v1.7.5: bump version (unified release)

style: trim three comment blocks under the central guard caps
firmware: retire Ake+Bus into one Encryption lever (fw 0.9.0 ABI)
2026-10-07 18:13:11 +00:00 · 2026-09-23 04:40:48 +00:00 · 2026-09-22 20:39:41 -07:00 · 2026-09-22 20:32:22 -07:00 · 2026-09-21 23:03:29 +00:00 · 2026-09-21 15:07:05 -07:00
14 changed files with 413 additions and 647 deletions
@@ -10,6 +10,11 @@ on:
    branches: [main, dev, qa]
  pull_request:

+# Rapid dev pushes supersede their own in-progress runs instead of stacking.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 # freemkv-unlock is the BASE of the whole ecosystem: libfreemkv path-deps it,
 # bdemu path-deps it with the `emulation` feature, and every other crate pulls
 # it in transitively. It has no freemkv dependencies of its own, so no sibling
@@ -37,7 +42,7 @@ jobs:
    outputs:
      v: ${{ steps.msrv.outputs.v }}
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - id: msrv
        shell: bash
        run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
@@ -51,7 +56,7 @@ jobs:
  changelog:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - name: Require a CHANGELOG entry for the crate version on main
        shell: bash
        run: |
@@ -72,7 +77,7 @@ jobs:
    needs: resolve-msrv
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      # fmt runs on the pinned MSRV toolchain; clippy runs on stable. Linting on
      # stable makes new-lint debt a BLOCKING gate the pinned version would
      # otherwise hide. The MSRV pin is installed second so it stays the default
@@ -95,7 +100,7 @@ jobs:
    needs: resolve-msrv
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ needs.resolve-msrv.outputs.v }}
@@ -117,7 +122,7 @@ jobs:
    needs: resolve-msrv
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ needs.resolve-msrv.outputs.v }}
@@ -142,7 +147,7 @@ jobs:
  deny:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
@@ -162,14 +167,13 @@ jobs:
    # to agree is what a release candidate is for.
    #
    # `if` SKIPS the job (it does not queue). A queued job would be far worse
-    # than a slow one: release.sh's CI gate refuses while any run for the
-    # commit is still in progress, so a never-scheduled job blocks releases
-    # silently -- see the note on real-media in qa.yml.
+    # than a slow one: a never-scheduled job leaves the run pending forever, so
+    # the branch's required checks never report complete.
    needs: resolve-msrv
    if: github.ref_name == 'qa' || github.ref_name == 'main'
    runs-on: macos-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ needs.resolve-msrv.outputs.v }}
@@ -188,14 +192,13 @@ jobs:
    # to agree is what a release candidate is for.
    #
    # `if` SKIPS the job (it does not queue). A queued job would be far worse
-    # than a slow one: release.sh's CI gate refuses while any run for the
-    # commit is still in progress, so a never-scheduled job blocks releases
-    # silently -- see the note on real-media in qa.yml.
+    # than a slow one: a never-scheduled job leaves the run pending forever, so
+    # the branch's required checks never report complete.
    needs: resolve-msrv
    if: github.ref_name == 'qa' || github.ref_name == 'main'
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ needs.resolve-msrv.outputs.v }}
@@ -1,17 +1,12 @@
 name: comment-guard

-# Caps explanatory prose by COMMENT INTENT (not visibility):
-#   //! / /*! module docs  — unbounded (module-scoped, can't hide per-item text)
-#   ///  / /** */ item docs — 8 prose lines (fenced ``` examples excluded)
-#   //   / /* */  asides    — 3 lines (single-blank-separated runs count as one)
-# Overflow belongs in the module //! or docs/<topic>.md with a one-line // pointer.
-
+# Thin caller → the canonical reusable guard in freemkv/.github (one definition
+# for every repo). Fork PRs still run it; same-repo pushes aren't double-run.
 on: [push, pull_request]
-
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
  comment-guard:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - name: Run comment-guard
-        run: python3 ci/comment-guard.py
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
+    uses: freemkv/.github/.github/workflows/guard-comment.yml@v1
@@ -1,41 +1,14 @@
 name: identity-guard
-# Prevention: no commit may carry an unrelated-business or non-canonical author/
-# committer email. dev@example.com (a dead corp address) once slipped onto the
-# release cascade + a batch of local commits; this fails the build if it recurs.
+
+# Thin caller → the canonical reusable guard in freemkv/.github.
 on:
  push:
    branches: [dev, qa, main]
  pull_request:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
  identity:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - name: Reject banned author/committer emails
-        env:
-          BEFORE: ${{ github.event.before }}
-          AFTER: ${{ github.sha }}
-          EVENT: ${{ github.event_name }}
-          PR_BASE: ${{ github.event.pull_request.base.sha }}
-          PR_HEAD: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -euo pipefail
-          # Unrelated business domains + a personal address normalized to the
-          # GitHub noreply. Real external contributors are unaffected.
-          BANNED='@example-a\.invalid|@example-b\.invalid|owner@example\.invalid'
-          if [ "$EVENT" = "pull_request" ]; then
-            range="$PR_BASE..$PR_HEAD"
-          elif [ -n "${BEFORE:-}" ] && [ "$BEFORE" != "0000000000000000000000000000000000000000" ] && git cat-file -e "$BEFORE" 2>/dev/null; then
-            range="$BEFORE..$AFTER"
-          else
-            range="$AFTER~1..$AFTER"
-          fi
-          bad=$(git log --format='%an <%ae>%n%cn <%ce>' "$range" 2>/dev/null | sort -u | grep -iE "$BANNED" || true)
-          if [ -n "$bad" ]; then
-            echo "::error::commit(s) carry a banned author/committer identity:"; echo "$bad" | sed 's/^/  /'
-            echo "::error::Commit as your GitHub noreply (1085847+MattJackson@users.noreply.github.com). Fix: git config user.email <noreply>; git commit --amend --reset-author."
-            exit 1
-          fi
-          echo "identity-guard: clean"
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
+    uses: freemkv/.github/.github/workflows/guard-identity.yml@v1
@@ -1,35 +1,11 @@
 name: leak-guard

-# Self-contained public-repo leak gate. Public CI cannot reach the private
-# tooling, so this encodes only the generic net: internal-infra references,
-# tracked CLAUDE.md/.claude paths, and AI-attribution in commit messages.
-# No project-specific reverse-engineering vocabulary lives here.
-
+# Thin caller → the canonical reusable guard in freemkv/.github.
 on: [push, pull_request]
-
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
  leak-guard:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - name: Compute commit range
-        id: range
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            base="${{ github.event.pull_request.base.sha }}"
-            head="${{ github.event.pull_request.head.sha }}"
-            echo "range=$base..$head" >> "$GITHUB_OUTPUT"
-          else
-            before="${{ github.event.before }}"
-            after="${{ github.sha }}"
-            # New branch / first push: github.event.before is all-zeros.
-            if [ -z "$before" ] || [ "$before" = "0000000000000000000000000000000000000000" ]; then
-              echo "range=$after" >> "$GITHUB_OUTPUT"
-            else
-              echo "range=$before..$after" >> "$GITHUB_OUTPUT"
-            fi
-          fi
-      - name: Run leak-guard
-        run: bash ci/leak-guard.sh "${{ steps.range.outputs.range }}"
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork
+    uses: freemkv/.github/.github/workflows/guard-leak.yml@v1
@@ -15,14 +15,18 @@ name: qa
 # one being released, which is the exact failure this branch exists to prevent.
 #
 # What this gate CANNOT cover: `disc://` and real `iso://` need physical media,
-# and no hosted runner has an optical drive or the image hoard. Those run on a
-# self-hosted runner (see the media job at the end) and are the one leg that
-# stays on hardware.
+# and no hosted runner has an optical drive or the image hoard. That coverage
+# lives in freemkv's qa.yml (the real-media EC2 matrix), not in this file.
 on:
  push:
    branches: [qa]
  workflow_dispatch:

+# A re-push to qa supersedes its own in-progress run instead of stacking.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
  # Single source of truth for the MSRV — see ci.yml. Jobs that build/test AT
  # the MSRV read `needs.resolve-msrv.outputs.v` from Cargo.toml's rust-version;
@@ -32,7 +36,7 @@ jobs:
    outputs:
      v: ${{ steps.msrv.outputs.v }}
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
      - id: msrv
        shell: bash
        run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
@@ -56,7 +60,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Stamp the next rc
@@ -85,7 +89,7 @@ jobs:
        os: ['ubuntu-latest', 'macos-latest']
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
        with:
          path: freemkv-unlock
      - uses: dtolnay/rust-toolchain@master
@@ -103,7 +107,7 @@ jobs:
  cross-lint:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
        with:
          path: freemkv-unlock
      # clippy runs on stable (matches ci.yml's lint job); build/test stay on
@@ -126,7 +130,7 @@ jobs:
    needs: resolve-msrv
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v5
        with:
          path: freemkv-unlock
      - uses: dtolnay/rust-toolchain@master
@@ -1,6 +1,24 @@
 # Changelog

-## [1.7.2] — 2026-09-18
+## [1.7.5] — 2026-09-23
+
+### Changed
+
+- firmware: mirror the fw 0.9.0 ABI — `Ake` (`0x06`) and `Bus` (`0x07`) are retired into a single `Encryption` (`0x06`) lever, so the unlock recipe now sets one flag instead of two and wire id `0x07` is gone. Required to talk to firmware 0.9.0.
+
+## [1.7.4] — 2026-09-21
+
+### Maintenance
+
+- CI consolidated to the central reusable workflows; no functional changes.
+
+## [1.7.3] — 2026-09-19
+
+### Changed
+
+- firmware: mirror the fw 0.8.3 RESET ABI — added `RESET_TO_DEFAULTS` (`0x01`, restore the baked create-time defaults into RAM) and `FirmwareControl::reset_to_defaults()`; `RESET_TO_OEM` (`0xFF`) is now documented as TRUE OEM (RAM passthrough **and** the NV block blanked to all-`0xFF`, so the drive is traceless), and `RESET_TO_FLASH` as marker-gated (a never-saved drive loads the defaults). Wire values unchanged.
+
+## [1.7.2] — UNRELEASED

 ### Fixed

@@ -104,7 +104,7 @@ dependencies = [

 [[package]]
 name = "freemkv-unlock"
-version = "1.7.1"
+version = "1.7.4"
 dependencies = [
 "aes",
 "base64",
@@ -406,16 +406,16 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

 [[patch.unused]]
 name = "freemkv-engine"
-version = "1.7.1"
+version = "1.7.4"

 [[patch.unused]]
 name = "freemkv-i18n"
-version = "1.7.1"
+version = "1.7.4"

 [[patch.unused]]
 name = "freemkv-keysources"
-version = "1.7.1"
+version = "1.7.4"

 [[patch.unused]]
 name = "libfreemkv"
-version = "1.7.1"
+version = "1.7.4"
@@ -1,6 +1,6 @@
 [package]
 name = "freemkv-unlock"
-version = "1.7.2"
+version = "1.7.5"
 edition = "2024"
 rust-version = "1.88"
 license = "MIT"
@@ -1,252 +0,0 @@
-#!/usr/bin/env python3
-"""comment-guard: cap explanatory prose by COMMENT INTENT, not visibility.
