xenia-rs/audit-runs/iterate-2S-longbudget-signal-match/writer-report.md

# Iterate 2.S — Long-budget (500M) replay with 2.Q `signal.match` active (writer report)

**Date:** 2026-05-28. **LOC delta:** engine **0**, canary **0**, tooling **0**.
Pure measurement.
**Tests:** N/A (no source modifications).
**Cascade:** N/A — observability replay only.

## Headline

**BUDGET-CAP-FALSIFIED  /  C-2-SCHEDULER-FAIRNESS-CONFIRMED-STRUCTURAL.**
500M-instruction replay (10× 2.Q's 50M) under `XENIA_CACHE_WIPE=1` with
2.Q `signal.match` instrumentation active emits **121,605 events,
bit-identical to 2.Q's 50M run.** Run terminates `EXIT=0` at wallclock
13.7 s on `reached max instruction count limit=500000000`. **Zero
`signal.match` events on wedge handle `0x000012e4` (or any of the
4 unsignaled wedge handles {0x12c8, 0x12d0, 0x12e4, 0x1020}) in the
entire 500M-instruction window.** Exit-state thread geometry bit-identical
to 2.M/2.N/2.Q (13 threads, 10 wedge entries, same wedge map). **tid=6
remains `Ready` on `hw_id=5` with no resumption** despite the engine
having ~13× more wallclock budget to schedule it. Combined with 2.K's
identical "zero new events 50M→500M" result, this **definitively rules
out the C-1 burst-then-halt subclass framing as a budget-truncation
artifact** and **confirms 2.R's C-2 (Ready-but-not-running on CPU5) as
structural**. Next iterate should be 2.T (`wake.requested`
instrumentation in `wake_eligible_waiters`) to decisively distinguish
kernel-wake-call-not-issued vs scheduler-pick-skipping-Ready-tid-6.

## Mode

ZERO LOC. Invocation (identical to 2.K except cwd):

```
XENIA_CACHE_WIPE=1 timeout 600 ./target/release/xenia-rs exec \
  -n 500000000 --quiet \
  --phase-a-event-log audit-runs/iterate-2S-longbudget-signal-match/ours-cold.jsonl \
  "../Project Sylpheed - Arc of Deception (USA, Europe) (En,Ja).iso"
```

Engine binary `xenia-rs/target/release/xenia-rs` from May 28 19:51 carries
the uncommitted 2.Q `signal.match` patch (working tree HEAD
`e6d43a23…` + diff sha256 `e81a4b84…`). XDG cache `/home/fabi/.local/share/
xenia-rs/cache/` was empty before run; `XENIA_CACHE_WIPE=1` set for
belt-and-braces.

Run completed `EXIT=0`. Diagnostic re-run (non-quiet) captured:
`reached max instruction count limit=500000000` ... `exec complete
wall_ms=13705 instructions=500000004 import_calls=40390 unimplemented=0`.
Instruction budget hit cleanly, no panic / fault / SIGSEGV / timeout.

## Primary gate results

### Gate 1 — `signal.match` events on wedge handle `0x000012e4`

| metric | value |
|---|---:|
| `signal.match` on `0x000012e4` whole run | **0** |
| `signal.match` on `0x000012e4` in [1.0, 5.0] s | **0** |
| `signal.match` total (run-wide) | 36 |

**Same as 2.Q.** No signaler ever produces `0x000012e4`. The disambiguation
gate from the goal-spec resolves to "C-2 confirmed structural" (since
neither budget cap nor signal observability changed).

