FABRIC-3.5.md §XVII: item 12 CLOSED -- Console already exists as a singleton, it just has no VM face

Closes the largest remaining design item, the one gating §IV.

§XIII.5 got this wrong by comparing the wrong object. It measured the
Tripod legs against capsule_console_birth()'s per-attach proxies, found
Console "plural, ephemeral and capsule-less," and concluded a singular
Console did not exist -- so §IV.1 would be inventing one. Traced: there
are three distinct things called console here, not two. The HAL drawing
fabric (hal/console.c, framebuffer.c, vt100.c, font_8x16.c, ~98 KB of
kernel C) is already singular, already permanent, already kernel-resident.
It is not a VM and has no owner.

So the Console leg is that fabric given a VM face, not a promoted proxy.
The proxies stay plural and ephemeral, which is correct -- they are what
binding produces, not what Console is. §V.1's bind point then falls out
rather than being asserted: the VM owning the fabric is necessarily what
you bind to. §XIII.5's proposed shape was right; its justification was
wrong, and is corrected in place.

Records the evidence that the fabric actually wants an owner, which is an
argument for the reshuffle this document had not previously identified.
The ownerless console_set_vm_name() global has already caused a live bug,
documented in console.h:193-203 -- get_vm_name() is unsafe for
save-then-restore because an intervening set overwrites the saved
pointer's own bytes before the restore runs; found live 2026-08-28,
silently no-opping, with console_save_vm_name() existing solely to work
around it. That is the signature of shared mutable state with no owner.

Notes what the ruling commits to: a new capsules/console/init.4th (the
one genuinely new artifact, and it is a capsule rather than a mechanism),
the is_fleet_foundation triple changing membership, kernel_main.c's
Hermes birth becoming Console's, the DoE CSV schema change, and Console
needing BIRTH registered. §IV is unblocked.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VkM1zHGvBerLF6aqkHPweP

FABRIC-3.5.md

@@ -602,9 +602,9 @@ Collected so nothing here is mistaken for settled. **Updated 2026-09-18 after §
 Most of this list is now closed — see §XIV.2 and §XV.6 for what resolved, dissolved, or had its
 premise rejected.
 
-**Still genuinely open — updated again 2026-09-18 after §XVI settled item 10.**
-- **Item 12 (§XIII.5)** — is the Console Tripod leg a new singleton, distinct from today's
-  per-attach proxies? **Now the largest remaining design item**, and still gates §IV.
+**Still genuinely open — updated again 2026-09-18 after §XVII closed item 12. Nothing
+structural remains; what follows are small local decisions, one placement question, and one
+build-time check.**
 - **Item 9 (§VII.2/§XVI.5)** — half-answered. The consumer action is defined for the two
   fleet-fatal cases; open is whether an *ordinary peer's* `SOS` is actionable or merely
   advisory, plus the trivial number allocation.
@@ -768,6 +768,16 @@ would create a Console that does not currently exist. That is worth naming plain
 is the one place this document's "reorganization, not invention" scope discipline is genuinely
 strained.
 
+> **CORRECTED 2026-09-18 by §XVII — the paragraph above compares the wrong object.** The
+> singular pinned Console *does* already exist: it is the HAL drawing fabric
+> (`hal/console.c`, `framebuffer.c`, `vt100.c`, `font_8x16.c`), already singular, permanent
+> and kernel-resident — it simply has no VM face and no owner. The per-attach proxies this
+> section measured against are what *binding produces*, not what Console *is*. The scope
+> discipline is therefore **not** strained: the leg is an existing singleton given an owner,
+> and the only genuinely new artifact is a capsule personality. The resolution shape proposed
+> below was right; this justification for it was wrong. **RATIFIED — see §XVII.2.** Left in
+> place, not rewritten.
+
 **The shape that resolves it without inventing anything** — offered as analysis, **not
 ratified, Captain Bob's call**: distinguish **Console** (singular, pinned, capsule-backed, the
 Tripod leg — owns the drawing fabric and is the bind point, per §V.1) from **console proxies**
@@ -1264,3 +1274,107 @@ VM inheriting Hera's authority — it is the machine having nothing left to run.
 authority flowing only down the birth graph (§IX.2) while still terminating.
 
