vms-buildtest-fix: keep the executive guarantee inside executive_attach() (Rule 9 gate)

.github/workflows/ci.yml

@@ -4167,6 +4167,35 @@ jobs:
               sh /src/src/imgact/test/run_tls_producer_over_crtl.sh
             '
 
+  weak-import-activate:
+    name: Weak-by-name Import (.vms$wimp) — LOGINOUT reaches RMS across the layer cycle
+    needs: changes
+    if: ${{ github.event_name != 'pull_request' || needs.changes.outputs.toolchain == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Native x86_64 (no emulation): the LINK-level assertions are the gate here
+      # — a #pragma-weak reference no --use'd producer exports lands in .vms$wimp
+      # (NOT baked to 0, NOT a link error), and binds STRONG (.vms$imp) when an
+      # exporter IS --use'd. The by-name ACTIVATION half needs a real /dev/vms
+      # ACP (INV-6: IMGACT has no POSIX image-read fallback), which this container
+      # lacks by construction — that half is proven by the boot-to-DCL login
+      # (uat-session), so the script runs the LINK assertions and notes the split.
+      - name: Record + bind a weak cross-image reference through LINK.EXE/.vms$wimp (x86_64)
+        run: |
+          docker run --rm \
+            -v "${{ github.workspace }}":/src -w /src \
+            docker.io/library/alpine:3.20 sh -c '
+              set -e
+              apk add --no-cache gcc musl-dev binutils make python3 >/dev/null
+              export CC=gcc WORK=/tmp/weak-import-act
+              sh /src/src/imgact/test/run_weak_import_activation.sh
+            '
+
   vmsprocess-native:
     name: vmsprocess VMS-native Migration (LIBVMSPROCESS$SHR)
     needs: changes

distro/Dockerfile.bootable

@@ -567,7 +567,24 @@ RUN mkdir -p /system-stage/dev /system-stage/proc /system-stage/sys \
     # HELP built-in (src/vmsdcl/dcl_help.c) and HELP.EXE walk. Without it the
     # booted system's HELP has no library to read and every topic fails.
     cp -r distro/rootfs/vms/SYS0/SYSCOMMON/SYSHLP/. /system-stage/vms/SYS0/SYSCOMMON/SYSHLP/ && \
+    # SYSUAF.DAT (vms-d92 atomic flip): the shipped distro/rootfs SYSUAF.DAT is
+    # now the GENUINE binary $UAFDEF RMS Prolog-3 indexed file (generated by
+    # tools/mksysuaf -- the seed's generator of record; run it to regenerate when
+    # the default account set changes), NOT an ASCII+SHA-256 file. It is the same
+    # bytes the runtime reads back over the ODS-2 ACP (the record format is
+    # substrate-agnostic). A single committed seed keeps every harness that copies
+    # it (qemu, alpha, native login) byte-identical to the runtime.
     cp distro/rootfs/vms/SYS0/SYSCOMMON/SYSEXE/SYSUAF.DAT /system-stage/vms/SYS0/SYSCOMMON/SYSEXE/ && \
+    # RIGHTSLIST.DAT (vms-f15a atomic flip): the shipped distro/rootfs
+    # RIGHTSLIST.DAT is now the GENUINE binary $RDBDEF RMS Prolog-3 indexed file
+    # (generated by tools/mkrightslist -- the seed's generator of record; run it
+    # to regenerate when the shipped identifier set changes), NOT an ASCII
+    # colon-delimited file. It is the same bytes the runtime reads back over the
+    # ODS-2 ACP via $ASCTOID/$IDTOASC (rightslist_live.c). It carries BOTH
+    # general AND per-account UIC identifiers (vms-930) and is mastered
+    # WORLD-READABLE (World:R, vms-109), so an unprivileged F$IDENTIFIER
+    # resolves an identifier by reading it directly, without SYSPRV and without
+    # touching the protected (World:none) SYSUAF.
     cp distro/rootfs/vms/SYS0/SYSCOMMON/SYSEXE/RIGHTSLIST.DAT /system-stage/vms/SYS0/SYSCOMMON/SYSEXE/ 2>/dev/null ; \
     # OVMXVMSSYS.PAR (vms-d34): the initial SYSGEN parameter file, seeded
     # with factory defaults (SCSNODE=OVMX). Staged UNVERSIONED, same
@@ -705,6 +722,30 @@ RUN mkdir -p /kit-stage/SYSEXE /kit-stage/SYSLIB /kit-stage/SYSMGR /kit-stage/SY
     cp /boot/ovmx-os.kit /system-stage/vms/SYS0/SYSCOMMON/SYSUPD/OVMX-OS.KIT && \
     echo "OK: ovmx-os.kit staged at SYS\$UPDATE:OVMX-OS.KIT for the distrib image"
 
