reuse verified native platform version without duplicate query

.gitea/workflows/pr-push-build-and-test.yaml

@@ -3,6 +3,10 @@ name: PR and Push Build/Test
 on:
   pull_request:
   push:
+    # This temporary branch changes only the native prerequisite diagnostic.
+    # Its manual workflow provides that evidence; the PR branch still runs all jobs.
+    branches-ignore:
+      - codex/macos-ci-kvm-compatibility
   workflow_dispatch:
 
 jobs:

docs/macos-native-diagnostic.md

@@ -57,7 +57,15 @@ No new force/beta argument is needed for actual no-AVX2 CPUs. Baseline arguments
 
 The Apple wrapper is byte-identical to baseline: background `/Volumes/installstate/readiness.sh` then `exec /usr/libexec/recoveryosd` under the same launchd job/PID. Source evidence does not prove Apple's executable ran.
 
-Readiness changes only minimum macOS 14 to 13. Validation normalizes that gate to 14 and requires baseline SHA256 `4d428f594dac14eff64ed87b172c81ecf85ac91da8c5460cd6ec4b1d310800c3`. Architecture, UID, services, disk size/writability/uniqueness, retries, proof bounds, timers and native-wait/cleanup/flush metrics remain identical. Limits stay 45 seconds per native command, 180 seconds for UID, ten minutes disk readiness, 40 minutes host and 45 minutes workflow.
+The disk IPC continuation contains seven explicitly marked diagnostic blocks and limits disk enumeration to one attempt. Its disk query receives 120 seconds so the owned sample can finish while the query is still running. Validation removes only those marked blocks, including that command-budget exception, restores the former attempt condition and normalizes macOS 13 to 14 before requiring baseline SHA256 `4d428f594dac14eff64ed87b172c81ecf85ac91da8c5460cd6ec4b1d310800c3`. Two separate named version marker pairs exclude the new parser and explicitly restore the original three-line `sw_vers -productVersion` sequence for this baseline comparison. The receipt records this version-source exception, the 1,024-byte parser bound and all existing diagnostic budget exceptions. Architecture, UID, native service exits, minimum macOS version, disk size/writability/uniqueness, proof bounds and native-wait/cleanup/flush metrics remain identical. All other required native commands retain 45 seconds, UID retains 180 seconds, and outer limits remain ten minutes maximum disk readiness, 40 minutes host and 45 minutes workflow.
+
+Run 4186 at `227884723a25e703ec1be39f8600eeaae2085c4f` completed native `sw_vers` successfully after 43 seconds, reporting macOS 13.6 / 22G120. The redundant `sw_vers -productVersion` then timed out after 48 seconds before any disk query. The continuation extracts exactly one `ProductVersion` field from the entire already-successful `platform` or `platform-warm` output. It requires EOF within 1,024 bytes, rejects NUL delimiters, duplicate/missing fields and malformed version suffixes, and accepts only two or three numeric version components separated by dots with native tab/space padding. The existing macOS 13 minimum remains mandatory; no native timeout is relaxed by this reuse.
+
+Run 4175 at `94a70b200508d3ba295124896d923fbb785d1658` reached macOS 13.6, x86_64 and UID 0 with KVM enabled; its nine `diskutil list physical` attempts timed out. Run 4185 at `25989cf0eb7205f30ac0bb44eb279aa3b463f12c` proved the whole writable 64-GiB target as IOMedia `disk2`; it measured approximately 14 seconds for the final native process listing and 33 seconds for IOMedia. Both Apple disk jobs were running; DiskManagement's endpoint was still inactive. The former eight-second observer allowance was shorter than observed native startup, so its killed sample did not establish an IPC wait point. A missing target is ruled out for that run; service initialization, IPC or resource delays remain unresolved.
+
+Before the only disk attempt the continuation records bounded `launchctl print` output for `com.apple.diskarbitrationd` and `com.apple.diskmanagementd`, plus `ioreg -r -c IOMedia -l -w 0`. Its observer starts only `/usr/bin/sample <owned-diskutil-child-pid> 3 100 -file <owned-output>`, with no preceding process list or additional service query. Three seconds at a 100-millisecond interval reduces sampling overhead. The sample has 60 seconds for startup/reporting plus the existing two-second TERM/KILL grace; its separate report is flushed into the proof alongside command output. Missing sample tooling or an already completed diskutil is reported explicitly; nonzero observation exits are logged and cannot satisfy any native gate.
+
+The observer owns its command/timer PIDs and is stopped when the disk query completes or the probe is canceled. Its output enters the existing 512-KiB per-output and 4-MiB proof budgets. The hook only reads media/service/process state and writes its existing diagnostic files: it does not load, restart, erase or modify any service or disk. Bash remains necessary because Apple Recovery runs this hook before a .NET SDK is installed. The CPU, Recovery, QEMU, Apple wrapper and container profile are unchanged. These observations are prepared diagnostics, not a new successful guest or full native CI receipt.
 
