starkernel: item 3.8 -- VM identifiers as UUID/GUID

Punch list §25 item 3.8 complete. Added after starting item 4.1
surfaced the need to thread a vm_id into stadium_admit()'s new quota
parameter; Captain Bob ruled UUID/GUID rather than keeping the
narrower uint32_t.

New VMUuid type (vm_uuid.h/vm_uuid.c): two uint64_t halves, RFC-4122-
shaped for logging. Not real randomness -- checked directly against
QEMU 10.2.1's actual CPU feature set: amd64 RDRAND and riscv64 Zkr are
both real, available features here; aarch64 has no RNG property on any
CPU model including "max" (verified exhaustively via QMP
query-cpu-model-expansion). Captain Bob ruled a uniform fallback
across all three ISAs rather than a per-architecture split.

Fallback is a deterministic PRNG (splitmix64) seeded from the Mama
capsule's content hash, pre-filling a 16-entry FIFO pool at boot and
refilling with another batch of the same stream when exhausted --
exactly the shape requested. Same capsule booted twice produces the
same id sequence, preserving the dict_hash reproducibility this
session has relied on throughout.

Hera keeps a fixed, reserved all-zero id, not drawn from the pool --
capsule_birth.c uses vm_id == 0 as a load-bearing sentinel in three
places (KILL protection x2, fleet heat-fanout parent-chain
terminator), found by reading before writing any code.

Two real sentinel-collision bugs caught before shipping, same class as
STADIUM_CONTAINS_NONE: vm_uuid_none() (all-ones, not all-zero) for
"not yet assigned"/"no VM" placeholders; confirmed item 3.7's quota
table already used an in_use boolean rather than a vm_id sentinel, so
no second collision was actually possible there -- the dead,
never-referenced STADIUM_QUOTA_SLOT_EMPTY macro was removed.

Blast radius larger than first scoped, flagged mid-work rather than
silently absorbed: capsule_vm_physics.c/.h (the fleet heat-transfer
layer item 2.1 modified earlier this session) has its own vm_id-keyed
node table and walks parent_vm_id chains through the same identity
space, so it needed the same change, plus its callers in
mama_forth_words.c and sk_vm_bootstrap.c.

One live FORTH word contract changed, by explicit ruling: CAPSULE-BIRTH
was ( capsule-id -- vm-id ), a single cell -- can't hold 128 bits.
Captain Bob picked pushing two cells ("there is doubles support in the
FORTH std word set anyway"): ( capsule-id -- vm-id-hi vm-id-lo ).
MAMA-VM-ID changed the same way: ( -- 0 0 ).

Verified: full (not standalone-file) kernel rebuild to catch cross-file
breakage given the size of this change -- it surfaced the
capsule_vm_physics.c blast radius a narrower check would have missed.
Three-architecture boot (amd64, aarch64, riscv64), all reaching ok>
with identical dict_hash=0x3d4e1daf289da94f matching the item-3.7
baseline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/starkernel/capsule/capsule_birth.c

@@ -64,7 +64,9 @@ typedef struct vm_node {
 
 static vm_node_t *vm_registry_head  = (void *)0;
 static uint32_t   vm_registry_count = 0;
-static uint32_t   next_vm_id        = 1;  /* VM 0 reserved for Mama */
+/* item 3.8: vm_id generation moved to vm_uuid_next()'s deterministic pool;
+ * the monotonic next_vm_id counter this replaced is gone. Hera's id is
+ * vm_uuid_hera() (fixed, reserved), not drawn from the pool. */
 
 /* Copy at most VM_NAME_MAX-1 chars, always null-terminate */
 static void vm_name_copy(char *dst, const char *src) {
@@ -84,10 +86,10 @@ static int vm_name_eq(const char *a, const char *b) {
 }
 
 /* Internal: return mutable pointer into registry node for vm_id */
-static VMRegistryEntry *vm_find_entry_ptr(uint32_t vm_id) {
+static VMRegistryEntry *vm_find_entry_ptr(VMUuid vm_id) {
     vm_node_t *node = vm_registry_head;
     while (node) {
-        if (node->entry.vm_id == vm_id) return &node->entry;
+        if (vm_uuid_equal(node->entry.vm_id, vm_id)) return &node->entry;
         node = node->next;
     }
     return (void *)0;
@@ -109,19 +111,18 @@ void capsule_vm_registry_init(void *mama_vm_ptr) {
 
     vm_registry_head  = (void *)0;
     vm_registry_count = 0;
-    next_vm_id        = 1;
 
