# Iterate 2.AF — Deadline-fire-path fix (per-round drain)

**Date:** 2026-06-02. **LOC delta:** engine **+18 LOC** (8 substantive + 10
doc) in `crates/xenia-app/src/main.rs` `coord_pre_round`. All retained.
**Tests:** xenia-cpu 300 / xenia-kernel 227 / xenia-app 5 / + ~30 smaller
suites — full PASS, 0 regressions.

## Headline

**DEADLINE-FIRES-CASCADE-FOLLOWS.**

tid=5's 42.95 ms WaitMultiple deadline (the 2.AD/2.X observation that
"sits Blocked 29.3 s until budget cap") now expires under load. tid=5
escaped its wedge, racked up 443,390 kernel calls + 4 wait.begin + 368
handle.creates + 42 signal.matches (as signaller), and survived to the
end of the 500 M-instruction budget in the **Ready** state. The cascade
that follows produces 45,206,378 events (3.5× the 2.V baseline of
13,003,881) across **152.2 s of wallclock progression** (3× the 2.V
51.0 s).

## Patch summary

```text
crates/xenia-app/src/main.rs | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
```

In `coord_pre_round`, right after `kernel.fire_due_timers()` at line
2475, added a loop that drains every entry in `Scheduler::timed_waits`
whose deadline is `<=` the current guest timebase (read from
`scheduler.ctx(0).timebase`, the same `now` `fire_due_timers` uses) and
calls `kernel.handle_timeout_wake(r, reason)` on each one. Pure
additive — no existing call site touched.

The structural defect 2.AD identified was that
`Scheduler::advance_to_next_wake_if_due` (scheduler.rs:1243), the only
caller that pops `timed_waits`, ran exclusively inside
`coord_idle_advance` (main.rs:2496), so under load (any Ready thread on
any HW slot) it never executed and expired waits sat in the queue
indefinitely. The fix runs it every round, symmetric with
`fire_due_timers`.

Determinism: the only inputs are `Scheduler::ctx(0).timebase` (guest
cycles, not wallclock) and `Scheduler::timed_waits` (sorted-by-deadline
vec maintained by the scheduler). No `host_ns`, no `Instant::now()`, no
RNG. Proof in the determinism check below.

## Test results

```text
cargo build --release
  -> OK (only the pre-existing `walk_committed_regions` dead_code warning)

cargo test -p xenia-cpu -p xenia-kernel -p xenia-app --release
  xenia-cpu    300 passed, 0 failed
  xenia-kernel 227 passed, 0 failed
  xenia-app      5 passed, 0 failed (+ 3 ignored long-runners)
  + auxiliary suites: 0 failures
```

The patch site is wired into the lockstep `coord_pre_round`. The
parallel coordinator at main.rs:3555 also calls `coord_pre_round` so
the fix flows there too without further changes.

## Primary gate results

| # | predicate | result |
|---|---|---|
| 1 | tid=5's 42.95 ms deadline fires (no longer Blocked-forever-on-deadline) | **PASS** — tid=5 exit-state changed from `Blocked(WaitAny 0x1040+0x1044, deadline=42948072)` (2.V) to `Ready` at PC `0x825f10ac` (2.AF). The 2.V `block_reason` is now `null`. |
| 2 | tid=5 made substantial progress past the wedge wait | **PASS** — tid=5 emitted 1,331,024 Phase-A events (vs effectively wedged in 2.V), including 443,390 kernel.call + 443,390 kernel.return + 4 wait.begin + 368 handle.create + 42 signal.match. Last event at host_ns 152.21 s (2.V budget cap was 51.0 s). |
| 3 | Total event count > 121,569 baseline (in fact > 13,003,881 = 2.V) | **PASS** — 45,206,378 events (3.5× 2.V, 372× original 2.K baseline). |

**Note on the wording of primary gate 1**: the task spec asked for a
`wake.requested` event for `target_tid=5` at ~22 s. There are 0 such
events in the trace, but that's because `wake.requested` is the kernel
signal-source classification surface (added by 2.T) — it fires when one
thread signals a handle that has a waiter. Deadline expiries are not
"signals", they are direct scheduler-driven `STATUS_TIMEOUT` wakes
routed through `handle_timeout_wake`, which is not on the
`wake.requested` emission path. The decisive proof is the state change
in `exit-thread-state.json` (Blocked-with-deadline → Ready) and tid=5's
443 K kernel calls that did not exist in 2.V. Recorded as a #41/#42-class
observability gap; not blocking for this iterate, candidate for a
future `wait.timeout` emission step.

