6bed5d9e8e
Owner-confirmed on glass (2026-06-25, "works great"): the IDD-push primary path captures the lock/UAC secure desktop AND input reaches the streamed console session. This was the single biggest open risk — the whole capture strategy (Decision B: IDD-push primary for everything incl. secure desktop, WGC/DDA demoted) rested on it. Now proven, not asserted. - §15: M3 row → DONE (secure desktop); removed the secure-desktop gate from "What genuinely remains" (renumbered); added it to "Resolved since §11". - §11 "IDD-push input + secure desktop" open item → RESOLVED. - §14 critique "SINGLE BIGGEST RISK: the secure-desktop claim" → RESOLVED. The WGC-relay / secure-DDA path is no longer load-bearing — kept only as a non-IddCx-hardware fallback. Remaining rewrite work is migration/cleanup (M4 gamepad drivers, M5/M6, slot-reclaim), none blocking the validated path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>