admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity

Rename FABRIC series: FABRIC.md->0, FABRIC-2.md->1, FABRIC-3.md->2, FABRIC-4.md unchanged

Browse Source 
FABRIC.md -> FABRIC-0.md
FABRIC-2.md -> FABRIC-1.md
FABRIC-3.md -> FABRIC-2.md (the current/living document)
FABRIC-4.md unchanged (new #3 to follow separately)

Every cross-reference repo-wide updated to match, including doc-comment
citations inside kernel source (.c/.h) files -- done via an ordered
placeholder substitution (FABRIC-3.md->placeholder2, FABRIC-2.md->
placeholder1, FABRIC.md->placeholder0, then placeholders resolved to
final names) in a single pass per file to avoid double-shifting
already-renamed references.

One line in capsules/font.4th grew past the 64-char block-format limit
as a side effect of the longer filename; shortened it and reverified
with mkcapsule --lint (34/34 pass) before rebuilding.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after the fix; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var
This commit is contained in:
Robert Allan James
2026-09-04 11:22:51 -04:00
co-authored by Claude Sonnet 5
parent ff2941dfb9
commit b031b802e3
128 changed files with 37154 additions and 9572 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/block_subsystem.c
+8 -8
View File
@@ -74,7 +74,7 @@
/* Single-block relocation (Milestone 2h+). One reserved 4 KiB devblock:
* a 4-byte count prefix plus up to BLK_RELOC_MAX_ENTRIES 8-byte
* {home_lbn, actual_lbn} pairs (500*8+4 = 4004 <= 4096). Relocations are
* expected rare, not routine -- see FABRIC-2.md's own design writeup --
* expected rare, not routine -- see FABRIC-1.md's own design writeup --
* so a linear-scanned fixed array is deliberate, matching this file's
* existing tolerance for small bounded scans (DISK_CACHE_SLOTS above,
* BLK_VM_SLOTS in block_words.c are the same shape). */
@@ -193,7 +193,7 @@ static struct {
/* Redirect lbn through the relocation table if it's been moved elsewhere.
* The single choke point every public LBN-consuming entry point below
* calls first -- see FABRIC-2.md's design writeup for why this is an
* calls first -- see FABRIC-1.md's design writeup for why this is an
* LBN->LBN redirect rather than a new storage-allocation mechanism, and
* why it's safe for every downstream function (BAM offset math, cache
* lookup, lbn_to_slot() itself) to stay completely unaware a substitution
@@ -706,7 +706,7 @@ int blk_subsys_attach_device(struct blkio_dev *dev) {
* device becomes the owner. A later-attached second disk-backed
* device (e.g. a USB drive attaching after Artemis's own disk) must
* NOT overwrite the already-loaded table with its own (likely empty)
* one. See FABRIC-2.md's design writeup for why "first attached wins"
* one. See FABRIC-1.md's design writeup for why "first attached wins"
* is a pragmatic default, not a general multi-primary-device answer. */
if (slot->dev && first_disk_slot() == slot) {
(void) reloc_load_from_disk(slot);
@@ -771,7 +771,7 @@ int blk_subsys_detach_device(struct blkio_dev *dev) {
return BLK_OK;
}
/* Milestone 2h+ single-block relocation -- see FABRIC-2.md's design
/* Milestone 2h+ single-block relocation -- see FABRIC-1.md's design
* writeup for the full reasoning. Mechanical primitive only: this
* function does not decide *whether* a relocation should happen (ACL's
* job) or validate that target_lbn is genuinely owned by whoever is
@@ -1136,7 +1136,7 @@ int blk_set_volume_meta(const blk_volume_meta_t *meta) {
return BLK_OK;
}
/* FABRIC-3.md §I.2, 2026-09-04: same dev-pointer slot lookup
/* FABRIC-2.md §I.2, 2026-09-04: same dev-pointer slot lookup
* blk_subsys_detach_device() already does internally, exposed publicly
* for the first time so a caller can scope a scan/query to one specific
* attached device. */
@@ -1276,7 +1276,7 @@ int blk_set_meta(uint32_t block_num, const blk_meta_t *meta) {
return BLK_OK;
}
/* BMAPFMT field accessors -- FABRIC-3.md §H.12 step 14. Thin
/* BMAPFMT field accessors -- FABRIC-2.md §H.12 step 14. Thin
* read-modify-write wrappers over blk_get_meta()/blk_set_meta() above,
* which already own caching/dirty-tracking -- these add no state of
* their own. */
@@ -1355,7 +1355,7 @@ int blk_flags_set(uint32_t block_num, uint64_t flags) {
return blk_set_meta(block_num, &meta);
}
/* FABRIC-3.md §F.11/§I.2, built 2026-09-04. is_lbn_zero() -- BLK_FLAG_
/* FABRIC-2.md §F.11/§I.2, built 2026-09-04. is_lbn_zero() -- BLK_FLAG_
* CLAIMED clear AND owner_fp all-zero is "unowned"; either alone would
* misclassify a claimed-but-not-yet-fp-stamped or fp-stamped-but-
* evicted devblock, neither of which should exist given owner_fp is
@@ -1459,7 +1459,7 @@ int blk_meta_relocate_devblock(uint32_t home_devblock, uint32_t target_devblock)
return blk_set_meta(home_devblock, &home_meta);
}
/* FABRIC-3.md §I.2, 2026-09-04: heat/wear-leveling migration trigger.
/* FABRIC-2.md §I.2, 2026-09-04: heat/wear-leveling migration trigger.
* Uses blk_meta_t.write_count -- already present, already documented
* for exactly this purpose ("Number of writes (wear leveling)"), no new
* cross-subsystem query needed (Stadium's own compudynamics block heat,
src/starkernel/arch/aarch64/apic.c
+2 -2
View File
@@ -16,7 +16,7 @@
*
* Base addresses and the PPI INTID are QEMU-virt-machine constants, not
* device-tree-discovered, and that is a deliberate, recorded exception
* rather than an oversight (FABRIC.md item 0.6, GAP-B1 follow-up):
* rather than an oversight (FABRIC-0.md item 0.6, GAP-B1 follow-up):
* `fdt_valid(boot_info->dtb)` fails on this system's aarch64 firmware
* (qemu-efi-aarch64 2025.11-3ubuntu7 does not forward a devicetree to the
* guest), confirmed live rather than assumed. The values below were not
@@ -168,7 +168,7 @@ int apic_init(BootInfo *boot_info)
* 3. @c GICD_ITARGETSR (byte-indexed like IPRIORITYR) -- routes to CPU 0
* only; this target has no @c -smp, so no other bit is ever valid.
* 4. @c GICD_ICFGR is read back, not written, unless the readback disagrees
* with the expected level-triggered configuration -- FABRIC.md §27.5.1's
* with the expected level-triggered configuration -- FABRIC-0.md §27.5.1's
* decoded QEMU `interrupt-map` says PCI legacy INTx on this board already
* is level-triggered by default, so this keeps item 0.6's "don't touch
* ICFGR unless forced to" posture rather than writing it unconditionally.
src/starkernel/arch/aarch64/arch.c
+2 -2
View File
@@ -33,7 +33,7 @@ static int s_current_el = -1;
*
* EDK2 on QEMU's aarch64 @c virt machine has been observed to leave the
* kernel at either EL1 or EL2 depending on firmware build; nothing in this
* tree may assume one over the other (FABRIC.md §25.7.1 GAP-B3). Every
* tree may assume one over the other (FABRIC-0.md §25.7.1 GAP-B3). Every
* EL-dependent choice — @c VBAR_EL1 vs @c VBAR_EL2, the @c ELR_ELx /
* @c SPSR_ELx saved-state pair, and @c CNTP_*_EL0 vs @c CNTHP_*_EL2 — must
* read this accessor rather than hardcode a level.
@@ -129,7 +129,7 @@ void arch_cold_reset(void)
* arguments and has no SMC64 variant defined by the PSCI spec -- only
* the SMC32 encoding is valid (fixed 2026-08-18, was 0xC4000009).
*
* FABRIC-2.md Section I, 2026-08-18: live gdb tracing (using the real
* FABRIC-1.md Section I, 2026-08-18: live gdb tracing (using the real
* UEFI-relocated runtime address, not the standalone kernel.elf's
* link-time address -- see that section for why those differ) proved
* the SMC call itself traps: PC does not fall through to the wfi loop
src/starkernel/arch/aarch64/timer.c
+2 -2
View File
@@ -20,7 +20,7 @@
/* ─── ARM generic-timer helpers ─────────────────────────────────────── */
/* FABRIC-3.md §I.5, 2026-09-04: real hypervisor-vs-hardware detection.
/* FABRIC-2.md §I.5, 2026-09-04: real hypervisor-vs-hardware detection.
* s_cal.vm_mode was hardcoded to 1 unconditionally below (comment:
* "QEMU SBSA always uses virtualised Generic Timer") -- true for the
* *timing policy* this file cares about, but wrong to reuse as a
@@ -260,7 +260,7 @@ const timer_calibration_record_t *timer_calibration_record(void)
/**
* @brief Read the raw counter the aarch64 heartbeat is paced against.
*
* Item 0.8 (FABRIC.md §25.1): the shared heartbeat.c now owns
* Item 0.8 (FABRIC-0.md §25.1): the shared heartbeat.c now owns
* heartbeat_init()/heartbeat_tick()/heartbeat_service()/heartbeat_ticks()/
* heartbeat_trust()/heartbeat_state() and the per-arch @c g_heartbeat
* state that used to live in this file. This is the one piece that stays
src/starkernel/arch/amd64/i8042.c
+1 -1
View File
@@ -24,7 +24,7 @@
/**
* i8042.c - PS/2 keyboard controller driver (amd64)
*
* Item 4.3.5 (FABRIC.md §27.5).
* Item 4.3.5 (FABRIC-0.md §27.5).
*/
#ifndef __STARKERNEL__
src/starkernel/arch/amd64/ioapic.c
+1 -1
View File
@@ -24,7 +24,7 @@
/**
* ioapic.c - I/O APIC driver (amd64)
*
* Item 4.3.5 (FABRIC.md §27.5). MADT parsing mirrors pci.c's RSDP -> XSDT ->
* Item 4.3.5 (FABRIC-0.md §27.5). MADT parsing mirrors pci.c's RSDP -> XSDT ->
* table-by-signature walk (the two files don't share a header for this —
* same duplication pci.c already has relative to a hypothetical shared
* acpi.c, not introduced fresh here).
src/starkernel/arch/amd64/timer.c
+3 -3
View File
@@ -134,7 +134,7 @@ static uint64_t vm_ns_base = 0;
* @p b are both large (e.g., nanosecond conversion of multi-GHz tick counts).
* No libgcc dependency — pure inline assembly.
*
* FABRIC.md item 4.5d, 2026-08-11: this asm previously declared @c RDX as a
* FABRIC-0.md item 4.5d, 2026-08-11: this asm previously declared @c RDX as a
* plain output (@c "=d"(hi)), which tells GCC only "I want to read RDX's
* value after this block" — nothing told it that @c mulq writes RDX *before*
* @c divq needs to read a *different* value (the divisor @c c) out of it.
@@ -604,7 +604,7 @@ static uint64_t calibrate_tsc_with_pmtimer(void)
uint64_t elapsed_ns = muldiv64(elapsed_ticks, 1000000000ull, PMTIMER_FREQ_HZ);
if (elapsed_ns == 0) return 0;
/* FABRIC.md item 4.5d, 2026-08-11: this file's own comments already
/* FABRIC-0.md item 4.5d, 2026-08-11: this file's own comments already
* flag TSC non-monotonicity as a real risk under TCG ("invariant
* TSC not present under hypervisor... no determinism guarantees").
* If end_tsc < start_tsc, this subtraction wraps to a huge unsigned
@@ -1378,7 +1378,7 @@ const timer_calibration_record_t *timer_calibration_record(void)
/**
* @brief Read the raw counter the amd64 heartbeat is paced against.
*
* Item 0.8 (FABRIC.md §25.1): the shared heartbeat.c owns
* Item 0.8 (FABRIC-0.md §25.1): the shared heartbeat.c owns
* heartbeat_init()/heartbeat_tick()/heartbeat_service()/heartbeat_ticks()/
* heartbeat_trust()/heartbeat_state() and the variance/trust math that used
* to live in this file. This is the one piece that stays per-architecture
src/starkernel/arch/riscv64/arch.c
+1 -1
View File
@@ -69,7 +69,7 @@ void arch_early_init(void)
* activated here, per its own load_cr3() no-op outside __x86_64__) and
* has no present use for virtual memory on this ISA, so there is no
* reason to inherit firmware's Sv57 mapping -- which is confirmed to
* have at least one hole (PLIC_THRESHOLD, FABRIC.md item 4.3.5a).
