Phase 5 close-out: Isabelle pass, doc sweep, SBOM, version bump (FABRIC-3.6.md tasks 5.1-5.4)

5.1: Isabelle/HOL pass (52 theories, clean) -- restated the boundary rather
than just citing the green build: proof/ scope was already entirely
outside this reshuffle's footprint (src/starkernel/, capsules/*.4th),
so the boundary is unchanged, not moved.

5.2: Documentation sweep. CLAUDE.md's stale WIP banner and Tripod fleet
description updated now that Phases 0-4 have actually landed (Hera/
Artemis/Hestia, no Hermes). MANIFEST.md rides the strip -- hermes/init.4th's
block table replaced with a deletion note, init.4th/doe-campaign.4th/
hestia/init.4th entries corrected to match the post-strip live files.
Confirmed the TRIPOD.md/0.1 contradiction was already resolved (2026-08-13).
Settled the superseded-docs call explicitly: archive as-is, do not rewrite.
Fixed experiments/bare_metal/README.md's block-size framing (still said
1024-byte budget; real rule is 64 chars x 16 lines). K-qualification
checked clean against the two living documents; full retroactive sweep
of the closed archival FABRIC corpus explicitly declined as disproportionate.

5.3: make sbom. Installed syft (user-local, approved). Found and fixed a
real Makefile bug while at it -- the sbom target hardcoded
--source-name StarForth, so DocumentName was wrong even after regenerating.

5.4: LITHOS_VERSION 2.0.0 -> 2.1.0, engine VERSION 3.1.0 -> 3.2.0 (minor,
per the dictionary-visible-only rule). Replaced the stale version-comment
block in Makefile.starkernel (had the odd/even LTS rule backwards) and
docs/lithosananke/ROADMAP.md's retired versioning-policy section with the
ratified ladder. Verified on all three architectures; riscv64's first pass
hit a transient virtio_blk timeout during boot-time Zuse genesis mint,
reported and confirmed non-reproducing on an immediate clean retry.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -11,20 +11,31 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 > **Superseded subsystem docs (Captain Bob, 2026-08-15):** `.claude/TRIPOD.md`,
 > `.claude/HERMES.md`, `.claude/ARTEMIS.md`, and `.claude/CONSOLE.md` are all superseded —
 > `FABRIC-0.md`, `FABRIC-1.md`, and `FABRIC-2.md` (all design history/archival as of
-> 2026-09-04) and `FABRIC-3.md` (current/living, topic: bare metal boot, read this one first)
-> are the sole authoritative source for Tripod/Hermes/Artemis/Console work now. The four
-> subsystem docs remain in the repo as historical record only; each carries its own
-> superseded-header pointing here. Do not treat them as current, do not read them for design
-> authority, and do not cite them in place of `FABRIC-0.md`/`FABRIC-1.md`/`FABRIC-2.md`/
-> `FABRIC-3.md`.
+> 2026-09-04), `FABRIC-3.md` (current/living, topic: bare metal boot), and `FABRIC-3.5.md`/
+> `FABRIC-3.6.md` (Tripod/kernel reshuffle, design + execution) are the sole authoritative
+> source for Tripod/Hermes/Artemis/Console work now. The four subsystem docs remain in the
+> repo as pure historical record — they describe the pre-reshuffle Hera/Hermes/Artemis fleet,
+> and `.claude/HERMES.md` in particular now describes a VM that no longer exists in this
+> codebase at all, not merely a superseded design. Each carries its own superseded-header
+> pointing here. Do not treat them as current, do not read them for design authority, and do
+> not cite them in place of `FABRIC-0.md`/`FABRIC-1.md`/`FABRIC-2.md`/`FABRIC-3.md`/
+> `FABRIC-3.5.md`/`FABRIC-3.6.md`. **Decision (Captain Bob, 2026-09-22, FABRIC-3.6.md task
+> 5.2): archive as-is, do not rewrite.** These four docs stay frozen at their 2026-08-15
+> superseded state; they are not updated to reflect Hermes's removal, since they are already
+> explicitly out of scope for current design authority and rewriting historical record to
+> track a codebase it no longer describes would defeat its purpose as a record.
 
-> **WORK IN PROGRESS — Tripod/kernel reshuffle (2026-09-19).** Hermes moves into the kernel;
-> the Tripod becomes **Hera / Artemis / Hestia**. Design is complete and ruled in
-> **`FABRIC-3.5.md`** (authoritative); execution is tracked in **`FABRIC-3.6.md`** — **start
-> there, at its `START HERE` section.** `FABRIC-3.md` remains open and authoritative for its
-> own topic (bare metal boot); nothing in the reshuffle supersedes it. **No reshuffle code has
-> been written yet.** The descriptions of the Tripod elsewhere in this file describe the
-> *current* fleet (Hera/Hermes/Artemis) and stay correct until the reshuffle lands.
+> **Tripod/kernel reshuffle — Phases 0–4 COMPLETE (2026-09-22); Phase 5 close-out in
+> progress.** Hermes moved into the kernel as kernel-Hermes (`src/starkernel/vm/kernel_
+> hermes.c`); the Tripod is now **Hera / Artemis / Hestia** — **the Hermes VM, `capsules/
+> hermes/init.4th`, and `capsules/common/messaging.4th` no longer exist in this codebase.**
+> Design is complete and ruled in **`FABRIC-3.5.md`** (authoritative); execution is tracked in
+> **`FABRIC-3.6.md`**. `FABRIC-3.md` remains open and authoritative for its own topic (bare
+> metal boot); nothing in the reshuffle supersedes it. **The Tripod/fleet descriptions
+> elsewhere in this file have been updated to match** (Hera/Artemis/Hestia, no Hermes) — this
+> is no longer a "stays correct until it lands" caveat, it already landed. Remaining:
+> Isabelle pass ✅, doc sweep (this note) ✅, SBOM/version bump/master-merge still open — see
+> `FABRIC-3.6.md` Phase 5 for status.
 
 > **Scope:** This repo is LithosAnanke — the bare-metal UEFI kernel that boots StarForth
 > directly on hardware. StarForth (the hosted FORTH-79 VM) has its own separate repository
@@ -181,8 +192,11 @@ userspace runtime. No libc, no traditional OS underneath. It is the bare-metal t
 removed as an active target.)
 
 **Current status: M7.1** — capsule birth protocol, Mama FORTH vocabulary, Tripod multi-VM
-fleet (Hera/Hermes/Artemis), and word-level ACL (Phases 1–7) are live; POST at boot verifies
-parity hash across amd64/aarch64/riscv64 with a 453-word Mama capsule dictionary.
+fleet (Hera/Artemis/Hestia — Hermes moved into the kernel as kernel-Hermes, FABRIC-3.6.md
+Phase 4, 2026-09-22), and word-level ACL (Phases 1–7) are live; POST at boot verifies parity
+hash across amd64/aarch64/riscv64 with a 530-word Mama capsule dictionary (word count as of
+the Phase 4 strip; verify against a live `PARITY:M7.1a word_count=` line before citing, it
+changes with any new C word registration).
 
