§H.12 step 15: FORTH wrappers for BMAPFMT block-ACL fields

BLK-ACL-ALLOW@/!, BLK-ACL-TTL@/!, BLK-OWNER@ registered in block_words.c.
BLK-OWNER@ packs the 8-byte owner fingerprint into one cell (cell_t is
int64_t). No BLK-OWNER! -- ownership stays a controlled C-only operation.

Live-tested via QMP keystrokes on a running instance: 1 BLK-ACL-ALLOW@
executed cleanly against a real block. Verified 3-arch boot to ok>
(amd64/aarch64/riscv64) plus a hosted sanity build (shared source).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

FABRIC-3.md

@@ -4069,7 +4069,15 @@ work, not new invention.
   tracking; these add no new state). FORTH wrappers (step 15) call these, not
   `blk_get_meta()`/`blk_set_meta()` directly, mirroring the word-level ACL system's own
   C-primitive/FORTH-policy split. Verified 3-arch boot to `ok>` (amd64/aarch64/riscv64).
-- [ ] **15.** Add FORTH wrappers (`BLK-ACL-ALLOW@`/`!`, `BLK-ACL-TTL@`/`!`, `BLK-OWNER@`).
+- [x] **15. DONE 2026-09-03, live-tested.** `BLK-ACL-ALLOW@`/`!`, `BLK-ACL-TTL@`/`!`,
+  `BLK-OWNER@` registered in `block_words.c` (shared/vendored source — verified with both a
+  hosted sanity build and the 3-arch kernel boot). `BLK-OWNER@` packs the 8-byte fingerprint
+  into one cell (`cell_t` is `int64_t`, 8 bytes — exact fit, raw bit reinterpretation). No
+  `BLK-OWNER!` — only the five words step 15 itself listed; setting ownership stays a
+  controlled, C-only operation (MINT/birth), not a general FORTH write. **Live-tested via QMP
+  keystrokes on the running riscv64 instance**: `1 BLK-ACL-ALLOW@` executed cleanly (`ok`, no
+  `UNKNOWN WORD` error) against a real block. Verified 3-arch boot to `ok>`
+  (amd64/aarch64/riscv64).
 - [ ] **16.** Add a new policy capsule (mirroring `ACL.4th`) with a real fast-deny check on
   top — no stub, per this project's standing "no stubs or TODOs, ever" rule (§C).
 

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-09-03T11:27:27Z -->
+<!-- Generated by mkcapsule --manifest  2026-09-03T11:33:33Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->

src/word_source/block_words.c

@@ -551,6 +551,68 @@ void block_word_next_block(VM *vm) {
     }
 }
 
+/* --- BMAPFMT block-ACL words (FABRIC-3.md §F.4/§H.6/§H.12 step 15) ----
+ * Raw C-primitive accessors, matching the word-level ACL system's own
+ * split: policy is composed in FORTH on top of these (a new capsule,
+ * §H.12 step 16), not here. block_num validated the same way BLOCK/
+ * BUFFER above already do. */
+
+/* BLK-ACL-ALLOW@ ( block# -- allow ) */
+static void block_word_acl_allow_fetch(VM *vm) {
+    if (vm->dsp < 0) { vm->error = 1; return; }
+    cell_t blk = vm_pop(vm);
+    if (blk == 0 || !blk_is_valid((uint32_t) blk)) { vm->error = 1; return; }
+    uint8_t allow;
+    if (blk_acl_allow_get((uint32_t) blk, &allow) != BLK_OK) { vm->error = 1; return; }
+    vm_push(vm, (cell_t) allow);
+}
+
+/* BLK-ACL-ALLOW! ( allow block# -- ) */
+static void block_word_acl_allow_store(VM *vm) {
+    if (vm->dsp < 1) { vm->error = 1; return; }
+    cell_t blk   = vm_pop(vm);
+    cell_t allow = vm_pop(vm);
+    if (blk == 0 || !blk_is_valid((uint32_t) blk)) { vm->error = 1; return; }
+    if (blk_acl_allow_set((uint32_t) blk, (uint8_t)(allow ? 1 : 0)) != BLK_OK) {
+        vm->error = 1;
+    }
+}
+
+/* BLK-ACL-TTL@ ( block# -- ttl ) */
+static void block_word_acl_ttl_fetch(VM *vm) {
+    if (vm->dsp < 0) { vm->error = 1; return; }
+    cell_t blk = vm_pop(vm);
+    if (blk == 0 || !blk_is_valid((uint32_t) blk)) { vm->error = 1; return; }
+    uint32_t ttl;
+    if (blk_acl_ttl_get((uint32_t) blk, &ttl) != BLK_OK) { vm->error = 1; return; }
+    vm_push(vm, (cell_t) ttl);
+}
+
+/* BLK-ACL-TTL! ( ttl block# -- ) */
+static void block_word_acl_ttl_store(VM *vm) {
+    if (vm->dsp < 1) { vm->error = 1; return; }
+    cell_t blk = vm_pop(vm);
+    cell_t ttl = vm_pop(vm);
+    if (blk == 0 || !blk_is_valid((uint32_t) blk)) { vm->error = 1; return; }
+    if (blk_acl_ttl_set((uint32_t) blk, (uint32_t) ttl) != BLK_OK) { vm->error = 1; }
+}
+
+/* BLK-OWNER@ ( block# -- fp ) : 8-byte owner fingerprint packed into one
+ * cell (cell_t is 8 bytes, int64_t -- see vm.h) -- raw bit reinterpretation,
+ * not a numeric value. Read-only from FORTH: only step 15's own list, no
+ * BLK-OWNER! -- setting ownership happens at a more controlled point
+ * (MINT/birth), in C, not exposed as a general FORTH write. */
+static void block_word_owner_fetch(VM *vm) {
+    if (vm->dsp < 0) { vm->error = 1; return; }
+    cell_t blk = vm_pop(vm);
+    if (blk == 0 || !blk_is_valid((uint32_t) blk)) { vm->error = 1; return; }
+    uint8_t fp[8];
+    if (blk_owner_fp_get((uint32_t) blk, fp) != BLK_OK) { vm->error = 1; return; }
+    cell_t packed;
+    memcpy(&packed, fp, sizeof(packed));
+    vm_push(vm, packed);
+}
+
 /* --- Registration ----------------------------------------------------- */
 
 /*
@@ -571,4 +633,9 @@ void register_block_words(VM *vm) {
     register_word(vm, "THRU", block_word_thru);
     register_word(vm, "SCR", block_word_scr);
     register_word(vm, "-->", block_word_next_block);
+    register_word(vm, "BLK-ACL-ALLOW@", block_word_acl_allow_fetch);
+    register_word(vm, "BLK-ACL-ALLOW!", block_word_acl_allow_store);
+    register_word(vm, "BLK-ACL-TTL@", block_word_acl_ttl_fetch);
+    register_word(vm, "BLK-ACL-TTL!", block_word_acl_ttl_store);
+    register_word(vm, "BLK-OWNER@", block_word_owner_fetch);
 }