v0.9.0

Full Changelog: v0.8.8...v0.9.0

v0.8.8 — symbols strict-GUID matching + capture memory-mode selection

etw-mcp v0.8.8 — Combined Symbols + Capture-Profiles Release

This is a combined release covering two streams of parity work that landed together:

---

fix(symbols): Strict GUID+Age PDB matching — check_symbols & diagnose now always agree (#29)

Fixes nijosmsft/mcp-servers#3, #8, #15, #19, #21.

The root cause across the symbols stream: check_symbols trusted a cached SymbolSource="pdb" without verifying the PDB on disk matched the trace's RSDS GUID+Age, causing it to disagree with diagnose_symbol_load. All tools now apply the same strict GUID+Age rule and match on the authoritative symstore folder name (<GUID32><hexAge>), readable even for MSFZ-compressed PDBs.

Fixes:

• #3 — New MISMATCHED_PDB status; tcpip.sys/afd.sys now correctly flagged (was false-OK). diagnose_symbol_load is folder-name aware; ntoskrnl.exe MSFZ folder match stays trusted. The two tools never disagree for the same module/trace.
• #3 (secondary) — read_pdb_signature reads PDB Info Stream (stream 1) not stream 0, fixing GUID misread on normal PDBs.
• #8 — resolve_symbols prefers native in-process symbolizer; xperf access-violation (0xC0000005) detected and reported gracefully.
• #15 / #19 — check_symbols surfaces PRE_RESOLVED for dotnet pre-symbolized rows instead of false 0% / MISSING.
• #21 — Stack rebuild warns clearly when symbolizer raises on bulk_resolve instead of silently producing all-unknown frames.

Tests: 16 new symbol regression tests (test_symbols_regression.py). Full suite post-merge: 1108 passed / 16 skipped.

---

feat(capture): First-class memory logging-mode selection on capture tools (#30)

Fixes nijosmsft/mcp-servers#9.

get_capture_commands and get_capture_instructions now accept a mode parameter ("file" default | "memory"). Previously, memory-mode captures required hand-editing; wpr -start <p>.wprp (no -filemode) silently failed with 0xc5584017 for callers who didn't realize file mode was hard-wired.

Behaviour:

• mode="memory" — live wpr -start <profile>.wprp with no -filemode, selecting the bundled LoggingMode="Memory" variant (fixed-size RAM ring, merged to ETL at -stop). Preferred for high-rate captures where file mode drops events.
• mode="file" — existing -filemode behaviour (safe default; no caller breakage).
• Unselected mode rendered as a commented-out alternative in the PowerShell block.
• Unknown mode → friendly error. pktmon ignores mode (no WPR logging mode).

Tests: 7 new capture-profile mode tests. Full suite post-merge: 1111 passed / 16 skipped.

---

Assets

• etw_mcp-0.8.8-py3-none-any.whl — installable wheel
• etw_mcp-0.8.8.tar.gz — source distribution

v0.8.7 — dotnet sidecar: CSwitch stacks, ReadyThread, process-name synthesis, stack attribution

v0.8.7 — dotnet sidecar: CSwitch stacks, ReadyThread, process-name synthesis, stack attribution

This release fixes the dotnet sidecar stream (PR #28). Five blocking defects resolved with exact xperf-oracle parity on mmsg-stacks.etl.

Fixed

• #5 — CSwitch stacks all-null: QPC timestamp-only fallback pairs CSwitch+StackWalk across TID mismatch — 168,244/168,244 rows now carry a Stack (0 → 100%).
• #6 — PendingStackBuffer evicting ~24% of stacks: FIFO capacity 1024 → 65,536; O(1) _byQpc index + TsFallbackPairings telemetry. Eviction 24% → 7.6%.
• #7 — 0 ReadyThread events: _wantReady auto-activated with CSwitch. 83,455 rows (== xperf oracle).
• #12 — CSwitch missing OldProcessName/NewProcessName: Synthesized from PID→name map; fixes get_lock_contention crash on dotnet traces.
• #11 — Stacks collapse to 1 unknown row: Image index from raw Image/* frames; 94 real modules now returned.

Added

• #17 — Parameterized CSwitch schema parity tests: 1097 passed / 16 skipped.

v0.8.6 — DPC/ISR + DiskIO fixes

etw-mcp v0.8.6 — DPC/ISR + DiskIO fixes (Carol's stream)

Merged: #27 (squash commit 4933386) · Branch: fix/etw-dpc
Validated by: Clint (tester) + Heimdall (architect) — both APPROVE

Bug Fixes

get_dpc_per_cpu >100% (#4)
DPC per-CPU percentages now use the trace duration as the denominator (from
trace.duration_seconds / trace_metadata.DurationSeconds). NDIS.SYS CPU40
dropped from 278.7% to 22.27%; no values exceed 100%. Exact xperf-oracle parity
confirmed (NDIS DPC+ISR total: 10,441,034 rows match).

DPC silent exception swallow / wrong remediation (#13)
_get_dpc_df counts raw DPC rows before aggregation. If aggregation fails with
rows present, a ValueError is raised with resolve_symbols(trace_id) guidance
instead of silently returning "No DPC/ISR data".

get_diskio_summary no-data bug (#14)
_gather_diskio() handles xperf slash-key format (DiskIo/Read), native/dotnet
underscore-key format (diskio_read), and combined diskio parquet with
Kind/Type/Operation. Exact match: reads=12, writes=755, flushes=2.

New Tests

• #16 — DPC exception/message paths + metadata-duration handling (12/12 pass)
• #18 — DiskIO Kind/Type/underscore key normalization (all pass)
• #20 — End-to-end real ETL integration (5 pass, 1 expected xfail for BUG-1/#11)

Notes

• Symbolizer lookup failures still degrade to unknown (acceptable, consistent with sibling aggregators per Heimdall review).
• Does not touch the shared symbolizer-init path; safe to merge independently of SYMBOLS/SIDECAR streams.
• The dotnet sidecar stacks xfail (BUG-1/#11) is tracked separately.

v0.8.5

Full Changelog: v0.8.4...v0.8.5

v0.8.4

Full Changelog: v0.8.3...v0.8.4

v0.8.3

Full Changelog: v0.8.2...v0.8.3

v0.8.2

Full Changelog: v0.8.1...v0.8.2

v0.8.1

Full Changelog: v0.8.0...v0.8.1

v0.8.0

What's Changed

• feat(load): finalized manifests and async load status by @nijosmsft in #25

Full Changelog: v0.7.2...v0.8.0