-    /* Mama is always VM 0 */
+    /* Mama is always the reserved, fixed vm_uuid_hera() id (item 3.8) */
     mama = (vm_node_t *)kmalloc(sizeof(vm_node_t));
     if (!mama) return;
 
-    mama->entry.vm_id              = 0;
+    mama->entry.vm_id              = vm_uuid_hera();
     mama->entry.state              = VM_STATE_LIVE;
     mama->entry.birth_capsule_id   = 0;
     mama->entry.birth_timestamp_ns = 0;
     mama->entry.birth_dict_hash    = 0;
     mama->entry.flags              = 0;
-    mama->entry.parent_vm_id       = 0;  /* self-referential: Hera is the root */
+    mama->entry.parent_vm_id       = vm_uuid_hera();  /* self-referential: Hera is the root */
     mama->entry.vm_ptr             = mama_vm_ptr;
     for (i = 0; i < VM_NAME_MAX; i++) mama->entry.name[i] = '\0';
     vm_name_copy(mama->entry.name, "Hera");
@@ -142,15 +143,20 @@ static VMRegistryEntry *vm_registry_alloc(void) {
     node = (vm_node_t *)kmalloc(sizeof(vm_node_t));
     if (!node) return (void *)0;
 
-    node->entry.vm_id              = 0;
+    node->entry.vm_id              = vm_uuid_none();  /* not yet assigned -- NOT
+                                                        * vm_uuid_hera(): a
+                                                        * newly-allocated embryo
+                                                        * is never Hera (item
+                                                        * 3.8 caught this exact
+                                                        * collision class again) */
     node->entry.state              = VM_STATE_EMBRYO;
     node->entry.birth_capsule_id   = 0;
     node->entry.birth_timestamp_ns = 0;
     node->entry.birth_dict_hash    = 0;
     node->entry.flags              = 0;
-    node->entry.parent_vm_id       = 0;  /* only Hera calls BIRTH today; see
-                                          * design doc's "explicitly out of
-                                          * scope" for making this dynamic */
+    node->entry.parent_vm_id       = vm_uuid_hera();  /* only Hera calls BIRTH
+                                          * today; see design doc's "explicitly
+                                          * out of scope" for making this dynamic */
     node->entry.vm_ptr             = (void *)0;
     for (i = 0; i < VM_NAME_MAX; i++) node->entry.name[i] = '\0';
     node->next = (void *)0;
@@ -168,7 +174,7 @@ static VMRegistryEntry *vm_registry_alloc(void) {
     return &node->entry;
 }
 
-int capsule_vm_registry_get(uint32_t vm_id, VMRegistryEntry *out) {
+int capsule_vm_registry_get(VMUuid vm_id, VMRegistryEntry *out) {
     VMRegistryEntry *entry;
     if (!out) return -1;
     entry = vm_find_entry_ptr(vm_id);
@@ -242,12 +248,12 @@ int capsule_vm_find_by_name_nocase(const char *name, VMRegistryEntry *out) {
     return -1;
 }
 
-void capsule_vm_set_state(uint32_t vm_id, uint32_t state) {
+void capsule_vm_set_state(VMUuid vm_id, uint32_t state) {
     VMRegistryEntry *entry = vm_find_entry_ptr(vm_id);
     if (entry) entry->state = state;
 }
 
-void capsule_vm_registry_set_name(uint32_t vm_id, const char *name) {
+void capsule_vm_registry_set_name(VMUuid vm_id, const char *name) {
     VMRegistryEntry *entry;
     if (!name) return;
     entry = vm_find_entry_ptr(vm_id);
@@ -277,7 +283,7 @@ static void dispatch_init_forth(void *vm_ctx) {
 int capsule_vm_kill(const char *name) {
     VMRegistryEntry *entry;
     VM              *vm;
-    uint32_t         vm_id;
+    VMUuid           vm_id;
     uint32_t         i;
 
     if (!name) return -1;
@@ -303,7 +309,7 @@ int capsule_vm_kill(const char *name) {
     }
 
