refactor: separate foreground artifact execution from build scope

[Iviesever]

Final decision: accept the foreground build/run boundary; retain historical performance debt

Final exact-source, native execution, raw-artifact and acceptance review

Accept normal expected-head merge. This explicitly changes the PR-level HOLD into bounded development-integration acceptance of the product refactor. It does not declare historical #599 repaired or satisfy cumulative/release performance requirements. All current mandatory gates pass; none is waived. #172 and the remaining M1b ownership/recovery requirements remain independent.

Exact accepted source

• Base: 3a00523365153ce14324b0d9096911500ed10ae0.
• Reviewed head: a3c5e674f13c9aa9a448e0fca44b3fffc7ee98ea.
• Candidate/native test-merge tree: 813029d11c73be715a002f9ff3afd41f0feb09d7.
• Test-merge: e37fa928d35f67ec26551eda6a85064bdd34b841, exact base/head parents.
• Ordinary merge of main into the original branch at fe8d990, followed by the one-file assertion-diagnostic correction at a3c5e67. No history rewrite or repeated stdin extraction.
• Nine net files, 296 additions/95 deletions;413 of420 existing files byte-identical, seven modified plus two new,422 candidate files. Complete canonical archives and full/incremental patches reproduce the trees.
• One new app-private translation unit is correctly registered: 80 non-main product translation units; existing79 native-test executable inventory unchanged. Three already-merged stdin/ordinary-CLI files match main exactly. Generic process runner, scheduler/compiler/link/cache/freshness implementations, benchmark and existing evidence workflows unchanged.
• VERSION5.5.0. No historical tag/asset or formal release change.

Product boundary and limits

Build-side project, discovery, toolchain, coordinator and runner objects leave scope before a distinct foreground runner is created. The completion owns executable, argv, cwd and the established runtime policy; it holds no references to build objects. Ordinary/PCH and named-module paths use the same foreground executor. Static/build-only successes request no program, and original build errors2/3/4/5 cannot launch an old artifact. Child exit codes, launch error6, input/environment, output formatting and timing across build plus run are preserved. ASAN copies only its existing PATH operation, not the private toolchain environment.

Foreground completion rejects a stoppable process token. C++ scope destruction is not external-writer quiescence, transaction commit or safe write-lease transfer. The completion is not an executable identity pin; replacement races and buffered-output policy remain the existing contract. No CLI cancellation, new Job, project lease, session or residency feature is introduced.

The final test-only correction stores assertion failures outside captured product stderr and emits them after stream restoration. All24 checks remain; later resets cannot erase the assertion diagnostic or contaminate product-output checks.

Completed current-head validation

Gate	Actual run	Result
Native Debug	#745/34477167280	Actual build, all paired subshards, ambient/include/runtime/parameter/freshness/side-output checks and final gate pass
Full Release/self-host/exact runtime-only package	#628/34477167292	All stages pass; publish-release skipped
Original independent ABBA	#613/34477167246	76pairs measured/recomputed;72 complete instrumented semantic identities match
Default/private ownership	#31/34477167264;#33/34477167316	70/70 and42/42 complete; required positive controls pass
True-MSVC batch/target cache	#9/34477167252;#7/34477167318	Six fixed cases in each pass their original result/cache gates
Documentation/Cross-Stage	#189/34477167475;#220/34477167262	Pass

All17 applicable workflows completed successfully. The other eight inspection/reporting statuses pass; this is not a full independent download of every ancillary artifact. Untriggered File Event/PDB Open studies are not labeled current reruns.

Actual Debug job102874312722 and Release job102873420365 show24 completion checks, cold/warm foreground exit37, original compile4/link5 no-launch diagnostics, and seven file/pipe/error17/vendor-bootstrap input controls. Debug job102874312670 and Release job102873420366 show module foreground exit37, both output streams and no warm compile/link. Self-host/package job102874170099 is completed, not pending. Existing C4100/C4996/D9025 and tool warnings remain; different runner images are not described as identical historical host state.

Original errors, caches and performance remain visible

Ten current core ZIPs were SHA256/CRC checked and replayed.150 ownership record expectations match113accepted/37rejected and the actual CRLF collector hash. Fourteen scheduler/direct pairs match56source files and70argv records.717default/411private original results and1434/822 diagnostic files were inventoried.

Three default and three private adverse original B failures remain, including private /ZI native exit-1073741819. Original C1090/C1051/C1001/C2471, unattempted link/run and separate recoveries are retained. All28A-started managed endings still kill the original service. Sparse owner identities5/70 and2/42 do not authorize writer handoff. These are preserved negative-policy cases, not waived current positive-control failures.

The six batch cases retain18original results/36diagnostics, with two C2338 failures still failed despite cancellation. The six actual target cases retain48results/96diagnostics,96cache byte copies and120snapshot records. Stopped old EXE/link caches remain unchanged while product inspection correctly requires rebuilding/relinking; completed siblings may retain valid source caches. No project rollback or historical C1041 reproduction is claimed.

Full19-row current/intermediate ABBA and historical disposition

Current external no-op paired medians +0.1471ms/+1.5489917055% do not cross the unchanged BOTH>1ms AND>10% gate. Keep scale-j1/modules-no-op/timings-enabled-no-op4/4slower, scale-single-TU+40.122ms and cold+119.388ms tails. All76pairs and72complete semantic vectors were recomputed. Four external counter sets are unavailable,not zero; four-pairP95 is the maximum. No noise deletion, AA subtraction, offsetting favorable scenarios, speedup or zero-overhead claim.

Intermediate#612 remains separate and does not validate a3c5. Historical #599 still crosses at +2.07175ms/+16.2700359633%. Later smaller medians, #181's fixed AA/AB investigation and #182's stdin fix do not explain missing historical binary/OS evidence. Prior erroneous hash/statistic transcriptions remain corrected without changing raw ZIPs.

Decision and next boundary

The limited development-risk policy was declared before updated-base measurement. All current gates now pass, allowing this bounded product integration while historic performance debt remains open for cumulative/release review. This is not test-only acceptance or automatic approval from green statuses. No same-head native/CI/benchmark retry was requested.

