Real per-VM log persistence: source attribution + ACL pin (FABRIC-3.md §XXVII)

Wires the previously-unused vm_log_attributed_vm() into LOG-APPEND's kernel
primitive so persisted log records carry a trustworthy source (the real
attributed VM's registry name, or "HADES" pseudo-source) instead of a
caller-supplied, trivially forgeable string. Drops src-addr/src-u from
LOG-APPEND's stack signature accordingly. Pins LOG-APPEND via bare ACL-PIN
in Artemis's own init.4th, matching BIRTH/CAPSULE-BIRTH's precedent for a
privileged word that can't reach the shared, host-portable ACL.4th.

Also fixes two console-banner nitpicks: a mis-rendering em dash (U+2014)
in the boot banner, and drops "Emergency" from the CLI banner text.

Doc corrections to artemis_sig.h/zuse_eligibility_list.h reconciling the
three fixed devblock ranges now in play. LOG-FLUSH (the intended normal
entry point) and level-aware log eviction remain open, flagged not fixed.

Re-verified clean boot to ok> on all 3 architectures after every change.
riscv64 showed one new, unrelated virtio_blk write-timeout anomaly during
Artemis's early physics self-test (self-recovered, boot unaffected,
sector doesn't map to the log region) -- flagged, not investigated.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016UNhH1mhi52i6Qihh7ZV5S

include/starkernel/artemis_sig.h

@@ -151,15 +151,27 @@ typedef struct {
                                   * boundary" convention homeblocks_sig_t
                                   * uses for an identity's own pool. */
 
-    uint32_t log_region_offset;    /* Devblock offset where the growable
-                                    * per-VM log-persistence region starts;
-                                    * 0 = not yet allocated. */
-    uint32_t log_region_devblocks; /* Current reserved size of the log
-                                    * region, in devblocks -- grows over
-                                    * time (same growable-reservation
-                                    * mechanism the metadata fence design
-                                    * already uses elsewhere), not a single
-                                    * fixed guess made once at genesis. */
+    uint32_t log_region_offset;    /* CORRECTION, Step 4 (log_region.h,
+                                    * 2026-09-13): stays 0 -- informational
+                                    * field only, never written or read by
+                                    * the real implementation. The log
+                                    * region ended up at a fixed, compile-
+                                    * time devblock_from_top constant
+                                    * (LOG_REGION_DEVBLOCK_FROM_TOP_BASE,
+                                    * log_region.h) reached through
+                                    * blk_meta_zone_*(), whose own control
+                                    * header (log_region_ctrl_t) is the one
+                                    * authoritative source of the region's
+                                    * live offset/size/head/tail -- a second
+                                    * writer of the same fact here would be
+                                    * unnecessary drift risk, not a useful
+                                    * summary. Left at 0/reserved rather
+                                    * than deleted, in case a real second
+                                    * reader (a host-side offline tool that
+                                    * can't run blk_meta_zone_*() at all)
+                                    * ever needs it. */
+    uint32_t log_region_devblocks; /* See log_region_offset above -- same
+                                    * reasoning, stays 0. */
 
     uint64_t hdr_crc;            /* Computed over every field above this
                                   * one, same boundary/discipline as

