uia-live-gate start-identity handshake read races a transient holder (sharing violation) #839

Describe the bug
A hosted Windows port-validation contract hit a file-sharing violation while reading an atomically published multi-project process-start identity. The original PR #836 job failed at the extracted Start-MultiProjectOwnedProcess reader from Tools\windows\uia-live-gate.ps1:4509:

Get-Content -LiteralPath $identityPath -Raw | ConvertFrom-Json

The error names mp-start-938304b42a0d4569aa53994f8f6cfac3.identity under the owned temporary gc-mp-* directory. The writer already writes and closes a .pending file and publishes it with File.Move at lines 4465–4468. Atomic publication therefore must not be mistaken for proof that an immediate read cannot encounter a transient holder. The holder and exact cause are unknown; antivirus/indexing is an operator hypothesis, not established evidence.

To reproduce

1. Exercise the existing automatic Windows port-validation Verify validation runner contract step at source head 359a033ba749a9bcf2648ba8b96ee424ad8f398a (PR Fix fixture compile-log sharing races #836). This describes the observed hosted path, not a deterministic local reproducer or a local execution grant.
2. Start-MultiProjectOwnedProcess creates a fresh mp-start-* gate and .identity path, waits for the identity file to exist, then immediately reads it with Get-Content.
3. In original run 38832369751, job 116753854474, the read failed with The process cannot access the file ... because it is being used by another process. The downstream Swift validation and real-zmx empty-list steps did not run in that original job.

The one operator-authorized diagnostic rerun of failed jobs on the unchanged source head passed. The original failure remains retained; passing the rerun is not a fix for this reader.

Expected behavior
Read the valid published identity within the existing bounded startup deadline despite a transient sharing conflict, while preserving identity validation and fail-closed behavior. A missing or invalid identity must not become a success-shaped fallback.

Screenshots
None. This is a startup-handshake/hosted contract failure, not visual-parity evidence.

Environment

• GraphCode version: Windows development source head 359a033ba749a9bcf2648ba8b96ee424ad8f398a; fixture-only PR Fix fixture compile-log sharing races #836 is now merged as 78ef35d387984630bcc353e7f3a10a4bff1e16ba.
• macOS version: Not applicable; original observation was on a hosted Windows runner.
• Backend: multi-project validation process-start handshake; no actual GUI, Swift, or real-zmx failure is established by this read error.

Additional context
The full uia-live-gate.ps1 Git blob is identical at the PR base badcf5149be2a01abd866e4cf180521f485fa2c4 and reviewed head 359a033ba749a9bcf2648ba8b96ee424ad8f398a: 8749c1690b2c89cd7889ce2cb4986a907e4b4797. Relevant code is lines 4446–4509; #836 changed only fixture compiler-log reads in a different file, not this handshake.

Original completed-job log retained locally at C:\gcs\coord2\833-836-swift-failed-job-raw-v2.log, length 433,708 bytes, SHA-256 62E454E515D60C59ADA489C8F3B770772E35A77123DF0DF2203179785CF2CB94. The local path is a coordinator receipt, not a public attachment; the hosted job link above is the accessible evidence. A sanitized reader copy was used to inspect terminal-control-free text; the raw log was preserved.

Suggested direction: a share-tolerant bounded read, or bounded retry only for an actual sharing-violation HRESULT, retaining the existing startup deadline, PID/start-time validation and explicit errors. Do not infer that the pending-file writer itself is non-atomic, or introduce broad catches/stale identity fallbacks.

Disposition: tracking only; no worker yet. Queue investigation after #834. This issue does not authorize additional reruns, local native reproduction, a new owner, or any new capture lease.