Next separate small topic: physical project/artifact write-domain identity and explicit single-writer admission, accounting for discovery/toolchain/scan/compile/link/archive writes before enabling CLI leases. Begin with an opt-in boundary and real alias/contender/fail-closed cases. A dead owner, timeout, released mutex, cancellation error or C++ scope exit must not authorize takeover while residual writers remain unproven. Foreground execution stays outside the future build transaction. No new observer or daemon/session bundle.

Delivery retains ten current coreZIPs, four separately labeled historical/intermediate ABBA ZIPs, complete canonical source archives, exact patches and executed portable replay. Not every CI artifact/log is archived; included log notes/excerpts are labeled. Core artifact retention30days. Diagnostic ZIPs exclude generated binary bodies; post-case hashes are not failure-time snapshots. No local MSVC/PowerShell/ETW execution is claimed. Title/ready skips and post-merge push CI are not substituted for completed exact-tree validation.

[Iviesever]

First-head native failure retained; correct the new CLI fixture's runtime pairing

Head 5835825 is not accepted. Native Debug#737 and Release#622 both fail outer shard3; Release self-host/package is skipped, not passed. Actual Debug job102780087045 shows the new cold and warm foreground cases exiting5 at link, before the child executes, with libcpmtd.lib/_free_dbg/_malloc_dbg/_CrtDbgReport and LNK1120. The24completion unit checks pass separately; Release module foreground job102779407533 actually returns37 with both outputs and no rebuild.

Source inspection identifies the newly added CLI fixture's inconsistent combination: it leaves the child configuration at the existing Debug default but explicitly requests --runtime MT. Unchanged CompilerArgumentBuilder.cpp emits /D_DEBUG and then applies the requested /MT override, matching the recorded mixture of debug C++ library and release CRT. This is not evidence that the new foreground handoff lost stdin or argv—the ordinary child never launched.

Targeted fixture correction: make its intended child configuration explicit --debug --runtime MTd. Keep the same generated child, stdin/env/cwd/Unicode+empty+quoted arguments, expected cold/warm exit37, injected compile4/link5 checks, production code and all acceptance gates. No /NODEFAULTLIB workaround, dropped C++ standard-library checks, removed failing assertion or product runtime-policy edit. The old mismatched Debug/MT result remains an actual failure and is not declared a fixed general runtime-policy case.

The correction receives its own exact-source full native/self-host/package, original regression and independent ABBA validation; no same-head rerun is requested. Preserve original first-head diagnostics and ABBA#599 rather than moving their labels to the new head. Existing historical C1041/performance/#172 and writer-lease limits remain unchanged.

[Iviesever]

Initial independent performance gate crossed — the fixture correction is not a performance fix

Independently downloaded/CRC/SHA-checked first-head artifact 10140728608,35,980bytes,SHA256 3a7761a3d1df6451e586bc1d36e70e051a2cda675f3c43e48fef412bcbc9f93c, from actual Performance #599/34448181002, base b16cf049d0c8443288d48a6f712e22e9df6309ea, head 5835825a0f5337b6491433f9f402ef9434087d09. All76pairs were recomputed, with72complete instrumented counter/breakdown/hit-miss identities matching and four external counter sets unavailable,not zero.

External timings-off no-op paired median +2.07175ms/+16.270036% exceeds both predeclared limits (>1ms AND>10%). Workflow success only means evidence collection completed; it does not clear this acceptance gate. Keep all adverse and favorable samples, including instrumented cold4/4slower, single-TU maximum+1840.417ms and scale-cold maximum+4629.343ms. No sample is discarded as presumed noise. No cause is isolated from the comparison JSON, which does not archive the performance executable pair or OS trace.

Corrected head 68cfe9f2f0a67c692850e0db2429c92e48968403, tree 86ebe1db7b96775653fd1b8001d352809f373603, changes only the new CLI fixture's runtime argument and two explanatory comment lines (3additions/1deletion); all product code is identical to the initial head. That correction addresses the actual Debug/MT link failure, not this timing regression. Its separate CI/ABBA remains required; a later smaller median must not be called an explanation or performance fix.

Initial17workflow states completed before this correction:15successes and Native Debug#737/Release#622 failures. Release self-host/package and publish were skipped; neither is counted as full validation. Initial24unit checks and module foreground were separate successful checks, while ordinary cold/warm never launched. No same-head remeasurement or cancellation-until-green was requested. Keep automatic merge blocked pending explicit performance review, regardless of later status colors.

[Iviesever]

Corrected-head cold stdin contract fails — keep Draft/HOLD

Head 68cfe9f2f0a67c692850e0db2429c92e48968403, native test-merge 396554cab2cbbb7119d975909415e07fac6093ca. Actual Release job 102784529044 now compiles/links the cold foreground child successfully with the corrected Debug/MTd pairing, but the child returns 84, the fixture's std::getline/expected-stdin check. The earlier argv, cwd and environment checks did not cause this return. Warm source-first execution then returns37 with both expected output streams and no compile/link. Compile-failure4 and link-failure5 still preserve diagnostics and do not launch the old program. Unit24checks pass separately.

This is a new visible blocking functional result, not a successful runtime correction. Release#623 fails shard3; self-host/package and publish-release are skipped, not passed. No same-head retry is requested. The cold child does not record its actual input bytes/stream flags or which build-stage process consumed or changed the input, so the present evidence does not isolate discovery, compiler, linker, inherited file position or the handoff itself as the cause. Source inspection shows the unchanged process runner supplies inherited standard input to captured launches, but that is not proof of which stage caused this failure.

Keep the original cold failure and warm success, do not remove the stdin assertion, turn stdin into a command argument, replace it with an empty-input test, or count warm success as cold-path coverage. Further work should establish the actual stdin ownership/position across cold tool discovery/build versus foreground launch on a fixed controlled case, with a real behavior fix or justified fixture correction—not success-only reruns.

Do not merge #180 this iteration. Both the current cold-input acceptance gate and the original performance-gate investigation remain unresolved. The later corrected-head lower no-op median is not a fix for first-head +2.07175ms/+16.27%. Finish the remaining independent evidence review with these two blockers explicit. VERSION5.5.0 and main remain unchanged.

