v1.6.2: bump version (unified release)

release.sh dates the heading when it cuts the tag, and refuses a bare
'## [1.6.1]' because it cannot tell an undated heading from one it has
already stamped. Shipping a tag whose public changelog says UNRELEASED is
permanent and cannot be corrected inside that tag, so the check is right
to stop rather than guess.

.github/workflows/ci.yml

@@ -0,0 +1,72 @@
+name: CI
+
+on:
+  push:
+    # dev -> qa -> main. `dev` is where work lands and is meant to be pushed
+    # to often: these are the FAST checks, so a mistake surfaces in minutes.
+    # `qa` is the release candidate — it runs these too, plus the expensive
+    # suite in qa.yml. `main` only ever moves at release time, to a tagged
+    # commit that was already green on qa.
+    branches: [main, dev, qa]
+  pull_request:
+
+# freemkv-unlock is the BASE of the whole ecosystem: libfreemkv path-deps it,
+# bdemu path-deps it with the `emulation` feature, and every other crate pulls
+# it in transitively. It has no freemkv dependencies of its own, so no sibling
+# checkout is needed here — but it is also the crate whose breakage takes all
+# seven others down with it, which is why it gets the full OS matrix rather
+# than a token Linux run.
+#
+# Cargo.lock is gitignored (library convention), so `--locked` is deliberately
+# NOT used: with no committed lockfile it fails rather than resolves.
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@1.97.0
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo fmt --check
+      # --all-targets so the test code is linted too, not just the library.
+      - run: cargo clippy --all-targets -- -D warnings
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@1.97.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo test --tests
+      # `emulation` is off by default and is the face bdemu builds against. A
+      # feature nothing compiles is a feature that breaks at release time.
+      - run: cargo test --tests --features emulation
+
+  # The crate ships on macOS and Windows through its consumers, so it has to
+  # compile there. Build the tests (not just `cargo check`) — that forces
+  # codegen and catches errors in test-only code, which `check` skips.
+  check-macos:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@1.97.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo build --tests --all-features
+
+  check-windows:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@1.97.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo build --tests --all-features

.github/workflows/leak-guard.yml

@@ -0,0 +1,35 @@
+name: leak-guard
+
+# Self-contained public-repo leak gate. Public CI cannot reach the private
+# tooling, so this encodes only the generic net: internal-infra references,
+# tracked CLAUDE.md/.claude paths, and AI-attribution in commit messages.
+# No project-specific reverse-engineering vocabulary lives here.
+
+on: [push, pull_request]
+
+jobs:
+  leak-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Compute commit range
+        id: range
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            base="${{ github.event.pull_request.base.sha }}"
+            head="${{ github.event.pull_request.head.sha }}"
+            echo "range=$base..$head" >> "$GITHUB_OUTPUT"
+          else
+            before="${{ github.event.before }}"
+            after="${{ github.sha }}"
+            # New branch / first push: github.event.before is all-zeros.
+            if [ -z "$before" ] || [ "$before" = "0000000000000000000000000000000000000000" ]; then
+              echo "range=$after" >> "$GITHUB_OUTPUT"
+            else
+              echo "range=$before..$after" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+      - name: Run leak-guard
+        run: bash ci/leak-guard.sh "${{ steps.range.outputs.range }}"

.github/workflows/qa.yml

@@ -0,0 +1,118 @@
+name: qa
+
+# ── The qa gate: "is this production worth?" ────────────────────────────────
+#
+# dev -> qa -> main.
+#
+# `dev` is for committing often. ci.yml answers "is it green" in minutes with
+# fmt, clippy and the unit suite, so a mistake surfaces while it is still cheap
+# to fix. `qa` is the release-candidate branch, and THIS workflow is the claim
+# that a commit is production worth: everything expensive that can run without
+# physical media. `main` only ever receives a qa that went green here.
+#
+# Sibling repos are checked out at `qa`, NOT `dev`. A qa run that resolved its
+# dependencies from dev tips would be validating a combination that is not the
+# one being released, which is the exact failure this branch exists to prevent.
+#
+# What this gate CANNOT cover: `disc://` and real `iso://` need physical media,
+# and no hosted runner has an optical drive or the image hoard. Those run on a
+# self-hosted runner (see the media job at the end) and are the one leg that
+# stays on hardware.
+on:
+  push:
+    branches: [qa]
+  workflow_dispatch:
+
+jobs:
+  # ── Name the candidate ────────────────────────────────────────────────
+  #
+  # Every push to `qa` is a release candidate, so every push gets a tag:
+  # v<version>-rc<N>, N incrementing. That is the answer to "which build is on
+  # qa right now, and is it the one I tested?" — a question that otherwise gets
+  # answered from memory.
+  #
+  # This runs FIRST and does not depend on the gates, deliberately. A red
+  # candidate needs a name more than a green one does: "rc3 failed
+  # release-tests on windows" is a sentence you can act on; "qa is red" is not.
+  # Red on qa is a working gate, not an incident — it is the branch saying this
+  # is not production worth yet. Fix on dev, get dev green, push qa again.
+  #
+  # release.yml excludes v*-rc* so a candidate never publishes a release.
+  rc-tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Stamp the next rc
+        shell: bash
+        run: |
+          set -euo pipefail
+          v=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
+          [ -n "$v" ] || { echo "no version in Cargo.toml" >&2; exit 1; }
+          # Numeric sort on the rc ordinal: -rc10 must beat -rc9, and a plain
+          # lexical sort gets that backwards from the tenth candidate on.
+          n=$(git tag -l "v$v-rc*" | sed "s|^v$v-rc||" | sort -n | tail -1)
+          tag="v$v-rc$(( ${n:-0} + 1 ))"
+          git tag "$tag"
+          git push origin "$tag"
+          echo "### Candidate \`$tag\`" >> "$GITHUB_STEP_SUMMARY"
+
+  # The debug suite runs on every dev push. Release is a DIFFERENT build:
+  # overflow checks are off, debug_assert! is compiled out, and inlining
+  # changes what the optimiser can prove. A test that only passes in debug is
+  # a test that never guarded the binary anyone actually ships.
+  release-tests:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ['ubuntu-latest', 'macos-latest']
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          path: freemkv-unlock
+      - uses: dtolnay/rust-toolchain@1.97.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: freemkv-unlock
+      - run: cargo test --release --tests
+        working-directory: freemkv-unlock
+
+  # clippy's output is target-dependent: cfg-gated code only gets linted on
+  # the target it compiles for. Linting solely on the dev machine's host
+  # target is how a lint that CI rejects reaches a push.
+  cross-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          path: freemkv-unlock
+      - uses: dtolnay/rust-toolchain@1.97.0
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: freemkv-unlock
+      - run: rustup target add x86_64-unknown-linux-gnu
+      - run: cargo clippy --all-targets --target x86_64-unknown-linux-gnu -- -D warnings
+        working-directory: freemkv-unlock
+
+  # Windows compiles the tests but does not run them, matching the policy
+  # ci.yml already set. The value here is codegen: the #[cfg(windows)] halves
+  # of the SCSI transport and platform layers compile on no other runner, so
+  # without this they are first built at release time.
+  windows-build:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          path: freemkv-unlock
+      - uses: dtolnay/rust-toolchain@1.97.0
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: freemkv-unlock
+      - run: cargo build --release --tests
+        working-directory: freemkv-unlock

