# capsules/MANIFEST.md — Block Ownership Registry (justifications)
# StarshipOS / StarForth — Captain Bob (Robert Allan James)
# This document is authoritative for WHY each block is where it is and
# whether it's immutable. For WHICH blocks exist and their current
# content hash, see capsules/BLOCK_MAP.md — auto-generated by
# `make -f Makefile.starkernel manifest` (or on every kernel build),
# never hand-edited. If the two ever disagree on a block NUMBER,
# BLOCK_MAP.md is correct; this document's numbers need updating.
# Any new capsule MUST claim a range and get a justification row here
# before first commit. Collisions are marked ⚠️ — resolve before
# production bake.

---

## How to Read This Document

Each entry lists:
- **File** — path relative to `capsules/`
- **Blocks** — LBN range(s) claimed (cross-check against `BLOCK_MAP.md`)
- **Immutable** — block is locked for life; reason given
- **Justification** — why each block or range lives where it does

The block namespace is shared across all loaded capsules. `mkcapsule.c` bakes
every `.4th` file into the kernel image. If two capsules claim the same block
and are loaded together, the later-loaded definition wins in block RAM.
Definitions already compiled into the dictionary are unaffected, but LOADing
that block again would give wrong results. Flag collisions; resolve before
production bake. Run `mkcapsule --manifest capsules` (or `make -f
Makefile.starkernel manifest`) before adding any new capsule — it reports
conflicts directly, no need to hand-check against the tables below.

For the full current block-to-capsule map (LBN, capsule, content hash,
conflict status), see **`capsules/BLOCK_MAP.md`** — regenerated
automatically on every `Makefile.starkernel` build, so it never drifts.
This document intentionally no longer duplicates that map; it only carries
the parts a tool can't generate — the justification for each block and the
history of how the layout got here.

---

## Mama VM Personality Capsules

Mama VM is the root VM (Hera). Exactly one Mama personality is active at a time.
All entries in this section are mutually exclusive — they are never loaded together.

### `init.4th` — Default Mama personality

Blocks: **2049–2052, 2057**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2049  | No        | Hera VM init: loads compudynamics, VM-INIT, lib, common:msg, fleet-k, process; BIRTHs Artemis + Hermes. VM-TREE + VM-CHILDREN implemented (`b52281b9`), unrolled for v1 Tripod |
| 2050  | No        | BOOT-BANNER call — separated so the banner block can be swapped without touching init logic |
| 2051  | No        | TRIPOD-TEST — 6 acceptance gates per TRIPOD.md. Dead EVENT-WAIT step replaced with HERMES-TICK liveness check (`3436d564`) |
| 2052  | No        | TRIPOD-TEST invocation block |
| 2057  | No        | BOOT-BANNER word definition (reusable across Mama variants) |

Note: 2048 is the kernel ramdrive entry point. `init.4th` starts at 2049 intentionally
(2048 = PERSONALITY block, loaded separately by the capsule birth protocol).

### `doe.4th` — DoE Mama personality

Blocks: **2100–2107**

Moved from 2049–2056 (2026-07-05) — that range collided with `init.4th`'s
real blocks (2049–2052). Alternate-personality status doesn't excuse a real
LBN clash when both capsules are baked into the same binary; renumbered
into the range this doc had already earmarked for `doe.4th` ("2100–2199")
but the file itself had never actually used. See Conflict Register C2.

**Note (2026-07-08):** the table below previously described generic
lifecycle-stage content ("loop control", "teardown / flush") that didn't
match any of this file's actual blocks. Rewritten to match the live file.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2100  | No        | Factor threshold constants (`ENT-HI`/`CV-HI`/`TMP-HI`/`STB-HI`) + run-matrix sizing (`N-CFG`/`N-REPS`/`N-RUNS`) |
| 2101  | No        | Serial output primitives: `N.`/`COMMA`/`CRLF`/`CSV-COL`/`CSV-LAST`/`CSV-HEADER` |
| 2102  | No        | Factor extraction + apply: `CFG-ENT`/`CFG-CV`/`CFG-TMP`/`CFG-STB`/`APPLY-CFG` (drives `L8-UPDATE`/`L8-APPLY`) |
| 2103  | No        | `DOE-WORK`: the arithmetic workload itself (~5000-iteration loop, ~35000 word executions) |
| 2104  | No        | Run matrix: `RUN-MATRIX` (`CREATE`...`ALLOT`) + `MATRIX!`/`MATRIX@`/`SWAP-MTX`/`INIT-MATRIX`. Not fully immutable: `CREATE` allocates memory at compile time |
| 2105  | No        | Fisher-Yates shuffle (`SHUFFLE-MATRIX`) over the run matrix |
| 2106  | No        | `EMIT-ROW`: CSV row emitter, pulls inference-engine state (`INFER-RUN`, `L8-MODE`, `WINDOW-DIVERSITY`, etc.) |
| 2107  | No        | `EXEC-DOE`/`DOE`: main entry point — seeds, shuffles, runs the full matrix, emits CSV |

