feat(windows): rebuild converter UI with guided Fluent workflow

.github/workflows/mh3g-converter-windows-ui-quality.yml

@@ -0,0 +1,44 @@
+name: MH3G Converter Windows UI Quality
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "apps/mh3g-save-converter-windows/**"
+      - "scripts/verify-mh3g-save-converter-windows-ui-quality.py"
+      - "scripts/capture-mh3g-save-converter-windows-ui-quality.ps1"
+      - ".github/workflows/mh3g-converter-windows-ui-quality.yml"
+
+jobs:
+  source-contract:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - run: python3 scripts/verify-mh3g-save-converter-windows-ui-quality.py
+
+  native-build-candidate:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with: { targets: x86_64-pc-windows-msvc }
+      - uses: actions/setup-dotnet@v4
+        with: { dotnet-version: "8.0.x" }
+      - name: Build native converter sidecar
+        run: cargo build --release -p mh3g-save-convert --target x86_64-pc-windows-msvc
+      - name: Publish WinUI candidate
+        shell: pwsh
+        run: ./scripts/package-mh3g-save-converter-windows.ps1 -ValidateOnly -SkipTests -SkipTransactionSmoke
+      - name: Upload candidate for interactive evidence runner
+        uses: actions/upload-artifact@v4
+        with:
+          name: mh3g-windows-ui-quality-candidate
+          path: artifacts/mh3g-save-convert-windows-x64/**
+          retention-days: 7
+
+# GitHub-hosted Windows runners build the native candidate but are not treated
+# as an interactive desktop or human usability environment. Runtime screenshots,
+# UI Automation, focus, high-contrast, text-scale, and motion evidence must be
+# captured by the checked-in PowerShell harness on an interactive Windows runner.

.ui-os/design/DIRECTIONS.md

@@ -0,0 +1,85 @@
+# Windows Standard design directions
+
+Both directions consume the independently reviewed task-time research run `windows-winui3-standard-20260813` and preserve the same shared product kernel, action identities, state scopes, confirmation, fingerprints, backup, manifest, and rollback behavior. They differ in structure, not palette.
+
+## Direction A — Guided Fluent workspace (selected)
+
+**Shape:** one WinUI `NavigationView` owns application destinations. Convert owns a bounded four-step task whose current step is rendered in one work surface with a persistent command footer.
+
+```text
+NavigationView          Convert content
+Conversion              Step 1 of 4 — Input
+  Convert save          [mode] [slot]
+Records                 [3DS source selected-path row]
+  History               [current reference in Repair]
+Advanced                [output selected-path row]
+  Experimental CEC      [technical details disclosure]
+Application             --------------------------------
+  Settings              status/reason + Fix    [Inspect]
+```
+
+### Full flow
+
+1. **Input** — choose source, optional read-only current reference, and output; Inspect is the sole primary action.
+2. **Optional Data** — all domains are off by default. Enabling a domain reveals only its required paths and independent actions. **Skip optional data** removes only optional intent; **Continue to Dry Run** never requires optional configuration.
+3. **Dry Run** — a Ready/Needs action list explains the exact core transaction. The sole primary action is **Run Dry Run**. A blocker sits in the footer with one local Fix.
+4. **Write / Result** — authorized fingerprints lead to native `ContentDialog` confirmation. Running feedback stays local with stable CTA geometry. Success/failure shows report and rollback without false success.
+5. **History** — current-session history only; empty state offers **Start conversion** and never hosts conversion blockers.
+6. **Experimental CEC** — isolated advanced route with its own acknowledgement and transaction sequence.
+7. **Settings** — language, CLI fallback, update checking and accessibility/motion diagnostics; no conversion blocker.
+
+### Expert path
+
+- Windows standard Tab/Shift+Tab order follows task order.
+- `Alt` access keys are attached to frequent route/primary commands where WinUI supports them.
+- Enter/Space activates focused commands; Escape cancels confirmation and returns focus to the invoker.
+- No keyboard shortcut bypasses Inspect, Dry Run, expected-hash binding, confirmation, or rollback evidence.
+
+### Why selected
+
+- Most legible at the 920×600 minimum and at increased text scale.
+- Separates application navigation from ordered transaction progress.
+- Makes the disabled reason, Fix, and current primary action one stable local unit.
+- Keeps first-time guidance while progressive disclosure protects expert density.
+- Maps directly to native `NavigationView`, `InfoBar`, `Expander`, picker, progress and dialog primitives.
+
+## Direction B — Compact operation canvas (rejected)
+
+**Shape:** the same app `NavigationView`, but Convert presents a persistent source/current/output comparison canvas with a right-side transaction inspector and collapsible task sections.
+
+```text
+NavigationView     Source / current / output      Transaction inspector
+Convert            [path summary rows]            status + next action
+History            [Inspect details]              Dry Run evidence
+CEC                [Optional details]             Write / rollback
+Settings
+```
+
+### Full flow
+
+- Users can inspect or replace any selected input without moving between steps.
+- Optional System/ExtData attach beneath their related source/target row.
+- Dry Run, write confirmation, result and recovery stay in the transaction inspector.
+- History may reopen a previous session result into the inspector without mutating inputs.
+
+### Why rejected
+
+- At minimum width or 150–200% text scale the comparison and inspector compete, forcing either horizontal compression or a long stacked canvas.
+- First-time users must understand the source/current/output topology before seeing a single next action.
+- Persistent transaction inspector risks duplicating state already present at the affected input or result surface.
+- It is faster for expert repeated repair, but that efficiency does not outweigh weaker first-run clarity for this Pilot.
+
+## Decision matrix
+
+| Criterion | A Guided Fluent workspace | B Compact operation canvas |
+| --- | ---: | ---: |
+| Five-second task clarity | 5 | 3 |
+| Information hierarchy | 5 | 4 |
+| Minimum-window behavior | 5 | 3 |
+| Windows native fit | 5 | 4 |
+| Keyboard/focus predictability | 5 | 4 |
+| Text scaling / zh-Hans | 5 | 3 |
+| Scoped recovery | 5 | 4 |
+| Expert repeat efficiency | 4 | 5 |
+| Cross-screen consistency | 5 | 4 |
+

