Phase 8 C (3/n): top-of-device metadata fence, step 1 (field round-trip)

Corrected substrate: this OS is anti-POSIX, anti-file by design -- the
prior "dedicated system-identity disk" framing was wrong vocabulary,
caught before any code was written (saved as
feedback_no_files_anti_posix.md). The real primitives are
content-addressed capsules and raw LBN blocks, never a filesystem.

Design (agreed on request): a growable metadata fence at the TOP of a
device's block space, mirroring block_subsystem.c's existing bottom BAM
reservation from the opposite end -- the two grow toward each other,
never colliding, same shape as a stack/heap. Starts at
BLK_META_FENCE_INIT (128 blocks), explicitly never RAM-backed. Reuses
Artemis's already-attached, already-proven virtio-blk device -- no new
device. Rejected reusing BAM's own reserved zone directly: those blocks
are fully claimed by BAM bookkeeping, not free space.

Step 1 only: new meta_fence_blocks field in blk_volume_meta_t, appended
after reloc_devblocks and carved from _pad[] -- identical graceful-
default technique reloc_devblocks already established (a pre-existing
volume reads it back as 0, not a format break). Added a compile-time
_Static_assert on the struct's total size, same discipline
homeblocks_sig.h uses -- caught a real bug immediately: the hand-summed
_pad[] formula was off by 4 bytes (a compiler alignment gap the manual
count missed), found via offsetof() rather than re-deriving by hand.

Worked against disposable clones throughout, never the real
disk/artemis.img (ARTDISK is ?=-overridable) -- artemis-metafence-fresh.img
(blank, fresh-format path) and artemis-metafence-test.img (copy of the
pre-existing artemis.img, graceful-default-on-reload path), kept as
regression fixtures matching disk/README.md's existing convention.
Verified independently via direct byte reads of the disk image, not the
kernel's own log output (log_message(LOG_INFO,...) doesn't reach serial
in this build -- unrelated pre-existing gap): fresh format writes 128 at
header offset 184, a reboot without reformatting preserves it, the old
pre-fence image reads back 0. Full 3-arch acceptance boot against the
real, untouched disk/artemis.img also clean.

Allocator (user_blocks math) and zone read/write accessors both still
open -- next steps, documented in FABRIC-3.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd

FABRIC-3.md

@@ -526,6 +526,54 @@ decisions get added here, not to `FABRIC-2.md`. Follow the same discipline `FABR
   commented-out default. Verified clean compile and clean boot on all three architectures in
   this reverted state.
 
+  **Substrate corrected (Captain Bob, 2026-08-26): no files, ever — this OS's entire reason
+  for being is anti-POSIX, anti-file.** The "dedicated system-identity disk" recommendation
+  above was framed in file/filesystem language by mistake; corrected before any code was
+  written. The only real persistence primitives here are content-addressed capsules and raw
+  LBN-numbered blocks (`block_subsystem.c`) — never a filesystem, never file paths. Saved as
+  `feedback_no_files_anti_posix.md` so this isn't re-learned next session.
+
+  **Design, agreed on request: a growable metadata fence at the TOP of a device's block
+  space, mirroring the bottom BAM reservation from the opposite end.** `block_subsystem.c`'s
+  BAM already reserves the bottom `BLK_DISK_SYS_RESERVED` (32) blocks of every attached
+  device, invisible to FORTH's `BLOCK`/`BUFFER`. Zuse's cert (and future system metadata)
+  gets a second reservation at the *top* of the same device, starting at
+  `BLK_META_FENCE_INIT` (128) blocks and growing downward as needed — the two reservations
+  grow toward each other from opposite ends, never colliding, same shape as a stack/heap.
+  Explicitly never RAM-backed (the fast-RAM/ramdrive LBN ranges are documented as volatile in
+  this same file's own header comment — losing Zuse's identity to a RAM eviction is exactly
+  the failure this is designed against). Reuses Artemis's own already-attached, already-proven
+  virtio-blk device — no new device attachment. Rejected reusing BAM's own bottom-reserved
+  zone directly: those 32 blocks are fully claimed by BAM/volume-metadata bookkeeping, not
+  free space.
+
+  **Step 1 (field round-trip) implemented and verified 2026-08-26, allocator not yet
+  touched.** New `meta_fence_blocks` field in `blk_volume_meta_t`, appended after
+  `reloc_devblocks` and carved from `_pad[]` — identical graceful-default technique the
+  `reloc_start`/`reloc_devblocks` fields already established (a pre-existing formatted volume
+  reads the field back as 0 via its zeroed former padding, not a format-breaking change).
+  Added a compile-time `_Static_assert(sizeof(blk_volume_meta_t) == 4096, ...)`, same
+  discipline `homeblocks_sig.h` already uses — caught a real bug immediately: the hand-summed
+  `_pad[]` size formula was off by 4 bytes (a compiler-inserted alignment gap before
+  `tracked_blocks` that the manual byte-count missed), found via `offsetof()` rather than by
+  re-deriving the arithmetic by hand again, consistent with this project's standing rule to
+  never trust a hand-derived numeric claim in this class of code.
+
+  Worked against disposable clones throughout, never the real `disk/artemis.img`
+  (`ARTDISK=...` is `?=`-overridable) — `disk/artemis-metafence-fresh.img` (blank, exercises
+  the fresh-format path) and `disk/artemis-metafence-test.img` (a copy of the pre-existing
+  `artemis.img`, exercises the graceful-default-on-reload path), both kept as regression
+  fixtures per `disk/README.md`'s existing convention (mirrors `artemis-reloc-test.img`
+  exactly). **Verified independently via direct byte reads of the disk image, not the
+  kernel's own self-report** (`log_message(LOG_INFO, ...)` turned out not to reach serial
+  output at all in this build — an unrelated, pre-existing log-level gap, not a regression):
+  fresh format writes `meta_fence_blocks=128` at header byte offset 184; a second boot without
+  reformatting reads it back unchanged; the pre-existing old-format image correctly reads back
+  0. Full 3-arch acceptance boot against the real, untouched `disk/artemis.img` also clean —
+  conservation intact, no panics. The allocator (`user_blocks` math) still doesn't know about
+  this reservation yet, and there are no read/write accessors for the zone's actual data —
+  both still open, next steps.
+
 ### From FABRIC-2.md §X, Milestone 5 — Console/VM key-match binding
 
 - [ ] Settle the still-open question: reuse `ACL-PIN`/`acl_allow` directly, or build a