v1.7.6: bump version (unified release)

The 1.7.6 unified release ships no rip-path change (Linux desktop shell,
notifications, menu_layout refactor, XDG paths). Real-media QA on EC2
adds ~2h + real money to the release cycle to prove code that never
enters the rip pipeline. This empty commit puts `[skip-media]` in qa's
HEAD so the media matrix in qa.yml auto-skips per the documented bypass;
the full-platform builds/tests still run.

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [1.7.6] — 2026-09-26
+
+### Changed
+
+- firmware: mirror the fw 0.9.2 ABI — `Feature::Bd` (wire id `0x04`) is retired, and `Feature::Uhd` is renamed to `Feature::Unrestricted` (wire id `0x03`). `ALL_FEATURES` shrinks from 6 to 5. Required to talk to firmware 0.9.2. **Breaking**: any downstream code naming `Feature::Bd` or `Feature::Uhd` must be updated.
+- Version aligned to 1.7.6 for the unified release alongside the freemkv 1.7.6 Linux desktop shell (issue #56).
+
+## [1.7.5] — 2026-09-23
+
+### Changed
+
+- firmware: mirror the fw 0.9.0 ABI — `Ake` (`0x06`) and `Bus` (`0x07`) are retired into a single `Encryption` (`0x06`) lever, so the unlock recipe now sets one flag instead of two and wire id `0x07` is gone. Required to talk to firmware 0.9.0.
+
+## [1.7.4] — 2026-09-21
+
+### Maintenance
+
+- CI consolidated to the central reusable workflows; no functional changes.
+
 ## [1.7.3] — 2026-09-19
 
 ### Changed

Cargo.lock

@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "freemkv-unlock"
-version = "1.7.4"
+version = "1.7.6"
 dependencies = [
  "aes",
  "base64",
@@ -406,16 +406,16 @@ checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
 [[patch.unused]]
 name = "freemkv-engine"
-version = "1.7.4"
+version = "1.7.6"
 
 [[patch.unused]]
 name = "freemkv-i18n"
-version = "1.7.4"
+version = "1.7.6"
 
 [[patch.unused]]
 name = "freemkv-keysources"
-version = "1.7.4"
+version = "1.7.6"
 
 [[patch.unused]]
 name = "libfreemkv"
-version = "1.7.4"
+version = "1.7.6"

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "freemkv-unlock"
-version = "1.7.4"
+version = "1.7.6"
 edition = "2024"
 rust-version = "1.88"
 license = "MIT"

src/aacs/mod.rs

@@ -360,7 +360,7 @@ mod tests {
         };
         // A minimal freemkv drive: IDENTITY→magic, SET updates state, GET reads it.
         struct FwDrive {
-            ake: u8,
+            encryption: u8,
             hrl: u8,
             cdbs: Vec<Vec<u8>>,
         }
@@ -380,17 +380,18 @@ mod tests {
                     resp.extend(std::iter::repeat_n(STATE_PASSTHROUGH, ALL_FEATURES.len()));
                     n = resp.len().min(data.len());
                     data[..n].copy_from_slice(&resp[..n]);
-                } else if cdb[CDB_VERB] == Verb::Set as u8 && cdb[CDB_FEATURE] == Feature::Ake as u8
+                } else if cdb[CDB_VERB] == Verb::Set as u8
+                    && cdb[CDB_FEATURE] == Feature::Encryption as u8
                 {
-                    self.ake = cdb[CDB_STATE];
+                    self.encryption = cdb[CDB_STATE];
                 } else if cdb[CDB_VERB] == Verb::Set as u8 && cdb[CDB_FEATURE] == Feature::Hrl as u8
                 {
                     self.hrl = cdb[CDB_STATE];
                 } else if cdb[CDB_VERB] == Verb::Get as u8
-                    && cdb[CDB_FEATURE] == Feature::Ake as u8
+                    && cdb[CDB_FEATURE] == Feature::Encryption as u8
                     && !data.is_empty()
                 {
-                    data[0] = self.ake;
+                    data[0] = self.encryption;
                     n = 1;
                 } else if cdb[CDB_VERB] == Verb::Get as u8
                     && cdb[CDB_FEATURE] == Feature::Hrl as u8
@@ -407,19 +408,22 @@ mod tests {
             }
         }
         let mut t = FwDrive {
-            ake: STATE_PASSTHROUGH,
+            encryption: STATE_PASSTHROUGH,
             hrl: STATE_PASSTHROUGH,
             cdbs: Vec::new(),
         };
         let u = AacsUnlocker::new(vec![host_cert()]).arm_before_unlock(ArmRecipe::BypassBd);
         u.maybe_arm(&mut t).expect("armed");
         assert_eq!(t.hrl, STATE_OFF, "the recipe skipped revocation (Hrl=off)");
-        assert_eq!(t.ake, STATE_OFF, "the recipe nulled the AKE (Ake=off)");
-        // IDENTITY, then Set(Hrl,off)+verify, then Set(Ake,off)+verify.
+        assert_eq!(
+            t.encryption, STATE_OFF,
+            "the recipe disabled encryption (Encryption=off)"
+        );
+        // IDENTITY, then Set(Hrl,off)+verify, then Set(Encryption,off)+verify.
         assert_eq!(t.cdbs[0][CDB_VERB], Verb::Identity as u8);
         assert_eq!(t.cdbs[1], build_set_cdb(Feature::Hrl, STATE_OFF));
         assert_eq!(t.cdbs[2][CDB_VERB], Verb::Get as u8);
-        assert_eq!(t.cdbs[3], build_set_cdb(Feature::Ake, STATE_OFF));
+        assert_eq!(t.cdbs[3], build_set_cdb(Feature::Encryption, STATE_OFF));
         assert_eq!(t.cdbs[4][CDB_VERB], Verb::Get as u8);
     }
 

src/css/mod.rs

@@ -14,7 +14,7 @@ use crate::scsi::{DataDirection, ScsiTransport};
 
 // Issue ONE CSS bus-auth CDB, honouring the transport contract: treats a
 // non-zero status as CssAuthFailed and checks bytes_transferred >= min_bytes
-// rather than trusting an unfilled buffer. See docs/css-mod.md#css_scsi.
+// rather than trusting an unfilled buffer.
 fn css_scsi(
     scsi: &mut dyn ScsiTransport,
     cdb: &[u8],
@@ -202,7 +202,7 @@ impl crate::Unlocker for DvdUnlocker {
     fn name(&self) -> &'static str {
         // "DVD" names the medium this bus-auth unlocks, not the CSS scheme:
         // the bus-auth runs on any DVD regardless of whether the content is
-        // actually scrambled. See docs/css-mod.md#dvdunlocker-name.
+        // actually scrambled.
         "DVD"
     }
 
@@ -240,7 +240,7 @@ impl crate::Unlocker for DvdUnlocker {
 
 // Probes GET CONFIGURATION current-profile (DVD family 0x0010..=0x001F) so
 // DvdUnlocker can self-verify against the drive rather than trust the
-// caller's DiscKind. See docs/css-mod.md#mounted_disc_is_dvd.
+// caller's DiscKind.
 fn mounted_disc_is_dvd(
     scsi: &mut dyn ScsiTransport,
 ) -> std::result::Result<bool, crate::UnlockError> {
@@ -300,7 +300,6 @@ fn unlock_css_reads_inner(scsi: &mut dyn ScsiTransport, _lba: u32) -> Result<()>
     tracing::debug!(target: "freemkv::css", agid, "css unlock: bus authentication ok");
     // Disc-key REPORT KEY: best-effort only, for firmware that ties part of
     // its read-unlock to it; bytes are unused and failure is non-fatal.
-    // See docs/css-mod.md#disc-key-report-key (7014 bug history).
     if let Err(e) = read_disc_key(scsi, agid) {
         tracing::debug!(target: "freemkv::css", error_code = e.code(), "css unlock: disc-key REPORT KEY skipped (non-fatal)");
     }
@@ -311,7 +310,7 @@ fn unlock_css_reads_inner(scsi: &mut dyn ScsiTransport, _lba: u32) -> Result<()>
 // ── Step 1: Bus Authentication ────────────────────────────────────────────
 
 // Runs the CSS bus-auth handshake to set ASF=1 (invalidate AGIDs, allocate,
-// challenge/response). Returns the AGID; no bus key is derived. See docs/css-mod.md.
+// challenge/response). Returns the AGID; no bus key is derived.
 fn establish_authenticated_session(scsi: &mut dyn ScsiTransport) -> Result<u8> {
     // Invalidate all AGIDs via REPORT KEY format 0x3F. This is also what makes
     // an abandoned AGID self-heal — which is not a reason to abandon one.
@@ -438,7 +437,7 @@ fn authenticate_with_agid(scsi: &mut dyn ScsiTransport, agid: u8) -> Result<()>
 // ── Step 2: Disc Key ──────────────────────────────────────────────────────
 
 // Issues READ DVD STRUCTURE format 0x02 (opcode 0xAD) purely for its
-// bus-auth side effect; returned bytes are unused. See docs/css-mod.md#read_disc_key.
+// bus-auth side effect; returned bytes are unused.
 fn read_disc_key(scsi: &mut dyn ScsiTransport, agid: u8) -> Result<()> {
     // READ DVD STRUCTURE, format 0x02 (disc key), 2048+4 bytes
     let alloc_len: u16 = 2048 + 4;
@@ -464,7 +463,7 @@ fn read_disc_key(scsi: &mut dyn ScsiTransport, agid: u8) -> Result<()> {
 fn crypt_key(key_type: usize, variant: u8, challenge: &[u8; 10]) -> [u8; 5] {
     // key_type indexes PERM_CHALLENGE ([_;3]); variant indexes VARIANTS/
     // PERM_VARIANT ([_;32]). Real (not debug-only) asserts catch an OOB index even
-    // in release; cost is nil on this once-per-disc path. See docs/css-mod.md.
+    // in release; cost is nil on this once-per-disc path.
     assert!(key_type < 3, "crypt_key: key_type out of range");
     assert!((variant as usize) < 32, "crypt_key: variant out of range");
     let perm = &PERM_CHALLENGE[key_type];
@@ -620,7 +619,7 @@ mod tests {
 
