BCM path proven on X520: fix multi-byte i2c read (SDA release), GET_SNR is 0x8030 invoked bare, IEEE SNR regs dead on BCM, module pause forced off

docs/transports.md

@@ -49,9 +49,13 @@ Docs are in this folder (`10GBase-T...BCM84891.pdf` transport, `BCM84891L-MDIO C
   4. Poll STATUS for PASS/ERROR.
   5. Read DATAn for results.
   - Poll ~100 ms; STATUS is frozen up to 2 s during 10GBASE-T training, so only run after link up.
-- **Commands**:
-  - **CMD_GET_SNR** (GET commands 0x8000+; detail §1.25.1.24): DATA2/10..DATA5/10 = per-pair SNR dB (channels A–D).
-  - Also pair swap/skew/polarity, die temp, voltage, 1588.
+- **Commands** (codes verified on hardware — the PDF's command-table columns misalign under text extraction; the check that settled it was GET_CURRENT_VOLTAGE = 0x802F returning the 0.8/1.88 V rails in tenths of mV):
+  - **CMD_GET_SNR = 0x8030** — invoke with **no DATA1 write**; writing the documented display flag makes this firmware return zeros. Bare invocation returns DATA2–5 = per-pair SNR (channels A–D) in tenths of dB. Bench: 27–32 dB absolute, ~0.1–0.4 dB read-to-read jitter. This is *absolute* receiver SNR, not margin (10GBASE-T operating point ≈ 26.5 dB).
+  - The IEEE PMA SNR registers 1.133–1.140 read a constant 0x8080 on the BCM — never populated, display flag inert. **On FS modules SNR comes from the command handler, not standard registers.**
+  - **CMD_GET_CURRENT_TEMP = 0x8031** (die runs ~70 °C on bench), **GET_CURRENT_VOLTAGE = 0x802F**.
+  - **Trap: 0x8020 is SET_PAUSE_FRAME_MODE** — a config *write*, and the handler executes whatever stale DATA1 holds as its argument. Module pause is explicitly set to 0 (off — the state cabletest requires); GET_PAUSE_FRAME_MODE (0x801F) returns junk on this firmware, so treat the setting as write-only.
+  - The >1 ms SMI read delay: 3 ms works reliably.
+  - Also pair swap/skew/polarity, 1588.
   - **Enhanced Cable Diagnostics** (shorts/opens/**cable length**) is a headline feature, but its invocation is NOT in the command-code table (0x8000–0x805B) — it's a separate ECD register mechanism whose chapter isn't in the docs FS sent. This is the one outstanding ask to FS.
 
 **Correct BCM SMI framing over the E810 topo-I2C** (recorded in case a write-capable multi-byte transport reappears): read = write `[001+devad,RegH,RegL]` offset_size=1, STOP, >1 ms, then read 2 B offset_size=0; write = offset_size=2, addr = devad<<8|RegH, data = `[RegL,DataH,DataL]`.