test: calibrate native PDB failure and observer evidence

[Iviesever]

Final decision: accept test-only evidence capability; historical faults remain unresolved

Final exact-source review, explicit limited-risk decision and handoff

Accept ordinary expected-head merge of the investigative code. This deliberately revises the earlier PR-level HOLD, but does not declare the historical warm/concurrent C1041 fixed or reproduced. Current mandatory controls pass, and the tool now demonstrates that it can correctly preserve a real compiler failure, native service event and original diagnostics—not just collect successful runs. The unresolved historical root-cause and performance debts remain in #164 and continue to limit production cancellation/transaction/lease/release acceptance. #170/#172 are not approved by this decision.

Exact source and unchanged product boundary

• Base 564becf9d9e99ed91de0ed0f38407872797957a6.
• Reviewed head 33ebb4dda4fbab063d0b94cea556b3e717241822.
• Candidate and native test-merge tree 6a91360d2125a08083a01192bc083b814b905438.
• Native test-merge e05c39784c5eb9af60b16de9bf66e4424fb9fca1, exact declared base/head parents.
• This iteration: four test/CI files,423 additions/6 deletions. Full PR: six files,1188 additions/64 deletions;403of407base files byte-identical,409candidate files. Canonical source tree and full/incremental patch replays verified.
• No product src/include, scheduler, accepted ETW recorder/readiness/verifier, original default/private collectors, benchmark/ABBA, manifest/native inventory, CLI/freshness or VERSION change. VERSION remains5.5.0; no historical tag/asset or formal release change.

What the code now provides

The prior parts of this PR record native coordinator API envelopes and compiler invocation intervals, preserve process creation identity, ambiguous child candidates, native return codes, and explicitly unattempted/null RM-query evidence. Fixed existing P/M, exact preexisting Zi traced/untraced and RM-on/off studies remain. No time-overlap-to-RPC-ownership inference is introduced.

This iteration adds a separately labeled cold B-PDB fault calibration, using the existing recorder and fixed baseline/conflict,conflict/baseline four slots. Seed starts a real default MSPDBSRV; A preparation succeeds; B uses a fresh directory and original6000-function input with /FS /Zi /Od /MTd. Both arms create an empty share0 placeholder using CREATE_NEW. Baseline removes it before first B compilation; conflict holds it until the first compilation and its original diagnostics are saved. The same held object is marked for deletion through FileDispositionInfo and closed only at the declared point, after checking it remains empty; no produced MSVC PDB is path-deleted.

First compile, holder identity/release, native file events and one separate recovery are independently checked. Original nonzero results remain nonzero. A calibration success is not an original-positive-control success, historical reproduction, scheduler-cancellation proof or safe writer-lease release. The state fields preserve those distinctions.

Actual current-head validation

Gate	Actual first-attempt run	Result
Native Debug/all subshards/freshness/runtime/parameter	#727/34377199110	Passed, actual execution
Complete Release/self-host/exact runtime-only package	#617/34377199187	Passed; publish-release skipped
Documentation/Cross-Stage/original PDB study	#178/34377199169;#204/34377199024;#8/34377199072	Passed
Record contracts and native build	Event#11/34377199236	33fault+54invocation+64observer+36trace expectations, PowerShell parsing and native build passed
New cold-B calibration	Event#11/34377199236	2baseline successes+2expected original C1041 failures;4separate recoveries; all4full calibrations pass
All retained studies	Event#11/34377199236	8P/M+4references+4T4U+4RM-on4RM-off complete, native refusal controls preserved
Original default/private matrices	#21/34377199206;#23/34377199116	56/56 and42/42complete; required positive controls pass
Independent original observer-OFF ABBA	#583/34377199191	76pairs measured/recomputed;72complete instrumented semantic identities match

Full raw fault result, executable provenance, original matrices and all19ABBA rows

Both injected cases produce C1041/exit2, each with two actual retained-MSPDBSRV sharing failures0xc0000043 on exact B/compiler.pdb wholly inside the original B invocation and held interval. Baseline originals exit0. All four recoveries separately exit0. The16toolresults/32diagnostics,64real PDB/PCH pairs, native readiness/refusal and8failure+8success boundary markers were checked. Two complete input comparisons match10sources/8argv. This proves the reporting path for this artificial empty-PDB conflict; it does not reconstruct the older warm/concurrent failure.

Existing studies contribute292original tool results/584diagnostics, and preserve31ambiguous tool intervals. All five studies' actual input executable bytes match source/observer provenance. They are not the independent performance binary pair. Original default matrices retain no B failures this time; private retains four adverse managed-policy failures(C1090/C1001). All28A-started managed endings still kill the original service. Empty resource-owner snapshots are not writer-quiescence proof.

Performance and earlier failures stay adverse evidence

External timings-off no-op paired median +0.4617ms/+4.2782%,max adverse+1.184ms,3/4slower; the original BOTH>1ms AND>10% gate is not crossed. Preserve scale-cold +4627.868ms tail,scale-single-TU median+89.170ms/+72.44%,modules-no-op4/4slower and all favorable/adverse pairs. No zero-overhead/speedup claim, noise-based deletion, AA subtraction or historical debt closure. Four external counter sets are unavailable, not zeros; four-pairP95 is a maximum. Only the external row uses timings-off elapsed.

Initial head0c6bcda had one accepted baseline/one rejected conflict/two unattempted slots. Real C1041 and native service sharing violations were present, but full diagnostic path matching mishandled mixed slashes. The correction only normalizes separators/case for the complete path with token boundaries and adds six tests; it does not change native behavior or the predetermined PDB diagnostic set. Old raw results remain unchanged, and corrected offline interpretation does not turn the old workflow green or fill missing slots. Initial Release#616 was cancelled; initial ABBA#582 remains separately retained. Old-parent title-triggered#581 stopped during baseline build before measurements. No same-head benchmark or CI retry was requested.

The original600208d default artifact still fails its original positive oracle for B/work0 C1041. No historical pass is fabricated and no current failed check is waived. This review accepts a diagnostic tool despite explicitly retained unresolved historical risk; it does not assert that cold-file injection explains the old defect. Original positive tests remain enabled and future failures still block their own gates. Cause/lease flags stayfalse, M1b is incomplete, and no production retry/workaround is introduced.

Handoff and retention

End this observer-expansion subseries. Next re-review #170 against the updated main and exact resulting tree with its own evidence and explicit historical-performance disposition, then return to typed original-failure/cancellation propagation and real scheduler integration. A failed compile must not become cancellation-success or permit link/cache publication. That work is separate, not implemented or authorized here. External-writer ownership, transaction/write-lease release, build/run/session/residency and formal release remain dependent gates.

Sixteen immutable coreZIPs(11current+3initial+2historical), four complete source versions, patches and executed read-only reproductions are retained in delivery. This is not every Actions artifact. Actionsretention30days; generated compiler binary bodies are excluded by the established diagnostic contract, and post-case inventories are not failure-instant snapshots. Local GCC declaration-shim syntax/Python checks are not local MSVC/ETW execution. The temporary perf title changed only after actual#583completed; later skipped perf jobs are not new measurements. Post-merge push CI is not claimed completed by this exact-tree review.

[Iviesever]

First exact-head Windows record contracts independently inspected

Head 600208de2d5c37872f205a346929ff9c4be796e2, base 564becf9d9e99ed91de0ed0f38407872797957a6. Contract job102425736938 in Event#7/34339207782 passed the actual PowerShell parse and all three Python suites. Downloaded artifact10098992729,3303bytes,SHA256 05ad16fd040df705e393090d798c43da5aeedd79b4bbe691c945cfca6b71fc54, ZIP CRC/digest and every recorded expectation checked: new observer38/38, original invocation40/40 and trace36/36. This closes the record-test gate, not native API/trace verification.

The new analyzer also rejects an unchanged #175 metadata snapshot lacking observer boundaries with missing/invalid observer boundary (historical data not backfilled). No old call windows are invented. An initial read-only ad hoc audit used the invalid Python encoding spelling utf8-sig and failed before parsing; corrected to utf-8-sig and reran only that local read. No repository source, raw archive or CI rerun changed.

Full source review confirms original CreateFileW access128/share7, original native RM sequence and MoreData bounds, and original input/compiler flags are preserved. Native return/GetLastError is captured before after-QPC; fixed-buffer overflow records failure without discarding the original call. No exceptions or allocation occur in the native-call logging wrapper itself. RmEndSession still runs through the original scope cleanup, with its return separately retained rather than substituted for the query result. Actual Windows probe build and fixed real studies remain separate required gates.

[Iviesever]

Independent exact-base/head ABBA completed and recomputed

Base 564becf9d9e99ed91de0ed0f38407872797957a6, head 600208de2d5c37872f205a346929ff9c4be796e2. Performance #573 /34339207855 actually checked out both refs, built both Release executables, verified instrumentation, measured ABBA and uploaded the comparison. Artifact 10099361442,35555bytes,SHA256 6cfd98d9c0dabda78fce16a05e6c6c8a4e6d6b18f8b35a757d0df965d84f9367 downloaded and CRC/hash verified.

Independent read-only recomputation checked all 76 pairs /19 scenarios, AB/BA/AB/BA orientations, every stored pair delta, paired median/MAD/nearest-rank P95 and marginal medians. 72/72 instrumented pairs preserve complete counters/breakdowns/compile-link-archive hit-miss identity. Four external timings-off counter sets are unavailable, not zeros. Only the final row uses timings-off external elapsed; all other rows use mqb.timings. Four-pair P95 is a maximum, not a population-tail estimate.

Scenario	Paired median Δms	Paired median Δ%	MAD ms	Paired P95 Δms	Slower
cold	−3.335	−0.17	42.983	+62.746	2/4
no-op	−0.153	−3.26	0.206	+0.184	1/4
single-tu	−74.284	−26.89	80.400	+6.182	2/4
public-header	−8.230	−7.56	7.007	+3.831	1/4
build-run	+0.461	+3.06	0.445	+1.223	3/4
link-only	−31.639	−31.98	26.743	−2.350	0/4
target-scale-cold	−88.974	−2.08	298.922	+389.823	2/4
target-scale-no-op	−0.180	−0.53	1.748	+3.416	1/4
target-scale-no-op-auto	−0.083	−0.21	4.239	+7.692	2/4
target-scale-no-op-j1	−1.149	−2.41	2.513	+16.899	2/4
target-scale-common-header-no-op	+0.183	+0.48	6.597	+12.069	2/4
target-scale-single-tu	+0.096	+0.09	18.428	+34.804	2/4
discovery-cold	−58.407	−3.38	157.519	+229.675	1/4
discovery-no-op	−1.384	−12.49	1.853	+0.964	1/4
discovery-header	−10.599	−8.73	16.783	+14.555	1/4
modules-cold	−123.718	−6.30	262.099	+295.475	1/4
modules-no-op	−0.030	−0.48	0.180	+0.217	2/4
timings-enabled-no-op	+0.039	+1.01	0.030	+0.086	3/4
timings-disabled-no-op (external)	−1.749	−10.38	2.409	+0.875	2/4

Unrounded external medians −1.7493ms/−10.3774392% do not cross the unchanged BOTH>1ms AND>10% regression gate. No speedup/zero-overhead claim: product src/include and benchmark remain byte-unchanged, and the observer probe is not part of these invocations. Preserve adverse build-run3/4slower, target-scale-j1+16.899ms, scale-cold+389.823ms and modules-cold+295.475ms tails. Their causes are not isolated; no samples are discarded as presumed noise or offset against favorable ones. Historical #170/cold-tail holds remain open.

This closes this head's independent ABBA gate only. Native full correctness and actual eight/four traced studies remain independently required. No same-head remeasurement was requested. The artifact contains comparison JSON, not raw process/OS traces or the actual performance binary pair.

