Rename FABRIC series: FABRIC.md->0, FABRIC-2.md->1, FABRIC-3.md->2, FABRIC-4.md unchanged

FABRIC.md -> FABRIC-0.md
FABRIC-2.md -> FABRIC-1.md
FABRIC-3.md -> FABRIC-2.md (the current/living document)
FABRIC-4.md unchanged (new #3 to follow separately)

Every cross-reference repo-wide updated to match, including doc-comment
citations inside kernel source (.c/.h) files -- done via an ordered
placeholder substitution (FABRIC-3.md->placeholder2, FABRIC-2.md->
placeholder1, FABRIC.md->placeholder0, then placeholders resolved to
final names) in a single pass per file to avoid double-shifting
already-renamed references.

One line in capsules/font.4th grew past the 64-char block-format limit
as a side effect of the longer filename; shortened it and reverified
with mkcapsule --lint (34/34 pass) before rebuilding.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after the fix; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

src/starkernel/vm/host/shim.c

@@ -418,7 +418,7 @@ void sf_mutex_destroy(sf_mutex_t *mutex) {
  * acquiring the mutex is always immediate and guaranteed to succeed.
  *
  * This no-op is correct only as long as nothing running in interrupt
- * context mutates the structure a given lock protects (FABRIC.md §21.2,
+ * context mutates the structure a given lock protects (FABRIC-0.md §21.2,
  * §25.1 item 0.9). If that ever stops being true, making this a real
  * spinlock is not the fix: a single hart taking an interrupt while
  * already holding the lock would spin against itself and deadlock. The
@@ -1107,7 +1107,7 @@ int puts(const char *s) { console_println(s ? s : ""); return 0; }
 int putchar(int c) { console_putc((char)c); return c; }
 /** @brief Kernel @c putc(): ignores stream, same as @c putchar(). GCC's -O2
  *  folds @c putchar(c) / @c fputc(c, stdout) call sites into @c putc(c, stdout)
- *  (FABRIC.md item 4.5d) -- this symbol was never needed at -O0 because that
+ *  (FABRIC-0.md item 4.5d) -- this symbol was never needed at -O0 because that
  *  fold pass is inactive there. */
 int putc(int c, FILE *stream) { (void)stream; return putchar(c); }
 /** @brief Kernel @c fflush(): no-op (console writes are synchronous); returns 0. */
@@ -1246,7 +1246,7 @@ const unsigned short ** __ctype_b_loc(void) {
  *  servicing, no echo). See fgets()'s own doc comment on shim_console_vm(). */
 int getchar(void) { return sk_console_getkey(shim_console_vm()); }
 /** @brief Kernel @c getc(): ignores stream, same as @c getchar(). GCC's -O2
- *  folds @c getchar() call sites into @c getc(stdin) (FABRIC.md item 4.5d) --
+ *  folds @c getchar() call sites into @c getc(stdin) (FABRIC-0.md item 4.5d) --
  *  this symbol was never needed at -O0 because that fold pass is inactive
  *  there. */
 int getc(FILE *stream) { (void)stream; return getchar(); }

src/starkernel/vm/session.c

@@ -22,7 +22,7 @@
  */
 
 /**
- * session.c - Per-VM session bookkeeping (FABRIC-3.md §H.12 steps 2-3)
+ * session.c - Per-VM session bookkeeping (FABRIC-2.md §H.12 steps 2-3)
  *
  * Slot table sized from stadium_max_vm_count() at session_boot_init() time,
  * mirroring stadium.c's own StadiumVMQuota table (kmalloc'd to a

src/starkernel/vm/stadium.c

@@ -41,7 +41,7 @@
 #include "starkernel/q48_16.h" /* Q48_ONE -- item 4.1's reservoir starts each VM's quota at 1.0 */
 #include "vm.h" /* VM_MEMORY_SIZE -- the per-VM footprint stadium_max_vm_count() budgets against */
 #include "block_subsystem.h" /* blk_flush() -- STADIUM_BEHAVIOUR_MIGRATE's real write-back action */
-#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-3.md §H.12 step 4 */
+#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-2.md §H.12 step 4 */
 
 static StadiumCell *stadium_cell_array   = (StadiumCell *)0;
 static uint8_t      *stadium_bitmap       = (uint8_t *)0;
@@ -72,7 +72,7 @@ static size_t link_to_size(uint32_t v) {
 }
 