.ui-os/design/DISCOVERY.md

@@ -0,0 +1,78 @@
+# Windows UI Quality OS discovery
+
+## Verified repository baseline
+
+- Repository: `MHToolkit/mh-save-sync`.
+- Isolated worktree: `/Volumes/GameHub/Development/Games/mh-save-sync-windows-ui-quality-os`.
+- Feature branch: `feat/mh3g-windows-ui-quality-os`.
+- Baseline: `origin/main` at `b3d58f70aa713b5e7f0ba7397d745b7166925547` (`v0.0.18`).
+- Target stack: unpackaged **WinUI 3**, .NET 8, Windows App SDK `1.8.260710003`, Windows 10 1809 minimum, x64 self-contained packaging.
+- Backend boundary: the existing C# presentation invokes the bundled Rust CLI as independent argv elements. Rust remains authoritative for inspection, dry-run authorization, expected hashes, transactional write, manifest, backup, and rollback.
+
+## Runtime baseline status
+
+A downloaded portable executable exists at `/Users/vincentadamnemessis/Downloads/MH3GSaveConverter-Portable-x64.exe`, but it is an older, provenance-uncertain artifact (timestamp 2026-08-01; embedded assembly version `1.0.0.0`) and is not tied to the current `v0.0.18` source hash. This macOS host has no active Windows VM or native Windows runner. Previous GameHub execution was already reported unusable and is not repeated.
+
+Therefore **current Windows runtime baseline screenshots, UI Automation tree, focus traversal, High Contrast, text scaling, and animation evidence are BLOCKED/UNVERIFIED**. The Pilot may improve source, fixtures, source-level gates and Windows CI capture support here, but must not label cross-compilation or static XAML inspection as Windows runtime proof.
+
+## Existing surface inventory
+
+The current app is one 1,240×900 `ScrollViewer` containing the entire product:
+
+- fixed top brand/status/language strip;
+- a large illustrated hero and a four-item visual stage strip;
+- five post-operation `InfoBar` continuations;
+- source/current/output/CLI controls;
+- Inspect, progress inspection, event inspection, Dry Run, Write, rollback;
+- shared `system`, ExtData, CEC, latest report, and operation history;
+- 43 buttons, 16 text boxes, 8 InfoBars, 104 text blocks, 28 hard-coded ARGB colors;
+- no `NavigationView`, no `Expander`, no stable `AutomationId`, and no deterministic UI fixture launch contract.
+
+The `StageArtwork` control swaps among five raster images and overlays a second stage presentation. Hard-coded light surfaces and text colors bypass theme and High Contrast resources. A single long surface means task scope, utility scope, history, status, and recovery compete vertically.
+
+## Baseline problems to solve
+
+1. **No primary navigation:** core conversion, optional transactions, CEC, history, report, update, and rollback are stacked into one document.
+2. **Repeated state/navigation:** top status, hero stage labels, stage artwork, InfoBars, section copy, and action availability all describe the same progression.
+3. **Primary action distance:** Inspect, Dry Run, Write, rollback, and their explanations live in different columns or far-apart vertical regions; the correct next action is not stable at the first screen.
+4. **Optional-data contradiction:** `SelectedOptionalDataIsConfigured` currently disables core Dry Run and Write whenever an enabled optional domain is incomplete. This makes “optional” a global core blocker.
+5. **Scope leakage risk:** all global InfoBars and optional controls share one root surface, so unrelated history/report/settings content has no structural boundary from optional warnings.
