test: diagnose fixed cumulative cold builds with calibrated process lifetimes

[Iviesever]

One diagnostic topic, not a fix or a replacement release gate

Preregistered in #164 comment5654089373 before any new Windows measurement. Continue #189/#164 comment5653778216. The original main push Native C++ #760/run34761553204 attempt1 completed successfully; four actual Debug shard logs read, 79/79 programs executed. No retry. #188 and #172 remain original-head Draft/HOLD; do not cherry-pick or merge them, execute main's obsolete cumulative entry, or repeat #630/the original584-pair matrix/the warm study.

Exact base 752668650dfbf8e32a3a5d66d9d0808e10daf2ec, tree 4fc13a345866c6b162f13b0b8300e5a32f80d227.
Exact head 49770368ce1c7be1a757df392a2251b9e94c9cf5, tree 1544b00ac059caae79a4dc9c14d91f1dcca83fce.
One commit, four added files /878 additions, all original441 files unchanged. All four remote blobs and tree exactly match the locally portable-tested source. Product, C++ layout/manifest/native inventory, original Recorder/statistics, existing ETW recorder, other workflows, VERSION5.5.0 and tags/assets unchanged. This initial perf: title invokes the existing independent ABBA gate, not an optimization claim.

Question and immutable experimental objects

For common129 cold builds, does new elapsed variation coincide with cl.exe lifetimes, link.exe lifetimes, or their uncovered complement? small2 is a scale control. Process lifetime is not CPU time; uncovered time is not by itself MQB overhead, scheduler wait, physical disk time, or proof of an OS/antivirus cause. The old private warm flag, cold tails and C1041 are separate unresolved observations.

Reuse only the original actual A/B executables from cumulative run34756138330/artifact10317617795: archive SHA256 d70a0478c8b060e1da1b64e1361ec9ee69978277eed3d2c671149cff372c4530; A 46a3fc9fd4826b16f5130895438a82601d6531a29000982720f88cfc94fcc95f; B deab6c9dea5342f3a83ca79e2be3f51d483b03a8f045fbfa8411a8e6ad645c8c. No replacement rebuilds. These are rebuilt-v5.5-source versus frozen-product-candidate binaries, not the published release exe or #630's missing historical pair.

The unchanged pdb_file_event_probe.cpp is built once with original B on a separate build VM; its actual exe, build log, source archive and identity are retained and transferred to a new measurement VM. No MQB or recorder rebuild there. Reuse established TDH schema decoding, raw payload preservation, same-session event-backed readiness, 10-second refusal control, boundary success/sharing-conflict controls and loss/cap checks. No new Job ownership, tool wrapper, priority/affinity, service termination or cancellation policy.

Fixed experiment and accounting

small2/common129 × four Williams blocks × A-off/B-off/A-on/B-on = 32 cold scores (16ON/16OFF), auto parallelism, original same-path fixture and timings OFF. Four orders (0,1,3,2)/(1,2,0,3)/(2,3,1,0)/(3,0,2,1); the two fixture orders alternate across blocks. Each cell occupies every position once per fixture; all distinct within-block ordered predecessor pairs occur once. Cold means .mqb absent before launch, not cold OS pages or a cold PDB service. No OS cache flush or server killing.

4prime+4pre-audit, 32cold+32separate post-warm audits, then two distinctly labelled compiler failure/caller-repair/post-audit sequences (6 calls): 78 MQB calls, excluding the single build-VM recorder-compilation invocation. 34 built-program checks. No prime/audit/control is silently promoted to a scored sample. No sample deletion, observer/AA subtraction, adaptive budgets or new release threshold.

Before MQB work: one unchanged withheld-provider control must refuse child/sentinel admission; one traced Python calibration worker starts three actual children (including exit17 with both original output streams), whose retained identities must match ETW generations and parent lifetimes. 20 trace-entry invocations maximum = 16scoresON+2compiler-failureON+2entry controls. 18 MQB root-resource records. Failed calibration blocks scoring; do not patch/retry same head to replace its first evidence.

