Repository navigation
Offline real-zmx rehearsal fails acquiring a conhost identity: initial Snapshot receives null handle #849
Description
Describe the bug
The contained offline real-zmx qualification on frozen #848 source executed 85 cases: 83 passed, 2 failed. The primary failure was real zmx job lifecycle through actual command with target normal; the later successful-rehearsal report gate failed dependently.
Retained traces identify the initial Get-CapProcessIdentity Snapshot call while the supervisor is admitting a journaled conhost. Its handle argument was null at method binding. The underlying reason for that value is unobserved: the trace records a System.Diagnostics.Process type name, not the Handle getter result/exception, disposal state or exact exit ordering.
To reproduce
Historical execution only; this issue does not authorize a new run:
- The single admitted qualification used root
D:\gs10, base95a12681d6d3a6bbc3e1c64992489dd4d04f2863, frozen moduleA29BC8279648E97AD66F268CC6CAAEDEAEA8B89BE87B055AB04DC1ABEAD6C727, worker8468E1692A3E27D3C0D89BC2F4C5C853ACACD312BBEC2A251C2CF32B25104CA1, and unchanged supervisor8754C9C08FB7DAB80B836AA6199FE0D25970165C4A011D8C1BCF752F416D061C. - In
real-seed-normal, real zmx exited 0 and reached daemon/cmd/conhost readiness. At2026-10-16T21:19:47.0896110Z,Add-CapTrackedIdentitybegan admitting journaled conpty-conhost PID 61772, requested creation134366591828363240, parent 45192, session 1. - At
21:19:47.0913723Z, it calledGet-CapProcessIdentityfromInvoke-UiCapture.ps1:415. The initialCapNative.Snapshot($Process.Handle, $Process.Id)at currentUiCaptureDriver.psm1:1610(baseline Bound Windows capture seed lifecycle and output ownership #845/d814 and main95 line 1300) failed converting a null handle argument toIntPtr. The subsequentConvertTo-CapImagePathcall did not occur. This was not the umbrella cleanup Snapshot at supervisor line 974. - The supervisor logged the failure at
21:19:47.1109597Z/21:19:47.1117176Z, then guarded worker termination. The case release is CLEANUP_UNPROVEN, with actual worker stdout/stderr EOF true but no worker final binding and no final output manifest. It is not a clean negative case.
Expected behavior
Identity acquisition must fail closed with sufficient retained, generation-bound evidence to distinguish process exit, property-access failure and other acquisition problems. Preserve ownership checks, deadlines, and the distinction between genuine kernel-exit/EOF proof and an unavailable process. Do not infer death from absent CIM rows or invent a handle/default identity.
First separately scope safe identity-acquisition observability and an actual behavioral reproduction before changing ownership or cleanup. No particular fix is established by these records.
Screenshots
None. This was the offline contained qualification, not a GUI, live UIA or B-scene capture.
Environment
- GraphCode version: frozen B capture refuses first Alpha project selector; retained UIA candidates are not inspectable #848 source on base
95a12681; source hashes above. - macOS version: not applicable; Windows, PowerShell 7 and real pinned zmx.
- Backend: offline fixture; zmx provider
785b3fd15dcafd1882b495c831a10f98c201b908, binary SHA-256DFFF744FA8D7B0FB483416674C2FF4C2647EA46A3BDD82A95DC173A1FA07DC5B. No paid/backend turn.
Additional context
The delegated read-only classification located the initial Snapshot call with high confidence from positive sequential traces and source, not a captured disposal event:
- Supervisor trace: 301 records; worker trace: 338 records. Neither records
Find-CapAutomationElement,Resolve-CapAutomationCandidate,Wait-CapVisibleElementor the new refusal-diagnostic commands in this failing case. The B capture refuses first Alpha project selector; retained UIA candidates are not inspectable #848 selector/wait code was not observed executing here. Get-CapProcessIdentity,Assert-CapProcessIdentity,Add-CapTrackedIdentityandRefresh-CapJournalmatch both main95 and qualified Bound Windows capture seed lifecycle and output ownership #845/d814 function text after explicitly labelled LF normalization for comparison only. The entire supervisor raw hash is unchanged. An unchanged path does not prove the underlying cause predates B capture refuses first Alpha project selector; retained UIA candidates are not inspectable #848 or establish a known flake.GetProcessByIdat supervisor line 403 precedes the identity call at 415. The localDisposeat 430 is in the catch after the failed call. No prior disposal or mutation by B capture refuses first Alpha project selector; retained UIA candidates are not inspectable #848 is observed. Exit-between-acquisition-and-handle-read, a suppressed property getter failure, disposal or another mechanism remain unproved.- The two suite stderr
CAP_TRACE_FAILURE ... ToInt64lines belong to deliberately injected passing observer-error tests. That separate suspected finding was withdrawn; it is not evidence of a real selector handle failure.
