xenia-rs/audit-runs/phase-a-diff-harness/validation.md

Phase A — Validation record

All four acceptance gates from the plan have been executed against the patched canary (build-cross/bin/Windows/Debug/xenia_canary.exe) and ours (target/release/xenia-rs). Results below were captured on 2026-05-13.

Gate 1: cvar-OFF determinism

ours

• Pre-patch binary digest: audit-runs/phase-a-diff-harness/digest-pre-patch.json (captured from a copy of the binary made before applying the patch).
• Post-patch binary digest: audit-runs/phase-a-diff-harness/digest-post-patch-cvaroff.json.
• Both runs: check --stable-digest -n 50000000 against the same ISO.
• Verification: diff of the two files produces zero output. Byte-identical. PASS.

canary

• Pre-patch run: 12 s boot under Wine, --mute=true, log size 68 301 bytes.
• Post-patch run with cvar unset: same conditions, log size 68 407 bytes.
• Per-line diff of the two logs:
  • Lines 19-20: two new entries in the CONFIG DUMP — phase_a_event_log_path = "" and phase_a_event_log_mem_writes = false. Expected — these are the two cvars we declared, both default to empty/false.
  • Remaining differences: host-pointer values (pid=0x..., graphics_system=0x..., native=0x...) and millisecond timings (Translated 5 shaders in 18 ms vs ... in 13 ms).
• Cross-check: re-ran the same post-patch binary a second time. Log size identical (68 407 bytes). Diff between two consecutive runs of the same binary shows the same volume and nature of host-pointer/timing changes — i.e. this is normal run-to-run jitter, not a behavioral change introduced by the patch.
• Smoke marker (AUDIT-DEMO-SETUP-BEGIN/AUDIT-DEMO-SETUP-GRAPHICS-OK) fires in both runs.
• PASS.

Unit tests

cargo test -p xenia-kernel event_log — 2/2 tests pass:

• fnv1a_known_vector (FNV-1a 64-bit of "foobar" == 0x85944171f73967e8, the standard FNV-1a test vector)
• semantic_id_stable (identity inputs produce identity output; distinct inputs produce distinct output)

Gate 2: cvar-ON emits well-formed JSONL with schema_version header

ours

$ head -1 audit-runs/phase-a-diff-harness/ours-sanity.jsonl
{"schema_version":1,"engine":"ours","kind":"schema_version","tid":0,"tid_event_idx":0,
 "guest_cycle":0,"host_ns":48371,"deterministic":true,
 "payload":{"version":1,"emitter_build":"ours-phaseA"}}
$ wc -l audit-runs/phase-a-diff-harness/ours-sanity.jsonl
121363

50 M-instruction run produced 121 363 valid JSONL events.

canary

$ head -1 audit-runs/phase-a-diff-harness/canary-sanity.jsonl
{"schema_version":1,"engine":"canary","kind":"schema_version","tid":0,"tid_event_idx":0,
 "guest_cycle":0,"host_ns":300,"deterministic":true,
 "payload":{"version":1,"emitter_build":"canary-phaseA"}}
$ wc -l audit-runs/phase-a-diff-harness/canary-sanity.jsonl
1635789

12 s Wine run produced 1 635 789 valid JSONL events. (Volume differential vs ours reflects canary's debug build with full kernel-call logging at every shim trampoline; both engines pin schema_version=1.)

Both files lead with a schema_version event. PASS.

Gate 3: diff tool finds matching prefix on tid=1

Ran tools/diff-events/diff_events.py on the two sanity files with auto-mapping:

| canary_tid | ours_tid | matched | canary_total | ours_total | first_divergence_at |
|     6      |    1     |   113   |    313196    |   108492   |         113         |
|     4      |   11     |     5   |     25163    |        9   |           5         |
|     7      |    2     |     2   |        29    |       33   |           2         |
|    12      |    7     |     2   |      2846    |        3   |           2         |
|    14      |    9     |    11   |    587000    |       75   |          11         |
|    15      |   10     |    15   |    355601    |       15   |          —          |

The primary boot-thread pair (canary_tid=6 → ours_tid=1) matched 113 events before the first divergence — well over the ≥100 threshold required by the gate. PASS.

The full per-thread report is at diff-report.md. Per Phase A discipline, those divergences are NOT analyzed in this session; they are input for Phase B.

Gate 4: Negative test detects a hand-corrupted event

# Self-diff of identical files — clean exit
$ python3 tools/diff-events/diff_events.py \
    --canary /tmp/ours-short.jsonl --ours /tmp/ours-short.jsonl --validate-identical
$ echo $?
0

# Corrupted "kernel.call" -> "kernel.CORRUPT" on a tid=1 kernel.call event
$ python3 tools/diff-events/diff_events.py \
    --canary /tmp/ours-short.jsonl --ours /tmp/ours-corrupt.jsonl --validate-identical
$ echo $?
1

The diff report names the divergence at the right index:

First divergence at `tid_event_idx=4`: kind: canary='kernel.call' ours='kernel.CORRUPT'

A second corruption further down the file (line 51, tid_event_idx=49) was also detected. PASS.

Summary

Gate	Status
1. Cvar-OFF determinism (both engines)	✅
2. Cvar-ON emits valid JSONL with schema_version header (both engines)	✅
3. Diff tool reports ≥100-event matching prefix on tid=1 → divergence at idx 113	✅
4. Negative test (corrupt one event) → exit 1, correct tid_event_idx named	✅

Cascade prediction at session close (harness signals only):

• A (infrastructure builds, cvar-OFF zero overhead): achieved.
• B (cvar-ON emits valid JSONL both engines): achieved.
• C (sanity validation 4-gate passes first try): achieved on the first complete run, modulo a transient build-time issue (CMake xe_platform_sources is non-incremental for new .cc files in canary — needed a cmake --preset cross-win-clangcl reconfigure).
• D (fix lands): N/A — out of scope for Phase A.