handoff: VSync/event-wedge fixes + iterate 2.A–2.BC research notes

Source changes (dormant parity infra, retained from iterate 2.AI/2.AO):
- xenia-kernel/exports.rs: nt_create_event manual_reset polarity +
  related event wiring
- xenia-gpu/mmio_region.rs: D1MODE_VBLANK_VLINE_STATUS hardcode parity

Also lands the audit-runs/ analysis notes (.md/.txt/.json digests) for the
iterate 2.x VSync/0x10e8/0x1004 wedge investigation. Raw trace dumps
(.jsonl/.gz/.csv/.stdout) and agent worktrees (.claude/) are gitignored as
regenerable local artifacts — see memory + HANDOFF for the running findings.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

audit-runs/review-a-step2-natural-trigger/extract_canary_install_window.py

@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+"""Extract tid=6 kernel call sequence from canary-jitter-1.jsonl in install window.
+
+Install window: host_ns in [9_000_000_000, 11_000_000_000] (9s..11s).
+Per AUDIT-068 S3: vtable install at ~9.4-9.6s, sub_825070F0 spawn at 10.383s.
+
+Outputs are written next to this script.
+"""
+import json
+import os
+import sys
+from collections import Counter
+
+INPUT = "/home/fabi/RE - Project Sylpheed/xenia-canary/build-cross/bin/Windows/Debug/canary-jitter-1.jsonl"
+OUTDIR = os.path.dirname(os.path.abspath(__file__))
+T_LO = 9_000_000_000
+T_HI = 11_000_000_000
+TARGET_TIDS = {6}
+
+import_calls = []
+kernel_calls = []
+kernel_returns = []
+handle_creates = []
+thread_events = []
+mem_events = []
+other_events = []
+
+count_in_window = 0
+count_total = 0
+with open(INPUT, "r") as f:
+    for line in f:
+        count_total += 1
+        if '"host_ns":' not in line:
+            continue
+        try:
+            i = line.index('"host_ns":') + len('"host_ns":')
+            j = i
+            while j < len(line) and (line[j].isdigit() or line[j] == '-'):
+                j += 1
+            host_ns = int(line[i:j])
+        except (ValueError, IndexError):
+            continue
+        if host_ns < T_LO:
+            continue
+        if host_ns >= T_HI:
+            break
+        try:
+            ev = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        if ev.get("tid") not in TARGET_TIDS:
+            continue
+        count_in_window += 1
+        kind = ev.get("kind", "")
+        if kind == "import.call":
+            import_calls.append(ev)
+        elif kind == "kernel.call":
+            kernel_calls.append(ev)
+        elif kind == "kernel.return":
+            kernel_returns.append(ev)
+        elif kind == "handle.create":
+            handle_creates.append(ev)
+        elif kind in ("thread.create", "thread.exit"):
+            thread_events.append(ev)
+        elif kind in ("mem.write", "mem.read"):
+            mem_events.append(ev)
+        else:
+            other_events.append(ev)
+
+print(f"Total lines scanned: {count_total}")
+print(f"Events in window for tid in {TARGET_TIDS}: {count_in_window}")
+print(f"  import.call: {len(import_calls)}")
+print(f"  kernel.call: {len(kernel_calls)}")
+print(f"  kernel.return: {len(kernel_returns)}")
+print(f"  handle.create: {len(handle_creates)}")
+print(f"  thread.create/exit: {len(thread_events)}")
+print(f"  mem.read/write: {len(mem_events)}")
+print(f"  other: {len(other_events)}")
+
+with open(os.path.join(OUTDIR, "canary-tid6-install-window.csv"), "w") as f:
+    f.write("host_ns,tid_event_idx,kind,name,raw_handle,detail\n")
+    all_evts = []
+    for ev in kernel_calls:
+        name = ev["payload"].get("name", "?")
+        detail = json.dumps(ev["payload"].get("args_resolved") or ev["payload"].get("args", {}))[:200]
+        all_evts.append((ev["host_ns"], ev["tid_event_idx"], "kernel.call", name, "", detail))
+    for ev in kernel_returns:
+        name = ev["payload"].get("name", "?")
+        rv = ev["payload"].get("return_value", "")
+        st = ev["payload"].get("status", "")
+        detail = f"rv={rv} status={st}"
+        all_evts.append((ev["host_ns"], ev["tid_event_idx"], "kernel.return", name, "", detail))
+    for ev in handle_creates:
+        rh = ev["payload"].get("raw_handle_id", "")
+        ot = ev["payload"].get("object_type", "")
+        detail = f"object_type={ot}"
+        all_evts.append((ev["host_ns"], ev["tid_event_idx"], "handle.create", "", rh, detail))
+    for ev in thread_events:
+        detail = json.dumps(ev["payload"])[:200]
+        all_evts.append((ev["host_ns"], ev["tid_event_idx"], ev["kind"], "", "", detail))
+    all_evts.sort()
+    for ev in all_evts:
+        host_ns, idx, kind, name, rh, detail = ev
+        detail_escaped = detail.replace('"', '""')
+        f.write(f'{host_ns},{idx},{kind},{name},{rh},"{detail_escaped}"\n')
+
+print(f"Wrote canary-tid6-install-window.csv with {len(all_evts)} ordered events.")
+
+call_counts = Counter()
+for ev in kernel_calls:
+    call_counts[ev["payload"].get("name", "?")] += 1
+
+with open(os.path.join(OUTDIR, "canary-tid6-install-window.summary"), "w") as f:
+    f.write(f"Canary tid=6 install-window event summary [host_ns {T_LO}..{T_HI}]\n")
+    f.write(f"\n=== Top kernel.call by frequency ===\n")
+    for name, c in call_counts.most_common(80):
+        f.write(f"  {c:6d}  {name}\n")
+    f.write(f"\n=== Unique kernel.call names ===\n")
+    f.write(f"  {len(call_counts)}\n")
+
+print(f"Wrote canary-tid6-install-window.summary")