     // SECURITY REGRESSION GUARD: scans source files for a `tracing` field
     // binding a forbidden key name to a value expression (only a string
-    // literal or `_fp` field is allowed). See docs/css-mod.md#key-guard.
+    // literal or `_fp` field is allowed).
     #[test]
     fn no_key_bytes_in_instrumentation() {
         use std::path::Path;
@@ -776,7 +775,7 @@ mod tests {
     // ── CSS constant-table integrity ───────────────────────────────────────
 
     // Each PERM_CHALLENGE row must be a permutation of indices 0..10; a
-    // non-permutation would drop/duplicate bytes. See docs/css-mod.md#perm-challenge-rows.
+    // non-permutation would drop/duplicate bytes.
     #[test]
     fn perm_challenge_rows_are_permutations() {
         for (row, perm) in PERM_CHALLENGE.iter().enumerate() {
@@ -795,7 +794,6 @@ mod tests {
 
     // Each PERM_VARIANT row must map the 32 variants to 32 distinct 5-bit
     // values; a collision would make two variants indistinguishable.
-    // See docs/css-mod.md#perm-variant-rows.
     #[test]
     fn perm_variant_rows_are_permutations_of_0_31() {
         for (row, perm) in PERM_VARIANT.iter().enumerate() {
@@ -816,7 +814,7 @@ mod tests {
     // ── crypt_key behaviour ────────────────────────────────────────────────
 
     // crypt_key's result must depend on every challenge byte: flipping any
-    // single byte must change the output. See docs/css-mod.md#crypt-key-byte-dependence.
+    // single byte must change the output.
     #[test]
     fn crypt_key_depends_on_every_challenge_byte() {
         let base: [u8; 10] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
@@ -834,7 +832,7 @@ mod tests {
 
     // crypt_key(0, v, ..) must be distinct for each of the 32 variants:
     // bus-auth brute-forces the variant by matching against key1, so a
-    // collision could select the wrong one. See docs/css-mod.md.
+    // collision could select the wrong one.
     #[test]
     fn crypt_key_type0_distinct_per_variant() {
         let challenge: [u8; 10] = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
@@ -851,7 +849,6 @@ mod tests {
 
     // crypt_key's `key_type < 3` debug_assert must fire for key_type 3
     // (which would otherwise index PERM_CHALLENGE out of bounds).
-    // See docs/css-mod.md#crypt-key-preconditions.
     #[test]
     #[should_panic]
     fn crypt_key_rejects_out_of_range_key_type() {
@@ -861,7 +858,6 @@ mod tests {
 
     // crypt_key's `variant < 32` debug_assert must fire for variant 32
     // (which would otherwise index VARIANTS/PERM_VARIANT out of bounds).
-    // See docs/css-mod.md#crypt-key-preconditions.
     #[test]
     #[should_panic]
     fn crypt_key_rejects_out_of_range_variant() {
@@ -895,7 +891,6 @@ mod tests {
 
     // The key-format field is masked to 6 bits so a format with high bits
     // set (e.g. 0xFF) cannot corrupt the AGID bits of byte 10.
-    // See docs/css-mod.md#cdb-builders.
     #[test]
     fn report_key_cdb_masks_format_to_6_bits() {
         let cdb = report_key_cdb(0, 0xFF, 8);
@@ -904,7 +899,7 @@ mod tests {
 
     // send_key_cdb encodes a 12-byte MMC SEND KEY (opcode 0xA3) CDB with the
     // parameter-list length at bytes 8-9 (big-endian) and AGID/format at
-    // byte 10. See docs/css-mod.md#cdb-builders.
+    // byte 10.
     #[test]
     fn send_key_cdb_matches_mmc_layout() {
         let cdb = send_key_cdb(0b11, 0x03, 0x000C); // AGID=3, format=3, param_len=12
@@ -921,7 +916,6 @@ mod tests {
 
     // Allocation length > 255 must split across bytes 8 (high) and 9 (low)
     // as a 16-bit big-endian field, e.g. 0x0804 (the disc-key block size).
-    // See docs/css-mod.md#cdb-builders.
     #[test]
     fn report_key_cdb_alloc_len_is_16bit_big_endian() {
         let cdb = report_key_cdb(0, 0x00, 0x0804);
@@ -1012,7 +1006,7 @@ mod tests {
 
     // Defect-7 regression: a transport fault on the first probe command
     // must abort as Transport, not fall through to NotApplicable (which
-    // let the consumer keep probing a dead bus). See docs/css-mod.md.
+    // let the consumer keep probing a dead bus).
     #[test]
     fn transport_fault_probing_for_a_dvd_aborts() {
         let id = DriveId::default();
@@ -1039,7 +1033,7 @@ mod tests {
 
     // Defect-2 regression: a DVD is mounted, then the bus dies mid
     // bus-auth — must abort as Transport, not collapse to CssAuthFailed /
-    // NotApplicable. See docs/css-mod.md.
+    // NotApplicable.
     #[test]
     fn transport_fault_during_bus_auth_aborts() {
         let id = DriveId::default();

src/firmware/mod.rs

@@ -44,8 +44,13 @@ use crate::scsi::{DataDirection, ScsiTransport};
 pub const READ_BUFFER_OPCODE: u8 = 0x3C;
 /// The freemkv sub-command mode at `cdb[1]`; OEM rejects modes `>= 0x0E`.
 pub const KNOCK_MODE: u8 = 0x0E;
-/// Two-byte knock at `cdb[2..4]` ("C0DE").
+/// Two-byte knock at `cdb[2..4]` ("C0DE") — the *safe* knock carried by every
+/// durable verb (Identity/Set/Get/Reset/DumpAll/Save/FlashWrite).
 pub const KNOCK: [u8; 2] = [0xC0, 0xDE];
+/// Two-byte knock at `cdb[2..4]` — the *debug* knock, distinct from [`KNOCK`]
+/// by construction. The only frame the fw honours for the debug-only verbs
+/// ([`Verb::Call`], [`Verb::Poke`], [`Verb::Reboot`]).
+pub const DEBUG_KNOCK: [u8; 2] = [0xDE, 0xB9];
 /// Response-framing magic leading the [`Verb::Identity`] reply (`b"freemkv"`).
 pub const RESP_MAGIC: &[u8] = b"freemkv";
 
@@ -153,12 +158,39 @@ pub enum Verb {
     /// Diagnostic RAM peek: [`MEMREAD_LEN`] bytes at the 32-bit address in
     /// `cdb[5..9]` (big-endian).
     DumpAll = 0x09,
+    /// **TEMPORARY** diagnostic probe: program a single byte to an allowlisted
+    /// flash offset via the OEM PROGRAM routine. `CDB[5..9]` = 32-bit flash offset
+    /// (big-endian); `CDB[9]` = value byte. The firmware refuses any offset outside
+    /// the compile-time allowlist window (`0x1EA000..0x1EB000` — the corpus-proven-
+    /// unlocked NV/SAVE block) with a distinct `"REFU"` status word (PROGRAM not
+    /// called). Reply: 4-byte offset echo (BE) + 4-byte PROGRAM/REFU status (BE).
+    /// Not part of the durable feature grammar; subsumed by [`Verb::Save`].
+    FlashWrite = 0x0A,
     /// Persist the whole RAM feature-state table to the flash config block. This is
     /// the ONLY verb that writes the config to flash: [`Verb::Set`] and
     /// [`Verb::Reset`] touch RAM only, so a host's changes stay volatile until a
     /// `Save` commits them (and survive a power cycle only once saved). Ignores
     /// feature/state.
     Save = 0x0B,
+    /// **Debug-knock only.** Interactive fw-exploration `blx target` primitive.
+    /// `CDB[5..9]` = 32-bit target VA (big-endian); `CDB[9]` = single u8 that
+    /// is loaded into r0 as the sole register argument. Refused under the safe
+    /// [`KNOCK`]; only executed under [`DEBUG_KNOCK`]. See [`build_call_cdb`].
+    Call = 0x0C,
+    /// **Debug-knock only.** Poke a single byte to an arbitrary address.
+    /// `CDB[5..9]` = 32-bit target address (big-endian, RAM or MMIO);
+    /// `CDB[9]` = byte value to store. Refused under the safe [`KNOCK`]; only
+    /// executed under [`DEBUG_KNOCK`]. See [`build_poke_cdb`].
+    Poke = 0x0D,
+    /// **Debug-knock only.** Invokes the firmware's boot function entry with
+    /// r0=4 to force the cold path (BSS clear + C-runtime data init + full
+    /// post-init), recovering a wedged drive without a power cycle. The target
+    /// briefly returns Aborted Command mid-reboot, then comes back ~5s later
+    /// with the safe-knock verb chain re-armed to its power-on defaults. The
+    /// target VA is baked into the handler at build time, so no CDB arguments
+    /// are carried beyond the verb byte. Refused under the safe [`KNOCK`];
+    /// only executed under [`DEBUG_KNOCK`]. See [`build_reboot_cdb`].
+    Reboot = 0x0F,
 }
 
