# Pre8 Completion and Validation

## Final Verdict

Pre8 overall status is **FAIL**.

The required implementation, static review, revert review, build matrix, basic
plain/LZ4 smoke, and selected test suite were all executed. The selected suite
did not pass its required gate. In particular, TC004 produced a definite DUT
failure while twelve other DUT verdicts were blocked by test-harness defects or
prior test residue. Under the status definition in `planning/pre8`, a required
action that ran and failed a gate is `FAIL`, not `PASS` or `PARTIAL`.

This overall verdict does not erase the narrower successful results:

| Validation layer | Verdict | Scope |
| --- | --- | --- |
| Source implementation | PASS | Planned loader placement and xattr iterator work is present in the final source tree. |
| Static source review | PASS | Allowlist, token-equivalence, references, xattr invariants, and protected paths passed review. |
| Revert and history review | PASS | Accepted replacement commits passed their defined direct-parent and final-HEAD checks; historical failures remain disclosed. |
| Four build configurations | PASS | `default`, `debug`, `zstdio0`, and `zstdio1` built and passed module load/unload smoke. |
| Basic plain/LZ4 smoke | PASS | Independent run `20260812T210345.913633Z-770842-a2868dd9`. |
| Selected 19-case suite | FAIL | Automation: 5 PASS / 9 FAIL / 4 ERROR / 1 NOT_RUN. Audited DUT: 6 PASS / 1 FAIL / 12 BLOCKED. |
| Pre8 overall | **FAIL** | A required selected-suite gate ran and failed. |

No claim is made that Pre8, repo22, the LZMA issue, or the test harness was
fixed by this validation work.

## Final DUT Identity

The final repository identity used by both selected-suite and basic-smoke
evidence is:

```text
parent repository commit: d1f5b686e8945d06b6e8c0a0188b2262de0b4ac2
parent repository tree:   19f450085cad49d06f6fe05d180313f13d4347f0
repo-pre-8 tree:           497736695fcc4285760b24c5954c34d32b8af49f
repo-pre-8/src tree:       cbf93a19df8d1ce2fb66e2aeb7276a4ea6d4dcc2
```

Selected-suite DUT archive:

```text
bbcfd8a6a28faba3f7c5c7e827bde5578774be6e08b83d05485d58ee16a7fb6f
```

Basic-smoke DUT archive:

```text
402459ba6a6f55696d06474f7494a69ef1a5fe49063d565cacadece37e8b9ce1
```

The different archive hashes belong to different runners and archive
procedures. Both reports bind their run to the same final repository commit
and `repo-pre-8/src` tree.

## Source Delivery

### Accepted implementation

The final accepted source changes are:

1. `3d28d96fc48753231b1899fce6189e586cf988c6`
   (`erofs: unify inline and shared xattr iteration`)
2. `aac1412056f9ae7269f7c0f85c0233ade8cc662a`
   (`erofs: move codec config loaders atomically`)

The xattr commit introduces common private inline/shared iteration while
preserving the reviewed lookup order, list order, namespace and errno timing,
inline/shared validation differences, buffer ownership, and output accounting.

The atomic loader replacement moves the LZMA, DEFLATE, and ZSTD configuration
loaders to their backend files. The loader bodies remain token-equivalent to
the baseline, dispatch calls remain in the core, decode functions are not
changed, and no Linux page/folio or descriptor ABI was introduced.

### Superseded split-loader history

The following pushed commits remain in history and must not be described as
accepted independent delivery units:

| Commit | Historical final-HEAD inverse result | Final disposition |
| --- | --- | --- |
| `dd7f2483d468ec4397a863c7a871391ea1bc2c4c` | FAIL: conflict in `decompressor.c`; `internal.h` auto-merged as staged content | Superseded by `aac1412`; failure permanently retained. |
| `0dba0ea223bee8626b8cd3371562f87ed975a99f` | FAIL: conflict in `decompressor.c`; `internal.h` auto-merged as staged content | Superseded by `aac1412`; failure permanently retained. |
| `7c47f6d` | PASS | Superseded with the split-loader group by `aac1412`. |

All three split commits passed direct-parent restoration at the point where
they were introduced. That fact does not overwrite the two final-HEAD inverse
failures. The split group was reverted by `96f041f`, then replayed as the one
accepted atomic commit `aac1412`. Commit `3d28d96` was not superseded.

