All three stashes distilled into docs and dropped: xdp.md carries the AF_XDP record (ixgbe's 3 KB single-buffer XDP cap excludes the locked jumbo mix; XSK need_wakeup TX as the spin-free flow control, zero-copy-or-die, the stray-RX fill-ring trap, BTF-resolved stamp kfunc, wire-weighted size schedule as an unadopted option); connectx-5 README gains the PCICONF/ICMD/MCIA gateway constants so a rebuild needs no mstflint re-mine; e810 keeps the read-side transport map (cage-cache, bus=port, bus-5 phantom, 16-bit-addr hazard, latency as wire-truth) and NVM rollback pointers; x710 the >=30 ms EEPROM write pacing; fibergaga the empirical vendor-space finds; fs the inert-I2C-surface map; state.md stash section now empty

docs/modules/fibergaga/README.md

@@ -15,6 +15,22 @@ The documented oracle — and only that: the part's 30 m reach limit makes it un
 | 1E.C880–C883 | Reflection impedance/magnitude |
 | PMA 1.133–1.140, PCS 3.32/3.33 | Standard set ([../README.md](../README.md)), proven live |
 
+## Vendor space found empirically (beyond the documented set)
+
+From a 544-register sweep of the vendor regions plus snapshot-diffing to separate live counters from static state (staleness ruled out: 20/20 interleaved known-value reads correct). The method transfers to any undocumented map — sweep for nonzero, then diff snapshots across time and across link events:
+
+| Register | Behaviour |
+|---|---|
+| 1E.C886 | Link uptime, monotonic +1 per second |
+| 1E.C869 | ~452 Hz free-running clear-on-read tick — **not errors**: returned an identical count on consecutive fixed-length samples, deterministic where errors would be Poisson |
+| 1E.C860–C868 | MDIO write shadow log — echoes devad/register/value of the last write |
+| 1E.C820/C821 | Die temperature (~97 °C on bench) and its valid bit |
+| 3.C820, 3.E810, 3.E812 | Spike during link training, quiet on a settled link |
+
+Live behaviour of the documented 3.E820 (post-FEC uncorrected frames): reads 0 on a settled link, ~1852 within 0.7 s of a retrain — LDPC coding gain keeps it at exactly zero anywhere short of the margin cliff, so it moves during training and near failure, nothing in between.
+
+Two negative results worth keeping: short-reach mode (PMA 1.131 bit 0) lowers *our* launch power, which degrades the far end's receive, not our own SNR — useless for self-degradation; and per-pair margins are retrain-dependent on this module too (the same cable trained to 66/45/56/48 and 52/36/45/46 in consecutive sessions) — compare within one training session only.
+
 ## Pre-FEC correlation run (verification, not classification)
 
 `3.E820` is post-FEC; the pre-FEC counters are the corrected-by-iteration histogram (3.E840–E84E). The correlation run verifies the expected ordering; this module is its instrument. Design points:

docs/modules/fs/README.md

@@ -16,6 +16,12 @@ PHY at I2C 8-bit **0xAC write / 0xAD read**.
 - Single-byte reads see the bridge as inert (returns 0) — the DevAD-prefixed frame + delay is mandatory. This is why early probing wrongly declared 0x56 dead. Treat 0x0000 reads as retry-with-longer-delay: 0 is also the bridge's not-ready signature.
 - Recorded for a future multi-byte firmware transport (mlx5 MCIA shape): read = write `[001+devad,RegH,RegL]` offset_size=1, STOP, >1 ms, read 2 B offset_size=0; write = offset_size=2, addr = devad<<8|RegH, data = `[RegL,DataH,DataL]`.
 
+## The rest of the I2C surface (probed exhaustively over a real write path)
+
+- **Undeclared live DOM**: A0h byte 92 (0x5C) claims no DDM, but A2h 0x60+ serves real temperature/Vcc/bias/power (~79 °C, 3.25 V observed on bench). Usable read-only.
+- **A2h 0x00–0x7A takes writes and is plain memory, not a mailbox**: every non-volatile byte holds any value, tagged block writes cause zero side effects anywhere in A2h, and sliding the command-handler STATUS signature (1E.4037, idle 0x0004) across every consecutive 3-byte window in both byte orders never surfaced it. 0x7B–0xFF does not take writes (0x7B–0x7E RollBall password area, write-only by convention; 0x7F page register pinned 0xFF; upper half reads zeros).
+- The 7-bit 0x53 window ACKs every read and write and always serves zeros — inert, unlike 0x56, whose zeros were the unframed bridge.
+
 ## Host interface (XFI) bring-up gating
 
 **The module never enables its XFI TX toward the host until it receives valid host signal** — observed live on the ConnectX-5, where it produces a mutual-wait deadlock ([../../nics/connectx-5/README.md](../../nics/connectx-5/README.md)):