LithosAnanake/capsules/MANIFEST.md

# capsules/MANIFEST.md — Block Ownership Registry (justifications)
# StarshipOS / StarForth — Captain Bob (Robert Allan James)
# This document is authoritative for WHY each block is where it is and
# whether it's immutable. For WHICH blocks exist and their current
# content hash, see capsules/BLOCK_MAP.md — auto-generated by
# `make -f Makefile.starkernel manifest` (or on every kernel build),
# never hand-edited. If the two ever disagree on a block NUMBER,
# BLOCK_MAP.md is correct; this document's numbers need updating.
# Any new capsule MUST claim a range and get a justification row here
# before first commit. Collisions are marked ⚠️ — resolve before
# production bake.

---

## How to Read This Document

Each entry lists:
- **File** — path relative to `capsules/`
- **Blocks** — LBN range(s) claimed (cross-check against `BLOCK_MAP.md`)
- **Immutable** — block is locked for life; reason given
- **Justification** — why each block or range lives where it does

The block namespace is shared across all loaded capsules. `mkcapsule.c` bakes
every `.4th` file into the kernel image. If two capsules claim the same block
and are loaded together, the later-loaded definition wins in block RAM.
Definitions already compiled into the dictionary are unaffected, but LOADing
that block again would give wrong results. Flag collisions; resolve before
production bake. Run `mkcapsule --manifest capsules` (or `make -f
Makefile.starkernel manifest`) before adding any new capsule — it reports
conflicts directly, no need to hand-check against the tables below.

For the full current block-to-capsule map (LBN, capsule, content hash,
conflict status), see **`capsules/BLOCK_MAP.md`** — regenerated
automatically on every `Makefile.starkernel` build, so it never drifts.
This document intentionally no longer duplicates that map; it only carries
the parts a tool can't generate — the justification for each block and the
history of how the layout got here.

---

## Mama VM Personality Capsules

Mama VM is the root VM (Hera). Exactly one Mama personality is active at a time.
All entries in this section are mutually exclusive — they are never loaded together.

### `init.4th` — Default Mama personality

Blocks: **2049–2052, 2057**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2049  | No        | Hera VM init: `VM-TREE`/`VM-PARENT`/`VM-CHILDREN`; loads `ACL.4th`, `block-acl.4th`, `zuse-eligibility.4th`, `lib.4th`. **Corrected 2026-09-19 (three times)** — first pass removed a stale listing of `compudynamics`/`common:msg`/`fleet-k`/`process` (none loaded here; two already-deleted, two stripped in the same pass, FABRIC-3.6.md tasks 0.2/0.3). Second pass (same day): `fabric.4th`/`font.4th` **removed** from this list — relocated to `hestia/init.4th` (FABRIC-3.6.md tasks 1.6/1.7), Hera no longer loads either. Third pass (2026-09-22, FABRIC-3.6.md Phase 4 Stage E): `common:messaging.4th` + `MSG-CD-INIT` **removed** — the file itself is deleted (see "Deleted capsules" below); every FORTH-owned message type was cut over to kernel-Hermes first (Phase 3) |
| 2050  | No        | BOOT-BANNER call — separated so the banner block can be swapped without touching init logic |
| 2051  | No        | TRIPOD-TEST — 6 acceptance gates per TRIPOD.md. Dead EVENT-WAIT step replaced with HERMES-TICK liveness check (`3436d564`) |
| 2052  | No        | TRIPOD-TEST invocation block |
| 2057  | No        | BOOT-BANNER word definition (reusable across Mama variants) |

Note: 2048 is the kernel ramdrive entry point. `init.4th` starts at 2049 intentionally
(2048 = PERSONALITY block, loaded separately by the capsule birth protocol).

### `doe.4th` — DoE Mama personality

Blocks: **2100–2107**

Moved from 2049–2056 (2026-07-05) — that range collided with `init.4th`'s
real blocks (2049–2052). Alternate-personality status doesn't excuse a real
LBN clash when both capsules are baked into the same binary; renumbered
into the range this doc had already earmarked for `doe.4th` ("2100–2199")
but the file itself had never actually used. See Conflict Register C2.

**Note (2026-07-08):** the table below previously described generic
lifecycle-stage content ("loop control", "teardown / flush") that didn't
match any of this file's actual blocks. Rewritten to match the live file.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2100  | No        | Factor threshold constants (`ENT-HI`/`CV-HI`/`TMP-HI`/`STB-HI`) + run-matrix sizing (`N-CFG`/`N-REPS`/`N-RUNS`) |
| 2101  | No        | Serial output primitives: `N.`/`COMMA`/`CRLF`/`CSV-COL`/`CSV-LAST`/`CSV-HEADER` |
| 2102  | No        | Factor extraction + apply: `CFG-ENT`/`CFG-CV`/`CFG-TMP`/`CFG-STB`/`APPLY-CFG` (drives `L8-UPDATE`/`L8-APPLY`) |
| 2103  | No        | `DOE-WORK`: the arithmetic workload itself (~5000-iteration loop, ~35000 word executions) |
| 2104  | No        | Run matrix: `RUN-MATRIX` (`CREATE`...`ALLOT`) + `MATRIX!`/`MATRIX@`/`SWAP-MTX`/`INIT-MATRIX`. Not fully immutable: `CREATE` allocates memory at compile time |
| 2105  | No        | Fisher-Yates shuffle (`SHUFFLE-MATRIX`) over the run matrix |
| 2106  | No        | `EMIT-ROW`: CSV row emitter, pulls inference-engine state (`INFER-RUN`, `L8-MODE`, `WINDOW-DIVERSITY`, etc.) |
| 2107  | No        | `EXEC-DOE`/`DOE`: main entry point — seeds, shuffles, runs the full matrix, emits CSV |

### `workload-4.4th` — Mama variant (numbered)

Blocks: **2130–2132**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2130  | No        | Mama variant init logic |
| 2131  | No        | Variant personality block 2 |
| 2132  | No        | Variant personality block 3 |

### `workload-7.4th` — Mama variant (numbered)

Blocks: **2150**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2150  | No        | Single-block Mama variant |

### `workload-8.4th` — Mama variant (numbered)

Blocks: **2160**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2160  | No        | Single-block Mama variant |

### `workload-0.4th` — Mama variant (numbered)

Blocks: **2200–2201**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2200  | No        | Mama variant init |
| 2201  | No        | Mama variant personality continuation |

### `workload-6.4th` — Full-range Mama variant

Blocks: **2080–2095**

Moved from 2048–2063 (2026-07-05). That range put both `workload-6.4th` and
its byte-identical twin `init-l8-omni.4th` on top of `init.4th`'s real
blocks (2049–2052, 2057) — a genuine collision the original Conflict
Register missed by only tracking "6 vs omni" (C1) and "init vs doe" (C2)
as separate entries, never checking omni/6 against `init.4th` itself. See
Conflict Register C1.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2080–2095 | No   | Full Mama personality suite: 16 blocks covering init, loop control, L8 hooks, workload dispatch, banner, teardown |

### `init-l8-omni.4th` — L8 Jacquard omni Mama variant

Blocks: **2064–2079**

Moved from 2048–2063 (2026-07-05), for the same reason as `workload-6.4th`
above. `init-l8-omni.4th` is byte-identical to `workload-6.4th` (same content,
same xxHash64) — presumably a copy-forward placeholder awaiting real L8
Jacquard omni-mode content that was never written. Given as a separate
capsule anyway (rather than deleted) since it's referenced by name
elsewhere as the L8-enabled variant; flagging the duplication here for
visibility, not resolving it — that's a content decision, not a block
numbering one.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2064–2079 | No   | L8 Jacquard omni Mama personality; currently identical content to workload-6.4th (see note above) |

### `workload-5.4th` — Raw code capsule (no block format)

Blocks: **none** (no `Block N` headers)

`workload-5.4th` defines words inline without FORTH block formatting. It is a raw
code capsule compiled directly into the dictionary at load time. It does not
claim any LBN slot and cannot be LOADed by number. This is intentional for
volatile/chaos workloads where block-structured layout adds no value.

---

## Workload Capsules (4406–4849)

Exactly one workload capsule is active per DoE run — never co-loaded with
another. Moved off 3001–3060 (2026-07-05): that range was shared verbatim
across all 9 workload capsules on the theory that "mutually exclusive, so
sharing is fine" — the same reasoning that masked C1/C2 above, and true
only in the narrow sense that boot-time compilation reads capsule text
straight from the in-memory payload. The `write_ramdrive_block` re-cache
step (so a human can later type `N LOAD`) goes through the real block
subsystem, and 9 capsules pointing at the same LBN for that step meant only
the last-loaded one's text was ever recoverable that way — worth cleaning
up even though nothing observable broke. See Conflict Register C3.

Each capsule now owns a private, non-overlapping range. The numbered
non-L8 workloads keep their original sparse per-phase spacing (still room
to add a phase without renumbering); the contiguous L8 workloads keep their
original contiguous style, just relocated.

### `workload-1.4th` — Non-L8 workload, 4 phases

Blocks: **4406, 4415, 4425, 4435**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4406  | No        | Workload entry point |
| 4415  | No        | Phase 2 workload words |
| 4425  | No        | Phase 3 workload words |
| 4435  | No        | Phase 4 workload words |

### `workload-2.4th` — Non-L8 workload, 5 phases

Blocks: **4506, 4515, 4525, 4535, 4545**

Same sparse slot pattern as `workload-1.4th`, own private hundred-block zone,
plus one additional phase block.

