Stadium: real VM-patron admission + real COOL dispatch at KILL (FABRIC-3.md §B)

capsule_vm_kill() had zero Stadium involvement (vm_cleanup()/sf_free()
only), and child-VM birth only ever called stadium_grant_quota() -- a
resource pool for the VM's own future word/block patrons, never
stadium_admit() for the VM itself. stadium_birth_hera() looked like a
precedent but admits Hera into her own quota as a permanently pinned
cell 0, which can never reach stadium_evict() -- not a working example
of COOL firing for a VM.

Adds size_t stadium_patron_cell to VMRegistryEntry. At birth, right
after the existing stadium_grant_quota() call, admits a candidate into
the new VM's own quota mirroring stadium_birth_hera()'s shape
(identity=0, mass=1, behaviour=COOL) but deliberately unpinned --
pinning would need a new "unpin" primitive (none exists) to ever evict
it later, and unpinned costs nothing since nothing wires COOL's
dispatch body to kill anything; the worst case of an unrelated natural
eviction is stale bookkeeping, tolerated the same way
stadium_word_forget() already tolerates staleness elsewhere. At
capsule_vm_kill() and capsule_vm_kill_all_nonmama(): stadium_evict()
the tracked cell if still resident, silently tolerating refusal
(already gone). stadium_dispatch()'s COOL case needed no new payload
body -- same as it already is for words, where COOL has no defined
extra action beyond stadium_evict()'s own universal reservoir credit.

On investigation this turned out not to be entangled with the
still-iterating Tripod/Zuse/messaging vision after all -- birth and
kill already funnel through two single choke points, so the earlier
deferral (previous commit) was overcautious.

Verified live: a second, new "Stadium: dispatch cell=... behaviour=
COOL" now fires immediately before every PARITY:KILL line, for both
Hermes and Artemis, distinct from the pre-existing COMMON-CH
word-eviction self-test's own COOL print. Conservation
(resident_sum + reservoir == Q48_ONE) intact throughout. Clean
zero-warning compile and clean boot on all three architectures.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn

FABRIC-3.md

@@ -359,12 +359,34 @@ other three become honest, explicit punch-list items instead of being touched sp
   USE` now correctly prints `USE: now using Artemis` and switches the REPL's console-name
   coloring, confirming the C primitive runs unshadowed. Clean compile and clean boot with
   conservation intact on all three architectures (amd64/aarch64/riscv64).
-- [ ] Scope VM-`COOL`: confirm whether `capsule_vm_kill()`/Tripod's existing VM lifecycle has
-  any real hook point equivalent to `stadium_evict()`, or needs the same kind of admission
-  work `MIGRATE` needs. **Deferred (2026-08-25)** per the user's own "we're going to have to
-  iterate" framing of the final Tripod/Zuse/messaging shape (see §D below) — building VM
-  eviction/cooling machinery ahead of that design risks throwaway or conflicting work. Resolve
-  only after that shape is nailed down, or if it turns out trivially small on its own.
+- [x] **Resolved (2026-08-26): real VM-patron admission + real explicit-KILL eviction, both
+  live.** Re-scoped on request: confirmed `capsule_vm_kill()` had zero Stadium involvement
+  (`vm_cleanup()`/`sf_free()` only) and child-VM birth only ever called
+  `stadium_grant_quota()` (a resource pool for the VM's *own* future word/block patrons) —
+  never `stadium_admit()` for the VM *itself*. The only precedent, `stadium_birth_hera()`,
+  admits Hera into her own quota as a permanently pinned cell 0, which can never reach
+  `stadium_evict()` — not a working example of `COOL` firing for a VM. On closer look this
+  turned out NOT to be entangled with the still-iterating Tripod/Zuse/messaging vision after
+  all (§D) — birth and kill already funnel through two single choke points, so the earlier
+  2026-08-25 deferral was overcautious. **Design:** added `size_t stadium_patron_cell` to
+  `VMRegistryEntry` (`capsule_run.h`). At birth, right after the existing
+  `stadium_grant_quota()` call (`capsule_birth.c`), admit a candidate into the new VM's own
+  quota mirroring `stadium_birth_hera()`'s shape (`identity=0`, `mass=1`, `behaviour=COOL`)
+  but deliberately **unpinned** — pinning would need a new "unpin" primitive (none exists) to
+  ever evict it later, and adding a pin-bypass to `stadium_evict()`'s refusal logic isn't
+  something to do casually; unpinned costs nothing since nothing wires `COOL`'s dispatch body
+  to actually kill anything, so the worst case of an unrelated natural eviction is
+  `stadium_patron_cell` going stale, which is tolerated the same way `stadium_word_forget()`
+  already tolerates staleness. At `capsule_vm_kill()` and `capsule_vm_kill_all_nonmama()`:
+  `stadium_evict()` the tracked cell if still resident, silently tolerating refusal (already
+  gone). `stadium_dispatch()`'s `COOL` case needed no new payload body — same as it already is
+  for words, where `COOL` has no defined extra action beyond `stadium_evict()`'s own universal
+  reservoir credit; the missing piece was admission and a genuine trigger, not dispatch-body
+  logic. **Verified live:** a second, new `Stadium: dispatch cell=... behaviour=COOL` now
+  fires immediately before every `PARITY:KILL` line, for both Hermes and Artemis, confirmed on
+  amd64 (distinct from the pre-existing `COMMON-CH` word-eviction self-test's own COOL print).
+  Conservation (`resident_sum + reservoir == Q48_ONE`) intact throughout. Clean zero-warning
+  compile and clean boot on all three architectures (amd64/aarch64/riscv64).
 - [ ] `DELIVER` (Hermes) — scope as its own future item once `MIGRATE`/VM-`COOL` land; do not
   re-decide the `DELIVER`-vs-`EXPIRE` message/channel mapping here, `FABRIC.md`'s own note
   already flags it as genuinely open, not casually assumable.

include/starkernel/capsule_run.h

@@ -30,6 +30,7 @@
 #ifndef STARKERNEL_CAPSULE_RUN_H
 #define STARKERNEL_CAPSULE_RUN_H
 
+#include <stddef.h>
 #include <stdint.h>
 #include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
 
@@ -106,6 +107,13 @@ typedef struct {
                                   * parent chain stops at. */
     void    *vm_ptr;             /* Pointer to live VM object; NULL when dead */
     char     name[VM_NAME_MAX];  /* Symbolic name, e.g. "Hera", "Hermes" */
+    size_t   stadium_patron_cell; /* FABRIC-3.md SS B, VM-COOL: this VM's own
+                                   * Stadium cell index (STADIUM_CELL_NONE,
+                                   * i.e. (size_t)-1, if never admitted or
+                                   * already reaped) -- admitted into the VM's
+                                   * own quota at birth, explicitly evicted at
+                                   * KILL. Not Hera's; she is pinned and never
+                                   * reaches this field's purpose. */
 } VMRegistryEntry;
 
 /*===========================================================================

src/starkernel/capsule/capsule_birth.c

@@ -124,6 +124,10 @@ void capsule_vm_registry_init(void *mama_vm_ptr) {
     mama->entry.flags              = 0;
     mama->entry.parent_vm_id       = vm_uuid_hera();  /* self-referential: Hera is the root */
     mama->entry.vm_ptr             = mama_vm_ptr;
+    mama->entry.stadium_patron_cell = STADIUM_CELL_NONE; /* set for real by
+                                                           * stadium_birth_hera()
+                                                           * separately -- not
+                                                           * tracked here */
     for (i = 0; i < VM_NAME_MAX; i++) mama->entry.name[i] = '\0';
     vm_name_copy(mama->entry.name, "Hera");
     mama->next = (void *)0;
@@ -158,6 +162,7 @@ static VMRegistryEntry *vm_registry_alloc(void) {
                                           * today; see design doc's "explicitly
                                           * out of scope" for making this dynamic */
     node->entry.vm_ptr             = (void *)0;
+    node->entry.stadium_patron_cell = STADIUM_CELL_NONE;
     for (i = 0; i < VM_NAME_MAX; i++) node->entry.name[i] = '\0';
     node->next = (void *)0;
 
