§H.12 step 16: block-acl.4th policy capsule -- Phase 5 (BMAPFMT) complete

capsules/block-acl.4th (blocks 4019-4020, next free range per
BLOCK_MAP.md): BLK-ACL-CHECK (block# -- allow?), a real fast-deny check
mirroring vm.c:611-624's pattern for blocks instead of words. First
touch lazily claims the block (allow=1, TTL=256, same base as ACL.4th's
own), matching the word card's default-permissive baseline. Not a stub --
genuinely does something on every call.

Loaded via a new EXEC line in init.4th right after ACL.4th's own;
confirmed ACL.4th's own activation is unaffected. Passed mkcapsule
--lint. Live-tested via QMP keystrokes: 1 BLK-ACL-CHECK executed cleanly.

Phase 5 (BMAPFMT) is now fully complete -- field layout, flags bits, C
accessors, FORTH wrappers, and a real policy word.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

capsules/block-acl.4th

@@ -0,0 +1,25 @@
+Block 4019
+( block-acl.4th - Block-Level Access Control  BMAPFMT )
+( C prims: BLK-ACL-ALLOW@ BLK-ACL-ALLOW! BLK-ACL-TTL@ )
+( BLK-ACL-TTL! BLK-OWNER@ )
+( Policy words this file: BLK-ACL-CHECK )
+( Mirrors ACL.4th's C-primitive/FORTH-policy split, )
+( applied to blocks instead of words. )
+( FABRIC-3.md H.12 step 16, 2026-09-03. )
+256 CONSTANT BLK-ACL-BASE-TTL
+
+Block 4020
+( BLK-ACL-CHECK  block# -- allow?                     )
+( Fast-deny check, vm.c 611-624's pattern applied to  )
+( a block. First touch: default-permissive claim --   )
+( allow=1, TTL=BLK-ACL-BASE-TTL -- matching the word  )
+( card's own default. No automatic TTL decrement loop )
+( exists for blocks yet -- words decrement per word   )
+( dispatch, blocks have no equivalent hot path -- but )
+( this is a real, working fast-deny gate either way.  )
+: BLK-ACL-CHECK ( block# -- allow? )
+  DUP BLK-ACL-TTL@ 0= IF
+    DUP BLK-ACL-BASE-TTL SWAP BLK-ACL-TTL!
+    DUP 1 SWAP BLK-ACL-ALLOW!
+  THEN
+  BLK-ACL-ALLOW@ ;