Add FS/BCM capability inventory; drop SNR/power-backoff length proxies -- length is PHY features or NIC timestamps only

docs/modules.md

@@ -27,6 +27,21 @@ Proven on the CUX3610 before they died, and on the Fibergaga oracle — all IEEE
 
 Not available in safe space: pre-FEC counter, cable length. Those live in the µC vendor space that killed the modules.
 
+## What the FS/BCM gives
+All via the SMI bridge + command handler (transports.md carries the codes and the invocation traps). Proven on the X520:
+- **Per-pair SNR** — CMD_GET_SNR 0x8030 invoked bare: DATA2–5 = absolute receiver SNR in 0.1 dB (bench ≈ 27–32 dB; the 10GBASE-T operating point is ≈ 26.5 dB, so margin ≈ value − 26.5). The IEEE registers 1.133–1.140 stay at 0x8080 — handler only.
+- **Die temperature** (0x8031) and **supply rails** (0x802F) — module health.
+- **Standard PCS 3.32/3.33** — block lock, latched errored-block/BER counters, clear-on-read: the noise-stress error proxy.
+- **Retrain** — IEEE AN restart `7.0 |= bit9`, relinks in ~6 s.
+
+Documented in the handler table, not yet exercised:
+- **CMD_GET_PAIR_SWAP 0x8000** — MDI wiring/crossover/polarity report.
+- **GET_LIMITED_REACH_MODE 0x8006** — DATA3 = "currently linked in limited-reach mode": the only handler-visible consequence of the DSP's internal cable-length estimate, a single short/long bit, and only meaningful when LR mode is enabled (a config change — measure-only by default).
+- **GET_EEE_MODE 0x8008 / GET_EEE_STATISTICS 0x801B** — verify EEE is off before trusting loss numbers.
+- **GET_SUB_LF_RF_STATUS 0x800D** — local/remote fault detail.
+
+**No cable length.** The handler catalog is complete (§1.25.1.1–45: pair swap through WOL) and contains no ECD, length, or skew command. Cable length, opens/shorts, pair skew, and polarity live in the separate ECD register mechanism whose chapter FS hasn't sent — still the one outstanding ask. Until it lands, FS-side length comes only from the NIC timestamp path — in contrast to the Aquantia oracle, whose `1E.C884` length register is fully documented.
+
 ## Marvell cable-length register candidates (unverified, single-shot only)
 From kernel drivers for sibling parts — templates for a *future* single targeted probe on a sacrificial module, never a sweep, never near `*.0x??64`: