Add per-command monotonic deadline (1500 ms, beyond the device 1000 ms
timeout) so a missing response fails the head instead of wedging the
queue. Bound send and poll transport errors (8 each) with 5 ms doubling
to 100 ms backoff so a persistent STALL cannot spin HID ioctls.
Retries resend only the unsent head with identical bytes; once sent the
head is polled, never resent. The response carries no command echo
(seqnum/busy only), so a late reply after a timeout can be misattributed
to the next command; last seq is retained to ignore duplicates and
callers must validate payload status/length.
Fail callbacks once via a shared helper; clear stays safe after timeouts.
HID -1/errno semantics unchanged; valid busy polls every tick.
Add fake-HID/fake-time tests for success pipelining, busy timeout
advance, send/poll/short backoff bounds, clear-once safety, stale seq,
and null HID expiry.
lbgos
720d93e12e