v1.6.12: bump version (unified release)

Targets the files round-1/2 left out of scope: ld/platform/mod.rs (the
PlatformDriver default trait method, previously 0%), ld/error.rs Display
impl (now 100%), aacs/mod.rs Default + full unlock_bus success path
(exposes handshake::tests::DriveEmu/dummy_cert as pub(crate) for reuse),
css/mod.rs (DvdUnlocker::default, the disc-key-refusal non-fatal path,
drive-challenge/Key2-send failure branches), aacs/handshake.rs
(run_cert_handshake's per-cert backoff sleep + retry), and mt1959
mod.rs/variant_a.rs (MODE_B dispatch, a non-transport pass-1 probe
sense, WRITE_BUFFER's 24-bit length guard, variant_a's full upload+
verify+double-unlock success path).

Total coverage 95.65% -> 96.50% (regions), 95.33% -> 96.61% (lines).

.github/dependabot.yml

@@ -0,0 +1,63 @@
+version: 2
+
+# Dependency updates land on `dev`, never on `main`.
+#
+# `main` here is a RELEASE POINTER that release.sh moves to each tag. A bot
+# commit on it would put work there that no tag contains, which is exactly the
+# state that aborted the 1.6.2 cascade at the last step -- so pointing
+# Dependabot at main would recreate that failure on a schedule.
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    # One PR per week for the routine bumps instead of one per crate. Eight
+    # repos times a handful of crates is a volume nobody reads, and an
+    # unread PR queue is indistinguishable from no updates at all.
+    groups:
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # The freemkv crates depend on each other by GIT TAG, re-pinned by
+      # release.sh as part of the release commit. Dependabot cannot see that
+      # cascade, so a PR bumping one of these would fight the release process
+      # and could pin a version whose tag does not exist yet.
+      - dependency-name: freemkv-unlock
+      - dependency-name: libfreemkv
+      - dependency-name: freemkv-keysources
+      - dependency-name: freemkv-i18n
+      - dependency-name: freemkv-engine
+
+  # The workflows are now real infrastructure -- the release cascade, the
+  # cross-platform hash matrix, the disc gate -- so their actions need the same
+  # attention as the crates.
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      actions:
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # NOT a dependency: `dtolnay/rust-toolchain` is versioned by the RUST
+      # release it installs, and the tag we pin is the toolchain CI is pinned
+      # to on purpose -- precommit.sh runs the same one locally so a lint that
+      # passes on a developer's newer default cannot pass CI by accident.
+      #
+      # Dependabot reads those tags as semver and proposed 1.97.0 -> 1.100.0,
+      # a Rust version that does not exist. Every such PR 404s on toolchain
+      # download across all eight repos, and they regenerate weekly -- eight
+      # permanently-red PRs that promote.yml then has to special-case when it
+      # decides whether dev is green.
+      #
+      # Bumping the toolchain is a deliberate, all-eight-repos change, made by
+      # hand together with precommit.sh. There is nothing here for a bot.
+      - dependency-name: dtolnay/rust-toolchain

.github/workflows/ci.yml

@@ -0,0 +1,149 @@
+name: CI
+
+on:
+  push:
+    # dev -> qa -> main. `dev` is where work lands and is meant to be pushed
+    # to often: these are the FAST checks, so a mistake surfaces in minutes.
+    # `qa` is the release candidate — it runs these too, plus the expensive
+    # suite in qa.yml. `main` only ever moves at release time, to a tagged
+    # commit that was already green on qa.
+    branches: [main, dev, qa]
+  pull_request:
+
+# freemkv-unlock is the BASE of the whole ecosystem: libfreemkv path-deps it,
+# bdemu path-deps it with the `emulation` feature, and every other crate pulls
+# it in transitively. It has no freemkv dependencies of its own, so no sibling
+# checkout is needed here — but it is also the crate whose breakage takes all
+# seven others down with it, which is why it gets the full OS matrix rather
+# than a token Linux run.
+#
+# Cargo.lock is gitignored (library convention), so `--locked` is deliberately
+# NOT used: with no committed lockfile it fails rather than resolves.
+
+jobs:
+  # CI owns the changelog: main may never carry a released version without a
+  # CHANGELOG.md entry for it. The release orchestrator dates an existing
+  # `## [X.Y.Z]` heading — it does NOT invent one — so a version bump that
+  # forgot its changelog entry must fail here rather than ship a blank release.
+  # Hard-fails on main (and PRs targeting main); warns elsewhere so an
+  # in-progress dev/qa branch whose entry isn't written yet is not blocked.
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Require a CHANGELOG entry for the crate version on main
+        shell: bash
+        run: |
+          set -euo pipefail
+          version=$(grep -m1 '^version = ' Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')
+          if grep -qE "^## \[${version}\]" CHANGELOG.md; then
+            echo "CHANGELOG.md has an entry for ${version}."
+            exit 0
+          fi
+          msg="CHANGELOG.md has no '## [${version}]' entry"
+          if [ "${GITHUB_REF_NAME:-}" = "main" ] || [ "${GITHUB_BASE_REF:-}" = "main" ]; then
+            echo "::error::${msg} — main requires a changelog entry for the released version."
+            exit 1
+          fi
+          echo "::warning::${msg} (allowed on ${GITHUB_REF_NAME:-unknown}; required before it can reach main)."
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.90.0
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo fmt --check
+      # --all-targets so the test code is linted too, not just the library.
+      - run: cargo clippy --all-targets -- -D warnings
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.90.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo test --tests
+      # `emulation` is off by default and is the face bdemu builds against. A
+      # feature nothing compiles is a feature that breaks at release time.
+      - run: cargo test --tests --features emulation
+
+  # Coverage is additive and NON-REQUIRED: it uploads to Codecov but never
+  # gates a merge (fail_ci_if_error is false, and it is not wired into any
+  # release gate). It mirrors the `test` job's environment — same pinned
+  # toolchain, ubuntu-latest, no `if:` so it runs on every branch and PR just
+  # as `test` does. `--locked` is intentionally omitted to match this crate's
+  # policy (Cargo.lock is gitignored; --locked would fail without it).
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.90.0
+        with:
+          components: llvm-tools-preview
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-coverage
+      - uses: taiki-e/install-action@cargo-llvm-cov
+      - run: cargo llvm-cov --workspace --ignore-run-fail --lcov --output-path lcov.info
+      - uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: lcov.info
+          slug: freemkv/freemkv-unlock
+          fail_ci_if_error: false
+
+  # The crate ships on macOS and Windows through its consumers, so it has to
+  # compile there. Build the tests (not just `cargo check`) — that forces
+  # codegen and catches errors in test-only code, which `check` skips.
+  check-macos:
+    # dev is the FAST lane: this job still runs, but on the release-candidate
+    # branches rather than on every push to dev. Nothing is deleted and no
+    # platform stops being checked before a release -- qa.yml independently
+    # covers macOS and Windows, and the jobs unique to this file (the Intel
+    # macOS build, the Windows release build) run here on qa and main. A push
+    # to dev is meant to be cheap and frequent; waiting on three runner pools
+    # to agree is what a release candidate is for.
+    #
+    # `if` SKIPS the job (it does not queue). A queued job would be far worse
+    # than a slow one: release.sh's CI gate refuses while any run for the
+    # commit is still in progress, so a never-scheduled job blocks releases
+    # silently -- see the note on real-media in qa.yml.
+    if: github.ref_name == 'qa' || github.ref_name == 'main'
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.90.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo build --tests --all-features
+
+  check-windows:
+    # dev is the FAST lane: this job still runs, but on the release-candidate
+    # branches rather than on every push to dev. Nothing is deleted and no
+    # platform stops being checked before a release -- qa.yml independently
+    # covers macOS and Windows, and the jobs unique to this file (the Intel
+    # macOS build, the Windows release build) run here on qa and main. A push
+    # to dev is meant to be cheap and frequent; waiting on three runner pools
+    # to agree is what a release candidate is for.
+    #
+    # `if` SKIPS the job (it does not queue). A queued job would be far worse
+    # than a slow one: release.sh's CI gate refuses while any run for the
+    # commit is still in progress, so a never-scheduled job blocks releases
+    # silently -- see the note on real-media in qa.yml.
+    if: github.ref_name == 'qa' || github.ref_name == 'main'
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@1.90.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo build --tests --all-features

.github/workflows/leak-guard.yml

@@ -0,0 +1,35 @@
+name: leak-guard
+
+# Self-contained public-repo leak gate. Public CI cannot reach the private
+# tooling, so this encodes only the generic net: internal-infra references,
+# tracked CLAUDE.md/.claude paths, and AI-attribution in commit messages.
+# No project-specific reverse-engineering vocabulary lives here.
+
+on: [push, pull_request]
+
+jobs:
+  leak-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Compute commit range
+        id: range
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            base="${{ github.event.pull_request.base.sha }}"
+            head="${{ github.event.pull_request.head.sha }}"
+            echo "range=$base..$head" >> "$GITHUB_OUTPUT"
+          else
+            before="${{ github.event.before }}"
+            after="${{ github.sha }}"
+            # New branch / first push: github.event.before is all-zeros.
+            if [ -z "$before" ] || [ "$before" = "0000000000000000000000000000000000000000" ]; then
+              echo "range=$after" >> "$GITHUB_OUTPUT"
+            else
+              echo "range=$before..$after" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+      - name: Run leak-guard
+        run: bash ci/leak-guard.sh "${{ steps.range.outputs.range }}"

.github/workflows/qa.yml

@@ -0,0 +1,118 @@
+name: qa
+
+# ── The qa gate: "is this production worth?" ────────────────────────────────
+#
+# dev -> qa -> main.
+#
+# `dev` is for committing often. ci.yml answers "is it green" in minutes with
+# fmt, clippy and the unit suite, so a mistake surfaces while it is still cheap
+# to fix. `qa` is the release-candidate branch, and THIS workflow is the claim
+# that a commit is production worth: everything expensive that can run without
+# physical media. `main` only ever receives a qa that went green here.
+#
+# Sibling repos are checked out at `qa`, NOT `dev`. A qa run that resolved its
+# dependencies from dev tips would be validating a combination that is not the
+# one being released, which is the exact failure this branch exists to prevent.
+#
+# What this gate CANNOT cover: `disc://` and real `iso://` need physical media,
+# and no hosted runner has an optical drive or the image hoard. Those run on a
+# self-hosted runner (see the media job at the end) and are the one leg that
+# stays on hardware.
+on:
+  push:
+    branches: [qa]
+  workflow_dispatch:
+
+jobs:
+  # ── Name the candidate ────────────────────────────────────────────────
+  #
+  # Every push to `qa` is a release candidate, so every push gets a tag:
+  # v<version>-rc<N>, N incrementing. That is the answer to "which build is on
+  # qa right now, and is it the one I tested?" — a question that otherwise gets
+  # answered from memory.
+  #
+  # This runs FIRST and does not depend on the gates, deliberately. A red
+  # candidate needs a name more than a green one does: "rc3 failed
+  # release-tests on windows" is a sentence you can act on; "qa is red" is not.
+  # Red on qa is a working gate, not an incident — it is the branch saying this
+  # is not production worth yet. Fix on dev, get dev green, push qa again.
+  #
+  # release.yml excludes v*-rc* so a candidate never publishes a release.
+  rc-tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Stamp the next rc
+        shell: bash
+        run: |
+          set -euo pipefail
+          v=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
+          [ -n "$v" ] || { echo "no version in Cargo.toml" >&2; exit 1; }
+          # Numeric sort on the rc ordinal: -rc10 must beat -rc9, and a plain
+          # lexical sort gets that backwards from the tenth candidate on.
+          n=$(git tag -l "v$v-rc*" | sed "s|^v$v-rc||" | sort -n | tail -1)
+          tag="v$v-rc$(( ${n:-0} + 1 ))"
+          git tag "$tag"
+          git push origin "$tag"
+          echo "### Candidate \`$tag\`" >> "$GITHUB_STEP_SUMMARY"
+
+  # The debug suite runs on every dev push. Release is a DIFFERENT build:
+  # overflow checks are off, debug_assert! is compiled out, and inlining
+  # changes what the optimiser can prove. A test that only passes in debug is
+  # a test that never guarded the binary anyone actually ships.
+  release-tests:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ['ubuntu-latest', 'macos-latest']
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          path: freemkv-unlock
+      - uses: dtolnay/rust-toolchain@1.90.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: freemkv-unlock
+      - run: cargo test --release --tests
+        working-directory: freemkv-unlock
+
+  # clippy's output is target-dependent: cfg-gated code only gets linted on
+  # the target it compiles for. Linting solely on the dev machine's host
+  # target is how a lint that CI rejects reaches a push.
+  cross-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          path: freemkv-unlock
+      - uses: dtolnay/rust-toolchain@1.90.0
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: freemkv-unlock
+      - run: rustup target add x86_64-unknown-linux-gnu
+      - run: cargo clippy --all-targets --target x86_64-unknown-linux-gnu -- -D warnings
+        working-directory: freemkv-unlock
+
+  # Windows compiles the tests but does not run them, matching the policy
+  # ci.yml already set. The value here is codegen: the #[cfg(windows)] halves
+  # of the SCSI transport and platform layers compile on no other runner, so
+  # without this they are first built at release time.
+  windows-build:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          path: freemkv-unlock
+      - uses: dtolnay/rust-toolchain@1.90.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: freemkv-unlock
+      - run: cargo build --release --tests
+        working-directory: freemkv-unlock

CHANGELOG.md

@@ -0,0 +1,222 @@
+# Changelog
+
+## [1.6.12] — 2026-08-27
+
+### Changed
+
+- Version aligned to 1.6.12 for the unified release; no functional changes.
+
+## [1.6.11] — 2026-08-26
+
+### Changed
+
+- Version aligned to 1.6.11 for the unified release. No functional changes to
+  this crate; the release was driven by the libfreemkv main-feature selection
+  improvements and the autorip mux-quarantine fix (see the libfreemkv and
+  autorip 1.6.11 notes).
+
+### Added
+
+- Codecov coverage reporting and badge.
+- Substantially expanded unit-test coverage.
+
+## [1.6.10] — 2026-08-23
+
+### Changed
+
+- Version aligned to 1.6.10 for the unified release. No functional changes to
+  this crate; the release was driven by libfreemkv (TrueHD/MLP audio now resyncs
+  to the next major-sync access unit after a source transport-stream
+  discontinuity, instead of splicing post-gap audio mid-stream — fixing
+  decoder-choking seams on discs whose stream carries a continuity-counter gap;
+  see the libfreemkv 1.6.10 notes).
+- MSRV lowered from 1.97 to 1.90. The crate does not use anything newer than
+  1.90 stabilized; CI's pinned toolchain and `rust-version` are updated to
+  match.
+
+## [1.6.9] — 2026-08-22
+
+### Changed
+
+- Version aligned to 1.6.9 for the unified release. No functional changes to
+  this crate; the release was driven by autorip (automatic per-episode TV
+  ripping — each episode named `S{NN}E{MM}`, with TMDB runtime-aligned episode
+  numbering across multi-disc seasons — a Manual Rename option, and a unified
+  per-disc staging state file — see the autorip 1.6.9 notes).
+
+## [1.6.8] — 2026-08-21
+
+### Changed
+
+- Version aligned to 1.6.8 for the unified release. No functional changes to
+  this crate; the release was driven by autorip (webhooks now fire per pipeline
+  stage — Rip / Mux / Move — with the Rip hook firing the moment the drive is
+  free again, plus a Ripper-tab activity-banner fix so it also shows during
+  moves — see the autorip 1.6.8 notes).
+
+## [1.6.7] — 2026-08-21
+
+### Changed
+
+- Version aligned to 1.6.7 for the unified release. No functional changes to
+  this crate; the release was driven by autorip (per-webhook event selection,
+  a progress bar per moved artifact, and move-queue / webhook-error fixes —
+  see the autorip 1.6.7 notes).
+
+## [1.6.6] — 2026-08-20
+
+### Changed
+
+- Version aligned to 1.6.6 for the unified release. No functional changes
+  to this crate; the release was driven by autorip (webhooks may now target
+  private/LAN addresses — see the autorip 1.6.6 notes).
+
+## [1.6.5] — 2026-08-20
+
+### Added
+
+- **AACS 2.0 (P-256) drives now complete a live host-certificate
+  handshake.** The elliptic-curve (P-256) authentication path is wired
+  into the cert handshake for real, not left as dead code. A drive is
+  first tried with the AACS 1.0 certificate (a 2.0 drive accepts it for
+  the Volume ID); if the drive refuses it and the supplied host
+  certificate carries AACS 2.0 credentials, the crate falls back to the
+  native P-256 handshake. It is cert-agnostic — it uses whatever the host
+  certificate carries, with no separate feature gate — and a bus fault on
+  the 1.0 attempt short-circuits the fallback so a dead bus is not
+  hammered. The 2.0 path enforces the same chain-of-trust checks as the
+  1.0 path (drive-cert type gate, fatal certificate verification under the
+  real 2.0 Licensing Administrator key, on-curve validation of every
+  attacker-supplied point, and AGID release on every exit). The 2.0
+  certificate byte layout is documented as provisional pending a genuine
+  drive certificate to pin it against; a wrong layout fails closed and
+  never trusts.
+
+### Security
+
+- **A rogue drive or bridge can no longer forge its way to a trusted bus
+  key.** A drive certificate whose type was neither AACS 1.0 nor 2.0 used
+  to skip Licensing Administrator verification yet still have its own key
+  trusted for the bus-key signature check, letting an attacker inject a
+  chosen bus key; unknown cert types are now rejected at the type gate
+  before any key is trusted. ECDSA verification now validates the signer's
+  public key (on-curve, in-field, not the identity point) before use — a
+  key of (0,0) previously collapsed verification to a forgeable form. The
+  compiled-in AACS 1.0 and 2.0 Licensing Administrator anchor keys, which
+  were off-curve, are replaced with the real published keys (both
+  confirmed on-curve; the 1.0 key verifies a genuine LA-signed
+  certificate). The P-256 certificate-length check now matches the real
+  132-byte layout, so AACS 2.0 certificates verify at all.
+
+- **Sensitive material no longer leaks through debug output.** `Unlocked`
+  (which carries the bus key and Volume ID) and `DriveProfile` (which
+  carries the MediaTek drive firmware image and per-drive vendor SCSI
+  templates) now use hand-written redacting `Debug` implementations
+  instead of printing everything. The AACS 2.0 authentication path now
+  releases the drive AGID on every failure exit, matching the 1.0 path.
+
+### Fixed
+
+- **A dead or failing drive bus is no longer reported as a successful
+  unlock.** A transport fault during the AACS data-key read, during
+  firmware-unlock disc probing, and in both MediaTek speed-probe passes
+  used to be swallowed or flattened into a generic failure — in the
+  firmware-unlock case surfacing as `drive_unlocked: true` on a bus that
+  had actually died. These paths now abort with a transport error so the
+  fault is visible instead of masquerading as clear content.
+
+- **Transport faults are no longer misclassified as "wrong drive" or
+  "bad credentials."** A dead bus on the first probe command previously
+  read as "not a Renesas drive" or "not a supported DVD profile"; a bus
+  that died mid-handshake was reported as a credentials rejection after
+  three retries against dead hardware; and CSS bus-auth collapsed every
+  fault into a generic auth failure. Each call site now honours the
+  transport contract — abort on a real bus fault, fall through only on a
+  genuine "not applicable." A merely short probe response is no longer
+  fabricated into a transport failure, so rips that would have succeeded
+  are no longer aborted.
+
+- **A half-unlocked drive now falls through to certificate
+  authentication instead of claiming the bus is clear.** The firmware
+  unlocker set `drive_unlocked: true` whenever the handshake merely
+  completed, ignoring the computed unlock flag; a drive returning zero
+  bytes could even report a full unlock from a buffer it never wrote.
+  The unlock outcome is now actually consulted, so a partial unlock
+  correctly steers to the cert-auth fallback. Related read paths that
+  parsed the caller's own zero-filled buffer as drive data on a CHECK
+  CONDITION are fixed to inspect status and bytes transferred.
+
+### Changed
+
+- **Drive preparation issues 88 fewer SCSI commands per disc.** The
+  probe's two passes previously walked the same 88 addresses twice; the
+  redundant pass is removed.
+
+## [1.6.4] — 2026-08-15
+
+### Changed
+
+- **No functional change.** This crate ships alongside the rest of freemkv at a
+  matching version; its behaviour is untouched.
+
+## [1.6.3] — 2026-08-10
+
+### Changed
+
+- **Housekeeping only — nothing about how a drive is unlocked has changed.** The
+  cryptography and compression crates this crate builds on were moved to their
+  current releases and brought into line with the versions the rest of freemkv
+  uses, so one version of each is built instead of two.
+
+## [1.6.2] — 2026-08-08
+
+Version sync with the workspace. No functional change in this crate.
+
+## [1.6.1] — 2026-08-07
+
+Version sync with the workspace. No functional change in this crate.
+
+## [1.6.0] — 2026-08-03
+
+Version sync with the workspace. No functional change in this crate.
+
+## [1.5.2] — 2026-07-22
+
+### Changed
+
+- The DVD read-unlocker (bus-auth) is renamed `CSS` → `DVD`: it reports the
+  medium it unlocks, not whether a title-key crack ran. The unlocker report now
+  reads `DVD: yes` on any DVD.
+
+## [1.4.1] — 2026-07-14
+
+Version sync with the workspace; inherits libfreemkv 1.4.1.
+
+## [1.4.0] — 2026-07-13
+
+Version sync with the workspace; inherits libfreemkv 1.4.0.
+
+## [1.3.2] — 2026-07-10
+
+Version sync with the workspace; inherits libfreemkv 1.3.2.
+
+## [1.3.1] — 2026-07-10
+
+### Licensing
+
+- **Relicensed to the MIT License, from 1.3.1 onwards** (releases up to and
+  including 1.3.0 remain under AGPL-3.0).
+
+Version sync with the workspace; inherits libfreemkv 1.3.1.
+
+## [1.3.0] — 2026-07-08
+
+### Changed
+
+- **`Unlocker` is now two capability methods.** `unlock_features` (drive
+  riplock / speed / OEM VID at drive-prep) and `unlock_bus` (bus-encryption
+  removal for the mounted disc) replace the single `matches()` + `unlock()`
+  contract. Each defaults to `NotApplicable`, so an unlocker implements only the
+  capabilities it actually provides.
+- **`DriveId` gains a `product_id` field** carrying the SCSI INQUIRY product
+  string, so consumers can match on it.

CODE_OF_CONDUCT.md

@@ -36,7 +36,7 @@ This Code of Conduct applies within all community spaces, and also applies when
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at owner@example.invalid. All complaints will be reviewed and investigated promptly and fairly.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported privately to the project maintainer via GitHub at https://github.com/MattJackson. All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the reporter of any incident.
 

CONTRIBUTING.md

@@ -0,0 +1,18 @@
+# Contributing
+
+Thanks for your interest!
+
+- **Report a bug** — open an issue
+- **Fix a bug** — fork, branch, PR
+- **Suggest a feature** — open an issue first
+
+## Development
+
+```bash
+cargo build
+cargo test
+```
+
+## License
+
+MIT

Cargo.toml

@@ -1,13 +1,28 @@
-# freemkv-unlock — unlocker plugins for libfreemkv.
-#
-# libfreemkv ships only the `Unlocker` trait + registry and stays firmware-clean.
-# Each member here is one concrete unlocker, registered into libfreemkv by a
-# single `register_unlocker(...)` line in the consuming binary — so dropping an
-# unlocker is deleting that one line plus the dependency (delete-to-comply).
-#
-# Members:
-#   ld — LibreDrive (MediaTek MT1959 firmware unlock)
-#   (future unlockers go here as additional members)
-[workspace]
-resolver = "2"
-members = ["ld"]
+[package]
+name = "freemkv-unlock"
+version = "1.6.12"
+edition = "2024"
+rust-version = "1.90"
+license = "MIT"
+description = "Unlock layer for the freemkv toolchain: the Unlocker contract + self-contained firmware/AACS/CSS unlocker modules. libfreemkv depends on this and dispatches via all_unlockers()."
+repository = "https://github.com/freemkv/freemkv-unlock"
+# NEVER crates.io: this crate carries drive firmware. Consumed only by git tag.
+publish = false
+
+[features]
+# Off by default. Exposes ld's unlock-handshake wire format (`UNLOCK_MARKER`,
+# `is_unlock_read_buffer`) for the bdemu test-emulator, which impersonates an
+# ld-unlockable drive. Real clients never enable it and keep the generic API.
+emulation = []
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+base64 = "0.23"
+tracing = "0.1"
+num-bigint = "0.5"
+num-traits = "0.2"
+sha1 = "0.10"
+sha2 = "0.11"
+aes = "0.9"
+rand = "0.10"

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Jackson & Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,21 +1,39 @@
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+[![CI](https://github.com/freemkv/freemkv-unlock/actions/workflows/ci.yml/badge.svg)](https://github.com/freemkv/freemkv-unlock/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/freemkv/freemkv-unlock/branch/dev/graph/badge.svg)](https://codecov.io/gh/freemkv/freemkv-unlock)
+
 # freemkv-unlock
 
-Unlocker plugins for [libfreemkv](https://github.com/freemkv/libfreemkv).
+The unlock layer for the freemkv toolchain.
 
