docs(perf): retain rejected actual-server PGO screens

Author: louistrue

scripts/perf/README.md

@@ -857,3 +857,14 @@ The next step is fresh training and qualification of the actual Darwin server
 with its release profile, allocator, features and build-std settings. Do not
 reuse the probe profile as shipping evidence or turn PGO on unconditionally.
 [Sanitized measurements and limits](evidence/native-pgo-current-2026-09-07/README.md).
+
+The separately matched [counter-only HTTP PGO screen](evidence/server-pgo-counter-http-4059/README.md)
+did not meet its predeclared continuation threshold and retained a diagnostic
+mismatch despite exact geometry and data-model payloads. It was rejected before
+repeated qualification; no flags shipped. This does not dispose of full-value
+PGO, which requires its own fresh training, compatibility audit and endpoint
+qualification. Do not repeat the same counter-only profile as a hidden win.
+
+### Rejected full-value actual-server PGO (#4059)
+
+Fresh full-value profiles from a generator-only graceful shutdown did not qualify the shipping Darwin server. The held-out screen missed its continuation threshold, retained a strict CSG diagnostic mismatch and exposed a largest-model time/memory regression. The separate native processing-probe result does not transfer automatically to the actual endpoint. Stop both server variants without enabling PGO or adding repeated qualification; do not substitute the training cohort or drop failed diagnostics to promote them. The [full-value evidence](evidence/server-pgo-full-value-http-4059/README.md) preserves source/profile provenance, compiler compatibility limits and all corpus outcomes.

scripts/perf/evidence/server-pgo-counter-http-4059/README.md

@@ -0,0 +1,17 @@
+# Rejected actual-server counter-only PGO screen (#4059)
+
+Do not ship or expand this candidate. The held-out screen falls below its predeclared continuation threshold, and a CSG diagnostic comparison remains failed. No five-pair cohort was started. This verdict applies to the continuous counter-only candidate, not PGO in general.
+
+[screen.json](./screen.json) retains every anonymous model, fixture hash, pair order, cold HTTP readiness, startup/upload/cache milestones, geometry counts, sampled RSS and exact gate. The primary held-out timing aggregate includes the diagnostic-failed model explicitly; the separately reported qualified subset excludes it. The subset is not a replacement primary result. Training fixtures remain marked and are not given extra weight.
+
+Both artifacts use the corrected server JSON cache implementation from #4064, the Darwin downloadable release/build-std configuration, default allocator/features and identical source hashes. The candidate adds the fresh continuous IR counter profile. Its value-site warnings were retained and checked against matching LLVM source: branch weights are applied, but value profiling is absent. This is distinct from the earlier native full-value processing probe, which did not measure this HTTP endpoint or this artifact.
+
+All raw geometry batch sequences and data-model bytes match across cold arms and cache replay. The complete semantic comparison fails for model-18 because its CSG failure count differs; metadata, symbolic data and both cache replays remain exact. [#4067](https://github.com/LTplus-AG/ifc-lite/issues/4067) tracks the source audit: the current KernelError emitter records accepted open topology, while shared mesh caches omit diagnostics on hits and allow concurrent rebuilds. That mechanism can vary counts without changing mesh bytes, but the retained aggregate logs do not identify the extra operation. This explanation does not waive the failed gate.
+
+The timed boundary includes raw upload, complete geometry SSE and data-model receipt. It excludes offline verification and client reconstruction. Fresh server processes and empty caches were used for each arm. Both captures and process cleanup completed before the isolated offline verifier; verified APFS copy-on-write retention then ran before the next pair. Each pair passed its free-space reserve check. Interrupted earlier observer pilots were excluded rather than pooled or reconstructed.
+
+RSS is sampled process residency, not physical footprint. Very short requests can finish before a representative sample, so their peaks and a cross-corpus memory aggregate are unqualified. Startup remains separately visible. The screen does not establish browser readiness, server-restart cache behavior, other-platform performance or absence of regressions.
+
+A successor actual-server full-value PGO experiment remains pending. Its separate graceful-generator mechanism permits normal profile flushing; neither its eventual outcome nor the native processing-probe result should be attributed to this rejected counter-only screen.
+
+The separate [full-value actual-server screen](../server-pgo-full-value-http-4059/README.md) is now complete and also rejected under its frozen gates. No results are pooled and no shipping compiler flags change.

