Drop goals and open-questions docs, cut PTP from the appliance kernel

docs/modules/wiitek/README.md

@@ -13,7 +13,7 @@ Both original Wiiteks were bricked **permanently** by register exploration — t
   - Single targeted reads only, on registers with a documented, verified-safe reason.
 - Recovery needs a vendor firmware image + the boot-download protocol (1.0xC050 boot status, 1.0xD0F0–D0F3 download) — we have no CUX3610 image, so bricks are effectively dead. A ghost I2C device at 7-bit 0x57 (returns zeros) is the ROM bootloader waiting for a download.
 
-The `rollball_ixgbe.py` client hard-guards the blacklist and raises *before* touching hardware — it structurally cannot repeat the kill.
+cabletest cannot repeat the kill because it issues only the safe set below — no sweep, no vendor window, nothing outside a documented register. Any client that goes further needs the blacklist enforced before the transaction reaches the wire, not after: the mailbox writes the address bytes and the µC dies executing the access, so there is no failure to catch afterwards.
 
 ## Safe register set — proven live
 
@@ -57,7 +57,7 @@ This PHY offers no length capability the product needs (the length strategy live
 Routes that do not risk the module:
 
 1. **The real VCT register map** from Marvell/Wiitek under NDA — the only route to a *confirmed*-safe sequence.
-2. **Deliberate sacrifice** of a spare to test the QCA-CDT-start hypothesis, `rb_forensic.py` running — only if the capability is judged worth a module.
+2. **Deliberate sacrifice** of a spare to test the QCA-CDT-start hypothesis — only if the capability is judged worth a module.
 
 The Marvell 88E151x datasheet PDF in this directory is family reference material.