vms-30e: DECnet Phase IV engine rung-1 — userspace AF_PACKET datalink + HELLO tx/rx + adjacency drive (Option B, Rule-1-hidden)

docs/decnet-provenance-register.md

@@ -380,7 +380,56 @@ The L3–L6 userspace surface (NCP, session, FAL, DCL/RMS integration) is stream
 
 ---
 
-## 6. Open `verify:` items (resolve before the claims they gate ship)
+## 6. Engine decision — **RESOLVED: Option B (userspace NSP/AF_PACKET)**, and open `verify:` items
+
+### 6.0 The §4.5 go/no-go verdict (rd `vms-a1c`, operator-ruled 2026-08-31)
+
+**RULED — Option B (userspace NSP + Phase IV routing over `AF_PACKET SOCK_RAW`), the §4.5 NO-GO /
+fallback path — is the DECnet engine of record.** The go/no-go analysis is
+`docs/design-decnet-engine-go-nogo.md` (rd `vms-a1c`, now **done**). Recorded here per §4.5's
+"Decision recording: the go/no-go verdict … reflected in §6, never a silent greenfield."
+
+**Verdict.** Do NOT forward-port the mainline-removed Linux `net/decnet` (Option A / stream (ii));
+build the engine as an OVMX-userspace daemon over `AF_PACKET SOCK_RAW` (ethertype `0x6003`,
+`AA-00-04-00-xx-yy` MAC, `AB-00-00-03-00-00` Phase IV multicast), **forking the proven
+`src/vmsscs/scsd.c` raw-Ethernet datalink pattern** (`scs_datalink.h`, written engine-agnostic for
+exactly this second consumer).
+
+**Rationale (why this is not a loosening of any invariant):**
+
+1. **scsd precedent — the pattern already ships, rated real.** `src/vmsscs/scsd.c` is a userspace
+   `AF_PACKET SOCK_RAW` raw-Ethernet daemon for the cluster SCS/NISCA wire, rated
+   *implemented/real* in `docs/compatibility-surface.md`, **not** a facade. The DECnet engine is
+   the same architecture for a second DEC L2 protocol.
+2. **No live in-kernel stack to ride — so this is NOT a Rule-9/`networking-kernel-driver-model`
+   violation.** That ruling (BGn:/TCP-IP: "no userspace socket layer") forbids reimplementing a
+   stack the host kernel *already runs in-kernel* (`AF_INET`). On a 6.8+ kernel **no live in-kernel
+   DECnet stack exists to ride** — `AF_DECnet` was removed in 6.1 — so the rationale does not
+   transfer. Fail-honest still holds (INV-6): the daemon opens a real datalink or exits with a
+   real error; it never fakes per-process success.
+3. **Rule 1 — the mechanism is HIDDEN behind a VMS-authentic surface.** The `AF_PACKET` socket and
+   the Linux/NetBSD interface name are never exposed. The OVMX side sees the DECnet routing surface
+   an NCP user sees — an **executor node** (`area.node` + name + `State = on`), a **circuit** over
+   the datalink device, and **SHOW ADJACENT NODES** — exactly as scsd hides its SCA socket behind
+   the SCS surface.
+4. **No longer greenfield.** The three engine-agnostic codecs (HELLO `vms-851`/PR #964, NSP
+   `vms-6986`, adjacency `vms-b15`) already landed and are oracle-tested; Option B binds them, so
+   most of its unique work was already built and lab-grounded.
+
+**Engine rung 1 landed (rd `vms-449d`).** `src/vmsdecnet/engine/` — `dnet_engine.{c,h}` (the
+socketless engine core: HELLO tx-build + rx-decode + adjacency-SM drive + the VMS presentation
+surface) and `decnetd.c` (**`DECNETD.EXE`**, the daemon that owns the datalink via
+`scs_datalink_*`, the DECnet analogue of `SCSD.EXE`). Proven three ways:
+(a) the engine's built endnode-HELLO for node 1.1 is **byte-identical to the §4.6 specimen #1
+VAX capture** (`tests/vmsdecnet/test_dnet_engine.c`, Rule-8 oracle proof);
+(b) two engine instances drive `DOWN→INITIALIZING→UP→DOWN` over a real `socketpair(2)` and via the
+runnable `DECNETD.EXE --self-test` (no `CAP_NET_RAW`);
+(c) a live `AF_PACKET` on-wire bracket over a `veth` pair in an isolated netns — two `DECNETD.EXE`
+endnodes exchanged 60-byte HELLOs on the T3 cadence and each listed the other in SHOW ADJACENT
+NODES. **Deferred to children of `vms-30e`:** the NSP logical-link connection service (rd
+`vms-c23`) and the live-VAX oracle adjacency bracket (rd `vms-aac0`, the §4.4 done-bar).
+
+### 6.1 Open `verify:` items (resolve before the claims they gate ship)
 