 /// The feature selector in `cdb[5]` for [`Verb::Set`] / [`Verb::Get`]. These
@@ -178,44 +210,35 @@ pub enum Feature {
     /// [`REGION_BD_A`]/`_B`/`_C` (`0x0A`/`0x0B`/`0x0C`) = force BD region A/B/C;
     /// [`REGION_FREE`] (`0x0F`) = region-free (any disc plays).
     Region = 0x02,
-    /// UHD (AACS 2.0) capability gate. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM (as
-    /// shipped); [`STATE_OFF`] (`0x00`) = No (refuse UHD discs); [`STATE_ON`]
-    /// (`0x01`) = Yes (accept UHD — the mode gate is neutralized so the drive
-    /// engages UHD discs). On the byte-extraction classifier (e.g. BU40N) the No
-    /// (OFF) leg currently reads back but behaves == OEM (boot-safe no-op, pending
-    /// deeper RE) — do NOT treat OFF as a proven UHD disable there.
-    Uhd = 0x03,
-    /// Blu-ray (AACS 1.0) capability gate. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM (BD
-    /// engaged as shipped); [`STATE_OFF`] (`0x00`) = No (force-refuse BD discs — the
-    /// drive raises its own `6F` refusal sense); [`STATE_ON`] (`0x01`) = Yes (accept
-    /// BD — an enable direction, not a no-op).
-    Bd = 0x04,
+    /// Unrestricted (BD/UHD) capability widen gate — fw 0.9.2 unified the former
+    /// separate BD/UHD accept gates. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM;
+    /// [`STATE_OFF`] (`0x00`) = No (currently no-op on byte-extraction classifiers
+    /// like BU40N, pending RE); [`STATE_ON`] (`0x01`) = Yes (accept BD/UHD).
+    /// Wire id `0x04` (was `Bd`) is retired: unused/reserved, fw treats as no-op.
+    Unrestricted = 0x03,
     /// Host Revocation List handling on the cert path. [`STATE_PASSTHROUGH`]
     /// (`0xFF`) = OEM enforce; [`STATE_OFF`] (`0x00`) = off (skip the HRL lookup —
     /// revoked certs accepted, non-destructive, the unlock direction); [`STATE_ON`]
     /// (`0x01`) = on (enforce the HRL).
     Hrl = 0x05,
-    /// Drive-host AKE. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM real handshake;
-    /// [`STATE_OFF`] (`0x00`) = off (null/bypass — the drive acts pre-authenticated,
-    /// the unlock direction); [`STATE_ON`] (`0x01`) = on (require the real handshake).
-    Ake = 0x06,
-    /// In-transit AACS bus encryption. [`STATE_PASSTHROUGH`] (`0xFF`) = OEM (bus
-    /// encryption on); [`STATE_OFF`] (`0x00`) = off (de-bussed — content returned
-    /// with no bus encryption, the unlock direction); [`STATE_ON`] (`0x01`) = on
-    /// (bus encryption).
-    Bus = 0x07,
+    /// The one master encryption/cert bypass. [`STATE_OFF`] (`0x00`) = every
+    /// drive-side encryption/cert requirement gone (cert-AKE relaxed, bus-wrap
+    /// off — what used to need a cert now doesn't). [`STATE_PASSTHROUGH`] (`0xFF`)
+    /// = OEM behavior (real handshake, bus-encrypted content). [`STATE_ON`]
+    /// (`0x01`) = on (require the real handshake). Wire id `0x07` is retired
+    /// (was `Bus`, empirically proved inert as a separate datapath lever on
+    /// BU40N/MT1959 — the single Encryption lever de-busses on its own).
+    Encryption = 0x06,
 }
 
 /// The set of all features, in the canonical order the IDENTITY feature-state
 /// table serialises them (and the order [`FirmwareControl::states`] probes).
-pub const ALL_FEATURES: [Feature; 7] = [
+pub const ALL_FEATURES: [Feature; 5] = [
     Feature::Speed,
     Feature::Region,
-    Feature::Uhd,
-    Feature::Bd,
+    Feature::Unrestricted,
     Feature::Hrl,
-    Feature::Ake,
-    Feature::Bus,
+    Feature::Encryption,
 ];
 
 /// A Blu-ray region for [`FirmwareControl::force_region_bd`].
@@ -316,6 +339,63 @@ pub fn build_memread_cdb(addr: u32) -> [u8; CDB_LEN] {
     cdb
 }
 
+/// Build a 10-byte CDB for [`Verb::Call`]: `blx target(r0)` where `target` is
+/// packed big-endian in `cdb[5..9]` and the u8 `r0` register argument rides in
+/// `cdb[9]`. Carries the [`DEBUG_KNOCK`] at `cdb[2..4]` — the ONLY frame the
+/// fw honours for Call. The handler ORs the thumb bit into the address at
+/// runtime. r1..r3 are undefined at callee entry.
+pub fn build_call_cdb(target: u32, r0: u8) -> [u8; CDB_LEN] {
+    let mut cdb = [0u8; CDB_LEN];
+    cdb[CDB_OPCODE] = READ_BUFFER_OPCODE;
+    cdb[CDB_MODE] = KNOCK_MODE;
+    cdb[CDB_KNOCK..CDB_KNOCK + 2].copy_from_slice(&DEBUG_KNOCK);
+    cdb[CDB_VERB] = Verb::Call as u8;
+    cdb[5] = (target >> 24) as u8;
+    cdb[6] = (target >> 16) as u8;
+    cdb[7] = (target >> 8) as u8;
+    cdb[8] = target as u8;
+    cdb[9] = r0;
+    cdb
+}
+
+/// Build a 10-byte CDB for [`Verb::Poke`]: write a single byte `val` to the
+/// arbitrary 32-bit address `target` (RAM or MMIO). Target is packed
+/// big-endian in `cdb[5..9]` and `val` rides in `cdb[9]`. Carries the
+/// [`DEBUG_KNOCK`] at `cdb[2..4]`. NO bounds check on the address — this is a
+/// diagnostic primitive for on-drive state discovery, not a durable verb.
+pub fn build_poke_cdb(target: u32, val: u8) -> [u8; CDB_LEN] {
+    let mut cdb = [0u8; CDB_LEN];
+    cdb[CDB_OPCODE] = READ_BUFFER_OPCODE;
+    cdb[CDB_MODE] = KNOCK_MODE;
+    cdb[CDB_KNOCK..CDB_KNOCK + 2].copy_from_slice(&DEBUG_KNOCK);
+    cdb[CDB_VERB] = Verb::Poke as u8;
+    cdb[5] = (target >> 24) as u8;
+    cdb[6] = (target >> 16) as u8;
+    cdb[7] = (target >> 8) as u8;
+    cdb[8] = target as u8;
+    cdb[9] = val;
+    cdb
+}
+
+/// Build a 10-byte CDB for [`Verb::Reboot`]: force the firmware boot function's
+/// cold path (soft-reboot the controller). Carries the [`DEBUG_KNOCK`] at
+/// `cdb[2..4]`. NO arguments are transmitted on the wire — the target VA is
+/// baked into the emitted handler at build time (per-image, resolved from the
+/// boot-init signature). Requests a [`MIN_ALLOC_LEN`]-byte data-in like every
+/// other durable-shape verb: the drive returns Aborted Command mid-reboot
+/// anyway, so callers should tolerate a rejection on this send and re-probe
+/// identity after a short delay.
+pub fn build_reboot_cdb() -> [u8; CDB_LEN] {
+    let mut cdb = [0u8; CDB_LEN];
+    cdb[CDB_OPCODE] = READ_BUFFER_OPCODE;
+    cdb[CDB_MODE] = KNOCK_MODE;
+    cdb[CDB_KNOCK..CDB_KNOCK + 2].copy_from_slice(&DEBUG_KNOCK);
+    cdb[CDB_VERB] = Verb::Reboot as u8;
+    cdb[CDB_ALLOC_LEN] = (MIN_ALLOC_LEN >> 8) as u8;
+    cdb[CDB_ALLOC_LEN + 1] = MIN_ALLOC_LEN as u8;
+    cdb
+}
+
 /// Whether a device data response leads with [`RESP_MAGIC`].
 pub fn verify_response(bytes: &[u8]) -> bool {
     bytes.starts_with(RESP_MAGIC)
@@ -359,16 +439,12 @@ pub struct FeatureStates {
     pub speed: u8,
     /// [`Feature::Region`] state.
     pub region: u8,
-    /// [`Feature::Uhd`] state.
-    pub uhd: u8,
-    /// [`Feature::Bd`] state.
-    pub bd: u8,
+    /// [`Feature::Unrestricted`] state.
+    pub unrestricted: u8,
     /// [`Feature::Hrl`] state.
     pub hrl: u8,
-    /// [`Feature::Ake`] state.
-    pub ake: u8,
-    /// [`Feature::Bus`] state.
-    pub bus: u8,
+    /// [`Feature::Encryption`] state (the consolidated cert/bus bypass).
+    pub encryption: u8,
 }
 
 impl FeatureStates {
@@ -377,11 +453,9 @@ impl FeatureStates {
         FeatureStates {
             speed: STATE_PASSTHROUGH,
             region: STATE_PASSTHROUGH,
-            uhd: STATE_PASSTHROUGH,
-            bd: STATE_PASSTHROUGH,
+            unrestricted: STATE_PASSTHROUGH,
             hrl: STATE_PASSTHROUGH,
-            ake: STATE_PASSTHROUGH,
-            bus: STATE_PASSTHROUGH,
+            encryption: STATE_PASSTHROUGH,
         }
     }
 
@@ -390,11 +464,9 @@ impl FeatureStates {
         match feature {
             Feature::Speed => self.speed,
             Feature::Region => self.region,
-            Feature::Uhd => self.uhd,
-            Feature::Bd => self.bd,
+            Feature::Unrestricted => self.unrestricted,
             Feature::Hrl => self.hrl,
-            Feature::Ake => self.ake,
-            Feature::Bus => self.bus,
+            Feature::Encryption => self.encryption,
         }
     }
 
@@ -402,11 +474,9 @@ impl FeatureStates {
         match feature {
             Feature::Speed => self.speed = state,
             Feature::Region => self.region = state,
-            Feature::Uhd => self.uhd = state,
-            Feature::Bd => self.bd = state,
+            Feature::Unrestricted => self.unrestricted = state,
             Feature::Hrl => self.hrl = state,
-            Feature::Ake => self.ake = state,
-            Feature::Bus => self.bus = state,
+            Feature::Encryption => self.encryption = state,
         }
     }
 }
@@ -451,6 +521,9 @@ pub enum ArmRecipe {
     BypassBd,
     /// [`FirmwareControl::arm_bypass_uhd`].
     BypassUhd,
+    // NOTE: Feature::Unrestricted unifies former BD+UHD gates (fw 0.9.2); recipe
+    // names above name the disc TYPE being ripped, not the retired per-format
+    // feature — see `arm_oem_uhd`/`arm_bypass_uhd`.
     /// [`FirmwareControl::arm_stealth_oem`].
     StealthOem,
 }
@@ -468,7 +541,7 @@ const CMD_TIMEOUT_MS: u32 = 5_000;
 /// # fn demo(scsi: &mut dyn freemkv_unlock::scsi::ScsiTransport) {
 /// let mut fw = FirmwareControl::new(scsi);
 /// if fw.is_freemkv().unwrap_or(false) {
-///     // Real AKE on a UHD disc, revocation ignored, bus de-encrypted:
+///     // Encryption off on a UHD disc, revocation ignored:
 ///     let _ = fw.arm_oem_uhd();
 /// }
 /// # }
@@ -615,39 +688,28 @@ impl<'a> FirmwareControl<'a> {
 