     /* Hera cannot be killed */
-    if (entry->vm_id == 0) {
+    if (vm_uuid_is_hera(entry->vm_id)) {
         console_println("KILL: cannot kill Hera");
         return -1;
     }
@@ -341,11 +347,11 @@ int capsule_vm_kill(const char *name) {
 void capsule_vm_kill_all_nonmama(void) {
     vm_node_t *node;
     VM        *vm;
-    uint32_t   vm_id;
+    VMUuid     vm_id;
 
     node = vm_registry_head;
     while (node) {
-        if (node->entry.vm_id == 0 || node->entry.state == VM_STATE_DEAD) {
+        if (vm_uuid_is_hera(node->entry.vm_id) || node->entry.state == VM_STATE_DEAD) {
             node = node->next;
             continue;
         }
@@ -402,13 +408,18 @@ CapsuleRunResult capsule_birth_mama(
         post_dict_hash);
 
     {
-        VMRegistryEntry *mama_entry = vm_find_entry_ptr(0);
+        VMRegistryEntry *mama_entry = vm_find_entry_ptr(vm_uuid_hera());
         if (mama_entry) {
             mama_entry->birth_capsule_id = mama_cap->capsule_id;
             mama_entry->birth_dict_hash  = post_dict_hash;
         }
     }
 
+    /* item 3.8: seed the vm_uuid pool now that the Mama capsule's content
+     * hash is known -- before any baby birth (none happens today, item 0.1),
+     * so the same capsule booted twice produces the same id sequence. */
+    vm_uuid_pool_init(mama_cap->content_hash);
+
     return CAPSULE_RUN_OK;
 }
 
@@ -422,7 +433,7 @@ CapsuleRunResult capsule_birth_baby(
     const CapsuleDesc      *descs,
     const CapsuleNameEntry *names,
     const uint8_t          *arena,
-    uint32_t               *out_vm_id,
+    VMUuid                 *out_vm_id,
     void                  **out_vm_ctx)
 {
     if (!capsule_name || !dir || !descs || !names || !arena)
@@ -440,7 +451,7 @@ CapsuleRunResult capsule_birth_baby(
     if (vr != CAPSULE_VALID) return CAPSULE_RUN_ERR_INVALID;
 
     if (vm_registry_live_count() >= STADIUM_MAX_VM_COUNT) {
-        capsule_parity_log_birth_failed(0, cap->capsule_id,
+        capsule_parity_log_birth_failed(vm_uuid_none(), cap->capsule_id,
             CAPSULE_RUN_ERR_FLEET_FULL, 0);
         return CAPSULE_RUN_ERR_FLEET_FULL;
     }
@@ -448,7 +459,7 @@ CapsuleRunResult capsule_birth_baby(
     VMRegistryEntry *entry = vm_registry_alloc();
     if (!entry) return CAPSULE_RUN_ERR_INVALID;
 
-    uint32_t vm_id = next_vm_id++;
+    VMUuid vm_id = vm_uuid_next();
     entry->vm_id            = vm_id;
     entry->state            = VM_STATE_EMBRYO;
     entry->birth_capsule_id = cap->capsule_id;
@@ -533,7 +544,7 @@ CapsuleRunResult capsule_run_experiment(
 
     CapsuleRunRecord record;
     record.run_id         = 0;
-    record.vm_id          = 0;
+    record.vm_id          = vm_uuid_hera();  /* experiments run on Mama's own VM */
     record.reserved       = 0;
     record.capsule_id     = cap->capsule_id;
     record.capsule_hash   = cap->content_hash;
@@ -546,7 +557,7 @@ CapsuleRunResult capsule_run_experiment(
 
     uint64_t run_id = capsule_run_log_record(&record);
 
-    capsule_parity_log_run(0, run_id, cap->capsule_id, pre_dict_hash, post_dict_hash);
+    capsule_parity_log_run(vm_uuid_hera(), run_id, cap->capsule_id, pre_dict_hash, post_dict_hash);
 
     if (out_run_id) *out_run_id = run_id;
 

src/starkernel/capsule/capsule_run.c

@@ -67,7 +67,7 @@ void capsule_run_log_init(void) {
     /* Zero the ring buffer */
     for (uint32_t i = 0; i < CAPSULE_MAX_RUN_RECORDS; i++) {
         run_log[i].run_id = 0;
-        run_log[i].vm_id = 0;
+        run_log[i].vm_id = vm_uuid_none(); /* not {0,0} -- that's Hera's reserved id (item 3.8) */
         run_log[i].reserved = 0;
         run_log[i].capsule_id = 0;
         run_log[i].capsule_hash = 0;
@@ -158,6 +158,14 @@ static void parity_put_hex64(uint64_t val) {
     PARITY_EMIT(buf);
 }
 