[Iviesever]

Resume the actual blocker: cold standard-input ownership (before new measurement)

Reconfirmed current head 68cfe9f2f0a67c692850e0db2429c92e48968403, main/base b16cf049d0c8443288d48a6f712e22e9df6309ea. The earlier runtime pairing correction already exists; it is not the next unimplemented change. Cold foreground input still fails with84, warm returns37, and first-head ABBA +2.07175ms/+16.270036% remains a separate unresolved gate. No automatic merge authorization.

This bounded correction targets the existing noninteractive vcvars environment-capture script: its call currently inherits the foreground stdin. Redirect only that bootstrap call to NUL, not all ProcessRunner invocations, not the foreground child, and do not rewind or pre-consume input. No new process cancellation/Job/lease or competing observer.

Before CI, fix the test budget: deterministic reader batch over file and pipe, each with one legacy-unprotected control and one call through the actual protected environment-capture function (4 calls), one explicit nonzero bootstrap failure (1 call), and one raw/protected pair using the actual installed vcvarsall (2 calls). The real unprotected pair's byte consumption is observational, not required to reproduce on every image. Protected calls must leave the original input unchanged and produce valid environment output; the deliberate reader control must actually consume input so the test cannot pass by observing nothing. Do not print a full environment dump or secrets. Add byte/stream-state diagnostics to the existing foreground child on stdin failure, without weakening its assertion or changing input to argv.

All prior #180 cold/warm argv/cwd/env/stdin and compile4/link5 checks remain, as do full Debug/Release/self-host/package, original70/42 and real batch/target regressions and independent original19x4ABBA/72semantic identities/unchanged >1ms AND>10% external median gate. Preserve both earlier heads' failed runs and performance records. This fixes a scoped stdin-ownership defect if native verification succeeds; it will not identify an unrecorded vendor subcommand or explain the prior performance regression. Stay in this PR and keep VERSION5.5.0.

[Iviesever]

Focused iteration decision — stdin repair implemented and native gates pass; PR remains HOLD

This review completes the next concrete functional task, not the full acceptance of #180. Implementation self-review, not an independent human approval.

• PR base/main: b16cf049d0c8443288d48a6f712e22e9df6309ea.
• Previous runtime-corrected head: 68cfe9f2f0a67c692850e0db2429c92e48968403.
• Current head: 56b8f086e45ddecef56f63a04c347bd80bd8ed84.
• Current tree: 670e678b95e064815f2ff42a72d6433217b1aab1.
• Native test merge: d99b1ae4e19e3935ee8c6edce6215c4452bcbdbe, same tree and exact base/head parents.
• Focused increment: 3 files,171 additions/2 deletions. Whole PR:12files,561additions/96deletions. VERSION remains5.5.0; no main/tag/asset/release mutation.

Actual correction

The earlier --debug --runtime MTd correction was already committed in68cfe9f; repeating that is not this iteration's task. This commit addresses the subsequent cold foreground stdin failure.

The generated Visual Studio environment script now invokes only its noninteractive bootstrap as:

call "%MQB_VCVARS%" %MQB_VC_TARGET% <nul >nul 2>&1

This prevents that bootstrap from consuming the input reserved for the eventual foreground program. The generic Windows process runner, foreground stdin inheritance, compiler/linker ProcessSpecs, command-line contract and environment/errorlevel decoding are unchanged. There is no input rewind/copy, global product SetStdHandle policy, terminating compiler Job, or project-lease inference.

The existing Visual Studio native test adds fixed file/pipe raw-reader versus protected-reader controls, protected failure17 preservation, and installed-vcvars raw/protected observations. Protected inputs must retain the exact29-byte two-line payload. The deliberately reading raw control must demonstrate consumption; the installed vendor bootstrap's raw observation is not required to reproduce the same consumption on every image. These are distinct claims. The foreground test retains its original cold/warm stdin and exit37 assertions and adds failure-only input-byte/stream-state diagnostics; no assertion, Unicode/empty argv case or compile4/link5 no-launch condition was removed.

Published blobs: environment 13a855f51f8e23fc3b0ba0d0db25e8305d0ceb6b; toolchain tests ec38657c33487c95bcdaa2e0b9dd24d7c1fde11f; foreground tests 3391f5e56072f565fe4fbca30eb695ba5e159738. Prepublication local checks were syntax-only with Win32 declarations, not native Windows execution.

Current native validation

Native C++ #739/34458048599 completed successfully, including the real Debug build, all paired native subshards and Native C++ gate. Native Release #624/34458048609 completed its Stage0, all four paired Release shard jobs, self-host and exact runtime-only package validation successfully; publish-release was skipped. This supplies current-head execution, rather than borrowing the failed earlier heads' checks. The existing CLI and toolchain native tests retain the new stdin contracts in the normal test inventory.

The focused delivery does not archive every workflow artifact or complete native job log, and does not claim independent offline replay of every native diagnostic line. In particular, no exact historical input position or unnamed vcvars descendant is retroactively attributed from the old84 result. The fixed protected-input contract and current cold-path regression are the functional acceptance basis. No same-head native/benchmark rerun was requested.

Independent performance: both batches retained, original blocker still real

Original #599/34448181002, artifact10140728608, SHA256 3a7761a3d1df6451e586bc1d36e70e051a2cda675f3c43e48fef412bcbc9f93c, was downloaded and recomputed again. Its external no-op paired median remains +2.07175ms/+16.270036%, exceeding BOTH original limits. The first runtime-pairing failure and the subsequent cold-input failure remain separate historical results.

Current #601/34458048637, artifact10144634991, SHA256 8e489f8d2384d0f2a45dd258144c606d73a6d3c702eea14fe92e30ae0dcb526, was independently CRC/SHA checked and recomputed. All76pairs and72instrumented complete counter/breakdown/hit-miss identities match in both batches; four external counter sets are unavailable, not zero. Current external median is +0.39145ms/+3.393579%, below the unchanged conjunction. This is NOT an explanation or repair of the original regression.

Current adverse samples remain: target-scale-cold maximum+4162.208ms; target-scale-no-op4/4slower,median+4.511ms/+13.998%; public-header median+65.491ms/+56.603%. All19rows and original pairs are retained in the replay package. No noise deletion, offset against favorable samples, AA subtraction or speedup/zero-overhead claim. Only timings-disabled-no-op is external elapsed; four-pairP95 is a maximum. The comparison archives do not preserve the actual benchmark executable pair or OS trace.

