AacsState (public via Disc.aacs) and Key (the decrypt_with key-transport enum) are crate-root re-exported and carried VUK/unit/read-data keys + volume id on #[derive(Debug)]; HandshakeResult carried the VID + AACS 2.0 bus key. Manual Debug impls print shape only, guarded by red->green tests.