[Iviesever]

Blocking original default-control C1041 — HOLD, not waived by successful new tracing

Exact head 600208de2d5c37872f205a346929ff9c4be796e2. The original default56 workflow #17 /34339207791 retains one failed positive control: zi-debug-preexisting-drain. Independently downloaded artifact 10099429348,12424896bytes,SHA256 e41256279fb5cf2ed4f4b89a9209ce12e1e73602b322d1335d419ef8abf9e6bf. ZIP digest/CRC and original records are intact.

The original B/work0 compiler exits 2 with C1041 cannot open B/compiler.pdb. Its actual argv already includes /FS /Zi /Od /MTd; this is not a missing-/FS fix. A/work0 and B/work1 succeed, the original preexisting MSPDBSRV survives, pending A work is suppressed and cleanup is verified, but B link/run are unattempted(-2), not passed. B's separate recovery compile succeeds and does not replace the original failure. No exact historical causal explanation is available from this untraced default case.

All56 rows completed, with 13/14 direct-drain positive controls passing. The unchanged positive matrix auditor rejects the artifact with collection/control failure. A separate read-only failure audit checks all56 original rows, 562 tool results/1124 stdout-stderr files, and preserves that rejected verdict; it does not redefine the failed positive control as expected success. The three intentionally adverse managed-ending B failures (/ZI cancel C1001, PCH Debug normal C1051/C2471/C2859, PCH Debug cancel C1090) are separately retained and are not this blocker.

The eight new traced studies and four calibration references pass their own controls. Their new API-boundary evidence cannot substitute for the failed original default control. This default mode does not enable new invocation/observer records or ETW; no claim is made that the failure is caused by the new tracing, or that lack of attribution proves harmlessness. Original compiler options, matrix inventory and requirements have not been relaxed.

Current decision: keep #176 Draft/HOLD; no merge this iteration unless the actual blocker is resolved with new justified evidence. No same-head retry, success-only replacement, /Z7 substitution, removed query/case/workload, or changed performance/correctness threshold is requested. #170/#172 and historical debt remain held. Finish the remaining source/raw-evidence review without relabeling this failure.

[Iviesever]

New native evidence: sharing conflicts are inside RmGetList, not compiler invocations

Exact head 600208de2d5c37872f205a346929ff9c4be796e2. The fixed eight-case investigation and four retained calibration cases completed on their first attempt; both separate missing-readiness negative controls passed. This does not waive the separately failed original default-control gate.

Downloaded and independently re-audited raw artifacts:

• Eight-case investigation10099435352,25441533bytes,SHA256 ce563f348370f6b91551b2168291a15415fee6c8fb8174c18a290c0d2b8b79a1.
• Four-case reference10099376827,12380865bytes,SHA256 55427f96df3a42d03a3d141d806aae9ffc87b72e9d57755134fbcb6c80e58c33.
• Actual input10099299519,1376712bytes,SHA256 de10916915a0dd5295b5ca7092c51d636d5523e8f9a8561b91798f2309b666f4.
• Build10099300378 and contracts10098992729 also CRC/hash checked; original build warnings remain in diagnostics.

The exact published trace/invocation/observer analyzers were rerun over unmodified raw records and their full results compared with saved reports. All 8 original A/B controls and4reference controls pass, with24matched native failure calibrations and24successful-open controls across12positive traces. Original80workload source files and80argv records match same-head default P/M controls, with only fixture-directory normalization in argv. No workload reduction, extra sample or same-head retry.

API/result/event association

The eight investigated cases retain 296 native API calls in128groups,88original result files/176stdout-stderr files,80tool intervals, and 508 real PDB/PCH open-completion pairs. Fourteen tool intervals still have multiple compatible child candidates; no unique compiler was guessed from their order.

Recorded API / actual return	Associated file-event status	Matched events
CreateFileW /0	0	72
CreateFileW /2	0xc0000034	24
RmGetList /0	0	32
RmGetList /0	0xc0000043	12

All twelve sharing failures belong to the native coordinator PID+creation identity and issuing TID and are fully contained in six actual RmGetList intervals: slot02 query2; slot03 queries1/2; slot04 queries1/2; slot08 query2. Each such interval contains two failed file opens, with raw ShareAccess0 and7. RmGetList itself returns0 in every one. None of these twelve events matched the metadata CreateFileW interval, cl.exe or MSPDBSRV identity. They are bounded observations during the synchronous observer query, not compiler failures or evidence of compiler retry. There is no captured call stack or historical causal proof.

The24native CreateFileW error2 results are the intentionally absent common.pch files in Modules cases; no GetFileInformationByHandleEx is invented after those failed opens. All72actual metadata information queries return0. All32each Start/Register/GetList/End returns are0, preserved separately from internal event status. The original four calibration cases contain no new observer fields, confirming the explicit-mode boundary in this run.

Of508real pairs, 140 match one recorded observer call; 368 remain unmatched to these observer envelopes, including compiler/service operations. All84nonzero events (72x0xc0000034,12x0xc0000043) remain. Unmatched does not mean harmless or nonexistent; no all-writer coverage is claimed. The reference study separately retains302pairs including two sharing failures whose missing API windows cannot be backfilled from the new study.

Actual selected compiler MSVC14.51.36231/Hostx64-x64, Windows10.0.26100, PowerShell7.6.5, observer runner image 20260907.229.1. This differs from earlier recorded runner images, so the new run is not presented as identical historical OS state. Actual input executable hashes match provenance: MQB 4bcb0286144357a48054edcf98a95fc0f610685d40eaf0f9278a012c0177d45c; ownership probe bc56da97136f00b893fdf784922db04af27bbd05f5055bfe461848af1e32e57b; recorder 85cec77a7a2aeb642dd0982e421a232dc430c5478a94ffb66444caf8c339ba58. These are observer inputs, not the independent ABBA pair.

Decision remains HOLD because zi-debug-preexisting-drain in the untraced default matrix failed its original B compile with C1041. The new12events do not explain that separate failure. Finite API envelopes, event association, successful query returns and later successful compiles do not establish RPC ownership, quiescence or safe writer-lease transfer. #170/#172 and VERSION5.5.0 remain unchanged.

[Iviesever]

Final iteration review — observer boundaries validated; HOLD on original C1041 positive control

Implementation self-review with separate read-only source/artifact/statistics reconstruction, not an independent human approval.

Exact base: 564becf9d9e99ed91de0ed0f38407872797957a6.
Reviewed head: 600208de2d5c37872f205a346929ff9c4be796e2.
Candidate tree: 30d3f729fcf5b75d43a5943e63603ec38b448997.
Native test-merge: d2d2e3f81a797c5d2673419d0bf63706115e28e7, with the identical tree and exactly those base/head parents.

Full four-file diff reviewed: 351 additions/14 deletions. Of407base files,404remain byte-identical; three changed and one new file give408candidate files. Product src/include, scheduler, accepted ETW recorder/readiness/verifier, original benchmark/ABBA, manifest, native executable inventory, CLI/freshness and VERSION are unchanged. Verified blobs: probe 2efcb62efc50c329897394ad0eda8ccb94b38c3e; observer verifier 7599f2556caf4fd18bcde924c8397f06a7dff868; collector 3e708c09511039b73391680b76c8730ba9ebba2b; workflow b6e310019bdd136881f6c7865ced815f366ea571. Complete canonical source archive and patch replay reproduce this tree.

Actual completed checks: eight workflow successes, one blocking failure

• Native Debug #723/34339207750 passed actual Debug build, all four paired shard jobs, ambient/include/runtime/parameter, freshness/side-output checks and final gate. Not classifier-induced skip.
• Native Release #613/34339207788 passed Stage0, all four Release shard jobs, full self-host, staging, exact runtime-only package validation and upload. publish-release skipped.
• Documentation #174/34339207746, Cross-Stage #200/34339207754, existing PDB Open Investigation #4/34339207780 passed.
• File Event #7/34339207782 passed actual native probe/recorder build, PowerShell parsing, 38observer+40invocation+36trace synthetic expectations, both native missing-readiness controls, eight investigation cases and four reference cases.
• Private Ownership #19/34339207752 passed all42cases and required unmanaged controls.
• Default Endpoint #17/34339207791 FAILED:56rows complete, but only13/14direct-drain positive controls pass.
• Independent Performance #573/34339207855 actually performed both exact source builds, instrumentation verification, original19x4ABBA and upload. All76pairs independently recomputed and72instrumented complete semantic counter/breakdown/hit-miss identities match.

These are this head's first-attempt results. There was no post-submission source revision, same-head retry or later success substituted for failure.

Blocking original positive control — not an expected calibration failure

The raw C1041 review documents zi-debug-preexisting-drain, original B/work0 exit2 with C1041 opening B/compiler.pdb. Actual argv contains /FS /Zi /Od /MTd. A/work0 and B/work1 succeed; original preexisting MSPDBSRV survives, pending A work stays suppressed and cleanup is verified. Nevertheless B's link/run are unattempted(-2), not passed. B recovery compile0 does not replace the original failure.

The original positive artifact auditor rejects the56-case artifact. A separate immutable-record audit verifies all56rows,562tool results/1124stdout-stderr files and explicitly retains original_matrix_gate_passed=false; it is not a new accepting oracle. This mode does not enable new observer/invocation records or the ETW recorder. Lack of causal attribution neither proves that the new code caused C1041 nor proves harmlessness. New traced controls cannot replace this untraced failed control.

Keep the distinct intentionally adverse managed-termination results: three default and three private original B failures with C1001/C1090/C1051/C2471/C2859 as recorded. The private audit checks411results/822diagnostics. All28A-started managed endings across the two matrices still kill the original service. Successful later recovery does not erase original results; empty resource snapshots do not authorize a writer lease.

Useful new evidence: public API success can contain failed file opens

The full native observer audit verifies eight investigation controls and four reference controls, their original A/B outputs, native refusal tests and24failure+24success calibrations. No original input/workload reduction:80source files and80argv records match same-head P/M matrix controls after only fixture-directory normalization.

Eight investigated cases retain 296 native calls in128groups,80tool intervals,88original results/176diagnostics and508real PDB/PCH completion pairs. Fourteen tool intervals retain multiple compatible child candidates. The observer verifier does not choose a compiler by ordering.

Of508pairs,140match one recorded same-process-creation/same-thread/same-path API envelope;368remain unmatched to these observer envelopes. All84nonzero statuses remain. In particular 12Status0xc0000043 events are wholly inside six actual RmGetList calls, each on the coordinator's native PID+creation identity and issuing TID. The corresponding public RmGetList return is 0 for every one; failed internal opens have raw ShareAccess0/7. They do not match metadata CreateFileW, cl.exe or MSPDBSRV identities. This narrows the CURRENT events to the synchronous observer query envelope; it is not a captured call stack, compiler failure/retry or historical C1041 cause.

All24native CreateFileW error2 records are absent Modules common.pch observations; no later metadata-information call is invented. Original query returns, including EndSession, remain separate from nested NTSTATUS. The old four reference cases contain no new observer fields and retain two sharing conflicts whose missing API windows cannot be backfilled.

Actual observer image is 20260907.229.1, not the older image used in earlier studies; MSVC14.51.36231/Hostx64-x64,Windows10.0.26100,PowerShell7.6.5. Native input hashes match provenance for actual MQB/probe/recorder bytes. They are observer inputs, not the independent performance executable pair. No C1041 occurs in these eight new traces; that does not explain the separate failed default control.

Independent performance: gate not crossed, adverse evidence retained

All19rows and original paired statistics. External timings-off no-op paired median −1.7493ms/−10.3774%,MAD2.409ms,maximum adverse+0.875ms,2/4slower. The unchanged BOTH>1ms AND>10% regression gate is not crossed. No speedup/zero-overhead claim: product and benchmark code are unchanged, and this observer is not in those invocations.

