FABRIC.md: item 4.2 -- fourth ruling, two more STADIUM-* primitives

Punch list §25 item 4.2 acceptance amended (scoping only, no code).
Found while reading Hermes's actual implementation (capsules/hermes/init.4th):
MSG-COOL-ALL/CH-COOL-ALL mutate each live node's own heat field every
HERMES-TICK, and MSG-TOTAL-HEAT/CH-TOTAL-HEAT sum it -- none of the original
five primitives expose a resident cell's heat at all. Ruled: STADIUM-HEAT@
(read) and STADIUM-HEAT! (write, reconciling the reservoir delta atomically
in C -- same shape as stadium_word_dispatch()'s own cooling code, so
conservation is never left to FORTH to get right). Cooling cadence stays in
Hermes's own HERMES-TICK loop, not a new C-side per-tick sweep -- matches
HERMES.md's language constraint. Primitive surface is now seven, not five;
Done-when updated to match.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

FABRIC.md

@@ -3386,6 +3386,32 @@ document and committing that amendment as its own item.*
   >    the hosted build's layout must stay untouched outside the `__STARKERNEL__` guard.
   >    Set once, at VM creation, from the same `VMRegistryEntry.vm_id` the birth path
   >    already assigns (`capsule_birth.c`) — not invented at the dispatch call sites.
+  > 4. **Primitive surface grows from five to seven.** Found while reading Hermes's actual
+  >    implementation (`capsules/hermes/init.4th`): `MSG-COOL-ALL`/`CH-COOL-ALL` (blocks
+  >    4108/4114) mutate each live node's own heat field in place every `HERMES-TICK`, and
+  >    `MSG-TOTAL-HEAT`/`CH-TOTAL-HEAT` sum it. None of the original five primitives expose
+  >    a resident cell's own `heat` field at all — only admission, eviction, and the calling
+  >    VM's reservoir. Ruled: two more primitives, same implicit-self discipline as the
+  >    original five (cell must belong to the calling VM's own quota):
+  >    ```
+  >    STADIUM-HEAT@  ( cell -- heat )
+  >    STADIUM-HEAT!  ( new-heat cell -- )
+  >    ```
+  >    `STADIUM-HEAT!` reconciles the reservoir delta atomically in C — pulls from the
+  >    calling VM's reservoir if `new-heat` is higher than current (refusing, leaving heat
+  >    unchanged, if the reservoir can't cover it), pushes back if lower — the same shape as
+  >    `stadium_word_dispatch()`'s own cooling code. Conservation is never left to FORTH to
+  >    get right by remembering to call `STADIUM-RES-PULL`/`-PUSH` itself; a single call is
+  >    both the write and the correct accounting. Serves two callers: a cooling tick
+  >    (`heat × Q-DECAY`, replacing `MSG-COOL-ONE`'s in-place multiply) and a floor-refresh
+  >    (`COMMON-INIT`/`HERMES-TICK` reset `COMMON-CH`'s heat to a fixed `Q.1/3` unconditionally,
+  >    not a decay — needs the same delta-reconciling write, just with a different target
+  >    value). `STADIUM-HEAT@` alone serves `MSG-TOTAL-HEAT`/`CH-TOTAL-HEAT`'s summation and
+  >    `MSG-REAP`/`CH-REAP-SAFE`'s heat-reached-zero check. Cooling cadence stays entirely in
+  >    Hermes's own FORTH `HERMES-TICK` loop (rewritten to call these, not a new C-side
+  >    per-tick sweep) — matches `HERMES.md`'s language constraint and the fact that
+  >    `HERMES-TICK` already owns this loop; nothing about moving the heat storage changes
+  >    who decides when to cool.
   >
   > **Open, surfaced not resolved:** mapping Hermes's message/channel lifecycle onto the
   > closed `STADIUM_BEHAVIOUR_*` set (`MIGRATE`/`DELIVER`/`EXPIRE`/`COOL`) — `DELIVER` and
@@ -3399,7 +3425,7 @@ document and committing that amendment as its own item.*
   > implementation; do not resolve by assumption.
   >
   > *Done when:*
-  > - The five `STADIUM-*` FORTH primitives exist, are kernel-only (not in the shared/
+  > - The seven `STADIUM-*` FORTH primitives exist, are kernel-only (not in the shared/
   >   vendored word set), and are exercised by at least one Hermes word each.
   > - `stadium_owner[idx]` is written correctly on both the free-list-pop and
   >   eviction-fallback paths in `stadium_admit()`, verified by a resident cell's
@@ -3423,7 +3449,7 @@ document and committing that amendment as its own item.*
   > - The POST suite (regression gate per §10) passes.
   > - **The effort number is recorded explicitly** — per §10, "what Hermes costs is the
   >   multiplier for everything else." Report at minimum: wall-clock/session time spent,
-  >   lines changed (FORTH + the five-primitive C surface, split out), and file count
+  >   lines changed (FORTH + the seven-primitive C surface, split out), and file count
   >   touched, so 4.3/4.4 can be estimated from a real data point rather than guessed.
   > - All three architectures boot to `ok>`/`zuse)ok>` with logs under `logs/`, and
   >   Hermes's own conservation check (K≡1.0 across messages + channels + reservoir) closes