Stage K-3: drain and channel-open policy self-tests retargeted to Hestia (FABRIC-3.10.8 §4.3)

- Both looked up the retired Hermes VM and printed SKIPPED on every boot.
  Drain test: target Hestia, nested VM-EXEC of "1 DROP". Policy test:
  Hestia is the no-policy VM (never loads ACL.4th). A missing target now
  prints FAIL, not SKIPPED.
- Both PASS on amd64/aarch64/riscv64; standard sequence passes (hash, G,
  MINT/WIREBIND/USE, conserved, 0 idle growth). Ledger baseline now
  pulled 262144 / returned 259359 (the drain test's real message).
- Found, not fixed: ARTEMIS-ANNOUNCE-READY, doe_log's "Hermes" heat
  column and CONNECT-HERMES still reference the retired Hermes VM.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

FABRIC-3.10.8.md

@@ -512,3 +512,29 @@ The results are identical on all three ISAs:
 - The ledger totals (pulled 262144 / returned 259359) are higher than the usual line only because the probe worker's messages are counted; held and consumed are unchanged, and `stadium_conserved(self)=true`.
 - The hosted `make` builds.
 - **K-2 closes §8 defects 1 and 2.**
+
+### 4.3 K-3 — the two skipped self-tests (2026-09-26)
+
+**Change** (`kernel_main.c`). Both self-tests looked up a VM named "Hermes", which hasn't existed since the Phase 4 reshuffle, so both printed `SKIPPED` on every boot. Both now use **Hestia**:
+- **Drain self-test:** the target is Hestia. The nested depth-2 check (which must not drain) `VM-EXEC`s a harmless `1 DROP` into her from Hera, in place of Hermes's `WELCOME` word. The outermost drain must take exactly the one message.
+- **Channel-open policy self-test:** Hestia is the no-policy VM. Like the old Hermes VM she never loads `ACL.4th` (`capsules/hestia/init.4th` loads fabric, font and lib only), so she has no `HERMES-CHANNEL-OPEN?` and must be refused closed.
+- A missing target now prints `FAIL`, not `SKIPPED`.
+
+**Evidence:** both self-tests print **PASS** on all three ISAs, and no `SKIPPED` line appears for either.
+
+**Standard sequence.** All three ISAs pass: hash `0x99b01134c3d3049c`, G byte-identical, MINT / WIREBIND / USE / `1 2 + .` → `3`, 0 B idle growth, 0 UNKNOWN and 0 faults.
+
+| ISA | log |
+|---|---|
+| amd64 | `logs/20260926-031446` |
+| aarch64 | `logs/20260926-032735` |
+| riscv64 | `logs/20260926-034037` |
+
+**The ledger line's baseline moves from here on:** pulled 262144 and returned 259359, from 258048 and 255263. The drain self-test now really publishes and drains one message, which adds one message cell's pull and return. Held (2048) and consumed (737) are unchanged, and conservation holds.
+
+**Found, not fixed:** three more references to the retired Hermes VM.
+1. `capsules/artemis/init.4th` block 4129, `ARTEMIS-ANNOUNCE-READY`, `VM-EXEC`s `2 ENQUEUE-READY` into "Hermes".
+2. `doe_log.c:207` reads a per-row "Hermes" heat column (`doe_log_heat_by_name("Hermes")`).
+3. The `CONNECT-HERMES` word (`mama_forth_words.c` ~2257) still births and names a Hermes VM.
+
+**K-3 closes §8 defect 4.**

src/starkernel/kernel_main.c

@@ -1458,6 +1458,11 @@ static void kernel_main_deep(BootInfo *boot_info) {
      * disk-backed state (`block_subsystem.c`) that a throwaway
      * diagnostic has no business touching -- VM-EXEC's cross-VM nesting
      * proves the same depth gate without it. */
+    /* FABRIC-3.10.8 K-3: retargeted from the Hermes VM, which no longer
+     * exists (the test printed SKIPPED on every boot since the Phase 4
+     * reshuffle), to Hestia -- a live Tripod VM with a genuine dictionary.
+     * The nested call VM-EXECs a harmless "1 DROP" into her instead of
+     * Hermes's WELCOME word. Same assertions otherwise. */
     {
         VMUuid pub_id3, hermes_id;
         VMRegistryEntry hermes_drain_entry;
@@ -1469,9 +1474,9 @@ static void kernel_main_deep(BootInfo *boot_info) {
         pub_id3.lo = 11;
 
         console_puts("Kernel-Hermes drain self-test: ");
-        if (capsule_vm_find_by_name_nocase("Hermes", &hermes_drain_entry) != 0 ||
+        if (capsule_vm_find_by_name_nocase("Hestia", &hermes_drain_entry) != 0 ||
             hermes_drain_entry.state != VM_STATE_LIVE || !hermes_drain_entry.vm_ptr) {
-            console_println("SKIPPED (Hermes not live)");
+            console_println("FAIL (Hestia not live)");
         } else {
             hermes_id = hermes_drain_entry.vm_id;
             grant_rc  = stadium_grant_quota(pub_id3, vm_uuid_hera());
@@ -1487,7 +1492,7 @@ static void kernel_main_deep(BootInfo *boot_info) {
 
                 /* Nested (depth 2 during VM-EXEC's own call): must not drain. */
                 if (drain_ok) {
-                    vm_interpret(mama, "S\" WELCOME\" S\" Hermes\" VM-EXEC");
+                    vm_interpret(mama, "S\" 1 DROP\" S\" Hestia\" VM-EXEC");
                     if (mama->error) { mama->error = 0; drain_ok = 0; }
                 }
                 if (drain_ok && sk_hermes_pending_count(hermes_id) != 1) drain_ok = 0;
@@ -1764,6 +1769,10 @@ static void kernel_main_deep(BootInfo *boot_info) {
      * wires the policy result straight into sk_hermes_channel_respond()
      * (task 3.6) end to end: a denied policy really produces a NACK and
      * no channel, exactly like task 3.6's own deny path. */
+    /* FABRIC-3.10.8 K-3: the no-policy VM is now Hestia -- like the Hermes
+     * VM this used, she never loads ACL.4th (capsules/hestia/init.4th loads
+     * fabric/font/lib only), so she has no HERMES-CHANNEL-OPEN? word. The
+     * Hermes VM no longer exists, so this printed SKIPPED on every boot. */
     {
         VMRegistryEntry hera_pol_entry, hermes_pol_entry;
         VMUuid requester_pol;
@@ -1773,9 +1782,9 @@ static void kernel_main_deep(BootInfo *boot_info) {
 
         console_puts("Kernel-Hermes channel-open policy self-test: ");
         if (capsule_vm_find_by_name_nocase("Hera", &hera_pol_entry) != 0 || !hera_pol_entry.vm_ptr ||
-            capsule_vm_find_by_name_nocase("Hermes", &hermes_pol_entry) != 0 ||
+            capsule_vm_find_by_name_nocase("Hestia", &hermes_pol_entry) != 0 ||
             hermes_pol_entry.state != VM_STATE_LIVE || !hermes_pol_entry.vm_ptr) {
-            console_println("SKIPPED (Hera/Hermes not available)");
+            console_println("FAIL (Hera/Hestia not available)");
         } else {
             VM *hera_vm = (VM *)hera_pol_entry.vm_ptr;
             VM *hermes_vm = (VM *)hermes_pol_entry.vm_ptr;