v0.16.3: i18n damage display

- Add rip.damage_lost, rip.damage_lost_movie, rip.damage_lost_simple, rip.damage_none keys
- Update all 6 locale files (en, es, fr, de, it, pt, nl)
- CLI progress shows 'Xs lost (Y in movie)' instead of 'Xs unreadable'
- Perfect rips show '0s' instead of '0s unreadable'

CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 0.16.1 (2026-04-30)
+
+### Unified progress display for sweep and patch
+
+- Patch passes now show `bytes_good / disc_total` as GB (grows when sectors are recovered), with pass progress `%` using `work_done / work_total` (always advances). `Xs unreadable` declines as data is recovered. Same UI for all pass types.
+
+## 0.16.0 (2026-04-30)
+
+### IOKit registry-based drive enumeration, BSD name matching, reverse patch default
+
+- **`shim_open_exclusive`** now matches the correct `IOBDServices` for the requested BSD name. Walks all IOBDServices entries in the IOKit registry, matches child IOMedia `"BSD Name"` property. Falls back to IOMedia parent walk, then first-match. Fixes multi-drive systems.
+- **`shim_list_drives`** (new): registry-based drive enumeration. Reads IOBDServices `"Device Characteristics"` for vendor/model/firmware and child IOMedia for BSD name. Zero SCSI, zero exclusive access, zero unmounts. Fixes the enumeration blast that unmounted every disk on the system.
+- **`list_drives()`** and **`find_drives()`** rewritten to use `shim_list_drives`. No longer iterates `/dev/disk0..15` opening exclusive SCSI on each.
+- **`patch_internal`** defaults `reverse: true`. Sweep jumps forward with escalating gaps, so NonTrimmed ranges have good data at their tail. Reverse patch hits good data first, converges on actual bad block boundaries.
+
+## 0.15.1 (2026-04-30)
+
+### Fix damage-jump detection, fix dispatch covers_disc check
+
+- Damage-jump tuning: `DAMAGE_WINDOW=16`, `DAMAGE_THRESHOLD_PCT=12%` (was 50/25%). Old params were too diluted by good reads between sparse failures; new params trigger on 2nd scattered failure.
+- `Disc::copy()` dispatch: `covers_disc` now checks `map.total_size() == disc_size` (byte-for-byte, not approximate). Fixes false sweep dispatch when mapfile exists but doesn't cover full disc.
+- Sweep resume: when dispatched from existing mapfile with NonTried, passes `resume: true`.
+
+## 0.15.0 (2026-04-30)
+
+### Multipass dispatch rewrite, speed control on damage zone entry/exit
+
+- `CopyOptions { decrypt, multipass, progress, halt }`. `Disc::copy()` auto-detects sweep vs patch from mapfile state: no mapfile → sweep, NonTried → sweep with resume, only NonTrimmed/NonScraped/Unreadable → patch, clean → no-op.
+- `Disc::mapfile_for()`: `/dev/null` output → `/tmp/<disc_name>.mapfile`, otherwise `mapfile_path_for(path)`.
+- Speed control: damage zone entry → `set_speed(0x0000)` (minimum), 16 consecutive good reads → `set_speed(0xFFFF)` (maximum). Drive manages optimal speed in clean sections.
+- `SET CD SPEED` SCSI command via `SectorReader::set_speed()` (default no-op, Drive impl sends SCSI).
+
+## 0.14.0 (2026-04-30)
+
+### Damage-jump algorithm replaces probe, bridge degradation detection
+
+- Damage-jump algorithm: when damage threshold exceeded in sliding window, jump ahead by `256×batch×multiplier` sectors. Doubles multiplier on each jump. Zero-fills gap as NonTrimmed.
+- `ecc_sectors()`: returns ECC block size per disc format (32 for UHD, 16 for BD, 16 for DVD).
+- Bridge degradation detection: NOT READY with sense key 2/ASC 0x04/ASCQ 0x3E triggers 10s cooldown, up to 5 times before treating as bad sector.
+
 ## 0.13.43 (2026-04-29)
 
 ### Pass 1 transport-failure recovery loop

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "libfreemkv"
-version = "0.14.0"
+version = "0.16.3"
 edition = "2024"
 rust-version = "1.86"
 license = "AGPL-3.0-only"

docs/drive-access.md

@@ -99,7 +99,6 @@ descriptors or calls ioctls outside of a `ScsiTransport` implementation.
 |----------|---------------|--------|
 | Linux | `SgIoTransport` — async `write`/`poll`/`read` on `/dev/sg*` | `/dev/sg*` |
 | macOS | `MacScsiTransport` — IOKit SCSITask | IOKit service |
-| Windows | `WindowsScsiTransport` — SPTI | `\\.\CdRomN` |
 
 The Linux backend uses the sg driver's asynchronous interface: `write()` submits
 the command, `poll()` waits with an enforceable wall-clock timeout, `read()`
@@ -107,6 +106,17 @@ retrieves the result. If `poll()` times out, the fd is abandoned (closed in a
 background thread) and a fresh fd opened — the kernel's USB error recovery
 cannot block us. Opens with `O_RDWR | O_NONBLOCK`.
 