-libfreemkv ships only the pluggable `Unlocker` trait + registry and stays
-firmware-clean — it contains no concrete unlock code. Each crate in this
-workspace implements one unlocker and is registered into libfreemkv by a single
-line in the consuming binary:
+An **unlocker removes a drive-level bus-encryption barrier** so the drive serves
+readable (de-bus'd / de-scrambled) sectors. Content-key decryption is a separate
+concern — the consumer's job.
+
+This crate defines the `Unlocker` contract and a generic SCSI transport
+contract, and holds the self-contained unlocker modules. The consumer
+([libfreemkv](https://github.com/freemkv/libfreemkv)) depends on this crate and
+dispatches through `all_unlockers()`; it never names an individual unlocker, and
+clients of libfreemkv are oblivious to unlockers entirely (as they are to the
+SCSI layer).
 
 ```rust
-libfreemkv::register_unlocker(Box::new(my_unlocker::MyUnlocker::new()));
+use freemkv_unlock::UnlockError;
+
+// Drive-prep: try each unlocker's feature unlock until one claims the drive.
+// `NotApplicable` means "not this unlocker's drive" — move on; a transport
+// error means a dead bus — abort. `unlock_bus` follows the same contract for
+// removing per-disc bus encryption.
+for u in freemkv_unlock::all_unlockers() {
+    match u.unlock_features(&mut scsi, &ctx) {
+        Ok(unlocked) => return Ok(unlocked),
+        Err(UnlockError::NotApplicable) => continue,
+        Err(e) => return Err(e),
+    }
+}
 ```
 
-Removing an unlocker is deleting that one line and the dependency
-(delete-to-comply).
+To remove an unlocker, delete its module directory and its one line in
+`all_unlockers()` — nothing else changes.
 
-## Members
-
-Each member is a self-contained unlocker plugin — see its own README for details.
-
-License: AGPL-3.0-only.
+License: MIT.

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| 1.6.x   | Yes       |
+| < 1.6   | No        |
+
+Only the current 1.6.x line receives security fixes.
+
+## Reporting a vulnerability
+
+Report vulnerabilities privately through GitHub Security Advisories:
+https://github.com/freemkv/freemkv-unlock/security/advisories/new
+
+Do not open a public issue for a security report. Include the affected
+version, steps to reproduce, and the impact you believe the issue has.
+
+## Response time
+
+You will get an initial response within 7 days.

ci/leak-guard.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+#
+# leak-guard.sh — self-contained public-repo leak gate.
+#
+# This is the LAST line of defense in CI. It is intentionally self-contained:
+# public CI cannot reach the private tooling, so this script encodes ONLY the
+# generic net — internal infrastructure references, agent-context files, and
+# AI-attribution in commit messages. It deliberately contains NO project-
+# specific reverse-engineering vocabulary (those words would themselves be a
+# leak). The richer private scanner stays private.
+#
+# Fails (exit 1) if any of the following appear in the repo:
+#   1. a tracked CLAUDE.md or .claude/ path (agent context — never public),
+#   2. tracked file content matching the internal-infra net,
+#   3. a commit message (in the given range) with AI attribution.
+#
+# Usage:
+#   leak-guard.sh [<commit-range>]
+#     <commit-range>  optional git rev-list range to scan commit messages
+#                     (e.g. "abc..def"). If omitted, commit-message scan is
+#                     skipped (path + content checks always run).
+
+set -euo pipefail
+
+# Absolute path to this script, resolved before any cd, so we can exclude it
+# from the content scan (it necessarily contains the detection patterns).
+SELF_ABS="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/$(basename "${BASH_SOURCE[0]}")"
+
+REPO="$(git rev-parse --show-toplevel)"
+cd "$REPO"
+
+fail=0
+note() { printf '  ✗ %s\n' "$1"; fail=1; }
+
+# Internal-infra net — GENERIC ONLY. This script ships in the public repo, so
+# the patterns themselves must not name any org-specific identifier (doing so
+# would itself leak the infra they guard). We catch the leak *class*:
+#   - RFC1918 private IPv4 ranges (10/8, 172.16/12, 192.168/16),
+#   - private/internal/non-routable TLDs (.internal/.local/.lan/.corp/.invalid),
+#   - docker.internal.
+# The full org-specific net (literal hostnames, service names, repo paths,
+# vendor tooling, …) lives ONLY in the private scanner and never ships here.
+INFRA_RE='\b10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|\b172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}|\b192\.168\.[0-9]{1,3}\.[0-9]{1,3}|\.internal\b|\.local\b|\.lan\b|\.corp\b|\.invalid\b|docker\.internal'
+# Home-path net — GENERIC ONLY. Catches an absolute developer home path
+# committed into a tracked file (a macOS /Users/<user>/… or Linux /home/<user>/…
+# path). This names NO specific user — it matches the leak *class* (any home
+# path), so the pattern itself reveals nothing org- or person-specific. A real
+# leak (e.g. /Users/alice/Developer/x slipping into a public RELEASE.md) trips
+# this regardless of whose machine it came from. The username segment is a
+# literal-username class ([A-Za-z0-9._-]) so dynamic/templated paths that build
+# the user at runtime — shell `/home/$USER/`, doc `/home/<rip>/`, Rust
+# `/home/{user}/` — do NOT false-positive; only a baked-in literal home leaks.
+HOMEPATH_RE='/Users/[A-Za-z0-9._-]+/|/home/[A-Za-z0-9._-]+/'
+# AI-attribution net (case-insensitive). "claude" matches only as a standalone
+# word — NOT preceded by a dot/slash/alnum and NOT followed by .md — so legit
+# mentions of CLAUDE.md / .claude/ in a commit message don't false-positive.
+ATTR_RE='co-authored-by|generated with|🤖|(?<![.\/A-Za-z0-9])claude(?!\.md)'
+
+echo "── leak-guard: tracked agent-context paths ──"
+while IFS= read -r f; do
+  case "$f" in
+    CLAUDE.md|*/CLAUDE.md|.claude|.claude/*|*/.claude|*/.claude/*)
+      note "tracked agent-context file: $f (CLAUDE.md/.claude must never be tracked in a public repo)" ;;
+  esac
+done < <(git ls-files)
+
+# Match a PCRE against a file, emitting "LINE: MATCH". The pattern is passed as
+# an argument (not interpolated into a //) so metacharacters like the "/" in a
+# path-style token can't break the regex. Reads raw bytes so non-UTF-8 blobs
+# don't abort the scan.
+pcre_matches() {
+  perl -e '
+    my ($file, $re) = @ARGV;
+    open(my $fh, "<:raw", $file) or exit 0;
+    my $rx; eval { $rx = qr/$re/i }; exit 0 if $@;
+    while (my $l = <$fh>) { if ($l =~ /$rx/) { print "$.: $&\n"; } }
+  ' "$1" "$2" 2>/dev/null
+}
+
+# This script's own source necessarily contains the detection patterns (e.g.
+# the regex tokens in INFRA_RE), so scanning it would always self-flag. Skip it.
+SELF="$(git ls-files --full-name -- "$SELF_ABS" 2>/dev/null | head -1)"
+
+echo "── leak-guard: internal-infra references in tracked files ──"
+while IFS= read -r f; do
+  case "$f" in *.png|*.jpg|*.jpeg|*.ico|*.gif|*.bin|*.crate|*.gz|*.zip|*.pdf) continue ;; esac
+  [ -n "$SELF" ] && [ "$f" = "$SELF" ] && continue
+  [ -f "$f" ] || continue
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    note "internal-infra reference: $f:$hit"
+  done < <(pcre_matches "$f" "$INFRA_RE")
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    note "[HOME-PATH] absolute home path: $f:$hit (no local home path may be committed to a public repo)"
+  done < <(pcre_matches "$f" "$HOMEPATH_RE")
+done < <(git ls-files)
+
+RANGE="${1:-}"
+if [ -n "$RANGE" ]; then
+  echo "── leak-guard: AI-attribution in commit messages ($RANGE) ──"
+  while IFS= read -r sha; do
+    [ -z "$sha" ] && continue
+    msg="$(git log -1 --format='%B' "$sha" 2>/dev/null || true)"
+    # Pass the pattern as an argument (not interpolated into a //) so the
+    # lookbehind char class and "/" don't break the regex.
+    hit="$(printf '%s' "$msg" | perl -e '
+      my $re = $ARGV[0]; my $rx = qr/$re/i;
+      while (my $l = <STDIN>) { if ($l =~ /($rx)/) { print "$1\n"; last; } }
+    ' "$ATTR_RE" | head -1 || true)"
+    [ -n "$hit" ] && note "commit ${sha:0:12}: message contains \"$hit\" (owner rule: zero AI attribution, ever)"
+  done < <(git rev-list "$RANGE" 2>/dev/null || true)
+fi
+
+echo
+if [ "$fail" -ne 0 ]; then
+  echo "✗ leak-guard: blocking finding(s) above — DO NOT MERGE/PUBLISH"
+  exit 1
+fi
+echo "✓ leak-guard: clean"

codecov.yml

@@ -0,0 +1,16 @@
+coverage:
+  status:
+    project:
+      default:
+        informational: true
+    patch:
+      default:
+        informational: true
+
+comment: false
+
+ignore:
+  - "tests"
+  - "**/tests"
+  - "benches"
+  - "examples"

ld/Cargo.toml

@@ -1,15 +0,0 @@
-[package]
-name = "freemkv-unlock-ld"
-version = "1.1.0"
-edition = "2024"
-rust-version = "1.86"
-license = "AGPL-3.0-only"
-description = "LibreDrive unlocker plugin for libfreemkv (firmware unlock for MediaTek MT1959 drives)"
-repository = "https://github.com/freemkv/freemkv-unlock"
-
-[dependencies]
-libfreemkv = "1.1.0"
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-base64 = "0.22.1"
-tracing = "0.1"

ld/README.md

@@ -1,54 +0,0 @@
-# freemkv-unlock-ld
-
-The **LibreDrive** unlocker plugin for [libfreemkv](https://github.com/freemkv/libfreemkv).
-
-libfreemkv ships only the `Unlocker` trait + registry and stays firmware-clean.
-This crate owns *how* MediaTek MT1959 drives are firmware-unlocked: the bundled
-drive-profile database (`profiles.json`), the firmware blobs, the
-WRITE_BUFFER / MODE SELECT upload, the unlock CDBs, and the variant-A / variant-B
-handshake logic.
-
-## Usage
-
-Register the unlocker once at process start, before any rip:
-
-```rust
-libfreemkv::register_unlocker(Box::new(freemkv_unlock_ld::LibreDrive::new()));
-```
-
-That single line is the whole plug. Any drive whose identity matches a bundled
-profile is firmware-unlocked at drive-prep; everything else falls through to
-libfreemkv's host-certificate AACS handshake.
-
-## The `Unlocker` contract
-
-This crate is the LibreDrive unlocker — an implementation of libfreemkv's
-`Unlocker` trait. The trait is a 3-method capability contract:
-
-- `unlock_drive` — put the drive into extended-access mode. The one required
-  capability.
-- `read_volume_id` — read the disc Volume ID directly, bypassing the AACS cert
-  handshake. `None` → libfreemkv falls back to the cert-based read. No-op
-  default.
-- `set_max_read_speed` — raise the drive to its maximum read speed. No-op
-  default.
-
-libfreemkv's AACS layer is the always-present baseline; it uses an unlocker's
-capabilities when one matches, and does the full cert handshake when none do.
-Remove this crate and libfreemkv still compiles and rips — every capability
-falls back to the OEM/baseline path.
-
-## Scope: RAM microcode only (`#2`), never the bootloader flash (`#1`)
-
-freemkv uploads the RAM microcode to an **already-bootloader-flashed** drive.
-The permanent bootloader flash (`#1`) is the drive owner's one-time manual
-step; it is **never** automated by freemkv. This crate only performs the
-non-persistent `#2` step — the microcode lives in RAM and is gone on power
-cycle.
-
-## Credits
-
-LibreDrive was created by **Mike Chen** and the **MakeMKV team**. This crate
-builds on their work — our thanks and full credit to them for the LibreDrive
-capabilities.
-

ld/src/lib.rs

@@ -1,390 +0,0 @@
-//! freemkv-unlock-ld — the LibreDrive unlocker plugin for libfreemkv.
-//!
-//! This crate owns *how* MediaTek MT1959 drives are firmware-unlocked:
-//! the bundled drive profiles, the firmware blobs, the WRITE_BUFFER /
-//! MODE SELECT upload, the unlock CDBs, and the variant-A / variant-B
-//! handshake logic. libfreemkv knows none of it — it only exposes the
-//! [`libfreemkv::Unlocker`] trait and a registry.
-//!
-//! Plug it in once at process start:
-//!
-//! ```no_run
-//! libfreemkv::register_unlocker(Box::new(freemkv_unlock_ld::LibreDrive::new()));
-//! ```
-//!
-//! With that one line, any drive whose identity matches a bundled profile
-//! is firmware-unlocked at drive-prep; everything else falls through to
-//! libfreemkv's host-certificate AACS handshake.
-
-// libfreemkv module aliases so the moved firmware code keeps its original
-// `crate::error::*` / `crate::scsi::*` paths.
-pub(crate) use libfreemkv::{error, scsi};
-
-pub mod cdb;
-pub mod profile;
-
-mod platform;
-
-use error::Result;
-use libfreemkv::aacs::Vid;
-use libfreemkv::{DriveId, ScsiTransport, UnlockError, Unlocker};
-use scsi::DataDirection;
-
-/// The LibreDrive unlocker.
-///
-/// Matches a drive against the bundled profile database and, on a hit,
-/// runs the MediaTek MT1959 firmware-unlock (and disc-speed calibration)
-/// handshake over the raw SCSI transport.
-pub struct LibreDrive;
-
-impl LibreDrive {
-    pub fn new() -> Self {
-        LibreDrive
-    }
-}
-
-impl Default for LibreDrive {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl LibreDrive {
-    /// Read the OEM Volume ID via the matched profile's vendor CDB.
-    ///
-    /// This recovers the per-drive READ_BUFFER VID path that lived in
-    /// libfreemkv before the unlocker refactor (it was `read_vid_oem` in
-    /// `libfreemkv/src/disc/encrypt.rs`), now living inside the unlocker where
-    /// the per-drive `read_vid_cdb` template belongs. Folded into [`Self::unlock`]:
-    /// an unlocked drive must hand back its Volume ID in one step.
-    ///
-    /// Returns:
-    ///   * `Ok(Vid)` — the profile carries an OEM VID CDB and the drive served a
-    ///     well-formed VID. No host certificate or HRL is involved.
-    ///   * `Err(UnlockError::VidUnavailable)` — no matching profile, no OEM VID
-    ///     CDB, or a short / bad-signature response (auth succeeded but the VID
-    ///     could not be read → cert fallback).
-    ///   * `Err(UnlockError::Scsi(code))` — the OEM CDB itself failed at the
-    ///     transport (via `?` / `From<Error>`).
-    ///
-    /// Response layout (36 bytes):
-    ///   * `[0..3]`   3-byte response signature; expected `00 22 00`
-    ///   * `[3]`      reserved
-    ///   * `[4..20]`  16-byte Volume ID
-    ///   * `[20..36]` reserved / per-drive padding
-    fn read_oem_vid(
-        &self,
-        scsi: &mut dyn ScsiTransport,
-        id: &DriveId,
-    ) -> std::result::Result<Vid, UnlockError> {
-        const RESPONSE_LEN: usize = 36;
-        const EXPECTED_HEADER: [u8; 3] = [0x00, 0x22, 0x00];
-
-        // No matching profile, or a profile without an OEM VID CDB → no OEM VID
-        // path; the caller falls back to the cert handshake.
-        let Some(m) = profile::find_bundled(id) else {
-            return Err(UnlockError::VidUnavailable);
-        };
-        let Some(cdb) = m.profile.read_vid_cdb else {
-            return Err(UnlockError::VidUnavailable);
-        };
-
-        let mut buf = vec![0u8; RESPONSE_LEN];
-        // A transport failure here is a raw SCSI error → Scsi(code) via `?`.
-        let result = scsi.execute(&cdb, DataDirection::FromDevice, &mut buf, 5_000)?;
-        if result.bytes_transferred < RESPONSE_LEN {
-            tracing::warn!(
-                target: "freemkv::disc",
-                phase = "oem_vid_short_response",
-                bytes_transferred = result.bytes_transferred,
-                "OEM VID CDB returned short response"
-            );
-            return Err(UnlockError::VidUnavailable);
-        }
-        if buf[0..3] != EXPECTED_HEADER {
-            tracing::warn!(
-                target: "freemkv::disc",
-                phase = "oem_vid_bad_header",
-                header_0 = buf[0],
-                header_1 = buf[1],
-                header_2 = buf[2],
-                "OEM VID response header mismatch"
-            );
-            return Err(UnlockError::VidUnavailable);
-        }
-        let mut vid = [0u8; 16];
-        vid.copy_from_slice(&buf[4..20]);
-        tracing::debug!(
-            target: "freemkv::disc",
-            phase = "oem_vid_ok",
-            "OEM VID retrieved via unlocker"
-        );
-        Ok(Vid(vid))
-    }
-}
-
-impl Unlocker for LibreDrive {
-    fn name(&self) -> &str {
-        "LibreDrive"
-    }
-
-    fn matches(&self, id: &DriveId) -> bool {
-        profile::find_bundled(id).is_some()
-    }
-
-    /// Firmware-unlock the drive AND return the disc's OEM Volume ID in one step
-    /// (the new trait folds the old `unlock_drive()` + `read_volume_id()`).
-    ///
-    /// Maps to [`UnlockError`]:
-    ///   * no matching profile / Renesas (no firmware unlock implemented) →
-    ///     [`UnlockError::FirmwareNotUnlockable`];
-    ///   * a SCSI failure during the firmware-unlock handshake →
-    ///     [`UnlockError::Scsi`] (via `?` / `From<Error>`);
-    ///   * unlocked but no readable OEM VID → [`UnlockError::VidUnavailable`].
-    ///
-    /// Any error makes libfreemkv fall through to the in-tree cert handshake.
-    fn unlock(
-        &self,
-        scsi: &mut dyn ScsiTransport,
-        id: &DriveId,
-    ) -> std::result::Result<Vid, UnlockError> {
-        let Some(m) = profile::find_bundled(id) else {
-            // matches() returned true but the profile vanished — this unlocker
-            // cannot put the firmware into extended mode.
-            return Err(UnlockError::FirmwareNotUnlockable);
-        };
-        if matches!(m.platform, profile::Platform::Renesas) {
-            // Renesas firmware unlock is not implemented; cannot unlock the
-            // firmware, so the host-cert handshake must carry the disc.
-            return Err(UnlockError::FirmwareNotUnlockable);
-        }
-        let is_variant_b = matches!(m.platform, profile::Platform::Mt1959B);
-        use platform::PlatformDriver;
-        let mut mt = platform::mt1959::Mt1959::new(m.profile, is_variant_b);
-        // Firmware unlock. A SCSI failure becomes UnlockError::Scsi via `?`.
-        mt.init(scsi)?;
-        // On success, prime the per-region speed table so the drive manages
-        // zone speeds internally (best-effort — calibration failure must not
-        // fail an otherwise-good unlock).
-        let _ = mt.probe_disc(scsi);
-        // An unlocked drive must hand back its Volume ID in the same step.
-        self.read_oem_vid(scsi, id)
-    }
-
-    /// Raise the drive to its maximum read speed.
-    ///
-    /// Issues the matched profile's `set_speed_max_cdb` (the
-    /// `0xBB SET CD SPEED`-to-max command) over the raw transport. A profile
-    /// without a `set_speed_max_cdb` (or no matching profile at all) is a
-    /// no-op — the drive stays at its current speed.
-    fn set_max_read_speed(&self, scsi: &mut dyn ScsiTransport, id: &DriveId) -> Result<()> {
-        let Some(m) = profile::find_bundled(id) else {
-            return Ok(());
-        };
-        let Some(cdb) = m.profile.set_speed_max_cdb else {
-            return Ok(());
-        };
-        let mut buf = [0u8; 0];
-        scsi.execute(&cdb, DataDirection::None, &mut buf, 5_000)?;
-        tracing::debug!(
-            target: "freemkv::drive",
-            phase = "set_max_read_speed",
-            "issued SET CD SPEED (max) via unlocker"
-        );
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use scsi::{DataDirection, ScsiResult, ScsiTransport};
-
-    /// A fake transport that fills the response buffer from a fixed payload
-    /// and reports a configurable transferred-byte count. Exercises the OEM
-    /// VID response-parse branches without a live drive.
-    struct FakeTransport {
-        payload: Vec<u8>,
-        bytes_transferred: usize,
-    }
-    impl ScsiTransport for FakeTransport {
-        fn execute(
-            &mut self,
-            _cdb: &[u8],
-            _dir: DataDirection,
-            data: &mut [u8],
-            _timeout_ms: u32,
-        ) -> Result<ScsiResult> {
-            let n = self.payload.len().min(data.len());
-            data[..n].copy_from_slice(&self.payload[..n]);
-            Ok(ScsiResult {
-                status: 0,
-                bytes_transferred: self.bytes_transferred,
-                sense: [0u8; 32],
-            })
-        }
-    }
-
-    /// A DriveId for the bundled HL-DT-ST profile that carries a real
-    /// `read_vid_cdb`, so `read_vid` finds a profile and issues the CDB.
-    fn known_vid_drive_id() -> DriveId {
-        make_drive_id("HL-DT-ST", "1.01", "NM00100", "211711202000")
-    }
-
-    fn make_drive_id(vendor: &str, rev: &str, vs: &str, date: &str) -> DriveId {
-        let mut inquiry = vec![0u8; 96];
-        inquiry[8..8 + vendor.len().min(8)]
-            .copy_from_slice(&vendor.as_bytes()[..vendor.len().min(8)]);
-        inquiry[32..32 + rev.len().min(4)].copy_from_slice(&rev.as_bytes()[..rev.len().min(4)]);
-        inquiry[36..36 + vs.len().min(7)].copy_from_slice(&vs.as_bytes()[..vs.len().min(7)]);
-        DriveId::from_inquiry(&inquiry, date)
-    }
-
-    /// A well-formed 36-byte response (signature 00 22 00, VID at [4..20])
-    /// parses to that VID via the OEM-VID helper `unlock` folds in.
-    #[test]
-    fn read_oem_vid_parses_well_formed_response() {
-        // Confirm the bundled profile actually carries a read_vid_cdb; otherwise
-        // read_oem_vid would short-circuit and this test wouldn't exercise the
-        // parse path.
-        let m = profile::find_bundled(&known_vid_drive_id()).expect("profile match");
-        assert!(
-            m.profile.read_vid_cdb.is_some(),
-            "test fixture drive must carry an OEM VID CDB"
-        );
-
-        let mut payload = vec![0u8; 36];
-        payload[0..3].copy_from_slice(&[0x00, 0x22, 0x00]);
-        let vid = [0x3Cu8; 16];
-        payload[4..20].copy_from_slice(&vid);
-        let mut t = FakeTransport {
-            payload,
-            bytes_transferred: 36,
-        };
-        let got = LibreDrive::new()
-            .read_oem_vid(&mut t, &known_vid_drive_id())
-            .expect("parse ok");
-        assert_eq!(got, Vid(vid), "VID parsed from [4..20]");
-    }
-
-    /// A short response (fewer than 36 transferred bytes) → VidUnavailable
-    /// (unlocked but no readable VID → cert fallback).
-    #[test]
-    fn read_oem_vid_short_response_is_vid_unavailable() {
-        let mut t = FakeTransport {
-            payload: vec![0u8; 36],
-            bytes_transferred: 20,
-        };
-        let err = LibreDrive::new()
-            .read_oem_vid(&mut t, &known_vid_drive_id())
-            .expect_err("short response must error");
-        assert_eq!(err, UnlockError::VidUnavailable);
-    }
-
-    /// A response whose 3-byte signature isn't `00 22 00` → VidUnavailable.
-    #[test]
-    fn read_oem_vid_bad_header_is_vid_unavailable() {
-        let mut payload = vec![0u8; 36];
-        payload[0..3].copy_from_slice(&[0xDE, 0xAD, 0xBE]); // wrong signature
-        let mut t = FakeTransport {
-            payload,
-            bytes_transferred: 36,
-        };
-        let err = LibreDrive::new()
-            .read_oem_vid(&mut t, &known_vid_drive_id())
-            .expect_err("bad header must error");
-        assert_eq!(err, UnlockError::VidUnavailable);
-    }
-
-    /// A drive with no matching profile → `read_oem_vid` is VidUnavailable
-    /// (cert fallback), and the transport is never issued a CDB.
-    #[test]
-    fn read_oem_vid_no_profile_is_vid_unavailable() {
-        let mut t = FakeTransport {
-            payload: vec![0u8; 36],
-            bytes_transferred: 36,
-        };
-        let err = LibreDrive::new()
-            .read_oem_vid(&mut t, &make_drive_id("FAKE-VND", "9.99", "XX12345", ""))
-            .expect_err("no profile → VidUnavailable");
-        assert_eq!(err, UnlockError::VidUnavailable);
-    }
-
-    /// `unlock` on a drive with no matching profile → FirmwareNotUnlockable
-    /// (this unlocker cannot put the firmware into extended mode), short-
-    /// circuiting before any firmware handshake is attempted.
-    #[test]
-    fn unlock_no_profile_is_firmware_not_unlockable() {
-        let mut t = FakeTransport {
-            payload: vec![0u8; 36],
-            bytes_transferred: 36,
-        };
-        let err = LibreDrive::new()
-            .unlock(&mut t, &make_drive_id("FAKE-VND", "9.99", "XX12345", ""))
-            .expect_err("no profile → FirmwareNotUnlockable");
-        assert_eq!(err, UnlockError::FirmwareNotUnlockable);
-    }
-
-    /// A transport that records the CDB issued (and how many CDBs it saw),
-    /// so the speed test can assert the profile's `set_speed_max_cdb` is the
-    /// one sent — or that nothing was sent at all (no-op).
-    struct RecordingTransport {
-        last_cdb: Vec<u8>,
-        calls: usize,
-    }
-    impl ScsiTransport for RecordingTransport {
-        fn execute(
-            &mut self,
-            cdb: &[u8],
-            _dir: DataDirection,
-            _data: &mut [u8],
-            _timeout_ms: u32,
-        ) -> Result<ScsiResult> {
-            self.last_cdb = cdb.to_vec();
-            self.calls += 1;
-            Ok(ScsiResult {
-                status: 0,
-                bytes_transferred: 0,
-                sense: [0u8; 32],
-            })
-        }
-    }
-
-    /// A matched drive whose profile carries `set_speed_max_cdb` → that exact
-    /// CDB is issued.
-    #[test]
-    fn set_max_read_speed_issues_profile_cdb() {
-        let m = profile::find_bundled(&known_vid_drive_id()).expect("profile match");
-        let expected = m
-            .profile
-            .set_speed_max_cdb
-            .expect("test fixture drive must carry a set_speed_max_cdb");
-
-        let mut t = RecordingTransport {
-            last_cdb: Vec::new(),
-            calls: 0,
-        };
-        LibreDrive::new()
-            .set_max_read_speed(&mut t, &known_vid_drive_id())
-            .expect("set_max_read_speed ok");
-        assert_eq!(t.calls, 1, "exactly one CDB issued");
-        assert_eq!(
-            t.last_cdb,
-            expected.to_vec(),
-            "the profile's set_speed_max_cdb"
-        );
-    }
-
-    /// A drive with no matching profile → no-op: no CDB issued, Ok(()).
-    #[test]
-    fn set_max_read_speed_no_profile_is_noop() {
-        let mut t = RecordingTransport {
-            last_cdb: Vec::new(),
-            calls: 0,
-        };
-        LibreDrive::new()
-            .set_max_read_speed(&mut t, &make_drive_id("FAKE-VND", "9.99", "XX12345", ""))
-            .expect("no-profile is a no-op Ok(())");
-        assert_eq!(t.calls, 0, "no profile → no CDB issued");
-    }
-}

