v2.1.12-rc2（pre-release）——STAGING-FALLBACK 重试载具修正（FLR + FWSEC 重新点火）

这是 pre-release；Latest 仍为 v2.1.11。 本版是 #156（1e93，RTX 2080 SUPER 移动版）裸跑的目标版：直接换 EFI\BOOT\BOOTX64.EFI，无需任何 marker。预期日志序：STAGING-FALLBACK: booter 0x89 ... 门控行 → FLR done (cold engine, WPR2 wiped) → FWSEC re-ignited, WPR2 re-verified → LOW 带重建 → 开火 → SELECTOR RESULT / HANDOFF-OUT ... tu10x:unlock=true。

以下为自 v2.1.11（上一稳定版）以来的全部变化（rc1 已含 1–8，rc2 新增 9–10；跳过 rc1 的用户请整表读）。

解锁行为变化

1. STAGING-FALLBACK 自动回退（rc1 引入）：Turing 载荷轮 booter mailbox0=0x89 且宿主 meta magic 完好 = ≥4GiB staging 读未送达（#74/#156/#191 类平台）→ 自动单次 LOW 带重试，不再需要手工 \tx-low-staging.txt。0x91 镜像类（sub-4GB 读锁，#16/#57）与宿主页损坏（buffer-side）按设计不进门；单发无循环，两带都死走原失败路径 + VT-d 提示。
2. rc2 修正重试载具：1e93 现场证伪了 rc1 的"engine reset 恢复 fire 面"假设——完整跑过一轮 booter（halt+sanitize）后 FBIF 写面死掉（falcon_dma_unblock 写 0x115/0x0 读回 0x114/0x80，EIO 确定性）。rc2 重试改为：function-level FLR（整 function 冷态，FBIF 一并复活）→ FWSEC 重新点火（FLR 擦 WPR2 须重建）→ LOW 带重建 → 开火。门开火点零解锁、零 payload 写，FLR 无状态可毁。0x89 机上重试段代价 ~2–3s（正常机零成本：门条件未变，健康 HIGH 机零误触，台架证据）。sim 新故障 fbif_write_dead_after_run + t40 场景建模该平台（从 fallback 删 FLR 步即以现场 EIO 原形失败），t34–t40 全绿。
3. 三代交棒默认门开（FEAT PLM 不再交棒前重锁）：TU106 bench 端到端坐实——卡自身 GOP 重建与 Windows 驱动 init 都不重关门，系统内 PLM 保持 0xffffffff，写入面开放（ssdiag --reapply 的 Turing 只读限制具备解除条件）。\tx-relock.txt 恢复旧重锁行为（Turing 臂回锁值 0xffffffef/0xffffff8f 随板方差；Ampere/Ada 臂未 bench）。

速度/静默旋钮（全部 opt-in marker，缺省零行为差异）

1. \tx-ultrafast.txt 速度档（已验证机器用）：跳过全部纯诊断探测（M1 冷态采样/GOP 探测/AUTH-SCAN/ROOT-DIR 转储/opener 拓扑/载荷后 FEAT sweep/HANDOFF-PCI/HANDOFF-VGA-FINAL/POST-GOP 探针/CHAIN-MEMMAP），折叠 quiet + 仅事务锚点 flush（80→15 次/轮）；复位金丝雀保留（HANDOFF-OUT 带真值）；CHAIN reconnect pass 一并跳过。裁决读回一个不少：selector 写读回、WPR2/POST-BOOT 判定、booter 载入审计照跑。
2. \tx-no-log.txt / \tx-no-console.txt：分别不开 \loader.log / 不回显；同置 = 完全静默跑（no-console 确认提示不可见，必须配 armed，键盘语义不变）。
3. armed 倒计时接受 0：\i_know_what_i_am_doing.txt 首行 0 = 不等待，只读预备完成立即 PROCEED（此前钳到 1 秒）。
4. armed/chain 路径两条固定 stall 删除（~550 ms）。
5. OS-loader 预载改 opt-in（#198 交棒后挂死嫌疑收敛）：\tx-preload.txt 启用预载；缺省不预载，BootOrder 引导链的索引解析与跨盘防护保留。
6. 旧 banner 串修正（'unloader'/'M0 skeleton' 残留）+ banner cstr16 导入按 feature 门控。

