# USB enumeration deterministic recovery-test software candidate

Status: complete
Result: target proof invalidated; historical qualification candidate only
Type: evidence
Updated: 2026-08-01
Next Action: none; retain as invalidated historical proof and use the completed v2 target evidence for current disposition
Campaign: 003-complete-bounded-hpt-slow-export-firmware-ticket

Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/completed/wp-restore-broad-usb-compatibility-baseline.md
Checklist: work/checklists/checklist-stage-1b-four-drive-usb-compatibility-baseline.md
Prior Evidence: work/evidence/usb-enumeration-recovery-six-insertion-and-export-20260801.md
Successor Evidence: work/evidence/usb-enumeration-deterministic-test-v2-software-candidate-20260801.md

## Outcome

Source commit `80e6a455` adds a qualification-only, one-shot way to create
USBX's native final unconfigured enumeration-failure state. This is not a
production compatibility change. It exists only to prove the already-deployed
bounded recovery branch and will be removed after the test.

The exact J-Link-only RAM command is accepted only from a fresh reset baseline
with no USB device attached and no earlier recovery attempt. Once armed, the
hook returns `UX_TRANSFER_ERROR` before address, descriptor, class, or FileX
ownership on exactly the three root-port enumeration attempts defined by
`UX_RH_ENUMERATION_RETRY`. It then clears its live command.

USBX itself performs its existing cleanup between attempts and creates its
existing final failure notification/error after the third failure. The
production recovery code must then observe that terminal state, extract the
retained root device, signal the existing USBX enumeration thread exactly
once, and mount normally after the qualification hook is spent.

The hook:

- is limited to root device owner `UX_NULL`, port `0`;
- uses exact RAM magic `0x55454641` and cannot arm from the controller UI;
- rejects an already-mounted USB session;
- clears itself after exactly three injected attempts;
- changes no USBHS settings, storage transport, FileX write path, 32 KiB cap,
  USB identity behavior, timeout, normal retry, or VBUS control;
- records a 32-byte injection disposition alongside the existing 64-byte
  production recovery telemetry.

## Target result and invalidation

Controller B received the exact frozen Release candidate and passed full-flash,
post-reboot, no-drive, SD detection, representative-sector, complete CID,
HPT-ready, hardware, and zero-error gates. The one-shot injection then recorded
state `3`, count `3 / 3`, and live command `0` after `USB03_32G` was inserted.

The drive mounted normally at high speed with a valid FileX session, but the
production recovery diagnostic remained zero with attempt count `0`. This is
not recovery proof. The physical insertion had queued more than one root-hub
enumeration signal. After the third injected failure, USBX consumed another
already-queued signal and mounted the drive before the application recovery
service could observe the terminal unconfigured state.

Raw evidence is retained under
`work/evidence/hpt-log-store-circular-mirror/controller-b/usb-enumeration-deterministic-recovery-test-20260801/`.
The successor v2 candidate drains only already-queued enumeration work after
the third qualification failure so that the existing production recovery path,
not USBX's extra queued pass, must perform the bounded retry.

## Software gates

- USB mass-storage workflow/source policy: PASS.
- USB write-size diagnostic policy: PASS, 9/9.
- HPT customer export invariants: PASS, 34/34.
- USB transaction inventory: PASS.
- USB workflow host models: PASS, 9/9.
- Code-review mitigations: PASS, 15/15.
- SD CID invariants: PASS, 25/25.
- Qualification PowerShell parser: PASS.
- Canonical managed Debug rebuild: PASS.
- Canonical managed Release rebuild: PASS.
- Debug and Release packaging: PASS; stable and versioned copies match.
- Command/status/recovery symbol sizes: `0x04 / 0x20 / 0x40`, PASS in both
  Debug and Release.

Both managed builds completed with only the established repository warning
set. The hook introduced no compiler warning.

## Exact candidate artifacts

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `work/evidence/generated/usb-enumeration-deterministic-test-candidate-20260801/7520553_SMI_FW-Debug.elf` | 14,695,340 | `0C39B8B5570B51C04A2D90EF6A64C88C337AFB0C7522DCB12CCB0467170FE181` |
| `work/evidence/generated/usb-enumeration-deterministic-test-candidate-20260801/7520553_SMI_FW-Debug.srec` | 8,643,162 | `F75B95F5C37DFFD7CD388743CE4B25BCFF98C2A65C48649CD9DA558A4A9399E2` |
| `work/evidence/generated/usb-enumeration-deterministic-test-candidate-20260801/7520553_SMI_FW-Release.elf` | 11,363,484 | `AB69ED0CE3D55371E3F573D5B3AC35BDEBBE2D1315BC79F2A5096C7DECA7ED0E` |
| `work/evidence/generated/usb-enumeration-deterministic-test-candidate-20260801/7520553_SMI_FW-Release.srec` | 8,643,162 | `A7D1AF9D1531E24BEC746D323D680371CE69AFFB5F9D603BE3A53D574D9A41B1` |

The expanded Release S-record is 4,194,304 bytes with SHA-256
`BFDF9AE0E6877C8D4A2BE74D5BE59660CE7CFCE86C92A3A069C5E12179C63317`.
Deployment must use the explicit frozen Release artifacts above.

## Target acceptance and restoration boundary

Controller B is sufficient for this synthetic branch proof because both
hardware variants already passed deployment and three healthy insertions each
on the production candidate. The bounded proof requires all of the following:

- pre-deploy and post-reboot Controller B SD detection, representative-sector,
  complete CID, HPT-ready, hardware, no-drive, and zero-error gates pass;
- the qualification status reports state `3`, injection count/required count
  `3 / 3`, and live command `0`;
- production recovery reports exactly one attempt, root extraction and
  semaphore status success, terminal complete state, and mounted-after `1`;
- the mounted device is configured at high speed with a valid FileX session;
- there is no VBUS action and no second recovery attempt;
- one powered removal and ordinary reinsertion after the proof mounts with the
  qualification command still zero and recovery attempt count unchanged;
- Controller B is restored to the frozen production recovery S-record from
  `work/evidence/usb-enumeration-recovery-software-candidate-20260731.md`, with
  independent full-flash match and fresh SD identity/state capture.

Controller A remains on the production recovery candidate throughout this
qualification-only test.
