Rename FABRIC series: FABRIC.md->0, FABRIC-2.md->1, FABRIC-3.md->2, FABRIC-4.md unchanged

FABRIC.md -> FABRIC-0.md FABRIC-2.md -> FABRIC-1.md FABRIC-3.md -> FABRIC-2.md (the current/living document) FABRIC-4.md unchanged (new #3 to follow separately) Every cross-reference repo-wide updated to match, including doc-comment citations inside kernel source (.c/.h) files -- done via an ordered placeholder substitution (FABRIC-3.md->placeholder2, FABRIC-2.md-> placeholder1, FABRIC.md->placeholder0, then placeholders resolved to final names) in a single pass per file to avoid double-shifting already-renamed references. One line in capsules/font.4th grew past the 64-char block-format limit as a side effect of the longer filename; shortened it and reverified with mkcapsule --lint (34/34 pass) before rebuilding. Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the foreground) after the fix; logs and DoE CSVs from this session's verification runs included per this repo's own audit-artifact convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var
2026-09-04 11:22:51 -04:00
parent ff2941dfb9
commit b031b802e3
128 changed files with 37154 additions and 9572 deletions
@@ -5,11 +5,11 @@
 ---

 > **SUPERSEDED (Captain Bob, 2026-08-15).** This document is no longer authoritative.
-> `FABRIC.md`/`FABRIC-2.md` (repo root — read `FABRIC-2.md` first, it is the current/living
+> `FABRIC-0.md`/`FABRIC-1.md` (repo root — read `FABRIC-1.md` first, it is the current/living
 > one) are the sole design-of-record for Artemis work now. Kept here as historical record
 > only; do not read this for current design authority, and do not cite it in place of
-> `FABRIC.md`/`FABRIC-2.md`. Artemis becoming the pre-Artemis-closeout blocker (item 4.6) is
-> tracked in `FABRIC-2.md`, not here. See `.claude/CLAUDE.md`'s own pointer.
+> `FABRIC-0.md`/`FABRIC-1.md`. Artemis becoming the pre-Artemis-closeout blocker (item 4.6) is
+> tracked in `FABRIC-1.md`, not here. See `.claude/CLAUDE.md`'s own pointer.

 ---

@@ -148,7 +148,7 @@ for this scope. `capsules/artemis/init.4th` implements the full flat-pool
 target above.

 **Corrected 2026-08-13 — the "boots live in the Tripod fleet... on every
-kernel boot" claim below is stale since item 0.1 (`FABRIC.md` Phase 0),
+kernel boot" claim below is stale since item 0.1 (`FABRIC-0.md` Phase 0),
 same pattern already found and fixed in `TRIPOD.md`.** Two distinct things
 were being conflated: Artemis's block-storage *device* (the virtio-blk
 disk, `disk/artemis.img`) genuinely does auto-attach at the C level at
@@ -10,12 +10,12 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co

 > **Superseded subsystem docs (Captain Bob, 2026-08-15):** `.claude/TRIPOD.md`,
 > `.claude/HERMES.md`, `.claude/ARTEMIS.md`, and `.claude/CONSOLE.md` are all superseded —
-> `FABRIC.md` and `FABRIC-2.md` (both design history/archival as of 2026-08-25) and
-> `FABRIC-3.md` (current/living, read this one first) are the sole authoritative source for
+> `FABRIC-0.md` and `FABRIC-1.md` (both design history/archival as of 2026-08-25) and
+> `FABRIC-2.md` (current/living, read this one first) are the sole authoritative source for
 > Tripod/Hermes/Artemis/Console work now. The four subsystem docs remain in the repo as
 > historical record only; each carries its own superseded-header pointing here. Do not treat
 > them as current, do not read them for design authority, and do not cite them in place of
-> `FABRIC.md`/`FABRIC-2.md`/`FABRIC-3.md`.
+> `FABRIC-0.md`/`FABRIC-1.md`/`FABRIC-2.md`.

 > **Scope:** This repo is LithosAnanke — the bare-metal UEFI kernel that boots StarForth
 > directly on hardware. StarForth (the hosted FORTH-79 VM) has its own separate repository
@@ -133,14 +133,14 @@ The word-level ACL system is fully implemented, including kernel parity. Key con
 - Measured overhead: +0.0054%–+0.0088% across all 9 cells; CV = 0.000%
 - Report confirmed to exist: `experiments/bare_metal/analysis/report/bare_metal_doe_report.pdf`
  (~2MB, with LaTeX source and figures) — patent support material
- **Correction (found 2026-08-20/21, `FABRIC-2.md` §§M–T):** the "ACL-RWT" name itself was
+- **Correction (found 2026-08-20/21, `FABRIC-1.md` §§M–T):** the "ACL-RWT" name itself was
  wrong — the Rolling-Window-of-Truth mechanism it was named after was dead code, removed
  2026-07-08 (`ACL-RECHECK-RW` was never reachable — `acl_recheck()` only ever looks up the
  11-char `ACL-RECHECK`, never the 14-char `-RW` variant). What this campaign actually
  measured was the live `ACL-TTL` mechanism under a misleading name, and at `-O0`, before
  real compiler optimization landed. The corrected, current figure — same live mechanism,
  correct name, re-run on the current substrate — is **+0.0603% ACL-TTL enforcement overhead,
-  architecture-independent, CV=0.000%** (`FABRIC-2.md` §T, memory
+  architecture-independent, CV=0.000%** (`FABRIC-1.md` §T, memory
  `project_acl_ttl_overhead_final.md`). Use that number, not the one above.

 **Before writing or modifying any `.4th` capsule file**, read `experiments/bare_metal/README.md`
@@ -20,11 +20,11 @@

 > **SUPERSEDED (Captain Bob, 2026-08-15).** This document is no longer authoritative, and its
 > core premise below ("Console is a 4th Tripod VM, Quadrupod, StarForth-dialect-only") was
-> architecturally reversed by a later, decided ruling: `FABRIC.md` §17.5 — the framebuffer is
+> architecturally reversed by a later, decided ruling: `FABRIC-0.md` §17.5 — the framebuffer is
 > a **utility**, not a patron, not a VM. What actually shipped is direct C
 > (`src/starkernel/hal/console.c`/`vt100.c`/`framebuffer.c` plus keyboard drivers), called
-> straight from the kernel, no Hera-spawned Console VM anywhere. `FABRIC.md`/`FABRIC-2.md`
-> (repo root — read `FABRIC-2.md` first) are the sole design-of-record for Console/framebuffer
+> straight from the kernel, no Hera-spawned Console VM anywhere. `FABRIC-0.md`/`FABRIC-1.md`
+> (repo root — read `FABRIC-1.md` first) are the sole design-of-record for Console/framebuffer
 > work now. Kept here as historical record only. See `.claude/CLAUDE.md`'s own pointer.

 ---
@@ -5,10 +5,10 @@
 ---

 > **SUPERSEDED (Captain Bob, 2026-08-15).** This document is no longer authoritative.
-> `FABRIC.md`/`FABRIC-2.md` (repo root — read `FABRIC-2.md` first, it is the current/living
+> `FABRIC-0.md`/`FABRIC-1.md` (repo root — read `FABRIC-1.md` first, it is the current/living
 > one) are the sole design-of-record for Hermes work now. Kept here as historical record
 > only — note its message-layout table (8 cells) is confirmed stale against the real shipped
-> capsule (9 cells, `capsules/hermes/init.4th`), see `FABRIC-2.md`. Do not read this for
+> capsule (9 cells, `capsules/hermes/init.4th`), see `FABRIC-1.md`. Do not read this for
 > current design authority. See `.claude/CLAUDE.md`'s own pointer.

 ---
@@ -5,10 +5,10 @@
 ---

 > **SUPERSEDED (Captain Bob, 2026-08-15).** This document is no longer authoritative.
-> `FABRIC.md`/`FABRIC-2.md` (repo root — read `FABRIC-2.md` first, it is the current/living
+> `FABRIC-0.md`/`FABRIC-1.md` (repo root — read `FABRIC-1.md` first, it is the current/living
 > one) are the sole design-of-record for Tripod work now. Kept here as historical record
 > only; do not read this for current design authority, and do not cite it in place of
-> `FABRIC.md`/`FABRIC-2.md`. See `.claude/CLAUDE.md`'s own pointer.
+> `FABRIC-0.md`/`FABRIC-1.md`. See `.claude/CLAUDE.md`'s own pointer.

 ---

@@ -35,8 +35,8 @@ or work execution logic in Hera — stop. You have the wrong VM.

 ## The Immediate Goal

-**Corrected 2026-08-13 — stale since item 0.1 (`FABRIC.md` Phase 0), flagged in
-`FABRIC-2.md` §A item 5.3, never fixed until now.** This section used to say Hera spawns
+**Corrected 2026-08-13 — stale since item 0.1 (`FABRIC-0.md` Phase 0), flagged in
+`FABRIC-1.md` §A item 5.3, never fixed until now.** This section used to say Hera spawns
 Hermes and Artemis automatically at boot. She does not, by deliberate design: item 0.1
 pruned `capsules/init.4th` to boot Hera alone (confirmed current —
 `capsules/init.4th` births no other VM). Hermes and Artemis-as-VM-patron births happen
@@ -42,7 +42,7 @@ corrected to the valid SMC32 encoding (`0x84000009`).
 Full three-arch DoE campaign (`L8-DOE`, 48 trials each) re-run clean on all
 three architectures post-fix: stress campaigns 30/30 PASS, clean `BYE` exit,
 no exceptions. Full investigation trail, evidence, and dead ends in
-`FABRIC-2.md` Sections H and I.
+`FABRIC-1.md` Sections H and I.

 ## 2026-07-24 — Kernel 3-arch acceptance test re-run; amd64 dict_hash non-determinism root-caused (`lithosananke`)

@@ -1,8 +1,8 @@
-# FABRIC.md — the Stadium
+# FABRIC-0.md — the Stadium

 **Status: CLOSED, 2026-08-12.** This document is archival. It is not edited further and no
 new work is added to it — everything still open as of the closure date was carried forward
-into **`FABRIC-2.md`**, which is now the living document. Read `FABRIC-2.md` first for
+into **`FABRIC-1.md`**, which is now the living document. Read `FABRIC-1.md` first for
 current status; come back here only for the historical design argument and decision record
 behind it.

@@ -20,7 +20,7 @@ places were found where something had actually been resolved by later work but t
 document's own note was never updated (§19.6 #3, §21.5 #4, the §25.7 `stadium_owner[idx]`
 bullet, and item 4.5's own parent checkbox) — those four are fixed in place below, since
 they were bookkeeping errors, not open work. Everything else genuinely still open is in
-`FABRIC-2.md`.
+`FABRIC-1.md`.

 **How to read what remains.** §1–15 are the original design argument, written before any
 code was examined. §16 onward are findings and decisions made against the actual tree, in
@@ -35,7 +35,7 @@ quotes that reproduce an earlier section verbatim, and in §12's preserved quest
 which several sections quote.

 **On `docs/lithosananke/ROADMAP.md`.** As of 2026-08-11, Captain Bob stated this document
-superseded ROADMAP.md entirely. That still holds, transitively, through `FABRIC-2.md` now.
+superseded ROADMAP.md entirely. That still holds, transitively, through `FABRIC-1.md` now.

 ---

@@ -375,7 +375,7 @@ Ten minutes on paper. It confirmed the design and caught one case, which is what

 ## 10. Sequencing

-**FABRIC.md first, then Hermes native on the fabric, then measure, then Console, then
+**FABRIC-0.md first, then Hermes native on the fabric, then measure, then Console, then
 Artemis last.**

 > **Amended by §16.5 and §21.2.** This ordering is still right for the *subsystems*, but it
@@ -419,7 +419,7 @@ re-running it. Automated, but budget for it.
  This is why the admission test comes before code.

 **Early signal:** ARTEMIS.md, HERMES.md, CONSOLE.md and TRIPOD.md each currently describe
-their own heat mechanics. After FABRIC.md, each should shrink to roughly three lines —
+their own heat mechanics. After FABRIC-0.md, each should shrink to roughly three lines —
 what an entry is here, what heat means, what the reap event is. If any one of them gets
 *longer*, that subsystem is fighting the fabric, and you will know which one before
 writing code.
@@ -1562,7 +1562,7 @@ noun was overloaded.
   2.1** — `vm_physics_touch()` was restated on the virtual tick (no `now_ns` parameter at
   all), closing exactly the gap this point raised. This item's own cross-reference (*Refs:*
   §19.6 #3) points back here; this note closes the loop the other direction. Never annotated
-   here at the time (found during the 2026-08-12 FABRIC-2.md audit).
+   here at the time (found during the 2026-08-12 FABRIC-1.md audit).

 ---

@@ -1623,13 +1623,13 @@ There is no renormalisation anywhere. `vm_physics_conserved()` tests a genuine i
   dropped. **The "guarded, shouldn't happen" description was only half right** — the
   Hera-is-root case was reachable via `S" Hera" KILL` (`mama_word_kill()` called
   `vm_physics_retire()` before `capsule_vm_kill()`'s own Hera guard ran), fixed 2026-08-13
-   (`FABRIC-2.md` §C). The broken-parent-chain case remains genuinely unreachable
+   (`FABRIC-1.md` §C). The broken-parent-chain case remains genuinely unreachable
   (`parent_vm_id` is set once at birth, never rewritten) and is not tracked further.
 2. ~~**Truncation** (`:304-305`). The proportional fan-out computes
   `(moved_total * heat) / others_total` per VM in integer arithmetic. The shares sum to
   *less than* `moved_total`. **Every multi-VM touch loses a little heat**, so the sum drifts
   downward monotonically. `VM_PHYSICS_EPSILON_Q48` is 3277 — 5% of `Q48_ONE` — so given
-   enough touches this would eventually trip.~~ **WRONG, corrected 2026-08-13** (`FABRIC-2.md`
+   enough touches this would eventually trip.~~ **WRONG, corrected 2026-08-13** (`FABRIC-1.md`
   §B "Fleet heat leak," investigated when item 4.2 made this measurable) — the truncated
   `share` is what actually moves on *both* sides of `vm_physics_transfer()`, so the fleet
   sum cannot drift from this path; only path 1 above can. Left standing here per this
@@ -1655,7 +1655,7 @@ conservation law the project makes claims about. It is small per touch and may b
 tolerable, but it is monotonic, and nobody has measured how far it drifts over a long run.~~
 **WRONG, corrected 2026-08-13** — see the strikethrough correction on path 2 above. Path 1
 (the dying-VM-is-root/broken-chain drop) is the only live defect; it is tracked in
-`FABRIC-2.md` §C, not here, per this document's closure.
+`FABRIC-1.md` §C, not here, per this document's closure.

 ### 20.3 Nesting — §12 Q6 is less open than it looks

@@ -1898,7 +1898,7 @@ level it was born on.
 4. ~~**§20.5 #4 remains open.**~~ **RESOLVED by item 1.7 (§25.2), 2026-08-04** — this
   section (§21.5) was written before that ruling and never updated to point to it. Bounded
   by a Kconfig-tunable cap, default 2, enforced at VM-birth time. See §20.5 #4 for the full
-   resolution. Stale cross-reference, not new work (found during the 2026-08-12 FABRIC-2.md
+   resolution. Stale cross-reference, not new work (found during the 2026-08-12 FABRIC-1.md
   audit).

 ---
@@ -3672,7 +3672,7 @@ document and committing that amendment as its own item.*
  >   - Self-test scaffolding (`kernel_main.c`, diagnostic-only, not production code):
  >     +119 / −0, 1 file.
  >   - **Total: 12 implementation files, +759 / −120 (879 lines changed).**
-  > - **File count:** 12 implementation files (13 including this write-up in `FABRIC.md`
+  > - **File count:** 12 implementation files (13 including this write-up in `FABRIC-0.md`
  >   itself).
 - [ ] **4.3 — Console.** Settles 1.11 as part of the work. *Refs:* §17.5.

@@ -5109,7 +5109,7 @@ document and committing that amendment as its own item.*
 - [x] **4.4c — Wire `console_fb_init()` into the boot path.** Found while verifying 4.4d
  (below) by screendump — not a bug in 4.4a/4.4b, a pre-existing, deliberate gap.
  `kernel_main.c:830-834` has an explicit comment: *"console.c / vt100.c are superseded by
-  the Console drawing-fabric redesign (FABRIC.md §27) and are deliberately not invoked
+  the Console drawing-fabric redesign (FABRIC-0.md §27) and are deliberately not invoked
  here... `fb_init()` wires the raw GOP framebuffer directly... nothing else touches it."*
  Only raw `fb_init()` runs; `console_fb_init()` (which calls `vt100_init()`) is never
  called anywhere in the boot sequence. Consequence, confirmed by screendump: `vt100_putc()`
@@ -6261,11 +6261,11 @@ document and committing that amendment as its own item.*

  > **Parent closed 2026-08-12.** All six sub-items (4.5a–4.5f) below are `[x]` done; 4.5f's
  > own done-when is satisfied by 4.4g's real landing, not a separate pass. This checkbox was
-  > never flipped at the time — pure bookkeeping, not new work (found during the FABRIC-2.md
+  > never flipped at the time — pure bookkeeping, not new work (found during the FABRIC-1.md
  > audit). One real loose end surfaced by 4.5f's own text, not closed by any of this: the
  > ACL-RWT DoE campaign's overhead numbers (CLAUDE.md, "+0.0054%–+0.0088%") were all measured
  > at `-O0`, before this item enabled real optimization — nobody has re-measured or even
-  > asked whether they're still comparable. Carried forward to FABRIC-2.md.
+  > asked whether they're still comparable. Carried forward to FABRIC-1.md.

 - [x] **4.5a — Full ISR/interrupt-context global-state audit, all three architectures.**
  Investigation only, no code change. For each architecture, enumerate every vector actually
@@ -6797,7 +6797,7 @@ so.*
  folded into item 4.2's scope by explicit Captain Bob ruling**, fixed and verified: a
  resident cell's evict-credit lands in the correct VM's reservoir with two VMs holding
  quotas (Hera + Hermes), not just asserted from reading the code. This bullet was never
-  struck through at the time; stale, not new work (found during the 2026-08-12 FABRIC-2.md
+  struck through at the time; stale, not new work (found during the 2026-08-12 FABRIC-1.md
  audit). See item 4.2's *Done when* list and its 2026-08-05 addendum.
 - **Taxonomy and lexicon.** Raised by Captain Bob 2026-08-04, mid-item-3.1. This document's
  physics-flavored vocabulary (heat, mass, density, patron, Stadium, and the rest) needs a
@@ -6805,7 +6805,7 @@ so.*
  covers the growing set of Kconfig build knobs (`STADIUM_MAX_VM_COUNT` and its siblings) so
  the terminology in code, Kconfig help text, and this document stays one language instead
  of drifting apart. Not scoped, not placed in a phase. Captain Bob: "I guess that we didn't
-  finish out FABRIC.md quite as much as we thought."
+  finish out FABRIC-0.md quite as much as we thought."

 ### 25.7.1 Second review pass — 2026-08-03, pre-coding. Awaiting rulings.

@@ -1,12 +1,12 @@
 # FABRIC-4.md — forward-looking design notes

-**Status:** Not a successor to `FABRIC-3.md` and not a punch-list document. `FABRIC-3.md` is
+**Status:** Not a successor to `FABRIC-2.md` and not a punch-list document. `FABRIC-2.md` is
 still the living document — nothing here supersedes it, and this file doesn't follow the
-close-and-carry-forward discipline `FABRIC.md` → `FABRIC-2.md` → `FABRIC-3.md` used (that
-chain triggers on *closing* a document; `FABRIC-3.md` isn't closed). This is a separate,
+close-and-carry-forward discipline `FABRIC-0.md` → `FABRIC-1.md` → `FABRIC-2.md` used (that
+chain triggers on *closing* a document; `FABRIC-2.md` isn't closed). This is a separate,
 lower-discipline scratchpad for design ideas caught early — theory-stage, pre-punch-list,
 often missing a stated "why" on purpose (captured as raised, not fully justified yet). An idea
-graduates out of here into `FABRIC-3.md` §I (or wherever `FABRIC-3.md` is by then) once it has
+graduates out of here into `FABRIC-2.md` §I (or wherever `FABRIC-2.md` is by then) once it has
 a real scope, not before.

 ---
@@ -513,9 +513,9 @@ Slide 2: "Formally: f(t) = f₀ * e^(-λt)"
 **Added 2026-08-13**, closing a real, acknowledged documentation-debt item: the physics
 vocabulary built on top of the original heat/decay/inference model above (patron, mass,
 density, Stadium, and the Kconfig knob names built on them) accumulated across
-`FABRIC.md`/`FABRIC-2.md` without an explicit statement, in one place, that these are named
+`FABRIC-0.md`/`FABRIC-1.md` without an explicit statement, in one place, that these are named
 analogies — the same discipline Section III already applies to "heat," extended to the
-newer terms. Definitions below are drawn directly from `FABRIC.md`'s own DECIDED sections
+newer terms. Definitions below are drawn directly from `FABRIC-0.md`'s own DECIDED sections
 (cited inline), not invented here.

