diff --git a/docs/compat/facilities/cluster-dlm.yaml b/docs/compat/facilities/cluster-dlm.yaml index dea1554a4..e3dec4ca1 100644 --- a/docs/compat/facilities/cluster-dlm.yaml +++ b/docs/compat/facilities/cluster-dlm.yaml @@ -35,11 +35,11 @@ last_reviewed: 2026-08-31 items: - id: cluster-dlm$cross-node-lock kind: feature - status: verified + status: implemented authenticity: real vms: "Cross-node $ENQ grant / block-then-grant / blocking-AST delivered on the mastering node + real holder" evidence: src/kernel-core/vms_lock.c - verified_against: "tests/qemu/test_syssvc_dlm_xnode.c (x86_64 + Alpha LP64); tests/qemu/run_dlm_harness_h5.sh + run_dlm_harness_h6.sh (block-then-grant + BLKAST wire on real /dev/vms)" + verified_against: "tests/qemu/test_syssvc_dlm_xnode.c (x86_64 + Alpha LP64) — scenario 5 (H5: block-then-grant + deferred-grant report) and scenario 7 (H6: BLKAST wire + holder-side receive) driven against a real /dev/vms executive. (The former two-node run_dlm_harness_h5.sh/_h6.sh QEMU harnesses were retired with the userspace SCSD daemon in the executive-resident pivot, #1052; the receive-handler behavior they proved is now exercised by this injected-cross-node-request test on real /dev/vms.)" notes: > vms-94c/vms-e8f1/vms-904c + BLKAST wire H6 (vms-76d/#918). vms_lock_dlm_xnode_dispatch runs a decoded cross-node $ENQ through the real @@ -50,17 +50,19 @@ items: decision. The BLKAST is now DELIVERED over SCS and fires a genuine user-mode AST on the remote holder's process (H6, was deferred); a cross-node $DEQ (vms_lock_dlm_xnode_deq, authorized by CSID) releases and grants the blocked - request (GETLKI flips NL->EX). Proven on real /dev/vms - (tests/qemu/test_syssvc_dlm_xnode.c x86_64 + Alpha LP64; the multi-node H5/H6 - QEMU harnesses). No fake grants OR blocks — a queued request is a real lock on - the master's queue that releases only on a real $DEQ (INV-6). + request (GETLKI flips NL->EX). Exercised on real /dev/vms single-node with an + injected cross-node CSID (tests/qemu/test_syssvc_dlm_xnode.c x86_64 + Alpha + LP64); the two-node H5/H6 QEMU harnesses that proved the over-the-wire path + were retired in #1052 — multi-node runtime proof pending (vms-1ee). No fake + grants OR blocks — a queued request is a real lock on the master's queue that + releases only on a real $DEQ (INV-6). - id: cluster-dlm$async-reply-wire kind: feature - status: verified + status: implemented authenticity: real vms: "Async DLM replies (queued-reply + deferred GRANT) delivered over SCS; requester-side completion" evidence: src/kernel-core/vms_dlm_scs_fsm.c - verified_against: "tests/qemu/run_dlm_harness_h5.sh (two-node A<->B live /dev/vms: SCSD-I-DLMPEND, SCSD-I-DLMDEFER, SCSD-I-DLMH5FLIP granted_mode=EX)" + verified_against: "tests/qemu/test_syssvc_dlm_xnode.c — scenario 5 (H5: the block-then-grant $DEQ REPORTS the flipped waiter so the daemon can wire a deferred GRANT) and scenario 5b (the requester-side VMS_DLM_OP_GRANT receive completes an executive-resident origin record — a queued-reply leaves it NL-pending, a deferred GRANT flips NL->EX, read back on the requester by GETLKI), driven against a real /dev/vms executive. (The former two-node A<->B run_dlm_harness_h5.sh daemon harness — SCSD-I-DLMPEND/DLMDEFER/DLMH5FLIP — was retired with the userspace SCSD daemon in the executive-resident pivot, #1052.)" notes: > vms-6ca rung H5. The master's async replies ride the live SCS wire: node B WIREs the queued-reply (granted mode NL — the requester stays genuinely @@ -72,19 +74,26 @@ items: is set ONLY from what the master sent over SCS; GETLKI reads the NL->EX flip back on the REQUESTER. This origin record is the requester-side wait-for state H11's distributed deadlock search reads (VMS_IOCTL_DLM_ENUM_WAITS). - Proven on a two-node live A<->B QEMU harness with real /dev/vms on both - (tests/qemu/run_dlm_harness_h5.sh: SCSD-I-DLMPEND, SCSD-I-DLMDEFER, - SCSD-I-DLMH5FLIP granted_mode=EX). No fabricated wire reply or grant (INV-6). + The requester-side receive is exercised single-node on real /dev/vms + (tests/qemu/test_syssvc_dlm_xnode.c, injected CSID); the former two-node A<->B + run_dlm_harness_h5.sh proof (SCSD-I-DLMPEND/DLMDEFER/DLMH5FLIP) was retired in + #1052 — multi-node wire proof pending (vms-1ee). No fabricated wire reply or + grant (INV-6). - id: cluster-dlm$remaster-lvb-deadlock kind: feature - status: verified + status: implemented authenticity: real vms: "LVB replication, dynamic remastering (directory + lock state), directory-ownership guard, distributed deadlock detection" evidence: src/kernel-core/vms_lock.c - verified_against: "tests/qemu/run_dlm_harness_h8.sh, _h9.sh (LVB write/read), _h10.sh (H10a directory remaster), _h10b.sh (H10b lock-state rebuild), _e84.sh (directory-ownership refusal), _ec75.sh (H11 distributed deadlock) — all multi-node real /dev/vms" + verified_against: "PARTIAL coverage only — host units tests/cluster/host/test_dlm_ldwv.c (LVB read + wait-for visibility, injected/fake master) + tests/cluster/host/test_dlm_requester.c; N-node simulator scenarios tests/cluster/sim/scenarios/dlm_directory.c (directory routing) + tests/cluster/sim/scenarios/dlm_requester.c (simulated peers); tests/cluster/host/test_codec_dlm.c (REBUILD/DLKSRCH frame codec). The multi-node real-/dev/vms proofs (run_dlm_harness_h8/_h9/_h10/_h10b/_e84/_ec75.sh — LVB write/read crossing, dynamic remaster, directory-ownership refusal, distributed deadlock) were RETIRED with the userspace SCSD daemon in the #1052 executive-resident pivot and have NO real-/dev/vms multi-node successor today — status downgraded verified->implemented pending re-established proof (vms-1ee)." notes: > - The former "remain absent" cluster of the DLM epic, now COMPLETE and each - part proven on a live multi-node /dev/vms rail. LVB REPLICATION both ways: + The former "remain absent" cluster of the DLM epic. The code implements each + part below and was originally proven on a live multi-node /dev/vms rail, but + those multi-node proofs (the run_dlm_harness_* QEMU harnesses referenced below) + were RETIRED in the #1052 executive-resident pivot with no real-/dev/vms + multi-node successor today — so this row is implemented, not verified + (re-establishment tracked in vms-1ee). The mechanism, still in the executive. + LVB REPLICATION both ways: the H8 write crossing (vms-d81/#923) and the H9 read crossing (vms-eeb/#925). DYNAMIC REMASTERING on graceful departure: the directory INGRESS re-resolves a departed node's resources onto a survivor (H10a, vms-2bf/#927, @@ -111,18 +120,19 @@ items: (vms-d1f, post-1.0). - id: cluster-dlm$scs-transport kind: feature - status: verified + status: implemented authenticity: real vms: "DLM SYSAP SCS connection + lock-request message class (ENQ/GRANT/DEQ/BLKAST/REBUILD/DLKSRCH) between cluster nodes" evidence: src/kernel-core/vms_cluster_codec_dlm.c - verified_against: "tests/qemu/run_dlm_harness_h0.sh..ec75 (H0..H11 on real /dev/vms); tests/cluster/host/test_codec_dlm.c (DLM frame encode/decode + op validators)" + verified_against: "tests/cluster/host/test_codec_dlm.c (DLM frame encode/decode + op validators: ENQ/GRANT/DENY/CONVERT fixture round trip + the op-0d rebuild-record echo); tests/qemu/test_syssvc_dlm_xnode.c (the receive handler GRANTS/QUEUES/DEQs and delivers BLKAST on a real /dev/vms executive, rungs 2/3/H5/H6). (The former run_dlm_harness_h0.sh..ec75 QEMU harnesses were retired with the userspace SCSD daemon in the executive-resident pivot, #1052. NOTE — the REBUILD-on-remaster and DLKSRCH distributed-deadlock op HANDLING those harnesses exercised at runtime on real /dev/vms has no equivalent successor test today; see the cluster-dlm remaster-lvb-deadlock row.)" notes: > vms-94c rung 1, extended through H11. A DLM message rides as a p.4-13 SCS application message (MTYPE 10) with its body at SCA content offset 58 (the scs_mscp.c nesting). The transport is real and the receive handler GRANTS, QUEUES, delivers BLKAST, rebuilds on remaster, and runs the deadlock search — - the full ENQ-class op set is handled on a real /dev/vms executive across every - DLM QEMU harness (H0..H11). + the full ENQ-class op set is handled on a real /dev/vms executive (single-node + dispatch, tests/qemu/test_syssvc_dlm_xnode.c); the H0..H11 multi-node QEMU + harnesses were retired in #1052 with no multi-node successor (vms-1ee). wire_format: provenance: > TWO provenance classes, kept distinct (Rule 8). (A) SEMANTIC field diff --git a/docs/compatibility-surface.md b/docs/compatibility-surface.md index 8c0f7746b..67955168c 100644 --- a/docs/compatibility-surface.md +++ b/docs/compatibility-surface.md @@ -1,7 +1,7 @@ # OVMX Compatibility Surface Register -> Generated 2026-09-09 from `docs/compat/` against `origin/main`. Source of truth is the YAML; this file is regenerated. See `docs/design-compat-surface-register.md`. +> Generated 2026-09-10 from `docs/compat/` against `origin/main`. Source of truth is the YAML; this file is regenerated. See `docs/design-compat-surface-register.md`. ## Inventory @@ -11,8 +11,8 @@ | Status | Count | | Authenticity | Count | |---|---|---|---|---| -| ✅ verified | 26 | | real | 302 | -| 🟢 implemented | 263 | | n/a | 93 | +| ✅ verified | 22 | | real | 302 | +| 🟢 implemented | 267 | | n/a | 93 | | 🟡 partial | 48 | | advisory | 45 | | 🟠 stub | 16 | | facade-risk | 6 | | 🔵 designed | 0 | | | | @@ -859,7 +859,7 @@ Full UAF account record storage and Purdy/hashed password authentication are rea _SCS, NISCA/NISCS, connection manager/quorum, cluster-wide DLM, MSCP serving, cluster-wide logicals, shadowing._ -`✅✅✅✅✅🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟡🟡⬜⬜⬜⬜⬜⬜` — 26 surfaces catalogued (18 met · 2 in progress · 6 not started) · V1: 25 committed, 18 met +`✅🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟡🟡⬜⬜⬜⬜⬜⬜` — 26 surfaces catalogued (18 met · 2 in progress · 6 not started) · V1: 25 committed, 18 met ### cluster-dlm — Cluster-wide Distributed Lock Manager scope: in · plan: vms-694 · ref: OpenVMS Cluster Systems manual; $ENQ/$DEQ/$GETLKI system services · reviewed 2026-08-31 @@ -871,13 +871,13 @@ The ENQ-class distributed lock manager is COMPLETE and every rung is proven on a | | Surface | Kind | VMS | Status | Auth | Scope | Evidence / notes | |---|---|---|---|---|---|---|---| -| ✅ | `cluster-dlm$cross-node-lock` | feature | Cross-node $ENQ grant / block-then-grant / blocking-AST delivered on the mastering node + real holder | verified | real | in | `src/kernel-core/vms_lock.c` — vms-94c/vms-e8f1/vms-904c + BLKAST wire H6 (vms-76d/#918). vms_lock_dlm_xnode_dispatch