Add BCM4500 register map and fill documentation gaps

New page: bcm4500/register-map.mdx consolidates all register
addresses (direct, indirect page 0, FX2 XRAM/IRAM, I2C controller)
into a single lookup reference with cross-reference index.

Expanded sections:
- fw213-variants: hardware detection mechanism, distinguishing
  characteristics table, FW1 demod type detection signatures
- demodulator: probe logic (3x3 retry, INT0 40-iteration boot probe
  at 0x7F/0x3F, no_demod_flag graceful degradation)
- version-comparison: version ID gap aside (v2.07.04 is a kernel
  constant, not a real firmware release)

Cross-links added to signal-monitoring and tuning-protocol pages.

site/src/content/docs/firmware/fw213-variants.mdx

@@ -21,10 +21,40 @@ The v2.13 firmware was distributed as three sub-variants via the `SW1_update_2_1
 | Demod interface | **I2C bus** | **Parallel bus (P0/P1)** | **Parallel bus (enhanced)** |
 | Config source | Hardcoded | External (`0xE080`--`0xE08E`) | External (`0xE080`--`0xE08E`) |
 
-<Aside type="note">
-All three sub-variants report the same version ID (`0x020D01`) to the host. The updater program selects the correct sub-variant based on hardware detection (likely a GPIO strap or I2C device ID read at flash time).
+## Hardware Detection
+
+All three sub-variants report the same version ID (`0x020D01`) to the host. The Windows updater `SW1_update_2_13_x.exe` selects which sub-variant to flash, but the detection mechanism is not yet fully understood.
+
+<Aside type="caution" title="Open Investigation">
+The exact hardware detection method remains unknown. The updater binary has not been fully disassembled. Candidates include a GPIO strap read (cheap, common in consumer electronics), an I2C device ID probe (the demod responds differently on I2C vs. parallel-bus hardware), or a USB descriptor field that encodes the PCB revision. If you have access to the updater binary or multiple hardware revisions, this would be a valuable area to investigate.
 </Aside>
 
+### Distinguishing Characteristics
+
+Although the updater's detection method is opaque, the firmware binaries themselves contain clear markers that distinguish each target hardware:
+
+| Characteristic | FW1 | FW2 | FW3 | Docs |
+|---------------|-----|-----|-----|------|
+| P0 init value | `0xA4` | `0xA4` | `0xA0` (bit 2 cleared) | [Register Map &mdash; IRAM](/bcm4500/register-map/#fx2-iram-by-firmware-version) |
+| Stack pointer | `0x50` | `0x50` | `0x52` (+2 for status reg) | [Register Map &mdash; IRAM](/bcm4500/register-map/#fx2-iram-by-firmware-version) |
+| Config status IRAM | `0x4F` | `0x4F` | `0x51` | [Config Status](/usb/config-status/) |
+| I2C buffer IRAM | `0x48`/`0x49` | `0x48`/`0x49` | `0x4A`/`0x4B` | [Register Map &mdash; IRAM](/bcm4500/register-map/#fx2-iram-by-firmware-version) |
+| Demod interface | I2C bus | Parallel (P0/P1) | Parallel (enhanced, dual-phase) | See tabs below |
+| Config source | Hardcoded | External `0xE080`--`0xE08E` | External `0xE080`--`0xE08E` | [Register Map &mdash; XRAM](/bcm4500/register-map/#fw2fw3-external-configuration) |
+
+### FW1 Demod Type Detection
+
+FW1 is the only sub-variant that performs demodulator type identification at runtime. Function `FUN_CODE_1405` reads the P1 port after an I2C transaction and matches the result against known silicon signatures:
+
+| Type Code | P1 Signature | Likely Silicon |
+|-----------|--------------|----------------|
+| Type 3 | `0xA5` or `0xB5` | Original BCM4500 |
+| Type 4 | `0x5A` | BCM4500 revision A |
+| Type 5 | `0x5B` | BCM4500 revision B |
+| Type 6 | `0x5C` | BCM4500 revision C |
+
+FW2 and FW3 use a different signature check (`P1 ^ 0x1D`) through the parallel bus, suggesting the demod variant is already known at flash time on those PCBs.
+
 ## Hardware Interface Evolution
 
 <Tabs>

site/src/content/docs/firmware/version-comparison.mdx

@@ -173,6 +173,16 @@ GP8PSK_FW_REV2 = 0x020704    // v2.07.4
 
 If the firmware version reported by `GET_FW_VERS` (command `0x92`) is >= `GP8PSK_FW_REV2`, the kernel enables Rev.2-specific code paths. All v2.10 and v2.13 firmwares are newer than either constant.
 
+<Aside type="caution" title="Version ID Gaps">
+`GP8PSK_FW_REV2` (`0x020704` = v2.07.04) is a **kernel threshold constant**, not an actual firmware release. No firmware with version 2.07.x was ever distributed. The real version progression is:
+
+**v2.06.04** &rarr; **v2.10.04** &rarr; **v2.13.01**
+
+Versions v2.07 through v2.09 and v2.11 through v2.12 do not exist. The kernel developers chose `0x020704` as a convenient threshold above the known v2.06.04 release.
+
+All three v2.13 sub-variants (FW1, FW2, FW3) report the same version ID `0x020D01` despite targeting different hardware. See [FW2.13 Variants](/firmware/fw213-variants/) for how they differ.
+</Aside>
+
 ## Binary Similarity Matrix
 
 Byte-level comparison across the shared code length (percentage of identical bytes):