[pranems]

Summary

Current reconciled source (2026-10-30), proposed 0.55.67, DRAFT.

Exact published head: abdef7207428ec26ce54e76ec0e26a08921ea6ea.
Normal merge parents: held ff2d2377 and reviewed master eb733f61
(merged Hono #262, version 0.55.66). All constituent history is preserved.
The version downgrade is resolved in this proposed source, not on master.

Complete API/web manifests and locks match reviewed master except
coordinated 0.55.67 root metadata, with zero non-root drift. Serving source,
schema, UI and estate boundaries match master. Original performance tests,
tooling, script tests and all workflow source match ff2d2377.
Both actual complete dependency inventories and the six-directory physical
ownership guard pass. No dependency restore or local npm regeneration.

New-head normal PREPUSH_MODE=Validate publication: 30/30 PASS,
exit 0, 1,632.3 seconds. API 6,254 / 216 suites; inmemory HTTP
2,514 / 118 suites, plus 42 tests / two suites explicitly skipped;
web 1,661 / 125 files; membership 226 passed / two explicit skips.
Separate bounded integration review found no significant introduced defects:
#251 (comment).
That is source review, not independent test/artifact execution or human
GitHub approval. All seven exact-tip ordinary checks are now SUCCESS:
PR Build Test Image,
push Build Test Image,
CodeQL,
and Docs freshness.
Every run's metadata binds to exact abdef720.

Canonical clean-CI regeneration
also passed at the exact head. Artifact 12946832522, raw ZIP SHA-256
31a3c88ef37468991da084b2eff0b3720aa6141e749a209a3c597264d3715397,
was authenticated against GitHub metadata before safe absolute extraction.
Both lockfiles exactly equal the committed Git blob bytes; Windows CRLF
checkout differences are explained separately. Seven-day floor preserved,
zero changed packages. No import, reinstall, new commit or repeated hook.

Before synchronization this PR was deliberately converted to draft,
using the existing tested guard. All three new-head expensive campaigns
are verified SKIPPED, each with null runner identity and zero steps:
qualification 40985896468, timeline 40985896469, native 40985896520.
No unchanged benchmark ran. These skips are not qualification passes.
Do not mark ready solely because ordinary source gates pass.

The authenticated historical qualification 40974749991 remains failed.
This new source is not performance-qualified. Its source preparation does
not approve an admission-policy waiver, source-only merge, final release
artifact, infrastructure spending or deployment. Prospective measurement
design remains a separate prerequisite; the superseded duplicate pilot
must not be implemented.

Historical hold after #262 merged, before source reconciliation.
Master is now eb733f61e7f25d1d642fe746075e266c3b19ad60, version
0.55.66, with the independently reviewed Hono correction normally merged.
This PR's source remains unchanged at ff2d2377, proposed 0.55.65.
It must not be merged as a version downgrade. Required next source work is
history-preserving integration of the new master and coordinated version
reconciliation above 0.55.66, with normal gates for that new exact tip.

The authenticated qualification failure remains a separate blocker:
40974749991 failed three first-control comparisons. Successful diagnostics
and the retained 64,000-sample descriptive history audit do not clear it.
Do not rerun an unchanged benchmark or implement the superseded duplicate
experiment. No admission-policy waiver, source-only merge exception, final
release artifact or deployment is approved by the Hono merge.

The checkpoints below preserve the earlier source and evidence identities.

Authoritative reviewed-master union (2026-10-29), proposed 0.55.65.
Exact published head: ff2d2377d34e3b517c09ee2e445629183153774e.
Exact reviewed master: cffc64c8a188a721fabb85c37a80243d5e65a74f.
Original #251: 6fe4d2e21f7ba5dd2d0481c600339ba5995e045c.

#259, #260 and #261 are now reviewed and normally merged. This ordinary
two-parent merge inherits their web/API dependency corrections and preserves
all 58 performance constituents. The following earlier preparation and
implementation sections remain historical provenance, not current status.

Current preservation checks PASS:

• API source/schema, web source and estate registry equal reviewed master.
• API tests, performance tooling, script tests, three performance workflows
  and build-test workflow equal original reviewed ci: qualify membership performance on isolated Linux runners #251.
• Both complete manifests and locks equal master except coordinated
  0.55.65 version fields. Zero non-root drift.
• Both complete npm ls --all --json inventories EXIT 0. Physical dependency
  graphs are unchanged from validated 0.55.64, so no redundant restore.
• All 58 constituents remain ancestors. Resolution preserves 32 strictly
  version-only hunks and five narrative unions, without local npm lock
  generation, rebase, squash, amend, force or hook bypass.
• Fresh independent read-only review of exact ff2d2377 against cffc64c8
  found no significant introduced defects. Original unchanged
  performance implementation was not re-reviewed; no tests, installs,
  inventories or independent artifact download were performed by reviewer.
• Final PREPUSH_MODE=Validate; git push origin HEAD:refs/heads/fix/performance-qualification-20261022:
  PASS, 30/30 gates in 1421.3 seconds, exit 0.
  API 6,248/215 suites; HTTP 2,514/118 suites plus 42 existing
  skipped tests /2 suites; web 1,661/125 files; membership tools
  226 passed /2 explicit skips, zero failures. Existing worker warnings
  remain, with no deadline, worker, exclusion or forceExit changes.
• Clean-CI confirmation 40974518051:
  PASS at exact ff2d2377. Artifact 12942231169, raw ZIP SHA-256
  06c95c5dbaf4f2d03e2f9a4533db7e106c6a0f5002448fdb6d35fcd4702f5e03,
  authenticated before absolute-owned extraction. Both locks are
  byte-identical to exact committed Git blobs, with unchanged seven-day
  floor and zero changed packages. No import, new source commit, reinstall
  or duplicate protected run is needed.
• Ordinary exact-head runs all PASS: push Build Test Image
  40974486202, PR Build Test Image 40974493369, CodeQL 40974493333,
  docs freshness 40974493351. No historical source result is substituted.

Source integration does not clear the frozen 1.23928982 >1.10 failure,
customer-data/restore, cleanup 403, live/browser, operator-visual,
Windows/native-exit or final-artifact admission holds. Hono correction #262
is a separate pending boundary. No deployment or customer-production action.
The PR is now ready after the independent technical review and protected
validation. Existing draft guards previously skipped historical-image
campaigns; those skips are not performance proof. The readiness transition
started qualification 40974749991, native function diagnostic 40974749988
and CPU timeline diagnostic 40974750064 at exact ff2d2377.
Qualification FAIL; both diagnostics PASS; PR remains unmerged.

Qualification stopped after its first same-image 0.55.58 control, not a
0.55.65 or final merged-image comparison. Independent nearest-rank
recomputation of all 16,000 raw timings reproduces all 12 comparisons:

Failed control	Pseudo-baseline ms	Pseudo-candidate ms	Ratio
Populated read p95	4.107535	2.727228	0.66395734
Remove member p95	35.750806	39.378554	1.10147318
Empty read p95	6.665426	3.480782	0.52221448

Unchanged accepted interval: 1/1.10 through 1.10 for these A/A controls.
Faster values below the reciprocal floor also fail repeatability. Later
blocks did not run; neither a product regression nor product safety follows.
Four resource receipts confirm the identical pinned image ID, 0.5 CPU,
1 GiB and no OOM. Functional/privacy receipts report 66 assertions and
200 validated rows; exact cleanup/finalization receipts pass.

Artifact 12941578735 was authenticated against raw ZIP SHA-256
54c8ad00591794b2fabb4288da290fba434cc762d87f57e21cd92064ded787ad.
The actual PR checkout is synthetic merge
14f5d546dbf985df8c88347db7e1ffe3656f180d; its entire tree equals
ff2d2377. All five source hashes match exact source checkout bytes:
the committed .gitattributes explicitly requires CRLF for PowerShell;
the other three receipts match committed bytes. Changed-content negative
controls reject all five mutations. No archive authentication was normalized.

Both diagnostic archives were also SHA-256 authenticated before extraction.
Repository analyzers recomputed their complete summaries exactly on isolated
derived copies, leaving original extracted evidence untouched. Native
analysis covers 17,628 request spans and two complete profiles. CPU analysis
retains 59,427 observations; 150/168 p99-tail spans contain an interior
CPU-group throttling-counter increase. This is temporal association, not
causal delay. Different hosted CPU models and profiled Node versions prevent
an application-only causal or profiler-overhead claim.