 Container profile: `KVM=Y`, `CPU_MODEL=host`, `VERSION=13`, 4-GiB guest, two guest/host CPUs, 6-GiB memory/swap and 512-MiB shared memory. Fresh anonymous `/storage` holds the 64-GiB disk; evidence reads `/storage/13/setup.dmg`. Existing resource budget checks remain.
 
@@ -65,4 +73,6 @@ Only device mapping: exactly `/dev/kvm:/dev/kvm:rw`. Inspection rejects other de
 
 Evidence retains run/profile identity, source/assets, EFI staging, container/resources, macOS 13 Recovery hash, native proof/result/outcome and cleanup. `[recovery-original]` logs the exact download's size/SHA256 before modifying it, including when patch failure later deletes the source. `guest-container-resources.last-success.stdout.log` and its timestamp/hash receipt preserve the last successful resource snapshot independently of a later failed stopped-container `docker exec`. Optional final Unix HMP capture includes `info kvm`, `info status` and a bounded PPM exported from `/tmp`; capture success passes no native gate.
 
+Optional 20-second resource snapshots before, during and after the guest probe retain cgroup CPU usage/throttling/pressure, memory events/pressure/statistics and host page-fault/swap counters. These observations test resource contention as a hypothesis; no resource failure is established by the existing guest timing alone. The large Recovery image hash is captured once after compatibility-profile staging is observed, with its successful receipt retained, instead of repeatedly hashing the image while collecting guest progress. Snapshot or hash observation failure cannot satisfy a native readiness gate.
+
 Both cleanup paths keep exact token/label/ID checks. `docker rm --force --volumes` removes only the owned container and anonymous volume, then its exact image; no unrelated objects or pruning. Evidence stays seven days. Full native CI still needs a subsequent actual installed remote guest to build/sign helpers and pass the full suite, including five native tests without skips.

