§H.12 step 2: session-slot table, session_find/session_register

src/starkernel/vm/session.c: kmalloc'd-at-boot slot table sized from
stadium_max_vm_count() (mirrors stadium.c's own StadiumVMQuota, not a
fixed compile-time array as originally planned -- that table was already
moved off a fixed array for the same "population isn't knowable in
advance" reason). session_boot_init()/session_find()/session_register()
implemented for real, no stubs; session_register() zeroes identity and
leaves pinned=0, matching VMIdentity's own documented default and
deferring pin policy to callers. Added session.c to Makefile.starkernel's
explicit source lists. No callers yet.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

FABRIC-3.md

@@ -3946,8 +3946,15 @@ work, not new invention.
    embedded)}`. Type only, no logic. No callers yet, so this acceptance run only confirms the
    header itself is syntactically clean and doesn't break the build. Verified 3-arch boot to
    `ok>` (amd64/aarch64/riscv64).
-2. `src/starkernel/vm/session.c`: fixed-size global session-slot array +
-   `session_find(VMUuid)`/`session_register(...)` skeleton. No callers yet.
+2. **DONE 2026-09-03, one deviation from the original wording.** `src/starkernel/vm/session.c`
+   + `session_boot_init()`/`session_find(VMUuid)`/`session_register(...)`. Not a fixed-size
+   array as originally written here — found `stadium.c`'s own `StadiumVMQuota` table had
+   already been moved off a fixed array to a `kmalloc`'d-at-boot, budget-sized one (same
+   "population isn't knowable in advance" reasoning), so `session.c` mirrors that current
+   precedent instead: `session_boot_init()` sizes the slot table from `stadium_max_vm_count()`,
+   must run after `stadium_boot_init()`. Added `session.c` to `Makefile.starkernel`'s explicit
+   `LOADER_EXTRA_SRCS`/`KERNEL_EXTRA_SRCS` list (not a wildcard build). No callers yet.
+   Verified 3-arch boot to `ok>`.
 3. `session_set_pinned()`/`session_is_pinned()` — the pin-authority choke point (H.2/H.10):
    writes/reads `Session.pinned`, syncs `STADIUM_FLAG_PIN` on that VM's patron cell.
 4. Rewire `stadium_birth_hera()` to register through `session_register()`/

Makefile.starkernel

@@ -528,7 +528,8 @@ LOADER_EXTRA_SRCS := \
     $(KERNEL_SRC)/vm/q48_stubs.c \
     $(KERNEL_SRC)/vm/stadium.c \
     $(KERNEL_SRC)/vm/stadium_words.c \
-    $(KERNEL_SRC)/vm/stadium_blocks.c
+    $(KERNEL_SRC)/vm/stadium_blocks.c \
+    $(KERNEL_SRC)/vm/session.c
 
 KERNEL_EXTRA_SRCS := $(LOADER_EXTRA_SRCS)
 

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-09-03T09:55:22Z -->
+<!-- Generated by mkcapsule --manifest  2026-09-03T10:01:35Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->

include/starkernel/session.h

@@ -76,6 +76,54 @@ typedef struct {
     VMIdentity identity;                 /* embedded, not referenced -- see vm_identity.h */
 } Session;
 
+/*
+ * session_boot_init - Boot-time allocation, mirroring stadium_boot_init()'s
+ * own kmalloc-sized-from-budget shape rather than a fixed compile-time
+ * array (stadium.c's own StadiumVMQuota table was moved off a fixed array
+ * for the same reason -- population isn't knowable in advance). Must run
+ * after stadium_boot_init() (session slot count is sized from
+ * stadium_max_vm_count()) and before the first session is registered.
+ * No callers yet (§H.12 step 2) -- wiring into the boot sequence happens
+ * in a later punch-list step.
+ *
+ * @return 0 on success, -1 if kmalloc failed or stadium_max_vm_count() is 0
+ *         (Stadium not yet initialized).
+ */
+int session_boot_init(void);
+
+/*
+ * session_find - Look up a session by the VMUuid of the patron it
+ * references. Linear scan, same shape as stadium.c's own
+ * quota_slot_for_vm() -- the population this searches is small (one entry
+ * per VM, not per word/block).
+ *
+ * @return Pointer to the live session, or NULL if none is registered for
+ *         vm_id.
+ */
+Session *session_find(VMUuid vm_id);
+
+/*
+ * session_register - Register a new session for vm_id. identity starts
+ * zeroed (VMIdentity's own documented default: installed=0, "no lock,
+ * allow freely" -- §H.12 Correction 2). pinned starts 0 (unpinned); use
+ * session_set_pinned() separately to pin, keeping this function's job to
+ * "create the session record" only, not "create and also decide pin
+ * policy" -- callers (e.g. the capsule-birth admission path, §H.12 phase 2)
+ * decide pinning themselves.
+ *
+ * @param vm_id   The patron this session references. Must not already have
+ *                a registered session (session_find(vm_id) must be NULL).
+ * @param parent  Who birthed this session (vm_uuid_hera() for Hera's own
+ *                self-registration -- self-referential, matching the
+ *                existing parent_vm_id convention documented in
+ *                capsule_run.h).
+ * @param name    Copied into the new session's name buffer, truncated to
+ *                SESSION_NAME_BUF - 1 if longer.
+ * @return Pointer to the new session, or NULL if the slot table is full,
+ *         not yet initialized, or vm_id is already registered.
+ */
+Session *session_register(VMUuid vm_id, VMUuid parent, const char *name);
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_SESSION_H */

