Repository navigation
Distinguish native and metadata causes of Windows trace STOP refusal - #1120
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Disposable calibration 41001651151 passed both ownership readbacks, then refused STOP with code 13. That code could come from ControlTrace itself or from our returned-property parser or identity check. Replace the query-only diagnostic with a shared, finite native-action diagnostic so STOP records its actual native result separately from a synthesized refusal.
The strict status/4 writer and PowerShell sanitizer agree on reachable query and STOP combinations. They reject legacy query-only records, impossible STOP gate diagnostics, inconsistent masks and uncertain summary claims. Logs expose only finite stages, codes and numeric mode/flags. Start, allocation, parsing and the ownership gate are unchanged; query behavior changes only the diagnostic type name. STOP retains its exact former acceptance predicates and one-shot eligibility. There is no retry, logger sweep, raw trace upload or bound increase.
Signed head
631643792b2d3a3a72bccc3e76c147531635bcb0, base9bf86cb2e50e1e33aa27bd779cd1221705eba3f5, tree81402bd8d2c2cddd801908ff41c1a3197c24d5c9. Independent complete frozen-source and exact-head review by/root/etw_query_origin_review: PASS. All compiled and verifier inputs match the frozen source, including the explicit QueryDiagnostic→NativeActionDiagnostic rename; manual documentation differs only by required Prettier whitespace.Validation: zero-warning framework build; 42 existing, 39 preflight, 117 native-action and 155 strict sanitizer controls, plus six actual writer-to-parser readbacks pass. The promoted signed-head source and receipt-bound gates passed in 3,565 ms. Receipt: 4,969 bytes, SHA256
0199f3ca8ac122af62a4fad05d23106936f7c68623284839a8a53c9ae98b94f8. These checks started no ETW. Required current CI remains pending.After review, CI and merge, one exact-main disposable-host calibration must identify the real STOP cause. Earlier STOP success and cleanup remain unproven. No local ETW, helper installation, selection, service/ACL/trust change or governed Attempt.
helper_missingremains correct. Related to #997; release PR1113 and LexSona153 stay separate.