refactor(platform-probes): route every probe's output through one sink

CHECKLIST-mutation-survivors.md

@@ -77,15 +77,28 @@ to the engineer, not to whoever picks up this checklist.
 
 - [ ] **MS-2.1** -- **`windows-platform-probes`: 511 survivors, 17% caught.**
   See [windows-platform-probes.md](mutation-sweeps/2026-09-02/windows-platform-probes.md).
-  Fourteen executable probes you *run* to answer a question about Windows, not a
-  library with a test surface; `publish = false` at version `0.0.0`. Most of the
+  Executable probes you *run* to answer a question about Windows, not a library
+  with a test surface; `publish = false` at version `0.0.0`. Most of the
   survivors are `main`-adjacent code no test was ever going to reach. Judging
   this crate by mutation score is measuring the wrong thing.
-  A related, separately-tracked item: twelve of these probes still print
-  directly rather than through the `Report` sink, tracked as `SH-13.4` on the
-  branch that ships the topology and queue crates. That checklist is not in this
-  repository yet, so this deliberately names the item rather than linking a file
-  that does not exist. Doing that first would make some of this reachable.
+  **The sweep measured a fourteen-probe tree, of which eight are in this
+  repository** -- `core_affinity`, `peer_index_cache`, `doorbell_cost`,
+  `queue_contention`, `request_cost` and `topology` were only ever on the
+  originating branch, so six of the fourteen sections in the sweep report have no
+  counterpart here yet. Read the totals with that in mind before scoping any of
+  it.
+  A related, separately-tracked item, **partly discharged**: at sweep time twelve
+  of those fourteen probes printed directly rather than through a `Report` sink,
+  tracked as `SH-13.4` on the branch that ships the topology and queue crates.
+  The sink has since landed here
+  ([crates/windows-platform-probes/src/report.rs](crates/windows-platform-probes/src/report.rs))
+  and all eight probes in this repository route through it, so what remains of
+  `SH-13.4` is the six branch-only probes, and it stays named rather than linked
+  because that branch checklist is still not in this repository. The crate's own
+  durable work now has a home to link:
+  [crates/windows-platform-probes/CHECKLIST.md](crates/windows-platform-probes/CHECKLIST.md).
+  For the eight that landed, the "would make some of this reachable" prerequisite
+  is met -- each `main` is one line and each report is a `String` a test can read.
 
 - [ ] **MS-2.2** -- **`windows-file-watcher-example-test-harness`: 69 survivors.**
   See [windows-file-watcher-example-test-harness.md](mutation-sweeps/2026-09-02/windows-file-watcher-example-test-harness.md).