 ### 9.1 The metaphor, restated for this layer
@@ -537,7 +537,7 @@ LITERAL IMPLEMENTATIONS (No Metaphor):
  K                       → Σ execution_heat_q48 across live entries, conserved at 1.0
 ```

-The Stadium metaphor is a **venue**, not a building: §2 (`FABRIC.md`) is explicit that a
+The Stadium metaphor is a **venue**, not a building: §2 (`FABRIC-0.md`) is explicit that a
 patron *arrives and departs* — the Stadium holds what is live, not everything that exists.
 That is the load-bearing distinction between "Stadium" and "warehouse" below, and it is why
 the dictionary-at-rest is warehouse, not Stadium, even though every dictionary entry is
@@ -549,29 +549,29 @@ the dictionary-at-rest is warehouse, not Stadium, even though every dictionary e
 *Definition*: The Stadium's fixed-size unit of storage — a patron header, or a continuation
 cell owned by exactly one patron.
 *Formal*: A closed, two-constructor sum type: `Cell = Header | Continuation(owner)`, fixed
-at build time (`FABRIC.md` §3).
-*Measurement*: Proposed size 64 bytes (`FABRIC.md` §23.3, **not yet built** — see
-`FABRIC-2.md`'s §23.4 #2 closure: the one real patron kind actually shipped, Hermes
+at build time (`FABRIC-0.md` §3).
+*Measurement*: Proposed size 64 bytes (`FABRIC-0.md` §23.3, **not yet built** — see
+`FABRIC-1.md`'s §23.4 #2 closure: the one real patron kind actually shipped, Hermes
 messages, did not adopt this cell shape).
 *Category*: Storage unit.
 *Warning*: Not a pointer target — links between cells are Stadium-array indices, never
-addresses (`FABRIC.md` §3, §13).
+addresses (`FABRIC-0.md` §3, §13).

 **Code field**
 *Definition*: A closed-enumeration behaviour tag stored in a patron header, dispatched by
 the engine rather than branched on by kind.
 *Formal*: `behaviour ∈ {MIGRATE, DELIVER, EXPIRE, COOL, ...}` — a fixed datatype, not an
-open extension point (`FABRIC.md` §3, §13, §18.3).
+open extension point (`FABRIC-0.md` §3, §13, §18.3).
 *Category*: Dispatch mechanism.
 *Note*: This is deliberately **the entire type system** — the engine never asks what kind
-of patron it holds, only what its code field says to do (`FABRIC.md` §3).
+of patron it holds, only what its code field says to do (`FABRIC-0.md` §3).

 **Density**
 *Definition*: A patron's heat share divided by its mass — heat per unit of occupied
 Stadium floor space.
-*Formal*: `density(p) = heat(p) / mass(p)`, derived, never stored (`FABRIC.md` §19.2).
+*Formal*: `density(p) = heat(p) / mass(p)`, derived, never stored (`FABRIC-0.md` §19.2).
 *Measurement*: Used for ranking and admission (denser evicts sparser), not computed by a
-separate scheduler — it is read, not decided (`FABRIC.md` §19.3).
+separate scheduler — it is read, not decided (`FABRIC-0.md` §19.3).
 *Category*: Derived quantity.
 *Warning*: This is the one place the thermodynamic metaphor is literal in form (quantity
 per unit volume) even though heat itself remains metaphorical.
@@ -581,65 +581,65 @@ per unit volume) even though heat itself remains metaphorical.
 *Formal*: `K = Σ execution_heat_q48`, held at `Q48_ONE` (1.0) by construction — verified by
 `vm_physics_conserved()` (`capsule_vm_physics.c`).
 *Measurement*: A correctness check, not a diagnostic — it is 1.0 by construction and can
-never itself signal system state (`FABRIC.md` §14, §19.1). Entropy over the heat
+never itself signal system state (`FABRIC-0.md` §14, §19.1). Entropy over the heat
 *distribution* is the actual instrument; K is not.
 *Category*: Invariant.
 *Warning*: Not an occupancy ratio (`Σmass / capacity`) — that definition was considered and
 explicitly rejected because it contradicts the already-implemented, tested mechanism
-(`FABRIC.md` §19.1).
+(`FABRIC-0.md` §19.1).

 **Mass**
 *Definition*: The number of Stadium cells a patron occupies — its footprint.
 *Formal*: Integer ≥ 1, an entry field independent of heat; never enters K
-(`FABRIC.md` §3, §19.2).
+(`FABRIC-0.md` §3, §19.2).
 *Category*: Structural quantity, not conserved.
 *Note*: A large patron is not "referenced" from the Stadium — it simply occupies more
 cells. By-reference storage is reserved for things outside the Stadium entirely
-(`FABRIC.md` §19.3, §23.1).
+(`FABRIC-0.md` §19.3, §23.1).

 **Mass conservation vs. heat conservation**
 *Definition*: Two independent invariants that must not be confused. Heat (K) is conserved
 globally and moved by traffic. Mass is conserved *per patron* during a residency —
 identity and mass never change as a side effect of use — but is not a fleet-wide summed
-invariant the way heat is (`FABRIC.md` §24.2).
+invariant the way heat is (`FABRIC-0.md` §24.2).

 **Patron**
 *Definition*: A live thing occupying a Stadium cell or linked run of cells — the unit the
 Stadium actually holds.
 *Formal*: One structure, no variants, no type field — identified by its code field's
-behaviour, not by a kind tag (`FABRIC.md` §3, §13).
+behaviour, not by a kind tag (`FABRIC-0.md` §3, §13).
 *Measurement*: Nine header wires: identity, heat, TTL, pin, link, code field, mass,
-payload, contains (`FABRIC.md` §3, with amendments cited in place).
+payload, contains (`FABRIC-0.md` §3, with amendments cited in place).
 *Category*: The Stadium's sole occupant type.
 *Known kinds (as of this writing)*: words (dictionary — fully migrated and live via
-`stadium_word_dispatch()`, `FABRIC.md` §16.3/§17.7), blocks (Artemis), messages (Hermes — shipped with a
-**different** shape than this header, see `FABRIC-2.md`'s §23.4 #2 closure), VMs (Tripod,
-`FABRIC.md` §20), dirty events (console, `FABRIC.md` §17.5). Five kinds, not four — an
-earlier draft undercounted (`FABRIC.md` §1).
+`stadium_word_dispatch()`, `FABRIC-0.md` §16.3/§17.7), blocks (Artemis), messages (Hermes — shipped with a
+**different** shape than this header, see `FABRIC-1.md`'s §23.4 #2 closure), VMs (Tripod,
+`FABRIC-0.md` §20), dirty events (console, `FABRIC-0.md` §17.5). Five kinds, not four — an
+earlier draft undercounted (`FABRIC-0.md` §1).

 **Reap**
 *Definition*: The event that ends a patron's residency — not destruction, a return of its
 cells and remaining heat to the pool.
 *Formal*: Consumed on delivery (messages), on redraw (dirty events), on cooling below floor
-(VMs), or on eviction by a denser newcomer (`FABRIC.md` §17.2, §17.5, §19.3).
+(VMs), or on eviction by a denser newcomer (`FABRIC-0.md` §17.2, §17.5, §19.3).
 *Category*: Lifecycle event.

 **Stadium**
 *Definition*: A single, bounded region of memory outside any VM, holding everything
 currently live.
 *Formal*: A fixed-size array of cells, index-linked (not pointer-linked), allocated at
-boot before any VM exists, not part of the heap (`FABRIC.md` §2, §17.6).
+boot before any VM exists, not part of the heap (`FABRIC-0.md` §2, §17.6).
 *Measurement*: Per-VM quota over a single global cell pool, elastic under pressure,
-arbitrated by Hera (`FABRIC.md` §22) — not per-VM physical regions.
+arbitrated by Hera (`FABRIC-0.md` §22) — not per-VM physical regions.
 *Category*: The bounded live-state substrate this whole vocabulary describes.
 *Warning*: "Live" is the operative word — the Stadium holds what is live, not everything
 that exists. A dictionary word sitting cold and unexecuted is warehouse, not Stadium, even
-once the dictionary itself migrates into this representation (`FABRIC.md` §2, §16.3).
+once the dictionary itself migrates into this representation (`FABRIC-0.md` §2, §16.3).

 **Warehouse**
 *Definition*: What lies beneath the Stadium — storage for things not currently live.
 *Formal*: Artemis (block storage) and the resting dictionary are warehouse; the Stadium is
-the floor above it (`FABRIC.md` §17.5's three-category taxonomy: warehouse / Stadium /
+the floor above it (`FABRIC-0.md` §17.5's three-category taxonomy: warehouse / Stadium /
 utility).
 *Category*: Storage layer, outside the engine's live-state model.

@@ -647,7 +647,7 @@ utility).
 *Definition*: External infrastructure the Stadium consumes but never contains — beside the
 building, not inside or beneath it.
 *Formal*: The framebuffer and devices generally; the engine never learns about a utility's
-existence, which is what makes it a boundary rather than an exception (`FABRIC.md` §17.5).
+existence, which is what makes it a boundary rather than an exception (`FABRIC-0.md` §17.5).
 *Category*: Third taxonomy category, coordinate with warehouse and Stadium, not a
 sub-case of either.

@@ -655,7 +655,7 @@ sub-case of either.

 Per Bob's own flag: code, Kconfig, and documentation terminology must not drift apart.
 The table below is the current, verified wiring status of every `STADIUM_*` Kconfig
-symbol — confirmed by direct source grep during the `FABRIC-2.md` closure work this
+symbol — confirmed by direct source grep during the `FABRIC-1.md` closure work this
 vocabulary accompanies, not assumed from the symbol's name or Kconfig help text alone.

 | Kconfig symbol | Vocabulary term | Wiring status (2026-08-13) |
@@ -664,8 +664,8 @@ vocabulary accompanies, not assumed from the symbol's name or Kconfig help text
 | `STADIUM_MEMORY_PERCENT` | Stadium capacity sizing | **Live** — read in `stadium.c` |
 | `STADIUM_WORD_HEAT_QUANTUM` | Heat (word-patron admission) | **Live** — read in `stadium_words.c` |
 | `STADIUM_WORD_COOL_RATE_Q48` | Heat decay rate (word patrons) | **Live** — read in `stadium_words.c` |
-| `STADIUM_CONTAINS_DEPTH_MAX` | `contains` wire depth cap (§3, §8) | **Declared, not yet enforced** — reap-gating enforcement is item 3.5's scope, not implemented (`FABRIC-2.md` §A item 5.3 area; not a bug, a known sequencing gap) |
-| `STADIUM_CAPACITY_TICK` | Capacity-loop cadence, distinct from heat's (§22.4) | **Dead** — declared with the correct intended default (1000, matching §22.4's precedent) but never read by any code path; only appearance beyond its own default is a compile-time `> 0` static assertion in `stadium.h`. Found and reported during this session's §12 Q5 closure (`FABRIC-2.md`) — `vm_physics_heartbeat_tick()` still literally shares `HEARTBEAT_INFERENCE_FREQUENCY` instead |
+| `STADIUM_CONTAINS_DEPTH_MAX` | `contains` wire depth cap (§3, §8) | **Declared, not yet enforced** — reap-gating enforcement is item 3.5's scope, not implemented (`FABRIC-1.md` §A item 5.3 area; not a bug, a known sequencing gap) |
+| `STADIUM_CAPACITY_TICK` | Capacity-loop cadence, distinct from heat's (§22.4) | **Dead** — declared with the correct intended default (1000, matching §22.4's precedent) but never read by any code path; only appearance beyond its own default is a compile-time `> 0` static assertion in `stadium.h`. Found and reported during this session's §12 Q5 closure (`FABRIC-1.md`) — `vm_physics_heartbeat_tick()` still literally shares `HEARTBEAT_INFERENCE_FREQUENCY` instead |

 This table is a snapshot, not a promise — it will drift the moment any of these symbols is
 wired or unwired. Re-verify against source before relying on it for anything past a casual
@@ -6,7 +6,7 @@
 > Tripod/Stadium/word-level ACL existed, and before "Phase 1 Starting (HAL)" had any of the
 > meaning it has now. Kept for historical record only. For current status, see
 > `docs/lithosananke/ROADMAP.md` (repo-specific, LithosAnanke roadmap) and
-> `FABRIC.md`/`FABRIC-2.md`/`FABRIC-3.md` (design history and current work) — not this
+> `FABRIC-0.md`/`FABRIC-1.md`/`FABRIC-2.md` (design history and current work) — not this
 > document.

 **Version**: 1.0
@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-09-04T15:02:01Z -->
+<!-- Generated by mkcapsule --manifest  2026-09-04T15:20:47Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->
@@ -9,15 +9,15 @@
 | Capsule | Blocks claimed | xxHash64 | Signed |
 |---------|----------------|----------|--------|
 | `ACL.4th` | 4000, 4001, 4002, 4003, 4004, 4005, 4006, 4007, 4015 | `0xd781d22148ff171d` | yes |
-| `artemis:init.4th` | 4110, 4111, 4112, 4113, 4122, 4123, 4124, 4125, 4126, 4127, 4128, 4129, 4130, 4131, 4132, 4133, 4134, 4135, 4136, 4137, 4138, 4139, 4140, 4141, 4160, 4161, 4162, 4163, 4164, 4165, 4166, 4167, 4168, 4169, 4170, 4171, 4172, 4173, 4174, 4177, 4178, 4179, 4180, 4181, 4182, 4851, 4852, 4853, 4854 | `0x90208e9ab5ae0070` | yes |
-| `block-acl.4th` | 4019, 4020 | `0xf5eab0544b962dfa` | yes |
+| `artemis:init.4th` | 4110, 4111, 4112, 4113, 4122, 4123, 4124, 4125, 4126, 4127, 4128, 4129, 4130, 4131, 4132, 4133, 4134, 4135, 4136, 4137, 4138, 4139, 4140, 4141, 4160, 4161, 4162, 4163, 4164, 4165, 4166, 4167, 4168, 4169, 4170, 4171, 4172, 4173, 4174, 4177, 4178, 4179, 4180, 4181, 4182, 4851, 4852, 4853, 4854 | `0x1bb1886fc961c152` | yes |
+| `block-acl.4th` | 4019, 4020 | `0xf6cc2a59e3a6734e` | yes |
 | `common:messaging.4th` | 5003, 5004, 5005, 5006, 5007, 5008, 5009, 5010, 5011, 5012, 5013, 5014, 5015, 5016, 5017, 5018, 5019, 5020, 5021, 5022, 5023, 5024, 5025, 5026, 5027, 5028, 5029, 5030, 5031, 5032, 5033, 5034, 5035, 5036, 5037, 5038, 5039, 5040 | `0x9cb26fa2d67465db` | yes |
 | `common:msg.4th` | 4055 | `0x850a0382344ea6c4` | yes |
 | `doe-campaign.4th` | 4060, 4061, 4062, 4063, 4064, 4065 | `0x3d4549142d91ec20` | yes |
 | `doe.4th` | 2100, 2101, 2102, 2103, 2104, 2105, 2106, 2107 | `0xf154616d248e861f` | yes |
-| `fabric.4th` | 4900, 4901, 4902, 4903, 4904, 4905, 4906, 4907, 4908, 4909, 4910, 4911, 4912, 4913, 4914, 4915, 4916, 4917, 4918, 4919, 4920, 4921, 4922, 4923, 4924, 5000, 5001, 5002 | `0x9b1d061339cea98d` | yes |
-| `font.4th` | 4925, 4926, 4927, 4928, 4929, 4930, 4931, 4932, 4933, 4934, 4935, 4936, 4937, 4938, 4939, 4940, 4941, 4942, 4943, 4944, 4945, 4946, 4947, 4948, 4949, 4950, 4951, 4952, 4953, 4954, 4955, 4956, 4957, 4958, 4959, 4960, 4961, 4962, 4963, 4964, 4965, 4966, 4967, 4968, 4969, 4970, 4971, 4972, 4973, 4974, 4975, 4976, 4977, 4978, 4979, 4980, 4981, 4982, 4983, 4984, 4985 | `0x720792b4fc758156` | yes |
-| `hermes:init.4th` | 4153, 4855, 5116 | `0x7d4ab35a4d3ffc0c` | yes |
+| `fabric.4th` | 4900, 4901, 4902, 4903, 4904, 4905, 4906, 4907, 4908, 4909, 4910, 4911, 4912, 4913, 4914, 4915, 4916, 4917, 4918, 4919, 4920, 4921, 4922, 4923, 4924, 5000, 5001, 5002 | `0x9d9489cbeca4099b` | yes |
+| `font.4th` | 4925, 4926, 4927, 4928, 4929, 4930, 4931, 4932, 4933, 4934, 4935, 4936, 4937, 4938, 4939, 4940, 4941, 4942, 4943, 4944, 4945, 4946, 4947, 4948, 4949, 4950, 4951, 4952, 4953, 4954, 4955, 4956, 4957, 4958, 4959, 4960, 4961, 4962, 4963, 4964, 4965, 4966, 4967, 4968, 4969, 4970, 4971, 4972, 4973, 4974, 4975, 4976, 4977, 4978, 4979, 4980, 4981, 4982, 4983, 4984, 4985 | `0x3f305911500c78f6` | yes |
+| `hermes:init.4th` | 4153, 4855, 5116 | `0x2df61924448a6812` | yes |
 | `init-0.4th` | 2200, 2201 | `0xd0a9550baf786bb3` | yes |
 | `init-1.4th` | 4406, 4415, 4425, 4435 | `0x63e251adb0a03613` | yes |
 | `init-2.4th` | 4506, 4515, 4525, 4535, 4545 | `0xf113b3d0bcccae47` | yes |
@@ -40,7 +40,7 @@
 | `sdk.4th` | 5109, 5110, 5111, 5112, 5113, 5114, 5115 | `0x008fdbbb62c94a3a` | yes |
 | `turtle.4th` | 5100, 5101, 5102, 5103, 5104, 5105, 5106, 5107, 5108 | `0x4d470418ca543365` | yes |
 | `user-font-demo.4th` | 4200, 4201, 4202 | `0xce1fd7d1b581a56d` | yes |
-| `zuse-eligibility.4th` | 4021, 4022 | `0x604ddb82c8fa4db0` | yes |
+| `zuse-eligibility.4th` | 4021, 4022 | `0x8b49c1bc1e01dc58` | yes |
 | `zuse.4th` | 4016, 4017, 4018 | `0x490ded9be257a90b` | yes |

 ## Block Map (sorted by LBN)
@@ -109,10 +109,10 @@
 | 4016 | `zuse.4th` | `0x490ded9be257a90b` | ok |
 | 4017 | `zuse.4th` | `0x490ded9be257a90b` | ok |
 | 4018 | `zuse.4th` | `0x490ded9be257a90b` | ok |
-| 4019 | `block-acl.4th` | `0xf5eab0544b962dfa` | ok |
-| 4020 | `block-acl.4th` | `0xf5eab0544b962dfa` | ok |
-| 4021 | `zuse-eligibility.4th` | `0x604ddb82c8fa4db0` | ok |
-| 4022 | `zuse-eligibility.4th` | `0x604ddb82c8fa4db0` | ok |
+| 4019 | `block-acl.4th` | `0xf6cc2a59e3a6734e` | ok |
+| 4020 | `block-acl.4th` | `0xf6cc2a59e3a6734e` | ok |
+| 4021 | `zuse-eligibility.4th` | `0x8b49c1bc1e01dc58` | ok |
+| 4022 | `zuse-eligibility.4th` | `0x8b49c1bc1e01dc58` | ok |
 | 4050 | `lib.4th` | `0x4b216635c359ef73` | ok |
 | 4055 | `common:msg.4th` | `0x850a0382344ea6c4` | ok |
 | 4060 | `doe-campaign.4th` | `0x3d4549142d91ec20` | ok |
@@ -121,52 +121,52 @@
 | 4063 | `doe-campaign.4th` | `0x3d4549142d91ec20` | ok |
 | 4064 | `doe-campaign.4th` | `0x3d4549142d91ec20` | ok |
 | 4065 | `doe-campaign.4th` | `0x3d4549142d91ec20` | ok |
-| 4110 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4111 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4112 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4113 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4122 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4123 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4124 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4125 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4126 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4127 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4128 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4129 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4130 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4131 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4132 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4133 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4134 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4135 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4136 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4137 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4138 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4139 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4140 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4141 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4153 | `hermes:init.4th` | `0x7d4ab35a4d3ffc0c` | ok |
-| 4160 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4161 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4162 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4163 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4164 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4165 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4166 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4167 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4168 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4169 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4170 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4171 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4172 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4173 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4174 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4177 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4178 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4179 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4180 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4181 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4182 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
+| 4110 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4111 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4112 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4113 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4122 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4123 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4124 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4125 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4126 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4127 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4128 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4129 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4130 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4131 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4132 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4133 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4134 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4135 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4136 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4137 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4138 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4139 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4140 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4141 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4153 | `hermes:init.4th` | `0x2df61924448a6812` | ok |
+| 4160 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4161 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4162 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4163 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4164 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4165 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4166 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4167 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4168 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4169 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4170 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4171 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4172 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4173 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4174 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4177 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4178 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4179 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4180 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4181 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4182 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
 | 4200 | `user-font-demo.4th` | `0xce1fd7d1b581a56d` | ok |
 | 4201 | `user-font-demo.4th` | `0xce1fd7d1b581a56d` | ok |
 | 4202 | `user-font-demo.4th` | `0xce1fd7d1b581a56d` | ok |
@@ -206,100 +206,100 @@
 | 4840 | `init-l8-transition.4th` | `0xbcc1a81976f0a4c9` | ok |
 | 4841 | `init-l8-transition.4th` | `0xbcc1a81976f0a4c9` | ok |
 | 4842 | `init-l8-transition.4th` | `0xbcc1a81976f0a4c9` | ok |
-| 4851 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4852 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4853 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4854 | `artemis:init.4th` | `0x90208e9ab5ae0070` | ok |
-| 4855 | `hermes:init.4th` | `0x7d4ab35a4d3ffc0c` | ok |
-| 4900 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4901 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4902 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4903 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4904 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4905 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4906 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4907 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4908 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4909 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4910 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4911 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4912 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4913 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4914 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4915 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4916 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4917 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4918 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4919 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4920 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4921 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4922 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4923 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4924 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 4925 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4926 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4927 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4928 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4929 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4930 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4931 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4932 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4933 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4934 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4935 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4936 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4937 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4938 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4939 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4940 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4941 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4942 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4943 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4944 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4945 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4946 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4947 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4948 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4949 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4950 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4951 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4952 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4953 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4954 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4955 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4956 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4957 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4958 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4959 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4960 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4961 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4962 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4963 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4964 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4965 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4966 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4967 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4968 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4969 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4970 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4971 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4972 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4973 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4974 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4975 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4976 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4977 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4978 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4979 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4980 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4981 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4982 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4983 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4984 | `font.4th` | `0x720792b4fc758156` | ok |
-| 4985 | `font.4th` | `0x720792b4fc758156` | ok |
-| 5000 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 5001 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
-| 5002 | `fabric.4th` | `0x9b1d061339cea98d` | ok |
+| 4851 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4852 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4853 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4854 | `artemis:init.4th` | `0x1bb1886fc961c152` | ok |
+| 4855 | `hermes:init.4th` | `0x2df61924448a6812` | ok |
+| 4900 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4901 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4902 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4903 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4904 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4905 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4906 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4907 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4908 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4909 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4910 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4911 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4912 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4913 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4914 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4915 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4916 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4917 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4918 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4919 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4920 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4921 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4922 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4923 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4924 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 4925 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4926 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4927 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4928 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4929 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4930 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4931 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4932 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4933 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4934 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4935 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4936 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4937 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4938 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4939 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4940 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4941 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4942 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4943 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4944 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4945 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4946 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4947 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4948 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4949 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4950 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4951 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4952 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4953 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4954 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4955 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4956 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4957 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4958 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4959 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4960 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4961 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4962 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4963 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4964 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4965 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4966 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4967 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4968 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4969 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4970 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4971 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4972 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4973 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4974 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4975 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4976 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4977 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4978 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4979 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4980 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4981 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4982 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4983 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4984 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 4985 | `font.4th` | `0x3f305911500c78f6` | ok |
+| 5000 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 5001 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
+| 5002 | `fabric.4th` | `0x9d9489cbeca4099b` | ok |
 | 5003 | `common:messaging.4th` | `0x9cb26fa2d67465db` | ok |
 | 5004 | `common:messaging.4th` | `0x9cb26fa2d67465db` | ok |
 | 5005 | `common:messaging.4th` | `0x9cb26fa2d67465db` | ok |
@@ -354,7 +354,7 @@
 | 5113 | `sdk.4th` | `0x008fdbbb62c94a3a` | ok |
 | 5114 | `sdk.4th` | `0x008fdbbb62c94a3a` | ok |
 | 5115 | `sdk.4th` | `0x008fdbbb62c94a3a` | ok |
-| 5116 | `hermes:init.4th` | `0x7d4ab35a4d3ffc0c` | ok |
+| 5116 | `hermes:init.4th` | `0x2df61924448a6812` | ok |

 ## Conflicts

@@ -65,7 +65,7 @@ Block 4137
 ( item 4.6 -- Stadium cell-index arena, not a heat arena. One  )
 ( slot per possible LBN, holding STADIUM-NONE or a live cell   )
 ( index -- residency exists only while a block is allocated    )
-( (admission-on-allocate, FABRIC-2.md item 4.6's ruling).      )
+( (admission-on-allocate, FABRIC-1.md item 4.6's ruling).      )
 CREATE BLK-CELL ART-DATA-BLKS CELLS ALLOT
 Block 4138
 ( Cell-index accessors and LBN conversion. Heat itself now )
@@ -5,7 +5,7 @@ Block 4019
 ( Policy words this file: BLK-ACL-CHECK )
 ( Mirrors ACL.4th's C-primitive/FORTH-policy split, )
 ( applied to blocks instead of words. )
-( FABRIC-3.md H.12 step 16, 2026-09-03. )
+( FABRIC-2.md H.12 step 16, 2026-09-03. )
 256 CONSTANT BLK-ACL-BASE-TTL

 Block 4020
@@ -1,6 +1,6 @@
 # capsules/contrib/

-Milestone 7 (contributor capsules / trust tiers), FABRIC-3.md §I.5.
+Milestone 7 (contributor capsules / trust tiers), FABRIC-2.md §I.5.

 Any `.4th` file placed here gets `FLAG_CONTRIB` in addition to the usual
 `FLAG_PRODUCTION | FLAG_EXPERIMENT` pair — `tools/mkcapsule.c`'s
@@ -1,6 +1,6 @@
 Block 4900
 ( fabric.4th -- Console drawing-fabric coordinate machinery )
-( FABRIC.md item 4.3.3. 45-degree cavalier orthographic     )
+( FABRIC-0.md item 4.3.3. 45-degree cavalier orthographic     )
 ( projection. Z is depth-into-screen, not height. Q48.16    )
 ( throughout. Raw pixel write (PLOT/FB-WIDTH/FB-HEIGHT) is  )
 ( C; this capsule is the FORTH-side policy on top of it.    )
@@ -6,7 +6,7 @@ Block 4925
 ( (fabric.4th 5000-5002); straight strokes stay G-LINE. Not    )
 ( every round-ish letter was converted -- only ones a single   )
 ( circle/arc/ellipse renders cleanly without per-glyph angle   )
-( tuning (S/s/&/2/3/5/6/8/9 etc. stay blocky; see FABRIC.md).  )
+( tuning (S/s/&/2/3/5/6/8/9 stay blocky; FABRIC-0.md).         )
 Block 4926
 ( Digit 0: ELLIPSE -- true oval, not a 6-line rectangle. )
 : G-0 ( -- adv )
@@ -534,7 +534,7 @@ Block 4969
  500 ;

 Block 4970
-( Latin-1 Supplement, 11 glyphs. codepoints per FABRIC.md   )
+( Latin-1 Supplement, 11 glyphs. codepoints per FABRIC-0.md   )
 ( 27.6.4. DEGREE/CENT use curves; rest are line-only.        )
 : G-DEGREE ( -- adv )  250 600 60 G-CIRCLE  350 ;
 : G-CENT ( -- adv )
@@ -600,7 +600,7 @@ Block 4975
 : G-NBSP ( -- adv )  300 ;

 Block 4976
-( General Punctuation, 7 glyphs. codepoints per FABRIC.md   )
+( General Punctuation, 7 glyphs. codepoints per FABRIC-0.md   )
 ( 27.6.4. ELLIPSIS uses three CIRCLEs, matching PERIOD.     )
 : G-LSQUOTE ( -- adv )
  230 650 220 600 G-LINE
@@ -636,7 +636,7 @@ Block 4978

 Block 4979
 ( Real DISPATCH-DIGIT, replaces fabric.4th's placeholder.   )
-( Redefinition needed -- CASE binds early (FABRIC.md 27.6.5).)
+( Redefinition needed -- CASE binds early (FABRIC-0.md 27.6.5).)
 : DISPATCH-DIGIT ( codepoint -- adv )  CASE
  48 OF G-0 ENDOF 49 OF G-1 ENDOF 50 OF G-2 ENDOF
  51 OF G-3 ENDOF 52 OF G-4 ENDOF 53 OF G-5 ENDOF
@@ -1,13 +1,13 @@
 # capsules/fonts/

-Font capsule for FABRIC.md items 4.3.7/4.3.7b (TrueType rendering, adjunct
+Font capsule for FABRIC-0.md items 4.3.7/4.3.7b (TrueType rendering, adjunct
 to the stroke font — §27.7).

 | File | License | Provenance |
 |------|---------|------------|
 | `JetBrainsMono-Regular.ttf` | SIL Open Font License, Version 1.1 | The JetBrains Mono Project Authors, copyright 2020 (https://github.com/JetBrains/JetBrainsMono). License string confirmed by reading the font's own embedded `name` table directly (`strings -e b JetBrainsMono-Regular.ttf`) — not taken on trust from the filename. |

-Chosen as the v1 test/default TTF font 2026-08-10 (FABRIC.md §27.7 "Update
+Chosen as the v1 test/default TTF font 2026-08-10 (FABRIC-0.md §27.7 "Update
 2026-08-10"), resolving that item's licensing-check blocker.

 **Embedded as a raw-binary capsule, not text-encoded.** `tools/mkcapsule.c`'s
@@ -21,7 +21,7 @@ relative path, per `build_capsule_name()`). Fetch it with
 `capsule_find_by_name()` (`include/starkernel/capsule.h`) — that returns
 `offset`/`length` into the arena without ever routing through
 `capsule_exec_payload()`, so nothing tries to interpret the font bytes as
-FORTH source. This superseded FABRIC.md §27.7 decision #3 (hex/base64
+FORTH source. This superseded FABRIC-0.md §27.7 decision #3 (hex/base64
 text-encoding) — see that section's 2026-08-10 correction note.

 No SIL OFL 1.1 full license text is bundled here yet — only the font's own
@@ -1,6 +1,6 @@
 Block 4855
 ( Hermes v1 -- WELCOME. Generic messaging vocab moved to )
-( common:messaging.4th, FABRIC-3.md Phase C 2026-08-28. )
+( common:messaging.4th, FABRIC-2.md Phase C 2026-08-28. )
 : WELCOME ( -- ) LOG-INFO" Hermes: loaded" ;
 WELCOME
 Block 4153
@@ -6,7 +6,7 @@ Block 4021
 ( Hera's own dict -- delivered here by messaging.4th's )
 ( MSG-DELIVER via VM-EXEC when a session calls the )
 ( common:messaging.4th SEND-ELEVATE-REQUEST entrypoint. )
-( FABRIC-3.md H.12 step 21, 2026-09-03. )
+( FABRIC-2.md H.12 step 21, 2026-09-03. )
 CREATE ELEVATE-PK-BUF 32 ALLOT

 Block 4022
@@ -85,7 +85,7 @@ carrying timestamp noise in git history.

 - `artemis-metafence-fresh.img` — 30MB raw image, blank at creation,
  added 2026-08-26 for the top-of-device system-metadata fence
-  (`meta_fence_blocks` in `blk_volume_meta_t`, FABRIC-3.md Phase 8 §C).
+  (`meta_fence_blocks` in `blk_volume_meta_t`, FABRIC-2.md Phase 8 §C).
  Same reasoning as `artemis-reloc-test.img` above: the fence is only
  initialized to `BLK_META_FENCE_INIT` (128) by
  `blk_compute_fresh_geometry()` on a fresh format, so a genuinely blank
@@ -103,7 +103,7 @@ carrying timestamp noise in git history.
  or misreading adjacent fields.

 - `zuse.img` — 64MB raw image simulating the physical Zuse superuser
-  thumbdrive for QEMU testing (FABRIC-3.md, Phase 8: `zuse.img` "bleach"
+  thumbdrive for QEMU testing (FABRIC-2.md, Phase 8: `zuse.img` "bleach"
  mechanism, added 2026-08-26). **64MB is only this fixture's size, not a
  constraint on real home-blocks thumbdrives** (Captain Bob, 2026-08-26) —
  the design is not bound to any particular drive size; `homeblocks_sig_t`'s
@@ -597,7 +597,7 @@ like `ttf_words.c`, not a word-registration file.
 ## Console Fabric — Framebuffer (`framebuffer_words.c`)

 Kernel-only (`__STARKERNEL__`); no-ops on hosted builds. Raw hardware-boundary access —
-FABRIC.md item 4.3.3.
+FABRIC-0.md item 4.3.3.

 | Word | Stack Effect | Description |
 |---|---|---|
@@ -618,7 +618,7 @@ FABRIC.md item 4.3.3.

 ## Console Fabric — TrueType Text (`ttf_words.c`)

-Kernel-only (`__STARKERNEL__`); no-op on hosted builds. FABRIC.md item 4.3.7e.
+Kernel-only (`__STARKERNEL__`); no-op on hosted builds. FABRIC-0.md item 4.3.7e.

 | Word | Stack Effect | Description |
 |---|---|---|
@@ -626,7 +626,7 @@ Kernel-only (`__STARKERNEL__`); no-op on hosted builds. FABRIC.md item 4.3.7e.

 ## Console Fabric — Scrollback (`scroll_words.c`)

-Kernel-only (`__STARKERNEL__`); no-op on hosted builds. FABRIC.md item 4.4q (boot-mode
+Kernel-only (`__STARKERNEL__`); no-op on hosted builds. FABRIC-0.md item 4.4q (boot-mode
 scrollback added by 4.4ac).

 | Word | Stack Effect | Description |
@@ -1,7 +1,7 @@
 # M7.1: Init Capsule Architecture

 **Status:** Shipped and live, not just designed — this document predates the actual
-capsule/Tripod/Stadium work; see `FABRIC.md`/`FABRIC-2.md`/`FABRIC-3.md` for real status
+capsule/Tripod/Stadium work; see `FABRIC-0.md`/`FABRIC-1.md`/`FABRIC-2.md` for real status
 (per `.claude/CLAUDE.md`'s standing redirect)
 **Branch:** `master` (post-split; the old `lithosananke` branch no longer exists in this repo)
 **Prerequisite:** M7 (VM Parity Validation)
@@ -3,7 +3,7 @@
 **Branch:** `master` (post-split: this repo's `master` is the sole LithosAnanke production
 line; the old `lithosananke` branch belonged to the pre-split combined monorepo and no
 longer exists here — see `.claude/CLAUDE.md`'s "On the branch topology" note)
-**Current:** M7.1 in progress — see `FABRIC.md`/`FABRIC-2.md`/`FABRIC-3.md` for real status
+**Current:** M7.1 in progress — see `FABRIC-0.md`/`FABRIC-1.md`/`FABRIC-2.md` for real status

 ---

@@ -28,7 +28,7 @@ belongs here.

 Applied to the two planned releases: the **v2.0.0** cut (even major, so LTS) is the QEMU
 release; **v2.5.0** is the hardware bare-metal release that transfers v2.0.0's QEMU story to
-real boards. See `FABRIC-3.md` §G for the release-gate punch lists.
+real boards. See `FABRIC-2.md` §G for the release-gate punch lists.

 **Board-by-board hardware rollout, decided 2026-08-29 (extends the above as boards come
 online).** Real silicon is arriving incrementally (Beelink SER5 in hand now; RasPi 5 + Milk-V
@@ -151,8 +151,8 @@ M4  APIC                ██████████████████
 M5  Timer               ████████████████████ COMPLETE
 M6  Heap                ████████████████████ COMPLETE
 M7  VM Parity           ████████████████████ COMPLETE
-M7.1 Capsules           ████████████████░░░░ LIVE — see FABRIC.md/FABRIC-2.md/FABRIC-3.md
-M8  REPL                ░░░░░░░░░░░░░░░░░░░░ OBSOLETE — see FABRIC.md §25.5 item 4.4
+M7.1 Capsules           ████████████████░░░░ LIVE — see FABRIC-0.md/FABRIC-1.md/FABRIC-2.md
+M8  REPL                ░░░░░░░░░░░░░░░░░░░░ OBSOLETE — see FABRIC-0.md §25.5 item 4.4
 M9  Block I/O           ░░░░░░░░░░░░░░░░░░░░ PLANNED
 M10 Networking          ░░░░░░░░░░░░░░░░░░░░ FUTURE
 ```
@@ -328,15 +328,15 @@ APIC Timer: started
 **Goal:** Content-addressed, immutable init capsules for VM birth