@@ -325,6 +330,15 @@ int capsule_vm_kill(const char *name) {
     vm_id = entry->vm_id;
     vm    = (VM *)entry->vm_ptr;
 
+    /* FABRIC-3.md SS B, VM-COOL: reap this VM's own Stadium patron cell for
+     * real, dispatching COOL. Refusal (already naturally reclaimed by
+     * unrelated quota pressure, or never admitted) is silently tolerated --
+     * KILL tears the VM down unconditionally either way. */
+    if (entry->stadium_patron_cell != STADIUM_CELL_NONE) {
+        (void)stadium_evict(entry->stadium_patron_cell);
+        entry->stadium_patron_cell = STADIUM_CELL_NONE;
+    }
+
     /* Tear down and free */
     if (vm) {
         vm_cleanup(vm);
@@ -357,6 +371,10 @@ void capsule_vm_kill_all_nonmama(void) {
         }
         vm_id = node->entry.vm_id;
         vm    = (VM *)node->entry.vm_ptr;
+        if (node->entry.stadium_patron_cell != STADIUM_CELL_NONE) {
+            (void)stadium_evict(node->entry.stadium_patron_cell);
+            node->entry.stadium_patron_cell = STADIUM_CELL_NONE;
+        }
         if (vm) {
             vm->halted = 1;
             vm_cleanup(vm);
@@ -493,6 +511,38 @@ CapsuleRunResult capsule_birth_baby(
      * stillbirth here is the rare case, not the common one. */
     (void)stadium_grant_quota(vm_id, vm_uuid_hera());
 
+    /* FABRIC-3.md SS B, VM-COOL: admit this VM as a patron of its own
+     * quota -- identity 0 (same convention stadium_birth_hera() uses for
+     * "patron zero"), heat 0 (no reservoir cost), unpinned (unlike Hera --
+     * there is no unpin primitive, and pinning here would make the
+     * explicit KILL-time eviction below unreachable without adding one).
+     * Unpinned means unrelated quota pressure on this VM's own words/
+     * blocks could naturally evict this cell before KILL ever runs; that
+     * is tolerated, not a bug -- nothing wires COOL's dispatch body to
+     * kill anything, so the only visible effect is entry->stadium_
+     * patron_cell going stale, which the KILL-time eviction below already
+     * tolerates (stadium_evict() simply refuses if it's already gone).
+     * Soft failure, same as stadium_grant_quota() above -- a refused
+     * admission leaves stadium_patron_cell at STADIUM_CELL_NONE, and
+     * nothing downstream depends on it succeeding. */
+    {
+        StadiumPatronHeader vm_patron;
+        uint8_t            *raw = (uint8_t *)&vm_patron;
+        size_t               i;
+
+        for (i = 0; i < sizeof(vm_patron); i++) raw[i] = 0;
+        vm_patron.identity  = 0;
+        vm_patron.heat      = 0;
+        vm_patron.ttl       = 0;
+        vm_patron.link      = 0;
+        vm_patron.contains  = STADIUM_CONTAINS_NONE;
+        vm_patron.mass      = 1;
+        vm_patron.flags     = 0;
+        vm_patron.behaviour = (uint8_t)STADIUM_BEHAVIOUR_COOL;
+
+        entry->stadium_patron_cell = stadium_admit(vm_id, &vm_patron);
+    }
+
     const uint8_t *payload = capsule_get_payload(cap, arena);
     if (!payload) {
         entry->state = VM_STATE_STILLBORN;