diff --git a/CLAUDE.md b/CLAUDE.md
index 3748adb..59407b6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -277,6 +277,34 @@ Pi over J4 with the board on 12 V — device ID `04 02 02 00`, NCRA reset
 self-clearing, PAR0–5, MAR0–7, ANALOG, NWAYC, IMR `0x86` readback, NCRA SR,
 and NWAYS `0x17`. See `hardware/re-bba-rb/exi_fullpath_rpi.py`.
 
+✅ **FULL ROUND TRIP ON HARDWARE 2026-09-30.** The board sent 5 ARP requests
+over EXI and received all 5 replies back: `op=2`, unicast to our own MAC
+`00:09:bf:00:00:01`, sender 10.0.0.50 / target 10.0.0.99, read back out of the
+SPRAM ring by EXI DMA with RWP advancing exactly one page per exchange. The PC
+could only reply, and only address it to our MAC, if our request reached it —
+so this closes the loop independently of any packet capture.
+
+Getting there took four W5100 fixes, none of which simulation could catch
+because the bus model reproduces neither the chip's reset timing nor its
+interrupt latching. Each masked the next:
+1. `tx_bytes` overflow — the drain waited for a length that only arrived at the
+   ST trigger, so frames truncated at exactly 16 bytes (see TWD fix below).
+2. Post-reset settle was 1 ms; the W5100S needs 60.3 ms. Marginal, so it
+   *sometimes* worked — which is what made everything look flaky.
+3. `w5100_rst_n` was declared and NEVER DRIVEN. The only reset was the MR
+   software reset, which a wedged chip cannot answer because it arrives over
+   the stuck bus — so a wedge survived NCRA reset, reflashing and even FPGA
+   reconfiguration, and needed a 12 V power cycle.
+4. `RX_RSR_CHK` returned to IDLE on RSR==0 without clearing `Sn_IR`. SEND_OK
+   (bit 4) fires after every transmit and only RECV (bit 2) was ever cleared,
+   so INT_N latched low; since IDLE tests `~w5100_int_n` BEFORE `tx_valid`, the
+   FSM span and TX starved. Symptom: first frame transmits, all later ones
+   never set TI while RX keeps working.
+
+⚠️ Note TI only means `TXFrameDrain` handed the frame to the W5100 — it does
+NOT mean the chip put it on the wire. Do not treat TI as proof of transmission;
+the round trip above is the real test.
+
 ✅ **BOTH DIRECTIONS PROVEN ON HARDWARE 2026-09-30 — the BBA data path works.**
 
 *GC → wire* (after the TWD fix below): a full **60-byte ARP request**, captured