# Phase C+22 re-invocation — ESCALATION CONFIRMED (2026-05-22)

## Decision

**RE-CONFIRM the C+22 escalation landed 2026-05-18.** No engine
change, no diff-tool change. Class A (scheduler-determinism +
post-wait state-mutation downstream effect) — same root cause as
C+20, structurally parallel to C+14.

## Phase 0 — Class E ruled out (verified today)

Both engines register RtlEnterCriticalSection and
RtlLeaveCriticalSection symmetrically:

| engine  | RtlEnterCriticalSection                                          | RtlLeaveCriticalSection                                          |
|---------|------------------------------------------------------------------|------------------------------------------------------------------|
| canary  | `xboxkrnl_table.inc:307` ord 0x125 (293) `kFunction` shimmed     | `xboxkrnl_table.inc:318` ord 0x130 (304) `kFunction` shimmed     |
| ours    | `exports.rs:169` `register_export(Xboxkrnl, 0x0125, …, rtl_enter)` | `exports.rs:177` `register_export(Xboxkrnl, 0x0130, …, rtl_leave)` |

(Note: the prompt cited "ord 293" / "ord 304" decimal; the hex
forms 0x125 / 0x130 are the actual table indices. They match the
decimal values — no off-by-one.)

Class E ruled out — both export paths reach a real implementation
in both engines.

## State drift check vs prior C+22 session

- `xenia-rs` HEAD: `e6d43a2…` (unchanged from prior C+22 session
  on 2026-05-18 — verified by `git log -1`).
- `exports.rs` carries the Phase D Stage 3 contention-replay
  manifest in `rtl_enter_critical_section` (lines 3290-3396).
  This was already in place at the prior C+22 session per the
  Phase D Stage 3+4 memory entry. Default-mode behavior
  unchanged (manifest short-circuits when
  `XENIA_CONTENTION_MANIFEST_PATH` unset).
- Working tree contains uncommitted canary-side instrumentation
  for AUDIT-068/069 and Iterate 2.A (per the index entries) —
  none of it touches RtlEnter/Leave or the post-wait branch.
- xenia-canary RtlEnter/Leave shims unchanged (same ord lookup
  table file, same line numbers).

## Cross-reference with C+14 + Phase D forensics

The Phase D D-extension memory entry already pinpoints the
upstream root cause:

> tid=1 wakes from notification-event wait → consults
> CS-protected tree at `(CS 0x828f4838).r30+48` via helper
> `0x8245B1F8` find-or-insert → canary's tree has more entries
> because peer tid=5 had more wall-time to insert during the
> wait window → canary's "insert" path nested-Enter+Leaves;
> ours's "match" path early-exits.

That's exactly the C+14 single-CS wrapper at `sub_8245B128` +
the file-tracker singleton at `0x828F4838`. The C+22 prompt's
"file-tracker state divergence (F)" hypothesis is correct, and
the Phase D D-extension absorber (LANDED 2026-05-18) is already
the diff-tool-level band-aid that crosses reading-error #23 in
spirit — it absorbed +439 events past the cap by folding the
`[Enter-block, Leave-block]` pair as a nested-CS-cleanup
absorber. Main is now at **105,046** matched-prefix per the
Phase D D-extension entry (not the 104,607 from C+21 — the
absorber advanced past the cap).

## Reconciling 104,607 (prompt) vs 105,046 (Phase D D-ext)

The prompt frames today's target as "idx 104,607 cold-vs-cold
first divergence." This was the C+21 / C+22 baseline. The Phase
D D-extension (LANDED 2026-05-18, same date as prior C+22)
shifted main to **105,046** via diff-tool absorber. Both can be
true: the prompt cites the pre-D-extension cap; today's
methodologically-correct measurement uses the post-D-extension
diff tool.

Without re-running cold-vs-cold (cost-benefit unfavorable given
no engine drift), the existing Phase D D-extension result stands
as the most recent matched-prefix value. Today's invocation does
not advance it.

