Stage S-1c: WORD's buffer is per VM; input buffers allotted at VM init, below all compiled code (FABRIC-3.9.0 §8.1)

- The static word_scratch_addr shared by every VM is gone: WORD builds in
  vm->word_buf (257 bytes: count + 255 + NUL). A token over 255 chars is
  refused whole (delimiter restored, >IN unconsumed, vm->error), logged at
  LOG_ERROR and counted -- no more silent cut to 62 chars.
- Pre-existing corruption found by the probe: TIB/>IN/SPAN (and WORD's
  scratch) were allotted lazily at HERE; POST's restore_dict_state(),
  FORGET and COLD rolled HERE below them and compiled the dictionary over
  them (Hera's TIB lay under ACL-RECHECK's body; QUERY/WORD wrote into
  code). Per Captain Bob, all four are now allotted first in both
  vm_init()s (offsets 0-1305); COLD's clamp never goes below them.

Probe (reverted), identical on amd64/aarch64/riscv64: 0 colon bodies inside
the buffers; per-VM isolation; 62/100/255-char tokens full length; 300
refused and counted; interpreter sane after full-width TIB writes.
3-ISA acceptance passes; M7.1a hash and dict_hash set unchanged (here
0xd8 -> 0x5f8).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

include/vm.h

@@ -155,6 +155,9 @@ static inline cell_t CELL(vaddr_t a) { return (cell_t)(int64_t)a; }
 #define WORD_ID_INVALID UINT32_MAX
 #define VM_MEMORY_SIZE (5 * 1024 * 1024)  /* 5 MB total VM memory */
 #define INPUT_BUFFER_SIZE 1025
+/* WORD's buffer: a count byte, up to 255 chars (the most a counted string can
+ * hold -- a format limit, not a chosen bound), and a trailing NUL. */
+#define WORD_BUFFER_SIZE 257
 #define WORD_NAME_MAX 31
 #define COMPILE_BUFFER_SIZE 1024
 
@@ -562,6 +565,11 @@ typedef struct VM
     size_t tib_cap; /* capacity in bytes */
     cell_t* in_var; /* >IN (legacy; will migrate to VM addr) */
     cell_t* span_var; /* SPAN (legacy; will migrate to VM addr) */
+    /* FABRIC-3.9.0.md §8.1 (Stage S-1c): WORD's counted-string buffer, one per
+     * VM, allotted with the TIB (vm_input_ensure()). Was a single static
+     * shared by every VM, allotted in the first caller's space wherever HERE
+     * happened to be, 64 bytes, silently truncating tokens to 62 chars. */
+    unsigned char* word_buf;
 
     /* Block system (VM-backed variables / addresses) */
     vaddr_t scr_addr;