Zuse default-attach: xHCI initial-port-scan fix, ZUSEDISK wiring, mismatched-marker resync

xhci_bringup() now scans for already-connected ports at bring-up
(xhci_scan_ports_for_already_connected()), not just later hotplug events,
so a USB device present on the QEMU command line at launch is detected.
Makefile.starkernel attaches disk/zuse.img on the xhci0 bus by default in
all three arch qemu targets (ZUSEDISK=, empties for a bare boot).

capsule_mint_identity() gained a drive_known_blank param to skip a fully
redundant second homeblocks_sig_check() when the caller already confirmed
HOMEBLOCKS_SIG_BLANK itself.

Root-caused what looked like a hang after the drive attached: Artemis's
fence still carried a genesis marker from before a mid-session reformat,
while the reformatted disk/zuse.img read back BLANK -- a mismatched pair
capsule_zuse_boot_try_attach() correctly declined to act on, leaving the
boot idling at a plain ok> with nothing left to log (indistinguishable
from a hang under slow TCG). Fixed by zeroing both disk/artemis.img and
disk/zuse.img at their original sizes, giving a matched blank pair.
Verified full three-architecture acceptance: amd64 fresh genesis-mint,
aarch64/riscv64 clean reload against the same now-minted images.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KBjfeLPo71sUQ8zC7V7P5m

Makefile.starkernel

@@ -101,6 +101,27 @@ DOE_LATEST_DIR     := experiments/bare_metal/latest
 
 CAPSULES_DIR       ?= capsules
 ARTDISK            ?= disk/artemis.img
+# ZUSEDISK -- Zuse's own minted USB thumbdrive, attached by default so a
+# plain `make qemu` lands already authenticated into the Zuse identity
+# (Captain Bob, 2026-08-28). Attached at QEMU launch time via -drive/
+# -device on the qemu-xhci controller each arch's qemu target already
+# creates; xhci_bringup()'s initial port scan (src/starkernel/usb/xhci.c)
+# is what makes an already-connected-at-launch device visible at all --
+# xhci_poll_events() alone is purely hotplug-event-driven and would never
+# see a device present before controller reset. Override to "" (empty) to
+# boot without Zuse attached, e.g. `make -f Makefile.starkernel qemu ZUSEDISK=`.
+ZUSEDISK           ?= disk/zuse.img
+# Precomputed (not inlined as $(if ...,...)) because the drive/device specs
+# below are comma-heavy and GNU make's $(if) function splits its own
+# arguments on every top-level comma -- inlining it silently truncated the
+# flags to just "-drive if=none" with everything past the next comma
+# dropped, confirmed live via `ps aux` showing the truncated qemu command
+# line (2026-08-28).
+ifneq ($(strip $(ZUSEDISK)),)
+ZUSEDISK_QEMU_ARGS := -drive if=none,id=zusedrv,file=$(ZUSEDISK),format=raw -device usb-storage,bus=xhci0.0,drive=zusedrv
+else
+ZUSEDISK_QEMU_ARGS :=
+endif
 MKCAPSULE_SRC       = tools/mkcapsule.c tools/pkcs8_ed25519.c \
                       src/starkernel/crypto/ed25519.c \
                       src/starkernel/crypto/fe25519.c \
@@ -785,6 +806,7 @@ ifeq ($(ARCH),amd64)
 		-drive id=artdisk,file=$(ARTDISK),format=raw,if=none \
 		-device virtio-blk-pci,drive=artdisk \
 		-device qemu-xhci,id=xhci0 \
+		$(ZUSEDISK_QEMU_ARGS) \
 		-object rng-random,id=rng0,filename=/dev/urandom \
 		-device virtio-rng-pci,rng=rng0 \
 		-chardev socket,id=cserial,path=$$SERIAL_SOCK,server=on,wait=off,logfile=$$LOG \
@@ -868,6 +890,7 @@ else ifeq ($(ARCH),aarch64)
 		-device virtio-blk-pci,drive=artdisk \
 		-device virtio-keyboard-pci,addr=0x3 \
 		-device qemu-xhci,id=xhci0,addr=0x4 \
+		$(ZUSEDISK_QEMU_ARGS) \
 		-object rng-random,id=rng0,filename=/dev/urandom \
 		-device virtio-rng-pci,rng=rng0,addr=0x5 \
 		-device ramfb \
@@ -957,6 +980,7 @@ else ifeq ($(ARCH),riscv64)
 		-device virtio-blk-pci,drive=artdisk,addr=0x1 \
 		-device virtio-keyboard-pci,addr=0x3 \
 		-device qemu-xhci,id=xhci0,addr=0x4 \
+		$(ZUSEDISK_QEMU_ARGS) \
 		-object rng-random,id=rng0,filename=/dev/urandom \
 		-device virtio-rng-pci,rng=rng0,addr=0x5 \
 		-device ramfb \

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-08-28T22:27:23Z -->
+<!-- Generated by mkcapsule --manifest  2026-08-29T01:39:10Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->

include/starkernel/capsule_mint.h

@@ -79,12 +79,28 @@ typedef enum {
  *                   install the cert into Hera's own VM immediately
  *                   (vm_zuse_cert_install()) -- the seed otherwise only
  *                   ever lives on the minted thumbdrive.
+ * @param drive_known_blank Pass 1 when the caller has *already* just run
+ *                   homeblocks_sig_check() on dev and confirmed
+ *                   HOMEBLOCKS_SIG_BLANK (e.g. capsule_zuse_boot_try_
+ *                   attach(), which must check sig_rc before it can even
+ *                   decide to call this) -- skips this function's own
+ *                   internal "refuse to overwrite" re-check, which
+ *                   otherwise repeats the exact same full BOT read
+ *                   sequence a second time for no reason (found live,
+ *                   FABRIC-3.md §F.25/§F.26: the redundant check was
+ *                   mistaken for a hang before the real cause -- leaked
+ *                   `tail -f` processes from repeated hard kills during
+ *                   the same debugging session -- was found). Pass 0 from
+ *                   any caller (like MINT, mama_forth_words.c) that has
+ *                   not already checked -- the safety check still applies
+ *                   there.
  * @return MINT_OK on success, an error code otherwise.
  */
 MintResult capsule_mint_identity(struct blkio_dev *dev, VM *issuer_vm,
                                   const char *full_name, const char *username,
                                   const char *email, const char *phone,
-                                  uint8_t out_pubkey[32], uint8_t out_seed[32]);
+                                  uint8_t out_pubkey[32], uint8_t out_seed[32],
+                                  int drive_known_blank);
 
 #endif /* __STARKERNEL__ */