capsule_vm_kill() and capsule_vm_force_reap() never touched kernel-Hermes: a dead VM stayed a member of channel 0 and every channel it joined, its undelivered mail was never released, and anything published to it afterwards held heat forever. M-B's autonomous events would leak on every dead subscriber. Captain Bob: "Fix first, own commit." - sk_hermes_vm_departed(): unsubscribe from every channel, release + pop the pending queue (heat back to each funder, ledger exact), free the queue entry. Called from both kill and reap, with a HERMES departure line. Console evidence identical on amd64/aarch64/riscv64: wa with 2 pending -> "left 2 channel(s), released 2 pending", gone from .CHANNELS, PUBLISH to its channel delivers 0; acceptance ledger held=2048 (6144 without the release). Boot parity/dict_hash unchanged; acceptance passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
include/starkernel/vm/
Headers for the kernel-side VM subsystem (src/starkernel/vm/).
arena.h— the capsule arena allocator: fixed-region allocation for capsule payload data, separate fromkmalloc's general kernel heap.parity.h— the birth/execution parity-record logger: declares the logging interface used to record VM ID, capsule content hash, and dictionary hash on every capsule birth, enabling offline determinism verification across independent kernel runs.
See include/starkernel/vm/bootstrap/README.md for the VM bootstrap
subsystem.