runs a decoded cross-node $ENQ through the real lock manager on the mastering node, held FOR the remote requester's CSID: a compatible request GRANTS (SS$_NORMAL, GET_RESMASTER shows held_for=); an incompatible one QUEUES on the real waiting queue (VMS_DLM_STS_QUEUED, GETLKI shows granted NL / requested EX) and the master fires the blocking-AST decision. The BLKAST is now DELIVERED over SCS and fires a genuine user-mode AST on the remote holder's process (H6, was deferred); a cross-node $DEQ (vms_lock_dlm_xnode_deq, authorized by CSID) releases and grants the blocked request (GETLKI flips NL->EX). Proven on real /dev/vms (tests/qemu/test_syssvc_dlm_xnode.c x86_64 + Alpha LP64; the multi-node H5/H6 QEMU harnesses). No fake grants OR blocks — a queued request is a real lock on the master's queue that releases only on a real $DEQ (INV-6). +| 🟢 | `cluster-dlm$cross-node-lock` | feature | Cross-node $ENQ grant / block-then-grant / blocking-AST delivered on the mastering node + real holder | implemented | real | in | `src/kernel-core/vms_lock.c` — vms-94c/vms-e8f1/vms-904c + BLKAST wire H6 (vms-76d/#918). vms_lock_dlm_xnode_dispatch runs a decoded cross-node $ENQ through the real lock manager on the mastering node, held FOR the remote requester's CSID: a compatible request GRANTS (SS$_NORMAL, GET_RESMASTER shows held_for=); an incompatible one QUEUES on the real waiting queue (VMS_DLM_STS_QUEUED, GETLKI shows granted NL / requested EX) and the master fires the blocking-AST decision. The BLKAST is now DELIVERED over SCS and fires a genuine user-mode AST on the remote holder's process (H6, was deferred); a cross-node $DEQ (vms_lock_dlm_xnode_deq, authorized by CSID) releases and grants the blocked request (GETLKI flips NL->EX). Exercised on real /dev/vms single-node with an injected cross-node CSID (tests/qemu/test_syssvc_dlm_xnode.c x86_64 + Alpha LP64); the two-node H5/H6 QEMU harnesses that proved the over-the-wire path were retired in #1052 — multi-node runtime proof pending (vms-1ee). No fake grants OR blocks — a queued request is a real lock on the master's queue that releases only on a real $DEQ (INV-6). | -| ✅ | `cluster-dlm$async-reply-wire` | feature | Async DLM replies (queued-reply + deferred GRANT) delivered over SCS; requester-side completion | verified | real | in | `src/kernel-core/vms_dlm_scs_fsm.c` — vms-6ca rung H5. The master's async replies ride the live SCS wire: node B WIREs the queued-reply (granted mode NL — the requester stays genuinely pending) and, on a real cross-node $DEQ that flips a queued waiter to granted, WIREs an unprompted deferred GRANT (SS$_NORMAL, the granted mode) to that requester (vms_lock_dlm_xnode_deq reports the flipped waiter). The REQUESTER-SIDE GRANT RECEIVE (VMS_DLM_OP_GRANT) completes an executive-resident ORIGIN record on the requesting node, whose granted mode is set ONLY from what the master sent over SCS; GETLKI reads the NL->EX flip back on the REQUESTER. This origin record is the requester-side wait-for state H11's distributed deadlock search reads (VMS_IOCTL_DLM_ENUM_WAITS). Proven on a two-node live A<->B QEMU harness with real /dev/vms on both (tests/qemu/run_dlm_harness_h5.sh: SCSD-I-DLMPEND, SCSD-I-DLMDEFER, SCSD-I-DLMH5FLIP granted_mode=EX). No fabricated wire reply or grant (INV-6). +| 🟢 | `cluster-dlm$async-reply-wire` | feature | Async DLM replies (queued-reply + deferred GRANT) delivered over SCS; requester-side completion | implemented | real | in | `src/kernel-core/vms_dlm_scs_fsm.c` — vms-6ca rung H5. The