Stop the OTG state machines running blind in either role

Widens the #160 fix, which was scoped too narrowly to host role, and fixes
flare-edge#168.

Device role was deliberately left alone on the reasoning that the state
machine is only meaningless when the port is a host. That was wrong. On a
board with no extcon phandle the machine has no external role signal in
EITHER direction, and with bvalid pinned high by the VBUS bypass its charger
detection cannot be meaningful at all. In device role its verdict suspends
the phy underneath a bound gadget, so the USB recovery link dies.

Reproduced deterministically on warden-c8a3 with a host attached:

  device role, host attached   ccf=1  phy_sus=0x0    udc=configured  works
  -> host role                 ccf=1  phy_sus=0x0    udc=(none)
  -> back to gadget            ccf=0  phy_sus=0x1d1  udc=configured  SUSPENDED
  -> +15s / +30s               ccf=0  phy_sus=0x1d1  udc=configured  never recovers

and the 2207:0019 device disappears from the host for good.

Nothing notices, because every obvious signal lies: udc state reads
"configured", usb0 carrier reads 1, and DCTL RUN_STOP reads 1, so the gadget
really is asserting its pullup. It asserts into a phy whose analog front end
and 480M clock are off, so the SoC sees SE0 and the host sees no device at
all, not even an enumeration error.

It cannot self-heal either. bvalid is pinned high, so a host attaching later
produces no VBUS edge for the machine to trigger on: it ran once, powered the
phy off, and nothing re-evaluates. That is why a reboot appears to fix it and
why this read as a cable fault for weeks. It is not, and the cables were fine.

Gated on the extcon being self-allocated rather than on the board compatible,
so it describes the actual precondition: no external role signal exists.

Renamed from 29-usb2phy-no-otg-sm-in-host.patch, whose name now misstated the
scope.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MVGTC78dgCGfRANNKjoPea

kernel/rv1106-enablement/usb/rv1106_usb2phy_cfg.c.frag

@@ -1,12 +1,14 @@
  * RV1106 USB2 PHY: single OTG port at 0xff3e0000 (ported from the vendor driver;
  * fields map 1:1 to 6.18 except utmi_iddig -> utmi_id, and the 5.10-only
- * iddig_output/iddig_en/bvalid_grf_sel are dropped). Signal-quality phy_tuning is
- * left off for now (guarded, so NULL is safe): the phy is functional without it.
+ * iddig_output/iddig_en/bvalid_grf_sel are dropped). Signal-quality phy_tuning
+ * was originally left off here; it is now implemented (patches/27-usb-phy-tuning.patch)
+ * because "functional without it" turned out not to mean reliable -- see #160.
  */
 static const struct rockchip_usb2phy_cfg rv1106_phy_cfgs[] = {
 	{
 		.reg = 0xff3e0000,
 		.num_ports	= 1,
+		.phy_tuning	= rv1106_usb2phy_tuning,
 		.clkout_ctl	= { 0x0058, 4, 4, 1, 0 },
 		.port_cfgs	= {
 			[USB2PHY_PORT_OTG] = {