### Gate 2 — Exit-thread-state on tid=6 (and other wedge tids)

`exit-thread-state.json` 9651 bytes, bit-identical to 2.M/2.N/2.Q. tid=6
state and full wedge geometry unchanged:

| tid | state | hw_id | affinity | last_pc | wedge waiting on |
|---:|---|---:|---|---|---|
| 1 | Blocked | 0 | 0xff | 0x824ac578 | 0x12c8 = Thread(13) |
| 2 | Blocked | 1 | 0xff | 0x824a95f8 | 0x8287093c = Event |
| 3 | Blocked | 5 | 0x20 | 0x824ac578 | 0x1020 = Event |
| 4 | Blocked | 3 | 0x08 | 0x824ac578 | 0x1028 = Semaphore(0/2³¹-1) |
| 5 | Blocked | 3 | 0x08 | 0x824ac578 | **0x12e4 = Event** |
| **6** | **Ready** | **5** | **0x20** | **0x824ab214** | **—** |
| 7 | Blocked | 2 | 0x04 | 0x824cd4f4 | 0xbe8cbb5c = Event |
| 8 | Blocked | 2 | 0x04 | 0x824ab214 | 0x10ec=Event + 0x10d8=Sem |
| 9 | Ready | 4 | 0x10 | 0x824d1404 | — |
| 10 | Ready | 5 | 0x20 | 0x824d1404 | — |
| 11 | Blocked | 0 | 0xff | 0x824d2a94 | 0x828a3244 + 0x828a3220 |
| 12 | Ready | 5 | 0x20 | 0x824aa6a4 | — |
| 13 | Blocked | 1 | 0x02 | 0x824ac578 | 0x12d0 = Event |

**tid=6 STILL Ready at hw_id=5** — exactly as 2.R observed. The 10× budget
did not allow the scheduler to resume tid=6.

### Gate 3 — tid=5 last guest_cycle

| metric | 2.R (50M jitter sample) | 2.S (500M run) | delta |
|---|---:|---:|---:|
| tid=5 last guest_cycle | (n/a separately reported, but wedge wait at 1,007,809,113 host_ns) | **486,334** | — |
| tid=5 last host_ns | 1,007,809,113 (2.R) | **859,219,713** | LOWER (jitter, not regression) |

Note: `host_ns` is wallclock-derived and varies jitter-to-jitter. `guest_cycle`
is the deterministic guest-side counter; tid=5's last guest_cycle 486,334
is bit-equivalent across 2.Q / 2.S (same Phase-A event content).

## Secondary gate results

### Total event counts

| metric | 2.K (50M-baseline, no signal.match) | 2.Q (50M+signal.match) | 2.S (500M+signal.match) |
|---|---:|---:|---:|
| total events | 121,569 | 121,605 | **121,605** |
| `signal.match` events | 0 (kind not emitted) | 36 | **36** |
| baseline events (ex signal.match) | 121,569 | 121,569 | **121,569** |
| Phase-A delta 50M→500M | 0 (vs 2.J) | n/a | **0** |
| Wallclock | 13.96 s | not reported (~5s) | **13.7 s** |
| Termination reason | `reached max instruction count limit` | (50M) | **`reached max instruction count limit=500000000`** |

**Bit-identical event count to 2.Q.** 10× budget bought ~10× wallclock
but produced **zero additional Phase-A events**.

### `signal.match` by signaler tid (whole run)

| tid | count | target handles |
|---:|---:|---|
| 5 | 19 | 0x1028×7, 0x10b4×5, 0x103c, 0x1068, 0x10a0, 0x10fc, 0x1128, 0x1160, 0x11a0 |
| 1 | 9 | 0x1044×7, 0x10d8, 0x10dc |
| 6 | **3** | 0x10ac, 0x1108, 0x116c |
| 13 | 1 | 0x1044 |
| 2 | 1 | 0x8287094c |
| 11 | 1 | 0x828a3254 |
| 9 | 1 | 0x828a3230 |
| 8 | 1 | 0x000012c0 |

**tid=6 fires only 3 `signal.match` events** (3 of its 41 `NtSetEvent`
calls land on a parked waiter — namely tid=5's 3 satisfied
`NtWaitForSingleObjectEx` calls per [[iterate_2R_missing_producer_2026_05_28]]'s
per-wait table). The other 38 `NtSetEvent` calls land on already-signaled
or no-waiter events — consistent with the canary tid=11 polling-loop
behavior (the analog of ours tid=6) issuing many "ensure signaled" sets
on a manual-reset event that already has no waiter.

