# P15-087 Stage0 Decision

Status: `STOP`. B12 is `STOP-NO-SOURCE`; no production source, B12 case, or
B12 fixture is authorized.

The final decision uses frozen DUT BASE
`c7d692acf9166f5c5e42335db2de64f0793ba8a2`, FreeBSD source HEAD
`106727738dcfb6c001b46f25363b91cece970085`, and
`mkfs.erofs (erofs-utils) 1.8.6`. The final gate script and input SHA256 values
are `349720b900ad2288153c9830f5f5ee84b8da707c06ffabcbd8e3e7a7e89f9e2a`
and `cb3aaa6c780c7b1efbd7c339f2b2da2ed8bf38d3ba32229dc17996807fd00787`.

## Workload and Independent Oracle

The gate deterministically creates 18,000 long-name regular files. Since
erofs-utils tailpacks the root directory even with `-E noinline_data`, the
generator moves the final 1,456-byte tail into one appended contiguous block,
changes only the root layout from flat-inline to flat-plain, increments the
superblock block count, and recomputes CRC32C. A second generation is
byte-identical and `fsck.erofs -d0` exits zero.

The independent parser does not call DUT code. It verifies a 3,880,368-byte
flat-plain directory at physical block 282, covering 948 contiguous 4 KiB
blocks and 18,002 entries. Its expected final cookie is 3,880,368 and its
record FNV64 is `427bb414efa99dc0`; the random offset is 1,937,408. The fixture
SHA256 is `3ecc5b706dd43b734c7e14a648a2bed2fb97a9f7963d4db703d15de81dc07a9d`.
The immutable `oracle.json` SHA256 is
`f247bbe5029301265342ff2098fcbd463a25e4752608826cbc1126d6620ef5d6`.

The generated prototype patch SHA256 is
`33b25131a611eec9c8731e88e4c258dfc92fe5897dd6781b6c95414a846dd2d1`.
Static extraction proves that it calls `breadn` only on the mapped backing
`devvp`, does not call `breadn` on the EROFS directory vnode, caps the window
at exactly 1 MiB, gates readahead on an offset-zero sequential readdir, and
adds no VM entrypoint, vnode lock, GEOM ownership operation, `cluster_read`,
or errno token. The `semantic-ledger.json` SHA256 is
`d26dbc37f4f34f65d07745a1b8069217d18545436d7f16f24e775e8c2db1a6b3`.
This closes the static design boundary but cannot replace runtime proof.

## Quantitative Decision

| Required G11 measurement | Required | Valid result | Decision |
|---|---:|---:|---|
| Cold sequential runs | 5 baseline + 5 prototype | 0 + 0 | FAIL: no median |
| Median latency improvement | at least 10% | not measurable | FAIL |
| Extra provider reads | at most 25% | not measurable | FAIL |
| Readahead window | at most 1 MiB | 1 MiB static cap | PASS |
| Random seek readahead | zero | 0 valid runtime samples | FAIL: not verified |
| Hash/cookie equality | exact independent oracle | 0 valid runtime samples | FAIL: not verified |

No run produced `runs.tsv`; therefore no latency, read-transfer, random-no-op,
or runtime hash/cookie value is claimed. It would be dishonest to infer GO
from the static prototype, from QEMU startup, or from build progress. Because
the workload could not be measured credibly and repeatably, G11's explicit
rule requires low-confidence STOP even though the 1 MiB static bound passes.

## Replay Ledger

The authoritative command shape was:

```sh
timeout -k 30 1200 tests/pre15/gates/P15-087.sh \
    --base c7d692acf9166f5c5e42335db2de64f0793ba8a2 \
    --output OWNED_OUTPUT
```

Existing evidence was retained long enough to hash and reconcile before
repository cleanup:

| Run ID | Result before any benchmark sample |
|---|---|
| `20260815T044720Z-G11-P15-087` | Superseded generator STOP: mkfs root remained flat-inline |
| `20260815T044924Z-G11-P15-087` | `INFRA_BLOCKED`: 12 boot-time providers exceeded SSH deadline |
| `20260815T045505Z-G11-P15-087` | `INFRA_BLOCKED`: FreeBSD did not enumerate PCI-hotplugged virtio-blk devices |
| `20260815T050003Z-G11-P15-087` | `INFRA_BLOCKED`: guest benchmark declaration error |
| `20260815T050520Z-G11-P15-087` | `INFRA_BLOCKED`: baseline KLD load did not reach workload |
| `20260815T051933Z-G11-P15-087` | `INFRA_BLOCKED`: phased baseline KLD load did not reach workload |
| `20260815T053543Z-G11-P15-087` | `INFRA_BLOCKED`: exact-basename baseline KLD load did not reach workload |
| `20260815T054540Z-G11-P15-087` | Aborted on instruction; owned process group terminated and audited |

Each completed QEMU ownership record reports that the owned port was free
after cleanup, protected PID 26318 retained the same identity, protected port
9222 was not used, and `/work/build/vm-freebsd-build.qcow2.bp` retained inode,
size, mtime, and ctime. The interrupted run used owned PID 1172175 and port
49845; both were absent after targeted process-group cleanup. Final process
audit found only protected QEMU PID 26318.

## Semantic and Batch Consequences

Runtime preservation of FreeBSD vnode, VM, locking, GEOM, errno, hash, and
cookie behavior was not established. Correctness may not depend on
readahead, so static plausibility is insufficient. P15-087 is STOP for Pre15,
B12 remains absent, and no host feature case, K0 build, TC183 QEMU acceptance,
or full feature suite is run. Rollback is the single gate decision commit;
there is no source commit to revert.