patches/27-usb-phy-tuning.patch

@@ -0,0 +1,128 @@
+diff --git a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+@@ -247,6 +247,7 @@
+ 	struct device	*dev;
+ 	struct regmap	*grf;
+ 	struct regmap	*usbgrf;
++	void __iomem	*phy_base;
+ 	struct clk_bulk_data	*clks;
+ 	struct clk	*clk480m;
+ 	struct clk_hw	clk480m_hw;
+@@ -1417,6 +1418,19 @@
+ 		return -EINVAL;
+ 	}
+ 
++	/*
++	 * RV1106 tunes signal quality through the PHY's own register block, which
++	 * is this node's "reg" resource and is distinct from the GRF regmap above.
++	 * Map it only where a tuning callback needs it; every other SoC here tunes
++	 * through the GRF and must keep working with phy_base left NULL.
++	 */
++	if (of_device_is_compatible(np, "rockchip,rv1106-usb2phy")) {
++		rphy->phy_base = devm_platform_ioremap_resource(pdev, 0);
++		if (IS_ERR(rphy->phy_base))
++			return dev_err_probe(dev, PTR_ERR(rphy->phy_base),
++					     "failed to map phy registers\n");
++	}
++
+ 	rphy->phy_reset = devm_reset_control_get_optional(dev, "phy");
+ 	if (IS_ERR(rphy->phy_reset))
+ 		return PTR_ERR(rphy->phy_reset);
+@@ -1506,6 +1520,30 @@
+ 	return ret;
+ }
+ 
++/*
++ * Direct PHY-register accessors. Most SoCs here tune through the GRF regmap,
++ * but the RV1106's signal-quality registers live in the PHY's own block, which
++ * is mapped separately into rphy->phy_base.
++ */
++static inline void phy_update_bits(void __iomem *reg, u32 mask, u32 val)
++{
++	u32 tmp = readl(reg);
++
++	tmp &= ~mask;
++	tmp |= val & mask;
++	writel(tmp, reg);
++}
++
++static inline void phy_set_bits(void __iomem *reg, u32 bits)
++{
++	writel(readl(reg) | bits, reg);
++}
++
++static inline void phy_clear_bits(void __iomem *reg, u32 bits)
++{
++	writel(readl(reg) & ~bits, reg);
++}
++
+ static int rk3128_usb2phy_tuning(struct rockchip_usb2phy *rphy)
+ {
+ 	/* Turn off differential receiver in suspend mode */
+@@ -2291,10 +2329,65 @@
+  * iddig_output/iddig_en/bvalid_grf_sel are dropped). Signal-quality phy_tuning is
+  * left off for now (guarded, so NULL is safe) — the phy is functional without it.
+  */
++/*
++ * RV1106 USB2 PHY signal-quality tuning, ported from the vendor 5.10 driver
++ * (drivers/phy/rockchip/phy-rockchip-inno-usb2.c, rv1106_usb2phy_tuning).
++ *
++ * The 6.18 forward-port originally omitted this ("the phy is functional without
++ * it"). It is functional, but not reliable: with these registers left at reset
++ * defaults the HS link is electrically marginal under sustained traffic. On a
++ * bench panel a USB-Ethernet dongle would stall a bulk transfer after a few
++ * minutes; the r8152 Tx-timeout recovery then issues an xHCI Stop Endpoint
++ * command which the controller never answers, and xhci-hcd declares the
++ * controller dead and tears the bus down (flare-edge issue #160). Measured
++ * carrier-on to death across four runs: 14s, 519s, 521s, 584s -- a stochastic
++ * spread, not a timer, which is what marginal signalling looks like.
++ *
++ * Pre-emphasis strength is silicon-revision dependent. The vendor driver picks
++ * it from rockchip_get_cpu_version(), which does not exist in mainline; it
++ * derives from RV1106_OS_REG1 (0xff020204) & 0x7. Our panels read 1, i.e. the
++ * non-zero branch, so 3'b001 is pinned here. If a board ever reports version 0
++ * it wants 3'b011 instead -- see the vendor driver.
++ */
++static int rv1106_usb2phy_tuning(struct rockchip_usb2phy *rphy)
++{
++	/* Mapped only for this compatible; refuse to poke a NULL base. */
++	if (!rphy->phy_base)
++		return -ENODEV;
++
++	/* Always enable pre-emphasis in SOF & EOP & chirp & non-chirp state */
++	phy_update_bits(rphy->phy_base + 0x30, GENMASK(2, 0), 0x07);
++
++	/* Set Tx HS pre_emphasize strength to 3'b001 (cpu_version != 0) */
++	phy_update_bits(rphy->phy_base + 0x40, GENMASK(5, 3), (0x01 << 3));
++
++	/* Set RX Squelch trigger point configure to 4'b0000(112.5 mV) */
++	phy_update_bits(rphy->phy_base + 0x64, GENMASK(6, 3), (0x00 << 3));
++
++	/* Turn off differential receiver by default to save power */
++	phy_clear_bits(rphy->phy_base + 0x100, BIT(6));
++
++	/* Set 45ohm HS ODT value to 5'b10111 to increase driver strength */
++	phy_update_bits(rphy->phy_base + 0x11c, GENMASK(4, 0), 0x17);
++
++	/* Set Tx HS eye height tuning to 3'b011(462 mV) */
++	phy_update_bits(rphy->phy_base + 0x124, GENMASK(4, 2), (0x03 << 2));
++
++	/* Bypass Squelch detector calibration */
++	phy_update_bits(rphy->phy_base + 0x1a4, GENMASK(7, 4), (0x01 << 4));
++	phy_update_bits(rphy->phy_base + 0x1b4, GENMASK(7, 4), (0x01 << 4));
++
++	/* Set HS disconnect detect mode to single ended detect mode */
++	phy_set_bits(rphy->phy_base + 0x70, BIT(2));
++
++	return 0;
++}
++
+ static const struct rockchip_usb2phy_cfg rv1106_phy_cfgs[] = {
+ 	{
+ 		.reg = 0xff3e0000,
+ 		.num_ports	= 1,
++		.phy_tuning	= rv1106_usb2phy_tuning,
+ 		.clkout_ctl	= { 0x0058, 4, 4, 1, 0 },
+ 		.port_cfgs	= {
+ 			[USB2PHY_PORT_OTG] = {

