FABRIC-3.8.md Stage B: kernel-side idle loop in the switch trampoline

sk_vm_switch_entry() stops being the Stage-2 placeholder bounce and becomes
every switch participant's own idle loop: it drains one of its own
kernel-Hermes messages per pass, on its own native stack (driven by the drain's
return value, so a non-consuming drain cannot spin), and when nothing is
drained it marks the VM parked_idle and yields back. It is entirely OS-driven,
with no VM-side yield word. sk_hermes_drain_checkpoint() gains a per-VM
hermes_draining guard so a payload's own in-word checkpoint cannot drain a
second message inside the first. Still inert in normal operation: nothing
marks work until Stage C.

Finding fixed here: amd64 sk_vm_switch_prime built the first-entry frame at
top-56, entering with rsp 16-aligned instead of the SysV-required 8 mod 16, so
the first aligned SSE spill in a callee took #GP (logs/20260923-142526, kept).
It had been latent since SXXVIII Stage 2 because the placeholder never called
anything. The frame is now at top-64 with a zeroed pad slot. aarch64 and
riscv64 were already correct.

Evidence: a temporary kernel_main probe (reverted, not in this commit) queued
two messages to Hestia, the first calling a colon word, and switched into her.
It passed on all three ISAs: 0 pending, parked_idle, depth 0, context saved on
her own stack, SB-SEQ=12 (drained one at a time, not nested), ledger and
stadium_conserved restored. Formal acceptance without the probe on all three
ISAs: dict_hash identical and unchanged, zero UNKNOWN WORD or faults, and the
live WIREBIND mint -> USE -> 1 2 + . -> 3 relay.

FABRIC-3.8.md also records Captain Bob's rulings that no VM-side word ever gives
up control and that multitasking is a compudynamic hybrid, and opens SS3.12
(VM frames for per-VM execution state).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/starkernel/arch/amd64/switch.S

@@ -68,7 +68,16 @@ sk_vm_switch_to:
     .global sk_vm_switch_prime
 sk_vm_switch_prime:
     mov rax, rdi
-    sub rax, 56
+    /* FABRIC-3.8.md Stage B finding (2026-09-23): was `sub rax, 56`, which
+     * entered `entry` with rsp == stack_top (16-byte aligned). SysV requires
+     * rsp == 8 (mod 16) at function entry (as if a `call` had just pushed a
+     * return address); off by 8, any compiler-emitted aligned SSE spill in
+     * the entry function's callees #GPs. Latent through Stage 2 because the
+     * placeholder trampoline never called anything that spilled; found live
+     * the moment the trampoline started draining (vm_interpret()). 64 leaves
+     * a zeroed pad slot above the entry address so entry sees rsp = top-8. */
+    sub rax, 64
+    mov qword ptr [rax+56], 0    /* pad: the fake caller's slot, never used */
     mov qword ptr [rax+0],  0    /* r15 */
     mov qword ptr [rax+8],  0    /* r14 */
     mov qword ptr [rax+16], 0    /* r13 */

src/starkernel/vm/kernel_hermes.c

@@ -589,6 +589,11 @@ int sk_hermes_drain_checkpoint(VM *vm) {
     if (!vm) return -1;
     if (sk_hermes_pending_total == 0) return 0; /* fast path -- see this
                                                   * counter's own doc comment */
+    /* FABRIC-3.8.md §3.3 (Stage B): one drain at a time per VM. A payload
+     * this function is already interpreting for `vm` runs at vm's own
+     * depth 1, so its in-word checkpoint (vm_core.c) would otherwise drain
+     * a SECOND message inside the first one's execution. */
+    if (vm->hermes_draining) return 0;
 
     self = vm->stadium_vm_id;
     msg  = sk_hermes_pending_peek(self);
@@ -651,7 +656,12 @@ int sk_hermes_drain_checkpoint(VM *vm) {
 
     vm->mode = MODE_INTERPRET; /* a payload is never compiled into whatever
                                 * the enclosing context was mid-defining */
+    vm->hermes_draining = 1;   /* FABRIC-3.8.md §3.3 -- set only once a message
+                                * is actually in hand (every earlier return
+                                * above leaves it untouched), cleared on the
+                                * single path out below */
     vm_interpret(vm, (const char *)msg->payload_addr);
+    vm->hermes_draining = 0;
     drain_error = vm->error;
 
     memcpy(vm->input_buffer, saved_input, sizeof(saved_input));

src/starkernel/vm/switch.c

@@ -30,6 +30,8 @@
 #include "starkernel/vm/switch.h"
 #include "vm.h"
 #include "starkernel/capsule_birth.h" /* capsule_vm_set_state */
+#include "starkernel/vm/kernel_hermes.h" /* FABRIC-3.8.md §3.2 -- sk_hermes_drain_checkpoint() */
+#include "starkernel/hal/hal.h" /* sk_hal_panic() */
 #include <stdint.h>
 
 /* Arch-specific (switch.S in each arch dir). sk_vm_switch_prime() builds
@@ -97,10 +99,46 @@ void sk_vm_switch_set_current(VM *vm) { g_switch_current_vm = vm; }
  * itself, independent of vm_interpret()'s own attribution bookkeeping.
  * This placeholder's behavior is therefore unchanged from Stage 2.
  */
+/*
+ * FABRIC-3.8.md §3.2 (Stage B, 2026-09-23): the placeholder above is
+ * superseded -- this trampoline is now every switch participant's own
+ * kernel-side idle loop, the base of its native stack. Entirely OS-driven:
+ * nothing a VM executes decides to give up control (Captain Bob: "no
+ * special words saying I'm giving up control... strictly all operating
+ * system and strictly all compudynamically driven"). Each pass:
+ *
+ *   - Drain one of this VM's own kernel-Hermes messages, in its own
+ *     context, on its own stack (sk_hermes_drain_checkpoint() at depth 0
+ *     here, so the payload runs at this VM's depth 1 and its own word
+ *     checkpoints pass the Stage A ownership gate).
+ *   - If nothing was drained, this VM has no work: mark it parked-idle
+ *     (§3.5 -- nothing borrowed on its stack, nothing in progress) and
+ *     yield back to whoever switched in.
+ *
+ * Driven off the drain's return value, never a separate pending-count
+ * probe: any path where a drain returns without consuming a message would
+ * otherwise spin here forever with no word checkpoint to break it --
+ * indistinguishable from a switch storm. A failed yield is a kernel
+ * invariant violation, not something to retry, so it panics loudly.
+ *
+ * Deliberately NOT here yet (FABRIC-3.8.md §3.11, a Stage C design
+ * question): this point between messages is also a clean switch point
+ * (own stack, depth 0), and the compudynamic switch decision should be
+ * consulted here too, so a VM with a queue of checkpoint-free payloads
+ * cannot hold the CPU indefinitely.
+ */
 void sk_vm_switch_entry(void) {
     VM *self = g_switch_entry_vm;
     for (;;) {
-        sk_vm_context_switch(self, self->native_switch_back_to);
+        if (sk_hermes_drain_checkpoint(self) != 0) {
+            continue; /* consumed one message (1 = ok, -1 = payload erred) */
+        }
+        self->parked_idle = 1;
+        if (!self->native_switch_back_to ||
+            sk_vm_context_switch(self, self->native_switch_back_to) != 0) {
+            sk_hal_panic("switch trampoline: idle yield failed");
+        }
+        self->parked_idle = 0; /* resumed: someone switched back in */
     }
 }