Stage MC-0d: Stadium partitioned by quota slot, one lock per slot (FABRIC-3.10.8 §3.5)

- Ruling (Captain Bob): per-slot locks, not "own path needs no lock" --
  a lock only on the cross-slot side can't exclude an unlocked owner
  (Hermes release evicting a sender's cell while the sender admits).
  FABRIC-3.10.0 §3.6 amended.
- StadiumVMQuota.lock covers the slot's lists, reservoir, consumed, word
  row and its cells. Word dispatch holds only its own slot lock for the
  whole dispatch (*_in_slot forms); peek-then-pull is one step.
- g_lock_stadium: grant slot allocation (new slot published with release
  in_use) and the shared block table (ruled: the one shared-lock Stadium
  path). Taken before a slot lock.
- Bitmap bytes set/cleared atomically (8 cells, possibly 8 slots).
- Cross-slot writers moved under the owner's lock: Hermes decay
  (stadium_cell_decay), Hermes release ledger (stadium_evict_credit),
  session pin (stadium_cell_set_pin). stadium_conserved() one hold.
- Word and block cell lookups check the cell is still this slot's.
- Probe (removed), identical on all three ISAs: 10,746,599 of 10,746,616
  word dispatches took exactly one lock (own slot), the 17 others all row
  growths; every live VM conserved; Hermes audit failures 0.
- Findings reported: births/USE run a VM's words while another VM is the
  core's current VM (MC-3 claim must cover it); quota slots never
  released; owner admission can evict a live message cell (latent, 0).
- Standard sequence on amd64/aarch64/riscv64: dict_hash set and G
  byte-identical, MINT/WIREBIND/USE ok, conservation true, 0 idle growth.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

include/starkernel/spinlock.h

@@ -50,6 +50,11 @@
  *     g_lock_switch     switch-signal slot table and stamps
  *                       (capsule_vm_switch_signal.c)
  *     g_lock_registry   VM registry list and entries (capsule_birth.c)
+ *     g_lock_stadium    Stadium's global part: quota-slot allocation
+ *                       (grants) and the shared block table (MC-0d)
+ *     (slot lock)       one Stadium quota slot: its lists, reservoir,
+ *                       consumed, word row and cells (stadium.c's
+ *                       StadiumVMQuota.lock; at most one held at a time)
  *     g_lock_doe        DoE region (doe_region.c)
  *     g_lock_log        log region (log_region.c)
  *     g_lock_block      block subsystem: device chain, caches, BAM,
@@ -63,8 +68,10 @@
  * The switch table and the registry never call out while held: their walks
  * copy one entry under the lock and judge it outside. Hermes hands the
  * switch module its notifications after dropping its own lock (they read
- * Hermes queues back). Stadium's lock comes with MC-0d; it sits below
- * Hermes (Hermes admits and evicts cells).
+ * Hermes queues back). Stadium sits below Hermes (Hermes admits, evicts and
+ * decays cells) and below a VM's dict_lock (vm_core.c's heat bump dispatches
+ * the word under it), and above block (MIGRATE calls blk_flush()); nothing
+ * in the block path calls into Stadium.
  */
 #ifndef STARKERNEL_SPINLOCK_H
 #define STARKERNEL_SPINLOCK_H
@@ -102,6 +109,7 @@ uint64_t sk_lock_bad_releases(void);
 uint64_t sk_lock_held_at_switch(void);
 
 extern sk_spinlock_t g_lock_registry;
+extern sk_spinlock_t g_lock_stadium;
 extern sk_spinlock_t g_lock_switch;
 extern sk_spinlock_t g_lock_hermes;
 extern sk_spinlock_t g_lock_doe;

include/starkernel/vm/stadium.h

@@ -584,6 +584,44 @@ uint64_t stadium_cell_heat_get(VMUuid vm_id, size_t cell_index);
  */
 int stadium_cell_heat_set(VMUuid vm_id, size_t cell_index, uint64_t new_heat);
 
+/*
+ * FABRIC-3.10.8 Stage MC-0d: Stadium is partitioned by quota slot, one lock
+ * per slot (Captain Bob, 2026-09-25). Every public function above locks the
+ * slot it touches; a cell's operations lock the cell's owning slot. The word
+ * and block dispatch paths hold their own VM's slot lock across a whole
+ * dispatch and use the *_in_slot forms below, so another VM's dispatch never
+ * contends them. g_lock_stadium (spinlock.h) serializes grants and the
+ * block table; it is taken before a slot lock, never after.
+ */
+
+/* Locks vm_id's quota slot and returns it, or -1 (no quota; nothing locked). */
+int  stadium_slot_lock_vm(VMUuid vm_id);
+void stadium_slot_unlock(int slot);
+
+/* Caller holds `slot`'s lock. */
+size_t   stadium_admit_in_slot(int slot, const StadiumPatronHeader *candidate);
+int      stadium_evict_in_slot(int slot, size_t cell_index);   /* -1 unless slot owns the cell */
+uint64_t stadium_reservoir_pull_in_slot(int slot, uint64_t amount);
+void     stadium_reservoir_push_in_slot(int slot, uint64_t amount);
+uint64_t stadium_reservoir_peek_in_slot(int slot);
+
+/* The quota slot that owns cell_index (-1 out of range). A resident cell's
+ * owner never changes. */
+int stadium_cell_owner_slot(size_t cell_index);
+
+/* stadium_evict(), and *credited receives the heat returned to the owner's
+ * reservoir, read under the owner's lock (kernel-Hermes's release ledger). */
+int stadium_evict_credit(size_t cell_index, uint64_t *credited);
+
+/* kernel-Hermes's message decay, under the owning slot's lock: heat becomes
+ * q48_mul(heat, factor_q48); the difference is recorded as the slot's
+ * consumed heat and returned in *consumed_out. -1 if the cell isn't resident. */
+int stadium_cell_decay(size_t cell_index, uint64_t factor_q48, uint64_t *consumed_out);
+
+/* Sets or clears STADIUM_FLAG_PIN under the owning slot's lock (session.c's
+ * session_set_pinned(), the sole pin choke point). -1 if out of range. */
+int stadium_cell_set_pin(size_t cell_index, int pinned);
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_VM_STADIUM_H */