FABRIC-3.md §I.3/§I.8: WIREBIND EJECT/detach + EXPIRE re-scoped as logout

Closes §I.3 (Milestone 5 remainder): WIREBIND now tracks which VM is
attached via the home-blocks USB path, and a new EJECT word plus the
existing hot-unplug signal both flush/reset-console/kill through it
(FABRIC-3.md §F.10).

Closes §I.8 (EXPIRE/ACL), re-scoped: the original "admit the zuse
session as a Stadium patron and reap on TTL" plan was invalidated a
second time -- Zuse authenticates directly onto Hera, who is patron
zero and permanently pinned, so there is no patron for a reap sweep to
ever find. Built instead as a detach-triggered logout
(capsule_zuse_boot_logout()), the same trigger EJECT/hot-unplug use for
regular WIREBIND users, so neither identity is a special case. Required
a companion fix: install_and_activate() used to skip re-running
ACL-ZUSE-BOOT whenever the cert was already installed, which made a
logout permanent for the rest of the boot; the outer re-attach gate now
checks zuse_session (clears on logout) instead of zuse_cert_installed
(a deliberate permanent one-way ratchet, left untouched).

Verified 3-arch boot to ok> (amd64/aarch64/riscv64, each in the
foreground) after both steps; logs and DoE CSVs from this session's
verification runs included per this repo's own audit-artifact
convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019YcT3H2PQeyujrzjqS3Var

include/starkernel/capsule_wirebind.h

@@ -78,6 +78,40 @@ void capsule_wirebind_try_attach(struct blkio_dev *dev,
                                   const homeblocks_sig_t *sig,
                                   VM *mama_vm);
 
+/**
+ * capsule_wirebind_eject - Graceful detach of whatever VM is currently
+ * attached via the home-blocks USB path (FABRIC-3.md §F.10, decision 1).
+ * The drive is still physically present when this runs.
+ *
+ * Sequence: resolve the tracked attached-VM id to a live registry entry
+ * (no-op, returns -1, if nothing is tracked or the entry is already
+ * dead/gone -- capsule_vm_kill()'s own idempotency covers a VM already
+ * killed by some other path); blk_vm_flush_all() while the VM is still
+ * alive; if the console's active VM is this same VM, reset it to Hera
+ * (sk_repl_set_active_vm(NULL)) *before* teardown -- required, not
+ * optional, to avoid a dangling console pointer; capsule_vm_kill() by
+ * name; clear the tracked state.
+ *
+ * Single-USB-device constraint (§F.8) means there is never more than one
+ * candidate, so this always targets "whatever's currently attached" --
+ * no name argument.
+ *
+ * @return 0 on success, -1 if nothing was attached to eject.
+ */
+int capsule_wirebind_eject(void);
+
+/**
+ * capsule_wirebind_unclean_detach - Abrupt-path counterpart to
+ * capsule_wirebind_eject() (FABRIC-3.md §F.10, decision 2 -- the UNCLEAN
+ * node, closed alongside EJECT). Called from the existing
+ * bot_msc_detach_pending hot-unplug signal (repl.c) -- the device is
+ * already gone by the time this runs, so no flush is attempted; data
+ * since the last flush is lost, which is correct unclean-removal
+ * semantics. Otherwise identical to capsule_wirebind_eject(): same
+ * active-VM reset-before-kill step, same tracked-state clear.
+ */
+void capsule_wirebind_unclean_detach(void);
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_CAPSULE_WIREBIND_H */

include/starkernel/capsule_zuse_boot.h

@@ -58,6 +58,28 @@ void capsule_zuse_boot_try_attach(struct blkio_dev *dev,
                                    const homeblocks_sig_t *sig,
                                    VM *mama_vm);
 
+/**
+ * capsule_zuse_boot_logout - End Zuse's session when her own attached
+ * drive detaches (FABRIC-3.md §I.8, re-scoped 2026-09-04: no identity is
+ * different here -- Zuse logs out on device removal exactly like a
+ * WIREBIND user does, not via a Stadium-patron TTL. She has no separate
+ * VM or blocks of her own, so unlike capsule_wirebind_eject()/
+ * _unclean_detach() there is no flush step to skip on the abrupt path --
+ * one function covers both the graceful (EJECT) and abrupt (hot-unplug)
+ * call sites identically.
+ *
+ * No-op if the currently-tracked attached device isn't Zuse's own
+ * (nothing to do -- some other identity's drive is what's leaving, or
+ * nothing is attached at all). Clears mama_vm->zuse_session only --
+ * zuse_cert_installed and the cert itself stay put, permanently, per
+ * vm_zuse_cert_install()'s own one-way design; re-attaching her own
+ * drive re-authenticates via capsule_zuse_boot_try_attach() without
+ * re-minting anything.
+ *
+ * @param mama_vm Hera's own VM (zuse_session lives here).
+ */
+void capsule_zuse_boot_logout(VM *mama_vm);
+
 #endif /* __STARKERNEL__ */
 
 #endif /* STARKERNEL_CAPSULE_ZUSE_BOOT_H */