include/starkernel/log_attrib.h

@@ -0,0 +1,64 @@
+/*
+  StarForth — Steady-State Virtual Machine Runtime
+
+  Copyright (c) 2023–2025 Robert A. James
+  All rights reserved.
+
+  This file is part of the StarForth project.
+
+  Licensed under the StarForth License, Version 1.0 (the "License");
+  you may not use this file except in compliance with the License.
+
+  You may obtain a copy of the License at:
+      https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
+
+  This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  express or implied, including but not limited to the warranties of
+  merchantability, fitness for a particular purpose, and noninfringement.
+
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/**
+ * log_attrib.h - "Which VM is currently executing" for log persistence
+ * attribution (FABRIC-3.md §XXVI follow-on, Step 4, 2026-09-13)
+ *
+ * log_message() (shim.c) is a global function called from hundreds of
+ * existing sites -- most with no VM in scope at all (boot, PCI, xHCI,
+ * driver code). Rather than thread a VM parameter through every one of
+ * those call sites (a large, invasive change for no benefit to the ones
+ * that genuinely have no VM), vm_interpret() (vm_core.c, the single
+ * dispatch entry point for ALL FORTH execution -- interactive lines,
+ * LOAD'd block content, and every VM-EXEC/MSG-DELIVER dispatch into a
+ * target VM) sets this at entry and restores the previous value at exit,
+ * save/restore style so nested vm_interpret() calls (VM-EXEC dispatching
+ * into a different VM's own dictionary, mid-interpret) attribute
+ * correctly to whichever VM is actually running at the moment
+ * log_message() fires -- not the outermost caller.
+ *
+ * NULL means "no VM is currently interpreting" -- boot sequence, PCI/
+ * xHCI/driver code, anything running outside a vm_interpret() call frame.
+ * log_message()'s own persistence hook (shim.c) treats NULL as the fixed
+ * "HADES" pseudo-source, matching the console's own existing
+ * "[HADES][LEVEL]" prefix convention for exactly this class of message.
+ */
+
+#ifndef STARKERNEL_LOG_ATTRIB_H
+#define STARKERNEL_LOG_ATTRIB_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct VM;
+
+/* vm_log_attributed_vm - The VM whose dictionary context is currently
+ * executing, or NULL if none (see this header's own doc comment). */
+struct VM *vm_log_attributed_vm(void);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* STARKERNEL_LOG_ATTRIB_H */

