Build capsules/per-isa-doe.4th: per-ISA campaign driver (N=3, 18 trials/ISA)

Thin wrapper over multiuser-doe.4th's own MU-EXEC-CAMPAIGN, which already
implements the ratified 6-cell factorial generically -- adds only what
FABRIC-3.md §XXXIV.4's per-ISA pivot needed: one fixed seed per ISA,
N=3 reps/cell=18 trials/ISA (ratified over §XXXV.5's own N=2 safety-margin
recommendation, Captain Bob's explicit choice), an ISA tag threaded into
the trial marker so records from all 3 ISAs' sequential campaigns can be
told apart on the shared disk/artemis.img, and three single-word
no-argument entry points (RUN-AMD64-CAMPAIGN/RUN-AARCH64-CAMPAIGN/
RUN-RISCV64-CAMPAIGN).

Blocks 5117-5119 -- the only 3 remaining in the [2048,5120) user block
namespace; mkcapsule --lint caught the first draft going one block past
the ceiling. Verified live, load-only: both capsules load with zero
UNKNOWN WORD/redefinition/error lines, all 3 entry words resolve,
constants compile correctly. No campaign trial has been run yet --
build+verify only, per explicit scope for this pass.

FABRIC-3.md §XXXV.8/.9 records the decision and verification.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

FABRIC-3.md

@@ -5520,7 +5520,43 @@ not optional, before any of them could be re-minted.
 Committed and pushed (image/log commit follows this one). `disk/README.md` updated with the
 same account.
 
-### XXXV.8 -- Genuinely open, not decided here
+### XXXV.8 -- `capsules/per-isa-doe.4th` built: N=3 ratified over the §XXXV.5 recommendation
+(2026-09-17)
+
+Captain Bob picked **N=3 reps/cell (18 trials/ISA, ~24.8h/ISA, ~74.5h/~3.1 days total)** over
+§XXXV.5's own N=2 safety-margin recommendation -- more replication depth, accepting less margin
+against the unmeasured aarch64/riscv64 per-trial-cost risk §XXXIV.4 already flagged. Scope for
+this pass, also confirmed directly: build and commit the driver capsule only, no live multi-hour
+campaign launch yet.
+
+Built `capsules/per-isa-doe.4th` (blocks 5117-5119 -- the *only* 3 blocks left in the entire
+[2048, 5120) user block namespace; `mkcapsule --lint` enforces this ceiling and caught the first
+draft's block numbers landing one past it). Deliberately a thin wrapper, not new campaign
+mechanics: `multiuser-doe.4th`'s own `MU-EXEC-CAMPAIGN` already implements the full ratified
+6-cell factorial (`MU-N-CONC`=3 x `MU-N-MODES`=2) generically over `(seed n-reps -- )`, so this
+capsule adds only what the per-ISA pivot needed on top of it -- one fixed, documented seed per
+ISA (`AMD64-SEED`/`AARCH64-SEED`/`RISCV64-SEED`, arbitrary but fixed, not tuned),
+`PER-ISA-NREPS`=18, an ISA tag (`PER-ISA-TAG!`) threaded into a redefined
+`MU-EMIT-TRIAL-MARKER` so records from all 3 ISAs' sequential campaigns can be told apart once
+they land on the same shared `disk/artemis.img` (§XXXV.2 item 2's own requirement), and three
+single-word no-argument entry points (`RUN-AMD64-CAMPAIGN`/`RUN-AARCH64-CAMPAIGN`/
+`RUN-RISCV64-CAMPAIGN`) so a boot only ever needs one command, no operator-supplied seed/reps
+arguments to get wrong live.
+
+**Verified live, load-only (no campaign trial run):** booted amd64, `S" multiuser-doe.4th" EXEC`
+then `S" per-isa-doe.4th" EXEC`, confirmed zero `UNKNOWN WORD`/redefinition-warning/error lines
+anywhere in the log after either load, confirmed all 3 entry words resolve (`' RUN-AMD64-CAMPAIGN
+DROP` etc., no error), confirmed the constants compiled correctly (`AMD64-SEED . AARCH64-SEED .
+RISCV64-SEED . PER-ISA-NREPS .` printed exactly `20260917 20260918 20260919 18`), clean `BYE`
+shutdown, zero leaked qemu processes. `disk/artemis.img`'s incidental `mounted_time` header churn
+from this boot was reverted before committing, per `disk/README.md`'s own documented convention.
+Log preserved: `logs/20260917-122832/amd64/qemu-amd64-20260917-122832.log`.
+
+**Not done in this pass, by explicit scope:** no live campaign trial has actually been run on any
+ISA yet -- `RUN-AMD64-CAMPAIGN`/etc. are verified to *load and resolve*, not to have completed
+even one real trial. Launching the first live ~24.8h run is a separate, later step.
+
+### XXXV.9 -- Genuinely open, not decided here
 
 - **Exact v2 decimation factor**, if/when v2 is built at all (§XXXV.4).
 - Whether `THRU`'s own line-swallowing defect (§XXXIV.1, still un-root-caused at the C level) gets
@@ -5532,7 +5568,10 @@ same account.
 - Whether the old 30 MiB `disk/artemis.img` gets deleted/archived now that the new 1 GiB image is
   confirmed live and re-minted (§XXXV.7).
 - The block-backed DoE persistence writer itself (§XXXV.3/§XXXV.4) is still design-only -- no
-  capsule/C code written for it. Only the drive-resize/re-mint prerequisite (§XXXV.6) is done.
+  capsule/C code written for it. `per-isa-doe.4th` (§XXXV.8) only tags trial markers for it,
+  does not persist them anywhere the serial log doesn't already reach.
+- When/whether to actually launch the first live per-ISA campaign run (amd64 first, ~24.8h) --
+  not started, explicit scope decision this session.
 - The `ZUSE-ELIGIBILITY-ADD` elevation-eligibility list (narrower than baseline identity auth --
   only gates the `ELEVATE` flow in `capsules/zuse-eligibility.4th`, confirmed by reading its only
   call site) was **not** re-populated for any of the 8 re-minted identities during this pass --