FABRIC-3.md: full EXPIRE scoping -- two findings, four open design questions

Investigated on request. acl_ttl (DictEntry, per-word ACL-RECHECK
amortization) and StadiumPatronHeader.ttl (residency countdown) are
different mechanisms wearing the same name -- ACL-RECHECK always
renews (allow=1, fresh ttl), never revokes, so it doesn't resemble a
reap event at all. Separately, StadiumPatronHeader.ttl is completely
inert across the whole codebase: every candidate constructor sets it
to 0, nothing ever reads or decrements it -- the generic TTL-expiry
mechanism EXPIRE would fire from doesn't exist in Stadium's own engine
yet, a gap one level deeper than "ACL isn't wired to Stadium."

Recorded four open questions that need a real decision before any
code: whether "ACL patron" is even the right model, what unit would
be admitted (redundant per-word vs. a session-scoped patron once
Phase 8 PKI/zuse work lands), whether building Stadium's missing
generic ttl-reap mechanism is in scope here, and what the reap action
should actually do given ACL policy never revokes today.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn

FABRIC-3.md

@@ -409,12 +409,40 @@ other three become honest, explicit punch-list items instead of being touched sp
   printing `(stub)` — out of scope for this pass, noted in `stadium.c`'s own comment. Clean
   zero-warning compile and clean boot with conservation intact on all three architectures.
 - [ ] `EXPIRE` (ACL) — confirmed genuinely unscoped (2026-08-26), not a case of stale
-  documentation like `DELIVER` turned out to be: zero mentions of Stadium anywhere in
-  `ACL.4th`, `acl_recheck()`, or the ACL design doc. `DictEntry.acl_ttl` (per-word ACL
-  recheck) is a completely separate mechanism from `StadiumPatronHeader.ttl` (unused by every
-  caller today, always set to 0). Needs real design decisions before any code: would an
-  ACL-guarded word be admitted as its own Stadium patron, keyed how, and what would "expire"
-  mean as a reap action (revoke a permission? reset `acl_ttl`?). Stays open until decided.
+  documentation like `DELIVER` turned out to be. Two findings, then four open questions that
+  need a real decision before any code:
+
+  **Finding 1 — `acl_ttl` and Stadium's `ttl` are different things wearing the same name.**
+  `DictEntry.acl_ttl` (`vm_core.c:756`) is a per-word countdown that batches how often
+  `ACL-RECHECK` runs — when it hits 0, `acl_recheck()` calls the FORTH word `ACL-RECHECK`
+  (`ACL.4th:50`), which **always renews**: STRICT mode sets `allow=1, ttl=0` (recheck every
+  time); TTL mode computes a fresh heat-based TTL and sets `allow=1`. Denial isn't a live path
+  anywhere in current policy. This is a *renewal* cycle, not a *residency-ending* event —
+  nothing about it resembles "leaving the Stadium floor."
+
+  **Finding 2 — `StadiumPatronHeader.ttl` is completely inert.** Every candidate constructor
+  across the whole codebase (`stadium.c`, `stadium_words.c`, `stadium_blocks.c`, Hermes's
+  `MSG-ALLOC`/`CH-ALLOC`) sets `candidate.ttl = 0`, and nothing anywhere ever reads,
+  decrements, or reaps on it. The generic TTL-expiry *mechanism* `EXPIRE` would need to fire
+  from doesn't exist in Stadium's own engine at all — a gap one level deeper than "ACL isn't
+  wired to Stadium."
+
+  **Open questions:**
+  1. Is "ACL patron" even the right model, or was `FABRIC.md`'s original "ACLs → EXPIRE"
+     mapping a category mismatch from the start — conflating `acl_ttl`'s recheck-amortization
+     counter with Stadium's residency `ttl`?
+  2. If it is the right model: what gets admitted as a patron? One per ACL-guarded word would
+     be redundant with the word's own patron cell item 4.1 already tracks. A different unit
+     (e.g. per zuse session) might fit better once PKI/session auth lands (Phase 8, still
+     open per `.claude/CLAUDE.md`'s ACL section).
+  3. Building this for real means building Stadium's generic ttl-decrement/reap-on-zero
+     mechanism first — nothing to hook `EXPIRE` into today. Is that in scope here, or its own
+     separate item?
+  4. What should the reap action actually *do*, given current ACL policy never revokes — would
+     `EXPIRE` force an `ACL-RECHECK`, or something else entirely?
+
+  Current read: this fits more naturally after Phase 8's session/identity work lands than as a
+  word-scoped patron today. Stays open until these are decided.
 - [x] Fixed (2026-08-26): `ONTOLOGY.md` §IX's "words (dictionary, warehouse-resident today,
   not yet migrated)" line was stale — corrected to state words are fully migrated and live
   via `stadium_word_dispatch()`. Doc-only, no build/boot verification needed.