> > - how does it handle fileid recycles?
> 
> It doesn't and it won't. The code that makes use of metahook(9) needs
> to do this. Look at Veriexec.

if it doesn't handle normal filesystem activities, what's the point of
making it filesystem-specific?

> > - "inode" is a filesystem dependent term.
> 
> Is there an alternative?

"file"?

> > - using dev_t here seems weird to me.  isn't it better to use
> >   a pointer to struct mount?
> 
> Aren't they really the same? what is the benefit?

it's straightforward, IMO.

YAMAMOTO Takashi