Skip to content

Plans index

This page summarises every planning document in chronological order. Master plans decompose work into numbered phases, each with its own detailed plan file. Standalone plans track issues, follow-ups, or design decisions that do not require phased execution.

New plans should follow the structure in PLAN-TEMPLATE.md at the repo root. For pre-push audits of our own work see PUSH-AUDIT.md (also at the repo root).

Master plans

Date Plan Intent Status Phases
2026-05-08 Distro matrix CI Run instar's full functional test suite against installed .deb/.rpm packages on a representative matrix of Linux distributions in the GitHub merge queue, with qemu-img differential coverage Complete 1: glibc build split, 2: qemu profiles, 2b: qemu output parity, 3: runner, 4: workflow, 5: merge queue
2026-05-09 Release v0.2.0 Cut the v0.2.0 tag and publish signed GitHub Release artifacts (tarball, .deb, .rpm) for x86_64 Linux Complete (no phase files; sequential gates)
2026-05-10 First public release of instar Cargo.toml metadata, release workflow, .deb/.rpm packaging, and signing for instar's public releases (umbrella plan; v0.2.0 execution lives in PLAN-release-v0.2.md) Complete (phases inline)
2026-05-10 Security audit Sweep instar for security weaknesses across the host VMM, KVM guest, call-table boundary, and format parsers, including coverage-guided fuzzing Complete (phases inline)
2026-05-10 Coverage-guided fuzzing Stand up coverage-guided fuzzing across the format parsers and run sustained campaigns Complete (phases inline)
2026-05-10 Fuzz autofix workflow Built a workflow that triaged fuzzer-discovered crashes and proposed fixes, then measured it and withdrew it: 60 runs produced one pull request, the stager's safety boundary did not hold and could be rewritten by what it constrained, and its orchestration could not be tested. The machinery is deleted; the crash reporting half is kept, and fixes go back to interactive sessions Complete 1: trailer and end-to-end proof, 2: push audit and retirement
2026-05-10 Convert follow-ups Track the deferred work from the (now-removed) convert master plan: extra qemu-img subcommands (create / map / measure / resize / snapshot / rebase / commit) and check --repair wiring Complete 1: subcommand parity, 2: check --repair
2026-05-10 instar measure subcommand Implement the measure subcommand (qemu-img parity for raw and qcow2 outputs; instar extensions for vmdk / vhd / vhdx) with cross-version baselines, integration tests, coverage-guided fuzzing, and differential fuzzing Complete 1: calculators, 2: allocation scanners, 3: guest op, 4: host CLI, 5: target options, 6: baselines, 7: integration tests, 8: coverage fuzz, 9: differential fuzz, 10: docs
2026-05-16 instar create subcommand Implement the create subcommand (qemu-img parity for raw / qcow2 / vmdk monolithicSparse / vhd / vhdx outputs, with backing-file support, preallocation modes, cross-version info-equivalence baselines, integration tests, coverage-guided fuzzing, and differential fuzzing) Complete 1: emitters, 2: guest op, 3: host CLI, 4: target options, 5: backing file, 6: preallocation, 7: baselines, 8: integration tests, 9: coverage fuzz, 10: differential fuzz, 11: docs
2026-05-20 instar resize subcommand Implement the resize subcommand (qemu-img parity for raw / qcow2 / vmdk monolithicSparse / vhd dynamic+fixed / vhdx dynamic, including --shrink for raw and qcow2, --preallocation modes, the [+-]SIZE syntax, a new read_output_sector call-table primitive, cross-version info-equivalence baselines, integration tests, coverage-guided fuzzing, and differential fuzzing) Complete 1: skeleton, 2: qcow2 grow, 3: qcow2 shrink, 4: vhd, 5: vhdx, 6: vmdk, 7: guest op, 8: host CLI, 9: preallocation, 10: baselines, 11: integration tests, 12: fuzz, 13: docs
2026-05-25 resize followup-01: targeted refcount pre-pass Lift the qcow2 grow image-size ceiling (~128 GiB at default cluster) by replacing the guest's "stage every refcount block" pre-pass with a targeted pre-pass that stages only the specific blocks the chosen grow flavour will modify. New public compute_qcow2_grow_query planner helper computes the action + required-block set; guest pre-pass dispatches on it. Bound is now "what the filesystem can hold" instead of per-cluster-size. Shrink retains its older stage-all pre-pass (separate followup). Complete 01a: planner helper, 01b: guest pre-pass, 01c: large-image integration tests, 01d: fuzz clamp relaxation, 01e: docs