### `workload-3.4th` — Non-L8 workload, 7 phases

Blocks: **4606, 4615, 4625, 4635, 4645, 4655, 4665**

Largest non-L8 workload. Own private hundred-block zone with room for
three more phases (4675, 4685, 4695) before needing a new zone.

### `workload-9.4th` — Non-L8 workload, 5 phases

Blocks: **4706, 4715, 4725, 4735, 4745**

Structurally identical slot pattern to `workload-2.4th`; different workload content.

### `init-l8-stable.4th` — L8 stable mode workload

Blocks: **4806**

Single-block workload. Stable mode = low CV, minimal variability. One block suffices.

### `init-l8-volatile.4th` — L8 volatile mode workload

Blocks: **4810–4813**

Four blocks. Volatile mode generates high-CV execution patterns requiring more
definition space.

### `init-l8-diverse.4th` — L8 diverse mode workload

Blocks: **4820–4822**

Three blocks. Diverse mode cycles across word categories.

### `init-l8-temporal.4th` — L8 temporal mode workload

Blocks: **4830–4831**

Two blocks. Temporal mode generates time-varying access patterns.

### `init-l8-transition.4th` — L8 transition mode workload

Blocks: **4840–4842**

Three blocks. Transition mode exercises mode-switching boundary behavior.

---

## Infrastructure Capsules (4000+)

Infrastructure capsules are permanent system libraries. Multiple may be loaded
simultaneously. Block assignments in this range are non-overlapping except
where explicitly flagged.

**Everything in this range lives on Artemis's disk, not the ramdrive.**
The kernel ramdrive is exactly 1024 blocks, LBN 2048–3071 (`KRD_MAX_BLOCKS`
in `capsule_loader.c`). Artemis's virtio-blk disk is attached immediately
after as the next device in the block subsystem's LBN-ordered slot chain
(`kernel_main.c`, `blk_subsys_attach_device`), starting at LBN 3072 — which
is also `ART-HDR-LBN`, the very first byte of Artemis's own on-disk header.
So every block number in this section (4000+) resolves through
`blk_get_buffer()`'s device routing to Artemis's persistent disk image
(`disk/artemis.img`), not a scratch buffer. This has been true since these
capsules were first numbered — it isn't new. It's provably harmless for
boot correctness (`capsule_load_blocks` compiles word definitions straight
from the in-memory payload; the block-subsystem write is only a courtesy
copy so a human can later type `N LOAD` interactively), but it does mean
every boot writes capsule source text over whatever LBNs 4000+ map to on
Artemis's disk — which is why `disk/artemis.img` shows a binary diff after
every acceptance run. Keep this in mind before claiming new blocks in the
"OPEN"/"UNASSIGNED" ranges below: they are disk offsets, not free RAM.

### `ACL.4th` — Word-level ACL system

Blocks: **4000–4007, 4015**

**Note (2026-07-08):** rows 4001–4007 below were previously wrong in every
row (describing `ACL-BOOT-STRICT`/`ACL-BOOT-PERMISSIVE`/`ACL-PERMISSIVE-MODE`/
`ACL-TTL-TICK` — none of which exist — and misplacing content between rows,
e.g. claiming zuse.4th loads from 4007 when that call is actually in 4015).
Corrected this pass by reading the live file directly.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4000  | Yes       | `ACL-STRICT-MODE`/`ACL-TTL-MODE-VAL`/`ACL-BASE-TTL`/`ACL-MAX-TTL` constants. Immutable: changing these alters security semantics of all downstream capsules |
| 4001  | No        | `ACL-ENTRY` ( xt -- xt ): identity word for API symmetry. Not immutable: cosmetic, safe to extend |
| 4002  | Yes       | `ACL-STRICT` / `ACL-TTL-MODE`: pin-guarded mode selector words. Immutable: mode selection is a load-bearing policy operation |
| 4003  | Yes       | `ACL-TTL-COMPUTE`: adaptive TTL formula (heat/4 + `ACL-BASE-TTL`, capped at `ACL-MAX-TTL`). Immutable: formally verified in `ACL_TTL_Bounded.thy`; core enforcement math |
| 4004  | Yes       | `ACL-RECHECK`: cold-path policy called by C `acl_recheck()` at TTL=0. Immutable: core enforcement path; changes here affect every word execution under ACL |
| 4005  | Yes       | `ACL-BOOT`: stamps default ACL via `ACL-INIT-PRIMITIVES`, pins `EXEC`/`BYE`/`ACL-RECHECK`/`ACL-INIT-PRIMITIVES`, self-pins. Immutable: self-activation runs once at boot; must be stable |
| 4006  | Yes       | `ACL-CA-KEY-LO`/`ACL-CA-KEY-HI`: Ed25519 CA root public key placeholders. Immutable: capsule hash is the root-of-trust fingerprint; any change rejects the birth protocol |
| 4007  | No        | Self-activation placeholder comment + historical note on the removed RWT mechanism (see 4008–4014 below). Not immutable: comment-only content |
| 4008–4014 | —     | UNASSIGNED. Formerly the "ACL Rolling Window of Truth" (RWT) TTL mechanism (ring buffer, slope inference, `ACL-RECHECK-RW`, `ACL-BOOT-RW`). Removed 2026-07-08: it was dead code from the day it was written — the C hot path's `acl_recheck()` looks up the word literally named `ACL-RECHECK` (11 chars), never `ACL-RECHECK-RW` (14 chars), so nothing ever reached this mechanism regardless of `ACL-BOOT-RW` pinning it. It was never covered by `ACL_TTL_Bounded.thy` despite this table's prior claim otherwise. Also removed: 4 backing `DictEntry` fields (`acl_rwt[8]`/`acl_rwt_head`/`acl_rwt_count`/`acl_rwt_slope`) that violated the project's own four-field ACL limit, and 6 orphaned C primitives (`ACL-RWT-*`) in `src/word_source/acl_words.c`. |
| 4015  | Yes       | Self-activation: runs `ACL-BOOT` (the real, live boot function defined at 4005), then `S" zuse.4th" EXEC`. Immutable: runs once at boot |

