Block 4016
( zuse.4th - Bootstrap superuser for StarForth ACL )
( Named for Konrad Zuse, pioneer of programmable computers. )
( Sole superuser; mints credentials; owns emergency REPL. )
( Loaded by ACL.4th; must not load before ACL.4th. )
( Thumbdrive-resident Ed25519 PKI (2026-08-28) -- her seed )
( lives only on her own minted drive, never system-resident. )
( HUMAN-REVIEW: capsule hash = root of superuser trust. )
( Cert (seed+pubkey) lives in C-only VM fields, installed by )
( capsule_zuse_boot.c on genesis-mint or thumbdrive attach. )
( NOT a CONSTANT: ACL-PIN blocks redefinition, not a )
( >BODY-then-store, so a pinned CONSTANT isn't tamper-proof. )
( Read with ZUSE-PUBKEY@ / ZUSE-CERT-INSTALLED? -- both C )
( primitives, read-only; the seed has no FORTH access at all. )

Block 4017
( ACL-ZUSE-BOOT ( -- ) re-invokable: capsule_zuse_boot.c )
( calls it again once a thumbdrive attach installs a cert. )
( Only authenticates if a real cert is installed -- refuses )
( god-mode to a Zuse with no real identity behind her. )
( ZUSE-AUTHENTICATE is C-only; no FORTH word grants god-mode )
( except through this sequence. )
: ACL-ZUSE-BOOT ( -- )
  ZUSE-CERT-INSTALLED? IF
    ZUSE-AUTHENTICATE
    LOG-INFO" zuse: activated"
  ELSE
    LOG-INFO" zuse: NOT activated -- no cert installed"
  THEN ;

Block 4018
( Pin against redefinition -- once, after definition closes; )
( ['] from inside its own body can't find itself mid-compile, )
( found live 2026-08-28 activating ACL.4th for the first time. )
( Pinning doesn't block re-EXECUTION, only redefinition -- the )
( re-invoke above still works after this runs. Self-activates. )
['] ACL-ZUSE-BOOT ACL-PIN
ACL-ZUSE-BOOT