No benchmark rerun, threshold change, merge, deployment or admission.
Any future measurement design must account for the already completed
23 October fresh/reused application-history diagnostic. A new read-only
verifier checks its anchored manifest, ten frozen source files, sixteen
receipt hashes/process epochs and all 64,000 timings. All 48 descriptive
comparisons are retained: fresh BAAB/ABBA each have three values outside
the original interval, reused BAAB/ABBA have twelve/four. These Windows-client
instrumented observations are not admission results. App restart alone is
not an untested remedy; the draft repeat-pilot proposal was superseded
before source editing or allocation. PostgreSQL restart was not tested.
The verifier has assertion-level RED then 12/12 GREEN, including byte,
epoch, resource, sample and CLI overwrite controls. It is session-local
evidence tooling, not a new repository feature or experiment.
This source union is not permission to silently redefine admission. Final
merged-artifact qualification remains independent. Detailed receipt
verification is not a new inspection of destroyed hosted resources.

The current independent review receipt is published at
comment 6511131008.
All nine historical review threads are resolved, with no further page.

Self-improvement applied: explicit source/graph/ancestry preservation and
AC-9's strict committed-byte versus CRLF-checkout verification distinction.
Design disposition accepted: ordinary integration, no new serving
responsibility or speculative abstraction. Review is independently executed
automated technical evidence, not a fabricated human or GitHub approval.

Historical ordinary source consolidation before advisory merges

Current ordinary source consolidation (2026-10-29), candidate 0.55.65.
Exact tip: 6fe4d2e21f7ba5dd2d0481c600339ba5995e045c. Preserve original head
e5e107f5b6882d2e71c8015adbeb16e89d8b3524 through normal merge
ffc2552832e3f80b1bbdcc14cb6baad2db630660, whose second parent is current
master 727860866c53c7ec8d01d1ff5bae858f80a1715d.
All 58 preserved constituent commits remain ancestors. Only five documentation
conflicts needed resolution; both histories are retained. Runtime, Prisma,
UI source, request-body security patches, logging fixture fixes, TTL settings,
production URL GIN index and stopped authentication-advertisement work match master.
The performance source, frozen protocol and prior review fixes match the old head.
Independent drafts #259/.62, #260/.63 and #261/.64 are not included or modified.

The final normal protected Validate push passes 30/30 gates in 1306.4
seconds. Source bootstrap separately passed 30/30 in 1,126.6 seconds.
No manual full suite was repeated immediately before the hooks.
Clean-CI lock run 40936685877
authenticates exact source ffc25528, artifact 12925301374, archive digest
sha256:55c3e768993862fa1a3b34b4af9b4684d9869bc2c503ab666ed13125fb7c8c06.
Only four root-version fields change .61 -> .65; every package entry, dependency
graph, public registry host and SHA-512 integrity stays identical. The existing
seven-day report contains zero changed package versions. There is no local lock
generation, package-policy change or independent advisory-patch adoption.

Bounded actual review pagination returns nine resolved threads with all comments
captured and no next page. No threads were blanket marked addressed.
The 21 historical reviews are not approval of this new tip.
One ordinary new-tip Copilot review request is recorded separately; current state:
One ordinary request returned exit 0, but the actual state has no pending reviewer and no exact-tip review. Independent review remains missing; this acknowledgment is not approval.. This PR remains OPEN / DRAFT. No merge or ready transition.

Remaining holds: full API npm ls --all --json still exits 1 with the three
existing override-context errors (debug, get-intrinsic, call-bind-apply-helpers).
That report is retained, not filtered or fixed by copying #260. The frozen run
39875689201 remains FAILED, with populated-read p99 ratio 1.23928982 > 1.10.
Cleanup HTTP 403 is not CLEANED. Native Windows worker shutdown remains unresolved.
No new benchmark, local/live app or database, Docker operation, deployment,
promotion, latest-tag push, customer-data restoration, operator visual receipt,
performance qualification or artifact/release admission occurred.

Current receipts and complete logs:
test-results/performance-master-integration-20261029/HANDOFF.md.
Self-improvement: applied explicit two-parent, source-boundary and dependency-graph
preservation checks. Design/architecture disposition: accepted, because no
runtime responsibility grows and an abstraction would be speculative.

Historical preserved implementation and review narrative

The following source-time measurements, reviews and corrections are retained
as history. They do not replace the current-tip results and holds above.

Historical exact-tip checkpoint: f6f03a52 is published through all 28 ordinary
Validate gates. Fresh review 5622420148 has no code findings or inline
comments; all six existing threads are resolved. It still asks for final
human review, which is not claimed here. Native 39875689138 and timeline
39875689169 PASS and independently audit exactly, including the new
same-record privacy proof. Qualification 39875689201 remains FAIL:
identical 0.55.58 images have populated-read 99th-percentile latency
40.650743 ms versus 50.378052 ms, ratio 1.23928982 (+23.93%), outside the
unchanged 1.10 stability ceiling. Five source hashes, four resource receipts,
16,000 timings and all 12 nearest-rank comparisons independently verify.
Later blocks correctly do not run. No threshold waiver, favorable benchmark
retry, release admission, merge or deployment follows.

Add a bounded prospective membership-performance qualification on existing
public Linux Actions runners, without changing serving code or deploying.

The current 0.55.58 artifact from merged PR #250 has a complete passing
correctness matrix but failed the original Windows/Docker performance
admission. Opposite order passed; identical-image control flagged eight of
twelve comparisons. Preserve those receipts. Do not reinterpret a code-free
false-regression flag as proof that the candidate is safe.

This separate tooling change freezes BAAB and ABBA same-image controls before
either old/current comparison. Every block preserves the original twelve
+10% ceilings, 0.5 CPU / 1 GiB, 100 warmup and 1,000 measured complete
lifecycle cycles per round. A/A additionally checks reciprocal agreement.
Any failure stops later blocks, with no automatic retries or sample removal.
It is at most sixteen rounds, not the unapproved 128-round design campaign.

All app/PG/client images are immutable; raw timings, actual cgroup settings,
source/image identity, functional/privacy and cleanup evidence are retained.
The workflow has contents-read permission only. No Azure credentials,
customer data, newly provisioned paid host, package publication or deployment
command is present. The two passing controls, if observed, do not estimate a
statistical false-failure rate or prove customer capacity.

Hosted review 5614222330 identified three relevant issues on the initial
tip. Corrections preserve final PostgreSQL TCP readiness, explicit partial
FAIL receipts and copy-before-rejection, plus cleanup/upload headroom:
60-minute cooperative work deadline, 65-minute step and 75-minute job.
Checkout/tests/upload caps are 2/3/4 minutes. No sample policy or performance
threshold changed. Source 216d3961 is preserved; its intermediate hook was
deliberately stopped to batch all findings, not treated as passing.

Corrected Linux run 39784232793 on 23d23220 completes the first A/A
block, but five of twelve control limits fail: three exceed +10% and two
fall below the reciprocal floor. All 16,000 timings, 66 functional assertions,
200 private-log checks and exact owned cleanup are retained. Both labels use
the same current image. No second control or actual old/current block runs.
The host move alone did not establish repeatability; this is not proof of
either candidate regression or safety.

Fresh review 5614795378 confirms the three original fixes and finds one
previously missed resource-evidence path. Local correction 117d5b1e writes
an explicit complete/partial resource receipt before failure and cleanup.
Eight actual-round/cleanup controls cover memory/RSS boundaries, OOM,
unavailable probes and deadline expiry; already collected before-counters
also survive a failed client. Actual A/A and A/B identity/order selection
is tested independently, without claiming unexecuted measurements ran.
All 26 focused tests pass. Normal publication passes all 28 Validate gates,
and the remote head is verified at 117d5b1e. Fresh exact-tip review
5615359957 reports no open code issues; its execution-assurance caveat is
answered with the retained new-source evidence, not claimed as human approval.
Automatic exact-new-source Linux run 39790526704 also fails its first A/A
control (add p99 +11.95%, remove p99 +14.86%). Its four new resource receipts
exactly match the retained rows after cleanup. It is not a manual retry or
a claim that either previous A/A failure was fixed.
No performance-limit, workload, image or serving change is made.

