2.AY tid=12 / Event 0x1004 producer recon (RECON ONLY, 0 LOC)

=== tid=12 exact wait (ours, 2AP trace + root exit-state) ===
entry_pc 0x82178950 (trampoline -> sub_82178960), ctx_ptr 0x828F3EC0 (= canary tid=16)
wait site 0x824ac578 via sub_824AA330 -> 0x824AC540 (NtWaitForSingleObjectEx)
handle 0x1004, SID 6da916d9b6a3a757, Event, manual_reset=FALSE (auto), signaled=FALSE, deadline=INFINITE
Whole-run 16GB trace: SID appears EXACTLY 2x = handle.create(tid=1) + 1 wait.begin(tid=12). 0 signal.match / 0 KeSetEvent / 0 NtSetEvent on it. CONFIRMED missing producer.

tid=12 full lifecycle (34 events): spawn ~5.437s -> ObReferenceObjectByHandle, KeSetAffinityThread, RtlInit CS, then ONE NtWaitForSingleObjectEx(0x1004) at 5.485s -> blocks forever. NEVER re-waits.

=== Event 0x1004 role ===
Created in dispatcher singleton ctor sub_821783d8 (builds object at 0x828F3EC0): event from 0x824A9F18 stored to ctx+0x78 (stw r3,120(r30) @0x82178530). Dispatcher = global work-queue/DPC dispatch singleton (getter sub_8217c850 called from ~400 sites image-wide). 0x1004 = the queue's "work-ready / wake" event. Auto-reset => each post signals once, dispatcher consumes one item, re-waits.

=== canary analog producer (phase-c22 canary-cold-trunc.jsonl) ===
SID 454e25a8ff5c2a7c, handle 0xf800000c, Event, created by canary tid=6.
canary tid=16 issues 1044 wait.begin on it over 1927ms->21620ms => RE-WAITS 1044x => event IS signaled ~1044x (cross-engine symmetry rule SATISFIED: real bug).
Cadence: median wait gap 16.684ms = 60Hz (frame-locked).
canary VSync tid=2 NtSetEvent: 4660x @ median 16.667ms = 60Hz, span 1667->88957ms.
=> 0x1004-analog wake is FRAME-PACED, locked to VSync cadence.
Exact producer PC NOT pinnable from this canary trace (no signal.match emitted; tight-window attribution drowned by tid=4 audio 9078 KeSetEvent + tid=2 4660). Producer is on the frame/render path. MEDIUM confidence on exact PC, HIGH on "frame-loop-driven 60Hz".

=== decisive cross-check in ours ===
ours DPC/work subsystem INERT whole-run:
 KeRaiseIrqlToDpcLevel 123 (canary 13,659)
 KeSetEvent 8 (canary ~11,712)
 NtSetEvent 394 (canary tid2 4660 + tid6 740 + ...)
 KeInsertQueueDpc/KeInsertQueue/ExQueueWorkItem = 0
ours set-events clustered seconds 1-7 (112/123) then dormant to 52s. tid=12 waits at 5.49s = tail of cluster. After boot, signal subsystem stops => 0x1004 never signaled.
SAME signature as R1 (2.AV/2.AR): VSync/opt_callback fires ~67-77x early-boot then STOPS; canary 60Hz forever.

=== classification ===
MISSING-PRODUCER, and NOT independent: shares root with R1 (VSync 60Hz delivery stops after boot). The DPC work-queue is fed by the frame/render loop; when ours's frame loop dies post-boot, no work is posted, 0x1004 never signaled, tid=12 wedges. 2.AM's "bilateral-nonexistence SID" was a red herring of SID-hashing (objects differ by guest addr but ROLE matches: both are the 60Hz DPC-queue wake). 2.AS's "tid=11/XAudio cascade" already falsified by 2.AU; this confirms the real upstream is the frame loop, not XAudio.

=== fix surface ===
Same as revised R1: xenia-rs/crates/xenia-kernel/src/interrupts.rs VSync interrupt-delivery cadence (tick_vsync_wallclock / queue_interrupt) — restore sustained 60Hz frame-loop delivery. When the frame loop runs at 60Hz, work gets posted to the 0x828F3EC0 dispatcher, 0x1004 is signaled, tid=12 unwedges. NO separate tid=12 fix; NO force-signal 0x1004 (consumer-side dead-end, #44). ~20-60 LOC MEDIUM (the R1 surface).
Confidence: missing-producer HIGH; frame-loop/R1 linkage HIGH; exact canary producer PC MEDIUM (needs canary signal.match trace = the 2.AW canary-runtime-trace blocker).
