split out hash because rocky doesnt support it inline

docs/design-v2-errata.md

@@ -4,7 +4,7 @@ Records where the as-built implementation diverges from
 `diskless-fleet-design-v2.pdf`. The PDF remains authoritative for the
 architecture; this note captures deltas discovered bringing the build up on
 **Rocky 9.8** until they are folded into a consolidated **v3**. Last updated
-2026-06-13.
+2026-06-15.
 
 The architecture is unchanged: 802.1X EAP-TLS with a TPM-held key, MACsec on the
 access link, dm-verity-protected erofs root over NVMe/TCP, signed UKI, and the
@@ -30,6 +30,33 @@ failure mode is NFS root — not applicable here (NVMe block root). Set in
 [../scripts/extract-artifacts.sh](../scripts/extract-artifacts.sh); module list
 in [../files/etc/dracut.conf.d/90-diskless.conf](../files/etc/dracut.conf.d/90-diskless.conf).
 
+## 1b. Design-level change — dm-verity uses two namespaces, not in-file offset
+
+**PDF says (§5):** the erofs data and the dm-verity hash tree share a single
+NVMe/TCP namespace, appended in one file and split on the host with
+`systemd.verity_root_options=hash-offset=`.
+
+**As built:** data and hash are **two separate namespaces** — `rootfs.erofs`
+(data) and `rootfs.hash` (hash tree) — each a file in the OCI artifact, served as
+its own NVMe namespace with a distinct pinned UUID. The cmdline uses
+`systemd.verity_root_data=` / `systemd.verity_root_hash=` by-id devices with no
+offset.
+
+**Why:** Rocky 9.8 `systemd-veritysetup` does not support `hash-offset=` — it
+logs `Encountered unknown option 'hash-offset=…', ignoring` then `Failed to load
+verity superblock: invalid argument`, so the single-namespace layout never maps
+`/dev/mapper/root`. Two namespaces is the design's own documented fallback and
+uses systemd's native verity (no custom activation code; keeps root-hash
+signature support for production). Devices are referenced by stable
+`/dev/disk/by-id/nvme-uuid.<uuid>` (not `/dev/nvmeNnM`) because controller
+indices shift with the transient discovery controller.
+
+**Touches:** [../scripts/extract-artifacts.sh](../scripts/extract-artifacts.sh)
+(emits `rootfs.hash`, two UUIDs, offset-free cmdline),
+[../scripts/build-oci.sh](../scripts/build-oci.sh) (artifact list + SHA256SUMS),
+[../serving/spdk-setup.sh](../serving/spdk-setup.sh) (2nd bdev/namespace), and
+CLAUDE.md invariant #9.
+
 ## 2. Implementation notes (not architectural)
 
 These don't contradict the PDF (it doesn't specify them) but are worth recording.