release prep: rc.1 baseline and gating updates

spec/alias_index.md

@@ -0,0 +1,9 @@
+# Alias Index
+
+OpenBitdo uses a strict no-duplicate PID model in runtime and canonical spec tables.
+These legacy names are preserved here as aliases only.
+
+| Alias PID Name | Canonical PID Name | PID (hex) | Note |
+| --- | --- | --- | --- |
+| `PID_Pro2_OLD` | `PID_Pro2` | `0x6003` | Legacy constant alias in 8BitDo source; runtime/spec use only `PID_Pro2`. |
+| `PID_ASLGMouse` | `PID_Mouse` | `0x5205` | Alias constant maps to the same PID as `PID_Mouse`; runtime/spec use only `PID_Mouse`. |

spec/command_matrix.csv

@@ -1,18 +1,74 @@
-command_id,safety_class,confidence,experimental_default,report_id,request_len,request_hex,expected_response,notes
-GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,"Primary PID detection request"
-GetReportRevision,SafeRead,confirmed,false,0x81,64,81040001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x04;byte5=0x01,"RR read preflight"
-GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,"Mode read"
-GetModeAlt,SafeRead,confirmed,false,0x81,64,81050800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,"Alternate mode read"
-GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,"Controller version"
-GetSuperButton,SafeRead,inferred,true,0x81,64,81052100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,"Super button capability"
-SetModeDInput,SafeWrite,confirmed,false,0x81,64,81050051020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,"Mode write to DInput"
-Idle,SafeRead,confirmed,false,0x81,64,81040001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,"Idle check"
-Version,SafeRead,confirmed,false,0x81,64,81042101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte1=0x22,"Version check"
-ReadProfile,SafeRead,inferred,true,0x81,64,81060001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,"Profile slot read (sanitized)"
-WriteProfile,SafeWrite,inferred,true,0x81,64,81070001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,"Profile slot write (sanitized)"
-EnterBootloaderA,UnsafeBoot,confirmed,false,0x81,6,050050010000,none,"Boot stage A"
-EnterBootloaderB,UnsafeBoot,confirmed,false,0x81,6,005100000000,none,"Boot stage B"
-EnterBootloaderC,UnsafeBoot,confirmed,false,0x81,5,0050000000,none,"Boot stage C"
-ExitBootloader,UnsafeBoot,inferred,true,0x81,6,050051010000,none,"Boot exit (sanitized inferred)"
-FirmwareChunk,UnsafeFirmware,inferred,true,0x81,64,81100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,"Firmware chunk transfer"
-FirmwareCommit,UnsafeFirmware,inferred,true,0x81,64,81110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,"Firmware commit"
+command_id,safety_class,confidence,experimental_default,report_id,request_len,request_hex,expected_response,notes,applies_to,operation_group,dossier_id,evidence_static,evidence_runtime,evidence_hardware,promotion_gate
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Primary PID detection request,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+GetReportRevision,SafeRead,confirmed,false,0x81,64,81040001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x04;byte5=0x01,RR read preflight,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Mode read,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+GetModeAlt,SafeRead,confirmed,false,0x81,64,81050800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Alternate mode read,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Controller version,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+GetSuperButton,SafeRead,inferred,true,0x81,64,81052100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Super button capability,*,Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+SetModeDInput,SafeWrite,confirmed,false,0x81,64,81050051020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Mode write to DInput,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+Idle,SafeRead,confirmed,false,0x81,64,81040001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Idle check,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+Version,SafeRead,confirmed,false,0x81,64,81042101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte1=0x22,Version check,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+ReadProfile,SafeRead,inferred,true,0x81,64,81060001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Profile slot read (sanitized),*,Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+WriteProfile,SafeWrite,inferred,true,0x81,64,81070001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Profile slot write (sanitized),*,Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+EnterBootloaderA,UnsafeBoot,confirmed,false,0x81,6,050050010000,none,Boot stage A,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+EnterBootloaderB,UnsafeBoot,confirmed,false,0x81,6,005100000000,none,Boot stage B,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+EnterBootloaderC,UnsafeBoot,confirmed,false,0x81,5,0050000000,none,Boot stage C,*,Core,DOS-CORE-GLOBAL,yes,yes,yes,n/a
+ExitBootloader,UnsafeBoot,inferred,true,0x81,6,050051010000,none,Boot exit (sanitized inferred),*,Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+FirmwareChunk,UnsafeFirmware,inferred,true,0x81,64,81100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Firmware chunk transfer,*,Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+FirmwareCommit,UnsafeFirmware,inferred,true,0x81,64,81110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Firmware commit,*,Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+Jp108ReadDedicatedMappings,SafeRead,inferred,true,0x81,64,81053020010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,JP108 dedicated-button mapping read,0x5209;0x520a,JP108Dedicated,DOS-CORE-GLOBAL,yes,no,no,n/a
+Jp108WriteDedicatedMapping,SafeWrite,inferred,true,0x81,64,81053120010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,JP108 dedicated-button mapping write (index/value payload),0x5209;0x520a,JP108Dedicated,DOS-CORE-GLOBAL,yes,no,no,n/a
+Jp108ReadFeatureFlags,SafeRead,inferred,true,0x81,64,81053220010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,JP108 feature flags read,0x5209;0x520a,JP108Dedicated,DOS-CORE-GLOBAL,yes,no,no,n/a
+Jp108WriteFeatureFlags,SafeWrite,inferred,true,0x81,64,81053320010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,JP108 feature flags write,0x5209;0x520a,JP108Dedicated,DOS-CORE-GLOBAL,yes,no,no,n/a
