reuse verified native platform version without duplicate query

.gitea/workflows/pr-push-build-and-test.yaml

@@ -3,6 +3,10 @@ name: PR and Push Build/Test
 on:
   pull_request:
   push:
+    # This temporary branch changes only the native prerequisite diagnostic.
+    # Its manual workflow provides that evidence; the PR branch still runs all jobs.
+    branches-ignore:
+      - codex/macos-ci-kvm-compatibility
   workflow_dispatch:
 
 jobs:
@@ -112,15 +116,6 @@ jobs:
             --nologo
           test -s MeetingAssistant/bin/Release/net10.0-windows10.0.19041.0/win-x64/MeetingAssistant.dll
 
-      - name: Measure transcript reader sharing on the Windows Wine host
-        run: |
-          mkdir -p artifacts/tests
-          transcript_probe_exit=0
-          "${WINE_BIN}" "${WIN_DOTNET_DIR}/dotnet.exe" run \
-            --file tools/ci/TranscriptFileShareProbe.cs > artifacts/tests/transcript-file-sharing.json || transcript_probe_exit=$?
-          cat artifacts/tests/transcript-file-sharing.json
-          exit "${transcript_probe_exit}"
-
       - name: Run tests via Wine (Windows dotnet host)
         run: |
           rm -f artifacts/tests/wine.trx

MeetingAssistant.Tests/RecordingCoordinatorTests.cs

@@ -191,21 +191,18 @@ public sealed class RecordingCoordinatorTests
             NullLogger<MarkdownMeetingNoteStore>.Instance);
         var artifactStore = new MarkdownMeetingArtifactStore(
             NullLogger<MarkdownMeetingArtifactStore>.Instance);
-        var writeProbe = new TranscriptWriteDiagnostic();
-        var transcriptStore = new DiagnosticTranscriptStore(
-            new VaultTranscriptStore(Options.Create(options), NullLogger<VaultTranscriptStore>.Instance),
-            writeProbe);
         var coordinator = new MeetingRecordingCoordinator(
             audioSource,
             new TestSpeechRecognitionPipelineFactory(
-                new DiagnosticTranscriptionProvider(
-                    new FixedSegmentStreamingTranscriptionProvider(
-                        new TranscriptionSegment(
-                            TimeSpan.FromSeconds(4),
-                            TimeSpan.FromSeconds(5),
-                            "Guest-1",
-                            "Azure returned ***** here.")), writeProbe)),
-            transcriptStore,
+                new FixedSegmentStreamingTranscriptionProvider(
+                    new TranscriptionSegment(
+                        TimeSpan.FromSeconds(4),
+                        TimeSpan.FromSeconds(5),
+                        "Guest-1",
+                        "Azure returned ***** here."))),
+            new VaultTranscriptStore(
+                Options.Create(options),
+                NullLogger<VaultTranscriptStore>.Instance),
             noteStore,
             new CapturingMeetingNoteOpener(),
             artifactStore,
@@ -221,45 +218,9 @@ public sealed class RecordingCoordinatorTests
                 NullLogger<MeetingWorkflowEngine>.Instance));
 
         var started = await coordinator.StartAsync(CancellationToken.None);
-        Exception? waitFailure = null;
-        Exception? stopFailure = null;
-        try
-        {
-            await audioSource.WriteAsync(new AudioChunk([1, 0], 16000, 1), CancellationToken.None);
-            writeProbe.Record("test-audio-enqueued");
-            await WaitUntilAsync(() => FileContainsText(started.TranscriptPath!, "Azure returned"));
-        }
-        catch (Exception exception)
-        {
-            waitFailure = exception;
-            writeProbe.Record("test-wait-failed", exception);
-        }
-        finally
-        {
-            try
-            {
-                await coordinator.StopAsync(CancellationToken.None);
-                writeProbe.Record("test-stop-completed");
-            }
-            catch (Exception exception)
-            {
-                stopFailure = exception;
-                writeProbe.Record("test-stop-failed", exception);
-            }
-        }
-
-        if (waitFailure is TimeoutException)
-        {
-            throw new TimeoutException($"{waitFailure.Message} {writeProbe.Describe()}", waitFailure);
-        }
-        if (waitFailure is not null)
-        {
-            System.Runtime.ExceptionServices.ExceptionDispatchInfo.Capture(waitFailure).Throw();
-        }
-        if (stopFailure is not null)
-        {
-            System.Runtime.ExceptionServices.ExceptionDispatchInfo.Capture(stopFailure).Throw();
-        }
+        await audioSource.WriteAsync(new AudioChunk([1, 0], 16000, 1), CancellationToken.None);
+        await WaitUntilAsync(() => FileContainsText(started.TranscriptPath!, "Azure returned"));
+        await coordinator.StopAsync(CancellationToken.None);
 
         var content = await File.ReadAllTextAsync(started.TranscriptPath!);
         Assert.Contains("[00:00:04] Guest-1: Azure returned [redacted] here.", content);
@@ -5251,94 +5212,6 @@ public sealed class RecordingCoordinatorTests
         }
     }
 