ld/src/platform/mod.rs

@@ -1,25 +0,0 @@
-//! Platform-specific drive unlock + disc probing (LibreDrive internals).
-
-pub mod mt1959;
-
-use crate::error::Result;
-use crate::scsi::ScsiTransport;
-
-pub(crate) trait PlatformDriver: Send {
-    /// Unlock drive + upload firmware if needed.
-    fn init(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()>;
-
-    /// Calibrate drive for this disc. Probes the disc surface so the
-    /// drive's firmware learns the optimal speed for each region.
-    fn probe_disc(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()>;
-
-    /// True after successful init().
-    #[allow(dead_code)]
-    fn is_ready(&self) -> bool;
-
-    /// True if the drive is currently in the extended-access state.
-    #[allow(dead_code)]
-    fn is_unlocked(&self) -> bool {
-        false
-    }
-}

ld/src/platform/mt1959/mod.rs

@@ -1,596 +0,0 @@
-//! MT1959 platform — shared logic for both variants.
-
-mod variant_a;
-mod variant_b;
-
-use super::PlatformDriver;
-use crate::error::{Error, Result};
-use crate::profile::DriveProfile;
-use crate::scsi::{self, DataDirection, ScsiTransport};
-
-// ── Variant constants ──────────────────────────────────────────────────
-// Every vendor command: 3C [mode] [buffer_id] [sub_cmd] [addr] ...
-const MODE_A: u8 = 0x01;
-const MODE_B: u8 = 0x02;
-const BUFFER_ID_A: u8 = 0x44;
-const BUFFER_ID_B: u8 = 0x77;
-
-// ── SCSI opcodes ──────────────────────────────────────────────────────
-const SCSI_READ_BUFFER: u8 = 0x3C;
-const SCSI_READ_CAPACITY: u8 = 0x25;
-/// Shared by both firmware-upload variants (see `variant_a` / `variant_b`).
-pub(super) const SCSI_WRITE_BUFFER: u8 = 0x3B;
-
-// ── Sub-commands (shared A/B) ─────────────────────────────────────────
-const SUB_CMD_UNLOCK: u8 = 0x00;
-const SUB_CMD_INIT: u8 = 0x12;
-const SUB_CMD_PROBE: u8 = 0x14;
-const UNLOCK_RESPONSE_SIZE: u8 = 64;
-const VALIDATE_RESPONSE_SIZE: u8 = 4;
-/// Primary mode marker at bytes [12..16] of the unlock response — set
-/// by the platform firmware when the runtime image is loaded and the
-/// extended-access surface is live.
-const FIRMWARE_ACTIVE_OFFSET: usize = 12;
-const FIRMWARE_ACTIVE_SIG: [u8; 4] = [0x4D, 0x4D, 0x6B, 0x76];
-/// Secondary mode marker repeated through bytes [16..64] of the unlock
-/// response. Confirms the runtime firmware is the one driving the
-/// response, not a stale image's residual buffer.
-const FIRMWARE_MODE_OFFSET: usize = 16;
-const FIRMWARE_MODE_SIG: [u8; 4] = [0x4C, 0x62, 0x44, 0x72];
-
-// ── Init address (per disc type) ──────────────────────────────────────
-const INIT_ADDR_BD: u16 = 0x0100;
-const INIT_ADDR_UHD: u16 = 0x0200;
-
-// ── Probe scan ranges ─────────────────────────────────────────────────
-const PROBE_COARSE_END: u16 = 0x5800;
-const PROBE_FINE_END: u32 = 0x10000;
-const PROBE_STEP: u16 = 0x0100;
-const PROBE_RESPONSE_SIZE: u8 = 4;
-
-// ── Disc type threshold ───────────────────────────────────────────────
-const UHD_SECTOR_THRESHOLD: u32 = 25_000_000; // ~50 GB
-const READ_CAPACITY_RESPONSE_SIZE: usize = 8;
-
-pub struct Mt1959 {
-    pub(crate) profile: DriveProfile,
-    pub(crate) mode: u8,
-    pub(crate) buffer_id: u8,
-    /// True after `run_init` has completed the unlock handshake (and any
-    /// required firmware upload). Gates probe + downstream control
-    /// commands; says nothing about whether the drive is in
-    /// extended-access mode.
-    pub(crate) init_complete: bool,
-    /// True when the unlock response carried both the per-drive
-    /// signature AND the primary mode marker at offset 12 AND the
-    /// secondary mode marker at offset 16. When true the drive is in
-    /// the extended-access state — host can issue the per-drive
-    /// OEM CDBs and read sectors without the cert-based AACS bus
-    /// encryption / mutual-auth gate.
-    unlocked: bool,
-    probed: bool,
-}
-
-impl Mt1959 {
-    pub fn new(profile: DriveProfile, is_variant_b: bool) -> Self {
-        let (mode, buffer_id) = if is_variant_b {
-            (MODE_B, BUFFER_ID_B)
-        } else {
-            (MODE_A, BUFFER_ID_A)
-        };
-        Mt1959 {
-            profile,
-            mode,
-            buffer_id,
-            init_complete: false,
-            unlocked: false,
-            probed: false,
-        }
-    }
-
-    // ── SCSI helpers (shared by both variants) ─────────────────────────
-
-    pub(crate) fn read_buffer_sub(&self, sub_cmd: u8, address: u16, length: u8) -> [u8; 10] {
-        [
-            SCSI_READ_BUFFER,
-            self.mode,
-            self.buffer_id,
-            sub_cmd,
-            (address >> 8) as u8,
-            address as u8,
-            0x00,
-            0x00,
-            length,
-            0x00,
-        ]
-    }
-
-    pub(crate) fn read_buffer_probe(
-        &self,
-        scsi: &mut dyn ScsiTransport,
-        sub_cmd: u8,
-        address: u16,
-        buf: &mut [u8],
-        expected: usize,
-    ) -> Result<usize> {
-        // The READ_BUFFER CDB transfer-length is a single byte; an
-        // `expected` above 255 cannot be expressed and would silently
-        // truncate. All in-crate callers pass small fixed sizes (4); guard
-        // the invariant rather than emit a malformed CDB.
-        debug_assert!(
-            expected <= u8::MAX as usize,
-            "read_buffer_probe expected exceeds 1-byte CDB length field"
-        );
-        let cdb = self.read_buffer_sub(sub_cmd, address, expected as u8);
-        let result = scsi.execute(&cdb, DataDirection::FromDevice, buf, 5_000)?;
-        if result.bytes_transferred != expected {
-            return Err(Error::ScsiError {
-                opcode: SCSI_READ_BUFFER,
-                status: crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE,
-                sense: None,
-            });
-        }
-        Ok(result.bytes_transferred)
-    }
-
-    pub(crate) fn set_cd_speed_max(&self, scsi: &mut dyn ScsiTransport) -> Result<()> {
-        let cdb = scsi::build_set_cd_speed(0xFFFF);
-        let mut dummy = [0u8; 0];
-        scsi.execute(&cdb, DataDirection::None, &mut dummy, 5_000)?;
-        Ok(())
-    }
-
-    // ── Unlock (shared) ────────────────────────────────────────────────
-
-    pub(crate) fn do_unlock(&mut self, scsi: &mut dyn ScsiTransport) -> Result<Vec<u8>> {
-        let cdb = [
-            0x3C,
-            self.mode,
-            self.buffer_id,
-            SUB_CMD_UNLOCK,
-            0x00,
-            0x00,
-            0x00,
-            0x00,
-            UNLOCK_RESPONSE_SIZE,
-            0x00,
-        ];
-        let mut response = vec![0u8; UNLOCK_RESPONSE_SIZE as usize];
-        let result = scsi.execute(&cdb, DataDirection::FromDevice, &mut response, 30_000)?;
-
-        // `response` is a fixed 64-byte buffer, so `response.len()` is
-        // always >= every offset below — the meaningful bound is how many
-        // bytes the drive actually delivered. Validate against
-        // `bytes_transferred` so a short/partial transfer (stale trailing
-        // zeros) can't be read as if the drive sent real marker bytes.
-        let n = result.bytes_transferred.min(response.len());
-
-        if n >= 4 && response[0..4] != self.profile.signature {
-            return Err(Error::SignatureMismatch {
-                expected: self.profile.signature,
-                got: response[0..4].try_into().unwrap_or([0; 4]),
-            });
-        }
-
-        if n >= FIRMWARE_ACTIVE_OFFSET + 4
-            && response[FIRMWARE_ACTIVE_OFFSET..FIRMWARE_ACTIVE_OFFSET + 4] != FIRMWARE_ACTIVE_SIG
-        {
-            return Err(Error::UnlockFailed);
-        }
-
-        // Extended-access state is active when BOTH the per-drive
-        // signature matched AND the response carries the secondary
-        // marker at offset 16 (repeated through bytes 16..64) AND the
-        // primary mode marker at [12..16] is present. The active-mode
-        // marker at [12..16] is the primary gate; the [16..20] marker
-        // is the redundant confirmation the firmware writes through
-        // the rest of the response. Requiring both before we tell the
-        // upper layer "OEM path is live" keeps any partial / corrupted
-        // response from steering us off the cert-auth fallback.
-        self.unlocked = n >= FIRMWARE_MODE_OFFSET + 4
-            && response[FIRMWARE_ACTIVE_OFFSET..FIRMWARE_ACTIVE_OFFSET + 4] == FIRMWARE_ACTIVE_SIG
-            && response[FIRMWARE_MODE_OFFSET..FIRMWARE_MODE_OFFSET + 4] == FIRMWARE_MODE_SIG;
-
-        self.init_complete = true;
-        Ok(response)
-    }
-
-    fn validate(&self, scsi: &mut dyn ScsiTransport) -> Result<()> {
-        for _attempt in 0..5 {
-            let cdb = [
-                0x3C,
-                self.mode,
-                self.buffer_id,
-                SUB_CMD_UNLOCK,
-                0x00,
-                0x00,
-                0x00,
-                0x00,
-                VALIDATE_RESPONSE_SIZE,
-                0x00,
-            ];
-            let mut resp = [0u8; 4];
-            if scsi
-                .execute(&cdb, DataDirection::FromDevice, &mut resp, 5_000)
-                .is_ok()
-            {
-                return Ok(());
-            }
-        }
-        Err(Error::ScsiError {
-            opcode: SCSI_READ_BUFFER,
-            status: crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE,
-            sense: None,
-        })
-    }
-
-    // ── Init (unlock + firmware) ───────────────────────────────────────
-
-    fn run_init(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()> {
-        let mut succeeded = false;
-        for _attempt in 0..3 {
-            match self.do_unlock(scsi) {
-                Ok(_) => {
-                    succeeded = true;
-                    break;
-                }
-                Err(Error::SignatureMismatch { .. }) => {
-                    return Err(Error::UnlockFailed);
-                }
-                Err(_) => {
-                    let loaded = if self.mode == MODE_A {
-                        variant_a::load_firmware(self, scsi).is_ok()
-                    } else {
-                        variant_b::load_firmware(self, scsi).is_ok()
-                    };
-                    if !loaded {
-                        continue;
-                    }
-                    // Firmware upload resets the drive. Give it time to
-                    // fully recover before retrying unlock.
-                    std::thread::sleep(std::time::Duration::from_secs(10));
-                }
-            }
-        }
-        if !succeeded {
-            return Err(Error::UnlockFailed);
-        }
-        Ok(())
-    }
-
-    // ── Probe disc ─────────────────────────────────────────────────────
-
-    /// Probe the disc surface so the drive firmware learns optimal speeds
-    /// per region. Two passes, then SET_CD_SPEED(max). After this the
-    /// drive manages per-zone speeds internally.
-    fn run_probe(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()> {
-        if !self.init_complete {
-            self.do_unlock(scsi)?;
-        }
-
-        // Detect disc type from capacity to select probe mode.
-        // BD:  3C 01 44 12 01 00 00 00 04 00  (init_addr = 0x0100)
-        // UHD: 3C 01 44 12 02 00 00 00 04 00  (init_addr = 0x0200)
-        // Empirically verified via SCSI capture: BD and UHD use different init addresses.
-        let cap_cdb = [
-            SCSI_READ_CAPACITY,
-            0x00,
-            0x00,
-            0x00,
-            0x00,
-            0x00,
-            0x00,
-            0x00,
-            0x00,
-            0x00,
-        ];
-        let mut cap_buf = [0u8; READ_CAPACITY_RESPONSE_SIZE];
-        let disc_sectors = if scsi
-            .execute(&cap_cdb, DataDirection::FromDevice, &mut cap_buf, 5_000)
-            .is_ok()
-        {
-            // last_lba + 1 = sector count. A 0xFFFFFFFF last-LBA is the
-            // READ CAPACITY(10) "capacity exceeds 32 bits" sentinel; saturate
-            // rather than wrap to 0 (which would misclassify a huge disc as
-            // BD). A saturated count stays above the UHD threshold -> UHD.
-            u32::from_be_bytes([cap_buf[0], cap_buf[1], cap_buf[2], cap_buf[3]]).saturating_add(1)
-        } else {
-            0
-        };
-        let init_addr = if disc_sectors > UHD_SECTOR_THRESHOLD {
-            INIT_ADDR_UHD
-        } else {
-            INIT_ADDR_BD
-        };
-        let mut init_resp = [0u8; PROBE_RESPONSE_SIZE as usize];
-        let _ = self.read_buffer_probe(
-            scsi,
-            SUB_CMD_INIT,
-            init_addr,
-            &mut init_resp,
-            PROBE_RESPONSE_SIZE as usize,
-        );
-
-        self.validate(scsi)?;
-
-        // Pass 1: coarse scan
-        let mut addr: u16 = 0;
-        while addr < PROBE_COARSE_END {
-            let mut resp = [0u8; PROBE_RESPONSE_SIZE as usize];
-            if self
-                .read_buffer_probe(
-                    scsi,
-                    SUB_CMD_PROBE,
-                    addr,
-                    &mut resp,
-                    PROBE_RESPONSE_SIZE as usize,
-                )
-                .is_err()
-            {
-                return Err(Error::ScsiError {
-                    opcode: SCSI_READ_BUFFER,
-                    status: crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE,
-                    sense: None,
-                });
-            }
-            addr = addr.wrapping_add(PROBE_STEP);
-        }
-
-        // Pass 2: fine scan
-        let mut addr: u32 = 0;
-        while addr < PROBE_FINE_END {
-            let mut resp = [0u8; PROBE_RESPONSE_SIZE as usize];
-            if self
-                .read_buffer_probe(
-                    scsi,
-                    SUB_CMD_PROBE,
-                    addr as u16,
-                    &mut resp,
-                    PROBE_RESPONSE_SIZE as usize,
-                )
-                .is_err()
-            {
-                break;
-            }
-            addr += PROBE_STEP as u32;
-        }
-
-        // Set max speed — drive manages zones from here
-        let _ = self.set_cd_speed_max(scsi);
-
-        self.probed = true;
-        Ok(())
-    }
-}
-
-// ── PlatformDriver trait ───────────────────────────────────────────────
-
-impl PlatformDriver for Mt1959 {
-    fn init(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()> {
-        if self.init_complete {
-            return Ok(());
-        }
-        self.run_init(scsi)
-    }
-
-    fn probe_disc(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()> {
-        if !self.init_complete {
-            // Don't retry init here — if init() failed, probing can't work either.
-            // Retrying causes repeated USB bus resets on BU40N.
-            return Ok(());
-        }
-        if self.probed {
-            return Ok(());
-        }
-        self.run_probe(scsi)
-    }
-
-    fn is_ready(&self) -> bool {
-        self.init_complete
-    }
-
-    fn is_unlocked(&self) -> bool {
-        self.unlocked
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::profile::{DriveProfile, Identity};
-    use crate::scsi::{DataDirection, ScsiResult, ScsiTransport};
-
-    /// Minimal mock transport that returns a scripted response to the
-    /// next `execute()` call. Only used for verifying that `do_unlock`
-    /// classifies the response correctly — no general SCSI coverage.
-    struct ScriptedTransport {
-        response: Vec<u8>,
-    }
-
-    impl ScsiTransport for ScriptedTransport {
-        fn execute(
-            &mut self,
-            _cdb: &[u8],
-            _dir: DataDirection,
-            data: &mut [u8],
-            _timeout_ms: u32,
-        ) -> Result<ScsiResult> {
-            let n = self.response.len().min(data.len());
-            data[..n].copy_from_slice(&self.response[..n]);
-            Ok(ScsiResult {
-                status: 0,
-                bytes_transferred: n,
-                sense: [0u8; 32],
-            })
-        }
-    }
-
-    /// Records every CDB issued, so a test can assert which bytes hit the wire.
-    struct RecordingTransport {
-        cdbs: Vec<Vec<u8>>,
-    }
-
-    impl ScsiTransport for RecordingTransport {
-        fn execute(
-            &mut self,
-            cdb: &[u8],
-            _dir: DataDirection,
-            _data: &mut [u8],
-            _timeout_ms: u32,
-        ) -> Result<ScsiResult> {
-            self.cdbs.push(cdb.to_vec());
-            // Empty response → do_unlock's signature check fails, so the unlock
-            // loop exhausts — but the firmware-load CDBs (incl. the F1 verify)
-            // are already recorded by then.
-            Ok(ScsiResult {
-                status: 0,
-                bytes_transferred: 0,
-                sense: [0u8; 32],
-            })
-        }
-    }
-
-    /// variant_b must issue the PROFILE's per-drive `fw_verify_cdb`, not the
-    /// hardcoded fallback const — the bug that broke ~139 of 140 B drives.
-    #[test]
-    fn variant_b_issues_profile_fw_verify_cdb_not_const() {
-        let drive_f1 = [0xF1, 0x01, 0x02, 0x00, 0x0C, 0xF0, 0x01, 0xFB, 0xC9, 0x93];
-        // variant_b's hardcoded fallback const (a different drive's token).
-        let fallback_f1 = [0xF1, 0x01, 0x02, 0x00, 0x0D, 0x30, 0x01, 0xF3, 0xAD, 0x23];
-        let mut profile = fixture_profile([0x9a, 0xa9, 0x3a, 0xe2]);
-        profile.firmware = vec![0u8; 2208]; // a real per-drive length, != old 0x9C0
-        profile.fw_verify_cdb = Some(drive_f1);
-
-        let mut mt = Mt1959::new(profile, true);
-        let mut t = RecordingTransport { cdbs: Vec::new() };
-        let _ = variant_b::load_firmware(&mut mt, &mut t);
-
-        assert!(
-            t.cdbs.iter().any(|c| c.as_slice() == drive_f1),
-            "must send the profile's F1 verify CDB"
-        );
-        assert!(
-            !t.cdbs.iter().any(|c| c.as_slice() == fallback_f1),
-            "must NOT send the hardcoded fallback const when the profile has its own"
-        );
-        // MODE SELECT must encode the real per-drive length (2208), not 0x9C0.
-        let ms = t
-            .cdbs
-            .iter()
-            .find(|c| c.first() == Some(&0x55))
-            .expect("MODE SELECT issued");
-        let len = ((ms[7] as usize) << 8) | ms[8] as usize;
-        assert_eq!(len, 2208, "MODE SELECT length = firmware.len(), not 2496");
-    }
-
-    fn fixture_profile(signature: [u8; 4]) -> DriveProfile {
-        DriveProfile {
-            identity: Identity {
-                vendor_id: "TEST".into(),
-                product_revision: String::new(),
-                vendor_specific: String::new(),
-                firmware_date: String::new(),
-            },
-            signature,
-            firmware: Vec::new(),
-            unlock_init_value: 0,
-            unlock_response_size: 0,
-            read_vid_cdb: None,
-            read_disc_keys_cdb: None,
-            drive_nominal_speed_cdb: None,
-            set_speed_max_cdb: None,
-            read10_raw_2sec_cdb: None,
-            read10_raw_1sec_cdb: None,
-            read_buffer_verify_cdb: None,
-            write_buffer_cdb: None,
-            read_buffer_unlock_cdb: None,
-            fw_verify_cdb: None,
-            speed_zone_table: None,
-            speed_calc_table: None,
-        }
-    }
-
-    /// Build a synthetic 64-byte unlock response.
-    ///
-    /// `mode_marker`: bytes [12..16]. Pass `FIRMWARE_ACTIVE_SIG` for the
-    /// active-mode primary marker.
-    /// `id_marker`:   bytes [16..20] (and repeated through [20..64] in
-    /// real responses; only [16..20] is checked).
-    fn build_response(signature: [u8; 4], mode_marker: [u8; 4], id_marker: [u8; 4]) -> Vec<u8> {
-        let mut r = vec![0u8; 64];
-        r[0..4].copy_from_slice(&signature);
-        // bytes [4..12] left as zeros (version + reserved per format)
-        r[12..16].copy_from_slice(&mode_marker);
-        // Real firmware repeats the secondary marker through [16..64];
-        // the parser only checks [16..20], so we just write the marker
-        // once.
-        r[16..20].copy_from_slice(&id_marker);
-        r
-    }
-
-    #[test]
-    fn do_unlock_sets_unlocked_when_both_markers_present() {
-        let sig = [0x99, 0x9E, 0xC3, 0x75];
-        let response = build_response(sig, FIRMWARE_ACTIVE_SIG, FIRMWARE_MODE_SIG);
-        let mut transport = ScriptedTransport { response };
-        let mut mt = Mt1959::new(fixture_profile(sig), false);
-
-        let raw = mt.do_unlock(&mut transport).expect("unlock should succeed");
-        assert_eq!(raw.len(), 64);
-        assert!(mt.init_complete, "init_complete set after success");
-        assert!(
-            mt.is_unlocked(),
-            "both markers present -> extended-access state"
-        );
-    }
-
-    #[test]
-    fn do_unlock_init_complete_but_not_unlocked_when_id_marker_missing() {
-        // Primary mode marker present (so init passes) but the
-        // secondary marker is replaced with zeros — drive isn't in
-        // extended-access state.
-        let sig = [0x99, 0x9E, 0xC3, 0x75];
-        let response = build_response(sig, FIRMWARE_ACTIVE_SIG, [0u8; 4]);
-        let mut transport = ScriptedTransport { response };
-        let mut mt = Mt1959::new(fixture_profile(sig), false);
-
-        mt.do_unlock(&mut transport).expect("unlock should succeed");
-        assert!(mt.init_complete);
-        assert!(
-            !mt.is_unlocked(),
-            "missing secondary marker -> not in extended-access state"
-        );
-    }
-
-    #[test]
-    fn do_unlock_rejects_signature_mismatch() {
-        let response = build_response(
-            [0xAA, 0xBB, 0xCC, 0xDD],
-            FIRMWARE_ACTIVE_SIG,
-            FIRMWARE_MODE_SIG,
-        );
-        let mut transport = ScriptedTransport { response };
-        let mut mt = Mt1959::new(fixture_profile([0x99, 0x9E, 0xC3, 0x75]), false);
-
-        let err = mt.do_unlock(&mut transport).unwrap_err();
-        assert!(matches!(err, Error::SignatureMismatch { .. }));
-        assert!(!mt.init_complete);
-        assert!(!mt.is_unlocked());
-    }
-
-    #[test]
-    fn do_unlock_rejects_inactive_mode_marker() {
-        // Signature matches but the primary marker at [12..16] is
-        // missing -> drive is not in active mode; init_complete and the
-        // unlocked flag must both stay false.
-        let sig = [0x99, 0x9E, 0xC3, 0x75];
-        let response = build_response(sig, [0u8; 4], FIRMWARE_MODE_SIG);
-        let mut transport = ScriptedTransport { response };
-        let mut mt = Mt1959::new(fixture_profile(sig), false);
-
-        let err = mt.do_unlock(&mut transport).unwrap_err();
-        assert!(matches!(err, Error::UnlockFailed));
-        assert!(!mt.init_complete);
-        assert!(!mt.is_unlocked());
-    }
-}