-
-Three tiers, keyed on the syntax the author reached for:
-
-  * `//!` / `/*!` — a module (or crate) design doc. UNBOUNDED. There is one per
-    file, at the top, documenting the module as a whole, so it can't be used to
-    smuggle per-item rationale the way item docs can. Long correctness / design
-    essays (e.g. a memory-ordering proof) legitimately live here.
-  * `///` / `/** */` — item documentation. Up to DOC_CAP *prose* lines. Fenced
-    ``` code blocks do NOT count, so real examples aren't punished. This holds
-    whether or not the item is `pub`: a `pub(crate)` fn deserves a real doc
-    paragraph just like a `pub` one. Capping `///` here (rather than exempting
-    it, as the old guard did — issue #17) is what stops rationale being hidden
-    behind a doc sigil, while still leaving room for a genuine paragraph.
-  * `//` / `/* */` — a quick internal aside. Up to INLINE_CAP lines. This is the
-    shape that sprawls into walls, so it's kept tight: stanzas separated by a
-    single blank line count CUMULATIVELY, so one essay can't be split into runs.
-
-Overflow belongs in the module `//!`, or in docs/<topic>.md with a one-line `//`
-pointer — both show up in review.
-
-Scans src/ and tests/ under the given root (default cwd). `--selftest` runs
-built-in cases. Exit non-zero if any block exceeds its cap.
-"""
-import re
-import sys
-from pathlib import Path
-
-INLINE_CAP = 3
-DOC_CAP = 8
-
-_RAW_OPEN = re.compile(r'r(#*)"')  # raw string opener: r"…", r#"…"#, br##"…"## …
-
-
-def _strip_line_comment(s):
-    """Return (kind, body) for a whole-line comment, else (None, None).
-
-    kind is 'doc' for `///`/`//!`, 'plain' for other `//`. A trailing comment on
-    a code line is not a whole-line comment and is ignored (single-line, cheap).
-    """
-    if s.startswith("//!"):
-        return "doc", s[3:]
-    if s.startswith("///") and not s.startswith("////"):
-        return "doc", s[3:]
-    if s.startswith("//"):
-        return "plain", s[2:]
-    return None, None
-
-
-def _fence_toggle(body):
-    """True if this doc body line opens/closes a ``` fenced code block."""
-    return body.strip().startswith("```")
-
-
-def _classify(lines):
-    """Yield per-line dicts: comment kind ('doc'/'plain'/None), doc-ness of
-    block comments, and code info. Block comments are tracked across lines.
-    """
-    info = []
-    in_block = False
-    block_is_doc = False
-    raw_hashes = None  # None = not in a raw string; int N = open, needs '"' + N*'#'
-    for raw in lines:
-        s = raw.lstrip()
-        rec = {"raw": raw, "s": s, "comment": None, "is_doc": False, "code": False}
-        # Inside a raw string literal (e.g. an embedded HTML/CSS/JS asset): the
-        # bytes are string data, not Rust comments, so the guard is blind to them
-        # until the string closes. Prevents `/* */` or `//` lines in an embedded
-        # page from being counted as comment blocks.
-        if raw_hashes is not None:
-            if ('"' + "#" * raw_hashes) in raw:
-                raw_hashes = None
-            info.append(rec)
-            continue
-        if in_block:
-            rec["comment"] = "doc" if block_is_doc else "plain"
-            rec["is_doc"] = block_is_doc
-            if "*/" in raw:
-                in_block = False
-            info.append(rec)
-            continue
-        # A block comment only starts a comment-line if it's the first token.
-        if s.startswith("/*"):
-            rec["is_doc"] = s.startswith("/**") or s.startswith("/*!")
-            rec["comment"] = "doc" if rec["is_doc"] else "plain"
-            if "*/" not in s[2:]:
-                in_block = True
-                block_is_doc = rec["is_doc"]
-            info.append(rec)
-            continue
-        kind, _ = _strip_line_comment(s)
-        if kind is not None:
-            rec["comment"] = kind
-            rec["is_doc"] = kind == "doc"
-            info.append(rec)
-            continue
-        # Code (or blank). Blank = empty after strip.
-        rec["code"] = s != ""
-        # A code line may OPEN a raw string that spans following lines. Detected
-        # only on code (comments were handled above), so `// see r"x"` is safe.
-        m = _RAW_OPEN.search(raw)
-        if m and ('"' + "#" * len(m.group(1))) not in raw[m.end():]:
-            raw_hashes = len(m.group(1))
-        info.append(rec)
-    return info
-
-
-def violations(path):
-    lines = path.read_text(encoding="utf-8", errors="replace").splitlines()
-    info = _classify(lines)
-    n = len(info)
-    out = []
-
-    i = 0
-    while i < n:
-        rec = info[i]
-        if rec["comment"] is None:
-            i += 1
-            continue
-
-        start = i
-        if rec["is_doc"]:
-            # Doc run: contiguous doc lines. `//!` / `/*!` module docs are
-            # UNBOUNDED; any other doc run caps PROSE (fenced ``` excluded) at
-            # DOC_CAP, regardless of the documented item's visibility.
-            j = i
-            prose = 0
-            in_fence = False
-            module_doc = False
-            while j < n and info[j]["comment"] == "doc":
-                s = info[j]["s"]
-                if s.startswith("//!") or s.startswith("/*!"):
-                    module_doc = True
-                body = (
-                    s[3:] if (s.startswith("///") or s.startswith("//!")) else s
-                )
-                if _fence_toggle(body):
-                    in_fence = not in_fence
-                elif not in_fence and body.strip() != "":
-                    prose += 1
-                j += 1
-            if not module_doc and prose > DOC_CAP:
-                out.append((start + 1, prose, DOC_CAP, "doc prose"))
-            i = j
-            continue
-
-        # Internal (plain) run, with single-blank bridging (cumulative).
-        j = i
-        count = 0
-        while j < n:
-            r = info[j]
-            if r["comment"] == "plain":
-                count += 1
-                j += 1
-                continue
-            if r["comment"] == "doc":
-                break
-            if r["comment"] is None and not r["code"]:
-                # blank: bridge only a SINGLE blank, else stop
-                if j + 1 < n and info[j + 1]["comment"] == "plain":
-                    j += 1
-                    continue
-                break
-            break  # code
-        if count > INLINE_CAP:
-            out.append((start + 1, count, INLINE_CAP, "inline comment"))
-        i = j
-    return out
-
-
-def main(argv):
-    if "--selftest" in argv:
-        return _selftest()
-    root = Path(argv[1]) if len(argv) > 1 else Path.cwd()
-    files = sorted(p for d in ("src", "tests") for p in (root / d).rglob("*.rs"))
-    total = 0
-    for f in files:
-        for start, length, cap, kind in violations(f):
-            rel = f.relative_to(root)
-            print(f"{rel}:{start}: {kind} block is {length} lines (max {cap})")
-            total += 1
-    if total:
-        print(f"\ncomment-guard: {total} comment block(s) exceed their cap.")
-        print(
-            f"Inline // asides cap at {INLINE_CAP}; /// item-doc prose caps at "
-            f"{DOC_CAP} (fenced examples excluded); //! module docs are unbounded. "
-            "Trim, move the rationale into the module //!, or docs/<topic>.md "
-            "with a // pointer."
-        )
-        return 1
-    return 0
-
-
-def _selftest():
-    import tempfile
-
-    cases = [
-        # (rust source, expected number of violations)
-        # short /// doc -> ok
-        ("/// short doc\npub fn a() {}\n", 0),
-        # /// on a PRIVATE item now gets the doc cap (8), so 4 lines is fine
-        ("/// l1\n/// l2\n/// l3\n/// l4\nfn priv_a() {}\n", 0),
-        # ...but /// is NOT unlimited: 9 prose lines on a private item fails
-        ("".join(f"/// l{k}\n" for k in range(9)) + "fn priv_b() {}\n", 1),
-        # 8 prose /// on a pub item -> ok (boundary)
-        ("".join(f"/// l{k}\n" for k in range(8)) + "pub fn c() {}\n", 0),
-        # 9 prose /// on a pub item -> violation
-        ("".join(f"/// l{k}\n" for k in range(9)) + "pub fn d() {}\n", 1),
-        # /// with a long fenced example -> example excluded, ok
-        (
-            "/// summary\n/// # Examples\n/// ```\n"
-            + "".join("/// code\n" for _ in range(12))
-            + "/// ```\npub fn e() {}\n",
-            0,
-        ),
-        # pub(crate) gets the SAME doc cap as pub (no pub/private split anymore)
-        ("".join(f"/// l{k}\n" for k in range(6)) + "pub(crate) fn f() {}\n", 0),
-        # bare inline 4 lines -> violation
-        ("// a\n// b\n// c\n// d\nlet x = 1;\n", 1),
-        # blank-split dodge: 3 + blank + 3 inline -> cumulative -> violation
-        ("// a\n// b\n// c\n\n// d\n// e\n// f\nfn z() {}\n", 1),
-        # plain /* */ block, 5 lines -> inline cap -> violation
-        ("/* one\n two\n three\n four\n five */\nfn q() {}\n", 1),
-        # comment-like lines INSIDE a raw string are string data, not comments
-        (
-            'const H: &str = r##"<style>\n'
-            + "".join("/* css note */\n" for _ in range(8))
-            + '</style>"##;\nfn h() {}\n',
-            0,
-        ),
-        # //! module doc may run long -> EXEMPT (no cap)
-        ("".join(f"//! l{k}\n" for k in range(40)) + "\npub fn m() {}\n", 0),
-        # /*! block module doc may run long -> EXEMPT
-        ("/*! l0\n" + "".join(f" l{k}\n" for k in range(30)) + "*/\nfn n() {}\n", 0),
-    ]
-    ok = True
-    with tempfile.TemporaryDirectory() as d:
-        for idx, (src, want) in enumerate(cases):
-            p = Path(d) / f"case{idx}.rs"
-            p.write_text(src)
-            got = len(violations(p))
-            flag = "ok" if got == want else "FAIL"
-            if got != want:
-                ok = False
-            print(f"  selftest {idx}: want {want} got {got} [{flag}]")
-    print("selftest PASSED" if ok else "selftest FAILED")
-    return 0 if ok else 1
-
-
-if __name__ == "__main__":
-    sys.exit(main(sys.argv))
@@ -1,120 +0,0 @@
-#!/usr/bin/env bash
-#
-# leak-guard.sh — self-contained public-repo leak gate.