* have at least one hole (PLIC_THRESHOLD, FABRIC-0.md item 4.3.5a).
* ExitBootServices() has already completed several checkpoints before
* this function runs (ConOut/GOP done, BootServices exited per the
* "[CKPT 008]" trace), so nothing downstream depends on firmware's
src/starkernel/arch/riscv64/timer.c
+3 -3
View File
@@ -16,7 +16,7 @@
* mixing the two counters would compare unrelated clocks; and `cycle` has no
* discoverable frequency, so every heartbeat variance and TIME-TRUST figure
* riscv64 produced before this was measured against a wrong expected interval
* (FABRIC.md §16.2). Figures from before and after are not comparable.
* (FABRIC-0.md §16.2). Figures from before and after are not comparable.
*/
#include "timer.h"
@@ -27,7 +27,7 @@
#include <stdint.h>
#include <string.h>
/* FABRIC-3.md §I.5, 2026-09-04: real hypervisor-vs-hardware detection.
/* FABRIC-2.md §I.5, 2026-09-04: real hypervisor-vs-hardware detection.
* s_cal.vm_mode was hardcoded to 1 unconditionally below -- see
* aarch64/timer.c's own running_under_hypervisor() doc comment for why
* that's wrong to reuse as a general "are we in QEMU" signal elsewhere
@@ -265,7 +265,7 @@ const timer_calibration_record_t *timer_calibration_record(void)
/**
* @brief Read the raw counter the riscv64 heartbeat is paced against.
*
* Item 0.8 (FABRIC.md §25.1): the shared heartbeat.c now owns
* Item 0.8 (FABRIC-0.md §25.1): the shared heartbeat.c now owns
* heartbeat_init()/heartbeat_tick()/heartbeat_service()/heartbeat_ticks()/
* heartbeat_trust()/heartbeat_state(). This is the one piece that stays
* per-architecture -- the same @c rdtime() the timer deadline is armed
src/starkernel/capsule/capsule_birth.c
+12 -12
View File
@@ -34,8 +34,8 @@
#include "starkernel/kmalloc.h"
#include "starkernel/console.h"
#include "starkernel/vm/stadium.h" /* item 4.1a -- stadium_grant_quota() */
#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-3.md §H.12 step 5 */
#include "starkernel/timer.h" /* timer_calibration_record()->vm_mode -- FABRIC-3.md §I.5 CONTRIB trust tier */
#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-2.md §H.12 step 5 */
#include "starkernel/timer.h" /* timer_calibration_record()->vm_mode -- FABRIC-2.md §I.5 CONTRIB trust tier */
#include "vm.h"
#include "platform_alloc.h"
/* No LOG_LINE_MAX include-order constraint anymore: vm.h's own
@@ -105,7 +105,7 @@ static VMRegistryEntry *vm_find_entry_ptr(VMUuid vm_id) {
return (void *)0;
}
/* FABRIC-3.md §H.12 step 10: creator-ceiling enforcement, birth-time
/* FABRIC-2.md §H.12 step 10: creator-ceiling enforcement, birth-time
* snapshot only, no live sync (§H.3, decided 2026-09-03 -- "if something
* was developed with a particular set of ACLs, it should remain at
* that... otherwise parent changes break the child's program"). For
@@ -244,7 +244,7 @@ int capsule_vm_registry_get_by_index(uint32_t index, VMRegistryEntry *out) {
/* Live population, distinct from vm_registry_count above: vm_registry_count
* is monotonic (incremented on every vm_registry_alloc(), never decremented
* on death), so it counts every VM ever born, not the outer Stadium's
* current occupancy. FABRIC.md item 1.5's bound is on LIVE VMs -- a dead or
* current occupancy. FABRIC-0.md item 1.5's bound is on LIVE VMs -- a dead or
* stillborn slot doesn't hold Stadium capacity, and gating on the monotonic
* total would mean the fleet could never regrow after any VM's death,
* which contradicts Hera's own kill-then-rebirth lifecycle (TRIPOD-TEST's
@@ -394,7 +394,7 @@ int capsule_vm_kill(const char *name) {
vm_id = entry->vm_id;
vm = (VM *)entry->vm_ptr;
/* FABRIC-3.md SS B, VM-COOL: reap this VM's own Stadium patron cell for
/* FABRIC-2.md SS B, VM-COOL: reap this VM's own Stadium patron cell for
* real, dispatching COOL. Refusal (already naturally reclaimed by
* unrelated quota pressure, or never admitted) is silently tolerated --
* KILL tears the VM down unconditionally either way. */
@@ -451,7 +451,7 @@ void capsule_vm_kill_all_nonmama(void) {
}
}
/* FABRIC-3.md §I.5, 2026-09-04: contributor-capsule trust tier
/* FABRIC-2.md §I.5, 2026-09-04: contributor-capsule trust tier
* (QEMU-vs-real-hardware conditional enforcement, decided in
* conversation). CAPSULE_FLAG_CONTRIB capsules get the same WARN-only
* treatment as everything else under QEMU (timer_calibration_record()->
@@ -574,7 +574,7 @@ CapsuleRunResult capsule_birth_baby(
/* Milestone 6 (Phase 8): enforced only on INVALID -- see the fuller
* comment in capsule_birth_mama() above for why MISSING/NO_ROOT_KEY
* stay WARN-only. Skipped entirely when skip_pki_sig is set (RUNCAP,
* FABRIC-3.md §F.6/F.18): capsule_get_signatures() is the compile-
* FABRIC-2.md §F.6/F.18): capsule_get_signatures() is the compile-
* time-baked array, indexed against the build-time capsule_descriptors[]
* -- meaningless for a heap-built directory sourced from a thumbdrive,
* where idx 0 would just compare against whatever real capsule happens
@@ -589,7 +589,7 @@ CapsuleRunResult capsule_birth_baby(
names[idx].name, capsule_sig_result_str(sr));
if (sr == CAPSULE_SIG_INVALID) return CAPSULE_RUN_ERR_INVALID;
}
/* FABRIC-3.md §I.5: contrib trust tier -- see contrib_capsule_
/* FABRIC-2.md §I.5: contrib trust tier -- see contrib_capsule_
* refused()'s own doc comment. */
if (contrib_capsule_refused(cap->flags, sr)) {
log_message(LOG_WARN, "capsule sig: %s: contrib capsule refused on real hardware (%s)",
@@ -627,7 +627,7 @@ CapsuleRunResult capsule_birth_baby(
* own reservoir, not vm_uuid_hera()'s (item 4.1's hardcoded default). */
((VM *)new_vm)->stadium_vm_id = vm_id;
/* item 4.6 fix (FABRIC-2.md, 2026-08-18): granted here, before IDENTITY
/* item 4.6 fix (FABRIC-1.md, 2026-08-18): granted here, before IDENTITY
* exec, not after a confirmed live birth as item 4.1a originally placed
* it. item 4.1a's placement assumed no VM's own IDENTITY code would ever
* need a Stadium quota before birth completes -- true until item 4.6's
@@ -641,7 +641,7 @@ CapsuleRunResult capsule_birth_baby(
* stillbirth here is the rare case, not the common one. */
(void)stadium_grant_quota(vm_id, vm_uuid_hera());
/* FABRIC-3.md SS B, VM-COOL: admit this VM as a patron of its own
/* FABRIC-2.md SS B, VM-COOL: admit this VM as a patron of its own
* quota -- identity 0 (same convention stadium_birth_hera() uses for
* "patron zero"), heat 0 (no reservoir cost). Admitted unpinned here
* regardless of which VM this is -- pinning (when it applies) happens
@@ -650,7 +650,7 @@ CapsuleRunResult capsule_birth_baby(
* Hera (stadium_admit() has no admission-time-special pin handling,
* just copies the candidate header, so this ordering is safe).
*
* FABRIC-3.md §H.12 step 5: fleet-foundation VMs (Hera/Hermes/Artemis)
* FABRIC-2.md §H.12 step 5: fleet-foundation VMs (Hera/Hermes/Artemis)
* are pinned -- permanent, exempt from COOL, per §H.1's decision.
* Ordinary/user VMs stay unpinned, matching the original comment's own
* reasoning here (unrelated quota pressure can naturally evict this
@@ -786,7 +786,7 @@ CapsuleRunResult capsule_run_experiment(
names[idx].name, capsule_sig_result_str(sr));
if (sr == CAPSULE_SIG_INVALID) return CAPSULE_RUN_ERR_INVALID;
}
/* FABRIC-3.md §I.5: contrib trust tier -- see contrib_capsule_
/* FABRIC-2.md §I.5: contrib trust tier -- see contrib_capsule_
* refused()'s own doc comment. */
if (contrib_capsule_refused(cap->flags, sr)) {
log_message(LOG_WARN, "capsule sig: %s: contrib capsule refused on real hardware (%s)",
src/starkernel/capsule/capsule_mint.c
+2 -2
View File
@@ -30,7 +30,7 @@
#define MINT_IDENTITY_SRC_DEVBLOCKS 2u /* 1 seed record + 1 personality source */
#define MINT_METADATA_DEVBLOCKS 5u /* devblocks 0..4 reserved */
/* Real, working, minimal default personality -- FABRIC-3.md §F.6/§F.8's
/* Real, working, minimal default personality -- FABRIC-2.md §F.6/§F.8's
* "default personality content" question stays open (mint-time-fixed vs.
* user-editable), but the identity this mints must actually do something
* when RUNCAP births it, not just exist. Needs the "Block NNNN" header
@@ -43,7 +43,7 @@
* A minted identity's RUNCAP-born VM is not exempt from that pump, so
* omitting this left it spamming "UNKNOWN WORD: 'MSG-TICK'" every idle
* tick forever from the moment WIREBIND made the VM live -- found live
* minting a real second identity (FABRIC-3.md §F.26 follow-up). */
* minting a real second identity (FABRIC-2.md §F.26 follow-up). */
static const char MINT_DEFAULT_PERSONALITY[] =
"Block 4999\n"
"S\" common:messaging.4th\" EXEC\n"
src/starkernel/capsule/capsule_runcap.c
+1 -1
View File
@@ -106,7 +106,7 @@ CapsuleRunResult capsule_runcap_birth(
* -ARTEMIS) does this as a separate step after a successful birth,
* via capsule_vm_registry_set_name(). Found live: skipping this left
* a freshly RUNCAP-born VM's registry name empty, which the idle-loop
* pump (FABRIC-3.md Phase C) then read as a zero-length name and
* pump (FABRIC-2.md Phase C) then read as a zero-length name and
* refused ("VM name too long or empty") every tick. */
if (r == CAPSULE_RUN_OK && out_vm_id) {
capsule_vm_registry_set_name(*out_vm_id, vm_name);
src/starkernel/capsule/capsule_vm_physics.c
+6 -6
View File
@@ -83,9 +83,9 @@ static vm_physics_node_t *vm_physics_head = (void *)0;
* wasn't clamped (rate = amount / elapsed_ticks), rather than curve-fitting
* a reconstructed trajectory against a synthetic time axis.
*
* Restated on the virtual tick (FABRIC.md item 2.1, 2026-08-04): this used
* Restated on the virtual tick (FABRIC-0.md item 2.1, 2026-08-04): this used
* to be elapsed_us, wall-clock microseconds -- non-reproducible under TCG
* per GAP-A1 (FABRIC.md §25.7.1). Now counts fleet_heartbeat_tick_count
* per GAP-A1 (FABRIC-0.md §25.7.1). Now counts fleet_heartbeat_tick_count
* ticks, which is execution-paced (incremented once per vm_tick() call,
* confirmed at vm_runtime.c:143). */
typedef struct {
@@ -135,7 +135,7 @@ static VMFleetWindow fleet_window = { { { 0, 0, 0 } }, 0, 0, 0 };
* via doe_log.c's per-VM heat CSV columns showing a dead-flat trajectory
* across a full boot (VM-FLEET-ATTRACTOR-DESIGN-20260705.md rev f).