-    // Temporary diagnosis of Run4174. Observes public provider/store boundaries only.
-    private sealed class TranscriptWriteDiagnostic
-    {
-        private readonly System.Diagnostics.Stopwatch elapsed = System.Diagnostics.Stopwatch.StartNew();
-        private readonly ConcurrentQueue<string> events = new();
-
-        public void Record(string name, Exception? error = null)
-        {
-            events.Enqueue($"{elapsed.ElapsedMilliseconds}ms:{name}" + (error is null ? "" :
-                $":{error.GetType().FullName}:HResult=0x{error.HResult:X8}:{error.Message}"));
-        }
-
-        public string Describe() => "[DEBUG-transcript-write-4174] " + string.Join(" | ", events);
-    }
-
-    private sealed class DiagnosticTranscriptionProvider(
-        IStreamingTranscriptionProvider inner,
-        TranscriptWriteDiagnostic probe) : IStreamingTranscriptionProvider
-    {
-        public async IAsyncEnumerable<TranscriptionSegment> TranscribeAsync(
-            IAsyncEnumerable<AudioChunk> audio,
-            SpeechRecognitionPipelineOptions options,
-            [System.Runtime.CompilerServices.EnumeratorCancellation] CancellationToken cancellationToken)
-        {
-            await foreach (var segment in inner.TranscribeAsync(ObserveAudioAsync(audio, cancellationToken), options, cancellationToken))
-            {
-                probe.Record("fake-segment-yielded");
-                yield return segment;
-            }
-        }
-
-        private async IAsyncEnumerable<AudioChunk> ObserveAudioAsync(
-            IAsyncEnumerable<AudioChunk> audio,
-            [System.Runtime.CompilerServices.EnumeratorCancellation] CancellationToken cancellationToken)
-        {
-            await foreach (var chunk in audio.WithCancellation(cancellationToken))
-            {
-                probe.Record("fake-audio-consumed");
-                yield return chunk;
-            }
-        }
-    }
-
-    private sealed class DiagnosticTranscriptStore(
-        ITranscriptStore inner,
-        TranscriptWriteDiagnostic probe) : ITranscriptStore
-    {
-        public Task<TranscriptSession> CreateSessionAsync(CancellationToken cancellationToken) =>
-            inner.CreateSessionAsync(cancellationToken);
-        public Task<TranscriptSession> CreateSessionAsync(MeetingAssistantOptions options, DateTimeOffset startedAt, CancellationToken cancellationToken) =>
-            inner.CreateSessionAsync(options, startedAt, cancellationToken);
-        public Task ReplaceLinesAsync(TranscriptSession session, IReadOnlyList<string> replacementLines, CancellationToken cancellationToken) =>
-            inner.ReplaceLinesAsync(session, replacementLines, cancellationToken);
-        public Task UpdateMetadataAsync(TranscriptSession session, MeetingSessionArtifacts artifacts, MeetingNote meetingNote, CancellationToken cancellationToken) =>
-            inner.UpdateMetadataAsync(session, artifacts, meetingNote, cancellationToken);
-
-        public async Task<TranscriptLineReference> AppendLineAsync(TranscriptSession session, string line, CancellationToken cancellationToken)
-        {
-            probe.Record("append-entered");
-            try
-            {
-                var reference = await inner.AppendLineAsync(session, line, cancellationToken);
-                probe.Record("append-completed");
-                return reference;
-            }
-            catch (Exception exception)
-            {
-                probe.Record("append-failed", exception);
-                throw;
-            }
-        }
-
-        public async Task ReplaceLineAsync(TranscriptSession session, TranscriptLineReference lineReference, string replacementLine, CancellationToken cancellationToken)
-        {
-            probe.Record("rewrite-entered");
-            try
-            {
-                await inner.ReplaceLineAsync(session, lineReference, replacementLine, cancellationToken);
-                probe.Record("rewrite-completed");
-            }
-            catch (Exception exception)
-            {
-                probe.Record("rewrite-failed", exception);
-                throw;
-            }
-        }
-    }
-
     private sealed class TestSpeechRecognitionPipelineFactory : ISpeechRecognitionPipelineFactory
     {
         private readonly IStreamingTranscriptionProvider provider;

docs/macos-native-diagnostic.md

@@ -57,7 +57,15 @@ No new force/beta argument is needed for actual no-AVX2 CPUs. Baseline arguments
 
 The Apple wrapper is byte-identical to baseline: background `/Volumes/installstate/readiness.sh` then `exec /usr/libexec/recoveryosd` under the same launchd job/PID. Source evidence does not prove Apple's executable ran.
 
-Readiness changes only minimum macOS 14 to 13. Validation normalizes that gate to 14 and requires baseline SHA256 `4d428f594dac14eff64ed87b172c81ecf85ac91da8c5460cd6ec4b1d310800c3`. Architecture, UID, services, disk size/writability/uniqueness, retries, proof bounds, timers and native-wait/cleanup/flush metrics remain identical. Limits stay 45 seconds per native command, 180 seconds for UID, ten minutes disk readiness, 40 minutes host and 45 minutes workflow.
+The disk IPC continuation contains seven explicitly marked diagnostic blocks and limits disk enumeration to one attempt. Its disk query receives 120 seconds so the owned sample can finish while the query is still running. Validation removes only those marked blocks, including that command-budget exception, restores the former attempt condition and normalizes macOS 13 to 14 before requiring baseline SHA256 `4d428f594dac14eff64ed87b172c81ecf85ac91da8c5460cd6ec4b1d310800c3`. Two separate named version marker pairs exclude the new parser and explicitly restore the original three-line `sw_vers -productVersion` sequence for this baseline comparison. The receipt records this version-source exception, the 1,024-byte parser bound and all existing diagnostic budget exceptions. Architecture, UID, native service exits, minimum macOS version, disk size/writability/uniqueness, proof bounds and native-wait/cleanup/flush metrics remain identical. All other required native commands retain 45 seconds, UID retains 180 seconds, and outer limits remain ten minutes maximum disk readiness, 40 minutes host and 45 minutes workflow.
+
+Run 4186 at `227884723a25e703ec1be39f8600eeaae2085c4f` completed native `sw_vers` successfully after 43 seconds, reporting macOS 13.6 / 22G120. The redundant `sw_vers -productVersion` then timed out after 48 seconds before any disk query. The continuation extracts exactly one `ProductVersion` field from the entire already-successful `platform` or `platform-warm` output. It requires EOF within 1,024 bytes, rejects NUL delimiters, duplicate/missing fields and malformed version suffixes, and accepts only two or three numeric version components separated by dots with native tab/space padding. The existing macOS 13 minimum remains mandatory; no native timeout is relaxed by this reuse.
+
+Run 4175 at `94a70b200508d3ba295124896d923fbb785d1658` reached macOS 13.6, x86_64 and UID 0 with KVM enabled; its nine `diskutil list physical` attempts timed out. Run 4185 at `25989cf0eb7205f30ac0bb44eb279aa3b463f12c` proved the whole writable 64-GiB target as IOMedia `disk2`; it measured approximately 14 seconds for the final native process listing and 33 seconds for IOMedia. Both Apple disk jobs were running; DiskManagement's endpoint was still inactive. The former eight-second observer allowance was shorter than observed native startup, so its killed sample did not establish an IPC wait point. A missing target is ruled out for that run; service initialization, IPC or resource delays remain unresolved.
+
+Before the only disk attempt the continuation records bounded `launchctl print` output for `com.apple.diskarbitrationd` and `com.apple.diskmanagementd`, plus `ioreg -r -c IOMedia -l -w 0`. Its observer starts only `/usr/bin/sample <owned-diskutil-child-pid> 3 100 -file <owned-output>`, with no preceding process list or additional service query. Three seconds at a 100-millisecond interval reduces sampling overhead. The sample has 60 seconds for startup/reporting plus the existing two-second TERM/KILL grace; its separate report is flushed into the proof alongside command output. Missing sample tooling or an already completed diskutil is reported explicitly; nonzero observation exits are logged and cannot satisfy any native gate.
+
+The observer owns its command/timer PIDs and is stopped when the disk query completes or the probe is canceled. Its output enters the existing 512-KiB per-output and 4-MiB proof budgets. The hook only reads media/service/process state and writes its existing diagnostic files: it does not load, restart, erase or modify any service or disk. Bash remains necessary because Apple Recovery runs this hook before a .NET SDK is installed. The CPU, Recovery, QEMU, Apple wrapper and container profile are unchanged. These observations are prepared diagnostics, not a new successful guest or full native CI receipt.
 
