vms-buildtest-fix: keep the executive guarantee inside executive_attach() (Rule 9 gate)

[baron-3dl]

Problem

On work/vms-0.5-final the Build & Test job builds clean but ctest fails at the Test step. Root-caused on the k3s rail (real git clone) and the bare builder image, the genuine integration regression is:

• tests/qemu: gate the silent-fallback path and fix round-4 regressions (vms-1d9) #5 runtime_target_gate — FAILED
• Codify semantic fidelity and executive-residency as project rules 10 and 11 #8 runtime_target_negctl — FAILED (positive control re-runs tests/qemu: gate the silent-fallback path and fix round-4 regressions (vms-1d9) #5)

Each merged branch was green alone; the combination reddened the standing Rule 9 / INV-6 gate.

Root cause (merge interaction)

vms-46c-sysboot-acp refactored ovmx_init.c's executive_attach(). Pre-merge it was one function that loaded vms.ko, opened /dev/vms, captured the descriptor into executive_fd, halted on failure, pinned the fd, and printed %OVMX-I-EXEC inline. The refactor split that into executive_attach_silent() (capture+halt) + executive_announce() (printf) + a thin executive_attach() wrapper — needed because the conversational SYSBOOT> path must attach the executive before the prompt (the Files-11 ACP $MOUNT needs it) but print nothing until after.

But test_runtime_target.sh check 3 inspects the body of the function literally named executive_attach() for the capture, the terminal-halt branch, and the pin. After the refactor that body only delegates → gate reports "no ovmx_boot_open_executive() result is captured into a variable" and fails. The negctl was untouched by the merge, so its positive control failed with #5 and its 3b(h) mutation still anchored the executive_attach(void) signature.

Fix (code only — no test touched)

Move the guarantee back into executive_attach(): the load, the executive_fd = ovmx_boot_open_executive() capture, the if (executive_fd < 0) terminal ovmx_exec_halt(), the pinned file-static fd, and the %OVMX-I-EXEC printf all live in the one function the gate reads. The conversational path's need to defer the console line is met by a file-static executive_announce_deferred flag (set before the silent attach, emitted via executive_announce() after SYSBOOT>) — a deferral of the announce only; the capture+halt+pin guarantee is unconditional. Signature stays executive_attach(void) and the guarantee lines stay verbatim, so the gate and every negctl mutation (including 3b(h), which anchors the signature) match and trip exactly as before.

test_runtime_target.sh and test_runtime_target_negctl.sh are unchanged — no gate weakened, no allowlist added (CLAUDE.md Rule 9).

Verification

• Local: Rule 9 gate PASS; negctl 31/31.
• Full ctest on the k3s rail (real git clone, non-dind) — see run below.

Not part of this fix

dcl-integration (#117) fails on the bare builder/rail image because SET ACCOUNTING cannot write SYS$MANAGER:ACCOUNTNG.ENB with no populated VMS root. It fails identically on the pre-merge base commit 06e62f59, so it is a pre-existing environment artifact, not an integration regression.

🤖 Generated with Claude Code

[baron-3dl]

Closing as subsumed by the V0.5/V0.5-1 releases (the ACP flip). Its payload already shipped on main via the #689/#696 squash-merges; verified by content-diff (two independent triage passes). Subsumed AND regressive — main documents the executive_attach() Rule-9 guarantee under the newer OVMX_BOOT_ACP_BRIDGE/vms-329 ACP-only cutover; this branch reverts to the pre-vms-329 OVMX_BOOT_LINUX model. Merging would regress the ACP cutover. Branch is retained (not deleted) — reopen if you find genuine residue I missed.