Phase 8 C (3/n): top-of-device metadata fence, step 1 (field round-trip)

Corrected substrate: this OS is anti-POSIX, anti-file by design -- the
prior "dedicated system-identity disk" framing was wrong vocabulary,
caught before any code was written (saved as
feedback_no_files_anti_posix.md). The real primitives are
content-addressed capsules and raw LBN blocks, never a filesystem.

Design (agreed on request): a growable metadata fence at the TOP of a
device's block space, mirroring block_subsystem.c's existing bottom BAM
reservation from the opposite end -- the two grow toward each other,
never colliding, same shape as a stack/heap. Starts at
BLK_META_FENCE_INIT (128 blocks), explicitly never RAM-backed. Reuses
Artemis's already-attached, already-proven virtio-blk device -- no new
device. Rejected reusing BAM's own reserved zone directly: those blocks
are fully claimed by BAM bookkeeping, not free space.

Step 1 only: new meta_fence_blocks field in blk_volume_meta_t, appended
after reloc_devblocks and carved from _pad[] -- identical graceful-
default technique reloc_devblocks already established (a pre-existing
volume reads it back as 0, not a format break). Added a compile-time
_Static_assert on the struct's total size, same discipline
homeblocks_sig.h uses -- caught a real bug immediately: the hand-summed
_pad[] formula was off by 4 bytes (a compiler alignment gap the manual
count missed), found via offsetof() rather than re-deriving by hand.

Worked against disposable clones throughout, never the real
disk/artemis.img (ARTDISK is ?=-overridable) -- artemis-metafence-fresh.img
(blank, fresh-format path) and artemis-metafence-test.img (copy of the
pre-existing artemis.img, graceful-default-on-reload path), kept as
regression fixtures matching disk/README.md's existing convention.
Verified independently via direct byte reads of the disk image, not the
kernel's own log output (log_message(LOG_INFO,...) doesn't reach serial
in this build -- unrelated pre-existing gap): fresh format writes 128 at
header offset 184, a reboot without reformatting preserves it, the old
pre-fence image reads back 0. Full 3-arch acceptance boot against the
real, untouched disk/artemis.img also clean.

Allocator (user_blocks math) and zone read/write accessors both still
open -- next steps, documented in FABRIC-3.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd

src/block_subsystem.c

@@ -526,6 +526,7 @@ static void blk_compute_fresh_geometry(blk_dev_slot_t *slot) {
      * variable-size region that might need to grow later. */
     slot->vol_meta.reloc_devblocks  = 1;
     slot->vol_meta.devblock_base    = slot->vol_meta.reloc_start + slot->vol_meta.reloc_devblocks;
+    slot->vol_meta.meta_fence_blocks = BLK_META_FENCE_INIT;
     compute_totals_from_B(&slot->vol_meta);
 
     if (sf_has_rtc()) slot->vol_meta.created_time = sf_realtime_ns();
@@ -701,14 +702,15 @@ int blk_subsys_attach_device(struct blkio_dev *dev) {
 
     log_message(LOG_INFO,
                 "blk: disk '%s' v2 LBN %u..%u (%u user blocks); "
-                "devblocks=%llu bam=%u base=%u total=%llu free=%llu",
+                "devblocks=%llu bam=%u base=%u total=%llu free=%llu fence=%u",
                 slot->vol_meta.label,
                 slot->start_lbn, slot->start_lbn + slot->user_blocks - 1,
                 slot->user_blocks,
                 (unsigned long long) slot->vol_meta.total_devblocks,
                 slot->vol_meta.bam_devblocks, slot->vol_meta.devblock_base,
                 (unsigned long long) slot->vol_meta.total_blocks,
-                (unsigned long long) slot->vol_meta.free_blocks);
+                (unsigned long long) slot->vol_meta.free_blocks,
+                slot->vol_meta.meta_fence_blocks);
     return BLK_OK;
 }