 Container profile: `KVM=Y`, `CPU_MODEL=host`, `VERSION=13`, 4-GiB guest, two guest/host CPUs, 6-GiB memory/swap and 512-MiB shared memory. Fresh anonymous `/storage` holds the 64-GiB disk; evidence reads `/storage/13/setup.dmg`. Existing resource budget checks remain.
 
@@ -65,4 +73,6 @@ Only device mapping: exactly `/dev/kvm:/dev/kvm:rw`. Inspection rejects other de
 
 Evidence retains run/profile identity, source/assets, EFI staging, container/resources, macOS 13 Recovery hash, native proof/result/outcome and cleanup. `[recovery-original]` logs the exact download's size/SHA256 before modifying it, including when patch failure later deletes the source. `guest-container-resources.last-success.stdout.log` and its timestamp/hash receipt preserve the last successful resource snapshot independently of a later failed stopped-container `docker exec`. Optional final Unix HMP capture includes `info kvm`, `info status` and a bounded PPM exported from `/tmp`; capture success passes no native gate.
 
+Optional 20-second resource snapshots before, during and after the guest probe retain cgroup CPU usage/throttling/pressure, memory events/pressure/statistics and host page-fault/swap counters. These observations test resource contention as a hypothesis; no resource failure is established by the existing guest timing alone. The large Recovery image hash is captured once after compatibility-profile staging is observed, with its successful receipt retained, instead of repeatedly hashing the image while collecting guest progress. Snapshot or hash observation failure cannot satisfy a native readiness gate.
+
 Both cleanup paths keep exact token/label/ID checks. `docker rm --force --volumes` removes only the owned container and anonymous volume, then its exact image; no unrelated objects or pruning. Evidence stays seven days. Full native CI still needs a subsequent actual installed remote guest to build/sign helpers and pass the full suite, including five native tests without skips.

