Fix site benchmark fixtures and bound heavy verification children

Author: KSemenenko

docs/ADR/ADR-080-benchmark-failure-isolation.md

@@ -1,7 +1,7 @@
 # ADR-080: Isolate benchmark failures during publication
 
 Status: Accepted; source implemented, delivered-source verification pending.
-Date: 2026-10-04. Related: REQ/AC-BC-FAIL-001..011, ADR-056/074/076.
+Date: 2026-10-04. Related: REQ/AC-BC-FAIL-001..014, ADR-056/074/076.
 
 ## Decision
 
@@ -129,14 +129,72 @@ upload; cancellation/timeouts that prevent artifacts remain explicit blockers.
    remain rejected as measurement/publication evidence. The registry test alone
    accepts legitimate final-budget timeout facts and exposes Node stderr; its
    production30s/2s bounds and success predicate remain unchanged.
+   Under FAIL-SITE-PROBES (REQ/AC-BC-FAIL-012/013), genuine run37173267644
+   qualified all270 original cells and source/archive intake, but site135/158
+   passed. Nine direct failures are test-harness defects: default PascalCase
+   request serialization disagrees with lowercase Node arithmetic input; numeric
+   native DOMException.code is read as string; seven disposable SEO/vendor
+   repositories omit the eagerly imported canonical isolated-contract.json.
+   Native worker owns SiteNodeProbe.cs, SiteIsolatedNodeProgram.cs,
+   SiteMetadataRejectionTests.cs and SiteVendorTestScope.cs under SiteTests;
+   SiteVendorTokens.cs loses only the obsolete scratch-aggregate directory token.
+   Use existing SiteTokens.JsonOptions, actual native error.name only when code
+   is not a string, and exact source-byte copying of the canonical contract.
+   Vendor-only source mutations retain the accepted fixture's full original
+   aggregate/270-worker input directory as an unchanged read-only input. Remove
+   the aggregate-only scratch copy: the native validator requires all271files,
+   whose actual development inventory is2064912853bytes. Do not duplicate it
+   for every vendor metadata mutation or weaken inventory/byte validation.
+   Preserve median/AbortError assertions, real production builder, vendor bytes,
+   every intended asset rejection, native inputs and all coverage thresholds.
+   Existing16 focused cases are the regressions; root integrates/builds/formats
+   and records actual source/patch/input identity for development evidence.
+   Under FAIL-SITE-ADMISSION (REQ/AC-BC-FAIL-014), the same original TRX shows
+   eleven independent full builders and two archive-verification children each
+   reached the unchanged300s active deadline during the concurrent test burst.
+   Before-session full native verification succeeded in60.14s; after-session
+   verification/coverage completed in91.27s. Bounded original-input development
+   profiling now measures native V8-instrumented CPU-heavy execution: one builder
+   44.014s and two53.448/53.444s; full277-input verification48.428s single and
+   59.707/75.799s concurrent, with peak per-child RSS below483MB on the actual
+   macOS arm64 machine. These local observations do not prove GitHub saturation.
+   The original TRX has25 builder cases plus12 produce-rejection cases, allowing
+   35 pending requests with two active. Approve two active children, at most64
+   FIFO waiters and20 minutes for cancellable admission within the existing
+   30-minute Aspire site-suite budget. Classify actual builder/produce/full
+   inputs or CLI verify-inputs calls; light probes and native network capture
+   remain independent. Producer owns SiteHeavyChildAdmission.cs,
+   SiteHeavyChildLease.cs, SiteHeavyChildTokens.cs,
+   SiteHeavyChildClassification.cs, SiteHeavyChildProcessFixture.cs,
+   SiteHeavyChildAdmissionTests.cs and SiteHeavyChildCleanupTests.cs, and only
+   modifies SiteIsolatedNodeProcess.cs, SiteIsolatedBuilderProcess.cs,
+   SiteIsolatedGitHubNodeProcess.cs and SiteIsolatedGitHubNativeProcess.cs under
+   the same SiteTests feature. Scoped actual admission instances permit real
+   Node-child FIFO/capacity, queued-cancel, queue-full/deadline, start-failure,
+   active-cancel, output-bound and unsafe-ownership tests; no mocked process,
+   clock, transport or fabricated provider replaces the native dependency.
+   Admission precedes the existing active deadline and is bounded/cancellable.
+   Ownership lasts through real exit and settled readers, including failed or
+   cancelled children. Unsafe incomplete cleanup poisons admission and rejects
+   pending requests; it must not release capacity before exit/readers settle.
+   Keep full270/277/raw checks and add real-process tests for
+   concurrency, queued cancellation and failure/cleanup; do not extend300s,
+   fabricate input, omit tests, reduce coverage or make an alternative publisher.
+   All browser starts failed before Chrome; missing browser coverage is an
+   observed consequence, not permission to remove its required inventory.
+   Local development uses genuine original bytes and actual source/patch identity,
+   never forged CI/GitHub environment or rebound original website/control fields.
+   A focused development filter cannot qualify the full suite/coverage.
+   Rollback reverts only these test-harness/admission changes and truthfully
+   restores the observed qualification failure. No engine/data migration.
 5. Root reviews all diffs, builds solution, runs formatter/governance and focused
    Aspire-owned suites, then checkpoints scoped changes on current main and pushes.
 6. Genuine Linux Benchmarks run qualifies all cells, aggregate, site coverage/browser
    and Pages publication. Local tests are development proof only.
 
