§H.12 step 19: ZUSE-ELIGIBILITY-ADD word, no gating (corrected mid-step)

Plain FORTH word wrapping zuse_eligibility_add() unconditionally. Two
wrong first attempts (C-level zuse_session check, then a FORTH wrapper
checking it) both corrected: zuse_session isn't a special axis needing
its own gate anywhere -- Zuse's authority is the absence of any ACL
restricting her, not a flag any word checks.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QgooKd5hJNtTYqB6CyK5f9

FABRIC-3.md

@@ -4124,7 +4124,20 @@ work, not new invention.
   write failure rather than duplicating that check here. No callers yet (that's item 19).
   Verified 3-arch boot to `ok>` (amd64/aarch64/riscv64), each run in the foreground per
   CLAUDE.md's QEMU rule.
-- [ ] **19.** Add a Zuse-only FORTH word to add an entry, gated by `zuse_session`.
+- [x] **19. DONE 2026-09-03, corrected mid-step: no gating added at all.** First pass wrote a
+  `vm->zuse_session` check directly into the C primitive — wrong, caught immediately by
+  Captain Bob ("NEVER, EVER do that") as the same "policy belongs in `ACL.4th`, never in C"
+  violation as any other word/block ACL decision. Second pass moved the check into a FORTH
+  wrapper capsule instead — also wrong per Captain Bob's follow-up: `zuse_session` isn't a
+  special axis needing its own bespoke gate anywhere, C or FORTH — "there is nothing special
+  about zuse session, it's just a session," and "full superpowers can be determined by the
+  lack of ACLs" — Zuse's authority is the *absence* of any ACL restricting her, not a flag any
+  word checks. Final shape: `ZUSE-ELIGIBILITY-ADD ( c-addr -- ok? )` registered plainly in
+  `mama_forth_words.c`, calling `zuse_eligibility_add()` (item 18) unconditionally, no
+  authorization check anywhere. If this word is ever restricted from ordinary sessions, that
+  happens later via the same standing word-level ACL mechanism (`acl_allow`/`ACL-PIN` in
+  `ACL.4th`) any other word would use — not invented as a one-off here. Verified 3-arch boot
+  to `ok>` (amd64/aarch64/riscv64), each run in the foreground.
 
 **Phase 7 — Message card gate + `ELEVATE-REQUEST` (H.8)**
 - [ ] **20.** Add the initiator-only ACL gate at `CH-REQUEST`'s entry point