fix(pre-bringup): resolve P0 + quick-win P1 findings from 2026-04-19 audit

Addresses findings from docs/DEVELOP_AUDIT_2026-04-19.md:

P0 source-level:
- F-4.3 ADAR1000_Manager::adarSetTxPhase now writes REG_LOAD_WORKING
  with LD_WRK_REGS_LDTX_OVERRIDE (0x02) instead of 0x01. Previous value
  toggled the LDRX latch on a TX-phase write, so host TX phase updates
  never reached the working registers.
- F-6.1 DDC mixer_saturation / filter_overflow / diagnostics were deleted
  at the receiver boundary. Now plumbed to new outputs on
  radar_receiver_final (ddc_overflow_any, ddc_saturation_count) and
  aggregated into gpio_dig5 in radar_system_top. Added mark_debug
  attributes for ILA visibility. Test/debug inputs tied low explicitly.
- F-0.8 adc_clk_mmcm.xdc set_clock_uncertainty: removed invalid -add
  flag (Vivado silently rejected it, applying zero guardband). Now uses
  absolute 0.150 ns which covers 53 ps jitter + ~100 ps PVT margin.

P1:
- F-4.2 adarSetBit / adarResetBit reject broadcast=ON — the RMW sampled
  a single device but wrote to all four, clobbering the other three's
  state.
- F-4.4 initializeSingleDevice returns false and leaves initialized=false
  when scratchpad verification fails; previously marked the device
  initialized anyway so downstream PA enable could drive a dead bus.
- F-6.2 FIR I/Q filter_overflow ports, previously unconnected, now OR'd
  into the module-level filter_overflow output.
- F-6.3 mti_canceller exposes 8-bit saturation counter. Saturation was
  previously invisible and produces spurious Doppler harmonics.

Verification:
- 27/27 iverilog testbenches pass
- 228/228 pytest pass (cross-layer contract + cosim)
- MCU unit tests 51/51 + 24/24 pass
- Remote Vivado 2025.2 build: bitstream writes; 400 MHz mixer pipeline
  now shows WNS -0.109 ns which MATCHES the audit's F-0.9 prediction
  that the design only closed because F-0.8's guardband was silently
  dropped. ft_clkout F-0.9 remains a show-stopper (requires MRCC pin
  move), tracked separately.

Not addressed in this PR (larger scope, follow-up tickets):
F-0.4, F-0.5, F-0.6, F-0.7, F-0.9, F-1.1, F-1.2, F-2.2, F-3.2, F-4.1,
F-4.7, F-6.4, F-6.5.

9_Firmware/9_2_FPGA/radar_receiver_final.v

@@ -74,7 +74,16 @@ module radar_receiver_final (
     // AGC status outputs (for status readback / STM32 outer loop)
     output wire [7:0]  agc_saturation_count, // Per-frame clipped sample count
     output wire [7:0]  agc_peak_magnitude,   // Per-frame peak (upper 8 bits)
-    output wire [3:0]  agc_current_gain      // Effective gain_shift encoding
+    output wire [3:0]  agc_current_gain,     // Effective gain_shift encoding
+
+    // DDC overflow diagnostics (audit F-6.1 — previously deleted at boundary).
+    // Not yet plumbed into the USB status packet (protocol contract is frozen);
+    // exposed here for gpio aggregation and ILA mark_debug visibility.
+    output wire        ddc_overflow_any,
+    output wire [2:0]  ddc_saturation_count,
+
+    // MTI 2-pulse canceller saturation count (audit F-6.3).
+    output wire [7:0]  mti_saturation_count_out
 );
 
 // ========== INTERNAL SIGNALS ==========
@@ -211,6 +220,16 @@ wire signed [17:0] ddc_out_q;
 wire ddc_valid_i;
 wire ddc_valid_q;
 