 **Key distinguishing features:**
 
@@ -191,9 +205,11 @@ parity hash across amd64/aarch64/riscv64 with a 453-word Mama capsule dictionary
 - Content-addressed, immutable **capsules** as the primary organizational unit — no dynamic
   allocator in the traditional sense; identity is a content hash (XXHash64), mutation
   produces a new capsule
-- **Tripod** — a named multi-VM fleet (Hera the Mama VM, two Hermes instances, Artemis)
-  that births, runs, and re-births independently; verified booting live pre-REPL on all
-  three architectures. See `.claude/TRIPOD.md`, `.claude/HERMES.md`, `.claude/ARTEMIS.md`.
+- **Tripod** — a named multi-VM fleet (Hera the Mama VM, Artemis, Hestia) that births, runs,
+  and re-births independently; verified booting live pre-REPL on all three architectures.
+  Hermes moved into the kernel as kernel-Hermes (`src/starkernel/vm/kernel_hermes.c`) and is
+  no longer a Tripod VM — see `FABRIC-3.5.md`/`FABRIC-3.6.md`, not the archived
+  `.claude/TRIPOD.md`/`.claude/HERMES.md`/`.claude/ARTEMIS.md`.
 - Word-level ACL security system with kernel parity (see above) — measured overhead three
   orders of magnitude below the measurement floor
 - Kconfig-based build configuration (~40 discoverable symbols spanning physics/heartbeat/

FABRIC-3.6.md

@@ -1340,18 +1340,131 @@ intermediate states.
       explicitly accept that Phase 8 PKI work will need to build its own entrypoint from
       scratch rather than resuming this one.
 
+      **Decision (Captain Bob, 2026-09-22): leave it unreachable.** `ELEVATE-GRANT` and
+      `KH-ELEVATE-SEND` stay in place, uncalled, until Phase 8 PKI begins; that milestone will
+      build its own entrypoint rather than resuming `SEND-ELEVATE-REQUEST`. No further action
+      this phase.
+
 ## Phase 5 — Close-out
 
