Dissolve resolved analyses into standalone device docs; open-questions.md keeps only the four live problems; discard NIC-timestamp length path (BCM ECD is proven) and Aquantia length trivia (30m part, oracle-only)

docs/modules/README.md

@@ -53,6 +53,5 @@ Split transactions (separate STOP per byte) are field-proven on both the Fiberga
 
 ## Cable-length physics (applies to all vendors)
 
-- **TDR** (classic VCT/CDT/ECD): locates opens/shorts both-ended. But *healthy-cable length* needs a far-end reflection, and a plugged-in terminated far end absorbs the pulse — "OK" pairs report no distance. Effectively single-ended for length; every kernel implementation only reports distance for *fault* results.
+- **TDR** (classic VCT/CDT/ECD): locates opens/shorts both-ended. The generic concern — *healthy-cable length* needs a far-end reflection, and a plugged-in terminated far end absorbs the pulse, so "OK" pairs report no distance (every kernel implementation only reports distance for *fault* results) — is disproven for the BCM: its ECD reports per-pair length for healthy pairs on a plugged, terminated, linked cable, meter-accurate ([fs/](fs/README.md)). **The BCM ECD is the product length path.**
 - **DSP estimate**: both vendors' PHYs compute linked-cable length continuously from insertion loss during training (Marvell "proactively determines cable length"; the BCM's limited-reach power mode switches "based on cable length" while linked). Works in the product's both-ends-plugged topology — the question is only whether the estimate is exposed in a readable register (Aquantia: yes, `1E.C884`; BCM/Marvell: not in documented space).
-- **NIC timestamp path-delay** — the module-independent fallback: works linked, needs hardware timestamps and a short-cable calibration to cancel fixed PHY latency (~4.8 ns/m one way; 50 m ≈ 240 ns). Viability gated on PHY-latency stability across retrains ([../open-questions.md](../open-questions.md) §2).

docs/modules/fibergaga/README.md

@@ -1,13 +1,13 @@
 # Fibergaga SFP-10G-T-30M (Aquantia AQR)
 
-The documented oracle. RollBall module, PHY ID 0x31c31c13, proven over the i40e oracle path ([../../nics/x710/](../../nics/x710/README.md)). Its PHY family register reference is vendored in this directory (`aquantia-aqr107-aqr109-datasheet.pdf` — the AQR107-AQR109 register reference).
+The documented oracle — and only that: the part's 30 m reach limit makes it unusable in the test set, so its registers matter as reference/instrument, never as product capability. RollBall module, PHY ID 0x31c31c13, proven over the i40e oracle path ([../../nics/x710/](../../nics/x710/README.md)). Its PHY family register reference is vendored in this directory (`aquantia-aqr107-aqr109-datasheet.pdf` — the AQR107-AQR109 register reference).
 
 ## Documented registers
 
 | Registers | What |
 |---|---|
 | 3.E820/3.E821 | PCS Receive Vendor **Uncorrected** Frame Counter (post-FEC) |
-| 3.E840–3.E84E | Corrected Frame N Iteration Counters, N = 1…10 LDPC iterations — the pre-FEC leading indicator ([../../open-questions.md](../../open-questions.md) §5) |
+| 3.E840–3.E84E | Corrected Frame N Iteration Counters, N = 1…10 LDPC iterations — the pre-FEC leading indicator |
 | 3.E816 | RS Corrected Error Frame Counter (system-side, secondary) |
 | 1E.C884 bits 7:0 | **Estimated cable length in meters, ±1 m**, RO, from the cable diagnostic engine |
 | 1E.C800 | Per-pair TDR fault verdicts (open/short/mismatch/cross-pair) |
@@ -15,7 +15,13 @@ The documented oracle. RollBall module, PHY ID 0x31c31c13, proven over the i40e
 | 1E.C880–C883 | Reflection impedance/magnitude |
 | PMA 1.133–1.140, PCS 3.32/3.33 | Standard set ([../README.md](../README.md)), proven live |
 
-## Open bench questions
+## Pre-FEC correlation run (verification, not classification)
 