*
* UNVALIDATED after the ns-to-tick restatement (FABRIC.md item 2.1,
* UNVALIDATED after the ns-to-tick restatement (FABRIC-0.md item 2.1,
* 2026-08-04): this value was calibrated against elapsed wall-clock
* microseconds. Elapsed fleet-heartbeat *ticks* between touches is a
* different quantity at a different scale, and the seed has not been
@@ -289,10 +289,10 @@ void vm_physics_touch(VMUuid vm_id)
if (!target || !target->physics.is_live) return;
/* Restated on the virtual tick (FABRIC.md item 2.1, 2026-08-04): this
/* Restated on the virtual tick (FABRIC-0.md item 2.1, 2026-08-04): this
* used to gate on target->physics.last_active_ns > 0 and scale by
* elapsed wall-clock microseconds -- non-reproducible run to run under
* TCG (GAP-A1, FABRIC.md §25.7.1). fleet_heartbeat_tick_count is
* TCG (GAP-A1, FABRIC-0.md §25.7.1). fleet_heartbeat_tick_count is
* execution-paced (vm_runtime.c:143), so elapsed_ticks is now a pure
* function of the execution stream. `touched` replaces the old
* `> 0` sentinel: tick 0 is a legitimate value for a genuine first
@@ -458,7 +458,7 @@ void vm_physics_tick(uint64_t now_ns)
}
/* Gated on STADIUM_CAPACITY_TICK, not HEARTBEAT_INFERENCE_FREQUENCY (fixed
* 2026-08-15, FABRIC-2.md §12 Q5): fleet_heartbeat_tick_count is fed by
* 2026-08-15, FABRIC-1.md §12 Q5): fleet_heartbeat_tick_count is fed by
* EVERY live VM's own vm_tick() (see the comment above this counter's
* declaration), so it advances several times faster in wall-clock terms
* than a single VM's own tick_count -- comparing it against
src/starkernel/capsule/capsule_wirebind.c
+4 -4
View File
@@ -18,7 +18,7 @@
#include "starkernel/vm_identity.h"
#include "starkernel/user_identity_seed.h"
#include "starkernel/console.h"
#include "starkernel/repl.h" /* sk_repl_get/set_active_vm() -- FABRIC-3.md §F.10 EJECT */
#include "starkernel/repl.h" /* sk_repl_get/set_active_vm() -- FABRIC-2.md §F.10 EJECT */
#include "blkio.h"
#include "block_subsystem.h" /* compute_crc64() */
#include "word_source/include/block_words.h" /* blk_vm_flush_all() -- §F.10 EJECT */
@@ -26,7 +26,7 @@
#include <string.h>
#include <stddef.h>
/* FABRIC-3.md §F.10: "the VM currently attached via the home-blocks USB
/* FABRIC-2.md §F.10: "the VM currently attached via the home-blocks USB
* path" -- WIREBIND's own to track, set at successful birth in
* capsule_wirebind_try_attach(), read and cleared by both
* capsule_wirebind_eject() and capsule_wirebind_unclean_detach(). Single-
@@ -37,7 +37,7 @@ static int g_wirebind_attached_valid = 0;
/* Plain username (no "~user" registry-name suffix), tracked separately
* from g_wirebind_attached_vm_id -- the registry entry's own name is
* user_vm_name ("<username>~user"), not the bare form the (user) prompt
* segment wants (FABRIC-3.md §I.1/4.4s). */
* segment wants (FABRIC-2.md §I.1/4.4s). */
static char g_wirebind_attached_username[USER_IDENTITY_USERNAME_MAX] = {0};
/* WIREBIND_CERT_MAX_DEVBLOCKS: a sane upper bound on how much cert
@@ -178,7 +178,7 @@ void capsule_wirebind_try_attach(struct blkio_dev *dev,
((VM *)user_ctx)->identity = identity;
}
/* FABRIC-3.md §F.10: this is the successful-birth point EJECT/UNCLEAN
/* FABRIC-2.md §F.10: this is the successful-birth point EJECT/UNCLEAN
* need a tracked VMUuid from -- the user VM, not the console VM
* (blk_vm_flush_all()/capsule_vm_kill() below both act on the VM that
* actually owns block-subsystem state). */
src/starkernel/capsule/capsule_zuse_boot.c
+3 -3
View File
@@ -21,7 +21,7 @@
#include <string.h>
#include <stddef.h>
/* FABRIC-3.md §I.8 (re-scoped 2026-09-04): tracks whether the currently
/* FABRIC-2.md §I.8 (re-scoped 2026-09-04): tracks whether the currently
* home-blocks-attached device is Zuse's own -- the single-USB-device
* constraint (§F.8) means capsule_zuse_boot_logout() only needs one flag,
* not a device/uuid comparison, to know a detach event is hers to act on
@@ -57,7 +57,7 @@ static void install_and_activate(VM *mama_vm, const uint8_t seed[32], const uint
* once vm->zuse_cert_installed is already 1) -- that's a real
* security property (the cert/pubkey must never be re-installed or
* swapped) and stays untouched here. Its return is NOT used to gate
* ACL-ZUSE-BOOT below anymore (FABRIC-3.md §I.8, re-scoped
* ACL-ZUSE-BOOT below anymore (FABRIC-2.md §I.8, re-scoped
* 2026-09-04): re-authenticating after capsule_zuse_boot_logout()
* needs ACL-ZUSE-BOOT to re-run and re-set zuse_session even when
* the cert itself was already installed from an earlier boot-time
@@ -81,7 +81,7 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
const homeblocks_sig_t *sig,
VM *mama_vm) {
if (!dev || !mama_vm) return;
/* FABRIC-3.md §I.8, re-scoped 2026-09-04: gate on zuse_session, not
/* FABRIC-2.md §I.8, re-scoped 2026-09-04: gate on zuse_session, not
* zuse_cert_installed. zuse_cert_installed never clears (one-way,
* see install_and_activate()'s own comment) and would permanently
* block re-authentication after a logout; zuse_session does clear
src/starkernel/capsule/mama_forth_words.c
+12 -12
View File
@@ -43,7 +43,7 @@
#include "starkernel/capsule_runcap.h"
#include "starkernel/capsule_console.h"
#include "starkernel/capsule_wirebind.h"
#include "starkernel/capsule_zuse_boot.h" /* capsule_zuse_boot_logout() -- FABRIC-3.md §I.8 EJECT */
#include "starkernel/capsule_zuse_boot.h" /* capsule_zuse_boot_logout() -- FABRIC-2.md §I.8 EJECT */
#include "starkernel/homeblocks_sig.h"
#include "freestanding/stdio.h"
#include "starkernel/capsule_mint.h"
@@ -483,7 +483,7 @@ void mama_word_use(VM *vm)
return;
}
/* BINDSTEP (FABRIC-3.md §F.9/§F.24): if the target has a real
/* BINDSTEP (FABRIC-2.md §F.9/§F.24): if the target has a real
* installed identity (WIREBIND set this at attach time), re-verify
* it against whatever drive is CURRENTLY attached -- live, not
* cached (decision 1: this is a rare, human-triggered, interactive
@@ -584,7 +584,7 @@ void mama_word_kill(VM *vm)
/**
* @brief EJECT ( -- )
* Graceful detach of whatever identity is currently attached via the
* home-blocks USB path (FABRIC-3.md §F.10, extended §I.8 2026-09-04) --
* home-blocks USB path (FABRIC-2.md §F.10, extended §I.8 2026-09-04) --
* a regular WIREBIND user VM or Zuse herself, no identity handled any
* differently. Single-USB-device constraint (§F.8) means there is only
* ever one candidate, so at most one of the two calls below actually
@@ -834,7 +834,7 @@ static void mama_word_vm_call(VM *vm)
/**
* @brief MINT ( -- ok? )
* Mint a fresh identity onto the currently attached USB drive
* (FABRIC-3.md §F.8/§F.19). Deliberately no name/string argument despite
* (FABRIC-2.md §F.8/§F.19). Deliberately no name/string argument despite
* F.8's original "S\" name\" MINT" sketch: this design never binds a VM
* name at mint time -- the drive holds an anonymous, self-contained
* identity, and a name is only assigned later, at RUNCAP birth (a
@@ -865,7 +865,7 @@ static int mint_pop_string(VM *vm, char *dst, size_t dst_cap)
/**
* @brief MINT ( fname-c fname-u uname-c uname-u email-c email-u phone-c phone-u -- ok? )
* Mint a fresh identity onto the currently attached USB drive, with a
* real human profile (FABRIC-3.md §F.20). full_name/username required
* real human profile (FABRIC-2.md §F.20). full_name/username required
* and non-empty; pass a zero-length string (S" ") for email/phone to
* leave them null.
*/
@@ -922,7 +922,7 @@ static void mama_word_mint(VM *vm)
/**
* @brief ZUSE-ELIGIBILITY-ADD ( c-addr -- ok? )
* Add the 32-byte Ed25519 public key at c-addr to Zuse's elevation
* eligibility list (FABRIC-3.md §H.5/§H.12 item 19). Plain, unconditional
* eligibility list (FABRIC-2.md §H.5/§H.12 item 19). Plain, unconditional
* primitive -- no authorization check here or anywhere else in this
* codebase gates on vm->zuse_session. Zuse's authority is the *absence*
* of any ACL restricting her, not a bit this or any other word checks;
@@ -957,7 +957,7 @@ static void mama_word_zuse_eligibility_add(VM *vm)
/**
* @brief ZUSE-ELIGIBLE? ( c-addr -- flag )
* Membership check over Zuse's elevation eligibility list (FABRIC-3.md
* Membership check over Zuse's elevation eligibility list (FABRIC-2.md
* §H.5/§H.12 item 21). Plain, unconditional wrapper over
* zuse_eligibility_is_member() -- same "no bespoke gate" convention as
* ZUSE-ELIGIBILITY-ADD above; is_member() itself is already fail-closed.
@@ -1046,7 +1046,7 @@ static void mama_word_elevate_pubkey_unpack(VM *vm)
/**
* @brief RUNCAP-TEST ( caddr u -- ok? rc )
* Diagnostic-only word (FABRIC-3.md §F.6/§F.18): calls
* Diagnostic-only word (FABRIC-2.md §F.6/§F.18): calls
* capsule_runcap_birth() against whatever drive sk_repl_get_homeblocks_
* dev()/sig() currently report, naming the new VM from the given string.
* Not the real RUNCAP call site -- that's WIREBIND (still unbuilt); this
@@ -1092,7 +1092,7 @@ static void mama_word_runcap_test(VM *vm)
/**
* @brief PAIR-TEST ( caddr u -- ok? )
* Diagnostic-only word (FABRIC-3.md Phase F, 2026-08-28): births a
* Diagnostic-only word (FABRIC-2.md Phase F, 2026-08-28): births a
* console VM (bare, capsule_console.h) named by the given string, and a
* user VM (capsule_runcap_birth(), from whatever drive sk_repl_get_
* homeblocks_dev()/sig() currently report) named "<string>~user" --
@@ -1583,7 +1583,7 @@ void register_mama_forth_words(VM *vm)
}
/* ============================================================================
* Stadium Words (FABRIC.md punch list item 4.2)
* Stadium Words (FABRIC-0.md punch list item 4.2)
*
* The entire C surface item 4.2 is permitted to add, per HERMES.md's
* language constraint: all eight operate on the CALLING VM's own identity
@@ -1679,7 +1679,7 @@ static void mama_word_stadium_res_fetch(VM *vm)
* Sum of heat held by the calling VM's own word-execution residents
* (item 4.1's cells) -- the term a VM's own application-level conservation
* check (e.g. Hermes's HERMES-K) needs to close exactly, since word patrons
* are otherwise invisible to FORTH (FABRIC.md §25.7, ruling 2026-08-06).
* are otherwise invisible to FORTH (FABRIC-0.md §25.7, ruling 2026-08-06).
