split out hash because rocky doesnt support it inline

docs/TODO.md

@@ -173,6 +173,18 @@ boot LAN.
     `/etc/udev/rules.d/95-nvmf-initqueue.rules`) — so the fully-native
     `rd.nvmf.discover` autoconnect path is available as a fallback if the unit
     doesn't fire on boot.
+  - **dm-verity: `hash-offset` is unsupported → two namespaces.** With NVMe
+    connecting and the right by-id device present, verity still failed:
+    `systemd-veritysetup` logged `unknown option 'hash-offset=…'` then `Failed
+    to load verity superblock` — exactly the CLAUDE.md bench-verify item. The
+    in-file (data+hash in one namespace, split by offset) layout is not
+    supported by Rocky 9.8 systemd. **Fixed** via the documented fallback:
+    `extract-artifacts.sh` now emits `rootfs.erofs` (data) + `rootfs.hash` (hash
+    tree) as separate files, served as **two NVMe namespaces** with distinct
+    pinned UUIDs (`f1ee7000-…-01` data, `…-02` hash); the cmdline uses
+    `systemd.verity_root_data=`/`systemd.verity_root_hash=` by-id devices with no
+    offset. Touches `extract-artifacts.sh`, `build-oci.sh` (artifact list +
+    SHA256SUMS), `serving/spdk-setup.sh` (2nd bdev/namespace), and invariant #9.
     **⚠ The secure path has the same dependency on the
     (absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
     must likewise drive `connect-all` (or the network-manager port #1 must wire

docs/design-v2-errata.md

@@ -4,7 +4,7 @@ Records where the as-built implementation diverges from
 `diskless-fleet-design-v2.pdf`. The PDF remains authoritative for the
 architecture; this note captures deltas discovered bringing the build up on
 **Rocky 9.8** until they are folded into a consolidated **v3**. Last updated
-2026-06-13.
+2026-06-15.
 
 The architecture is unchanged: 802.1X EAP-TLS with a TPM-held key, MACsec on the
 access link, dm-verity-protected erofs root over NVMe/TCP, signed UKI, and the
@@ -30,6 +30,33 @@ failure mode is NFS root — not applicable here (NVMe block root). Set in
 [../scripts/extract-artifacts.sh](../scripts/extract-artifacts.sh); module list
 in [../files/etc/dracut.conf.d/90-diskless.conf](../files/etc/dracut.conf.d/90-diskless.conf).
 
+## 1b. Design-level change — dm-verity uses two namespaces, not in-file offset
+
+**PDF says (§5):** the erofs data and the dm-verity hash tree share a single
+NVMe/TCP namespace, appended in one file and split on the host with
+`systemd.verity_root_options=hash-offset=`.
+
+**As built:** data and hash are **two separate namespaces** — `rootfs.erofs`
+(data) and `rootfs.hash` (hash tree) — each a file in the OCI artifact, served as
+its own NVMe namespace with a distinct pinned UUID. The cmdline uses
+`systemd.verity_root_data=` / `systemd.verity_root_hash=` by-id devices with no
+offset.
+
+**Why:** Rocky 9.8 `systemd-veritysetup` does not support `hash-offset=` — it
+logs `Encountered unknown option 'hash-offset=…', ignoring` then `Failed to load
+verity superblock: invalid argument`, so the single-namespace layout never maps
+`/dev/mapper/root`. Two namespaces is the design's own documented fallback and
+uses systemd's native verity (no custom activation code; keeps root-hash
+signature support for production). Devices are referenced by stable
+`/dev/disk/by-id/nvme-uuid.<uuid>` (not `/dev/nvmeNnM`) because controller
+indices shift with the transient discovery controller.
+
+**Touches:** [../scripts/extract-artifacts.sh](../scripts/extract-artifacts.sh)
+(emits `rootfs.hash`, two UUIDs, offset-free cmdline),
+[../scripts/build-oci.sh](../scripts/build-oci.sh) (artifact list + SHA256SUMS),
+[../serving/spdk-setup.sh](../serving/spdk-setup.sh) (2nd bdev/namespace), and
+CLAUDE.md invariant #9.
+
 ## 2. Implementation notes (not architectural)
 
 These don't contradict the PDF (it doesn't specify them) but are worth recording.