fix: harden v1.2.0 Phase 2 visual progress

[HelloThisWorld]

Summary

Phase 2 itself was already merged to main in #23 before this work began. This draft is a focused follow-up audit and hardening change based on d84d1e1f3a8931f1fa13a795acdc3c0ff69c3040; it fixes renderer lifecycle gaps and recognition/suppression safety defects without duplicating or reverting the shipped Phase 2 architecture.

Phase 1 dependency #22 is merged. Its final feature head was f686b6904fec94aeb9d6fe83770b3d8567362db6, with merge commit e04724a4822feba0a93158719ba9dc7b95d3a30c. Because both #22 and #23 are merged, this branch starts from current main and this PR targets main; there is no remaining stacked-PR rebase or retarget step.

No merge, tag, GitHub Release, website update, version bump, workflow redesign, package change, or Phase 3 feature is included.

Related issues

Follow-up to #22 and #23. No issue is auto-closed.

Detailed changes

Rainbow Arc renderer hardening

• Replaces non-authoritative CoreWindow visibility/focus state in the Win32 XAML-Islands host with the existing HWND lifecycle owned by TerminalPage.
• Propagates visible/focused state through every tab and recursive pane tree, including new/restored tabs, renderer creation, and newly split children.
• Starts renderers unfocused, pauses continuous motion and sparks while unfocused/hidden, and resumes from authoritative host state.
• Rebinds compositor geometry animations after the track width or vertical origin changes so resize does not retain stale comet endpoints.
• Adds light-surface running/waiting/success/error colors matching App.xaml, while preserving system-color High Contrast and Reduced Motion fallbacks.
• Makes zero/unknown-progress error state visible with a red track and a head parked at the zero boundary; it does not fabricate fill or percentage.

The renderer remains pane-local and composition-driven: no CPU frame loop, permanent per-pane timer, per-frame gradient recreation, terminal-buffer repaint, or viewport relayout was added.

Recognition and replacement hardening

• Preserves a high-confidence built-in owner only across another progress-shaped candidate; ordinary output clears all provider ownership, curl/wget anchors, bounded Docker/BuildKit tables, and generic heuristics so a later command cannot inherit suppression authority.
• Gives Wget anchors an explicit preserve-only indeterminate match, while an intervening ordinary record invalidates the anchor.
• Supports bounded two-record Rich pip meters and shared-unit values such as 1.0/2.0 MB.
• Allows a wheel announcement to establish pip context; generic source archives require a prior explicit pip signature. Strict extension boundaries reject .zipper-style substrings, and bare .zip/source-archive downloads remain Generic/overlay-only.
• Recognizes tagged and untagged Maven Resolver transfer records while keeping Maven stages indeterminate unless a real transfer value exists.
• Adds Generic overlay-only recognition for spinners, speed plus ETA, and repeated carriage-return structural shapes; Generic never overrides a valid built-in, never suppresses text, and emits a structural hidden update when progress-like output ends.

Supported built-ins remain Docker Pull, Docker BuildKit, pip, Git, curl, wget, npm, pnpm, yarn, nvm, Maven, Gradle, and the Generic fallback.

Only high-confidence whole-record transient frames from pip, Git, curl, and wget can be replacement candidates, and only when the renderer, parser, normal-screen, cursor-origin, ANSI, fragmentation, warning/error, and preview-setting gates all pass. Docker, BuildKit, npm/pnpm/yarn, nvm, Maven, Gradle, and Generic remain overlay-only. Newline logs, fragments, prompts, warnings, errors, summaries, unsafe CSI/SGR, malformed input, alternate-screen output, and renderer/parser failures are preserved.

Hard limits and privacy

• Spark pool: 8 live sparks per pane; 24 shared per process/window budget.
• Recognition: 32 Ki UTF-16 code units per chunk, 2,048 code units per current line, 64 code units per ANSI sequence, 8 recent structural progress records, 32 Docker layers, and 32 BuildKit steps.
• Publication interval: 50 ms (at most about 20 normalized updates per second), with the existing one-element UI mailbox/coalescing path.
• Provider state retains structural IDs, counts, bounded signatures, and character-class hashes only. No command text, package/image names, paths, URLs, credentials, or terminal output is logged, persisted, uploaded, or added to telemetry.

