# K1561–K1565: read-only open rights

An open request takes a dentry token that the current mount table validates before any handle is published. This bounded table owns two value handles and a monotonic identifier. Two independent read-only opens of the same inode receive distinct identifiers. Closing each identifier releases exactly one slot.

Both mounts are read-only. A request containing either `write` or `create` returns `Erofs` before it reserves a slot, increments an identifier, or issues disk I/O. Invalid flags, stale dentries, full capacity, and identifier overflow also leave the table unchanged. The host test checks two successful opens, full-table refusal, `Erofs` with zero handles, and continued healthy read-only service.

This model has no writable backend or disk-write entry point. Real disk integrity is checked by the guest matrix fixture hash before and after each run. It does not by itself establish a full userspace `open` system call or product release acceptance.