safety commit

docs/v4.0.0/MESH.md

@@ -1389,10 +1389,19 @@ Checked in the code on 2026-10-16 (`kernel/src/capsule/mama_forth_words.c`,
 6. **A centre faces another centre on port 6, on both sides.** The ports
    of a centre: 0 the kernel, 1 the console or devices, 2 to 5 its outer
    nodes, 6 and 7 other centres (section 4.1's proposal).
-7. **GONE goes down the birth graph.** Hera sends it to the nodes she
+7. ~~**GONE goes down the birth graph.** Hera sends it to the nodes she
    birthed. A node that believes a GONE sends it on to the nodes it
-   birthed, as from itself. A node still believes a GONE only from its own
-   centre (7b.4).
+   birthed, as from itself.~~ **Changed 2026-10-16, after the final review
+   of step 7 (Captain Bob: "yes, agreed"): the kernel tells a node's
+   going.** When Hera kills a node, the kernel puts a GONE about it on the
+   wire of every live node from its parent, as if its parent had sent it.
+   No node hands a GONE on. A node still believes a GONE only from its own
+   centre (7b.4), and its parent is its centre. Why: handing a GONE on ran
+   message machinery on a node's own stacks, in whatever text it was in --
+   the cause 7c.6 found when the first wait was backed out, and which 7d
+   took off the nodes. The review found the hand-on lost at depth, and a
+   node between texts losing its values to a fault; the kernel has the
+   registry and needs no stack of a node's.
 
 ### 9a.3 The capsules
 
@@ -1409,10 +1418,6 @@ Checked in the code on 2026-10-16 (`kernel/src/capsule/mama_forth_words.c`,
     capsule. It gains the child's port.
   - `UNIT ( n -- )`, as now, giving `childport` 2.
   - The words that join two outer nodes (`(JOIN)`, `(SAY)`), as now.
-  - `GONE-DOWN ( n -- )`: n is gone; every node this one birthed is told,
-    as from this one, and n leaves its table if it was one of them. It is
-    put in the system's `(GONE-HOOK)` when the capsule is loaded, before
-    the node seals.
 - **`hera.4th`**: what is Hera's alone.
   - `KILL ( n -- )`, `PAUSE ( n -- )`, `RESUME ( n -- )`.
   - `UNIT-KILL ( n -- )`: asks the kernel for n's children, kills each, and
@@ -1421,14 +1426,14 @@ Checked in the code on 2026-10-16 (`kernel/src/capsule/mama_forth_words.c`,
     `S" v4:centre.4th" BIRTH-AS`, sets her way to n+1 to n+4 to port 6,
     and sends it the text `n UNIT`, waiting for it to end.
 
-**The system's part (ruled 2026-10-16, planning).** A node believes a GONE
-in the system (`(GONE?)`, `capsules/v4/sys/quit.f18`), so the system hands
-it on: a variable, `(GONE-HOOK)`, holds the xt of a word that is given the
-number of the node that is gone; 0, as at switch-on, does nothing. `COLD`
-clears it if it points at or above the sealed system.
-  - Her table of the nodes she birthed is `centre.4th`'s, as every
-    centre's is: it is whom she tells a GONE. A node she did not birth she
-    finds through the kernel's registry.
+  - She keeps no table of the nodes she birthed: she finds a node, and its
+    children, through the kernel's registry.
+
+~~**The system's part (ruled 2026-10-16, planning).** A node believes a GONE
+in the system, so the system hands it on: a variable, `(GONE-HOOK)`, holds
+the xt of a word that is given the number of the node that is gone.~~
+**Withdrawn the same day with ruling 7:** the kernel tells the GONE; the
+system hands nothing on.
 
 ### 9a.4 The kernel (`v4/include/v4/manage.h`, `v4/src/manage.c`)
 
@@ -1453,6 +1458,11 @@ clears it if it points at or above the sealed system.
 - **`NODE-SLEEP`, `NODE-WAKE` and `NODE-KILL` take a number**, which the
   registry turns into a place. `NODE-KILL` refuses Hera. A number that is
   not live does nothing, as v3's `KILL` of a dead VM.
+- **`NODE-KILL` tells everyone** (ruled 2026-10-16, ruling 7 as changed):
+  the killed node's children become Hera's, and the kernel puts a GONE
+  about it on every live node's wire from its parent. A wire with no room
+  for it is not waited for, and that node is not told (as an answer whose
+  way back is full, 7d.6).
 - **Two queries:** `NODE-CHILD ( number i -- child | 0 )`, the i-th live
   child of that node; `NODE-PLACE ( number -- place | -1 )`.
 - **The requests' numbers are fixed** (ruled 2026-10-16, planning): -6 to