*/
static void mama_word_stadium_word_heat(VM *vm)
{
@@ -1788,7 +1788,7 @@ void register_child_vm_words(VM *vm)
register_word(vm, "EXEC", mama_word_exec);
register_word(vm, "VM-EXEC", mama_word_vm_exec);
register_word(vm, "VM-CALL", mama_word_vm_call);
/* USE (FABRIC-3.md §F.24): not console-specific -- any VM can
/* USE (FABRIC-2.md §F.24): not console-specific -- any VM can
* redirect the physical REPL to any other VM it has ACL access to
* (BINDSTEP re-verifies on every call, §F.9), including a console
* VM switching back to Hera or to a different session entirely.
src/starkernel/capsule/vm_uuid.c
+1 -1
View File
@@ -22,7 +22,7 @@
*/
/**
* vm_uuid.c - 128-bit VM identifiers (FABRIC.md punch list item 3.8)
* vm_uuid.c - 128-bit VM identifiers (FABRIC-0.md punch list item 3.8)
*
* See vm_uuid.h for the design rationale (no RNG source exists on any of
* the three ISAs uniformly, so this is deterministic, not random).
src/starkernel/crypto/ed25519.c
+1 -1
View File
@@ -5,7 +5,7 @@
*
* All constants below were generated by direct Python computation
* (arbitrary-precision arithmetic) and pasted in, not hand-derived or
* recalled from memory -- see FABRIC-2.md's Ed25519 milestone writeup
* recalled from memory -- see FABRIC-1.md's Ed25519 milestone writeup
* for the derivation. Cross-checked: the curve equation
* -x^2+y^2 = 1+d*x^2*y^2 holds for (BX,BY) under this D; the base point
* encoding (0x58, then 0x66 repeating) matches the well-known published
src/starkernel/hal/console.c
+2 -2
View File
@@ -164,7 +164,7 @@ static int serial_transmit_empty(void) {
*
* g_active_vm_name_buf owns the storage -- console_set_vm_name() copies
* into it rather than storing the caller's own pointer. Found live
* 2026-08-28 (FABRIC-3.md Phase F): mama_word_use() (USE) passes
* 2026-08-28 (FABRIC-2.md Phase F): mama_word_use() (USE) passes
* entry.name, a local VMRegistryEntry's own field -- once USE returns,
* that stack frame is reused and the old raw-pointer version left
* g_active_vm_name dangling, corrupting every console tag after the
@@ -229,7 +229,7 @@ static void raw_putc(char c) {
* framebuffer (vt100_putc) -- mirrors console_putc()'s own serial/framebuffer
* split so the prefix reaches both outputs, not serial only. No recursion
* into console_putc itself (would re-trigger the line-start prefix check). */
/* FABRIC.md 4.4: the bracketed VM name (brackets included) renders in
/* FABRIC-0.md 4.4: the bracketed VM name (brackets included) renders in
* standard web orange, 0xFFA500 -- not in the classic 16-color ANSI
* palette, so sent as a literal 24-bit SGR sequence rather than a palette
* index. Same dual serial+framebuffer send pattern as the rest of this
src/starkernel/hal/framebuffer.c
+5 -5
View File
@@ -73,7 +73,7 @@ static FbState g_fb;
* uint32 store), e.g. PixelRedGreenBlueReserved8BitPerColor means byte0=R,
* byte1=G, byte2=B, byte3=X -- which as a little-endian uint32 puts R in
* bits[7:0], G in bits[15:8], B in bits[23:16]. The two branches below were
* previously swapped relative to that (found via FABRIC.md item 4.3.1's
* previously swapped relative to that (found via FABRIC-0.md item 4.3.1's
* orientation test: corners rendered with R and B channels exchanged).
*/
static uint32_t pack_pixel(uint32_t rgb)
@@ -190,7 +190,7 @@ void fb_draw_glyph(uint32_t px, uint32_t py, uint8_t ch,
uint32_t packed = on ? pfg : pbg;
uint32_t base_x = px + col * g_fb.scale;
/* font_8x16_data stores each glyph's scanlines bottom-to-top
* (FABRIC.md item 4.4f) -- row 0 is the glyph's bottom row, so
* (FABRIC-0.md item 4.4f) -- row 0 is the glyph's bottom row, so
* it maps to the cell's last pixel row, not its first. */
uint32_t base_y = py + (15u - row) * g_fb.scale;
@@ -215,7 +215,7 @@ void fb_draw_glyph(uint32_t px, uint32_t py, uint8_t ch,
* --------------------------------------------------------------------- */
/**
* fb_draw_orientation_test — one-time boot diagnostic (FABRIC.md item 4.3.1).
* fb_draw_orientation_test — one-time boot diagnostic (FABRIC-0.md item 4.3.1).
*
* Fills each raster corner with a distinct solid color so a screendump
* immediately reveals whether the image is flipped or rotated. Not part of
@@ -263,7 +263,7 @@ void fb_draw_orientation_test(void)
* show it, but enough scrolls (or scrolling quickly) accumulates visible
* pixel overlap between rows.
*
* Copies through non-volatile pointers (FABRIC.md item 4.4g performance
* Copies through non-volatile pointers (FABRIC-0.md item 4.4g performance
* fix, 2026-08-11): the GOP framebuffer is mapped write-back, not
* cache-disabled MMIO (vmm.c:350-363 -- "QEMU's VGA emulation is coherent
* and UC- mapping causes #GP"), so it behaves as ordinary RAM and does not
@@ -315,7 +315,7 @@ void fb_scroll_rows(uint32_t pixel_rows, uint32_t bg)
}
/**
* fb_scroll_rect — box-confined scroll (FABRIC.md item 4.4t).
* fb_scroll_rect — box-confined scroll (FABRIC-0.md item 4.4t).
*
* Same non-volatile bulk-copy rationale as fb_scroll_rows() above, but
* bounded to a caller-supplied rectangle instead of the whole framebuffer --
src/starkernel/hal/ttf.c
+2 -2
View File
@@ -8,7 +8,7 @@
*/
/**
* ttf.c — TrueType font parser core (FABRIC.md items 4.3.7, 4.3.7a)
* ttf.c — TrueType font parser core (FABRIC-0.md items 4.3.7, 4.3.7a)
*
* sfnt directory + head/maxp/loca/glyf/cmap(format 4) table parsing, plus
* simple- and composite-glyph outline extraction. All multi-byte fields in
@@ -26,7 +26,7 @@
* an unsigned overflow check; q48_mul does a plain unsigned widen-multiply)
* — confirmed by reading that file, not assumed. Per this repo's rule
* against modifying a shared/tested module to "fix" it without being
* asked, that gap is reported (see FABRIC.md's 4.3.7a completion note),
* asked, that gap is reported (see FABRIC-0.md's 4.3.7a completion note),
* not patched here. No glyph in the v1 repertoire (§27.6.4) needs a
* non-identity composite transform — checked against
* fonts/JetBrainsMono-Regular.ttf before writing this, not assumed.
src/starkernel/hal/vt100.c
+12 -12
View File
@@ -55,7 +55,7 @@
#define UNDERLINE_ROW 14u
/* -----------------------------------------------------------------------
* FABRIC.md item 4.4j: TTF glyph backend, active only from
* FABRIC-0.md item 4.4j: TTF glyph backend, active only from
* vt100_enable_ttf() onward (boot/POST stays font_8x16.c).
*
* Point size and cell geometry, decided final by item 4.4m (20px text,
@@ -81,7 +81,7 @@ static ttf_font_t g_ttf_font;
static int g_ttf_ready = 0;
static ttf_raster_cache_t g_ttf_cache;
/* FABRIC.md item 4.4y-revised: Alt+TAB graphics/text toggle. When 0, every
/* FABRIC-0.md item 4.4y-revised: Alt+TAB graphics/text toggle. When 0, every
* terminal draw call (put_char's glyph blit, erase, scroll) becomes a
* pure logical update -- g_vt's cursor/attributes and the scrollback
* shadow still advance normally, only the actual framebuffer write is
@@ -92,7 +92,7 @@ static ttf_raster_cache_t g_ttf_cache;
static int g_terminal_visible = 1;
/* -----------------------------------------------------------------------
* FABRIC.md items 4.4t/4.4o/4.4u/4.4w/4.4x/4.4z tried a 640x480 CANVAS
* FABRIC-0.md items 4.4t/4.4o/4.4u/4.4w/4.4x/4.4z tried a 640x480 CANVAS
* box with a separate single-line REPL strip pinned below it -- a
* confined region plus independent border-drawing/geometry bookkeeping
* for both. Reverted 2026-08-12, simplified back to what this comment
@@ -105,7 +105,7 @@ static int g_terminal_visible = 1;
* --------------------------------------------------------------------- */
/* -----------------------------------------------------------------------
* FABRIC.md item 4.4q: REPL scrollback. Text-only (not pixel snapshots --
* FABRIC-0.md item 4.4q: REPL scrollback. Text-only (not pixel snapshots --
* at 1000 lines x ~cols bytes this is tens of KB; a pixel-snapshot ring
* would be roughly three orders of magnitude larger for no benefit, since
* the only consumer is a redraw). Only active in TTF mode (allocated in
@@ -154,7 +154,7 @@ static uint32_t g_ring_cap = 0; /* active ring capacity -- VT100_BOOT_S
static uint32_t g_scroll_offset = 0; /* 0 = live view */
/* -----------------------------------------------------------------------
* FABRIC.md item 4.4ac: boot-mode scrollback. font_8x16/bitmap-mode boot
* FABRIC-0.md item 4.4ac: boot-mode scrollback. font_8x16/bitmap-mode boot
* output (POST, capsule birth, self-tests, heartbeat) previously had no
* scrollback at all -- g_shadow/g_ring above were only ever allocated in
* vt100_enable_ttf(), so anything printed before the REPL took over was
@@ -314,7 +314,7 @@ static void draw_cursor_glyph(uint8_t ch)
uint32_t f = eff_fg();
uint32_t b = eff_bg();
/* FABRIC.md item 4.4q: mirror every drawn character into the
/* FABRIC-0.md item 4.4q: mirror every drawn character into the
* scrollback shadow buffer, when active. */
if (g_shadow && g_vt.cy < g_vt.rows && g_vt.cx < g_vt.cols) {
g_shadow[(size_t)g_vt.cy * g_line_stride + g_vt.cx] = (char)ch;
@@ -428,7 +428,7 @@ void vt100_init(void)
erase_display(2);
/* FABRIC.md item 4.4ac: allocate boot-mode scrollback now, at the
/* FABRIC-0.md item 4.4ac: allocate boot-mode scrollback now, at the
* bitmap cell geometry just computed above. Non-fatal on failure, same
* pattern as vt100_enable_ttf()'s TTF allocation below: g_shadow/g_ring
* stay NULL, draw_cursor_glyph()/scroll_up() already gate on that and
@@ -483,7 +483,7 @@ void vt100_enable_ttf(void)
g_ttf_ready = 1;
}
/* FABRIC.md item 4.4ac: freeze the boot-mode scrollback buffers (if
/* FABRIC-0.md item 4.4ac: freeze the boot-mode scrollback buffers (if
* any -- vt100_init() may have failed to allocate them) before they
* get overwritten below. g_vt.cols/rows/g_shadow/g_ring/g_line_stride/
* g_ring_count/g_ring_head/g_ring_cap still hold boot-mode values at
@@ -518,7 +518,7 @@ void vt100_enable_ttf(void)
fb_fill_rect(0, 0, fb_width(), fb_height(), g_vt.def_bg);
erase_display(2);
/* FABRIC.md item 4.4q: allocate the scrollback shadow + ring buffers
/* FABRIC-0.md item 4.4q: allocate the scrollback shadow + ring buffers
* now that cols/rows are fixed for the rest of this session. Failure
* is non-fatal -- scrollback just stays unavailable (g_shadow/g_ring
* stay NULL, every scrollback call site already checks), REPL text
@@ -607,7 +607,7 @@ static void scrollback_redraw(void)
}
}
/* FABRIC.md item 4.4y-revised: Alt+TAB graphics/text toggle, a two-state
/* FABRIC-0.md item 4.4y-revised: Alt+TAB graphics/text toggle, a two-state
* machine (VISIBLE <-> HIDDEN) with exactly one transition function --
* both the physical Alt+TAB interception (repl.c) and the ALT+TAB FORTH
* word (keyboard_words.c) call this same function, so there is exactly
@@ -689,7 +689,7 @@ static void advance_cursor(void)
}
}
/* FABRIC.md item 4.4q: push the rows about to be discarded into the
/* FABRIC-0.md item 4.4q: push the rows about to be discarded into the
* scrollback ring before the pixel scroll happens, then shift the shadow
* buffer to match. `n` is clamped to g_vt.rows -- scrolling further than
* a full screen at once cannot happen through this code path (advance_cursor
@@ -739,7 +739,7 @@ static void scroll_up(uint32_t lines)
* Erase operations
* --------------------------------------------------------------------- */
/* FABRIC.md item 4.4i found this drawing a per-cell blank glyph
/* FABRIC-0.md item 4.4i found this drawing a per-cell blank glyph
* (font_8x16.c-specific, and inconsistent with erase_display(2)'s
* full-screen case just below, which already used a plain rect fill).
* 4.4j fixes both problems at once: a blank cell is visually identical to
src/starkernel/heartbeat.c
+4 -4
View File
@@ -15,7 +15,7 @@
* timer.c contributes only heartbeat_read_counter() — the one thing that is
* genuinely per-ISA (rdtsc / rdtime / CNTPCT_EL0).