Retained directory: D:\gs10\suite\cases\real-seed-normal. Exact evidence:
output\lease-release.json: SHA-25656D833BC80CE0B2BA5912AA58759A5E83FBE88E6B757AF81C91924D13D73BB2C.output\supervisor-calls.jsonl:3BD86AF2FFE79A80B18B8F827D75C0A4A8EE382DDA791E89786248B5E378CA06.output\worker-calls.jsonl:A8E151A4B99FDF6F5CB18292EAFB338C686F7090ABC2D91CF553D046332F16F4.command-stderr.log:2B0A615E216CC7D13AAE57CFDEA864AFCDF81D486341456D29FC4A1131BD2DD6.output\worker.log:7A580E3689F0701DAB24CE84528FCE3E44DB5BA9BC888329EF448F4226370B7F.output\supervisor-worker-stderr.logis legitimately empty (SHA-256E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855);output\manifest.jsonis absent. Neither absence is passing evidence.
The outer suite controller independently recorded job counts 0/0/0 before Close and both actual EOFs, with no cleanup failures. That does not repair the individual case's CLEANUP_UNPROVEN result. Post-success full release/chain/source-rehash gates were skipped after the suite failed and are not claimed verified. Original source, failed records and the read-only classification remain frozen; no fix, new probe or rerun occurred during classification. User disk cleanup removed some historical local #845 qualification roots; cited Git commits/earlier PR hashes are not a claim those raw files remain locally available. Refs #848.
Activity
coneilen commentedon Oct 16, 2026
Second observed Snapshot identity-attestation occurrence: Windows 2022 CI
PR #850, head
dea7de2a374b6619e0a69f0b22ff16603a3311f6, failed its first Windows 2022 hardening attempt in the fixture PREPARE step, before the ordinary capture-child suite:UiScenariocompleted an actual 166 executed / 166 passed / 0 failed at22:01:45Z.22:01:57.1454580Z:Process.Start identity attestation failed for cim-race-compiler-discovery PID : Exception calling "Snapshot" with "2".ValidationRunner.Tests.ps1:4721then rejectedoffline capture fixture preparation failed. The B capture refuses first Alpha project selector; retained UIA candidates are not inspectable #848 caller change is only the later exact ordinary-case count assertion; it was not reached.This is the second observed occurrence in the identity-attestation/Snapshot family, in a different path: the earlier local
D:\gs10event was initial journaled-conhost identity acquisition; this event is short-lived compiler-discovery process attestation. That is 2 observed events / N attempts, where the complete denominator N has not been established. It is not a measured failure rate or a proven flake.The empty Process PID/Handle symptom is consistent with an intermittently unavailable Process identity around start/exit. The exact unavailable getter, disposal state and kernel exit ordering are not established by this job log; do not substitute a proven race/disposal diagnosis. Preserve fail-closed generation, kernel/EOF and ownership requirements.
The multiproject drift lines in this job precede the successful 166-case functional suite and are expected fault injection, not an additional #831 failure.
Raw failed-job log:
D:\gcs\coord2\850-win2022-job117215107135-ansi-raw.log, 375145 bytes, SHA-256E024A48A9C88FE29C421F207799F6E4D2A6FAFD63AEAA783678D81D8364A900F. It is retained unchanged; only displayed extracts have ANSI removed. The initial CLI refusal to display escape sequences is preserved separately and is not a second CI execution.The operator explicitly approved one job-only, same-head diagnostic rerun under the new allowed signature "#849 identity-attestation Snapshot on unchanged path"; no rerun result is claimed here. Recurrence stops the PR rather than increasing retries. A fresh, separately scoped #849 fix is prioritized after #850 merges and before any live B attempt. No identity gate is weakened and no source fix is made by this comment.
coneilen commentedon Oct 16, 2026
Tracking relationship (operator-directed): #846, #849 and #851 form the capture-core flake set. This is an administrative grouping of distinct intermittent failures, not a claim that their root causes are identical or proven harmless flakes. #846 tracks actor exit/kernel/both-EOF evidence; #849 tracks unavailable Process Handle/Id during Snapshot attestation; #851 tracks journal per-object budget ownership/pre-open timing. Preserve each failed attempt and its exact signature independently; a passing diagnostic is not a source fix or causal explanation. Current execution order is #851 first, parked #850 mechanical rebase/requalification after that merge, then #849, then the separately leased live B attempt. No retry, gate weakening or live execution is granted by this comment.
