xHCI: drive Port Reset on port reuse; WIREBIND: kill the console VM too (FABRIC-3.md §XI.5)

Two independent bugs that together caused a reliable hotplug wedge:
reusing an xHCI port for a second identity right after an unclean
detach of a first would leave no further hotplug events reaching the
guest at all.

Bug 1 (xhci.c/xhci_driver.h): the xHCI driver never drove PORTSC.PR --
a known, named gap since Milestone 2e (the code's own comment flagged
it, PORTSC_PR/PRC were defined but never referenced). A port's first
connect each boot reads PED already set, so skipping the reset
happened to work; a second device on the same port after a prior
disconnect reads PED clear, and Address Device reliably failed without
an explicit reset cycle. New XHCI_CONN_AWAIT_PORT_RESET state drives
PR and waits for PED to read set before proceeding to Enable Slot.

Bug 2 (capsule_wirebind.c): capsule_wirebind_eject()/unclean_detach()
compared g_repl_active_vm against the *user* VM's pointer
(g_wirebind_attached_vm_id tracks that one, not the console VM) --
never equal, since USE/g_repl_active_vm always points at the console
VM. The guard never fired and the console VM was never killed at all,
only orphaned -- paired to a dead user VM but still the REPL's active
session. New wirebind_teardown_console() helper resolves and tears
down the console VM by its own tracked bare username.

Verified live on amd64: the exact repro (identity 01 on port 2,
unclean detach, identity 02 on the same port immediately after) --
previously wedged with "xhci: address device failed" and no further
hotplug activity; now attaches cleanly and fast, both VMs' KILL
messages appear, console is immediately interactive on the new
identity. Three-arch clean qemu acceptance passed, all clean on the
first attempt.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Ec88YKxxhZGG1RNnune78

src/starkernel/capsule/capsule_wirebind.c

@@ -262,6 +262,43 @@ static int wirebind_resolve_attached(VMRegistryEntry *out) {
     return 0;
 }
 
+/* FABRIC-3.md, 2026-09-09: shared by capsule_wirebind_eject() and
+ * capsule_wirebind_unclean_detach() -- tears down the *console* VM
+ * (registered under the bare username, e.g. "00" -- capsule_console_
+ * birth() in capsule_wirebind_try_attach() above) paired with the user
+ * VM ("<username>~user") those two functions already kill.
+ *
+ * Real bug found live, 2026-09-09: both functions used to compare
+ * sk_repl_get_active_vm() against entry.vm_ptr, where `entry` comes
+ * from wirebind_resolve_attached() -- which resolves g_wirebind_
+ * attached_vm_id, the *user* VM's id (see that field's own doc comment:
+ * "the user VM, not the console VM"). But USE/g_repl_active_vm always
+ * points at the *console* VM, never the user VM -- so that comparison
+ * was never true, the dangling-pointer guard never fired, and the
+ * console VM was never killed at all here, just silently orphaned
+ * (paired to a now-dead user VM, but still live and still whatever the
+ * active REPL session was). Confirmed live: reusing an xHCI port for a
+ * second identity right after an unclean detach of a first left the
+ * console stuck showing the first identity's own dead-paired prompt.
+ *
+ * Uses g_wirebind_attached_username (the bare username, captured at
+ * attach time) rather than deriving it from entry.name (which is
+ * already the "<user>~user" registry name) -- see capsule_wirebind_
+ * try_attach()'s own comment on why the two names are tracked
+ * separately. Called before either caller clears that field. */
+static void wirebind_teardown_console(void) {
+    if (g_wirebind_attached_username[0] == '\0') return;
+    VMRegistryEntry console_entry;
+    if (capsule_vm_find_by_name(g_wirebind_attached_username, &console_entry) != 0 ||
+        console_entry.state != VM_STATE_LIVE) {
+        return;
+    }
+    if (sk_repl_get_active_vm() == (VM *)console_entry.vm_ptr) {
+        sk_repl_set_active_vm((VM *)0);
+    }
+    capsule_vm_kill(console_entry.name);
+}
+
 int capsule_wirebind_eject(void) {
     VMRegistryEntry entry;
     if (wirebind_resolve_attached(&entry) != 0) {
@@ -273,10 +310,7 @@ int capsule_wirebind_eject(void) {
      * remove (§F.10 decision 1). */
     blk_vm_flush_all((VM *)entry.vm_ptr);
 
-    if (sk_repl_get_active_vm() == (VM *)entry.vm_ptr) {
-        sk_repl_set_active_vm((VM *)0);
-    }
-
+    wirebind_teardown_console();
     capsule_vm_kill(entry.name);
     g_wirebind_attached_valid       = 0;
     g_wirebind_attached_dev         = (struct blkio_dev *) 0;
@@ -306,10 +340,7 @@ void capsule_wirebind_unclean_detach(struct blkio_dev *dev) {
     /* Device is already gone (§F.10 decision 2) -- no flush attempted;
      * data since the last flush is lost, matching real-OS unclean-removal
      * semantics. */
-    if (sk_repl_get_active_vm() == (VM *)entry.vm_ptr) {
-        sk_repl_set_active_vm((VM *)0);
-    }
-
+    wirebind_teardown_console();
     capsule_vm_kill(entry.name);
     g_wirebind_attached_valid       = 0;
     g_wirebind_attached_dev         = (struct blkio_dev *) 0;