 **Status:** Design Complete (see [M7.1.md](M7.1.md)) — this section predates the actual
-capsule/Tripod/Stadium work and is not current. **See `FABRIC.md`/`FABRIC-2.md` for real
+capsule/Tripod/Stadium work and is not current. **See `FABRIC-0.md`/`FABRIC-1.md` for real
 status** (per `.claude/CLAUDE.md`'s standing redirect) — Tripod (Hera/Hermes/Artemis),
 word-level ACL Phases 1–7, and the Stadium physics-economy migration are all live, not just
 designed. Most recently: item 4.6 (Artemis's block-heat arena migrated to Stadium
 admission-on-allocate) verified passing its 30-rep stress campaign on all three
 architectures 2026-08-18, after fixing a quota-grant ordering bug (`capsule_birth.c`) that
-had made every admission fail; see `FABRIC-2.md` Section H. The same pass also fixed a
+had made every admission fail; see `FABRIC-1.md` Section H. The same pass also fixed a
 long-standing aarch64-only crash on `BYE` (wrong PSCI conduit — SMC has nothing to answer it
-under AAVMF/no-EL3 boot; switched to HVC), see `FABRIC-2.md` Section I.
+under AAVMF/no-EL3 boot; switched to HVC), see `FABRIC-1.md` Section I.

 **Core Concepts:**

@@ -379,7 +379,7 @@ under AAVMF/no-EL3 boot; switched to HVC), see `FABRIC-2.md` Section I.
 ## Phase 4: Interactive Forth (M8)

 > **⚠ OBSOLETE (2026-08-11).** This entire M8 section is superseded by
-> `FABRIC.md` §25.5 item 4.4 (REPL). The console/REPL design has moved past
+> `FABRIC-0.md` §25.5 item 4.4 (REPL). The console/REPL design has moved past
 > what's scoped here — do not use this section as a source for REPL or
 > CANVAS design decisions. Kept in place for history only.

@@ -387,7 +387,7 @@ under AAVMF/no-EL3 boot; switched to HVC), see `FABRIC-2.md` Section I.

 **Status:** Scoped 2026-08-11 (this section). Substrate (interrupt-driven keyboard
 input, glyph rendering) already complete via Stadium's Console fabric work
-(FABRIC.md §25.5 items 4.3.5–4.3.7f) — see "What's already done" below. This
+(FABRIC-0.md §25.5 items 4.3.5–4.3.7f) — see "What's already done" below. This
 scoping pass covers what's left: wiring the existing keyboard-event stream into
 the REPL's character input path.

