diff --git a/src/kernel-core/vms_lock.c b/src/kernel-core/vms_lock.c
index 66dd1d1ca..98f19a2d5 100644
--- a/src/kernel-core/vms_lock.c
+++ b/src/kernel-core/vms_lock.c
@@ -137,8 +137,8 @@ exec_list_head_t vms_dlm_origin_list;
 exec_lock_t vms_dlm_origin_lock;
 
 static int vms_lock_dlm_origin_getlki(uint32_t lkid, uint32_t *granted_mode,
-                                      uint32_t *requested_mode, char *resnam,
-                                      size_t resnam_len, uint8_t *valblk);
+                                      uint32_t *requested_mode, uint32_t *master_lkid,
+                                      char *resnam, size_t resnam_len, uint8_t *valblk);
 
 /* ================================================================
  * Cluster membership crosses into the executive (rd vms-551,
@@ -1447,6 +1447,41 @@ uint32_t vms_lock_acp_vol_release(struct vms_proc *proc, uint32_t lkid)
     return d.status;
 }
 
+/*
+ * vms_lock_acp_vol_standing - take the STANDING per-volume lock a faithful MOUNT
+ * holds for the WHOLE mount life (vms-25e). Unlike vms_lock_acp_vol_ex (the
+ * transient EX synchronization lock a single on-disk-structure write takes and
+ * immediately drops), this is a NULL-mode (NL) lock held from $MOUNT to
+ * $DISMOUNT. Its purpose is cluster registration, not serialization: it names the
+ * volume in the DLM so the connection manager can register "this node has this
+ * volume mounted" to the coordinator during a directory rebuild -- the standing
+ * F11B$v<label> lock a real VMS node holds and re-registers on join.
+ *
+ * NL asserts PRESENCE, not exclusion: it takes a different resource (F11B$v) than
+ * the XQP's per-write sync lock (F11B$s), holds nothing exclusive, and so can
+ * never block the XQP, another writer, or another cluster node -- deadlock-free
+ * and cluster-safe by construction. Released by vms_lock_acp_vol_release at
+ * $DISMOUNT (or on the holder's rundown). Returns the executive status; on
+ * SS$_NORMAL *lkid_out is the standing lock's handle for later registration.
+ */
+uint32_t vms_lock_acp_vol_standing(struct vms_proc *proc, const char *resnam,
+                                   uint32_t *lkid_out)
+{
+    struct vms_enq_args a;
+
+    if (lkid_out)
+        *lkid_out = 0;
+    memset(&a, 0, sizeof(a));
+    a.lkmode = LCK_K_NLMODE;    /* NL: a presence marker, holds nothing exclusive */
+    a.flags  = LCK_M_SYNC;      /* $ENQW; an NL request grants immediately */
+    strscpy(a.resnam, resnam, sizeof(a.resnam));
+
+    vms_enq_core_ex(proc, &a, NULL);
+    if (a.status == SS__NORMAL && lkid_out)
+        *lkid_out = a.lkid;
+    return a.status;
+}
+
 /*
  * vms_ioctl_convert - Convert lock mode ($ENQ with LCK$M_CONVERT)
  *
@@ -1588,12 +1623,13 @@ long vms_ioctl_getlki(struct vms_proc *proc, unsigned long arg)
          * its origin record carries the status the master's GRANT completed. This
          * makes the NL->EX flip driven by the remote master observable here.
          */
-        uint32_t org_granted = 0, org_requested = 0;
+        uint32_t org_granted = 0, org_requested = 0, org_master = 0;
         if (vms_lock_dlm_origin_getlki(args.lkid, &org_granted, &org_requested,
-                                       args.resnam, sizeof(args.resnam),
+                                       &org_master, args.resnam, sizeof(args.resnam),
                                        args.valblk)) {
             args.granted_mode = org_granted;
             args.requested_mode = org_requested;
+            args.master_lkid = org_master;   /* vms-16c: the master's granted handle, from real origin state */
             args.parent_id = 0;
             /* args.valblk was filled by origin_getlki: the master's LVB the
              * GRANT delivered (rd vms-eeb), or zeros if none -- the read
@@ -2388,8 +2424,8 @@ static uint32_t vms_lock_dlm_xnode_blkast_recv(struct vms_proc *proc,
  * cross-node request's status flip on the REQUESTER node.
  */
 static int vms_lock_dlm_origin_getlki(uint32_t lkid, uint32_t *granted_mode,
-                                      uint32_t *requested_mode, char *resnam,
-                                      size_t resnam_len, uint8_t *valblk)
+                                      uint32_t *requested_mode, uint32_t *master_lkid,
+                                      char *resnam, size_t resnam_len, uint8_t *valblk)
 {
     struct vms_dlm_origin *cur;
     int found = 0;
@@ -2403,6 +2439,8 @@ static int vms_lock_dlm_origin_getlki(uint32_t lkid, uint32_t *granted_mode,
                 *granted_mode = cur->granted_mode;
             if (requested_mode)
                 *requested_mode = cur->requested_mode;
+            if (master_lkid)
+                *master_lkid = cur->master_lkid;   /* the master's granted handle (0 until a real GRANT recorded it) */
             if (resnam && resnam_len)
                 strscpy(resnam, cur->resnam, resnam_len);
             /*
@@ -2480,6 +2518,57 @@ static uint32_t vms_lock_dlm_xnode_rebuild(struct vms_proc *proc,
     return SS__NORMAL;
 }
 
+/*
+ * vms_lock_dlm_xnode_enq_idempotent - retransmit idempotency for a cross-node
+ * $ENQ (vms-16c). A cluster member (VAX1/VAX2) that never sees a STABLE granted
+ * lock re-sends the same op-01 ENQ. Before this, every re-send ran the full
+ * enqueue core and minted a FRESH master lock record, so the handle OVMX returned
+ * changed on each reply (0x328 -> 0x329 -> 0x32a ...) and the requester could
+ * never correlate a held lock -- it re-requested forever (the measured ~35/sec
+ * storm on LNM$CWLOGICALS + F11B$aSYSDSK1, CN stuck at 2). A real VMS master is
+ * idempotent to a retransmit: the SAME (req_csid, req_lkid) on the same resource,
+ * already granted at a mode that covers the request, returns the SAME master
+ * handle every time.
+ *
+ * Returns 1 and fills req->master_lkid / master_csid / valblk (the caller returns
+ * SS$_NORMAL) when an existing grant satisfies the retransmit; 0 to let the caller
+ * run the full enqueue core -- a genuinely new lock, or an UP-CONVERSION (existing
+ * grant weaker than the request) the core must process for real. Cross-node only
+ * (both ids non-zero); a local $ENQ (both 0) is never deduped here. INV-6: the
+ * handle returned names a REAL existing lock record on the resource's granted
+ * queue -- never a fabricated or defaulted grant.
+ */
+static int vms_lock_dlm_xnode_enq_idempotent(struct vms_dlm_xnode_args *req)
+{
+    struct vms_lock_resource *res;
+    struct vms_lock_entry *lock;
+    int handled = 0;
+
+    if (req->req_csid == 0 || req->req_lkid == 0)
+        return 0;   /* a local ENQ or unidentified requester: never dedup */
+
+    res = resource_find_or_create(req->resnam);
+    if (!res)
+        return 0;   /* let the core report SS$_INSFMEM honestly */
+
+    exec_lock(&res->lock);
+    exec_list_for_each_entry(lock, &res->granted, res_granted) {
+        if (lock->req_csid == req->req_csid &&
+            lock->req_lkid == req->req_lkid &&
+            lock->granted_mode >= req->lkmode) {
+            req->master_lkid = lock->lkid;          /* the SAME stable handle */
+            req->master_csid = vms_local_csid;
+            memcpy(req->valblk, res->valblk, LCK_VALBLK_SIZE);
+            handled = 1;
+            break;
+        }
+    }
+    exec_unlock(&res->lock);
+
+    resource_release(res);
+    return handled;
+}
+
 /*
  * vms_lock_dlm_xnode_dispatch - the cross-node DLM RECEIVE handler
  * (vms-94c transport; DLM epic vms-7fa).
@@ -2553,6 +2642,19 @@ uint32_t vms_lock_dlm_xnode_dispatch(struct vms_proc *proc,
         if (req->resnam[0] == '\0')
             return SS__BADPARAM;
 
+        /*
+         * Retransmit idempotency (vms-16c). An already-granted cross-node lock
+         * (same req_csid + req_lkid, mode still covered) returns its EXISTING
+         * master handle -- a STABLE handle the requester correlates -- instead of
+         * minting a fresh record per re-send. Without this the returned handle
+         * changed on every retransmit and the member re-requested forever. A
+         * genuinely new lock or an up-conversion returns 0 here and runs the core.
+         */
+        if (vms_lock_dlm_xnode_enq_idempotent(req)) {
+            req->queued = 0;
+            return SS__NORMAL;
+        }
+
         /*
          * Marshal the decoded cross-node $ENQ into the single-node lock manager
          * on this (the mastering) node, in CROSS-NODE mode (xn): the lock is held
diff --git a/src/kernel-core/vmsfs_acp.c b/src/kernel-core/vmsfs_acp.c
index 5a06d324c..98bc653b1 100644
--- a/src/kernel-core/vmsfs_acp.c
+++ b/src/kernel-core/vmsfs_acp.c
@@ -104,6 +104,16 @@ struct vms_acp_volume {
      */
     uint32_t         ibmap_lbn;         /* hm2_ibmaplbn: index-bitmap base LBN */
     uint32_t         maxfiles;          /* hm2_maxfiles: index-file capacity */
+    /*
+     * The STANDING volume lock a faithful MOUNT holds for the whole mount life
+     * (vms-25e): a real VMS MOUNT holds the per-volume "F11B$v<label>" lock from
+     * $MOUNT to $DISMOUNT -- the cluster-wide marker that this node has the volume
+     * mounted, which the connection manager registers during a directory rebuild.
+     * Taken at publish, released at $DISMOUNT. 0 = not held (acquire failed or the
+     * node has no DLM); the volume is still mounted -- the standing lock is a
+     * cluster-registration facility, never a gate on the mount itself.
+     */
+    uint32_t         vol_lkid;          /* standing F11B$v<label> lock handle, 0 if unheld */
 };
 
 /*
@@ -267,20 +277,27 @@ static struct vms_acp_volume *acp_vol_find_locked(const char *devnam)
 }
 
 /*
- * acp_vol_resnam - the per-volume synchronization RESOURCE NAME for the ACP's
- * DLM write lock (vms-233, design §4.7). Derived from the ODS-2 volume LABEL so
- * a clustered / MSCP-served volume computes the SAME resource name on every node
- * that serves it -- the DLM resource is the cluster-wide write sync point. The
- * namespace prefix follows VMS's public files-lock naming ("F11B$s..."); the
- * exact resource string is an OVMX design choice, not a claim of VMS byte-wire
- * fidelity (Rule 8). An unlabelled volume falls back to its backing device
- * numbers so it still serializes locally. Host-neutral (fixed-width fields, no
- * long/pointer/sizeof) -- kernel-core portable for the Alpha/VAX cross-check.
+ * acp_vol_resnam_kind - the per-volume Files-11 DLM RESOURCE NAME "F11B$<kind><label>"
+ * for one of the per-volume locks (vms-233, design §4.7). `kind` selects which:
+ *   's' -- the XQP volume-SYNCHRONIZATION lock, taken transiently per on-disk-
+ *          structure write (vms_lock_acp_vol_ex); the original single use.
+ *   'v' -- the standing VOLUME lock a faithful MOUNT holds for the whole mount
+ *          life (vms-25e), the cluster-wide "this volume is mounted here" marker
+ *          the connection manager registers during a directory rebuild.
+ *   'a' -- the volume-ALLOCATION lock.
+ * Derived from the ODS-2 volume LABEL so a clustered / MSCP-served volume computes
+ * the SAME resource name on every node that serves it -- the DLM resource is the
+ * cluster-wide sync point. The namespace follows VMS's public files-lock naming
+ * ("F11B$..."); the exact string is an OVMX design choice, not a claim of VMS
+ * byte-wire fidelity (Rule 8). An unlabelled volume falls back to its backing
+ * device numbers so it still serializes locally. Host-neutral (fixed-width fields,
+ * no long/pointer/sizeof) -- kernel-core portable for the Alpha/VAX cross-check.
  */
-static void acp_vol_resnam(const struct vms_acp_volume *vol, char *out, size_t outsz)
+static void acp_vol_resnam_kind(const struct vms_acp_volume *vol, char kind,
+                                char *out, size_t outsz)
 {
     size_t n = 0;
-    static const char pfx[] = "F11B$s";
+    const char pfx[7] = { 'F', '1', '1', 'B', '$', kind, '\0' };
     size_t i;
 
     for (i = 0; pfx[i] != '\0' && n + 1 < outsz; i++)
@@ -310,6 +327,14 @@ static void acp_vol_resnam(const struct vms_acp_volume *vol, char *out, size_t o
     out[n < outsz ? n : outsz - 1] = '\0';
 }
 
+/* acp_vol_resnam - the XQP volume-SYNC resource name ("F11B$s<label>"), the
+ * original per-write serialization lock. Thin wrapper over acp_vol_resnam_kind
+ * so the transient-lock call sites read unchanged. */
+static void acp_vol_resnam(const struct vms_acp_volume *vol, char *out, size_t outsz)
+{
+    acp_vol_resnam_kind(vol, 's', out, outsz);
+}
+
 /* Caller holds proc->chan_lock. */
 static struct vms_acp_chan *acp_chan_find_locked(struct vms_proc *proc, uint32_t chan)
 {
@@ -682,6 +707,23 @@ long vms_ioctl_acp_mount(struct vms_proc *proc, unsigned long arg)
     exec_list_add_tail(&vol->list, &vms_acp_vol_list);
     exec_unlock(&vms_acp_vol_lock);
 
+    /*
+     * vms-25e: take the STANDING volume lock a faithful MOUNT holds for the whole
+     * mount life -- the cluster-registration presence marker the connection
+     * manager registers to the coordinator on join. Enqueued AFTER dropping
+     * vms_acp_vol_lock (the enqueue may take DLM locks; never hold the table lock
+     * across it). Best-effort: a failure (no DLM backend) leaves vol_lkid 0 and
+     * the volume is mounted regardless -- the standing lock is a cluster facility,
+     * NEVER a gate on the mount itself (INV-6: honest omission on failure). Owned
+     * by the mounting process; for the PID-1-mounted system disk that is the
+     * node's life.
+     */
+    {
+        char vresnam[32];
+        acp_vol_resnam_kind(vol, 'v', vresnam, sizeof(vresnam));
+        vms_lock_acp_vol_standing(proc, vresnam, &vol->vol_lkid);
+    }
+
     args.status = SS__NORMAL;
 
 out:
@@ -705,7 +747,6 @@ long vms_ioctl_acp_dmount(struct vms_proc *proc, unsigned long arg)
     char devnam[VMS_DEVNAM_SIZE];
     uint32_t status;
 
-    (void)proc;
     memset(&args, 0, sizeof(args));
     if (exec_copyin(&args, (const void *)arg, sizeof(args)))
         return -EFAULT;
@@ -731,6 +772,14 @@ long vms_ioctl_acp_dmount(struct vms_proc *proc, unsigned long arg)
     }
     exec_list_del(&vol->list);
     exec_unlock(&vms_acp_vol_lock);
+    /*
+     * vms-25e: drop the standing volume lock this mount held (no-op if unheld).
+     * Best-effort, outside the table lock (the DEQ may touch DLM state). The lock
+     * was taken by the MOUNTING process; if a different process dismounts, the DEQ
+     * may not match and the holder's rundown ($DEQ-on-exit) is the backstop -- for
+     * the PID-1-mounted system disk, dismount and rundown are both PID 1.
+     */
+    vms_lock_acp_vol_release(proc, vol->vol_lkid);
     exec_free(vol);
 
     args.status = SS__NORMAL;
@@ -741,6 +790,50 @@ long vms_ioctl_acp_dmount(struct vms_proc *proc, unsigned long arg)
     return 0;
 }
 
