Phase 8 C (2/n): expand cert storage; NVRAM persistence crashed, reverted

Cert storage expanded from the old 16-byte placeholder to a real
32-byte seed + 32-byte pubkey. vm_zuse_cert_install() now has a
kernel-side duplicate in src/starkernel/vm/vm_core.c -- the kernel
build's VM_EXCLUDE list drops src/vm.c entirely (same reason
vm_set_base() already has two independent copies), so the hosted-only
version added earlier this session was never actually linked into the
kernel. FORTH-side ZUSE-CERT-LO@/HI@ replaced with ZUSE-PUBKEY@ (i -- u)
over the public half only; ACL-ZUSE-BOOT now checks
ZUSE-CERT-INSTALLED? before authenticating instead of unconditionally.

Attempted NVRAM-based persistence (GetVariable/SetVariable) for the
first-boot mint flow: page-faulted inside OVMF's variable service
(CR2 in the flash MMIO window). Moving the call site to match the one
proven-safe existing SetVariable call site in this codebase produced
the identical crash -- not a timing issue. Localized with debug
markers (one boot): GetVariable works; SetVariable with real data
never returns. The existing "working" precedent call is actually a
delete-of-nonexistent-variable (size=0, data=NULL), a cheaper path
that never touches flash, so it proved nothing about real writes.
Root cause: this kernel's VMM never maps the region OVMF's variable
service needs for real flash writes -- a genuine gap in UEFI runtime-
services support, not Zuse-specific, and not obviously fixable in a
3-arch-uniform way (flash window location is firmware/arch-specific).

Independently, storing the raw seed in RUNTIME_ACCESS NVRAM would have
been a real security defect regardless of the crash -- readable by any
later-loaded UEFI app or the booted OS.

Reverted to a known-safe state: all NVRAM/mint code removed from
kernel_main.c, init.4th's ACL.4th line back to its documented
commented-out default. Verified clean compile and clean boot on all
three architectures. Cert storage expansion (the part that works)
stays. A dedicated system-identity disk (virtio-blk, already proven
for writes via Artemis) is the recommended next substrate -- not yet
decided or built. Full investigation documented in FABRIC-3.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-08-26T19:15:03Z -->
+<!-- Generated by mkcapsule --manifest  2026-08-26T19:54:10Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->
@@ -38,7 +38,7 @@
 | `sdk.4th` | 5109, 5110, 5111, 5112, 5113, 5114, 5115 | `0x008fdbbb62c94a3a` |
 | `turtle.4th` | 5100, 5101, 5102, 5103, 5104, 5105, 5106, 5107, 5108 | `0x4d470418ca543365` |
 | `user-font-demo.4th` | 4200, 4201, 4202 | `0xce1fd7d1b581a56d` |
-| `zuse.4th` | 4016, 4017, 4018 | `0x097456615c8d9173` |
+| `zuse.4th` | 4016, 4017, 4018 | `0x3b31872d02a43d83` |
 
 ## Block Map (sorted by LBN)
 
@@ -103,9 +103,9 @@
 | 4006 | `ACL.4th` | `0xd781d22148ff171d` | ok |
 | 4007 | `ACL.4th` | `0xd781d22148ff171d` | ok |
 | 4015 | `ACL.4th` | `0xd781d22148ff171d` | ok |
-| 4016 | `zuse.4th` | `0x097456615c8d9173` | ok |
-| 4017 | `zuse.4th` | `0x097456615c8d9173` | ok |
-| 4018 | `zuse.4th` | `0x097456615c8d9173` | ok |
+| 4016 | `zuse.4th` | `0x3b31872d02a43d83` | ok |
+| 4017 | `zuse.4th` | `0x3b31872d02a43d83` | ok |
+| 4018 | `zuse.4th` | `0x3b31872d02a43d83` | ok |
 | 4050 | `lib.4th` | `0x1c77d7c9562a5b62` | ok |
 | 4055 | `common:msg.4th` | `0x850a0382344ea6c4` | ok |
 | 4060 | `doe-campaign.4th` | `0x3d4549142d91ec20` | ok |

capsules/zuse.4th

@@ -5,21 +5,27 @@ Block 4016
 ( Loaded by ACL.4th; must not load before ACL.4th. )
 ( FUTURE: Replace with thumbdrive Ed25519 PKI. )
 ( HUMAN-REVIEW: capsule hash = root of superuser trust. )
-( Cert value lives in C-only VM fields (vm_zuse_cert_install),
-( NOT a dictionary CONSTANT: ACL-PIN only blocks redefinition,
-( not a >BODY-then-store, so a pinned CONSTANT is not actually
-( tamper-proof. Read with ZUSE-CERT-LO@ / ZUSE-CERT-HI@ / )
-( ZUSE-CERT-INSTALLED? -- all C primitives, all read-only.  )
+( Cert (seed+pubkey) lives in C-only VM fields, installed by )
+( kernel_main.c's first-boot mint-or-load (NVRAM ZuseCert). )
+( NOT a CONSTANT: ACL-PIN blocks redefinition, not a )
+( >BODY-then-store, so a pinned CONSTANT isn't tamper-proof. )
+( Read with ZUSE-PUBKEY@ / ZUSE-CERT-INSTALLED? -- both C )
+( primitives, read-only; the seed has no FORTH access at all. )
 
 Block 4017
 ( ACL-ZUSE-BOOT ( -- )                               )
-( Authenticates zuse session (sets vm->zuse_session=1)
-( via C primitive) and pins itself against redefinition.)
-( ZUSE-AUTHENTICATE is C-only; no FORTH word grants  )
-( god-mode except through this boot sequence.        )
+( Only authenticates if a real cert was installed this boot -- )
+( refuses god-mode to a Zuse with no real identity behind her )
+( (no runtime services, no entropy). Pins itself against )
+( redefinition either way. ZUSE-AUTHENTICATE is C-only; no )
+( FORTH word grants god-mode except through this sequence. )
 : ACL-ZUSE-BOOT ( -- )
-  ZUSE-AUTHENTICATE
-  LOG-INFO" zuse: activated"
+  ZUSE-CERT-INSTALLED? IF
+    ZUSE-AUTHENTICATE
+    LOG-INFO" zuse: activated"
+  ELSE
+    LOG-INFO" zuse: NOT activated -- no cert installed"
+  THEN
   ['] ACL-ZUSE-BOOT ACL-PIN ;
 
 Block 4018