update

2026-08-18 09:20:44 +02:00
commit b826cd721a
522 changed files with 93730 additions and 0 deletions
@@ -0,0 +1,95 @@
+# P15-087 Stage0 Decision
+
+Status: `STOP`. B12 is `STOP-NO-SOURCE`; no production source, B12 case, or
+B12 fixture is authorized.
+
+The final decision uses frozen DUT BASE
+`c7d692acf9166f5c5e42335db2de64f0793ba8a2`, FreeBSD source HEAD
+`106727738dcfb6c001b46f25363b91cece970085`, and
+`mkfs.erofs (erofs-utils) 1.8.6`. The final gate script and input SHA256 values
+are `349720b900ad2288153c9830f5f5ee84b8da707c06ffabcbd8e3e7a7e89f9e2a`
+and `cb3aaa6c780c7b1efbd7c339f2b2da2ed8bf38d3ba32229dc17996807fd00787`.
+
+## Workload and Independent Oracle
+
+The gate deterministically creates 18,000 long-name regular files. Since
+erofs-utils tailpacks the root directory even with `-E noinline_data`, the
+generator moves the final 1,456-byte tail into one appended contiguous block,
+changes only the root layout from flat-inline to flat-plain, increments the
+superblock block count, and recomputes CRC32C. A second generation is
+byte-identical and `fsck.erofs -d0` exits zero.
+
+The independent parser does not call DUT code. It verifies a 3,880,368-byte
+flat-plain directory at physical block 282, covering 948 contiguous 4 KiB
+blocks and 18,002 entries. Its expected final cookie is 3,880,368 and its
+record FNV64 is `427bb414efa99dc0`; the random offset is 1,937,408. The fixture
+SHA256 is `3ecc5b706dd43b734c7e14a648a2bed2fb97a9f7963d4db703d15de81dc07a9d`.
+The immutable `oracle.json` SHA256 is
+`f247bbe5029301265342ff2098fcbd463a25e4752608826cbc1126d6620ef5d6`.
+
+The generated prototype patch SHA256 is
+`33b25131a611eec9c8731e88e4c258dfc92fe5897dd6781b6c95414a846dd2d1`.
+Static extraction proves that it calls `breadn` only on the mapped backing
+`devvp`, does not call `breadn` on the EROFS directory vnode, caps the window
+at exactly 1 MiB, gates readahead on an offset-zero sequential readdir, and
+adds no VM entrypoint, vnode lock, GEOM ownership operation, `cluster_read`,
+or errno token. The `semantic-ledger.json` SHA256 is
+`d26dbc37f4f34f65d07745a1b8069217d18545436d7f16f24e775e8c2db1a6b3`.
+This closes the static design boundary but cannot replace runtime proof.
+
+## Quantitative Decision
+
+| Required G11 measurement | Required | Valid result | Decision |
+|---|---:|---:|---|
+| Cold sequential runs | 5 baseline + 5 prototype | 0 + 0 | FAIL: no median |
+| Median latency improvement | at least 10% | not measurable | FAIL |
+| Extra provider reads | at most 25% | not measurable | FAIL |
+| Readahead window | at most 1 MiB | 1 MiB static cap | PASS |
+| Random seek readahead | zero | 0 valid runtime samples | FAIL: not verified |
+| Hash/cookie equality | exact independent oracle | 0 valid runtime samples | FAIL: not verified |
+
+No run produced `runs.tsv`; therefore no latency, read-transfer, random-no-op,
+or runtime hash/cookie value is claimed. It would be dishonest to infer GO
+from the static prototype, from QEMU startup, or from build progress. Because
+the workload could not be measured credibly and repeatably, G11's explicit
+rule requires low-confidence STOP even though the 1 MiB static bound passes.
+
+## Replay Ledger
+
+The authoritative command shape was:
+
+```sh
+timeout -k 30 1200 tests/pre15/gates/P15-087.sh \
+    --base c7d692acf9166f5c5e42335db2de64f0793ba8a2 \
+    --output OWNED_OUTPUT
+```
+
+Existing evidence was retained long enough to hash and reconcile before
+repository cleanup:
+
+| Run ID | Result before any benchmark sample |
+|---|---|
+| `20260815T044720Z-G11-P15-087` | Superseded generator STOP: mkfs root remained flat-inline |
+| `20260815T044924Z-G11-P15-087` | `INFRA_BLOCKED`: 12 boot-time providers exceeded SSH deadline |
+| `20260815T045505Z-G11-P15-087` | `INFRA_BLOCKED`: FreeBSD did not enumerate PCI-hotplugged virtio-blk devices |
+| `20260815T050003Z-G11-P15-087` | `INFRA_BLOCKED`: guest benchmark declaration error |
+| `20260815T050520Z-G11-P15-087` | `INFRA_BLOCKED`: baseline KLD load did not reach workload |
+| `20260815T051933Z-G11-P15-087` | `INFRA_BLOCKED`: phased baseline KLD load did not reach workload |
+| `20260815T053543Z-G11-P15-087` | `INFRA_BLOCKED`: exact-basename baseline KLD load did not reach workload |
+| `20260815T054540Z-G11-P15-087` | Aborted on instruction; owned process group terminated and audited |
+
+Each completed QEMU ownership record reports that the owned port was free
+after cleanup, protected PID 26318 retained the same identity, protected port
+9222 was not used, and `/work/build/vm-freebsd-build.qcow2.bp` retained inode,
+size, mtime, and ctime. The interrupted run used owned PID 1172175 and port
+49845; both were absent after targeted process-group cleanup. Final process
+audit found only protected QEMU PID 26318.
+
+## Semantic and Batch Consequences
+
+Runtime preservation of FreeBSD vnode, VM, locking, GEOM, errno, hash, and
+cookie behavior was not established. Correctness may not depend on
+readahead, so static plausibility is insufficient. P15-087 is STOP for Pre15,
+B12 remains absent, and no host feature case, K0 build, TC183 QEMU acceptance,
+or full feature suite is run. Rollback is the single gate decision commit;
+there is no source commit to revert.