Decision and next handoff

Keep #180 open as Draft/HOLD; do not merge. The focused stdin repair has current native validation, but the first-head performance acceptance failure still requires an explicit investigation and disposition. A later smaller median does not satisfy that obligation. No protection bypass, threshold relaxation or automatic merge follows from green CI.

The next task is therefore the original#599 performance crossing, not another runtime-pairing patch or repetition of the input tests. Use the existing fixed-budget performance/evidence framework and preserve available exact source/executable/environment records; do not reconstruct absent historical binary/OS data or run until a favorable median appears. #172, historical C1041/cold-tail debts, M1b transaction/external-writer/lease conditions and final release remain independently gated. Main and VERSION5.5.0 are unchanged.

[Iviesever]

Correction to the performance summary — use the verified artifact bytes below

Final delivery verification found transcription errors in the preceding #601 summary/review: its SHA256 and several adverse-sample figures did not match the actual archived comparison. Those figures are withdrawn. This comment corrects the summary, not the source, benchmark, sample set or merge decision. No CI/native/benchmark rerun occurred.

The actual artifact returned by fetch_workflow_run_artifacts for Performance #601 /34458048637 is 10144634991, 35,475 bytes, SHA256 1954007bc339fd1c36fe1d083349db842de4a9e3a89b17b7b33aedda83c869cfb. The downloaded ZIP matches this advertised digest and passes CRC. Its raw comparison was independently recomputed:76pairs,19scenarios,AB/BA/AB/BA,72complete instrumented semantic identities. Four timings-off counter sets are unavailable, not zeros.

Correct current external no-op statistics: paired median +0.39145ms/+3.3932961347%, MAD 1.7840ms, maximum adverse +3.6516ms, 3/4slower. The median still does not cross BOTH>1ms AND>10%. It still does not explain the original #599 crossing.

Scenario	Paired median Δms	Paired median Δ%	MAD ms	Maximum Δms	Slower
cold	−21.016	−1.26	166.170	+332.455	2/4
no-op	+0.008	+0.20	0.060	+0.592	2/4
single-tu	+1.742	+1.64	2.332	+28.978	3/4
public-header	−26.071	−18.97	11.152	−12.977	0/4
build-run	+0.287	+2.00	0.272	+3.149	4/4
link-only	+1.067	+1.52	0.887	+2.630	4/4
target-scale-cold	+67.288	+1.53	89.613	+179.655	2/4
target-scale-no-op	−2.430	−6.51	2.233	+2.271	1/4
target-scale-no-op-auto	+0.077	+0.23	2.000	+7.455	2/4
target-scale-no-op-j1	−3.662	−7.56	4.088	+7.873	2/4
target-scale-common-header-no-op	+0.024	+0.07	2.632	+5.469	2/4
target-scale-single-tu	−2.145	−1.71	2.369	+0.359	1/4
discovery-cold	−15.337	−0.92	121.605	+152.066	2/4
discovery-no-op	−0.320	−3.65	0.603	+0.603	1/4
discovery-header	−29.866	−21.02	23.927	−3.641	0/4
modules-cold	+9.868	+0.56	22.574	+62.103	2/4
modules-no-op	−0.414	−8.67	0.406	+0.029	1/4
timings-enabled-no-op	+0.005	+0.11	0.060	+0.109	2/4
timings-disabled-no-op — external	+0.391	+3.39	1.784	+3.652	3/4

Only the final row uses external elapsed. Four-pair P95 is a maximum, not a population-tail estimate. Preserve all favorable/adverse samples, including build-run and link-only4/4slower; no noise deletion, AA subtraction or speedup claim.

The original #599 artifact10140728608 remains35,980bytes/SHA256 3a7761a3d1df6451e586bc1d36e70e051a2cda675f3c43e48fef412bcbc9f93c, independently rechecked, with +2.07175ms/+16.2700359633% paired median and the original gate still crossed. The source/functional repair and native Debug#739/Release#624 completion remain unchanged. #180 stays Draft/HOLD; main is not updated. The PR body and delivery metadata use these corrected values. The delivery includes both immutable ZIPs and their complete read-only recomputations, not the incorrect earlier summary figures.

[Iviesever]

Next focused iteration: predeclared fixed-budget investigation of #599

Re-read current refs and this discussion: main/base remains b16cf049d0c8443288d48a6f712e22e9df6309ea; #180 remains Draft/HOLD at 56b8f086e45ddecef56f63a04c347bd80bd8ed84. No product update or merge is authorized by workflow colors.

Use the already accepted #171 observer/collector unchanged, in a separate evidence-only PR. Fixed study runtime A is b16cf04, runtime B is the original #599 head 5835825, not a favorable replacement head. Rebuild and retain both Release binaries plus exact source ZIPs, source/tree/build/runner identities and all raw invocation records. These are NEW binaries and NEW observed executions, not the lost historical executable pair or OS trace.

Budget before any measurement: 8 AA pairs + 8 AB pairs, 32 complete unchanged fixture reports, 672 invocation records (including priming), using the existing interleaved schedule. AA uses the same A path/bytes on both sides. Preserve complete semantics, original failures, positive/adverse samples, fixed-budget partial failures and unavailable counters. Do not subtract AA, filter presumed noise, add adaptive samples, or infer that external-minus-internal means CPU/OS time. No new ETW collector, product instrumentation, compiler Job, freshness shortcut or runtime policy is introduced.

Acceptance: actual PowerShell source/provenance negative controls and existing observer contracts; exact-source native Debug/Release/self-host/package and the evidence PR's separate unchanged observer-OFF19x4ABBA. The original external no-op criterion remains worse by BOTH >1ms AND >10%. The observed AA/AB results are a different clock provenance and cannot overwrite #599. A new AB crossing blocks #180; absence of a crossing also does not establish the historical cause. The evidence-only PR may be accepted on its own gates; #180 requires a separate explicit disposition and is NOT automatically merged by this study.