 **Offered as analysis, not a ruling — Captain Bob's call.** Added as punch item 18.
+
+---
+
+## XVII. Item 12 CLOSED — "Console" already exists as a singleton; it just has no VM face
+
+Taken as closing **item 12** (§XIII.5's Console-singleton question), the largest remaining
+design item and the one gating §IV.
+
+**§XIII.5 framed this wrongly, and the error is worth naming before the answer.** It compared
+the Tripod legs against `capsule_console_birth()`'s per-attach proxies, found Console "plural,
+ephemeral and capsule-less," and concluded that a singular pinned Console "does not currently
+exist" — so §IV.1 would be creating one, straining the reorganization-not-invention discipline.
+**That comparison picked the wrong object.** Traced 2026-09-18: there are three distinct things
+called "console" in this kernel, not two.
+
+### XVII.1 — The three consoles, traced
+
+1. **The HAL console — the drawing fabric itself.** `src/starkernel/hal/console.c` (14 KB),
+   `framebuffer.c` (13 KB), `vt100.c` (43 KB), `font_8x16.c` (27 KB) — ~98 KB of kernel C.
+   **Already singular. Already permanent. Already kernel-resident.** It is not a VM and has no
+   owner in the fleet sense.
+2. **The console proxy VMs** — `capsule_console_birth()`, plural, ephemeral, minted per attach
+   from a 3-line C string literal (§XIII.5).
+3. **The active-console-VM name** — a single global, `console_set_vm_name()`/
+   `console_get_vm_name()` (`include/starkernel/console.h:190-191`), swapped by every dispatch
+   in the "switch, do work, switch back" pattern.
+
+### XVII.2 — RULING: the Console Tripod leg is (1), given a VM face. Not a promoted proxy.
+
+The singular, permanent Console this design wants **already exists in substance** — it is the
+drawing fabric. What it lacks is an *owner*: today the fabric is an ownerless kernel singleton
+that any VM reaches into through a global. So §IV.1's "Console takes the vacated third slot"
+is **not** the invention §XIII.5 feared. It is giving an existing singleton a VM face.
+
+That resolves the tension cleanly and without inventing anything:
+
+- **The Console leg is singular, pinned and born-at-boot** — because the fabric it owns already
+  is all three.
+- **The proxies are untouched.** They stay plural and ephemeral, which is correct: they are
+  what *binding produces*, not what Console *is* (§XIII.5's own phrasing, now properly
+  grounded).
+- **§V.1's "bind point" falls out rather than being asserted.** The VM that owns the fabric is
+  necessarily what a user or agent VM binds *to*.
+
+**§XIII.5's proposed shape was right; its justification was wrong.** It proposed exactly this
+leg/proxy split but called the leg new. The leg is not new — only its VM face is.
+
+### XVII.3 — The evidence that the fabric actually wants an owner
+
+This is not merely tidy. The ownerless global in (3) has already caused a real, live bug,
+documented in the kernel's own header (`console.h:193-203`): `console_get_vm_name()` alone is
+**not** safe for save-then-restore, because it returns a pointer into the single internal
+buffer that `console_set_vm_name()` copies into — so an intervening call in the normal
+"switch, do work, switch back" pattern overwrites the very bytes the saved pointer points at
+**before the restore runs**. Found live 2026-08-28; the restore silently no-opped.
+`console_save_vm_name()` exists solely to work around it.
+
+That is the signature of shared mutable state with no owner. **Giving the fabric an owning VM
+is a structural fix for the class**, not just a reorganization — and it is an argument *for*
+Bob's reshuffle that this document had not previously identified.
+
+### XVII.4 — What this commits to, concretely
+
+Consequences of the ruling, so they are not discovered late:
+
+- **Console needs a capsule personality.** `capsules/console/init.4th` — a new directory beside
+  `hermes/` and `artemis/`. This is the one genuinely new artifact, and it is a capsule, not a
+  mechanism.
+- **`is_fleet_foundation` changes membership** (`capsule_birth.c:793-796`): the name-prefix
+  triple becomes Hera / Artemis / Console. That single line is what makes a VM pinned
+  (§XIII.3), so it is also what makes Console a Tripod leg.
+- **`kernel_main.c:865`'s `S" Hermes" BIRTH` becomes Console's birth**, and the switch-signal
+  registration at `:1007` follows it.
+- **The DoE CSV schema changes** — `doe_log.c`'s six Tripod-named columns (§XIII.3). Still the
+  expensive consequence, still not to be resolved by quietly renaming a column.
+- **Console must have `BIRTH` registered** (§XIII.6): binding mints a proxy, and minting is
+  `BIRTH`. Already settled in principle by §XV.1's "any VM can birth."
+- **Console becomes the owner of the `console_set_vm_name()` discipline** — the fix in §XVII.3
+  is available once there is an owner, but is **not** in this reshuffle's scope. Flagged, not
+  scheduled.
+
+### XVII.5 — §IV is unblocked, and §XIII.5's marker corrected
+
+With item 12 closed, **§IV.1 (Tripod = Hera/Artemis/Console) stands as ratified with no
+outstanding objection**, and §IV.2 remains dissolved per §XIV.2. §XIII.5's "this is the one
+place the scope discipline is genuinely strained" no longer holds and is corrected there.
+
+### XVII.6 — Punch list after this ruling
+
+- ✅ **Item 12 — CLOSED** (§XVII). The Console leg is the existing drawing-fabric singleton
+  given a VM face; proxies unchanged. §IV unblocked.
+- 🔶 **Item 9** — half-answered (§XVI.5): open is whether an ordinary peer's `SOS` is actionable
+  or advisory, plus the number allocation.
+- ⬜ **§VIII.3 first bullet** — where the sinking semaphore mechanically lives.
+- ⬜ **Item 16** (§XV.4) — implementation check: teardown paths must reach `STADIUM-EVICT`.
+- ⬜ **Item 17** (§XVI.2) — does Hera's suicide replace `BYE`'s cold-restart or become a
+  separate word?
+- ⬜ **Item 18** (§XVI.7) — if Hera is already dead, nobody performs the halt.
+
+**Nothing structural remains open.** Items 9, 17 and 18 are small, local decisions; §VIII.3's
+first bullet is a placement question; item 16 is a build-time check. Every load-bearing
+architectural question this document opened — what Hermes becomes, what the Tripod is, what
+`BIRTH` means, who owns death, who owns turn order, what survives, what shutdown is — is now
+ruled.