master's async replies ride the live SCS wire: node B WIREs the queued-reply (granted mode NL — the requester stays genuinely pending) and, on a real cross-node $DEQ that flips a queued waiter to granted, WIREs an unprompted deferred GRANT (SS$_NORMAL, the granted mode) to that requester (vms_lock_dlm_xnode_deq reports the flipped waiter). The REQUESTER-SIDE GRANT RECEIVE (VMS_DLM_OP_GRANT) completes an executive-resident ORIGIN record on the requesting node, whose granted mode is set ONLY from what the master sent over SCS; GETLKI reads the NL->EX flip back on the REQUESTER. This origin record is the requester-side wait-for state H11's distributed deadlock search reads (VMS_IOCTL_DLM_ENUM_WAITS). The requester-side receive is exercised single-node on real /dev/vms (tests/qemu/test_syssvc_dlm_xnode.c, injected CSID); the former two-node A<->B run_dlm_harness_h5.sh proof (SCSD-I-DLMPEND/DLMDEFER/DLMH5FLIP) was retired in #1052 — multi-node wire proof pending (vms-1ee). No fabricated wire reply or grant (INV-6). | -| ✅ | `cluster-dlm$remaster-lvb-deadlock` | feature | LVB replication, dynamic remastering (directory + lock state), directory-ownership guard, distributed deadlock detection | verified | real | in | `src/kernel-core/vms_lock.c` — The former "remain absent" cluster of the DLM epic, now COMPLETE and each part proven on a live multi-node /dev/vms rail. LVB REPLICATION both ways: the H8 write crossing (vms-d81/#923) and the H9 read crossing (vms-eeb/#925). DYNAMIC REMASTERING on graceful departure: the directory INGRESS re-resolves a departed node's resources onto a survivor (H10a, vms-2bf/#927, VMS_IOCTL_DLM_MEMBER_DEPART + a runtime departed-set filtering the static dlm_member_csids vector), AND the cross-node lock STATE is rebuilt on the new master from the surviving holder's REAL origin record over a targeted SCS_DLM_OP_REBUILD, reconstructed directly into res->granted and value-verified (H10b, vms-dca9/#928, run_dlm_harness_h10b.sh three-way equality). DIRECTORY OWNERSHIP: a node refuses to master a resource it is not the directory for — dlm_resolve_master returns SS$_UNSUPPORTED — proven on the wire (e84, vms-e84/#929, run_dlm_harness_e84.sh: non-directory node answers 0x8F8, directory node GRANTS). DISTRIBUTED DEADLOCK DETECTION: a cross-node cycle is found by an edge-chasing search over the real distributed wait-for graph (home pending origins via VMS_IOCTL_DLM_ENUM_WAITS + master res->granted via VMS_IOCTL_DLM_GET_GRANTED), and a globally-deterministic single victim (lexicographic-min over the cycle) is aborted with SS$_DEADLOCK via the GRANT-reply path, idempotently (H11, vms-ec75/#930, run_dlm_harness_ec75.sh: cycle detected, exactly one victim, the other stays queued). Every edge is a real queue/origin read; a dropped/ttl-expired probe reports no-deadlock, never a fabricated cycle (INV-6). DEPTH deferred beyond the engine (honest, tracked): the concurrent-both-initiate deadlock proof (vms-04f — logic shipped + code-verified), directory REDIRECT (vms-b96), and a real app-process cross-node acquisition path replacing the SS$_UNSUPPORTED "0.4" stub (vms-d1f, post-1.0). +| 🟢 | `cluster-dlm$remaster-lvb-deadlock` | feature | LVB replication, dynamic remastering (directory + lock state), directory-ownership guard, distributed deadlock detection | implemented | real | in | `src/kernel-core/vms_lock.c` — The former "remain absent" cluster of the DLM epic. The code implements each part below and was originally proven on a live multi-node /dev/vms rail, but