### Static and revert verdict

Final static and revert status is **PASS**:

- the implementation remained within the planned source allowlist;
- protected trees and unrelated paths were unchanged;
- all three moved loader bodies matched their baseline implementations;
- declaration, definition, and dispatch-call closure was correct;
- the ZSTD availability and `windowlog > 10` rejection order was preserved;
- codec decode bodies were unchanged;
- the xattr iterator behavior and ownership matrix passed independent review;
- `aac1412` restored its direct parent exactly when reverted;
- `aac1412` independently reverted from final HEAD without changing xattr;
- `3d28d96` independently reverted from final HEAD without changing the
  accepted loader layout;
- final `repo-pre-8/src` matched the reviewed functional source tree;
- `git diff --check` and worktree cleanliness checks passed at static handoff.

The detailed history record is
`repo-pre-8/docs/pre8-loader-history-correction.md`.

## Build Validation

The selected-suite runner built four module configurations. Every
configuration passed build completion, SHA256 recording, unresolved-symbol
checks, and an actual `kldload`/`kldunload` smoke before case execution.

| Configuration | Verdict | SHA256 | Size |
| --- | --- | --- | --- |
| `default` | PASS | `348cb1f5a91d47e1412747d285c795c49375a61a66cfb3d35d22f38ecfde6ea0` | 47,272 bytes |
| `debug` | PASS | `274189804511d249b34fbb3c223e9525b07c7c6266ec39d016ad2f33185001c7` | **UNKNOWN**; the harness did not persist size evidence before VM destruction |
| `zstdio0` | PASS | `348cb1f5a91d47e1412747d285c795c49375a61a66cfb3d35d22f38ecfde6ea0` | 47,272 bytes; byte-identical to `default` |
| `zstdio1` | PASS | `6cdb8e01fdac7805cb7ae12a9d1804b00d3e5cf37ef8b2f583137d36ee70426e` | 51,368 bytes |

The missing debug size is not reconstructed or inferred. No KLD or other
binary was committed.

## Basic Plain/LZ4 Smoke

Independent basic smoke run:

```text
run ID:        20260812T210345.913633Z-770842-a2868dd9
automation:    PASS
runner exit:   0
DUT result:    PASS for plain and LZ4 basic differential scope
guest:         FreeBSD 15.0-RELEASE-p8 amd64
KLD SHA256:    527fe80ad7307d0200cfc4fec84c6fb86b914e89889e4a42ff0613fc24465015
KLD size:      47,272 bytes
```

All twelve runner stages passed. The run created a deterministic corpus with
256 regular files, 9 symlinks, and 43 directories. Both the plain and LZ4
images mounted read-only, passed a 307-entry differential preflight, completed
all four workers, and unmounted cleanly. The test QEMU exited gracefully, its
overlay and large temporary data were removed, and ports 10000 and 10001 were
released.

This result covers only plain/LZ4 basic mount, traversal, read, differential,
unmount, and cleanup behavior. It does not override the selected-suite
failures or blocked verdicts.

Evidence:

- `/work/tests-dev/erofsstress/demo-result/repo-pre-8-smoke-20260812/20260812T210345.913633Z-770842-a2868dd9/audit-report.md`
- `/work/tests-dev/erofsstress/demo-result/repo-pre-8-smoke-20260812/20260812T210345.913633Z-770842-a2868dd9/result.json`
- tests-dev commit `374b8e3ab4b0df24d6761802b70c694e2896d5fd`

## Selected Suite

Primary run:

```text
run ID:      pre8-required-20260812T194817Z
cases:       19
automation:  5 PASS / 9 FAIL / 4 ERROR / 1 NOT_RUN
runner exit: 3
duration:    1892.44 seconds
audited DUT: 6 PASS / 1 FAIL / 12 BLOCKED
```

The automation status is the runner's result. The DUT status is a separate
evidence audit. An automation failure caused by a harness defect is not changed
to automation PASS. Likewise, a positive command observed before a missing
negative check does not make the full DUT case PASS.

