Wire homeblocks_sig_check() into USB attach: the warn half (Phase 8)

Wired into sk_repl_idle()'s USB hotplug attach handler, right between
blkio_usb_open_msc() succeeding and blk_subsys_attach_device() -- logs
a distinct message per outcome (recognized / blank-or-foreign /
bad-version / bad-crc / read-error).

The "refuse" half is deliberately not implemented -- there is nothing
real to gate yet. blkio_usb.c has no SCSI WRITE(10) support at all, so
there is no write path today to refuse; attach currently only enables
read-only access, which is also the general-purpose USB block I/O
path this repo already relies on for unrelated testing, not
exclusively a home-blocks identity workflow. Refusing attach on blank
media would break that legitimate use without protecting anything
real -- same "don't build ahead of a real caller" reasoning EXPIRE's
deferral used. Refuse belongs on the write path once WRITE(10) exists.

sig_start_fblock is hardcoded to 0 at the call site -- correct for
today's unpartitioned raw test/real media (no GPT parser exists yet),
flagged in the comment as the one place that changes once a real
GPT-partition-relative lookup exists, isolated from
homeblocks_sig.c's own location-agnostic check logic.

Verified live: hot-attached disk/usb-thumbdrive-test.img (blank media)
through a running amd64 instance's QMP socket (blockdev-add +
device_add usb-storage) -- captured exactly 4 real TUR+READ10 BOT
cycles (matching the header's 4 forth-block span) followed by the
correct "not recognized" warning, then normal attach completing
successfully afterward (no regression). Conservation intact, no
panic. Clean zero-warning compile and clean boot on all three
architectures.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn

FABRIC-3.md

@@ -235,9 +235,35 @@ decisions get added here, not to `FABRIC-2.md`. Follow the same discipline `FABR
   build/link regression from exposing `compute_crc64` and adding the new source file to
   every kernel build.
 
-- [ ] Implement the warn-and-refuse behavior for blank/foreign/unrecognized media — this is
-  where `homeblocks_sig_check()` above actually gets a live caller, wiring it into the real
-  drive-insertion path.
+- [x] **Implemented (2026-08-26): the "warn" half, live and wired.** Wired into
+  `sk_repl_idle()`'s USB hotplug attach handler (`repl.c`), right between
+  `blkio_usb_open_msc()` succeeding and `blk_subsys_attach_device()` — calls
+  `homeblocks_sig_check(&usb_blk_dev, 0, &sig)` and logs a distinct message per outcome
+  (recognized / blank-or-foreign / bad-version / bad-crc / read-error).
+
+  **The "refuse" half is deliberately not implemented — there is nothing real to gate yet.**
+  `blkio_usb.c` has no SCSI `WRITE(10)` support at all (Milestone 2's biggest open item), so
+  there is no write path today to refuse; the only thing attach currently enables is
+  read-only access, which is also the general-purpose USB block I/O path this repo already
+  relies on for unrelated testing, not exclusively a home-blocks identity workflow. Refusing
+  attach on blank media would have broken that legitimate use without protecting anything
+  real — building that gate now would be enforcement with no live consumer, the same
+  "don't build ahead of a real caller" reasoning `EXPIRE`'s deferral used. Refuse belongs on
+  the write path once `WRITE(10)` exists to give it something to gate against.
+
+  `sig_start_fblock` is hardcoded to `0` at the call site — correct for today's unpartitioned
+  raw test/real media (no GPT parser exists yet), explicitly flagged in the code comment as
+  the one place that will need to change to a real GPT-partition-relative lookup once that
+  parser lands, isolated from `homeblocks_sig.c`'s own location-agnostic check logic.
+
+  **Verified live**, not just compiled: hot-attached `disk/usb-thumbdrive-test.img` (blank
+  media, no `LAHB` magic) through a running amd64 instance's QMP socket (`blockdev-add` +
+  `device_add usb-storage,bus=xhci0.0`) — captured exactly 4 real TUR+READ10 BOT cycles
+  (matching the header's 4 forth-block span) followed by `xhci: USB drive not recognized
+  (blank or foreign media) -- read-only general use only`, then normal attach completing
+  successfully afterward (no regression — no `MSC block-subsystem attach failed`).
+  Conservation intact, no panic. Clean zero-warning compile and clean boot on all three
+  architectures.
 
 - [ ] Extend `acl_pinned`'s one-way-ratchet mechanism (already exists, already proven, just
   needs applying) to gate zuse credential minting specifically — confirm whether this

src/starkernel/repl.c

@@ -36,6 +36,7 @@
 #include "starkernel/arch.h"
 #include "starkernel/xhci_driver.h"
 #include "starkernel/blkio_usb.h"
+#include "starkernel/homeblocks_sig.h"
 #include "block_subsystem.h"
 #include "word_source/include/keyboard_words.h"
 #include "word_source/include/block_words.h"
@@ -107,6 +108,45 @@ static void sk_repl_idle(VM *active_vm)
         uint32_t slot_id = xdev->bot_msc_attach_slot_id;
 
         int rc = blkio_usb_open_msc(&usb_blk_dev, xdev, slot_id);
+        if (rc == 0) {
+            /* FABRIC-3.md Milestone 4: warn on blank/foreign/unrecognized
+             * media -- the "warn" half. No "refuse" half yet: blkio_usb.c
+             * has no SCSI WRITE(10) support at all (Milestone 2's biggest
+             * open item), so there is no write path today to refuse --
+             * only read-only attach, which is also the general-purpose USB
+             * block I/O path this repo already relies on for unrelated
+             * testing, not exclusively a home-blocks identity workflow.
+             * Refusing attach on blank media here would break that
+             * legitimate use without protecting anything real yet. Refuse
+             * belongs on the write path, once WRITE(10) gives it something
+             * to gate.
+             *
+             * sig_start_fblock = 0: correct for today's unpartitioned raw
+             * test/real media (no GPT parser exists yet -- see
+             * homeblocks_sig.h's own doc). Will need to become a real
+             * GPT-partition-relative lookup once that parser lands; this is
+             * the one place that changes, isolated from homeblocks_sig.c's
+             * own location-agnostic check. */
+            homeblocks_sig_t         sig;
+            homeblocks_sig_result_t  sig_rc = homeblocks_sig_check(&usb_blk_dev, 0, &sig);
+            switch (sig_rc) {
+                case HOMEBLOCKS_SIG_OK:
+                    console_println("xhci: USB drive recognized as a home-blocks drive");
+                    break;
+                case HOMEBLOCKS_SIG_BLANK:
+                    console_println("xhci: USB drive not recognized (blank or foreign media) -- read-only general use only");
+                    break;
+                case HOMEBLOCKS_SIG_BAD_VERSION:
+                    console_println("xhci: USB drive has a home-blocks header of an unrecognized version -- read-only general use only");
+                    break;
+                case HOMEBLOCKS_SIG_BAD_CRC:
+                    console_println("xhci: USB drive has a home-blocks header that fails its checksum (corrupt or tampered) -- read-only general use only");
+                    break;
+                case HOMEBLOCKS_SIG_READ_ERROR:
+                    console_println("xhci: USB drive signature check failed to read the device -- read-only general use only");
+                    break;
+            }
+        }
         if (rc == 0 && blk_subsys_attach_device(&usb_blk_dev) == BLK_OK) {
             xdev->bot_msc_attached = 1;
         } else {