+The macOS backend uses a C shim (`macos_shim.c`) for IOKit exclusive access.
+The shim handles:
+1. `shim_open_exclusive(bsd_name)` — unmounts the target device via `diskutil`,
+   then walks the IOKit registry to find the `IOBDServices` matching the
+   requested BSD name (IOBDServices → IOBDBlockStorageDriver → IOMedia → "BSD Name"),
+   then creates MMCDeviceInterface → SCSITaskDeviceInterface → ObtainExclusiveAccess.
+2. `shim_list_drives()` — registry-based enumeration with zero SCSI, zero exclusive
+   access, zero unmounts. Reads IOBDServices "Device Characteristics" for
+   vendor/model/firmware and child IOMedia "BSD Name" for the device path.
+3. `shim_execute()` / `shim_close()` — raw CDB dispatch and cleanup.
+
 On non-zero SCSI status, the transport parses sense key from the sense buffer
 and returns `Error::ScsiError`.
 

docs/rip-recovery.md

@@ -62,52 +62,51 @@ Position and size are hex byte offsets into the ISO.
 
 ### `CopyOptions` and `PatchOptions`
 
-Defaults preserve pre-`0.11.21` behavior — abort on the first unreadable
-sector. Opt in to the recovery-friendly path:
+`Disc::copy()` auto-detects the pass from mapfile state:
 
 ```rust
 CopyOptions {
-    skip_on_error: true,   // zero-fill bad blocks, continue
-    skip_forward: true,    // exponential skip-forward after a failure
-    resume: true,          // pick up from an existing ISO + mapfile
-    decrypt: false,        // keep the ISO a raw disc image
-    ..Default::default()
+    decrypt: true,     // decrypt AACS/CSS sectors
+    multipass: true,   // enable mapfile + skip-on-error + damage-jump
+    progress: Some(&reporter),  // progress callback
+    halt: Some(flag),  // halt flag for graceful stop
 }
 ```
 
+Dispatch logic:
+- No mapfile → sweep (fresh Pass 1)
+- Mapfile with NonTried (`?`) → sweep with resume
+- Mapfile covering full disc, only NonTrimmed/NonScraped/Unreadable → patch
+- Mapfile clean → no-op
+
 ## Algorithm
 
-### Pass 1 — fast sweep (`Disc::copy`)
+### Pass 1 — fast sweep (`Disc::copy` → `sweep_internal`)
 
-1. Read 64 KB (32 sectors, one BD ECC block) at the current LBA via
-   `Drive::read(.., recovery=false)` — short 1.5 s timeout, single shot.
-2. On success: mark the range `+`, advance by one block.
-3. On failure (with `skip_on_error`): zero-fill the block in the ISO, mark
-   it `*`, advance.
-4. If `skip_forward` is set: after a failure, jump ahead by an exponentially
-   growing amount (256 KB initial, doubling on consecutive failures, capped at
-   1% of disc). The skipped bytes are also marked `*` — `patch` will visit
-   them later.
-5. Reset the skip size to 256 KB on the first success after a failure.
+1. Read one ECC block (32 sectors for UHD, 16 for BD/DVD) at the current LBA.
+2. On success: write data to ISO, mark `+`, advance.
+3. On failure (with `multipass`): zero-fill, mark `*`, advance.
+4. Track a sliding window of the last 16 ECC block results. When ≥12% are failures
+   → **damage-jump**: skip ahead by `256×batch×multiplier` sectors (8 MB base for
+   UHD). Double the multiplier on each jump (8→16→32→64 MB...). Zero-fill the gap as `*`.
+5. On 16 consecutive good reads: reset jump multiplier to 1, restore max read speed.
+6. Speed control: damage zone entry → minimum speed, exit → maximum speed.
+7. Only transport failures (USB bridge crash) abort the pass.
 
-Pass 1 completes when every byte has terminal status (`+`, `-`, or the caller
-bails via the halt flag).
+Pass 1 completes when every byte has been visited (either `+` or `*`).
 
-### Pass 2+ — patch (`Disc::patch`)
+### Pass 2+ — patch (`Disc::copy` → `patch_internal`)
 
-`Disc::patch` reads the mapfile and iterates every non-`+` range. For each:
+`Disc::patch` reads the mapfile and iterates every non-`+` range. Default: **reverse** mode
+(walks ranges from highest LBA to lowest, within each range from end to start).
 
-1. Issue a drive read via `Drive::read(.., recovery=true)` — long 30 s
-   timeout, still single shot. Drive firmware does its own ECC and retries
-   inside that window; userspace does not pile on additional retries here.
-2. On success: write the good bytes into the ISO at the exact byte offset,
-   mark `+`.
-3. On failure: mark `-`.
-4. Update the mapfile after every block — crash-safe resume.
-
-Idempotent. Call `patch` N times for N retry attempts; typically the caller
-stops early if a pass recovers zero bytes (structure-protected sectors will
-never yield).
+1. Issue a single-sector read with 60 s timeout (`recovery=true`). Drive firmware
+   does its own ECC recovery inside that window.
+2. On success: write the good bytes into the ISO, mark `+`.
+3. On failure with non-marginal SCSI sense: bail immediately (drive won't produce data).
+4. On failure with marginal sense: mark `-`, continue.
+5. Update the mapfile after every block — crash-safe resume.
+6. Wedged-drive exit: 50 consecutive failures with zero recovery → bail this pass.
 
