# P15-062 Stage0 Decision

Status: `STOP`. B26 is `STOP-NO-SOURCE`; no production source, B26 case, or
B26 fixture is authorized.

The decision is bound to DUT BASE
`205a90465edb64e83ba44aaacac9bedad4cbe905`, FreeBSD source HEAD
`106727738dcfb6c001b46f25363b91cece970085`, and exact upstream erofs-utils
commits for v1.4, v1.7, and v1.8.6. The authoritative gate evidence and final
script/input hashes are recorded below and in the G04 evidence commit.

The later B26 terminal review is recorded at
`planning/pre15/evidence/20260817T-B26-terminal-review/VERDICT.md`.
It retains `STOP_NO_SOURCE / NOT_TESTED` and adds secondary
`TERMINAL_REVIEWED_NO_SOURCE`. It found the historical zero-tail shape to be
reproducible, but did not establish that trailing zeros are format-mandated or
that current FreeBSD rejects them.

## Authoritative Run

The gate ran from `/work/erofs-freebsd-pre` as:

```sh
timeout -k 10 240 repo-pre-15/tests/pre15/gates/P15-062.sh \
    --base 205a90465edb64e83ba44aaacac9bedad4cbe905 \
    --output planning/pre15/evidence/20260815T062257Z-G04-P15-062/gate-output
```

It returned the gate-defined STOP exit status 1. Evidence is rooted at
`planning/pre15/evidence/20260815T062257Z-G04-P15-062/`. The authoritative
script SHA-256 is
`6af503f1612eb42410f91a54fdc37481bae86a4419232c9de48c08bfa7ecee5d` and
the input SHA-256 is
`390202738ac006aba2514d27d3b0a19a0123a009601a26cac3b560a3dff388e5`.
The result SHA-256 is
`597466203edcaee6d163651a6d6a05e49dff24f39201234911f9753b29eebbe0`.

## Decision Rule

G04 permits P15-062 only if every normative and historical full LZ4 input uses
the same exact-consumption rule. The B26 review found that the old fsck
acceptance path uses `LZ4_decompress_safe_partial()` for legacy/no-0padding
images, so that acceptance does not prove full physical consumption or format
legality. The format sources contain no stored compressed-stream length or
general trailing-zero rule. The current FreeBSD decoder accepts an all-zero
remainder and rejects nonzero remainder bytes; no implementation defect was
demonstrated.

## Reproducible Corpus

The gate builds three upstream mkfs generations from exact commits in an owned
temporary directory. Each version twice generates the same fixed-time,
fixed-UUID, root-owned, xattr-free legacy LZ4 image from the same deterministic
1 MiB file. Matching `fsck.erofs --extract` accepts each image. The image,
source, build tree, and binaries remain temporary and are not committed.

The independent parser reconstructs the complete file from two physical
pclusters. The final extent has `m_plen=4096`, but its raw LZ4 stream reaches
9,670 decoded bytes after consuming 48 bytes; the remaining 4,048 bytes are
zero. This shape is byte-reproducible in v1.4, v1.7, and v1.8.6. The current
FreeBSD decoder accepts the whole input and liblz4 accepts the 48-byte exact
stream but rejects the block-sized input. The zero-tail shape is therefore a
historical tool-compatible candidate, not a proven format-legal fixture.

## Partial and Corruption Controls

A separate v1.8.6 `-Ededupe` image contains two real noncompact
`Z_EROFS_LI_PARTIAL_REF` records that share an LZ4 pcluster. The independent
parser, liblz4 partial API, and frozen DUT callback agree on the 4,096- and
5,594-byte prefixes. Corruption beginning after the 4,096-byte request remains
undetected by that partial read but causes the same fixture's full decode to
return positive `EINTEGRITY` (97), as required by G04. Truncation and nonzero
tail controls also return 97; all output guards remain unchanged.

Production `zdata.c` ownership anchors show that metadata/physical input is
released after every decoder return, failed decoded output is freed, and only
successful output is published. The decoder itself allocates and owns no
buffers. The gate's owned build/image directory is removed, and it does not
start QEMU or touch protected PID 26318, port 9222, or the shared base image.

## Consequence

P15-062 remains STOP for Pre15 because B26 has no authorized production source,
case, or fixture. `src/decompressor_lz4.c`,
`tests/pre15/cases/B26-lz4-input.sh`, and `tests/pre15/fixtures/B26-*` remain
unchanged or absent as applicable. B26 acceptance D, exact-ABI build, TC167
QEMU, and the full feature suite are not run because no implementation error
was demonstrated. The secondary B26 status is
`TERMINAL_REVIEWED_NO_SOURCE`.