Fail closed on unavailable capture process identities (#854)
coneilen commentedon Oct 17, 2026
Implementation confirmation: PR #854 merged as
02a504be0649da4e87bb6f9f7dc608f8541eb4d9at2026-10-17T05:16:38Z, exact reviewed headfd3f59eb4306a0ad2b3b4bb81ffa6b7c310deb22/ bodySHA5480D1BE4980DC82B4AF940643544803DD0426A18DD16DFDCFFC2F28C05A8665.Both hardening jobs passed on the FIRST attempt: Windows-2022 job117312433681 and Windows-2025 job117312433623, each with actual UiCaptureDriver92/92/0 and ValidationRunner PASS. Whole logs contain no real identity-attestation recurrence, #846-shaped failing case or real/unclassified JournalUnavailable. The known passing identity-unavailable and observer-negative fixtures are not production recurrences. RawSHA: Win22
E070629E68E163782770360D21E80D0172E2C0CF993AA52A837AC73304995DAD; Win25B7C2020696DDBC82136F01E9B7378D32073CE3303D273E3518CDDB8345F94BAD.All nine required contexts and nonrequired checks were accepted. Ready05:14:22.6679342Z was followed by NEW Ready-event DCO39005526652, created05:14:25Z, success before final exacthead/body/main/scope/review/CLEAN guards and match-head squash. No old synchronize DCO or check bypass was substituted.
Persistence independently matches parent
206a7dbc849473d73ee9f257be1da3a59252813f, whole treed3784671416d077458977ef1e6d1cc77de840158and all eight qualified raw Git blobs/SHA-256 values. The local contained95/95 proof, actual null-handle Snapshot-binding RED and serial7/13/5 focused pass remain separately identified. Earlier parallel compatibility failures remain retained; the serial/full pass does not establish scheduling causation or a historical disposal race. The 95 complete journal publications are derived per bound terminal, not assumed from the prior96; the one fewer readiness member publication was semantically checked against later cleanup inclusion.Typed unavailable Handle/Id handling now refuses before Snapshot binding and retains actual-versus-expected PID context and primary/secondary failures. It does not fabricate identity, infer death from unavailable properties/CIM, weaken generation/image/parent/session/kernel/EOF gates, or prove why either old occurrence happened.
Leaving #849 OPEN until the fresh live run is clean. The separately authorized ONE fresh-root live B packet is next, not already executed. #848 also stays open until live B demonstrates refusal evidence. A local/hosted harness PASS is not GUI/UIA, keyboard, rendering, accessibility or parity evidence.
coneilen commentedon Oct 18, 2026
Flaky new #865 test on hosted windows-2025
On PR #870's rebased head
500b405a(run 39159818629, Deterministic hardening (windows-2025, pwsh)),UiCaptureDriverran 140 tests with 138 passing and 2 failing:FAIL real worker action polls initial zero until a late hidden UIA element is available: Real action refused initial found=0 instead of waiting for its late native UIA target.This is the Wait for capture action targets within the reserved deadline #865 test.FAIL actual rehearsal data satisfies the repaired report gate and refuses stale proof: Wrong refusal: The repaired-core preflight does not prove a nonempty successful exact-source offline rehearsal.This is the known cascade from any earlier failure.#870 changes only
DaemonClient.zig, which can't affect this PowerShell test. The same job passed on #871, #872 and #874 heads at the same time, so this looks timing-dependent on the hosted runner.Rerunning once under the CI policy. If it recurs, the #865 late-element test needs a deterministic wait or appearance contract.
A separate hosted failure on #876 (
windows-spikes Swift, offlinePrepareFixturesOnly,cim-race-compiler-discoveryQueryFullProcessImageNameerror 5 on a live PID) is the #849 identity-attestation family. It has also been rerun once.coneilen commentedon Oct 19, 2026
New flake signature for this family. Run 39182255709 (#876 at 27ac6bb), job 'windows-shell integration', step 'Scrubbed production shell startup', exited -1073741502 (0xC0000142 STATUS_DLL_INIT_FAILED). That is a loader-level failure before app code runs, consistent with runner desktop-heap/window-station exhaustion. It was seen once in the last 6 failed windows-shell runs. One rerun passed, and #876 merged as 7f35f4b. Treat it as known-flake (one rerun per head); if it recurs, investigate desktop heap on the runner.