patches/29-usb2phy-no-blind-otg-sm.patch

@@ -0,0 +1,136 @@
+diff --git a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+--- a/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-usb2.c
+@@ -203,6 +203,7 @@
+  * @event_nb: hold event notification callback.
+  * @state: define OTG enumeration states before device reset.
+  * @mode: the dr_mode of the controller.
++ * @host_mode: the port is currently acting as a USB host.
+  */
+ struct rockchip_usb2phy_port {
+ 	struct phy	*phy;
+@@ -222,6 +223,7 @@
+ 	struct notifier_block	event_nb;
+ 	enum usb_otg_state	state;
+ 	enum usb_dr_mode	mode;
++	bool		host_mode;
+ };
+ 
+ /**
+@@ -239,6 +241,8 @@
+  * @dcd_retries: The retry count used to track Data contact
+  *		 detection process.
+  * @edev: extcon device for notification registration
++ * @edev_self_allocated: no extcon phandle in DT, so the OTG state machine
++ *			has no external role signal at all
+  * @irq: muxed interrupt for single irq configuration
+  * @phy_cfg: phy register configuration, assigned by driver data.
+  * @ports: phy port instance.
+@@ -257,6 +261,7 @@
+ 	enum power_supply_type	chg_type;
+ 	u8			dcd_retries;
+ 	struct extcon_dev	*edev;
++	bool			edev_self_allocated;
+ 	int			irq;
+ 	const struct rockchip_usb2phy_cfg	*phy_cfg;
+ 	struct rockchip_usb2phy_port	ports[USB2PHY_NUM_PORTS];
+@@ -459,6 +464,14 @@
+ 		if (ret)
+ 			return dev_err_probe(rphy->dev, ret,
+ 					     "failed to register extcon device\n");
++
++		/*
++		 * Nothing external drives the role on this board. The extcon
++		 * below is ours, and no code ever sets a cable state on it, so
++		 * the OTG state machine's view of the world is permanently
++		 * blank rather than merely stale.
++		 */
++		rphy->edev_self_allocated = true;
+ 	}
+ 
+ 	rphy->edev = edev;
+@@ -649,11 +662,52 @@
+ 	return 0;
+ }
+ 
++/*
++ * The OTG port's state machines only make sense while the port is a
++ * peripheral. In host role their inputs are meaningless on a board with no
++ * ID source: charger detection drives the analog front end of a port that is
++ * already enumerating a device, and its DCP verdict ends in
++ * rockchip_usb2phy_power_off(), which suspends the phy and drops the 480M
++ * clkout that the host controller's core runs on. The controller then stops
++ * clocking with its registers still readable, so it reports itself healthy
++ * while no transfer ever completes.
++ *
++ * dwc3 already calls phy_set_mode() on every role change, but this driver
++ * implemented no .set_mode, so the phy never learned the role. Track it and
++ * keep both state machines out of host role.
++ */
++static int rockchip_usb2phy_set_mode(struct phy *phy, enum phy_mode mode,
++				     int submode)
++{
++	struct rockchip_usb2phy_port *rport = phy_get_drvdata(phy);
++
++	if (rport->port_id != USB2PHY_PORT_OTG)
++		return 0;
++
++	switch (mode) {
++	case PHY_MODE_USB_HOST:
++		if (!rport->host_mode) {
++			rport->host_mode = true;
++			cancel_delayed_work_sync(&rport->otg_sm_work);
++			cancel_delayed_work_sync(&rport->chg_work);
++		}
++		break;
++	case PHY_MODE_USB_DEVICE:
++		rport->host_mode = false;
++		break;
++	default:
++		break;
++	}
++
++	return 0;
++}
++
+ static const struct phy_ops rockchip_usb2phy_ops = {
+ 	.init		= rockchip_usb2phy_init,
+ 	.exit		= rockchip_usb2phy_exit,
+ 	.power_on	= rockchip_usb2phy_power_on,
+ 	.power_off	= rockchip_usb2phy_power_off,
++	.set_mode	= rockchip_usb2phy_set_mode,
+ 	.owner		= THIS_MODULE,
+ };
+ 
+@@ -667,6 +721,15 @@
+ 	unsigned long delay;
+ 	bool vbus_attach, sch_work, notify_charger;
+ 
++	/*
++	 * This machine can only get the answer wrong here. In host role its
++	 * verdict suspends a phy that is enumerating a device (#160); with a
++	 * self-allocated extcon it has no role signal in EITHER direction, and
++	 * in device role it strands the gadget the same way (#168).
++	 */
++	if (rport->host_mode || rphy->edev_self_allocated)
++		return;
++
+ 	vbus_attach = property_enabled(rphy->grf,
+ 				       &rport->port_cfg->utmi_bvalid);
+ 
+@@ -825,6 +888,15 @@
+ 	bool is_dcd, tmout, vout, vbus_attach;
+ 	unsigned long delay;
+ 
++	/*
++	 * Never probe the front end of a port that is hosting a device, and
++	 * never at all on a board whose bvalid is pinned high by the VBUS
++	 * bypass: charger detection cannot be meaningful there, and its DCP
++	 * verdict powers the phy off underneath a working link (#160, #168).
++	 */
++	if (rport->host_mode || rphy->edev_self_allocated)
++		return;
++
+ 	vbus_attach = property_enabled(rphy->grf, &rport->port_cfg->utmi_bvalid);
+ 
+ 	dev_dbg(&rport->phy->dev, "chg detection work state = %d\n",

patches/README.md

@@ -18,6 +18,8 @@ with `../build/warden_defconfig` -> `zImage` + `rv1106-warden.dtb`).
 | `15-pinctrl.patch` | `pinctrl-rockchip` RV1106 iomux |
 | `20-arch-dts-bindings.patch` | `arch/arm` DTs (`rv1106.dtsi`, `rv1106-warden.dts`, pinctrl), mach, configs, `include/dt-bindings` |
 | `25-usb-phy.patch` | inno-usb2 phy |
+| `27-usb-phy-tuning.patch` | inno-usb2 phy: RV1106 signal-quality register tuning |
+| `29-usb2phy-no-blind-otg-sm.patch` | inno-usb2 phy: stop the OTG/charger state machines running blind |
 | `30-drm-vop-panel-rgb.patch` | VOP (`rgb_dclk_pol`=0 + WIN1 scanout), panel-simple bus-format, rockchip_rgb |
 | `35-mailbox-hpmcu.patch` | rockchip-mailbox (rv1106 num_chans=1) |
 | `40-pvtm-soc.patch` | PVTM (core+pmu) + `include/soc/rockchip/pvtm.h` |

qemu/tests/qmp.py

@@ -78,6 +78,11 @@ math, this file only drives it.
                            1 dimmed, 2 asleep), read off a fresh `stats`
                            reply (warden_debug.c). Same OP vocabulary as
                            assert_json.
+    wait_stat FIELD OP VALUE TIMEOUT_S
+                           assert_stat, polled every 0.5s (poll_until) until
+                           it holds or TIMEOUT_S elapses -- for a field like
+                           fps that a rolling window can still report as 0
+                           right after the page holding it opens.
     capture_region NAME X Y W H TOLERANCE
                            screendump now, crop to X,Y,WxH, and (over)write
                            NAME in the refs file with both a phash and a
@@ -588,6 +593,29 @@ def eval_json(ctl, path, op, value):
     return ok, "" if ok else f"{path} is {actual!r}"
 
