[tib8]

Windows can timestamp suspend just before a session lock, or report another lock while resuming a session that was already closed. These sequences could incorrectly mark a complete day as incomplete and exclude its work sections from workbook export.

Keep sleep/resume context independently of the retained work transitions. Prefer the native closing record within five seconds after suspend, preserving exact timestamps and break-pair identities. Recognize lock-screen notifications from five seconds before through 60 seconds after wake, including equal timestamps with unrelated Security/System record IDs. A real unlock or reconnect ends duplicate suppression immediately; unexplained repeated events and cross-session ambiguity remain visible for review.

Validation:

• 97 Core checks passed, including the original contributor's regression checks and additional suspend/resume cases.
• 11 Windows checks and 35 UI/bridge checks passed.
• 117 synthetic event sequences passed the comparative review matrix.
• Full Release solution build completed with no warnings or errors.

No personal event-log data is included.