Phase 5 close-out: Isabelle pass, doc sweep, SBOM, version bump (FABRIC-3.6.md tasks 5.1-5.4)

5.1: Isabelle/HOL pass (52 theories, clean) -- restated the boundary rather
than just citing the green build: proof/ scope was already entirely
outside this reshuffle's footprint (src/starkernel/, capsules/*.4th),
so the boundary is unchanged, not moved.

5.2: Documentation sweep. CLAUDE.md's stale WIP banner and Tripod fleet
description updated now that Phases 0-4 have actually landed (Hera/
Artemis/Hestia, no Hermes). MANIFEST.md rides the strip -- hermes/init.4th's
block table replaced with a deletion note, init.4th/doe-campaign.4th/
hestia/init.4th entries corrected to match the post-strip live files.
Confirmed the TRIPOD.md/0.1 contradiction was already resolved (2026-08-13).
Settled the superseded-docs call explicitly: archive as-is, do not rewrite.
Fixed experiments/bare_metal/README.md's block-size framing (still said
1024-byte budget; real rule is 64 chars x 16 lines). K-qualification
checked clean against the two living documents; full retroactive sweep
of the closed archival FABRIC corpus explicitly declined as disproportionate.

5.3: make sbom. Installed syft (user-local, approved). Found and fixed a
real Makefile bug while at it -- the sbom target hardcoded
--source-name StarForth, so DocumentName was wrong even after regenerating.

5.4: LITHOS_VERSION 2.0.0 -> 2.1.0, engine VERSION 3.1.0 -> 3.2.0 (minor,
per the dictionary-visible-only rule). Replaced the stale version-comment
block in Makefile.starkernel (had the odd/even LTS rule backwards) and
docs/lithosananke/ROADMAP.md's retired versioning-policy section with the
ratified ladder. Verified on all three architectures; riscv64's first pass
hit a transient virtio_blk timeout during boot-time Zuse genesis mint,
reported and confirmed non-reproducing on an immediate clean retry.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -11,20 +11,31 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 > **Superseded subsystem docs (Captain Bob, 2026-08-15):** `.claude/TRIPOD.md`,
 > `.claude/HERMES.md`, `.claude/ARTEMIS.md`, and `.claude/CONSOLE.md` are all superseded —
 > `FABRIC-0.md`, `FABRIC-1.md`, and `FABRIC-2.md` (all design history/archival as of
-> 2026-09-04) and `FABRIC-3.md` (current/living, topic: bare metal boot, read this one first)
-> are the sole authoritative source for Tripod/Hermes/Artemis/Console work now. The four
-> subsystem docs remain in the repo as historical record only; each carries its own
-> superseded-header pointing here. Do not treat them as current, do not read them for design
-> authority, and do not cite them in place of `FABRIC-0.md`/`FABRIC-1.md`/`FABRIC-2.md`/
-> `FABRIC-3.md`.
+> 2026-09-04), `FABRIC-3.md` (current/living, topic: bare metal boot), and `FABRIC-3.5.md`/
+> `FABRIC-3.6.md` (Tripod/kernel reshuffle, design + execution) are the sole authoritative
+> source for Tripod/Hermes/Artemis/Console work now. The four subsystem docs remain in the
+> repo as pure historical record — they describe the pre-reshuffle Hera/Hermes/Artemis fleet,
+> and `.claude/HERMES.md` in particular now describes a VM that no longer exists in this
+> codebase at all, not merely a superseded design. Each carries its own superseded-header
+> pointing here. Do not treat them as current, do not read them for design authority, and do
+> not cite them in place of `FABRIC-0.md`/`FABRIC-1.md`/`FABRIC-2.md`/`FABRIC-3.md`/
+> `FABRIC-3.5.md`/`FABRIC-3.6.md`. **Decision (Captain Bob, 2026-09-22, FABRIC-3.6.md task
+> 5.2): archive as-is, do not rewrite.** These four docs stay frozen at their 2026-08-15
+> superseded state; they are not updated to reflect Hermes's removal, since they are already
+> explicitly out of scope for current design authority and rewriting historical record to
+> track a codebase it no longer describes would defeat its purpose as a record.
 
