Implements the message-arrival eligibility signal FABRIC-3.md §XXVIII.1 left open (has_work per-slot flag, set via new SWITCH-MARK-WORK primitive from MSG-SEND) so an idle VM never becomes a switch target purely by waiting out the readiness threshold. Also root-causes and fixes a second, independent switch-storm: the tick's "who is current" check used vm_log_attributed_vm(), which can't see a VM parked in switch.c's own raw trampoline. Replaced with a dedicated g_switch_current_vm tracked by the switch mechanism itself, and moved target-slot eligibility reset to the switch decision point instead of relying on ISR polling to observe a window that can be only a few instructions wide. Verified live on all 3 architectures: clean boot to zuse@Hera] ok>, live cross-VM message dispatch, and (since a quiet log looks identical to a livelocked storm once the DoE probe is gone) confirmed genuine REPL liveness via QMP send-key + screendump on aarch64/riscv64, not log inspection alone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K
src/starkernel/capsule/
Kernel-side capsule system: locating, validating, and executing the
immutable, content-addressed .4th initialization payloads in
capsules/ (embedded into the kernel image via tools/mkcapsule.c).
capsule_find.c— locates a capsule by name in the generated capsule directory.capsule_validate.c— validates a capsule's content hash before use.capsule_birth.c— the birth protocol: allocate VM ID → execute IDENTITY (capsule code) → execute PERSONALITY (block 1 from ramdrive) → log parity record.capsule_run.c— capsule execution against a VM instance.capsule_loader.c— loads capsule block content into kernel ramdrive block RAM, writing eachBlock Nheader to its literal numbered block address (not reordered).capsule_vm_hooks.c— VM integration hooks for capsule execution.capsule_vm_physics.c— physics-runtime bindings for capsule-birthed VMs.mama_forth_words.c— Mama VM-specific FORTH word bindings.