§H.12 steps 21-22: ELEVATE-REQUEST + ELEVATE-GRANT + SEND-ELEVATE-REQUEST

Phase 7 complete, closing out §H.12's punch list. MSG-DELIVER turned out
to VM-EXEC payload text directly rather than dispatching by type, so the
"handler" is ELEVATE-GRANT, a word the delivered text calls. New Hera-only
C primitives (ZUSE-ELIGIBLE?, NAME>XT, ELEVATE-PUBKEY-UNPACK) stay plain
and unconditional; capsules/zuse-eligibility.4th composes the actual
eligibility check + ACL-ALLOW!/ACL-TTL! grant in FORTH.
SEND-ELEVATE-REQUEST (common:messaging.4th) builds the payload text and
sends it via the item-20-gated CH-REQUEST.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QgooKd5hJNtTYqB6CyK5f9

FABRIC-3.md

@@ -4156,9 +4156,41 @@ work, not new invention.
   (amd64/aarch64/riscv64, each in the foreground); confirmed via the amd64 log that both
   Hermes's and Artemis's `PARITY:BIRTH` still succeed (their init capsules, including the new
   lines, compile and run cleanly).
-- [ ] **21.** Define `ELEVATE-REQUEST` and a minimal real handler checking the eligibility
-  list, granting via `ACL-ALLOW!`/`ACL-TTL!` on match.
-- [ ] **22.** Add the FORTH entrypoint a session actually calls to send one.
+- [x] **21. DONE 2026-09-03.** Found before writing this: `MSG-DELIVER` doesn't dispatch by
+  type at all — it takes the payload text and `VM-EXEC`s it directly inside the target VM, so
+  a "handler" is really just a word the payload text calls once delivered. Since VMs have
+  separate memory, the pubkey can't cross as a pointer — Captain Bob confirmed embedding it as
+  4 literal cells in the message text (matching `ZUSE-PUBKEY@`'s own 8-byte-LE-chunk
+  convention), and that the target word is named by the caller, resolved dynamically. Added
+  `8 CONSTANT ELEVATE-REQUEST` (`common:messaging.4th`, next to `CONSOLE-CMD-EVENT`) and three
+  new plain/unconditional C primitives in `mama_forth_words.c` (Hera-only, same "no bespoke
+  gate" discipline as item 19): `ZUSE-ELIGIBLE? ( c-addr -- flag )` wraps
+  `zuse_eligibility_is_member()`; `NAME>XT ( c-addr u -- xt|0 )` is a dynamic dictionary
+  lookup from a data-stack string (distinct from `FIND`/`'`, which parse the live input
+  stream — `FIND` itself untouched, per the standing rule); `ELEVATE-PUBKEY-UNPACK
+  ( pk0 pk1 pk2 pk3 buf-addr -- )` reconstructs the 32-byte pubkey, byte-exact, as the inverse
+  of `ZUSE-PUBKEY@`'s packing. New capsule `capsules/zuse-eligibility.4th` (blocks 4021–4022,
+  next free range after `block-acl.4th`) defines `ELEVATE-GRANT
+  ( waddr wu pk0 pk1 pk2 pk3 -- )`: unpacks the pubkey, checks `ZUSE-ELIGIBLE?`, and on a hit
+  resolves the named word via `NAME>XT` and grants it `1 ACL-ALLOW!` +
+  `ACL-BASE-TTL ACL-TTL!` (the existing, already-decided `ACL-TTL` reuse) — silent no-op on
+  any miss (not eligible, or word not found). Loaded from Hera's own `init.4th` right after
+  `block-acl.4th`. Passed `mkcapsule --lint` cleanly across all 34 capsule files.
+- [x] **22. DONE 2026-09-03.** `SEND-ELEVATE-REQUEST ( pk3 pk2 pk1 pk0 waddr wu -- )` added to
+  `common:messaging.4th` (new blocks 5039–5040, after a small scratch-buffer text-builder:
+  `ELEVATE-REQ-RESET`/`-PUTC`/`-APPEND`/`-NUM`, the last using `<# 0 SWAP #S #>` — explicit
+  double-cell form, not the tolerant single-cell path, which takes an absolute value and would
+  corrupt exact bit-pattern round-trip for a chunk with its top bit set). Builds the literal
+  payload text `S" <wordname>" <pk0dec> <pk1dec> <pk2dec> <pk3dec> ELEVATE-GRANT` (args taken
+  in reverse pk order so top-of-stack processing emits pk0 first) and sends it via
+  `ELEVATE-REQUEST MY-CH-ID @ 0 ... CH-REQUEST` — `to`=0 (Hera, where `ELEVATE-GRANT` lives),
+  riding both the item-20 initiator-only gate and H.7's already-real messaging protocol
+  unmodified. Verified 3-arch boot to `ok>` (amd64/aarch64/riscv64, each in the foreground);
+  confirmed via each arch's log that Hermes's and Artemis's `PARITY:BIRTH` still succeed with
+  no `UNKNOWN WORD` errors (their init capsules load `common:messaging.4th`, and Hera's own
+  boot sequence loads `zuse-eligibility.4th`, both compiling cleanly).
+
+  **Phase 7, and with it §H.12's entire punch list, is now complete.**
 
 **Excluded, per H.11's deferred items 10–11**: VM card multi-owner support, live-console
 `sudo`-style elevation, pre-signed capability tickets.