v1.7.4: bump version (unified release)

Replace comment/leak/identity guard workflows with thin callers into
freemkv/.github reusable guards (guard-comment/leak/identity @v1); fork
PRs still run, same-repo pushes aren't double-run. Delete now-unused
local ci/comment-guard.py and ci/leak-guard.sh. Add top-level
concurrency (cancel-in-progress) to ci.yml and qa.yml and standardize
actions/checkout to @v5.

.github/dependabot.yml

@@ -0,0 +1,63 @@
+version: 2
+
+# Dependency updates land on `dev`, never on `main`.
+#
+# `main` here is a RELEASE POINTER that release.sh moves to each tag. A bot
+# commit on it would put work there that no tag contains, which is exactly the
+# state that aborted the 1.6.2 cascade at the last step -- so pointing
+# Dependabot at main would recreate that failure on a schedule.
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    # One PR per week for the routine bumps instead of one per crate. Eight
+    # repos times a handful of crates is a volume nobody reads, and an
+    # unread PR queue is indistinguishable from no updates at all.
+    groups:
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # The freemkv crates depend on each other by GIT TAG, re-pinned by
+      # release.sh as part of the release commit. Dependabot cannot see that
+      # cascade, so a PR bumping one of these would fight the release process
+      # and could pin a version whose tag does not exist yet.
+      - dependency-name: freemkv-unlock
+      - dependency-name: libfreemkv
+      - dependency-name: freemkv-keysources
+      - dependency-name: freemkv-i18n
+      - dependency-name: freemkv-engine
+
+  # The workflows are now real infrastructure -- the release cascade, the
+  # cross-platform hash matrix, the disc gate -- so their actions need the same
+  # attention as the crates.
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: dev
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      actions:
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # NOT a dependency: `dtolnay/rust-toolchain` is versioned by the RUST
+      # release it installs, and the tag we pin is the toolchain CI is pinned
+      # to on purpose -- precommit.sh runs the same one locally so a lint that
+      # passes on a developer's newer default cannot pass CI by accident.
+      #
+      # Dependabot reads those tags as semver and proposed 1.97.0 -> 1.100.0,
+      # a Rust version that does not exist. Every such PR 404s on toolchain
+      # download across all eight repos, and they regenerate weekly -- eight
+      # permanently-red PRs that promote.yml then has to special-case when it
+      # decides whether dev is green.
+      #
+      # Bumping the toolchain is a deliberate, all-eight-repos change, made by
+      # hand together with precommit.sh. There is nothing here for a bot.
+      - dependency-name: dtolnay/rust-toolchain

.github/workflows/ci.yml

@@ -0,0 +1,208 @@
+name: CI
+
+on:
+  push:
+    # dev -> qa -> main. `dev` is where work lands and is meant to be pushed
+    # to often: these are the FAST checks, so a mistake surfaces in minutes.
+    # `qa` is the release candidate — it runs these too, plus the expensive
+    # suite in qa.yml. `main` only ever moves at release time, to a tagged
+    # commit that was already green on qa.
+    branches: [main, dev, qa]
+  pull_request:
+
+# Rapid dev pushes supersede their own in-progress runs instead of stacking.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# freemkv-unlock is the BASE of the whole ecosystem: libfreemkv path-deps it,
+# bdemu path-deps it with the `emulation` feature, and every other crate pulls
+# it in transitively. It has no freemkv dependencies of its own, so no sibling
+# checkout is needed here — but it is also the crate whose breakage takes all
+# seven others down with it, which is why it gets the full OS matrix rather
+# than a token Linux run.
+#
+# Cargo.lock is now committed (issue #15), so the resolved dependency graph is
+# recorded and the `deny` job audits it. `--locked` is still deliberately NOT
+# used, matching the binary crates' ci.yml: CI's sibling path-patch layout
+# resolves the freemkv crates as path packages, which `--locked` can't satisfy.
+
+jobs:
+  # ── Single source of truth for the MSRV ─────────────────────────────────────
+  #
+  # `rust-version` in Cargo.toml is the ONE place the MSRV is declared. This job
+  # reads it; every job that must build/test AT the MSRV consumes
+  # `needs.resolve-msrv.outputs.v` instead of a hardcoded pin, so the floor
+  # cannot drift out of sync across workflow files. The `test` job building
+  # green at this value IS the verification that the declared MSRV is real.
+  # clippy deliberately does NOT use it — it runs on `stable` (lint debt is
+  # caught against current Rust).
+  resolve-msrv:
+    runs-on: ubuntu-latest
+    outputs:
+      v: ${{ steps.msrv.outputs.v }}
+    steps:
+      - uses: actions/checkout@v5
+      - id: msrv
+        shell: bash
+        run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
+
+  # CI owns the changelog: main may never carry a released version without a
+  # CHANGELOG.md entry for it. The release orchestrator dates an existing
+  # `## [X.Y.Z]` heading — it does NOT invent one — so a version bump that
+  # forgot its changelog entry must fail here rather than ship a blank release.
+  # Hard-fails on main (and PRs targeting main); warns elsewhere so an
+  # in-progress dev/qa branch whose entry isn't written yet is not blocked.
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Require a CHANGELOG entry for the crate version on main
+        shell: bash
+        run: |
+          set -euo pipefail
+          version=$(grep -m1 '^version = ' Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')
+          if grep -qE "^## \[${version}\]" CHANGELOG.md; then
+            echo "CHANGELOG.md has an entry for ${version}."
+            exit 0
+          fi
+          msg="CHANGELOG.md has no '## [${version}]' entry"
+          if [ "${GITHUB_REF_NAME:-}" = "main" ] || [ "${GITHUB_BASE_REF:-}" = "main" ]; then
+            echo "::error::${msg} — main requires a changelog entry for the released version."
+            exit 1
+          fi
+          echo "::warning::${msg} (allowed on ${GITHUB_REF_NAME:-unknown}; required before it can reach main)."
+
+  lint:
+    needs: resolve-msrv
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      # fmt runs on the pinned MSRV toolchain; clippy runs on stable. Linting on
+      # stable makes new-lint debt a BLOCKING gate the pinned version would
+      # otherwise hide. The MSRV pin is installed second so it stays the default
+      # toolchain (fmt uses it implicitly); clippy is invoked with `+stable`.
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ needs.resolve-msrv.outputs.v }}
+          components: rustfmt
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo fmt --check
+      # --all-targets so the test code is linted too, not just the library.
+      - run: cargo +stable clippy --all-targets -- -D warnings
+
+  test:
+    needs: resolve-msrv
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ needs.resolve-msrv.outputs.v }}
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo test --tests
+      # `emulation` is off by default and is the face bdemu builds against. A
+      # feature nothing compiles is a feature that breaks at release time.
+      - run: cargo test --tests --features emulation
+
+  # Coverage is additive and NON-REQUIRED: it uploads to Codecov but never
+  # gates a merge (fail_ci_if_error is false, and it is not wired into any
+  # release gate). It mirrors the `test` job's environment — same pinned
+  # toolchain, ubuntu-latest, no `if:` so it runs on every branch and PR just
+  # as `test` does. `--locked` is intentionally omitted to match this crate's
+  # policy (Cargo.lock is committed but --locked can't satisfy the path-patch layout).
+  coverage:
+    needs: resolve-msrv
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ needs.resolve-msrv.outputs.v }}
+          components: llvm-tools-preview
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-coverage
+      - uses: taiki-e/install-action@cargo-llvm-cov
+      - run: cargo llvm-cov --workspace --ignore-run-fail --lcov --output-path lcov.info
+      - uses: codecov/codecov-action@v7
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: lcov.info
+          slug: freemkv/freemkv-unlock
+          fail_ci_if_error: false
+
+  # cargo-deny gates the RESOLVED dependency graph: RUSTSEC advisories, a
+  # permissive licence allow-list, and source/ban hygiene. It mirrors the
+  # `test` job's checkout (single root checkout, no siblings) and runs on
+  # `stable` — advisory/licence debt is caught against current Rust, not the
+  # MSRV pin — so no `needs: resolve-msrv`.
+  deny:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check advisories bans licenses sources
+          manifest-path: Cargo.toml
+
+  # The crate ships on macOS and Windows through its consumers, so it has to
+  # compile there. Build the tests (not just `cargo check`) — that forces
+  # codegen and catches errors in test-only code, which `check` skips.
+  check-macos:
+    # dev is the FAST lane: this job still runs, but on the release-candidate
+    # branches rather than on every push to dev. Nothing is deleted and no
+    # platform stops being checked before a release -- qa.yml independently
+    # covers macOS and Windows, and the jobs unique to this file (the Intel
+    # macOS build, the Windows release build) run here on qa and main. A push
+    # to dev is meant to be cheap and frequent; waiting on three runner pools
+    # to agree is what a release candidate is for.
+    #
+    # `if` SKIPS the job (it does not queue). A queued job would be far worse
+    # than a slow one: a never-scheduled job leaves the run pending forever, so
+    # the branch's required checks never report complete.
+    needs: resolve-msrv
+    if: github.ref_name == 'qa' || github.ref_name == 'main'
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ needs.resolve-msrv.outputs.v }}
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo build --tests --all-features
+
+  check-windows:
+    # dev is the FAST lane: this job still runs, but on the release-candidate
+    # branches rather than on every push to dev. Nothing is deleted and no
+    # platform stops being checked before a release -- qa.yml independently
+    # covers macOS and Windows, and the jobs unique to this file (the Intel
+    # macOS build, the Windows release build) run here on qa and main. A push
+    # to dev is meant to be cheap and frequent; waiting on three runner pools
+    # to agree is what a release candidate is for.
+    #
+    # `if` SKIPS the job (it does not queue). A queued job would be far worse
+    # than a slow one: a never-scheduled job leaves the run pending forever, so
+    # the branch's required checks never report complete.
+    needs: resolve-msrv
+    if: github.ref_name == 'qa' || github.ref_name == 'main'
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ needs.resolve-msrv.outputs.v }}
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: freemkv-unlock-ci
+      - run: cargo build --tests --all-features

.github/workflows/comment-guard.yml

@@ -0,0 +1,12 @@
+name: comment-guard
+
+# Thin caller → the canonical reusable guard in freemkv/.github (one definition
+# for every repo). Fork PRs still run it; same-repo pushes aren't double-run.
+on: [push, pull_request]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  comment-guard:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
+    uses: freemkv/.github/.github/workflows/guard-comment.yml@v1

.github/workflows/identity-guard.yml

@@ -0,0 +1,14 @@
+name: identity-guard
+
+# Thin caller → the canonical reusable guard in freemkv/.github.
+on:
+  push:
+    branches: [dev, qa, main]
+  pull_request:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  identity:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
+    uses: freemkv/.github/.github/workflows/guard-identity.yml@v1

.github/workflows/leak-guard.yml

@@ -0,0 +1,11 @@
+name: leak-guard
+
+# Thin caller → the canonical reusable guard in freemkv/.github.
+on: [push, pull_request]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  leak-guard:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
+    uses: freemkv/.github/.github/workflows/guard-leak.yml@v1

.github/workflows/qa.yml

@@ -0,0 +1,143 @@
+name: qa
+
+# ── The qa gate: "is this production worth?" ────────────────────────────────
+#
+# dev -> qa -> main.
+#
+# `dev` is for committing often. ci.yml answers "is it green" in minutes with
+# fmt, clippy and the unit suite, so a mistake surfaces while it is still cheap
+# to fix. `qa` is the release-candidate branch, and THIS workflow is the claim
+# that a commit is production worth: everything expensive that can run without
+# physical media. `main` only ever receives a qa that went green here.
+#
+# Sibling repos are checked out at `qa`, NOT `dev`. A qa run that resolved its
+# dependencies from dev tips would be validating a combination that is not the
+# one being released, which is the exact failure this branch exists to prevent.
+#
+# What this gate CANNOT cover: `disc://` and real `iso://` need physical media,
+# and no hosted runner has an optical drive or the image hoard. That coverage
+# lives in freemkv's qa.yml (the real-media EC2 matrix), not in this file.
+on:
+  push:
+    branches: [qa]
+  workflow_dispatch:
+
+# A re-push to qa supersedes its own in-progress run instead of stacking.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Single source of truth for the MSRV — see ci.yml. Jobs that build/test AT
+  # the MSRV read `needs.resolve-msrv.outputs.v` from Cargo.toml's rust-version;
+  # clippy (cross-lint) runs on stable instead.
+  resolve-msrv:
+    runs-on: ubuntu-latest
+    outputs:
+      v: ${{ steps.msrv.outputs.v }}
+    steps:
+      - uses: actions/checkout@v5
+      - id: msrv
+        shell: bash
+        run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
+
+  # ── Name the candidate ────────────────────────────────────────────────
+  #
+  # Every push to `qa` is a release candidate, so every push gets a tag:
+  # v<version>-rc<N>, N incrementing. That is the answer to "which build is on
+  # qa right now, and is it the one I tested?" — a question that otherwise gets
+  # answered from memory.
+  #
+  # This runs FIRST and does not depend on the gates, deliberately. A red
+  # candidate needs a name more than a green one does: "rc3 failed
+  # release-tests on windows" is a sentence you can act on; "qa is red" is not.
+  # Red on qa is a working gate, not an incident — it is the branch saying this
+  # is not production worth yet. Fix on dev, get dev green, push qa again.
+  #
+  # release.yml excludes v*-rc* so a candidate never publishes a release.
+  rc-tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Stamp the next rc
+        shell: bash
+        run: |
+          set -euo pipefail
+          v=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -1)
+          [ -n "$v" ] || { echo "no version in Cargo.toml" >&2; exit 1; }
+          # Numeric sort on the rc ordinal: -rc10 must beat -rc9, and a plain
+          # lexical sort gets that backwards from the tenth candidate on.
+          n=$(git tag -l "v$v-rc*" | sed "s|^v$v-rc||" | sort -n | tail -1)
+          tag="v$v-rc$(( ${n:-0} + 1 ))"
+          git tag "$tag"
+          git push origin "$tag"
+          echo "### Candidate \`$tag\`" >> "$GITHUB_STEP_SUMMARY"
+
+  # The debug suite runs on every dev push. Release is a DIFFERENT build:
+  # overflow checks are off, debug_assert! is compiled out, and inlining
+  # changes what the optimiser can prove. A test that only passes in debug is
+  # a test that never guarded the binary anyone actually ships.
+  release-tests:
+    needs: resolve-msrv
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ['ubuntu-latest', 'macos-latest']
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          path: freemkv-unlock
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ needs.resolve-msrv.outputs.v }}
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: freemkv-unlock
+      - run: cargo test --release --tests
+        working-directory: freemkv-unlock
+
+  # clippy's output is target-dependent: cfg-gated code only gets linted on
+  # the target it compiles for. Linting solely on the dev machine's host
+  # target is how a lint that CI rejects reaches a push.
+  cross-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          path: freemkv-unlock
+      # clippy runs on stable (matches ci.yml's lint job); build/test stay on
+      # the MSRV pin. See ci.yml for why the lint toolchain need not be the MSRV.
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: freemkv-unlock
+      - run: rustup target add x86_64-unknown-linux-gnu
+      - run: cargo clippy --all-targets --target x86_64-unknown-linux-gnu -- -D warnings
+        working-directory: freemkv-unlock
+
+  # Windows compiles the tests but does not run them, matching the policy
+  # ci.yml already set. The value here is codegen: the #[cfg(windows)] halves
+  # of the SCSI transport and platform layers compile on no other runner, so
+  # without this they are first built at release time.
+  windows-build:
+    needs: resolve-msrv
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          path: freemkv-unlock
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ needs.resolve-msrv.outputs.v }}
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: freemkv-unlock
+      - run: cargo build --release --tests
+        working-directory: freemkv-unlock

.gitignore

@@ -1,3 +1,3 @@
 /target
-Cargo.lock
 .cargo/config.toml
+NEXT_SESSION.md

CHANGELOG.md

@@ -1,5 +1,250 @@
 # Changelog
 
+## [1.7.4] — 2026-09-21
+### Maintenance
+
+- CI consolidated to the central reusable workflows; no functional changes.
+
+## [1.7.3] — 2026-09-19
+
+### Changed
+
+- firmware: mirror the fw 0.8.3 RESET ABI — added `RESET_TO_DEFAULTS` (`0x01`, restore the baked create-time defaults into RAM) and `FirmwareControl::reset_to_defaults()`; `RESET_TO_OEM` (`0xFF`) is now documented as TRUE OEM (RAM passthrough **and** the NV block blanked to all-`0xFF`, so the drive is traceless), and `RESET_TO_FLASH` as marker-gated (a never-saved drive loads the defaults). Wire values unchanged.
+
+## [1.7.2] — UNRELEASED
+
+### Fixed
+
+- `FreemkvUnlocker::set` now issues the vendor SET over the required 64-byte data-in phase (mirroring `FirmwareControl::set`). freemkv firmware 0.8.x aborts a SET sent with no data phase (CHECK CONDITION / Aborted Command), so every drive-feature SET failed — including the load-bearing `Set(Ake, off)` — and the freemkv firmware unlock silently fell back to the AACS/online-key route. Drives on freemkv firmware now unlock via the freemkv route again (hardware-confirmed on BU40N fw 0.8.1).
+
+### Changed
+
+- firmware: mirror ABI v2 — `Save` + `RESET`-to-flash/OEM modes, the region/speed value encodings, and the HRL/AKE/BUS `off = unlock` (`0x00`) polarity; `full_unlock`'s default profile flipped to match. Aligns `FirmwareControl` with freemkv firmware 0.8.0.
+
+## [1.7.1] — 2026-09-14
+
+### Added
+
+- freemkv firmware: `full_unlock` now issues a trailing best-effort Raw Read `04 03` (data-clear / bus-off) after the VID read, so an unlocked drive is placed in bus-off mode and subsequent content `READ(10)`s return AACS-at-rest bytes without the in-transit AACS bus wrap. A no-op on firmware without the `04 03` lever and never discards an obtained unlock, so it is inert until the firmware side ships. Also exposed as `set_bus_off`.
+
+### Fixed
+
+- `ld/profile`: `find_by_drive_id` now binds a UNIQUE four-field identity match even when the drive reports a specific `product_id` the catalog stores generically (drive reports "BD-RE BU40N", catalog "BD-RE"). The 1.7.0 gating on an empty product id broke LibreDrive unlock on UHD-capable LG BU40N drives; this restores it.
+
+## [1.7.0] — 2026-09-02
+
+### Added
+
+- Preliminary, beta unlocking support for **Renesas** optical drives and for drives running **freemkv firmware**. Both are early and unvalidated; the established LibreDrive / AACS / CSS unlock routes are unchanged.
+
+### Fixed
+
+- `ld/profile`: `find_by_drive_id` no longer mis-binds a drive whose reported `product_id` is real but not catalogued to a sibling model's profile. The product-id-blind loose match is now gated on an empty product id, so a wrong profile — and its wrong LibreDrive microcode — can't be selected for a drive that does report a product id.
+
+### Changed
+
+- Version aligned to 1.7.0 for the unified release.
+
+## [1.6.14] — 2026-08-31
+
+### Changed
+
+- Version aligned to 1.6.14 for the unified release.
+
+## [1.6.13] — 2026-08-28
+
+### Changed
+
+- Version aligned to 1.6.13 for the unified release.
+
+## [1.6.12] — 2026-08-27
+
+### Changed
+
+- Version aligned to 1.6.12 for the unified release; no functional changes.
+
+## [1.6.11] — 2026-08-26
+
+### Changed
+
+- Version aligned to 1.6.11 for the unified release. No functional changes to
+  this crate; the release was driven by the libfreemkv main-feature selection
+  improvements and the autorip mux-quarantine fix (see the libfreemkv and
+  autorip 1.6.11 notes).
+
+### Added
+
+- Codecov coverage reporting and badge.
+- Substantially expanded unit-test coverage.
+
+## [1.6.10] — 2026-08-23
+
+### Changed
+
+- Version aligned to 1.6.10 for the unified release. No functional changes to
+  this crate; the release was driven by libfreemkv (TrueHD/MLP audio now resyncs
+  to the next major-sync access unit after a source transport-stream
+  discontinuity, instead of splicing post-gap audio mid-stream — fixing
+  decoder-choking seams on discs whose stream carries a continuity-counter gap;
+  see the libfreemkv 1.6.10 notes).
+- MSRV lowered from 1.97 to 1.90. The crate does not use anything newer than
+  1.90 stabilized; CI's pinned toolchain and `rust-version` are updated to
+  match.
+
+## [1.6.9] — 2026-08-22
+
+### Changed
+
+- Version aligned to 1.6.9 for the unified release. No functional changes to
+  this crate; the release was driven by autorip (automatic per-episode TV
+  ripping — each episode named `S{NN}E{MM}`, with TMDB runtime-aligned episode
+  numbering across multi-disc seasons — a Manual Rename option, and a unified
+  per-disc staging state file — see the autorip 1.6.9 notes).
+
+## [1.6.8] — 2026-08-21
+
+### Changed
+
+- Version aligned to 1.6.8 for the unified release. No functional changes to
+  this crate; the release was driven by autorip (webhooks now fire per pipeline
+  stage — Rip / Mux / Move — with the Rip hook firing the moment the drive is
+  free again, plus a Ripper-tab activity-banner fix so it also shows during
+  moves — see the autorip 1.6.8 notes).
+
+## [1.6.7] — 2026-08-21
+
+### Changed
+
+- Version aligned to 1.6.7 for the unified release. No functional changes to
+  this crate; the release was driven by autorip (per-webhook event selection,
+  a progress bar per moved artifact, and move-queue / webhook-error fixes —
+  see the autorip 1.6.7 notes).
+
+## [1.6.6] — 2026-08-20
+
+### Changed
+
+- Version aligned to 1.6.6 for the unified release. No functional changes
+  to this crate; the release was driven by autorip (webhooks may now target
+  private/LAN addresses — see the autorip 1.6.6 notes).
+
+## [1.6.5] — 2026-08-20
+
+### Added
+
+- **AACS 2.0 (P-256) drives now complete a live host-certificate
+  handshake.** The elliptic-curve (P-256) authentication path is wired
+  into the cert handshake for real, not left as dead code. A drive is
+  first tried with the AACS 1.0 certificate (a 2.0 drive accepts it for
+  the Volume ID); if the drive refuses it and the supplied host
+  certificate carries AACS 2.0 credentials, the crate falls back to the
+  native P-256 handshake. It is cert-agnostic — it uses whatever the host
+  certificate carries, with no separate feature gate — and a bus fault on
+  the 1.0 attempt short-circuits the fallback so a dead bus is not
+  hammered. The 2.0 path enforces the same chain-of-trust checks as the
+  1.0 path (drive-cert type gate, fatal certificate verification under the
+  real 2.0 Licensing Administrator key, on-curve validation of every
+  attacker-supplied point, and AGID release on every exit). The 2.0
+  certificate byte layout is documented as provisional pending a genuine
+  drive certificate to pin it against; a wrong layout fails closed and
+  never trusts.
+
+### Security
+
+- **A rogue drive or bridge can no longer forge its way to a trusted bus
+  key.** A drive certificate whose type was neither AACS 1.0 nor 2.0 used
+  to skip Licensing Administrator verification yet still have its own key
+  trusted for the bus-key signature check, letting an attacker inject a
+  chosen bus key; unknown cert types are now rejected at the type gate
+  before any key is trusted. ECDSA verification now validates the signer's
+  public key (on-curve, in-field, not the identity point) before use — a
+  key of (0,0) previously collapsed verification to a forgeable form. The
+  compiled-in AACS 1.0 and 2.0 Licensing Administrator anchor keys, which
+  were off-curve, are replaced with the real published keys (both
+  confirmed on-curve; the 1.0 key verifies a genuine LA-signed
+  certificate). The P-256 certificate-length check now matches the real
+  132-byte layout, so AACS 2.0 certificates verify at all.
+
+- **Sensitive material no longer leaks through debug output.** `Unlocked`
+  (which carries the bus key and Volume ID) and `DriveProfile` (which
+  carries the MediaTek drive firmware image and per-drive vendor SCSI
+  templates) now use hand-written redacting `Debug` implementations
+  instead of printing everything. The AACS 2.0 authentication path now
+  releases the drive AGID on every failure exit, matching the 1.0 path.
+
+### Fixed
+
+- **A dead or failing drive bus is no longer reported as a successful
+  unlock.** A transport fault during the AACS data-key read, during
+  firmware-unlock disc probing, and in both MediaTek speed-probe passes
+  used to be swallowed or flattened into a generic failure — in the
+  firmware-unlock case surfacing as `drive_unlocked: true` on a bus that
+  had actually died. These paths now abort with a transport error so the
+  fault is visible instead of masquerading as clear content.
+
+- **Transport faults are no longer misclassified as "wrong drive" or
+  "bad credentials."** A dead bus on the first probe command previously
+  read as "not a Renesas drive" or "not a supported DVD profile"; a bus
+  that died mid-handshake was reported as a credentials rejection after
+  three retries against dead hardware; and CSS bus-auth collapsed every
+  fault into a generic auth failure. Each call site now honours the
+  transport contract — abort on a real bus fault, fall through only on a
+  genuine "not applicable." A merely short probe response is no longer
+  fabricated into a transport failure, so rips that would have succeeded
+  are no longer aborted.
+
+- **A half-unlocked drive now falls through to certificate
+  authentication instead of claiming the bus is clear.** The firmware
+  unlocker set `drive_unlocked: true` whenever the handshake merely
+  completed, ignoring the computed unlock flag; a drive returning zero
+  bytes could even report a full unlock from a buffer it never wrote.
+  The unlock outcome is now actually consulted, so a partial unlock
+  correctly steers to the cert-auth fallback. Related read paths that
+  parsed the caller's own zero-filled buffer as drive data on a CHECK
+  CONDITION are fixed to inspect status and bytes transferred.
+
+### Changed
+
+- **Drive preparation issues 88 fewer SCSI commands per disc.** The
+  probe's two passes previously walked the same 88 addresses twice; the
+  redundant pass is removed.
+
+## [1.6.4] — 2026-08-15
+
+### Changed
+
+- **No functional change.** This crate ships alongside the rest of freemkv at a
+  matching version; its behaviour is untouched.
+
+## [1.6.3] — 2026-08-10
+
+### Changed
+
+- **Housekeeping only — nothing about how a drive is unlocked has changed.** The
+  cryptography and compression crates this crate builds on were moved to their
+  current releases and brought into line with the versions the rest of freemkv
+  uses, so one version of each is built instead of two.
+
+## [1.6.2] — 2026-08-08
+
+Version sync with the workspace. No functional change in this crate.
+
+## [1.6.1] — 2026-08-07
+
+Version sync with the workspace. No functional change in this crate.
+
+## [1.6.0] — 2026-08-03
+
+Version sync with the workspace. No functional change in this crate.
+
+## [1.5.2] — 2026-07-22
+
+### Changed
+
+- The DVD read-unlocker (bus-auth) is renamed `CSS` → `DVD`: it reports the
+  medium it unlocks, not whether a title-key crack ran. The unlocker report now
+  reads `DVD: yes` on any DVD.
+
 ## [1.4.1] — 2026-07-14
 
 Version sync with the workspace; inherits libfreemkv 1.4.1.

CODE_OF_CONDUCT.md

@@ -36,7 +36,7 @@ This Code of Conduct applies within all community spaces, and also applies when
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at owner@example.invalid. All complaints will be reviewed and investigated promptly and fairly.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported privately to the project maintainer via GitHub at https://github.com/MattJackson. All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the reporter of any incident.
 

CONTRIBUTING.md

@@ -0,0 +1,18 @@
+# Contributing
+
+Thanks for your interest!
+
+- **Report a bug** — open an issue
+- **Fix a bug** — fork, branch, PR
+- **Suggest a feature** — open an issue first
+
+## Development
+
+```bash
+cargo build
+cargo test
+```
+
+## License
+
+MIT

Cargo.lock

@@ -0,0 +1,421 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aes"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8eb277bec05f56a0e0591f155a484cbd0f4f07ff2905051a48c72f004f7ed58"
+dependencies = [
+ "cipher",
+ "cpubits",
+ "cpufeatures",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "rand_core",
+]
+
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+]
+
+[[package]]
+name = "freemkv-unlock"
+version = "1.7.4"
+dependencies = [
+ "aes",
+ "base64",
+ "num-bigint",
+ "num-traits",
+ "rand",
+ "serde",
+ "serde_json",
+ "sha1",
+ "sha2",
+ "tracing",
+ "zeroize",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "rand_core",
+]
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "num-bigint"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.4",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[patch.unused]]
+name = "freemkv-engine"
+version = "1.7.4"
+
+[[patch.unused]]
+name = "freemkv-i18n"
+version = "1.7.4"
+
+[[patch.unused]]
+name = "freemkv-keysources"
+version = "1.7.4"
+
+[[patch.unused]]
+name = "libfreemkv"
+version = "1.7.4"

Cargo.toml

@@ -1,8 +1,8 @@
 [package]
 name = "freemkv-unlock"
-version = "1.4.5"
+version = "1.7.4"
 edition = "2024"
-rust-version = "1.86"
+rust-version = "1.88"
 license = "MIT"
 description = "Unlock layer for the freemkv toolchain: the Unlocker contract + self-contained firmware/AACS/CSS unlocker modules. libfreemkv depends on this and dispatches via all_unlockers()."
 repository = "https://github.com/freemkv/freemkv-unlock"
@@ -18,11 +18,18 @@ emulation = []
 [dependencies]
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-base64 = "0.22.1"
+base64 = "0.23"
 tracing = "0.1"
-num-bigint = "0.4"
+num-bigint = "0.5"
 num-traits = "0.2"
-sha1 = "0.10"
-sha2 = "0.10"
-aes = "0.8"
-rand = "0.8"
+sha1 = "0.11"
+sha2 = "0.11"
+aes = "0.9"
+rand = "0.10"
+# Wipes host private keys, ephemeral scalars, and derived bus/volume/data-key
+# material on drop so it doesn't linger in freed memory (defence in depth atop
+# the redacting Debug impls). `derive` gives ZeroizeOnDrop for the key structs.
+zeroize = { version = "1", features = ["derive"] }
+
+[lints.clippy]
+uninlined_format_args = "allow"

NOTICE

@@ -0,0 +1,24 @@
+NOTICE — Third-Party Drive Microcode
+====================================
+
+freemkv-unlock's own source code is licensed under the MIT License (see LICENSE).
+The MIT License does NOT cover the drive-microcode payloads bundled in
+`src/ld/profiles.json`.
+
+Those payloads are volatile, RAM-only optical-drive microcode ("LibreDrive")
+authored and owned by the MakeMKV team (GuinpinSoft inc.). Each payload embeds
+its own copyright notice, e.g.:
+
+    "This is volatile RAM-only microcode for LibreDrive by MakeMKV -
+     http://www.makemkv.com/libredrive/
+     Copyright (c) MakeMKV team, all rights reserved."
+
+They are included solely to recognize supported drives and perform the
+non-persistent, RAM-only unlock in interoperation with MakeMKV's LibreDrive, on
+drives their owners already possess. They are third-party proprietary material —
+**Copyright (c) MakeMKV team, all rights reserved** — and are **NOT** licensed
+under MIT. No ownership is claimed or transferred.
+
+freemkv is an independent project, not affiliated with, endorsed by, or
+sponsored by MakeMKV / GuinpinSoft inc. With thanks to the MakeMKV team for
+LibreDrive. See https://www.makemkv.com/ and http://www.makemkv.com/libredrive/.

README.md

@@ -1,3 +1,7 @@
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+[![CI](https://github.com/freemkv/freemkv-unlock/actions/workflows/ci.yml/badge.svg)](https://github.com/freemkv/freemkv-unlock/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/freemkv/freemkv-unlock/branch/dev/graph/badge.svg)](https://codecov.io/gh/freemkv/freemkv-unlock)
+
 # freemkv-unlock
 
 The unlock layer for the freemkv toolchain.
@@ -14,9 +18,17 @@ clients of libfreemkv are oblivious to unlockers entirely (as they are to the
 SCSI layer).
 
 ```rust
+use freemkv_unlock::UnlockError;
+
+// Drive-prep: try each unlocker's feature unlock until one claims the drive.
+// `NotApplicable` means "not this unlocker's drive" — move on; a transport
+// error means a dead bus — abort. `unlock_bus` follows the same contract for
+// removing per-disc bus encryption.
 for u in freemkv_unlock::all_unlockers() {
-    if u.matches(&ctx) {
-        return u.unlock(&mut scsi, &ctx);
+    match u.unlock_features(&mut scsi, &ctx) {
+        Ok(unlocked) => return Ok(unlocked),
+        Err(UnlockError::NotApplicable) => continue,
+        Err(e) => return Err(e),
     }
 }
 ```
@@ -24,4 +36,13 @@ for u in freemkv_unlock::all_unlockers() {
 To remove an unlocker, delete its module directory and its one line in
 `all_unlockers()` — nothing else changes.
 
-License: MIT.
+## License
+
+freemkv-unlock's own source is MIT — see [LICENSE](LICENSE).
+
+`src/ld/profiles.json` bundles volatile, RAM-only **LibreDrive** microcode
+authored and owned by the **MakeMKV team** (GuinpinSoft inc.) — *Copyright (c)
+MakeMKV team, all rights reserved.* That microcode is third-party proprietary
+material, **not** covered by the MIT license; no ownership is claimed. See
+[`NOTICE`](NOTICE). With thanks to the MakeMKV team for
+[LibreDrive](http://www.makemkv.com/libredrive/).

