diff --git a/docs/fabric/FABRIC-3.md b/docs/fabric/FABRIC-3.md
index 3e6034c4..c6bbfea6 100644
--- a/docs/fabric/FABRIC-3.md
+++ b/docs/fabric/FABRIC-3.md
@@ -6288,3 +6288,18 @@ byte in OpenSBI's banner too, printed before our kernel runs. So the byte was do
 serial capture under the server's load, not by the kernel (Captain Bob closed #131). The check that
 failed was right to: it refuses a line that is not what was printed. The capture itself (the log is
 `logfile=` on the socket chardev the acceptance types through) is what is left to harden.
+
+### 7. Downloads (#126): what a release publishes, and what a download must boot to (2026-11-08)
+
+- **Ruled** (Captain Bob): the Downloads page goes live with alpha.4, filled by the release itself;
+  the StarshipOS Root CA's certificate is published with it.
+- **Built:** the release builds the PC's USB stick too (`scripts/nightly.sh images`, classifier
+  `pc-stick`; `pc` stays the ISO QEMU boots), and makes the tag a Gitea release -- a pre-release for
+  an alpha -- with the images, `SHA256SUMS`, the documents and the Root CA's certificate attached
+  for anyone to download (`scripts/nightly.sh gitea-release`, run by `release.yml` with the secret
+  `RELEASE_TOKEN`). Tested against a stand-in Gitea API: the release, its notes and ten files; a
+  second run adds nothing.
+- **Found:** a downloaded image boots headless today -- "Zuse: no genesis on this disk -- the system
+  stays headless"; minting Zuse on a stick's first boot (`docs/v4.0.0/STICK.md` section 6) is #92.
+  **Ruled:** #92 into alpha.4, so the PC stick downloaded from alpha.4 on boots to
+  `[zuse@Hera] ok>` at its first boot.