diff --git a/docs/fabric/FABRIC-3.md b/docs/fabric/FABRIC-3.md
index f18411fa..49c15472 100644
--- a/docs/fabric/FABRIC-3.md
+++ b/docs/fabric/FABRIC-3.md
@@ -6139,3 +6139,17 @@ tag names the kernel (`release.yml`: `v<LITHOS_VERSION>`), so:
 - Each v4 capsule logs `signature: no root key (cert not found/parseable)`: the kernel looks for the
   StarshipOS Capsule Signing certificate (XLVI), which is not in the tree until `ci/pki/make-ca.sh`
   has run. A warning, as "missing (unsigned)" was before; nothing is refused.
+
+### 3. The StarshipOS CA, and acceptance again (`4ca935d8`)
+
+`ci/pki/make-ca.sh` ran on the CI box (2026-11-07 16:50 UTC): the StarshipOS Root CA there, the
+signing key in the secret `CAPSULE_SIGN_KEY`, and the certificate -- O=StarshipOS, CN=StarshipOS
+Capsule Signing, issued by the root, 2026-11-07 to 2036-11-06, `CA:TRUE, pathlen:0`, SHA-256 of the
+DER `13a28dda...029b9a6c` -- in the tree as `capsules/pki/starshipos-intermediate.der`, the snakeoil
+intermediate out of it. The tree changed, so the protocol ran again here: amd64
+(`logs/20261107-165611`), aarch64 (`-165817`), riscv64 (`-170149`) -- POST 538/538,
+`dict_hash=0xfec8c47cfc6f437f` on all three; the stick loaded high (`-170326`); `test-32`, 39
+programs, 0 failures; the proofs (`-171020`). Each capsule now logs `signature: missing (unsigned)`:
+the kernel found and read the StarshipOS certificate (it said "no root key" without it), and this
+session has no key to sign with. CI signs with the secret: the PR's acceptance and the release are
+where every capsule first verifies.
diff --git a/experiments/bare_metal/runs/doe-aarch64-20261107-165817.csv b/experiments/bare_metal/runs/doe-aarch64-20261107-165817.csv
new file mode 100644
index 00000000..e69de29b
diff --git a/experiments/bare_metal/runs/doe-amd64-20261107-165611.csv b/experiments/bare_metal/runs/doe-amd64-20261107-165611.csv
new file mode 100644
index 00000000..e69de29b
diff --git a/experiments/bare_metal/runs/doe-amd64-20261107-170326.csv b/experiments/bare_metal/runs/doe-amd64-20261107-170326.csv
new file mode 100644
index 00000000..e69de29b
diff --git a/experiments/bare_metal/runs/doe-riscv64-20261107-170149.csv b/experiments/bare_metal/runs/doe-riscv64-20261107-170149.csv
new file mode 100644
index 00000000..e69de29b
diff --git a/logs/20261107-165611/amd64/qemu-amd64-20261107-165611.log b/logs/20261107-165611/amd64/qemu-amd64-20261107-165611.log
new file mode 100644
index 00000000..67e838a0
--- /dev/null
+++ b/logs/20261107-165611/amd64/qemu-amd64-20261107-165611.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5f0b918ad976bfb73db05123c487b373cd574119f89570ee77ea56978ada78bb
+size 6634
diff --git a/logs/20261107-165817/aarch64/qemu-aarch64-20261107-165817.log b/logs/20261107-165817/aarch64/qemu-aarch64-20261107-165817.log
new file mode 100644
index 00000000..c4e48347
--- /dev/null
+++ b/logs/20261107-165817/aarch64/qemu-aarch64-20261107-165817.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7b32cdad9ba553bfcc98fb2ed27eb8f16490cfd7f261f65682c51945d509d378
+size 5602
diff --git a/logs/20261107-170149/riscv64/qemu-riscv64-20261107-170149.log b/logs/20261107-170149/riscv64/qemu-riscv64-20261107-170149.log
new file mode 100644
index 00000000..26a51d3c
--- /dev/null
+++ b/logs/20261107-170149/riscv64/qemu-riscv64-20261107-170149.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:3a3a6599cd7f2a32ef4a0d9e6365ae20e27772ed0bee013a36fa4331f6df8b86
+size 7993
diff --git a/logs/20261107-170326/amd64/qemu-amd64-20261107-170326.log b/logs/20261107-170326/amd64/qemu-amd64-20261107-170326.log
new file mode 100644
index 00000000..f0a72b02
--- /dev/null
+++ b/logs/20261107-170326/amd64/qemu-amd64-20261107-170326.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:dd28cfe6b02b1306491bc8b70b6cd25d4ce17a124ef0388928ac61d4e0d85a4a
+size 6708
diff --git a/logs/20261107-171020/isabelle/isabelle-20261107-171020.log b/logs/20261107-171020/isabelle/isabelle-20261107-171020.log
new file mode 100644
index 00000000..eab46bd5
--- /dev/null
+++ b/logs/20261107-171020/isabelle/isabelle-20261107-171020.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:749586aec05a93d552a14461ed6ee85c6e9ff0dce3d9a28482a2d692a62503c8
+size 7783