diff --git a/FABRIC-3.7.md b/FABRIC-3.7.md
index deba8630..c99187c9 100644
--- a/FABRIC-3.7.md
+++ b/FABRIC-3.7.md
@@ -185,6 +185,17 @@ Corrected per §2's re-read above. Concretely, when Phase 8 next picks this up:
   `feedback_no_knowledge_factor_identity`) — **do not revisit a knowledge-factor approach here.**
   Any future work in this space needs a fundamentally different mechanism (not something typed
   and known) or stays an accepted limitation.
+- **Phase 8 v3, 2026-09-23 — done, a distinct and narrower concern from the item above.** The
+  "accepted limitation" above is about a drive image copied *outside* StarshipOS entirely (e.g.
+  imaged on an external computer) — that's still accepted, unchanged by this item. Captain Bob
+  separately asked to close a narrower, different threat: **cloning a device's block content
+  from *within* StarshipOS's own console**, using its own stock, unpinned words
+  (`<src> BLOCK <dst> BUFFER 1024 MOVE`/`RELOCATE-BLOCK`). That's now closed — `MOVE`/`CMOVE`/
+  `CMOVE>`/`RELOCATE-BLOCK` all refuse a same-VM, cross-device copy, verified live on all three
+  architectures. See `/home/rajames/.claude/plans/jiggly-cuddling-stallman.md`'s "Phase 8 v3"
+  section for the full design and verification record. The identity record itself
+  (seed/pubkey/cert) was already unreachable from FORTH before this — this closes the one real
+  gap the research found: ordinary block content, not the identity record.
 
 ## 5. What this document is not