CHANGELOG.md

@@ -0,0 +1,54 @@
+# Changelog
+
+## [1.6.2] — 2026-08-08
+
+Version sync with the workspace. No functional change in this crate.
+
+## [1.6.1] — 2026-08-07
+
+Version sync with the workspace. No functional change in this crate.
+
+## [1.6.0] — 2026-08-03
+
+Version sync with the workspace. No functional change in this crate.
+
+## [1.5.2] — 2026-07-22
+
+### Changed
+
+- The DVD read-unlocker (bus-auth) is renamed `CSS` → `DVD`: it reports the
+  medium it unlocks, not whether a title-key crack ran. The unlocker report now
+  reads `DVD: yes` on any DVD.
+
+## [1.4.1] — 2026-07-14
+
+Version sync with the workspace; inherits libfreemkv 1.4.1.
+
+## [1.4.0] — 2026-07-13
+
+Version sync with the workspace; inherits libfreemkv 1.4.0.
+
+## [1.3.2] — 2026-07-10
+
+Version sync with the workspace; inherits libfreemkv 1.3.2.
+
+## [1.3.1] — 2026-07-10
+
+### Licensing
+
+- **Relicensed to the MIT License, from 1.3.1 onwards** (releases up to and
+  including 1.3.0 remain under AGPL-3.0).
+
+Version sync with the workspace; inherits libfreemkv 1.3.1.
+
+## [1.3.0] — 2026-07-08
+
+### Changed
+
+- **`Unlocker` is now two capability methods.** `unlock_features` (drive
+  riplock / speed / OEM VID at drive-prep) and `unlock_bus` (bus-encryption
+  removal for the mounted disc) replace the single `matches()` + `unlock()`
+  contract. Each defaults to `NotApplicable`, so an unlocker implements only the
+  capabilities it actually provides.
+- **`DriveId` gains a `product_id` field** carrying the SCSI INQUIRY product
+  string, so consumers can match on it.

CODE_OF_CONDUCT.md

@@ -36,7 +36,7 @@ This Code of Conduct applies within all community spaces, and also applies when
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at owner@example.invalid. All complaints will be reviewed and investigated promptly and fairly.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported privately to the project maintainer via GitHub at https://github.com/MattJackson. All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the reporter of any incident.
 

Cargo.toml

@@ -1,9 +1,9 @@
 [package]
 name = "freemkv-unlock"
-version = "1.2.2"
+version = "1.6.2"
 edition = "2024"
-rust-version = "1.86"
-license = "AGPL-3.0-only"
+rust-version = "1.97"
+license = "MIT"
 description = "Unlock layer for the freemkv toolchain: the Unlocker contract + self-contained firmware/AACS/CSS unlocker modules. libfreemkv depends on this and dispatches via all_unlockers()."
 repository = "https://github.com/freemkv/freemkv-unlock"
 # NEVER crates.io: this crate carries drive firmware. Consumed only by git tag.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Jackson & Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -14,9 +14,17 @@ clients of libfreemkv are oblivious to unlockers entirely (as they are to the
 SCSI layer).
 
 ```rust
+use freemkv_unlock::UnlockError;
+
+// Drive-prep: try each unlocker's feature unlock until one claims the drive.
+// `NotApplicable` means "not this unlocker's drive" — move on; a transport
+// error means a dead bus — abort. `unlock_bus` follows the same contract for
+// removing per-disc bus encryption.
 for u in freemkv_unlock::all_unlockers() {
-    if u.matches(&ctx) {
-        return u.unlock(&mut scsi, &ctx);
+    match u.unlock_features(&mut scsi, &ctx) {
+        Ok(unlocked) => return Ok(unlocked),
+        Err(UnlockError::NotApplicable) => continue,
+        Err(e) => return Err(e),
     }
 }
 ```
@@ -24,4 +32,4 @@ for u in freemkv_unlock::all_unlockers() {
 To remove an unlocker, delete its module directory and its one line in
 `all_unlockers()` — nothing else changes.
 
-License: AGPL-3.0-only.
+License: MIT.

