test: calibrate native PDB file events after recording readiness

[Iviesever]

Final decision: accept calibrated event tooling; keep #170 and #172 held

Final exact-source, full execution, raw evidence and acceptance review

The missing recording-readiness boundary is now implemented and verified with actual Windows events. Accept this investigation tool, not historical-cause resolution, CLI cancellation or writer-lease authority. #170/#172 retain their independent HOLD decisions; M1b remains incomplete.

Exact accepted source

• Base: 792fa39d3c2489ad520d25139709d6b0144ea29a (test: investigate PCH PDB failure with fixed resource-query controls #173).
• Reviewed head: 18f212865df52ea86431489adf80ff96a8c8a019.
• Candidate and native test-merge tree: 7580fe467e0c7053c43a79aebb69c07ce4f9c8a9.
• Test-merge 959eaac8fb13626d6d84911eeaad46aeb3fbe143, exactly those base/head parents.
• Four new test/CI files, 1234 additions/0deletions. All402existing main files remain byte-identical. Full canonical source-tree reconstruction and patch replay match the accepted tree.
• VERSION5.5.0 unchanged. No historical tag/asset or formal Release change.

Delivered behavior

The native recorder owns a uniquely named file+real-time ETW session on an explicitly authorized disposable Windows VM. The authoritative ETL retains Kernel-File Create/OperationEnd and process/thread events, actual TDH property definitions, selected raw payload/decoded records, native QPC boundaries and stop/loss/decode/cap status. Session/evidence reuse is refused. No compiler/service termination policy or production caller changes.

A same-session live consumer must first receive a real successful Create/OperationEnd pair. The original opening calibration is then issued once; its successful open and controlled sharing failure must both arrive with matching native PID/TID/QPC before the compiler fixture may start. Both waits share a fixed10-second admission budget. No sleep, repeated marker or adaptive budget. A quiet host may be refused if no event witness arrives. The wait does not make provider APIs, queued-buffer drainage, teardown or compilation hard-time-bounded.

Offline audit independently rematches live selected header/QPC/raw-payload/TDH-data to the ETL-decoded stream. It retains original IRP lifetime, process identity, before/after calibration, loss/cap/status and original compiler outcome checks. Live readiness alone is insufficient. The Python verifier does not implement a separate binary ETL decoder. FileObject/IRP are transient identifiers, not durable file IDs; physical calibration identity is read separately from its held HANDLE.

One separately labeled negative invocation withholds file-provider enable and must time out without any calibration, child record or child-execution sentinel. It is a refusal test, not a manufactured MSVC C1041 reproduction. The real fixed study remains four fresh PCH Release/A-started/direct-drain cases, rm-on/off,off/on, unchanged24kA/6kB inputs and /FS /Zi /O2 /MT /Yu with large-A-only /bigobj. Existing default56/private42 probes and collectors are unchanged.

Completed current-head gates

Gate	Actual first-attempt run	Result
Native Debug/all shards and runtime/freshness/parameter checks	#718/34324815386	Passed, actual execution
Complete Release/self-host/exact runtime-only package	#610/34324815289	Passed; publish-release skipped
Documentation/Cross-Stage	#171/34324815504; #195/34324815191	Passed
File-event contracts and native build	Event#4/34324815389	36/36synthetic expectations(4accepted/32rejected), PowerShell parsing, actual recorder compilation passed
Native missing-readiness control	Event#4/34324815389	10-second refusal, no calibration/child/sentinel
Fixed real traced compiler study	Event#4/34324815389	4/4complete traces,8native sharing failures+8successes, all original A/B controls pass
Original default/private matrices	#14/34324815411; #16/34324815273	56/56 and42/42complete; required positive controls pass
Independent original observer-OFF ABBA	#566/34324815334	76pairs measured/recomputed;72instrumented semantic identities match

Full native readiness, negative control, four raw traces and executable provenance

Full19-rowABBA, original ownership regressions and unfavorable evidence

The negative control reached10.000539seconds, wait258, child/calibration=null and sentinel absent; its ETL has no file events. All four positive traces match both live opening witnesses to offline records and have complete before/after native Status0 and0xc0000043(Win32error32) calibration, exact child creation identity and no reported loss/decode/cap failure. Actual observed admission acknowledgements were2.102–4.214seconds, not a general latency guarantee.44original tool results/88stdout-stderr files were inspected.300selected PDB/PCH completion pairs have attributed lifetimes in this scope, while24nonzero0xc0000034statuses remain despite successful original builds. Those statuses are not deleted or called C1041. No C1041 occurred in this new four-case fixture, and historical C1041 is not explained.

Performance and unfavorable evidence retained

External timings-off no-op paired median −1.2531ms/−8.0433%, maximum adverse+3.622ms,2/4slower; original gate (worse by both1ms and10%) not crossed. No speedup/zero-overhead claim. Instrumented scale-no-op/auto are slower4/4, and scale-cold+980.648ms/discovery-header+829.318ms tails remain. Four-pair P95 is a maximum, not a population estimate. Only the external row uses timings-off elapsed; four counter sets are unavailable, not zeros. Original72instrumented complete counters/breakdowns/compile-link-archive hit-miss identities match. No noise-based deletion, AA subtraction, same-head remeasurement or historical cold-tail closure.

Original default/private retain 6+2managed B failures(C1090/C1001) and all28A-started managed-service deaths. Failed link/run are unattempted; recovery compiles never replace originals. Default B owner identity15/56/private1/42 does not prove complete writer ownership. These adverse termination experiments are separate from successful new readiness/PCH controls.

Original failures and gates are not rewritten

Older cfa/b6 traces still fail offline for original schema errors/missing opening calibration; their absent events are not fabricated. The independently failed Modules Debug C1041 positive control remains failed and untraced. New successful controls cannot explain or erase it.

First readiness head b2498eca... failed actual MSVC C2398. The correction only adds an explicit conversion at the QPC-frequency constructor call. That head has no native readiness observations; its Debug#717,Release#609/default#13 ended cancelled by the genuine source change. Preserve its35/56default prefix, completed private42 and separate ABBA#565 including its+1962.480ms tail. No same-head retry. LocalPython/GCC syntax tests are not local MSVC or ETW execution.

