feat(v4.0.0): the stacks are guarded (D-16); DEPTH, PICK and ROLL

Ruled 2026-10-04, revising D-2: stack overflow and underflow are errors
that are shown and return to the prompt, not silent wrap-around.

- Each stack counts what it holds.  Before every opcode the executor
  checks that the stacks hold what it takes and have room for what it
  leaves; otherwise the opcode does nothing and the node faults, as for a
  bad address, to that kind's handler.  Every fault empties both stacks.
- The fault handler is now a table of five jumps: address, data overflow,
  data underflow, return overflow, return underflow.  The host node says
  "Stack overflow", "Stack underflow", "Return stack overflow",
  "Return stack underflow", then ERROR and the prompt.
- Two registers, DSTACK-DEPTH and RSTACK-DEPTH: a fetch reads the depth,
  a store empties the stack.  QUIT, ABORT and the error exits empty the
  return stack before they call anything; ABORT empties the data stack.
- capsule/forth.v4: DEPTH, PICK and ROLL, to FORTH-79 (counting from
  one).  PICK and ROLL set the values above the one wanted aside in
  memory, and work with the stack full.
- Division by zero now takes its operands off the stack, as v3 does.
- A colon with no room for its entry abandons the line.
- tests: every opcode at every depth of both stacks; the faults, the
  registers and the three words from the prompt.

The sizes are unchanged: ten values, nine return entries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v4/src/stack.c

@@ -33,6 +33,7 @@ void v4_dstack_reset(v4_dstack *st)
     st->t = 0;
     st->s = 0;
     st->head = 0;
+    st->depth = 0;
     for (unsigned i = 0; i < V4_DATA_RING; i++) st->ring[i] = 0;
     v4_guard_fill(st->guard_head, V4_DATA_BOUND, V4_GUARD_PATTERN_HEAD);
     v4_guard_fill(st->guard_tail, V4_DATA_BOUND, V4_GUARD_PATTERN_TAIL);
@@ -50,14 +51,19 @@ void v4_dstack_push(v4_dstack *st, v4_cell x)
     st->s = st->t;
     st->t = x;
     st->head = (st->head + 1u) % V4_DATA_RING;
+    if (st->depth < V4_DATA_DEPTH) st->depth++;
 }
 
+void v4_dstack_clear(v4_dstack *st) { st->depth = 0; }
+void v4_rstack_clear(v4_rstack *st) { st->depth = 0; }
+
 v4_cell v4_dstack_pop(v4_dstack *st)
 {
     v4_cell x = st->t;
     st->t = st->s;
     st->head = (st->head + V4_DATA_RING - 1u) % V4_DATA_RING;
     st->s = st->ring[st->head];
+    if (st->depth > 0) st->depth--;
     return x;
 }
 
@@ -75,6 +81,7 @@ void v4_rstack_reset(v4_rstack *st)
 {
     st->r = 0;
     st->head = 0;
+    st->depth = 0;
     for (unsigned i = 0; i < V4_RET_RING; i++) st->ring[i] = 0;
     v4_guard_fill(st->guard_head, V4_RET_BOUND, V4_GUARD_PATTERN_HEAD);
     v4_guard_fill(st->guard_tail, V4_RET_BOUND, V4_GUARD_PATTERN_TAIL);
@@ -91,6 +98,7 @@ void v4_rstack_push(v4_rstack *st, v4_cell x)
     st->ring[st->head] = st->r;
     st->r = x;
     st->head = (st->head + 1u) % V4_RET_RING;
+    if (st->depth < V4_RET_DEPTH) st->depth++;
 }
 
 v4_cell v4_rstack_pop(v4_rstack *st)
@@ -98,6 +106,7 @@ v4_cell v4_rstack_pop(v4_rstack *st)
     v4_cell x = st->r;
     st->head = (st->head + V4_RET_RING - 1u) % V4_RET_RING;
     st->r = st->ring[st->head];
+    if (st->depth > 0) st->depth--;
     return x;
 }