hil: add ea4088_quickstart with an RTT consolehil-add-ea4088qs

The board's probe is an LPC-Link2 with no VCOM, so its console is RTT. Two
host tests could not run that way: test_host_cdc_msc_hid and
test_host_msc_file_explorer opened the flasher's VCOM directly instead of
going through open_board_console(), and the config gate rejecting
is_cdc/is_msc fixtures on "logger": "rtt" boards existed only to keep them
from dying mid-run on a port that does not exist.

Route both through the console abstraction and drop the gate. The reset
ordering differs per console -- RTT owns the probe so the board must be reset
before the console opens, a VCOM survives the reset so it opens first -- and
that rule now lives in open_console_reset() instead of being spelled out at
each call site.

The roster entry runs device, host and dual: USB1's Type-A drives a hub with
a CH340 (TX-RX shorted, for the cdc echo) and a thumbdrive, while USB2 keeps
serving the device tests. BUFFER_SIZE_DOWN=128 because that echo writes up to
64 bytes at once and SEGGER's ring keeps one byte free, which the 16-byte
default cannot hold; 64 measured unreliable, 128 reliable.

Measured on the rig: 19 passed, 0 failed, 0 skipped. usbtest 30/30, host MSC
reads 682 KB/s, device CDC/MSC ~510 kB/s (full speed behind the rig's hub).

2 files changed, 20 insertions, 31 deletions

diff --git a/docs/reference/hil_boards.md b/docs/reference/hil_boards.md
index 678f7f0ed..074fc7741 100644
--- a/docs/reference/hil_boards.md
+++ b/docs/reference/hil_boards.md
@@ -2,7 +2,7 @@
 
 ### ci rig
 
-27 boards, from `test/hil/tinyusb.json`.
+28 boards, from `test/hil/tinyusb.json`.
 
 | Board                    | Roles              | Flasher   | Variants                                               | Note                                                                                                                                                                   |
 |--------------------------|--------------------|-----------|--------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
@@ -14,6 +14,7 @@
 | max32666fthr             | device             | openocd   |                                                        |                                                                                                                                                                        |
 | metro_m4_express         | device, dual       | jlink     | metro_m4_express                                       | pl23x; audio_test_freertos skipped: samd51 iso-IN capture fails (arecord EIO)                                                                                          |
 | lpcxpresso11u37          | device             | jlink     |                                                        |                                                                                                                                                                        |
+| ea4088_quickstart        | device, host, dual | jlink     | ea4088_quickstart                                      | console is the LPC-Link2's RTT channel: this probe has no VCOM (rtt skill)                                                                                             |
 | lpcxpresso55s28          | device             | jlink     |                                                        |                                                                                                                                                                        |
 | ra4m1_ek                 | device             | jlink     |                                                        |                                                                                                                                                                        |
 | raspberry_pi_pico        | device, host, dual | openocd   | raspberry_pi_pico                                      |                                                                                                                                                                        |
diff --git a/docs/superpowers/followup/pr3853-rtt-harness-adoption.md b/docs/superpowers/followup/pr3853-rtt-harness-adoption.md
index 8f3eae16b..80562e700 100644
--- a/docs/superpowers/followup/pr3853-rtt-harness-adoption.md
+++ b/docs/superpowers/followup/pr3853-rtt-harness-adoption.md
@@ -12,36 +12,26 @@ src-level `board_putchar` asymmetry this work surfaced has its own handoff
   ea4088_quickstart runs its host suite over RTT (16 passed / 0 failed / 3
   skipped, the 'hil: read the host console over RTT when the probe has no VCOM' commit), and the `rtt` skill's boards.md carries the
   validated matrix.
-- `test_host_device_info` honors `"logger": "rtt"` (hil_test.py, `test_host_device_info`; the eof fail-fast assert sits in its read loop):
-  in RTT mode it resets via the flasher BEFORE opening the console (which
-  then owns the probe; Commander delivers the buffered boot burst) and its
-  read loop fails fast on `JlinkRtt.eof` instead of blaming the board.
+- All three host tests honor `"logger": "rtt"`: `test_host_device_info`,
+  `test_host_cdc_msc_hid` and `test_host_msc_file_explorer` open through
+  `open_console_reset()` (hil_test.py), which does the per-console reset
+  ordering — RTT resets via the flasher BEFORE opening (the console owns the
+  probe; Commander delivers the buffered boot burst), VCOM resets after — and
+  each read loop fails fast on `JlinkRtt.eof` instead of blaming the board.
+  Landed with the ea4088_quickstart roster entry; the interim load-time gate
+  that rejected `logger: rtt` + `is_cdc`/`is_msc` is gone.
 
