update

docs/pre15-stage0/P15-022.md

@@ -0,0 +1,87 @@
+# P15-022 Stage0 Decision
+
+Status: `GO`. B19a source is authorized.
+
+P15-022 is the G03/G05 xattr-cache candidate. The old decision was not treated
+as terminal because its multi-block path parser stopped before producing a
+P15-022 result and G05 had zero samples. The repaired gate completed both
+mandatory branches before source implementation.
+
+## Frozen Identity
+
+The replay base is `50a4e84d0da33592a81361e0294b7feb5bbd3ffa`.
+`P15-022-input.json` freezes the current DUT/Linux source, exact-ABI FreeBSD
+source `/work/dev-freebsd-releng` at
+`106727738dcfb6c001b46f25363b91cece970085`, host tools, B17 assets, B19a
+generator/oracle/model assets, a 1 MiB mount budget, a 64 KiB per-vnode body
+limit, 64 workers, five samples per variant, and the unchanged 25 percent
+provider-metadata-read threshold.
+
+## Oracle Repair And G03
+
+The B19a oracle now reads every logical directory block, including a short
+final block, and validates name offsets, embedded NUL rules, strict in-block
+ordering, strict adjacent-block ordering, stable entry order, duplicate
+resolution, and missing-path classification. Its self-controls cover target
+lookup after a block boundary, duplicate within/across blocks, duplicate
+resolution, missing target, backwards boundary, and an invalid name range.
+
+The real fixture retains 64 long-named peers and one target. It has 2 root
+directory blocks, 68 entries, and resolves `target.bin` in block 1 after the
+`peer-047`/`peer-048` boundary. The target contains both one inline xattr and
+one shared xattr. Valid, corrupt shared-count, corrupt shared-ID, and corrupt
+inline-name fixtures are independently checked with positive FreeBSD errno.
+
+G03 completed twice on byte-reproducible images. The existing B17 oracle also
+replayed twice with all 10 legal and 15 damaged images passing and frozen
+fixture-set SHA256
+`d821aeb36de37ae40b817b91f8169e585721c33a3a9e59098cdfbcbfff74e364`.
+
+## G05 Result
+
+The same image, host, operations, warmup, loops, and sample order were used for
+both variants. Five raw samples per variant are retained; no failed sample was
+filtered. Baseline provider metadata reads were
+`1400,1400,1400,1400,1400`; candidate reads were
+`800,800,800,800,800`. Median reduction is `42.857142857142854%` for both
+instrumented calls and provider block reads, above the unchanged `25.0%` gate.
+
+The focused cache model passes 64-worker one-owner publication, identical
+waiter bytes and typed failure, failed initialization without a half-published
+body, the 64 KiB entry limit, exact 1 MiB budget exhaustion fallback, invalidation,
+inflight close, reclaim, and zero resident bytes after cleanup. The decision
+is `GO`; source modification is now authorized only within the B19a write set.
+
+## Evidence And Scope
+
+Evidence is retained under
+`planning/pre15/evidence/20260817T171814Z-B19a/`. `GATE-attempt1` preserves the
+runner failure caused by the missing sample directory. `GATE-attempt2` is the
+authoritative GO replay with raw fixtures, oracle reports, cache-model output,
+sample JSON, aggregate TSV, commands, and cleanup manifest.
+
+The authorized source/test write set is:
+
+```text
+repo-pre-15/src/erofs_vnops.c
+repo-pre-15/src/inode.c
+repo-pre-15/src/internal.h
+repo-pre-15/src/xattr.c
+repo-pre-15/tests/pre15/cases/B19a-xattr-cache.sh
+repo-pre-15/tests/pre15/fixtures/B19a-*
+```
+
+No QEMU or production source was touched by this Stage0 gate. B36 and all
+other execution units remain out of scope.
+
+## B19a Acceptance Addendum
+
+B19a subsequently implemented the authorized per-vnode xattr body/shared-ID
+cache within the declared write set. The focused FreeBSD 15.0-RELEASE-p8
+exact-ABI run passed first, concurrent, and repeated xattr reads; symmetric
+`EINTEGRITY` results for all three damaged images; normal and forced unmount;
+cache invalidation and reclaim; KLD unload; guest mount/md cleanup; target and
+runner cleanup; and an empty dmesg delta. The runner retained the original
+1200-second case deadline, focused command timeouts, 64 KiB body limit, 1 MiB
+mount budget, and 25 percent G05 threshold. The final evidence is under
+`planning/pre15/evidence/20260817T193130Z-B19a-final/`.