ON is the unchanged file Create/OperationEnd plus process/thread ETW, not lightweight process-only tracing. Its recorder is an extra ancestor. Both modes use the same Python worker and unchanged compare_reporting.Recorder for actual MQB launch/capture/wait. Primary elapsed is still that MQB interval. Recorder/worker startup, event readiness, closing/decoding, source checking, audits and program checks are outside it; outer entry elapsed is separately retained. ETW runtime and ON post-exit root queries are observer effects, not subtracted constants. OFF has no ETW launch or resource query. Root queries borrow the original CPython3.12.10 Popen handle.

Process correlation uses payload ProcessID + CreateTime and valid parent generations, not emitter PID or bare PID lookup. Root image and cl/link paths must match original binaries/selected tools. Overlapping cl lifetimes are unioned; root uncovered intervals and all individual tool intervals remain available. Missing/ambiguous/unclosed relevant processes or wrong counts block validity. Original decoder does not expose each tool exit code: fields remain unavailable, not zero. MQB exit/result and post-build program checks remain separate evidence. Processes outside the tool subset do not prove all-writer coverage or quiescence.

Acceptance gates declared before FIRST execution

1. Exact base/head/test-merge/tree and complete diff; original Windows Debug79/Release79 actual programs, self-host Stage0/1/2, runtime-only exact package/checksum/installer lifecycle and applicable documentation. Keep Draft until substantive review; missing/skipped work is not success.
2. Portable 14 new tests, including eight identity rejection mutations, ordering/budget, interval union, PID reuse/overlap/parent identity, missing stops/counts, volume/Unicode images, raw adverse summaries, real OFF worker no-query, original unexpected exit17/stdout/stderr preservation, no overwrite/attempt2, original four-field cold counts. Also run existing10 observer tests and existing ETW health/readiness self-tests. Locally all passed and original ZIP/A/B/helper hashes verified. Local Linux tests are NOT MSVC/ETW evidence. A prepublication cold-count dict omission of pch:0 was corrected before the first portable suite; no Windows failure or score was replaced.
3. Same-session readiness, both boundary controls, zero reported event/buffer/decode losses and no cap for each positive ON capture. Native wrapper PID+creation and each root identity/parent/lifetime matched; cold exact cl count2/129 and link count1, known image paths. All32 original cold report scopes, zero-exit built programs, complete warm cache/counters/breakdown vectors across versions and audits, and no warm metadata changes. Actual tracer/A/B/tool hashes and original source inputs remain stable. Retain all78 calls, raw streams, ETL/payload/schema/control/status records and partial failures. The two deliberate compiler failures must preserve exit4 and cold_trace_visible_failure, followed by caller repair and warm audit; they do not excuse unexpected failures.
4. Independent, unchanged per-PR original19×4ABBA compares base7526686 with this head4977036, not the archived A/B pair. Preserve76 pairs and all72 available complete cache/counter/breakdown/hit-miss vectors; external no-op blocker remains conjunction >+1ms AND >+10% paired medians. The old actual-ABBA-exe retention gap is not filled by diagnostic binaries. Keep every other adverse value and unavailable field.
5. Any unmet mandatory gate => Draft/HOLD, original first failure retained. No same-head rerun, ad-hoc samples, threshold changes or use of unrelated green evidence. A completed diagnostic may only narrow a future hypothesis; historical_cause_resolved/historical_risks_cleared/release_authorized stay false. This PR does not authorize a product repair without evidence.

First source archive/plan is saved before recorder build; measurement fixture inputs/source archives precede scoring. always() artifacts use run/attempt identities and90-day retention. No live PDB/IDB/build-state copying. Unexpected failure does not clear .mqb and retry. Root timeout remains the original Recorder's semantics; outer failure timeout does not certify descendant cleanup.

Unchanged boundaries

#188/#630, original private129 +3.4128ms/+6.8036063%, common129 +5.354s/+6.480s and other cold tails, #172/#176 C1041, #170/#180#599/#625/#627 adverse samples remain. No performance risk waived merely because new timing differs. No default CLI cancellation/write lock, full transactions, automatic recovery, sessions, residency, VERSION/release or historical tag/asset mutation. v5.6 publication remains HOLD; #164's v6.0 route remains intact.