All other rows are instrumented; external counter sets are unavailable, not zero. Four-pair P95 is a maximum, not a population-tail estimate. Preserve build-run3/4slower, scale-j1+16.899ms, scale-cold+389.823ms and modules-cold+295.475ms tails; favorable values do not offset failures. No outlier deletion, presumed-noise dismissal, AA subtraction or historical #170/cold-tail debt closure. Comparison JSON is not OS trace or archived performance binary-pair evidence.

Artifact and local validation boundaries

Eight current raw ZIPs were downloaded/CRC/SHA checked. Important identities: investigation10099435352 ce563f348370f6b91551b2168291a15415fee6c8fb8174c18a290c0d2b8b79a1; reference10099376827 55427f96df3a42d03a3d141d806aae9ffc87b72e9d57755134fbcb6c80e58c33; default10099429348 e41256279fb5cf2ed4f4b89a9209ce12e1e73602b322d1335d419ef8abf9e6bf; private10099412330 d7bc7afb0be3b2b5876daae4da95eb8f409b3999bbe2effbec56e157c13f0e96; ABBA10099361442 6cfd98d9c0dabda78fce16a05e6c6c8a4e6d6b18f8b35a757d0df965d84f9367. Input/build/contracts and complete exact sources also retained. This is the eight core artifacts, not a claim that every artifact from all workflows was downloaded.

Exact published Python auditors were rerun on raw records and compared with saved reports. Local six GCC23 strict/sanitizer helper checks use simulated Win32 clock/process calls, not a full native probe. An additional112-case offline correlation cross-product keeps wrong actor/thread/time/path distinct; it is not native coverage. Original old snapshots without API fields remain rejected. One local ad hoc utf8-sig spelling failed before parsing and was corrected to utf-8-sig; only offline analysis was rerun, without source/raw/CI changes. No local MSVC/PowerShell/ETW execution claimed.

Final decision and next handoff

HOLD. Keep #176 open as Draft and do not merge this iteration. The predeclared original-positive-control gate is unmet; no other green job or favorable measurement waives it. Keep #170/#172 independently held, VERSION5.5.0, M1b incomplete and all cause/lease-safety authority fields false. No CLI cancellation, external-writer quiescence, project transaction/build-run/session/residency or formal release authority is granted.

Next stay within #176 and address the actual failed /Zi Debug + preexisting service + direct drain case using the already calibrated recorder. The current traced invocation mode covers only A-started PCH/Modules and therefore does not cover this failed shape. Extend only the minimum profile/origin and record validation needed, with a predeclared fixed traced/untraced control budget; do not create another observer, remove the failed control, relabel it intentional or accumulate unrelated P/M successes. Native API/event boundaries may narrow a newly observed failure, but historical absent events remain unavailable. No successful rerun alone resolves this blocker.

Actions retention30days; raw core ZIPs, exact source archives, patch and repeatable read-only audits will be included in delivery. Compiler-generated binary bodies are excluded by the established artifact contract; post-case inventories are not failure-instant snapshots. Title changes after completed#573 may trigger skipped perf jobs; those are not new measurements. Main has not been updated by this review.

[Iviesever]

Resume same PR: exact failed shape, fixed traced/untraced budget

Reconfirmed main/base 564becf9d9e99ed91de0ed0f38407872797957a6 and held head 600208de2d5c37872f205a346929ff9c4be796e2. Stay in #176; do not open another observer or silently merge the original C1041 failure.

Before measurement, fix eight fresh /Zi Debug + preexisting MSPDBSRV + direct-drain slots, four pairs ordered T/U,U/T,T/U,U/T. T uses the accepted calibrated ETW recorder plus existing invocation/observer boundaries; U invokes the original --default-case directly, without ETW, invocation spans or observer snapshots. Both retain original /FS /Zi /Od /MTd, 24k-function A and 6k-function B work, original preexisting-service seed, RM queries and natural drain. Compare complete generated source and tool argv inventories with only each fixture-directory identity normalized. This comparison is input equivalence, not a policy-performance claim.

Extend only the existing native investigation admission and Python identity/expected-record coverage to this exact profile/origin, including the seed's original compiler invocation. Keep the old eight PCH/Modules study, four calibration references and default56/private42 unchanged. Fixed budget, no repeat-until-green or outcome-dependent added samples. A missing trace/record/cleanup or original positive-control failure stops the remaining slots, preserving original errors and unattempted work. Negative no-readiness admission test remains separate.

Full native Debug/Release/selfhost/exact package, all old/new contracts and original matrices, and independent original observer-OFF19x4ABBA are still required. Keep all72instrumented semantic identities, unavailable timings-off counters and the external no-op paired-median gate worse by BOTH1ms and10%. The initial C1041 and historical #170/#172 holds cannot be resolved merely by later successful runs. All cause/lease authority stays false and VERSION5.5.0 remains unchanged. Final new synthetic inventory will be recorded before pushing the new head.

[Iviesever]

Pre-push source and test inventory fixed

Prepared incremental change against held head 600208de...: five existing files, 215 additions/34 deletions, candidate tree 90085552eb4a299592d75cb49e6944000e905e5b reconstructed locally. Native change only broadens explicit invocation investigation to the exact additional /Zi Debug/preexisting/drain shape. Existing recorder/readiness, production code, default/private collector, benchmark and VERSION are byte-unchanged. All existing file-event workflow jobs are structurally unchanged; one separate disposable-VM job performs the predeclared four T/U pairs.

Fixed new contract inventory: invocation 54/54 (old40 +8 on-disk exact-shape/seed/original-failure checks +6 paired-input equality/mutation checks), observer 38/38, trace 36/36 locally match expectations. The actual extracted C++ admission expression passed 192 GCC C++23 strict-warning ASan/UBSan shape combinations, explicitly no Win32 execution. No local PowerShell, full MSVC or ETW execution is claimed.

U runs the original --default-case directly and rejects trace directories, invocation spans or observer snapshots. It reuses the original matrix validators and checks raw A first-compile/seed outcomes. T audits the seed invocation as well as A/B, retaining ambiguous children and separate recovery. Source/argv comparison includes all generated inputs and every attempted tool argv, normalizing only each full fixture directory. Neither paired equality nor later success authorizes historical-cause resolution or lease transfer. Any original control/trace/cleanup/input mismatch stops the remaining fixed slots; original HOLD still requires explicit final disposition, not automatic release.

[Iviesever]

New exact-head Windows contract gate inspected

Head b6fa22fd5801a031a3110fbab4ab73d88dd586d2 is now on the existing branch. Event#8/34348677175 contract job102456313180 completed actual PowerShell parsing plus 54 invocation /38 observer /36 trace expectations. Downloaded original artifact10102753860,3513bytes,SHA256 804b2877aa3d8c84aabb05c175bab566627b1bcd6c68be2c289cf4a47a980cf7; CRC and each record's expected/actual outcome verified. Invocation54 comprises16accepted/38rejected; observer38 includes30accept/reject checks plus8correlation checks; trace36 comprises4accepted/32rejected. Synthetic contracts do not establish native MSVC/ETW behavior.

Remote comparison confirms exactly the predeclared incremental five files/215additions/34deletions and no unrelated source modification. The new real preexisting T/U cases, original studies/matrices, complete native/selfhost/package and separate ABBA still require this head's own execution. Original #176 C1041 remains failed and unresolved; no historical outcome has been rewritten.

[Iviesever]

Exact failed-shape study completed: four T/U pairs, original failure still unresolved

Exact head b6fa22fd5801a031a3110fbab4ab73d88dd586d2, base 564becf9d9e99ed91de0ed0f38407872797957a6. Event#8/34348677175 executed the predeclared preexisting-service study on a separate Windows VM. Artifact 10103095187,14,822,619bytes,SHA256 bb0d1df5d4391080c74992b0d6119e3d755670bcb35f8204fcebb1d0a820feae independently downloaded/CRC checked and rerun through the exact submitted trace/invocation/observer/input-equivalence auditors.

8/8 original controls pass: four traced T, four untraced U, order T/U,U/T,T/U,U/T. Each uses /Zi Debug, the preexisting-service seed, original direct drain and unchanged /FS /Zi /Od /MTd,24kA/6kB. All original seed/A/B compiles and B link/run succeed, original service survives, pending A is suppressed and cleanup is verified. The separate native missing-readiness refusal passed without admitting a child. No slot repeated or added.

T cases have four complete calibrated traces with eight controlled native sharing failures and eight successful opens, matched live/offline readiness and child identities. They retain 36 invocation spans including four seed compiles,136native observer calls and180selected PDB/PCH completion pairs. Six invocation intervals still have multiple compatible child candidates; no unique child was guessed. All56nonzero real open statuses are0xc0000034; there are no real0xc0000043 events outside the dedicated calibration files in this batch. Nonzero events remain even though compiler controls succeed. Finite trace coverage is not all-writer or RPC ownership proof.

U cases actually invoke original --default-case directly, contain no new invocation/observer snapshot sidecars and no trace directory. Their capture_exit is null, not a fabricated successful trace. All80original/recovery tool result records and160stdout/stderr files across the eight slots were read and checked; recovery was not used as an original outcome.

All four complete input inventories match after replacing only each full fixture-directory identity: 32 source-file comparisons and36 full tool-argv comparisons. In addition, every slot matches the original failed600208d control's eight source files and seven attempted compile argv records. The old B/link and B/run argv are correctly absent because its original compile failed; their absence is not hidden to claim equal attempted-work inventories. Original failure remains rejected by the old positive-matrix auditor.

Actual selected toolchain: MSVC14.51.36231/Hostx64-x64,Windows10.0.26100,PowerShell7.6.5,runner image20260824.214.3. The original failed default artifact reports that same image label, but this does not reproduce its live process/filesystem/timing state. Observer input artifact10103005460 (1,376,705bytes),SHA256 87cbc13dca43de621cf7d5f202bb527e36acae3f76761e7036e2dcdc2956f3b0 contains actual MQB/probe/recorder bytes whose hashes match this head's provenance. They are not the separate performance binary pair.

The original eight PCH/Modules and four calibration references also completed and were independently re-audited. Their raw artifacts remain separate:10103126451 SHA256 51eb49581aa1b92ca75df7488fbc9dc941cfbce91416368e5c9a61f5c70d95f2;10103065322 SHA256 6b0cd2c62cfbbc88e6d5671c575918ba5a759f5bb10e6d6f0d127db19edfd19f. Their successes do not replace the newly covered shape or the old failure.

Interpretation: this closes the missing test-shape/seed evidence coverage, not C1041 attribution. Traced versus untraced changes ETW plus existing invocation/metadata observation together, so it does not isolate an individual observer API's causal effect. Both arms retain RM queries. No C1041 recurred in this fixed batch; that is not a fix and does not alone authorize merging #176 or releasing #170/#172. No cause/lease safety flag was enabled.

[Iviesever]

Current-head independent ABBA and original matrix regression evidence

Base 564becf9d9e99ed91de0ed0f38407872797957a6; head b6fa22fd5801a031a3110fbab4ab73d88dd586d2. Performance #576 /34348677168 actually ran both exact checkouts, both Release builds, instrumentation validation and original observer-OFF19x4ABBA. Artifact 10103108084,35,718bytes,SHA256 515fecbcf590eabccbefd0e3a45a41dc7f543b68e699bd5ebc6d8fdfe0e54ee1 was downloaded and independently recomputed.