-- [ ] **5.1** — Isabelle/HOL pass. **Deliverable is the restated boundary**, explicitly
+- [x] **5.1** — Isabelle/HOL pass. **Deliverable is the restated boundary**, explicitly
       including §XXV.4's coverage loss — *not* a green build (§XXV.3).
-- [~] **5.2** — Documentation sweep, grepping **by exclusion** (§XXVIII.3).
+      2026-09-22 · **Closed.** `/home/rajames/CLionProjects/Isabelle2011-1/bin/isabelle build
+      -o threads=1 -D proof/` (memory-safe single-threaded flag per this session's own standing
+      rule) — exit 0, "Finished StarForth" in 41s (warm heap cache), zero `FAILED`/`error`/
+      `sorry`/`warning` across all 52 theories. This is the green build, included for
+      completeness, but per `proof/COVERAGE.md`'s own framing it isn't the deliverable.
+
+      **The restated boundary.** `proof/COVERAGE.md` (generated 2026-08-14, commit `346c793`,
+      unchanged since) scopes the entire suite to `src/word_source/*.c` — the 34 vendored
+      FORTH-word-implementation files, the 7 physics loops, Q48.16, and the 5 word-level ACL
+      policy theories. **None of Phases 0–4 of this reshuffle touched anything in that scope.**
+      Every file this reshuffle changed lives in `src/starkernel/` (kernel-only C, `kernel_
+      hermes.c`/`.h`, `repl.c`, `capsule_*.c`, `kernel_main.c`) or `capsules/*.4th` (Hera/
+      Artemis/Hestia init capsules, the deleted `messaging.4th`/`hermes/init.4th`) — both
+      entirely outside `proof/`'s own stated boundary from the start. The clean pass above
+      confirms no regression in the covered surface, but it is not evidence the reshuffle's
+      *own* new code (kernel-Hermes's C implementation, the WIREBIND/MINT identity flow, the
+      capsule birth/switch-signal changes) is formally verified — none of that was ever in
+      scope for this suite, and still isn't. The suite's already-documented gaps (block-window
+      cache, TIB scan-shape variants beyond `forth_parse_word`, vocabulary-chain file-scope
+      statics, raw-pointer DictEntry navigation, the three divergent L8 mode-selector
+      representations — full list in `proof/COVERAGE.md`'s own "structurally NOT provable"
+      section) are unaffected by this reshuffle either way, since none of them intersect
+      `src/starkernel/` or `capsules/` at all. **Net effect on the boundary: none — restated,
+      not moved.**
+- [x] **5.2** — Documentation sweep, grepping **by exclusion** (§XXVIII.3).
       **CLAUDE.md's four errors: DONE 2026-09-19 (§XLIV), pointer to this document added.**
-      Outstanding: `MANIFEST.md` (rides the strip, §XXII.5), the `TRIPOD.md`/0.1 contradiction,
-      item 42's K-qualification, the superseded subsystem docs' update-or-archive call, and
-      item 45 (`experiments/bare_metal/README.md` block framing).
-- [ ] **5.3** — `make sbom`; check `Created:` and `DocumentName` (§XXVI.2).
-- [ ] **5.4** — `LITHOS_VERSION = 2.1.0`; engine `VERSION` per §XXX.6's rule; roadmap table
+      2026-09-22 · **Closed.** Every outstanding item resolved or explicitly settled:
+
+      - **`.claude/CLAUDE.md` itself, further updated** (beyond the four-errors pass): now
+        that Phase 4 has actually landed, its WIP banner claiming "no reshuffle code has been
+        written yet" was false — corrected to reflect Phases 0–4 complete. The "current fleet"
+        Tripod description (Hera/Hermes/Artemis, plus a stray "two Hermes instances" claim
+        that was stale even before this reshuffle) updated to Hera/Artemis/Hestia. Mama
+        dictionary word count corrected `453` → `530` (current `PARITY:M7.1a word_count=`),
+        with a caveat to verify against a live line rather than cite the number statically.
+      - **`MANIFEST.md` rides the strip (§XXII.5) — done.** `hermes/init.4th`'s full
+        block-by-block table (4100–4153) replaced with a deletion note (detail recoverable
+        from git history, not duplicated); `common/messaging.4th`'s deletion recorded in
+        "Deleted capsules"; `init.4th` block 2049, `doe-campaign.4th` blocks 4060–4062, and
+        `hestia/init.4th` block 4987 (its `COMMON-CH` join no longer exists) all updated to
+        match the post-strip live files, verified by direct read. Former Hermes range marked
+        UNASSIGNED. `mkcapsule --manifest capsules` reports zero conflicts, 36 capsules,
+        after the edit.
+      - **The `TRIPOD.md`/0.1 contradiction (punch item 26) — confirmed already resolved.**
+        `.claude/TRIPOD.md`'s "Immediate Goal" section carries its own 2026-08-13 correction
+        header stating the contradiction (Hera auto-spawning Hermes/Artemis at boot) was fixed
+        then, before the document was even marked superseded (2026-08-15). No further action
+        needed; the punch item was asking to confirm a fix already in place, not make one.
+      - **Item 42 (K-qualification) — checked against the currently-living corpus, clean; full
+        retroactive sweep of the closed archival corpus explicitly declined.** `.claude/
+        CLAUDE.md` and `FABRIC-3.6.md` (the two documents this reshuffle actually reads/writes
+        day to day) both already use qualified terms throughout (`fleet K`, `stadium_
+        conserved()`, `quota conservation`) with zero ambiguous bare-`K` hits. The closed
+        archival documents (`FABRIC-0.md`/`FABRIC-1.md`/`FABRIC-2.md`/`FABRIC-3.5.md`) carry
+        110 combined raw `\bK\b` regex hits — the large majority already correctly qualified
+        in context (the regex can't distinguish "fleet K" from a genuinely bare "K"), scattered
+        across ~20,000 combined lines of design record. A full manual audit is disproportionate
+        to the residual risk and contradicts this series' own stated discipline (`FABRIC-3.5.md`
+        §XLII.2: "design rulings are never restated... corrections are recorded, not silently
+        rewritten into archival history"). Declined, not silently dropped — recorded here as
+        the explicit decision.
+      - **The superseded subsystem docs' update-or-archive call — settled: archive, do not
+        update.** Recorded directly in `.claude/CLAUDE.md`'s own superseded-docs note: `TRIPOD.
+        md`/`HERMES.md`/`ARTEMIS.md`/`CONSOLE.md` stay frozen at their 2026-08-15 state.
+        `HERMES.md` in particular now describes a VM that no longer exists in this codebase at
+        all (not merely a superseded design) — noted explicitly rather than silently left
+        stale, but not rewritten, since rewriting a historical record to track a codebase it no
+        longer describes defeats its purpose as a record.
+      - **Item 45 — `experiments/bare_metal/README.md` block framing — was real, fixed.**
+        Line 149 still said "each block can hold up to 1024 bytes of source text," the same
+        wrong-kind-of-rule `FABRIC-3.5.md` §XLIV.1 found and corrected in `.claude/CLAUDE.md`
+        on 2026-09-19 (8 lines of 128 characters is 1024 bytes and still fails — the real
+        limit is per-line/per-line-count, not a byte total). Corrected to the real rule (64
+        chars × 16 lines, block range `[2048,5120)`, verify with `mkcapsule --lint`, not
+        `wc -c`) — this file had never received that correction.
+- [x] **5.3** — `make sbom`; check `Created:` and `DocumentName` (§XXVI.2).
+      2026-09-22 · **Closed.** `syft` was not installed on this machine — installed to
+      `~/.local/bin` (user, not root; explicit approval obtained first). First regen fixed
+      `Created:` (`2026-07-24` → live) but `DocumentName` stayed wrong (`StarForth`) — traced to
+      a genuine Makefile bug, not a stale artifact: `Makefile:747` hardcodes `--source-name
+      StarForth` in the `sbom` target. Fixed (`--source-name LithosAnanke`, explicit approval
+      obtained first) and regenerated. Both fields now correct: `DocumentName: LithosAnanke`,
+      `Created: 2026-09-22T23:21:56Z`. `sbom.spdx`/`sbom.spdx.json` and the `Makefile` one-line
+      fix ride this phase's commit.
+- [x] **5.4** — `LITHOS_VERSION = 2.1.0`; engine `VERSION` per §XXX.6's rule; roadmap table
       gains its `2.1.0` line in two live places (§XXVIII.2).
+      2026-09-22 · **Closed.** `Makefile.starkernel`: `LITHOS_VERSION` `2.0.0` → `2.1.0`;
+      engine `VERSION` `3.1.0` → `3.2.0` (minor per §XXX.6's rule — dictionary-visible changes
+      only: `BIRTH`'s registration widened, the messaging layer replaced by kernel-Hermes,
+      `PLOT`/`FB-*` relocated to Hestia; no FORTH-79 word semantics changed). The stale
+      version-comment block in `Makefile.starkernel` (which still said "even major = LTS" —
+      backwards relative to the ratified §XXX.1 odd/even rule — and had no `v2.1.0` entry)
+      replaced with the real ladder. `docs/lithosananke/ROADMAP.md`'s own "Release Versioning
+      Policy" section (the second of the two live places) was still the full retired
+      2026-08-28 policy, not just a stale table — replaced with the ratified §XXX policy text,
+      the old text kept struck-through in a `<details>` block for traceability, and the
+      board-by-board rollout section's "each cut is an LTS point-in-time cut" line corrected
+      (v2.x is the even/working line under the ratified policy, not LTS).
+
+      Verified the bump flows through the real build: `include/version.h` shows
+      `STARFORTH_VERSION "3.2.0"` / `LITHOS_VERSION "2.1.0"` after a clean amd64 rebuild.
+      Full three-architecture acceptance re-run (version bump is a `Makefile.starkernel`
+      change, so it gets the same three-arch boot as any kernel change): amd64
+      (`logs/20260922-192400/amd64/`) and aarch64 (`logs/20260922-192931/aarch64/`) both clean
+      on the first pass — zero `UNKNOWN WORD`, banner correctly reads `LithosAnanke v2.1.0` /
+      `StarForth Version 3.2.0`. riscv64's first pass (`logs/20260922-193504/riscv64/`) hit a
+      `virtio_blk: vblk_io timed out` during the boot-time Zuse genesis mint (fence marker
+      write failed, not persistent) — reached `[zuse@Hera] ok>` regardless, but flagged rather
+      than accepted on a degraded run. Retried immediately with no code change
+      (`logs/20260922-194020/riscv64/`): clean pass, genesis mint succeeded, zero `UNKNOWN
+      WORD`. Assessed as transient host I/O contention under TCG (single qemu process, no
+      leaked processes, host memory tight but not exhausted at the time) rather than a
+      regression — this change touched only `Makefile.starkernel` version strings/comments and
+      two markdown files, no runtime code — and the clean retry on identical disk state/binary
+      confirms it. Reported here rather than silently retried-and-forgotten, per Captain Bob's
+      Law.
 - [ ] **5.5** — Resolve the stray `refs/heads/v2.0.1` and PR #1 (§XXVI.4). **Investigate, do
       not delete.**
 - [ ] **5.6** — Merge to `master`; tag `v2.1.0`.

Makefile

@@ -744,7 +744,7 @@ sbom:
 		exit 1; \
 	fi
 	@syft dir:. -o spdx-json=sbom.spdx.json -o spdx=sbom.spdx \
-		--source-name StarForth \
+		--source-name LithosAnanke \
 		--source-version $(VERSION) \
 		--exclude './build/**' --exclude './tools/**' --exclude './.git/**'
 	@echo "✅ SBOM generated:"

