4.0 KiB
P15-022 Stage0 Decision
Status: GO. B19a source is authorized.
P15-022 is the G03/G05 xattr-cache candidate. The old decision was not treated as terminal because its multi-block path parser stopped before producing a P15-022 result and G05 had zero samples. The repaired gate completed both mandatory branches before source implementation.
Frozen Identity
The replay base is 50a4e84d0da33592a81361e0294b7feb5bbd3ffa.
P15-022-input.json freezes the current DUT/Linux source, exact-ABI FreeBSD
source /work/dev-freebsd-releng at
106727738dcfb6c001b46f25363b91cece970085, host tools, B17 assets, B19a
generator/oracle/model assets, a 1 MiB mount budget, a 64 KiB per-vnode body
limit, 64 workers, five samples per variant, and the unchanged 25 percent
provider-metadata-read threshold.
Oracle Repair And G03
The B19a oracle now reads every logical directory block, including a short final block, and validates name offsets, embedded NUL rules, strict in-block ordering, strict adjacent-block ordering, stable entry order, duplicate resolution, and missing-path classification. Its self-controls cover target lookup after a block boundary, duplicate within/across blocks, duplicate resolution, missing target, backwards boundary, and an invalid name range.
The real fixture retains 64 long-named peers and one target. It has 2 root
directory blocks, 68 entries, and resolves target.bin in block 1 after the
peer-047/peer-048 boundary. The target contains both one inline xattr and
one shared xattr. Valid, corrupt shared-count, corrupt shared-ID, and corrupt
inline-name fixtures are independently checked with positive FreeBSD errno.
G03 completed twice on byte-reproducible images. The existing B17 oracle also
replayed twice with all 10 legal and 15 damaged images passing and frozen
fixture-set SHA256
d821aeb36de37ae40b817b91f8169e585721c33a3a9e59098cdfbcbfff74e364.
G05 Result
The same image, host, operations, warmup, loops, and sample order were used for
both variants. Five raw samples per variant are retained; no failed sample was
filtered. Baseline provider metadata reads were
1400,1400,1400,1400,1400; candidate reads were
800,800,800,800,800. Median reduction is 42.857142857142854% for both
instrumented calls and provider block reads, above the unchanged 25.0% gate.
The focused cache model passes 64-worker one-owner publication, identical
waiter bytes and typed failure, failed initialization without a half-published
body, the 64 KiB entry limit, exact 1 MiB budget exhaustion fallback, invalidation,
inflight close, reclaim, and zero resident bytes after cleanup. The decision
is GO; source modification is now authorized only within the B19a write set.
Evidence And Scope
Evidence is retained under
planning/pre15/evidence/20260817T171814Z-B19a/. GATE-attempt1 preserves the
runner failure caused by the missing sample directory. GATE-attempt2 is the
authoritative GO replay with raw fixtures, oracle reports, cache-model output,
sample JSON, aggregate TSV, commands, and cleanup manifest.
The authorized source/test write set is:
repo-pre-15/src/erofs_vnops.c
repo-pre-15/src/inode.c
repo-pre-15/src/internal.h
repo-pre-15/src/xattr.c
repo-pre-15/tests/pre15/cases/B19a-xattr-cache.sh
repo-pre-15/tests/pre15/fixtures/B19a-*
No QEMU or production source was touched by this Stage0 gate. B36 and all other execution units remain out of scope.
B19a Acceptance Addendum
B19a subsequently implemented the authorized per-vnode xattr body/shared-ID
cache within the declared write set. The focused FreeBSD 15.0-RELEASE-p8
exact-ABI run passed first, concurrent, and repeated xattr reads; symmetric
EINTEGRITY results for all three damaged images; normal and forced unmount;
cache invalidation and reclaim; KLD unload; guest mount/md cleanup; target and
runner cleanup; and an empty dmesg delta. The runner retained the original
1200-second case deadline, focused command timeouts, 64 KiB body limit, 1 MiB
mount budget, and 25 percent G05 threshold. The final evidence is under
planning/pre15/evidence/20260817T193130Z-B19a-final/.