@@ -401,11 +401,11 @@ is a second input source feeding the same loop.
  aarch64/riscv64 virtio-keyboard-pci + GIC/PLIC), converged behind one shared
  interface: `KEY-EVENT ( -- keycode pressed -1 | 0 )` in
  `src/word_source/keyboard_words.c`, `keycode` in the Linux input keycode
-  namespace. FABRIC.md items 4.3.5–4.3.5f, verified live on all three
+  namespace. FABRIC-0.md items 4.3.5–4.3.5f, verified live on all three
  architectures with real keypresses.
 - Glyph rendering, both paths: the stroke-drawn font (`TEXT`, capsule-based,
-  113-glyph v1 repertoire, FABRIC.md 4.3.6–4.3.6g) and TrueType (`TTF-TEXT`,
-  proportional spacing via real `hmtx` advance widths, FABRIC.md 4.3.7–4.3.7f).
+  113-glyph v1 repertoire, FABRIC-0.md 4.3.6–4.3.6g) and TrueType (`TTF-TEXT`,
+  proportional spacing via real `hmtx` advance widths, FABRIC-0.md 4.3.7–4.3.7f).
  Neither is required for the REPL text itself, though — see the VT100 finding
  below.
 - **The REPL's on-screen text already renders independently of both of the
@@ -468,7 +468,7 @@ ok 1 2 + .
 3 ok
 ```
 (via a real keypress on all three architectures, same live-keypress
-verification standard FABRIC.md 4.3.5f already established — not a
+verification standard FABRIC-0.md 4.3.5f already established — not a
 serial-injected synthetic test, though serial injection must still work
 identically afterward.)

@@ -546,7 +546,7 @@ LithosAnanke is successful when:
 1. **M7 Parity** — VM dictionary hash reproducible across boots
 2. **M7.1 Capsules** — Birth protocol enforced, provenance logged
 3. ~~**M8 REPL** — Interactive Forth at bare metal~~ — superseded, this criterion is now met
-   via Stadium's Console fabric work (`FABRIC.md` §25.5 item 4.4), not a standalone M8; see
+   via Stadium's Console fabric work (`FABRIC-0.md` §25.5 item 4.4), not a standalone M8; see
   the OBSOLETE banner above Phase 4
 4. **M9 Persistence** — State survives reboot

@@ -27,7 +27,7 @@ What actually exists, as of 2026-08-19:
 |-----------|------|--------------|---------------|
 | Word-level DoE (**this HOWTO**) | `doe.4th` | `DOE` / `EXEC-DOE ( seed n-reps -- )` | A single embedded arithmetic workload (`DOE-WORK`), run across the 16 L8 factor configurations, streaming a CSV row per run to serial. Not auto-run anywhere. |
 | Compudynamics fleet campaign | `doe-campaign.4th` | `CAMPAIGN` / `SMOKE-CAMPAIGN` / `THREE-VM-CAMPAIGN` | Spawns Hermes/Artemis and drives real `VM-EXEC` touches between them to measure fleet heat conservation (`VM-CONSERVED?`). Not auto-run anywhere. |
-| Artemis stress campaign | `capsules/artemis/init.4th` | `ART-STRESS-CAMPAIGN` | Runs unconditionally at the bottom of the file, so it fires automatically every time Artemis is born. This is the actual source of the live `[Artemis][HADES][DOE ]` CSV rows visible during every kernel boot — unrelated to either mechanism above, and the subject of FABRIC-2.md's item 4.6 fix. |
+| Artemis stress campaign | `capsules/artemis/init.4th` | `ART-STRESS-CAMPAIGN` | Runs unconditionally at the bottom of the file, so it fires automatically every time Artemis is born. This is the actual source of the live `[Artemis][HADES][DOE ]` CSV rows visible during every kernel boot — unrelated to either mechanism above, and the subject of FABRIC-1.md's item 4.6 fix. |

 Only the first is a self-contained "package/library" in the sense the
 cookbook wants — a capsule you load and call with your own parameters, not
@@ -4,7 +4,7 @@

 # SDK HOWTO — `capsules/sdk.4th`

-**Status:** WORKING. Part of the v1.9.0 scoping work (FABRIC-2.md section K).
+**Status:** WORKING. Part of the v1.9.0 scoping work (FABRIC-1.md section K).
 Loads the two cookbook capsules (turtle graphics, DoE library) and adds an
 `SDK` vocabulary entry point plus `FENCE` protection on top of them.

@@ -54,7 +54,7 @@ word wrongly destroyed every other word back to the fence too; forgetting
 an older word (which correctly cascades to remove newer words, per
 FORTH-79 semantics) crashed with a SIGSEGV — a use-after-free in the
 dictionary relink logic. Found and fixed as part of this work; full
-root-cause writeup in FABRIC-2.md section K. Three POST cases were added to
+root-cause writeup in FABRIC-1.md section K. Three POST cases were added to
 `dictionary_manipulation_words_test.c` (Module 14) alongside `FORGET`'s
 own, including the exact regression scenario, so it can't silently return.

@@ -144,7 +144,7 @@ rather than a `POLYGON` call with `n=5`.
    documented in `DOE-LIBRARY-HOWTO-20260819.md`) — it carried a stale
    `TEMP: ... revert once that run is done` comment for a verification
    run that had already closed. Reverted to disabled, matching the
-    file's own note (FABRIC-2.md section K/L).
+    file's own note (FABRIC-1.md section K/L).
  - The kernel's heartbeat CSV logging (`[HADES][DOE ]` rows) draws to
    the *same* console surface `PLOT` draws pixels to, and scrolls
    continuously — anything drawn gets visually overwritten within a
@@ -167,7 +167,7 @@ typedef struct {
     * graceful-default technique as reloc_devblocks itself: a
     * pre-existing formatted volume's zeroed padding reads back here as
     * meta_fence_blocks=0 ("no fence yet"), not a format-breaking
-     * change. See FABRIC-3.md's Phase 8 §C writeup for the full design. */
+     * change. See FABRIC-2.md's Phase 8 §C writeup for the full design. */
    uint32_t meta_fence_blocks; /* current fence size, in 4 KiB devblocks (0 = none yet) */

    /* Padding to keep header ≤ 4096 bytes */
@@ -199,7 +199,7 @@ typedef struct {
 _Static_assert(sizeof(blk_volume_meta_t) == 4096,
               "blk_volume_meta_t must be exactly one 4 KiB devblock");

-/* blk_meta_t.flags bit values -- FABRIC-3.md §F.4/§H.6/§H.12 step 13,
+/* blk_meta_t.flags bit values -- FABRIC-2.md §F.4/§H.6/§H.12 step 13,
 * decided 2026-09-02/03. Orthogonal bits, not a mutually-exclusive enum:
 * a block can be both CLAIMED and MIGRATING at once. Grounded in the only
 * states §F.4 actually motivated by a real need (MIGSM/UNCLEAN, two
@@ -233,7 +233,7 @@ typedef struct {
    uint64_t entropy[4]; /* 256-bit entropy/random seed */
    uint64_t hash[4]; /* SHA-256 (optional) */

-    /* Security & ownership -- FABRIC-3.md §F.4/§H.6/§H.12 step 12, decided
+    /* Security & ownership -- FABRIC-2.md §F.4/§H.6/§H.12 step 12, decided
     * 2026-08-27/2026-09-03: BMAPFMT repurposes this slot rather than
     * building a separate on-drive block-map table (distributed
     * ownership/ACL, travels with the block itself). Replaces the old
@@ -276,7 +276,7 @@ typedef struct {

    uint8_t padding[5]; /* trailing slack, unrelated to any exact size target --
                          * the old "341-byte slice" comment here was already
-                          * inaccurate before FABRIC-3.md §H.12 step 12's edit
+                          * inaccurate before FABRIC-2.md §H.12 step 12's edit
                          * (sizeof(blk_meta_t) was 344, not 341, due to
                          * ordinary trailing struct-alignment padding after
                          * this array -- harmless since BLK_META_PER_BLOCK,
@@ -357,7 +357,7 @@ uint64_t blk_subsys_epoch(void);
 * the caller's own identity already owns, on whichever device it's being
 * relocated to; this function does not itself validate ownership, that's
 * policy, left to the caller -- see this session's ACL-owns-policy
- * direction in FABRIC-2.md), frees home_lbn's original BAM entry, records
+ * direction in FABRIC-1.md), frees home_lbn's original BAM entry, records
 * an LBN->LBN redirect so every future access to home_lbn transparently
 * resolves to target_lbn instead, and bumps blk_subsys_epoch() so any VM's
 * cached block window correctly invalidates. Persisted immediately to the
@@ -376,7 +376,7 @@ uint64_t blk_subsys_epoch(void);
 int blk_subsys_relocate_block(uint32_t home_lbn, uint32_t target_lbn);

 /* blk_get_device_range - the LBN range (start_lbn, count of 1 KiB FORTH
- * blocks) a specific already-attached device occupies (FABRIC-3.md §I.2,
+ * blocks) a specific already-attached device occupies (FABRIC-2.md §I.2,
 * 2026-09-04). Mirrors blk_subsys_detach_device()'s own dev-pointer slot
 * lookup, exposed publicly for the first time -- needed so a caller can
 * scope a scan/query to exactly one attached device rather than the
@@ -404,7 +404,7 @@ int blk_get_device_free_blocks(struct blkio_dev *dev, uint64_t *out_free, uint64
 */
 int blk_get_first_disk_range(uint32_t *out_start_lbn, uint32_t *out_count);

-/* blk_firsttouch_claim - FABRIC-3.md §F.11, decisions 1-3, built exactly
+/* blk_firsttouch_claim - FABRIC-2.md §F.11, decisions 1-3, built exactly
 * as scoped 2026-08-27 (re-verified against current blk_meta_t 2026-09-04
 * before building -- the chain fields below are real and untouched by
 * BMAPFMT's unrelated owner_fp/acl_allow/acl_ttl/flags field addition).
@@ -444,7 +444,7 @@ int blk_get_first_disk_range(uint32_t *out_start_lbn, uint32_t *out_count);
 */
 int blk_firsttouch_claim(const uint8_t owner_fp[8], uint32_t count, uint32_t *out_chain_head);

-/* blk_meta_relocate_devblock - the real migration primitive (FABRIC-3.md
+/* blk_meta_relocate_devblock - the real migration primitive (FABRIC-2.md
 * §I.2, migration state machine, 2026-09-04): moves one devblock's full
 * content and blk_meta_t ownership from home_devblock to target_devblock.
 * BLK_FLAG_MIGRATING is set on home_devblock for the duration -- the
@@ -479,7 +479,7 @@ int blk_firsttouch_claim(const uint8_t owner_fp[8], uint32_t count, uint32_t *ou
 int blk_meta_relocate_devblock(uint32_t home_devblock, uint32_t target_devblock);

 /* blk_migration_idle_check - heat/wear-leveling migration trigger, meant
- * to be called once per idle tick (FABRIC-3.md §I.2, 2026-09-04). See
+ * to be called once per idle tick (FABRIC-2.md §I.2, 2026-09-04). See
 * block_subsystem.c's own doc comment for the full scan/threshold
 * description and what's deliberately left open (overflow-triggered
 * migration). */
@@ -524,7 +524,7 @@ int blk_get_meta(uint32_t block_num, blk_meta_t *meta);

 int blk_set_meta(uint32_t block_num, const blk_meta_t *meta);

-/* BMAPFMT field accessors -- FABRIC-3.md §F.4/§H.6/§H.12 step 14. Thin
+/* BMAPFMT field accessors -- FABRIC-2.md §F.4/§H.6/§H.12 step 14. Thin
 * read-modify-write wrappers over blk_get_meta()/blk_set_meta() (which
 * already own the caching/dirty-tracking), one per new blk_meta_t field.
 * FORTH wrappers (BLK-ACL-ALLOW@/! etc., §H.12 step 15) call these, not
@@ -256,7 +256,7 @@ q48_16_t q48_sqrt_approx(q48_16_t q);
 /*
 * @brief Approximate sin(q) in Q48.16 (integer-only, Taylor series)
 *
- * Purpose: Console drawing fabric's CIRCLE/ARC/ELLIPSE (FABRIC.md item 4.3.3b)
+ * Purpose: Console drawing fabric's CIRCLE/ARC/ELLIPSE (FABRIC-0.md item 4.3.3b)
 * Method: Range-reduce into [-pi, pi], then Taylor series
 *
 * @param q Angle in Q48.16 format (radians, any magnitude)
@@ -267,7 +267,7 @@ q48_16_t q48_sin_approx(q48_16_t q);
 /*
 * @brief Approximate cos(q) in Q48.16 (integer-only, Taylor series)
 *
- * Purpose: Console drawing fabric's CIRCLE/ARC/ELLIPSE (FABRIC.md item 4.3.3b)
+ * Purpose: Console drawing fabric's CIRCLE/ARC/ELLIPSE (FABRIC-0.md item 4.3.3b)
 * Method: Range-reduce into [-pi, pi], then Taylor series
 *
 * @param q Angle in Q48.16 format (radians, any magnitude)
@@ -6,7 +6,7 @@
 * driver's synchronous bridge (xhci_bot_wait_for_idle(), xhci_bot_get_capacity(),
 * xhci_bot_read_block()) from Milestone 2h's foundational increment.
 *
- * Read-write since 2026-08-28 (FABRIC-3.md §F.1): SCSI WRITE(10) is real
+ * Read-write since 2026-08-28 (FABRIC-2.md §F.1): SCSI WRITE(10) is real
 * (xhci_bot_send_write10()/xhci_bot_write_block()/xhci_bot_write_data_out(),
 * xhci.c), mirroring READ(10)'s existing CBW/data-stage/CSW machinery with
 * the data direction flipped. Verified live on amd64: BLK-CONFIRM-FORMAT's
@@ -87,7 +87,7 @@ typedef enum {
 /** Mama init flag (exactly one capsule must have this) */
 #define CAPSULE_FLAG_MAMA_INIT    0x00000040  /* (m) Mama's init */

-/** Contributor capsule flag (FABRIC-3.md §I.5, 2026-09-04) -- path-match
+/** Contributor capsule flag (FABRIC-2.md §I.5, 2026-09-04) -- path-match
 * on capsules/contrib/, mirrors FLAG_MAMA_INIT's own exact-match pattern
 * in mkcapsule.c's flags_from_name(). Trust-tier enforcement (QEMU-vs-
 * real-hardware, decided in conversation) is a runtime check in
@@ -127,7 +127,7 @@ CapsuleRunResult capsule_birth_mama(
 * @param descs         Capsule descriptor array
 * @param names         Capsule name entry array (parallel to descs)
 * @param arena         Capsule payload arena
- * @param parent        Who is birthing this VM (FABRIC-3.md §H.12 step 7) --
+ * @param parent        Who is birthing this VM (FABRIC-2.md §H.12 step 7) --
 *                       the caller's own VMUuid (e.g. vm->stadium_vm_id for
 *                       a FORTH word handler), recorded on the new VM's
 *                       Session.parent. Every current call site has one in
@@ -138,7 +138,7 @@ CapsuleRunResult capsule_birth_mama(
 * @param skip_pki_sig  0 for every build-time capsule (the normal case --
 *                       checked against the compile-time-baked signature
 *                       array via capsule_get_signatures()). Non-zero only
- *                       for RUNCAP (FABRIC-3.md §F.6/F.18): a heap-built,
+ *                       for RUNCAP (FABRIC-2.md §F.6/F.18): a heap-built,
 *                       single-entry directory sourced from a user's own
 *                       thumbdrive has no entry in that array at all --
 *                       index 0 would silently compare against whatever
@@ -254,7 +254,7 @@ uint32_t capsule_vm_registry_count(void);
 * capsule_vm_registry_get_by_index - Get registry entry by list position
 * (birth order, stable within a boot session -- the registry is
 * append-only). For enumeration (e.g. the idle-loop messaging pump,
- * FABRIC-3.md Phase C, 2026-08-28), where no vm_id is known up front.
+ * FABRIC-2.md Phase C, 2026-08-28), where no vm_id is known up front.
 * Index range is [0, capsule_vm_registry_count()).
 *
 * @param index  Zero-based position in birth order
@@ -8,7 +8,7 @@
 */

 /**
- * capsule_console.h - Bare console-VM birth (FABRIC-3.md Phase F,
+ * capsule_console.h - Bare console-VM birth (FABRIC-2.md Phase F,
 * 2026-08-28): a minimal VM whose only job is loading
 * common:messaging.4th and being the physical REPL's relay target
 * (sk_repl_dispatch_line(), repl.c) for a paired user VM
@@ -35,7 +35,7 @@
 *                       "CaptBob"); sk_repl_dispatch_line() looks for a
 *                       live "<name>~user" counterpart to decide
 *                       whether a given active VM is a console.
- * @param parent         Who is birthing this VM (FABRIC-3.md §H.12 step 7)
+ * @param parent         Who is birthing this VM (FABRIC-2.md §H.12 step 7)
 *                       -- passed straight through to capsule_birth_baby().
 * @param out_vm_id      Output: assigned VM ID.
 * @param out_vm_ctx     Output: new VM context (may be NULL).
@@ -9,7 +9,7 @@

 /**
 * capsule_mint.h - MINT: mint a fresh identity onto a blank thumbdrive
- * (FABRIC-3.md §F.8/§F.19), the last piece of the original Tripod
+ * (FABRIC-2.md §F.8/§F.19), the last piece of the original Tripod
 * vision. Writes a real keypair, a Zuse-signed cert, and a minimal
 * working default personality -- everything RUNCAP (capsule_runcap.h)
 * and CERTVERIFY need at a later attach.
@@ -87,7 +87,7 @@ typedef enum {
 *                   internal "refuse to overwrite" re-check, which
 *                   otherwise repeats the exact same full BOT read
 *                   sequence a second time for no reason (found live,
- *                   FABRIC-3.md §F.25/§F.26: the redundant check was
+ *                   FABRIC-2.md §F.25/§F.26: the redundant check was
 *                   mistaken for a hang before the real cause -- leaked
 *                   `tail -f` processes from repeated hard kills during
 *                   the same debugging session -- was found). Pass 0 from
@@ -32,7 +32,7 @@

 #include <stddef.h>
 #include <stdint.h>
-#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
+#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC-0.md item 3.8 */

 #ifdef __cplusplus
 extern "C" {
@@ -56,7 +56,7 @@ typedef enum {
    CAPSULE_RUN_ERR_EXEC_FAIL,     /* Execution failed */
    CAPSULE_RUN_ERR_HASH_MISMATCH, /* Post-run hash mismatch */
    CAPSULE_RUN_ERR_STILLBORN,     /* VM birth failed */
-    CAPSULE_RUN_ERR_FLEET_FULL,    /* Outer Stadium at stadium_max_vm_count() (FABRIC.md item 1.5/2.2) */
+    CAPSULE_RUN_ERR_FLEET_FULL,    /* Outer Stadium at stadium_max_vm_count() (FABRIC-0.md item 1.5/2.2) */
 } CapsuleRunResult;

 /*===========================================================================
@@ -107,7 +107,7 @@ typedef struct {
                                  * parent chain stops at. */
    void    *vm_ptr;             /* Pointer to live VM object; NULL when dead */
    char     name[VM_NAME_MAX];  /* Symbolic name, e.g. "Hera", "Hermes" */
-    size_t   stadium_patron_cell; /* FABRIC-3.md SS B, VM-COOL: this VM's own
+    size_t   stadium_patron_cell; /* FABRIC-2.md SS B, VM-COOL: this VM's own
                                   * Stadium cell index (STADIUM_CELL_NONE,
                                   * i.e. (size_t)-1, if never admitted or
                                   * already reaped) -- admitted into the VM's
@@ -9,7 +9,7 @@

 /**
 * capsule_runcap.h - RUNCAP: runtime capsule construction from thumbdrive
- * content (FABRIC-3.md §F.6/§F.18).
+ * content (FABRIC-2.md §F.6/§F.18).
 *
 * A user's identity source (raw FORTH init/personality text, minted by
 * MINT into a home-blocks drive's identity_src region) never exists at
@@ -58,7 +58,7 @@ struct blkio_dev;
 * @param vm_name     Symbolic name for the new VM (becomes both the
 *                    capsule's own single directory entry name and the
 *                    VM registry name).
- * @param parent      Who is birthing this VM (FABRIC-3.md §H.12 step 7) --
+ * @param parent      Who is birthing this VM (FABRIC-2.md §H.12 step 7) --
 *                    passed straight through to capsule_birth_baby().
 * @param out_vm_id   Output: assigned VM ID.
 * @param out_vm_ctx  Output: new VM context (may be NULL if not needed).
@@ -7,7 +7,7 @@
 *
 * Enforced ONLY on CAPSULE_SIG_INVALID (2026-08-26, after landing
 * WARN-only and proving correct on all three architectures against both
- * a valid and a deliberately-corrupted capsule -- see FABRIC-3.md's
+ * a valid and a deliberately-corrupted capsule -- see FABRIC-2.md's
 * Milestone 6 writeup). CAPSULE_SIG_MISSING and CAPSULE_SIG_NO_ROOT_KEY
 * stay WARN-only, deliberately: MISSING is the normal state on every
 * machine without access to the offline signing key (CI, any other
@@ -41,7 +41,7 @@
 #define STARKERNEL_CAPSULE_VM_PHYSICS_H

 #include <stdint.h>
-#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
+#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC-0.md item 3.8 */

 #ifdef __cplusplus
 extern "C" {
@@ -82,7 +82,7 @@ void vm_physics_retire(VMUuid vm_id);
 * (amount = elapsed_ticks * fleet_transfer_slope_q48 >> 16) and appends
 * vm_id to the fleet's rolling touch-history window.
 *
- * Restated on the virtual tick (FABRIC.md item 2.1, 2026-08-04): no
+ * Restated on the virtual tick (FABRIC-0.md item 2.1, 2026-08-04): no
 * longer takes a wall-clock timestamp. Reads fleet_heartbeat_tick_count
 * internally, which is execution-paced (advanced once per vm_tick()
 * call, see vm_physics_heartbeat_tick), so the transfer this produces is
@@ -9,7 +9,7 @@

 /**
 * capsule_wirebind.h - WIREBIND: the real thumbdrive-attach call site
- * (FABRIC-3.md §F.5/§F.23). Assembles pieces already built and
+ * (FABRIC-2.md §F.5/§F.23). Assembles pieces already built and
 * individually verified this session -- CERTVERIFY (vm_identity.h's
 * vm_identity_from_cert()), RUNCAP (capsule_runcap.h), the console-VM +
 * user-VM pair (capsule_console.h, sk_repl_dispatch_line() in repl.c) --
@@ -33,7 +33,7 @@ struct blkio_dev;
 * it against mama_vm's own Zuse identity. Shared by both
 * capsule_wirebind_try_attach() (the original attach) and BINDSTEP
 * (mama_word_use(), mama_forth_words.c -- re-verifies live on every USE
- * of an identity-locked VM, per FABRIC-3.md §F.9 decision 1) so both
+ * of an identity-locked VM, per FABRIC-2.md §F.9 decision 1) so both
 * call sites check the exact same thing the exact same way.
 *
 * No-op-and-fail (-1) if sig->cert_offset is 0 (no cert region -- a
@@ -80,7 +80,7 @@ void capsule_wirebind_try_attach(struct blkio_dev *dev,

 /**
 * capsule_wirebind_eject - Graceful detach of whatever VM is currently
- * attached via the home-blocks USB path (FABRIC-3.md §F.10, decision 1).
+ * attached via the home-blocks USB path (FABRIC-2.md §F.10, decision 1).
 * The drive is still physically present when this runs.
 *
 * Sequence: resolve the tracked attached-VM id to a live registry entry
@@ -102,7 +102,7 @@ int capsule_wirebind_eject(void);

 /**
 * capsule_wirebind_unclean_detach - Abrupt-path counterpart to
- * capsule_wirebind_eject() (FABRIC-3.md §F.10, decision 2 -- the UNCLEAN
+ * capsule_wirebind_eject() (FABRIC-2.md §F.10, decision 2 -- the UNCLEAN
 * node, closed alongside EJECT). Called from the existing
 * bot_msc_detach_pending hot-unplug signal (repl.c) -- the device is
 * already gone by the time this runs, so no flush is attempted; data
@@ -115,7 +115,7 @@ void capsule_wirebind_unclean_detach(void);
 /**
