Stage D batch 3: fix silent error sites in vm_core.c, incl. the two highest-value primitives; two real NULL-deref bugs found and fixed (FABRIC-3.md §XXXII.6)

All 13 silent vm->error=1 sites in vm_core.c now log a diagnostic
first: vm_enter_compile_mode, vm_compile_word, vm_compile_literal,
vm_compile_call, vm_exit_compile_mode, execute_colon_word (2 sites
each/combined), and the four fundamental memory primitives
vm_load_u8/vm_store_u8/vm_load_cell/vm_store_cell.

Found and fixed two real NULL-pointer-dereference risks while adding
the diagnostics: vm_compile_call() and vm_exit_compile_mode() each had
a combined `if (!vm || <cond>) { vm->error = 1; ... }` guard that
dereferenced vm->error even on the !vm branch of its own condition.
Split both, and applied the same defensive split to the four memory
primitives since vm_ptr()/vm_addr_ok() both tolerate vm==NULL
internally.

Live-verified, amd64: 999999999 @ . recovers correctly at Zuse's own
console (Stage A's mechanism holds), but the new vm_load_cell
diagnostic itself didn't print -- traced to memory_words.c's own
redundant, still-silent vm_addr_ok() pre-check in memory_word_fetch()
(and the same shape in memory_word_store()), which intercepts before
ever reaching vm_load_cell(). memory_words.c is vendored, out of this
initiative's scope, spun off to FABRIC-4.md -- recorded as a concrete
cross-reference for that future work rather than left to be
rediscovered.

Three-arch clean qemu acceptance passed, full POST suite included.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K

src/starkernel/vm/vm_core.c

@@ -495,6 +495,7 @@ void vm_enter_compile_mode(VM* vm, const char* name, size_t len)
     vm->compiling_word = de;
     if (!de)
     {
+        log_message(LOG_ERROR, ": vm_create_word failed for '%.*s'", (int)len, name);
         vm->error = 1;
         return;
     }
@@ -505,6 +506,7 @@ void vm_enter_compile_mode(VM* vm, const char* name, size_t len)
     cell_t* df = vm_dictionary_get_data_field(de);
     if (!df)
     {
+        log_message(LOG_ERROR, ": no data field for '%.*s'", (int)len, name);
         vm->error = 1;
         return;
     }
@@ -518,6 +520,7 @@ void vm_compile_word(VM* vm, DictEntry* entry)
     if (!vm || vm->mode != MODE_COMPILE) return;
     if (!entry)
     {
+        log_message(LOG_ERROR, "vm_compile_word: NULL entry");
         vm->error = 1;
         return;
     }
@@ -525,6 +528,7 @@ void vm_compile_word(VM* vm, DictEntry* entry)
     cell_t* slot = (cell_t*)vm_allot(vm, sizeof(cell_t));
     if (!slot)
     {
+        log_message(LOG_ERROR, "vm_compile_word: vm_allot failed");
         vm->error = 1;
         return;
     }
@@ -554,6 +558,7 @@ void vm_compile_literal(VM* vm, cell_t value)
     cell_t* val = (cell_t*)vm_allot(vm, sizeof(cell_t));
     if (!val)
     {
+        log_message(LOG_ERROR, "vm_compile_literal: vm_allot failed");
         vm->error = 1;
         return;
     }
@@ -562,8 +567,15 @@ void vm_compile_literal(VM* vm, cell_t value)
 
 void vm_compile_call(VM* vm, word_func_t func)
 {
-    if (!vm || vm->mode != MODE_COMPILE)
+    /* FABRIC-3.md §XXXII.6, 2026-09-15: split from the original combined
+     * `if (!vm || vm->mode != MODE_COMPILE) { vm->error = 1; ... }` guard
+     * -- that form dereferenced vm->error even on the !vm branch of its
+     * own condition, a real NULL-pointer-deref risk found while adding
+     * this diagnostic, not just a missing message. */
+    if (!vm) return;
+    if (vm->mode != MODE_COMPILE)
     {
+        log_message(LOG_ERROR, "vm_compile_call: not in compile mode");
         vm->error = 1;
         return;
     }
@@ -592,8 +604,12 @@ void vm_compile_exit(VM* vm)
 