### tid=5 NtReleaseSemaphore on handle 0x000010b4 (the tid=6 backlog feeder)

`signal.match` on `0x000010b4` (tid=6 is the sole waiter per 2.Q snapshot):

| ns (ms) | signaler | waiters |
|---:|---:|---|
| 493.7 | tid=5 | [6] |
| 493.8 | tid=5 | [6] |
| 520.9 | tid=5 | [6] |
| 719.9 | tid=5 | [6] |
| **856.6** | **tid=5** | **[6]** |

**5 releases on 0x10b4 targeting tid=6 as parked waiter.** Critically,
**tid=5 release at ns=856.6 ms fires AFTER tid=6's last event at
ns=723.5 ms** (tid=6's last `NtSetEvent` `signal.match`). That release
should wake tid=6 — but tid=6 never reschedules (its last event is
723.6 ms, ~133 ms before the 856.6 ms release; the 859.2 ms run-end
is then only ~2.6 ms after the release with no tid=6 activity). This is
the same starvation pattern 2.R documented for a different jitter
sample (2.R had tid=5 issuing 76 releases in [880, 991] ms). **2.S
confirms the pattern is reproducible across jitter samples and across
budgets.**

(2.R's "76 releases" appears to have come from raw `kernel.call` args
parsing rather than `signal.match`; 2.S only has 5 because `signal.match`
filters to events where waiter_count ≥ 1 — the other ~70 releases must
have been on different handles or with no waiter present at signal time.
Either way the wake-pattern conclusion is the same.)

### Per-tid event counts and last activity

| tid | events | last host_ns (ms) | last guest_cycle |
|---:|---:|---:|---:|
| 1 | 108,516 | 852.3 | 9,169,116 |
| 5 | 10,031 | 859.2 | 486,334 |
| 4 | 2,075 | 859.2 | 92,705 |
| 13 | 436 | 855.3 | 27,211 |
| 6 | **318** | **723.6** | **6,020,629** |
| 9 | 78 | 819.3 | 689 |
| 8 | 38 | 852.0 | 443 |
| 3 | 37 | 468.5 | 1,030 |
| 2 | 34 | 468.1 | 4,273 |
| 10 | 17 | 819.4 | 103 |
| 11 | 12 | 819.0 | 91 |
| 12 | 6 | 851.6 | 45 |
| 7 | 5 | 500.7 | 30 |

tid=6's 318 events in 723.6 ms of host time is its **complete observable
lifetime in this run**, with the rest of the 13,700 ms wallclock budget
contributing zero further tid=6 events. tid=1 (the main bootstrap) and
tid=5 (the AUDIT-068 dispatcher) continue logging events until ~852-859 ms
host_ns, well past tid=6's quiescence — proving the trace isn't truncated
early; tid=6 specifically is starved.

## Disambiguation result vs goal-spec

| outcome | gate predicate | result | conclusion |
|---|---|---|---|
| BUDGET-CAP-WAS-ISSUE-WEDGE-DISSOLVED | `signal.match` on 0x12e4 in [1.0, 5.0]s > 0 OR tid=6 last event > 888.5 ms OR exit state changes | NO (0 on 0x12e4; tid=6 last 723.6 ms; exit state bit-identical to 2.M/2.N/2.Q) | **FALSIFIED** |
| C-2-CONFIRMED-STRUCTURAL | 0 signals on 0x12e4 AND tid=6 still Ready/idle at exit | YES + YES | **CONFIRMED** |
| NEW-BEHAVIOR-OBSERVED | event count or wedge map differs from 2.Q | NO (event count identical, wedge map identical) | NOT TRIGGERED |
| RUN-FAILED | non-zero exit / crash / hang | NO (EXIT=0, wall_ms=13,705) | NOT TRIGGERED |

**Result: C-2 (scheduler-fairness Ready-but-not-running on CPU5) confirmed
structural** by 500M-budget reproduction.

The C-1 (burst-then-halt by backlog drain) subclass framing **survives as
a partial-cause description** (tid=6's 228 ms burst from ns=498 to 723 is
real and finite, matches a backlog-drain shape), but **cannot be the SOLE
cause** because:

1. tid=5 issues a release on tid=6's waited semaphore 0x10b4 at ns=856.6 ms
   (133 ms after tid=6 quiescent), which by C-1 alone should rescue tid=6;
2. The 500M budget gives the scheduler ~13s of wallclock to pick tid=6,
   which has affinity 0x20 = CPU5 (shared with two other Ready tids
   tid=10 and tid=12 — three Ready threads on one HW thread);
3. No tid=6 events appear in the entire post-723.6ms window.

