Keep tutorial prose on the user path

Author: Littlefisher619

src/51-tcp-quarantine/README.md

@@ -431,7 +431,7 @@ When `bpf_sock_destroy` tears down a socket, the kernel executes the protocol's
 - Writes may produce `EPIPE` with a `SIGPIPE` signal.
 - The exact behavior varies by kernel version and the timing of operations.
 
-The test included with this tutorial accepts any of these as valid indicators that the connection was torn down.
+Treat any of these outcomes as application-visible evidence that the connection was torn down; confirm the exact behavior expected by your application and kernel version.
 
 ## Building and Running
 

src/51-tcp-quarantine/README.zh.md

@@ -429,7 +429,7 @@ sudo nsenter --net=/proc/<target-pid>/ns/net -- ./tcp_quarantine \
 - 写操作可能产生 `EPIPE` 并伴随 `SIGPIPE` 信号。
 - 具体行为因内核版本和操作时机而异。
 
-本教程附带的测试接受以上任何一种作为连接被拆除的有效指示。
+这些结果都可能表示连接已经被拆除；请结合你的应用行为和内核版本确认预期现象。
 
 ## 编译与运行
 

src/52-fsession-latency/README.md

@@ -4,7 +4,7 @@ When a file-backed service shows read-latency spikes, application-level timing t
 
 This tutorial demonstrates how to measure `vfs_read` call latency using the **fsession** mechanism introduced in Linux 7.0. fsession is a new eBPF program type that runs once at function entry and once at return, with built-in per-invocation storage for correlating the two phases. The tool timestamps function entry, computes latency at return, filters by process and threshold, and reports the object type plus a `major:minor:inode` identity through a ring buffer.
 
-`vfs_read` is not limited to regular files: pipes, character devices, and other file-backed objects also pass through it. A slow event therefore identifies a slow `vfs_read` call, not necessarily slow storage. The deterministic test below deliberately uses a pipe and labels it `type=fifo`; it separately checks that ordinary file reads are labeled `type=regular`.
+`vfs_read` is not limited to regular files: pipes, character devices, and other file-backed objects also pass through it. A slow event therefore identifies a slow `vfs_read` call, not necessarily slow storage. Use the reported `type` together with the `major:minor:inode` identity to distinguish regular-file reads from FIFOs and other VFS objects.
 
 > Complete source: <https://github.com/eunomia-bpf/bpf-developer-tutorial/tree/main/src/52-fsession-latency>
 

src/52-fsession-latency/README.zh.md

@@ -4,7 +4,7 @@
 
 本教程展示如何使用 Linux 7.0 引入的 **fsession** 机制测量 `vfs_read` 调用延迟。fsession 是一种新的 eBPF 程序类型，它在函数进入时执行一次、返回时再执行一次，并提供内置的调用级存储来关联这两个阶段。工具会在函数进入时记录时间戳、返回时计算延迟，按进程和阈值过滤后，通过 ring buffer 上报对象类型和 `major:minor:inode` 身份。
 
-`vfs_read` 不只处理普通文件，pipe、字符设备等文件对象也会经过它。因此慢事件表示某次 `vfs_read` 较慢，并不必然说明存储较慢。下面的确定性测试故意使用 pipe，并将其标成 `type=fifo`；它还会单独检查普通文件读被标成 `type=regular`。
+`vfs_read` 不只处理普通文件，pipe、字符设备等文件对象也会经过它。因此慢事件表示某次 `vfs_read` 较慢，并不必然说明存储较慢。应结合输出中的 `type` 和 `major:minor:inode` 身份，区分普通文件读、FIFO 以及其他 VFS 对象。
 
 > 完整源码：<https://github.com/eunomia-bpf/bpf-developer-tutorial/tree/main/src/52-fsession-latency>