ci/leak-guard.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+#
+# leak-guard.sh — self-contained public-repo leak gate.
+#
+# This is the LAST line of defense in CI. It is intentionally self-contained:
+# public CI cannot reach the private tooling, so this script encodes ONLY the
+# generic net — internal infrastructure references, agent-context files, and
+# AI-attribution in commit messages. It deliberately contains NO project-
+# specific reverse-engineering vocabulary (those words would themselves be a
+# leak). The richer private scanner stays private.
+#
+# Fails (exit 1) if any of the following appear in the repo:
+#   1. a tracked CLAUDE.md or .claude/ path (agent context — never public),
+#   2. tracked file content matching the internal-infra net,
+#   3. a commit message (in the given range) with AI attribution.
+#
+# Usage:
+#   leak-guard.sh [<commit-range>]
+#     <commit-range>  optional git rev-list range to scan commit messages
+#                     (e.g. "abc..def"). If omitted, commit-message scan is
+#                     skipped (path + content checks always run).
+
+set -euo pipefail
+
+# Absolute path to this script, resolved before any cd, so we can exclude it
+# from the content scan (it necessarily contains the detection patterns).
+SELF_ABS="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/$(basename "${BASH_SOURCE[0]}")"
+
+REPO="$(git rev-parse --show-toplevel)"
+cd "$REPO"
+
+fail=0
+note() { printf '  ✗ %s\n' "$1"; fail=1; }
+
+# Internal-infra net — GENERIC ONLY. This script ships in the public repo, so
+# the patterns themselves must not name any org-specific identifier (doing so
+# would itself leak the infra they guard). We catch the leak *class*:
+#   - RFC1918 private IPv4 ranges (10/8, 172.16/12, 192.168/16),
+#   - private/internal/non-routable TLDs (.internal/.local/.lan/.corp/.invalid),
+#   - docker.internal.
+# The full org-specific net (literal hostnames, service names, repo paths,
+# vendor tooling, …) lives ONLY in the private scanner and never ships here.
+INFRA_RE='\b10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|\b172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}|\b192\.168\.[0-9]{1,3}\.[0-9]{1,3}|\.internal\b|\.local\b|\.lan\b|\.corp\b|\.invalid\b|docker\.internal'
+# Home-path net — GENERIC ONLY. Catches an absolute developer home path
+# committed into a tracked file (a macOS /Users/<user>/… or Linux /home/<user>/…
+# path). This names NO specific user — it matches the leak *class* (any home
+# path), so the pattern itself reveals nothing org- or person-specific. A real
+# leak (e.g. /Users/alice/Developer/x slipping into a public RELEASE.md) trips
+# this regardless of whose machine it came from. The username segment is a
+# literal-username class ([A-Za-z0-9._-]) so dynamic/templated paths that build
+# the user at runtime — shell `/home/$USER/`, doc `/home/<rip>/`, Rust
+# `/home/{user}/` — do NOT false-positive; only a baked-in literal home leaks.
+HOMEPATH_RE='/Users/[A-Za-z0-9._-]+/|/home/[A-Za-z0-9._-]+/'
+# AI-attribution net (case-insensitive). "claude" matches only as a standalone
+# word — NOT preceded by a dot/slash/alnum and NOT followed by .md — so legit
+# mentions of CLAUDE.md / .claude/ in a commit message don't false-positive.
+ATTR_RE='co-authored-by|generated with|🤖|(?<![.\/A-Za-z0-9])claude(?!\.md)'
+
+echo "── leak-guard: tracked agent-context paths ──"
+while IFS= read -r f; do
+  case "$f" in
+    CLAUDE.md|*/CLAUDE.md|.claude|.claude/*|*/.claude|*/.claude/*)
+      note "tracked agent-context file: $f (CLAUDE.md/.claude must never be tracked in a public repo)" ;;
+  esac
+done < <(git ls-files)
+
+# Match a PCRE against a file, emitting "LINE: MATCH". The pattern is passed as
+# an argument (not interpolated into a //) so metacharacters like the "/" in a
+# path-style token can't break the regex. Reads raw bytes so non-UTF-8 blobs
+# don't abort the scan.
+pcre_matches() {
+  perl -e '
+    my ($file, $re) = @ARGV;
+    open(my $fh, "<:raw", $file) or exit 0;
+    my $rx; eval { $rx = qr/$re/i }; exit 0 if $@;
+    while (my $l = <$fh>) { if ($l =~ /$rx/) { print "$.: $&\n"; } }
+  ' "$1" "$2" 2>/dev/null
+}
+
+# This script's own source necessarily contains the detection patterns (e.g.
+# the regex tokens in INFRA_RE), so scanning it would always self-flag. Skip it.
+SELF="$(git ls-files --full-name -- "$SELF_ABS" 2>/dev/null | head -1)"
+
+echo "── leak-guard: internal-infra references in tracked files ──"
+while IFS= read -r f; do
+  case "$f" in *.png|*.jpg|*.jpeg|*.ico|*.gif|*.bin|*.crate|*.gz|*.zip|*.pdf) continue ;; esac
+  [ -n "$SELF" ] && [ "$f" = "$SELF" ] && continue
+  [ -f "$f" ] || continue
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    note "internal-infra reference: $f:$hit"
+  done < <(pcre_matches "$f" "$INFRA_RE")
+  while IFS= read -r hit; do
+    [ -z "$hit" ] && continue
+    note "[HOME-PATH] absolute home path: $f:$hit (no local home path may be committed to a public repo)"
+  done < <(pcre_matches "$f" "$HOMEPATH_RE")
+done < <(git ls-files)
+
+RANGE="${1:-}"
+if [ -n "$RANGE" ]; then
+  echo "── leak-guard: AI-attribution in commit messages ($RANGE) ──"
+  while IFS= read -r sha; do
+    [ -z "$sha" ] && continue
+    msg="$(git log -1 --format='%B' "$sha" 2>/dev/null || true)"
+    # Pass the pattern as an argument (not interpolated into a //) so the
+    # lookbehind char class and "/" don't break the regex.
+    hit="$(printf '%s' "$msg" | perl -e '
+      my $re = $ARGV[0]; my $rx = qr/$re/i;
+      while (my $l = <STDIN>) { if ($l =~ /($rx)/) { print "$1\n"; last; } }
+    ' "$ATTR_RE" | head -1 || true)"
+    [ -n "$hit" ] && note "commit ${sha:0:12}: message contains \"$hit\" (owner rule: zero AI attribution, ever)"
+  done < <(git rev-list "$RANGE" 2>/dev/null || true)
+fi
+
+echo
+if [ "$fail" -ne 0 ]; then
+  echo "✗ leak-guard: blocking finding(s) above — DO NOT MERGE/PUBLISH"
+  exit 1
+fi
+echo "✓ leak-guard: clean"

src/aacs/mod.rs

@@ -48,15 +48,17 @@ impl Unlocker for AacsCert {
         "AACS"
     }
 
-    fn matches(&self, ctx: &UnlockCtx) -> bool {
-        ctx.kind == DiscKind::Aacs
-    }
-
-    fn unlock(
+    /// AACS removes BUS encryption via the host-cert handshake; it provides no
+    /// drive features. Self-guards on the disc kind (the consumer iterates every
+    /// unlocker's `unlock_bus`, so a non-AACS disc must decline here).
+    fn unlock_bus(
         &self,
         scsi: &mut dyn ScsiTransport,
         ctx: &UnlockCtx,
     ) -> std::result::Result<Unlocked, UnlockError> {
+        if ctx.kind != DiscKind::Aacs {
+            return Err(UnlockError::NotApplicable);
+        }
         if ctx.host_certs.is_empty() {
             // No host cert to authenticate with — the consumer falls back to a
             // VID-less / keysource path.
@@ -81,18 +83,29 @@ mod tests {
         crate::DriveId::default()
     }
 
-    /// AacsCert matches only `DiscKind::Aacs`.
+    /// `unlock_bus` self-guards on the disc kind: on a non-AACS disc it declines
+    /// (`NotApplicable`) WITHOUT touching the transport, so iterating it on a
+    /// CSS/unknown disc is safe.
     #[test]
-    fn matches_only_aacs_kind() {
+    fn unlock_bus_declines_non_aacs_kinds() {
+        struct DeadTransport;
+        impl ScsiTransport for DeadTransport {
+            fn execute(
+                &mut self,
+                _cdb: &[u8],
+                _dir: crate::scsi::DataDirection,
+                _data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> crate::scsi::Result<crate::scsi::ScsiResult> {
+                panic!("transport must not be touched on a non-AACS disc");
+            }
+        }
         let id = id();
-        let u = AacsCert::new();
+        let mut t = DeadTransport;
         for k in [DiscKind::Unknown, DiscKind::Unencrypted, DiscKind::Css] {
-            assert!(
-                !u.matches(&UnlockCtx::new(&id, k, &[])),
-                "must not match {k:?}"
-            );
+            let r = AacsCert::new().unlock_bus(&mut t, &UnlockCtx::new(&id, k, &[]));
+            assert_eq!(r.unwrap_err(), UnlockError::NotApplicable, "declines {k:?}");
         }
-        assert!(u.matches(&UnlockCtx::new(&id, DiscKind::Aacs, &[])));
     }
 
