feat(perf): T-029 Phase 2 — EL0 syscall round-trip micro-bench

Completes T-029: the EL0↔EL1↔EL0 syscall round-trip, timed kernel-side, with no
CNTVCT_EL0 exposure to EL0 (AC#4). Combined with the Phase-1 ctx+IPC benches so
one `perf-bench` measurement build reports all three.

Design (maintainer-approved: hand-assembled image + combined build):
- A hand-assembled 12-byte raw-flat EL0 image (`mov x8,#0; svc #0; b .-4`,
  BENCH_EL0_IMAGE) loops a REJECTED syscall (number 0 → BadSyscallNumber →
  Resume, before any cap is touched — no yield, no side effect, no log). So each
  svc is the pure fixed round-trip overhead (trap + 272-byte frame save + decode
  + return), and the task monopolises the CPU (never switches) → back-to-back
  syscall_entry entries.
- perf_bench::run loads it via the existing load_image + task_create_from_image
  + add_user_task (added FIRST, dispatched first), alongside the Phase-1
  driver/partner/idle.
- A feature-gated hook in syscall_entry — el0_roundtrip_tick(effect) — times
  consecutive entries (safe Timer::now_ns), skips a warm-up, accumulates N
  deltas, prints the mean, then returns SyscallEffect::Terminate(0). The
  EXISTING (T-028) Terminate arm ends the EL0 bench via task_exit_current and
  dispatches the driver → the ctx/IPC benches run next.
- Un-gated USER_TASK_STACK / USER_TASK_TABLE: now the EL0 bench task's SP_EL1 +
  an empty cap table (the rejected svc consults no capability).

No new `unsafe` operation: timing reuses safe now_ns (UNSAFE-2026-0015); the EL0
load reuses load_image (UNSAFE-2026-0025/0026/0027) + add_user_task/enter_el0
(UNSAFE-2026-0032); the Terminate is applied by the audited arm
(UNSAFE-2026-0008). UNSAFE-2026-0014 gains a Phase-2 Amendment.

Numbers (QEMU-virt/TCG, relative-only): EL0 syscall round-trip 9 108 ns/syscall
(N=50 000) — ≈3.6x a context switch in the same run.

Gates: fmt clean; kernel-clippy ±feature clean (-D warnings; run() gets the same
too_many_lines allow kernel_main_high uses); host tests pass; build ±feature;
feature-off byte-identity (.text/.data/.bss + footprint identical to base, only
32 .rodata panic-loc bytes shift); feature-off smoke = unchanged demo trace; one
feature-on run captured all three numbers + `perf-bench complete`; Miri
--workspace --exclude bsp 0 UB.

Docs: baseline §Micro-measurements Phase 2 section filled in (section complete);
T-029 AC#4/#6 flipped, all ACs met; UNSAFE-2026-0014 Phase-2 Amendment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cemililik

bsp-qemu-virt/src/main.rs

@@ -263,7 +263,7 @@ static TASK_IDLE_STACK: TaskStack = TaskStack::new();
 /// handler on this stack (the trap frame + the gate-#1 dispatch call tree); a
 /// uniform 4 KiB `TaskStack` is ample (≫ the ~272-byte frame + walk depth) and
 /// satisfies `add_user_task`'s ≥1-page / 16-byte-aligned `SP_EL1` contract.
-#[cfg(not(feature = "perf-bench"))]
+/// Reused as the EL0 bench task's `SP_EL1` under `perf-bench` (T-029 Phase 2).
 static USER_TASK_STACK: TaskStack = TaskStack::new();
 
 // ─── Global kernel state ──────────────────────────────────────────────────────
@@ -469,7 +469,8 @@ static FAILCLOSED_TABLE: StaticCell<CapabilityTable> = StaticCell::new();
 /// `console_write` against **its own** caps (gate #3 / T-026). BSP-owned; the
 /// scheduler only records the `*mut` per [ADR-0021]. Distinct from the
 /// kernel-side `BOOTSTRAP_AS_TABLE` (which holds the AS + Task management caps).
-#[cfg(not(feature = "perf-bench"))]
+/// Under `perf-bench` (T-029 Phase 2) it is the EL0 bench task's table, seeded
+/// **empty** — the bench's rejected no-op `svc` touches no capability.
 static USER_TASK_TABLE: StaticCell<CapabilityTable> = StaticCell::new();
 