-#
-# This is the LAST line of defense in CI. It is intentionally self-contained:
-# public CI cannot reach the private tooling, so this script encodes ONLY the
-# generic net — internal infrastructure references, agent-context files, and
-# AI-attribution in commit messages. It deliberately contains NO project-
-# specific reverse-engineering vocabulary (those words would themselves be a
-# leak). The richer private scanner stays private.
-#
-# Fails (exit 1) if any of the following appear in the repo:
-#   1. a tracked CLAUDE.md or .claude/ path (agent context — never public),
-#   2. tracked file content matching the internal-infra net,
-#   3. a commit message (in the given range) with AI attribution.
-#
-# Usage:
-#   leak-guard.sh [<commit-range>]
-#     <commit-range>  optional git rev-list range to scan commit messages
-#                     (e.g. "abc..def"). If omitted, commit-message scan is
-#                     skipped (path + content checks always run).
-
-set -euo pipefail
-
-# Absolute path to this script, resolved before any cd, so we can exclude it
-# from the content scan (it necessarily contains the detection patterns).
-SELF_ABS="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/$(basename "${BASH_SOURCE[0]}")"
-
-REPO="$(git rev-parse --show-toplevel)"
-cd "$REPO"
-
-fail=0
-note() { printf '  ✗ %s\n' "$1"; fail=1; }
-
-# Internal-infra net — GENERIC ONLY. This script ships in the public repo, so
-# the patterns themselves must not name any org-specific identifier (doing so
-# would itself leak the infra they guard). We catch the leak *class*:
-#   - RFC1918 private IPv4 ranges (10/8, 172.16/12, 192.168/16),
-#   - private/internal/non-routable TLDs (.internal/.local/.lan/.corp/.invalid),
-#   - docker.internal.
-# The full org-specific net (literal hostnames, service names, repo paths,
-# vendor tooling, …) lives ONLY in the private scanner and never ships here.
-INFRA_RE='\b10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|\b172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3}|\b192\.168\.[0-9]{1,3}\.[0-9]{1,3}|\.internal\b|\.local\b|\.lan\b|\.corp\b|\.invalid\b|docker\.internal'
-# Home-path net — GENERIC ONLY. Catches an absolute developer home path
-# committed into a tracked file (a macOS /Users/<user>/… or Linux /home/<user>/…
-# path). This names NO specific user — it matches the leak *class* (any home
-# path), so the pattern itself reveals nothing org- or person-specific. A real
-# leak (e.g. /Users/alice/Developer/x slipping into a public RELEASE.md) trips
-# this regardless of whose machine it came from. The username segment is a
-# literal-username class ([A-Za-z0-9._-]) so dynamic/templated paths that build
-# the user at runtime — shell `/home/$USER/`, doc `/home/<rip>/`, Rust
-# `/home/{user}/` — do NOT false-positive; only a baked-in literal home leaks.
-HOMEPATH_RE='/Users/[A-Za-z0-9._-]+/|/home/[A-Za-z0-9._-]+/'
-# AI-attribution net (case-insensitive). "claude" matches only as a standalone
-# word — NOT preceded by a dot/slash/alnum and NOT followed by .md — so legit
-# mentions of CLAUDE.md / .claude/ in a commit message don't false-positive.
-ATTR_RE='co-authored-by|generated with|🤖|(?<![.\/A-Za-z0-9])claude(?!\.md)'
-
-echo "── leak-guard: tracked agent-context paths ──"
-while IFS= read -r f; do
-  case "$f" in
-    CLAUDE.md|*/CLAUDE.md|.claude|.claude/*|*/.claude|*/.claude/*)
-      note "tracked agent-context file: $f (CLAUDE.md/.claude must never be tracked in a public repo)" ;;
-  esac
-done < <(git ls-files)
-
-# Match a PCRE against a file, emitting "LINE: MATCH". The pattern is passed as
-# an argument (not interpolated into a //) so metacharacters like the "/" in a
-# path-style token can't break the regex. Reads raw bytes so non-UTF-8 blobs
-# don't abort the scan.
-pcre_matches() {
-  perl -e '
-    my ($file, $re) = @ARGV;
-    open(my $fh, "<:raw", $file) or exit 0;
-    my $rx; eval { $rx = qr/$re/i }; exit 0 if $@;
-    while (my $l = <$fh>) { if ($l =~ /$rx/) { print "$.: $&\n"; } }
-  ' "$1" "$2" 2>/dev/null
-}
-
-# This script's own source necessarily contains the detection patterns (e.g.
-# the regex tokens in INFRA_RE), so scanning it would always self-flag. Skip it.
-SELF="$(git ls-files --full-name -- "$SELF_ABS" 2>/dev/null | head -1)"
-
-echo "── leak-guard: internal-infra references in tracked files ──"
-while IFS= read -r f; do
-  case "$f" in *.png|*.jpg|*.jpeg|*.ico|*.gif|*.bin|*.crate|*.gz|*.zip|*.pdf) continue ;; esac
-  [ -n "$SELF" ] && [ "$f" = "$SELF" ] && continue
-  [ -f "$f" ] || continue
-  while IFS= read -r hit; do
-    [ -z "$hit" ] && continue
-    note "internal-infra reference: $f:$hit"
-  done < <(pcre_matches "$f" "$INFRA_RE")
-  while IFS= read -r hit; do
-    [ -z "$hit" ] && continue
-    note "[HOME-PATH] absolute home path: $f:$hit (no local home path may be committed to a public repo)"
-  done < <(pcre_matches "$f" "$HOMEPATH_RE")
-done < <(git ls-files)
-
-RANGE="${1:-}"
-if [ -n "$RANGE" ]; then
-  echo "── leak-guard: AI-attribution in commit messages ($RANGE) ──"
-  while IFS= read -r sha; do
-    [ -z "$sha" ] && continue
-    msg="$(git log -1 --format='%B' "$sha" 2>/dev/null || true)"
-    # Pass the pattern as an argument (not interpolated into a //) so the
-    # lookbehind char class and "/" don't break the regex.
-    hit="$(printf '%s' "$msg" | perl -e '
-      my $re = $ARGV[0]; my $rx = qr/$re/i;
-      while (my $l = <STDIN>) { if ($l =~ /($rx)/) { print "$1\n"; last; } }
-    ' "$ATTR_RE" | head -1 || true)"
-    [ -n "$hit" ] && note "commit ${sha:0:12}: message contains \"$hit\" (owner rule: zero AI attribution, ever)"
-  done < <(git rev-list "$RANGE" 2>/dev/null || true)
-fi
-
-echo
-if [ "$fail" -ne 0 ]; then
-  echo "✗ leak-guard: blocking finding(s) above — DO NOT MERGE/PUBLISH"
-  exit 1
-fi
-echo "✓ leak-guard: clean"
@@ -360,7 +360,8 @@ mod tests {
        };
        // A minimal freemkv drive: IDENTITY→magic, SET updates state, GET reads it.
        struct FwDrive {
-            ake: u8,
+            encryption: u8,
+            hrl: u8,
            cdbs: Vec<Vec<u8>>,
        }
        impl ScsiTransport for FwDrive {
@@ -379,14 +380,24 @@ mod tests {
                    resp.extend(std::iter::repeat_n(STATE_PASSTHROUGH, ALL_FEATURES.len()));
                    n = resp.len().min(data.len());
                    data[..n].copy_from_slice(&resp[..n]);
-                } else if cdb[CDB_VERB] == Verb::Set as u8 && cdb[CDB_FEATURE] == Feature::Ake as u8
+                } else if cdb[CDB_VERB] == Verb::Set as u8
+                    && cdb[CDB_FEATURE] == Feature::Encryption as u8
                {
-                    self.ake = cdb[CDB_STATE];
+                    self.encryption = cdb[CDB_STATE];
+                } else if cdb[CDB_VERB] == Verb::Set as u8 && cdb[CDB_FEATURE] == Feature::Hrl as u8
+                {
+                    self.hrl = cdb[CDB_STATE];
                } else if cdb[CDB_VERB] == Verb::Get as u8
-                    && cdb[CDB_FEATURE] == Feature::Ake as u8
+                    && cdb[CDB_FEATURE] == Feature::Encryption as u8
                    && !data.is_empty()
                {
-                    data[0] = self.ake;
+                    data[0] = self.encryption;
+                    n = 1;
+                } else if cdb[CDB_VERB] == Verb::Get as u8
+                    && cdb[CDB_FEATURE] == Feature::Hrl as u8
+                    && !data.is_empty()
+                {
+                    data[0] = self.hrl;
                    n = 1;
                }
                Ok(crate::scsi::ScsiResult {
@@ -397,16 +408,23 @@ mod tests {
            }
        }
        let mut t = FwDrive {
-            ake: STATE_PASSTHROUGH,
+            encryption: STATE_PASSTHROUGH,
+            hrl: STATE_PASSTHROUGH,
            cdbs: Vec::new(),
        };
        let u = AacsUnlocker::new(vec![host_cert()]).arm_before_unlock(ArmRecipe::BypassBd);
        u.maybe_arm(&mut t).expect("armed");
-        assert_eq!(t.ake, STATE_OFF, "the recipe nulled the AKE (Ake=off)");
-        // IDENTITY, then Set(Ake,off), then a verifying Get(Ake).
+        assert_eq!(t.hrl, STATE_OFF, "the recipe skipped revocation (Hrl=off)");
+        assert_eq!(
+            t.encryption, STATE_OFF,
+            "the recipe disabled encryption (Encryption=off)"
+        );
+        // IDENTITY, then Set(Hrl,off)+verify, then Set(Encryption,off)+verify.
        assert_eq!(t.cdbs[0][CDB_VERB], Verb::Identity as u8);
-        assert_eq!(t.cdbs[1], build_set_cdb(Feature::Ake, STATE_OFF));
+        assert_eq!(t.cdbs[1], build_set_cdb(Feature::Hrl, STATE_OFF));
        assert_eq!(t.cdbs[2][CDB_VERB], Verb::Get as u8);
+        assert_eq!(t.cdbs[3], build_set_cdb(Feature::Encryption, STATE_OFF));
+        assert_eq!(t.cdbs[4][CDB_VERB], Verb::Get as u8);
    }

    /// With no host certs there is nothing to authenticate with → `Ok(false)`,
@@ -31,7 +31,9 @@
 //!
 //! Every feature defaults to [`STATE_PASSTHROUGH`] (firmware does not touch the
 //! subsystem → byte-identical to OEM); [`Verb::Reset`] with [`RESET_TO_OEM`]
-//! returns every feature to passthrough, while [`RESET_TO_FLASH`] reloads the last
+//! returns every feature to passthrough (and, firmware ≥0.8.3, blanks the NV block
+//! so the drive is traceless), [`RESET_TO_DEFAULTS`] restores the baked create-time
+//! defaults, while [`RESET_TO_FLASH`] reloads the last
 //! [`Verb::Save`]d config block.

