From 32d2f5ac1db955c6117e940c8d1e9d06f06cd0f6 Mon Sep 17 00:00:00 2001 From: alice Date: Wed, 9 Sep 2026 23:54:05 +0000 Subject: [PATCH 1/2] vms-7f6: repoint dead run_dlm_harness verified_against citations to their executive-resident successors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The run_dlm_harness_h0.sh..ec75 QEMU harnesses were deleted in #1052 (the CN=3 executive-resident pivot that retired the userspace SCSD daemon). Three cluster-dlm register rows still cited them in verified_against. render_compat.py only validates `evidence:` paths, not `verified_against:`, so this drift was invisible to the tool. Repointed to the real successors (verified by reading each test): - cross-node-lock (H5/H6): tests/qemu/test_syssvc_dlm_xnode.c scenarios 5 & 7 (block-then-grant + BLKAST wire) on a real /dev/vms executive. - async-reply-wire (H5): test_syssvc_dlm_xnode.c scenarios 5 & 5b (deferred GRANT report + requester-side origin-record receive) on real /dev/vms. - scs-transport: tests/cluster/host/test_codec_dlm.c (codec round trip + op validators) + test_syssvc_dlm_xnode.c (receive-handler GRANT/QUEUE/DEQ/BLKAST). Left unchanged and FLAGGED for conductor adjudication (NOT repointed, status untouched): cluster-dlm$remaster-lvb-deadlock. Its cited harnesses proved LVB write/read crossing (H8/H9), dynamic remastering (H10a/H10b), directory-ownership refusal (e84) and distributed deadlock detection (H11) on a real MULTI-NODE /dev/vms rail. No successor test exercises those cross-node behaviors on a real /dev/vms today; only partial host-backend/simulator coverage exists (test_lock_proxy.c: LVB-read + ENUM_WAITS visibility; sim scenarios: directory routing). A row marked status:verified / authenticity:real whose multi-node proof is gone may be overclaiming — flagged for downgrade / Baron authenticity review rather than silently repointed. render_compat.py: succeeds, 0 warnings (unchanged from baseline); build json is gitignored and the rendered surface md does not carry per-row verified_against, so both are byte-identical after regeneration. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_018q4jvj6GCkdbYjRvpy7Vwu --- docs/compat/facilities/cluster-dlm.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/compat/facilities/cluster-dlm.yaml b/docs/compat/facilities/cluster-dlm.yaml index dea1554a4..3b9f41582 100644 --- a/docs/compat/facilities/cluster-dlm.yaml +++ b/docs/compat/facilities/cluster-dlm.yaml @@ -39,7 +39,7 @@ items: authenticity: real vms: "Cross-node $ENQ grant / block-then-grant / blocking-AST delivered on the mastering node + real holder" evidence: src/kernel-core/vms_lock.c - verified_against: "tests/qemu/test_syssvc_dlm_xnode.c (x86_64 + Alpha LP64); tests/qemu/run_dlm_harness_h5.sh + run_dlm_harness_h6.sh (block-then-grant + BLKAST wire on real /dev/vms)" + verified_against: "tests/qemu/test_syssvc_dlm_xnode.c (x86_64 + Alpha LP64) — scenario 5 (H5: block-then-grant + deferred-grant report) and scenario 7 (H6: BLKAST wire + holder-side receive) driven against a real /dev/vms executive. (The former two-node run_dlm_harness_h5.sh/_h6.sh QEMU harnesses were retired with the userspace SCSD daemon in the executive-resident pivot, #1052; the receive-handler behavior they proved is now exercised by this injected-cross-node-request test on real /dev/vms.)" notes: > vms-94c/vms-e8f1/vms-904c + BLKAST wire H6 (vms-76d/#918). vms_lock_dlm_xnode_dispatch runs a decoded cross-node $ENQ through the real @@ -60,7 +60,7 @@ items: authenticity: real vms: "Async DLM replies (queued-reply + deferred GRANT) delivered over SCS; requester-side completion" evidence: src/kernel-core/vms_dlm_scs_fsm.c - verified_against: "tests/qemu/run_dlm_harness_h5.sh (two-node A<->B live /dev/vms: SCSD-I-DLMPEND, SCSD-I-DLMDEFER, SCSD-I-DLMH5FLIP granted_mode=EX)" + verified_against: "tests/qemu/test_syssvc_dlm_xnode.c — scenario 5 (H5: the block-then-grant $DEQ REPORTS the flipped waiter so the daemon can wire a deferred GRANT) and scenario 5b (the requester-side VMS_DLM_OP_GRANT receive completes an executive-resident origin record — a queued-reply leaves it NL-pending, a deferred GRANT flips NL->EX, read back on the requester by GETLKI), driven against a real /dev/vms executive. (The former two-node A<->B run_dlm_harness_h5.sh daemon harness — SCSD-I-DLMPEND/DLMDEFER/DLMH5FLIP — was retired with the userspace SCSD daemon in the executive-resident pivot, #1052.)" notes: > vms-6ca rung H5. The master's async replies ride the live SCS wire: node B WIREs the queued-reply (granted mode NL — the requester stays genuinely @@ -115,7 +115,7 @@ items: authenticity: real vms: "DLM SYSAP SCS connection + lock-request message class (ENQ/GRANT/DEQ/BLKAST/REBUILD/DLKSRCH) between cluster nodes" evidence: src/kernel-core/vms_cluster_codec_dlm.c - verified_against: "tests/qemu/run_dlm_harness_h0.sh..ec75 (H0..H11 on real /dev/vms); tests/cluster/host/test_codec_dlm.c (DLM frame encode/decode + op validators)" + verified_against: "tests/cluster/host/test_codec_dlm.c (DLM frame encode/decode + op validators: ENQ/GRANT/DENY/CONVERT fixture round trip + the op-0d rebuild-record echo); tests/qemu/test_syssvc_dlm_xnode.c (the receive handler GRANTS/QUEUES/DEQs and delivers BLKAST on a real /dev/vms executive, rungs 2/3/H5/H6). (The former run_dlm_harness_h0.sh..ec75 QEMU harnesses were retired with the userspace SCSD daemon in the executive-resident pivot, #1052. NOTE — the REBUILD-on-remaster and DLKSRCH distributed-deadlock op HANDLING those harnesses exercised at runtime on real /dev/vms has no equivalent successor test today; see the cluster-dlm remaster-lvb-deadlock row.)" notes: > vms-94c rung 1, extended through H11. A DLM message rides as a p.4-13 SCS application message (MTYPE 10) with its body at SCA content offset 58 (the From 54b9348d67b8cf20460f45677ce52b5e4b006cf2 Mon Sep 17 00:00:00 2001 From: alice Date: Thu, 10 Sep 2026 00:16:15 +0000 Subject: [PATCH 2/2] vms-7f6+vms-1ee: downgrade the 4 cluster-dlm rows verified->implemented (multi-node proof retired in #1052) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit An adversarial audit of the frontier verified/real rows found that repointing verified_against alone (the prior commit) was insufficient: all four cluster-dlm rows are marked `verified` on the strength of the run_dlm_harness_*.sh multi-node real-/dev/vms proofs, which were DELETED in #1052 (the CN=3 executive-resident pivot that retired the userspace SCSD daemon). The surviving coverage — test_syssvc_dlm_xnode.c (single-node dispatch with an injected cross-node CSID), test_codec_dlm.c (frame codec), the host units, and the N-node simulator scenarios — is real but does NOT prove the multi-node/over-the-wire behavior the `verified` status claims. Keeping `verified` is an overclaim on the public compatibility page. Honest correction (INV-6 real-data-or-honest-omission): - status verified->implemented for cross-node-lock, async-reply-wire, remaster-lvb-deadlock, scs-transport (code is real + executive-resident; the multi-node PROOF is gone, not the code). - remaster-lvb-deadlock verified_against repointed off the deleted harnesses to its real surviving partial coverage (host units + sim scenarios + codec). - notes: corrected the "Proven on a live multi-node /dev/vms rail" / "across every DLM QEMU harness (H0..H11)" claims to reflect that those harnesses were retired in #1052; the accurate mechanism descriptions are preserved, and every run_dlm_harness reference is now explicitly framed as retired history. Re-establishing the multi-node runtime proof is tracked + gated for Baron in vms-1ee. verified count 26->22. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_018q4jvj6GCkdbYjRvpy7Vwu --- docs/compat/facilities/cluster-dlm.yaml | 42 +++++++++++++++---------- docs/compatibility-surface.md | 16 +++++----- 2 files changed, 34 insertions(+), 24 deletions(-) diff --git a/docs/compat/facilities/cluster-dlm.yaml b/docs/compat/facilities/cluster-dlm.yaml index 3b9f41582..e3dec4ca1 100644 --- a/docs/compat/facilities/cluster-dlm.yaml +++ b/docs/compat/facilities/cluster-dlm.yaml @@ -35,7 +35,7 @@ last_reviewed: 2026-08-31 items: - id: cluster-dlm$cross-node-lock kind: feature - status: verified + status: implemented authenticity: real vms: "Cross-node $ENQ grant / block-then-grant / blocking-AST delivered on the mastering node + real holder" evidence: src/kernel-core/vms_lock.c @@ -50,13 +50,15 @@ items: decision. The BLKAST is now DELIVERED over SCS and fires a genuine user-mode AST on the remote holder's process (H6, was deferred); a cross-node $DEQ (vms_lock_dlm_xnode_deq, authorized by CSID) releases and grants the blocked - request (GETLKI flips NL->EX). Proven on real /dev/vms - (tests/qemu/test_syssvc_dlm_xnode.c x86_64 + Alpha LP64; the multi-node H5/H6 - QEMU harnesses). No fake grants OR blocks — a queued request is a real lock on - the master's queue that releases only on a real $DEQ (INV-6). + request (GETLKI flips NL->EX). Exercised on real /dev/vms single-node with an + injected cross-node CSID (tests/qemu/test_syssvc_dlm_xnode.c x86_64 + Alpha + LP64); the two-node H5/H6 QEMU harnesses that proved the over-the-wire path + were retired in #1052 — multi-node runtime proof pending (vms-1ee). No fake + grants OR blocks — a queued request is a real lock on the master's queue that + releases only on a real $DEQ (INV-6). - id: cluster-dlm$async-reply-wire kind: feature - status: verified + status: implemented authenticity: real vms: "Async DLM replies (queued-reply + deferred GRANT) delivered over SCS; requester-side completion" evidence: src/kernel-core/vms_dlm_scs_fsm.c @@ -72,19 +74,26 @@ items: is set ONLY from what the master sent over SCS; GETLKI reads the NL->EX flip back on the REQUESTER. This origin record is the requester-side wait-for state H11's distributed deadlock search reads (VMS_IOCTL_DLM_ENUM_WAITS). - Proven on a two-node live A<->B QEMU harness with real /dev/vms on both - (tests/qemu/run_dlm_harness_h5.sh: SCSD-I-DLMPEND, SCSD-I-DLMDEFER, - SCSD-I-DLMH5FLIP granted_mode=EX). No fabricated wire reply or grant (INV-6). + The requester-side receive is exercised single-node on real /dev/vms + (tests/qemu/test_syssvc_dlm_xnode.c, injected CSID); the former two-node A<->B + run_dlm_harness_h5.sh proof (SCSD-I-DLMPEND/DLMDEFER/DLMH5FLIP) was retired in + #1052 — multi-node wire proof pending (vms-1ee). No fabricated wire reply or + grant (INV-6). - id: cluster-dlm$remaster-lvb-deadlock kind: feature - status: verified + status: implemented authenticity: real vms: "LVB replication, dynamic remastering (directory + lock state), directory-ownership guard, distributed deadlock detection" evidence: src/kernel-core/vms_lock.c - verified_against: "tests/qemu/run_dlm_harness_h8.sh, _h9.sh (LVB write/read), _h10.sh (H10a directory remaster), _h10b.sh (H10b lock-state rebuild), _e84.sh (directory-ownership refusal), _ec75.sh (H11 distributed deadlock) — all multi-node real /dev/vms" + verified_against: "PARTIAL coverage only — host units tests/cluster/host/test_dlm_ldwv.c (LVB read + wait-for visibility, injected/fake master) + tests/cluster/host/test_dlm_requester.c; N-node simulator scenarios tests/cluster/sim/scenarios/dlm_directory.c (directory routing) + tests/cluster/sim/scenarios/dlm_requester.c (simulated