 ### In-stream — adaptive batch halving (`DiscStream::fill_extents`)
 

src/disc/mapfile.rs

@@ -316,11 +316,7 @@ impl Mapfile {
         {
             let file = std::fs::File::create(&tmp)?;
             let mut w = std::io::BufWriter::new(file);
-            writeln!(
-                w,
-                "# Rescue Logfile. Created by {}",
-                self.version
-            )?;
+            writeln!(w, "# Rescue Logfile. Created by {}", self.version)?;
             writeln!(w, "# Current pos / status / pass / pass_time")?;
             writeln!(w, "0x000000000  ?  1  0")?;
             writeln!(w, "#      pos        size  status")?;

src/drive/macos.rs

@@ -1,26 +1,25 @@
 //! macOS drive discovery and device resolution.
+//!
+//! `find_drives` uses IOKit registry enumeration (via `scsi::list_drives`)
+//! to discover optical drives without exclusive access or unmounts. Only
+//! the returned paths are then opened for INQUIRY to build full `DriveId`.
 
 use crate::error::{Error, Result};
 use crate::identity::DriveId;
 
 pub fn find_drives() -> Vec<(String, DriveId)> {
     let mut drives = Vec::new();
-    for i in 0..16 {
-        let path = format!("/dev/disk{}", i);
-        if !std::path::Path::new(&path).exists() {
-            continue;
-        }
-        match crate::scsi::open(std::path::Path::new(&path)) {
+    let discovered = crate::scsi::list_drives();
+    for info in discovered {
+        let path = std::path::Path::new(&info.path);
+        match crate::scsi::open(path) {
             Ok(mut transport) => {
                 if let Ok(id) = DriveId::from_drive(transport.as_mut()) {
-                    if !id.raw_inquiry.is_empty() && (id.raw_inquiry[0] & 0x1F) == 0x05 {
-                        drives.push((path, id));
-                    }
+                    drives.push((info.path.clone(), id));
                 }
             }
             Err(_) => {
-                // Device exists but can't be opened (likely mounted).
-                // Use `diskutil unmountDisk /dev/diskN` to unmount before accessing.
+                continue;
             }
         }
     }

src/drive/mod.rs

@@ -599,6 +599,10 @@ impl SectorReader for Drive {
     ) -> Result<usize> {
         self.read(lba, count, buf, recovery)
     }
+
+    fn set_speed(&mut self, kbs: u16) {
+        Drive::set_speed(self, kbs);
+    }
 }
 
 /// Find the first optical drive on this system and open it.

src/error.rs

@@ -543,7 +543,7 @@ impl Error {
     ///     classified as fatal; treat as recoverable
     ///
     /// Returns `false` for transport failures (no sense data delivered),
-    /// HARDWARE ERROR, DATA PROTECT, UNIT ATTENTION, NOT READY, ILLEGAL
+    /// HARDWARE ERROR, DATA PROTECT, UNIT ATTENTION, ILLEGAL
     /// REQUEST, BLANK CHECK, kernel `IoError`, and any non-SCSI variant.
     /// Caller-agnostic predicate — describes a property of the *error*,
     /// not what one specific call site should do with it. Used by

src/progress.rs

@@ -39,19 +39,22 @@ pub enum PassKind {
 #[derive(Debug, Clone, Copy)]
 pub struct PassProgress {
     pub kind: PassKind,
-    /// Bytes processed in this pass so far. Monotonically non-decreasing.
     pub work_done: u64,
-    /// Total bytes this pass will process. Constant for the duration of
-    /// the pass.
     pub work_total: u64,
-    /// Cumulative bytes confirmed clean (`Finished` mapfile state) across
-    /// every pass run on this rip. Doesn't change across pass boundaries.
     pub bytes_good_total: u64,
-    /// Cumulative bytes marked bad (`NonTrimmed` + `NonScraped` +
-    /// `Unreadable`) across every pass run on this rip.
-    pub bytes_bad_total: u64,
-    /// Total disc capacity in bytes. Constant.
+    pub bytes_unreadable_total: u64,
+    pub bytes_pending_total: u64,
     pub bytes_total_disc: u64,
+    pub disc_duration_secs: Option<f64>,
+    /// How many bytes of the worst-case damage (unreadable + pending) fall
+    /// within the main title's extents. Zero means none of the damage
+    /// affects the main movie — it's all in extras/menus.
+    pub bytes_bad_in_main_title: u64,
+    /// Main title duration in seconds. Same as disc_duration_secs when the
+    /// disc has one dominant title, but separate so consumers can show both.
+    pub main_title_duration_secs: Option<f64>,
+    /// Main title size in bytes (sum of extent sizes).
+    pub main_title_size_bytes: Option<u64>,
 }
 
 /// A consumer of pipeline progress events. Library code calls

src/scsi/macos.rs

@@ -4,11 +4,15 @@
 //! through `SCSITaskDeviceInterface::ExecuteTaskSync` — 1:1 with the Linux
 //! SG_IO backend. The C shim (`macos_shim.c`) handles:
 //!
-//! 1. `diskutil unmountDisk force` so the kernel block-storage driver releases
-//! 2. Find `IOBDServices` directly via `IOServiceMatching` (not IOMedia walk)
+//! 1. `diskutil unmountDisk force` on the target device only
+//! 2. Find `IOBDServices` matching the requested BSD name (walks IOKit
+//!    registry: IOBDServices → IOBDBlockStorageDriver → IOMedia → BSD Name)
 //! 3. Create `MMCDeviceInterface` → `SCSITaskDeviceInterface`
 //! 4. `ObtainExclusiveAccess`
 //! 5. Raw CDB dispatch via `CreateSCSITask` + `ExecuteTaskSync`
+//!
+//! Drive enumeration (`list_drives`) uses the IOKit registry directly via
+//! `shim_list_drives` — no exclusive access, no SCSI commands, no unmounts.
 