PLANS.md

@@ -20,6 +20,7 @@ plans tracker: [crates/windows-file-enumeration-sys/PLANS.md](crates/windows-fil
 | [CHECKLIST-thread-ambient.md](CHECKLIST-thread-ambient.md) | in progress | M22-M23: extract the captured-context composite into `windows-thread-ambient-sys`, a standalone platform layer that captures a thread's ambient state and applies it on another thread. M24-M26: `windows-namespace-request-sys`, marshalable Win32 namespace call parameter sets, over a round-one entry list audited from three real consumers (this repository's watcher and enumeration crates, and `MikeGrier/Globazog-rs`) rather than guessed. M27: `windows-platform-probes`, a durable home for the measurements this workspace's designs rest on, under a three-tier scheme (asserted / ignored / binary-only) where every tier is compiled by an ordinary build. Feature-scoped and deleted when complete; it is the whole of the `mikegrier/thread-ambient` branch's work, and is deliberately separate from the deferred namespace-facility items in [CHECKLIST.md](CHECKLIST.md). | [crates/windows-thread-ambient-sys/DESIGN-NOTES.md](crates/windows-thread-ambient-sys/DESIGN-NOTES.md) |
 | [crates/windows-overlapped-io-sys/CHECKLIST.md](crates/windows-overlapped-io-sys/CHECKLIST.md) | not started | M14: finish the contract audit -- categories 1, 2, 6, 8, 9 were not examined -- and sweep `outstanding()` for the advisory-predicate hazard. | [crates/windows-overlapped-io-sys/DESIGN-NOTES.md](crates/windows-overlapped-io-sys/DESIGN-NOTES.md) |
 | [crates/windows-ioring-sys/CHECKLIST.md](crates/windows-ioring-sys/CHECKLIST.md) | in progress | Memory-safe Rust over the Windows `IoRing` submission/completion ring, as a new crate. M1-M7 (ring lifecycle through the `ring-copy` topology-aligned sample) are complete and archived. The parked, pinned-thread `M6+` work and the new M10 contract audit remain. | [crates/windows-ioring-sys/DESIGN-NOTES.md](crates/windows-ioring-sys/DESIGN-NOTES.md) |
+| [crates/windows-platform-probes/CHECKLIST.md](crates/windows-platform-probes/CHECKLIST.md) | not started | M1: stream a probe's report as it is measured. The one-sink refactor has each renderer compose its report into a `String`, which buys the seam that lets a probe's findings be asserted rather than eyeballed, and gives up output appearing as it is measured. `emit_report` recovers that for an unwinding panic only; Ctrl-C and an abort during unwinding still discard the buffer. Costs most on `probe-cancel-io`, which runs about twenty seconds precisely when the wedge it hunts for occurs -- precisely when a reader interrupts. | [crates/windows-platform-probes/DESIGN-NOTES.md](crates/windows-platform-probes/DESIGN-NOTES.md#d-buffered-report) |
 | [CHECKLIST-mutation-survivors.md](CHECKLIST-mutation-survivors.md) | not started | Work queued from the workspace-wide cargo-mutants sweep of 2026-09-02, whose findings are kept in [mutation-sweeps/2026-09-02/](mutation-sweeps/2026-09-02/README.md) rather than re-derived -- the run took roughly fourteen hours. 2,792 caught, 1,112 survived, 198 timed out. **The headline numbers mislead in three ways and the README says how**: a timeout in a blocking-API crate is usually a detection that lost its name rather than a gap (measured: one of `windows-waitable-queues`' 120 timeouts fails four tests in 0.00s when re-injected alone), a low score on an executable probe crate is measuring the wrong thing, and three kinds of survivor -- equivalent mutants, unreachable code, and constants that want a `const` assertion -- are not missing tests at all. M1 covers the shipping crates; M2 holds the two crates that are not libraries and whose scope is an engineer's decision; M3 re-runs and prunes rather than hand-editing the tool's output into a second source of truth. | [mutation-sweeps/2026-09-02/README.md](mutation-sweeps/2026-09-02/README.md) |
 
 Add a row here when new work is planned, against [CHECKLIST.md](CHECKLIST.md) or any crate's.

