vms-3e8e: IMGACT activates images via IO$_ACCESS+READVBLK (ACP file access, ATOMIC-FLIP-GROUP — red-by-design)

[baron-3dl]

What

IMGACT (the freestanding image activator) now reads every image file over the executive Files-11 (ODS-2) ACP — $ASSIGN a file-class channel to the mounted volume, IO$_ACCESS the file by walking its directory chain, IO$_READVBLK its ELF header + PT_LOAD segments — instead of open()/pread()/mmap() on a /vms POSIX path. This retires IMGACT's leg of the /vms passthrough per docs/design-files11-acp-executive.md §4.6 (rung of epic vms-208).

Read-then-place first cut (read each region via READVBLK into the anonymous PT_LOAD span, exactly as load_object() already did with pread). Demand-page-through-the-window is the end state — noted as a follow-up.

Freestanding ACP-read approach

• src/imgact/imgact_acp.{c,h} — a self-contained freestanding ACP reader. It issues VMS_IOCTL_REGISTER (adopt-or-create the tgid PCB), ACP_ASSIGN, ACP_ACCESS, ACP_READVBLK, ACP_DEACCESS, DASSGN as raw ioctls on /dev/vms via three host primitives (imgact_acp_dev_{open,close,ioctl}). IMGACT backs them with syscall6; the QEMU test backs them with libc — so the test exercises the exact activator code, not a re-implementation.
• src/imgact/imgact.c — load_object, load_ovmx_producer, ovmx_find_section, apply_vms_rel, activate_symbol_vector all read through an imgsrc handle backed by the ACP. SYS_ioctl added to each arch header.
• No POSIX fallback (INV-6): no /dev/vms, boot volume not ACP-mounted, or file not on the ACP volume → honest %IMGACT-F-IMGNOTFND / SS$_NOSUCHDEV / SS$_NOSUCHFILE, never a silent /vms read.

Real-/dev/vms activation proof (run locally, QEMU kernel-executive harness)

New tests/qemu/test_syssvc_imgact_acp.c drives the freestanding reader against a real /dev/vms over a generated ODS-2 fixture (mkimage_ods2_imgact.c + imgact_acp_fixture_elf.h, a real ELF [IMGACT]TESTIMG.EXE) on a new 4th disk DKA300: (vdd):

=== test_syssvc_imgact_acp: 13 passed, 0 failed ===
  PASS: imgact_acp_open walks [IMGACT] and IO$_ACCESSes TESTIMG.EXE over the ACP
  PASS: the accessed image's valid-byte count (1424) matches the on-disk FH2
  PASS: IO$_READVBLK reads a well-formed ELF64 header at offset 0
  PASS: the ACP-read ELF header is BYTE-EXACT vs the on-disk image
  PASS: the ACP-read program-header table is BYTE-EXACT vs the on-disk image
  PASS: every PT_LOAD's p_filesz bytes, read at p_offset via IO$_READVBLK, are BYTE-EXACT vs the on-disk image
  PASS: the whole image read back over the ACP window is BYTE-EXACT vs the golden
  PASS: an image name not on the volume is SS$_NOSUCHFILE (no POSIX fallback, INV-6)
  PASS: a unit that is not an ACP-mounted volume is SS$_NOSUCHDEV (no POSIX fallback, INV-6)

test_kmod_disk updated for the 4th disk: 19 passed, 0 failed (its "no next disk" negative control moved to DKA400:).

Expected-red (ATOMIC-FLIP-GROUP contract)

Because boot does not yet ACP-mount SYS$DISK and the shipped images live on the POSIX /vms initramfs tree (not an ODS-2 ACP volume), every context that execs IMGACT to activate an image now fails honestly — via the %IMGACT-F-IMGNOTFND die path (imgact_acp_dev_open() → -1 → SS$_NOSUCHDEV, or the file not on the ACP volume → SS$_NOSUCHFILE), never a crash and never a /vms POSIX read:

A. In-guest (real /dev/vms) — MEASURED: test_syssvc_mmk_build — 1 assertion (IMGACT activated the MMK-driven OVMXRT.EXE and it RAN to exit 216). IMGACT IO$_ACCESSes DECC$SHR.EXE on DKA0: (the real-VAX fixture), which does not carry SYS0/SYSCOMMON/SYSLIB/DECC$SHR.EXE → SS$_NOSUCHFILE → OVMXRT doesn't run. Measured this run: 15 passed, 1 failed (honest, no crash). Everything else in the harness stayed green.

B. Plain-host native-link / symbol-vector activation CI jobs (no /dev/vms at all): every script that execs IMGACT.EXE to activate an image now fails-honest. From .github/workflows/ci.yml ("VMS-native LINK.EXE Graph via CMake" x aarch64/x86_64, and run_test): run_test.sh, run_test_x86_64.sh, run_symvec_activation.sh, run_shareable_import_activation.sh, run_libvmssys_native.sh, run_vmsprocess_native.sh, run_vmslnm_native.sh, run_vmsfs_native.sh, run_libvms_native.sh, run_vmsrms_native.sh, run_decc_shr_activation.sh, run_tls_producer_over_crtl.sh, run_exec_tls.sh, run_multiobj_exec.sh, run_multiobj_exec_x86_64.sh, run_dcl_native.sh, run_login_native.sh, run_link_native.sh, run_link_selfhost_native.sh, run_build_com_native.sh, run_tcc_native.sh, run_tcc_object_native.sh, run_tcc_rms.sh, run_tcc_selfhost.sh, run_tcc_asm_roundtrip.sh, run_olb_native.sh, run_known_images_lookup.sh, run_test_alpha.sh.

Stay GREEN: verify_imgact_cmake.sh / verify_imgact_cmake_x86_64.sh (build + readelf-check IMGACT, never execute it); test_imgact_bind / test_imgact_publish (in-process registry, not the freestanding reader).

C. QEMU boot-to-DCL / distro e2e that activate images from the boot SYS$DISK via IMGACT: fail-honest at the first activation until PID 1 ACP-$MOUNTs SYS$DISK (a later rung). Noted by inspection, not run locally.

The fix for all of the above is the atomic flip landing (PID 1 ACP-$MOUNTs SYS$DISK; the shipped images live on the ODS-2 volume). Hence:

⚠ DO NOT MERGE STANDALONE

ATOMIC-FLIP-GROUP member, red-by-design until the flip ACP-mounts SYS$DISK. Co-lands with the flip; does not merge on its own.

CLAUDE.md cascade

• New tests/qemu/test_syssvc_* suite → genuine negctl anchor imgact-acp-valid-bytes-offbyone added to facility_defects.sh (drops the - 1u in the valid-byte decode; reddens exactly the on-disk-geometry assertion, all reads stay byte-exact). FLOOR-NO-BUMP (anchor only). selftest passes.
• No libvmssys_shr.vec / SYS_VEC / native-link enumeration change: IMGACT reaches /dev/vms through its own freestanding ioctl wrappers, calling no vms_kif_* symbol (verified).
• No kernel-core change (device auto-enumeration already maps vdd→DKA300:).

🤖 Generated with Claude Code

[baron-3dl]

Closing as SUPERSEDED. The Files-11 ODS-2 executive ACP flip landed on main via the winning train (#633/#640/#641/#644/#654 -> #689 V0.5 -> #690/#696 V0.5-1), and the real VAX-side ACP flip landed as vms-329/PR #706. This PR is part of the parallel, CI-red work/vms-0.5-final integration branch (last touched Aug 20) that did not win the race; spot-checks found its runtime functionality already on main. Reopen if a specific piece here is found genuinely missing from main. -- conductor stale-queue cleanup (operator-authorized)