2026-05-27 Fuzzing bug backlog Triage and fix the 44 open security-audit GitHub issues filed by coverage-guided fuzzing and differential fuzzing. Five root-cause fix phases: plan_vmdk capacity overflow, qcow2 scan_allocation out-of-bounds L2 entries, measure-calculator sum overflow, vhd/vhdx/vmdk allocated_bytes clamp, differential-fuzz external-timeout reclassification. Complete 01: plan_vmdk, 02: qcow2 OOB L2, 03: measure calc overflow, 04: vhd/vhdx/vmdk clamp, 05: diff-fuzz timeouts
2026-05-30 instar rebase and instar commit subcommands Implement rebase (change backing-file references; both -u unsafe metadata-only mode and the default safe data-aware mode) and commit (merge overlay clusters into backing file) for qcow2 and vmdk monolithicSparse, with cross-version baselines, integration tests, coverage-guided fuzzing, and differential fuzzing. Reuses the read_output_sector call-table primitive from resize; no ABI extension required. Complete 1: ABI, 2: rebase planners, 3: rebase guest, 4: rebase host, 5: rebase tests, 6: commit planners, 7: commit guest, 8: commit host, 9: commit tests, 10: fuzz, 11: diff fuzz, 12: docs
2026-06-03 instar map subcommand Implement the map subcommand (qemu-img parity for raw / qcow2 / vmdk / vhd / vhdx single-image sources, streaming per-extent emission over the guest serial channel, cross-version baselines, integration tests, coverage-guided fuzzing, and differential fuzzing). Backing-chain depth composition deferred to a follow-up. Complete 1: extent iterators, 2: guest op, 3: host CLI, 4: output formatting, 5: baselines, 6: integration tests, 7: coverage fuzz, 8: differential fuzz, 9: docs
2026-06-08 instar snapshot subcommand Implement the snapshot subcommand (qcow2-only, mirroring qemu-img snapshot's -l/-c/-a/-d modes). List mode emits qemu-img-compatible human and JSON output; mutating modes manipulate the snapshot table, L1 copies, refcounts, and COPIED flags entirely inside the KVM guest using the existing write_input_sector primitive. Cross-version list baselines, integration tests with qemu-img check / info / compare post-op assertions, coverage-guided fuzzing of parse and refcount mutators, and differential fuzzing of random -c/-d/-a chains against qemu-img. Closes out the convert-followups subcommand roster. Complete 1: ABI, 2: list planner, 3: list guest, 4: list host, 5: refcount mutators, 6: create, 7: delete, 8: apply, 9: mutate host, 10: baselines, 11: integration tests, 12: coverage fuzz, 13: differential fuzz, 14: docs
2026-06-13 June 2026 fuzzer bug backlog Triage and fix the 10 open bug GitHub issues outstanding after the May 2026 backlog drain. Three root-cause fix phases: Fixed-VHD virtual_size overflow in plan_vhd (7 fuzz_create_emitters issues), unchecked VHDX resize sequence-number increment (2 fuzz_resize_planners issues), and qcow2 resize --shrink sub-byte refcount corruption (1 hand-filed snapshot-audit issue). Complete 01: fixed-vhd overflow, 02: vhdx resize seqnum, 03: qcow2 shrink sub-byte refcount
2026-06-13 instar check --repair for QCOW2 Wire CheckConfig::FLAG_REPAIR (reserved but dead since the original check op) to real QCOW2 repair logic, mirroring qemu-img check -r leaks/-r all. Settles the repair safety model (tiered safe-vs-lossy repair, dry-run-by-default, in-place mutation with no mandatory backup, crash-safe write ordering guarded by the corrupt header bit, refuse-rather-than-guess) and implements leak reclamation + refcount/COPIED rebuild inside the KVM guest, reusing the src/crates/snapshot/ refcount mutators. Corrupt-fixture baselines, integration tests with post-op qemu-img check/info/compare, coverage and differential fuzzing. Promoted from convert-followups phase 2. Complete 1: ABI + crate, 2: leak planner, 3: refcount planner, 4: guest (leaks tier), 5: guest (all tier), 6: host CLI, 7: baselines, 8: integration tests, 9: coverage fuzz, 10: differential fuzz, 11: docs
2026-06-15 instar amend subcommand Implement the amend subcommand (qcow2-only, mirroring qemu-img amend -o). v1 scope is the two header-only options that change no cluster/refcount data: compat=0.10 and compat=1.1 (qcow2 v2⇔v3 version transition, with v3-only-feature downgrade blockers, refcount-width constraints, and header-extension relocation) and lazy_refcounts=on and lazy_refcounts=off (the v3 compatible-feature bit). Reuses the resize/rebase in-place-mutation idiom; new src/crates/amend/ planner crate and src/operations/amend/ guest op. Cross-version info-equivalence baselines, integration tests with post-op info/check/compare, coverage and differential fuzzing. refcount_bits, external data file, encryption, and backing-file amend deferred. Picks up the qemu-img amend sibling deferred from convert-followups. Complete 1: ABI, 2: qcow2 planner, 3: guest, 4: host CLI, 5: rust tests, 6: integration tests, 7: baselines, 8: fuzz, 9: docs