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| 1.6.x   | Yes       |
+| < 1.6   | No        |
+
+Only the current 1.6.x line receives security fixes.
+
+## Reporting a vulnerability
+
+Report vulnerabilities privately through GitHub Security Advisories:
+https://github.com/freemkv/freemkv-unlock/security/advisories/new
+
+Do not open a public issue for a security report. Include the affected
+version, steps to reproduce, and the impact you believe the issue has.
+
+## Response time
+
+You will get an initial response within 7 days.

codecov.yml

@@ -0,0 +1,16 @@
+coverage:
+  status:
+    project:
+      default:
+        informational: true
+    patch:
+      default:
+        informational: true
+
+comment: false
+
+ignore:
+  - "tests"
+  - "**/tests"
+  - "benches"
+  - "examples"

deny.toml

@@ -0,0 +1,42 @@
+# cargo-deny — gates the RESOLVED dependency graph (issue #15).
+# Runs in CI against the committed Cargo.lock: RUSTSEC advisories, a permissive
+# licence allow-list, and source/ban hygiene. Update the lock (cargo update)
+# to clear an advisory rather than adding an `ignore` entry without cause.
+
+[advisories]
+yanked = "deny"
+# ignore = ["RUSTSEC-0000-0000"]  # only with a written justification
+
+[licenses]
+# The whole tree is permissive. r-efi's LGPL arm is satisfied by Apache-2.0
+# (its expression is "Apache-2.0 OR LGPL-2.1-or-later"), so no copyleft is
+# allowed here. Add a licence only when a real dependency introduces it.
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "0BSD",
+    "Unicode-3.0",
+    "Unlicense",
+    "Zlib",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "CDLA-Permissive-2.0",
+]
+confidence-threshold = 0.9
+
+[bans]
+multiple-versions = "warn"   # transitive dupes (digest 0.10/0.11 etc.) are noise, not a gate
+wildcards = "deny"
+# The freemkv siblings resolve as path deps under CI's path-patch layout, which
+# reads as a wildcard version req. That is internal, not a supply-chain wildcard.
+allow-wildcard-paths = true
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+# The freemkv siblings are first-party git-tag deps; allow git sources from
+# our own org only (CI resolves them as git, not the local path override).
+[sources.allow-org]
+github = ["freemkv"]

docs/aacs-handshake.md

@@ -0,0 +1,184 @@
+# AACS bus authentication handshake
+
+## Flow
+
+1. Invalidate AGIDs → allocate fresh AGID
+2. Send host certificate + nonce
+3. Receive drive certificate + nonce
+4. Receive drive key point + signature, verify
+5. Sign host key point, send
+6. ECDH: host_priv × drive_key_point → bus key (low 128 bits of x)
+7. Read VID or Read Data Keys (encrypted with bus key)
+
+## Why `scsi_read`/`scsi_write` check status at the seam
+
+The contract this crate is built on (`ScsiTransport::execute`) returns `Ok`
+on a SCSI sense and `Err` ONLY on a transport-layer fault. These two helpers
+used to propagate the `?` and nothing else — so a CHECK CONDITION (`Ok`,
+non-zero `status`) handed the caller back its own ZERO-FILLED buffer and
+every REPORT/SEND KEY step consumed zeros as valid drive data: a drive
+certificate of zeros, a key point of zeros, a Volume ID of zeros, all
+reported as success. It has not fired in production only because the sole
+transport implementor violates the contract in the opposite direction (it
+returns `Err` for any non-zero status). Plugging in a CONFORMING transport
+would have turned the whole handshake into a zero-buffer success, so the
+status and the transferred length are checked here, at the seam.
+
+## Why `scsi_write` shares this reasoning
+
+Same contract reasoning as `scsi_read`: a drive that REFUSES the host
+certificate answers with `Ok` + CHECK CONDITION, and treating that as a
+successful send carried the handshake on against a drive that never
+accepted it.
+
+## `ec_mul` design notes
+
+**Constant-time tradeoff:** this branches on `scalar.bit(0)` and clones
+BigUints per iteration, so its timing is data-dependent on the secret scalar
+(the long-term host private key in `ecdsa_sign`, the ephemeral key in ECDH).
+This is deliberate: the handshake runs once per disc against a local optical
+drive, so throughput and the narrow local-timing surface do not justify
+pulling in a vetted constant-time backend. Revisit if this ever signs in a
+remote/shared context.
+
+**Cofactor:** both AACS curves used here have cofactor 1, so a point that
+lies on the curve is automatically in the prime-order subgroup — no
+small-subgroup defense / `n·P == O` check is required for the inputs this is
+called with.
+
+## `verify_cert_p256` — provisional AACS 2.0 cert layout
+
+Verifies an AACS 2.0 drive certificate (type 0x11) against an AACS 2.0 LA
+key. PROVISIONAL LAYOUT — the byte offsets below are NOT yet confirmed
+against a genuine AACS 2.0 cert, and no such cert exists on this machine to
+pin them (an exhaustive hunt found only 2.0 *content* certs, a different
+format; a real host/drive AKE cert needs a live USB/SCSI capture). What IS
+confirmed: first, the P-256/SHA-256 ECDSA primitive and curve constants are
+correct (`ecdsa_verify_p256_verifies_a_genuine_aacs2_content_cert` verifies a
+real 2.0 content cert under the published CC key); second, the 132-byte
+4-byte-header framing MATCHES the step-6 drive-key message (x[4..36] /
+y[36..68] / r[68..100] / s[100..132]), the natural 20→32-byte scaling of the
+established AACS 1.0 84-byte key-message framing.
+
+What is NOT confirmed: that a *certificate* shares that framing. No known
+implementation verifies 2.0 certs against a confirmed layout (the published
+spec draft leaves that format ambiguous), and the AACS 2.0 draft architecture
+lists the 2.0 host cert (type 0x12) with a 6-byte Host ID + a NEW 4-byte
+paired-Device-Key-Set field before the 64-byte public key — implying a
+~140–144-byte cert with the pubkey near offset 12–16 and a signed range of
+~76–80 bytes, NOT 68. The drive cert (type 0x11) has no paired-DKS field
+(~140 bytes, pubkey ~[12..76], signed ~first 76). So the offsets HERE
+(pubkey [4..68], signed [..68]) are a best-effort self-consistent
+placeholder, chosen to match the confirmed key message; they will almost
+certainly move when a real cert lands (see the `#[ignore]` real-cert slot).
+This matters for USEFULNESS, not SAFETY: a wrong signed range makes
+verification FAIL, and since the caller treats a verify failure as FATAL,
+the path fails CLOSED (rejects) rather than trusting anything — never the
+reverse.
+
+The `>= 132` guard keeps the `cert[100..132]` slice safe while letting a
+full-length cert reach verification (the old `>= 138` guard rejected every
+132-byte input unconditionally).
+
+The LA anchor is a PARAMETER, not the compiled-in constant, so a unit test
+can drive the whole chain under a test LA keypair (sign a synthetic drive
+cert, prove it is accepted / a bad-sig cert is rejected) without the real
+anchor's private half, which no one has. Production always threads
+`AACS2_LA_PUB_X/Y` from `aacs2_authenticate_p256`.
+
+## Why an unknown drive-cert type must be rejected
+
+This used to be an `if` / `else if` with NO `else`, so an unknown type
+(e.g. 0x02) fell straight through: `is_aacs20` stayed false, so the step-6
+key-signature check still ran — against `cert_pub_key(drive_cert)`, the
+drive's OWN key lifted out of a cert that was never checked against the LA.
+A rogue USB bridge could set byte 0 to 0x02, present its own keypair, sign
+`host_nonce || drive_key_point`, and the handshake would return Ok with an
+attacker-chosen bus key. The chain of trust must not appear to have run
+when it did not.
+
+## AACS 2.0 chain-of-trust gate (`aacs2_authenticate_p256_with_agid`)
+
+The SAME shape the AACS 1.0 sibling (`aacs_authenticate_with_agid`)
+enforces, now MANDATORY because this path is live. Two distinct rejections,
+both BEFORE any drive key is trusted:
+
+**(a) Cert TYPE gate.** An AACS 2.0 drive cert is type 0x11. Anything else
+is unexpected on the native P-256 AKE and is REJECTED here, never allowed to
+fall through. The earlier `if type==0x11 && !verify` form left NO branch for
+a non-0x11 type: a rogue bridge could send a type-0x10 (or any) cert, skip
+verification entirely, and still reach the step-6 key check against
+`cert_pub_key_p256(drive_cert)` — its OWN key, lifted from a cert the LA
+never signed — winning an attacker-chosen bus key. The chain of trust must
+not merely LOOK like it ran.
+
+**(b) Cert VERIFY is FATAL.** A type-0x11 cert whose P-256/SHA-256 signature
+does not verify under the real 2.0 LA anchor (`AACS2_LA_PUB`, on-curve — see
+`la_anchor_keys_are_on_curve`) is REJECTED, not logged-and-continued.
+`ecdsa_verify_p256` range/curve-checks every point (`point_on_curve`), so a
+forged or off-curve cert key cannot slip past. The previous "non-fatal for
+backward compat" behaviour was the exact hole the SECURITY note demanded be
+closed before wiring.
+
+## `run_cert_handshake` — cert-agnostic AKE selection
+
+The AACS 1.0 host cert is always present and is tried FIRST: an AACS 2.0
+drive accepts a 1.0 host cert for backward compatibility, which is enough to
+learn the Volume ID. If the drive REFUSES the 1.0 cert (a plain cert-level
+rejection — NOT a dead or wedged bus) and THIS host cert also carries AACS
+2.0 (P-256) credentials, fall back to the native P-256 AKE.
+
+This does NOT branch on "do we possess 2.0 certs?" as a feature switch: it
+consumes whatever the supplied `HostCert` carries, exactly as the 1.0 path
+consumes `hc.certificate`. A host cert without v2 credentials simply has
+nothing more to present and keeps its 1.0 error; a host cert WITH them
+drives the P-256 AKE the moment the drive asks for it. When a real 2.0 host
+cert is supplied at runtime, the P-256 handshake runs — no code change, no
+possession gate.
+
+A transport fault on the 1.0 attempt short-circuits the fallback:
+re-running the P-256 AKE against a bus that is gone re-issues AGID
+invalidation + SEND/REPORT KEY for nothing and buries the real (replug)
+cause. The `Err` arm below still classifies it as `Transport`.
+
+## AACS 2.0 (P-256) host-certificate handshake — live-path test plumbing
+
+No genuine 2.0 host cert exists for us to sign with (a side agent is hunting
+one; see the `#[ignore]` slot at the end). So the tests below prove the
+PLUMBING under a self-generated test LA keypair: a 132-byte drive cert
+signed by the test LA is threaded through the SAME code the production
+anchor uses, only the anchor differs (a parameter, not a recompile). The
+layout mirrored is the code's self-consistent 4-byte-header framing —
+header(4)+pub_x(32)+pub_y(32)+sig_r(32)+sig_s(32)=132, LA signs SHA-256 over
+cert[..68] — identical to the step-6 drive-key message framing and the
+156-byte SEND KEY host-cert payload (4+20 nonce+132 cert).
+
+## `ecdsa_verify_p256_verifies_a_genuine_aacs2_content_cert` — why it matters
+
+SANITY: `ecdsa_verify_p256` + the P-256 curve constants + SHA-256 are correct
+against GENUINE AACS 2.0 material. No real 2.0 host/drive AKE cert exists
+anywhere on this machine (an exhaustive hunt found none — it needs a live
+USB/SCSI AKE capture), but a real AACS 2.0 CONTENT certificate does
+(`research/aacs/iso-aacs/CivilWar/Content000.cer`, type 0x10, 232 bytes). It
+is signed by the AACS 2.0 *Content Cert* key (P-256/SHA-256, 64-byte
+signature over the first `signed_len` bytes) — a DIFFERENT key for a
+DIFFERENT purpose than the AKE LA anchor, but it exercises the EXACT same
+`ecdsa_verify_p256` primitive `verify_cert_p256` relies on; only the pubkey
+and the offsets differ. Proving it verifies here pins that the P-256
+ECDSA/SHA-256 math and the `point_on_curve` gate are right, so when a
+genuine 2.0 host/drive cert (and its correct signed range) lands, only the
+offsets — not the crypto — remain to be fixed.
+
+The CC pubkey is the published AACS 2.0 Content Certificate public key
+(P-256). Corrupting any `P256_*` constant, or removing SHA-256, makes this
+real-vector verification go red.
+
+## Cert support
+
+- AACS 1.0: custom 160-bit curve, SHA-1, 20-byte keys
+- AACS 2.0: an AACS 2.0 drive accepts an AACS 1.0 host cert for backward
+  compatibility (that yields the Volume ID), and the native P-256/SHA-256
+  AACS 2.0 AKE is the fallback when the drive refuses the 1.0 cert AND the
+  supplied host cert carries AACS 2.0 (P-256) credentials. Both paths are
+  LIVE and share the same chain-of-trust hardening; see
+  `run_cert_handshake` for the cert-agnostic dispatch.

docs/drive-profile-visibility.md

@@ -0,0 +1,16 @@
+# `DriveProfile` field visibility and `allow(dead_code)`
+
+Only `identity` and `signature` are public — they are what the catalog is
+public FOR ("is this drive supported?", and the emulator's impersonation).
+Everything below them is unlock MECHANISM: the MediaTek firmware image and
+the per-drive vendor CDB templates. `Cargo.toml` says this crate is never
+published because it carries drive firmware; re-exporting `DriveProfile`
+with a `pub firmware: Vec<u8>` handed that firmware, and every vendor CDB,
+to any downstream crate that called `ld::profile()`. They are `pub(crate)`
+so the mechanism stays inside the unlocker.
+
+`allow(dead_code)`: this is the on-disk catalog schema, and several
+captured CDB templates have no in-crate consumer yet. They were `pub`
+before, so the compiler saw the (external) use; making them `pub(crate)`
+is what exposes them as unread. Deleting them would silently drop fields
+from the format the profile-extraction pipeline emits.

docs/module-visibility.md

@@ -0,0 +1,29 @@
+# Module visibility rationale (`src/lib.rs`)
+
+Why each unlocker module is `pub mod` or `mod`, and what's actually public
+about it. The consumer never reaches an unlocker impl directly — only through
+[`all_unlockers`] — so "public" here means "exposes something other than the
+unlocker impl itself."
+
+## `ld`
+
+Public ONLY for its drive-profile catalog (`ld::profiles` / the `Profiles`
+object) and, under the `emulation` feature, the unlock-handshake wire format
+the bdemu test-emulator needs. The unlocker impl itself (`Mt1959Unlocker`) is
+`pub(crate)` — clients still reach unlockers only through `all_unlockers`.
+`aacs` and `css` carry no such public catalog, so they stay fully private.
+
+## `renesas`
+
+Public for its `is_renesas` drive-probe, which reports a dead bus as
+`Err(UnlockError::Transport)` rather than "not a Renesas drive" — a
+distinction the consumer needs before it can trust a negative probe result.
+The unlocker impl (`Renesas`) is `pub(crate)` — reached only through
+`all_unlockers`.
+
+## `freemkv`
+
+Carries no public catalog (the firmware self-identifies rather than matching
+a bundled profile) and no emulation wire format yet, so it stays fully
+private — the unlocker impl (`FreemkvUnlocker`) is reached only through
+`all_unlockers`.

docs/scsi-mock-fixture.md

@@ -0,0 +1,9 @@
+# `scsi::mock` — crate-wide mock transport
+
+The crate-wide mock transport. Before this existed, EVERY mock in the crate
+returned `Ok` with status 0 and a full `bytes_transferred` — so no test could
+ever exercise the three outcomes the contract actually distinguishes, and a
+whole class of transport-fault misclassification bugs sat uncaught (a dead bus
+read as "this unlocker doesn't apply", a zero-filled buffer read as valid
+drive data). This fixture can express all of them, and is the red-before-green
+vehicle for the transport-contract fixes across ld / aacs / css / renesas.

docs/unlocked-debug-redaction.md

@@ -0,0 +1,10 @@
+# Why `Unlocked`'s `Debug` impl is hand-written
+
+`Unlocked` is the public carrier that leaves this crate, and both `bus_key`
+(the AACS bus key) and `vid` (the Volume ID that feeds VUK derivation) are key
+material that must never reach a log or a test-failure message in plaintext.
+The `AacsAuth` / `CertHandshake` siblings already redact; a derived `Debug`
+here would print the very bytes they hide.
+
+Presence is still observable (`Some`/`None`) so a log can say WHETHER a key
+was obtained without revealing WHAT it is.

src/aacs/error.rs

@@ -20,11 +20,26 @@ pub enum Error {
     AacsKeyRead,
     AacsKeyRejected,
     AacsKeyVerify,
+    /// Our OWN just-produced host signature failed to verify against our host
+    /// certificate's public key (libaacs-style self-verify guard). This means
+    /// the loaded host cert's private key does not match its certificate — a
+    /// mispaired keydb entry — so shipping the signature would only earn an
+    /// opaque "KEY NOT ESTABLISHED" from the drive. Fail fast, host-side.
+    AacsHostSignVerify,
     AacsNoKeys,
     AacsVidMac,
     AacsVidRead,
     HandshakeRejected,
     VidUnavailable,
+    /// A handshake step returned FEWER bytes than the protocol step requires.
+    /// The buffer the step would have parsed is the caller's own zero fill, so
+    /// consuming it would turn a failed command into a "successful" handshake
+    /// step built entirely out of zeros.
+    ShortTransfer {
+        opcode: u8,
+        expected: usize,
+        got: usize,
+    },
     /// A SCSI command failed. `status == SCSI_STATUS_TRANSPORT_FAILURE` with
     /// `sense: None` is a transport-layer fault; a CHECK CONDITION carries the
     /// parsed [`ScsiSense`].
@@ -49,11 +64,13 @@ impl Error {
             Error::AacsKeyRead => 7007,
             Error::AacsKeyRejected => 7008,
             Error::AacsKeyVerify => 7009,
+            Error::AacsHostSignVerify => 7016,
             Error::AacsNoKeys => 7010,
             Error::AacsVidMac => 7011,
             Error::AacsVidRead => 7012,
             Error::HandshakeRejected => 7013,
             Error::VidUnavailable => 7014,
+            Error::ShortTransfer { .. } => 7015,
             Error::Scsi { .. } => 7099,
         }
     }
@@ -86,3 +103,145 @@ impl From<crate::scsi::ScsiError> for Error {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Every variant has its own stable numeric code. Constructing all 17
+    /// arms also exercises the `#[allow(dead_code)]` variants that the
+    /// wired handshake path never builds.
+    #[test]
+    fn code_is_stable_per_variant() {
+        assert_eq!(Error::AacsAgidAlloc.code(), 7001);
+        assert_eq!(Error::AacsCertRead.code(), 7002);
+        assert_eq!(Error::AacsCertRejected.code(), 7003);
+        assert_eq!(Error::AacsCertShort.code(), 7004);
+        assert_eq!(Error::AacsCertVerify.code(), 7005);
+        assert_eq!(Error::AacsDataKey.code(), 7006);
+        assert_eq!(Error::AacsKeyRead.code(), 7007);
+        assert_eq!(Error::AacsKeyRejected.code(), 7008);
+        assert_eq!(Error::AacsKeyVerify.code(), 7009);
+        assert_eq!(Error::AacsHostSignVerify.code(), 7016);
+        assert_eq!(Error::AacsNoKeys.code(), 7010);
+        assert_eq!(Error::AacsVidMac.code(), 7011);
+        assert_eq!(Error::AacsVidRead.code(), 7012);
+        assert_eq!(Error::HandshakeRejected.code(), 7013);
+        assert_eq!(Error::VidUnavailable.code(), 7014);
+        assert_eq!(
+            Error::ShortTransfer {
+                opcode: 0xA4,
+                expected: 16,
+                got: 4,
+            }
+            .code(),
+            7015
+        );
+        assert_eq!(
+            Error::Scsi {
+                opcode: 0xA4,
+                status: 0x02,
+                sense: None,
+            }
+            .code(),
+            7099
+        );
+    }
+
+    /// `scsi_sense` returns the parsed sense for a `Scsi` error carrying one,
+    /// `None` when the `Scsi` error has none, and `None` for every non-`Scsi`
+    /// variant.
+    #[test]
+    fn scsi_sense_returns_the_parsed_sense_only_for_scsi_variant() {
+        let sense = ScsiSense {
+            sense_key: 0x05,
+            asc: 0x20,
+            ascq: 0x00,
+        };
+        let with_sense = Error::Scsi {
+            opcode: 0xA4,
+            status: 0x02,
+            sense: Some(sense),
+        };
+        let sc = with_sense.scsi_sense().unwrap();
+        assert_eq!(sc.sense_key, sense.sense_key);
+        assert_eq!(sc.asc, sense.asc);
+        assert_eq!(sc.ascq, sense.ascq);
+
+        let without_sense = Error::Scsi {
+            opcode: 0xA4,
+            status: 0xFF,
+            sense: None,
+        };
+        assert!(without_sense.scsi_sense().is_none());
+
+        assert!(Error::AacsNoKeys.scsi_sense().is_none());
+    }
+
+    /// `is_scsi_transport_failure` is true only for a `Scsi` error with the
+    /// transport-failure status AND no sense; a drive CHECK CONDITION and
+    /// every non-`Scsi` variant are false.
+    #[test]
+    fn is_scsi_transport_failure_true_and_false_paths() {
+        let transport = Error::Scsi {
+            opcode: 0,
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        };
+        assert!(transport.is_scsi_transport_failure());
+
+        let check_condition = Error::Scsi {
+            opcode: 0xA4,
+            status: 0x02,
+            sense: Some(ScsiSense {
+                sense_key: 0x05,
+                asc: 0x20,
+                ascq: 0x00,
+            }),
+        };
+        assert!(!check_condition.is_scsi_transport_failure());
+
+        assert!(!Error::AacsNoKeys.is_scsi_transport_failure());
+    }
+
+    /// `From<ScsiError>` maps a raw transport-layer error into `Error::Scsi`,
+    /// parsing the sense buffer when present and leaving it `None` otherwise.
+    #[test]
+    fn from_scsi_error_maps_status_and_parses_sense() {
+        let e = Error::from(crate::scsi::ScsiError {
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        });
+        match e {
+            Error::Scsi {
+                opcode,
+                status,
+                sense,
+            } => {
+                assert_eq!(opcode, 0);
+                assert_eq!(status, SCSI_STATUS_TRANSPORT_FAILURE);
+                assert!(sense.is_none());
+            }
+            _ => panic!("expected Error::Scsi"),
+        }
+
+        let mut buf = [0u8; 32];
+        buf[2] = 0x05;
+        buf[12] = 0x24;
+        buf[13] = 0x01;
+        let e = Error::from(crate::scsi::ScsiError {
+            status: 0x02,
+            sense: Some(buf),
+        });
+        match e {
+            Error::Scsi { status, sense, .. } => {
+                assert_eq!(status, 0x02);
+                let s = sense.expect("sense parsed");
+                assert_eq!(s.sense_key, 0x05);
+                assert_eq!(s.asc, 0x24);
+                assert_eq!(s.ascq, 0x01);
+            }
+            _ => panic!("expected Error::Scsi"),
+        }
+    }
+}

src/aacs/mod.rs

@@ -8,70 +8,186 @@
 mod error;
 mod handshake;
 
-use aes::Aes128;
-use aes::cipher::{BlockDecrypt, KeyInit, generic_array::GenericArray};
+/// Keypair-validity check for a stored AACS 1.0 host cert (`priv·G ==
+/// cert_pub_key`). Exposed for the key service, which must refuse to serve a
+/// cert whose stored private key doesn't match its certificate.
+pub use handshake::aacs1_keypair_matches;
 
+use aes::Aes128;
+use aes::cipher::{Array, BlockCipherDecrypt, KeyInit};
+
+use crate::firmware::{ArmRecipe, FirmwareControl, FirmwareError};
 use crate::scsi::ScsiTransport;
-use crate::{DiscKind, UnlockCtx, UnlockError, Unlocked, Unlocker};
+use crate::{DiscKind, HostCert, UnlockCtx, UnlockError, Unlocked, Unlocker};
 
 /// AES-128-ECB decrypt a single 16-byte block — used to decrypt the bus key /
 /// read_data_key the drive returns after the handshake.
 pub(crate) fn aes_ecb_decrypt(key: &[u8; 16], data: &[u8; 16]) -> [u8; 16] {
-    let cipher = Aes128::new(GenericArray::from_slice(key));
-    let mut block = GenericArray::clone_from_slice(data);
+    let cipher = Aes128::new(&(*key).into());
+    let mut block: Array<u8, _> = (*data).into();
     cipher.decrypt_block(&mut block);
     let mut out = [0u8; 16];
     out.copy_from_slice(&block);
     out
 }
 
-/// The AACS host-certificate unlocker. Matches a Blu-ray/UHD disc
-/// (`DiscKind::Aacs`) and runs the cert handshake against the host certs the
-/// consumer collected (via [`UnlockCtx::host_certs`]), learning the Volume ID
-/// and — on AACS 2.0 — the bus key.
-pub struct AacsCert;
+/// The AACS host-certificate unlocker — the fallback for a drive with NO vendor
+/// unlock (can't be raw-read-enabled), so the bus is removed by a real host-cert
+/// AKE + bus key rather than a CDB. The host certs are injected at CONSTRUCTION
+/// (the one place certs enter the system). Owns its AKE crypto — no reach into
+/// libfreemkv.
+pub struct AacsUnlocker {
+    host_certs: Vec<HostCert>,
+    /// Opt-in: a freemkv firmware recipe to ARM the drive with before the cert
+    /// AKE. `None` (the default) keeps behaviour byte-identical to a stock host
+    /// — the drive is never touched with a vendor command. See
+    /// [`AacsUnlocker::arm_before_unlock`].
+    arm: Option<ArmRecipe>,
+    /// TEST-ONLY seam: a self-generated AACS 1.0 LA anchor to run the cert AKE
+    /// under. Production verifies against the real compiled-in anchor, which no
+    /// synthetic drive emulator can sign for, so the end-to-end unlock tests
+    /// drive the handshake under a test anchor instead. `None` in every real
+    /// build (the field does not exist off `cfg(test)`).
+    #[cfg(test)]
+    test_v1_anchor: Option<([u8; 20], [u8; 20])>,
+}
 
-impl AacsCert {
-    pub fn new() -> Self {
-        AacsCert
+impl AacsUnlocker {
+    pub fn new(host_certs: Vec<HostCert>) -> Self {
+        AacsUnlocker {
+            host_certs,
+            arm: None,
+            #[cfg(test)]
+            test_v1_anchor: None,
+        }
+    }
+
+    /// TEST-ONLY: run the cert AKE under a self-generated AACS 1.0 LA anchor
+    /// (see [`AacsUnlocker::test_v1_anchor`]).
+    #[cfg(test)]
+    pub(crate) fn with_test_v1_anchor(mut self, la_x: [u8; 20], la_y: [u8; 20]) -> Self {
+        self.test_v1_anchor = Some((la_x, la_y));
+        self
+    }
+
+    /// Run the cert handshake against the drive. Production threads the real LA
+    /// anchors via [`handshake::run_cert_handshake`]; a test may override the
+    /// AACS 1.0 anchor so a synthetic drive can complete the AKE.
+    fn run_handshake(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+    ) -> std::result::Result<handshake::CertHandshake, UnlockError> {
+        #[cfg(test)]
+        if let Some((ax, ay)) = self.test_v1_anchor {
+            // v2 anchor is unused here: allow_p256 = false keeps the native 2.0
+            // path off, so a zeroed placeholder is never read.
+            let dummy_v2 = [0u8; 32];
+            return handshake::run_cert_handshake_with_anchors(
+                scsi,
+                &self.host_certs,
+                (&ax, &ay),
+                (&dummy_v2, &dummy_v2),
+                false,
+            );
+        }
+        handshake::run_cert_handshake(scsi, &self.host_certs)
+    }
+
+    /// Opt IN to arming a freemkv-firmware drive with a named recipe *before*
+    /// the cert AKE (builder style). OFF by default, so the cert route's default
+    /// behaviour is unchanged and a non-freemkv / stock drive is never sent a
+    /// vendor command. When set, `unlock()` probes via
+    /// [`FirmwareControl::identity`] and applies `recipe` only on a match — e.g.
+    /// [`ArmRecipe::BypassBd`] (`Ake=null`) pre-authenticates the drive so cert
+    /// selection is moot; [`ArmRecipe::OemBd`] (`Hrl=skip`) accepts a revoked
+    /// cert. A non-freemkv drive or a refused recipe is left untouched.
+    pub fn arm_before_unlock(mut self, recipe: ArmRecipe) -> Self {
+        self.arm = Some(recipe);
+        self
+    }
+
+    /// If arming is opted-in, detect freemkv firmware and apply the recipe.
+    /// Best-effort: a non-freemkv drive or a refused recipe is a no-op; only a
+    /// dead bus (`FirmwareError::Transport`) aborts the whole unlock.
+    fn maybe_arm(&self, scsi: &mut dyn ScsiTransport) -> std::result::Result<(), UnlockError> {
+        let Some(recipe) = self.arm else {
+            return Ok(());
+        };
+        let mut fw = FirmwareControl::new(scsi);
+        match fw.identity() {
+            Ok(Some(id)) => {
+                tracing::debug!(
+                    target: "freemkv::disc",
+                    phase = "aacs_arm_freemkv_detected",
+                    version = %id.version,
+                    recipe = ?recipe,
+                    "freemkv firmware detected; arming before the cert AKE"
+                );
+                match fw.arm(recipe) {
+                    Ok(()) => Ok(()),
+                    Err(FirmwareError::Transport) => Err(UnlockError::Transport),
+                    Err(e) => {
+                        tracing::debug!(
+                            target: "freemkv::disc",
+                            phase = "aacs_arm_recipe_refused",
+                            recipe = ?recipe,
+                            error = ?e,
+                            "firmware refused the arm recipe; proceeding with the plain cert AKE"
+                        );
+                        Ok(())
+                    }
+                }
+            }
+            Ok(None) => Ok(()), // not freemkv — leave the drive untouched
+            Err(FirmwareError::Transport) => Err(UnlockError::Transport),
+            Err(_) => Ok(()),
+        }
     }
 }
 
-impl Default for AacsCert {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl Unlocker for AacsCert {
+impl Unlocker for AacsUnlocker {
     fn name(&self) -> &'static str {
         "AACS"
     }
 
-    /// AACS removes BUS encryption via the host-cert handshake; it provides no
-    /// drive features. Self-guards on the disc kind (the consumer iterates every
-    /// unlocker's `unlock_bus`, so a non-AACS disc must decline here).
-    fn unlock_bus(
+    /// Remove AACS bus encryption via the host-cert handshake. Like every other
+    /// unlocker this DOES unlock the drive — just with a cert + AKE instead of a
+    /// vendor CDB. `Some` on a successful handshake (VID + bus key learned);
+    /// `None` on a non-AACS disc, no usable cert, or a rejected handshake (fall
+    /// through); `Err(Transport)` on a dead bus.
+    fn unlock(
         &self,
         scsi: &mut dyn ScsiTransport,
         ctx: &UnlockCtx,
-    ) -> std::result::Result<Unlocked, UnlockError> {
-        if ctx.kind != DiscKind::Aacs {
-            return Err(UnlockError::NotApplicable);
+    ) -> std::result::Result<Option<Unlocked>, UnlockError> {
+        if ctx.kind != DiscKind::Aacs || self.host_certs.is_empty() {
+            // Wrong disc kind, or no host cert to authenticate with — the loop
+            // falls through to a VID-less / keysource path.
+            return Ok(None);
         }
-        if ctx.host_certs.is_empty() {
-            // No host cert to authenticate with — the consumer falls back to a
-            // VID-less / keysource path.
-            return Err(UnlockError::NoUsableHostCert);
-        }
-        let h = handshake::run_cert_handshake(scsi, ctx.host_certs)?;
-        Ok(Unlocked {
-            vid: Some(h.volume_id),
-            // Host-cert AKE path: bus removal depends on the bus key, not a
-            // firmware unlock.
-            bus_key: h.read_data_key,
-            drive_unlocked: false,
-        })
+        // Opt-in: arm a freemkv-firmware drive before the AKE (no-op by default,
+        // and on non-freemkv drives). Only a dead bus aborts here.
+        self.maybe_arm(scsi)?;
+        crate::fallthrough(self.run_handshake(scsi).map(|h| {
+            // A UHD disc whose bus-key fetch the drive refused (non-transport)
+            // returns Ok with read_data_key: None + read_data_key_err: Some —
+            // otherwise indistinguishable from an AACS-1.0 disc. Surface it.
+            if h.read_data_key.is_none()
+                && let Some(code) = h.read_data_key_err
+            {
+                tracing::warn!(
+                    target: "freemkv::disc",
+                    phase = "read_data_key_dropped",
+                    error_code = code,
+                    "AACS auth + VID succeeded but the drive served no read_data_key (bus key); \
+                     unlock reports bus_key: None"
+                );
+            }
+            Unlocked {
+                vid: Some(h.volume_id),
+                bus_key: h.read_data_key,
+            }
+        }))
     }
 }
 
@@ -79,15 +195,47 @@ impl Unlocker for AacsCert {
 mod tests {
     use super::*;
 
+    /// AES-128-ECB decrypt against the FIPS-197 Appendix B / NIST known-answer
+    /// test vector: decrypting the published ciphertext with the published key
+    /// must recover the published plaintext.
+    #[test]
+    fn aes_ecb_decrypt_matches_fips197_test_vector() {
+        let key: [u8; 16] = [
+            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D,
+            0x0E, 0x0F,
+        ];
+        let ciphertext: [u8; 16] = [
+            0x69, 0xC4, 0xE0, 0xD8, 0x6A, 0x7B, 0x04, 0x30, 0xD8, 0xCD, 0xB7, 0x80, 0x70, 0xB4,
+            0xC5, 0x5A,
+        ];
+        let expected_plaintext: [u8; 16] = [
+            0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD,
+            0xEE, 0xFF,
+        ];
+        let out = aes_ecb_decrypt(&key, &ciphertext);
+        assert_eq!(out, expected_plaintext);
+    }
+
+    /// Decrypting a different ciphertext under the same key must not produce
+    /// the same plaintext — pins that the function actually decrypts the
+    /// given block rather than returning a constant.
+    #[test]
+    fn aes_ecb_decrypt_varies_with_input() {
+        let key = [0u8; 16];
+        let a = aes_ecb_decrypt(&key, &[0u8; 16]);
+        let b = aes_ecb_decrypt(&key, &[1u8; 16]);
+        assert_ne!(a, b);
+    }
+
     fn id() -> crate::DriveId {
         crate::DriveId::default()
     }
 
-    /// `unlock_bus` self-guards on the disc kind: on a non-AACS disc it declines
-    /// (`NotApplicable`) WITHOUT touching the transport, so iterating it on a
-    /// CSS/unknown disc is safe.
+    /// Self-guards on the disc kind: on a non-AACS disc `unlock()` declines
+    /// (`Ok(false)`) WITHOUT touching the transport, even WITH a cert present —
+    /// so the reason is the kind, not a missing cert.
     #[test]
-    fn unlock_bus_declines_non_aacs_kinds() {
+    fn declines_non_aacs_kinds() {
         struct DeadTransport;
         impl ScsiTransport for DeadTransport {
             fn execute(
@@ -103,15 +251,182 @@ mod tests {
         let id = id();
         let mut t = DeadTransport;
         for k in [DiscKind::Unknown, DiscKind::Unencrypted, DiscKind::Css] {
-            let r = AacsCert::new().unlock_bus(&mut t, &UnlockCtx::new(&id, k, &[]));
-            assert_eq!(r.unwrap_err(), UnlockError::NotApplicable, "declines {k:?}");
+            assert!(
+                AacsUnlocker::new(vec![host_cert()])
+                    .unlock(&mut t, &UnlockCtx::new(&id, k))
+                    .expect("declines")
+                    .is_none(),
+                "declines {k:?}"
+            );
         }
     }
 