tools/ci/MacOsNativeDiagnostic.cs

@@ -69,7 +69,7 @@ static class NativeDiagnostic
                 await PrepareSource(Path.GetFullPath(source), output, "validation", false, Option(args, "--cryptex-archive"), CancellationToken.None);
                 await ValidateResourceRetention(output);
                 await ValidateRecoveryPatch(output);
-                Save(Path.Combine(output, "validation.json"), new { success = true, profile = "kvm-host-ventura-cryptex", helperSha256 = Hash(File.ReadAllBytes(Path.Combine("tools", "ci", "MacOsNativeDiagnostic.cs"))), udifChecksumBindingSha256 = Hash(File.ReadAllBytes(Path.Combine("tools", "ci", "macos-native-udif-checksums.py"))), baselineReadinessNormalized = true, resultNegativeCases = 6, containerNegativeCases = 11, recoveryPositiveCases = 4, recoveryNegativeCases = 12, independentFixtureCrc32Readback = true, resourceSnapshotRetention = true, cryptexArchiveVerified = true, configurationAndStagingContractsVerified = true, templateIsoDownloaded = false, activeLiluRuntimeChecked = false, sourceModified = false, dockerExecuted = false, guestExecuted = false, completedUtc = DateTimeOffset.UtcNow });
+                Save(Path.Combine(output, "validation.json"), new { success = true, profile = "kvm-host-ventura-cryptex", helperSha256 = Hash(File.ReadAllBytes(Path.Combine("tools", "ci", "MacOsNativeDiagnostic.cs"))), udifChecksumBindingSha256 = Hash(File.ReadAllBytes(Path.Combine("tools", "ci", "macos-native-udif-checksums.py"))), baselineReadinessNormalized = true, readinessDiagnosticBlocksExcluded = 7, productVersionParserBlockExcluded = true, productVersionSequenceRestored = true, productVersionMaximumBytes = 1024, nativeProductVersionCommandRemoved = true, diskReadinessAttemptLimit = 1, diskCommandLimitSeconds = 120, diskSampleLimitSeconds = 60, diskSampleDurationSeconds = 3, diskSampleIntervalMilliseconds = 100, resultNegativeCases = 6, containerNegativeCases = 11, recoveryPositiveCases = 4, recoveryNegativeCases = 12, independentFixtureCrc32Readback = true, resourceSnapshotRetention = true, cryptexArchiveVerified = true, configurationAndStagingContractsVerified = true, templateIsoDownloaded = false, activeLiluRuntimeChecked = false, sourceModified = false, dockerExecuted = false, guestExecuted = false, completedUtc = DateTimeOffset.UtcNow });
             }
             Console.WriteLine("Source patch contracts and diagnostic result validation passed; no Docker or guest execution occurred.");
             return 0;
@@ -131,13 +131,21 @@ static class NativeDiagnostic
             await Command("docker", ["inspect", id], output, "container-created", deadline.Token);
             AssertContainer(File.ReadAllText(Path.Combine(output, "container-created.stdout.log")), token);
             await Command("docker", ["start", id], output, "docker-start", deadline.Token);
+            await CapturePressure(id, output, "before", deadline.Token);
             Console.WriteLine("The owned restricted KVM/host-CPU macOS 13 compatibility guest is starting. Success requires native macOS 13+/x86_64 and a writable 64-GiB disk; no installer will run. This is not a single-variable causal test.");
             var recoveryStarted = Stopwatch.StartNew();
             var heartbeat = Stopwatch.StartNew();
+            var diskPressureCaptured = false;
             while (true)
             {
