wip(kernel): the proxy Zuse -- a stick's first boot mints its own Zuse (#92, Task 1) [skip ci]

Work in progress on StarForth-v4.0.0; not yet accepted (plan
2026-10-29-stick-5, Task 1).

- zuse_genesis_marker.h: the marker's version 2 -- the proxy's key and the
  real Zuse's -- beside version 1.
- capsule_zuse_boot.c: capsule_zuse_boot_check_key() (the identity-record
  half of the check) and capsule_zuse_boot_genesis_mint() (the mint half of
  v3's genesis) split out; v3's two callers unchanged in behaviour.
- sk_v4_marker.c: the v4 boot reads version 1 as a proxy with no real Zuse,
  and writes version 2.
- sk_v4_identity.c: no marker and a blank identity partition -> genesis:
  mint, read back, then the marker; the proxy logs in. A marker with a real
  key: no session for the proxy (the fixed screen is Task 5).
- qemu_session.py: boot()/shutdown(), so a mode can boot twice; modes
  genesis and stick_genesis; stick_boot now expects genesis and the prompt.

Logs: genesis on amd64 before the change (both boots: "no genesis on this
disk", FAIL) and after (minted, then recognised: PASS). The DoE CSV of
032532 is from a run whose QEMU never started (no display; its empty log
directory was removed).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

kernel/include/starkernel/capsule_zuse_boot.h

@@ -50,6 +50,28 @@ zuse_drive_t capsule_zuse_boot_check(struct blkio_dev *dev,
                                       const homeblocks_sig_t *sig,
                                       uint8_t seed[32], uint8_t pubkey[32]);
 
+/**
+ * capsule_zuse_boot_check_key - The identity-record half of
+ * capsule_zuse_boot_check(): the drive's identity record (magic, version,
+ * CRC-64) and its public key against @p want, with no marker read
+ * (plan 2026-10-29-stick-5, Task 1: the v4 boot checks against either of the
+ * version 2 marker's keys). ZUSE_DRIVE_HERS, with @p seed and @p pubkey
+ * filled in, or ZUSE_DRIVE_NOT_HERS. Writes nothing.
+ */
+zuse_drive_t capsule_zuse_boot_check_key(struct blkio_dev *dev,
+                                          homeblocks_sig_result_t sig_rc,
+                                          const homeblocks_sig_t *sig,
+                                          const uint8_t want[32],
+                                          uint8_t seed[32], uint8_t pubkey[32]);
+
+/**
+ * capsule_zuse_boot_genesis_mint - The mint half of v3's genesis, with no VM:
+ * Zuse's identity minted onto the blank drive @p dev (genesis mode,
+ * capsule_mint_identity()). Returns 0 with @p seed and @p pubkey filled in,
+ * or -1. Writes no marker: each caller writes its own.
+ */
+int capsule_zuse_boot_genesis_mint(struct blkio_dev *dev, uint8_t seed[32], uint8_t pubkey[32]);
+
 /**
  * capsule_zuse_boot_root_pubkey - Zuse's public key from the genesis
  * marker. Returns 0 with @p pubkey filled in, or -1 (no genesis yet, or the

kernel/include/starkernel/v4/sk_v4_marker.h

@@ -0,0 +1,30 @@
+/* sk_v4_marker.h -- the genesis marker, as the v4 boot reads and writes it:
+ * version 2, the stick's proxy Zuse and the real Zuse (docs/v4.0.0/STICK.md 6,
+ * 6a; plan 2026-10-29-stick-5, Task 1). On Artemis's metadata fence,
+ * devblock 0 from the top (blk_meta_zone_read/write), as v3's version 1.
+ *
+ * Built only with STARFORTH_V4=1 (Kconfig.kernel).
+ */
+#ifndef STARKERNEL_V4_SK_V4_MARKER_H
+#define STARKERNEL_V4_SK_V4_MARKER_H
+
+#include <stdint.h>
+
+typedef struct {
+    int     present;      /* a marker is on the fence: genesis has happened */
+    uint8_t proxy[32];    /* the stick's proxy Zuse */
+    int     has_real;     /* the real Zuse is minted, on a second stick */
+    uint8_t real[32];     /* her key, when has_real */
+} sk_v4_marker_t;
+
+/* The marker on the first disk slot's fence. A version 1 marker (v3's, the
+ * minted pair's) reads as a proxy with no real Zuse. Returns 0 with @p m
+ * filled in; -1 when there is none or it fails its checks (@p m then reads
+ * present = 0). */
+int sk_v4_marker_read(sk_v4_marker_t *m);
+
+/* Write @p m to the fence, always as version 2. Returns 0, or -1 on a write
+ * error. */
+int sk_v4_marker_write(const sk_v4_marker_t *m);
+
+#endif /* STARKERNEL_V4_SK_V4_MARKER_H */

kernel/include/starkernel/zuse_genesis_marker.h

@@ -43,4 +43,26 @@ typedef struct {
 _Static_assert(sizeof(zuse_genesis_marker_t) == 4096,
                "zuse_genesis_marker_t must be exactly one 4 KiB devblock");
 
+/* Version 2 (docs/v4.0.0/STICK.md 6, 6a; plan 2026-10-29-stick-5, Task 1): the
+ * same magic and devblock, two keys -- the stick's proxy Zuse, minted at its
+ * first boot, and the real Zuse, minted onto a second stick (zero, and
+ * has_real 0, until she is). Written and read only by the v4 boot
+ * (sk_v4_marker.c), which reads a version 1 marker as a proxy with no real
+ * Zuse. v3 reads version 1 only, and never runs from a stick (STICK.md 5.5). */
+#define ZUSE_GENESIS_MARKER_VERSION_2 2u
+
+typedef struct {
+    uint32_t magic;            /* ZUSE_GENESIS_MARKER_MAGIC */
+    uint32_t version;          /* ZUSE_GENESIS_MARKER_VERSION_2 */
+    uint8_t  proxy_pubkey[32]; /* the stick's proxy Zuse */
+    uint8_t  real_pubkey[32];  /* the real Zuse, when has_real */
+    uint32_t has_real;         /* 1 once the real Zuse is minted */
+    uint32_t _reserved;        /* zero: makes the padding before crc explicit */
+    uint64_t crc;              /* CRC-64/ISO over every byte before this field */
+    uint8_t  _pad[4096 - (4 + 4 + 32 + 32 + 4 + 4 + 8)];
+} zuse_genesis_marker_v2_t;
+
+_Static_assert(sizeof(zuse_genesis_marker_v2_t) == 4096,
+               "zuse_genesis_marker_v2_t must be exactly one 4 KiB devblock");
+
 #endif /* STARKERNEL_ZUSE_GENESIS_MARKER_H */