Makefile.starkernel

@@ -71,16 +71,28 @@ MAKEFLAGS += -j$(NPROC)
 endif
 
 # Version
-# Roadmap (per docs/lithosananke/ROADMAP.md "Release Versioning Policy" and
-# FABRIC-2.md §G — X.0.0 = QEMU release, X.5.0 = hardware bare-metal release):
-#   v1.0.x — serial-only production (released)
-#   v1.5.x — framebuffer VT100 terminal/console milestone (released)
-#   v2.0.0 — QEMU release (even major = LTS): three-arch QEMU story complete
-#   v2.0.1 — SER5 hardware-track line: RDRAND backend + generic thumbdrive image goal
-#   v2.2.0 — amd64 bare-metal (Beelink SER5) — see ROADMAP "Board-by-board rollout"
-#   v2.5.0 — hardware bare-metal release: real per-arch RNG + real-board boot
-VERSION       ?= 3.1.0
-LITHOS_VERSION ?= 2.0.0
+# Versioning policy (FABRIC-3.5.md §XXX, ratified 2026-09-19, replaces the old
+# X.0.0/X.5.0 QEMU/hardware encoding this comment used to carry):
+#   Major: ODD = LTS line (non-breaking fixes only). EVEN = working line
+#          (breaking changes land here). Minor: release within the line.
+#          Patch: working builds within a release.
+#   v1.0.x  — serial-only production (released, historical encoding)
+#   v1.5.x  — framebuffer VT100 console milestone (released, historical encoding)
+#   v2.0.0  — QEMU release: three-arch QEMU story complete (released)
+#   v2.0.1  — SER5 hardware-track line (historical; superseded by this policy)
+#   v2.1.0  — Tripod/kernel reshuffle: Hermes into the kernel, Tripod = Hera/Artemis/Hestia
+#   v2.2.0  — amd64 bare-metal bring-up (Beelink SER5)
+#   v2.x    — further working releases; riscv64 / aarch64 board bring-up
+#   v3.0.0  — FIRST LTS, when and only when FABRIC-3.5.md §XXX.5's 5 criteria are met
+# LITHOS_VERSION (kernel) and VERSION (embedded StarForth engine) are independent
+# and do not auto-sync (§XXX.4) — do not infer a relationship if they ever coincide.
+# Engine VERSION bumps at tag time by what actually changed (§XXX.6): major = any
+# FORTH-79-visible word semantics change; minor = words added/removed/relocated;
+# patch = build-only. This reshuffle is a minor bump: BIRTH's registration widened,
+# the messaging layer was replaced by kernel-Hermes, PLOT/FB-* relocated to Hestia —
+# all dictionary-visible, no FORTH-79 word semantics changed.
+VERSION       ?= 3.2.0
+LITHOS_VERSION ?= 2.1.0
 
 # ==============================================================================
 # BUILD PATHS

capsules/MANIFEST.md

@@ -49,7 +49,7 @@ Blocks: **2049–2052, 2057**
 
 | Block | Immutable | Justification |
 |-------|-----------|---------------|
-| 2049  | No        | Hera VM init: `VM-TREE`/`VM-PARENT`/`VM-CHILDREN`; loads `ACL.4th`, `block-acl.4th`, `zuse-eligibility.4th`, `lib.4th`, `common:messaging.4th` + `MSG-CD-INIT`. **Corrected 2026-09-19 (twice)** — first pass removed a stale listing of `compudynamics`/`common:msg`/`fleet-k`/`process` (none loaded here; two already-deleted, two stripped in the same pass, FABRIC-3.6.md tasks 0.2/0.3). Second pass (same day): `fabric.4th`/`font.4th` **removed** from this list — relocated to `hestia/init.4th` (FABRIC-3.6.md tasks 1.6/1.7), Hera no longer loads either |
+| 2049  | No        | Hera VM init: `VM-TREE`/`VM-PARENT`/`VM-CHILDREN`; loads `ACL.4th`, `block-acl.4th`, `zuse-eligibility.4th`, `lib.4th`. **Corrected 2026-09-19 (three times)** — first pass removed a stale listing of `compudynamics`/`common:msg`/`fleet-k`/`process` (none loaded here; two already-deleted, two stripped in the same pass, FABRIC-3.6.md tasks 0.2/0.3). Second pass (same day): `fabric.4th`/`font.4th` **removed** from this list — relocated to `hestia/init.4th` (FABRIC-3.6.md tasks 1.6/1.7), Hera no longer loads either. Third pass (2026-09-22, FABRIC-3.6.md Phase 4 Stage E): `common:messaging.4th` + `MSG-CD-INIT` **removed** — the file itself is deleted (see "Deleted capsules" below); every FORTH-owned message type was cut over to kernel-Hermes first (Phase 3) |
 | 2050  | No        | BOOT-BANNER call — separated so the banner block can be swapped without touching init logic |
 | 2051  | No        | TRIPOD-TEST — 6 acceptance gates per TRIPOD.md. Dead EVENT-WAIT step replaced with HERMES-TICK liveness check (`3436d564`) |
 | 2052  | No        | TRIPOD-TEST invocation block |
@@ -317,74 +317,51 @@ Blocks: **4060–4065**
 matched the file at any point on record. Rewritten to match the actual
 content, migrated this pass off the deleted `compudynamics.4th`/
 `fleet-k.4th` primitives onto the `VM-PHYSICS-STATUS`/`VM-CONSERVED?`
-mechanism — see `capsules/hermes/init.4th` block 4153 and
+mechanism — see (historical) `hermes/init.4th` block 4153 and
 `capsules/artemis/init.4th` block 4852 for the companion `LOAD-DOE` fix
 this migration also required.
 
+**Note (2026-09-22, FABRIC-3.6.md Phase 4 Stage E):** `SETUP-HERMES` and every
+Hermes touch in `PHASE1-DOE`/`CD-TICK`/`SMOKE-CAMPAIGN` removed — Hermes no
+longer exists. Every block below is now Artemis-only.
+
 | Block | Immutable | Justification |
 |-------|-----------|---------------|
-| 4060  | No        | `SETUP-HERMES`/`SETUP-ARTEMIS`/`SETUP-VMS`: `BIRTH` + remote `LOAD-DOE` VM-EXEC per child VM. Not immutable: setup sequence may grow |
-| 4061  | No        | `PHASE1-DOE`: real per-VM `DOE-WORK` baseline touches. Historical note: dead `CD-WORK` (index-dispatch, deleted VM-HERA/HERMES/ARTEMIS constants) removed here 2026-07-08 |
-| 4062  | No        | `CD-TICK`/`CD-DOE`: one real fleet-touch pass (`VM-EXEC "DOE-WORK"` on Hermes+Artemis), looped N times. `CAMPAIGN-STATUS`: `VM-PHYSICS-STATUS` + `VM-CONSERVED?` check. Not immutable: workload/status content may evolve |
+| 4060  | No        | `SETUP-ARTEMIS`/`SETUP-VMS`: `BIRTH` + remote `LOAD-DOE` VM-EXEC on Artemis. Not immutable: setup sequence may grow |
+| 4061  | No        | `PHASE1-DOE`: real per-VM `DOE-WORK` baseline touch, Artemis only. Historical note: dead `CD-WORK` (index-dispatch, deleted VM-HERA/HERMES/ARTEMIS constants) removed here 2026-07-08 |
+| 4062  | No        | `CD-TICK`/`CD-DOE`: one real fleet-touch pass (`VM-EXEC "DOE-WORK"` on Artemis), looped N times. `CAMPAIGN-STATUS`: `VM-PHYSICS-STATUS` + `VM-CONSERVED?` check. Not immutable: workload/status content may evolve |
 | 4063  | No        | `CAMPAIGN`: full campaign — baselines then 30 real fleet touches |
 | 4064  | No        | `SMOKE-CAMPAIGN`: 1-rep seed-1959 smoke test + 16 real fleet touches |
 | 4065  | No        | `THREE-VM-CAMPAIGN`: loads `doe.4th` locally on Hera, then 48 real fleet touches, all three VMs as Compudynamics peers |
 