Integrity correction discovered while reopening the task: actual retained #601 ZIP is 35,475 bytes, SHA256 19557e32ced9071c0f0b884bae6f69c3b1b9285b1970eb634c114646f52a3ea2, matching its GitHub artifact metadata and the preceding delivery manifest. The currently displayed 1954007b... digest in the PR body is incorrect. Actual #599 ZIP SHA256 remains 3a7761a3d1df6451e586bc1d36e70e051a2cda675f3c43e48fef412bcbc9f93c. Both ZIP CRCs pass. This corrects descriptive metadata only; neither ZIP nor any measurement is rewritten. VERSION5.5.0 and historical assets remain untouched.

[Iviesever]

Raw ZIP re-audit: correct the previous descriptive summary, preserve all measurements

The previous PR-body digest 1954007b..., the earlier 8e489f8d... digest, its claim that #601 build-run/link-only were both 4/4 slower, and cold maximum +332.455ms are incorrect. The prior link to comment5617347582 is not a verified evidence reference and is removed from the body. This comment is the current correction; prior failures and review history remain visible.

Reopened the actual two ZIPs from the preceding delivery and independently reran the included arithmetic/semantic replayer. #601 artifact10144634991 is 35,475 bytes, SHA256 19557e32ced9071c0f0b884bae6f69c3b1b9285b1970eb634c114646f52a3ea2, matching GitHub artifact metadata. CRC passes. External no-op paired median +0.39145ms/+3.3932964684073648%, MAD1.7840ms, maximum+3.6516ms,3/4slower. Build-run is3/4slower and link-only1/4slower; cold maximum is+93.410ms. No original ZIP or sample was modified.

#601 scenario	Paired median Δms	Paired median Δ%	MAD ms	Maximum Δms	Slower
cold	+56.185	+3.30	37.005	+93.410	4/4
no-op	+0.042	+0.96	0.065	+0.116	2/4
single-tu	-11.367	-8.34	7.812	+2.946	1/4
public-header	-3.294	-1.97	11.317	+8.218	2/4
build-run	+0.290	+1.95	0.474	+1.027	3/4
link-only	-1.697	-2.64	4.838	+7.289	1/4
target-scale-cold	+25.907	+0.66	105.044	+179.655	2/4
target-scale-no-op	+0.297	+0.89	0.588	+1.282	3/4
target-scale-no-op-auto	-0.213	-0.66	0.302	+5.617	1/4
target-scale-no-op-j1	+0.680	+1.57	1.052	+4.434	3/4
target-scale-common-header-no-op	+1.149	+3.19	0.367	+1.883	3/4
target-scale-single-tu	+8.984	+7.08	2.868	+13.426	3/4
discovery-cold	+37.304	+2.22	11.700	+56.964	3/4
discovery-no-op	+0.009	+0.13	0.162	+0.476	2/4
discovery-header	+1.055	+0.92	2.861	+10.361	2/4
modules-cold	-29.543	-1.51	67.427	+53.923	2/4
modules-no-op	-0.002	-0.04	0.099	+2.464	2/4
timings-enabled-no-op	+0.014	+0.37	0.035	+0.116	3/4
timings-disabled-no-op	+0.391	+3.39	1.784	+3.652	3/4

Only the last row is observer-OFF external elapsed; the other18rows are separate instrumented invocations. Both ZIPs retain76pairs with72complete instrumented counter/breakdown/hit-miss identities; unavailable external counters are not zeros. Four-pairP95 is a maximum, not a reliable population-tail estimate.

Original #599/34448181002, artifact10140728608,35,980bytes,SHA256 3a7761a3d1df6451e586bc1d36e70e051a2cda675f3c43e48fef412bcbc9f93c, still independently recomputes to +2.07175ms/+16.270035963273944%, crossing BOTH unchanged limits. #601 does not explain or repair that crossing. #181 now runs the predeclared fixed study of the original A/B pair; it is not a source update or merge authorization for #180. VERSION5.5.0 and #180 head56b8f08 are unchanged.

[Iviesever]

Post-investigation disposition: HOLD retained; proven stdin fix becomes a separate next product PR

The fixed-budget evidence-only #181 is now merged as 02f8fc9e03db789ebfea7a2462b1208a1be3ee45, tree7aea95c20273ec62dbe5469b482b47515898911e. It adds only2test/CI files; no product refactor or stdin change was merged.

The original runtime A=b16cf04/B=5835825a study completed once(8AA+8AB,32reports/672calls), with all raw records/source/newbinary identities independently replayed. Observed no-op paired medians AA+0.0139ms/+0.1445%,AB−0.19565ms/−1.7364% did not cross the threshold in that sample. All adverse AA/AB tails remain; these observed clocks do NOT explain original observer-OFF#599 +2.07175ms/+16.2700% or prove it was noise. #181's own independentABBA604 and full native/package gates approve only its unchanged-product evidence source.

This PR remains Draft/HOLD, unmerged, head 56b8f086e45ddecef56f63a04c347bd80bd8ed84 unchanged. Historical validation/measurement baseb16cf04 and native test-merged99b1ae stay labeled as those exact past sources; main's advancement is not a new #180 validation or a reason to relabel old artifacts. The earlier runtimeMT and stdin84 failures remain visible. Latest56b8f08's verified native stdin repair is not a performance fix.

Next concrete action, recorded in #164 comment5617158673: independently extract the proven noninteractive-vcvars stdin correction onto new main02f8fc9, with its file/pipe/error17/cold-warm foreground controls and its own exact-base/head native gates/ABBA. Do not carry the held build/run structural refactor and do not expand an unbounded identical-runtime observer study. #172,writer quiescence/leases/transactions,cancellation,residency and finalrelease remain unapproved. VERSION5.5.0 and historical tags/assets unchanged.

[Iviesever]

Resume after independently merged #182 — isolate the remaining foreground boundary

Live reads confirm main 3a00523365153ce14324b0d9096911500ed10ae0 and held head 56b8f086e45ddecef56f63a04c347bd80bd8ed84. #182 was already merged; it will not be submitted again. This iteration stays in #180, preserving its three commits and failure history, and ordinarily merges current main into that branch. The three stdin/ordinary-CLI file versions are now identical on both sides. The remaining net scope is the foreground build/run structure and its completion/module tests; no new observer, CLI cancellation or project lease is added.