## Authorized fix shape (or escalation rationale)

**Escalation.** Per the prompt's tripstone 5: "if this turns out
to be the same `sub_8245B128` file-tracker issue, escalate
cleanly. Don't push through." That tripstone fires today:

1. Class E ruled out (Phase 0 verification above).
2. Class A established by prior 4-canary-sample evidence
   (jitter-1/2/3 + fresh c22, all `E E L L` nested pattern in
   canary; ours `E L NtClose` simple-release).
3. Root cause is the C+14 / Phase D `sub_8245B128` chain reading
   the file-tracker tree at `(CS 0x828f4838).r30+48`, with
   peer tid=5 timing-dependent inserts.
4. Authorized scope explicitly EXCLUDES "scheduler determinism"
   refactor, which is what would be required to fix at root.
5. Diff-tool absorber for this region ALREADY LANDED (Phase D
   D-extension, +439 events past cap).

No engine modification within scope can advance further. The
prompt's "quick fix ≤50 LOC" path is not available; the
"C+14-class deferred" path is the correct outcome.

## Per-chain delta table

No fresh cold-vs-cold run executed in today's invocation (cost-
benefit: engine state for this subsystem is unchanged from
2026-05-18 C+22, which already executed the full protocol). Per
Phase D D-extension's archived measurement:

| chain                          | C+21    | C+22 (prior) | Phase D D-ext | today (no run) |
|--------------------------------|---------|--------------|---------------|----------------|
| canary tid=6 → ours tid=1 main | 104,607 | 104,607      | **105,046**   | 105,046        |
| canary tid=4 → ours tid=11     | 11      | 11           | 11            | 11             |
| canary tid=7 → ours tid=2      | 32      | 32           | 32            | 32             |
| canary tid=12 → ours tid=7     | 3       | 3            | 4 (per index) | 4              |
| canary tid=14 → ours tid=9     | 41      | 41           | 41            | 41             |
| canary tid=15 → ours tid=10    | 16      | 16           | 16            | 16             |

## Jitter verification

Inherited from prior C+22 session (canary-jitter-1/2/3 + fresh
c22 cold): all 4 canary samples agree on the `E E L L` nested
pattern post-wait. Re-verification today is not warranted —
canary table file is unchanged and the canary-jitter jsonls are
archived intact.

## Gates (escalation-mode)

| gate                                     | result |
|------------------------------------------|--------|
| Phase 0 — Class E ruled out              | PASS   |
| xenia-rs HEAD unchanged for this subsys  | PASS   |
| canary table file unchanged              | PASS   |
| Phase B `image_canonical_sha256`         | UNCHANGED `ea8d160e…` |
| Prior escalation evidence still valid    | PASS   |
| Tripstone 5 (C+14-class) fires correctly | PASS   |
| Canary caches untouched today            | PASS (no run) |
| `--mute=true` discipline                 | N/A (no run) |

## Files

- This file: confirmation of prior escalation.
- Prior C+22 session artifacts: `xenia-rs/audit-runs/phase-c22-rtl-enter-leave-control-flow/`
  - `investigation.md` (263 lines)
  - `escalation.md` (123 lines)
  - `cold-vs-cold-result.md` (96 lines)
  - `re-validation.md`
  - `diff-cold-vs-cold.md`
  - `canary-binary-cache-pre-wipe.tar.gz` + `canary-xdg-cache-pre-wipe.tar.gz`
- Phase D D-extension landed-state: see memory index entry
  `phase_d_d_extension_absorber_2026_05_18`.

## Next target

Per the prior C+22 escalation's next-target recommendation:

1. **C+23 = D-NEW-2** (LANDED 2026-05-18 per memory entry
   `project_phase_c23_kewait_timeout_addis_signext_2026_05_18`).
2. **C+24 = D-NEW-3** (XAudio voice-category divergence on
   tid=14→9 sister chain).
3. **Parallel scheduler-determinism track** — multi-session
   refactor. Memory entry
   `project_scheduler_determinism_plan_2026_05_18` documents
   the plan. Phase D Stages 0-4 already implemented the
   replay-track infrastructure; Phase D D-extension landed the
   diff-tool absorber that crossed the cap.

The Phase C C+22 thread is COMPLETE at the escalation
boundary; advancement requires the parallel scheduler track.