8822B narrowband: fix RF18 re-latch edge (full 5/10 MHz on both Jaguar2 variants) + kernel-parity ports

CLAUDE.md

@@ -21,19 +21,18 @@ construction from the `SYS_CFG2` chip-id (see **Architecture**):
   RTL8811CU / RTL8821CU (chip 8821C, chip-id `0x09`). A hybrid: HalMAC FW
   download / MAC init / power sequencing like Jaguar3, phydm `check_positive`
   register tables like Jaguar1 (shared `PhyTableLoader`). RX + TX on 2.4/5 GHz
-  at 20/40/80 MHz, plus **5/10 MHz narrowband on the 8821C variant** (a
-  baseband ADC/DAC re-clock packed into BB `0x8ac`; the RF stays in 20 MHz
-  mode; applied as an end-of-bring-up retune, kernel-flow parity). 5 MHz at
-  5 GHz is CFO-limited: subcarrier spacing shrinks 4× and a far-offset
-  TX/RX crystal pair syncs bimodally per bring-up — at 2.4 GHz the same
-  pair is stable (`tests/narrowband_cross_rx.sh` header). The 8822B
-  carries the same NB register recipe but is gated off (`narrowband_ok=false`):
-  its NB RX syncs ~10% and NB TX airs nothing, while the OpenHD kernel module
-  does full-rate NB on the same dongle with the same firmware — the kernel's
-  NB switch retunes the RF RXBB LPF via a runtime FW interaction not yet
-  ported (see the `set_channel_bw` NB branch comment). Per-rate
+  at 20/40/80 MHz plus **5/10 MHz narrowband on both variants** (a baseband
+  ADC/DAC re-clock packed into BB `0x8ac`; the RF stays in 20 MHz mode;
+  applied as an end-of-bring-up retune. The 8822B RF synth only re-latches
+  on an RF18 *value edge*, so the narrowband path writes RF18 twice —
+  same-value rewrites do nothing; see the `set_channel_bw` NB branch).
+  5 MHz at 5 GHz is CFO-limited: subcarrier spacing shrinks 4× and a
+  far-offset TX/RX crystal pair syncs bimodally per bring-up — at 2.4 GHz
+  the same pair is stable (`tests/narrowband_cross_rx.sh` header). Per-rate
   bandwidth-aware efuse TX power clamped to generated `txpwr_lmt` tables
-  (narrowband folds to the 20 MHz column).
+  (narrowband folds to the 20 MHz column). Golden-init replay
+  (`DEVOURER_REPLAY_WSEQ`, a captured kernel write stream applied verbatim
+  at the end of Init) is the debugging lever that found the RF18-edge bug.
 - **Jaguar3** (`src/jaguar3/`): rtl8822c (RTL8812CU/8822CU, chip-id `0x13`) and
   rtl8822e (RTL8812EU/8822EU, chip-id `0x17`). **5/10 MHz narrowband** (its
   re-clock lives in the `0x9b0`/`0x9b4` dividers; Jaguar1 silicon has no

README.md

@@ -29,8 +29,8 @@ long-range digital video links.
   depending on chip — fast enough to hop on every packet
   ([how](docs/frequency-hopping.md)).
 - **Narrowband modes the kernel can't do.** 5 and 10 MHz channels on the
-  Jaguar3 chips and the Jaguar2 8821C — half/quarter the bandwidth, more
-  range from the same power.
+  Jaguar2 and Jaguar3 chips — half/quarter the bandwidth, more range from
+  the same power.
 - **A radio lab in a dongle.** Channel sounding, per-antenna signal quality,
   beamforming report capture (enough to do
   [motion sensing](docs/beamforming-victim-sensing.md)), spectrum sweeps,
@@ -53,7 +53,7 @@ Bandwidth cells are devourer's measured on-air TX throughput (Mbps, HT MCS7,
 | **RTL8811AU**                 | 1T1R              | —             | —             | —                | 1T1R cut of 8812 silicon; rides the 8812 code path. Not benchmarked |
 | **RTL8814AU**                 | 4T4R, 3-SS max    | 65            | †(32)         | †(32)            | `0bda:8813`; tested on COMFAST CF-938AC and CF-960AC — antenna builds differ in realised [RX diversity](docs/measuring-spatial-diversity.md) |
 | **RTL8821AU**                 | 1T1R AC + BT      | 54            | 32            | 28               | TP-Link Archer T2U Plus (`2357:0120`) |
-| **RTL8822BU**                 | 2T2R + BT         | 52            | 50            | 49               | TP-Link Archer T3U (`2357:012d`) |
+| **RTL8822BU**                 | 2T2R + BT         | 52            | 50            | 49               | TP-Link Archer T3U (`2357:012d`). 5/10 MHz capable |
 | **RTL8812BU**                 | 1T1R + BT         | —             | —             | —                | 1T1R cut of 8822B silicon; rides the 8822BU code path. Not benchmarked |
 | **RTL8811CU**                 | 1T1R + BT         | 36            | 29            | 28               | COMFAST CF-811AC (`0bda:c811`). 5/10 MHz capable |
 | **RTL8821CU**                 | 1T1R + BT         | —             | —             | —                | rides the 8811CU (8821C) code path. 5/10 MHz capable |