### `zuse.4th` — Bootstrap superuser

Blocks: **4016–4018**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4016  | Yes       | ZUSE-CERT-LO / ZUSE-CERT-HI constants. Immutable: capsule hash = root of superuser trust; changing breaks PKI chain |
| 4017  | Yes       | ACL-ZUSE-BOOT: authenticates session + pins zuse words. Immutable: this is the sole path to zuse_session=1; must not be alterable post-boot |
| 4018  | Yes       | Self-activation (ACL-ZUSE-BOOT). Immutable: runs once at boot |

### `lib.4th` — Shared serial output + FORTH aliases

Blocks: **4050**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4050  | No        | N. COMMA CRLF CSV-COL CSV-LAST Q.SHOW USE RUN. Not immutable: these are utilities; adding words is safe. Removing or renaming existing words requires audit of all callers |

### `doe-campaign.4th` — DoE campaign harness

Blocks: **4060–4065**

**Note (2026-07-08):** this table previously described fictional content
(e.g. "CSV output formatting", "statistical reduction words") that never
matched the file at any point on record. Rewritten to match the actual
content, migrated this pass off the deleted `compudynamics.4th`/
`fleet-k.4th` primitives onto the `VM-PHYSICS-STATUS`/`VM-CONSERVED?`
mechanism — see (historical) `hermes/init.4th` block 4153 and
`capsules/artemis/init.4th` block 4852 for the companion `LOAD-DOE` fix
this migration also required.

**Note (2026-09-22, FABRIC-3.6.md Phase 4 Stage E):** `SETUP-HERMES` and every
Hermes touch in `PHASE1-DOE`/`CD-TICK`/`SMOKE-CAMPAIGN` removed — Hermes no
longer exists. Every block below is now Artemis-only.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4060  | No        | `SETUP-ARTEMIS`/`SETUP-VMS`: `BIRTH` + remote `LOAD-DOE` VM-EXEC on Artemis. Not immutable: setup sequence may grow |
| 4061  | No        | `PHASE1-DOE`: real per-VM `DOE-WORK` baseline touch, Artemis only. Historical note: dead `CD-WORK` (index-dispatch, deleted VM-HERA/HERMES/ARTEMIS constants) removed here 2026-07-08 |
| 4062  | No        | `CD-TICK`/`CD-DOE`: one real fleet-touch pass (`VM-EXEC "DOE-WORK"` on Artemis), looped N times. `CAMPAIGN-STATUS`: `VM-PHYSICS-STATUS` + `VM-CONSERVED?` check. Not immutable: workload/status content may evolve |
| 4063  | No        | `CAMPAIGN`: full campaign — baselines then 30 real fleet touches |
| 4064  | No        | `SMOKE-CAMPAIGN`: 1-rep seed-1959 smoke test + 16 real fleet touches |
| 4065  | No        | `THREE-VM-CAMPAIGN`: loads `doe.4th` locally on Hera, then 48 real fleet touches, all three VMs as Compudynamics peers |