All76pairs and AB/BA/AB/BA orientations, every original pair delta, paired median/MAD/nearest-rank P95 and marginal medians checked. 72/72 instrumented pairs retain complete counters/breakdowns/compile-link-archive hit-miss identity; the four timings-off external counter sets are unavailable, not zeros. Only the last row uses external Stopwatch elapsed. Four-pair nearest-rank P95 is the maximum, not a population-tail estimate. Percent medians use each pair's own denominator.

Scenario	Paired median delta ms	Paired median delta %	MAD ms	Paired P95 ms	Slower
cold	+184.463	+10.59	356.878	+1445.154	3/4
no-op	+1.408	+29.89	1.527	+4.769	3/4
single-tu	+159.547	+157.32	677.791	+1352.082	2/4
public-header	+116.486	+116.38	403.017	+1441.637	2/4
build-run	-1.387	-6.41	3.381	+3.963	2/4
link-only	-24.355	-13.80	38.614	+397.355	2/4
target-scale-cold	+668.851	+10.54	931.553	+1833.648	2/4
target-scale-no-op	+1.499	+4.35	2.255	+14.481	2/4
target-scale-no-op-auto	+6.979	+20.99	4.389	+15.604	3/4
target-scale-no-op-j1	+8.146	+17.78	5.113	+13.622	3/4
target-scale-common-header-no-op	-1.904	-4.74	2.497	+1.382	1/4
target-scale-single-tu	+98.370	+70.76	97.352	+317.184	3/4
discovery-cold	+20.386	+1.15	52.501	+96.885	2/4
discovery-no-op	-0.347	-3.32	0.731	+0.413	2/4
discovery-header	-2.355	-2.12	3.645	+1.401	2/4
modules-cold	-2.487	-0.16	69.363	+242.279	2/4
modules-no-op	-0.086	-1.49	0.147	+0.110	2/4
timings-enabled-no-op	-0.163	-4.11	0.071	-0.060	0/4
timings-disabled-no-op (external)	-0.046	-0.27	0.845	+1.363	2/4

Unrounded external paired medians -0.0457ms/-0.2703178% do not cross the unchanged gate (worse by BOTH1ms and10%). No speedup/zero-overhead claim. The instrumented single-TU/public-header medians exceed100%, and scale-cold has+1833.648ms tail; none is discarded or dismissed as noise, and favorable other rows do not cancel adverse evidence. The artifacts do not provide the performance binary pair/OS trace to establish causality. Historical #170 threshold crossing and cold-tail debt remain open; no same-head remeasurement was requested.

Current original Default #18 /34348677189 completes56/56 with zero collector/control failures, and all14direct-drain positive controls pass; Private #20 /34348677174 completes42/42 with required unmanaged controls passing. Raw checks covered 552 default/415 private tool results and1104/830 stdout-stderr files. The earlier zi-debug-preexisting-drain C1041 artifact remains separately rejected; current success does not explain that past failure.

Retain nine default managed-ending B failures: /Zi Debug normal(C1090), /ZI Debug normal(C1051/C2471), /Zi Release normal(C1051), /Zi Release cancel(C1090), PCH Debug normal(C1090), PCH Debug cancel(C1051), PCH Release normal(C1090), Modules Debug normal(C1090), Modules Release normal(C1090). Private retains PCH Debug A-started normal(C1090). Recovery compiles do not replace those original results; failed link/run remain unattempted. All28A-started managed endings still kill the original service. These negative-policy cases are separate from the passing positive drain controls.

Raw matrices: default10103320428,12,412,703bytes,SHA256 139764b06397dea9e79f9e24cba34cebc9d8903c3d98ca23bfa6d77853a2b214; private10103131592,4,916,443bytes,SHA256 7c6a24cd3858d0db78fefee742a457bfba89438d820300a883efa8f4ee4f30d4. Complete data and original failures are retained. Final review must explicitly dispose of the original HOLD rather than silently inferring release from current green status.

[Iviesever]

Offline delivery verification completed in bounded parts

All current core artifact CRC/SHA checks, three complete canonical Git trees, the submitted Python contracts, four/eight old studies, the new four T/U pairs, both current ownership matrices, independent ABBA and the retained original failed-control audit have completed locally as read-only data verification. The final combining step hash-checks the two completed report sets and explicitly returns historical_original_default_control_still_failed=true, historical_cause_resolved=false, merge_authorized=false.

Whole-sequence local invocations were interrupted by tool execution limits while re-reading the preexisting study; an attempted interactive execution facility was unavailable. All partial logs remain. The verifier was divided into two bounded offline parts plus a checked combination; each completed successfully on the same immutable input ZIPs. No repository source, CI/native run, benchmark sample or historical result was changed or rerun. This is a delivery-verifier execution constraint, not evidence that the current native tests failed, and not authorization to erase the earlier C1041.

[Iviesever]

Final exact-shape iteration review — coverage completed, historical C1041 HOLD retained

Implementation self-review with separate immutable-source/artifact recomputation, not an independent human approval.

Base 564becf9d9e99ed91de0ed0f38407872797957a6; reviewed head b6fa22fd5801a031a3110fbab4ab73d88dd586d2; tree 90085552eb4a299592d75cb49e6944000e905e5b. Native test-merge 310400d2a21fcef3130092768d3cf46250db1324 has the identical tree and exactly those parents. Full canonical base/prior/current source archives were independently reconstructed; full main-to-head patch application reproduces the current tree.

This iteration is five existing files, 215 additions/34 deletions relative to held600208d. Full PR versus main is 563 additions/45 deletions, five files; of407main files403remain byte-identical, four modified and one new file. Product src/include, scheduler, accepted ETW recorder/readiness/verifier, original default/private collector, benchmark/ABBA, manifest, native executable inventory, CLI/freshness and VERSION are unchanged. No extra PR or competing observer was created.

Verified current blobs: probe 5c007abbb304a4be0ef8c2f183500c17c76a9eb4, invocation verifier f617c6fcfb9183a9194fe60ddf0a9dd051722819, observer verifier 541841794e44b004bba533bc285bfe618d17779a, collector 2eeef6ea77083d8e8385ef0742b4c0a996e7a607, workflow 0e44135f0f85ba05606c4b7a75e8f425023314d1.

Source review and scope

Native admission only adds the exact /Zi Debug + preexisting-service + direct-drain investigation shape, not arbitrary profiles or production cancellation. Preexisting seed/warm now receives the same explicit investigation spans and is required in the raw inventory. Its original error cannot be hidden behind A/B or recovery outcomes. Existing A-started PCH/Modules investigation remains.

The fixed new plan is T/U,U/T,T/U,U/T. T invokes the accepted tracer with existing invocation/observer records; U directly invokes the original --default-case with original RM queries and no added spans/metadata snapshots. U rejects trace directories and investigation sidecars. Raw seed/A first-compiles are independently checked, in addition to the original matrix assertions. Each original control/trace/cleanup failure stops the remaining slots. Complete paired source/argv inventory comparison runs after all original controls; its failure also blocks acceptance and remains a separate report, not an excuse to discard data.

T versus U changes ETW, span and metadata observation together; it is NOT a one-factor experiment isolating RmGetList. Both sides retain RM queries. A fixed budget and balanced order prevent adaptive success selection, but cannot restore the historical machine/timing state or prove an intermittent defect absent.

All nine current-head workflows completed on their first attempt

• Native Debug #724/34348677215: actual Debug build, all paired shards, ambient/include/runtime/parameter and freshness/side-output checks and final gate passed; not classifier-induced skip.
• Native Release #614/34348677138: Stage0, all four Release shard jobs, full MQB self-host, staging and exact runtime-only package validation/upload passed. publish-release skipped.
• Documentation #175/34348677325, Cross-Stage #201/34348677127, original PDB investigation #5/34348677256 passed.
• File Event #8/34348677175: actual native build/PowerShell parse, 54 invocation +38 observer +36 trace expectations, original four/eight studies and new eight-slot preexisting study all passed.
• Original Default #18/34348677189 and Private #20/34348677174 completed56/42cases, their required unmanaged controls and all14default direct-drain positive controls pass.
• Independent original observer-OFF Performance #576/34348677168 actually ran exact source checkouts, both Release builds, instrumentation validation,19x4ABBA and upload; all76pairs independently recomputed,72complete instrumented semantic identities match.

No source revision or same-head CI/benchmark retry occurred after this head was pushed. These checks are not reused600208d evidence.

Exact failed-shape evidence: successful current controls, not historical resolution

Detailed immutable study and original-input audit.

Four traced +four untraced controls all pass, including original seed/A/B compilation, B link/run, retained original service and pending A suppression. T has four complete traces, eight native failure calibrations and eight successful opens; its native no-readiness negative admits no child. U has no trace directory or investigation sidecars; capture_exit is null, not fabricated trace success. Across the new eight slots80raw tool results/160stdout-stderr records are checked; recovery stays separate.

The four traced controls retain36invocation spans including all fourseed compiles,136observer native calls and180PDB/PCHcompletionpairs. Six tool intervals retain multiple compatible children.56nonzero real statuses0xc0000034 remain; there are no real sharing-violation events outside the dedicated calibration in this batch. These observations do not enumerate all writers or assign shared-service RPCs.

Four paired complete inventories match: 32source comparisons +36argv comparisons, replacing only the complete fixture-directory identity. Every new slot also matches all eight historical failed-case source files and its seven attempted compile argv records. Historical B/link and B/run remain absent because they were never attempted; they are not backfilled to manufacture identical attempted work.

The new eight P/M reference traces and original four calibration traces also pass their own independent controls and negative tests. With the new four traced cases this makes16positive traces with32native failure/32successful-open calibrations, plus four untraced controls; their results are not substituted for each other. The input study is not a timing comparison of policies.

New exact-shape raw artifact10103095187,14,822,619bytes,SHA256 bb0d1df5d4391080c74992b0d6119e3d755670bcb35f8204fcebb1d0a820feae. Actual MSVC14.51.36231/Hostx64-x64,Windows10.0.26100,PowerShell7.6.5,image20260824.214.3. The old failed default artifact reports the same image label, but this does not reproduce its live OS/process/file state. Three actual observer-input executable hashes match provenance; they are not the independent performance binary pair.

Original failure is still a failure; current green CI is not a cause fix

Old head600208d's zi-debug-preexisting-drain B/work0 C1041 exit2 remains unchanged in raw artifact10099429348, SHA256 e41256279fb5cf2ed4f4b89a9209ce12e1e73602b322d1335d419ef8abf9e6bf. Its actual /FS /Zi /Od /MTd and original A/B1 success, unattempted B link/run and later recovery are all retained. The old positive-matrix auditor still rejects it. The failure auditor verifies562original results/1124diagnostics but explicitly leaves its positive gate false.

This round did NOT reproduce C1041 or change a runtime behavior that explains it. It completed missing profile/origin/seed coverage and supplied successful bounded current controls. Those are useful results, but they do not independently resolve the earlier blocker. No unrecorded historical events are invented and no success replaces the original failure.

Current default/private preserve nine +one intentionally adverse managed B failures, separate from positive drain controls, and all28A-started managed-service deaths. Raw checks cover552/415tool results and1104/830diagnostics. Recovery never replaces those originals. Resource snapshots remain incomplete ownership evidence, not a writer-lease certificate.

Independent ABBA: unchanged gate, adverse data retained

All19rows, exact sample arithmetic and current matrix evidence.

Artifact10103108084,35,718bytes,SHA256 515fecbcf590eabccbefd0e3a45a41dc7f543b68e699bd5ebc6d8fdfe0e54ee1. External timings-off no-op paired median −0.0457ms/−0.2703%,maximum adverse+1.363ms,2/4slower does not cross the original BOTH>1ms AND>10% gate. No speedup/zero-overhead claim. All72instrumented complete counters/breakdowns/compile-link-archive hit-miss equal; four external counter sets remain unavailable, not zero.

