Phase 8: zuse cert storage moved out of the dictionary (fuse-blow install)

Found that a pinned CONSTANT is not actually tamper-proof: ACL-PIN only
blocks redefinition, not a >BODY-then-store on the word's existing data
field. Moves the Zuse cert value into C-only VM struct fields
(zuse_cert_lo/hi + zuse_cert_installed fuse bit) with a one-time
vm_zuse_cert_install() and read-only ZUSE-CERT-LO@/HI@/INSTALLED? FORTH
accessors, closing the tamper path structurally instead of by convention.
Deletes the now-insecure ZUSE-CERT-LO/HI CONSTANT words from zuse.4th.

vm_zuse_cert_install() has no caller yet -- the real mint flow (Milestone
6 CA, the MINT word) is still open; this is storage + accessors only, not
a stand-in mint. Documented in FABRIC-3.md. Verified: hosted build clean,
mkcapsule --lint clean (31/31), clean boot to ok> on amd64/aarch64/riscv64
with Stadium conservation intact and no panics.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd

src/vm.c

@@ -117,6 +117,31 @@ void vm_set_base(VM* vm, unsigned b)
 /* vm_init and vm_cleanup moved to vm_bootstrap.c */
 /* vm_tick* and heartbeat functions moved to vm_time.c */
 
+/**
+ * @brief One-time write of the Zuse cert value (blows the fuse).
+ *
+ * Deliberately not backed by a dictionary CONSTANT: ACL-PIN only blocks
+ * redefinition (vm_create_word shadowing), not a >BODY-then-store on the
+ * word's data field, so a pinned CONSTANT is not actually immutable against
+ * FORTH-level tampering. Keeping the value in a VM struct field with no
+ * corresponding FORTH store word closes that path entirely -- see
+ * FABRIC-3.md's Milestone 4 mint-then-pin writeup for the finding.
+ *
+ * @param vm  VM instance.
+ * @param lo  Cert value, low half.
+ * @param hi  Cert value, high half.
+ * @return    0 on success; -1 if already installed (fuse already blown).
+ */
+int vm_zuse_cert_install(VM* vm, uint64_t lo, uint64_t hi)
+{
+    if (!vm) return -1;
+    if (vm->zuse_cert_installed) return -1;
+    vm->zuse_cert_lo = lo;
+    vm->zuse_cert_hi = hi;
+    vm->zuse_cert_installed = 1;
+    return 0;
+}
+
 /* ====================== Parser / number ======================= */
 
 /**

src/word_source/starforth_words.c

@@ -793,6 +793,26 @@ static void starforth_word_zuse_authenticate(VM *vm)
     vm->zuse_session = 1;
 }
 
+/* ZUSE-CERT-LO@ ( -- lo )  Read-only: no FORTH store word exists or should
+ * exist -- the cert is written exactly once, in C, via vm_zuse_cert_install(). */
+static void starforth_word_zuse_cert_lo_fetch(VM *vm)
+{
+    vm_push(vm, (cell_t)vm->zuse_cert_lo);
+}
+
+/* ZUSE-CERT-HI@ ( -- hi )  See ZUSE-CERT-LO@. */
+static void starforth_word_zuse_cert_hi_fetch(VM *vm)
+{
+    vm_push(vm, (cell_t)vm->zuse_cert_hi);
+}
+
+/* ZUSE-CERT-INSTALLED? ( -- flag )  -1 if the one-time cert fuse has been
+ * blown (vm_zuse_cert_install() has succeeded), 0 otherwise. */
+static void starforth_word_zuse_cert_installed_query(VM *vm)
+{
+    vm_push(vm, vm->zuse_cert_installed ? -1 : 0);
+}
+
 /**
  * @brief Read-only accessor for the canonical heartbeat tick counter
  *
@@ -826,6 +846,9 @@ void register_starforth_words(VM* vm)
     register_word(vm, "RANDOM", starforth_word_random);
     register_word(vm, "WAIT", starforth_word_wait);
     register_word(vm, "ZUSE-AUTHENTICATE", starforth_word_zuse_authenticate);
+    register_word(vm, "ZUSE-CERT-LO@", starforth_word_zuse_cert_lo_fetch);
+    register_word(vm, "ZUSE-CERT-HI@", starforth_word_zuse_cert_hi_fetch);
+    register_word(vm, "ZUSE-CERT-INSTALLED?", starforth_word_zuse_cert_installed_query);
     register_word(vm, "HEARTBEAT-TICKS@", starforth_word_heartbeat_ticks);
 
     vm_bootstrap_root_vocabulary(vm, "STARFORTH");
@@ -844,6 +867,9 @@ void register_starforth_words(VM* vm)
     register_word(vm, "RANDOM", starforth_word_random);
     register_word(vm, "WAIT", starforth_word_wait);
     register_word(vm, "ZUSE-AUTHENTICATE", starforth_word_zuse_authenticate);
+    register_word(vm, "ZUSE-CERT-LO@", starforth_word_zuse_cert_lo_fetch);
+    register_word(vm, "ZUSE-CERT-HI@", starforth_word_zuse_cert_hi_fetch);
+    register_word(vm, "ZUSE-CERT-INSTALLED?", starforth_word_zuse_cert_installed_query);
     register_word(vm, "HEARTBEAT-TICKS@", starforth_word_heartbeat_ticks);
 
     vocabulary_word_forth(vm);