test: attribute link-cache save work to nested subspans

[Iviesever]

Decision: HOLD — real default-endpoint drain control failed

Final exact-source, native execution, full19-rowABBA, raw-artifact review and HOLD decision

Blocking C1041 failure with original compiler argv/results

Keep this PR Draft and unmerged. The new subspan diagnostic study, native tests and independent ABBA completed, but the predeclared requirement that every real default drain control pass is unmet. #170 remains independently Draft/HOLD. Neither PR is approved by this instrumentation.

Exact source and scope

• Base c8c8c0172850ff11351b63d5bd1507a7f57ac01e, merged test: retain benchmark invocation evidence and fixed AA calibration #171.
• Reviewed head 6386cc2be1207c25692e96c1fe160755f6271edc.
• Candidate/native test-merge tree 14ed3d293e64593e3b213cccb57067df59f6bc2b.
• Native test-merge fd769b90b9ad80c4af1f5978603486c47a55d062, with exactly those parents.
• Six files, 429 additions/8 deletions. Product changes are diagnostic instrumentation in the existing collector, renderer and LinkCacheFile::save, not a test-only source diff.
• VERSION5.5.0 unchanged. No historical tag/asset or formal Release changes. No CLI, cache-format, file-operation ordering, manifest, native executable inventory or freshness change.

Delivered diagnostic contract

Four disjoint child scopes within inclusive link_cache_write: serialization, directory/temporary-path preparation, complete stream lifetime, and installation/replacement. Payload write and flush are nested within stream. The stream interval includes implicit close and original failure cleanup; installation includes unchanged exists/remove/rename/error cleanup. Do not add nested work again as wall elapsed, label flush as durable storage, or infer a disk/antivirus/OS cause from these aggregate scopes.

The six enum/name entries append to existing fields. Existing cache counts, file format and errors are preserved; new JSON work fields are additive. Inactive scope guards take no new clock readings, but guard/collector overhead remains possible and was measured separately. No zero-overhead or optimization claim.

Existing native link-cache tests now check observed/unobserved create/replacement byte identity, round-trip and actual write counts, raw interval containment, oversize serialization rejection, directory obstruction and nonempty-destination replacement errors with unchanged diagnostics/cleanup. No new test executable is added.

The new collector reuses #171's original clock/statistics/semantic helpers, adds nine positive/negative subspan contracts and a predeclared four AA pairs/eight reports/168 invocation records/144 instrumented subspan samples. Same candidate path and bytes on both sides; fixed left/right order, complete plan before measurement, no overwrite/adaptive budget/retry. Original benchmark and ABBA scripts are byte-unchanged. Actual diagnostic executable and exact source archives are retained. JSON containment tolerances only cover independent0.001ms rounding, not performance noise.

Completed gates and the failed gate

Gate	Actual run	Result
Native Debug and all shards	#712/34307133464	Passed; expanded cache test executed in job102327478334
Complete Release/self-host/package	#605/34307133347	Passed; cache test executed in job102327521691; publish-release skipped
Documentation/Cross-Stage/Reporting	#166/34307133248; #189/34307133346; #8/34307133247	Passed
Incremental/PCH/module/build-plan evidence	Applicable six workflows	Passed
Subspan contracts and fixed study	#1/34307133260	Nine expected contract outcomes;8reports/168invocations/144subspan records complete
Independent original ABBA	#556/34307133279	76pairs measured/recomputed;72instrumented semantic identities match
Private endpoint	#11/34307133236	42/42 collected; all unmanaged controls passed
Default endpoint	#9/34307133230	56 records complete;1control failure;13/14drain controls passed

Why the default failure blocks merge

pch-release-A-started-drain created its PCH and warmed successfully, then original A/work0 exited2 with C1041 cannot open A/compiler.pdb. Its argv already contains /FS /Zi /O2 /MT /bigobj /Yucommon.hpp. A and B use distinct PDB paths. A/drain.json records the failure; root exits1 and lifecycle/drain_control_ok are false. Pending A work is suppressed, B's original compile/link/run succeed and the original service survives, but those do not replace the failed A compile. The separate recovery compile is B, not A. Cleanup is verified, with no cause established for the failed PDB open.

The unchanged positive artifact auditor rejects the matrix. A separate read-only failure audit verifies all56 records and retains that rejection; it does not turn this into an expected successful case. No same-head retry or removal of /FS/PCH/workload/case. This is distinct from the preserved 6 default+2 private original B failures in the intentionally adverse managed-ending experiment. All28A-started managed endings still kill their original service. Both sets of evidence remain, and no service/writer-lease safety is authorized.

