Stage 3 follow-on: message-arrival eligibility hook + trampoline-blind switch-storm fix (FABRIC-3.md §XXVIII.2)

Implements the message-arrival eligibility signal FABRIC-3.md §XXVIII.1 left
open (has_work per-slot flag, set via new SWITCH-MARK-WORK primitive from
MSG-SEND) so an idle VM never becomes a switch target purely by waiting out
the readiness threshold.

Also root-causes and fixes a second, independent switch-storm: the tick's
"who is current" check used vm_log_attributed_vm(), which can't see a VM
parked in switch.c's own raw trampoline. Replaced with a dedicated
g_switch_current_vm tracked by the switch mechanism itself, and moved
target-slot eligibility reset to the switch decision point instead of
relying on ISR polling to observe a window that can be only a few
instructions wide.

Verified live on all 3 architectures: clean boot to zuse@Hera] ok>, live
cross-VM message dispatch, and (since a quiet log looks identical to a
livelocked storm once the DoE probe is gone) confirmed genuine REPL
liveness via QMP send-key + screendump on aarch64/riscv64, not log
inspection alone.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K

src/starkernel/vm/switch.c

@@ -51,6 +51,26 @@ extern uint64_t sk_vm_switch_prime(uint64_t stack_top, void *entry);
  * who most recently switched into it does. */
 static VM *g_switch_entry_vm;
 
+/* FABRIC-3.md §XXVIII Stage 3 follow-on (2026-09-14): which VM is
+ * currently running, from the switch mechanism's own point of view --
+ * independent of vm_log_attributed_vm() (vm_core.c), which is scoped to
+ * nested vm_interpret() calls for log-source attribution and has no way
+ * to know a VM is "running" while parked inside this file's own raw C
+ * trampoline (sk_vm_switch_entry()), never itself calling vm_interpret().
+ * sk_vm_switch_signal_tick() (capsule_vm_switch_signal.c) consults this
+ * instead of vm_log_attributed_vm() for exactly that reason -- see its
+ * own updated comment. Single-writer-mainline, same discipline as
+ * g_switch_entry_vm above: set unconditionally on every switch, by the
+ * only code path that can ever change who is physically running.
+ * Seeded once at boot via sk_vm_switch_set_current() for whichever VM is
+ * running before any switch has ever happened (Hera, at Stage 3
+ * registration time -- kernel_main.c). */
+static VM *g_switch_current_vm;
+
+VM *sk_vm_switch_current_vm(void) { return g_switch_current_vm; }
+
+void sk_vm_switch_set_current(VM *vm) { g_switch_current_vm = vm; }
+
 /**
  * sk_vm_switch_entry - trampoline for a VM's first-ever entry.
  *
@@ -64,6 +84,18 @@ static VM *g_switch_entry_vm;
  * first. Must never fall off the end -- there is no legitimate return
  * address below a synthetic first-entry frame, unlike an ordinary
  * function.
+ *
+ * FABRIC-3.md §XXVIII Stage 3 follow-on (2026-09-14): an attempt to make
+ * this attributable by calling vm_interpret(self, "MSG-TICK") here was
+ * tried and reverted -- it introduced a second, distinct hang (a stall in
+ * sk_repl_headless_wait()'s WIREBIND-attachment wait, not root-caused) in
+ * place of the switch-storm it was meant to fix. The switch-storm's real
+ * cause (sk_vm_switch_signal_tick()'s "who is current" check via
+ * vm_log_attributed_vm() never seeing a VM that only ever runs this raw
+ * C trampoline) is instead fixed at the source in switch.c/
+ * capsule_vm_switch_signal.c: sk_vm_context_switch() now tracks "current"
+ * itself, independent of vm_interpret()'s own attribution bookkeeping.
+ * This placeholder's behavior is therefore unchanged from Stage 2.
  */
 void sk_vm_switch_entry(void) {
     VM *self = g_switch_entry_vm;
@@ -95,12 +127,14 @@ int sk_vm_context_switch(VM *from, VM *to) {
 
     capsule_vm_set_state(to->stadium_vm_id, VM_STATE_LIVE);
     capsule_vm_set_state(from->stadium_vm_id, VM_STATE_SWITCHED_OUT);
+    g_switch_current_vm = to;
 
     sk_vm_switch_to(&from->native_stack_saved_sp, new_sp);
 
     /* Resumes here only once something later switches back to `from` --
      * from `from`'s own point of view, this call simply took a while. */
     capsule_vm_set_state(from->stadium_vm_id, VM_STATE_LIVE);
+    g_switch_current_vm = from;
     return 0;
 }
 

src/starkernel/vm/vm_core.c

@@ -920,14 +920,16 @@ void execute_colon_word(VM* vm)
          * `vm`, which could be an arbitrary number of ticks later --
          * calling it after would attribute switch_count_cumulative/
          * switch_ticks_since to the wrong (resume) event instead of the
-         * actual switch-out this counts. */
+         * actual switch-out this counts. It also resets target_id's own
+         * eligibility state directly (2026-09-14 correction) -- see its
+         * own doc comment for why that can't be left to ISR polling. */
         if (sk_vm_at_outermost_interpret()) {
             VMUuid target_id = sk_vm_switch_signal_take_pending();
             if (!vm_uuid_equal(target_id, vm_uuid_none())) {
                 VMRegistryEntry target_entry;
                 if (capsule_vm_registry_get(target_id, &target_entry) == 0 &&
                     target_entry.vm_ptr && target_entry.vm_ptr != (void *)vm) {
-                    sk_vm_switch_signal_note_switch_performed();
+                    sk_vm_switch_signal_note_switch_performed(target_id);
                     sk_vm_context_switch(vm, (VM *)target_entry.vm_ptr);
                     /* Resumes here once something later switches back. */
                 }