test fault-on-AP and affinity; report the faulting core

fault-ap-df pins a #DF to an AP (its own IST must catch it); affinity checks a pinned task never migrates. onException now names the core, so an AP fault is attributed and shown contained. Both teeth-checked.

docs/smp.md

@@ -194,7 +194,15 @@ next lands.
   core online, and enters the run loop. With interrupts on, each core's own timer tick
   preempts its idle context into whatever the global ready queue offers — so all cores
   pull real work in parallel. The `smp` test spawns CPU-bound workers and confirms they
-  execute on all four cores at once.
+  execute on all four cores at once, and `fault-ap-df` pins a #DF to an AP and checks
+  that core catches it on **its own** IST (a broken per-core TSS would triple-fault) —
+  reported as "core N: …", so a fault is always attributed to the core it happened on,
+  and is contained to that core (the rest of the system keeps running).
+- **Thread affinity** — `spawnOn(entry, priority, cpu)` pins a task to a core (its own
+  per-core pinned queue, merged with the global queue at selection; see
+  [scheduling.md](scheduling.md#affinity-pinning-a-task-to-a-core)). The `affinity`
+  test confirms a pinned task never migrates. This is the mechanism the fault-on-AP
+  test rides on, and the *explicit-affinity* real-time-predictable model.
 - **`single_threaded` off** — the kernel was built `single_threaded = true`, which
   compiles `std.atomic` down to plain non-atomic ops. Harmless on one core, but it
   quietly breaks the big kernel lock across cores; it's now `false`.
@@ -214,8 +222,13 @@ next lands.
 - **IPIs** — cross-core wake/preempt. Not needed for correctness: an idle core wakes
   on its own timer tick and pulls ready work then; IPIs only cut that latency from
   ≤1 ms to near-instant.
-- **Per-core run queues + thread affinity** — the Fiasco.OC direction, if the single
-  global queue's lock contention ever bites (and the more real-time-predictable model).
+- **Per-core run queues** — the Fiasco.OC direction, if the single global queue's lock
+  contention ever bites. (Thread *affinity* already exists — see above; this is the
+  further step of giving each core its own primary run queue for load distribution.)
+- **Fault recovery** — today a fault halts (only) the faulting core. Turning that into
+  "kill the task, keep the core running" is the [resilience](resilience.md) track (it
+  needs the task's lock/resource state handled), and for taking a core fully offline,
+  its tasks migrated first.
 
 ## Further reading