crates/windows-platform-probes/CHECKLIST.md

@@ -0,0 +1,55 @@
+# Checklist: windows-platform-probes
+
+Design decisions are in [DESIGN-NOTES.md](DESIGN-NOTES.md). This crate's *creation* is tracked
+separately, in the workspace [CHECKLIST-thread-ambient.md](../../CHECKLIST-thread-ambient.md) milestone
+M27; that file is feature-scoped and is deleted when its feature completes, so durable follow-up work
+for the crate belongs here instead.
+
+## M1 -- Stream a probe's report as it is measured
+
+The report sink introduced with [src/report.rs](src/report.rs) has each renderer compose its whole
+report into a `String`, which `emit_report` then hands to a [`Report`]. That buys the seam the crate
+wanted -- a probe's findings can be asserted rather than eyeballed -- and it gave up a property the
+previous line-by-line `println!` had for free: output appearing as it is measured.
+
+`emit_report` recovers it for an **unwinding panic** only, by catching, emitting what was composed, and
+resuming. A termination that does not unwind still discards the buffer:
+
+- **Ctrl-C.** The default Windows console handler terminates the process; no unwind runs.
+- **Abort from a panic raised while already unwinding.**
+
+The case that costs most is `probe-cancel-io`: four attempts against a five-second watchdog, so about
+twenty seconds, and it runs that long *precisely when the wedge it hunts for occurs* -- which is
+precisely when a reader gives up and interrupts. The measurement most worth having is the one most
+likely to be thrown away.
+
+See [DESIGN-NOTES.md](DESIGN-NOTES.md) -> [The report is buffered, and what that
+costs](DESIGN-NOTES.md#d-buffered-report) for why it was built this way and why the fix is a separate
+piece of work rather than a correction to that one.
+
+- [ ] **M1.1** -- Decide how a formatted line reaches the sink, because that choice is what makes the
+  rest mechanical. Every renderer today writes through `let _ = writeln!(out, ...)` against a
+  `String`'s `fmt::Write` -- roughly 156 sites across the eight probes -- so the sink must accept
+  *formatted* output, not just `&str`, or every site grows a `format!` and an allocation per line.
+  The options differ in what they cost callers, and the choice is the engineer's:
+  (a) give `Report` a method taking `fmt::Arguments` plus a `report_line!` macro, so a call site stays
+  one line and reads almost as it does now;
+  (b) implement `fmt::Write` for the sink types, so `writeln!(out, ...)` keeps working verbatim against
+  a `&mut dyn Report` -- smallest diff at the call sites, but `fmt::Write` is line-agnostic, so the sink
+  must split on newlines internally and `Captured`'s one-line-per-entry guarantee has to be re-established
+  rather than assumed;
+  (c) leave the renderers writing to a `String` and flush it to the sink at each line boundary, which
+  streams without touching the call sites but keeps two buffers.
+
+- [ ] **M1.2** -- Convert the eight renderers to write into the sink as they measure, and simplify
+  `emit_report` accordingly: once lines leave as they are produced, catching the unwind is no longer
+  what makes partial output work, and the `catch_unwind`/`resume_unwind` pair should be removed rather
+  than left as machinery that no longer earns its place. Keep `Captured` working -- it is what every
+  in-process test asserts against.
+
+- [ ] **M1.3** -- Verify by interruption, not by reasoning. Sending Ctrl-C to a probe part-way through
+  must leave the already-measured lines on the terminal; today it leaves nothing. Assert the in-process
+  half (a renderer that panics mid-report still has its finished lines in a `Captured`) as a unit test,
+  and record the Ctrl-C observation in [DESIGN-NOTES.md](DESIGN-NOTES.md) -- an interactive signal is not
+  something to assert in CI, but it is the property the milestone exists for, so it must be measured
+  once rather than assumed.

crates/windows-platform-probes/Cargo.toml

@@ -48,10 +48,26 @@ name = "probe-pool-growth"
 path = "src/bin/pool_growth.rs"
 
 [dependencies]
+# **Every workspace dependency below is path-only, with no `version`**, because
+# this crate is never distributed at all -- not to a registry, and not as a
+# released binary either, unlike `windows-placement-probe` next door. These
+# probes are a development instrument, run from a checkout, and `publish = false`
+# above is the whole story.
+#
+# A `version` beside a `path` is consulted only when the depending crate is
+# packaged, but cargo still requires the path crate's own version to satisfy it
+# at every build -- so a pin left behind by a bump breaks the whole workspace's
+# resolution rather than only this crate's.
+#
 # The pool-growth probe measures the shipping API rather than a
 # reimplementation of the SDK's inline environment helpers, so it depends on the
 # real crate.
-windows-threadpool-sys = { version = "0.1.3", path = "../windows-threadpool-sys" }
+windows-threadpool-sys = { path = "../windows-threadpool-sys" }
+# Every probe's report opens with a line naming the machine that produced it and
+# whether the measurement is tainted, so a captured finding cannot be pasted
+# somewhere and compared against something it does not describe. That banner is
+# `windows-placement-probe`'s to render, not a second copy here.
+windows-placement-probe = { path = "../windows-placement-probe" }
 
 [dependencies.windows-sys]
 version = "0.61.2"

crates/windows-platform-probes/DESIGN-NOTES.md

@@ -1,7 +1,9 @@
 # Design notes: windows-platform-probes
 
-Decisions for this crate. Pending work is in the workspace
-[CHECKLIST-thread-ambient.md](../../CHECKLIST-thread-ambient.md), milestone M27.
+Decisions for this crate. Pending work is in [CHECKLIST.md](CHECKLIST.md); the
+crate's *creation* is tracked separately in the workspace
+[CHECKLIST-thread-ambient.md](../../CHECKLIST-thread-ambient.md), milestone M27,
+which is feature-scoped and deleted when that feature completes.
 
