Block 4019
( block-acl.4th - Block-Level Access Control  BMAPFMT )
( C prims: BLK-ACL-ALLOW@ BLK-ACL-ALLOW! BLK-ACL-TTL@ )
( BLK-ACL-TTL! BLK-OWNER@ )
( Policy words this file: BLK-ACL-CHECK )
( Mirrors ACL.4th's C-primitive/FORTH-policy split, )
( applied to blocks instead of words. )
( FABRIC-3.md H.12 step 16, 2026-09-03. )
256 CONSTANT BLK-ACL-BASE-TTL

Block 4020
( BLK-ACL-CHECK  block# -- allow?                     )
( Fast-deny check, vm.c 611-624's pattern applied to  )
( a block. First touch: default-permissive claim --   )
( allow=1, TTL=BLK-ACL-BASE-TTL -- matching the word  )
( card's own default. No automatic TTL decrement loop )
( exists for blocks yet -- words decrement per word   )
( dispatch, blocks have no equivalent hot path -- but )
( this is a real, working fast-deny gate either way.  )
: BLK-ACL-CHECK ( block# -- allow? )
  DUP BLK-ACL-TTL@ 0= IF
    DUP BLK-ACL-BASE-TTL SWAP BLK-ACL-TTL!
    DUP 1 SWAP BLK-ACL-ALLOW!
  THEN
  BLK-ACL-ALLOW@ ;