Retain instrumented single-TU median+159.547ms/+157.32%, public-header+116.486ms/+116.38%, scale-cold maximum+1833.648ms and all favorable/adverse samples. Four-pair P95 is a maximum, not a population tail. No noise-based deletion, AA subtraction, same-head remeasurement or historical #170/cold-tail closure. Comparison JSON is not OS trace or actual performance executable pair evidence.

Final decision and next boundary

Maintain HOLD: leave #176 open as Draft and do not merge this iteration. This is not a claim that the current native suite failed—it passed. The unresolved issue is the previously declared C1041 hold, which this coverage-only amendment does not explain or repair. #170/#172 remain independently held. No M1b completion, CLI cancellation, external-writer quiescence, writer-lease/transaction or release authority is granted. VERSION5.5.0 stays unchanged.

Next stay with this exact shape and existing recorder. Both current arms still use RM queries; a minimal predeclared fixed query-on/off comparison with recording held constant can investigate that remaining factor without removing or relabeling the original default positive controls. It must distinguish observer-origin event errors from actual compiler outcomes, preserve non-reproduction as non-reproduction and avoid a new competing observer or indefinite success-only sampling. Missing historical traces cannot be recovered retroactively; any eventual risk acceptance must be explicit rather than silently inferred from green reruns.

Reproducibility and execution limits

Delivery retains11unmodified core ZIPs (nine current, original failed default and original ABBA), full canonical base/prior/current source archives, full/incremental patches and raw recomputation. All CRC/SHA/source-tree/patch checks pass. Local192GCC23strict/ASan/UBSan shape tests exercise only the extracted admission expression, not Win32. Exact submitted Python suites and raw-record analyzers ran locally; no local MSVC/PowerShell/ETW execution claimed.

Whole-bundle local verification hit tool execution limits while re-reading deterministic trace records; logs and the unavailable interactive-tool attempt are retained. Two bounded offline verification parts plus a hash-checked combining step completed and explicitly retain historical failure/merge_authorized=false. These were read-only audits, not CI/native/benchmark reruns. Actions retention30days; diagnostic artifacts omit generated compiler binaries and only retain post-case hashes. Separate input ZIPs contain observer tools, not the performance pair. The title may be restored to test after completed#576; later skipped performance jobs are not new measurements.

[Iviesever]

Next bounded iteration: isolate RM-query enablement in the exact failed shape

Reconfirmed main/base 564becf9d9e99ed91de0ed0f38407872797957a6, current head b6fa22fd5801a031a3110fbab4ab73d88dd586d2, and the #164 handoff. Stay in this PR; no competing recorder or held-PR merge.

Before measurement, fix a separate eight-slot study on /Zi Debug + preexisting service + direct drain: on/off, off/on, on/off, off/on. BOTH arms use the SAME accepted calibrated recorder, invocation spans and metadata snapshots. The only experimental switch is whether the four coordinator RM queries execute. Disabled queries must have explicit not-attempted/null outcome records, not fabricated successful empty owner sets. Real compiler/seed/source/argv/output identities, native readiness and both boundary calibrations stay unchanged. No sleep, synthetic C1041, retry-until-success or sample additions.

Retain the existing 8 P/M, 4 calibration, 4T+4U studies and original default56/private42 unmodified as separate required controls. New pair checking compares complete inputs. Missing trace/query/metadata evidence or an original positive-control failure stops unattempted slots with full failure records. No later recovery substitutes for an original outcome. Query-off is an experimental control, NOT a new product default or a waiver of original RM-on correctness.

Acceptance gates remain exact base/head/test-merge source review, full Native Debug/Release/self-host/exact package, native tracing/refusal and synthetic contracts, original positive controls, and the independent unchanged observer-OFF19x4ABBA. Preserve all72instrumented semantic counter/breakdown/hit-miss identities, unavailable external counters and the existing external no-op paired-median gate (worse by BOTH >1ms AND >10%). No threshold changes or same-head repeats. Test counts will be fixed before the push.

Historical C1041/performance holds remain; successful pairs alone cannot resolve them. VERSION5.5.0, production src/include, CLI/freshness, shared-service ownership and lease-safety authority stay unchanged.

[Iviesever]

Pre-push implementation and test inventory fixed

Prepared increment against b6fa22fd...: four existing files, 217 additions/27 deletions. The new query-contrast study adds four RM-on and four RM-off traces in on/off,off/on,on/off,off/on order on the exact preexisting Zi Debug drain shape. Existing calibration/invocation/T-U jobs and default56/private42 are retained.

Only the dedicated native --query-contrast-case / helper entry point may omit RM calls; it refuses other shapes or unknown mode strings. Both arms retain the same tracing/invocation/metadata operations and original compiler inputs. Off slots record attempted=false, query_error/owners/observer=null; all ten query-derived fields in observation.json are null, never false/zero/empty. On slots retain actual native call envelopes/results and owners. The verifier takes an expected arm from CLI, checks policy/slot inventories and cross-checks query outputs against the original observation. A missing mode/policy or synthetic empty result is rejected.

Local 64 observer +54 invocation +36 trace synthetic expectations all pass (original38 observer cases retained plus26 query-policy/slot cases). Six additional strict GCC C++23+ASan/UBSan checks run the actual extracted query-dispatch closure with explicitly simulated native queries: original paths/on execute four calls; new off executes zero and retains four null records. This is NOT a full Windows probe or native RM/ETW run. YAML/whitespace checks pass; complete prior source index matches authoritative tree90085552.... No local PowerShell/MSVC execution is claimed.

Real Windows compilation, full new/old fixed studies, native Debug/Release/self-host/package and independent exact-main/head ABBA remain required for the upcoming head. The query-off result is missing observation, not an ownership/quiescence certificate or product cancellation change. Historical C1041 remains unexplained, thresholds and HOLD semantics unchanged.

[Iviesever]

Exact-head contract and source identity verified

New head 476dc0e7ee20ad5fd9808d907ca36e705cdcbc8a, base 564becf9d9e99ed91de0ed0f38407872797957a6. Native test-merge d8c68317d75abda8eea802bb4ec69e8d630240ae has exact parents and identical tree 41b40caee682219bef89f74e7b37dcc9c778f834. Complete source reconstruction verifies408candidate files,403of407main files byte-identical; only the five cumulative PR test/CI files differ. This iteration changes four files,218additions/29deletions. VERSION remains5.5.0.

Actual Windows contract job102505003787 in Event#9/34363149259 passed native PowerShell parsing and 64observer +54invocation +36trace expectations. Downloaded original artifact10108687754 (3912bytes), SHA256 ddd037b9c4d314d54b2d2ec47badf178dfe4a2e479ae295d8cad44dc010b9661; CRC/digest and all recorded expectations independently checked.

This is record-contract evidence only. Probe compilation, new fixed RMcontrast, old controls and full native/self-host/package remain independent gates. The synchronize-triggered Performance#578 was skipped under the previous test title; actual new-head Performance#579 is the required independent measurement, not a rerun or replacement of measured samples. One GitHub read disconnected and succeeded via a GET retry; no CI, benchmark or native experiment was restarted.

[Iviesever]

Fixed same-recorder RM-on/off study independently verified — current event source narrowed, historical C1041 not resolved

Exact head 476dc0e7ee20ad5fd9808d907ca36e705cdcbc8a, base 564becf9d9e99ed91de0ed0f38407872797957a6. New study artifact 10109133754,23,925,880bytes/756entries, SHA256 2ba4bb55a35341825604c09ac908c4a1e1aa071db5d0a62c78f2bb87121307f9 downloaded and CRC/digest verified. Exact submitted trace/invocation/observer analyzers were replayed against every slot's immutable raw data and compared with saved reports; per-slot results were combined only after all eight checks and four independent input-pair comparisons completed.

All four RM-on and four RM-off original controls pass in the predeclared on/off,off/on,on/off,off/on order. All eight use the same calibrated recorder and invocation/metadata observations; original seed/A/B compilation and B link/run succeed, pending A is suppressed, original service survives and cleanup is confirmed. The native missing-readiness control also passes. Four complete pairs match 32source files and36argv records, normalizing only fixture directories. No sample, workload, compiler flag or original matrix requirement was removed.

Arm	Cases	Native RM API calls	Metadata API calls	Real PDB/PCH completion pairs	Real sharing-violation events
RM on	4	64	72	188	8
RM off	4	0	72	164	0

Each on case has exactly two0xc0000043 events, fully inside query-2/RmGetList on the coordinator's PID+creation identity and issuing thread, targeting A/compiler.pdb. All four corresponding public RmGetList calls return0. These are not cl.exe/MSPDBSRV events; current A and B compiles still succeed. The original historical C1041 affected B/compiler.pdb, so neither path identity nor failed-compiler outcome supports equating it with these eight observer events. Query-off's absence is observed in this finite batch, not proof that all possible sharing conflicts disappear.

All 16 disabled query slots preserve attempted=false and query_error/owners/observer=null, and all10query-derived fields in each off observation remain null. No unavailable result is replaced with zero/false/empty array. Metadata remains active in both arms; absent common.pch opens retain their error2. All112other nonzero0xc0000034 events remain. Across eight cases:80original tool results/160stdout-stderr files,72invocation spans,208recorded native calls and352real completion pairs;15tool intervals still retain multiple child candidates rather than guessed identities.

Actual source/input executable hashes match observer provenance. Windows10.0.26100,PowerShell7.6.5,runner image20260824.214.3; the same image label does not recreate historical live state. No C1041 appeared in this batch. This is a controlled distinction of CURRENT observer-generated events, not a historical compiler fix or writer-lease certificate. The raw historical600208d default artifact still fails its original positive auditor; no missing old API/event evidence was backfilled.

Remaining original studies/native/ownership and actual independent ABBA gates are reviewed separately. No native/CI/benchmark retry was requested. An offline per-slot audit label was corrected to avoid implying whole-study verification before combination; only that read-only slot check was repeated, with no source or raw-record change.

[Iviesever]

Independent exact-base/head ABBA and original matrix review complete

Base 564becf9d9e99ed91de0ed0f38407872797957a6, head 476dc0e7ee20ad5fd9808d907ca36e705cdcbc8a. Performance #579/34363183911 actually executed both exact checkouts, both Release builds, instrumentation verification, original observer-OFF19x4ABBA and upload. Artifact 10109084653,35,417bytes,SHA256 48469ccd3db0aec5c665ad4991bf99b13848096a30adee17e35b99f883e12885 was downloaded and independently recomputed.

All76pair identities/order/deltas/statistics checked;72instrumented complete counters/breakdowns/compile-link-archive hit-miss identities match. Four timings-off counter sets are unavailable, not zeros. Only the last row uses external Stopwatch elapsed; other rows are instrumented. Four-pair nearest-rank P95 is the maximum, not a population-tail estimate.