     // ── Typed setters ────────────────────────────────────────────────────────
 
-    /// Force the UHD (AACS 2.0) capability gate on (drive engages UHD discs).
-    pub fn enable_uhd(&mut self) -> Result<()> {
-        self.set(Feature::Uhd, STATE_ON)
+    /// Force the Unrestricted (BD/UHD) capability gate on (drive engages both
+    /// BD and UHD discs). fw 0.9.2 unified the former separate UHD/BD gates
+    /// into this single lever.
+    pub fn enable_unrestricted(&mut self) -> Result<()> {
+        self.set(Feature::Unrestricted, STATE_ON)
     }
-    /// Force the UHD capability gate off.
-    pub fn disable_uhd(&mut self) -> Result<()> {
-        self.set(Feature::Uhd, STATE_OFF)
-    }
-    /// Force the Blu-ray (AACS 1.0) capability gate on.
-    pub fn enable_bd(&mut self) -> Result<()> {
-        self.set(Feature::Bd, STATE_ON)
-    }
-    /// Force the Blu-ray capability gate off (drive refuses BD discs). Sends the
-    /// uniform [`STATE_OFF`] (`0x00`) — an unarmed image boots to [`STATE_PASSTHROUGH`]
-    /// (`0xFF`, OEM) via the firmware power-on hook, so `0x00` no longer collides
-    /// with the boot value (the retired `0x02` sentinel is gone).
-    pub fn disable_bd(&mut self) -> Result<()> {
-        self.set(Feature::Bd, STATE_OFF)
+    /// Force the Unrestricted (BD/UHD) capability gate off.
+    pub fn disable_unrestricted(&mut self) -> Result<()> {
+        self.set(Feature::Unrestricted, STATE_OFF)
     }
     /// Skip the HRL lookup (revoked certs accepted; non-destructive). The unlock
     /// direction is now [`STATE_OFF`] (`0x00` = HRL enforcement off).
     pub fn skip_hrl(&mut self) -> Result<()> {
         self.set(Feature::Hrl, STATE_OFF)
     }
-    /// Null the drive-host AKE (drive acts pre-authenticated). The unlock direction
-    /// is now [`STATE_OFF`] (`0x00` = handshake off/bypassed).
-    pub fn null_ake(&mut self) -> Result<()> {
-        self.set(Feature::Ake, STATE_OFF)
-    }
-    /// Turn AACS in-transit bus encryption off (content returned de-bussed). The
-    /// unlock direction is now [`STATE_OFF`] (`0x00` = bus encryption off).
-    pub fn bus_off(&mut self) -> Result<()> {
-        self.set(Feature::Bus, STATE_OFF)
+    /// Disable every drive-side encryption/cert requirement in one shot: the
+    /// drive acts pre-authenticated (no handshake) AND content returns de-bussed
+    /// (no in-transit bus encryption). The consolidated `Encryption` lever
+    /// replaces the old separate `Ake`/`Bus` levers — wire id `0x07` (`Bus`) is
+    /// retired. The unlock direction is [`STATE_OFF`] (`0x00`).
+    pub fn disable_encryption(&mut self) -> Result<()> {
+        self.set(Feature::Encryption, STATE_OFF)
     }
     /// Region-free (RPC-1). Sends [`REGION_FREE`] (`0x0F`) — under the migrated
     /// region scheme `0x01` now means "force DVD region 1", not region-free.
@@ -684,38 +746,37 @@ impl<'a> FirmwareControl<'a> {
         self.set_verify(Feature::Hrl, STATE_OFF)
     }
 
-    /// **arm_oem_uhd** — OEM-style UHD (AACS 2.0) rip with a REAL AKE.
+    /// **arm_oem_uhd** — OEM-style UHD (AACS 2.0) rip.
     ///
-    /// Sets: `Uhd = on` (mode-gate neutralized so the drive engages the UHD
-    /// disc), `Hrl = skip` (revocation off), `Bus = off` (content de-bussed).
-    /// The host still runs the real AKE. Rips: UHD via the OEM cert path.
+    /// Sets: `Unrestricted = on` (mode-gate neutralized so the drive engages
+    /// the UHD disc), `Hrl = skip` (revocation off), `Encryption = off`
+    /// (content de-bussed — the consolidated cert/bus bypass). Rips: UHD via
+    /// the OEM path.
     pub fn arm_oem_uhd(&mut self) -> Result<()> {
-        self.set_verify(Feature::Uhd, STATE_ON)?;
+        self.set_verify(Feature::Unrestricted, STATE_ON)?;
         self.set_verify(Feature::Hrl, STATE_OFF)?;
-        self.set_verify(Feature::Bus, STATE_OFF)
+        self.set_verify(Feature::Encryption, STATE_OFF)
     }
 
     /// **arm_bypass_bd** — full-bypass Blu-ray rip (NO host cert needed).
     ///
-    /// Sets: `Ake = null` (drive acts pre-authenticated, so a bare VID read
-    /// returns the volume ID with no cert and no AKE) and `Hrl = skip`
-    /// (revocation off, so a revoked/absent cert never trips the HRL check).
-    /// Rips: BD with no cert.
+    /// Sets: `Encryption = off` (the consolidated cert/bus bypass — drive acts
+    /// pre-authenticated, no handshake, content de-bussed) and `Hrl = skip`
+    /// (revocation off). Rips: BD with no cert.
     pub fn arm_bypass_bd(&mut self) -> Result<()> {
         self.set_verify(Feature::Hrl, STATE_OFF)?;
-        self.set_verify(Feature::Ake, STATE_OFF)
+        self.set_verify(Feature::Encryption, STATE_OFF)
     }
 
     /// **arm_bypass_uhd** — full-bypass UHD rip (NO host cert needed).
     ///
-    /// Sets: `Uhd = on` (engage the UHD disc), `Ake = null` (skip the
-    /// handshake), `Bus = off` (content de-bussed), and `Hrl = skip`
-    /// (revocation off). Rips: UHD with no cert.
+    /// Sets: `Unrestricted = on` (engage the UHD disc), `Encryption = off`
+    /// (the consolidated cert/bus bypass), and `Hrl = skip` (revocation off).
+    /// Rips: UHD with no cert.
     pub fn arm_bypass_uhd(&mut self) -> Result<()> {
-        self.set_verify(Feature::Uhd, STATE_ON)?;
+        self.set_verify(Feature::Unrestricted, STATE_ON)?;
         self.set_verify(Feature::Hrl, STATE_OFF)?;
-        self.set_verify(Feature::Ake, STATE_OFF)?;
-        self.set_verify(Feature::Bus, STATE_OFF)
+        self.set_verify(Feature::Encryption, STATE_OFF)
     }
 
     /// **arm_stealth_oem** — return the drive to byte-for-byte OEM behaviour.

src/firmware/mod_tests.rs

@@ -13,18 +13,32 @@ fn verb_values_match_abi() {
     assert_eq!(Verb::Get as u8, 0x03);
     assert_eq!(Verb::Reset as u8, 0x04);
     assert_eq!(Verb::DumpAll as u8, 0x09);
+    assert_eq!(Verb::FlashWrite as u8, 0x0A);
     assert_eq!(Verb::Save as u8, 0x0B);
+    assert_eq!(Verb::Call as u8, 0x0C);
+    assert_eq!(Verb::Poke as u8, 0x0D);
+    assert_eq!(Verb::Reboot as u8, 0x0F);
 }
 
 #[test]
 fn feature_values_match_abi() {
     assert_eq!(Feature::Speed as u8, 0x01);
     assert_eq!(Feature::Region as u8, 0x02);
-    assert_eq!(Feature::Uhd as u8, 0x03);
-    assert_eq!(Feature::Bd as u8, 0x04);
+    assert_eq!(Feature::Unrestricted as u8, 0x03);
     assert_eq!(Feature::Hrl as u8, 0x05);
-    assert_eq!(Feature::Ake as u8, 0x06);
-    assert_eq!(Feature::Bus as u8, 0x07);
+    assert_eq!(Feature::Encryption as u8, 0x06);
+    // Wire id 0x04 (was `Bd`) is retired — fw 0.9.2 unified BD+UHD into
+    // Unrestricted; the BD slot is now unused/reserved (fw no-ops it).
+    // Wire id 0x07 (was `Bus`) is retired — proven inert on BU40N/MT1959.
+    assert_eq!(ALL_FEATURES.len(), 5);
+}
+
+#[test]
+fn debug_knock_distinct_from_safe_knock() {
+    // The fw dispatches Call/Poke ONLY under DEBUG_KNOCK; a typo of a safe verb
+    // vs a debug verb under the wrong knock never crosses the line.
+    assert_ne!(KNOCK, DEBUG_KNOCK);
+    assert_eq!(DEBUG_KNOCK, [0xDE, 0xB9]);
 }
 
 #[test]
@@ -52,21 +66,22 @@ fn state_and_frame_constants_match_abi() {
 
 #[test]
 fn build_set_cdb_exact_bytes() {
-    // SET Ake = ON: verb 02, feature 06, state 01, alloc MIN_ALLOC_LEN (0x0040)
-    // at cdb[7..9] big-endian — the drive aborts a sub-16-byte data-in.
+    // SET Encryption = ON: verb 02, feature 06, state 01, alloc MIN_ALLOC_LEN
+    // (0x0040) at cdb[7..9] big-endian — the drive aborts a sub-16-byte data-in.
     assert_eq!(
-        build_set_cdb(Feature::Ake, STATE_ON),
+        build_set_cdb(Feature::Encryption, STATE_ON),
         [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x06, 0x01, 0x00, 0x40, 0x00]
     );
 }
 
 #[test]
 fn build_get_cdb_exact_bytes() {
-    // GET Bus: verb 03, feature 07, alloc MIN_ALLOC_LEN (0x0040) at cdb[7..9]
-    // big-endian — the drive aborts a 1-byte data-in; state read from offset 0.
+    // GET Encryption: verb 03, feature 06, alloc MIN_ALLOC_LEN (0x0040) at
+    // cdb[7..9] big-endian — the drive aborts a 1-byte data-in; state read
+    // from offset 0.
     assert_eq!(
-        build_get_cdb(Feature::Bus),
-        [0x3C, 0x0E, 0xC0, 0xDE, 0x03, 0x07, 0x00, 0x00, 0x40, 0x00]
+        build_get_cdb(Feature::Encryption),
+        [0x3C, 0x0E, 0xC0, 0xDE, 0x03, 0x06, 0x00, 0x00, 0x40, 0x00]
     );
 }
 