-### `hermes/init.4th` — Hermes VM (messenger)
+### `hermes/init.4th` — DELETED 2026-09-22 (formerly Hermes VM, the messenger)
 
-Blocks: **4100–4109, 4114–4121, 4142–4153**
+**Deleted, FABRIC-3.6.md Phase 4 Stage E (task 4.1).** Formerly blocks
+**4100–4109, 4114–4121, 4142–4153** (gaps 4110–4113 and 4122–4141 were always
+Artemis's, hard-locked, never Hermes's — see the `artemis/init.4th` entry below,
+unaffected by this deletion). Every FORTH-owned message type this file's
+`messaging.4th` companion implemented (`BLK-ATTACH-EVENT`, `CONSOLE-CMD-EVENT`,
+`ELEVATE-REQUEST`) was cut over to kernel-Hermes first (Phase 3, tasks 3.8–3.10),
+verified live on all three architectures at each step; only then was the Hermes
+VM itself, this capsule, and `capsules/common/messaging.4th` removed. Full
+three-architecture acceptance for the deletion: `logs/20260922-181141/amd64/`,
+`logs/20260922-181753/aarch64/`, `logs/20260922-182136/riscv64/` — zero
+`UNKNOWN WORD`, identical `dict_hash` across all three. See FABRIC-3.6.md's own
+Phase 4 entry for the full account, including one found-not-fixed collateral
+defect (`SEND-ELEVATE-REQUEST`, this file's own former caller into
+`zuse-eligibility.4th`'s `ELEVATE-GRANT`, is now unreachable — Captain Bob's
+2026-09-22 decision: leave it, Phase 8 PKI will build its own entrypoint).
+Former blocks 4100–4153 (ex-Artemis-gaps) are now UNASSIGNED — see Unassigned
+Ranges below. The per-block justification table this section used to carry
+(arena allocator ABI, message/channel field accessors, the VM-name routing
+table, channel negotiation, broadcast) is not reproduced here; it is historical
+detail about deleted code, recoverable from git history (`git show
+<pre-strip-commit>:capsules/hermes/init.4th`) if ever needed again.
 
-Gap 4110–4113 = Artemis. **HARD LOCKED. Never touch from Hermes side.**
-Gap 4122–4141 = Artemis (extended — see below). Never touch from Hermes side.
-
-| Block | Immutable | Justification |
-|-------|-----------|---------------|
-| 4100  | Yes       | Hermes constants: event codes, channel states, node sizes, arena sizes, MSG-DELIVERED. Immutable: changing node size constants corrupts all arena math |
-| 4101  | Yes       | Arena CREATE: MSG-ARENA CH-ARENA MBR-ARENA; free-list roots; MSG-SEQ CH-ACTIVE. Immutable: CREATE allocates memory at compile time; re-running changes VM memory layout |
-| 4102  | Yes       | MSG-INIT-FREE + CH-INIT-FREE. Immutable: free-list init is called once from CD-INIT; structure change breaks allocator |
-| 4103  | Yes       | MBR-INIT-FREE + MSG-ALLOC + MSG-FREE-NODE. Immutable: allocator ABI; MSG-ALLOC is called by every MSG-SEND |
-| 4104  | Yes       | CH-ALLOC + CH-FREE-NODE + MBR-ALLOC + MBR-FREE-NODE. Immutable: same allocator ABI constraint |
-| 4105  | Yes       | Message field accessors (MSG-TYPE@/! through MSG-SEQ@/!). Immutable: field offsets are load-bearing; changing breaks every accessor caller |
-| 4106  | Yes       | Channel + member accessors (CH-ID@/! through MBR-VM@). Immutable: same field offset constraint |
-| 4107  | No        | VARIABLE MSG-LAST-MSG + IDX>NAME + MSG-DELIVER. Not fully immutable: MSG-DELIVER may evolve for async model. IDX>NAME now a table lookup over VM-NAME-ADDRS/LENS (see 4142) |
-| 4108  | No        | MSG-SEND. Not immutable: send protocol may evolve |
-| 4109  | No        | MSG-REAP. Ordering bug fixed (`8ca0cda2`) — type cleared before free-node prepend |
-| —     | —         | 4110–4113: ARTEMIS. NEVER TOUCH. |
-| 4114  | No        | VARIABLE CH-SCAN + CH-COOL-ALL + CH-TOTAL-HEAT. Not immutable: channel cooling may evolve |
-| 4115  | No        | CH-REAP-SAFE. Not immutable: channel reaping logic may evolve |
-| 4116  | No        | VARIABLE COMMON-CH + COMMON-INIT + HERMES-TICK. Not immutable: HERMES-TICK drives the event loop; may grow |
-| 4117  | No        | EVENT-EMIT + EVENT-WAIT + EVENT-DRAIN (backward compat). Not immutable: EVENT-WAIT is a diagnostic peek only per HERMES.md |
-| —     | —         | 4118: reserved, currently empty (former HERA-NOTIFY-SPAWN/KILL, removed `9323f776` — notification is automatic via `vm_physics_init`/`retire`) |
-| 4119  | No        | CH-MINT-ID + CH-REQUEST. Not immutable: channel negotiation protocol may expand (multi-party invite deferred) |
-| 4120  | No        | CD-INIT. Not immutable: init sequence may grow |
-| 4121  | No        | MSG-ACK-LAST + MSG-NACK-LAST. Not immutable: NACK-requeue (reduced heat, retry) deferred; block may need extension |
-| —     | —         | 4122–4141: ARTEMIS (extended). NEVER TOUCH. |
-| 4142  | No        | VM name routing table: VM-NAME-ADDRS/LENS + VM-NAME-REG + VM-NAMES-INIT. Not immutable: table-driven, grows via VM-MAX |
-| 4143  | Yes       | MSG-CH@/! + MSG-ORIG-TYPE@/! + MSG-NACKED. Immutable: field offset constraint, same as 4105 |
-| 4144  | No        | MSG-SEND. Not immutable: send protocol may evolve |
-| 4145  | No        | MSG-TOTAL-HEAT + MSG-REDELIVER-NACKED. Not immutable: cooling/redelivery logic may evolve |
-| 4146  | No        | MSG-DELIVER-ALL. Not immutable: delivery logic may evolve |
-| 4147  | No        | HERMES-K + WELCOME. Not immutable: may grow |
-| 4148  | No        | CH-ACCEPT + CH-CONFIRM + CH-CLOSE. Not immutable: channel negotiation protocol may expand |
-| 4149  | No        | HERMES-STATUS (MSG-USED + CH-USED). Not immutable: status may expand |
-| 4150  | No        | Member management: MBR-NEXT!/VM! + CH-ADD-MBR + HERMES-MSG-TEST. Not immutable: may grow |
-| 4151  | No        | Phase 2 real multi-member broadcast: MSG-BROADCAST + BC-* variables. Not immutable: broadcast protocol may expand |
-| 4152  | No        | Phase 2 COMMON-CH membership + test: BCAST-GOT/BCAST-RECV/REGISTER-COMMON-MEMBERS/SEND-BROADCAST-TEST. Not immutable: test harness may grow |
-| 4153  | No        | `LOAD-DOE` ( -- ): `S" doe.4th" EXEC`. Added 2026-07-08 — `doe-campaign.4th`'s `SETUP-HERMES` calls this remotely so Hermes gets `DOE-WORK`; was missing entirely before this pass, so `doe-campaign.4th` could never have worked even pre-dating the VM-fleet-physics redesign. Not immutable: trivial wrapper |
-
-**2026-07-05 collision fix:** blocks 4142–4150 were previously numbered
-4122–4131 (interleaved with the blocks below them in this list), directly
-colliding with Artemis's real block range. The collision was introduced
-`fca7b09a` (Jul 1) when the VM-name routing table was added without
-checking MANIFEST.md, and went undetected for 4 days because `mkcapsule`'s
-build path doesn't run conflict detection (only `--manifest` does). Found
-via `mkcapsule --manifest` while syncing this document; renumbered into
-genuinely free space and reverified with a clean amd64 TRIPOD-TEST boot
-(`PASS: fleet K`, `PASS: Hermes liveness`, `PASS: Artemis ready`, `K soak`,
-`PASS: E2E msg flow` — Hermes's kill/rebirth soak test reproduced an
-identical `dict_hash` before and after, confirming the reload path is now
-clean). amd64-only per the rev-f iteration rule; three-arch not yet run for
-this fix. See Conflict Register entry C5.
+**2026-07-05 collision fix (historical, still relevant to Conflict Register
+C5 below):** blocks 4142–4150 were previously numbered 4122–4131, directly
+colliding with Artemis's real block range, introduced `fca7b09a` (Jul 1),
+found and resolved via `mkcapsule --manifest`. See Conflict Register entry C5.
 