 ## Remaining gaps
 
-1. **`test_host_cdc_msc_hid` and `test_host_msc_file_explorer` (hil_test.py) still call `hil_util.get_serial_dev(flasher["uid"], ...)`
-   directly** — on a `logger: rtt` board with `is_cdc`/`is_msc` fixtures they
-   would fail with the same "No serial device found" the console work fixed
-   for device_info (an interim load-time gate in `hil_test.py` now rejects
-   that combination up front; delete the gate when this lands). Fix: route
-   both through `open_board_console(board)` — but design the conversion
-   reset-aware rather than hand-copying device_info's dual branch: hoist a
-   `reset=` parameter into `open_board_console` that does the per-console
-   ordering itself (RTT: reset via flasher BEFORE opening — the console owns
-   the probe; VCOM: reset after open to catch the banner), and REMOVE the
-   existing post-open `# reset device to catch mount messages` blocks in both
-   tests (grep the marker — line numbers churn) — kept as-is on an RTT board they reset
-   while the console holds the probe. `JlinkRtt` carries input for their
-   menus and implements the `reset_input_buffer()` those tests call.
-2. **`hil_pool_check.check_host_serial` carries its own inline RTT branch**
+1. **`hil_pool_check.check_host_serial` carries its own inline RTT branch**
    (reset → `JlinkRtt` → poll through `hil_util.strip_banner`) — RTT boards
    ARE health-checkable today, but the console-opening logic now lives in
-   two places (`open_board_console` in hil_test.py and this branch), each
-   with its own reset-ordering. Fix: hoist `open_board_console()` into
-   `hil_util.py` with the `reset=` parameter from item 1 and collapse
-   pool_check's branch onto it; keep the `do_reset` flush semantics for the
-   VCOM path intact.
-3. **OpenOCD console backend in the harness**: the skill's CLI
+   two places (`open_console_reset` in hil_test.py and this branch), each
+   with its own reset-ordering. Fix: hoist `open_console_reset()` into
+   `hil_util.py` next to `open_board_console()` and collapse pool_check's
+   branch onto it; keep the `do_reset` flush semantics for the VCOM path
+   intact.
+2. **OpenOCD console backend in the harness**: the skill's CLI
    (`tools/rtt.py --backend openocd`, class
    `OpenocdRtt` in the same module) is built, deduplicated behind a shared
    base class next to `JlinkRtt` in `tools/rtt.py`, re-exported by
@@ -55,8 +45,6 @@ src-level `board_putchar` asymmetry this work surfaced has its own handoff
 
 ## Validation for this follow-up
 
-Run the ea4088 local host suite (a board with a `is_cdc`+`is_msc` capable
-device attached to J3, or the rig's frdm_k64f/mimxrt1064 with a temporary
-`logger: rtt` entry) so cdc_msc_hid and msc_file_explorer actually execute
-over RTT; then a `hil_pool_check.py` pass on a no-VCOM board. Delete this doc
-when the follow-up PR lands.
+A `hil_pool_check.py` pass on a no-VCOM board (ea4088_quickstart), plus the
+ea4088 host suite to show the collapse did not change the reset ordering the
+three tests depend on. Delete this doc when the follow-up PR lands.