New source a7e51d10 adds a diagnostic-only lane, not another admission:
one same-image BAAB block records client monotonic spans and a bounded
exact-owned host cgroup observer. Preserve every original sample, observer
cost, read windows and coverage gaps. Counter association is not request-
specific causal delay. Diagnostic-marked rows and clients cannot enter
normal qualification. Both workflows share one concurrency group; the
diagnostic has read-only permission and no cloud/deployment authority.
All 44 focused contracts pass after RED. Normal protected publication passes
all 28 Validate gates in 1101.7 seconds. Exact-source Linux diagnostic
39799891906 succeeds; all seven checkout-source hashes, 17,628 spans,
16,000 timings, 44,489 CPU observations and its exact recomputation verify.
Of 168 p99-tail spans, 142 have interior app-group throttle-counter increases;
none of these tail spans lacks sampling coverage. This is temporal
association, not request-specific causal delay. Observer cost is 0.55-0.70
CPU seconds per round and maximum gaps are 4.98-6.72 ms.
Fresh review 5616280374 reports no open issues; its missing-execution caveat
is now answered by that artifact. Human review is not invented.
The paired untraced qualification 39799892493 fails three first-control
limits. Eight other checks pass; GitHub's qualify check still reports
IN_PROGRESS even though its benchmark step failed, all job steps completed
and the workflow API reports completed/failure. That publication inconsistency
cannot become green. Original A/A failures remain failed and block admission.

Source 8f4e1697 adds one explicitly non-admitting old/current native-function
BAAB diagnostic. Only app Node is instrumented, not migrations or ordinary
qualification. Both real processes retain their first/second visits under
unchanged quotas and workload. Before any profiler exit signal, require both
exact-run ownership and a native-profiler label. Collect already-exited
evidence before rejecting exit status, attempt both role captures before
cleanup even if one fails, and preserve partial capture receipts.
The analyzer requires original protocol/image/runtime/container identities,
all 17,628 ordered spans, all 16,000 original timings and privacy/cleanup.
Function observations are unweighted; wall-clock gaps are not CPU time.
Whole-process startup/idle/privacy work and different bundled Node versions
remain explicit confounders, not application-only causal conclusions.
All 68 focused contracts pass. Real network-disabled frozen-image collector/
bootstrap probes pass on Node v24.20.0 and v24.22.1, with exact cleanup.
These are capability probes, not SCIM performance comparisons.
Exact-source Linux application execution and fresh review are still pending.
Published tip is 5c60e41c, retaining implementation 8f4e1697. The first
protected attempt is correctly blocked by a Web worker-startup error: 123 files/
1,653 assertions complete, two tests never start. Their focused run passes,
but that does not replace the gate. With test configuration unchanged, the
second ordinary Validate push passes all 28 gates in 991.4 seconds, including
the complete 124-file/1,655-test Web suite. The original failure remains
retained; underlying resource-pressure cause is unproven and tracked.

Fresh review 5617819970 identifies two relevant issues on 5c60e41c.
Both are corrected and published in 30fbea59, preserving all constituent
commits. Every shared-group participant uses documented queue: max;
GitHub accepts one running diagnostic plus two retained pending lanes.
Native hashing is a sibling of timeline mode, and real 5/7/9 source-key/
SHA-256-value controls cover all three modes. All 71 focused tests pass.
The queue-only intermediate hook was stopped to batch the newly confirmed
hash fix, not counted as a passing publication. Final normal Validate push
passes all 28 gates in 1205.1 seconds, with complete 1655/124 Web execution.
Both new inline threads are answered with exact evidence and resolved.
Fresh exact-tip review 5618294791 reports no open code issues.
Actual Linux native run 39822577851 retains both complete profiles and all
four BAAB rounds, then fails analysis on two baseline -2 microsecond steps.
The consumer's monotonic-step assumption does not match the official DevTools
handling of reconstructed timestamps. RED-first correction validates every
cumulative timestamp, reports reorder count/maximum backward step and preserves
all unweighted observations. It also prints a bounded causal CLI error.
All 72 focused tests pass, including intermediate bounds with a valid final sum.
Separate replay verifies all nine exact producer hashes, four resource/client
receipts, privacy/cleanup, 17,628 spans and 16,000 timings, recording the corrected
consumer hash separately. The original campaign remains FAIL, unchanged.
New-source protected publication and execution remain required.
Signed-clock fix 58f06800 is preserved; first full Validate push is blocked
after 25 passing gates because the new shell lacks DATABASE_URL for Prisma
configuration loading. Migration lint and Web tests do not run. Unchanged
generation passes with an explicit synthetic codegen-only loopback URL.
Follow-up 9378e765 documents the gate prerequisite and full available
continuation RCA reconciliation; no serving default or hook change is made.
The second full protected push passes 27 gates but fails Web startup: four
files /47 tests do not execute. They pass unchanged in focused runs, which
does not replace a complete suite. An initial scratch observer itself changed
IPC buffering; a delayed-listener baseline/RED/GREEN control fixes that probe.
The corrected diagnostic completes all 124 handshakes and 1,655 tests, maximum
startup 17.476 seconds, without reproducing the ordinary failure.
Keep that intermittent issue open and all failed/diagnostic evidence separate.
Follow-up 8d86bbfd records the limits. Its ordinary full Validate push,
explicitly without observer preload or gate relaxation, is also blocked:
23 gates pass, then API units report one nested real-timezone Jest child
deadline (30,103 ms elapsed against the unchanged 30,000 ms bound).
The other 6,209 assertions /212 suites pass; later gates do not run.
The exact parent case passes in isolation in 18.54 seconds, not full admission.
Stop blind complete-suite retries and retain all three failed attempts.
Earlier local checkpoint 0cb86f1b preserves the source correction, RCA, gate comments
and current context. Its documentation freshness audit passes all 27 documents
and PowerShell parsing passes. The remote remains 30fbea59; none of the four
new local commits is claimed published or exact-source CI-verified.

Autonomous follow-up 84d11af7 removes only redundant nested Jest startup.
A fresh Node process uses existing ts-node and the actual endpoint service
with mocked PostgreSQL snapshot data. Parent assertions validate exact runner,
non-UTC offset, one snapshot read and both returned UTC fields.
The old runner is confirmed RED for missing structured receipt; all21 cases
then pass. Reversing actual production UTC interpretation makes both fields
incorrectly05:00Z and the new assertion fails; production is restored unchanged
and all21 cases pass again. Targeted lint/syntax pass. Keep the30s child/35s
parent bounds, original workers, tests and ordinary protected hook.
One direct child invocation is2720.8ms, not a full-load guarantee.
The new complete ordinary Validate push succeeds on 84d11af7: all 28 gates
PASS in 1104 seconds, exit 0, without observer preload or hook bypass.
API units: 6210 tests / 213 suites. HTTP: 2514 tests / 118 passing suites,
with the existing 42 backend-specific cases and two log suites skipped.
Web: all 1655 tests / 124 files pass. Local and remote tips match exactly;
the worktree is clean. All five existing review threads remain resolved;
fresh Copilot review has been requested on this published tip.
Exact-tip CI is running. Qualification 39840296611 runs first; native
39840296709 and timeline 39840296989 are retained pending in the shared
queue. Their outcomes are not yet claimed. Prior failures remain retained;
the intermittent ordinary Web startup cause remains unproven.
No serving change, version bump, merge, deployment or admission is claimed.

Fresh exact-tip review 5619805016 identifies one relevant additional finding:
a failed profile copy skips available bootstrap metadata before container
cleanup. Local correction e312a92f attempts both files independently,
propagates the first error/stage and keeps incomplete capture failed.
The actual collector is RED in two controls before correction; all 74 focused
workflow contracts then pass. Both asymmetric failures assert retained file
contents, and the both-failure case asserts that both attempts occurred.
Normal complete Validate publication of e312a92f succeeds: all 28 gates
PASS, 1092 seconds, exit 0. API units 6210/213, HTTP 2514/118 with the
unchanged 42 backend-specific skips, Web 1655/124 PASS. Local and remote
tips match and the worktree is clean. Fresh exact-tip review is requested.
Native 39844751546 is running; qualification 39844751652 and timeline
39844751715 are retained pending in the shared queue. No unexecuted result
or human approval is claimed.

Exact 84d11af7 native run 39840296709 succeeds. Independent audit verifies
nine checkout-source hashes, four receipts, 17,628 spans, 16,000 timings,
profile/runtime identity, privacy, cleanup and exact analyzer recomputation.
Timeline 39840296989 also succeeds and independently recomputes.
Qualification 39840296611 fails first-control populated-read p99 ratio
1.10065341 and empty-read p99 ratio 0.74715670; all twelve assessment checks
exactly recompute. Diagnostic success does not clear this failure.

