Fix DELIVER's misleading (stub) label -- it was never actually a gap

Re-scoped on request. capsules/hermes/init.4th's MSG-ALLOC already
admits every message onto Stadium with SB-DELIVER, and MSG-FREE-NODE
(called from both MSG-ACK-LAST and heat-driven MSG-REAP) already
evicts it -- "behaviour=DELIVER (stub)" has been printing on boot logs
since at least 2026-08-05. The earlier "zero consumer, needs
substantial Hermes lifecycle mapping work" framing was wrong,
carried over unverified from FABRIC.md's old "open, not resolved" note
about which Hermes event maps to DELIVER vs. EXPIRE -- item 4.2
already answered that in code without the prose catching up. Same
documentation-drift class as the stale ONTOLOGY.md words note and the
earlier glibc misattribution.

Checked whether the dispatch body needed a real payload action the way
MIGRATE did: MSG-DELIVER (the FORTH word) already runs the actual
delivery (VM-EXEC of the payload) before eviction, decoupled from
Stadium reap -- so by dispatch time delivery is already done, same
shape as COOL, which needs no extra action beyond stadium_evict()'s
own universal reservoir credit.

Fix: stadium_dispatch()'s DELIVER case now prints the departing
message's real identity (DELIVER msg_idx=N, same shape as MIGRATE's
lbn= print) instead of a misleading (stub) label. COOL is in the
identical situation (real for both words and VMs) but left as-is --
out of scope for this pass, noted in stadium.c's own comment.

Also confirmed EXPIRE (ACL) is genuinely unscoped, not stale docs like
DELIVER turned out to be -- zero Stadium involvement anywhere in
ACL.4th/acl_recheck()/the ACL design doc. Stays open pending real
design decisions.

Verified live via a forced MSG-SEND/MSG-DELIVER-ALL/MSG-ACK-LAST
sequence from Hermes's own REPL context ("USE" now works after the
previous fix): "Stadium: dispatch cell=73653 behaviour=DELIVER
msg_idx=1". Clean zero-warning compile and clean boot with
conservation intact on all three architectures.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn

FABRIC-3.md

@@ -387,11 +387,34 @@ other three become honest, explicit punch-list items instead of being touched sp
   amd64 (distinct from the pre-existing `COMMON-CH` word-eviction self-test's own COOL print).
   Conservation (`resident_sum + reservoir == Q48_ONE`) intact throughout. Clean zero-warning
   compile and clean boot on all three architectures (amd64/aarch64/riscv64).
-- [ ] `DELIVER` (Hermes) — scope as its own future item once `MIGRATE`/VM-`COOL` land; do not
-  re-decide the `DELIVER`-vs-`EXPIRE` message/channel mapping here, `FABRIC.md`'s own note
-  already flags it as genuinely open, not casually assumable.
-- [ ] `EXPIRE` (ACL) — scope as its own future item; ACL has never touched Stadium, this is
-  new integration work, not a wire-up of something partially built.
+- [x] **Re-scoped and resolved (2026-08-26): `DELIVER` (Hermes) was never actually a gap —
+  the earlier "zero consumer, needs substantial Hermes lifecycle mapping" framing above was
+  wrong, carried over unverified from `FABRIC.md`'s old "open, not resolved" note about
+  *which* Hermes event maps to `DELIVER` vs. `EXPIRE`. Item 4.2 already answered that in code
+  (messages → `DELIVER`, channels → `COOL`) without the prose ever catching up — same
+  documentation-drift class as the stale `ONTOLOGY.md` words note and the earlier glibc
+  misattribution. Confirmed live: `capsules/hermes/init.4th`'s `MSG-ALLOC` already admits
+  every message with `SB-DELIVER`, and `MSG-FREE-NODE` (called from both `MSG-ACK-LAST` and
+  heat-driven `MSG-REAP`) already evicts it — `behaviour=DELIVER (stub)` has been printing on
+  boot logs since at least 2026-08-05. Checked whether the dispatch body needed a real payload
+  action the way `MIGRATE` did: `MSG-DELIVER` (the FORTH word) already runs the actual
+  delivery (`VM-EXEC` of the payload) *before* eviction, decoupled from Stadium reap — so by
+  dispatch time delivery is already done, same shape as `COOL`, which needs no extra action
+  beyond `stadium_evict()`'s own universal reservoir credit. **Fix:** `stadium_dispatch()`'s
+  `DELIVER` case now prints the departing message's real identity (`DELIVER msg_idx=N`, same
+  shape as `MIGRATE`'s `lbn=` print) instead of a misleading `(stub)` label — confirmed live
+  via a forced `MSG-SEND`/`MSG-DELIVER-ALL`/`MSG-ACK-LAST` sequence from Hermes's own REPL
+  context (`Stadium: dispatch cell=73653 behaviour=DELIVER msg_idx=1`). `COOL`'s case is in
+  the identical situation (real for both words and VMs, no extra action needed) but was left
+  printing `(stub)` — out of scope for this pass, noted in `stadium.c`'s own comment. Clean
+  zero-warning compile and clean boot with conservation intact on all three architectures.
+- [ ] `EXPIRE` (ACL) — confirmed genuinely unscoped (2026-08-26), not a case of stale
+  documentation like `DELIVER` turned out to be: zero mentions of Stadium anywhere in
+  `ACL.4th`, `acl_recheck()`, or the ACL design doc. `DictEntry.acl_ttl` (per-word ACL
+  recheck) is a completely separate mechanism from `StadiumPatronHeader.ttl` (unused by every
+  caller today, always set to 0). Needs real design decisions before any code: would an
+  ACL-guarded word be admitted as its own Stadium patron, keyed how, and what would "expire"
+  mean as a reap action (revoke a permission? reset `acl_ttl`?). Stays open until decided.
 - [ ] Fix `ONTOLOGY.md` §IX's "words (dictionary, warehouse-resident today, not yet migrated)"
   line — stale, words are fully migrated and live via `stadium_word_dispatch()`. Small,
   independent doc fix, not blocking any of the above.

