Add exact-equality Hermes ledger self-audit -- FABRIC-3.6.md task 2.6

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/starkernel/kernel_main.c

@@ -951,7 +951,20 @@ static void kernel_main_deep(BootInfo *boot_info) {
             if (held4 != pulled4 - returned4 - consumed4) ok = 0;
             if (stadium_reservoir_peek(alloc_test_id) != reservoir0 - decay_expected) ok = 0;
 
+            /* Task 2.6: the live audit never fired across both cycles,
+             * and a ONE-unit corruption of each counter in turn (on a
+             * copy -- live state untouched) is caught by the pure
+             * predicate, while the uncorrupted values pass it. */
+            if (sk_hermes_audit_failure_count() != 0) ok = 0;
+            if (!sk_hermes_audit()) ok = 0;
+            if (!sk_hermes_audit_values(held4, pulled4, returned4, consumed4)) ok = 0;
+            if (sk_hermes_audit_values(held4 + 1, pulled4, returned4, consumed4)) ok = 0;
+            if (sk_hermes_audit_values(held4, pulled4 + 1, returned4, consumed4)) ok = 0;
+            if (sk_hermes_audit_values(held4, pulled4, returned4 + 1, consumed4)) ok = 0;
+            if (sk_hermes_audit_values(held4, pulled4, returned4, consumed4 + 1)) ok = 0;
+
             console_println(ok ? "PASS" : "FAIL");
+            print_uint("  audit_failures=", sk_hermes_audit_failure_count());
             print_uint("  decay_consumed=", decay_expected);
             print_uint("  reservoir0=", reservoir0);
             print_uint("  Q_SLOT=", SK_HERMES_Q_SLOT);

src/starkernel/vm/kernel_hermes.c

@@ -48,6 +48,7 @@
 #include "starkernel/vm/kernel_hermes.h"
 #include "starkernel/vm/stadium.h"
 #include "starkernel/q48_16.h"
+#include "console.h"
 
 static SkHermesMessage sk_hermes_msgs[SK_HERMES_MSG_MAX];
 
@@ -66,6 +67,27 @@ void sk_hermes_ledger(uint64_t *held, uint64_t *pulled, uint64_t *returned, uint
     if (consumed) *consumed = sk_hermes_consumed;
 }
 
+int sk_hermes_audit_values(uint64_t held, uint64_t pulled, uint64_t returned, uint64_t consumed) {
+    /* Epsilon zero (SXXXVII.3): exact integer equality, no tolerance. */
+    return held == pulled - returned - consumed;
+}
+
+static uint64_t sk_hermes_audit_failures = 0;
+
+int sk_hermes_audit(void) {
+    int ok = sk_hermes_audit_values(sk_hermes_held, sk_hermes_pulled,
+                                    sk_hermes_returned, sk_hermes_consumed);
+    if (!ok) {
+        sk_hermes_audit_failures++;
+        console_println("Kernel-Hermes AUDIT FAILURE: held != pulled - returned - consumed");
+    }
+    return ok;
+}
+
+uint64_t sk_hermes_audit_failure_count(void) {
+    return sk_hermes_audit_failures;
+}
+
 static int sk_hermes_find_free_slot(void) {
     int i;
     for (i = 0; i < SK_HERMES_MSG_MAX; i++) {
@@ -135,6 +157,7 @@ int sk_hermes_alloc(VMUuid vm_id, SkHermesMessage **out_msg) {
      * once every refusal path above has already returned. */
     sk_hermes_held   += pulled;
     sk_hermes_pulled += pulled;
+    sk_hermes_audit();
 
     return 0;
 }
@@ -176,6 +199,7 @@ int sk_hermes_release(SkHermesMessage *msg) {
     if (rc == 0) {
         sk_hermes_held     -= remaining;
         sk_hermes_returned += remaining;
+        sk_hermes_audit();
     }
 
     memset(msg, 0, sizeof(*msg));
@@ -198,6 +222,7 @@ int sk_hermes_decay(SkHermesMessage *msg) {
      * pays for it). SXXXVII.3: decay's delta is exact and in hand here. */
     sk_hermes_consumed += before - after;
     sk_hermes_held     -= before - after;
+    sk_hermes_audit();
 
     return 0;
 }