§H.12 steps 7-9: thread real parent VMUuid through the birth call chain

Session.parent now comes from the actual birthing VM's own
stadium_vm_id, not a hardcoded vm_uuid_hera(). Added a VMUuid parent
parameter to capsule_birth_baby() and, one level up, to
capsule_console_birth()/capsule_runcap_birth() (neither had a VM* in
their own signature, but every caller did). Updated all 6 real call
sites: BIRTH, CAPSULE-BIRTH, CONNECT-ARTEMIS, CONNECT-HERMES,
RUNCAP-TEST, PAIR-TEST (mama_forth_words.c) and the console+user birth
pair in capsule_wirebind_try_attach() (capsule_wirebind.c). Two
functions had their vm parameter marked __attribute__((unused)), now
genuinely used -- attribute removed.

Steps 8 (Session.name from capsule name) and 9 (identity defaults to
installed=0) were already satisfied by step 5's existing
session_register() call and its identity-zeroing -- confirmed by
inspection, no further code needed.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

FABRIC-3.md

@@ -4001,11 +4001,27 @@ work, not new invention.
   comment and this entry.
 
 **Phase 3 — Session fields wired at birth**
-- [ ] **7.** Populate `Session.parent` from the birthing VM's `stadium_vm_id`.
+- [x] **7. DONE 2026-09-03, larger than one line — a real signature-threading pass.**
-- [ ] **8.** Populate `Session.name` from the capsule's own name string (already available at
+  `Session.parent` now comes from the actual birthing VM's own `stadium_vm_id`, not a
-  this point in `capsule_birth.c`).
+  hardcoded `vm_uuid_hera()`. This meant adding a `VMUuid parent` parameter to
-- [ ] **9.** Confirm `Session.identity` defaults to `installed=0` correctly (no behavior
+  `capsule_birth_baby()` and, one level up, to `capsule_console_birth()` and
-  change expected yet).
+  `capsule_runcap_birth()` (neither had a `VM *` in their own signature, but every one of
+  their callers did) — traced all 6 real call sites across `mama_forth_words.c` (4: `BIRTH`,
+  `CAPSULE-BIRTH`, `CONNECT-ARTEMIS`, `CONNECT-HERMES`, plus `RUNCAP-TEST`/`PAIR-TEST` = 6
+  total) and `capsule_wirebind.c` (2: console + user birth in
+  `capsule_wirebind_try_attach()`), confirmed each has a real `VM *` (`vm`/`mama_vm`) in
+  scope, and passed `vm->stadium_vm_id` through at every one. Two functions
+  (`mama_word_connect_artemis`/`_hermes`) had their `vm` parameter marked
+  `__attribute__((unused))`, now genuinely used — attribute removed. User explicitly chose
+  this option (full threading) over leaving the earlier `vm_uuid_hera()` hardcode in place.
+- [x] **8. Already satisfied by step 5.** `session_register(vm_id, parent, capsule_name)`
+  already passes the capsule's own name string — nothing further needed.
+- [x] **9. Confirmed by code inspection.** `session_register()` (step 2) zeroes `identity`
+  unconditionally — `installed` reads 0 by construction, matching `VMIdentity`'s own
+  documented default. No behavior change, as expected.
+
+  Verified 3-arch boot to `ok>` (amd64/aarch64/riscv64) for step 7's actual code changes,
+  which also exercises 8 and 9 unchanged.
 
 **Phase 4 — Creator-ceiling enforcement (H.3, birth-time snapshot)**
 - [ ] **10.** `dictionary_snapshot_acl_from_parent(child, parent)`: for each word also present

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-09-03T10:24:56Z -->
+<!-- Generated by mkcapsule --manifest  2026-09-03T10:36:42Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->

include/starkernel/capsule_birth.h

@@ -127,6 +127,14 @@ CapsuleRunResult capsule_birth_mama(
  * @param descs         Capsule descriptor array
  * @param names         Capsule name entry array (parallel to descs)
  * @param arena         Capsule payload arena
+ * @param parent        Who is birthing this VM (FABRIC-3.md §H.12 step 7) --
+ *                       the caller's own VMUuid (e.g. vm->stadium_vm_id for
+ *                       a FORTH word handler), recorded on the new VM's
+ *                       Session.parent. Every current call site has one in
+ *                       scope, directly or one level up; traced live rather
+ *                       than assumed (checked all 6 call sites across
+ *                       mama_forth_words.c/capsule_console.c/
+ *                       capsule_runcap.c/capsule_wirebind.c).
  * @param skip_pki_sig  0 for every build-time capsule (the normal case --
  *                       checked against the compile-time-baked signature
  *                       array via capsule_get_signatures()). Non-zero only
@@ -154,6 +162,7 @@ CapsuleRunResult capsule_birth_baby(
     const CapsuleDesc *descs,
     const CapsuleNameEntry *names,
     const uint8_t *arena,
+    VMUuid parent,
     int skip_pki_sig,
     VMUuid *out_vm_id,
     void **out_vm_ctx

