update

docs/pre15-stage0/P15-038.md

@@ -0,0 +1,85 @@
+# P15-038 Stage0 Decision
+
+Status: `GO`. B33 is authorized.
+
+The authoritative frozen-BASE run is
+`planning/pre15/evidence/20260816T021736Z-G05-P15-038/` against
+`5d6755649a369498a9b257bb2d1d1e3496d5135e`. Its state model, hard-budget
+accounting, real codec oracle, eviction check, and owned cleanup all pass.
+
+The gate compares the current LZMA-only admission policy with a test-only,
+codec-neutral single-entry decoded cache. Both variants execute the same 1,024
+deterministic random 4 KiB logical reads against the same 256 KiB payload for
+each of LZ4, LZMA, Deflate, and Zstd. Each variant has exactly five cold-cache
+samples; no sample may be discarded. The helper uses the frozen host
+liblz4/liblzma/zlib/libzstd libraries and performs real compression and full
+decode work. It contains no synthetic sleep.
+
+This is an independent host codec-cost oracle. It can prove avoided codec work
+and byte correctness, but it is not guest vnode latency evidence and must not
+be reported as such. Provider I/O, map lookup, VOP dispatch, and guest kernel
+scheduling are outside its scope.
+
+The state model preserves B32's exact key, one-owner, waiter, typed-failure,
+retry, and no-cache fallback rules. It additionally freezes mount-cache then
+global-budget lock order, reservation-before-decode accounting, codec-neutral
+work/size admission, disabled policy, global exhaustion, ready eviction,
+inflight reclaim refusal, successful reclaim, unmount drain, and key reuse.
+Reserved plus resident decoded bytes are charged to the same hard budget.
+
+G05 is GO only if the state model closes, all current/candidate hashes match,
+eviction-before/after SHA-256 matches, every candidate sample stays within the
+fixed budget, and at least two codecs improve median latency by 10 percent or
+more. Any missing sample, correctness mismatch, lifecycle gap, or budget
+overflow is STOP for P15-038 only.
+
+## Result
+
+All five current and five candidate samples are retained for each codec. The
+median current/candidate latencies and improvements are:
+
+| Codec | Current median | Candidate median | Improvement |
+|---|---:|---:|---:|
+| LZ4 | 44,988,337 ns | 6,583,335 ns | 85.367% |
+| LZMA | 7,278,779 ns | 7,286,634 ns | -0.108% |
+| Deflate | 186,791,959 ns | 6,102,297 ns | 96.733% |
+| Zstd | 20,355,035 ns | 6,236,635 ns | 69.361% |
+
+Three codecs exceed the required 10 percent threshold. LZMA is the expected
+control because both current and candidate policies admit it; its negative
+0.108 percent delta is retained and is not excluded or rewritten.
+
+Every candidate sample charges exactly 262,144 resident bytes against the
+262,144-byte mount budget. The state model reaches the 524,288-byte global
+limit with two mounts, proves a third mount's synchronous no-cache fallback,
+reclaims one reservation, retries successfully, and returns to zero bytes.
+It also passes 16-thread success and typed-failure waves, ready eviction,
+inflight reclaim refusal, key reuse, policy disable, low-work/oversize bypass,
+and unmount drain. The real Deflate decode before and after eviction has
+SHA-256 `5d3c21088380524a78c52b067d47a93117c5385464c5dfc83e8de598119511bb`.
+
+No QEMU process was started by this pre-source gate. No guest vnode latency is
+claimed. No production source, B32 correctness path, B32 QEMU runner, protected
+PID 26318, port 9222, or shared base image was touched. B33 may now execute its
+exact write set and acceptance matrix.
+
+## B33 Execution
+
+B33 source/test commit `bc56f830918b76029871b60cca2e53992de70a2e`
+implements codec-neutral decoded-work/size admission with fixed hard mount and
+global budgets, loader configuration/disable controls, four-codec accounting,
+FreeBSD `vm_lowmem` reclaim, eviction, unmount release, and synchronous
+no-cache fallback. It changes only `src/internal.h` and `src/zdata.c` in the
+production tree and preserves the B32 key/inflight/failure contract.
+
+D, authoritative H `20260816T025825Z-host-B33-cache-policy-1393732-0`, and
+FreeBSD 15 cross-KLD builds with zstdio0 and zstdio1 pass. The final H-tested
+seven-path source/test tree is byte-identical to the committed tree. Q
+TC168-cache-inflight is `INFRA_BLOCKED`: guest SSH was not ready at the exact
+absolute 300-second deadline, so no guest source, case target, KLD load, vnode
+latency, or guest PASS is claimed. Owned PID 1389807, overlay, and port 33537
+were cleaned; the protected process, port, and base metadata are unchanged.
+
+The Q attempt predates the final replacement-order and policy-bypass-accounting
+changes and did not reach the DUT. Full correspondence details and exact hashes
+are in `planning/pre15/evidence/20260816T023315Z-B33/VERDICT.md`.