scripts/perf/evidence/server-pgo-counter-http-4059/screen.json

@@ -1,40 +1,40 @@
-# Actual Darwin server PGO qualification: pending
+# Actual Darwin server PGO: both screens rejected
 
-The native processing probe has a qualified corpus result in the [separate record](../native-pgo-current-2026-09-07/README.md). The actual HTTP server screen is still running. No actual-server gain, universal improvement, shipping readiness or profile-use flag change is claimed here.
+The native processing probe has a qualified corpus result in the [separate record](../native-pgo-current-2026-09-07/README.md). The [counter-only HTTP screen](../server-pgo-counter-http-4059/README.md) did not meet its continuation threshold and retained one failed diagnostic gate. It did not continue to five pairs. The distinct [full-value generator-only-shutdown screen](../server-pgo-full-value-http-4059/README.md) also failed its continuation gates; its results are not pooled with this profile. No shipping readiness or profile-use flag change is claimed here.
 
 ## What has passed
 
-Five fixed public fixtures trained a fresh instrumented server after the JSON cache roundtrip correction (#4064). Each completed cold geometry/data-model delivery and exact same-process cache replay. Profiles are continuous counter-only, with no value-profile data. All three compiled-source hash maps match despite a later documentation-only commit. Artifact, compiler, source, training and profile evidence is supplied separately in [stack PR #4070](https://github.com/LTplus-AG/ifc-lite/pull/4070), including `pre-screen-provenance.json`; it is not part of this harness-only commit.
+Five fixed public fixtures trained a fresh instrumented server after the JSON cache roundtrip correction (#4064). Each completed cold geometry/data-model delivery and exact same-process cache replay. Profiles are continuous counter-only, with no value-profile data. All three compiled-source hash maps match despite a later documentation-only commit. Artifact, compiler, source, training and profile evidence is in `pre-screen-provenance.json`.
 
-LLVM21 value-site warnings do not discard branch profiles: `populateCounters()` and `setBranchWeights()` precede `annotateValueSites()`, whose mismatch returns only from the value annotation helper. The [matching upstream source](https://github.com/llvm/llvm-project/blob/llvmorg-21.1.5/llvm/lib/Transforms/Instrumentation/PGOInstrumentation.cpp) and its digest/line references are recorded. Missing-function diagnostics and value-site warnings remain visible; this is not a warning-free build claim.
+LLVM 21 value-site warnings do not discard branch profiles: `populateCounters()` and `setBranchWeights()` precede `annotateValueSites()`, whose mismatch returns only from the value annotation helper. The [matching upstream source](https://github.com/llvm/llvm-project/blob/llvmorg-21.1.5/llvm/lib/Transforms/Instrumentation/PGOInstrumentation.cpp) and its digest/line references are recorded. Missing-function diagnostics and value-site warnings remain visible; this is not a warning-free build claim.
 
 ## Measurement limits
 
 Cold means a fresh server process, empty application cache and raw IFC upload. The operating-system page cache is not purged; preflight fixture hashing can warm it. Local loopback HTTP includes upload, wire persistence and observer overhead; it does not measure internet latency or physical-disk cold reads. Cold readiness ends at complete data-model receipt; cache publication/replay has separate timestamps. Memory is sampled server RSS, not physical footprint.
 
-Both timed arms finish and their server processes are reaped before offline decoding or evidence retention. The offline child exits before the next pair. One operator owns the timing host; no concurrent builds, profiling, compression or heavy hashing. A single pair is a screen, not a qualified five-pair estimate. The held-out22 cohort is primary; all27 and fixed training5 are secondary.
+Both timed arms finish and their server processes are reaped before offline decoding or evidence retention. The offline child exits before the next pair. One operator owns the timing host; no concurrent builds, profiling, compression or heavy hashing. A single pair is a screen, not a qualified five-pair estimate. The held-out 22 cohort is primary; all 27 and fixed training 5 are secondary.
 
 ## Reproduction source
 
 `reproduce/` contains the actual HTTP transport, full wire/data-model witnesses, tests and paired driver, plus parameterized build/training/profile tools. `harness-source-map.json` identifies exact private-origin hashes and published hashes, including explicit path-parameter adaptations. These are manual evidence tools, not production entry points or CI performance gates. User IFC files and generated wire evidence are never committed.
 
