Fix Windows CI failure reporting and retain benchmark attempts

[Pedro Henrique Penna (ppenna)]

Summary

Make Windows CI fail faithfully and retain the evidence from bounded lifecycle remeasurement.

Investigation

Investigated run 35562857677, attempt 1 at NVX 02d889db1768d4d1208407014f359e46f13e5399 and OpenVMM 64054d7a7275c2c6d66c2bbb10f77ec777e11889 in a new isolated worktree. This was a failed dev push, not PR supersession.

The Windows acceptance step correctly rejected both snapshot-generation samples:

• Attempt 1 split 5/5 between 757.897 ms and 977.413 ms (29.0% gap).
• Attempt 2 had p50 1235.405 ms, 60.4% above p25 770.192 ms.
• Raw profiles localize the slow regime to capture.mapped_memory_flush (~1.18 s versus ~0.70 s). Other capture phases stayed near a combined 60 ms; boot and restore succeeded.

The preserved CI JSON reproduces exit 75. Fresh exact-artifact runs on the same azure-windows-1 host and on azure-windows-2 pass unchanged. The executable, kernel, and initramfs SHA-256 hashes match the failed run. This supports host-side mapped-RAM-flush variability, not an established VMM regression; the external trigger for the original prolonged slow regime remains unproven. No VMM source, durability behavior, stability threshold, retry count, or tracked performance baseline is changed here.

The same job also contained four failed CLI tests hidden by a successful validation step. Those failures reproduce deterministically with the Network Service 8.3 temporary-directory alias. PowerShell continued past the failed native unittest command, and a later successful help command masked its exit status.

Changes

• Check every native command's exit status in Windows CLI validation.
• Resolve the four affected temporary-directory fixtures before comparing or mocking canonical repository paths.
• Preserve acceptance-attempt-1.json and acceptance-attempt-2.json, including rejected profiles. Copy only a validated result to acceptance.json, removing stale accepted output before measuring.
• Add executable PowerShell failure-injection tests for every validation command and all acceptance outcomes, plus regression cases for both original unstable sample sets.
• Document retained attempts and profile-based diagnosis.

This PR fixes the concrete CI correctness and evidence-loss defects; it does not claim to eliminate transient Windows flushing jitter or hide it with additional retries.

Validation

• Ruff lint/format and Pyright for Linux and Windows pass.
• Full CLI suite: 249 tests pass (one existing platform skip); 4 host resolver tests pass; compilation and all CLI help checks pass.
• Both configured Azure WHP servers pass the full Windows CLI action using the original Network Service short-path temporary-directory environment.
• azure-windows-1 passes every Windows benchmark action step at the committed revision with the original CI artifacts: LAPIC correctness (1/2/4/8 vCPUs), lifecycle acceptance (1 warmup + 10 runs), performance suite, multi-vCPU restore, device I/O, and result collection.
• The accepted remote JSON is byte-identical to its retained validated attempt. Original NVX and OpenVMM checkouts remain untouched; the new worktrees are clean.

[Copilot]

Copilot review overview

🟢 Approval recommended

The workflow fixes are coherent, bounded, and covered by targeted Windows regression tests.

Review effort: Balanced
Findings: None

What changed in this PR

Fixes Windows CI failure propagation and preserves lifecycle benchmark evidence.

Changes:

• Propagates every Windows validation command failure.
• Retains benchmark attempts while publishing only validated results.
• Adds regressions and diagnostic documentation.

File	Description
.github/​actions/​validate-nvx/​action.yml	Fails immediately on native command errors.
.github/​actions/​run-benchmark/​action.yml	Preserves attempts and gates accepted output.
scripts/​test_nvx_tools.py	Tests PowerShell failures and benchmark outcomes.
scripts/​test_performance.py	Adds unstable-sample regressions.
doc/​benchmarks.md	Documents retained evidence and diagnosis.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.