@@ -78,12 +93,38 @@ fn vendor_commands_floor_alloc_len_at_min_for_hw() {
     assert_eq!(MIN_ALLOC_LEN, 64);
     let alloc =
         |cdb: &[u8; CDB_LEN]| u16::from_be_bytes([cdb[CDB_ALLOC_LEN], cdb[CDB_ALLOC_LEN + 1]]);
-    assert_eq!(alloc(&build_set_cdb(Feature::Ake, STATE_ON)), MIN_ALLOC_LEN);
-    assert_eq!(alloc(&build_get_cdb(Feature::Ake)), MIN_ALLOC_LEN);
+    assert_eq!(
+        alloc(&build_set_cdb(Feature::Encryption, STATE_ON)),
+        MIN_ALLOC_LEN
+    );
+    assert_eq!(alloc(&build_get_cdb(Feature::Encryption)), MIN_ALLOC_LEN);
     assert_eq!(alloc(&build_reset_cdb(RESET_TO_OEM)), MIN_ALLOC_LEN);
     assert_eq!(alloc(&build_save_cdb()), MIN_ALLOC_LEN);
 }
 
+#[test]
+fn build_call_and_poke_cdb_exact_bytes() {
+    // Call: verb 0x0C at cdb[4], DEBUG_KNOCK at cdb[2..4], target big-endian
+    // in cdb[5..9], r0 in cdb[9].
+    assert_eq!(
+        build_call_cdb(0x0102_0304, 0xAB),
+        [0x3C, 0x0E, 0xDE, 0xB9, 0x0C, 0x01, 0x02, 0x03, 0x04, 0xAB]
+    );
+    // Poke: verb 0x0D at cdb[4], DEBUG_KNOCK at cdb[2..4], target big-endian
+    // in cdb[5..9], value in cdb[9].
+    assert_eq!(
+        build_poke_cdb(0x0200_0E40, 0xAA),
+        [0x3C, 0x0E, 0xDE, 0xB9, 0x0D, 0x02, 0x00, 0x0E, 0x40, 0xAA]
+    );
+    // Reboot: verb 0x0F at cdb[4], DEBUG_KNOCK at cdb[2..4], no on-wire target
+    // (the boot-entry VA is baked into the handler at build time). Alloc floors
+    // at MIN_ALLOC_LEN (0x0040 at cdb[7..9]) so the data-in is not aborted.
+    assert_eq!(
+        build_reboot_cdb(),
+        [0x3C, 0x0E, 0xDE, 0xB9, 0x0F, 0x00, 0x00, 0x00, 0x40, 0x00]
+    );
+}
+
 #[test]
 fn build_reset_and_identity_cdb_exact_bytes() {
     // RESET carries its mode in the state slot (cdb[6]) and floors its data-in at
@@ -271,13 +312,13 @@ impl ScsiTransport for FwMock {
 #[test]
 fn identity_detects_freemkv_and_issues_identity_cdb() {
     let mut m = FwMock::new();
-    m.states.ake = STATE_ON;
+    m.states.encryption = STATE_ON;
     {
         let mut fw = FirmwareControl::new(&mut m);
         let id = fw.identity().expect("no fault").expect("is freemkv");
         assert_eq!(id.version, "0.6.6");
         // States no longer ride in IDENTITY — read them via GET.
-        assert_eq!(fw.get(Feature::Ake).expect("get"), STATE_ON);
+        assert_eq!(fw.get(Feature::Encryption).expect("get"), STATE_ON);
         assert!(fw.is_freemkv().expect("no fault"));
     }
     assert_eq!(m.cdbs[0], build_identity_cdb(MEMREAD_LEN as u16));
@@ -311,20 +352,19 @@ fn get_and_set_roundtrip_issue_the_right_cdbs() {
     let mut m = FwMock::new();
     {
         let mut fw = FirmwareControl::new(&mut m);
-        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_PASSTHROUGH);
-        fw.set(Feature::Bus, STATE_ON).expect("set");
-        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_ON);
+        assert_eq!(fw.get(Feature::Encryption).expect("get"), STATE_PASSTHROUGH);
+        fw.set(Feature::Encryption, STATE_ON).expect("set");
+        assert_eq!(fw.get(Feature::Encryption).expect("get"), STATE_ON);
     }
-    assert_eq!(m.cdbs[0], build_get_cdb(Feature::Bus));
-    assert_eq!(m.cdbs[1], build_set_cdb(Feature::Bus, STATE_ON));
-    assert_eq!(m.cdbs[2], build_get_cdb(Feature::Bus));
+    assert_eq!(m.cdbs[0], build_get_cdb(Feature::Encryption));
+    assert_eq!(m.cdbs[1], build_set_cdb(Feature::Encryption, STATE_ON));
+    assert_eq!(m.cdbs[2], build_get_cdb(Feature::Encryption));
 }
 
 #[test]
 fn reset_sends_reset_cdb_and_clears_state() {
     let mut m = FwMock::new();
-    m.states.ake = STATE_ON;
-    m.states.bus = STATE_ON;
+    m.states.encryption = STATE_ON;
     {
         let mut fw = FirmwareControl::new(&mut m);
         fw.reset().expect("reset");
@@ -350,12 +390,12 @@ fn save_then_reset_to_flash_restores_the_saved_value() {
     let mut m = FwMock::new();
     {
         let mut fw = FirmwareControl::new(&mut m);
-        fw.set(Feature::Bus, STATE_OFF).expect("set");
+        fw.set(Feature::Encryption, STATE_OFF).expect("set");
         fw.save().expect("save");
         fw.reset().expect("reset to OEM");
-        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_PASSTHROUGH);
+        assert_eq!(fw.get(Feature::Encryption).expect("get"), STATE_PASSTHROUGH);
         fw.reset_to_flash().expect("reset to flash");
-        assert_eq!(fw.get(Feature::Bus).expect("get"), STATE_OFF);
+        assert_eq!(fw.get(Feature::Encryption).expect("get"), STATE_OFF);
     }
     // The verbs issued, in order: SET, SAVE, RESET, GET, RESET, GET.
     assert_eq!(
@@ -386,10 +426,11 @@ fn states_probes_every_feature_in_order() {
     }
     assert_eq!(states.speed, SPEED_MAX);
     assert_eq!(states.hrl, STATE_ON);
-    // Seven GETs, one per feature, in ALL_FEATURES order.
-    assert_eq!(m.cdbs.len(), 7);
+    // Five GETs, one per feature, in ALL_FEATURES order (Bd id 0x04 and Bus id
+    // 0x07 both retired).
+    assert_eq!(m.cdbs.len(), 5);
     let features: Vec<u8> = m.cdbs.iter().map(|c| c[CDB_FEATURE]).collect();
-    assert_eq!(features, vec![0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07]);
+    assert_eq!(features, vec![0x01, 0x02, 0x03, 0x05, 0x06]);
     assert!(m.verbs().iter().all(|&v| v == Verb::Get as u8));
 }
 
@@ -413,28 +454,24 @@ fn typed_setters_issue_expected_set_cdbs() {
     let mut m = FwMock::new();
     {
         let mut fw = FirmwareControl::new(&mut m);
-        fw.enable_uhd().unwrap();
-        fw.disable_bd().unwrap();
+        fw.enable_unrestricted().unwrap();
         fw.skip_hrl().unwrap();
-        fw.null_ake().unwrap();
-        fw.bus_off().unwrap();
+        fw.disable_encryption().unwrap();
         fw.region_free().unwrap();
         fw.force_region_bd(BdRegion::B).unwrap();
         fw.force_region_dvd(2).unwrap();
         fw.unlock_speed().unwrap();
     }
-    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Uhd, STATE_ON));
-    assert_eq!(m.cdbs[1], build_set_cdb(Feature::Bd, STATE_OFF));
-    // The HRL/AKE/BUS unlock direction is now STATE_OFF (0x00), not STATE_ON.
-    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Hrl, STATE_OFF));
-    assert_eq!(m.cdbs[3], build_set_cdb(Feature::Ake, STATE_OFF));
-    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Bus, STATE_OFF));
+    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Unrestricted, STATE_ON));
+    // The HRL/Encryption unlock direction is STATE_OFF (0x00), not STATE_ON.
+    assert_eq!(m.cdbs[1], build_set_cdb(Feature::Hrl, STATE_OFF));
+    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Encryption, STATE_OFF));
     // Region-free is REGION_FREE (0x0F) — 0x01 now forces DVD region 1.
-    assert_eq!(m.cdbs[5], build_set_cdb(Feature::Region, REGION_FREE));
-    assert_eq!(m.cdbs[6], build_set_cdb(Feature::Region, REGION_BD_B));
+    assert_eq!(m.cdbs[3], build_set_cdb(Feature::Region, REGION_FREE));
+    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Region, REGION_BD_B));
     // force_region_dvd(2) = REGION_DVD_BASE + 2 = 0x02 under the new base.
-    assert_eq!(m.cdbs[7], build_set_cdb(Feature::Region, 0x02));
-    assert_eq!(m.cdbs[8], build_set_cdb(Feature::Speed, SPEED_MAX));
+    assert_eq!(m.cdbs[5], build_set_cdb(Feature::Region, 0x02));
+    assert_eq!(m.cdbs[6], build_set_cdb(Feature::Speed, SPEED_MAX));
 }
 
 #[test]
@@ -461,7 +498,7 @@ fn arm_oem_bd_sets_and_verifies_hrl_skip() {
 }
 
 #[test]
-fn arm_oem_uhd_sets_uhd_hrl_bus_each_verified() {
+fn arm_oem_uhd_sets_uhd_hrl_encryption_each_verified() {
     let mut m = FwMock::new();
     {
         let mut fw = FirmwareControl::new(&mut m);
@@ -474,53 +511,51 @@ fn arm_oem_uhd_sets_uhd_hrl_bus_each_verified() {
         vec![0x02, 0x03, 0x02, 0x03, 0x02, 0x03],
         "each set is verified by a get"
     );
-    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Uhd, STATE_ON));
+    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Unrestricted, STATE_ON));
     assert_eq!(m.cdbs[2], build_set_cdb(Feature::Hrl, STATE_OFF));
-    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Bus, STATE_OFF));
-    assert_eq!(m.states.uhd, STATE_ON);
+    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Encryption, STATE_OFF));
+    assert_eq!(m.states.unrestricted, STATE_ON);
     assert_eq!(m.states.hrl, STATE_OFF);
-    assert_eq!(m.states.bus, STATE_OFF);
+    assert_eq!(m.states.encryption, STATE_OFF);
 }
 