+# vms-738 per-file protection PROOF fixture. Build a tiny second kit whose one
+# file (PROOFPROT.DAT, an ORDINARY name -> per-file CLASS default 0xAA00 =
+# G:RE,W:RE) is then OVERWRITTEN in the kit index to a DIVERGENT protection
+# 0xFF00 (S:RWED,O:RWED,G:,W: -- system+owner only), the case a real PCSI kit
+# authors and the case that DISTINGUISHES "installer honoured the kit's
+# ke_protection" from "installer took the create-time class default" (the two
+# coincide for every ordinary file, so only a divergent entry proves the fix).
+# ke_protection sits at byte 128 of the 160-byte entry; the index starts at the
+# 128-byte header end -> absolute offset 256 for a single-file kit. The `list`
+# re-read below is a FAIL-CLOSED guard: if that layout ever drifts, the image
+# build breaks here (loudly) rather than the e2e silently proving nothing.
+# tests/qemu/test_product_install_e2e.sh installs this over the ACP and asserts
+# the installed file's ODS-2 fh2_fileprot reads back 0xFF00, not the default.
+RUN mkdir -p /proof-stage/SYSEXE && \
+    printf 'vms-738 per-file protection proof fixture\n' > /proof-stage/SYSEXE/PROOFPROT.DAT && \
+    /src/build-static/bin/ovmx_kit_pack pack /boot/proof-prot.kit /proof-stage "PROOFPROT" && \
+    printf '\000\377' | dd of=/boot/proof-prot.kit bs=1 seek=256 count=2 conv=notrunc status=none && \
+    PROOFLINE=$(/src/build-static/bin/ovmx_kit_pack list /boot/proof-prot.kit | grep 'PROOFPROT.DAT') && \
+    echo "proof kit entry after patch: $PROOFLINE" && \
+    echo "$PROOFLINE" | grep -qF '(S:RWED,O:RWED,G:,W:)' \
+        || { echo "FAIL: proof-prot.kit patch did not yield the divergent 0xFF00 protection (kit layout drift?)"; exit 1; } && \
+    cp /boot/proof-prot.kit /system-stage/vms/SYS0/SYSCOMMON/SYSUPD/PROOF-PROT.KIT && \
+    echo "OK: proof-prot.kit staged at SYS\$UPDATE:PROOF-PROT.KIT (divergent 0xFF00, vms-738 proof)"
+
 # -- Distribution system-disk image (vms-8ab) ----------------------------------
 # Master a PRE-INSTALLED, bootable VMSFS system disk from the SAME populated
 # /vms system tree the system-tree staging stage just assembled above (/system-stage/vms:
@@ -728,54 +769,58 @@ RUN mkdir -p /kit-stage/SYSEXE /kit-stage/SYSLIB /kit-stage/SYSMGR /kit-stage/SY
 # policy (SYSTEM UIC [1,4], every file version ;1, the OVMXSYS volume label) is
 # an OVMX build-tool choice, not a VMS-authentic fact.
 #
-# 64 MB matches the system-disk convention used everywhere else (boot.sh /
-# run-qemu.sh / test_persistent_boot.sh all size a blank DKA0: at 64M) and
-# leaves free space for runtime writes (e.g. PARTS creating its indexed data
-# file), while staying well above the tree's own footprint.
-RUN /src/build-static/bin/vmsfs_master master \
-        /boot/ovmx-distrib.img OVMXSYS /system-stage/vms 64 && \
-    /src/build-static/bin/vmsfs_master list /boot/ovmx-distrib.img && \
-    # Ground-source gate, baked into the build: extract the mastered image back
-    # out with the tool's round-trip reader and prove the login chain the boot
-    # depends on (LOGINOUT -> DCL, via IMGACT, established by PROVISION) is
-    # actually PRESENT on the disk and byte-identical to what the system-tree
-    # staging stage staged. A mastered image that does not carry these cannot
-    # reach a login prompt, so this is checked here, not merely asserted
-    # downstream.
-    rm -rf /tmp/distrib-verify && \
-    /src/build-static/bin/vmsfs_master extract /boot/ovmx-distrib.img /tmp/distrib-verify && \
+# 128 MB (vms-5f0): the genuine ODS-2 system volume must hold the full static
+# system tree PLUS the redundant SYS$UPDATE:OVMX-OS.KIT copy, which together sit
+# right at the old 64 MB edge and overflow it -- ODS-2 gives every file at least
+# one 512-byte block and no cross-file packing, so it needs a little more room
+# than the retired VMFS master did for the same tree. 128 MB clears the tree +
+# kit and still leaves free space for runtime writes (e.g. PARTS creating its
+# indexed data file). Blank DKA0: disks (boot.sh / run-qemu.sh /
+# test_persistent_boot.sh) stay 64M -- those hold no system tree.
+# ATOMIC FLIP (vms-5f0, epic vms-208): the boot master emits a GENUINE ODS-2
+# (DECFILE11B) volume by default (--ods2), NOT the bespoke OVMX VMFS format.
+# SYS$DISK is now $MOUNTed by the Files-11 ACP in the executive (ovmx_init.c),
+# so the disk the boot mounts must be real ODS-2. The ground-source gate reads
+# it back with the tool's GENUINE ODS-2 reader (`--ods2 list`, ods2_bdev_*) --
+# the same codec the ACP uses -- and proves the login chain (LOGINOUT -> DCL, via
+# IMGACT, established by PROVISION) is PRESENT on the ODS-2 volume. (Byte-exact
+# read-back off the ODS-2 volume is proven by the QEMU ACP tests
+# tests/qemu/test_syssvc_dirlogical_acp.c / _rms_acp.c against a real /dev/vms;
+# extract is VMFS-only, so the build gate here is a genuine-ODS-2 presence gate.)
+RUN /src/build-static/bin/vmsfs_master --ods2 master \
+        /boot/ovmx-distrib.img OVMXSYS /system-stage/vms 128 && \
+    /src/build-static/bin/vmsfs_master --ods2 list /boot/ovmx-distrib.img > /tmp/distrib-list.txt && \
+    cat /tmp/distrib-list.txt && \
     for name in DCL.EXE LOGINOUT.EXE IMGACT.EXE PROVISION.EXE SYSUAF.DAT; do \
-        SRC="/system-stage/vms/SYS0/SYSCOMMON/SYSEXE/$name" && \
-        OUT="/tmp/distrib-verify/SYS0/SYSCOMMON/SYSEXE/$name" && \
-        [ -f "$OUT" ] || { echo "FAIL: mastered ovmx-distrib.img missing SYS\$SYSTEM:$name"; exit 1; } && \
-        cmp -s "$SRC" "$OUT" || { echo "FAIL: mastered SYS\$SYSTEM:$name differs from staged bytes"; exit 1; } && \
-        echo "OK: ovmx-distrib.img carries SYS\$SYSTEM:$name (byte-identical to staged)"; \
+        grep -qi "\]$name;" /tmp/distrib-list.txt || { echo "FAIL: mastered ODS-2 ovmx-distrib.img missing SYS\$SYSTEM:$name"; exit 1; } && \
+        echo "OK: ovmx-distrib.img carries SYS\$SYSTEM:$name (genuine ODS-2)"; \
     done && \
-    [ -f /tmp/distrib-verify/SYS0/SYSCOMMON/SYSMGR/STARTUP.COM ] || { echo "FAIL: mastered image missing SYS\$MANAGER:STARTUP.COM"; exit 1; } && \
+    grep -qi "\]STARTUP.COM;" /tmp/distrib-list.txt || { echo "FAIL: mastered image missing SYS\$MANAGER:STARTUP.COM"; exit 1; } && \
     echo "OK: ovmx-distrib.img carries SYS\$MANAGER:STARTUP.COM" && \
     # vms-21a: STDRV's phase-driver data files must be on the mastered disk,
     # or every OPEN in STARTUP.COM's phase driver fails %RMS-E-FNF and no
     # phase (and no site file the driver invokes) ever runs.
-    [ -f "/tmp/distrib-verify/SYS0/SYSCOMMON/SYS\$STARTUP/VMS\$PHASES.DAT" ] || { echo "FAIL: mastered image missing SYS\$STARTUP:VMS\$PHASES.DAT"; exit 1; } && \
-    [ -f "/tmp/distrib-verify/SYS0/SYSCOMMON/SYS\$STARTUP/VMS\$VMS.DAT" ] || { echo "FAIL: mastered image missing SYS\$STARTUP:VMS\$VMS.DAT"; exit 1; } && \
+    grep -qi "\]VMS\$PHASES.DAT;" /tmp/distrib-list.txt || { echo "FAIL: mastered image missing SYS\$STARTUP:VMS\$PHASES.DAT"; exit 1; } && \
+    grep -qi "\]VMS\$VMS.DAT;" /tmp/distrib-list.txt || { echo "FAIL: mastered image missing SYS\$STARTUP:VMS\$VMS.DAT"; exit 1; } && \
     echo "OK: ovmx-distrib.img carries SYS\$STARTUP:VMS\$PHASES.DAT and VMS\$VMS.DAT" && \
-    [ -f /tmp/distrib-verify/SYS0/SYSCOMMON/SYSMGR/SYCONFIG.COM ] || { echo "FAIL: mastered image missing SYS\$MANAGER:SYCONFIG.COM"; exit 1; } && \
-    [ -f /tmp/distrib-verify/SYS0/SYSCOMMON/SYSMGR/SYLOGICALS.COM ] || { echo "FAIL: mastered image missing SYS\$MANAGER:SYLOGICALS.COM"; exit 1; } && \
+    grep -qi "\]SYCONFIG.COM;" /tmp/distrib-list.txt || { echo "FAIL: mastered image missing SYS\$MANAGER:SYCONFIG.COM"; exit 1; } && \
+    grep -qi "\]SYLOGICALS.COM;" /tmp/distrib-list.txt || { echo "FAIL: mastered image missing SYS\$MANAGER:SYLOGICALS.COM"; exit 1; } && \
     echo "OK: ovmx-distrib.img carries SYS\$MANAGER:SYCONFIG.COM and SYLOGICALS.COM" && \
     # The LARP config files this work deletes must never come back on the
     # mastered image -- a regression that recreates distro/rootfs/.../
     # OVMX.CONF would silently ship it again without this gate.
-    [ ! -f /tmp/distrib-verify/SYS0/SYSCOMMON/SYSMGR/OVMX.CONF ] || { echo "FAIL: mastered image carries deleted SYS\$MANAGER:OVMX.CONF"; exit 1; } && \
-    [ ! -f /tmp/distrib-verify/SYS0/SYSCOMMON/SYSMGR/SYLOGICALS.CONF ] || { echo "FAIL: mastered image carries deleted SYS\$MANAGER:SYLOGICALS.CONF"; exit 1; } && \
+    ! grep -qi "\]OVMX.CONF;" /tmp/distrib-list.txt || { echo "FAIL: mastered image carries deleted SYS\$MANAGER:OVMX.CONF"; exit 1; } && \
+    ! grep -qi "\]SYLOGICALS.CONF;" /tmp/distrib-list.txt || { echo "FAIL: mastered image carries deleted SYS\$MANAGER:SYLOGICALS.CONF"; exit 1; } && \
     echo "OK: ovmx-distrib.img carries neither OVMX.CONF nor SYLOGICALS.CONF" && \
     # The SYSTEM-writable persistent directories must be baked in: PID 1 no
     # longer creates them (vms-2f0), so if the mastering source ever loses them
     # SYS$SCRATCH:/SYS$LOGIN: writes fail at runtime (%RMS-E-DNF). Assert both
-    # are present so a regression is caught at BUILD, not in the PARTS demo.
-    [ -d /tmp/distrib-verify/SYSTMP ] || { echo "FAIL: mastered image missing [SYSTMP] (SYS\$SCRATCH:)"; exit 1; } && \
-    [ -d /tmp/distrib-verify/USERS ]  || { echo "FAIL: mastered image missing [USERS]"; exit 1; } && \
+    # are present (as ODS-2 directory files NAME.DIR) so a regression is caught
+    # at BUILD, not in the PARTS demo.
+    grep -qi "\]SYSTMP.DIR;" /tmp/distrib-list.txt || { echo "FAIL: mastered image missing [SYSTMP] (SYS\$SCRATCH:)"; exit 1; } && \
+    grep -qi "\]USERS.DIR;" /tmp/distrib-list.txt || { echo "FAIL: mastered image missing [USERS]"; exit 1; } && \
     echo "OK: ovmx-distrib.img carries SYSTEM-writable [SYSTMP] and [USERS]" && \
-    rm -rf /tmp/distrib-verify && \
+    rm -f /tmp/distrib-list.txt && \
     echo "DISTRIB image: $(ls -lh /boot/ovmx-distrib.img | awk '{print $5}')"
 
