feat(log): LOG-FLUSH -- a VM's log records reach Artemis's log ring; and the ring keeps its order when it grows

FABRIC-3 SXXXII.4's deferred LOG-FLUSH, built to the 2026-10-14 rulings
(SXXXVIII): everything a VM logs, at or above the log level, goes into its
own buffer; it goes to Artemis on LOG-FLUSH, when full, and at once on an
ERROR, as one kernel-Hermes LOG_BATCH message she writes on her own turn,
the source being the sender the kernel stamped.  Records that cannot go yet
are counted and reported with the next flush.  LOG-SHOW (Hera only) reads
the ring back -- it had no reader.

Found by the first test that filled it: ring growth overwrote the oldest
record and put blank slots inside the live range.  Fixed test first.

Three ISAs: POST 1052 passed; new parity baseline word_count=526
hash=0x82f4ae7cb2e2d424 (deliberate).  CLAUDE.md: Phase 8 PKI closed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -149,8 +149,11 @@ The word-level ACL system is fully implemented, including kernel parity. Key con
    confirmed **absent** from `v3/src/vm.c`. (The `feature/acl-rwt` branch this work was
    apparently done on is not traceable in `git log --all` — likely squash-merged without
    preserving the ref. The code is real and verified; the branch name is not.)
-8. ⬜ PKI / thumbdrive — Ed25519 challenge-response; user minting by zuse. **This is the open
-   item — pick up here next.**
+8. ✅ PKI / thumbdrive — closed 2026-10-14. User minting by Zuse is built (`MINT`, `MINT-SCRATCH`,
+   WIREBIND cert verification). Challenge-response against a cloned drive was ruled out by design
+   ("there's only the drive", `FABRIC-3.7.md`). Runtime word-ACL elevation (`ELEVATE-GRANT`, the
+   Zuse eligibility list) was ruled not needed and removed, with the hole it carried
+   (`FABRIC-3.md` §XXXVII).
 
 **ACL-RWT DoE campaign (June 15–16 2026) — superseded, kept for historical record:**
 - 3×3 Latin square: 3 seeds × amd64/aarch64/riscv64, 30 reps each
@@ -199,8 +202,8 @@ removed as an active target.)
 **Current status: M7.1** — capsule birth protocol, Mama FORTH vocabulary, Tripod multi-VM
 fleet (Hera/Artemis/Hestia — Hermes moved into the kernel as kernel-Hermes, FABRIC-3.6.md
 Phase 4, 2026-09-22), and word-level ACL (Phases 1–7) are live; POST at boot verifies parity
-hash across amd64/aarch64/riscv64 with a 530-word Mama capsule dictionary (word count as of
-the Phase 4 strip; verify against a live `PARITY:M7.1a word_count=` line before citing, it
+hash across amd64/aarch64/riscv64 with a 526-word Mama capsule dictionary (word count as of
+2026-10-14, `FABRIC-3.md` §XXXVIII, hash `0x82f4ae7cb2e2d424`; verify against a live `PARITY:M7.1a word_count=` line before citing, it
 changes with any new C word registration).
 
 **Key distinguishing features:**
@@ -433,7 +436,7 @@ UEFI Firmware → uefi_loader.c (BOOTX64.EFI / BOOTAA64.EFI / BOOTRISCV64.EFI)
 - ✅ M0–M6: complete, v1.5.1-FINAL
 - ✅ M7: StarForth VM integration + parity validation, complete
 - 🔄 M7.1: capsule birth protocol · Mama FORTH vocabulary · Tripod fleet · word-level ACL —
-  in progress (Phase 8 PKI is the open item, see ACL section above)
+  in progress (Phase 8 PKI closed 2026-10-14, see ACL section above)
 - Planned: M8 (REPL keyboard input), M9 (block storage — see the virtio note above; source
   exists but milestone-complete status not independently verified here)