-    /// With no host certs there is nothing to authenticate with → NoUsableHostCert,
+    // Full success path through `Unlocker::unlock`: a self-consistent AACS 1.0
+    // emulator proves the entry point learns `vid`/`bus_key` — and that the cert
+    // route reports `unlock() == true` (it DOES unlock the drive, via the cert).
+    #[test]
+    fn unlock_succeeds_end_to_end() {
+        let mut t = handshake::tests::DriveEmu::new();
+        t.serve_data_keys = true;
+        let (lax, lay) = (t.la_x, t.la_y);
+        let id = id();
+        let ctx = UnlockCtx::new(&id, DiscKind::Aacs);
+        let out = AacsUnlocker::new(vec![host_cert()])
+            .with_test_v1_anchor(lax, lay)
+            .unlock(&mut t, &ctx)
+            .expect("auth + VID + data-key reads all succeed")
+            .expect("the cert route unlocks the drive");
+        assert_eq!(out.vid, Some([0x5Au8; 16]));
+        assert!(out.bus_key.is_some());
+    }
+
+    // The `read_data_key_dropped` path: auth + VID succeed but the drive serves
+    // no bus key (non-transport). `unlock` still reports Unlocked (unlocked via
+    // the cert) with `vid: Some` but `bus_key: None` — surfaced, not hidden.
+    #[test]
+    fn unlock_without_a_served_read_data_key_yields_vid_but_no_bus_key() {
+        let mut t = handshake::tests::DriveEmu::new();
+        t.serve_zero_data_keys = true; // GOOD status, all-zero key block
+        let (lax, lay) = (t.la_x, t.la_y);
+        let id = id();
+        let ctx = UnlockCtx::new(&id, DiscKind::Aacs);
+        let out = AacsUnlocker::new(vec![host_cert()])
+            .with_test_v1_anchor(lax, lay)
+            .unlock(&mut t, &ctx)
+            .expect("auth + VID succeed even when the bus key is refused")
+            .expect("the cert route still unlocks the drive");
+        assert_eq!(out.vid, Some([0x5Au8; 16]), "the VID was learned");
+        assert!(
+            out.bus_key.is_none(),
+            "no read_data_key served ⇒ bus_key: None (reported, not faked)"
+        );
+    }
+
+    fn host_cert() -> crate::HostCert {
+        handshake::tests::dummy_cert()
+    }
+
+    // ── Opt-in arm-before-unlock ──────────────────────────────────────────────
+
+    /// The default (no arm opted-in) NEVER touches the transport for arming.
+    #[test]
+    fn no_arm_by_default_does_not_probe_firmware() {
+        struct PanicTransport;
+        impl ScsiTransport for PanicTransport {
+            fn execute(
+                &mut self,
+                _cdb: &[u8],
+                _dir: crate::scsi::DataDirection,
+                _data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> crate::scsi::Result<crate::scsi::ScsiResult> {
+                panic!("default AacsUnlocker must not issue a firmware knock");
+            }
+        }
+        let u = AacsUnlocker::new(vec![host_cert()]);
+        assert!(u.arm.is_none());
+        u.maybe_arm(&mut PanicTransport).expect("no-op");
+    }
+
+    /// Opting in on a NON-freemkv drive probes once (IDENTITY) and then leaves
+    /// the drive untouched — no recipe SETs are sent.
+    #[test]
+    fn arm_on_non_freemkv_drive_is_a_noop_after_the_probe() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::illegal_request());
+        let u = AacsUnlocker::new(vec![host_cert()]).arm_before_unlock(ArmRecipe::BypassBd);
+        u.maybe_arm(&mut t).expect("no-op on non-freemkv");
+        // Exactly one CDB: the IDENTITY probe. No recipe SETs followed.
+        assert_eq!(t.cdbs.len(), 1);
+        assert_eq!(t.cdbs[0][4], crate::firmware::Verb::Identity as u8);
+    }
+
+    /// A dead bus on the arm probe aborts the whole unlock.
+    #[test]
+    fn arm_probe_transport_fault_aborts() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::TransportFault);
+        let u = AacsUnlocker::new(vec![host_cert()]).arm_before_unlock(ArmRecipe::BypassBd);
+        assert_eq!(u.maybe_arm(&mut t).unwrap_err(), UnlockError::Transport);
+    }
+
+    /// Opting in on a freemkv drive applies the recipe: BypassBd sends
+    /// Set(Ake, on) and verifies it, BEFORE the handshake would run.
+    #[test]
+    fn arm_on_freemkv_drive_applies_the_recipe() {
+        use crate::firmware::{
+            ALL_FEATURES, CDB_FEATURE, CDB_STATE, CDB_VERB, Feature, RESP_MAGIC, STATE_OFF,
+            STATE_PASSTHROUGH, Verb, build_set_cdb,
+        };
+        // A minimal freemkv drive: IDENTITY→magic, SET updates state, GET reads it.
+        struct FwDrive {
+            ake: u8,
+            hrl: u8,
+            cdbs: Vec<Vec<u8>>,
+        }
+        impl ScsiTransport for FwDrive {
+            fn execute(
+                &mut self,
+                cdb: &[u8],
+                _dir: crate::scsi::DataDirection,
+                data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> crate::scsi::Result<crate::scsi::ScsiResult> {
+                self.cdbs.push(cdb.to_vec());
+                let mut n = 0;
+                if cdb[CDB_VERB] == Verb::Identity as u8 {
+                    let mut resp = RESP_MAGIC.to_vec();
+                    resp.push(0x01);
+                    resp.extend(std::iter::repeat_n(STATE_PASSTHROUGH, ALL_FEATURES.len()));
+                    n = resp.len().min(data.len());
+                    data[..n].copy_from_slice(&resp[..n]);
+                } else if cdb[CDB_VERB] == Verb::Set as u8 && cdb[CDB_FEATURE] == Feature::Ake as u8
+                {
+                    self.ake = cdb[CDB_STATE];
+                } else if cdb[CDB_VERB] == Verb::Set as u8 && cdb[CDB_FEATURE] == Feature::Hrl as u8
+                {
+                    self.hrl = cdb[CDB_STATE];
+                } else if cdb[CDB_VERB] == Verb::Get as u8
+                    && cdb[CDB_FEATURE] == Feature::Ake as u8
+                    && !data.is_empty()
+                {
+                    data[0] = self.ake;
+                    n = 1;
+                } else if cdb[CDB_VERB] == Verb::Get as u8
+                    && cdb[CDB_FEATURE] == Feature::Hrl as u8
+                    && !data.is_empty()
+                {
+                    data[0] = self.hrl;
+                    n = 1;
+                }
+                Ok(crate::scsi::ScsiResult {
+                    status: 0,
+                    bytes_transferred: n,
+                    sense: [0u8; 32],
+                })
+            }
+        }
+        let mut t = FwDrive {
+            ake: STATE_PASSTHROUGH,
+            hrl: STATE_PASSTHROUGH,
+            cdbs: Vec::new(),
+        };
+        let u = AacsUnlocker::new(vec![host_cert()]).arm_before_unlock(ArmRecipe::BypassBd);
+        u.maybe_arm(&mut t).expect("armed");
+        assert_eq!(t.hrl, STATE_OFF, "the recipe skipped revocation (Hrl=off)");
+        assert_eq!(t.ake, STATE_OFF, "the recipe nulled the AKE (Ake=off)");
+        // IDENTITY, then Set(Hrl,off)+verify, then Set(Ake,off)+verify.
+        assert_eq!(t.cdbs[0][CDB_VERB], Verb::Identity as u8);
+        assert_eq!(t.cdbs[1], build_set_cdb(Feature::Hrl, STATE_OFF));
+        assert_eq!(t.cdbs[2][CDB_VERB], Verb::Get as u8);
+        assert_eq!(t.cdbs[3], build_set_cdb(Feature::Ake, STATE_OFF));
+        assert_eq!(t.cdbs[4][CDB_VERB], Verb::Get as u8);
+    }
+
+    /// With no host certs there is nothing to authenticate with → `Ok(false)`,
     /// and the transport is never touched.
     #[test]
-    fn no_host_certs_is_no_usable_host_cert() {
+    fn no_host_certs_declines() {
         struct DeadTransport;
         impl ScsiTransport for DeadTransport {
             fn execute(
@@ -126,7 +441,11 @@ mod tests {
         }
         let id = id();
         let mut t = DeadTransport;
-        let r = AacsCert::new().unlock_bus(&mut t, &UnlockCtx::new(&id, DiscKind::Aacs, &[]));
-        assert_eq!(r.unwrap_err(), UnlockError::NoUsableHostCert);
+        assert!(
+            AacsUnlocker::new(vec![])
+                .unlock(&mut t, &UnlockCtx::new(&id, DiscKind::Aacs))
+                .expect("no certs declines")
+                .is_none()
+        );
     }
 }

src/css/error.rs

@@ -19,6 +19,31 @@ impl Error {
             Error::Scsi(_) => 7299,
         }
     }
+
+    /// True if this is a transport-layer SCSI failure (bus dead).
+    pub fn is_transport_failure(&self) -> bool {
+        matches!(
+            self,
+            Error::Scsi(s)
+                if s.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE && s.sense.is_none()
+        )
+    }
+}
+
+/// Collapse a SCSI-layer failure from a bus-auth step onto the CSS auth code —
+/// but NEVER a transport fault.
+///
+/// Every step used to do `.map_err(|_| Error::CssAuthFailed)?`, which discarded
+/// the `ScsiError` whole. That made the `Transport` arm of the conversion below
+/// UNREACHABLE from any real call site: a dead bus arrived at the consumer as
+/// `NotApplicable`, so it fell through and kept probing a bus that was gone.
+pub fn step_err(e: crate::scsi::ScsiError) -> Error {
+    let err = Error::Scsi(e);
+    if err.is_transport_failure() {
+        err
+    } else {
+        Error::CssAuthFailed
+    }
 }
 
 impl From<crate::scsi::ScsiError> for Error {
@@ -31,11 +56,93 @@ impl From<crate::scsi::ScsiError> for Error {
 /// "this unlocker didn't apply" (a transport fault still surfaces as Transport).
 impl From<Error> for crate::UnlockError {
     fn from(e: Error) -> Self {
+        if e.is_transport_failure() {
+            crate::UnlockError::Transport
+        } else {
+            crate::UnlockError::NotApplicable
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::UnlockError;
+    use crate::scsi::{SCSI_STATUS_CHECK_CONDITION, SCSI_STATUS_TRANSPORT_FAILURE, ScsiError};
+
+    /// Catches restoring the `.map_err(|_| CssAuthFailed)` that made the
+    /// `Transport` arm unreachable: a dead bus must classify as `Transport`
+    /// (consumer aborts), a drive rejection as `NotApplicable` (fall through).
+    #[test]
+    fn transport_fault_survives_the_step_mapping() {
+        let dead = step_err(ScsiError {
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        });
+        assert!(dead.is_transport_failure());
+        assert_eq!(UnlockError::from(dead), UnlockError::Transport);
+
+        let refused = step_err(ScsiError {
+            status: SCSI_STATUS_CHECK_CONDITION,
+            sense: Some([0u8; 32]),
+        });
+        assert!(matches!(refused, Error::CssAuthFailed));
+        assert_eq!(UnlockError::from(refused), UnlockError::NotApplicable);
+    }
+
+    /// Each variant has its own stable numeric code.
+    #[test]
+    fn code_is_stable_per_variant() {
+        assert_eq!(Error::CssAuthFailed.code(), 7201);
+        assert_eq!(
+            Error::Scsi(ScsiError {
+                status: SCSI_STATUS_CHECK_CONDITION,
+                sense: Some([0u8; 32]),
+            })
+            .code(),
+            7299
+        );
+    }
+
+    // False for `CssAuthFailed` and for a `Scsi` error with a sense (a
+    // drive rejection, not a dead bus) even at transport-failure status;
+    // true only for the genuine transport fault (status + no sense).
+    #[test]
+    fn is_transport_failure_false_paths() {
+        assert!(!Error::CssAuthFailed.is_transport_failure());
+
+        let sensed = Error::Scsi(ScsiError {
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: Some([0u8; 32]),
+        });
+        assert!(!sensed.is_transport_failure());
+
+        let refusal = Error::Scsi(ScsiError {
+            status: SCSI_STATUS_CHECK_CONDITION,
+            sense: None,
+        });
+        assert!(!refusal.is_transport_failure());
+
+        let dead = Error::Scsi(ScsiError {
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        });
+        assert!(dead.is_transport_failure());
+    }
+
+    /// `From<ScsiError>` wraps the transport error unchanged into `Error::Scsi`.
+    #[test]
+    fn from_scsi_error_wraps_into_scsi_variant() {
+        let e = Error::from(ScsiError {
+            status: SCSI_STATUS_CHECK_CONDITION,
+            sense: Some([1u8; 32]),
+        });
         match e {
-            Error::Scsi(s) if s.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE => {
-                crate::UnlockError::Transport
+            Error::Scsi(inner) => {
+                assert_eq!(inner.status, SCSI_STATUS_CHECK_CONDITION);
+                assert_eq!(inner.sense, Some([1u8; 32]));
             }
-            _ => crate::UnlockError::NotApplicable,
+            _ => panic!("expected Error::Scsi"),
         }
     }
 }

src/firmware/mod.rs

@@ -0,0 +1,754 @@
+//! firmware — an ergonomic, typed Rust API for the freemkv-firmware
+//! vendor-command grammar.
+//!
+//! # This file is a MIRROR of the wire contract
+//!
+//! The single source of truth for the freemkv vendor-command ABI is
+//! `freemkv-firmware/crates/freemkv-fw/src/abi.rs`. The firmware tool and this
+//! host crate share **no code** — this module is a hand-kept mirror, so the
+//! numeric values below (verbs, features, state bytes, CDB field offsets) ARE
+//! the contract and MUST NOT drift. [`tests`] pins every pinned value so a drift
+//! against `abi.rs` is caught at `cargo test` time.
+//!
+//! # Grammar: `verb [feature] [state]`
+//!
+//! A freemkv command hijacks the standard SCSI `READ BUFFER` (`0x3C`) opcode via
+//! an OEM-unused mode plus a two-byte knock, then carries a small verb grammar:
+//!
+//! ```text
+//!   cdb[0]    = 0x3C  (READ BUFFER)          ← standard opcode; bridge-safe
+//!   cdb[1]    = 0x0E  (KNOCK_MODE)           ← OEM's jump table rejects modes >= 0x0E
+//!   cdb[2..4] = 0xC0 0xDE (KNOCK)            ← defence-in-depth signature
+//!   cdb[4]    = Verb                         ← IDENTITY / SET / GET / RESET / DUMPALL
+//!   cdb[5]    = Feature id                   ← SET/GET only (else 0)
+//!   cdb[6]    = State byte                   ← SET only (else 0)
+//!   cdb[7..9] = allocation length (16-bit big-endian)  ← data-returning verbs
+//!   cdb[9]    = control (0)
+//! ```
+//!
+//! [`Verb::DumpAll`] is the exception: it packs a 32-bit RAM address big-endian
+//! into `cdb[5..9]` and always returns a fixed [`MEMREAD_LEN`]-byte window.
+//!
+//! Every feature defaults to [`STATE_PASSTHROUGH`] (firmware does not touch the
+//! subsystem → byte-identical to OEM); [`Verb::Reset`] with [`RESET_TO_OEM`]
+//! returns every feature to passthrough (and, firmware ≥0.8.3, blanks the NV block
+//! so the drive is traceless), [`RESET_TO_DEFAULTS`] restores the baked create-time
+//! defaults, while [`RESET_TO_FLASH`] reloads the last
+//! [`Verb::Save`]d config block.
+
+use crate::scsi::{DataDirection, ScsiTransport};
+
+// ── Wire constants (mirror of abi.rs) ────────────────────────────────────────
+
+/// Standard SCSI `READ BUFFER` opcode — the command freemkv hijacks (`cdb[0]`).
+pub const READ_BUFFER_OPCODE: u8 = 0x3C;
+/// The freemkv sub-command mode at `cdb[1]`; OEM rejects modes `>= 0x0E`.
+pub const KNOCK_MODE: u8 = 0x0E;
+/// Two-byte knock at `cdb[2..4]` ("C0DE").
+pub const KNOCK: [u8; 2] = [0xC0, 0xDE];
+/// Response-framing magic leading the [`Verb::Identity`] reply (`b"freemkv"`).
+pub const RESP_MAGIC: &[u8] = b"freemkv";
+
+/// Length of a freemkv (READ BUFFER) CDB.
+pub const CDB_LEN: usize = 10;
+/// Offset of the opcode byte (`cdb[0]`).
+pub const CDB_OPCODE: usize = 0;
+/// Offset of the mode/knock byte (`cdb[1]`).
+pub const CDB_MODE: usize = 1;
+/// Offset of the first knock byte (`cdb[2]`, `cdb[3]`).
+pub const CDB_KNOCK: usize = 2;
+/// Offset of the verb byte (`cdb[4]`).
+pub const CDB_VERB: usize = 4;
+/// Offset of the feature-id byte (`cdb[5]`) — SET/GET only.
+pub const CDB_FEATURE: usize = 5;
+/// Offset of the state byte (`cdb[6]`) — SET only.
+pub const CDB_STATE: usize = 6;
+/// Offset of the 16-bit big-endian allocation length (`cdb[7..9]`).
+pub const CDB_ALLOC_LEN: usize = 7;
+
+/// Bytes returned by one [`Verb::DumpAll`] read (fixed 64-byte window).
+pub const MEMREAD_LEN: usize = 64;
+
+/// Minimum data-in allocation length any freemkv vendor command may request.
+///
+/// **Hardware-confirmed (LG BU40N on freemkv firmware):** the drive's `READ
+/// BUFFER` hijack ABORTS (Check Condition, sense key Aborted Command) any vendor
+/// command whose data-in allocation length is under ~16 bytes (0/1/2 all abort;
+/// 16 and 64 both succeed). Every builder floors its allocation at `64` — it
+/// matches [`MEMREAD_LEN`] and is safely above the minimum. The verb/feature/
+/// state ride in the CDB, so a larger data-in is harmless; a [`Verb::Get`] still
+/// reads its state byte from data offset 0. Mirrors firmware ABI `MIN_ALLOC_LEN`.
+pub const MIN_ALLOC_LEN: u16 = 64;
+
+/// Feature state: **passthrough** — firmware does not touch this subsystem
+/// (OEM behaviour). The boot default of every feature and what [`Verb::Reset`]
+/// restores. `0xFF`.
+pub const STATE_PASSTHROUGH: u8 = 0xFF;
+/// Feature state: explicit **off / disabled** (`0x00`).
+pub const STATE_OFF: u8 = 0x00;
+/// Feature state: explicit **on / enabled** (`0x01`).
+pub const STATE_ON: u8 = 0x01;
+
+/// [`Feature::Speed`] state: speed control OFF — the read-speed cap is lifted and
+/// the drive runs uncapped at maximum throughput. This is the [`STATE_OFF`]
+/// (`0x00`) leg of Speed: "off" is the *limiter* being off, i.e. maximum speed.
+/// `0x01..=0xFE` are explicit caps and `0xFF` is the OEM ramp.
+pub const SPEED_MAX: u8 = 0x00;
+
+/// [`Feature::Region`] state: force BD region A (`0x0A`). See [`BdRegion`]. BD
+/// regions A/B/C share the low-nibble block with the DVD `0x0N` scheme
+/// ([`REGION_DVD_BASE`]) and [`REGION_FREE`] (`0x0F`).
+pub const REGION_BD_A: u8 = 0x0A;
+/// [`Feature::Region`] state: force BD region B (`0x0B`).
+pub const REGION_BD_B: u8 = 0x0B;
+/// [`Feature::Region`] state: force BD region C (`0x0C`).
+pub const REGION_BD_C: u8 = 0x0C;
+
+/// [`Feature::Region`] state base for "force DVD region N": `REGION_DVD_BASE + N`,
+/// so regions 1..=8 are `0x01..=0x08`. `0x00` itself is region-locked (nothing
+/// plays).
+pub const REGION_DVD_BASE: u8 = 0x00;
+
+/// [`Feature::Region`] state: region-free — any disc plays regardless of its
+/// region code. Sits in the region low-nibble block above the DVD (`0x01..=0x08`)
+/// and BD (`0x0A..=0x0C`) values.
+pub const REGION_FREE: u8 = 0x0F;
+
+/// [`Verb::Reset`] mode (rides in the state slot `cdb[6]`): reload the saved flash
+/// config block into the RAM feature-state table, discarding un-saved RAM changes
+/// — the non-destructive "revert to last SAVE". Marker-gated in firmware ≥0.8.3: a
+/// never-saved drive loads the baked create-time defaults instead.
+pub const RESET_TO_FLASH: u8 = 0x00;
+
+/// [`Verb::Reset`] mode (rides in the state slot `cdb[6]`): restore the baked
+/// per-create **defaults** (the create-time flags, e.g. UHD/BD on) into the RAM
+/// feature-state table. RAM-only — does not touch flash. This is what a never-saved
+/// drive boots to. Firmware ≥0.8.3.
+pub const RESET_TO_DEFAULTS: u8 = 0x01;
+
+/// [`Verb::Reset`] mode (rides in the state slot `cdb[6]`): TRUE OEM. Forces every
+/// feature to [`STATE_PASSTHROUGH`] in RAM **and** (firmware ≥0.8.3) writes the NV
+/// config block all-`0xFF` — marker included — so the drive is byte-for-byte like a
+/// never-saved/never-configured drive (no trace it was ever set). Because the marker
+/// is then `0xFF`, the NEXT boot loads the baked defaults, exactly like a fresh drive.
+pub const RESET_TO_OEM: u8 = 0xFF;
+
+/// The verb selector in `cdb[4]`. These numeric values ARE the wire protocol.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[repr(u8)]
+pub enum Verb {
+    /// Status/ping — returns [`RESP_MAGIC`] + version + the feature-state table.
+    Identity = 0x01,
+    /// Set one feature (`cdb[5]`) to a state (`cdb[6]`).
+    Set = 0x02,
+    /// Read one feature's (`cdb[5]`) current state back in the data-in payload.
+    Get = 0x03,
+    /// Restore the RAM feature-state table. The mode rides in `cdb[6]` (the state
+    /// slot): [`RESET_TO_FLASH`] (`0x00`) reloads the saved flash config block back
+    /// into RAM (discarding un-saved changes; marker-gated in fw ≥0.8.3),
+    /// [`RESET_TO_DEFAULTS`] (`0x01`) restores the baked create-time defaults, and
+    /// [`RESET_TO_OEM`] (`0xFF`) forces every feature to [`STATE_PASSTHROUGH`] AND
+    /// blanks the NV block (traceless, fw ≥0.8.3). Ignores feature.
+    Reset = 0x04,
+    /// Diagnostic RAM peek: [`MEMREAD_LEN`] bytes at the 32-bit address in
+    /// `cdb[5..9]` (big-endian).
+    DumpAll = 0x09,
+    /// Persist the whole RAM feature-state table to the flash config block. This is
+    /// the ONLY verb that writes the config to flash: [`Verb::Set`] and
+    /// [`Verb::Reset`] touch RAM only, so a host's changes stay volatile until a
+    /// `Save` commits them (and survive a power cycle only once saved). Ignores
+    /// feature/state.
+    Save = 0x0B,
+}
+
+/// The feature selector in `cdb[5]` for [`Verb::Set`] / [`Verb::Get`]. These
+/// numeric values ARE the wire protocol.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[repr(u8)]
+pub enum Feature {
+    /// Read-speed / riplock ceiling. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM ramp;
+    /// [`STATE_OFF`] (`0x00`) = speed control off, i.e. the cap is lifted and the
+    /// drive runs uncapped at maximum throughput (see [`SPEED_MAX`]); `0x01..=0xFE`
+    /// = an explicit speed cap (the byte IS the cap, lower is slower). Note the OFF
+    /// direction: "off" means the *limiter* is off, so OFF is the fastest state.
+    Speed = 0x01,
+    /// Region (RPC) control. [`STATE_PASSTHROUGH`] (`0xFF`) = drive's own region
+    /// logic; [`STATE_OFF`] (`0x00`) = region-locked (nothing plays);
+    /// [`REGION_DVD_BASE`]` + N` (`0x01..=0x08`) = force DVD region 1..8;
+    /// [`REGION_BD_A`]/`_B`/`_C` (`0x0A`/`0x0B`/`0x0C`) = force BD region A/B/C;
+    /// [`REGION_FREE`] (`0x0F`) = region-free (any disc plays).
+    Region = 0x02,
+    /// UHD (AACS 2.0) capability gate. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM (as
+    /// shipped); [`STATE_OFF`] (`0x00`) = No (refuse UHD discs); [`STATE_ON`]
+    /// (`0x01`) = Yes (accept UHD — the mode gate is neutralized so the drive
+    /// engages UHD discs). On the byte-extraction classifier (e.g. BU40N) the No
+    /// (OFF) leg currently reads back but behaves == OEM (boot-safe no-op, pending
+    /// deeper RE) — do NOT treat OFF as a proven UHD disable there.
+    Uhd = 0x03,
+    /// Blu-ray (AACS 1.0) capability gate. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM (BD
+    /// engaged as shipped); [`STATE_OFF`] (`0x00`) = No (force-refuse BD discs — the
+    /// drive raises its own `6F` refusal sense); [`STATE_ON`] (`0x01`) = Yes (accept
+    /// BD — an enable direction, not a no-op).
+    Bd = 0x04,
+    /// Host Revocation List handling on the cert path. [`STATE_PASSTHROUGH`]
+    /// (`0xFF`) = OEM enforce; [`STATE_OFF`] (`0x00`) = off (skip the HRL lookup —
+    /// revoked certs accepted, non-destructive, the unlock direction); [`STATE_ON`]
+    /// (`0x01`) = on (enforce the HRL).
+    Hrl = 0x05,
+    /// Drive-host AKE. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM real handshake;
+    /// [`STATE_OFF`] (`0x00`) = off (null/bypass — the drive acts pre-authenticated,
+    /// the unlock direction); [`STATE_ON`] (`0x01`) = on (require the real handshake).
+    Ake = 0x06,
+    /// In-transit AACS bus encryption. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM (bus
+    /// encryption on); [`STATE_OFF`] (`0x00`) = off (de-bussed — content returned
+    /// with no bus encryption, the unlock direction); [`STATE_ON`] (`0x01`) = on
+    /// (bus encryption).
+    Bus = 0x07,
+}
+
+/// The set of all features, in the canonical order the IDENTITY feature-state
+/// table serialises them (and the order [`FirmwareControl::states`] probes).
+pub const ALL_FEATURES: [Feature; 7] = [
+    Feature::Speed,
+    Feature::Region,
+    Feature::Uhd,
+    Feature::Bd,
+    Feature::Hrl,
+    Feature::Ake,
+    Feature::Bus,
+];
+
+/// A Blu-ray region for [`FirmwareControl::force_region_bd`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BdRegion {
+    /// Region A (`0x0A`).
+    A,
+    /// Region B (`0x0B`).
+    B,
+    /// Region C (`0x0C`).
+    C,
+}
+
+impl BdRegion {
+    /// The `Feature::Region` state byte that forces this BD region.
+    pub fn state(self) -> u8 {
+        match self {
+            BdRegion::A => REGION_BD_A,
+            BdRegion::B => REGION_BD_B,
+            BdRegion::C => REGION_BD_C,
+        }
+    }
+}
+
+// ── CDB builders (mirror of abi.rs) ──────────────────────────────────────────
+
+/// Build a 10-byte host CDB for a verb over the `3C 0E C0 DE …` frame.
+///
+/// `feature`/`state` land at `cdb[5]`/`cdb[6]` (0 when the verb ignores them);
+/// `alloc_len` is the data-in buffer size, 16-bit big-endian at `cdb[7..9]`.
+/// Use [`build_memread_cdb`] for [`Verb::DumpAll`] (different field layout).
+pub fn build_cdb(
+    verb: Verb,
+    feature: Option<Feature>,
+    state: Option<u8>,
+    alloc_len: u16,
+) -> [u8; CDB_LEN] {
+    let mut cdb = [0u8; CDB_LEN];
+    cdb[CDB_OPCODE] = READ_BUFFER_OPCODE;
+    cdb[CDB_MODE] = KNOCK_MODE;
+    cdb[CDB_KNOCK..CDB_KNOCK + 2].copy_from_slice(&KNOCK);
+    cdb[CDB_VERB] = verb as u8;
+    cdb[CDB_FEATURE] = feature.map(|f| f as u8).unwrap_or(0);
+    cdb[CDB_STATE] = state.unwrap_or(0);
+    cdb[CDB_ALLOC_LEN] = (alloc_len >> 8) as u8;
+    cdb[CDB_ALLOC_LEN + 1] = alloc_len as u8;
+    cdb
+}
+
+/// Build a `SET feature = state` CDB. Requests a [`MIN_ALLOC_LEN`]-byte data-in
+/// (the drive aborts sub-16-byte transfers — HW-confirmed, see [`MIN_ALLOC_LEN`]);
+/// the feature/state ride in the CDB, so the returned payload is ignored.
+pub fn build_set_cdb(feature: Feature, state: u8) -> [u8; CDB_LEN] {
+    build_cdb(Verb::Set, Some(feature), Some(state), MIN_ALLOC_LEN)
+}
+
+/// Build a `GET feature` CDB. Requests a [`MIN_ALLOC_LEN`]-byte data-in (the
+/// drive aborts a 1-byte transfer — HW-confirmed, see [`MIN_ALLOC_LEN`]); the
+/// current state byte is read back from data offset 0.
+pub fn build_get_cdb(feature: Feature) -> [u8; CDB_LEN] {
+    build_cdb(Verb::Get, Some(feature), None, MIN_ALLOC_LEN)
+}
+
+/// Build a `RESET` CDB. `mode` rides in the state slot (`cdb[6]`):
+/// [`RESET_TO_FLASH`] (`0x00`) reloads the saved flash config into RAM,
+/// [`RESET_TO_DEFAULTS`] (`0x01`) restores the baked create-time defaults, and
+/// [`RESET_TO_OEM`] (`0xFF`) forces every feature to passthrough (and blanks NV).
+/// Floors its data-in at [`MIN_ALLOC_LEN`] for the same HW min-transfer reason as
+/// [`build_set_cdb`].
+pub fn build_reset_cdb(mode: u8) -> [u8; CDB_LEN] {
+    build_cdb(Verb::Reset, None, Some(mode), MIN_ALLOC_LEN)
+}
+
+/// Build a `SAVE` CDB (persist the RAM feature-state table to the flash config
+/// block — the only verb that writes config to flash). Floors its data-in at
+/// [`MIN_ALLOC_LEN`] for the same HW min-transfer reason as [`build_reset_cdb`].
+pub fn build_save_cdb() -> [u8; CDB_LEN] {
+    build_cdb(Verb::Save, None, None, MIN_ALLOC_LEN)
+}
+
+/// Build an `IDENTITY` CDB. `alloc_len` sizes the magic+version+state reply.
+pub fn build_identity_cdb(alloc_len: u16) -> [u8; CDB_LEN] {
+    build_cdb(Verb::Identity, None, None, alloc_len)
+}
+
+/// Build a [`Verb::DumpAll`] CDB: read [`MEMREAD_LEN`] bytes at the 32-bit
+/// `addr`, packed big-endian into `cdb[5..9]`.
+pub fn build_memread_cdb(addr: u32) -> [u8; CDB_LEN] {
+    let mut cdb = [0u8; CDB_LEN];
+    cdb[CDB_OPCODE] = READ_BUFFER_OPCODE;
+    cdb[CDB_MODE] = KNOCK_MODE;
+    cdb[CDB_KNOCK..CDB_KNOCK + 2].copy_from_slice(&KNOCK);
+    cdb[CDB_VERB] = Verb::DumpAll as u8;
+    cdb[5] = (addr >> 24) as u8;
+    cdb[6] = (addr >> 16) as u8;
+    cdb[7] = (addr >> 8) as u8;
+    cdb[8] = addr as u8;
+    cdb
+}
+
+/// Whether a device data response leads with [`RESP_MAGIC`].
+pub fn verify_response(bytes: &[u8]) -> bool {
+    bytes.starts_with(RESP_MAGIC)
+}
+
+// ── Errors ───────────────────────────────────────────────────────────────────
+
+/// Why a firmware command did not succeed.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum FirmwareError {
+    /// The drive rejected the command (CHECK CONDITION / vendor refusal). Not a
+    /// freemkv drive, or the feature/state is unsupported.
+    Rejected,
+    /// A verify-after-set (`SET` then `GET`) read back a state that did not
+    /// match what was written. Carries `(feature, wanted, got)`.
+    VerifyFailed {
+        feature: Feature,
+        wanted: u8,
+        got: u8,
+    },
+    /// A genuine SCSI transport fault (bus dead). Callers must abort.
+    Transport,
+}
+
+/// Result of a firmware command.
+pub type Result<T> = std::result::Result<T, FirmwareError>;
+
+/// Whether a transport error is a genuine dead bus (a senseless
+/// transport-failure status) rather than a drive rejection surfaced through a
+/// non-conforming transport (`Err` carrying a sense).
+fn is_dead_bus(e: &crate::scsi::ScsiError) -> bool {
+    e.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE && e.sense.is_none()
+}
+
+// ── Parsed replies ───────────────────────────────────────────────────────────
+
+/// The current state of every feature, indexed by [`Feature`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FeatureStates {
+    /// [`Feature::Speed`] state.
+    pub speed: u8,
+    /// [`Feature::Region`] state.
+    pub region: u8,
+    /// [`Feature::Uhd`] state.
+    pub uhd: u8,
+    /// [`Feature::Bd`] state.
+    pub bd: u8,
+    /// [`Feature::Hrl`] state.
+    pub hrl: u8,
+    /// [`Feature::Ake`] state.
+    pub ake: u8,
+    /// [`Feature::Bus`] state.
+    pub bus: u8,
+}
+
+impl FeatureStates {
+    /// All features at [`STATE_PASSTHROUGH`] (the OEM / freshly-reset drive).
+    pub fn all_passthrough() -> Self {
+        FeatureStates {
+            speed: STATE_PASSTHROUGH,
+            region: STATE_PASSTHROUGH,
+            uhd: STATE_PASSTHROUGH,
+            bd: STATE_PASSTHROUGH,
+            hrl: STATE_PASSTHROUGH,
+            ake: STATE_PASSTHROUGH,
+            bus: STATE_PASSTHROUGH,
+        }
+    }
+
+    /// The state byte for one feature.
+    pub fn get(&self, feature: Feature) -> u8 {
+        match feature {
+            Feature::Speed => self.speed,
+            Feature::Region => self.region,
+            Feature::Uhd => self.uhd,
+            Feature::Bd => self.bd,
+            Feature::Hrl => self.hrl,
+            Feature::Ake => self.ake,
+            Feature::Bus => self.bus,
+        }
+    }
+
+    fn set(&mut self, feature: Feature, state: u8) {
+        match feature {
+            Feature::Speed => self.speed = state,
+            Feature::Region => self.region = state,
+            Feature::Uhd => self.uhd = state,
+            Feature::Bd => self.bd = state,
+            Feature::Hrl => self.hrl = state,
+            Feature::Ake => self.ake = state,
+            Feature::Bus => self.bus = state,
+        }
+    }
+}
+
+/// A parsed [`Verb::Identity`] reply. Only present when the reply led with
+/// [`RESP_MAGIC`]. The firmware answers IDENTITY with a human banner
+/// `freemkv <version>` (NUL-padded) — there is NO binary state table in the
+/// reply, so this carries only the version string; read the live feature states
+/// via [`FirmwareControl::states`]/[`get`](FirmwareControl::get).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct FirmwareIdentity {
+    /// Firmware version string, the banner text after [`RESP_MAGIC`] up to the
+    /// first NUL, trimmed (e.g. `"0.7.1"`).
+    pub version: String,
+}
+
+impl FirmwareIdentity {
+    /// Parse an IDENTITY data-in payload. `None` unless it leads with
+    /// [`RESP_MAGIC`] (i.e. not freemkv firmware). Layout: `RESP_MAGIC` (7) +
+    /// ASCII version banner, NUL-terminated/padded.
+    pub fn parse(bytes: &[u8]) -> Option<Self> {
+        if !verify_response(bytes) {
+            return None;
+        }
+        let tail = &bytes[RESP_MAGIC.len()..];
+        let end = tail.iter().position(|&b| b == 0).unwrap_or(tail.len());
+        let version = String::from_utf8_lossy(&tail[..end]).trim().to_string();
+        Some(FirmwareIdentity { version })
+    }
+}
+
+/// A named arming recipe (see [`FirmwareControl`] `arm_*` helpers). Lets a
+/// caller pick a mode by value (e.g. from a CLI flag or a config field) and
+/// apply it uniformly.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ArmRecipe {
+    /// [`FirmwareControl::arm_oem_bd`].
+    OemBd,
+    /// [`FirmwareControl::arm_oem_uhd`].
+    OemUhd,
+    /// [`FirmwareControl::arm_bypass_bd`].
+    BypassBd,
+    /// [`FirmwareControl::arm_bypass_uhd`].
+    BypassUhd,
+    /// [`FirmwareControl::arm_stealth_oem`].
+    StealthOem,
+}
+
+// ── FirmwareControl ──────────────────────────────────────────────────────────
+
+/// A timeout every firmware command uses (ms). Matches the wider unlocker.
+const CMD_TIMEOUT_MS: u32 = 5_000;
+
+/// An ergonomic, typed driver for the freemkv vendor-command grammar over any
+/// [`ScsiTransport`]. Borrows the transport for the lifetime of the control.
+///
+/// ```no_run
+/// # use freemkv_unlock::firmware::{FirmwareControl, Feature};
+/// # fn demo(scsi: &mut dyn freemkv_unlock::scsi::ScsiTransport) {
+/// let mut fw = FirmwareControl::new(scsi);
+/// if fw.is_freemkv().unwrap_or(false) {
+///     // Real AKE on a UHD disc, revocation ignored, bus de-encrypted:
+///     let _ = fw.arm_oem_uhd();
+/// }
+/// # }
+/// ```
+pub struct FirmwareControl<'a> {
+    scsi: &'a mut dyn ScsiTransport,
+}
+
+impl<'a> FirmwareControl<'a> {
+    /// Wrap a transport.
+    pub fn new(scsi: &'a mut dyn ScsiTransport) -> Self {
+        FirmwareControl { scsi }
+    }
+
+    /// Issue a CDB with a data-in phase, returning the bytes transferred into a
+    /// fixed [`MEMREAD_LEN`]-byte buffer.
+    fn exec_in(&mut self, cdb: &[u8; CDB_LEN]) -> Result<([u8; MEMREAD_LEN], usize)> {
+        let mut buf = [0u8; MEMREAD_LEN];
+        match self
+            .scsi
+            .execute(cdb, DataDirection::FromDevice, &mut buf, CMD_TIMEOUT_MS)
+        {
+            Ok(r) if r.status == 0 => Ok((buf, r.bytes_transferred)),
+            Ok(_) => Err(FirmwareError::Rejected),
+            Err(e) => Err(if is_dead_bus(&e) {
+                FirmwareError::Transport
+            } else {
+                FirmwareError::Rejected
+            }),
+        }
+    }
+
+    /// Send IDENTITY and parse the magic + version banner.
+    /// `Ok(None)` if the drive answered but the reply lacked [`RESP_MAGIC`] (not
+    /// freemkv firmware); `Err(Transport)` only on a dead bus, `Err(Rejected)`
+    /// if the drive refused the command outright (also "not freemkv").
+    pub fn identity(&mut self) -> Result<Option<FirmwareIdentity>> {
+        let cdb = build_identity_cdb(MEMREAD_LEN as u16);
+        match self.exec_in(&cdb) {
+            Ok((buf, n)) => Ok(FirmwareIdentity::parse(&buf[..n.min(buf.len())])),
+            // A drive that rejects the knock is simply not freemkv firmware.
+            Err(FirmwareError::Rejected) => Ok(None),
+            Err(e) => Err(e),
+        }
+    }
+
+    /// Convenience: is this a freemkv-firmware drive? `false` on a rejection or a
+    /// no-magic reply; `Err(Transport)` on a dead bus.
+    pub fn is_freemkv(&mut self) -> Result<bool> {
+        Ok(self.identity()?.is_some())
+    }
+
+    /// Read one feature's current state byte (GET).
+    pub fn get(&mut self, feature: Feature) -> Result<u8> {
+        let cdb = build_get_cdb(feature);
+        let (buf, n) = self.exec_in(&cdb)?;
+        if n == 0 {
+            return Err(FirmwareError::Rejected);
+        }
+        Ok(buf[0])
+    }
+
+    /// Set one feature to an explicit state byte (SET).
+    ///
+    /// Issued with a data-in phase (`exec_in`), not `exec_none`: the drive's
+    /// READ BUFFER hijack aborts ANY vendor verb that carries no data-in
+    /// transfer — the `MIN_ALLOC_LEN` floor in the CDB is only honored when the
+    /// host actually reads that many bytes back. The returned bytes are the
+    /// echoed state frame; we discard them (GET is the read path).
+    pub fn set(&mut self, feature: Feature, state: u8) -> Result<()> {
+        let cdb = build_set_cdb(feature, state);
+        self.exec_in(&cdb).map(|_| ())
+    }
+
+    /// Restore every feature to [`STATE_PASSTHROUGH`] (RESET with [`RESET_TO_OEM`])
+    /// — TRUE OEM: firmware ≥0.8.3 also blanks the NV block so the drive is
+    /// traceless. Data-in phase for the same reason as [`set`](Self::set) — a no-data
+    /// RESET is aborted.
+    pub fn reset(&mut self) -> Result<()> {
+        let cdb = build_reset_cdb(RESET_TO_OEM);
+        self.exec_in(&cdb).map(|_| ())
+    }
+
+    /// Restore the baked create-time defaults into the RAM feature-state table
+    /// (RESET with [`RESET_TO_DEFAULTS`]) — what a never-saved drive boots to; does
+    /// not touch flash. Firmware ≥0.8.3. Data-in phase for the same reason as
+    /// [`reset`](Self::reset).
+    pub fn reset_to_defaults(&mut self) -> Result<()> {
+        let cdb = build_reset_cdb(RESET_TO_DEFAULTS);
+        self.exec_in(&cdb).map(|_| ())
+    }
+
+    /// Reload the saved flash config block back into the RAM feature-state table
+    /// (RESET with [`RESET_TO_FLASH`]), discarding any un-saved RAM changes — the
+    /// non-destructive "revert to last SAVE". Data-in phase for the same reason as
+    /// [`reset`](Self::reset).
+    pub fn reset_to_flash(&mut self) -> Result<()> {
+        let cdb = build_reset_cdb(RESET_TO_FLASH);
+        self.exec_in(&cdb).map(|_| ())
+    }
+
+    /// Persist the whole RAM feature-state table to the flash config block (SAVE)
+    /// — the only verb that writes config to flash, so a host's SET changes survive
+    /// a power cycle only once saved. Data-in phase for the same reason as
+    /// [`reset`](Self::reset).
+    pub fn save(&mut self) -> Result<()> {
+        let cdb = build_save_cdb();
+        self.exec_in(&cdb).map(|_| ())
+    }
+
+    /// SET a feature, then GET it back and confirm the state stuck.
+    fn set_verify(&mut self, feature: Feature, state: u8) -> Result<()> {
+        self.set(feature, state)?;
+        let got = self.get(feature)?;
+        if got == state {
+            Ok(())
+        } else {
+            Err(FirmwareError::VerifyFailed {
+                feature,
+                wanted: state,
+                got,
+            })
+        }
+    }
+
+    /// Read the current state of every feature via repeated GET.
+    pub fn states(&mut self) -> Result<FeatureStates> {
+        let mut s = FeatureStates::all_passthrough();
+        for feature in ALL_FEATURES {
+            s.set(feature, self.get(feature)?);
+        }
+        Ok(s)
+    }
+
+    /// Diagnostic RAM peek: [`MEMREAD_LEN`] bytes at `addr` (DUMPALL).
+    pub fn dump(&mut self, addr: u32) -> Result<[u8; MEMREAD_LEN]> {
+        let cdb = build_memread_cdb(addr);
+        let (buf, n) = self.exec_in(&cdb)?;
+        if n < MEMREAD_LEN {
+            return Err(FirmwareError::Rejected);
+        }
+        Ok(buf)
+    }
+
+    // ── Typed setters ────────────────────────────────────────────────────────
+
+    /// Force the UHD (AACS 2.0) capability gate on (drive engages UHD discs).
+    pub fn enable_uhd(&mut self) -> Result<()> {
+        self.set(Feature::Uhd, STATE_ON)
+    }
+    /// Force the UHD capability gate off.
+    pub fn disable_uhd(&mut self) -> Result<()> {
+        self.set(Feature::Uhd, STATE_OFF)
+    }
+    /// Force the Blu-ray (AACS 1.0) capability gate on.
+    pub fn enable_bd(&mut self) -> Result<()> {
+        self.set(Feature::Bd, STATE_ON)
+    }
+    /// Force the Blu-ray capability gate off (drive refuses BD discs). Sends the
+    /// uniform [`STATE_OFF`] (`0x00`) — an unarmed image boots to [`STATE_PASSTHROUGH`]
+    /// (`0xFF`, OEM) via the firmware power-on hook, so `0x00` no longer collides
+    /// with the boot value (the retired `0x02` sentinel is gone).
+    pub fn disable_bd(&mut self) -> Result<()> {
+        self.set(Feature::Bd, STATE_OFF)
+    }
+    /// Skip the HRL lookup (revoked certs accepted; non-destructive). The unlock
+    /// direction is now [`STATE_OFF`] (`0x00` = HRL enforcement off).
+    pub fn skip_hrl(&mut self) -> Result<()> {
+        self.set(Feature::Hrl, STATE_OFF)
+    }
+    /// Null the drive-host AKE (drive acts pre-authenticated). The unlock direction
+    /// is now [`STATE_OFF`] (`0x00` = handshake off/bypassed).
+    pub fn null_ake(&mut self) -> Result<()> {
+        self.set(Feature::Ake, STATE_OFF)
+    }
+    /// Turn AACS in-transit bus encryption off (content returned de-bussed). The
+    /// unlock direction is now [`STATE_OFF`] (`0x00` = bus encryption off).
+    pub fn bus_off(&mut self) -> Result<()> {
+        self.set(Feature::Bus, STATE_OFF)
+    }
+    /// Region-free (RPC-1). Sends [`REGION_FREE`] (`0x0F`) — under the migrated
+    /// region scheme `0x01` now means "force DVD region 1", not region-free.
+    pub fn region_free(&mut self) -> Result<()> {
+        self.set(Feature::Region, REGION_FREE)
+    }
+    /// Force a specific Blu-ray region.
+    pub fn force_region_bd(&mut self, region: BdRegion) -> Result<()> {
+        self.set(Feature::Region, region.state())
+    }
+    /// Force a specific DVD region (1..=8). Returns [`FirmwareError::Rejected`]
+    /// for an out-of-range region rather than sending a malformed state.
+    pub fn force_region_dvd(&mut self, region: u8) -> Result<()> {
+        if !(1..=8).contains(&region) {
+            return Err(FirmwareError::Rejected);
+        }
+        self.set(Feature::Region, REGION_DVD_BASE + region)
+    }
+    /// Lift the read-speed / riplock ceiling to maximum.
+    pub fn unlock_speed(&mut self) -> Result<()> {
+        self.set(Feature::Speed, SPEED_MAX)
+    }
+
+    // ── Named recipes (the "modes" table) ─────────────────────────────────────
+
+    /// **arm_oem_bd** — OEM-style Blu-ray (AACS 1.0) rip with a REAL AKE, only
+    /// revocation disabled.
+    ///
+    /// Sets: `Hrl = skip` (revoked host certs accepted; non-destructive).
+    /// Leaves everything else at passthrough — the drive still runs the real
+    /// host-cert handshake and returns bus-encrypted content, so the host
+    /// performs the AKE and de-busses. Rips: BD with an otherwise-revoked cert.
+    pub fn arm_oem_bd(&mut self) -> Result<()> {
+        self.set_verify(Feature::Hrl, STATE_OFF)
+    }
+
+    /// **arm_oem_uhd** — OEM-style UHD (AACS 2.0) rip with a REAL AKE.
+    ///
+    /// Sets: `Uhd = on` (mode-gate neutralized so the drive engages the UHD
+    /// disc), `Hrl = skip` (revocation off), `Bus = off` (content de-bussed).
+    /// The host still runs the real AKE. Rips: UHD via the OEM cert path.
+    pub fn arm_oem_uhd(&mut self) -> Result<()> {
+        self.set_verify(Feature::Uhd, STATE_ON)?;
+        self.set_verify(Feature::Hrl, STATE_OFF)?;
+        self.set_verify(Feature::Bus, STATE_OFF)
+    }
+
+    /// **arm_bypass_bd** — full-bypass Blu-ray rip (NO host cert needed).
+    ///
+    /// Sets: `Ake = null` (drive acts pre-authenticated, so a bare VID read
+    /// returns the volume ID with no cert and no AKE) and `Hrl = skip`
+    /// (revocation off, so a revoked/absent cert never trips the HRL check).
+    /// Rips: BD with no cert.
+    pub fn arm_bypass_bd(&mut self) -> Result<()> {
+        self.set_verify(Feature::Hrl, STATE_OFF)?;
+        self.set_verify(Feature::Ake, STATE_OFF)
+    }
+
+    /// **arm_bypass_uhd** — full-bypass UHD rip (NO host cert needed).
+    ///
+    /// Sets: `Uhd = on` (engage the UHD disc), `Ake = null` (skip the
+    /// handshake), `Bus = off` (content de-bussed), and `Hrl = skip`
+    /// (revocation off). Rips: UHD with no cert.
+    pub fn arm_bypass_uhd(&mut self) -> Result<()> {
+        self.set_verify(Feature::Uhd, STATE_ON)?;
+        self.set_verify(Feature::Hrl, STATE_OFF)?;
+        self.set_verify(Feature::Ake, STATE_OFF)?;
+        self.set_verify(Feature::Bus, STATE_OFF)
+    }
+
+    /// **arm_stealth_oem** — return the drive to byte-for-byte OEM behaviour.
+    ///
+    /// Issues RESET (every feature → passthrough) and verifies each feature read
+    /// back as [`STATE_PASSTHROUGH`]. Rips: nothing — this DISARMS the drive.
+    pub fn arm_stealth_oem(&mut self) -> Result<()> {
+        self.reset()?;
+        for feature in ALL_FEATURES {
+            let got = self.get(feature)?;
+            if got != STATE_PASSTHROUGH {
+                return Err(FirmwareError::VerifyFailed {
+                    feature,
+                    wanted: STATE_PASSTHROUGH,
+                    got,
+                });
+            }
+        }
+        Ok(())
+    }
+
+    /// Apply a named [`ArmRecipe`].
+    pub fn arm(&mut self, recipe: ArmRecipe) -> Result<()> {
+        match recipe {
+            ArmRecipe::OemBd => self.arm_oem_bd(),
+            ArmRecipe::OemUhd => self.arm_oem_uhd(),
+            ArmRecipe::BypassBd => self.arm_bypass_bd(),
+            ArmRecipe::BypassUhd => self.arm_bypass_uhd(),
+            ArmRecipe::StealthOem => self.arm_stealth_oem(),
+        }
+    }
+}
+
+#[cfg(test)]
+#[path = "mod_tests.rs"]
+mod tests;