src/aacs/error.rs

@@ -0,0 +1,239 @@
+//! aacs's internal error for the cert-handshake SCSI/crypto code. Mirrors the
+//! handshake's original libfreemkv error surface (the specific Aacs* failure
+//! points + a structured SCSI error), so the moved handshake body is unchanged.
+
+use crate::scsi::{SCSI_STATUS_TRANSPORT_FAILURE, ScsiSense};
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+// A few variants are matched (defensive arms in the handshake) but never
+// constructed in the wired path — kept for completeness.
+#[allow(dead_code)]
+#[derive(Debug, Clone)]
+pub enum Error {
+    AacsAgidAlloc,
+    AacsCertRead,
+    AacsCertRejected,
+    AacsCertShort,
+    AacsCertVerify,
+    AacsDataKey,
+    AacsKeyRead,
+    AacsKeyRejected,
+    AacsKeyVerify,
+    AacsNoKeys,
+    AacsVidMac,
+    AacsVidRead,
+    HandshakeRejected,
+    VidUnavailable,
+    /// A handshake step returned FEWER bytes than the protocol step requires.
+    /// The buffer the step would have parsed is the caller's own zero fill, so
+    /// consuming it would turn a failed command into a "successful" handshake
+    /// step built entirely out of zeros.
+    ShortTransfer {
+        opcode: u8,
+        expected: usize,
+        got: usize,
+    },
+    /// A SCSI command failed. `status == SCSI_STATUS_TRANSPORT_FAILURE` with
+    /// `sense: None` is a transport-layer fault; a CHECK CONDITION carries the
+    /// parsed [`ScsiSense`].
+    Scsi {
+        /// CDB opcode that failed — diagnostic, carried for future logging.
+        opcode: u8,
+        status: u8,
+        sense: Option<ScsiSense>,
+    },
+}
+
+impl Error {
+    /// Stable numeric code (logged). Values are local to this crate.
+    pub fn code(&self) -> u16 {
+        match self {
+            Error::AacsAgidAlloc => 7001,
+            Error::AacsCertRead => 7002,
+            Error::AacsCertRejected => 7003,
+            Error::AacsCertShort => 7004,
+            Error::AacsCertVerify => 7005,
+            Error::AacsDataKey => 7006,
+            Error::AacsKeyRead => 7007,
+            Error::AacsKeyRejected => 7008,
+            Error::AacsKeyVerify => 7009,
+            Error::AacsNoKeys => 7010,
+            Error::AacsVidMac => 7011,
+            Error::AacsVidRead => 7012,
+            Error::HandshakeRejected => 7013,
+            Error::VidUnavailable => 7014,
+            Error::ShortTransfer { .. } => 7015,
+            Error::Scsi { .. } => 7099,
+        }
+    }
+
+    /// The parsed sense for a CHECK CONDITION SCSI error, else `None`.
+    pub fn scsi_sense(&self) -> Option<ScsiSense> {
+        match self {
+            Error::Scsi { sense, .. } => *sense,
+            _ => None,
+        }
+    }
+
+    /// True if this is a transport-layer SCSI failure (bus dead).
+    pub fn is_scsi_transport_failure(&self) -> bool {
+        matches!(
+            self,
+            Error::Scsi { status, sense: None, .. } if *status == SCSI_STATUS_TRANSPORT_FAILURE
+        )
+    }
+}
+
+/// A generic transport fault from the SCSI contract converts in (opcode unknown
+/// at the transport level; sense parsed from the raw buffer when present).
+impl From<crate::scsi::ScsiError> for Error {
+    fn from(e: crate::scsi::ScsiError) -> Self {
+        Error::Scsi {
+            opcode: 0,
+            status: e.status,
+            sense: e.sense.map(|s| ScsiSense::from_buf(&s)),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Every variant has its own stable numeric code. Constructing all 16
+    /// arms also exercises the `#[allow(dead_code)]` variants that the
+    /// wired handshake path never builds.
+    #[test]
+    fn code_is_stable_per_variant() {
+        assert_eq!(Error::AacsAgidAlloc.code(), 7001);
+        assert_eq!(Error::AacsCertRead.code(), 7002);
+        assert_eq!(Error::AacsCertRejected.code(), 7003);
+        assert_eq!(Error::AacsCertShort.code(), 7004);
+        assert_eq!(Error::AacsCertVerify.code(), 7005);
+        assert_eq!(Error::AacsDataKey.code(), 7006);
+        assert_eq!(Error::AacsKeyRead.code(), 7007);
+        assert_eq!(Error::AacsKeyRejected.code(), 7008);
+        assert_eq!(Error::AacsKeyVerify.code(), 7009);
+        assert_eq!(Error::AacsNoKeys.code(), 7010);
+        assert_eq!(Error::AacsVidMac.code(), 7011);
+        assert_eq!(Error::AacsVidRead.code(), 7012);
+        assert_eq!(Error::HandshakeRejected.code(), 7013);
+        assert_eq!(Error::VidUnavailable.code(), 7014);
+        assert_eq!(
+            Error::ShortTransfer {
+                opcode: 0xA4,
+                expected: 16,
+                got: 4,
+            }
+            .code(),
+            7015
+        );
+        assert_eq!(
+            Error::Scsi {
+                opcode: 0xA4,
+                status: 0x02,
+                sense: None,
+            }
+            .code(),
+            7099
+        );
+    }
+
+    /// `scsi_sense` returns the parsed sense for a `Scsi` error carrying one,
+    /// `None` when the `Scsi` error has none, and `None` for every non-`Scsi`
+    /// variant.
+    #[test]
+    fn scsi_sense_returns_the_parsed_sense_only_for_scsi_variant() {
+        let sense = ScsiSense {
+            sense_key: 0x05,
+            asc: 0x20,
+            ascq: 0x00,
+        };
+        let with_sense = Error::Scsi {
+            opcode: 0xA4,
+            status: 0x02,
+            sense: Some(sense),
+        };
+        let sc = with_sense.scsi_sense().unwrap();
+        assert_eq!(sc.sense_key, sense.sense_key);
+        assert_eq!(sc.asc, sense.asc);
+        assert_eq!(sc.ascq, sense.ascq);
+
+        let without_sense = Error::Scsi {
+            opcode: 0xA4,
+            status: 0xFF,
+            sense: None,
+        };
+        assert!(without_sense.scsi_sense().is_none());
+
+        assert!(Error::AacsNoKeys.scsi_sense().is_none());
+    }
+
+    /// `is_scsi_transport_failure` is true only for a `Scsi` error with the
+    /// transport-failure status AND no sense; a drive CHECK CONDITION and
+    /// every non-`Scsi` variant are false.
+    #[test]
+    fn is_scsi_transport_failure_true_and_false_paths() {
+        let transport = Error::Scsi {
+            opcode: 0,
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        };
+        assert!(transport.is_scsi_transport_failure());
+
+        let check_condition = Error::Scsi {
+            opcode: 0xA4,
+            status: 0x02,
+            sense: Some(ScsiSense {
+                sense_key: 0x05,
+                asc: 0x20,
+                ascq: 0x00,
+            }),
+        };
+        assert!(!check_condition.is_scsi_transport_failure());
+
+        assert!(!Error::AacsNoKeys.is_scsi_transport_failure());
+    }
+
+    /// `From<ScsiError>` maps a raw transport-layer error into `Error::Scsi`,
+    /// parsing the sense buffer when present and leaving it `None` otherwise.
+    #[test]
+    fn from_scsi_error_maps_status_and_parses_sense() {
+        let e = Error::from(crate::scsi::ScsiError {
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        });
+        match e {
+            Error::Scsi {
+                opcode,
+                status,
+                sense,
+            } => {
+                assert_eq!(opcode, 0);
+                assert_eq!(status, SCSI_STATUS_TRANSPORT_FAILURE);
+                assert!(sense.is_none());
+            }
+            _ => panic!("expected Error::Scsi"),
+        }
+
+        let mut buf = [0u8; 32];
+        buf[2] = 0x05;
+        buf[12] = 0x24;
+        buf[13] = 0x01;
+        let e = Error::from(crate::scsi::ScsiError {
+            status: 0x02,
+            sense: Some(buf),
+        });
+        match e {
+            Error::Scsi { status, sense, .. } => {
+                assert_eq!(status, 0x02);
+                let s = sense.expect("sense parsed");
+                assert_eq!(s.sense_key, 0x05);
+                assert_eq!(s.asc, 0x24);
+                assert_eq!(s.ascq, 0x01);
+            }
+            _ => panic!("expected Error::Scsi"),
+        }
+    }
+}

src/aacs/mod.rs

@@ -0,0 +1,200 @@
+//! aacs — the AACS host-certificate unlocker (Blu-ray / UHD).
+//!
+//! Self-contained module: it owns the cert-handshake EC crypto (the AKE, bus-key
+//! derivation, P-160 / P-256 curve math) that REMOVES AACS bus encryption. It
+//! implements [`crate::Unlocker`], learning the Volume ID + AACS 2.x bus key.
+//! Content-key decryption (unit keys, MKB, VUK) is the consumer's job, not here.
+
+mod error;
+mod handshake;
+
+use aes::Aes128;
+use aes::cipher::{Array, BlockCipherDecrypt, KeyInit};
+
+use crate::scsi::ScsiTransport;
+use crate::{DiscKind, UnlockCtx, UnlockError, Unlocked, Unlocker};
+
+/// AES-128-ECB decrypt a single 16-byte block — used to decrypt the bus key /
+/// read_data_key the drive returns after the handshake.
+pub(crate) fn aes_ecb_decrypt(key: &[u8; 16], data: &[u8; 16]) -> [u8; 16] {
+    let cipher = Aes128::new(&(*key).into());
+    let mut block: Array<u8, _> = (*data).into();
+    cipher.decrypt_block(&mut block);
+    let mut out = [0u8; 16];
+    out.copy_from_slice(&block);
+    out
+}
+
+/// The AACS host-certificate unlocker. Matches a Blu-ray/UHD disc
+/// (`DiscKind::Aacs`) and runs the cert handshake against the host certs the
+/// consumer collected (via [`UnlockCtx::host_certs`]), learning the Volume ID
+/// and — on AACS 2.0 — the bus key.
+pub struct AacsCert;
+
+impl AacsCert {
+    pub fn new() -> Self {
+        AacsCert
+    }
+}
+
+impl Default for AacsCert {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Unlocker for AacsCert {
+    fn name(&self) -> &'static str {
+        "AACS"
+    }
+
+    /// AACS removes BUS encryption via the host-cert handshake; it provides no
+    /// drive features. Self-guards on the disc kind (the consumer iterates every
+    /// unlocker's `unlock_bus`, so a non-AACS disc must decline here).
+    fn unlock_bus(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        if ctx.kind != DiscKind::Aacs {
+            return Err(UnlockError::NotApplicable);
+        }
+        if ctx.host_certs.is_empty() {
+            // No host cert to authenticate with — the consumer falls back to a
+            // VID-less / keysource path.
+            return Err(UnlockError::NoUsableHostCert);
+        }
+        let h = handshake::run_cert_handshake(scsi, ctx.host_certs)?;
+        Ok(Unlocked {
+            vid: Some(h.volume_id),
+            // Host-cert AKE path: bus removal depends on the bus key, not a
+            // firmware unlock.
+            bus_key: h.read_data_key,
+            drive_unlocked: false,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// AES-128-ECB decrypt against the FIPS-197 Appendix B / NIST known-answer
+    /// test vector: decrypting the published ciphertext with the published key
+    /// must recover the published plaintext.
+    #[test]
+    fn aes_ecb_decrypt_matches_fips197_test_vector() {
+        let key: [u8; 16] = [
+            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D,
+            0x0E, 0x0F,
+        ];
+        let ciphertext: [u8; 16] = [
+            0x69, 0xC4, 0xE0, 0xD8, 0x6A, 0x7B, 0x04, 0x30, 0xD8, 0xCD, 0xB7, 0x80, 0x70, 0xB4,
+            0xC5, 0x5A,
+        ];
+        let expected_plaintext: [u8; 16] = [
+            0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD,
+            0xEE, 0xFF,
+        ];
+        let out = aes_ecb_decrypt(&key, &ciphertext);
+        assert_eq!(out, expected_plaintext);
+    }
+
+    /// Decrypting a different ciphertext under the same key must not produce
+    /// the same plaintext — pins that the function actually decrypts the
+    /// given block rather than returning a constant.
+    #[test]
+    fn aes_ecb_decrypt_varies_with_input() {
+        let key = [0u8; 16];
+        let a = aes_ecb_decrypt(&key, &[0u8; 16]);
+        let b = aes_ecb_decrypt(&key, &[1u8; 16]);
+        assert_ne!(a, b);
+    }
+
+    fn id() -> crate::DriveId {
+        crate::DriveId::default()
+    }
+
+    /// `unlock_bus` self-guards on the disc kind: on a non-AACS disc it declines
+    /// (`NotApplicable`) WITHOUT touching the transport, so iterating it on a
+    /// CSS/unknown disc is safe.
+    #[test]
+    fn unlock_bus_declines_non_aacs_kinds() {
+        struct DeadTransport;
+        impl ScsiTransport for DeadTransport {
+            fn execute(
+                &mut self,
+                _cdb: &[u8],
+                _dir: crate::scsi::DataDirection,
+                _data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> crate::scsi::Result<crate::scsi::ScsiResult> {
+                panic!("transport must not be touched on a non-AACS disc");
+            }
+        }
+        let id = id();
+        let mut t = DeadTransport;
+        for k in [DiscKind::Unknown, DiscKind::Unencrypted, DiscKind::Css] {
+            let r = AacsCert::new().unlock_bus(&mut t, &UnlockCtx::new(&id, k, &[]));
+            assert_eq!(r.unwrap_err(), UnlockError::NotApplicable, "declines {k:?}");
+        }
+    }
+
+    /// `Default` must delegate to `new()` (there is only one way to build an
+    /// `AacsCert`, so this pins the two constructors never drift apart).
+    #[test]
+    #[allow(clippy::default_constructed_unit_structs)]
+    fn default_matches_new() {
+        let _ = AacsCert::default();
+        let _ = AacsCert::new();
+    }
+
+    /// THE full success path through `Unlocker::unlock_bus` itself: a
+    /// self-consistent AACS 1.0 drive emulator carries auth + VID + data-key
+    /// reads all the way to `Ok(Unlocked { .. })`, so the crate's public entry
+    /// point — not just `run_cert_handshake` underneath it — is proven to wire
+    /// `volume_id` and `read_data_key` into `Unlocked` correctly.
+    #[test]
+    fn unlock_bus_succeeds_end_to_end() {
+        let mut t = handshake::tests::DriveEmu::new();
+        t.serve_data_keys = true;
+        let id = id();
+        let certs = [host_cert()];
+        let ctx = UnlockCtx::new(&id, DiscKind::Aacs, &certs);
+        let unlocked = AacsCert::new()
+            .unlock_bus(&mut t, &ctx)
+            .expect("auth + VID + data-key reads all succeed");
+        assert_eq!(unlocked.vid, Some([0x5Au8; 16]));
+        assert!(unlocked.bus_key.is_some());
+        assert!(
+            !unlocked.drive_unlocked,
+            "cert path never sets drive_unlocked"
+        );
+    }
+
+    fn host_cert() -> crate::HostCert {
+        handshake::tests::dummy_cert()
+    }
+
+    /// With no host certs there is nothing to authenticate with → NoUsableHostCert,
+    /// and the transport is never touched.
+    #[test]
+    fn no_host_certs_is_no_usable_host_cert() {
+        struct DeadTransport;
+        impl ScsiTransport for DeadTransport {
+            fn execute(
+                &mut self,
+                _cdb: &[u8],
+                _dir: crate::scsi::DataDirection,
+                _data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> crate::scsi::Result<crate::scsi::ScsiResult> {
+                panic!("transport must not be touched with no host certs");
+            }
+        }
+        let id = id();
+        let mut t = DeadTransport;
+        let r = AacsCert::new().unlock_bus(&mut t, &UnlockCtx::new(&id, DiscKind::Aacs, &[]));
+        assert_eq!(r.unwrap_err(), UnlockError::NoUsableHostCert);
+    }
+}

src/css/error.rs

@@ -0,0 +1,149 @@
+//! css's internal error for the CSS bus-auth code. Distinct from
+//! [`crate::UnlockError`] (the outcome the consumer sees).
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug, Clone)]
+pub enum Error {
+    /// The CSS bus-authentication challenge-response failed.
+    CssAuthFailed,
+    /// A SCSI transport-layer fault.
+    Scsi(crate::scsi::ScsiError),
+}
+
+impl Error {
+    /// Stable numeric code (logged). Values are local to this crate.
+    pub fn code(&self) -> u16 {
+        match self {
+            Error::CssAuthFailed => 7201,
+            Error::Scsi(_) => 7299,
+        }
+    }
+
+    /// True if this is a transport-layer SCSI failure (bus dead).
+    pub fn is_transport_failure(&self) -> bool {
+        matches!(
+            self,
+            Error::Scsi(s)
+                if s.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE && s.sense.is_none()
+        )
+    }
+}
+
+/// Collapse a SCSI-layer failure from a bus-auth step onto the CSS auth code —
+/// but NEVER a transport fault.
+///
+/// Every step used to do `.map_err(|_| Error::CssAuthFailed)?`, which discarded
+/// the `ScsiError` whole. That made the `Transport` arm of the conversion below
+/// UNREACHABLE from any real call site: a dead bus arrived at the consumer as
+/// `NotApplicable`, so it fell through and kept probing a bus that was gone.
+pub fn step_err(e: crate::scsi::ScsiError) -> Error {
+    let err = Error::Scsi(e);
+    if err.is_transport_failure() {
+        err
+    } else {
+        Error::CssAuthFailed
+    }
+}
+
+impl From<crate::scsi::ScsiError> for Error {
+    fn from(e: crate::scsi::ScsiError) -> Self {
+        Error::Scsi(e)
+    }
+}
+
+/// CSS bus-auth either enables scrambled reads or it doesn't — any failure means
+/// "this unlocker didn't apply" (a transport fault still surfaces as Transport).
+impl From<Error> for crate::UnlockError {
+    fn from(e: Error) -> Self {
+        if e.is_transport_failure() {
+            crate::UnlockError::Transport
+        } else {
+            crate::UnlockError::NotApplicable
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::UnlockError;
+    use crate::scsi::{SCSI_STATUS_CHECK_CONDITION, SCSI_STATUS_TRANSPORT_FAILURE, ScsiError};
+
+    /// Catches restoring the `.map_err(|_| CssAuthFailed)` that made the
+    /// `Transport` arm unreachable: a dead bus must classify as `Transport`
+    /// (consumer aborts), a drive rejection as `NotApplicable` (fall through).
+    #[test]
+    fn transport_fault_survives_the_step_mapping() {
+        let dead = step_err(ScsiError {
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        });
+        assert!(dead.is_transport_failure());
+        assert_eq!(UnlockError::from(dead), UnlockError::Transport);
+
+        let refused = step_err(ScsiError {
+            status: SCSI_STATUS_CHECK_CONDITION,
+            sense: Some([0u8; 32]),
+        });
+        assert!(matches!(refused, Error::CssAuthFailed));
+        assert_eq!(UnlockError::from(refused), UnlockError::NotApplicable);
+    }
+
+    /// Each variant has its own stable numeric code.
+    #[test]
+    fn code_is_stable_per_variant() {
+        assert_eq!(Error::CssAuthFailed.code(), 7201);
+        assert_eq!(
+            Error::Scsi(ScsiError {
+                status: SCSI_STATUS_CHECK_CONDITION,
+                sense: Some([0u8; 32]),
+            })
+            .code(),
+            7299
+        );
+    }
+
+    /// `is_transport_failure` is false for `CssAuthFailed`, false for a
+    /// `Scsi` error carrying a sense (a drive rejection, not a dead bus) even
+    /// at the transport-failure status, and true only for the genuine
+    /// transport fault (status + no sense).
+    #[test]
+    fn is_transport_failure_false_paths() {
+        assert!(!Error::CssAuthFailed.is_transport_failure());
+
+        let sensed = Error::Scsi(ScsiError {
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: Some([0u8; 32]),
+        });
+        assert!(!sensed.is_transport_failure());
+
+        let refusal = Error::Scsi(ScsiError {
+            status: SCSI_STATUS_CHECK_CONDITION,
+            sense: None,
+        });
+        assert!(!refusal.is_transport_failure());
+
+        let dead = Error::Scsi(ScsiError {
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        });
+        assert!(dead.is_transport_failure());
+    }
+
+    /// `From<ScsiError>` wraps the transport error unchanged into `Error::Scsi`.
+    #[test]
+    fn from_scsi_error_wraps_into_scsi_variant() {
+        let e = Error::from(ScsiError {
+            status: SCSI_STATUS_CHECK_CONDITION,
+            sense: Some([1u8; 32]),
+        });
+        match e {
+            Error::Scsi(inner) => {
+                assert_eq!(inner.status, SCSI_STATUS_CHECK_CONDITION);
+                assert_eq!(inner.sense, Some([1u8; 32]));
+            }
+            _ => panic!("expected Error::Scsi"),
+        }
+    }
+}

src/ld/README.md

@@ -0,0 +1,21 @@
+# ld — the drive bus-unlock module
+
+A drive bus-unlock module for freemkv-unlock.
+
+freemkv-unlock defines the generic `Unlocker` contract; this module is one
+implementation of it. It recognizes a bundled catalog of supported drives
+(`profiles.json`) and, for a matching drive, lifts the drive-level
+bus-encryption barrier so the drive serves readable sectors. Content-key
+decryption is a separate concern, handled by the consumer.
+
+Clients never name this module directly —
+[libfreemkv](https://github.com/freemkv/libfreemkv) dispatches through
+`freemkv_unlock::all_unlockers()`, and this module answers `unlock_features()` /
+`unlock_bus()` when the drive identity is one it supports.
+
+## Scope: non-persistent unlock only
+
+This module performs only the **non-persistent** unlock — the access state it
+sets up lives in drive RAM and is gone on power cycle. The one-time, permanent
+drive preparation is the drive owner's own manual step and is **never**
+automated here.

src/ld/cdb.rs

@@ -1,7 +1,7 @@
 //! Public unlock-CDB seam.
 //!
 //! These items expose the *minimum* an external consumer (e.g. the bdemu
-//! drive emulator) needs to recognise and answer the LibreDrive unlock
+//! drive emulator) needs to recognise and answer the Mt1959Unlocker unlock
 //! READ_BUFFER handshake, without that consumer open-coding the
 //! handshake internals. The concrete CDB shapes and the verification
 //! marker are unlock-handshake details and must live ONLY in this crate.
@@ -15,7 +15,7 @@ pub const UNLOCK_MARKER: &[u8] = b"MMkv";
 
