Computed the loader's true runtime relocation delta to correctly correlate fault addresses (the running image is starkernel_loader.efi, a relocated PE, not the separately-linked starkernel_kernel.elf assumed at first). Fault RIP decodes to log_message()'s entry -- coincidental, not causal, since it's called on nearly every HADES dispatch during word registration. Used QEMU's monitor for -d exec,int tracing. Late-start tracing (stop right before the danger zone to keep trace size down) failed twice -- the window between a detectable checkpoint and the crash is shorter than host-side reaction latency. Fell back to full-boot tracing from -S (~2.7GB per attempt, not committed). That trace shows an unremarkable, normal-looking repeating three-block loop immediately before the fault, then "Servicing hardware INT=0x20" (APIC_TIMER_VECTOR) with IDT already showing limit=0 at that instant. Ruled out a second illegitimate lidt call (only one call site exists anywhere, one-time M4 boot setup; searched the trace for any later execution of that address range and found none). Not yet established: the actual corrupting write. Documented two remaining explanations (earlier silent corruption vs. a genuine TCG artifact) and that pinpointing the exact instruction needs GDB-level single-stepping, a bigger tooling step than attempted this session. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
experiments/
Design of Experiments (DoE) campaign data and analysis for the LithosAnanke kernel.
bare_metal/— the bare-metal DoE experiment: blind full-factorial 2⁴ runs measuring the L8 Jacquard mode selector's effect on the Steady-State Machine across amd64/aarch64/riscv64. Seeexperiments/bare_metal/README.mdfor the full directory layout (runs/,latest/,analysis/{charts,tables,report}).
Hosted-VM DoE campaigns (factorial/heartbeat/ablation studies) live under
docs/working/experiments/ instead — this top-level directory is
specifically the kernel/bare-metal side.