Scenario	Paired median Δms	Paired median Δ%	MAD ms	Max Δms	Slower
cold	+24.050	+1.49	19.266	+59.609	3/4
no-op	−0.011	−0.28	0.042	+0.043	2/4
single-tu	+0.675	+0.70	2.373	+3.226	2/4
public-header	−8.653	−7.92	8.052	+2.222	1/4
build-run	−1.373	−7.92	1.689	+0.571	2/4
link-only	−7.191	−12.08	4.061	+0.352	1/4
target-scale-cold	−175.171	−4.22	141.472	+13.234	1/4
target-scale-no-op	−0.262	−0.90	0.824	+0.818	2/4
target-scale-no-op-auto	−0.236	−0.82	0.377	+0.373	1/4
target-scale-no-op-j1	+0.218	+0.61	0.970	+1.372	2/4
target-scale-common-header-no-op	−0.475	−1.46	0.442	+0.366	1/4
target-scale-single-tu	+12.722	+10.56	11.796	+58.265	3/4
discovery-cold	+23.584	+1.52	52.139	+92.185	2/4
discovery-no-op	−0.307	−3.91	0.933	+2.228	1/4
discovery-header	−3.223	−2.86	10.203	+14.042	1/4
modules-cold	+59.794	+3.23	23.089	+85.396	4/4
modules-no-op	−0.279	−5.57	0.337	+0.339	1/4
timings-enabled-no-op	−0.501	−11.23	0.574	+0.166	1/4
timings-disabled-no-op (external)	−0.603	−2.71	4.023	+4.872	2/4

Unrounded external median −0.6033ms/−2.7059938% does not cross the unchanged BOTH>1ms AND>10% gate. No speedup/zero-overhead claim. Keep modules-cold4/4slower,scale-single-TU+12.722ms/+10.56% and all other adverse/favorable pairs. No noise deletion, AA subtraction or same-head benchmark retry. Historical #170 crossing and cold-tail debt remain unresolved. This comparison JSON is not the actual ABBA executable pair or an OS trace; archived observer inputs are separate.

Current default #19/34363149203 and private #21/34363149351 complete56/42cases and pass their original required positive controls. Independently checked568/413original tool results and1136/826stdout-stderr files. Default retains one intentionally adverse managed B failure(Modules Release A-started normal,C1090); private retains two(PCH Debug A-started cancel,C1090;Modules Release A-started normal,C1051/C2471). Recovery never substitutes for original outcomes. All28A-started managed endings still kill the original service. Observed B-resource identity is4/56default and2/42private, not a no-writer certificate.

Raw default10109286134 SHA256 c111148ee0edb448d03932b1263df10acc566d2300b330410284b33cff7a0161; private10109194678 766f0b3bd4592b1a7fb0ead7124afb93c8bfb7c75d9e11454d6d7cb5c165ce54. The unchanged old600208d default artifact is separately re-audited and still rejected for its original C1041. Current green matrices do not rewrite that failed record or supply its missing events. No historical-hold release is implied.

[Iviesever]

Final RM-query contrast iteration — current controlled effect verified; historical C1041 HOLD retained

Implementation self-review with separate read-only source/raw-artifact/statistics verification, not an independent human approval.

Base/main: 564becf9d9e99ed91de0ed0f38407872797957a6.
Reviewed head: 476dc0e7ee20ad5fd9808d907ca36e705cdcbc8a.
Candidate tree: 41b40caee682219bef89f74e7b37dcc9c778f834.
Native test-merge: d8c68317d75abda8eea802bb4ec69e8d630240ae, identical tree and exact base/head parents.

Four-file increment from b6fa22f: 218 additions/29 deletions. Full PR versus main: five test/CI files, 769 additions/62 deletions;403of407main files are unchanged, four modified/one new,408candidate files. Full canonical source archives and Git patch replay reproduce the tree. Production src/include, scheduler, accepted ETW recorder/readiness/verifier, original ownership collectors, original benchmark/ABBA, native inventory, manifest, CLI/freshness and VERSION are unchanged.

Source contract and scope

Only the dedicated exact-shape --query-contrast-case mode can skip the four RM queries; it rejects unsupported shape or mode strings. Both arms retain the accepted recorder, invocation spans, metadata snapshots, original seed and compiler workloads. Disabled query records require attempted=false and explicit null query_error/owners/observer. All ten query-derived observation fields are null, never fabricated zero/false/empty-owner results. An internal ERROR_NOT_SUPPORTED sentinel is not exposed as successful observation. On records retain actual original returns and owner arrays.

The offline verifier takes the expected arm independently from CLI, checks exact policy/slot/schema/native types, cross-checks original observation fields and retains original metadata/lifetime/temporal-correlation assertions. Original investigation modes remain query-on and their format is not silently converted into the new study. The mode change is a diagnostic experiment, NOT a new production default, a product cancellation implementation or an ownership certificate.

All current-head gates actually completed

• Native Debug #725/34363149172: actual Debug build, all four paired-shard jobs, runtime/ambient/include/parameter and freshness/side-output checks, final gate passed; not classifier-induced skip.
• Native Release #615/34363149275: Stage0, all four Release shard jobs, full self-host, staging and exact runtime-only package validation/upload passed. publish-release skipped.
• Documentation #176/34363149380, Cross-Stage #202/34363149290, original PDB Investigation #6/34363149152 passed.
• File Event #9/34363149259: actual native probe/recorder build, PowerShell parsing, 64observer+54invocation+36trace expectations, all new and retained studies passed.
• Original default #19/34363149203 and private #21/34363149351:56/56 and42/42complete with all required positive controls, including14/14default drain controls.
• Independent original observer-OFF Performance #579/34363183911: both exact checkouts, both Release builds, instrumentation validation, actual19x4ABBA and upload completed. Synchronize-triggered#578 was skipped before the title changed; it is not a second measurement. No same-head native/CI/benchmark retry or post-push source correction occurred.

New same-recorder comparison: all four pairs complete

Full immutable query-contrast inspection

All eight predeclared slots run in on/off,off/on,on/off,off/on order on /Zi Debug+preexisting service+direct drain. All original seed/A/B compiles and B link/run succeed, original service survives, A's pending TU is not dispatched and cleanup is confirmed. The independent native no-readiness refusal passes. Four complete input pairs match32source files and36argv records, normalizing only fixture directory identity.

RM-on:4cases,64native RM API calls,72metadata calls,188real PDB/PCHcompletionpairs,8sharing violations. RM-off:4cases,zero RM calls,72metadata calls,164completionpairs,zero real sharing violations. All16disabled slots and their query-derived fields remain null/not-attempted. There are80original tool results/160stdout-stderr files,72invocation spans,208native calls and352real completionpairs;15invocation intervals retain multiple child candidates. All112other nonzero0xc0000034events remain.

Each on case's two0xc0000043events are wholly inside query-2/RmGetList on A/compiler.pdb, with matching coordinator PID+creation and issuing TID. Every corresponding public RmGetList return is0. These are not cl.exe/MSPDBSRV events, and no compiler failed in this batch. This fixed intervention provides evidence distinguishing CURRENT observer-query events; it does not establish that RM caused the historical B/compiler.pdb C1041. Target file and failed-compiler outcome differ. No captured call stack or old missing trace is invented. Finite query-off absence is not all-writer coverage or proof that sharing conflicts cannot recur.

Each new slot's eight workload sources and seven attempted compile argv also match the historical failed shape; old B link/run were unattempted, so their missing records remain missing. Actual observer identity is Windows10.0.26100,PowerShell7.6.5,image20260824.214.3. A matching image label does not recreate historical live process/file state.

Retained studies and provenance

The original8PCH/Modules study,4calibration study and4T+4Upreexisting study all complete and pass, each retaining its own negative readiness control. Combined with the new study, this is 24positive traces plus4untraced workload cases,48native failure calibrations and48successful-open calibrations, and four separately labeled native admission-refusal controls. Replay verified292original tool results/584diagnostics across the four studies. The original P/M study retains16sharing events within RM-query envelopes; they are not reclassified as compiler failures. Unmatched and ambiguous events remain.

Ten current core ZIPs were SHA256/CRC-checked, including the actual three observer-input executables matched to provenance. New query artifact10109133754:23,925,880bytes,SHA256 2ba4bb55a35341825604c09ac908c4a1e1aa071db5d0a62c78f2bb87121307f9. Actual input10109005273:1,378,453bytes,SHA256 7c3007f188db790dae5c3e51c94347dd59f9b64172f844a2bdfc9fbc662c8c2d. Input executable hashes: MQB 04961f6083a795c5842e246aec1b2952ec53e52ca5121bff97755e2cd48d0912; ownership probe 0e5eb584318b02e3aafd6389b93115f4323a09f85a3bd839f5d65c34c6b07e1a; recorder 773a887801f197a2444da2ee999cac2f94033f7ed5f2548b6907934bf0dc2187. They are NOT the independent performance executable pair.

Current ownership matrices were separately audited:568/413tool results and1136/826diagnostics. Retain one default managed B failure(C1090) and two private managed failures(C1090;C1051/C2471), distinct from positive controls. All28A-started managed endings still kill the original service. Later recovery never replaces initial outcomes; B-resource snapshots4/56default and2/42private do not prove external-writer quiescence.

Independent performance and historical failure remain separate

All19paired rows and original matrix audit

All76pairs independently recomputed;72instrumented complete counter/breakdown/compile-link-archive hit-miss identities match. Four timings-off counter sets unavailable, not zero. External no-op paired median −0.6033ms/−2.7059938%,MAD4.023ms,max adverse+4.872ms,2/4slower: unchanged BOTH>1ms AND>10% gate not crossed. No speedup/zero-overhead claim. Preserve modules-cold4/4slower(median+59.794ms),scale-single-TU+12.722ms/+10.56% and all favorable/adverse pairs; no noise deletion, AA subtraction or historic#170/cold-tail debt closure. Only the external row uses Stopwatch elapsed; four-pairP95 is a maximum, not population-tail estimation.

The unmodified old600208d default artifact remains rejected for zi-debug-preexisting-drain B/work0 C1041/exit2. Its original failure was independently rechecked, not replaced by these green results. This iteration adds an experimental switch, not a behavior repair explaining that failure. The historical default and old ABBA are retained separately in the12ZIP delivery, not mislabeled current-head data.

Decision and bounded handoff

Keep #176 Draft/HOLD; do not merge this iteration. Current-head gates pass, but the original historical C1041 condition has not received a causal fix or explicit justified risk disposition. Removing observer queries is not accepted as a product/default-matrix workaround, and green on/off controls are not enough to release the existing hold. Keep #170/#172 independently held, VERSION5.5.0, M1b incomplete and cause/lease-authority fields false.

The RM-on/off question is now covered for this batch; do not repeat more identical all-success batches. The next minimal task should validate the B compiler failure-to-native-event path, using a separately labeled bounded B-PDB open-conflict fault calibration alongside unchanged successful controls and the existing recorder. An injected failure must never be called historical C1041 reproduction or substituted for the original positive controls. It should test actual compiler diagnostics/exit, exact process/file identities and preserved failed outcomes, not add another observer. Historical absent events remain absent; any later risk acceptance must explicitly retain that limitation.

Local64/54/36Python tests and six strictGCC/ASan/UBSan extracted-dispatch checks are correctly limited: Win32 queries in the latter are simulated, not local nativeMSVC/ETW. The offline audit's per-slot scope label and one unused optional derived count field were corrected without changing raw evidence or assertions; whole-study status was set only after all slots and pair comparisons verified. One GitHub read disconnected and was retried as a GET, not a CI rerun. Raw ZIPs, canonical sources, patches and executed bounded offline audits are retained; Actions retention30days. Generated compiler binaries remain excluded from diagnostics; finite post-case hashes are not failure-time snapshots. No CLI cancellation, RPC ownership, writer lease, transaction/build-run/session/residency or formal release authority is granted.