 /// Returns `true` when a READ_BUFFER (`0x3C`) CDB with the given mode
 /// (`cdb[1] & 0x1F`) and buffer id (`cdb[2]`) is an unlock-handshake
-/// read — i.e. one of the LibreDrive unlock variants.
+/// read — i.e. one of the Mt1959Unlocker unlock variants.
 ///
 /// This is the single source of truth for the unlock READ_BUFFER CDB
 /// shapes; consumers must call it rather than hardcoding the mode /

src/ld/error.rs

@@ -0,0 +1,204 @@
+//! ld's internal error type for the firmware-unlock SCSI/handshake code.
+//! Distinct from [`crate::UnlockError`] (the unlock OUTCOME the consumer sees);
+//! this is the low-level error ld's code uses. Maps both ways: a generic
+//! [`crate::scsi::ScsiError`] transport fault converts IN, and an `Error`
+//! converts OUT to the contract's `UnlockError`.
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Error {
+    /// A bundled drive profile could not be parsed (malformed hex / length).
+    ProfileParse,
+    /// A handshake completed but the device did not reach the expected state.
+    UnlockFailed,
+    /// A verify/handshake response did not match the expected signature.
+    SignatureMismatch { expected: [u8; 4], got: [u8; 4] },
+    /// A SCSI command failed. `status == SCSI_STATUS_TRANSPORT_FAILURE` with
+    /// `sense: None` is a transport-layer fault (bridge crash / disconnect).
+    Scsi {
+        opcode: u8,
+        status: u8,
+        sense: Option<[u8; 32]>,
+    },
+}
+
+impl std::fmt::Display for Error {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Error::ProfileParse => write!(f, "drive profile parse error"),
+            Error::UnlockFailed => write!(f, "firmware unlock failed"),
+            Error::SignatureMismatch { .. } => write!(f, "signature mismatch"),
+            Error::Scsi { opcode, status, .. } => {
+                write!(f, "SCSI error (opcode {opcode:#04x}, status {status:#04x})")
+            }
+        }
+    }
+}
+
+impl std::error::Error for Error {}
+
+impl Error {
+    /// Stable numeric code (logged). Values are local to this crate and share
+    /// the crate-wide space with `aacs` (70xx) and `css` (72xx).
+    pub fn code(&self) -> u16 {
+        match self {
+            Error::ProfileParse => 7101,
+            Error::UnlockFailed => 7102,
+            Error::SignatureMismatch { .. } => 7103,
+            Error::Scsi { .. } => 7199,
+        }
+    }
+
+    /// True if this is a transport-layer SCSI failure (bus dead), as opposed to a
+    /// drive sense or a logical failure.
+    pub(crate) fn is_transport_failure(&self) -> bool {
+        matches!(
+            self,
+            Error::Scsi { status, sense: None, .. }
+                if *status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE
+        )
+    }
+}
+
+/// A generic transport fault from the SCSI contract converts into ld's error
+/// (the opcode is unknown at the transport level).
+impl From<crate::scsi::ScsiError> for Error {
+    fn from(e: crate::scsi::ScsiError) -> Self {
+        Error::Scsi {
+            opcode: 0,
+            status: e.status,
+            sense: e.sense,
+        }
+    }
+}
+
+/// ld's internal error converts OUT to the contract outcome: a dead bus is a
+/// hard `Transport` abort; any other firmware failure means "this unlocker
+/// didn't apply" → the consumer falls through to the next unlocker.
+impl From<Error> for crate::UnlockError {
+    fn from(e: Error) -> Self {
+        if e.is_transport_failure() {
+            crate::UnlockError::Transport
+        } else {
+            crate::UnlockError::NotApplicable
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::UnlockError;
+    use crate::scsi::{SCSI_STATUS_CHECK_CONDITION, SCSI_STATUS_TRANSPORT_FAILURE, ScsiError};
+
+    /// The abort/fall-through boundary, which had no test at all. Catches
+    /// widening `is_transport_failure` (every failure would abort every rip) or
+    /// narrowing it (a dead bus would be probed forever).
+    #[test]
+    fn only_a_senseless_transport_status_is_a_transport_failure() {
+        let dead_bus = Error::Scsi {
+            opcode: 0x3C,
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        };
+        assert!(dead_bus.is_transport_failure());
+        assert_eq!(UnlockError::from(dead_bus), UnlockError::Transport);
+
+        // A CHECK CONDITION is the DRIVE refusing, not the bus dying.
+        let refused = Error::Scsi {
+            opcode: 0x3C,
+            status: SCSI_STATUS_CHECK_CONDITION,
+            sense: Some([0u8; 32]),
+        };
+        assert!(!refused.is_transport_failure());
+        assert_eq!(UnlockError::from(refused), UnlockError::NotApplicable);
+
+        // The transport-failure status WITH a sense is a drive that reported
+        // 0xFF, not a bus fault — it must not abort the consumer.
+        let odd = Error::Scsi {
+            opcode: 0x3C,
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: Some([0u8; 32]),
+        };
+        assert!(!odd.is_transport_failure());
+
+        for e in [
+            Error::ProfileParse,
+            Error::UnlockFailed,
+            Error::SignatureMismatch {
+                expected: [0; 4],
+                got: [1; 4],
+            },
+        ] {
+            assert!(!e.is_transport_failure(), "{e:?} is not a bus fault");
+            assert_eq!(UnlockError::from(e), UnlockError::NotApplicable);
+        }
+    }
+
+    /// `Display` is what shows up in logs — every variant must render without
+    /// panicking and the SCSI variant must carry the opcode/status through.
+    #[test]
+    fn display_renders_every_variant() {
+        assert_eq!(Error::ProfileParse.to_string(), "drive profile parse error");
+        assert_eq!(Error::UnlockFailed.to_string(), "firmware unlock failed");
+        assert_eq!(
+            Error::SignatureMismatch {
+                expected: [0; 4],
+                got: [1; 4],
+            }
+            .to_string(),
+            "signature mismatch"
+        );
+        assert_eq!(
+            Error::Scsi {
+                opcode: 0x3C,
+                status: 0x02,
+                sense: None,
+            }
+            .to_string(),
+            "SCSI error (opcode 0x3c, status 0x02)"
+        );
+    }
+
+    /// `From<ScsiError>` must carry the status AND sense across the seam —
+    /// collapsing either one destroys the transport-vs-rejection distinction the
+    /// whole abort/fall-through split rests on.
+    #[test]
+    fn scsi_error_conversion_preserves_status_and_sense() {
+        let e = Error::from(ScsiError {
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        });
+        assert!(e.is_transport_failure());
+
+        let e = Error::from(ScsiError {
+            status: SCSI_STATUS_CHECK_CONDITION,
+            sense: Some([0u8; 32]),
+        });
+        assert!(!e.is_transport_failure());
+        assert_eq!(UnlockError::from(e), UnlockError::NotApplicable);
+    }
+
+    /// Error codes are stable and distinct — they are the numeric contract the
+    /// logs carry instead of English.
+    #[test]
+    fn error_codes_are_distinct_and_stable() {
+        let codes = [
+            Error::ProfileParse.code(),
+            Error::UnlockFailed.code(),
+            Error::SignatureMismatch {
+                expected: [0; 4],
+                got: [0; 4],
+            }
+            .code(),
+            Error::Scsi {
+                opcode: 0,
+                status: 0,
+                sense: None,
+            }
+            .code(),
+        ];
+        assert_eq!(codes, [7101, 7102, 7103, 7199]);
+    }
+}

src/ld/mod.rs

@@ -0,0 +1,626 @@
+//! ld — the MediaTek MT1959 firmware unlocker.
+//!
+//! Self-contained module: it owns the bundled drive profiles, firmware blobs,
+//! the WRITE_BUFFER / MODE SELECT upload, the unlock CDBs, and the variant-A /
+//! variant-B handshake. It implements [`crate::Unlocker`] — removing AACS bus
+//! encryption AT THE DRIVE (the unlocked drive serves clear content) and
+//! reporting the OEM Volume ID.
+
+// `cdb` carries ONLY the unlock-handshake wire format that the bdemu emulator
+// needs (the real unlocker drives its CDBs from per-drive profile templates, not
+// these constants). Compile it only when the `emulation` feature exposes it, so
+// it never dead-codes in a normal build.
+// Compiled under `cfg(test)` as well as the feature: its tests pin the unlock
+// wire format, and gating the whole module on a non-default feature meant CI
+// (which builds with default features) never ran them.
+#[cfg(any(feature = "emulation", test))]
+mod cdb;
+mod error;
+mod platform;
+mod profile;
+
+use crate::ld::error::Result;
+use crate::scsi::{DataDirection, ScsiTransport};
+use crate::{DriveId, UnlockCtx, UnlockError, Unlocked, Unlocker};
+
+// ── Public profile catalog ──────────────────────────────────────────────────
+//
+// The catalog of drives the MT1959 unlocker recognizes is the one piece of
+// ld worth exposing publicly: it answers "is this drive supported?" without
+// unlocking, and the bdemu test-emulator reads it to impersonate a supported
+// drive. The unlock *mechanism* (firmware blobs, upload sequence, CDB wire
+// format) stays private — only the catalog and its match result are public.
+
+pub use profile::{DriveProfile as Profile, Identity, Platform, ProfileMatch, Profiles};
+
+/// The bundled MT1959 profile catalog (parsed once, process-cached), or
+/// `None` if the embedded JSON fails to parse (a build-time bug). Pair with
+/// [`Profiles::get`] to look up a specific drive:
+/// `freemkv_unlock::ld::profiles().and_then(|p| p.get(&drive_id))`.
+pub fn profiles() -> Option<&'static Profiles> {
+    profile::bundled()
+}
+
+/// The bundled profile matching a drive identity, if the drive is supported.
+/// Convenience over [`profiles`] + [`Profiles::get`].
+pub fn profile(drive_id: &DriveId) -> Option<ProfileMatch> {
+    profile::find_bundled(drive_id)
+}
+
+/// The unlock-handshake wire format the bdemu test-emulator needs to impersonate
+/// an ld-unlockable drive: the marker an unlocked drive returns and the
+/// READ BUFFER mode/buf-id that constitutes an unlock request. Behind the
+/// non-default `emulation` feature so real clients never see ld's wire format.
+#[cfg(feature = "emulation")]
+pub use cdb::{UNLOCK_MARKER, is_unlock_read_buffer};
+
+/// The MT1959 unlocker. `pub(crate)` — clients reach it only through
+/// [`crate::all_unlockers`], never by name (the locked-design contract).
+///
+/// Matches a drive against the bundled profile database and, on a hit,
+/// runs the MediaTek MT1959 firmware-unlock (and disc-speed calibration)
+/// handshake over the raw SCSI transport.
+pub(crate) struct Mt1959Unlocker;
+
+impl Mt1959Unlocker {
+    pub(crate) fn new() -> Self {
+        Mt1959Unlocker
+    }
+}
+
+/// The firmware-unlocker name for a drive that has a bundled profile (for
+/// drive-info "is this drive supported?" display), or `None`. A pure profile
+/// lookup — does NOT touch the drive or unlock anything.
+pub(crate) fn firmware_name(id: &DriveId) -> Option<&'static str> {
+    profile::find_bundled(id).map(|_| "MT1959")
+}
+
+impl Mt1959Unlocker {
+    /// Read the OEM Volume ID via the matched profile's vendor CDB.
+    ///
+    /// Takes the profile the caller ALREADY matched rather than re-running
+    /// `find_bundled`: the catalog is 206 entries and drive-prep used to scan it
+    /// twice per drive (once here, once in `firmware_unlock`) for the same
+    /// answer.
+    ///
+    /// `Ok(Some(vid))` on a well-formed 36-byte response (signature `00 22 00`,
+    /// VID at `[4..20]`); `Ok(None)` when there is no OEM-VID CDB or the response
+    /// is short / bad-signature / drive-rejected (the drive is still unlocked,
+    /// just no VID); `Err` only on a transport fault.
+    fn read_oem_vid(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        profile: &profile::DriveProfile,
+    ) -> Result<Option<[u8; 16]>> {
+        const RESPONSE_LEN: usize = 36;
+        const EXPECTED_HEADER: [u8; 3] = [0x00, 0x22, 0x00];
+
+        let Some(cdb) = profile.read_vid_cdb else {
+            return Ok(None);
+        };
+
+        let mut buf = vec![0u8; RESPONSE_LEN];
+        let result = scsi.execute(&cdb, DataDirection::FromDevice, &mut buf, 5_000)?;
+        // Per the transport contract a drive sense arrives as `Ok` with a
+        // non-zero `status`, NOT as `Err`. Without this check a CHECK CONDITION
+        // would be read as a successful 36-byte response and the caller's own
+        // zero fill parsed as a Volume ID.
+        if result.status != 0 {
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "oem_vid_check_condition",
+                status = result.status,
+                "OEM VID CDB returned a drive sense"
+            );
+            return Ok(None);
+        }
+        if result.bytes_transferred < RESPONSE_LEN {
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "oem_vid_short_response",
+                bytes_transferred = result.bytes_transferred,
+                "OEM VID CDB returned short response"
+            );
+            return Ok(None);
+        }
+        if buf[0..3] != EXPECTED_HEADER {
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "oem_vid_bad_header",
+                "OEM VID response header mismatch"
+            );
+            return Ok(None);
+        }
+        let mut vid = [0u8; 16];
+        vid.copy_from_slice(&buf[4..20]);
+        tracing::debug!(target: "freemkv::disc", phase = "oem_vid_ok", "OEM VID retrieved via unlocker");
+        Ok(Some(vid))
+    }
+}
+
+impl Mt1959Unlocker {
+    /// The MediaTek firmware unlock. Because the MT1959 unlocker removes AACS bus
+    /// encryption AT THE DRIVE (the unlocked drive serves CLEAR content), this ONE
+    /// operation satisfies BOTH the drive-features and the bus-removal capability
+    /// — so `unlock_features` and `unlock_bus` both delegate here. The result
+    /// carries `drive_unlocked: true` (no bus key needed) and the OEM Volume ID.
+    ///
+    /// A no-firmware-route drive (Renesas / no profile) returns `NotApplicable`; a
+    /// transport fault propagates as `Transport`; any other firmware failure also
+    /// falls through as `NotApplicable`.
+    fn firmware_unlock(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        let id = ctx.drive_id;
+        let Some(m) = profile::find_bundled(id) else {
+            return Err(UnlockError::NotApplicable);
+        };
+        if matches!(m.platform, profile::Platform::Renesas) {
+            // Renesas is a different platform (handled by the Renesas unlocker).
+            return Err(UnlockError::NotApplicable);
+        }
+        let is_variant_b = matches!(m.platform, profile::Platform::Mt1959B);
+        use platform::PlatformDriver;
+        let mut mt = platform::mt1959::Mt1959::new(m.profile.clone(), is_variant_b);
+        // A transport fault → UnlockError::Transport; any other firmware failure
+        // → NotApplicable (via From<error::Error>).
+        mt.init(scsi)?;
+        // `init` only proves the handshake COMPLETED — `do_unlock` returns Ok on
+        // a response that carried the per-drive signature but not both firmware
+        // markers. Only `is_unlocked()` means the drive actually reached the
+        // extended-access state and serves clear content. Reporting
+        // `drive_unlocked: true` off `init` alone told the consumer the bus was
+        // clear on a half-unlocked drive, which suppressed the cert-auth
+        // fallback and shipped ciphertext at rc=0. A partial unlock must fall
+        // through to the next unlocker.
+        if !mt.is_unlocked() {
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "firmware_unlock_incomplete",
+                "firmware handshake completed but the drive is not in the extended-access state; falling through"
+            );
+            return Err(UnlockError::NotApplicable);
+        }
+        // Prime the per-region speed table. Best-effort — it must not fail the
+        // unlock — but NOT silent: speed calibration can fail completely, and an
+        // unlogged `let _ =` made a fully-failed calibration indistinguishable
+        // from a successful one in the rip log.
+        if let Err(e) = mt.probe_disc(scsi) {
+            // A transport fault here is a DEAD BUS, not a speed-calibration miss.
+            // The rest of this path (`read_oem_vid`) is a no-op for the 140/206
+            // profiles that carry no `read_vid_cdb`, so it never touches the bus
+            // again — meaning this swallowed fault was the ONLY dead-bus signal,
+            // and warn-and-continue turned it into `Ok(Unlocked{drive_unlocked:
+            // true})`: a dead bus rendered as a fully-unlocked drive (the flagship
+            // failure-that-looks-like-success). A genuine calibration miss (drive
+            // sense / short reply) still continues on the default speed table.
+            if e.is_transport_failure() {
+                tracing::warn!(
+                    target: "freemkv::disc",
+                    phase = "probe_disc_transport_fault",
+                    "transport fault during disc speed calibration; aborting"
+                );
+                return Err(UnlockError::Transport);
+            }
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "probe_disc_failed",
+                transport_failure = false,
+                "disc speed calibration failed; continuing with the drive's default speed table"
+            );
+        }
+        let vid = self.read_oem_vid(scsi, &m.profile)?;
+        Ok(Unlocked {
+            vid,
+            bus_key: None,
+            drive_unlocked: true,
+        })
+    }
+}
+
+impl Unlocker for Mt1959Unlocker {
+    fn name(&self) -> &'static str {
+        "MT1959"
+    }
+
+    /// Mt1959Unlocker provides drive features (riplock/speed, OEM VID) — and, because
+    /// its firmware unlock serves clear content, bus removal comes free with it.
+    fn unlock_features(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        self.firmware_unlock(scsi, ctx)
+    }
+
+    /// Same firmware code as [`unlock_features`]: Mt1959Unlocker removes the bus at
+    /// the drive. In practice the consumer skips this because drive-prep already
+    /// set `drive_unlocked`; it's here for completeness / a bus-first call order.
+    fn unlock_bus(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        self.firmware_unlock(scsi, ctx)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::DiscKind;
+    use crate::scsi::{DataDirection, ScsiResult, ScsiTransport};
+
+    /// Unlock context for a fake drive id (kind/host-certs irrelevant to the
+    /// firmware unlocker — it keys off the drive identity).
+    fn ctx(id: &DriveId) -> UnlockCtx<'_> {
+        UnlockCtx::new(id, DiscKind::Unknown, &[])
+    }
+
+    /// A fake transport that fills the response buffer from a fixed payload and
+    /// reports a configurable transferred-byte count.
+    struct FakeTransport {
+        payload: Vec<u8>,
+        bytes_transferred: usize,
+    }
+    impl ScsiTransport for FakeTransport {
+        fn execute(
+            &mut self,
+            _cdb: &[u8],
+            _dir: DataDirection,
+            data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> crate::scsi::Result<ScsiResult> {
+            let n = self.payload.len().min(data.len());
+            data[..n].copy_from_slice(&self.payload[..n]);
+            Ok(ScsiResult {
+                status: 0,
+                bytes_transferred: self.bytes_transferred,
+                sense: [0u8; 32],
+            })
+        }
+    }
+
+    /// A DriveId for the bundled HL-DT-ST profile that carries a real
+    /// `read_vid_cdb`, so `read_oem_vid` finds a profile and issues the CDB.
+    fn known_vid_drive_id() -> DriveId {
+        make_drive_id("HL-DT-ST", "1.01", "NM00100", "211711202000")
+    }
+
+    fn make_drive_id(vendor: &str, rev: &str, vs: &str, date: &str) -> DriveId {
+        DriveId {
+            vendor_id: vendor.to_string(),
+            product_id: String::new(),
+            product_revision: rev.to_string(),
+            vendor_specific: vs.to_string(),
+            firmware_date: date.to_string(),
+        }
+    }
+
+    /// The bundled profile of the fixture drive (the one carrying a real
+    /// `read_vid_cdb`).
+    fn known_vid_profile() -> profile::DriveProfile {
+        let m = profile::find_bundled(&known_vid_drive_id()).expect("profile match");
+        assert!(
+            m.profile.read_vid_cdb.is_some(),
+            "test fixture drive must carry an OEM VID CDB"
+        );
+        m.profile
+    }
+
+    /// A well-formed 36-byte response (signature 00 22 00, VID at [4..20]) parses
+    /// to `Some(vid)`.
+    #[test]
+    fn read_oem_vid_parses_well_formed_response() {
+        let mut payload = vec![0u8; 36];
+        payload[0..3].copy_from_slice(&[0x00, 0x22, 0x00]);
+        let vid = [0x3Cu8; 16];
+        payload[4..20].copy_from_slice(&vid);
+        let mut t = FakeTransport {
+            payload,
+            bytes_transferred: 36,
+        };
+        let got = Mt1959Unlocker::new()
+            .read_oem_vid(&mut t, &known_vid_profile())
+            .expect("parse ok");
+        assert_eq!(got, Some(vid), "VID parsed from [4..20]");
+    }
+
+    /// A short response → `Ok(None)` (drive unlocked, just no readable VID).
+    #[test]
+    fn read_oem_vid_short_response_is_none() {
+        let mut t = FakeTransport {
+            payload: vec![0u8; 36],
+            bytes_transferred: 20,
+        };
+        let got = Mt1959Unlocker::new()
+            .read_oem_vid(&mut t, &known_vid_profile())
+            .expect("short response is Ok(None)");
+        assert_eq!(got, None);
+    }
+
+    /// A response whose 3-byte signature isn't `00 22 00` → `Ok(None)`.
+    #[test]
+    fn read_oem_vid_bad_header_is_none() {
+        let mut payload = vec![0u8; 36];
+        payload[0..3].copy_from_slice(&[0xDE, 0xAD, 0xBE]);
+        let mut t = FakeTransport {
+            payload,
+            bytes_transferred: 36,
+        };
+        let got = Mt1959Unlocker::new()
+            .read_oem_vid(&mut t, &known_vid_profile())
+            .expect("bad header is Ok(None)");
+        assert_eq!(got, None);
+    }
+
+    /// Catches dropping the `result.status` check: a CHECK CONDITION arrives as
+    /// `Ok` per the transport contract, so without it the caller's zero-filled
+    /// buffer is parsed as a real 36-byte response.
+    #[test]
+    fn read_oem_vid_check_condition_is_none_not_a_vid() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::illegal_request());
+        let got = Mt1959Unlocker::new()
+            .read_oem_vid(&mut t, &known_vid_profile())
+            .expect("a drive sense is not a transport fault");
+        assert_eq!(got, None, "a CHECK CONDITION must never yield a VID");
+    }
+
+    /// Catches swallowing a transport fault in the OEM-VID read: a dead bus must
+    /// propagate (→ `UnlockError::Transport`), never become `Ok(None)`.
+    #[test]
+    fn read_oem_vid_transport_fault_propagates() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::TransportFault);
+        let err = Mt1959Unlocker::new()
+            .read_oem_vid(&mut t, &known_vid_profile())
+            .expect_err("a dead bus must not be Ok(None)");
+        assert!(err.is_transport_failure());
+        assert_eq!(UnlockError::from(err), UnlockError::Transport);
+    }
+
+    /// A profile with no OEM-VID CDB → `Ok(None)` without touching the drive.
+    #[test]
+    fn read_oem_vid_no_cdb_is_none() {
+        let mut p = known_vid_profile();
+        p.read_vid_cdb = None;
+        let mut t = FakeTransport {
+            payload: vec![0u8; 36],
+            bytes_transferred: 36,
+        };
+        let got = Mt1959Unlocker::new()
+            .read_oem_vid(&mut t, &p)
+            .expect("no CDB is Ok(None)");
+        assert_eq!(got, None);
+    }
+
+    /// Public catalog accessors: `profiles()` returns the bundled catalog and
+    /// `profile()` is `profiles().and_then(get)` for a known drive.
+    #[test]
+    fn public_catalog_accessors_find_the_bundled_fixture_drive() {
+        assert!(super::profiles().is_some(), "bundled catalog must parse");
+        let m = super::profile(&known_vid_drive_id()).expect("known fixture drive matches");
+        assert!(m.profile.read_vid_cdb.is_some());
+    }
+
+    /// `unlock_features` on a drive with no matching profile → `NotApplicable`
+    /// (fall through), short-circuiting before any firmware handshake.
+    #[test]
+    fn unlock_no_profile_is_not_applicable() {
+        let mut t = FakeTransport {
+            payload: vec![0u8; 36],
+            bytes_transferred: 36,
+        };
+        let err = Mt1959Unlocker::new()
+            .unlock_features(
+                &mut t,
+                &ctx(&make_drive_id("FAKE-VND", "9.99", "XX12345", "")),
+            )
+            .expect_err("no profile → NotApplicable");
+        assert_eq!(err, UnlockError::NotApplicable);
+    }
+
+    /// THE defect-1 test. The drive answers every unlock READ_BUFFER with a
+    /// response carrying the per-drive signature and the primary firmware marker
+    /// but NOT the secondary one — `do_unlock` returns `Ok` and `init()`
+    /// succeeds, yet the drive is NOT in the extended-access state. Reporting
+    /// `drive_unlocked: true` here suppresses the cert-auth fallback. Catches
+    /// removing the `is_unlocked()` gate in `firmware_unlock`.
+    #[test]
+    fn half_unlocked_drive_falls_through_instead_of_claiming_unlocked() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let id = known_vid_drive_id();
+        let sig = profile::find_bundled(&id)
+            .expect("profile")
+            .profile
+            .signature;
+
+        // 64-byte unlock response: signature + primary marker "MMkv" at [12..16],
+        // secondary marker at [16..20] left zeroed.
+        let mut resp = vec![0u8; 64];
+        resp[0..4].copy_from_slice(&sig);
+        resp[12..16].copy_from_slice(&[0x4D, 0x4D, 0x6B, 0x76]);
+
+        let mut t = MockTransport::always(Reply::good(resp));
+        let err = Mt1959Unlocker::new()
+            .unlock_features(&mut t, &ctx(&id))
+            .expect_err("a half-unlocked drive must fall through to cert-auth");
+        assert_eq!(err, UnlockError::NotApplicable);
+    }
+
+    /// The whole-unlock happy path still reports `drive_unlocked` when BOTH
+    /// firmware markers are present — the `is_unlocked()` gate must not have
+    /// made a genuinely unlocked drive fall through.
+    #[test]
+    fn fully_unlocked_drive_reports_drive_unlocked() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let id = known_vid_drive_id();
+        let sig = profile::find_bundled(&id)
+            .expect("profile")
+            .profile
+            .signature;
+
+        let mut resp = vec![0u8; 64];
+        resp[0..4].copy_from_slice(&sig);
+        resp[12..16].copy_from_slice(&[0x4D, 0x4D, 0x6B, 0x76]);
+        resp[16..20].copy_from_slice(&[0x4C, 0x62, 0x44, 0x72]);
+
+        let mut t = MockTransport::always(Reply::good(resp));
+        let u = Mt1959Unlocker::new()
+            .unlock_features(&mut t, &ctx(&id))
+            .expect("both markers → unlocked");
+        assert!(u.drive_unlocked);
+    }
+
+    /// THE probe-disc dead-bus test. The drive unlocks fully (both firmware
+    /// markers), then the bus DIES during disc-speed calibration. `probe_disc`
+    /// used to be warn-and-continued regardless of the fault, and — because the
+    /// 140/206 profiles without a `read_vid_cdb` never touch the bus again — a
+    /// dead bus was reported as `Ok(Unlocked{drive_unlocked:true})`: a dead bus
+    /// rendered as a successful unlock (the flagship failure-that-looks-like-
+    /// success). `firmware_unlock` must now abort with `Transport`.
+    /// MUTATION: reverting the `if e.is_transport_failure()` return in
+    /// `firmware_unlock` (warn-and-continue), OR flattening the probe loops'
+    /// transport classification, makes this go red.
+    #[test]
+    fn transport_fault_during_probe_disc_is_transport_not_a_successful_unlock() {
+        let id = known_vid_drive_id();
+        let sig = profile::find_bundled(&id)
+            .expect("profile")
+            .profile
+            .signature;
+
+        // A drive that unlocks fully but whose bus dies on the speed probe.
+        struct ProbeFaultsDrive {
+            resp: Vec<u8>,
+        }
+        impl ScsiTransport for ProbeFaultsDrive {
+            fn execute(
+                &mut self,
+                cdb: &[u8],
+                _dir: DataDirection,
+                data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> crate::scsi::Result<ScsiResult> {
+                // READ_BUFFER (0x3C) / SUB_CMD_PROBE (0x14) is the speed probe.
+                if cdb.first() == Some(&0x3C) && cdb.get(3) == Some(&0x14) {
+                    return Err(crate::scsi::ScsiError {
+                        status: crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE,
+                        sense: None,
+                    });
+                }
+                let n = self.resp.len().min(data.len());
+                data[..n].copy_from_slice(&self.resp[..n]);
+                Ok(ScsiResult {
+                    status: 0,
+                    bytes_transferred: n,
+                    sense: [0u8; 32],
+                })
+            }
+        }
+
+        let mut resp = vec![0u8; 64];
+        resp[0..4].copy_from_slice(&sig);
+        resp[12..16].copy_from_slice(&[0x4D, 0x4D, 0x6B, 0x76]); // primary marker
+        resp[16..20].copy_from_slice(&[0x4C, 0x62, 0x44, 0x72]); // secondary marker
+        let mut t = ProbeFaultsDrive { resp };
+
+        let err = Mt1959Unlocker::new()
+            .unlock_features(&mut t, &ctx(&id))
+            .expect_err("a dead bus during probe must abort, not report success");
+        assert_eq!(err, UnlockError::Transport);
+    }
+
+    /// A drive-sense (not a dead bus) rejecting the speed probe is a genuine
+    /// calibration miss, not a transport fault — `firmware_unlock` must
+    /// warn-and-continue on the drive's default speed table, still reporting a
+    /// full unlock. The non-transport sibling of
+    /// `transport_fault_during_probe_disc_is_transport_not_a_successful_unlock`.
+    #[test]
+    fn drive_sense_during_probe_disc_still_reports_a_successful_unlock() {
+        let id = known_vid_drive_id();
+        let sig = profile::find_bundled(&id)
+            .expect("profile")
+            .profile
+            .signature;
+
+        let mut resp = vec![0u8; 64];
+        resp[0..4].copy_from_slice(&sig);
+        resp[12..16].copy_from_slice(&[0x4D, 0x4D, 0x6B, 0x76]); // primary marker
+        resp[16..20].copy_from_slice(&[0x4C, 0x62, 0x44, 0x72]); // secondary marker
+
+        struct ProbeSenseDrive {
+            resp: Vec<u8>,
+        }
+        impl ScsiTransport for ProbeSenseDrive {
+            fn execute(
+                &mut self,
+                cdb: &[u8],
+                _dir: DataDirection,
+                data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> crate::scsi::Result<ScsiResult> {
+                // READ_BUFFER (0x3C) / SUB_CMD_PROBE (0x14) is the speed probe.
+                if cdb.first() == Some(&0x3C) && cdb.get(3) == Some(&0x14) {
+                    return Ok(ScsiResult {
+                        status: 0x02,
+                        bytes_transferred: 0,
+                        sense: [0u8; 32],
+                    });
+                }
+                let n = self.resp.len().min(data.len());
+                data[..n].copy_from_slice(&self.resp[..n]);
+                Ok(ScsiResult {
+                    status: 0,
+                    bytes_transferred: n,
+                    sense: [0u8; 32],
+                })
+            }
+        }
+        let mut t = ProbeSenseDrive { resp };
+        let u = Mt1959Unlocker::new()
+            .unlock_features(&mut t, &ctx(&id))
+            .expect("a calibration miss must not fail the whole unlock");
+        assert!(u.drive_unlocked);
+    }
+
+    /// `unlock_bus` is the same firmware code as `unlock_features` (bus removal
+    /// comes free with the drive unlock) — pins that the trait method actually
+    /// delegates rather than being an accidental no-op stub.
+    #[test]
+    fn unlock_bus_delegates_to_the_same_firmware_unlock() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let id = known_vid_drive_id();
+        let sig = profile::find_bundled(&id)
+            .expect("profile")
+            .profile
+            .signature;
+
+        let mut resp = vec![0u8; 64];
+        resp[0..4].copy_from_slice(&sig);
+        resp[12..16].copy_from_slice(&[0x4D, 0x4D, 0x6B, 0x76]);
+        resp[16..20].copy_from_slice(&[0x4C, 0x62, 0x44, 0x72]);
+
+        let mut t = MockTransport::always(Reply::good(resp));
+        let u = Mt1959Unlocker::new()
+            .unlock_bus(&mut t, &ctx(&id))
+            .expect("unlock_bus runs the same firmware handshake");
+        assert!(u.drive_unlocked);
+    }
+
+    /// Catches classifying a dead bus as "not this unlocker's drive": the very
+    /// first unlock command faulting at the transport layer must abort the
+    /// consumer (`Transport`), not fall through to the next unlocker.
+    #[test]
+    fn transport_fault_during_unlock_is_transport_not_not_applicable() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::TransportFault);
+        let err = Mt1959Unlocker::new()
+            .unlock_features(&mut t, &ctx(&known_vid_drive_id()))
+            .expect_err("dead bus");
+        assert_eq!(err, UnlockError::Transport);
+    }
+}

