diff --git a/FABRIC-3.md b/FABRIC-3.md
index e271541..970fd57 100644
--- a/FABRIC-3.md
+++ b/FABRIC-3.md
@@ -2497,3 +2497,54 @@ QMP used instead to force a fresh device read, which is non-destructive).
 all three are now genuinely unblocked, not just scoped. Nothing about their own design changes;
 they can now actually be built and tested rather than only designed. Real hardware (Milestone
 8) remains untested — this verification is QEMU-only, per `F.1`'s own acknowledged scope.
+
+### D.7 — Birth-by-message-only, universal to Zuse and user VMs (vision, 2026-08-28)
+
+Stated directly, prompted by planning the freshly-minted-`zuse.img`-thumbdrive-to-`(Zuse)ok>`
+flow: **"Hera gives birth only by request once messaging and storage are functional and
+should display no coupling outside of messages. This will include 'user' VMs too."** A
+sharper, universal restatement of the standing "nothing is done until it's messaging"
+completion criterion (D.1) — not a new principle, but a concrete commitment that this
+specific, next flow should go straight to the message-only shape rather than pass through
+a hardwired interim first, since messaging (`Hermes`) and storage (`Artemis`) are both now
+genuinely live.
+
+**Concretely, for the mint-`zuse.img`-thumbdrive-to-`(Zuse)ok>` flow:**
+1. Hera's own hardware polling (`sk_repl_idle()`/`xhci_poll_events()`) is unavoidable —
+   she's the only VM whose C code has xHCI MMIO access. This stays.
+2. But Hera must not *decide or act* on what she detects. Per direct instruction: **detection
+   ownership moves to a running Artemis VM instance** — a real change from what `HOTPLUG`
+   (closed) and `WIREBIND` (§F.5, still just a breadcrumb) already built/scoped, both of which
+   currently have Hera deciding and acting directly. Hera's role narrows to relaying the raw
+   hardware event; Artemis owns the identity-verification decision and the birth *request*.
+3. Grounded, not assumed: block LBN space is one flat, global address space
+   (`block_subsystem.c`'s `g.total_user_lbn`), not per-VM — any VM's dictionary can already
+   read any LBN once told which one, no new C-level read plumbing needed for the
+   identity-check content itself. The gap is coordination (when, which LBN), not capability.
+
+**Real, load-bearing prerequisite surfaced by tracing, not assumed:** Artemis is not
+persistently alive today. Every boot this session confirms she's birthed for her own 4.6
+migration self-test, then explicitly killed (`KILL: Artemis dead`) before the REPL ever
+reaches `ok>`. For any message to reach a running Artemis instance, she has to actually stay
+born — a real, new requirement this direction depends on, not something `HOTPLUG`/`WIREBIND`
+ever needed before.
+
+**What this reshapes, not yet re-scoped:**
+- `WIREBIND` (§F.5) was deliberately left a breadcrumb, not fully designed, specifically
+  because "wire hotplug → `capsule_birth_baby()` directly" is exactly the hardwired coupling
+  this principle now rules out — this direction is the real answer that breadcrumb was
+  waiting for, not a contradiction of it.
+- `MSGMIGRATE` (§F.15) scoped a two-hop Hera↔Console flow (Hera reports attach, Console
+  requests the privileged operation). Artemis is a **new participant**, not a replacement —
+  identity verification/storage (Artemis's role) and human-facing onboarding UX (Console's
+  role, §D.6) are both real and distinct; the full flow likely needs both, reconciled together
+  rather than re-litigated as either/or.
+- Applies universally, per direct instruction — the same message-only shape governs ordinary
+  user-VM birth too, not a Zuse-specific carve-out.
+
+**Not yet scoped:** whether Artemis becoming persistent changes her own self-test's shape or
+timing; the exact message types/payloads for Hera→Artemis (raw attach event) and
+Artemis→Hera (birth request); how/whether Console fits into this specific flow versus the
+already-scoped `MSGMIGRATE` two-hop; whether `CERTVERIFY` (§F.7) itself should now run as
+Artemis-mediated logic rather than a bare function call. Capture only, per this arc's own
+established discipline — design happens in its own pass.