src/starkernel/vm/session.c

@@ -0,0 +1,124 @@
+/*
+  StarForth — Steady-State Virtual Machine Runtime
+
+  Copyright (c) 2023–2025 Robert A. James
+  All rights reserved.
+
+  This file is part of the StarForth project.
+
+  Licensed under the StarForth License, Version 1.0 (the "License");
+  you may not use this file except in compliance with the License.
+
+  You may obtain a copy of the License at:
+      https://github.com/star.4th@proton.me/StarForth/LICENSE.txt
+
+  This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  express or implied, including but not limited to the warranties of
+  merchantability, fitness for a particular purpose, and noninfringement.
+
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ */
+
+/**
+ * session.c - Per-VM session bookkeeping (FABRIC-3.md §H.12 step 2)
+ *
+ * Slot table sized from stadium_max_vm_count() at session_boot_init() time,
+ * mirroring stadium.c's own StadiumVMQuota table (kmalloc'd to a
+ * budget-computed count, not a fixed compile-time array -- population isn't
+ * knowable in advance, same reasoning stadium.c's own history already
+ * settled). No callers yet; wiring into the boot sequence and into
+ * stadium_birth_hera()/capsule_birth.c's admission path are later
+ * §H.12 steps.
+ */
+
+#ifdef __STARKERNEL__
+
+#include "starkernel/session.h"
+#include "starkernel/vm/stadium.h"
+#include "starkernel/kmalloc.h"
+
+static Session *g_sessions        = (Session *)0;
+static size_t   g_session_slots   = 0; /* capacity, from stadium_max_vm_count() */
+static size_t   g_session_count   = 0; /* slots actually in use, 0..g_session_slots */
+
+int session_boot_init(void)
+{
+    size_t max_vm_count = stadium_max_vm_count();
+    Session *slots;
+    size_t i;
+
+    if (max_vm_count == 0) return -1; /* Stadium not yet initialized */
+
+    slots = (Session *)kmalloc(max_vm_count * sizeof(Session));
+    if (!slots) return -1;
+
+    for (i = 0; i < max_vm_count; i++) {
+        uint8_t *raw = (uint8_t *)&slots[i];
+        size_t   j;
+        for (j = 0; j < sizeof(Session); j++) raw[j] = 0;
+        slots[i].vm_id  = vm_uuid_none();
+        slots[i].parent = vm_uuid_none();
+    }
+
+    g_sessions      = slots;
+    g_session_slots = max_vm_count;
+    g_session_count = 0;
+    return 0;
+}
+
+Session *session_find(VMUuid vm_id)
+{
+    size_t i;
+
+    if (!g_sessions) return (Session *)0;
+
+    for (i = 0; i < g_session_slots; i++) {
+        if (!vm_uuid_is_none(g_sessions[i].vm_id) &&
+            vm_uuid_equal(g_sessions[i].vm_id, vm_id)) {
+            return &g_sessions[i];
+        }
+    }
+    return (Session *)0;
+}
+
+Session *session_register(VMUuid vm_id, VMUuid parent, const char *name)
+{
+    size_t i;
+    Session *slot = (Session *)0;
+
+    if (!g_sessions) return (Session *)0;
+    if (session_find(vm_id)) return (Session *)0; /* already registered */
+
+    for (i = 0; i < g_session_slots; i++) {
+        if (vm_uuid_is_none(g_sessions[i].vm_id)) {
+            slot = &g_sessions[i];
+            break;
+        }
+    }
+    if (!slot) return (Session *)0; /* table full */
+
+    slot->vm_id  = vm_id;
+    slot->parent = parent;
+    slot->pinned = 0;
+
+    {
+        size_t j = 0;
+        if (name) {
+            for (; j < SESSION_NAME_BUF - 1u && name[j]; j++) slot->name[j] = name[j];
+        }
+        slot->name[j] = '\0';
+    }
+
+    {
+        uint8_t *raw = (uint8_t *)&slot->identity;
+        size_t   j;
+        for (j = 0; j < sizeof(VMIdentity); j++) raw[j] = 0;
+    }
+
+    g_session_count++;
+    return slot;
+}
+
+#endif /* __STARKERNEL__ */