tools/ci/MacOsNativeDiagnostic.cs

@@ -69,7 +69,7 @@ static class NativeDiagnostic
                 await PrepareSource(Path.GetFullPath(source), output, "validation", false, Option(args, "--cryptex-archive"), CancellationToken.None);
                 await ValidateResourceRetention(output);
                 await ValidateRecoveryPatch(output);
-                Save(Path.Combine(output, "validation.json"), new { success = true, profile = "kvm-host-ventura-cryptex", helperSha256 = Hash(File.ReadAllBytes(Path.Combine("tools", "ci", "MacOsNativeDiagnostic.cs"))), udifChecksumBindingSha256 = Hash(File.ReadAllBytes(Path.Combine("tools", "ci", "macos-native-udif-checksums.py"))), baselineReadinessNormalized = true, resultNegativeCases = 6, containerNegativeCases = 11, recoveryPositiveCases = 4, recoveryNegativeCases = 12, independentFixtureCrc32Readback = true, resourceSnapshotRetention = true, cryptexArchiveVerified = true, configurationAndStagingContractsVerified = true, templateIsoDownloaded = false, activeLiluRuntimeChecked = false, sourceModified = false, dockerExecuted = false, guestExecuted = false, completedUtc = DateTimeOffset.UtcNow });
+                Save(Path.Combine(output, "validation.json"), new { success = true, profile = "kvm-host-ventura-cryptex", helperSha256 = Hash(File.ReadAllBytes(Path.Combine("tools", "ci", "MacOsNativeDiagnostic.cs"))), udifChecksumBindingSha256 = Hash(File.ReadAllBytes(Path.Combine("tools", "ci", "macos-native-udif-checksums.py"))), baselineReadinessNormalized = true, readinessDiagnosticBlocksExcluded = 7, productVersionParserBlockExcluded = true, productVersionSequenceRestored = true, productVersionMaximumBytes = 1024, nativeProductVersionCommandRemoved = true, diskReadinessAttemptLimit = 1, diskCommandLimitSeconds = 120, diskSampleLimitSeconds = 60, diskSampleDurationSeconds = 3, diskSampleIntervalMilliseconds = 100, resultNegativeCases = 6, containerNegativeCases = 11, recoveryPositiveCases = 4, recoveryNegativeCases = 12, independentFixtureCrc32Readback = true, resourceSnapshotRetention = true, cryptexArchiveVerified = true, configurationAndStagingContractsVerified = true, templateIsoDownloaded = false, activeLiluRuntimeChecked = false, sourceModified = false, dockerExecuted = false, guestExecuted = false, completedUtc = DateTimeOffset.UtcNow });
             }
             Console.WriteLine("Source patch contracts and diagnostic result validation passed; no Docker or guest execution occurred.");
             return 0;
@@ -131,13 +131,21 @@ static class NativeDiagnostic
             await Command("docker", ["inspect", id], output, "container-created", deadline.Token);
             AssertContainer(File.ReadAllText(Path.Combine(output, "container-created.stdout.log")), token);
             await Command("docker", ["start", id], output, "docker-start", deadline.Token);
+            await CapturePressure(id, output, "before", deadline.Token);
             Console.WriteLine("The owned restricted KVM/host-CPU macOS 13 compatibility guest is starting. Success requires native macOS 13+/x86_64 and a writable 64-GiB disk; no installer will run. This is not a single-variable causal test.");
             var recoveryStarted = Stopwatch.StartNew();
             var heartbeat = Stopwatch.StartNew();
+            var diskPressureCaptured = false;
             while (true)
             {
                 deadline.Token.ThrowIfCancellationRequested();
                 await CaptureGuest(id, output, deadline.Token);
+                var proofPath = Path.Combine(output, "guest-proof.log");
+                if (!diskPressureCaptured && File.Exists(proofPath) && File.ReadAllText(proofPath).Contains("[proof-start] disks", StringComparison.Ordinal))
+                {
+                    diskPressureCaptured = true;
+                    await CapturePressure(id, output, "during", deadline.Token);
+                }
                 var resultPath = Path.Combine(output, "guest-result.json");
                 if (File.Exists(resultPath))
                 {
@@ -167,6 +175,7 @@ static class NativeDiagnostic
             Console.CancelKeyPress -= cancelHandler;
             using var captureDeadline = new CancellationTokenSource(TimeSpan.FromSeconds(45));
             try { await CaptureGuest(state.ContainerId ?? state.ContainerName, output, captureDeadline.Token, true, state.Token); } catch (Exception exception) { Console.Error.WriteLine("Final evidence capture: " + exception.Message); }
+            await CapturePressure(state.ContainerId ?? state.ContainerName, output, "after", captureDeadline.Token);
             try { PrintGuestProof(output, state.Token); } catch (Exception exception) { Console.Error.WriteLine("Native proof output: " + exception.Message); }
             var clean = await Cleanup(output);
             if (!clean) { outcome = "failed"; error = (error ?? "") + " Owned-resource cleanup failed; inspect cleanup evidence."; }
@@ -184,9 +193,11 @@ static class NativeDiagnostic
     static void ValidateContracts()
     {
         var readiness = File.ReadAllText(Path.Combine("tools", "ci", "macos-native-readiness.sh"));
-        var baseline = ReplaceOnce(readiness, "(( ${os_version%%.*} >= 13 ))", "(( ${os_version%%.*} >= 14 ))");
+        var baseline = NormalizeReadinessDiagnostics(readiness);
+        baseline = ReplaceOnce(baseline, "(( ${os_version%%.*} >= 13 ))", "(( ${os_version%%.*} >= 14 ))");
+        baseline = ReplaceOnce(baseline, "while (( attempt < 1 && SECONDS - readiness_start < 600 )); do", "while (( SECONDS - readiness_start < 600 )); do");
         if (Hash(Encoding.UTF8.GetBytes(baseline)) != "4d428f594dac14eff64ed87b172c81ecf85ac91da8c5460cd6ec4b1d310800c3")
-            throw new InvalidOperationException("Compatibility readiness may change only the baseline's macOS minimum to 13; identity, services, disk and limits must remain identical.");
+            throw new InvalidOperationException("Outside seven explicit diagnostic blocks, the successful sw_vers version parser/sequence, the macOS minimum and one-attempt limit, baseline identity/service/disk gates and watchdogs must remain identical.");
         if (Hash(File.ReadAllBytes(Path.Combine("tools", "ci", "macos-native-bootstrap.sh"))) != "94f069e116fdc7685a4d233cab6fa50df9f39274386bb82157674061e74fadb5")
             throw new InvalidOperationException("Compatibility profile must preserve the baseline Apple recoveryosd wrapper.");
         if (Hash(Encoding.UTF8.GetBytes(OriginalDaemon13)) != "af9d7f6c1948079bd4384d27b6882678d6fb4e338fcf6a8be8f84fceef174ad6") throw new InvalidOperationException("macOS 13 allowlist bytes differ from the independently read comparison plist.");
@@ -214,6 +225,38 @@ static class NativeDiagnostic
         }
     }
 