+Jp108ReadVoice,SafeRead,inferred,true,0x81,64,81053420010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,JP108 voice read,0x5209;0x520a,JP108Dedicated,DOS-CORE-GLOBAL,yes,no,no,n/a
+Jp108WriteVoice,SafeWrite,inferred,true,0x81,64,81053520010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,JP108 voice write,0x5209;0x520a,JP108Dedicated,DOS-CORE-GLOBAL,yes,no,no,n/a
+U2GetCurrentSlot,SafeRead,inferred,true,0x81,64,81054012010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Ultimate2 current slot read,0x6012;0x6013,Ultimate2Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+U2ReadConfigSlot,SafeRead,inferred,true,0x81,64,81054112010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Ultimate2 slot config read,0x6012;0x6013,Ultimate2Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+U2WriteConfigSlot,SafeWrite,inferred,true,0x81,64,81054212010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Ultimate2 slot config write,0x6012;0x6013,Ultimate2Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+U2ReadButtonMap,SafeRead,inferred,true,0x81,64,81054312010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Ultimate2 core button map read,0x6012;0x6013,Ultimate2Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+U2WriteButtonMap,SafeWrite,inferred,true,0x81,64,81054412010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Ultimate2 core button map write,0x6012;0x6013,Ultimate2Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+U2SetMode,SafeWrite,inferred,true,0x81,64,81054512010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Ultimate2 mode write,0x6012;0x6013,Ultimate2Core,DOS-CORE-GLOBAL,yes,no,no,n/a
+Jp108EnterBootloader,UnsafeBoot,inferred,true,0x81,6,050050010000,none,JP108 boot enter,0x5209;0x520a,Firmware,DOS-CORE-GLOBAL,yes,no,no,n/a
+Jp108FirmwareChunk,UnsafeFirmware,inferred,true,0x81,64,81601020090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,JP108 firmware chunk,0x5209;0x520a,Firmware,DOS-CORE-GLOBAL,yes,no,no,n/a
+Jp108FirmwareCommit,UnsafeFirmware,inferred,true,0x81,64,81601120090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,JP108 firmware commit,0x5209;0x520a,Firmware,DOS-CORE-GLOBAL,yes,no,no,n/a
+Jp108ExitBootloader,UnsafeBoot,inferred,true,0x81,6,050051010000,none,JP108 boot exit,0x5209;0x520a,Firmware,DOS-CORE-GLOBAL,yes,no,no,n/a
+U2EnterBootloader,UnsafeBoot,inferred,true,0x81,6,050050010000,none,Ultimate2 boot enter,0x6012;0x6013,Firmware,DOS-CORE-GLOBAL,yes,no,no,n/a
+U2FirmwareChunk,UnsafeFirmware,inferred,true,0x81,64,81601060120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Ultimate2 firmware chunk,0x6012;0x6013,Firmware,DOS-CORE-GLOBAL,yes,no,no,n/a
+U2FirmwareCommit,UnsafeFirmware,inferred,true,0x81,64,81601160120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02,Ultimate2 firmware commit,0x6012;0x6013,Firmware,DOS-CORE-GLOBAL,yes,no,no,n/a
+U2ExitBootloader,UnsafeBoot,inferred,true,0x81,6,050051010000,none,Ultimate2 boot exit,0x6012;0x6013,Firmware,DOS-CORE-GLOBAL,yes,no,no,n/a
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x3100,CoreDiag,DOS-3100-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x3100,ModeProfileRead,DOS-3100-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x3100,FirmwarePreflight,DOS-3100-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x3105,CoreDiag,DOS-3105-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x3105,ModeProfileRead,DOS-3105-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x3105,FirmwarePreflight,DOS-3105-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x2100,CoreDiag,DOS-2100-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x2100,ModeProfileRead,DOS-2100-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x2100,FirmwarePreflight,DOS-2100-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x2101,CoreDiag,DOS-2101-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x2101,ModeProfileRead,DOS-2101-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x2101,FirmwarePreflight,DOS-2101-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x901a,CoreDiag,DOS-901A-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x901a,ModeProfileRead,DOS-901A-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x901a,FirmwarePreflight,DOS-901A-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x6006,CoreDiag,DOS-6006-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x6006,ModeProfileRead,DOS-6006-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x6006,FirmwarePreflight,DOS-6006-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x5203,CoreDiag,DOS-5203-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x5203,ModeProfileRead,DOS-5203-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x5203,FirmwarePreflight,DOS-5203-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x5204,CoreDiag,DOS-5204-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x5204,ModeProfileRead,DOS-5204-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x5204,FirmwarePreflight,DOS-5204-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x301a,CoreDiag,DOS-301A-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x301a,ModeProfileRead,DOS-301A-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x301a,FirmwarePreflight,DOS-301A-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x9028,CoreDiag,DOS-9028-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x9028,ModeProfileRead,DOS-9028-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x9028,FirmwarePreflight,DOS-9028-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x3026,CoreDiag,DOS-3026-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x3026,ModeProfileRead,DOS-3026-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x3026,FirmwarePreflight,DOS-3026-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime
+GetPid,SafeRead,confirmed,false,0x81,64,8105c100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05;byte4=0xC1,Wave2 static core diagnostics coverage for candidate-readonly PID,0x3027,CoreDiag,DOS-3027-CORE-DIAG-W2,yes,no,no,blocked/no_runtime
+GetMode,SafeRead,confirmed,false,0x81,64,81040501000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x05,Wave2 static mode/profile read coverage; read-only and gated,0x3027,ModeProfileRead,DOS-3027-MODEPROFILE-W2,yes,no,no,blocked/no_runtime
+GetControllerVersion,SafeRead,confirmed,false,0x81,64,81042101000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000,byte0=0x02;byte1=0x22,Wave2 static firmware preflight metadata coverage; transfer blocked,0x3027,FirmwarePreflight,DOS-3027-FW-PREFLIGHT-W2,yes,no,no,blocked/no_runtime

spec/device_name_catalog.md

@@ -0,0 +1,68 @@
+# Device Name Catalog
+
+This catalog is the sanitized naming source of truth for OpenBitdo runtime/docs.
+Canonical rows are unique by PID (no duplicates in this table).
+
+| canonical_pid_name | pid_hex | display_name_en | protocol_family | name_source | source_confidence | aliases |
+| --- | --- | --- | --- | --- | --- | --- |
+| PID_None | 0x0000 | No Device (Sentinel) | Unknown | internal-fallback | low | |
+| PID_IDLE | 0x3109 | Unconfirmed Internal Device (PID_IDLE) | Standard64 | internal-fallback | low | |
+| PID_SN30Plus | 0x6002 | SN30 Pro+ | Standard64 | official-web | medium | |
+| PID_USB_Ultimate | 0x3100 | Unconfirmed Internal Device (PID_USB_Ultimate) | Standard64 | internal-fallback | low | |
+| PID_USB_Ultimate2 | 0x3105 | Unconfirmed Internal Device (PID_USB_Ultimate2) | Standard64 | internal-fallback | low | |
+| PID_USB_UltimateClasses | 0x3104 | Unconfirmed Internal Device (PID_USB_UltimateClasses) | Standard64 | internal-fallback | low | |
+| PID_Xcloud | 0x2100 | Unconfirmed Internal Device (PID_Xcloud) | Standard64 | internal-fallback | low | |
+| PID_Xcloud2 | 0x2101 | Unconfirmed Internal Device (PID_Xcloud2) | Standard64 | internal-fallback | low | |
+| PID_ArcadeStick | 0x901a | Arcade Stick | Standard64 | internal-fallback | medium | |
+| PID_Pro2 | 0x6003 | Pro 2 Bluetooth Controller | Standard64 | official-web | high | PID_Pro2_OLD |
+| PID_Pro2_CY | 0x6006 | Unconfirmed Variant Name (PID_Pro2_CY) | Standard64 | internal-fallback | low | |
+| PID_Pro2_Wired | 0x3010 | Pro 2 Wired Controller | Standard64 | internal-fallback | medium | |
+| PID_Ultimate_PC | 0x3011 | Ultimate PC Controller | Standard64 | internal-fallback | medium | |
+| PID_Ultimate2_4 | 0x3012 | Ultimate 2.4G Controller | Standard64 | internal-fallback | medium | |
+| PID_Ultimate2_4RR | 0x3013 | Ultimate 2.4G Adapter | Standard64 | internal-fallback | medium | |
+| PID_UltimateBT | 0x6007 | Ultimate Wireless Controller | Standard64 | vendor-language-map | high | |
+| PID_UltimateBTRR | 0x3106 | Ultimate Wireless Adapter | Standard64 | internal-fallback | medium | |
+| PID_JP | 0x5200 | Retro Mechanical Keyboard | JpHandshake | vendor-language-map | high | |
+| PID_JPUSB | 0x5201 | Retro Mechanical Keyboard Receiver | JpHandshake | vendor-language-map | high | |
+| PID_NUMPAD | 0x5203 | Retro 18 Mechanical Numpad | Standard64 | vendor-language-map | high | |
+| PID_NUMPADRR | 0x5204 | Retro 18 Adapter | Standard64 | vendor-language-map | high | |
+| PID_QINGCHUN2 | 0x310a | Ultimate 2C Controller | DInput | official-web | high | |
+| PID_QINGCHUN2RR | 0x301c | Ultimate 2C Wireless Adapter | DInput | vendor-language-map | high | |
+| PID_Xinput | 0x310b | Unconfirmed Interface Name (PID_Xinput) | DInput | internal-fallback | low | |
+| PID_Pro3 | 0x6009 | Pro 3 Bluetooth Gamepad | DInput | vendor-language-map | high | |
+| PID_Pro3USB | 0x600a | Pro 3 Bluetooth Adapter | DInput | vendor-language-map | high | |
+| PID_Pro3DOCK | 0x600d | Charging Dock for Pro 3S Gamepad | Standard64 | vendor-language-map | high | |
+| PID_108JP | 0x5209 | Retro 108 Mechanical Keyboard | JpHandshake | official-web | high | |
+| PID_108JPUSB | 0x520a | Retro 108 Mechanical Adapter | JpHandshake | vendor-language-map | high | |
+| PID_XBOXJP | 0x2028 | Retro 87 Mechanical Keyboard - Xbox Edition | JpHandshake | official-web | high | |
+| PID_XBOXJPUSB | 0x202e | Retro 87 Mechanical Keyboard Adapter - Xbox Edition | JpHandshake | vendor-language-map | high | |
+| PID_NGCDIY | 0x5750 | Mod Kit for NGC Controller | Standard64 | vendor-language-map | high | |
+| PID_NGCRR | 0x902a | Retro Receiver for NGC | Standard64 | vendor-language-map | high | |
+| PID_Ultimate2 | 0x6012 | Ultimate 2 Wireless Controller | DInput | official-web | high | |
+| PID_Ultimate2RR | 0x6013 | Ultimate 2 Wireless Adapter | DInput | vendor-language-map | high | |
+| PID_UltimateBT2 | 0x600f | Ultimate 2 Bluetooth Controller | DInput | official-web | high | |
+| PID_UltimateBT2RR | 0x6011 | Ultimate 2 Bluetooth Adapter | DInput | vendor-language-map | high | |
+| PID_Mouse | 0x5205 | Retro R8 Mouse | Standard64 | official-web | high | PID_ASLGMouse |
+| PID_MouseRR | 0x5206 | Retro R8 Adapter | Standard64 | vendor-language-map | high | |
+| PID_SaturnRR | 0x902b | Retro Receiver for Saturn | Standard64 | vendor-language-map | high | |
+| PID_UltimateBT2C | 0x301a | Ultimate 2C Bluetooth Controller | Standard64 | official-web | high | |
+| PID_Lashen | 0x301e | Ultimate Mobile Gaming Controller | Standard64 | vendor-language-map | high | |
+| PID_HitBox | 0x600b | Arcade Controller | DInput | official-web | high | |
+| PID_HitBoxRR | 0x600c | Arcade Controller Adapter | DInput | vendor-language-map | high | |
+| PID_N64BT | 0x3019 | 64 Bluetooth Controller | Standard64 | official-web | high | |
+| PID_N64 | 0x3004 | 64 2.4G Wireless Controller | Standard64 | vendor-language-map | high | |
+| PID_N64RR | 0x9028 | Retro Receiver for N64 | Standard64 | vendor-language-map | high | |
+| PID_XBOXUK | 0x3026 | Retro 87 Mechanical Keyboard - Xbox (UK) | Standard64 | vendor-language-map | high | |
+| PID_XBOXUKUSB | 0x3027 | Retro 87 Mechanical Keyboard Adapter - Xbox (UK) | Standard64 | vendor-language-map | high | |
+| PID_LashenX | 0x200b | Ultimate Mobile Gaming Controller For Xbox | Standard64 | vendor-language-map | high | |
+| PID_68JP | 0x203a | Retro 68 Keyboard - N40 | JpHandshake | vendor-language-map | high | |
+| PID_68JPUSB | 0x2049 | Retro 68 Keyboard Adapter - N40 | JpHandshake | vendor-language-map | high | |
+| PID_N64JoySticks | 0x3021 | Joystick v2 for N64 Controller | Standard64 | vendor-language-map | high | |
+| PID_DoubleSuper | 0x203e | Wireless Dual Super Button | Standard64 | vendor-language-map | high | |
+| PID_Cube2RR | 0x2056 | Retro Cube 2 Adapter - N Edition | Standard64 | vendor-language-map | high | |
+| PID_Cube2 | 0x2039 | Retro Cube 2 Speaker - N Edition | Standard64 | vendor-language-map | high | |
+| PID_ASLGJP | 0x205a | Riviera Keyboard | JpHandshake | vendor-language-map | high | |
+
+## Notes
+- Name-source references are indexed in `/Users/brooklyn/data/8bitdo/cleanroom/process/device_name_sources.md`.
+- Alias names are documented in `/Users/brooklyn/data/8bitdo/cleanroom/spec/alias_index.md` and intentionally excluded from canonical PID rows.

spec/dossiers/2028/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2028-CORE"
+pid_hex = "0x2028"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with fixed command marker bytes and JP handshake gating"
+response_shape = "status header plus minimal payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "JpHandshake dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/2028/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2028-FIRMWARE"
+pid_hex = "0x2028"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/202e/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-202E-CORE"
+pid_hex = "0x202e"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with fixed command marker bytes and JP handshake gating"
+response_shape = "status header plus minimal payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "JpHandshake dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/202e/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-202E-FIRMWARE"
+pid_hex = "0x202e"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/2039/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2039-CORE"
+pid_hex = "0x2039"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with command marker bytes"
+response_shape = "status header plus optional payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Peripheral/Specialty dispatch"
+notes = "Stretch target dossier; candidate-readonly until runtime+hardware evidence"

spec/dossiers/203a/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-203A-CORE"
+pid_hex = "0x203a"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with fixed command marker bytes and JP handshake gating"
+response_shape = "status header plus minimal payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "JpHandshake dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/203a/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-203A-FIRMWARE"
+pid_hex = "0x203a"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/2049/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2049-CORE"
+pid_hex = "0x2049"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with fixed command marker bytes and JP handshake gating"
+response_shape = "status header plus minimal payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "JpHandshake dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/2049/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2049-FIRMWARE"
+pid_hex = "0x2049"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/2056/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2056-CORE"
+pid_hex = "0x2056"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with command marker bytes"
+response_shape = "status header plus optional payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Peripheral/Specialty dispatch"
+notes = "Stretch target dossier; candidate-readonly until runtime+hardware evidence"