 use super::{DataDirection, ScsiResult, ScsiTransport};
 use crate::error::{Error, Result};
@@ -16,6 +20,15 @@ use std::path::Path;
 
 const K_SENSE_DATA_SIZE: usize = 32;
 
+#[repr(C)]
+#[derive(Copy, Clone)]
+struct ShimDriveInfo {
+    bsd_name: [u8; 32],
+    vendor: [u8; 32],
+    model: [u8; 48],
+    firmware: [u8; 16],
+}
+
 unsafe extern "C" {
     fn shim_open_exclusive(bsd_name: *const u8) -> i32;
     fn shim_close();
@@ -30,6 +43,7 @@ unsafe extern "C" {
         task_status_out: *mut u8,
         transfer_count: *mut u64,
     ) -> i32;
+    fn shim_list_drives(out: *mut ShimDriveInfo, max_entries: i32) -> i32;
 }
 
 pub struct MacScsiTransport {
@@ -131,42 +145,38 @@ impl ScsiTransport for MacScsiTransport {
     }
 }
 
-// ── Drive enumeration ────────────────────────────────────────────────────
+// ── Drive enumeration (registry-based, no exclusive access) ──────────────
 
 pub(super) fn list_drives() -> Vec<super::DriveInfo> {
+    let mut buf = [ShimDriveInfo {
+        bsd_name: [0; 32],
+        vendor: [0; 32],
+        model: [0; 48],
+        firmware: [0; 16],
+    }; 8];
+
+    let count = unsafe { shim_list_drives(buf.as_mut_ptr(), buf.len() as i32) };
+
     let mut out = Vec::new();
-    for i in 0..K_DEV_DISK_MAX {
-        let path = format!("/dev/disk{i}");
-        if !std::path::Path::new(&path).exists() {
-            continue;
-        }
-        let mut transport = match MacScsiTransport::open(std::path::Path::new(&path)) {
-            Ok(t) => t,
-            Err(_) => continue,
-        };
-        let inquiry = match super::inquiry(&mut transport) {
-            Ok(r) => r,
-            Err(_) => continue,
-        };
-        if inquiry.raw.is_empty()
-            || (inquiry.raw[K_INQUIRY_TYPE_BYTE] & K_INQUIRY_TYPE_MASK) != K_SCSI_TYPE_OPTICAL
-        {
+    for info in buf.iter().take((count as usize).min(buf.len())) {
+        let bsd_name = cstr_to_str(&info.bsd_name);
+        if bsd_name.is_empty() {
             continue;
         }
         out.push(super::DriveInfo {
-            path,
-            vendor: inquiry.vendor_id,
-            model: inquiry.model,
-            firmware: inquiry.firmware,
+            path: format!("/dev/{bsd_name}"),
+            vendor: cstr_to_str(&info.vendor).to_string(),
+            model: cstr_to_str(&info.model).to_string(),
+            firmware: cstr_to_str(&info.firmware).to_string(),
         });
     }
     out
 }
 
-const K_DEV_DISK_MAX: u8 = 16;
-const K_INQUIRY_TYPE_BYTE: usize = 0;
-const K_INQUIRY_TYPE_MASK: u8 = 0x1F;
-const K_SCSI_TYPE_OPTICAL: u8 = 0x05;
+fn cstr_to_str(bytes: &[u8]) -> &str {
+    let end = bytes.iter().position(|&b| b == 0).unwrap_or(bytes.len());
+    std::str::from_utf8(&bytes[..end]).unwrap_or("")
+}
 
 pub(super) fn drive_has_disc(path: &Path) -> Result<bool> {
     let mut transport = MacScsiTransport::open(path)?;

src/scsi/macos_shim.c

@@ -1,10 +1,13 @@
 #include <IOKit/IOKitLib.h>
 #include <IOKit/IOCFPlugIn.h>
 #include <IOKit/scsi/SCSITaskLib.h>
+#include <CoreFoundation/CoreFoundation.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
+// ── Types ──────────────────────────────────────────────────────────────────
+
 typedef struct {
     IOCFPlugInInterface      **plugin;
     MMCDeviceInterface       **mmc;
@@ -12,8 +15,196 @@ typedef struct {
     int                        exclusive;
 } ShimHandle;
 
+typedef struct {
+    char bsd_name[32];
+    char vendor[32];
+    char model[48];
+    char firmware[16];
+} ShimDriveInfo;
+
+// ── Global handle (single-drive, same as before) ──────────────────────────
+
 static ShimHandle g_handle = {NULL, NULL, NULL, 0};
 