+/*
+ * vms_ioctl_dlm_enum_standing - enumerate this node's STANDING cluster-registrable
+ * system locks (vms-1f4). These are the locks the executive holds for the node's
+ * LIFE that the connection manager (scsd) registers to the coordinator during a
+ * directory rebuild: today the per-volume F11B$v<label> lock a MOUNT holds
+ * (vms-25e), one entry per mounted volume that genuinely holds it (vol_lkid != 0).
+ * Each entry carries the resource name and this node's LOCAL lock handle -- the
+ * op-0x01 requester lkid scsd puts on the wire.
+ *
+ * INV-6: a READ of REAL lock state. count is exactly the number of standing locks
+ * the executive genuinely holds; a volume whose best-effort acquire failed
+ * (vol_lkid == 0) contributes nothing. Never a fabricated lock. The enqueue lock
+ * is dropped before copyout (copyout may fault); the table lock is held only
+ * across the in-memory walk.
+ */
+long vms_ioctl_dlm_enum_standing(struct vms_proc *proc, unsigned long arg)
+{
+    struct vms_dlm_enum_standing_args args;
+    struct vms_acp_volume *vol;
+
+    (void)proc;
+    memset(&args, 0, sizeof(args));
+
+    exec_lock(&vms_acp_vol_lock);
+    exec_list_for_each_entry(vol, &vms_acp_vol_list, list) {
+        if (vol->vol_lkid == 0)
+            continue;                   /* no standing lock held (best-effort acquire failed) */
+        args.total++;
+        if (args.count < VMS_DLM_ENUM_STANDING_MAX) {
+            struct vms_dlm_standing_ent *e = &args.ent[args.count];
+            acp_vol_resnam_kind(vol, 'v', e->resnam, sizeof(e->resnam));
+            e->lkid = vol->vol_lkid;
+            e->mode = LCK_K_NLMODE;      /* the volume presence lock is held at NL */
+            args.count++;
+        }
+    }
+    exec_unlock(&vms_acp_vol_lock);
+    args.status = SS__NORMAL;
+
+    if (exec_copyout((void *)arg, &args, sizeof(args)))
+        return -EFAULT;
+    return 0;
+}
+
 /*
  * $ASSIGN a FILE-CLASS channel to a mounted ODS-2 volume (design §4.2). The
  * channel is the executive's -- bound to the mounted volume, drawn from the
diff --git a/src/kernel-netbsd/vms_internal.h b/src/kernel-netbsd/vms_internal.h
index 4896167d1..b1e91368b 100644
--- a/src/kernel-netbsd/vms_internal.h
+++ b/src/kernel-netbsd/vms_internal.h
@@ -820,6 +820,13 @@ long vms_ioctl_getlki(struct vms_proc *proc, unsigned long arg);
 uint32_t vms_lock_acp_vol_ex(struct vms_proc *proc, const char *resnam,
                              uint32_t *lkid_out);
 uint32_t vms_lock_acp_vol_release(struct vms_proc *proc, uint32_t lkid);
+/* The STANDING per-volume lock a faithful MOUNT holds for the whole mount life
+ * (vms-25e): an NL-mode $ENQ on the F11B$v<label> resource, held from $MOUNT to
+ * $DISMOUNT as the cluster-registration presence marker. Released with
+ * vms_lock_acp_vol_release. Mirror of the src/kernel/vms_internal.h decl (#928:
+ * kernel-core lock ops must be declared in BOTH the Linux and NetBSD headers). */
+uint32_t vms_lock_acp_vol_standing(struct vms_proc *proc, const char *resnam,
+                                   uint32_t *lkid_out);
 long vms_ioctl_get_resmaster(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_dlm_member_depart(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_dlm_get_granted(struct vms_proc *proc, unsigned long arg);
@@ -866,6 +873,11 @@ void vms_acp_init(void);
 void vms_acp_cleanup(void);
 long vms_ioctl_acp_mount(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_acp_dmount(struct vms_proc *proc, unsigned long arg);
+/* Enumerate this node's standing cluster-registrable system locks (vms-1f4): one
+ * entry (resname + local lkid + mode) per mounted volume holding its F11B$v lock.
+ * A READ of real lock state for scsd's directory-rebuild registration. Mirror of
+ * the src/kernel/vms_internal.h decl (#928: kernel-core ops in BOTH headers). */
+long vms_ioctl_dlm_enum_standing(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_acp_assign(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_acp_access(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_acp_deaccess(struct vms_proc *proc, unsigned long arg);
diff --git a/src/kernel-netbsd/vms_lock_nb.h b/src/kernel-netbsd/vms_lock_nb.h
index 077d2012b..5c97c5e03 100644
--- a/src/kernel-netbsd/vms_lock_nb.h
+++ b/src/kernel-netbsd/vms_lock_nb.h
@@ -274,6 +274,24 @@ struct vms_dlm_enum_waits_args {
 	struct vms_dlm_wait_ent ent[VMS_DLM_ENUM_WAITS_MAX];
 };
 
+/* Standing cluster-registrable system locks (vms-1f4). MUST match
+ * src/kernel/vms_ioctl.h byte-for-byte. One entry per lock the executive holds
+ * for the node's life (the F11B$v volume lock) that scsd registers to the
+ * coordinator on a directory rebuild. See vms_ioctl.h for the full INV-6 note. */
+#define VMS_DLM_ENUM_STANDING_MAX 16u
+struct vms_dlm_standing_ent {
+	char     resnam[32];
+	uint32_t lkid;
+	uint32_t mode;
+};
+struct vms_dlm_enum_standing_args {
+	uint32_t count;
+	uint32_t total;
+	uint32_t status;
+	uint32_t pad;
+	struct vms_dlm_standing_ent ent[VMS_DLM_ENUM_STANDING_MAX];
+};
+
 /* Cluster membership crosses into the executive (rd vms-551). MUST match
  * src/kernel/vms_ioctl.h byte-for-byte. SEPARATE from dlm_member_csids
  * above (that vector is CSID-only, static, for DLM directory hashing; this
@@ -326,6 +344,7 @@ struct vms_cluster_member_get_args {
 #define VMS_IOCTL_CLUSTER_MEMBER_SET   _IOWR(VMS_LOCK_IOC_MAGIC, 0x39, struct vms_cluster_member_set_args)
 #define VMS_IOCTL_CLUSTER_MEMBER_CLEAR _IOWR(VMS_LOCK_IOC_MAGIC, 0x3a, struct vms_cluster_member_clear_args)
 #define VMS_IOCTL_CLUSTER_MEMBER_GET   _IOWR(VMS_LOCK_IOC_MAGIC, 0x3b, struct vms_cluster_member_get_args)
+#define VMS_IOCTL_DLM_ENUM_STANDING    _IOWR(VMS_LOCK_IOC_MAGIC, 0x3c, struct vms_dlm_enum_standing_args)
 
 /*
  * Freeze the shared layouts -- see the other _nb.h contracts' identical asserts:
@@ -349,6 +368,8 @@ _Static_assert(sizeof(struct vms_dlm_granted_args) == 56,
                "vms_dlm_granted_args changed size -- VMS_IOCTL_DLM_GET_GRANTED ABI break");
 _Static_assert(sizeof(struct vms_dlm_enum_waits_args) == 16 + 48 * 8,
                "vms_dlm_enum_waits_args changed size -- VMS_IOCTL_DLM_ENUM_WAITS ABI break");
+_Static_assert(sizeof(struct vms_dlm_enum_standing_args) == 16 + 40 * 16,
+               "vms_dlm_enum_standing_args changed size -- VMS_IOCTL_DLM_ENUM_STANDING ABI break");
 _Static_assert(sizeof(struct vms_cluster_member_set_args) == 44,
                "vms_cluster_member_set_args changed size -- VMS_IOCTL_CLUSTER_MEMBER_SET ABI break");
 _Static_assert(sizeof(struct vms_cluster_member_clear_args) == 8,
diff --git a/src/kernel-netbsd/vms_netbsd.c b/src/kernel-netbsd/vms_netbsd.c
index d0da42664..a85372f10 100644
--- a/src/kernel-netbsd/vms_netbsd.c
+++ b/src/kernel-netbsd/vms_netbsd.c
@@ -1248,6 +1248,7 @@ vms_ioctl(dev_t self __unused, u_long cmd, void *data, int flag __unused,
 	case VMS_IOCTL_DLM_MEMBER_DEPART:
 	case VMS_IOCTL_DLM_GET_GRANTED:
 	case VMS_IOCTL_DLM_ENUM_WAITS:
+	case VMS_IOCTL_DLM_ENUM_STANDING:
 	case VMS_IOCTL_CLUSTER_MEMBER_SET:
 	case VMS_IOCTL_CLUSTER_MEMBER_CLEAR:
 	case VMS_IOCTL_CLUSTER_MEMBER_GET:
@@ -1273,6 +1274,8 @@ vms_ioctl(dev_t self __unused, u_long cmd, void *data, int flag __unused,
 			r = vms_ioctl_dlm_get_granted(proc, (unsigned long)uarg); break;
 		case VMS_IOCTL_DLM_ENUM_WAITS:
 			r = vms_ioctl_dlm_enum_waits(proc, (unsigned long)uarg); break;
+		case VMS_IOCTL_DLM_ENUM_STANDING:
+			r = vms_ioctl_dlm_enum_standing(proc, (unsigned long)uarg); break;
 		case VMS_IOCTL_CLUSTER_MEMBER_SET:
 			r = vms_ioctl_cluster_member_set(proc, (unsigned long)uarg); break;
 		case VMS_IOCTL_CLUSTER_MEMBER_CLEAR:
diff --git a/src/kernel/vms_internal.h b/src/kernel/vms_internal.h
index 0abc52782..571d819e9 100644
--- a/src/kernel/vms_internal.h
+++ b/src/kernel/vms_internal.h
@@ -1087,6 +1087,12 @@ long vms_ioctl_getlki(struct vms_proc *proc, unsigned long arg);
 uint32_t vms_lock_acp_vol_ex(struct vms_proc *proc, const char *resnam,
                              uint32_t *lkid_out);
 uint32_t vms_lock_acp_vol_release(struct vms_proc *proc, uint32_t lkid);
+/* The STANDING per-volume lock a faithful MOUNT holds for the whole mount life
+ * (vms-25e): an NL-mode $ENQ on the F11B$v<label> resource, held from $MOUNT to
+ * $DISMOUNT as the cluster-registration presence marker (not serialization).
+ * Released with vms_lock_acp_vol_release. See vms_lock.c. */
+uint32_t vms_lock_acp_vol_standing(struct vms_proc *proc, const char *resnam,
+                                   uint32_t *lkid_out);
 /*
  * DLM resource-directory + mastering (vms-ci.5 DB). Read-only diagnostic:
  * report the directory node, the mastering node and the granted-lock count
@@ -1283,6 +1289,10 @@ void vms_mbx_release_all(struct vms_proc *proc);
  */
 long vms_ioctl_acp_mount(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_acp_dmount(struct vms_proc *proc, unsigned long arg);
+/* Enumerate this node's standing cluster-registrable system locks (vms-1f4): one
+ * entry (resname + local lkid + mode) per mounted volume holding its F11B$v lock.
+ * A READ of real lock state for scsd's directory-rebuild registration. */
+long vms_ioctl_dlm_enum_standing(struct vms_proc *proc, unsigned long arg);
 long vms_ioctl_acp_assign(struct vms_proc *proc, unsigned long arg);
 /*
  * IO$_ACCESS / IO$_DEACCESS (vms-204): open a file by name or by FID on a
diff --git a/src/kernel/vms_ioctl.h b/src/kernel/vms_ioctl.h
index f0317e7e9..b50963b38 100644
--- a/src/kernel/vms_ioctl.h
+++ b/src/kernel/vms_ioctl.h
@@ -454,7 +454,13 @@ struct vms_getlki_args {
     char     resnam[32];        /* return: resource name */
     uint8_t  valblk[LCK_VALBLK_SIZE]; /* return: value block */
     uint32_t status;            /* return: SS$_ status */
-    uint32_t pad;
+    uint32_t master_lkid;       /* return: the MASTER's lock handle for a cross-node
+                                 * ORIGIN record (the value grant_recv stored from the
+                                 * master's GRANT); 0 for a local lock or a still-pending
+                                 * origin. Lets a requester read back, from executive
+                                 * state, the handle the master granted it -- so a
+                                 * rebuild-completion references real recorded state,
+                                 * never a wire copy (vms-16c). Was a reserved pad. */
 };
 
 /*
@@ -697,6 +703,41 @@ _Static_assert(sizeof(struct vms_dlm_enum_waits_args) == 16 + 48 * 8,
 _Static_assert(VMS_IOCTL_DLM_ENUM_WAITS == 0xC1905638u,
                "VMS_IOCTL_DLM_ENUM_WAITS encodes differently than the reference build");
 
+/*
+ * Enumerate this node's STANDING cluster-registrable system locks (vms-1f4, the
+ * enumeration seam of faithful cluster DLM registration vms-3eb). These are the
+ * locks the executive holds for the node's LIFE -- today the per-volume
+ * "F11B$v<label>" lock a faithful MOUNT holds from $MOUNT to $DISMOUNT (vms-25e),
+ * later the mount (MOU$) and clusterwide-logical (LNM$CWLOGICALS) locks -- that
+ * the connection manager (scsd) must register to the coordinator during a
+ * directory rebuild. Each entry gives the resource name and this node's LOCAL
+ * lock handle, which becomes the op-0x01 requester lkid on the wire.
+ *
+ * INV-6: a READ of REAL lock-manager state -- one entry per lock the executive
+ * genuinely holds (a nonzero vol_lkid on a mounted volume). count=0 when the node
+ * holds no standing locks; never a fabricated lock. This is the honest boundary
+ * scsd registers FROM: it can only announce to the cluster what the executive
+ * actually holds.
+ */
+#define VMS_DLM_ENUM_STANDING_MAX 16u   /* standing system locks returned per call */
+struct vms_dlm_standing_ent {
+    char     resnam[32];        /* the standing lock's resource name (e.g. "F11B$vOVMXSYS") */
+    uint32_t lkid;              /* this node's LOCAL handle for it (the op-0x01 req_lkid)   */
+    uint32_t mode;              /* granted mode (LCK_K_NLMODE for the volume presence lock) */
+};
+struct vms_dlm_enum_standing_args {
+    uint32_t count;             /* return: standing locks filled (<= VMS_DLM_ENUM_STANDING_MAX) */
+    uint32_t total;             /* return: total standing locks the node holds (may exceed count) */
+    uint32_t status;            /* return: SS$_ status */
+    uint32_t pad;               /* zero */
+    struct vms_dlm_standing_ent ent[VMS_DLM_ENUM_STANDING_MAX];
+};
+_Static_assert(sizeof(struct vms_dlm_enum_standing_args) == 16 + 40 * 16,
+               "vms_dlm_enum_standing_args changed size -- VMS_IOCTL_DLM_ENUM_STANDING ABI break");
+#define VMS_IOCTL_DLM_ENUM_STANDING _IOWR(VMS_IOC_MAGIC, 0x3c, struct vms_dlm_enum_standing_args)
+_Static_assert(VMS_IOCTL_DLM_ENUM_STANDING == 0xC290563Cu,
+               "VMS_IOCTL_DLM_ENUM_STANDING encodes differently than the reference build");
+
 /*
  * Cluster membership crosses into the executive (rd vms-551,
  * docs/design-cluster-membership-executive.md). vms.ko owns a small
diff --git a/src/kernel/vms_module.c b/src/kernel/vms_module.c
index 561a1835a..74c09dd85 100644
--- a/src/kernel/vms_module.c
+++ b/src/kernel/vms_module.c
@@ -1036,6 +1036,8 @@ static long vms_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg
      * search (rd vms-ec75, DLM rung H11). */
     case VMS_IOCTL_DLM_ENUM_WAITS:
         return vms_ioctl_dlm_enum_waits(proc, arg);
+    case VMS_IOCTL_DLM_ENUM_STANDING:
+        return vms_ioctl_dlm_enum_standing(proc, arg);
     /* Cluster membership crosses into the executive (vms-551): scsd's local
      * populate path (SET/CLEAR) and SHOW CLUSTER's read (GET). */
     case VMS_IOCTL_CLUSTER_MEMBER_SET:
diff --git a/src/libvmssys/vms_kif.c b/src/libvmssys/vms_kif.c
index 4e5fe1729..d84fdfb97 100644
--- a/src/libvmssys/vms_kif.c
+++ b/src/libvmssys/vms_kif.c
@@ -812,6 +812,33 @@ uint32_t vms_kif_get_resmaster(const char *resnam, uint32_t *found,
     return args.status;
 }
 
+/*
+ * vms_kif_dlm_enum_standing - enumerate this node's STANDING cluster-registrable
+ * system locks over /dev/vms (vms-1f4): on return *out holds up to
+ * VMS_DLM_ENUM_STANDING_MAX entries (out->count filled, out->total held), each
+ * the resource name + local lkid + mode of a lock the executive genuinely holds
+ * (the F11B$v volume lock a MOUNT holds). scsd registers these to the coordinator
+ * during a directory rebuild. Fail-honest (SS$_NOSUCHDEV) when /dev/vms is absent
+ * (KIF_CALL); a READ of real lock state, never a fabricated lock (INV-6).
+ */
+uint32_t vms_kif_dlm_enum_standing(struct vms_dlm_enum_standing_args *out)
+{
+    if (!out)
+        return 0x00000014; /* SS$_BADPARAM */
+
+    /*
+     * Write STRAIGHT into the caller's buffer -- no local copy. A local
+     * `struct ... args; ...; *out = args;` would lower the 656-byte struct
+     * assignment to a libc memcpy() call, which the freestanding libvmssys
+     * shareable cannot resolve (DECC$SHR exports no memcpy -- vms-61f). The
+     * KIF_CALL copyout fills *out directly; vms_memset (a local shim, not libc)
+     * zeroes it first so a pre-ioctl failure leaves a clean all-zero block.
+     */
+    vms_memset(out, 0, sizeof(*out));
+    KIF_CALL(VMS_IOCTL_DLM_ENUM_STANDING, out);
+    return out->status;
+}
+
 /*
  * vms_kif_dlm_xnode - dispatch a decoded cross-node DLM request to the kernel
  * lock manager's cross-node handler (vms-94c, DLM epic vms-7fa rung 1). Issues
diff --git a/src/libvmssys/vms_kif.h b/src/libvmssys/vms_kif.h
index c5c183f06..2d97bdfaa 100644
--- a/src/libvmssys/vms_kif.h
+++ b/src/libvmssys/vms_kif.h
@@ -323,6 +323,19 @@ uint32_t vms_kif_get_resmaster(const char *resnam, uint32_t *found,
                                uint32_t *n_granted,
                                uint32_t *remote_holder_csid);
 