 # -- Negative-control distribution disk (vms-2a9) -------------------------------
@@ -800,9 +845,9 @@ RUN cp -r /system-stage/vms /system-stage-negctl-vms && \
     if grep -q 'JOB_CONTROL_STARTUP\.COM' "/system-stage-negctl-vms/SYS0/SYSCOMMON/SYS\$STARTUP/VMS\$VMS.DAT"; then \
         echo "FAIL: negctl VMS\$VMS.DAT still names JOB_CONTROL_STARTUP.COM"; exit 1; \
     fi && \
-    /src/build-static/bin/vmsfs_master master \
-        /boot/ovmx-distrib-negctl.img OVMXSYS /system-stage-negctl-vms 64 && \
-    /src/build-static/bin/vmsfs_master list /boot/ovmx-distrib-negctl.img && \
+    /src/build-static/bin/vmsfs_master --ods2 master \
+        /boot/ovmx-distrib-negctl.img OVMXSYS /system-stage-negctl-vms 128 && \
+    /src/build-static/bin/vmsfs_master --ods2 list /boot/ovmx-distrib-negctl.img && \
     rm -rf /system-stage-negctl-vms && \
     echo "NEGCTL DISTRIB image: $(ls -lh /boot/ovmx-distrib-negctl.img | awk '{print $5}')"
 
