[coneilen]

Summary

Prevent the capture supervisor's bounded live journal read from starving while the worker keeps publishing newer numbered snapshots. The preserved C8R run did not hit a rename or sharing failure: one transaction verified sequences 209, 215, 219, 225, and 230, then exhausted its one-second budget while chasing sequence 236, which poisoned later final stdout binding and kernel-cleanup proof.

Changes

• Accept the verified monotonic snapshot selected by the current live-read transaction and defer publications announced during decoding to the next 200 ms supervisor poll.
• Preserve the existing one-second I/O budget, eight Open attempts, seven retries, monotonic observed floor, absolute caller deadline, and fail-closed final hash-chain verification.
• Add a deterministic sequence-236 reproduction that proves the repaired path can later bind the exact terminal journal and clean FAILED manifest.
• Keep corrupt, missing, foreign, and stale highest-observed journals refused.
• Document the moving-head contract without changing the registered 182 default / 185 real-seed group totals.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -JournalMovingHeadContractOnly -ScratchRoot C:\Users\coneilen.copilot\session-state\ea4b497e-21af-44e5-b5d2-e3c9f8bd55b7\files\c8r-journal-red-236 -> JournalUnavailable sequence=236 after 1629 ms; 1 executed, 0 passed, 1 failed
GREEN: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -JournalMovingHeadContractOnly -ScratchRoot C:\g931f -> final rebased head 07da081, 1 executed, 1 passed, 0 failed
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot C:\g931r -PrebuiltFixtureManifest C:\g931p\fixtures.json -PrebuiltFixtureManifestSha256 308EE71413C409B1897DF25511796424B9C4D5D01D319833B80EA00DCCDC5ADB -> final rebased head 07da081, 182 executed, 182 passed, 0 failed, 0 skipped

Additional checks:

• TEMP=C:\g931v; TMP=C:\g931v; pwsh -NoProfile -File Tools\windows\Tests\ValidationRunner.Tests.ps1 -> PASS; UiScenario 166/166 and UiCaptureDriver 182/182.
• TEMP=C:\g931h; TMP=C:\g931h; pwsh -NoProfile -File Tools\windows\Tests\Hardening.Tests.ps1 -SkipTrayLive -> repeated-runs PASS 3/3.
• PowerShell parser checks for both changed PowerShell sources -> passed.
• git diff --check origin/main...HEAD -> passed.
• git ls-files --eol -- Tools/windows/UiCaptureDriver.psm1 Tools/windows/Tests/UiCaptureDriver.Tests.ps1 Tools/windows/UI-CAPTURE-SCENARIOS.md -> LF in index and worktree.
• pwsh -NoProfile -File Tools\tdd\Test-TddEvidence.ps1 -BodyPath C:\Users\coneilen\.copilot\session-state\ea4b497e-21af-44e5-b5d2-e3c9f8bd55b7\files\pr-body.md -> passed.

Exact-head and rerun provenance

The original head fc5f70a6ef019128b8f54c789e7f995f4fd00113 completed all required current-head checks successfully before rebase. It was rebased onto ec3b53e08ac51f94f93c89b5f458917366152e14 as 860f07ac2723cc55b412acffe1a6e96f03280f29, then rebased again after #931 onto current origin/main f3336f93ab74014cc02d25ff769c1c2e1bd92dcd as final head 07da08183e494574ce4e3f4aeb5cba39a2e49463. Every pre/post binary patch SHA256 is identically 67418F95CD9E5072E6C63A4F151F9B764419D42DA23F805DECAC776818ACBB4B.

Two exact-head ValidationRunner attempts passed UiScenario 166/166 and then refused fixture preparation because the short-lived existing vswhere.exe process exited before its initial native image attestation (ProcessImageAttestationUnavailable, kernel exit and EOF left UNPROVEN). No success was inferred from those attempts. A third unchanged exact-head run completed normally and passed both 166/166 and 182/182.

Preserved hosted failures and bounded retries

On intermediate exact head 860f07ac, Windows workflow run 40308907250 attempt 1 failed only its integration job 121524923340: uia-live-gate.ps1:2158 exhausted TreeWalker.GetFirstChild retries against a stale element after its parent UI closed. The same log proves UIA_PROCESS_TREE_CLEANUP=verified, UIA_PROVIDER_PROCESS_CLEANUP=verified, and WINDOWS_SHELL_DEFAULT_PROFILE_UNCHANGED=verified. Preserved failed-job log SHA256: B1FFEA8D4C361D9854F39093C9EEE2E4433FF61735DFB58255AC77B8A02FFC62.

Windows port run 40308907191 attempt 1 failed Swift job 121524907108 only because the ValidationRunner step reached its 15-minute hosted timeout after already proving UiScenario 166/166. Preserved failed-job log SHA256: 9E8A6F0944B437FAB54ECF5C80185DD0E28DA4E66D9B4BBE79CC78D65F37AC15.

One bounded failed-job retry was issued per completed workflow without an empty commit or source change. Attempt 2 passed completely: Windows integration job 121535057017, Windows summary job 121540688106, Swift job 121535060554, and spikes summary job 121547391461 all succeeded on unchanged 860f07ac.

Final exact-head CI on 07da08183e494574ce4e3f4aeb5cba39a2e49463 is fully green. Windows shell run 40319306334, Windows port run 40319305788, deterministic hardening run 40319305538, DCO run 40319305760, and live body validation run 40319352470 all completed successfully; path-gated jobs skipped as designed. The PR reports mergeStateStatus=CLEAN.

The earlier pre-rebase full run using the long session artifact path produced 179/182 because two existing seed-path cases correctly rejected a 278-character zmx lease path above the 240-character contract; the report-gate case then failed dependently. Its short-path rerun passed 182/182. No C8R capture, GUI launch, image capture, or lease consumption occurred.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure