Startup time: 8812AU rows + true-VBUS-cold harness (REGRESS_VBUS_MAP)

[josephnef]

Closes #205.

Investigation verdict (issue #205's three candidates)

Ran a per-rep true-cold discriminator on two identical 8812AU units (the suspect + a fresh one), both on uhubctl-switchable hub ports, with a verified-radiating 8814AU beacon flood as the hearing reference and the in-tree rtw88_8812au temp-blacklisted so nothing touches the chip before the driver under test:

arm (all uncontaminated true cold)	result
new unit, first init	8/8 hears (~10k flood hits/25 s; power_on 3–6 ms; hal_init ~950 ms)
old unit, first init	0/9 hears — init green, radio deaf
old unit, warm re-init ×5 / 60 s idle / 300 s idle	still deaf

• (a) the unit — confirmed. Every old-unit init reads stochastic garbage EFUSE (EEPROM ID = 0x7114/0xeeee/0x0031/0x1000/0x1029/0x8100… vs true 0x8129, different every read) → rfe_type=0, PA/LNA zeroed → wrong PHY tables → deaf with a green init. Independently, the 8051 never boots firmware (polling_fwdl_chksum report never asserts) — the same pathology behind the in-tree rtw88 driver's perpetual probe failure on this unit (0/10+ ever, vs the new unit's first-try pass; that probe result is a 5-second smoke test for this failure mode). A warm re-read recovers the ID but the map tail stays erased-looking (ThermalMeter 0xFF, RFE 0) — so an EFUSE-read-retry in the library would not save such a unit; not added.
• (b) the port — refuted. The signature followed the unit from the xhci root port to a powered hub on a different controller; a neighbour DUT on the same hub is fine.
• (c) shared driver cold-init gap — refuted. Healthy unit from pristine cold: single-digit-ms power_on, ~950 ms hal_init, hears instantly. The issue's "suspicious 20 ms power_on" was normal behaviour. The InitLLTTable8812A aborts did not reproduce in 11 inits (clean or contaminated) — the dying unit's failure locus is stochastic and that was its worst (boot-cold) phase.

Methodology confound found along the way: every historical "first init from true cold" data point was contaminated — modern kernels ship in-tree rtw88 USB drivers for all supported chips, udev auto-loads them by modalias at every enumeration (a bare modprobe -r doesn't survive re-enumeration), and their probe firmware-downloads into the chip before devourer or the vendor .ko ever opens it. On the dying unit that probe also fails, leaving the chip half-wedged mid-fwdl. Neither driver had ever seen pristine cold on this rig.

What this PR adds

• docs/startup-time.md — the missing RTL8812AU rows, measured on the healthy unit:
  • true cold: devourer 1.7 s vs 88XXau 2.1 s (median of 4 reps/cell, 100% pass, per-cell real VBUS cold)
  • warm: 1.7 s / 2.0 s (kernel cold 2.1 s)
  • a third harness-honesty trap (in-tree rtw88 auto-probe → temp-blacklist requirement), and an authorized-toggle caveat: 1 of 8 toggled-warm inits came up RX-deaf with a fully green init (0 of 8 VBUS-cold) — suspect the toggle before the driver or the unit.
• tests/regress.py — REGRESS_VBUS_MAP="<sysfs_id>=<hubloc>:<port>" teaches usb_port_power_cycle (shared by bench_init.py/regress.py) to cut real VBUS via uhubctl for mapped DUTs, giving genuine first-plug cold per cell. Root ports must never be mapped (a root-port uhubctl cycle wedged a device on this rig beyond anything but a machine power-off).
• tests/cold_first_init_8812au.sh — the discriminator harness: per-rep VBUS cold, six arms (unit × rtw88-present/absent × retry/idle), flood verified radiating before and after every arm, mid-off port-power evidence captured.
• tests/bench_8812au_row.sh — the row measurement wrapper (handles two same-PID/same-serial units by powering the spare's port off, temp-blacklists rtw88_8812au, runs bench_init.py with the VBUS map; WARM=1 for the toggle-warm table).

🤖 Generated with Claude Code