### `init-4.4th` — Mama variant (numbered)

Blocks: **2130–2132**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2130  | No        | Mama variant init logic |
| 2131  | No        | Variant personality block 2 |
| 2132  | No        | Variant personality block 3 |

### `init-7.4th` — Mama variant (numbered)

Blocks: **2150**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2150  | No        | Single-block Mama variant |

### `init-8.4th` — Mama variant (numbered)

Blocks: **2160**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2160  | No        | Single-block Mama variant |

### `init-0.4th` — Mama variant (numbered)

Blocks: **2200–2201**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2200  | No        | Mama variant init |
| 2201  | No        | Mama variant personality continuation |

### `init-6.4th` — Full-range Mama variant

Blocks: **2080–2095**

Moved from 2048–2063 (2026-07-05). That range put both `init-6.4th` and
its byte-identical twin `init-l8-omni.4th` on top of `init.4th`'s real
blocks (2049–2052, 2057) — a genuine collision the original Conflict
Register missed by only tracking "6 vs omni" (C1) and "init vs doe" (C2)
as separate entries, never checking omni/6 against `init.4th` itself. See
Conflict Register C1.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2080–2095 | No   | Full Mama personality suite: 16 blocks covering init, loop control, L8 hooks, workload dispatch, banner, teardown |

### `init-l8-omni.4th` — L8 Jacquard omni Mama variant

Blocks: **2064–2079**

Moved from 2048–2063 (2026-07-05), for the same reason as `init-6.4th`
above. `init-l8-omni.4th` is byte-identical to `init-6.4th` (same content,
same xxHash64) — presumably a copy-forward placeholder awaiting real L8
Jacquard omni-mode content that was never written. Given as a separate
capsule anyway (rather than deleted) since it's referenced by name
elsewhere as the L8-enabled variant; flagging the duplication here for
visibility, not resolving it — that's a content decision, not a block
numbering one.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 2064–2079 | No   | L8 Jacquard omni Mama personality; currently identical content to init-6.4th (see note above) |

### `init-5.4th` — Raw code capsule (no block format)

Blocks: **none** (no `Block N` headers)

`init-5.4th` defines words inline without FORTH block formatting. It is a raw
code capsule compiled directly into the dictionary at load time. It does not
claim any LBN slot and cannot be LOADed by number. This is intentional for
volatile/chaos workloads where block-structured layout adds no value.

---

## Workload Capsules (4406–4849)

Exactly one workload capsule is active per DoE run — never co-loaded with
another. Moved off 3001–3060 (2026-07-05): that range was shared verbatim
across all 9 workload capsules on the theory that "mutually exclusive, so
sharing is fine" — the same reasoning that masked C1/C2 above, and true
only in the narrow sense that boot-time compilation reads capsule text
straight from the in-memory payload. The `write_ramdrive_block` re-cache
step (so a human can later type `N LOAD`) goes through the real block
subsystem, and 9 capsules pointing at the same LBN for that step meant only
the last-loaded one's text was ever recoverable that way — worth cleaning
up even though nothing observable broke. See Conflict Register C3.

Each capsule now owns a private, non-overlapping range. The numbered
non-L8 workloads keep their original sparse per-phase spacing (still room
to add a phase without renumbering); the contiguous L8 workloads keep their
original contiguous style, just relocated.

### `init-1.4th` — Non-L8 workload, 4 phases

Blocks: **4406, 4415, 4425, 4435**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4406  | No        | Workload entry point |
| 4415  | No        | Phase 2 workload words |
| 4425  | No        | Phase 3 workload words |
| 4435  | No        | Phase 4 workload words |

### `init-2.4th` — Non-L8 workload, 5 phases

Blocks: **4506, 4515, 4525, 4535, 4545**

Same sparse slot pattern as `init-1.4th`, own private hundred-block zone,
plus one additional phase block.

### `init-3.4th` — Non-L8 workload, 7 phases

Blocks: **4606, 4615, 4625, 4635, 4645, 4655, 4665**

Largest non-L8 workload. Own private hundred-block zone with room for
three more phases (4675, 4685, 4695) before needing a new zone.

