§H.12 step 19: ZUSE-ELIGIBILITY-ADD word, no gating (corrected mid-step)

Plain FORTH word wrapping zuse_eligibility_add() unconditionally. Two
wrong first attempts (C-level zuse_session check, then a FORTH wrapper
checking it) both corrected: zuse_session isn't a special axis needing
its own gate anywhere -- Zuse's authority is the absence of any ACL
restricting her, not a flag any word checks.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QgooKd5hJNtTYqB6CyK5f9

FABRIC-3.md

@@ -4124,7 +4124,20 @@ work, not new invention.
   write failure rather than duplicating that check here. No callers yet (that's item 19).
   Verified 3-arch boot to `ok>` (amd64/aarch64/riscv64), each run in the foreground per
   CLAUDE.md's QEMU rule.
-- [ ] **19.** Add a Zuse-only FORTH word to add an entry, gated by `zuse_session`.
+- [x] **19. DONE 2026-09-03, corrected mid-step: no gating added at all.** First pass wrote a
+  `vm->zuse_session` check directly into the C primitive — wrong, caught immediately by
+  Captain Bob ("NEVER, EVER do that") as the same "policy belongs in `ACL.4th`, never in C"
+  violation as any other word/block ACL decision. Second pass moved the check into a FORTH
+  wrapper capsule instead — also wrong per Captain Bob's follow-up: `zuse_session` isn't a
+  special axis needing its own bespoke gate anywhere, C or FORTH — "there is nothing special
+  about zuse session, it's just a session," and "full superpowers can be determined by the
+  lack of ACLs" — Zuse's authority is the *absence* of any ACL restricting her, not a flag any
+  word checks. Final shape: `ZUSE-ELIGIBILITY-ADD ( c-addr -- ok? )` registered plainly in
+  `mama_forth_words.c`, calling `zuse_eligibility_add()` (item 18) unconditionally, no
+  authorization check anywhere. If this word is ever restricted from ordinary sessions, that
+  happens later via the same standing word-level ACL mechanism (`acl_allow`/`ACL-PIN` in
+  `ACL.4th`) any other word would use — not invented as a one-off here. Verified 3-arch boot
+  to `ok>` (amd64/aarch64/riscv64), each run in the foreground.
 
 **Phase 7 — Message card gate + `ELEVATE-REQUEST` (H.8)**
 - [ ] **20.** Add the initiator-only ACL gate at `CH-REQUEST`'s entry point

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-09-03T15:22:32Z -->
+<!-- Generated by mkcapsule --manifest  2026-09-03T15:36:04Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->

src/starkernel/capsule/mama_forth_words.c

@@ -47,6 +47,7 @@
 #include "freestanding/stdio.h"
 #include "starkernel/capsule_mint.h"
 #include "starkernel/user_identity_seed.h"
+#include "starkernel/zuse_eligibility.h"
 #include "starkernel/capsule_loader.h"
 #include "starkernel/capsule_run.h"
 #include "starkernel/capsule_loader.h"
@@ -898,6 +899,42 @@ static void mama_word_mint(VM *vm)
     vm_push(vm, 0);
 }
 
+/**
+ * @brief ZUSE-ELIGIBILITY-ADD ( c-addr -- ok? )
+ * Add the 32-byte Ed25519 public key at c-addr to Zuse's elevation
+ * eligibility list (FABRIC-3.md §H.5/§H.12 item 19). Plain, unconditional
+ * primitive -- no authorization check here or anywhere else in this
+ * codebase gates on vm->zuse_session. Zuse's authority is the *absence*
+ * of any ACL restricting her, not a bit this or any other word checks;
+ * restricting who may call this word, if ever wanted, is the same
+ * standing word-level ACL mechanism (acl_allow/ACL-PIN in ACL.4th) any
+ * other word would use, applied later if and when actually needed --
+ * not invented here.
+ */
+static void mama_word_zuse_eligibility_add(VM *vm)
+{
+    if (vm->dsp < 0) {
+        vm->error = 1;
+        vm_push(vm, 0);
+        return;
+    }
+    cell_t caddr = vm_pop(vm);
+    const uint8_t *pubkey = vm_ptr(vm, (vaddr_t)caddr);
+    if (!pubkey) {
+        vm->error = 1;
+        vm_push(vm, 0);
+        return;
+    }
+
+    if (zuse_eligibility_add(pubkey) != 0) {
+        console_println("ZUSE-ELIGIBILITY-ADD: FAILED -- fence write error");
+        vm_push(vm, 0);
+        return;
+    }
+
+    vm_push(vm, 1);
+}
+
 /**
  * @brief RUNCAP-TEST ( caddr u -- ok? rc )
  * Diagnostic-only word (FABRIC-3.md §F.6/§F.18): calls
@@ -1377,6 +1414,7 @@ void register_mama_forth_words(VM *vm)
     register_word(vm, "CAPSULE-BIRTH", mama_word_capsule_birth);
     register_word(vm, "CAPSULE-RUN", mama_word_capsule_run);
     register_word(vm, "MINT", mama_word_mint);
+    register_word(vm, "ZUSE-ELIGIBILITY-ADD", mama_word_zuse_eligibility_add);
     register_word(vm, "RUNCAP-TEST", mama_word_runcap_test);
     register_word(vm, "PAIR-TEST", mama_word_pair_test);
     register_word(vm, "MAMA-VM-ID", mama_word_mama_vm_id);
@@ -1409,6 +1447,7 @@ void register_mama_forth_words(VM *vm)
     register_word(vm, "CAPSULE-BIRTH", mama_word_capsule_birth);
     register_word(vm, "CAPSULE-RUN", mama_word_capsule_run);
     register_word(vm, "MINT", mama_word_mint);
+    register_word(vm, "ZUSE-ELIGIBILITY-ADD", mama_word_zuse_eligibility_add);
     register_word(vm, "RUNCAP-TEST", mama_word_runcap_test);
     register_word(vm, "PAIR-TEST", mama_word_pair_test);
     register_word(vm, "MAMA-VM-ID", mama_word_mama_vm_id);