[Iviesever]

下一迭代预先固定：B 编译失败→原生事件的独立故障校准

已核对 main/base 564becf9d9e99ed91de0ed0f38407872797957a6、当前head 476dc0e7ee20ad5fd9808d907ca36e705cdcbc8a。留在#176，原HOLD和全部历史失败不改写。

本轮新增独立标记的四槽校准：baseline/conflict、conflict/baseline，各槽全新目录；继续复用现有已校准ETW/首尾标记和原生不就绪拒绝测试。校准先用seed启动真实默认MSPDBSRV，并保留A预热。B首次使用一个全新PDB路径，编译固定6000函数TU，保留/FS /Zi /Od /MTd。专用夹具用CREATE_NEW创建空的B/compiler.pdb并取得不共享读写的HANDLE：baseline在首次B编译前关闭并删除该空占位文件；conflict保持到首次B编译及其原始诊断已返回后再关闭/删除。然后各组只做一次明确单列的恢复编译。只可清理本槽新建、身份已记录且仍为空的占位文件；不是产品恢复方案或项目锁移交。

这是冷B-PDB的受控失败记录校准，不是原并行热PDB/C1041故障的重现，也不宣称覆盖调度器取消。baseline必须首次编译成功；conflict必须首次编译非零，包含预先限定的PDB诊断C1041/C1090/C2471，并在保持独占期间出现目标B/compiler.pdb的STATUS_SHARING_VIOLATION事件，其实际进程身份须是唯一对应cl子进程或保留HANDLE确认的默认MSPDBSRV，不能拿协调器的RM/校准事件替代。完整退出码、诊断、双方身份、QPC区间和后续恢复结果分别保存。没有目标失败或缺失事件就拒绝，不临时放宽或重跑。

原正向default56/private42、8P/M、4校准、4T4U、RM开关研究保持，故障校准结果不会进入原positive统计。完整native Debug/Release/selfhost/package及独立原observer-OFF19x4ABBA继续要求；保持72instrumented语义计数一致和外部no-op同时>1ms且>10%门槛，所有不利样本保留。VERSION5.5.0、生产源码、记录器、CLI/freshness不改。具体新合成测试数量在提交前记录，当前无新运行结果或合并授权。

[Iviesever]

提交前验收清单（样本预算不变）

本轮四个test/CI文件增量405 additions/6 deletions，候选完整tree 0d2cc7c821709c7080e443d085f243d43685cc31。新增27项故障证据契约（3接受/24拒绝）本地通过；原54调用、64观察、36录制预期全部保留通过。新C++函数用声明式Win32/仓库类型替身做了GCC23严格语法检查，包含避免再次漏掉ADL问题；它不是完整原生构建/运行。无本地MSVC或PowerShell执行声明。

释放实现收紧为对持有的同一HANDLE标记FileDispositionInfo，再CloseHandle，而不是先关闭再按路径DeleteFile，避免删除路径被替换的对象。两组都使用CREATE_NEW、GENERIC_READ|GENERIC_WRITE|DELETE、share0；删除标记只在声明的释放点设置，原始故障编译期间并无delete-pending注入。关闭前校验占位文件仍为空，分别保留标记/关闭/事后路径不存在的原生返回码与QPC。该机制只处理新建校准占位文件，不是删除MSVC生成PDB或授权生产写lease。依据Microsoft SetFileInformationByHandle/FileDispositionInfo文档的DELETE权限和关闭删除契约。

固定baseline/conflict、conflict/baseline四槽；baseline原始B成功、conflict原始B非零+预定PDB诊断+锁持有期间同路径真实cl/保留服务身份的共享冲突事件必须同时成立。种子/A控制、两组释放后单次恢复均须成功；完整原始结果和注入标记分列，不进入原positive统计。两对完整源码/argv须一致（只归一化目录）。任何未捕获的目标失败/事件均拒绝且停止后续槽位，不修改门槛补测。原所有研究、default56/private42、完整native/selfhost/package与独立19x4ABBA门槛保持。历史故障及#170/#172/#176 HOLD不以校准通过自动解除。

[Iviesever]

当前head记录契约已实际通过，尚未借此放行原生校准

Head 0c6bcda7c0078b72c30261d443027b7b8161835a，base 564becf9...。Event#10/34375549326的Windows契约job102547309627实际通过Python四套测试与PowerShell解析。下载artifact10113687204（4771bytes）并核验SHA256 e4cafcc22e729ef3f768f336b4920f57e31abf46b4ac5c41b83627b2bb9cb7c2、ZIP CRC和全部结果：新27/27、原54/54调用、64/64观察、36/36录制预期匹配。

完整上传四blob与本地源码一致；从精确parent tree41b40...和main tree9bd290...分别应用增量/完整补丁都重建为 cc65a02561a8e107997c39973e2d28e7c1575415。当前完整PR为六文件1170 additions/64 deletions；本轮四文件405 additions/6 deletions。预提交局部文本替换误触原measure参数行已在推送前更正，原生上传内容保留正确断言；没有把未执行的完整Windows构建说成已通过。

实际故障组原生编译/事件对应、全部原正向矩阵、完整native/selfhost/package及独立ABBA仍需本head单独验证。固定样本和预期PDB诊断集合不修改，历史HOLD保持。

[Iviesever]

首次原生校准：真实B/C1041已捕获；完整路径比较错误需修正

Head 0c6bcda7c0078b72c30261d443027b7b8161835a 的新fault job 102550118133 / Event#10 被审计拒绝。Artifact 10114044008（4947853bytes），已核验SHA256 **3155b1e3395b944dc19b20cd2017d25cc66c28e8d2434cf06d04b6075d7c07af**及CRC。固定四槽中，baseline通过；第二槽conflict的原始B编译C1041/exit2、恢复0均有记录，但新审计器报failure diagnostic does not name locked B PDB，后两槽未运行。原运行仍失败，不能算四槽通过。

实际holder路径保存为...\\B/compiler.pdb，MSVC原始诊断打印为...\\B\\compiler.pdb。原审计只casefold、不统一分隔符，错误拒绝了同一完整绝对路径。不是缺失C1041，也不是需要放宽诊断集合或目标文件。修正仅做完整路径的分隔符/大小写比较并检查边界，拒绝错卷、错目录和compiler.pdb2前缀冒充；新增6项定向测试，原27项不删除，合计33项。记录器、原生占位锁、工作量、错误集合、校准顺序和合并门槛不改。

用修正后的只读分析器对该原始ZIP离线重放，确认第二槽有2次0xc0000043，实际PID+创建时间匹配保留的MSPDBSRV（PID10012），完整位于首次B编译及独占HANDLE区间内；B诊断确实C1041、exit2，后续恢复0，原服务存活。没有使用协调器RM事件代替，也没有修改ZIP。该新离线结论不补造后两槽，不把原失败工作流改成成功，更不是历史热PDB故障归因。

即将提交单Python文件的定向修正；新head需要自己的完整固定四槽及所有原CI/矩阵/ABBA。没有同head重跑、额外样本或事后改变预定故障判断。

[Iviesever]

Corrected-head fault calibration and independent ABBA fully audited

Base 564becf9d9e99ed91de0ed0f38407872797957a6; head 33ebb4dda4fbab063d0b94cea556b3e717241822. Native test-merge e05c39784c5eb9af60b16de9bf66e4424fb9fca1 has the identical tree 6a91360d2125a08083a01192bc083b814b905438 and exactly those parents.

Actual cold-B calibration: compiler diagnostics and service events now agree

Event #11 /34377199236, job102555911051, completed the predeclared baseline/conflict,conflict/baseline sequence. Downloaded artifact 10114748233,9,631,339bytes,SHA256 c8de2d8c93f601214cf80efaadb60458d72b6fc15a19b32f9634f113316f6ec4. Independently checked ZIP CRC/hash and reran the exact published trace and fault analyzers on every raw slot, comparing full results with saved reports.

Slot	Original B compile	Original PDB diagnostic	Matched service sharing failures while held	Separate recovery
01 baseline	0	none	0	0
02 conflict	2	C1041	2	0
03 conflict	2	C1041	2	0
04 baseline	0	none	0	0

All four controlled slots are correctly evaluated, NOT four successful original B compiles. The two injected failures remain nonzero with their original stdout/stderr and result.json. The four relevant Status0xc0000043 events belong to retained MSPDBSRV process identities (PID4572 and9172, with matching creation times), target the exact B/compiler.pdb, and lie entirely within both the first compiler interval and the held-placeholder interval. They are not coordinator/RM or before/after calibration markers. Corresponding native compilers are uniquely matched by parent/image/start and completion event; no parallel-candidate tie was guessed.

The native placeholder was CREATE_NEW/share0, its physical identity was recorded, and its size remained0. FileDispositionInfo was set only at the planned release point on the held HANDLE, then that HANDLE closed; native mark/close statuses0 and post-close absence error2 were checked. This does not delete an MSVC-produced PDB or authorize any product writer lease. Seed/A preparation succeed, the same original service survives, and recovery uses byte-identical source but a separate invocation. Baselines remove the placeholder before first compilation; conflicts remove it only after original diagnostics/result have been saved. No link/run or warm concurrent-B cancellation coverage is claimed for this cold-B calibration.

16 original tool results/32 diagnostics,64real PDB/PCH completion pairs, the unchanged live/offline readiness and all8boundary successes+8boundary failure markers were checked. The separate actual withheld-provider test admits no child. Two full source/argv pairs match 10 source-file and8 argv comparisons, normalizing only slot-directory identity. Actual MSVC14.51.36231,Windows10.0.26100,PowerShell7.6.5,image20260824.214.3. This is a controlled causal intervention for this new empty-PDB case, not evidence that the historical warm/concurrent C1041 had the same cause.

Input artifact 10114698438 actual executable bytes match all five study provenance records: MQB b4a84ad9add99d1332552cac2108efc226cd61a07b1b1e97b220ae9c3406c263, probe a72f482549c77f64cb9b63574b92b164fe4965228a56a5063c3c41fb8ec7275d, recorder 15a6e67811a5648637344a35c1e96d25827d353b92299f5955c36391af4b4537. These are observer tools, not the performance executable pair. Original D9025 build warnings remain in the build ZIP. Contracts artifact10114350121 verifies 33fault+54invocation+64observer+36trace expectations, including six new full-path tests; no old tests removed.

All existing studies independently retained and replayed

Original studies complete:8PCH/Modules,4calibration references,4traced+4untraced exact-shape cases,4RM-on+4RM-off cases. Each original first-A/B control passes, with all four separate native readiness-refusal controls retained. Raw per-slot auditors were rerun in bounded subprocesses and combined only after every slot and complete input pair verified. Total across those original studies:292tool results/584diagnostics; the new fault calibration adds16/32 separately. No induced compile failure is counted as an original positive control.

The current default56 has all required positive controls passing and no original B compile failures; private42 retains four adverse managed-policy B failures, /Zi Debug cancel(C1090),/ZI normal(C1001),PCH Debug normal(C1090),Modules Debug cancel(C1090), all A-started. All28A-started managed endings still kill their original service across both modes. Recovery does not erase those results. Their complete result/diagnostic inventories were independently checked, not just workflow status.

Independent observer-OFF ABBA #583 /34377199191

Artifact 10114694524,35,477bytes,SHA256 3895cd3bf248a80604a1432a89c48c87569f47a8c39744112626b29fccb6380b. Both exact checkouts, Release builds, instrumentation check, actual ABBA and upload completed. All76pairs, orientation AB/BA/AB/BA, paired arithmetic, medians/MAD/nearest-rank P95 and72complete instrumented counter/breakdown/compile-link-archive hit-miss identities were independently recomputed. Four external counter sets are unavailable, not zero. Only the last row is timings-off external Stopwatch elapsed; every other row is instrumented. Four-pair P95 is the maximum, not a population-tail estimate.