peers); tests/cluster/host/test_codec_dlm.c (REBUILD/DLKSRCH frame codec). The multi-node real-/dev/vms proofs (run_dlm_harness_h8/_h9/_h10/_h10b/_e84/_ec75.sh — LVB write/read crossing, dynamic remaster, directory-ownership refusal, distributed deadlock) were RETIRED with the userspace SCSD daemon in the #1052 executive-resident pivot and have NO real-/dev/vms multi-node successor today — status downgraded verified->implemented pending re-established proof (vms-1ee)." notes: > - The former "remain absent" cluster of the DLM epic, now COMPLETE and each - part proven on a live multi-node /dev/vms rail. LVB REPLICATION both ways: + The former "remain absent" cluster of the DLM epic. The code implements each + part below and was originally proven on a live multi-node /dev/vms rail, but + those multi-node proofs (the run_dlm_harness_* QEMU harnesses referenced below) + were RETIRED in the #1052 executive-resident pivot with no real-/dev/vms + multi-node successor today — so this row is implemented, not verified + (re-establishment tracked in vms-1ee). The mechanism, still in the executive. + LVB REPLICATION both ways: the H8 write crossing (vms-d81/#923) and the H9 read crossing (vms-eeb/#925). DYNAMIC REMASTERING on graceful departure: the directory INGRESS re-resolves a departed node's resources onto a survivor (H10a, vms-2bf/#927, @@ -111,7 +120,7 @@ items: (vms-d1f, post-1.0). - id: cluster-dlm$scs-transport kind: feature - status: verified + status: implemented authenticity: real vms: "DLM SYSAP SCS connection + lock-request message class (ENQ/GRANT/DEQ/BLKAST/REBUILD/DLKSRCH) between cluster nodes" evidence: src/kernel-core/vms_cluster_codec_dlm.c @@ -121,8 +130,9 @@ items: application message (MTYPE 10) with its body at SCA content offset 58 (the scs_mscp.c nesting). The transport is real and the receive handler GRANTS, QUEUES, delivers BLKAST, rebuilds on remaster, and runs the deadlock search — - the full ENQ-class op set is handled on a real /dev/vms executive across every - DLM QEMU harness (H0..H11). + the full ENQ-class op set is handled on a real /dev/vms executive (single-node + dispatch, tests/qemu/test_syssvc_dlm_xnode.c); the H0..H11 multi-node QEMU + harnesses were retired in #1052 with no multi-node successor (vms-1ee). wire_format: provenance: > TWO provenance classes, kept distinct (Rule 8). (A) SEMANTIC field diff --git a/docs/compatibility-surface.md b/docs/compatibility-surface.md index 8c0f7746b..67955168c 100644 --- a/docs/compatibility-surface.md +++ b/docs/compatibility-surface.md @@ -1,7 +1,7 @@ # OVMX Compatibility Surface Register -> Generated 2026-09-09 from `docs/compat/` against `origin/main`. Source of truth is the YAML; this file is regenerated. See `docs/design-compat-surface-register.md`. +> Generated 2026-09-10 from `docs/compat/` against `origin/main`. Source of truth is the YAML; this file is regenerated. See `docs/design-compat-surface-register.md`. ## Inventory @@ -11,8 +11,8 @@ | Status | Count | | Authenticity | Count | |---|---|---|---|---| -| ✅ verified | 26 | | real | 302 | -| 🟢 implemented | 263 | | n/a | 93 | +| ✅ verified | 22 | | real | 302 | +| 🟢 implemented | 267 | | n/a | 93 | | 🟡 partial | 48 | | advisory | 45 | | 🟠 stub | 16 | | facade-risk | 6 | | 🔵 designed | 0 | | | | @@ -859,7 +859,7 @@ Full UAF account record storage and Purdy/hashed password authentication are rea _SCS, NISCA/NISCS, connection manager/quorum, cluster-wide DLM, MSCP serving, cluster-wide logicals, shadowing._ -`✅✅✅✅✅🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟡🟡⬜⬜⬜⬜⬜⬜` — 26 surfaces catalogued (18 met · 2 in progress · 6 not started) · V1: 25 committed, 18 met +`✅🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟢🟡🟡⬜⬜⬜⬜⬜⬜` — 26 surfaces catalogued (18 met · 2 in