Fresh review 5620142839 on e312a92f identifies earlier signal/shutdown
failures that bypass collection. Local correction 35b66b36 captures the
first authorized lifecycle error, re-inspects once after a failed signal,
records secondary inspection failure and independently attempts both files
before propagating the original error/stage. Partial copied evidence stays
FAIL; unknown exit remains null; unauthorized profiles are not collected.
Five actual lifecycle controls are RED, then all 77 workflow contracts PASS.
Tests clear the source store before verifying retained file contents.
ER-68o records the gap, fix and promoted standing contract. The complete
ordinary Validate push succeeds on 35b66b36: all 28 gates PASS in 1248.5
seconds, exit 0. API units 6210/213, HTTP 2514/118 with unchanged 42 backend
skips, Web 1655/124 PASS. Local/remote tips match, worktree clean.
Fresh exact-tip review is requested. Native 39849505885 is running;
qualification 39849505902 and timeline 39849506242 are retained pending.
No unexecuted CI result is assumed.

Exact e312a92f native 39844751546 separately fails negative-path categorized
console correlation, retaining both profiles with incomplete-work receipts.
Raw private/console logs are intentionally not exported; the exact failed
predicate and root cause remain unproven (ER-68p). Qualification
39844751652 fails, while timeline 39844751715 succeeds. No check is dropped
and no unchanged manual measurement retry or deployment occurs.

Fresh review 5620551104 on 35b66b36 identifies three relevant runner gaps.
Correction abbcce07 drains logs via the existing authenticated endpoint
instead of a two-second sleep before a three-second default flush, persists
sanitized partial privacy counts/stages/independent correlation predicates,
and preserves primary work errors through capture/cleanup failures.
Both analyzers now share the original native privacy guard; actual timeline
controls reject missing/failed privacy proof. Injected receipt-write failures
also preserve a prior error and explicitly warn when no receipt is durable.
No raw log, credential, request-ID or exception text enters privacy receipts.
Original 12 review controls, two analyzer cases and two write-precedence
controls are RED first; all 93 focused workflow contracts then PASS.
The full normal Validate-protected push of abbcce07 succeeds: all 28 gates
PASS, 1171.7 seconds, exit 0. API units 6210/213, HTTP 2514/118 with unchanged
42 backend-specific skips, Web 1655/124 PASS. Local/remote match, worktree clean.
Subsequent exact-tip review is 5620999429. Timeline 39855401180 and native
39855401567 pass and independently audit with seven/nine producer hashes,
four receipts, 17,628 spans, 16,000 timings and exact recomputation.
Qualification 39855403223 fails its first A/A control: populated-read p99
ratio 1.5758701207231616 and remove p99 ratio 0.8481296005871589. Five producer
hashes and all twelve recomputed checks match; original privacy, resources,
finalization and cleanup verify. These artifacts prove their original
whole-capture correlation contract, not the new same-record requirement.
Prior 35b66b36 native 39849505885 independently audits PASS with all nine
source hashes, four receipts, 17,628 spans and 16,000 timings. Its timeline
also passes; qualification still fails. Neither diagnostic nor the buffered
fixture retroactively explains the unknown predicate in failed ER-68p.
Untraced 39822577951 fails its first A/A block: add p99 ratio 1.14944754
and empty-read p99 ratio 0.83167868. Exact evaluator recomputation matches
all twelve checks. No admission, version bump, merge or deployment follows.

Review 5620999429 contains four relevant findings despite its headline.
Correction 6a710734 independently attempts client receipt retrieval after
exit-status inspection/writer failure, preserves the first round error across
observer/resource finalization, requires the selected negative request ID and
top-level category in one real console record, and always restores original
environment values after campaign receipt failure. A final writer failure
after otherwise successful work still fails and cannot print success.
Nine substantive controls first fail; one additional initial failure is
explicitly identified as a fixture-context issue, not a production defect.
All 104 focused contracts pass, zero skips. Corrected lexical campaign tests
also reverse-check exact unmodified abbcce07: both writer defects reproduce
and ordinary work-error handling passes; all three cases pass on current code.
ER-68w-ac records these fixes, the audit-report provenance correction and
fixture lessons. The existing bounded coordinator is 396 lines; no speculative
workflow framework, serving change, quota/workload/threshold change or version
bump. Ordinary Validate-protected publication succeeds: all 28 gates PASS
in 1229.7 seconds, exit 0; local and remote exact tips match with clean source.
API 6210/213, hook HTTP 2514/118 plus the unchanged 42 backend-specific
exclusions/two log suites outside the subset, and complete Web 1655/124 PASS.
Fresh exact-tip review requested. New-source qualification 39861215762
is active; native 39861215972 and timeline 39861215862 are queued.
No merge, deployment or release admission.

Linked Defect / Plan Reference

Current correction f6f03a52 addresses exact-tip review 5621836110.
All three 6febc534 Linux lanes pass contracts and four full rounds, then
fail the privacy guard, not a latency ceiling: real Group PATCH logs use
scim.patch while the guard and invented fixtures require scim.group.
An isolated frozen-image 66-outcome probe proves the selected request has
one PATCH-category record and zero Group-category records. The actual
corrected guard passes another bounded private contract, with exact cleanup
and no raw-log/request-ID export. Correct only the three category predicates;
retain same-record matching, JSON root checks, redaction and fail-closed
receipts. Ten controls are RED first; all110 focused tests PASS and the
Linux bridge passes15 actual PowerShell privacy cases plus1 Node producer
mapping guard. ER-68ah-ai, permanent wrong-domain cases, the producer guard
and standing fixture-fidelity rule record the lesson. Published through all28
normal Validate gates in1522.1seconds, exit0; exactlocal/remotetips match and
tracked source is clean. Retain the first27PASS/1WebFAIL push and focused19PASS;
the single unchanged normal retry does not close the worker-startup cause.
Fresh exact-tip review has no code findings; native/timeline PASS and
qualification fails the same-image stability limit, as summarized above.
No image/workload/
quota/threshold/serving/version change or performance admission.

Current follow-up 6febc534 addresses fresh review 5621417287, comment
4354001080, and the exact 6a710734 Linux contract failure. All three prior
Linux lanes fail only the campaign restoration controls before allocating
benchmarks (qualification45/48, timeline63/66, native101/104); no new timings
exist and their upload failures are cascades. Windows PowerShell7.4.21/.NET8
does not expose .NET9's empty-versus-null difference. A pinned official Linux
PowerShell7.5.0/.NET9.0.1 reproduction confirms ordinary null leaves an empty
variable, whereas typed null removes it. Restore originally absent variables
with typed null and preserve real empty values separately.

The leaf profile collector now preserves its first ownership/capture error
through a failed status writer, explicitly warns about the missing receipt
and still throws a writer-only failure. Two combined cases first fail.
All107 focused contracts PASS; six actual Linux PowerShell executions with
mocked Docker/IO also PASS after three Linux restoration RED cases.
RCA ER-68ad-ag and the existing standing rules capture the runtime and leaf-
writer lessons. Published through all28 ordinary Validate gates in1184.5s,
exit0, with local/remote tips identical and tracked source clean. New exact-tip
CI is running/queued; fresh review remains required. No product bump,
serving/image/workload/quota/limit change, merge or deployment.

• DELIVERY_PLAN.md defect ID: N/A, continuation of the exact-image performance hold.
• Audit doc reference: docs/ENDPOINT_SNAPSHOT_REVISION.md, prospective Linux performance qualification / ER-62.
• ADR (if applicable): N/A, no serving architecture decision.

TDD Process

• RED test written first; observed it fail for the expected reason
• GREEN: minimal implementation that turns the test green
• Refactor (if any) keeps the test green
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/)

RED receipts show the missing evaluator assertion and the exact PowerShell
$role: interpolation error and six resource-receipt losses before cleanup.
110 permanent Node tests now pass across three files, including
actual analyzer CLI/provenance controls, real observer success/failure/deadline
and PowerShell subprocess lifecycle, plus actual diagnostic/admission
mode isolation. Initial diagnostic RED is 25 PASS / 9 FAIL; additional
assurance RED exposes missing clock/cost validation and failure-stage
reporting. ER-67 records the local delimiter and Windows startup fixes.
The native diagnostic workflow runs all three files before Docker allocation.
Native-specific REDs reproduce the missing parser/CLI/selection/capture
behavior, already-exited loss and signal authorization gap. The actual
runner finally proves a first capture failure cannot skip the other role
or exact cleanup. Launch tests separate profiled app startup from migrations.
ER-68 records capture/fixture issues and the complete available continuation's
signal/narration reconciliation; the deleted original transcript is not claimed.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior. API service/controller N/A; 226 passing Node tooling cases plus 2 explicit local-evidence skips cover the consolidated collection. Earlier 110-case measurements remain historical below.
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP. API behavior N/A; real local HTTP client tests verify all 4,407 requests, complete sample arrays, incorrect readback failure and fixture deletion.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure. New serving section N/A; the qualification itself executes unchanged lifecycle checks and the existing 66-outcome group contract against pinned disposable images.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage. Existing feature/RCA doc expanded with explicit flow, table, worked decisions, limitations and ER-62; no Mermaid block edited.
• INDEX.md Update - add the new doc reference to docs/INDEX.md. N/A, existing indexed document extended, no new feature doc.
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md
• Version Management - bump api/package.json (and any other version refs) when behavior changed. Integration candidate is 0.55.65 with CI-authenticated version-only locks; the frozen historical experiment still pins 0.55.58.
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live). N/A, no response contract changes.