src/ld/platform/mod.rs

@@ -0,0 +1,65 @@
+//! Platform-specific drive unlock + disc probing (Mt1959Unlocker internals).
+
+pub mod mt1959;
+
+use crate::ld::error::Result;
+use crate::scsi::ScsiTransport;
+
+pub(crate) trait PlatformDriver: Send {
+    /// Unlock drive + upload firmware if needed.
+    fn init(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()>;
+
+    /// Calibrate drive for this disc. Probes the disc surface so the
+    /// drive's firmware learns the optimal speed for each region.
+    fn probe_disc(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()>;
+
+    /// True after successful init().
+    #[allow(dead_code)]
+    fn is_ready(&self) -> bool;
+
+    /// True if the drive is currently in the extended-access state. THE gate
+    /// `Mt1959Unlocker::firmware_unlock` reports `drive_unlocked` from — `init()`
+    /// returning `Ok` only means the handshake completed, not that the drive
+    /// serves clear content.
+    fn is_unlocked(&self) -> bool {
+        false
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::scsi::mock::{MockTransport, Reply};
+
+    /// A minimal driver that takes every `PlatformDriver` default (`is_unlocked`)
+    /// so the shim's dispatch and the default's `false` are both exercised —
+    /// every real driver (`Mt1959`) overrides `is_unlocked`, so without this the
+    /// default body is dead in coverage even though it is reachable code.
+    struct StubDriver;
+
+    impl PlatformDriver for StubDriver {
+        fn init(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()> {
+            scsi.execute(&[0], crate::scsi::DataDirection::None, &mut [], 0)?;
+            Ok(())
+        }
+
+        fn probe_disc(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()> {
+            scsi.execute(&[0], crate::scsi::DataDirection::None, &mut [], 0)?;
+            Ok(())
+        }
+
+        fn is_ready(&self) -> bool {
+            true
+        }
+    }
+
+    #[test]
+    fn default_is_unlocked_is_false_and_trait_methods_dispatch() {
+        let mut drv = StubDriver;
+        let mut scsi = MockTransport::always(Reply::good(vec![]));
+        assert!(drv.init(&mut scsi).is_ok());
+        assert!(drv.probe_disc(&mut scsi).is_ok());
+        assert!(drv.is_ready());
+        assert!(!drv.is_unlocked());
+    }
+}

src/ld/platform/mt1959/variant_a.rs

@@ -3,7 +3,7 @@
 //! WRITE_BUFFER (0x3B) → verify READ_BUFFER (0x45) → unlock × 2
 
 use super::Mt1959;
-use crate::error::Result;
+use crate::ld::error::Result;
 use crate::scsi::{DataDirection, ScsiTransport};
 
 use super::SCSI_WRITE_BUFFER;
@@ -17,7 +17,7 @@ const WRITE_BUFFER_MAX_LEN: usize = 0x00FF_FFFF;
 pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Result<()> {
     let firmware = &mt.profile.firmware;
     if firmware.is_empty() {
-        return Err(crate::error::Error::UnlockFailed);
+        return Err(crate::ld::error::Error::UnlockFailed);
     }
 
     // Upload firmware via WRITE_BUFFER. The CDB's length is a 24-bit field;
@@ -26,7 +26,7 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
     // length-mismatched command.
     let len = firmware.len();
     if len > WRITE_BUFFER_MAX_LEN {
-        return Err(crate::error::Error::UnlockFailed);
+        return Err(crate::ld::error::Error::UnlockFailed);
     }
     let cdb = [
         SCSI_WRITE_BUFFER,
@@ -43,7 +43,12 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
     let mut data = firmware.clone();
     scsi.execute(&cdb, DataDirection::ToDevice, &mut data, 30_000)?;
 
-    // Verify firmware loaded (non-fatal — different buffer_id 0x45)
+    // Verify the firmware loaded (non-fatal — different buffer_id 0x45). There
+    // is no documented expected payload to compare against, so the outcome is
+    // TRACED rather than asserted: discarding it with `let _ =` meant a corrupt
+    // upload proceeded straight into the do_unlock retries with no diagnostic
+    // whatsoever, which is exactly the silent-failure shape this crate exists to
+    // avoid.
     let verify_cdb = [
         super::SCSI_READ_BUFFER,
         super::MODE_A,
@@ -57,12 +62,43 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
         0x00,
     ];
     let mut verify_resp = [0u8; super::VALIDATE_RESPONSE_SIZE as usize];
-    let _ = scsi.execute(
+    match scsi.execute(
         &verify_cdb,
         DataDirection::FromDevice,
         &mut verify_resp,
         5_000,
-    );
+    ) {
+        Ok(r) if r.status == 0 && r.bytes_transferred == verify_resp.len() => {
+            tracing::debug!(
+                target: "freemkv::disc",
+                phase = "mt1959a_fw_verify_ok",
+                "variant-A firmware verify read returned a full response"
+            );
+        }
+        Ok(r) => {
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "mt1959a_fw_verify_bad",
+                status = r.status,
+                bytes_transferred = r.bytes_transferred,
+                "variant-A firmware verify read did not return a full good response"
+            );
+        }
+        // A dead bus mid-upload must abort, not be swallowed into the unlock
+        // retries below.
+        Err(e) => {
+            let err = crate::ld::error::Error::from(e);
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "mt1959a_fw_verify_failed",
+                transport_failure = err.is_transport_failure(),
+                "variant-A firmware verify read failed"
+            );
+            if err.is_transport_failure() {
+                return Err(err);
+            }
+        }
+    }
 
     // Double unlock after firmware upload. The first establishes the
     // unlock and is fatal on failure; the second is a confirmation pass and

src/ld/platform/mt1959/variant_b.rs

@@ -3,7 +3,7 @@
 //! MODE SELECT (0x55) → read metadata → WRITE_BUFFER → vendor verify (0xF1) → unlock × 5+1
 
 use super::{Mt1959, SCSI_READ_BUFFER, SCSI_WRITE_BUFFER};
-use crate::error::Result;
+use crate::ld::error::Result;
 use crate::scsi::{DataDirection, ScsiTransport};
 
 const SCSI_MODE_SELECT: u8 = 0x55;
@@ -13,10 +13,51 @@ const FIRMWARE_EXTRA: [u8; 16] = [0; 16];
 /// that drive — real profiles must supply their own (see `DriveProfile`).
 const VENDOR_VERIFY: [u8; 10] = [0xF1, 0x01, 0x02, 0x00, 0x0D, 0x30, 0x01, 0xF3, 0xAD, 0x23];
 
+/// Trace the outcome of a best-effort firmware-upload step and swallow
+/// everything EXCEPT a transport fault. These steps are advisory (the unlock
+/// retries below are the real gate) but their results were previously thrown
+/// away entirely, so a firmware upload could fail end to end and leave nothing
+/// in the log to say so — and a dead bus kept the sequence running.
+fn trace_step(phase: &'static str, r: crate::scsi::Result<crate::scsi::ScsiResult>) -> Result<()> {
+    match r {
+        Ok(res) if res.status == 0 => {
+            tracing::debug!(
+                target: "freemkv::disc",
+                phase,
+                bytes_transferred = res.bytes_transferred,
+                "firmware upload step ok"
+            );
+            Ok(())
+        }
+        Ok(res) => {
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase,
+                status = res.status,
+                "firmware upload step returned a drive sense"
+            );
+            Ok(())
+        }
+        Err(e) => {
+            let err = crate::ld::error::Error::from(e);
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase,
+                transport_failure = err.is_transport_failure(),
+                "firmware upload step failed"
+            );
+            if err.is_transport_failure() {
+                return Err(err);
+            }
+            Ok(())
+        }
+    }
+}
+
 pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Result<()> {
     let firmware = &mt.profile.firmware;
     if firmware.is_empty() {
-        return Err(crate::error::Error::UnlockFailed);
+        return Err(crate::ld::error::Error::UnlockFailed);
     }
 
     // Step 1: Upload the firmware via MODE SELECT. The profile's `firmware` is
@@ -27,7 +68,7 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
     // expressed in the CDB.
     let write_len = firmware.len();
     if write_len > u16::MAX as usize {
-        return Err(crate::error::Error::UnlockFailed);
+        return Err(crate::ld::error::Error::UnlockFailed);
     }
     let mode_select_cdb = [
         SCSI_MODE_SELECT,
@@ -58,12 +99,15 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
         0x00,
     ];
     let mut meta_resp = [0u8; 16];
-    let _ = scsi.execute(
-        &read_meta_cdb,
-        DataDirection::FromDevice,
-        &mut meta_resp,
-        5_000,
-    );
+    trace_step(
+        "mt1959b_fw_meta",
+        scsi.execute(
+            &read_meta_cdb,
+            DataDirection::FromDevice,
+            &mut meta_resp,
+            5_000,
+        ),
+    )?;
 
     // Step 3: Write extra firmware data (all zeros)
     let write_extra_cdb = [
@@ -79,14 +123,24 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
         0x00,
     ];
     let mut data2 = FIRMWARE_EXTRA.to_vec();
-    let _ = scsi.execute(&write_extra_cdb, DataDirection::ToDevice, &mut data2, 5_000);
+    trace_step(
+        "mt1959b_fw_extra",
+        scsi.execute(&write_extra_cdb, DataDirection::ToDevice, &mut data2, 5_000),
+    )?;
 
     // Step 4: Vendor verify (0xF1 — B-only, not standard SCSI). PER-DRIVE: take
     // it from the profile (39 distinct values across the 140 B drives). The
     // const is only a legacy fallback — it carries one drive's token.
+    // The result used to be discarded with `let _ =` despite the comment calling
+    // this a verify step: a corrupt upload proceeded straight to the do_unlock
+    // retries with no diagnostic. There is no documented expected payload, so
+    // the outcome is TRACED; only a dead bus aborts.
     let verify_cdb = mt.profile.fw_verify_cdb.unwrap_or(VENDOR_VERIFY);
     let mut dummy = [0u8; 0];
-    let _ = scsi.execute(&verify_cdb, DataDirection::None, &mut dummy, 5_000);
+    trace_step(
+        "mt1959b_fw_verify",
+        scsi.execute(&verify_cdb, DataDirection::None, &mut dummy, 5_000),
+    )?;
 
     // Step 5: Unlock retries (up to 5, then a final fatal attempt). On a
     // successful unlock we issue one confirmation pass; its result is
@@ -94,9 +148,14 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
     // unlock state, so a hiccup on the redundant confirmation must not fail
     // an otherwise-good unlock.
     for _attempt in 0..5 {
-        if mt.do_unlock(scsi).is_ok() {
-            let _ = mt.do_unlock(scsi);
-            return Ok(());
+        match mt.do_unlock(scsi) {
+            Ok(_) => {
+                let _ = mt.do_unlock(scsi);
+                return Ok(());
+            }
+            // A dead bus will not recover across five more unlock attempts.
+            Err(e) if e.is_transport_failure() => return Err(e),
+            Err(_) => {}
         }
     }
     mt.do_unlock(scsi)?;

src/ld/profile.rs

@@ -1,11 +1,13 @@
 //! Drive profile loading and matching.
 
-use crate::error::{Error, Result};
+use crate::ld::error::{Error, Result};
 use serde::Deserialize;
 
-/// Top-level profiles file — keyed by chipset + variant.
+/// The Mt1959Unlocker profile catalog — the set of optical drives the firmware
+/// unlocker recognizes, keyed by chipset + variant. Loaded from the bundled
+/// JSON; the public entry point is [`crate::ld::profiles`].
 #[derive(Debug, Deserialize)]
-pub struct ProfilesFile {
+pub struct Profiles {
     #[serde(default)]
     pub mt1959_a: Vec<DriveProfile>,
     #[serde(default)]
@@ -14,12 +16,23 @@ pub struct ProfilesFile {
     pub renesas: Vec<DriveProfile>,
 }
 
+impl Profiles {
+    /// The profile matching a drive identity, if this catalog supports that
+    /// drive. Two-pass per platform section: exact (incl. firmware date) then a
+    /// looser vendor/revision/vendor-specific match. See `find_by_drive_id`.
+    pub fn get(&self, drive_id: &crate::DriveId) -> Option<ProfileMatch> {
+        find_by_drive_id(self, drive_id)
+    }
+}
+
 /// Drive identity — matched against INQUIRY data.
 #[derive(Debug, Clone, Deserialize)]
 pub struct Identity {
     #[serde(default)]
     pub vendor_id: String,
     #[serde(default)]
+    pub product_id: String,
+    #[serde(default)]
     pub product_revision: String,
     #[serde(default)]
     pub vendor_specific: String,
@@ -28,7 +41,23 @@ pub struct Identity {
 }
 
 /// Per-drive profile.
-#[derive(Debug, Clone, Deserialize)]
+///
+/// VISIBILITY: only `identity` and `signature` are public — they are what the
+/// catalog is public FOR ("is this drive supported?", and the emulator's
+/// impersonation). Everything below them is unlock MECHANISM: the MediaTek
+/// firmware image and the per-drive vendor CDB templates. `Cargo.toml` says this
+/// crate is never published because it carries drive firmware; re-exporting
+/// `DriveProfile` with a `pub firmware: Vec<u8>` handed that firmware, and every
+/// vendor CDB, to any downstream crate that called `ld::profile()`. They are
+/// `pub(crate)` so the mechanism stays inside the unlocker.
+///
+/// `allow(dead_code)`: this is the on-disk catalog schema, and several captured
+/// CDB templates have no in-crate consumer yet. They were `pub` before, so the
+/// compiler saw the (external) use; making them `pub(crate)` is what exposes
+/// them as unread. Deleting them would silently drop fields from the format the
+/// profile-extraction pipeline emits.
+#[allow(dead_code)]
+#[derive(Clone, Deserialize)]
 pub struct DriveProfile {
     pub identity: Identity,
     /// Expected first 4 bytes of the drive's unlock response — the
@@ -40,7 +69,7 @@ pub struct DriveProfile {
     /// firmware-load step). JSON-encoded as standard base64; empty when
     /// the profile carries no firmware blob.
     #[serde(default, deserialize_with = "deserialize_base64")]
-    pub firmware: Vec<u8>,
+    pub(crate) firmware: Vec<u8>,
 
     // ── OEM-extended-access CDB templates ──────────────────────────────
     //
@@ -49,39 +78,61 @@ pub struct DriveProfile {
     // in the JSON as lowercase hex strings without separators
     // (e.g. `"3c014410e29100002400"` for a 10-byte CDB).
     #[serde(default)]
-    pub unlock_init_value: u8,
+    pub(crate) unlock_init_value: u8,
     #[serde(default)]
-    pub unlock_response_size: u8,
+    pub(crate) unlock_response_size: u8,
 
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read_vid_cdb: Option<[u8; 10]>,
+    pub(crate) read_vid_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read_disc_keys_cdb: Option<[u8; 10]>,
+    pub(crate) read_disc_keys_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_12")]
-    pub drive_nominal_speed_cdb: Option<[u8; 12]>,
+    pub(crate) drive_nominal_speed_cdb: Option<[u8; 12]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_12")]
-    pub set_speed_max_cdb: Option<[u8; 12]>,
+    pub(crate) set_speed_max_cdb: Option<[u8; 12]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read10_raw_2sec_cdb: Option<[u8; 10]>,
+    pub(crate) read10_raw_2sec_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read10_raw_1sec_cdb: Option<[u8; 10]>,
+    pub(crate) read10_raw_1sec_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read_buffer_verify_cdb: Option<[u8; 10]>,
+    pub(crate) read_buffer_verify_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub write_buffer_cdb: Option<[u8; 10]>,
+    pub(crate) write_buffer_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read_buffer_unlock_cdb: Option<[u8; 10]>,
+    pub(crate) read_buffer_unlock_cdb: Option<[u8; 10]>,
     /// Variant-B vendor verify (0xF1) CDB. PER-DRIVE: 39 distinct values across
     /// the 140 B drives, so it CANNOT be a hardcoded constant. `variant_b`'s old
     /// `VENDOR_VERIFY` const was one drive's token, wrong for the other ~139.
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub fw_verify_cdb: Option<[u8; 10]>,
+    pub(crate) fw_verify_cdb: Option<[u8; 10]>,
 
     // Per-drive identifier tables — variable-length hex strings.
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes")]
-    pub speed_zone_table: Option<Vec<u8>>,
+    pub(crate) speed_zone_table: Option<Vec<u8>>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes")]
-    pub speed_calc_table: Option<Vec<u8>>,
+    pub(crate) speed_calc_table: Option<Vec<u8>>,
+}
+
+// Hand-written, REDACTING Debug. `DriveProfile` is `pub` and reachable through
+// the public `Profiles` catalog (`ld::bundled` / `ld::profiles`), whose own
+// derived `Debug` would recurse into this one. `Cargo.toml` says this crate is
+// NEVER published because it carries drive firmware; a derived `Debug` would
+// render that firmware image AND every captured per-drive vendor CDB (the unlock
+// MECHANISM) straight into any log. Show only the PUBLIC identity + signature
+// (what the catalog is public FOR); collapse the firmware to a byte length and
+// omit the vendor CDB templates entirely so no mechanism bytes reach a log.
+impl std::fmt::Debug for DriveProfile {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DriveProfile")
+            .field("identity", &self.identity)
+            .field("signature", &self.signature)
+            .field(
+                "firmware",
+                &format_args!("[{} bytes redacted]", self.firmware.len()),
+            )
+            .field("cdb_templates", &"[redacted]")
+            .finish()
+    }
 }
 
 /// Chipset + variant — determined by which section the profile was found in.
@@ -128,7 +179,7 @@ pub struct ProfileMatch {
 /// translatable English message.
 fn decode_hex(s: &str) -> std::result::Result<Vec<u8>, &'static str> {
     let bytes = s.as_bytes();
-    if bytes.len() % 2 != 0 {
+    if !bytes.len().is_multiple_of(2) {
         return Err("hex");
     }
     let mut out = Vec::with_capacity(bytes.len() / 2);
@@ -233,14 +284,13 @@ where
 
 // ── Loading ────────────────────────────────────────────────────────────
 
-const BUNDLED_PROFILES: &str = include_str!("../profiles.json");
+const BUNDLED_PROFILES: &str = include_str!("profiles.json");
 
