# P15-081 Stage0 Decision

Status: `GO`. B11 is authorized; no production source was modified by this
decision.

The authoritative G11 replay uses frozen B25 BASE
`e2e3fb86b6fffcb01d6fd29c17dd95628ad070de`, FreeBSD source HEAD
`106727738dcfb6c001b46f25363b91cece970085`, and
`mkfs.erofs (erofs-utils) 1.8.6`. The gate script and input SHA256 values are
`6215a3005214ba8d25dacd63e039320a0c63308d2334b5faff99a3927cad7d2e`
and `a887fad56927545adb48462b770100d1e64b22b32554ed8ffad14c72b8febfc3`.

## Real Disk and Normal Entrypoint

The gate independently materializes a deterministic source tree containing
regular, directory, character-device, block-device, FIFO, socket, symlink,
and two hardlink names. It invokes mkfs twice with fixed UUID, time, ownership,
worker count, xattr policy, and inline-data policy. It also fixes and restores
the process umask and explicitly sets every source-node mode. Complete
replays under outer umask `022` and `077`, including both seed generations in
each replay, are byte-identical.

The gate parses the actual superblock, checksum range, root inode, inline root
directory, 12-byte dirents, NIDs, and compact inode modes without using DUT
helpers. Every derived image changes one real dirent byte and recomputes the
superblock CRC32C. `dump.erofs --ls --path=/` observes the mutated on-disk
`file_type`, while `dump.erofs --path=/NAME` reaches the same NID and reports
the inode kind from its mode. This gives 13 normal namespace resolutions from
real disk fields: eight known mismatches and five forward-compatibility cases.

All eight known mismatches are checksum-valid, fsck-clean images and yield
positive FreeBSD `EINTEGRITY` in the independent candidate oracle. Type zero,
nonzero dirent reserved bytes, and out-of-range type 8/255 remain accepted by
the DUT policy and candidate oracle. erofs-utils fsck separately rejects 8/255;
the evidence records that as `policy-reject` rather than falsely claiming
fsck-clean. P15-093 already freezes the FreeBSD behavior for these extension
values as `DT_UNKNOWN`, so fsck's stricter userspace policy does not override
the G11 compatibility boundary.

## Cache and Lock Boundary

`regular` and `regular-hard` are different namespace keys with the same real
NID. The first normal lookup can instantiate the vnode; the second name misses
that namecache key and reaches the existing `erofs_vget()` path, whose frozen
body checks `vfs_hash_get()` before inode decode. Mutating only the second
dirent to known directory type therefore provides the required cached-vnode
trigger without adding a readdir-time vget.

The generated candidate patch adds no lock, vget, hash, or recursive lookup
call. It reads immutable `vtype` after the existing child lookup, returns
positive `EINTEGRITY` for a known mismatch, drops the locked child with
`vput()`, and runs before `a_vpp` and namecache publication. Dotdot's existing
`vn_vget_ino()` path explicitly bypasses the validator because root `..` can
return the directory vnode itself; this preserves its parent-lock contract.
The parent/child lock order, readdir cookies, and VFS/VOP entrypoints are
unchanged. Readdir still contains no vnode lookup.

Linux supplies the format mapping: EROFS file type values match generic Linux
`FT_*`, and Linux readdir maps those values with `fs_ftype_to_dtype()`. The
candidate aligns that known-type mapping while retaining FreeBSD vnode types,
the FreeBSD 15 `__enum_uint8(vtype)` ABI type, positive errno, VFS locks, and
forward handling for unknown values.

## Replay Result

The authoritative command was:

```sh
timeout -k 10 240 tests/pre15/gates/P15-081.sh \
    --base e2e3fb86b6fffcb01d6fd29c17dd95628ad070de \
    --output OWNED_OUTPUT
```

It exits zero with `GO`: 14 generated images, eight known-match records
including the hardlink alias, eight known mismatches, five compatibility
cases, 13 normal entrypoint observations, one cached-vnode sequence, and 21
compiled prototype records. Two fresh output directories are byte-identical. The fixture-set
SHA256 is
`b562a7e42e139b16f3ce399d585aa7c373a66aa478a084bfed67b2b2aa9f2bd3`.

Key immutable evidence SHA256 values are:

- `result.json`: `4ec8e053c60ae75ae2fc4580a3d820a0452cf519f6b85376953135e18a7ec0ec`
- `oracle.json`: `932e558d3ead05572f38c89635bb10cae45393e42028031f81dfc7a56f2093f6`
- `lock-ledger.json`: `e8c2e6ba797fbcc83d832af6583d3f74f344750f6897111e7fe501130e577c13`
- `fixture-index.json`: `1a46b8ebfec16109c5d193001dc650a1b56000045e5d9e1e9b145fe7c5df9a16`
- `candidate.patch`: `427097da9304f5bedb770be8cab5f589706d316fb18a152ca16cb9d0663713fd`
- `prototype.c`: `1a295d18830c61a9708d465c3b1e415efb3ff8276100e4e32139bfa715195d8b`
- `normal-entry.tsv`: `b2841448068f70633ed0c02d901177a639cfed150f0e1c58977cc6c7b1e7313e`
- `SHA256SUMS`: `36b486617920b04ca87e88016e2fc0f519cda3a5f99dc675c9a89549615a02e3`

QEMU and the full feature suite were not run for this pre-source gate. The
gate uses host-created real EROFS images, independent binary parsing, normal
userspace namespace resolution, frozen DUT/FreeBSD control flow, and a
compiled prototype that is not linked into the DUT KLD.