include/starkernel/capsule_console.h

@@ -35,11 +35,13 @@
  *                       "CaptBob"); sk_repl_dispatch_line() looks for a
  *                       live "<name>~user" counterpart to decide
  *                       whether a given active VM is a console.
+ * @param parent         Who is birthing this VM (FABRIC-3.md §H.12 step 7)
+ *                       -- passed straight through to capsule_birth_baby().
  * @param out_vm_id      Output: assigned VM ID.
  * @param out_vm_ctx     Output: new VM context (may be NULL).
  * @return CAPSULE_RUN_OK on success, error code otherwise.
  */
-CapsuleRunResult capsule_console_birth(const char *console_name,
+CapsuleRunResult capsule_console_birth(const char *console_name, VMUuid parent,
                                         VMUuid *out_vm_id, void **out_vm_ctx);
 
 #endif /* __STARKERNEL__ */

include/starkernel/capsule_runcap.h

@@ -58,6 +58,8 @@ struct blkio_dev;
  * @param vm_name     Symbolic name for the new VM (becomes both the
  *                    capsule's own single directory entry name and the
  *                    VM registry name).
+ * @param parent      Who is birthing this VM (FABRIC-3.md §H.12 step 7) --
+ *                    passed straight through to capsule_birth_baby().
  * @param out_vm_id   Output: assigned VM ID.
  * @param out_vm_ctx  Output: new VM context (may be NULL if not needed).
  * @return CAPSULE_RUN_OK on success, error code otherwise.
@@ -66,6 +68,7 @@ CapsuleRunResult capsule_runcap_birth(
     struct blkio_dev      *dev,
     const homeblocks_sig_t *sig,
     const char             *vm_name,
+    VMUuid                  parent,
     VMUuid                 *out_vm_id,
     void                  **out_vm_ctx
 );

src/starkernel/capsule/capsule_birth.c

@@ -505,6 +505,7 @@ CapsuleRunResult capsule_birth_baby(
     const CapsuleDesc      *descs,
     const CapsuleNameEntry *names,
     const uint8_t          *arena,
+    VMUuid                  parent,
     int                     skip_pki_sig,
     VMUuid                 *out_vm_id,
     void                  **out_vm_ctx)
@@ -637,7 +638,7 @@ CapsuleRunResult capsule_birth_baby(
         entry->stadium_patron_cell = stadium_admit(vm_id, &vm_patron);
 
         if (entry->stadium_patron_cell != STADIUM_CELL_NONE) {
-            Session *s = session_register(vm_id, vm_uuid_hera(), capsule_name);
+            Session *s = session_register(vm_id, parent, capsule_name);
             if (s) {
                 s->stadium_cell = entry->stadium_patron_cell;
                 if (is_fleet_foundation) session_set_pinned(vm_id, 1);

src/starkernel/capsule/capsule_console.c

@@ -30,7 +30,7 @@ static const char CONSOLE_IDENTITY_SRC[] =
     "S\" common:messaging.4th\" EXEC\n"
     "MSG-CD-INIT\n";
 
-CapsuleRunResult capsule_console_birth(const char *console_name,
+CapsuleRunResult capsule_console_birth(const char *console_name, VMUuid parent,
                                         VMUuid *out_vm_id, void **out_vm_ctx)
 {
     if (!console_name) return CAPSULE_RUN_ERR_INVALID;
@@ -74,7 +74,7 @@ CapsuleRunResult capsule_console_birth(const char *console_name,
     dir.dir_hash      = 0;
 
     CapsuleRunResult r = capsule_birth_baby(
-        console_name, &dir, &desc, &name_entry, arena,
+        console_name, &dir, &desc, &name_entry, arena, parent,
         1 /* skip_pki_sig -- not build-time content, same rationale as RUNCAP */,
         out_vm_id, out_vm_ctx);
 

src/starkernel/capsule/capsule_runcap.c

@@ -23,6 +23,7 @@ CapsuleRunResult capsule_runcap_birth(
     struct blkio_dev       *dev,
     const homeblocks_sig_t *sig,
     const char              *vm_name,
+    VMUuid                   parent,
     VMUuid                  *out_vm_id,
     void                   **out_vm_ctx)
 {
@@ -96,7 +97,7 @@ CapsuleRunResult capsule_runcap_birth(
     dir.dir_hash      = 0; /* not verified anywhere in the birth path today */
 
