starkernel: item 3.8 -- VM identifiers as UUID/GUID

Punch list §25 item 3.8 complete. Added after starting item 4.1
surfaced the need to thread a vm_id into stadium_admit()'s new quota
parameter; Captain Bob ruled UUID/GUID rather than keeping the
narrower uint32_t.

New VMUuid type (vm_uuid.h/vm_uuid.c): two uint64_t halves, RFC-4122-
shaped for logging. Not real randomness -- checked directly against
QEMU 10.2.1's actual CPU feature set: amd64 RDRAND and riscv64 Zkr are
both real, available features here; aarch64 has no RNG property on any
CPU model including "max" (verified exhaustively via QMP
query-cpu-model-expansion). Captain Bob ruled a uniform fallback
across all three ISAs rather than a per-architecture split.

Fallback is a deterministic PRNG (splitmix64) seeded from the Mama
capsule's content hash, pre-filling a 16-entry FIFO pool at boot and
refilling with another batch of the same stream when exhausted --
exactly the shape requested. Same capsule booted twice produces the
same id sequence, preserving the dict_hash reproducibility this
session has relied on throughout.

Hera keeps a fixed, reserved all-zero id, not drawn from the pool --
capsule_birth.c uses vm_id == 0 as a load-bearing sentinel in three
places (KILL protection x2, fleet heat-fanout parent-chain
terminator), found by reading before writing any code.

Two real sentinel-collision bugs caught before shipping, same class as
STADIUM_CONTAINS_NONE: vm_uuid_none() (all-ones, not all-zero) for
"not yet assigned"/"no VM" placeholders; confirmed item 3.7's quota
table already used an in_use boolean rather than a vm_id sentinel, so
no second collision was actually possible there -- the dead,
never-referenced STADIUM_QUOTA_SLOT_EMPTY macro was removed.

Blast radius larger than first scoped, flagged mid-work rather than
silently absorbed: capsule_vm_physics.c/.h (the fleet heat-transfer
layer item 2.1 modified earlier this session) has its own vm_id-keyed
node table and walks parent_vm_id chains through the same identity
space, so it needed the same change, plus its callers in
mama_forth_words.c and sk_vm_bootstrap.c.

One live FORTH word contract changed, by explicit ruling: CAPSULE-BIRTH
was ( capsule-id -- vm-id ), a single cell -- can't hold 128 bits.
Captain Bob picked pushing two cells ("there is doubles support in the
FORTH std word set anyway"): ( capsule-id -- vm-id-hi vm-id-lo ).
MAMA-VM-ID changed the same way: ( -- 0 0 ).

Verified: full (not standalone-file) kernel rebuild to catch cross-file
breakage given the size of this change -- it surfaced the
capsule_vm_physics.c blast radius a narrower check would have missed.
Three-architecture boot (amd64, aarch64, riscv64), all reaching ok>
with identical dict_hash=0x3d4e1daf289da94f matching the item-3.7
baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

include/starkernel/capsule_birth.h

@@ -137,7 +137,7 @@ CapsuleRunResult capsule_birth_baby(
     const CapsuleDesc *descs,
     const CapsuleNameEntry *names,
     const uint8_t *arena,
-    uint32_t *out_vm_id,
+    VMUuid *out_vm_id,
     void **out_vm_ctx
 );
 
@@ -216,7 +216,7 @@ int capsule_vm_kill(const char *name);
  * @param out    Output: registry entry copy
  * @return 0 on success, -1 if not found
  */
-int capsule_vm_registry_get(uint32_t vm_id, VMRegistryEntry *out);
+int capsule_vm_registry_get(VMUuid vm_id, VMRegistryEntry *out);
 
 /**
  * capsule_vm_registry_count - Get number of registered VMs
@@ -252,7 +252,7 @@ int capsule_vm_find_by_name_nocase(const char *name, VMRegistryEntry *out);
  * @param vm_id  VM ID to update
  * @param state  New VMState value
  */
-void capsule_vm_set_state(uint32_t vm_id, uint32_t state);
+void capsule_vm_set_state(VMUuid vm_id, uint32_t state);
 