+/* item 3.8: VMUuid printed as its two hex64 halves, hyphen-separated --
+ * reuses parity_put_hex64 rather than a new hex-formatting routine. */
+static void parity_put_uuid(VMUuid id) {
+    parity_put_hex64(id.hi);
+    PARITY_EMIT("-");
+    parity_put_hex64(id.lo);
+}
+
 static void parity_put_u32(uint32_t val) {
     char buf[12];
     int i = 11;
@@ -189,7 +197,7 @@ static void parity_put_u64(uint64_t val) {
 }
 
 void capsule_parity_log_birth(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t capsule_id,
     uint64_t capsule_hash,
     uint64_t dict_hash)
@@ -197,7 +205,7 @@ void capsule_parity_log_birth(
     if (!PARITY_HAVE_SINK) return;
 
     PARITY_EMIT("PARITY:BIRTH vm_id=");
-    parity_put_u32(vm_id);
+    parity_put_uuid(vm_id);
     PARITY_EMIT(" capsule_id=");
     parity_put_hex64(capsule_id);
     PARITY_EMIT(" mode=p capsule_hash=");
@@ -208,7 +216,7 @@ void capsule_parity_log_birth(
 }
 
 void capsule_parity_log_birth_failed(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t capsule_id,
     CapsuleRunResult error,
     uint64_t partial_dict_hash)
@@ -216,7 +224,7 @@ void capsule_parity_log_birth_failed(
     if (!PARITY_HAVE_SINK) return;
 
     PARITY_EMIT("PARITY:BIRTH_FAILED vm_id=");
-    parity_put_u32(vm_id);
+    parity_put_uuid(vm_id);
     PARITY_EMIT(" capsule_id=");
     parity_put_hex64(capsule_id);
     PARITY_EMIT(" error=");
@@ -227,7 +235,7 @@ void capsule_parity_log_birth_failed(
 }
 
 void capsule_parity_log_run(
-    uint32_t vm_id,
+    VMUuid vm_id,
     uint64_t run_id,
     uint64_t capsule_id,
     uint64_t pre_dict_hash,
@@ -236,7 +244,7 @@ void capsule_parity_log_run(
     if (!PARITY_HAVE_SINK) return;
 
     PARITY_EMIT("PARITY:RUN vm_id=");
-    parity_put_u32(vm_id);
+    parity_put_uuid(vm_id);
     PARITY_EMIT(" run_id=");
     parity_put_u64(run_id);
     PARITY_EMIT(" capsule_id=");
@@ -268,12 +276,12 @@ void capsule_parity_log_mama_init(
     PARITY_EMIT("\n");
 }
 
-void capsule_parity_log_kill(uint32_t vm_id, const char *name)
+void capsule_parity_log_kill(VMUuid vm_id, const char *name)
 {
     if (!PARITY_HAVE_SINK) return;
 
     PARITY_EMIT("PARITY:KILL vm_id=");
-    parity_put_u32(vm_id);
+    parity_put_uuid(vm_id);
     PARITY_EMIT(" name=");
     if (name) PARITY_EMIT(name);
     PARITY_EMIT("\n");

src/starkernel/capsule/capsule_vm_physics.c

@@ -66,7 +66,7 @@ typedef struct {
 } VMPhysics;
 
 typedef struct vm_physics_node {
-    uint32_t                vm_id;
+    VMUuid                   vm_id;
     VMPhysics                physics;
     struct vm_physics_node  *next;
 } vm_physics_node_t;
@@ -157,11 +157,11 @@ static uint64_t slope_fit_quality_q48    = 0;
 static uint64_t fleet_heartbeat_tick_count  = 0;
 static uint64_t fleet_last_inference_tick   = 0;
 
-static vm_physics_node_t *vm_physics_find(uint32_t vm_id)
+static vm_physics_node_t *vm_physics_find(VMUuid vm_id)
 {
     vm_physics_node_t *n = vm_physics_head;
     while (n) {
-        if (n->vm_id == vm_id) return n;
+        if (vm_uuid_equal(n->vm_id, vm_id)) return n;
         n = n->next;
     }
     return (void *)0;
@@ -182,10 +182,10 @@ static void vm_physics_transfer(VMPhysics *from, VMPhysics *to, uint64_t amount_
     to->execution_heat_q48   += moved;
 }
 