*
* Top half / bottom half split (FABRIC.md §25.1 item 0.8, per the GAP-A1
* Top half / bottom half split (FABRIC-0.md §25.1 item 0.8, per the GAP-A1
* ruling in §16.4/§18.4): heartbeat_tick() is called from interrupt context
* and does nothing but read the counter, bump TIME-TICKS, and latch a
* pending sample. heartbeat_service() runs on the mainline (the REPL idle
@@ -23,7 +23,7 @@
* state — the engine stays on the virtual tick per §18.4, unchanged by this
* file.
*
* Adaptive re-arm period (FABRIC.md §26, ruled 2026-08-03): Loop #7
* Adaptive re-arm period (FABRIC-0.md §26, ruled 2026-08-03): Loop #7
* (vm_runtime.c) computes an execution-derived stable/volatile signal and
* calls heartbeat_set_adaptive_period_ns() with it, rescaled to this file's
* kernel-appropriate base (10 ms, matching the 100 Hz rate item 0.1-0.7
@@ -47,7 +47,7 @@
* rate established throughout items 0.1-0.7. Deliberately NOT
* HEARTBEAT_TICK_NS (include/starforth_config.h) -- that constant is the
* hosted pthread-worker's 10 µs base and is three orders of magnitude too
* fast for a bare-metal ISR period (FABRIC.md §26.3). Loop #7's decision
* fast for a bare-metal ISR period (FABRIC-0.md §26.3). Loop #7's decision
* logic is reused unmodified; only the base it scales differs. */
#define HEARTBEAT_BASE_PERIOD_NS 10000000ULL
@@ -213,7 +213,7 @@ const TimeTrustState *heartbeat_state(void)
}
/**
* @brief Set the adaptive re-arm period (FABRIC.md §26).
* @brief Set the adaptive re-arm period (FABRIC-0.md §26).
*
* Called from vm_runtime.c's Loop #7 site on the mainline execution path
* (never interrupt context) with a value already rescaled to this file's
src/starkernel/homeblocks_sig.c
+1 -1
View File
@@ -21,7 +21,7 @@
*/
/**
* homeblocks_sig.c - Drive signature check (FABRIC-3.md, Milestone 4).
* homeblocks_sig.c - Drive signature check (FABRIC-2.md, Milestone 4).
* See starkernel/homeblocks_sig.h for the format and interface design.
*/
src/starkernel/kernel_main.c
+10 -10
View File
@@ -414,7 +414,7 @@ void kernel_main(BootInfo *boot_info) {
console_println("APIC: init done\n");
#ifdef ARCH_AMD64
/* item 4.3.5 (FABRIC.md §27.5): I/O APIC + i8042 keyboard, interrupt-
/* item 4.3.5 (FABRIC-0.md §27.5): I/O APIC + i8042 keyboard, interrupt-
* driven. Routed masked here; unmasked in kernel_main_deep() at the
* same point the APIC timer is started. */
console_println("I/O APIC: init...");
@@ -508,12 +508,12 @@ static void kernel_main_deep(BootInfo *boot_info) {
console_println("Boot successful!\n");
#ifdef STARFORTH_ENABLE_VM
/* Stadium: boot-time allocation (FABRIC.md item 3.2), before any VM
/* Stadium: boot-time allocation (FABRIC-0.md item 3.2), before any VM
* exists (§6). Soft failure -- nothing downstream consumes the Stadium
* yet, so a failed allocation logs and boot continues. */
(void)stadium_boot_init();
/* Session: boot-time allocation (FABRIC-3.md §H.12 step 4), sized from
/* Session: boot-time allocation (FABRIC-2.md §H.12 step 4), sized from
* stadium_max_vm_count() so it must run after stadium_boot_init() above
* and before the first session is registered (stadium_birth_hera()
* below registers Hera as session zero). Soft failure, same reasoning
@@ -521,14 +521,14 @@ static void kernel_main_deep(BootInfo *boot_info) {
* failed session_register() rather than treating it as fatal. */
(void)session_boot_init();
/* item 4.1, FABRIC.md item 3.6/§17.7: actually enforce "Hera is patron
/* item 4.1, FABRIC-0.md item 3.6/§17.7: actually enforce "Hera is patron
* zero" before anything else can land on cell 0 via the free list, then
* bring up the word layer's map. Both must happen before the first word
* ever dispatches -- capsule birth below runs init.4th, which dispatches
* words. */
(void)stadium_birth_hera();
stadium_words_init();
stadium_blocks_init(); /* FABRIC-3.md §B: block-patron layer, same ordering as words */
stadium_blocks_init(); /* FABRIC-2.md §B: block-patron layer, same ordering as words */
/* M7: VM Bootstrap and Parity Validation */
console_println("VM: bootstrap parity...");
@@ -616,7 +616,7 @@ static void kernel_main_deep(BootInfo *boot_info) {
}
}
/* Zuse identity: SUPERSEDED 2026-08-28 (FABRIC-3.md §F.20/§F.21).
/* Zuse identity: SUPERSEDED 2026-08-28 (FABRIC-2.md §F.20/§F.21).
* The one-shot block-fence mint-or-load that used to run here is
* gone -- Zuse is thumbdrive-resident now (her seed never touches
* system storage), and a thumbdrive can't be detected this early in
@@ -655,7 +655,7 @@ static void kernel_main_deep(BootInfo *boot_info) {
xhci_bringup(&xhci_dev) == 0);
}
/* FABRIC.md item 4.4g (decided 2026-08-11): console_fb_init() moved here,
/* FABRIC-0.md item 4.4g (decided 2026-08-11): console_fb_init() moved here,
* before capsule_birth_mama(), so the fleet-birth/self-test transcript is
* framebuffer-visible too, not just the small post-birth tail. Costs
* roughly 12x more boot-time heartbeat ticks (one-shot, at boot only --
@@ -796,7 +796,7 @@ static void kernel_main_deep(BootInfo *boot_info) {
* for the same reason. */
/* Hermes is now a permanent fleet-foundation VM, not self-test
* scaffolding -- FABRIC-3.md D.7 (birth-by-message-only, 2026-08-28):
* scaffolding -- FABRIC-2.md D.7 (birth-by-message-only, 2026-08-28):
* the Tripod legs (Hera/Hermes/Artemis) must be alive session-less so
* a later thumbdrive-attach flow has a running Hermes/Artemis to
* message. Previously born, exercised, and KILLed by item 4.2's own
@@ -816,7 +816,7 @@ static void kernel_main_deep(BootInfo *boot_info) {
/* Artemis is now a permanent fleet-foundation VM, not self-test
* scaffolding -- same reasoning as Hermes's own birth just above
* (FABRIC-3.md D.7). Previously born, exercised, and KILLed by item
* (FABRIC-2.md D.7). Previously born, exercised, and KILLed by item
* 4.6's own self-test every boot; that diagnostic exercising is gone,
* only the birth remains. Artemis's own capsule still runs its own
* self-test plus a 30-rep stress campaign at load
@@ -862,7 +862,7 @@ static void kernel_main_deep(BootInfo *boot_info) {
if (mama->halted) goto idle;
#endif
/* FABRIC.md item 4.4g (decided 2026-08-11): console_fb_init() call site
/* FABRIC-0.md item 4.4g (decided 2026-08-11): console_fb_init() call site
* moved earlier in this function, before capsule_birth_mama() -- see that
* call site's comment. This used to be here (item 4.4c, 2026-08-11: wires
* the framebuffer AND turns on vt100_init(), so serial and framebuffer
src/starkernel/math/q48_16.c
+1 -1
View File
@@ -263,7 +263,7 @@ q48_16_t q48_sqrt_approx(q48_16_t q)
* Approximation: Sine / Cosine (Taylor Series, Integer-Only)
* ============================================================================
*
* FABRIC.md item 4.3.3a -- needed by the Console drawing fabric's
* FABRIC-0.md item 4.3.3a -- needed by the Console drawing fabric's
* CIRCLE/ARC/ELLIPSE (item 4.3.3b). Radian input.
*
* PI_Q48 = 205887 (pi * 65536, rounded). TWO_PI_Q48 is derived as
src/starkernel/repl.c
+32 -32
View File
@@ -18,7 +18,7 @@
* Idle spin: polls console_getc() and services the adaptive heartbeat.
* The timer ISR's top half (heartbeat_tick()) latches one
* sample per interrupt; the idle spin drains it every
* iteration via heartbeat_service() (item 0.8, FABRIC.md §26)
* iteration via heartbeat_service() (item 0.8, FABRIC-0.md §26)
* and calls sk_repl_idle() once per SK_IDLE_BEAT_INTERVAL ticks
* for coarser subsystem dispatch. On QEMU TCG the ISR must fire
* for ticks to advance — check "Heartbeat: N ticks" in the
@@ -49,7 +49,7 @@
#include <stdint.h>
#include <string.h>
/* FABRIC.md 4.4: "ok>" (including its trailing space) renders in bright
/* FABRIC-0.md 4.4: "ok>" (including its trailing space) renders in bright
* cyan, 0x55FFFF -- reuses FB_ANSI_PALETTE[14]. Sent as a real SGR escape
* so it colors both the framebuffer (parsed by vt100.c's apply_sgr()) and
* any ANSI-aware serial terminal, per 4.4c's "identical on both" goal. */
@@ -57,7 +57,7 @@
const char lithos_version[64] = LITHOS_VERSION_STR;
/* FABRIC.md §27.8/4.4s, unblocked 2026-09-04: extends the prompt to
/* FABRIC-0.md §27.8/4.4s, unblocked 2026-09-04: extends the prompt to
* "[VM name] (user) ok>" (e.g. "[Hera] (zuse) ok>") whenever an
* identity is currently attached -- Zuse (mama_vm->zuse_session; there
* is only ever one, so no username lookup needed) or a regular WIREBIND
@@ -67,7 +67,7 @@ const char lithos_version[64] = LITHOS_VERSION_STR;
* segment reflects "who is at the console" the same way regardless of
* which VM you've USE'd into. Prints nothing (bare "ok> ", today's
* existing format, unchanged) when neither is attached -- Hera's own
* documented normal steady state (FABRIC-3.md §D.2). */
* documented normal steady state (FABRIC-2.md §D.2). */
static void sk_print_prompt(void) {
VM *mama_vm = (VM *)sk_get_mama_vm();
const char *username;
@@ -97,7 +97,7 @@ VM *sk_repl_get_active_vm(void) { return g_repl_active_vm; }
/*===========================================================================
* Currently attached home-blocks device: mirrors g_repl_active_vm's own
* shape (FABRIC-3.md §F.9's own precedent for this exact accessor). Set
* shape (FABRIC-2.md §F.9's own precedent for this exact accessor). Set
* once sk_repl_idle()'s own attach handling confirms HOMEBLOCKS_SIG_OK
* below; cleared on detach. RUNCAP (§F.6/§F.18) and, later, BINDSTEP's
* re-verify-live check (§F.9) both need this -- neither lives in this
@@ -146,7 +146,7 @@ static uint64_t g_last_beat_tick; /* zero-initialized (BSS) */
/* Reentrancy guards for the MSG-TICK pump inside sk_repl_idle().