### `hermes/init.4th` — DELETED 2026-09-22 (formerly Hermes VM, the messenger)

**Deleted, FABRIC-3.6.md Phase 4 Stage E (task 4.1).** Formerly blocks
**4100–4109, 4114–4121, 4142–4153** (gaps 4110–4113 and 4122–4141 were always
Artemis's, hard-locked, never Hermes's — see the `artemis/init.4th` entry below,
unaffected by this deletion). Every FORTH-owned message type this file's
`messaging.4th` companion implemented (`BLK-ATTACH-EVENT`, `CONSOLE-CMD-EVENT`,
`ELEVATE-REQUEST`) was cut over to kernel-Hermes first (Phase 3, tasks 3.8–3.10),
verified live on all three architectures at each step; only then was the Hermes
VM itself, this capsule, and `capsules/common/messaging.4th` removed. Full
three-architecture acceptance for the deletion: `logs/20260922-181141/amd64/`,
`logs/20260922-181753/aarch64/`, `logs/20260922-182136/riscv64/` — zero
`UNKNOWN WORD`, identical `dict_hash` across all three. See FABRIC-3.6.md's own
Phase 4 entry for the full account, including one found-not-fixed collateral
defect (`SEND-ELEVATE-REQUEST`, this file's own former caller into
`zuse-eligibility.4th`'s `ELEVATE-GRANT`, is now unreachable — Captain Bob's
2026-09-22 decision: leave it, Phase 8 PKI will build its own entrypoint).
Former blocks 4100–4153 (ex-Artemis-gaps) are now UNASSIGNED — see Unassigned
Ranges below. The per-block justification table this section used to carry
(arena allocator ABI, message/channel field accessors, the VM-name routing
table, channel negotiation, broadcast) is not reproduced here; it is historical
detail about deleted code, recoverable from git history (`git show
<pre-strip-commit>:capsules/hermes/init.4th`) if ever needed again.

**2026-07-05 collision fix (historical, still relevant to Conflict Register
C5 below):** blocks 4142–4150 were previously numbered 4122–4131, directly
colliding with Artemis's real block range, introduced `fca7b09a` (Jul 1),
found and resolved via `mkcapsule --manifest`. See Conflict Register entry C5.

### `artemis/init.4th` — Artemis VM (flat pool disk manager v2)

Blocks: **4110–4113** (core, hard locked) + **4122–4141, 4851–4852** (extended)

★ **HARD LOCKED (4110–4113).** Core Artemis block storage primitives.
They live in the middle of the Hermes range by deliberate layout choice
(Hermes owns 4100–4121 + 4142–4150; Artemis owns 4110–4113 as a protected
island plus its own extended range at 4122–4141). No other capsule may
ever claim these blocks. No tool, script, or automated process may modify
these blocks without Captain Bob's explicit written permission.

Artemis's extended range grew organically across several sessions
(`ed05db25` Artemis BAM, `48b5f726` entry-block renumbering) without a
MANIFEST.md update at each step — this is the range that collided with
Hermes (see above). The table below reflects the actual current footprint.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4110  | Yes       | Constants (ART-HDR-LBN, ART-FM-LBN, ART-DATA-LBN, ART-DATA-BLKS) + Q-DECAY. Immutable: constants define the on-disk geometry; changing them corrupts existing disk images |
| 4111  | Yes       | LE32!/LE32@ — arch-neutral little-endian 32-bit byte I/O. Immutable: on-disk format depends on these; changing byte order corrupts cross-arch images |
| 4112  | Yes       | SHL1N/SHR1N/BIT-TEST/BIT-SET/BIT-CLR — bit manipulation. Immutable: free map correctness depends on these primitives |
| 4113  | Yes       | FM-ADDR-BIT/FM-TEST/FM-SET/FM-CLR — free map core. Immutable: free map ABI; changing breaks allocator |
| 4122  | No        | FM-FIND-FREE/BLK-ALLOC/BLK-FREE. Not immutable: scan strategy may improve (e.g. hint-based) |
| 4123  | No        | ART-MAGIC!/ART-MAGIC? — disk detection primitives. Not immutable: magic check may extend |
| 4124  | No        | ART-BOOT-DETECT/BLK-FETCH/BLK-PERSIST/ART-FLUSH. Not immutable: boot mode may gain additional cases |
| 4125  | No        | ART-HDR-WRITE — on-disk header format. Not immutable: header layout may extend |
| 4126  | No        | ART-FORMAT/ART-RESUME/ART-HALT-UNRECOG. Not immutable: resume path will grow |
| 4127  | No        | ART-STATUS/WELCOME. Not immutable: status may expand |
| 4128  | Yes       | LE64!/LE64@ — depends on LE32!/LE32@ (4111). Immutable: same on-disk format constraint |
| 4129  | —         | UNASSIGNED (former entry block; entry moved to 4133 in `48b5f726`) |
| 4130  | No        | ART-BLANK? — blank block detection. Not immutable: may extend |
| 4131  | No        | ART-INIT — boot state machine. Not immutable: boot cases may grow |
| 4132  | No        | ART-SELF-TEST. Not immutable: may expand |
| 4133  | No        | Entry block — ART-INIT ART-BOOT-ENTRY WELCOME. Numbered after all defs to avoid CAPSULE DEFER; may grow |
| 4134  | No        | ART-WRITE-TEST (persist-write test). Not immutable: test may expand |
| 4135  | No        | ART-READ-TEST (persist-read test). Not immutable: test may expand |
| 4136  | No        | ART-BOOT-ENTRY — boot-mode dispatch. Not immutable: dispatch cases may grow |
| 4137  | Yes       | BLK-HEAT arena (CREATE ... ALLOT). Immutable: CREATE allocates memory at compile time; re-running changes VM memory layout |
| 4138  | No        | BLK-HEAT@/! + LBN>IDX. Not immutable: accessor logic may evolve |
| 4139  | No        | ART-K-TOTAL + ART-COOL. Not immutable: cooling logic may evolve |
| 4140  | No        | ART-REAP + ART-TICK. Not immutable: reap logic may evolve |
| 4141  | No        | CD-INIT — Hera calls this at fleet boot. Not immutable: init sequence may grow |
| 4851  | No        | ART-PING ( -- ): cheap O(1) touch target for Phase 3 fleet DoE workload, unlike ART-TICK/ART-STATUS which scan all ART-DATA-BLKS. Not immutable: may extend |
| 4852  | No        | `LOAD-DOE` ( -- ): `S" doe.4th" EXEC`. Added 2026-07-08 — same missing-word fix as `hermes/init.4th` 4153; `doe-campaign.4th`'s `SETUP-ARTEMIS` calls this remotely. Not immutable: trivial wrapper |