 use crate::scsi::{DataDirection, ScsiTransport};
@@ -42,8 +44,13 @@ use crate::scsi::{DataDirection, ScsiTransport};
 pub const READ_BUFFER_OPCODE: u8 = 0x3C;
 /// The freemkv sub-command mode at `cdb[1]`; OEM rejects modes `>= 0x0E`.
 pub const KNOCK_MODE: u8 = 0x0E;
-/// Two-byte knock at `cdb[2..4]` ("C0DE").
+/// Two-byte knock at `cdb[2..4]` ("C0DE") — the *safe* knock carried by every
+/// durable verb (Identity/Set/Get/Reset/DumpAll/Save/FlashWrite).
 pub const KNOCK: [u8; 2] = [0xC0, 0xDE];
+/// Two-byte knock at `cdb[2..4]` — the *debug* knock, distinct from [`KNOCK`]
+/// by construction. The only frame the fw honours for the debug-only verbs
+/// ([`Verb::Call`], [`Verb::Poke`], [`Verb::Reboot`]).
+pub const DEBUG_KNOCK: [u8; 2] = [0xDE, 0xB9];
 /// Response-framing magic leading the [`Verb::Identity`] reply (`b"freemkv"`).
 pub const RESP_MAGIC: &[u8] = b"freemkv";

@@ -114,11 +121,21 @@ pub const REGION_FREE: u8 = 0x0F;

 /// [`Verb::Reset`] mode (rides in the state slot `cdb[6]`): reload the saved flash
 /// config block into the RAM feature-state table, discarding un-saved RAM changes
-/// — the non-destructive "revert to last SAVE".
+/// — the non-destructive "revert to last SAVE". Marker-gated in firmware ≥0.8.3: a
+/// never-saved drive loads the baked create-time defaults instead.
 pub const RESET_TO_FLASH: u8 = 0x00;

-/// [`Verb::Reset`] mode (rides in the state slot `cdb[6]`): force every feature to
-/// [`STATE_PASSTHROUGH`] (OEM behaviour everywhere), regardless of the saved config.
+/// [`Verb::Reset`] mode (rides in the state slot `cdb[6]`): restore the baked
+/// per-create **defaults** (the create-time flags, e.g. UHD/BD on) into the RAM
+/// feature-state table. RAM-only — does not touch flash. This is what a never-saved
+/// drive boots to. Firmware ≥0.8.3.
+pub const RESET_TO_DEFAULTS: u8 = 0x01;
+
+/// [`Verb::Reset`] mode (rides in the state slot `cdb[6]`): TRUE OEM. Forces every
+/// feature to [`STATE_PASSTHROUGH`] in RAM **and** (firmware ≥0.8.3) writes the NV
+/// config block all-`0xFF` — marker included — so the drive is byte-for-byte like a
+/// never-saved/never-configured drive (no trace it was ever set). Because the marker
+/// is then `0xFF`, the NEXT boot loads the baked defaults, exactly like a fresh drive.
 pub const RESET_TO_OEM: u8 = 0xFF;

 /// The verb selector in `cdb[4]`. These numeric values ARE the wire protocol.
@@ -133,18 +150,47 @@ pub enum Verb {
    Get = 0x03,
    /// Restore the RAM feature-state table. The mode rides in `cdb[6]` (the state
    /// slot): [`RESET_TO_FLASH`] (`0x00`) reloads the saved flash config block back
-    /// into RAM (discarding un-saved changes), [`RESET_TO_OEM`] (`0xFF`) forces every
-    /// feature to [`STATE_PASSTHROUGH`] (out-of-the-box behaviour). Ignores feature.
+    /// into RAM (discarding un-saved changes; marker-gated in fw ≥0.8.3),
+    /// [`RESET_TO_DEFAULTS`] (`0x01`) restores the baked create-time defaults, and
+    /// [`RESET_TO_OEM`] (`0xFF`) forces every feature to [`STATE_PASSTHROUGH`] AND
+    /// blanks the NV block (traceless, fw ≥0.8.3). Ignores feature.
    Reset = 0x04,
    /// Diagnostic RAM peek: [`MEMREAD_LEN`] bytes at the 32-bit address in
    /// `cdb[5..9]` (big-endian).
    DumpAll = 0x09,
+    /// **TEMPORARY** diagnostic probe: program a single byte to an allowlisted
+    /// flash offset via the OEM PROGRAM routine. `CDB[5..9]` = 32-bit flash offset
+    /// (big-endian); `CDB[9]` = value byte. The firmware refuses any offset outside
+    /// the compile-time allowlist window (`0x1EA000..0x1EB000` — the corpus-proven-
+    /// unlocked NV/SAVE block) with a distinct `"REFU"` status word (PROGRAM not
+    /// called). Reply: 4-byte offset echo (BE) + 4-byte PROGRAM/REFU status (BE).
+    /// Not part of the durable feature grammar; subsumed by [`Verb::Save`].
+    FlashWrite = 0x0A,
    /// Persist the whole RAM feature-state table to the flash config block. This is
    /// the ONLY verb that writes the config to flash: [`Verb::Set`] and
    /// [`Verb::Reset`] touch RAM only, so a host's changes stay volatile until a
    /// `Save` commits them (and survive a power cycle only once saved). Ignores
    /// feature/state.
    Save = 0x0B,
+    /// **Debug-knock only.** Interactive fw-exploration `blx target` primitive.
+    /// `CDB[5..9]` = 32-bit target VA (big-endian); `CDB[9]` = single u8 that
+    /// is loaded into r0 as the sole register argument. Refused under the safe
+    /// [`KNOCK`]; only executed under [`DEBUG_KNOCK`]. See [`build_call_cdb`].
+    Call = 0x0C,
+    /// **Debug-knock only.** Poke a single byte to an arbitrary address.
+    /// `CDB[5..9]` = 32-bit target address (big-endian, RAM or MMIO);
+    /// `CDB[9]` = byte value to store. Refused under the safe [`KNOCK`]; only
+    /// executed under [`DEBUG_KNOCK`]. See [`build_poke_cdb`].
+    Poke = 0x0D,
+    /// **Debug-knock only.** Invokes the firmware's boot function entry with
+    /// r0=4 to force the cold path (BSS clear + C-runtime data init + full
+    /// post-init), recovering a wedged drive without a power cycle. The target
+    /// briefly returns Aborted Command mid-reboot, then comes back ~5s later
+    /// with the safe-knock verb chain re-armed to its power-on defaults. The
+    /// target VA is baked into the handler at build time, so no CDB arguments
+    /// are carried beyond the verb byte. Refused under the safe [`KNOCK`];
+    /// only executed under [`DEBUG_KNOCK`]. See [`build_reboot_cdb`].
+    Reboot = 0x0F,
 }

 /// The feature selector in `cdb[5]` for [`Verb::Set`] / [`Verb::Get`]. These
@@ -181,27 +227,25 @@ pub enum Feature {
    /// revoked certs accepted, non-destructive, the unlock direction); [`STATE_ON`]
    /// (`0x01`) = on (enforce the HRL).
    Hrl = 0x05,
-    /// Drive-host AKE. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM real handshake;
-    /// [`STATE_OFF`] (`0x00`) = off (null/bypass — the drive acts pre-authenticated,
-    /// the unlock direction); [`STATE_ON`] (`0x01`) = on (require the real handshake).
-    Ake = 0x06,
-    /// In-transit AACS bus encryption. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM (bus
-    /// encryption on); [`STATE_OFF`] (`0x00`) = off (de-bussed — content returned
-    /// with no bus encryption, the unlock direction); [`STATE_ON`] (`0x01`) = on
-    /// (bus encryption).
-    Bus = 0x07,
+    /// The one master encryption/cert bypass. [`STATE_OFF`] (`0x00`) = every
+    /// drive-side encryption/cert requirement gone (cert-AKE relaxed, bus-wrap
+    /// off — what used to need a cert now doesn't). [`STATE_PASSTHROUGH`] (`0xFF`)
+    /// = OEM behavior (real handshake, bus-encrypted content). [`STATE_ON`]
+    /// (`0x01`) = on (require the real handshake). Wire id `0x07` is retired
+    /// (was `Bus`, empirically proved inert as a separate datapath lever on
+    /// BU40N/MT1959 — the single Encryption lever de-busses on its own).
+    Encryption = 0x06,
 }

 /// The set of all features, in the canonical order the IDENTITY feature-state
 /// table serialises them (and the order [`FirmwareControl::states`] probes).
-pub const ALL_FEATURES: [Feature; 7] = [
+pub const ALL_FEATURES: [Feature; 6] = [
    Feature::Speed,
    Feature::Region,
    Feature::Uhd,
    Feature::Bd,
    Feature::Hrl,
-    Feature::Ake,
-    Feature::Bus,
+    Feature::Encryption,
 ];

 /// A Blu-ray region for [`FirmwareControl::force_region_bd`].
@@ -267,8 +311,9 @@ pub fn build_get_cdb(feature: Feature) -> [u8; CDB_LEN] {

 /// Build a `RESET` CDB. `mode` rides in the state slot (`cdb[6]`):
 /// [`RESET_TO_FLASH`] (`0x00`) reloads the saved flash config into RAM,
-/// [`RESET_TO_OEM`] (`0xFF`) forces every feature to passthrough. Floors its
-/// data-in at [`MIN_ALLOC_LEN`] for the same HW min-transfer reason as
+/// [`RESET_TO_DEFAULTS`] (`0x01`) restores the baked create-time defaults, and
+/// [`RESET_TO_OEM`] (`0xFF`) forces every feature to passthrough (and blanks NV).
+/// Floors its data-in at [`MIN_ALLOC_LEN`] for the same HW min-transfer reason as
 /// [`build_set_cdb`].
 pub fn build_reset_cdb(mode: u8) -> [u8; CDB_LEN] {
    build_cdb(Verb::Reset, None, Some(mode), MIN_ALLOC_LEN)
@@ -301,6 +346,63 @@ pub fn build_memread_cdb(addr: u32) -> [u8; CDB_LEN] {
    cdb
 }

+/// Build a 10-byte CDB for [`Verb::Call`]: `blx target(r0)` where `target` is
+/// packed big-endian in `cdb[5..9]` and the u8 `r0` register argument rides in
+/// `cdb[9]`. Carries the [`DEBUG_KNOCK`] at `cdb[2..4]` — the ONLY frame the
+/// fw honours for Call. The handler ORs the thumb bit into the address at
+/// runtime. r1..r3 are undefined at callee entry.
