Prerequisite for FABRIC-3.md §XXXV.6's ratified re-mint: capsule_mint.c's
capsule_mint_identity() refuses to write over an already-recognized drive
(MINT_ERR_ALREADY_MINTED, mirrors WRITE(10)'s refuse-on-non-blank-media
rule), so all 9 existing certs had to be destroyed before any of them
could be re-minted against the new 1 GiB artemis.img. Confirmed root
cause first: Zuse's genesis marker (zuse_pubkey) lives on Artemis's own
disk fence (devblock_from_top=0), not on her thumbdrive -- capsule_zuse_
boot.c's capsule_zuse_boot_try_attach() silently no-ops if her drive
isn't blank and the marker is missing, so the old zuse-thumb-ident.img
could not re-authenticate against the fresh artemis.img regardless.
All 9 images (zuse, bob, 00-06) verified all-zero, 64 MiB size intact.
Re-mint itself (live QEMU boot + MINT) not yet performed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Documents the full scope of the driver's single-device-at-a-time state
(connect/enumerate, control-transfer, and BOT state machines), the
persistent-vs-in-flight distinction that bounds the fix, the concurrency
target, and a numbered punch list. No driver code has been touched —
implementation is explicitly held pending go-ahead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018EjXFo7mPXjUMjfJeuUUz4