 ### `artemis/init.4th` — Artemis VM (flat pool disk manager v2)
 
@@ -436,17 +413,14 @@ Hermes (see above). The table below reflects the actual current footprint.
 Blocks: **4986–4988** (allocated 4986–4996, FABRIC-3.6.md task 1.1; 3 of the 11 used so far)
 
 Added 2026-09-19 (FABRIC-3.6.md tasks 1.2/1.4/1.6/1.7, Tripod/kernel reshuffle — see
-FABRIC-3.5.md §II/§IV). Reconstitutes the Tripod as Hera/Artemis/Hestia; Hermes stays live and
-fleet-foundation throughout Phase 1–3 (FABRIC-3.6.md §XXXIV.4), so Hestia joins the messaging
-fabric on a fresh slot rather than reusing Hermes's — see block 4987's own justification below.
-Birthed (task 1.4) and owns the drawing fabric (`fabric.4th`/`font.4th`, tasks 1.6/1.7 — see
-block 4988).
+FABRIC-3.5.md §II/§IV). Reconstitutes the Tripod as Hera/Artemis/Hestia. Birthed (task 1.4)
+and owns the drawing fabric (`fabric.4th`/`font.4th`, tasks 1.6/1.7 — see block 4988).
 
 | Block | Immutable | Justification |
 |-------|-----------|---------------|
 | 4986  | No        | `WELCOME` banner word + call. Not immutable: message text may change |
 | 4988  | No        | `S" fabric.4th" EXEC` + `S" font.4th" EXEC` — moved here from `init.4th` (Hera), tasks 1.6/1.7, **merged into one commit rather than done separately as the punchlist originally split them**: `font.4th` calls `G-LINE`/`G-ELLIPSE`, which are `fabric.4th`'s own words, so moving one without the other strands the dependency in whichever VM keeps only half — confirmed live, moving `fabric.4th` alone floods Hera's boot with `UNKNOWN WORD: 'G-LINE'`. Order preserved (`fabric.4th` before `font.4th`), matching `init.4th`'s own prior load order. Not immutable: may grow if more of the drawing/font surface relocates here |
-| 4987  | No        | Joins `COMMON-CH` on slot **11** (Hera/Hermes/Artemis hold 0/1/2, identities hold 3–10, `messaging.4th:78-85`) — a fresh slot, not Hermes's, since Hermes is still live. **Deliberately does not add a `VM-NAME-REG` entry for "Hestia"** in `messaging.4th`'s `VM-NAMES-INIT` — Phase 1's gate is "messaging untouched," and adding a name means editing that file. Hestia is `COMMON-CH`-reachable by raw slot today, not yet `VM-EXEC`-addressable by name; whichever task first needs name lookup settles where that one line goes. Not immutable: this is expected to be revisited once name lookup is needed |
+| 4987  | No        | **Rewritten 2026-09-22, FABRIC-3.6.md Phase 4 Stage E.** Originally joined `COMMON-CH` on slot 11 (Hera/Hermes/Artemis held 0/1/2, identities held 3–10, `messaging.4th:78-85`) — that whole `COMMON-CH` concept no longer exists, `messaging.4th` is deleted. Now just `S" lib.4th" EXEC` + `LOG-INFO" Hestia: ready"` + `STARTUP-BANNER`. Not immutable: startup sequence may grow |
 
 ### Deleted capsules (historical)
 
@@ -472,6 +446,17 @@ removal also took `messaging.4th`'s `EVENT-EMIT`/`EVENT-WAIT`/
 `EVENT-DRAIN` (former block 5030) with it, its only live caller. Their
 former ranges are now UNASSIGNED (see Namespace Map).
 
+`hermes/init.4th` (formerly 4100–4109, 4114–4121, 4142–4153) and
+`common/messaging.4th` were deleted 2026-09-22 (FABRIC-3.6.md Phase 4 Stage E,
+tasks 4.1/4.3), the final step of the Tripod/kernel reshuffle — the Hermes VM
+itself and its FORTH messaging layer, superseded by kernel-Hermes
+(`src/starkernel/vm/kernel_hermes.c`) after every live message type was cut
+over in Phase 3 (see the `hermes/init.4th` entry above for the full account).
+Their former ranges are now UNASSIGNED (see Namespace Map). This is the same
+"cut over first, delete after, one commit per Category B item, verified on all
+three architectures" discipline `compudynamics.4th`/`fleet-k.4th` and
+`common/msg.4th`/`process.4th` were deleted under above.
+
 ---
 
