feat(v4): every word but the ten is called, so it can be checked

Plan 2026-10-20 (ENGINE step 4), Task A2, for #189. Captain Bob,
2026-11-13: "The ten"; "Accept it".

- compile.f18 (COMPILE,): a word is copied in line only when it is flagged
  in-line and compile-only (24) -- the ten that work on the return stack,
  >R R> R@ I J LEAVE and the later UNLOOP 2>R 2R> 2R@. Every other word,
  in-line ones too, is a call the hook at `call` sees.
- EXECUTE calls the xt: `call xt` (opcode 3, slot 0) and a ; in (EXEC),
  run. INTERPRET runs a word by (GO): `call xt` and `jump (IL)` in
  (RUNX), entered by a jump, at the old return-stack depth.
- host_map.h: (EXEC) BUF0_W-22, (RUNX) BUF0_W-115, from what was free.
- Its cost, accepted: one return entry at the bottom of a chain (30 deep
  from the prompt, not 31) and one per explicit EXECUTE while its word
  runs; the hosted boot +2.4% (2.917 s to 2.987 s), instructions +0.4%.
- Tests first (logs/20261113-045122/a2): inline_words_are_called,
  residue_stays_inline, execute_passes_the_hook, rstack_kept_across_call,
  abandoned_definition_not_called -- 3 of 1096 failed before. The depth
  checks moved to the new figures; SEE shows the calls; two layout checks
  use in-line test words; 2>R 2R@ 2R> checked in test_host_quit.
- DECOMPOSITION.md EXECUTE, the plan's A2 and rulings, FABRIC-3 XLVIII.22.

Suite: test, test-32 99 programs 0 failures; v4-checks 79 under the
sanitizers 0 failures, the hosted builds alike; hosted POST 539/539.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm

v4/tests/host_map.h

@@ -122,7 +122,9 @@
 /* THE IMAGE RECORD: where the system's source says, with `store`, the addresses a host needs (v4/image.h): where the
  * node waits for a message, its fault table, and KEY's code. */
 #define ROM_IMG      (BUF0_W - 119)             /* idle, fault table, KEY, the word after KEY: 4 cells */
-/* FREE, plain memory: BUF0_W - 22 .. - 21; - 115 .. - 113; BUF0_W - 144 .. - 141 (what a flush makes zero after
+#define EXEC_W       (BUF0_W - 22)              /* (EXEC): EXECUTE's `call xt`, and the ; after it (compile.f18; #189) */
+#define RUNX_W       (BUF0_W - 115)             /* (RUNX): INTERPRET's `call xt`, and the jump back (compile.f18; #189) */
+/* FREE, plain memory: BUF0_W - 113; BUF0_W - 144 .. - 141 (what a flush makes zero after
  * a full output buffer); and OUT_W - 144 .. OUT_W - 65.  They and
  * the cells above held the messages waiting, the refusals owed and what went with them (MESH.md 7a, 7b), which a
  * node no longer keeps. */
@@ -368,6 +370,8 @@ static unsigned host_branch_slots(void)
     X("DSTACK-DEPTH", DSTACK_REG) \
     X("RSTACK-DEPTH", RSTACK_REG) \
     X("HEAT-OP", HEAT_REG) \
+    X("(EXEC)", EXEC_W) \
+    X("(RUNX)", RUNX_W) \
     X("ANTICLOCK", HEAT_REG + 32) \
     X("CFBASE", CFS_W) \
     X("CFEND", CFS_W + CFS_CELLS)