The originally required four complete traces/eight calibrated failures/eight successes, process/loss/decode/cap checks, original positive controls, full exact-source native/selfhost/package and independent19x4ABBA were not relaxed. The readiness amendment adds36synthetic expectations and an actual negative admission gate. All current applicable gates now pass. The temporary perf title was removed only after actual#566 finished; title/ready-triggered skipped perf jobs do not replace it.

Decision and handoff

Accept ordinary expected-head merge under unchanged branch protection. Keep #170/#172 held, safety fields false and VERSION5.5.0. This resolves the tool's specified readiness/calibration acceptance gap for the tested scope, not historical OS causes, RPC completion, all-writer enumeration, durable quiescence, crash recovery or writer-lease transfer.

Next use the accepted calibrated recorder for a bounded investigation of the unresolved actual PDB-open/compiler failures, rather than creating another competing observer or relying on success-only reruns. Any future #170/#172 re-review must validate the then-current combined source and explicitly retain their original failures. M1b, CLI/transaction/build-run/session/residency and formal VERSION/release remain separate.

Raw current and previous ZIPs, canonical source archives, patches and offline reproduction are retained separately in delivery. Actions artifacts retain30days. Generated compiler binaries are omitted by the diagnostic artifact contract; separate input ZIPs contain the actual recorder/probe/MQB bytes, not the independent performance executable pair. Post-case binary inventories are not failure-instant snapshots. Post-merge push CI is not claimed already completed by these PR results.

[Iviesever]

First exact-head contract evidence inspected; native trace gate remains separate

Head cfa894c2984103e75c1cded47dd016b9fb19275f, base 792fa39d3c2489ad520d25139709d6b0144ea29a. Workflow34317627257 contract job102357068086 actually executed Python verification and PowerShell parser checks successfully. Downloaded artifact10090629666,758bytes,SHA256 7760299943328b2d075a7f721344066819915c9d4f255900eced9b56d1183f5f, ZIP CRC and raw JSON independently inspected.

All16 declared outcomes match: two valid record shapes accepted, fourteen damaged cases rejected (loss/stop/decode/cap/status/IRP/identity/duplicate/missing-boundary/safety defects). Original child exit1 remains a valid collection record, not a successful original compiler control. That distinction is checked later by the unchanged strict drain-result validator.

This is synthetic record validation plus actual PowerShell syntax checking, not native ETW capture or MSVC calibration. The full trace, original default/private controls, native/self-host/package and independent ABBA gates remain required; #170/#172 remain held. No same-head rerun was requested.

[Iviesever]

First-source failures retained — decoder defects, missing opening calibration, and independent C1041 control failure

Head cfa894c2984103e75c1cded47dd016b9fb19275f is not accepted. Recorder compilation succeeded, but event workflow34317627257 stopped after its first rm-on slot; three planned slots were not attempted. Downloaded trace artifact10090828889,3423640bytes,SHA256 25db2c607d05dcb71116901c1e4ce230bce21a4c085337cc9eb8fac505c4dc71, verified ZIP CRC and raw records.

The31,195,136-byte ETL reports zero lost events/buffers;134,561 selected records were decoded, with 65 errors on ProcessStop-v2 ImageName (TDH ANSI type2). The manifest File OperationEnd records also lack the requested NtStatus JSON field: this recorder used the classic FileIo spelling, not the manifest's Status property. These are recorder/schema defects, not compiler failures. A targeted source correction will preserve ANSI property bytes without guessing a code page, retain each actual host schema once, request the manifest Status field through TDH and update the record verifier accordingly. No hard-coded payload offsets or invented native statuses will be used.

A separate completeness gap is visible even before correcting those fields: no Create event for calibration-before, despite native Win32 error32 being recorded; only calibration-after's two Create events are present. The earliest selected timestamp is after the opening calibration. Zero reported loss therefore does not establish a fully observed opening boundary. The decoding correction will not be presented as an explanation or fix for that missing readiness boundary, and no sleeps, extra calibration attempts or relaxed acceptance were added. A later successful capture alone will not erase this gap.

The one traced real A/B fixture itself completed original compile/link/run successfully, with original service alive and pending A suppressed. That does not make its incomplete trace pass.

Independent unchanged default56 also failed a real positive control: modules-debug-A-started-drain, original B/work0 exits2 with C1041 cannot open B/compiler.pdb; A succeeds, original service survives, pending A is suppressed, B/work1 succeeds, link/run remain unattempted and separate B recovery succeeds. Actual original argv still contains /FS /Zi; this is not the intentionally adverse managed-ending policy. Artifact10090985015,12420665bytes,SHA256 1bf448bfa9df592e62441faad7ce451757c29b71932291a78e43cc6f27d9d3a3 preserves all56 records and the failed13/14drain gate. That workflow never invokes the new event recorder. This does not establish a cause, and the separately successful traced PCH case cannot substitute for it.

All first-source artifacts and statuses remain separate; no same-head rerun was requested. The impending decoding-source correction requires its own validation, not relabeling the above failures. #170/#172 and this PR's merge authorization remain held.

[Iviesever]

Decoder correction committed; initial performance and native results retained separately

Corrected head b6a3b07915fc9a943013d225fceaf819fed3525b, tree de320e2a7bb5422464db21e654dda71c29ecfcbd. Two-file amendment only: native manifest Status/opaque ANSI/schema preservation and corresponding Python Status contract. Both submitted Git blobs and the entire resulting tree match local reconstructions. The unchanged16synthetic expectations pass locally. No opening-readiness fix, added sleeps, calibration repeats or altered compiler/workload/threshold is included.

First head cfa894c... Native Debug#715 and full Native Release/selfhost/package#607 completed; publish-release skipped. Its private42 passed collection with two original managed B C1090 failures retained. Its independent default56 positive drain failure and native trace incompleteness remain blockers, as recorded above. These old-head successes are not new-head validation.

First-source independent ABBA#561/34317627163 artifact 10090841435,35375bytes,SHA256 d131126df720204fbf02c9d1dd3ce22b0e4781a69152185b104c92bc1c418361 was downloaded/CRC-verified and recomputed. All76pairs/19scenarios, AB/BA/AB/BA,72instrumented complete counter/breakdown/compile-link-archive hit-miss identities match. Four external timings-off pairs have unavailable counters. External no-op paired median +0.390ms/+3.59%, MAD0.334ms,max+0.886ms,3/4slower: below the unchanged BOTH>1ms AND>10% gate, not proof of zero cost. Adverse instrumented discovery-cold tail +730.446ms, discovery-header tail+146.657ms and common-header no-op median+1.046ms remain. Favorable cold/scale-cold medians are not attributed to a test-only code addition. Full paired JSON and all19 recomputed rows are retained, no outlier removal or same-head remeasurement.