src/firmware/mod_tests.rs

@@ -0,0 +1,589 @@
+//! Tests for the firmware vendor-command mirror + [`FirmwareControl`].
+
+use super::*;
+use crate::scsi::mock::{MockTransport, Reply};
+use crate::scsi::{DataDirection, Result as ScsiTResult, ScsiResult, ScsiTransport};
+
+// ── Pinned-value drift guards (vs. freemkv-fw/src/abi.rs) ────────────────────
+
+#[test]
+fn verb_values_match_abi() {
+    assert_eq!(Verb::Identity as u8, 0x01);
+    assert_eq!(Verb::Set as u8, 0x02);
+    assert_eq!(Verb::Get as u8, 0x03);
+    assert_eq!(Verb::Reset as u8, 0x04);
+    assert_eq!(Verb::DumpAll as u8, 0x09);
+    assert_eq!(Verb::Save as u8, 0x0B);
+}
+
+#[test]
+fn feature_values_match_abi() {
+    assert_eq!(Feature::Speed as u8, 0x01);
+    assert_eq!(Feature::Region as u8, 0x02);
+    assert_eq!(Feature::Uhd as u8, 0x03);
+    assert_eq!(Feature::Bd as u8, 0x04);
+    assert_eq!(Feature::Hrl as u8, 0x05);
+    assert_eq!(Feature::Ake as u8, 0x06);
+    assert_eq!(Feature::Bus as u8, 0x07);
+}
+
+#[test]
+fn state_and_frame_constants_match_abi() {
+    assert_eq!(READ_BUFFER_OPCODE, 0x3C);
+    assert_eq!(KNOCK_MODE, 0x0E);
+    assert_eq!(KNOCK, [0xC0, 0xDE]);
+    assert_eq!(RESP_MAGIC, b"freemkv");
+    assert_eq!(CDB_LEN, 10);
+    assert_eq!(MEMREAD_LEN, 64);
+    assert_eq!(MIN_ALLOC_LEN, 64);
+    assert_eq!(STATE_PASSTHROUGH, 0xFF);
+    assert_eq!(STATE_OFF, 0x00);
+    assert_eq!(STATE_ON, 0x01);
+    assert_eq!(SPEED_MAX, 0x00);
+    assert_eq!([REGION_BD_A, REGION_BD_B, REGION_BD_C], [0x0A, 0x0B, 0x0C]);
+    assert_eq!(REGION_DVD_BASE, 0x00);
+    assert_eq!(REGION_FREE, 0x0F);
+    assert_eq!(RESET_TO_FLASH, 0x00);
+    assert_eq!(RESET_TO_DEFAULTS, 0x01);
+    assert_eq!(RESET_TO_OEM, 0xFF);
+}
+
+// ── CDB builders ─────────────────────────────────────────────────────────────
+
+#[test]
+fn build_set_cdb_exact_bytes() {
+    // SET Ake = ON: verb 02, feature 06, state 01, alloc MIN_ALLOC_LEN (0x0040)
+    // at cdb[7..9] big-endian — the drive aborts a sub-16-byte data-in.
+    assert_eq!(
+        build_set_cdb(Feature::Ake, STATE_ON),
+        [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x06, 0x01, 0x00, 0x40, 0x00]
+    );
+}
+
+#[test]
+fn build_get_cdb_exact_bytes() {
+    // GET Bus: verb 03, feature 07, alloc MIN_ALLOC_LEN (0x0040) at cdb[7..9]
+    // big-endian — the drive aborts a 1-byte data-in; state read from offset 0.
+    assert_eq!(
+        build_get_cdb(Feature::Bus),
+        [0x3C, 0x0E, 0xC0, 0xDE, 0x03, 0x07, 0x00, 0x00, 0x40, 0x00]
+    );
+}
+
+#[test]
+fn vendor_commands_floor_alloc_len_at_min_for_hw() {
+    // HW-confirmed: the drive aborts a vendor command with a sub-16-byte data-in
+    // allocation, so SET/GET/RESET all request at least MIN_ALLOC_LEN (= 64,
+    // comfortably above the ~16-byte hardware floor).
+    assert_eq!(MIN_ALLOC_LEN, 64);
+    let alloc =
+        |cdb: &[u8; CDB_LEN]| u16::from_be_bytes([cdb[CDB_ALLOC_LEN], cdb[CDB_ALLOC_LEN + 1]]);
+    assert_eq!(alloc(&build_set_cdb(Feature::Ake, STATE_ON)), MIN_ALLOC_LEN);
+    assert_eq!(alloc(&build_get_cdb(Feature::Ake)), MIN_ALLOC_LEN);
+    assert_eq!(alloc(&build_reset_cdb(RESET_TO_OEM)), MIN_ALLOC_LEN);
+    assert_eq!(alloc(&build_save_cdb()), MIN_ALLOC_LEN);
+}
+
+#[test]
+fn build_reset_and_identity_cdb_exact_bytes() {
+    // RESET carries its mode in the state slot (cdb[6]) and floors its data-in at
+    // MIN_ALLOC_LEN (0x0040) for the same HW reason: to-OEM = 0xFF, to-flash = 0x00.
+    assert_eq!(
+        build_reset_cdb(RESET_TO_OEM),
+        [0x3C, 0x0E, 0xC0, 0xDE, 0x04, 0x00, 0xFF, 0x00, 0x40, 0x00]
+    );
+    assert_eq!(
+        build_reset_cdb(RESET_TO_FLASH),
+        [0x3C, 0x0E, 0xC0, 0xDE, 0x04, 0x00, 0x00, 0x00, 0x40, 0x00]
+    );
+    // SAVE takes no feature/state and floors its data-in at MIN_ALLOC_LEN.
+    assert_eq!(
+        build_save_cdb(),
+        [0x3C, 0x0E, 0xC0, 0xDE, 0x0B, 0x00, 0x00, 0x00, 0x40, 0x00]
+    );
+    // IDENTITY with a 64-byte allocation (0x0040 big-endian at cdb[7..9]).
+    assert_eq!(
+        build_identity_cdb(MEMREAD_LEN as u16),
+        [0x3C, 0x0E, 0xC0, 0xDE, 0x01, 0x00, 0x00, 0x00, 0x40, 0x00]
+    );
+}
+
+#[test]
+fn build_cdb_encodes_alloc_len_16bit_big_endian() {
+    let cdb = build_cdb(Verb::Identity, None, None, 0x1234);
+    assert_eq!([cdb[CDB_ALLOC_LEN], cdb[CDB_ALLOC_LEN + 1]], [0x12, 0x34]);
+}
+
+#[test]
+fn build_memread_cdb_packs_address_big_endian_at_5_to_9() {
+    let cdb = build_memread_cdb(0xDEAD_BEEF);
+    assert_eq!(cdb[CDB_VERB], Verb::DumpAll as u8);
+    assert_eq!([cdb[5], cdb[6], cdb[7], cdb[8]], [0xDE, 0xAD, 0xBE, 0xEF]);
+    assert_eq!(cdb[9], 0x00);
+}
+
+#[test]
+fn region_state_bytes() {
+    assert_eq!(BdRegion::A.state(), 0x0A);
+    assert_eq!(BdRegion::B.state(), 0x0B);
+    assert_eq!(BdRegion::C.state(), 0x0C);
+}
+
+// ── Identity / states parsing ────────────────────────────────────────────────
+
+#[test]
+fn identity_parse_reads_version_banner() {
+    // The firmware answers IDENTITY with the ASCII banner `freemkv <ver>`,
+    // NUL-padded — there is no binary state table.
+    let mut payload = Vec::new();
+    payload.extend_from_slice(RESP_MAGIC);
+    payload.extend_from_slice(b" 0.7.1\0");
+    payload.resize(64, 0); // NUL-pad to the allocation window
+    let id = FirmwareIdentity::parse(&payload).expect("has magic");
+    assert_eq!(id.version, "0.7.1");
+}
+
+#[test]
+fn identity_parse_none_without_magic() {
+    assert!(FirmwareIdentity::parse(&[0u8; 64]).is_none());
+}
+
+// ── A stateful firmware mock ─────────────────────────────────────────────────
+
+/// A mock freemkv drive: answers IDENTITY with the `freemkv <ver>` banner, GET
+/// with the requested feature's state, applies SET, and RESET → all-passthrough.
+/// Records every CDB so tests can assert the exact command order.
+///
+/// It also models the real hardware constraint: any vendor verb executed with
+/// [`DataDirection::None`] (no data-in phase) is REJECTED with a non-zero
+/// status, exactly as the drive's READ BUFFER hijack aborts a no-data verb.
+struct FwMock {
+    version: &'static str,
+    states: FeatureStates,
+    /// The saved flash config block: SAVE snapshots `states` into it, RESET
+    /// with RESET_TO_FLASH reloads it, RESET_TO_OEM forces all-passthrough.
+    saved: FeatureStates,
+    is_freemkv: bool,
+    cdbs: Vec<Vec<u8>>,
+}
+
+impl FwMock {
+    fn new() -> Self {
+        FwMock {
+            version: "0.6.6",
+            states: FeatureStates::all_passthrough(),
+            saved: FeatureStates::all_passthrough(),
+            is_freemkv: true,
+            cdbs: Vec::new(),
+        }
+    }
+    fn feature_of(id: u8) -> Feature {
+        *ALL_FEATURES
+            .iter()
+            .find(|f| **f as u8 == id)
+            .expect("known feature id")
+    }
+    /// The verbs issued, in order (cdb[4] of each recorded CDB).
+    fn verbs(&self) -> Vec<u8> {
+        self.cdbs.iter().map(|c| c[CDB_VERB]).collect()
+    }
+}
+
+impl ScsiTransport for FwMock {
+    fn execute(
+        &mut self,
+        cdb: &[u8],
+        dir: DataDirection,
+        data: &mut [u8],
+        _timeout_ms: u32,
+    ) -> ScsiTResult<ScsiResult> {
+        self.cdbs.push(cdb.to_vec());
+        // Model the hardware: a vendor verb with no data-in phase is aborted.
+        // This is what makes the old `exec_none` SET/RESET path a test failure.
+        let is_vendor = cdb[CDB_OPCODE] == READ_BUFFER_OPCODE && cdb[CDB_MODE] == KNOCK_MODE;
+        if is_vendor && matches!(dir, DataDirection::None) {
+            return Ok(ScsiResult {
+                status: 0x02, // CHECK CONDITION — rejected
+                bytes_transferred: 0,
+                sense: [0u8; 32],
+            });
+        }
+        let mut transferred = 0usize;
+        match cdb[CDB_VERB] {
+            v if v == Verb::Identity as u8 => {
+                if self.is_freemkv {
+                    // The `freemkv <ver>` banner, NUL-terminated.
+                    let mut resp = Vec::new();
+                    resp.extend_from_slice(RESP_MAGIC);
+                    resp.push(b' ');
+                    resp.extend_from_slice(self.version.as_bytes());
+                    resp.push(0);
+                    let n = resp.len().min(data.len());
+                    data[..n].copy_from_slice(&resp[..n]);
+                    transferred = n;
+                }
+                // non-freemkv: GOOD status but no magic (buffer stays zero)
+                if !self.is_freemkv {
+                    transferred = data.len();
+                }
+            }
+            v if v == Verb::Get as u8 => {
+                let f = Self::feature_of(cdb[CDB_FEATURE]);
+                if !data.is_empty() {
+                    data[0] = self.states.get(f);
+                    transferred = 1;
+                }
+            }
+            v if v == Verb::Set as u8 => {
+                let f = Self::feature_of(cdb[CDB_FEATURE]);
+                self.states.set(f, cdb[CDB_STATE]);
+            }
+            v if v == Verb::Reset as u8 => {
+                // The mode rides in the state slot (cdb[6]): to-OEM forces
+                // all-passthrough, to-flash reloads the saved config block.
+                self.states = if cdb[CDB_STATE] == RESET_TO_FLASH {
+                    self.saved
+                } else {
+                    FeatureStates::all_passthrough()
+                };
+            }
+            v if v == Verb::Save as u8 => {
+                self.saved = self.states;
+            }
+            v if v == Verb::DumpAll as u8 => {
+                for (i, b) in data.iter_mut().enumerate() {
+                    *b = i as u8;
+                }
+                transferred = data.len();
+            }
+            _ => {}
+        }
+        Ok(ScsiResult {
+            status: 0,
+            bytes_transferred: transferred,
+            sense: [0u8; 32],
+        })
+    }
+}
+
+// ── FirmwareControl behaviour ────────────────────────────────────────────────
+
+#[test]
+fn identity_detects_freemkv_and_issues_identity_cdb() {
+    let mut m = FwMock::new();
+    m.states.ake = STATE_ON;
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        let id = fw.identity().expect("no fault").expect("is freemkv");
+        assert_eq!(id.version, "0.6.6");
+        // States no longer ride in IDENTITY — read them via GET.
+        assert_eq!(fw.get(Feature::Ake).expect("get"), STATE_ON);
+        assert!(fw.is_freemkv().expect("no fault"));
+    }
+    assert_eq!(m.cdbs[0], build_identity_cdb(MEMREAD_LEN as u16));
+}
+
+#[test]
+fn identity_none_on_non_freemkv() {
+    let mut m = FwMock::new();
+    m.is_freemkv = false;
+    let mut fw = FirmwareControl::new(&mut m);
+    assert!(fw.identity().expect("no fault").is_none());
+    assert!(!fw.is_freemkv().expect("no fault"));
+}
+
+#[test]
+fn identity_none_when_drive_rejects() {
+    let mut t = MockTransport::always(Reply::illegal_request());
+    let mut fw = FirmwareControl::new(&mut t);
+    assert!(fw.identity().expect("rejection is not a fault").is_none());
+}
+
+#[test]
+fn identity_transport_fault_propagates() {
+    let mut t = MockTransport::always(Reply::TransportFault);
+    let mut fw = FirmwareControl::new(&mut t);
+    assert_eq!(fw.identity().unwrap_err(), FirmwareError::Transport);
+}
+
+#[test]
+fn get_and_set_roundtrip_issue_the_right_cdbs() {
+    let mut m = FwMock::new();
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_PASSTHROUGH);
+        fw.set(Feature::Bus, STATE_ON).expect("set");
+        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_ON);
+    }
+    assert_eq!(m.cdbs[0], build_get_cdb(Feature::Bus));
+    assert_eq!(m.cdbs[1], build_set_cdb(Feature::Bus, STATE_ON));
+    assert_eq!(m.cdbs[2], build_get_cdb(Feature::Bus));
+}
+
+#[test]
+fn reset_sends_reset_cdb_and_clears_state() {
+    let mut m = FwMock::new();
+    m.states.ake = STATE_ON;
+    m.states.bus = STATE_ON;
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.reset().expect("reset");
+    }
+    assert_eq!(m.cdbs[0], build_reset_cdb(RESET_TO_OEM));
+    assert_eq!(m.states, FeatureStates::all_passthrough());
+}
+
+#[test]
+fn reset_to_defaults_sends_the_defaults_mode_cdb() {
+    let mut m = FwMock::new();
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.reset_to_defaults().expect("reset to defaults");
+    }
+    assert_eq!(m.cdbs[0], build_reset_cdb(RESET_TO_DEFAULTS));
+}
+
+#[test]
+fn save_then_reset_to_flash_restores_the_saved_value() {
+    // SET a feature, SAVE it, force all-passthrough with RESET(to-OEM), then
+    // RESET(to-flash) must reload the saved value (not passthrough).
+    let mut m = FwMock::new();
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.set(Feature::Bus, STATE_OFF).expect("set");
+        fw.save().expect("save");
+        fw.reset().expect("reset to OEM");
+        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_PASSTHROUGH);
+        fw.reset_to_flash().expect("reset to flash");
+        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_OFF);
+    }
+    // The verbs issued, in order: SET, SAVE, RESET, GET, RESET, GET.
+    assert_eq!(
+        m.verbs(),
+        vec![
+            Verb::Set as u8,
+            Verb::Save as u8,
+            Verb::Reset as u8,
+            Verb::Get as u8,
+            Verb::Reset as u8,
+            Verb::Get as u8,
+        ]
+    );
+    assert_eq!(m.cdbs[1], build_save_cdb());
+    assert_eq!(m.cdbs[2], build_reset_cdb(RESET_TO_OEM));
+    assert_eq!(m.cdbs[4], build_reset_cdb(RESET_TO_FLASH));
+}
+
+#[test]
+fn states_probes_every_feature_in_order() {
+    let mut m = FwMock::new();
+    m.states.speed = SPEED_MAX;
+    m.states.hrl = STATE_ON;
+    let states;
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        states = fw.states().expect("states");
+    }
+    assert_eq!(states.speed, SPEED_MAX);
+    assert_eq!(states.hrl, STATE_ON);
+    // Seven GETs, one per feature, in ALL_FEATURES order.
+    assert_eq!(m.cdbs.len(), 7);
+    let features: Vec<u8> = m.cdbs.iter().map(|c| c[CDB_FEATURE]).collect();
+    assert_eq!(features, vec![0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07]);
+    assert!(m.verbs().iter().all(|&v| v == Verb::Get as u8));
+}
+
+#[test]
+fn dump_issues_memread_and_returns_the_window() {
+    let mut m = FwMock::new();
+    let got;
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        got = fw.dump(0x0102_0304).expect("dump");
+    }
+    assert_eq!(got[0], 0x00);
+    assert_eq!(got[63], 63);
+    assert_eq!(m.cdbs[0], build_memread_cdb(0x0102_0304));
+}
+
+// ── Typed setters ────────────────────────────────────────────────────────────
+
+#[test]
+fn typed_setters_issue_expected_set_cdbs() {
+    let mut m = FwMock::new();
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.enable_uhd().unwrap();
+        fw.disable_bd().unwrap();
+        fw.skip_hrl().unwrap();
+        fw.null_ake().unwrap();
+        fw.bus_off().unwrap();
+        fw.region_free().unwrap();
+        fw.force_region_bd(BdRegion::B).unwrap();
+        fw.force_region_dvd(2).unwrap();
+        fw.unlock_speed().unwrap();
+    }
+    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Uhd, STATE_ON));
+    assert_eq!(m.cdbs[1], build_set_cdb(Feature::Bd, STATE_OFF));
+    // The HRL/AKE/BUS unlock direction is now STATE_OFF (0x00), not STATE_ON.
+    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Hrl, STATE_OFF));
+    assert_eq!(m.cdbs[3], build_set_cdb(Feature::Ake, STATE_OFF));
+    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Bus, STATE_OFF));
+    // Region-free is REGION_FREE (0x0F) — 0x01 now forces DVD region 1.
+    assert_eq!(m.cdbs[5], build_set_cdb(Feature::Region, REGION_FREE));
+    assert_eq!(m.cdbs[6], build_set_cdb(Feature::Region, REGION_BD_B));
+    // force_region_dvd(2) = REGION_DVD_BASE + 2 = 0x02 under the new base.
+    assert_eq!(m.cdbs[7], build_set_cdb(Feature::Region, 0x02));
+    assert_eq!(m.cdbs[8], build_set_cdb(Feature::Speed, SPEED_MAX));
+}
+
+#[test]
+fn force_region_dvd_rejects_out_of_range() {
+    let mut m = FwMock::new();
+    let mut fw = FirmwareControl::new(&mut m);
+    assert_eq!(fw.force_region_dvd(0).unwrap_err(), FirmwareError::Rejected);
+    assert_eq!(fw.force_region_dvd(9).unwrap_err(), FirmwareError::Rejected);
+}
+
+// ── Recipes ──────────────────────────────────────────────────────────────────
+
+#[test]
+fn arm_oem_bd_sets_and_verifies_hrl_skip() {
+    let mut m = FwMock::new();
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.arm_oem_bd().expect("armed");
+    }
+    // SET Hrl=OFF (the migrated skip direction), then GET Hrl to verify.
+    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Hrl, STATE_OFF));
+    assert_eq!(m.cdbs[1], build_get_cdb(Feature::Hrl));
+    assert_eq!(m.states.hrl, STATE_OFF);
+}
+
+#[test]
+fn arm_oem_uhd_sets_uhd_hrl_bus_each_verified() {
+    let mut m = FwMock::new();
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.arm_oem_uhd().expect("armed");
+    }
+    let verbs = m.verbs();
+    // set,get, set,get, set,get
+    assert_eq!(
+        verbs,
+        vec![0x02, 0x03, 0x02, 0x03, 0x02, 0x03],
+        "each set is verified by a get"
+    );
+    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Uhd, STATE_ON));
+    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Hrl, STATE_OFF));
+    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Bus, STATE_OFF));
+    assert_eq!(m.states.uhd, STATE_ON);
+    assert_eq!(m.states.hrl, STATE_OFF);
+    assert_eq!(m.states.bus, STATE_OFF);
+}
+
+#[test]
+fn arm_bypass_bd_nulls_ake() {
+    let mut m = FwMock::new();
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.arm_bypass_bd().expect("armed");
+    }
+    // Hrl=off (revocation skip) is set+verified FIRST, then Ake=null.
+    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Hrl, STATE_OFF));
+    assert_eq!(m.cdbs[1], build_get_cdb(Feature::Hrl));
+    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Ake, STATE_OFF));
+    assert_eq!(m.cdbs[3], build_get_cdb(Feature::Ake));
+    assert_eq!(m.states.hrl, STATE_OFF);
+    assert_eq!(m.states.ake, STATE_OFF);
+}
+
+#[test]
+fn arm_bypass_uhd_sets_uhd_ake_bus() {
+    let mut m = FwMock::new();
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.arm_bypass_uhd().expect("armed");
+    }
+    // Recipe order: Uhd=on, Hrl=off, Ake=null, Bus=off (each SET then verifying GET).
+    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Uhd, STATE_ON));
+    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Hrl, STATE_OFF));
+    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Ake, STATE_OFF));
+    assert_eq!(m.cdbs[6], build_set_cdb(Feature::Bus, STATE_OFF));
+    assert_eq!(m.states.uhd, STATE_ON);
+    assert_eq!(m.states.hrl, STATE_OFF);
+    assert_eq!(m.states.ake, STATE_OFF);
+    assert_eq!(m.states.bus, STATE_OFF);
+}
+
+#[test]
+fn arm_stealth_oem_resets_then_verifies_all_passthrough() {
+    let mut m = FwMock::new();
+    m.states.ake = STATE_ON;
+    m.states.uhd = STATE_ON;
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.arm_stealth_oem().expect("disarmed");
+    }
+    assert_eq!(m.cdbs[0], build_reset_cdb(RESET_TO_OEM));
+    // then a GET of every feature
+    assert_eq!(m.cdbs.len(), 1 + ALL_FEATURES.len());
+    assert!(m.cdbs[1..].iter().all(|c| c[CDB_VERB] == Verb::Get as u8));
+    assert_eq!(m.states, FeatureStates::all_passthrough());
+}
+
+#[test]
+fn arm_by_recipe_enum_dispatches() {
+    let mut m = FwMock::new();
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.arm(ArmRecipe::BypassBd).expect("armed");
+    }
+    assert_eq!(m.states.ake, STATE_OFF);
+}
+
+#[test]
+fn set_verify_reports_mismatch() {
+    // A drive that ACKs the SET but never actually changes the state: GET reads
+    // back the old value, so the verify fails.
+    struct StuckDrive;
+    impl ScsiTransport for StuckDrive {
+        fn execute(
+            &mut self,
+            cdb: &[u8],
+            _dir: DataDirection,
+            data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> ScsiTResult<ScsiResult> {
+            let mut n = 0;
+            if cdb[CDB_VERB] == Verb::Get as u8 && !data.is_empty() {
+                data[0] = STATE_PASSTHROUGH; // never changes
+                n = 1;
+            }
+            Ok(ScsiResult {
+                status: 0,
+                bytes_transferred: n,
+                sense: [0u8; 32],
+            })
+        }
+    }
+    let mut d = StuckDrive;
+    let mut fw = FirmwareControl::new(&mut d);
+    let err = fw.arm_bypass_bd().unwrap_err();
+    // arm_bypass_bd now verifies Hrl=off FIRST, so the stuck drive trips on Hrl.
+    assert_eq!(
+        err,
+        FirmwareError::VerifyFailed {
+            feature: Feature::Hrl,
+            wanted: STATE_OFF,
+            got: STATE_PASSTHROUGH,
+        }
+    );
+}
+
+#[test]
+fn recipe_transport_fault_propagates() {
+    let mut t = MockTransport::always(Reply::TransportFault);
+    let mut fw = FirmwareControl::new(&mut t);
+    assert_eq!(fw.arm_oem_bd().unwrap_err(), FirmwareError::Transport);
+}