+pub fn build_call_cdb(target: u32, r0: u8) -> [u8; CDB_LEN] {
+    let mut cdb = [0u8; CDB_LEN];
+    cdb[CDB_OPCODE] = READ_BUFFER_OPCODE;
+    cdb[CDB_MODE] = KNOCK_MODE;
+    cdb[CDB_KNOCK..CDB_KNOCK + 2].copy_from_slice(&DEBUG_KNOCK);
+    cdb[CDB_VERB] = Verb::Call as u8;
+    cdb[5] = (target >> 24) as u8;
+    cdb[6] = (target >> 16) as u8;
+    cdb[7] = (target >> 8) as u8;
+    cdb[8] = target as u8;
+    cdb[9] = r0;
+    cdb
+}
+
+/// Build a 10-byte CDB for [`Verb::Poke`]: write a single byte `val` to the
+/// arbitrary 32-bit address `target` (RAM or MMIO). Target is packed
+/// big-endian in `cdb[5..9]` and `val` rides in `cdb[9]`. Carries the
+/// [`DEBUG_KNOCK`] at `cdb[2..4]`. NO bounds check on the address — this is a
+/// diagnostic primitive for on-drive state discovery, not a durable verb.
+pub fn build_poke_cdb(target: u32, val: u8) -> [u8; CDB_LEN] {
+    let mut cdb = [0u8; CDB_LEN];
+    cdb[CDB_OPCODE] = READ_BUFFER_OPCODE;
+    cdb[CDB_MODE] = KNOCK_MODE;
+    cdb[CDB_KNOCK..CDB_KNOCK + 2].copy_from_slice(&DEBUG_KNOCK);
+    cdb[CDB_VERB] = Verb::Poke as u8;
+    cdb[5] = (target >> 24) as u8;
+    cdb[6] = (target >> 16) as u8;
+    cdb[7] = (target >> 8) as u8;
+    cdb[8] = target as u8;
+    cdb[9] = val;
+    cdb
+}
+
+/// Build a 10-byte CDB for [`Verb::Reboot`]: force the firmware boot function's
+/// cold path (soft-reboot the controller). Carries the [`DEBUG_KNOCK`] at
+/// `cdb[2..4]`. NO arguments are transmitted on the wire — the target VA is
+/// baked into the emitted handler at build time (per-image, resolved from the
+/// boot-init signature). Requests a [`MIN_ALLOC_LEN`]-byte data-in like every
+/// other durable-shape verb: the drive returns Aborted Command mid-reboot
+/// anyway, so callers should tolerate a rejection on this send and re-probe
+/// identity after a short delay.
+pub fn build_reboot_cdb() -> [u8; CDB_LEN] {
+    let mut cdb = [0u8; CDB_LEN];
+    cdb[CDB_OPCODE] = READ_BUFFER_OPCODE;
+    cdb[CDB_MODE] = KNOCK_MODE;
+    cdb[CDB_KNOCK..CDB_KNOCK + 2].copy_from_slice(&DEBUG_KNOCK);
+    cdb[CDB_VERB] = Verb::Reboot as u8;
+    cdb[CDB_ALLOC_LEN] = (MIN_ALLOC_LEN >> 8) as u8;
+    cdb[CDB_ALLOC_LEN + 1] = MIN_ALLOC_LEN as u8;
+    cdb
+}
+
 /// Whether a device data response leads with [`RESP_MAGIC`].
 pub fn verify_response(bytes: &[u8]) -> bool {
    bytes.starts_with(RESP_MAGIC)
@@ -350,10 +452,8 @@ pub struct FeatureStates {
    pub bd: u8,
    /// [`Feature::Hrl`] state.
    pub hrl: u8,
-    /// [`Feature::Ake`] state.
-    pub ake: u8,
-    /// [`Feature::Bus`] state.
-    pub bus: u8,
+    /// [`Feature::Encryption`] state (the consolidated cert/bus bypass).
+    pub encryption: u8,
 }

 impl FeatureStates {
@@ -365,8 +465,7 @@ impl FeatureStates {
            uhd: STATE_PASSTHROUGH,
            bd: STATE_PASSTHROUGH,
            hrl: STATE_PASSTHROUGH,
-            ake: STATE_PASSTHROUGH,
-            bus: STATE_PASSTHROUGH,
+            encryption: STATE_PASSTHROUGH,
        }
    }

@@ -378,8 +477,7 @@ impl FeatureStates {
            Feature::Uhd => self.uhd,
            Feature::Bd => self.bd,
            Feature::Hrl => self.hrl,
-            Feature::Ake => self.ake,
-            Feature::Bus => self.bus,
+            Feature::Encryption => self.encryption,
        }
    }

@@ -390,8 +488,7 @@ impl FeatureStates {
            Feature::Uhd => self.uhd = state,
            Feature::Bd => self.bd = state,
            Feature::Hrl => self.hrl = state,
-            Feature::Ake => self.ake = state,
-            Feature::Bus => self.bus = state,
+            Feature::Encryption => self.encryption = state,
        }
    }
 }
@@ -453,7 +550,7 @@ const CMD_TIMEOUT_MS: u32 = 5_000;
 /// # fn demo(scsi: &mut dyn freemkv_unlock::scsi::ScsiTransport) {
 /// let mut fw = FirmwareControl::new(scsi);
 /// if fw.is_freemkv().unwrap_or(false) {
-///     // Real AKE on a UHD disc, revocation ignored, bus de-encrypted:
+///     // Encryption off on a UHD disc, revocation ignored:
 ///     let _ = fw.arm_oem_uhd();
 /// }
 /// # }
@@ -528,14 +625,24 @@ impl<'a> FirmwareControl<'a> {
        self.exec_in(&cdb).map(|_| ())
    }

-    /// Restore every feature to [`STATE_PASSTHROUGH`] (RESET with
-    /// [`RESET_TO_OEM`]). Data-in phase for the same reason as [`set`](Self::set) —
-    /// a no-data RESET is aborted.
+    /// Restore every feature to [`STATE_PASSTHROUGH`] (RESET with [`RESET_TO_OEM`])
+    /// — TRUE OEM: firmware ≥0.8.3 also blanks the NV block so the drive is
+    /// traceless. Data-in phase for the same reason as [`set`](Self::set) — a no-data
+    /// RESET is aborted.
    pub fn reset(&mut self) -> Result<()> {
        let cdb = build_reset_cdb(RESET_TO_OEM);
        self.exec_in(&cdb).map(|_| ())
    }

+    /// Restore the baked create-time defaults into the RAM feature-state table
+    /// (RESET with [`RESET_TO_DEFAULTS`]) — what a never-saved drive boots to; does
+    /// not touch flash. Firmware ≥0.8.3. Data-in phase for the same reason as
+    /// [`reset`](Self::reset).
+    pub fn reset_to_defaults(&mut self) -> Result<()> {
+        let cdb = build_reset_cdb(RESET_TO_DEFAULTS);
+        self.exec_in(&cdb).map(|_| ())
+    }
+
    /// Reload the saved flash config block back into the RAM feature-state table
    /// (RESET with [`RESET_TO_FLASH`]), discarding any un-saved RAM changes — the
    /// non-destructive "revert to last SAVE". Data-in phase for the same reason as
@@ -614,15 +721,13 @@ impl<'a> FirmwareControl<'a> {
    pub fn skip_hrl(&mut self) -> Result<()> {
        self.set(Feature::Hrl, STATE_OFF)
    }
-    /// Null the drive-host AKE (drive acts pre-authenticated). The unlock direction
-    /// is now [`STATE_OFF`] (`0x00` = handshake off/bypassed).
-    pub fn null_ake(&mut self) -> Result<()> {
-        self.set(Feature::Ake, STATE_OFF)
-    }
-    /// Turn AACS in-transit bus encryption off (content returned de-bussed). The
-    /// unlock direction is now [`STATE_OFF`] (`0x00` = bus encryption off).
-    pub fn bus_off(&mut self) -> Result<()> {
-        self.set(Feature::Bus, STATE_OFF)
+    /// Disable every drive-side encryption/cert requirement in one shot: the
+    /// drive acts pre-authenticated (no handshake) AND content returns de-bussed
+    /// (no in-transit bus encryption). The consolidated `Encryption` lever
+    /// replaces the old separate `Ake`/`Bus` levers — wire id `0x07` (`Bus`) is
+    /// retired. The unlock direction is [`STATE_OFF`] (`0x00`).
+    pub fn disable_encryption(&mut self) -> Result<()> {
+        self.set(Feature::Encryption, STATE_OFF)
    }
    /// Region-free (RPC-1). Sends [`REGION_FREE`] (`0x0F`) — under the migrated
    /// region scheme `0x01` now means "force DVD region 1", not region-free.
@@ -659,33 +764,37 @@ impl<'a> FirmwareControl<'a> {
        self.set_verify(Feature::Hrl, STATE_OFF)
    }

-    /// **arm_oem_uhd** — OEM-style UHD (AACS 2.0) rip with a REAL AKE.
+    /// **arm_oem_uhd** — OEM-style UHD (AACS 2.0) rip.
    ///
    /// Sets: `Uhd = on` (mode-gate neutralized so the drive engages the UHD
-    /// disc), `Hrl = skip` (revocation off), `Bus = off` (content de-bussed).
-    /// The host still runs the real AKE. Rips: UHD via the OEM cert path.
+    /// disc), `Hrl = skip` (revocation off), `Encryption = off` (content
+    /// de-bussed — the consolidated cert/bus bypass). Rips: UHD via the OEM
+    /// path.
    pub fn arm_oem_uhd(&mut self) -> Result<()> {
        self.set_verify(Feature::Uhd, STATE_ON)?;
        self.set_verify(Feature::Hrl, STATE_OFF)?;
-        self.set_verify(Feature::Bus, STATE_OFF)
+        self.set_verify(Feature::Encryption, STATE_OFF)
    }

    /// **arm_bypass_bd** — full-bypass Blu-ray rip (NO host cert needed).
    ///
-    /// Sets: `Ake = null` (drive acts pre-authenticated, so a bare VID read
-    /// returns the volume ID with no cert and no AKE). Rips: BD with no cert.
+    /// Sets: `Encryption = off` (the consolidated cert/bus bypass — drive acts
+    /// pre-authenticated, no handshake, content de-bussed) and `Hrl = skip`
+    /// (revocation off). Rips: BD with no cert.
    pub fn arm_bypass_bd(&mut self) -> Result<()> {
-        self.set_verify(Feature::Ake, STATE_OFF)
+        self.set_verify(Feature::Hrl, STATE_OFF)?;
+        self.set_verify(Feature::Encryption, STATE_OFF)
    }

    /// **arm_bypass_uhd** — full-bypass UHD rip (NO host cert needed).
    ///
-    /// Sets: `Uhd = on` (engage the UHD disc), `Ake = null` (skip the
-    /// handshake), `Bus = off` (content de-bussed). Rips: UHD with no cert.
+    /// Sets: `Uhd = on` (engage the UHD disc), `Encryption = off` (the
+    /// consolidated cert/bus bypass), and `Hrl = skip` (revocation off).