-Use Python3.9 or newer and the recorded dependencies in `reproduce/requirements.txt`; use the repository-pinned Rust toolchain and its matching `llvm-profdata`. Darwin training additionally needs the documented16KiB profile section alignment. Do not reuse profiles across source changes or infer other target/compiler behavior.
+Use Python 3.9 or newer and the recorded dependencies in `reproduce/requirements.txt`; use the repository-pinned Rust toolchain and its matching `llvm-profdata`. Darwin training additionally needs the documented 16 KiB profile section alignment. Do not reuse profiles across source changes or infer other target/compiler behavior.
 
-Provide an experiment `plan.json` with sourceCommit, profileKind and exactly five training rows `{label, path, publicSha256}`. The fixture schema examples are supplied by [stack PR #4070](https://github.com/LTplus-AG/ifc-lite/pull/4070), including `corpus.example.json`; they are not included in this harness-only commit. Replace example paths with local files. The driver requires exactly27 unique fixture hashes and a training subset of5. The same follow-up supplies `capacity-projection.example.json` with label/SHA-linked budgets. Supply an explicitly reviewed PROJECTION file; storage requirements must be re-evaluated for different fixtures.
+Provide an experiment `plan.json` with sourceCommit, profileKind and exactly five training rows `{label, path, publicSha256}`. `corpus.example.json` documents the fixture manifest schema; replace example paths with local files. The driver requires exactly 27 unique fixture hashes and a training subset of 5. `capacity-projection.example.json` contains measured label/SHA-linked capacity budgets; storage requirements must be re-evaluated for different fixtures.
 
-From this directory, with SOURCE, EXPERIMENT, COMMIT, CORPUS, PROJECTION and PROF_DATA_TOOL set explicitly by the operator:
+From this directory, with SOURCE, EXPERIMENT, COMMIT, CORPUS and PROF_DATA_TOOL set explicitly by the operator:
 
 ```bash
 python reproduce/build_server.py --source "$SOURCE" --experiment "$EXPERIMENT" --expected-commit "$COMMIT" control
 python reproduce/build_server.py --source "$SOURCE" --experiment "$EXPERIMENT" --expected-commit "$COMMIT" generate
 python reproduce/train.py --experiment "$EXPERIMENT"
 python reproduce/audit_profile.py --experiment "$EXPERIMENT" --llvm-profdata "$PROF_DATA_TOOL"
 python reproduce/build_server.py --source "$SOURCE" --experiment "$EXPERIMENT" --expected-commit "$COMMIT" use
-python reproduce/screen_http_v2.py --manifest "$CORPUS" --training-plan "$EXPERIMENT/plan.json" --base-provenance "$EXPERIMENT/control-provenance.json" --candidate-provenance "$EXPERIMENT/use-provenance.json" --projection "$PROJECTION" --out "$EXPERIMENT/http-screen" --cpu-window-confirmed
+python reproduce/screen_http_v2.py --manifest "$CORPUS" --training-plan "$EXPERIMENT/plan.json" --base-provenance "$EXPERIMENT/control-provenance.json" --candidate-provenance "$EXPERIMENT/use-provenance.json" --projection capacity-projection.example.json --out "$EXPERIMENT/http-screen" --cpu-window-confirmed
 ```
 
 These commands intentionally refuse existing build targets/profiles/output directories. Keep failures instead of silently retrying or overwriting. The APFS retention helper only operates on explicitly released generated evidence; it verifies exact bytes and keeps distinct paths/inodes. Run its tests and inspect capacity permits before use on another filesystem.
 
 Run witness tests with `python -m unittest discover -s reproduce -p 'test_*.py'`; retention tests separately use `-s reproduce/retention`. They encode actual Arrow/Parquet data and mutate payload fields. No source-text assertions or private IFC fixtures are required.
 
-The eventual HTTP verdict will be appended only after all retained output, memory and timing gates have been reviewed. Issue#4059 remains open while that work is active.
+The counter-only verdict is recorded separately, with all failures. The bounded qualification in #4059 is complete with both actual-server candidates rejected. `pre-screen-provenance.json` is the immutable initial counter-only preparation snapshot, including its then-pending status.