+/* Enumerate this node's STANDING cluster-registrable system locks (vms-1f4): on
+ * return *out holds the standing locks the executive genuinely holds (the F11B$v
+ * volume lock a MOUNT holds) -- out->count entries, each resname + local lkid +
+ * mode. scsd registers these to the coordinator during a directory rebuild. A
+ * READ of real lock state; fail-honest (SS$_NOSUCHDEV) when /dev/vms is absent.
+ *
+ * OVMX-UNWIRED: vms_kif_dlm_enum_standing (vms-1f4) -- the enumeration accessor
+ * (Layer 2). Its product caller is Layer 3 (vms-74f): scsd calls this to fetch
+ * the node's standing locks and register them to the coordinator. Not on a
+ * product path yet -- only the QEMU test exercises it. REMOVE this marker when
+ * Layer 3 wires scsd (else the census flags a stale marker). */
+uint32_t vms_kif_dlm_enum_standing(struct vms_dlm_enum_standing_args *out);
+
 /* Dispatch a decoded cross-node DLM request to the kernel lock manager's
  * cross-node handler (vms-94c, DLM epic vms-7fa rung 1).
  * OVMX-UNWIRED: vms_kif_dlm_xnode (vms-94c) -- the DLM message TRANSPORT reaches
diff --git a/src/vmsscs/include/scs_member.h b/src/vmsscs/include/scs_member.h
index b2a6c263b..d0da1e98b 100644
--- a/src/vmsscs/include/scs_member.h
+++ b/src/vmsscs/include/scs_member.h
@@ -338,6 +338,58 @@ int scs_member_build_dlm_response(const struct scs_member_params *p,
 int scs_member_build_dlm_selfreg(const struct scs_member_params *p,
                                  uint8_t out[SCS_MEMBER_FRAME_LEN]);
 
+/* Build the cat-82 op-01 GRANT reply to an inbound cat-02 op-01 lock request, from
+ * OVMX's REAL master lock state (vms-16c, faithful DLM). Rewrites the body[20:56]
+ * lock-DB window from real state (master_lkid for held modes, 0 for NL) -- NOT an
+ * echo; measured against VAX1's own accepted grant format. See scs_member.c. */
+int scs_member_build_dlm_enq_response(const struct scs_member_params *p,
+                                      const uint8_t *req_frame, size_t req_len,
+                                      uint32_t master_lkid, uint8_t granted_mode,
+                                      uint8_t out[SCS_MEMBER_FRAME_LEN]);
+
+/* The honest NULL-mode (NL) DLM registration OVMX originates for a resource a
+ * non-coordinator member showed it in an op-0d rebuild record (db20-b, vms-7e2):
+ * cat 0x02 op 0x01 ENQ, mode hard-pinned NL (holds nothing), resource name from
+ * the shown record, dir_hash an honest 0. The respond-to-rebuild frame VAX1
+ * granted 48/48. See scs_member.c. */
+int scs_member_build_dlm_nl_enq(const struct scs_member_params *p,
+                                uint16_t dir_hash,
+                                const char *resname, uint8_t namelen,
+                                uint8_t out[SCS_MEMBER_FRAME_LEN]);
+
+/* The requester's rebuild-COMPLETION pair driven to the MASTER after its op-01
+ * registrations were granted: cat 0x02 op 0x04 (completion), then op 0x03 COMMIT.
+ * body[20:24] = the MASTER's granted lock handle (from OVMX's executive origin
+ * record, grant_recv->GETLKI; caller passes 0 and MUST NOT send when there is no
+ * real grant -- honest omission), body[24:28] = OVMX's own requester lkid. See
+ * scs_member.c for the INV-6 guardrail (vms-16c). */
+int scs_member_build_dlm_op04(const struct scs_member_params *p, uint32_t master_lkid,
+                              uint32_t req_lkid, uint8_t out[SCS_MEMBER_FRAME_LEN]);
+int scs_member_build_dlm_commit(const struct scs_member_params *p, uint32_t master_lkid,
+                                uint32_t req_lkid, uint8_t out[SCS_MEMBER_FRAME_LEN]);
+
+/* The FULL per-lock DLM record OVMX carries in its op-01 ENQ registration (Layer
+ * 3, vms-74f) -- every field a REAL attribute of the standing lock OVMX genuinely
+ * holds, in OVMX's own executive encoding (INV-6, no fabrication). A skeletal
+ * record is dropped by the coordinator (run 9c); the coordinator needs the full
+ * per-lock context every real ENQ carries. */
+struct scs_dlm_reg_fields {
+    uint32_t req_lkid;    /* body[4:8]   OVMX's own lock handle */
+    uint32_t dir_csid;    /* body[20:24] the resource's directory-master csid (OVMX's dir_csid) */
+    uint32_t lock_id;     /* body[24:28] OVMX's unique per-lock id */
+    uint16_t flags;       /* body[28:30] lock flags */
+    uint8_t  mode;        /* body[30]    granted mode (NL for the volume presence lock) */
+    uint32_t lockmgmt;    /* body[32:36] lock-mgmt count/flags word */
+};
+
+/* The cat 0x02 op 0x01 ENQ that REGISTERS one of OVMX's REAL standing system
+ * locks to the coordinator (Layer 3, vms-74f): the full per-lock record from
+ * OVMX's genuine lock state. See scs_member.c. */
+int scs_member_build_dlm_reg_enq(const struct scs_member_params *p,
+                                 const char *resname, uint8_t namelen,
+                                 const struct scs_dlm_reg_fields *f,
+                                 uint8_t out[SCS_MEMBER_FRAME_LEN]);
+
 /* Current time as a VMS 64-bit absolute time (100 ns since 17-NOV-1858). */
 uint64_t scs_member_vms_time_now(void);
 
diff --git a/src/vmsscs/scs_member.c b/src/vmsscs/scs_member.c
index add86d317..a65382793 100644
--- a/src/vmsscs/scs_member.c
+++ b/src/vmsscs/scs_member.c
@@ -698,6 +698,69 @@ int scs_member_build_dlm_response(const struct scs_member_params *p,
     return 0;
 }
 
+/*
+ * scs_member_build_dlm_enq_response - build the cat-82 op-01 GRANT reply to an
+ * inbound cat-02 op-01 lock request, from OVMX's REAL master lock state (vms-16c,
+ * faithful DLM). Unlike scs_member_build_dlm_response (echo-only), this REWRITES the
+ * body[20:56] lock-DB window from real state -- the field set the "silence" comment
+ * said needs a real lock manager. Measured against VAX1's OWN grant format (the one
+ * VAX1/VAX2 produce and accept, 2f2025a7 ENQ->GRANT diff), NOT the varied reference:
+ *   body[0:4]  OVMX's SYSAP send/ack counters (NOT a lock handle -- scs_member.h
+ *              body[0:2]=send-msg#, [2:4]=ack-msg#; the grant ACKs the ENQ's send).
+ *   body[4:8]  the requester's req_lkid, ECHOED unchanged.
+ *   body[8]    category | 0x80 (granted bit); body[9] opcode 0x01 echoed.
+ *   body[12:16] 0x00030001 granted status (request carried 0x00020001).
+ *   body[28:30] master lock handle (16-bit): OVMX's real master_lkid for a HELD
+ *              mode, 0 for pure-NL (the rebuild grant is NL -> 0, as VAX1's NL grants).
+ *   body[30]   GRANTED mode (1-5), honored from the inbound request -- NOT NL. The
+ *              handle field is 16-bit precisely so it does not overrun into this byte:
+ *              writing it as le32 put the handle's high zero byte here and clobbered
+ *              every grant to NL, so VAX (asking PR/CR) was never satisfied and
+ *              re-requested forever (the measured retransmit storm, vms-16c).
+ *   body[32:36] 0x00fe0000 master-state marker (low bits = record index).
+ *   resname + L1 region ECHOED. INV-6: every rewritten field is OVMX's REAL lock
+ *   state (from the executive grant), never fabricated; body[28]=0 for NL carries
+ *   no dangling handle (the a554e7ce failure mode).
+ */
+int scs_member_build_dlm_enq_response(const struct scs_member_params *p,
+                                      const uint8_t *req_frame, size_t req_len,
+                                      uint32_t master_lkid, uint8_t granted_mode,
+                                      uint8_t out[SCS_MEMBER_FRAME_LEN])
+{
+    if (p == NULL || req_frame == NULL || out == NULL) {
+        return -1;
+    }
+    if (req_len < SCS_MEMBER_FRAME_LEN) {
+        return -1;
+    }
+    uint16_t lenword = get_le16(req_frame + 14);
+    if ((uint16_t)(lenword + 2) != SCS_MEMBER_SCA_LEN) {
+        return -1;
+    }
+    build_common(p, member_config_tmpl, SCS_MEMBER_ENV_CREDIT_CONFIG, out);
+    uint8_t *obody = out + 72;
+    const uint8_t *rbody = req_frame + 72;
+    memcpy(obody, rbody, SCS_MEMBER_SCA_LEN - SCS_MEMBER_BODY_OFF); /* echo body */
+    put_le16(obody + 0, p->sysap_send_msg);      /* SYSAP send-msg# (NOT a handle) */
+    put_le16(obody + 2, p->sysap_ack_msg);       /* SYSAP ack-msg# */
+    obody[8] = (uint8_t)(rbody[8] | SCS_MEMBER_RESPONSE_BIT); /* 0x02 -> 0x82 granted */
+    put_le32(obody + 12, 0x00030001u);           /* granted status */
+    /* body[20:56] rewritten from REAL master state (not echoed). The master handle
+     * is a 16-bit field at body[28:30]: writing it as le32 overran into the MODE
+     * byte at body[30] and, for every handle < 0x10000, the handle's high zero byte
+     * clobbered the mode to NL -- the exact "grant carries NL, VAX never satisfied,
+     * re-requests forever" retransmit storm the re-fire measured (vms-16c). Keep the
+     * handle in [28:30]; carry the GRANTED mode (1-5, honored from the request) at
+     * [30]. Both are OVMX's REAL executive lock state (INV-6). */
+    if (granted_mode > 0)                         /* held mode -> the real master handle */
+        put_le16(obody + 28, (uint16_t)master_lkid);
+    else
+        put_le16(obody + 28, 0u);                 /* pure-NL grant: no held handle (as VAX1) */
+    put_le16(obody + 30, (uint16_t)granted_mode); /* GRANTED mode at [30]; [31]=0 */
+    put_le32(obody + 32, 0x00fe0000u);            /* master-state marker */
+    return 0;
+}
+
 /*
  * scs_member_build_dlm_selfreg - originate the joiner's SCS$DIRECTORY self-
  * registration (category 0x02, op 0x0d), the ONE cat-0x02 frame a real joiner
@@ -752,6 +815,203 @@ int scs_member_build_dlm_selfreg(const struct scs_member_params *p,
     return 0;
 }
 
