Codify semantic fidelity and executive-residency as project rules 10 and 11

[baron-3dl]

Operator ruling 2026-07-30: "these are project-wide rules, really."

Both invariants were already being enforced — but ad hoc, in item descriptions and review comments. That meant an agent reading an item cold could reinvent exactly the thing they forbid, and this week two agents did (one of them me, twice).

Rule 10 — Semantic fidelity: two legal answers, never three

For any behavior, condition, or interface:

1. MATCH VMS — reproduce it as VMS does, pinned to the oracle (~/vax lab or public docs).
2. HIDE IT — VMS has no such thing, so make the condition unreachable rather than handling it.

The illegal third answer is inventing a reasonable-looking handler for a condition VMS never faces. It always looks like diligence — graceful degradation, a sensible default, a helpful fallback — and it always ships a lie.

Both worked examples in the rule are from this week, which is why they're worth recording:

• The /dev/vms fallbacks. VMS has no "executive absent" state, so the condition is unreachable, not handled — PID 1 refuses to boot. Five waves of work went into polishing those error paths before the rule revealed the paths were themselves the defect.
• The process name across exec. sys$creprc's prcnam dies at exec. Carrying it in a VMS_PRCNAM env var, following the existing VMS_USERNAME/VMS_TERMINAL convention, compiled and tested green — and was a cheat: a process self-reporting a name nothing else can see. Its only consumer was the test written to validate it.

Rule 11 — VMS system facilities are executive-resident, not per-process

A system facility is shared state owned by the executive. If it lives in per-process memory it is a facade regardless of how correct its output looks.

The decisive test is A-writes / B-reads — do it in process A, observe from process B. A per-process fake passes every single-process test perfectly, which is precisely how the three known facades survived: no executive process table (vms-8019), per-process logical name tables with a zero-client daemon (vms-a4b), and vms_kif_register() with zero callers (vms-9fc). The rule names them so they stop being cited as precedent to copy.

Corollary: a user-visible VMS command is a reader of an executive facility, never a thing that fabricates its own answer.

Note on Rule 9

Rule 9's SS$_NOSUCHDEV parenthetical is now contradicted by Rule 10 — returning it per call was itself the wrong answer. Rule 9's text is left intact with the correction noted inline, rather than silently rewritten.

Conventions only — no code change.

Refs: vms-14f, vms-8019, vms-a4b, vms-9fc, vms-0ff

🤖 Generated with Claude Code

[baron-3dl]

Closing: superseded / not being carried forward. Branch vms-semantic-rules retained.