                 deadline.Token.ThrowIfCancellationRequested();
                 await CaptureGuest(id, output, deadline.Token);
+                var proofPath = Path.Combine(output, "guest-proof.log");
+                if (!diskPressureCaptured && File.Exists(proofPath) && File.ReadAllText(proofPath).Contains("[proof-start] disks", StringComparison.Ordinal))
+                {
+                    diskPressureCaptured = true;
+                    await CapturePressure(id, output, "during", deadline.Token);
+                }
                 var resultPath = Path.Combine(output, "guest-result.json");
                 if (File.Exists(resultPath))
                 {
@@ -167,6 +175,7 @@ static class NativeDiagnostic
             Console.CancelKeyPress -= cancelHandler;
             using var captureDeadline = new CancellationTokenSource(TimeSpan.FromSeconds(45));
             try { await CaptureGuest(state.ContainerId ?? state.ContainerName, output, captureDeadline.Token, true, state.Token); } catch (Exception exception) { Console.Error.WriteLine("Final evidence capture: " + exception.Message); }
+            await CapturePressure(state.ContainerId ?? state.ContainerName, output, "after", captureDeadline.Token);
             try { PrintGuestProof(output, state.Token); } catch (Exception exception) { Console.Error.WriteLine("Native proof output: " + exception.Message); }
             var clean = await Cleanup(output);
             if (!clean) { outcome = "failed"; error = (error ?? "") + " Owned-resource cleanup failed; inspect cleanup evidence."; }
@@ -184,9 +193,11 @@ static class NativeDiagnostic
     static void ValidateContracts()
     {
         var readiness = File.ReadAllText(Path.Combine("tools", "ci", "macos-native-readiness.sh"));
-        var baseline = ReplaceOnce(readiness, "(( ${os_version%%.*} >= 13 ))", "(( ${os_version%%.*} >= 14 ))");
+        var baseline = NormalizeReadinessDiagnostics(readiness);
+        baseline = ReplaceOnce(baseline, "(( ${os_version%%.*} >= 13 ))", "(( ${os_version%%.*} >= 14 ))");
+        baseline = ReplaceOnce(baseline, "while (( attempt < 1 && SECONDS - readiness_start < 600 )); do", "while (( SECONDS - readiness_start < 600 )); do");
         if (Hash(Encoding.UTF8.GetBytes(baseline)) != "4d428f594dac14eff64ed87b172c81ecf85ac91da8c5460cd6ec4b1d310800c3")
-            throw new InvalidOperationException("Compatibility readiness may change only the baseline's macOS minimum to 13; identity, services, disk and limits must remain identical.");
+            throw new InvalidOperationException("Outside seven explicit diagnostic blocks, the successful sw_vers version parser/sequence, the macOS minimum and one-attempt limit, baseline identity/service/disk gates and watchdogs must remain identical.");
         if (Hash(File.ReadAllBytes(Path.Combine("tools", "ci", "macos-native-bootstrap.sh"))) != "94f069e116fdc7685a4d233cab6fa50df9f39274386bb82157674061e74fadb5")
             throw new InvalidOperationException("Compatibility profile must preserve the baseline Apple recoveryosd wrapper.");
         if (Hash(Encoding.UTF8.GetBytes(OriginalDaemon13)) != "af9d7f6c1948079bd4384d27b6882678d6fb4e338fcf6a8be8f84fceef174ad6") throw new InvalidOperationException("macOS 13 allowlist bytes differ from the independently read comparison plist.");
@@ -214,6 +225,38 @@ static class NativeDiagnostic
         }
     }
 