The initial private ZIP10090887448 SHA256 7241228f75b19825dd94b04bd2e786708b11a2f907ca91b99fa3c75abf48e6a5 and input/build ZIPs10090812153/10090812524 are also saved with checked digests. The new head gets separate native/trace/default/private/ABBA evidence. Neither this decoding fix nor a later successful sample resolves the historical C1041 or missing opening-calibration record.

[Iviesever]

Corrected native status decoder works; opening-boundary calibration still fails — HOLD

Exact head b6a3b07915fc9a943013d225fceaf819fed3525b, base 792fa39d3c2489ad520d25139709d6b0144ea29a. Native trace workflow #2/34319389186 actually compiled the revised recorder and executed the first rm-on fixture on a separate VM. Artifact 10091479006,3539322bytes,SHA256 551ca00d5f829c5c457373433fa660e6376735b63e30befaf17be8809c7fafad, downloaded with verified CRC and independently inspected using the exact submitted verifier.

The decoder correction is demonstrated by the actual host metadata: File24v0 exposes Status as unsigned32, not NtStatus; Process2v2 ImageName is ANSI and is now retained as opaque bytes; Process1v4 retains its Unicode image and creation identity. All 136594selected events decode with 0errors, from136596total events and a33030144-byteETL. Stop/ProcessTrace/CloseTrace and reported lost-event/buffer counts are all0. No hard-coded native payload offsets were used to manufacture statuses.

The closing calibration has a paired successful open Status0 and the deliberately denied open Status3221225539 /0xc0000043. Its native Win32error is32. The denied event pair falls within the logged QPC call boundary and names the expected file, PID6848/TID8432 and held physical-file calibration identity. This is a controlled observer test, not C1041 reproduction.

However, the opening calibration still has zero matching Create events despite its native Win32error32. Thus the unchanged exact Python acceptance auditor rejects the log: missing/ambiguous positive sharing-failure or successful-open calibration. The collector records1slotcompleted/3notrun and stops, without adaptive calibration or fixture retries. A native recorder exit0 means decode/capture APIs completed; it does NOT mean the full trace-integrity gate passed.

The traced original PCH A/B work completed successfully, shared service survived and pending A was suppressed. Those original results cannot replace the missing opening boundary or the separate initial default56 Modules Debug C1041 failure. No cause for startup-event absence has been proven; zero reported loss is insufficient to certify complete coverage. No sleeps, extra samples or relaxed gate were added by the schema fix.

Decision already supported by this result: keep #174 Draft/HOLD, unmerged. Finish recording the remaining new-head native/default/private/independent-ABBA results, but their success cannot waive this failed predeclared boundary gate. The next correction should establish an event-backed recording-readiness boundary within this PR, with a separately bounded readiness failure test; not append another success-only workload or another competing investigation PR. #170/#172 and historical C1041/performance debt remain held.

[Iviesever]

Corrected-head independent ABBA — measured and recomputed, not a waiver of trace failure

Base 792fa39d3c2489ad520d25139709d6b0144ea29a, head b6a3b07915fc9a943013d225fceaf819fed3525b. Performance #562/34319389247 actually completed both exact checkouts, both Release builds, instrumentation verification, ABBA and upload. Artifact 10091519865,35233bytes,SHA256 f8190061d10fcd096f415aa555f40776ef785d6ec24bcd1c3e8c9fc897f378cc, independently downloaded/CRC-checked and recomputed. This archive contains paired comparison JSON, not the actual performance executable pair or OS traces.

All76pairs/19scenarios use AB/BA/AB/BA order. All72instrumented pairs preserve complete counters, breakdowns and compile/link/archive hit/miss semantics. Four timings-off counter sets are unavailable, not fabricated zero. Values below are paired medians; P95 with four pairs is the maximum, not a population-tail estimate. Only the final row uses external timings-off elapsed.

Scenario	Paired median Δms	Paired median Δ%	MAD ms	Paired P95 Δms	Slower pairs
cold	+25.992	+1.50	30.919	+91.398	3/4
no-op	−0.287	−5.81	0.334	+0.118	1/4
single-tu	+0.666	+0.75	29.484	+57.927	2/4
public-header	−1.107	−0.93	3.730	+3.166	2/4
build-run	−0.794	−4.77	3.068	+4.864	1/4
link-only	−23.630	−23.50	4.305	+2.148	1/4
target-scale-cold	−96.530	−2.27	44.512	−7.733	0/4
target-scale-no-op	+0.197	+0.58	0.203	+0.472	3/4
target-scale-no-op-auto	−0.085	−0.26	0.389	+0.607	1/4
target-scale-no-op-j1	+0.133	+0.32	1.010	+1.191	2/4
target-scale-common-header-no-op	+11.727	+31.33	11.474	+28.097	4/4
target-scale-single-tu	+9.911	+6.34	12.723	+28.927	3/4
discovery-cold	+8.455	+0.52	88.836	+330.929	2/4
discovery-no-op	−0.575	−6.57	0.730	+0.730	1/4
discovery-header	+7.614	+5.81	14.880	+88.768	3/4
modules-cold	−21.179	−1.20	6.995	+291.128	1/4
modules-no-op	−0.137	−2.38	0.269	+0.243	2/4
timings-enabled-no-op	−0.004	−0.08	0.050	+0.063	2/4
timings-disabled-no-op (external)	+0.067	+0.55	0.399	+0.560	2/4

The unchanged predeclared external median gate (worse by both1ms and10%) is not crossed. No performance improvement, zero-cost or causal-regression claim. Public-header scale no-op is slower4/4 with median+31.33%; discovery-cold and modules-cold adverse tails remain. Favorable link-only/scale-cold samples are not attributed to a new test executable that is absent from the production binary. No outliers are removed, no A/A subtraction and no same-head remeasurement. Initial#561 and every historical no-op/cold-tail observation remain distinct evidence.

