[luthermonson]

Third MSVC-image build failure, third distinct cause — and this one is below the Dockerfile's own steps. With #191's quoting fix in, the failure moved to the snapshot commit of the verification step (a read-only RUN):

failed to commit ... during finalize: failed to reimport snapshot:
Files/Windows/Temp/DO32B1.tmp: unknown stream ID 9

DO*.tmp in Windows\Temp is the Delivery Optimization service (DoSvc), which runs inside Server Core containers and writes sparse temp files on its own schedule. The Windows layer archiver (go-winio backuptar) can't serialize sparse backup streams — stream ID 9 is BACKUP_SPARSE_BLOCK — so whichever RUN happens to be live when DoSvc writes loses its layer commit. Nondeterministic by nature: earlier runs committed the same steps fine.

Fix: a first RUN (right after SHELL) that stops DoSvc, sets it Disabled, and sweeps any DO*.tmp already present. Service start-type is registry state, so the single early layer protects every later step. -ErrorAction SilentlyContinue on the service ops so a future base without DoSvc doesn't fail the build — absence is success.

Cost: the new leading layer invalidates the cached VS Build Tools install, so the next build re-downloads it once (~25 min). Unavoidable, and that cache would eventually have been poisoned by the same bug anyway.

Failure ledger for this image, for the record:

1. run 1 — checkout killed by the fleet's wedged-teardown incident (fixed operationally + fix(scheduler): bound runner teardown and retry failed env creates #190)
2. run 2 — PowerShell quote-stripping in the rustup step (fix(images): no double quotes in the MSVC image's rustup step #191, merged)
3. run 3 — this: DoSvc sparse files breaking layer commit

VS Build Tools install + all six layout probes have passed on real hardware, so once this lands the image should finally publish.