…r2 variants) + kernel-parity ports (#219)

## What

PR #216 shipped Jaguar2 5/10 MHz narrowband but **gated the 8822B** — it
synced ~0.5% of NB frames on RX and aired nothing on TX, while the
OpenHD kernel module did full-rate NB on the same dongle with the same
firmware. This PR finds and fixes the root cause, and lands the
vendor-parity gaps discovered along the way.

## Root cause: RF18 re-latch edge

**The RTL8822B RF synthesizer only re-latches its internal channel state
on an RF18 (`RF 0x18`) *value edge*** — a same-value rewrite is a no-op.
Devourer applies narrowband as an end-of-bring-up re-clock and rewrote
RF18 with the *identical* value, leaving the RF latched to its
pre-re-clock internals: RX deaf, TX invalid, band-independent. The
kernel driver never exposes this because its flow always tunes *through*
a channel/band change (an RF18 edge) around any bandwidth switch.

This also retroactively explains the earlier "firmware-autonomous RF
`0x82`/`0xf2` retune" observation — those are RF-internal LUT outputs
refreshed by the RF18 edge, not FW action.

**Fix** (`set_channel_bw`, 8822B NB branch): write RF18 once with a
substitute channel byte, then the real value, on both RF paths.

## How it was found — golden-init replay

Every readable-state hypothesis had already been eliminated by A/B
against the vendored kernel module (a 116-register MAC+BB flip and
removal of the module's only H2C traffic both left kernel NB working).
The latch is invisible to state diffing because it keys on the *write
event*, not the value. So:

1. usbmon-capture the working kernel's complete post-DLFW register write
stream (3630 writes incl. the 10 MHz switch).
2. Replay it verbatim from devourer via a new `DEVOURER_REPLAY_WSEQ`
debug knob (applied at end of `Init`, overriding devourer's own config)
→ NB unlocks (39100 hits vs ~10) → causal state is host-writable.
3. Delta-debug the stream (~25 automated probes) down to the causal RF18
write pair. Edge pair alone: 23300 hits; same-value rewrite alone: 9.

`DEVOURER_REPLAY_WSEQ` is kept as a permanent lever — it converts any
"same registers, different behavior" mystery into a mechanical
bisection.

## Hardware validation (T3U 8822BU ↔ Jaguar3 8812CU, true frame counts)

- ch44 10 MHz RX 7700 / TX 12600; ch44 5 MHz RX 6500; 2.4 GHz ch6 10 MHz
RX 7700
- scripted `tests/narrowband_cross_rx.sh`: **20M=3900 / 10M=4000 /
5M=3900** — full control parity, both widths
- 20/40/80 smokes + `ctest` pass; the RF18 edge is narrowband-gated
(wide paths byte-unchanged)

Caps ungated: `narrowband_ok=true` on both Jaguar2 variants, `bw_mask`
keeps 5/10.

## Also in this branch (kernel-parity ports found by the same
comparison)

These were prerequisites/gap-closures uncovered while diffing devourer's
init against the kernel's write stream. Each is independently
vendor-parity and measured; together they roughly **doubled 8822B 20 MHz
RX** (~4700 → ~8100 hits/cell) before the NB fix:

- **halrf kfree** — efuse power/PA-bias trim: the PA-bias RF LUT write
(RF `0x51/0x52` → `0x3f` via the `0xef[10]` window) + per-channel-group
TX gain trim (`RF 0xde/0x65/0x55`). Gotcha ported with it: close the RF
LUT window before the `0x51/0x52` reads (the table apply leaves it open,
aliasing the reads).
- **eFEM CCA table fix** — RFE types 3/5/12/15/16/17/19 (external-FEM
boards incl. the bench T3U) need `cca_ifem_ccut_rfe`; devourer hardcoded
the plain iFEM column for every board. Plus the 20 MHz DFS-channel CCA
adjust.
- **phydm spur calibration** — reset the NBI/CSI notch state on every
channel set, and PSD-detect + notch the chip's own clock spur on the
fixed spur channels (validated engaging at ch6/2440 MHz).
- **halmac cfg_mac_clk** — the MAC µs-tick dividers (`0x55c/0x638`);
chip reset defaults are wrong for the running clock.
- **SoML enable + RxHP band block**, and the **FW
GENERAL_INFO/PHYDM_INFO H2C** (`send_fw_general_info`) — the kernel's
post-DLFW FW identity handshake.

## Test notes

- `DEVOURER_REPLAY_WSEQ=<file>` — golden-init replay (lines: `<addr_hex>
<width 1|2|4> <val_hex>`).
- `tests/narrowband_cross_rx.sh` / `tests/jaguar2_narrowband_sdr.sh` now
cover both Jaguar2 variants.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>