 /// Task kernel-object arena — global per [ADR-0016]. Although the v1 demo

bsp-qemu-virt/src/perf_bench.rs

@@ -46,17 +46,19 @@
 //! [ADR-0021]: https://github.com/HodeTech/Tyrne/blob/main/docs/decisions/0021-raw-pointer-scheduler-ipc-bridge.md
 
 use core::fmt::Write;
-use core::sync::atomic::{AtomicU8, Ordering};
+use core::sync::atomic::{AtomicU64, AtomicU8, Ordering};
 
-use tyrne_hal::{Cpu, FmtWriter, Timer};
+use tyrne_hal::{Cpu, FmtWriter, Timer, VirtAddr};
 use tyrne_kernel::cap::{CapHandle, CapObject, CapRights, Capability, CapabilityTable};
 use tyrne_kernel::ipc::{IpcQueues, Message};
 use tyrne_kernel::mm::BOOTSTRAP_ADDRESS_SPACE_HANDLE;
 use tyrne_kernel::obj::endpoint::{create_endpoint, Endpoint, EndpointArena};
 use tyrne_kernel::obj::task::{create_task, Task, TaskArena};
+use tyrne_kernel::obj::task_loader::{load_image, task_create_from_image};
 use tyrne_kernel::sched::{
     ipc_recv_and_yield, ipc_send_and_yield, register_idle, start, yield_now, Scheduler,
 };
+use tyrne_kernel::syscall::SyscallEffect;
 
 use crate::console::Pl011Uart;
 use crate::cpu::QemuVirtCpu;
@@ -86,9 +88,54 @@ static PHASE: AtomicU8 = AtomicU8::new(PHASE_CTX);
 /// `insert_root` lands at index 0 / generation 0 — asserted in [`run`].
 const BENCH_EP_CAP: CapHandle = CapHandle::from_raw(0, 0);
 
-/// Set up the two bench tasks and start the scheduler. Never returns: after the
-/// driver prints its results it parks, so the measurement build halts (the QEMU
-/// harness captures the `tyrne: perf …` lines and stops the guest).
+// ── EL0 syscall round-trip bench (Phase 2) ───────────────────────────────────
+
+/// Timed EL0 syscall round-trips; after this many the kernel terminates the EL0
+/// bench task (see [`el0_roundtrip_tick`]) and hands off to the ctx/IPC benches.
+const N_EL0_ROUNDTRIPS: u64 = 50_000;
+/// Untimed EL0 round-trips before the timed window (steady state).
+const EL0_WARMUP: u64 = 256;
+
+/// A minimal raw-flat EL0 program (entry at offset 0, [ADR-0029] format) that
+/// loops a **rejected** syscall, so the kernel can time the EL0↔EL1↔EL0
+/// round-trip from `syscall_entry` (T-029 Phase 2 / AC#4) **without** exposing
+/// `CNTVCT_EL0` to EL0. Hand-assembled aarch64:
+///
+/// ```text
+///   _start: mov x8, #0   ; D2800008 — syscall number 0 = reserved-invalid
+///   loop:   svc #0       ; D4000001 — trap to EL1 → BadSyscallNumber → Resume
+///           b   loop     ; 17FFFFFF — branch back to the svc (offset −4)
+/// ```
+///
+/// Number 0 decodes to `BadSyscallNumber` **before** any capability is touched
+/// (no cap lookup, no yield, no log), so each `svc` is the *pure* fixed
+/// round-trip overhead (trap + 272-byte frame save + decode + return) with no
+/// side effect — and the task never switches away, so `syscall_entry` sees
+/// back-to-back entries until the kernel forces termination after N.
+#[rustfmt::skip]
+static BENCH_EL0_IMAGE: [u8; 12] = [
+    0x08, 0x00, 0x80, 0xd2, // mov x8, #0
+    0x01, 0x00, 0x00, 0xd4, // svc #0
+    0xff, 0xff, 0xff, 0x17, // b .-4  (back to the svc)
+];
+
+/// Timestamp of the previous `syscall_entry` (0 = "no previous yet"). The
+/// entry-to-entry delta is one full EL0 round-trip.
+static EL0_PREV_NS: AtomicU64 = AtomicU64::new(0);
+/// Count of `syscall_entry` entries seen so far (the EL0 bench task is the only
+/// `SVC` source, so every entry is one of its round-trips).
+static EL0_ENTRY_COUNT: AtomicU64 = AtomicU64::new(0);
+/// Accumulated ns across the N timed deltas (mean = this / `N_EL0_ROUNDTRIPS`).
+static EL0_ACCUM_NS: AtomicU64 = AtomicU64::new(0);
+
+/// Set up the EL0 bench task + the two kernel bench tasks and start the
+/// scheduler. Never returns: after the driver prints its results it parks, so
+/// the measurement build halts (the QEMU harness captures the `tyrne: perf …`
+/// lines and stops the guest).
+#[allow(
+    clippy::too_many_lines,
+    reason = "linear measurement-build setup top-to-bottom for auditability — mirrors `kernel_main_high`; splitting into helpers would scatter the load→create→publish→schedule order each step depends on"
+)]
 pub fn run(cpu: &QemuVirtCpu, console: &Pl011Uart) -> ! {
     {
         let mut w = FmtWriter(console);
@@ -98,24 +145,86 @@ pub fn run(cpu: &QemuVirtCpu, console: &Pl011Uart) -> ! {
         );
     }
 