-void vm_physics_init(uint32_t vm_id)
+void vm_physics_init(VMUuid vm_id)
 {
     vm_physics_node_t *node = vm_physics_find(vm_id);
-    /* Hera (vm_id 0) is the fleet's single structural root -- the one
+    /* Hera (vm_uuid_hera()) is the fleet's single structural root -- the one
      * entry capsule_vm_kill refuses to ever kill, and the same fixed
      * point vm_physics_find_root_id below walks every parent chain up
      * to. She is where the fleet's whole Q48_ONE initially resides;
@@ -193,7 +193,7 @@ void vm_physics_init(uint32_t vm_id)
      * per the "cold mass added to a closed system" reasoning -- which
      * requires a nonzero sum to already exist, so Hera's own
      * registration is where that sum is seeded. */
-    int is_root = (vm_id == 0);
+    int is_root = vm_uuid_is_hera(vm_id);
 
     if (node) {
         node->physics.execution_heat_q48 = is_root ? Q48_ONE : 0;
@@ -222,39 +222,39 @@ void vm_physics_init(uint32_t vm_id)
  * at its own birth and never rewritten -- including a dead VM's, so the
  * walk continues correctly through an already-killed intermediate
  * parent without any special dead-parent handling. Hera's own entry is
- * self-referential (parent_vm_id == vm_id == 0), which is what stops
- * the walk: she is the only node with no outbound edge.
+ * self-referential (parent_vm_id == vm_id == vm_uuid_hera()), which is
+ * what stops the walk: she is the only node with no outbound edge.
  *
  * The 64-hop guard is defensive only -- a well-formed chain terminates
  * in O(fleet depth) hops, nowhere near 64. It exists so a corrupted
  * chain (which should never happen) returns the starting vm_id instead
  * of spinning.
  */
-static uint32_t vm_physics_find_root_id(uint32_t vm_id)
+static VMUuid vm_physics_find_root_id(VMUuid vm_id)
 {
-    uint32_t cursor = vm_id;
+    VMUuid   cursor = vm_id;
     uint32_t guard;
 
     for (guard = 0; guard < 64; guard++) {
         VMRegistryEntry entry;
 
         if (capsule_vm_registry_get(cursor, &entry) != 0) break;
-        if (entry.parent_vm_id == cursor) break; /* self-referential: root */
+        if (vm_uuid_equal(entry.parent_vm_id, cursor)) break; /* self-referential: root */
         cursor = entry.parent_vm_id;
     }
     return cursor;
 }
 
-void vm_physics_retire(uint32_t vm_id)
+void vm_physics_retire(VMUuid vm_id)
 {
     vm_physics_node_t *dying = vm_physics_find(vm_id);
     vm_physics_node_t *root;
-    uint32_t           root_id;
+    VMUuid              root_id;
 
     if (!dying || !dying->physics.is_live) return;
 
     root_id = vm_physics_find_root_id(vm_id);
-    root    = (root_id != vm_id) ? vm_physics_find(root_id) : (void *)0;
+    root    = !vm_uuid_equal(root_id, vm_id) ? vm_physics_find(root_id) : (void *)0;
 
     if (root) {
         /* The dying VM's entire remaining heat flows to the root it
@@ -278,7 +278,7 @@ void vm_physics_retire(uint32_t vm_id)
     dying->physics.is_live             = 0;
 }
 
-void vm_physics_touch(uint32_t vm_id)
+void vm_physics_touch(VMUuid vm_id)
 {
     vm_physics_node_t  *target   = vm_physics_find(vm_id);
     VMFleetTouchSample  sample   = { 0, 0, 0 };
@@ -483,7 +483,7 @@ int vm_physics_conserved(void)
     return diff < VM_PHYSICS_EPSILON_Q48;
 }
 
-uint64_t vm_physics_heat_of(uint32_t vm_id)
+uint64_t vm_physics_heat_of(VMUuid vm_id)
 {
     vm_physics_node_t *n = vm_physics_find(vm_id);
     if (!n || !n->physics.is_live) return 0;
@@ -541,7 +541,11 @@ void vm_physics_status(void)
             if (!n->physics.is_live) continue;
 
             console_puts("VM-PHYSICS:   vm_id=");
-            console_put_u64(n->vm_id);
+            {
+                char uuid_buf[37];
+                vm_uuid_format(n->vm_id, uuid_buf);
+                console_puts(uuid_buf);
+            }
 
             if (capsule_vm_registry_get(n->vm_id, &entry) == 0) {
                 console_puts(" name=");

src/starkernel/capsule/mama_forth_words.c

@@ -224,7 +224,7 @@ void mama_word_birth(VM *vm)
     const char     *src;
     char            lower[VM_NAME_MAX];
     CapsuleRunResult result;
-    uint32_t        new_vm_id;
+    VMUuid          new_vm_id;
 
     if (vm->dsp < 1) {
         vm->error = 1;
@@ -277,7 +277,7 @@ void mama_word_birth(VM *vm)
     { const char *suf = "init.4th"; for (i = 0; suf[i]; i++) capsule_name[j++] = suf[i]; }
     capsule_name[j] = '\0';
 
