zmx seed daemon inherits redirected pipes and prevents bounded EOF attestation #834

Describe the bug
The live capture core cannot finish attesting an exited daemonising zmx seed when the daemon inherits the launcher's redirected stdout/stderr pipes. The owned launcher exits, but its daemon keeps those pipes open; the required bounded both-stream EOF never arrives. The single coordinator B slot stopped before any GraphCode GUI launch or image capture.

To reproduce
Steps to reproduce the behavior:

1. Historical run cdba36a51f144798b40fd78bdb50251b used the unchanged production supervisor at source 944ee565ed2e36885b8cf1087fc5fbe2d05d38b6 (full tree identical to merged main badcf5149be2a01abd866e4cf180521f485fa2c4) and pinned zmx source 785b3fd15dcafd1882b495c831a10f98c201b908.
2. The B worker launches its real offline peer and the zmx daemon seed. The original slot lease was 640c69a9-049e-46ba-9ebe-5c813a3f93a1, granted 2026-10-15T23:50:18.4647178Z; this is retained provenance, not a new execution grant.
3. At 23:50:45Z, worker PID 37428 recorded: Process.Start identity attestation failed for zmx-seed PID 36288: Exited zmx-seed PID 36288 did not reach bounded stdout/stderr EOF; cannot attest it genuinely gone.; guarded rollback also failed: Rollback stdout reader did not reach bounded EOF for PID 36288.
4. Worker exit was 1. The final manifest contains zero GUI launches, zero images and a pending seed-launch rollback. The supervisor release is CLEANUP_UNPROVEN, not a zero-survivor success.

No repeat live slot, experiment, process-name kill or production-source change is authorized by this issue.

Expected behavior
A real daemonising zmx seed must have separately owned, bounded output capture and generation-bound lifecycle evidence for its launcher, daemon and descendants. Launch/rollback/cleanup must not depend on a pipe that the deliberately live daemon inherits. Keep fail-closed ownership, kernel-exit and EOF requirements meaningful; do not turn missing EOF, empty CIM results or an unproved descendant into success.

Proposed design to plan-review after #833: redirect the seed's stdout/stderr to owned files, or use a launch mechanism that prevents unwanted handle inheritance. Specify launcher versus daemon attestation and when files/streams become quiescent; a file snapshot is not proof that a live writer has closed. Track and clean up the actual owned daemon/descendants by verified generation. Preserve diagnostics and original failure classification.

Add a real-zmx, no-GUI seed rehearsal to the preflight so this path cannot remain hidden behind the Start-CapOfflineSeed stub. Test-only #833 handles compiler-log readers; this issue concerns the capture core's real daemon-launch path and must not be silently folded into that fixture-only PR.

Screenshots
None: the manifest reports guiLaunches=[] and images=[]; the official release reports captures=0.

Environment

• GraphCode version: production capture source 944ee565ed2e36885b8cf1087fc5fbe2d05d38b6, tree a6ccbfd5580d9fba0c336da93e716609c4538ce0, identical to main badcf5149be2a01abd866e4cf180521f485fa2c4.
• macOS version: not applicable; Windows and PowerShell 7.
• Backend: isolated offline fixture, no paid/backend turn.
• Pinned zmx binary SHA-256: DFFF744FA8D7B0FB483416674C2FF4C2647EA46A3BDD82A95DC173A1FA07DC5B.

Additional context
Retained evidence under C:\gccp\capture-coordinator-b1:

• worker.log: primary seed attestation and rollback error.
• manifest.json: run ID cdba36a51f144798b40fd78bdb50251b, launcher PID 36288, creation file time 134365818411426552, kernel-exited=true but pending rollback; peer PID 46440 has kernel exit and both EOF true; no GUI/images.
• lease-release.json: SHA-256 DED09AD2C54E77E4AF6E4251F06467F2BEABEC999B9D7CE80E3536A1C985058F, CLEANUP_UNPROVEN, worker stdout/stderr EOF false, no accepted final journal binding. Its empty survivor array does not override the unproved cleanup status.
• Coordinator console: C:\gcs\coord2\coor-b-slot1-console.txt, SHA-256 7DE661F76921934337EEAA909AF20DB80BFFB44F22F8DB77AE1DA8E20DA5D0C5.
• Journal directory: C:\gccp\runs\cdba36a51f144798b40fd78bdb50251b\process-journal; immutable published snapshots remain preserved.

Operator-observed root cause: launcher PID 36288 spawned daemon PID 22760, which inherited the launcher's output pipes. The operator stopped the verified orphaned fixture daemon at C:\gccp\runtime\zmx.exe and subsequently reported no remaining zmx, graphcode-windows or graphcoded processes. This later cleanup is a separate operator action, not a rewrite of the original CLEANUP_UNPROVEN receipt or an invented original EOF proof.

The passing 59-case core-59b preflight explicitly stubs Start-CapOfflineSeed and is not a real zmx/peer rehearsal; it therefore did not exercise this defect. The live track is stopped with no retries. Refs #826, #829 and #833. Schedule this core prerequisite after #833 and before D's Quick Chat adapter or option 1 integration. Plan review must precede any source edits; close nothing on the strength of this report alone.