### `hestia/init.4th` — Hestia VM (third Tripod leg, bind point)

Blocks: **4986–4988** (allocated 4986–4996, FABRIC-3.6.md task 1.1; 3 of the 11 used so far)

Added 2026-09-19 (FABRIC-3.6.md tasks 1.2/1.4/1.6/1.7, Tripod/kernel reshuffle — see
FABRIC-3.5.md §II/§IV). Reconstitutes the Tripod as Hera/Artemis/Hestia. Birthed (task 1.4)
and owns the drawing fabric (`fabric.4th`/`font.4th`, tasks 1.6/1.7 — see block 4988).

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4986  | No        | `WELCOME` banner word + call. Not immutable: message text may change |
| 4988  | No        | `S" fabric.4th" EXEC` + `S" font.4th" EXEC` — moved here from `init.4th` (Hera), tasks 1.6/1.7, **merged into one commit rather than done separately as the punchlist originally split them**: `font.4th` calls `G-LINE`/`G-ELLIPSE`, which are `fabric.4th`'s own words, so moving one without the other strands the dependency in whichever VM keeps only half — confirmed live, moving `fabric.4th` alone floods Hera's boot with `UNKNOWN WORD: 'G-LINE'`. Order preserved (`fabric.4th` before `font.4th`), matching `init.4th`'s own prior load order. Not immutable: may grow if more of the drawing/font surface relocates here |
| 4987  | No        | **Rewritten 2026-09-22, FABRIC-3.6.md Phase 4 Stage E.** Originally joined `COMMON-CH` on slot 11 (Hera/Hermes/Artemis held 0/1/2, identities held 3–10, `messaging.4th:78-85`) — that whole `COMMON-CH` concept no longer exists, `messaging.4th` is deleted. Now just `S" lib.4th" EXEC` + `LOG-INFO" Hestia: ready"` + `STARTUP-BANNER`. Not immutable: startup sequence may grow |

### Deleted capsules (historical)

`compudynamics.4th` (formerly 4200–4204) and `fleet-k.4th` (formerly
4400–4405) were deleted in `9323f776` (2026-07-05) — superseded by the
generalized VM fleet physics mechanism (`capsule_vm_physics.c`/`.h`,
`VM-CONSERVED?` / `VM-PHYSICS-STATUS` primitives). See
`docs/working/architecture/VM-PHYSICS-DYNAMIC-FLEET-DESIGN-20260705.md`
and `docs/working/archive/session-logs/2026-07-05-worklog.md`. Their
former ranges are now UNASSIGNED (see Namespace Map).

`common/msg.4th` (formerly 4055) and `process.4th` (formerly 4300–4301)
were deleted 2026-09-19 (FABRIC-3.6.md tasks 0.2/0.3, part of the
Tripod/kernel reshuffle's Category A surgical strip — see FABRIC-3.5.md
§XXII). Both were confirmed dead by all three of §XXII.2's reachability
routes: zero `EXEC` sites in any boot-loaded capsule, and zero callers
anywhere of their exported words (`HERMES-ACK`/`HERMES-NACK` for the
former; `SPAWN`/`PAUSE`/`RESUME`/`KILL-VM` for the latter).
`common/msg.4th`'s block-4055 entry had claimed it was an immutable ABI
"every messaging VM loads at birth" — `FABRIC-2.md:2773` had already
flagged that claim as stale before this correction. `process.4th`'s
removal also took `messaging.4th`'s `EVENT-EMIT`/`EVENT-WAIT`/
`EVENT-DRAIN` (former block 5030) with it, its only live caller. Their
former ranges are now UNASSIGNED (see Namespace Map).

