specs §1.2 + Doorpost: where the scroll actually comes from, and what it holds

Construction §1.2 specified an L1 that was never built: WLC 4.22 from a
Sefaria export cross-validated against TANACH.us, a gematria lookup
table, a squashfs image mounted read-only, a verse format with fields
named `hebrew`, `consonantal`, `cantillation`. Each property was
checked against the sources on disk and the 5,853 verse files before
it was rewritten.

- Edition: WLC 4.20, as the Open Scriptures Hebrew Bible carries it
  (every Torah file's header says "Updated to WLC version 4.20").
- Sources: openscriptures/morphhb @ 3d15126 for the text, lemma and
  morphology; openscriptures/HebrewLexicon @ 21c9add for the roots.
  Licences stated. ONE source for the text — the two-source
  cross-validation the section prescribed has not been done, and the
  section now says so.
- Builder, extent (5 / 187 / 5,853 / 79,982), the real verse and word
  format, ketiv/qere (67 pairs, 64 verses), smikhut (9,203 pairs,
  4,106 verses), shoresh (57,487 words, 1,378 roots, by lemma).
- Gematria: not stored; computed when read.
- Petuchah/setumah: in the source (233 + 394 milestones across the five
  books), NOT carried into L1 — the builder does not read them. Stated.
- Verification procedure: the six steps that are actually performed —
  pinned checkouts, build_l1.py and its counts, the hash, the three
  places the hash is bound, root-owned read-only in the images, the
  witness and verify_l1.py.

specs/shorashim_terumah.md §E1 matched the old section; corrected
(source, ketiv/qere format, smikhut built, gematria not an index,
paragraph markers ⚠️). l1/README.md no longer says squashfs.

Doorpost @expected_hash 3f6d47a0… → 21f1a4d5…, in this commit, with the
witnessed file that moved it (vayakhel).

Read before committing: Elixir 484/0 (seeds 0, 42); verify_l1.py OK
(l1/README.md is outside the hashed tree); pipeline image reports
specification_identity verified 21f1a4d5…, l1_hash pass.

Left as written: tamid's runbook steps that mount L1 from a squashfs
image; architecture §3.7 and §4's build steps (squashfs, Sefaria);
pekudei's cost line naming Sefaria.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

vav_pipeline/lib/vav_pipeline/doorpost.ex

@@ -175,7 +175,7 @@ defmodule VavPipeline.Doorpost do
   # changes; the update is a deliberate operator commit. A bare
   # hash-update commit (without a corresponding spec change in the
   # same commit) is itself a drift signal.
-  @expected_hash "3f6d47a0b91ce12a1002cfe2d0a6bfe7af4fb280cd05264c87ba914d258a06fe"
+  @expected_hash "21f1a4d52e21a166be243533f71e7b5be1ab13ac55670a0811ba5b1b4d29fa56"
 
   @doc "Return the list of files that constitute the category-grade specification."
   @spec files() :: [String.t()]