Keep the DD and session counters out of module storage (#64)

[mgrossmann]

Fixes #64.

What happens

UFSD is link-edited AC(1). Fetched from an APF-authorized library the job step is already authorized when program fetch runs, so MVS obtains the job pack area in subpool 252, key 0 — authorized code must not be patchable by problem-key code. The STC runs problem state key 8, so any store into the module's own storage is a protection exception.

The three dumps on the issue are identical and land on the first such store, ++s_ddn_seq in ufsd_disk_mount_dyn — right after UFSD047I, before UFSD001I READY:

PSW AT ENTRY TO ABEND  078D2000 000ADD0A   ILC 4  INTC 0004
REGS AT TIME OF ERROR  ...  R3 000ACC78  R4 00000001  R12 000ADC0A
SPQE 009BF2B0 ... SPID 252  KEY 0   DQE BLK 000A5000  LN 00021000
CDE  NM UFSD  EPA 000A5B18   XL 000204E8

R3 addresses the fetched module, R12 matches the function's BALR 12,0 base, and the bytes at 0ADCF4 are L 3,=A(@V1) / L 4,0(3) / A 4,=F'1' / ST 4,0(3) — the ST is the failing instruction, R4 the incremented 1.

s_sess_serial in ufsd_sess_open is the same defect one step further on: with s_ddn_seq alone fixed, the first client session would have abended instead.

Why the SVC 244 route is unaffected: it sets JSCBAUTH after the fetch and cannot relabel storage that is already allocated, so the module stays key 8. That is why the STC works on a stock TK4-/TK5 and only fails when the LINKLIB carries an APF entry.

Changes

• Both counters move into UFSD_STC — a main() local, hence key 8. ufsd_sess_open reaches it through anchor->server_stc, which is set before the SSCT is registered, so no client can arrive before it exists.
• tools/check-module-data.py rejects mutable file-scope data and function-local statics in the AC(1) modules; own CI job, no toolchain needed. UFSFMT is exempt — AC(0), so the job step is never authorized and the module is fetched key 8.
• Constraint 7 in CLAUDE.md, plus the APF section and a troubleshooting row in docs/installation.md.

Exposure audit

Beyond the two counters, the generated assembler was scanned for stores through a register loaded from =A(@Vn) (that is what found these): nothing else in UFSD, UFSDSSIR or UFSDCLNP, nothing in client/libufs.c (not covered by the guard — it is a library, so the storage key of the module it lands in is the consuming program's business), and nothing in the libc370 members linked into build/UFSD — the C library keeps per-task state in the heap-allocated CRT and uses module statics only as no-CRT fallbacks.

There is a second reason to want the rule, independent of authorization: ld370 marks a load module RENT and REUS by default (norent / noreus opt out, and none of our modules does). So these counters were not merely at risk of breaking a future reentrancy claim — they broke the one the module already carries, and would have failed the same way in the LPA. Link attributes are deliberately untouched here.

Verification

• make clean, make test-host 180/180 assertions pass, lint clean — and the lint flags the pre-fix source when pointed at it.
• Not yet verified on MVS. Nothing here reproduces key-0 protection off-target: that needs /S UFSD with an APF-authorized UFSD.LINKLIB reaching UFSD001I READY, plus one client session (HTTPD or FTPD) to exercise the second counter.