Validation Output

Current source-integration validation

All commands use the owned worktree. Complete logs are retained beside HANDOFF.md.
No new serving behavior is introduced; the earlier TDD boxes describe preserved
behavioral corrections, not a newly invented integration RED/GREEN cycle.

Exact command	Observed result
api: npm test -- --runInBand --runTestsByPath src/modules/logging/log-config.controller.spec.ts src/modules/logging/logging-auto-prune.spec.ts src/scripts/check-dependency-pins.spec.ts	PASS, 3 suites / 111 tests
node --test --test-reporter=tap scripts\test\membership-tool-gates.test.cjs scripts\test\membership-privacy-reference.test.cjs	PASS, 14 pass / one explicit external-evidence skip
node test-results\performance-master-integration-20261029\preservation-preflight.cjs	PASS, master source / preserved tooling / minimal graph proof
api: npm ls --all --json	FAIL, exit 1 / three pre-existing invalid override contexts; not waived
PREPUSH_MODE=Validate; git push origin HEAD:refs/heads/fix/performance-qualification-20261022	PASS, final 30/30 gates in 1306.4s
api: npm test through protected hook	PASS, 6220 tests / 213 suites
api: npm run test:e2e -- --maxWorkers=2 --testPathIgnorePatterns 'endpoint-scoped-logs.e2e-spec.ts' --testPathIgnorePatterns 'log-config.e2e-spec.ts' through protected hook	PASS, 2514 tests / 118 suites; 42 tests / two existing suites skipped
web: npm test -- --maxWorkers=2 through protected hook	PASS, 1655 tests / 124 files, complete configured collection
Hook-selected complete scripts\test\membership-*.test.cjs collection	PASS, 226 / 2 explicit skips / zero failures
api: npm run lint through protected hook	PASS, zero errors / 507 existing warnings
web: npx tsc --noEmit through protected hook	66 existing errors, within unchanged 96-error ratchet; not zero errors
gh workflow run regen-lockfile.yml --repo pranems/SCIMServer --ref fix/performance-qualification-20261022 -f workspace=both	PASS, source-authenticated run 40936685877, zero changed package entries

Exact-tip CI, source 6fe4d2e21f7ba5dd2d0481c600339ba5995e045c

Run	Workflow	Event	Result
40940436015	Docs freshness	pull_request	success
40940435895	CodeQL	pull_request	success
40940435891	Membership native function diagnostic	pull_request	skipped
40940436042	Membership performance qualification	pull_request	skipped
40940435963	Membership CPU timeline diagnostic	pull_request	skipped
40940435881	Build Test Image	pull_request	success
40940424271	Build Test Image	push	success

Draft campaign skips allocate no benchmark runner and are not performance
qualification. Ordinary CI green does not remove any release hold above.

Historical validation receipts (unchanged)

Current PATCH-category correction (f6f03a52):
  node --test --test-reporter=tap scripts\test\membership-performance.test.cjs scripts\test\membership-cpu-trace.test.cjs scripts\test\membership-v8-profile.test.cjs
  PASS:110 tests, zero failures/skips; final production-shaped fixtures.
  node --test-reporter=tap --test-name-pattern='privacy fixtures|actual privacy phase' test-results\run-qualification-linux-env.cjs
  PASS:16 tests=15 actual Linux PowerShell privacy cases+1 Node producer guard.
  pwsh -NoProfile -File test-results\probe-negative-log-categories.ps1
  PASS:actual corrected guard and66functional outcomes on isolated frozen
  0.55.58containers; exact cleanup, no raw logs/IDs exported.
  This Windows Docker diagnostic is not Linux performance qualification.
  PREPUSH_MODE=Validate git push origin HEAD:
  PASS:28/28 normal full protected gates,1522.1seconds,exit0.
  API6210/213;HTTP2514/118 with42unchangedskips/2suiteexclusions;
  Web1655/124 complete. Exactlocal/remotetips matchf6f03a52; sourceclean.
  FirstpushFAIL27PASS/1WebFAIL/1634.6s;2workers/19tests neverexecute.
  Unchangedfocused2files/19PASS/23.1s, then one normal full retryPASS.
  No worker/timeouts/config/hook changes; startup cause remains open.
  Native39875689138 PASS:9sourcehashes/4resources/17628spans/16000timings,
  exactanalyzerrecomputation and sameRecordPresent=true.
  Timeline39875689169 PASS:7hashes/17628spans/16000timings/49664observations,
  exactrecomputation and requiredsame-recordprivacyproof.
  Qualification39875689201 FAIL firstaa-baab:populatedReadp99ratio
  1.2392898206067746. Independentaudit:5hashes/4resources/16000timings,
  all12comparisons exactly recomputed. Laterblocksnotrun; noadmission.
  Bothimagebuildworkflows,CodeQL,docsfreshnessPASS.
  Freshreview5622420148:no code/inlinefindings;6threadsresolved,
  finalhumanreviewrequested, notfabricated.

Prior Linux and leaf-writer correction (6febc534):
  node --test --test-reporter=tap scripts\test\membership-performance.test.cjs scripts\test\membership-cpu-trace.test.cjs scripts\test\membership-v8-profile.test.cjs
  PASS:107 tests, zero failures/skips.
  node --test-reporter=tap --test-name-pattern='actual campaign restores environment|actual native profile capture.*write-failure' test-results\run-qualification-linux-env.cjs
  PASS:6 actual Linux PowerShell controls with mocked Docker/IO.
  Official pinned test runtime:PowerShell7.5.0/.NET9.0.1, read-only source,
  no network, exact-run fixture container removal verified.
  Linux restoration RED:3cases; combined capture/status-writer RED:2cases.
  Original empty-value identity and first-error messages are asserted.
  PREPUSH_MODE=Validate git push origin HEAD:
  PASS:28/28 normal protected gates,1184.5s,exit0; no bypass.
  Local/remote tips match6febc534; tracked worktree clean.
  Exact-source qualification39866153855, timeline39866153917,
  native39866153894 FAIL post-round correlation; no latency assessment.
  Freshreview5621836110 finds the wrong-category issue now corrected above.

Prior layered finalization correction (6a710734):
  node --test --test-reporter=tap scripts\test\membership-performance.test.cjs scripts\test\membership-cpu-trace.test.cjs scripts\test\membership-v8-profile.test.cjs
  PASS:104 contracts, zero failures/skips.
  node --test --test-reporter=tap --test-name-pattern='actual campaign restores environment' scripts\test\membership-performance.test.cjs
  PASS:3 actual campaign controls after fixture-context correction/formatting.
  Reverse check against exact parent from Git, without replacing production:
  EXPECTED RED:2 original writer defects; ordinary work-failure control PASS.
  git diff --check PASS; added-line em-dash check clean.
  $env:DATABASE_URL='postgresql://codegen_only:unused@127.0.0.1:1/codegen_only'
  $env:PREPUSH_MODE='Validate'
  git push origin HEAD
  PASS:28/28 gates, 1229.7seconds, exit0; no bypass or duplicate full suites.
  API units6210/213; HTTP2514/118 with42 genuine existing exclusions;
  two logging suites remain outside the hook subset; Web1655/124 complete.
  Local/remote exact tip6a710734fe0f4b65f0e6201040cdfe78d1a9b837, clean source.
  Fresh exact-tip review requested; Linux qualification39861215762 active,
  native39861215972 and timeline39861215862 queued. No admission claimed.

Focused Node contracts:
  node --test scripts\test\membership-performance.test.cjs
  PASS: 26 tests, including actual fail-stop/readiness/deadline/copy/resource
  orchestration, actual A/A/A-B identity/order selection and real HTTP
  complete/partial evidence after measurement/cleanup failures.