spec/dossiers/2100/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2100-CORE-DIAG-W2"
+pid_hex = "0x2100"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_Xcloud; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/2100/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2100-FW-PREFLIGHT-W2"
+pid_hex = "0x2100"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_Xcloud; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/2100/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2100-MODEPROFILE-W2"
+pid_hex = "0x2100"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_Xcloud; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/2101/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2101-CORE-DIAG-W2"
+pid_hex = "0x2101"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_Xcloud2; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/2101/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2101-FW-PREFLIGHT-W2"
+pid_hex = "0x2101"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_Xcloud2; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/2101/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-2101-MODEPROFILE-W2"
+pid_hex = "0x2101"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_Xcloud2; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/3004/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3004-CORE"
+pid_hex = "0x3004"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle", "GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report with command byte and optional slot/mode payload"
+response_shape = "status header with mode/profile payload bytes"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Standard64 dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/3004/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3004-FIRMWARE"
+pid_hex = "0x3004"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/3010/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3010-CORE"
+pid_hex = "0x3010"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle", "GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report with command byte and optional slot/mode payload"
+response_shape = "status header with mode/profile payload bytes"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Standard64 dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/3010/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3010-FIRMWARE"
+pid_hex = "0x3010"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/3011/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3011-CORE"
+pid_hex = "0x3011"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle", "GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report with command byte and optional slot/mode payload"
+response_shape = "status header with mode/profile payload bytes"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Standard64 dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/3011/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3011-FIRMWARE"
+pid_hex = "0x3011"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/3012/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3012-CORE"
+pid_hex = "0x3012"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle", "GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report with command byte and optional slot/mode payload"
+response_shape = "status header with mode/profile payload bytes"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Standard64 dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/3012/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3012-FIRMWARE"
+pid_hex = "0x3012"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/3013/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3013-CORE"
+pid_hex = "0x3013"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle", "GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report with command byte and optional slot/mode payload"
+response_shape = "status header with mode/profile payload bytes"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Standard64 dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/3013/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3013-FIRMWARE"
+pid_hex = "0x3013"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/3019/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3019-CORE"
+pid_hex = "0x3019"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle", "GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report with command byte and optional slot/mode payload"
+response_shape = "status header with mode/profile payload bytes"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Standard64 dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/3019/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3019-FIRMWARE"
+pid_hex = "0x3019"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/301a/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-301A-CORE-DIAG-W2"
+pid_hex = "0x301a"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_UltimateBT2C; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/301a/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-301A-FW-PREFLIGHT-W2"
+pid_hex = "0x301a"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_UltimateBT2C; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/301a/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-301A-MODEPROFILE-W2"
+pid_hex = "0x301a"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_UltimateBT2C; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/3021/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3021-CORE"
+pid_hex = "0x3021"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with command marker bytes"
+response_shape = "status header plus optional payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Peripheral/Specialty dispatch"
+notes = "Stretch target dossier; candidate-readonly until runtime+hardware evidence"

spec/dossiers/3026/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3026-CORE-DIAG-W2"
+pid_hex = "0x3026"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_XBOXUK; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/3026/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3026-FW-PREFLIGHT-W2"
+pid_hex = "0x3026"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_XBOXUK; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/3026/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3026-MODEPROFILE-W2"
+pid_hex = "0x3026"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_XBOXUK; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/3027/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3027-CORE-DIAG-W2"
+pid_hex = "0x3027"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_XBOXUKUSB; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/3027/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3027-FW-PREFLIGHT-W2"
+pid_hex = "0x3027"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_XBOXUKUSB; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/3027/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3027-MODEPROFILE-W2"
+pid_hex = "0x3027"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_XBOXUKUSB; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/3100/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3100-CORE-DIAG-W2"
+pid_hex = "0x3100"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_USB_Ultimate; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/3100/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3100-FW-PREFLIGHT-W2"
+pid_hex = "0x3100"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_USB_Ultimate; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/3100/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3100-MODEPROFILE-W2"
+pid_hex = "0x3100"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_USB_Ultimate; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/3105/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3105-CORE-DIAG-W2"
+pid_hex = "0x3105"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_USB_Ultimate2; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/3105/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3105-FW-PREFLIGHT-W2"
+pid_hex = "0x3105"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_USB_Ultimate2; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/3105/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-3105-MODEPROFILE-W2"
+pid_hex = "0x3105"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_USB_Ultimate2; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/5200/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5200-CORE"
+pid_hex = "0x5200"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with fixed command marker bytes and JP handshake gating"
+response_shape = "status header plus minimal payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "JpHandshake dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/5200/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5200-FIRMWARE"
+pid_hex = "0x5200"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/5201/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5201-CORE"
+pid_hex = "0x5201"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with fixed command marker bytes and JP handshake gating"
+response_shape = "status header plus minimal payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "JpHandshake dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/5201/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5201-FIRMWARE"
+pid_hex = "0x5201"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/5203/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5203-CORE-DIAG-W2"
+pid_hex = "0x5203"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_NUMPAD; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/5203/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5203-FW-PREFLIGHT-W2"
+pid_hex = "0x5203"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_NUMPAD; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/5203/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5203-MODEPROFILE-W2"
+pid_hex = "0x5203"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_NUMPAD; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/5204/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5204-CORE-DIAG-W2"
+pid_hex = "0x5204"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_NUMPADRR; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/5204/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5204-FW-PREFLIGHT-W2"
+pid_hex = "0x5204"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_NUMPADRR; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/5204/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5204-MODEPROFILE-W2"
+pid_hex = "0x5204"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_NUMPADRR; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/5205/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5205-CORE"
+pid_hex = "0x5205"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with command marker bytes"
+response_shape = "status header plus optional payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Peripheral/Specialty dispatch"
+notes = "Stretch target dossier; candidate-readonly until runtime+hardware evidence"

spec/dossiers/5206/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5206-CORE"
+pid_hex = "0x5206"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report with command marker bytes"
+response_shape = "status header plus optional payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Peripheral/Specialty dispatch"
+notes = "Stretch target dossier; candidate-readonly until runtime+hardware evidence"

spec/dossiers/5209/firmware_core.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5209-Firmware"
+pid_hex = "0x5209"
+operation_group = "Firmware"
+command_id = ["Jp108EnterBootloader", "Jp108FirmwareChunk", "Jp108FirmwareCommit", "Jp108ExitBootloader"]
+request_shape = "boot transition frames followed by chunked firmware transfer frames"
+response_shape = "ack/status and completion indicators"
+validator_rules = ["boot transition acknowledged", "chunk ack observed", "commit response accepted"]
+retry_behavior = "firmware retries are bounded and guarded by unsafe flags"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-JP108-002", "REQ-DR-001", "REQ-DR-002"]
+class_family = "JP firmware update dispatch"
+notes = "Unsafe flow remains runtime-gated with dual acknowledgement"