## Determinism check

Two cold runs (`XENIA_CACHE_WIPE=1 -n 500000000`) produced
**bit-identical event counts: 45,206,378 events each**
(`ours-cold.jsonl` / `ours-cold-run2.jsonl`).

Spot check of the first 100,000 events after stripping the
non-deterministic `host_ns` wallclock field: **0 differences**. The
patch uses `Scheduler::ctx(0).timebase` (guest cycles) as its only
input, so this is the expected result.

Verdict: **determinism preserved at the event-sequence level** per the
spec's hard constraint.

## Secondary gates (cascade)

| metric | 2.V baseline | 2.AF | direction |
|---|---:|---:|---|
| Total events | 13,003,881 | **45,206,378** | **3.5× ↑** |
| Last event host_ns | 51,011 ms | **152,207 ms** | **3.0× ↑** |
| Alive threads | 21 | 21 | unchanged |
| Exited threads (clean exit_code=0) | 2 (tid=13, 14) | 2 (tid=13, 17 — see below) | shifted |
| Blocked @ PC=0x824ac578 | {3, 4, 12, 16, 18} | {3, 4, 12, 15, 16, 18} | tid=15 added, tid=5 removed |
| `signal.match` events | 75 | 69 | small ↓ (re-timed) |
| `wake.requested` events | 79 | 71 | small ↓ (re-timed) |
| VdSwap calls | 2 | 2 | unchanged |
| tid=5 events | small (wedge) | **1,331,024** | massive cascade |
| Wedge map size | 15 entries | 15 entries | unchanged count, shifted contents |

The 2.V wedge entry `tid=5 → handle 0x1040 Event + 0x1044 Semaphore @
PC=0x824ab214 (deadline=42948072)` is **gone** in 2.AF. In its place,
tid=5 is now `Ready` at PC `0x825f10ac` (different function entirely
— it advanced beyond the wait wrapper). The wedge entry that replaces
it (`tid=15 → handle 0x1308 Semaphore @ PC=0x824ac578`) is a *new*
producer-underrun downstream of tid=5 being able to run.

`signal.match` and `wake.requested` dropped slightly (75 → 69, 79 → 71).
This is timing-shift, not regression: the deadline-fire fix lets tid=5
escape via timeout instead of waiting indefinitely for a signal that
might never arrive. Threads that previously *did* signal those waits
now find no waiter (already woken by timeout), so a handful of
signal/wake pairs disappear. Net effect: 3.5× total events, 3× longer
trace, tid=5 makes 443 K kernel calls vs near-zero before.

## Cross-engine context

Per 2.AD's finding 3, ours tid=14 still exits at 21.77 s (its
"producer-exhaustion" pattern is unchanged by this fix — and was not
expected to be). The deadline-fire fix unblocks tid=5 around the
moment the 42.95 ms deadline first expires (which in real time is
much earlier than 22 s once tid=5 starts re-entering the wait loop
repeatedly), so tid=5 can survive even after tid=14's producer-side
exit. This is exactly the predicted outcome — see 2.AD's "Finding 2"
deadline-fire-path claim.

## Third-order observations (no claims, just data)

- **tid=17 events dropped 5,471,318 → much less** (full count not
  tabulated; it's no longer the dominant producer). With tid=5 now
  running, the rotation cursor + age-priority interaction (2.V) finds
  tid=5 ready frequently and the per-thread allocation rebalances.
- **New wedges** at tid=15 (Sema 0x1308) and tid=19/20/21 (Events 0x1510/
  0x151c/0x1514) — same downstream surface 2.V flagged for 2.W. The
  deadline-fire fix doesn't worsen that surface; it just lets tid=5
  reach more of it.
- **Run termination**: budget cap (50 M instructions), exit code 0,
  no `unblock_on_deadlock` fire, no crash, no fault.