+    static string NormalizeReadinessDiagnostics(string source)
+    {
+        const string start = "# BEGIN disk IPC diagnostic\n";
+        const string end = "# END disk IPC diagnostic\n";
+        var blocks = 0;
+        while (source.IndexOf(start, StringComparison.Ordinal) is var from && from >= 0)
+        {
+            var to = source.IndexOf(end, from + start.Length, StringComparison.Ordinal);
+            if (to < 0 || source.IndexOf(start, from + start.Length, to - from - start.Length, StringComparison.Ordinal) >= 0)
+                throw new InvalidOperationException("Readiness diagnostic blocks are unbalanced or nested.");
+            source = source.Remove(from, to + end.Length - from);
+            blocks++;
+        }
+        if (blocks != 7 || source.Contains(end, StringComparison.Ordinal))
+            throw new InvalidOperationException("Readiness must contain exactly seven explicit disk IPC diagnostic blocks.");
+        source = RestoreVersionBlock(source, "successful sw_vers version parser", "");
+        source = RestoreVersionBlock(source, "successful sw_vers version extraction", "run_command version /usr/bin/sw_vers -productVersion\n(( LAST_EXIT == 0 )) || fail_probe product_version_failed\nread_scalar || fail_probe product_version_invalid\n");
+        return source;
+    }
+
+    static string RestoreVersionBlock(string source, string name, string originalSequence)
+    {
+        var start = "# BEGIN " + name + "\n";
+        var end = "# END " + name + "\n";
+        if (source.Split(start, StringSplitOptions.None).Length != 2 || source.Split(end, StringSplitOptions.None).Length != 2)
+            throw new InvalidOperationException("Readiness requires exactly one named version marker pair: " + name);
+        var from = source.IndexOf(start, StringComparison.Ordinal);
+        var to = source.IndexOf(end, StringComparison.Ordinal);
+        if (to < from + start.Length) throw new InvalidOperationException("Readiness version markers are reversed: " + name);
+        return source.Remove(from, to + end.Length - from).Insert(from, originalSequence);
+    }
+
     static async Task PrepareSource(string source, string output, string token, bool writeSource, string? cryptexArchive, CancellationToken cancellation)
     {
         Directory.CreateDirectory(output);
@@ -457,7 +500,40 @@ static class NativeDiagnostic
             var result = await Command("docker", ["exec", id, "cat", "/dev/shm/installstate/" + file.Item1], output, "capture-" + file.Item1, cancellation, requireSuccess: false);
             if (result.ExitCode == 0 && !string.IsNullOrWhiteSpace(result.Output)) File.WriteAllText(Path.Combine(output, file.Item2), result.Output);
         }
-        await Command("docker", ["exec", id, "sh", "-c", "printf '[qemu]\n'; qemu-system-x86_64 --version | head -n 1; printf '[Recovery hash]\n'; test ! -f /storage/13/setup.dmg || sha256sum /storage/13/setup.dmg; printf '[resources]\n'; df -Pk /storage; cat /sys/fs/cgroup/memory.max /sys/fs/cgroup/cpu.max 2>/dev/null || true"], output, "guest-container-resources", cancellation, requireSuccess: false, retainSuccessful: true);
+        // The immutable Recovery image is complete only after this staging marker.
+        // Hash it once instead of rereading 710 MB on every twenty-second poll.
+        if (logs.Output.Contains("[compatibility-profile] accelerator=kvm", StringComparison.Ordinal)
+            && !File.Exists(Path.Combine(output, "guest-container-resources.last-success.json")))
+            await Command("docker", ["exec", id, "sh", "-c", "printf '[qemu]\n'; qemu-system-x86_64 --version | head -n 1; printf '[Recovery hash]\n'; test -f /storage/13/setup.dmg && sha256sum /storage/13/setup.dmg || exit 1; printf '[resources]\n'; df -Pk /storage; cat /sys/fs/cgroup/memory.max /sys/fs/cgroup/cpu.max 2>/dev/null || true"], output, "guest-container-resources", cancellation, requireSuccess: false, retainSuccessful: true);
+    }
+
+    static async Task CapturePressure(string id, string output, string phase, CancellationToken cancellation)
+    {
+        using var snapshotDeadline = CancellationTokenSource.CreateLinkedTokenSource(cancellation);
+        snapshotDeadline.CancelAfter(TimeSpan.FromSeconds(20));
+        const string snapshot = """
+            printf '[snapshot UTC]\n'; date -u '+%Y-%m-%dT%H:%M:%SZ'
+            for path in /proc/meminfo /proc/pressure/cpu /proc/pressure/memory /proc/pressure/io \
+                /sys/fs/cgroup/cpu.max /sys/fs/cgroup/cpu.stat /sys/fs/cgroup/cpu.pressure \
+                /sys/fs/cgroup/memory.max /sys/fs/cgroup/memory.current /sys/fs/cgroup/memory.peak \
+                /sys/fs/cgroup/memory.events /sys/fs/cgroup/memory.stat /sys/fs/cgroup/memory.pressure \
+                /sys/fs/cgroup/memory.swap.current; do
+                printf '\n[%s]\n' "$path"
+                if [ -r "$path" ]; then cat "$path"; else printf 'unavailable\n'; fi
+            done
+            printf '\n[host paging counters]\n'
+            awk '/^(pgmajfault|pswpin|pswpout) / {print}' /proc/vmstat
+            """;
+        try
+        {
+            await Command("docker", ["exec", id, "sh", "-c", snapshot], output, "capture-pressure-" + phase, snapshotDeadline.Token, requireSuccess: false, retainSuccessful: true);
+        }
+        catch (Exception exception)
+        {
+            // Optional evidence must not replace the guest outcome or prevent cleanup.
+            try { Save(Path.Combine(output, "capture-pressure-" + phase + ".unavailable.json"), new { phase, error = exception.Message, capturedUtc = DateTimeOffset.UtcNow }); }
+            catch (Exception evidenceError) { Console.Error.WriteLine("Optional pressure evidence: " + evidenceError.Message); }
+        }
     }
 