@@ -837,9 +882,9 @@ RUN cp -r /system-stage/vms /system-stage-install-media-vms && \
     echo "OK: install-media image's SYSTARTUP_VMS.COM invokes OVMX\$INSTALL.COM" && \
     ! grep -q 'OVMX\$INSTALL' /system-stage/vms/SYS0/SYSCOMMON/SYSMGR/SYSTARTUP_VMS.COM && \
     echo "OK: ovmx-distrib.img's own SYSTARTUP_VMS.COM (unmodified /system-stage) does NOT invoke OVMX\$INSTALL.COM" && \
-    /src/build-static/bin/vmsfs_master master \
-        /boot/ovmx-install-media.img OVMXSYS /system-stage-install-media-vms 64 && \
-    /src/build-static/bin/vmsfs_master list /boot/ovmx-install-media.img && \
+    /src/build-static/bin/vmsfs_master --ods2 master \
+        /boot/ovmx-install-media.img OVMXSYS /system-stage-install-media-vms 128 && \
+    /src/build-static/bin/vmsfs_master --ods2 list /boot/ovmx-install-media.img && \
     rm -rf /system-stage-install-media-vms && \
     echo "INSTALL-MEDIA image: $(ls -lh /boot/ovmx-install-media.img | awk '{print $5}')"
 