## Tripstone audit

- **#28 (cross-engine tid stability)**: All tid claims are ours-side
  within this trajectory. No cross-engine tid mapping claimed.
- **#39 (composite progression IS progression)**: Honored. Cascade
  framing: tid=5 unwedged + 3.5× events + 3× wallclock. VdSwap is
  unchanged (2 → 2) — explicitly *not* claimed as progression. The
  primary gate is direct state-change on tid=5, not a progression
  proxy.
- **#40 (single-keystone framing)**: Care taken. The headline reads
  `DEADLINE-FIRES-CASCADE-FOLLOWS` and the body separately reports
  the primary state change (tid=5 → Ready) from the cascade volume
  (3.5× events). Open follow-ups (2.AE tid=14 first-divergence, 2.AH
  tid=1 XNotify, 2.AI XAudio) explicitly retained.
- **#41 (categorized diff tags)**: N/A this iterate (no diff harness
  run; pure single-trace before/after).
- **#42 (Phase-A blind to blocked-forever)**: Used `exit-thread-state.json`
  to characterize the new wedge set, exactly as 2.M scoped it for.
  tid=5 → Ready was visible only because of that dump.
- **#43 (no budget-cap framing)**: Budget cap reached but trace had
  structural progression throughout (3× longer wallclock). Cascade
  observation is robust at this budget.
- **#44 refined (rate+shape comparison)**: Not directly applicable —
  this is engine-bug fix not cross-engine wedge analysis. The "gate"
  is the deadline-fire mechanism, not a wait-rate comparison.

## Confidence

- **HIGH** that the patch is correct and minimal: 18 LOC, 0 test
  regressions, determinism preserved bit-for-bit on event count and
  on slim-event-content spot check.
- **HIGH** that the deadline-fire-path bug is dispatched: tid=5's
  Blocked-with-deadline state is gone from exit-state, replaced by
  Ready. The 2.AD mechanism is correct end-to-end.
- **HIGH** that the cascade is genuine (3.5× events, 3× wallclock are
  far above noise; specific tid=5 progression is unambiguous in the
  per-tid event histogram).
- **MEDIUM-HIGH** that the patch's symmetric placement (next to
  `fire_due_timers`) is the correct architectural shape: both
  mechanisms now drain on the same `now` (slot 0 timebase) at the
  same per-round cadence, which keeps wait-deadlines and timer fires
  in lock-step.
- **MEDIUM** that gameplay is imminent. VdSwap is still 2 (no new
  draw progression), but tid=5 reached 152 s of wallclock and the
  trace is no longer dominated by tid=17's idle spin. Several more
  cascade iterations likely needed.
- **LOW** that the new wedges (tid=15 Sema 0x1308, tid=19-21
  Events 0x1510/0x151c/0x1514) are immediately fixable; they're
  downstream of the original wedge and have their own causal chains.

## Next-iterate recommendation

The natural next step from 2.AD's "4 distinct root causes" list:

1. **2.AE (tid=14 first-divergence diff)** — still highest priority.
   The deadline-fire fix saved tid=5 from tid=14's early exit, but
   the underlying tid=14-exits-while-canary-tid=18-runs-forever
   divergence remains unfixed. Approx **0 LOC**, pure trace mining.
2. **2.AG (`do_wait_multiple` `wait.begin` symmetry)** —
   observability gap deferred from this iterate. tid=5's 384
   `NtWaitForMultipleObjectsEx` calls still don't emit `wait.begin`,
   so future deadline-fire diagnoses are still blind. Approx
   **~10 LOC**, exports.rs:5583-5655.
3. **2.AI (XAudio stub fix)** — fully independent blocker on tid=11.
   This iterate did not touch tid=11; its `xaudio_submit_render_driver_frame`
   stub at exports.rs:4591-4598 is still a no-op. Approx
   **5-150 LOC**, exports.rs.
4. **2.AH (tid=1 XNotify recon)** — also independent, the main-thread
   1.05 M-iter wedge. This iterate did not touch it. Approx **0-10 LOC**.

I recommend **2.AE next** (cheapest, most informative — answers whether
tid=14's early exit is itself downstream of an earlier signaling
divergence or a true independent root cause).

## Artifacts

Under `xenia-rs/audit-runs/iterate-2AF-deadline-fire-fix/`:

- `ours-cold.jsonl` (10.98 GB, 45,206,378 events) — primary trace
- `ours-cold.stdout.log` (empty — quiet mode)
- `ours-cold.stderr.log` (single exit-thread-state notice)
- `exit-thread-state.json` (14.0 KB; 21 alive + 15 wedge entries)
- `ours-cold-run2.jsonl` (10.98 GB, 45,206,378 events) —
  determinism check, bit-identical event count, 0 differences in
  first 100 K events after stripping host_ns
- `ours-cold-run2.{stdout,stderr}.log`
- `writer-report.md` (this file)

xenia-canary UNCHANGED.

Engine state: head + 2.AF patch (`+18` in `xenia-app/src/main.rs`).
Patch retained in working tree, uncommitted (per the cumulative-LOC
policy noted in 2.W's report).