[Iviesever]

实质验收决定：接纳 #190 的限定冷构建诊断工具；不认定产品修复，不解除 5.6.0 发布 HOLD

2026-09-14 接手已存在的 Draft #190，直接审查原始 attempt1 证据，没有新建竞争 PR、追加提交、重跑原研究或重传候选。预登记依据 #164 comment5654089373；该记录早于本 PR 及首次 Windows 测量。先重新确认 main 的 Native C++ #760/run34761553204 已 completed/success/attempt1。本次只重新读取其状态，不冒称再次读取 #760 的所有原始日志。

1. 精确验收对象和四文件范围

最终重新读取 main/base 752668650dfbf8e32a3a5d66d9d0808e10daf2ec；head 49770368ce1c7be1a757df392a2251b9e94c9cf5，tree 1544b00ac059caae79a4dc9c14d91f1dcca83fce。原 test-merge fe9a069b0802fca94352efb8945ce1e65d46fceb 的两个父提交精确等于上述 base/head，源码树相同。

已完整阅读新增的 workflow、diagnose_fixed_binary_cold.py、audit_cold_process_trace.py、test_fixed_binary_cold.py。只有一个提交、四个新增文件、878 additions/0 deletions；445 文件归档重新计算 Git tree 后与 head 一致，去掉四新增文件精确恢复原441文件/base tree 4fc13a345866c6b162f13b0b8300e5a32f80d227。Windows文本归档按已确认文本CRLF规范化，显式binary install.bat保持原始字节。产品、原 Recorder、原统计、原 ETW recorder、原生清单和 VERSION5.5.0 未改；#188 的两个累计入口文件未被移植。

2. 首次冷构建证据：预算、来源和完整性

Fixed Binary Cold Diagnosis #1/run34765281714：输入 artifact10320680860（SHA256 71ceb8b6c861f9e2b7ba36aea680b3909cf21b65380e0853bd584fe3c3419220）；测量 artifact10320014327（94,065,041 bytes/666成员，SHA256 85daa4dfdb6b342644fe42be555960bc0edb2fe28b924b020a6a8a3bf927270b）。两者均已下载，源码、实际工具、原始诊断和完整轨迹分别核验。

直接复用原累计 run34756138330/artifact10317617795 的两端 EXE：A 46a3fc9fd4826b16f5130895438a82601d6531a29000982720f88cfc94fcc95f，B deab6c9dea5342f3a83ca79e2be3f51d483b03a8f045fbfa8411a8e6ad645c8c；原 ZIP SHA256 d70a0478c8b060e1da1b64e1361ec9ee69978277eed3d2c671149cff372c4530。不是重新构建替换历史样本，更不是 #630 或本次独立 ABBA 的实际程序。A 是发布源码重建版本，不是历史发布资产 EXE。

现有 recorder 在另一构建 VM 编译，实际 EXE SHA256 705636206e05872f9783fcda72e9eabd85099ad3c7ddc0945ebc71d0967cfccb，传入新的测量 VM；原始构建 transcript/source/hash 已核查。测量 job103745174466 的完整原日志已读取；构建 job 的完整原日志未在本轮另外读取，不将其步骤状态说成完整日志复核。

固定 small2/common129 ×4 Williams区组×A-off/B-off/A-on/B-on：32 次冷评分，16 ON/16 OFF。加4prime、4pre-audit、32post-audit及两组故意编译失败→调用者修复→post-audit，合计 78次MQB调用、156份原始stdout/stderr、38次分离暖审计、34次生成程序检查。20次trace入口=16评分ON+2故障ON+2入口控制，18份MQB根资源记录；OFF资源保持不可用，不填零。

独立审计逐条核对所有调用参数、工作目录、源码输入身份、顺序、退出、原始报告与hash；20轨迹分成四个互不重复区间全部完成核查。正向捕获的同会话ready、前后文件成功/共享冲突控制、零报告event/buffer/decode loss、未到cap均满足；withheld-provider负控按预期拒绝子程序，而不是冒充一次成功捕获。三个Python校准子进程0/17/0和原始双诊断流、创建代际和父关系均可对应。