 /*
- * StadiumVMQuota - one VM's ownership record (item 3.7, FABRIC.md §22.3).
+ * StadiumVMQuota - one VM's ownership record (item 3.7, FABRIC-0.md §22.3).
  * See stadium.h's stadium_admit() doc for why vm_id needs a linear search
  * rather than direct indexing.
  */
@@ -80,7 +80,7 @@ typedef struct {
     VMUuid   vm_id;
     int      in_use;
     size_t   free_head;
-    uint64_t reservoir; /* item 4.1, FABRIC.md §17.7 -- Q48.16, heat this VM's
+    uint64_t reservoir; /* item 4.1, FABRIC-0.md §17.7 -- Q48.16, heat this VM's
                           * quota holds but no resident patron has claimed.
                           * Invariant: Σ(resident patron heat) + reservoir ==
                           * Q48_ONE, checked the same way vm_physics_conserved()
@@ -257,12 +257,12 @@ uint8_t *stadium_header_bitmap(void) {
  * for a tag that exists is a build failure, not a silent gap -- the compiler
  * enforces closedness, not just this comment.
  *
- * MIGRATE (blocks) is real, FABRIC-3.md §B: write-back via blk_flush(),
+ * MIGRATE (blocks) is real, FABRIC-2.md §B: write-back via blk_flush(),
  * called with the departing patron's identity (the LBN) -- stadium_evict()
  * calls this BEFORE zeroing the header, so `identity` is still valid here.
  *
  * DELIVER (Hermes messages) needs no extra payload action here, confirmed
- * 2026-08-26 (FABRIC-3.md §B): capsules/hermes/init.4th's MSG-ALLOC already
+ * 2026-08-26 (FABRIC-2.md §B): capsules/hermes/init.4th's MSG-ALLOC already
  * admits every message with this behaviour, and MSG-FREE-NODE (called from
  * both explicit ack and heat-driven reap) already evicts it -- has been
  * real and live on every boot for weeks. The actual delivery action
@@ -273,7 +273,7 @@ uint8_t *stadium_header_bitmap(void) {
  * message's identity, same shape as MIGRATE's lbn print, instead of
  * claiming to be unimplemented.
  *
- * COOL (words, item 4.1; VMs, FABRIC-3.md §B) needs no extra payload action
+ * COOL (words, item 4.1; VMs, FABRIC-2.md §B) needs no extra payload action
  * here either, same reasoning as DELIVER: stadium_evict()'s own universal
  * reservoir credit is the whole of what "cooling off the floor" means for
  * both patron kinds -- real and live for both since item 4.1 and this
@@ -282,7 +282,7 @@ uint8_t *stadium_header_bitmap(void) {
  * for a VM) instead of a misleading "(stub)" label.
  *
  * EXPIRE (ACL) alone remains genuinely unbuilt -- no ACL-Stadium
- * integration of any kind exists yet (FABRIC-3.md §B).
+ * integration of any kind exists yet (FABRIC-2.md §B).
  */
 void stadium_dispatch(size_t cell_index, StadiumBehaviour behaviour) {
     console_puts("Stadium: dispatch cell=");
@@ -318,7 +318,7 @@ void stadium_dispatch(size_t cell_index, StadiumBehaviour behaviour) {
 }
 
 /*
- * FABRIC.md §19.2/§19.3: density is heat / mass, read on demand from fields
+ * FABRIC-0.md §19.2/§19.3: density is heat / mass, read on demand from fields
  * already in the header -- not a value a scheduler maintains. mass == 0
  * (an empty or never-admitted slot; everything is zero-initialized until
  * something is actually born into the Stadium, which nothing yet does)
@@ -336,7 +336,7 @@ uint64_t stadium_density(size_t cell_index) {
     return header->heat / (uint64_t)header->mass;
 }
 