### `init-9.4th` — Non-L8 workload, 5 phases

Blocks: **4706, 4715, 4725, 4735, 4745**

Structurally identical slot pattern to `init-2.4th`; different workload content.

### `init-l8-stable.4th` — L8 stable mode workload

Blocks: **4806**

Single-block workload. Stable mode = low CV, minimal variability. One block suffices.

### `init-l8-volatile.4th` — L8 volatile mode workload

Blocks: **4810–4813**

Four blocks. Volatile mode generates high-CV execution patterns requiring more
definition space.

### `init-l8-diverse.4th` — L8 diverse mode workload

Blocks: **4820–4822**

Three blocks. Diverse mode cycles across word categories.

### `init-l8-temporal.4th` — L8 temporal mode workload

Blocks: **4830–4831**

Two blocks. Temporal mode generates time-varying access patterns.

### `init-l8-transition.4th` — L8 transition mode workload

Blocks: **4840–4842**

Three blocks. Transition mode exercises mode-switching boundary behavior.

---

## Infrastructure Capsules (4000+)

Infrastructure capsules are permanent system libraries. Multiple may be loaded
simultaneously. Block assignments in this range are non-overlapping except
where explicitly flagged.

**Everything in this range lives on Artemis's disk, not the ramdrive.**
The kernel ramdrive is exactly 1024 blocks, LBN 2048–3071 (`KRD_MAX_BLOCKS`
in `capsule_loader.c`). Artemis's virtio-blk disk is attached immediately
after as the next device in the block subsystem's LBN-ordered slot chain
(`kernel_main.c`, `blk_subsys_attach_device`), starting at LBN 3072 — which
is also `ART-HDR-LBN`, the very first byte of Artemis's own on-disk header.
So every block number in this section (4000+) resolves through
`blk_get_buffer()`'s device routing to Artemis's persistent disk image
(`disk/artemis.img`), not a scratch buffer. This has been true since these
capsules were first numbered — it isn't new. It's provably harmless for
boot correctness (`capsule_load_blocks` compiles word definitions straight
from the in-memory payload; the block-subsystem write is only a courtesy
copy so a human can later type `N LOAD` interactively), but it does mean
every boot writes capsule source text over whatever LBNs 4000+ map to on
Artemis's disk — which is why `disk/artemis.img` shows a binary diff after
every acceptance run. Keep this in mind before claiming new blocks in the
"OPEN"/"UNASSIGNED" ranges below: they are disk offsets, not free RAM.

### `ACL.4th` — Word-level ACL system

Blocks: **4000–4007, 4015**

**Note (2026-07-08):** rows 4001–4007 below were previously wrong in every
row (describing `ACL-BOOT-STRICT`/`ACL-BOOT-PERMISSIVE`/`ACL-PERMISSIVE-MODE`/
`ACL-TTL-TICK` — none of which exist — and misplacing content between rows,
e.g. claiming zuse.4th loads from 4007 when that call is actually in 4015).
Corrected this pass by reading the live file directly.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4000  | Yes       | `ACL-STRICT-MODE`/`ACL-TTL-MODE-VAL`/`ACL-BASE-TTL`/`ACL-MAX-TTL` constants. Immutable: changing these alters security semantics of all downstream capsules |
| 4001  | No        | `ACL-ENTRY` ( xt -- xt ): identity word for API symmetry. Not immutable: cosmetic, safe to extend |
| 4002  | Yes       | `ACL-STRICT` / `ACL-TTL-MODE`: pin-guarded mode selector words. Immutable: mode selection is a load-bearing policy operation |
| 4003  | Yes       | `ACL-TTL-COMPUTE`: adaptive TTL formula (heat/4 + `ACL-BASE-TTL`, capped at `ACL-MAX-TTL`). Immutable: formally verified in `ACL_TTL_Bounded.thy`; core enforcement math |
| 4004  | Yes       | `ACL-RECHECK`: cold-path policy called by C `acl_recheck()` at TTL=0. Immutable: core enforcement path; changes here affect every word execution under ACL |
| 4005  | Yes       | `ACL-BOOT`: stamps default ACL via `ACL-INIT-PRIMITIVES`, pins `EXEC`/`BYE`/`ACL-RECHECK`/`ACL-INIT-PRIMITIVES`, self-pins. Immutable: self-activation runs once at boot; must be stable |
| 4006  | Yes       | `ACL-CA-KEY-LO`/`ACL-CA-KEY-HI`: Ed25519 CA root public key placeholders. Immutable: capsule hash is the root-of-trust fingerprint; any change rejects the birth protocol |
| 4007  | No        | Self-activation placeholder comment + historical note on the removed RWT mechanism (see 4008–4014 below). Not immutable: comment-only content |
| 4008–4014 | —     | UNASSIGNED. Formerly the "ACL Rolling Window of Truth" (RWT) TTL mechanism (ring buffer, slope inference, `ACL-RECHECK-RW`, `ACL-BOOT-RW`). Removed 2026-07-08: it was dead code from the day it was written — the C hot path's `acl_recheck()` looks up the word literally named `ACL-RECHECK` (11 chars), never `ACL-RECHECK-RW` (14 chars), so nothing ever reached this mechanism regardless of `ACL-BOOT-RW` pinning it. It was never covered by `ACL_TTL_Bounded.thy` despite this table's prior claim otherwise. Also removed: 4 backing `DictEntry` fields (`acl_rwt[8]`/`acl_rwt_head`/`acl_rwt_count`/`acl_rwt_slope`) that violated the project's own four-field ACL limit, and 6 orphaned C primitives (`ACL-RWT-*`) in `src/word_source/acl_words.c`. |
| 4015  | Yes       | Self-activation: runs `ACL-BOOT` (the real, live boot function defined at 4005), then `S" zuse.4th" EXEC`. Immutable: runs once at boot |