     /// With no host certs there is nothing to authenticate with → NoUsableHostCert,
@@ -113,7 +126,7 @@ mod tests {
         }
         let id = id();
         let mut t = DeadTransport;
-        let r = AacsCert::new().unlock(&mut t, &UnlockCtx::new(&id, DiscKind::Aacs, &[]));
+        let r = AacsCert::new().unlock_bus(&mut t, &UnlockCtx::new(&id, DiscKind::Aacs, &[]));
         assert_eq!(r.unwrap_err(), UnlockError::NoUsableHostCert);
     }
 }

src/css/mod.rs

@@ -141,34 +141,44 @@ pub fn unlock_css_reads(scsi: &mut dyn ScsiTransport, lba: u32) -> Result<()> {
     r
 }
 
-/// The CSS unlocker — the DVD peer of the firmware and AACS-cert unlockers in
-/// the uniform [`crate::Unlocker`] registry. It removes the CSS
-/// scrambled-read barrier (drive ASF=1) and learns no VID or bus key — the
-/// descramble key is recovered keylessly downstream (the Stevenson attack).
-pub struct CssUnlocker;
+/// The DVD unlocker (registry name `"DVD"`) — the DVD peer of the firmware and
+/// AACS-cert unlockers in the uniform [`crate::Unlocker`] registry. It removes
+/// the DVD scrambled-read barrier (drive ASF=1) via bus-auth and learns no VID
+/// or bus key — the descramble key is recovered keylessly downstream (the
+/// Stevenson attack). Named for the medium it unlocks (DVD), not the CSS
+/// scheme: the bus-auth is required to read a CSS-protected DVD at all, whether
+/// or not any given sector turns out to be scrambled. Lives in the `css` module
+/// beside the CSS-scheme primitives it drives.
+pub struct DvdUnlocker;
 
-impl CssUnlocker {
+impl DvdUnlocker {
     pub fn new() -> Self {
-        CssUnlocker
+        DvdUnlocker
     }
 }
 
-impl Default for CssUnlocker {
+impl Default for DvdUnlocker {
     fn default() -> Self {
         Self::new()
     }
 }
 
-impl crate::Unlocker for CssUnlocker {
+impl crate::Unlocker for DvdUnlocker {
     fn name(&self) -> &'static str {
-        "CSS"
+        // User-facing unlocker label. This unlocker's job is the DVD
+        // read-enablement bus-auth (it clears the drive's scrambled-read
+        // barrier and learns no key) — a property of the DVD medium, NOT of
+        // whether the content happens to be CSS-scrambled. Reporting it as
+        // "DVD" is honest: on any DVD the bus-auth ran; the CSS descramble
+        // itself is keyless and handled downstream, so it is not a separate
+        // "did an unlocker run" signal.
+        "DVD"
     }
 
-    fn matches(&self, ctx: &crate::UnlockCtx) -> bool {
-        ctx.kind == crate::DiscKind::Css
-    }
-
-    fn unlock(
+    /// CSS removes the scrambled-sector barrier (a bus-level concern); it
+    /// provides no drive features. Self-guards against the hardware (below), so
+    /// it declines cleanly when the consumer iterates it on a non-DVD.
+    fn unlock_bus(
         &self,
         scsi: &mut dyn ScsiTransport,
         _ctx: &crate::UnlockCtx,
@@ -180,8 +190,8 @@ impl crate::Unlocker for CssUnlocker {
         if !mounted_disc_is_dvd(scsi) {
             tracing::debug!(
                 target: "freemkv::css",
-                phase = "css_unlocker_not_dvd",
-                "CssUnlocker invoked on a non-DVD profile; refusing (NotApplicable)"
+                phase = "dvd_unlocker_not_dvd",
+                "DvdUnlocker invoked on a non-DVD profile; refusing (NotApplicable)"
             );
             return Err(crate::UnlockError::NotApplicable);
         }
@@ -194,7 +204,7 @@ impl crate::Unlocker for CssUnlocker {
 }
 
 /// Transport-level "is the mounted disc a DVD?" probe (GET CONFIGURATION
-/// current-profile, DVD family `0x0010..=0x001F`). Lets the CssUnlocker
+/// current-profile, DVD family `0x0010..=0x001F`). Lets the DvdUnlocker
 /// self-verify against the drive instead of trusting the caller's DiscKind.
 fn mounted_disc_is_dvd(scsi: &mut dyn ScsiTransport) -> bool {
     // RT=0: the 8-byte feature header carries the Current Profile in bytes 6-7.
@@ -923,35 +933,46 @@ mod tests {
         assert_eq!(cdb[9], 0x04, "low byte of 2052-byte transfer");
     }
 
-    /// The CssUnlocker matches ONLY `DiscKind::Css` (never fires during
-    /// drive-prep or on a Blu-ray).
+    /// The unlocker's user-facing name is "DVD" (the medium it read-unlocks),
+    /// not "CSS" (the scheme). Apps render the unlocker report from this name,
+    /// so it is a stable contract — the bus-auth ran on any DVD, encrypted or
+    /// not, and the report must say so rather than conflate it with a CSS crack.
     #[test]
-    fn css_unlocker_matches_only_css_kind() {
-        use crate::{DiscKind, DriveId, UnlockCtx, Unlocker};
-        let id = DriveId {
-            vendor_id: "FAKEVNDR".to_string(),
-            ..Default::default()
-        };
+    fn dvd_unlocker_is_named_dvd() {
+        use crate::Unlocker;
+        assert_eq!(DvdUnlocker::new().name(), "DVD");
+    }
 
-        let u = CssUnlocker::new();
-        assert!(
-            u.matches(&UnlockCtx::new(&id, DiscKind::Css, &[])),
-            "matches a CSS DVD"
-        );
-        for k in [DiscKind::Unknown, DiscKind::Unencrypted, DiscKind::Aacs] {
-            assert!(
-                !u.matches(&UnlockCtx::new(&id, k, &[])),
-                "CssUnlocker must not match {k:?}"
-            );
+    /// DvdUnlocker provides bus removal only — it never provides drive features.
+    #[test]
+    fn dvd_unlocker_provides_no_features() {
+        use crate::scsi::{DataDirection, ScsiResult};
+        use crate::{DiscKind, DriveId, UnlockCtx, UnlockError, Unlocker};
+        struct DeadTransport;
+        impl ScsiTransport for DeadTransport {
+            fn execute(
+                &mut self,
+                _cdb: &[u8],
+                _dir: DataDirection,
+                _data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> crate::scsi::Result<ScsiResult> {
+                panic!("unlock_features must not touch the transport");
+            }
         }
+        let id = DriveId::default();
+        let mut t = DeadTransport;
+        let r =
+            DvdUnlocker::new().unlock_features(&mut t, &UnlockCtx::new(&id, DiscKind::Css, &[]));
+        assert_eq!(r.unwrap_err(), UnlockError::NotApplicable);
     }
 
