# P15-092 Stage0 Decision

Status: `STOP`. B15 is `STOP-NO-SOURCE`; terminal static review status is
`TERMINAL_REVIEWED_NO_SOURCE`. No production source, B15 case, or B15 fixture
was created. Historical acceptance remains `NOT_TESTED`.

P15-092 is the G11 zero-nlink candidate. The frozen BASE is
`b22dae8dc634c68db4ea89dccade91350614c139`, the FreeBSD source HEAD is
`106727738dcfb6c001b46f25363b91cece970085`, the erofs-utils source HEAD is
`7db78788b000999e2de88decd2ba90654f26171c`, and the generator is
`mkfs.erofs (erofs-utils) 1.8.6`. Linux EROFS identity is frozen by the three
source hashes in `P15-092-input.json` and the Pre15 semantic audit hash ledger.

The final gate script and input SHA256 values are
`5943b85864da9095174ef51d1eed032ec6f0a1766c6465cb9660ea20cbd46b1e`
and `0a6f6c76185644d3f5525a98429a310027556ef3cf7ebb43abb912f92e052bde`.

## Real Disk Oracle

The gate creates the same deterministic source tree twice in forced compact
form and twice in forced extended form. It uses fixed UUID, timestamp, worker
count, xattr policy, and inline-data policy. Both complete host output trees
are byte-identical.

An independent parser reads the real superblock, checksum span, metadata block,
root NID, directory entries, compact `i_nb.nlink`, extended `i_nlink`, and the
compact `EROFS_I_NLINK_1_BIT` rule. It then materializes seven images:

- compact and extended positive seeds;
- namespace-reachable compact, extended, and directory inodes with nlink zero;
- a root inode with nlink zero;
- an unreachable inode with nlink zero, whose former name is redirected to a
  real hardlink NID and whose replacement link count is corrected to three.

Every derived image has a recomputed valid EROFS CRC32C. `dump.erofs --path`
resolves the actual directory edge and NID; no DUT helper or internal value
injection is used. All seven images, including all three namespace-reachable
zero-nlink images, pass `fsck.erofs -d0` with no error marker. The fixture-set
SHA256 is `99897d4fd81da015bdaa66a5dfdbf3f42e9e830882c0d8c979e691fa9209ee7a`.

Key deterministic host evidence SHA256 values are:

- `host-result.json`: `59a27e9389e2771c921d689f6b76caeb858f0fd28487a933529153727aac12e8`
- `disk-records.json`: `44bf0355dc5b34e93ec6868db9f9049de32500591b048a9016bf46aed9609485`
- `boundary.json`: `985df1236c6dd2016d6cb244b71578d36bd4cd10aa273b60a92d5bb6d24d5b60`
- `format-semantics.json`: `88efc1d7814103c044b36ff4dc3cac1dfa4da79f3d8955c682d1a60d9bfd9fcf`
- `fixture-index.json`: `4d2b69bcc31709ecb96cfafb41f5db8ffcc97215c3290cfa476d0b6c7fc27886`
- `source-anchors.json`: `ef9e6871d5fe1a3a6113f1172340269da4ea0c1692003aad0b0fee06ec4deb42`

## Linux and FreeBSD Semantics

Linux EROFS calls `set_nlink()` with the compact or extended disk value and has
no zero-nlink rejection in inode decode or super initialization. This is an
inode/link-count behavior, not a FreeBSD vnode publication rule. Linux and
FreeBSD both permit a live unlinked inode/vnode with link count zero; the
FreeBSD VM code explicitly treats `va_nlink == 0` as an unlinked mapping case.

The FreeBSD EROFS adapter has three distinct entry semantics:

1. `erofs_lookup()` owns a non-dot namespace edge and calls `erofs_vget()`.
2. `.vfs_vget = erofs_vget` is the raw NID entry used by VFS/root callers.
3. `erofs_fhtovp()` calls raw `VFS_VGET` and then maps `nlink == 0` to `ESTALE`.

