update

docs/pre15-stage0/P15-081.md

@@ -0,0 +1,95 @@
+# P15-081 Stage0 Decision
+
+Status: `GO`. B11 is authorized; no production source was modified by this
+decision.
+
+The authoritative G11 replay uses frozen B25 BASE
+`e2e3fb86b6fffcb01d6fd29c17dd95628ad070de`, FreeBSD source HEAD
+`106727738dcfb6c001b46f25363b91cece970085`, and
+`mkfs.erofs (erofs-utils) 1.8.6`. The gate script and input SHA256 values are
+`6215a3005214ba8d25dacd63e039320a0c63308d2334b5faff99a3927cad7d2e`
+and `a887fad56927545adb48462b770100d1e64b22b32554ed8ffad14c72b8febfc3`.
+
+## Real Disk and Normal Entrypoint
+
+The gate independently materializes a deterministic source tree containing
+regular, directory, character-device, block-device, FIFO, socket, symlink,
+and two hardlink names. It invokes mkfs twice with fixed UUID, time, ownership,
+worker count, xattr policy, and inline-data policy. It also fixes and restores
+the process umask and explicitly sets every source-node mode. Complete
+replays under outer umask `022` and `077`, including both seed generations in
+each replay, are byte-identical.
+
+The gate parses the actual superblock, checksum range, root inode, inline root
+directory, 12-byte dirents, NIDs, and compact inode modes without using DUT
+helpers. Every derived image changes one real dirent byte and recomputes the
+superblock CRC32C. `dump.erofs --ls --path=/` observes the mutated on-disk
+`file_type`, while `dump.erofs --path=/NAME` reaches the same NID and reports
+the inode kind from its mode. This gives 13 normal namespace resolutions from
+real disk fields: eight known mismatches and five forward-compatibility cases.
+
+All eight known mismatches are checksum-valid, fsck-clean images and yield
+positive FreeBSD `EINTEGRITY` in the independent candidate oracle. Type zero,
+nonzero dirent reserved bytes, and out-of-range type 8/255 remain accepted by
+the DUT policy and candidate oracle. erofs-utils fsck separately rejects 8/255;
+the evidence records that as `policy-reject` rather than falsely claiming
+fsck-clean. P15-093 already freezes the FreeBSD behavior for these extension
+values as `DT_UNKNOWN`, so fsck's stricter userspace policy does not override
+the G11 compatibility boundary.
+
+## Cache and Lock Boundary
+
+`regular` and `regular-hard` are different namespace keys with the same real
+NID. The first normal lookup can instantiate the vnode; the second name misses
+that namecache key and reaches the existing `erofs_vget()` path, whose frozen
+body checks `vfs_hash_get()` before inode decode. Mutating only the second
+dirent to known directory type therefore provides the required cached-vnode
+trigger without adding a readdir-time vget.
+
+The generated candidate patch adds no lock, vget, hash, or recursive lookup
+call. It reads immutable `vtype` after the existing child lookup, returns
+positive `EINTEGRITY` for a known mismatch, drops the locked child with
+`vput()`, and runs before `a_vpp` and namecache publication. Dotdot's existing
+`vn_vget_ino()` path explicitly bypasses the validator because root `..` can
+return the directory vnode itself; this preserves its parent-lock contract.
+The parent/child lock order, readdir cookies, and VFS/VOP entrypoints are
+unchanged. Readdir still contains no vnode lookup.
+
+Linux supplies the format mapping: EROFS file type values match generic Linux
+`FT_*`, and Linux readdir maps those values with `fs_ftype_to_dtype()`. The
+candidate aligns that known-type mapping while retaining FreeBSD vnode types,
+the FreeBSD 15 `__enum_uint8(vtype)` ABI type, positive errno, VFS locks, and
+forward handling for unknown values.
+
+## Replay Result
+
+The authoritative command was:
+
+```sh
+timeout -k 10 240 tests/pre15/gates/P15-081.sh \
+    --base e2e3fb86b6fffcb01d6fd29c17dd95628ad070de \
+    --output OWNED_OUTPUT
+```
+
+It exits zero with `GO`: 14 generated images, eight known-match records
+including the hardlink alias, eight known mismatches, five compatibility
+cases, 13 normal entrypoint observations, one cached-vnode sequence, and 21
+compiled prototype records. Two fresh output directories are byte-identical. The fixture-set
+SHA256 is
+`b562a7e42e139b16f3ce399d585aa7c373a66aa478a084bfed67b2b2aa9f2bd3`.
+
+Key immutable evidence SHA256 values are:
+
+- `result.json`: `4ec8e053c60ae75ae2fc4580a3d820a0452cf519f6b85376953135e18a7ec0ec`
+- `oracle.json`: `932e558d3ead05572f38c89635bb10cae45393e42028031f81dfc7a56f2093f6`
+- `lock-ledger.json`: `e8c2e6ba797fbcc83d832af6583d3f74f344750f6897111e7fe501130e577c13`
+- `fixture-index.json`: `1a46b8ebfec16109c5d193001dc650a1b56000045e5d9e1e9b145fe7c5df9a16`
+- `candidate.patch`: `427097da9304f5bedb770be8cab5f589706d316fb18a152ca16cb9d0663713fd`
+- `prototype.c`: `1a295d18830c61a9708d465c3b1e415efb3ff8276100e4e32139bfa715195d8b`
+- `normal-entry.tsv`: `b2841448068f70633ed0c02d901177a639cfed150f0e1c58977cc6c7b1e7313e`
+- `SHA256SUMS`: `36b486617920b04ca87e88016e2fc0f519cda3a5f99dc675c9a89549615a02e3`
+
+QEMU and the full feature suite were not run for this pre-source gate. The
+gate uses host-created real EROFS images, independent binary parsing, normal
+userspace namespace resolution, frozen DUT/FreeBSD control flow, and a
+compiled prototype that is not linked into the DUT KLD.