[coneilen]

Summary

Separates the numbered-journal one-second Open/Copy/retry budget from the absolute caller and cleanup deadline after immutable bytes are copied. This prevents valid large terminal journals from being refused while preserving all I/O, hard-deadline, identity, mutation, and cleanup refusals.

Changes

• Keep an accumulated, pausable I/O clock for numbered journal Open, Copy, and retry waits while retaining the unchanged absolute hard deadline for decode, hash, schema, inventory, and final binding.
• Add a 679-process, 2,479,730-byte terminal contract with more than one second of post-copy validation, plus explicit over-one-second I/O and post-copy hard-deadline negative cases.
• Document the deadline split and preserve the frozen failed lease as CLEANUP_UNPROVEN / UNPROVEN.

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -JournalFirstOpenContractOnly -ScratchRoot D:\gcr-red-08572544 -> JournalUnavailable sequence=2 after openMs=0.876 copyMs=3.162 totalMs=2471.853
GREEN: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -JournalFirstOpenContractOnly -ScratchRoot D:\gcr-green-d6b488af -> 2/2 passed
REGRESSION: pwsh -NoProfile -File Tools\windows\Tests\UiCaptureDriver.Tests.ps1 -ScratchRoot D:\gcu-full-8d3eb9ad -PrebuiltFixtureManifest D:\gcu-prep-0c80633b\fixtures.json -PrebuiltFixtureManifestSha256 80E8E7A9509C7A18C314C4BC369DA3C4DA5F9A65562564A010B1411EB17F8258 -> 182/182 passed, zero skips

Additional validation:

• Focused timing, first-Open, and moving-head journal contracts: 4/4 passed.
• Fresh pinned real-zmx preflight: 185/185 passed, zero skips; zmx SHA-256 035311740FD7A7B15BAFB499F24E073FAB2C436711FA6D9A0D5EAA9267F6EE31.
• Tools\windows\Tests\ValidationRunner.Tests.ps1: UiScenario 166/166 and nested UiCaptureDriver 182/182 passed.
• Tools\windows\validate.ps1 -Task hardening: deterministic repeated runs 3/3 passed.
• Exact-head no-lease live transition rehearsal at deb35d9b696a6466095feb416ed4077864be3d35: 36/36 checkpoints, 22/22 seeds, 2/2 Restarts, one before-to-after transition, zero captures/images/PNGs, RELEASED_ZERO_SURVIVORS, and KERNEL_EXIT_AND_EOF_PROVEN.
• Rehearsal manifest SHA-256 1F156EE6D8309EE4F480DA9C1EDA439D9D08A933D33973F16AA05CA0E4BB587E; release SHA-256 BE84D7A039E91A216817F7174BB95CD96C96BE5526462F2B953D8D406F5A1221; checkpoint aggregate SHA-256 F58D3032727FC66416747C7CE96EE5FB006733A75903FB9DBA4A68B3242F85DB; terminal journal SHA-256 00BB1E4CCDD5841D63B9D0C00B5510B1169E24C5C74061AF05874B8EB8BD6FBA.
• PowerShell parse, git diff --check, and LF checks passed.
• macOS make test / make check were not run because this change is confined to Windows capture tooling, tests, and documentation.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test)
• Code follows the existing style (make check)
• I added the test/contract before the implementation and observed the intended RED failure