Stage B proof: add per-VM consumed term to stadium_conserved -- FABRIC-3.6.md task 2.7

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

FABRIC-3.6.md

@@ -683,10 +683,35 @@ Hestia; headless policy intact.
       Limit, stated: the corruption proof exercises the predicate, not the wiring of the live
       audit's failure branch (that branch never executed). Task 2.8's scan cross-check is the
       independent check on the counters themselves.
-- [ ] **2.7** — **Stage B proof** (§XXXIV.3 as corrected by §XXXIX.4): alloc/free cycle
+- [x] **2.7** — **Stage B proof** (§XXXIV.3 as corrected by §XXXIX.4): alloc/free cycle
       verifying **(a)** the ledger and **(b)** `stadium_conserved()` before and after.
       *Check:* both true, all three arches. **`fleet_conserved` is not evidence here** — it
       cannot see Stadium heat (§XXXIX.1).
+      2026-09-20 · `logs/20260920-212209/amd64/`, `logs/20260920-212522/aarch64/`,
+      `logs/20260920-212845/riscv64/` — all print `Stage B (ledger + stadium_conserved): PASS`,
+      `audit_failures=0`, `vm_consumed=693`; zero `UNKNOWN WORD`; `dict_hash` triple unmoved and
+      identical across ISAs; reach `[zuse@Hera] ok>`.
+
+      **Prerequisite built here, as §XL.4 directs:** `stadium_conserved()` gains its `consumed`
+      term. New per-VM `consumed` field in `StadiumVMQuota` (zeroed at both quota-creation
+      sites), `stadium_consumed_record()`/`stadium_consumed_peek()`, and
+      `stadium_conserved()` now checks `resident + reservoir + consumed == Q48_ONE`, epsilon
+      zero. `SkHermesMessage` gained an `owner` VMUuid so decay charges the funding VM;
+      `sk_hermes_decay()` records into it. Other VMs are unaffected (consumed stays 0).
+
+      Stage B checks `stadium_conserved()` at four points — before, mid-hold, after decay,
+      after release — plus the ledger audit, and requires the old **two-term form to FAIL after
+      decay** while the four-term form holds (non-vacuity: the consumed term is load-bearing).
+      `fleet_conserved` is not consulted.
+
+      **First attempt FAILED on all three ISAs** (`logs/20260920-211204/`, `-211517/`,
+      `-211840/`, kept as audit artifacts). Cause was a bug in the test, not the code: it
+      expected 32 allocations, but the preceding decay cycle had consumed 352 from that VM's
+      reservoir so only 31 fit. Fixed by deriving the expected count from the current reservoir.
+      Vm_consumed=693 is 352 (32×11, first cycle) + 341 (31×11, Stage B).
+
+      **Phase 2 gate: passed** (2.7 holds on all three arches). Remaining Phase 2 work is 2.8
+      (diagnostic scan cross-check).
 - [ ] **2.8** — Scan-based cross-check of the counters, diagnostics only, off the hot path
       (§XXXVII.4). *Check:* scan agrees with counters.