progress · 6 not started) · V1: 25 committed, 18 met ### cluster-dlm — Cluster-wide Distributed Lock Manager scope: in · plan: vms-694 · ref: OpenVMS Cluster Systems manual; $ENQ/$DEQ/$GETLKI system services · reviewed 2026-08-31 @@ -871,13 +871,13 @@ The ENQ-class distributed lock manager is COMPLETE and every rung is proven on a | | Surface | Kind | VMS | Status | Auth | Scope | Evidence / notes | |---|---|---|---|---|---|---|---| -| ✅ | `cluster-dlm$cross-node-lock` | feature | Cross-node $ENQ grant / block-then-grant / blocking-AST delivered on the mastering node + real holder | verified | real | in | `src/kernel-core/vms_lock.c` — vms-94c/vms-e8f1/vms-904c + BLKAST wire H6 (vms-76d/#918). vms_lock_dlm_xnode_dispatch runs a decoded cross-node $ENQ through the real lock manager on the mastering node, held FOR the remote requester's CSID: a compatible request GRANTS (SS$_NORMAL, GET_RESMASTER shows held_for=); an incompatible one QUEUES on the real waiting queue (VMS_DLM_STS_QUEUED, GETLKI shows granted NL / requested EX) and the master fires the blocking-AST decision. The BLKAST is now DELIVERED over SCS and fires a genuine user-mode AST on the remote holder's process (H6, was deferred); a cross-node $DEQ (vms_lock_dlm_xnode_deq, authorized by CSID) releases and grants the blocked request (GETLKI flips NL->EX). Proven on real /dev/vms (tests/qemu/test_syssvc_dlm_xnode.c x86_64 + Alpha LP64; the multi-node H5/H6 QEMU harnesses). No fake grants OR blocks — a queued request is a real lock on the master's queue that releases only on a real $DEQ (INV-6). +| 🟢 | `cluster-dlm$cross-node-lock` | feature | Cross-node $ENQ grant / block-then-grant / blocking-AST delivered on the mastering node + real holder | implemented | real | in | `src/kernel-core/vms_lock.c` — vms-94c/vms-e8f1/vms-904c + BLKAST wire H6 (vms-76d/#918). vms_lock_dlm_xnode_dispatch runs a decoded cross-node $ENQ through the real lock manager on the mastering node, held FOR the remote requester's CSID: a compatible request GRANTS (SS$_NORMAL, GET_RESMASTER shows held_for=); an incompatible one QUEUES on the real waiting queue (VMS_DLM_STS_QUEUED, GETLKI shows granted NL / requested EX) and the master fires the blocking-AST decision. The BLKAST is now DELIVERED over SCS and fires a genuine user-mode AST on the remote holder's process (H6, was deferred); a cross-node $DEQ (vms_lock_dlm_xnode_deq, authorized by CSID) releases and grants the blocked request (GETLKI flips NL->EX). Exercised on real /dev/vms single-node with an injected cross-node CSID (tests/qemu/test_syssvc_dlm_xnode.c x86_64 + Alpha LP64); the two-node H5/H6 QEMU harnesses that proved the over-the-wire path were retired in #1052 — multi-node runtime proof pending (vms-1ee). No fake grants OR blocks — a queued request is a real lock on the master's queue that releases only on a real $DEQ (INV-6). | -| ✅ | `cluster-dlm$async-reply-wire` | feature | Async DLM replies (queued-reply + deferred GRANT) delivered over SCS; requester-side completion | verified | real | in | `src/kernel-core/vms_dlm_scs_fsm.c` — vms-6ca rung H5. The master's async replies ride the live SCS wire: node B WIREs the queued-reply (granted mode NL — the requester stays genuinely pending) and, on a real cross-node $DEQ that flips a queued waiter to granted, WIREs an unprompted deferred GRANT (SS$_NORMAL, the granted mode) to that requester (vms_lock_dlm_xnode_deq reports the flipped waiter). The REQUESTER-SIDE GRANT RECEIVE (VMS_DLM_OP_GRANT) completes an executive-resident ORIGIN record on the requesting node, whose granted mode is set ONLY from what the master sent over SCS; GETLKI reads the NL->EX flip back on the REQUESTER. This origin record is the requester-side wait-for state H11's distributed deadlock search