### `zuse.4th` — Bootstrap superuser

Blocks: **4016–4018**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4016  | Yes       | ZUSE-CERT-LO / ZUSE-CERT-HI constants. Immutable: capsule hash = root of superuser trust; changing breaks PKI chain |
| 4017  | Yes       | ACL-ZUSE-BOOT: authenticates session + pins zuse words. Immutable: this is the sole path to zuse_session=1; must not be alterable post-boot |
| 4018  | Yes       | Self-activation (ACL-ZUSE-BOOT). Immutable: runs once at boot |

### `lib.4th` — Shared serial output + FORTH aliases

Blocks: **4050**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4050  | No        | N. COMMA CRLF CSV-COL CSV-LAST Q.SHOW USE RUN. Not immutable: these are utilities; adding words is safe. Removing or renaming existing words requires audit of all callers |

### `common/msg.4th` — Hermes participant interface

Blocks: **4055**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4055  | Yes       | HERMES-ACK / HERMES-NACK. Immutable: this is the cross-VM ACK/NACK ABI. Every messaging VM (Hera, Hermes, Artemis) loads this at birth. Changing the block or the word names breaks the Hermes delivery protocol |

### `doe-campaign.4th` — DoE campaign harness

Blocks: **4060–4065**

**Note (2026-07-08):** this table previously described fictional content
(e.g. "CSV output formatting", "statistical reduction words") that never
matched the file at any point on record. Rewritten to match the actual
content, migrated this pass off the deleted `compudynamics.4th`/
`fleet-k.4th` primitives onto the `VM-PHYSICS-STATUS`/`VM-CONSERVED?`
mechanism — see `capsules/hermes/init.4th` block 4153 and
`capsules/artemis/init.4th` block 4852 for the companion `LOAD-DOE` fix
this migration also required.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4060  | No        | `SETUP-HERMES`/`SETUP-ARTEMIS`/`SETUP-VMS`: `BIRTH` + remote `LOAD-DOE` VM-EXEC per child VM. Not immutable: setup sequence may grow |
| 4061  | No        | `PHASE1-DOE`: real per-VM `DOE-WORK` baseline touches. Historical note: dead `CD-WORK` (index-dispatch, deleted VM-HERA/HERMES/ARTEMIS constants) removed here 2026-07-08 |
| 4062  | No        | `CD-TICK`/`CD-DOE`: one real fleet-touch pass (`VM-EXEC "DOE-WORK"` on Hermes+Artemis), looped N times. `CAMPAIGN-STATUS`: `VM-PHYSICS-STATUS` + `VM-CONSERVED?` check. Not immutable: workload/status content may evolve |
| 4063  | No        | `CAMPAIGN`: full campaign — baselines then 30 real fleet touches |
| 4064  | No        | `SMOKE-CAMPAIGN`: 1-rep seed-1959 smoke test + 16 real fleet touches |
| 4065  | No        | `THREE-VM-CAMPAIGN`: loads `doe.4th` locally on Hera, then 48 real fleet touches, all three VMs as Compudynamics peers |