*
* sk_repl_idle() runs vm_interpret(mama, ...) (below) to VM-EXEC MSG-TICK
* into every live child VM (FABRIC-3.md Phase C). But sk_repl_idle() is
* into every live child VM (FABRIC-2.md Phase C). But sk_repl_idle() is
* itself called from the blocking KEY/EXPECT/QUERY reads (sk_console_getkey()
* / sk_console_readline(), which run *from inside* the executing VM's own
* vm_interpret once a FORTH word reads input mid-line). vm_interpret() is
@@ -204,7 +204,7 @@ static void sk_repl_idle(VM *active_vm)
int rc = blkio_usb_open_msc(&usb_blk_dev, xdev, slot_id);
if (rc == 0) {
/* FABRIC-3.md Milestone 4: warn on blank/foreign/unrecognized
/* FABRIC-2.md Milestone 4: warn on blank/foreign/unrecognized
* media -- the "warn" half. No "refuse" half yet: blkio_usb.c
* has no SCSI WRITE(10) support at all (Milestone 2's biggest
* open item), so there is no write path today to refuse --
@@ -218,7 +218,7 @@ static void sk_repl_idle(VM *active_vm)
*
* HOMEBLOCKS_SIG_START_FBLOCK (devblock 1): the real, final
* location -- GPT was dropped permanently, this is not an
* interim value (FABRIC-3.md §F.8/§F.13). */
* interim value (FABRIC-2.md §F.8/§F.13). */
homeblocks_sig_t sig;
homeblocks_sig_result_t sig_rc =
homeblocks_sig_check(&usb_blk_dev, HOMEBLOCKS_SIG_START_FBLOCK, &sig);
@@ -243,7 +243,7 @@ static void sk_repl_idle(VM *active_vm)
break;
}
/* FABRIC-3.md §F.20/§F.21: Zuse is thumbdrive-resident now,
/* FABRIC-2.md §F.20/§F.21: Zuse is thumbdrive-resident now,
* not system-resident -- this is the only point in the boot
* lifecycle a just-attached drive's sig result is known, so
* genesis-mint/attach-authenticate has to happen from here,
@@ -253,7 +253,7 @@ static void sk_repl_idle(VM *active_vm)
* identity this boot. */
capsule_zuse_boot_try_attach(&usb_blk_dev, sig_rc, &sig, (VM *)sk_get_mama_vm());
/* FABRIC-3.md §F.5/§F.23 (WIREBIND): the real thumbdrive-
/* FABRIC-2.md §F.5/§F.23 (WIREBIND): the real thumbdrive-
* attach call site for a regular (non-Zuse) identity --
* verify-then-birth-then-pair, replacing the RUNCAP-TEST/
* PAIR-TEST diagnostic words that exercised each piece by
@@ -291,19 +291,19 @@ static void sk_repl_idle(VM *active_vm)
g_attached_blk_dev = (void *)0;
}
/* FABRIC-3.md §F.10 decision 2 (UNCLEAN, closed alongside EJECT):
/* FABRIC-2.md §F.10 decision 2 (UNCLEAN, closed alongside EJECT):
* the device is already gone -- no-op if WIREBIND never had
* anything tracked (general-purpose USB use, not a home-blocks
* identity drive). */
capsule_wirebind_unclean_detach();
/* FABRIC-3.md §I.8, re-scoped 2026-09-04: Zuse logs out on device
/* FABRIC-2.md §I.8, re-scoped 2026-09-04: Zuse logs out on device
* removal exactly like a WIREBIND user -- no-op if the device
* that just left wasn't hers. */
capsule_zuse_boot_logout((VM *)sk_get_mama_vm());
}
/* FABRIC.md/FABRIC-2.md Section V item 6: "a cheap 'anything dirty?
/* FABRIC-0.md/FABRIC-1.md Section V item 6: "a cheap 'anything dirty?
* no? done' block-sync check", the same "interrupt-driven, coarse
* cadence, cheap early-exit" trigger shape as the xHCI servicing
* above -- this was the one piece of that design already fully
@@ -325,7 +325,7 @@ static void sk_repl_idle(VM *active_vm)
* did not survive a reboot until this fix. */
blk_vm_flush_all(active_vm);
/* FABRIC-3.md §I.2, built 2026-09-04: heat/wear-leveling migration
/* FABRIC-2.md §I.2, built 2026-09-04: heat/wear-leveling migration
* trigger -- one linear scan of Artemis's own device per idle tick
* (same ~1 Hz SK_IDLE_BEAT_INTERVAL cadence this whole function
* already runs at, chosen so a hot devblock is caught proactively
@@ -335,7 +335,7 @@ static void sk_repl_idle(VM *active_vm)
* migration, needs a call site threaded from WIREBIND). */
blk_migration_idle_check();
/* FABRIC-3.md Phase C (2026-08-28): distributed messaging pump. Every
/* FABRIC-2.md Phase C (2026-08-28): distributed messaging pump. Every
* live VM except Hera herself now owns its own MSG-ARENA/CH-ARENA and
* MSG-TICK word (see capsules/common/messaging.4th) instead of only
* Hermes having one -- "fully distributed, Hera pumps each VM's
@@ -388,7 +388,7 @@ static void sk_repl_idle(VM *active_vm)
}
/*===========================================================================
* FABRIC.md item 4.4v: keyboard-to-REPL bridge.
* FABRIC-0.md item 4.4v: keyboard-to-REPL bridge.
*
* Translates sk_key_event_poll()'s converged Linux-keycode-namespace
* stream (keyboard_words.c -- one implementation shared with KEY-EVENT,
@@ -492,7 +492,7 @@ static int sk_kbd_getc(void)
static int sk_console_getc_raw(void)
{
int c = console_getc();
if (c < 0) c = sk_kbd_getc(); /* FABRIC.md 4.4v: second source, same buffer */
if (c < 0) c = sk_kbd_getc(); /* FABRIC-0.md 4.4v: second source, same buffer */
return c;
}
@@ -585,7 +585,7 @@ int sk_console_readline(char* buf, int size, VM* active_vm, int reanchor_prompt)
if (c < 0) {
/* Service the heartbeat bottom half every idle iteration, not
* gated by SK_IDLE_BEAT_INTERVAL (item 0.8, FABRIC.md §26):
* gated by SK_IDLE_BEAT_INTERVAL (item 0.8, FABRIC-0.md §26):
* heartbeat_service() drains at most one latched sample per
* call, so a coarse gate here would silently lose or merge
* samples between ISR-latched ticks. sk_repl_idle() below is
@@ -612,14 +612,14 @@ int sk_console_readline(char* buf, int size, VM* active_vm, int reanchor_prompt)
}
/*
* Re-anchor the prompt (FABRIC.md 4.4a unified prompt: print
* Re-anchor the prompt (FABRIC-0.md 4.4a unified prompt: print
* only "ok> " here -- console_putc() auto-prefixes the current
* [VMName] on a fresh line). When an idle bottom half above
* pushed output past prompt_tx_mark, the console cursor is now
* below/after new lines and the "ok> " the caller printed has
* been scrolled or buried -- once the flood passes, the screen
* and serial log would end on a stale line with no prompt
* (FABRIC-3.md: the bare prompt must be the last thing shown
* (FABRIC-2.md: the bare prompt must be the last thing shown
* while the REPL sits idle). Reprinting it restores that
* invariant. Skipped while a line is being edited (n > 0) so
* partial echo stays attached to its own prompt; shim.c's
@@ -683,7 +683,7 @@ int sk_console_readline(char* buf, int size, VM* active_vm, int reanchor_prompt)
/*===========================================================================
* sk_repl - FORTH REPL
*
* FABRIC-3.md §F.20/§F.21 (2026-08-28): the unauthenticated emergency-CLI
* FABRIC-2.md §F.20/§F.21 (2026-08-28): the unauthenticated emergency-CLI
* ACL bypass this REPL used to grant itself on Hera's own bare prompt is
* retired -- every word runs under ordinary ACL enforcement here now,
* console identity included. emergency_console still exists as a field
@@ -707,7 +707,7 @@ static void sk_fault_handler(VM *vm) {
#endif
/*===========================================================================
* sk_repl_dispatch_line - console-VM + user-VM pair relay (FABRIC-3.md
* sk_repl_dispatch_line - console-VM + user-VM pair relay (FABRIC-2.md
* Phase F, 2026-08-28).
*
* If `vm`'s own registered name has a live "<name>~user" counterpart,
@@ -727,7 +727,7 @@ static void sk_fault_handler(VM *vm) {
* v1 limitation -- warned about, not silently mishandled).
*===========================================================================*/
/* USE (FABRIC-3.md §F.24) is a REPL-control word, not a command for
/* USE (FABRIC-2.md §F.24) is a REPL-control word, not a command for
* whatever VM happens to be paired to a console -- it must always run
* on the active VM directly, never get relayed as a message. Real
* FORTH syntax always puts USE last (S" name" USE), so a trailing-
@@ -809,20 +809,20 @@ out:
int sk_repl_step(VM *vm)
{
char input[INPUT_BUFFER_SIZE]; /* FABRIC.md 4.4w: matches the strip's input width */
char input[INPUT_BUFFER_SIZE]; /* FABRIC-0.md 4.4w: matches the strip's input width */
if (!vm || vm->halted) return 0;
{
/* Unified prompt (FABRIC.md 4.4a): console_putc()'s existing per-line
/* Unified prompt (FABRIC-0.md 4.4a): console_putc()'s existing per-line
* "[VMName] " prefix (console.c, g_active_vm_name) already supplies the
* bracket -- print only "ok> " here, don't build a second one.
* emergency_console is no longer set from here (FABRIC-3.md §F.20/
* emergency_console is no longer set from here (FABRIC-2.md §F.20/
* §F.21: the emergency-CLI ACL bypass is retired) -- it's driven
* only by the genuine C-level fault handler now (vm.c's own
* emergency-fault-recovery use, EMERGENCY_CONSOLE_ENABLED). Every
* word run from this REPL, Hera's bare prompt included, goes
* through ordinary ACL enforcement. FABRIC.md 4.4s (2026-09-04):
* through ordinary ACL enforcement. FABRIC-0.md 4.4s (2026-09-04):
* sk_print_prompt() extends this with a "(user)" segment when an
* identity is attached -- see its own doc comment. */
sk_print_prompt();
@@ -854,7 +854,7 @@ int sk_repl_step(VM *vm)
void sk_repl_run(VM *vm)
{
char input[INPUT_BUFFER_SIZE]; /* FABRIC.md 4.4w: matches the strip's input width */
char input[INPUT_BUFFER_SIZE]; /* FABRIC-0.md 4.4w: matches the strip's input width */
VM *active;
vm->halted = 0;
@@ -863,12 +863,12 @@ void sk_repl_run(VM *vm)
/* USE may redirect input to a different VM each iteration */
active = g_repl_active_vm ? g_repl_active_vm : vm;
/* Unified prompt (FABRIC.md 4.4a): console_putc()'s existing per-line
/* Unified prompt (FABRIC-0.md 4.4a): console_putc()'s existing per-line
* "[VMName] " prefix (console.c, g_active_vm_name) already supplies the
* bracket -- print only "ok> " here, don't build a second one.
* emergency_console is no longer set from here (FABRIC-3.md §F.20/
* emergency_console is no longer set from here (FABRIC-2.md §F.20/
* §F.21: the emergency-CLI ACL bypass is retired) -- see sk_repl_
* step()'s matching comment above. FABRIC.md 4.4s (2026-09-04):
* step()'s matching comment above. FABRIC-0.md 4.4s (2026-09-04):
* sk_print_prompt() extends this with a "(user)" segment. */
sk_print_prompt();
@@ -897,7 +897,7 @@ void sk_repl_run(VM *vm)
void sk_repl(VM *vm)
{
/* FABRIC.md item 4.4j: boot and POST (both already returned by the time
/* FABRIC-0.md item 4.4j: boot and POST (both already returned by the time
* sk_repl() is called) stay on font_8x16.c/VT100 by design; the
* interactive REPL -- this function -- is the boundary where TTF-TEXT
* takes over. One-shot: console_fb_enable_ttf() no-ops on any later
src/starkernel/usb/blkio_usb.c
+1 -1
View File
@@ -92,7 +92,7 @@ static int usb_blk_info(blkio_dev_t *dev, blkio_info_t *out) {
out->phys_sector_size = s->scsi_block_size;
out->phys_size_bytes = (uint64_t)s->total_forth_blocks * BLKIO_FORTH_BLOCK_SIZE;
out->read_only = 0; /* WRITE(10) verified live end-to-end on amd64,
* 2026-08-28 (FABRIC-3.md §F.1): BLK-CONFIRM-FORMAT's
* 2026-08-28 (FABRIC-2.md §F.1): BLK-CONFIRM-FORMAT's
* BAM/reloc writes and an explicit content write both
* survived a cold reboot and read back correctly. */
return BLKIO_OK;
src/starkernel/virtio/virtio_input.c
+4 -4
View File
@@ -21,7 +21,7 @@
*
* Interrupt routing (source computation/enable) is arch-guarded below,
* riscv64 (PLIC) and aarch64 (GIC) each with their own slot/pin-to-source
* formula (FABRIC.md §27.5.1 aarch64, §27.5.2 riscv64, both derived live
* formula (FABRIC-0.md §27.5.1 aarch64, §27.5.2 riscv64, both derived live
* from this host's own QEMU DTB, not assumed identical to each other). The
* capability walk, feature negotiation, and queue/event handling are
* arch-agnostic and compiled for all three targets (same idiom as pci.c
@@ -260,7 +260,7 @@ static void *walk_virtio_caps(const PciDevice *d, uint8_t cap_type,
static inline void wmb(void) {
/* Compiler barrier only, same as virtio_blk.c -- reported not fixed
* there (FABRIC.md item 4.3.5e note); this item is the first place an
* there (FABRIC-0.md item 4.3.5e note); this item is the first place an
* interrupt-driven used-ring (device writes concurrently with the
* driver's re-post loop) leans on the ordering harder than blk's
* synchronous polled loop ever did. */
@@ -335,7 +335,7 @@ static int vinput_init_device(const PciDevice *pci) {
/* pci_enable() only sets IO/MEM/BUS_MASTER -- it never clears PCI
* COMMAND bit 10 (Interrupt Disable). If firmware left it set, INTx
* never asserts and every step below "succeeds" while producing zero
* real interrupts (FABRIC.md item 4.3.5c/4.3.5e note). Check and clear
* real interrupts (FABRIC-0.md item 4.3.5c/4.3.5e note). Check and clear
* explicitly. */
{
uint16_t cmd = pci_read16(pci, (uint16_t)PCI_CFG_COMMAND);
@@ -515,7 +515,7 @@ void virtio_input_isr(void) {
g_virtio_input_isr_count++;
/* Mandatory: reading ISR status is what deasserts the (level-triggered,
* per FABRIC.md §27.5.2's decoded interrupt-map flags) line. Skipping
* per FABRIC-0.md §27.5.2's decoded interrupt-map flags) line. Skipping
* this leaves the PLIC source's condition latched -- storm or hang,
* not a subtle bug (same finding 4.3.5e's plan flags). */
(void)*s->isr_status;
src/starkernel/vm/host/shim.c
+3 -3
View File
@@ -418,7 +418,7 @@ void sf_mutex_destroy(sf_mutex_t *mutex) {
* acquiring the mutex is always immediate and guaranteed to succeed.
