[dalkedev]

Parent cancellation follow-up

Current head: 697f1d5a728d420cdeb998b0e343782a4248010b (same PR/branch; no new measurement run).

run_bounded now shares finite process-tree termination/direct-child reaping between deadline expiry and parent cancellation/exception, then reraises the original cancellation. Windows taskkill uncertainty remains explicit, including a fixed exception note when cleanup cannot be confirmed. Normal output, exit-status handling, Rust measurements and workload/profile arguments are unchanged.

• PASS: three disposable child/descendant regressions first failed on the old code, then passed after the fix: actual POSIX SIGINT, injected KeyboardInterrupt, and injected RuntimeError. Fixtures unconditionally clean only their own recorded PIDs/groups.
• PASS: local runner suite 16 tests; all scripts 32 PASS / 1 SKIP; normal stdout/exit-status compatibility regression, syntax/YAML checks and independent source review.
• PASS: Python-only hosted gate 42299513382, Linux and Windows. Rust setup/builds, long measurements, report upload and HAR consumers were skipped. Windows uses real disposable process trees with injected Python cancellation/exception; console Ctrl+C is NOT RUN.
• PASS: automatic current-head full checks 42299499687 and all four CodeQL analyses. Linux/Windows/macOS packaging and desktop/MCP smoke checks also PASS; zero open PR alerts observed. The follow-up delivery gates are complete.

The canonical measured commit remains 19aec4f: both Linux and Windows measurements finished successfully, including all 48 batches/required controls. Later runner/workflow changes are explicitly identified in the source-provenance summary; no new fsync, throughput or production claim is made.

Result

Refs #28. Add an opt-in, bounded synthetic harness that measures Scope's current synchronous archive path before proposing a writer rewrite. Production scheduling, SQL, durability settings, persistence ordering and existing test deadlines are unchanged.

• Time actual serialization, connection-mutex acquisition and SQLite execution in cfg(test) only. Preserve 32-client HTTP/TLS rule semantics, request pairing, original snapshots, ordered rule evidence, revisions and reopened IDs.
• Measure executor heartbeat lag and independent-thread loopback echo responsiveness, with exact workload windows, bounded collectors, hard process budgets and fail-closed numeric-only exports.
• Document a bounded writer/admission proposal with acknowledgement barriers, byte/slot limits, backpressure, cancellation/Stop/restart and error-finalization requirements. No production writer is implemented; encoded-size and failure-path prerequisites remain unresolved.

Validation and provenance

• PASS: hosted measurement run 42293997874, measured commit 19aec4fc8ca63551c05a0380c157c5593f048efa, clean Linux/Windows sources. Separate debug/release, current-thread/two-worker, HTTP/TLS profiles; three samples per case. All 48 batches, 1,536 clients/rows and 9,216 save statements/revision increments passed, without overflow, lost evidence or deadline violations.
• PASS: all 48 persisted-rule corruption and 48 independent row-loss controls; all four required current-thread timer/network blocking controls. Two-worker blocking controls are intentionally NOT RUN.
• PASS: both ZIP digests matched GitHub's artifact API; source/run/attempt/sample identities, strict schemas and raw JSON hashes verified. Independent source/data review recalculated all 16 statistical groups and table cells, with no remaining findings.
• PASS: 72 local locked core/device/MCP tests, scripts suite 28 PASS / 1 SKIP, formatting, whitespace, workflow YAML and documentation/hash checks. Full Linux/Windows/macOS checks, HAR cases and all four CodeQL analyses passed on the measured commit; no open PR CodeQL alerts observed.
• PASS: full CI for previous delivery head 1ff7ad713f72796aca583d1bae0cececc3e12080. After the measured commit, changes are documentation/results plus one normal-CI test assertion: a zero-width window legitimately permits no additional active network sample. The Rust timing/window/workload implementation remains byte-identical, with a precisely defined runtime-prefix hash and preserved measured whole-file hashes in the summary; no new measurement dispatch is needed.
• FAIL, resolved test correction: the macOS results-head job required an incidental network sample during roughly 20ms of drain. That requirement was removed; real readiness, timer observation, zero coverage/NOTRUN and false-control assertions remain intact. Fresh exact-head macOS workspace, packaging and desktop/MCP smoke checks now PASS; Linux/Windows checks also PASS. All four final-head CodeQL analyses and the three HAR cases PASS, with zero open PR alerts observed.
• FAIL, resolved and preserved: the earlier Windows control-startup validation failed because its first timer deadline preceded network readiness/the control window. The timer is now armed after readiness, with unchanged thresholds and filtering. Exact numeric regression evidence remains available; corrected native Windows debug/release controls pass.
• NOT RUN: GUI/Android, sustained/large-body traffic, a production writer/queue, fsync counts, isolated storage latency and production performance. Windows image version/affinity and unavailable memory/I/O limits are explicitly unknown. The historical 29-client timeout failure was not reproduced.

Method, descriptive results, raw data, limitations and proposal. Profiles/operating systems remain separate; measured SQL time is not a disk-flush count or proof of storage causality. Issue #28 remains open.