# Test Case: Compact and Extended Timestamp Validation

**Test ID**: TC156-inode-timestamp-validation
**Category**: Inode Corruption
**Priority**: Critical
**Regression**: Timestamp arithmetic and conversion accepted malformed values

## Objective

Verify checked compact-inode epoch addition, nanoseconds below one billion for
both inode layouts, and rejection of unsigned seconds that cannot be represented
by FreeBSD 15 amd64 `time_t`.

## Fixtures

Generate the review fixtures with `tests/review_fixtures.py`. Its structured
field assertions produce:

| Image | Malformed field | Trigger |
|---|---|---|
| `compact-epoch-wrap.erofs` | `epoch=UINT64_MAX`, root `i_mtime=1` | `uint64_t` addition overflow |
| `compact-epoch-range.erofs` | `epoch=INT64_MAX`, target `i_mtime=1` | result exceeds signed 64-bit `time_t` |
| `compact-nsec-invalid.erofs` | `fixed_nsec=1000000000` | invalid compact nanoseconds |
| `extended-nsec-invalid.erofs` | target `i_mtime_nsec=1000000000` | invalid extended nanoseconds |
| `extended-seconds-range.erofs` | target `i_mtime=INT64_MAX+1` | seconds exceed `time_t` |

Every image must pass the helper's EROFS field-location and CRC32C checks before
guest transfer.

## Procedure

1. For `compact-epoch-wrap.erofs`, attach the image and trace the mount. The
   mount must fail with `ERR#97` when the root inode is decoded.
2. For `compact-nsec-invalid.erofs`, trace the mount. Superblock timestamp
   validation must fail with `ERR#97` before a vnode is returned.
3. Mount `compact-epoch-range.erofs`. The root timestamp at `INT64_MAX` remains
   representable, but `stat /zz-identity.txt` must fail with `ERR#97`.
4. Mount each extended fixture. The root remains usable, while
   `stat /extended-time.txt` must fail with `ERR#97` for the targeted field.
5. Repeat every failing access, compare dmesg, and clean the mount and md unit
   after each image.

## Expected Results

- Compact epoch addition overflow returns `EINTEGRITY`, not a wrapped time.
- Exactly `999999999` remains the maximum accepted nanosecond value;
  `1000000000` is rejected for compact and extended timestamps.
- `INT64_MAX` seconds is accepted on the qualified amd64 ABI, while
  `INT64_MAX+1` is rejected before assignment to `timespec.tv_sec`.
- No malformed inode creates a vnode with normalized, negative, or wrapped
  timestamps, and no panic or assertion occurs.