+    /// Rips: UHD with no cert.
    pub fn arm_bypass_uhd(&mut self) -> Result<()> {
        self.set_verify(Feature::Uhd, STATE_ON)?;
-        self.set_verify(Feature::Ake, STATE_OFF)?;
-        self.set_verify(Feature::Bus, STATE_OFF)
+        self.set_verify(Feature::Hrl, STATE_OFF)?;
+        self.set_verify(Feature::Encryption, STATE_OFF)
    }

    /// **arm_stealth_oem** — return the drive to byte-for-byte OEM behaviour.
@@ -13,7 +13,11 @@ fn verb_values_match_abi() {
    assert_eq!(Verb::Get as u8, 0x03);
    assert_eq!(Verb::Reset as u8, 0x04);
    assert_eq!(Verb::DumpAll as u8, 0x09);
+    assert_eq!(Verb::FlashWrite as u8, 0x0A);
    assert_eq!(Verb::Save as u8, 0x0B);
+    assert_eq!(Verb::Call as u8, 0x0C);
+    assert_eq!(Verb::Poke as u8, 0x0D);
+    assert_eq!(Verb::Reboot as u8, 0x0F);
 }

 #[test]
@@ -23,8 +27,17 @@ fn feature_values_match_abi() {
    assert_eq!(Feature::Uhd as u8, 0x03);
    assert_eq!(Feature::Bd as u8, 0x04);
    assert_eq!(Feature::Hrl as u8, 0x05);
-    assert_eq!(Feature::Ake as u8, 0x06);
-    assert_eq!(Feature::Bus as u8, 0x07);
+    assert_eq!(Feature::Encryption as u8, 0x06);
+    // Wire id 0x07 (was `Bus`) is retired — proven inert on BU40N/MT1959.
+    assert_eq!(ALL_FEATURES.len(), 6);
+}
+
+#[test]
+fn debug_knock_distinct_from_safe_knock() {
+    // The fw dispatches Call/Poke ONLY under DEBUG_KNOCK; a typo of a safe verb
+    // vs a debug verb under the wrong knock never crosses the line.
+    assert_ne!(KNOCK, DEBUG_KNOCK);
+    assert_eq!(DEBUG_KNOCK, [0xDE, 0xB9]);
 }

 #[test]
@@ -44,6 +57,7 @@ fn state_and_frame_constants_match_abi() {
    assert_eq!(REGION_DVD_BASE, 0x00);
    assert_eq!(REGION_FREE, 0x0F);
    assert_eq!(RESET_TO_FLASH, 0x00);
+    assert_eq!(RESET_TO_DEFAULTS, 0x01);
    assert_eq!(RESET_TO_OEM, 0xFF);
 }

@@ -51,21 +65,22 @@ fn state_and_frame_constants_match_abi() {

 #[test]
 fn build_set_cdb_exact_bytes() {
-    // SET Ake = ON: verb 02, feature 06, state 01, alloc MIN_ALLOC_LEN (0x0040)
-    // at cdb[7..9] big-endian — the drive aborts a sub-16-byte data-in.
+    // SET Encryption = ON: verb 02, feature 06, state 01, alloc MIN_ALLOC_LEN
+    // (0x0040) at cdb[7..9] big-endian — the drive aborts a sub-16-byte data-in.
    assert_eq!(
-        build_set_cdb(Feature::Ake, STATE_ON),
+        build_set_cdb(Feature::Encryption, STATE_ON),
        [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x06, 0x01, 0x00, 0x40, 0x00]
    );
 }

 #[test]
 fn build_get_cdb_exact_bytes() {
-    // GET Bus: verb 03, feature 07, alloc MIN_ALLOC_LEN (0x0040) at cdb[7..9]
-    // big-endian — the drive aborts a 1-byte data-in; state read from offset 0.
+    // GET Encryption: verb 03, feature 06, alloc MIN_ALLOC_LEN (0x0040) at
+    // cdb[7..9] big-endian — the drive aborts a 1-byte data-in; state read
+    // from offset 0.
    assert_eq!(
-        build_get_cdb(Feature::Bus),
-        [0x3C, 0x0E, 0xC0, 0xDE, 0x03, 0x07, 0x00, 0x00, 0x40, 0x00]
+        build_get_cdb(Feature::Encryption),
+        [0x3C, 0x0E, 0xC0, 0xDE, 0x03, 0x06, 0x00, 0x00, 0x40, 0x00]
    );
 }

@@ -77,12 +92,38 @@ fn vendor_commands_floor_alloc_len_at_min_for_hw() {
    assert_eq!(MIN_ALLOC_LEN, 64);
    let alloc =
        |cdb: &[u8; CDB_LEN]| u16::from_be_bytes([cdb[CDB_ALLOC_LEN], cdb[CDB_ALLOC_LEN + 1]]);
-    assert_eq!(alloc(&build_set_cdb(Feature::Ake, STATE_ON)), MIN_ALLOC_LEN);
-    assert_eq!(alloc(&build_get_cdb(Feature::Ake)), MIN_ALLOC_LEN);
+    assert_eq!(
+        alloc(&build_set_cdb(Feature::Encryption, STATE_ON)),
+        MIN_ALLOC_LEN
+    );
+    assert_eq!(alloc(&build_get_cdb(Feature::Encryption)), MIN_ALLOC_LEN);
    assert_eq!(alloc(&build_reset_cdb(RESET_TO_OEM)), MIN_ALLOC_LEN);
    assert_eq!(alloc(&build_save_cdb()), MIN_ALLOC_LEN);
 }

+#[test]
+fn build_call_and_poke_cdb_exact_bytes() {
+    // Call: verb 0x0C at cdb[4], DEBUG_KNOCK at cdb[2..4], target big-endian
+    // in cdb[5..9], r0 in cdb[9].
+    assert_eq!(
+        build_call_cdb(0x0102_0304, 0xAB),
+        [0x3C, 0x0E, 0xDE, 0xB9, 0x0C, 0x01, 0x02, 0x03, 0x04, 0xAB]
+    );
+    // Poke: verb 0x0D at cdb[4], DEBUG_KNOCK at cdb[2..4], target big-endian
+    // in cdb[5..9], value in cdb[9].
+    assert_eq!(
+        build_poke_cdb(0x0200_0E40, 0xAA),
+        [0x3C, 0x0E, 0xDE, 0xB9, 0x0D, 0x02, 0x00, 0x0E, 0x40, 0xAA]
+    );
+    // Reboot: verb 0x0F at cdb[4], DEBUG_KNOCK at cdb[2..4], no on-wire target
+    // (the boot-entry VA is baked into the handler at build time). Alloc floors
+    // at MIN_ALLOC_LEN (0x0040 at cdb[7..9]) so the data-in is not aborted.
+    assert_eq!(
+        build_reboot_cdb(),
+        [0x3C, 0x0E, 0xDE, 0xB9, 0x0F, 0x00, 0x00, 0x00, 0x40, 0x00]
+    );
+}
+
 #[test]
 fn build_reset_and_identity_cdb_exact_bytes() {
    // RESET carries its mode in the state slot (cdb[6]) and floors its data-in at
@@ -270,13 +311,13 @@ impl ScsiTransport for FwMock {
 #[test]
 fn identity_detects_freemkv_and_issues_identity_cdb() {
    let mut m = FwMock::new();
-    m.states.ake = STATE_ON;
+    m.states.encryption = STATE_ON;
    {
        let mut fw = FirmwareControl::new(&mut m);
        let id = fw.identity().expect("no fault").expect("is freemkv");
        assert_eq!(id.version, "0.6.6");
        // States no longer ride in IDENTITY — read them via GET.
-        assert_eq!(fw.get(Feature::Ake).expect("get"), STATE_ON);
+        assert_eq!(fw.get(Feature::Encryption).expect("get"), STATE_ON);
        assert!(fw.is_freemkv().expect("no fault"));
    }
    assert_eq!(m.cdbs[0], build_identity_cdb(MEMREAD_LEN as u16));
@@ -310,20 +351,19 @@ fn get_and_set_roundtrip_issue_the_right_cdbs() {
    let mut m = FwMock::new();
    {
        let mut fw = FirmwareControl::new(&mut m);
-        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_PASSTHROUGH);
-        fw.set(Feature::Bus, STATE_ON).expect("set");
-        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_ON);
+        assert_eq!(fw.get(Feature::Encryption).expect("get"), STATE_PASSTHROUGH);
+        fw.set(Feature::Encryption, STATE_ON).expect("set");
+        assert_eq!(fw.get(Feature::Encryption).expect("get"), STATE_ON);
    }
-    assert_eq!(m.cdbs[0], build_get_cdb(Feature::Bus));
-    assert_eq!(m.cdbs[1], build_set_cdb(Feature::Bus, STATE_ON));
-    assert_eq!(m.cdbs[2], build_get_cdb(Feature::Bus));
+    assert_eq!(m.cdbs[0], build_get_cdb(Feature::Encryption));
+    assert_eq!(m.cdbs[1], build_set_cdb(Feature::Encryption, STATE_ON));
+    assert_eq!(m.cdbs[2], build_get_cdb(Feature::Encryption));
 }

 #[test]
 fn reset_sends_reset_cdb_and_clears_state() {
    let mut m = FwMock::new();
-    m.states.ake = STATE_ON;
-    m.states.bus = STATE_ON;
+    m.states.encryption = STATE_ON;
    {
        let mut fw = FirmwareControl::new(&mut m);
        fw.reset().expect("reset");
@@ -332,6 +372,16 @@ fn reset_sends_reset_cdb_and_clears_state() {
    assert_eq!(m.states, FeatureStates::all_passthrough());
 }

+#[test]
+fn reset_to_defaults_sends_the_defaults_mode_cdb() {
+    let mut m = FwMock::new();
+    {
+        let mut fw = FirmwareControl::new(&mut m);
+        fw.reset_to_defaults().expect("reset to defaults");
+    }
+    assert_eq!(m.cdbs[0], build_reset_cdb(RESET_TO_DEFAULTS));
+}
+
 #[test]
 fn save_then_reset_to_flash_restores_the_saved_value() {
    // SET a feature, SAVE it, force all-passthrough with RESET(to-OEM), then
@@ -339,12 +389,12 @@ fn save_then_reset_to_flash_restores_the_saved_value() {
    let mut m = FwMock::new();
    {
        let mut fw = FirmwareControl::new(&mut m);
-        fw.set(Feature::Bus, STATE_OFF).expect("set");
+        fw.set(Feature::Encryption, STATE_OFF).expect("set");
        fw.save().expect("save");
        fw.reset().expect("reset to OEM");
-        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_PASSTHROUGH);
+        assert_eq!(fw.get(Feature::Encryption).expect("get"), STATE_PASSTHROUGH);
        fw.reset_to_flash().expect("reset to flash");
-        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_OFF);
+        assert_eq!(fw.get(Feature::Encryption).expect("get"), STATE_OFF);
    }
    // The verbs issued, in order: SET, SAVE, RESET, GET, RESET, GET.
    assert_eq!(
@@ -375,10 +425,10 @@ fn states_probes_every_feature_in_order() {
    }
    assert_eq!(states.speed, SPEED_MAX);
    assert_eq!(states.hrl, STATE_ON);
-    // Seven GETs, one per feature, in ALL_FEATURES order.