### Per-case matrix

| Case | Automation | DUT | Audited observation |
| --- | --- | --- | --- |
| TC005 | FAIL | BLOCKED | Inline listing and both requested user xattr values succeeded. The missing-xattr `ENOATTR` assertion was never invoked because the truss output directory did not exist. |
| TC013 | PASS | PASS | Invalid NID returned `EINTEGRITY` (`ERR#97`) twice; mount, unmount, and zero-state checks passed. |
| TC079 | PASS | PASS | Packed user and trusted prefix values matched expected data and cleanup passed. |
| TC080 | FAIL | BLOCKED | Four packed-prefix values were correct. The missing-suffix `ENOATTR` assertion was not invoked because the truss output directory was absent. |
| TC082 | FAIL | BLOCKED | ACL bytes and ordering were observed, but automation compared spaced hex against an unspaced prefix; the user-namespace negative assertion also was not invoked. |
| TC067 | FAIL | PASS | Both shared files, the local xattr, and listing matched the fixture. Automation incorrectly expected one additional trailing `!`. |
| TC068 | FAIL | BLOCKED | Shared listing succeeded. The nonexistent lookup was not invoked because truss could not create its output file. |
| TC069 | PASS | PASS | Three shared xattrs were listed and all exact values were read; cleanup passed. |
| TC081 | PASS | PASS | Metabox shared, shared-prefix, and packed-prefix xattrs were listed and read from both files; cleanup passed. |
| TC117 | FAIL | BLOCKED | Both corrupt fixtures mounted and valid local shared data remained readable. Corrupt-entry errno assertions were not invoked because truss failed first. |
| TC135 | PASS | PASS | Metabox, packed, and primary-prefix fallback values matched expected data. |
| TC138 | FAIL | BLOCKED | Valid unordered and empty-header ACLs were read. Three malformed ACL assertions were not invoked because the scratch directory was absent. |
| TC140 | FAIL | BLOCKED | Positive compressed and fragment metabox carrier hashes and xattrs passed. Four negative mount commands were not invoked because truss failed opening its trace. |
| TC142 | FAIL | BLOCKED | Positive fragment-backed compressed metabox hash and xattrs passed. Four negative mount commands were not invoked for the same reason. |
| TC004 | ERROR | **FAIL** | LZMA image mounted, but SHA256 of the mounted 8 MiB `level.dat` timed out after 30 seconds. The process remained running and left the mount and `md0` busy. |
| TC084 | ERROR; follow-up FAIL | BLOCKED | Primary run was contaminated by TC004 residue. Fresh follow-up mounted LZ4 and found the target, but guest `dump.erofs` was absent before content verification. |
| TC102 | ERROR; follow-up FAIL | BLOCKED | Primary run was contaminated by TC004 residue. Fresh follow-up mounted DEFLATE, but missing guest `dump.erofs` prevented algorithm and content verification. |
| TC105 | ERROR; follow-up FAIL | BLOCKED | Primary run was contaminated by TC004 residue. Fresh follow-up mounted ZSTD with `zstdio1`, but missing guest `dump.erofs` prevented verification. |
| TC145 | NOT_RUN; follow-up ERROR | BLOCKED | Both zstdio modules built and initial load smoke passed. The follow-up queried and unloaded module name `erofs` instead of the loaded artifact name, so functional mount/read gates were not reached. |

### Definite DUT failure

TC004 is a definite observed DUT failure for this test run:

1. `lzma-level6.erofs` attached as `md0`.
2. The read-only EROFS mount succeeded.
3. The mounted `level.dat` existed.
4. SHA256 of the source file completed and returned
   `ddda39737f0f6093e828a032ec161511fefbb1fa361bc6cbffdbc91e48e4c461`.
5. SHA256 of the mounted 8 MiB file did not finish within 30 seconds.
6. The timed-out `sha256` process remained alive.
7. Unmount and `mdconfig -d` returned `Device busy`.

This evidence does **not** prove that Pre8 introduced the problem. No matching
Pre7 or pre-change comparison run with the same image, guest, module build,
and command is available. The issue is recorded separately in
`issues/pre8-lzma-read-timeout.md` without an attribution claim.

