Scoped Segment evidence cache

The first packaged million-record query trial found correct answers but excessive latency: all 200 independent query-oracle verdicts passed, while five-page metric queries reached 10.270 seconds before restart and 8.724 seconds afterward. The registered two-second latency gate failed. That trial remains failed.

Mechanism and contract

Every scoped page reconstructed receive bounds and per-signal freshness by decoding every raw Batch in each selected Segment. Selective row walking therefore still paid a full evidence scan per page. Authentication used SHA-256 credential lookup; it was not the repeated expensive stage.

Native source commit e174fd3deb3150e93799718dac983f14be5a0142 adds a storage-owned derived summary per complete immutable Segment, keyed by Spindle label and signal. Current authorization, node and signal scope are reapplied on every read. Partial snapshots retain the exact raw path. The existing raw-file availability checks remain active, and the cache stamp covers ordinary file replacement/mutation and manifest identity. Construction rechecks the stamp before publication.

The cache admits at most 8 MiB of conservatively charged resident summaries, 1 MiB staging per serialized builder and 4,096 Segments, with FIFO eviction. These are admission estimates, not a universal process-RSS bound. A changed stamp invalidates the entry; it does not provide a retention lease. Silent corruption that preserves filesystem stamps remains outside this invalidation mechanism. No wire format, durable commit ordering or evidence authority is changed.

Registered comparison

Protocol: docs/experiments/benchmarks/scoped-evidence-protocol.md, registered in 43e5339 before measurement. Baseline native source was 0eb10c3; candidate native files match e174fd3. The retained failed trial supplied an unchanged million-row fixture and the same fixed first query of each registered shape. Each repetition opened a fresh History, then executed the five shapes including every page. Both executables were pinned to CPUs 0 and 1. This measures the native library, not TLS, admission, authentication, browser transport or concurrent ingestion.

The accepted pair is scoped-evidence-pair-02: three repetitions, fifteen complete answers per executable. Every old/new answer was identical; all fifteen candidate answers passed the unchanged independent Python query oracle. Storage hashes were unchanged. The entire contained run exited 0 in 150.097 seconds, with 2.3 GiB cgroup peak including compilation and validation, under a 6 GiB cap and no OOM events.

Shape	Baseline	Candidate	Interpretation
First cold fleet query	about 1.46 seconds	about 1.46–1.48 seconds	The first evidence scan still happens
Warm rare-text query	about 1.5 seconds	0.092–0.101 seconds	Reuses complete Segment evidence
Warm trace lookup	about 1.5 seconds	0.00195–0.00217 seconds	Selective lookup no longer hides a full raw scan
Five-page counter query	about 6.6 seconds	0.269–0.306 seconds	Pages share evidence summaries
Warm log query	about 1.34 seconds	0.059–0.065 seconds	Avoids repeated raw evidence decoding

Exact per-query values and oracle verdicts remain in the private result receipt. Baseline executable SHA-256: dd3ac592ffb352d2f005780d1ba10943c87dce5bc7e1dcb0fb19dcaa3f43c408. Candidate executable SHA-256: 5d570ca49f417575d963624fabd61e5b5f1672bc757933d32428e210f309947f.

Resource repeat and verification

scoped-evidence-resource-01 repeated the same three query sets with those exact executables under /usr/bin/time -v. All thirty answers equalled their already oracle-graded pair-02 counterparts; this repeat did not rerun the independent oracle. Baseline/candidate wall time was 38.870/6.192 seconds, user CPU 38.14/6.03 seconds and system CPU 0.53/0.12 seconds. Peak process RSS was 52,360/52,216 KiB. The contained run exited 0 in 45.406 seconds with 84.9 MiB cgroup peak and no OOM.

scoped-evidence-native-04 exited 0: five cache controls, three literal History scope/snapshot/replacement fixtures and seven console tests passed, followed by strict server all-target/all-feature Clippy. The unit ran for 23.238 seconds under 3 GiB, with 1.6 GiB peak. Earlier row-helper checks passed eight tests with one ignored; an accidentally empty console filter is recorded as zero tests, not a pass.

Counterexamples retained

scoped-evidence-pair-01 is invalid as a performance comparison: Cargo reused the baseline executable in both worktrees sharing one target. An appended assessment records identical executable hashes and rejects acceptance without rewriting the original receipt. Pair-02 cleans the package artifacts before each compilation, asserts distinct hashes and verifies that the candidate contains its new marker.

scoped-evidence-native-02 failed because its new fixture omitted an empty active journal and used group sequence as a different Spindle's Batch sequence. The fixture was corrected to represent the existing contract; expected literal answers did not change. The failed output is preserved.

Storage, cleanup and next acceptance

All scratch, binaries and evidence are under $FABRIC_DATA. The pair-02 private source worktrees were removed after preserving manifests, executables and answers. Resource-repeat output created no additional raw fixture. The original failed million-row fixture remains private for reproduction. No credentials or raw user telemetry are published on this page.

The successor Debian/RPM candidates and four fresh million-record HTTPS cells must establish the unchanged release gate with the active console, server resource limits and restart recovery. These library measurements do not qualify that gate.