`hermes/init.4th` (formerly 4100–4109, 4114–4121, 4142–4153) and
`common/messaging.4th` were deleted 2026-09-22 (FABRIC-3.6.md Phase 4 Stage E,
tasks 4.1/4.3), the final step of the Tripod/kernel reshuffle — the Hermes VM
itself and its FORTH messaging layer, superseded by kernel-Hermes
(`src/starkernel/vm/kernel_hermes.c`) after every live message type was cut
over in Phase 3 (see the `hermes/init.4th` entry above for the full account).
Their former ranges are now UNASSIGNED (see Namespace Map). This is the same
"cut over first, delete after, one commit per Category B item, verified on all
three architectures" discipline `compudynamics.4th`/`fleet-k.4th` and
`common/msg.4th`/`process.4th` were deleted under above.

---

## Unassigned Ranges

| Range       | Status      | Notes |
|-------------|-------------|-------|
| 0–2047      | KERNEL      | VM internal; never use in capsules |
| 2053–2056, 2058–2063 | UNASSIGNED | init.4th extension space (after its real 2049–2052,2057) |
| 2096–2099   | UNASSIGNED  | Between workload-6.4th and doe.4th |
| 2108–2129   | UNASSIGNED  | doe.4th extension space (within its 2100–2199 range) |
| 2133–2149   | UNASSIGNED  | Between init-4 and init-7 variants |
| 2151–2159   | UNASSIGNED  | Between init-7 and init-8 variants |
| 2161–2199   | UNASSIGNED  | Between init-8 and init-0 variants |
| 2202–2999   | UNASSIGNED  | Open for future Mama variants |
| 3001–3999   | UNASSIGNED  | Freed by the 2026-07-05 workload renumbering (was 3001–3060, shared across all 9 workload capsules — see C3). NOTE: LBN 3072+ is Artemis's virtio-blk disk, not ramdrive — see the callout above the Infrastructure Capsules section before claiming anything here |
| 4008–4009   | UNASSIGNED  | ACL extension space |
| 4019–4049   | UNASSIGNED  | ACL / zuse extension space |
| 4051–4054   | UNASSIGNED  | lib.4th extension space |
| 4055–4059   | UNASSIGNED  | Former `common/msg.4th` range (deleted 2026-09-19, FABRIC-3.6.md task 0.2) |
| 4066–4099   | UNASSIGNED  | doe-campaign extension space |
| 4100–4153   | UNASSIGNED  | Former `hermes/init.4th` range (deleted 2026-09-22, FABRIC-3.6.md Phase 4 Stage E task 4.1). Excludes 4110–4113/4122–4141, which were always Artemis's, hard-locked, unaffected |
| 4154–4199   | UNASSIGNED  | Hermes extension space (post-4153), now moot along with 4100–4153 above |
| 4200–4299   | UNASSIGNED  | Former compudynamics.4th range (deleted `9323f776`) |
| 4300–4399   | UNASSIGNED  | Former `process.4th` range (deleted 2026-09-19, FABRIC-3.6.md task 0.3) |
| 4400–4405   | UNASSIGNED  | Former fleet-k.4th range (deleted `9323f776`) |
| 4410–4414, 4420–4424, 4430–4434 | UNASSIGNED | workload-1.4th's private zone, room for growth |
| 4986–4996   | CLAIMED     | `hestia/init.4th`, allocated 2026-09-19 (FABRIC-3.6.md task 1.1, Tripod/kernel reshuffle) — file not yet created (task 1.2). Sits between `font.4th`'s last block (4985) and the console proxy's hardcoded `Block 4997` (`capsule_console.c:27-29`) — chosen specifically to avoid 4997, per §XVIII.4 |
| 4853–4985, 4998+ | OPEN   | Future capsules — claim here first (excludes 4900–4985, already `fabric.4th`/`font.4th`, and 4986–4996, now claimed above) |

