#1261 probes: exception entry, spurious ack, timer re-arm, console-free sample

[drawmeanelephant]

What this is

The probe set #1261 needed to make a dying boot name its own last instant, plus the one defect the extended gate caught in the sampler before merge. Every probe is inert unless forensics on; the extended live-forensics spec pins every probe call site so deleting one fails the gate instead of silently zeroing the reading.

Closes #1261 — the card's deliverable was a settled delivered-vs-recorded verdict with the mechanism bounded in writing, which this supplies (below). The follow-on work (which guest action makes VZ abort, and can the abort be made observable) is filed as #1287.

The probes

probe	site	arg	what it separates
entry	exc_dispatch entry, before any GIC state is consumed	kind	cadence vs post-ack irq: "not delivered" vs "delivered but acked spurious"
spur	spurious-ack early return in irq_dispatch	intid	a spurious storm was previously indistinguishable from silence
rearm	timer.arm, before the comparator write	programmed delta	steady rearm + no entry ⇒ comparator fires but exception never taken; rearm gap ⇒ the source stopped
shot	shell idle loop, self-draining	wall-clock second	the guest is executing with no console traffic to ride on

The verdict (measured, twice, on the nudge dying-boot scratch tree)

The PPIs are delivered AND recorded to the last second. The death is not guest-side.

• entry cadence matches the 1 Hz timer to the end; samples on a 4.0 s cadence through the final second; spurious acks zero for the whole run; rearm args all exactly 24000000 (a 1 s comparator at 24 MHz).
• Host side names the death: VZErrorDomain code=1 — Internal Virtualization error. The virtual machine stopped unexpectedly. VZ aborts the VM rather than the guest faulting — which is why no [EXC] block and no tombstone ever appeared.
• The console-free shot sample is what makes the "still alive" claim sound: 4.000 s exact spacing across the whole run needs neither a delivered interrupt nor a console line to be printed.
• New collateral finding: the counter itself is not monotonic for the first ~0.9 s under VZ on this host (a ~0.1 s backward step at t≈0.89 s, observed twice). Any trace sorting t= across the first second is misordered; the sampler saturates elapsed time instead of underflowing, and the comment at the guard records this.

The gate-caught defect (why this PR exists beyond doc comments)

The first sampler clock was timer.irq_ticks. The extended gate's census came back shot: 6624 on a ~30 s boot — the exact flood signature the wrong-clock bug produced in the scratch tree. Reading the run with VIRELAI_KEEP_RUN=1: irq_ticks is a shared counter (both cores' 1 Hz PPIs) and is reset by re-init paths (it went 1 → 0 during early boot), and the == 0 bypass fired on every sample until the first timer IRQ. The shipped clock is timer.cntpct() / timer.freq — monotonic by contract, exact seconds, and deterministic in host tests because the frequency is a parameter. Post-fix census on a 120 s boot: entry 245 / irq 238 / rearm 238 / rotate 121 / shot 32, shot args 4 → 8 → … → 124 exact, dense per-core sequences intact.

Verification (all observed this session)

gate	result
live-forensics (class B, extended spec)	PASS 1/1 — census above, host verdict line present
just verify-portable (incl. transcript gate, fmt, unit tests)	PASS — all 495 tests
zig build (guest image)	rc=0
coordination gate	ok — 2 open claims, no overlaps

Not re-run here: the other class-B VZ shards (need VZ; CI runs them).