 | # | Verify | Gates | Source to confirm from |
 |---|---|---|---|

src/vmsdecnet/CMakeLists.txt

@@ -13,3 +13,10 @@
 # vms-851 / vms-30e.
 add_subdirectory(routing)
 add_subdirectory(nsp)
+
+# Engine rung 1 (rd vms-449d): the userspace routing ENGINE that MOVES FRAMES
+# using the engine-agnostic codecs above -- AF_PACKET SOCK_RAW over the shared
+# src/vmsscs raw-L2 datalink (operator ruling vms-a1c, Option B), with the
+# socket hidden behind a VMS-faithful DECnet surface (Rule 1). The daemon
+# (DECNETD.EXE) is the DECnet analogue of scsd.
+add_subdirectory(engine)

src/vmsdecnet/engine/CMakeLists.txt

@@ -0,0 +1,40 @@
+# vmsdecnet engine - DECnet Phase IV routing ENGINE (rd vms-449d, rung 1 of the
+# engine lane under epic vms-30e).
+#
+# The engine that MOVES FRAMES using the three landed engine-agnostic codecs
+# (vmsdecnet_routing: dnet_hello + dnet_adjacency). Operator ruling 2026-08-31
+# (rd vms-a1c): Option B -- a userspace routing engine over AF_PACKET SOCK_RAW,
+# forking the proven src/vmsscs raw-L2 datalink, NOT an in-kernel AF_DECnet
+# forward-port. See docs/decnet-provenance-register.md sec 6.
+#
+# dnet_engine: the socketless engine core -- pure logic over frame buffers + an
+# injected clock (same discipline as the codecs), so it is deterministically
+# unit-testable and substrate-neutral. It binds the HELLO codec + the adjacency
+# state machine into a live routing endnode and owns the VMS-faithful
+# presentation surface (executor / circuit / SHOW ADJACENT NODES). It touches NO
+# socket: Rule 1 -- the raw datalink is HIDDEN, exactly as src/vmsscs/scsd.c
+# hides its SCA socket behind the SCS surface.
+add_library(vmsdecnet_engine STATIC dnet_engine.c)
+target_include_directories(vmsdecnet_engine PUBLIC
+    ${CMAKE_CURRENT_SOURCE_DIR}/include
+)
+# The engine core consumes the rung-1 HELLO codec and the rung-3 adjacency SM.
+target_link_libraries(vmsdecnet_engine PUBLIC vmsdecnet_routing)
+
+# decnetd -- THE DAEMON. The DECnet analogue of scsd_exe: the ONLY place the raw
+# datalink (scs_datalink_{open,send,recv}, the generic raw-L2 abstraction from
+# src/vmsscs written engine-agnostic for exactly this second consumer) is
+# touched. It ties the socketless engine core to the live datalink + a monotonic
+# clock. Links vmsscs_datalink for its socket/bpf open + MAC-get + send + recv
+# primitives.
+add_executable(decnetd_exe decnetd.c)
+target_include_directories(decnetd_exe PRIVATE
+    ${CMAKE_CURRENT_SOURCE_DIR}/include
+    ${CMAKE_SOURCE_DIR}/src/vmsscs/include   # scs_datalink.h
+)
+target_link_libraries(decnetd_exe PRIVATE vmsdecnet_engine vmsscs_datalink)
+set_target_properties(decnetd_exe PROPERTIES
+    OUTPUT_NAME "DECNETD"
+    SUFFIX ".EXE"
+)
+install(TARGETS decnetd_exe RUNTIME DESTINATION ${VMS_SYSTEM_DIR})