spec/dossiers/5209/jp108_dedicated.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-5209-JP108-Dedicated"
+pid_hex = "0x5209"
+operation_group = "JP108Dedicated"
+command_id = ["Jp108ReadDedicatedMappings", "Jp108WriteDedicatedMapping", "Jp108ReadFeatureFlags", "Jp108WriteFeatureFlags", "Jp108ReadVoice", "Jp108WriteVoice"]
+request_shape = "64-byte JP108 command frames with dedicated index/value payloads"
+response_shape = "status header plus dedicated mapping/flag payload bytes"
+validator_rules = ["byte0 == 0x02", "byte1 indicates command family", "payload length meets command minimum"]
+retry_behavior = "bounded retries for read/ack operations"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-JP108-001", "REQ-DR-001", "REQ-DR-002"]
+class_family = "JP108Advance / JP108AdvanceUI dispatch"
+notes = "Dedicated mapping scope remains A/B/K1-K8 in current product milestone"

spec/dossiers/6002/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-6002-CORE"
+pid_hex = "0x6002"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle", "GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report with command byte and optional slot/mode payload"
+response_shape = "status header with mode/profile payload bytes"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Standard64 dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/6002/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-6002-FIRMWARE"
+pid_hex = "0x6002"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/6003/core_diag.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-6003-CORE"
+pid_hex = "0x6003"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle", "GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report with command byte and optional slot/mode payload"
+response_shape = "status header with mode/profile payload bytes"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "status byte must indicate success"]
+retry_behavior = "retry timeout/malformed response up to configured attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002", "REQ-PID-002"]
+class_family = "Standard64 dispatch"
+notes = "Wave 1 candidate-readonly dossier; no runtime trace or hardware write confirmation yet"

spec/dossiers/6003/firmware.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-6003-FIRMWARE"
+pid_hex = "0x6003"
+operation_group = "Firmware"
+command_id = ["EnterBootloaderA", "EnterBootloaderB", "EnterBootloaderC", "FirmwareChunk", "FirmwareCommit", "ExitBootloader"]
+request_shape = "bootloader entry sequence followed by chunked firmware transfer frames"
+response_shape = "ack/status oriented responses with transfer progression"
+validator_rules = ["boot transition acknowledged", "chunk response indicates acceptance", "commit response indicates completion"]
+retry_behavior = "firmware retries are bounded; unsafe flows remain blocked for candidate-readonly"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-002", "REQ-PROM-001", "REQ-PROM-002"]
+class_family = "Firmware update dispatch"
+notes = "Firmware path is intentionally blocked for candidate-readonly support tier in this wave"

spec/dossiers/6006/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-6006-CORE-DIAG-W2"
+pid_hex = "0x6006"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_Pro2_CY; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/6006/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-6006-FW-PREFLIGHT-W2"
+pid_hex = "0x6006"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_Pro2_CY; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/6006/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-6006-MODEPROFILE-W2"
+pid_hex = "0x6006"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_Pro2_CY; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/6012/firmware_core.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-6012-Firmware"
+pid_hex = "0x6012"
+operation_group = "Firmware"
+command_id = ["U2EnterBootloader", "U2FirmwareChunk", "U2FirmwareCommit", "U2ExitBootloader"]
+request_shape = "boot transition frames followed by chunked firmware transfer frames"
+response_shape = "ack/status and completion indicators"
+validator_rules = ["boot transition acknowledged", "chunk ack observed", "commit response accepted"]
+retry_behavior = "firmware retries are bounded and guarded by unsafe flags"
+failure_signatures = ["boot transition failure", "chunk ack mismatch", "commit timeout"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-U2-002", "REQ-DR-001", "REQ-DR-002"]
+class_family = "Ultimate2 firmware update dispatch"
+notes = "Unsafe flow remains runtime-gated with dual acknowledgement"

spec/dossiers/6012/u2_core.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-6012-U2-Core"
+pid_hex = "0x6012"
+operation_group = "Ultimate2Core"
+command_id = ["U2GetCurrentSlot", "U2ReadConfigSlot", "U2WriteConfigSlot", "U2ReadButtonMap", "U2WriteButtonMap", "U2SetMode"]
+request_shape = "64-byte Ultimate2 command frames with slot/mode/map payload sections"
+response_shape = "status header plus slot/config/map payload bytes"
+validator_rules = ["byte0 == 0x02", "payload length meets command minimum", "slot readback value is bounded"]
+retry_behavior = "bounded retries for slot/map reads and write acknowledgements"
+failure_signatures = ["timeout", "malformed response", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-U2-001", "REQ-DR-001", "REQ-DR-002"]
+class_family = "Ultimate2_4Advance2 / Ultimate2_4Advance2UI dispatch"
+notes = "Advanced theme/sixaxis/deep macro controls remain intentionally hidden"

spec/dossiers/901a/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-901A-CORE-DIAG-W2"
+pid_hex = "0x901a"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_ArcadeStick; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/901a/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-901A-FW-PREFLIGHT-W2"
+pid_hex = "0x901a"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_ArcadeStick; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/901a/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-901A-MODEPROFILE-W2"
+pid_hex = "0x901a"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_ArcadeStick; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/9028/core_diag.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-9028-CORE-DIAG-W2"
+pid_hex = "0x9028"
+operation_group = "CoreDiag"
+command_id = ["GetPid", "GetReportRevision", "GetControllerVersion", "Version", "Idle"]
+request_shape = "64-byte HID report; command opcode in request[1], pid-specific capability gating outside payload"
+response_shape = "status header (byte0/byte1) + optional payload bytes for pid/version/revision"
+validator_rules = ["byte0 == 0x02", "response_len >= 4", "signature bytes match command expectation"]
+retry_behavior = "retry timeout or malformed responses up to configured max attempts with bounded backoff"
+failure_signatures = ["timeout", "malformed_frame", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Wave 2 static dossier for PID_N64RR; support tier remains candidate-readonly"
+
+[state_machine]
+pre_state = "DeviceConnected"
+action = "Run core diagnostics read sequence"
+post_state = "DeviceIdentified"
+invalid_transitions = ["NoDevice", "TransportClosed", "BootloaderOnly"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime request/response traces for core diagnostics", "command-level status validation examples"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["identify + diag run on physical device", "repeatable read success across reconnects"]

spec/dossiers/9028/firmware_preflight.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-9028-FW-PREFLIGHT-W2"
+pid_hex = "0x9028"
+operation_group = "FirmwarePreflight"
+command_id = ["GetReportRevision", "GetControllerVersion", "Version"]
+request_shape = "64-byte HID read commands used for firmware readiness and metadata preflight"
+response_shape = "status bytes + firmware/version metadata bytes when present"
+validator_rules = ["byte0 == 0x02", "metadata bytes pass bounds checks", "device remains in application mode"]
+retry_behavior = "safe-read retries only; firmware transfer/write commands stay blocked for candidate-readonly"
+failure_signatures = ["timeout", "metadata_mismatch", "unsupported_for_pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-001", "REQ-PROM-W2-002"]
+class_family = "Standard64"
+notes = "Preflight-only dossier for PID_N64RR; no bootloader entry/chunk/commit enablement"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read firmware preflight metadata"
+post_state = "FirmwarePreflightReady"
+invalid_transitions = ["NoDevice", "BootloaderActive", "TransferInProgress"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime preflight metadata traces", "error signature samples for invalid firmware path"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware preflight check success", "metadata stability across reconnects"]

