Diagnose intermittent Windows Git capability probe failure with bounded startup evidence

Observed failure and impact

Frozen release head eb56e33d95e13d7fbd291a16c4e8e68e51f7a1c5 failed Windows shard 3, run 40321989382 / job 121569121047:

routes/apps/crud.test.js > GET /api/apps > flags non-git directories with isGitRepo and leaves a missing directory unknown

Expected { plain: false, repo: true, gone: undefined }; received { plain: false, repo: false, gone: undefined }. The case took 744 ms and the CRUD file 866 ms. Its independent execFileSync('git', ['init', '-q'], { cwd: gitDir }) completed without throwing before the HTTP assertion. The API then ran the real contained Git probe through isRepo/execGit. The log does not reveal whether that probe returned a nonzero Git result, failed containment startup, or rejected for another operational reason. This is an observed native-boundary failure with an unconfirmed cause, not a diagnosed compiler, protocol, timeout, or fixture race.

A local focused run passed 37/37. A later head 67879ccdd3300f553135063fc4c5d513f0a131b4, with a pass-through observer on the existing probe and the original strict assertion, passed Windows shard 3, run 40328012033 / job 121589838208. That is non-reproduction, not diagnosis or resolution of the earlier native failure; successful probes provide no failure discriminator.

The independent product defect that converted rejected probes into a confirmed non-Git capability flag is fixed separately by release-candidate commit df459e20cbd32ff858b1b5d67d04d19664b88913: GET /api/apps leaves capability unknown on a rejected probe while execution guards retain their default fail-closed booleans. That correction does not explain the original native failure, and the real initialized-repository assertion remains strict.

Chosen next step

Preserve bounded startup/failure evidence at the existing Windows Git boundary, then diagnose the original class of failure from the first reproduced result. Do not add a warm-up probe, retry until green, bypass containment, change Git's trust configuration, replace the real positive fixture with a mock, weaken the assertion, or raise deadlines.

• In server/lib/windowsGitProcess.js, retain fixed phase categories for compiler spawn/exit/timeout, Git lookup, broker startup/readiness/transport/protocol, plus numeric compiler exit codes and a small whitelist of spawn error codes. Preserve these fields through the terminal catch, which currently replaces causes with generic GIT_CONTAINMENT_UNAVAILABLE.
• Extend the existing pass-through diagnostic observer in server/routes/apps/crud.test.js to capture those bounded fields without changing the original operation/promise, arguments, options or concurrency. Keep the independent raw Git initialization and public HTTP assertion.
• If the observed result is a native launch-failed receipt, add a fixed native call-stage plus numeric Win32 error in server/lib/windowsGitSupervisor.cs; do not infer it from elapsed time. Keep process settlement and held obligations intact.
• Add deterministic synthetic cases through the actual execGit boundary in server/lib/windowsGitProcess.protocol.test.js for unavailable compiler exit/spawn, Git lookup and broker startup. Keep the separate real Windows process-boundary suite in server/lib/windowsGitProcess.test.js.
• Apply a targeted root-cause fix only when evidence identifies one. If a bounded observation run does not reproduce it, retain that coverage limit and leave the native cause unresolved rather than claiming the passing run fixed it.

Raw compiler stderr, paths, argv, environment values, credentials and process identities must not enter shared diagnostics. Existing fixture diagnostics already cap and redact synthetic paths; preserve those limits.

Acceptance criteria

• A failed probe reports an actionable bounded phase/result without private details; tests prove permitted metadata survives and arbitrary error text does not.
• Existing real Git-positive, plain-directory-negative and missing-directory-unknown HTTP assertions remain unchanged in meaning.
• No new command changes cold-start ordering or warms away the observed boundary; there is no fallback launch or blind retry.
• Real Windows ordinary Git, overlapping-job isolation, owned cancellation, neighboring-process preservation and settlement/teardown contracts continue passing.
• Report original failure versus later non-reproduction separately. A native cause is considered resolved only with reproduced evidence and an appropriate regression; generic startup timings alone are insufficient.

Owner: Windows Git process boundary / CI reliability. Related closed work: #13703 and #13721; #13733 covers CI efficiency and does not own this native correctness lead. No currently open duplicate was found.

Dispatch: model:heavy for native process/protocol and lifetime reasoning; effort:high for cross-boundary failure evidence and deterministic regression design. hardwareRequirements: ["windows"]; helpWanted: false because hosted Windows CI is available and no human hardware action is required.