fix(security): no VM but Artemis and Hera can make Hera run text; a message runs once; word-ACL elevation removed

Any identity could have arbitrary FORTH run as Zuse: KH-ELEVATE-SEND and
KH-BLK-ATTACH-SEND sent any text to Hera, from any VM (shown live).  And the
drain popped a message after running it, so a payload calling a colon word
ran twice.  Both fixed test first (FABRIC-3 SXXXVII):

- KH-BLK-ATTACH-SEND is ( dev-addr ok? -- sent? ), Artemis only; the kernel
  writes the reply text.  BLK-ATTACH-ACK is Hera's only.
- The drain pops before it runs.
- Elevation, ruled not needed: KH-ELEVATE-SEND, message type 8,
  zuse-eligibility.4th, ZUSE-ELIGIBLE?/ZUSE-ELIGIBILITY-ADD/
  ELEVATE-PUBKEY-UNPACK and the eligibility list removed; its disk area
  stays reserved, unused.  FABRIC-3.7 closed.

Three ISAs: POST 1052 passed; new parity baseline word_count=523
hash=0xb73b58052d591638 (deliberate).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

capsules/MANIFEST.md

@@ -49,7 +49,7 @@ Blocks: **2049–2052, 2057**
 
 | Block | Immutable | Justification |
 |-------|-----------|---------------|
-| 2049  | No        | Hera VM init: `VM-TREE`/`VM-PARENT`/`VM-CHILDREN`; loads `ACL.4th`, `block-acl.4th`, `zuse-eligibility.4th`, `lib.4th`. **Corrected 2026-09-19 (three times)** — first pass removed a stale listing of `compudynamics`/`common:msg`/`fleet-k`/`process` (none loaded here; two already-deleted, two stripped in the same pass, FABRIC-3.6.md tasks 0.2/0.3). Second pass (same day): `fabric.4th`/`font.4th` **removed** from this list — relocated to `hestia/init.4th` (FABRIC-3.6.md tasks 1.6/1.7), Hera no longer loads either. Third pass (2026-09-22, FABRIC-3.6.md Phase 4 Stage E): `common:messaging.4th` + `MSG-CD-INIT` **removed** — the file itself is deleted (see "Deleted capsules" below); every FORTH-owned message type was cut over to kernel-Hermes first (Phase 3) |
+| 2049  | No        | Hera VM init: `VM-TREE`/`VM-PARENT`/`VM-CHILDREN`; loads `ACL.4th`, `block-acl.4th`, `lib.4th` (`zuse-eligibility.4th` removed 2026-10-14 with word-ACL elevation — FABRIC-3.md §XXXVII). **Corrected 2026-09-19 (three times)** — first pass removed a stale listing of `compudynamics`/`common:msg`/`fleet-k`/`process` (none loaded here; two already-deleted, two stripped in the same pass, FABRIC-3.6.md tasks 0.2/0.3). Second pass (same day): `fabric.4th`/`font.4th` **removed** from this list — relocated to `hestia/init.4th` (FABRIC-3.6.md tasks 1.6/1.7), Hera no longer loads either. Third pass (2026-09-22, FABRIC-3.6.md Phase 4 Stage E): `common:messaging.4th` + `MSG-CD-INIT` **removed** — the file itself is deleted (see "Deleted capsules" below); every FORTH-owned message type was cut over to kernel-Hermes first (Phase 3) |
 | 2050  | No        | BOOT-BANNER call — separated so the banner block can be swapped without touching init logic |
 | 2051  | No        | TRIPOD-TEST — 6 acceptance gates per TRIPOD.md. Dead EVENT-WAIT step replaced with HERMES-TICK liveness check (`3436d564`) |
 | 2052  | No        | TRIPOD-TEST invocation block |
@@ -350,7 +350,7 @@ three-architecture acceptance for the deletion: `logs/20260922-181141/amd64/`,
 Phase 4 entry for the full account, including one found-not-fixed collateral
 defect (`SEND-ELEVATE-REQUEST`, this file's own former caller into
 `zuse-eligibility.4th`'s `ELEVATE-GRANT`, is now unreachable — Captain Bob's
-2026-09-22 decision: leave it, Phase 8 PKI will build its own entrypoint).
+2026-09-22 decision: leave it, Phase 8 PKI will build its own entrypoint). Removed 2026-10-14: elevation was ruled not needed, and `zuse-eligibility.4th` (blocks 4021–4022), its C words and the eligibility list went with it (FABRIC-3.md §XXXVII).
 Former blocks 4100–4153 (ex-Artemis-gaps) are now UNASSIGNED — see Unassigned
 Ranges below. The per-block justification table this section used to carry
 (arena allocator ABI, message/channel field accessors, the VM-name routing