 ## Unassigned Ranges
@@ -492,7 +477,8 @@ former ranges are now UNASSIGNED (see Namespace Map).
 | 4051–4054   | UNASSIGNED  | lib.4th extension space |
 | 4055–4059   | UNASSIGNED  | Former `common/msg.4th` range (deleted 2026-09-19, FABRIC-3.6.md task 0.2) |
 | 4066–4099   | UNASSIGNED  | doe-campaign extension space |
-| 4154–4199   | UNASSIGNED  | Hermes extension space (post-4153) |
+| 4100–4153   | UNASSIGNED  | Former `hermes/init.4th` range (deleted 2026-09-22, FABRIC-3.6.md Phase 4 Stage E task 4.1). Excludes 4110–4113/4122–4141, which were always Artemis's, hard-locked, unaffected |
+| 4154–4199   | UNASSIGNED  | Hermes extension space (post-4153), now moot along with 4100–4153 above |
 | 4200–4299   | UNASSIGNED  | Former compudynamics.4th range (deleted `9323f776`) |
 | 4300–4399   | UNASSIGNED  | Former `process.4th` range (deleted 2026-09-19, FABRIC-3.6.md task 0.3) |
 | 4400–4405   | UNASSIGNED  | Former fleet-k.4th range (deleted `9323f776`) |
@@ -551,3 +537,15 @@ before this doc pass. Not re-verified this pass: whether every other
 still-unflagged row elsewhere in this document matches source exactly —
 this was a targeted correction of the rows touched by recent work plus
 `doe.4th`/`ACL.4th`, not a full line-by-line re-audit of all ~250 blocks.*
+
+*Doc-debt pass, 2026-09-22 — MANIFEST.md updated to ride the Tripod/kernel
+reshuffle's Category B strip (FABRIC-3.6.md Phase 4 Stage E, task 5.2 close-out
+sweep, §XXII.5). `hermes/init.4th`'s block-by-block table replaced with a
+deletion note (git history retains the detail); `common/messaging.4th`'s
+deletion recorded in "Deleted capsules"; `init.4th` block 2049,
+`doe-campaign.4th` blocks 4060–4062, and `hestia/init.4th` block 4987 updated
+to match the post-strip live files (verified by direct read, not by this
+document's own prior claims, same discipline as every other pass here).
+Former Hermes range (4100–4153, excluding Artemis's hard-locked 4110–4113/
+4122–4141) marked UNASSIGNED. Not re-verified this pass: the ~230 other rows
+this strip didn't touch.*

docs/lithosananke/ROADMAP.md

@@ -7,34 +7,70 @@ longer exists here — see `.claude/CLAUDE.md`'s "On the branch topology" note)
 
 ---
 
-## Release Versioning Policy (decided 2026-08-28)
+## Release Versioning Policy (ratified 2026-09-19, FABRIC-3.5.md §XXX — supersedes the
+2026-08-28 policy below)
 
 This is the standing release-versioning policy for LithosAnanke. It is authoritative; the
 FABRIC documents track implementation against it, and any permanent change to the policy
 belongs here.
 
-- **`X.0.0` — QEMU release.** A whole-number minor in the `X.0` position is the QEMU-only
-  release: the point where the three-architecture (amd64/aarch64/riscv64) story under QEMU
-  is complete and defensible on its own terms. Nothing real-hardware-only is required to cut
-  an `X.0.0`.
-- **`X.5.0` — Hardware bare-metal release.** A `X.5` release is the real-hardware release:
-  the point where the same story transfers to bare metal on real boards (SER5, RasPi 6,
-  Milk-V, Zynq FPGA). Real-hardware-only work — the per-arch RNG drivers behind the unified
-  entropy entry point, and real-board boot validation — gates `X.5.0`, not `X.0.0`.
-- **Even major numbers are LTS.** A release whose major number (`X`) is even is a
-  Long-Term-Support release — maintained and supported long-term (bug fixes, security,
-  backports) rather than a point-in-time cut. Odd major numbers are non-LTS development
-  lines.
+**Superseded 2026-09-19.** The original 2026-08-28 policy (`X.0.0` = QEMU release, `X.5.0` =
+hardware bare-metal release, **even** major = LTS) used the minor field to carry a milestone
+meaning and had the LTS parity backwards relative to the ratified policy below. It is kept
+struck through immediately after this note for historical traceability, not as current rule.
 
-Applied to the two planned releases: the **v2.0.0** cut (even major, so LTS) is the QEMU
-release; **v2.5.0** is the hardware bare-metal release that transfers v2.0.0's QEMU story to
-real boards. See `FABRIC-2.md` §G for the release-gate punch lists.
+- **Major: ODD = LTS line** (non-breaking fixes only — backports, never redesigns). **EVEN =
+  working line** (breaking changes land here). The line you are on tells you whether breakage
+  is possible at all — not the major number's parity signaling "supported vs. not" the way the
+  retired policy read it.
+- **Minor** — release within that line. No longer carries a milestone meaning (`X.5.0` no
+  longer means anything special) — milestones are roadmap entries now, not arithmetic.
+- **Patch** — working builds within a release.
+- **`LITHOS_VERSION` (kernel) and `VERSION` (embedded StarForth engine) are independent and do
+  not auto-sync** — do not infer a relationship if they ever coincide.
+- **Engine `VERSION` bumps at tag time by what actually changed:** major = any
+  FORTH-79-visible word semantics change; minor = words added/removed/relocated; patch =
+  build-only, no dictionary-visible change.
+
+```
+  v1.0.x  — serial-only production (released, historical encoding)
+  v1.5.x  — framebuffer VT100 console milestone (released, historical encoding)
+  v2.0.0  — QEMU release: three-arch QEMU story complete (released)
+  v2.0.1  — SER5 hardware-track line (historical; superseded by this policy)
+  v2.1.0  — Tripod/kernel reshuffle: Hermes into the kernel, Tripod = Hera/Artemis/Hestia
+  v2.2.0  — amd64 bare-metal bring-up (Beelink SER5)
+  v2.x    — further working releases; riscv64 / aarch64 board bring-up
+  v3.0.0  — FIRST LTS, when and only when all 5 criteria below are met
+```
+
+**LTS criteria (a tag may take an odd major only when all five hold):** real-hardware boot
+demonstrated on at least the amd64 reference board, logs committed as audit artifacts; no
+known-reproducible silent-failure defect open; ACL Phase 8 closed (or explicitly scoped out in
+writing); the `proof/` boundary restated and not contracted relative to the prior LTS; a soak —
+architecture unchanged for at least one full release cycle. The first tag meeting all five
+takes the odd major — no judgement call.
+
+See `FABRIC-3.5.md` §XXX for the full ratified policy text and reasoning, and `FABRIC-2.md` §G
+for the release-gate punch lists this ladder replaced the arithmetic reading of.
+
+<details>
+<summary>Historical: the retired 2026-08-28 policy (kept for traceability only)</summary>
+
+- ~~`X.0.0` — QEMU release. A whole-number minor in the `X.0` position is the QEMU-only
+  release: the point where the three-architecture (amd64/aarch64/riscv64) story under QEMU
+  is complete and defensible on its own terms.~~
+- ~~`X.5.0` — Hardware bare-metal release. Real-hardware-only work gates `X.5.0`, not
+  `X.0.0`.~~
+- ~~Even major numbers are LTS.~~ **Wrong — the ratified policy is odd = LTS.**
+
+</details>
 
 **Board-by-board hardware rollout, decided 2026-08-29 (extends the above as boards come
-online).** Real silicon is arriving incrementally (Beelink SER5 in hand now; RasPi 5 + Milk-V
-orderable around Mon 2026-08-31), so the hardware release is split per real board in hand,
-each its own even-minor cut on the same line (each `X.Y.0` here is an LTS point-in-time cut,
-not a separate dev line):
+online; corrected 2026-09-22 for the ratified §XXX policy — these are working-line minor
+releases, not LTS cuts, since v2.x is the even/working line).** Real silicon is arriving
+incrementally (Beelink SER5 in hand now; RasPi 5 + Milk-V orderable around Mon 2026-08-31), so
+the hardware release is split per real board in hand, each its own minor cut on the v2.x
+working line (v2.1.0, the Tripod/kernel reshuffle, landed first — see the ladder above):
 
 - **v2.2.0 — amd64 bare metal.** Beelink SER5 (in hand). Gate: the generic GPT/FAT32
   thumbdrive image (`make -f Makefile.starkernel ARCH=amd64 thumbdrive`) flashes to and boots

experiments/bare_metal/README.md

@@ -137,16 +137,22 @@ before building) rather than wiring it into `doe.4th`.
 ## `.4th` File Structure
 
 Every `.4th` file must follow StarForth's block format.  The block system
-maps source text to 1024-byte logical blocks; the `Block NNNN` header tells
-the loader which block slot to fill.
+maps source text to logical blocks; the `Block NNNN` header tells the loader
+which block slot to fill.
 
 **Mandatory rules:**
 
 1. The first line of each logical block must be `Block NNNN` (capital B,
    single space, decimal integer).
-2. Block numbers must be unique within a single capsule file.
+2. Block numbers must be unique within a single capsule file, and must fall
+   in `[2048, 5120)`.
 3. Blocks are loaded in file order and executed top-to-bottom.
-4. Each block can hold up to 1024 bytes of source text.
+4. Each block can hold at most 16 content lines, each at most 64 characters
+   long (`validate_forth_blocks` in `tools/mkcapsule.c`, corrected 2026-09-19
+   against the tool itself — **not** a 1024-byte budget: 8 lines of 128
+   characters is 1024 bytes and still fails, since the limit is enforced
+   per-line and per-line-count, not as a total byte count). Verify with
+   `mkcapsule --lint capsules/`, not `wc -c`.
 5. Comments use `( ... )` — parentheses with spaces inside.
 6. Word definitions use `: NAME ... ;` — standard FORTH-79.
 

sbom.spdx

@@ -1,106 +1,15 @@
 SPDXVersion: SPDX-2.3
 DataLicense: CC0-1.0
 SPDXID: SPDXRef-DOCUMENT
-DocumentName: StarForth
-DocumentNamespace: https://anchore.com/syft/dir/StarForth-0d65d83a-09a9-4fd8-8766-f38a20390e07
+DocumentName: LithosAnanke
+DocumentNamespace: https://anchore.com/syft/dir/LithosAnanke-2eaf09a2-c24c-435e-b628-e0dc58035114
 LicenseListVersion: 3.28
 Creator: Organization: Anchore, Inc
-Creator: Tool: syft-1.45.1
-Created: 2026-07-24T15:18:47Z
+Creator: Tool: syft-1.52.0
+Created: 2026-09-22T23:21:56Z
 
 ##### Unpackaged files
 
-FileName: build/aarch64/kernel/starkernel_kernel.elf
-SPDXID: SPDXRef-File-...aarch64-kernel-starkernel-kernel.elf-0cffd118d4c9784f
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/aarch64/kernel/starkernel_loader.efi
-SPDXID: SPDXRef-File-...aarch64-kernel-starkernel-loader.efi-0164edee157474b7
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/amd64/kernel/starkernel_kernel.elf
-SPDXID: SPDXRef-File-...amd64-kernel-starkernel-kernel.elf-395c96157330c7b5
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/amd64/kernel/starkernel_loader.efi
-SPDXID: SPDXRef-File-...amd64-kernel-starkernel-loader.efi-791abd66a8ce5716
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/riscv64/kernel/starkernel_loader_patched.elf
-SPDXID: SPDXRef-File-...kernel-starkernel-loader-patched.elf-3b61a24dfa183731
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/riscv64/kernel/starkernel_loader_stripped.elf
-SPDXID: SPDXRef-File-...kernel-starkernel-loader-stripped.elf-d873b13cd2e296ae
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/riscv64/kernel/starkernel_loader_tmp.elf
-SPDXID: SPDXRef-File-...kernel-starkernel-loader-tmp.elf-78ea20daffb5e979
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/riscv64/kernel/starkernel_kernel.elf
-SPDXID: SPDXRef-File-...riscv64-kernel-starkernel-kernel.elf-4eb358e4ba73d4c5
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/riscv64/kernel/starkernel_loader.efi
-SPDXID: SPDXRef-File-...riscv64-kernel-starkernel-loader.efi-d278be3f4856bc0f
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/aarch64/kernel/tools/mkcapsule
-SPDXID: SPDXRef-File-build-aarch64-kernel-tools-mkcapsule-22322f2334ee5d2e
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/amd64/kernel/tools/mkcapsule
-SPDXID: SPDXRef-File-build-amd64-kernel-tools-mkcapsule-835281b6c8b00ffe
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/amd64/standard/starforth
-SPDXID: SPDXRef-File-build-amd64-standard-starforth-05a6b77cdbe0e767
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: build/riscv64/kernel/tools/mkcapsule
-SPDXID: SPDXRef-File-build-riscv64-kernel-tools-mkcapsule-0ed079baf53028fe
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
 FileName: lfs/amd64/starforth
 SPDXID: SPDXRef-File-lfs-amd64-starforth-61e983295223f075
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
@@ -115,6 +24,13 @@ LicenseConcluded: NOASSERTION
 LicenseInfoInFile: NOASSERTION
 FileCopyrightText: NOASSERTION
 
+FileName: lfs/raspi/starforth
+SPDXID: SPDXRef-File-lfs-raspi-starforth-6f4f7296d88b0a57
+FileChecksum: SHA1: 0000000000000000000000000000000000000000
+LicenseConcluded: NOASSERTION
+LicenseInfoInFile: NOASSERTION
+FileCopyrightText: NOASSERTION
+
 FileName: lfs/riscv64/starforth
 SPDXID: SPDXRef-File-lfs-riscv64-starforth-619b07683e31fae9
 FileChecksum: SHA1: 0000000000000000000000000000000000000000
@@ -122,39 +38,11 @@ LicenseConcluded: NOASSERTION
 LicenseInfoInFile: NOASSERTION
 FileCopyrightText: NOASSERTION
 
-FileName: tools/kconfig/conf
-SPDXID: SPDXRef-File-tools-kconfig-conf-a7660202cc1b1b1e
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
+##### Package: LithosAnanke
 
-FileName: tools/kconfig/mconf
-SPDXID: SPDXRef-File-tools-kconfig-mconf-911a4694edd3f0aa
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: tools/kconfig/qconf
-SPDXID: SPDXRef-File-tools-kconfig-qconf-79f14cdfc3460806
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-FileName: tools/mkcapsule
-SPDXID: SPDXRef-File-tools-mkcapsule-2a567c5c4d049551
-FileChecksum: SHA1: 0000000000000000000000000000000000000000
-LicenseConcluded: NOASSERTION
-LicenseInfoInFile: NOASSERTION
-FileCopyrightText: NOASSERTION
-
-##### Package: StarForth
-
-PackageName: StarForth
-SPDXID: SPDXRef-DocumentRoot-Directory-StarForth
-PackageVersion: v3.1.0
+PackageName: LithosAnanke
+SPDXID: SPDXRef-DocumentRoot-Directory-LithosAnanke
+PackageVersion: 3.1.0
 PackageSupplier: NOASSERTION
 PackageDownloadLocation: NOASSERTION
 PrimaryPackagePurpose: FILE
@@ -165,5 +53,5 @@ PackageCopyrightText: NOASSERTION
 
 ##### Relationships
 
-Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DocumentRoot-Directory-StarForth
+Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DocumentRoot-Directory-LithosAnanke