dcd(ci_hs): stale overlay fix; run usbtest on lpcxpresso43s67

- dcd_edpt_stall flushes the primed buffer (ENDPTFLUSH), but the aborted
  transfer's dQH overlay can be left ACTIVE with mid-transfer state; the
  next prime after clear-halt then resumes the stale overlay instead of
  loading the fresh qtd, so post-halt IN reads return mid-buffer data
  (usbtest case 13 'buf[32] = 56 (not 0)', with case 18 failing
  downstream of the same corruption in the full battery). qhd_start_xfer
  now clears overlay.active alongside overlay.halted before linking the
  new qtd.
- test/hil(hfp): drop lpcxpresso43s67's device/usbtest skip - the
  historical first-case wedge no longer reproduces on this branch, and
  with the overlay fix the board runs 30/30 on its Fresco xHCI host
  (previously 28/30 with deterministic case 13/18 failures).
  mimxrt1064_evk (imxrt dcache path) 30/30 regression-clean.
- docs(hil skill): document the external hifiphile rig - pool
  test/hil/hfp.json, SSH-reachable from htpc/ci with no outbound SSH,
  exercised by the CI hil-tinyusb (hfp.json) job; never run HIL against
  it during development unless the user explicitly asks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017TQZrFfU3K4Y198aLsUpBC

.claude/skills/hil/SKILL.md

@@ -11,9 +11,15 @@ Run TinyUSB HIL tests on real boards. **Run `hostname` first** — it tells you
 |------|--------------|------------------------|
 | `htpc` (dev PC) | `test/hil/local.json` | yes (large pool, `test/hil/tinyusb.json`) |
 | `ci` (the rig) | `test/hil/tinyusb.json` (large pool) | no — can't SSH to htpc, and boards are already local |
+| `hifiphile` (external rig) | `test/hil/hfp.json` | no outbound SSH to htpc/ci; SSH-reachable FROM both |
 
 Default to **local**. Use **remote** only when on `htpc` and the user says `remote`/`ci.lan`. Never attempt remote on `ci`.
 
+The `hifiphile` rig is externally hosted by TinyUSB maintainer hifiphile; its board pool is
+`test/hil/hfp.json` and its HIL runs are triggered by GitHub CI (the `hil-tinyusb (hfp.json)`
+matrix job). **Never run HIL against this rig during development unless the user explicitly
+asks for it.**
+
 ## Board locks — the CI runner keeps running
 
 The `ci` rig also hosts a GitHub Actions runner that flashes boards and runs HIL as part of CI. Hardware access is arbitrated **per board** with kernel flocks in `/tmp/tinyusb-hil-locks/` — do NOT stop the runner service.

src/portable/chipidea/ci_hs/dcd_ci_hs.c

@@ -393,7 +393,8 @@ void dcd_edpt_stall(uint8_t rhport, uint8_t ep_addr) {
   ci_hs_regs_t *dcd_reg = CI_HS_REG(rhport);
   dcd_reg->ENDPTCTRL[epnum] |= ENDPTCTRL_STALL << (dir ? 16 : 0);
 
-  // flush to abort any primed buffer
+  // flush to abort any primed buffer; the aborted transfer's dQH overlay can be left
+  // ACTIVE with mid-transfer state - qhd_start_xfer clears it before the next prime
   dcd_reg->ENDPTFLUSH = TU_BIT(epnum + (dir ? 16 : 0));
 }
 
@@ -497,6 +498,7 @@ static void qhd_start_xfer(uint8_t rhport, uint8_t epnum, uint8_t dir) {
   dcd_qtd_t    *p_qtd   = &_dcd_data.qtd[epnum][dir];
 
   p_qhd->qtd_overlay.halted = false;           // clear any previous error
+  p_qhd->qtd_overlay.active = false;           // a flushed prime leaves stale ACTIVE state; clear it so the fresh qtd loads
   p_qhd->qtd_overlay.next   = (uint32_t)p_qtd; // link qtd to qhd
 
   // flush cache

test/hil/hfp.json

@@ -31,9 +31,7 @@
             "name": "lpcxpresso43s67",
             "uid": "08F000044528BAAA8D858F58C50700F5",
             "tests": {
-                "device": true, "host": false, "dual": false,
-                "skip": ["device/usbtest"],
-                "comment": "usbtest skipped: ip3511 HS wedges from the first control case (1/30); needs on-rig debugging"
+                "device": true, "host": false, "dual": false
             },
             "flasher": {
                 "name": "jlink",