reads (VMS_IOCTL_DLM_ENUM_WAITS). Proven on a two-node live A<->B QEMU harness with real /dev/vms on both (tests/qemu/run_dlm_harness_h5.sh: SCSD-I-DLMPEND, SCSD-I-DLMDEFER, SCSD-I-DLMH5FLIP granted_mode=EX). No fabricated wire reply or grant (INV-6). +| 🟢 | `cluster-dlm$async-reply-wire` | feature | Async DLM replies (queued-reply + deferred GRANT) delivered over SCS; requester-side completion | implemented | real | in | `src/kernel-core/vms_dlm_scs_fsm.c` — vms-6ca rung H5. The master's async replies ride the live SCS wire: node B WIREs the queued-reply (granted mode NL — the requester stays genuinely pending) and, on a real cross-node $DEQ that flips a queued waiter to granted, WIREs an unprompted deferred GRANT (SS$_NORMAL, the granted mode) to that requester (vms_lock_dlm_xnode_deq reports the flipped waiter). The REQUESTER-SIDE GRANT RECEIVE (VMS_DLM_OP_GRANT) completes an executive-resident ORIGIN record on the requesting node, whose granted mode is set ONLY from what the master sent over SCS; GETLKI reads the NL->EX flip back on the REQUESTER. This origin record is the requester-side wait-for state H11's distributed deadlock search reads (VMS_IOCTL_DLM_ENUM_WAITS). The requester-side receive is exercised single-node on real /dev/vms (tests/qemu/test_syssvc_dlm_xnode.c, injected CSID); the former two-node A<->B run_dlm_harness_h5.sh proof (SCSD-I-DLMPEND/DLMDEFER/DLMH5FLIP) was retired in #1052 — multi-node wire proof pending (vms-1ee). No fabricated wire reply or grant (INV-6). | -| ✅ | `cluster-dlm$remaster-lvb-deadlock` | feature | LVB replication, dynamic remastering (directory + lock state), directory-ownership guard, distributed deadlock detection | verified | real | in | `src/kernel-core/vms_lock.c` — The former "remain absent" cluster of the DLM epic, now COMPLETE and each part proven on a live multi-node /dev/vms rail. LVB REPLICATION both ways: the H8 write crossing (vms-d81/#923) and the H9 read crossing (vms-eeb/#925). DYNAMIC REMASTERING on graceful departure: the directory INGRESS re-resolves a departed node's resources onto a survivor (H10a, vms-2bf/#927, VMS_IOCTL_DLM_MEMBER_DEPART + a runtime departed-set filtering the static dlm_member_csids vector), AND the cross-node lock STATE is rebuilt on the new master from the surviving holder's REAL origin record over a targeted SCS_DLM_OP_REBUILD, reconstructed directly into res->granted and value-verified (H10b, vms-dca9/#928, run_dlm_harness_h10b.sh three-way equality). DIRECTORY OWNERSHIP: a node refuses to master a resource it is not the directory for — dlm_resolve_master returns SS$_UNSUPPORTED — proven on the wire (e84, vms-e84/#929, run_dlm_harness_e84.sh: non-directory node answers 0x8F8, directory node GRANTS). DISTRIBUTED DEADLOCK DETECTION: a cross-node cycle is found by an edge-chasing search over the real distributed wait-for graph (home pending origins via VMS_IOCTL_DLM_ENUM_WAITS + master res->granted via VMS_IOCTL_DLM_GET_GRANTED), and a globally-deterministic single victim (lexicographic-min over the cycle) is aborted with SS$_DEADLOCK via the GRANT-reply path, idempotently (H11, vms-ec75/#930, run_dlm_harness_ec75.sh: cycle detected, exactly one victim, the other stays queued). Every edge is a real queue/origin read; a dropped/ttl-expired probe reports no-deadlock, never a fabricated cycle (INV-6). DEPTH deferred beyond the engine (honest, tracked): the concurrent-both-initiate deadlock proof (vms-04f — logic shipped + code-verified), directory REDIRECT (vms-b96), and a real app-process cross-node acquisition path replacing the SS$_UNSUPPORTED "0.4" stub (vms-d1f, post-1.0). +| 🟢 | `cluster-dlm$remaster-lvb-deadlock` | feature | LVB replication, dynamic remastering (directory + lock state), directory-ownership