-    new_vm_id = 0;
+    new_vm_id = vm_uuid_none();
 
     /* Switch console prefix to the baby's name so its init capsule output
      * appears tagged [Hermes] / [Artemis] rather than [Hera]. */
@@ -468,8 +468,8 @@ void mama_word_use(VM *vm)
         return;
     }
 
-    /* vm_id 0 = Hera — restore default dispatch (NULL = use REPL's own vm) */
-    if (entry.vm_id == 0) {
+    /* Hera — restore default dispatch (NULL = use REPL's own vm) */
+    if (vm_uuid_is_hera(entry.vm_id)) {
         sk_repl_set_active_vm((void *)0);
     } else {
         sk_repl_set_active_vm((VM *)entry.vm_ptr);
@@ -763,9 +763,11 @@ static void mama_word_vm_call(VM *vm)
 }
 
 /**
- * @brief CAPSULE-BIRTH ( capsule-id -- vm-id )
+ * @brief CAPSULE-BIRTH ( capsule-id -- vm-id-hi vm-id-lo )
  * Birth a baby VM from a production (p) capsule.
- * Returns the new VM's ID, or -1 on failure.
+ * Returns the new VM's 128-bit ID as a double (item 3.8 -- FORTH already
+ * has double-cell words for exactly this), high cell on top, or
+ * vm_uuid_none()'s hi/lo (both all-ones) on failure.
  */
 void mama_word_capsule_birth(VM *vm)
 {
@@ -775,10 +777,11 @@ void mama_word_capsule_birth(VM *vm)
     }
 
     cell_t capsule_idx = vm_pop(vm);
-    uint32_t new_vm_id = 0;
+    VMUuid new_vm_id = vm_uuid_none();
 
     if ((uint64_t)capsule_idx >= capsule_get_desc_count()) {
-        vm_push(vm, (cell_t)-1);
+        vm_push(vm, (cell_t)new_vm_id.lo);
+        vm_push(vm, (cell_t)new_vm_id.hi);
         return;
     }
     const char *cap_name = capsule_get_names()[(uint32_t)capsule_idx].name;
@@ -793,11 +796,11 @@ void mama_word_capsule_birth(VM *vm)
         (void **)0  /* Don't need VM context back */
     );
 
-    if (result == CAPSULE_RUN_OK) {
-        vm_push(vm, (cell_t)new_vm_id);
-    } else {
-        vm_push(vm, (cell_t)-1);  /* Birth failed */
+    if (result != CAPSULE_RUN_OK) {
+        new_vm_id = vm_uuid_none();  /* Birth failed */
     }
+    vm_push(vm, (cell_t)new_vm_id.lo);
+    vm_push(vm, (cell_t)new_vm_id.hi);
 }
 
 /**
@@ -836,12 +839,14 @@ void mama_word_capsule_run(VM *vm)
  * ============================================================================ */
 
 /**
- * @brief MAMA-VM-ID ( -- 0 )
- * Push Mama's VM ID (always 0).
+ * @brief MAMA-VM-ID ( -- 0 0 )
+ * Push Mama's VM ID as a double (item 3.8): vm_uuid_hera() is all-zero,
+ * so both cells are 0. High cell on top, matching CAPSULE-BIRTH.
  */
 void mama_word_mama_vm_id(VM *vm)
 {
     vm_push(vm, 0);
+    vm_push(vm, 0);
 }
 
 /**
@@ -969,7 +974,7 @@ static void mama_word_connect_artemis(VM *vm __attribute__((unused)))
     if (capsule_vm_find_by_name_nocase("Artemis", &entry) != 0 ||
         entry.state == VM_STATE_DEAD ||
         entry.state == VM_STATE_STILLBORN) {
-        uint32_t new_vm_id = 0;
+        VMUuid new_vm_id = vm_uuid_none();
         const char *saved = console_get_vm_name();
         CapsuleRunResult r;
 
