update

docs/pre15-stage0/P15-062.md

@@ -0,0 +1,89 @@
+# P15-062 Stage0 Decision
+
+Status: `STOP`. B26 is `STOP-NO-SOURCE`; no production source, B26 case, or
+B26 fixture is authorized.
+
+The decision is bound to DUT BASE
+`205a90465edb64e83ba44aaacac9bedad4cbe905`, FreeBSD source HEAD
+`106727738dcfb6c001b46f25363b91cece970085`, and exact upstream erofs-utils
+commits for v1.4, v1.7, and v1.8.6. The authoritative gate evidence and final
+script/input hashes are recorded below and in the G04 evidence commit.
+
+The later B26 terminal review is recorded at
+`planning/pre15/evidence/20260817T-B26-terminal-review/VERDICT.md`.
+It retains `STOP_NO_SOURCE / NOT_TESTED` and adds secondary
+`TERMINAL_REVIEWED_NO_SOURCE`. It found the historical zero-tail shape to be
+reproducible, but did not establish that trailing zeros are format-mandated or
+that current FreeBSD rejects them.
+
+## Authoritative Run
+
+The gate ran from `/work/erofs-freebsd-pre` as:
+
+```sh
+timeout -k 10 240 repo-pre-15/tests/pre15/gates/P15-062.sh \
+    --base 205a90465edb64e83ba44aaacac9bedad4cbe905 \
+    --output planning/pre15/evidence/20260815T062257Z-G04-P15-062/gate-output
+```
+
+It returned the gate-defined STOP exit status 1. Evidence is rooted at
+`planning/pre15/evidence/20260815T062257Z-G04-P15-062/`. The authoritative
+script SHA-256 is
+`6af503f1612eb42410f91a54fdc37481bae86a4419232c9de48c08bfa7ecee5d` and
+the input SHA-256 is
+`390202738ac006aba2514d27d3b0a19a0123a009601a26cac3b560a3dff388e5`.
+The result SHA-256 is
+`597466203edcaee6d163651a6d6a05e49dff24f39201234911f9753b29eebbe0`.
+
+## Decision Rule
+
+G04 permits P15-062 only if every normative and historical full LZ4 input uses
+the same exact-consumption rule. The B26 review found that the old fsck
+acceptance path uses `LZ4_decompress_safe_partial()` for legacy/no-0padding
+images, so that acceptance does not prove full physical consumption or format
+legality. The format sources contain no stored compressed-stream length or
+general trailing-zero rule. The current FreeBSD decoder accepts an all-zero
+remainder and rejects nonzero remainder bytes; no implementation defect was
+demonstrated.
+
+## Reproducible Corpus
+
+The gate builds three upstream mkfs generations from exact commits in an owned
+temporary directory. Each version twice generates the same fixed-time,
+fixed-UUID, root-owned, xattr-free legacy LZ4 image from the same deterministic
+1 MiB file. Matching `fsck.erofs --extract` accepts each image. The image,
+source, build tree, and binaries remain temporary and are not committed.
+
+The independent parser reconstructs the complete file from two physical
+pclusters. The final extent has `m_plen=4096`, but its raw LZ4 stream reaches
+9,670 decoded bytes after consuming 48 bytes; the remaining 4,048 bytes are
+zero. This shape is byte-reproducible in v1.4, v1.7, and v1.8.6. The current
+FreeBSD decoder accepts the whole input and liblz4 accepts the 48-byte exact
+stream but rejects the block-sized input. The zero-tail shape is therefore a
+historical tool-compatible candidate, not a proven format-legal fixture.
+
+## Partial and Corruption Controls
+
+A separate v1.8.6 `-Ededupe` image contains two real noncompact
+`Z_EROFS_LI_PARTIAL_REF` records that share an LZ4 pcluster. The independent
+parser, liblz4 partial API, and frozen DUT callback agree on the 4,096- and
+5,594-byte prefixes. Corruption beginning after the 4,096-byte request remains
+undetected by that partial read but causes the same fixture's full decode to
+return positive `EINTEGRITY` (97), as required by G04. Truncation and nonzero
+tail controls also return 97; all output guards remain unchanged.
+
+Production `zdata.c` ownership anchors show that metadata/physical input is
+released after every decoder return, failed decoded output is freed, and only
+successful output is published. The decoder itself allocates and owns no
+buffers. The gate's owned build/image directory is removed, and it does not
+start QEMU or touch protected PID 26318, port 9222, or the shared base image.
+
+## Consequence
+
+P15-062 remains STOP for Pre15 because B26 has no authorized production source,
+case, or fixture. `src/decompressor_lz4.c`,
+`tests/pre15/cases/B26-lz4-input.sh`, and `tests/pre15/fixtures/B26-*` remain
+unchanged or absent as applicable. B26 acceptance D, exact-ABI build, TC167
+QEMU, and the full feature suite are not run because no implementation error
+was demonstrated. The secondary B26 status is
+`TERMINAL_REVIEWED_NO_SOURCE`.