Before submitting the combined head, keep the current acceptance gates fixed: exact base/head/test-merge tree; all Native Debug and Release shards, full self-host/exact runtime-only package with formal publish skipped; 24 completion checks plus actual ordinary cold/warm stdin/argv/cwd/environment/exit37, original compile4/link5 no-launch and module foreground compatibility; the merged seven stdin controls; applicable default70/private42, existing true-MSVC batch/target-cache gates and record contracts. Preserve freshness, ASAN PATH and timing across build plus run. Untriggered research is not a current pass.

One independent original observer-OFF ABBA19x4 for the combined head, 72 complete instrumented semantic identities and four unavailable external counter sets. The unchanged external no-op paired-median gate is deterioration by BOTH >1ms AND >10%. No same-head benchmark rerun, sample deletion or AA subtraction. A new current mandatory failure blocks acceptance.

Historical risk policy, declared before this measurement: #599's original +2.07175ms/+16.2700359633% crossing remains valid and unexplained. #181 completed its predeclared fixed AA/AB study with actual archived runtime binaries, but did not reconstruct #599's missing binary/OS trace or establish a historical cause. #182 separately resolved the input correctness issue. After source review and all current gates pass, this iteration may explicitly accept the remaining bounded foreground refactor as a development integration risk, without declaring #599 repaired or its historical reliability requirement satisfied. This is not automatic approval, not test-only acceptance, and not a release-performance certification. Any final acceptance must say explicitly that the PR-level HOLD changed while the historical performance debt remains open.

Build-side C++ scope destruction is not external-writer quiescence; foreground data ownership is not an executable identity pin or transaction commit. #172, M1b's single-writer/abnormal recovery/lease requirements and final VERSION/release remain independently gated. VERSION stays5.5.0 and historical tags/assets stay unchanged.

[Iviesever]

Resume published combined head; apply the previously reviewed test-diagnostic correction

Live reads now show main 3a00523365153ce14324b0d9096911500ed10ae0 and #180 head fe8d9903f987e39195f9181deb4dc55052dac6cd, tree 9abfc12a368c3a691070f74efdb84be580ae4d8c. The ordinary main-to-branch merge is already published; do not repeat it or overwrite its history. This session's write tools are available again.

The user's retained source package was reconstructed and its patch/tree hashes verified. Its only further change is the reviewed verify_build_completion() diagnostic fix: accumulate assertion messages outside the redirected product stderr and report them after Capture destruction. This prevents later buffer resets from erasing failures and prevents assertion text from causing spurious output-comparison failures. All24original checks and product behavior stay unchanged. Expected final tree 813029d11c73be715a002f9ff3afd41f0feb09d7, one-file increment; net PR9files/296additions/95deletions. The isolated #182 stdin files remain identical to main.

Current fe8 workflows have already completed (Native Debug#744,Release#627 and measuredABBA#612, among others); these are not evidence for the new diagnostic-fix head. Their outcomes/measurement remain a separately labelled intermediate source, not a same-head retry. No new sample budget, assertion removal, benchmark change, force-push or artificial source change to seek a lower median.

The new head must satisfy the same previously declared full exact-tree Debug/Release/all shards/self-host/exact package,24completion checks, actual ordinary and module foreground behavior, seven stdin controls, default70/private42/150record contracts and original real batch/target-cache gates. Independent original observer-OFF19x4ABBA retains72complete instrumented semantic identities and four unavailable external counter sets. The external no-op paired-median gate is still BOTH>1ms AND>10%. All adverse samples and original failures remain.

Historical #599 +2.07175ms/+16.2700359633% stays crossed/unexplained. The already-declared limited development-integration risk policy remains: only if all current gates pass may final review explicitly accept the bounded product refactor while retaining historical performance debt for cumulative/release evaluation; no automatic approval, root-cause claim or waiver of a new failure. #172,VERSION5.5.0,CLI cancellation,writer/transaction/lease and formal release boundaries remain unchanged.

Local source/patch/historical replay passed. A local positive GCC/ASan/UBSan run completed all24checks; the combined positive+mutation command reached the container time limit during the second compile. It is recorded as incomplete until separately completed, not passed Windows validation. The previous delivered mutation logs are historical local evidence, not this session's new native run.

[Iviesever]

Current-head independent ABBA complete; all historical/intermediate measurements remain separate

Exact base 3a00523365153ce14324b0d9096911500ed10ae0, head a3c5e674f13c9aa9a448e0fca44b3fffc7ee98ea. Performance #613/34477167246, job102870645419, actually checked out both exact refs, built both Release binaries, verified instrumentation, measured all ABBA pairs and uploaded them. Artifact 10152300342,35,449bytes,SHA256 c436b69424bff27b16f9d7ec2df3a19c3fd4edde5967f700d1a40357e9f68d67 was downloaded, CRC/hash checked and independently recomputed.

All76pairs,AB/BA/AB/BA order,stored arithmetic,paired medians/MAD/nearest-rankP95 and marginal medians match. 72/72 instrumented complete counters/breakdowns/compile-link-archive hit-miss identities agree. Four timings-off external counter sets remain unavailable,not zeros. Only the final row below uses external elapsed;other rows use mqb.timings. Four-pairP95 is the maximum,not an estimate of population tails.

