fix: resolve purge-test C++ compilation and pacing validation blockers #618

Context

Blocker extracted from #614 and draft PR #616. The CPU candidate V7 is published for review, not accepted or measured. Two validation defects need resolution before that work resumes.

1. Existing secure C++ compilation failure

test/test-purge-holes.c:test_owner_sweep_pacing uses early goto done paths across initialized scalar locals (stamped_at, before_in, after_in, elapsed, before_out, after_out). This is valid C but rejected when CMake intentionally sets this .c source to LANGUAGE CXX under MI_USE_CXX. The test calls internal allocator functions with C++ linkage in that configuration, so simply forcing this test to C is not a demonstrated solution.

Reproduced with MI_SECURE=5, MI_DEBUG=3, C++17 against byte-identical test source on frozen baseline 227eef06ff03f92966f38508441d6c2f60a75135. Diagnostics report jumps to done at line 1939 crossing initializations. A likely minimal repair is an inner scope for measurement locals, with cleanup outside; preserve the timing of clock/counter reads and all checks.

2. Unresolved purge-pacing assertion

Actual ASan + owner-gate Debug candidate run: 34 cases passed; new-thread-does-not-sweep-at-once failed at line 2313 with 6 discards, expected 0. The matching baseline build passed with 0 discards. Do not call this a baseline failure or an accepted flaky test.

The test measures a process-wide discard counter around thread C. Background scavenger work remains possible, so the delta is not necessarily attributable to C. This is a hypothesis needing thread/reason attribution. Diagnostics were enabled and unsampled; both runs recorded zero successful large repurposes, proving V7's specialized removal did not execute in the failing suite. That narrows the investigation without waiving the assertion or proving a test-only bug.

Evidence / reproduction

Draft PR #616 contains the evidence archive, digest and handoff. Archive SHA256: c1a9c4ff57f1694031ed38aeee4b1e1dc9f9f05802fe925b76afe642d06465e1 (46 members; 4,864,167 bytes).

The archive preserves actual candidate and baseline executables, CMake caches/flags, commands, failed and passing logs, current source patch/new headers, and per-member hashes. Relevant members include v7-baseline-cxx-command.json, v7-baseline-cxx-error.log, v7-cxx-build.log, v7-asan-tests.log, and baseline/Testing/Temporary/LastTest.log. Original local paths in command JSON must be adapted to the checkout location.

C candidate commit 2ec4d32e; generated Rust C 28ef6ad7; fixed baseline above. The focused large-span test passes in C, secure C++ and actual ASan + owner-gate builds. No V7 performance run has been dispatched.

Proposal

1. Fix C++ scope compatibility without moving measurement calls earlier, removing const unnecessarily, changing cleanup, or weakening checks.
2. Attribute each discard observed by the pacing scenario to its thread and trigger. Establish a focused, reproducible RED signal for the real defect.
3. Fix the test if accounting is polluted, or allocator logic if pacing is genuinely wrong. Preserve separate coverage for background release and owner-side pacing; do not disable required behavior merely to make the test pass.
4. Record the disposition on perf: reduce large-page reuse CPU after #611 while preserving RSS and p99 #614 and perf: large-page reuse CPU investigation and draft V7 (#614) #616 before resuming CPU measurement.

Acceptance criteria

• Original C++ compiler repro is RED; repaired test compiles and runs in C and secure C++ with the same checks and read timing.
• Pacing failure has concrete thread/trigger attribution and focused RED → GREEN evidence; an unchanged passing rerun is not a fix.
• Original candidate failure and matching baseline pass remain in the record; no threshold relaxation, swallowed failure or waived assertion.
• Validate affected ASan/owner-gate, ordinary C/C++, native MSVC and Windows GNU configurations, plus relevant scavenger/release tests.
• Preserve C/Rust source separation and regenerate Rust if allocator C changes; pass the required local gate before push.
• Link the fix/evidence and unblock decision on perf: reduce large-page reuse CPU after #611 while preserving RSS and p99 #614 and draft PR perf: large-page reuse CPU investigation and draft V7 (#614) #616. This issue does not claim completion of the CPU improvement.

Decisions

• Priority P2; this is a validation blocker, not a demonstrated V7 memory-safety defect.
• Keep this issue focused on the two purge-test blockers; CPU acceptance remains perf: reduce large-page reuse CPU after #611 while preserving RSS and p99 #614.
• No new workflow files, unrelated policy changes, or relaxation of perf acceptance.
• The current publication is a handoff, not authorization to merge the CPU candidate.

Open questions

Which thread and purge trigger produced the six observed discards? Does the deterministic fix belong in test attribution or allocator pacing?

Related

• perf: reduce large-page reuse CPU after #611 while preserving RSS and p99 #614 / draft PR perf: large-page reuse CPU investigation and draft V7 (#614) #616: blocked CPU optimization and complete evidence.
• feat(benchmarks): short-lived-thread large-block workload on the README scaling charts — show the deficit, then verify #477 #478: original short-lived-thread pacing scenario referenced by the test.