vms-8d4: SHOW CLUSTER reflects real SCS membership (INV-DCL facade-kill)

[baron-3dl]

Problem

cmd_show_cluster() (src/vmsdcl/dcl_cmd_show.c) hardcoded %SYSTEM-I-NOTMEMBER unconditionally — so a genuinely-clustered node lied about being standalone, even though src/vmsscs/ implements the full SCS stack (datalink, NISCA VC, connection manager, MSCP serve, the vms-694 rejoin epic). The live membership lived only inside the SCSD process's in-memory peer table, unreachable by the separate DCL process. This is the top INV-DCL facade.

Fix — the real query path

Implements the local IPC that docs/design-cluster-node.md §3.1 already specifies ("SCSD exposes a local IPC ... to userspace consumers (SHOW CLUSTER, mount)"), in its simplest honest form: SCSD publishes its live member set to a well-known file; consumers read it. The file IS the daemon's real state (Rule 9 / INV-6) — not a per-process fake. When the daemon is down or this node has not joined, the file is absent and NOTMEMBER is the honest answer, exactly as a real non-member VMS node reports.

• src/vmsscs/include/scs_membership.h — header-only (all static inline, so no shareable-image symbol-vector wiring; sidesteps the native-link cascade). Byte format is an OVMX invention, labeled as such (Rule 8). Path resolves via $OVMX_CLUSTER_STATE_PATH, else <$OVMX_SYSGEN_PATH>.members, else a default.
• src/vmsscs/scsd.c — scsd_publish_membership() writes the live view (~1 Hz off the main loop): local node plus every peer whose VMS$VAXcluster connection reached OPEN (vaxcluster_open_reached) or that received the coordinator's post-commit membership burst (membership_bursts). Cleared on departure/exit.
• src/vmsdcl/dcl_cmd_show.c — reads the published view, renders the OpenVMS SHOW CLUSTER default report (NODE/SOFTWARE/STATUS banner, Rule 8 — modeled on public docs). Software version shown only for the local node (peer software is genuinely unknown, so not claimed).

Sibling audit

• F\$GETSYI("CLUSTER_MEMBER") / CLUSTER_NODES (src/libvms/syssvc/sys_misc.c) — shared the facade (read the static SYSGEN VAXCLUSTER flag / hardcoded 1). Fixed in-scope: both now read the same live membership, consistent with SHOW CLUSTER.
• SHOW CLUSTER/CONTINUOUS (SCACP live-updating TUI) — now shows the real snapshot rather than lying, but the continuous live-refresh screen is a larger piece of work. Filed as a follow-up, not a membership lie.

Tests (run foreground, all pass)

• tests/vmsscs/test_scs_membership.c — publish/read/clear round-trip at the real IPC boundary (does not mock the function under test): absent → NOTMEMBER; 2-node set round-trips; unknown-name peer keyed on SCSSYSTEMID; clear → NOTMEMBER.
• tests/integration/test_show_cluster_membership.sh — RUNS DCL against a membership file written in SCSD's own publish format (the real daemon↔DCL boundary): member set shown when present, NOTMEMBER when absent/empty, unknown-name peer shown by SCSSYSTEMID.
• Regression: vmsscs_scsd_wire_unit and all 27 fast scs-labelled tests green; runtime_target_gate + negctl green.

Requires lab-2 to fully verify: an end-to-end proof that SCSD actually publishes the file on a real 2-node join (this PR proves the wiring and the honest standalone/member split without a live cluster).

🤖 Generated with Claude Code