     CapsuleRunResult r = capsule_birth_baby(
-        vm_name, &dir, &desc, &name_entry, arena,
+        vm_name, &dir, &desc, &name_entry, arena, parent,
         1 /* skip_pki_sig -- trust comes from CERTVERIFY, a separate root */,
         out_vm_id, out_vm_ctx);
 

src/starkernel/capsule/capsule_wirebind.c

@@ -145,11 +145,13 @@ void capsule_wirebind_try_attach(struct blkio_dev *dev,
     VMUuid console_id, user_id;
     void  *console_ctx = (void *)0;
     void  *user_ctx    = (void *)0;
-    if (capsule_console_birth(username, &console_id, &console_ctx) != CAPSULE_RUN_OK) {
+    if (capsule_console_birth(username, mama_vm->stadium_vm_id, &console_id, &console_ctx)
+        != CAPSULE_RUN_OK) {
         console_println("WIREBIND: console VM birth FAILED");
         return;
     }
-    if (capsule_runcap_birth(dev, sig, user_vm_name, &user_id, &user_ctx) != CAPSULE_RUN_OK) {
+    if (capsule_runcap_birth(dev, sig, user_vm_name, mama_vm->stadium_vm_id, &user_id,
+                              &user_ctx) != CAPSULE_RUN_OK) {
         console_println("WIREBIND: user VM birth FAILED");
         return;
     }

src/starkernel/capsule/mama_forth_words.c

@@ -303,6 +303,7 @@ void mama_word_birth(VM *vm)
             capsule_get_descriptors(),
             capsule_get_names(),
             capsule_get_arena(),
+            vm->stadium_vm_id, /* §H.12 step 7: who is birthing this VM */
             0,  /* skip_pki_sig: normal build-time capsule */
             &new_vm_id,
             (void **)0
@@ -937,7 +938,8 @@ static void mama_word_runcap_test(VM *vm)
     }
 
     VMUuid new_vm_id;
-    CapsuleRunResult r = capsule_runcap_birth(dev, sig, vm_name, &new_vm_id, (void **)0);
+    CapsuleRunResult r = capsule_runcap_birth(dev, sig, vm_name, vm->stadium_vm_id,
+                                               &new_vm_id, (void **)0);
     vm_push(vm, r == CAPSULE_RUN_OK ? 1 : 0);
     vm_push(vm, (cell_t)r);
 }
@@ -990,12 +992,14 @@ static void mama_word_pair_test(VM *vm)
 
     VMUuid console_id, user_id;
     void  *console_ctx = (void *)0;
-    if (capsule_console_birth(console_name, &console_id, &console_ctx) != CAPSULE_RUN_OK) {
+    if (capsule_console_birth(console_name, vm->stadium_vm_id, &console_id, &console_ctx)
+        != CAPSULE_RUN_OK) {
         console_println("PAIR-TEST: console birth FAILED");
         vm_push(vm, 0);
         return;
     }
-    if (capsule_runcap_birth(dev, sig, user_name, &user_id, (void **)0) != CAPSULE_RUN_OK) {
+    if (capsule_runcap_birth(dev, sig, user_name, vm->stadium_vm_id, &user_id, (void **)0)
+        != CAPSULE_RUN_OK) {
         console_println("PAIR-TEST: user birth FAILED");
         vm_push(vm, 0);
         return;
@@ -1046,6 +1050,7 @@ void mama_word_capsule_birth(VM *vm)
         capsule_get_descriptors(),
         capsule_get_names(),
         capsule_get_arena(),
+        vm->stadium_vm_id, /* §H.12 step 7: who is birthing this VM */
         0,  /* skip_pki_sig: normal build-time capsule */
         &new_vm_id,
         (void **)0  /* Don't need VM context back */
@@ -1220,7 +1225,7 @@ void mama_word_exec(VM *vm)
 /**
  * @brief CONNECT-ARTEMIS ( -- ) — Enter Artemis's REPL, birthing it first if needed.
  */
-static void mama_word_connect_artemis(VM *vm __attribute__((unused)))
+static void mama_word_connect_artemis(VM *vm)
 {
     VMRegistryEntry  entry;
     VM              *artemis;
@@ -1240,6 +1245,7 @@ static void mama_word_connect_artemis(VM *vm __attribute__((unused)))
             capsule_get_descriptors(),
             capsule_get_names(),
             capsule_get_arena(),
+            vm->stadium_vm_id, /* §H.12 step 7: who is birthing this VM */
             0,  /* skip_pki_sig: normal build-time capsule */
             &new_vm_id, (void **)0);
         console_set_vm_name(saved);
@@ -1291,7 +1297,7 @@ static void mama_word_bye(VM *vm __attribute__((unused)))
  * Idempotent: if Hermes is already born (LIVE or STOPPED) it is entered
  * directly without re-birthing.  On BYE from Hermes, control returns here.
  */
-static void mama_word_connect_hermes(VM *vm __attribute__((unused)))
+static void mama_word_connect_hermes(VM *vm)
 {
     VMRegistryEntry  entry;
     VM              *hermes;
@@ -1312,6 +1318,7 @@ static void mama_word_connect_hermes(VM *vm __attribute__((unused)))
             capsule_get_descriptors(),
             capsule_get_names(),
             capsule_get_arena(),
+            vm->stadium_vm_id, /* §H.12 step 7: who is birthing this VM */
             0,  /* skip_pki_sig: normal build-time capsule */
             &new_vm_id, (void **)0);
         console_set_vm_name(saved);