# P15-052 Stage0 Decision

Status: `STOP`. B20 is complete as `STOP-NO-SOURCE`; B21 was not started.

The authoritative G06 replay uses frozen BASE
`ca7bb4fe6b33e4a1bdf423801134b0ed6bda86dd`. It verifies the exact current
FreeBSD and Linux source hashes, the FreeBSD amd64 `PAGE_SHIFT=12` contract,
signed 64-bit `off_t`, and GEOM's `off_t mediasize` before evaluating every
listed branch.

## Exact Branch Result

All twelve proposed on-disk arithmetic branches have unique source sites, but
none has a target marker reachable from one validated on-disk field mutation.
The current source text returns positive `EOVERFLOW` at those defensive sites;
the proposed mapping would be positive `EINTEGRITY`. Linux has no matching
checked branches in these functions, so its relevant semantic mapping is
negative `-EFSCORRUPTED`, not a textual negative copy of the FreeBSD return.

The decisive counterexample to the supplied READY prototype is
`xattr.metadata.header_add`. The prototype directly mutates the local
`aligned_off` value. The real helper first rejects input above
`UINT64_MAX - 3`, then rounds to four bytes. The greatest surviving aligned
offset is therefore `UINT64_MAX - 3`; adding the two-byte header cannot
overflow. The named branch cannot be independently reached.

The other prototype vectors likewise inject values outside current provenance:
mounted image bytes are bounded by GEOM's signed `off_t mediasize`; inode size
is bounded by `OFF_MAX`; decoded physical blocks are at most 48 bits;
`blkszbits` is at most 12; prefix start and shared IDs are 32-bit. These bounds
prevent each proposed shift, add, alignment, and index overflow before the
listed target.

## Preserved Semantics

The replay separately freezes corruption, unsupported, provider I/O, EOF, and
short-read behavior. Disk/backing range contradictions remain positive
`EINTEGRITY`; exact zero-length EOF remains success; provider `EIO` and media
`ENXIO` remain exact; unsupported xattr layout remains positive
`EOPNOTSUPP`; allocation remains positive `ENOMEM` and outside B20. Linux
counterparts retain negative errno or `PTR_ERR` propagation.

The nominal `erofs_xattr_read_backing()` `off > INT64_MAX` positive
`EOVERFLOW` site is also not reachable for a mounted primary provider: the
preceding range check requires `off <= backing_size`, while mount validation
requires `backing_size <= INT64_MAX`. This site remains unchanged because a
STOP decision has no source diff.

## Atomic Decision

G06 requires every listed branch to be independently reachable. One missing
branch stops all of P15-052; this replay finds twelve missing target markers.
No `data.c` or `xattr.c` errno is changed, no B20 case/fixture is created, and
no candidate replay or QEMU run can cure a host-proven reachability failure.
The full feature suite was not run.

The authoritative command was:

```sh
timeout -k 10 240 tests/pre15/gates/P15-052.sh \
    --base ca7bb4fe6b33e4a1bdf423801134b0ed6bda86dd \
    --output OWNED_OUTPUT
```

It exited 1 because a valid gate `STOP` is not `GO`. Two fresh output
directories were byte-identical. The initial replay produced result SHA256
`37280545d8ef5a6b87c7b9d536939513a1bbac8e4e4b2389e84f5ca77e1aa522`,
branch-ledger SHA256
`8024a2cb6b43bd10fbcf446cf8cf44de37f1f9d6df25718c641cb9db4c257169`,
and preservation-ledger SHA256
`d17e05b8df43ea5173bed6e58d7431b37a7a9c4a143e07717b543efcb54ecc66`.

B21 is not authorized because the execution request requires B20 PASS before
B21. Wave16 is therefore not ready from this serial chain.