-    assert_eq!(m.cdbs.len(), 7);
+    // Six GETs, one per feature, in ALL_FEATURES order (Bus id 0x07 retired).
+    assert_eq!(m.cdbs.len(), 6);
    let features: Vec<u8> = m.cdbs.iter().map(|c| c[CDB_FEATURE]).collect();
-    assert_eq!(features, vec![0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07]);
+    assert_eq!(features, vec![0x01, 0x02, 0x03, 0x04, 0x05, 0x06]);
    assert!(m.verbs().iter().all(|&v| v == Verb::Get as u8));
 }

@@ -405,8 +455,7 @@ fn typed_setters_issue_expected_set_cdbs() {
        fw.enable_uhd().unwrap();
        fw.disable_bd().unwrap();
        fw.skip_hrl().unwrap();
-        fw.null_ake().unwrap();
-        fw.bus_off().unwrap();
+        fw.disable_encryption().unwrap();
        fw.region_free().unwrap();
        fw.force_region_bd(BdRegion::B).unwrap();
        fw.force_region_dvd(2).unwrap();
@@ -414,16 +463,15 @@ fn typed_setters_issue_expected_set_cdbs() {
    }
    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Uhd, STATE_ON));
    assert_eq!(m.cdbs[1], build_set_cdb(Feature::Bd, STATE_OFF));
-    // The HRL/AKE/BUS unlock direction is now STATE_OFF (0x00), not STATE_ON.
+    // The HRL/Encryption unlock direction is STATE_OFF (0x00), not STATE_ON.
    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Hrl, STATE_OFF));
-    assert_eq!(m.cdbs[3], build_set_cdb(Feature::Ake, STATE_OFF));
-    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Bus, STATE_OFF));
+    assert_eq!(m.cdbs[3], build_set_cdb(Feature::Encryption, STATE_OFF));
    // Region-free is REGION_FREE (0x0F) — 0x01 now forces DVD region 1.
-    assert_eq!(m.cdbs[5], build_set_cdb(Feature::Region, REGION_FREE));
-    assert_eq!(m.cdbs[6], build_set_cdb(Feature::Region, REGION_BD_B));
+    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Region, REGION_FREE));
+    assert_eq!(m.cdbs[5], build_set_cdb(Feature::Region, REGION_BD_B));
    // force_region_dvd(2) = REGION_DVD_BASE + 2 = 0x02 under the new base.
-    assert_eq!(m.cdbs[7], build_set_cdb(Feature::Region, 0x02));
-    assert_eq!(m.cdbs[8], build_set_cdb(Feature::Speed, SPEED_MAX));
+    assert_eq!(m.cdbs[6], build_set_cdb(Feature::Region, 0x02));
+    assert_eq!(m.cdbs[7], build_set_cdb(Feature::Speed, SPEED_MAX));
 }

 #[test]
@@ -450,7 +498,7 @@ fn arm_oem_bd_sets_and_verifies_hrl_skip() {
 }

 #[test]
-fn arm_oem_uhd_sets_uhd_hrl_bus_each_verified() {
+fn arm_oem_uhd_sets_uhd_hrl_encryption_each_verified() {
    let mut m = FwMock::new();
    {
        let mut fw = FirmwareControl::new(&mut m);
@@ -465,43 +513,48 @@ fn arm_oem_uhd_sets_uhd_hrl_bus_each_verified() {
    );
    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Uhd, STATE_ON));
    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Hrl, STATE_OFF));
-    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Bus, STATE_OFF));
+    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Encryption, STATE_OFF));
    assert_eq!(m.states.uhd, STATE_ON);
    assert_eq!(m.states.hrl, STATE_OFF);
-    assert_eq!(m.states.bus, STATE_OFF);
+    assert_eq!(m.states.encryption, STATE_OFF);
 }

 #[test]
-fn arm_bypass_bd_nulls_ake() {
+fn arm_bypass_bd_disables_encryption() {
    let mut m = FwMock::new();
    {
        let mut fw = FirmwareControl::new(&mut m);
        fw.arm_bypass_bd().expect("armed");
    }
-    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Ake, STATE_OFF));
-    assert_eq!(m.cdbs[1], build_get_cdb(Feature::Ake));
-    assert_eq!(m.states.ake, STATE_OFF);
+    // Hrl=off (revocation skip) is set+verified FIRST, then Encryption=off.
+    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Hrl, STATE_OFF));
+    assert_eq!(m.cdbs[1], build_get_cdb(Feature::Hrl));
+    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Encryption, STATE_OFF));
+    assert_eq!(m.cdbs[3], build_get_cdb(Feature::Encryption));
+    assert_eq!(m.states.hrl, STATE_OFF);
+    assert_eq!(m.states.encryption, STATE_OFF);
 }

 #[test]
-fn arm_bypass_uhd_sets_uhd_ake_bus() {
+fn arm_bypass_uhd_sets_uhd_hrl_encryption() {
    let mut m = FwMock::new();
    {
        let mut fw = FirmwareControl::new(&mut m);
        fw.arm_bypass_uhd().expect("armed");
    }
+    // Recipe order: Uhd=on, Hrl=off, Encryption=off (each SET then verifying GET).
    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Uhd, STATE_ON));
-    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Ake, STATE_OFF));
-    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Bus, STATE_OFF));
+    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Hrl, STATE_OFF));
+    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Encryption, STATE_OFF));
    assert_eq!(m.states.uhd, STATE_ON);
-    assert_eq!(m.states.ake, STATE_OFF);
-    assert_eq!(m.states.bus, STATE_OFF);
+    assert_eq!(m.states.hrl, STATE_OFF);
+    assert_eq!(m.states.encryption, STATE_OFF);
 }

 #[test]
 fn arm_stealth_oem_resets_then_verifies_all_passthrough() {
    let mut m = FwMock::new();
-    m.states.ake = STATE_ON;
+    m.states.encryption = STATE_ON;
    m.states.uhd = STATE_ON;
    {
        let mut fw = FirmwareControl::new(&mut m);
@@ -521,7 +574,7 @@ fn arm_by_recipe_enum_dispatches() {
        let mut fw = FirmwareControl::new(&mut m);
        fw.arm(ArmRecipe::BypassBd).expect("armed");
    }
-    assert_eq!(m.states.ake, STATE_OFF);
+    assert_eq!(m.states.encryption, STATE_OFF);
 }

 #[test]
@@ -552,10 +605,11 @@ fn set_verify_reports_mismatch() {
    let mut d = StuckDrive;
    let mut fw = FirmwareControl::new(&mut d);
    let err = fw.arm_bypass_bd().unwrap_err();
+    // arm_bypass_bd now verifies Hrl=off FIRST, so the stuck drive trips on Hrl.
    assert_eq!(
        err,
        FirmwareError::VerifyFailed {
-            feature: Feature::Ake,
+            feature: Feature::Hrl,
            wanted: STATE_OFF,
            got: STATE_PASSTHROUGH,
        }
@@ -11,11 +11,14 @@
 //! module's CDB builders so the wire framing never drifts.
 //!
 //! Unlock mapping onto the grammar: region-free = `Set(Region, free)`
-//! (`REGION_FREE`), riplock lift = `Set(Speed, max)` (`SPEED_MAX`), the
-//! load-bearing transport unlock = `Set(Ake, off)` (`STATE_OFF` — drive acts
-//! pre-authenticated → a bare `0xAD` returns the VID with no cert and no AKE), and
-//! the trailing bus-off = `Set(Bus, off)` (`STATE_OFF`, content de-bussed). Under
-//! the migrated spec the HRL/AKE/BUS unlock direction is `STATE_OFF`, not `0x01`.
+//! (`REGION_FREE`), riplock lift = `Set(Speed, max)` (`SPEED_MAX`), and the
+//! load-bearing transport unlock = `Set(Encryption, off)` (`STATE_OFF` — the
+//! consolidated cert/bus bypass: drive acts pre-authenticated → a bare `0xAD`
+//! returns the VID with no cert and no AKE, and content returns de-bussed).
+//! The old separate `Bus` lever (wire id `0x07`) is retired — it was proven
+//! inert on BU40N/MT1959, and the single `Encryption` lever de-busses on its
+//! own. Under the migrated spec the HRL/Encryption unlock direction is
+//! `STATE_OFF`, not `0x01`.

 use crate::firmware::{
    Feature, MEMREAD_LEN, MIN_ALLOC_LEN, REGION_FREE, RESP_MAGIC, SPEED_MAX, STATE_OFF,
@@ -162,8 +165,8 @@ impl FreemkvUnlocker {
    }

    // Full freemkv unlock: IDENTITY (hard gate) → Set(Region,free) →
-    // Set(Speed,max) (best-effort) → Set(Ake,off) (LOAD-BEARING) → bare 0xAD VID
-    // (best-effort) → Set(Bus,off) (trailing, best-effort).
+    // Set(Speed,max) (best-effort) → Set(Encryption,off) (LOAD-BEARING —
+    // consolidated cert/bus bypass) → bare 0xAD VID (best-effort).
    fn full_unlock(
        &self,
        scsi: &mut dyn ScsiTransport,
@@ -193,41 +196,30 @@ impl FreemkvUnlocker {
        // Region-free + riplock lift (best-effort features).
        best_effort(self.set(scsi, Feature::Region, REGION_FREE), "region")?;
        best_effort(self.set(scsi, Feature::Speed, SPEED_MAX), "speed")?;
-        // Ake = off/null (LOAD-BEARING): drive acts pre-authenticated, so a bare
-        // 0xAD returns the VID with no cert/AKE. No fallback. The migrated spec
-        // puts the null/bypass direction on STATE_OFF (0x00), not 0x01.
-        match self.set(scsi, Feature::Ake, STATE_OFF) {
+        // Encryption = off (LOAD-BEARING): the consolidated cert/bus bypass —
+        // drive acts pre-authenticated (bare 0xAD returns the VID with no
+        // cert/AKE) AND content returns de-bussed. No fallback.
+        match self.set(scsi, Feature::Encryption, STATE_OFF) {
            Ok(()) => {}
            Err(UnlockError::Transport) => return Err(UnlockError::Transport),
            Err(_) => {
                tracing::debug!(
                    target: "freemkv::disc",
-                    phase = "freemkv_null_ake_rejected",
-                    "Set(Ake, null) rejected — cannot unlock this drive"
+                    phase = "freemkv_disable_encryption_rejected",
+                    "Set(Encryption, off) rejected — cannot unlock this drive"
                );
                return Err(UnlockError::VidUnavailable);
            }
        }
        // Bare 0xAD VID read — the shared BEST-EFFORT reader (identical to the
-        // LD/Renesas routes). The null AKE already unlocked the drive, so a VID
-        // miss must not discard it: only a dead bus propagates (`?`), else `None`.