guard, distributed deadlock detection | implemented | real | in | `src/kernel-core/vms_lock.c` — The former "remain absent" cluster of the DLM epic. The code implements each part below and was originally proven on a live multi-node /dev/vms rail, but those multi-node proofs (the run_dlm_harness_* QEMU harnesses referenced below) were RETIRED in the #1052 executive-resident pivot with no real-/dev/vms multi-node successor today — so this row is implemented, not verified (re-establishment tracked in vms-1ee). The mechanism, still in the executive. LVB REPLICATION both ways: the H8 write crossing (vms-d81/#923) and the H9 read crossing (vms-eeb/#925). DYNAMIC REMASTERING on graceful departure: the directory INGRESS re-resolves a departed node's resources onto a survivor (H10a, vms-2bf/#927, VMS_IOCTL_DLM_MEMBER_DEPART + a runtime departed-set filtering the static dlm_member_csids vector), AND the cross-node lock STATE is rebuilt on the new master from the surviving holder's REAL origin record over a targeted SCS_DLM_OP_REBUILD, reconstructed directly into res->granted and value-verified (H10b, vms-dca9/#928, run_dlm_harness_h10b.sh three-way equality). DIRECTORY OWNERSHIP: a node refuses to master a resource it is not the directory for — dlm_resolve_master returns SS$_UNSUPPORTED — proven on the wire (e84, vms-e84/#929, run_dlm_harness_e84.sh: non-directory node answers 0x8F8, directory node GRANTS). DISTRIBUTED DEADLOCK DETECTION: a cross-node cycle is found by an edge-chasing search over the real distributed wait-for graph (home pending origins via VMS_IOCTL_DLM_ENUM_WAITS + master res->granted via VMS_IOCTL_DLM_GET_GRANTED), and a globally-deterministic single victim (lexicographic-min over the cycle) is aborted with SS$_DEADLOCK via the GRANT-reply path, idempotently (H11, vms-ec75/#930, run_dlm_harness_ec75.sh: cycle detected, exactly one victim, the other stays queued). Every edge is a real queue/origin read; a dropped/ttl-expired probe reports no-deadlock, never a fabricated cycle (INV-6). DEPTH deferred beyond the engine (honest, tracked): the concurrent-both-initiate deadlock proof (vms-04f — logic shipped + code-verified), directory REDIRECT (vms-b96), and a real app-process cross-node acquisition path replacing the SS$_UNSUPPORTED "0.4" stub (vms-d1f, post-1.0). | -| ✅ | `cluster-dlm$scs-transport` | feature | DLM SYSAP SCS connection + lock-request message class (ENQ/GRANT/DEQ/BLKAST/REBUILD/DLKSRCH) between cluster nodes | verified | real | in | `src/kernel-core/vms_cluster_codec_dlm.c` — vms-94c rung 1, extended through H11. A DLM message rides as a p.4-13 SCS application message (MTYPE 10) with its body at SCA content offset 58 (the scs_mscp.c nesting). The transport is real and the receive handler GRANTS, QUEUES, delivers BLKAST, rebuilds on remaster, and runs the deadlock search — the full ENQ-class op set is handled on a real /dev/vms executive across every DLM QEMU harness (H0..H11). +| 🟢 | `cluster-dlm$scs-transport` | feature | DLM SYSAP SCS connection + lock-request message class (ENQ/GRANT/DEQ/BLKAST/REBUILD/DLKSRCH) between cluster nodes | implemented | real | in | `src/kernel-core/vms_cluster_codec_dlm.c` — vms-94c rung 1, extended through H11. A DLM message rides as a p.4-13 SCS application message (MTYPE 10) with its body at SCA content offset 58 (the scs_mscp.c nesting). The transport is real and the receive handler GRANTS, QUEUES, delivers BLKAST, rebuilds on remaster, and runs the deadlock search — the full ENQ-class op set is handled on a real /dev/vms executive (single-node dispatch, tests/qemu/test_syssvc_dlm_xnode.c); the H0..H11 multi-node QEMU harnesses were retired in #1052 with no multi-node successor (vms-1ee). | ### cluster-logicals — Cluster-wide logical names / global sections