FABRIC-3.md: BMAPFMT gets a TTL -- blocks support temporary elevation too

Resolves part of section F.4's deferred item #1 (allow-list/grant shape
beyond the single fast-deny bit): blk_meta_t's acl_reserved[7] becomes a
4-byte acl_ttl (mirroring DictEntry's countdown shape) plus 3 bytes still-
open slack, reusing the same ACL-TTL/Zuse-eligibility-list mechanism as
the word card. Kept lean -- no acl_mode/acl_pinned mirror, since a block
isn't pinned/strict the way a word is. Updated both F.4 (the field design)
and H.6 (the block card) to match.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

FABRIC-3.md

@@ -1771,9 +1771,15 @@ pubkey-based model — flagged, not silently reused.
                                   resolves via the drive's own identity record. */
    uint8_t  acl_allow;        /* cached fast-deny bit, checked first -- vm.c:611-624's exact
                                   pattern, applied to a block instead of a word. */
-   uint8_t  acl_reserved[7];  /* explicitly undecided -- deliberate slack per "flexibility
+   uint32_t acl_ttl;          /* countdown, same shape as DictEntry's acl_ttl -- decided
-                                  until we understand the recipe," not a placeholder to fill
+                                  2026-09-02 (FABRIC-3.md §H.6/§H.9 item 5): blocks need
-                                  reflexively. */
+                                  temporary elevation too, same ACL-TTL-reuse mechanism as the
+                                  word card (§H.5). Kept lean -- "lean, TTL only" -- no
+                                  acl_mode/acl_pinned mirror, a block isn't "pinned"/"strict"
+                                  the way a word is. */
+   uint8_t  acl_reserved[3];  /* still genuinely undecided -- deliberate slack per
+                                  "flexibility until we understand the recipe," not a
+                                  placeholder to fill reflexively. */
    uint64_t reserved_future;  /* untouched budget, same reasoning. */
    ```
    `flags` (already existing, already generic) does double duty as the **state** field from
@@ -1783,12 +1789,14 @@ pubkey-based model — flagged, not silently reused.
 4. **Allocation granularity**: claims quantize to whole devblocks (3 Forth blocks), matching
    the existing packing — a cell never needs to describe partial-devblock ranges.
 
-**Not yet scoped (deferred within this node):** the actual allow-list/grant shape beyond the
+**Resolved 2026-09-02 (part of item #1 below):** blocks need temporary elevation, reusing the
-single fast-deny bit (lands in `acl_reserved`, once designed); the specific `flags` bit
+same `ACL-TTL` mechanism as the word card, gated the same way by Zuse's eligibility list
-values for each state; whether `blk_get_meta()`/`blk_set_meta()` need new FORTH word wrappers
+(§H.5) — see the `acl_ttl` field added above.
-or stay C-only like `zuse_cert_seed`'s "no FORTH access" precedent; the actual repurposing
+
-edit to `block_subsystem.h`/`.c` itself (this pass produced the field design, not the code
+**Not yet scoped (deferred within this node):** the specific `flags` bit values for each
-change).
+state; whether `blk_get_meta()`/`blk_set_meta()` need new FORTH word wrappers or stay C-only
+like `zuse_cert_seed`'s "no FORTH access" precedent; the actual repurposing edit to
+`block_subsystem.h`/`.c` itself (this pass produced the field design, not the code change).
 
 ### F.5 — `WIREBIND` (breadcrumb only — followed into `RUNCAP` instead, 2026-08-27)
 
@@ -3665,8 +3673,15 @@ struct: 8-byte owner-pubkey fingerprint + 1-byte fast-deny `acl_allow`, with del
 reserved slack in the 40-byte block ("flexibility until we understand the recipe"). No
 separate centralized block-ownership table (makes `homeblocks_sig_t`'s reserved
 `blockmap_offset`/`blockmap_devblocks` fields unnecessary, already flagged for cleanup).
-`BMAPFMT`'s field design was done as of the §F.4 pass but **the code change was never made** —
+
-this refactor is presumably where it finally lands.
+**Extended 2026-09-02**: blocks need temporary elevation too, same `ACL-TTL`-reuse mechanism
+and Zuse-eligibility-list gating as the word card (H.5) — `acl_reserved` in §F.4's layout
+became a 4-byte `acl_ttl` (mirroring `DictEntry`'s countdown shape) plus 3 bytes still-open
+slack, kept lean rather than fully mirroring `DictEntry`'s `acl_mode`/`acl_pinned` too
+("lean, TTL only" — a block isn't "pinned"/"strict" the way a word is).
+
+`BMAPFMT`'s field design (now including the TTL) is done but **the code change was never
+made** — this refactor is presumably where it finally lands.
 
 ### H.7 — Messaging protocol groundwork (prerequisite to the message card)