 * capsule_wirebind_attached_username - The plain username (no "~user"
 * registry-name suffix) of whichever identity is currently tracked as
- * attached, or NULL if none is (FABRIC-3.md §I.1/4.4s -- the `(user)`
+ * attached, or NULL if none is (FABRIC-2.md §I.1/4.4s -- the `(user)`
 * console prompt segment reads this). Points into WIREBIND's own
 * internal storage; valid only until the next attach/eject/detach, same
 * caveat as console_get_vm_name().
@@ -9,7 +9,7 @@

 /**
 * capsule_zuse_boot.h - Thumbdrive-resident Zuse genesis/attach
- * (FABRIC-3.md §F.20/§F.21). Replaces kernel_main.c's old one-shot
+ * (FABRIC-2.md §F.20/§F.21). Replaces kernel_main.c's old one-shot
 * block-fence mint-or-load: Zuse's own identity now lives only on her
 * own minted thumbdrive, never system-resident. Since USB attach
 * detection only happens inside the idle loop (sk_repl_idle(), not at
@@ -60,7 +60,7 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,

 /**
 * capsule_zuse_boot_logout - End Zuse's session when her own attached
- * drive detaches (FABRIC-3.md §I.8, re-scoped 2026-09-04: no identity is
+ * drive detaches (FABRIC-2.md §I.8, re-scoped 2026-09-04: no identity is
 * different here -- Zuse logs out on device removal exactly like a
 * WIREBIND user does, not via a Stadium-patron TTL. She has no separate
 * VM or blocks of her own, so unlike capsule_wirebind_eject()/
@@ -73,7 +73,7 @@ void console_init(void);
 void console_fb_init(const FramebufferInfo *info, FbPixelFormat fmt);

 /**
- * FABRIC.md item 4.4j: switch the framebuffer console's glyph backend from
+ * FABRIC-0.md item 4.4j: switch the framebuffer console's glyph backend from
 * font_8x16.c to TTF-TEXT's rasterizer. Thin wrapper over
 * vt100_enable_ttf() -- see that function's doc comment for the full
 * contract (lazy font load, cell-geometry/cols/rows recompute, screen
@@ -84,7 +84,7 @@ void console_fb_init(const FramebufferInfo *info, FbPixelFormat fmt);
 void console_fb_enable_ttf(void);

 /**
- * FABRIC.md item 4.4q: thin wrappers over vt100_scroll_back()/
+ * FABRIC-0.md item 4.4q: thin wrappers over vt100_scroll_back()/
 * vt100_scroll_fwd() -- see those functions' doc comments for the full
 * contract. No-op if the framebuffer console was never initialized.
 */
@@ -92,7 +92,7 @@ void console_fb_scroll_back(uint32_t n);
 void console_fb_scroll_fwd(uint32_t n);

 /**
- * FABRIC.md item 4.4y-revised: thin wrapper over vt100_toggle_graphics()
+ * FABRIC-0.md item 4.4y-revised: thin wrapper over vt100_toggle_graphics()
 * -- see that function's doc comment for the full contract (the
 * Alt+TAB graphics/text state machine). No-op if the framebuffer console
 * was never initialized.
@@ -160,7 +160,7 @@ int console_poll(void);
 /**
 * Set the active VM name shown as [Name] prefix on each output line.
 * Pass NULL to suppress the prefix (kernel-only output before any VM).
- * Copies into internal storage (FABRIC-3.md Phase F, 2026-08-28) -- the
+ * Copies into internal storage (FABRIC-2.md Phase F, 2026-08-28) -- the
 * caller's own pointer does not need to remain valid afterward.
 */
 void console_set_vm_name(const char *name);
@@ -89,7 +89,7 @@ void fb_draw_glyph(uint32_t px, uint32_t py, uint8_t ch,
 * --------------------------------------------------------------------- */

 /**
- * One-time boot diagnostic (FABRIC.md item 4.3.1): fills each raster corner
+ * One-time boot diagnostic (FABRIC-0.md item 4.3.1): fills each raster corner
 * with a distinct solid color so a screendump reveals orientation. Not part
 * of the Console drawing fabric -- diagnostic-only.
 */
@@ -113,7 +113,7 @@ void fb_scroll_rows(uint32_t pixel_rows, uint32_t bg);

 /**
 * Scroll a sub-rectangle of the framebuffer up by `pixel_rows` pixel rows
- * (FABRIC.md item 4.4t: box-confined REPL scrolling). Unlike fb_scroll_rows()
+ * (FABRIC-0.md item 4.4t: box-confined REPL scrolling). Unlike fb_scroll_rows()
 * (whole-framebuffer), this is bounded to
 * [x, x+w) x [y, y+h). Both take an explicit pixel-row count so callers with
 * a non-8x16 cell height (e.g. TTF mode) pass their own cell height directly.
@@ -21,7 +21,7 @@
 */

 /**
- * homeblocks_sig.h - Home-blocks drive signature format (FABRIC-3.md,
+ * homeblocks_sig.h - Home-blocks drive signature format (FABRIC-2.md,
 * Milestone 4, Phase 8 kickoff; relocated + GPT dropped §F.13/§F.8,
 * 2026-08-28)
 *
@@ -74,7 +74,7 @@ extern "C" {
 #define HOMEBLOCKS_SIG_GET_VERSION(m) ((uint8_t)(((m) >> 32) & 0xFF))

 /* Where this header actually lives on a home-blocks drive: forth-block 4
- * (devblock 1), NOT devblock 0 -- FABRIC-3.md §F.13, decided 2026-08-28.
+ * (devblock 1), NOT devblock 0 -- FABRIC-2.md §F.13, decided 2026-08-28.
 * Devblock 0 is reserved for the block-subsystem's own generic 'STFR'/v2
 * volume header (block_subsystem.c); the two formats collide if both try
 * to occupy devblock 0 of the same raw device. GPT is permanently dropped
@@ -103,7 +103,7 @@ typedef struct {
    uint32_t cert_devblocks;     /* Size reserved for the cert blob, in devblocks. */

    uint32_t identity_src_offset;    /* Devblock offset where this identity's own record
-                                      * starts (RUNCAP/MINT, FABRIC-3.md §F.6/§F.8): first
+                                      * starts (RUNCAP/MINT, FABRIC-2.md §F.6/§F.8): first
                                      * devblock is a user_identity_seed_t, remainder is raw
                                      * FORTH personality/init source. Renamed from
                                      * blockmap_offset -- BMAPFMT (§F.4) repurposed blk_meta_t
@@ -137,7 +137,7 @@ typedef struct {
 typedef char homeblocks_sig_size_check[(sizeof(homeblocks_sig_t) == 4096) ? 1 : -1];

 /*===========================================================================
- * Signature check (FABRIC-3.md, Milestone 4)
+ * Signature check (FABRIC-2.md, Milestone 4)
 *===========================================================================*/

 typedef enum {
@@ -24,10 +24,10 @@
 /**
 * i8042.h - PS/2 keyboard controller interface (amd64 only)
 *
- * Item 4.3.5 (FABRIC.md §27.5). Interrupt-driven only — no polling of the
+ * Item 4.3.5 (FABRIC-0.md §27.5). Interrupt-driven only — no polling of the
 * status port (0x64) anywhere in this path. Groundwork only: this captures
 * and prints raw scancodes. Scancode-to-keycode translation and a consumer
- * API belong to the REPL keyboard-input work noted in FABRIC.md, not here.
+ * API belong to the REPL keyboard-input work noted in FABRIC-0.md, not here.
 */

 #ifndef STARKERNEL_I8042_H
@@ -24,7 +24,7 @@
 /**
 * ioapic.h - I/O APIC interface (amd64 only)
 *
- * Item 4.3.5 (FABRIC.md §27.5): no I/O APIC driver existed anywhere in this
+ * Item 4.3.5 (FABRIC-0.md §27.5): no I/O APIC driver existed anywhere in this
 * tree before this item. The Local APIC (apic.h) self-interrupts for the
 * timer and needs no routing; any *legacy* IRQ (i8042 keyboard's IRQ1
 * included) requires the I/O APIC to redirect it to a Local APIC vector.
@@ -7,7 +7,7 @@
 /**
 * plic.h - Platform-Level Interrupt Controller interface (riscv64 only)
 *
- * Item 4.3.5a (FABRIC.md §27.5): Phase 0 (0.2/0.3) only ever enabled the
+ * Item 4.3.5a (FABRIC-0.md §27.5): Phase 0 (0.2/0.3) only ever enabled the
 * S-mode *timer* interrupt (sie.STIE). External interrupts (sie.SEIE) were
 * never touched, and the PLIC -- the only external-interrupt path on
 * RISC-V, there is no legacy PIC or I/O APIC equivalent -- had no driver
@@ -74,7 +74,7 @@ VM *sk_repl_get_active_vm(void);
 /**
 * sk_repl_get_homeblocks_dev / sk_repl_get_homeblocks_sig - The currently
 * attached home-blocks USB drive, or NULL if none is attached / the
- * attached drive didn't check out as HOMEBLOCKS_SIG_OK (FABRIC-3.md
+ * attached drive didn't check out as HOMEBLOCKS_SIG_OK (FABRIC-2.md
 * §F.6/§F.9/§F.18). Both return NULL together; never one without the
 * other.
 */
@@ -83,7 +83,7 @@ const homeblocks_sig_t *sk_repl_get_homeblocks_sig(void);

 /**
 * sk_repl_get_attached_blk_dev - The currently attached USB block
- * device, regardless of home-blocks recognition (FABRIC-3.md
+ * device, regardless of home-blocks recognition (FABRIC-2.md
 * §F.8/§F.19) -- MINT's own target, since a blank/unminted drive never
 * sets sk_repl_get_homeblocks_dev() above. NULL if nothing is attached.
 */
@@ -22,9 +22,9 @@
 */

 /**
- * session.h - Per-VM session (FABRIC-3.md §H, decided 2026-09-02/03)
+ * session.h - Per-VM session (FABRIC-2.md §H, decided 2026-09-02/03)
 *
- * A session is a Stadium patron (FABRIC-3.md §H.1) -- registering a session
+ * A session is a Stadium patron (FABRIC-2.md §H.1) -- registering a session
 * IS admitting a patron to the Stadium, not a new parallel bookkeeping
 * structure. This struct is the piece that sits ALONGSIDE the patron,
 * referencing it by VMUuid rather than being indexed by Stadium cell index
@@ -33,7 +33,7 @@
 * instruction: give real-shaped data its own header and integrate as a
 * field, don't grow existing structs ad hoc).
 *
- * Fields (FABRIC-3.md §H.2, all five confirmed 2026-09-02/03):
+ * Fields (FABRIC-2.md §H.2, all five confirmed 2026-09-02/03):
 *   vm_id    -- the patron this session references.
 *   pinned   -- session is AUTHORITATIVE over Stadium's STADIUM_FLAG_PIN
 *               bit (§H.10): the sole read/write path for pin state is
@@ -44,7 +44,7 @@
 *   name     -- canonical human-readable name; feeds console.c's
 *               g_active_vm_name prefix, does not replace the
 *               console-binding mechanism itself.
- *   identity -- embedded VMIdentity (FABRIC-3.md §H.4's VM card is
+ *   identity -- embedded VMIdentity (FABRIC-2.md §H.4's VM card is
 *               effectively VMIdentity's existing ownership check; reused
 *               directly here, not reinvented).
 *
@@ -143,7 +143,7 @@ Session *session_register(VMUuid vm_id, VMUuid parent, const char *name);

 /*
 * session_set_pinned / session_is_pinned - The pin-authority choke point
- * (FABRIC-3.md §H.2/§H.10, decided 2026-09-02: "full choke point at the
+ * (FABRIC-2.md §H.2/§H.10, decided 2026-09-02: "full choke point at the
 * session level, both directions"). Session is authoritative for every
 * EXTERNAL reader -- nothing else, including existing Stadium code, reads
 * or writes STADIUM_FLAG_PIN on a patron header directly anymore.
@@ -93,7 +93,7 @@ typedef struct time_trust_state {
                                     * read directly by mainline
                                     * (heartbeat_ticks()); genuinely
                                     * concurrent, unlike every other field in
-                                     * this struct (FABRIC.md item 4.5a/4.5b,
+                                     * this struct (FABRIC-0.md item 4.5a/4.5b,
                                     * 2026-08-11). */
    uint64_t     last_tsc;         /* TSC at last heartbeat */
    uint64_t     expected_delta;   /* Expected TSC ticks per heartbeat */
@@ -209,7 +209,7 @@ const TimeTrustState *heartbeat_state(void);

 /**
 * Set the adaptive re-arm period, in nanoseconds (punch-list item 0.8,
- * FABRIC.md §26). Called from the mainline execution path only (Loop #7's
+ * FABRIC-0.md §26). Called from the mainline execution path only (Loop #7's
 * site in vm_runtime.c) -- never from interrupt context. Clamped to
 * [1/4x, 4x] of the kernel's base period internally; a caller need not
 * pre-clamp.
@@ -23,12 +23,12 @@
 /**
 * ttf.h - TrueType font parser core (Freestanding)
 *
- * FABRIC.md item 4.3.7. Reads a TTF's sfnt directory plus head/maxp/loca/
+ * FABRIC-0.md item 4.3.7. Reads a TTF's sfnt directory plus head/maxp/loca/
 * glyf/cmap tables, resolving a Unicode codepoint to a glyph index and its
 * outline header (contour count, bounding box). Does NOT extract outline
 * points or rasterize — that is 4.3.7a/4.3.7c. No floating point; all
 * fields read here are raw integers straight from the font's own
- * big-endian on-disk format (see FABRIC.md §27.7 decision #2 for why the
+ * big-endian on-disk format (see FABRIC-0.md §27.7 decision #2 for why the
 * Q48.16-vs-float call was made, and why it doesn't bind this file, which
 * never scales anything).
 *
@@ -95,7 +95,7 @@ typedef struct {
    int has_cmap;

    /* hhea/hmtx, for ttf_glyph_advance_width() -- proportional spacing
-     * (FABRIC.md item 4.3.7e). Mandatory tables per the TrueType spec,
+     * (FABRIC-0.md item 4.3.7e). Mandatory tables per the TrueType spec,
     * so their absence fails ttf_parse() same as head/maxp/loca/glyf. */
    uint32_t hmtx_off;
    uint16_t num_h_metrics;
@@ -215,7 +215,7 @@ typedef struct {
 /**
 * ttf_rasterize_glyph - Flatten a glyph's outline (quadratic Bezier
 * contours, fixed segment count per curve — see ttf.c's file header
- * comment) and fill it into `out` using the even-odd rule (FABRIC.md item
+ * comment) and fill it into `out` using the even-odd rule (FABRIC-0.md item
 * 4.3.7c; see that item's completion note for why even-odd rather than
 * nonzero winding — correct for the v1 glyph repertoire's non-self-
 * intersecting nested contours, not necessarily for an arbitrary font).
@@ -237,7 +237,7 @@ int ttf_rasterize_glyph(const ttf_font_t *font, uint32_t glyph_index,
                         q48_16_t scale, q48_16_t origin_x, q48_16_t origin_y,
                         uint8_t fill_value, ttf_bitmap_t *out);

-/* Glyph raster cache (FABRIC.md item 4.3.7d). Fixed-size, caller-owned
+/* Glyph raster cache (FABRIC-0.md item 4.3.7d). Fixed-size, caller-owned
 * slot array -- no allocation, same convention as the rest of this
 * module. Every cached bitmap is a fixed TTF_CACHE_BITMAP_DIM square,
 * rasterized with the fixed origin (TTF_CACHE_MARGIN,
@@ -293,10 +293,10 @@ int ttf_raster_cache_get(ttf_raster_cache_t *cache, const ttf_font_t *font,

 /**
 * ttf_load_from_capsule - Resolve a font capsule by name and parse it,
- * zero-copy (FABRIC.md item 4.3.7b). `out` borrows the capsule payload
+ * zero-copy (FABRIC-0.md item 4.3.7b). `out` borrows the capsule payload
 * directly from `arena` — no kmalloc, no decode step, since the capsule
 * is already a raw-byte match of the source `.ttf` (see
- * capsules/fonts/README.md and FABRIC.md §27.7's 2026-08-10 correction:
+ * capsules/fonts/README.md and FABRIC-0.md §27.7's 2026-08-10 correction:
 * capsule storage needs no hex/base64 text-encoding, `tools/mkcapsule.c`
 * already embeds arbitrary files as raw bytes). Validates the capsule's
 * content hash (`capsule_validate(..., verify_hash=1)`) before parsing.
@@ -628,7 +628,7 @@ typedef void (EFIAPI *EFI_RESET_SYSTEM)(
                                                  * seed || 32-byte pubkey.
                                                  * Written exactly once
                                                  * (Phase 8 first-boot mint,
-                                                  * see FABRIC-3.md) --
+                                                  * see FABRIC-2.md) --
                                                  * presence means the fuse
                                                  * is already blown. */

@@ -1,6 +1,6 @@
 /*
 * user_identity_seed.h -- on-disk record format for a minted user
- * identity's own keypair and profile (FABRIC-3.md §F.8/§F.20), stored in
+ * identity's own keypair and profile (FABRIC-2.md §F.8/§F.20), stored in
 * the first devblock of a home-blocks drive's identity_src region
 * (homeblocks_sig_t.identity_src_offset). The devblocks that follow it
 * (identity_src_offset+1 .. identity_src_offset+identity_src_devblocks-1)
@@ -38,7 +38,7 @@ typedef struct {
 * virtio_input_find_keyboard — locate a virtio-keyboard-pci device on the
 *                              PCI bus, initialise the driver, compute and
 *                              enable its PLIC interrupt source (item
- *                              4.3.5c's own derivation, FABRIC.md §27.5.2),
+ *                              4.3.5c's own derivation, FABRIC-0.md §27.5.2),
 *                              and pre-post the eventq's receive buffers.
 *
 * Returns  0 on success.
@@ -22,11 +22,11 @@
 */

 /**
- * stadium.h - The Stadium cell and header (FABRIC.md §3, punch list item 3.1)
+ * stadium.h - The Stadium cell and header (FABRIC-0.md §3, punch list item 3.1)
 *
 * A cell is one of exactly two things: a patron header, or a continuation
 * cell owned by exactly one patron. The union is closed, two-valued, and
- * fixed at build time -- not a type field. See FABRIC.md §3.
+ * fixed at build time -- not a type field. See FABRIC-0.md §3.
 */

 #ifndef STARKERNEL_VM_STADIUM_H
@@ -37,7 +37,7 @@
 #include <stddef.h>
 #include <stdint.h>
 #include "starforth_config.h" /* STADIUM_CONTAINS_DEPTH_MAX, STADIUM_CAPACITY_TICK, STADIUM_MEMORY_PERCENT */
-#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC.md item 3.8 */
+#include "starkernel/vm_uuid.h" /* VMUuid -- FABRIC-0.md item 3.8 */

 #define STADIUM_CELL_BYTES 64

@@ -47,10 +47,10 @@
 #define STADIUM_CONTAINS_NONE ((uint32_t)-1)

 /* `flags` bit 0 -- pinned, exempt from eviction/reap. Moved here from a
- * stadium.c-private #define (FABRIC-3.md §H.12 step 3) so session.c's pin-
+ * stadium.c-private #define (FABRIC-2.md §H.12 step 3) so session.c's pin-
 * authority choke point (session_set_pinned()/session_is_pinned()) can
 * write/read this same bit without a duplicate definition. Session is
- * authoritative for every EXTERNAL reader (FABRIC-3.md §H.10) -- this bit
+ * authoritative for every EXTERNAL reader (FABRIC-2.md §H.10) -- this bit
 * on the raw patron header stays a mirrored copy purely for the Stadium
 * engine's own internal eviction/admission logic (stadium.c), which must
 * stay self-contained and not call back into session.c. */
@@ -58,7 +58,7 @@

 /*
 * StadiumPatronHeader - one member of the closed two-valued cell union
- * (FABRIC.md §3). Nine wires: identity, heat, TTL, pin (a bit in `flags`),
+ * (FABRIC-0.md §3). Nine wires: identity, heat, TTL, pin (a bit in `flags`),
 * link, code field (`behaviour`), mass, payload, contains. `flags` bit 0 is
 * `pin`; the remaining bits are reserved. `behaviour` is the closed code-field
 * enumeration (§18.3) -- not yet defined, item 3.3's scope.
@@ -102,7 +102,7 @@ typedef struct {

 /*
 * StadiumCell - the closed two-valued union itself (§3). Which member is
- * valid for a given array slot is NOT stored in the cell -- FABRIC.md's item
+ * valid for a given array slot is NOT stored in the cell -- FABRIC-0.md's item
 * 3.1 amendment to §3 rules this an external side bitmap, one bit per cell,
 * kept outside the cell array. Declared here as the indexing contract this
 * type expects; item 3.2 (boot-time allocation) allocates the bitmap itself.
@@ -122,7 +122,7 @@ typedef char stadium_cell_size_check[(sizeof(StadiumCell) == STADIUM_CELL_BYTES)
 * implemented. STADIUM_CONTAINS_DEPTH_MAX still has no consumer (item 3.5
 * for the depth cap, not yet implemented). STADIUM_CAPACITY_TICK was wired
 * in 2026-08-15 (capsule_vm_physics.c's vm_physics_heartbeat_tick(), see
- * FABRIC-2.md F.2/§12 Q5) -- this check now proves a real, live constant
+ * FABRIC-1.md F.2/§12 Q5) -- this check now proves a real, live constant
 * is sane, not just a placeholder, same discipline already applied to the
 * byte-count checks above.
 */
@@ -139,7 +139,7 @@ typedef char stadium_capacity_tick_configured_check[(STADIUM_CAPACITY_TICK > 0)
 */

 /*
- * stadium_boot_init - Boot-time allocation (FABRIC.md item 3.2, §17.6 position
+ * stadium_boot_init - Boot-time allocation (FABRIC-0.md item 3.2, §17.6 position
 * (b)). Sizes the global cell array from the memory budget actually observed
 * at boot -- STADIUM_MEMORY_PERCENT of kmalloc_get_stats().free_bytes at the
 * point of the call, rounded down to whole STADIUM_CELL_BYTES cells -- rather
@@ -205,7 +205,7 @@ StadiumCell *stadium_cells(void);
 uint8_t *stadium_header_bitmap(void);

 /*
- * StadiumBehaviour - the closed code-field enumeration (FABRIC.md §13, §18.3).
+ * StadiumBehaviour - the closed code-field enumeration (FABRIC-0.md §13, §18.3).
 * The engine dispatches on this tag and never asks a patron what kind it is
 * -- §3's entire point. Two patrons may share a tag: a VM's tag is COOL, the
 * same tag a word carries (§18.3). Mapped from §17.1's patron table:
@@ -241,7 +241,7 @@ typedef enum {
 void stadium_dispatch(size_t cell_index, StadiumBehaviour behaviour);

 /*
- * stadium_density - Heat / mass for the patron header at cell_index (FABRIC.md
+ * stadium_density - Heat / mass for the patron header at cell_index (FABRIC-0.md
 * §19.2, §19.3). Read, not computed by a scheduler: both operands already
 * live in the header, so this is a division on demand, not maintained
 * bookkeeping. Result stays valid Q48.16, since heat is already Q48.16 and
@@ -276,7 +276,7 @@ uint64_t stadium_density(size_t cell_index);
 #define STADIUM_HERA_CELL_INDEX ((size_t)0)

 /*
- * stadium_birth_hera - Admits Hera as a real resident of cell 0 (FABRIC.md
+ * stadium_birth_hera - Admits Hera as a real resident of cell 0 (FABRIC-0.md
 * item 3.6's invariant, actually enforced -- item 4.1 found that nothing had
 * ever called this until a word patron was about to become the first-ever
 * occupant of cell 0 by accident via the free list). Candidate: identity 0,
@@ -300,7 +300,7 @@ int stadium_birth_hera(void);

 /*
 * stadium_reservoir_pull - Transfers up to `amount` (Q48.16) out of vm_id's
- * reservoir (FABRIC.md §17.7's reservoir mechanism). Clamped to what the
+ * reservoir (FABRIC-0.md §17.7's reservoir mechanism). Clamped to what the
 * reservoir actually holds -- never goes negative, never invents heat.