Scenario	Paired median Δms	Paired median Δ%	MAD ms	Paired P95 Δms	Slower
cold	+85.846	+5.53	59.326	+191.039	3/4
no-op	−0.116	−2.80	0.023	+0.308	1/4
single-tu	−5.875	−5.60	24.240	+52.958	2/4
public-header	+0.973	+0.94	7.848	+42.038	3/4
build-run	+0.078	+0.51	2.583	+5.081	2/4
link-only	−8.275	−12.60	10.234	+74.087	1/4
target-scale-cold	+481.738	+12.62	534.389	+4627.868	2/4
target-scale-no-op	+0.075	+0.27	1.289	+9.605	2/4
target-scale-no-op-auto	+0.404	+1.40	0.366	+1.024	3/4
target-scale-no-op-j1	+0.490	+1.28	0.657	+1.793	3/4
target-scale-common-header-no-op	+0.456	+1.47	3.293	+8.494	2/4
target-scale-single-tu	+89.170	+72.44	77.205	+483.991	3/4
discovery-cold	−5.026	−0.34	16.914	+129.207	2/4
discovery-no-op	+0.119	+1.71	0.229	+3.319	2/4
discovery-header	+14.043	+13.80	12.812	+115.092	3/4
modules-cold	+106.062	+6.48	53.876	+165.482	3/4
modules-no-op	+2.164	+46.07	1.301	+5.561	4/4
timings-enabled-no-op	+0.000	+0.01	0.033	+0.063	2/4
timings-disabled-no-op (external)	+0.462	+4.28	0.382	+1.184	3/4

Unrounded external medians +0.4617ms/+4.2782396% do not cross the unchanged BOTH>1ms AND>10% gate. No speedup/zero-overhead claim. The+4.628second scale-cold tail, +72.44% scale-single-TU instrumented median, modules-no-op4/4slower and all favorable samples remain. No cause is assigned, no sample is discarded as noise, and historical performance debt is not closed. Product source and benchmark are unchanged, but that does not prove these observations harmless.

Original failed source and old historical failure remain intact

First head0c6's artifact10114044008 has one accepted baseline, one rejected conflict and two unattempted slots. The rejected conflict had actual C1041/exit2 and two actual MSPDBSRV sharing violations; the auditor compared mixed slash styles literally. Correction33ebb changes only the Python full-path matcher plus six regression tests, not native locking or diagnostics requirements. Corrected offline replay can explain the audit rejection but does not fill the two missing slots or turn the original workflow green.

Old ABBA#582 is separately preserved/recomputed:artifact10114076747,SHA256 b71d73711e2903694b87b67c37931868a7198d1023308cf4a45f69868e5c546b; external median−0.15815ms/−1.5561%,scale-cold max+2127.279ms,72semantic identities match. Old Release#616 was cancelled by the real source change, not completed validation. The title-triggered old-parent#581 was cancelled during baseline build BEFORE candidate build or any measurement; not a same-head measured retry. Actual#583 supplies current-source performance evidence.

The much older600208d untraced default C1041 remains a failed positive control when replayed through its original oracle. Artificially blocking a cold B PDB neither identifies nor repairs that historical cause. All cause/lease flags remain false. Final merge review will explicitly separate acceptance of this test-only diagnostic capability from any claim about resolving that old product/toolchain risk.

[Iviesever]

Final review — accept test-only evidence capability with explicit historical-risk disposition

Implementation self-review and separate read-only artifact/source/statistics recomputation; not independent human approval.

Base: 564becf9d9e99ed91de0ed0f38407872797957a6.
Reviewed head: 33ebb4dda4fbab063d0b94cea556b3e717241822.
Tree: 6a91360d2125a08083a01192bc083b814b905438.
Native test-merge: e05c39784c5eb9af60b16de9bf66e4424fb9fca1, identical tree and exact base/head parents.

This iteration changes four test/CI files by423 additions/6 deletions against parent476dc0e. Full PR is six files1188 additions/64 deletions against main.403of407original files are byte-identical, with four modified/two new test files giving409candidate files. Complete canonical source reconstruction and both patch replays match the declared tree. Product src/include, scheduler implementation, original ETW recorder/readiness/verifier, original default/private collectors, benchmark/ABBA, manifest/native inventory, CLI/freshness and VERSION are unchanged.

Matched submitted blobs for this iteration: native probe485d5f76e31fcf98b3c42d323da55342812641c6; fault verifier05ffe1b5d7b18bfa614037d4ded8134db778cfd4; collector593b0674bf080a63864b6ac864b6f2430896f05e; workflow6a149b3366601f236781524c907021ebdf7e83c3. No unsubmitted local draft is represented as remote code.

Decision: ordinary merge of the diagnostic code, NOT resolution of historical C1041

Accept ordinary expected-head merge of this exact test-only PR. This is an explicit, limited-scope risk decision, revising the previous PR-level HOLD; it is not an automatic consequence of another green batch.

The historical600208d zi-debug-preexisting-drain/B/work0 C1041 remains a genuine failed positive control and its old artifact is still rejected. This new cold-PDB injection does not reproduce that warm/concurrent state or determine its cause. I am NOT declaring the historical root-cause requirement satisfied, changing its failed result, or applying an exemption to a currently failed check. All current-head required positive controls actually passed. The residual historical issue remains open in #164 and continues to limit claims and acceptance of production cancellation, transaction/write-lease safety and release readiness.

The reason to accept these files now is narrower: they are exclusively investigative code, and their ability to preserve and correlate an actual compiler failure is now tested with both deliberate native failures and successful controls, including an auditor defect found and fixed against immutable failing data. Keeping this usable evidence code out of main until an unrecorded historical event can be reconstructed would conflate diagnostic capability with product-reliability proof. Acceptance does not close or weaken the latter obligation. The recorder/original positive matrices remain active; future failures must continue to fail their gates. No automatic compiler retry, /Z7 workaround, disabled original RM queries or deleted failure control is introduced.

#170 and #172 are not approved or merged by this review. M1b, CLI cancellation, all-writer/RPC quiescence, writer leases and formal release remain unapproved. Both machine-readable cause/lease flags remain false. Calibration reports alone still explicitly grant no merge authority; this review is the separate scoped decision.

All exact-current-head gates completed

• Native Debug #727/34377199110: actual build, all four paired shard jobs, runtime/ambient/include/parameter and freshness/side-output checks, final gate passed; not classifier-induced skip.
• Native Release #617/34377199187: Stage0, all four Release shard jobs, full self-host, staging and exact runtime-only package validation passed. publish-release skipped.
• Documentation #178/34377199169, Cross-Stage #204/34377199024, original PDB Open Investigation #8/34377199072 passed.
• Event #11/34377199236: actual Windows native build and PowerShell parsing; 33fault+54invocation+64observer+36trace expectations matched. All five study jobs and their native missing-readiness refusal controls passed.
• Original default #21/3437719920656/56 and private #23/3437719911642/42 complete; all required unmanaged and14default direct-drain controls passed. Independently audited570/409tool results and1140/818stdout-stderr files. Current default B originals all succeeded; private retains four intentionally adverse managed B failures(C1090/C1001). Recovery does not replace originals. All28A-started managed endings still kill the original service. Resource-owner identity is observed0/56default and3/42private, not a writer-quiescence certificate.
• Independent observer-OFF Performance #583/34377199191 actually ran exact checkouts, both Release builds, instrumentation validation, original19x4ABBA and upload.76pairs independently recomputed;72instrumented complete counters/breakdowns/compile-link-archive hit-miss equal; four external counter sets unavailable, not zeros.

Native failure calibration — new evidence, limited inference

Complete raw calibration, input identity, all19ABBA rows and initial failure

The predeclared baseline/conflict,conflict/baseline sequence completed exactly once per slot. Baselines firstB exit0; both conflicts firstB C1041/exit2, each with two actual MSPDBSRV Status0xc0000043 events on the exact B/compiler.pdb during both the first compiler interval and the held exclusive-file interval. Holder, service and compiler are distinct native process creation identities. The four observed service conflicts are not coordinator/RM/calibration-marker substitutions. Original failed diagnostics are preserved, followed by separately successful recovery, never overwritten.

The placeholder is newly created and empty, using CREATE_NEW/share0 with recorded physical identity. Deletion is marked on its held HANDLE only at the declared release point, then the HANDLE is closed; mark/close status0 and absence error2 were checked. The code never path-deletes a produced MSVC PDB. It introduces a controlled empty-file conflict, not a general safe-unlock/recovery policy. Baseline removes before compilation; conflict removes after original diagnostics are saved. No warm/concurrent B, link/run or scheduler cancellation claim is made for this fixture.

All16tool results/32diagnostics,64real PDB/PCH completion pairs, both complete input pairs(10source and8argv comparisons), readiness and8before/after failure+8success calibrations were independently checked. Four recoveries compile byte-identical original source. Actual retained original service survives. Current source has187total synthetic expectations, not187native scenarios.

The previous8P/M,4calibration,4traced+4untraced and4RM-on+4RM-off cases remain and pass. Their292results/584diagnostics and full published analyses were replayed per slot, with source/argv pair checks after all slots completed. Together with the new calibration, there are28calibrated traces and4untraced workload cases, five separately labeled native no-readiness controls. Original32noninjected/injected workload slots are not collapsed into an all-compilers-success statement. In the four existing studies31tool intervals retain multiple child candidates; no unique attribution is fabricated.

Performance debt is not hidden by the passing median gate

External timings-off no-op paired median +0.4617ms/+4.2782%, maximum adverse+1.184ms,3/4slower: unchanged BOTH>1ms AND>10% gate not crossed. Nevertheless preserve scale-cold max+4627.868ms, scale-single-TU median+89.170ms/+72.44%,modules-no-op4/4slower(+46.07% median), and every favorable/adverse sample. No speedup/zero-overhead claim, noise deletion, AA subtraction or historical #170/cold-tail closure. Product source is unchanged but that alone proves neither cause nor harmlessness of observed delays. Only the external row uses Stopwatch elapsed; four-pairP95 is a maximum, not a population-tail estimate. Comparison JSON is not the performance executable pair or OS trace.

Failed first version and retained evidence

First head0c6bcda's native calibration produced baseline success and real injected B/C1041, but the new full-path diagnostic check rejected mixed path separators. Original workflow remains failed with two unattempted slots. The correction changes one Python verifier only: full-path separator/case normalization and boundary checks, plus six tests rejecting wrong directories, volumes and basename prefixes. No native locking/diagnostic set/input/sample-budget changes. Corrected offline old-data interpretation is explicitly separate from its failed workflow and missing slots.

First-head Release#616 was cancelled by the real source correction; its completed ABBA#582, raw contract/fault artifacts and other outcomes remain separately labeled. Old-parent title-triggered#581 was cancelled during baseline build before candidate/measurement and supplied no samples. No same-head benchmark or CI retry was requested. Local GCC checks are extracted declaration-shim syntax tests, not MSVC/ETW execution.

16core unmodified artifact ZIPs (11current,3first-source,2historical) have SHA256/CRC checks; four canonical source versions and full/incremental/fix patches are retained. Raw fault10114748233 SHA256 c8de2d8c93f601214cf80efaadb60458d72b6fc15a19b32f9634f113316f6ec4; currentABBA10114694524 3895cd3bf248a80604a1432a89c48c87569f47a8c39744112626b29fccb6380b. Actual three observer executable members match provenance across all five studies. Those bytes are not the independent performance pair. DiagnosticZIPs omit compiler-generated binary bodies; post-case inventories are not failure-instant snapshots. Actions retention30days. The offline verifier reuses the accepted decoder, not an independently implemented binary ETL decoder.

Handoff

End this observer-expansion subseries here. Keep the historical C1041 and performance debts explicitly open in #164 rather than manufacturing a root cause or adding more identical all-success calibration batches. Next re-review #170 against the new main and exact resulting tree, with its own evidence and explicit disposition of its historical performance hold. Subsequent feature work should return to typed original-failure/cancellation propagation and real scheduler integration; a compile failure must block subsequent link/cache publication and must not become cancellation-success. That is a separate PR, not authorized or implemented here. Project transactions/lease release remain dependent on external-writer authority, not parent exit or this calibration.

Retain VERSION5.5.0 and do not publish tags/assets/releases. Ordinary expected-head merge only, without bypassing protection. Any title/ready-triggered skipped perf job is not new measurement; post-merge push CI is not claimed already completed by this exact-tree review.