#174 remains HOLD because its new trace fails the mandatory opening-boundary calibration. A below-threshold external median cannot compensate for that correctness/evidence-completeness gate or the initial independent Modules Debug C1041 failure. The three exact recorder/ownership/MQB executable members in separate input artifact10091459466 were also hashed and matched to observer provenance; they are not this performance job's executable pair.

[Iviesever]

Final iteration review — HOLD: native decoding fixed, opening trace coverage unproven

Implementation self-review plus separate read-only artifact recomputation, not independent human approval. Do not merge this iteration. Keep #174 Draft; keep #170/#172 held. The new mandatory native calibration gate fails even though the remaining corrected-head workflows completed successfully.

Exact base: 792fa39d3c2489ad520d25139709d6b0144ea29a.
Reviewed head: b6a3b07915fc9a943013d225fceaf819fed3525b.
Candidate/native test-merge tree: de320e2a7bb5422464db21e654dda71c29ecfcbd.
Test-merge faef0a2687f6e57bba613b87a43ba48885fab52c has the identical tree and exactly those base/head parents. Complete canonical base/initial/corrected source archives were independently reconstructed into their Git trees. All402existing files remain byte-identical; only four new test/CI files, 845 additions/0deletions. Product source/header, scheduler, original probes/matrices, benchmark, CLI/freshness, native inventory and VERSION5.5.0 are unchanged.

What actually passed and failed

• Native Debug #716/34319389236: actual Debug build, ambient/include/runtime/parameter and freshness/side-output checks, all paired shards and final gate passed. Not a classifier-induced skip.
• Native Release #608/34319389270: stage0, all Release shard jobs, complete self-host, staging and validation of the exact runtime-only package passed. publish-release skipped.
• Documentation #169/34319389286, Cross-Stage #193/34319389183 passed.
• File Event #2/34319389186: recorder/ownership-probe compilation and actual PowerShell parsing passed;16/16synthetic expectations match (2accepted/14rejected). Real trace failed its opening calibration after slot1; slots2–4notrun.
• **Original Default #12/34319389254:**56complete, all14unmanaged and14direct-drain controls pass on this head. **Original Private #14/34319389252:**42complete, all14unmanaged controls pass. These new outcomes do not erase the first-head positive-control failure.
• Independent original observer-OFF ABBA #562/34319389247: both exact checkouts/builds, instrumentation check,76pairs and upload actually executed; all72instrumented complete counter/breakdown/hit-miss identities match. No same-head rerun was requested.

New native evidence and the failed boundary

Corrected trace findings were independently recomputed from artifact 10091479006,3539322bytes,SHA256 551ca00d5f829c5c457373433fa660e6376735b63e30befaf17be8809c7fafad.

The33030144-byteETL has136596total/136594selected events, zero decoder errors, zero reported lost events/buffers and successful stop/decode APIs. Actual TDH schemas establish File24v0's unsigned32 Status field and Process2v2's ANSI ImageName; the latter is retained as opaque bytes while Unicode ProcessStart identity remains authoritative. This fixes the first source's65ANSI decoding errors and missing manifest status field without guessing payload offsets.

The closing calibration now independently matches a successful open Status0 and controlled denied open Status0xc0000043, consistent with native Win32error32. Success is paired at sequences136589/136590; sharing failure at136593/136594, within the native call's QPC boundary. The expected PID6848/TID8432 is matched. The volume+128bit file identity is from the separately retained calibration HANDLE; ETW FileObject/IRP are not promoted to durable file IDs.

But there are still zero Create events for the opening calibration, although its native open failed with the intended Win32error32. The exact unchanged positive auditor correctly rejects the trace as missing/ambiguous boundary calibration. Native recorder exit0 only says capture/decode completed; it does not mean the full evidence gate passed. This is 0accepted complete traces out of4planned, with one captured rejected slot and three explicitly unattempted slots. It is not a completed query-on/off comparison.

The traced PCH A/B original work itself succeeds, original service survives and pending A is suppressed. Successful compilation does not fill missing events. Zero reported loss is not a complete-coverage certificate, and no cause for the missing startup boundary is established. No sleeps, extra calibration attempts, discarded records or relaxed thresholds were added to make it pass.

Original correctness failures retained, separate from calibration failures

The first-source failure review keeps the independently executed default56 modules-debug-A-started-drain B/work0 C1041 exit2, despite /FS /Zi and a surviving original service. A/work0 and B/work1 succeed, pending A is suppressed, B link/run are unattempted; B recovery success is not original success. That workflow never calls this recorder. Initial default is13/14drain, not14/14. Its unchanged positive auditor is retained as rejecting the artifact; a separate failure-record audit does not convert the failed control into success.

Corrected-head original matrices retain 4default+3private managed-policy B C1090 failures and all28original A-started managed-service deaths. Default errors occur in /Zi Debug and /Zi Release, normal/cancel; private in PCH Debug, PCH Release and Modules Release normal endings. Original failures are not replaced by98successful later recovery compiles. Raw audit checked 562default/411private tool results and1124/822stdout/stderr files. B resource identity appears only7/56default and3/42private. Empty snapshots are not RPC completion or external-writer quiescence.

Performance is not a waiver

Complete corrected-head19-rowABBA, artifact 10091519865,35233bytes,SHA256 f8190061d10fcd096f415aa555f40776ef785d6ec24bcd1c3e8c9fc897f378cc: external timings-off no-op paired median +0.067ms/+0.55%,MAD0.399ms,max+0.560ms,2/4slower. The original BOTH>1ms AND>10% paired-median gate is not crossed. All18other scenarios are instrumented; unavailable external counters are not zeros. Four-pair P95 is a maximum, not a population-tail estimate.

Retain common-header scale no-op 4/4slower,median+11.727ms/+31.33%, discovery-cold tail+330.929ms and modules-cold+291.128ms. Favorable link-only/scale-cold samples are not attributed to inactive test-only additions. First-head#561 has its own preserved76pairs/externalmedian+0.390ms/+3.59% and discovery-cold+730.446ms tail. No noise-based sample removal, AA subtraction, speedup/zero-cost claim or historical-debt closure. Paired JSON is not an OS trace or the archived performance executable pair.

