Pup - Puppeteer Bridge

Temporary diagnostic instrumentation on the birth-capture block to find why hwnd resolution stopped producing results (logs fresh/profile/beforeHwnds, per-iter rows/offscreen/newOff counts, and any thrown exception) - to be removed once the root cause is found

Make the 2.0.34 set-diff birth capture actually resolve under concurrency: widen the off-screen birth spacing from 40px to 220px so disambiguating concurrent births by nearest-birthLeft is unambiguous against Chrome placement jitter (the 18px tolerance was too tight and left every concurrent birth AMBIGUOUS with nothing stamped; 60px had been too loose and cross-wired). New windows are identified by set-diff, then the one nearest my unique birthLeft is mine

Fix cross-wired taskbar identity John caught (fusion and nb resolved to the SAME hwnd, so one thread stamped its AUMID onto the other's window and the loser stayed a grouped raw-Chrome button while a pup tile showed no overlay): the birth-time hwnd capture is now a SET-DIFF (snapshot window handles before createTarget, the NEW off-screen handle not present before and not already owned by any session is ours by construction) instead of a coordinate match whose 60px tolerance overlapped the 40px birth spacing; concurrent births disambiguate by the unique birthLeft with an 18px tolerance; and a hard guard rejects any handle already owned by another live session at every resolution path (birth, geometry, off-screen re-capture) so two windows can never share one handle

Let the off-screen re-capture run even while a window is in the geometry-resolution backoff (the backoff only suppresses the geometry hammering, not the definitive re-capture that actually fixes the bare window), with a 30s per-window cooldown so it moves the window at most once per half-minute

Self-heal bare BACKGROUND pup windows that have no birth handle (opened before the 2.0.31 fix, or re-attached by recovery/drag-out) on a crowded shared profile where geometry cannot disambiguate: as a last resort the resolver briefly moves the window's own CDP target to a unique far-off-screen slot, enumerates to grab the window now at that exact coordinate (unambiguous identity by construction), then restores it on-screen at z-bottom and re-parks. Invisible because the window is already background z-bottom, and never done to a window the user is using. Gives an on-screen window the same reliable handle a birth-time window gets, so its AUMID and overlay finally paint

Fix raw-Chrome taskbar icons on pup windows, the regression from removing the title tag: killing the title tag in 2.0.24 silently removed the shared-profile fallback that BOTH the identity stamp (titleContains) and hwndBelongsToPup (v1.9.350 title-ownership proof) relied on, so any window whose hwnd did not resolve got no AUMID and no overlay and showed a raw flashing Chrome button. Fixes: (1) birth-time hwnd capture now matches the window by its UNIQUE off-screen birth position instead of by pid membership, which was empty for the shared adom-you Chrome process whose real pid is untracked; (2) hwndBelongsToPup now trusts a birth-captured handle as proof of ownership by construction, no title and no pid tracking needed, and learns the pid so sibling windows on the shared process pass instantly. Identity and overlay no longer depend on the title tag at all

Fix the jump-list tasks broken by the 2.0.28 ownership gate: a click on a pup window's own taskbar jump-list is the USER operating their own window (caller aiThread user-taskbar-menu) and is always sanctioned, so it bypasses the ownership gate, the omitted-sessionId active-window resolution, and the dead-session hard error; and pup_close with no sessionId is the global close-all by design and is never gated or resolved to the active window. The Close ALL task, the Owned-by info card, and both wiki view-switch tasks all work again

Close issue 42, the wiki sign-in race across shared-profile pup windows: auto-sign from the desktop wiki token now runs for the shared adom-you profile on ANY adom URL that is not the deliberately-anonymous public or isolated view, not only when wikiView:authed is explicitly requested, so a fresh window whose shared cookie has not landed yet no longer paints signed-out while its siblings show signed-in; it fires only on a definite 401 (never a probe timeout) so an already-signed-in window is never re-navigated, and it schedules an overlay repaint so the taskbar hover thumbnail drops any cached signed-out frame

Close issue 41, the isolation hole the nb thread caught that masqueraded as a cross-thread takeover: a verb naming a DEAD sessionId now hard-errors with session_not_found and the live-session list instead of silently falling back to another thread's active window, and per John's ai-thread model the activeSessionId implication is deleted from every session-targeting verb: omitted sessionId resolves to the CALLER THREAD's own window (the shared ai-thread-slug keying pup_open_window uses, or the single window the thread owns by explicit name), with a teaching error when the thread has none or several; the ownership gate also now covers resolved targets, not just explicitly named ones

