unix: a bound socket is a file

Gate 1, item 3, and the last of foundations.md.

bind() creates a T_SOCK node at the path; connect() resolves the path and looks
for the socket bound to **that inode**. Matching on the inode rather than on
the path *string* is the part that matters: the name used to live only in the
socket table, so two spellings of one path missed each other, a relative path
never matched an absolute one, and there was nothing to stat() or unlink().
An inode is the thing a path resolves *to*, so connect() can walk the path
however it likes and arrive at the same socket.

    # ls -l /tmp
    srwxr-xr-x 1 root root 0 2026-09-22 08:04 socktest

The node is a marker, not the binding. It holds no data and the live
association stays in the socket table, so a socket file left by a crash is
what Linux leaves behind -- a dead file that connect() refuses until something
binds again -- and unlink()ing a live socket's path does not disturb anyone
already connected.

EADDRINUSE comes from the *directory* rather than from a scan of the table,
deliberately: a stale socket file has to refuse a rebind for the same reason a
running server's does, or two servers both believe they own it. The creation
lives in sys_bind() and not in unix.c, because that is the layer with both --
kernel/net/unix.c knows about sockets and has no business calling create().

T_SOCK is a compat addition to SchFS by the rule in schfs.h: a driver that does
not know SCHFS_T_SOCK maps it to a zero-length regular file, so nothing goes
stale and nothing becomes unreadable.

cmd/socktest section 15 asserts the plan's own wording -- bind, stat, see an
`s`, unlink -- plus the two a name table could never fail: a second bind to a
live path is refused, and connecting to a path that is a *regular file* is
refused rather than matched by name.

**And the semantics being real broke socktest on its second run**, correctly:
the socket files persisted and every bind() hit EADDRINUSE. Every real server
unlinks before binding; socktest now does too, which is the change the new
behaviour demands rather than a workaround for it.

Chasing that turned up something worse. `socktest` reported rc=1 with every
check passing, and so did every other first-party program:

  - **lib/start.S called main and threw %eax away.** sys_exit() reads the
    status from %rdi and nothing put it there, so every program exited with
    whatever that register happened to hold. Every test suite ends in
    `return failures ? 1 : 0` and none of it reached the shell.
  - **exit(void) passed no status either**, for the same reason: the
    declaration takes no argument, so %rdi was the caller's litter.

`if socktest; then` works now, and a failing command reports 1 -- checked both
ways, because a fix that makes everything return 0 would look identical from
the success side.

Also factored: unlink_path() out of sys_unlink, so a failed bind can take its
own node back out without going through the syscall entry, and create_sock()
as a named door rather than exporting create() with an arbitrary type.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kernel/sys/sys_net.c

@@ -19,6 +19,7 @@
 #include "fs.h"
 #include "spinlock.h"
 #include "sleeplock.h"
+#include "stat.h"
 #include "file.h"
 #include "posix.h"
 #include "syscall.h"
@@ -241,7 +242,46 @@ SYSCALL_DEFINE(bind)
 
     if ((r = fetch_sun_path(uaddr, ulen, path)) < 0)
         return r;
-    return sockbind(s, path);
+
+    // The node lives in the filesystem now, and it is made here rather than in
+    // sockbind() because this is the layer that has both -- kernel/net/unix.c
+    // knows about sockets and has no business calling create().
+    //
+    // EADDRINUSE comes from the directory, not from a scan of the socket
+    // table: the name being taken is a property of the filesystem, and a
+    // socket file left behind by a crashed server has to refuse a rebind for
+    // the same reason a running one does. Otherwise two servers both believe
+    // they own it.
+    {
+        struct inode *ip;
+        uint   dev;
+        uint64 ino;
+
+        begin_op();
+        if ((ip = namei(path)) != 0) {
+            iput(ip);
+            end_op();
+            return -EADDRINUSE;
+        }
+        if ((ip = create_sock(path)) == 0) {
+            end_op();
+            return -ENOENT;           // the directory does not exist
+        }
+        dev = ip->dev;
+        ino = ip->inum;
+        iunlockput(ip);
+        end_op();
+
+        r = sockbind(s, path, dev, ino);
+        if (r < 0) {
+            // Take the node back out, so a failed bind leaves nothing behind
+            // for the next one to trip over.
+            begin_op();
+            unlink_path(path);
+            end_op();
+        }
+        return r;
+    }
 }
 
 SYSCALL_DEFINE(listen)
@@ -277,7 +317,27 @@ SYSCALL_DEFINE(connect)
 
     if ((r = fetch_sun_path(uaddr, ulen, path)) < 0)
         return r;
-    return sockconnect(s, path);
+
+    // Resolve the path here, for the same reason bind() creates here. A path
+    // that names nothing, or names something that is not a socket, is
+    // ECONNREFUSED -- which is what Linux says and what a client can act on.
+    {
+        struct inode *ip;
+        uint   dev;
+        uint64 ino;
+        short  type;
+
+        if ((ip = namei(path)) == 0)
+            return -ECONNREFUSED;
+        ilock(ip);
+        dev  = ip->dev;
+        ino  = ip->inum;
+        type = ip->type;
+        iunlockput(ip);
+        if (type != T_SOCK)
+            return -ECONNREFUSED;
+        return sockconnect(s, dev, ino);
+    }
 }
 
 // accept(2) and accept4(2) share everything but the flags word.