Artemis Milestone 2g (partial): bulk endpoint discovery + 2e disconnect teardown

Picked up from a crashed session: xhci_driver.h/xhci.h already had the
bulk_in/out_ep_addr/max_packet fields and Endpoint-descriptor offset
macros scaffolded, but the actual walk that populates them was never
written. Added it: after 2f confirms a Mass Storage/SCSI/BOT interface,
a nested walk continues through the Endpoint descriptors that follow it
(bDescriptorType==5, stopping at the next Interface descriptor or end
of stream), keeping only Bulk-type endpoints and splitting IN/OUT by
bEndpointAddress bit 7. Also reset the four new fields in
xhci_bringup(), which the scaffolding had missed.

Also completed 2e's disconnect teardown, which was fully implemented
this session (not scaffolded): a Disable Slot command is now submitted
on a real disconnect, with the port's tracked slot ID captured and
cleared from port_slot_id[] immediately (before the command completes)
so a fresh connect on the same port isn't confused for one already in
progress, and DCBAA[slot_id] cleared only on a successful completion.

Verified live via QMP hotplug (deliberate device_add/device_del against
freshly launched, individually-tracked instances -- not whatever
happened to be attached at boot), all three architectures,
byte-identical: bulk IN endpoint=0x81, bulk OUT endpoint=0x02, then a
clean disconnect -> disable slot succeeded, no wedge. Caught and fixed
a documentation near-miss in the same pass: an initial draft cited the
probe-free three-arch acceptance boots as this feature's verification
evidence, but a stale leftover log directory from a pre-crash orphaned
QEMU process had been picked up by an `ls -dt | head -1` glob during
monitoring and mistaken for this session's own result -- the real
acceptance logs never had a device attached at all. Re-verified against
real PIDs and real log paths before writing FABRIC-2.md's final
writeup.

FABRIC-2.md Section X Milestone 2 updated: 2e's disconnect-teardown
checklist item marked done, 2g's endpoint-identification item marked
partially done (identification only -- Configure Endpoint / EP Context
wiring is still open).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R4VMX6VSKCten8nGgaMkq4

include/starkernel/xhci.h

@@ -192,6 +192,7 @@ typedef struct {
 /* TRB types used by this driver (subset — xHCI defines many more) */
 #define XHCI_TRB_TYPE_LINK                   6   /* ring-wraparound marker, Command/Transfer Rings only */
 #define XHCI_TRB_TYPE_ENABLE_SLOT_CMD      9
+#define XHCI_TRB_TYPE_DISABLE_SLOT_CMD     10
 #define XHCI_TRB_TYPE_ADDRESS_DEVICE_CMD    11
 #define XHCI_TRB_TYPE_SETUP_STAGE             2   /* Transfer Ring, control transfers only */
 #define XHCI_TRB_TYPE_DATA_STAGE              3
@@ -260,6 +261,19 @@ typedef struct {
 #define USB_SUBCLASS_SCSI            0x06u  /* SCSI transparent command set */
 #define USB_PROTOCOL_BOT             0x50u  /* Bulk-Only Transport */
 
+/* Standard USB Endpoint descriptor field offsets (7 bytes, USB 2.0 spec
+ * table 9-13) -- found the same way as the Interface descriptor: walked
+ * by bDescriptorType within the concatenated stream, not a fixed offset,
+ * since the number of endpoints on the interface isn't known up front. */
+#define USB_DESC_TYPE_ENDPOINT        5u
+#define USB_EP_OFF_ADDRESS            2u  /* bEndpointAddress: bit 7 = direction, bits 3:0 = number */
+#define USB_EP_OFF_ATTRIBUTES         3u  /* bmAttributes: bits 1:0 = transfer type */
+#define USB_EP_OFF_MAX_PACKET_SIZE    4u  /* wMaxPacketSize, 2 bytes */
+#define USB_EP_ADDR_DIR_MASK          0x80u
+#define USB_EP_ADDR_NUM_MASK          0x0Fu
+#define USB_EP_ATTR_TYPE_MASK         0x03u
+#define USB_EP_TYPE_BULK              0x02u
+
 /* Command Completion Event TRB layout (xHCI 1.2 spec table 6-32):
  * parameter[63:4] = Command TRB Pointer, status[31:24] = Completion Code,
  * status[23:0] = unused here, control[31:24] = Slot ID (Enable Slot's