erofs-freebsd-out-tree/docs/pre15-stage0/P15-038.md

P15-038 Stage0 Decision

Status: GO. B33 is authorized.

The authoritative frozen-BASE run is planning/pre15/evidence/20260816T021736Z-G05-P15-038/ against 5d6755649a369498a9b257bb2d1d1e3496d5135e. Its state model, hard-budget accounting, real codec oracle, eviction check, and owned cleanup all pass.

The gate compares the current LZMA-only admission policy with a test-only, codec-neutral single-entry decoded cache. Both variants execute the same 1,024 deterministic random 4 KiB logical reads against the same 256 KiB payload for each of LZ4, LZMA, Deflate, and Zstd. Each variant has exactly five cold-cache samples; no sample may be discarded. The helper uses the frozen host liblz4/liblzma/zlib/libzstd libraries and performs real compression and full decode work. It contains no synthetic sleep.

This is an independent host codec-cost oracle. It can prove avoided codec work and byte correctness, but it is not guest vnode latency evidence and must not be reported as such. Provider I/O, map lookup, VOP dispatch, and guest kernel scheduling are outside its scope.

The state model preserves B32's exact key, one-owner, waiter, typed-failure, retry, and no-cache fallback rules. It additionally freezes mount-cache then global-budget lock order, reservation-before-decode accounting, codec-neutral work/size admission, disabled policy, global exhaustion, ready eviction, inflight reclaim refusal, successful reclaim, unmount drain, and key reuse. Reserved plus resident decoded bytes are charged to the same hard budget.

G05 is GO only if the state model closes, all current/candidate hashes match, eviction-before/after SHA-256 matches, every candidate sample stays within the fixed budget, and at least two codecs improve median latency by 10 percent or more. Any missing sample, correctness mismatch, lifecycle gap, or budget overflow is STOP for P15-038 only.

Result

All five current and five candidate samples are retained for each codec. The median current/candidate latencies and improvements are:

Codec	Current median	Candidate median	Improvement
LZ4	44,988,337 ns	6,583,335 ns	85.367%
LZMA	7,278,779 ns	7,286,634 ns	-0.108%
Deflate	186,791,959 ns	6,102,297 ns	96.733%
Zstd	20,355,035 ns	6,236,635 ns	69.361%

Three codecs exceed the required 10 percent threshold. LZMA is the expected control because both current and candidate policies admit it; its negative 0.108 percent delta is retained and is not excluded or rewritten.

Every candidate sample charges exactly 262,144 resident bytes against the 262,144-byte mount budget. The state model reaches the 524,288-byte global limit with two mounts, proves a third mount's synchronous no-cache fallback, reclaims one reservation, retries successfully, and returns to zero bytes. It also passes 16-thread success and typed-failure waves, ready eviction, inflight reclaim refusal, key reuse, policy disable, low-work/oversize bypass, and unmount drain. The real Deflate decode before and after eviction has SHA-256 5d3c21088380524a78c52b067d47a93117c5385464c5dfc83e8de598119511bb.

No QEMU process was started by this pre-source gate. No guest vnode latency is claimed. No production source, B32 correctness path, B32 QEMU runner, protected PID 26318, port 9222, or shared base image was touched. B33 may now execute its exact write set and acceptance matrix.

B33 Execution

B33 source/test commit bc56f830918b76029871b60cca2e53992de70a2e implements codec-neutral decoded-work/size admission with fixed hard mount and global budgets, loader configuration/disable controls, four-codec accounting, FreeBSD vm_lowmem reclaim, eviction, unmount release, and synchronous no-cache fallback. It changes only src/internal.h and src/zdata.c in the production tree and preserves the B32 key/inflight/failure contract.

D, authoritative H 20260816T025825Z-host-B33-cache-policy-1393732-0, and FreeBSD 15 cross-KLD builds with zstdio0 and zstdio1 pass. The final H-tested seven-path source/test tree is byte-identical to the committed tree. Q TC168-cache-inflight is INFRA_BLOCKED: guest SSH was not ready at the exact absolute 300-second deadline, so no guest source, case target, KLD load, vnode latency, or guest PASS is claimed. Owned PID 1389807, overlay, and port 33537 were cleaned; the protected process, port, and base metadata are unchanged.

The Q attempt predates the final replacement-order and policy-bypass-accounting changes and did not reach the DUT. Full correspondence details and exact hashes are in planning/pre15/evidence/20260816T023315Z-B33/VERDICT.md.