使用payload ProcessID/CreateTime及有效父代际核对，未用事件发出者PID或裸PID替代。对raw payload固定前缀与保存的TDH schema解码值交叉检查，并独立重算重叠区间并集。8个common129评分ON各有129个cl和1个link；8个small评分ON各2个cl和1个link。缺失工具exit_code保持null，未推定为零。所有 relevant 生命周期闭合、映像匹配；无以合计并行子进程时长充当总wall。

这是本地Linux只读复核已保存的ETL哈希、原decoder输出/raw payload/schema和关联结果，不是本地重新执行Windows TDH解码或MSVC。Windows运行时检查了暖状态元数据不变，但前后完整元数据快照未随产物归档，故本轮不能独立重算该断言，也不称逐字节/事务证明。38分离审计的完整cache/counters/breakdown均可核对，不能将其计时挪到评分样本。

3. 全部冷评分保留；观察时间不扣除

四对/格的配对中位差：small OFF +20.14875ms/+1.235237736%，small ON -139.36305ms/-7.059708680%；common129 OFF +5.7212ms/+0.130852551%，common129 ON +30.81215ms/+0.676312834%。common OFF四对原值 -21.3454/+32.7878/+389.509/-119.4478ms，ON为 +6.8497/-52.2824/+439.1446/+54.7746ms。所有有利和不利值保留，没有重新评分、删值、AA或observer扣除，也没有新发布阈值。

primary elapsed为Recorder中的MQB调用区间；ETW启动、关闭、解码等外层entry耗时单独保存。ON运行中追踪及退出后根资源查询影响仍在，不能从OFF或历史样本中扣掉一个估计常数。cold只代表此前.mqb不存在，不等于冷OS页缓存、共享服务静止或全写者域闭合。

common第3区组ON的不利配对 +439.1446ms，其root差+439.2046ms可分为cl区间并集差 -410.9916ms、link并集差 +356.8052ms、未被cl/link覆盖的区间差 +493.391ms。这只是该对时间区间分解；未覆盖部分包含其他阶段/进程，不能直接命名为MQB额外工作、调度等待或磁盘原因。

4. 必须单独保留的8秒故障控制：线索更具体，但不是历史根因结论

基线的非评分故意编译失败：MQB external 8138.5732ms，ETW根生命周期 8136.7288ms；其中唯一cl生命周期 8125.0709ms，剩余根区间 11.6579ms，link=0。保留原始 cold_trace_visible_failure 诊断和MQB exit4；修复为调用者另一次操作，未覆盖失败。

同序列候选故障控制 external46.3957ms、cl32.1711ms，全部保留。8秒样本发生在基线、观察ON的故障控制中，不是候选common129的评分退化；不能混入32评分或旧584对矩阵。 现在可定位该样本的大部分wall落在cl进程存活期，而非仅有MQB外部计时。

对于该cl，已配对记录的FileCreate/OperationEnd最长仅0.1305ms，没有一条这样的已捕获Create操作单独覆盖8秒。但本次追踪没有CPU栈/上下文切换与完整I/O，因此不能证明cl一直计算、一直等待，不能排除未观察的I/O、调度或服务依赖，更不能直接归因杀软。工具生命周期不是CPU时间，根CPU不能代替cl CPU。旧common129秒级尾部、private暖退化和C1041都没有因此被解决。

5. 原生、自举、包和文档门槛

Native C++ #761/run34765281654：完整读取Debug四配对job 103746350695/103746350681/103746350685/103746350678；Native Release #637/run34765281655：完整读取Release四配对job 103746190818/103746190830/103746190801/103746190840。每配置八子片8/9/9/9/10/12/11/11，各79/79独立程序实际执行。原prewrite44/recipe28/target84/batch50/domain39/map33/foreground边界及C2338、LNK2019/LNK1120、stdin正反对照保留。Release宿主不自动代表每个内嵌目标也以Release构建。两prepare本轮只核对步骤状态，未冒称读过其完整原日志。