+/*
+ * scs_member_build_dlm_nl_enq - originate an honest NULL-mode (NL) DLM registration
+ * (cat 0x02 op 0x01 ENQ) for a resource a non-coordinator member has SHOWN OVMX in
+ * its op-0d directory-rebuild record (db20-b, vms-7e2). The RESPOND-to-rebuild model
+ * VAX1 granted 48/48: OVMX accepts directory-node participation in the resource the
+ * cluster asked it to rebuild, holding NOTHING (mode hard-pinned NL). INV-6: the
+ * resource NAME comes from the shown record; every other field is OVMX's own true
+ * state (txn tag, its per-VC counter, its own member_count) or an honest ZERO
+ * (dir_hash -- a SCS$DIRECTORY hash is computed from the name, not echoed, and OVMX
+ * does not compute the VMS hash; omit rather than invent). body[4:6]=txn,
+ * body[6:8]=the per-VC counter (the granted frame's incrementing field) -- NEVER a
+ * node-index (0x0003 there is the DIR_TAG, coincident with OVMX being node 3).
+ */
+int scs_member_build_dlm_nl_enq(const struct scs_member_params *p,
+                                uint16_t dir_hash,
+                                const char *resname, uint8_t namelen,
+                                uint8_t out[SCS_MEMBER_FRAME_LEN])
+{
+    if (p == NULL || out == NULL || resname == NULL) {
+        return -1;
+    }
+    if (namelen == 0 || namelen > 31) {   /* a VMS resource name is 1..31 bytes */
+        return -1;
+    }
+    build_common(p, member_config_tmpl, SCS_MEMBER_ENV_CREDIT_CONFIG, out);
+
+    uint8_t *body = out + 72;
+    memset(body + 4, 0, SCS_MEMBER_SCA_LEN - SCS_MEMBER_BODY_OFF - 4);
+    put_le16(body + 0, p->sysap_send_msg);
+    put_le16(body + 2, p->sysap_ack_msg);
+    put_le16(body + 4, p->txn);           /* per-VC directory tag (opaque, minted) */
+    put_le16(body + 6, p->checksum);      /* per-VC monotonic counter (opaque, minted) */
+    body[8]  = SCS_MEMBER_CAT_DLM;         /* 0x02 */
+    body[9]  = 0x01;                       /* op 0x01 = ENQ */
+    put_le16(body + 10, dir_hash);         /* honest 0 -- computed from the name, not echoed (INV-6) */
+    body[12] = 0x01;                       /* node-independent constant */
+    put_le16(body + 14, p->member_count);  /* OVMX's own true post-transition member count */
+    /* body[16:30] zero -- ungrounded per-message ids (INV-6: never replay VAX3's). */
+    body[30] = 0x00;                       /* == NL. HARD-PINNED -- the INV-6 guarantee. */
+    /* body[31:47] zero. */
+    body[47] = namelen;                    /* resource-name length */
+    memcpy(body + 48, resname, namelen);   /* the discovered resource name; value block stays null */
+    return 0;
+}
+
+/*
+ * scs_member_build_dlm_op04 / scs_member_build_dlm_commit - the joiner's
+ * rebuild-COMPLETION pair (cat 0x02 op 0x04, then op 0x03 COMMIT) that a real
+ * joiner drives to the COORDINATOR after its op-01 registrations, closing the
+ * directory-rebuild transaction (vms-cn3 minimal-completion test). OVMX drives
+ * the completion but registers NOTHING HELD: it holds no persistent cluster
+ * lock (its DLM takes only transient RMS/ACP locks -- scsd.c:1631 "OVMX holds no
+ * locks... revisit when it has a real lock manager to answer FROM"), so this is
+ * the honest "my rebuild contribution is complete, I hold nothing" signal.
+ *
+ * The frame STRUCTURE is reproduced from the coordinator-rebuild specimens
+ * (JOIN->COORD F11B$aSYSDSK1, member-body layout validated by db20-b -- cat@8
+ * op@9, the 0x00030001 status word @12:16, mode@30, resname@48, per-lock handles
+ * @20:24 + @24:28). INV-6 / honesty guardrail, enforced by construction:
+ *   - resname (body[48:]) is ZEROED   -> claims NO named resource.
+ *   - the per-lock handle words (body[20:28]) are ZEROED -> claims NO held lock.
+ * i.e. the completion carries no resource and no lock handle OVMX cannot honestly
+ * back. Everything else replays the specimen's opaque structural bytes (Rule 8:
+ * reproduce the frame shape, invent nothing). If the coordinator counts OVMX off
+ * this content-free completion, completion alone suffices (OPT A); if not, the
+ * standing system-lock set is genuinely required (OPT B, a completeness call).
+ */
+static const uint8_t dlm_op04_struct[40] = {
+    /* body[ 8:16] */ 0x02, 0x04, 0x00, 0x00, 0x01, 0x00, 0x03, 0x00,
+    /* body[16:24] */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* [20:24] handle ZEROED */
+    /* body[24:32] */ 0x00, 0x00, 0x00, 0x00, 0x4b, 0x00, 0x00, 0x00, /* [24:28] handle ZEROED */
+    /* body[32:40] */ 0x02, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00,
+    /* body[40:48] */ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* [47] len ZEROED (no resname) */
+};
+static const uint8_t dlm_commit_struct[40] = {
+    /* body[ 8:16] */ 0x02, 0x03, 0x00, 0x00, 0x01, 0x00, 0x03, 0x00,
+    /* body[16:24] */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* [20:24] handle ZEROED */
+    /* body[24:32] */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* [24:28] handle ZEROED */
+    /* body[32:40] */ 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    /* body[40:48] */ 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    /* op-03 commits BY HANDLE with no resname; here the handle is null too. */
+};
+
+static int build_dlm_completion(const struct scs_member_params *p,
+                                const uint8_t struct40[40], uint32_t master_lkid,
+                                uint32_t req_lkid, uint8_t out[SCS_MEMBER_FRAME_LEN])
+{
+    if (p == NULL || out == NULL) {
+        return -1;
+    }
+    build_common(p, member_config_tmpl, SCS_MEMBER_ENV_CREDIT_CONFIG, out);
+    uint8_t *body = out + 72;
+    memset(body + 4, 0, SCS_MEMBER_SCA_LEN - SCS_MEMBER_BODY_OFF - 4);
+    put_le16(body + 0, p->sysap_send_msg);
+    put_le16(body + 2, p->sysap_ack_msg);
+    put_le16(body + 4, p->txn);          /* per-VC directory-tree tag (opaque, minted) */
+    put_le16(body + 6, p->checksum);     /* per-VC monotonic counter (opaque, minted) */
+    memcpy(body + 8, struct40, 40);      /* body[8:48] structural template */
+    /*
+     * The rebuild-completion references the MASTER's granted lock, matching the
+     * real requester->master completion (conductor's VAX<->VAX chain, vms-16c):
+     *   body[20:24] = the MASTER's lock handle (what VAX1 returned in its GRANT and
+     *                 looks up in ITS lock DB). This is the field whose placeholder
+     *                 0x00000001 bugchecked VAX1 (INVLOCKID). It now carries the real
+     *                 handle OVMX's executive RECORDED from the grant (grant_recv ->
+     *                 GETLKI), never a placeholder or an un-backed wire copy: the
+     *                 caller passes 0 when the executive holds no real grant, and the
+     *                 caller must then NOT send the frame (honest omission, INV-6).
+     *   body[24:28] = OVMX's OWN requester lkid, echoed as in the real completion so
+     *                 the master can pair the completion with the lock it granted.
+     * body[30] MODE stays NL; body[48:] resname stays 0 (op-03 commits by handle).
+     */
+    put_le32(body + 20, master_lkid);
+    put_le32(body + 24, req_lkid);
+    return 0;
+}
+
+int scs_member_build_dlm_op04(const struct scs_member_params *p, uint32_t master_lkid,
+                              uint32_t req_lkid, uint8_t out[SCS_MEMBER_FRAME_LEN])
+{
+    return build_dlm_completion(p, dlm_op04_struct, master_lkid, req_lkid, out);
+}
+
+int scs_member_build_dlm_commit(const struct scs_member_params *p, uint32_t master_lkid,
+                                uint32_t req_lkid, uint8_t out[SCS_MEMBER_FRAME_LEN])
+{
+    return build_dlm_completion(p, dlm_commit_struct, master_lkid, req_lkid, out);
+}
+
+/*
+ * scs_member_build_dlm_reg_enq - originate the cat 0x02 op 0x01 ENQ that
+ * REGISTERS one of OVMX's REAL standing system locks in the cluster directory,
+ * driven to the COORDINATOR during a rebuild (Layer 3 of faithful cluster DLM
+ * registration, vms-74f). Unlike db20-b's NL-only presence ENQ (which zeroed the
+ * id fields because it registered NOTHING), this carries OVMX's REAL local lock
+ * handle -- req_lkid, from the vms-1f4 DLM_ENUM_STANDING accessor: the handle of a
+ * lock the executive GENUINELY HOLDS (the standing F11B$v<label> volume lock a
+ * MOUNT holds, vms-25e). Because op-01 registers a REAL held lock (not the
+ * content-free OPT-A completion), the rebuild transaction has real substance --
+ * fixing the dangling transaction that reformed the cluster in OPT A. The
+ * subsequent op-04/op-03 that COMPLETE the transaction carry their own per-lock
+ * handles; those builders + the await-grant sequencing are Layer 3 scsd, not here.
+ *
+ * Run 9c showed the coordinator DROPS a skeletal op-01 (req_lkid + resname, rest
+ * zero): a granted ref ENQ carries a FULL per-lock record. So the caller passes a
+ * scs_dlm_reg_fields sourced ENTIRELY from OVMX's own genuine lock state (INV-6):
+ *   req_lkid @ body[4:8]  -- OVMX's own lock handle (DLM_ENUM_STANDING)
+ *   dir_csid @ body[20:24]-- the resource's directory-master csid, in OVMX's OWN
+ *                            encoding (GET_RESMASTER); this is the measured
+ *                            operator-scope decider -- if VAX2 grants off OVMX's
+ *                            encoding, honest CN=3 lands with no cluster-DLM scope.
+ *   lock_id  @ body[24:28]-- OVMX's unique per-lock id
+ *   flags    @ body[28:30], mode @ body[30] (NL, genuinely held),
+ *   lockmgmt @ body[32:36]-- count/flags word (n_granted).
+ * body[16:20] req_csid stays 0 (the reference had it 0 in 846/846). Built on
+ * db20-b's VALIDATED op-01 frame (VAX1 granted 48/48). NEVER replay VAX3's handles.
+ */
+int scs_member_build_dlm_reg_enq(const struct scs_member_params *p,
+                                 const char *resname, uint8_t namelen,
+                                 const struct scs_dlm_reg_fields *f,
+                                 uint8_t out[SCS_MEMBER_FRAME_LEN])
+{
+    if (p == NULL || out == NULL || resname == NULL || f == NULL) {
+        return -1;
+    }
+    if (namelen == 0 || namelen > 31) {   /* a VMS resource name is 1..31 bytes */
+        return -1;
+    }
+    build_common(p, member_config_tmpl, SCS_MEMBER_ENV_CREDIT_CONFIG, out);
+
+    uint8_t *body = out + 72;
+    memset(body + 4, 0, SCS_MEMBER_SCA_LEN - SCS_MEMBER_BODY_OFF - 4);
+    put_le16(body + 0, p->sysap_send_msg);
+    put_le16(body + 2, p->sysap_ack_msg);
+    /*
+     * A FULL per-lock DLM record for the standing lock OVMX genuinely holds --
+     * every field a REAL attribute of its own lock (INV-6), in OVMX's own
+     * executive encoding (grounded from the ref op-01 846-ENQ survey, offsets
+     * moderate-confidence; the lab validates each). A skeletal record (req_lkid +
+     * resname, rest zero) is dropped by the coordinator (run 9c).
+     */
+    put_le32(body + 4,  f->req_lkid);      /* body[4:8]   OVMX's own lock handle */
+    body[8]  = 0x02;                       /* cat 0x02 (DLM) */
+    body[9]  = 0x01;                       /* op 0x01 = ENQ */
+    body[12] = 0x01;                       /* node-independent constant; with member_count forms 0x00030001 at CN=3 */
+    put_le16(body + 14, p->member_count);  /* OVMX's own true post-transition member count */
+    /* body[16:20] req_csid = 0 (from memset -- the reference had it 0 in 846/846). */
+    put_le32(body + 20, f->dir_csid);      /* body[20:24] the resource's DIRECTORY-master csid (OVMX's own dir_csid, from GET_RESMASTER) */
+    put_le32(body + 24, f->lock_id);       /* body[24:28] OVMX's unique per-lock id */
+    put_le16(body + 28, f->flags);         /* body[28:30] lock flags */
+    body[30] = f->mode;                    /* body[30]    granted mode (NL for the volume presence lock) */
+    put_le32(body + 32, f->lockmgmt);      /* body[32:36] lock-mgmt count/flags word */
+    body[47] = namelen;                    /* resource-name length */
+    memcpy(body + 48, resname, namelen);
+    return 0;
+}
+
 int scs_member_build_response(const struct scs_member_params *p,
                               const uint8_t *req_frame, size_t req_len,
                               uint8_t out[SCS_MEMBER_FRAME_LEN])
diff --git a/src/vmsscs/scsd.c b/src/vmsscs/scsd.c
index 0ea234218..a183c11f2 100644
--- a/src/vmsscs/scsd.c
+++ b/src/vmsscs/scsd.c
@@ -373,6 +373,10 @@ static void ovmx_cluster_logical(uint16_t sysid, uint8_t out[6])
 /* --- vms-5fe: directed-HELLO / SCS-connect responder state --- */
 
 #define OVMX_MAX_PEERS 4
+/* vms-655/db20-b: cap on distinct resources OVMX NL-registers per member during a
+ * directory rebuild (the reference joiner registered a bounded subset of what it
+ * was shown). Dedup + cap live in dlm_nl_reg_add. */
+#define OVMX_DLM_NL_MAX 48
 
 /* vms-298 / vms-584 item 5: THE CON.ID HIGH WORD IS PER-BOOT, NOT COMPILE-TIME.
  *
@@ -1049,6 +1053,12 @@ struct peer_state {
      * body[6:8] counter is ps->own_cksum (shared with the barrier steps); the
      * txn tag is the SCSD_DLM_DIR_TAG constant. */
     int      dlm_selfreg_sent;          /* one-shot: self-reg emitted for the current epoch */
+    int      dlm_reg_sent;              /* one-shot: op-01 standing-lock registrations driven to THIS peer, the resource directory node (vms-74f/vms-16c) */
+    int      dlm_completion_sent;       /* one-shot: op-04+op-03 rebuild completion driven to the peer we registered to (vms-74f/vms-16c) */
+    /* vms-655/db20-b: resources OVMX has NL-registered to THIS member in response
+     * to its op-0d rebuild records (dedup, so each shown resource registers once). */
+    char     dlm_nl_reg[OVMX_DLM_NL_MAX][32];
+    int      dlm_nl_reg_n;
     /* rd vms-ec75 (DLM rung H11): DISTRIBUTED DEADLOCK SEARCH. A contender node
      * holds one resource (mastered by C) and $ENQs a second that QUEUES behind the
      * other contender -- a genuine cross-node wait-for cycle. When the wait queues,
@@ -1527,6 +1537,9 @@ static struct peer_state *cm_pick_coordinator(struct peer_state *tbl)
 #define CM_RSP_ECHO  1  /* full-body 0x81 echo + the three sec 4(p) mutations */
 #define CM_RSP_TOKEN 2  /* (txn,checksum) + OUR OWN node-parameter block only */
 #define CM_RSP_DLM   3  /* verbatim echo + body[34]=0xf9, NO cat-0x01 mutations */
+#define CM_RSP_DLM_ENQ 4 /* vms-16c: a real cat-82 op-01 GRANT from executive lock
+                          * state -- GROUNDED through the CM response machinery (the
+                          * request's txn/send_seq correlation) so VAX ACCEPTS it. */
 
 /*
  * cm_response_shape - decide how (and WHETHER) to answer a token-correlated
@@ -1609,26 +1622,21 @@ static int cm_response_shape(uint8_t category, uint8_t opcode)
         if (opcode == SCS_MEMBER_OP_DLM_REBUILD) {
             return CM_RSP_DLM;
         }
-        /* op 0x01 (and its 3x-higher-volume sibling op 0x12): SILENCE IS THE
-         * GROUNDED ANSWER HERE, not a gap to be closed. Do not "finish" this.
-         *
-         * A real responder's 0x82/0x01 reply is NOT derivable from the request:
-         * it echoes body[0:20] and body[56:132] but REWRITES the 36-byte window
-         * body[20:56] from its own lock-manager state. Mechanically tested over
-         * 17218 real request/response pairs in two captures -- the op-0x0d
-         * recipe reconstructs 0 of them, and no recipe short of "have a lock
-         * database" reconstructs more than 37%. body[28:32] of the request is
-         * the SENDER'S lock handle and body[112:116] is address-shaped sender
-         * state; echoing either reflects a peer's live lock-database pointer,
-         * which is the INCONSTATE/LOCKMGRERR failure mode exactly.
-         *
-         * And refusing costs nothing: in the run where OVMX reached MEMBER, one
-         * arrived 47.8 s after membership, OVMX answered only the SCS credit,
-         * VAX1 NEVER retransmitted it, and OVMX was not dropped -- the opposite
-         * of op 0x0d, which retransmits 3x and freezes the barrier.
-         *
-         * OVMX holds no locks. The honest answer to a lock request is nothing.
-         * Revisit only when OVMX has a real lock manager to answer FROM. */
+        /* op 0x01 -- a cross-node lock ENQ. This USED to be "silence is the
+         * grounded answer" because a real 0x82/0x01 reply REWRITES the body[20:56]
+         * window from lock-manager state and "no recipe short of having a lock
+         * database" reconstructs it. OVMX now HAS that lock database (vms-16c,
+         * operator-directed faithful DLM): it masters the rebuild-assigned resource
+         * and its executive grants the ENQ from REAL lock state. So op-01 is now a
+         * GROUNDED response -- CM_RSP_DLM_ENQ, whose window is REWRITTEN from the
+         * executive's real grant (never echoed, never fabricated), sent through THIS
+         * response machinery so it carries the request's txn/send_seq correlation
+         * and VAX ACCEPTS it (the CM-grounding the earlier separate send lacked ->
+         * SCSD-W-CMUNGROUNDED retry storm). Only op-01; op-12 RELAY and every other
+         * cat-02 opcode still silence (not grounded). */
+        if (opcode == 0x01) {
+            return CM_RSP_DLM_ENQ;
+        }
         return CM_RSP_NONE;
     case SCS_MEMBER_CAT_MEMBERSHIP:
         /* Closes the transaction. Token + our OWN parameter block, never an
@@ -1681,6 +1689,13 @@ static struct {
      * SDA on both VAX1 and VAX3 reports `Found Node SYSID 000000000401` = 1025.
      * Learned, never computed (Rule 10). */
     uint16_t founding_sysid;
+    /* vms-655: OVMX's OWN cluster-assigned CSID (0x000X000X form), learned by
+     * IDENTITY from the cat-01 op-05 per-member membership record whose sysid
+     * matches our SCSSYSTEMID. Its low 16 bits are OVMX's node-index, which a
+     * granted op-01 req_lkid MUST carry (a VAX rejects a lock id whose
+     * node-index != the sender's). 0 until learned. Learned off the wire, never
+     * computed or hardcoded (Rule 10 / the operator's real-CN=3 bar). */
+    uint32_t assigned_csid;
 } ovmx_cluster;
 
 /*
@@ -2622,6 +2637,17 @@ static unsigned long sysap_cm_messages = 0;      /* ... and it was a CM dialogue
  * receive dispatch, far below, because it drives the whole CM dialogue. */
 static void scsd_sysap_msg_input(struct scs_cdt *cdt, const void *msg, size_t msglen,
                                  void *ctx);
+/* vms-16c: faithful-DLM primitives, DEFINED beside the other DLM /dev/vms helpers
+ * but CALLED earlier (op-0d rebuild handler / inbound op-01 request handler). */
+static uint32_t scsd_dlm_master_local(const char *resnam, uint32_t *out_lkid);
+static uint32_t cm_dlm_grant_inbound_op01(const char *resnam, uint8_t mode,
+                                          uint32_t req_csid, uint32_t req_lkid,
+                                          uint32_t *out_master_lkid,
+                                          uint32_t *out_queued);
+static uint32_t cm_dlm_record_grant_from_master(uint32_t req_lkid, uint32_t master_lkid,
+                                                uint32_t master_csid, uint8_t granted_mode,
+                                                const char *resnam);
+static uint32_t cm_dlm_getlki_master_lkid(uint32_t req_lkid);
 
 /* vms-34b: installed on the MSCP$DISK SERVER CDT (OVMX_MSCP_SERVER_CONID)
  * the moment OVMX accepts a member-opened MSCP$DISK connect. Defined with the
@@ -3673,6 +3699,23 @@ static ssize_t send_frame_raw(int sock, int ifindex, const uint8_t mac[6],
  *                             between barrier steps 4 and 5 on the one CM send_seq
  *                             stream; a null-value-block directory record, CHOKED
  *                             like every other sequenced VC message
+ *     cm_send_dlm_registration() the cat-0x02 op-0x01 ENQ per standing lock the
+ *                             executive genuinely holds, registering OVMX's REAL
+ *                             locks to the coordinator on the op-06 admission burst
+ *                             (vms-74f, Layer 3); one sequenced VC message per lock,
+ *                             CHOKED like the self-reg
+ *     cm_send_dlm_completion_one() the cat-0x02 op-0x04 + op-0x03 COMMIT pair for ONE
+ *                             lock that CLOSES a registration once the master's cat-82
+ *                             op-01 grant arrives and the executive has RECORDED it
+ *                             (vms-74f/vms-16c); carries the MASTER's granted handle
+ *                             read back from the executive (grant_recv->GETLKI) + OVMX's
+ *                             own requester lkid, two sequenced VC messages, CHOKED
+ *     cm_send_dlm_nl_register() the cat-0x02 op-0x01 NULL-mode ENQ OVMX originates
+ *                             REACTIVELY for each resource a non-coordinator member
+ *                             shows it in an op-0d rebuild record (vms-655/db20-b) --
+ *                             the respond-to-rebuild that drains the member's
+ *                             directory rebuild; NL (holds nothing), one sequenced
+ *                             VC message per shown resource, CHOKED
  *     scs_reflect_credit()    the op8->op9 / op6->op7 credit handshake reply
  *     scs_send_disconnect_self() self-directed teardown, hand-built frame
  *
@@ -6477,6 +6520,323 @@ static int cm_send_dlm_selfreg(int sock, int ifindex, struct peer_state *ps,
     return 0;
 }
 