 * Returns the amount actually pulled, which may be less than requested (or
 * 0, e.g. a drained reservoir or an unknown vm_id). Callers that go on to
@@ -345,7 +345,7 @@ uint64_t stadium_reservoir_peek(VMUuid vm_id);
 * stadium_quota_slot_for_vm - Read-only: vm_id's quota slot index (0 to
 * stadium_max_vm_count()-1), for callers outside stadium.c that need to key
 * their own per-VM state the same way stadium.c's internal arrays already
- * do (FABRIC.md §25.5 item 4.2 -- stadium_words.c's word_id -> cell_index
+ * do (FABRIC-0.md §25.5 item 4.2 -- stadium_words.c's word_id -> cell_index
 * map needs this to stop colliding across VMs; word_id is scoped per-VM,
 * not globally unique, so a single shared map aliases different VMs' words
 * onto each other's Stadium cells and reservoirs).
@@ -357,7 +357,7 @@ int stadium_quota_slot_for_vm(VMUuid vm_id);

 /*
 * stadium_resident_sum - Read-only: sum of heat across every cell currently
- * resident AND owned by vm_id's own quota (FABRIC.md §25.5 item 4.2 --
+ * resident AND owned by vm_id's own quota (FABRIC-0.md §25.5 item 4.2 --
 * boot diagnostics need this filtered per-VM once a second VM holds a
 * quota; summing every resident cell regardless of owner, as the pre-4.2
 * diagnostic did, mixes two VMs' conservation totals together).
@@ -369,7 +369,7 @@ int stadium_quota_slot_for_vm(VMUuid vm_id);
 uint64_t stadium_resident_sum(VMUuid vm_id);

 /*
- * stadium_evict - Reap the patron header at cell_index (FABRIC.md §17.2:
+ * stadium_evict - Reap the patron header at cell_index (FABRIC-0.md §17.2:
 * "reap means leaves the floor, not destroyed"). Dispatches its behaviour
 * (§18.3), clears its item-3.1 discriminator bit, zeroes its header, and
 * (item 3.7) returns the freed cell to the free list of whichever VM's
@@ -377,7 +377,7 @@ uint64_t stadium_resident_sum(VMUuid vm_id);
 * record, not passed by the caller.
 *
 * PANICS (does not return) if cell_index == STADIUM_HERA_CELL_INDEX and the
- * cell is actually resident -- FABRIC.md §20.5 #3: Hera is pinned (§3), but
+ * cell is actually resident -- FABRIC-0.md §20.5 #3: Hera is pinned (§3), but
 * pinning alone is a silent guarantee, and item 3.6 requires a hard
 * assertion at the eviction site rather than relying on pin holding. This
 * check runs BEFORE the pin/contains checks below, deliberately: if pin were
@@ -399,7 +399,7 @@ int stadium_evict(size_t cell_index);

 /*
 * StadiumVMQuota - per-VM ownership of a subset of the global cell array
- * (FABRIC.md §22.3, item 3.7: "each VM holds its own free-list head index
+ * (FABRIC-0.md §22.3, item 3.7: "each VM holds its own free-list head index
 * into the global array"). Linearly searched by vm_id -- a VMUuid (item 3.8)
 * can't be used as a direct array index anyway. Was a small, compile-time-
 * bounded table (linear scan "costs nothing" at the old default of 4);
@@ -415,7 +415,7 @@ int stadium_evict(size_t cell_index);

 /*
 * stadium_admit - Place a candidate patron header into the Stadium, scoped
- * to vm_id's quota (FABRIC.md §19.3, §22.3, item 3.7).
+ * to vm_id's quota (FABRIC-0.md §19.3, §22.3, item 3.7).
 *
 * Pops vm_id's free-list head first (O(1)) if non-empty. Only if that VM's
 * free list is exhausted does this fall back to eviction -- scoped to that
@@ -468,7 +468,7 @@ size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate);

 /*
 * stadium_grant_quota - One-time initial quota grant for a newly born VM
- * (FABRIC.md item 4.1a). NOT item 1.3's recurring capacity-transfer
+ * (FABRIC-0.md item 4.1a). NOT item 1.3's recurring capacity-transfer
 * arbitration -- that mechanism (density-gradient-driven, per capacity-tick)
 * stays unbuilt and its "how much moves" question stays open. This is the
 * narrower, one-time event: the same shape as Hera's own whole-pool grant at
@@ -496,7 +496,7 @@ size_t stadium_admit(VMUuid vm_id, const StadiumPatronHeader *candidate);
 int stadium_grant_quota(VMUuid new_vm_id, VMUuid from_vm_id);

 /*
- * stadium_cell_heat_get - Read a resident cell's own heat (FABRIC.md item
+ * stadium_cell_heat_get - Read a resident cell's own heat (FABRIC-0.md item
 * 4.2's fourth ruling). Requires cell_index to be resident AND owned by
 * vm_id's quota -- returns 0 otherwise (out of range, not resident, or
 * belongs to a different VM), same ambiguity-with-a-genuine-zero already
@@ -513,7 +513,7 @@ uint64_t stadium_cell_heat_get(VMUuid vm_id, size_t cell_index);

 /*
 * stadium_cell_heat_set - Write a resident cell's own heat, reconciling the
- * reservoir delta atomically (FABRIC.md item 4.2's fourth ruling). Same
+ * reservoir delta atomically (FABRIC-0.md item 4.2's fourth ruling). Same
 * ownership requirement as stadium_cell_heat_get(). If new_heat is higher
 * than the cell's current heat, pulls the exact difference from vm_id's own
 * reservoir first -- refuses (returns -1, no mutation) if the reservoir
@@ -22,7 +22,7 @@
 */

 /**
- * stadium_blocks.h - Block patrons on the Stadium (FABRIC-3.md §B/§D,
+ * stadium_blocks.h - Block patrons on the Stadium (FABRIC-2.md §B/§D,
 * MIGRATE punch-list item)
 *
 * The block-specific layer on top of the generic L0 engine (stadium.h), same
@@ -22,7 +22,7 @@
 */

 /**
- * stadium_words.h - Word patrons on the Stadium (FABRIC.md §17.3/§17.7,
+ * stadium_words.h - Word patrons on the Stadium (FABRIC-0.md §17.3/§17.7,
 * punch list item 4.1)
 *
 * The word-specific layer on top of the generic L0 engine (stadium.h).
@@ -57,7 +57,7 @@
 * first; guarded internally as a no-op if already initialized. Nothing
 * calls it twice today.
 *
- * item 4.2 (FABRIC.md §25.5): the map is keyed by quota slot, not just
+ * item 4.2 (FABRIC-0.md §25.5): the map is keyed by quota slot, not just
 * word_id -- word_id is assigned per-VM (vm->next_word_id), not globally
 * unique, so a single shared word_id -> cell_index map aliased different
 * VMs' words onto each other's Stadium cells and reservoirs the moment a
@@ -67,7 +67,7 @@
 void stadium_words_init(void);

 /*
- * stadium_word_dispatch - The per-dispatch entry point (FABRIC.md §17.7),
+ * stadium_word_dispatch - The per-dispatch entry point (FABRIC-0.md §17.7),
 * called once per DictEntry touched at each of vm_core.c's three
 * physics_execution_heat_increment() call sites -- deliberately mirroring
 * that function's existing call pattern 1:1, including the entry != canon
@@ -80,7 +80,7 @@ void stadium_words_init(void);
 * STADIUM_WORD_HEAT_QUANTUM from the reservoir into the cell -- clamped to
 * what the reservoir actually holds AND to a floor of Q48_ONE / 3 that
 * word-execution admission alone may never dip the reservoir below
- * (FABRIC.md §25.7, Captain Bob's ruling 2026-08-06: this pull fires on
+ * (FABRIC-0.md §25.7, Captain Bob's ruling 2026-08-06: this pull fires on
 * EVERY dispatch, not just first admission, and without a floor exhausts a
 * VM's entire reservoir in ~32 dispatches, starving any application-level
 * economy -- e.g. item 4.2's Hermes -- sharing the same VM's reservoir).
@@ -102,7 +102,7 @@ void stadium_words_init(void);
 *
 * @param vm_id           Owning VM -- vm->stadium_vm_id at every call site.
 *                        Scopes the word_id -> cell_index lookup to this
- *                        VM's own quota slot (item 4.2, FABRIC.md §25.5) so
+ *                        VM's own quota slot (item 4.2, FABRIC-0.md §25.5) so
 *                        two VMs' independently-numbered word_ids cannot
 *                        alias onto each other's cells/reservoirs.
 * @param word_id         The dispatching DictEntry's stable word_id.
@@ -123,7 +123,7 @@ void stadium_word_dispatch(VMUuid vm_id, uint32_t word_id, uint64_t heartbeat_ti
 * the map entry. No-op if word_id is not resident, out of range, or vm_id
 * holds no Stadium quota.
 *
- * @param vm_id    Owning VM -- vm->stadium_vm_id (item 4.2, FABRIC.md §25.5:
+ * @param vm_id    Owning VM -- vm->stadium_vm_id (item 4.2, FABRIC-0.md §25.5:
 *                 scopes the lookup to this VM's own word_slots, same
 *                 reason stadium_word_dispatch() takes it).
 * @param word_id  The DictEntry's word_id, about to be recycled.
@@ -136,7 +136,7 @@ void stadium_word_forget(VMUuid vm_id, uint32_t word_id);
 * own word_slots map) -- NOT messages/channels/other application residents,
 * which stadium_resident_sum() (stadium.h, item 4.2) mixes in alongside
 * everything else a VM owns. Exists so a VM's own application-level
- * conservation check (e.g. Hermes's HERMES-K, FABRIC.md §25.7, Captain
+ * conservation check (e.g. Hermes's HERMES-K, FABRIC-0.md §25.7, Captain
 * Bob's ruling 2026-08-06) can add this as an explicit term instead of
 * silently omitting word-execution heat it has no other way to see.
 *
@@ -168,7 +168,7 @@ void stadium_words_stats(VMUuid vm_id, uint64_t *promotions, uint64_t *evictions
 * Σ(resident heat) + reservoir against Q48_ONE as a conservation check --
 * not required by the acceptance text, but the mechanism proves nothing if
 * this silently doesn't hold. The heat sum is scoped to vm_id's own quota
- * (stadium_resident_sum(), item 4.2, FABRIC.md §25.5) so two VMs' checks
+ * (stadium_resident_sum(), item 4.2, FABRIC-0.md §25.5) so two VMs' checks
 * close independently instead of mixing both VMs' resident heat together.
 *
 * @param vm_id  The VM whose reservoir to read (vm_uuid_hera() today).
@@ -21,7 +21,7 @@
 */

 /**
- * vm_identity.h - Per-VM owner identity + ACL capabilities (FABRIC-3.md
+ * vm_identity.h - Per-VM owner identity + ACL capabilities (FABRIC-2.md
 * §F.2/§F.16, decided 2026-08-27/28)
 *
 * Holds only what a VM needs to prove *who owns it* and *what that owner
@@ -38,7 +38,7 @@
 * is not a structurally special VM: her identity just has every bit set.
 * No bit values are assigned yet -- deliberate slack, per this project's
 * "flexibility until we understand the recipe" precedent (see
- * blk_meta_t's own acl_reserved bytes, FABRIC-3.md §F.4) -- real bits get
+ * blk_meta_t's own acl_reserved bytes, FABRIC-2.md §F.4) -- real bits get
 * names only once the operation they gate actually gets built (BINDSTEP,
 * MINT, ...), not speculatively here.
 */
@@ -87,7 +87,7 @@ typedef struct {
 int vm_identity_has_cap(const VMIdentity *id, uint32_t cap);

 /**
- * vm_identity_from_cert - CERTVERIFY (FABRIC-3.md §F.7/§F.17): verify a
+ * vm_identity_from_cert - CERTVERIFY (FABRIC-2.md §F.7/§F.17): verify a
 * DER-encoded, Zuse-signed X.509 cert and populate a VMIdentity from it.
 *
 * Three checks, all must pass: the cert's own signature verifies against
@@ -22,7 +22,7 @@
 */

 /**
- * vm_uuid.h - 128-bit VM identifiers (FABRIC.md punch list item 3.8)
+ * vm_uuid.h - 128-bit VM identifiers (FABRIC-0.md punch list item 3.8)
 *
 * Replaces capsule_birth.c's monotonic uint32_t vm_id with a wider,
 * RFC-4122-shaped identifier. NOT real randomness: this kernel has no RNG
@@ -61,20 +61,20 @@
 void vt100_init(void);

 /**
- * FABRIC.md item 4.4j: switch the glyph-draw backend from font_8x16.c to
+ * FABRIC-0.md item 4.4j: switch the glyph-draw backend from font_8x16.c to
 * TTF-TEXT's rasterizer for everything drawn from this call onward --
 * boot/POST output before this call stays font_8x16.c, unaffected.
 * Lazily loads the font capsule and its raster cache on first call
 * (no-op on later calls). Recomputes cols/rows for the new cell size and
 * clears the screen, since the two glyph backends use different cell
- * dimensions. TTF point size/cell dimensions decided final by FABRIC.md
+ * dimensions. TTF point size/cell dimensions decided final by FABRIC-0.md
 * item 4.4m (20px text, 96px REPL strip). No-op if the font capsule
 * fails to load (stays on font_8x16.c; logged, not fatal).
 */
 void vt100_enable_ttf(void);

 /**
- * FABRIC.md item 4.4q: move the REPL scrollback view back/forward by
+ * FABRIC-0.md item 4.4q: move the REPL scrollback view back/forward by
 * @p n lines and redraw. Offset 0 (the default, and where every call
 * eventually returns to) is the live view -- the same content already on
 * screen. Clamped at both ends: back cannot pass the oldest stored line,
@@ -101,7 +101,7 @@ void vt100_putc(char c);
 void vt100_puts(const char *s);

 /**
- * FABRIC.md item 4.4y-revised: toggle the full-screen vt100 terminal
+ * FABRIC-0.md item 4.4y-revised: toggle the full-screen vt100 terminal
 * between visible (normal operation) and hidden (graphics mode -- the
 * terminal stops drawing, letting direct framebuffer/TTF-TEXT calls show
 * through undisturbed). Toggling back to visible does a full redraw of
@@ -1,7 +1,7 @@
 /*
 * x509_ed25519.h -- minimal, targeted DER walkers for Ed25519-signed X.509
 * certificates (RFC 8410). Deliberately NOT a general ASN.1/X.509 parser
- * (Milestone 6 decision, FABRIC-2.md): each function walks exactly as far
+ * (Milestone 6 decision, FABRIC-1.md): each function walks exactly as far
 * into the DER structure as its own job needs, nothing more.
 *
 * x509_extract_ed25519_pubkey() only ever reads SubjectPublicKeyInfo --
@@ -11,7 +11,7 @@
 * never re-verified against the offline root CA at boot.
 *
 * x509_verify_signature()/x509_extract_serial() (added 2026-08-28,
- * FABRIC-3.md §F.7/§F.17) are for CERTVERIFY -- a regular user's cert,
+ * FABRIC-2.md §F.7/§F.17) are for CERTVERIFY -- a regular user's cert,
 * which unlike the capsule-PKI chain is signed by Zuse's own on-device
 * key and genuinely needs its signature checked at attach time, not just
 * trusted by embedding. Two separate trust roots, two separate reasons
@@ -62,7 +62,7 @@ int x509_extract_serial(const uint8_t *der, size_t der_len,
                         size_t *serial_len_out);

 /*
- * x509_build_user_cert (added 2026-08-28, FABRIC-3.md §F.8/§F.19, MINT):
+ * x509_build_user_cert (added 2026-08-28, FABRIC-2.md §F.8/§F.19, MINT):
 * the encode-side counterpart to x509_verify_signature()/x509_extract_*
 * above. Builds a minimal DER-encoded X.509 certificate exercising
 * exactly the fields those functions read -- serialNumber, an Ed25519
@@ -233,7 +233,7 @@ typedef struct {
    uint32_t            bot_read10_block_size;
    /* WRITE(10) mirror of bot_read10_* above -- kept as separate fields
     * rather than renaming/reusing the read ones, so the already-tested
-     * READ10 path is never touched by this addition (FABRIC-3.md §F.1). */
+     * READ10 path is never touched by this addition (FABRIC-2.md §F.1). */
    uint32_t            bot_write10_lba;
    uint16_t            bot_write10_num_blocks;
    uint32_t            bot_write10_block_size;
@@ -1,5 +1,5 @@
 /*
- * zuse_cert_devblock.h -- SUPERSEDED 2026-08-28 (FABRIC-3.md §F.20/§F.21).
+ * zuse_cert_devblock.h -- SUPERSEDED 2026-08-28 (FABRIC-2.md §F.20/§F.21).
 * Zuse is now thumbdrive-resident, not system-resident: her seed lives
 * only on her own minted thumbdrive, never written to the fence. The
 * fence's devblock_from_top=0 slot this type used to occupy now holds
@@ -14,7 +14,7 @@
 *
 * on-disk record format for Zuse's cert, stored
 * in devblock_from_top=0 of the top-of-device system-metadata fence
- * (block_subsystem.h's blk_meta_zone_read()/write(), Phase 8, FABRIC-3.md
+ * (block_subsystem.h's blk_meta_zone_read()/write(), Phase 8, FABRIC-2.md
 * §C). Raw, unpacked 4 KiB devblock -- same convention as the volume
 * header itself (magic + version + fields + pad-to-4096, real CRC from
 * day one, matching homeblocks_sig_t's own precedent for exactly this
@@ -22,7 +22,7 @@
 *
 * Deliberately its own header, not inlined at the one call site that
 * uses it today (kernel_main.c's first-boot mint-or-load): the ongoing
- * `MINT` word (still open, FABRIC-3.md) will be a second consumer of
+ * `MINT` word (still open, FABRIC-2.md) will be a second consumer of
 * this exact format later, and the format should be stable and
 * documented once rather than ad-hoc.
 */
@@ -33,7 +33,7 @@

 /* Packed via shifts, not a hand-computed hex literal -- this project's
 * own standing lesson about hand-derived numeric constants in this
- * class of code (see FABRIC-3.md's Ed25519/scalar25519 writeups). */
+ * class of code (see FABRIC-2.md's Ed25519/scalar25519 writeups). */
 #define ZUSE_CERT_DEVBLOCK_MAGIC \
    ((uint32_t)'Z' | ((uint32_t)'U' << 8) | ((uint32_t)'S' << 16) | ((uint32_t)'E' << 24))

@@ -9,7 +9,7 @@

 /**
 * zuse_eligibility.h - Read/add/membership-check over the on-disk
- * elevation eligibility list (FABRIC-3.md §H.5/§H.12 Phase 6,
+ * elevation eligibility list (FABRIC-2.md §H.5/§H.12 Phase 6,
 * zuse_eligibility_list.h's zuse_eligibility_devblock_t chain). Zuse
 * checks zuse_eligibility_is_member() before honoring any
 * ELEVATE-REQUEST (§H.7/§H.8) -- a gating layer on top of the
@@ -1,6 +1,6 @@
 /*
 * zuse_eligibility_list.h -- on-disk record format for Zuse's word/block
- * elevation eligibility list (FABRIC-3.md §H.5/§H.12 Phase 6): a simple
+ * elevation eligibility list (FABRIC-2.md §H.5/§H.12 Phase 6): a simple
 * growable list of owner_pubkey[32] entries, no extra per-entry metadata
 * ("simple list, no extra metadata, unless we find a reason this won't
 * work"). Zuse checks this list before honoring any ELEVATE-REQUEST
@@ -1,6 +1,6 @@
 /*
 * zuse_genesis_marker.h -- on-disk record format for the system-resident
- * "a root Zuse identity already exists" marker (FABRIC-3.md §F.21),
+ * "a root Zuse identity already exists" marker (FABRIC-2.md §F.21),
 * stored in devblock_from_top=0 of the top-of-device system-metadata
 * fence (block_subsystem.h's blk_meta_zone_read()/write(), same location
 * zuse_cert_devblock_t used to occupy).
@@ -359,7 +359,7 @@ typedef enum

 #ifdef __STARKERNEL__
 #include "starkernel/vm_uuid.h" /* VMUuid -- item 4.2, VM.stadium_vm_id */
-#include "starkernel/vm_identity.h" /* VMIdentity -- FABRIC-3.md §F.2/§F.16 */
+#include "starkernel/vm_identity.h" /* VMIdentity -- FABRIC-2.md §F.2/§F.16 */

 /* Saved interpreter state for VM lifecycle calls (BIRTH, VM-EXEC, START).
 * Dynamically allocated; grows on demand via sf_realloc. */
@@ -401,7 +401,7 @@ typedef struct VM
                                 *   here so callers don't need to re-derive it. No FORTH word can
                                 *   write it -- deliberately kept out of the dictionary so ACL-PIN's
                                 *   redefinition-only guarantee can't be bypassed via >BODY on a
-                                 *   CONSTANT (see FABRIC-3.md). Read-only FORTH access via
+                                 *   CONSTANT (see FABRIC-2.md). Read-only FORTH access via
                                 *   ZUSE-PUBKEY@. */
    /** @} */

@@ -545,7 +545,7 @@ typedef struct VM
    int          call_stack_max; /**< High-water mark depth (DoE metric) */
    /** @} */

-    /** @name Stadium Identity (item 4.2, FABRIC.md §25.5)
+    /** @name Stadium Identity (item 4.2, FABRIC-0.md §25.5)
     * @{
     */
    VMUuid stadium_vm_id; /**< This VM's own identity, set once at birth from
@@ -556,7 +556,7 @@ typedef struct VM
                            *   vm_uuid_hera(). */
    /** @} */

-    /** @name Owner identity + ACL capabilities (FABRIC-3.md §F.2/§F.16)
+    /** @name Owner identity + ACL capabilities (FABRIC-2.md §F.2/§F.16)
     * @{
     */
    VMIdentity identity; /**< This VM's owning identity. installed=0 (the
@@ -38,7 +38,7 @@ proof/
 │   StarForth_Mutex.thy,
 │   StarForth_Transition.thy        # cross-cutting VM/concurrency properties
 │                                    #   (predate this sweep, part of the earlier
-│                                    #   FABRIC-2.md item 5.2 toolchain work)
+│                                    #   FABRIC-1.md item 5.2 toolchain work)
 ├── StarForth_Loop{1..7}_*.thy       # the 7 physics feedback loops
 ├── StarForth_Q48_16.thy            # Q48.16 fixed-point math library
 ├── ACL_*.thy (5 files)             # word-level ACL policy properties
@@ -85,7 +85,7 @@ library itself is separately covered by `StarForth_Q48_16.thy`).
 | `log_words.c` | `StarForth_Log_Words.thy` | 100% |
 | `q48_words.c` | `StarForth_Q48_Words.thy` | 17/23 |
 | `inference_words.c` | `StarForth_Inference_Words.thy` | 5 accessors full; rest guard/shape |
-| plus: `arithmetic_words.c`, `stack_words.c`, `return_stack_words.c`, `logical_words.c`, `memory_words.c`, `mixed_arithmetic_words.c` | corresponding `StarForth_*_Words.thy` | pre-date this sweep, part of the original 23-theory FABRIC-2.md §5.2 base |
+| plus: `arithmetic_words.c`, `stack_words.c`, `return_stack_words.c`, `logical_words.c`, `memory_words.c`, `mixed_arithmetic_words.c` | corresponding `StarForth_*_Words.thy` | pre-date this sweep, part of the original 23-theory FABRIC-1.md §5.2 base |

 ## What's structurally NOT provable without a bigger modelling project

@@ -74,7 +74,7 @@
 /* Single-block relocation (Milestone 2h+). One reserved 4 KiB devblock:
 * a 4-byte count prefix plus up to BLK_RELOC_MAX_ENTRIES 8-byte
 * {home_lbn, actual_lbn} pairs (500*8+4 = 4004 <= 4096). Relocations are
- * expected rare, not routine -- see FABRIC-2.md's own design writeup --
+ * expected rare, not routine -- see FABRIC-1.md's own design writeup --
 * so a linear-scanned fixed array is deliberate, matching this file's
 * existing tolerance for small bounded scans (DISK_CACHE_SLOTS above,
 * BLK_VM_SLOTS in block_words.c are the same shape). */
@@ -193,7 +193,7 @@ static struct {

 /* Redirect lbn through the relocation table if it's been moved elsewhere.
 * The single choke point every public LBN-consuming entry point below
- * calls first -- see FABRIC-2.md's design writeup for why this is an
+ * calls first -- see FABRIC-1.md's design writeup for why this is an