src/freemkv/mod.rs

@@ -0,0 +1,630 @@
+//! freemkv — the self-identifying custom-firmware unlocker.
+//!
+//! Detects a freemkv-firmware drive by issuing the vendor IDENTITY command
+//! (`3C 0E C0 DE 01 …`) and checking the reply starts `b"freemkv"` — no bundled
+//! profile database is needed, unlike [`crate::ld`], because the firmware
+//! self-identifies.
+//!
+//! The wire grammar (verbs/features/states, CDB layout) lives in
+//! [`crate::firmware`], the typed mirror of `freemkv-fw/src/abi.rs`. This module
+//! only sequences the vendor commands into an unlock; it reuses the firmware
+//! module's CDB builders so the wire framing never drifts.
+//!
+//! Unlock mapping onto the grammar: region-free = `Set(Region, free)`
+//! (`REGION_FREE`), riplock lift = `Set(Speed, max)` (`SPEED_MAX`), the
+//! load-bearing transport unlock = `Set(Ake, off)` (`STATE_OFF` — drive acts
+//! pre-authenticated → a bare `0xAD` returns the VID with no cert and no AKE), and
+//! the trailing bus-off = `Set(Bus, off)` (`STATE_OFF`, content de-bussed). Under
+//! the migrated spec the HRL/AKE/BUS unlock direction is `STATE_OFF`, not `0x01`.
+
+use crate::firmware::{
+    Feature, MEMREAD_LEN, MIN_ALLOC_LEN, REGION_FREE, RESP_MAGIC, SPEED_MAX, STATE_OFF,
+    build_identity_cdb, build_memread_cdb, build_set_cdb,
+};
+use crate::scsi::{DataDirection, ScsiTransport};
+use crate::{UnlockCtx, UnlockError, Unlocked, Unlocker};
+
+/// The ASCII magic leading the IDENTITY reply — the ENTIRE freemkv-detection
+/// mechanism (no bundled profile database; the firmware self-identifies).
+const IDENTITY_MARKER: &[u8] = RESP_MAGIC;
+
+/// Allocation the IDENTITY / DUMPALL data-in phase reads back (a fixed 64-byte
+/// window, matching [`firmware::MEMREAD_LEN`]).
+const RESP_LEN: usize = MEMREAD_LEN;
+
+/// Whether a transport error is a genuine dead bus (a senseless
+/// transport-failure status) rather than a drive rejection surfaced through a
+/// non-conforming transport (`Err` carrying a sense).
+fn is_dead_bus(e: &crate::scsi::ScsiError) -> bool {
+    e.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE && e.sense.is_none()
+}
+
+// The freemkv custom-firmware unlocker. Detection: IDENTITY, checking the reply
+// starts "freemkv" — no bundled profile catalog needed, unlike
+// crate::ld::LdUnlocker. Stateless: `unlock()` returns what it learned.
+#[derive(Default)]
+pub struct FreemkvUnlocker;
+
+impl FreemkvUnlocker {
+    pub fn new() -> Self {
+        FreemkvUnlocker
+    }
+
+    // Issue IDENTITY: Ok(true) if the reply starts "freemkv", Ok(false) if
+    // rejected/mismatched (not this firmware). A dead bus is Err(Transport) —
+    // this is the FIRST command, so a transport fault must abort.
+    fn identify(&self, scsi: &mut dyn ScsiTransport) -> std::result::Result<bool, UnlockError> {
+        let cdb = build_identity_cdb(RESP_LEN as u16);
+        let mut buf = [0u8; RESP_LEN];
+        match scsi.execute(&cdb, DataDirection::FromDevice, &mut buf, 5_000) {
+            Ok(r) => {
+                let matched = r.status == 0
+                    && r.bytes_transferred >= IDENTITY_MARKER.len()
+                    && buf[..IDENTITY_MARKER.len()] == *IDENTITY_MARKER;
+                if !matched {
+                    tracing::debug!(
+                        target: "freemkv::disc",
+                        phase = "freemkv_identity_no_match",
+                        "IDENTITY probe did not report freemkv firmware"
+                    );
+                }
+                Ok(matched)
+            }
+            Err(e) => {
+                if is_dead_bus(&e) {
+                    tracing::warn!(
+                        target: "freemkv::disc",
+                        phase = "freemkv_identity_transport_fault",
+                        "transport fault on the freemkv IDENTITY probe; aborting"
+                    );
+                    return Err(UnlockError::Transport);
+                }
+                tracing::debug!(
+                    target: "freemkv::disc",
+                    phase = "freemkv_identity_rejected",
+                    status = e.status,
+                    "freemkv IDENTITY probe rejected by the drive; not this firmware"
+                );
+                Ok(false)
+            }
+        }
+    }
+
+    // Issue a `Set(feature, state)` over the required data-in phase. Ok(()) on GOOD status;
+    // NotApplicable if rejected; Transport only on a dead bus.
+    fn set(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        feature: Feature,
+        state: u8,
+    ) -> std::result::Result<(), UnlockError> {
+        let cdb = build_set_cdb(feature, state);
+        // SET needs the data-in phase its CDB advertises — a no-data SET is aborted
+        // (CHECK CONDITION, HW-confirmed on BU40N fw 0.8.1). Buffer sized from the SAME
+        // const the CDB advertises (MIN_ALLOC_LEN) so the transfer length has one source.
+        let mut buf = [0u8; MIN_ALLOC_LEN as usize];
+        match scsi.execute(&cdb, DataDirection::FromDevice, &mut buf, 5_000) {
+            Ok(r) if r.status == 0 => Ok(()),
+            Ok(r) => {
+                tracing::debug!(
+                    target: "freemkv::disc",
+                    phase = "freemkv_set_rejected",
+                    feature = ?feature,
+                    state,
+                    status = r.status,
+                    "freemkv SET rejected by the drive"
+                );
+                Err(UnlockError::NotApplicable)
+            }
+            Err(e) => {
+                if is_dead_bus(&e) {
+                    tracing::warn!(
+                        target: "freemkv::disc",
+                        phase = "freemkv_set_transport_fault",
+                        feature = ?feature,
+                        "transport fault on a freemkv SET; aborting"
+                    );
+                    return Err(UnlockError::Transport);
+                }
+                tracing::debug!(
+                    target: "freemkv::disc",
+                    phase = "freemkv_set_rejected_as_err",
+                    feature = ?feature,
+                    status = e.status,
+                    "freemkv SET rejected (via Err)"
+                );
+                Err(UnlockError::NotApplicable)
+            }
+        }
+    }
+
+    /// DumpAll diagnostic RAM read (DUMPALL): return the 64-byte window at
+    /// `addr`. A host-side diagnostic path only — not used by the unlock flow.
+    #[allow(dead_code)]
+    fn dump_ram(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        addr: u32,
+    ) -> std::result::Result<[u8; MEMREAD_LEN], UnlockError> {
+        let cdb = build_memread_cdb(addr);
+        let mut buf = [0u8; MEMREAD_LEN];
+        match scsi.execute(&cdb, DataDirection::FromDevice, &mut buf, 5_000) {
+            Ok(r) if r.status == 0 && r.bytes_transferred >= MEMREAD_LEN => Ok(buf),
+            Ok(_) => Err(UnlockError::NotApplicable),
+            Err(e) => {
+                if is_dead_bus(&e) {
+                    Err(UnlockError::Transport)
+                } else {
+                    Err(UnlockError::NotApplicable)
+                }
+            }
+        }
+    }
+
+    // Full freemkv unlock: IDENTITY (hard gate) → Set(Region,free) →
+    // Set(Speed,max) (best-effort) → Set(Ake,off) (LOAD-BEARING) → bare 0xAD VID
+    // (best-effort) → Set(Bus,off) (trailing, best-effort).
+    fn full_unlock(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+    ) -> std::result::Result<Unlocked, UnlockError> {
+        // IDENTITY: must be a freemkv drive.
+        if !self.identify(scsi)? {
+            return Err(UnlockError::NotApplicable);
+        }
+        // Best-effort feature set: only a dead bus aborts.
+        let best_effort = |r: std::result::Result<(), UnlockError>,
+                           what: &'static str|
+         -> std::result::Result<(), UnlockError> {
+            match r {
+                Ok(()) => Ok(()),
+                Err(UnlockError::Transport) => Err(UnlockError::Transport),
+                Err(_) => {
+                    tracing::debug!(
+                        target: "freemkv::disc",
+                        phase = "freemkv_feature_unavailable",
+                        feature = what,
+                        "feature unavailable; continuing"
+                    );
+                    Ok(())
+                }
+            }
+        };
+        // Region-free + riplock lift (best-effort features).
+        best_effort(self.set(scsi, Feature::Region, REGION_FREE), "region")?;
+        best_effort(self.set(scsi, Feature::Speed, SPEED_MAX), "speed")?;
+        // Ake = off/null (LOAD-BEARING): drive acts pre-authenticated, so a bare
+        // 0xAD returns the VID with no cert/AKE. No fallback. The migrated spec
+        // puts the null/bypass direction on STATE_OFF (0x00), not 0x01.
+        match self.set(scsi, Feature::Ake, STATE_OFF) {
+            Ok(()) => {}
+            Err(UnlockError::Transport) => return Err(UnlockError::Transport),
+            Err(_) => {
+                tracing::debug!(
+                    target: "freemkv::disc",
+                    phase = "freemkv_null_ake_rejected",
+                    "Set(Ake, null) rejected — cannot unlock this drive"
+                );
+                return Err(UnlockError::VidUnavailable);
+            }
+        }
+        // Bare 0xAD VID read — the shared BEST-EFFORT reader (identical to the
+        // LD/Renesas routes). The null AKE already unlocked the drive, so a VID
+        // miss must not discard it: only a dead bus propagates (`?`), else `None`.
+        let vid = crate::vid::read_aacs_vid(scsi)?;
+        // Trailing Set(Bus, off): remove in-transit bus encryption (STATE_OFF is
+        // the de-bussed direction). FULLY best-effort — inert without the lever,
+        // and a failure here never discards an already-obtained unlock.
+        if let Err(e) = self.set(scsi, Feature::Bus, STATE_OFF) {
+            tracing::debug!(
+                target: "freemkv::disc",
+                phase = "freemkv_bus_off_unavailable",
+                ?e,
+                "bus-off (Set Bus) not applied; continuing"
+            );
+        }
+        tracing::debug!(
+            target: "freemkv::disc",
+            phase = "freemkv_unlocked",
+            has_vid = vid.is_some(),
+            "freemkv drive unlocked (null AKE — Ake=off)"
+        );
+        Ok(Unlocked { vid, bus_key: None })
+    }
+}
+
+impl Unlocker for FreemkvUnlocker {
+    fn name(&self) -> &'static str {
+        "freemkv"
+    }
+
+    /// Recognise the drive by its IDENTITY knock, lift riplock/region
+    /// (best-effort), null the AKE (the actual unlock), and read the Volume ID
+    /// with a bare `0xAD` (best-effort). `Some` when the null-AKE set succeeded —
+    /// the drive is unlocked whether or not the VID read did; `None` if it isn't
+    /// a freemkv drive; `Err(Transport)` on a dead bus. `ctx` is unused: this
+    /// unlocker self-identifies rather than matching on drive identity.
+    fn unlock(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        _ctx: &UnlockCtx,
+    ) -> std::result::Result<Option<Unlocked>, UnlockError> {
+        crate::fallthrough(self.full_unlock(scsi))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::DiscKind;
+    use crate::firmware::{
+        REGION_FREE, RESET_TO_OEM, STATE_OFF, build_identity_cdb, build_memread_cdb,
+        build_reset_cdb, build_set_cdb,
+    };
+    use crate::scsi::mock::{MockTransport, Reply};
+    use crate::scsi::{DataDirection, Result, ScsiResult, ScsiTransport};
+
+    fn ctx(id: &crate::DriveId) -> UnlockCtx<'_> {
+        UnlockCtx::new(id, DiscKind::Unknown)
+    }
+
+    /// Serves a fixed payload with a GOOD status (used for the Identity probe).
+    struct FakeTransport {
+        payload: Vec<u8>,
+    }
+    impl ScsiTransport for FakeTransport {
+        fn execute(
+            &mut self,
+            _cdb: &[u8],
+            _dir: DataDirection,
+            data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> Result<ScsiResult> {
+            let n = self.payload.len().min(data.len());
+            data[..n].copy_from_slice(&self.payload[..n]);
+            Ok(ScsiResult {
+                status: 0,
+                bytes_transferred: n,
+                sense: [0u8; 32],
+            })
+        }
+    }
+
+    fn freemkv_identity_payload() -> Vec<u8> {
+        let mut p = vec![0u8; RESP_LEN];
+        let s = b"freemkv";
+        p[..s.len()].copy_from_slice(s);
+        p[s.len()] = 0x42; // version
+        p
+    }
+
+    /// A well-formed format-0x80 VID structure: 4-byte header, 16-byte VID at
+    /// offset 4, 16-byte MAC (zeroed on the bare path — it isn't checked). 36 =
+    /// the fixed `0xAD` fmt-0x80 response length (see `crate::vid`).
+    fn vid_ds_response(vid: [u8; 16]) -> Vec<u8> {
+        let mut p = vec![0u8; 36];
+        p[4..20].copy_from_slice(&vid);
+        p
+    }
+
+    // ── CDB shape ────────────────────────────────────────────────────────
+
+    /// IDENTITY builds the pinned knock frame with a 64-byte allocation.
+    #[test]
+    fn identity_cdb_is_the_knock_shape() {
+        assert_eq!(
+            build_identity_cdb(RESP_LEN as u16),
+            [0x3C, 0x0E, 0xC0, 0xDE, 0x01, 0x00, 0x00, 0x00, 0x40, 0x00]
+        );
+    }
+
+    /// Regression (BU40N fw 0.8.1): a SET issued WITHOUT the data-in phase its
+    /// CDB advertises is aborted by the drive (CHECK CONDITION / Aborted Command),
+    /// so the unlocker's `set()` MUST read the MIN_ALLOC_LEN table back like
+    /// `FirmwareControl::set` — not send `DataDirection::None`. Before the fix
+    /// the whole freemkv unlock failed at `Set(Ake)` and fell back to AACS.
+    #[test]
+    fn set_issues_the_required_data_in_phase() {
+        struct DataInContract;
+        impl ScsiTransport for DataInContract {
+            fn execute(
+                &mut self,
+                cdb: &[u8],
+                dir: DataDirection,
+                data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> Result<ScsiResult> {
+                assert_eq!(cdb[4], 0x02, "test exercises only the SET verb");
+                // Model the drive: a SET with no from-device phase is aborted.
+                if !matches!(dir, DataDirection::FromDevice) || data.is_empty() {
+                    return Ok(ScsiResult {
+                        status: 2,
+                        bytes_transferred: 0,
+                        sense: [0u8; 32],
+                    });
+                }
+                Ok(ScsiResult {
+                    status: 0,
+                    bytes_transferred: data.len(),
+                    sense: [0u8; 32],
+                })
+            }
+        }
+        FreemkvUnlocker::new()
+            .set(&mut DataInContract, Feature::Region, REGION_FREE)
+            .expect("SET must succeed by issuing the data-in phase the firmware requires");
+    }
+
+    /// Each unlock SET is `Verb::Set` (02) on the right feature id (cdb[5]) with
+    /// the state at cdb[6]; SET floors its data-in allocation at MIN_ALLOC_LEN
+    /// (0x0040 at cdb[7..9]) — the drive aborts a sub-16-byte transfer (HW-confirmed).
+    #[test]
+    fn unlock_set_cdbs_have_the_new_grammar_shape() {
+        // Region-free is REGION_FREE (0x0F) at cdb[6] — 0x01 now forces DVD region 1.
+        assert_eq!(
+            build_set_cdb(Feature::Region, REGION_FREE),
+            [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x02, 0x0F, 0x00, 0x40, 0x00]
+        );
+        // Speed max is SPEED_MAX (0x00) — the limiter-off leg of Speed.
+        assert_eq!(
+            build_set_cdb(Feature::Speed, SPEED_MAX),
+            [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x01, 0x00, 0x00, 0x40, 0x00]
+        );
+        // Ake/Bus unlock direction is now STATE_OFF (0x00) at cdb[6], not 0x01.
+        assert_eq!(
+            build_set_cdb(Feature::Ake, STATE_OFF),
+            [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x06, 0x00, 0x00, 0x40, 0x00]
+        );
+        assert_eq!(
+            build_set_cdb(Feature::Bus, STATE_OFF),
+            [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x07, 0x00, 0x00, 0x40, 0x00]
+        );
+    }
+
+    // ── Detection ────────────────────────────────────────────────────────
+
+    #[test]
+    fn identify_true_on_freemkv_marker_and_issues_identity_cdb() {
+        let mut t = MockTransport::always(Reply::good(freemkv_identity_payload()));
+        assert!(FreemkvUnlocker::new().identify(&mut t).expect("no fault"));
+        assert_eq!(t.cdbs[0], build_identity_cdb(RESP_LEN as u16));
+    }
+
+    #[test]
+    fn identify_false_on_non_matching_payload() {
+        let mut t = FakeTransport {
+            payload: vec![0u8; RESP_LEN],
+        };
+        assert!(!FreemkvUnlocker::new().identify(&mut t).expect("no fault"));
+    }
+
+    #[test]
+    fn identify_false_on_short_response() {
+        let mut t = MockTransport::always(Reply::short(freemkv_identity_payload(), 3));
+        assert!(!FreemkvUnlocker::new().identify(&mut t).expect("no fault"));
+    }
+
+    #[test]
+    fn identify_false_when_command_rejected() {
+        let mut t = MockTransport::always(Reply::illegal_request());
+        assert!(!FreemkvUnlocker::new().identify(&mut t).expect("no fault"));
+    }
+
+    #[test]
+    fn identify_false_when_command_rejected_as_err() {
+        let mut t = MockTransport::always(Reply::illegal_request_as_err());
+        assert!(!FreemkvUnlocker::new().identify(&mut t).expect("no fault"));
+    }
+
+    #[test]
+    fn identify_transport_fault_aborts() {
+        let mut t = MockTransport::always(Reply::TransportFault);
+        assert_eq!(
+            FreemkvUnlocker::new().identify(&mut t).unwrap_err(),
+            UnlockError::Transport
+        );
+    }
+
+    // ── Feature sets ──────────────────────────────────────────────────────
+
+    #[test]
+    fn set_region_free_issues_the_set_region_on_cdb() {
+        let mut t = MockTransport::always(Reply::good(vec![]));
+        FreemkvUnlocker::new()
+            .set(&mut t, Feature::Region, REGION_FREE)
+            .expect("ok");
+        assert_eq!(t.cdbs[0], build_set_cdb(Feature::Region, REGION_FREE));
+    }
+
+    #[test]
+    fn set_ake_null_issues_the_set_ake_on_cdb() {
+        let mut t = MockTransport::always(Reply::good(vec![]));
+        FreemkvUnlocker::new()
+            .set(&mut t, Feature::Ake, STATE_OFF)
+            .expect("ok");
+        assert_eq!(t.cdbs[0], build_set_cdb(Feature::Ake, STATE_OFF));
+    }
+
+    #[test]
+    fn set_drive_rejection_is_not_applicable() {
+        let mut t = MockTransport::always(Reply::illegal_request());
+        let err = FreemkvUnlocker::new()
+            .set(&mut t, Feature::Ake, STATE_OFF)
+            .unwrap_err();
+        assert_eq!(err, UnlockError::NotApplicable);
+    }
+
+    #[test]
+    fn set_transport_fault_propagates() {
+        let mut t = MockTransport::always(Reply::TransportFault);
+        let err = FreemkvUnlocker::new()
+            .set(&mut t, Feature::Speed, SPEED_MAX)
+            .unwrap_err();
+        assert_eq!(err, UnlockError::Transport);
+    }
+
+    // ── full_unlock / unlock ─────────────────────────────────────────────
+
+    /// The full unlock runs IDENTITY → Set(Region) → Set(Speed) → Set(Ake) →
+    /// bare VID → Set(Bus) in order.
+    #[test]
+    fn full_unlock_issues_identity_region_speed_ake_then_bare_vid_then_bus() {
+        let vid = [0x7Cu8; 16];
+        let mut t = MockTransport::scripted(
+            vec![
+                Reply::good(freemkv_identity_payload()), // IDENTITY
+                Reply::good(vec![]),                     // Set Region
+                Reply::good(vec![]),                     // Set Speed
+                Reply::good(vec![]),                     // Set Ake (load-bearing)
+                Reply::good(vid_ds_response(vid)),       // 0xAD bare VID
+                Reply::good(vec![]),                     // Set Bus (trailing)
+            ],
+            Reply::TransportFault,
+        );
+        let id = crate::DriveId::default();
+        let out = FreemkvUnlocker::new()
+            .unlock(&mut t, &ctx(&id))
+            .expect("no fault")
+            .expect("null AKE ⇒ unlocked");
+        assert_eq!(out.vid, Some(vid));
+        assert_eq!(t.cdbs.len(), 6);
+        // The four vendor SETs land on the right features, in order.
+        assert_eq!(t.cdbs[0], build_identity_cdb(RESP_LEN as u16));
+        assert_eq!(t.cdbs[1], build_set_cdb(Feature::Region, REGION_FREE));
+        assert_eq!(t.cdbs[2], build_set_cdb(Feature::Speed, SPEED_MAX));
+        assert_eq!(t.cdbs[3], build_set_cdb(Feature::Ake, STATE_OFF));
+        assert_eq!(t.cdbs[4][0], crate::scsi::SCSI_READ_DISC_STRUCTURE);
+        assert_eq!(t.cdbs[5], build_set_cdb(Feature::Bus, STATE_OFF));
+    }
+
+    /// A missing region/speed feature does not fail the unlock (best-effort).
+    #[test]
+    fn full_unlock_tolerates_missing_region_and_speed() {
+        let vid = [0x3Cu8; 16];
+        let mut t = MockTransport::scripted(
+            vec![
+                Reply::good(freemkv_identity_payload()), // identity
+                Reply::illegal_request(),                // region unsupported
+                Reply::illegal_request(),                // speed unsupported
+                Reply::good(vec![]),                     // null ake
+                Reply::good(vid_ds_response(vid)),       // bare VID
+            ],
+            Reply::TransportFault,
+        );
+        let id = crate::DriveId::default();
+        let out = FreemkvUnlocker::new()
+            .unlock(&mut t, &ctx(&id))
+            .expect("no fault")
+            .expect("unlocked");
+        assert_eq!(out.vid, Some(vid));
+    }
+
+    /// The null AKE is LOAD-BEARING: if the drive rejects it, this isn't an
+    /// unlockable freemkv drive, so `unlock()` declines (`None`) and falls
+    /// through — never a hard error.
+    #[test]
+    fn declines_when_null_ake_rejected() {
+        let mut t = MockTransport::scripted(
+            vec![
+                Reply::good(freemkv_identity_payload()), // identity
+                Reply::good(vec![]),                     // region
+                Reply::good(vec![]),                     // speed
+                Reply::illegal_request(),                // null ake REJECTED
+            ],
+            Reply::TransportFault,
+        );
+        let id = crate::DriveId::default();
+        assert!(
+            FreemkvUnlocker::new()
+                .unlock(&mut t, &ctx(&id))
+                .expect("no fault")
+                .is_none()
+        );
+    }
+
+    /// Best-effort VID: the null AKE succeeded (drive unlocked), but the bare
+    /// VID read was rejected — `unlock()` still returns `Some`, with `vid: None`.
+    #[test]
+    fn unlocks_without_vid_when_bare_read_fails() {
+        let mut t = MockTransport::scripted(
+            vec![
+                Reply::good(freemkv_identity_payload()), // identity
+                Reply::good(vec![]),                     // region
+                Reply::good(vec![]),                     // speed
+                Reply::good(vec![]),                     // null ake
+                Reply::illegal_request(),                // bare VID: no medium
+            ],
+            Reply::TransportFault,
+        );
+        let id = crate::DriveId::default();
+        let out = FreemkvUnlocker::new()
+            .unlock(&mut t, &ctx(&id))
+            .expect("no fault")
+            .expect("unlocked despite no VID");
+        assert_eq!(out.vid, None);
+    }
+
+    #[test]
+    fn declines_non_freemkv_drive() {
+        let mut t = MockTransport::always(Reply::illegal_request());
+        let id = crate::DriveId::default();
+        assert!(
+            FreemkvUnlocker::new()
+                .unlock(&mut t, &ctx(&id))
+                .expect("no fault")
+                .is_none()
+        );
+    }
+
+    #[test]
+    fn transport_fault_propagates() {
+        let mut t = MockTransport::always(Reply::TransportFault);
+        let id = crate::DriveId::default();
+        assert_eq!(
+            FreemkvUnlocker::new()
+                .unlock(&mut t, &ctx(&id))
+                .unwrap_err(),
+            UnlockError::Transport
+        );
+    }
+
+    // ── DumpAll ──────────────────────────────────────────────────────────
+
+    #[test]
+    fn dump_ram_builds_memread_cdb_and_returns_the_window() {
+        let mut payload = vec![0xABu8; MEMREAD_LEN];
+        payload[0] = 0xEE;
+        let mut t = MockTransport::always(Reply::good(payload));
+        let got = FreemkvUnlocker::new()
+            .dump_ram(&mut t, 0x01F8_1234)
+            .expect("dump ok");
+        assert_eq!(got[0], 0xEE);
+        assert_eq!(
+            t.cdbs[0],
+            [0x3C, 0x0E, 0xC0, 0xDE, 0x09, 0x01, 0xF8, 0x12, 0x34, 0x00]
+        );
+    }
+
+    #[test]
+    fn build_memread_cdb_packs_address_big_endian_at_5_to_9() {
+        let cdb = build_memread_cdb(0xDEAD_BEEF);
+        assert_eq!(cdb[4], crate::firmware::Verb::DumpAll as u8);
+        assert_eq!([cdb[5], cdb[6], cdb[7], cdb[8]], [0xDE, 0xAD, 0xBE, 0xEF]);
+        assert_eq!(cdb[9], 0x00);
+    }
+
+    /// RESET builds the pinned all-features-passthrough frame (not issued by the
+    /// unlock flow, but pinned here so the shared builder stays honest).
+    #[test]
+    fn reset_cdb_shape() {
+        assert_eq!(
+            build_reset_cdb(RESET_TO_OEM),
+            [0x3C, 0x0E, 0xC0, 0xDE, 0x04, 0x00, 0xFF, 0x00, 0x40, 0x00]
+        );
+    }
+
+    #[test]
+    fn name_is_freemkv() {
+        assert_eq!(FreemkvUnlocker::new().name(), "freemkv");
+    }
+}

src/ld/NOTICE

@@ -0,0 +1,15 @@
+THIRD-PARTY NOTICE for profiles.json
+====================================
+
+`profiles.json` in this directory contains volatile, RAM-only optical-drive
+microcode ("LibreDrive") authored and owned by the MakeMKV team (GuinpinSoft
+inc.). Each payload embeds its own notice:
+
+    "This is volatile RAM-only microcode for LibreDrive by MakeMKV -
+     http://www.makemkv.com/libredrive/
+     Copyright (c) MakeMKV team, all rights reserved."
+
+This microcode is third-party proprietary material — Copyright (c) MakeMKV team,
+all rights reserved — and is NOT covered by this repository's MIT LICENSE. No
+ownership is claimed. See the repository-root NOTICE. Thanks to the MakeMKV team
+for LibreDrive: https://www.makemkv.com/ , http://www.makemkv.com/libredrive/ .

src/ld/README.md

@@ -1,6 +1,6 @@
-# ld — the LibreDrive unlocker
+# ld — the drive bus-unlock module
 
-The **LibreDrive** unlocker module for freemkv-unlock.
+A drive bus-unlock module for freemkv-unlock.
 
 freemkv-unlock defines the generic `Unlocker` contract; this module is one
 implementation of it. It recognizes a bundled catalog of supported drives
@@ -10,8 +10,8 @@ decryption is a separate concern, handled by the consumer.
 
 Clients never name this module directly —
 [libfreemkv](https://github.com/freemkv/libfreemkv) dispatches through
-`freemkv_unlock::all_unlockers()`, and this module answers `matches()` /
-`unlock()` when the drive identity is one it supports.
+`freemkv_unlock::all_unlockers()`, and this module answers `unlock_features()` /
+`unlock_bus()` when the drive identity is one it supports.
 
 ## Scope: non-persistent unlock only
 
@@ -20,8 +20,12 @@ sets up lives in drive RAM and is gone on power cycle. The one-time, permanent
 drive preparation is the drive owner's own manual step and is **never**
 automated here.
 
-## Credits
+## Third-party microcode (`profiles.json`)
 
-LibreDrive was created by **Mike Chen** and the **MakeMKV team**. This module
-builds on their work — our thanks and full credit to them for the LibreDrive
-capabilities.
+`profiles.json` bundles volatile, RAM-only optical-drive microcode
+("LibreDrive") authored and owned by the **MakeMKV team** (GuinpinSoft inc.).
+Each payload carries its own notice — *"Copyright (c) MakeMKV team, all rights
+reserved."* This microcode is **third-party proprietary material and is NOT
+covered by this repository's MIT license**; no ownership is claimed. See the
+[`NOTICE`](./NOTICE) in this directory and the repository-root `NOTICE`. With
+thanks to the MakeMKV team for [LibreDrive](http://www.makemkv.com/libredrive/).

src/ld/cdb.rs

@@ -1,7 +1,7 @@
 //! Public unlock-CDB seam.
 //!
 //! These items expose the *minimum* an external consumer (e.g. the bdemu
-//! drive emulator) needs to recognise and answer the LibreDrive unlock
+//! drive emulator) needs to recognise and answer the LdUnlocker unlock
 //! READ_BUFFER handshake, without that consumer open-coding the
 //! handshake internals. The concrete CDB shapes and the verification
 //! marker are unlock-handshake details and must live ONLY in this crate.
@@ -15,7 +15,7 @@ pub const UNLOCK_MARKER: &[u8] = b"MMkv";
 
 /// Returns `true` when a READ_BUFFER (`0x3C`) CDB with the given mode
 /// (`cdb[1] & 0x1F`) and buffer id (`cdb[2]`) is an unlock-handshake
-/// read — i.e. one of the LibreDrive unlock variants.
+/// read — i.e. one of the LdUnlocker unlock variants.
 ///
 /// This is the single source of truth for the unlock READ_BUFFER CDB
 /// shapes; consumers must call it rather than hardcoding the mode /

src/ld/error.rs

@@ -39,6 +39,17 @@ impl std::fmt::Display for Error {
 impl std::error::Error for Error {}
 
 impl Error {
+    /// Stable numeric code (logged). Values are local to this crate and share
+    /// the crate-wide space with `aacs` (70xx) and `css` (72xx).
+    pub fn code(&self) -> u16 {
+        match self {
+            Error::ProfileParse => 7101,
+            Error::UnlockFailed => 7102,
+            Error::SignatureMismatch { .. } => 7103,
+            Error::Scsi { .. } => 7199,
+        }
+    }
+
     /// True if this is a transport-layer SCSI failure (bus dead), as opposed to a
     /// drive sense or a logical failure.
     pub(crate) fn is_transport_failure(&self) -> bool {
@@ -74,3 +85,120 @@ impl From<Error> for crate::UnlockError {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::UnlockError;
+    use crate::scsi::{SCSI_STATUS_CHECK_CONDITION, SCSI_STATUS_TRANSPORT_FAILURE, ScsiError};
+
+    /// The abort/fall-through boundary, which had no test at all. Catches
+    /// widening `is_transport_failure` (every failure would abort every rip) or
+    /// narrowing it (a dead bus would be probed forever).
+    #[test]
+    fn only_a_senseless_transport_status_is_a_transport_failure() {
+        let dead_bus = Error::Scsi {
+            opcode: 0x3C,
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        };
+        assert!(dead_bus.is_transport_failure());
+        assert_eq!(UnlockError::from(dead_bus), UnlockError::Transport);
+
+        // A CHECK CONDITION is the DRIVE refusing, not the bus dying.
+        let refused = Error::Scsi {
+            opcode: 0x3C,
+            status: SCSI_STATUS_CHECK_CONDITION,
+            sense: Some([0u8; 32]),
+        };
+        assert!(!refused.is_transport_failure());
+        assert_eq!(UnlockError::from(refused), UnlockError::NotApplicable);
+
+        // The transport-failure status WITH a sense is a drive that reported
+        // 0xFF, not a bus fault — it must not abort the consumer.
+        let odd = Error::Scsi {
+            opcode: 0x3C,
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: Some([0u8; 32]),
+        };
+        assert!(!odd.is_transport_failure());
+
+        for e in [
+            Error::ProfileParse,
+            Error::UnlockFailed,
+            Error::SignatureMismatch {
+                expected: [0; 4],
+                got: [1; 4],
+            },
+        ] {
+            assert!(!e.is_transport_failure(), "{e:?} is not a bus fault");
+            assert_eq!(UnlockError::from(e), UnlockError::NotApplicable);
+        }
+    }
+
+    /// `Display` is what shows up in logs — every variant must render without
+    /// panicking and the SCSI variant must carry the opcode/status through.
+    #[test]
+    fn display_renders_every_variant() {
+        assert_eq!(Error::ProfileParse.to_string(), "drive profile parse error");
+        assert_eq!(Error::UnlockFailed.to_string(), "firmware unlock failed");
+        assert_eq!(
+            Error::SignatureMismatch {
+                expected: [0; 4],
+                got: [1; 4],
+            }
+            .to_string(),
+            "signature mismatch"
+        );
+        assert_eq!(
+            Error::Scsi {
+                opcode: 0x3C,
+                status: 0x02,
+                sense: None,
+            }
+            .to_string(),
+            "SCSI error (opcode 0x3c, status 0x02)"
+        );
+    }
+
+    /// `From<ScsiError>` must carry the status AND sense across the seam —
+    /// collapsing either one destroys the transport-vs-rejection distinction the
+    /// whole abort/fall-through split rests on.
+    #[test]
+    fn scsi_error_conversion_preserves_status_and_sense() {
+        let e = Error::from(ScsiError {
+            status: SCSI_STATUS_TRANSPORT_FAILURE,
+            sense: None,
+        });
+        assert!(e.is_transport_failure());
+
+        let e = Error::from(ScsiError {
+            status: SCSI_STATUS_CHECK_CONDITION,
+            sense: Some([0u8; 32]),
+        });
+        assert!(!e.is_transport_failure());
+        assert_eq!(UnlockError::from(e), UnlockError::NotApplicable);
+    }
+
+    /// Error codes are stable and distinct — they are the numeric contract the
+    /// logs carry instead of English.
+    #[test]
+    fn error_codes_are_distinct_and_stable() {
+        let codes = [
+            Error::ProfileParse.code(),
+            Error::UnlockFailed.code(),
+            Error::SignatureMismatch {
+                expected: [0; 4],
+                got: [0; 4],
+            }
+            .code(),
+            Error::Scsi {
+                opcode: 0,
+                status: 0,
+                sense: None,
+            }
+            .code(),
+        ];
+        assert_eq!(codes, [7101, 7102, 7103, 7199]);
+    }
+}

src/ld/mod.rs

@@ -1,4 +1,4 @@
-//! ld — the LibreDrive firmware unlocker (MediaTek MT1959).
+//! ld — the MediaTek MT1959 firmware unlocker.
 //!
 //! Self-contained module: it owns the bundled drive profiles, firmware blobs,
 //! the WRITE_BUFFER / MODE SELECT upload, the unlock CDBs, and the variant-A /
@@ -6,11 +6,10 @@
 //! encryption AT THE DRIVE (the unlocked drive serves clear content) and
 //! reporting the OEM Volume ID.
 
-// `cdb` carries ONLY the unlock-handshake wire format that the bdemu emulator
-// needs (the real unlocker drives its CDBs from per-drive profile templates, not
-// these constants). Compile it only when the `emulation` feature exposes it, so
-// it never dead-codes in a normal build.
-#[cfg(feature = "emulation")]
+// `cdb` is only the bdemu emulator's wire format (real unlocking uses profile
+// templates), gated behind `emulation`; also compiled under `cfg(test)` so its
+// wire-format tests run in default-feature CI. See docs/ld-mod.md — cdb gating.
+#[cfg(any(feature = "emulation", test))]
 mod cdb;
 mod error;
 mod platform;
@@ -21,16 +20,12 @@ use crate::scsi::{DataDirection, ScsiTransport};
 use crate::{DriveId, UnlockCtx, UnlockError, Unlocked, Unlocker};
 
 // ── Public profile catalog ──────────────────────────────────────────────────
-//
-// The catalog of drives the LibreDrive unlocker recognizes is the one piece of
-// ld worth exposing publicly: it answers "is this drive supported?" without
-// unlocking, and the bdemu test-emulator reads it to impersonate a supported
-// drive. The unlock *mechanism* (firmware blobs, upload sequence, CDB wire
-// format) stays private — only the catalog and its match result are public.
+// Only the catalog is public (supported-drive lookup, used by bdemu); the
+// unlock mechanism stays private. See docs/ld-mod.md — public catalog design.
 
 pub use profile::{DriveProfile as Profile, Identity, Platform, ProfileMatch, Profiles};
 
-/// The bundled LibreDrive profile catalog (parsed once, process-cached), or
+/// The bundled MT1959 profile catalog (parsed once, process-cached), or
 /// `None` if the embedded JSON fails to parse (a build-time bug). Pair with
 /// [`Profiles::get`] to look up a specific drive:
 /// `freemkv_unlock::ld::profiles().and_then(|p| p.get(&drive_id))`.
@@ -51,17 +46,15 @@ pub fn profile(drive_id: &DriveId) -> Option<ProfileMatch> {
 #[cfg(feature = "emulation")]
 pub use cdb::{UNLOCK_MARKER, is_unlock_read_buffer};
 
-/// The LibreDrive unlocker. `pub(crate)` — clients reach it only through
-/// [`crate::all_unlockers`], never by name (the locked-design contract).
-///
-/// Matches a drive against the bundled profile database and, on a hit,
-/// runs the MediaTek MT1959 firmware-unlock (and disc-speed calibration)
-/// handshake over the raw SCSI transport.
-pub(crate) struct LibreDrive;
+// The MT1959 unlocker. Matches a drive against the bundled profile database and
+// runs the firmware-unlock + disc-speed-calibration handshake over raw SCSI.
+// Stateless: `unlock()` returns what it learned.
+#[derive(Default)]
+pub struct LdUnlocker;
 
-impl LibreDrive {
-    pub(crate) fn new() -> Self {
-        LibreDrive
+impl LdUnlocker {
+    pub fn new() -> Self {
+        LdUnlocker
     }
 }
 
@@ -69,29 +62,39 @@ impl LibreDrive {
 /// drive-info "is this drive supported?" display), or `None`. A pure profile
 /// lookup — does NOT touch the drive or unlock anything.
 pub(crate) fn firmware_name(id: &DriveId) -> Option<&'static str> {
-    profile::find_bundled(id).map(|_| "LibreDrive")
+    profile::find_bundled(id).map(|_| "LD")
 }
 
-impl LibreDrive {
-    /// Read the OEM Volume ID via the matched profile's vendor CDB.
-    ///
-    /// `Ok(Some(vid))` on a well-formed 36-byte response (signature `00 22 00`,
-    /// VID at `[4..20]`); `Ok(None)` when there is no OEM-VID CDB or the response
-    /// is short / bad-signature (the drive is still unlocked, just no VID); `Err`
-    /// only on a transport fault.
-    fn read_oem_vid(&self, scsi: &mut dyn ScsiTransport, id: &DriveId) -> Result<Option<[u8; 16]>> {
+impl LdUnlocker {
+    // Read the OEM Volume ID via the matched profile's vendor CDB (profile passed
+    // in to avoid a redundant 206-entry catalog scan). Ok(Some) on a well-formed
+    // response; Ok(None) if unreadable; Err only on a transport fault.
+    fn read_oem_vid(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        profile: &profile::DriveProfile,
+    ) -> Result<Option<[u8; 16]>> {
         const RESPONSE_LEN: usize = 36;
         const EXPECTED_HEADER: [u8; 3] = [0x00, 0x22, 0x00];
 
-        let Some(m) = profile::find_bundled(id) else {
-            return Ok(None);
-        };
-        let Some(cdb) = m.profile.read_vid_cdb else {
+        let Some(cdb) = profile.read_vid_cdb else {
             return Ok(None);
         };
 
         let mut buf = vec![0u8; RESPONSE_LEN];
         let result = scsi.execute(&cdb, DataDirection::FromDevice, &mut buf, 5_000)?;
+        // Per the transport contract a drive sense arrives as `Ok` with non-zero
+        // `status`, not `Err` — without this check a CHECK CONDITION reads as a
+        // successful response and the zero-filled buffer parses as a bogus VID.
+        if result.status != 0 {
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "oem_vid_check_condition",
+                status = result.status,
+                "OEM VID CDB returned a drive sense"
+            );
+            return Ok(None);
+        }
         if result.bytes_transferred < RESPONSE_LEN {
             tracing::warn!(
                 target: "freemkv::disc",
@@ -116,16 +119,10 @@ impl LibreDrive {
     }
 }
 
-impl LibreDrive {
-    /// The MediaTek firmware unlock. Because LibreDrive removes AACS bus
-    /// encryption AT THE DRIVE (the unlocked drive serves CLEAR content), this ONE
-    /// operation satisfies BOTH the drive-features and the bus-removal capability
-    /// — so `unlock_features` and `unlock_bus` both delegate here. The result
-    /// carries `drive_unlocked: true` (no bus key needed) and the OEM Volume ID.
-    ///
-    /// A no-firmware-route drive (Renesas / no profile) returns `NotApplicable`; a
-    /// transport fault propagates as `Transport`; any other firmware failure also
-    /// falls through as `NotApplicable`.
+impl LdUnlocker {
+    // The MediaTek firmware unlock. Since it removes AACS at the drive (clear
+    // content), this one op satisfies both features and bus-removal, so both
+    // trait methods delegate here. See docs/ld-mod.md — firmware_unlock contract.
     fn firmware_unlock(
         &self,
         scsi: &mut dyn ScsiTransport,
@@ -141,45 +138,64 @@ impl LibreDrive {
         }
         let is_variant_b = matches!(m.platform, profile::Platform::Mt1959B);
         use platform::PlatformDriver;
-        let mut mt = platform::mt1959::Mt1959::new(m.profile, is_variant_b);
+        let mut mt = platform::mt1959::Mt1959::new(m.profile.clone(), is_variant_b);
         // A transport fault → UnlockError::Transport; any other firmware failure
         // → NotApplicable (via From<error::Error>).
         mt.init(scsi)?;
-        // Prime the per-region speed table (best-effort — must not fail the unlock).
-        let _ = mt.probe_disc(scsi);
-        let vid = self.read_oem_vid(scsi, id)?;
-        Ok(Unlocked {
-            vid,
-            bus_key: None,
-            drive_unlocked: true,
-        })
+        // `init` only proves the handshake completed, not that the drive reached
+        // extended-access state. Reporting unlocked off `init` alone shipped
+        // ciphertext at rc=0. See docs/ld-mod.md — half-unlock fallback.
+        if !mt.is_unlocked() {
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "firmware_unlock_incomplete",
+                "firmware handshake completed but the drive is not in the extended-access state; falling through"
+            );
+            return Err(UnlockError::NotApplicable);
+        }
+        // Prime the per-region speed table. Best-effort (must not fail the unlock)
+        // but not silent — an unlogged `let _ =` made a failed calibration
+        // indistinguishable from success in the rip log.
+        if let Err(e) = mt.probe_disc(scsi) {
+            // A transport fault here is a dead bus, not a calibration miss — most
+            // profiles never touch the bus again, so this was the only dead-bus
+            // signal. See docs/ld-mod.md — probe_disc dead-bus classification.
+            if e.is_transport_failure() {
+                tracing::warn!(
+                    target: "freemkv::disc",
+                    phase = "probe_disc_transport_fault",
+                    "transport fault during disc speed calibration; aborting"
+                );
+                return Err(UnlockError::Transport);
+            }
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "probe_disc_failed",
+                transport_failure = false,
+                "disc speed calibration failed; continuing with the drive's default speed table"
+            );
+        }
+        let vid = self.read_oem_vid(scsi, &m.profile)?;
+        Ok(Unlocked { vid, bus_key: None })
     }
 }
 
-impl Unlocker for LibreDrive {
+impl Unlocker for LdUnlocker {
     fn name(&self) -> &'static str {
-        "LibreDrive"
+        "LD"
     }
 
-    /// LibreDrive provides drive features (riplock/speed, OEM VID) — and, because
-    /// its firmware unlock serves clear content, bus removal comes free with it.
-    fn unlock_features(
+    /// Match the drive against the bundled profile database and run the firmware
+    /// unlock — one op that removes bus encryption at the drive (clear content)
+    /// and reads the OEM Volume ID (best-effort). `Some` when the firmware
+    /// handshake reached the extended-access state; `None` for an unknown drive
+    /// or an incomplete handshake; `Err(Transport)` on a dead bus.
+    fn unlock(
         &self,
         scsi: &mut dyn ScsiTransport,
         ctx: &UnlockCtx,
-    ) -> std::result::Result<Unlocked, UnlockError> {
-        self.firmware_unlock(scsi, ctx)
-    }
-
-    /// Same firmware code as [`unlock_features`]: LibreDrive removes the bus at
-    /// the drive. In practice the consumer skips this because drive-prep already
-    /// set `drive_unlocked`; it's here for completeness / a bus-first call order.
-    fn unlock_bus(
-        &self,
-        scsi: &mut dyn ScsiTransport,
-        ctx: &UnlockCtx,
-    ) -> std::result::Result<Unlocked, UnlockError> {
-        self.firmware_unlock(scsi, ctx)
+    ) -> std::result::Result<Option<Unlocked>, UnlockError> {
+        crate::fallthrough(self.firmware_unlock(scsi, ctx))
     }
 }
 
@@ -192,7 +208,7 @@ mod tests {
     /// Unlock context for a fake drive id (kind/host-certs irrelevant to the
     /// firmware unlocker — it keys off the drive identity).
     fn ctx(id: &DriveId) -> UnlockCtx<'_> {
-        UnlockCtx::new(id, DiscKind::Unknown, &[])
+        UnlockCtx::new(id, DiscKind::Unknown)
     }
 
     /// A fake transport that fills the response buffer from a fixed payload and
@@ -235,16 +251,21 @@ mod tests {
         }
     }
 
-    /// A well-formed 36-byte response (signature 00 22 00, VID at [4..20]) parses
-    /// to `Some(vid)`.
-    #[test]
-    fn read_oem_vid_parses_well_formed_response() {
+    /// The bundled profile of the fixture drive (the one carrying a real
+    /// `read_vid_cdb`).
+    fn known_vid_profile() -> profile::DriveProfile {
         let m = profile::find_bundled(&known_vid_drive_id()).expect("profile match");
         assert!(
             m.profile.read_vid_cdb.is_some(),
             "test fixture drive must carry an OEM VID CDB"
         );
+        m.profile
+    }
 
+    /// A well-formed 36-byte response (signature 00 22 00, VID at [4..20]) parses
+    /// to `Some(vid)`.
+    #[test]
+    fn read_oem_vid_parses_well_formed_response() {
         let mut payload = vec![0u8; 36];
         payload[0..3].copy_from_slice(&[0x00, 0x22, 0x00]);
         let vid = [0x3Cu8; 16];
@@ -253,8 +274,8 @@ mod tests {
             payload,
             bytes_transferred: 36,
         };
-        let got = LibreDrive::new()
-            .read_oem_vid(&mut t, &known_vid_drive_id())
+        let got = LdUnlocker::new()
+            .read_oem_vid(&mut t, &known_vid_profile())
             .expect("parse ok");
         assert_eq!(got, Some(vid), "VID parsed from [4..20]");
     }
@@ -266,8 +287,8 @@ mod tests {
             payload: vec![0u8; 36],
             bytes_transferred: 20,
         };
-        let got = LibreDrive::new()
-            .read_oem_vid(&mut t, &known_vid_drive_id())
+        let got = LdUnlocker::new()
+            .read_oem_vid(&mut t, &known_vid_profile())
             .expect("short response is Ok(None)");
         assert_eq!(got, None);
     }
@@ -281,25 +302,62 @@ mod tests {
             payload,
             bytes_transferred: 36,
         };
-        let got = LibreDrive::new()
-            .read_oem_vid(&mut t, &known_vid_drive_id())
+        let got = LdUnlocker::new()
+            .read_oem_vid(&mut t, &known_vid_profile())
             .expect("bad header is Ok(None)");
         assert_eq!(got, None);
     }
 
-    /// A drive with no matching profile → `read_oem_vid` is `Ok(None)`.
+    /// Catches dropping the `result.status` check: a CHECK CONDITION arrives as
+    /// `Ok` per the transport contract, so without it the caller's zero-filled
+    /// buffer is parsed as a real 36-byte response.
     #[test]
-    fn read_oem_vid_no_profile_is_none() {
+    fn read_oem_vid_check_condition_is_none_not_a_vid() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::illegal_request());
+        let got = LdUnlocker::new()
+            .read_oem_vid(&mut t, &known_vid_profile())
+            .expect("a drive sense is not a transport fault");
+        assert_eq!(got, None, "a CHECK CONDITION must never yield a VID");
+    }
+
+    /// Catches swallowing a transport fault in the OEM-VID read: a dead bus must
+    /// propagate (→ `UnlockError::Transport`), never become `Ok(None)`.
+    #[test]
+    fn read_oem_vid_transport_fault_propagates() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::TransportFault);
+        let err = LdUnlocker::new()
+            .read_oem_vid(&mut t, &known_vid_profile())
+            .expect_err("a dead bus must not be Ok(None)");
+        assert!(err.is_transport_failure());
+        assert_eq!(UnlockError::from(err), UnlockError::Transport);
+    }
+
+    /// A profile with no OEM-VID CDB → `Ok(None)` without touching the drive.
+    #[test]
+    fn read_oem_vid_no_cdb_is_none() {
+        let mut p = known_vid_profile();
+        p.read_vid_cdb = None;
         let mut t = FakeTransport {
             payload: vec![0u8; 36],
             bytes_transferred: 36,
         };
-        let got = LibreDrive::new()
-            .read_oem_vid(&mut t, &make_drive_id("FAKE-VND", "9.99", "XX12345", ""))
-            .expect("no profile is Ok(None)");
+        let got = LdUnlocker::new()
+            .read_oem_vid(&mut t, &p)
+            .expect("no CDB is Ok(None)");
         assert_eq!(got, None);
     }
 
+    /// Public catalog accessors: `profiles()` returns the bundled catalog and
+    /// `profile()` is `profiles().and_then(get)` for a known drive.
+    #[test]
+    fn public_catalog_accessors_find_the_bundled_fixture_drive() {
+        assert!(super::profiles().is_some(), "bundled catalog must parse");
+        let m = super::profile(&known_vid_drive_id()).expect("known fixture drive matches");
+        assert!(m.profile.read_vid_cdb.is_some());
+    }
+
     /// `unlock_features` on a drive with no matching profile → `NotApplicable`
     /// (fall through), short-circuiting before any firmware handshake.
     #[test]
@@ -308,12 +366,185 @@ mod tests {
             payload: vec![0u8; 36],
             bytes_transferred: 36,
         };
-        let err = LibreDrive::new()
-            .unlock_features(
+        let unlocked = LdUnlocker::new()
+            .unlock(
                 &mut t,
                 &ctx(&make_drive_id("FAKE-VND", "9.99", "XX12345", "")),
             )
-            .expect_err("no profile → NotApplicable");
-        assert_eq!(err, UnlockError::NotApplicable);
+            .expect("no profile → declines, not a hard error");
+        assert!(unlocked.is_none());
+    }
+
+    // THE defect-1 test: response carries the signature + primary marker but not
+    // the secondary one, so init() succeeds but the drive isn't in extended-access
+    // state. Catches removing the `is_unlocked()` gate in `firmware_unlock`.
+    #[test]
+    fn half_unlocked_drive_falls_through_instead_of_claiming_unlocked() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let id = known_vid_drive_id();
+        let sig = profile::find_bundled(&id)
+            .expect("profile")
+            .profile
+            .signature;
+
+        // 64-byte unlock response: signature + primary marker "MMkv" at [12..16],
+        // secondary marker at [16..20] left zeroed.
+        let mut resp = vec![0u8; 64];
+        resp[0..4].copy_from_slice(&sig);
+        resp[12..16].copy_from_slice(&[0x4D, 0x4D, 0x6B, 0x76]);
+
+        let mut t = MockTransport::always(Reply::good(resp));
+        let unlocked = LdUnlocker::new()
+            .unlock(&mut t, &ctx(&id))
+            .expect("a half-unlock declines, not a hard error");
+        assert!(
+            unlocked.is_none(),
+            "a half-unlocked drive must fall through to cert-auth"
+        );
+    }
+
+    /// The whole-unlock happy path still reports unlocked when BOTH firmware
+    /// markers are present — the `is_unlocked()` gate must not have made a
+    /// genuinely unlocked drive fall through.
+    #[test]
+    fn fully_unlocked_drive_reports_unlocked() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let id = known_vid_drive_id();
+        let sig = profile::find_bundled(&id)
+            .expect("profile")
+            .profile
+            .signature;
+
+        let mut resp = vec![0u8; 64];
+        resp[0..4].copy_from_slice(&sig);
+        resp[12..16].copy_from_slice(&[0x4D, 0x4D, 0x6B, 0x76]);
+        resp[16..20].copy_from_slice(&[0x4C, 0x62, 0x44, 0x72]);
+
+        let mut t = MockTransport::always(Reply::good(resp));
+        assert!(
+            LdUnlocker::new()
+                .unlock(&mut t, &ctx(&id))
+                .expect("no fault")
+                .is_some(),
+            "both markers → unlocked"
+        );
+    }
+
+    // THE probe-disc dead-bus test: bus dies during speed calibration after a
+    // full unlock; must abort with Transport, not report a successful unlock.
+    // See docs/ld-mod.md — probe_disc dead-bus test / mutation notes.
+    #[test]
+    fn transport_fault_during_probe_disc_is_transport_not_a_successful_unlock() {
+        let id = known_vid_drive_id();
+        let sig = profile::find_bundled(&id)
+            .expect("profile")
+            .profile
+            .signature;
+
+        // A drive that unlocks fully but whose bus dies on the speed probe.
+        struct ProbeFaultsDrive {
+            resp: Vec<u8>,
+        }
+        impl ScsiTransport for ProbeFaultsDrive {
+            fn execute(
+                &mut self,
+                cdb: &[u8],
+                _dir: DataDirection,
+                data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> crate::scsi::Result<ScsiResult> {
+                // READ_BUFFER (0x3C) / SUB_CMD_PROBE (0x14) is the speed probe.
+                if cdb.first() == Some(&0x3C) && cdb.get(3) == Some(&0x14) {
+                    return Err(crate::scsi::ScsiError {
+                        status: crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE,
+                        sense: None,
+                    });
+                }
+                let n = self.resp.len().min(data.len());
+                data[..n].copy_from_slice(&self.resp[..n]);
+                Ok(ScsiResult {
+                    status: 0,
+                    bytes_transferred: n,
+                    sense: [0u8; 32],
+                })
+            }
+        }
+
+        let mut resp = vec![0u8; 64];
+        resp[0..4].copy_from_slice(&sig);
+        resp[12..16].copy_from_slice(&[0x4D, 0x4D, 0x6B, 0x76]); // primary marker
+        resp[16..20].copy_from_slice(&[0x4C, 0x62, 0x44, 0x72]); // secondary marker
+        let mut t = ProbeFaultsDrive { resp };
+
+        let err = LdUnlocker::new()
+            .unlock(&mut t, &ctx(&id))
+            .expect_err("a dead bus during probe must abort, not report success");
+        assert_eq!(err, UnlockError::Transport);
+    }
+
+    // A drive-sense (not a dead bus) rejecting the speed probe is a genuine
+    // calibration miss: warn-and-continue on the default speed table, still
+    // reporting a full unlock. Non-transport sibling of the probe-fault test.
+    #[test]
+    fn drive_sense_during_probe_disc_still_reports_a_successful_unlock() {
+        let id = known_vid_drive_id();
+        let sig = profile::find_bundled(&id)
+            .expect("profile")
+            .profile
+            .signature;
+
+        let mut resp = vec![0u8; 64];
+        resp[0..4].copy_from_slice(&sig);
+        resp[12..16].copy_from_slice(&[0x4D, 0x4D, 0x6B, 0x76]); // primary marker
+        resp[16..20].copy_from_slice(&[0x4C, 0x62, 0x44, 0x72]); // secondary marker
+
+        struct ProbeSenseDrive {
+            resp: Vec<u8>,
+        }
+        impl ScsiTransport for ProbeSenseDrive {
+            fn execute(
+                &mut self,
+                cdb: &[u8],
+                _dir: DataDirection,
+                data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> crate::scsi::Result<ScsiResult> {
+                // READ_BUFFER (0x3C) / SUB_CMD_PROBE (0x14) is the speed probe.
+                if cdb.first() == Some(&0x3C) && cdb.get(3) == Some(&0x14) {
+                    return Ok(ScsiResult {
+                        status: 0x02,
+                        bytes_transferred: 0,
+                        sense: [0u8; 32],
+                    });
+                }
+                let n = self.resp.len().min(data.len());
+                data[..n].copy_from_slice(&self.resp[..n]);
+                Ok(ScsiResult {
+                    status: 0,
+                    bytes_transferred: n,
+                    sense: [0u8; 32],
+                })
+            }
+        }
+        let mut t = ProbeSenseDrive { resp };
+        assert!(
+            LdUnlocker::new()
+                .unlock(&mut t, &ctx(&id))
+                .expect("a calibration miss must not fail the whole unlock")
+                .is_some()
+        );
+    }
+
+    /// Catches classifying a dead bus as "not this unlocker's drive": the very
+    /// first unlock command faulting at the transport layer must abort the
+    /// consumer (`Transport`), not fall through to the next unlocker.
+    #[test]
+    fn transport_fault_during_unlock_is_transport_not_not_applicable() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::TransportFault);
+        let err = LdUnlocker::new()
+            .unlock(&mut t, &ctx(&known_vid_drive_id()))
+            .expect_err("dead bus");
+        assert_eq!(err, UnlockError::Transport);
     }
 }

src/ld/platform/mod.rs

@@ -1,4 +1,4 @@
-//! Platform-specific drive unlock + disc probing (LibreDrive internals).
+//! Platform-specific drive unlock + disc probing (LdUnlocker internals).
 
 pub mod mt1959;
 
@@ -17,9 +17,47 @@ pub(crate) trait PlatformDriver: Send {
     #[allow(dead_code)]
     fn is_ready(&self) -> bool;
 
-    /// True if the drive is currently in the extended-access state.
-    #[allow(dead_code)]
+    /// True if the drive is currently in the extended-access state. THE gate
+    /// `LdUnlocker::firmware_unlock` reports `drive_unlocked` from — `init()`
+    /// returning `Ok` only means the handshake completed, not that the drive
+    /// serves clear content.
     fn is_unlocked(&self) -> bool {
         false
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::scsi::mock::{MockTransport, Reply};
+
+    // Minimal driver taking the `PlatformDriver` default `is_unlocked`, so
+    // the default's `false` path is exercised (real drivers override it).
+    struct StubDriver;
+
+    impl PlatformDriver for StubDriver {
+        fn init(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()> {
+            scsi.execute(&[0], crate::scsi::DataDirection::None, &mut [], 0)?;
+            Ok(())
+        }
+
+        fn probe_disc(&mut self, scsi: &mut dyn ScsiTransport) -> Result<()> {
+            scsi.execute(&[0], crate::scsi::DataDirection::None, &mut [], 0)?;
+            Ok(())
+        }
+
+        fn is_ready(&self) -> bool {
+            true
+        }
+    }
+
+    #[test]
+    fn default_is_unlocked_is_false_and_trait_methods_dispatch() {
+        let mut drv = StubDriver;
+        let mut scsi = MockTransport::always(Reply::good(vec![]));
+        assert!(drv.init(&mut scsi).is_ok());
+        assert!(drv.probe_disc(&mut scsi).is_ok());
+        assert!(drv.is_ready());
+        assert!(!drv.is_unlocked());
+    }
+}

src/ld/platform/mt1959/variant_a.rs

@@ -21,9 +21,8 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
     }
 
     // Upload firmware via WRITE_BUFFER. The CDB's length is a 24-bit field;
-    // if the blob exceeds that, the encoded length would silently disagree
-    // with the bytes actually sent (`data`). Reject rather than upload a
-    // length-mismatched command.
+    // reject blobs that would exceed it rather than send a length-mismatched
+    // command.
     let len = firmware.len();
     if len > WRITE_BUFFER_MAX_LEN {
         return Err(crate::ld::error::Error::UnlockFailed);
@@ -43,7 +42,9 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
     let mut data = firmware.clone();
     scsi.execute(&cdb, DataDirection::ToDevice, &mut data, 30_000)?;
 
-    // Verify firmware loaded (non-fatal — different buffer_id 0x45)
+    // Verify the firmware loaded (non-fatal — different buffer_id 0x45). No
+    // documented expected payload exists, so the outcome is traced rather
+    // than asserted, instead of silently discarded before the unlock retries.
     let verify_cdb = [
         super::SCSI_READ_BUFFER,
         super::MODE_A,
@@ -57,17 +58,47 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
         0x00,
     ];
     let mut verify_resp = [0u8; super::VALIDATE_RESPONSE_SIZE as usize];
-    let _ = scsi.execute(
+    match scsi.execute(
         &verify_cdb,
         DataDirection::FromDevice,
         &mut verify_resp,
         5_000,
-    );
+    ) {
+        Ok(r) if r.status == 0 && r.bytes_transferred == verify_resp.len() => {
+            tracing::debug!(
+                target: "freemkv::disc",
+                phase = "mt1959a_fw_verify_ok",
+                "variant-A firmware verify read returned a full response"
+            );
+        }
+        Ok(r) => {
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "mt1959a_fw_verify_bad",
+                status = r.status,
+                bytes_transferred = r.bytes_transferred,
+                "variant-A firmware verify read did not return a full good response"
+            );
+        }
+        // A dead bus mid-upload must abort, not be swallowed into the unlock
+        // retries below.
+        Err(e) => {
+            let err = crate::ld::error::Error::from(e);
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase = "mt1959a_fw_verify_failed",
+                transport_failure = err.is_transport_failure(),
+                "variant-A firmware verify read failed"
+            );
+            if err.is_transport_failure() {
+                return Err(err);
+            }
+        }
+    }
 
-    // Double unlock after firmware upload. The first establishes the
-    // unlock and is fatal on failure; the second is a confirmation pass and
-    // is best-effort (matching variant B), so a benign hiccup on the
-    // redundant call doesn't fail an already-successful unlock.
+    // Double unlock after firmware upload: first is fatal on failure, second
+    // is a best-effort confirmation pass (matching variant B) so a benign
+    // hiccup there doesn't fail an already-successful unlock.
     mt.do_unlock(scsi)?;
     let _ = mt.do_unlock(scsi);
     Ok(())

src/ld/platform/mt1959/variant_b.rs

@@ -13,18 +13,54 @@ const FIRMWARE_EXTRA: [u8; 16] = [0; 16];
 /// that drive — real profiles must supply their own (see `DriveProfile`).
 const VENDOR_VERIFY: [u8; 10] = [0xF1, 0x01, 0x02, 0x00, 0x0D, 0x30, 0x01, 0xF3, 0xAD, 0x23];
 
+// See docs/variant-b-firmware-upload.md — trace_step rationale.
+// Swallows everything except a transport fault; these steps are advisory,
+// the unlock retries below are the real gate.
+fn trace_step(phase: &'static str, r: crate::scsi::Result<crate::scsi::ScsiResult>) -> Result<()> {
+    match r {
+        Ok(res) if res.status == 0 => {
+            tracing::debug!(
+                target: "freemkv::disc",
+                phase,
+                bytes_transferred = res.bytes_transferred,
+                "firmware upload step ok"
+            );
+            Ok(())
+        }
+        Ok(res) => {
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase,
+                status = res.status,
+                "firmware upload step returned a drive sense"
+            );
+            Ok(())
+        }
+        Err(e) => {
+            let err = crate::ld::error::Error::from(e);
+            tracing::warn!(
+                target: "freemkv::disc",
+                phase,
+                transport_failure = err.is_transport_failure(),
+                "firmware upload step failed"
+            );
+            if err.is_transport_failure() {
+                return Err(err);
+            }
+            Ok(())
+        }
+    }
+}
+
 pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Result<()> {
     let firmware = &mt.profile.firmware;
     if firmware.is_empty() {
         return Err(crate::ld::error::Error::UnlockFailed);
     }
 
-    // Step 1: Upload the firmware via MODE SELECT. The profile's `firmware` is
-    // the exact per-drive image — extracted at the drive's own load-CDB length
-    // (2192..2528 bytes; the old fixed 0x9C0 truncated some drives and over-read
-    // others into blob strings). Upload all of it. MODE SELECT(10)'s
-    // parameter-list length is 16-bit, so reject only a blob that can't be
-    // expressed in the CDB.
+    // Step 1: Upload the firmware via MODE SELECT (see docs/variant-b-firmware-upload.md).
+    // MODE SELECT(10)'s parameter-list length is 16-bit, so reject only a
+    // blob that can't be expressed in the CDB.
     let write_len = firmware.len();
     if write_len > u16::MAX as usize {
         return Err(crate::ld::error::Error::UnlockFailed);
@@ -58,12 +94,15 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
         0x00,
     ];
     let mut meta_resp = [0u8; 16];
-    let _ = scsi.execute(
-        &read_meta_cdb,
-        DataDirection::FromDevice,
-        &mut meta_resp,
-        5_000,
-    );
+    trace_step(
+        "mt1959b_fw_meta",
+        scsi.execute(
+            &read_meta_cdb,
+            DataDirection::FromDevice,
+            &mut meta_resp,
+            5_000,
+        ),
+    )?;
 
     // Step 3: Write extra firmware data (all zeros)
     let write_extra_cdb = [
@@ -79,24 +118,33 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
         0x00,
     ];
     let mut data2 = FIRMWARE_EXTRA.to_vec();
-    let _ = scsi.execute(&write_extra_cdb, DataDirection::ToDevice, &mut data2, 5_000);
+    trace_step(
+        "mt1959b_fw_extra",
+        scsi.execute(&write_extra_cdb, DataDirection::ToDevice, &mut data2, 5_000),
+    )?;
 
-    // Step 4: Vendor verify (0xF1 — B-only, not standard SCSI). PER-DRIVE: take
-    // it from the profile (39 distinct values across the 140 B drives). The
-    // const is only a legacy fallback — it carries one drive's token.
+    // Step 4: Vendor verify (0xF1 — B-only, not standard SCSI), per-drive.
+    // See docs/variant-b-firmware-upload.md for why the outcome is traced
+    // rather than discarded.
     let verify_cdb = mt.profile.fw_verify_cdb.unwrap_or(VENDOR_VERIFY);
     let mut dummy = [0u8; 0];
-    let _ = scsi.execute(&verify_cdb, DataDirection::None, &mut dummy, 5_000);
+    trace_step(
+        "mt1959b_fw_verify",
+        scsi.execute(&verify_cdb, DataDirection::None, &mut dummy, 5_000),
+    )?;
 
-    // Step 5: Unlock retries (up to 5, then a final fatal attempt). On a
-    // successful unlock we issue one confirmation pass; its result is
-    // intentionally best-effort — the first call already established the
-    // unlock state, so a hiccup on the redundant confirmation must not fail
-    // an otherwise-good unlock.
+    // Step 5: Unlock retries (up to 5, then a final fatal attempt). The
+    // confirmation pass after success is intentionally best-effort — see
+    // docs/variant-b-firmware-upload.md.
     for _attempt in 0..5 {
-        if mt.do_unlock(scsi).is_ok() {
-            let _ = mt.do_unlock(scsi);
-            return Ok(());
+        match mt.do_unlock(scsi) {
+            Ok(_) => {
+                let _ = mt.do_unlock(scsi);
+                return Ok(());
+            }
+            // A dead bus will not recover across five more unlock attempts.
+            Err(e) if e.is_transport_failure() => return Err(e),
+            Err(_) => {}
         }
     }
     mt.do_unlock(scsi)?;

src/ld/profile.rs

@@ -3,7 +3,7 @@
 use crate::ld::error::{Error, Result};
 use serde::Deserialize;
 
-/// The LibreDrive profile catalog — the set of optical drives the firmware
+/// The LdUnlocker profile catalog — the set of optical drives the firmware
 /// unlocker recognizes, keyed by chipset + variant. Loaded from the bundled
 /// JSON; the public entry point is [`crate::ld::profiles`].
 #[derive(Debug, Deserialize)]
@@ -19,7 +19,7 @@ pub struct Profiles {
 impl Profiles {
     /// The profile matching a drive identity, if this catalog supports that
     /// drive. Two-pass per platform section: exact (incl. firmware date) then a
-    /// looser vendor/revision/vendor-specific match. See [`find_by_drive_id`].
+    /// looser vendor/revision/vendor-specific match. See `find_by_drive_id`.
     pub fn get(&self, drive_id: &crate::DriveId) -> Option<ProfileMatch> {
         find_by_drive_id(self, drive_id)
     }
@@ -41,7 +41,13 @@ pub struct Identity {
 }
 
 /// Per-drive profile.
-#[derive(Debug, Clone, Deserialize)]
+///
+/// Only `identity` and `signature` are public; everything else (firmware
+/// image, per-drive vendor CDB templates) is `pub(crate)` unlock mechanism
+/// that must stay inside this unpublished crate.
+/// See docs/drive-profile-visibility.md — field-visibility and allow(dead_code) rationale.
+#[allow(dead_code)]
+#[derive(Clone, Deserialize)]
 pub struct DriveProfile {
     pub identity: Identity,
     /// Expected first 4 bytes of the drive's unlock response — the
@@ -53,48 +59,62 @@ pub struct DriveProfile {
     /// firmware-load step). JSON-encoded as standard base64; empty when
     /// the profile carries no firmware blob.
     #[serde(default, deserialize_with = "deserialize_base64")]
-    pub firmware: Vec<u8>,
+    pub(crate) firmware: Vec<u8>,
 
     // ── OEM-extended-access CDB templates ──────────────────────────────
-    //
-    // All optional — older profile blobs that pre-date the CDB capture
-    // pipeline simply omit these fields and decode as `None`. Encoded
-    // in the JSON as lowercase hex strings without separators
-    // (e.g. `"3c014410e29100002400"` for a 10-byte CDB).
+    // All optional (`None` if pre-capture-pipeline). Hex strings, no
+    // separators, e.g. `"3c014410e29100002400"`.
     #[serde(default)]
-    pub unlock_init_value: u8,
+    pub(crate) unlock_init_value: u8,
     #[serde(default)]
-    pub unlock_response_size: u8,
+    pub(crate) unlock_response_size: u8,
 
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read_vid_cdb: Option<[u8; 10]>,
+    pub(crate) read_vid_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read_disc_keys_cdb: Option<[u8; 10]>,
+    pub(crate) read_disc_keys_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_12")]
-    pub drive_nominal_speed_cdb: Option<[u8; 12]>,
+    pub(crate) drive_nominal_speed_cdb: Option<[u8; 12]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_12")]
-    pub set_speed_max_cdb: Option<[u8; 12]>,
+    pub(crate) set_speed_max_cdb: Option<[u8; 12]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read10_raw_2sec_cdb: Option<[u8; 10]>,
+    pub(crate) read10_raw_2sec_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read10_raw_1sec_cdb: Option<[u8; 10]>,
+    pub(crate) read10_raw_1sec_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read_buffer_verify_cdb: Option<[u8; 10]>,
+    pub(crate) read_buffer_verify_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub write_buffer_cdb: Option<[u8; 10]>,
+    pub(crate) write_buffer_cdb: Option<[u8; 10]>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub read_buffer_unlock_cdb: Option<[u8; 10]>,
+    pub(crate) read_buffer_unlock_cdb: Option<[u8; 10]>,
     /// Variant-B vendor verify (0xF1) CDB. PER-DRIVE: 39 distinct values across
     /// the 140 B drives, so it CANNOT be a hardcoded constant. `variant_b`'s old
     /// `VENDOR_VERIFY` const was one drive's token, wrong for the other ~139.
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes_10")]
-    pub fw_verify_cdb: Option<[u8; 10]>,
+    pub(crate) fw_verify_cdb: Option<[u8; 10]>,
 
     // Per-drive identifier tables — variable-length hex strings.
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes")]
-    pub speed_zone_table: Option<Vec<u8>>,
+    pub(crate) speed_zone_table: Option<Vec<u8>>,
     #[serde(default, deserialize_with = "deserialize_opt_hex_bytes")]
-    pub speed_calc_table: Option<Vec<u8>>,
+    pub(crate) speed_calc_table: Option<Vec<u8>>,
+}
+
+// Hand-written, REDACTING Debug: a derived one would recurse through the
+// public `Profiles` catalog and print raw firmware + vendor CDB bytes into
+// logs. Show only identity + signature; collapse firmware to a length.
+impl std::fmt::Debug for DriveProfile {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DriveProfile")
+            .field("identity", &self.identity)
+            .field("signature", &self.signature)
+            .field(
+                "firmware",
+                &format_args!("[{} bytes redacted]", self.firmware.len()),
+            )
+            .field("cdb_templates", &"[redacted]")
+            .finish()
+    }
 }
 
 /// Chipset + variant — determined by which section the profile was found in.
@@ -129,23 +149,16 @@ pub struct ProfileMatch {
     pub platform: Platform,
 }
 
-// ── Parsing ────────────────────────────────────────────────────────────
-
-/// Decode an even-length ASCII hex string into bytes.
-///
-/// Operates on raw bytes rather than `&str` char-boundary slices: a
-/// non-ASCII input (e.g. a hand-edited profile with a multi-byte char)
-/// could otherwise have `&s[i..i+2]` land inside a UTF-8 char boundary and
-/// panic. Hex is ASCII, so any non-ASCII or non-hex byte simply fails to
-/// decode. The error is a stable, language-neutral token (`"hex"`), not a
-/// translatable English message.
+// ── Parsing: decode hex on raw bytes (not `&str` slices) so non-ASCII
+// can't land `&s[i..i+2]` inside a UTF-8 char boundary and panic — it
+// just fails to decode with `"hex"`.
 fn decode_hex(s: &str) -> std::result::Result<Vec<u8>, &'static str> {
     let bytes = s.as_bytes();
-    if bytes.len() % 2 != 0 {
+    if !bytes.len().is_multiple_of(2) {
         return Err("hex");
     }
     let mut out = Vec::with_capacity(bytes.len() / 2);
-    for pair in bytes.chunks_exact(2) {
+    for pair in bytes.as_chunks::<2>().0.iter() {
         let hi = (pair[0] as char).to_digit(16).ok_or("hex")?;
         let lo = (pair[1] as char).to_digit(16).ok_or("hex")?;
         out.push((hi * 16 + lo) as u8);
@@ -185,9 +198,7 @@ where
 }
 
 // ── Fixed-length hex deserializers for CDB templates ────────────────────
-//
-// Profile JSON encodes CDBs as lowercase hex strings without separators.
-// An empty string / null / missing field decodes as `None`.
+// Lowercase hex strings, no separators; empty/null/missing decodes as `None`.
 
 fn parse_hex_bytes(s: &str) -> std::result::Result<Vec<u8>, &'static str> {
     decode_hex(s)
@@ -266,7 +277,20 @@ pub fn bundled() -> Option<&'static Profiles> {
     use std::sync::OnceLock;
     static CACHE: OnceLock<Option<Profiles>> = OnceLock::new();
     CACHE
-        .get_or_init(|| load_from_str(BUNDLED_PROFILES).ok())
+        .get_or_init(|| match load_from_str(BUNDLED_PROFILES) {
+            Ok(p) => Some(p),
+            // `None` caches permanently; unlogged that's indistinguishable
+            // from a genuinely uncataloged drive, so log once, loudly, here.
+            Err(e) => {
+                tracing::error!(
+                    target: "freemkv::disc",
+                    phase = "bundled_profiles_parse_failed",
+                    error_code = e.code(),
+                    "bundled LdUnlocker profile catalog failed to parse; no drive can match"
+                );
+                None
+            }
+        })
         .as_ref()
 }
 
@@ -283,15 +307,14 @@ fn load_from_str(data: &str) -> Result<Profiles> {
     serde_json::from_str(data).map_err(|_| Error::ProfileParse)
 }
 
-/// Find a profile matching a drive's INQUIRY fields.
+/// Find a profile matching a drive's INQUIRY fields, whitespace-trimmed.
 ///
-/// Per platform section (MT1959-A, then MT1959-B, then Renesas), tried in
-/// order of decreasing specificity: full match including `product_id` and
-/// `firmware_date` (skipped when the drive reports no product), then the same
-/// without `product_id`. Both require `firmware_date`; every profile carries a
-/// unique identity under these fields, so a match is exact — no looser
-/// vendor/revision fallback that could pick the wrong same-model variant. All
-/// comparisons are whitespace-trimmed. Returns the first section that matches.
+/// Per platform section (MT1959-A, -B, Renesas): (1) exact match including
+/// `product_id` when the drive reports one; (2) product-id-blind fallback on
+/// the four-field identity (vendor/revision/vendor_specific/firmware_date).
+/// Catalogs store a GENERIC product_id (e.g. "BD-RE") vs a drive's specific one
+/// ("BD-RE BU40N"), so pass 1 misses; pass 2 binds a UNIQUE four-field match —
+/// a shared four-tuple binds only when the drive reported no product_id.
 pub fn find_by_drive_id(profiles: &Profiles, drive_id: &crate::DriveId) -> Option<ProfileMatch> {
     let v = drive_id.vendor_id.trim();
     let prod = drive_id.product_id.trim();
@@ -304,32 +327,54 @@ pub fn find_by_drive_id(profiles: &Profiles, drive_id: &crate::DriveId) -> Optio
         (Platform::Mt1959B, &profiles.mt1959_b),
         (Platform::Renesas, &profiles.renesas),
     ] {
-        if !prod.is_empty() {
-            if let Some(p) = list.iter().find(|p| {
+        if !prod.is_empty()
+            && let Some(p) = list.iter().find(|p| {
                 p.identity.vendor_id.trim() == v
                     && p.identity.product_id.trim() == prod
                     && p.identity.product_revision.trim() == r
                     && p.identity.vendor_specific.trim() == vs
                     && p.identity.firmware_date.trim() == date
-            }) {
-                return Some(ProfileMatch {
-                    profile: p.clone(),
-                    platform,
-                });
-            }
-        }
-
-        if let Some(p) = list.iter().find(|p| {
-            p.identity.vendor_id.trim() == v
-                && p.identity.product_revision.trim() == r
-                && p.identity.vendor_specific.trim() == vs
-                && p.identity.firmware_date.trim() == date
-        }) {
+            })
+        {
             return Some(ProfileMatch {
                 profile: p.clone(),
                 platform,
             });
         }
+
+        // Product-id-blind fallback: catalogs store a GENERIC product_id while
+        // drives report a specific one, so the exact pass misses. Match the
+        // four-field identity instead; guard mis-binding on shared tuples below.
+        let four_field: Vec<&DriveProfile> = list
+            .iter()
+            .filter(|p| {
+                p.identity.vendor_id.trim() == v
+                    && p.identity.product_revision.trim() == r
+                    && p.identity.vendor_specific.trim() == vs
+                    && p.identity.firmware_date.trim() == date
+            })
+            .collect();
+        match four_field.as_slice() {
+            // Exactly one four-field match — unambiguous; bind regardless of
+            // the reported product_id (the common real-drive case, and the
+            // pre-1.7.0 behaviour a UHD-capable LG BU40N relied on).
+            [only] => {
+                return Some(ProfileMatch {
+                    profile: (*only).clone(),
+                    platform,
+                });
+            }
+            // Shared four-tuple: bind only when the drive reported NO
+            // product_id. A non-empty one that missed the exact pass is an
+            // uncataloged variant and must not mis-bind to a sibling.
+            [first, ..] if prod.is_empty() => {
+                return Some(ProfileMatch {
+                    profile: (*first).clone(),
+                    platform,
+                });
+            }
+            _ => {}
+        }
     }
 
     None
@@ -386,6 +431,47 @@ mod tests {
         let id0 = make_drive_id("TIE", "1.00", "XX00000", "200001010000");
         let m0 = find_by_drive_id(&profiles, &id0).unwrap();
         assert_eq!(m0.profile.signature, [0xaa, 0xaa, 0xaa, 0xaa]);
+
+        // A REPORTED product_id that matches no cataloged entry must NOT fall
+        // through to the four-field pass and bind to a sibling (MODEL-A/B);
+        // an uncataloged variant is no match, not a wrong match.
+        let mut idc = make_drive_id("TIE", "1.00", "XX00000", "200001010000");
+        idc.product_id = "MODEL-C".to_string();
+        assert!(
+            find_by_drive_id(&profiles, &idc).is_none(),
+            "an uncataloged product_id must not mis-bind to a same-vendor sibling",
+        );
+    }
+
+    /// REGRESSION (1.7.0): a real drive reports a SPECIFIC product_id (e.g.
+    /// "BD-RE BU40N") while the catalog stores a GENERIC one ("BD-RE"), so the
+    /// exact pass misses. When the four-field identity is UNIQUE it must still
+    /// bind — the pre-1.7.0 behaviour a UHD LG BU40N relies on for LibreDrive
+    /// unlock. 1.7.0 gated the four-field pass behind an empty product_id, so it
+    /// silently stopped matching and the firmware unlocker was skipped entirely.
+    #[test]
+    fn find_by_drive_id_specific_product_id_binds_unique_four_field() {
+        use serde_json::json;
+        let profiles: Profiles = serde_json::from_str(
+            &json!({
+                "mt1959_a": [
+                    {"identity": {"vendor_id":"HL-DT-ST","product_id":"BD-RE",
+                        "product_revision":"1.03","vendor_specific":"NM00000",
+                        "firmware_date":"211810241934"},
+                        "signature":"12345678","firmware":""}
+                ]
+            })
+            .to_string(),
+        )
+        .unwrap();
+
+        // Drive reports the specific marketing product_id; catalog has "BD-RE".
+        let mut id = make_drive_id("HL-DT-ST", "1.03", "NM00000", "211810241934");
+        id.product_id = "BD-RE BU40N".to_string();
+        let m = find_by_drive_id(&profiles, &id)
+            .expect("unique four-field identity must match despite the product_id mismatch");
+        assert_eq!(m.profile.signature, [0x12, 0x34, 0x56, 0x78]);
+        assert_eq!(m.platform, Platform::Mt1959A);
     }
 
     #[test]
@@ -488,10 +574,8 @@ mod tests {
         assert_eq!(parse_hex4("aabbccdd").unwrap(), [0xaa, 0xbb, 0xcc, 0xdd]);
     }
 
-    /// Platform::name() returns stable, non-empty, language-neutral identifiers.
-    /// These strings are logged and keyed on in caller code; changing them is a
-    /// breaking change.
-    /// Mutation: swapping Mt1959A and Mt1959B names silently misroutes firmware upload.
+    // Platform::name() strings are logged/keyed by callers; changing them is
+    // a breaking change. Mutation: swapping A/B names misroutes firmware upload.
     #[test]
     fn platform_name_is_stable() {
         // The exact strings are part of the public stable API (logged/keyed).
@@ -500,11 +584,9 @@ mod tests {
         assert_eq!(Platform::Renesas.name(), "Renesas");
     }
 
-    /// find_by_drive_id: exact match (including firmware_date) wins over loose match.
-    /// Spec: two-pass — first an exact match including firmware_date, then looser.
-    /// Build two synthetic Profiles entries that differ only by firmware_date,
-    /// and verify the correct one is selected.
-    /// Mutation: doing only the loose pass would return the first entry regardless of date.
+    // find_by_drive_id: two-pass — exact match (incl. firmware_date) wins
+    // over loose. Mutation: skipping the exact pass returns the first entry
+    // regardless of date.
     #[test]
     fn find_by_drive_id_exact_date_wins_over_loose() {
         use serde_json::json;
@@ -596,10 +678,8 @@ mod tests {
         assert!(matches!(result, Err(Error::ProfileParse)));
     }
 
-    /// Bundled profiles is non-empty (mt1959_a has at least one entry).
-    /// This pins the embedded JSON: if profiles.json is accidentally emptied
-    /// or truncated, this test goes red.
-    /// Mutation: clearing profiles.json would make this fail.
+    // Pins the embedded JSON: if profiles.json is emptied/truncated, this
+    // goes red.
     #[test]
     fn bundled_profiles_has_entries() {
         let profiles = load_bundled().unwrap();
@@ -609,10 +689,8 @@ mod tests {
         );
     }
 
-    /// deserialization of a profile with missing optional CDB fields
-    /// produces None for those fields (not a parse error).
-    /// Spec: all CDB template fields are `#[serde(default)]` — they are optional.
-    /// Mutation: making a CDB field required breaks backward-compat with old blobs.
+    // All CDB fields are `#[serde(default)]`. Mutation: making one required
+    // breaks backward-compat with old blobs.
     #[test]
     fn profile_optional_cdb_fields_default_to_none() {
         use serde_json::json;
@@ -660,10 +738,38 @@ mod tests {
         );
     }
 
-    /// deserialize_hex4 of an empty string must produce [0;4] without error.
-    /// This matches `deserialize_hex4`'s explicit early-return for empty strings.
-    /// Mutation: treating empty string as an error prevents profiles where signature
-    ///           was not captured from loading.
+    // `Debug` must not render firmware/CDB bytes. Mutation: restoring
+    // `#[derive(Debug)]` prints them (e.g. the 0xEE marker below), goes red.
+    #[test]
+    fn drive_profile_debug_redacts_firmware_and_cdbs() {
+        use serde_json::json;
+        let profiles: Profiles = serde_json::from_str(
+            &json!({
+                "mt1959_a": [{
+                    "identity": {"vendor_id":"VIS","product_revision":"1.00",
+                        "vendor_specific":"AA00000","firmware_date":"200001010000"},
+                    "signature":"aabbccdd",
+                    "firmware":"7u7u7u7u", // base64 → six 0xEE bytes
+                    "read_vid_cdb":"3c014410e29100002400"
+                }]
+            })
+            .to_string(),
+        )
+        .unwrap();
+        let s = format!("{:?}", profiles.mt1959_a[0]);
+        // Firmware byte 0xEE renders as `238` under a derived Debug.
+        assert!(!s.contains("238"), "firmware bytes must not appear: {s}");
+        assert!(
+            !s.contains("read_vid_cdb"),
+            "CDB templates must not appear: {s}"
+        );
+        assert!(s.contains("redacted"), "must mark redaction: {s}");
+        // The PUBLIC fields stay visible.
+        assert!(s.contains("VIS"), "identity must remain visible: {s}");
+    }
+
+    // deserialize_hex4("") must produce [0;4]. Mutation: treating empty as
+    // an error blocks profiles with no captured signature from loading.
     #[test]
     fn profile_empty_signature_deserialises_as_zeroes() {
         use serde_json::json;

src/lib.rs

@@ -1,32 +1,61 @@
 //! freemkv-unlock — the unlock layer for the freemkv toolchain.
 //!
 //! An **unlocker removes a drive-level bus-encryption barrier** so the drive
-//! serves readable (de-bus'd / de-scrambled) sectors. Content-key decryption is
-//! a separate layer — the consumer's (libfreemkv's) job.
+//! serves readable (de-bus'd / de-scrambled) sectors. Content-key decryption
+//! is a separate layer — the consumer's (libfreemkv's) job.
 //!
-//! This crate defines the [`Unlocker`] contract + the SCSI transport contract,
-//! and holds the self-contained unlocker modules (firmware / AACS cert / CSS).
-//! libfreemkv depends on this crate and dispatches via [`all_unlockers`]; it
-//! never names an individual unlocker. To remove an unlocker, delete its module
-//! dir and its one line in [`all_unlockers`] — nothing else changes.
+//! This crate defines the [`Unlocker`] contract + the SCSI transport
+//! contract, and holds the self-contained unlocker modules (firmware / AACS
+//! cert / CSS). The consumer (libfreemkv) assembles its own dispatch list from
+//! the exported unlocker types and drives them all through the same trait.
 
 pub mod scsi;
 
+// `firmware` is the ergonomic, typed mirror of the freemkv vendor-command ABI
+// (`freemkv-fw/src/abi.rs`) + the `FirmwareControl` driver. Public so host
+// tooling (freemkv-drivetest) can arm/inspect a freemkv drive directly.
+pub mod firmware;
+
 mod aacs;
 mod css;
-// `ld` is public ONLY for its drive-profile catalog (`ld::profiles` / the
-// `Profiles` object) and, under the `emulation` feature, the unlock-handshake
-// wire format the bdemu test-emulator needs. The unlocker impl itself
-// (`LibreDrive`) is `pub(crate)` — clients still reach unlockers only through
-// [`all_unlockers`]. `aacs` and `css` carry no such public catalog, so they
-// stay fully private.
+// Shared best-effort AACS Volume ID read, used by every route that opens the
+// drive to raw reads (freemkv / MT1959 / Renesas). See `vid`.
+mod vid;
+// The bare best-effort AACS Volume ID read (`0xAD` fmt `0x80`) — public so a
+// harness armed `Ake=null` can read the VID with NO cert AKE and prove no
+// SEND KEY crossed the bus.
+pub use vid::read_aacs_vid;
+// `ld` is public only for its drive-profile catalog + (under `emulation`) the
+// handshake wire format bdemu needs; the unlocker impl stays `pub(crate)`.
+// See docs/module-visibility.md — module visibility rationale.
 pub mod ld;
-// `renesis` is public for its `is_renesas` drive-probe; the unlocker impl
-// (`Renesis`) is `pub(crate)` — reached only through [`all_unlockers`].
-pub mod renesis;
+// `renesas` is public for its `is_renesas` drive-probe (dead bus vs. "not a
+// Renesas drive"); the unlocker impl stays `pub(crate)`.
+// See docs/module-visibility.md — module visibility rationale.
+pub mod renesas;
+// `freemkv` self-identifies rather than matching a bundled profile, so it
+// stays fully private. See docs/module-visibility.md — module visibility rationale.
+mod freemkv;
 
 use scsi::ScsiTransport;
 
+// The five unlockers, exposed as concrete types so the consumer assembles its
+// own dispatch list and injects each one's deps at construction (certs → AACS)
+// — no central factory to thread another unlocker's config through.
+pub use aacs::AacsUnlocker;
+// Keypair-validity check for a stored AACS 1.0 host cert (`priv·G ==
+// cert_pub_key`), for the key service's host-cert health gate.
+pub use aacs::aacs1_keypair_matches;
+pub use css::DvdUnlocker;
+// The ergonomic firmware-control surface (typed grammar + recipes).
+pub use firmware::{
+    ArmRecipe, BdRegion, Feature, FeatureStates, FirmwareControl, FirmwareError, FirmwareIdentity,
+    Verb,
+};
+pub use freemkv::FreemkvUnlocker;
+pub use ld::LdUnlocker;
+pub use renesas::Renesas;
+
 /// Drive identity an unlocker matches against — four raw INQUIRY-derived fields,
 /// filled by the consumer (this crate parses no INQUIRY itself).
 #[derive(Debug, Clone, Default)]
@@ -49,44 +78,74 @@ pub enum DiscKind {
 
 /// A host certificate for the AACS cert handshake (raw; the consumer collects
 /// these from its key sources and passes them in).
-#[derive(Debug, Clone)]
+// `ZeroizeOnDrop` wipes the two host PRIVATE keys on drop so they don't linger in
+// freed memory. The certificates are public material (sent to the drive in the
+// clear), so they are `#[zeroize(skip)]` — nothing secret, cert bytes untouched.
+#[derive(Clone, zeroize::ZeroizeOnDrop)]
 pub struct HostCert {
     /// AACS 1.0 host private key (20 bytes).
     pub private_key: [u8; 20],
     /// AACS 1.0 host certificate (92 bytes).
+    #[zeroize(skip)]
     pub certificate: Vec<u8>,
     /// AACS 2.0 host private key (P-256, 32 bytes). `None` for AACS 1.0 only.
     pub private_key_v2: Option<[u8; 32]>,
     /// AACS 2.0 host certificate (type 0x11). `None` for AACS 1.0 only.
+    #[zeroize(skip)]
     pub certificate_v2: Option<Vec<u8>>,
 }
 
-/// Context handed to an unlocker: drive identity, disc kind, and (for the cert
-/// route) the host certs the consumer collected.
-pub struct UnlockCtx<'a> {
-    pub drive_id: &'a DriveId,
-    pub kind: DiscKind,
-    pub host_certs: &'a [HostCert],
-}
-
-impl<'a> UnlockCtx<'a> {
-    pub fn new(drive_id: &'a DriveId, kind: DiscKind, host_certs: &'a [HostCert]) -> Self {
-        Self {
-            drive_id,
-            kind,
-            host_certs,
-        }
+// Manual Debug: `private_key`/`private_key_v2` are the raw host private keys —
+// they must never reach a log in plaintext; presence (Some/None) of the v2 key
+// stays observable. Mirrors the redacting Debug on AacsAuth/Unlocked.
+impl std::fmt::Debug for HostCert {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("HostCert")
+            .field("private_key", &"[redacted]")
+            .field("certificate", &self.certificate)
+            .field("private_key_v2", &self.private_key_v2.map(|_| "[redacted]"))
+            .field("certificate_v2", &self.certificate_v2)
+            .finish()
     }
 }
 
-/// What removing bus encryption yielded. `drive_unlocked` means the drive now
-/// serves clear content (firmware route) — equivalent, for the gate, to a cert
-/// `bus_key`.
-#[derive(Debug, Clone, Default)]
+/// Per-attempt context the consumer hands to EVERY unlocker, uniformly: the
+/// drive identity and the mounted disc's kind. These are the shared facts the
+/// dispatch loop knows; anything an individual unlocker needs beyond them (the
+/// AACS cert route's host certs) is injected into THAT unlocker at construction,
+/// so the loop and the other unlockers never see it. See docs/module-visibility.md.
+pub struct UnlockCtx<'a> {
+    pub drive_id: &'a DriveId,
+    pub kind: DiscKind,
+}
+
+impl<'a> UnlockCtx<'a> {
+    pub fn new(drive_id: &'a DriveId, kind: DiscKind) -> Self {
+        Self { drive_id, kind }
+    }
+}
+
+/// What a successful unlock captured: the Volume ID (best-effort — may be `None`
+/// even on success) and, for the cert route, the bus key the read path applies
+/// to de-bus content. Returned inside the `Some` of [`Unlocker::unlock`]; there
+/// is no `drive_unlocked` flag — "unlocked" is simply `unlock()` returning
+/// `Some`, uniformly for every route.
+#[derive(Clone, Default)]
 pub struct Unlocked {
     pub vid: Option<[u8; 16]>,
     pub bus_key: Option<[u8; 16]>,
-    pub drive_unlocked: bool,
+}
+
+// Hand-written, REDACTING Debug: `bus_key`/`vid` are key material that must
+// never reach a log in plaintext; presence (Some/None) stays observable.
+// See docs/unlocked-debug-redaction.md — full rationale.
+impl std::fmt::Debug for Unlocked {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Unlocked")
+            .field("vid", &self.vid.map(|_| "[redacted]"))
+            .field("bus_key", &self.bus_key.map(|_| "[redacted]"))
+            .finish()
+    }
 }
 
 /// Why an unlock produced no usable result. Only `Transport` is a hard error
@@ -107,46 +166,46 @@ pub enum UnlockError {
 }
 
 /// An unlocker removes a drive-level bus-encryption barrier. Implementors are
-/// the self-contained modules in this crate; the consumer only ever sees the
-/// trait, via [`all_unlockers`]. (Each module owns its own conversion from its
-/// internal error to [`UnlockError`].)
+/// the self-contained modules in this crate; the consumer drives them all
+/// through this trait. (Each module owns its own conversion from its internal
+/// error to [`UnlockError`].)
 ///
 /// NOTE: drive tuning (e.g. SET CD SPEED to lift riplock) is deliberately NOT
 /// here — that is the consumer's concern, not bus removal.
 pub trait Unlocker: Send + Sync {
-    /// Short, stable identifier for this unlocker (e.g. "LibreDrive", "AACS",
-    /// "CSS", "Renesas"). The ONE place a name lives — apps render the unlocker
-    /// report from [`all_unlockers`], never hardcoding names, so adding/removing
+    /// Short, stable identifier for this unlocker (e.g. "freemkv", "LD",
+    /// "AACS", "DVD", "Renesas"). The ONE place a name lives — apps render the
+    /// unlocker report from `name()`, never hardcoding names, so adding/removing
     /// an unlocker updates every report with no app change.
     fn name(&self) -> &'static str;
 
-    /// Unlock DRIVE FEATURES — riplock/speed, OEM Volume ID, OEM extended-access
-    /// reads. The consumer runs this at drive-prep, trying each unlocker until
-    /// one handles the drive. `Ok(_)` = this unlocker handled it (LibreDrive also
-    /// removes bus encryption at the drive, so its result carries
-    /// `drive_unlocked: true`); `Err(NotApplicable)` = not this unlocker's drive;
-    /// `Err(Transport)` = dead bus (the consumer aborts). Default: not provided.
-    fn unlock_features(
+    /// Attempt to unlock the drive, whatever the mechanism (vendor CDB, profile
+    /// firmware handshake, AACS cert AKE, CSS auth):
+    /// `Ok(Some(unlocked))` = this one unlocked it (read `vid`/`bus_key`, stop);
+    /// `Ok(None)` = not this unlocker's drive (try the next); `Err(Transport)` =
+    /// dead bus (abort). Only a dead bus is `Err` — a missing VID, rejected
+    /// handshake, missing cert, or wrong disc kind all fall through as `Ok(None)`
+    /// (the VID inside `Unlocked` is best-effort). `&self`: stateless, returns
+    /// what it learned rather than stashing it.
+    fn unlock(
         &self,
         scsi: &mut dyn ScsiTransport,
         ctx: &UnlockCtx,
-    ) -> std::result::Result<Unlocked, UnlockError> {
-        let _ = (scsi, ctx);
-        Err(UnlockError::NotApplicable)
-    }
+    ) -> std::result::Result<Option<Unlocked>, UnlockError>;
+}
 
-    /// Remove BUS ENCRYPTION for the mounted disc (AACS host-cert handshake, or
-    /// CSS scrambled-sector auth). The consumer runs this only when the bus isn't
-    /// already clear, trying each unlocker until one handles it. Same `Ok` /
-    /// `Err(NotApplicable)` / `Err(Transport)` contract as [`unlock_features`].
-    /// Default: not provided.
-    fn unlock_bus(
-        &self,
-        scsi: &mut dyn ScsiTransport,
-        ctx: &UnlockCtx,
-    ) -> std::result::Result<Unlocked, UnlockError> {
-        let _ = (scsi, ctx);
-        Err(UnlockError::NotApplicable)
+/// The shared "only a dead bus is fatal" rule every unlocker uses to turn its
+/// mechanism's `Result<Unlocked>` into the trait's outcome: success → `Some`, a
+/// dead bus → `Err(Transport)`, any other failure → `None` (fall through to the
+/// next unlocker). Written once here so the five unlockers stay identical in
+/// error handling and differ only in their CDBs and checks.
+pub(crate) fn fallthrough(
+    r: std::result::Result<Unlocked, UnlockError>,
+) -> std::result::Result<Option<Unlocked>, UnlockError> {
+    match r {
+        Ok(u) => Ok(Some(u)),
+        Err(UnlockError::Transport) => Err(UnlockError::Transport),
+        Err(_) => Ok(None),
     }
 }
 
@@ -159,14 +218,97 @@ pub fn unlocker_name(drive_id: &DriveId) -> Option<&'static str> {
     ld::firmware_name(drive_id)
 }
 
-/// Every unlocker, in dispatch order (firmware → cert → css). This is the ONLY
-/// place an unlocker is named. Remove one = delete its line here + its module
-/// dir; the consumer never changes.
-pub fn all_unlockers() -> Vec<Box<dyn Unlocker>> {
-    vec![
-        Box::new(ld::LibreDrive::new()),
-        Box::new(renesis::Renesis::new()),
-        Box::new(aacs::AacsCert::new()),
-        Box::new(css::CssUnlocker::new()),
-    ]
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // The canonical dispatch order the consumer assembles (freemkv → firmware →
+    // Renesas → cert → css). It lives in the consumer now (no factory), but the
+    // types are ours, so pin their names here so a rename is caught crate-local.
+    fn canonical_unlockers() -> Vec<Box<dyn Unlocker>> {
+        vec![
+            Box::new(FreemkvUnlocker::new()),
+            Box::new(LdUnlocker::new()),
+            Box::new(Renesas::new()),
+            Box::new(AacsUnlocker::new(Vec::new())),
+            Box::new(DvdUnlocker::new()),
+        ]
+    }
+
+    #[test]
+    fn unlocker_names_are_stable() {
+        let names: Vec<&'static str> = canonical_unlockers().iter().map(|u| u.name()).collect();
+        assert_eq!(names, vec!["freemkv", "LD", "Renesas", "AACS", "DVD"]);
+    }
+
+    /// The uniform contract every unlocker obeys, whatever its mechanism: on a
+    /// DEAD BUS, `unlock()` either declined before touching it (`Ok(false)`) or
+    /// engaged it and reported the fault (`Err(Transport)`) — but NEVER claims a
+    /// dead bus as unlocked, and NEVER surfaces a non-`Transport` hard error.
+    /// This is the guardrail that was missing: it holds the next new unlocker to
+    /// the same discipline the loop relies on.
+    #[test]
+    fn no_unlocker_claims_a_dead_bus_or_hard_errors() {
+        let id = DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Aacs);
+        for u in canonical_unlockers() {
+            let name = u.name();
+            let mut t = scsi::mock::MockTransport::always(scsi::mock::Reply::TransportFault);
+            match u.unlock(&mut t, &ctx) {
+                Ok(None) => {}                    // declined before touching — fine
+                Err(UnlockError::Transport) => {} // engaged, dead bus — fine
+                other => panic!("{name} violated the dead-bus contract: {other:?}"),
+            }
+        }
+    }
+
+    /// `unlocker_name` is a PURE lookup — it must answer from the `DriveId`
+    /// alone, and only the identity-keyed unlocker can claim a drive this way.
+    #[test]
+    fn unlocker_name_is_a_pure_identity_lookup() {
+        assert_eq!(unlocker_name(&DriveId::default()), None);
+    }
+
+    // `bus_key`/`vid` are key material; `Debug` must NOT print those bytes.
+    // MUTATION: restoring `#[derive(Debug)]` prints the raw byte arrays, so
+    // the marker bytes appear in the output and this test goes red.
+    #[test]
+    fn unlocked_debug_redacts_key_material() {
+        let u = Unlocked {
+            vid: Some([0xAB; 16]),
+            bus_key: Some([0xCD; 16]),
+        };
+        let s = format!("{u:?}");
+        // A derived Debug renders `[171, 171, ...]` (0xAB) / `[205, ...]` (0xCD).
+        assert!(!s.contains("171"), "vid bytes must not appear: {s}");
+        assert!(!s.contains("205"), "bus_key bytes must not appear: {s}");
+        assert!(s.contains("[redacted]"), "must mark redaction: {s}");
+        // Presence (Some/None) stays observable.
+        assert!(s.contains("Some"), "must still show a key WAS present: {s}");
+    }
+
+    // `private_key`/`private_key_v2` are the raw host private keys; `Debug` must
+    // NOT print those bytes. Restoring `#[derive(Debug)]` renders the byte
+    // arrays (e.g. 0xAB → 171 / 0xCD → 205), turning this test red.
+    #[test]
+    fn host_cert_debug_redacts_private_keys() {
+        let c = HostCert {
+            private_key: [0xAB; 20],
+            certificate: vec![0x01, 0x02],
+            private_key_v2: Some([0xCD; 32]),
+            certificate_v2: None,
+        };
+        let s = format!("{c:?}");
+        assert!(!s.contains("171"), "private_key bytes must not appear: {s}");
+        assert!(
+            !s.contains("205"),
+            "private_key_v2 bytes must not appear: {s}"
+        );
+        assert!(s.contains("[redacted]"), "must mark redaction: {s}");
+        // Presence of the v2 key stays observable.
+        assert!(
+            s.contains("Some"),
+            "must still show the v2 key WAS present: {s}"
+        );
+    }
 }