-/* STADIUM_FLAG_PIN moved to stadium.h (FABRIC-3.md §H.12 step 3) -- see its
+/* STADIUM_FLAG_PIN moved to stadium.h (FABRIC-2.md §H.12 step 3) -- see its
  * doc comment there for why. */
 
 static int bitmap_get(size_t cell_index) {
@@ -352,7 +352,7 @@ static void bitmap_clear(size_t cell_index) {
 }
 
 /*
- * FABRIC.md §17.2: reap means leaves the floor, not destroyed. Refuses a
+ * FABRIC-0.md §17.2: reap means leaves the floor, not destroyed. Refuses a
  * pinned header (§3) or one with a non-none `contains` (item 1.1: a patron
  * holding another cannot be reaped). Refuses an out-of-range index or a cell
  * whose discriminator bit is not set -- nothing resident there to reap.
@@ -407,7 +407,7 @@ int stadium_evict(size_t cell_index) {
 }
 
 /*
- * FABRIC.md §19.3, §22.3, item 3.7: admit into vm_id's own quota. Pops that
+ * FABRIC-0.md §19.3, §22.3, item 3.7: admit into vm_id's own quota. Pops that
  * VM's free-list head first (O(1), no comparison needed -- §19.3's density
  * rule only governs the full case). Only if that list is empty does this
  * fall back to eviction, scoped to that SAME VM's own residents (quota
@@ -496,7 +496,7 @@ size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate) {
 }
 
 /*
- * FABRIC.md item 4.1a: one-time initial quota grant, not item 1.3's
+ * FABRIC-0.md item 4.1a: one-time initial quota grant, not item 1.3's
  * (still-unbuilt) recurring transfer. See stadium.h's doc for the full
  * argument. Two passes over from_vm_id's free list: the first counts it
  * (need the length before deciding where to split), the second detaches the
@@ -634,12 +634,12 @@ uint64_t stadium_resident_sum(VMUuid vm_id) {
 }
 
 /*
- * FABRIC.md item 3.6 / item 4.1: see stadium.h's doc. Idempotent via the
+ * FABRIC-0.md item 3.6 / item 4.1: see stadium.h's doc. Idempotent via the
  * item-3.1 discriminator bitmap -- if cell 0 already reads as resident,
  * something already birthed her (or, if it isn't actually Hera, something
  * else already claimed cell 0 -- either way this must not clobber it).
  *
- * FABRIC-3.md §H.12 step 4: pinning no longer happens by setting
+ * FABRIC-2.md §H.12 step 4: pinning no longer happens by setting
  * STADIUM_FLAG_PIN on the candidate before admission -- session.c's
  * session_set_pinned() is now the sole choke point for that bit (§H.10).
  * Hera is admitted unpinned, then registered as session zero

src/starkernel/vm/stadium_blocks.c

@@ -22,7 +22,7 @@
  */
 
 /**
- * stadium_blocks.c - Block patrons on the Stadium (FABRIC-3.md §B/§D,
+ * stadium_blocks.c - Block patrons on the Stadium (FABRIC-2.md §B/§D,
  * MIGRATE punch-list item). See stadium_blocks.h for the design rationale.
  */
 