 #[test]
-fn arm_bypass_bd_nulls_ake() {
+fn arm_bypass_bd_disables_encryption() {
     let mut m = FwMock::new();
     {
         let mut fw = FirmwareControl::new(&mut m);
         fw.arm_bypass_bd().expect("armed");
     }
-    // Hrl=off (revocation skip) is set+verified FIRST, then Ake=null.
+    // Hrl=off (revocation skip) is set+verified FIRST, then Encryption=off.
     assert_eq!(m.cdbs[0], build_set_cdb(Feature::Hrl, STATE_OFF));
     assert_eq!(m.cdbs[1], build_get_cdb(Feature::Hrl));
-    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Ake, STATE_OFF));
-    assert_eq!(m.cdbs[3], build_get_cdb(Feature::Ake));
+    assert_eq!(m.cdbs[2], build_set_cdb(Feature::Encryption, STATE_OFF));
+    assert_eq!(m.cdbs[3], build_get_cdb(Feature::Encryption));
     assert_eq!(m.states.hrl, STATE_OFF);
-    assert_eq!(m.states.ake, STATE_OFF);
+    assert_eq!(m.states.encryption, STATE_OFF);
 }
 
 #[test]
-fn arm_bypass_uhd_sets_uhd_ake_bus() {
+fn arm_bypass_uhd_sets_uhd_hrl_encryption() {
     let mut m = FwMock::new();
     {
         let mut fw = FirmwareControl::new(&mut m);
         fw.arm_bypass_uhd().expect("armed");
     }
-    // Recipe order: Uhd=on, Hrl=off, Ake=null, Bus=off (each SET then verifying GET).
-    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Uhd, STATE_ON));
+    // Recipe order: Unrestricted=on, Hrl=off, Encryption=off (each SET then verifying GET).
+    assert_eq!(m.cdbs[0], build_set_cdb(Feature::Unrestricted, STATE_ON));
     assert_eq!(m.cdbs[2], build_set_cdb(Feature::Hrl, STATE_OFF));
-    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Ake, STATE_OFF));
-    assert_eq!(m.cdbs[6], build_set_cdb(Feature::Bus, STATE_OFF));
-    assert_eq!(m.states.uhd, STATE_ON);
+    assert_eq!(m.cdbs[4], build_set_cdb(Feature::Encryption, STATE_OFF));
+    assert_eq!(m.states.unrestricted, STATE_ON);
     assert_eq!(m.states.hrl, STATE_OFF);
-    assert_eq!(m.states.ake, STATE_OFF);
-    assert_eq!(m.states.bus, STATE_OFF);
+    assert_eq!(m.states.encryption, STATE_OFF);
 }
 
 #[test]
 fn arm_stealth_oem_resets_then_verifies_all_passthrough() {
     let mut m = FwMock::new();
-    m.states.ake = STATE_ON;
-    m.states.uhd = STATE_ON;
+    m.states.encryption = STATE_ON;
+    m.states.unrestricted = STATE_ON;
     {
         let mut fw = FirmwareControl::new(&mut m);
         fw.arm_stealth_oem().expect("disarmed");
@@ -539,7 +574,7 @@ fn arm_by_recipe_enum_dispatches() {
         let mut fw = FirmwareControl::new(&mut m);
         fw.arm(ArmRecipe::BypassBd).expect("armed");
     }
-    assert_eq!(m.states.ake, STATE_OFF);
+    assert_eq!(m.states.encryption, STATE_OFF);
 }
 
 #[test]

src/freemkv/mod.rs

@@ -11,11 +11,14 @@
 //! module's CDB builders so the wire framing never drifts.
 //!
 //! Unlock mapping onto the grammar: region-free = `Set(Region, free)`
-//! (`REGION_FREE`), riplock lift = `Set(Speed, max)` (`SPEED_MAX`), the
-//! load-bearing transport unlock = `Set(Ake, off)` (`STATE_OFF` — drive acts
-//! pre-authenticated → a bare `0xAD` returns the VID with no cert and no AKE), and
-//! the trailing bus-off = `Set(Bus, off)` (`STATE_OFF`, content de-bussed). Under
-//! the migrated spec the HRL/AKE/BUS unlock direction is `STATE_OFF`, not `0x01`.
+//! (`REGION_FREE`), riplock lift = `Set(Speed, max)` (`SPEED_MAX`), and the
+//! load-bearing transport unlock = `Set(Encryption, off)` (`STATE_OFF` — the
+//! consolidated cert/bus bypass: drive acts pre-authenticated → a bare `0xAD`
+//! returns the VID with no cert and no AKE, and content returns de-bussed).
+//! The old separate `Bus` lever (wire id `0x07`) is retired — it was proven
+//! inert on BU40N/MT1959, and the single `Encryption` lever de-busses on its
+//! own. Under the migrated spec the HRL/Encryption unlock direction is
+//! `STATE_OFF`, not `0x01`.
 
 use crate::firmware::{
     Feature, MEMREAD_LEN, MIN_ALLOC_LEN, REGION_FREE, RESP_MAGIC, SPEED_MAX, STATE_OFF,
@@ -162,8 +165,8 @@ impl FreemkvUnlocker {
     }
 
     // Full freemkv unlock: IDENTITY (hard gate) → Set(Region,free) →
-    // Set(Speed,max) (best-effort) → Set(Ake,off) (LOAD-BEARING) → bare 0xAD VID
-    // (best-effort) → Set(Bus,off) (trailing, best-effort).
+    // Set(Speed,max) (best-effort) → Set(Encryption,off) (LOAD-BEARING —
+    // consolidated cert/bus bypass) → bare 0xAD VID (best-effort).
     fn full_unlock(
         &self,
         scsi: &mut dyn ScsiTransport,
@@ -193,41 +196,30 @@ impl FreemkvUnlocker {
         // Region-free + riplock lift (best-effort features).
         best_effort(self.set(scsi, Feature::Region, REGION_FREE), "region")?;
         best_effort(self.set(scsi, Feature::Speed, SPEED_MAX), "speed")?;
-        // Ake = off/null (LOAD-BEARING): drive acts pre-authenticated, so a bare
-        // 0xAD returns the VID with no cert/AKE. No fallback. The migrated spec
-        // puts the null/bypass direction on STATE_OFF (0x00), not 0x01.
-        match self.set(scsi, Feature::Ake, STATE_OFF) {
+        // Encryption = off (LOAD-BEARING): the consolidated cert/bus bypass —
+        // drive acts pre-authenticated (bare 0xAD returns the VID with no
+        // cert/AKE) AND content returns de-bussed. No fallback.
+        match self.set(scsi, Feature::Encryption, STATE_OFF) {
             Ok(()) => {}
             Err(UnlockError::Transport) => return Err(UnlockError::Transport),
             Err(_) => {
                 tracing::debug!(
                     target: "freemkv::disc",
-                    phase = "freemkv_null_ake_rejected",
-                    "Set(Ake, null) rejected — cannot unlock this drive"
+                    phase = "freemkv_disable_encryption_rejected",
+                    "Set(Encryption, off) rejected — cannot unlock this drive"
                 );
                 return Err(UnlockError::VidUnavailable);
             }
         }
         // Bare 0xAD VID read — the shared BEST-EFFORT reader (identical to the
-        // LD/Renesas routes). The null AKE already unlocked the drive, so a VID
-        // miss must not discard it: only a dead bus propagates (`?`), else `None`.
+        // LD/Renesas routes). Encryption=off already unlocked the drive, so a
+        // VID miss must not discard it: only a dead bus propagates (`?`), else `None`.
         let vid = crate::vid::read_aacs_vid(scsi)?;
-        // Trailing Set(Bus, off): remove in-transit bus encryption (STATE_OFF is
-        // the de-bussed direction). FULLY best-effort — inert without the lever,
-        // and a failure here never discards an already-obtained unlock.
-        if let Err(e) = self.set(scsi, Feature::Bus, STATE_OFF) {
-            tracing::debug!(
-                target: "freemkv::disc",
-                phase = "freemkv_bus_off_unavailable",
-                ?e,
-                "bus-off (Set Bus) not applied; continuing"
-            );
-        }
         tracing::debug!(
             target: "freemkv::disc",
             phase = "freemkv_unlocked",
             has_vid = vid.is_some(),
-            "freemkv drive unlocked (null AKE — Ake=off)"
+            "freemkv drive unlocked (Encryption=off — consolidated cert/bus bypass)"
         );
         Ok(Unlocked { vid, bus_key: None })
     }
@@ -370,15 +362,12 @@ mod tests {
             build_set_cdb(Feature::Speed, SPEED_MAX),
             [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x01, 0x00, 0x00, 0x40, 0x00]
         );
-        // Ake/Bus unlock direction is now STATE_OFF (0x00) at cdb[6], not 0x01.
+        // Encryption unlock direction is STATE_OFF (0x00) at cdb[6]; wire id
+        // 0x07 (was `Bus`) is retired.
         assert_eq!(
-            build_set_cdb(Feature::Ake, STATE_OFF),
+            build_set_cdb(Feature::Encryption, STATE_OFF),
             [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x06, 0x00, 0x00, 0x40, 0x00]
         );
-        assert_eq!(
-            build_set_cdb(Feature::Bus, STATE_OFF),
-            [0x3C, 0x0E, 0xC0, 0xDE, 0x02, 0x07, 0x00, 0x00, 0x40, 0x00]
-        );
     }
 
     // ── Detection ────────────────────────────────────────────────────────
@@ -437,19 +426,19 @@ mod tests {
     }
 
     #[test]
-    fn set_ake_null_issues_the_set_ake_on_cdb() {
+    fn set_encryption_off_issues_the_set_encryption_cdb() {
         let mut t = MockTransport::always(Reply::good(vec![]));
         FreemkvUnlocker::new()
-            .set(&mut t, Feature::Ake, STATE_OFF)
+            .set(&mut t, Feature::Encryption, STATE_OFF)
             .expect("ok");
-        assert_eq!(t.cdbs[0], build_set_cdb(Feature::Ake, STATE_OFF));
+        assert_eq!(t.cdbs[0], build_set_cdb(Feature::Encryption, STATE_OFF));
     }
 