-- Whether `1E.C884` is continuously valid on a linked cable or only after an explicit diag run.
-- The pre-FEC correlation experiment ([../../open-questions.md](../../open-questions.md) §5) — this module is its instrument.
+`3.E820` is post-FEC; the pre-FEC counters are the corrected-by-iteration histogram (3.E840–E84E). The correlation run verifies the expected ordering; this module is its instrument. Design points:
+
+- Dose axis = *measured* SNR margin (1.133–6), not the noise-knob position — plot counter rates against margin; don't assume the knob is monotonic.
+- Run at high line utilization: an uncorrected LDPC frame landing in idle/IFG leaves no host-visible trace; low-load runs undercount the host side.
+- Expected ordering as margin falls: corrected-iteration counters shift toward higher N first (host still perfect — the leading-indicator regime), then E820 + PCS 3.32/33 errored blocks + host CRC/loss together. One uncorrected LDPC frame is 2048 line bits (~320 ns) and can clip multiple packets — expect burstiness, not 1:1.
+- Log fast retrains alongside (IEEE 1.147) to separate FEC exhaustion from retrain hiccups.
+- Clear-on-read discipline: exactly one reader during a run.
+- Scope: documents the Aquantia oracle — fine; proving the pipeline is the oracle's job. The CUX3610 is Alaska-M with its own map and stays out until documented.

docs/modules/fs/README.md

@@ -72,6 +72,6 @@ Observed on a plugged, linked, healthy cable: verdicts OK×4 and per-pair length
 Chapters the datasheet TOC lists but the excerpts here omit — to source elsewhere:
 
 1. The **ECD chapter** — now for confirming bit meanings rather than unblocking.
-2. The **1588 operation chapter** (in-PHY timestamping would measure path delay at the MDI, removing PHY-pipeline latency from the length equation; [../../open-questions.md](../../open-questions.md) §2).
+2. The **1588 operation chapter**.
 3. Datasheet **§1.20 loopback** (copper line loopback) and **§1.17 EEE/fast-retrain monitoring**.
 4. **Chapter 2 register summary.** The excerpt's TOC names them all.

docs/modules/wiitek/README.md

@@ -33,7 +33,7 @@ Not available in safe space: pre-FEC counter, cable length — those live in the
 
 ## VCT/cable length: no confirmed-safe path
 
-The problem is real (if both loop ends become Wiiteks, this PHY is the only length source), but every known VCT candidate lands in the exact danger zone, and the safe-looking option is a documentation error corrected here:
+This PHY offers no length capability the product needs (the length strategy lives in [../README.md](../README.md)); every known VCT candidate lands in the exact danger zone, and the safe-looking option is a documentation error corrected here:
 
 - **The 88Q2220 TDR recipe is NOT safe.** Its registers (MMD 3, 0xFECA/0xFED9/0xFEDA/0xFEDE/0xFEDD) sit at `3.0xFExx` — inside the `3.0x8000+` µC-mapped window this doc identifies as the space that bricked both modules. Low-byte ≠ 0x64 does **not** make them safe; the whole high window is µC-intercept space, and the brick was a µC crash on access, not specifically the 0x64 decode. (The 0x64 pattern is the one *confirmed* kill; it is not the boundary of the danger.) Treat the entire `3.0x8000+` / `31.0xF000+` space as lethal-until-proven, not the `*.??64` addresses alone.
 - **The QCA-style CDT block** (`qcom/qcom.h`: 3.0x8064 status, 3.0x8065–0x8068 per-pair results, 3.0x8074–0x807E thresholds) is the most likely *intended* VCT — the ODM firmware emulates it — but it is centered on `3.0x8064`, the precise register that killed both originals. Hypothesis: the kill was a *cold* status read before running the test, and the real protocol is write-start → wait → read-status/results. Plausible, unproven, and not worth a live module.
@@ -41,8 +41,7 @@ The problem is real (if both loop ends become Wiiteks, this PHY is the only leng
 
 Routes that do not risk the module:
 
-1. **NIC timestamp path-delay** for length — module-independent, works whatever modules are at the ends ([../../open-questions.md](../../open-questions.md) §2). This directly answers the same-module-both-ends case; prioritize the X710 retrain-stability experiment.
-2. **The real VCT register map** from Marvell/Wiitek under NDA — the only route to a *confirmed*-safe sequence.
-3. **Deliberate sacrifice** of a spare to test the QCA-CDT-start hypothesis, `rb_forensic.py` running — only if the capability is judged worth a module.
+1. **The real VCT register map** from Marvell/Wiitek under NDA — the only route to a *confirmed*-safe sequence.
+2. **Deliberate sacrifice** of a spare to test the QCA-CDT-start hypothesis, `rb_forensic.py` running — only if the capability is judged worth a module.
 
 The Marvell 88E151x datasheet PDF in this directory is family reference material.