update

docs/pre15-stage0/P15-052.md

@@ -0,0 +1,74 @@
+# P15-052 Stage0 Decision
+
+Status: `STOP`. B20 is complete as `STOP-NO-SOURCE`; B21 was not started.
+
+The authoritative G06 replay uses frozen BASE
+`ca7bb4fe6b33e4a1bdf423801134b0ed6bda86dd`. It verifies the exact current
+FreeBSD and Linux source hashes, the FreeBSD amd64 `PAGE_SHIFT=12` contract,
+signed 64-bit `off_t`, and GEOM's `off_t mediasize` before evaluating every
+listed branch.
+
+## Exact Branch Result
+
+All twelve proposed on-disk arithmetic branches have unique source sites, but
+none has a target marker reachable from one validated on-disk field mutation.
+The current source text returns positive `EOVERFLOW` at those defensive sites;
+the proposed mapping would be positive `EINTEGRITY`. Linux has no matching
+checked branches in these functions, so its relevant semantic mapping is
+negative `-EFSCORRUPTED`, not a textual negative copy of the FreeBSD return.
+
+The decisive counterexample to the supplied READY prototype is
+`xattr.metadata.header_add`. The prototype directly mutates the local
+`aligned_off` value. The real helper first rejects input above
+`UINT64_MAX - 3`, then rounds to four bytes. The greatest surviving aligned
+offset is therefore `UINT64_MAX - 3`; adding the two-byte header cannot
+overflow. The named branch cannot be independently reached.
+
+The other prototype vectors likewise inject values outside current provenance:
+mounted image bytes are bounded by GEOM's signed `off_t mediasize`; inode size
+is bounded by `OFF_MAX`; decoded physical blocks are at most 48 bits;
+`blkszbits` is at most 12; prefix start and shared IDs are 32-bit. These bounds
+prevent each proposed shift, add, alignment, and index overflow before the
+listed target.
+
+## Preserved Semantics
+
+The replay separately freezes corruption, unsupported, provider I/O, EOF, and
+short-read behavior. Disk/backing range contradictions remain positive
+`EINTEGRITY`; exact zero-length EOF remains success; provider `EIO` and media
+`ENXIO` remain exact; unsupported xattr layout remains positive
+`EOPNOTSUPP`; allocation remains positive `ENOMEM` and outside B20. Linux
+counterparts retain negative errno or `PTR_ERR` propagation.
+
+The nominal `erofs_xattr_read_backing()` `off > INT64_MAX` positive
+`EOVERFLOW` site is also not reachable for a mounted primary provider: the
+preceding range check requires `off <= backing_size`, while mount validation
+requires `backing_size <= INT64_MAX`. This site remains unchanged because a
+STOP decision has no source diff.
+
+## Atomic Decision
+
+G06 requires every listed branch to be independently reachable. One missing
+branch stops all of P15-052; this replay finds twelve missing target markers.
+No `data.c` or `xattr.c` errno is changed, no B20 case/fixture is created, and
+no candidate replay or QEMU run can cure a host-proven reachability failure.
+The full feature suite was not run.
+
+The authoritative command was:
+
+```sh
+timeout -k 10 240 tests/pre15/gates/P15-052.sh \
+    --base ca7bb4fe6b33e4a1bdf423801134b0ed6bda86dd \
+    --output OWNED_OUTPUT
+```
+
+It exited 1 because a valid gate `STOP` is not `GO`. Two fresh output
+directories were byte-identical. The initial replay produced result SHA256
+`37280545d8ef5a6b87c7b9d536939513a1bbac8e4e4b2389e84f5ca77e1aa522`,
+branch-ledger SHA256
+`8024a2cb6b43bd10fbcf446cf8cf44de37f1f9d6df25718c641cb9db4c257169`,
+and preservation-ledger SHA256
+`d17e05b8df43ea5173bed6e58d7431b37a7a9c4a143e07717b543efcb54ecc66`.
+
+B21 is not authorized because the execution request requires B20 PASS before
+B21. Wave16 is therefore not ready from this serial chain.