include/starkernel/log_region.h

@@ -0,0 +1,177 @@
+/*
+  StarForth — Steady-State Virtual Machine Runtime
+
+  Copyright (c) 2023–2025 Robert A. James
+  All rights reserved.
+
+  This file is part of the StarForth project.
+
+  Licensed under the StarForth License, Version 1.0 (the "License");
+  you may not use this file except in compliance with the License.
+
+  You may obtain a copy of the License at:
+      https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
+
+  This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  express or implied, including but not limited to the warranties of
+  merchantability, fitness for a particular purpose, and noninfringement.
+
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+/**
+ * log_region.h - Growable per-VM log-persistence ring on Artemis's own disk
+ * (FABRIC-3.md §XXVI follow-on, Step 4, 2026-09-13)
+ *
+ * Records real log_message() output (INFO and above, independent of the
+ * console's own current_level filter) so a run survives past the QEMU
+ * serial log -- the motivating case is comparing bare-metal and QEMU
+ * results directly as a DoE factor once bare-metal boot lands, where the
+ * only artifact both platforms share is whatever got persisted to disk.
+ *
+ * Lives in the SAME top-of-device system-metadata fence artemis_sig_t and
+ * Zuse's genesis marker/eligibility list already use
+ * (block_subsystem.h's blk_meta_zone_read()/write(), devblock_from_top
+ * addressing) -- reached the SAME way, deliberately NOT through
+ * artemis_sig.c's own independent blkio_info()-based arithmetic. That
+ * arithmetic exists only because artemis_sig_t must be discoverable on a
+ * device that isn't attached yet (bus-agnostic discovery, repl.c's
+ * idle-loop USB-MSC scan); this ring is only ever read or written once
+ * Artemis's disk is already attached and formatted (LOG-APPEND runs
+ * inside Artemis's own already-live dictionary context, dispatched by a
+ * sender's MSG-SEND/MSG-TICK), so blk_meta_zone_*() -- which requires
+ * exactly that already-attached state -- is the correct, simpler,
+ * already-tested tool, not a limitation to work around.
+ *
+ * Fixed devblock_from_top allocation (NOT persisted in artemis_sig_t's own
+ * log_region_offset/log_region_devblocks fields -- those stay at their
+ * genesis-time value of 0/0, "informational only, control header below is
+ * authoritative," documented in artemis_sig.h; two writers of the same
+ * fact was rejected as unnecessary drift risk):
+ *   64       -- artemis_sig_t itself (ARTEMIS_SIG_DEVBLOCK_FROM_TOP)
+ *   65       -- this ring's control header (LOG_REGION_DEVBLOCK_FROM_TOP_BASE)
+ *   66-96    -- this ring's slot devblocks, growable up to LOG_REGION_MAX_DEVBLOCKS
+ * Chosen clear of Zuse's genesis marker (devblock_from_top=0) and
+ * eligibility list (chains upward from 1, unbounded in code -- see
+ * zuse_eligibility_list.h's own CORRECTION comment, updated alongside this
+ * file, for the honest real-world headroom that leaves: devblocks 1-63,
+ * ~8000 possible eligible identities before ever reaching 64).
+ *
+ * Ring granularity is one whole devblock-quarter (LOG_SLOT_SIZE, 1024
+ * bytes = exactly one blkio forth-block) per record -- avoids any
+ * partial-forth-block read-modify-write for the write itself (a slot
+ * write is one aligned blkio_write()-equivalent-sized unit); the
+ * surrounding devblock (4 slots) still needs a read-modify-write via
+ * blk_meta_zone_read()/write() since that accessor's own unit is one full
+ * 4 KiB devblock, but that cost is the same regardless of slot size.
+ * Records are truncated to fit one slot rather than spanning multiple --
+ * simple, real, and sufficient for what's actually persisted (see
+ * vm_log_buffer.h's own tighter caps, chosen to fit a whole batch of
+ * several records inside one VM-EXEC/MSG-SEND line, INPUT_BUFFER_SIZE=1025).
+ */
+
+#ifndef STARKERNEL_LOG_REGION_H
+#define STARKERNEL_LOG_REGION_H
+
+#include <stdint.h>
+#include "starkernel/artemis_sig.h" /* ARTEMIS_SIG_DEVBLOCK_FROM_TOP */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*===========================================================================
+ * Fence allocation
+ *===========================================================================*/
+
+#define LOG_REGION_DEVBLOCK_FROM_TOP_BASE (ARTEMIS_SIG_DEVBLOCK_FROM_TOP + 1u) /* 65 */
+#define LOG_REGION_INITIAL_DEVBLOCKS      4u   /* slot devblocks at first use, excludes control header */
+#define LOG_REGION_GROWTH_INCREMENT       4u
+#define LOG_REGION_MAX_DEVBLOCKS          32u  /* ceiling -- devblock_from_top stays within [66,96] */
+
+#define LOG_SLOTS_PER_DEVBLOCK 4u   /* 4 x 1 KiB forth-blocks per 4 KiB devblock */
+#define LOG_SLOT_SIZE          1024u
+
+/*===========================================================================
+ * log_region_ctrl_t - ring control header, one devblock at
+ * LOG_REGION_DEVBLOCK_FROM_TOP_BASE. head_slot/tail_slot/record_count are
+ * the authoritative, live ring state -- nothing outside this header (not
+ * even artemis_sig_t) needs to track it.
+ *===========================================================================*/
+
+#define LOG_REGION_MAGIC     0x474C474Cull /* 'LGLG' */
+#define LOG_REGION_VERSION_0 0
+
+#define LOG_REGION_PACK(ver) \
+    (LOG_REGION_MAGIC | ((uint64_t)(ver) << 32))
+#define LOG_REGION_GET_MAGIC(m)   ((uint32_t)((m) & 0xFFFFFFFFull))
+#define LOG_REGION_GET_VERSION(m) ((uint8_t)(((m) >> 32) & 0xFF))
+
+typedef struct {
+    uint64_t magic;         /* LOG_REGION_PACK(...) */
+    uint32_t devblocks;     /* current slot-area size, in devblocks (excludes this header) */
+    uint32_t head_slot;     /* index of the oldest live record */
+    uint32_t tail_slot;     /* index where the NEXT record will be written */
+    uint32_t record_count;  /* live records, <= devblocks * LOG_SLOTS_PER_DEVBLOCK */
+    uint64_t hdr_crc;       /* covers every field above this one */
+    uint8_t  _pad[4096 - (8 + 4 + 4 + 4 + 4 + 8)];
+} log_region_ctrl_t;
+
+typedef char log_region_ctrl_size_check[(sizeof(log_region_ctrl_t) == 4096) ? 1 : -1];
+
+/*===========================================================================
+ * log_slot_t - one record, exactly one 1 KiB forth-block.
+ *===========================================================================*/
+
+#define LOG_SLOT_SOURCE_MAX 16u  /* NUL-padded VM/source tag, e.g. "Hera", "HADES" */
+#define LOG_SLOT_MSG_MAX (LOG_SLOT_SIZE - 8u - 2u - 1u - LOG_SLOT_SOURCE_MAX) /* 997 */
+
+/* Field order deliberate: uint64_t, uint16_t, uint8_t, then char arrays --
+ * every fixed field lands on its natural alignment with zero compiler-
+ * inserted padding (offsets 0, 8, 10, 11), so sizeof() == the hand-summed
+ * byte count the static assert below checks, and LOG_SLOT_SIZE (1024,
+ * already a multiple of 8) needs no trailing padding either. */
+typedef struct {
+    uint64_t timestamp;              /* shim.c's own KRELTSC-style relative tick */
+    uint16_t msg_len;                /* used length of msg[], <= LOG_SLOT_MSG_MAX (997, needs 16 bits) */
+    uint8_t  level;                  /* LogLevel */
+    char     source[LOG_SLOT_SOURCE_MAX];
+    char     msg[LOG_SLOT_MSG_MAX];
+} log_slot_t;
+
+typedef char log_slot_size_check[(sizeof(log_slot_t) == LOG_SLOT_SIZE) ? 1 : -1];
+
+/*===========================================================================
+ * API
+ *===========================================================================*/
+
+/*
+ * log_region_append - Write one record to the ring, growing it (within
+ * LOG_REGION_MAX_DEVBLOCKS) or evicting the oldest record (ring full and
+ * already at the growth ceiling) as needed. Initializes the ring on first
+ * use (control header blank). Never calls log_message() or anything that
+ * might (this runs inside Artemis's own dictionary context during message
+ * delivery -- see this header's own note on why; a log call here could
+ * recurse into this same append path via Artemis's own buffered flush).
+ *
+ * @param level     LogLevel of this record.
+ * @param timestamp Caller-supplied relative timestamp (same KRELTSC base
+ *                   shim.c's own log_message() uses).
+ * @param source     VM/source tag, e.g. "Hera", "HADES", an identity name.
+ * @param source_len Length of source (truncated to LOG_SLOT_SOURCE_MAX-1).
+ * @param msg        Message text (not NUL-terminated required).
+ * @param msg_len    Length of msg (truncated to LOG_SLOT_MSG_MAX).
+ * @return 0 on success, -1 on any read/write failure (ring left however
+ *         the failed operation left it -- blk_meta_zone_write() itself
+ *         never partially writes a devblock).
+ */
+int log_region_append(uint8_t level, uint64_t timestamp,
+                       const char *source, uint32_t source_len,
+                       const char *msg, uint32_t msg_len);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* STARKERNEL_LOG_REGION_H */