+/* Max standing locks scsd registers per rebuild (matches VMS_DLM_ENUM_STANDING_MAX;
+ * defined locally so the SCSD_UNIT_TEST seam, which omits vms_ioctl.h, still sizes
+ * the array). */
+#define SCSD_STANDING_MAX 16
+
+/* One of this node's standing cluster-registrable locks (Layer 3, vms-74f): the
+ * resource name + OVMX's OWN real lock handle, as the executive reports them. */
+struct scsd_standing_lock {
+    char     resnam[32];
+    uint8_t  namelen;
+    uint32_t lkid;
+};
+
+/*
+ * scsd_enum_standing_locks - read this node's standing cluster-registrable locks
+ * from the executive over /dev/vms (VMS_IOCTL_DLM_ENUM_STANDING, Layer 2). Fills
+ * up to `max` entries into `out`; returns the count. FAIL-HONEST: 0 on any
+ * failure (no /dev/vms, ioctl error) -- scsd registers ONLY what the executive
+ * genuinely reports it holds (INV-6). Direct ioctl (scsd is glibc, not the
+ * freestanding vms_kif client), mirroring scsd_dlm_dispatch_to_executive().
+ */
+static int scsd_enum_standing_locks(struct scsd_standing_lock *out, int max)
+{
+#ifdef SCSD_UNIT_TEST
+    (void)out; (void)max;
+    return 0;   /* wire test seam: executive-resident, the ioctl path is unexercised */
+#else
+    struct vms_dlm_enum_standing_args args;
+    struct vms_register_args reg;
+    int fd = open("/dev/vms", O_RDWR);
+    if (fd < 0) {
+        return 0;
+    }
+    memset(&reg, 0, sizeof(reg));
+    if (ioctl(fd, VMS_IOCTL_REGISTER, &reg) < 0) { close(fd); return 0; }
+    memset(&args, 0, sizeof(args));
+    if (ioctl(fd, VMS_IOCTL_DLM_ENUM_STANDING, &args) < 0) { close(fd); return 0; }
+    close(fd);
+
+    int n = 0;
+    for (uint32_t i = 0; i < args.count && n < max; i++) {
+        char nm[32];
+        memcpy(nm, args.ent[i].resnam, 32);
+        nm[31] = '\0';
+        uint8_t nl = 31;
+        while (nl > 0 && (nm[nl - 1] == ' ' || nm[nl - 1] == '\0')) {
+            nl--;
+        }
+        /* a real resource name is 1..31 bytes beginning with a letter. */
+        if (nl == 0 || !(nm[0] >= 'A' && nm[0] <= 'Z')) {
+            continue;
+        }
+        memcpy(out[n].resnam, nm, sizeof(out[n].resnam));
+        out[n].namelen = nl;
+        out[n].lkid = args.ent[i].lkid;
+        n++;
+    }
+    return n;
+#endif
+}
+
+/*
+ * cm_dlm_frame_common - fill the per-send SCS/SYSAP envelope every cat-02 DLM
+ * frame OVMX originates on the coordinator VC shares (Layer 3). Advances the VC
+ * sequence + per-VC counters, so the caller only fills the DLM body.
+ */
+static void cm_dlm_frame_common(struct peer_state *ps, const uint8_t our_hw_mac[6],
+                                const uint8_t our_src_logical[6],
+                                struct scs_member_params *bp)
+{
+    memset(bp, 0, sizeof(*bp));
+    memcpy(bp->dst_mac, ps_port_addr(ps), 6);
+    memcpy(bp->src_mac, our_hw_mac, 6);
+    memcpy(bp->src_logical, our_src_logical, 6);
+    memcpy(bp->peer_logical, ps_sys_addr(ps), 6);
+    bp->remote_conid = ps->cm_remote_conid;
+    bp->local_conid = ps->cm_local_conid;
+    bp->incarnation = ps->incarnation;
+    bp->recv_ack = ps->vc.seq.recv_seq;
+    bp->send_seq = scs_seq_advance(&ps->vc.seq);
+    if (ps->sysap_send == 0) {
+        ps->sysap_send = 1;
+    }
+    bp->sysap_send_msg = ps->sysap_send++;
+    bp->sysap_ack_msg = ps->sysap_recv;
+    bp->txn = SCSD_DLM_DIR_TAG;       /* SCS$DIRECTORY tree tag, as the self-reg */
+    bp->checksum = ++ps->own_cksum;   /* continuous per-VC counter */
+    bp->member_count = ovmx_cluster.known ? ovmx_cluster.member_count : 0;
+}
+
+/*
+ * dlm_op0d_resname - extract the resource name from a received op-0d rebuild record
+ * (db20-b/5bdbad43). The name is 31 ASCII bytes at body[SCS_DLM_B_RESNAM]=body[48]
+ * (scs_dlm.h). Returns the trimmed length, or 0 if body[48] is not a plausible name
+ * (must begin with A-Z) -- honest reject over registering a garbage resource.
+ */
+static uint8_t dlm_op0d_resname(const uint8_t *body, char out[32])
+{
+    memset(out, 0, 32);
+    memcpy(out, body + SCS_DLM_B_RESNAM, 31);
+    if (!(out[0] >= 'A' && out[0] <= 'Z')) {
+        return 0;
+    }
+    uint8_t nl = 31;
+    while (nl > 0 && (out[nl - 1] == ' ' || out[nl - 1] == '\0')) {
+        nl--;
+    }
+    return nl;
+}
+
+/*
+ * dlm_nl_reg_add - record that OVMX has NL-registered resource `res` (32-byte fixed
+ * field) to this member; returns 1 if NEW (register it now), 0 if already registered
+ * or the per-member cap (OVMX_DLM_NL_MAX) is reached. Dedup so each shown resource
+ * registers once (db20-b).
+ */
+static int dlm_nl_reg_add(struct peer_state *ps, const char res[32])
+{
+    for (int i = 0; i < ps->dlm_nl_reg_n; i++) {
+        if (memcmp(ps->dlm_nl_reg[i], res, 32) == 0) {
+            return 0;
+        }
+    }
+    if (ps->dlm_nl_reg_n >= OVMX_DLM_NL_MAX) {
+        return 0;
+    }
+    memcpy(ps->dlm_nl_reg[ps->dlm_nl_reg_n++], res, 32);
+    return 1;
+}
+
+/*
+ * cm_send_dlm_nl_register - originate an honest NULL-mode DLM registration (cat 0x02
+ * op 0x01 ENQ, mode NL) for a resource a NON-COORDINATOR member has shown OVMX in an
+ * op-0d rebuild record (db20-b, vms-7e2). This is the RESPOND-to-rebuild the member
+ * needs to DRAIN its directory rebuild with OVMX (and, per db20-b, advance to the
+ * SCA$TRANSPORT member-STATUS probe). Frame built by scs_member_build_dlm_nl_enq
+ * (mode HARD-PINNED NL -- OVMX holds nothing, registers only directory
+ * participation). Envelope from cm_dlm_frame_common (txn=DIR_TAG, per-VC counter,
+ * OVMX's own member_count). CHOKED through send_frame_vc like every sequenced frame.
+ */
+static int cm_send_dlm_nl_register(int sock, int ifindex, struct peer_state *ps,
+                                   const uint8_t our_hw_mac[6],
+                                   const uint8_t our_src_logical[6],
+                                   uint16_t dir_hash, const char *resname,
+                                   uint8_t namelen)
+{
+    if (ps->cm_local_conid == 0) {
+        return 0;
+    }
+    struct scs_member_params bp;
+    cm_dlm_frame_common(ps, our_hw_mac, our_src_logical, &bp);
+    uint8_t dframe[SCS_MEMBER_FRAME_LEN];
+    if (scs_member_build_dlm_nl_enq(&bp, dir_hash, resname, namelen, dframe) == 0 &&
+        send_frame_vc(sock, ifindex, ps, ps->pb,
+                      "CM DLM NL registration (cat 0x02 op 0x01, mode NL)",
+                      dframe, sizeof(dframe)) > 0) {
+        scs_vc_record_sent(&ps->vc, bp.send_seq, monotonic_ms());
+        log_ts(stdout);
+        printf(" SCSD-I-DLMNLREG, originated NL-mode DLM registration in response to"
+               " an op-0d rebuild record (cat 0x02 op 0x01 NL, res='%.*s' hash=0x%04x"
+               " cksum=0x%04x seq=%u)\n",
+               (int)namelen, resname, dir_hash, bp.checksum, bp.send_seq);
+        fflush(stdout);
+        return 1;
+    }
+    return 0;
+}
+
+/*
+ * cm_send_dlm_registration - drive OVMX's REAL standing-lock registrations to the
+ * COORDINATOR (Layer 3, vms-74f). Enumerate the node's standing locks (the
+ * F11B$v<label> volume lock a MOUNT holds -- vms-25e/1f4) and originate one cat-02
+ * op-01 ENQ per lock, carrying OVMX's OWN real handle (req_lkid) + its real
+ * resource name. This is what OVMX was missing: a real registration behind the
+ * op-03 COMMIT, so the rebuild transaction has substance (unlike OPT A's dangling
+ * commit that reformed the cluster).
+ *
+ * dir_csid = 0 (body[20:24]). This is DELIBERATE and measured, not a gap: OVMX must
+ * NOT compute the resource's directory master. Its executive directory uses
+ * exec_jhash (an OVMX design choice; VMS's directory hash is unpublished, Rule 8),
+ * so any value OVMX computes is uncorrelated with VMS's choice -- and asserting
+ * itself as master (vms-655's 90b3bbbd, dir_csid=OVMX) BROKE the real cluster
+ * (VAX1 reformed, CN 2->1). The reference joiner registers each resource to a
+ * MEMBER, which masters it; a joiner never self-masters mid-transition. db20-b
+ * PROVED a dir_csid=0 op-01 is GRANTED (48/48) -- the master is implicit (the
+ * granting node). So OVMX registers its REAL held lock with dir_csid=0 and lets
+ * the connected member master it. db20-b was granted-but-insufficient only because
+ * it carried ZERO handles; the fix is the real req_lkid/lock_id below. CHOKED.
+ */
+static int cm_send_dlm_registration(int sock, int ifindex, struct peer_state *ps,
+                                    const uint8_t our_hw_mac[6],
+                                    const uint8_t our_src_logical[6])
+{
+    if (ps->cm_local_conid == 0) {
+        return 0;
+    }
+    struct scsd_standing_lock locks[SCSD_STANDING_MAX];
+    int n = scsd_enum_standing_locks(locks, SCSD_STANDING_MAX);
+    int sent = 0;
+    for (int i = 0; i < n; i++) {
+        struct scs_member_params bp;
+        cm_dlm_frame_common(ps, our_hw_mac, our_src_logical, &bp);
+        /*
+         * The op-01 record, matched to db20-b's GRANTED baseline (VAX granted it
+         * 48/48) with ONE honest correction measured on the 5360671a drop:
+         *   req_lkid = (OVMX's real lock handle << 16) | OVMX's node-index. A VAX
+         *     rejects a lock id whose LOW 16 bits (the node-index) aren't the
+         *     sender's; 5360671a sent the executive's raw lkid (low16=1, a wrong
+         *     node) and was dropped. The node-index is OVMX's cluster-assigned CSID
+         *     & 0xffff, LEARNED by identity from the op-05 record (never hardcoded).
+         *   dir_csid = 0 -- OVMX asserts no directory opinion (exec_jhash != VMS's
+         *     hash; self-mastering broke the cluster in 90b3bbbd).
+         *   lock_id / flags / lockmgmt = 0 -- db20-b was GRANTED with these zeroed;
+         *     add back only if the completion proves to need them.
+         *   mode = NL (the mode OVMX genuinely holds).
+         * INV-6: req_lkid is OVMX's REAL handle carried in OVMX's REAL (wire-learned)
+         * node-index; nothing fabricated. The caller fires only once assigned_csid
+         * is known, so node_index is always the real value here. */
+        uint32_t node_index = ovmx_cluster.assigned_csid & 0xffffu;
+        struct scs_dlm_reg_fields f;
+        memset(&f, 0, sizeof(f));
+        f.req_lkid = ((locks[i].lkid & 0xffffu) << 16) | node_index;
+        f.dir_csid = 0;                             /* master is the granter (measured) */
+        /*
+         * body[24:28] = OVMX's OWN requester lock id (vms-16c). This was ZEROED to
+         * "match db20-b's granted baseline" -- but that baseline was DEGENERATE: with
+         * body[24:28]=0 VAX1 had no requester lock id to build the normal grant pair,
+         * so it returned only a bare handle and OVMX's completion had no master id to
+         * reference -> placeholder -> VAX1 INVLOCKID bugcheck (fc8540ae crashed the
+         * cluster). The real requester carries its own lock id here (conductor's named
+         * VAX<->VAX chain: body[24:28] is the requester lkid, echoed ENQ->grant). Use
+         * OVMX's REAL handle in the same node-index encoding as req_lkid -- so VAX1
+         * runs the full handshake and returns a proper master handle. */
+        f.lock_id  = f.req_lkid;                    /* OVMX's real requester lkid (was 0 = degenerate) */
+        f.mode     = 0;                             /* NL -- the mode OVMX holds */
+        f.flags    = 0;                             /* match db20-b granted baseline */
+        f.lockmgmt = 0;                             /* match db20-b granted baseline */
+        uint8_t dframe[SCS_MEMBER_FRAME_LEN];
+        if (scs_member_build_dlm_reg_enq(&bp, locks[i].resnam, locks[i].namelen,
+                                         &f, dframe) == 0 &&
+            send_frame_vc(sock, ifindex, ps, ps->pb,
+                          "CM DLM registration ENQ (cat 0x02 op 0x01)",
+                          dframe, sizeof(dframe)) > 0) {
+            scs_vc_record_sent(&ps->vc, bp.send_seq, monotonic_ms());
+            sent++;
+            log_ts(stdout);
+            printf(" SCSD-I-DLMREGENQ, registered a REAL standing lock to the"
+                   " connected member (cat 0x02 op 0x01, res='%.*s'"
+                   " req_lkid=0x%08x [handle 0x%04x, node-index 0x%04x] dir_csid=0"
+                   " [master is the granter] cksum=0x%04x seq=%u)\n",
+                   (int)locks[i].namelen, locks[i].resnam, f.req_lkid,
+                   (unsigned)(locks[i].lkid & 0xffffu), (unsigned)node_index,
+                   bp.checksum, bp.send_seq);
+            fflush(stdout);
+        }
+    }
+    return sent;
+}
+
+/*
+ * cm_send_dlm_completion_one - CLOSE ONE standing-lock registration to the MASTER
+ * (the peer that granted it) with the op-04 completion + op-03 COMMIT (Layer 3,
+ * vms-74f / vms-16c), fired PER grant-back once the executive has RECORDED the
+ * master's grant. Both frames reference the MASTER's granted handle at body[20:24]
+ * (master_lkid, read back from OVMX's executive origin record via GETLKI -- REAL
+ * state, never a wire copy nor a placeholder) and OVMX's own requester lkid at
+ * body[24:28]. The caller invokes this ONLY with a non-zero master_lkid the
+ * executive genuinely holds; a lock with no recorded grant is omitted entirely
+ * (honest omission, INV-6) -- which is what makes this crash-safe: VAX1 never
+ * receives a completion whose lock id it cannot look up (the fc8540ae INVLOCKID).
+ */
+static int cm_send_dlm_completion_one(int sock, int ifindex, struct peer_state *ps,
+                                      const uint8_t our_hw_mac[6],
+                                      const uint8_t our_src_logical[6],
+                                      uint32_t req_lkid, uint32_t master_lkid)
+{
+    if (ps->cm_local_conid == 0 || master_lkid == 0 || req_lkid == 0) {
+        /* no real recorded grant -> send NOTHING (honest omission, INV-6) */
+        if (req_lkid != 0 && master_lkid == 0) {
+            log_ts(stdout);
+            printf(" SCSD-I-DLMNOCOMMIT, honest omission: executive holds no master"
+                   " handle for req_lkid=0x%08x -- no op-04/op-03 sent (INV-6)\n",
+                   req_lkid);
+            fflush(stdout);
+        }
+        return 0;
+    }
+    int sent = 0;
+    /* op 0x04 completion, then op 0x03 COMMIT, in order on the send_seq stream. */
+    struct scs_member_params bp4;
+    cm_dlm_frame_common(ps, our_hw_mac, our_src_logical, &bp4);
+    uint8_t f4[SCS_MEMBER_FRAME_LEN];
+    if (scs_member_build_dlm_op04(&bp4, master_lkid, req_lkid, f4) == 0 &&
+        send_frame_vc(sock, ifindex, ps, ps->pb,
+                      "CM DLM rebuild completion (cat 0x02 op 0x04)",
+                      f4, sizeof(f4)) > 0) {
+        scs_vc_record_sent(&ps->vc, bp4.send_seq, monotonic_ms());
+        sent++;
+    }
+    struct scs_member_params bp3;
+    cm_dlm_frame_common(ps, our_hw_mac, our_src_logical, &bp3);
+    uint8_t f3[SCS_MEMBER_FRAME_LEN];
+    if (scs_member_build_dlm_commit(&bp3, master_lkid, req_lkid, f3) == 0 &&
+        send_frame_vc(sock, ifindex, ps, ps->pb,
+                      "CM DLM rebuild COMMIT (cat 0x02 op 0x03)",
+                      f3, sizeof(f3)) > 0) {
+        scs_vc_record_sent(&ps->vc, bp3.send_seq, monotonic_ms());
+        sent++;
+        log_ts(stdout);
+        printf(" SCSD-I-DLMCOMPLETE, committed a standing lock to the master from REAL"
+               " executive state (op 0x04+0x03, req_lkid=0x%08x master_lkid=0x%08x seq=%u)\n",
+               req_lkid, master_lkid, bp3.send_seq);
+        fflush(stdout);
+    }
+    return sent;
+}
+
 /*
  * cm_send_ack - emit one category-0x04 SYSAP acknowledgement naming our current
  * high-water mark on the VC the connection-manager dialogue is riding.
@@ -7136,6 +7496,38 @@ static void scsd_sysap_msg_input(struct scs_cdt *cdt, const void *msg, size_t ms
                     ps->cm_last_recv_op = mv.opcode;
                 }
 