-/// Parse the bundled profiles fresh into an owned [`ProfilesFile`].
-///
-/// Re-parses the embedded JSON (~800 KB) on every call; prefer
-/// [`bundled`] for the hot path, which parses once and caches. This
-/// owned form is kept for callers that need a mutable / independent copy.
-pub fn load_bundled() -> Result<ProfilesFile> {
+/// Parse the bundled profiles fresh into an owned [`Profiles`]. Test-only — the
+/// library hot path uses the cached [`bundled`]; tests use this owned form for
+/// independent copies.
+#[cfg(test)]
+pub fn load_bundled() -> Result<Profiles> {
     load_from_str(BUNDLED_PROFILES)
 }
 
@@ -250,11 +300,28 @@ pub fn load_bundled() -> Result<ProfilesFile> {
 /// Returns `None` if the embedded JSON fails to parse (a build-time bug —
 /// the bundled blob is fixed at compile time, so the first successful call
 /// guarantees all later calls succeed too).
-pub fn bundled() -> Option<&'static ProfilesFile> {
+pub fn bundled() -> Option<&'static Profiles> {
     use std::sync::OnceLock;
-    static CACHE: OnceLock<Option<ProfilesFile>> = OnceLock::new();
+    static CACHE: OnceLock<Option<Profiles>> = OnceLock::new();
     CACHE
-        .get_or_init(|| load_from_str(BUNDLED_PROFILES).ok())
+        .get_or_init(|| match load_from_str(BUNDLED_PROFILES) {
+            Ok(p) => Some(p),
+            // The `None` is cached PERMANENTLY (correctly — the blob is fixed at
+            // compile time), which means a bad shipped profiles.json makes
+            // Mt1959Unlocker report "drive not supported" for every drive for the
+            // life of the process. Unlogged, that is indistinguishable from a
+            // genuinely uncataloged drive; log it once, loudly, at the one place
+            // the parse happens.
+            Err(e) => {
+                tracing::error!(
+                    target: "freemkv::disc",
+                    phase = "bundled_profiles_parse_failed",
+                    error_code = e.code(),
+                    "bundled Mt1959Unlocker profile catalog failed to parse; no drive can match"
+                );
+                None
+            }
+        })
         .as_ref()
 }
 
@@ -263,28 +330,26 @@ pub fn bundled() -> Option<&'static ProfilesFile> {
 /// Convenience wrapper over [`bundled`] + [`find_by_drive_id`] that skips
 /// the per-call re-parse. Returns `None` if no profile matches (or, in the
 /// build-bug case, if the bundled JSON failed to parse).
-pub fn find_bundled(drive_id: &libfreemkv::DriveId) -> Option<ProfileMatch> {
+pub fn find_bundled(drive_id: &crate::DriveId) -> Option<ProfileMatch> {
     find_by_drive_id(bundled()?, drive_id)
 }
 
-fn load_from_str(data: &str) -> Result<ProfilesFile> {
+fn load_from_str(data: &str) -> Result<Profiles> {
     serde_json::from_str(data).map_err(|_| Error::ProfileParse)
 }
 
 /// Find a profile matching a drive's INQUIRY fields.
 ///
-/// Two-pass per platform section (MT1959-A, then MT1959-B, then Renesas):
-/// first an exact match including `firmware_date`, then — if none — a
-/// looser match on vendor / revision / vendor-specific only. The exact
-/// pass wins so a drive with a known firmware date binds to its precise
-/// profile; the looser pass lets a drive whose firmware date we don't have
-/// on file still match a same-model profile. All comparisons are
-/// whitespace-trimmed. Returns the first section that yields a match.
-pub fn find_by_drive_id(
-    profiles: &ProfilesFile,
-    drive_id: &libfreemkv::DriveId,
-) -> Option<ProfileMatch> {
+/// Per platform section (MT1959-A, then MT1959-B, then Renesas), tried in
+/// order of decreasing specificity: full match including `product_id` and
+/// `firmware_date` (skipped when the drive reports no product), then the same
+/// without `product_id`. Both require `firmware_date`; every profile carries a
+/// unique identity under these fields, so a match is exact — no looser
+/// vendor/revision fallback that could pick the wrong same-model variant. All
+/// comparisons are whitespace-trimmed. Returns the first section that matches.
+pub fn find_by_drive_id(profiles: &Profiles, drive_id: &crate::DriveId) -> Option<ProfileMatch> {
     let v = drive_id.vendor_id.trim();
+    let prod = drive_id.product_id.trim();
     let r = drive_id.product_revision.trim();
     let vs = drive_id.vendor_specific.trim();
     let date = drive_id.firmware_date.trim();
@@ -294,12 +359,15 @@ pub fn find_by_drive_id(
         (Platform::Mt1959B, &profiles.mt1959_b),
         (Platform::Renesas, &profiles.renesas),
     ] {
-        if let Some(p) = list.iter().find(|p| {
-            p.identity.vendor_id.trim() == v
-                && p.identity.product_revision.trim() == r
-                && p.identity.vendor_specific.trim() == vs
-                && p.identity.firmware_date.trim() == date
-        }) {
+        if !prod.is_empty()
+            && let Some(p) = list.iter().find(|p| {
+                p.identity.vendor_id.trim() == v
+                    && p.identity.product_id.trim() == prod
+                    && p.identity.product_revision.trim() == r
+                    && p.identity.vendor_specific.trim() == vs
+                    && p.identity.firmware_date.trim() == date
+            })
+        {
             return Some(ProfileMatch {
                 profile: p.clone(),
                 platform,
@@ -310,6 +378,7 @@ pub fn find_by_drive_id(
             p.identity.vendor_id.trim() == v
                 && p.identity.product_revision.trim() == r
                 && p.identity.vendor_specific.trim() == vs
+                && p.identity.firmware_date.trim() == date
         }) {
             return Some(ProfileMatch {
                 profile: p.clone(),
@@ -324,15 +393,54 @@ pub fn find_by_drive_id(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use libfreemkv::DriveId;
+    use crate::DriveId;
 
     fn make_drive_id(vendor: &str, rev: &str, vs: &str, date: &str) -> DriveId {
-        let mut inquiry = vec![0u8; 96];
-        inquiry[8..8 + vendor.len().min(8)]
-            .copy_from_slice(&vendor.as_bytes()[..vendor.len().min(8)]);
-        inquiry[32..32 + rev.len().min(4)].copy_from_slice(&rev.as_bytes()[..rev.len().min(4)]);
-        inquiry[36..36 + vs.len().min(7)].copy_from_slice(&vs.as_bytes()[..vs.len().min(7)]);
-        DriveId::from_inquiry(&inquiry, date)
+        DriveId {
+            vendor_id: vendor.to_string(),
+            product_id: String::new(),
+            product_revision: rev.to_string(),
+            vendor_specific: vs.to_string(),
+            firmware_date: date.to_string(),
+        }
+    }
+
+    /// When two profiles share vendor/rev/vs/date and differ only in product_id,
+    /// the full pass binds to the one whose product matches; the looser passes
+    /// would return the first regardless.
+    #[test]
+    fn find_by_drive_id_product_id_breaks_a_tie() {
+        use serde_json::json;
+        let profiles: Profiles = serde_json::from_str(
+            &json!({
+                "mt1959_a": [
+                    {"identity": {"vendor_id":"TIE","product_id":"MODEL-A",
+                        "product_revision":"1.00","vendor_specific":"XX00000",
+                        "firmware_date":"200001010000"},
+                        "signature":"aaaaaaaa","firmware":""},
+                    {"identity": {"vendor_id":"TIE","product_id":"MODEL-B",
+                        "product_revision":"1.00","vendor_specific":"XX00000",
+                        "firmware_date":"200001010000"},
+                        "signature":"bbbbbbbb","firmware":""}
+                ]
+            })
+            .to_string(),
+        )
+        .unwrap();
+
+        let mut id = make_drive_id("TIE", "1.00", "XX00000", "200001010000");
+        id.product_id = "MODEL-B".to_string();
+        let m = find_by_drive_id(&profiles, &id).unwrap();
+        assert_eq!(
+            m.profile.signature,
+            [0xbb, 0xbb, 0xbb, 0xbb],
+            "product_id must select MODEL-B over the first entry"
+        );
+
+        // No product_id → falls back to the 4-field pass → first entry.
+        let id0 = make_drive_id("TIE", "1.00", "XX00000", "200001010000");
+        let m0 = find_by_drive_id(&profiles, &id0).unwrap();
+        assert_eq!(m0.profile.signature, [0xaa, 0xaa, 0xaa, 0xaa]);
     }
 
     #[test]
@@ -374,11 +482,11 @@ mod tests {
     fn bundled_is_cached_and_matches_fresh_parse() {
         let cached = bundled().expect("bundled profiles parse");
         let fresh = load_bundled().unwrap();
-        // Same data either way (compare section sizes — ProfilesFile isn't Eq).
+        // Same data either way (compare section sizes — Profiles isn't Eq).
         assert_eq!(cached.mt1959_a.len(), fresh.mt1959_a.len());
         // Cached accessor returns a stable address across calls.
-        let a = bundled().unwrap() as *const ProfilesFile;
-        let b = bundled().unwrap() as *const ProfilesFile;
+        let a = bundled().unwrap() as *const Profiles;
+        let b = bundled().unwrap() as *const Profiles;
         assert_eq!(a, b);
     }
 
@@ -449,7 +557,7 @@ mod tests {
 
     /// find_by_drive_id: exact match (including firmware_date) wins over loose match.
     /// Spec: two-pass — first an exact match including firmware_date, then looser.
-    /// Build two synthetic ProfilesFile entries that differ only by firmware_date,
+    /// Build two synthetic Profiles entries that differ only by firmware_date,
     /// and verify the correct one is selected.
     /// Mutation: doing only the loose pass would return the first entry regardless of date.
     #[test]
@@ -483,7 +591,7 @@ mod tests {
             ]
         })
         .to_string();
-        let profiles: ProfilesFile = serde_json::from_str(&profiles_json).unwrap();
+        let profiles: Profiles = serde_json::from_str(&profiles_json).unwrap();
 
         // "TESTDRV " (with space) fills 8 bytes; trim() → "TESTDRV" on both sides.
         let id_date1 = make_drive_id("TESTDRV ", "1.00", "XX00000", "200001010000");
@@ -505,14 +613,12 @@ mod tests {
         );
     }
 
-    /// find_by_drive_id: loose match (no date) still works when an entry has
-    /// the same vendor/revision/vs but an unknown firmware_date.
-    /// Mutation: making the loose pass require a date match means "no date" drives
-    ///           always return None even though a same-model profile exists.
+    /// find_by_drive_id: a drive whose firmware_date does NOT match any profile
+    /// gets no match — there is no loose vendor/rev/vs fallback that could bind
+    /// the wrong same-model variant.
     #[test]
-    fn find_by_drive_id_loose_match_when_date_unknown() {
+    fn find_by_drive_id_no_match_when_date_differs() {
         use serde_json::json;
-        // "LOOSEDR " fills 8 bytes; trim() → "LOOSEDR".
         let profiles_json = json!({
             "mt1959_a": [
                 {
@@ -528,25 +634,19 @@ mod tests {
             ]
         })
         .to_string();
-        let profiles: ProfilesFile = serde_json::from_str(&profiles_json).unwrap();
+        let profiles: Profiles = serde_json::from_str(&profiles_json).unwrap();
 
-        // Drive with an unknown firmware date — no exact match, loose match should work.
-        // "LOOSEDR " fills 8 bytes; "000000000000" is the unknown date.
+        // Same vendor/rev/vs but a different date — must NOT match.
         let id = make_drive_id("LOOSEDR ", "2.00", "YY11111", "000000000000");
-        let m = find_by_drive_id(&profiles, &id).unwrap();
-        assert_eq!(
-            m.profile.signature,
-            [0xde, 0xad, 0xbe, 0xef],
-            "loose match must bind the same-model profile when date differs"
-        );
+        assert!(find_by_drive_id(&profiles, &id).is_none());
     }
 
     /// load_from_str (via load_bundled) returns ProfileParse on invalid JSON.
-    /// Mutation: returning an empty ProfilesFile instead of an error silently
+    /// Mutation: returning an empty Profiles instead of an error silently
     ///           leaves the drive-profile database empty.
     #[test]
     fn load_from_str_returns_profile_parse_on_bad_json() {
-        let result: Result<ProfilesFile> =
+        let result: Result<Profiles> =
             serde_json::from_str("not valid json {{{{").map_err(|_| Error::ProfileParse);
         assert!(matches!(result, Err(Error::ProfileParse)));
     }
@@ -586,7 +686,7 @@ mod tests {
             ]
         })
         .to_string();
-        let profiles: ProfilesFile = serde_json::from_str(&json_str).unwrap();
+        let profiles: Profiles = serde_json::from_str(&json_str).unwrap();
         let p = &profiles.mt1959_a[0]; // DriveProfile directly
         // All optional CDB fields must be None when absent from JSON.
         assert!(
@@ -615,6 +715,40 @@ mod tests {
         );
     }
 
+    /// `DriveProfile`'s `Debug` must NOT render the firmware image or the
+    /// per-drive vendor CDB templates — this crate is unpublished precisely
+    /// because it carries drive firmware, and the profile is reachable through
+    /// the public `Profiles` catalog.
+    /// MUTATION: restoring `#[derive(Debug)]` prints the raw firmware bytes
+    /// (e.g. the 0xEE marker below) and the CDB bytes, so this goes red.
+    #[test]
+    fn drive_profile_debug_redacts_firmware_and_cdbs() {
+        use serde_json::json;
+        let profiles: Profiles = serde_json::from_str(
+            &json!({
+                "mt1959_a": [{
+                    "identity": {"vendor_id":"VIS","product_revision":"1.00",
+                        "vendor_specific":"AA00000","firmware_date":"200001010000"},
+                    "signature":"aabbccdd",
+                    "firmware":"7u7u7u7u", // base64 → six 0xEE bytes
+                    "read_vid_cdb":"3c014410e29100002400"
+                }]
+            })
+            .to_string(),
+        )
+        .unwrap();
+        let s = format!("{:?}", profiles.mt1959_a[0]);
+        // Firmware byte 0xEE renders as `238` under a derived Debug.
+        assert!(!s.contains("238"), "firmware bytes must not appear: {s}");
+        assert!(
+            !s.contains("read_vid_cdb"),
+            "CDB templates must not appear: {s}"
+        );
+        assert!(s.contains("redacted"), "must mark redaction: {s}");
+        // The PUBLIC fields stay visible.
+        assert!(s.contains("VIS"), "identity must remain visible: {s}");
+    }
+
     /// deserialize_hex4 of an empty string must produce [0;4] without error.
     /// This matches `deserialize_hex4`'s explicit early-return for empty strings.
     /// Mutation: treating empty string as an error prevents profiles where signature
@@ -637,7 +771,7 @@ mod tests {
             ]
         })
         .to_string();
-        let profiles: ProfilesFile = serde_json::from_str(&json_str).unwrap();
+        let profiles: Profiles = serde_json::from_str(&json_str).unwrap();
         assert_eq!(
             profiles.mt1959_a[0].signature, [0u8; 4],
             "empty signature must deserialise as [0;4]"

src/lib.rs

@@ -0,0 +1,276 @@
+//! freemkv-unlock — the unlock layer for the freemkv toolchain.
+//!
+//! An **unlocker removes a drive-level bus-encryption barrier** so the drive
+//! serves readable (de-bus'd / de-scrambled) sectors. Content-key decryption is
+//! a separate layer — the consumer's (libfreemkv's) job.
+//!
+//! This crate defines the [`Unlocker`] contract + the SCSI transport contract,
+//! and holds the self-contained unlocker modules (firmware / AACS cert / CSS).
+//! libfreemkv depends on this crate and dispatches via [`all_unlockers`]; it
+//! never names an individual unlocker. To remove an unlocker, delete its module
+//! dir and its one line in [`all_unlockers`] — nothing else changes.
+
+pub mod scsi;
+
+mod aacs;
+mod css;
+// `ld` is public ONLY for its drive-profile catalog (`ld::profiles` / the
+// `Profiles` object) and, under the `emulation` feature, the unlock-handshake
+// wire format the bdemu test-emulator needs. The unlocker impl itself
+// (`Mt1959Unlocker`) is `pub(crate)` — clients still reach unlockers only through
+// [`all_unlockers`]. `aacs` and `css` carry no such public catalog, so they
+// stay fully private.
+pub mod ld;
+// `renesis` is public for its `is_renesas` drive-probe (which reports a dead
+// bus as `Err(UnlockError::Transport)` rather than "not a Renesas drive"); the unlocker impl
+// (`Renesis`) is `pub(crate)` — reached only through [`all_unlockers`].
+pub mod renesis;
+
+use scsi::ScsiTransport;
+
+/// Drive identity an unlocker matches against — four raw INQUIRY-derived fields,
+/// filled by the consumer (this crate parses no INQUIRY itself).
+#[derive(Debug, Clone, Default)]
+pub struct DriveId {
+    pub vendor_id: String,
+    pub product_id: String,
+    pub product_revision: String,
+    pub vendor_specific: String,
+    pub firmware_date: String,
+}
+
+/// Bus-encryption class of the mounted disc, probed by the consumer.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DiscKind {
+    Unknown,
+    Unencrypted,
+    Aacs,
+    Css,
+}
+
+/// A host certificate for the AACS cert handshake (raw; the consumer collects
+/// these from its key sources and passes them in).
+#[derive(Debug, Clone)]
+pub struct HostCert {
+    /// AACS 1.0 host private key (20 bytes).
+    pub private_key: [u8; 20],
+    /// AACS 1.0 host certificate (92 bytes).
+    pub certificate: Vec<u8>,
+    /// AACS 2.0 host private key (P-256, 32 bytes). `None` for AACS 1.0 only.
+    pub private_key_v2: Option<[u8; 32]>,
+    /// AACS 2.0 host certificate (type 0x11). `None` for AACS 1.0 only.
+    pub certificate_v2: Option<Vec<u8>>,
+}
+
+/// Context handed to an unlocker: drive identity, disc kind, and (for the cert
+/// route) the host certs the consumer collected.
+pub struct UnlockCtx<'a> {
+    pub drive_id: &'a DriveId,
+    pub kind: DiscKind,
+    pub host_certs: &'a [HostCert],
+}
+
+impl<'a> UnlockCtx<'a> {
+    pub fn new(drive_id: &'a DriveId, kind: DiscKind, host_certs: &'a [HostCert]) -> Self {
+        Self {
+            drive_id,
+            kind,
+            host_certs,
+        }
+    }
+}
+
+/// What removing bus encryption yielded. `drive_unlocked` means the drive now
+/// serves clear content (firmware route) — equivalent, for the gate, to a cert
+/// `bus_key`.
+#[derive(Clone, Default)]
+pub struct Unlocked {
+    pub vid: Option<[u8; 16]>,
+    pub bus_key: Option<[u8; 16]>,
+    pub drive_unlocked: bool,
+}
+
+// Hand-written, REDACTING Debug — `Unlocked` is the public carrier that leaves
+// this crate, and both `bus_key` (the AACS bus key) and `vid` (the Volume ID
+// that feeds VUK derivation) are key material that must never reach a log or a
+// test-failure message in plaintext. The `AacsAuth` / `CertHandshake` siblings
+// already redact; a derived `Debug` here would print the very bytes they hide.
+// Presence is still observable (Some/None) so a log can say WHETHER a key was
+// obtained without revealing WHAT it is.
+impl std::fmt::Debug for Unlocked {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Unlocked")
+            .field("vid", &self.vid.map(|_| "[redacted]"))
+            .field("bus_key", &self.bus_key.map(|_| "[redacted]"))
+            .field("drive_unlocked", &self.drive_unlocked)
+            .finish()
+    }
+}
+
+/// Why an unlock produced no usable result. Only `Transport` is a hard error
+/// (bus dead → consumer aborts); the rest mean "fall through to the next
+/// unlocker".
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum UnlockError {
+    /// This unlocker does not apply (wrong disc kind / no profile / no certs).
+    NotApplicable,
+    /// The AACS cert route had no usable host certificate.
+    NoUsableHostCert,
+    /// The drive rejected the auth handshake.
+    HandshakeRejected,
+    /// Auth succeeded but no Volume ID could be read.
+    VidUnavailable,
+    /// A genuine SCSI transport fault (bus dead). The consumer aborts.
+    Transport,
+}
+
+/// An unlocker removes a drive-level bus-encryption barrier. Implementors are
+/// the self-contained modules in this crate; the consumer only ever sees the
+/// trait, via [`all_unlockers`]. (Each module owns its own conversion from its
+/// internal error to [`UnlockError`].)
+///
+/// NOTE: drive tuning (e.g. SET CD SPEED to lift riplock) is deliberately NOT
+/// here — that is the consumer's concern, not bus removal.
+pub trait Unlocker: Send + Sync {
+    /// Short, stable identifier for this unlocker (e.g. "MT1959", "AACS",
+    /// "DVD", "Renesas"). The ONE place a name lives — apps render the unlocker
+    /// report from [`all_unlockers`], never hardcoding names, so adding/removing
+    /// an unlocker updates every report with no app change.
+    fn name(&self) -> &'static str;
+
+    /// Unlock DRIVE FEATURES — riplock/speed, OEM Volume ID, OEM extended-access
+    /// reads. The consumer runs this at drive-prep, trying each unlocker until
+    /// one handles the drive. `Ok(_)` = this unlocker handled it (Mt1959Unlocker also
+    /// removes bus encryption at the drive, so its result carries
+    /// `drive_unlocked: true`); `Err(NotApplicable)` = not this unlocker's drive;
+    /// `Err(Transport)` = dead bus (the consumer aborts). Default: not provided.
+    fn unlock_features(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        let _ = (scsi, ctx);
+        Err(UnlockError::NotApplicable)
+    }
+
+    /// Remove BUS ENCRYPTION for the mounted disc (AACS host-cert handshake, or
+    /// CSS scrambled-sector auth). The consumer runs this only when the bus isn't
+    /// already clear, trying each unlocker until one handles it. Same `Ok` /
+    /// `Err(NotApplicable)` / `Err(Transport)` contract as
+    /// [`Unlocker::unlock_features`].
+    /// Default: not provided.
+    fn unlock_bus(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        let _ = (scsi, ctx);
+        Err(UnlockError::NotApplicable)
+    }
+}
+
+/// Name of the unlocker that claims this drive by identity (for drive-info "is
+/// this drive supported?" display), or `None`. A pure lookup — does NOT touch
+/// the drive or unlock anything. Only the identity-keyed (drive-prep) unlocker
+/// can answer from a `DriveId` alone; the disc-kind-keyed unlockers (AACS / CSS)
+/// don't claim a drive sight-unseen, so they never match here.
+pub fn unlocker_name(drive_id: &DriveId) -> Option<&'static str> {
+    ld::firmware_name(drive_id)
+}
+
+/// Every unlocker, in dispatch order (firmware → cert → css). This is the ONLY
+/// place an unlocker is named. Remove one = delete its line here + its module
+/// dir; the consumer never changes.
+pub fn all_unlockers() -> Vec<Box<dyn Unlocker>> {
+    vec![
+        Box::new(ld::Mt1959Unlocker::new()),
+        Box::new(renesis::Renesis::new()),
+        Box::new(aacs::AacsCert::new()),
+        Box::new(css::DvdUnlocker::new()),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The dispatch order is a documented contract (`firmware → cert → css`) and
+    /// had NO test: `all_unlockers` is the one place an unlocker is named, and
+    /// the consumer stops at the first that doesn't decline, so reordering this
+    /// list silently changes which unlocker claims a drive. Catches a reorder,
+    /// a rename, and an accidental addition/removal.
+    #[test]
+    fn all_unlockers_dispatch_order_is_firmware_then_cert_then_css() {
+        let names: Vec<&'static str> = all_unlockers().iter().map(|u| u.name()).collect();
+        assert_eq!(names, vec!["MT1959", "Renesas", "AACS", "DVD"]);
+    }
+
+    /// Every unlocker declines by default rather than claiming a capability it
+    /// does not provide — and declines WITHOUT touching the transport, so the
+    /// consumer can iterate the whole registry on any drive.
+    #[test]
+    fn unlockers_decline_capabilities_they_do_not_provide() {
+        struct DeadTransport;
+        impl scsi::ScsiTransport for DeadTransport {
+            fn execute(
+                &mut self,
+                _cdb: &[u8],
+                _dir: scsi::DataDirection,
+                _data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> scsi::Result<scsi::ScsiResult> {
+                panic!("a declining unlocker must not issue a CDB");
+            }
+        }
+        let id = DriveId::default(); // matches no bundled profile
+        let ctx = UnlockCtx::new(&id, DiscKind::Unencrypted, &[]);
+        let mut t = DeadTransport;
+        for u in all_unlockers() {
+            // AACS/DVD provide no drive features; Mt1959Unlocker/Renesas are the
+            // feature unlockers but decline an unknown drive identity.
+            let name = u.name();
+            if name == "AACS" || name == "DVD" {
+                assert_eq!(
+                    u.unlock_features(&mut t, &ctx).unwrap_err(),
+                    UnlockError::NotApplicable,
+                    "{name} must not claim drive features"
+                );
+            }
+            if name == "Renesas" {
+                assert_eq!(
+                    u.unlock_bus(&mut t, &ctx).unwrap_err(),
+                    UnlockError::NotApplicable,
+                    "{name} leaves bus removal to the cert unlocker"
+                );
+            }
+        }
+    }
+
+    /// `unlocker_name` is a PURE lookup — it must answer from the `DriveId`
+    /// alone, and only the identity-keyed unlocker can claim a drive this way.
+    #[test]
+    fn unlocker_name_is_a_pure_identity_lookup() {
+        assert_eq!(unlocker_name(&DriveId::default()), None);
+    }
+
+    /// `Unlocked` is the public carrier that leaves the crate, and its `bus_key`
+    /// and `vid` are key material. Its `Debug` must NOT print those bytes.
+    /// MUTATION: restoring `#[derive(Debug)]` prints the raw byte arrays, so the
+    /// distinctive marker bytes appear in the output and this goes red.
+    #[test]
+    fn unlocked_debug_redacts_key_material() {
+        let u = Unlocked {
+            vid: Some([0xAB; 16]),
+            bus_key: Some([0xCD; 16]),
+            drive_unlocked: true,
+        };
+        let s = format!("{u:?}");
+        // A derived Debug renders `[171, 171, ...]` (0xAB) / `[205, ...]` (0xCD).
+        assert!(!s.contains("171"), "vid bytes must not appear: {s}");
+        assert!(!s.contains("205"), "bus_key bytes must not appear: {s}");
+        assert!(s.contains("[redacted]"), "must mark redaction: {s}");
+        // Presence (Some/None) stays observable.
+        assert!(s.contains("Some"), "must still show a key WAS present: {s}");
+        assert!(s.contains("drive_unlocked: true"));
+    }
+}

