Stage O-C: the event-driven DoE driver -- DOE returns to the prompt, EV-DONE chains the trials, MU-WAIT-ALL deleted (FABRIC-3.9.0 §3/§7.4)

- DOE sets up, JOINs EV-DONE and starts trial 1, then returns. Each trial
  births and sends WL-RUN only; completion arrives as the OS's EV-DONE.
- ON-DONE counts this campaign's own workers while active; the last one
  ends the trial (KILL all, marker, persist) and starts the next, or
  finishes (HB-OFF, UNJOIN, MU-CAMPAIGN: complete). MU-WAIT-ALL is gone;
  the start/end cycle goes through MU-END-XT.
- WL-DONE-ARGS removed from all ten workload capsules; lint passes.

Smoke campaign (amd64, 1 rep, rows off per Captain Bob): DOE returns, the
prompt answers mid-trial, all 6 trials chain on events, fail=0 each,
28/28 born/killed/departed, MU-CAMPAIGN: complete in ~61 min. Standard
sequence passes on all three ISAs (with the xHCI fix it exposed, df150e86).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

FABRIC-3.9.8.md

@@ -1,6 +1,6 @@
 # FABRIC-3.9.8.md — Observers and participants: execution plan and log
 
-**Status: IN PROGRESS.** Done: O-A, the stack-convention fix, S-1a, S-1b, S-1c, M-0, M-A, the dead-VM departure fix, M-B and O-B (§2). The design and
+**Status: IN PROGRESS.** Done: O-A, the stack-convention fix, S-1a, S-1b, S-1c, M-0, M-A, the dead-VM departure fix, M-B, O-B, the xHCI fix and O-C (§2). The design and
 its rulings (O-1 to O-4, the discard, and §7/§8's M- and S- rulings) are in `FABRIC-3.9.0.md`.
 
 Each stage:
@@ -799,3 +799,53 @@ Evidence is named **before** each stage runs.
       **Process note.** During the investigation, a `make clean` for amd64 was run while that
       ISA's QEMU was up. It deleted the running QEMU's control sockets; that QEMU was stopped with
       SIGTERM, since no QMP socket was left, and its log was discarded as flawed.
+- [x] **Stage O-C — the event-driven DoE driver (`FABRIC-3.9.0.md` §3, as revised by §7.4).**
+      2026-09-25. Captain Bob: *"go ahead with O-C"*. On the smoke run's length: *"Rows off, full 6
+      trials."* Capsule only.
+
+      **The change** (`multiuser-doe.4th`, `per-isa-doe.4th`, `workload-0..9.4th`):
+      - **`DOE` starts trial 1 and returns to the prompt.** `MU-EXEC-CAMPAIGN` sets up (seed,
+        shuffled matrix, `HB-ON`), `JOIN`s `EV-DONE`, sets `MU-ACTIVE`, and starts the trial.
+      - **A trial starts and returns.** `MU-START-TRIAL` births the workers, sends each its job, and
+        returns.
+      - **The job text is just `WL-RUN`.** It has no `SEND` and no `WL-DONE-ARGS`. A worker's
+        completion reaches Hera as the OS's own `EV-DONE` (M-B).
+      - **`ON-DONE ( c-addr u -- )`**, Hera's handler, counts only while a campaign is active, and
+        only its own workers (`mu0`–`mu7`). The last one runs `MU-END-TRIAL`: `KILL` all, the
+        marker, persist, then the next trial, or `MU-FINISH` (`HB-OFF`, `EV-DONE UNJOIN`,
+        `MU-CAMPAIGN: complete`).
+      - **`MU-WAIT-ALL` is deleted.** The start → send → end → start cycle is broken in definition
+        order through `MU-END-XT`, an execution token stored after `MU-END-TRIAL` is defined.
+      - **A failed send** still counts as done and as a fail (`MU-FAIL-COUNT`), and the end check
+        runs after all sends.
+      - **`WL-DONE-ARGS` is gone** from all ten workload capsules. `mkcapsule --lint` passes on all
+        37 capsules.
+
+      **Evidence: smoke campaign, amd64, 1 rep = 6 cells, heartbeat rows off.** Ruled because rows
+      on, serial output at about 20 rows/s would stretch the smoke to about a day. That rows-on
+      attempt is `logs/20260924-230814/amd64/`: `DOE` returned and the prompt answered mid-trial,
+      stopped by choice after 20 minutes. The rows-off runs are `logs/20260925-013706/amd64/`, and
+      again on the fixed kernel in `-090302`:
+      - `12345 1 S" amd64" DOE HB-OFF` returns to the prompt immediately.
+      - `1 2 + .` typed mid-trial gives `3`.
+      - All 6 trials chain on `EV-DONE` events alone: `cfg=5 nw=8`, `cfg=1 nw=2`, `cfg=4 nw=8`,
+        `cfg=3 nw=4`, `cfg=2 nw=4`, `cfg=0 nw=2`. Every one is `fail=0`, and then
+        `MU-CAMPAIGN: complete`, in about 61 minutes.
+      - 28/28 births, 28/28 `KILL … dead`, 28/28 `HERMES: mu… departed`. Zero `UNKNOWN WORD`s, zero
+        faults.
+      - Afterwards `.CHANNELS` shows the event channels empty, and `EV-DROPPED` and `MU-ACTIVE`
+        both read `0`.
+
+      "Hera's rows during trials are only event handling" was named in the plan, but it can't be
+      shown with rows off. It belongs with O-D's rows-on run.
+
+      **Found by this stage:** the standard sequence after the campaign crashed, which turned out to
+      be the pre-existing xHCI heap corruption. That was fixed and committed separately (entry
+      above). On the fixed kernel, the campaign followed by O-A, `MINT`, unplug and re-attach passes
+      (`-090302`).
+
+      **Standard sequence, all three ISAs** (`logs/20260925-101854/amd64/`, `-103145/aarch64/`,
+      `-104448/riscv64/`, on the tree carrying both the xHCI fix and O-C's capsules):
+      - boot parity and the `dict_hash` set unchanged;
+      - the O-A checks pass;
+      - mint → WIREBIND → `USE` → `3`, idle growth 0, no faults.