unix: a bound socket is a file

Gate 1, item 3, and the last of foundations.md.

bind() creates a T_SOCK node at the path; connect() resolves the path and looks
for the socket bound to **that inode**. Matching on the inode rather than on
the path *string* is the part that matters: the name used to live only in the
socket table, so two spellings of one path missed each other, a relative path
never matched an absolute one, and there was nothing to stat() or unlink().
An inode is the thing a path resolves *to*, so connect() can walk the path
however it likes and arrive at the same socket.

    # ls -l /tmp
    srwxr-xr-x 1 root root 0 2026-09-22 08:04 socktest

The node is a marker, not the binding. It holds no data and the live
association stays in the socket table, so a socket file left by a crash is
what Linux leaves behind -- a dead file that connect() refuses until something
binds again -- and unlink()ing a live socket's path does not disturb anyone
already connected.

EADDRINUSE comes from the *directory* rather than from a scan of the table,
deliberately: a stale socket file has to refuse a rebind for the same reason a
running server's does, or two servers both believe they own it. The creation
lives in sys_bind() and not in unix.c, because that is the layer with both --
kernel/net/unix.c knows about sockets and has no business calling create().

T_SOCK is a compat addition to SchFS by the rule in schfs.h: a driver that does
not know SCHFS_T_SOCK maps it to a zero-length regular file, so nothing goes
stale and nothing becomes unreadable.

cmd/socktest section 15 asserts the plan's own wording -- bind, stat, see an
`s`, unlink -- plus the two a name table could never fail: a second bind to a
live path is refused, and connecting to a path that is a *regular file* is
refused rather than matched by name.

**And the semantics being real broke socktest on its second run**, correctly:
the socket files persisted and every bind() hit EADDRINUSE. Every real server
unlinks before binding; socktest now does too, which is the change the new
behaviour demands rather than a workaround for it.

Chasing that turned up something worse. `socktest` reported rc=1 with every
check passing, and so did every other first-party program:

  - **lib/start.S called main and threw %eax away.** sys_exit() reads the
    status from %rdi and nothing put it there, so every program exited with
    whatever that register happened to hold. Every test suite ends in
    `return failures ? 1 : 0` and none of it reached the shell.
  - **exit(void) passed no status either**, for the same reason: the
    declaration takes no argument, so %rdi was the caller's litter.

`if socktest; then` works now, and a failing command reports 1 -- checked both
ways, because a fix that makes everything return 0 would look identical from
the success side.

Also factored: unlink_path() out of sys_unlink, so a failed bind can take its
own node back out without going through the syscall entry, and create_sock()
as a named door rather than exporting create() with an arbitrary type.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kernel/net/unix.c

@@ -133,12 +133,12 @@ alloc_locked(int type)
 
 // Find a socket listening on this name. Caller holds stab.lock.
 static struct socket *
-find_listener(const char *name)
+find_listener_ino(uint dev, uint64 ino)
 {
   struct socket *s;
 
   for(s = stab.sock; s < stab.sock + NSOCK; s++)
-    if(s->state == SS_LISTENING && strncmp(s->name, name, UNIX_PATH_MAX) == 0)
+    if(s->state == SS_LISTENING && s->bind_dev == dev && s->bind_ino == ino)
       return s;
   return 0;
 }
@@ -656,11 +656,22 @@ sockpair(struct socket **pa, struct socket **pb)
   return 0;
 }
 
+// bind(2) for AF_UNIX. The caller has already created the filesystem node and
+// hands over its identity; see sys_bind() in kernel/sys/sys_net.c for why the
+// creation lives there and not here.
+//
+// The name used to live only in this table, so `bind()` created nothing --
+// there was no file to stat(), no `s` in `ls -l`, and nothing to unlink. A
+// Wayland client finds its compositor by bind()ing a real path, and
+// libwayland locks the file beside it; a name table can express neither.
+//
+// **The node is a marker, not the binding.** It holds no data. What makes a
+// socket findable is that connect() resolves the path to an inode and looks
+// for the socket bound to *that inode*, so any spelling of the path arrives
+// at the same place -- which a string comparison could never manage.
 int
-sockbind(struct socket *s, const char *path)
+sockbind(struct socket *s, const char *path, uint dev, uint64 ino)
 {
-  struct socket *other;
-
   if(path[0] == '\0')
     return -EINVAL;
 
@@ -669,14 +680,9 @@ sockbind(struct socket *s, const char *path)
     release(&stab.lock);
     return -EINVAL;
   }
-  for(other = stab.sock; other < stab.sock + NSOCK; other++){
-    if(other != s && other->state >= SS_BOUND &&
-       strncmp(other->name, path, UNIX_PATH_MAX) == 0){
-      release(&stab.lock);
-      return -EADDRINUSE;
-    }
-  }
   safestrcpy(s->name, path, UNIX_PATH_MAX);
+  s->bind_dev = dev;
+  s->bind_ino = ino;
   s->state = SS_BOUND;
   release(&stab.lock);
   return 0;
@@ -753,8 +759,11 @@ sockaccept(struct socket *s)
   return c;
 }
 
+// connect(2) for AF_UNIX. The listener is the socket bound to the inode the
+// path resolved to -- the caller did the resolving, for the same reason
+// sockbind() does not create the node.
 int
-sockconnect(struct socket *s, const char *path)
+sockconnect(struct socket *s, uint dev, uint64 ino)
 {
   struct socket *srv, *peer;
 
@@ -763,7 +772,7 @@ sockconnect(struct socket *s, const char *path)
     release(&stab.lock);
     return -EINVAL;
   }
-  srv = find_listener(path);
+  srv = find_listener_ino(dev, ino);
   if(srv == 0){
     release(&stab.lock);
     return -ECONNREFUSED;