Diagnostic findings, not historical root-cause resolution

The fixed study validates all72zero-save samples as zero,72actual saves and72instrumented AA semantic pairs. Maximum link-cache save is 3.039ms (serialize0.289/prepare1.387/stream0.605/install0.757; nested payload0.122/flush0.047). No seconds-scale save tail reproduced; that does not disprove #171's earlier observation. Observed AA timings-off no-op median +0.19685ms/+1.6587%,4/4right sides slower, no gate crossing. Observer effects and unrecorded OS state remain.

Independent observer-OFF ABBA has external timings-off no-op paired median +0.9536ms/+8.0065%,MAD1.49965,max+3.2324ms,3/4slower. The unchanged BOTH>1ms AND>10% gate is not crossed, but this is near the boundary and not zero-cost proof. All18other scenarios remain instrumented; all favorable/adverse samples retained.

The worst new paired tail, discovery-header pair2, totals182.412→3721.849ms. link_execution111.929→3651.657ms, while link_cache_write1.762→1.842ms. This narrows THIS tail to the existing process-launch/wait/capture/cleanup envelope, not link-cache save, but it does not isolate link.exe CPU or an OS cause. The full table preserves cold4/4slower, discovery-header4/4slower and all remaining tails. No outlier deletion, AA subtraction, speedup or historical-cause claim.

Original acceptance gates remain unchanged

Full final diff/exact trees; complete native Debug/Release/selfhost/package and relevant documentation/Cross-Stage/ownership gates; actual cache-test execution; nine contract expectations; fixed8reports/168records/144samples with original correspondence/containment/zero-save checks;72AA semantic identities. Independent original19x4ABBA with all72counter/breakdown/hit-miss identities and the original external no-op BOTH>1ms AND>10% median gate. Missing instrumentation is unavailable, not fabricated zero. All real default drain controls must pass: this gate did not pass, so no merge.

No post-PR source correction or same-head rerun. The pre-PR placeholder correction and initial local CRLF-vs-LF audit mismatch are recorded, not erased. Complete source-tree reconstruction resolves the latter without changing raw archives. No local MSVC/PowerShell execution is claimed.

Handoff

First investigate the real A/PCH/PDB-open failure with a bounded predeclared plan and preserved exact tools, A/B PDB identity and underlying failure diagnostics. A successful rerun alone is insufficient; unavailable historical lock/RPC/OS traces cannot be fabricated. Reconsider this PR only after its unmet correctness gate is addressed. The performance follow-on can then target the newly localized link/process envelope with credible subspans/tool/OS evidence, not a blind median rerun.

#170 remains held. No M1b completion, CLI cancellation, durable quiescence, single-writer lease, transaction/build-run/session/daemon or release authorization. Five original ZIPs with verified hashes and read-only reproducible audits are retained in the delivery; Actions retention30days. Ownership generated binaries are post-case hashes, not failure-time snapshots; the separate diagnostic study archives its actual executable, not the independent ABBA executable pair. Title was changed only after actual#556 completed; later title-triggered skipped perf jobs are not replacement measurements.

[Iviesever]

First exact-head evidence checked: nine contract cases and matching test tree

Head 6386cc2be1207c25692e96c1fe160755f6271edc, base c8c8c0172850ff11351b63d5bd1507a7f57ac01e. GitHub candidate tree and native test-merge fd769b90b9ad80c4af1f5978603486c47a55d062 both equal 14ed3d293e64593e3b213cccb57067df59f6bc2b; the test-merge parents are exactly the declared base/head.

The Windows subspan contract job 102326051610 in workflow 34307133260 passed. Downloaded artifact 10087043962, 523 bytes, verified SHA-256 43ddbdc31047bbc216500694292e9f9dd5954205168909fe1a1d27a615a40504 and ZIP CRC. Independently inspected all nine JSON outcomes: both valid controls accepted and all seven damaged records rejected with their expected categories. This is synthetic validation, not timing or filesystem execution evidence.

Complete source diff review confirms six files, 429 additions / 8 deletions. The new work identifiers append to existing enums/names; LinkCacheFile::save retains its original serialization, stream write/flush/destruction, replacement ordering and error branches, with the declared nested scopes around them. Two trailing-newline differences in the header/renderer are nonfunctional; they are not claimed as scope changes. No source change or same-head CI rerun has been requested after PR creation.

The exact candidate has also built successfully in the dedicated Windows study. Its fixed eight reports, actual native Debug/Release filesystem tests and the separate observer-off ABBA are still independently required. No merge authorization, root-cause attribution or #170 HOLD release follows from this initial contract result.