### `hermes/init.4th` — Hermes VM (messenger)

Blocks: **4100–4109, 4114–4121, 4142–4153**

Gap 4110–4113 = Artemis. **HARD LOCKED. Never touch from Hermes side.**
Gap 4122–4141 = Artemis (extended — see below). Never touch from Hermes side.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4100  | Yes       | Hermes constants: event codes, channel states, node sizes, arena sizes, MSG-DELIVERED. Immutable: changing node size constants corrupts all arena math |
| 4101  | Yes       | Arena CREATE: MSG-ARENA CH-ARENA MBR-ARENA; free-list roots; MSG-SEQ CH-ACTIVE. Immutable: CREATE allocates memory at compile time; re-running changes VM memory layout |
| 4102  | Yes       | MSG-INIT-FREE + CH-INIT-FREE. Immutable: free-list init is called once from CD-INIT; structure change breaks allocator |
| 4103  | Yes       | MBR-INIT-FREE + MSG-ALLOC + MSG-FREE-NODE. Immutable: allocator ABI; MSG-ALLOC is called by every MSG-SEND |
| 4104  | Yes       | CH-ALLOC + CH-FREE-NODE + MBR-ALLOC + MBR-FREE-NODE. Immutable: same allocator ABI constraint |
| 4105  | Yes       | Message field accessors (MSG-TYPE@/! through MSG-SEQ@/!). Immutable: field offsets are load-bearing; changing breaks every accessor caller |
| 4106  | Yes       | Channel + member accessors (CH-ID@/! through MBR-VM@). Immutable: same field offset constraint |
| 4107  | No        | VARIABLE MSG-LAST-MSG + IDX>NAME + MSG-DELIVER. Not fully immutable: MSG-DELIVER may evolve for async model. IDX>NAME now a table lookup over VM-NAME-ADDRS/LENS (see 4142) |
| 4108  | No        | MSG-SEND. Not immutable: send protocol may evolve |
| 4109  | No        | MSG-REAP. Ordering bug fixed (`8ca0cda2`) — type cleared before free-node prepend |
| —     | —         | 4110–4113: ARTEMIS. NEVER TOUCH. |
| 4114  | No        | VARIABLE CH-SCAN + CH-COOL-ALL + CH-TOTAL-HEAT. Not immutable: channel cooling may evolve |
| 4115  | No        | CH-REAP-SAFE. Not immutable: channel reaping logic may evolve |
| 4116  | No        | VARIABLE COMMON-CH + COMMON-INIT + HERMES-TICK. Not immutable: HERMES-TICK drives the event loop; may grow |
| 4117  | No        | EVENT-EMIT + EVENT-WAIT + EVENT-DRAIN (backward compat). Not immutable: EVENT-WAIT is a diagnostic peek only per HERMES.md |
| —     | —         | 4118: reserved, currently empty (former HERA-NOTIFY-SPAWN/KILL, removed `9323f776` — notification is automatic via `vm_physics_init`/`retire`) |
| 4119  | No        | CH-MINT-ID + CH-REQUEST. Not immutable: channel negotiation protocol may expand (multi-party invite deferred) |
| 4120  | No        | CD-INIT. Not immutable: init sequence may grow |
| 4121  | No        | MSG-ACK-LAST + MSG-NACK-LAST. Not immutable: NACK-requeue (reduced heat, retry) deferred; block may need extension |
| —     | —         | 4122–4141: ARTEMIS (extended). NEVER TOUCH. |
| 4142  | No        | VM name routing table: VM-NAME-ADDRS/LENS + VM-NAME-REG + VM-NAMES-INIT. Not immutable: table-driven, grows via VM-MAX |
| 4143  | Yes       | MSG-CH@/! + MSG-ORIG-TYPE@/! + MSG-NACKED. Immutable: field offset constraint, same as 4105 |
| 4144  | No        | MSG-SEND. Not immutable: send protocol may evolve |
| 4145  | No        | MSG-TOTAL-HEAT + MSG-REDELIVER-NACKED. Not immutable: cooling/redelivery logic may evolve |
| 4146  | No        | MSG-DELIVER-ALL. Not immutable: delivery logic may evolve |
| 4147  | No        | HERMES-K + WELCOME. Not immutable: may grow |
| 4148  | No        | CH-ACCEPT + CH-CONFIRM + CH-CLOSE. Not immutable: channel negotiation protocol may expand |
| 4149  | No        | HERMES-STATUS (MSG-USED + CH-USED). Not immutable: status may expand |
| 4150  | No        | Member management: MBR-NEXT!/VM! + CH-ADD-MBR + HERMES-MSG-TEST. Not immutable: may grow |
| 4151  | No        | Phase 2 real multi-member broadcast: MSG-BROADCAST + BC-* variables. Not immutable: broadcast protocol may expand |
| 4152  | No        | Phase 2 COMMON-CH membership + test: BCAST-GOT/BCAST-RECV/REGISTER-COMMON-MEMBERS/SEND-BROADCAST-TEST. Not immutable: test harness may grow |
| 4153  | No        | `LOAD-DOE` ( -- ): `S" doe.4th" EXEC`. Added 2026-07-08 — `doe-campaign.4th`'s `SETUP-HERMES` calls this remotely so Hermes gets `DOE-WORK`; was missing entirely before this pass, so `doe-campaign.4th` could never have worked even pre-dating the VM-fleet-physics redesign. Not immutable: trivial wrapper |

