xenia-rs/audit-runs/phase-c22-rtl-enter-leave-104607/escalation-confirmed.md

Phase C+22 re-invocation — ESCALATION CONFIRMED (2026-05-22)

Decision

RE-CONFIRM the C+22 escalation landed 2026-05-18. No engine change, no diff-tool change. Class A (scheduler-determinism + post-wait state-mutation downstream effect) — same root cause as C+20, structurally parallel to C+14.

Phase 0 — Class E ruled out (verified today)

Both engines register RtlEnterCriticalSection and RtlLeaveCriticalSection symmetrically:

engine	RtlEnterCriticalSection	RtlLeaveCriticalSection
canary	xboxkrnl_table.inc:307 ord 0x125 (293) kFunction shimmed	xboxkrnl_table.inc:318 ord 0x130 (304) kFunction shimmed
ours	exports.rs:169 register_export(Xboxkrnl, 0x0125, …, rtl_enter)	exports.rs:177 register_export(Xboxkrnl, 0x0130, …, rtl_leave)

(Note: the prompt cited "ord 293" / "ord 304" decimal; the hex forms 0x125 / 0x130 are the actual table indices. They match the decimal values — no off-by-one.)

Class E ruled out — both export paths reach a real implementation in both engines.

State drift check vs prior C+22 session

• xenia-rs HEAD: e6d43a2… (unchanged from prior C+22 session on 2026-05-18 — verified by git log -1).
• exports.rs carries the Phase D Stage 3 contention-replay manifest in rtl_enter_critical_section (lines 3290-3396). This was already in place at the prior C+22 session per the Phase D Stage 3+4 memory entry. Default-mode behavior unchanged (manifest short-circuits when XENIA_CONTENTION_MANIFEST_PATH unset).
• Working tree contains uncommitted canary-side instrumentation for AUDIT-068/069 and Iterate 2.A (per the index entries) — none of it touches RtlEnter/Leave or the post-wait branch.
• xenia-canary RtlEnter/Leave shims unchanged (same ord lookup table file, same line numbers).

Cross-reference with C+14 + Phase D forensics

The Phase D D-extension memory entry already pinpoints the upstream root cause:

tid=1 wakes from notification-event wait → consults CS-protected tree at (CS 0x828f4838).r30+48 via helper 0x8245B1F8 find-or-insert → canary's tree has more entries because peer tid=5 had more wall-time to insert during the wait window → canary's "insert" path nested-Enter+Leaves; ours's "match" path early-exits.

That's exactly the C+14 single-CS wrapper at sub_8245B128 + the file-tracker singleton at 0x828F4838. The C+22 prompt's "file-tracker state divergence (F)" hypothesis is correct, and the Phase D D-extension absorber (LANDED 2026-05-18) is already the diff-tool-level band-aid that crosses reading-error #23 in spirit — it absorbed +439 events past the cap by folding the [Enter-block, Leave-block] pair as a nested-CS-cleanup absorber. Main is now at 105,046 matched-prefix per the Phase D D-extension entry (not the 104,607 from C+21 — the absorber advanced past the cap).

Reconciling 104,607 (prompt) vs 105,046 (Phase D D-ext)

The prompt frames today's target as "idx 104,607 cold-vs-cold first divergence." This was the C+21 / C+22 baseline. The Phase D D-extension (LANDED 2026-05-18, same date as prior C+22) shifted main to 105,046 via diff-tool absorber. Both can be true: the prompt cites the pre-D-extension cap; today's methodologically-correct measurement uses the post-D-extension diff tool.

Without re-running cold-vs-cold (cost-benefit unfavorable given no engine drift), the existing Phase D D-extension result stands as the most recent matched-prefix value. Today's invocation does not advance it.

Authorized fix shape (or escalation rationale)

Escalation. Per the prompt's tripstone 5: "if this turns out to be the same sub_8245B128 file-tracker issue, escalate cleanly. Don't push through." That tripstone fires today:

1. Class E ruled out (Phase 0 verification above).
2. Class A established by prior 4-canary-sample evidence (jitter-1/2/3 + fresh c22, all E E L L nested pattern in canary; ours E L NtClose simple-release).
3. Root cause is the C+14 / Phase D sub_8245B128 chain reading the file-tracker tree at (CS 0x828f4838).r30+48, with peer tid=5 timing-dependent inserts.
4. Authorized scope explicitly EXCLUDES "scheduler determinism" refactor, which is what would be required to fix at root.
5. Diff-tool absorber for this region ALREADY LANDED (Phase D D-extension, +439 events past cap).

No engine modification within scope can advance further. The prompt's "quick fix ≤50 LOC" path is not available; the "C+14-class deferred" path is the correct outcome.

Per-chain delta table

No fresh cold-vs-cold run executed in today's invocation (cost- benefit: engine state for this subsystem is unchanged from 2026-05-18 C+22, which already executed the full protocol). Per Phase D D-extension's archived measurement:

chain	C+21	C+22 (prior)	Phase D D-ext	today (no run)
canary tid=6 → ours tid=1 main	104,607	104,607	105,046	105,046
canary tid=4 → ours tid=11	11	11	11	11
canary tid=7 → ours tid=2	32	32	32	32
canary tid=12 → ours tid=7	3	3	4 (per index)	4
canary tid=14 → ours tid=9	41	41	41	41
canary tid=15 → ours tid=10	16	16	16	16

Jitter verification

Inherited from prior C+22 session (canary-jitter-1/2/3 + fresh c22 cold): all 4 canary samples agree on the E E L L nested pattern post-wait. Re-verification today is not warranted — canary table file is unchanged and the canary-jitter jsonls are archived intact.

Gates (escalation-mode)

gate	result
Phase 0 — Class E ruled out	PASS
xenia-rs HEAD unchanged for this subsys	PASS
canary table file unchanged	PASS
Phase B image_canonical_sha256	UNCHANGED ea8d160e…
Prior escalation evidence still valid	PASS
Tripstone 5 (C+14-class) fires correctly	PASS
Canary caches untouched today	PASS (no run)
--mute=true discipline	N/A (no run)

Files

• This file: confirmation of prior escalation.
• Prior C+22 session artifacts: xenia-rs/audit-runs/phase-c22-rtl-enter-leave-control-flow/
  • investigation.md (263 lines)
  • escalation.md (123 lines)
  • cold-vs-cold-result.md (96 lines)
  • re-validation.md
  • diff-cold-vs-cold.md
  • canary-binary-cache-pre-wipe.tar.gz + canary-xdg-cache-pre-wipe.tar.gz
• Phase D D-extension landed-state: see memory index entry phase_d_d_extension_absorber_2026_05_18.

Next target

Per the prior C+22 escalation's next-target recommendation:

1. C+23 = D-NEW-2 (LANDED 2026-05-18 per memory entry project_phase_c23_kewait_timeout_addis_signext_2026_05_18).
2. C+24 = D-NEW-3 (XAudio voice-category divergence on tid=14→9 sister chain).
3. Parallel scheduler-determinism track — multi-session refactor. Memory entry project_scheduler_determinism_plan_2026_05_18 documents the plan. Phase D Stages 0-4 already implemented the replay-track infrastructure; Phase D D-extension landed the diff-tool absorber that crossed the cap.

The Phase C C+22 thread is COMPLETE at the escalation boundary; advancement requires the parallel scheduler track.