 /**
  * capsule_vm_registry_set_name - Assign a symbolic name to a registered VM
@@ -262,7 +262,7 @@ void capsule_vm_set_state(uint32_t vm_id, uint32_t state);
  * @param vm_id  VM ID to name
  * @param name   Symbolic name string
  */
-void capsule_vm_registry_set_name(uint32_t vm_id, const char *name);
+void capsule_vm_registry_set_name(VMUuid vm_id, const char *name);
 
 /**
  * capsule_vm_kill_all_nonmama - Kill every non-Mama VM in the registry.

include/starkernel/capsule_run.h

@@ -31,6 +31,7 @@
 #define STARKERNEL_CAPSULE_RUN_H
 
 #include <stdint.h>
+#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
 
 #ifdef __cplusplus
 extern "C" {
@@ -63,7 +64,7 @@ typedef enum {
 
 typedef struct {
     uint64_t run_id;         /* Sequential run identifier */
-    uint32_t vm_id;          /* Which VM executed this */
+    VMUuid   vm_id;          /* Which VM executed this (item 3.8) */
     uint32_t reserved;       /* Padding */
     uint64_t capsule_id;     /* Which capsule was run */
     uint64_t capsule_hash;   /* Hash at time of execution */
@@ -91,17 +92,18 @@ typedef enum {
 } VMState;
 
 typedef struct {
-    uint32_t vm_id;              /* Assigned at birth, immutable */
+    VMUuid   vm_id;              /* Assigned at birth, immutable (item 3.8) */
     uint32_t state;              /* VMState */
     uint64_t birth_capsule_id;   /* Which capsule birthed this VM */
     uint64_t birth_timestamp_ns; /* When VM was born */
     uint64_t birth_dict_hash;    /* Dictionary hash after birth */
     uint32_t flags;              /* VM flags */
-    uint32_t parent_vm_id;       /* Who birthed this VM. Set once at birth,
+    VMUuid   parent_vm_id;       /* Who birthed this VM. Set once at birth,
                                   * never rewritten. Hera's own entry is
                                   * self-referential (parent_vm_id == vm_id
-                                  * == 0) -- the sentinel a heat-fanout walk
-                                  * up the parent chain stops at. */
+                                  * == vm_uuid_hera(), all-zero) -- the
+                                  * sentinel a heat-fanout walk up the
+                                  * parent chain stops at. */
     void    *vm_ptr;             /* Pointer to live VM object; NULL when dead */
     char     name[VM_NAME_MAX];  /* Symbolic name, e.g. "Hera", "Hermes" */
 } VMRegistryEntry;
@@ -148,7 +150,7 @@ uint32_t capsule_run_log_count(void);
  *   PARITY:BIRTH vm_id=N capsule_id=X mode=p capsule_hash=H dict_hash=D
  */
 void capsule_parity_log_birth(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t capsule_id,
     uint64_t capsule_hash,
     uint64_t dict_hash
@@ -161,7 +163,7 @@ void capsule_parity_log_birth(
  *   PARITY:BIRTH_FAILED vm_id=N capsule_id=X error=E partial_dict_hash=H
  */
 void capsule_parity_log_birth_failed(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t capsule_id,
     CapsuleRunResult error,
     uint64_t partial_dict_hash
@@ -174,7 +176,7 @@ void capsule_parity_log_birth_failed(
  *   PARITY:RUN vm_id=N run_id=R capsule_id=X mode=e pre_dict=P post_dict=Q
  */
 void capsule_parity_log_run(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t run_id,
     uint64_t capsule_id,
     uint64_t pre_dict_hash,
@@ -200,7 +202,7 @@ void capsule_parity_log_mama_init(
  *   PARITY:KILL vm_id=N name=X
  */
 void capsule_parity_log_kill(
-    uint32_t vm_id,
+    VMUuid vm_id,
     const char *name
 );
 

include/starkernel/capsule_vm_physics.h

@@ -41,6 +41,7 @@
 #define STARKERNEL_CAPSULE_VM_PHYSICS_H
 
 #include <stdint.h>
+#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
 
 #ifdef __cplusplus
 extern "C" {
@@ -55,7 +56,7 @@ extern "C" {
  *
  * @param vm_id  Registry VM ID assigned at birth
  */
-void vm_physics_init(uint32_t vm_id);
+void vm_physics_init(VMUuid vm_id);
 
 /**
  * vm_physics_retire - Remove a killed VM, returning its heat to Hera
@@ -70,7 +71,7 @@ void vm_physics_init(uint32_t vm_id);
  *
  * @param vm_id  Registry VM ID of the VM being killed
  */
-void vm_physics_retire(uint32_t vm_id);
+void vm_physics_retire(VMUuid vm_id);
 