+// ── Registry helpers ──────────────────────────────────────────────────────
+
+static int cfstring_to_cstr(CFStringRef cf, char *buf, size_t buflen) {
+    if (!cf) return 0;
+    if (!CFStringGetCString(cf, buf, buflen, kCFStringEncodingUTF8)) return 0;
+    return 1;
+}
+
+static int registry_entry_bsd_name(io_registry_entry_t entry, char *buf, size_t buflen) {
+    CFStringRef cf = IORegistryEntryCreateCFProperty(entry, CFSTR("BSD Name"),
+        kCFAllocatorDefault, 0);
+    if (!cf) return 0;
+    int ok = cfstring_to_cstr(cf, buf, buflen);
+    CFRelease(cf);
+    return ok;
+}
+
+static io_registry_entry_t find_iomedia_child(io_registry_entry_t parent) {
+    io_iterator_t iter;
+    kern_return_t kr = IORegistryEntryGetChildIterator(parent, kIOServicePlane, &iter);
+    if (kr != KERN_SUCCESS) return 0;
+
+    io_registry_entry_t child;
+    while ((child = IOIteratorNext(iter)) != 0) {
+        char cls[128];
+        kr = IOObjectGetClass(child, cls);
+        if (kr == KERN_SUCCESS) {
+            if (strcmp(cls, "IOMedia") == 0) {
+                IOObjectRelease(iter);
+                return child;
+            }
+        }
+        IOObjectRelease(child);
+    }
+    IOObjectRelease(iter);
+    return 0;
+}
+
+static io_registry_entry_t find_child_of_class(io_registry_entry_t parent, const char *target_class) {
+    io_iterator_t iter;
+    kern_return_t kr = IORegistryEntryGetChildIterator(parent, kIOServicePlane, &iter);
+    if (kr != KERN_SUCCESS) return 0;
+
+    io_registry_entry_t child;
+    while ((child = IOIteratorNext(iter)) != 0) {
+        char cls[128];
+        kr = IOObjectGetClass(child, cls);
+        if (kr == KERN_SUCCESS && strcmp(cls, target_class) == 0) {
+            IOObjectRelease(iter);
+            return child;
+        }
+        IOObjectRelease(child);
+    }
+    IOObjectRelease(iter);
+    return 0;
+}
+
+static io_registry_entry_t find_parent_of_class(io_registry_entry_t entry, const char *target_class) {
+    io_registry_entry_t parent;
+    kern_return_t kr = IORegistryEntryGetParentEntry(entry, kIOServicePlane, &parent);
+    if (kr != KERN_SUCCESS) return 0;
+
+    char cls[128];
+    kr = IOObjectGetClass(parent, cls);
+    if (kr == KERN_SUCCESS && strcmp(cls, target_class) == 0) {
+        return parent;
+    }
+    IOObjectRelease(parent);
+    return 0;
+}
+
+// Given an IOBDServices, find the BSD name of its IOMedia child.
+// Chain: IOBDServices -> IOBDBlockStorageDriver -> IOMedia (has "BSD Name")
+static int bdsvc_to_bsd_name(io_registry_entry_t bdsvc, char *buf, size_t buflen) {
+    io_registry_entry_t driver = find_child_of_class(bdsvc, "IOBDBlockStorageDriver");
+    if (!driver) return 0;
+
+    io_registry_entry_t media = find_iomedia_child(driver);
+    IOObjectRelease(driver);
+    if (!media) return 0;
+
+    int ok = registry_entry_bsd_name(media, buf, buflen);
+    IOObjectRelease(media);
+    return ok;
+}
+
+// Given an IOBDServices, extract Device Characteristics strings.
+static void bdsvc_device_info(io_registry_entry_t bdsvc, ShimDriveInfo *info) {
+    CFDictionaryRef dc = IORegistryEntryCreateCFProperty(bdsvc,
+        CFSTR("Device Characteristics"), kCFAllocatorDefault, 0);
+    if (!dc) return;
+
+    CFStringRef val;
+
+    val = CFDictionaryGetValue(dc, CFSTR("Vendor Name"));
+    if (val) cfstring_to_cstr(val, info->vendor, sizeof(info->vendor));
+
+    val = CFDictionaryGetValue(dc, CFSTR("Product Name"));
+    if (val) cfstring_to_cstr(val, info->model, sizeof(info->model));
+
+    val = CFDictionaryGetValue(dc, CFSTR("Product Revision Level"));
+    if (val) cfstring_to_cstr(val, info->firmware, sizeof(info->firmware));
+
+    CFRelease(dc);
+}
+
+// Find the IOBDServices that owns the given BSD name.
+// Returns a retained io_service_t (caller must release), or 0.
+static io_service_t find_bdsvc_by_bsd_name(mach_port_t mp, const char *bsd_name) {
+    CFMutableDictionaryRef matching = IOServiceMatching("IOBDServices");
+    if (!matching) return 0;
+
+    io_iterator_t iter;
+    kern_return_t kr = IOServiceGetMatchingServices(mp, matching, &iter);
+    if (kr != KERN_SUCCESS) return 0;
+
+    io_service_t result = 0;
+    io_service_t svc;
+    while ((svc = IOIteratorNext(iter)) != 0) {
+        char name[64];
+        if (bdsvc_to_bsd_name(svc, name, sizeof(name))) {
+            if (strcmp(name, bsd_name) == 0) {
+                result = svc;
+                break;
+            }
+        }
+        IOObjectRelease(svc);
+    }
+
+    if (!result) {
+        IOIteratorReset(iter);
+        while ((svc = IOIteratorNext(iter)) != 0) {
+            IOObjectRelease(svc);
+        }
+    }
+
+    IOObjectRelease(iter);
+    return result;
+}
+
+// Find the IOBDServices that owns the given BSD name by walking from
+// IOMedia upward. Used as fallback when bdsvc_to_bsd_name fails
+// (e.g. disc under exclusive access, no IOMedia child).
+// Chain: IOMedia -> IOBDBlockStorageDriver -> IOBDServices
+static io_service_t find_bdsvc_from_iomedia(mach_port_t mp, const char *bsd_name) {
+    CFMutableDictionaryRef matching = IOServiceMatching("IOMedia");
+    if (!matching) return 0;
+
+    io_iterator_t iter;
+    kern_return_t kr = IOServiceGetMatchingServices(mp, matching, &iter);
+    if (kr != KERN_SUCCESS) return 0;
+
+    io_service_t result = 0;
+    io_service_t media;
+    while ((media = IOIteratorNext(iter)) != 0) {
+        char name[64];
+        if (registry_entry_bsd_name(media, name, sizeof(name))
+            && strcmp(name, bsd_name) == 0)
+        {
+            io_registry_entry_t driver = find_parent_of_class(media, "IOBDBlockStorageDriver");
+            if (driver) {
+                io_registry_entry_t bdsvc = find_parent_of_class(driver, "IOBDServices");
+                IOObjectRelease(driver);
+                if (bdsvc) {
+                    result = bdsvc;
+                    IOObjectRelease(media);
+                    break;
+                }
+            }
+        }
+        IOObjectRelease(media);
+    }
+
+    IOObjectRelease(iter);
+    return result;
+}
+
+// ── Public API ────────────────────────────────────────────────────────────
+
 int shim_open_exclusive(const char *bsd_name) {
     kern_return_t kr;
     HRESULT hr;
@@ -31,8 +222,14 @@ int shim_open_exclusive(const char *bsd_name) {
     mach_port_t mp;
     IOMainPort(0, &mp);
 