 * LBN->LBN redirect rather than a new storage-allocation mechanism, and
 * why it's safe for every downstream function (BAM offset math, cache
 * lookup, lbn_to_slot() itself) to stay completely unaware a substitution
@@ -706,7 +706,7 @@ int blk_subsys_attach_device(struct blkio_dev *dev) {
     * device becomes the owner. A later-attached second disk-backed
     * device (e.g. a USB drive attaching after Artemis's own disk) must
     * NOT overwrite the already-loaded table with its own (likely empty)
-     * one. See FABRIC-2.md's design writeup for why "first attached wins"
+     * one. See FABRIC-1.md's design writeup for why "first attached wins"
     * is a pragmatic default, not a general multi-primary-device answer. */
    if (slot->dev && first_disk_slot() == slot) {
        (void) reloc_load_from_disk(slot);
@@ -771,7 +771,7 @@ int blk_subsys_detach_device(struct blkio_dev *dev) {
    return BLK_OK;
 }

-/* Milestone 2h+ single-block relocation -- see FABRIC-2.md's design
+/* Milestone 2h+ single-block relocation -- see FABRIC-1.md's design
 * writeup for the full reasoning. Mechanical primitive only: this
 * function does not decide *whether* a relocation should happen (ACL's
 * job) or validate that target_lbn is genuinely owned by whoever is
@@ -1136,7 +1136,7 @@ int blk_set_volume_meta(const blk_volume_meta_t *meta) {
    return BLK_OK;
 }

-/* FABRIC-3.md §I.2, 2026-09-04: same dev-pointer slot lookup
+/* FABRIC-2.md §I.2, 2026-09-04: same dev-pointer slot lookup
 * blk_subsys_detach_device() already does internally, exposed publicly
 * for the first time so a caller can scope a scan/query to one specific
 * attached device. */
@@ -1276,7 +1276,7 @@ int blk_set_meta(uint32_t block_num, const blk_meta_t *meta) {
    return BLK_OK;
 }

-/* BMAPFMT field accessors -- FABRIC-3.md §H.12 step 14. Thin
+/* BMAPFMT field accessors -- FABRIC-2.md §H.12 step 14. Thin
 * read-modify-write wrappers over blk_get_meta()/blk_set_meta() above,
 * which already own caching/dirty-tracking -- these add no state of
 * their own. */
@@ -1355,7 +1355,7 @@ int blk_flags_set(uint32_t block_num, uint64_t flags) {
    return blk_set_meta(block_num, &meta);
 }

-/* FABRIC-3.md §F.11/§I.2, built 2026-09-04. is_lbn_zero() -- BLK_FLAG_
+/* FABRIC-2.md §F.11/§I.2, built 2026-09-04. is_lbn_zero() -- BLK_FLAG_
 * CLAIMED clear AND owner_fp all-zero is "unowned"; either alone would
 * misclassify a claimed-but-not-yet-fp-stamped or fp-stamped-but-
 * evicted devblock, neither of which should exist given owner_fp is
@@ -1459,7 +1459,7 @@ int blk_meta_relocate_devblock(uint32_t home_devblock, uint32_t target_devblock)
    return blk_set_meta(home_devblock, &home_meta);
 }

-/* FABRIC-3.md §I.2, 2026-09-04: heat/wear-leveling migration trigger.
+/* FABRIC-2.md §I.2, 2026-09-04: heat/wear-leveling migration trigger.
 * Uses blk_meta_t.write_count -- already present, already documented
 * for exactly this purpose ("Number of writes (wear leveling)"), no new
 * cross-subsystem query needed (Stadium's own compudynamics block heat,
@@ -16,7 +16,7 @@
 *
 * Base addresses and the PPI INTID are QEMU-virt-machine constants, not
 * device-tree-discovered, and that is a deliberate, recorded exception
- * rather than an oversight (FABRIC.md item 0.6, GAP-B1 follow-up):
+ * rather than an oversight (FABRIC-0.md item 0.6, GAP-B1 follow-up):
 * `fdt_valid(boot_info->dtb)` fails on this system's aarch64 firmware
 * (qemu-efi-aarch64 2025.11-3ubuntu7 does not forward a devicetree to the
 * guest), confirmed live rather than assumed. The values below were not
@@ -168,7 +168,7 @@ int apic_init(BootInfo *boot_info)
 * 3. @c GICD_ITARGETSR (byte-indexed like IPRIORITYR) -- routes to CPU 0
 *    only; this target has no @c -smp, so no other bit is ever valid.
 * 4. @c GICD_ICFGR is read back, not written, unless the readback disagrees
- *    with the expected level-triggered configuration -- FABRIC.md §27.5.1's
+ *    with the expected level-triggered configuration -- FABRIC-0.md §27.5.1's
 *    decoded QEMU `interrupt-map` says PCI legacy INTx on this board already
 *    is level-triggered by default, so this keeps item 0.6's "don't touch
 *    ICFGR unless forced to" posture rather than writing it unconditionally.
@@ -33,7 +33,7 @@ static int s_current_el = -1;
 *
 * EDK2 on QEMU's aarch64 @c virt machine has been observed to leave the
 * kernel at either EL1 or EL2 depending on firmware build; nothing in this
- * tree may assume one over the other (FABRIC.md §25.7.1 GAP-B3). Every
+ * tree may assume one over the other (FABRIC-0.md §25.7.1 GAP-B3). Every
 * EL-dependent choice — @c VBAR_EL1 vs @c VBAR_EL2, the @c ELR_ELx /
 * @c SPSR_ELx saved-state pair, and @c CNTP_*_EL0 vs @c CNTHP_*_EL2 — must
 * read this accessor rather than hardcode a level.
@@ -129,7 +129,7 @@ void arch_cold_reset(void)
     * arguments and has no SMC64 variant defined by the PSCI spec -- only
     * the SMC32 encoding is valid (fixed 2026-08-18, was 0xC4000009).
     *
-     * FABRIC-2.md Section I, 2026-08-18: live gdb tracing (using the real
+     * FABRIC-1.md Section I, 2026-08-18: live gdb tracing (using the real
     * UEFI-relocated runtime address, not the standalone kernel.elf's
     * link-time address -- see that section for why those differ) proved
     * the SMC call itself traps: PC does not fall through to the wfi loop
@@ -20,7 +20,7 @@

 /* ─── ARM generic-timer helpers ─────────────────────────────────────── */

-/* FABRIC-3.md §I.5, 2026-09-04: real hypervisor-vs-hardware detection.
+/* FABRIC-2.md §I.5, 2026-09-04: real hypervisor-vs-hardware detection.
 * s_cal.vm_mode was hardcoded to 1 unconditionally below (comment:
 * "QEMU SBSA always uses virtualised Generic Timer") -- true for the
 * *timing policy* this file cares about, but wrong to reuse as a
@@ -260,7 +260,7 @@ const timer_calibration_record_t *timer_calibration_record(void)
 /**
 * @brief Read the raw counter the aarch64 heartbeat is paced against.
 *
- * Item 0.8 (FABRIC.md §25.1): the shared heartbeat.c now owns
+ * Item 0.8 (FABRIC-0.md §25.1): the shared heartbeat.c now owns
 * heartbeat_init()/heartbeat_tick()/heartbeat_service()/heartbeat_ticks()/
 * heartbeat_trust()/heartbeat_state() and the per-arch @c g_heartbeat
 * state that used to live in this file. This is the one piece that stays
@@ -24,7 +24,7 @@
 /**
 * i8042.c - PS/2 keyboard controller driver (amd64)
 *
- * Item 4.3.5 (FABRIC.md §27.5).
+ * Item 4.3.5 (FABRIC-0.md §27.5).
 */

 #ifndef __STARKERNEL__
@@ -24,7 +24,7 @@
 /**
 * ioapic.c - I/O APIC driver (amd64)
 *
- * Item 4.3.5 (FABRIC.md §27.5). MADT parsing mirrors pci.c's RSDP -> XSDT ->
+ * Item 4.3.5 (FABRIC-0.md §27.5). MADT parsing mirrors pci.c's RSDP -> XSDT ->
 * table-by-signature walk (the two files don't share a header for this —
 * same duplication pci.c already has relative to a hypothetical shared
 * acpi.c, not introduced fresh here).
@@ -134,7 +134,7 @@ static uint64_t vm_ns_base  = 0;
 * @p b are both large (e.g., nanosecond conversion of multi-GHz tick counts).
 * No libgcc dependency — pure inline assembly.
 *
- * FABRIC.md item 4.5d, 2026-08-11: this asm previously declared @c RDX as a
+ * FABRIC-0.md item 4.5d, 2026-08-11: this asm previously declared @c RDX as a
 * plain output (@c "=d"(hi)), which tells GCC only "I want to read RDX's
 * value after this block" — nothing told it that @c mulq writes RDX *before*
 * @c divq needs to read a *different* value (the divisor @c c) out of it.
@@ -604,7 +604,7 @@ static uint64_t calibrate_tsc_with_pmtimer(void)
            uint64_t elapsed_ns = muldiv64(elapsed_ticks, 1000000000ull, PMTIMER_FREQ_HZ);
            if (elapsed_ns == 0) return 0;

-            /* FABRIC.md item 4.5d, 2026-08-11: this file's own comments already
+            /* FABRIC-0.md item 4.5d, 2026-08-11: this file's own comments already
             * flag TSC non-monotonicity as a real risk under TCG ("invariant
             * TSC not present under hypervisor... no determinism guarantees").
             * If end_tsc < start_tsc, this subtraction wraps to a huge unsigned
@@ -1378,7 +1378,7 @@ const timer_calibration_record_t *timer_calibration_record(void)
 /**
 * @brief Read the raw counter the amd64 heartbeat is paced against.
 *
- * Item 0.8 (FABRIC.md §25.1): the shared heartbeat.c owns
+ * Item 0.8 (FABRIC-0.md §25.1): the shared heartbeat.c owns
 * heartbeat_init()/heartbeat_tick()/heartbeat_service()/heartbeat_ticks()/
 * heartbeat_trust()/heartbeat_state() and the variance/trust math that used
 * to live in this file. This is the one piece that stays per-architecture
@@ -69,7 +69,7 @@ void arch_early_init(void)
     * activated here, per its own load_cr3() no-op outside __x86_64__) and
     * has no present use for virtual memory on this ISA, so there is no
     * reason to inherit firmware's Sv57 mapping -- which is confirmed to
-     * have at least one hole (PLIC_THRESHOLD, FABRIC.md item 4.3.5a).
+     * have at least one hole (PLIC_THRESHOLD, FABRIC-0.md item 4.3.5a).
     * ExitBootServices() has already completed several checkpoints before
     * this function runs (ConOut/GOP done, BootServices exited per the
     * "[CKPT 008]" trace), so nothing downstream depends on firmware's
@@ -16,7 +16,7 @@
 * mixing the two counters would compare unrelated clocks; and `cycle` has no
 * discoverable frequency, so every heartbeat variance and TIME-TRUST figure
 * riscv64 produced before this was measured against a wrong expected interval
- * (FABRIC.md §16.2). Figures from before and after are not comparable.
+ * (FABRIC-0.md §16.2). Figures from before and after are not comparable.
 */

 #include "timer.h"
@@ -27,7 +27,7 @@
 #include <stdint.h>
 #include <string.h>

-/* FABRIC-3.md §I.5, 2026-09-04: real hypervisor-vs-hardware detection.
+/* FABRIC-2.md §I.5, 2026-09-04: real hypervisor-vs-hardware detection.
 * s_cal.vm_mode was hardcoded to 1 unconditionally below -- see
 * aarch64/timer.c's own running_under_hypervisor() doc comment for why
 * that's wrong to reuse as a general "are we in QEMU" signal elsewhere
@@ -265,7 +265,7 @@ const timer_calibration_record_t *timer_calibration_record(void)
 /**
 * @brief Read the raw counter the riscv64 heartbeat is paced against.
 *
- * Item 0.8 (FABRIC.md §25.1): the shared heartbeat.c now owns
+ * Item 0.8 (FABRIC-0.md §25.1): the shared heartbeat.c now owns
 * heartbeat_init()/heartbeat_tick()/heartbeat_service()/heartbeat_ticks()/
 * heartbeat_trust()/heartbeat_state(). This is the one piece that stays
 * per-architecture -- the same @c rdtime() the timer deadline is armed
@@ -34,8 +34,8 @@
 #include "starkernel/kmalloc.h"
 #include "starkernel/console.h"
 #include "starkernel/vm/stadium.h" /* item 4.1a -- stadium_grant_quota() */
-#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-3.md §H.12 step 5 */
-#include "starkernel/timer.h" /* timer_calibration_record()->vm_mode -- FABRIC-3.md §I.5 CONTRIB trust tier */
+#include "starkernel/session.h" /* session_register()/session_set_pinned() -- FABRIC-2.md §H.12 step 5 */
+#include "starkernel/timer.h" /* timer_calibration_record()->vm_mode -- FABRIC-2.md §I.5 CONTRIB trust tier */
 #include "vm.h"
 #include "platform_alloc.h"
 /* No LOG_LINE_MAX include-order constraint anymore: vm.h's own
@@ -105,7 +105,7 @@ static VMRegistryEntry *vm_find_entry_ptr(VMUuid vm_id) {
    return (void *)0;
 }

-/* FABRIC-3.md §H.12 step 10: creator-ceiling enforcement, birth-time
+/* FABRIC-2.md §H.12 step 10: creator-ceiling enforcement, birth-time
 * snapshot only, no live sync (§H.3, decided 2026-09-03 -- "if something
 * was developed with a particular set of ACLs, it should remain at
 * that... otherwise parent changes break the child's program"). For
@@ -244,7 +244,7 @@ int capsule_vm_registry_get_by_index(uint32_t index, VMRegistryEntry *out) {
 /* Live population, distinct from vm_registry_count above: vm_registry_count
 * is monotonic (incremented on every vm_registry_alloc(), never decremented
 * on death), so it counts every VM ever born, not the outer Stadium's
- * current occupancy. FABRIC.md item 1.5's bound is on LIVE VMs -- a dead or
+ * current occupancy. FABRIC-0.md item 1.5's bound is on LIVE VMs -- a dead or
 * stillborn slot doesn't hold Stadium capacity, and gating on the monotonic
 * total would mean the fleet could never regrow after any VM's death,
 * which contradicts Hera's own kill-then-rebirth lifecycle (TRIPOD-TEST's
@@ -394,7 +394,7 @@ int capsule_vm_kill(const char *name) {
    vm_id = entry->vm_id;
    vm    = (VM *)entry->vm_ptr;

-    /* FABRIC-3.md SS B, VM-COOL: reap this VM's own Stadium patron cell for
+    /* FABRIC-2.md SS B, VM-COOL: reap this VM's own Stadium patron cell for
     * real, dispatching COOL. Refusal (already naturally reclaimed by
     * unrelated quota pressure, or never admitted) is silently tolerated --
     * KILL tears the VM down unconditionally either way. */
@@ -451,7 +451,7 @@ void capsule_vm_kill_all_nonmama(void) {
    }
 }

-/* FABRIC-3.md §I.5, 2026-09-04: contributor-capsule trust tier
+/* FABRIC-2.md §I.5, 2026-09-04: contributor-capsule trust tier
 * (QEMU-vs-real-hardware conditional enforcement, decided in
 * conversation). CAPSULE_FLAG_CONTRIB capsules get the same WARN-only
 * treatment as everything else under QEMU (timer_calibration_record()->
@@ -574,7 +574,7 @@ CapsuleRunResult capsule_birth_baby(
    /* Milestone 6 (Phase 8): enforced only on INVALID -- see the fuller
     * comment in capsule_birth_mama() above for why MISSING/NO_ROOT_KEY
     * stay WARN-only. Skipped entirely when skip_pki_sig is set (RUNCAP,
-     * FABRIC-3.md §F.6/F.18): capsule_get_signatures() is the compile-
+     * FABRIC-2.md §F.6/F.18): capsule_get_signatures() is the compile-
     * time-baked array, indexed against the build-time capsule_descriptors[]
     * -- meaningless for a heap-built directory sourced from a thumbdrive,
     * where idx 0 would just compare against whatever real capsule happens
@@ -589,7 +589,7 @@ CapsuleRunResult capsule_birth_baby(
                        names[idx].name, capsule_sig_result_str(sr));
            if (sr == CAPSULE_SIG_INVALID) return CAPSULE_RUN_ERR_INVALID;
        }
-        /* FABRIC-3.md §I.5: contrib trust tier -- see contrib_capsule_
+        /* FABRIC-2.md §I.5: contrib trust tier -- see contrib_capsule_
         * refused()'s own doc comment. */
        if (contrib_capsule_refused(cap->flags, sr)) {
            log_message(LOG_WARN, "capsule sig: %s: contrib capsule refused on real hardware (%s)",
@@ -627,7 +627,7 @@ CapsuleRunResult capsule_birth_baby(
     * own reservoir, not vm_uuid_hera()'s (item 4.1's hardcoded default). */
    ((VM *)new_vm)->stadium_vm_id = vm_id;

-    /* item 4.6 fix (FABRIC-2.md, 2026-08-18): granted here, before IDENTITY
+    /* item 4.6 fix (FABRIC-1.md, 2026-08-18): granted here, before IDENTITY
     * exec, not after a confirmed live birth as item 4.1a originally placed
     * it. item 4.1a's placement assumed no VM's own IDENTITY code would ever
     * need a Stadium quota before birth completes -- true until item 4.6's
@@ -641,7 +641,7 @@ CapsuleRunResult capsule_birth_baby(
     * stillbirth here is the rare case, not the common one. */
    (void)stadium_grant_quota(vm_id, vm_uuid_hera());

-    /* FABRIC-3.md SS B, VM-COOL: admit this VM as a patron of its own
+    /* FABRIC-2.md SS B, VM-COOL: admit this VM as a patron of its own
     * quota -- identity 0 (same convention stadium_birth_hera() uses for
     * "patron zero"), heat 0 (no reservoir cost). Admitted unpinned here
     * regardless of which VM this is -- pinning (when it applies) happens
@@ -650,7 +650,7 @@ CapsuleRunResult capsule_birth_baby(
     * Hera (stadium_admit() has no admission-time-special pin handling,
     * just copies the candidate header, so this ordering is safe).
     *
-     * FABRIC-3.md §H.12 step 5: fleet-foundation VMs (Hera/Hermes/Artemis)
+     * FABRIC-2.md §H.12 step 5: fleet-foundation VMs (Hera/Hermes/Artemis)
     * are pinned -- permanent, exempt from COOL, per §H.1's decision.
     * Ordinary/user VMs stay unpinned, matching the original comment's own
     * reasoning here (unrelated quota pressure can naturally evict this
@@ -786,7 +786,7 @@ CapsuleRunResult capsule_run_experiment(
                        names[idx].name, capsule_sig_result_str(sr));
            if (sr == CAPSULE_SIG_INVALID) return CAPSULE_RUN_ERR_INVALID;
        }
-        /* FABRIC-3.md §I.5: contrib trust tier -- see contrib_capsule_
+        /* FABRIC-2.md §I.5: contrib trust tier -- see contrib_capsule_
         * refused()'s own doc comment. */
        if (contrib_capsule_refused(cap->flags, sr)) {
            log_message(LOG_WARN, "capsule sig: %s: contrib capsule refused on real hardware (%s)",
@@ -30,7 +30,7 @@
 #define MINT_IDENTITY_SRC_DEVBLOCKS 2u /* 1 seed record + 1 personality source */
 #define MINT_METADATA_DEVBLOCKS   5u  /* devblocks 0..4 reserved */

-/* Real, working, minimal default personality -- FABRIC-3.md §F.6/§F.8's
+/* Real, working, minimal default personality -- FABRIC-2.md §F.6/§F.8's
 * "default personality content" question stays open (mint-time-fixed vs.
 * user-editable), but the identity this mints must actually do something
 * when RUNCAP births it, not just exist. Needs the "Block NNNN" header
@@ -43,7 +43,7 @@
 * A minted identity's RUNCAP-born VM is not exempt from that pump, so
 * omitting this left it spamming "UNKNOWN WORD: 'MSG-TICK'" every idle
 * tick forever from the moment WIREBIND made the VM live -- found live
- * minting a real second identity (FABRIC-3.md §F.26 follow-up). */
+ * minting a real second identity (FABRIC-2.md §F.26 follow-up). */
 static const char MINT_DEFAULT_PERSONALITY[] =
    "Block 4999\n"
    "S\" common:messaging.4th\" EXEC\n"
@@ -106,7 +106,7 @@ CapsuleRunResult capsule_runcap_birth(
     * -ARTEMIS) does this as a separate step after a successful birth,
     * via capsule_vm_registry_set_name(). Found live: skipping this left
     * a freshly RUNCAP-born VM's registry name empty, which the idle-loop
-     * pump (FABRIC-3.md Phase C) then read as a zero-length name and
+     * pump (FABRIC-2.md Phase C) then read as a zero-length name and
     * refused ("VM name too long or empty") every tick. */
    if (r == CAPSULE_RUN_OK && out_vm_id) {
        capsule_vm_registry_set_name(*out_vm_id, vm_name);
@@ -83,9 +83,9 @@ static vm_physics_node_t *vm_physics_head = (void *)0;
 * wasn't clamped (rate = amount / elapsed_ticks), rather than curve-fitting
 * a reconstructed trajectory against a synthetic time axis.
 *
- * Restated on the virtual tick (FABRIC.md item 2.1, 2026-08-04): this used
+ * Restated on the virtual tick (FABRIC-0.md item 2.1, 2026-08-04): this used
 * to be elapsed_us, wall-clock microseconds -- non-reproducible under TCG
- * per GAP-A1 (FABRIC.md §25.7.1). Now counts fleet_heartbeat_tick_count
+ * per GAP-A1 (FABRIC-0.md §25.7.1). Now counts fleet_heartbeat_tick_count
 * ticks, which is execution-paced (incremented once per vm_tick() call,
 * confirmed at vm_runtime.c:143). */
 typedef struct {
@@ -135,7 +135,7 @@ static VMFleetWindow fleet_window = { { { 0, 0, 0 } }, 0, 0, 0 };
 * via doe_log.c's per-VM heat CSV columns showing a dead-flat trajectory
 * across a full boot (VM-FLEET-ATTRACTOR-DESIGN-20260705.md rev f).
 *
- * UNVALIDATED after the ns-to-tick restatement (FABRIC.md item 2.1,
+ * UNVALIDATED after the ns-to-tick restatement (FABRIC-0.md item 2.1,
 * 2026-08-04): this value was calibrated against elapsed wall-clock
 * microseconds. Elapsed fleet-heartbeat *ticks* between touches is a
 * different quantity at a different scale, and the seed has not been
@@ -289,10 +289,10 @@ void vm_physics_touch(VMUuid vm_id)

    if (!target || !target->physics.is_live) return;

-    /* Restated on the virtual tick (FABRIC.md item 2.1, 2026-08-04): this
+    /* Restated on the virtual tick (FABRIC-0.md item 2.1, 2026-08-04): this
     * used to gate on target->physics.last_active_ns > 0 and scale by
     * elapsed wall-clock microseconds -- non-reproducible run to run under
-     * TCG (GAP-A1, FABRIC.md §25.7.1). fleet_heartbeat_tick_count is
+     * TCG (GAP-A1, FABRIC-0.md §25.7.1). fleet_heartbeat_tick_count is
     * execution-paced (vm_runtime.c:143), so elapsed_ticks is now a pure
     * function of the execution stream. `touched` replaces the old
     * `> 0` sentinel: tick 0 is a legitimate value for a genuine first
@@ -458,7 +458,7 @@ void vm_physics_tick(uint64_t now_ns)
 }

 /* Gated on STADIUM_CAPACITY_TICK, not HEARTBEAT_INFERENCE_FREQUENCY (fixed
- * 2026-08-15, FABRIC-2.md §12 Q5): fleet_heartbeat_tick_count is fed by
+ * 2026-08-15, FABRIC-1.md §12 Q5): fleet_heartbeat_tick_count is fed by
 * EVERY live VM's own vm_tick() (see the comment above this counter's
 * declaration), so it advances several times faster in wall-clock terms
 * than a single VM's own tick_count -- comparing it against
@@ -18,7 +18,7 @@
 #include "starkernel/vm_identity.h"
 #include "starkernel/user_identity_seed.h"
 #include "starkernel/console.h"
-#include "starkernel/repl.h" /* sk_repl_get/set_active_vm() -- FABRIC-3.md §F.10 EJECT */
+#include "starkernel/repl.h" /* sk_repl_get/set_active_vm() -- FABRIC-2.md §F.10 EJECT */
 #include "blkio.h"
 #include "block_subsystem.h" /* compute_crc64() */
 #include "word_source/include/block_words.h" /* blk_vm_flush_all() -- §F.10 EJECT */
@@ -26,7 +26,7 @@
 #include <string.h>
 #include <stddef.h>

-/* FABRIC-3.md §F.10: "the VM currently attached via the home-blocks USB
+/* FABRIC-2.md §F.10: "the VM currently attached via the home-blocks USB