-    // Task arena + the three task handles (driver, partner, idle).
+    // Task arena.
     // SAFETY: `.bss`-resident StaticCell; single-core and the scheduler is not
     // started, so this write-once publish is unaliased. Audit: UNSAFE-2026-0001.
     unsafe {
         (*crate::TASK_ARENA.0.get()).write(TaskArena::default());
     }
-    // SAFETY: `TASK_ARENA` was just written; the momentary `&mut` is scoped to
-    // these `create_task` calls and drops before any task runs (no cross-switch
-    // borrow per [ADR-0021]). Audit: UNSAFE-2026-0014.
-    let (driver_h, partner_h, idle_h) = unsafe {
+
+    // Load the EL0 bench image into a fresh address space, reusing the
+    // bootstrap-AS loader path — PMM / MMU / AS arena / the bootstrap AS
+    // authority cap are all initialised before `kernel_main_high`'s workload
+    // fork. The image just loops a rejected `svc` (see `BENCH_EL0_IMAGE`); the
+    // kernel times consecutive `syscall_entry` entries and terminates it.
+    // SAFETY: those five statics are written before the fork (single-core, no
+    // task running); the momentary `&mut`/`&`s drop at this block's end and
+    // never cross a switch ([ADR-0021]). Audit: UNSAFE-2026-0010 +
+    // UNSAFE-2026-0014 (+ the loader's own UNSAFE-2026-0025/0026/0027 for the
+    // page-table writes / frame zero-fill / image byte-copy).
+    let loaded = unsafe {
+        let pmm = (*crate::PMM.0.get()).assume_init_mut();
+        let mmu = (*crate::MMU.0.get()).assume_init_ref();
+        let table = (*crate::BOOTSTRAP_AS_TABLE.0.get()).assume_init_mut();
+        let arena = (*crate::AS_ARENA.0.get()).assume_init_mut();
+        let parent_cap = *(*crate::BOOTSTRAP_AS_CAP.0.get()).assume_init_ref();
+        load_image(
+            &BENCH_EL0_IMAGE,
+            pmm,
+            mmu,
+            table,
+            arena,
+            parent_cap,
+            CapRights::empty(),
+            VirtAddr(crate::USERSPACE_IMAGE_BASE_VA),
+            crate::USERSPACE_STACK_PAGES,
+        )
+        .expect("perf-bench: load EL0 bench image failed")
+    };
+
+    // The three kernel task handles (driver, partner, idle) + the EL0 bench task
+    // (turned into a runnable Task via the T-024 bridge, then resolved to a
+    // `TaskHandle`).
+    // SAFETY: `TASK_ARENA` + `BOOTSTRAP_AS_TABLE` are written above; the momentary
+    // `&mut`s are scoped to this block and drop before any task runs (no
+    // cross-switch borrow per [ADR-0021]). Audit: UNSAFE-2026-0010 + UNSAFE-2026-0014.
+    let (driver_h, partner_h, idle_h, el0_task_h, el0_as_h) = unsafe {
         let arena = &mut *crate::TASK_ARENA.as_mut_ptr();
         let d = create_task(arena, Task::new(0, BOOTSTRAP_ADDRESS_SPACE_HANDLE))
             .expect("perf-bench: create driver task failed");
         let p = create_task(arena, Task::new(1, BOOTSTRAP_ADDRESS_SPACE_HANDLE))
             .expect("perf-bench: create partner task failed");
         let i = create_task(arena, Task::new(2, BOOTSTRAP_ADDRESS_SPACE_HANDLE))
             .expect("perf-bench: create idle task failed");
-        (d, p, i)
+
+        let bootstrap_table = (*crate::BOOTSTRAP_AS_TABLE.0.get()).assume_init_mut();
+        let el0_as_h = {
+            let cap = bootstrap_table
+                .lookup(loaded.as_cap)
+                .expect("perf-bench: loaded AS cap is stale");
+            match cap.object() {
+                CapObject::AddressSpace(h) => h,
+                _ => panic!("perf-bench: loaded.as_cap is not an AddressSpace cap"),
+            }
+        };
+        let task_cap = task_create_from_image(
+            &loaded,
+            bootstrap_table,
+            arena,
+            3,
+            CapRights::DUPLICATE | CapRights::DERIVE | CapRights::REVOKE,
+        )
+        .expect("perf-bench: task_create_from_image failed");
+        let el0_task_h = {
+            let cap = bootstrap_table
+                .lookup(task_cap)
+                .expect("perf-bench: minted Task cap is stale");
+            match cap.object() {
+                CapObject::Task(h) => h,
+                _ => panic!("perf-bench: task_create_from_image returned a non-Task cap"),
+            }
+        };
+        (d, p, i, el0_task_h, el0_as_h)
     };
 