 
+# The fields assert_stat/wait_stat expose. parse_stats() itself recognizes a
+# couple more (STATS_FIELD_RE has 'releases') that these verbs don't -- this
+# is the whitelist both verbs enforce, not everything a `stats` reply carries.
+STAT_FIELDS = ("cpu", "fps", "render", "idle", "presses", "termbusy", "termintr", "termfg", "termsig")
+
+
+def eval_stat(ctl, field, op, value):
+    """One `stats` fetch + field-lookup + op-apply round for
+    assert_stat/wait_stat. -> (ok, detail); detail is empty on success,
+    otherwise the reason."""
+    if field not in STAT_FIELDS:
+        return False, (f"unknown stat field {field!r} "
+                        f"(known: {', '.join(STAT_FIELDS)})")
+    stats = parse_stats(ctl.send("stats"))
+    if field not in stats:
+        return False, "no such field"
+    try:
+        ok = apply_op(op, stats[field], value)
+    except (TypeError, ValueError) as e:
+        return False, str(e)
+    return ok, "" if ok else f"{field} is {stats[field]}"
+
+
 STATS_FIELD_RE = {
     "cpu": re.compile(r'^cpu:\s*(-?\d+(?:\.\d+)?)%?\s*$'),
     "fps": re.compile(r'^fps:\s*(-?\d+(?:\.\d+)?)\s*$'),
@@ -908,18 +936,26 @@ def verb_wait_json(ctx, lineno, cmd, args, line):
 def verb_assert_stat(ctx, lineno, cmd, args, line):
     # assert_stat FIELD OP VALUE: FIELD off a fresh `stats` reply.
     ctx.need_ctl(lineno, cmd)
-    field, op, value = args[0], args[1], args[2]
-    if field not in ("cpu", "fps", "render", "idle", "presses", "termbusy", "termintr", "termfg", "termsig"):
-        return "fail", (f"unknown stat field {field!r} "
-                        f"(known: cpu, fps, render, idle, presses, termbusy, termintr, termfg, termsig)")
-    stats = parse_stats(ctx.ctl.send("stats"))
-    if field not in stats:
-        return "fail", "no such field"
-    try:
-        ok = apply_op(op, stats[field], value)
-    except (TypeError, ValueError) as e:
-        return "fail", str(e)
-    return ("ok" if ok else "fail"), ("" if ok else f"{field} is {stats[field]}")
+    ok, detail = eval_stat(ctx.ctl, args[0], args[1], args[2])
+    return ("ok" if ok else "fail"), detail
+
+
+def verb_wait_stat(ctx, lineno, cmd, args, line):
+    # wait_stat FIELD OP VALUE TIMEOUT_S: eval_stat polled every 0.5s
+    # (poll_until) until it holds or the deadline passes. warden-ui's fps
+    # counter is a rolling one-second window (warden_debug.c): a single
+    # sample taken right after a page opens can read 0 even though the UI
+    # is live and about to report a real rate, on a runner slow enough that
+    # window hasn't filled yet (flare-edge #44). This exists for
+    # exactly that shape of check, the same reason wait_json exists for the
+    # asynchronously-written status file.
+    ctx.need_ctl(lineno, cmd)
+    field, op, value, timeout_s = args[0], args[1], args[2], float(args[3])
+    ok, detail, waited, fatal = poll_until(
+        lambda: eval_stat(ctx.ctl, field, op, value), timeout_s)
+    if fatal:
+        return "fatal", detail
+    return ("ok" if ok else "fail"), (f"waited {waited:.1f}s" if ok else detail)
 
 
 def verb_capture_region(ctx, lineno, cmd, args, line):
@@ -1057,6 +1093,7 @@ VERBS = {
     "assert_json": verb_assert_json,
     "wait_json": verb_wait_json,
     "assert_stat": verb_assert_stat,
+    "wait_stat": verb_wait_stat,
     "capture_region": verb_capture_region,
     "assert_region": verb_assert_region,
     "wait_region": verb_wait_region,
@@ -1112,12 +1149,12 @@ def drive(s, f, script_path, outdir, size, ctl_path=None, console_path=None, ref
             # reason: several verbs parse their own arguments with bare
             # int()/float()/positional indexing before any handler-local
             # guard (tap, swipe, fling, sleep, wait_hit, wait_json,
-            # capture_region, wait_region), and a malformed or missing
-            # argument -- a typo'd coordinate, a hand-edited *.txt script, a
-            # future flowc.py bug -- used to raise straight out of drive()
-            # and silently drop every row from that line onward, the exact
-            # truncated-run failure mode this file exists to rule out
-            # (flare-edge #244).
+            # wait_stat, capture_region, wait_region), and a malformed or
+            # missing argument -- a typo'd coordinate, a hand-edited *.txt
+            # script, a future flowc.py bug -- used to raise straight out
+            # of drive() and silently drop every row from that line
+            # onward, the exact truncated-run failure mode this file
+            # exists to rule out (flare-edge #244).
             # Recorded the same as any other fatal row: the run keeps going
             # past it.
             result = ("fatal", str(e))