 * path" -- WIREBIND's own to track, set at successful birth in
 * capsule_wirebind_try_attach(), read and cleared by both
 * capsule_wirebind_eject() and capsule_wirebind_unclean_detach(). Single-
@@ -37,7 +37,7 @@ static int    g_wirebind_attached_valid = 0;
 /* Plain username (no "~user" registry-name suffix), tracked separately
 * from g_wirebind_attached_vm_id -- the registry entry's own name is
 * user_vm_name ("<username>~user"), not the bare form the (user) prompt
- * segment wants (FABRIC-3.md §I.1/4.4s). */
+ * segment wants (FABRIC-2.md §I.1/4.4s). */
 static char   g_wirebind_attached_username[USER_IDENTITY_USERNAME_MAX] = {0};

 /* WIREBIND_CERT_MAX_DEVBLOCKS: a sane upper bound on how much cert
@@ -178,7 +178,7 @@ void capsule_wirebind_try_attach(struct blkio_dev *dev,
        ((VM *)user_ctx)->identity = identity;
    }

-    /* FABRIC-3.md §F.10: this is the successful-birth point EJECT/UNCLEAN
+    /* FABRIC-2.md §F.10: this is the successful-birth point EJECT/UNCLEAN
     * need a tracked VMUuid from -- the user VM, not the console VM
     * (blk_vm_flush_all()/capsule_vm_kill() below both act on the VM that
     * actually owns block-subsystem state). */
@@ -21,7 +21,7 @@
 #include <string.h>
 #include <stddef.h>

-/* FABRIC-3.md §I.8 (re-scoped 2026-09-04): tracks whether the currently
+/* FABRIC-2.md §I.8 (re-scoped 2026-09-04): tracks whether the currently
 * home-blocks-attached device is Zuse's own -- the single-USB-device
 * constraint (§F.8) means capsule_zuse_boot_logout() only needs one flag,
 * not a device/uuid comparison, to know a detach event is hers to act on
@@ -57,7 +57,7 @@ static void install_and_activate(VM *mama_vm, const uint8_t seed[32], const uint
     * once vm->zuse_cert_installed is already 1) -- that's a real
     * security property (the cert/pubkey must never be re-installed or
     * swapped) and stays untouched here. Its return is NOT used to gate
-     * ACL-ZUSE-BOOT below anymore (FABRIC-3.md §I.8, re-scoped
+     * ACL-ZUSE-BOOT below anymore (FABRIC-2.md §I.8, re-scoped
     * 2026-09-04): re-authenticating after capsule_zuse_boot_logout()
     * needs ACL-ZUSE-BOOT to re-run and re-set zuse_session even when
     * the cert itself was already installed from an earlier boot-time
@@ -81,7 +81,7 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
                                   const homeblocks_sig_t *sig,
                                   VM *mama_vm) {
    if (!dev || !mama_vm) return;
-    /* FABRIC-3.md §I.8, re-scoped 2026-09-04: gate on zuse_session, not
+    /* FABRIC-2.md §I.8, re-scoped 2026-09-04: gate on zuse_session, not
     * zuse_cert_installed. zuse_cert_installed never clears (one-way,
     * see install_and_activate()'s own comment) and would permanently
     * block re-authentication after a logout; zuse_session does clear
@@ -43,7 +43,7 @@
 #include "starkernel/capsule_runcap.h"
 #include "starkernel/capsule_console.h"
 #include "starkernel/capsule_wirebind.h"
-#include "starkernel/capsule_zuse_boot.h" /* capsule_zuse_boot_logout() -- FABRIC-3.md §I.8 EJECT */
+#include "starkernel/capsule_zuse_boot.h" /* capsule_zuse_boot_logout() -- FABRIC-2.md §I.8 EJECT */
 #include "starkernel/homeblocks_sig.h"
 #include "freestanding/stdio.h"
 #include "starkernel/capsule_mint.h"
@@ -483,7 +483,7 @@ void mama_word_use(VM *vm)
        return;
    }

-    /* BINDSTEP (FABRIC-3.md §F.9/§F.24): if the target has a real
+    /* BINDSTEP (FABRIC-2.md §F.9/§F.24): if the target has a real
     * installed identity (WIREBIND set this at attach time), re-verify
     * it against whatever drive is CURRENTLY attached -- live, not
     * cached (decision 1: this is a rare, human-triggered, interactive
@@ -584,7 +584,7 @@ void mama_word_kill(VM *vm)
 /**
 * @brief EJECT ( -- )
 * Graceful detach of whatever identity is currently attached via the
- * home-blocks USB path (FABRIC-3.md §F.10, extended §I.8 2026-09-04) --
+ * home-blocks USB path (FABRIC-2.md §F.10, extended §I.8 2026-09-04) --
 * a regular WIREBIND user VM or Zuse herself, no identity handled any
 * differently. Single-USB-device constraint (§F.8) means there is only
 * ever one candidate, so at most one of the two calls below actually
@@ -834,7 +834,7 @@ static void mama_word_vm_call(VM *vm)
 /**
 * @brief MINT ( -- ok? )
 * Mint a fresh identity onto the currently attached USB drive
- * (FABRIC-3.md §F.8/§F.19). Deliberately no name/string argument despite
+ * (FABRIC-2.md §F.8/§F.19). Deliberately no name/string argument despite
 * F.8's original "S\" name\" MINT" sketch: this design never binds a VM
 * name at mint time -- the drive holds an anonymous, self-contained
 * identity, and a name is only assigned later, at RUNCAP birth (a
@@ -865,7 +865,7 @@ static int mint_pop_string(VM *vm, char *dst, size_t dst_cap)
 /**
 * @brief MINT ( fname-c fname-u uname-c uname-u email-c email-u phone-c phone-u -- ok? )
 * Mint a fresh identity onto the currently attached USB drive, with a
- * real human profile (FABRIC-3.md §F.20). full_name/username required
+ * real human profile (FABRIC-2.md §F.20). full_name/username required
 * and non-empty; pass a zero-length string (S" ") for email/phone to
 * leave them null.
 */
@@ -922,7 +922,7 @@ static void mama_word_mint(VM *vm)
 /**
 * @brief ZUSE-ELIGIBILITY-ADD ( c-addr -- ok? )
 * Add the 32-byte Ed25519 public key at c-addr to Zuse's elevation
- * eligibility list (FABRIC-3.md §H.5/§H.12 item 19). Plain, unconditional
+ * eligibility list (FABRIC-2.md §H.5/§H.12 item 19). Plain, unconditional
 * primitive -- no authorization check here or anywhere else in this
 * codebase gates on vm->zuse_session. Zuse's authority is the *absence*
 * of any ACL restricting her, not a bit this or any other word checks;
@@ -957,7 +957,7 @@ static void mama_word_zuse_eligibility_add(VM *vm)

 /**
 * @brief ZUSE-ELIGIBLE? ( c-addr -- flag )
- * Membership check over Zuse's elevation eligibility list (FABRIC-3.md
+ * Membership check over Zuse's elevation eligibility list (FABRIC-2.md
 * §H.5/§H.12 item 21). Plain, unconditional wrapper over
 * zuse_eligibility_is_member() -- same "no bespoke gate" convention as
 * ZUSE-ELIGIBILITY-ADD above; is_member() itself is already fail-closed.
@@ -1046,7 +1046,7 @@ static void mama_word_elevate_pubkey_unpack(VM *vm)

 /**
 * @brief RUNCAP-TEST ( caddr u -- ok? rc )
- * Diagnostic-only word (FABRIC-3.md §F.6/§F.18): calls
+ * Diagnostic-only word (FABRIC-2.md §F.6/§F.18): calls
 * capsule_runcap_birth() against whatever drive sk_repl_get_homeblocks_
 * dev()/sig() currently report, naming the new VM from the given string.
 * Not the real RUNCAP call site -- that's WIREBIND (still unbuilt); this
@@ -1092,7 +1092,7 @@ static void mama_word_runcap_test(VM *vm)

 /**
 * @brief PAIR-TEST ( caddr u -- ok? )
- * Diagnostic-only word (FABRIC-3.md Phase F, 2026-08-28): births a
+ * Diagnostic-only word (FABRIC-2.md Phase F, 2026-08-28): births a
 * console VM (bare, capsule_console.h) named by the given string, and a
 * user VM (capsule_runcap_birth(), from whatever drive sk_repl_get_
 * homeblocks_dev()/sig() currently report) named "<string>~user" --
@@ -1583,7 +1583,7 @@ void register_mama_forth_words(VM *vm)
 }

 /* ============================================================================
- * Stadium Words (FABRIC.md punch list item 4.2)
+ * Stadium Words (FABRIC-0.md punch list item 4.2)
 *
 * The entire C surface item 4.2 is permitted to add, per HERMES.md's
 * language constraint: all eight operate on the CALLING VM's own identity
@@ -1679,7 +1679,7 @@ static void mama_word_stadium_res_fetch(VM *vm)
 * Sum of heat held by the calling VM's own word-execution residents
 * (item 4.1's cells) -- the term a VM's own application-level conservation
 * check (e.g. Hermes's HERMES-K) needs to close exactly, since word patrons
- * are otherwise invisible to FORTH (FABRIC.md §25.7, ruling 2026-08-06).
+ * are otherwise invisible to FORTH (FABRIC-0.md §25.7, ruling 2026-08-06).
 */
 static void mama_word_stadium_word_heat(VM *vm)
 {
@@ -1788,7 +1788,7 @@ void register_child_vm_words(VM *vm)
    register_word(vm, "EXEC",    mama_word_exec);
    register_word(vm, "VM-EXEC", mama_word_vm_exec);
    register_word(vm, "VM-CALL", mama_word_vm_call);
-    /* USE (FABRIC-3.md §F.24): not console-specific -- any VM can
+    /* USE (FABRIC-2.md §F.24): not console-specific -- any VM can
     * redirect the physical REPL to any other VM it has ACL access to
     * (BINDSTEP re-verifies on every call, §F.9), including a console
     * VM switching back to Hera or to a different session entirely.
@@ -22,7 +22,7 @@
 */

 /**
- * vm_uuid.c - 128-bit VM identifiers (FABRIC.md punch list item 3.8)
+ * vm_uuid.c - 128-bit VM identifiers (FABRIC-0.md punch list item 3.8)
 *
 * See vm_uuid.h for the design rationale (no RNG source exists on any of
 * the three ISAs uniformly, so this is deterministic, not random).
@@ -5,7 +5,7 @@
 *
 * All constants below were generated by direct Python computation
 * (arbitrary-precision arithmetic) and pasted in, not hand-derived or
- * recalled from memory -- see FABRIC-2.md's Ed25519 milestone writeup
+ * recalled from memory -- see FABRIC-1.md's Ed25519 milestone writeup
 * for the derivation. Cross-checked: the curve equation
 * -x^2+y^2 = 1+d*x^2*y^2 holds for (BX,BY) under this D; the base point
 * encoding (0x58, then 0x66 repeating) matches the well-known published
@@ -164,7 +164,7 @@ static int serial_transmit_empty(void) {
 *
 * g_active_vm_name_buf owns the storage -- console_set_vm_name() copies
 * into it rather than storing the caller's own pointer. Found live
- * 2026-08-28 (FABRIC-3.md Phase F): mama_word_use() (USE) passes
+ * 2026-08-28 (FABRIC-2.md Phase F): mama_word_use() (USE) passes
 * entry.name, a local VMRegistryEntry's own field -- once USE returns,
 * that stack frame is reused and the old raw-pointer version left
 * g_active_vm_name dangling, corrupting every console tag after the
@@ -229,7 +229,7 @@ static void raw_putc(char c) {
 * framebuffer (vt100_putc) -- mirrors console_putc()'s own serial/framebuffer
 * split so the prefix reaches both outputs, not serial only. No recursion
 * into console_putc itself (would re-trigger the line-start prefix check). */
-/* FABRIC.md 4.4: the bracketed VM name (brackets included) renders in
+/* FABRIC-0.md 4.4: the bracketed VM name (brackets included) renders in
 * standard web orange, 0xFFA500 -- not in the classic 16-color ANSI
 * palette, so sent as a literal 24-bit SGR sequence rather than a palette
 * index. Same dual serial+framebuffer send pattern as the rest of this
@@ -73,7 +73,7 @@ static FbState g_fb;
 * uint32 store), e.g. PixelRedGreenBlueReserved8BitPerColor means byte0=R,
 * byte1=G, byte2=B, byte3=X -- which as a little-endian uint32 puts R in
 * bits[7:0], G in bits[15:8], B in bits[23:16]. The two branches below were
- * previously swapped relative to that (found via FABRIC.md item 4.3.1's
+ * previously swapped relative to that (found via FABRIC-0.md item 4.3.1's
 * orientation test: corners rendered with R and B channels exchanged).
 */
 static uint32_t pack_pixel(uint32_t rgb)
@@ -190,7 +190,7 @@ void fb_draw_glyph(uint32_t px, uint32_t py, uint8_t ch,
            uint32_t packed = on ? pfg : pbg;
            uint32_t base_x = px + col  * g_fb.scale;
            /* font_8x16_data stores each glyph's scanlines bottom-to-top
-             * (FABRIC.md item 4.4f) -- row 0 is the glyph's bottom row, so
+             * (FABRIC-0.md item 4.4f) -- row 0 is the glyph's bottom row, so
             * it maps to the cell's last pixel row, not its first. */
            uint32_t base_y = py + (15u - row) * g_fb.scale;

@@ -215,7 +215,7 @@ void fb_draw_glyph(uint32_t px, uint32_t py, uint8_t ch,
 * --------------------------------------------------------------------- */

 /**
- * fb_draw_orientation_test — one-time boot diagnostic (FABRIC.md item 4.3.1).
+ * fb_draw_orientation_test — one-time boot diagnostic (FABRIC-0.md item 4.3.1).
 *
 * Fills each raster corner with a distinct solid color so a screendump
 * immediately reveals whether the image is flipped or rotated. Not part of
@@ -263,7 +263,7 @@ void fb_draw_orientation_test(void)
 * show it, but enough scrolls (or scrolling quickly) accumulates visible
 * pixel overlap between rows.
 *
- * Copies through non-volatile pointers (FABRIC.md item 4.4g performance
+ * Copies through non-volatile pointers (FABRIC-0.md item 4.4g performance
 * fix, 2026-08-11): the GOP framebuffer is mapped write-back, not
 * cache-disabled MMIO (vmm.c:350-363 -- "QEMU's VGA emulation is coherent
 * and UC- mapping causes #GP"), so it behaves as ordinary RAM and does not
@@ -315,7 +315,7 @@ void fb_scroll_rows(uint32_t pixel_rows, uint32_t bg)
 }

 /**
- * fb_scroll_rect — box-confined scroll (FABRIC.md item 4.4t).
+ * fb_scroll_rect — box-confined scroll (FABRIC-0.md item 4.4t).
 *
 * Same non-volatile bulk-copy rationale as fb_scroll_rows() above, but
 * bounded to a caller-supplied rectangle instead of the whole framebuffer --
@@ -8,7 +8,7 @@
 */

 /**
- * ttf.c — TrueType font parser core (FABRIC.md items 4.3.7, 4.3.7a)
+ * ttf.c — TrueType font parser core (FABRIC-0.md items 4.3.7, 4.3.7a)
 *
 * sfnt directory + head/maxp/loca/glyf/cmap(format 4) table parsing, plus
 * simple- and composite-glyph outline extraction. All multi-byte fields in
@@ -26,7 +26,7 @@
 * an unsigned overflow check; q48_mul does a plain unsigned widen-multiply)
 * — confirmed by reading that file, not assumed. Per this repo's rule
 * against modifying a shared/tested module to "fix" it without being
- * asked, that gap is reported (see FABRIC.md's 4.3.7a completion note),
+ * asked, that gap is reported (see FABRIC-0.md's 4.3.7a completion note),
 * not patched here. No glyph in the v1 repertoire (§27.6.4) needs a
 * non-identity composite transform — checked against
 * fonts/JetBrainsMono-Regular.ttf before writing this, not assumed.
@@ -55,7 +55,7 @@
 #define UNDERLINE_ROW 14u

 /* -----------------------------------------------------------------------
- * FABRIC.md item 4.4j: TTF glyph backend, active only from
+ * FABRIC-0.md item 4.4j: TTF glyph backend, active only from
 * vt100_enable_ttf() onward (boot/POST stays font_8x16.c).
 *
 * Point size and cell geometry, decided final by item 4.4m (20px text,
@@ -81,7 +81,7 @@ static ttf_font_t          g_ttf_font;
 static int                 g_ttf_ready   = 0;
 static ttf_raster_cache_t  g_ttf_cache;

-/* FABRIC.md item 4.4y-revised: Alt+TAB graphics/text toggle. When 0, every
+/* FABRIC-0.md item 4.4y-revised: Alt+TAB graphics/text toggle. When 0, every
 * terminal draw call (put_char's glyph blit, erase, scroll) becomes a
 * pure logical update -- g_vt's cursor/attributes and the scrollback
 * shadow still advance normally, only the actual framebuffer write is
@@ -92,7 +92,7 @@ static ttf_raster_cache_t  g_ttf_cache;
 static int g_terminal_visible = 1;

 /* -----------------------------------------------------------------------
- * FABRIC.md items 4.4t/4.4o/4.4u/4.4w/4.4x/4.4z tried a 640x480 CANVAS
+ * FABRIC-0.md items 4.4t/4.4o/4.4u/4.4w/4.4x/4.4z tried a 640x480 CANVAS
 * box with a separate single-line REPL strip pinned below it -- a
 * confined region plus independent border-drawing/geometry bookkeeping
 * for both. Reverted 2026-08-12, simplified back to what this comment
@@ -105,7 +105,7 @@ static int g_terminal_visible = 1;
 * --------------------------------------------------------------------- */

 /* -----------------------------------------------------------------------
- * FABRIC.md item 4.4q: REPL scrollback. Text-only (not pixel snapshots --
+ * FABRIC-0.md item 4.4q: REPL scrollback. Text-only (not pixel snapshots --
 * at 1000 lines x ~cols bytes this is tens of KB; a pixel-snapshot ring
 * would be roughly three orders of magnitude larger for no benefit, since
 * the only consumer is a redraw). Only active in TTF mode (allocated in
@@ -154,7 +154,7 @@ static uint32_t  g_ring_cap      = 0;    /* active ring capacity -- VT100_BOOT_S
 static uint32_t  g_scroll_offset = 0;    /* 0 = live view */

 /* -----------------------------------------------------------------------
- * FABRIC.md item 4.4ac: boot-mode scrollback. font_8x16/bitmap-mode boot
+ * FABRIC-0.md item 4.4ac: boot-mode scrollback. font_8x16/bitmap-mode boot
 * output (POST, capsule birth, self-tests, heartbeat) previously had no
 * scrollback at all -- g_shadow/g_ring above were only ever allocated in
 * vt100_enable_ttf(), so anything printed before the REPL took over was
@@ -314,7 +314,7 @@ static void draw_cursor_glyph(uint8_t ch)
    uint32_t f = eff_fg();
    uint32_t b = eff_bg();

-    /* FABRIC.md item 4.4q: mirror every drawn character into the
+    /* FABRIC-0.md item 4.4q: mirror every drawn character into the
     * scrollback shadow buffer, when active. */
    if (g_shadow && g_vt.cy < g_vt.rows && g_vt.cx < g_vt.cols) {
        g_shadow[(size_t)g_vt.cy * g_line_stride + g_vt.cx] = (char)ch;
@@ -428,7 +428,7 @@ void vt100_init(void)

    erase_display(2);

-    /* FABRIC.md item 4.4ac: allocate boot-mode scrollback now, at the
+    /* FABRIC-0.md item 4.4ac: allocate boot-mode scrollback now, at the
     * bitmap cell geometry just computed above. Non-fatal on failure, same
     * pattern as vt100_enable_ttf()'s TTF allocation below: g_shadow/g_ring
     * stay NULL, draw_cursor_glyph()/scroll_up() already gate on that and
@@ -483,7 +483,7 @@ void vt100_enable_ttf(void)
        g_ttf_ready = 1;
    }

-    /* FABRIC.md item 4.4ac: freeze the boot-mode scrollback buffers (if
+    /* FABRIC-0.md item 4.4ac: freeze the boot-mode scrollback buffers (if
     * any -- vt100_init() may have failed to allocate them) before they
     * get overwritten below. g_vt.cols/rows/g_shadow/g_ring/g_line_stride/
     * g_ring_count/g_ring_head/g_ring_cap still hold boot-mode values at
@@ -518,7 +518,7 @@ void vt100_enable_ttf(void)
    fb_fill_rect(0, 0, fb_width(), fb_height(), g_vt.def_bg);
    erase_display(2);

-    /* FABRIC.md item 4.4q: allocate the scrollback shadow + ring buffers
+    /* FABRIC-0.md item 4.4q: allocate the scrollback shadow + ring buffers
     * now that cols/rows are fixed for the rest of this session. Failure
     * is non-fatal -- scrollback just stays unavailable (g_shadow/g_ring
     * stay NULL, every scrollback call site already checks), REPL text
@@ -607,7 +607,7 @@ static void scrollback_redraw(void)
    }
 }

-/* FABRIC.md item 4.4y-revised: Alt+TAB graphics/text toggle, a two-state
+/* FABRIC-0.md item 4.4y-revised: Alt+TAB graphics/text toggle, a two-state
 * machine (VISIBLE <-> HIDDEN) with exactly one transition function --
 * both the physical Alt+TAB interception (repl.c) and the ALT+TAB FORTH
 * word (keyboard_words.c) call this same function, so there is exactly
@@ -689,7 +689,7 @@ static void advance_cursor(void)
    }
 }

-/* FABRIC.md item 4.4q: push the rows about to be discarded into the
+/* FABRIC-0.md item 4.4q: push the rows about to be discarded into the
 * scrollback ring before the pixel scroll happens, then shift the shadow
 * buffer to match. `n` is clamped to g_vt.rows -- scrolling further than
 * a full screen at once cannot happen through this code path (advance_cursor
@@ -739,7 +739,7 @@ static void scroll_up(uint32_t lines)
 * Erase operations
 * --------------------------------------------------------------------- */

-/* FABRIC.md item 4.4i found this drawing a per-cell blank glyph
+/* FABRIC-0.md item 4.4i found this drawing a per-cell blank glyph
 * (font_8x16.c-specific, and inconsistent with erase_display(2)'s
 * full-screen case just below, which already used a plain rect fill).
 * 4.4j fixes both problems at once: a blank cell is visually identical to
@@ -15,7 +15,7 @@
 * timer.c contributes only heartbeat_read_counter() — the one thing that is
 * genuinely per-ISA (rdtsc / rdtime / CNTPCT_EL0).
 *
- * Top half / bottom half split (FABRIC.md §25.1 item 0.8, per the GAP-A1
+ * Top half / bottom half split (FABRIC-0.md §25.1 item 0.8, per the GAP-A1
 * ruling in §16.4/§18.4): heartbeat_tick() is called from interrupt context
 * and does nothing but read the counter, bump TIME-TICKS, and latch a
 * pending sample. heartbeat_service() runs on the mainline (the REPL idle
@@ -23,7 +23,7 @@
 * state — the engine stays on the virtual tick per §18.4, unchanged by this
 * file.
 *
- * Adaptive re-arm period (FABRIC.md §26, ruled 2026-08-03): Loop #7
+ * Adaptive re-arm period (FABRIC-0.md §26, ruled 2026-08-03): Loop #7
 * (vm_runtime.c) computes an execution-derived stable/volatile signal and
 * calls heartbeat_set_adaptive_period_ns() with it, rescaled to this file's
 * kernel-appropriate base (10 ms, matching the 100 Hz rate item 0.1-0.7
@@ -47,7 +47,7 @@
 * rate established throughout items 0.1-0.7. Deliberately NOT
 * HEARTBEAT_TICK_NS (include/starforth_config.h) -- that constant is the
 * hosted pthread-worker's 10 µs base and is three orders of magnitude too
- * fast for a bare-metal ISR period (FABRIC.md §26.3). Loop #7's decision
+ * fast for a bare-metal ISR period (FABRIC-0.md §26.3). Loop #7's decision
 * logic is reused unmodified; only the base it scales differs. */
 #define HEARTBEAT_BASE_PERIOD_NS  10000000ULL

@@ -213,7 +213,7 @@ const TimeTrustState *heartbeat_state(void)
 }

 /**
- * @brief Set the adaptive re-arm period (FABRIC.md §26).
+ * @brief Set the adaptive re-arm period (FABRIC-0.md §26).
 *
 * Called from vm_runtime.c's Loop #7 site on the mainline execution path
 * (never interrupt context) with a value already rescaled to this file's
--- a/Show More
+++ b/Show More