2026-06-21 instar dd subcommand Implement the dd subcommand to upstream qemu-img dd parity (no PVE/downstream extensions). dd is convert with a windowed input: name=value operands (bs/count/skip/if/of) plus -f/-O (default output raw), a dense (non-sparse) copy, and faithful quirk replication (count shrinks-only, skip subtracts after count, skip-past-EOF ⇒ empty-but-exit-0, bs=0 rejected, short final block). Reuses convert's format writers and the run_convert lifecycle. New host name=value operand parser, guest input-windowing path, cross-version baselines, integration tests over a 14-row cross-validation matrix vs real qemu-img dd, coverage and differential fuzzing. First of the three remaining in-scope subcommands (dd, then bitmap, then bench). Complete 1: ABI, 2: host operands, 3: guest raw, 4: guest formats, 5: rust tests, 6: integration tests, 7: baselines, 8: coverage fuzz, 9: differential fuzz, 10: docs
2026-06-29 instar bitmap subcommand Implement the bitmap subcommand (qcow2-only, mirroring qemu-img bitmap's --add/--remove/--clear/--enable/--disable/--merge actions, applied in command-line order). Manages persistent dirty bitmaps: net-new qcow2 bitmaps-extension + directory + table + data parsing in the qcow2 crate, a new src/crates/bitmap/ planner crate and src/operations/bitmap/ guest op that allocate/free clusters and maintain refcounts (reusing the snapshot/check mutators) and the autoclear-bit crash-safe ordering. Cross-validates against qemu-img bitmap via post-op qemu-img check/info, with cross-version baselines, integration tests, coverage and differential fuzzing. Leaves bench as the only unimplemented qemu-img subcommand. Complete 1: parse ✓, 2: ABI ✓, 3: planner ✓, 4: guest ✓, 5: host CLI ✓, 6: rust tests ✓, 7: integration tests ✓, 8: baselines ✓, 9: fuzz ✓, 10: docs ✓
2026-07-06 instar bench subcommand Implement the bench subcommand — the last unimplemented qemu-img subcommand, closing the 15/15 parity roster. Runs a fixed-count sequential read (or -w write) benchmark through the format layer inside the KVM guest, so the reported time measures instar's real sandboxed I/O path; instar bench vs qemu-img bench on the same image is the reproducible sandbox-overhead measurement the announcement email lacked. Byte-parity on the deterministic output surface (header line, validation, exit codes); host-Instant timing bracketed by guest markers (no guest clock exists); -d accepted but serialized in v1 (the synchronous single-buffer virtio driver has no queue depth — true depth is future work); --output json instar extension for perf-regression tracking. New pure crates/bench schedule crate, src/operations/bench/ guest op, call-table VERSION 19→20. Explicitly no cross-version baselines (timing is not comparable). Complete 1: schedule crate ✓, 2: ABI ✓, 3: guest read ✓, 4: host CLI ✓, 5: write test ✓, 6: integration tests ✓, 7: fuzz ✓, 8: docs ✓
2026-07-09 bench qcow2 refcount growth Let bench's qcow2 -w path grow the refcount structures (new refblocks; refcount-table relocation with a snapshot-style fsync-ordered header flip) preemptively at setup from a worst-case schedule bound, so any schedule qemu-img bench executes on the fuzzer envelope also succeeds under instar with identical virtual content and a clean qemu-img check. Retires the qcow2-write-refblock-coverage fuzzer steer-around (issues #397-#401) and restores the full cluster-size matrix to -w differential coverage. Complete 01: planner, 02: guest, 03: integration, 04: fuzzer + docs
2026-07-10 qcow2 write infrastructure Build src/crates/qcow2-write/, the missing callable "write N bytes at virtual offset X into an existing qcow2, allocating as needed" primitive: a pure planner owning cluster classification (overwrite / allocate / copy-on-write), L2 and data-cluster allocation, refcount maintenance, the shared v1 envelope gates, and the crash-safe write-ordering contract. Migrates the three existing inlined allocate-on-write compositions (commit, rebase safe mode, bench -w) onto it with byte-invisible refactor proofs, generalizes bench's refcount growth into the shared crate, and adds copy-on-write for snapshot-shared clusters (adopted per consumer as its parity oracle permits; bench lifts its internal-snapshot gate first). Phase 1 empirically pins qemu's snapshot-bearing commit/rebase behaviour — commit's blind overwrite (no nb_snapshots gate, no COPIED check) is a candidate live corruption defect that gets an interim gate if confirmed. Foundation for deferred features: amend refcount_bits, qcow2 preallocation modes, per-format write infrastructure. Complete 1: semantics pin ✓, 2: interim gates + defect handling ✓, 3: qcow2-write crate ✓, 4: migrate commit ✓, 5: migrate rebase ✓, 6: migrate bench ✓, 7: copy-on-write ✓, 8: fuzz ✓, 9: docs ✓