Provenance and limitations

Fourteen original ZIPs (seven per source head) were downloaded and verified by digest/CRC. Separate input ZIPs contain the three actual recorder/ownership/MQB executables; each actual hash matches observer provenance. These are not the performance binary pair. Raw ETLs, payloads, schema metadata and decoded records are retained; compiler-generated PDB/PCH/OBJ/EXE bodies are excluded by the existing artifact contract. Raw traces contain disposable-VM system activity, not product-wide tracing.

The complete source archives reconstruct to the declared base/initial/corrected Git trees. The first local archive check inherited core.autocrlf=true and failed on401text members; the cause was recorded and archives regenerated with explicit LF settings, then every blob/tree verified. No remote source/CI/raw artifact changed for that correction. A transfer typo existed only in an unreferenced blob and was caught by exact hash checking before tree/commit creation. Local checks are Python/YAML/source/patch replay; no local MSVC/PowerShell or native ETW execution is claimed.

Decision and next handoff

HOLD; no merge, no release, no authorization of CLI cancellation, writer leases or M1b completion. The actual decoder now records a calibrated native failure at the closing boundary, but the main acceptance requirement of bracketed capture is unmet. A successful new default control cannot explain away initial C1041. Keep both source histories and artifacts, with configured30-day Actions retention and an additional delivery copy.

Continue inside #174 with one bounded, event-backed recording-readiness design and a deliberately missing-readiness negative test before any real compiler workload is admitted. Avoid arbitrary startup sleeps, repeated markers until green, additional success-only samples or another parallel investigation PR. Existing raw ETLs should remain useful for offline decoding/correlation regression. Missing historical events cannot be reconstructed retroactively. #170/#172 stay held; transaction/build-run/session/residency and final VERSION/release work remain separate.

[Iviesever]

Resume same PR: bounded, event-backed recording readiness before compiler admission

Reconfirmed main/base 792fa39d3c2489ad520d25139709d6b0144ea29a, current head b6a3b07915fc9a943013d225fceaf819fed3525b; no competing observer PR. Existing #170/#172 holds and all original #174 failures remain.

Pre-measurement design: keep the ETL as the authoritative offline record, add a real-time consumer of the same session. Before issuing the existing opening calibration, require an actually decoded Kernel-File Create/OperationEnd pair. Then issue the opening success/conflict calibration once, require its two correctly attributed native-status pairs delivered within their native QPC boundaries, and only then launch the compiler fixture. Admission waits share one fixed 10-second deadline; API calls/cleanup are not claimed hard-time-bounded. No sleep, repeated marker, sample-size adaptation or success-only retry. Readiness cannot be inferred from EnableTrace success, thread startup or zero loss counters.

Add one separately labeled negative run with the file provider deliberately not enabled: it must time out/refuse admission, record no child, and leave a child-execution sentinel absent. This is a gate test, not a real MSVC failure or a provider root-cause explanation. Offline audit must independently find both readiness evidence and the unchanged pre/post calibration in the ETL. Preserve live consumer status/error and all original loss/decode/cap checks. Existing old ETLs/decoded records remain rejecting offline regression inputs, never fabricated complete.

The real study budget stays four fresh cases (rm-on/off, off/on); original default56/private42 and all their positive controls remain independent required gates. Full exact-source native Debug/Release/self-host/package and original independent observer-OFF19x4ABBA remain required. Keep the same external no-op paired-median gate (worse by BOTH1ms and10%), all72instrumented semantic identities, unavailable timings-off counters, all adverse samples and historic holds. VERSION5.5.0/product source/CLI/freshness remain unchanged. Synthetic case inventory will be finalized in the commit evidence before this new head is measured.

[Iviesever]

Pre-push implementation and validation inventory

The same-session live readiness change is prepared against b6a3b079...: four existing PR files only, incremental diff 411 additions/22 deletions. All402 mainline files remain untouched. Positive capture schema2 requires a live successful Create/OperationEnd pair and exactly one live-observed opening success/conflict pair before child launch; the offline verifier independently matches live raw payload/header/QPC/data back to the authoritative ETL. Both provider delivery and opening confirmation share one10-second admission deadline and an8192-outstanding-IRP cap. No calibration retry or sleep.

Added one actual native negative invocation with file-provider enable withheld: timeout, no calibration, no launched child and no child-execution sentinel are all required. The original four traced compiler slots and default56/private42 are unchanged; this negative is explicitly separate from real compiler outcomes. It neither attributes C1041 nor changes an original positive control into an expected failure.

36 local Python synthetic expectations pass (4accepted/32rejected): original16 retained,14readiness identity/order/status/correlation mutations,6negative-admission shapes. Re-ran the new read-only verifier against both old raw event artifacts: initial source still rejected for decode errors; b6a3b07 still rejected for absent opening calibration. No native artifact was modified. Reconstructed the complete previous source Git tree and matched de320e2a7bb5422464db21e654dda71c29ecfcbd; whitespace checks passed. Windows/MSVC/PowerShell execution remains to be supplied by this new head's CI, not inferred from these checks.

All original merge gates, performance threshold, fixed four-case sample budget, initial failures and historic holds remain. Live delivery is an admission witness, not a complete-writer or durable-storage proof. CloseTrace ERROR_CTX_CLOSE_PENDING is retained as its documented successful real-time close status, not mislabeled an error or suppressed; ProcessTrace and loss/decode checks remain required. Primary lifecycle contracts: Microsoft EnableTraceEx2, OpenTrace/EventTraceLogfile and CloseTrace documentation.

[Iviesever]

First readiness head fails native compilation; exact one-line correction

Head b2498eca2521a162366819eec7fa329473b69701 is not accepted. Actual MSVC recorder build in Event#3/34323764257 fails C2398 at line472: list-initializing LiveReadiness's uint64_t frequency with QueryPerformanceFrequency's signed LONGLONG is narrowing. The ownership probe build completed, but the readiness refusal/real four-case observer job was skipped, not passed. Windows36synthetic expectations and PowerShell parsing passed separately.

Downloaded original build artifact10093114546 (5017bytes), SHA256 d419c2a2f5209572e1bdcd553341f7566e94d1154713e9835a5fb6df6579f0a6; original recorder diagnostics and source remain preserved. No actual readiness/capture observations exist at this head. Contract artifact10092895082 (1242bytes), SHA256 92ef548a2e011c6110d0ac0ffb2d28ad70d6a460477e4c65a9992c0d22ab4097, independently confirms36/36(4accepted/32rejected).