include/starkernel/zuse_eligibility_list.h

@@ -16,10 +16,26 @@
  * "this is the last devblock in the chain") -- entries are appended by
  * filling the current tail devblock, then chaining a fresh one out of the
  * already-reserved BLK_META_FENCE_INIT budget once it's full. No fence
- * growth logic is needed yet: only 2 of the 128 pre-reserved devblocks
- * are spoken for (0 = genesis marker, 1 = this list's head) and the
- * chain has 126 more slots to grow into before that budget itself would
- * need extending.
+ * growth logic is needed yet.
+ *
+ * CORRECTION (FABRIC-3.md SXXVI follow-on, Step 4, 2026-09-13): the fence
+ * is no longer this list's alone to grow into. artemis_sig_t now owns
+ * devblock_from_top=64 (include/starkernel/artemis_sig.h), and the
+ * per-VM log-persistence ring now owns devblock_from_top 65-96
+ * (include/starkernel/log_region.h) -- both fixed, compile-time
+ * constants, chosen deliberately clear of this list's own growth
+ * direction (chaining upward from devblock_from_top=1). This list's real
+ * remaining headroom is devblocks 1-63 (not "126 more slots" as this
+ * comment used to say): 63 devblocks x ZUSE_ELIGIBILITY_ENTRIES_PER_DEVBLOCK
+ * (127) = 8001 possible eligible identities before ever reaching
+ * devblock_from_top=64 -- vastly beyond any plausible real deployment of
+ * this project, but genuinely unenforced: there is no code-level ceiling
+ * stopping this chain from growing into devblock 64+ if that number were
+ * ever actually approached. Noted here, not silently assumed safe, after
+ * a fixed-offset collision was caught and fixed once already this session
+ * (Artemis's own disk vs. its live BAM, artemis_sig.h's own CORRECTION
+ * comment) -- the lesson being to state the real bound in writing rather
+ * than trust "it'll never get that big."
  *
  * Raw, unpacked 4 KiB devblock -- same convention as
  * zuse_genesis_marker_t/homeblocks_sig_t: real CRC from day one, this