xenia-rs/audit-runs/phase-c10-NtQueryFullAttributesFile/re-validation.md

Phase C+10 — NtQueryFullAttributesFile — Re-validation

Validation against the Phase 1 emitter extension (only landed work). No fix landed for the actual divergence (ESCALATED — see escalation.md).

Gate matrix

#	gate	result
1	cvar-OFF determinism 50M (3 runs)	PASS — all 3 = b8fa0e0460359a4f660adb7605e053de (UNCHANGED from C+9 baseline; extension is zero-cost when cvar OFF)
2	Phase B image_loaded_sha256	PASS — ea8d160e9369328a5b922258a92113efb8d7ce3e1a5c12cc521e375985c91c18 (matches baseline; XEX loader untouched)
3	Phase A main matched-prefix	UNCHANGED — 102404 (no fix landed; matched-prefix advance NOT expected this session)
3b	tid=4 → 11 unchanged	PASS — 9 (no regression)
3c	tid=7 → 2 unchanged	PASS — 29 (no regression)
3d	tid=12 → 7 unchanged	PASS — 2 (no regression)
3e	tid=14 → 9 unchanged	PASS — 39 (no regression)
3f	tid=15 → 10 unchanged	PASS — 15 (no regression)
4	Both engines build clean	PASS (1 unrelated walk_committed_regions dead-code warning, pre-existing C+9)
5	Phase A emitter determinism (2 runs)	PASS — both = 7489e90ef4c9be629af8c9fabb1cbdd7
6	Unit tests	PASS — 165 → 165 (no new tests; no regressions)

Stable-digest comparison

field	C+9 baseline	C+10 post-extension	delta
(all stable fields, 3 runs)	b8fa0e0460359a4f660adb7605e053de	b8fa0e0460359a4f660adb7605e053de	0

Extension is purely emitter-side, cvar-gated default-off, behaviorally inert. Determinism unchanged.

Phase A determinism

ours.jsonl        (run 1) det-fields md5: 7489e90ef4c9be629af8c9fabb1cbdd7
ours-determ.jsonl (run 2) det-fields md5: 7489e90ef4c9be629af8c9fabb1cbdd7

Byte-identical on deterministic fields. New --phase-a det baseline 7489e90e… (replaces C+9's 0b299c37…). The signature changed because the new args_resolved.path field IS part of the deterministic payload — but it's stable across runs (path string is read directly out of guest memory, fully deterministic for fixed input).

Per-chain summary

chain	C+9 baseline	C+10 (after emitter extension)	delta
canary tid=6 → ours tid=1 (main)	102404	102404	0 (no fix landed)
canary tid=4 → ours tid=11	9	9	0
canary tid=7 → ours tid=2	29	29	0
canary tid=12 → ours tid=7	2	2	0
canary tid=14 → ours tid=9	39	39	0
canary tid=15 → ours tid=10	15	15	0

All chains unchanged. No regressions. No advances (as expected — no behavioral change to either engine).

Confirmed framing (Phase 1 success)

The divergence path is now visible in the diff output:

canary[6][102403] kernel.call NtQueryFullAttributesFile
                  args_resolved.path = "cache:\d4ea4615\e\46ee8ca"
ours  [1][102403] kernel.call NtQueryFullAttributesFile
                  args_resolved.path = "cache:\d4ea4615\e\46ee8ca"

Both engines query the SAME path. Both successfully read the OBJECT_ATTRIBUTES.name_ptr. Divergence is purely in vfs.stat/file_system().ResolvePath outcome (canary's mount has the file; ours's wiped cache doesn't).

Sources of truth for the path field

Both engines read directly out of guest memory at the same point in the dispatch sequence (right before the export handler runs). The resulting string is byte-identical when input is identical. This is verified by the byte-identical det-fields md5 across runs.

Phase 6 status

Gates 1-2, 3b-3f, 4-6 all pass. Gate 3 main-prefix did NOT advance. This is because no fix was landed — Phase 4 ESCALATED.

The session's contribution is:

• Permanent emitter extension on both engines (~80 LOC each).
• Path framing captured for the divergence.
• Classification + scope-decision memo in escalation.md.

Next target

Same idx 102,404, but in a dedicated cache-subsystem session that can:

1. Re-test AUDIT-053's warm-start regression under AUDIT-054's FILE_DIRECTORY_FILE fix.
2. Decide between cache-build subsystem vs cache-seed-from-canary vs stub-success.
3. Land + re-validate the cache-state mechanism + run Phase A to measure the cascade.

The path framing landed in this session is the permanent input for that follow-up session.