Correction is only an explicit static_cast<std::uint64_t>(frequency.QuadPart) at the constructor call. QueryPerformanceFrequency success remains checked before use. No wait budget, readiness semantics, fixture workload, tracing mask or acceptance gate changes. A local strict GCC23 minimized regression rejects the original braced conversion and accepts the explicit cast; this is a syntax regression, not a local Windows runtime test. Corrected head gets its own exact-source CI/ABBA; original cancelled/incomplete runs are not relabeled successful, and no same-head retry is requested.

[Iviesever]

Preserve first readiness-head measurement and cancelled-prefix provenance

The targeted C2398 conversion fix is now head 18f212865df52ea86431489adf80ff96a8c8a019, tree 7580fe467e0c7053c43a79aebb69c07ce4f9c8a9; the source difference from b2498eca... is exactly one line. Its new exact-source runs are independent. No same-head CI or benchmark rerun was requested.

Initial-head Performance#565/34323764223 completed before the source correction. Artifact10093209573,35818bytes,SHA256 45d70dd1fe8f177d63ce80ac9e3973d265088ca36617bea9405ee98c456d1b0f was independently downloaded/CRC-checked and all76pairs recomputed. All72instrumented complete counters/breakdowns/compile-link-archive hit-miss identities match. External timings-off no-op paired median −2.135ms/−13.91%,MAD4.781ms,max adverse+5.519ms,1/4slower; the original BOTH>1ms AND>10% median gate is not crossed. This is not a speedup or zero-overhead claim. Instrumented adverse samples remain: cold4/4slower,median+203.904ms/+12.42%; link-only4/4slower,median+36.660ms/+60.09%; scale-cold max+1962.480ms. Their causes are not attributed, favorable values do not erase adverse ones, and historical debt remains open. Only the external row uses timings-off elapsed; four-pair P95 is a maximum.

Initial private42 artifact10093281237 (4913467bytes), SHA256 576604f0db3466f85a4b199b7ba641ef09bd56294c79f1bdac49d24015653c8f, completed and was independently checked. Three original managed B failures remain: PCH Release normal/cancel and Modules Debug normal under A-started services. All required private unmanaged controls pass; recovery is separate.

Initial default#13 was cancelled by the genuine source correction, retaining artifact10093305969 (7939221bytes), SHA256 dc26e90f20043c29462b9b671fc23ed526d246ee4af38c327b669a06e102f47c. Its checkpoint has 35/56 completed rows, no failed collector row in that completed prefix, plus original adverse B results for /ZI A-started normal and /Zi Release A-started cancel. It is incomplete, not full default validation, and remaining/in-progress records are not counted as passed. The corrected head must independently meet all gates; no old result is relabeled as corrected-head evidence.

[Iviesever]

Actual event-backed readiness and four complete traces independently verified

Exact head 18f212865df52ea86431489adf80ff96a8c8a019, base 792fa39d3c2489ad520d25139709d6b0144ea29a. Event#4/34324815389 actually built the corrected recorder on Windows and ran the negative admission control plus all four fixed compiler cases on a separate VM. Downloaded artifact 10093649346, 12145647bytes/331entries, SHA256 13de1b3f15b4cf91d61466d0ab1bf5157d8ff2f4c763478ef144caa3fecc437c; CRCs and all raw records checked.

Native missing-readiness control passed. With file-provider enable deliberately withheld, the actual wait reached its 10-second deadline (decision10.000539seconds after start), wait_status258, no provider/opening witness, no calibration, child=null, and the child-execution sentinel absent. Native exit1 was required and independently distinguished from an arbitrary infrastructure failure. Its ETL has33selected process events and no file events, with zero reported loss/decoder errors. This is a controlled observer refusal, not a manufactured MSVC C1041 failure.

4/4 real traces now pass full offline integrity and original A/B controls. The original plan remains rm-on/off,off/on; no slot repeated or added. For each trace the offline auditor matched the live provider witness and both live opening-calibration events back to exact selected header/QPC/raw-payload/decoded-data identities in the authoritative ETL. The opening acknowledgement precedes child launch; all eight controlled native sharing failures (Status0xc0000043/Win32error32) and eight successful opens are independently correlated across the original before/after boundaries. Child PID+creationFILETIME matches the process-start stream. Live/offline stop/decode/loss/cap checks all pass; actual CloseTrace statuses were0.

Slot	Admission acknowledgement ms from start	Selected ETL events	ETL bytes	Original A+B control
01-rm-on	2314.3436	133400	31719424	pass
02-rm-off	2102.4674	106172	24379392	pass
03-rm-off	3032.3323	106823	24641536	pass
04-rm-on	4214.4031	105673	26738688	pass

These are observed gate intervals, not a hard deadline for OS APIs, teardown or compiler completion. The live consumer makes delivery observable; it does not retroactively identify the kernel reason for the old missing opening events. Both historical traces still fail the new offline audit for their original missing/decode evidence, and are not repaired or relabeled.

The four real cases contain 300 selected PDB/PCH open-completion pairs, all with attributed process lifetimes in this recorded scope; this does not establish all-writer coverage. Each preserves six raw nonzero statuses0xc0000034 (24total), while its original A compile and B compile/link/run succeed. Those event failures are retained, not automatically classified as C1041 or deleted. C1041 was not observed in these four new fixtures. Original service survival, A/B overlap, suppression of pending A work and original outputs were checked; no recovery result replaces original outcomes. The 44original tool results and88stdout/stderr files are retained.

Exact input artifact 10093594207 (1368165bytes), SHA256 4dc42a590e3df863dd97739764f158387883133b893b13acb7b2d95b112b0641: actual three executable members independently hash-match observer provenance: MQB c01c2d4c004e6b604b5a6f1f1c38e2eb83e45949d7bd0e084781baa8bb9f8732, ownership probe 31e86508e8501dfe0ccbe2f26ec7af807ae51486d090c813efdbbff59010f4e4, recorder 7b298c4d9144abd607802fc2ccc6378ce1013f0d127194033653607f295119dd. These are observer inputs, not the performance workflow's binary pair. Build artifact10093594598 and contracts10093309600 also verified;36/36synthetic expectations match(4accepted/32rejected), plus actual PowerShell parsing.