The PowerShell deletion on ab 2.0.16 native verbs, closing the ab64 commitment: z-order, foreground reads, user-idle, window enumeration by pid and class, hwnd owner validation, parent-pid checks, send-to-back, lower-by-pid, and the taskbar attention clear are all precompiled-Rust ab calls now (roughly 20ms each versus 300ms runtime-compiled PowerShell spawns), the EnumWindows resolver and its temp-file EBUSY class are gone, the zero-caller osMinimizeToBackground and osBackgroundWatchdog are deleted, the synchronous PowerShell runner itself is deleted with zero callers remaining, internal identifiers adCommand and adPayload renamed to abCommand and abPayload, and the user-foreground doctrine got the fix John's question exposed: an ever-user-raised window stays hands-off for as long as it remains OS-foreground with no ten-minute clock, the recency window only applies once the user has left. Five scripts remain by design: the focus-raise dance x3 (works today, wishlisted for a native raise verb), base-icon extraction, and the credential import scan, all async-only

Stop fighting the user for the window: the post-open re-assert timers called the z-bottom primitive with force (needed for Chrome PDF self-activation pops) which also demoted a window the USER had just raised from the taskbar, because the session-flag guards lag the click by seconds. The primitive now checks GetLastInputInfo in the same PowerShell pass: OS-foreground plus user input within 5s means a human raised it, so it returns user-foreground instead of bottoming even under force; a PDF self-pop with idle hands still gets demoted. All re-assert and park callers stop retrying on that signal and mark the session userActive so every later demotion timer skips it for 10 minutes

One visible taskbar mutation per window open instead of three, from John watching the button live: the create-time identity stamp fired before session registration so its result was never recorded and the post-park re-brand recreated the button again with the identical appId (pre-registration stamps are now remembered and adopted at registration so the second stamp truly no-ops), and the favicon overlay no longer races onto the still-Chrome button just to be wiped by the stamp (young windows defer overlay until identity lands, stamp-once then overlay-once, with a 30s grace so an unstampable window is never left bare)

Title mangling fully dead, completing what John asked when the jump-list owner task shipped: the three legacy always-on title-suffix injectors (launch path, adopted-tab retag, post-navigate) predated the titleTag setting and kept appending the ai-thread/profile suffix with their own observers; they now stamp only the invisible window.name carrier and strip legacy tags, installing nothing and observing nothing. Ownership is conveyed solely by the jump-list Owned-by task and the pup_window_info native card

Zero synchronous PowerShell: all 7 remaining execFileSync window-management helpers (idle probe, foreground reads, force-activate, the three backgrounding paths, z-bottom, flash-clear) are now async with every call site awaited, so pup's event loop can never again stall on a powershell spawn and starve ab's health probe (the ab61 reap trigger); the sync runner carries a do-not-add-callers tombstone until ab ships native window verbs and PowerShell is deleted outright

Caption card copy polish: replace em-dashes with middots in the pup_window_info native card per the house style for user-facing copy

Ownership conveyed the way John designed it instead of title mangling: every pup window's jump-list now leads with an 'Owned by: ' task, and clicking it runs the new pup_window_info verb, which paints a native always-on-top click-through caption card just above the taskbar (ab desktop_caption, 12s auto-dismiss) showing the owning thread, container, profile, tabs, window age, last agent action, and any takeover history; the verb also returns the same info as JSON for AI callers and is read-only and never owner-gated

Hotfix for the frozen-window regression John hit within the hour: revert the titleTag default to off (the v2.0.19 flip re-armed the documented title-observer ping-pong that pegs renderers and froze hd-publish-1.0.0), harden the opt-in observer to only ever watch a real title node instead of the whole document subtree on titleless pages, and make takeover:true on one-shot verbs act without stealing ownership so a sanctioned repair reload does not lock the original thread out of its own window

Hard window ownership keyed on caller identity: every window-mutating verb naming an explicit sessionId is refused with session_owned_by_another_thread when that session belongs to a different AI thread (the old gate compared only the optional args.owner field and covered just navigate and close, so undeclared callers could take over other threads' windows, the kicad-vs-nb incident John caught); takeover:true is logged with both thread names and reassigns ownership. Ownership is now user-visible too: the ai-thread title tag defaults on so taskbar hover and Alt-Tab name the owner, and the jump-list header carries the owning thread

Negative-result backoff on window-handle resolution: a shared-profile window that cannot be disambiguated was re-probed with PowerShell EnumWindows passes on every overlay, park, and flash touch, forever; three straight misses now put that session on a 5-minute resolution cooldown (any real handle landing clears it). Ends the hot loop that burned laptop CPU and blocked the event loop so often that ab's 1500ms health marker probe timed out against a live bridge, judged it unhealthy, and reap-looped it, the other half of the 557 flap

EADDRINUSE self-heal for the 557 permanent-outage loop: when a replacement pup spawn finds its port held, it probes the holder's /health and, only if the holder identifies as a sibling pup bridge (by definition an orphan ab lost track of), kills that one pid and retries the bind with a 3-attempt cap; a non-pup holder is never touched and the process exits with a clear log. Turns the reaper-lost-my-pid outage from a manual taskkill into automatic recovery on the next verb