# Phase C+10 — NtQueryFullAttributesFile — Re-validation

Validation against the Phase 1 emitter extension (only landed work).
No fix landed for the actual divergence (ESCALATED — see
`escalation.md`).

## Gate matrix

| # | gate | result |
|---|---|---|
| 1 | cvar-OFF determinism 50M (3 runs) | PASS — all 3 = `b8fa0e0460359a4f660adb7605e053de` (UNCHANGED from C+9 baseline; extension is zero-cost when cvar OFF) |
| 2 | Phase B `image_loaded_sha256` | PASS — `ea8d160e9369328a5b922258a92113efb8d7ce3e1a5c12cc521e375985c91c18` (matches baseline; XEX loader untouched) |
| 3 | Phase A main matched-prefix | UNCHANGED — 102404 (no fix landed; matched-prefix advance NOT expected this session) |
| 3b | tid=4 → 11 unchanged | PASS — 9 (no regression) |
| 3c | tid=7 → 2 unchanged | PASS — 29 (no regression) |
| 3d | tid=12 → 7 unchanged | PASS — 2 (no regression) |
| 3e | tid=14 → 9 unchanged | PASS — 39 (no regression) |
| 3f | tid=15 → 10 unchanged | PASS — 15 (no regression) |
| 4 | Both engines build clean | PASS (1 unrelated `walk_committed_regions` dead-code warning, pre-existing C+9) |
| 5 | Phase A emitter determinism (2 runs) | PASS — both = `7489e90ef4c9be629af8c9fabb1cbdd7` |
| 6 | Unit tests | PASS — 165 → 165 (no new tests; no regressions) |

## Stable-digest comparison

| field | C+9 baseline | C+10 post-extension | delta |
|---|---|---|---|
| (all stable fields, 3 runs) | `b8fa0e0460359a4f660adb7605e053de` | `b8fa0e0460359a4f660adb7605e053de` | 0 |

Extension is purely emitter-side, cvar-gated default-off, behaviorally
inert. Determinism unchanged.

## Phase A determinism

```
ours.jsonl        (run 1) det-fields md5: 7489e90ef4c9be629af8c9fabb1cbdd7
ours-determ.jsonl (run 2) det-fields md5: 7489e90ef4c9be629af8c9fabb1cbdd7
```

Byte-identical on deterministic fields. New `--phase-a` det baseline
`7489e90e…` (replaces C+9's `0b299c37…`). The signature changed
because the new `args_resolved.path` field IS part of the
deterministic payload — but it's stable across runs (path string is
read directly out of guest memory, fully deterministic for fixed
input).

## Per-chain summary

| chain | C+9 baseline | C+10 (after emitter extension) | delta |
|---|---|---|---|
| canary tid=6 → ours tid=1 (main) | 102404 | 102404 | 0 (no fix landed) |
| canary tid=4 → ours tid=11 | 9 | 9 | 0 |
| canary tid=7 → ours tid=2 | 29 | 29 | 0 |
| canary tid=12 → ours tid=7 | 2 | 2 | 0 |
| canary tid=14 → ours tid=9 | 39 | 39 | 0 |
| canary tid=15 → ours tid=10 | 15 | 15 | 0 |

All chains unchanged. No regressions. No advances (as expected — no
behavioral change to either engine).

## Confirmed framing (Phase 1 success)

The divergence path is now visible in the diff output:

```
canary[6][102403] kernel.call NtQueryFullAttributesFile
                  args_resolved.path = "cache:\d4ea4615\e\46ee8ca"
ours  [1][102403] kernel.call NtQueryFullAttributesFile
                  args_resolved.path = "cache:\d4ea4615\e\46ee8ca"
```

Both engines query the SAME path. Both successfully read the
OBJECT_ATTRIBUTES.name_ptr. Divergence is purely in
`vfs.stat`/`file_system().ResolvePath` outcome (canary's mount has
the file; ours's wiped cache doesn't).

## Sources of truth for the path field

Both engines read directly out of guest memory at the same point in
the dispatch sequence (right before the export handler runs). The
resulting string is byte-identical when input is identical. This is
verified by the byte-identical det-fields md5 across runs.

## Phase 6 status

Gates 1-2, 3b-3f, 4-6 all pass. Gate 3 main-prefix did NOT advance.
This is because **no fix was landed** — Phase 4 ESCALATED.

The session's contribution is:
* Permanent emitter extension on both engines (~80 LOC each).
* Path framing captured for the divergence.
* Classification + scope-decision memo in `escalation.md`.

## Next target

Same idx 102,404, but in a dedicated cache-subsystem session that
can:

1. Re-test AUDIT-053's warm-start regression under AUDIT-054's
   FILE_DIRECTORY_FILE fix.
2. Decide between cache-build subsystem vs cache-seed-from-canary vs
   stub-success.
3. Land + re-validate the cache-state mechanism + run Phase A to
   measure the cascade.

The path framing landed in this session is the permanent input for
that follow-up session.