specs §1.2 + Doorpost: where the scroll actually comes from, and what it holds

Construction §1.2 specified an L1 that was never built: WLC 4.22 from a
Sefaria export cross-validated against TANACH.us, a gematria lookup
table, a squashfs image mounted read-only, a verse format with fields
named `hebrew`, `consonantal`, `cantillation`. Each property was
checked against the sources on disk and the 5,853 verse files before
it was rewritten.

- Edition: WLC 4.20, as the Open Scriptures Hebrew Bible carries it
  (every Torah file's header says "Updated to WLC version 4.20").
- Sources: openscriptures/morphhb @ 3d15126 for the text, lemma and
  morphology; openscriptures/HebrewLexicon @ 21c9add for the roots.
  Licences stated. ONE source for the text — the two-source
  cross-validation the section prescribed has not been done, and the
  section now says so.
- Builder, extent (5 / 187 / 5,853 / 79,982), the real verse and word
  format, ketiv/qere (67 pairs, 64 verses), smikhut (9,203 pairs,
  4,106 verses), shoresh (57,487 words, 1,378 roots, by lemma).
- Gematria: not stored; computed when read.
- Petuchah/setumah: in the source (233 + 394 milestones across the five
  books), NOT carried into L1 — the builder does not read them. Stated.
- Verification procedure: the six steps that are actually performed —
  pinned checkouts, build_l1.py and its counts, the hash, the three
  places the hash is bound, root-owned read-only in the images, the
  witness and verify_l1.py.

specs/shorashim_terumah.md §E1 matched the old section; corrected
(source, ketiv/qere format, smikhut built, gematria not an index,
paragraph markers ⚠️). l1/README.md no longer says squashfs.

Doorpost @expected_hash 3f6d47a0… → 21f1a4d5…, in this commit, with the
witnessed file that moved it (vayakhel).

Read before committing: Elixir 484/0 (seeds 0, 42); verify_l1.py OK
(l1/README.md is outside the hashed tree); pipeline image reports
specification_identity verified 21f1a4d5…, l1_hash pass.

Left as written: tamid's runbook steps that mount L1 from a squashfs
image; architecture §3.7 and §4's build steps (squashfs, Sefaria);
pekudei's cost line naming Sefaria.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

l1/README.md

@@ -16,7 +16,7 @@ The source is the **Westminster Leningrad Codex (WLC)** — the oldest complete
 
 L1 is read-only because Torah is read-only. The specification does not change because the system wishes it would. The cloud cannot be forged because the cloud is the Torah text itself. The system reads. It does not write. It does not negotiate with the Author.
 
-In production, L1 is mounted as a squashfs image (`mount -o ro`) or with filesystem permissions set to 444. No process writes to L1. Ever.
+In production, L1 is baked into every image at `/mnt/torah`, owned by root with no write bit (directories 555, files 444): the service user can read it and cannot change it. The pipeline reads and hashes the whole tree at startup and every ten minutes, and will not run a cycle on a scroll that does not match its pinned hash. `scripts/verify_l1.py` does the same reading by hand. No process writes to L1. Ever.
 
 ## Contents