starkernel: item 4.2 -- Hermes native on the Stadium (complete)

Migrates Hermes's message/channel lifecycle onto the Stadium's unified
heat/capacity economy: MSG-ALLOC/FREE-NODE and CH-ALLOC/FREE-NODE now
route entirely through stadium_admit()/stadium_evict(), replacing the
old local free-list + independent heat-field mechanism. Eight
kernel-only STADIUM-* FORTH primitives (ADMIT, EVICT, RES@, RES-PULL,
RES-PUSH, HEAT@, HEAT!, WORD-HEAT), VM.stadium_vm_id threaded through
all three vm_core.c dispatch sites (replacing item 4.1's hardcoded
vm_uuid_hera()), and the stadium_owner[idx] fix so evict-credit lands
in the VM that actually admitted a patron, not whoever owned cell 0.

This session's own contribution, on top of that pre-existing
implementation: found and fixed two bugs blocking the item's own K≡1.0
conservation self-check (HERMES-K was reading 0, not 65536):

- Q.SLOT admission-heat fix (capsules/hermes/init.4th): MSG-SEND/
  CH-ACCEPT admitted with Q.1 (the entire fleet-wide "1.0" unit) per
  item, a leftover from before the Stadium migration when each
  message/channel had its own unconstrained heat field. Instantly
  drained the shared, finite reservoir.

- Reservoir floor for word-execution admission (stadium_words.c):
  stadium_word_dispatch() (item 4.1) pulls STADIUM_WORD_HEAT_QUANTUM on
  every word dispatch, not just first admission -- exhausts a VM's
  entire reservoir in ~32 dispatches, starving any application-level
  economy sharing that VM's reservoir before it gets a chance to pull
  anything. word_dispatch_pull() now clamps word-execution's own pulls
  to leave a Q48_ONE/3 floor (same fair-share figure COMMON-CH's own
  floor already uses); application-level pulls are unaffected.

- STADIUM-WORD-HEAT primitive + stadium_words_resident_heat(): the
  floor deliberately leaves word-execution residents holding real
  heat, invisible to HERMES-K's original formula (MSG+CH+reservoir,
  no term for word patrons). Adding this term closes K to exactly
  65536 on all three architectures.

Also rules on two open scope questions in FABRIC.md: MBR-ALLOC/
MBR-FREE-NODE stay off the Stadium (membership records have no heat
field, never did -- the acceptance bullet's inclusion of them was a
completeness gesture predating a check of the actual layout), and
records the effort number (12 implementation files, +759/-120 lines).

Verified: all three architectures boot clean, full self-test passes,
Stadium conservation closes exactly (resident_sum + reservoir =
Q48_ONE) at both the C/Stadium level and the FORTH-level HERMES-K
check.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

include/starkernel/vm/stadium.h

@@ -307,6 +307,33 @@ void stadium_reservoir_push(VMUuid vm_id, uint64_t amount);
  */
 uint64_t stadium_reservoir_peek(VMUuid vm_id);
 
+/*
+ * stadium_quota_slot_for_vm - Read-only: vm_id's quota slot index (0 to
+ * STADIUM_MAX_VM_COUNT-1), for callers outside stadium.c that need to key
+ * their own per-VM state the same way stadium.c's internal arrays already
+ * do (FABRIC.md §25.5 item 4.2 -- stadium_words.c's word_id -> cell_index
+ * map needs this to stop colliding across VMs; word_id is scoped per-VM,
+ * not globally unique, so a single shared map aliases different VMs' words
+ * onto each other's Stadium cells and reservoirs).
+ *
+ * @param vm_id  VM to look up.
+ * @return Quota slot index, or -1 if vm_id holds no quota.
+ */
+int stadium_quota_slot_for_vm(VMUuid vm_id);
+
+/*
+ * stadium_resident_sum - Read-only: sum of heat across every cell currently
+ * resident AND owned by vm_id's own quota (FABRIC.md §25.5 item 4.2 --
+ * boot diagnostics need this filtered per-VM once a second VM holds a
+ * quota; summing every resident cell regardless of owner, as the pre-4.2
+ * diagnostic did, mixes two VMs' conservation totals together).
+ * Returns 0 for an unknown vm_id, same convention as stadium_reservoir_peek().
+ *
+ * @param vm_id  Owning VM's id.
+ * @return Sum of resident heat owned by vm_id (Q48.16), or 0 if vm_id has no quota.
+ */
+uint64_t stadium_resident_sum(VMUuid vm_id);
+
 /*
  * stadium_evict - Reap the patron header at cell_index (FABRIC.md §17.2:
  * "reap means leaves the floor, not destroyed"). Dispatches its behaviour
@@ -430,6 +457,43 @@ size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate);
  */
 int stadium_grant_quota(VMUuid new_vm_id, VMUuid from_vm_id);
 
+/*
+ * stadium_cell_heat_get - Read a resident cell's own heat (FABRIC.md item
+ * 4.2's fourth ruling). Requires cell_index to be resident AND owned by
+ * vm_id's quota -- returns 0 otherwise (out of range, not resident, or
+ * belongs to a different VM), same ambiguity-with-a-genuine-zero already
+ * accepted by stadium_reservoir_peek()'s doc: callers that need to
+ * distinguish "refused" from "actually zero" must already know the cell is
+ * theirs (e.g. from their own resident-cell tracking), same contract as
+ * every other implicit-self primitive here.
+ *
+ * @param vm_id       Calling VM's own identity.
+ * @param cell_index  Index of the resident patron header to read.
+ * @return The cell's current heat (Q48.16), or 0 if refused.
+ */
+uint64_t stadium_cell_heat_get(VMUuid vm_id, size_t cell_index);
+
+/*
+ * stadium_cell_heat_set - Write a resident cell's own heat, reconciling the
+ * reservoir delta atomically (FABRIC.md item 4.2's fourth ruling). Same
+ * ownership requirement as stadium_cell_heat_get(). If new_heat is higher
+ * than the cell's current heat, pulls the exact difference from vm_id's own
+ * reservoir first -- refuses (returns -1, no mutation) if the reservoir
+ * cannot cover the full increase, never a partial credit that would invent
+ * heat. If new_heat is lower, pushes the exact difference back to the
+ * reservoir after writing. Equal is a no-op success. This is the only
+ * sanctioned way to change a resident cell's heat post-admission -- doing
+ * the reservoir accounting here, not leaving it to the FORTH caller, is the
+ * whole reason this primitive exists rather than a raw field poke.
+ *
+ * @param vm_id       Calling VM's own identity.
+ * @param cell_index  Index of the resident patron header to write.
+ * @param new_heat    The heat value to set (Q48.16).
+ * @return 0 on success, -1 if refused (not owned/resident, or insufficient
+ *         reservoir for an increase).
+ */
+int stadium_cell_heat_set(VMUuid vm_id, size_t cell_index, uint64_t new_heat);
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_VM_STADIUM_H */