unix: a bound socket is a file

Gate 1, item 3, and the last of foundations.md.

bind() creates a T_SOCK node at the path; connect() resolves the path and looks
for the socket bound to **that inode**. Matching on the inode rather than on
the path *string* is the part that matters: the name used to live only in the
socket table, so two spellings of one path missed each other, a relative path
never matched an absolute one, and there was nothing to stat() or unlink().
An inode is the thing a path resolves *to*, so connect() can walk the path
however it likes and arrive at the same socket.

    # ls -l /tmp
    srwxr-xr-x 1 root root 0 2026-09-22 08:04 socktest

The node is a marker, not the binding. It holds no data and the live
association stays in the socket table, so a socket file left by a crash is
what Linux leaves behind -- a dead file that connect() refuses until something
binds again -- and unlink()ing a live socket's path does not disturb anyone
already connected.

EADDRINUSE comes from the *directory* rather than from a scan of the table,
deliberately: a stale socket file has to refuse a rebind for the same reason a
running server's does, or two servers both believe they own it. The creation
lives in sys_bind() and not in unix.c, because that is the layer with both --
kernel/net/unix.c knows about sockets and has no business calling create().

T_SOCK is a compat addition to SchFS by the rule in schfs.h: a driver that does
not know SCHFS_T_SOCK maps it to a zero-length regular file, so nothing goes
stale and nothing becomes unreadable.

cmd/socktest section 15 asserts the plan's own wording -- bind, stat, see an
`s`, unlink -- plus the two a name table could never fail: a second bind to a
live path is refused, and connecting to a path that is a *regular file* is
refused rather than matched by name.

**And the semantics being real broke socktest on its second run**, correctly:
the socket files persisted and every bind() hit EADDRINUSE. Every real server
unlinks before binding; socktest now does too, which is the change the new
behaviour demands rather than a workaround for it.

Chasing that turned up something worse. `socktest` reported rc=1 with every
check passing, and so did every other first-party program:

  - **lib/start.S called main and threw %eax away.** sys_exit() reads the
    status from %rdi and nothing put it there, so every program exited with
    whatever that register happened to hold. Every test suite ends in
    `return failures ? 1 : 0` and none of it reached the shell.
  - **exit(void) passed no status either**, for the same reason: the
    declaration takes no argument, so %rdi was the caller's litter.

`if socktest; then` works now, and a failing command reports 1 -- checked both
ways, because a fix that makes everything return 0 would look identical from
the success side.

Also factored: unlink_path() out of sys_unlink, so a failed bind can take its
own node back out without going through the syscall entry, and create_sock()
as a named door rather than exporting create() with an arbitrary type.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/plan/1.0.md

@@ -436,7 +436,14 @@ Nothing above needs these; everything below stops without them.
       System V key, which is the whole reason it exists on Linux.
       `cmd/memfdtest`: seventeen checks, ending with a memfd sent over a
       socket to a receiver that closes every inherited copy first.
-- [ ] **Item 3 — `AF_UNIX` sockets in the filesystem namespace.**
+- [x] ~~**Item 3 — `AF_UNIX` sockets in the filesystem namespace.**~~ `bind()`
+      creates a `T_SOCK` node; `connect()` resolves the path and matches the
+      socket bound to *that inode*, not to a string. `ls -l` shows
+      `srwxr-xr-x`, `stat()` reports `S_IFSOCK`, `unlink()` removes it, and a
+      second bind to a live path is `EADDRINUSE` *from the directory* — which
+      is what makes a socket file left by a crashed server refuse a rebind, as
+      it must. `cmd/socktest` section 15. `flock()` is still missing and is
+      recorded as such.
 
 ### Gate 2 — Init as a role — **done**
 

docs/plan/foundations.md

@@ -97,12 +97,18 @@ carries `shmid` and a `no_free` flag for pages that are not ours to release).
 The general answer — a page cache, and writable `MAP_SHARED` of a real file —
 stays owed. It is a larger project and nothing on this plan needs it.
 
-### 3. `AF_UNIX` sockets in the filesystem namespace
+### 3. `AF_UNIX` sockets in the filesystem namespace — **done**
 
 Clients find a Wayland compositor by `bind()`ing `$XDG_RUNTIME_DIR/wayland-0` as
 a real path, and libwayland `flock()`s the lock file beside it. A name table can
 express neither.
 
+`bind()` creates a `T_SOCK` node and `connect()` resolves the path and matches
+the socket bound to **that inode** — not to a string, which is what made two
+spellings of one path miss each other. `ls -l` shows `srwxr-xr-x`, `stat()`
+reports `S_IFSOCK`, and `unlink()` removes it. Asserted by `cmd/socktest`,
+section 15. `flock()` is still not implemented; see below.
+
 `kernel/net/unix.c`'s own header comment already predicted this:
 
 > *"What is lost is `ls -l /tmp/schcom` showing an `s`, and `unlink()` of a socket
@@ -159,3 +165,7 @@ These belong in `bootcheck` as a new switch, following the `-Sock` model.
 - **`SO_*` coverage is the two options named**, not the full set.
 - **No credential passing** (`SCM_CREDENTIALS`) — only descriptors. Nothing on
   this plan needs it, and a compositor that wants to know who connected will.
+- **No `flock()`.** libwayland locks `wayland-0.lock` beside the socket to stop
+  two compositors claiming one display. The socket itself is now a real path,
+  so the lock file can be created and opened; what is missing is the advisory
+  lock, which is a separate mechanism and has no other caller yet.