handoff: VSync/event-wedge fixes + iterate 2.A–2.BC research notes
Source changes (dormant parity infra, retained from iterate 2.AI/2.AO): - xenia-kernel/exports.rs: nt_create_event manual_reset polarity + related event wiring - xenia-gpu/mmio_region.rs: D1MODE_VBLANK_VLINE_STATUS hardcode parity Also lands the audit-runs/ analysis notes (.md/.txt/.json digests) for the iterate 2.x VSync/0x10e8/0x1004 wedge investigation. Raw trace dumps (.jsonl/.gz/.csv/.stdout) and agent worktrees (.claude/) are gitignored as regenerable local artifacts — see memory + HANDOFF for the running findings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
106
audit-runs/phase-c10-NtQueryFullAttributesFile/re-validation.md
Normal file
106
audit-runs/phase-c10-NtQueryFullAttributesFile/re-validation.md
Normal file
@@ -0,0 +1,106 @@
|
||||
# Phase C+10 — NtQueryFullAttributesFile — Re-validation
|
||||
|
||||
Validation against the Phase 1 emitter extension (only landed work).
|
||||
No fix landed for the actual divergence (ESCALATED — see
|
||||
`escalation.md`).
|
||||
|
||||
## Gate matrix
|
||||
|
||||
| # | gate | result |
|
||||
|---|---|---|
|
||||
| 1 | cvar-OFF determinism 50M (3 runs) | PASS — all 3 = `b8fa0e0460359a4f660adb7605e053de` (UNCHANGED from C+9 baseline; extension is zero-cost when cvar OFF) |
|
||||
| 2 | Phase B `image_loaded_sha256` | PASS — `ea8d160e9369328a5b922258a92113efb8d7ce3e1a5c12cc521e375985c91c18` (matches baseline; XEX loader untouched) |
|
||||
| 3 | Phase A main matched-prefix | UNCHANGED — 102404 (no fix landed; matched-prefix advance NOT expected this session) |
|
||||
| 3b | tid=4 → 11 unchanged | PASS — 9 (no regression) |
|
||||
| 3c | tid=7 → 2 unchanged | PASS — 29 (no regression) |
|
||||
| 3d | tid=12 → 7 unchanged | PASS — 2 (no regression) |
|
||||
| 3e | tid=14 → 9 unchanged | PASS — 39 (no regression) |
|
||||
| 3f | tid=15 → 10 unchanged | PASS — 15 (no regression) |
|
||||
| 4 | Both engines build clean | PASS (1 unrelated `walk_committed_regions` dead-code warning, pre-existing C+9) |
|
||||
| 5 | Phase A emitter determinism (2 runs) | PASS — both = `7489e90ef4c9be629af8c9fabb1cbdd7` |
|
||||
| 6 | Unit tests | PASS — 165 → 165 (no new tests; no regressions) |
|
||||
|
||||
## Stable-digest comparison
|
||||
|
||||
| field | C+9 baseline | C+10 post-extension | delta |
|
||||
|---|---|---|---|
|
||||
| (all stable fields, 3 runs) | `b8fa0e0460359a4f660adb7605e053de` | `b8fa0e0460359a4f660adb7605e053de` | 0 |
|
||||
|
||||
Extension is purely emitter-side, cvar-gated default-off, behaviorally
|
||||
inert. Determinism unchanged.
|
||||
|
||||
## Phase A determinism
|
||||
|
||||
```
|
||||
ours.jsonl (run 1) det-fields md5: 7489e90ef4c9be629af8c9fabb1cbdd7
|
||||
ours-determ.jsonl (run 2) det-fields md5: 7489e90ef4c9be629af8c9fabb1cbdd7
|
||||
```
|
||||
|
||||
Byte-identical on deterministic fields. New `--phase-a` det baseline
|
||||
`7489e90e…` (replaces C+9's `0b299c37…`). The signature changed
|
||||
because the new `args_resolved.path` field IS part of the
|
||||
deterministic payload — but it's stable across runs (path string is
|
||||
read directly out of guest memory, fully deterministic for fixed
|
||||
input).
|
||||
|
||||
## Per-chain summary
|
||||
|
||||
| chain | C+9 baseline | C+10 (after emitter extension) | delta |
|
||||
|---|---|---|---|
|
||||
| canary tid=6 → ours tid=1 (main) | 102404 | 102404 | 0 (no fix landed) |
|
||||
| canary tid=4 → ours tid=11 | 9 | 9 | 0 |
|
||||
| canary tid=7 → ours tid=2 | 29 | 29 | 0 |
|
||||
| canary tid=12 → ours tid=7 | 2 | 2 | 0 |
|
||||
| canary tid=14 → ours tid=9 | 39 | 39 | 0 |
|
||||
| canary tid=15 → ours tid=10 | 15 | 15 | 0 |
|
||||
|
||||
All chains unchanged. No regressions. No advances (as expected — no
|
||||
behavioral change to either engine).
|
||||
|
||||
## Confirmed framing (Phase 1 success)
|
||||
|
||||
The divergence path is now visible in the diff output:
|
||||
|
||||
```
|
||||
canary[6][102403] kernel.call NtQueryFullAttributesFile
|
||||
args_resolved.path = "cache:\d4ea4615\e\46ee8ca"
|
||||
ours [1][102403] kernel.call NtQueryFullAttributesFile
|
||||
args_resolved.path = "cache:\d4ea4615\e\46ee8ca"
|
||||
```
|
||||
|
||||
Both engines query the SAME path. Both successfully read the
|
||||
OBJECT_ATTRIBUTES.name_ptr. Divergence is purely in
|
||||
`vfs.stat`/`file_system().ResolvePath` outcome (canary's mount has
|
||||
the file; ours's wiped cache doesn't).
|
||||
|
||||
## Sources of truth for the path field
|
||||
|
||||
Both engines read directly out of guest memory at the same point in
|
||||
the dispatch sequence (right before the export handler runs). The
|
||||
resulting string is byte-identical when input is identical. This is
|
||||
verified by the byte-identical det-fields md5 across runs.
|
||||
|
||||
## Phase 6 status
|
||||
|
||||
Gates 1-2, 3b-3f, 4-6 all pass. Gate 3 main-prefix did NOT advance.
|
||||
This is because **no fix was landed** — Phase 4 ESCALATED.
|
||||
|
||||
The session's contribution is:
|
||||
* Permanent emitter extension on both engines (~80 LOC each).
|
||||
* Path framing captured for the divergence.
|
||||
* Classification + scope-decision memo in `escalation.md`.
|
||||
|
||||
## Next target
|
||||
|
||||
Same idx 102,404, but in a dedicated cache-subsystem session that
|
||||
can:
|
||||
|
||||
1. Re-test AUDIT-053's warm-start regression under AUDIT-054's
|
||||
FILE_DIRECTORY_FILE fix.
|
||||
2. Decide between cache-build subsystem vs cache-seed-from-canary vs
|
||||
stub-success.
|
||||
3. Land + re-validate the cache-state mechanism + run Phase A to
|
||||
measure the cascade.
|
||||
|
||||
The path framing landed in this session is the permanent input for
|
||||
that follow-up session.
|
||||
Reference in New Issue
Block a user