§H.12 step 16: block-acl.4th policy capsule -- Phase 5 (BMAPFMT) complete

capsules/block-acl.4th (blocks 4019-4020, next free range per
BLOCK_MAP.md): BLK-ACL-CHECK (block# -- allow?), a real fast-deny check
mirroring vm.c:611-624's pattern for blocks instead of words. First
touch lazily claims the block (allow=1, TTL=256, same base as ACL.4th's
own), matching the word card's default-permissive baseline. Not a stub --
genuinely does something on every call.

Loaded via a new EXEC line in init.4th right after ACL.4th's own;
confirmed ACL.4th's own activation is unaffected. Passed mkcapsule
--lint. Live-tested via QMP keystrokes: 1 BLK-ACL-CHECK executed cleanly.

Phase 5 (BMAPFMT) is now fully complete -- field layout, flags bits, C
accessors, FORTH wrappers, and a real policy word.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

FABRIC-3.md

@@ -4078,8 +4078,24 @@ work, not new invention.
   keystrokes on the running riscv64 instance**: `1 BLK-ACL-ALLOW@` executed cleanly (`ok`, no
   `UNKNOWN WORD` error) against a real block. Verified 3-arch boot to `ok>`
   (amd64/aarch64/riscv64).
-- [ ] **16.** Add a new policy capsule (mirroring `ACL.4th`) with a real fast-deny check on
-  top — no stub, per this project's standing "no stubs or TODOs, ever" rule (§C).
+- [x] **16. DONE 2026-09-03, live-tested — Phase 5 complete.** `capsules/block-acl.4th`
+  (blocks 4019–4020, next free range after `zuse.4th`'s 4016–4018, verified against
+  `BLOCK_MAP.md` — CLAUDE.md's block-namespace rule) defines `BLK-ACL-CHECK ( block# --
+  allow? )`: a real, working fast-deny check mirroring `vm.c:611-624`'s pattern applied to a
+  block instead of a word. First touch lazily claims the block (`allow=1`,
+  `TTL=BLK-ACL-BASE-TTL`=256, same base value as `ACL.4th`'s own), matching the word card's
+  default-permissive baseline — not a stub, genuinely does something on every call. No
+  automatic TTL-decrement hot path exists for blocks yet (words decrement per-dispatch in
+  `vm.c`; blocks have no equivalent loop) — out of this step's scope, the fast-deny gate
+  itself is real and complete regardless. Passed `mkcapsule --lint` cleanly. Loaded via a new
+  `S" block-acl.4th" EXEC` line in `init.4th`'s Block 2049, right after `ACL.4th`'s own —
+  confirmed `ACL.4th`'s own activation messages identical before/after this addition (nothing
+  broken). **Live-tested via QMP keystrokes**: `1 BLK-ACL-CHECK` executed cleanly (`ok`, no
+  `UNKNOWN WORD`) on the running amd64 instance. Verified 3-arch boot to `ok>`
+  (amd64/aarch64/riscv64).
+
+  **Phase 5 (`BMAPFMT`) is now fully complete** — field layout, `flags` bits, C accessors,
+  FORTH wrappers, and a real policy word all landed and verified.
 
 **Phase 6 — Zuse eligibility list (H.5)**
 - [ ] **17.** Extend the metadata-fence record format with a new growable

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-09-03T11:33:33Z -->
+<!-- Generated by mkcapsule --manifest  2026-09-03T11:42:42Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->
@@ -10,6 +10,7 @@
 |---------|----------------|----------|--------|
 | `ACL.4th` | 4000, 4001, 4002, 4003, 4004, 4005, 4006, 4007, 4015 | `0xd781d22148ff171d` | yes |
 | `artemis:init.4th` | 4110, 4111, 4112, 4113, 4122, 4123, 4124, 4125, 4126, 4127, 4128, 4129, 4130, 4131, 4132, 4133, 4134, 4135, 4136, 4137, 4138, 4139, 4140, 4141, 4160, 4161, 4162, 4163, 4164, 4165, 4166, 4167, 4168, 4169, 4170, 4171, 4172, 4173, 4174, 4177, 4178, 4179, 4180, 4181, 4182, 4851, 4852, 4853, 4854 | `0xfe6e570467368153` | yes |
+| `block-acl.4th` | 4019, 4020 | `0xf5eab0544b962dfa` | yes |
 | `common:messaging.4th` | 5003, 5004, 5005, 5006, 5007, 5008, 5009, 5010, 5011, 5012, 5013, 5014, 5015, 5016, 5017, 5018, 5019, 5020, 5021, 5022, 5023, 5024, 5025, 5026, 5027, 5028, 5029, 5030, 5031, 5032, 5033, 5034, 5035, 5036, 5037, 5038 | `0x892fd1c86d8c175e` | yes |
 | `common:msg.4th` | 4055 | `0x850a0382344ea6c4` | yes |
 | `doe-campaign.4th` | 4060, 4061, 4062, 4063, 4064, 4065 | `0x3d4549142d91ec20` | yes |
@@ -33,7 +34,7 @@
 | `init-l8-temporal.4th` | 4830, 4831 | `0x51abd4c138246651` | yes |
 | `init-l8-transition.4th` | 4840, 4841, 4842 | `0xbcc1a81976f0a4c9` | yes |
 | `init-l8-volatile.4th` | 4810, 4811, 4812, 4813 | `0x98caabbbd92abac4` | yes |
-| `init.4th` | 2049, 2050, 2057 | `0x9ac6523d24b80cd0` | yes |
+| `init.4th` | 2049, 2050, 2057 | `0xa94a7b63db15021b` | yes |
 | `lib.4th` | 4050 | `0x4b216635c359ef73` | yes |
 | `process.4th` | 4300, 4301 | `0x781afc1dbd0294f7` | yes |
 | `sdk.4th` | 5109, 5110, 5111, 5112, 5113, 5114, 5115 | `0x008fdbbb62c94a3a` | yes |
@@ -45,9 +46,9 @@
 
 | LBN | Capsule | xxHash64 | Status |
 |-----|---------|----------|--------|
-| 2049 | `init.4th` | `0x9ac6523d24b80cd0` | ok |
-| 2050 | `init.4th` | `0x9ac6523d24b80cd0` | ok |
-| 2057 | `init.4th` | `0x9ac6523d24b80cd0` | ok |
+| 2049 | `init.4th` | `0xa94a7b63db15021b` | ok |
+| 2050 | `init.4th` | `0xa94a7b63db15021b` | ok |
+| 2057 | `init.4th` | `0xa94a7b63db15021b` | ok |
 | 2064 | `init-l8-omni.4th` | `0x5979e314d6452045` | ok |
 | 2065 | `init-l8-omni.4th` | `0x5979e314d6452045` | ok |
 | 2066 | `init-l8-omni.4th` | `0x5979e314d6452045` | ok |
@@ -107,6 +108,8 @@
 | 4016 | `zuse.4th` | `0x490ded9be257a90b` | ok |
 | 4017 | `zuse.4th` | `0x490ded9be257a90b` | ok |
 | 4018 | `zuse.4th` | `0x490ded9be257a90b` | ok |
+| 4019 | `block-acl.4th` | `0xf5eab0544b962dfa` | ok |
+| 4020 | `block-acl.4th` | `0xf5eab0544b962dfa` | ok |
 | 4050 | `lib.4th` | `0x4b216635c359ef73` | ok |
 | 4055 | `common:msg.4th` | `0x850a0382344ea6c4` | ok |
 | 4060 | `doe-campaign.4th` | `0x3d4549142d91ec20` | ok |
@@ -353,4 +356,4 @@
 None.
 
 ---
-*32 capsule(s) scanned.  Re-run `mkcapsule --manifest <dir>` to refresh.*
+*33 capsule(s) scanned.  Re-run `mkcapsule --manifest <dir>` to refresh.*

capsules/block-acl.4th

@@ -0,0 +1,25 @@
+Block 4019
+( block-acl.4th - Block-Level Access Control  BMAPFMT )
+( C prims: BLK-ACL-ALLOW@ BLK-ACL-ALLOW! BLK-ACL-TTL@ )
+( BLK-ACL-TTL! BLK-OWNER@ )
+( Policy words this file: BLK-ACL-CHECK )
+( Mirrors ACL.4th's C-primitive/FORTH-policy split, )
+( applied to blocks instead of words. )
+( FABRIC-3.md H.12 step 16, 2026-09-03. )
+256 CONSTANT BLK-ACL-BASE-TTL
+
+Block 4020
+( BLK-ACL-CHECK  block# -- allow?                     )
+( Fast-deny check, vm.c 611-624's pattern applied to  )
+( a block. First touch: default-permissive claim --   )
+( allow=1, TTL=BLK-ACL-BASE-TTL -- matching the word  )
+( card's own default. No automatic TTL decrement loop )
+( exists for blocks yet -- words decrement per word   )
+( dispatch, blocks have no equivalent hot path -- but )
+( this is a real, working fast-deny gate either way.  )
+: BLK-ACL-CHECK ( block# -- allow? )
+  DUP BLK-ACL-TTL@ 0= IF
+    DUP BLK-ACL-BASE-TTL SWAP BLK-ACL-TTL!
+    DUP 1 SWAP BLK-ACL-ALLOW!
+  THEN
+  BLK-ACL-ALLOW@ ;

capsules/init.4th

@@ -14,6 +14,7 @@ Block 2049
 : VM-PARENT   ( -- id ) 0 ;
 : VM-CHILDREN ( -- ) ." (none)" CR ;
 S" ACL.4th" EXEC
+S" block-acl.4th" EXEC
 S" lib.4th" EXEC
 S" fabric.4th" EXEC
 S" font.4th" EXEC