-> **WORK IN PROGRESS — Tripod/kernel reshuffle (2026-09-19).** Hermes moves into the kernel;
-> the Tripod becomes **Hera / Artemis / Hestia**. Design is complete and ruled in
-> **`FABRIC-3.5.md`** (authoritative); execution is tracked in **`FABRIC-3.6.md`** — **start
-> there, at its `START HERE` section.** `FABRIC-3.md` remains open and authoritative for its
-> own topic (bare metal boot); nothing in the reshuffle supersedes it. **No reshuffle code has
-> been written yet.** The descriptions of the Tripod elsewhere in this file describe the
-> *current* fleet (Hera/Hermes/Artemis) and stay correct until the reshuffle lands.
+> **Tripod/kernel reshuffle — Phases 0–4 COMPLETE (2026-09-22); Phase 5 close-out in
+> progress.** Hermes moved into the kernel as kernel-Hermes (`src/starkernel/vm/kernel_
+> hermes.c`); the Tripod is now **Hera / Artemis / Hestia** — **the Hermes VM, `capsules/
+> hermes/init.4th`, and `capsules/common/messaging.4th` no longer exist in this codebase.**
+> Design is complete and ruled in **`FABRIC-3.5.md`** (authoritative); execution is tracked in
+> **`FABRIC-3.6.md`**. `FABRIC-3.md` remains open and authoritative for its own topic (bare
+> metal boot); nothing in the reshuffle supersedes it. **The Tripod/fleet descriptions
+> elsewhere in this file have been updated to match** (Hera/Artemis/Hestia, no Hermes) — this
+> is no longer a "stays correct until it lands" caveat, it already landed. Remaining:
+> Isabelle pass ✅, doc sweep (this note) ✅, SBOM/version bump/master-merge still open — see
+> `FABRIC-3.6.md` Phase 5 for status.
 
 > **Scope:** This repo is LithosAnanke — the bare-metal UEFI kernel that boots StarForth
 > directly on hardware. StarForth (the hosted FORTH-79 VM) has its own separate repository
@@ -181,8 +192,11 @@ userspace runtime. No libc, no traditional OS underneath. It is the bare-metal t
 removed as an active target.)
 
 **Current status: M7.1** — capsule birth protocol, Mama FORTH vocabulary, Tripod multi-VM
-fleet (Hera/Hermes/Artemis), and word-level ACL (Phases 1–7) are live; POST at boot verifies
-parity hash across amd64/aarch64/riscv64 with a 453-word Mama capsule dictionary.
+fleet (Hera/Artemis/Hestia — Hermes moved into the kernel as kernel-Hermes, FABRIC-3.6.md
+Phase 4, 2026-09-22), and word-level ACL (Phases 1–7) are live; POST at boot verifies parity
+hash across amd64/aarch64/riscv64 with a 530-word Mama capsule dictionary (word count as of
+the Phase 4 strip; verify against a live `PARITY:M7.1a word_count=` line before citing, it
+changes with any new C word registration).
 
 **Key distinguishing features:**
 
@@ -191,9 +205,11 @@ parity hash across amd64/aarch64/riscv64 with a 453-word Mama capsule dictionary
 - Content-addressed, immutable **capsules** as the primary organizational unit — no dynamic
   allocator in the traditional sense; identity is a content hash (XXHash64), mutation
   produces a new capsule
-- **Tripod** — a named multi-VM fleet (Hera the Mama VM, two Hermes instances, Artemis)
-  that births, runs, and re-births independently; verified booting live pre-REPL on all
-  three architectures. See `.claude/TRIPOD.md`, `.claude/HERMES.md`, `.claude/ARTEMIS.md`.
+- **Tripod** — a named multi-VM fleet (Hera the Mama VM, Artemis, Hestia) that births, runs,
+  and re-births independently; verified booting live pre-REPL on all three architectures.
+  Hermes moved into the kernel as kernel-Hermes (`src/starkernel/vm/kernel_hermes.c`) and is
+  no longer a Tripod VM — see `FABRIC-3.5.md`/`FABRIC-3.6.md`, not the archived
+  `.claude/TRIPOD.md`/`.claude/HERMES.md`/`.claude/ARTEMIS.md`.
 - Word-level ACL security system with kernel parity (see above) — measured overhead three
   orders of magnitude below the measurement floor
 - Kconfig-based build configuration (~40 discoverable symbols spanning physics/heartbeat/