@@ -1040,7 +1045,7 @@ static void mama_word_connect_hermes(VM *vm __attribute__((unused)))
     if (capsule_vm_find_by_name_nocase("Hermes", &entry) != 0 ||
         entry.state == VM_STATE_DEAD ||
         entry.state == VM_STATE_STILLBORN) {
-        uint32_t new_vm_id = 0;
+        VMUuid new_vm_id = vm_uuid_none();
         const char *saved = console_get_vm_name();
         CapsuleRunResult r;
 

src/starkernel/capsule/vm_uuid.c

@@ -0,0 +1,137 @@
+/*
+  StarForth — Steady-State Virtual Machine Runtime
+
+  Copyright (c) 2023–2025 Robert A. James
+  All rights reserved.
+
+  This file is part of the StarForth project.
+
+  Licensed under the StarForth License, Version 1.0 (the "License");
+  you may not use this file except in compliance with the License.
+
+  You may obtain a copy of the License at:
+      https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
+
+  This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  express or implied, including but not limited to the warranties of
+  merchantability, fitness for a particular purpose, and noninfringement.
+
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ */
+
+/**
+ * vm_uuid.c - 128-bit VM identifiers (FABRIC.md punch list item 3.8)
+ *
+ * See vm_uuid.h for the design rationale (no RNG source exists on any of
+ * the three ISAs uniformly, so this is deterministic, not random).
+ */
+
+#include "starkernel/vm_uuid.h"
+
+#ifdef __STARKERNEL__
+
+#include <stddef.h>
+
+#define VM_UUID_POOL_SIZE 16
+
+static uint64_t vm_uuid_prng_state  = 0;
+static int      vm_uuid_seeded      = 0;
+static VMUuid   vm_uuid_pool[VM_UUID_POOL_SIZE];
+static size_t   vm_uuid_pool_pos    = VM_UUID_POOL_SIZE; /* "empty": first next() call refills */
+
+VMUuid vm_uuid_hera(void) {
+    VMUuid id;
+    id.hi = 0;
+    id.lo = 0;
+    return id;
+}
+
+int vm_uuid_is_hera(VMUuid id) {
+    return id.hi == 0 && id.lo == 0;
+}
+
+VMUuid vm_uuid_none(void) {
+    VMUuid id;
+    id.hi = 0xFFFFFFFFFFFFFFFFULL;
+    id.lo = 0xFFFFFFFFFFFFFFFFULL;
+    return id;
+}
+
+int vm_uuid_is_none(VMUuid id) {
+    return id.hi == 0xFFFFFFFFFFFFFFFFULL && id.lo == 0xFFFFFFFFFFFFFFFFULL;
+}
+
+int vm_uuid_equal(VMUuid a, VMUuid b) {
+    return a.hi == b.hi && a.lo == b.lo;
+}
+
+/* splitmix64 -- public-domain, well-known, minimal. Deterministic given a
+ * seed; not cryptographically random, not claimed to be. */
+static uint64_t splitmix64_next(uint64_t *state) {
+    uint64_t z = (*state += 0x9E3779B97F4A7C15ULL);
+    z = (z ^ (z >> 30)) * 0xBF58476D1CE4E5B9ULL;
+    z = (z ^ (z >> 27)) * 0x94D049BB133111EBULL;
+    return z ^ (z >> 31);
+}
+
+static void vm_uuid_pool_refill(void) {
+    size_t i;
+    for (i = 0; i < VM_UUID_POOL_SIZE; i++) {
+        uint64_t hi = splitmix64_next(&vm_uuid_prng_state);
+        uint64_t lo = splitmix64_next(&vm_uuid_prng_state);
+        /* RFC 4122 version 4 / variant bits -- cosmetic shape only, not a
+         * claim these are cryptographically random. */
+        hi = (hi & 0xFFFFFFFFFFFF0FFFULL) | 0x0000000000004000ULL;
+        lo = (lo & 0x3FFFFFFFFFFFFFFFULL) | 0x8000000000000000ULL;
+        vm_uuid_pool[i].hi = hi;
+        vm_uuid_pool[i].lo = lo;
+    }
+    vm_uuid_pool_pos = 0;
+}
+
+void vm_uuid_pool_init(uint64_t seed) {
+    vm_uuid_prng_state = seed;
+    vm_uuid_seeded = 1;
+    vm_uuid_pool_refill();
+}
+
+VMUuid vm_uuid_next(void) {
+    VMUuid id;
+
+    if (!vm_uuid_seeded) {
+        /* Safety net, not the intended path -- callers should seed from the
+         * Mama capsule's content hash before the first non-Hera VM birth. */
+        vm_uuid_pool_init(0x9E3779B97F4A7C15ULL);
+    }
+    if (vm_uuid_pool_pos >= VM_UUID_POOL_SIZE) {
+        vm_uuid_pool_refill();
+    }
+
+    id = vm_uuid_pool[vm_uuid_pool_pos];
+    vm_uuid_pool_pos++;
+    return id;
+}
+
+void vm_uuid_format(VMUuid id, char *buf) {
+    static const char hex[] = "0123456789abcdef";
+    int pos = 0;
+    int i;
+    uint64_t halves[2];
+    /* Group boundaries per RFC 4122: 8-4-4-4-12 hex digits, dashes after
+     * digit 8, 12, 16, 20 (of 32 total). hi supplies digits 0-15, lo
+     * supplies digits 16-31. */
+    halves[0] = id.hi;
+    halves[1] = id.lo;
+
+    for (i = 0; i < 32; i++) {
+        uint64_t v = (i < 16) ? halves[0] : halves[1];
+        int shift = (15 - (i % 16)) * 4;
+        buf[pos++] = hex[(v >> shift) & 0xF];
+        if (i == 7 || i == 11 || i == 15 || i == 19) buf[pos++] = '-';
+    }
+    buf[pos] = '\0';
+}
+
+#endif /* __STARKERNEL__ */