The mechanism that must explain (1)+(2)+(3) is the C-2 scheduler-fairness
issue: tid=6 is on the Ready queue for hw_id=5 but the scheduler is not
context-switching to it. The 5th tid=5 release on 0x10b4 makes a
`signal.match` emit with tid=6 in waiter list — yet tid=6 doesn't actually
get woken+rescheduled before the budget runs out.

Open: whether (a) `wake_eligible_waiters` is correctly transitioning
tid=6 from Blocked→Ready and the scheduler then never re-picks it
(pure scheduler bug), OR (b) `wake_eligible_waiters` is failing to even
issue the wake-request for tid=6 (wake-call bug masquerading as scheduler
issue). 2.T (`wake.requested` instrumentation) decisively distinguishes
these.

## Comparison: 2.K → 2.Q → 2.S

| gate | 2.K (500M, no signal.match) | 2.Q (50M + signal.match) | 2.S (500M + signal.match) |
|------|---:|---:|---:|
| total events | 121,569 | 121,605 | **121,605** |
| baseline events | 121,569 | 121,569 | **121,569** |
| `signal.match` events | n/a | 36 | **36** |
| `signal.match` on 0x12e4 | n/a | 0 | **0** |
| Phase-A events 50M→500M | 0 (vs 2.J) | n/a | **0** |
| exit-state size | 9651 | 9651 | **9651** |
| wedge tids parked at 0x824ac578 | 5 | 5 | **5** |
| tid=6 final state | Ready | Ready | **Ready** |
| Termination | budget hit | (50M) | **budget hit (500M)** |
| Wallclock | 13.96 s | ~5 s | **13.7 s** |
| Engine binary HEAD | `e6d43a23` | `e6d43a23` + 2.Q patch | **`e6d43a23` + 2.Q patch** |

**Bit-equivalent to 2.Q** on every observable. Bit-equivalent to 2.K on
non-`signal.match` events. The 10× budget is observability-null, AND the
2.Q `signal.match` adds no events in the 50M→500M window.

## Tripstone audit

- **#28** (cross-engine tid stability): No cross-engine tid claims made.
  Comparisons across 2.K/2.Q/2.S all on ours-side; ours-side scheduler
  tids stable for this trajectory.
- **#39** (composite progression IS progression): NO progression claim.
  VdSwap=1, draws=0, render_targets=0 — bit-identical to 2.J/2.K/2.Q/2.N.
  Matched-prefix unchanged.
- **#40** (single-keystone framing): Carefully NOT collapsing into a
  single-cause story. C-2 framing is *confirmed structural* via budget
  reproduction, but the underlying mechanism (wake-call-not-issued vs
  scheduler-skip) remains open and is what 2.T will distinguish. C-1
  burst-then-halt remains partially descriptive (the burst exists) but
  cannot be sole cause given (1)+(2)+(3) above.
- **#41** (categorized diff tags): `signal.match` is ENGINE_LOCAL in
  the diff harness; doesn't affect matched-prefix.
- **#42** (Phase-A blind to blocked-forever waits): Used 2.M
  `exit-thread-state.json` as authoritative for tid=6's Ready state
  (Phase-A would have shown only the wait-loop completion events, missing
  the actual final Ready geometry). Confirms tid=6 is NOT Blocked, it's
  Ready-and-skipped.

## Reading-error #43 candidate — REJECTED

Goal-spec floated reading-error #43 as a candidate if budget-cap dissolved
the wedge. **The wedge did NOT dissolve at 10× budget.** Reading-error #43
is NOT triggered. **Inverse risk** (NOT a new reading-error, but worth
noting): be skeptical of "budget cap probably explains this" framings for
wait-loop wedges — 2.K already showed this, 2.S re-confirms. Any future
iterate that argues "we need more budget" must clear a high bar after
two consecutive 500M reproductions show zero new events.

