Robert Allan JamesandClaude Sonnet 5
2b1ba031a5
sk_hermes_drain_checkpoint() interprets one queued payload per checkpoint (ruled: one message per checkpoint), reusing sk_vm_at_outermost_interpret() and placed before the switch-signal block in vm_core.c's existing cooperative checkpoint (sk_vm_context_switch() doesn't return until switched back to, so drain must come first or it silently never runs on a switching checkpoint). Amends FABRIC-3.5.md SXLIII.5, caught by advisor() before writing the naive version: "recursive drain is prevented for free" via g_vm_interpret_depth is true but only for same-message re-drain -- it doesn't cover the separate same-VM reentrancy hazard FABRIC-3.md SXX already named for Hera specifically (VMCallState saves rsp/exit_colon/ ecw_nesting only, never input_buffer/input_length/input_pos). Draining calls vm_interpret() on the same vm whose own vm_interpret() call is still paused mid-word at the checkpoint; without saving and restoring the cursor by hand, the enclosing REPL line or LOAD block would be silently truncated. sk_hermes_drain_checkpoint() snapshots and restores input_buffer/input_length/input_pos/mode/error/abort_requested around the call. Not a divergence from the ruling -- cursor preservation is the implementer's own obligation inside the ruled mechanism. Gated behind a system-wide pending-total counter so the common no-message-in-flight case costs one integer read per word dispatch, not a stadium_max_vm_count()-sized queue scan (also flagged by advisor() as a real hot-path cost, not deferred). Verified live on all three architectures: a self-test publishes a real payload to Hermes, proves the depth gate via VM-EXEC-ing an existing harmless colon word into Hermes (genuine nested vm_interpret(), depth 2, must not drain), then drains directly from genuinely-outermost context and confirms exactly one clean drain. dict_hash unmoved and identical across architectures. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
src/starkernel/vm/
Kernel-side StarForth VM subsystem.
vm_core.c— kernel port of the core interpreter loop.vm_runtime.c— kernel VM runtime support.vm_bootstrap.c— kernel VM bootstrap (distinct frombootstrap/sk_vm_bootstrap.c, which owns the higher-level subsystem wiring called fromkernel_main.c).arena.c— capsule arena allocator (fixed-region allocation for capsule payload data).parity.c— birth/execution parity logging (VM ID + capsule hash + dictionary hash), enabling offline determinism verification.alloc_kernel.c— the kernel-side implementation of the VM's allocator interface actually referenced byMakefile.starkernel's build (seesrc/platform/README.mdfor a note on a second, unwired copy).q48_stubs.c— deliberate no-op stubs forq48_from_double()/q48_to_double()in the freestanding kernel build, where floating point is unavailable; always returns zero, safe because shared VM code only uses these results for logging/diagnostic paths that are inactive in the kernel build.vm_internal.h— internal-only declarations shared across this directory's files.
Subdirectories:
bootstrap/sk_vm_bootstrap.c— owns VM init + capsule loading wiring, called fromkernel_main.c;kernel_main.citself only owns hardware milestones.host/shim.c— host-service shim bridging the kernel VM tosrc/starkernel/hal/host_services.c.