Add DAB ANTCAP calibration and fix BT1035 boot banner timing

Extend the FM-only ANTCAP antenna-varactor override to DAB, mirroring the
existing mechanism end to end (driver, tuner, service, EEPROM storage,
HTTP API). Live sweep on real hardware found no ANTCAP value beating
auto-tune on the ensembles tested, so DAB stays on auto-tune by default.

Also fix BT1035 boot: the module's real boot banner doesn't appear until
~18-24s after RESET# releases, not the 3.5s previously waited; add a
2-attempt retry and a baud-rate probe fallback for diagnostics.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Software/instructions.md

@@ -4,8 +4,8 @@ Read this together with `AGENTS.md` and everything under
 `.cursor/rules/`. Those define *how* to write code; this file defines
 *what we are building* and the current state on `main`.
 
-**Firmware on `main`:** **0.8.5** — agent tasks T1–T12 complete; device HIL
-pending PCB arrival.
+**Firmware on `main`:** **0.9.0** — agent tasks T1–T12 complete; device HIL
+now largely done on the first real PCB (see below), not pending anymore.
 
 ## What DigiRadio is
 
@@ -53,8 +53,62 @@ Repository: https://github.com/manvalan/DigiRadio
 | T8 NVS encryption | Done (0.8.3) | `initEncryptedStorage`; HIL when PCB ready |
 | T9–T12 Platform | Done (0.8.4) | Dual OTA, EEPROM identity, DSP + firmware OTA |
 
-Next work: **hardware-in-the-loop** (`docs/TODO.md` § P4), not new features
-unless the user requests them.
+## Post-0.8.5 HIL work (first real PCB, not in the table above)
+
+The board arrived and most of Slice 3–8's HIL assumptions turned out to be
+wrong in ways that needed real fixes, not just testing. Summary (full
+detail in `docs/si4684-rf-investigation-report.md`):
+
+- **Si4684 total RF blackout, root-caused and fixed.** `writeCommand()`'s
+  ARG1 byte was mis-offset across FM/DAB tune, seek, DAB service commands,
+  and several ARG1-only status/ack commands — the chip answered every
+  command correctly but never actually tuned. Real FM lock, real DAB
+  ensemble lock (3+ ensembles), real audio confirmed live.
+- **Si4684→ADAU1701 digital audio silence, fixed.** `PIN_CONFIG_ENABLE`
+  had both I2SOUTEN and DACOUTEN set (chip falls back to unused analog
+  out per AN649); `SerialInputRegister` IBP polarity was wrong (ADAU
+  sampling on the wrong BCLK edge).
+- **DAB service list, two rounds of offset bugs fixed.** Response-parsing
+  offsets were wrong in a way that made `GET_DIGITAL_SERVICE_LIST` return
+  empty/garbled; confirmed live with 22 real, correctly-decoded station
+  labels. Also found `DAB_EVENT_INTERRUPT_SOURCE` (property 0xB300) was
+  never configured, so the service-list-ready event could never fire.
+- **BT1035 total boot silence, root cause found and fixed (2026-08-20).**
+  Not a hardware fault: VBAT_IN/SYS_CTRL/VDD_IO/1.8V_OUT and TX/RX wiring
+  were all independently confirmed correct with a multimeter (SYS_CTRL
+  and 1.8V_OUT readings pinned down by probing the nearest decoupling cap
+  instead of the tiny 0.5mm-pitch castellated pad directly, which had
+  given a false "regulator dead" reading earlier). The actual bug: the
+  module's spontaneous boot banner (`+VER=...`, `+DEVSTAT=1`) doesn't
+  appear until ~18-24s after RESET# releases — full BT stack init, not
+  just the internal regulator powering up. The old code only waited 3.5s
+  before cutting power and restarting the whole sequence, so across every
+  prior session the module never once got the chance to finish booting.
+  Fixed by waiting up to 25s (`kBootBannerWaitMs`) for the banner before
+  giving up; boot now succeeds on the first attempt, no retries needed.
+- **FM front-end calibration.** The board's actual matching network
+  differs from the AN851 reference the chip's auto-tune constants assume.
+  Swept ANTCAP (AN851 Appendix A) and found a fixed override that beats
+  auto-tune by 6–11 dB RSSI/SNR across the whole band; persisted to the
+  24AA025E48 EEPROM (`POST /api/tuner/calibrate-antenna`) and applied by
+  default to every FM tune.
+- **New features, not in the original Slice plan:** full FM band scan
+  (`POST /api/tuner/scan/full`), generic ADAU1701 parameter access
+  (`GET`/`PUT /api/dsp/param`, an escape hatch onto any SigmaStudio cell
+  beyond the curated mixer/EQ API), phone PCM streaming
+  (`PUT /api/stream/phone`), BLE Wi-Fi provisioning
+  (`net::ble_provisioning`, ESP-IDF's own `wifi_provisioning` over the
+  ESP32-S3's onboard BLE, additive alongside the SoftAP), web radio
+  streaming stutter fix (batched I2S writes).
+- **Still open**: intermittent multi-second HTTP unresponsiveness under
+  load (candidate cause: a blocking Si4684 SPI wait colliding with
+  `max_open_sockets=3`); DAB signal quality still antenna-limited even
+  after calibration; NVS partition (24 KB) may be undersized given the
+  accumulated write traffic (`saveProfile()` `store_failed` seen
+  intermittently, never root-caused).
+
+Next work: keep chasing the open items above as the user prioritises them,
+not new features unless requested.
 
 - **Blockers first** — state risks before solutions.
 - **One vertical slice at a time** — `main` always builds; host tests green.