+    static string NormalizeReadinessDiagnostics(string source)
+    {
+        const string start = "# BEGIN disk IPC diagnostic\n";
+        const string end = "# END disk IPC diagnostic\n";
+        var blocks = 0;
+        while (source.IndexOf(start, StringComparison.Ordinal) is var from && from >= 0)
+        {
+            var to = source.IndexOf(end, from + start.Length, StringComparison.Ordinal);
+            if (to < 0 || source.IndexOf(start, from + start.Length, to - from - start.Length, StringComparison.Ordinal) >= 0)
+                throw new InvalidOperationException("Readiness diagnostic blocks are unbalanced or nested.");
+            source = source.Remove(from, to + end.Length - from);
+            blocks++;
+        }
+        if (blocks != 7 || source.Contains(end, StringComparison.Ordinal))
+            throw new InvalidOperationException("Readiness must contain exactly seven explicit disk IPC diagnostic blocks.");
+        source = RestoreVersionBlock(source, "successful sw_vers version parser", "");
+        source = RestoreVersionBlock(source, "successful sw_vers version extraction", "run_command version /usr/bin/sw_vers -productVersion\n(( LAST_EXIT == 0 )) || fail_probe product_version_failed\nread_scalar || fail_probe product_version_invalid\n");
+        return source;
+    }
+
+    static string RestoreVersionBlock(string source, string name, string originalSequence)
+    {
+        var start = "# BEGIN " + name + "\n";
+        var end = "# END " + name + "\n";
+        if (source.Split(start, StringSplitOptions.None).Length != 2 || source.Split(end, StringSplitOptions.None).Length != 2)
+            throw new InvalidOperationException("Readiness requires exactly one named version marker pair: " + name);
+        var from = source.IndexOf(start, StringComparison.Ordinal);
+        var to = source.IndexOf(end, StringComparison.Ordinal);
+        if (to < from + start.Length) throw new InvalidOperationException("Readiness version markers are reversed: " + name);
+        return source.Remove(from, to + end.Length - from).Insert(from, originalSequence);
+    }
+
     static async Task PrepareSource(string source, string output, string token, bool writeSource, string? cryptexArchive, CancellationToken cancellation)
     {
         Directory.CreateDirectory(output);
@@ -457,7 +500,40 @@ static class NativeDiagnostic
             var result = await Command("docker", ["exec", id, "cat", "/dev/shm/installstate/" + file.Item1], output, "capture-" + file.Item1, cancellation, requireSuccess: false);
             if (result.ExitCode == 0 && !string.IsNullOrWhiteSpace(result.Output)) File.WriteAllText(Path.Combine(output, file.Item2), result.Output);
         }
-        await Command("docker", ["exec", id, "sh", "-c", "printf '[qemu]\n'; qemu-system-x86_64 --version | head -n 1; printf '[Recovery hash]\n'; test ! -f /storage/13/setup.dmg || sha256sum /storage/13/setup.dmg; printf '[resources]\n'; df -Pk /storage; cat /sys/fs/cgroup/memory.max /sys/fs/cgroup/cpu.max 2>/dev/null || true"], output, "guest-container-resources", cancellation, requireSuccess: false, retainSuccessful: true);
+        // The immutable Recovery image is complete only after this staging marker.
+        // Hash it once instead of rereading 710 MB on every twenty-second poll.
+        if (logs.Output.Contains("[compatibility-profile] accelerator=kvm", StringComparison.Ordinal)
+            && !File.Exists(Path.Combine(output, "guest-container-resources.last-success.json")))
+            await Command("docker", ["exec", id, "sh", "-c", "printf '[qemu]\n'; qemu-system-x86_64 --version | head -n 1; printf '[Recovery hash]\n'; test -f /storage/13/setup.dmg && sha256sum /storage/13/setup.dmg || exit 1; printf '[resources]\n'; df -Pk /storage; cat /sys/fs/cgroup/memory.max /sys/fs/cgroup/cpu.max 2>/dev/null || true"], output, "guest-container-resources", cancellation, requireSuccess: false, retainSuccessful: true);
+    }
+
+    static async Task CapturePressure(string id, string output, string phase, CancellationToken cancellation)
+    {
+        using var snapshotDeadline = CancellationTokenSource.CreateLinkedTokenSource(cancellation);
+        snapshotDeadline.CancelAfter(TimeSpan.FromSeconds(20));
+        const string snapshot = """
+            printf '[snapshot UTC]\n'; date -u '+%Y-%m-%dT%H:%M:%SZ'
+            for path in /proc/meminfo /proc/pressure/cpu /proc/pressure/memory /proc/pressure/io \
+                /sys/fs/cgroup/cpu.max /sys/fs/cgroup/cpu.stat /sys/fs/cgroup/cpu.pressure \
+                /sys/fs/cgroup/memory.max /sys/fs/cgroup/memory.current /sys/fs/cgroup/memory.peak \
+                /sys/fs/cgroup/memory.events /sys/fs/cgroup/memory.stat /sys/fs/cgroup/memory.pressure \
+                /sys/fs/cgroup/memory.swap.current; do
+                printf '\n[%s]\n' "$path"
+                if [ -r "$path" ]; then cat "$path"; else printf 'unavailable\n'; fi
+            done
+            printf '\n[host paging counters]\n'
+            awk '/^(pgmajfault|pswpin|pswpout) / {print}' /proc/vmstat
+            """;
+        try
+        {
+            await Command("docker", ["exec", id, "sh", "-c", snapshot], output, "capture-pressure-" + phase, snapshotDeadline.Token, requireSuccess: false, retainSuccessful: true);
+        }
+        catch (Exception exception)
+        {
+            // Optional evidence must not replace the guest outcome or prevent cleanup.
+            try { Save(Path.Combine(output, "capture-pressure-" + phase + ".unavailable.json"), new { phase, error = exception.Message, capturedUtc = DateTimeOffset.UtcNow }); }
+            catch (Exception evidenceError) { Console.Error.WriteLine("Optional pressure evidence: " + evidenceError.Message); }
+        }
     }
 
     static async Task CaptureMonitor(string id, string output, string token, CancellationToken cancellation)