Focused commits

• af3b45f75 — fix: harden Rainbow Arc renderer lifecycle
• f9ce93a33 — fix: harden Visual Progress recognition
• 435b940be — test: expand Visual Progress Phase 2 coverage
• 6f1191525 — docs: clarify Visual Progress Phase 2 hardening

Validation performed

Environment: local Windows x64 toolchain, Release configuration, Visual Studio/MSBuild 17.14.51, TAEF 10.100k.

• ./scripts/winterm/test-visual-progress.ps1 -SourceOnly — PASS.
• PowerShell AST parser validation for test-visual-progress.ps1 and the existing smoke script — PASS.
• LLVM clang-format --dry-run --Werror over every changed standalone Visual Progress header/test source — PASS.
• ./scripts/winterm/test-ci-classification.ps1 — PASS.
• Exact committed file set classified as code: fast build true, full build false, package false.
• ./scripts/winterm/verify-version.ps1 — PASS; application 1.1.3, package 1.1.3.0, module 1.1.3, all schema versions unchanged.
• ./scripts/winterm/build.ps1 -Configuration Release -Platform x64 -IncludeTests — PASS in 353 seconds; only pre-existing PRI localization warnings were emitted.
• After the final recognizer-only fixes, targeted x64 Release MSBuilds of TerminalControlLib.vcxproj and SettingsModel.UnitTests.vcxproj — PASS (about 41–43 seconds per incremental run).
• Focused compiled ownership/archive/Maven/Wget/curl/suppression regressions — PASS.
• ./scripts/winterm/test.ps1 -Suite Relevant -Configuration Release -Platform x64 on the final tree — PASS: Settings Model 226/226, Terminal App 51/51, Control 30/30, plus all relevant source/privacy/branding/version checks.
• git diff --check origin/main...HEAD — PASS.
• Independent final diff review — no remaining actionable findings.
• GitHub Actions run 30681847846 — PASS: Classify exact change set (24s), Quick source and smoke validation (34s), x64 Release build and relevant tests (27m38s), and ci-gate (11s). Package/delivery and matrix-only jobs were skipped as expected for the code-class diff.

Not run:

• Packaged/unpackaged interactive visual smoke and synthetic provider demo: requires launching and visually inspecting the Windows UI; source contracts and model behavior passed, but dark/light, 100/125/150/200% DPI, narrow/maximized/zoomed/multi-pane layouts, resize, focus/minimize, success/error appearance, and device-loss recovery still require hands-on QA.
• Optional long soak, high-throughput multi-pane benchmark, and real Docker/Node/Python/Maven/Gradle network commands: these are deliberately outside ordinary CI and would depend on local tools or external downloads. The bounded compiled stress/fragmentation/reset coverage ran in the Relevant suite.
• Full/package/delivery test modes and installer/portable validation: the authoritative classifier selects the code fast-build path, and this PR changes no workflows, project files, packaging, installer, release, or delivery assets.

Known limitations and Phase 3 exclusions remain unchanged: no polished settings UI, adaptive governor UI, labels/ETA text, notifications, history, external parser plugins, persistence, telemetry, website work, or v1.2.0 release preparation.

Checklist

• The change is focused and does not include unrelated formatting.
• Tests were added or updated where appropriate.
• All tests claimed above actually ran and passed.
• User-facing behavior and limitations are documented in this repository.
• Version and schema remain unchanged; application version is still 1.1.3.
• Package identity, winterm.exe, and Microsoft Terminal coexistence remain isolated.
• No command text, terminal output, clipboard content, credentials, or private paths are logged.
• No new source or script files were added; existing license headers remain intact.
• I did not include generated build output, secrets, certificates, or local absolute paths.
• No tag, GitHub Release, merge, or release asset was created.