src/renesis.rs

@@ -0,0 +1,265 @@
+//! renesis — Renesas-platform detection (Pioneer + HL-DT-ST Renesas drives).
+//!
+//! Optical drives split into two controller families: MediaTek (handled by
+//! [`crate::ld`]) and Renesas. This module identifies the Renesas side via a
+//! single vendor identity probe (see [`is_renesas`]) and reports the match so a
+//! Renesas drive is named honestly. It does not modify drive state; AACS bus
+//! decryption is handled by the host cert.
+
+use crate::scsi::{DataDirection, ScsiTransport};
+use crate::{UnlockCtx, UnlockError, Unlocked, Unlocker};
+
+/// READ_BUFFER mode 0x02, buffer 0xF1 — the Renesas vendor identity buffer.
+const RB_F1_CDB: [u8; 10] = [0x3C, 0x02, 0xF1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00];
+const RB_F1_LEN: usize = 48;
+/// The ASCII interface marker a Renesas controller returns at `[16..19]`.
+const RENESAS_MARKER: &[u8] = b"SAT";
+const RENESAS_MARKER_OFFSET: usize = 16;
+
+/// `Ok(true)` if `scsi` is a Renesas-platform drive (Pioneer or HL-DT-ST
+/// Renesas).
+///
+/// Issues the vendor READ_BUFFER 0x02/0xF1 probe: a Renesas controller serves a
+/// 48-byte identity block whose bytes `[16..19]` are the ASCII `SAT` interface
+/// tag. A MediaTek drive rejects it — as a CHECK CONDITION (`Ok` with a
+/// non-zero status) or, through a non-conforming transport, as an `Err`
+/// carrying a sense — which is `Ok(false)`: not a Renesas drive. This is the
+/// definitive Renesas-vs-MediaTek split.
+///
+/// A TRANSPORT fault is `Err(Transport)`. It used to be folded into the same
+/// `false` as a drive rejection, and because this probe is the first SCSI
+/// command the unlocker issues, a dead bus read as "not a Renesas drive" — the
+/// consumer then walked the remaining unlockers against a bus that was gone.
+pub fn is_renesas(scsi: &mut dyn ScsiTransport) -> std::result::Result<bool, UnlockError> {
+    let mut buf = [0u8; RB_F1_LEN];
+    match scsi.execute(&RB_F1_CDB, DataDirection::FromDevice, &mut buf, 5_000) {
+        Ok(r) => {
+            let end = RENESAS_MARKER_OFFSET + RENESAS_MARKER.len();
+            Ok(r.status == 0
+                && r.bytes_transferred >= end
+                && &buf[RENESAS_MARKER_OFFSET..end] == RENESAS_MARKER)
+        }
+        // Only a senseless transport-failure status is a dead bus; anything
+        // else the transport reports as `Err` is the drive refusing.
+        Err(e) => {
+            if e.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE && e.sense.is_none() {
+                tracing::warn!(
+                    target: "freemkv::disc",
+                    phase = "renesas_probe_transport_fault",
+                    "transport fault on the Renesas identity probe; aborting"
+                );
+                return Err(UnlockError::Transport);
+            }
+            tracing::debug!(
+                target: "freemkv::disc",
+                phase = "renesas_probe_rejected",
+                status = e.status,
+                "Renesas identity probe rejected by the drive; not a Renesas platform"
+            );
+            Ok(false)
+        }
+    }
+}
+
+/// The Renesas-platform unlocker. `pub(crate)` — reached only through
+/// [`crate::all_unlockers`].
+pub(crate) struct Renesis;
+
+impl Renesis {
+    pub(crate) fn new() -> Self {
+        Renesis
+    }
+}
+
+impl Unlocker for Renesis {
+    fn name(&self) -> &'static str {
+        "Renesas"
+    }
+
+    /// Report whether the drive is a Renesas platform. On a match, returns `Ok`
+    /// with `drive_unlocked: false` — the drive is recognized but its state is
+    /// not modified here (AACS bus decryption is handled by the host cert). A
+    /// non-Renesas drive → `NotApplicable`.
+    fn unlock_features(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        _ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        if !is_renesas(scsi)? {
+            return Err(UnlockError::NotApplicable);
+        }
+        tracing::debug!(
+            target: "freemkv::disc",
+            phase = "renesas_recognized",
+            "Renesas drive recognized; bus handled by cert"
+        );
+        Ok(Unlocked {
+            vid: None,
+            bus_key: None,
+            drive_unlocked: false,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::DiscKind;
+    use crate::scsi::{DataDirection, Result, ScsiError, ScsiResult, ScsiTransport};
+
+    /// Serves a fixed READ_BUFFER payload (Renesas-like) with a Good status.
+    struct RenesasTransport {
+        payload: Vec<u8>,
+    }
+    impl ScsiTransport for RenesasTransport {
+        fn execute(
+            &mut self,
+            _cdb: &[u8],
+            _dir: DataDirection,
+            data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> Result<ScsiResult> {
+            let n = self.payload.len().min(data.len());
+            data[..n].copy_from_slice(&self.payload[..n]);
+            Ok(ScsiResult {
+                status: 0,
+                bytes_transferred: n,
+                sense: [0u8; 32],
+            })
+        }
+    }
+
+    /// Rejects the command the way a MediaTek drive does: ILLEGAL REQUEST. The
+    /// sense is what distinguishes this from a dead bus — the old fixture sent
+    /// `sense: None`, which is the wire shape of a TRANSPORT fault, and the test
+    /// built on it asserted `NotApplicable`, pinning exactly the
+    /// misclassification this file had.
+    struct RejectingTransport;
+    impl ScsiTransport for RejectingTransport {
+        fn execute(
+            &mut self,
+            _cdb: &[u8],
+            _dir: DataDirection,
+            _data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> Result<ScsiResult> {
+            let mut sense = [0u8; 32];
+            sense[2] = 0x05; // ILLEGAL REQUEST
+            sense[12] = 0x20; // invalid command operation code
+            Err(ScsiError {
+                status: crate::scsi::SCSI_STATUS_CHECK_CONDITION,
+                sense: Some(sense),
+            })
+        }
+    }
+
+    fn renesas_payload() -> Vec<u8> {
+        // 48-byte RB 0xF1 block with "SAT" at [16..19] (the real S13JX shape).
+        let mut p = vec![0x20u8; 48];
+        p[16..19].copy_from_slice(b"SAT");
+        p
+    }
+
+    #[test]
+    fn is_renesas_true_on_sat_marker() {
+        let mut t = RenesasTransport {
+            payload: renesas_payload(),
+        };
+        assert!(is_renesas(&mut t).expect("no transport fault"));
+    }
+
+    #[test]
+    fn is_renesas_false_when_command_rejected() {
+        let mut t = RejectingTransport;
+        assert!(!is_renesas(&mut t).expect("a drive rejection is not a bus fault"));
+    }
+
+    #[test]
+    fn is_renesas_false_on_missing_marker() {
+        // Good status but no "SAT" at [16..19] (e.g. a stray buffer).
+        let mut t = RenesasTransport {
+            payload: vec![0u8; 48],
+        };
+        assert!(!is_renesas(&mut t).expect("no transport fault"));
+    }
+
+    #[test]
+    fn is_renesas_false_on_short_response() {
+        // Fewer than 19 bytes returned — can't carry the marker.
+        let mut t = RenesasTransport {
+            payload: vec![0x20u8; 8],
+        };
+        assert!(!is_renesas(&mut t).expect("no transport fault"));
+    }
+
+    #[test]
+    fn features_report_match_without_bus_removal_on_renesas() {
+        let mut t = RenesasTransport {
+            payload: renesas_payload(),
+        };
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Unknown, &[]);
+        // Recognized → Ok, but a feature-only unlock: bus NOT removed, no VID.
+        let u = Renesis::new()
+            .unlock_features(&mut t, &ctx)
+            .expect("renesas → Ok");
+        assert!(
+            !u.drive_unlocked,
+            "renesis does not remove the bus (cert does)"
+        );
+        assert_eq!(u.vid, None);
+        assert_eq!(u.bus_key, None);
+    }
+
+    /// A drive REJECTION (ILLEGAL REQUEST, with a sense) is "not a Renesas
+    /// drive" → fall through to the next unlocker.
+    #[test]
+    fn features_not_applicable_on_non_renesas() {
+        let mut t = RejectingTransport;
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Unknown, &[]);
+        let err = Renesis::new().unlock_features(&mut t, &ctx).unwrap_err();
+        assert_eq!(err, UnlockError::NotApplicable);
+    }
+
+    /// The same rejection delivered the way a CONFORMING transport delivers it —
+    /// `Ok` with a CHECK CONDITION status — must reach the same answer. Catches
+    /// dropping the `r.status == 0` check, which would read the probe buffer's
+    /// zero fill as an identity block.
+    #[test]
+    fn check_condition_is_not_a_renesas_drive() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::illegal_request());
+        assert!(!is_renesas(&mut t).expect("a drive sense is not a bus fault"));
+    }
+
+    /// THE defect-8 test: a dead bus on the FIRST command the unlocker issues
+    /// must abort the consumer, not be reported as "not a Renesas drive".
+    /// Catches restoring the `Err(_) => false` arm.
+    #[test]
+    fn transport_fault_aborts_instead_of_declining() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::TransportFault);
+        assert_eq!(is_renesas(&mut t).unwrap_err(), UnlockError::Transport);
+
+        let mut t = MockTransport::always(Reply::TransportFault);
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Unknown, &[]);
+        assert_eq!(
+            Renesis::new().unlock_features(&mut t, &ctx).unwrap_err(),
+            UnlockError::Transport
+        );
+    }
+
+    #[test]
+    fn does_not_provide_bus_removal() {
+        // Renesas leaves bus encryption to the cert: unlock_bus is the default.
+        let mut t = RenesasTransport {
+            payload: renesas_payload(),
+        };
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Aacs, &[]);
+        let err = Renesis::new().unlock_bus(&mut t, &ctx).unwrap_err();
+        assert_eq!(err, UnlockError::NotApplicable);
+    }
+}

src/scsi.rs

@@ -0,0 +1,367 @@
+//! The SCSI transport contract every unlocker issues CDBs through. The consumer
+//! (libfreemkv) implements [`ScsiTransport`] over its own SCSI; the unlockers
+//! never see a concrete transport. Common MMC/SPC opcodes live here too.
+
+/// Direction of a SCSI data transfer.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DataDirection {
+    None,
+    FromDevice,
+    ToDevice,
+}
+
+/// Result of a SCSI command: status byte, bytes transferred, raw sense.
+#[derive(Debug, Clone)]
+pub struct ScsiResult {
+    pub status: u8,
+    pub bytes_transferred: usize,
+    pub sense: [u8; 32],
+}
+
+/// A transport-layer SCSI failure (the command could not complete — bridge
+/// crash / disconnect), as opposed to a drive sense returned in [`ScsiResult`].
+#[derive(Debug, Clone)]
+pub struct ScsiError {
+    pub status: u8,
+    pub sense: Option<[u8; 32]>,
+}
+
+/// Transport-layer result.
+pub type Result<T> = std::result::Result<T, ScsiError>;
+
+/// The one capability an unlocker needs from the host: run a raw CDB. `Ok` even
+/// on a SCSI sense (inspect `status`); `Err` only on a transport-layer fault.
+pub trait ScsiTransport {
+    fn execute(
+        &mut self,
+        cdb: &[u8],
+        direction: DataDirection,
+        data: &mut [u8],
+        timeout_ms: u32,
+    ) -> Result<ScsiResult>;
+}
+
+/// Parsed SCSI sense (the diagnostic an unlocker reads off a failed command).
+#[derive(Debug, Clone, Copy)]
+pub struct ScsiSense {
+    pub sense_key: u8,
+    pub asc: u8,
+    pub ascq: u8,
+}
+
+impl ScsiSense {
+    /// Parse the fixed-format sense buffer (key at byte 2, ASC at 12, ASCQ at 13).
+    pub fn from_buf(sense: &[u8; 32]) -> Self {
+        ScsiSense {
+            sense_key: sense[2] & 0x0F,
+            asc: sense[12],
+            ascq: sense[13],
+        }
+    }
+    /// ILLEGAL REQUEST (sense key 0x05) — the drive won't honor the command.
+    pub fn is_illegal_request(&self) -> bool {
+        self.sense_key == 0x05
+    }
+}
+
+/// SCSI status byte for a transport-layer failure (bridge crash / disconnect).
+pub(crate) const SCSI_STATUS_TRANSPORT_FAILURE: u8 = 0xFF;
+/// SCSI status byte CHECK CONDITION (a drive sense is available). Part of the
+/// status contract; currently referenced only by tests asserting the
+/// transport-vs-check-condition distinction.
+#[allow(dead_code)]
+pub(crate) const SCSI_STATUS_CHECK_CONDITION: u8 = 0x02;
+
+// Common opcodes used by the unlocker modules.
+pub(crate) const SCSI_SET_CD_SPEED: u8 = 0xBB;
+pub(crate) const SCSI_SEND_KEY: u8 = 0xA3;
+pub(crate) const SCSI_REPORT_KEY: u8 = 0xA4;
+pub(crate) const SCSI_READ_DISC_STRUCTURE: u8 = 0xAD;
+pub(crate) const SCSI_GET_CONFIGURATION: u8 = 0x46;
+/// AACS key class selector used in REPORT/SEND KEY CDBs.
+pub(crate) const AACS_KEY_CLASS: u8 = 0x02;
+
+/// Build a SET CD SPEED (0xBB) CDB requesting `read_speed` (KB/s; 0xFFFF = max).
+pub(crate) fn build_set_cd_speed(read_speed: u16) -> [u8; 12] {
+    [
+        SCSI_SET_CD_SPEED,
+        0x00,
+        (read_speed >> 8) as u8,
+        read_speed as u8,
+        0xFF,
+        0xFF,
+        0x00,
+        0x00,
+        0x00,
+        0x00,
+        0x00,
+        0x00,
+    ]
+}
+
+// ── Test fixture ────────────────────────────────────────────────────────────
+//
+// The crate-wide mock transport. Before this existed, EVERY mock in the crate
+// returned `Ok` with status 0 and a full `bytes_transferred` — so no test could
+// ever exercise the three outcomes the contract actually distinguishes, and a
+// whole class of transport-fault misclassification bugs sat uncaught (a dead bus
+// read as "this unlocker doesn't apply", a zero-filled buffer read as valid
+// drive data). This fixture can express all of them, and is the red-before-green
+// vehicle for the transport-contract fixes across ld / aacs / css / renesis.
+#[cfg(test)]
+#[allow(dead_code)] // a fixture: each helper is used by a subset of the modules
+pub(crate) mod mock {
+    use super::*;
+    use std::collections::VecDeque;
+
+    /// One scripted answer to one `execute()` call.
+    #[derive(Debug, Clone)]
+    pub(crate) enum Reply {
+        /// `Ok` + GOOD status. `payload` is copied into the caller's buffer;
+        /// `bytes_transferred` defaults to the number of bytes copied.
+        Data {
+            payload: Vec<u8>,
+            bytes_transferred: Option<usize>,
+        },
+        /// `Ok` + a NON-ZERO SCSI status (CHECK CONDITION) with a drive sense.
+        /// Per the contract at [`ScsiTransport::execute`] this is NOT a
+        /// transport fault — the caller must inspect `status`, and a caller that
+        /// doesn't will consume the caller's zero-filled buffer as drive data.
+        Sense {
+            status: u8,
+            sense_key: u8,
+            asc: u8,
+            ascq: u8,
+        },
+        /// `Err` with the transport-failure status and no sense — a genuine
+        /// transport-layer fault (bridge crash / disconnect). MUST abort.
+        TransportFault,
+        /// `Err` carrying a real status + parsed sense. This is what a
+        /// NON-conforming transport does (libfreemkv's adapter returns `Err` for
+        /// any non-zero SCSI status); classification must still treat it as a
+        /// drive rejection, not a dead bus.
+        ErrWithSense {
+            status: u8,
+            sense_key: u8,
+            asc: u8,
+            ascq: u8,
+        },
+    }
+
+    impl Reply {
+        /// `Ok`, GOOD status, full transfer of `payload`.
+        pub(crate) fn good(payload: Vec<u8>) -> Reply {
+            Reply::Data {
+                payload,
+                bytes_transferred: None,
+            }
+        }
+        /// `Ok`, GOOD status, but the drive only delivered `n` bytes.
+        pub(crate) fn short(payload: Vec<u8>, n: usize) -> Reply {
+            Reply::Data {
+                payload,
+                bytes_transferred: Some(n),
+            }
+        }
+        /// `Ok`, GOOD status, ZERO bytes delivered — the buffer the caller reads
+        /// is entirely its own zero fill.
+        pub(crate) fn zero_transfer(len: usize) -> Reply {
+            Reply::Data {
+                payload: vec![0u8; len],
+                bytes_transferred: Some(0),
+            }
+        }
+        /// `Ok` + CHECK CONDITION / ILLEGAL REQUEST (0x05, ASC 0x20 invalid
+        /// command) — the ordinary way a drive refuses a vendor command.
+        pub(crate) fn illegal_request() -> Reply {
+            Reply::Sense {
+                status: SCSI_STATUS_CHECK_CONDITION,
+                sense_key: 0x05,
+                asc: 0x20,
+                ascq: 0x00,
+            }
+        }
+        /// `Err` + CHECK CONDITION / ILLEGAL REQUEST — the same drive refusal as
+        /// seen through a non-conforming transport.
+        pub(crate) fn illegal_request_as_err() -> Reply {
+            Reply::ErrWithSense {
+                status: SCSI_STATUS_CHECK_CONDITION,
+                sense_key: 0x05,
+                asc: 0x20,
+                ascq: 0x00,
+            }
+        }
+    }
+
+    fn sense_buf(sense_key: u8, asc: u8, ascq: u8) -> [u8; 32] {
+        let mut b = [0u8; 32];
+        b[2] = sense_key & 0x0F;
+        b[12] = asc;
+        b[13] = ascq;
+        b
+    }
+
+    /// A scripted transport: answers each `execute()` from `script`, falling
+    /// back to `default` once the script runs out, and records every CDB.
+    pub(crate) struct MockTransport {
+        pub(crate) script: VecDeque<Reply>,
+        pub(crate) default: Reply,
+        pub(crate) cdbs: Vec<Vec<u8>>,
+    }
+
+    impl MockTransport {
+        /// Every command gets the same answer.
+        pub(crate) fn always(reply: Reply) -> Self {
+            MockTransport {
+                script: VecDeque::new(),
+                default: reply,
+                cdbs: Vec::new(),
+            }
+        }
+        /// The first N commands follow `script`; the rest get `default`.
+        pub(crate) fn scripted(script: Vec<Reply>, default: Reply) -> Self {
+            MockTransport {
+                script: script.into(),
+                default,
+                cdbs: Vec::new(),
+            }
+        }
+        /// How many CDBs were issued (lets a test assert a dead bus aborted
+        /// instead of retrying).
+        pub(crate) fn calls(&self) -> usize {
+            self.cdbs.len()
+        }
+    }
+
+    impl ScsiTransport for MockTransport {
+        fn execute(
+            &mut self,
+            cdb: &[u8],
+            _direction: DataDirection,
+            data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> Result<ScsiResult> {
+            self.cdbs.push(cdb.to_vec());
+            let reply = self
+                .script
+                .pop_front()
+                .unwrap_or_else(|| self.default.clone());
+            match reply {
+                Reply::Data {
+                    payload,
+                    bytes_transferred,
+                } => {
+                    let n = payload.len().min(data.len());
+                    data[..n].copy_from_slice(&payload[..n]);
+                    Ok(ScsiResult {
+                        status: 0,
+                        bytes_transferred: bytes_transferred.unwrap_or(n),
+                        sense: [0u8; 32],
+                    })
+                }
+                Reply::Sense {
+                    status,
+                    sense_key,
+                    asc,
+                    ascq,
+                } => Ok(ScsiResult {
+                    status,
+                    bytes_transferred: 0,
+                    sense: sense_buf(sense_key, asc, ascq),
+                }),
+                Reply::TransportFault => Err(ScsiError {
+                    status: SCSI_STATUS_TRANSPORT_FAILURE,
+                    sense: None,
+                }),
+                Reply::ErrWithSense {
+                    status,
+                    sense_key,
+                    asc,
+                    ascq,
+                } => Err(ScsiError {
+                    status,
+                    sense: Some(sense_buf(sense_key, asc, ascq)),
+                }),
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use mock::{MockTransport, Reply};
+
+    /// The fixed-format sense layout the whole crate reads its diagnostics off
+    /// (key at byte 2 low nibble, ASC at 12, ASCQ at 13). This file had no test
+    /// at all, so nothing pinned the offsets.
+    #[test]
+    fn sense_parses_at_the_fixed_format_offsets() {
+        let mut buf = [0u8; 32];
+        buf[2] = 0xF5; // sense key is the LOW nibble only
+        buf[12] = 0x24;
+        buf[13] = 0x01;
+        let s = ScsiSense::from_buf(&buf);
+        assert_eq!(s.sense_key, 0x05);
+        assert_eq!(s.asc, 0x24);
+        assert_eq!(s.ascq, 0x01);
+        assert!(s.is_illegal_request());
+
+        buf[2] = 0x02; // NOT READY
+        assert!(!ScsiSense::from_buf(&buf).is_illegal_request());
+    }
+
+    /// SET CD SPEED encodes the read speed big-endian at bytes 2-3 and leaves
+    /// the write speed at 0xFFFF.
+    #[test]
+    fn set_cd_speed_encodes_the_read_speed_big_endian() {
+        let cdb = build_set_cd_speed(0x1234);
+        assert_eq!(cdb[0], SCSI_SET_CD_SPEED);
+        assert_eq!([cdb[2], cdb[3]], [0x12, 0x34]);
+        assert_eq!([cdb[4], cdb[5]], [0xFF, 0xFF]);
+        assert_eq!(build_set_cd_speed(0xFFFF)[2..4], [0xFF, 0xFF]);
+    }
+
+    /// The fixture itself must honour the contract it exists to test: a drive
+    /// sense is `Ok` with a non-zero status, a bus fault is `Err`. If this ever
+    /// drifts, every transport-contract test built on it silently stops testing
+    /// anything.
+    #[test]
+    fn mock_transport_expresses_the_three_contract_outcomes() {
+        let mut t = MockTransport::scripted(
+            vec![
+                Reply::good(vec![0xAB; 4]),
+                Reply::illegal_request(),
+                Reply::zero_transfer(4),
+            ],
+            Reply::TransportFault,
+        );
+        let mut buf = [0u8; 4];
+
+        let r = t
+            .execute(&[0x3C], DataDirection::FromDevice, &mut buf, 0)
+            .expect("data reply is Ok");
+        assert_eq!(r.status, 0);
+        assert_eq!(r.bytes_transferred, 4);
+        assert_eq!(buf, [0xAB; 4]);
+
+        let r = t
+            .execute(&[0x3C], DataDirection::FromDevice, &mut buf, 0)
+            .expect("A DRIVE SENSE IS Ok, NOT Err — the load-bearing contract");
+        assert_eq!(r.status, SCSI_STATUS_CHECK_CONDITION);
+        assert!(ScsiSense::from_buf(&r.sense).is_illegal_request());
+
+        let r = t
+            .execute(&[0x3C], DataDirection::FromDevice, &mut buf, 0)
+            .expect("a zero-length transfer is still Ok");
+        assert_eq!(r.bytes_transferred, 0);
+
+        let e = t
+            .execute(&[0x3C], DataDirection::FromDevice, &mut buf, 0)
+            .expect_err("a transport fault is Err");
+        assert_eq!(e.status, SCSI_STATUS_TRANSPORT_FAILURE);
+        assert!(e.sense.is_none(), "a bus fault carries no drive sense");
+
+        assert_eq!(t.calls(), 4);
+    }
+}