     // One endpoint: the driver holds SEND, the partner holds RECV. Least
@@ -139,25 +248,43 @@ pub fn run(cpu: &QemuVirtCpu, console: &Pl011Uart) -> ! {
         "perf-bench: endpoint caps must resolve to (index 0, generation 0)"
     );
 
-    // Publish the IPC state + the two tables before the scheduler starts.
+    // Publish the IPC state + the two tables + the EL0 task's own (empty) table.
     // SAFETY: single-core; no task is running yet. Audit: UNSAFE-2026-0001.
     unsafe {
         (*crate::EP_ARENA.0.get()).write(ep_arena);
         (*crate::IPC_QUEUES.0.get()).write(IpcQueues::new());
         (*crate::TABLE_A.0.get()).write(table_d);
         (*crate::TABLE_B.0.get()).write(table_p);
+        // Gate #3 sources this for the EL0 bench task; left empty — the rejected
+        // no-op `svc` (number 0 → BadSyscallNumber) looks up no capability.
+        (*crate::USER_TASK_TABLE.0.get()).write(CapabilityTable::new());
     }
 
-    // Scheduler: the driver is added first so it runs first and drives the
-    // sequence; the partner cooperates; idle sits in the dispatcher fallback
-    // slot ([ADR-0026]) and is never reached while either task is Ready.
+    // Scheduler: the EL0 bench task is added FIRST so `start` dispatches it
+    // first; it monopolises the CPU (its rejected `svc` is `Resume`, never
+    // yields) until the kernel terminates it after N round-trips, which then
+    // dispatches the driver — so the ctx/IPC benches run next. Idle sits in the
+    // dispatcher fallback slot ([ADR-0026]).
     let mut sched = Scheduler::<QemuVirtCpu>::new();
-    // SAFETY: `add_task` / `register_idle` call `init_context`; each stack top
-    // is 16-byte aligned (TaskStack repr) and outlives the run; entries are
-    // `fn() -> !`. The momentary `&mut Scheduler` does not cross a switch
-    // ([ADR-0021]). Audit: UNSAFE-2026-0009 + UNSAFE-2026-0011 (`top()`) +
-    // UNSAFE-2026-0014.
+    // SAFETY: `add_user_task` / `add_task` / `register_idle` call
+    // `init_user_context` / `init_context`; each stack top is 16-byte aligned
+    // (TaskStack repr) and outlives the run; kernel entries are `fn() -> !`; the
+    // EL0 task's `user_sp` (loader page-aligned) + `kernel_stack_top` are
+    // 16-byte-aligned + non-null (debug-asserted by `add_user_task`). No `&mut
+    // Scheduler` crosses a switch ([ADR-0021]). Audit: UNSAFE-2026-0009 +
+    // UNSAFE-2026-0011 (`top()`) + UNSAFE-2026-0014 + UNSAFE-2026-0032 (`enter_el0`).
     unsafe {
+        sched
+            .add_user_task(
+                cpu,
+                el0_task_h,
+                el0_as_h,
+                loaded.entry_va.0,
+                loaded.stack_top_va.0,
+                crate::USER_TASK_STACK.top(),
+                crate::USER_TASK_TABLE.as_mut_ptr(),
+            )
+            .expect("perf-bench: add EL0 bench task failed");
         sched
             .add_task(
                 cpu,
@@ -194,7 +321,7 @@ pub fn run(cpu: &QemuVirtCpu, console: &Pl011Uart) -> ! {
         let mut w = FmtWriter(console);
         let _ = writeln!(
             w,
-            "tyrne: perf-bench starting scheduler (ctx-switch + IPC, N={N_CTX_ROUNDTRIPS}/{N_IPC_CYCLES}, warmup={WARMUP})"
+            "tyrne: perf-bench starting scheduler (el0-roundtrip + ctx-switch + IPC, N={N_EL0_ROUNDTRIPS}/{N_CTX_ROUNDTRIPS}/{N_IPC_CYCLES}, warmup={EL0_WARMUP}/{WARMUP})"
         );
     }
 