@@ -873,8 +918,10 @@ RUN mkdir -p /initramfs-slim/dev /initramfs-slim/proc /initramfs-slim/sys \
     # SYSKRNL distro metadata (rd vms-700/vms-296/vms-3de) -- same
     # os-release as the system-tree stage, see its comment there.
     cp distro/rootfs/etc/os-release /initramfs-slim/etc/os-release && \
-    # Minimal config — SYSUAF + manager files (STARTUP.EXE reads these at boot)
-    cp distro/rootfs/vms/SYS0/SYSCOMMON/SYSEXE/SYSUAF.DAT /initramfs-slim/vms/SYS0/SYSCOMMON/SYSEXE/ && \
+    # Minimal config — SYSUAF + manager files (STARTUP.EXE reads these at boot).
+    # vms-d92: use the BINARY $UAFDEF file mksysuaf generated into /system-stage
+    # above (never the retired ASCII rootfs file).
+    cp /system-stage/vms/SYS0/SYSCOMMON/SYSEXE/SYSUAF.DAT /initramfs-slim/vms/SYS0/SYSCOMMON/SYSEXE/ && \
     cp -r distro/rootfs/vms/SYS0/SYSCOMMON/SYSMGR/* /initramfs-slim/vms/SYS0/SYSCOMMON/SYSMGR/ && \
     # Pack the (only) boot initramfs. Reproducibility (vms-d73): normalize
     # every file's mtime to SOURCE_DATE_EPOCH (cp resets mtime to build

distro/kernel/drivers-ovmx/vms/Kbuild

@@ -28,6 +28,18 @@ vms-y := vms_module.o \
          vms_lock.o \
          vms_mbx.o \
          vms_proctab.o \
-         vmsfs_acp.o
+         vmsfs_acp.o \
+         ods2_reader.o \
+         ods2_edit.o
 