[Iviesever]

Merge-blocking real default-endpoint control failure — C1041 despite explicit /FS

Exact head 6386cc2be1207c25692e96c1fe160755f6271edc. Default Endpoint #9 /34307133230 completed with failure. This is not one of the allowed adverse managed-termination B results: pch-release-A-started-drain failed its original A compilation, so the predeclared all-drain-controls gate is unmet. No merge authorization. No same-head retry or relaxed acceptance.

Downloaded artifact 10087359460, 12,420,568 bytes, verified SHA-256 7a3da051ebff0a148ac70137200be41c8d187e02d36e7bf3f587e48c4e9d7cf8 and ZIP CRC. Its summary contains all56 cases with one collection/control failure, no cleanup abort. The failed case retains:

• A/prefix.result.json and A/warm.result.json: exit0, not cancelled.
• A/work0.result.json: exit2, cancelled=false. Original stdout reports fatal error C1041, cannot open A/compiler.pdb at source line1. The compiler's generic message suggests /FS, but the actual archived argv ALREADY contains /FS /Zi /O2 /MT /bigobj /Yucommon.hpp and A's own /Fd and /Fp paths.
• A/drain.json: stop_observed=true, exactly one work compile dispatched, first_compile_exit2, pending_compile_exit−2. A root exits1; lifecycle_ok and drain_control_ok are false. This is not a successful natural drain merely because pending work was suppressed.
• Retained A/B process overlap observed, original MSPDBSRV survives, B's ORIGINAL two compiles/link/run all exit0. The separately labeled B recovery compile exits0; it is not an A recovery or replacement for A's failure.
• Typed outer cleanup is verified with no remaining server. Empty resource-owner snapshots do not identify the cause of the PDB-open failure and do not certify writer quiescence.

The original strict read-only artifact audit correctly rejected this control failure. I am inspecting the remaining records without changing that verdict. Production timing instrumentation is new in this PR, but the compiler fixture, its /FS flag and its A/B output separation are unchanged; current evidence does not establish whether this failure is causally related to the new instrumentation. Neither source equality for the probe nor another successful run would establish that by itself.

Microsoft documents that /FS serializes PDB writes through MSPDBSRV but is not a guarantee against every PDB access error (https://learn.microsoft.com/en-us/cpp/build/reference/fs-force-synchronous-pdb-writes?view=msvc-170). This is platform context, not proof of antivirus/disk/lock/RPC causation here. No /Z7 substitution, /FS removal, global service kill, retry-to-green or workload reduction will be used to erase this failure.

Separate gates are successful so far: actual link-cache native test execution in Debug job102327478334 and Release job102327521691; the fixed subspan study; independent ABBA collection/recomputation; and native/release workflow status. These do not override the failed real-tool control. #170 remains independently held.

[Iviesever]

Final iteration review — subspan tooling works; merge HOLD because a real drain control failed

Implementation/source self-review with independent read-only artifact/statistics recomputation, not independent human approval. Do not merge this iteration. The new diagnostic study and native tests pass, but the predeclared real default-endpoint gate does not.

Exact source

Base c8c8c0172850ff11351b63d5bd1507a7f57ac01e, head 6386cc2be1207c25692e96c1fe160755f6271edc, tree 14ed3d293e64593e3b213cccb57067df59f6bc2b. Native test-merge fd769b90b9ad80c4af1f5978603486c47a55d062 has that identical tree and exactly those parents. Independently reconstructed both complete Git trees from the CI source archives (400 base /402 head files), respecting .gitattributes and Windows CRLF checkout conversion: base reconstructs af6b293f04521575a2bdbd2fc31bc156b676d0c8, head reconstructs the tree above.

Full diff: six files,429 additions/8 deletions. This changes PRODUCT diagnostic instrumentation, not only tests. The existing write protocol, cache bytes, error categories/diagnostics, manifest,79 native executable inventory, original benchmark/ABBA scripts and freshness remain unchanged. New enum/name entries append after existing values. No new clock reads inside inactive scopes, but guards/larger collector can have overhead; no zero-overhead assertion. Payload/flush are nested inside stream, not additive wall elapsed. Stream includes implicit close and failure cleanup; install includes original exists/remove/rename and its cleanup. No durable-storage/atomic-transaction claim.

