# Phase C+9 — XamContentCreateEnumerator re-validation

## Gate matrix

| # | gate | result |
|---|---|---|
| 1 | cvar-OFF determinism 50M (3 runs) | PASS — all 3 = `b8fa0e0460359a4f660adb7605e053de` (new baseline; coarse fields shifted: imports 40470→40465, ±5 reflecting downstream branch flip from the 0x525 return) |
| 2 | Phase B `image_loaded_sha256` | PASS — `ea8d160e9369328a5b922258a92113efb8d7ce3e1a5c12cc521e375985c91c18` (matches baseline; XEX loader untouched) |
| 3 | Phase A main chain matched-prefix > 102197 | PASS — **102404** (+207 from 102197) |
| 3b | tid=4 → 11 unchanged | PASS — 9 (no regression) |
| 3c | tid=7 → 2 unchanged | PASS — 29 (no regression) |
| 3d | tid=12 → 7 unchanged | PASS — 2 (no regression) |
| 3e | tid=14 → 9 unchanged | PASS — 39 (no regression) |
| 3f | tid=15 → 10 unchanged | PASS — 15 (no regression) |
| 4 | Build clean | PASS (1 unrelated `walk_committed_regions` dead-code warning, pre-existing) |
| 5 | Phase A emitter determinism (2 runs) | PASS — both det-fields md5 = `0b299c37b8fe9fd4ee1b1877a875543f` |
| 6 | Unit tests | PASS — 160 → **165** (+5 new, 0 regressions) |

## Stable-digest comparison

| field | C+8 baseline | C+9 post-fix | delta |
|---|---|---|---|
| instructions | 50000000 | 50000002 | +2 (engine ticks; jittery) |
| imports | 40470 | 40465 | -5 (game took the 0x525 branch, calls fewer of something) |
| unimpl | 0 | 0 | 0 |
| draws | 0 | 0 | 0 |
| swaps | 1 | 1 | 0 |
| unique_render_targets | 0 | 0 | 0 |
| shader_blobs_live | 0 | 0 | 0 |
| texture_cache_entries | 0 | 0 | 0 |

C+8 baseline `c6d895829b4611964978990ae1cb8a6a` → C+9 baseline
`b8fa0e0460359a4f660adb7605e053de`. First non-trivial digest movement
in 4 Phase C sub-sessions — the `0x525` return flips at least one
downstream branch decision, producing 5 fewer import calls within 50M
instructions.

## Phase A determinism

ours.jsonl       (run 1) det-fields md5: `0b299c37b8fe9fd4ee1b1877a875543f`
ours-determ.jsonl (run 2)              : `0b299c37b8fe9fd4ee1b1877a875543f`

Byte-identical on deterministic fields. New `--phase-a` det baseline
(`0b299c37…`), replacing C+8's `9135e369…`. Reflects the downstream
trajectory shift caused by the return-value flip at idx=102197.

## Per-chain summary

| chain | C+8 KeResetEvent | C+9 XamContentCreateEnumerator | delta |
|---|---|---|---|
| canary tid=6 → ours tid=1 (main) | 102197 | **102404** | **+207** |
| canary tid=4 → ours tid=11 | 9 | 9 | 0 (sister at end of ours window) |
| canary tid=7 → ours tid=2 | 29 | 29 | 0 (sister at end of ours window) |
| canary tid=12 → ours tid=7 | 2 | 2 | 0 (different bug: KeWaitForSingleObject 258 vs 0) |
| canary tid=14 → ours tid=9 | 39 | 39 | 0 (different bug: XAudio vs RtlEnterCS) |
| canary tid=15 → ours tid=10 | 15 | 15 | 0 |

All gates pass. No regressions.

## Next target

`canary tid=6 → ours tid=1` main, idx **102404**:
`NtQueryFullAttributesFile`
- canary return_value=0 (`STATUS_SUCCESS`) — file/path exists
- ours   return_value=3221225524 (`0xC0000034 STATUS_OBJECT_NAME_NOT_FOUND`) — file/path missing

Likely a VFS/cache path-existence divergence: canary has a pre-populated
content directory or HDD-backing mount that responds SUCCESS to a
specific Sylpheed query path, while ours's fresh-boot VFS rejects it.
Sister of AUDIT-053/054 (VFS layout aliasing) and the AUDIT-052 cache
persistence question.

The args/path string is not captured in the Phase A event payload
(emitter gap — kernel.call args resolution for `lpstring_t` not wired).
First step in Phase C+10 will be capturing the path (either via the
existing emitter or a one-shot --trace-imports run with the same
ISO + binary).