Infrastructure documentation:
  pwsh -NoProfile -File scripts\audit-deployment-doc.ps1 -BaseRef origin/master
  PASS: coverage, freshness and declared elements.

Workflow YAML:
  Parsed with the existing js-yaml dependency.
  PASS: syntax, contents-read permission, PR trigger and 75-minute cap.

Documentation:
  Literal JSON parser PASS: 1 block, 0 errors.
  git diff --cached --check PASS.

Initial protected publication (33c93e4e):
  $env:PREPUSH_MODE = 'Validate'
  git push --set-upstream origin fix/performance-qualification-20261022
  PASS: 28/28 gates, 1541.3 seconds, exit 0.
  API: 6210 units / 213 suites; 2514 hook HTTP / 118 passing suites.
  HTTP excludes 42 genuine backend-specific cases and two log suites.
  Web: 1655 tests / 124 files.
  API lint: 0 errors / unchanged 512 warnings.
  Prisma generation, all migration lint and documentation gates PASS.

Complete review-correction publication (23d23220):
  PASS: 28/28 Validate gates, 997 seconds, exit 0.
  6210 API units; 2514 hook HTTP with 42 genuine exclusions/two log suites
  outside this subset; 1655 Web tests. All build/type/lint/doc/Prisma gates PASS.

Additional resource-retention correction (117d5b1e):
  $env:PREPUSH_MODE = 'Validate'
  git push origin fix/performance-qualification-20261022
  PASS: 28/28 authoritative gates, exit 0; remote exact head verified.
  API units: 6210 / 213 suites.
  Hook HTTP: 2514 / 118 passing suites, 42 genuine exclusions;
  two logging suites remain outside this hook subset.
  Web: 1655 / 124 files.
  API lint: 0 errors / unchanged 512 warnings.
  node --test scripts\test\membership-performance.test.cjs
  PASS: 26 tests / zero failures / zero skips.
  git diff --cached --check PASS; added-line em-dash scan clean.
  Changed documentation literal JSON blocks: none; private checkpoints parse.

Prospective Linux benchmark:
  Initial run 39778828864 FAILS setup before timing.
  Zero blocks, artifact retained and exact-owned cleanup verified.
  Corrected-tip run 39784232793 FAILS its first same-image control.
  Four successful rounds, 17628 requests, 16000 timings, 5/12 control flags.
  Runtime/privacy/resource/cleanup controls pass; later blocks do not run.
  Raw reassessment exactly matches the original artifact.
  Automatic exact-new-source run 39790526704 FAILS first A/A control.
  Add p99 +11.95%, remove p99 +14.86%; both roles use the same current image.
  All four resource receipts match raw rows; privacy and exact cleanup PASS.
  Second A/A and both A/B blocks do not run.
  No manual rerun, admission or causal claim from the resource-only fix.
  No admission, deployment or customer-capacity PASS inferred.

Exact-tip review and CI (117d5b1e):
  Hosted review 5615359957: no open code issues.
  Original three inline threads verified resolved; no new inline finding.
  Review-body execution caveat answered with latest-source proof and limits.
  gh pr checks 251 --watch --interval 60
  Exit 1: seven checks PASS; qualify FAIL. Nothing pending at final check.
  No PR merge or deployment attempted through the failed qualification.

Diagnostic source (a7e51d10):
  node --test scripts\test\membership-performance.test.cjs scripts\test\membership-cpu-trace.test.cjs
  PASS: 44 tests, zero failures/skips.
  Diagnostic workflow YAML parses using existing js-yaml.
  PASS: 30-minute job, step caps total 29, contents-read permission,
  no deployment commands and shared qualification concurrency group.
  git diff --check PASS before commit.
  Normal Validate publication PASS: 28/28 gates, 1101.7 seconds, exit 0.
  API 6210 /213 suites; hook HTTP 2514 /118 passing suites plus42 genuine
  exclusions/two logging suites outside subset; Web 1655 /124 files.
  API lint remains 0 errors /512 warnings.
  Exact-source diagnostic 39799891906 PASS: source hashes, raw-span/sample
  mapping, CPU coverage, resources, privacy and exact cleanup independently
  checked; analyzer result recomputed exactly from an isolated scratch copy.
  Separate qualification 39799892493 FAIL: populated-read p95 -74.04%,
  remove p95 +13.69%, empty-read p95 -68.24%. All 16000 timings retained;
  original evaluator recomputation matches. Both labels use identical images.
  Fresh exact-tip review 5616280374: no open code issues.
  Check publication: eight PASS; qualify still IN_PROGRESS despite completed
  failed workflow and completed steps. No all-green or merge claim.
  Diagnostic completion can never authorize release admission.

Native function source (8f4e1697):
  node --test scripts\test\membership-performance.test.cjs scripts\test\membership-cpu-trace.test.cjs scripts\test\membership-v8-profile.test.cjs
  PASS: 68 tests, zero failures/skips.
  Real frozen-image collector/bootstrap probes PASS:
    baseline Node v24.20.0, 20905 samples, exit 0;
    candidate Node v24.22.1, 20805 samples, exit 0.
    Both clock-contained, strict-profile parsing and exact cleanup verified.
    Network-disabled synthetic Node, not SCIM application benchmarks.
  PowerShell AST syntax, workflow YAML and git diff --check PASS.
  First protected publication FAIL: 27 PASS, Web fork startup FAIL.
    123 files/1653 assertions completed; missing file passes 2 cases alone.
    No timeouts, worker counts, skips or exit conditions changed.
  Final source 5c60e41c:
    $env:PREPUSH_MODE = 'Validate'
    git push origin HEAD
    PASS: 28/28 gates, 991.4 seconds, exit 0; exact remote head verified.
    API units 6210/213; hook HTTP 2514/118 plus42 genuine exclusions
    and two logging suites outside subset; Web 1655/124, all complete.
  Exact-source Linux application profiles and fresh review: PENDING.

Fresh review correction (30fbea59):
  node --test scripts\test\membership-performance.test.cjs scripts\test\membership-cpu-trace.test.cjs scripts\test\membership-v8-profile.test.cjs
  PASS: 71 tests, zero failures/skips, including actual 5/7/9 source hashes.
  All three queue participant YAML configurations parse and match max/false.
  Normal PREPUSH_MODE=Validate git push origin HEAD:
  PASS: 28/28 gates, 1205.1 seconds, exit 0; clean exact remote tip verified.
  API 6210/213; hook HTTP 2514/118 plus42 genuine exclusions/two log suites
  outside subset; complete Web 1655/124.
  Both review 5617819970 inline threads resolved with evidence replies.
  GitHub scheduler accepts one active plus TWO pending membership workflows.
  Fresh exact-tip review 5618294791: no open code issues.
  Native 39822577851: raw captures complete, campaign FAIL at consumer.

Signed native-clock consumer correction:
  node --test scripts\test\membership-performance.test.cjs scripts\test\membership-cpu-trace.test.cjs scripts\test\membership-v8-profile.test.cjs
  PASS: 72 tests, zero failures/skips after two intended RED assertions.
  node test-results\verify-membership-native-artifact.cjs test-results\linux-native-39822577851\membership-function-diagnostic-39822577851-1 30fbea59125e3528b91f9a65507342003423472c test-results\membership-native-39822577851-audit.json test-results\membership-native-39822577851-reanalysis.json
  PASS: 9 original producer hashes, 4 receipts, 17628 spans, 16000 timings,
    privacy, cleanup and exact corrected-consumer replay.
    Original campaign FAIL preserved; derived output is diagnostic only.
  New-source protected push and Linux execution: PENDING.
  First signed-clock protected push: BLOCKED after 25 PASS by missing
    DATABASE_URL; no migration-lint/Web execution or complete-pass claim.
  cd api; npx --no-install prisma generate
  PASS with explicit synthetic codegen-only loopback URL in the caller.
  Second ordinary full push on 9378e765: BLOCKED, 27PASS/1FAIL.
    Four worker-startup errors; only120files/1608assertions execute.
    Focused omitted tests:47PASS, not a complete full-suitePASS.
  Corrected startup diagnostic:124files/1655testsPASS, all124 handshakes.
    Instrumented only; no admission and ordinary failure cause unproven.
  Third ordinary full PREPUSH_MODE=Validate push on 8d86bbfd: BLOCKED.
    23 gates PASS; API units have 6209 PASS /1 nested-child deadline failure.
    Exact focused parent case PASS in18.54s, not full-suite admission.
  pwsh -NoProfile -File scripts\audit-doc-freshness.ps1
  PASS: all27 documents at local checkpoint0cb86f1b.
  PowerShell parser: PASS for the gate-definition comments.
  New-source CI/review: NOT RUN because protected publication is blocked.

