50a488776f
Captures two consecutive read-only diagnostic sessions: AUDIT-008 (2026-05-05): IO-003 model reset. The 0x100c / 0x1004 / 0x15e0 workers ARE spawned post-IO-003; the IO-003 prediction-scorecard's "UNCREATED" markers were misclassifications (handle audit already showed the workers parked on lifecycle events, just unlinked from dispatcher addresses). Hypothesized the gate among the 5 non-create-chain callers of sub_821800D8 whose parents live in 0x82287000-0x82292FFF. AUDIT-009 (2026-05-05): falsifies AUDIT-008's β-hypothesis. A 21-PC --branch-probe (6 parents + 5 shims + dispatcher + 9 audit-005 producer-callsites) shows 0/21 firings at -n 500M — the entire 0x82287000-0x82294000 cluster is unreached. Static analysis confirms the cluster's level-1 roots have zero non-call xrefs in sylpheed.db. The gate is structurally above the cluster (vtable / function-pointer that's never written). Stop condition 1 triggered; discipline gate fails on box 1 + box 3; no fix this session. Also updates audit-runs/audit-006/canary_export_queue.md to reflect the AUDIT-009 evidence: 3 canary-only exports remain REAL_BUT_UNREACHED (ExTerminateThread, KeReleaseSemaphore, XamUserReadProfileSettings) — none is the immediate gate. No code changes; --branch-probe machinery from AUDIT-007 sufficed. Trace artifacts left untracked under audit-runs/audit-008/ + audit-runs/audit-009/ (consistent with prior audit-runs/* convention). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>