qemu/tests/test_qmp_drive.py

@@ -387,6 +387,24 @@ class PureHelpers(unittest.TestCase):
                                "termbusy": 1.0, "termintr": 2.0,
                                "termfg": -1.0, "termsig": 3.0})
 
+    def test_eval_stat_rejects_unknown_fields_and_catches_bad_ops(self):
+        # eval_stat's own whitelist is narrower than parse_stats(): 'releases'
+        # is a real field in a `stats` reply (see test_parse_stats) but not
+        # one assert_stat/wait_stat expose. And it must catch apply_op's
+        # (TypeError, ValueError) the same way eval_json does, so a malformed
+        # OP reads as an ordinary fail, not a driver crash, for both the
+        # single-read and the polling verb built on top of it.
+        ctl = FakeCtl("x")
+        ok, detail = qmp.eval_stat(ctl, "releases", "eq", "1")
+        self.assertFalse(ok)
+        self.assertIn("unknown stat field", detail)
+        ok, detail = qmp.eval_stat(ctl, "fps", "bogus", "1")
+        self.assertFalse(ok)
+        self.assertIn("bogus", detail)
+        ok, detail = qmp.eval_stat(ctl, "fps", "eq", "10")
+        self.assertTrue(ok)
+        self.assertEqual(detail, "")
+
     def test_poll_until_turns_a_channel_fault_into_fatal_not_a_raise(self):
         # A CHECK that raises RuntimeError or OSError (Ctl.send on EOF or a
         # socket timeout) must stop poll_until() and come back with the
@@ -425,6 +443,7 @@ class DriveVerbs(unittest.TestCase):
             "wait_json list len_ge 2 2\n"
             "assert_json name eq warden\n"
             "assert_stat fps gt 0\n"
+            "wait_stat fps gt 0 2\n"
             "nav Demo/Rows\n"
             "capture_region r1 0 0 8 8 exact\n"
             "assert_region r1 exact\n"
@@ -435,8 +454,9 @@ class DriveVerbs(unittest.TestCase):
             "home\n"
         )
         self.assertIsNone(rc, [r for r in rows if r["status"] != "ok"])
-        self.assertEqual(len(rows), 16)
+        self.assertEqual(len(rows), 17)
         self.assertIn("waited", by["wait_hit 47 676 obj 2 box=12,640,72x72"]["detail"])
+        self.assertIn("waited", by["wait_stat fps gt 0 2"]["detail"])
         self.assertTrue(all(r["status"] == "ok" for r in rows))
 
     def test_mismatches_are_fails_not_stops(self):
@@ -447,17 +467,19 @@ class DriveVerbs(unittest.TestCase):
             "wait_json a.b eq 2 1\n"
             "assert_json a.zz eq 1\n"
             "assert_stat fps lt 0\n"
+            "wait_stat fps lt 0 1\n"
             "scroll 360 400 0\n"
             "wait_hit 47 676 obj 1 box=0,0,1x1\n"
             "assert_page Demo/Rows\n"
         )
         self.assertEqual(rc, 1)
         self.assertEqual([r["status"] for r in rows],
-                         ["fail", "fail", "fail", "fail", "fail", "fail", "fail", "ok"])
+                         ["fail", "fail", "fail", "fail", "fail", "fail", "fail", "fail", "ok"])
         self.assertIn("moved", by["assert_hit 47 676 obj box=0,0,1x1"]["detail"])
         self.assertIn("moved", by["wait_hit 47 676 obj 1 box=0,0,1x1"]["detail"])
-        self.assertGreaterEqual(time.monotonic() - t0, 2.0,
-                                "wait_json and wait_hit must each honour their timeout")
+        self.assertIn("fps is 10.0", by["wait_stat fps lt 0 1"]["detail"])
+        self.assertGreaterEqual(time.monotonic() - t0, 3.0,
+                                "wait_json, wait_stat and wait_hit must each honour their timeout")
 
     def test_dying_channel_is_fatal_for_the_step_not_a_crash(self):
         # A page still building when the control channel itself drops mid-
@@ -484,13 +506,23 @@ class DriveVerbs(unittest.TestCase):
         self.assertEqual([r["status"] for r in rows], ["fatal", "ok"])
         self.assertIn("control channel closed", by["wait_hit 47 676 obj 2"]["detail"])
 