+                /* vms-655: LEARN OVMX's OWN cluster-assigned CSID from the
+                 * cat-0x01 op-0x05 per-member membership record, matched BY
+                 * IDENTITY (the record whose sysid == our own SCSSYSTEMID). The
+                 * record is {sysid @ body[20], csid @ body[36]} (csid = sysid+16,
+                 * verified across all three cluster nodes). Its low 16 bits are
+                 * OVMX's node-index, which a granted op-01 req_lkid must carry (a
+                 * VAX rejects a lock id whose node-index != the sender's, measured
+                 * on the 5360671a drop). Matching by our own sysid makes this
+                 * immune to offset drift -- a wrong offset simply never matches,
+                 * so we fail honest (no CSID learned) rather than fabricate one.
+                 * Learned off the wire, never computed/hardcoded (Rule 10). */
+                if (!mv.is_response && mv.category == SCS_MEMBER_CAT_CONFIG &&
+                    mv.opcode == SCS_MEMBER_OP_LOCKRB &&
+                    ovmx_cluster.assigned_csid == 0 && n >= 72 + 40) {
+                    const uint8_t *rb = buf + 72;
+                    uint32_t rec_sysid = (uint32_t)rb[20] | ((uint32_t)rb[21] << 8) |
+                                         ((uint32_t)rb[22] << 16) | ((uint32_t)rb[23] << 24);
+                    if (rec_sysid == (uint32_t)resolve_scssystemid()) {
+                        ovmx_cluster.assigned_csid =
+                            (uint32_t)rb[36] | ((uint32_t)rb[37] << 8) |
+                            ((uint32_t)rb[38] << 16) | ((uint32_t)rb[39] << 24);
+                        log_ts(stdout);
+                        printf(" SCSD-I-CSIDLEARN, learned OVMX's cluster-assigned"
+                               " CSID 0x%08x (node-index 0x%04x) from the op-05"
+                               " membership record matching our SCSSYSTEMID %u\n",
+                               ovmx_cluster.assigned_csid,
+                               ovmx_cluster.assigned_csid & 0xffffu,
+                               (unsigned)resolve_scssystemid());
+                        fflush(stdout);
+                    }
+                }
+
                 /* vms-7a9: consume the peer's advertised VOTES from its
                  * cat-0x01 op-0x01 cluster-parameters message (grounded LE u16
                  * at VC body[22:24], spec sec 4j) and fold it into the quorum
@@ -7229,6 +7621,88 @@ static void scsd_sysap_msg_input(struct scs_cdt *cdt, const void *msg, size_t ms
                 int cm_token_req = cm_req && mv.txn != 0;
                 int cm_plain_req = cm_req && mv.txn == 0;
 
+                /*
+                 * vms-74f/vms-16c (Layer 3): the cat-82 op-01 GRANT for OVMX's
+                 * standing-lock registrations has ARRIVED -- the await-grant gate.
+                 * CLOSE the transaction: drive the op-04 completion + op-03 COMMIT
+                 * per lock (cm_send_dlm_completion). PURE trigger -- we extract NO
+                 * handle from the grant (op-04/op-03 carry OVMX's OWN handles, never
+                 * the granting node's mst_lkid).
+                 *
+                 * FIRES ON THE PEER OVMX REGISTERED TO, not the coordinator (vms-16c
+                 * FIX). In the rebuild OVMX registers each standing lock with that
+                 * resource's DIRECTORY node and completes with the SAME node --
+                 * measured, that is VAX1/1025 (the non-coordinator MEMBER that masters
+                 * OVMX's file locks F11B$aSYSDSK1/CACHE$cmSYSDSK1/VCC$vSYSDSK1/
+                 * SYS$_$2$DUA0:); the coordinator VAX2/1026 grants OVMX NOTHING. The
+                 * per-peer ps->dlm_reg_sent flag (armed at the cm_send_dlm_nl_register
+                 * origination site) IS the "peer we registered to" discriminator: it
+                 * is set ONLY on that peer, so the grant-back on that same ps fires
+                 * the completion and no other. The prior coordinator-keyed gate could
+                 * NEVER fire in this topology -- and the arming was ALSO lost when
+                 * cm_send_dlm_registration was retired, so dlm_reg_sent stayed 0:
+                 * 48 grants received, 0 completions, flow-1 never committed, CN=2.
+                 * One-shot per epoch; awaiting >=1 grant before committing is the
+                 * OPT-A insurance -- a commit with no grant behind it reformed the cluster.
+                 */
+                if (mv.is_response &&
+                    /* scs_member_parse keeps the RAW category, so a response
+                     * carries the 0x80 bit here (0x82) -- MUST mask with & 0x7f;
+                     * a bare `== CAT_DLM` never matches a grant (regression:
+                     * test_dlm_grant_response_needs_masking). */
+                    (mv.category & 0x7f) == SCS_MEMBER_CAT_DLM &&
+                    mv.opcode == 0x01) {
+                    /*
+                     * A cat-82 op-01 GRANT-BACK: the master (VAX1) granted one of OVMX's
+                     * own standing-lock registrations. Per the conductor's named
+                     * VAX<->VAX chain the grant echoes OVMX's requester lkid at
+                     * body[24:28] and carries the master's granted handle at body[28:30]
+                     * (16-bit, named resources). RECORD it in OVMX's executive
+                     * (grant_recv -> a real origin record), read the master handle BACK
+                     * (GETLKI), and complete ONLY from that real state (honest omission
+                     * otherwise, INV-6 -- a placeholder is what bugchecked VAX1 in
+                     * fc8540ae). The DISCRIMINATOR is the non-zero echoed reqlkid (a real
+                     * registration; the NL drain echoes 0), NOT ps->dlm_reg_sent -- a
+                     * mid-storm transition re-open can clear that flag before the
+                     * grant-back lands, silently dropping the completion (vms-16c). The
+                     * DLMGRANTBACK/DLMGRANTREC logs pin exactly where the chain breaks.
+                     */
+                    const uint8_t *gb = buf + 72;
+                    uint32_t ovmx_reqlkid = (uint32_t)gb[24] | ((uint32_t)gb[25] << 8) |
+                                            ((uint32_t)gb[26] << 16) | ((uint32_t)gb[27] << 24);
+                    uint32_t vax_master   = (uint32_t)gb[28] | ((uint32_t)gb[29] << 8);
+                    uint8_t  gmode        = gb[30];
+                    uint32_t master_csid  = (uint32_t)peer_node_number(ps);
+                    char gres[32];
+                    uint8_t grl = dlm_op0d_resname(gb, gres);
+                    log_ts(stdout);
+                    printf(" SCSD-I-DLMGRANTBACK, cat-82 op-01 grant-back (res='%.*s'"
+                           " reqlkid=0x%08x master=0x%04x reg_sent=%d)\n",
+                           (int)grl, gres, ovmx_reqlkid, vax_master, ps->dlm_reg_sent);
+                    fflush(stdout);
+                    if (ovmx_reqlkid != 0 && vax_master != 0) {
+                        uint32_t st_gr = cm_dlm_record_grant_from_master(ovmx_reqlkid,
+                                             vax_master, master_csid, gmode,
+                                             grl > 0 ? gres : NULL);
+                        uint32_t exec_master = cm_dlm_getlki_master_lkid(ovmx_reqlkid);
+                        log_ts(stdout);
+                        printf(" SCSD-I-DLMGRANTREC, recorded grant in executive"
+                               " (grant_recv=0x%08x getlki_master=0x%08x)\n",
+                               st_gr, exec_master);
+                        fflush(stdout);
+                        cm_send_dlm_completion_one(rx->sock, (int)rx->ifindex, ps,
+                                                   rx->our_hw_mac, rx->our_src_logical,
+                                                   ovmx_reqlkid, exec_master);
+                    }
+                }
+
+                /* vms-16c: the inbound cat-02 op-01 lock request is now answered by a
+                 * REAL, GROUNDED grant via cm_response_shape -> CM_RSP_DLM_ENQ in the
+                 * token-response machinery below (which carries the request's
+                 * txn/send_seq correlation so VAX accepts it). The earlier SEPARATE
+                 * send here was UNGROUNDED -> the CM layer logged SCSD-W-CMUNGROUNDED
+                 * and VAX rejected + retried (14K storm). Removed. */
+
                 /* vms-760: TRACE EVERY inbound CM message. This exists because
                  * a run stalled at barrier step 1 and the logs could not say
                  * whether the coordinator's op-0x0c release had arrived and
@@ -7273,29 +7747,55 @@ static void scsd_sysap_msg_input(struct scs_cdt *cdt, const void *msg, size_t ms
                  * genuine LOSE r4), because the coordinator only publishes the new
                  * membership once the transition COMMITS cluster-wide (Rule of
                  * Total Connectivity, Davis p.7-39) -- exactly the condition the
-                 * oracle measures. So XITDONE is emitted from THIS, latched once. */
+                 * oracle measures. So XITDONE is emitted from THIS, latched once.
+                 *
+                 * REFINED (vms-74f/vms-655, measured 2026-09-02): that 1:1 held in
+                 * the pre-DLM-registration sweep, but op-06 now GATES OVMX's DLM
+                 * standing-lock registration -- and a registration the coordinator
+                 * DROPS (e.g. dir_csid gap vms-655) leaves op-06 received yet
+                 * CLUSTER_NODES stuck at 2. op-06 is the admission INVITATION, not
+                 * proof of counting; the log below says so and no longer claims
+                 * "admitted". The latch is kept (oracle-compat) but its meaning is
+                 * "transition opened", not "counted". */
                 if (cm_plain_req && mv.category == SCS_MEMBER_CAT_CONFIG &&
                     mv.opcode == SCS_MEMBER_OP_MEMBERSHIP) {
                     ps->membership_bursts++;
                     if (!ovmx_cluster.membership_committed) {
                         ovmx_cluster.membership_committed = 1;
                         log_ts(stdout);
-                        printf(" SCSD-I-XITDONE, cluster membership COMMITTED --"
-                               " received the coordinator's op 0x06 MEMBERSHIP burst"
-                               " (post-commit membership publication) from"
-                               " %02x:%02x:%02x:%02x:%02x:%02x. This is the"
-                               " AUTHENTIC admission signal (1:1 with the member"
-                               " oracle F$GETSYI(\"CLUSTER_NODES\") 2->3, spec"
-                               " §4(O.38)): the coordinator publishes it only once"
-                               " the transition commits cluster-wide, so its receipt"
-                               " means OVMX is now an admitted cluster member --"
-                               " whether or not OVMX's own op-0x0c barrier"
-                               " (SCSD-I-XITBARRIER) has finished\n",
+                        printf(" SCSD-I-XITDONE, received the coordinator's op 0x06"
+                               " MEMBERSHIP burst (admission INVITATION) from"
+                               " %02x:%02x:%02x:%02x:%02x:%02x -- OVMX now drives its"
+                               " DLM standing-lock registration to the coordinator."
+                               " HONEST SCOPE: this is NECESSARY but NOT SUFFICIENT"
+                               " for counted membership. The op 0x06 burst opens the"
+                               " transition; F$GETSYI(\"CLUSTER_NODES\") increments to"
+                               " 3 ONLY once the DLM registration COMMITS cluster-wide"
+                               " (op-01 ENQ -> coordinator cat-82 op-01 GRANT -> op-04"
+                               " -> op-03 COMMIT, vms-74f). op-06 receipt alone is NOT"
+                               " admission -- a dropped op-01 leaves OVMX uncounted"
+                               " (measured 2026-09-02, dir_csid gap vms-655)\n",
                                ps_port_addr(ps)[0], ps_port_addr(ps)[1],
                                ps_port_addr(ps)[2], ps_port_addr(ps)[3],
                                ps_port_addr(ps)[4], ps_port_addr(ps)[5]);
                         fflush(stdout);
                     }
+                    /*
+                     * vms-655 (DETERMINISTIC finding 2026-09-02, reproduced across
+                     * two fresh clusters): OVMX must NOT originate a cat-02 op-01
+                     * here. An unsolicited pre-barrier op-01 from a not-yet-barrier'd
+                     * joiner makes the coordinator WITHHOLD XITGO: the op-0c barrier
+                     * never runs, the SCS$DIRECTORY selfreg (gated at barrier step 5)
+                     * never fires, VAX1 never pushes the directory rebuild, and OVMX
+                     * never counts (0 XITGO / 0 op-0b-0c / 0 op-0d, members=1). The
+                     * honest granted model is the REVERSE: stay quiet after op-06, let
+                     * the barrier run, and register REACTIVELY to VAX1's op-0d rebuild
+                     * requests (the CM_RSP_DLM path) -- the respond-to-rebuild model
+                     * db20-b was granted 48/48 for. So the op-06-gated origination is
+                     * removed. The real standing-lock registration (cm_send_dlm_registration)
+                     * now fires REACTIVELY in the CM_RSP_DLM echo path (vms-16c), post-barrier,
+                     * where it does not perturb XITGO -- NOT here.
+                     */
                 }
 