-ccflags-y := -I $(src) -DOVMX_KBACKEND_LINUX
+# vms-5f0 (epic vms-208): the ATOMIC FLIP makes PID 1 $MOUNT SYS$DISK through
+# the Files-11 ACP, the FIRST product path to call the bootable ACP $MOUNT -- so
+# the shipped in-tree vms.ko must now carry the genuine ODS-2 codec (previously
+# only the out-of-tree QEMU-test vms.ko did, and the bootable ACP $MOUNT
+# fail-honestly refused with SS$_DEVNOTMOUNT). Mirrors src/kernel/Makefile's
+# vms-y (ods2_reader.o = the pure parse/validate surface acp_validate_ods2 uses:
+# home/FH2/SCB parse + FM2 map-walk; ods2_edit.o = the EDIT twins the IO$_WRITEVBLK
+# path uses). NOT the writer / block-I/O objects: vmsfs_acp.c does its own block
+# reads/writes through the exec_blockdev_*_block shim. Same flatten-safe codec
+# staging as vmsfs/Kbuild (sources.conf stages vmsfs/ods2.h at <moddir>/vmsfs/).
+ccflags-y := -I $(src) -DOVMX_KBACKEND_LINUX -DOVMX_ODS2_KERNEL

distro/kernel/drivers-ovmx/vms/sources.conf

@@ -14,3 +14,16 @@ src/kernel/*.c
 src/kernel/*.h
 src/kernel-core/*.c
 src/kernel-core/*.h
+# The genuine ODS-2 codec compiled KERNEL-RESIDENT (vms-5f0, epic vms-208): the
+# atomic flip makes PID 1 $MOUNT SYS$DISK via the ACP, so the shipped vms.ko must
+# validate the volume for real (acp_validate_ods2 in vmsfs_acp.c). vms/Kbuild's
+# vms-y builds ONLY ods2_reader.o + ods2_edit.o (the pure parse/validate + edit
+# surface); the writer / bdev / block objects are staged but NOT built --
+# vmsfs_acp.c does its own block I/O through exec_blockdev_*_block. Same pattern
+# as vmsfs/sources.conf.
+src/vmsfs/ods2/*.c
+src/vmsfs/ods2/*.h
+# The codec's PUBLIC header is #include'd by a SUBDIR path (#include
+# "vmsfs/ods2.h"); stage it preserving that component (the '->' convention in
+# overlay-ovmx-drivers.sh) so the flat module dir resolves it via -I$(src).
+src/vmsfs/include/vmsfs/ods2.h -> vmsfs/

distro/kernel/drivers-ovmx/vmsfs/Kbuild

@@ -47,6 +47,7 @@ vmsfs-y := vmsfs_super.o \
            vmsfs_header.o \
            ods2_reader.o \
            ods2_writer.o \
+           ods2_edit.o \
            ods2_bdev.o \
            ods2_path.o \
            ods2_block_kern.o \

distro/kernel/drivers-ovmx/vmsfs/sources.conf

@@ -12,11 +12,12 @@ src/kernel/vmsfs/*.h
 src/kernel-core/vmsfs/*.c
 src/kernel-core/vmsfs/*.h
 # The genuine ODS-2 codec compiled KERNEL-RESIDENT (rd vms-4a8, epic vms-208):
-# reader/writer/path/bdev + its kernel block seam (ods2_block_kern.c) and
-# private headers (ods2_block.h, ods2_kcompat.h). vmsfs/Kbuild's vmsfs-y selects
-# exactly the kernel objects; ods2_block_posix.c / ods2_edit.c are staged but
-# NOT built (userspace-only), the same way src/kernel/vmsfs/*.c stages more than
-# vmsfs-y compiles.
+# reader/writer/path/bdev + its kernel block seam (ods2_block_kern.c), the EDIT
+# twins consumed by ods2_writer.c (ods2_edit.c: ods2_fh2_rename /
+# ods2_dir_remove_blocks / ods2_fh2_reseal), and private headers (ods2_block.h,
+# ods2_kcompat.h). vmsfs/Kbuild's vmsfs-y selects exactly the kernel objects;
+# ods2_block_posix.c is staged but NOT built (userspace-only), the same way
+# src/kernel/vmsfs/*.c stages more than vmsfs-y compiles.
 src/vmsfs/ods2/*.c
 src/vmsfs/ods2/*.h
 # The codec's PUBLIC header is #include'd by a SUBDIR path (#include