This closes the readiness/trace gate for this head, not the entire merge decision yet. Original native/default/private and independent ABBA are separately reviewed. No historical C1041/performance hold, CLI cancellation, complete external-writer drainage or writer-lease authority is released by this result.

[Iviesever]

Corrected-head independent ABBA and unchanged ownership regressions audited

Base 792fa39d3c2489ad520d25139709d6b0144ea29a; head 18f212865df52ea86431489adf80ff96a8c8a019. Performance#566/34324815334 actually performed both exact checkouts, both Release builds, instrumentation check, ABBA measurement and upload. Downloaded artifact10093596974,35727bytes,SHA256 fbd6f30de87c440f58927f00737c8c633fc0eb539be580de52694bced2abb124; all76pairs independently recomputed.

All72instrumented pairs have identical complete counters, breakdowns and compile/link/archive hit-miss values. The four timings-off external samples have unavailable counters, not zeros. Order is AB/BA/AB/BA; no pair is removed. Only the final row uses external elapsed; all others use mqb.timings instrumentation. Four-pair nearest-rank P95 is the maximum, not a population-tail estimate. Paired medians and percentages are recomputed from each pair's own denominator.

Scenario	Paired median Δms	Paired median Δ%	MAD ms	Paired P95 Δms	Slower pairs
cold	+47.161	+2.79	86.656	+221.974	3/4
no-op	+0.021	+0.47	0.184	+1.245	2/4
single-tu	−13.988	−11.37	18.601	+12.098	1/4
public-header	−4.112	−3.30	14.707	+79.271	2/4
build-run	+0.105	+0.68	6.021	+11.114	2/4
link-only	−8.007	−8.44	14.583	+116.383	2/4
target-scale-cold	−72.882	−1.71	94.162	+980.648	1/4
target-scale-no-op	+1.235	+4.03	0.411	+5.381	4/4
target-scale-no-op-auto	+0.500	+1.69	0.256	+10.580	4/4
target-scale-no-op-j1	+0.890	+2.28	1.002	+4.337	3/4
target-scale-common-header-no-op	−0.199	−0.51	1.056	+2.166	2/4
target-scale-single-tu	+9.087	+7.53	19.777	+38.741	2/4
discovery-cold	−8.056	−0.47	39.077	+55.901	2/4
discovery-no-op	+0.423	+5.52	0.088	+0.542	3/4
discovery-header	+8.665	+7.98	296.173	+829.318	3/4
modules-cold	−135.079	−6.52	182.459	+84.725	2/4
modules-no-op	−0.001	+0.01	0.237	+0.726	2/4
timings-enabled-no-op	+0.048	+1.36	0.149	+0.205	2/4
timings-disabled-no-op (external)	−1.253	−8.04	1.333	+3.622	2/4

Unrounded external paired medians −1.2531ms/−8.0432756% do not cross the unchanged gate (worse by BOTH1ms and10%). No speedup/zero-overhead claim: all402main files remain byte-unchanged and the recorder is not part of the performance invocation. The scale-no-op and auto variants are slower4/4; scale-cold+980.648ms and discovery-header+829.318ms adverse tails remain. Neither favorable samples nor lack of source attribution permits deleting these observations as noise. Old#170 crossing and all historical cold-tail debt remain unresolved. This comparison JSON does not contain the performance executable pair or OS traces; observer-input executables are a separate artifact.

Original default56/private42 separately complete and pass their required positive controls on this corrected head. Independently audited558/413original tool results and1116/826stdout/stderr files, all original outcome identities/flags and cleanup envelopes. Default14direct-drain controls and both modes'14unmanaged controls pass. Original probes, collector behavior, compiler workloads and flags are unchanged.

Adverse managed-termination cases remain 6default+2private original B failures. Default: /Zi Debug normal(C1090), /ZI Debug normal(C1001), PCH Debug cancel(C1090), PCH Release cancel(C1090), Modules Debug normal(C1090), Modules Release normal(C1090), all A-started. Private: /Zi Release cancel and Modules Debug cancel(C1090). Their failed link/run remain unattempted; later recovery compiles do not replace them. Across both modes all28A-started managed endings still kill the original service. B resource identity appears only15/56default and1/42private snapshots; empty or missing snapshots do not prove external-writer quiescence.

Raw ownership artifacts verified: default10093741189,12420337bytes,SHA256 7a9528236e930eac5f9a62b862db41ffdc2dec7a0c94ec18d4baae44f10ce149; private10093689633,4915453bytes,SHA256 68d14deb371799d3d1401a3da5c13ee50e6f4eefa5151b43d077421db68c3b74. Generated binary inventories have711/532entries but omit binary bodies, are post-case snapshots and not failure-instant evidence. The earlier cancelled35/56prefix and old C1041 failures remain separately preserved, not relabeled passed.

[Iviesever]

Final readiness iteration review — accept calibrated file-event tooling, not historical-cause resolution

Implementation self-review with separate read-only source/artifact/statistics checks; this is not an independent human approval.

Exact base 792fa39d3c2489ad520d25139709d6b0144ea29a; reviewed head 18f212865df52ea86431489adf80ff96a8c8a019; tree 7580fe467e0c7053c43a79aebb69c07ce4f9c8a9. PR test-merge 959eaac8fb13626d6d84911eeaad46aeb3fbe143 has this identical tree and exactly those parents. The complete PR adds four files/1234lines; all402existing main files remain byte-identical. Increment since the previously held b6 head is411additions/22deletions. Complete canonical source-tree reconstruction and patch application reproduce the candidate tree.

Verified Git blobs: recorder d726476eedc661bbc916e899555a5dc1f9f5dbad, Python verifier d3422ff292e2df4bc95ccfc26d7cd150f7e3b55f, PowerShell collector 4380e4210ce292a8bad8fd9c190d26b77cf55947, workflow bb1a7757a106743fcfdd54e1de0bff774796613d. No product source/header, scheduler, original probes/ownership collectors, benchmark/ABBA, manifest, native executable inventory, CLI/freshness or VERSION change.