 /**
  * vm_physics_touch - Record real dispatch activity against a VM
@@ -89,7 +90,7 @@ void vm_physics_retire(uint32_t vm_id);
  *
  * @param vm_id   Registry VM ID being dispatched to
  */
-void vm_physics_touch(uint32_t vm_id);
+void vm_physics_touch(VMUuid vm_id);
 
 /**
  * vm_physics_tick - Heartbeat-gated inference pass
@@ -147,7 +148,7 @@ uint64_t vm_physics_fleet_heat_sum(void);
  * @param vm_id  Registry VM ID
  * @return       execution_heat_q48, or 0 if vm_id is unknown or not live
  */
-uint64_t vm_physics_heat_of(uint32_t vm_id);
+uint64_t vm_physics_heat_of(VMUuid vm_id);
 
 /**
  * vm_physics_conserved - Conservation check

include/starkernel/vm/stadium.h

@@ -37,6 +37,7 @@
 #include <stddef.h>
 #include <stdint.h>
 #include "starforth_config.h" /* STADIUM_CONTAINS_DEPTH_MAX, STADIUM_CAPACITY_TICK, STADIUM_MEMORY_PERCENT */
+#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
 
 #define STADIUM_CELL_BYTES 64
 
@@ -272,19 +273,15 @@ int stadium_evict(size_t cell_index);
 /*
  * StadiumVMQuota - per-VM ownership of a subset of the global cell array
  * (FABRIC.md §22.3, item 3.7: "each VM holds its own free-list head index
- * into the global array"). A small table, linearly searched by vm_id --
- * capsule_birth.c's vm_id is monotonic and never reused (next_vm_id only
- * increments, even across VM death), so it cannot index this table
- * directly, and STADIUM_MAX_VM_COUNT is small enough (default 4) that a
- * linear scan costs nothing. Not exposed outside stadium.c: nothing outside
- * needs to inspect quota state directly yet.
+ * into the global array"). A small table, linearly searched by vm_id -- a
+ * VMUuid (item 3.8) can't be used as a direct array index anyway, and
+ * STADIUM_MAX_VM_COUNT is small enough (default 4) that a linear scan costs
+ * nothing. Not exposed outside stadium.c: nothing outside needs to inspect
+ * quota state directly yet. Slot emptiness is tracked by an internal
+ * `in_use` flag, not a vm_id sentinel value -- there is no unused vm_id bit
+ * pattern to reserve for it.
  */
 
-/* Sentinel meaning "no VM owns this slot yet." Distinct from a real vm_id
- * (capsule_birth.c reserves 0 for Hera, so 0 cannot double as "unused" here
- * either -- same shape of mistake STADIUM_CONTAINS_NONE was fixed for). */
-#define STADIUM_QUOTA_SLOT_EMPTY ((uint32_t)-1)
-
 /*
  * stadium_admit - Place a candidate patron header into the Stadium, scoped
  * to vm_id's quota (FABRIC.md §19.3, §22.3, item 3.7).
@@ -301,9 +298,9 @@ int stadium_evict(size_t cell_index);
  * -- the item-3.6 rule that patron zero (Hera) must never actually be
  * selected is a separate, later check at the eviction site.
  *
- * REFUSES if vm_id has no quota granted (only Hera, vm_id 0, has one today
- * -- granted the entire array at stadium_boot_init(), since she is the only
- * VM that exists per item 0.1). Granting quota to additional VMs, and
+ * REFUSES if vm_id has no quota granted (only Hera, vm_uuid_hera(), has one
+ * today -- granted the entire array at stadium_boot_init(), since she is the
+ * only VM that exists per item 0.1). Granting quota to additional VMs, and
  * transferring capacity between them, is capacity ARBITRATION -- item 1.3
  * left "how much capacity moves per eligible transfer" explicitly open, so
  * this item does not invent it. Only the boot-time all-to-Hera grant exists.
@@ -336,7 +333,7 @@ int stadium_evict(size_t cell_index);
  *         quota full and candidate not denser than its least-dense
  *         evictable resident, or it has no evictable resident at all).
  */
-size_t stadium_admit(uint32_t vm_id, const StadiumPatronHeader *candidate);
+size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate);
 
