[coneilen]

Summary

Fix qualified matched-action setup failing after the production worker definitions import: its topology installation and seed lifecycle helpers were accidentally nested inside Start-CapOfflineSeed. Expose those existing helpers at shared script scope and prove qualified preparation without granting product/provider launch authority.

Changes

• Move Install-CapQualifiedActionTopology, Start-CapMatchedActionSeeds, and the tightly coupled Close-CapMatchedActionSeeds to top-level worker scope. Installer, cleanup, and ordinary offline-seed tokens remain unchanged apart from removing the nested definitions.
• Add -PrepareOnly to the shared matched-action seed helper: publish the same immutable session manifest and record the same invocation, then return PREPARED_NO_LAUNCH before launcher creation. Default launch, custody, readiness, journal, receipt, and cleanup paths remain unchanged.
• Have the exact production -DryRun resolve all three imported helpers and prepare every bound qualified topology/seed plan before its existing harmless custody child. Preserve explicit phase/source/DPI/window binding checks from Bind action phases to source-derived capture window identities #951 and all fail-closed authorization checks.
• Add 16 separately counted topology/import contracts and require them in ValidationRunner alongside the unchanged 182/185 baseline, 18 import contracts, and 57 window-identity contracts. Extend the existing accepted production-entry fixture to verify all five qualified preparation paths.
• Document no-launch evidence limits. No product source, parity-ledger, capture campaign, raw failure archive, or original qualified topology edits.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\ActionTopologyImport.Tests.ps1 -ScratchRoot C:\gcth\red -> FAILED: Production DefinitionsOnly import did not expose Install-CapQualifiedActionTopology.
GREEN: pwsh -NoProfile -File Tools\windows\Tests\ActionTopologyImport.Tests.ps1 -ScratchRoot C:\gcth\green4 -> 16/16 passed, zero skips.
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 -> PASS; positive UiCaptureDriver 182/182, ActionWorkerImport 18/18, ActionWindowIdentity 57/57, ActionTopologyImport 16/16, zero skips.

Additional exact local commands and results:

• pwsh -NoProfile -File Tools\windows\Tests\ActionWorkerImport.Tests.ps1 -ScratchRoot C:\gcth\entry1 -> 18/18 passed, zero skips; actual production entry success and prelaunch setup refusal, including five qualified topology/seed preparations.
• pwsh -NoProfile -File Tools\windows\Tests\ActionWindowIdentity.Tests.ps1 -ScratchRoot C:\gcth\identity57 -> 57/57 passed, zero skips.
• pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -PrepareFixturesOnly -ScratchRoot C:\gcth\prebuilt -> prepared exact owned fixture inventory; manifest SHA256 9CE6BA0F142A865F63F5963A3ED7646507EBA8643EEE8B40D9CA48AEAE66B242.
• pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot C:\gcth\baseline182 -PrebuiltFixtureManifest C:\gcth\prebuilt\fixtures.json -PrebuiltFixtureManifestSha256 9CE6BA0F142A865F63F5963A3ED7646507EBA8643EEE8B40D9CA48AEAE66B242 -> 182/182 passed, zero skips.
• pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot C:\gcth\real185 -PrebuiltFixtureManifest C:\gcth\prebuilt\fixtures.json -PrebuiltFixtureManifestSha256 9CE6BA0F142A865F63F5963A3ED7646507EBA8643EEE8B40D9CA48AEAE66B242 -RequireRealSeed -RealSeedZmxPath C:\gcth\runtime\zmx.exe -RealSeedZmxSha256 447B8E94FE5A72D0B7D0F8C614BBEFDE597DFB864FD38278DB53AE98A921EC0B -> 185/185 passed, zero skips.
• pwsh -NoProfile -File Tools\windows\validate.ps1 -Task hardening -> PASS 3/3 repeated deterministic runs; owned environment target intentionally not run.
• pwsh -NoProfile -File Tools\windows\validate.ps1 -Task privacy -> PASS.
• pwsh -NoProfile -File Tools\windows\validate.ps1 -Task tdd-evidence -> PASS, including TddEvidence.Tests.ps1.
• pwsh -NoProfile -File Tools\tdd\Test-TddEvidence.ps1 -BodyPath C:\Users\coneilen\.copilot\session-state\0bf42501-267f-42cb-8731-c68c8afb5a4b\files\pr-body.md -> PASS against this complete template body.
• PowerShell parser checks on all five changed PowerShell files, working-file LF check, staged git ls-files --eol, and git diff --cached --check -> PASS.

Committed-source no-product proof: the unchanged production Invoke-MatchedActionSupplement.ps1 -DryRun ran against tested head a3479f36c79689b2d6c27ed808cf11f8d10a8e66, tree d13e40c6bb7298ae23a119860a942d42f8502086, using fresh owned copies of hash-verified historical qualified inputs. Its exact invocation was:

& Tools\windows\Invoke-MatchedActionSupplement.ps1 -Repository $PWD -OwnedRoot C:\gcth\production-head -ActionPlanPath C:\gcth\production-head\action-plan.json -ActionPlanSha256 D9675C34C8FD0E096176D70B9A5937E2395863E0ED6026C94CC495C13F236498 -DryRun

Result: COMPLETE / RELEASED_ZERO_SURVIVORS / DRY_RUN_NO_AUTHORITY; all three helpers available, all five qualified layouts and immutable seed plans prepared (session counts 2/3/1/12/2), six nonnull source-bound identities before the harmless launcher, five numbered journal publications, held job empty and launcher stdout/stderr EOF. Forty artifact hashes retained; proof SHA256 55D718FA190706DB69C091D2E12497F55931AB235AD0811CEA58AA24AE8B126D. Product launches, provider launches, completed action receipts, and PNGs are all zero.

Evidence limits: the real-zmx regression uses isolated required test fixtures, not a product action campaign. Prepared manifests, modeled cleanup, and launcher EOF do not prove mounted provider generations, target-private EOF, native input, persistence, runtime product windows, visual parity, or W1-W6 completion. Historical qualification is byte provenance, not current action authority. No old authorization was reused. No macOS make test/make check ran on this Windows host; the unchecked checklist entries below are intentional.

Failure history retained separately: the original behavioral/lexical RED logs were never overwritten. Early helper-suite attempts exposed test-fixture setup/diagnostic mismatches (unset synthetic job, platform-specific missing-file text, and PowerShell empty-array assignment); the corrected full 16-case suite and the exact ValidationRunner passed. No guards, baseline denominators, or required checks were removed or weakened.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure