FABRIC-3.md: decide EXPIRE's design questions -- defer to Phase 8

Decided directly on request, no code written. "ACLs -> EXPIRE" isn't
wrong in spirit but was aimed at the wrong unit: acl_ttl-hits-zero
always renews (never revokes), so it can't carry EXPIRE's
residency-ending meaning. The unit that actually has a real lifetime
and should be revoked is a zuse superuser session (Phase 8, not yet
built) -- authenticate, hold elevated privilege for a bounded time,
then actually drop back to non-zuse.

Resolves to: admit the session (not a per-word ACL entry, which would
be redundant with item 4.1's existing word patrons) as the Stadium
patron, once Phase 8 exists. Not in scope now -- there is no session
to admit regardless of any other choice, and building Stadium's
missing generic ttl-decrement/reap mechanism ahead of its only real
consumer would be speculative infrastructure, the same shape of
premature build the no-stubs standard exists to prevent, just
inverted. EXPIRE stays explicitly deferred until Phase 8 lands, with
a concrete trigger for revisiting it -- not abandoned, not left
ambiguous.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn

FABRIC-3.md

@@ -413,8 +413,9 @@ other three become honest, explicit punch-list items instead of being touched sp
   `COOL identity=1` at a second channel eviction — conservation intact throughout. Clean
   zero-warning compile and clean boot on all three architectures for both fixes.
 - [ ] `EXPIRE` (ACL) — confirmed genuinely unscoped (2026-08-26), not a case of stale
-  documentation like `DELIVER` turned out to be. Two findings, then four open questions that
-  need a real decision before any code:
+  documentation like `DELIVER` turned out to be. Two findings below, then four open questions
+  — **decided directly on request (2026-08-26)**, decision recorded after the questions, no
+  code written (a decision isn't a green light to build, per this session's own convention):
 
   **Finding 1 — `acl_ttl` and Stadium's `ttl` are different things wearing the same name.**
   `DictEntry.acl_ttl` (`vm_core.c:756`) is a per-word countdown that batches how often
@@ -445,8 +446,29 @@ other three become honest, explicit punch-list items instead of being touched sp
   4. What should the reap action actually *do*, given current ACL policy never revokes — would
      `EXPIRE` force an `ACL-RECHECK`, or something else entirely?
 
-  Current read: this fits more naturally after Phase 8's session/identity work lands than as a
-  word-scoped patron today. Stays open until these are decided.
+  **Decision:**
+  1. Not at the per-word level. `acl_ttl`-hits-zero always renews, never revokes — forcing
+     `EXPIRE`'s residency-ending tag onto it would misuse the tag. But "ACLs → EXPIRE" isn't
+     wrong in spirit, just aimed at the wrong unit: the one place in this system where
+     something ACL-related genuinely has a lifetime and should be revoked is a **zuse
+     superuser session** (Phase 8, not yet built) — authenticate, hold elevated privilege for
+     a bounded time, then actually drop back to non-zuse. That's a real residency-ending
+     event; per-word recheck isn't.
+  2. A zuse session, not a per-word ACL entry — a session is the thing with a genuine
+     start/lifetime/end. A word already has its own patron via item 4.1; a second one for ACL
+     purposes would be redundant bookkeeping, not a new concept.
+  3. **Not in scope now.** This is the decision that actually resolves the item: Phase 8
+     doesn't exist yet, so there is no session to admit as a patron regardless of any other
+     choice made here. Building the generic ttl-decrement/reap mechanism now, with nothing
+     real to feed it, would be speculative infrastructure ahead of its only consumer — close
+     in spirit to what the no-stubs standard exists to prevent, just inverted (a real
+     mechanism with no real caller, instead of a fake mechanism with a real caller).
+  4. Revoke the session's elevated privilege and drop the console back to its non-zuse state —
+     a real action, unlike `DELIVER`/`COOL`, which needed none.
+
+  **`EXPIRE` stays explicitly deferred until Phase 8 (PKI/zuse session minting) lands** — not
+  abandoned, not left ambiguous: revisit it as part of that work, admitting the session itself
+  (not a word) as the patron, once there is something real for it to represent.
 - [x] Fixed (2026-08-26): `ONTOLOGY.md` §IX's "words (dictionary, warehouse-resident today,
   not yet migrated)" line was stale — corrected to state words are fully migrated and live
   via `stadium_word_dispatch()`. Doc-only, no build/boot verification needed.