src/starkernel/vm/stadium.c

@@ -256,12 +256,26 @@ uint8_t *stadium_header_bitmap(void) {
  * for a tag that exists is a build failure, not a silent gap -- the compiler
  * enforces closedness, not just this comment.
  *
- * MIGRATE (blocks) is real, FABRIC-3.md §B (MIGRATE punch-list item):
- * write-back via blk_flush(), called with the departing patron's identity
- * (the LBN) -- stadium_evict() calls this BEFORE zeroing the header, so
- * `identity` is still valid here. DELIVER/EXPIRE/VM-COOL remain stubs --
- * their own subsystems (Hermes, ACL, Tripod VM lifecycle) have not been
- * migrated onto the Stadium yet, each its own future pass.
+ * MIGRATE (blocks) is real, FABRIC-3.md §B: write-back via blk_flush(),
+ * called with the departing patron's identity (the LBN) -- stadium_evict()
+ * calls this BEFORE zeroing the header, so `identity` is still valid here.
+ *
+ * DELIVER (Hermes messages) needs no extra payload action here, confirmed
+ * 2026-08-26 (FABRIC-3.md §B): capsules/hermes/init.4th's MSG-ALLOC already
+ * admits every message with this behaviour, and MSG-FREE-NODE (called from
+ * both explicit ack and heat-driven reap) already evicts it -- has been
+ * real and live on every boot for weeks. The actual delivery action
+ * (VM-EXEC of the payload, MSG-DELIVER) already runs in FORTH, decoupled
+ * from and prior to Stadium reap; by the time this dispatches, delivery is
+ * already done. Was printed as "(stub)" for a long time regardless, which
+ * was simply wrong, not a real gap -- fixed to print the departing
+ * message's identity, same shape as MIGRATE's lbn print, instead of
+ * claiming to be unimplemented.
+ *
+ * EXPIRE (ACL) and COOL (VMs, item 3.5) print "(stub)"/status text for
+ * their own separate reasons -- EXPIRE has no ACL-Stadium integration of
+ * any kind yet (FABRIC-3.md §B, genuinely unscoped); COOL's own status is
+ * documented at its own case below.
  */
 void stadium_dispatch(size_t cell_index, StadiumBehaviour behaviour) {
     console_puts("Stadium: dispatch cell=");
@@ -276,13 +290,21 @@ void stadium_dispatch(size_t cell_index, StadiumBehaviour behaviour) {
             blk_flush(lbn);
             break;
         }
-        case STADIUM_BEHAVIOUR_DELIVER:
-            console_println("DELIVER (stub)");
+        case STADIUM_BEHAVIOUR_DELIVER: {
+            uint64_t msg_idx = stadium_cell_array[cell_index].header.identity;
+            console_puts("DELIVER msg_idx=");
+            console_put_u64(msg_idx);
+            console_println("");
             break;
+        }
         case STADIUM_BEHAVIOUR_EXPIRE:
             console_println("EXPIRE (stub)");
             break;
         case STADIUM_BEHAVIOUR_COOL:
+            /* Real for words (item 4.1) and VMs (FABRIC-3.md SS B) -- both
+             * confirmed to need no extra payload action here either, same
+             * reasoning as DELIVER above. Left printing "(stub)" for now:
+             * only DELIVER's label was in scope for this fix. */
             console_println("COOL (stub)");
             break;
     }