# USB enumeration deterministic recovery-test v2 software candidate

Status: complete
Result: complete; historical qualification-only software evidence
Type: evidence
Updated: 2026-08-01
Next Action: none; the exact candidate passed its bounded target proof
Campaign: 003-complete-bounded-hpt-slow-export-firmware-ticket
Final Evidence: work/evidence/usb-enumeration-deterministic-v2-target-proof-20260801.md

Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/completed/wp-restore-broad-usb-compatibility-baseline.md
Checklist: work/checklists/checklist-stage-1b-four-drive-usb-compatibility-baseline.md
Supersedes: work/evidence/usb-enumeration-deterministic-test-software-candidate-20260801.md

## Outcome

Source commit `4032ab50` corrects the qualification-only test mechanism after
the first deterministic attempt proved three injected failures but did not
exercise production recovery. The first target attempt is explicitly invalid
as recovery proof: USBX consumed another already-queued root-hub signal,
mounted `USB03_32G`, and left recovery attempt count at `0`.

The v2 hook still injects `UX_TRANSFER_ERROR` before address, descriptor,
class, or FileX ownership on exactly the three native root-port enumeration
attempts. Only after the third injected failure, and only while the exact
J-Link-only one-shot is spent, it:

- records and clears already-queued root-hub signals for the tested root port;
- boundedly consumes already-queued enumeration-semaphore signals with
  `UX_NO_WAIT`, capped at 16;
- records but does not clear the HCD transfer-thread signal;
- records the final disposition and allows USBX to publish its native final
  unconfigured enumeration failure.

The production recovery code is unchanged. The qualification hook does not
alter VBUS, device identity, USBHS settings, storage transport, FileX writes,
the 32 KiB cap, customer operations, or production retry policy. It cannot arm
from the controller UI and rejects mounted or non-fresh baselines.

## Software gates

- Focused USB source/configuration policy: PASS.
- USB write-size diagnostic policy: PASS, 9/9.
- HPT customer export invariants: PASS, 34/34.
- USB transaction inventory: PASS.
- USB workflow host models: PASS, 9/9.
- Code-review mitigations: PASS, 15/15.
- SD CID invariants: PASS, 25/25.
- Qualification PowerShell parser: PASS.
- Canonical managed Debug rebuild: PASS.
- Canonical managed Release rebuild: PASS.
- Debug and Release packaging: PASS; stable and versioned S-records match.
- Command/injection/recovery symbol sizes: `0x04 / 0x30 / 0x40`, PASS in
  Debug and Release.

## Exact candidate artifacts

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `work/evidence/generated/usb-enumeration-deterministic-test-v2-candidate-20260801/7520553_SMI_FW-Debug.elf` | 14,696,832 | `9D045845C0AB40D2867E891D53D7AC03A8689787E988D4FB810D07B996BA29CE` |
| `work/evidence/generated/usb-enumeration-deterministic-test-v2-candidate-20260801/7520553_SMI_FW-Debug.srec` | 8,643,738 | `F33FF2393DBBD5904042D1896E57D2E8AF9058746853F6664812DFA81A933826` |
| `work/evidence/generated/usb-enumeration-deterministic-test-v2-candidate-20260801/7520553_SMI_FW-Release.elf` | 11,364,856 | `B6C1F73064D996C70BAA8EE013ECE04391ED1E9725940E2099A0262875CF6407` |
| `work/evidence/generated/usb-enumeration-deterministic-test-v2-candidate-20260801/7520553_SMI_FW-Release.srec` | 8,643,738 | `C99F166F0F7326942D9033DEBCAFF05608408190105FB0624A09CBD885276756` |

The expanded Release S-record is 4,194,304 bytes with SHA-256
`8E93D9B2C2E4AAE44F307AE1DF20AA794993D004DAD2142EE30312013AC877C9`.
Deployment must use the explicit frozen Release artifacts above.

## Target acceptance and restoration boundary

Controller B alone is used for this qualification-only branch proof;
Controller A remains on the production recovery candidate. Acceptance requires:

- pre-deploy and post-reboot hardware, no-drive, zero-error, HPT-ready, SD
  detection, representative-sector, and complete CID gates pass;
- injection state `4` (finalized), count `3 / 3`, and live command `0`;
- the recorded root/enumeration drain disposition is internally consistent and
  HCD transfer-thread state was observed rather than cleared;
- production recovery reports terminal complete state, attempt count exactly
  `1`, successful root extraction and semaphore signal, and mounted-after `1`;
- `USB03_32G` mounts configured at high speed with valid FileX/application
  ownership, zero USB/system errors, and no VBUS action;
- one normal powered removal and reinsertion mounts with the qualification
  command still zero and recovery attempt count unchanged;
- Controller B is restored to production Release S-record SHA-256
  `E31845E8EA8993B7271F2123E8830113213FE954968B2CA133BE1FF0B217B888`,
  expanded full-flash SHA-256
  `9CAF4ED22E2E7E06B900D6098D110650DB8987A2DE629783CE91AD43D9D3AEF2`,
  followed by a fresh complete SD identity/state capture.

Production promotion remains blocked until this proof, restoration, and
qualification-hook removal all pass.
