FABRIC-3.10.8 §5: MC-1 plan -- split per ISA (MC-1a amd64 + core table, MC-1b aarch64, MC-1c riscv64)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

FABRIC-3.10.8.md

@@ -804,3 +804,36 @@ The ledger reads pulled 319488 / returned 316703 on all three. That is the K-3 b
 **Found, not fixed:** MC-0b's three older lock reports (recursion, bad release, held at switch) go through `log_message()` only, so they are cut at 64 bytes and lose the lock name and site. None fired in any run here.
 
 **K-11 closes the "lock order checked by inspection only" finding.** With K-9..K-11, every ruling from K-8's report is carried out.
+
+## 5. MC-1 — bringing up the extra cores (plan, 2026-09-26)
+
+**Rulings (Captain Bob, 2026-09-26):**
+- **Multi-core (MC-1..MC-3) comes before the O-D DoE** (confirming MC-R6).
+- **MC-1 is split per ISA:** MC-1a (the shared core table, plus amd64), MC-1b (aarch64), MC-1c (riscv64). Each gets its own commit and 3-ISA acceptance. QEMU's `-smp 2` is turned on for an ISA only when its bring-up lands.
+
+**Common to every ISA (built in MC-1a):**
+- **Core ids are dense and logical.** Core 0 is the boot core, whatever its APIC id, MPIDR or hartid. The hardware id is recorded in the block beside the logical one and never reaches the lock owner word (`core_id + 1`).
+- **The core table** (`hal/smp.c`) is sized from enumeration and heap-allocated. It has no `MAX_CPUS`. Each extra core gets a heap-allocated `sk_percpu_t` and a 16 KiB stack.
+- **The block is handed to the core in its entry path,** and the per-CPU register is set **before any C code**. `sk_percpu_ready` is already 1, so it cannot guard a secondary core.
+- **In MC-1 a secondary core does no console, log or heap work.** It stores a readback of its per-CPU register into its block, marks itself online with a release store, then **parks**: interrupts masked, a `hlt`/`wfi` loop that counts every wake.
+- **The boot core brings the cores up one at a time.** It waits under a time bound (1 s, on the raw counter, as K-6 does), then prints the core's line, or prints that it did not come online and carries on.
+- **Park wakes are reported at the idle point** only when they change, like the lock report: a core that never wakes prints nothing.
+- **No new FORTH word.** The dict_hash set stays at the K-10 baseline.
+- **Bring-up runs in `kernel_main_deep()`** right after the heartbeat init, with interrupts still off on the boot core.
+
+**MC-1a, amd64:**
+- **Enumeration:** the MADT's enabled Local APIC entries (type 0, and type 9 x2APIC). The boot core is skipped by its own LAPIC ID.
+- **Trampoline:** one position-independent 4 KiB blob, copied into a page chosen from the UEFI memory map (conventional memory below 1 MiB, never page 0). The SIPI vector is that page's number.
+  - **Data block:** patched at run time with the trampoline's own GDT (flat 32-bit code and data, 64-bit code) and its far pointers.
+  - **Control state copied from the boot core:** CR0, CR3, CR4, EFER (for NXE), IA32_PAT, and XCR0 when CR4.OSXSAVE is set.
+  - **Also patched in:** the kernel's GDTR and IDTR, the core's block, its stack, and the C entry point.
+  - **Path:** real mode → protected mode → long mode. It loads the kernel GDT and IDT, reloads the segment registers, then writes IA32_GS_BASE (in that order, because a GS reload clears the base) and calls the C entry.
+  - **Limit, recorded for SER5:** CR3 must lie below 4 GiB, because it is loaded in 32-bit mode.
+- **Start sequence:** INIT, wait 10 ms, SIPI, wait 200 µs, SIPI, polling the ICR delivery-status bit (xAPIC MMIO, as the timer already uses).
+- **QEMU:** `-smp 2` on the `make qemu` amd64 invocation only. `qemu-esp` and `qemu-gdb` are unchanged.
+
+**MC-1a evidence (named in advance):**
+- **amd64, `-smp 2`:** the boot prints 2 cores found in the MADT. Core 1's line gives its logical id 1, its APIC id, its block address, and its GS readback, which equals its own block and differs from core 0's. It came online within the bound, with the time taken.
+- **Parked, not spinning:** no park-wake line in the whole run. On the host, core 1's QEMU vCPU thread sits near 0% CPU (`ps -L`), if TCG gives it its own thread.
+- **aarch64 and riscv64:** they report 1 core and are otherwise unchanged.
+- **Standard sequence on all three:** the K-10 dict_hash set, G A=40 B=40 byte-identical (still one worker core), all ok `3`, 0 B idle growth.