tools/ci/TranscriptFileShareProbe.cs

@@ -1,88 +0,0 @@
-#:property PublishAot=false
-// Local diagnostic only. See TranscriptFileShareProbe.md for the contract and limits.
-using System.Diagnostics;
-using System.Runtime.InteropServices;
-using System.Text;
-using System.Text.Json;
-
-const string original = "---\ntitle: transcript probe\n---\n\n# Meeting Transcript\n";
-const string written = original + "[00:00:04] Guest-1: Azure returned ***** here.\n";
-var root = Path.Combine(Path.GetTempPath(), "meeting-assistant-file-share-probe", Guid.NewGuid().ToString("N"));
-if (Directory.Exists(root))
-    throw new IOException("Probe directory already exists; refusing to reuse it.");
-Directory.CreateDirectory(root);
-var cases = new List<WriteObservation>();
-var cleanupCompleted = false;
-try
-{
-    var path = Path.Combine(root, "original-reader.md");
-    await File.WriteAllTextAsync(path, original);
-    using (var reader = new StreamReader(path, Encoding.UTF8, detectEncodingFromByteOrderMarks: true))
-    {
-        if (reader.ReadToEnd() != original)
-            throw new InvalidDataException("Original reader did not read the initial fixture.");
-        cases.Add(await ObserveWriteAsync("held-original-reader", path, written));
-    }
-    cases[^1] = cases[^1] with { ContentAfterReaderClosed = await File.ReadAllTextAsync(path) };
-    cases.Add(await ObserveWriteAsync("original-reader-released", path, written));
-    cases[^1] = cases[^1] with { ContentAfterReaderClosed = await File.ReadAllTextAsync(path) };
-
-    path = Path.Combine(root, "compatible-reader.md");
-    await File.WriteAllTextAsync(path, original);
-    using (var stream = new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete))
-    using (var reader = new StreamReader(stream, Encoding.UTF8, detectEncodingFromByteOrderMarks: true))
-    {
-        if (reader.ReadToEnd() != original)
-            throw new InvalidDataException("Compatible reader did not read the initial fixture.");
-        cases.Add(await ObserveWriteAsync("held-compatible-reader", path, written));
-    }
-    cases[^1] = cases[^1] with { ContentAfterReaderClosed = await File.ReadAllTextAsync(path) };
-}
-finally
-{
-    Directory.Delete(root, recursive: true);
-    cleanupCompleted = !Directory.Exists(root);
-}
-
-var windowsContractMatched = OperatingSystem.IsWindows()
-    ? !cases[0].Completed && cases[0].Error is { Type: "System.IO.IOException", NativeCode: 32 }
-        && cases[0].ContentAfterReaderClosed == original
-    : (bool?)null;
-var compatibleAndReleasedWritesCompleted = cases.Skip(1).All(result =>
-    result.Completed && result.Error is null && result.ContentAfterReaderClosed == written);
-Console.WriteLine(JsonSerializer.Serialize(new
-{
-    Schema = "meeting-assistant-file-share-probe/v1",
-    Runtime = RuntimeInformation.FrameworkDescription,
-    OS = RuntimeInformation.OSDescription,
-    Architecture = RuntimeInformation.ProcessArchitecture.ToString(),
-    ProbeDirectory = root,
-    CleanupCompleted = cleanupCompleted,
-    WindowsContractMatched = windowsContractMatched,
-    CompatibleAndReleasedWritesCompleted = compatibleAndReleasedWritesCompleted,
-    Cases = cases,
-    EvidenceLimit = "Held-reader access-mode probe; it does not reproduce the timing or establish the cause of Run4174."
-}, new JsonSerializerOptions { WriteIndented = true }));
-return cleanupCompleted && compatibleAndReleasedWritesCompleted && windowsContractMatched != false ? 0 : 1;
-
-static async Task<WriteObservation> ObserveWriteAsync(string name, string path, string content)
-{
-    var elapsed = Stopwatch.StartNew();
-    Task? write = null;
-    using var deadline = new CancellationTokenSource(TimeSpan.FromSeconds(5));
-    try
-    {
-        write = File.WriteAllTextAsync(path, content, deadline.Token);
-        await write;
-        return new(name, true, write.Status.ToString(), elapsed.ElapsedMilliseconds, null, null);
-    }
-    catch (Exception exception)
-    {
-        return new(name, false, write?.Status.ToString() ?? "not-returned", elapsed.ElapsedMilliseconds,
-            new(exception.GetType().FullName!, $"0x{exception.HResult:X8}", exception.HResult & 0xffff, exception.Message), null);
-    }
-}
-
-sealed record WriteObservation(string Name, bool Completed, string TaskStatus, long ElapsedMilliseconds,
-    WriteError? Error, string? ContentAfterReaderClosed);
-sealed record WriteError(string Type, string HResult, int NativeCode, string Message);

