harden USB telemetry transport

tests/fixtures/README.md

@@ -1,9 +1,11 @@
 # Hardware outage fixtures
 
-These captures came from the assembled XIAO ESP32-C3 prototype. A temporary
-validation build made the packet writer report failure while acquisition kept
-running; that failure injection was removed before the production firmware was
-built and flashed. The files contain only complete, CRC-valid `TRK1` frames.
+These captures came from the assembled XIAO ESP32-C3 prototype. The files
+contain only complete, CRC-valid `TRK1` frames.
+
+The two forced-outage captures used a temporary validation build that made the
+packet writer report failure while acquisition kept running. That injection was
+removed before production firmware was built and flashed.
 
 - `forced_outage_3s.trk` — SHA-256
   `01482816cdaa668e4681c33c8baa1df331d733b9bbcbc4f448ece25e88185ad6`.
@@ -15,10 +17,24 @@ built and flashed. The files contain only complete, CRC-valid `TRK1` frames.
   138 samples were dropped after the 512-entry queue filled, the cumulative
   drop count reached 138, and the corresponding timestamp delta is exactly
   1,390,000 us.
+- `direct_usb_stall.trk` — SHA-256
+  `40f874b7eaa7f705524ecdd75f832e8a724252366633116ac015fc75dfd16558`.
+  This came from the direct USB driver build after leaving the enumerated USB
+  endpoint without a serial reader long enough to overflow the acquisition
+  queue. It contains 864 samples. The retained block ends at sequence 511,
+  delivery resumes at 1,706, and both the sole 1,194-sample gap and the device's
+  cumulative drop counter equal 1,194. There are no packet gaps, CRC failures,
+  loop overruns, trailing bytes, or timestamp-saturation flags.
+
+  The first captured sample is sequence 8 because the flashing process still
+  had the endpoint open long enough to drain sequences 0 through 7 before the
+  capture application opened. That is deliberate evidence of the remaining
+  distinction: USB endpoint drain is observable, but application receipt
+  requires the planned acknowledgement/replay layer.
 
 `tests/test_trikke_protocol.py` verifies the hashes, parses the captures in
 fragmented chunks, and asserts these signatures so the hardware evidence remains
-executable regression data. To inspect either file manually:
+executable regression data. To inspect a file manually:
 
 ```sh
 python3 tools/decode_binary.py tests/fixtures/forced_outage_3s.trk /tmp/outage.csv