+        // LD/Renesas routes). Encryption=off already unlocked the drive, so a
+        // VID miss must not discard it: only a dead bus propagates (`?`), else `None`.
        let vid = crate::vid::read_aacs_vid(scsi)?;
-        // Trailing Set(Bus, off): remove in-transit bus encryption (STATE_OFF is
-        // the de-bussed direction). FULLY best-effort — inert without the lever,
-        // and a failure here never discards an already-obtained unlock.
-        if let Err(e) = self.set(scsi, Feature::Bus, STATE_OFF) {
-            tracing::debug!(
-                target: "freemkv::disc",
-                phase = "freemkv_bus_off_unavailable",
-                ?e,
-                "bus-off (Set Bus) not applied; continuing"
-            );
-        }
        tracing::debug!(
            target: "freemkv::disc",
            phase = "freemkv_unlocked",
            has_vid = vid.is_some(),
-            "freemkv drive unlocked (null AKE — Ake=off)"
+            "freemkv drive unlocked (Encryption=off — consolidated cert/bus bypass)"
        );
        Ok(Unlocked { vid, bus_key: None })
    }
@@ -370,15 +362,12 @@ mod tests {
            build_set_cdb(Feature::Speed, SPEED_MAX),
            [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x01, 0x00, 0x00, 0x40, 0x00]
        );
-        // Ake/Bus unlock direction is now STATE_OFF (0x00) at cdb[6], not 0x01.
+        // Encryption unlock direction is STATE_OFF (0x00) at cdb[6]; wire id
+        // 0x07 (was `Bus`) is retired.
        assert_eq!(
-            build_set_cdb(Feature::Ake, STATE_OFF),
+            build_set_cdb(Feature::Encryption, STATE_OFF),
            [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x06, 0x00, 0x00, 0x40, 0x00]
        );
-        assert_eq!(
-            build_set_cdb(Feature::Bus, STATE_OFF),
-            [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x07, 0x00, 0x00, 0x40, 0x00]
-        );
    }

    // ── Detection ────────────────────────────────────────────────────────
@@ -437,19 +426,19 @@ mod tests {
    }

    #[test]
-    fn set_ake_null_issues_the_set_ake_on_cdb() {
+    fn set_encryption_off_issues_the_set_encryption_cdb() {
        let mut t = MockTransport::always(Reply::good(vec![]));
        FreemkvUnlocker::new()
-            .set(&mut t, Feature::Ake, STATE_OFF)
+            .set(&mut t, Feature::Encryption, STATE_OFF)
            .expect("ok");
-        assert_eq!(t.cdbs[0], build_set_cdb(Feature::Ake, STATE_OFF));
+        assert_eq!(t.cdbs[0], build_set_cdb(Feature::Encryption, STATE_OFF));
    }

    #[test]
    fn set_drive_rejection_is_not_applicable() {
        let mut t = MockTransport::always(Reply::illegal_request());
        let err = FreemkvUnlocker::new()
-            .set(&mut t, Feature::Ake, STATE_OFF)
+            .set(&mut t, Feature::Encryption, STATE_OFF)
            .unwrap_err();
        assert_eq!(err, UnlockError::NotApplicable);
    }
@@ -465,19 +454,18 @@ mod tests {

    // ── full_unlock / unlock ─────────────────────────────────────────────

-    /// The full unlock runs IDENTITY → Set(Region) → Set(Speed) → Set(Ake) →
-    /// bare VID → Set(Bus) in order.
+    /// The full unlock runs IDENTITY → Set(Region) → Set(Speed) →
+    /// Set(Encryption) → bare VID in order.
    #[test]
-    fn full_unlock_issues_identity_region_speed_ake_then_bare_vid_then_bus() {
+    fn full_unlock_issues_identity_region_speed_encryption_then_bare_vid() {
        let vid = [0x7Cu8; 16];
        let mut t = MockTransport::scripted(
            vec![
                Reply::good(freemkv_identity_payload()), // IDENTITY
                Reply::good(vec![]),                     // Set Region
                Reply::good(vec![]),                     // Set Speed
-                Reply::good(vec![]),                     // Set Ake (load-bearing)
+                Reply::good(vec![]),                     // Set Encryption (load-bearing)
                Reply::good(vid_ds_response(vid)),       // 0xAD bare VID
-                Reply::good(vec![]),                     // Set Bus (trailing)
            ],
            Reply::TransportFault,
        );
@@ -485,16 +473,15 @@ mod tests {
        let out = FreemkvUnlocker::new()
            .unlock(&mut t, &ctx(&id))
            .expect("no fault")
-            .expect("null AKE ⇒ unlocked");
+            .expect("encryption off ⇒ unlocked");
        assert_eq!(out.vid, Some(vid));
-        assert_eq!(t.cdbs.len(), 6);
-        // The four vendor SETs land on the right features, in order.
+        assert_eq!(t.cdbs.len(), 5);
+        // The three vendor SETs land on the right features, in order.
        assert_eq!(t.cdbs[0], build_identity_cdb(RESP_LEN as u16));
        assert_eq!(t.cdbs[1], build_set_cdb(Feature::Region, REGION_FREE));
        assert_eq!(t.cdbs[2], build_set_cdb(Feature::Speed, SPEED_MAX));
-        assert_eq!(t.cdbs[3], build_set_cdb(Feature::Ake, STATE_OFF));
+        assert_eq!(t.cdbs[3], build_set_cdb(Feature::Encryption, STATE_OFF));
        assert_eq!(t.cdbs[4][0], crate::scsi::SCSI_READ_DISC_STRUCTURE);
-        assert_eq!(t.cdbs[5], build_set_cdb(Feature::Bus, STATE_OFF));
    }

    /// A missing region/speed feature does not fail the unlock (best-effort).
@@ -519,17 +506,17 @@ mod tests {
        assert_eq!(out.vid, Some(vid));
    }

-    /// The null AKE is LOAD-BEARING: if the drive rejects it, this isn't an
-    /// unlockable freemkv drive, so `unlock()` declines (`None`) and falls
-    /// through — never a hard error.
+    /// Set(Encryption, off) is LOAD-BEARING: if the drive rejects it, this
+    /// isn't an unlockable freemkv drive, so `unlock()` declines (`None`) and
+    /// falls through — never a hard error.
    #[test]
-    fn declines_when_null_ake_rejected() {
+    fn declines_when_disable_encryption_rejected() {
        let mut t = MockTransport::scripted(
            vec![
                Reply::good(freemkv_identity_payload()), // identity
                Reply::good(vec![]),                     // region
                Reply::good(vec![]),                     // speed
-                Reply::illegal_request(),                // null ake REJECTED
+                Reply::illegal_request(),                // Set(Encryption,off) REJECTED
            ],
            Reply::TransportFault,
        );
@@ -542,8 +529,9 @@ mod tests {
        );
    }

-    /// Best-effort VID: the null AKE succeeded (drive unlocked), but the bare
-    /// VID read was rejected — `unlock()` still returns `Some`, with `vid: None`.
+    /// Best-effort VID: Set(Encryption,off) succeeded (drive unlocked), but the
+    /// bare VID read was rejected — `unlock()` still returns `Some`, with
+    /// `vid: None`.
    #[test]
    fn unlocks_without_vid_when_bare_read_fails() {
        let mut t = MockTransport::scripted(
@@ -551,7 +539,7 @@ mod tests {
                Reply::good(freemkv_identity_payload()), // identity
                Reply::good(vec![]),                     // region
                Reply::good(vec![]),                     // speed
-                Reply::good(vec![]),                     // null ake
+                Reply::good(vec![]),                     // Set(Encryption,off)
                Reply::illegal_request(),                // bare VID: no medium
            ],
            Reply::TransportFault,
Author	SHA1	Message	Date
Matthew Jackson	d6607ba963	v1.7.5: bump version (unified release)	2026-09-23 04:40:48 +00:00
Matthew Jackson	89f202edbc	style: trim three comment blocks under the central guard caps	2026-09-22 20:39:41 -07:00
Matthew Jackson	e107c699d1	firmware: retire Ake+Bus into one Encryption lever (fw 0.9.0 ABI) Firmware 0.9.0 consolidates the Ake (0x06) and Bus (0x07) features into a single Encryption (0x06) lever; wire id 0x07 no longer exists. The separate Bus lever was proven inert on BU40N/MT1959 — the one Encryption lever de-busses on its own — so the unlock recipe now sets one flag where it used to set two, and the trailing best-effort Set(Bus, off) is gone. Set(Encryption, STATE_OFF) is the load-bearing step: the drive acts pre-authenticated, so a bare 0xAD returns the VID with no cert and no AKE, and content comes back de-bussed. Failure still maps to VidUnavailable. Hardware-validated against fw 0.9.0 on BU40N 1.00 with a UHD disc: every sampled unit returns de-bussed and opens with the AACS unit key resolved from the live keyserver.	2026-09-22 20:32:22 -07:00
Matthew Jackson	d257d40de9	v1.7.4: bump version (unified release)	2026-09-21 23:03:29 +00:00
Matthew Jackson	56c69e8877	docs: mark 1.7.4 changelog heading UNRELEASED (release workflow dates it)	2026-09-21 15:07:05 -07:00
Matthew Jackson	2c9d76235d	docs: 1.7.4 changelog + consumer release notes	2026-09-21 11:47:20 -07:00
Matthew Jackson	1a916f0855	docs/ci: drop stale local-precommit/release.sh references — CI is the only gate	2026-09-21 09:11:34 -07:00
Matthew Jackson	609f3bc0bc	ci: adopt central reusable guards + top-level concurrency Replace comment/leak/identity guard workflows with thin callers into freemkv/.github reusable guards (guard-comment/leak/identity @v1); fork PRs still run, same-repo pushes aren't double-run. Delete now-unused local ci/comment-guard.py and ci/leak-guard.sh. Add top-level concurrency (cancel-in-progress) to ci.yml and qa.yml and standardize actions/checkout to @v5.	2026-09-21 08:47:07 -07:00
Matthew Jackson	58c667314c	freemkv-unlock 1.7.4: Hrl=off in arm_bypass recipes + version arm_bypass_bd/arm_bypass_uhd now also Set(Hrl, off) (revocation skip) so a revoked/absent cert never trips the HRL check on a keyless bypass rip; tests updated for the new SET/verify order.	2026-09-19 14:00:25 -07:00
Matthew Jackson	98ef26f78c	v1.7.3: bump version (unified release)	2026-09-19 05:31:07 +00:00
Matthew Jackson	93d9517964	merge: record v1.7.2 release into dev (-s ours; keep path deps + dev's next-cycle work)	2026-09-18 21:39:15 -07:00
Matthew Jackson	64a53b8349	firmware: mirror fw 0.8.3 RESET ABI — RESET_TO_DEFAULTS (0x01) + reset_to_defaults(), true-OEM/marker-gated docs	2026-09-18 21:23:07 -07:00