     #[test]
     fn set_drive_rejection_is_not_applicable() {
         let mut t = MockTransport::always(Reply::illegal_request());
         let err = FreemkvUnlocker::new()
-            .set(&mut t, Feature::Ake, STATE_OFF)
+            .set(&mut t, Feature::Encryption, STATE_OFF)
             .unwrap_err();
         assert_eq!(err, UnlockError::NotApplicable);
     }
@@ -465,19 +454,18 @@ mod tests {
 
     // ── full_unlock / unlock ─────────────────────────────────────────────
 
-    /// The full unlock runs IDENTITY → Set(Region) → Set(Speed) → Set(Ake) →
-    /// bare VID → Set(Bus) in order.
+    /// The full unlock runs IDENTITY → Set(Region) → Set(Speed) →
+    /// Set(Encryption) → bare VID in order.
     #[test]
-    fn full_unlock_issues_identity_region_speed_ake_then_bare_vid_then_bus() {
+    fn full_unlock_issues_identity_region_speed_encryption_then_bare_vid() {
         let vid = [0x7Cu8; 16];
         let mut t = MockTransport::scripted(
             vec![
                 Reply::good(freemkv_identity_payload()), // IDENTITY
                 Reply::good(vec![]),                     // Set Region
                 Reply::good(vec![]),                     // Set Speed
-                Reply::good(vec![]),                     // Set Ake (load-bearing)
+                Reply::good(vec![]),                     // Set Encryption (load-bearing)
                 Reply::good(vid_ds_response(vid)),       // 0xAD bare VID
-                Reply::good(vec![]),                     // Set Bus (trailing)
             ],
             Reply::TransportFault,
         );
@@ -485,16 +473,15 @@ mod tests {
         let out = FreemkvUnlocker::new()
             .unlock(&mut t, &ctx(&id))
             .expect("no fault")
-            .expect("null AKE ⇒ unlocked");
+            .expect("encryption off ⇒ unlocked");
         assert_eq!(out.vid, Some(vid));
-        assert_eq!(t.cdbs.len(), 6);
-        // The four vendor SETs land on the right features, in order.
+        assert_eq!(t.cdbs.len(), 5);
+        // The three vendor SETs land on the right features, in order.
         assert_eq!(t.cdbs[0], build_identity_cdb(RESP_LEN as u16));
         assert_eq!(t.cdbs[1], build_set_cdb(Feature::Region, REGION_FREE));
         assert_eq!(t.cdbs[2], build_set_cdb(Feature::Speed, SPEED_MAX));
-        assert_eq!(t.cdbs[3], build_set_cdb(Feature::Ake, STATE_OFF));
+        assert_eq!(t.cdbs[3], build_set_cdb(Feature::Encryption, STATE_OFF));
         assert_eq!(t.cdbs[4][0], crate::scsi::SCSI_READ_DISC_STRUCTURE);
-        assert_eq!(t.cdbs[5], build_set_cdb(Feature::Bus, STATE_OFF));
     }
 
     /// A missing region/speed feature does not fail the unlock (best-effort).
@@ -519,17 +506,17 @@ mod tests {
         assert_eq!(out.vid, Some(vid));
     }
 
-    /// The null AKE is LOAD-BEARING: if the drive rejects it, this isn't an
-    /// unlockable freemkv drive, so `unlock()` declines (`None`) and falls
-    /// through — never a hard error.
+    /// Set(Encryption, off) is LOAD-BEARING: if the drive rejects it, this
+    /// isn't an unlockable freemkv drive, so `unlock()` declines (`None`) and
+    /// falls through — never a hard error.
     #[test]
-    fn declines_when_null_ake_rejected() {
+    fn declines_when_disable_encryption_rejected() {
         let mut t = MockTransport::scripted(
             vec![
                 Reply::good(freemkv_identity_payload()), // identity
                 Reply::good(vec![]),                     // region
                 Reply::good(vec![]),                     // speed
-                Reply::illegal_request(),                // null ake REJECTED
+                Reply::illegal_request(),                // Set(Encryption,off) REJECTED
             ],
             Reply::TransportFault,
         );
@@ -542,8 +529,9 @@ mod tests {
         );
     }
 
-    /// Best-effort VID: the null AKE succeeded (drive unlocked), but the bare
-    /// VID read was rejected — `unlock()` still returns `Some`, with `vid: None`.
+    /// Best-effort VID: Set(Encryption,off) succeeded (drive unlocked), but the
+    /// bare VID read was rejected — `unlock()` still returns `Some`, with
+    /// `vid: None`.
     #[test]
     fn unlocks_without_vid_when_bare_read_fails() {
         let mut t = MockTransport::scripted(
@@ -551,7 +539,7 @@ mod tests {
                 Reply::good(freemkv_identity_payload()), // identity
                 Reply::good(vec![]),                     // region
                 Reply::good(vec![]),                     // speed
-                Reply::good(vec![]),                     // null ake
+                Reply::good(vec![]),                     // Set(Encryption,off)
                 Reply::illegal_request(),                // bare VID: no medium
             ],
             Reply::TransportFault,

src/ld/mod.rs

@@ -8,7 +8,7 @@
 
 // `cdb` is only the bdemu emulator's wire format (real unlocking uses profile
 // templates), gated behind `emulation`; also compiled under `cfg(test)` so its
-// wire-format tests run in default-feature CI. See docs/ld-mod.md — cdb gating.
+// wire-format tests run in default-feature CI.
 #[cfg(any(feature = "emulation", test))]
 mod cdb;
 mod error;
@@ -21,7 +21,7 @@ use crate::{DriveId, UnlockCtx, UnlockError, Unlocked, Unlocker};
 
 // ── Public profile catalog ──────────────────────────────────────────────────
 // Only the catalog is public (supported-drive lookup, used by bdemu); the
-// unlock mechanism stays private. See docs/ld-mod.md — public catalog design.
+// unlock mechanism stays private.
 
 pub use profile::{DriveProfile as Profile, Identity, Platform, ProfileMatch, Profiles};
 
@@ -122,7 +122,7 @@ impl LdUnlocker {
 impl LdUnlocker {
     // The MediaTek firmware unlock. Since it removes AACS at the drive (clear
     // content), this one op satisfies both features and bus-removal, so both
-    // trait methods delegate here. See docs/ld-mod.md — firmware_unlock contract.
+    // trait methods delegate here.
     fn firmware_unlock(
         &self,
         scsi: &mut dyn ScsiTransport,
@@ -144,7 +144,7 @@ impl LdUnlocker {
         mt.init(scsi)?;
         // `init` only proves the handshake completed, not that the drive reached
         // extended-access state. Reporting unlocked off `init` alone shipped
-        // ciphertext at rc=0. See docs/ld-mod.md — half-unlock fallback.
+        // ciphertext at rc=0.
         if !mt.is_unlocked() {
             tracing::warn!(
                 target: "freemkv::disc",
@@ -159,7 +159,7 @@ impl LdUnlocker {
         if let Err(e) = mt.probe_disc(scsi) {
             // A transport fault here is a dead bus, not a calibration miss — most
             // profiles never touch the bus again, so this was the only dead-bus
-            // signal. See docs/ld-mod.md — probe_disc dead-bus classification.
+            // signal.
             if e.is_transport_failure() {
                 tracing::warn!(
                     target: "freemkv::disc",
@@ -432,7 +432,6 @@ mod tests {
 
     // THE probe-disc dead-bus test: bus dies during speed calibration after a
     // full unlock; must abort with Transport, not report a successful unlock.
-    // See docs/ld-mod.md — probe_disc dead-bus test / mutation notes.
     #[test]
     fn transport_fault_during_probe_disc_is_transport_not_a_successful_unlock() {
         let id = known_vid_drive_id();

src/ld/platform/mt1959/mod.rs

@@ -127,7 +127,7 @@ impl Mt1959 {
         let result = scsi.execute(&cdb, DataDirection::FromDevice, buf, 5_000)?;
         // A drive sense arrives as `Ok` with a non-zero status; a merely
         // SHORT response is the drive answering badly — neither is a dead
-        // bus. See docs/mt1959.md — short-probe-not-transport-failure.
+        // bus.
         if result.status != 0 || result.bytes_transferred != expected {
             return Err(Error::Scsi {
                 opcode: SCSI_READ_BUFFER,
@@ -181,7 +181,7 @@ impl Mt1959 {
 
         // `response` is a fixed 64-byte buffer; the meaningful bound is how
         // many bytes the drive actually delivered. Require enough bytes to
-        // validate before checking markers, up front. See docs/mt1959.md — min-unlock-response-length.
+        // validate before checking markers, up front.
         let n = result.bytes_transferred.min(response.len());
         if n < MIN_UNLOCK_RESPONSE {
             tracing::debug!(
@@ -206,7 +206,6 @@ impl Mt1959 {
 
         // Extended-access state requires the signature match AND both the
         // primary marker at [12..16] AND the secondary marker at [16..20].
-        // See docs/mt1959.md — unlock-marker-gating.
         self.unlocked =
             response[FIRMWARE_MODE_OFFSET..FIRMWARE_MODE_OFFSET + 4] == FIRMWARE_MODE_SIG;
 
@@ -282,7 +281,7 @@ impl Mt1959 {
                     return Err(Error::UnlockFailed);
                 }
                 // A dead bus must abort here, not be retried three times as
-                // firmware reloads. See docs/mt1959.md — run-init-transport-fault.
+                // firmware reloads.
                 Err(e) if e.is_transport_failure() => {
                     tracing::warn!(
                         target: "freemkv::disc",
@@ -349,7 +348,7 @@ impl Mt1959 {
         }
 