实测与工具

• 速度阶梯收口（Z170/TU106 台架，内置 SATA ESP，armed+quiet+ultrafast+no-console）：v2.1.9 quiet 代 17.2 s → ~1.9 s 全程（事务段 detach→FINAL ≈1.2 s）；逐级证据在 docs/evidence/tu106-1f07/。
• targeted PROM 读实验两提交已 revert（净零代码变化）。
• tools/bench_v2.py：社区标准四精度 GEMM 测量工具 vendoring。
• v2.1.11 的 zip 已原地重打包移除内嵌 ssdiag（杀软误报政策 #190/D#189——ssdiag 只以独立附件分发）。
• ssdiag 0.7.2 独立附件（本 release 新增，SHA256SUMS 一并覆盖）：修复 SR-IOV VF guest（vfio-pci，geforce-sriov 类栈）下的静默崩溃——VF 扩展配置空间读全 FF，扩展能力链走到 0xFFF 处的 u32 读跨出单页 ECAM 映射，进程在 ranges 之后无提示退出（67bb859）。现在读全部钳在单页内、全 FF 有专门报告行，标准链 link caps 照常打印。顺带正面数据点：pmxdrv 在 Secure Boot ON 的 guest 里装载成功。判读边界：VF guest 里的 UNLOCKED/NOT_UNLOCKED 不构成宿主卡解锁证据（VF 寄存器窗是 per-VF 过滤视图，FECS/PLM 属 PF 裸 PRI 状态）；VFIO 整卡直通（#135）仍是唯一有效 VM 数据点。

资产与校验

TX 构建经 check_efi.py 终验（TX banner YES / readonly YES 各自匹配）。Release: tag v2.1.12-rc2 = main 的版本 bump 提交。安全宪法副本与回滚手册见 README；解锁为易失覆盖（断电即失、每次引导重放），黑屏/STOP 即断电走正常引导。

v2.1.12-rc2 (pre-release) — STAGING-FALLBACK retry vehicle fixed (FLR + FWSEC re-ignition)

This is a pre-release; Latest remains v2.1.11. This is the target build for #156 (1e93, RTX 2080 SUPER Mobile): swap EFI\BOOT\BOOTX64.EFI and run bare — no marker needed. Expected log order: the STAGING-FALLBACK: booter 0x89 ... gate line → FLR done (cold engine, WPR2 wiped) → FWSEC re-ignited, WPR2 re-verified → LOW-band re-stage → fire → SELECTOR RESULT / HANDOFF-OUT ... tu10x:unlock=true.

Everything below is the complete delta since v2.1.11 (the last stable) (1–8 shipped in rc1, 9–10 are new in rc2; if you skipped rc1, read the whole list).

Unlock behavior changes

1. STAGING-FALLBACK auto-retry (introduced in rc1): a Turing payload run dying on booter mailbox0=0x89 with the host meta magic intact means the ≥4GiB staging read did not deliver (#74/#156/#191-class platforms) → one automatic LOW-band retry, no manual \tx-low-staging.txt needed. The 0x91 mirror class (sub-4GB read lock, #16/#57) and a corrupt host page (buffer-side) never enter the gate by design; one shot, no loops, and a both-bands-dead machine falls to the canonical failure path with the VT-d hint.
2. rc2 fixes the retry vehicle: 1e93 field-falsified rc1's "engine reset restores the fire surface" assumption — after one completed booter run (halt + sanitize) the FBIF write surface is dead (falcon_dma_unblock writes 0x115/0x0, reads back 0x114/0x80, deterministic EIO). The rc2 retry is: function-level FLR (the whole function cold, FBIF included) → FWSEC re-ignition (the FLR wipes WPR2) → LOW-band re-stage → fire. At the gate nothing is unlocked and zero payload writes happened, so the FLR has no state to destroy. On a 0x89 machine the retry costs ~2–3 s (zero cost on healthy machines: the gate is unchanged, HIGH-reachable machines never enter it — bench evidence). New sim fault fbif_write_dead_after_run + scenario t40 model the platform (removing the FLR step from the fallback fails t40 with the exact field EIO shape); t34–t40 all green.
3. All three families now hand off with the FEAT gate OPEN (no pre-handoff relock): a TU106 bench proved end-to-end that neither the card's own GOP rebuild nor the Windows driver init re-closes it — in-OS PLM stays 0xffffffff and the write surface stays open (the ssdiag Turing read-only --reapply restriction can now be lifted). \\tx-relock.txt restores the legacy relock (Turing-arm value 0xffffffef/0xffffff8f varies by board; the Ampere/Ada arm has never been benched).

Speed / silence knobs (all opt-in markers; zero behavior change when absent)

1. \\tx-ultrafast.txt speed profile (for machines with several verified rounds): skips every purely diagnostic probe (M1 cold sample/GOP probe/AUTH-SCAN/ROOT-DIR dump/opener topology/post-payload FEAT sweep/HANDOFF-PCI/HANDOFF-VGA-FINAL/POST-GOP probe/CHAIN-MEMMAP), folds in quiet + transaction-anchor-only flush (~80 → ~15 flushes/run); the reset canary stays (HANDOFF-OUT carries real values); the CHAIN reconnect pass is skipped too. None of the verdict readbacks are skipped: selector write/readback, WPR2/POST-BOOT verdicts and the booter load audit all still run.
2. \\tx-no-log.txt / \\tx-no-console.txt: never open \\loader.log / no console mirror at all; together = a fully silent run (no-console hides the confirm prompt — combine with armed; keyboard semantics unchanged).
3. Armed countdown accepts 0: first line 0 in \i_know_what_i_am_doing.txt = no wait, PROCEED as soon as the read-only prep finishes (previously clamped to 1 s).
4. Two fixed stalls dropped from the armed/chain path (~550 ms).
5. OS-loader preload becomes opt-in (#198 post-handoff hang investigation): \tx-preload.txt enables it; by default no preload, while the BootOrder chain's index resolution and cross-disk protections remain.
6. Stale banner string fix ('unloader'/'M0 skeleton' leftovers) + the banner cstr16 import is now feature-gated.