+6. **Repair path cognitive load:** source, read-only current reference, output, version detection, and CLI path appear as one uninterrupted technical form.
+7. **Technical detail dominance:** CLI path, hashes/reports/manifests, file topology and transaction implementation remain in primary reading order.
+8. **Theme/accessibility debt:** hard-coded colors, missing stable AutomationIds, no explicit minimum-size contract, no deterministic keyboard/High Contrast/text-scale fixture coverage.
+9. **Decorative displacement:** the hero and stage artwork consume the highest-value area but do not select a step, fix a blocker, or authorize a transaction.
+10. **No causal motion contract:** stage artwork transitions exist, but async action acknowledgement, local dependency reveal, selected-path confirmation, and reduced-motion equivalents are undefined.
+
+## Shared product kernel
+
+The Windows profile must preserve the already established cross-client task semantics:
+
+`Select source / read-only current reference / output → Inspect → configure or skip Optional Data → Dry Run → Confirm Write → Result / Rollback`
+
+- New conversion omits the current-reference input.
+- Repair keeps source, current reference, and output as three independent roles.
+- Optional transactions are opt-in and independently authorized; skipping them never weakens or blocks core conversion.
+- Experimental CEC remains an advanced, independently acknowledged transaction.
+- No fixture may execute the CLI, touch a real save, or report a synthetic write as real success.
+
+## Delete / merge before adding
+
+| Delete or merge | Windows destination / reason |
+| --- | --- |
+| Large hero and `StageArtwork` | Remove from operational flow. Keep only a compact product mark and, if useful, one small non-interactive empty-state vector. |
+| Four visual stage labels | Replace with one bounded step indicator inside Convert; it communicates location but is not a second app navigator. |
+| Top status badge and five global continuation InfoBars | Render state once at the narrowest affected surface; put the next action in a persistent task footer. |
+| One giant ScrollViewer | Use a native grouped `NavigationView`: Convert, History, Experimental CEC, Settings. |
+| Dry Run/Write side card plus remote reasons | One current-step surface; disabled CTA has one adjacent reason and executable Fix. |
+| Always-visible CLI path | Move to Settings/technical disclosure; bundled sidecar remains the default. |
+| Raw report/hash/manifest in primary order | Move to `Expander`/dialog technical details except confirmation and recovery-critical evidence. |
+| Global optional readiness gate | Scope incomplete optional paths to that component only; core Inspect/Dry Run/Write stay independent. |
+| Raster control-like artwork | Use licensed WinUI `SymbolIcon`/font glyphs for interaction and theme-aware vectors for any retained empty-state illustration. |
+
+## Baseline machine evidence
+
+- `scripts/verify-mh3g-save-converter-windows-source.py`: PASS on baseline.
+- `cargo test -p mh3g-save-convert`: 220 passed on baseline.
+- `cargo clippy -p mh3g-save-convert --all-targets -- -D warnings`: PASS on baseline.
+- macOS `dotnet build --no-restore`: expectedly failed because the isolated worktree had no restored Windows-target assets; this is environment evidence, not a product regression.
+