**2026-07-05 collision fix:** blocks 4142–4150 were previously numbered
4122–4131 (interleaved with the blocks below them in this list), directly
colliding with Artemis's real block range. The collision was introduced
`fca7b09a` (Jul 1) when the VM-name routing table was added without
checking MANIFEST.md, and went undetected for 4 days because `mkcapsule`'s
build path doesn't run conflict detection (only `--manifest` does). Found
via `mkcapsule --manifest` while syncing this document; renumbered into
genuinely free space and reverified with a clean amd64 TRIPOD-TEST boot
(`PASS: fleet K`, `PASS: Hermes liveness`, `PASS: Artemis ready`, `K soak`,
`PASS: E2E msg flow` — Hermes's kill/rebirth soak test reproduced an
identical `dict_hash` before and after, confirming the reload path is now
clean). amd64-only per the rev-f iteration rule; three-arch not yet run for
this fix. See Conflict Register entry C5.

### `artemis/init.4th` — Artemis VM (flat pool disk manager v2)

Blocks: **4110–4113** (core, hard locked) + **4122–4141, 4851–4852** (extended)

★ **HARD LOCKED (4110–4113).** Core Artemis block storage primitives.
They live in the middle of the Hermes range by deliberate layout choice
(Hermes owns 4100–4121 + 4142–4150; Artemis owns 4110–4113 as a protected
island plus its own extended range at 4122–4141). No other capsule may
ever claim these blocks. No tool, script, or automated process may modify
these blocks without Captain Bob's explicit written permission.

Artemis's extended range grew organically across several sessions
(`ed05db25` Artemis BAM, `48b5f726` entry-block renumbering) without a
MANIFEST.md update at each step — this is the range that collided with
Hermes (see above). The table below reflects the actual current footprint.

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4110  | Yes       | Constants (ART-HDR-LBN, ART-FM-LBN, ART-DATA-LBN, ART-DATA-BLKS) + Q-DECAY. Immutable: constants define the on-disk geometry; changing them corrupts existing disk images |
| 4111  | Yes       | LE32!/LE32@ — arch-neutral little-endian 32-bit byte I/O. Immutable: on-disk format depends on these; changing byte order corrupts cross-arch images |
| 4112  | Yes       | SHL1N/SHR1N/BIT-TEST/BIT-SET/BIT-CLR — bit manipulation. Immutable: free map correctness depends on these primitives |
| 4113  | Yes       | FM-ADDR-BIT/FM-TEST/FM-SET/FM-CLR — free map core. Immutable: free map ABI; changing breaks allocator |
| 4122  | No        | FM-FIND-FREE/BLK-ALLOC/BLK-FREE. Not immutable: scan strategy may improve (e.g. hint-based) |
| 4123  | No        | ART-MAGIC!/ART-MAGIC? — disk detection primitives. Not immutable: magic check may extend |
| 4124  | No        | ART-BOOT-DETECT/BLK-FETCH/BLK-PERSIST/ART-FLUSH. Not immutable: boot mode may gain additional cases |
| 4125  | No        | ART-HDR-WRITE — on-disk header format. Not immutable: header layout may extend |
| 4126  | No        | ART-FORMAT/ART-RESUME/ART-HALT-UNRECOG. Not immutable: resume path will grow |
| 4127  | No        | ART-STATUS/WELCOME. Not immutable: status may expand |
| 4128  | Yes       | LE64!/LE64@ — depends on LE32!/LE32@ (4111). Immutable: same on-disk format constraint |
| 4129  | —         | UNASSIGNED (former entry block; entry moved to 4133 in `48b5f726`) |
| 4130  | No        | ART-BLANK? — blank block detection. Not immutable: may extend |
| 4131  | No        | ART-INIT — boot state machine. Not immutable: boot cases may grow |
| 4132  | No        | ART-SELF-TEST. Not immutable: may expand |
| 4133  | No        | Entry block — ART-INIT ART-BOOT-ENTRY WELCOME. Numbered after all defs to avoid CAPSULE DEFER; may grow |
| 4134  | No        | ART-WRITE-TEST (persist-write test). Not immutable: test may expand |
| 4135  | No        | ART-READ-TEST (persist-read test). Not immutable: test may expand |
| 4136  | No        | ART-BOOT-ENTRY — boot-mode dispatch. Not immutable: dispatch cases may grow |
| 4137  | Yes       | BLK-HEAT arena (CREATE ... ALLOT). Immutable: CREATE allocates memory at compile time; re-running changes VM memory layout |
| 4138  | No        | BLK-HEAT@/! + LBN>IDX. Not immutable: accessor logic may evolve |
| 4139  | No        | ART-K-TOTAL + ART-COOL. Not immutable: cooling logic may evolve |
| 4140  | No        | ART-REAP + ART-TICK. Not immutable: reap logic may evolve |
| 4141  | No        | CD-INIT — Hera calls this at fleet boot. Not immutable: init sequence may grow |
| 4851  | No        | ART-PING ( -- ): cheap O(1) touch target for Phase 3 fleet DoE workload, unlike ART-TICK/ART-STATUS which scan all ART-DATA-BLKS. Not immutable: may extend |
| 4852  | No        | `LOAD-DOE` ( -- ): `S" doe.4th" EXEC`. Added 2026-07-08 — same missing-word fix as `hermes/init.4th` 4153; `doe-campaign.4th`'s `SETUP-ARTEMIS` calls this remotely. Not immutable: trivial wrapper |

