whitepaper: 352/169 — wave4 MEDIUM (hadoop/hbase/nova/neutron/openstack) + fix odl-0002 dup

defects/wasmer/patch/wasmer-0001.patch

@@ -0,0 +1,59 @@
+--- a/lib/virtual-net/src/ruleset.rs
++++ b/lib/virtual-net/src/ruleset.rs
+@@ -666,7 +666,14 @@ pub enum Rule {
+ /// control the inbound and outbound traffic of a network.
+ #[derive(Debug, Clone)]
+ pub struct Ruleset {
+-    rules: Arc<RwLock<Vec<Rule>>>,
++    /// All rules — kept for iteration order and serialization.
++    rules: Arc<RwLock<Vec<Rule>>>,
++    /// Pre-partitioned views for O(1) dispatch:
++    /// IP rules (IPV4/IPV6/Neg(IP)) — consulted by allows_socket/blocks_socket.
++    ip_rules: Arc<RwLock<Vec<Rule>>>,
++    /// DNS rules (DNS/Neg(DNS)) — consulted by allows_domain/blocks_domain.
++    dns_rules: Arc<RwLock<Vec<Rule>>>,
+ }
+
++impl Ruleset {
++    fn add_rule_internal(
++        rules: &mut Vec<Rule>,
++        ip_rules: &mut Vec<Rule>,
++        dns_rules: &mut Vec<Rule>,
++        rule: Rule,
++    ) {
++        match &rule {
++            Rule::DNS(_) => dns_rules.push(rule.clone()),
++            Rule::Neg(inner) => match inner.as_ref() {
++                Rule::DNS(_) => dns_rules.push(rule.clone()),
++                _ => ip_rules.push(rule.clone()),
++            },
++            _ => ip_rules.push(rule.clone()),
++        }
++        rules.push(rule);
++    }
++}
++
+ impl Ruleset {
+     /// Returns `true` if at least one rule allows accessing `socket_addr` in the specific `direction`
+     /// and no rule blocks it
+     pub fn allows_socket(&self, addr: impl Into<SocketAddr>, dir: Direction) -> bool {
+         let addr = addr.into();
+
+         {
+-            let ruleset = self.rules.read().unwrap();
++            // Only IP rules are relevant for socket checks — skip DNS rules entirely.
++            let ruleset = self.ip_rules.read().unwrap();
+
+             let is_blacklisted = ruleset.iter().any(|r| r.blocks_socket(addr, dir));
+             if is_blacklisted {
+@@ -695,7 +702,8 @@ impl Ruleset {
+     pub fn allows_domain(&self, domain: impl AsRef<str>) -> bool {
+         let domain = domain.as_ref();
+
+         {
+-            let ruleset = self.rules.read().unwrap();
++            // Only DNS rules are relevant for domain checks — skip IP rules entirely.
++            let ruleset = self.dns_rules.read().unwrap();
+
+             let is_blacklisted = ruleset.iter().any(|r| r.blocks_domain(domain));
+             if is_blacklisted {

defects/wasmer/patch/wasmer-0002.patch

@@ -0,0 +1,56 @@
+--- a/lib/wasix/src/os/task/thread.rs
++++ b/lib/wasix/src/os/task/thread.rs
+@@ -238,7 +238,9 @@ pub struct WasiThreadInner {
+     pub(crate) status: Arc<OwnedTaskStatus>,
+     /// Signals are used to indicate certain states to the thread
+-    signals: Mutex<(Vec<Signal>, Vec<Waker>)>,
++    /// Using a u64 bitmask instead of Vec<Signal> — Signal values are 1..=31,
++    /// so bit N represents signal N. O(1) insert, O(1) contains, O(1) test.
++    signals: Mutex<(u64, Vec<Waker>)>,
+ }
+
+@@ -268,7 +270,7 @@ impl WasiThreadInner {
+             status: Arc::new(OwnedTaskStatus::new(TaskStatus::Pending)),
+-            signals: Mutex::new((Vec::new(), Vec::new())),
++            signals: Mutex::new((0u64, Vec::new())),
+         }
+     }
+
+@@ -345,10 +347,8 @@ impl WasiThread {
+         let mut guard = self.state.signals.lock().unwrap();
+-        if !guard.0.contains(&signal) {
+-            guard.0.push(signal);
+-        }
++        // Set bit for this signal — O(1) insert with automatic dedup
++        guard.0 |= 1u64 << (signal as u32);
+         guard.1.drain(..).for_each(|w| w.wake());
+     }
+
+@@ -358,10 +358,10 @@ impl WasiThread {
+     pub fn has_signal(&self, signals: &[Signal]) -> bool {
+         let guard = self.state.signals.lock().unwrap();
+-        for s in guard.0.iter() {
+-            if signals.contains(s) {
+-                return true;
+-            }
+-        }
+-        false
++        // Build query bitmask in O(|signals|), then AND in O(1)
++        let query_mask: u64 = signals.iter().fold(0u64, |m, s| m | (1u64 << (*s as u32)));
++        guard.0 & query_mask != 0
+     }
+
+@@ -390,7 +390,7 @@ impl WasiThread {
+     pub fn pop_signals_or_subscribe(&self, waker: &Waker) -> Option<Vec<Signal>> {
+         let mut guard = self.state.signals.lock().unwrap();
+-        if guard.0.is_empty() {
++        if guard.0 == 0 {
+             // ...
+         }
+         // Convert bitmask back to Vec<Signal> for consumption
+-        Some(std::mem::take(&mut guard.0))
++        let mask = std::mem::replace(&mut guard.0, 0u64);
++        Some((0u32..64).filter(|b| mask & (1u64 << b) != 0)
++            .filter_map(|b| Signal::try_from(b as i32).ok())
++            .collect())
+     }