@@ -190,7 +190,7 @@ static size_t table_probe(int16_t quota_slot, uint32_t lbn, int *out_found) {
 /*
  * block_dispatch_pull - Reservoir pull for block-touch admission, same
  * Q48_ONE / 3 floor stadium_word_dispatch()'s word_dispatch_pull() enforces
- * and for the identical reason (FABRIC.md §25.5/§25.7): block-touch
+ * and for the identical reason (FABRIC-0.md §25.5/§25.7): block-touch
  * admission alone must never be able to drain a VM's reservoir below the
  * floor other reservoir consumers (word execution, application-level
  * pulls) depend on. Own copy, not shared code across files -- same

src/starkernel/vm/stadium_words.c

@@ -22,7 +22,7 @@
  */
 
 /**
- * stadium_words.c - Word patrons on the Stadium (FABRIC.md §17.3/§17.7,
+ * stadium_words.c - Word patrons on the Stadium (FABRIC-0.md §17.3/§17.7,
  * punch list item 4.1). See stadium_words.h for the design rationale.
  */
 
@@ -42,7 +42,7 @@
  * bookkeeping, separate from DictEntry.physics.last_decay_tick -- that field
  * belongs to execution_heat's decay, which item 4.1 does not touch.
  *
- * item 4.2 fix (FABRIC.md §25.5): keyed by [quota slot][word_id], not just
+ * item 4.2 fix (FABRIC-0.md §25.5): keyed by [quota slot][word_id], not just
  * word_id. word_id is assigned per-VM (vm->next_word_id in
  * dictionary_management.c), not globally unique -- a single shared
  * word_id -> cell_index map let two VMs' independently-numbered word_ids
@@ -129,7 +129,7 @@ static int cell_is_resident(size_t idx) {
 
 /*
  * word_dispatch_pull - Reservoir pull for word-execution admission, clamped
- * to leave a floor for application-level use (FABRIC.md §25.5/§25.7,
+ * to leave a floor for application-level use (FABRIC-0.md §25.5/§25.7,
  * Captain Bob's ruling 2026-08-06). Without this, stadium_word_dispatch()
  * pulling STADIUM_WORD_HEAT_QUANTUM on every dispatch -- not just the first
  * admission of a given word -- exhausts a VM's entire reservoir within
@@ -313,7 +313,7 @@ void stadium_words_print_boot_diagnostics(VMUuid vm_id) {
 
     stadium_words_stats(vm_id, &promotions, &evictions);
 
-    /* item 4.2 fix (FABRIC.md §25.5): filtered per-VM -- with two VMs
+    /* item 4.2 fix (FABRIC-0.md §25.5): filtered per-VM -- with two VMs
      * holding quotas, summing every resident cell regardless of owner
      * (the pre-4.2 behavior) mixed both VMs' conservation totals together. */
     resident_sum = stadium_resident_sum(vm_id);

src/starkernel/vm/vm_core.c

@@ -698,7 +698,7 @@ void execute_colon_word(VM* vm)
 
             physics_execution_heat_increment(w);
 
-            /* item 4.1, FABRIC.md §17.7: feed the Stadium's independent
+            /* item 4.1, FABRIC-0.md §17.7: feed the Stadium's independent
              * conserved heat wire. execution_heat above is untouched by
              * this call. item 4.2: dispatching VM's own identity, not the
              * item-4.1 hardcoded vm_uuid_hera() -- refused harmlessly by

src/starkernel/vm/vm_runtime.c

@@ -747,14 +747,14 @@ void vm_tick_inference_engine(VM* vm)
             }
         }
 
-        /* Punch-list item 0.8 / FABRIC.md §26: drive the physical re-arm
+        /* Punch-list item 0.8 / FABRIC-0.md §26: drive the physical re-arm
          * period from this same execution-derived signal, ratio-preserving
          * rescale onto the kernel's 10 ms base rather than the hosted
          * HEARTBEAT_TICK_NS (10 µs) base -- see §26.3 for why the literal
          * value cannot be used on bare-metal hardware. heartbeat.c clamps
          * defensively on the way in, so no clamping is duplicated here.
          *
-         * FABRIC-2.md, Category B "Multi-VM heartbeat ownership", ruled:
+         * FABRIC-1.md, Category B "Multi-VM heartbeat ownership", ruled:
          * there is exactly one physical timer, so exactly one VM may write
          * its period -- never a race between whichever VM's vm_tick() last
          * ran. Hera is the fixed point everywhere else in this design