     /// Defense in depth: even when the caller declares `DiscKind::Css`, the
-    /// CssUnlocker self-verifies against the drive's GET CONFIGURATION profile.
+    /// DvdUnlocker self-verifies against the drive's GET CONFIGURATION profile.
     /// A drive reporting a Blu-ray profile → `NotApplicable`, and NOT a single
     /// CSS CDB is issued (no bus-auth fired at a BD).
     #[test]
-    fn css_unlocker_self_guards_against_non_dvd() {
+    fn dvd_unlocker_self_guards_against_non_dvd() {
         use crate::scsi::{DataDirection, ScsiResult};
         use crate::{DiscKind, DriveId, UnlockCtx, UnlockError, Unlocker};
 
@@ -994,7 +1015,7 @@ mod tests {
         };
 
         let mut t = BdTransport { non_config_cdbs: 0 };
-        let r = CssUnlocker::new().unlock(&mut t, &UnlockCtx::new(&id, DiscKind::Css, &[]));
+        let r = DvdUnlocker::new().unlock_bus(&mut t, &UnlockCtx::new(&id, DiscKind::Css, &[]));
         assert_eq!(
             r.unwrap_err(),
             UnlockError::NotApplicable,

src/ld/README.md

@@ -0,0 +1,27 @@
+# ld — the LibreDrive unlocker
+
+The **LibreDrive** unlocker module for freemkv-unlock.
+
+freemkv-unlock defines the generic `Unlocker` contract; this module is one
+implementation of it. It recognizes a bundled catalog of supported drives
+(`profiles.json`) and, for a matching drive, lifts the drive-level
+bus-encryption barrier so the drive serves readable sectors. Content-key
+decryption is a separate concern, handled by the consumer.
+
+Clients never name this module directly —
+[libfreemkv](https://github.com/freemkv/libfreemkv) dispatches through
+`freemkv_unlock::all_unlockers()`, and this module answers `unlock_features()` /
+`unlock_bus()` when the drive identity is one it supports.
+
+## Scope: non-persistent unlock only
+
+This module performs only the **non-persistent** unlock — the access state it
+sets up lives in drive RAM and is gone on power cycle. The one-time, permanent
+drive preparation is the drive owner's own manual step and is **never**
+automated here.
+
+## Credits
+
+LibreDrive was created by **Mike Chen** and the **MakeMKV team**. This module
+builds on their work — our thanks and full credit to them for the LibreDrive
+capabilities.

src/ld/mod.rs

@@ -116,26 +116,17 @@ impl LibreDrive {
     }
 }
 
-impl Unlocker for LibreDrive {
-    /// Firmware unlock is a DRIVE-PREP concern: it runs before the disc kind is
-    /// probed (`kind == Unknown`) and keys off the drive identity. It must NOT
-    /// fire during the later content-keyed dispatch (Aacs/Css), or a DVD/Blu-ray
-    /// in a profiled drive would be re-firmware-unlocked.
-    fn name(&self) -> &'static str {
-        "LibreDrive"
-    }
-
-    fn matches(&self, ctx: &UnlockCtx) -> bool {
-        ctx.kind == crate::DiscKind::Unknown && profile::find_bundled(ctx.drive_id).is_some()
-    }
-
-    /// Firmware-unlock the drive and report its OEM Volume ID. The unlocked drive
-    /// serves CLEAR content, so `drive_unlocked: true` and there is no bus key.
+impl LibreDrive {
+    /// The MediaTek firmware unlock. Because LibreDrive removes AACS bus
+    /// encryption AT THE DRIVE (the unlocked drive serves CLEAR content), this ONE
+    /// operation satisfies BOTH the drive-features and the bus-removal capability
+    /// — so `unlock_features` and `unlock_bus` both delegate here. The result
+    /// carries `drive_unlocked: true` (no bus key needed) and the OEM Volume ID.
     ///
-    /// A no-firmware-route drive (Renesas) returns `NotApplicable` (fall through);
-    /// a transport fault propagates as `Transport`; a firmware failure that isn't
-    /// a dead bus also falls through (`NotApplicable`).
-    fn unlock(
+    /// A no-firmware-route drive (Renesas / no profile) returns `NotApplicable`; a
+    /// transport fault propagates as `Transport`; any other firmware failure also
+    /// falls through as `NotApplicable`.
+    fn firmware_unlock(
         &self,
         scsi: &mut dyn ScsiTransport,
         ctx: &UnlockCtx,
@@ -145,19 +136,17 @@ impl Unlocker for LibreDrive {
             return Err(UnlockError::NotApplicable);
         };
         if matches!(m.platform, profile::Platform::Renesas) {
-            // Renesas firmware unlock is not implemented — fall through to cert.
+            // Renesas is a different platform (handled by the Renesas unlocker).
             return Err(UnlockError::NotApplicable);
         }
         let is_variant_b = matches!(m.platform, profile::Platform::Mt1959B);
         use platform::PlatformDriver;
         let mut mt = platform::mt1959::Mt1959::new(m.profile, is_variant_b);
-        // Firmware unlock. A transport fault → UnlockError::Transport; any other
-        // firmware failure → NotApplicable (via From<error::Error>).
+        // A transport fault → UnlockError::Transport; any other firmware failure
+        // → NotApplicable (via From<error::Error>).
         mt.init(scsi)?;
         // Prime the per-region speed table (best-effort — must not fail the unlock).
         let _ = mt.probe_disc(scsi);
-        // The unlocked drive hands back its Volume ID; firmware serves clear
-        // content, so no bus key and drive_unlocked = true.
         let vid = self.read_oem_vid(scsi, id)?;
         Ok(Unlocked {
             vid,
@@ -167,6 +156,33 @@ impl Unlocker for LibreDrive {
     }
 }
 
