Artemis Milestone 2e (in progress): xHCI Command Ring write path proven live

Enable Slot command TRB submitted via a new xhci_submit_command()/
xhci_cmd_enable_slot(), ring doorbell 0, confirmed by a real Command
Completion Event on all three architectures -- the first time this driver
has written a TRB rather than only reading the Event Ring (2d). Added the
Command Ring's previously-missing Link TRB (xHCI 1.2 spec sec 4.9.2) for
wraparound correctness.

Port Register connect/disconnect handling, slot-ID/context bookkeeping,
Address Device, and the callback surface into Section U's code are still
open -- this is the discriminating first step, not full 2e.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HZ8kNoTuP63pbQtro4qvrm

FABRIC-2.md

@@ -3217,6 +3217,29 @@ Final three-arch acceptance (probe-free, `clean qemu`): all three boot to `ok>`
       calling into block_subsystem.c directly (matching the existing "kernel/Artemis
       decoupling boundary" pattern already documented in `block_subsystem.c`)
 
+**In progress, 2026-08-22 — Command Ring write path proven live before building the rest of
+2e on top of it.** Before touching the Port Register / connect-vs-disconnect logic above, the
+driver had never once written a TRB or rung a doorbell — `xhci_poll_events()` was read-only.
+Closed that gap first as its own discriminating step:
+- Command Ring now carries a permanent Link TRB at index `XHCI_RING_TRB_COUNT-1` (xHCI 1.2
+  spec §4.9.2 requires one per segment for wraparound; previously absent since nothing had
+  ever posted enough commands to reach it) — Toggle Cycle bit set, producer/consumer cycle
+  state kept in sync on wrap by `xhci_submit_command()`.
+- Added `xhci_submit_command()` (enqueue + doorbell ring, shared plumbing for Enable Slot and
+  the future Address Device) and `xhci_cmd_enable_slot()`, called once as a smoke test right
+  after a successful `xhci_bringup()`.
+- Verified live, all three architectures: each boot logs `xhci: enable slot command
+  submitted` during bring-up, then `xhci: command completion event` once `xhci_poll_events()`
+  starts running from `ok>`'s idle loop — proof the controller actually consumed a
+  software-written TRB via doorbell 0, not just that software believes it did.
+  `logs/20260822-093311/amd64/`, `logs/20260822-093412/aarch64/`, `logs/20260822-093549/riscv64/`.
+- Still open, unchanged from the checklist above: reading PORTSC to distinguish connect from
+  disconnect, correlating the Command Completion Event back to its issuing command (currently
+  only logged, slot ID/context bookkeeping not read from the event TRB), Address Device, and
+  the callback surface into Section U's higher-level code. The Enable Slot call above is a
+  speculative smoke test, not yet triggered by a real connect event — that wiring is the next
+  increment.
+
 **2f. USB device enumeration (post-connect, before it's usable as storage)**
 - [ ] Request and parse the device descriptor (confirm vendor/product IDs are even needed,
       or if class-only detection suffices for this project's purposes)