# Re-validation — Crowbar v3 composite progression metric

**Date**: 2026-05-21
**Method**: 3x OFF + 3x ON cold runs, 25M-instruction `check` digests.

## Protocol

- Binary: `target/release/xrs-crowbar3` (release build of HEAD + v3 patch).
- Command: `xrs-crowbar3 check <ISO> -n 25000000 --gpu-thread --out <json>`.
- OFF: no env vars set (crowbar default-off).
- ON: `XENIA_CROWBAR_WORKERS=1 XENIA_CROWBAR_CTX_BIN=ctx-canary.bin`.
- ISO: Sylpheed master image; no cache wipes between ours-runs (the
  crowbar trigger is per-instr-count, deterministic).

## Results

| Run | instructions | swaps | draws | unique_RT | score | notes |
|-|-:|-:|-:|-:|-:|-|
| OFF-1 | 25,000,000 | 1 | 0 | 0 | **1** | natural halt at limit |
| OFF-2 | 25,000,000 | 1 | 0 | 0 | **1** | natural halt at limit |
| OFF-3 | 25,000,000 | 1 | 0 | 0 | **1** | natural halt at limit |
| ON-1  | 20,000,167 | 1 | 0 | 0 | **1** | FAULT @ pc=0 lr=0x82506e38 r3=0xBCE25640 tid=15 |
| ON-2  | 20,000,167 | 1 | 0 | 0 | **1** | FAULT @ pc=0 lr=0x82506e38 r3=0xBCE25640 tid=15 |
| ON-3  | 20,000,167 | 1 | 0 | 0 | **1** | FAULT @ pc=0 lr=0x82506e38 r3=0xBCE25640 tid=15 |

## Composite score (option 6 from boot-state review)

```
score = 1*swaps + 10*draws + 100*unique_render_targets
```

- OFF mean: 1.0
- ON mean: 1.0
- **Δ = 0**

## Determinism

Across 3 ON runs:
- Fault PC, LR, CTR, r3, r4, r29, r30, r31 are bit-identical.
- Fault cycle is bit-identical (cycle=20000167).
- `instructions=20000167` matches across all 3 runs (deterministic
  scheduling under the GPU thread backend).
- `packets` varies slightly (18.6M / 18.7M / 19.1M) — expected, this
  is the GPU thread race documented as ±2-8% jitter.

## Conclusion

3x replication confirms the v3 crowbar deterministically faults at
the same dispatch site with the same register state. The
`XENIA_CROWBAR_CTX_BIN` install path is structurally sound — it writes
exactly the canary-captured bytes (verified via the post-install u32
slot dump in stderr) — but the secondary-object recursion is now the
blocker.

**The hypothesis "wedge is crowbar-soluble with full ctx state +
worker spawn" is FALSIFIED at the case-(D) recursion level.**