*
* This no-op is correct only as long as nothing running in interrupt
* context mutates the structure a given lock protects (FABRIC.md §21.2,
* context mutates the structure a given lock protects (FABRIC-0.md §21.2,
* §25.1 item 0.9). If that ever stops being true, making this a real
* spinlock is not the fix: a single hart taking an interrupt while
* already holding the lock would spin against itself and deadlock. The
@@ -1107,7 +1107,7 @@ int puts(const char *s) { console_println(s ? s : ""); return 0; }
int putchar(int c) { console_putc((char)c); return c; }
/** @brief Kernel @c putc(): ignores stream, same as @c putchar(). GCC's -O2
* folds @c putchar(c) / @c fputc(c, stdout) call sites into @c putc(c, stdout)
* (FABRIC.md item 4.5d) -- this symbol was never needed at -O0 because that
* (FABRIC-0.md item 4.5d) -- this symbol was never needed at -O0 because that
* fold pass is inactive there. */
int putc(int c, FILE *stream) { (void)stream; return putchar(c); }
/** @brief Kernel @c fflush(): no-op (console writes are synchronous); returns 0. */
@@ -1246,7 +1246,7 @@ const unsigned short ** __ctype_b_loc(void) {
* servicing, no echo). See fgets()'s own doc comment on shim_console_vm(). */
int getchar(void) { return sk_console_getkey(shim_console_vm()); }
/** @brief Kernel @c getc(): ignores stream, same as @c getchar(). GCC's -O2
* folds @c getchar() call sites into @c getc(stdin) (FABRIC.md item 4.5d) --
* folds @c getchar() call sites into @c getc(stdin) (FABRIC-0.md item 4.5d) --
* this symbol was never needed at -O0 because that fold pass is inactive
* there. */
int getc(FILE *stream) { (void)stream; return getchar(); }
src/starkernel/vm/session.c
+1 -1
View File
@@ -22,7 +22,7 @@
*/
/**
* session.c - Per-VM session bookkeeping (FABRIC-3.md §H.12 steps 2-3)
* session.c - Per-VM session bookkeeping (FABRIC-2.md §H.12 steps 2-3)
*
* Slot table sized from stadium_max_vm_count() at session_boot_init() time,
* mirroring stadium.c's own StadiumVMQuota table (kmalloc'd to a
src/starkernel/vm/stadium.c
+14 -14
View File
@@ -41,7 +41,7 @@
#include "starkernel/q48_16.h" /* Q48_ONE -- item 4.1's reservoir starts each VM's quota at 1.0 */
#include "vm.h" /* VM_MEMORY_SIZE -- the per-VM footprint stadium_max_vm_count() budgets against */
#include "block_subsystem.h" /* blk_flush() -- STADIUM_BEHAVIOUR_MIGRATE's real write-back action */
#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-3.md §H.12 step 4 */
#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-2.md §H.12 step 4 */
static StadiumCell *stadium_cell_array = (StadiumCell *)0;
static uint8_t *stadium_bitmap = (uint8_t *)0;
@@ -72,7 +72,7 @@ static size_t link_to_size(uint32_t v) {
}
/*
* StadiumVMQuota - one VM's ownership record (item 3.7, FABRIC.md §22.3).
* StadiumVMQuota - one VM's ownership record (item 3.7, FABRIC-0.md §22.3).
* See stadium.h's stadium_admit() doc for why vm_id needs a linear search
* rather than direct indexing.
*/
@@ -80,7 +80,7 @@ typedef struct {
VMUuid vm_id;
int in_use;
size_t free_head;
uint64_t reservoir; /* item 4.1, FABRIC.md §17.7 -- Q48.16, heat this VM's
uint64_t reservoir; /* item 4.1, FABRIC-0.md §17.7 -- Q48.16, heat this VM's
* quota holds but no resident patron has claimed.
* Invariant: Σ(resident patron heat) + reservoir ==
* Q48_ONE, checked the same way vm_physics_conserved()
@@ -257,12 +257,12 @@ uint8_t *stadium_header_bitmap(void) {
* for a tag that exists is a build failure, not a silent gap -- the compiler
* enforces closedness, not just this comment.
*
* MIGRATE (blocks) is real, FABRIC-3.md §B: write-back via blk_flush(),
* MIGRATE (blocks) is real, FABRIC-2.md §B: write-back via blk_flush(),
* called with the departing patron's identity (the LBN) -- stadium_evict()
* calls this BEFORE zeroing the header, so `identity` is still valid here.
*
* DELIVER (Hermes messages) needs no extra payload action here, confirmed
* 2026-08-26 (FABRIC-3.md §B): capsules/hermes/init.4th's MSG-ALLOC already
* 2026-08-26 (FABRIC-2.md §B): capsules/hermes/init.4th's MSG-ALLOC already
* admits every message with this behaviour, and MSG-FREE-NODE (called from
* both explicit ack and heat-driven reap) already evicts it -- has been
* real and live on every boot for weeks. The actual delivery action
@@ -273,7 +273,7 @@ uint8_t *stadium_header_bitmap(void) {
* message's identity, same shape as MIGRATE's lbn print, instead of
* claiming to be unimplemented.
*
* COOL (words, item 4.1; VMs, FABRIC-3.md §B) needs no extra payload action
* COOL (words, item 4.1; VMs, FABRIC-2.md §B) needs no extra payload action
* here either, same reasoning as DELIVER: stadium_evict()'s own universal
* reservoir credit is the whole of what "cooling off the floor" means for
* both patron kinds -- real and live for both since item 4.1 and this
@@ -282,7 +282,7 @@ uint8_t *stadium_header_bitmap(void) {
* for a VM) instead of a misleading "(stub)" label.
*
* EXPIRE (ACL) alone remains genuinely unbuilt -- no ACL-Stadium
* integration of any kind exists yet (FABRIC-3.md §B).
* integration of any kind exists yet (FABRIC-2.md §B).
*/
void stadium_dispatch(size_t cell_index, StadiumBehaviour behaviour) {
console_puts("Stadium: dispatch cell=");
@@ -318,7 +318,7 @@ void stadium_dispatch(size_t cell_index, StadiumBehaviour behaviour) {
}
/*
* FABRIC.md §19.2/§19.3: density is heat / mass, read on demand from fields
* FABRIC-0.md §19.2/§19.3: density is heat / mass, read on demand from fields
* already in the header -- not a value a scheduler maintains. mass == 0
* (an empty or never-admitted slot; everything is zero-initialized until
* something is actually born into the Stadium, which nothing yet does)
@@ -336,7 +336,7 @@ uint64_t stadium_density(size_t cell_index) {
return header->heat / (uint64_t)header->mass;
}
/* STADIUM_FLAG_PIN moved to stadium.h (FABRIC-3.md §H.12 step 3) -- see its
/* STADIUM_FLAG_PIN moved to stadium.h (FABRIC-2.md §H.12 step 3) -- see its
* doc comment there for why. */
static int bitmap_get(size_t cell_index) {
@@ -352,7 +352,7 @@ static void bitmap_clear(size_t cell_index) {
}
/*
* FABRIC.md §17.2: reap means leaves the floor, not destroyed. Refuses a
* FABRIC-0.md §17.2: reap means leaves the floor, not destroyed. Refuses a
* pinned header (§3) or one with a non-none `contains` (item 1.1: a patron
* holding another cannot be reaped). Refuses an out-of-range index or a cell
* whose discriminator bit is not set -- nothing resident there to reap.
@@ -407,7 +407,7 @@ int stadium_evict(size_t cell_index) {
}
/*
* FABRIC.md §19.3, §22.3, item 3.7: admit into vm_id's own quota. Pops that
* FABRIC-0.md §19.3, §22.3, item 3.7: admit into vm_id's own quota. Pops that
* VM's free-list head first (O(1), no comparison needed -- §19.3's density
* rule only governs the full case). Only if that list is empty does this
* fall back to eviction, scoped to that SAME VM's own residents (quota
@@ -496,7 +496,7 @@ size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate) {
}
/*
* FABRIC.md item 4.1a: one-time initial quota grant, not item 1.3's
* FABRIC-0.md item 4.1a: one-time initial quota grant, not item 1.3's
* (still-unbuilt) recurring transfer. See stadium.h's doc for the full
* argument. Two passes over from_vm_id's free list: the first counts it
* (need the length before deciding where to split), the second detaches the
@@ -634,12 +634,12 @@ uint64_t stadium_resident_sum(VMUuid vm_id) {
}
/*
* FABRIC.md item 3.6 / item 4.1: see stadium.h's doc. Idempotent via the
* FABRIC-0.md item 3.6 / item 4.1: see stadium.h's doc. Idempotent via the
* item-3.1 discriminator bitmap -- if cell 0 already reads as resident,
* something already birthed her (or, if it isn't actually Hera, something
* else already claimed cell 0 -- either way this must not clobber it).
*
* FABRIC-3.md §H.12 step 4: pinning no longer happens by setting
* FABRIC-2.md §H.12 step 4: pinning no longer happens by setting
* STADIUM_FLAG_PIN on the candidate before admission -- session.c's
* session_set_pinned() is now the sole choke point for that bit (§H.10).
* Hera is admitted unpinned, then registered as session zero
src/starkernel/vm/stadium_blocks.c
+2 -2
View File
@@ -22,7 +22,7 @@
*/
/**
* stadium_blocks.c - Block patrons on the Stadium (FABRIC-3.md §B/§D,
* stadium_blocks.c - Block patrons on the Stadium (FABRIC-2.md §B/§D,
* MIGRATE punch-list item). See stadium_blocks.h for the design rationale.
*/
@@ -190,7 +190,7 @@ static size_t table_probe(int16_t quota_slot, uint32_t lbn, int *out_found) {
/*
* block_dispatch_pull - Reservoir pull for block-touch admission, same
* Q48_ONE / 3 floor stadium_word_dispatch()'s word_dispatch_pull() enforces
* and for the identical reason (FABRIC.md §25.5/§25.7): block-touch
* and for the identical reason (FABRIC-0.md §25.5/§25.7): block-touch
* admission alone must never be able to drain a VM's reservoir below the
* floor other reservoir consumers (word execution, application-level
* pulls) depend on. Own copy, not shared code across files -- same
src/starkernel/vm/stadium_words.c
+4 -4
View File
@@ -22,7 +22,7 @@
*/
/**
* stadium_words.c - Word patrons on the Stadium (FABRIC.md §17.3/§17.7,
* stadium_words.c - Word patrons on the Stadium (FABRIC-0.md §17.3/§17.7,
* punch list item 4.1). See stadium_words.h for the design rationale.
*/
@@ -42,7 +42,7 @@
* bookkeeping, separate from DictEntry.physics.last_decay_tick -- that field
* belongs to execution_heat's decay, which item 4.1 does not touch.