tools/ci/TranscriptFileShareProbe.md

@@ -1,25 +0,0 @@
-# Transcript file sharing diagnostic
-
-Purpose: distinguish a writer error from a completed write when a reader with the original test's access mode remains open. This temporary diagnostic does not change the app, its tests, or their 577-case count.
-
-Entry point: `tools/ci/TranscriptFileShareProbe.cs`, a .NET 10 file-based app with BCL-only dependencies. From this clone:
-
-```sh
-/Users/dh/.dotnet/dotnet run --file tools/ci/TranscriptFileShareProbe.cs
-```
-
-On another machine use its .NET 10 SDK executable. The file-based app requires an SDK supporting file-based apps; the prepared local run uses SDK 10.0.401. Native AOT is disabled for this diagnostic so its JSON report can use the normal reflection serializer. It prints JSON with runtime/OS, write completion, exception type/HResult/native error code, content after reader disposal, and cleanup status. It creates a unique directory beneath the system temporary directory, writes two small fixture files, and deletes only that directory in `finally`. It starts no Meeting Assistant app, service, network client, container, or VM. The SDK can create its normal file-based build cache. For a fresh CLI profile set `DOTNET_GENERATE_ASPNET_CERTIFICATE=false` and `DOTNET_CLI_TELEMETRY_OPTOUT=1` to disable unrelated certificate/telemetry initialization.
-
-The optional instrumentation in the existing recording-coordinator test observes public provider and transcript-store boundaries: audio consumed, fake segment yielded, append/rewrite entered, completed, or failed. Timeout output uses `[DEBUG-transcript-write-4174]` and includes elapsed milliseconds, exception type, HResult, and message. The reader, 15-second wait and final redaction assertions are unchanged. `StopAsync` always runs in `finally`; a stop failure does not mask the original timeout. Timestamps distinguish events before and after the failed wait. Instrumentation can affect race timing; a passing run alone does not explain the original failure. This temporary instrumentation should be removed after the actual Wine incident is explained.
-
-The original-reader case uses the same path-taking `StreamReader` constructor as `File.ReadAllText`. It deliberately holds the reader after reading the fixture so that the overlap is deterministic. The original test normally disposes that reader immediately after `ReadToEnd`; therefore this probe checks compatible access modes, not the historical race's timing. The second write happens after disposing that reader. The compatible case holds `FileAccess.Read` with `FileShare.ReadWrite | FileShare.Delete`. No reader fix is applied to the actual test.
-
-The existing Wine job runs this probe after its actual Windows SDK build and before the unchanged full test cohort. It writes `artifacts/tests/transcript-file-sharing.json` and prints that report into the CI log. Invocation there uses the already installed Windows SDK through the existing `WINE_BIN`; no runner or infrastructure capability is added. The measured Wine result is pending until this exact workflow executes.
-
-## Primary-source contract
-
-In [.NET runtime v10.0.12 File.cs](https://github.com/dotnet/runtime/blob/v10.0.12/src/libraries/System.Private.CoreLib/src/System/IO/File.cs#L572), `ReadAllText` constructs a path-taking `StreamReader`; [`StreamReader.cs`](https://github.com/dotnet/runtime/blob/v10.0.12/src/libraries/System.Private.CoreLib/src/System/IO/StreamReader.cs#L203) opens read access sharing only further readers. `WriteAllTextAsync` delegates to a create-mode write; [its writer](https://github.com/dotnet/runtime/blob/v10.0.12/src/libraries/System.Private.CoreLib/src/System/IO/File.cs#L1416) opens write access with reader sharing.
-
-[Windows CreateFileW documentation](https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew#parameters) requires existing access and sharing modes to remain compatible until handle closure. A held reader that does not permit writes therefore prevents that writer from opening; the Windows contract expects an `IOException` with sharing-violation native code 32. Allowing read/write sharing removes that incompatibility. Delete sharing is included for the comparison but this probe does not rename or delete an open file.
-
-On Windows the CLI asserts that the original held-reader write fails with code 32 and leaves the original bytes, and that both subsequent writes complete with the expected content. On other platforms it reports the original-reader observation without asserting Windows behavior (`WindowsContractMatched: null`), and still checks completed compatible/released writes and cleanup. The Unix/macOS implementation can differ. A local macOS success is not evidence of Wine behavior or the cause of Run4174's timeout.

tools/ci/macos-native-readiness.sh

@@ -14,6 +14,9 @@ TIMER_FIFO="/tmp/native-diagnostic-$PROOF_TOKEN-$$.fifo"
 PENDING_OUTPUTS=()
 ACTIVE_COMMAND=""
 ACTIVE_TIMER=""
+# BEGIN disk IPC diagnostic
+ACTIVE_OBSERVER=""
+# END disk IPC diagnostic
 os_version=""
 architecture=""
 uid=-1
@@ -96,8 +99,92 @@ read_scalar() {
   SCALAR="$value"
 }
 
