Assert Hestia's headless invariant -- FABRIC-3.6.md task 1.9, Phase 1 closed

Audited first: neither capsules/hestia/init.4th nor her birth block in
kernel_main.c references g_wirebind_attached_username, CONSOLE-ATTACH,
MINT, or any proxy-minting mechanism -- the invariant already held
structurally, by absence. Stated it explicitly anyway, per the task:
added a comment at Hestia's birth site quoting FABRIC-3.5.md SXVIII.6's
invariant verbatim, warning future edits not to add console/wirebind/
proxy code there without re-reading it first.

Verified live with the actual no-thumbdrive boot
(ARCH=<arch> qemu ZUSEDISK=), not the default. All four VMs born
successfully on all three architectures, zero UNKNOWN WORD, and zero
ok> occurrences anywhere in any of the three full logs -- genuinely
silent, matching sk_repl_headless_wait()'s own documented "no banner,
no prompt, no input surface at all." Watched each log's line count
post-birth for 8-10s to confirm it stayed flat rather than eventually
printing something late.

Confirmed no regression on the standard (with-thumbdrive) path on
amd64: dict_hash identical to task 1.8's baseline. Did not repeat that
check on aarch64/riscv64 -- the change is a comment only, cannot
diverge by compiler, and the headless invariant itself was already
proven identically on all three.

Phase 1 is now fully closed (tasks 1.1-1.9). Tripod is Hera/Artemis/
Hestia plus Hermes (retained through Phase 1-3 per SXXXIV.4); Hestia
owns the drawing fabric exclusively; headless-until-login intact with
Hestia in the fleet. Phase 2 is next.

Authorized by Captain Bob ("yes").

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

FABRIC-3.6.md

@@ -443,9 +443,39 @@ Hestia; headless policy intact.
       this commit since it would otherwise sit stale against the source that produced it.
       `mkcapsule --lint capsules/` clean, 38 files, 0 violations (no capsule content changed —
       this task is pure C). No compiler warnings on either edited file.
-- [ ] **1.9** — Assert §XVIII.6's headless invariant: Hestia's birth sets no
+- [x] **1.9** — Assert §XVIII.6's headless invariant: Hestia's birth sets no
       `g_wirebind_attached_username` and mints no proxy. *Check:* boot headless, no thumbdrive,
       **no prompt appears**.
+      2026-09-19 · Audited first: neither `capsules/hestia/init.4th` nor her birth block in
+      `kernel_main.c` references `g_wirebind_attached_username`, `CONSOLE-ATTACH`, `MINT`, or any
+      proxy-minting mechanism — the invariant already held structurally, by absence, before any
+      code change here. Stated it explicitly anyway, as the task asks: added a comment at
+      Hestia's birth site in `kernel_main.c` quoting §XVIII.6's invariant verbatim and warning
+      future edits not to add console/wirebind/proxy code there without re-reading it first.
+
+      **Verified live with `make -f Makefile.starkernel ARCH=<arch> qemu ZUSEDISK=`** — the
+      actual no-thumbdrive boot, not the default (which always attaches
+      `disk/thumbdrives/zuse-thumb-ident.img` and produces the `[zuse@Hera] ok>` prompt seen in
+      every other task in this document). `logs/20260919-173942/amd64/`,
+      `logs/20260919-174126/aarch64/`, `logs/20260919-174307/riscv64/` — all four VMs (Hera/
+      Hermes/Hestia/Artemis) born successfully on all three, zero `UNKNOWN WORD`, and critically
+      **zero `ok>` occurrences anywhere in any of the three full logs** — genuinely silent,
+      matching `sk_repl_headless_wait()`'s own documented "no banner, no prompt, no input
+      surface at all." Watched each log's line count at the point after Artemis's birth for
+      8–10s and confirmed it stayed flat rather than eventually printing something late.
+
+      Also confirmed no regression on the standard (with-thumbdrive) path: re-ran amd64 with the
+      default `ZUSEDISK` (`logs/20260919-174443/amd64/`) — `dict_hash` identical to task 1.8's
+      baseline, zero `UNKNOWN WORD`, reaches `ok>` normally. Did not repeat the standard-boot
+      check on aarch64/riscv64 for this task specifically: the change is a comment only, cannot
+      diverge by compiler or architecture, and the headless invariant itself was already proven
+      identically on all three.
+
+      **Phase 1 is now fully closed** — tasks 1.1–1.9 all done. Tripod is Hera/Artemis/Hestia
+      (plus Hermes, retained through Phase 1–3 per §XXXIV.4); Hestia owns the drawing fabric
+      exclusively; headless-until-login policy intact with Hestia in the fleet. Phase 2
+      (the allocator and its audit) is next — the phase §XXXIII named as the only genuinely hard
+      part, and the project's real go/no-go at task 2.7.
 
 ## Phase 2 — Allocator and audit (inert) — **the real go/no-go**
 

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-09-19T21:34:18Z -->
+<!-- Generated by mkcapsule --manifest  2026-09-19T21:44:41Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->

src/starkernel/kernel_main.c

@@ -878,7 +878,17 @@ static void kernel_main_deep(BootInfo *boot_info) {
      * FABRIC-3.6.md task 1.4. Hermes stays live too (SXXXIV.4): the
      * fleet is Hera/Hermes/Artemis/Hestia through Phase 1-3, four VMs,
      * not three, until Phase 4's Category B strip retires Hermes. Same
-     * birth-by-name-then-registry-check shape as Hermes/Artemis above. */
+     * birth-by-name-then-registry-check shape as Hermes/Artemis above.
+     *
+     * HEADLESS INVARIANT (FABRIC-3.5.md SXVIII.6, FABRIC-3.6.md task 1.9):
+     * this birth must not set g_wirebind_attached_username, must not
+     * cause sk_console_identity_present() (repl.c) to report an
+     * identity, and must not mint a proxy. Hestia owns the fabric from
+     * boot; she presents nothing until something binds. This is the same
+     * invariant SXXXII.2 imposed on unattended identity birth, applied to
+     * a second path -- do not add console/wirebind/proxy code to this
+     * birth or to capsules/hestia/init.4th without re-reading SXVIII.6
+     * first. */
     console_println("Startup: birthing Hestia (fleet foundation)...");
     vm_interpret(mama, "S\" Hestia\" BIRTH");
     {