+impl Unlocker for LibreDrive {
+    fn name(&self) -> &'static str {
+        "LibreDrive"
+    }
+
+    /// LibreDrive provides drive features (riplock/speed, OEM VID) — and, because
+    /// its firmware unlock serves clear content, bus removal comes free with it.
+    fn unlock_features(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        self.firmware_unlock(scsi, ctx)
+    }
+
+    /// Same firmware code as [`unlock_features`]: LibreDrive removes the bus at
+    /// the drive. In practice the consumer skips this because drive-prep already
+    /// set `drive_unlocked`; it's here for completeness / a bus-first call order.
+    fn unlock_bus(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        self.firmware_unlock(scsi, ctx)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -212,6 +228,7 @@ mod tests {
     fn make_drive_id(vendor: &str, rev: &str, vs: &str, date: &str) -> DriveId {
         DriveId {
             vendor_id: vendor.to_string(),
+            product_id: String::new(),
             product_revision: rev.to_string(),
             vendor_specific: vs.to_string(),
             firmware_date: date.to_string(),
@@ -283,8 +300,8 @@ mod tests {
         assert_eq!(got, None);
     }
 
-    /// `unlock` on a drive with no matching profile → `NotApplicable` (fall
-    /// through), short-circuiting before any firmware handshake.
+    /// `unlock_features` on a drive with no matching profile → `NotApplicable`
+    /// (fall through), short-circuiting before any firmware handshake.
     #[test]
     fn unlock_no_profile_is_not_applicable() {
         let mut t = FakeTransport {
@@ -292,7 +309,7 @@ mod tests {
             bytes_transferred: 36,
         };
         let err = LibreDrive::new()
-            .unlock(
+            .unlock_features(
                 &mut t,
                 &ctx(&make_drive_id("FAKE-VND", "9.99", "XX12345", "")),
             )

src/ld/platform/mt1959/mod.rs

@@ -487,6 +487,7 @@ mod tests {
         DriveProfile {
             identity: Identity {
                 vendor_id: "TEST".into(),
+                product_id: String::new(),
                 product_revision: String::new(),
                 vendor_specific: String::new(),
                 firmware_date: String::new(),

src/ld/profile.rs

@@ -31,6 +31,8 @@ pub struct Identity {
     #[serde(default)]
     pub vendor_id: String,
     #[serde(default)]
+    pub product_id: String,
+    #[serde(default)]
     pub product_revision: String,
     #[serde(default)]
     pub vendor_specific: String,
@@ -139,7 +141,7 @@ pub struct ProfileMatch {
 /// translatable English message.
 fn decode_hex(s: &str) -> std::result::Result<Vec<u8>, &'static str> {
     let bytes = s.as_bytes();
-    if bytes.len() % 2 != 0 {
+    if !bytes.len().is_multiple_of(2) {
         return Err("hex");
     }
     let mut out = Vec::with_capacity(bytes.len() / 2);
@@ -283,15 +285,16 @@ fn load_from_str(data: &str) -> Result<Profiles> {
 
 /// Find a profile matching a drive's INQUIRY fields.
 ///
-/// Two-pass per platform section (MT1959-A, then MT1959-B, then Renesas):
-/// first an exact match including `firmware_date`, then — if none — a
-/// looser match on vendor / revision / vendor-specific only. The exact
-/// pass wins so a drive with a known firmware date binds to its precise
-/// profile; the looser pass lets a drive whose firmware date we don't have
-/// on file still match a same-model profile. All comparisons are
-/// whitespace-trimmed. Returns the first section that yields a match.
+/// Per platform section (MT1959-A, then MT1959-B, then Renesas), tried in
+/// order of decreasing specificity: full match including `product_id` and
+/// `firmware_date` (skipped when the drive reports no product), then the same
+/// without `product_id`. Both require `firmware_date`; every profile carries a
+/// unique identity under these fields, so a match is exact — no looser
+/// vendor/revision fallback that could pick the wrong same-model variant. All
+/// comparisons are whitespace-trimmed. Returns the first section that matches.
 pub fn find_by_drive_id(profiles: &Profiles, drive_id: &crate::DriveId) -> Option<ProfileMatch> {
     let v = drive_id.vendor_id.trim();
+    let prod = drive_id.product_id.trim();
     let r = drive_id.product_revision.trim();
     let vs = drive_id.vendor_specific.trim();
     let date = drive_id.firmware_date.trim();
@@ -301,12 +304,15 @@ pub fn find_by_drive_id(profiles: &Profiles, drive_id: &crate::DriveId) -> Optio
         (Platform::Mt1959B, &profiles.mt1959_b),
         (Platform::Renesas, &profiles.renesas),
     ] {
-        if let Some(p) = list.iter().find(|p| {
-            p.identity.vendor_id.trim() == v
-                && p.identity.product_revision.trim() == r
-                && p.identity.vendor_specific.trim() == vs
-                && p.identity.firmware_date.trim() == date
-        }) {
+        if !prod.is_empty()
+            && let Some(p) = list.iter().find(|p| {
+                p.identity.vendor_id.trim() == v
+                    && p.identity.product_id.trim() == prod
+                    && p.identity.product_revision.trim() == r
+                    && p.identity.vendor_specific.trim() == vs
+                    && p.identity.firmware_date.trim() == date
+            })
+        {
             return Some(ProfileMatch {
                 profile: p.clone(),
                 platform,
@@ -317,6 +323,7 @@ pub fn find_by_drive_id(profiles: &Profiles, drive_id: &crate::DriveId) -> Optio
             p.identity.vendor_id.trim() == v
                 && p.identity.product_revision.trim() == r
                 && p.identity.vendor_specific.trim() == vs
+                && p.identity.firmware_date.trim() == date
         }) {
             return Some(ProfileMatch {
                 profile: p.clone(),
@@ -336,12 +343,51 @@ mod tests {
     fn make_drive_id(vendor: &str, rev: &str, vs: &str, date: &str) -> DriveId {
         DriveId {
             vendor_id: vendor.to_string(),
+            product_id: String::new(),
             product_revision: rev.to_string(),
             vendor_specific: vs.to_string(),
             firmware_date: date.to_string(),
         }
     }
 
+    /// When two profiles share vendor/rev/vs/date and differ only in product_id,
+    /// the full pass binds to the one whose product matches; the looser passes
+    /// would return the first regardless.
+    #[test]
+    fn find_by_drive_id_product_id_breaks_a_tie() {
+        use serde_json::json;
+        let profiles: Profiles = serde_json::from_str(
+            &json!({
+                "mt1959_a": [
+                    {"identity": {"vendor_id":"TIE","product_id":"MODEL-A",
+                        "product_revision":"1.00","vendor_specific":"XX00000",
+                        "firmware_date":"200001010000"},
+                        "signature":"aaaaaaaa","firmware":""},
+                    {"identity": {"vendor_id":"TIE","product_id":"MODEL-B",
+                        "product_revision":"1.00","vendor_specific":"XX00000",
+                        "firmware_date":"200001010000"},
+                        "signature":"bbbbbbbb","firmware":""}
+                ]
+            })
+            .to_string(),
+        )
+        .unwrap();
+
+        let mut id = make_drive_id("TIE", "1.00", "XX00000", "200001010000");
+        id.product_id = "MODEL-B".to_string();
+        let m = find_by_drive_id(&profiles, &id).unwrap();
+        assert_eq!(
+            m.profile.signature,
+            [0xbb, 0xbb, 0xbb, 0xbb],
+            "product_id must select MODEL-B over the first entry"
+        );
+
+        // No product_id → falls back to the 4-field pass → first entry.
+        let id0 = make_drive_id("TIE", "1.00", "XX00000", "200001010000");
+        let m0 = find_by_drive_id(&profiles, &id0).unwrap();
+        assert_eq!(m0.profile.signature, [0xaa, 0xaa, 0xaa, 0xaa]);
+    }
+
     #[test]
     fn test_find_known_drive() {
         let profiles = load_bundled().unwrap();
@@ -512,14 +558,12 @@ mod tests {
         );
     }
 