Completed execution — one failed workflow is not hidden

• Native C++ #712 /34307133464: actual Debug build, all shards, freshness/side-output/runtime/parameter checks and final gate passed. The expanded link_cache_file_tests.cpp actually compiled/linked/executed PASS in job102327478334, subshard7/8.
• Native Release #605 /34307133347: all shards, complete self-host and validation of the exact runtime-only package passed. The same expanded cache test actually executed PASS in job102327521691. publish-release skipped.
• Documentation#166/34307133248; Cross-Stage#189/34307133346; Reporting#8/34307133247; incremental/PCH/module target/module scan/module compile/build-plan evidence workflows all completed successfully.
• Subspan Evidence #1 /34307133260: nine synthetic contracts and the full fixed diagnostic study passed, with raw evidence independently inspected.
• Independent Performance #556 /34307133279: both exact source checkouts, both Release builds, instrumentation verification, actual19x4 ABBA and upload ran. All paired data independently recomputed.
• **Private Ownership #11 /34307133236:**42/42 collected, no collection/control failure.
• **Default Endpoint #9 /34307133230: FAILED.**56 records complete, one real control failure; not an allowed managed-policy counterexample. Synthetic collector contracts, probe build and refusal guards passed, but the real matrix step failed.

Blocking failure: A cannot open its PDB, despite /FS

Original C1041 diagnostic, exact argv and unmet gate

pch-release-A-started-drain: PCH creation and warm compile exit0; original A/work0 exits2 with fatal C1041 cannot open A/compiler.pdb, while actual argv contains /FS /Zi /O2 /MT /bigobj /Yucommon.hpp and A's separate PDB/PCH paths. This is not missing /FS, not a compiler process terminated by admission cancellation, and not evidence establishing a particular lock/antivirus/RPC cause.

A/drain.json correctly preserves first_compile_exit2, one dispatched work compile, pending−2 and stop_observed=true. A root exits1; lifecycle/drain control flags are false. Retained A/B overlap, original service survival and all original B compile/link/run successes do NOT turn the failed A compile into successful drain. The later recovery is a B compile, not an A repair. Postflight cleanup is verified, but that is not a writer-quiescence or root-cause certificate. The strict original positive audit correctly rejects this artifact; a separate negative-evidence audit verifies the failure without modifying any record or relaxing acceptance.

Default direct-drain controls therefore pass 13/14, not14/14. Both modes'14 unmanaged controls pass. Separately retain 6 default +2 private original B failures under the old managed-ending counterexample: default includes C1001/C1090/C1051; private C1090. All28 A-started managed endings still kill the original service. These eight permitted adverse B results are not the blocking A control failure. All98 later B recovery compiles succeed and replace none of the original failures. B PDB owner identities are observed in only3/56 default and2/42 private. Audited558 default/413 private tool results and1116/826 original stdout/stderr files. No missing identity snapshot is promoted into proof.

Fixed candidate-only diagnostic study: four AA pairs, no adaptive reruns

Eight complete reports, 168 invocations including16 primes, 144 instrumented subspan samples,4968 merged output lines; 72 instrumented AA semantic pairs identical, four timings-off pairs retain unavailable counters. All72 no-save samples have zero work in all seven save fields;72 actual saves retain the expected write counts. Every raw invocation clock/start/result, original timing JSON and subspan summary was independently checked.

Actual measured executable is 1,815,040 bytes, SHA-256 8b5b84124b5623f79e4e1e49f8d4d2f7ed729fd7c5d1d1ca3e261d277464edaa, matching the archived executable, study copy and both build/study identities. This is the diagnostic executable, NOT the independent ABBA binary pair. Full source archive trees, unchanged harness and plan/order were also verified.

Maximum observed link-cache save 3.039ms in01-right/target-scale-single-tu: serialize0.289,prepare1.387,stream0.605,install0.757ms; nested payload0.122 andflush0.047ms. Another save,02-right/link-only, totals2.557ms withstream0.956 andnestedflush0.649ms. No seconds-scale cache-save tail reproduced in this fixed study. That does not explain or negate the historical tail. Stream residual is not isolated kernel close/disk wait; preparation and installation are still aggregate scopes.

The observed timings-off AA no-op median is +0.19685ms/+1.6587%,MAD0.10085,max+1.1073ms,4/4 right sides slower. Reported separately from unobserved ABBA below; no AA subtraction or observer-zero-cost claim.

Independent original ABBA — every scenario retained

Exact base/head pair above, observer OFF.76pairs, AB/BA/AB/BA; all72 instrumented counters/breakdowns/compile-link-archive hit/miss identities match. Four external timings-off counter sets remain unavailable, not zero. Only the LAST row is timings-off external elapsed; all others are instrumented. Four-pair nearest-rank P95 is the maximum, not a population-tail estimate. Paired percentage medians use each pair's own denominator.