No duplicate application suites were manually run immediately before the
normal hook-owned Validate run. The existing complete merged-e1070ba2 matrix
is historical serving evidence, not a claim that this new workflow ran.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014).
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this.

Destructive Migration Override (skip if not applicable)

N/A, no migrations.

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  

Reviewer Hint

Diff areas worth special attention from the reviewer:

• Fixed schedule, full raw samples and unrounded nearest-rank calculations.
• No A/B after failed A/A; no second order after a failed comparison.
• One diagnostic block only; actual mode branch never calls the admission evaluator.
• Strict owned cgroup/PID, bounded observer shutdown and no inherited application secrets.
• Clock identity, full range, cost and raw sample mapping must be valid before analysis.
• Counter differences are app-wide temporal associations; short-span uncertainty remains explicit.
• Immutable identities, resource envelope, owned-resource cleanup and privacy.
• Existing within-block process history is preserved; client moves from
  Windows-host Node to the pinned candidate Node image on Linux host networking.
• New source is harness/CI only, independent of the frozen serving artifact.
• Native sampler observations are unweighted, never sample-gap CPU time.
• Both capture attempts precede cleanup, including first-capture failure.
• Migration and ordinary qualification must never inherit native instrumentation.
• Self-improvement applied through permanent evaluator/parser/fail-stop/HTTP
  contracts. Design disposition accepted: client, numerical evaluator and
  resource/order runner have distinct responsibilities; no general framework.

[Copilot]

🟡 Changes recommended

The hosted run fails before measurement, and failure-path evidence retention remains incomplete.

3 open issues

• Bound qualification runtime to reserve cleanup and artifact upload · New
• Persist partial failure receipts before discarding measured evidence · New
• Probe the final PostgreSQL listener instead of the initialization socket · New

What changed in this PR

Adds a tooling-only Linux performance qualification for the immutable 0.55.58 artifact from PR #250. It preserves the earlier failed admission without changing serving code or deploying.

Changes:

• Freezes same-image controls before old/current comparisons, preserving workload limits and fail-stop ordering.
• Adds a benchmark client, numerical evaluator, Docker runner, and 11 focused contracts.
• Documents the qualification protocol, evidence requirements, and limits.

File	Description
Session_starter.md	Records merged-artifact status and qualification context.
scripts/​test/​membership-performance.test.cjs	Tests evaluation, orchestration, parsing, and HTTP behavior.
scripts/​performance/​run-membership-qualification.ps1	Orchestrates isolated resources, rounds, checks, and cleanup.
scripts/​performance/​membership-protocol.json	Pins images, workload limits, and block order.
scripts/​performance/​benchmark-membership.cjs	Measures membership lifecycle requests and verifies readback.
scripts/​performance/​assess-membership.cjs	Validates receipts and evaluates percentile ceilings.
docs/​strategy/​ENGINEERING_LESSONS_AND_PATTERNS.md	Records prospective environment-control guidance.
docs/​ENDPOINT_SNAPSHOT_REVISION.md	Defines the protocol, rationale, and limitations.
docs/​DEPLOYMENT_INFRASTRUCTURE_AND_FORM_FACTORS.md	Documents the isolated Linux runner.
docs/​CONTEXT_INSTRUCTIONS.md	Updates performance-hold and qualification context.
CHANGELOG.md	Summarizes tooling and contract-test additions.
.github/​workflows/​performance-qualification.yml	Adds read-only qualification execution and artifact upload.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Resource-failure evidence retention needs correction, and the failed control leaves both old/current comparison paths unexecuted and requiring human review.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Preserve resource measurements when limits abort a round

scripts/​performance/​run-membership-qualification.ps1:195

If peak memory reaches 1 GiB or Node RSS reaches 384 MiB, this throws before saving the collected resource measurements to rounds.json. The client receipt preserves timings, but not CPU counters, peak memory, RSS or OOM state; the block's finally then removes the app. Save a separate failed resource receipt before throwing, without admitting the round or continuing the campaign. Add a resource-limit failure test that verifies these measurements survive cleanup.

3 resolved since last review

• Probe the final PostgreSQL listener instead of the initialization socket
• Persist partial failure receipts before discarding measured evidence
• Bound qualification runtime to reserve cleanup and artifact upload

_{Review effort: Balanced}

[pranems]

Addressed the additional relevant resource-evidence finding in review #251 (review), published normally in 117d5b1e6c0b41d7cc7315b8a64708537c5e2b5f.

The runner now begins an explicit resource receipt before its first counter probe and saves it in finally, before owned teardown. CPU/SQL before-and-after observations, peak memory, Node RSS and OOM state survive a limit rejection; missing later observations remain explicit nulls in a partial FAIL receipt. Client failure and deadline expiry also preserve the already collected before-counters. Failures propagate, no failed row enters admitted results, and no later round starts.

Six original missing-receipt controls reproduced RED. The complete focused suite now passes 26/26: eight actual round/actual cleanup scenarios, prior client/deadline/readiness checks, and actual pinned A/A/A-B identity/order selection. These tests assert exact recorded values after cleanup, not merely write-statement presence. The normal Validate push passes 28/28 gates, including 6,210 API units, 2,514 hook HTTP cases and 1,655 Web tests. Remote head and the clean worktree are verified. Fresh exact-tip hosted review has been requested.

The old/current execution gap remains explicit: the previous Linux run 39784232793 failed its first identical-image control (5/12 limits), so neither actual version comparison ran. Synthetic branch-selection coverage is not represented as live A/B evidence or human approval. Its 16,000 raw timings and successful privacy/cleanup receipts remain retained. Automatic CI run 39790526704 checks the corrected new source; no manual unchanged-run retry, relaxed limit, retrospective PASS or deployment is claimed.

[Copilot]

🔵 Needs a closer look

Linux execution covers only the first control block and predates the latest resource-retention correction, leaving final harness assurance for human review.

No open issues 🎉

_{Review effort: Balanced}

[pranems]

Exact-tip review 5615359957 on 117d5b1e reports no open code issues. Its execution caveat remains important; here is the completed evidence that arrived after review scheduling:

• Linux run 39790526704 did execute the latest 117d5b1e resource-retention correction, not the earlier source. All four separate resource receipts are retained and their CPU/SQL/image/memory/RSS/OOM fields exactly match the four admitted resource-valid rows. The raw-data reassessment is identical to the retained evaluator result; 66 functional assertions, 200 private-log checks and exact owned cleanup pass.
• The campaign itself FAILS its first same-image control: add p99 79.200360 vs 70.747433 ms (+11.95%), remove p99 77.481641 vs 67.455442 ms (+14.86%). Both roles use the identical current image. This does not establish a version regression or safety. The earlier five-flag Linux failure is also retained, not replaced.
• The second A/A and both actual A/B blocks correctly remain unexecuted. Actual identity/order selection has permanent unit coverage; that is not described as Linux A/B execution or human approval. Live OOM/limit injection is likewise not claimed; the eight actual extracted-round/cleanup scenarios exercise those failure paths in the focused contract suite.
• All seven other exact-tip CI checks now pass. The qualify check is failed. The ordinary protected push passed 28/28 gates and focused contracts passed 26/26.

No unchanged run was manually retried, no limits were relaxed, and no PR merge or deployment is being attempted through this failed admission. Remaining measurement/execution assurance is recorded as a real hold, not silently resolved by the clean code-review headline.

[Copilot]

🔵 Needs a closer look

The new host-cgroup diagnostic still needs exact-source Linux execution evidence and human review, while performance calibration remains unresolved.

No open issues 🎉

_{Review effort: Balanced}

[pranems]

Addressing exact-source execution caveat in review 5616280374:

• Published a7e51d1 through all 28 normal Validate gates (1101.7 seconds). All 44 focused contracts pass.
• Exact-source Linux diagnostic 39799891906 succeeds. Independently verified seven checkout-source hashes, 17,628 request spans, 16,000 original timings, 44,489 CPU observations, resource limits, 66 functional/200 log checks and exact owned cleanup. The actual analyzer reproduces its result from an isolated copy.
• Of 168 p99-tail spans, 142 contain an interior app-group throttle-counter increase; no tail span lacks sampling coverage. This is temporal association, not causal per-request delay or a version-regression finding. Observer cost and gaps are retained.
• The separate untraced qualification 39799892493 still FAILS its first same-image control. All original samples are retained and the actual evaluator recomputes the three failures exactly. Later controls and both old/current blocks do not run.
• GitHub currently shows the qualification check IN_PROGRESS although every job step is completed and the workflow API reports completed/failure. That publisher-state inconsistency is not a passing gate.