*
* item 4.2 fix (FABRIC.md §25.5): keyed by [quota slot][word_id], not just
* item 4.2 fix (FABRIC-0.md §25.5): keyed by [quota slot][word_id], not just
* word_id. word_id is assigned per-VM (vm->next_word_id in
* dictionary_management.c), not globally unique -- a single shared
* word_id -> cell_index map let two VMs' independently-numbered word_ids
@@ -129,7 +129,7 @@ static int cell_is_resident(size_t idx) {
/*
* word_dispatch_pull - Reservoir pull for word-execution admission, clamped
* to leave a floor for application-level use (FABRIC.md §25.5/§25.7,
* to leave a floor for application-level use (FABRIC-0.md §25.5/§25.7,
* Captain Bob's ruling 2026-08-06). Without this, stadium_word_dispatch()
* pulling STADIUM_WORD_HEAT_QUANTUM on every dispatch -- not just the first
* admission of a given word -- exhausts a VM's entire reservoir within
@@ -313,7 +313,7 @@ void stadium_words_print_boot_diagnostics(VMUuid vm_id) {
stadium_words_stats(vm_id, &promotions, &evictions);
/* item 4.2 fix (FABRIC.md §25.5): filtered per-VM -- with two VMs
/* item 4.2 fix (FABRIC-0.md §25.5): filtered per-VM -- with two VMs
* holding quotas, summing every resident cell regardless of owner
* (the pre-4.2 behavior) mixed both VMs' conservation totals together. */
resident_sum = stadium_resident_sum(vm_id);
src/starkernel/vm/vm_core.c
+1 -1
View File
@@ -698,7 +698,7 @@ void execute_colon_word(VM* vm)
physics_execution_heat_increment(w);
/* item 4.1, FABRIC.md §17.7: feed the Stadium's independent
/* item 4.1, FABRIC-0.md §17.7: feed the Stadium's independent
* conserved heat wire. execution_heat above is untouched by
* this call. item 4.2: dispatching VM's own identity, not the
* item-4.1 hardcoded vm_uuid_hera() -- refused harmlessly by
src/starkernel/vm/vm_runtime.c
+2 -2
View File
@@ -747,14 +747,14 @@ void vm_tick_inference_engine(VM* vm)
}
}
/* Punch-list item 0.8 / FABRIC.md §26: drive the physical re-arm
/* Punch-list item 0.8 / FABRIC-0.md §26: drive the physical re-arm
* period from this same execution-derived signal, ratio-preserving
* rescale onto the kernel's 10 ms base rather than the hosted
* HEARTBEAT_TICK_NS (10 µs) base -- see §26.3 for why the literal
* value cannot be used on bare-metal hardware. heartbeat.c clamps
* defensively on the way in, so no clamping is duplicated here.
*
* FABRIC-2.md, Category B "Multi-VM heartbeat ownership", ruled:
* FABRIC-1.md, Category B "Multi-VM heartbeat ownership", ruled:
* there is exactly one physical timer, so exactly one VM may write
* its period -- never a race between whichever VM's vm_tick() last
* ran. Hera is the fixed point everywhere else in this design
src/vm.c
+1 -1
View File
@@ -126,7 +126,7 @@ void vm_set_base(VM* vm, unsigned b)
* word's data field, so a pinned CONSTANT is not actually immutable against
* FORTH-level tampering. Keeping the value in a VM struct field with no
* corresponding FORTH store word closes that path entirely -- see
* FABRIC-3.md's Milestone 4 mint-then-pin writeup for the finding.
* FABRIC-2.md's Milestone 4 mint-then-pin writeup for the finding.
*
* @param vm VM instance.
* @param seed Ed25519 seed, 32 bytes (the private identity).
src/word_registry.c
+1 -1
View File
@@ -138,7 +138,7 @@ void register_forth79_words(VM *vm) {
register_framebuffer_words(vm); /* Module 28: Console fabric -- raw framebuffer primitives */
register_keyboard_words(vm); /* Module 29: Console fabric -- raw keyboard scancode diagnostic */
register_ttf_words(vm); /* Module 30: TrueType text entry point */
register_scroll_words(vm); /* Module 31: REPL scrollback (FABRIC.md 4.4q) */
register_scroll_words(vm); /* Module 31: REPL scrollback (FABRIC-0.md 4.4q) */
#ifdef __STARKERNEL__
register_doe_log_words(vm); /* Module 32: DoE instrumentation runtime toggle (HB-ON/HB-OFF) */
#endif
src/word_source/block_words.c
+3 -3
View File
@@ -58,7 +58,7 @@
#include <stdio.h>
#ifdef __STARKERNEL__
#include "starkernel/vm/stadium_blocks.h" /* stadium_block_dispatch() -- FABRIC-3.md §B */
#include "starkernel/vm/stadium_blocks.h" /* stadium_block_dispatch() -- FABRIC-2.md §B */
#endif
/* ----------------------------------------------------------------------
@@ -281,7 +281,7 @@ static vaddr_t blk_vm_assign(VM *vm, uint32_t lbn) {
* (block_word_save_buffers() below is a one-line wrapper) -- exposed
* (declared in block_words.h) so kernel-side code can reuse the exact
* same flush path outside the word-dispatch mechanism, e.g. sk_repl_idle()
* (see FABRIC.md/FABRIC-2.md Section V item 6). Cheap to call when
* (see FABRIC-0.md/FABRIC-1.md Section V item 6). Cheap to call when
* nothing is dirty: every check below is a small fixed-size scan
* (BLK_VM_SLOTS here, DISK_CACHE_SLOTS per device inside blk_flush()),
* no I/O happens unless something actually needs writing. */
@@ -551,7 +551,7 @@ void block_word_next_block(VM *vm) {
}
}
/* --- BMAPFMT block-ACL words (FABRIC-3.md §F.4/§H.6/§H.12 step 15) ----
/* --- BMAPFMT block-ACL words (FABRIC-2.md §F.4/§H.6/§H.12 step 15) ----
* Raw C-primitive accessors, matching the word-level ACL system's own
* split: policy is composed in FORTH on top of these (a new capsule,
* §H.12 step 16), not here. block_num validated the same way BLOCK/
src/word_source/framebuffer_words.c
+1 -1
View File
@@ -8,7 +8,7 @@
*/
/* framebuffer_words.c — raw framebuffer hardware-boundary FORTH words
* (FABRIC.md item 4.3.3). Kernel-only; no-op on hosted builds. */
* (FABRIC-0.md item 4.3.3). Kernel-only; no-op on hosted builds. */
#include "include/framebuffer_words.h"
#include "../../include/log.h"
src/word_source/include/framebuffer_words.h
+1 -1
View File
@@ -17,7 +17,7 @@
* @{
*
* @brief Raw hardware-boundary FORTH words for the Console drawing fabric
* (FABRIC.md item 4.3.3). Deliberately raster-native -- no Cartesian
* (FABRIC-0.md item 4.3.3). Deliberately raster-native -- no Cartesian
* awareness, no policy. That lives in capsules/fabric.4th instead, per the
* compose-in-FORTH-first rule.
*
src/word_source/include/keyboard_words.h
+4 -4
View File
@@ -17,9 +17,9 @@
* @{
*
* @brief Raw hardware-boundary FORTH word for verifying the interrupt-driven
* keyboard path (FABRIC.md item 4.3.5). Deliberately a diagnostic peek at
* keyboard path (FABRIC-0.md item 4.3.5). Deliberately a diagnostic peek at
* the raw scancode ring buffer -- no set-2 translation, no REPL wiring.
* Those belong to the later REPL keyboard-input work noted in FABRIC.md.
* Those belong to the later REPL keyboard-input work noted in FABRIC-0.md.
*
* Kernel-only, amd64-only today (i8042 is amd64 hardware); no-op elsewhere
* so dictionary parity across all three architectures is unaffected.
@@ -52,7 +52,7 @@
* on; KBD-SCAN/VKBD-EVENT remain as lower-level per-device diagnostics.
*
* @par ALT+TAB ( -- )
* FABRIC.md item 4.4y-revised. Programmatic equivalent of the physical
* FABRIC-0.md item 4.4y-revised. Programmatic equivalent of the physical
* Alt+TAB graphics/text toggle -- calls the same state-machine transition
* (console_fb_toggle_graphics() / vt100_toggle_graphics()) the keyboard
* interception in repl.c uses, so there is exactly one place the toggle
@@ -63,7 +63,7 @@
void register_keyboard_words(VM *vm);
/**
* FABRIC.md item 4.4v: shared C-level poll, one converged event stream
* FABRIC-0.md item 4.4v: shared C-level poll, one converged event stream
* (Linux input keycode namespace, all three architectures) -- see
* KEY-EVENT's doc comment above for the full per-arch translation
* rationale. Used by both kbw_key_event() (the FORTH word) and the REPL
src/word_source/include/scroll_words.h
+1 -1
View File
@@ -17,7 +17,7 @@
* @{
*
* @brief `SCROLL-BACK`/`SCROLL-FWD`, the REPL scrollback controls
* (FABRIC.md item 4.4q). Kernel-only; no-op on hosted builds (no
* (FABRIC-0.md item 4.4q). Kernel-only; no-op on hosted builds (no
* framebuffer console there).
*
* @par SCROLL-BACK ( n -- )
src/word_source/include/ttf_words.h
+1 -1
View File
@@ -16,7 +16,7 @@
* @defgroup ttf_words TrueType Text Words
* @{
*
* @brief `TTF-TEXT`, the TrueType-backed text entry point (FABRIC.md item
* @brief `TTF-TEXT`, the TrueType-backed text entry point (FABRIC-0.md item
* 4.3.7e). Kernel-only; no-op on hosted builds (no framebuffer/capsule
* system exists there).
*
src/word_source/keyboard_words.c
+3 -3
View File
@@ -7,7 +7,7 @@
Licensed under the StarForth License, Version 1.0
*/
/* keyboard_words.c — raw scancode-ring diagnostic word (FABRIC.md item
/* keyboard_words.c — raw scancode-ring diagnostic word (FABRIC-0.md item
* 4.3.5). Kernel-only, amd64-only; no-op elsewhere. */
#include "include/keyboard_words.h"
@@ -121,7 +121,7 @@ static void kbw_vdebug(VM *vm)
* field already lives in the same Linux keycode namespace; `value` is
* mapped 1:1 except autorepeat (value=2), folded into "still pressed"
* here since this checkpoint's shape only distinguishes press/release. */
/* FABRIC.md item 4.4v: shared C-level implementation, so the REPL
/* FABRIC-0.md item 4.4v: shared C-level implementation, so the REPL
* keyboard bridge (repl.c) and the KEY-EVENT FORTH word below poll the
* exact same converged event stream rather than each re-deriving the
* per-arch translation kbw_key_event's own doc comment already explains
@@ -166,7 +166,7 @@ static void kbw_key_event(VM *vm)
}
}
/* ALT+TAB ( -- ): FABRIC.md item 4.4y-revised. Programmatic equivalent of
/* ALT+TAB ( -- ): FABRIC-0.md item 4.4y-revised. Programmatic equivalent of
* the physical Alt+TAB interception (repl.c's sk_kbd_getc()) -- both call
* console_fb_toggle_graphics(), so there is exactly one state-machine
* transition, invoked two ways. */
src/word_source/q48_16_words.c
+1 -1
View File
@@ -418,7 +418,7 @@ q48_16_t q48_sqrt_approx(q48_16_t q)
* Approximation: Sine / Cosine (Integer-Only, Taylor Series)
* ============================================================================
*
* FABRIC.md item 4.3.3a -- needed by the Console drawing fabric's
* FABRIC-0.md item 4.3.3a -- needed by the Console drawing fabric's
* CIRCLE/ARC/ELLIPSE (item 4.3.3b). Radian input, same Taylor-series
* approach as q48_exp_approx above.
*
src/word_source/scroll_words.c
+1 -1
View File
@@ -7,7 +7,7 @@
Licensed under the StarForth License, Version 1.0
*/
/* scroll_words.c — REPL scrollback entry points (FABRIC.md item 4.4q).
/* scroll_words.c — REPL scrollback entry points (FABRIC-0.md item 4.4q).
* Kernel-only; no-op on hosted builds. */
#include "include/scroll_words.h"
src/word_source/starforth_words.c
+1 -1
View File
@@ -793,7 +793,7 @@ static void starforth_word_zuse_authenticate(VM *vm)
vm->zuse_session = 1;
}
/* ZUSE-SESSION? ( -- flag ) Read-only diagnostic (FABRIC-3.md §F.21,
/* ZUSE-SESSION? ( -- flag ) Read-only diagnostic (FABRIC-2.md §F.21,
* added 2026-08-28): confirms whether ZUSE-AUTHENTICATE has actually run
* this boot. No corresponding write access -- matches ZUSE-PUBKEY@'s own
* read-only-window convention. */
src/word_source/ttf_words.c
+1 -1
View File
@@ -7,7 +7,7 @@
Licensed under the StarForth License, Version 1.0
*/
/* ttf_words.c — TrueType text entry point (FABRIC.md item 4.3.7e).
/* ttf_words.c — TrueType text entry point (FABRIC-0.md item 4.3.7e).
* Kernel-only; no-op on hosted builds. */
#include "include/ttf_words.h"