### Codec follow-up

Fresh follow-up run:

```text
run ID:      pre8-codec-followup-20260812T202059Z
cases:       TC084, TC102, TC105, TC145
automation:  3 FAIL / 1 ERROR
runner exit: 1
duration:    1136.92 seconds
audited DUT: 4 BLOCKED
```

The follow-up isolated these cases from TC004 residue, but it did not produce
codec functional PASS verdicts. TC084, TC102, and TC105 were blocked by absent
guest `dump.erofs`. TC145 was blocked by incorrect module-name lookup/unload
and cleanup behavior in the harness. These results remain FAIL/ERROR in
automation and BLOCKED for the DUT.

The harness findings are recorded in
`issues/pre8-test-harness-blockers.md`. No harness modification is part of
Pre8 source delivery.

Selected-suite evidence:

- `/work/tests-dev/demo-result/repo-pre-8-smoke-20260812/summary.md`
- `/work/tests-dev/demo-result/repo-pre-8-smoke-20260812/summary.json`
- `/work/tests-dev/demo-result/repo-pre-8-smoke-20260812/pre8-required-20260812T194817Z/summary.json`
- `/work/tests-dev/demo-result/repo-pre-8-smoke-20260812/pre8-required-20260812T194817Z/evidence/`
- `/work/tests-dev/demo-result/repo-pre-8-smoke-20260812/pre8-codec-followup-20260812T202059Z/summary.json`
- `/work/tests-dev/demo-result/repo-pre-8-smoke-20260812/pre8-codec-followup-20260812T202059Z/evidence/`
- tests-dev commit `46e6840f1b8918414af76c9a5731322c697eee8b`

## Fixtures and Immutable Inputs

The common base image was not modified:

```text
path:   /work/tests-dev/lfs/freebsd-15-dev-src-20260811.bp
format: qcow2
mode:   0444
size:   16,515,530,752 bytes
SHA256: 67f359621f23a1d745f0889370cbb99a096cee3e99a0b2f3bb18fc7a91bf6fef
```

Selected primary fixture deployment identities:

| Group | Manifest SHA256 | Checksum-list SHA256 |
| --- | --- | --- |
| G1 | `9ffe9e695a6544cb010a5d4ba1e0c2c09d7455e6d7e28cc81da54d2dd954f2f2` | `db416004ff6b00ad286e50da506168b35a544a7da5619042225198843e4c741c` |
| G4 | `6200842757dae30f3a5b0683d726d339a24e55dff98cd084597462289a9308aa` | `229c84c5436cf9b5b659ded375097fba13621c20a2cf2d845f146df737836622` |
| G5 | `c9540baafb53b3783233c3950f4d8548c28585cd32335dadc14db613692a8978` | `d08138b1bd51579cbf5461a73abce9d7fddc9cdb8ace1329c9f1581d41e1095f` |

Follow-up G5 deployment identities:

```text
manifest:      9be85e48115f2dd2cae058f2a4ea7438512f28e647c30476d049d6b8025b02fd
checksum list: 7513425c98400f641523083bf0d06b2d548aa3163dfcdfe980dca2b0e1900acd
```

Deployment hashes can include run-specific metadata. Image, source, generator,
and checksum evidence remains beneath each run's `fixture-evidence/` and
per-case evidence directories.

## Cleanup and Guard Integrity

- The selected primary and follow-up QEMUs were force-destroyed by the runner
  after their final errors.
- Their run-owned overlays were deleted.
- Ports 10000 and 10001 were released and closed.
- The independent basic-smoke QEMU shut down gracefully and its overlay was
  removed.
- Guard PID 26318 retained its identity and TCP port 9222 remained active.
- Base-image SHA256, mode, and size were unchanged before and after the runs.
- The DUT commit and source tree remained unchanged and clean.
- No DUT source, repo22 source, base image, test source, fixture generator, or
  `oldtests` content was modified during validation.

Cleanup of the disposable VM does not change TC004's case-level cleanup result:
the case itself failed to terminate its read process and could not unmount or
detach `md0`. VM destruction only removed the run environment afterward.

## Final Handoff

Pre8 delivers the planned source-responsibility changes and passes static,
revert, build, and basic plain/LZ4 smoke validation. It does not satisfy the
full required validation gate because the selected suite contains one definite
DUT failure and twelve blocked DUT cases. The honest final status is therefore
**FAIL**.

Open follow-up records:

- `issues/pre8-lzma-read-timeout.md`
- `issues/pre8-test-harness-blockers.md`