Bring-up: W5100 bus self-test, eFuse OVLO bug, Pi SPI EXI host

From the physical V2 bring-up session (2026-09-20):

- exi_bba/w5100_selftest.py (NEW): standalone FPGA<->W5100 bus diagnostic.
  Clock-independent data-bus walk (direct-mode GAR0 read-back, all 8 lines) +
  MR software-reset self-clear (needs the 25 MHz crystal). Reports 4 verdicts on
  D6/D7 LEDs AND over UART (115200): GOOD / data-line-N / clock-dead / no-response.
  Boot wait is 85 ms (> the W5100S 60.3 ms init). On this board: GOOD -- bus +
  all 8 data lines + 25 MHz clock all verified (unlike V1's broken D3).

- REVIEW.md / TODO.md: eFuse U13 OVLO is tied to GND, which on the TPS25961
  selects the internal FIXED ~6 V overvoltage cutoff -- so it blocks the 12 V
  rail entirely (bench-confirmed: 12V_EXI=0, GC_ON=0, W5100 unpowered). FAB-
  BLOCKER for V2.1: fix with an OVLO divider (~1.1M/100k -> trip ~15 V). Bench
  workaround: lift U13 pin 2 (OVLO) off GND. Also closed the eFuse-placement,
  GND-via/3V3-zone, and CC-ESD TODO items.

- hardware/re-bba-rb/exi_devid_spi.py (NEW): Pi hardware-SPI (~25 MHz) EXI
  device-ID host, companion to the bit-bang exi_devid_rpi.py.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hardware/re-bba-rb/TODO.md

@@ -241,6 +241,14 @@ schematic changes.
       at (148.49, 61.7225) near U11 pin 48. Verified 2026-07-22: nets
       `/ethernet/ETH_RST` + `/ethernet/ETH_3V3` both present on the footprint,
       0 unconnected items.
+- [ ] 🔴 **eFuse U13 OVLO MISCONFIGURED — BLOCKS 12 V (found at bring-up
+      2026-09-16, FAB-BLOCKER for V2.1).** OVLO (pin 2) is tied to GND, which on
+      the TPS25961 selects the internal *fixed* overvoltage cutoff ~5.98 V — so a
+      12 V rail is permanently in overvoltage lockout and the eFuse passes
+      nothing (bench-confirmed: 12V_EXI=0, GC_ON=0, W5100 unpowered). **Fix:**
+      OVLO divider off 12V_RAW, R_top ≈ 1.1 M / R_bottom ≈ 100 k → trip ~15 V.
+      See REVIEW.md eFuse entry. Bench workaround: feed 12 V onto 12V_EXI (C65+ /
+      U3 VIN) to bypass it. This must be fixed before any V2.1 fab order.
 - [ ] **12 V inrush limiter (U13 TPS25961 eFuse) — SCHEMATIC DONE 2026-07-31**,
       full design rationale in REVIEW.md §6. J3.5 → 12V_RAW → U13 → 12V_EXI;
       D3 (TVS) stays upstream, C65 downstream. R45 100 k sets I_LIM ≈ 500 mA
@@ -273,16 +281,14 @@ schematic changes.
       board PCF.
 - [ ] **Gateware: EXI INT drive style** — prefer open-drain emulation (drive
       low / release) on J3.3 rather than push-pull high.
-- [ ] **New 2026-07-22: 2 GND vias short the `/Power/3V3` zone on In2.Cu** —
-      found during the last DRC pass, 4 error-severity violations (2×
-      `clearance` + 2× `hole_clearance`, both 0 mm actual). Two GND vias at
-      (190.78, 58.58) and (190.34, 58.58) — just south of J3's courtyard,
-      likely stitching vias added during the J3 reroute — sit directly on
-      top of the 3V3 pour on In2.Cu. This is a real short risk, not a
-      manufacturability nit: move or delete these two vias (or void the 3V3
-      zone locally) before ordering. Also 1 harmless `track_dangling`: a
-      0.06 mm stub on `/exi/EXI_MOSI_RAW` near (188.39, 57.52) — routing
-      debris, delete when convenient.
+- [x] **2 GND vias vs `/Power/3V3` zone on In2.Cu — RESOLVED 2026-08-28.**
+      Was 4 error-severity DRC violations (2× `clearance` + 2× `hole_clearance`,
+      0 mm) from GND stitching vias sitting on the 3V3 pour. Cleared by refilling
+      the zones (the pour now voids around the vias); `kicad-cli pcb drc
+      --severity-error` = 0 on the filled board. The `flash`/production skill
+      (kicad-manufacturing-export) now refills zones before export, so this
+      can't silently regress. (Any leftover `track_dangling` stub is
+      warning-level debris, delete when convenient.)
 
 ## Broader items (beyond the wiring review — block fab on the first two)
 
@@ -374,8 +380,9 @@ schematic changes.
       exactly what stock iceprog opens by default, which now matches the
       rewired pins. Optionally program serial/product string later with
       FT_PROG (do NOT change VID/PID, or iceprog needs -d vid:pid).
-- [ ] CC1/CC2 have no ESD protection (USBLC6 covers D+/D− only) — optional,
-      most hobby designs skip; note spare-channel budget if respinning D2 area.
+- [x] CC1/CC2 ESD protection — **WON'T FIX** (Dennis, 2026-08-28). USBLC6
+      covers D+/D− only; CC lines left unprotected by choice, as most hobby
+      designs do. Closed, not a pending item.
 - [x] `.history/` (embedded `.git`) — VERIFIED ignored via root
       `.gitignore:28`, nothing tracked.