[robertcantu-pure]

Updates docs/decision-flasharray-smb-20261107.md.

• Sections 4–7 accepted as written (maintainer confirmation, 2026-11-15): the tool is named permissionreset-smb, lives in smb/ and shares a contract with the NFSv4 tool, is tagged smb-vX.Y.Z independently starting at smb-v0.1.0, and is built and tested by a hosted Windows CI job. The status row says what isn't built yet: the smb-v* release workflow and the Set-SaclOnly Pester job.
• Section 8, question 1 answered (2026-11-12 lab run on FlashArray over SMB):
  • Inherited-form ACEs a client writes keep following the parent when they match what the parent passes down.
  • Inherited-form ACEs that don't match are a frozen copy that looks normal in a raw read.
  • One root write on a 51,100-object tree takes 3–4 ms, returns synchronously, and leaves 0 objects showing the old DACL.
  • Design consequence: objects that only inherit get no write; written objects take their inherited ACEs from the parent's stored DACL; parents are written before children.
• Question 3 answered: a DACL-only SMB write on an audited object leaves S:AI, D:AI and the SACL bytes unchanged.
• Question 2 (the SMB throughput ceiling) stays open. The record notes that the read rate may now set the ceiling.

Verification

• Documentation only; no code or behavior change.
• Public scan of the tree and origin/main..HEAD commits: clean.
• The section 8 text summarizes lab platform tests run with a lab harness (no product binary). It covers one array, one client, and stored audit rules only, not delivered audit events. Timings are indicative, because the runs weren't a timing hold on the array. Array load was not captured, and the Purity version was not re-read on the day. Detailed evidence is kept internally.

🤖 Generated with Claude Code