§H.12 step 4: Hera registers as session zero; punch list to checkboxes

Rewired stadium_birth_hera() to admit unpinned then register through
session_register()/session_set_pinned() instead of setting
STADIUM_FLAG_PIN directly on the candidate header. Self-referential
parent (vm_uuid_hera(), vm_uuid_hera()), matching capsule_run.h's
parent_vm_id == vm_id root convention. Soft-fail, non-fatal, if
session_register() fails -- Hera's actual Stadium admission is what the
patron-zero invariant is about. Wired session_boot_init() into
kernel_main.c right after stadium_boot_init(), before stadium_birth_hera().

Also converted §H.12's punch list from bold "DONE" markers to this
document's established - [ ]/- [x] checkbox convention (already used
throughout §A), for consistency.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64), no soft-fail message
on any arch, Hermes/Artemis births unaffected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/starkernel/kernel_main.c

@@ -58,6 +58,7 @@ EFI_RUNTIME_SERVICES *g_sk_runtime_services = NULL;
 #include "starkernel/vm/stadium.h"
 #include "starkernel/vm/stadium_words.h"
 #include "starkernel/vm/stadium_blocks.h"
+#include "starkernel/session.h"
 #include "starkernel/capsule_generated.h"
 #include "starkernel/capsule_loader.h"
 #include "starkernel/capsule_birth.h"  /* capsule_birth_mama, capsule_find_mama_init */
@@ -512,6 +513,14 @@ static void kernel_main_deep(BootInfo *boot_info) {
      * yet, so a failed allocation logs and boot continues. */
     (void)stadium_boot_init();
 
+    /* Session: boot-time allocation (FABRIC-3.md §H.12 step 4), sized from
+     * stadium_max_vm_count() so it must run after stadium_boot_init() above
+     * and before the first session is registered (stadium_birth_hera()
+     * below registers Hera as session zero). Soft failure, same reasoning
+     * as stadium_boot_init() -- stadium_birth_hera() itself soft-fails a
+     * failed session_register() rather than treating it as fatal. */
+    (void)session_boot_init();
+
     /* item 4.1, FABRIC.md item 3.6/§17.7: actually enforce "Hera is patron
      * zero" before anything else can land on cell 0 via the free list, then
      * bring up the word layer's map. Both must happen before the first word

src/starkernel/vm/stadium.c

@@ -41,6 +41,7 @@
 #include "starkernel/q48_16.h" /* Q48_ONE -- item 4.1's reservoir starts each VM's quota at 1.0 */
 #include "vm.h" /* VM_MEMORY_SIZE -- the per-VM footprint stadium_max_vm_count() budgets against */
 #include "block_subsystem.h" /* blk_flush() -- STADIUM_BEHAVIOUR_MIGRATE's real write-back action */
+#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-3.md §H.12 step 4 */
 
 static StadiumCell *stadium_cell_array   = (StadiumCell *)0;
 static uint8_t      *stadium_bitmap       = (uint8_t *)0;
@@ -637,6 +638,17 @@ uint64_t stadium_resident_sum(VMUuid vm_id) {
  * item-3.1 discriminator bitmap -- if cell 0 already reads as resident,
  * something already birthed her (or, if it isn't actually Hera, something
  * else already claimed cell 0 -- either way this must not clobber it).
+ *
+ * FABRIC-3.md §H.12 step 4: pinning no longer happens by setting
+ * STADIUM_FLAG_PIN on the candidate before admission -- session.c's
+ * session_set_pinned() is now the sole choke point for that bit (§H.10).
+ * Hera is admitted unpinned, then registered as session zero
+ * (self-referential parent, matching capsule_run.h's parent_vm_id ==
+ * vm_id convention for the root) and pinned through the session layer.
+ * Session registration/pinning is soft-fail (logged, not fatal) -- Hera's
+ * actual Stadium admission above already succeeded and is what the
+ * patron-zero invariant is about; session.c not yet being initialized
+ * must not break that.
  */
 int stadium_birth_hera(void) {
     StadiumPatronHeader candidate;
@@ -656,7 +668,7 @@ int stadium_birth_hera(void) {
     candidate.link      = STADIUM_LINK_NONE;
     candidate.contains  = STADIUM_CONTAINS_NONE;
     candidate.mass      = 1;
-    candidate.flags     = STADIUM_FLAG_PIN;
+    candidate.flags     = 0;
     candidate.behaviour = (uint8_t)STADIUM_BEHAVIOUR_COOL;
 
     idx = stadium_admit(vm_uuid_hera(), &candidate);
@@ -664,6 +676,17 @@ int stadium_birth_hera(void) {
     if (idx != STADIUM_HERA_CELL_INDEX) {
         sk_hal_panic("Stadium: birth_hera did not land on cell 0 -- patron-zero invariant broken");
     }
+
+    {
+        Session *s = session_register(vm_uuid_hera(), vm_uuid_hera(), "Hera");
+        if (s) {
+            s->stadium_cell = idx;
+            session_set_pinned(vm_uuid_hera(), 1);
+        } else {
+            console_println("Stadium: session_register failed for Hera (session.c not yet initialized?)");
+        }
+    }
+
     return 0;
 }