 #endif /* __STARKERNEL__ */
 

include/starkernel/vm_uuid.h

@@ -0,0 +1,101 @@
+/*
+  StarForth — Steady-State Virtual Machine Runtime
+
+  Copyright (c) 2023–2025 Robert A. James
+  All rights reserved.
+
+  This file is part of the StarForth project.
+
+  Licensed under the StarForth License, Version 1.0 (the "License");
+  you may not use this file except in compliance with the License.
+
+  You may obtain a copy of the License at:
+      https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
+
+  This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  express or implied, including but not limited to the warranties of
+  merchantability, fitness for a particular purpose, and noninfringement.
+
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ */
+
+/**
+ * vm_uuid.h - 128-bit VM identifiers (FABRIC.md punch list item 3.8)
+ *
+ * Replaces capsule_birth.c's monotonic uint32_t vm_id with a wider,
+ * RFC-4122-shaped identifier. NOT real randomness: this kernel has no RNG
+ * source at all (checked directly against QEMU 10.2.1's actual CPU feature
+ * set -- amd64 RDRAND and riscv64 Zkr are both available, aarch64 has
+ * neither RNDR nor any RNG property on any CPU model including "max"), and
+ * Captain Bob ruled a uniform fallback across all three ISAs rather than a
+ * per-architecture split. Values are generated by a deterministic PRNG
+ * (splitmix64) seeded from the Mama capsule's content hash -- the same
+ * capsule booted twice produces the same ID sequence, preserving the
+ * run-to-run reproducibility this project has relied on everywhere else
+ * (the dict_hash regression check after every prior item this session).
+ */
+
+#ifndef STARKERNEL_VM_UUID_H
+#define STARKERNEL_VM_UUID_H
+
+#ifdef __STARKERNEL__
+
+#include <stdint.h>
+
+typedef struct {
+    uint64_t hi;
+    uint64_t lo;
+} VMUuid;
+
+/*
+ * vm_uuid_hera - The fixed, reserved identifier for Hera (patron zero,
+ * item 3.6; VM 0 in the pre-item-3.8 scheme). Not drawn from the pool --
+ * capsule_birth.c's KILL logic ("Hera cannot be killed") and the fleet
+ * heat-fanout parent-chain sentinel (capsule_run.h's `parent_vm_id`
+ * comment: "self-referential, parent_vm_id == vm_id == 0") both depend on
+ * Hera's id being a fixed, cheaply-comparable value, exactly as 0 was
+ * before this item. All-zero.
+ */
+VMUuid vm_uuid_hera(void);
+int    vm_uuid_is_hera(VMUuid id);
+
+/*
+ * vm_uuid_none - Sentinel meaning "no id" / "slot not in use." All-ones --
+ * NOT all-zero, because all-zero is Hera's reserved value (item 3.8 caught
+ * this collision before writing any code that could have repeated the
+ * STADIUM_CONTAINS_NONE mistake at a new site).
+ */
+VMUuid vm_uuid_none(void);
+int    vm_uuid_is_none(VMUuid id);
+
+int vm_uuid_equal(VMUuid a, VMUuid b);
+
+/*
+ * vm_uuid_pool_init - Seed the generator. Call once, after the Mama
+ * capsule's content hash is known (right after capsule_birth_mama()
+ * succeeds) and before the first non-Hera VM birth. Idempotent to call
+ * again (re-seeds and refills), though nothing does today.
+ */
+void vm_uuid_pool_init(uint64_t seed);
+
+/*
+ * vm_uuid_next - Pop the next id from the pre-filled FIFO pool, refilling
+ * with a fresh batch (continuing the same deterministic splitmix64 stream)
+ * when empty. If called before vm_uuid_pool_init() (not the intended path),
+ * self-seeds from a fixed default rather than returning garbage -- flagged
+ * as a safety net, not normal use.
+ */
+VMUuid vm_uuid_next(void);
+
+/*
+ * vm_uuid_format - Writes the RFC-4122-shaped string
+ * "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" (36 chars + NUL) into buf.
+ * @param buf  Caller-provided buffer, at least 37 bytes.
+ */
+void vm_uuid_format(VMUuid id, char *buf);
+
+#endif /* __STARKERNEL__ */
+
+#endif /* STARKERNEL_VM_UUID_H */