 Migration is additive to version4 dispositions; deploy producer/validators/site
 atomically. Rollback reverts this coherent change and restores the conservative
-publication gate, retaining immutable original artifacts. AC-BC-FAIL-001..011 map
+publication gate, retaining immutable original artifacts. AC-BC-FAIL-001..014 map
 to automated and actual-provider evidence in the feature specification. Root alone
 owns integration and shared contract updates; workers never commit or push.
 

docs/Features/BenchmarkComparisons.md

@@ -694,8 +694,51 @@ KeyLoad engine repair and concurrent series-codec work are outside this task.
 | REQ-BC-FAIL-009 align native Redis transport | AC-BC-FAIL-009 each isolated Redis resource uses the documented native certificate opt-out for its existing authenticated RESP/TCP bootstrap; after actual Aspire startup, primary/replica endpoints retain scheme `redis` and native target port6379 with TLS disabled. Discovered mapped host ports remain dynamic; native client settings retain a password without `ssl=true`. Preserve health checks, wait dependencies, AOF `always`, native membership, direct-copy/cancellation checks and WAIT/WAITAOF acknowledgements | actual pinned resource-model regressions plus genuine Aspire-owned native Redis 1/2/3-node preflights; complete matrix and site qualification remain mandatory |
 | REQ-BC-FAIL-010 preserve exact OpenSearch vector ordering | AC-BC-FAIL-010 the native query preserves the unchanged shared float32-input/double-accumulated cosine oracle and ordinal ID tie order. Use native `scripted_metric` map/combine/reduce over actual vector doc values; round parsed query values back to float32 before double arithmetic, retain at most TopK candidates per shard, merge only bounded shard TopK states, validate finite native double scores and retain projected content from the existing native source only for admitted candidates. Do not sort through float `_score`, weaken recall/tolerances, rerank/fetch in the client, duplicate stored vectors, use ANN or change the corpus/native topology/ACK contracts | independent deterministic precision witness for query d000000170 (documents2289/1272), positive/negative native query/response TUnit checks, and genuine Aspire-owned OpenSearch VectorExact1/2/3 jobs with every five10000-operation repetition passing the unchanged oracle; complete same-run aggregate/site/Pages still required |
 | REQ-BC-FAIL-011 create the qualification evidence parent | AC-BC-FAIL-011 initialization creates the real workspace artifacts/site-evidence parent before any capture redirection, preserves existing directories/files, rejects file or symlink collisions at artifacts or site-evidence before output, and leaves isolated-capture absent for its exclusive producer. Never skip/rebind source/archive/270/277/test/coverage/browser/freshness gates | SiteQualificationStartupTests executes the actual initialization Bash block in fresh owned filesystems (new/existing parent, file/base-link/parent-link collisions), checks actual envelope redirection and unchanged targets, and runs as a mandatory Aspire-owned unit preparation gate; genuine new-source website qualification/Pages remains required |
+| REQ-BC-FAIL-012 execute the actual native probe contract | AC-BC-FAIL-012 C# probe requests serialize the existing lowercase operation/values contract; median arithmetic and odd/even/empty assertions remain unchanged. Native error probes preserve string error codes and use the actual native error name for numeric DOMException codes; real AbortController cancellation must still assert AbortError | Existing SiteMeasurementArithmeticTests and SiteIsolatedHttpTests, original failed TRX and focused genuine-input development checks |
+| REQ-BC-FAIL-013 complete disposable builder source | AC-BC-FAIL-013 SEO/vendor scratch repositories copy the exact canonical isolated-contract.json bytes from the actual source repository before invoking the actual builder. Vendor-only mutations use the accepted fixture's unchanged full original aggregate and270-worker inventory; they must not substitute an aggregate-only directory or duplicate the2GB raw inventory for each metadata mutation. Existing missing/link/corrupt-asset negatives must reach their intended checks before output; the valid vendor compression case must succeed. No fabricated contract, provider input, replacement builder or weaker assertion | Existing four SiteMetadataRejectionTests and three SiteVendorBuildTests, with actual source-byte copying and unchanged input authority |
+| REQ-BC-FAIL-014 bound heavy qualification children | AC-BC-FAIL-014 expensive full-cohort builder/archive-verification children share bounded admission before their existing300s active execution deadline starts. Retain complete277 inputs/270 workers, stdout/stderr bounds, caller cancellation and original-byte verification. Hold ownership until actual child exit and readers settle; cancelled queued requests start no child. Select limits from original timings and bounded source-exact development measurements, then require every complete site test and native coverage gate in genuine Linux GitHub | Real-process admission/cancellation/failure regressions, original-input single-versus-parallel phase/CPU/RSS development receipts, complete unfiltered Aspire-owned GitHub site/TRX/Node+Chrome coverage and Pages |
 