@@ -358,3 +485,46 @@ fn partner_recv(cpu: &QemuVirtCpu) {
         .expect("perf-bench: ipc_recv_and_yield failed");
     }
 }
+
+/// Per-entry hook called by `syscall_entry` (feature-gated) for the EL0 bench
+/// task — the only `SVC` source in this build, so every entry is one of its
+/// round-trips. Times the entry-to-entry delta (one full EL0↔EL1↔EL0 round-trip,
+/// hook-to-hook), skips the first delta + `EL0_WARMUP`, accumulates the next
+/// `N_EL0_ROUNDTRIPS`, then prints the mean and returns
+/// [`SyscallEffect::Terminate`] — which ends the EL0 bench (`task_exit_current`)
+/// and hands off to the driver/partner ctx+IPC benches. Otherwise returns
+/// `effect` unchanged (the rejected `svc`'s `Resume`), so the EL0 task loops.
+///
+/// `Relaxed` atomics: single-core and `syscall_entry` runs with IRQs masked, so
+/// entries are strictly serial — there is no concurrent access to order.
+pub fn el0_roundtrip_tick(effect: SyscallEffect) -> SyscallEffect {
+    // SAFETY: `CPU` / `CONSOLE` are initialised before `start()`; single-core
+    // cooperative, IRQs masked in the SVC handler. Audit: UNSAFE-2026-0010.
+    let cpu = unsafe { (*crate::CPU.0.get()).assume_init_ref() };
+    let now = cpu.now_ns();
+    let prev = EL0_PREV_NS.swap(now, Ordering::Relaxed);
+    let n = EL0_ENTRY_COUNT.fetch_add(1, Ordering::Relaxed);
+
+    // n == 0: first entry — no previous timestamp, so no delta yet.
+    // 1..=EL0_WARMUP: warm-up deltas (skipped).
+    // EL0_WARMUP+1 ..= EL0_WARMUP+N: the N timed deltas.
+    if n == 0 || n <= EL0_WARMUP {
+        return effect;
+    }
+    EL0_ACCUM_NS.fetch_add(now.saturating_sub(prev), Ordering::Relaxed);
+    if n == EL0_WARMUP + N_EL0_ROUNDTRIPS {
+        let total = EL0_ACCUM_NS.load(Ordering::Relaxed);
+        // SAFETY: as above — `CONSOLE` initialised before `start()`. UNSAFE-2026-0010.
+        let console = unsafe { (*crate::CONSOLE.0.get()).assume_init_ref() };
+        let mut w = FmtWriter(console);
+        let _ = writeln!(
+            w,
+            "tyrne: perf el0 syscall round-trip = {} ns/syscall (kernel-side, hook-to-hook; rejected no-op svc; N={N_EL0_ROUNDTRIPS}, {total} ns total)",
+            total / N_EL0_ROUNDTRIPS
+        );
+        // End the EL0 bench task; `syscall_entry`'s Terminate arm switches to the
+        // next ready task (the driver) → the ctx/IPC benches run next.
+        return SyscallEffect::Terminate(0);
+    }
+    effect
+}

bsp-qemu-virt/src/syscall.rs

@@ -205,6 +205,13 @@ pub unsafe extern "C" fn syscall_entry(frame: *mut SyscallTrapFrame) {
         dispatch(&mut ctx, args)
     };
 