-    CFMutableDictionaryRef matching = IOServiceMatching("IOBDServices");
-    io_service_t svc = IOServiceGetMatchingService(mp, matching);
+    io_service_t svc = find_bdsvc_by_bsd_name(mp, bsd_name);
+    if (!svc) {
+        svc = find_bdsvc_from_iomedia(mp, bsd_name);
+    }
+    if (!svc) {
+        CFMutableDictionaryRef matching = IOServiceMatching("IOBDServices");
+        svc = IOServiceGetMatchingService(mp, matching);
+    }
     if (!svc) return -1;
 
     kr = IOCreatePlugInInterfaceForService(svc,
@@ -140,3 +337,40 @@ int shim_execute(const unsigned char *cdb, unsigned char cdb_len,
 
     return (int)kr;
 }
+
+// ── Registry-based drive enumeration ──────────────────────────────────────
+//
+// Walks IOBDServices entries in the IOKit registry. No exclusive access,
+// no SCSI commands, no unmounts. Returns up to max_entries drives.
+
+int shim_list_drives(ShimDriveInfo *out, int max_entries) {
+    mach_port_t mp;
+    IOReturn ret = IOMainPort(0, &mp);
+    if (ret != kIOReturnSuccess) return 0;
+
+    CFMutableDictionaryRef matching = IOServiceMatching("IOBDServices");
+    if (!matching) return 0;
+
+    io_iterator_t iter;
+    kern_return_t kr = IOServiceGetMatchingServices(mp, matching, &iter);
+    if (kr != KERN_SUCCESS) return 0;
+
+    int count = 0;
+    io_service_t svc;
+    while ((svc = IOIteratorNext(iter)) != 0 && count < max_entries) {
+        ShimDriveInfo *info = &out[count];
+        memset(info, 0, sizeof(*info));
+
+        bdsvc_device_info(svc, info);
+        bdsvc_to_bsd_name(svc, info->bsd_name, sizeof(info->bsd_name));
+
+        if (info->bsd_name[0]) {
+            count++;
+        }
+
+        IOObjectRelease(svc);
+    }
+
+    IOObjectRelease(iter);
+    return count;
+}

src/scsi/mod.rs

@@ -145,12 +145,14 @@ impl ScsiSense {
     /// (or a brief retry) sometimes succeeds:
     ///
     ///   - `MEDIUM ERROR` (3) — canonical bad-sector signal
+    ///   - `NOT READY` (2) — on many drives (notably BU40N), this is the
+    ///     dominant response for unreadable sectors (ASC 04/3E, 04/01, etc.)
     ///   - `ABORTED COMMAND` (B) — transient; retry usually works
     ///   - `RECOVERED ERROR` (1) / `NO SENSE` (0) — drive is healthy and
     ///     either recovered the data or has no specific fault to report
     ///
-    /// `false` for HARDWARE ERROR, DATA PROTECT, UNIT ATTENTION, NOT
-    /// READY, ILLEGAL REQUEST, BLANK CHECK, and any unknown key. Used
+    /// `false` for HARDWARE ERROR, DATA PROTECT, UNIT ATTENTION,
+    /// ILLEGAL REQUEST, BLANK CHECK, and any unknown key. Used
     /// by [`Error::is_marginal_read`] / `Disc::copy`'s hysteresis
     /// dispatch.
     pub fn is_marginal(&self) -> bool {
@@ -158,6 +160,7 @@ impl ScsiSense {
             self.sense_key,
             SENSE_KEY_NO_SENSE
                 | SENSE_KEY_RECOVERED_ERROR
+                | SENSE_KEY_NOT_READY
                 | SENSE_KEY_MEDIUM_ERROR
                 | SENSE_KEY_ABORTED_COMMAND
         )

src/sector.rs

@@ -24,6 +24,8 @@ pub trait SectorReader: Send {
     fn capacity(&self) -> u32 {
         0
     }
+
+    fn set_speed(&mut self, _kbs: u16) {}
 }
 
 /// SectorReader backed by a file (ISO image).

