docs: a stock-upstream baseline runs Stage 02 crash-free

Built upstream/canary_experimental (a5a18f5c7, 82 commits ahead of our merge
base) clean, to answer whether the 0x82307128 mission crash is ours or theirs.

Two tooling gaps found building it: version.h is never generated (upstream's
xenia-build.py writes it, build-canary does not invoke it, and our tree only
builds because a stale copy from an old sylpheed-re build sits in the build dir),
and build-canary reports exit 0 on a FAILED build - only the missing binary gave
it away.

Pure upstream cannot be driven at all: --hid=file is ours and there is no uinput
here. So the honest baseline is upstream plus those three pad commits. That
baseline reproduced the LOST RESUME on its second boot - black screen, guest at
522% CPU, newest host thread at 00:00:00 CPU, zero kernel calls from its handle -
and upstream's threading_posix.cc still has the two-lock-scope publish. So pure
upstream is not a stable state; it carries a bug we had already fixed.

Adding ONLY the threading fix on top - still none of the RE instrumentation -
reaches Stage 02 FLIGHT: TIME 05:03.75, wingman Rhino 103, radio dialogue, and
REMAINING OB 020 with OB badges on targets. The run ended in a legitimate GAME
OVER (the unattended craft was shot down, as autopilot-memory-driven.md warns),
not a crash. Crash dumps for the whole run: 0, against 384 on the instrumented
branch at the briefing alone.

So the mission crash is not upstream's. Whether it is in our 50 commits or fixed
among upstream's 82 this run does not separate; that needs a bisect.

REMAINING OB is visible and moves (020->019->018->017) but is NOT found. A
three-snapshot BE-u32 filter left 0 survivors; a differential across widths gave
exactly one candidate, 0xbc22e83c, and it is REFUTED - read live it held 26 while
the HUD showed 017. The empty u32 filter is itself informative: the counter is
not a plain persistent big-endian word.

docs/re/upstream-baseline.md

@@ -0,0 +1,90 @@
+# A stock-upstream baseline runs Stage 02 crash-free
+
+**Status:** ✅ `CONFIRMED` — upstream `canary_experimental` + **only** the pad
+driver and the threading fix reaches Stage 02 flight with **zero** crash dumps,
+where the instrumented branch produces 384 at the briefing and never reaches
+flight. 🔴 pure upstream on its own is **less** stable, not more — it still has
+the lost-resume race. 🔴 the `REMAINING OB` address is **not** found: the first
+candidate was refuted.
+
+## Why this was tried
+
+The instrumented branch stops at the Stage 02 briefing under a storm of
+`0x82307128` ([`title-crash-stl-tree.md`](title-crash-stl-tree.md)). The question
+"is that crash ours or upstream's?" is answerable by building upstream clean.
+
+## Building it, and two tooling gaps found on the way
+
+`git fetch upstream` works from this container. The merge base is 82 commits
+behind `upstream/canary_experimental` (`a5a18f5c7`); our branch carries 50 of its
+own.
+
+* **`version.h` is never generated.** The build fails on
+  `trace_writer.cc:17: fatal error: 'version.h' file not found`. Upstream's
+  `xenia-build.py` writes it from git HEAD; the container's `build-canary`
+  wrapper does not invoke it, and our tree only builds because a stale copy from
+  an old `sylpheed-re` build sits in the build directory. Regenerated by hand in
+  exactly the format that script emits.
+* **`build-canary` reports success on a failed build.** The harness recorded
+  "completed (exit code 0)" while ninja had stopped with `1 error generated`.
+  Only the missing binary gave it away.
+
+## Pure upstream cannot be driven — and is not more stable
+
+`--hid=file` is **ours** (`d15c8cfab` and two follow-ups), and there is no uinput
+in this container, so a genuinely pure binary boots but cannot be scripted past
+the title. The honest baseline is therefore **upstream + those three commits**.
+
+That baseline reproduced the **lost resume** on its second boot: black screen,
+guest alive at **522 % CPU**, the newest host thread at **`00:00:00`** CPU time,
+its guest handle making zero kernel calls — the exact signature from
+[`canary-scripted-input-traps.md`](canary-scripted-input-traps.md). Reading
+`upstream/canary_experimental:src/xenia/base/threading_posix.cc` confirms the
+two-lock-scope publish is still there. **So "pure upstream" is not a stable
+state: it contains a real bug this project had already fixed.**
+
+## ✅ Upstream + the threading fix: Stage 02, in flight, zero crashes
+
+Adding **only** `a60fe7d11` on top — still none of the RE instrumentation —
+`launch_mission.sh` drove boot → title → LOAD GAME → slot 01 → READY ROOM →
+TAKE OFF → **flight**:
+
+![Stage 02 in flight](captures/stage02-inflight-upstream-baseline.png)
+
+`TIME 05:03.75`, wingman `Rhino 103 / Ellen Bernstein`, radio dialogue, asteroids,
+tracer fire — and **`REMAINING OB 020`** with `OB` badges on the objective
+targets. The run ended in a legitimate **GAME OVER** (the unattended craft was
+shot down, exactly as `autopilot-memory-driven.md` warns) — **not** a crash.
+
+**Crash dumps for the entire run: 0.** Against 384 on the instrumented branch at
+the briefing alone.
+
+So the mission crash is **not upstream's**. It is either in our 50 commits or
+fixed among upstream's 82 — this run does not separate those two, and saying
+which would need a bisect.
+
+## 🔴 `REMAINING OB` in RAM: first candidate refuted
+
+The counter is visible and moves (020 → 019 → 018 → 017), so it is scannable.
+
+* A three-snapshot big-endian u32 filter (19 → 19 → 18) left **0** survivors.
+* A direct differential across widths over the 19→18 transition gave exactly
+  **one** aligned BE u32: `va 0xbc22e83c` (the u16 hit at `…83e` is its low half).
+* **Refuted.** Read live moments later it held **26** while the HUD showed
+  **017**. It is an unrelated counter that happened to step 19→18 in the same
+  window.
+
+That the u32 filter came back empty is itself a result: the counter is not a
+plain persistent big-endian word. Candidates worth trying next are a per-digit
+representation, a value recomputed each frame from an entity list (in which case
+the *list* is the real target), or a field inside a structure that moves.
+
+## Not settled
+
+* 🔴 Which side owns the mission crash — our 50 commits or upstream's 82. A
+  bisect would say; nothing cheaper will.
+* 🔴 The `REMAINING OB` address.
+* ⚠️ `wait_flight.sh` reported `NEVER REACHED FLIGHT` while the game was plainly
+  in flight — its detector is wrong, and `screen_id.py` got it right.
+* ⚠️ Any future in-mission scan needs the pilot flying or a safe holding pattern:
+  an idle craft is dead in about a minute.