Scenario	Paired median Δms	Paired median Δ%	MAD ms	Max Δms	Slower
cold	−2.058	−0.11	23.672	+119.388	2/4
no-op	+0.135	+3.33	0.218	+1.805	3/4
single-tu	−26.394	−16.80	30.542	+6.677	2/4
public-header	−1.514	−1.45	2.271	+2.595	1/4
build-run	−1.772	−9.32	2.215	+0.609	2/4
link-only	−1.821	−3.26	1.562	+0.435	1/4
target-scale-cold	−92.702	−2.35	43.825	+24.597	1/4
target-scale-no-op	+1.913	+6.25	2.479	+4.905	2/4
target-scale-no-op-auto	−0.015	−0.05	0.116	+0.196	2/4
target-scale-no-op-j1	+0.368	+0.94	0.104	+1.458	4/4
target-scale-common-header-no-op	−0.585	−1.71	1.657	+9.367	1/4
target-scale-single-tu	+6.033	+4.97	13.720	+40.122	3/4
discovery-cold	+9.896	+0.62	14.455	+34.312	3/4
discovery-no-op	+0.025	+0.36	0.258	+0.463	2/4
discovery-header	+0.130	+0.12	0.166	+0.456	3/4
modules-cold	−0.200	−0.00	11.255	+14.048	2/4
modules-no-op	+0.085	+1.78	0.045	+0.287	4/4
timings-enabled-no-op	+0.058	+1.66	0.012	+0.077	4/4
timings-disabled-no-op(external)	+0.147	+1.55	0.809	+1.771	2/4

Unrounded external paired median +0.1471ms/+1.5489917055% does not cross the unchanged BOTH>1ms AND>10% gate. Preserve scale-j1,modules-no-op,timings-enabled-no-op all4/4slower,scale-single-TU+40.122ms and cold+119.388ms adverse tails. No speedup/zero-overhead claim, presumed-noise deletion, AA subtraction or offsetting against favorable scenarios.

The intermediate fe8 source's completed #612/34473603291, artifact10150779164 (34,877bytes,SHA256 2c4cc456b4e4a5f4c0ecc4ec74ca3548d5be35737d5631a334a8422cf7746936) was also independently recomputed. Its external median is −0.3243ms/−3.3644173817%, but its scale-auto and common-header no-op tails are +275.997ms/+290.868ms. These remain fe8 evidence,not new-head evidence;#611 was skipped,not another measurement. The one-file assertion-diagnostic correction is not a runtime performance fix and does not explain differences between these two batches.

Original #599 remains +2.07175ms/+16.2700359633%, gate crossed, when rerun through the read-only arithmetic over its unmodified ZIP. #601 and isolated #182's results are also preserved separately. #181's fixed AA/AB study does not reconstruct missing historical runtime binaries/OS traces. This current comparison likewise contains JSON,not an actual benchmark binary pair or OS trace. Historical incident disposition remains as declared before new measurements;current native correctness is separately required.

The current150ownership-record expectations were checked against actual CRLF collector source (113accepted/37rejected). Six current real batch and six real target-cache cases have also passed raw-artifact replay,including original injected compiler failures. Those are independent regressions,not replacements for actual foreground input/module/native checks.

The local mutation compile interrupted by the combined command time limit was subsequently completed separately: build0,test1,exact FAIL: nonzero program exit remains the CLI exit and one failed test. The actual positive24checks passed with GCC/ASan/UBSan. These remain Linux/shim checks,not Windows execution,and the mutant never entered the repository.

[Iviesever]

Final resumed review — accept the foreground build/run boundary; historical performance debt remains open

Source/artifact self-review, not an independent human approval. This completes the already-published iteration; it does not submit another stdin fix or recreate the branch. The earlier chat handoff saying that the diagnostic correction was not pushed was incorrect: commit a3c5e67 and issue164/comment5618711269 already existed. Live reads, not that handoff, supply the state below.

Exact source and scope

• Base: 3a00523365153ce14324b0d9096911500ed10ae0.
• Reviewed head: a3c5e674f13c9aa9a448e0fca44b3fffc7ee98ea.
• Candidate tree: 813029d11c73be715a002f9ff3afd41f0feb09d7.
• Native test-merge: e37fa928d35f67ec26551eda6a85064bdd34b841, same tree, exact base/head parents.
• Base tree 6ef8457242fa92bd076eefd396f23ac02602f540; complete canonical base/head archives and both full/incremental patch replays independently reproduce the trees.
• Nine net files, 296 additions/95 deletions; 413 of 420 base files byte-identical, seven changed plus two new, 422 candidate files. This is a product refactor, not test-only acceptance.
• BuildCompletion.cpp is correctly registered: the manifest matches all 80 non-main product translation units. The 79 native-test executable inventory stays unchanged. All three independently merged stdin/ordinary-CLI files remain byte-identical to main. Scheduler/compiler/link/cache/freshness implementations, generic process runner, benchmark and existing evidence workflows remain unchanged. VERSION remains5.5.0.

Product and test review

build() owns project, discovery, toolchain, coordinators and build runner. Its returned completion owns executable, argv, cwd and the established runtime-environment policy. Those C++ build locals are destroyed before Application creates a distinct foreground runner. Ordinary/PCH and named-module paths share the same completion runner; static/build-only successes request no foreground program. Original build error codes2/3/4/5 cannot launch an old executable. Foreground launch errors retain6, child exit codes remain intact, capture/output formatting is unchanged, and the timing session spans build, destruction and foreground execution.

The ASAN PATH operation is copied while the toolchain exists; the entire private toolchain environment is not applied to the foreground program. A stoppable process token on a foreground completion is explicitly rejected. No new Job or CLI cancellation is added. This value is not an executable identity pin, filesystem commit, project lease or proof of external-writer quiescence; existing replacement races and buffered-output policy are not silently claimed fixed.

The final one-file test correction keeps assertion messages outside redirected product stderr and emits them after restoring the streams. All24 checks remain; output resets can no longer erase a diagnostic or contaminate the product-output assertions. The independently prepared source package, published blob 0aad18b287394dc24511997b2373e22903831c55 and current diff agree. Previous positive/mutation GCC/shim results remain labeled local, not Windows evidence; this resumed turn reran source/patch and raw-artifact audits, not another native benchmark or a new product build.

Actual current-head execution

All 17 applicable workflow runs completed successfully, including:

Gate	Current run	Evidence
Native Debug	#745 /34477167280	Actual build, all four paired subshards, ambient/include/runtime/parameter/freshness/side-output checks and final gate
Native Release	#628 /34477167292	Stage0, all four paired subshards, completed self-host and exact runtime-only package validation; publish-release skipped
Independent performance	#613 /34477167246	Exact base/head checkouts, both Release builds, instrumentation check, original19x4ABBA and upload
Default/private ownership	#31 /34477167264; #33 /34477167316	70/70 and42/42 complete; required positive controls pass
True-MSVC batch/target cache	#9 /34477167252; #7 /34477167318	Six fixed cases in each, with original failures and cache boundaries preserved
Documentation/Cross-Stage	#189 /34477167475; #220 /34477167262	Passed

The other eight applicable inspection/reporting workflow statuses pass; this is not a claim that every ancillary raw artifact was independently downloaded. Untriggered old File Event/PDB Open studies are not presented as current reruns.

