Authenticate unchanged capture bodies without staging objects
Summary
Complete native rescans authenticate regular-file bytes without rebuilding and writing the same blob objects. A matching content root retains the body. Metadata changes author only the metadata update; sparse layouts persist on their first read.
Decisions
- Host stamps cannot authenticate bytes: dirty shared mappings can change content while preserving those stamps. Every byte is still read and hashed, and opened-handle validation still runs. Changed bodies are staged after verification.
- Body reuse is independent of metadata equality for single-link files. macOS can retain bodies when capture reads change access time, while preserving metadata changes. Multiple-link restrictions are unchanged.
- Arithmetic keeps scalar WorkError values until an actual failure converts them, eliminating success-path error boxes throughout regular capture and staging.
- Main's #934 build fixes arrived through a signed merge, preserving published history.
Perf-rule evidence
The frozen pre-change regular/staging implementation runs against independently initialized host roots, stores, checkouts, cancellation tokens and ledgers. Its staging and final validation do not share candidate accounting or omission hooks. The pair compares complete output bytes, exact results/errors and ordered native traces.
Ordinary successful rescans require exactly 424 physical heap requests on Linux (412 Windows), zero object bytes written, and exact hash/encoding/copy/probe/allocation-operation counts. Complete-rescan probes require exactly 301 requests on Linux and 294 Windows. Controls restore persistence, add a large-file native stat/query, or omit final validation; each fails the same combined exact-work/heap/ordered-trace oracle. Sparse properties pin exact single-read work and heap requests, with speculative verification as a negative control. Metadata-change properties compare complete bytes, results and native traces against the isolated baseline, including cancellation.
Runnable final paired commands, from the lane checkout using the coordinator's lane tooling:
& Q:/temp/pm/skip-final.ps1
& Q:/temp/pm/skip-final-windows.ps1
& Q:/temp/pm/mac-codex-wait.ps1 -Lane perf-mount-skip -Filter reuse_final
The benchmark is native_capture::rescan::(128, 80): five alternating pairs of twenty samples, plain and ACYCLIC_BENCH_TRACE=1, with independently built before/after executables and work receipts establishing reuse. Final Linux results at 9ce365d17 (median of five run medians):
| OS | Plain median before -> after | TRACE median before -> after | Heap requests plain / TRACE before -> after | CPU seconds per 23 rescans, plain / TRACE |
|---|---|---|---|---|
| Linux bb1 | 21.71 -> 19.49 ms | 39.21 -> 29.66 ms | 13,066 -> 9,226 / 16,144 -> 11,024 | 0.5107 -> 0.4596 / 0.8626 -> 0.6539 |
| Windows local | 37.87 -> 40.83 ms | 42.57 -> 36.30 ms | 12,683 -> 8,843 / 15,761 -> 10,641 | 0.890625 -> 0.953125 / 0.96875 -> 0.90625 |
| macOS ivar | queued | queued | queued | queued |
Linux per-rescan work: object bytes written 20,352 -> 0; bytes hashed 246,198 -> 122,166; bytes encoded 66,704 -> 33,680; bytes copied 566,512 -> 490,736; object probes 769 -> 513; backend reads 1,927 -> 1,671; allocation operations 12,547 -> 8,835.
Windows timing is mixed: plain before samples 37.46-45.47 ms and after 32.70-44.61 ms overlap substantially. No Windows timing win is claimed. Its work per rescan drops object bytes written 20,352 -> 0, bytes hashed 242,102 -> 118,070, bytes encoded 67,560 -> 34,536, bytes copied 547,753 -> 471,977, object probes 769 -> 513, backend reads 1,800 -> 1,544, and allocation operations 12,164 -> 8,452.
Validation
- Linux 9ce365d17: 47 native-capture tests passed in 2.18s; build 6m50s.
- Windows GNU lib/tests proof passed in 1m50s.
- Linux final paired benchmark completed successfully.
- Real Windows 9ce365d17: all 42 native-capture tests passed in 6.80s; MSVC build 23m06s.
Live steps
- Finish ivar native checks/pair. Windows native checks and the final release pair passed. macOS pending: ivar is reachable but has only about 0.5 GB free (549,876 KiB at the latest attempt), so the runner cannot begin. Only this lane's obsolete binaries/backups were deleted; no other lane's files were touched. This lane reuses only ~/mac-target/co-perf-mount and ~/pm-src; source archives have been removed.
Paused WIP: finish exact heap/work oracle validation and final Linux, Windows and macOS measurements; the current Mac correctness run is still running and cleans its own target/source on exit.