The runtime evidence requested by the review now exists on the exact reviewed source. All four earlier code findings remain corrected; the fresh review reports no open code issue. Human review is not implied. No merge, deployment, threshold/quota change, retrospective pooling or manual unchanged timing retry occurs. Function-level old/current profiling is the next separate diagnostic investigation, not release admission.

[Copilot]

🟡 Changes recommended

Native-profile source hashes are omitted, and the shared concurrency queue can cancel pending evidence lanes.

2 open issues

• Shared workflow concurrency drops pending membership runs · New
• Profile-only runs omit native analyzer source hashes · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Exact-source native application profiling and artifact verification remain pending, so the new capture and analysis path still needs execution evidence and final human review.

No open issues 🎉

2 resolved since last review

• Profile-only runs omit native analyzer source hashes
• Shared workflow concurrency drops pending membership runs

_{Review effort: Balanced}

[pranems]

Consolidation reconciliation checkpoint - 2026-10-28

The preserved diagnostic branch
feat/membership-history-diagnostic-20261023 is pushed at
8321dab64724a31a65a6f5fd698708513ab3c7a8.
It contains both this PR's remote head
f6f03a523b6370eccc63f1499c3c111dd5cdf200 and current GitHub master
5bfff2dea1dec6f3e4b99c9a4cc0e6cb8e27388d as ancestors.
All constituent history is preserved. Its API/web trees match that master;
54 unmerged commits cover qualification/diagnostic tooling, tests, CI and docs.

The final normal protected Validate push passed 30/30 gates in 1,594.7 seconds:
API unit 6,214 passed, API E2E 2,514 passed with 42 existing skips,
web 124 files / 1,655 passed, membership local 224 passed / two explicit skips.
API lint retains 512 warnings; web TypeScript retains 66 errors inside its
96-error ratchet. These are not zero-warning/type-error claims.

Exact-tip evidence for that diagnostic branch, not this PR's unchanged head:

• Build Test Image 40061707692:
  PASS, including membership 218 passed / eight explicit skips, application
  validation, test-image publication, container smoke and then-current scan.
• CodeQL 40061707691:
  PASS.

The isolated shallow-checkout and positive-cleanup fixture failures found
during consolidation are corrected with causal RED/GREEN controls.
The existing PR currently has zero unresolved review threads; final human
review and release qualification are not claimed.

Why the PR head is not silently advanced

The qualification, CPU timeline and native-function workflows currently launch
automatically on a relevant pull_request synchronization. Advancing this
PR to the preserved diagnostic branch would therefore rerun the old frozen
campaigns, not merely reconcile Git history. Those completed/failed runs must
not be repeated unchanged as a favorable-retry strategy.

The existing head remains conflicting; this comment does not resolve the
conflict, update its head, waive checks or declare it merge-ready. Before head
publication, settle the campaign execution boundary as a reviewed workflow
change that preserves contract tests, retained failures and explicit
release-admission requirements. Ordinary correctness CI must remain active.

Separate release holds remain

• Frozen same-image control run 39875689201 failed populated-read p99:
  ratio 1.23928982 > 1.10. Completed diagnostic studies do not clear it.
• The fresh 28 October scan of the exact published 0.55.60 digest reports
  two HIGH runtime-image findings (body-parser and multer). Issue [security] pinned dependency review needed #256
  carries the exact-image receipt and approved-feed availability hold.
• Actual customer-data/restore proof, final cleanup read returning 403,
  final-artifact live/browser proof and real visual acceptance remain separate.

Docker is responsive through the user's process-scoped recovery configuration.
That restores local capability; it is not release admission.
No benchmark campaign, merge, deployment, live mutation, threshold change,
baseline adoption or new CVE suppression was performed for this checkpoint.

[pranems]

Reconciliation published; release still held

The final head is e5e107f. This supersedes
the earlier pending-publication checkpoint. The normal protected push passed
all 30 Validate gates in 1,591.5 seconds. The PR is now conflict-free and
remains draft, not ready to merge or deploy. All original commits, actual
master ancestry and failed historical evidence are preserved.

Evidence at the final head	Result
Local membership contracts	226 passed, two explicit skips out of 228
API unit	213 suites / 6,214 passed
API E2E	118 suites / 2,514 passed; existing two suites / 42 skipped
Web unit	124 files / 1,655 passed
PR image workflow	Ordinary validation PASS; image scan FAIL
Push image workflow	Ordinary validation PASS; image scan FAIL
CodeQL	Completed successfully; findings separately addressed below
Docs freshness and RFC currency	PASS
Three frozen performance campaigns	SKIPPED on draft PR, null runner identities, zero steps

Static ratchets remain explicit: API lint has zero errors / 512 warnings; web
TypeScript has 66 errors within the configured 96 ceiling, not zero-error proof.
Skipped campaigns are unexecuted evidence, not performance admission.

Review correction

The archive pathname-race finding is corrected using the exclusively created
descriptor through capture and positional reading. The regression covers
pathname replacement, inherited EOF offset, short reads and premature EOF.
The three focused privacy files passed 20 tests with one explicit retained-source
skip out of 21.

CodeQL marks original alert 338 fixed for this PR merge ref. Its instance on
the intentionally unadvanced diagnostic remote still refers to old 8321dab;
this is not a claim of global alert closure.

Alerts 339/340 identify the regression's deliberate synthetic reproduction of
the old pathname lookup. They have explicit native used in tests dispositions,
not claimed fixes or production waivers. Current review threads are resolved.

Blocking release evidence

Both final-tip hosted image workflows fail on the same two HIGH findings:
body-parser 2.3.0 / CVE-2026-111181 and multer 2.4.0 / CVE-2026-113872.
A separate fresh scan also confirmed them in the exact published 0.55.60 digest.
Issue #256 retains the evidence. The approved feed rejects the listed fixes with
E404; recheck on 30 October and verify actual npm publication age before using
the CI-only lockfile process. No quarantine bypass or new package suppression.

Performance admission remains held at the unchanged p99 ratio 1.23928982 versus
the 1.10 limit. Customer-data restore, final cleanup 403, final admitted-artifact
dev/live/browser proof and genuine operator visual acceptance remain outstanding.
No serving-code change, version bump, merge, live mutation or deployment occurred.

[pranems]

Refreshed independent technical review of the performance union

Exact head: ff2d2377d34e3b517c09ee2e445629183153774e.
Exact base: cffc64c8a188a721fabb85c37a80243d5e65a74f.
Preserved original: 6fe4d2e21f7ba5dd2d0481c600339ba5995e045c.
Separate read-only reviewer: c5e14ba3-ed82-4c3f-82d1-6d162d15f728.

Result: no significant introduced defects found.

The bounded refresh verified the ordinary two-parent merge and all 58
recorded constituents; API source/schema, web source and estate registry
equal reviewed master; API tests, performance tooling, script tests, three
performance workflows and build-test workflow equal original reviewed #251.
Both complete manifests and locks equal master except coordinated 0.55.65
version fields, with zero non-root drift.

The reviewer inspected local union/resolution proofs and integration
documentation, including historical-context precedence and AC-9's separation
of committed Git bytes, CRLF checkout bytes and raw archive authentication.

No tests, syntax probes, inventories, installs, restores or services were
run. Unchanged performance implementation was not re-reviewed. No new-head
CI result or independent artifact authentication is claimed by this review.
The frozen 1.23928982 >1.10 failure remains an admission hold.

This author-posted receipt records independently executed automated technical
review, not human/GitHub approval, deployment authorization or release
qualification. New-head gates and readiness-triggered workflows remain
separate evidence.

[pranems]

Independent bounded integration review

Exact head: abdef72.
Reviewer: separate read-only agent1311f839-824d-4c20-a6d2-b96059dc7152.
Result: No significant introduced defects found.

The reviewer independently checked all32 version-only conflict resolutions
and six narrative unions, preservation of relevant histories and admission
holds, complete API/web manifests and locks against reviewed master except
coordinated0.55.67 roots, specified serving/schema/UI boundaries against
master, and performance tests/tooling/all workflows against ff2d237.

Limits: source review only. No tests, installs, Docker, artifact
authentication, or GitHub approval. Qualification40974749991 remains failed.
Exact-tip validation and authoritative clean-CI lock equality are not
established by this review. Performance and release admission remain held.