         // Detect disc type from capacity to select probe mode (BD vs UHD
-        // init address). See docs/mt1959.md — probe-init-address-detection.
+        // init address).
         let cap_cdb = [
             SCSI_READ_CAPACITY,
             0x00,
@@ -368,7 +367,7 @@ impl Mt1959 {
         let cap = scsi.execute(&cap_cdb, DataDirection::FromDevice, &mut cap_buf, 5_000)?;
         let disc_sectors = if cap.status == 0 && cap.bytes_transferred >= 4 {
             // last_lba + 1 = sector count; saturate on the 32-bit-overflow
-            // sentinel rather than wrap to 0. See docs/mt1959.md — capacity-saturation.
+            // sentinel rather than wrap to 0.
             u32::from_be_bytes([cap_buf[0], cap_buf[1], cap_buf[2], cap_buf[3]]).saturating_add(1)
         } else {
             0
@@ -413,7 +412,7 @@ impl Mt1959 {
             {
                 // A dead bus MUST keep its transport classification; a
                 // short/rejected reply is the drive's own failure and stays
-                // `UnlockFailed`. See docs/mt1959.md — probe-failure-classification.
+                // `UnlockFailed`.
                 if e.is_transport_failure() {
                     return Err(e);
                 }
@@ -423,7 +422,6 @@ impl Mt1959 {
         }
 
         // Pass 2: continue past the coarse range (do not restart at 0).
-        // See docs/mt1959.md — probe-pass-overlap-fix.
         let mut addr: u32 = PROBE_COARSE_END as u32;
         while addr < PROBE_FINE_END {
             let mut resp = [0u8; PROBE_RESPONSE_SIZE as usize];
@@ -436,7 +434,7 @@ impl Mt1959 {
             ) {
                 // Fine probing is best-effort — a short/rejected reply just ends
                 // the sweep early, but a transport fault must keep its
-                // classification and abort. See docs/mt1959.md — probe-pass2-transport-fault.
+                // classification and abort.
                 if e.is_transport_failure() {
                     tracing::warn!(
                         target: "freemkv::disc",
@@ -696,7 +694,7 @@ mod tests {
 
     // THE defect-15 test: a zero-byte response used to skip every marker
     // check (each individually `n >= ..` guarded) and report a fully
-    // unlocked drive. See docs/mt1959.md — defect-15.
+    // unlocked drive.
     #[test]
     fn do_unlock_rejects_a_zero_length_response() {
         let sig = [0x99, 0x9E, 0xC3, 0x75];
@@ -776,7 +774,7 @@ mod tests {
 
     // THE defect-4 test: a dead bus must abort `run_init` at once, not
     // re-upload firmware on all three attempts and return the generic
-    // `UnlockFailed`. See docs/mt1959.md — defect-4.
+    // `UnlockFailed`.
     #[test]
     fn run_init_aborts_on_a_transport_fault_without_reloading_firmware() {
         let mut t =
@@ -894,7 +892,7 @@ mod tests {
 
     // THE probe pass-1 dead-bus test: a bus that dies during the coarse
     // probe must keep its transport classification so the caller aborts
-    // with `Transport`. See docs/mt1959.md — pass1-dead-bus-mutation.
+    // with `Transport`.
     #[test]
     fn transport_fault_during_pass1_probe_stays_a_transport_failure() {
         let mut t = ProbeFaultsTransport { fault_at: 0 };
@@ -909,7 +907,7 @@ mod tests {
 
     // THE probe pass-2 dead-bus test: the loop used to `break` on ANY
     // error and return `Ok(())`, swallowing a dead bus mid-pass-2. It
-    // must now propagate. See docs/mt1959.md — pass2-dead-bus-mutation.
+    // must now propagate.
     #[test]
     fn transport_fault_during_pass2_probe_stays_a_transport_failure() {
         let mut t = ProbeFaultsTransport {
@@ -952,7 +950,7 @@ mod tests {
 
     // variant_a's firmware-verify-read transport-abort branch: WRITE_BUFFER
     // succeeds, the 0x45 verify read faults — a dead bus must abort there,
-    // not be swallowed into the unlock retries. See docs/mt1959.md — variant-a-verify-read-transport-abort.
+    // not be swallowed into the unlock retries.
     #[test]
     fn variant_a_verify_read_transport_fault_aborts() {
         let mut profile = fixture_profile([0; 4]);
@@ -1013,7 +1011,7 @@ mod tests {
 
     // variant_b's firmware-upload step (here the metadata read) hitting a
     // dead bus must abort via `trace_step`, not be swallowed into the
-    // unlock retries. See docs/mt1959.md — variant-b-upload-step-transport-abort.
+    // unlock retries.
     #[test]
     fn variant_b_upload_step_transport_fault_aborts() {
         let mut profile = fixture_profile([0; 4]);

src/ld/platform/mt1959/variant_b.rs

@@ -13,7 +13,6 @@ const FIRMWARE_EXTRA: [u8; 16] = [0; 16];
 /// that drive — real profiles must supply their own (see `DriveProfile`).
 const VENDOR_VERIFY: [u8; 10] = [0xF1, 0x01, 0x02, 0x00, 0x0D, 0x30, 0x01, 0xF3, 0xAD, 0x23];
 
-// See docs/variant-b-firmware-upload.md — trace_step rationale.
 // Swallows everything except a transport fault; these steps are advisory,
 // the unlock retries below are the real gate.
 fn trace_step(phase: &'static str, r: crate::scsi::Result<crate::scsi::ScsiResult>) -> Result<()> {
@@ -58,7 +57,7 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
         return Err(crate::ld::error::Error::UnlockFailed);
     }
 
-    // Step 1: Upload the firmware via MODE SELECT (see docs/variant-b-firmware-upload.md).
+    // Step 1: Upload the firmware via MODE SELECT.
     // MODE SELECT(10)'s parameter-list length is 16-bit, so reject only a
     // blob that can't be expressed in the CDB.
     let write_len = firmware.len();
@@ -124,8 +123,6 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
     )?;
 
     // Step 4: Vendor verify (0xF1 — B-only, not standard SCSI), per-drive.
-    // See docs/variant-b-firmware-upload.md for why the outcome is traced
-    // rather than discarded.
     let verify_cdb = mt.profile.fw_verify_cdb.unwrap_or(VENDOR_VERIFY);
     let mut dummy = [0u8; 0];
     trace_step(
@@ -134,8 +131,7 @@ pub(super) fn load_firmware(mt: &mut Mt1959, scsi: &mut dyn ScsiTransport) -> Re
     )?;
 
     // Step 5: Unlock retries (up to 5, then a final fatal attempt). The
-    // confirmation pass after success is intentionally best-effort — see
-    // docs/variant-b-firmware-upload.md.
+    // confirmation pass after success is intentionally best-effort.
     for _attempt in 0..5 {
         match mt.do_unlock(scsi) {
             Ok(_) => {

src/renesas/mod.rs

@@ -24,8 +24,7 @@ const RENESAS_MARKER_OFFSET: usize = 16;
 /// interface tag. A rejection (CHECK CONDITION or `Err` with a sense) is
 /// `Ok(false)`: not a Renesas drive.
 ///
-/// `Err(Transport)` on a dead bus. See docs/renesas-mod.md for why a
-/// transport fault must not be folded into `Ok(false)`.
+/// `Err(Transport)` on a dead bus.
 pub fn is_renesas(scsi: &mut dyn ScsiTransport) -> std::result::Result<bool, UnlockError> {
     let mut buf = [0u8; RB_F1_LEN];
     match scsi.execute(&RB_F1_CDB, DataDirection::FromDevice, &mut buf, 5_000) {
@@ -71,8 +70,7 @@ impl Renesas {
     }
 
     // MakeMKV's vendor "open" sequence: primary read (A), and on refusal a
-    // knock + second read (B). See docs/renesas-mod.md for the full sequence
-    // and why we run A→knock→B rather than bailing after A.
+    // knock + second read (B).
     fn vendor_open(scsi: &mut dyn ScsiTransport) -> std::result::Result<bool, UnlockError> {
         const RB_B0_04_CDB: [u8; 10] = [0x3C, 0x02, 0xB0, 0x00, 0x00, 0x04, 0x00, 0x00, 0xA4, 0x00];
         const KNOCK_A5AAAA_CDB: [u8; 10] =
@@ -128,7 +126,7 @@ impl Unlocker for Renesas {
     /// best-effort `0xAD` reader. `Some` once the open succeeds — the drive
     /// serves clear content whether or not the bonus VID read did; `None` if it
     /// isn't a Renesas drive or the open is refused; `Err(Transport)` on a dead
-    /// bus. See docs/renesas-mod.md for the MakeMKV-parity rationale.
+    /// bus.
     fn unlock(
         &self,
         scsi: &mut dyn ScsiTransport,
@@ -188,7 +186,7 @@ mod tests {
     }
 
     // Rejects like a MediaTek drive: ILLEGAL REQUEST with a sense, which is
-    // what distinguishes this from a dead bus. See docs/renesas-mod.md.
+    // what distinguishes this from a dead bus.
     struct RejectingTransport;
     impl ScsiTransport for RejectingTransport {
         fn execute(
@@ -280,7 +278,7 @@ mod tests {
     }
 
     // Same rejection via a CONFORMING transport (`Ok` + CHECK CONDITION);
-    // must reach the same answer. See docs/renesas-mod.md.
+    // must reach the same answer.
     #[test]
     fn check_condition_is_not_a_renesas_drive() {
         use crate::scsi::mock::{MockTransport, Reply};
@@ -308,7 +306,7 @@ mod tests {
 
     // A recognized Renesas drive whose A read (RB 0xB0@0x04) is REFUSED but
     // whose B read (RB 0xB0@0x50) SUCCEEDS after the knock must unlock — and the
-    // knock CDB has to be issued BETWEEN A and B. See docs/renesas-mod.md.
+    // knock CDB has to be issued BETWEEN A and B.
     #[test]
     fn knock_runs_between_a_and_b_and_b_opens() {
         // The exact knock CDB the code issues (pinned wire format).
@@ -395,7 +393,7 @@ mod tests {
     }
 
     // A recognized Renesas drive that REFUSES the vendor open read must
-    // defer to the next unlocker, not claim the drive. See docs/renesas-mod.md.
+    // defer to the next unlocker, not claim the drive.
     #[test]
     fn open_rejection_defers_to_next_unlocker() {
         struct GateOkOpenRefused;

src/vid.rs

@@ -8,7 +8,7 @@
 //! BEST-EFFORT: only a dead bus is an `Err(Transport)`. A CHECK CONDITION, a
 //! short response, or an all-zero VID all yield `Ok(None)` — a VID miss must
 //! never discard an unlock that already removed the bus (a key source can still
-//! supply the key). See docs/freemkv-abi.md for the fixed-length reply rules.
+//! supply the key).
 
 use crate::UnlockError;
 use crate::scsi::{DataDirection, ScsiTransport};