-    /// find_by_drive_id: loose match (no date) still works when an entry has
-    /// the same vendor/revision/vs but an unknown firmware_date.
-    /// Mutation: making the loose pass require a date match means "no date" drives
-    ///           always return None even though a same-model profile exists.
+    /// find_by_drive_id: a drive whose firmware_date does NOT match any profile
+    /// gets no match — there is no loose vendor/rev/vs fallback that could bind
+    /// the wrong same-model variant.
     #[test]
-    fn find_by_drive_id_loose_match_when_date_unknown() {
+    fn find_by_drive_id_no_match_when_date_differs() {
         use serde_json::json;
-        // "LOOSEDR " fills 8 bytes; trim() → "LOOSEDR".
         let profiles_json = json!({
             "mt1959_a": [
                 {
@@ -537,15 +581,9 @@ mod tests {
         .to_string();
         let profiles: Profiles = serde_json::from_str(&profiles_json).unwrap();
 
-        // Drive with an unknown firmware date — no exact match, loose match should work.
-        // "LOOSEDR " fills 8 bytes; "000000000000" is the unknown date.
+        // Same vendor/rev/vs but a different date — must NOT match.
         let id = make_drive_id("LOOSEDR ", "2.00", "YY11111", "000000000000");
-        let m = find_by_drive_id(&profiles, &id).unwrap();
-        assert_eq!(
-            m.profile.signature,
-            [0xde, 0xad, 0xbe, 0xef],
-            "loose match must bind the same-model profile when date differs"
-        );
+        assert!(find_by_drive_id(&profiles, &id).is_none());
     }
 
     /// load_from_str (via load_bundled) returns ProfileParse on invalid JSON.

src/lib.rs

@@ -21,6 +21,9 @@ mod css;
 // [`all_unlockers`]. `aacs` and `css` carry no such public catalog, so they
 // stay fully private.
 pub mod ld;
+// `renesis` is public for its `is_renesas` drive-probe; the unlocker impl
+// (`Renesis`) is `pub(crate)` — reached only through [`all_unlockers`].
+pub mod renesis;
 
 use scsi::ScsiTransport;
 
@@ -29,6 +32,7 @@ use scsi::ScsiTransport;
 #[derive(Debug, Clone, Default)]
 pub struct DriveId {
     pub vendor_id: String,
+    pub product_id: String,
     pub product_revision: String,
     pub vendor_specific: String,
     pub firmware_date: String,
@@ -111,22 +115,39 @@ pub enum UnlockError {
 /// here — that is the consumer's concern, not bus removal.
 pub trait Unlocker: Send + Sync {
     /// Short, stable identifier for this unlocker (e.g. "LibreDrive", "AACS",
-    /// "CSS"). The ONE place a name lives — apps render the unlocker report from
-    /// [`all_unlockers`], never hardcoding names, so adding/removing an unlocker
-    /// updates every report with no app change.
+    /// "DVD", "Renesas"). The ONE place a name lives — apps render the unlocker
+    /// report from [`all_unlockers`], never hardcoding names, so adding/removing
+    /// an unlocker updates every report with no app change.
     fn name(&self) -> &'static str;
 
-    /// True if this unlocker applies to the given context (drive id + disc kind)
-    /// during live dispatch — the gate [`crate::all_unlockers`] uses to decide
-    /// whether to RUN it.
-    fn matches(&self, ctx: &UnlockCtx) -> bool;
-
-    /// Remove the bus-encryption barrier, returning what was learned.
-    fn unlock(
+    /// Unlock DRIVE FEATURES — riplock/speed, OEM Volume ID, OEM extended-access
+    /// reads. The consumer runs this at drive-prep, trying each unlocker until
+    /// one handles the drive. `Ok(_)` = this unlocker handled it (LibreDrive also
+    /// removes bus encryption at the drive, so its result carries
+    /// `drive_unlocked: true`); `Err(NotApplicable)` = not this unlocker's drive;
+    /// `Err(Transport)` = dead bus (the consumer aborts). Default: not provided.
+    fn unlock_features(
         &self,
         scsi: &mut dyn ScsiTransport,
         ctx: &UnlockCtx,
-    ) -> std::result::Result<Unlocked, UnlockError>;
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        let _ = (scsi, ctx);
+        Err(UnlockError::NotApplicable)
+    }
+
+    /// Remove BUS ENCRYPTION for the mounted disc (AACS host-cert handshake, or
+    /// CSS scrambled-sector auth). The consumer runs this only when the bus isn't
+    /// already clear, trying each unlocker until one handles it. Same `Ok` /
+    /// `Err(NotApplicable)` / `Err(Transport)` contract as [`unlock_features`].
+    /// Default: not provided.
+    fn unlock_bus(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        let _ = (scsi, ctx);
+        Err(UnlockError::NotApplicable)
+    }
 }
 
 /// Name of the unlocker that claims this drive by identity (for drive-info "is
@@ -144,7 +165,8 @@ pub fn unlocker_name(drive_id: &DriveId) -> Option<&'static str> {
 pub fn all_unlockers() -> Vec<Box<dyn Unlocker>> {
     vec![
         Box::new(ld::LibreDrive::new()),
+        Box::new(renesis::Renesis::new()),
         Box::new(aacs::AacsCert::new()),
-        Box::new(css::CssUnlocker::new()),
+        Box::new(css::DvdUnlocker::new()),
     ]
 }