src/renesas/mod.rs

@@ -0,0 +1,443 @@
+//! renesas — Renesas-platform detection (Pioneer + HL-DT-ST Renesas drives).
+//!
+//! Optical drives split into two controller families: MediaTek (handled by
+//! [`crate::ld`]) and Renesas. This module identifies the Renesas side via a
+//! single vendor identity probe (see [`is_renesas`]) and reports the match so a
+//! Renesas drive is named honestly. It does not modify drive state; AACS bus
+//! decryption is handled by the host cert.
+
+use crate::scsi::{DataDirection, ScsiTransport};
+use crate::{UnlockCtx, UnlockError, Unlocked, Unlocker};
+
+/// READ_BUFFER mode 0x02, buffer 0xF1 — the Renesas vendor identity buffer.
+const RB_F1_CDB: [u8; 10] = [0x3C, 0x02, 0xF1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00];
+const RB_F1_LEN: usize = 48;
+/// The ASCII interface marker a Renesas controller returns at `[16..19]`.
+const RENESAS_MARKER: &[u8] = b"SAT";
+const RENESAS_MARKER_OFFSET: usize = 16;
+
+/// `Ok(true)` if `scsi` is a Renesas-platform drive (Pioneer or HL-DT-ST
+/// Renesas).
+///
+/// Issues the vendor READ_BUFFER 0x02/0xF1 probe: a Renesas controller serves
+/// a 48-byte identity block whose bytes `[16..19]` are the ASCII `SAT`
+/// interface tag. A rejection (CHECK CONDITION or `Err` with a sense) is
+/// `Ok(false)`: not a Renesas drive.
+///
+/// `Err(Transport)` on a dead bus. See docs/renesas-mod.md for why a
+/// transport fault must not be folded into `Ok(false)`.
+pub fn is_renesas(scsi: &mut dyn ScsiTransport) -> std::result::Result<bool, UnlockError> {
+    let mut buf = [0u8; RB_F1_LEN];
+    match scsi.execute(&RB_F1_CDB, DataDirection::FromDevice, &mut buf, 5_000) {
+        Ok(r) => {
+            let end = RENESAS_MARKER_OFFSET + RENESAS_MARKER.len();
+            Ok(r.status == 0
+                && r.bytes_transferred >= end
+                && &buf[RENESAS_MARKER_OFFSET..end] == RENESAS_MARKER)
+        }
+        // Only a senseless transport-failure status is a dead bus; anything
+        // else the transport reports as `Err` is the drive refusing.
+        Err(e) => {
+            if e.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE && e.sense.is_none() {
+                tracing::warn!(
+                    target: "freemkv::disc",
+                    phase = "renesas_probe_transport_fault",
+                    "transport fault on the Renesas identity probe; aborting"
+                );
+                return Err(UnlockError::Transport);
+            }
+            tracing::debug!(
+                target: "freemkv::disc",
+                phase = "renesas_probe_rejected",
+                status = e.status,
+                "Renesas identity probe rejected by the drive; not a Renesas platform"
+            );
+            Ok(false)
+        }
+    }
+}
+
+/// The Renesas/Pioneer-platform unlocker. Its vendor "open" CDB puts the drive
+/// in the same raw-read / extended-access state the firmware routes reach (this
+/// is what MakeMKV's LibreDrive does on stock Pioneer firmware), so the Volume
+/// ID is then read with the SAME standard `0xAD` reader as freemkv/MT1959 — no
+/// host cert, no AKE. Stateless: `unlock()` returns what it learned.
+#[derive(Default)]
+pub struct Renesas;
+
+impl Renesas {
+    pub fn new() -> Self {
+        Renesas
+    }
+
+    // MakeMKV's vendor "open" sequence: primary read (A), and on refusal a
+    // knock + second read (B). See docs/renesas-mod.md for the full sequence
+    // and why we run A→knock→B rather than bailing after A.
+    fn vendor_open(scsi: &mut dyn ScsiTransport) -> std::result::Result<bool, UnlockError> {
+        const RB_B0_04_CDB: [u8; 10] = [0x3C, 0x02, 0xB0, 0x00, 0x00, 0x04, 0x00, 0x00, 0xA4, 0x00];
+        const KNOCK_A5AAAA_CDB: [u8; 10] =
+            [0x3B, 0x02, 0x41, 0xA5, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00];
+        const RB_B0_500000_CDB: [u8; 10] =
+            [0x3C, 0x02, 0xB0, 0x50, 0x00, 0x00, 0x00, 0x00, 0xA4, 0x00];
+
+        // A: primary open read.
+        if read_is_good(scsi, &RB_B0_04_CDB)? {
+            return Ok(true);
+        }
+        // B: MakeMKV's fallback — knock, then the second-window read. The knock is
+        // fire-and-forget (payload-less); its own status is not the signal.
+        match scsi.execute(&KNOCK_A5AAAA_CDB, DataDirection::None, &mut [], 5_000) {
+            Ok(_) => {}
+            Err(e)
+                if e.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE && e.sense.is_none() =>
+            {
+                return Err(UnlockError::Transport);
+            }
+            Err(_) => {} // a drive that refuses the knock still gets the B read tried
+        }
+        read_is_good(scsi, &RB_B0_500000_CDB)
+    }
+}
+
+/// Issue a 164-byte vendor READ_BUFFER; `Ok(true)` on GOOD status, `Ok(false)`
+/// on CHECK CONDITION (drive refused), `Err(Transport)` on a senseless
+/// transport failure (dead bus).
+fn read_is_good(
+    scsi: &mut dyn ScsiTransport,
+    cdb: &[u8; 10],
+) -> std::result::Result<bool, UnlockError> {
+    let mut buf = [0u8; 164];
+    match scsi.execute(cdb, DataDirection::FromDevice, &mut buf, 5_000) {
+        Ok(r) => Ok(r.status == 0),
+        Err(e) => {
+            if e.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE && e.sense.is_none() {
+                return Err(UnlockError::Transport);
+            }
+            Ok(false)
+        }
+    }
+}
+
+impl Unlocker for Renesas {
+    fn name(&self) -> &'static str {
+        "Renesas"
+    }
+
+    /// Gate on the `0xF1` SAT identity, then the vendor open read `0xB0@0x04`
+    /// (LOAD-BEARING — it's the unlock), then read the Volume ID with the shared
+    /// best-effort `0xAD` reader. `Some` once the open succeeds — the drive
+    /// serves clear content whether or not the bonus VID read did; `None` if it
+    /// isn't a Renesas drive or the open is refused; `Err(Transport)` on a dead
+    /// bus. See docs/renesas-mod.md for the MakeMKV-parity rationale.
+    fn unlock(
+        &self,
+        scsi: &mut dyn ScsiTransport,
+        _ctx: &UnlockCtx,
+    ) -> std::result::Result<Option<Unlocked>, UnlockError> {
+        if !is_renesas(scsi)? {
+            return Ok(None);
+        }
+        if !Self::vendor_open(scsi)? {
+            tracing::debug!(
+                target: "freemkv::disc",
+                phase = "renesas_open_rejected",
+                "Renesas drive recognized but RB 0xB0@0x04 refused; deferring to next unlocker"
+            );
+            return Ok(None);
+        }
+        // The open enabled raw reads (extended-access) — read the VID exactly as
+        // the firmware routes do. Best-effort: a VID miss must not discard the
+        // unlock (only a dead bus propagates via `?`).
+        let vid = crate::vid::read_aacs_vid(scsi)?;
+        tracing::debug!(
+            target: "freemkv::disc",
+            phase = "renesas_opened",
+            has_vid = vid.is_some(),
+            "Renesas drive opened (RB 0xB0@0x04 GOOD, raw reads enabled)"
+        );
+        Ok(Some(Unlocked { vid, bus_key: None }))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::DiscKind;
+    use crate::scsi::{DataDirection, Result, ScsiError, ScsiResult, ScsiTransport};
+
+    /// Serves a fixed READ_BUFFER payload (Renesas-like) with a Good status.
+    struct RenesasTransport {
+        payload: Vec<u8>,
+    }
+    impl ScsiTransport for RenesasTransport {
+        fn execute(
+            &mut self,
+            _cdb: &[u8],
+            _dir: DataDirection,
+            data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> Result<ScsiResult> {
+            let n = self.payload.len().min(data.len());
+            data[..n].copy_from_slice(&self.payload[..n]);
+            Ok(ScsiResult {
+                status: 0,
+                bytes_transferred: n,
+                sense: [0u8; 32],
+            })
+        }
+    }
+
+    // Rejects like a MediaTek drive: ILLEGAL REQUEST with a sense, which is
+    // what distinguishes this from a dead bus. See docs/renesas-mod.md.
+    struct RejectingTransport;
+    impl ScsiTransport for RejectingTransport {
+        fn execute(
+            &mut self,
+            _cdb: &[u8],
+            _dir: DataDirection,
+            _data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> Result<ScsiResult> {
+            let mut sense = [0u8; 32];
+            sense[2] = 0x05; // ILLEGAL REQUEST
+            sense[12] = 0x20; // invalid command operation code
+            Err(ScsiError {
+                status: crate::scsi::SCSI_STATUS_CHECK_CONDITION,
+                sense: Some(sense),
+            })
+        }
+    }
+
+    fn renesas_payload() -> Vec<u8> {
+        // 48-byte RB 0xF1 block with "SAT" at [16..19] (the real S13JX shape).
+        let mut p = vec![0x20u8; 48];
+        p[16..19].copy_from_slice(b"SAT");
+        p
+    }
+
+    #[test]
+    fn is_renesas_true_on_sat_marker() {
+        let mut t = RenesasTransport {
+            payload: renesas_payload(),
+        };
+        assert!(is_renesas(&mut t).expect("no transport fault"));
+    }
+
+    #[test]
+    fn is_renesas_false_when_command_rejected() {
+        let mut t = RejectingTransport;
+        assert!(!is_renesas(&mut t).expect("a drive rejection is not a bus fault"));
+    }
+
+    #[test]
+    fn is_renesas_false_on_missing_marker() {
+        // Good status but no "SAT" at [16..19] (e.g. a stray buffer).
+        let mut t = RenesasTransport {
+            payload: vec![0u8; 48],
+        };
+        assert!(!is_renesas(&mut t).expect("no transport fault"));
+    }
+
+    #[test]
+    fn is_renesas_false_on_short_response() {
+        // Fewer than 19 bytes returned — can't carry the marker.
+        let mut t = RenesasTransport {
+            payload: vec![0x20u8; 8],
+        };
+        assert!(!is_renesas(&mut t).expect("no transport fault"));
+    }
+
+    #[test]
+    fn opened_renesas_reports_unlocked_and_reads_vid() {
+        let mut t = RenesasTransport {
+            payload: renesas_payload(),
+        };
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Unknown);
+        // Recognized + vendor-open GOOD → unlocked; the open enables raw reads,
+        // so the standard 0xAD VID read returns a (non-zero) VID best-effort.
+        let out = Renesas::new()
+            .unlock(&mut t, &ctx)
+            .expect("no fault")
+            .expect("renesas → unlocked");
+        assert!(out.vid.is_some(), "opened drive yields a VID via 0xAD");
+        assert_eq!(out.bus_key, None, "raw-read route needs no bus key");
+    }
+
+    /// A drive REJECTION (ILLEGAL REQUEST, with a sense) is "not a Renesas
+    /// drive" → `Ok(false)`, fall through to the next unlocker.
+    #[test]
+    fn declines_non_renesas() {
+        let mut t = RejectingTransport;
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Unknown);
+        assert!(
+            Renesas::new()
+                .unlock(&mut t, &ctx)
+                .expect("non-renesas declines")
+                .is_none()
+        );
+    }
+
+    // Same rejection via a CONFORMING transport (`Ok` + CHECK CONDITION);
+    // must reach the same answer. See docs/renesas-mod.md.
+    #[test]
+    fn check_condition_is_not_a_renesas_drive() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::illegal_request());
+        assert!(!is_renesas(&mut t).expect("a drive sense is not a bus fault"));
+    }
+
+    /// THE defect-8 test: a dead bus on the FIRST command the unlocker issues
+    /// must abort the consumer, not be reported as "not a Renesas drive".
+    /// Catches restoring the `Err(_) => false` arm.
+    #[test]
+    fn transport_fault_aborts_instead_of_declining() {
+        use crate::scsi::mock::{MockTransport, Reply};
+        let mut t = MockTransport::always(Reply::TransportFault);
+        assert_eq!(is_renesas(&mut t).unwrap_err(), UnlockError::Transport);
+
+        let mut t = MockTransport::always(Reply::TransportFault);
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Unknown);
+        assert_eq!(
+            Renesas::new().unlock(&mut t, &ctx).unwrap_err(),
+            UnlockError::Transport
+        );
+    }
+
+    // A recognized Renesas drive whose A read (RB 0xB0@0x04) is REFUSED but
+    // whose B read (RB 0xB0@0x50) SUCCEEDS after the knock must unlock — and the
+    // knock CDB has to be issued BETWEEN A and B. See docs/renesas-mod.md.
+    #[test]
+    fn knock_runs_between_a_and_b_and_b_opens() {
+        // The exact knock CDB the code issues (pinned wire format).
+        const KNOCK_A5AAAA_CDB: [u8; 10] =
+            [0x3B, 0x02, 0x41, 0xA5, 0xAA, 0xAA, 0x00, 0x00, 0x00, 0x00];
+
+        struct AFailsBSucceeds {
+            cdbs: Vec<Vec<u8>>,
+        }
+        impl ScsiTransport for AFailsBSucceeds {
+            fn execute(
+                &mut self,
+                cdb: &[u8],
+                _dir: DataDirection,
+                data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> Result<ScsiResult> {
+                self.cdbs.push(cdb.to_vec());
+                // Gate 0xF1 → SAT identity.
+                if cdb.get(2) == Some(&0xF1) {
+                    let p = renesas_payload();
+                    let n = p.len().min(data.len());
+                    data[..n].copy_from_slice(&p[..n]);
+                    return Ok(ScsiResult {
+                        status: 0,
+                        bytes_transferred: n,
+                        sense: [0u8; 32],
+                    });
+                }
+                // A read (RB 0xB0@0x04) → refuse with a drive sense.
+                if cdb.get(2) == Some(&0xB0) && cdb.get(3) == Some(&0x00) {
+                    let mut sense = [0u8; 32];
+                    sense[2] = 0x05; // ILLEGAL REQUEST
+                    sense[12] = 0x20;
+                    return Err(ScsiError {
+                        status: crate::scsi::SCSI_STATUS_CHECK_CONDITION,
+                        sense: Some(sense),
+                    });
+                }
+                // B read (RB 0xB0@0x50), the knock (0x3B/0x41), and the 0xAD VID
+                // read all return GOOD so the open + VID read succeed.
+                let n = data.len().min(36);
+                if !data.is_empty() {
+                    // Non-zero VID so read_aacs_vid yields Some.
+                    for b in data.iter_mut().take(n) {
+                        *b = 0x5A;
+                    }
+                }
+                Ok(ScsiResult {
+                    status: 0,
+                    bytes_transferred: data.len(),
+                    sense: [0u8; 32],
+                })
+            }
+        }
+
+        let mut t = AFailsBSucceeds { cdbs: Vec::new() };
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Unknown);
+        let out = Renesas::new()
+            .unlock(&mut t, &ctx)
+            .expect("no fault")
+            .expect("B read opens the drive → unlocked");
+        assert_eq!(out.bus_key, None);
+
+        // The knock must appear, between the A read (0xB0@0x04) and the B read
+        // (0xB0@0x50).
+        let a = t
+            .cdbs
+            .iter()
+            .position(|c| c.get(2) == Some(&0xB0) && c.get(3) == Some(&0x00))
+            .expect("A read issued");
+        let knock = t
+            .cdbs
+            .iter()
+            .position(|c| c.as_slice() == KNOCK_A5AAAA_CDB)
+            .expect("knock CDB issued");
+        let b = t
+            .cdbs
+            .iter()
+            .position(|c| c.get(2) == Some(&0xB0) && c.get(3) == Some(&0x50))
+            .expect("B read issued");
+        assert!(a < knock && knock < b, "knock must run between A and B");
+    }
+
+    // A recognized Renesas drive that REFUSES the vendor open read must
+    // defer to the next unlocker, not claim the drive. See docs/renesas-mod.md.
+    #[test]
+    fn open_rejection_defers_to_next_unlocker() {
+        struct GateOkOpenRefused;
+        impl ScsiTransport for GateOkOpenRefused {
+            fn execute(
+                &mut self,
+                cdb: &[u8],
+                _dir: DataDirection,
+                data: &mut [u8],
+                _timeout_ms: u32,
+            ) -> Result<ScsiResult> {
+                if cdb.get(2) == Some(&0xF1) {
+                    // Serve the SAT identity so is_renesas() matches.
+                    let p = renesas_payload();
+                    let n = p.len().min(data.len());
+                    data[..n].copy_from_slice(&p[..n]);
+                    Ok(ScsiResult {
+                        status: 0,
+                        bytes_transferred: n,
+                        sense: [0u8; 32],
+                    })
+                } else {
+                    // RB 0xB0@0x04 (the open read) → CHECK CONDITION.
+                    let mut sense = [0u8; 32];
+                    sense[2] = 0x05; // ILLEGAL REQUEST
+                    sense[12] = 0x20; // invalid command operation code
+                    Err(ScsiError {
+                        status: crate::scsi::SCSI_STATUS_CHECK_CONDITION,
+                        sense: Some(sense),
+                    })
+                }
+            }
+        }
+        let mut t = GateOkOpenRefused;
+        let id = crate::DriveId::default();
+        let ctx = UnlockCtx::new(&id, DiscKind::Unknown);
+        assert!(
+            Renesas::new()
+                .unlock(&mut t, &ctx)
+                .expect("open refused → declines, not a hard error")
+                .is_none(),
+            "a refused vendor open must defer to the next unlocker"
+        );
+    }
+}

src/renesis.rs

@@ -1,202 +0,0 @@
-//! renesis — Renesas-platform detection (Pioneer + HL-DT-ST Renesas drives).
-//!
-//! Optical drives split into two controller families: MediaTek (handled by
-//! [`crate::ld`]) and Renesas. This module identifies the Renesas side via a
-//! single vendor identity probe (see [`is_renesas`]) and reports the match so a
-//! Renesas drive is named honestly. It does not modify drive state; AACS bus
-//! decryption is handled by the host cert.
-
-use crate::scsi::{DataDirection, ScsiTransport};
-use crate::{UnlockCtx, UnlockError, Unlocked, Unlocker};
-
-/// READ_BUFFER mode 0x02, buffer 0xF1 — the Renesas vendor identity buffer.
-const RB_F1_CDB: [u8; 10] = [0x3C, 0x02, 0xF1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x00];
-const RB_F1_LEN: usize = 48;
-/// The ASCII interface marker a Renesas controller returns at `[16..19]`.
-const RENESAS_MARKER: &[u8] = b"SAT";
-const RENESAS_MARKER_OFFSET: usize = 16;
-
-/// True if `scsi` is a Renesas-platform drive (Pioneer or HL-DT-ST Renesas).
-///
-/// Issues the vendor READ_BUFFER 0x02/0xF1 probe: a Renesas controller serves a
-/// 48-byte identity block whose bytes `[16..19]` are the ASCII `SAT` interface
-/// tag. A MediaTek drive rejects it (ILLEGAL REQUEST → `Err`), and a transport
-/// fault also yields `Err`; both return `false`. This is the definitive
-/// Renesas-vs-MediaTek split.
-pub fn is_renesas(scsi: &mut dyn ScsiTransport) -> bool {
-    let mut buf = [0u8; RB_F1_LEN];
-    match scsi.execute(&RB_F1_CDB, DataDirection::FromDevice, &mut buf, 5_000) {
-        Ok(r) => {
-            let end = RENESAS_MARKER_OFFSET + RENESAS_MARKER.len();
-            r.status == 0
-                && r.bytes_transferred >= end
-                && &buf[RENESAS_MARKER_OFFSET..end] == RENESAS_MARKER
-        }
-        Err(_) => false,
-    }
-}
-
-/// The Renesas-platform unlocker. `pub(crate)` — reached only through
-/// [`crate::all_unlockers`].
-pub(crate) struct Renesis;
-
-impl Renesis {
-    pub(crate) fn new() -> Self {
-        Renesis
-    }
-}
-
-impl Unlocker for Renesis {
-    fn name(&self) -> &'static str {
-        "Renesas"
-    }
-
-    /// Report whether the drive is a Renesas platform. On a match, returns `Ok`
-    /// with `drive_unlocked: false` — the drive is recognized but its state is
-    /// not modified here (AACS bus decryption is handled by the host cert). A
-    /// non-Renesas drive → `NotApplicable`.
-    fn unlock_features(
-        &self,
-        scsi: &mut dyn ScsiTransport,
-        _ctx: &UnlockCtx,
-    ) -> std::result::Result<Unlocked, UnlockError> {
-        if !is_renesas(scsi) {
-            return Err(UnlockError::NotApplicable);
-        }
-        tracing::debug!(
-            target: "freemkv::disc",
-            phase = "renesas_recognized",
-            "Renesas drive recognized; bus handled by cert"
-        );
-        Ok(Unlocked {
-            vid: None,
-            bus_key: None,
-            drive_unlocked: false,
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::DiscKind;
-    use crate::scsi::{DataDirection, Result, ScsiError, ScsiResult, ScsiTransport};
-
-    /// Serves a fixed READ_BUFFER payload (Renesas-like) with a Good status.
-    struct RenesasTransport {
-        payload: Vec<u8>,
-    }
-    impl ScsiTransport for RenesasTransport {
-        fn execute(
-            &mut self,
-            _cdb: &[u8],
-            _dir: DataDirection,
-            data: &mut [u8],
-            _timeout_ms: u32,
-        ) -> Result<ScsiResult> {
-            let n = self.payload.len().min(data.len());
-            data[..n].copy_from_slice(&self.payload[..n]);
-            Ok(ScsiResult {
-                status: 0,
-                bytes_transferred: n,
-                sense: [0u8; 32],
-            })
-        }
-    }
-
-    /// Rejects the command (a MediaTek drive → ILLEGAL REQUEST → transport `Err`).
-    struct RejectingTransport;
-    impl ScsiTransport for RejectingTransport {
-        fn execute(
-            &mut self,
-            _cdb: &[u8],
-            _dir: DataDirection,
-            _data: &mut [u8],
-            _timeout_ms: u32,
-        ) -> Result<ScsiResult> {
-            Err(ScsiError {
-                status: crate::scsi::SCSI_STATUS_CHECK_CONDITION,
-                sense: None,
-            })
-        }
-    }
-
-    fn renesas_payload() -> Vec<u8> {
-        // 48-byte RB 0xF1 block with "SAT" at [16..19] (the real S13JX shape).
-        let mut p = vec![0x20u8; 48];
-        p[16..19].copy_from_slice(b"SAT");
-        p
-    }
-
-    #[test]
-    fn is_renesas_true_on_sat_marker() {
-        let mut t = RenesasTransport {
-            payload: renesas_payload(),
-        };
-        assert!(is_renesas(&mut t));
-    }
-
-    #[test]
-    fn is_renesas_false_when_command_rejected() {
-        let mut t = RejectingTransport;
-        assert!(!is_renesas(&mut t));
-    }
-
-    #[test]
-    fn is_renesas_false_on_missing_marker() {
-        // Good status but no "SAT" at [16..19] (e.g. a stray buffer).
-        let mut t = RenesasTransport {
-            payload: vec![0u8; 48],
-        };
-        assert!(!is_renesas(&mut t));
-    }
-
-    #[test]
-    fn is_renesas_false_on_short_response() {
-        // Fewer than 19 bytes returned — can't carry the marker.
-        let mut t = RenesasTransport {
-            payload: vec![0x20u8; 8],
-        };
-        assert!(!is_renesas(&mut t));
-    }
-
-    #[test]
-    fn features_report_match_without_bus_removal_on_renesas() {
-        let mut t = RenesasTransport {
-            payload: renesas_payload(),
-        };
-        let id = crate::DriveId::default();
-        let ctx = UnlockCtx::new(&id, DiscKind::Unknown, &[]);
-        // Recognized → Ok, but a feature-only unlock: bus NOT removed, no VID.
-        let u = Renesis::new()
-            .unlock_features(&mut t, &ctx)
-            .expect("renesas → Ok");
-        assert!(
-            !u.drive_unlocked,
-            "renesis does not remove the bus (cert does)"
-        );
-        assert_eq!(u.vid, None);
-        assert_eq!(u.bus_key, None);
-    }
-
-    #[test]
-    fn features_not_applicable_on_non_renesas() {
-        let mut t = RejectingTransport;
-        let id = crate::DriveId::default();
-        let ctx = UnlockCtx::new(&id, DiscKind::Unknown, &[]);
-        let err = Renesis::new().unlock_features(&mut t, &ctx).unwrap_err();
-        assert_eq!(err, UnlockError::NotApplicable);
-    }
-
-    #[test]
-    fn does_not_provide_bus_removal() {
-        // Renesas leaves bus encryption to the cert: unlock_bus is the default.
-        let mut t = RenesasTransport {
-            payload: renesas_payload(),
-        };
-        let id = crate::DriveId::default();
-        let ctx = UnlockCtx::new(&id, DiscKind::Aacs, &[]);
-        let err = Renesis::new().unlock_bus(&mut t, &ctx).unwrap_err();
-        assert_eq!(err, UnlockError::NotApplicable);
-    }
-}

src/scsi.rs

@@ -98,3 +98,263 @@ pub(crate) fn build_set_cd_speed(read_speed: u16) -> [u8; 12] {
         0x00,
     ]
 }
+
+// ── Test fixture ────────────────────────────────────────────────────────────
+// Crate-wide mock transport, able to express all three transport outcomes.
+// See docs/scsi-mock-fixture.md — why this fixture exists
+#[cfg(test)]
+#[allow(dead_code)] // a fixture: each helper is used by a subset of the modules
+pub(crate) mod mock {
+    use super::*;
+    use std::collections::VecDeque;
+
+    /// One scripted answer to one `execute()` call.
+    #[derive(Debug, Clone)]
+    pub(crate) enum Reply {
+        /// `Ok` + GOOD status. `payload` is copied into the caller's buffer;
+        /// `bytes_transferred` defaults to the number of bytes copied.
+        Data {
+            payload: Vec<u8>,
+            bytes_transferred: Option<usize>,
+        },
+        /// `Ok` + a NON-ZERO SCSI status (CHECK CONDITION) with a drive sense.
+        /// Per the contract at [`ScsiTransport::execute`] this is NOT a
+        /// transport fault — the caller must inspect `status`, and a caller that
+        /// doesn't will consume the caller's zero-filled buffer as drive data.
+        Sense {
+            status: u8,
+            sense_key: u8,
+            asc: u8,
+            ascq: u8,
+        },
+        /// `Err` with the transport-failure status and no sense — a genuine
+        /// transport-layer fault (bridge crash / disconnect). MUST abort.
+        TransportFault,
+        /// `Err` carrying a real status + parsed sense. This is what a
+        /// NON-conforming transport does (libfreemkv's adapter returns `Err` for
+        /// any non-zero SCSI status); classification must still treat it as a
+        /// drive rejection, not a dead bus.
+        ErrWithSense {
+            status: u8,
+            sense_key: u8,
+            asc: u8,
+            ascq: u8,
+        },
+    }
+
+    impl Reply {
+        /// `Ok`, GOOD status, full transfer of `payload`.
+        pub(crate) fn good(payload: Vec<u8>) -> Reply {
+            Reply::Data {
+                payload,
+                bytes_transferred: None,
+            }
+        }
+        /// `Ok`, GOOD status, but the drive only delivered `n` bytes.
+        pub(crate) fn short(payload: Vec<u8>, n: usize) -> Reply {
+            Reply::Data {
+                payload,
+                bytes_transferred: Some(n),
+            }
+        }
+        /// `Ok`, GOOD status, ZERO bytes delivered — the buffer the caller reads
+        /// is entirely its own zero fill.
+        pub(crate) fn zero_transfer(len: usize) -> Reply {
+            Reply::Data {
+                payload: vec![0u8; len],
+                bytes_transferred: Some(0),
+            }
+        }
+        /// `Ok` + CHECK CONDITION / ILLEGAL REQUEST (0x05, ASC 0x20 invalid
+        /// command) — the ordinary way a drive refuses a vendor command.
+        pub(crate) fn illegal_request() -> Reply {
+            Reply::Sense {
+                status: SCSI_STATUS_CHECK_CONDITION,
+                sense_key: 0x05,
+                asc: 0x20,
+                ascq: 0x00,
+            }
+        }
+        /// `Err` + CHECK CONDITION / ILLEGAL REQUEST — the same drive refusal as
+        /// seen through a non-conforming transport.
+        pub(crate) fn illegal_request_as_err() -> Reply {
+            Reply::ErrWithSense {
+                status: SCSI_STATUS_CHECK_CONDITION,
+                sense_key: 0x05,
+                asc: 0x20,
+                ascq: 0x00,
+            }
+        }
+    }
+
+    fn sense_buf(sense_key: u8, asc: u8, ascq: u8) -> [u8; 32] {
+        let mut b = [0u8; 32];
+        b[2] = sense_key & 0x0F;
+        b[12] = asc;
+        b[13] = ascq;
+        b
+    }
+
+    /// A scripted transport: answers each `execute()` from `script`, falling
+    /// back to `default` once the script runs out, and records every CDB.
+    pub(crate) struct MockTransport {
+        pub(crate) script: VecDeque<Reply>,
+        pub(crate) default: Reply,
+        pub(crate) cdbs: Vec<Vec<u8>>,
+    }
+
+    impl MockTransport {
+        /// Every command gets the same answer.
+        pub(crate) fn always(reply: Reply) -> Self {
+            MockTransport {
+                script: VecDeque::new(),
+                default: reply,
+                cdbs: Vec::new(),
+            }
+        }
+        /// The first N commands follow `script`; the rest get `default`.
+        pub(crate) fn scripted(script: Vec<Reply>, default: Reply) -> Self {
+            MockTransport {
+                script: script.into(),
+                default,
+                cdbs: Vec::new(),
+            }
+        }
+        /// How many CDBs were issued (lets a test assert a dead bus aborted
+        /// instead of retrying).
+        pub(crate) fn calls(&self) -> usize {
+            self.cdbs.len()
+        }
+    }
+
+    impl ScsiTransport for MockTransport {
+        fn execute(
+            &mut self,
+            cdb: &[u8],
+            _direction: DataDirection,
+            data: &mut [u8],
+            _timeout_ms: u32,
+        ) -> Result<ScsiResult> {
+            self.cdbs.push(cdb.to_vec());
+            let reply = self
+                .script
+                .pop_front()
+                .unwrap_or_else(|| self.default.clone());
+            match reply {
+                Reply::Data {
+                    payload,
+                    bytes_transferred,
+                } => {
+                    let n = payload.len().min(data.len());
+                    data[..n].copy_from_slice(&payload[..n]);
+                    Ok(ScsiResult {
+                        status: 0,
+                        bytes_transferred: bytes_transferred.unwrap_or(n),
+                        sense: [0u8; 32],
+                    })
+                }
+                Reply::Sense {
+                    status,
+                    sense_key,
+                    asc,
+                    ascq,
+                } => Ok(ScsiResult {
+                    status,
+                    bytes_transferred: 0,
+                    sense: sense_buf(sense_key, asc, ascq),
+                }),
+                Reply::TransportFault => Err(ScsiError {
+                    status: SCSI_STATUS_TRANSPORT_FAILURE,
+                    sense: None,
+                }),
+                Reply::ErrWithSense {
+                    status,
+                    sense_key,
+                    asc,
+                    ascq,
+                } => Err(ScsiError {
+                    status,
+                    sense: Some(sense_buf(sense_key, asc, ascq)),
+                }),
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use mock::{MockTransport, Reply};
+
+    /// The fixed-format sense layout the whole crate reads its diagnostics off
+    /// (key at byte 2 low nibble, ASC at 12, ASCQ at 13). This file had no test
+    /// at all, so nothing pinned the offsets.
+    #[test]
+    fn sense_parses_at_the_fixed_format_offsets() {
+        let mut buf = [0u8; 32];
+        buf[2] = 0xF5; // sense key is the LOW nibble only
+        buf[12] = 0x24;
+        buf[13] = 0x01;
+        let s = ScsiSense::from_buf(&buf);
+        assert_eq!(s.sense_key, 0x05);
+        assert_eq!(s.asc, 0x24);
+        assert_eq!(s.ascq, 0x01);
+        assert!(s.is_illegal_request());
+
+        buf[2] = 0x02; // NOT READY
+        assert!(!ScsiSense::from_buf(&buf).is_illegal_request());
+    }
+
+    /// SET CD SPEED encodes the read speed big-endian at bytes 2-3 and leaves
+    /// the write speed at 0xFFFF.
+    #[test]
+    fn set_cd_speed_encodes_the_read_speed_big_endian() {
+        let cdb = build_set_cd_speed(0x1234);
+        assert_eq!(cdb[0], SCSI_SET_CD_SPEED);
+        assert_eq!([cdb[2], cdb[3]], [0x12, 0x34]);
+        assert_eq!([cdb[4], cdb[5]], [0xFF, 0xFF]);
+        assert_eq!(build_set_cd_speed(0xFFFF)[2..4], [0xFF, 0xFF]);
+    }
+
+    // The fixture must honour the contract it tests: a drive sense is `Ok`
+    // with non-zero status, a bus fault is `Err`. If this drifts, every
+    // transport-contract test built on it silently stops testing anything.
+    #[test]
+    fn mock_transport_expresses_the_three_contract_outcomes() {
+        let mut t = MockTransport::scripted(
+            vec![
+                Reply::good(vec![0xAB; 4]),
+                Reply::illegal_request(),
+                Reply::zero_transfer(4),
+            ],
+            Reply::TransportFault,
+        );
+        let mut buf = [0u8; 4];
+
+        let r = t
+            .execute(&[0x3C], DataDirection::FromDevice, &mut buf, 0)
+            .expect("data reply is Ok");
+        assert_eq!(r.status, 0);
+        assert_eq!(r.bytes_transferred, 4);
+        assert_eq!(buf, [0xAB; 4]);
+
+        let r = t
+            .execute(&[0x3C], DataDirection::FromDevice, &mut buf, 0)
+            .expect("A DRIVE SENSE IS Ok, NOT Err — the load-bearing contract");
+        assert_eq!(r.status, SCSI_STATUS_CHECK_CONDITION);
+        assert!(ScsiSense::from_buf(&r.sense).is_illegal_request());
+
+        let r = t
+            .execute(&[0x3C], DataDirection::FromDevice, &mut buf, 0)
+            .expect("a zero-length transfer is still Ok");
+        assert_eq!(r.bytes_transferred, 0);
+
+        let e = t
+            .execute(&[0x3C], DataDirection::FromDevice, &mut buf, 0)
+            .expect_err("a transport fault is Err");
+        assert_eq!(e.status, SCSI_STATUS_TRANSPORT_FAILURE);
+        assert!(e.sense.is_none(), "a bus fault carries no drive sense");
+
+        assert_eq!(t.calls(), 4);
+    }
+}

src/vid.rs

@@ -0,0 +1,193 @@
+//! Shared AACS Volume ID read — the standard `READ DISC STRUCTURE` (`0xAD`,
+//! format `0x80`) that returns the VID on a drive whose host-auth / bus has
+//! already been opened by a firmware or vendor CDB unlock (freemkv Raw Read,
+//! MT1959, or a Pioneer/Renesas vendor open). Because those routes put the
+//! drive in the same raw-read state, the VID read is identical across them — so
+//! it lives here once.
+//!
+//! BEST-EFFORT: only a dead bus is an `Err(Transport)`. A CHECK CONDITION, a
+//! short response, or an all-zero VID all yield `Ok(None)` — a VID miss must
+//! never discard an unlock that already removed the bus (a key source can still
+//! supply the key). See docs/freemkv-abi.md for the fixed-length reply rules.
+
+use crate::UnlockError;
+use crate::scsi::{DataDirection, ScsiTransport};
+
+/// The 16-byte AACS Volume ID.
+const VID_LEN: usize = 16;
+/// `READ DISC STRUCTURE` format for the Volume ID.
+const DISC_STRUCT_FMT_VID: u8 = 0x80;
+/// Response length: a 4-byte header, the 16-byte VID, and a 16-byte MAC. On the
+/// bare-read path (no bus key) the MAC can't be verified and is ignored.
+const VID_STRUCT_LEN: u16 = 36;
+
+/// The standard `0xAD` fmt-`0x80` (Blu-ray, AGID 0) Volume ID CDB — NOT a vendor
+/// knock; valid once the drive's bus/host-auth is open. Mirrors libfreemkv's
+/// `read_volume_id`.
+pub(crate) fn build_vid_cdb() -> [u8; 12] {
+    let mut cdb = [0u8; 12];
+    cdb[0] = crate::scsi::SCSI_READ_DISC_STRUCTURE;
+    cdb[1] = 0x01; // Blu-ray
+    cdb[7] = DISC_STRUCT_FMT_VID;
+    cdb[8] = (VID_STRUCT_LEN >> 8) as u8;
+    cdb[9] = (VID_STRUCT_LEN & 0xFF) as u8;
+    // cdb[10] = agid << 6; AGID 0 on the bare path (no AKE) → 0.
+    cdb
+}
+
+/// A senseless transport-failure status is a genuine dead bus, not a drive
+/// rejection surfaced through a non-conforming transport (`Err` with a sense).
+fn is_dead_bus(e: &crate::scsi::ScsiError) -> bool {
+    e.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE && e.sense.is_none()
+}
+
+/// Read the AACS VID with the bare `0xAD` fmt `0x80` (valid only after the drive
+/// is unlocked). `Ok(Some(vid))` on a well-formed non-zero VID; `Ok(None)` for
+/// any "no VID" outcome (rejected / short / all-zero); `Err(Transport)` only on
+/// a dead bus.
+pub fn read_aacs_vid(
+    scsi: &mut dyn ScsiTransport,
+) -> std::result::Result<Option<[u8; 16]>, UnlockError> {
+    let cdb = build_vid_cdb();
+    let mut buf = [0u8; VID_STRUCT_LEN as usize];
+    let result = match scsi.execute(&cdb, DataDirection::FromDevice, &mut buf, 5_000) {
+        Ok(r) => r,
+        Err(e) => {
+            if is_dead_bus(&e) {
+                return Err(UnlockError::Transport);
+            }
+            tracing::debug!(
+                target: "freemkv::disc",
+                phase = "vid_rejected_as_err",
+                status = e.status,
+                "bare VID read rejected (via Err); no Volume ID"
+            );
+            return Ok(None);
+        }
+    };
+    // A drive sense arrives as Ok with a non-zero status; without this check a
+    // CHECK CONDITION's zero-filled buffer would parse as a VID.
+    if result.status != 0 {
+        tracing::debug!(
+            target: "freemkv::disc",
+            phase = "vid_check_condition",
+            status = result.status,
+            "bare VID read returned a drive sense (no medium / drive not open)"
+        );
+        return Ok(None);
+    }
+    // Need the 4-byte header + the 16-byte VID.
+    if result.bytes_transferred < 4 + VID_LEN {
+        tracing::debug!(
+            target: "freemkv::disc",
+            phase = "vid_short_response",
+            bytes_transferred = result.bytes_transferred,
+            "bare VID response too short"
+        );
+        return Ok(None);
+    }
+    let mut vid = [0u8; VID_LEN];
+    vid.copy_from_slice(&buf[4..4 + VID_LEN]);
+    // An all-zero VID is what a permissive stub or an unfilled response leaves
+    // behind — reject it rather than pass a bogus key downstream.
+    if vid.iter().all(|&b| b == 0) {
+        tracing::debug!(
+            target: "freemkv::disc",
+            phase = "vid_all_zero",
+            "bare VID read returned an all-zero Volume ID"
+        );
+        return Ok(None);
+    }
+    tracing::debug!(target: "freemkv::disc", phase = "vid_ok", "Volume ID retrieved via bare 0xAD read");
+    Ok(Some(vid))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::scsi::mock::{MockTransport, Reply};
+
+    /// A well-formed format-0x80 VID structure: 4-byte header, 16-byte VID at
+    /// offset 4, 16-byte MAC (zeroed on the bare path — it isn't checked).
+    fn vid_ds_response(vid: [u8; 16]) -> Vec<u8> {
+        let mut p = vec![0u8; VID_STRUCT_LEN as usize];
+        p[4..20].copy_from_slice(&vid);
+        p
+    }
+
+    /// The bare VID read is the STANDARD 0xAD READ DISC STRUCTURE (format 0x80,
+    /// Blu-ray, AGID 0, len 36) — NOT a vendor knock.
+    #[test]
+    fn build_vid_cdb_is_standard_0xad_fmt_80() {
+        let cdb = build_vid_cdb();
+        assert_eq!(cdb[0], crate::scsi::SCSI_READ_DISC_STRUCTURE);
+        assert_eq!(cdb[1], 0x01); // Blu-ray
+        assert_eq!(cdb[7], 0x80); // AACS Volume ID
+        assert_eq!([cdb[8], cdb[9]], [0x00, 0x24]); // 36, BE16
+        assert_eq!(cdb[10], 0x00); // AGID 0 (no AKE)
+    }
+
+    /// Parses the VID from response[4..20] and issues exactly one 0xAD read.
+    #[test]
+    fn reads_and_parses_offset_4() {
+        let vid = [0x5Au8; 16];
+        let mut t = MockTransport::always(Reply::good(vid_ds_response(vid)));
+        let got = read_aacs_vid(&mut t).expect("no fault");
+        assert_eq!(got, Some(vid));
+        assert_eq!(t.cdbs.len(), 1, "exactly one command");
+        assert_eq!(t.cdbs[0][0], crate::scsi::SCSI_READ_DISC_STRUCTURE);
+        assert_eq!(t.cdbs[0][7], 0x80);
+    }
+
+    /// The MAC region (bytes 20..36) is ignored on the bare path.
+    #[test]
+    fn ignores_the_unverifiable_mac() {
+        let vid: [u8; 16] = [
+            0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD,
+            0xEE, 0xFF,
+        ];
+        let mut t = MockTransport::always(Reply::good(vid_ds_response(vid)));
+        assert_eq!(read_aacs_vid(&mut t).expect("no fault"), Some(vid));
+    }
+
+    /// A response too short to carry header + VID → best-effort `Ok(None)`.
+    #[test]
+    fn short_response_is_none() {
+        let mut t = MockTransport::always(Reply::short(vid_ds_response([0x11; 16]), 19));
+        assert_eq!(read_aacs_vid(&mut t).expect("no fault"), None);
+    }
+
+    /// A CHECK CONDITION (no medium / drive not open) → `Ok(None)`, never a VID
+    /// parsed from the zero fill.
+    #[test]
+    fn check_condition_is_none() {
+        let mut t = MockTransport::always(Reply::illegal_request());
+        assert_eq!(read_aacs_vid(&mut t).expect("no fault"), None);
+    }
+
+    /// An all-zero VID (permissive stub / unfilled response) → `Ok(None)`.
+    #[test]
+    fn all_zero_is_none() {
+        let mut t = MockTransport::always(Reply::good(vid_ds_response([0u8; 16])));
+        assert_eq!(read_aacs_vid(&mut t).expect("no fault"), None);
+    }
+
+    /// A rejection surfaced as `Err` WITH a sense (a non-conforming transport)
+    /// is a drive refusal, not a dead bus → `Ok(None)` VID-miss, never
+    /// `Err(Transport)`.
+    #[test]
+    fn err_with_sense_is_a_vid_miss_not_transport() {
+        let mut t = MockTransport::always(Reply::illegal_request_as_err());
+        assert_eq!(
+            read_aacs_vid(&mut t).expect("a sense is not a dead bus"),
+            None
+        );
+    }
+
+    /// Only a dead bus is an error.
+    #[test]
+    fn transport_fault_propagates() {
+        let mut t = MockTransport::always(Reply::TransportFault);
+        assert_eq!(read_aacs_vid(&mut t).unwrap_err(), UnlockError::Transport);
+    }
+}