Actual log evidence, not merely green statuses: Debug job102874312722 and Release job102873420365 compile/link/run the24completion checks and ordinary CLI test. Cold and warm foreground both return37 with original stdout/stderr; the child retains stdin, Unicode/empty/quoted argv, cwd and environment checks. Injected compilation and link failures return4/5 with their original diagnostics and do not run the old artifact. The same jobs preserve all seven stdin controls: file/pipe comparisons, bootstrap failure17, and installed-vcvars observations showing29bytes retained under protection. Debug job102874312670 and Release job102873420366 retain actual module foreground exit37, both output streams and the warm no-recompile/no-relink condition. Release self-host/package job 102874170099 is completed, not pending.

Existing C4100/C4996/D9025 and tool deprecation warnings remain in the logs. Runner images vary across jobs (20260824.214.3 and20260907.229.1); identical historical host state is not claimed. No same-head CI/native/benchmark retry was requested.

Raw evidence replay and unsafe-policy outcomes

Ten current immutable core ZIPs were SHA256/CRC checked. Exact published target verifier and separate read-only ownership/batch/input auditors were executed again on their unmodified contents.

• Ownership records:150/150 expected outcomes,113accepted/37rejected, actual Windows CRLF collector hash matched. All14scheduler/direct pairs match56source files and70argv records after case-directory normalization.
• Default/private:717/411 original tool results and1434/822 corresponding diagnostic files read and inventoried. All required unmanaged/direct/scheduler controls pass. Three default and three private original adverse B failures remain, with C1090/C1051/C1001/C2471, including private /ZI B0 exit -1073741819. Link/run remain unattempted where the original compile failed; recovery0 never replaces that failure.
• All28A-started managed endings still kill the original shared service. B-resource identities appear only5/70 and2/42; absent observations are not complete-writer proof. The917/528 generated-binary inventories are post-case hashes, not incident-time bodies.
• Six batch cases retain18original results/36diagnostics; both failure-plus-cancel cases remain failed with original C2338/exit2 and successful siblings. Their sentinel is fixture-only.
• Six actual target cases retain48original results/96diagnostics,96raw cache copies and120artifact snapshots. Cold/warm controls, original failure precedence, stopped EXE/link-cache preservation and subsequent dirty freshness all reproduce. Two failures are explicitly injected static assertions, not historical C1041 reproduction. All32target record expectations also match; platform-specific temporary-path error text is retained separately rather than claimed byte-identical.

These controls protect the accepted cancellation/result boundaries but do not authorize shared-service termination, owner-death recovery or write-lease transfer.

Performance: accept current gate, do not erase the old crossing

Full19-row current/intermediate ABBA record was independently recomputed again.

Current artifact 10152300342,35,449bytes,SHA256 c436b69424bff27b16f9d7ec2df3a19c3fd4edde5967f700d1a40357e9f68d67: all76pairs, AB/BA/AB/BA order, stored arithmetic, paired median/MAD/maximum and marginal medians agree; all72instrumented complete counters/breakdowns/compile-link-archive hit/miss agree. Four external counter sets are unavailable,not zero. Current external no-op paired medians +0.1471ms/+1.5489917055% do not cross the unchanged BOTH>1ms AND>10% requirement.

Keep scale-j1,modules-no-op and timings-enabled-no-op4/4slower, scale-single-TU+40.122ms and cold+119.388ms tails. Intermediate #612/fe8 remains separate: median−0.3243ms/−3.3644%, but scale-auto/common-header tails+275.997ms/+290.868ms. The diagnostic-only source correction is not an explanation for the difference. No sample deletion, AA subtraction, offset against favorable scenarios, speedup or zero-overhead claim. Four-pairP95 is only a maximum; comparison JSON does not retain the actual benchmark binary pair or OS trace.

Historical raw #599 was recomputed and still crosses: +2.07175ms/+16.2700359633%. #601 and #182/#608 remain separate historical measurements. #181's completed fixed AA/AB investigation is additional evidence, not reconstruction of the missing #599 binary/OS state. The original runtime-pairing and cold-input failures likewise remain in history; #182 fixes input correctness, not performance.

Explicit acceptance and next boundary

Under the historical-risk policy declared before the updated-base measurement, accept ordinary expected-head merge of a3c5e67, subject to unchanged main and protection. All current mandatory gates pass. This changes the PR-level HOLD into a bounded development-integration acceptance of the product refactor. It does not declare #599 repaired, satisfy cumulative/release performance requirements, or waive a current failure. The build/run boundary is now suitable for subsequent ownership work, not a finished project transaction.

Next independent small topic: establish the physical project/artifact write-domain identity and explicit single-writer admission boundary under M1b, covering all discovery/toolchain/scan/compile/link/archive writes before enabling CLI leases. Begin with an opt-in boundary and real alias/contender/fail-closed cases. A released mutex, dead owner, cancellation error, timeout, C++ scope exit or empty service snapshot must not alone authorize takeover while residual writers are unproven. Keep foreground artifact execution outside the future build transaction; do not bundle daemon/session work or expand observers.

VERSION5.5.0, #172HOLD, historical C1041/cold-tail debt and M1b's unresolved ownership/recovery gates remain. No final VERSION/release or tag/asset mutation. Branch protection allows only normal merge and no bypass; no unresolved inline review threads were returned.

Delivery retains the ten current core ZIPs, four separate historical/intermediate ABBA ZIPs, complete canonical source archives, exact full/diagnostic patches and executed portable replay. It is not every Actions artifact or a full native-log archive; included log material is explicitly excerpts/inspection notes. Actions core-artifact retention is30days. Public network access from the container failed, so source bytes came from the mounted prior canonical archives and were verified against live Git identities. No local MSVC/PowerShell/ETW execution is claimed. Post-merge push CI and title-triggered skipped performance runs are not substituted for these completed exact-tree validations.