src/renesis.rs

@@ -0,0 +1,202 @@
+//! renesis — Renesas-platform detection (Pioneer + HL-DT-ST Renesas drives).
+//!
+//! Optical drives split into two controller families: MediaTek (handled by
+//! [`crate::ld`]) and Renesas. This module identifies the Renesas side via a
+//! single vendor identity probe (see [`is_renesas`]) and reports the match so a
+//! Renesas drive is named honestly. It does not modify drive state; AACS bus
+//! decryption is handled by the host cert.
+
+use crate::scsi::{DataDirection, ScsiTransport};
+use crate::{UnlockCtx, UnlockError, Unlocked, Unlocker};
+
+/// READ_BUFFER mode 0x02, buffer 0xF1 — the Renesas vendor identity buffer.
+const RB_F1_CDB: [u8; 10] = [0x3C, 0x02, 0xF1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00];
+const RB_F1_LEN: usize = 48;
+/// The ASCII interface marker a Renesas controller returns at `[16..19]`.
+const RENESAS_MARKER: &[u8] = b"SAT";
+const RENESAS_MARKER_OFFSET: usize = 16;
+
+/// True if `scsi` is a Renesas-platform drive (Pioneer or HL-DT-ST Renesas).
+///
+/// Issues the vendor READ_BUFFER 0x02/0xF1 probe: a Renesas controller serves a
+/// 48-byte identity block whose bytes `[16..19]` are the ASCII `SAT` interface
+/// tag. A MediaTek drive rejects it (ILLEGAL REQUEST → `Err`), and a transport
+/// fault also yields `Err`; both return `false`. This is the definitive
+/// Renesas-vs-MediaTek split.
+pub fn is_renesas(scsi: &mut dyn ScsiTransport) -> bool {
+    let mut buf = [0u8; RB_F1_LEN];
+    match scsi.execute(&RB_F1_CDB, DataDirection::FromDevice, &mut buf, 5_000) {
+        Ok(r) => {
+            let end = RENESAS_MARKER_OFFSET + RENESAS_MARKER.len();
+            r.status == 0
+                && r.bytes_transferred >= end
+                && &buf[RENESAS_MARKER_OFFSET..end] == RENESAS_MARKER
+        }
+        Err(_) => false,
+    }
+}
+
+/// The Renesas-platform unlocker. `pub(crate)` — reached only through
+/// [`crate::all_unlockers`].
+pub(crate) struct Renesis;
+
+impl Renesis {
+    pub(crate) fn new() -> Self {
+        Renesis
+    }
+}
+
+impl Unlocker for Renesis {
+    fn name(&self) -> &'static str {
+        "Renesas"
+    }
+
+    /// Report whether the drive is a Renesas platform. On a match, returns `Ok`
+    /// with `drive_unlocked: false` — the drive is recognized but its state is
+    /// not modified here (AACS bus decryption is handled by the host cert). A
+    /// non-Renesas drive → `NotApplicable`.
+    fn unlock_features(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        _ctx: &UnlockCtx,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        if !is_renesas(scsi) {
+            return Err(UnlockError::NotApplicable);
+        }
+        tracing::debug!(
+            target: "freemkv::disc",
+            phase = "renesas_recognized",
+            "Renesas drive recognized; bus handled by cert"
+        );
+        Ok(Unlocked {
+            vid: None,
+            bus_key: None,
+            drive_unlocked: false,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::DiscKind;
+    use crate::scsi::{DataDirection, Result, ScsiError, ScsiResult, ScsiTransport};
+
+    /// Serves a fixed READ_BUFFER payload (Renesas-like) with a Good status.
+    struct RenesasTransport {
+        payload: Vec<u8>,
+    }
+    impl ScsiTransport for RenesasTransport {
+        fn execute(
+            &mut self,
+            _cdb: &[u8],
+            _dir: DataDirection,
+            data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> Result<ScsiResult> {
+            let n = self.payload.len().min(data.len());
+            data[..n].copy_from_slice(&self.payload[..n]);
+            Ok(ScsiResult {
+                status: 0,
+                bytes_transferred: n,
+                sense: [0u8; 32],
+            })
+        }
+    }
+
+    /// Rejects the command (a MediaTek drive → ILLEGAL REQUEST → transport `Err`).
+    struct RejectingTransport;
+    impl ScsiTransport for RejectingTransport {
+        fn execute(
+            &mut self,
+            _cdb: &[u8],
+            _dir: DataDirection,
+            _data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> Result<ScsiResult> {
+            Err(ScsiError {
+                status: crate::scsi::SCSI_STATUS_CHECK_CONDITION,
+                sense: None,
+            })
+        }
+    }
+
+    fn renesas_payload() -> Vec<u8> {
+        // 48-byte RB 0xF1 block with "SAT" at [16..19] (the real S13JX shape).
+        let mut p = vec![0x20u8; 48];
+        p[16..19].copy_from_slice(b"SAT");
+        p
+    }
+
+    #[test]
+    fn is_renesas_true_on_sat_marker() {
+        let mut t = RenesasTransport {
+            payload: renesas_payload(),
+        };
+        assert!(is_renesas(&mut t));
+    }
+
+    #[test]
+    fn is_renesas_false_when_command_rejected() {
+        let mut t = RejectingTransport;
+        assert!(!is_renesas(&mut t));
+    }
+
+    #[test]
+    fn is_renesas_false_on_missing_marker() {
+        // Good status but no "SAT" at [16..19] (e.g. a stray buffer).
+        let mut t = RenesasTransport {
+            payload: vec![0u8; 48],
+        };
+        assert!(!is_renesas(&mut t));
+    }
+
+    #[test]
+    fn is_renesas_false_on_short_response() {
+        // Fewer than 19 bytes returned — can't carry the marker.
+        let mut t = RenesasTransport {
+            payload: vec![0x20u8; 8],
+        };
+        assert!(!is_renesas(&mut t));
+    }
+
+    #[test]
+    fn features_report_match_without_bus_removal_on_renesas() {
+        let mut t = RenesasTransport {
+            payload: renesas_payload(),
+        };
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Unknown, &[]);
+        // Recognized → Ok, but a feature-only unlock: bus NOT removed, no VID.
+        let u = Renesis::new()
+            .unlock_features(&mut t, &ctx)
+            .expect("renesas → Ok");
+        assert!(
+            !u.drive_unlocked,
+            "renesis does not remove the bus (cert does)"
+        );
+        assert_eq!(u.vid, None);
+        assert_eq!(u.bus_key, None);
+    }
+
+    #[test]
+    fn features_not_applicable_on_non_renesas() {
+        let mut t = RejectingTransport;
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Unknown, &[]);
+        let err = Renesis::new().unlock_features(&mut t, &ctx).unwrap_err();
+        assert_eq!(err, UnlockError::NotApplicable);
+    }
+
+    #[test]
+    fn does_not_provide_bus_removal() {
+        // Renesas leaves bus encryption to the cert: unlock_bus is the default.
+        let mut t = RenesasTransport {
+            payload: renesas_payload(),
+        };
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Aacs, &[]);
+        let err = Renesis::new().unlock_bus(&mut t, &ctx).unwrap_err();
+        assert_eq!(err, UnlockError::NotApplicable);
+    }
+}