Reject exp 272 SQL UTF-8 cache expansion

[danReynolds]

Hypothesis

Saturday's exploit scan found a real but unmeasured capacity mismatch: exp 267 raised the SQL-keyed statement, schema, and row-hint caches from 32 to 128, while each isolate's native SQL UTF-8 pointer LRU remained at 32. Raising that pointer cache was eligible for implementation only if a downstream trace found repeated SQL at one-based per-isolate LRU rank 33-128 and the resulting rescued share could predict at least 3% representative wall impact.

This is the value-before-mechanism gate carried forward from the August 13 runner. A synthetic cyclic workload can exercise the mismatch, but cannot establish that representative product traffic contains the required working set.

Approach

A temporary synchronous trace point recorded the real cachedSqlUtf8 hit bit, per-isolate sequence, exact SQL identity, and UTF-8 byte length. Three Dune flow suites covering five test/database lifecycles exercised admin onboarding, message round-trip, and canvas sync/lifecycle. The temporary runtime tracer and SQL-bearing logs were removed.

The branch retains an anonymized 911-event stream and an offline analyzer. Replay validates sequence and identity integrity, computes exact one-based LRU rank independently per isolate, reproduces every real 32-entry hit, and compares capacities 32 and 128 including rescued SQL bytes.

Results

Dune flow	tests	isolate lifetimes	accesses	first-touch misses	reuse 1-32	reuse 33-128	misses at 32	misses at 128
Admin onboarding	2	10	201	191	10	0	191	191
Message round-trip	1	5	318	139	179	0	139	139
Canvas sync/lifecycle	2	10	392	265	127	0	265	265
Total	5	25	911	595	316	0	595	595

Replay matched the real hit bit on 911/911 events. All 316 repeated accesses had rank at most 32; the maximum rank was only 19. Capacity 128 therefore rescued zero misses and zero UTF-8 bytes. The message writer still used 77 unique SQL identities and the canvas writers used 79 each, demonstrating why lifetime diversity is not LRU pressure.

No implementation timing A/B followed: frequency × eligible share × per-miss saving is zero for these captured sequences. These are short deterministic JIT flows, not hours-long AOT dogfood. Spawned-peer stderr was not captured, and synchronous logging can change availability-based reader assignment; the five serialized FIFO writer sequences are routing-insensitive and independently contain zero candidate-only accesses.

Outcome

Rejected under the premise-refuted measurement escape. No library, native, hook, or public-API code ships. The cap mismatch remains mechanically real, but the measured product flows provide no allocation-avoidance opportunity.

Reopen only from a longer, lower-perturbation per-isolate trace with nonzero rank 33-128. Implement the smallest trace-supported cap only when replay plus measured conversion/free cost predicts at least 3% representative wall impact, then require at least 3% in both orders of two independent order-flipped AOT pairs, neutral controls, and bounded retained memory.

Test plan

• dart pub get
• dart run build_runner build --delete-conflicting-outputs
• dart analyze --fatal-infos
• dart test --timeout 60s --file-reporter=json:build/test-results.json (503 passed)
• dart run tool/knowledge/record_passing_tests.dart build/test-results.json
• dart run tool/knowledge/verify.dart --report --strict (67 pins)
• dart run tool/trace_sqlite_smoke.dart
• dart run benchmark/experiments/sql_utf8_cache_trace_analyze.dart benchmark/results/2026-08-15T10-22-43Z-exp272-sql-utf8-cache-events.tsv
• dart run benchmark/finalize_experiment.dart --experiment=experiments/272-sql-utf8-cache-incidence.md
• dart run benchmark/check_experiment_dispositions.dart
• dart run benchmark/check_knowledge_links.dart
• dart run benchmark/generate_knowledge_page.dart --check
• dart run tool/knowledge/impact.dart origin/main
• dart test test/api/admin_onboarding_flow_test.dart -r expanded (temporary Dune copy)
• dart test test/p2p/message_roundtrip_test.dart -r expanded (temporary Dune copy)
• dart test test/p2p/canvas_sync_test.dart -r expanded (temporary Dune copy)

[github-actions]

Belief impact

Learned

• 272.1 · Trace the SQL UTF-8 cache boundary
  Three captured downstream Dune flow traces spanning five test lifecycles produced 911 cachedSqlUtf8 accesses across 25 current-process reader/write…
• 272.2 · Trace the SQL UTF-8 cache boundary
  Lifetime SQL diversity does not establish pressure on an LRU cache. The message-round-trip writer recorded 77 unique SQL identities in 146 calls, and…
• 272.3 · Trace the SQL UTF-8 cache boundary
  The current source has a real capacity mismatch: each isolate's SQL UTF-8 native-pointer LRU is capped at 32 while the native prepared-statement cach…

What this changed

The 32-entry per-isolate cachedSqlUtf8 LRU is mechanically out of alignment with exp 267's 128-entry statement, schema and row-hint caches, but cache-cap alignment is not itself product value. Three captured downstream Dune flow traces spanning five test lifecycles recorded 911 accesses across 25 isolate lifetimes; all 316 repeats had one-based reuse rank at most 32, so replay at 128 rescued zero of 595 misses and zero SQL bytes. The implementation premise is refuted for the measured flows and no runtime cap change ships.

Total or lifetime-unique SQL is the wrong incidence measure for an isolate-local LRU. The message writer used 77 unique identities and each canvas writer used 79, yet every repeated access still fell within the 32 most recently used identities. Cold migrations and feature breadth can make a database look diverse without creating the reusable 33-128 working set this candidate needs.

Claim 267.1 remains live: a genuinely cyclic working set beyond the adjacent statement-cache cap has a sharp performance cliff. For the UTF-8 pointer cache it supplies an eligible workload, not a measured per-miss saving. Shipping this separate capacity raise requires per-isolate reuse-rank incidence, measured conversion/free cost and aggregate representative impact.

The premise-refuted measurement escape applies before an implementation A/B when the trace makes the candidate mechanically inert. With zero rescued accesses, operation frequency times eligible share times per-hit saving is zero; timing a 100%-eligible synthetic cycle would not repair the missing product-value term.