test(acceptance): preserve native reopen failure diagnostics

Author: hongtao

.github/workflows/windows-encrypted-draft-lifecycle.yml

@@ -82,6 +82,13 @@ jobs:
           if ($LASTEXITCODE -ne 0) { throw 'Candidate verification failed; installation qualification will not run.' }
           npm audit --audit-level=high
           if ($LASTEXITCODE -ne 0) { throw 'Candidate dependency audit failed.' }
+      - name: Diagnose isolated native open after candidate gate failure
+        if: ${{ failure() && steps.candidate_gates.outcome == 'failure' }}
+        working-directory: current
+        run: |
+          $ErrorActionPreference = 'Stop'
+          node scripts/diagnose-context-recovery-open.js
+          if ($LASTEXITCODE -ne 0) { throw 'Isolated native open diagnostic did not pass; original gate failure remains.' }
       - name: Build current test installer without publishing
         id: candidate_build
         working-directory: current

docs/context-recovery-implementation-status.md

@@ -1,5 +1,15 @@
 # HTTPS Proxy 多端上下文恢复实施状态
 
+## 2026-10-24：同提交成功/失败重开对照及失败后最小原生诊断接线
+
+继续核对7556263原60秒失败，不重跑失败候选。该提交完整coverage `120953707146`、正式source-gates `120953707438`均取得80条完整阶段事件，末阶段分别约6651ms、5778ms；初次ready约731ms、472ms。失败安装作业同一源码的初次ready却约18584ms，多个后续段也变慢，revoke累计59476.59ms后才开始clear。此对照证明延迟跨多段变化，不足以确认JS计算、外部原生进程、持久I/O或环境等待哪项是根因，也不以成功样本消除失败。
+
+为下一次实际Windows结果补充有限证据：原真实回归的onPhase输出仅增加本测试Node进程自身cpuUserMs/cpuSystemMs累计计数，原phase/sequence及60000ms期限不变，不读取其他进程或机器状态。安装链在candidate_gates失败后才运行已有diagnose-context-recovery-open.js，仍用默认worker、原生助手、原期限和全新OS-temp空库，两次开库/重开；不读取失败数据库，不运行模型或安装器，不上传数据。诊断退出非零继续失败，成功也不能改变原gate失败；后续build与安装仍沿原默认success条件跳过，没有continue-on-error或重试verify。
+
+新增门禁回归校验失败条件、原verify顺序、固定诊断命令及无期限/目录覆盖，无发布、密钥或额外权限；原开库诊断、重开断言和draft门禁三文件31项通过、1项原Windows-only skip，未增加skip。新测试首次因当前CRLF文件按LF分割未命中而失败，归一化测试读取换行后通过，失败日志保留；不涉及产品原生根因。定向Lint/语法、CI和发行治理通过。本机尚未执行Windows CPU及原生阶段观测，根因仍未解决，不宣称性能修复。
+
+25acc53的完整Verify `40122931446`现七项成功、coverage运行中；正式Windows `40122931561`的egress成功、source-gates运行中，安装链 `40123107840` / job `120958818328`仍在原完整候选门禁，未重启它。后续诊断批次需自身完整门禁。原安装两端、容量/24小时、实际provider与自用启用范围保持；冻结长测未访问、真实模型请求0。
+
 ## 2026-10-24：保留7556263原60秒重开失败，修复Claude验收初始监听协议
 
 `7556263b98e6f5dbe601aa1e6d2358526cea8a7c`的完整Verify `40121458356`八项和业务边界诊断 `40121458373`两项均success；正式Windows `40121458384`的egress和source-gates成功，N08 `120957998887`、N09 `120957998899`已运行、尚无终态结论。安装链 `40121484825` / job `120953889091`在完整候选verify阶段终态failure，原真实默认runtime/worker撤销清空重开测试用时60013.0193ms，触发原60000ms期限，安装构建及客户端步骤均未运行。未重跑同一失败候选，不能以独立Verify成功覆盖安装门禁失败。

test/nsis-draft-download.test.js

@@ -247,3 +247,30 @@ test('direct encrypted workflow retains full gates and private artifact workflow
   assert.match(original, /Receive-HpmPrivateBaselineArtifact/);
   assert.doesNotMatch(original, /contents: write|download-nsis-draft/);
 });
+
+test('failed candidate diagnostics retain the failed gate and cannot authorize build or installation', () => {
+  const workflow = fs
+    .readFileSync('.github/workflows/windows-encrypted-draft-lifecycle.yml', 'utf8')
+    .replaceAll('\r\n', '\n');
+  const diagnostic = workflow
+    .split('      - name: Diagnose isolated native open after candidate gate failure\n')[1]
+    ?.split('      - name: Build current test installer without publishing')[0];
+  assert.ok(diagnostic);
+  assert.match(
+    diagnostic,
+    /if: \$\{\{ failure\(\) && steps\.candidate_gates\.outcome == 'failure' \}\}/
+  );
+  assert.match(diagnostic, /working-directory: current/);
+  assert.match(diagnostic, /node scripts\/diagnose-context-recovery-open\.js/);
+  assert.match(diagnostic, /if \(\$LASTEXITCODE -ne 0\) \{ throw /);
+  assert.doesNotMatch(
+    diagnostic,
+    /continue-on-error|--(?:timeout|directory)|qualify-|npm run verify|upload|secrets\.|GH_TOKEN/
+  );
+  const build = workflow
+    .split('      - name: Build current test installer without publishing')[1]
+    ?.split('      - name: Qualify installed same-format')[0];
+  assert.ok(build);
+  assert.doesNotMatch(build, /if:|continue-on-error/);
+  assert.ok(workflow.indexOf('npm run verify') < workflow.indexOf('Diagnose isolated native open'));
+});

test/nsis-runtime-reopen-assertions.test.js

@@ -420,13 +420,20 @@ test(
   },
   async (t) => {
     const root = caseFixture(t);
+    const cpuStarted = process.cpuUsage();
     assert.deepEqual(
       await exerciseRuntimeReopenRevocation(
         { caseRoot: root },
         {
           onPhase(event) {
+            const cpu = process.cpuUsage(cpuStarted);
             process.stderr.write(
-              JSON.stringify({ scope: 'runtime-reopen-phase', ...event }) + '\n'
+              JSON.stringify({
+                scope: 'runtime-reopen-phase',
+                ...event,
+                cpuUserMs: Math.floor(cpu.user / 1000),
+                cpuSystemMs: Math.floor(cpu.system / 1000),
+              }) + '\n'
             );
           },
         }