Scenario	Paired median delta ms	Paired median delta %	MAD ms	Paired P95 delta ms	Slower pairs
cold	+200.034	+12.44%	84.929	+364.979	4/4
no-op	+0.068	+1.50%	0.162	+0.306	2/4
single-tu	+78.380	+80.23%	95.099	+638.560	2/4
public-header	+54.315	+37.33%	62.854	+250.724	3/4
build-run	+0.349	+2.39%	0.438	+1.221	3/4
link-only	+27.034	+39.42%	31.031	+155.518	3/4
target-scale-cold	+487.644	+12.07%	468.190	+1706.332	3/4
target-scale-no-op	−3.059	−7.10%	5.363	+2.923	2/4
target-scale-no-op-auto	+1.076	+3.29%	0.540	+1.681	3/4
target-scale-no-op-j1	+0.213	+0.49%	0.053	+0.292	3/4
target-scale-common-header-no-op	+0.421	+1.18%	0.917	+1.538	2/4
target-scale-single-tu	+5.302	+2.78%	7.678	+153.441	2/4
discovery-cold	+111.078	+6.92%	103.129	+1830.859	3/4
discovery-no-op	+0.266	+3.32%	0.176	+1.919	4/4
discovery-header	+114.036	+100.95%	110.072	+3539.437	4/4
modules-cold	+84.427	+5.00%	110.817	+226.246	3/4
modules-no-op	+0.535	+10.42%	0.677	+1.302	2/4
timings-enabled-no-op	−0.007	−0.18%	0.030	+0.032	2/4
timings-disabled-no-op (external)	+0.954	+8.01%	1.500	+3.232	3/4

Unrounded external no-op median +0.9536ms/+8.0064778818%,MAD1.49965,max+3.2324ms: it does not cross the unchanged BOTH>1ms AND>10% gate. This is close to the threshold, not evidence of zero cost. No favorable sample offsets a failed gate or an adverse sample.

The largest paired anomaly, discovery-header pair2, is localized differently from the old cache-save hypothesis: total182.412→3721.849ms; link_execution111.929→3651.657ms, but link_cache_write1.762→1.842ms. Candidate save subspans are0.018serialize/0.941prepare/0.356stream/0.527install; nested payload0.004/flush0.087. Thus THIS new tail sits in the existing process execution envelope, not the cache save. That envelope includes launch/wait/capture/cleanup, not only link.exe CPU, and does not isolate an OS cause. Other unfavorable cold/scale/discovery results remain; no outliers were discarded as noise and historical cold-tail debt stays open.

Raw artifact identity and corrections retained

All five original ZIPs downloaded and SHA-256/CRC verified:

• contracts10087043962,523bytes: 43ddbdc31047bbc216500694292e9f9dd5954205168909fe1a1d27a615a40504
• subspans10087181253,4,633,475bytes: f99d35390ceb5823bd00df6d522105a3eedddd6b92f78594c4ac4ac1978e4e0e
• ABBA10087256050,36,895bytes: b55fee34049c3682a70cb6994bf3443c46f4c1207049407832541312e59deadd
• default10087359460,12,420,568bytes: 7a3da051ebff0a148ac70137200be41c8d187e02d36e7bf3f587e48c4e9d7cf8
• private10087263565,4,914,445bytes: d7ef717525c64a7857559f8cc1c9e20234cd612ef0f7bc80d33ebcec12168d33

Diagnostic ownership ZIPs have post-case binary hashes (710default/533private), not generated binary bytes or failure-instant snapshots. The subspan ZIP separately contains the actual diagnostic executable and full source archives; ABBA contains paired comparison JSON, not its own executable pair. Actions retention30days; the delivery also retains these raw ZIPs and runnable read-only audits.

The first local source-blob audit incorrectly compared CRLF archive text directly with LF Git blobs; explicit normalization and then full-tree reconstruction corrected that audit, without changing source/artifacts or rerunning CI. A pre-PR script marker correction remains in history and never reached CI. All current-head executions are first attempts; no post-PR source fix or same-head retry was requested. No local MSVC/PowerShell/full Windows execution is claimed.

Decision / next handoff

HOLD #172 as Draft: the default drain control requirement is unmet. #170 remains independently HOLD; neither is merged. Keep actual main c8c8c017... and VERSION5.5.0 unchanged.

Next focus first on the new real A/PCH/PDB-open failure with a bounded, predeclared reproduction/observation plan preserving exact tools, separate A/B PDB identities and underlying errors. A successful rerun alone cannot close it. The raw snapshots do not locate the failing open's lock/RPC/OS state; do not invent that missing history or remove /FS/PCH/cases. Only after that gate is addressed should this PR be reconsidered. The performance follow-on can then observe actual link/process subspans or trustworthy OS events under its own declared budget, using this newly localized tail, not another blind median run. No CLI cancellation, durable writer quiescence or lease-transfer authority is granted.