Peel the non-planner planning and archive work onto its own branch

.gitignore

@@ -13,5 +13,17 @@ target
 
 # Scratch / diagnostic output (git-ignored per repo instructions)
 .scratch/
+
+# windows-placement-probe writes its backup record into the working directory,
+# so running the tool from inside a checkout leaves one of these behind. Ignored
+# because `git add -A` will otherwise sweep a machine's measurements into a
+# commit, which has already happened once.
+placement-probe-v*.json
 .vs
 .vscode/settings.json
+
+# tpu-mcp writes <file>.bak beside any file it repairs. Those are transient
+# backups of a repair that has already been verified and committed, so they are
+# never wanted in history -- and being adjacent to the file they back up, they
+# are easy to sweep up with `git add -A` without noticing.
+*.bak

COMPLETED-PLANS.md

@@ -8,6 +8,7 @@ and in [crates/windows-threadpool-sys/COMPLETED-CHECKLIST.md](crates/windows-thr
 
 | Path to CHECKLIST.md | Completion Date | Brief description | Design Notes |
 |---|---|---|---|
+| [CHECKLIST-topology-provenance.md, archived](COMPLETED-CHECKLIST.md#checklist-topology-provenance) | 2026-08-31 | Topology content carries its own provenance. `Topology` is documented as constructible by hand and by deserializing a description written for "a machine you do not have", and nothing distinguished either from `discover()`. `Provenance` is `Synthetic` by `Default`, so forgetting is safe and claiming is deliberate; only `discover` yields `Measured`; deserialization can only downgrade, so a file cannot assert it is this machine. The marker renders *inside* the canonical fingerprint string, because a marker beside it would let a fabricated host compare equal to a real one. A pure `places_from_topology` seam was added while `measure()` was deliberately left without one -- a seam that only moves data is safe, one that lets fabricated labels reach real hardware is not -- which closed an unverifiable NUMA mapping: hardcoding the node to 0 passed the entire suite beforehand and fails three tests now. | [crates/windows-topology-sys/DESIGN-NOTES.md](crates/windows-topology-sys/DESIGN-NOTES.md) `D-12`, [crates/windows-platform-probes/DESIGN-NOTES.md](crates/windows-platform-probes/DESIGN-NOTES.md) |
 | [CHECKLIST.md](CHECKLIST.md) | 2026-08-17 | Workspace metadata, release automation, name reservation, shared cross-crate invariants, generation-stamped operation identities so a retained `OperationId` cannot alias a recycled operation, and six rounds of review hardening: typed wait provenance, teardown-gated re-arming, borrow-checked callback environments, reusable cleanup groups, `stop_and_drain`, borrow-checked exclusivity for the blocking backend, a documented wait-overlap contract, and rejection of values the Win32 fields cannot honour across every adapter. | [DESIGN-NOTES.md](DESIGN-NOTES.md) |
 | [crates/windows-overlapped-io-sys/CHECKLIST.md](crates/windows-overlapped-io-sys/CHECKLIST.md) | 2026-08-17 | Overlapped-I/O foundation complete: endpoints/provenance, operation storage, raw IOCP and blocking backends, cancellation/rundown, submission seam, safe per-family adapters for file read/write plus scatter/gather (`fs`) and sockets on both backends (`socket`), and a buffer-owning but `unsafe` raw-control-code `DeviceIoControl` seam (`device`). | [crates/windows-overlapped-io-sys/DESIGN-NOTES.md](crates/windows-overlapped-io-sys/DESIGN-NOTES.md) |
 | [crates/windows-threadpool-sys/CHECKLIST.md](crates/windows-threadpool-sys/CHECKLIST.md) | 2026-08-17 | Thread pool complete: callback environment, private pools, cleanup groups, work, one-shot and periodic timers as distinct types, waits that own a handle of proven provenance, and the `TP_IO` backend over the shared seam, with examples, documentation, and an opt-in timer stress suite. | [DESIGN-NOTES.md](DESIGN-NOTES.md) |
@@ -23,3 +24,4 @@ and in [crates/windows-threadpool-sys/COMPLETED-CHECKLIST.md](crates/windows-thr