## Confidence

- **HIGH** that 500M budget was hit cleanly (`exec complete wall_ms=13705
  instructions=500000004`, diagnostic re-run).
- **HIGH** that event count is bit-identical to 2.Q (121,605 = 121,605
  per `wc -l`).
- **HIGH** that exit-state thread geometry is bit-identical to 2.M/2.N/2.Q
  (9651 bytes file, 13 threads, 10 wedge entries, same wedge_map).
- **HIGH** that `signal.match` on 0x000012e4 is 0 in entire 500M window
  (exhaustive grep via python jsonl scan).
- **HIGH** that tid=6 last event at 723.6 ms is well below the 859.2 ms
  trace-end, proving tid=6 specifically is starved (not a trace
  truncation).
- **HIGH** that 2.R's C-2 framing is confirmed structural by this
  reproduction — budget cap is NOT the cause.
- **MEDIUM-HIGH** that the underlying mechanism is scheduler-pick-skipping
  Ready tid=6 (vs wake-call-not-issued); 2.T will distinguish.
- **HIGH** that 2.R's C-1 partial framing (burst-then-halt) is real but
  cannot be sole cause given the 856.6 ms release evidence.

## Next iterate recommendation

**2.T — `wake.requested` instrumentation in `xenia-kernel/exports.rs`
`wake_eligible_waiters` (~80-150 LOC).** Emit a new schema-v1
`wake.requested` event per waiter the wake-loop touches, carrying
{signaler_tid, target_tid, handle, sid, prior_state, post_state,
context_switch_scheduled, ready_queue_position}. This decisively
distinguishes:

- **C-2a (wake-call not issued)**: `signal.match` shows tid=6 in waiter
  list at ns=856.6 ms but no corresponding `wake.requested` event for
  tid=6 → bug is in `wake_eligible_waiters` waiter-iteration or
  per-handle waiter-list registration.
- **C-2b (wake-call issued, scheduler-skip)**: `wake.requested` fires
  with `prior_state=Blocked, post_state=Ready, context_switch_scheduled=true`
  but tid=6 never actually executes — bug is in the scheduler ready-queue
  pick logic (hw_id=5 with affinity-0x20 contention).

C-2a vs C-2b have totally different fix paths (kernel-handle-list bug vs
scheduler-fairness bug), so this disambiguation is high-value. Same
observability-only pattern as 2.Q (zero semantic change). Estimated
~80-150 LOC, ~30 min to implement + ~10 min run + report.

Alternative deferred:
- **2.U — closure / commit 2.Q patch.** Per [[iterate_2Q_signal_match_2026_05_28]]
  the patch is uncommitted in working tree. Commit hygiene if no immediate
  follow-up work needed.
- **2.V — canary `signal.match` mirror (~30-60 LOC C++).** Adds parity
  for cross-engine SID diff (per AUDIT-062 wrong-slot vs missing-producer
  question). Higher long-term ROI but lower than 2.T's immediate
  disambiguation value.

**Recommended:** 2.T first (~30-40 min total), then commit 2.Q + 2.T
together as a single observability batch.

## Artifacts

Under `xenia-rs/audit-runs/iterate-2S-longbudget-signal-match/`:

- `ours-cold.jsonl` (28.7 MB, 121,605 events, 500M-instr quiet run)
- `ours-cold.stdout.log` (empty — quiet mode)
- `ours-cold.stderr.log` (single 2.M emission notice line — bit-equivalent
  to 2.Q's stderr)
- `exit-thread-state.json` (9651 bytes; bit-identical to 2.M/2.N/2.Q —
  13 threads + 10 wedge entries)
- `writer-report.md` (this file)

Engine HEAD `e6d43a23ac393004d2e5adf2f0395fd0b5e6448b` + uncommitted
diff sha256 `e81a4b84224ab07330a0af259589e928` (2.Q `signal.match` patch
+ prior retained 2.F/2.H/2.L/2.M patches). xenia-canary UNCHANGED.