tests/integration_progress_and_halt.rs

@@ -438,7 +438,7 @@ fn test_disc_copy_completes_full_disc_with_failing_reader() {
 
     let opts = CopyOptions {
         decrypt: false,
-        skip_on_error: true,
+        multipass: true,
 
         ..Default::default()
     };
@@ -518,7 +518,7 @@ fn test_disc_copy_halts_promptly_on_failing_reader() {
 
     let opts = CopyOptions {
         decrypt: false,
-        skip_on_error: true,
+        multipass: true,
 
         halt: Some(halt),
         ..Default::default()
@@ -593,7 +593,7 @@ impl SectorReader for BlockSizeFailingReader {
 #[test]
 fn test_disc_copy_marks_failed_ecc_blocks_as_nontrimmed() {
     let capacity_sectors: u32 = 256;
-    let total_bytes: u64 = capacity_sectors as u64 * SECTOR_SIZE as u64;
+    let _total_bytes: u64 = capacity_sectors as u64 * SECTOR_SIZE as u64;
 
     let mut reader = BlockSizeFailingReader {
         capacity: capacity_sectors,
@@ -606,7 +606,7 @@ fn test_disc_copy_marks_failed_ecc_blocks_as_nontrimmed() {
 
     let opts = CopyOptions {
         decrypt: false,
-        skip_on_error: true,
+        multipass: true,
 
         ..Default::default()
     };
@@ -634,3 +634,164 @@ fn test_disc_copy_marks_failed_ecc_blocks_as_nontrimmed() {
         "complete=false when sectors remain NonTrimmed"
     );
 }
+
+// ── 9. PassProgress carries separate unreadable vs pending byte counts ─────
+//
+// The video-damage-time display needs bytes_unreadable_total (confirmed dead)
+// separate from bytes_pending_total (might still recover). This test verifies
+// that a Pass 2 with some confirmed failures produces correct field values.
+
+#[test]
+fn test_pass_progress_separates_unreadable_from_pending() {
+    let capacity_sectors: u32 = 128;
+    let total_bytes: u64 = capacity_sectors as u64 * SECTOR_SIZE as u64;
+
+    let mut reader = FailingSectorReader::new(capacity_sectors);
+    let disc = synthetic_disc(capacity_sectors);
+
+    let tmp = tempfile::NamedTempFile::new().expect("tempfile create");
+    let iso_path = tmp.path().to_path_buf();
+    drop(tmp);
+
+    let opts = CopyOptions {
+        decrypt: false,
+        multipass: true,
+        ..Default::default()
+    };
+
+    let pass1 = disc.copy(&mut reader, &iso_path, &opts).expect("pass1 ok");
+
+    assert_eq!(pass1.bytes_good, 0, "pass1: no good sectors");
+    assert_eq!(pass1.bytes_unreadable, 0, "pass1: no confirmed unreadable");
+    assert_eq!(
+        pass1.bytes_pending, total_bytes,
+        "pass1: all sectors NonTrimmed"
+    );
+
+    let last_unreadable = Arc::new(AtomicU64::new(0));
+    let last_pending = Arc::new(AtomicU64::new(0));
+    let last_good = Arc::new(AtomicU64::new(0));
+    let last_dur = Arc::new(AtomicU64::new(0));
+
+    struct SnapshotReporter {
+        unreadable: Arc<AtomicU64>,
+        pending: Arc<AtomicU64>,
+        good: Arc<AtomicU64>,
+        dur: Arc<AtomicU64>,
+    }
+    impl libfreemkv::progress::Progress for SnapshotReporter {
+        fn report(&self, p: &libfreemkv::progress::PassProgress) {
+            self.unreadable
+                .store(p.bytes_unreadable_total, Ordering::Relaxed);
+            self.pending.store(p.bytes_pending_total, Ordering::Relaxed);
+            self.good.store(p.bytes_good_total, Ordering::Relaxed);
+            if let Some(d) = p.disc_duration_secs {
+                self.dur.store((d * 1000.0) as u64, Ordering::Relaxed);
+            }
+        }
+    }
+    let reporter = SnapshotReporter {
+        unreadable: last_unreadable.clone(),
+        pending: last_pending.clone(),
+        good: last_good.clone(),
+        dur: last_dur.clone(),
+    };
+
+    let pass2_opts = CopyOptions {
+        decrypt: false,
+        multipass: true,
+        progress: Some(&reporter),
+        ..Default::default()
+    };
+
+    let pass2 = disc
+        .copy(&mut reader, &iso_path, &pass2_opts)
+        .expect("pass2 ok");
+
+    let _ = std::fs::remove_file(&iso_path);
+    let _ = std::fs::remove_file(libfreemkv::disc::mapfile_path_for(&iso_path));
+
+    assert_eq!(
+        pass2.bytes_good, 0,
+        "pass2: still no good sectors (reader always fails)"
+    );
+    assert!(
+        pass2.bytes_unreadable > 0,
+        "pass2: some sectors confirmed unreadable"
+    );
+    assert!(
+        pass2.bytes_pending < pass1.bytes_pending,
+        "pass2: fewer pending sectors than pass1"
+    );
+
+    let observed_unreadable = last_unreadable.load(Ordering::Relaxed);
+    let observed_pending = last_pending.load(Ordering::Relaxed);
+    assert!(
+        observed_unreadable > 0,
+        "progress should report confirmed unreadable bytes"
+    );
+    assert!(
+        observed_pending == 0 || observed_pending < total_bytes,
+        "pending should shrink as sectors are confirmed unreadable"
+    );
+
+    // Video damage time: unreadable / total * duration
+    // With no titles on synthetic disc, disc_duration_secs = None
+    assert_eq!(
+        last_dur.load(Ordering::Relaxed),
+        0,
+        "synthetic disc has no titles, duration should be None/0"
+    );
+}
+
+// ── 10. Damage time calculation (unit test) ────────────────────────────────
+//
+// Verifies the formula: damage_secs = bytes_unreadable / bytes_total * duration
+// This mirrors the CLI's print_disc_progress logic.
+
+#[test]
+fn test_damage_time_calculation() {
+    // 78.8 GB disc, 2h45m movie (9900s), 74 KB unreadable
+    let disc_bytes: u64 = 78_800_000_000;
+    let duration_secs: f64 = 9900.0;
+
+    let cases: Vec<(u64, &str)> = vec![
+        (74 * 1024, "~10ms"),          // 74 KB → ~9ms, negligible
+        (10 * 1024 * 1024, "~1.3s"),   // 10 MB → ~1.3s
+        (100 * 1024 * 1024, "~13s"),   // 100 MB → ~13s
+        (1024 * 1024 * 1024, "~134s"), // 1 GB → ~134s
+    ];
+
+    for (bad_bytes, label) in cases {
+        let damage_secs = bad_bytes as f64 / disc_bytes as f64 * duration_secs;
+        match label {
+            "~10ms" => assert!(damage_secs < 0.05, "{label}: {damage_secs:.3}s"),
+            "~1.3s" => assert!(
+                (damage_secs - 1.3).abs() < 0.2,
+                "{label}: {damage_secs:.2}s"
+            ),
+            "~13s" => assert!(
+                (damage_secs - 13.0).abs() < 1.0,
+                "{label}: {damage_secs:.1}s"
+            ),
+            "~134s" => assert!(
+                (damage_secs - 134.0).abs() < 2.0,
+                "{label}: {damage_secs:.0}s"
+            ),
+            _ => {}
+        }
+    }
+
+    // 0.25s threshold: how many bad bytes = 0.25s of damage?
+    let threshold_bytes = (0.25 / duration_secs * disc_bytes as f64) as u64;
+    assert!(
+        threshold_bytes > 0,
+        "0.25s damage threshold should be > 0 bytes"
+    );
+    // At 9900s / 78.8 GB ≈ 0.25s = ~2 MB
+    let expected_mb = threshold_bytes as f64 / (1024.0 * 1024.0);
+    assert!(
+        (expected_mb - 2.0).abs() < 0.5,
+        "0.25s ≈ {expected_mb:.2} MB (expected ~2 MB)"
+    );
+}