Previously missing readiness boundary now has actual evidence

The live consumer observes the SAME session as the authoritative ETL. It first requires a real successful Create/OperationEnd pair, then the original opening calibration is issued exactly once. Both its success and STATUS_SHARING_VIOLATION pairs must be delivered with matching native PID/TID/QPC before child launch. A single10-second admission budget covers both waits; no sleep, repeated marker, or sample expansion. Live state is synchronized and serialized after consumer join. The offline verifier uniquely rematches live selected event headers/QPC/raw payload and TDH-decoded data to the ETL-decoded stream, so an in-process ready flag is not sufficient.

The passive provider witness can fail closed when no suitable event arrives; admission is not guaranteed on a quiet host. Provider API calls, queued-buffer drainage, teardown and compilation are NOT hard-time-bounded by the admission wait. Live witness fields are not continuous OS-writer coverage. The Python auditor checks the recorder's decoded stream and raw fingerprints; it does not independently implement a binary ETL decoder.

All current-head gates completed on their first attempt

• Native Debug #718/34324815386: actual Debug build, all paired subshards, ambient/include/runtime/parameter and freshness/side-output checks, final gate passed. Not classifier-induced skip.
• Native Release #610/34324815289: Stage0, all four Release shard jobs, full self-host, package staging, exact runtime-only package validation and upload passed. publish-release skipped.
• Documentation #171/34324815504 and Cross-Stage #195/34324815191: passed.
• File Event #4/34324815389: actual recorder compilation, PowerShell parsing,36/36synthetic expectations(4accepted/32rejected), native withheld-provider refusal and all four real traces passed.
• **Original default #14/34324815411 and private #16/34324815273:**56/56 and42/42complete; all required unmanaged controls and all14direct-drain controls pass.
• Independent original observer-OFF ABBA #566/34324815334: both exact source builds, instrumentation validation,19x4measurement and upload ran. All76pairs independently recomputed;72instrumented complete counter/breakdown/compile-link-archive hit-miss identities match; four external timings-off counter sets remain unavailable, not zeros.

Native trace gate: positive and negative controls both work

The full raw trace inspection verifies 4/4 complete traces, all 8controlled native sharing failures and8successful opens, live/offline correlation, child PID+creation identity and original A/B success. Original fixed slot order remains rm-on/off,off/on. Admission acknowledgements occurred at2.102–4.214seconds in these samples, not a general latency guarantee. All stop/loss/decode/cap checks passed.44original tool results and88stdout/stderr records are preserved.

The independently labeled negative run withheld file-provider enable. It actually reached the10-second deadline (10.000539seconds observed), returned wait258, recorded no calibration or child, left the sentinel absent, and had no file events. Expected native exit1 was distinguished from arbitrary failure by its full trace/readiness state. This calibrates refusal; it is not an artificial reproduction of MSVC C1041.

Across the four positive traces,300selected PDB/PCH open-completion pairs have attributed process lifetimes in this recorded scope.24nonzero Status0xc0000034 events remain while original compiler controls pass; these were not deleted or automatically classified as C1041. No C1041 occurred in this new four-case fixture. Finite coverage, calibration and zero reported loss do not enumerate every writer, establish RPC completion/durable quiescence or explain missing historical events. Both historical-cause and lease-safety fields remain false.

Raw trace artifact10093649346 (12145647bytes/331entries), SHA256 13de1b3f15b4cf91d61466d0ab1bf5157d8ff2f4c763478ef144caa3fecc437c, and all current inputs/build/contracts were CRC/SHA checked. The actual three input executable members match source/probe/observer provenance. They are NOT the independent performance workflow's executable pair.

Independent performance and adverse ownership evidence retained

The complete19-rowABBA and original matrix audit keeps every favorable/adverse pair. External no-op paired median −1.2531ms/−8.0433%, maximum adverse+3.622ms,2/4slower: unchanged BOTH>1ms AND>10% median gate not crossed. No speedup or zero-overhead claim. Instrumented scale-no-op and auto variants are slower4/4; scale-cold+980.648ms and discovery-header+829.318ms tails remain. Four-pair P95 is a maximum, not a population-tail estimate. No AA subtraction, noise-based sample removal or historical cold-tail closure.

Original default/private matrices preserve 6+2original adverse managed B failures(C1090/C1001), all28A-started managed-service deaths and unavailable/missing resource identity. Original failed link/run remain unattempted; later recovery does not replace failure. These are the intentionally adverse managed-termination experiments, not failures of the new readiness/PCH controls.558/413tool results and1116/826stdout/stderr files were audited. Default B-resource identity15/56,private1/42 is not a no-writer certificate.

All earlier failures stay visible

The immediately preceding readiness head b2498eca... failed real MSVC recorder compilation with C2398; no native readiness/trace experiment ran. Only the QPC frequency constructor argument was explicitly cast in the correction. Its Native Debug#717,Release#609 and default#13 ended cancelled by the genuine source change; default retains a35/56checkpoint and is not full validation. Completed old ABBA#565 and private42 retain their own adverse samples. No same-head rerun was requested.

Older cfa894c.../b6a3b079... traces still fail offline for ANSI/status decoding or missing opening calibration; their missing events were not invented. The older independent Modules Debug C1041 positive-control failure also remains a failure. Current positive controls do not erase or explain it. The prior source-archive LF/CRLF audit correction and original raw artifacts remain recorded. Local36-casePython and minimized GCC narrowing regressions are not local MSVC/ETW execution.

Decision and handoff

Accept ordinary merge with expected head 18f212865df52ea86431489adf80ff96a8c8a019, subject to unchanged main/protection. This closes this PR's specified recording-readiness/calibration acceptance gate without lowering its requirements. It does NOT release #170/#172, mark M1b complete, authorize CLI cancellation or writer-lease transfer. Keep VERSION5.5.0 and formal release work separate.

Next use this accepted, calibrated recorder in a bounded investigation of the unresolved actual PDB-open/compiler failures; do not create another competing observer or infer historical causes from successful reruns. Any re-review of #170/#172 must use the then-current main and resulting tree with their original failures explicitly retained. Tracing file opens is not RPC instrumentation, all-writer enumeration, crash recovery or transaction completion. Actions retain artifacts30days; raw current and earlier ZIPs, canonical source archives and offline reproduction are separately retained for delivery. Any title/ready-triggered skipped perf workflow is not substituted for actual#566, and new post-merge push CI is not claimed completed by this review.