xenia-rs/audit-runs/phase-c6half-sister-sweep/re-validation.md

# Phase C+6½ — re-validation (HARD GATES)

## Gate 1 — Determinism (cvar-OFF, ours)

3 fresh runs of `check -n 50000000 --stable-digest` post-fix:

| run | digest md5 |
|-----|------------|
| 1   | c6d895829b4611964978990ae1cb8a6a |
| 2   | c6d895829b4611964978990ae1cb8a6a |
| 3   | c6d895829b4611964978990ae1cb8a6a |
| C+6 baseline (cvar-OFF) | `c6d895829b4611964978990ae1cb8a6a` |

**Result**: ✅ byte-identical across 3 runs AND **UNCHANGED from C+6**.

Why digest unchanged despite Phase 2 behavior fixes:
* Phase 1 sister sweep is purely emitter-suppression (cvar-OFF inert).
* Phase 2 fixes ord 0x82 (`ke_query_interrupt_time`) and 0x98
  (`stub_success`) — but neither ord is called in the 50M-instr window
  (verified: 0 hits in event log for both names, before AND after).
  The new bodies are LATENT for now.

Cvar-OFF baseline preserved. No regression to determinism.

## Gate 2 — Phase B `image_canonical_sha256`

Phase B snapshot captured to `snap/ours/`:
```
$ grep image_loaded_sha256 snap/ours/config.json
"image_loaded_sha256": "ea8d160e9369328a5b922258a92113efb8d7ce3e1a5c12cc521e375985c91c18",
```

Matches the Phase-A/B verify baseline ✅. The fix touches only
kernel-export shim/emitter — no PE image bytes modified.

## Gate 3 — Phase A matched-prefix extension (KEY METRIC)

Diffed `/tmp/c6half_phasea.jsonl` (50M-instr Phase A capture post-fix)
against `audit-runs/phase-c-first-divergence/phase-a/canary.jsonl`.

| chain | C+6 | C+6½ | Δ |
|---|---|---|---|
| canary tid=6 → ours tid=1 (main) | 102158 | **102158** | **0** (preserved) |
| canary tid=4 → ours tid=11 | 5 | 5 | 0 |
| **canary tid=7 → ours tid=2** | **15** | **26** | **+11** ✅ |
| canary tid=12 → ours tid=7 | 2 | 2 | 0 |
| canary tid=14 → ours tid=9 | 39 | 39 | 0 |
| canary tid=15 → ours tid=10 | (no div) | (no div) | 0 |

**Gate 3 ✅**:
* tid=7→tid=2 chain advanced from 15 to 26 (+11) — direct payoff of
  the `StfsCreateDevice` class-E fix (C+6 predicted this).
* Main chain unchanged at 102158 (no regression).
* All other chains stable.

### New tid=7→tid=2 first divergence

idx=26: `kernel.return KeSetEvent` `return_value=1 (canary) vs 0 (ours)`.

Same divergence class as tid=4→tid=11 (also at idx=5 on KeSetEvent).
`KeSetEvent` semantically returns "the previous signaled state of the
event" — canary returns 1 (event was already signaled), ours returns
0 (correct STATUS_SUCCESS but wrong semantic). This is the `KeSetEvent`
return-value bug class, deferred — would need investigation of ours's
`nt_set_event`/`ke_set_event` body return semantics (likely a sister
to the `KeSetEvent_entry` body returning `prev_signaled` instead of
`STATUS_SUCCESS`).

## Gate 4 — Build

```
$ cargo build --release
   Compiling xenia-kernel v0.1.0
   Compiling xenia-app v0.1.0
    Finished `release` profile [optimized] target(s) in 6.73s
```

One pre-existing dead-code warning (`walk_committed_regions`); not
introduced by this fix. Canary untouched.

## Gate 5 — Phase A determinism (emitter)

Two cvar-ON captures of the same engine binary, md5-summing only
deterministic fields (excluding `host_ns` and `guest_cycle`):

```
run1 (det-fields-only md5): 11a07772f600abab9dcfe4af2300b554
run2 (det-fields-only md5): 11a07772f600abab9dcfe4af2300b554
```

Byte-identical ✅.

Note: digest changes from C+6's `7312446e…` because the suppression
flips events on/off in the deterministic stream for 9 more ords AND
the renamed ord 0x82/0x98 produce different name strings. Expected.

## Gate 6 — Kernel unit tests

```
$ cargo test --release -p xenia-kernel --lib
test result: ok. 146 passed; 0 failed; 0 ignored; 0 measured;
                 0 filtered out
```

Test count: 145 (C+6) → 146 (C+6½) = +1 net.
* Renamed: `ke_set_ideal_processor_round_trips` →
  `scheduler_ideal_processor_round_trips` (still exercises round-trip,
  but via scheduler API directly since the hallucinated kernel-export
  funcs were deleted).
* Added: `ke_query_interrupt_time_returns_synthetic_u64` — asserts
  the new ord 0x82 body returns a non-zero u64 (> u32::MAX) in gpr[3],
  guarding against regression to byte-sized return.

No regressions in any other test.

## Summary

All 6 gates pass.

* **Phase 1**: 9 class-E sister bugs fixed (DbgPrint, RtlCaptureContext,
  sprintf, RtlUnwind, _vsnprintf, __C_specific_handler,
  XeKeysConsoleSignatureVerification, StfsCreateDevice, StfsControlDevice).
  All registered via `register_unimplemented_export` to mirror canary's
  syscall-thunk silence. Bodies retained (harmless side effects).
* **Phase 2**: 2 hallucinated imports fixed (ord 0x82
  `KeQueryInterruptTime`, ord 0x98 `KeSetBackgroundProcessors`).
  Both rename + body fix; old hallucinated bodies deleted.
* **Phase 3**: no additional findings beyond the explicit list.

**Headline metric**: tid=7→tid=2 chain matched-prefix grew +11 (15→26),
exactly as the C+6 sister-bugs note predicted for `StfsCreateDevice`.
Main chain preserved at 102158. No regressions.

Diff-tool unchanged. Canary unchanged. Heap memory model (C+2) and
clock (Stage 2) deferred items untouched.

Next divergence (per metric):
* Main chain still blocked at 102158 (`XamTaskCloseHandle return=1
  vs 0`) — Phase C+7 target as noted in C+6 memory.
* tid=7→tid=2 now blocked at 26 (`KeSetEvent return=1 vs 0`) — same
  bug class as tid=4→tid=11 at idx=5 (KeSetEvent prev-signaled
  return-value semantics).