Therefore Linux's direct `set_nlink()` behavior does not authorize either a
global FreeBSD rejection or a namespace-only rejection. The latter would be a
new FreeBSD validator policy, and the disk/fsck corpus supplies no format-level
rule requiring it.

## Publication Boundary

B09 moved the vnode constructor to `src/erofs_vnops.c`, but the frozen B15
write set is only `src/namei.c` and `src/inode.c`. `erofs_vget()` inserts the
constructing vnode in the hash, decodes the inode, marks it
`VSTATE_CONSTRUCTED`, and only then returns to `erofs_lookup()`.

A post-`erofs_vget()` check in `namei.c` is therefore too late to reject before
vnode publication. `vput()` alone does not perform the required `vgone`
cleanup. An unconditional `vgone()` cannot preserve an already cached vnode
obtained through raw `VFS_VGET`, because `erofs_vget()` does not return a
created-versus-hit indicator. Pre-reading through `erofs_read_inode()` would
duplicate complete inode decode and metadata I/O on every cold namespace
lookup, then decode the same inode again in `erofs_vget()`.

The four failed GO requirements are consequently:

- no format or cross-kernel rule requires reachable zero-nlink rejection;
- rejection before vnode publication is unavailable within the exact B15
  write set;
- post-publication cleanup cannot preserve cached raw VGET semantics;
- pre-reading would duplicate full inode decode for a low-value validator.

Namespace and raw entrypoints are distinguishable, and the orphan needs no
mount-wide scan, but those two facts do not outweigh the failed safety,
compatibility, and cost requirements. P15-092 is therefore STOP rather than a
partial or expanded-write-set implementation.

## Replay and Infrastructure

The authoritative deterministic host command was run twice:

```sh
timeout -k 10 240 tests/pre15/gates/P15-092.sh \
    --base b22dae8dc634c68db4ea89dccade91350614c139 \
    --output OWNED_OUTPUT --host-only
```

Both runs exit `22` with `STOP` and have byte-identical host output trees.

One supplemental isolated runtime attempt used the standalone
`/work/debug-qemu/local/vm/freebsd-build-runtime.qcow2`, not the protected base
bp, with a fresh overlay, random port, exact baseline KLD, 180-second boot
deadline, 60-second guest command deadlines, 900-second inner timeout, and
1200-second outer timeout. Run
`20260815T083854Z-qemu-P15-092-gate-runtime-1219662-0` was
`INFRA_BLOCKED`: guest SSH did not become ready before the boot deadline, so no
runtime vnode result is claimed. The run used only PID `1219981` and port
`49795`; it did not own PID `26318`, port `9222`, or the protected base bp.

Cleanup is `PASS`: the owned QEMU PID stopped, port `49795` is free, the
overlay and case temp were removed, and the standalone base SHA256 remained
`ae09f47aef43cfd016049610e86bcf2073fdf70430961bcdb94662facac9f046`.
The runtime manifest and cleanup SHA256 values are
`2e9a4220dc86c5d8fa465e77e6d81e5e36c0f26338b70d71a84881af8fc02cb9`
and `0a499d8fa3397f73998c6c3c3ae9dfc9070f61267a86361ba96d1e8bc64cb392`.

Because the reproducible host gate already fails mandatory GO conditions, the
runtime infrastructure block does not defer or weaken the STOP decision. It is
reported separately and was not retried with another long-running VM. B15,
TC021, TC025, TC182, K0, and B15 acceptance QEMU are `NOT_RUN` by the mandatory
STOP-NO-SOURCE rule. The full feature suite was not run.

## Terminal Static Review

The 2026-08-17 review rechecked the current `repo-pre-15`, Linux EROFS
implementation, P15-092 plan, frozen write set, and post-STOP history. It
found no format or cross-kernel requirement for namespace zero-nlink
rejection, no new B15 consumer or test target, and no safe implementation
entry within the frozen write set. The detailed evidence is
`planning/pre15/evidence/20260817T-B15-terminal-review/VERDICT.md`.

The terminal review does not convert the historical STOP or acceptance state:
`STOP_NO_SOURCE` and `NOT_TESTED` remain the authoritative historical values.