SET PROCESS/NAME writes the executive process table, untruncated, and refuses like VMS (vms-fbe)

[baron-3dl]

Closes vms-fbe — SET PROCESS/NAME writes the process name into per-process memory.

Three rounds. Rounds 1 and 2 were each refused by an adversary; round 3 was verified MERGEABLE by the same adversary that found the round-2 defect.

What lands

SET PROCESS/NAME now writes the executive's process table through the same vms_kif_setprn path $CREPRC uses; ctx->process_name updates on success only, so a refused rename cannot locally claim a name the executive rejected.

tests/qemu/test_syssvc_setname.c is a genuine A-writes / B-reads proof across four separate DCL.EXE processes (Rule 11): one sets its name and stays alive; the executive's own row carries it via vms_kif_procscan — the same reader SHOW SYSTEM uses; a second independent DCL.EXE names it at the right pid; a third is refused for the duplicate; a fourth succeeds once the holder exits.

Round 2 fixed the truncation defect: upname was sized sizeof(ctx->process_name) (16) instead of VMS_PRCNAM_XFER (64), so an oversized name was truncated before it reached the executive and the executive never got the chance to refuse it — the exact defect that constant exists to prevent. The refusal now renders in the oracle's two-line shape (%SET-E-NOTSET / -SYSTEM-F-<ident>) per the VAX V7.3 transcript at src/kernel/vms_ioctl.h:653-658. No constant was self-certified: SS$_DUPLNAM (148) and SS$_IVLOGNAM (340) were oracle-pinned by vms-8019.

Round 3 is test-only — git diff 91b0770..7108c16 -- src/ is empty. Round 2 had shipped a new vacuous assertion of the class it was opened to kill: P6's "name unchanged after refusal" scanned the whole capture, which holds two SHOW SYSTEM outputs, and matched the row printed before the rename. Round 3 cuts the capture at the refusal message and searches only the tail.

Evidence

Rebuilt from a clean git archive, judged by the FINAL RESULTS line and the SUITE banners:

• Clean: 27 SUITE banners, none non-zero · FINAL RESULTS: 29 suites passed, 0 suites failed · 713 PASS / 0 FAIL · test_syssvc_setname 18/18
• Mutation FACILITY_DEFECT=proctab-duplicate-name: red set exactly {test_kmod_procnam, test_syssvc_procnam, test_syssvc_setname, test_syssvc_startup_service} — 5 unique FAIL lines matching require_fail(2) + knock_on_fail(3) verbatim; setname 17/1 (P4 only)
• nm on /initramfs/bin/DCL.EXE confirms vms_kif_setprn is genuinely imported

The P6 fix was settled by execution, not by review — sys_row_for copied verbatim into a standalone harness, round 2 vs round 3 over six inputs:

input	r2	r3
faithful capture	GREEN	GREEN
refusal wiped the name	GREEN	RED
refusal message absent entirely	GREEN	RED
round-1 single-line shape	GREEN	RED
name truncated	GREEN	RED
control row under another pid	GREEN	GREEN

Round 2 was green on all four defect shapes — fully vacuous, as charged. The strstr cut returns NULL rather than re-searching from byte 0, so there is no silent fallback.

Known and named, not hidden

• Hardcoded continuation strings are not derived from run_print_condition() / sys$getmsg — out of scope, left named.
• test_syssvc_setname.c:423 prose still describes the superseded single-line shape.
• P6 does not pid-check its row the way P3 does.
• SET PROCESS/NAME="" is a silent no-op and SET PROCESS/NAME="OVMXFBE!BAD" is accepted — both observed, not oracle-pinned, reported as facts rather than asserted as right or wrong.

Judge CI by its own result: vms-b1f records that tests/qemu/run_tests.sh can exit 1 on a fully green run via pipefail+SIGPIPE, but that is host-sensitive and does not fire on GitHub runners.

🤖 Generated with Claude Code

[baron-3dl]

Round 4 — f4a59d7, both CI gates closed

The first push of this PR failed two checks. Both were test defects; src/ is untouched by this round — the product was already correct on both counts.

1. Kernel Executive — Negative Control. CI reported "a public sys$ entry point reported SUCCESS with no executive present: a fabricated success." That diagnosis was wrong — both fabricated-success assertions passed. Filed as vms-c9c: the job infers one cause from rc=1, but its own comment says rc=1 has at least two.

What DCL.EXE actually does with no /dev/vms, executed rather than reasoned — it does not crash; 139 bytes, exit 0:

%OVMX-E-SETPRNFAIL, SET PROCESS/NAME could not reach the executive (status %X000002A4)

The failing assertion was a crash proxy matching %DCL- / %SYSTEM- / $, whose substrings don't include the message the product emits — and a piped DCL prints no $ prompt. The OVMX-branded shape is correct: an absent executive is a condition VMS never faces, so inventing a %SYSTEM- message would itself be the Rule 10 defect.

The assertion now pins that refusal positively — green on the real capture only, red on silent success, on a crash, on truncation, and on an invented %SET-E-NOTSET. The old disjunction was green on a silent userspace fallback printing a bare $ — precisely the Rule 9 defect this gate exists to catch.

2. Per-Facility Negative Controls — bind-client-no-register. test_syssvc_setname exited rc=141 (SIGPIPE): the suite writes a script into a pipe whose reader DCL.EXE exits first once the bind is deleted. Fixed with the remedy test_syssvc_showterm.c:392-405 already uses for the identical failure under the identical control. The suite then runs to completion, so CI's 3 truncated reds became 7 — all declared in knock_on_fail / knock_on_why, none narrowed away.

Measured, both builds run this time

run	result
Negative control	test_syssvc_setname rc=77, 5 passed / 0 failed; every test_syssvc_* at 77
Clean	27 SUITE banners rc=0 · FINAL RESULTS: 29 suites passed, 0 suites failed · 713 PASS / 0 FAIL · setname 18/18
bind-client-no-register	setname rc=1 (was 141); no strays; red set 118 named = 118 observed; all 5 blind suites green
proctab-duplicate-name	red set preserved exactly — {test_kmod_procnam, test_syssvc_procnam, test_syssvc_setname, test_syssvc_startup_service}, setname 17/1 (P4 only)

Note for reviewers

run_facility_negctl.sh cannot be driven on the workshop dev host at all: its own pristine positive control exits 1 through the pre-existing pipefail+SIGPIPE bug in run_tests.sh, so it refuses to inject. Round 4 replayed its checks 4/5/6/7 against the real captured run using the script's own extractors verbatim. That is now the second agent forced into the same manual substitute, so vms-b1f has been raised to p1. It is host-sensitive and does not fire on GitHub runners — judge this PR by CI, not by a local container exit code.

🤖 Generated with Claude Code

[baron-3dl]

CI is green at f4a59d7 — 35/35 checks pass, including the two that refused round 3: Kernel Executive — Negative Control and Kernel Executive — Per-Facility Negative Controls (attribution).

Left as a draft deliberately: the merge decision is the operator's. vms-fbe is the only one of the three vms-14f frontier branches at this state — vms-ecf and vms-cb5 are both in round 4.