                 /* vms-c21 (spec §4(O.33)): the cat 0x01 op 0x04 role 0x50 CM
@@ -7545,6 +8045,9 @@ static void scsd_sysap_msg_input(struct scs_cdt *cdt, const void *msg, size_t ms
                      * the SCS$DIRECTORY self-registration is re-emitted at this
                      * barrier's start (cm_send_dlm_selfreg). */
                     ps->dlm_selfreg_sent = 0;
+                    ps->dlm_reg_sent = 0;        /* vms-74f: re-arm the standing-lock registration one-shot */
+                    ps->dlm_completion_sent = 0; /* vms-74f: re-arm the rebuild-completion one-shot */
+                    ps->dlm_nl_reg_n = 0;        /* vms-655: re-arm the reactive NL-registration dedup for the new epoch */
                     /* vms-584: the open carries the post-transition cluster
                      * facts. Latch them now, apply them when the transition
                      * is real (see ovmx_cluster_relearn). */
@@ -7861,6 +8364,40 @@ static void scsd_sysap_msg_input(struct scs_cdt *cdt, const void *msg, size_t ms
                     } else if (cm_shape == CM_RSP_DLM) {
                         rc_build = scs_member_build_dlm_response(
                             &mp, buf, (size_t)n, rframe);
+                    } else if (cm_shape == CM_RSP_DLM_ENQ) {
+                        /* vms-16c: GRANT the inbound op-01 from OVMX's REAL executive
+                         * lock state, then build the cat-82 grant with THIS response's
+                         * correlation (mp: the request's txn echo, send_seq, ack) so
+                         * VAX accepts it. Only on a real executive grant (status==1);
+                         * otherwise rc_build != 0 -> stay silent (honest, never a fake
+                         * grant). The response window is rewritten from real state
+                         * (master_lkid; body[28]=0 for NL) inside the builder. */
+                        const uint8_t *qb = buf + 72;
+                        char eres[32];
+                        uint8_t erl = dlm_op0d_resname(qb, eres);
+                        uint8_t emode = qb[30];
+                        if (emode > 5) emode = LCK$K_NLMODE;
+                        uint32_t ecsid = (uint32_t)peer_node_number(ps);
+                        uint32_t elkid = (uint32_t)qb[4] | ((uint32_t)qb[5] << 8) |
+                                         ((uint32_t)qb[6] << 16) | ((uint32_t)qb[7] << 24);
+                        uint32_t emlkid = 0, equeued = 0;
+                        uint32_t est = (erl > 0)
+                            ? cm_dlm_grant_inbound_op01(eres, emode, ecsid, elkid,
+                                                        &emlkid, &equeued)
+                            : 2680u;
+                        if (est == 1u &&
+                            scs_member_build_dlm_enq_response(&mp, buf, (size_t)n,
+                                                              emlkid, emode, rframe) == 0) {
+                            rc_build = 0;
+                            log_ts(stdout);
+                            printf(" SCSD-I-DLMGRANT, GROUNDED cat-82 op-01 grant from"
+                                   " REAL executive lock state (res='%.*s' req_csid=0x%08x"
+                                   " mode=%u master_lkid=0x%08x)\n",
+                                   (int)erl, eres, ecsid, emode, emlkid);
+                            fflush(stdout);
+                        } else {
+                            rc_build = -1;  /* not granted -> silent, no fabricated grant */
+                        }
                     } else {
                         rc_build = scs_member_build_response(
                             &mp, buf, (size_t)n, rframe);
@@ -7927,6 +8464,65 @@ static void scsd_sysap_msg_input(struct scs_cdt *cdt, const void *msg, size_t ms
                                cm_shape == CM_RSP_TOKEN ? "token-only" : (cm_shape == CM_RSP_DLM ? "dlm-echo" : "echoed"),
                                mp.sysap_send_msg, mp.sysap_ack_msg);
                         fflush(stdout);
+
+                        /* vms-655/db20-b (vms-7e2): having ECHOED a non-coordinator
+                         * member's op-0d rebuild record, register honest NL
+                         * participation in that resource -- the respond-to-rebuild
+                         * exchange the member needs to DRAIN its directory rebuild
+                         * with OVMX (and, per db20-b, advance to the SCA$TRANSPORT
+                         * member-STATUS probe). NL only (holding nothing); OVMX
+                         * invents nothing -- the resource NAME comes from the record
+                         * we were shown (body[48]), member_count is OVMX's own true
+                         * count, dir_hash an honest 0. Dedup so each shown resource
+                         * registers once. This is the reactive registration HEAD's
+                         * branch lacked (db20-b line e08d4f58); the op-06-gated
+                         * origination that perturbed XITGO is gone. */
+                        if (cm_shape == CM_RSP_DLM &&
+                            !cm_peer_is_coordinator(rx->peers, ps)) {
+                            char res[32];
+                            uint8_t nl = dlm_op0d_resname(buf + 72, res);
+                            if (nl > 0 && dlm_nl_reg_add(ps, res)) {
+                                /* flow-2: OVMX's executive MASTERS the rebuild-assigned
+                                 * resource FOR REAL (a real vms_lock_resource) so a later
+                                 * inbound cat-02 op-01 grants from REAL lock state.
+                                 * Fail-honest with no /dev/vms. (Separate from flow-1.) */
+                                uint32_t mlkid = 0;
+                                uint32_t st = scsd_dlm_master_local(res, &mlkid);
+                                log_ts(stdout);
+                                printf(" SCSD-I-DLMMASTER, mastered rebuild-assigned"
+                                       " resource FOR REAL in the executive (res='%.*s'"
+                                       " status=0x%08x lkid=0x%08x)\n",
+                                       (int)nl, res, st, mlkid);
+                                fflush(stdout);
+                                /* DRAIN: the NL respond-to-rebuild the member needs to
+                                 * advance its directory rebuild (db20-b). Kept; its
+                                 * grant-back carries req_lkid=0, which the flow-1
+                                 * completion gate below correctly ignores. */
+                                cm_send_dlm_nl_register(rx->sock, (int)rx->ifindex,
+                                                        ps, rx->our_hw_mac,
+                                                        rx->our_src_logical,
+                                                        0u, res, nl);
+                            }
+                            /* flow-1 (the CN=3 gate, vms-16c): ONCE OVMX sees this member's
+                             * directory rebuild (post-barrier) and its cluster CSID is
+                             * assigned, drive OVMX's REAL standing-lock registrations to it
+                             * -- enum_standing gives the real resource names + OVMX's real
+                             * requester lkid, now carried at body[24:28] so VAX1 runs the
+                             * full handshake and returns a master handle OVMX can complete
+                             * against. Reactive (NOT op-06-gated), so it does not perturb
+                             * XITGO -- the reason the old pre-barrier origination was
+                             * retired. One-shot; arms the per-peer completion (dlm_reg_sent):
+                             * the grant-backs then fire op-04/op-03 from REAL executive
+                             * state (grant_recv -> GETLKI) in the gate above. */
+                            if (!ps->dlm_reg_sent &&
+                                (ovmx_cluster.assigned_csid & 0xffffu) != 0) {
+                                int nreg = cm_send_dlm_registration(rx->sock,
+                                               (int)rx->ifindex, ps, rx->our_hw_mac,
+                                               rx->our_src_logical);
+                                if (nreg > 0)
+                                    ps->dlm_reg_sent = 1;
+                            }
+                        }
                     }
                 }
             }
@@ -8292,6 +8888,174 @@ static uint32_t scsd_dlm_local_read_valblk(const char *resnam,
 #endif
 }
 
+/*
+ * scsd_dlm_master_local - MASTER a rebuild-assigned resource FOR REAL (vms-16c,
+ * operator-directed faithful DLM). When VAX1's op-0d rebuild assigns OVMX the
+ * directory for resource `resnam`, OVMX's executive must genuinely master it (a
+ * real vms_lock_resource with master_csid==vms_local_csid) so a later inbound
+ * cross-node $ENQ grants from REAL lock state -- NOT the wire-imitation NL frame.
+ * A LOCAL $ENQ (NL mode: OVMX holds nothing, blocks nothing) reaches
+ * dlm_resolve_master (vms_lock.c) and, as directory-of-first-use, sets
+ * master_csid=vms_local_csid + creates the resource block. Returns the executive
+ * status (1 == mastered/granted); *out_lkid = OVMX's own lock handle. Fail-honest
+ * (SS$_NOSUCHDEV 2680) with no /dev/vms -- never fabricates a master.
+ */
+static uint32_t scsd_dlm_master_local(const char *resnam, uint32_t *out_lkid)
+{
+    if (out_lkid) *out_lkid = 0;
+#ifdef SCSD_UNIT_TEST
+    (void)resnam;
+    return 2296u;
+#else
+    struct vms_enq_args args;
+    struct vms_register_args reg;
+    int fd = open("/dev/vms", O_RDWR);
+    if (fd < 0)
+        return 2680u;
+    memset(&reg, 0, sizeof(reg));
+    if (ioctl(fd, VMS_IOCTL_REGISTER, &reg) < 0) { close(fd); return 2680u; }
+    memset(&args, 0, sizeof(args));
+    args.lkmode = LCK$K_NLMODE;      /* NL: master the resource, hold nothing */
+    args.flags = LCK_M_VALBLK;       /* read the LVB back (input all-zero: read, not clobber) */
+    if (resnam) {
+        strncpy(args.resnam, resnam, sizeof(args.resnam) - 1);
+        args.resnam[sizeof(args.resnam) - 1] = '\0';
+    }
+    if (ioctl(fd, VMS_IOCTL_ENQ, &args) < 0) { close(fd); return 2680u; }
+    uint32_t status = args.status;
+    if (status == 1u && out_lkid)
+        *out_lkid = args.lkid;
+    close(fd);
+    return status;
+#endif
+}
+
+/*
+ * cm_dlm_grant_inbound_op01 - GRANT an inbound CM cat-02 op-01 lock request FROM
+ * REAL LOCK STATE (vms-16c, faithful DLM). A member (VAX1/VAX2) sends a cat-02
+ * op-01 ENQ for resource `resnam`; OVMX, having mastered it (scsd_dlm_master_local
+ * on the op-0d assignment), routes the request to its executive lock manager via
+ * VMS_IOCTL_DLM_XNODE (the SAME real cross-node ENQ path the OVMX$DLM SYSAP server
+ * uses, H4-H11) and returns the executive's REAL status -- SS$_NORMAL(1)=granted,
+ * VMS_DLM_STS_QUEUED(0)=blocked. *out_master_lkid = the master's real lock handle
+ * for the grant; *out_queued = whether it queued. This is NOT wire imitation: the
+ * grant decision comes from OVMX's real vms_lock_resource. Fail-honest (2680) with
+ * no /dev/vms -- never a fabricated grant.
+ */
+static uint32_t cm_dlm_grant_inbound_op01(const char *resnam, uint8_t mode,
+                                          uint32_t req_csid, uint32_t req_lkid,
+                                          uint32_t *out_master_lkid,
+                                          uint32_t *out_queued)
+{
+    if (out_master_lkid) *out_master_lkid = 0;
+    if (out_queued) *out_queued = 0;
+#ifdef SCSD_UNIT_TEST
+    (void)resnam; (void)mode; (void)req_csid; (void)req_lkid;
+    return 2296u;
+#else
+    struct vms_dlm_xnode_args args;
+    struct vms_register_args reg;
+    int fd = open("/dev/vms", O_RDWR);
+    if (fd < 0)
+        return 2680u;
+    memset(&reg, 0, sizeof(reg));
+    if (ioctl(fd, VMS_IOCTL_REGISTER, &reg) < 0) { close(fd); return 2680u; }
+    memset(&args, 0, sizeof(args));
+    args.op = VMS_DLM_OP_ENQ;
+    args.lkmode = mode;
+    args.req_csid = req_csid;
+    args.req_lkid = req_lkid;
+    if (resnam) {
+        strncpy(args.resnam, resnam, sizeof(args.resnam) - 1);
+        args.resnam[sizeof(args.resnam) - 1] = '\0';
+    }
+    if (ioctl(fd, VMS_IOCTL_DLM_XNODE, &args) < 0) { close(fd); return 2680u; }
+    uint32_t status = args.status;
+    if (out_master_lkid) *out_master_lkid = args.master_lkid;
+    if (out_queued) *out_queued = args.queued;
+    close(fd);
+    return status;
+#endif
+}
+
+/*
+ * cm_dlm_record_grant_from_master - RECORD a master's grant of one of OVMX's own
+ * standing-lock registrations into OVMX's executive, FOR REAL (vms-16c, faithful
+ * flow-1). When VAX1 (the directory node for OVMX's file locks) grants OVMX's op-01
+ * registration, OVMX records that cross-node grant the way a real VMS requester does:
+ * a vms_dlm_origin record keyed by OVMX's OWN req_lkid, carrying the master's granted
+ * handle + CSID. Routed through the executive VMS_DLM_OP_GRANT path
+ * (vms_lock_dlm_xnode_grant_recv) -- the SAME requester-side grant-receive the
+ * OVMX$DLM SYSAP uses (H5). After this, GETLKI(req_lkid) surfaces the recorded master
+ * handle, so the rebuild-completion references REAL executive state (never a wire
+ * copy) and OVMX genuinely holds the cross-node lock (real BLKAST/LVB/remaster).
+ * Returns the executive status (1 == recorded). Fail-honest (2680) with no /dev/vms;
+ * never fabricates an origin record.
+ */
+static uint32_t cm_dlm_record_grant_from_master(uint32_t req_lkid, uint32_t master_lkid,
+                                                uint32_t master_csid, uint8_t granted_mode,
+                                                const char *resnam)
+{
+#ifdef SCSD_UNIT_TEST
+    (void)req_lkid; (void)master_lkid; (void)master_csid; (void)granted_mode; (void)resnam;
+    return 2296u;
+#else
+    struct vms_dlm_xnode_args args;
+    struct vms_register_args reg;
+    int fd = open("/dev/vms", O_RDWR);
+    if (fd < 0)
+        return 2680u;
+    memset(&reg, 0, sizeof(reg));
+    if (ioctl(fd, VMS_IOCTL_REGISTER, &reg) < 0) { close(fd); return 2680u; }
+    memset(&args, 0, sizeof(args));
+    args.op = VMS_DLM_OP_GRANT;      /* requester-side grant-receive (grant_recv, H5) */
+    args.req_lkid = req_lkid;        /* OVMX's OWN handle -- the origin record key */
+    args.master_lkid = master_lkid;  /* the master's granted handle, from its GRANT */
+    args.master_csid = master_csid;  /* the master's CSID */
+    args.lkmode = granted_mode;      /* the mode the master granted */
+    if (resnam) {
+        strncpy(args.resnam, resnam, sizeof(args.resnam) - 1);
+        args.resnam[sizeof(args.resnam) - 1] = '\0';
+    }
+    if (ioctl(fd, VMS_IOCTL_DLM_XNODE, &args) < 0) { close(fd); return 2680u; }
+    uint32_t status = args.status;
+    close(fd);
+    return status;
+#endif
+}
+
+/*
+ * cm_dlm_getlki_master_lkid - read the MASTER's granted handle for one of OVMX's
+ * cross-node registrations BACK from OVMX's executive (vms-16c). GETLKI on the
+ * requester-side origin record (keyed by OVMX's own req_lkid) returns the master
+ * handle cm_dlm_record_grant_from_master stored from VAX1's GRANT. Returns 0 when
+ * there is no origin record or no grant recorded yet -- the completion caller treats
+ * 0 as "no real grant, send NOTHING" (honest omission, INV-6): a placeholder handle
+ * is exactly what bugchecked VAX1, so a completion is emitted ONLY when the executive
+ * genuinely holds the master's handle. Fail-honest (0) with no /dev/vms.
+ */
+static uint32_t cm_dlm_getlki_master_lkid(uint32_t req_lkid)
+{
+#ifdef SCSD_UNIT_TEST
+    (void)req_lkid;
+    return 0u;
+#else
+    struct vms_getlki_args args;
+    struct vms_register_args reg;
+    int fd = open("/dev/vms", O_RDWR);
+    if (fd < 0)
+        return 0u;
+    memset(&reg, 0, sizeof(reg));
+    if (ioctl(fd, VMS_IOCTL_REGISTER, &reg) < 0) { close(fd); return 0u; }
+    memset(&args, 0, sizeof(args));
+    args.lkid = req_lkid;
+    if (ioctl(fd, VMS_IOCTL_GETLKI, &args) < 0) { close(fd); return 0u; }
+    uint32_t m = (args.status == 1u) ? args.master_lkid : 0u;
+    close(fd);
+    return m;
+#endif
+}
+
 /*
  * scsd_dlm_dispatch_to_executive - hand ONE decoded cross-node DLM request to
  * the kernel lock manager over /dev/vms. Returns the executive status: a granted
diff --git a/tests/qemu/test_syssvc_acp_dlm.c b/tests/qemu/test_syssvc_acp_dlm.c
index 039839896..76c172e5f 100644
--- a/tests/qemu/test_syssvc_acp_dlm.c
+++ b/tests/qemu/test_syssvc_acp_dlm.c
@@ -190,6 +190,56 @@ int main(int argc, char **argv)
 
     st = vms_kif_acp_mount(ODS2_UNIT);
     check($VMS_STATUS_SUCCESS(st), "$MOUNT of the genuine ODS-2 " ODS2_UNIT " (precondition)");
+
+    /*
+     * vms-25e: $MOUNT holds the STANDING volume lock (F11B$v<label>) for the whole
+     * mount life -- the cluster-registration presence marker a faithful VMS MOUNT
+     * holds and the connection manager registers to the coordinator on join
+     * (distinct from the transient per-write F11B$s sync lock the workers below
+     * exercise). PROVE it is genuinely held: read the mounted volume's label (the
+     * SAME vol->volname the executive built the resource name from -- vmsfs_acp.c
+     * getvol copies it verbatim, so this reconstruction is byte-exact), form the
+     * F11B$v resource name, and assert the executive's DLM reports a granted lock
+     * on it. This is a READ of real GET_RESMASTER lock-manager state, never a fake
+     * (INV-6): a real standing lock the executive holds on a real mounted volume.
+     */
+    {
+        struct vms_getvol_args gv;
+        memset(&gv, 0, sizeof(gv));
+        st = vms_kif_getvol(ODS2_UNIT, &gv);
+        check($VMS_STATUS_SUCCESS(st) && gv.mounted && gv.volnam[0] != '\0',
+              "read the mounted volume label for the standing-lock proof");
+        if ($VMS_STATUS_SUCCESS(st) && gv.volnam[0] != '\0') {
+            char vresnam[32];
+            snprintf(vresnam, sizeof(vresnam), "F11B$v%s", gv.volnam);
+            uint32_t found = 0, lc = 0, dc = 0, mc = 0, ilm = 0, ng = 0, rh = 0;
+            uint32_t rst = vms_kif_get_resmaster(vresnam, &found, &lc, &dc, &mc,
+                                                 &ilm, &ng, &rh);
+            check($VMS_STATUS_SUCCESS(rst) && found && ng >= 1,
+                  "the STANDING F11B$v<label> volume lock is HELD after $MOUNT "
+                  "(vms-25e: GET_RESMASTER found, n_granted >= 1)");
+
+            /*
+             * vms-1f4: the enumeration accessor scsd registers FROM must surface
+             * that same standing lock. Assert DLM_ENUM_STANDING returns an entry
+             * naming F11B$v<label> with a real (nonzero) local handle -- the
+             * (resname, lkid) pair scsd puts on the wire as the op-0x01 requester
+             * registration. A READ of real lock state, no fabrication.
+             */
+            struct vms_dlm_enum_standing_args se;
+            memset(&se, 0, sizeof(se));
+            uint32_t est = vms_kif_dlm_enum_standing(&se);
+            int found_vol = 0;
+            for (uint32_t i = 0; i < se.count; i++) {
+                if (strcmp(se.ent[i].resnam, vresnam) == 0 && se.ent[i].lkid != 0)
+                    found_vol = 1;
+            }
+            check($VMS_STATUS_SUCCESS(est) && se.count >= 1 && found_vol,
+                  "DLM_ENUM_STANDING surfaces the F11B$v<label> standing lock with a "
+                  "real handle (vms-1f4: scsd's registration source)");
+        }
+    }
+
     st = vms_kif_acp_assign(ODS2_UNIT, &chan);
     check($VMS_STATUS_SUCCESS(st) && chan != 0, "$ASSIGN a file-class channel (precondition)");
     if (chan == 0) {
diff --git a/tests/qemu/test_syssvc_dlm_xnode.c b/tests/qemu/test_syssvc_dlm_xnode.c
index 0c518ce7d..82c811f82 100644
--- a/tests/qemu/test_syssvc_dlm_xnode.c
+++ b/tests/qemu/test_syssvc_dlm_xnode.c
@@ -155,6 +155,32 @@ int main(void)
     CHECK(st == SS_NORMAL && gm == LCK_K_EXMODE,
           "GETLKI: the holder's lock is granted at EX");
 