---

## Conflict Register

| ID  | Blocks    | Capsule A       | Capsule B           | Risk     | Resolution |
|-----|-----------|-----------------|---------------------|----------|------------|
| C1  | ~~2048–2063~~ | workload-6.4th  | init-l8-omni.4th / init.4th | Resolved (was mislabeled Low — the pair also silently overlapped `init.4th`'s real blocks, missed because the register only tracked "6 vs omni") | `init-l8-omni.4th` moved to 2064–2079; `workload-6.4th` moved to 2080–2095. Both now clear of `init.4th` (2049–2052,2057) and of each other. |
| C2  | ~~2049–2056~~ | init.4th    | doe.4th             | Resolved (was real — both baked into the same binary; "never co-loaded" doesn't stop a shared-manifest ambiguity) | `doe.4th` moved to 2100–2107, the range this doc had already earmarked for it but the file never actually used. |
| C3  | ~~3001–3060~~ | init-1..3,9 | init-l8-*.4th       | Resolved (was real for the `N LOAD` re-cache path — see the disk-routing callout above the Infrastructure Capsules section; harmless for boot compilation, still worth fixing) | Each of the 9 workload capsules moved to its own private range in 4406–4842; sparse per-phase spacing preserved for the numbered non-L8 workloads. |
| C4  | ~~4010–4012~~ | ACL.4th     | zuse.4th            | Resolved   | zuse.4th moved to 4016–4018; no overlap |
| C5  | ~~4122–4128,4130–4131~~ | hermes/init.4th | artemis/init.4th | Resolved (was real — both VMs co-loaded every boot, unlike C1–C3's mutually-exclusive personalities) | Introduced `fca7b09a` (Jul 1), undetected for 4 days — `mkcapsule`'s build path runs no conflict check, only `--manifest` does. Found while syncing this doc. Hermes's colliding blocks renumbered to 4142–4150; Artemis untouched. Reverified with a clean amd64 TRIPOD-TEST boot, including Hermes kill/rebirth reproducing an identical `dict_hash` before and after. |

`mkcapsule --manifest capsules` reports **zero conflicts** as of this
renumbering (2026-07-05) — verify with the same command before adding any
new capsule.

---

*This document is authoritative for capsule block assignments.*
*Last updated: 2026-07-05 — C1/C2/C3 resolved: eliminated every remaining
documented "safe by design" overlap, not just the real C5 one. workload-6.4th
and init-l8-omni.4th (byte-identical) moved off init.4th's range; doe.4th
moved into its own already-documented 2100–2199 range; all 9 workload
capsules moved off the shared 3001–3060 range into private zones at
4406–4842. Added a callout that LBN 3072+ (everything infrastructure
capsules and workload capsules now occupy) is Artemis's virtio-blk disk,
not a ramdrive — discovered while sizing free space for this renumbering.
Reverified with a full three-arch (amd64/aarch64/riscv64) TRIPOD-TEST
boot: zero FAIL lines, matching dict_hash at every checkpoint on all three
architectures, identical to the pre-renumbering baseline (the moved
capsules aren't in the default Tripod boot path).*

*Doc-debt pass, 2026-07-08 — every block-table row was checked directly
against the live `.4th` files and `mkcapsule --manifest`'s authoritative
block map (not against this document's own prior claims). Corrected:
`ACL.4th`'s entire 4001–4007 table (every row previously described words
that don't exist, e.g. `ACL-BOOT-STRICT`); `doe-campaign.4th`'s entire
table (previously fictional, e.g. "CSV output formatting" — real content
is `SETUP-VMS`/`CD-TICK`/`CAMPAIGN`, migrated this same pass off the
deleted `compudynamics.4th`/`fleet-k.4th` primitives); `doe.4th`'s entire
table (block-shifted against real content); missing `hermes/init.4th`
blocks 4151–4153 and `artemis/init.4th` blocks 4851–4852 (both existed in
source, undocumented, before this pass — 4153/4852 are new `LOAD-DOE`
definitions added this session to fix a second bug found while migrating
`doe-campaign.4th`: it was never defined on either VM). Zero conflicts
per `mkcapsule --manifest capsules`; three-arch QEMU acceptance run for
the `doe-campaign.4th`/`hermes`/`artemis` changes (commit `e2f30bfe`)
before this doc pass. Not re-verified this pass: whether every other
still-unflagged row elsewhere in this document matches source exactly —
this was a targeted correction of the rows touched by recent work plus
`doe.4th`/`ACL.4th`, not a full line-by-line re-audit of all ~250 blocks.*

*Doc-debt pass, 2026-09-22 — MANIFEST.md updated to ride the Tripod/kernel
reshuffle's Category B strip (FABRIC-3.6.md Phase 4 Stage E, task 5.2 close-out
sweep, §XXII.5). `hermes/init.4th`'s block-by-block table replaced with a
deletion note (git history retains the detail); `common/messaging.4th`'s
deletion recorded in "Deleted capsules"; `init.4th` block 2049,
`doe-campaign.4th` blocks 4060–4062, and `hestia/init.4th` block 4987 updated
to match the post-strip live files (verified by direct read, not by this
document's own prior claims, same discipline as every other pass here).
Former Hermes range (4100–4153, excluding Artemis's hard-locked 4110–4113/
4122–4141) marked UNASSIGNED. Not re-verified this pass: the ~230 other rows
this strip didn't touch.*