     static async Task CaptureMonitor(string id, string output, string token, CancellationToken cancellation)

tools/ci/macos-native-readiness.sh

@@ -14,6 +14,9 @@ TIMER_FIFO="/tmp/native-diagnostic-$PROOF_TOKEN-$$.fifo"
 PENDING_OUTPUTS=()
 ACTIVE_COMMAND=""
 ACTIVE_TIMER=""
+# BEGIN disk IPC diagnostic
+ACTIVE_OBSERVER=""
+# END disk IPC diagnostic
 os_version=""
 architecture=""
 uid=-1
@@ -96,8 +99,92 @@ read_scalar() {
   SCALAR="$value"
 }
 
+# BEGIN successful sw_vers version parser
+read_product_version() {
+  local value status line version="" fields=0
+  # Read the entire successful native output. EOF is mandatory; a NUL delimiter
+  # or reaching the 1025-byte sentinel must never hide a suffix.
+  LC_ALL=C IFS= read -r -n 1025 -d '' value < "$LAST_OUTPUT"; status=$?
+  (( status == 1 && ${#value} <= 1024 )) || return 1
+  while IFS= read -r line || [ -n "$line" ]; do
+    if [[ "$line" =~ ^[[:blank:]]*ProductVersion: ]]; then
+      fields=$((fields + 1))
+      (( fields == 1 )) || return 1
+      [[ "$line" =~ ^[[:blank:]]*ProductVersion:[[:blank:]]*([0-9]+\.[0-9]+(\.[0-9]+)?)[[:blank:]]*$ ]] || return 1
+      version="${BASH_REMATCH[1]}"
+    fi
+  done <<< "$value"
+  (( fields == 1 )) || return 1
+  SCALAR="$version"
+}
+
+# END successful sw_vers version parser
+# BEGIN disk IPC diagnostic
+# Optional observations have their own child/timer ownership. No service is
+# loaded, restarted or changed, and samples target only this probe's diskutil.
+observe_disk_query() {
+  local disk_process="$1" output="$2" sample_output="$3" observation_child="" observation_timer=""
+  cancel_observation() {
+    trap '' TERM INT
+    if [ -n "$observation_child" ]; then
+      kill -TERM "$observation_child" 2>/dev/null || :
+      IFS= read -r -t 2 -u 9 unused || :
+      kill -KILL "$observation_child" 2>/dev/null || :
+      wait "$observation_child" 2>/dev/null || :
+    fi
+    [ -z "$observation_timer" ] || { kill -TERM "$observation_timer" 2>/dev/null || :; wait "$observation_timer" 2>/dev/null || :; }
+    printf '[disk-observation] stopped after the owned disk query\n' >> "$output"
+    exit 143
+  }
+  observe_command() {
+    local name="$1" status started=$SECONDS
+    shift
+    printf '\n[disk-observation-command] %s:' "$name" >> "$output"
+    printf ' %s' "$@" >> "$output"
+    printf '\n' >> "$output"
+    "$@" >> "$output" 2>&1 &
+    observation_child=$!
+    (
+      trap 'exit 0' TERM INT
+      IFS= read -r -t 60 -u 9 unused || :
+      printf '[disk-observation-timeout] %s child=%s limit=60s\n' "$name" "$observation_child" >> "$output"
+      kill -TERM "$observation_child" 2>/dev/null || :
+      IFS= read -r -t 2 -u 9 unused || :
+      kill -KILL "$observation_child" 2>/dev/null || :
+    ) &
+    observation_timer=$!
+    wait "$observation_child"; status=$?
+    kill -TERM "$observation_timer" 2>/dev/null || :
+    wait "$observation_timer" 2>/dev/null || :
+    printf '[disk-observation-exit] %s status=%s elapsed=%ss\n' "$name" "$status" "$((SECONDS - started))" >> "$output"
+    observation_child=""; observation_timer=""
+  }
+  trap cancel_observation TERM INT
+  printf '[disk-observation] owned-diskutil-child=%s parent-shell=%s\n' "$disk_process" "$$" >> "$output"
+  if [ -x /usr/bin/sample ]; then
+    if kill -0 "$disk_process" 2>/dev/null; then
+      observe_command diskutil-sample /usr/bin/sample "$disk_process" 3 100 -file "$sample_output"
+    else
+      printf '[disk-observation-unavailable] diskutil already exited before sample\n' >> "$output"
+    fi
+  else
+    printf '[disk-observation-unavailable] /usr/bin/sample is unavailable\n' >> "$output"
+  fi