spec/dossiers/9028/mode_or_profile_read.toml

@@ -0,0 +1,30 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-9028-MODEPROFILE-W2"
+pid_hex = "0x9028"
+operation_group = "ModeProfileRead"
+command_id = ["GetMode", "GetModeAlt", "ReadProfile"]
+request_shape = "64-byte HID report; mode/profile selector byte in command payload"
+response_shape = "status header + mode/profile bytes when available"
+validator_rules = ["byte0 == 0x02", "mode/profile payload length is bounded", "fallback command path is defined"]
+retry_behavior = "use standard safe-read retry policy; fallback between mode-read command variants when defined"
+failure_signatures = ["timeout", "unsupported_for_pid", "invalid_signature"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-DR-001", "REQ-DR-W2-001", "REQ-PROM-001", "REQ-PROM-W2-002", "REQ-PID-002"]
+class_family = "Standard64"
+notes = "Read-only mode/profile snapshot for PID_N64RR; no write enablement in this wave"
+
+[state_machine]
+pre_state = "DeviceIdentified"
+action = "Read mode/profile snapshot"
+post_state = "ModeProfileSnapshotReady"
+invalid_transitions = ["NoDevice", "WritePending", "BootloaderActive"]
+
+[runtime_placeholder]
+required = true
+evidence_needed = ["runtime traces for mode/profile read commands", "read consistency across repeated probes"]
+
+[hardware_placeholder]
+required = true
+evidence_needed = ["hardware readback for mode/profile snapshot", "cross-slot/read variant sanity checks where applicable"]

spec/dossiers/global/core.toml

@@ -0,0 +1,16 @@
+# Sanitized static dirty-room dossier
+
+dossier_id = "DOS-CORE-GLOBAL"
+pid_hex = "*"
+operation_group = "Core"
+command_id = ["GetPid", "GetReportRevision", "GetMode", "GetModeAlt", "GetControllerVersion", "Version", "Idle", "ReadProfile", "WriteProfile", "SetModeDInput"]
+request_shape = "64-byte HID commands with command selector and optional payload bytes"
+response_shape = "status header plus command-dependent payload"
+validator_rules = ["byte0 == 0x02", "response length >= 4", "command-specific signature checks"]
+retry_behavior = "deterministic retries on timeout and malformed responses"
+failure_signatures = ["timeout", "malformed response", "invalid response signature", "unsupported for pid"]
+evidence_source = "static"
+confidence = "inferred"
+requirement_ids = ["REQ-PROT-001", "REQ-PROT-002", "REQ-DR-001", "REQ-DR-002"]
+class_family = "Core transport and command dispatch"
+notes = "Global core command dossier linked from command matrix rows"

spec/evidence_index.csv

@@ -0,0 +1,27 @@
+pid_hex,pid_name,class_family,operation_groups,evidence_source,confidence,notes
+0x2028,PID_XBOXJP,JP handshake dispatch,CoreDiag;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x202e,PID_XBOXJPUSB,JP handshake dispatch,CoreDiag;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x203a,PID_68JP,JP handshake dispatch,CoreDiag;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x2049,PID_68JPUSB,JP handshake dispatch,CoreDiag;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x2100,PID_Xcloud,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x2101,PID_Xcloud2,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x3004,PID_N64,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x3010,PID_Pro2_Wired,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x3011,PID_Ultimate_PC,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x3012,PID_Ultimate2_4,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x3013,PID_Ultimate2_4RR,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x3019,PID_N64BT,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x301a,PID_UltimateBT2C,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x3026,PID_XBOXUK,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x3027,PID_XBOXUKUSB,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x3100,PID_USB_Ultimate,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x3105,PID_USB_Ultimate2,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x5200,PID_JP,JP handshake dispatch,CoreDiag;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x5201,PID_JPUSB,JP handshake dispatch,CoreDiag;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x5203,PID_NUMPAD,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x5204,PID_NUMPADRR,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x6002,PID_SN30Plus,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x6003,PID_Pro2,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x6006,PID_Pro2_CY,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x901a,PID_ArcadeStick,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)
+0x9028,PID_N64RR,Standard64 dispatch,CoreDiag;ModeProfileRead;FirmwarePreflight,static,inferred,candidate-readonly wave dossier (static-only)

