HELD: 000159 legs 1-2 -- flake instrumentation, 5.1 SARIF validation, ManifestConsistency multi-name export fix (prep v1.27.2)

[manderse21]

HELD for Mike. Do not merge until reviewed; every merge and every pipeline trigger stays yours.

Dispatch 000159, legs 1 and 2. Prepped for the v1.27.2 PATCH cut.

What is here

Leg	Change	Bump
1a	Flake instrumentation: rescue isolated data-root logs into the CI artifact; split exited-empty-stdout from killed-at-cap	none (test-infra)
1b	Schema-validate the SARIF Windows PowerShell 5.1 emits, from a pwsh step	none (CI)
2	ManifestConsistency reads multi-name Export-ModuleMember lists	PATCH -> 1.27.2

Leg 1a -- instrument the flake, do not theorise about it

000156 leg 4 falsified the standing explanation (recorded It duration 3.3167s against a 25000ms
cap -- nothing was killed at a cap) and then could go no further, because both things it needed were
unobservable. Steps 1 and 2 of its recorded fix shape, and only those:

• The logs. Isolated roots live under the OS temp dir while CI uploads only psls-test-data/**,
  so they were outside the uploaded tree to begin with -- and several teardowns then discarded
  them. Two barriers, not the one the charter described. The rescue runs first in each
  teardown, ahead of the session-file cleanup that was itself discarding session/<sid>.json.
• The outcome. Invoke-PluginHook collapsed three distinct failures into one empty string.
  The reason is now recorded on a side channel; the return value is untouched, so no behaviour or
  timing changes. Closed across all 12 collapsing hooks.

Both exclusions are earned, not asserted: Invoke-CaptureU and Invoke-CaptureC spawn with a cap
but return a hashtable carrying ExitCode = -999 / Err = 'timeout', so they already discriminate.
The guard proves that rather than trusting it.

Step 3 (bounded retry / widened window) is deliberately NOT built. The evidence to choose
between them does not exist yet; producing it is the point. No Start-Sleep anywhere, including
fixtures -- killed-at-cap is forced with a child that blocks on an unset ManualResetEventSlim and
never exits, so the cap expires deterministically rather than probabilistically.

Leg 1b -- the riskiest host was the unchecked one

Three conformance cases skip on 5.1 because Test-Json -Schema does not exist there. That skip is
legitimate and stays. What it left behind: SARIF emitted under 5.1 was never schema-validated
anywhere, and 5.1's ConvertTo-Json is the serializer most likely to deviate. The JSON is already
produced; only the validator needed a modern host. Emission stays on 5.1, validation moves to pwsh.

-RequireHost 5 is the vacuity guard and is the point, not a nicety: a leg that silently emitted
nothing would otherwise validate zero files and report success.

Leg 2 -- the fix, and an accepted deviation

Multi-name lists parse as one node in either idiomatic form (ArrayLiteralAst /
ArrayExpressionAst), so both were skipped whole, the collected set stayed empty, and the caller
read that as "no explicit Export-ModuleMember" and assumed export-all -- reporting every
private function as under-declared.

• dogfood-reader.psm1: 13 false warnings -> 0, modelled surface matching Import-Module
  ground truth exactly (25 defined - 12 exported = the 13).
• -Cmdlet was measured to share the collection path and is fixed with it. -Alias measured
  not to -- alias names stay out of the function set (BurntToast shape, 000128).
• Mixed lists degrade rather than half-resolving: a partial set read as complete would be worse
  than the silence it replaced.

Accepted deviation (Mike's ruling)

The 0%-FP oracle bar is scoped to the chartered class, and that class measures clean:
0 of 910 remaining hits are attributable to a multi-name list. PowerShellGet's lists now resolve
correctly (38 names); every other module with remaining hits has no Export-ModuleMember at all.

A second, unrelated class is accepted as a recorded deviation and not fixed here: a
manifest's FunctionsToExport is the final export gate, so a defined-but-unlisted function is
simply not exported, yet is still reported as under-declared. Live oracle: 155 manifests enumerated,
26 with a resolvable RootModule, hits 1088 -> 910, of which 909 of 910 are confirmed false
positives with 0 true positives. Pester is the clean case: 419 functions defined, manifest lists
26, PowerShell exports exactly 26, and all 393 hits name functions it does not export. Chartered as
its own PATCH dispatch in the outbox.

Also recorded, pinned-not-fixed: the dot-source degrade in the same helper is inert -- it matches
CommandElements[0] -eq '.', but PowerShell carries the dot as the InvocationOperator. Same trap
000156 leg 3 banked after hitting it in a guard, never swept from shipped code. A characterization
test pins it so it cannot change silently in either direction.

Verification

Every proof below was re-run in this session against the adopted commits rather than trusted
from their messages (Hub Rule 7).

Proof	Result
Leg 1a suite	17/17
Leg 1b real run (5.1 emits -> pwsh validates)	exit 0, 2 artifacts conform
Leg 1b RED: empty dir / missing dir / no-5.1-artifact / non-conformant	exit 1 each
Leg 2 reproducer at base 2068b2b	RED 8/14
Leg 2 reproducer at work	GREEN 14/14
dogfood-reader	13 -> 0, ground truth matched
PowerShellLsp.Release.Tests.ps1	39/39
Version lockstep	plugin.json == marketplace.json == 1.27.2 == dated CHANGELOG heading
ASCII (0x00-0x7F), per file	clean on every touched file

After merging

1. Confirm the push CI on main is green and headSha-matched to the merge commit (000081).
2. Trigger the release pipeline for 1.27.2 -- dry-run first, then the producing run.
   No tag is cut here: the bump helper's manual tag pair is a broken-pipeline fallback and was
   deliberately not run (a hand-cut tag is unsigned and would make Gate 2 refuse the pipeline).

PR-B (leg 3) stacks on this branch and assumes it merges first.

https://claude.ai/code/session_01NCXh8Xms8ZKhdfKRBqSmaQ