src/starkernel/vm/bootstrap/sk_vm_bootstrap.c

@@ -271,7 +271,7 @@ int sk_vm_bootstrap_parity(ParityPacket *out) {
      * capsule_birth_baby() which never calls vm_init_with_host(). */
     capsule_vm_hooks_register();
     capsule_vm_registry_init(vm);  /* establishes [Hera] console prefix */
-    vm_physics_init(0);            /* Hera: the fleet's root, seeded Q48_ONE */
+    vm_physics_init(vm_uuid_hera()); /* Hera: the fleet's root, seeded Q48_ONE */
     capsule_run_log_init();
     register_mama_forth_words(vm); /* BIRTH KILL START STOP USE + capsule words */
 #if SK_PARITY_DEBUG

src/starkernel/vm/stadium.c

@@ -68,7 +68,7 @@ static size_t link_to_size(uint32_t v) {
  * rather than direct indexing.
  */
 typedef struct {
-    uint32_t vm_id;
+    VMUuid   vm_id;
     int      in_use;
     size_t   free_head;
 } StadiumVMQuota;
@@ -76,10 +76,10 @@ typedef struct {
 static StadiumVMQuota stadium_quotas[STADIUM_MAX_VM_COUNT];
 
 /* Returns the quota slot index for vm_id, or -1 if none is granted. */
-static int quota_slot_for_vm(uint32_t vm_id) {
+static int quota_slot_for_vm(VMUuid vm_id) {
     int i;
     for (i = 0; i < STADIUM_MAX_VM_COUNT; i++) {
-        if (stadium_quotas[i].in_use && stadium_quotas[i].vm_id == vm_id) return i;
+        if (stadium_quotas[i].in_use && vm_uuid_equal(stadium_quotas[i].vm_id, vm_id)) return i;
     }
     return -1;
 }
@@ -149,12 +149,12 @@ int stadium_boot_init(void) {
     {
         int i;
         for (i = 0; i < STADIUM_MAX_VM_COUNT; i++) {
-            stadium_quotas[i].vm_id     = 0;
+            stadium_quotas[i].vm_id     = vm_uuid_none();
             stadium_quotas[i].in_use    = 0;
             stadium_quotas[i].free_head = STADIUM_CELL_NONE;
         }
     }
-    stadium_quotas[0].vm_id     = 0;
+    stadium_quotas[0].vm_id     = vm_uuid_hera();
     stadium_quotas[0].in_use    = 1;
     stadium_quotas[0].free_head = 0;
 
@@ -309,7 +309,7 @@ int stadium_evict(size_t cell_index) {
  * contains-gated residents are skipped, never eviction candidates) and
  * evicting it only if the candidate is strictly denser.
  */
-size_t stadium_admit(uint32_t vm_id, const StadiumPatronHeader *candidate) {
+size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate) {
     int      slot;
     size_t   i;
     size_t   idx;