FABRIC-3.10.8 MC-3a: the claim, the physics lock, per-core decision state

VM.running_on claimed by compare-and-swap on switch-in and released once
the context is saved (release_after, sk_vm_switch_finish); a lost claim
returns 1 and the caller re-decides; double claims counted. Per-core
entry_vm and decision_due. g_lock_physics over capsule_vm_physics.c
(rank between switch and registry). KILL refuses a VM running anywhere.
Probe: 15737 claims, 0 lost, 0 double; a core-1 claim of Hera refused.
3-ISA acceptance with a 28-VM churn clean, 0 order violations.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

include/starkernel/percpu.h

@@ -67,6 +67,12 @@ typedef struct sk_percpu {
     uint64_t          reg_readback;  /* its per-CPU register, read on arrival */
     volatile uint32_t online;        /* 1 once parked (release store) */
     volatile uint64_t park_wakes;    /* times woken while parked */
+    /* MC-3a (switch.c): the VM this core just switched away from, released
+     * (running_on cleared) by whatever next runs here -- only once its
+     * context is saved. And this core's "re-decide at the next checkpoint". */
+    struct VM        *release_after;
+    volatile uint32_t decision_due;
+    struct VM        *entry_vm;      /* the VM a first-entry trampoline starts as */
 } sk_percpu_t;
 
 /* Installs the boot core's block in this core's per-CPU register. Call

include/starkernel/spinlock.h

@@ -50,6 +50,9 @@
  *     g_lock_hermes     kernel-Hermes arena, queues, channels, ledger
  *     g_lock_switch     switch-signal slot table and stamps
  *                       (capsule_vm_switch_signal.c)
+ *     g_lock_physics    fleet physics: node list, heat, touch window, slope
+ *                       (capsule_vm_physics.c, MC-3a); retirement walks
+ *                       the registry under it
  *     g_lock_registry   VM registry list and entries (capsule_birth.c)
  *     g_lock_stadium    Stadium's global part: quota-slot allocation
  *                       (grants) and the shared block table (MC-0d)
@@ -91,6 +94,7 @@ typedef enum sk_lock_rank {
     SK_LOCK_RANK_NONE = 0,     /* unranked: neither checked nor counted */
     SK_LOCK_RANK_HERMES,
     SK_LOCK_RANK_SWITCH,
+    SK_LOCK_RANK_PHYSICS,      /* fleet physics (MC-3a): walks the registry */
     SK_LOCK_RANK_REGISTRY,
     SK_LOCK_RANK_VM_DICT,      /* a VM's dict_lock (sf_mutex_t) */
     SK_LOCK_RANK_VM_TUNING,    /* a VM's tuning_lock (sf_mutex_t) */
@@ -141,6 +145,7 @@ uint64_t sk_lock_order_violations(void);
 extern sk_spinlock_t g_lock_registry;
 extern sk_spinlock_t g_lock_stadium;
 extern sk_spinlock_t g_lock_switch;
+extern sk_spinlock_t g_lock_physics;
 extern sk_spinlock_t g_lock_hermes;
 extern sk_spinlock_t g_lock_doe;
 extern sk_spinlock_t g_lock_log;

include/starkernel/vm/switch.h

@@ -52,6 +52,15 @@ int sk_vm_context_switch(struct VM *from, struct VM *to);
  * have entered an observer on a core other than core 0 (a guard; 0). */
 uint64_t sk_vm_switch_observer_refusals(void);
 
+/* FABRIC-3.10.8 MC-3a: the claim. sk_vm_try_claim() takes `vm` for this
+ * core (running_on 0 -> core_id + 1) by compare-and-swap: 1 if taken, 0 if
+ * another core holds it (counted as lost). sk_vm_context_switch() returns
+ * 1 when that happens to `to` -- nothing switched; the caller re-decides.
+ * The stats: claims taken, claims lost, and double claims (a switch-in that
+ * found its VM held by another core -- must stay 0). */
+int  sk_vm_try_claim(struct VM *vm);
+void sk_vm_switch_claim_stats(uint64_t *claims, uint64_t *lost, uint64_t *doubles);
+
 /* FABRIC-3.md §XXVIII Stage 3 follow-on (2026-09-14): which VM is
  * currently physically running, tracked by the switch mechanism itself --
  * see switch.c's own doc comment on g_switch_current_vm for why this