POST coverage cluster 1/4: ACL accessors (proof-covered, previously untested)

Adds interpreter-level POST coverage for six ACL read accessors
(ACL-MODE@/PINNED?/TTL@/ALLOW@/HEAT@/WORD-ID), ACL-INHERIT as an
interpreted word (not just its underlying C function, already tested),
and ACL-INIT-PRIMITIVES -- all proof-covered per proof/COVERAGE.md but
never exercised via vm_interpret() before. Follows acl_words_test.c's
existing hand-rolled ACL_ASSERT style, not the WordTestSuite table
format the rest of the tree uses.

First boot caught a real bug in the new test itself (2/29 assertions
failed): ACL-INHERIT's C implementation pops dst before src, the test
pushed them backwards. Fixed the test, not the word -- ACL-INHERIT's
own dispatch was correct throughout. Re-verified: 29/29 pass, zero
build warnings. Both the failing and fixed boot logs kept as evidence.

Part of the agreed sequence (code sweeps -> HOL green -> POST coverage,
one proof-covered cluster at a time). Three more clusters queued:
Q48.16 math primitives, inference-engine accessors, physics
freeze/diagnostic words. Full writeup in FABRIC-2.md Section J.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

FABRIC-2.md

@@ -1436,3 +1436,40 @@ occurrences of `error`/`fail`/`sorry`/`oops`/`exception`/`abort` anywhere in the
 log.** This is the real, current, verified state — not inferred from file/`ROOT` consistency
 as the earlier entry above had to settle for. The 52-theory count itself (vs. `FINDINGS.md`'s
 stale "53") is confirmed correct by this run too.
+
+**Third milestone in the same sequence: POST test coverage for proof-covered-but-untested
+words, in progress, one cluster at a time.** A fork cross-referenced every `register_word()`
+call in `src/word_source/*.c` (317 words total) against `WordTestSuite` table entries in
+`src/test_runner/modules/*.c`, then narrowed to the words `proof/COVERAGE.md` actually claims
+proof coverage for — landing on four small clusters genuinely proof-covered with zero POST
+exercise: ACL accessors (9 words, `acl_words.c`), Q48.16 math primitives (21 words,
+`q48_words.c`), inference-engine accessors (8 words, `inference_words.c`), physics freeze/
+diagnostic (5 words). The much larger raw 170-word gap the fork also found is mostly words
+`COVERAGE.md` itself already rules out of proof scope entirely (block-window cache,
+vocabulary chain, hot-words cache, interactive-only words) — not the target here.
+
+**Cluster 1, ACL accessors — done.** `src/test_runner/modules/acl_words_test.c` doesn't use
+the `WordTestSuite` table format the rest of the tree does (hand-rolled `ACL_ASSERT` macro,
+direct `vm_interpret()` calls) — new tests follow its existing style, not the tabular one.
+Added three new tests: read accessors (`ACL-MODE@`/`ACL-PINNED?`/`ACL-TTL@`/`ACL-ALLOW@`/
+`ACL-HEAT@`/`ACL-WORD-ID`, 6 assertions — none of these six had ever been pushed-and-
+interpreted anywhere in this file, only their write-side siblings had), `ACL-INHERIT` as an
+*interpreted word* rather than only its underlying C function (2 assertions — the existing
+`test_acl_inherit` proved `acl_inherit_entry()` correct via a direct C call, but never
+exercised the FORTH-level stack-popping dispatch itself), and `ACL-INIT-PRIMITIVES` (4
+assertions — unpinned entries reset to permissive defaults, pinned entries left alone).
+
+**A real bug in the new test itself, caught immediately by running it — worth recording as
+the caught mistake it is, not silently fixed.** First run: 27 passed, 2 failed (both
+`ACL-INHERIT`-as-word assertions). Root cause: the C implementation pops `dst` before `src`
+(`pop_xt(vm)` twice, top of stack first) — the test pushed `dst` then `src`, backwards. Fixed
+the test's push order (`src` then `dst`, matching what the C code actually expects), not the
+word itself — `ACL-INHERIT`'s own dispatch was correct throughout; this was a test-authoring
+mistake, caught by immediately booting and checking rather than assuming a clean compile
+meant a correct test. Re-run: **29 passed, 0 failed, 0 skipped, 0 errors.** Full amd64 build
+zero-warning-clean throughout. `logs/20260818-231204/` records the failing run (kept as
+evidence the bug was real and caught, not hidden), `logs/20260818-231403/` the fixed one.
+
+Remaining clusters (Q48.16, inference-engine, physics freeze/diagnostic) not yet started —
+next up, one at a time, same process: read the C implementation, write tests matching that
+file's existing style, boot and verify before committing.