 [ADR-080](../ADR/ADR-080-benchmark-failure-isolation.md) owns the boundary change.
+The site follow-up is FAIL-SITE-PROBES (native worker, four test-helper files and
+the obsolete SiteVendorTokens.cs scratch-aggregate token),
+FAIL-SITE-ADMISSION (producer worker, exact heavy-child lifecycle helpers and
+regressions after the root contract), then FAIL-SITE-JOIN/DELIVERY (root).
+Native worker owns SiteNodeProbe.cs, SiteIsolatedNodeProgram.cs,
+SiteMetadataRejectionTests.cs and SiteVendorTestScope.cs. The producer first
+profiles the unchanged actual source/original input before admission changes.
+The original TRX contains25 builder cases and12 produce-rejection cases; with
+two active children,35 eligible cases may wait. The approved admission policy is
+two active children, a FIFO queue of at most64 waiters and a20-minute cancellable
+admission deadline before the unchanged300-second active deadline. Local
+source6e/original AA270 profiling with native V8 coverage measured44.014s for one
+builder and53.448/53.444s for two; full277-input verification measured48.428s
+single and59.707/75.799s concurrent. Peak RSS stayed below483MB per child in
+these bounded macOS development sessions; this does not measure GitHub resource
+saturation or qualify website performance. Heavy classification includes actual
+builders, produce requests and inputs/verify-inputs probes; light probes and
+native network capture retain their existing paths and deadlines. An unsettled
+child or reader poisons admission and rejects pending requests, rather than
+releasing unsafe capacity. Producer owns SiteHeavyChildAdmission.cs,
+SiteHeavyChildLease.cs, SiteHeavyChildTokens.cs, SiteHeavyChildClassification.cs,
+SiteHeavyChildProcessFixture.cs, SiteHeavyChildAdmissionTests.cs and
+SiteHeavyChildCleanupTests.cs; its existing-file edits are limited to
+SiteIsolatedNodeProcess.cs, SiteIsolatedBuilderProcess.cs,
+SiteIsolatedGitHubNodeProcess.cs and SiteIsolatedGitHubNativeProcess.cs, all in
+the existing SiteTests feature. The real-process regressions cover FIFO/capacity,
+queued cancellation, queue-full/deadline rejection before start, native start
+failure, active cancellation, output bounds and unsafe ownership fail-closed.
+Root owns requirements, workflow/source closure, integration, full checks and delivery.
+An original source-exact verification copy with an explicitly recorded candidate
+test patch can provide filtered local development evidence. Never relabel the
+immutable receipt, current HEAD, CI/GitHub executor or local results. Filtering
+does not satisfy the full site/coverage qualification; production gates stay intact.
+The final16-file harness candidate passed all26 selected genuine-input Aspire
+case assertions (16 existing,10 new lifecycle cases), without skips or cancellation.
+The filtered run retained its actual exit10 and one synthetic after-session
+coverage failure; it does not qualify the full site or publication. A separate
+actual main73 candidate passed the full Release build, formatter and governance.
+Exact source, native-input, runner and TRX identities are recorded in
+[the development receipt](../implementation/benchmark-site-harness-development-2026-10-04.json).
 Ordered task graph: FAIL-CONTRACT (root, complete) -> FAIL-SITE (site worker),
 FAIL-PRODUCER (tooling worker), FAIL-PREP (root/diagnostic worker) -> FAIL-JOIN
 (root review/build/format/governance/Aspire tests) -> FAIL-DELIVERY (scoped commit,