tests/scsi_error_decoding.rs

@@ -203,7 +203,10 @@ fn test_check_cond_not_ready_predicate() {
 
     let sense = err.scsi_sense().expect("CHECK CONDITION must carry sense");
     assert!(sense.is_not_ready(), "sense_key 2 ⇒ is_not_ready");
-    assert!(!err.is_marginal_read(), "NOT READY is not marginal");
+    assert!(
+        err.is_marginal_read(),
+        "NOT READY is marginal (BU40N returns this for bad sectors)"
+    );
 }
 
 // ── 5. CHECK CONDITION + MEDIUM ERROR (canonical marginal-read) ───────────

tests/scsi_recovery.rs

@@ -8,7 +8,6 @@
 //!
 //! These tests require a real /dev/sg* device and are therefore #[ignore].
 
-use libfreemkv::scsi::{DataDirection, SCSI_STATUS_TRANSPORT_FAILURE};
 use std::path::Path;
 use std::time::Duration;
 
@@ -17,16 +16,17 @@ use std::time::Duration;
 fn test_sgio_transport_timeout_does_not_kill_transport() {
     let device = "/dev/sg2";
     let device = std::env::var("FREEMKV_TEST_SG_DEVICE").unwrap_or(device.to_string());
-    let path = Path::new(&device);
+    let _path = Path::new(&device);
 
     #[cfg(target_os = "linux")]
     {
         use libfreemkv::scsi::ScsiTransport;
         use libfreemkv::scsi::linux::SgIoTransport;
+        use libfreemkv::scsi::{DataDirection, SCSI_STATUS_TRANSPORT_FAILURE};
         use std::sync::Arc;
         use std::sync::atomic::{AtomicI32, Ordering};
 
-        let mut transport = SgIoTransport::open(path).expect("open device");
+        let mut transport = SgIoTransport::open(_path).expect("open device");
         let fd_before = transport.fd;
 
         // READ_10 with 1 ms timeout to force kernel timeout.
@@ -90,11 +90,11 @@ fn test_sgio_transport_timeout_does_not_kill_transport() {
 fn test_drive_read_per_cdb_timeout_bounds_call() {
     let device = "/dev/sg2";
     let device = std::env::var("FREEMKV_TEST_SG_DEVICE").unwrap_or(device.to_string());
-    let path = Path::new(&device);
+    let _path = Path::new(&device);
 
     #[cfg(target_os = "linux")]
     {
-        let mut drive = libfreemkv::Drive::open(path).expect("open drive");
+        let mut drive = libfreemkv::Drive::open(_path).expect("open drive");
         let timeout_ms: u32 = 5_000;
 
         let start = std::time::Instant::now();