Windows-2025 journal actor cleanup intermittently lacks exit and EOF proof #846

Describe the bug
Windows-2025 deterministic hardening has intermittently refused journal-test actor cleanup with Actor normal exit/kernel/bothEOF not proven. The affected test changed between two heads. A single diagnostic rerun of the Windows-2025 job passed on the unchanged second head; the actor-level cause remains UNOBSERVED. A passing rerun is not a source fix or proof of the original actors' cleanup.

This tracker is separate from #831, which concerns native workspace UIA convergence (MULTIPROJECT_IDENTITY), not journal actor lifecycle evidence.

To reproduce
These are retained CI observations, not a deterministic reproduction recipe:

1. On Bound Windows capture seed lifecycle and output ownership #845 head 30b718f2a69ad8eb65600364fa986282c3f17df8, run 38941311015, job 117109433142 failed Verify runner contract. Its offline capture child executed 69 cases: 66 passed and 3 failed. The concurrent numbered-publication test reported two incomplete actor cleanups. A separate nonempty-argument case also hit JournalUnavailable (openMs=0.610, copyMs=2.605, totalMs=1281.984); the report-gate failure was downstream. This head was not rerun.
2. The subsequent one-line production change removed the additional successful-read CopyCompleted observation before the deadline assertion, retaining timing accumulators, failure diagnostics, flush semantics and the 1000ms budget. On new head 58a7723b77a19bf7dd952048d0f609429a6f8407, run 38945518434, original job 117123618253 executed 69 cases: 67 passed and 2 failed. The prior nonempty-argument and concurrent-publication cases passed. The transient-Open retry test instead reported incomplete actor cleanup, followed by the dependent report-gate refusal.
3. The operator authorized exactly one diagnostic rerun of that Windows-2025 job only, with no further source change. Attempt 2, job 117129884237, ran 18:26:51–18:35:01Z on the same 58a7723b head and passed. The retained log contains one actual UiCaptureDriver summary with 69 executed / 69 passed / 0 failed, and one ValidationRunner.Tests.ps1: PASS line at 18:34:57.7803101Z.

The old 30b718f2 head did not have an identical-head passing rerun. Do not collapse the source change between heads and the diagnostic on 58a7723b into two successful reruns.

Expected behavior
Keep actor exit, retained-generation kernel and both-stream EOF requirements fail-closed. When cleanup is refused, preserve and surface each actor's actual stdout, stderr and exit code so the cause can be investigated instead of being hidden behind the cleanup summary.

Investigate before proposing any timeout, journal budget, retry or cleanup-gate change. The successful diagnostic does not establish whether the first attempts failed because of scheduling, output handling, a test-harness defect or another cause. No underlying actor stdout/stderr diagnosis is claimed here.

Screenshots
None. This is an offline CI contract failure; no GUI capture or screenshot is part of this evidence.

Environment

• GraphCode version: Bound Windows capture seed lifecycle and output ownership #845 heads 30b718f2a69ad8eb65600364fa986282c3f17df8 and 58a7723b77a19bf7dd952048d0f609429a6f8407.
• macOS version: not applicable; GitHub-hosted windows-2025, pwsh deterministic-hardening matrix entry. The diagnostic was an unchanged-head retry, not a claim of an identical physical host or measured identical runner image.
• Backend: offline capture/journal fixtures; no paid backend or GUI lifecycle claim.

Additional context
Retained complete job-log SHA-256 values:

• Original 30b718f2 job 117109433142: ECE6C0FBAF9C201925E49E6F1FD14EB0296A2794CDEB98132EB2FE5B111F9A11 (384,746 bytes).
• First 58a7723b job 117123618253: 69964D9A5648DF4196FDF251DF261C455AC144DD746A0AF446DC0407DB8AD03D (382,358 bytes).
• Same-head diagnostic job 117129884237: FD7603041B9A40051F72C3ADFC4553099D8176E95A1269623DA8F084D50F440A (381,335 bytes).

The first 58a7723b job log had no JournalUnavailable match in an executed whole-log search; that is a limit of the retained job log, not proof that an unretrieved actor artifact contains no such error. The actor cause remains unobserved. Original failed logs are preserved separately from the diagnostic; neither is overwritten or relabelled as passing.

A separate real-product packaging failure on this head was a GitHub connection timeout during pinned dependency bootstrap, before product steps. Its separately authorized job-only network retry passed; it is not the actor-cleanup signature.

Refs #845, #834 and #829. No implementation worker, new local/native run, additional CI rerun or budget/gate change is assigned by this tracker.