those multi-node proofs (the run_dlm_harness_* QEMU harnesses referenced below) were RETIRED in the #1052 executive-resident pivot with no real-/dev/vms multi-node successor today — so this row is implemented, not verified (re-establishment tracked in vms-1ee). The mechanism, still in the executive. LVB REPLICATION both ways: the H8 write crossing (vms-d81/#923) and the H9 read crossing (vms-eeb/#925). DYNAMIC REMASTERING on graceful departure: the directory INGRESS re-resolves a departed node's resources onto a survivor (H10a, vms-2bf/#927, VMS_IOCTL_DLM_MEMBER_DEPART + a runtime departed-set filtering the static dlm_member_csids vector), AND the cross-node lock STATE is rebuilt on the new master from the surviving holder's REAL origin record over a targeted SCS_DLM_OP_REBUILD, reconstructed directly into res->granted and value-verified (H10b, vms-dca9/#928, run_dlm_harness_h10b.sh three-way equality). DIRECTORY OWNERSHIP: a node refuses to master a resource it is not the directory for — dlm_resolve_master returns SS$_UNSUPPORTED — proven on the wire (e84, vms-e84/#929, run_dlm_harness_e84.sh: non-directory node answers 0x8F8, directory node GRANTS). DISTRIBUTED DEADLOCK DETECTION: a cross-node cycle is found by an edge-chasing search over the real distributed wait-for graph (home pending origins via VMS_IOCTL_DLM_ENUM_WAITS + master res->granted via VMS_IOCTL_DLM_GET_GRANTED), and a globally-deterministic single victim (lexicographic-min over the cycle) is aborted with SS$_DEADLOCK via the GRANT-reply path, idempotently (H11, vms-ec75/#930, run_dlm_harness_ec75.sh: cycle detected, exactly one victim, the other stays queued). Every edge is a real queue/origin read; a dropped/ttl-expired probe reports no-deadlock, never a fabricated cycle (INV-6). DEPTH deferred beyond the engine (honest, tracked): the concurrent-both-initiate deadlock proof (vms-04f — logic shipped + code-verified), directory REDIRECT (vms-b96), and a real app-process cross-node acquisition path replacing the SS$_UNSUPPORTED "0.4" stub (vms-d1f, post-1.0). | -| ✅ | `cluster-dlm$scs-transport` | feature | DLM SYSAP SCS connection + lock-request message class (ENQ/GRANT/DEQ/BLKAST/REBUILD/DLKSRCH) between cluster nodes | verified | real | in | `src/kernel-core/vms_cluster_codec_dlm.c` — vms-94c rung 1, extended through H11. A DLM message rides as a p.4-13 SCS application message (MTYPE 10) with its body at SCA content offset 58 (the scs_mscp.c nesting). The transport is real and the receive handler GRANTS, QUEUES, delivers BLKAST, rebuilds on remaster, and runs the deadlock search — the full ENQ-class op set is handled on a real /dev/vms executive across every DLM QEMU harness (H0..H11). +| 🟢 | `cluster-dlm$scs-transport` | feature | DLM SYSAP SCS connection + lock-request message class (ENQ/GRANT/DEQ/BLKAST/REBUILD/DLKSRCH) between cluster nodes | implemented | real | in | `src/kernel-core/vms_cluster_codec_dlm.c` — vms-94c rung 1, extended through H11. A DLM message rides as a p.4-13 SCS application message (MTYPE 10) with its body at SCA content offset 58 (the scs_mscp.c nesting). The transport is real and the receive handler GRANTS, QUEUES, delivers BLKAST, rebuilds on remaster, and runs the deadlock search — the full ENQ-class op set is handled on a real /dev/vms executive (single-node dispatch, tests/qemu/test_syssvc_dlm_xnode.c); the H0..H11 multi-node QEMU harnesses were retired in #1052 with no multi-node successor (vms-1ee). | ### cluster-logicals — Cluster-wide logical names / global sections