Self-host/package job103746541148完整日志已读：固定历史seed→Stage0→Stage1→清空状态→Stage2，后两代各83TU真实重建；安装/重装/卸载/PATH通过。实际包 artifact10320258072已下载并另行审计：外ZIP f820384be71e30e102a98d0d49fe46c5b507212a3cf9a07cdfbb2175a14e109a，内ZIP/sidecar fd3a898cf843b4a853c9c93d688c723e1616cf357c8662f3a24b667b354ded0a；扁平七文件、VERSION5.5.0、AMD64PE、包内EXE字节hash等于Stage1 8ccf25a0ccb72f0b03cedd99a8d99f4b235320afad45f5dd0319d76aabc23b95。Stage2原日志hash e73434d2d258bbd3200febd803f0dd60ca908ff7b777fd07a4d26bc16c59a4bf，未单独下载；不同hash不称字节可复现。

Documentation #201/run34765281682/job103745037801完整原日志确认19对维护文档通过。publish-release明确skipped，不计为发布成功。

6. 独立ABBA #634接近门槛；其他显著不利值继续发布风险记账

Performance #634/run34765281715/job103745037727：完整原日志核对同一固定v5.0.0-rc.2 seed、精确base752/head497、两端Release各83TU真实重建、原instrumentation检查和AB/BA/AB/BA。artifact10320187538 SHA256 b5cde8b1557c230f16b4d4c962b64f7c6c762a37db9a2c5812c26cbdbbe0a41b已下载独立重算。76对齐全，72组可用cache/counters/breakdown/hit-miss全向量一致；4对外部计时内部指标保持不可用。

external no-op四对全部更慢：+1.9599/+1.4662/+0.9585/+0.3737ms。未舍入配对中位 +1.21235ms/+9.8760361423%。按事先声明的 AND 规则，时间项超过1ms、百分比项未超过10%，故原强制阻塞条件不成立；不把9.876%四舍五入成10%后裁定，更不把“没跨门槛”写成没有变慢。前两对各自超过1ms和10%仍完整保留。

其余18场景并不共用上述外部门槛。必须保留的新不利数据：link-only中位+164.53ms/+300.171368026%，最差+471.31ms；public-header中位+47.821ms/+38.405702023%，最差+95.648ms；single-tu中位+33.3795ms/+31.891862015%，最差+90.518ms；modules-cold最差+1069.184ms；cold中位+125.7645ms。全部原始数据保留，没有噪声归因、删除或重跑。它们作为新的待处置发布风险进入#164，不因本PR只加工具而清账。

原独立ABBA仍未归档实际两端EXE/hash，不拿冷诊断原程序或当前包补称其历史程序。#634只支持本PR按原集成门槛接纳；不是累计候选性能通过、零开销、历史失败豁免或发布许可。

7. 决定、透明审计和下一接手点

所有预声明且可复核的必需运行已完成，已明确区分运行时断言与未归档状态快照限制。接纳这四个诊断工具文件，保留产品和历史发布HOLD。 本review是提交者账号下的实质COMMENT，不冒充另一名独立审查者APPROVE。

本地只读审计自身三次初始假设错误（Windows路径到ZIP路径、TDH schema仅在首次出现、工具路径分隔符）及失败代码/日志全部保留；随后只修正离线审计器，四个不重叠轨迹批次通过，原head/ZIP/Windows数据不变。14个cold和10个observer portable测试也完成，不冒称本地MSVC执行。交付执行台账明确是原日志转录，不冒充原始完整日志归档。

实质验收落地后拟将标题perf:改test:再转Ready，避免对同head重复采集；原#634已经完整执行，后续metadata触发的skip不能替代它。只按expected_head_sha正常合并；实际merge父提交/源码树/VERSION和新的main pushCI另行核对。

下一主题限定为cl/link异常长驻留的计算/等待归因，优先已有8.125秒cl故障控制与common第3区组，先利用已保存事件，只有现有证据确实不足时才另预登记固定预算、带观察OFF对照的CPU/等待级采集；不再重复整个冷热矩阵求绿，不无依据修改调度器。得到具体产品原因后再拆小修复或回退验证。

#188原head/Draft/HOLD、#630原失败、private129原+3.4128ms/+6.8036063%、common129历史+5.354s/+6.480s及其他冷尾、#172/#176 C1041、#170/#180#599/#625/#627等全部保留。VERSION继续5.5.0，6.0长期路线保留；不启用默认取消/写锁，不扩张事务/恢复/会话/驻留，不改历史tag/资产，不发布。