Investigate missing Windows agent settlement after Job cancellation

Start with server/lib/windowsAgentSupervisor.cs, server/lib/windowsAgentProcess.js, and server/lib/windowsAgentProcess.test.js; inspect the failed native Windows CI run and identify which settlement stage lacks privacy safe evidence. Run the declared finite cancellation matrix on Windows with real native processes, distinguishing accounting, signaling, receipt persistence, and supervisor failure. Done means a demonstrated cause is fixed and the listed native boundary cases pass while preserving deadlines and proof requirements.

Problem and evidence

The Windows native CI contract lib/windowsAgentProcess.test.js > native Windows release-agent boundary > cancels the exact Job, persists descendant settlement and preserves a neighboring process failed on PR #14032 at a243bad2499b4647e3fb7b232d7a7b0146ef5b8e:

https://github.com/atomantic/PortOS/actions/runs/40794593042/job/123188453731

The fixture observed started.json, requested cancellation through killProcessTree, awaited the supervisor's close, and then readWindowsAgentSettlement(agent) refused with WINDOWS_AGENT_PROCESS_UNVERIFIED at the assertion near line 119. The job had 151 passing tests and 37 skips. It does not record which receipt/schema/identity condition was unavailable; no causal fault is established.

Context: hosted Windows Server 2025, runner image windows-2025-vs2026 / 20261021.278, Node 26.12.1 x64, native server Vitest with no browser. The prior head's native job passed: https://github.com/atomantic/PortOS/actions/runs/40793879441/job/123185739710 . The Topaz branch does not change windowsAgentProcess.js, windowsAgentSupervisor.cs, or windowsAgentProcess.test.js. These observations support a suspected intermittent boundary failure, not a proven cause or resolution.

Expected: cancellation settles only the exact owned Job, durably publishes the matching whole-tree receipt before normal supervisor completion, and leaves the neighboring process alive. Actual: the durable reader refused after close; the log cannot distinguish missing receipt, failed supervisor stage, or invalid proof.

Chosen next step

Instrument the native supervisor and its boundary test with bounded, allowlisted phase/error and receipt-availability facts, then investigate on Windows with a predeclared finite cancellation matrix. In particular, distinguish empty-Job accounting, retained-process signaling, receipt persistence, and supervisor failure. The zero-time process-signal check after empty accounting is a hypothesis to examine, not a demonstrated cause. Do not print command text, arbitrary exception strings, process identifiers, paths, owner nonces or live instance data.

Affected files: server/lib/windowsAgentSupervisor.cs, server/lib/windowsAgentProcess.js, server/lib/windowsAgentProcess.test.js, and the native Windows CI diagnostic path.

Acceptance criteria

• Retain enough privacy-safe native evidence to identify the failing stage and distinguish publication/identity errors from process settlement.
• Use real Windows native processes with a declared finite run count, stopping on a useful recurrence and reporting non-reproduction honestly.
• Fix any demonstrated cause and cover cancellation, detached descendants, neighboring-process preservation, restart reading, supervisor loss and missing/corrupt proof at the native/service boundary.
• Preserve current deadlines and whole-tree/owner/process-generation assertions; no skip, sleep-after-close workaround, retry-until-green, PID-absence fallback or fabricated receipt.
• Missing or uncertain proof continues to hold recovery. A passing CI rerun is validation only and does not close the investigation without its stated evidence.

hardwareRequirements: ["windows"]
helpWanted: true

Windows is required to exercise Win32 Job objects, native supervisor cancellation and durable settlement; macOS/Linux cannot validate that boundary. The hosted Windows runner can provide the required validation, and Windows contributors can add controlled native reproductions.

Dispatch rationale: model:heavy for native process/receipt ordering and safety; effort:high for bounded diagnosis across kernel state, persistence and restart evidence.