 void vm_exit_compile_mode(VM* vm)
 {
-    if (!vm || !vm->compiling_word)
+    /* Split from the original `if (!vm || !vm->compiling_word)` guard --
+     * same NULL-deref risk as vm_compile_call() above (§XXXII.6). */
+    if (!vm) return;
+    if (!vm->compiling_word)
     {
+        log_message(LOG_ERROR, "vm_exit_compile_mode: no compiling word (unbalanced ';'?)");
         vm->error = 1;
         return;
     }
@@ -718,6 +734,8 @@ void execute_colon_word(VM* vm)
     cell_t* df = vm_dictionary_get_data_field(entry);
     if (!df)
     {
+        log_message(LOG_ERROR, "execute_colon_word: no data field for '%.*s'",
+                    (int)entry->name_len, entry->name);
         vm->error = 1;
         return;
     }
@@ -727,6 +745,8 @@ void execute_colon_word(VM* vm)
     cell_t* ip = (cell_t*)vm_ptr(vm, body_addr);
     if (!ip)
     {
+        log_message(LOG_ERROR, "execute_colon_word: bad body address for '%.*s'",
+                    (int)entry->name_len, entry->name);
         vm->error = 1;
         return;
     }
@@ -1213,11 +1233,24 @@ uint8_t* vm_ptr(struct VM* vm, vaddr_t addr)
     return vm->memory + (size_t)addr;
 }
 
+/* FABRIC-3.md §XXXII.6, 2026-09-15: all four of these previously
+ * dereferenced vm->error after a failed vm_ptr()/vm_addr_ok() call --
+ * both of those tolerate vm==NULL internally (returning NULL/0), so a
+ * NULL vm reaching any of these four would have crashed on the error
+ * report itself, the same NULL-deref shape already found and fixed in
+ * vm_compile_call()/vm_exit_compile_mode() above. Each now guards `!vm`
+ * first, and reports the genuinely common case -- a bad/misaligned
+ * address from an ordinary interactive `@ ! C@ C!` -- with a diagnostic
+ * these four calls' sheer reach (every FORTH word built on them) makes
+ * the highest-value fix in this whole audit (§XXXII.3). */
+
 uint8_t vm_load_u8(struct VM* vm, vaddr_t addr)
 {
+    if (!vm) return 0;
     uint8_t* p = vm_ptr(vm, addr);
     if (!p)
     {
+        log_message(LOG_ERROR, "vm_load_u8: bad address %lu", (unsigned long)addr);
         vm->error = 1;
         return 0;
     }
@@ -1226,9 +1259,11 @@ uint8_t vm_load_u8(struct VM* vm, vaddr_t addr)
 
 void vm_store_u8(struct VM* vm, vaddr_t addr, uint8_t v)
 {
+    if (!vm) return;
     uint8_t* p = vm_ptr(vm, addr);
     if (!p)
     {
+        log_message(LOG_ERROR, "vm_store_u8: bad address %lu", (unsigned long)addr);
         vm->error = 1;
         return;
     }
@@ -1237,8 +1272,10 @@ void vm_store_u8(struct VM* vm, vaddr_t addr, uint8_t v)
 
 cell_t vm_load_cell(struct VM* vm, vaddr_t addr)
 {
+    if (!vm) return 0;
     if (!vm_addr_ok(vm, addr, sizeof(cell_t)) || (addr % sizeof(cell_t)) != 0)
     {
+        log_message(LOG_ERROR, "vm_load_cell: bad/misaligned address %lu", (unsigned long)addr);
         vm->error = 1;
         return 0;
     }
@@ -1249,8 +1286,10 @@ cell_t vm_load_cell(struct VM* vm, vaddr_t addr)
 
 void vm_store_cell(struct VM* vm, vaddr_t addr, cell_t v)
 {
+    if (!vm) return;
     if (!vm_addr_ok(vm, addr, sizeof(cell_t)) || (addr % sizeof(cell_t)) != 0)
     {
+        log_message(LOG_ERROR, "vm_store_cell: bad/misaligned address %lu", (unsigned long)addr);
         vm->error = 1;
         return;
     }