2026-07-17 Format coverage expansion Close the input-side format-coverage gap against qemu-img's real image-format roster: detection + info parity for Parallels / Bochs / cloop / DMG, convert-from read paths for VDI / Parallels / QCOW1 / DMG, a recorded decision on QED, tested refusals for the formats we choose not to read, and a qemu-img-parity axis in docs/format-coverage.md. Output formats unchanged; write/create support for new formats out of scope. Complete 1: detection + info ✓, 2: vdi read ✓, 3: parallels read ✓, 4: qcow1 read ✓, 5: dmg read ✓, 6: qed decision ✓, 7: docs ✓
2026-07-25 Guest IDT for loud codegen failures Install a minimal IDT in the guest core so a CPU exception is reported to the host as a named vector and faulting RIP over the existing serial error channel, instead of escalating to an opaque triple fault. Makes any recurrence of the opt-level=z+lto control-flow miscompile on x86_64-unknown-none (issue #375) loud rather than silent Complete (no phase files; single change)
2026-07-28 Release v0.3.0 Cut the v0.3.0 tag and publish signed GitHub Release artifacts (tarball, .deb, .rpm) for x86_64 Linux, with the packaging manifests brought up to the 15/15 subcommand roster and the package smoke test extended to prove it Complete (no phase files; sequential gates)
2026-09-05 VHD and VHDX differencing output Emit differencing VHD (disk_type=4 + parent locator table) and differencing VHDX (HasParent + parent locator metadata item) from create -b, add parent-locator parsing to the vhd and vhdx crates, and close the silent parent-ignoring read of differencing children. An instar-only capability: qemu-img creates neither and reads both as though the parent did not exist, so the plan establishes an external oracle first Complete 1: pin + oracle ✓, 2: fixtures ✓, 3: parse ✓, 4: read policy ✓, 5: vhd emitter ✓, 6: vhdx emitter ✓, 7: guest + host ✓, 8: tests ✓, 9: fuzz ✓, 10: docs ✓, 11: chain host ✓, 12: vhd compose ✓ (narrower than the master plan implied -- the survey found the guest chain walker already built and already carrying a VHD arm, an unallocated BAT entry already descending to the parent, and the same function's extended-L2 subcluster path already demonstrating bitmap-driven run coalescing with backing-chain recursion, so the phase is a sector-bitmap reader and one arm's allocated-block case; execution found the planned conditional lift of the phase 4 refusal unsafe (device_count spans multiple chains -- issue #614), so the refusal stayed unconditional and a chain-boundary guard was added to the reader instead, verified at crate level because no host path builds a composing VHD chain until phase 14), 13: vhdx compose ✓ (execution found two defects the survey did not: VhdxState::init sized a differencing image's BAT by the dynamic rule, leaving every sector-bitmap entry unreachable for any block count that is not an exact multiple of chunk_ratio -- including the project's own 16 MiB fixture -- fixed by a separate padded bound that leaves the whole-BAT walks behind info and map alone and left the writer half as issue #623; and sector_bitmap_lookup carried two guards where there was one, the SB_BLOCK_NOT_PRESENT branch being unkillable because != SB_BLOCK_PRESENT subsumed it, found by putting the mutation harness's reader cases in the tree and running them. The chain walker now also refuses a BAT entry naming file offset zero, where the file identifier and headers live; the wider overlap case is issue #625. The in-tree mutation harness grew from 26 writer cases to 62, and its case totals are now derived from the script and CI-enforced rather than written in prose, after hand-maintained counts drifted three review rounds running -- though the sub-group breakdown stayed prose and drifted again, which phase 18's audit found), 14: op rollout ✓ (rescoped by its own survey, which found the master plan's seven-operation list wrong in four ways -- rebase reads through init_chain_states and was unnamed, dd is convert with different operands rather than an operation, and map, measure and check hold no chain notion at all, so composing in them is new plumbing and not a refusal lift; the refusal is four independent families rather than the single if the phase 12 bullet promised, and the host gate at src/vmm/src/main.rs:3047 is per caller kind where the rollout is per operation. Issues #623 and #614 are its first two steps, as the master plan requires, and it also takes #625 because lifting