Bind the product to the executive: vms_kif_register() had zero callers, so every /dev/vms ioctl failed (vms-9fc)

[baron-3dl]

The shared substrate defect under every Phase 1 and Phase 3 item. vms_kif.h's own header documents the protocol — "1. open /dev/vms 2. Call vms_kif_register()" — and step 2 had zero callers product-wide. vms_module.c routes every ioctl except REGISTER through a lookup that returns -ESRCH for an unregistered process, so every /dev/vms call from the product failed.

The precedent was broken too

sys_lock.c is described throughout this epic as "the ONE facility already wired to /dev/vms", and every implementer was told to copy it. Its bind called vms_kif_open() and only vms_kif_open() — the same omission. So sys$ENQ/$DEQ was failing in the shipped product and had never been proven end-to-end. Copying the precedent propagated the defect.

Fixed once, at the KIF layer: kif_bind() completes open→register before every ioctl, and all 28 wrappers route through it. bind_to_executive() is deleted rather than repaired — per-facility binding is exactly what let four callers each forget the step.

One PCB per PROCESS, not per Linux thread

The first cut keyed binding on gettid(), which minted one VMS PCB per thread. Review proved it in QEMU: a pthread saw prcnam='' after the main thread's $SETPRN returned success, and event flag 41 clear after the main thread set it. That is the Rule 11 facade inverted — per-thread state pretending to be per-process. On OpenVMS a process has one PCB shared by all its threads; that is the entire meaning of a process-wide event flag cluster.

Now keyed on tgid on both sides, with vms_dev_release() gaining a whole-process liveness test so a thread exiting out of a live image cannot delete its process's PCB. Proven: a pthread using only public entry points sees the same executive entry, name, flag state, and can $DEQ the main thread's lock — 42/0. Minimal mutation tgid → pid: exactly 5 assertions red, all in the thread suite, every other suite green.

Post-exec register: ADOPT

Oracle-pinned, not chosen. VAX 7.3, SHOW PROCESS/ACCOUNTING across two further image activations: same Process ID 2020021D, same name, Images activated 19 → 21, no error. vms_ioctl_register() now adopts a task it already knows and returns SS$_NORMAL; the old 0x1C is deleted. Adoption deliberately does not re-apply init_privs — a process that can reset its own privileges by re-registering is declaring its own privileges.

A ninth wrong constant

SS$_ILLIOFUNC was 580 in both ssdef.h and vms_errno.h. The oracle says 244, and 580 is %SYSTEM-F-VASFULL — so every sys$qio rejecting an unimplemented function code reported "virtual address space is full." The claim that "consumers name the symbol, so none breaks" was false: dcl_lexical.c's F$MESSAGE table is keyed by number. Corrected in both copies plus the message table and docs, and bound with a _Static_assert so moving it again breaks the build.

A negative control that silently lied

test_runtime_target_negctl.sh went 13/20 with all seven check-3c controls reporting "the evasion was CERTIFIED, not caught." The gate was fine — the control was broken: its fixture injected into a function this branch deletes, so the injection became a silent no-op and the gate ran on an unmutated tree. Fixed structurally, not per-instance: expect_red now takes the file its injection should have changed and reports BROKEN FIXTURE (not a broken gate) if that file is byte-identical, before it will interpret any verdict. A meta-control uses the real dead anchor. 21/0.

Note on the evidence

A reviewer refuted the implementer's own proof: test_syssvc_lock.c bootstraps its own registration, so it reports 4/0 on main byte-identically and does not discriminate for this item at all. It then wrote an independent probe using only public sys$ calls and confirmed the underlying claim holds on the branch and fails on main. Conclusion survived; the evidence for it was replaced.

ci.yml's negative-control floor was recomputed from the merged tree by building the image — neither side of the conflict taken, since PR #15 had replaced the tally pin with per-suite verdicts.

🤖 Generated with Claude Code