 ## A probe is a function that returns an observation, never a program that prints one
 
@@ -457,3 +459,42 @@ characters, so no mangling occurred -- an accident of environment, not of
 architecture. It would fail on any host with a longer user name, on either
 architecture. Recorded here because it is exactly the kind of result this
 comparison exists to classify correctly: a red build that is **not** a finding.
+
+## The report is buffered, and what that costs
+
+<a id="d-buffered-report"></a>
+
+Every probe's output goes through one sink: the renderer composes its report into
+a `String` and `emit_report` hands it to a [`Report`]. That is what the
+repository's architectural pre-step asks for -- the real stream is named in
+`report` and nowhere else, so a probe's `main` is one line that chooses no stream
+at all -- and it is what lets a test assert a probe's findings instead of a human
+reading them off a terminal.
+
+It also gave something up. Printing line-by-line meant whatever had been measured
+was already on the terminal; buffering means nothing is, until the renderer
+returns. These probes call into measurements documented to panic --
+`worker_context`'s impersonating observation panics three ways, and its renderer
+composes several completed findings before reaching it -- stated without a count
+deliberately, because the number moves whenever a line is added, and a stale count
+is the drift this repository keeps paying for -- so this is not hypothetical. For an
+instrument whose whole purpose is that a failure be diagnosable, how far it got is
+exactly the information worth keeping.
+
+`emit_report` recovers it for an unwinding panic: catch, emit what was composed,
+resume, so the exit status and message are unchanged and the partial report is
+added to them rather than substituted. **It does not recover it for a termination
+that does not unwind** -- Ctrl-C, which the default Windows console handler serves
+by terminating the process, and an abort from a panic raised during unwinding.
+
+That bound is known rather than overlooked, and it is not a defect in
+`emit_report` to be patched there: the fix is renderers writing into a [`Report`]
+as they measure rather than into a `String`, which restores streaming for *every*
+termination mode and makes the catch/resume machinery unnecessary. That changes
+every renderer and the shape of the sink trait, so it is queued as its own work --
+[CHECKLIST.md](CHECKLIST.md) milestone M1 -- rather than folded into the commit
+that introduced the sink.
+
+The ordering was deliberate. The sink had to exist before the probes could be
+peeled off their originating branch in reviewable stages, and a design that
+streams is a different design, not a later revision of this one.

crates/windows-platform-probes/PLANS.md

@@ -4,4 +4,5 @@ Design decisions are in [DESIGN-NOTES.md](DESIGN-NOTES.md).
 
 | Path to CHECKLIST.md | Status | Brief description | Design Notes |
 |---|---|---|---|
+| [CHECKLIST.md](CHECKLIST.md) | not started | M1: stream a probe's report as it is measured. The report sink buffers each report into a `String`, so a termination that does not unwind -- Ctrl-C, or an abort during unwinding -- discards it, where the line-by-line printing it replaced kept it. Costs most on `probe-cancel-io`, which runs about twenty seconds precisely when the wedge it hunts for occurs. | [DESIGN-NOTES.md](DESIGN-NOTES.md#d-buffered-report) |
 | [../../CHECKLIST-thread-ambient.md](../../CHECKLIST-thread-ambient.md) | in progress | M27: create the crate, migrate this session's probes into it under the three-tier scheme, and queue migration of the nine earlier measurements that still live only in git-ignored scratch. | [DESIGN-NOTES.md](DESIGN-NOTES.md) |