+# BEGIN successful sw_vers version parser
+read_product_version() {
+  local value status line version="" fields=0
+  # Read the entire successful native output. EOF is mandatory; a NUL delimiter
+  # or reaching the 1025-byte sentinel must never hide a suffix.
+  LC_ALL=C IFS= read -r -n 1025 -d '' value < "$LAST_OUTPUT"; status=$?
+  (( status == 1 && ${#value} <= 1024 )) || return 1
+  while IFS= read -r line || [ -n "$line" ]; do
+    if [[ "$line" =~ ^[[:blank:]]*ProductVersion: ]]; then
+      fields=$((fields + 1))
+      (( fields == 1 )) || return 1
+      [[ "$line" =~ ^[[:blank:]]*ProductVersion:[[:blank:]]*([0-9]+\.[0-9]+(\.[0-9]+)?)[[:blank:]]*$ ]] || return 1
+      version="${BASH_REMATCH[1]}"
+    fi
+  done <<< "$value"
+  (( fields == 1 )) || return 1
+  SCALAR="$version"
+}
+
+# END successful sw_vers version parser
+# BEGIN disk IPC diagnostic
+# Optional observations have their own child/timer ownership. No service is
+# loaded, restarted or changed, and samples target only this probe's diskutil.
+observe_disk_query() {
+  local disk_process="$1" output="$2" sample_output="$3" observation_child="" observation_timer=""
+  cancel_observation() {
+    trap '' TERM INT
+    if [ -n "$observation_child" ]; then
+      kill -TERM "$observation_child" 2>/dev/null || :
+      IFS= read -r -t 2 -u 9 unused || :
+      kill -KILL "$observation_child" 2>/dev/null || :
+      wait "$observation_child" 2>/dev/null || :
+    fi
+    [ -z "$observation_timer" ] || { kill -TERM "$observation_timer" 2>/dev/null || :; wait "$observation_timer" 2>/dev/null || :; }
+    printf '[disk-observation] stopped after the owned disk query\n' >> "$output"
+    exit 143
+  }
+  observe_command() {
+    local name="$1" status started=$SECONDS
+    shift
+    printf '\n[disk-observation-command] %s:' "$name" >> "$output"
+    printf ' %s' "$@" >> "$output"
+    printf '\n' >> "$output"
+    "$@" >> "$output" 2>&1 &
+    observation_child=$!
+    (
+      trap 'exit 0' TERM INT
+      IFS= read -r -t 60 -u 9 unused || :
+      printf '[disk-observation-timeout] %s child=%s limit=60s\n' "$name" "$observation_child" >> "$output"
+      kill -TERM "$observation_child" 2>/dev/null || :
+      IFS= read -r -t 2 -u 9 unused || :
+      kill -KILL "$observation_child" 2>/dev/null || :
+    ) &
+    observation_timer=$!
+    wait "$observation_child"; status=$?
+    kill -TERM "$observation_timer" 2>/dev/null || :
+    wait "$observation_timer" 2>/dev/null || :
+    printf '[disk-observation-exit] %s status=%s elapsed=%ss\n' "$name" "$status" "$((SECONDS - started))" >> "$output"
+    observation_child=""; observation_timer=""
+  }
+  trap cancel_observation TERM INT
+  printf '[disk-observation] owned-diskutil-child=%s parent-shell=%s\n' "$disk_process" "$$" >> "$output"
+  if [ -x /usr/bin/sample ]; then
+    if kill -0 "$disk_process" 2>/dev/null; then
+      observe_command diskutil-sample /usr/bin/sample "$disk_process" 3 100 -file "$sample_output"
+    else
+      printf '[disk-observation-unavailable] diskutil already exited before sample\n' >> "$output"
+    fi
+  else
+    printf '[disk-observation-unavailable] /usr/bin/sample is unavailable\n' >> "$output"
+  fi
+}
+
+stop_disk_observation() {
+  [ -n "$ACTIVE_OBSERVER" ] || return 0
+  kill -TERM "$ACTIVE_OBSERVER" 2>/dev/null || :
+  wait "$ACTIVE_OBSERVER" 2>/dev/null || :
+  ACTIVE_OBSERVER=""
+}
+
+# END disk IPC diagnostic
 cancel_probe() {
   trap '' TERM INT
+# BEGIN disk IPC diagnostic
+  stop_disk_observation
+# END disk IPC diagnostic
   if [ -n "$ACTIVE_COMMAND" ]; then
     kill -TERM "$ACTIVE_COMMAND" 2>/dev/null || :
     IFS= read -r -t 2 -u 9 unused || :
@@ -116,6 +203,9 @@ run_command() {
   # Run 4161: even native uname/ps startup took 34-42s under TCG.
   # Isolate only the failed UID gate; every other watchdog remains unchanged.
   [[ "$name" != uid ]] || command_limit=180
+# BEGIN disk IPC diagnostic
+  if [[ "$name" == disks && "${attempt:-0}" == 1 ]]; then command_limit=120; fi
+# END disk IPC diagnostic
   LAST_OUTPUT="/tmp/native-diagnostic-$name.out"
   printf '\n[proof-command] %s:' "$name" >&3
   printf ' %s' "$@" >&3
@@ -136,6 +226,18 @@ run_command() {
   ) &
   timer=$!
   ACTIVE_TIMER="$timer"
+# BEGIN disk IPC diagnostic
+  if [[ "$name" == disks && "$attempt" == 1 ]]; then
+    local observation_output="/tmp/native-diagnostic-disk-observation.out"
+    local sample_output="/tmp/native-diagnostic-disk-sample.out"
+    : > "$observation_output"
+    : > "$sample_output"
+    observe_disk_query "$process" "$observation_output" "$sample_output" &
+    ACTIVE_OBSERVER=$!
+    printf '[disk-observation-start] observer=%s owned-diskutil-child=%s\n' "$ACTIVE_OBSERVER" "$process" >&3
+    PENDING_OUTPUTS+=("$observation_output" "$sample_output")
+  fi
+# END disk IPC diagnostic
   wait "$process"
   exit_code=$?
   waited=$SECONDS
@@ -143,6 +245,9 @@ run_command() {
   printf '[proof-native-wait] %s child=%s elapsed=%ss exit=%s\n' "$name" "$process" "$((waited - started))" "$exit_code" >&3
   kill -TERM "$timer" 2>/dev/null || :
   wait "$timer" 2>/dev/null || :
+# BEGIN disk IPC diagnostic
+  stop_disk_observation
+# END disk IPC diagnostic
   ACTIVE_COMMAND=""; ACTIVE_TIMER=""
   printf '[proof-cleanup] %s child=%s elapsed=%ss total=%ss\n' "$name" "$process" "$((SECONDS - waited))" "$((SECONDS - started))" >&3
   printf '[proof-exit] %s\n' "$exit_code" >&3
@@ -195,18 +300,25 @@ if (( platform_exit != 0 )); then
   platform_exit="$LAST_EXIT"
 fi
 (( platform_exit == 0 )) || fail_probe sw_vers_failed
-run_command version /usr/bin/sw_vers -productVersion
-(( LAST_EXIT == 0 )) || fail_probe product_version_failed
-read_scalar || fail_probe product_version_invalid
+# BEGIN successful sw_vers version extraction
+read_product_version || fail_probe product_version_invalid
+# END successful sw_vers version extraction
 os_version="$SCALAR"
 [[ "$os_version" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]] || fail_probe product_version_invalid
 (( ${os_version%%.*} >= 13 )) || fail_probe unsupported_macos_version
 flush_outputs || finish false diagnostic_log_budget_exceeded
 
+# BEGIN disk IPC diagnostic
+run_command arbitration_before /bin/launchctl print system/com.apple.diskarbitrationd
+run_command management_before /bin/launchctl print system/com.apple.diskmanagementd
+run_command media_before /usr/sbin/ioreg -r -c IOMedia -l -w 0
+flush_outputs || finish false diagnostic_log_budget_exceeded
+
+# END disk IPC diagnostic
 # Bound readiness independently of the host's 40-minute overall deadline.
 readiness_start=$SECONDS
 attempt=0
-while (( SECONDS - readiness_start < 600 )); do
+while (( attempt < 1 && SECONDS - readiness_start < 600 )); do
   attempt=$((attempt + 1))
   printf '\n[readiness-attempt] %s\n' "$attempt" >&3
   run_command disks /usr/sbin/diskutil list physical