+}
+
+stop_disk_observation() {
+  [ -n "$ACTIVE_OBSERVER" ] || return 0
+  kill -TERM "$ACTIVE_OBSERVER" 2>/dev/null || :
+  wait "$ACTIVE_OBSERVER" 2>/dev/null || :
+  ACTIVE_OBSERVER=""
+}
+
+# END disk IPC diagnostic
 cancel_probe() {
   trap '' TERM INT
+# BEGIN disk IPC diagnostic
+  stop_disk_observation
+# END disk IPC diagnostic
   if [ -n "$ACTIVE_COMMAND" ]; then
     kill -TERM "$ACTIVE_COMMAND" 2>/dev/null || :
     IFS= read -r -t 2 -u 9 unused || :
@@ -116,6 +203,9 @@ run_command() {
   # Run 4161: even native uname/ps startup took 34-42s under TCG.
   # Isolate only the failed UID gate; every other watchdog remains unchanged.
   [[ "$name" != uid ]] || command_limit=180
+# BEGIN disk IPC diagnostic
+  if [[ "$name" == disks && "${attempt:-0}" == 1 ]]; then command_limit=120; fi
+# END disk IPC diagnostic
   LAST_OUTPUT="/tmp/native-diagnostic-$name.out"
   printf '\n[proof-command] %s:' "$name" >&3
   printf ' %s' "$@" >&3
@@ -136,6 +226,18 @@ run_command() {
   ) &
   timer=$!
   ACTIVE_TIMER="$timer"
+# BEGIN disk IPC diagnostic
+  if [[ "$name" == disks && "$attempt" == 1 ]]; then
+    local observation_output="/tmp/native-diagnostic-disk-observation.out"
+    local sample_output="/tmp/native-diagnostic-disk-sample.out"
+    : > "$observation_output"
+    : > "$sample_output"
+    observe_disk_query "$process" "$observation_output" "$sample_output" &
+    ACTIVE_OBSERVER=$!
+    printf '[disk-observation-start] observer=%s owned-diskutil-child=%s\n' "$ACTIVE_OBSERVER" "$process" >&3
+    PENDING_OUTPUTS+=("$observation_output" "$sample_output")
+  fi
+# END disk IPC diagnostic
   wait "$process"
   exit_code=$?
   waited=$SECONDS
@@ -143,6 +245,9 @@ run_command() {
   printf '[proof-native-wait] %s child=%s elapsed=%ss exit=%s\n' "$name" "$process" "$((waited - started))" "$exit_code" >&3
   kill -TERM "$timer" 2>/dev/null || :
   wait "$timer" 2>/dev/null || :
+# BEGIN disk IPC diagnostic
+  stop_disk_observation
+# END disk IPC diagnostic
   ACTIVE_COMMAND=""; ACTIVE_TIMER=""
   printf '[proof-cleanup] %s child=%s elapsed=%ss total=%ss\n' "$name" "$process" "$((SECONDS - waited))" "$((SECONDS - started))" >&3
   printf '[proof-exit] %s\n' "$exit_code" >&3
@@ -195,18 +300,25 @@ if (( platform_exit != 0 )); then
   platform_exit="$LAST_EXIT"
 fi
 (( platform_exit == 0 )) || fail_probe sw_vers_failed
-run_command version /usr/bin/sw_vers -productVersion
-(( LAST_EXIT == 0 )) || fail_probe product_version_failed
-read_scalar || fail_probe product_version_invalid
+# BEGIN successful sw_vers version extraction
+read_product_version || fail_probe product_version_invalid
+# END successful sw_vers version extraction
 os_version="$SCALAR"
 [[ "$os_version" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]] || fail_probe product_version_invalid
 (( ${os_version%%.*} >= 13 )) || fail_probe unsupported_macos_version
 flush_outputs || finish false diagnostic_log_budget_exceeded
 
+# BEGIN disk IPC diagnostic
+run_command arbitration_before /bin/launchctl print system/com.apple.diskarbitrationd
+run_command management_before /bin/launchctl print system/com.apple.diskmanagementd
+run_command media_before /usr/sbin/ioreg -r -c IOMedia -l -w 0
+flush_outputs || finish false diagnostic_log_budget_exceeded
+
+# END disk IPC diagnostic
 # Bound readiness independently of the host's 40-minute overall deadline.
 readiness_start=$SECONDS
 attempt=0
-while (( SECONDS - readiness_start < 600 )); do
+while (( attempt < 1 && SECONDS - readiness_start < 600 )); do
   attempt=$((attempt + 1))
   printf '\n[readiness-attempt] %s\n' "$attempt" >&3
   run_command disks /usr/sbin/diskutil list physical