fix(launcher): harden LA11 gate evidence

docs/research/2026-08-14-campaign-la-test-script.md

@@ -180,8 +180,10 @@ The helper rejects nonempty output, invalid or non-monotonic versions, missing
 root executables (including the co-deployed Bake CLI), nonabsolute inputs,
 output/source overlap in either direction, and any reparse point in source or
 output ancestry. It enumerates normalized relative paths with ordinal ordering,
-never its own output, and normalizes ZIP host metadata so Windows/Linux hashes
-are identical under multiple cultures. It writes fixed-timestamp sorted ZIPs,
+never its own output, and normalizes ZIP origin to Unix on both hosts so
+Windows/Linux hashes are identical under multiple cultures while native Linux
+extraction retains 0755 for App/Headless/Launcher/Bake and 0644 for ordinary
+files. It writes fixed-timestamp sorted ZIPs,
 the exact LA10 v1 SHA/size manifest, `fixture-report.json`, a loopback-only
 server (with optional bounded `-MaximumRequests` smoke mode), and an atomic A/B
 selector. Both generated helpers reject a `-Root` other than their own fixture
@@ -233,8 +235,10 @@ session composer, and orchestrator must all use this one exact path set.
 
 For every play/probe row, start this gate-only PID watcher immediately before
 clicking Refresh/Play. It correlates only the unique isolated session-config
-path, records neither command line nor config contents, and must finish while
-the child is still live:
+path, records neither raw command line nor config contents, and must finish
+while the child is still live. Its safe sidecar contains the normalized config
+path, a sanitized command fingerprint, and PID plus an OS-native process-start
+identity so later PID reuse cannot become a false leak:
 
 ```powershell
 $CapturePath = Join-Path $Evidence '<ROW>-process.capture.json'
@@ -262,8 +266,7 @@ $Status = Join-Path $WinCache "launcher/sessions/$($Capture.sessionId)/status.js
 pwsh -NoProfile -File (Join-Path $Repo 'tools/test-campaign-la-session-status.ps1') `
   -StatusFile $Status `
   -Mode '<probe|guiSelect|gui|headless>' `
-  -ExpectedProcessId $Capture.processId `
-  -SessionConfigPath $SessionConfig `
+  -ProcessCapturePath $CapturePath `
   -CredentialProfilePath (Join-Path $WinConfig 'launcher-profiles.json') `
   -ExpectedSessionId $Capture.sessionId `
   -ReportPath (Join-Path $Evidence '<ROW>-status.validation.json')
@@ -273,14 +276,16 @@ Add `-ExpectedPlugin acdream.smoke` to rows D–F. The validator enforces exact
 v1 fields **and property order**, one session id, UTC monotonic timestamps,
 mode-specific lifecycle order, exit code 0/reason, no unexpected plugin/login
 command failure, exact terminal `disconnected.reason == stopped`, credential
-redaction, and that exact captured PID is gone. Optional config-path correlation
-uses Windows CIM or Linux `/proc/*/cmdline`; it never globally scans a process
-name, so unrelated same-name processes and Linux's 15-character names do not
-affect the result. The validator verifies owner-only profile access, reads only
-password/secret fields in memory, recursively checks every allowed status
+redaction, and that exact captured process instance is gone. Independent exact
+config-path correlation uses Windows CIM or Linux `/proc/*/cmdline`; it never
+globally scans a process name, treats a different start identity on a reused PID
+as a different process, and is unaffected by unrelated same-name processes or
+Linux's 15-character names. The validator verifies owner-only profile access,
+reads only password/secret fields in memory, recursively checks every allowed status
 string (including command/error text), and reports only the forbidden-value
 count and status hash—never credential content or a credential hash. Keep the
-profile and raw `session.json`/`status.jsonl` local; never upload them.
+profile, raw `session.json`/`status.jsonl`, and raw process-capture sidecar
+(which contains the absolute isolated path) local; never upload them.
 
 ## 5. Serial Windows user rows A–H
 
@@ -429,8 +434,7 @@ called. This connected row proves the actual ACE graceful-logout half. Issue
 pwsh -NoProfile -File (Join-Path $Repo 'tools/test-campaign-la-session-status.ps1') `
   -StatusFile (Join-Path $WinCache 'launcher/sessions/<SESSION_ID>/status.jsonl') `
   -Mode guiSelect `
-  -ExpectedProcessId '<CAPTURED_CHILD_PID>' `
-  -SessionConfigPath (Join-Path $WinCache 'launcher/sessions/<SESSION_ID>/session.json') `
+  -ProcessCapturePath (Join-Path $Evidence 'G-process.capture.json') `
   -CredentialProfilePath (Join-Path $WinConfig 'launcher-profiles.json') `
   -ExpectNoEnteredWorld `
   -ExpectedSessionId '<SESSION_ID>' `