spec/pid_matrix.csv

@@ -1,60 +1,58 @@
-pid_name,pid_decimal,pid_hex,vid_decimal,vid_hex,support_level,protocol_family,notes
-PID_None,0,0x0,11720,0x2dc8,detect-only,Unknown,Sentinel value
-PID_IDLE,12553,0x3109,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_SN30Plus,24578,0x6002,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_USB_Ultimate,12544,0x3100,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_USB_Ultimate2,12549,0x3105,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_USB_UltimateClasses,12548,0x3104,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Xcloud,8448,0x2100,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Xcloud2,8449,0x2101,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_ArcadeStick,36890,0x901a,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Pro2,24579,0x6003,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Pro2_CY,24582,0x6006,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Pro2_OLD,24579,0x6003,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Pro2_Wired,12304,0x3010,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Ultimate_PC,12305,0x3011,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Ultimate2_4,12306,0x3012,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Ultimate2_4RR,12307,0x3013,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_UltimateBT,24583,0x6007,11720,0x2dc8,full,Standard64,Baseline from sanitized dirty-room analysis
-PID_UltimateBTRR,12550,0x3106,11720,0x2dc8,full,Standard64,Baseline from sanitized dirty-room analysis
-PID_JP,20992,0x5200,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis
-PID_JPUSB,20993,0x5201,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis
-PID_NUMPAD,20995,0x5203,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_NUMPADRR,20996,0x5204,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_QINGCHUN2,12554,0x310a,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis
-PID_QINGCHUN2RR,12316,0x301c,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis
-PID_Xinput,12555,0x310b,11720,0x2dc8,detect-only,DInput,Baseline from sanitized dirty-room analysis
-PID_Pro3,24585,0x6009,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis
-PID_Pro3USB,24586,0x600a,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis
-PID_Pro3DOCK,24589,0x600d,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_108JP,21001,0x5209,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis
-PID_108JPUSB,21002,0x520a,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis
-PID_XBOXJP,8232,0x2028,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis
-PID_XBOXJPUSB,8238,0x202e,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis
-PID_NGCDIY,22352,0x5750,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_NGCRR,36906,0x902a,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Ultimate2,24594,0x6012,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis
-PID_Ultimate2RR,24595,0x6013,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis
-PID_UltimateBT2,24591,0x600f,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis
-PID_UltimateBT2RR,24593,0x6011,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis
-PID_Mouse,20997,0x5205,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_MouseRR,20998,0x5206,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_SaturnRR,36907,0x902b,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_UltimateBT2C,12314,0x301a,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Lashen,12318,0x301e,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_HitBox,24587,0x600b,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis
-PID_HitBoxRR,24588,0x600c,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis
-PID_N64BT,12313,0x3019,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_N64,12292,0x3004,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_N64RR,36904,0x9028,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_XBOXUK,12326,0x3026,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_XBOXUKUSB,12327,0x3027,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_LashenX,8203,0x200b,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_68JP,8250,0x203a,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis
-PID_68JPUSB,8265,0x2049,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis
-PID_N64JoySticks,12321,0x3021,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_DoubleSuper,8254,0x203e,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Cube2RR,8278,0x2056,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_Cube2,8249,0x2039,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
-PID_ASLGJP,8282,0x205a,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis
-PID_ASLGMouse,20997,0x5205,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis
+pid_name,pid_decimal,pid_hex,vid_decimal,vid_hex,support_level,protocol_family,notes,support_tier
+PID_None,0,0x0,11720,0x2dc8,detect-only,Unknown,Sentinel value,detect-only
+PID_IDLE,12553,0x3109,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_SN30Plus,24578,0x6002,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_USB_Ultimate,12544,0x3100,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_USB_Ultimate2,12549,0x3105,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_USB_UltimateClasses,12548,0x3104,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_Xcloud,8448,0x2100,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_Xcloud2,8449,0x2101,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_ArcadeStick,36890,0x901a,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_Pro2,24579,0x6003,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_Pro2_CY,24582,0x6006,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_Pro2_Wired,12304,0x3010,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_Ultimate_PC,12305,0x3011,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_Ultimate2_4,12306,0x3012,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_Ultimate2_4RR,12307,0x3013,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_UltimateBT,24583,0x6007,11720,0x2dc8,full,Standard64,Baseline from sanitized dirty-room analysis,full
+PID_UltimateBTRR,12550,0x3106,11720,0x2dc8,full,Standard64,Baseline from sanitized dirty-room analysis,full
+PID_JP,20992,0x5200,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_JPUSB,20993,0x5201,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_NUMPAD,20995,0x5203,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_NUMPADRR,20996,0x5204,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_QINGCHUN2,12554,0x310a,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis,full
+PID_QINGCHUN2RR,12316,0x301c,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis,full
+PID_Xinput,12555,0x310b,11720,0x2dc8,detect-only,DInput,Baseline from sanitized dirty-room analysis,detect-only
+PID_Pro3,24585,0x6009,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis,full
+PID_Pro3USB,24586,0x600a,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis,full
+PID_Pro3DOCK,24589,0x600d,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_108JP,21001,0x5209,11720,0x2dc8,full,JpHandshake,Promoted to full after sanitized JP108 dedicated mapping + firmware evidence,full
+PID_108JPUSB,21002,0x520a,11720,0x2dc8,full,JpHandshake,Promoted to full after sanitized JP108 dedicated mapping + firmware evidence,full
+PID_XBOXJP,8232,0x2028,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_XBOXJPUSB,8238,0x202e,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_NGCDIY,22352,0x5750,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_NGCRR,36906,0x902a,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_Ultimate2,24594,0x6012,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis,full
+PID_Ultimate2RR,24595,0x6013,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis,full
+PID_UltimateBT2,24591,0x600f,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis,full
+PID_UltimateBT2RR,24593,0x6011,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis,full
+PID_Mouse,20997,0x5205,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_MouseRR,20998,0x5206,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_SaturnRR,36907,0x902b,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_UltimateBT2C,12314,0x301a,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_Lashen,12318,0x301e,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_HitBox,24587,0x600b,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis,full
+PID_HitBoxRR,24588,0x600c,11720,0x2dc8,full,DInput,Baseline from sanitized dirty-room analysis,full
+PID_N64BT,12313,0x3019,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_N64,12292,0x3004,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_N64RR,36904,0x9028,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_XBOXUK,12326,0x3026,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_XBOXUKUSB,12327,0x3027,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis Wave 2 candidate-readonly expansion (static dossiers complete; runtime/hardware pending).,candidate-readonly
+PID_LashenX,8203,0x200b,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_68JP,8250,0x203a,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_68JPUSB,8265,0x2049,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis,candidate-readonly
+PID_N64JoySticks,12321,0x3021,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_DoubleSuper,8254,0x203e,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_Cube2RR,8278,0x2056,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_Cube2,8249,0x2039,11720,0x2dc8,detect-only,Standard64,Baseline from sanitized dirty-room analysis,detect-only
+PID_ASLGJP,8282,0x205a,11720,0x2dc8,detect-only,JpHandshake,Baseline from sanitized dirty-room analysis,detect-only

spec/protocol_spec.md

@@ -28,10 +28,66 @@ It is intentionally independent from reverse-engineered source code details and
 - Validation outcomes: `Ok`, `Invalid`, `Malformed`
 - Retry policy applies on `Malformed` or timeout responses
 
+## Operation Groups
+- `Core`: generic identify/mode/profile/boot/fallback commands
+- `JP108Dedicated`: 108-key dedicated-button mapping + feature/voice operations
+- `Ultimate2Core`: Ultimate2 mode/slot/core-map operations
+- `Firmware`: device-scoped firmware enter/chunk/commit/exit operations
+- `CoreDiag`: decompiler-first detect/diagnostic command subset for candidate-readonly PIDs
+- `ModeProfileRead`: decompiler-first read-only mode/profile snapshot group for candidate-readonly PIDs
+- `FirmwarePreflight`: decompiler-first firmware readiness metadata reads (no transfer enablement)
+
+## JP108 Dedicated Support
+- Supported targets: `0x5209` (`PID_108JP`), `0x520a` (`PID_108JPUSB`)
+- First milestone mapping scope: `A`, `B`, `K1`-`K8`
+- Additional controls in this group:
+  - feature flags read/write
+  - voice setting read/write
+- Full 111-key matrix remap is explicitly out of scope for this milestone.
+
+## Ultimate2 Core Support
+- Supported targets: `0x6012` (`PID_Ultimate2`), `0x6013` (`PID_Ultimate2RR`)
+- First milestone editable scope:
+  - current mode read/set
+  - current slot read
+  - slot config read/write
+  - core button map read/write
+- Advanced subsystems (theme/sixaxis/deep macro editing) are intentionally hidden in this milestone.
+
+## PID-Aware Command Gating
+- Command availability is gated by:
+  1. safety class and runtime unsafe acknowledgements
+  2. capability flags
+  3. explicit PID allowlist from `command_matrix.csv:applies_to`
+- `applies_to="*"` means globally available within existing safety/capability constraints.
+
 ## Device Support Levels
 - `full`: command execution permitted for safe and unsafe operations (with user gates)
 - `detect-only`: identification allowed; unsupported operations return `UnsupportedForPid`
 