the refusal is what makes that bound reachable from a user command), 15: op consistency ✓ (rescoped by its own survey from the chain-support phase the master plan described -- measurement against qemu-img 10.0.13 found check does not walk the chain at all, so it needs no composition to reach parity, while map and measure compose for every format, making their gap qcow2-chain parity work that PLAN-map.md and PLAN-measure.md both deferred before reaching Complete; those leave this plan as issues #641 and #642. What phase 15 keeps is the boundary phase 14 left: the VHDX region-overlap test reaching map and measure (#634), the missing chain-depth guard in check and bench (#633), a test for the commit disposition phase 14 decided but did not test, and correcting the refusal justifications that five composing operations falsified -- the refusals themselves stay, with the lift question filed as #643), 16: compose tests ✓ (the survey corrected two tooling claims by measurement rather than by reading -- Debian's libvhdi-utils ships no export tool at all, so the python3-libvhdi binding the master plan prefers has nothing to be preferred over, and the 4096-byte-sector gap phase 13 handed over cannot be closed by an integration fixture because two chunk groups at that geometry need a 64 GiB virtual disk and neither qemu-img nor instar can author a 4K-sector VHDX at any size. The oracle was measured against the project's own goldens first: it agrees byte for byte on two of the three real chains and diverges in exactly one sector of the third, which the phase pins as a named exception rather than skipping the only fixture with mixed sector ownership inside a bitmap byte. Takes #635 and #631, both fixture-blocked and handed over by phase 15, and adds the first fuzz target to reach the compose path -- the shared mock call table is single-device by construction today. Execution found more than the tests it set out to write: the new fuzz_chain_compose target caught a live data-correctness defect -- a wide-I/O subcluster allocated at host offset zero returned success without filling the caller's buffer (#650) -- which is fixed here and pinned by a crate test and two mutation cases. Sweeping that class rather than retesting the instance found two more, each measured rather than argued: Standard(0) serves the image's own header to the guest as payload and exits 0 (#653), and UNALLOCATED_PLAIN zero-fills instead of descending to the backing file on well-formed images, in both I/O arms (#654). Their shared root cause is that host_offset == 0 is interpreted ad hoc per branch rather than each subcluster being classified once into the types qcow2 defines, so both were left open by an explicit scope decision and the phase landed as test-and-tooling work. A review item asking for a zero-sensitive fuzz invariant was declined as structurally vacuous, on measurement rather than argument: implemented as specified it ran 199,352 executions without firing, and a reachability probe showed it compared zero holes across 132,908, because a one-device read zero-fills every hole at the tail of read_chain_virtual_cluster), 17: compose docs ✓ (the survey found phase 14 had already shipped what the master plan's bullet asked for, so the phase is four corrections rather than an extension -- the load-bearing one being ARCHITECTURE.md still telling a first reader that instar refuses to compose a differencing child on read. Execution widened the sweep twice: see the phase plan's survey for the classification of all fourteen references and why the provenance ones stay. The info limitation it could not fix is issue #658), 18: push audit ✓ (the survey found the audit instrument would have audited nothing: every diff-scoped check in both wave scripts took its file set from git diff develop...HEAD, which on a push-audit branch covers only what the branch itself adds -- 3 files here against the 103 under audit, and empty outright for a branch with no commits of its own -- so step 1 repaired the scripts before anything ran. The audit then found nine documentation and comment defects this plan's own earlier phases had written, and filed six issues (#660 to #665); the findings, the negative results and what the audit did not cover are in the phase plan's audit findings)
2026-10-08 Backing-path resolution oracle Make backing-reference resolution answer only from filesystem state inside the allowlist, so an image can no longer learn whether a host path exists from the refusal reason (absolute and relative references, and symlink targets; issue #611) Complete (no phase files; single change)