+// DDC diagnostic signals (audit F-6.1 — all outputs previously unconnected)
+wire [1:0] ddc_status_w;
+wire [7:0] ddc_diagnostics_w;
+wire       ddc_mixer_saturation;
+wire       ddc_filter_overflow;
+
+(* mark_debug = "true" *) wire ddc_mixer_saturation_dbg = ddc_mixer_saturation;
+(* mark_debug = "true" *) wire ddc_filter_overflow_dbg  = ddc_filter_overflow;
+(* mark_debug = "true" *) wire [7:0] ddc_diagnostics_dbg = ddc_diagnostics_w;
+
 ddc_400m_enhanced ddc(
     .clk_400m(clk_400m),           // 400MHz clock from ADC DCO
     .clk_100m(clk),           // 100MHz system clock //used by the 2 FIR
@@ -219,12 +238,28 @@ ddc_400m_enhanced ddc(
     .adc_data_valid_i(adc_valid),     // Valid at 400MHz
     .adc_data_valid_q(adc_valid),     // Valid at 400MHz
     .baseband_i(ddc_out_i), // I output at 100MHz
-    .baseband_q(ddc_out_q), // Q output at 100MHz  
+    .baseband_q(ddc_out_q), // Q output at 100MHz
     .baseband_valid_i(ddc_valid_i),     // Valid at 100MHz
-	 .baseband_valid_q(ddc_valid_q),
- 	 .mixers_enable(1'b1)
+    .baseband_valid_q(ddc_valid_q),
+    .mixers_enable(1'b1),
+    // Diagnostics (audit F-6.1) — previously all unconnected
+    .ddc_status(ddc_status_w),
+    .ddc_diagnostics(ddc_diagnostics_w),
+    .mixer_saturation(ddc_mixer_saturation),
+    .filter_overflow(ddc_filter_overflow),
+    // Test/debug inputs — explicit tie-low (were floating)
+    .test_mode(2'b00),
+    .test_phase_inc(16'h0000),
+    .force_saturation(1'b0),
+    .reset_monitors(1'b0),
+    .debug_sample_count(),
+    .debug_internal_i(),
+    .debug_internal_q()
 );
 
+assign ddc_overflow_any     = ddc_mixer_saturation | ddc_filter_overflow;
+assign ddc_saturation_count = ddc_diagnostics_w[7:5];
+
 ddc_input_interface ddc_if (
     .clk(clk),
     .reset_n(reset_n),
@@ -391,7 +426,8 @@ mti_canceller #(
     .range_valid_out(mti_range_valid),
     .range_bin_out(mti_range_bin),
     .mti_enable(host_mti_enable),
-    .mti_first_chirp(mti_first_chirp)
+    .mti_first_chirp(mti_first_chirp),
+    .mti_saturation_count(mti_saturation_count_out)
 );
 
 // ========== FRAME SYNC FROM TRANSMITTER ==========
@@ -430,12 +466,12 @@ assign range_data_32bit = {mti_range_q, mti_range_i};
 assign range_data_valid = mti_range_valid;
 
 // ========== DOPPLER PROCESSOR ==========
-doppler_processor_optimized #(
-    .DOPPLER_FFT_SIZE(16),
-    .RANGE_BINS(64),
-    .CHIRPS_PER_FRAME(32),
-    .CHIRPS_PER_SUBFRAME(16)
-) doppler_proc (
+doppler_processor_optimized #(
+    .DOPPLER_FFT_SIZE(16),
+    .RANGE_BINS(64),
+    .CHIRPS_PER_FRAME(32),
+    .CHIRPS_PER_SUBFRAME(16)
+) doppler_proc (
     .clk(clk),
     .reset_n(reset_n),
     .range_data(range_data_32bit),
@@ -498,4 +534,4 @@ assign agc_saturation_count = gc_saturation_count;
 assign agc_peak_magnitude   = gc_peak_magnitude;
 assign agc_current_gain     = gc_current_gain;
 
-endmodule
+endmodule