feat(log): LOG-FLUSH -- a VM's log records reach Artemis's log ring; and the ring keeps its order when it grows

FABRIC-3 SXXXII.4's deferred LOG-FLUSH, built to the 2026-10-14 rulings
(SXXXVIII): everything a VM logs, at or above the log level, goes into its
own buffer; it goes to Artemis on LOG-FLUSH, when full, and at once on an
ERROR, as one kernel-Hermes LOG_BATCH message she writes on her own turn,
the source being the sender the kernel stamped.  Records that cannot go yet
are counted and reported with the next flush.  LOG-SHOW (Hera only) reads
the ring back -- it had no reader.

Found by the first test that filled it: ring growth overwrote the oldest
record and put blank slots inside the live range.  Fixed test first.

Three ISAs: POST 1052 passed; new parity baseline word_count=526
hash=0x82f4ae7cb2e2d424 (deliberate).  CLAUDE.md: Phase 8 PKI closed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v3/include/vm.h

@@ -677,6 +677,18 @@ typedef struct VM
                                          *   not be entered again to deliver a message. */
     /** @} */
 
+    /** @name Log buffer (kernel only; FABRIC-3.md §XXXVIII, 2026-10-14)
+     * Every log record attributed to this VM, packed, waiting to go to
+     * Artemis's log ring in one kernel-Hermes message (vm_log_buffer.c).
+     * @{
+     */
+#define VM_LOG_BUF_SIZE 900                 /**< one message's payload, leaving room for a lost-records notice */
+    uint8_t  log_buf[VM_LOG_BUF_SIZE];
+    uint16_t log_buf_len;                  /**< bytes used in log_buf */
+    uint32_t log_lost;                     /**< records that could not be sent, reported
+                                             *   with the next flush that can be */
+    /** @} */
+
     /** @name Stadium Identity (item 4.2, FABRIC-0.md §25.5)
      * @{
      */