# Phase C+22 cold-vs-cold result (2026-05-18)

## Outcome: NO engine change. ESCALATE.

Verified C+21 absorber engaged correctly on the fresh cold-vs-cold
measurement; main matched-prefix is stable at **104,607**
(no change from C+21 baseline). Divergence at canary idx 104,610
(post-absorb) vs ours idx 104,607 classified as **(A) ours
fast-paths while canary contends → state mutated during the wait
→ different post-acquire branch**. Same root cause as C+20.

## Matched-prefix table (vs C+21 baseline)

| chain                          | C+21    | C+22 (fresh c22) | delta |
|--------------------------------|---------|------------------|-------|
| canary tid=6 → ours tid=1 main | 104,607 | **104,607**      | 0     |
| canary tid=4 → ours tid=11     | 11      | 11               | 0     |
| canary tid=7 → ours tid=2      | 32      | 32               | 0     |
| canary tid=12 → ours tid=7     | 3       | 3                | 0     |
| canary tid=14 → ours tid=9     | 41      | 41               | 0     |
| canary tid=15 → ours tid=10    | 16      | 16               | 0     |

## Floating-event absorption counts (fresh c22)

| chain                          | floating_create (c/o) | floating_wait (c/o) |
|--------------------------------|-----------------------|---------------------|
| canary tid=6 → ours tid=1 main | 1 / 0                 | 2 / 0               |
| canary tid=15 → ours tid=10    | 0 / 1                 | 0 / 0               |
| others                         | 0 / 0                 | 0 / 0               |

C+18 absorber engaged on main chain (1 canary handle.create
floated) and on tid=15→10 (1 ours handle.create floated).
C+21 absorber engaged on main chain (2 canary wait.begin events
floated — the contention slow-path emitted them in this run).

## Cold-stable invariants

- **ours-cold byte-identical to C+19 archive**: 121,569 events
  match post-normalization (host_ns/guest_cycle excluded).
  Reading-error class #34 (cold-run determinism depends on input
  path form) discovered + documented; ALL future cold runs must
  use `.iso` not `.xex`.
- **Phase B image hash**: `ea8d160e9369328a5b922258a92113efb8d7
  ce3e1a5c12cc521e375985c91c18` — unchanged (no engine source
  change).
- **Engine source**: UNCHANGED in both ours and canary. No new
  exports, no new flags, no diff-tool changes.

## Verification of NOT-jitter

Pattern in canary's tid=6 post-loop region (idx 104,604-104,615
`import.call` events only):

| sample           | events                                                       |
|------------------|--------------------------------------------------------------|
| c21 archived     | E E L L                                                      |
| canary jitter-1  | E (wait.begin slow path) E L L                               |
| canary jitter-2  | E E L L                                                      |
| canary jitter-3  | (shifted) E E L L                                            |
| fresh c22        | E (wait.begin slow path) E L L                               |

All canary samples take the EXTRA nested RtlEnter after the
post-loop `E` at 104,604. Ours never does — it goes `E L NtClose`.
This is a real guest-code branch divergence, NOT diff-tool jitter.

## Cascade outcome

- A=verify divergence is NOT jitter: PASS
- B=classify (A/B/C/D): PASS — **(A) scheduler-determinism +
  post-wait state-mutation effect**
- C=land fix or escalate cleanly: ESCALATION (per prompt
  authorized fallback)
- D=main matched-prefix > 104,607: N/A (no engine change)

## Files

- `investigation.md` — detailed framing, mechanism, rejected
  fixes, reading-error #34 documentation, next-targets.
- `diff-cold-vs-cold.md` — full Phase A diff report (fresh c22
  cold-vs-cold).
- `canary-binary-cache-pre-wipe.tar.gz` — pre-wipe canary
  binary-dir cache backup (restored post-run).
- `canary-xdg-cache-pre-wipe.tar.gz` — pre-wipe canary XDG
  cache backup (restored post-run).
- `ours-cold-stdout.log` / `canary-cold-stdout.log` — run logs.

## Next-target recommendation

**C+23 = D-NEW-2** (`KeWaitForSingleObject` `timeout_ns`
sign/scale asymmetry on canary tid=12 → ours tid=7 idx=3):
canary=-30000000 vs ours=429466729600. Independent of
scheduler-determinism. Out of scope for C+22 per the C+22
prompt's explicit "You may NOT ... Fix D-NEW-2 in this
session." Likely ~20-40 LOC in `ke_wait_for_single_object`'s
timeout-pointer dereference.