 | [CHECKLIST.md](CHECKLIST.md) | 2026-08-27 | M3 executable sequencing rules: M2 covered the value-level contract facts and recorded that sequencing rules -- ordering, bracket entry states, terminality -- would stay prose. That was too pessimistic; what cannot express them is the *type system*, not the codebase. `ContractChecker` (in `windows-file-watcher`, behind `test-util`) is a per-`WatchId` state machine over one subscription's notification stream, checking terminality, tier-conditioned emission (delegated to `DesyncCause::is_reachable_in`), and D-50/D-78 volume continuity and distinctness. It lives in the crate rather than the harness so one definition serves the crate's own tests, the harness generator, and a consumer's test doubles. Equal care went into what it does **not** check -- six tests assert it accepts the sequences M14 found legal but surprising, since over-constraining is the same defect as under-specifying. Adopted at `Drained::pump` so all 15 of the crate's integration tests now validate the **real** watcher's output (no violations found; verified the guard fires by sabotage). Four hand-written restatements in the harness collapsed into one generate-then-validate test, with generator-*coverage* properties kept and renamed to say so. Known gap left visible: two harness tests still hand-encode contract rules the checker does not yet cover. | [DESIGN-NOTES.md](DESIGN-NOTES.md#restatement-drift) |
 | [CHECKLIST-review-baseline.md](COMPLETED-CHECKLIST.md#checklist-review-baseline) (deleted on completion; the link opens its archived entry) | 2026-08-28 | M1 automated-reviewer language baseline: closed the gap that let an automated review of PR #46 raise seven false "`size_of` is not in scope, this will not compile" findings. The reviewer was reasoning correctly from evidence stacked against it -- the edition and MSRV are structurally invisible in a diff (the toolchain pin never appears, the root manifest's `[workspace.package]` table fell six lines outside the only hunk, and the new crate manifests carry `edition.workspace = true`, a pointer to a table in no hunk), while the workspace's own pre-1.80 `size_of` sites supplied genuine in-repo precedent for the wrong reading. Created the `.github/instructions/global.rust.instructions.md` the root instructions had been citing for a file that did not exist (RB-1), stated the baseline first in `.github/copilot-instructions.md` where a reviewer reads it (RB-2), normalised seven contradicting call sites across three crates (RB-3), and added `tools/check-baseline.ps1` plus a CI job asserting twelve restatements across six files against the manifests, sabotage-verified in five ways (RB-4). Validated empirically: re-running the same reviewer on the same PR went from 7 comments to 0, with the `size_of` claim absent. Feature-scoped file deleted on completion. | [DESIGN-NOTES.md](DESIGN-NOTES.md#restatement-drift); [DESIGN-RATIONALE.md](DESIGN-RATIONALE.md) |
 | [crates/windows-impersonation-token-sys/CHECKLIST-mutant-tests.md](crates/windows-impersonation-token-sys/COMPLETED-CHECKLIST.md#mt-1) (deleted on completion; the link opens its archived entry) | 2026-09-01 | Added unit tests for both actionable mutation-test survivors in `windows-impersonation-token-sys` and recorded why the disjoint access-mask operator mutation is behaviorally equivalent. | N/A |
+| [crates/windows-platform-probes/CHECKLIST.md](crates/windows-platform-probes/CHECKLIST.md) | 2026-09-09 | M1: every probe streams its report as it measures, so a run killed partway keeps what it had already established; the buffering `catch_unwind` pair is gone with the buffer. M2: the report's parts are checked against *each other*, the defect class that a 180/0 mutation score and 28 rounds of per-artifact review both passed over, because each part was locally correct and the contradiction lived between two of them. An oracle reads the rendered artifact and relates only claims already visible in it; the topology banner is built from the read the body describes; both cost probes derive prose and NDJSON from one source; `GetFullPathNameW` is described accurately in the crate that owns it; and every CI probe step is gated on the build so diagnostics survive a failing test. | [crates/windows-platform-probes/DESIGN-NOTES.md](crates/windows-platform-probes/DESIGN-NOTES.md#d-correspondence-failures) |