+    // T-029 Phase 2 (perf-bench measurement build only): time consecutive EL0
+    // syscall round-trips kernel-side and, after N, force `Terminate` to end the
+    // bench EL0 task (handing off to the ctx/IPC benches). Feature-gated, so
+    // production `syscall_entry` is byte-identical. See `perf_bench`.
+    #[cfg(feature = "perf-bench")]
+    let effect = crate::perf_bench::el0_roundtrip_tick(effect);
+
     match effect {
         SyscallEffect::Resume(r) => {
             // SAFETY: write the status (x0) + payload (x1..x7) back into the

docs/analysis/reviews/performance-optimization-reviews/2026-06-01-B6-closure.md

@@ -71,9 +71,15 @@ cargo build --target aarch64-unknown-none -p tyrne-bsp-qemu-virt --features perf
 
 **These are QEMU-virt TCG emulated-time figures, not real-silicon latencies.** QEMU's virtual `CNTVCT_EL0` advances on emulated time and TCG executes far slower than hardware, so treat them as **order-of-magnitude + relative** — the same harness-floor caveat the [B5 leg](2026-05-29-B5-closure.md) and §Metric 3 record. They are a baseline for *relative* regression tracking (e.g. "did a scheduler change move ns/switch?"), not absolute performance claims; real-hardware numbers await the Raspberry Pi 4 bring-up. Each figure is the mean over N = 50 000 iterations (after a 256-iteration warm-up), so *within-run* variance is negligible; the 16 ns counter granularity is ≪ the per-op cost. **Cross-run absolutes drift ≈20–25 % with host load under TCG** — a second run measured 2 816 ns/switch and 17 684 ns/cycle — so the figures above are one representative sample, not a stable absolute. The **stable, meaningful** signal is the *ratio* (an IPC round-trip costs ≈4.3–4.5× a context switch across both runs) and same-run deltas, which is what relative regression tracking uses.
 
-### Phase 2 — EL0 syscall round-trip (pending)
+### Phase 2 — EL0 syscall round-trip (2026-06-01)
 
-The EL0↔EL1↔EL0 syscall round-trip — timed kernel-side around `syscall_entry` for a looping EL0 bench task, still **without** exposing `CNTVCT_EL0` to EL0 — lands in **T-029 Phase 2** (a separate PR), which will complete this section.
+A minimal EL0 bench program (a hand-assembled 12-byte raw-flat image: `mov x8,#0; svc #0; b .-4`) loops a **rejected** syscall (number 0 → `BadSyscallNumber` → `Resume`, before any capability is touched — no yield, no side effect). The kernel times **consecutive `syscall_entry` entries** (the EL0 bench task is the only `SVC` source), reading `CNTVCT_EL0` **kernel-side only** — `CNTVCT_EL0` is **never** exposed to EL0 (no `CNTKCTL_EL1.EL0VCTEN`; AC#4). After N the hook returns `SyscallEffect::Terminate`, ending the EL0 task and handing off to the ctx/IPC benches — so one measurement build reports all three.
+
+| primitive | QEMU-virt / TCG | composition |
+|---|---|---|
+| **EL0 syscall round-trip** | **9 108 ns/syscall** | one EL0↔EL1↔EL0 round-trip, hook-to-hook: `SVC` trap → 272-byte frame save → `dispatch` (decode → `BadSyscallNumber`) → `ERET` → 1 EL0 instr (`b`) → next `SVC`; N = 50 000 |
+
+This is the **pure fixed overhead** every syscall pays (trap + frame + decode + return), independent of the cap/IPC/console work a real syscall adds on top. In the same run it was ≈**3.6× a context switch** (2 546 ns/switch that run) — the round-trip's 272-byte frame save/restore + `ERET` is heavier than a kernel-internal switch. Same TCG / relative-only caveat as above (cross-run absolutes drift with host load; the *ratio* is the stable signal).
 
 ## Verdict