### `process.4th` — VM process management

Blocks: **4300–4301**

| Block | Immutable | Justification |
|-------|-----------|---------------|
| 4300  | No        | Event code constants + SPAWN + PAUSE lifecycle operators. Not immutable: process model may evolve |
| 4301  | No        | RESUME + KILL-VM. Not immutable: process model may evolve |

### Deleted capsules (historical)

`compudynamics.4th` (formerly 4200–4204) and `fleet-k.4th` (formerly
4400–4405) were deleted in `9323f776` (2026-07-05) — superseded by the
generalized VM fleet physics mechanism (`capsule_vm_physics.c`/`.h`,
`VM-CONSERVED?` / `VM-PHYSICS-STATUS` primitives). See
`docs/working/architecture/VM-PHYSICS-DYNAMIC-FLEET-DESIGN-20260705.md`
and `docs/working/archive/session-logs/2026-07-05-worklog.md`. Their
former ranges are now UNASSIGNED (see Namespace Map).

---

## Unassigned Ranges

| Range       | Status      | Notes |
|-------------|-------------|-------|
| 0–2047      | KERNEL      | VM internal; never use in capsules |
| 2053–2056, 2058–2063 | UNASSIGNED | init.4th extension space (after its real 2049–2052,2057) |
| 2096–2099   | UNASSIGNED  | Between init-6.4th and doe.4th |
| 2108–2129   | UNASSIGNED  | doe.4th extension space (within its 2100–2199 range) |
| 2133–2149   | UNASSIGNED  | Between init-4 and init-7 variants |
| 2151–2159   | UNASSIGNED  | Between init-7 and init-8 variants |
| 2161–2199   | UNASSIGNED  | Between init-8 and init-0 variants |
| 2202–2999   | UNASSIGNED  | Open for future Mama variants |
| 3001–3999   | UNASSIGNED  | Freed by the 2026-07-05 workload renumbering (was 3001–3060, shared across all 9 workload capsules — see C3). NOTE: LBN 3072+ is Artemis's virtio-blk disk, not ramdrive — see the callout above the Infrastructure Capsules section before claiming anything here |
| 4008–4009   | UNASSIGNED  | ACL extension space |
| 4019–4049   | UNASSIGNED  | ACL / zuse extension space |
| 4051–4054   | UNASSIGNED  | lib.4th extension space |
| 4056–4059   | UNASSIGNED  | common:msg extension space |
| 4066–4099   | UNASSIGNED  | doe-campaign extension space |
| 4154–4199   | UNASSIGNED  | Hermes extension space (post-4153) |
| 4200–4299   | UNASSIGNED  | Former compudynamics.4th range (deleted `9323f776`) |
| 4302–4399   | UNASSIGNED  | process extension space |
| 4400–4405   | UNASSIGNED  | Former fleet-k.4th range (deleted `9323f776`) |
| 4410–4414, 4420–4424, 4430–4434 | UNASSIGNED | init-1.4th's private zone, room for growth |
| 4853+       | OPEN        | Future capsules — claim here first |