Bench & tooling

• Speed ladder closed (Z170/TU106 bench, SATA ESP, armed+quiet+ultrafast+no-console): 17.2 s in the v2.1.9 quiet era → ~1.9 s total (transaction detach→FINAL ≈1.2 s); per-step evidence under docs/evidence/tu106-1f07/.
• The two targeted-PROM-read commits were reverted (net zero code change).
• tools/bench_v2.py: vendored community-standard 4-precision GEMM measurement.
• The v2.1.11 zip was repacked in place to drop the embedded ssdiag (AV false-positive policy #190/D#189 — ssdiag ships as a standalone attachment only).
• ssdiag 0.7.2 standalone attachment (new on this release; SHA256SUMS covers it): fixes a silent crash on SR-IOV VF guests (vfio-pci, geforce-sriov-class stacks) — the VF's extended config space reads all-FF, so the extended-cap walk stepped to 0xFFF and read a u32 straddling the single mapped ECAM page; the process died with no output past the ranges block (67bb859). All reads are now bounded to the page, the all-FF wall gets its own report line, and standard-chain link caps still print. Side datapoint: pmxdrv loads fine on Secure Boot ON VM guests. Reading boundary: a UNLOCKED/NOT_UNLOCKED verdict inside an SR-IOV VF guest is not evidence of the host card's unlock state (the VF register window is a per-VF filtered view; FECS/PLM are PF-side raw PRI state) — full-device VFIO passthrough (#135) remains the only valid VM datapoint.

Assets & checksums

Both verified with check_efi.py (TX banner / read-only banner respectively). Release: tag v2.1.12-rc2 = the version-bump commit on main. The safety-constitution copy and the recovery manual live in the README; the unlock is a volatile overlay (lost on power removal, replayed every boot) — on a black screen or STOP, power off and boot normally.

资产换件记录（2026-11-10 第三版——修复 fallback 重试的 BME 缺失）

1e93 rc2 现场轮（issue #156）：FLR 载具把 FBIF 写面救活（rc1 死点确认修复），但 FWSEC 重点火楔死——根因在报告者日志里定位：claim 建立 cmd=0x0007（BME on）使首发 DMA 正常，而 flr_phase 按 TOTORONG 交棒策略恢复 command 不含 BME（cmd=0x0003），重试即在无总线主控状态下点火 → FWSEC BL 的 sysmem DMA 拉取静默永不完成（核在跑 CPUCTL=0x0、零 EXCI、零 mailbox、WPR2 永不来）。修复：回退 FLR 后重臂 BME（raw command write |0x0004，带读回），并采纳报告者建议在 STARTCPU 后加 CPUCTL 立即读回判别行（0x0=核已启动 / 0x10=START 未贴上）。sim fwsec() 加 BME 守卫，t40 回归门在位（删重臂即以现场楔死签名失败）。tag 已移至修复提交 0ac10f6。

日志可辨识标记：本版在回退段新增 STAGING-FALLBACK: GPU BME re-armed (cmd=0x0003 -> 0x0007) 与 FWSEC-TU10X: STARTCPU post-START CPUCTL=... 两行——见到即新件。

Asset swap record (2026-11-10, third revision — BME re-arm fix)

The 1e93 rc2 field round (issue #156): the FLR vehicle DID revive the FBIF write surface (the rc1 death point is confirmed fixed), but the FWSEC re-ignition wedged — root cause pinned in the reporter's own log: the claim sets cmd=0x0007 (BME on) which made the first fire work, while flr_phase restores command without BME per the TOTORORONG handoff policy (cmd=0x0003), so the retry fired FWSEC without bus master and the FWSEC BL's sysmem DMA fetch of its staged image silently never completed (core running CPUCTL=0x0, zero EXCI, zero mailbox, WPR2 never up). Fix: re-arm BME after the fallback FLR (raw command write |0x0004, read back), plus the reporter's suggested immediate post-START CPUCTL readback discriminator (0x0 = core launched / 0x10 = START did not stick). sim fwsec() gains a BME guard; t40 is the regression gate (removing the re-arm fails with the exact field signature). Tag moved to the fix commit 0ac10f6.

Log-identifiable marks: this build adds STAGING-FALLBACK: GPU BME re-armed (cmd=0x0003 -> 0x0007) and FWSEC-TU10X: STARTCPU post-START CPUCTL=... in the fallback path — if you see them, you are on the new file.