Problem
SharedDomains can stage a speculative unwind without committing it. A CommitmentDomain read that falls through with a step bound can still populate the aggregator-scoped BranchCache after BranchCache.Unwind has advanced its epoch and floor.
The restored value is inserted under the new epoch and can carry a transaction number below the unwind floor. If validation is abandoned or the unwind is not committed, durable state remains on the original canonical branch, but a later canonical reader can receive the speculative restored branch from BranchCache.
This behavior exists on main and is independent of #23005. That PR rejects bounded fills into StateCache; the sibling BranchCache fill remains unconditional.
Proposed direction
Reject BranchCache population when the read is constrained by a staged-unwind bound, or represent equivalent fill authority in the cache API. Skipping the fill is the simplest safe starting point because the committed publication path can populate authoritative branches after a successful unwind.
Acceptance criteria
- Add a red regression test on
main that stages an unwind, performs a bounded commitment read, abandons the speculative state, and proves that a canonical reader cannot receive the restored value from BranchCache.
- Keep branch-cache population for unbounded committed-state reads.
- Verify both successful-unwind and abandoned-validation paths.
- Run the affected cache and execution tests under the race detector.
Problem
SharedDomainscan stage a speculative unwind without committing it. ACommitmentDomainread that falls through with a step bound can still populate the aggregator-scopedBranchCacheafterBranchCache.Unwindhas advanced its epoch and floor.The restored value is inserted under the new epoch and can carry a transaction number below the unwind floor. If validation is abandoned or the unwind is not committed, durable state remains on the original canonical branch, but a later canonical reader can receive the speculative restored branch from
BranchCache.This behavior exists on
mainand is independent of #23005. That PR rejects bounded fills intoStateCache; the siblingBranchCachefill remains unconditional.Proposed direction
Reject
BranchCachepopulation when the read is constrained by a staged-unwind bound, or represent equivalent fill authority in the cache API. Skipping the fill is the simplest safe starting point because the committed publication path can populate authoritative branches after a successful unwind.Acceptance criteria
mainthat stages an unwind, performs a bounded commitment read, abandons the speculative state, and proves that a canonical reader cannot receive the restored value fromBranchCache.