+    /* ---- 1c. ⭐ RETRANSMIT IDEMPOTENCY (vms-16c): the SAME cross-node ENQ
+     * (same req_csid + req_lkid, mode still covered) returns the SAME master
+     * handle and does NOT mint a second lock record. A cluster member that never
+     * saw a STABLE granted handle re-sent op-01 forever; before this fix each
+     * re-send minted a fresh lkid, so the member could not correlate a held lock
+     * -- the measured ~35/sec retransmit storm that pinned the cluster at 2 nodes.
+     * A real VMS master is idempotent to a retransmit. ------------------------ */
+    uint32_t lkid_a2 = 0, queued2 = 0;
+    st = vms_kif_dlm_xnode(VMS_DLM_OP_ENQ, LCK_K_EXMODE, 0,
+                           0x00040011u /*SAME req_lkid*/, 0 /*master_lkid*/,
+                           REQ_CSID_A, 0 /*master_csid: resolve*/, res, NULL,
+                           &lkid_a2, &queued2, NULL, NULL, NULL, NULL);
+    CHECK(st == SS_NORMAL, "retransmit of the granted cross-node ENQ -> SS$_NORMAL");
+    CHECK(queued2 == 0, "the retransmit was NOT queued");
+    CHECK(lkid_a2 == lkid_a,
+          "the retransmit returns the SAME stable master handle (idempotent)");
+
+    uint32_t found2 = 0, lc2 = 0, dc2 = 0, mc2 = 0, ilm2 = 0,
+             n_granted2 = 0, held_for2 = 0;
+    st = vms_kif_get_resmaster(res, &found2, &lc2, &dc2, &mc2, &ilm2,
+                               &n_granted2, &held_for2);
+    CHECK(st == SS_NORMAL && n_granted2 == 1,
+          "still exactly ONE grant after the retransmit (no duplicate lock record)");
+    CHECK(held_for2 == REQ_CSID_A,
+          "the single grant is still held FOR the original requester's CSID");
+
     /* ---- 2. ⭐ CONTENTION: a SECOND, INCOMPATIBLE cross-node ENQ BLOCKS ------
      * EX over the held EX, no NOQUEUE. The master QUEUES it on its real waiting
      * queue (contention rung, vms-904c): the dispatch returns VMS_DLM_STS_QUEUED
diff --git a/tests/vmsscs/test_scs_member.c b/tests/vmsscs/test_scs_member.c
index 265bfee49..0fba76464 100644
--- a/tests/vmsscs/test_scs_member.c
+++ b/tests/vmsscs/test_scs_member.c
@@ -953,6 +953,189 @@ static void test_dlm_selfreg_null_guards(void)
     CHECK(scs_member_build_dlm_selfreg(&mp, NULL) == -1, "build_dlm_selfreg NULL out");
 }
 
+/*
+ * vms-cn3: the rebuild-COMPLETION pair (op-04 + op-03 COMMIT) OVMX drives to the
+ * coordinator must be HONEST BY CONSTRUCTION -- no named resource, no held-lock
+ * handle. OVMX holds no persistent cluster lock, so the completion asserts
+ * "done, holding nothing". This pins that guarantee: resname@48 zeroed, per-lock
+ * handles@20:28 zeroed, mode@30 zeroed (NL). If any of those ever carries a value
+ * it would be claiming a lock OVMX cannot honestly back -- a fabrication, caught
+ * here rather than on the wire.
+ */
+static void test_dlm_completion_carries_master_handle(void)
+{
+    struct scs_member_params mp;
+    joiner_params(&mp, 0, 0, 0x0064, 0x0113);
+    mp.txn = 0x0003;
+    mp.checksum = 0x0100;
+
+    /* The faithful completion references the MASTER's granted lock (vms-16c). The
+     * old "holds nothing" model (body[20:24]=OVMX's own handle, body[24:28] ZERO)
+     * bugchecked VAX1 INVLOCKID -- VAX1 looks up body[20:24] in ITS lock DB and needs
+     * the handle IT granted. body[20:24] = the master's granted handle (read from
+     * OVMX's executive origin via grant_recv->GETLKI, never a placeholder or wire
+     * copy); body[24:28] = OVMX's own requester lkid. The honest boundary is at the
+     * SENDER: cm_send_dlm_completion_one omits the frame entirely when the executive
+     * holds no real master handle -- so the builder faithfully places whatever real
+     * pair the caller read from executive state. */
+    uint32_t master = 0x00000443u;   /* VAX1's granted master handle */
+    uint32_t reqlk  = 0x00040007u;   /* OVMX's own requester lkid */
+    uint8_t op04[SCS_MEMBER_FRAME_LEN], op03[SCS_MEMBER_FRAME_LEN];
+    CHECK(scs_member_build_dlm_op04(&mp, master, reqlk, op04) == 0, "build_dlm_op04 ok");
+    CHECK(scs_member_build_dlm_commit(&mp, master, reqlk, op03) == 0, "build_dlm_commit ok");
+
+    const uint8_t *b4 = op04 + 72;
+    const uint8_t *b3 = op03 + 72;
+#define RD32(b, o) ((uint32_t)((b)[o] | ((b)[(o)+1] << 8) | ((b)[(o)+2] << 16) | ((uint32_t)(b)[(o)+3] << 24)))
+    CHECK(b4[8] == 0x02 && b4[9] == 0x04, "op-04: cat 0x02 op 0x04");
+    CHECK(b3[8] == 0x02 && b3[9] == 0x03, "op-03: cat 0x02 op 0x03 (COMMIT)");
+    CHECK(RD32(b4, 20) == master, "op-04: the MASTER's granted handle at body[20:24]");
+    CHECK(RD32(b3, 20) == master, "op-03: the MASTER's granted handle at body[20:24]");
+    CHECK(RD32(b4, 24) == reqlk,  "op-04: OVMX's own requester lkid at body[24:28]");
+    CHECK(RD32(b3, 24) == reqlk,  "op-03: OVMX's own requester lkid at body[24:28]");
+
+    /* op-03 commits BY HANDLE: no named resource, NL mode. */
+    for (int i = 48; i < 64; i++) {
+        CHECK(b4[i] == 0 && b3[i] == 0, "completion: resname@48 is ZEROED (commits by handle)");
+    }
+    CHECK(b4[30] == 0 && b3[30] == 0, "completion: mode@30 is 0x00 (NL)");
+
+    CHECK((uint16_t)(b4[4] | (b4[5] << 8)) == 0x0003, "op-04: dir-tree tag minted");
+    CHECK((uint16_t)(b4[6] | (b4[7] << 8)) == 0x0100, "op-04: per-VC counter minted");
+#undef RD32
+
+    CHECK(scs_member_build_dlm_op04(NULL, master, reqlk, op04) == -1, "build_dlm_op04 NULL p");
+    CHECK(scs_member_build_dlm_commit(&mp, master, reqlk, NULL) == -1, "build_dlm_commit NULL out");
+}
+
+/*
+ * vms-74f (Layer 3): the op-01 ENQ that REGISTERS one of OVMX's REAL standing
+ * locks to the coordinator must carry OVMX's OWN real values -- its real lock
+ * handle (req_lkid@[4:8], from the accessor), the real coordinator csid
+ * (mst_csid@[20:24]), its real resource name, NL mode -- and must NOT invent the
+ * ungrounded per-lock lock-mgmt fields (body[24:30] zero). This pins that.
+ */
+static void test_dlm_reg_enq_carries_real_values(void)
+{
+    struct scs_member_params mp;
+    joiner_params(&mp, 0, 0, 0x0064, 0x0113);
+    mp.member_count = 3;
+
+    const char *res = "F11B$vOVMXSYS";
+    uint8_t nl = (uint8_t)strlen(res);
+    struct scs_dlm_reg_fields f;
+    memset(&f, 0, sizeof(f));
+    f.req_lkid = 0x00000001u;   /* OVMX's own lock handle */
+    f.dir_csid = 0x00010003u;   /* OVMX's own directory-master csid (its encoding) */
+    f.lock_id  = 0x00000001u;   /* OVMX's per-lock id */
+    f.flags    = 0x007du;       /* lock flags */
+    f.mode     = 0x00u;         /* NL */
+    f.lockmgmt = 0x00010001u;   /* count word */
+
+    uint8_t out[SCS_MEMBER_FRAME_LEN];
+    CHECK(scs_member_build_dlm_reg_enq(&mp, res, nl, &f, out) == 0, "build_dlm_reg_enq ok");
+    const uint8_t *b = out + 72;
+
+#define RD32(o) ((uint32_t)(b[o] | (b[(o)+1] << 8) | (b[(o)+2] << 16) | ((uint32_t)b[(o)+3] << 24)))
+    CHECK(RD32(4)  == f.req_lkid,  "op-01: OVMX's real req_lkid at body[4:8]");
+    CHECK(b[8] == 0x02 && b[9] == 0x01, "op-01: cat 0x02 op 0x01 (ENQ)");
+    CHECK(RD32(16) == 0,           "op-01: req_csid body[16:20] is 0 (as every granted ref ENQ)");
+    CHECK(RD32(20) == f.dir_csid,  "op-01: OVMX's own dir_csid at body[20:24] (the measured decider)");
+    CHECK(RD32(24) == f.lock_id,   "op-01: OVMX's real per-lock id at body[24:28] (non-zero, as every granted ENQ)");
+    CHECK((uint16_t)(b[28] | (b[29] << 8)) == f.flags, "op-01: lock flags at body[28:30]");
+    CHECK(b[30] == f.mode,         "op-01: mode@30 (NL, the mode OVMX holds)");
+    CHECK(RD32(32) == f.lockmgmt,  "op-01: lock-mgmt count word at body[32:36]");
+    CHECK(b[47] == nl && memcmp(b + 48, res, nl) == 0, "op-01: OVMX's real resource name at body[48]");
+#undef RD32
+
+    CHECK(scs_member_build_dlm_reg_enq(&mp, NULL, nl, &f, out) == -1, "build_dlm_reg_enq NULL resname");
+    CHECK(scs_member_build_dlm_reg_enq(&mp, res, nl, NULL, out) == -1, "build_dlm_reg_enq NULL fields");
+    CHECK(scs_member_build_dlm_reg_enq(&mp, res, 0, &f, out) == -1, "build_dlm_reg_enq zero namelen guarded");
+    CHECK(scs_member_build_dlm_reg_enq(&mp, res, 32, &f, out) == -1, "build_dlm_reg_enq namelen > 31 guarded");
+}
+
+/*
+ * The coordinator's cat-0x82 op-01 GRANT for our standing-lock registration.
+ * scs_member_parse stores the RAW category byte (body[8]) -- so a response frame
+ * carries the 0x80 bit IN v.category, and v.is_response is derived from it. Any
+ * consumer that classifies category MUST mask with & 0x7f: a bare
+ * `v.category == SCS_MEMBER_CAT_DLM` is UNSATISFIABLE for a response (0x82 != 0x02).
+ * This locks that contract -- the exact trap that silenced scsd.c's grant-detect
+ * (cm_send_dlm_completion trigger, vms-74f): a GRANT that never fires the op-04/
+ * op-03 completion dangles indistinguishably from a DROP.
+ */
+static void test_dlm_grant_response_needs_masking(void)
+{
+    uint8_t frame[SCS_MEMBER_FRAME_LEN];
+    struct scs_member_view v;
+
+    /* Start from a valid config frame, then stamp a cat-0x82 op-01 grant. */
+    make_frame(frame, golden_op01);
+    uint8_t *b = frame + 72;
+    b[8] = (uint8_t)(SCS_MEMBER_CAT_DLM | SCS_MEMBER_RESPONSE_BIT); /* 0x82 */
+    b[9] = 0x01;
+
+    CHECK(scs_member_parse(frame, sizeof(frame), &v) == 0, "parse cat-82 op-01 grant ok");
+    CHECK(v.is_response == 1, "grant: is_response set from the 0x80 bit");
+    CHECK(v.opcode == 0x01, "grant: opcode 0x01");
+    CHECK(v.category == 0x82, "grant: RAW category retains the response bit (0x82)");
+    CHECK(v.category != SCS_MEMBER_CAT_DLM,
+          "grant: a BARE `category == CAT_DLM` FAILS on a response (the silenced-trigger trap)");
+    CHECK((v.category & 0x7f) == SCS_MEMBER_CAT_DLM,
+          "grant: the MASKED category is DLM -- what the grant-detect must test");
+}
+
+/*
+ * The cat-0x82 op-01 GRANT that OVMX-the-master returns for an inbound cross-node
+ * $ENQ (scs_member_build_dlm_enq_response, vms-16c faithful DLM) MUST carry the
+ * GRANTED mode (1-5) at body[30] -- VAX asks for PR/CR and, if it reads NL there,
+ * treats the lock as unsatisfied and re-requests forever (the measured 34/sec
+ * retransmit storm). This locks the exact regression that caused it: the master
+ * handle is a 16-bit field at body[28:30]; a wider le32 write pushed the handle's
+ * high zero byte into body[30] and, for every handle < 0x10000, silently clobbered
+ * the mode to NL. Assert the handle DOES NOT reach the mode byte, and the granted
+ * mode survives -- with a small handle, the two conditions can only both hold if
+ * the handle write stays 16-bit.
+ */
+static void test_dlm_enq_grant_honors_mode(void)
+{
+    struct scs_member_params mp;
+    joiner_params(&mp, 20, 18, 0x0040, 0x0041); /* sysap send/ack counters */
+
+    /* A valid inbound cat-0x02 op-01 request to answer: PR (mode 3) at body[30]. */
+    uint8_t req[SCS_MEMBER_FRAME_LEN];
+    make_frame(req, golden_op01);
+    req[72 + 8] = 0x02;   /* category: DLM */
+    req[72 + 9] = 0x01;   /* opcode: ENQ  */
+    req[72 + 30] = 0x03;  /* requested mode PR -- what VAX asks for */
+
+    uint8_t out[SCS_MEMBER_FRAME_LEN];
+    /* A held-mode grant: master handle 0x0328 (< 0x10000, high bytes zero -- the
+     * exact shape that made the le32 write clobber the mode), granted mode PR. */
+    CHECK(scs_member_build_dlm_enq_response(&mp, req, sizeof(req), 0x0328u, 0x03u,
+                                            out) == 0, "build_dlm_enq_response ok");
+    const uint8_t *b = out + 72;
+    CHECK(b[8] == 0x82, "grant: cat 0x02 | 0x80 response bit");
+    CHECK(b[9] == 0x01, "grant: opcode 0x01 echoed");
+    CHECK((uint16_t)(b[28] | (b[29] << 8)) == 0x0328u,
+          "grant: 16-bit master handle at body[28:30]");
+    CHECK(b[30] == 0x03,
+          "grant: GRANTED mode PR at body[30] -- NOT clobbered to NL by the handle write");
+    CHECK(b[31] == 0x00, "grant: body[31] is the mode field's zero high byte");
+
+    /* A pure-NL grant carries no held handle and NL at the mode byte (as VAX1's). */
+    CHECK(scs_member_build_dlm_enq_response(&mp, req, sizeof(req), 0x0500u, 0x00u,
+                                            out) == 0, "build_dlm_enq_response NL ok");
+    CHECK((uint16_t)(b[28] | (b[29] << 8)) == 0x0000u,
+          "NL grant: no dangling master handle at body[28:30]");
+    CHECK(b[30] == 0x00, "NL grant: mode@30 is NL");
+
+    CHECK(scs_member_build_dlm_enq_response(NULL, req, sizeof(req), 1, 1, out) == -1,
+          "build_dlm_enq_response NULL p guarded");
+    CHECK(scs_member_build_dlm_enq_response(&mp, req, 8, 1, 1, out) == -1,
+          "build_dlm_enq_response short req guarded");
+}
+
 int main(void)
 {
     test_op14_byte_exact();
@@ -974,6 +1157,10 @@ int main(void)
     test_params_member_vs_joiner_form();
     test_dlm_selfreg_byte_exact();
     test_dlm_selfreg_null_guards();
+    test_dlm_completion_carries_master_handle();
+    test_dlm_reg_enq_carries_real_values();
+    test_dlm_grant_response_needs_masking();
+    test_dlm_enq_grant_honors_mode();
 
     if (failures == 0) {
         printf("test_scs_member: ALL PASSED\n");