---

## Conflict Register

| ID  | Blocks    | Capsule A       | Capsule B           | Risk     | Resolution |
|-----|-----------|-----------------|---------------------|----------|------------|
| C1  | ~~2048–2063~~ | init-6.4th  | init-l8-omni.4th / init.4th | Resolved (was mislabeled Low — the pair also silently overlapped `init.4th`'s real blocks, missed because the register only tracked "6 vs omni") | `init-l8-omni.4th` moved to 2064–2079; `init-6.4th` moved to 2080–2095. Both now clear of `init.4th` (2049–2052,2057) and of each other. |
| C2  | ~~2049–2056~~ | init.4th    | doe.4th             | Resolved (was real — both baked into the same binary; "never co-loaded" doesn't stop a shared-manifest ambiguity) | `doe.4th` moved to 2100–2107, the range this doc had already earmarked for it but the file never actually used. |
| C3  | ~~3001–3060~~ | init-1..3,9 | init-l8-*.4th       | Resolved (was real for the `N LOAD` re-cache path — see the disk-routing callout above the Infrastructure Capsules section; harmless for boot compilation, still worth fixing) | Each of the 9 workload capsules moved to its own private range in 4406–4842; sparse per-phase spacing preserved for the numbered non-L8 workloads. |
| C4  | ~~4010–4012~~ | ACL.4th     | zuse.4th            | Resolved   | zuse.4th moved to 4016–4018; no overlap |
| C5  | ~~4122–4128,4130–4131~~ | hermes/init.4th | artemis/init.4th | Resolved (was real — both VMs co-loaded every boot, unlike C1–C3's mutually-exclusive personalities) | Introduced `fca7b09a` (Jul 1), undetected for 4 days — `mkcapsule`'s build path runs no conflict check, only `--manifest` does. Found while syncing this doc. Hermes's colliding blocks renumbered to 4142–4150; Artemis untouched. Reverified with a clean amd64 TRIPOD-TEST boot, including Hermes kill/rebirth reproducing an identical `dict_hash` before and after. |

`mkcapsule --manifest capsules` reports **zero conflicts** as of this
renumbering (2026-07-05) — verify with the same command before adding any
new capsule.

---

*This document is authoritative for capsule block assignments.*
*Last updated: 2026-07-05 — C1/C2/C3 resolved: eliminated every remaining
documented "safe by design" overlap, not just the real C5 one. init-6.4th
and init-l8-omni.4th (byte-identical) moved off init.4th's range; doe.4th
moved into its own already-documented 2100–2199 range; all 9 workload
capsules moved off the shared 3001–3060 range into private zones at
4406–4842. Added a callout that LBN 3072+ (everything infrastructure
capsules and workload capsules now occupy) is Artemis's virtio-blk disk,
not a ramdrive — discovered while sizing free space for this renumbering.
Reverified with a full three-arch (amd64/aarch64/riscv64) TRIPOD-TEST
boot: zero FAIL lines, matching dict_hash at every checkpoint on all three
architectures, identical to the pre-renumbering baseline (the moved
capsules aren't in the default Tripod boot path).*

*Doc-debt pass, 2026-07-08 — every block-table row was checked directly
against the live `.4th` files and `mkcapsule --manifest`'s authoritative
block map (not against this document's own prior claims). Corrected:
`ACL.4th`'s entire 4001–4007 table (every row previously described words
that don't exist, e.g. `ACL-BOOT-STRICT`); `doe-campaign.4th`'s entire
table (previously fictional, e.g. "CSV output formatting" — real content
is `SETUP-VMS`/`CD-TICK`/`CAMPAIGN`, migrated this same pass off the
deleted `compudynamics.4th`/`fleet-k.4th` primitives); `doe.4th`'s entire
table (block-shifted against real content); missing `hermes/init.4th`
blocks 4151–4153 and `artemis/init.4th` blocks 4851–4852 (both existed in
source, undocumented, before this pass — 4153/4852 are new `LOAD-DOE`
definitions added this session to fix a second bug found while migrating
`doe-campaign.4th`: it was never defined on either VM). Zero conflicts
per `mkcapsule --manifest capsules`; three-arch QEMU acceptance run for
the `doe-campaign.4th`/`hermes`/`artemis` changes (commit `e2f30bfe`)
before this doc pass. Not re-verified this pass: whether every other
still-unflagged row elsewhere in this document matches source exactly —
this was a targeted correction of the rows touched by recent work plus
`doe.4th`/`ACL.4th`, not a full line-by-line re-audit of all ~250 blocks.*