# USB enumeration recovery software candidate

Status: complete
Result: complete; historical recovery software evidence
Type: evidence
Updated: 2026-08-01
Next Action: none; target recovery proof and the current broad baseline are complete
Campaign: 003-complete-bounded-hpt-slow-export-firmware-ticket
Final Evidence: work/evidence/usb-enumeration-deterministic-v2-target-proof-20260801.md

Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Workpackage: work/wp/completed/wp-restore-broad-usb-compatibility-baseline.md
Checklist: work/checklists/checklist-stage-1b-four-drive-usb-compatibility-baseline.md
Diagnostic Evidence: work/evidence/usb03-enumeration-diagnostic-five-insertion-observations-20260731.md

## Outcome

Source commit `29fcaa11` implements one bounded USBX root-port retry for the
exact terminal state observed in the earlier first-insertion misses. It does
not change USBHS/USBX/FileX configuration, the proven 32 KiB HPT write cap,
transport commands, write retry behavior, USB-drive identity handling, or
VBUS control.

The recovery is armed once per physical attachment only when all of these are
true:

- the drive is physically attached but FileX is not mounted;
- USBX has issued a generic null-class connection notification for a live,
  unconfigured device;
- the last USBX system error is `UX_DEVICE_ENUMERATION_FAILURE`;
- the HCD still owns a root device, while root-hub, HCD-thread, and enumeration
  semaphore signals are all exhausted.

After a one-second stability window, the code removes the failed USBX root
device and signals the existing USBX enumeration thread to process the still
attached root port. It never performs enumeration in the application thread.
It records trigger state, extraction/semaphore status, completion, and whether
FileX mounted afterward. A physical removal aborts the attempt and rearms the
one-attempt latch for a future attachment; a signalled attempt has a bounded
45-second completion window.

## Software gates

- USB mass-storage workflow/source policy: PASS.
- USB write-size diagnostic policy: PASS, 9/9.
- HPT customer export invariants: PASS, 34/34.
- USB transaction inventory: PASS.
- USB workflow host models: PASS, 9/9.
- Code-review mitigations: PASS, 15/15.
- SD CID invariants: PASS, 25/25.
- Canonical managed Debug rebuild: PASS.
- Canonical managed Release rebuild: PASS.
- Debug and Release packaging: PASS; stable and versioned artifacts match.
- Recovery telemetry symbol size: PASS, exactly `0x40` bytes.

Both managed builds completed without a new recovery-code compiler warning.
The repository's established unrelated warning set remains.

## Exact candidate artifacts

| Artifact | Bytes | SHA-256 |
| --- | ---: | --- |
| `work/evidence/generated/usb-enumeration-recovery-candidate-20260731/7520553_SMI_FW-Debug.elf` | 14,693,832 | `1B541E411EB9FF3D08DA71ED76BFCB584327B8290C5EC83418751C82D4ACFEE9` |
| `work/evidence/generated/usb-enumeration-recovery-candidate-20260731/7520553_SMI_FW-Debug.srec` | 8,642,586 | `DC2E7E5EB1DE2E0466548CCF7D690D1D07B08AD80C82E189D334EA2B58000C1C` |
| `work/evidence/generated/usb-enumeration-recovery-candidate-20260731/7520553_SMI_FW-Release.elf` | 11,362,388 | `6E89C5664D3B4F7FDBAC1910BA826D5049934E895D9CDE28A60DF0F520766205` |
| `work/evidence/generated/usb-enumeration-recovery-candidate-20260731/7520553_SMI_FW-Release.srec` | 8,642,586 | `E31845E8EA8993B7271F2123E8830113213FE954968B2CA133BE1FF0B217B888` |

Expanded Release S-record size is 4,194,304 bytes and SHA-256 is
`9CAF4ED22E2E7E06B900D6098D110650DB8987A2DE629783CE91AD43D9D3AEF2`.
Deployment must use the explicit frozen artifacts above, not tracked build
outputs.

## Promotion boundary

Software qualification proves the retry is narrow, bounded, buildable, and
observable. It does not yet prove target recovery. Production promotion
remains blocked until both hardware variants pass deployment and normal
insertion behavior, and a naturally reproduced final enumeration failure (or
a separately reviewed deterministic equivalent) demonstrates exactly one
recovery attempt and a valid mounted session without VBUS intervention.