+        rc, by, rows = run_script(
+            "wait_stat fps gt 0 2\n"
+            "sleep 0\n",
+            ctl_cls=DyingCtl,
+        )
+        self.assertEqual(rc, 1)
+        self.assertEqual([r["status"] for r in rows], ["fatal", "ok"])
+        self.assertIn("control channel closed", by["wait_stat fps gt 0 2"]["detail"])
+
     def test_dying_channel_is_fatal_for_every_verb_not_just_wait(self):
-        # wait_hit/wait_json route the channel through poll_until, which has
-        # always caught this. Every other verb that reaches ctl.send()
-        # directly did not, and used to crash the whole run instead of
-        # recording one fatal row and moving on. One representative of each
-        # family, back to back: every one must read as its own `fatal` row
-        # and the script must still reach the last line.
+        # wait_hit/wait_json/wait_stat route the channel through poll_until,
+        # which has always caught this. Every other verb that reaches
+        # ctl.send() directly did not, and used to crash the whole run
+        # instead of recording one fatal row and moving on. One
+        # representative of each family, back to back: every one must read
+        # as its own `fatal` row and the script must still reach the last
+        # line.
         rc, by, rows = run_script(
             "nav Demo/Rows\n"
             "wake\n"
@@ -500,12 +532,13 @@ class DriveVerbs(unittest.TestCase):
             "assert_hit 47 676 obj\n"
             "assert_json a.b eq 1\n"
             "assert_stat idle eq 0\n"
+            "wait_stat fps gt 0 1\n"
             "sleep 0\n",
             ctl_cls=ImmediateDyingCtl,
         )
         self.assertEqual(rc, 1)
         self.assertEqual([r["status"] for r in rows],
-                         ["fatal"] * 8 + ["ok"],
+                         ["fatal"] * 9 + ["ok"],
                          "a dead channel must not crash the run: every ctl "
                          "verb gets its own fatal row and sleep still runs")
         for row in rows[:-1]:
@@ -534,12 +567,12 @@ class DriveVerbs(unittest.TestCase):
     def test_malformed_numeric_argument_is_fatal_for_the_step_not_a_crash(self):
         # Several verbs parse their own arguments with bare
         # int()/float()/positional indexing before any handler-local guard
-        # (tap, swipe, fling, sleep, wait_hit, wait_json, capture_region,
-        # wait_region). A typo'd coordinate or a missing argument -- exactly
-        # what a hand-edited *.txt script or a flowc.py bug can produce --
-        # used to raise ValueError/IndexError straight out of drive(),
-        # losing every row from that line onward instead of reading as its
-        # own fatal row (flare-edge #244).
+        # (tap, swipe, fling, sleep, wait_hit, wait_json, wait_stat,
+        # capture_region, wait_region). A typo'd coordinate or a missing
+        # argument -- exactly what a hand-edited *.txt script or a flowc.py
+        # bug can produce -- used to raise ValueError/IndexError straight
+        # out of drive(), losing every row from that line onward instead of
+        # reading as its own fatal row (flare-edge #244).
         rc, by, rows = run_script(
             "tap 10 abc\n"
             "sleep 0\n",
@@ -565,6 +598,15 @@ class DriveVerbs(unittest.TestCase):
         self.assertIn("invalid literal",
                       by["capture_region r1 0 0 8 notanumber exact"]["detail"])
 
+        rc, by, rows = run_script(
+            "wait_stat fps gt 0 notanumber\n"
+            "sleep 0\n",
+        )
+        self.assertEqual(rc, 1)
+        self.assertEqual([r["status"] for r in rows], ["fatal", "ok"])
+        self.assertIn("could not convert string to float",
+                      by["wait_stat fps gt 0 notanumber"]["detail"])
+
     def test_bad_op_reads_as_a_fail_row_not_a_crash(self):
         # apply_op's error paths (unknown OP -> ValueError, 'contains'
         # against the wrong type -> TypeError) are caught by both callers