# P15-038 Stage0 Decision

Status: `GO`. B33 is authorized.

The authoritative frozen-BASE run is
`planning/pre15/evidence/20260816T021736Z-G05-P15-038/` against
`5d6755649a369498a9b257bb2d1d1e3496d5135e`. Its state model, hard-budget
accounting, real codec oracle, eviction check, and owned cleanup all pass.

The gate compares the current LZMA-only admission policy with a test-only,
codec-neutral single-entry decoded cache. Both variants execute the same 1,024
deterministic random 4 KiB logical reads against the same 256 KiB payload for
each of LZ4, LZMA, Deflate, and Zstd. Each variant has exactly five cold-cache
samples; no sample may be discarded. The helper uses the frozen host
liblz4/liblzma/zlib/libzstd libraries and performs real compression and full
decode work. It contains no synthetic sleep.

This is an independent host codec-cost oracle. It can prove avoided codec work
and byte correctness, but it is not guest vnode latency evidence and must not
be reported as such. Provider I/O, map lookup, VOP dispatch, and guest kernel
scheduling are outside its scope.

The state model preserves B32's exact key, one-owner, waiter, typed-failure,
retry, and no-cache fallback rules. It additionally freezes mount-cache then
global-budget lock order, reservation-before-decode accounting, codec-neutral
work/size admission, disabled policy, global exhaustion, ready eviction,
inflight reclaim refusal, successful reclaim, unmount drain, and key reuse.
Reserved plus resident decoded bytes are charged to the same hard budget.

G05 is GO only if the state model closes, all current/candidate hashes match,
eviction-before/after SHA-256 matches, every candidate sample stays within the
fixed budget, and at least two codecs improve median latency by 10 percent or
more. Any missing sample, correctness mismatch, lifecycle gap, or budget
overflow is STOP for P15-038 only.

## Result

All five current and five candidate samples are retained for each codec. The
median current/candidate latencies and improvements are:

| Codec | Current median | Candidate median | Improvement |
|---|---:|---:|---:|
| LZ4 | 44,988,337 ns | 6,583,335 ns | 85.367% |
| LZMA | 7,278,779 ns | 7,286,634 ns | -0.108% |
| Deflate | 186,791,959 ns | 6,102,297 ns | 96.733% |
| Zstd | 20,355,035 ns | 6,236,635 ns | 69.361% |

Three codecs exceed the required 10 percent threshold. LZMA is the expected
control because both current and candidate policies admit it; its negative
0.108 percent delta is retained and is not excluded or rewritten.

Every candidate sample charges exactly 262,144 resident bytes against the
262,144-byte mount budget. The state model reaches the 524,288-byte global
limit with two mounts, proves a third mount's synchronous no-cache fallback,
reclaims one reservation, retries successfully, and returns to zero bytes.
It also passes 16-thread success and typed-failure waves, ready eviction,
inflight reclaim refusal, key reuse, policy disable, low-work/oversize bypass,
and unmount drain. The real Deflate decode before and after eviction has
SHA-256 `5d3c21088380524a78c52b067d47a93117c5385464c5dfc83e8de598119511bb`.

No QEMU process was started by this pre-source gate. No guest vnode latency is
claimed. No production source, B32 correctness path, B32 QEMU runner, protected
PID 26318, port 9222, or shared base image was touched. B33 may now execute its
exact write set and acceptance matrix.

## B33 Execution

B33 source/test commit `bc56f830918b76029871b60cca2e53992de70a2e`
implements codec-neutral decoded-work/size admission with fixed hard mount and
global budgets, loader configuration/disable controls, four-codec accounting,
FreeBSD `vm_lowmem` reclaim, eviction, unmount release, and synchronous
no-cache fallback. It changes only `src/internal.h` and `src/zdata.c` in the
production tree and preserves the B32 key/inflight/failure contract.

D, authoritative H `20260816T025825Z-host-B33-cache-policy-1393732-0`, and
FreeBSD 15 cross-KLD builds with zstdio0 and zstdio1 pass. The final H-tested
seven-path source/test tree is byte-identical to the committed tree. Q
TC168-cache-inflight is `INFRA_BLOCKED`: guest SSH was not ready at the exact
absolute 300-second deadline, so no guest source, case target, KLD load, vnode
latency, or guest PASS is claimed. Owned PID 1389807, overlay, and port 33537
were cleaned; the protected process, port, and base metadata are unchanged.

The Q attempt predates the final replacement-order and policy-bypass-accounting
changes and did not reach the DUT. Full correspondence details and exact hashes
are in `planning/pre15/evidence/20260816T023315Z-B33/VERDICT.md`.