+## Support Tiers
+- `full`: read/write/unsafe operations available according to existing safety gates.
+- `candidate-readonly`: detect/diag safe reads are allowed per PID allowlist; safe writes and unsafe flows are blocked.
+- `detect-only`: identify-only posture for unsupported or unknown PIDs.
+
+## Candidate Read-Only Wave Policy
+- Wave-1 and Wave-2 expansion PIDs are classified as `candidate-readonly`.
+- Command policy for this tier:
+  - allow: detect/diag safe-read subset.
+  - allow: read-only mode/profile snapshot reads when family-appropriate.
+  - allow: firmware metadata/preflight reads only.
+  - deny: all safe-write operations.
+  - deny: all unsafe boot/firmware operations.
+- Promotion from `candidate-readonly` to `full` requires 3-signal evidence:
+  1. static dossier coverage
+  2. runtime trace evidence
+  3. hardware read/write/readback confirmation
+
+## Dossier Linkage
+- Per-PID operation evidence is tracked in `spec/dossiers/**`.
+- `command_matrix.csv:dossier_id` links command rows to sanitized dossier artifacts.
+- `evidence_index.csv` maps PID to class-family anchors and operation groups.
+
 ## Required Runtime Gating
 Unsafe commands execute only when both conditions are true:
 1. `--unsafe`

spec/requirements.yaml

@@ -43,10 +43,86 @@ requirements:
     description: SDK shall parse and serialize profile blobs compatible with golden binary fixture.
     acceptance: Profile serialization test round-trips fixture payload.
   - id: REQ-TEST-002
-    title: CLI structured output
-    description: CLI shall provide JSON output for automation.
-    acceptance: CLI tests assert stable JSON keys and command responses.
+    title: Beginner-first report output
+    description: User-facing reports shall be TOML-only and hidden on happy path.
+    acceptance: Report tests assert TOML persistence for diagnostics/failure flows and no JSON output path.
   - id: REQ-TEST-003
     title: Clean-room guard
     description: CI shall fail if cleanroom/sdk references forbidden dirty-room locations or tokens.
     acceptance: cleanroom guard script is executed in CI and by integration test.
+  - id: REQ-JP108-001
+    title: JP108 dedicated mapping read/write
+    description: SDK shall support reading and writing JP108 dedicated button mappings for A/B/K1-K8.
+    acceptance: Unit and hardware tests verify read/write/readback for A, B, and at least one K button.
+  - id: REQ-JP108-002
+    title: JP108 firmware path
+    description: SDK shall support JP108 firmware preflight and transfer with existing unsafe gates.
+    acceptance: Hardware smoke validates JP108 firmware preflight and guarded transfer path.
+  - id: REQ-U2-001
+    title: Ultimate2 core profile support
+    description: SDK shall support Ultimate2 mode, slot, and core button-map operations.
+    acceptance: Unit and hardware tests verify mode read/set/readback and slot/profile read/write/readback.
+  - id: REQ-U2-002
+    title: Ultimate2 firmware path
+    description: SDK shall support Ultimate2 firmware preflight and transfer with existing unsafe gates.
+    acceptance: Hardware smoke validates Ultimate2 firmware preflight and guarded transfer path.
+  - id: REQ-WIZ-001
+    title: Beginner guided configuration flows
+    description: TUI wizard shall provide dedicated JP108 and Ultimate2 configuration paths with mouse support.
+    acceptance: TUI tests verify end-to-end wizard transitions for mapping/profile apply and guided button test.
+  - id: REQ-WIZ-002
+    title: Backup and rollback safety
+    description: Mapping/profile writes shall create rollback snapshots and auto-rollback on failure.
+    acceptance: App-core tests verify backup creation, rollback on failure, and deterministic retry guidance.
+  - id: REQ-HW-001
+    title: Required hardware gates for target lines
+    description: CI shall enforce required blocking hardware jobs for Ultimate2 and JP108 targets.
+    acceptance: workflow includes required jobs that fail deterministically on missing fixture or command failure.
+  - id: REQ-DR-001
+    title: Dossier completeness
+    description: Every wave target PID shall have sanitized dossier files for each scoped operation group.
+    acceptance: `spec/dossiers/<pid_hex>/*.toml` exists and includes all required schema fields.
+  - id: REQ-DR-002
+    title: Dossier traceability
+    description: Dossiers and command matrix rows shall be linked by stable dossier IDs.
+    acceptance: command matrix `dossier_id` references an existing dossier artifact.
+  - id: REQ-DR-W2-001
+    title: Wave 2 dossier minimum per PID
+    description: Each Wave 2 target PID shall include `core_diag`, `mode_or_profile_read`, and `firmware_preflight` dossiers.
+    acceptance: lint check confirms all three required dossier files exist for every Wave 2 PID.
+  - id: REQ-DR-W2-002
+    title: Wave 2 dossier state model and placeholders
+    description: Every Wave 2 dossier shall include state machine, runtime placeholder, and hardware placeholder sections.
+    acceptance: dossier lint rejects files missing `state_machine`, `runtime_placeholder`, or `hardware_placeholder`.
+  - id: REQ-PROM-001
+    title: Strict promotion gate
+    description: Promotion to full support requires static evidence plus runtime traces and hardware read/write/readback.
+    acceptance: no PID is promoted without all three evidence signals marked complete.
+  - id: REQ-PROM-002
+    title: Candidate read-only enforcement
+    description: candidate-readonly devices shall permit detect/diag reads but reject safe writes and unsafe operations.
+    acceptance: command gating tests reject write/firmware commands for candidate-readonly PIDs.
+  - id: REQ-PROM-W2-001
+    title: Wave 2 promotion block
+    description: Wave 2 target devices shall remain candidate-readonly until runtime and hardware placeholders are satisfied.
+    acceptance: Wave 2 command matrix rows set `promotion_gate=blocked/no_runtime` and evidence runtime/hardware set to `no`.
+  - id: REQ-PROM-W2-002
+    title: Firmware preflight only for Wave 2
+    description: Wave 2 firmware coverage shall remain metadata/preflight only with no transfer/write enablement.
+    acceptance: firmware transfer commands remain blocked for Wave 2 candidate-readonly PIDs.
+  - id: REQ-COMM-001
+    title: Structured community intake
+    description: Community evidence submissions shall follow a structured sanitized template.
+    acceptance: issue templates collect VID/PID, operation group, sanitized request/response structure, and repro notes.
+  - id: REQ-COMM-002
+    title: Clean-room intake boundary
+    description: Community submissions must forbid raw vendor/decompiled snippet carryover.
+    acceptance: template and docs explicitly prohibit raw snippet submission.
+  - id: REQ-GH-001
+    title: Release-governance variables
+    description: Repository variables for AUR/Homebrew publication gates shall be configured through GitHub settings.
+    acceptance: variables `AUR_PUBLISH_ENABLED`, `HOMEBREW_PUBLISH_ENABLED`, and `HOMEBREW_TAP_REPO` are present.
+  - id: REQ-GH-002
+    title: Hardware-constrained required checks
+    description: Branch protection required checks shall reflect currently available hardware fixtures.
+    acceptance: required checks include `hardware-108jp` and `hardware-ultimate2`, excluding unavailable hardware families.