2026-10-13 Cut the merge queue's critical path Stop the merge queue ejecting green pull requests at the 360-minute check_response_timeout_minutes by removing work from the gate rather than rearranging it (issue #543). Measurement after private-ci#66 made runner ordering fair found the cost is not fan-out or any fixed setup -- about three minutes of a 42-minute matrix leg is setup, and six Hyper-V and VirtualPC VHD conversion tests are half the suite's execute time and the cause of a single worker setting every leg's wall clock. Those six move to a nightly cross-distro job, stestr gets derived timing data so a future heavy test cannot silently recreate the imbalance, and the test-partition guard is extended to the merge queue and the nightly so nothing can fall off the gate unnoticed Complete (no phase files; single change)
2026-10-19 One subcluster classification for qcow2 Replace the ad hoc readings of "host offset zero" across the qcow2 chain reader, map, measure and check with one classifier that mirrors qemu's seven subcluster types, including the external-data-file rule, and refuse what qemu calls an invalid entry. Fixes extended-L2 reads that skip the backing file (#654), a crafted entry that serves the image header as data (#653), and data-file images whose cluster 0 reads as zeros; then stops treating the data device as a chain layer (#792) and refuses the data-file entries qemu refuses (#803) Complete 1: classifier ✓, 2: data device ✓ (also takes #803, qemu's data-file host-offset refusals; the survey found the chain config documents the data device as a layer behind its owner, and that the crate harness never used the layout the VMM writes, which is why #792 had no crate test), 3: push audit ✓ (the survey found the audit tooling already repaired and resolving the two merges to 21 files; it found seven open issues this plan filed recorded only in phase plans, now in Future work, and that phase 2 moved the crate harness phase 1's mutation cases run against, so the audit re-runs all 23 of the plan's mutation cases on the merged tree; the audit then found eighteen defects this plan introduced or made true, four of them blocking documentation, which a follow-up pull request fixed, and filed #812 to #816)
2026-10-20 Populated BAT output: fixed VHDX and non-qcow2 preallocation Emit fixed VHDX from create and convert (and answer it in measure) the way qemu-img does -- LeaveBlocksAllocated set and every payload BAT entry written, PAYLOAD_BLOCK_ZERO by default or FULLY_PRESENT at sequential offsets with block_state_zero=off -- through a streaming BAT emitter that never holds the table in guest memory; accept -o preallocation=falloc and full on vmdk / vpc / vhdx as the no-op qemu-img makes it (and refuse metadata); add host-only create -f vmdk -o subformat=monolithicFlat. Fixes the VHDX read and geometry defects fixed output would expose first: the BAT entry count (#626, which makes instar refuse some well-formed qemu images), qemu's size-scaled default block size (#645), check rejecting a partial last block, resize turning a fixed VHDX into a hybrid, and the 64 TiB ceiling. Multi-extent VMDK output is out of scope In progress 1: pin ✓, 2: fixtures ✓ (five small fixtures rather than the 128 GiB one the master plan assumed -- git-LFS stores sparse files fully allocated, and an 8 MiB dynamic image reproduces #626; the generator joins scripts/create-vhd-testdata.sh in instar, and the create baselines move to phase 10), 3: host create ✓ (no-op preallocation for vmdk / vpc / vhdx and host-only monolithicFlat create, tested against the phase 1 pin; fixes #820, convert's flat extent name), 4: read side ✓ (one BAT entry count, qemu's, closing #626; check accepts a partial last block by payload index, deliberately not copying qemu's BAT-index rule, which refuses qemu's own fixed images past the first chunk (#797); resize refuses a fixed VHDX with its own error code (#798); measure joins the fixture read matrix), 5: geometry ✓ (one VHDX layout function for every writer, readers keep no ceiling; qemu's size-scaled default block size in create, convert, dd and measure, closing #645; the 64 TiB ceiling, closing #799; sizes rounded to 512 as qemu does, closing #843), 6: emitter (the streaming BAT filler and qemu's fixed data start in the vhdx crate, and a fixed subformat in plan_vhdx, reachable only from the crate until phase 7; the survey found instar's shared builders differ from qemu's in the Required bit, the metadata items' flags and placement, and the physical sector size, and fixes all of them for every VHDX writer), 7: create, 8: convert, 9: measure, 10: matrix, 11: fuzz, 12: docs, 13: push audit

📝 Report an issue with this page