examples/common/env_config.cpp

@@ -133,6 +133,8 @@ devourer::DeviceConfig devourer_config_from_env() {
   cfg.debug.efuse_dump = env_flag("DEVOURER_EFUSE_DUMP");
   cfg.debug.log_writes = env_flag("DEVOURER_LOG_WRITES");
   cfg.debug.log_txpwr = env_flag("DEVOURER_LOG_TXPWR");
+  if (const char *e = env_str("DEVOURER_REPLAY_WSEQ"))
+    cfg.debug.replay_wseq = e;
   cfg.debug.hop_prof = env_flag("DEVOURER_HOP_PROF");
   cfg.debug.gaintab_dbg = env_flag("DEVOURER_GAINTAB_DBG");
 

src/AdapterCaps.h

@@ -59,10 +59,9 @@ constexpr uint8_t kBw80 = 1u << 4;
 
 /* J1 does 20/40/80; J2 and J3 add the 5/10 MHz narrowband re-clock (J2 packs
  * the ADC/DAC clock word into 0x8ac, J3 into 0x9b0/0x9b4 — same RF-stays-20MHz
- * concept). Within J2 only the 8821C variant has working narrowband — the
- * 8822B device fill clears kBw5|kBw10 (see RtlJaguar2Device::GetAdapterCaps).
- * J1 has no vendor narrowband reference (the rtl8812au trees carry only dead
- * enum values). Pure; unit-tested in tests/adapter_caps_selftest.cpp. */
+ * concept; the J2 8822B additionally needs an RF18 re-latch edge after the
+ * re-clock). J1 has no vendor narrowband reference (the rtl8812au trees carry
+ * only dead enum values). Pure; unit-tested in tests/adapter_caps_selftest.cpp. */
 inline uint8_t bw_mask_for_generation(ChipGeneration g) {
   const uint8_t ac = kBw20 | kBw40 | kBw80;
   return g == ChipGeneration::Jaguar1 ? ac
@@ -114,7 +113,7 @@ struct AdapterCaps {
 
   /* --- feature flags --- */
   bool per_packet_txpower = false; /* Jaguar2 descriptor TXPWR_OFSET LUT only */
-  bool narrowband_ok = false;      /* 5/10 MHz re-clock (Jaguar2 8821C, Jaguar3) */
+  bool narrowband_ok = false;      /* 5/10 MHz re-clock (Jaguar2/Jaguar3) */
   bool fastretune_ok = false;      /* lean FastRetune override exists */
   bool per_chain_rssi = false;     /* frame parser fills per-chain rssi (>=2ch) */
 };

src/DeviceConfig.h

@@ -207,6 +207,13 @@ struct DeviceConfig {
     bool hop_prof = false;
     /* env: DEVOURER_GAINTAB_DBG — 8822E: log the TXGAPK gain-table backup. */
     bool gaintab_dbg = false;
+    /* env: DEVOURER_REPLAY_WSEQ — golden-init replay (Jaguar2): path to a
+     * register write-sequence file (lines: "<addr_hex> <width 1|2|4>
+     * <val_hex>", e.g. extracted from a kernel-driver usbmon capture).
+     * Applied verbatim at the end of Init, OVERRIDING devourer's own
+     * configuration — a debugging lever for hardware-diffing devourer
+     * against the vendor driver's end state. */
+    std::string replay_wseq;
   } debug;
 
   /* ---- USB / process environment -------------------------------------- */