feat(v4.0.0): the node tells its kernel of its words; the boot seals the system

ENGINE.md 3b, the node's side of ruling A (a word's code is the node's, its
accounts the kernel's).

- dict.v4, system.v4: (WORD-DEFINED) ( xt -- ) is run when an entry is
  made, (WORD-FORGOTTEN) ( w -- ) when FORGET or COLD removes entries; with
  0 there no one is told, as on the hosted product
- test_host_quit.c: a kernel that keeps the list of words and is checked to
  hold exactly the node's dictionary after definitions, a vocabulary, an
  abandoned definition, FORGET, a refused FORGET and COLD; KERNEL-WORD
  called from the prompt and from a definition

Fixed, found while writing that test: since the capsules moved from build
time to boot time (294e6946), what COLD returns to and FORGET protects was
still the nucleus alone, so COLD lost U*, U/MOD and BYE and FORGET U* was
allowed.  The boot now seals the system when it has loaded it
(v4_image_seal), and hosted-check checks COLD, the capsule word after it,
the refused FORGET and BYE.

Verified: make -C v4 test passes at both widths (1283 checks in
test_host_quit.c); hosted-check passes on three ISAs; clean qemu with
STARFORTH_V4=1 on amd64, aarch64 and riscv64 passes POST, and COLD, U*
after it, FORGET U* (refused), an unserved kernel word and BYE typed at
each prompt are answered correctly (logs/20261005-193045, -193307, -193636).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v4/capsule/dict.v4

@@ -38,6 +38,8 @@
 \   DBASE DLIMIT   byte addresses of the start and end of dictionary space
 \   PAD       byte address of the scratch area for strings, 84 bytes or more
 \   (D)       word address of five cells of scratch for this file
+\   (WORD-DEFINED) (WORD-FORGOTTEN)   word addresses of two variables: see
+\             "telling the kernel" below
 \ PAD is in line.
 
 macro 4*  2* 2*  endmacro
@@ -123,6 +125,26 @@ header SMUDGE
 header HIDDEN
 : HIDDEN ( -- )   LATEST if NONE  (FLAGS) a! @ 2 OR  ! ;   NONE: drop ;
 
+\ ---- telling the kernel (docs/v4.0.0/ENGINE.md 3b) ------------------------------
+\ A word's code is here on the node; its accounts are a record its kernel
+\ keeps.  So the kernel has to be told of every entry that is made and of
+\ every entry that goes.  An entry is made in one place, (HEADER); entries go
+\ in two, FORGET and COLD (system.v4).  Each tells through a variable that
+\ holds the xt of a word to run, or 0 for a node whose host keeps no records:
+\   (WORD-DEFINED)     ( xt -- )   an entry has been made; its code will be at xt
+\   (WORD-FORGOTTEN)   ( w -- )    every entry at word address w or above is gone
+\ On the bare-metal system the kernel puts words of its own there.
+
+\ ( -- )   tell of the entry just made, whose code starts at HERE
+: (DEFINED)
+  (WORD-DEFINED) b! @b if NONE  HERE SWAP push ;
+  NONE: drop ;
+
+\ ( w -- )   tell that the entries from word address w up have gone
+: (FORGOTTEN)
+  (WORD-FORGOTTEN) b! @b if NONE  push ;
+  NONE: drop drop ;
+
 \ ---- making an entry -------------------------------------------------------
 \ (D)+0 where the name starts   (D)+1 the name being looked up
 \ (D)+2 the name being copied, or the entry being looked at
@@ -154,7 +176,8 @@ header HIDDEN
   P: DP b! @b 3 and if ALIGNED  drop 0 C,  jump P
   ALIGNED: drop
   0 ,  (D) a! @ ,  LATEST ,
-  HERE CURRENT a! @ a! ! ;
+  HERE CURRENT a! @ a! !
+  jump (DEFINED)
   FULL: drop ;                               \ (DP+) has set NODE-ERROR
   EMPTY: drop  NODE-ERROR b! 6 !b ;             \ name missing
 

v4/capsule/quit.v4

@@ -89,6 +89,8 @@ macro R-CLEAR   RSTACK-DEPTH b! a !b   endmacro
 \ its own) and the line ends with ERROR.  The codes are listed in core.v4.
 header NODE-ERROR inline    : NODE-ERROR'   NODE-ERROR ;
 header (CATCH) inline       : (CATCH)'      (CATCH) ;
+header (WORD-DEFINED) inline    : (WORD-DEFINED)'    (WORD-DEFINED) ;
+header (WORD-FORGOTTEN) inline  : (WORD-FORGOTTEN)'  (WORD-FORGOTTEN) ;
 header (EMIT-HOOK) inline   : (EMIT-HOOK)'  (EMIT-HOOK) ;
 
 header QUIT

v4/capsule/system.v4

@@ -102,8 +102,9 @@ header FORGET
   PRUNED: drop
   CONTEXT a! @ (Q) a! @ inv + 1 + -if C1  drop jump C2
   C1: drop  (LATEST) CONTEXT a! !
-  C2: CURRENT a! @ (Q) a! @ inv + 1 + -if C3  drop ;
-  C3: drop  (LATEST) CURRENT a! ! ;
+  C2: CURRENT a! @ (Q) a! @ inv + 1 + -if C3  drop jump TOLD
+  C3: drop  (LATEST) CURRENT a! !
+  TOLD: (Q) a! @  jump (FORGOTTEN)           \ the kernel's records of them go too (dict.v4)
   MISSING: drop  (UNKNOWN) drop ;
 
 \ ---- the system as a whole -------------------------------------------------------
@@ -142,6 +143,7 @@ header COLD
   (BOOT) a! @ 2/ 2/  FENCE a! !
   (LATEST) CONTEXT a! !  (LATEST) CURRENT a! !  0 VOC-LINK a! !
   10 BASE a! !  0 SCR a! !  2 (LOG-LEVEL) a! !  0 (ACL-HOOK) a! !  EMPTY-BUFFERS
+  (BOOT) a! @ 2/ 2/  (FORGOTTEN)             \ the kernel's records of what has gone go too (dict.v4)
   $54524F46 (EMIT4) $39372D48 (EMIT4) $6C6F4320 (EMIT4) $74532064 (EMIT4) $747261 (EMIT4) CR
   $74737953 (EMIT4) $69206D65 (EMIT4) $6974696E (EMIT4) $7A696C61 (EMIT4) $2E6465 (EMIT4) CR
   jump ABORT