OpenIPC · josephnef · Jul 20, 2026 · Jul 20, 2026
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -322,7 +322,7 @@ per hop depending on chip. On the Jaguar2 dies (8822B, 8821C) and Jaguar3
 instead (H2C 0x1D, fire-and-confirm-later): ~1.4 ms dead air on the 8822B (a
 tie on-air on the 8822C/8822E, but ~3× cheaper host-side), and `=2` extends it
 to **cross-band** hops (~2–2.6 ms vs the ~90 ms full path) — protocol + bench:
-`docs/kernel-channel-switch-offload.md`. `send_packet` honours a radiotap `CHANNEL` field, so
+`docs/experiments/kernel-channel-switch-offload.md`. `send_packet` honours a radiotap `CHANNEL` field, so
 hopping is per-packet and radiotap-driven like rate. Demos hop via
 `DEVOURER_HOP_CHANNELS` (SweepSpec grammar: `1,6,11`, `36-48/4`, `5170-5250/5`
 MHz) + `DEVOURER_HOP_DWELL_FRAMES` / `_ROUNDS` / `_FAST` / `_RADIOTAP` /

diff --git a/README.md b/README.md
@@ -228,11 +228,11 @@ one `IRtlDevice` interface covers all four generations.
 - [Frequency hopping](docs/frequency-hopping.md) — how per-packet hopping
   works and what it costs on each chip, including the 8822B/C/E firmware
   channel-switch fast path (`DEVOURER_FASTRETUNE_FW`).
-- [Kernel channel-switch baseline](docs/kernel-channel-switch-baseline.md) +
-  [firmware offload](docs/kernel-channel-switch-offload.md) +
-  [MCC/FCS](docs/mcc-fcs-investigation.md) +
-  [dwell-1 A/B injection](docs/dwell1-ab-injection.md) +
-  [N-channel hopping](docs/n-channel-hopping.md) — how the standard
+- [Kernel channel-switch baseline](docs/experiments/kernel-channel-switch-baseline.md) +
+  [firmware offload](docs/experiments/kernel-channel-switch-offload.md) +
+  [MCC/FCS](docs/experiments/mcc-fcs-investigation.md) +
+  [dwell-1 A/B injection](docs/experiments/dwell1-ab-injection.md) +
+  [N-channel hopping](docs/experiments/n-channel-hopping.md) — how the standard
   Linux/Realtek drivers retune measured against devourer, where the chip
   firmware's own H2C 0x1D switch beats them, and a two-context per-slot data
   plane with zero wrong-channel over 100 k slots.

diff --git a/docs/dwell1-ab-injection.md → docs/experiments/dwell1-ab-injection.md b/docs/dwell1-ab-injection.md → docs/experiments/dwell1-ab-injection.md
diff --git a/docs/kernel-channel-switch-baseline.md → ...riments/kernel-channel-switch-baseline.md b/docs/kernel-channel-switch-baseline.md → ...riments/kernel-channel-switch-baseline.md
@@ -7,7 +7,7 @@ against. Companion harness: `tests/kchansw_bench.py` (orchestrator),
 `tests/kchansw_trace.py` (ftrace session), `tests/kchansw_inject.py`
 (tagged-frame injector), `tests/kchansw_analyze.py` (offline analysis +
 gate verdicts). Devourer's own numbers for the same operation:
-[fhss.md](fhss.md) — FastRetune 0.55–2.5 ms per generation.
+[fhss.md](../fhss.md) — FastRetune 0.55–2.5 ms per generation.
 
 ## Method
 

diff --git a/docs/kernel-channel-switch-offload.md → ...eriments/kernel-channel-switch-offload.md b/docs/kernel-channel-switch-offload.md → ...eriments/kernel-channel-switch-offload.md
diff --git a/docs/mcc-fcs-investigation.md → docs/experiments/mcc-fcs-investigation.md b/docs/mcc-fcs-investigation.md → docs/experiments/mcc-fcs-investigation.md
diff --git a/docs/n-channel-hopping.md → docs/experiments/n-channel-hopping.md b/docs/n-channel-hopping.md → docs/experiments/n-channel-hopping.md
diff --git a/docs/frequency-hopping.md b/docs/frequency-hopping.md
@@ -357,7 +357,7 @@ the two tie (~2.3 ms — that die's RF settle dominates) but the fw path is
 band boundary** (~2–2.6 ms measured, vs the ~90 ms full-path fallback the sw
 fast path needs) — mixed-band FHSS plans become practical. Protocol, bench
 method and full distributions:
-[kernel-channel-switch-offload.md](kernel-channel-switch-offload.md).
+[kernel-channel-switch-offload.md](experiments/kernel-channel-switch-offload.md).
 
 Two techniques carried the newer generations to the table above, beyond the
 original tricks:

diff --git a/examples/dwelltx/main.cpp b/examples/dwelltx/main.cpp
@@ -5,11 +5,11 @@
 // ONE admitted data-frame opportunity — "dwell-1". The channel switch at each
 // slot boundary is the on-chip firmware switch when DEVOURER_FASTRETUNE_FW is
 // set (Jaguar2 8822B / Jaguar3 8822C/8822E; H2C 0x1D — see
-// docs/kernel-channel-switch-offload.md); otherwise the software FastRetune,
+// docs/experiments/kernel-channel-switch-offload.md); otherwise the software FastRetune,
 // so the two are a controlled A/B.
 //
 // This is the caller-side answer to the rejected MCC/FCS scheduler
-// (docs/mcc-fcs-investigation.md): the library already switches channels in
+// (docs/experiments/mcc-fcs-investigation.md): the library already switches channels in
 // ~1 ms and hops per-packet from a radiotap CHANNEL field. What a real hopping
 // DATA plane needs on top of that is bounded admission — one frame per slot,
 // placed inside a window that guarantees it finishes airing before the slot

diff --git a/src/DeviceConfig.h b/src/DeviceConfig.h
@@ -223,7 +223,7 @@ struct DeviceConfig {
      * intra-band 20/40 MHz hops, 2 = additionally accept cross-band hops
      * (the firmware reprograms the band block; TXAGC baseline stays the
      * bring-up band's — active power knobs re-fold). Bench + protocol:
-     * docs/kernel-channel-switch-offload.md. */
+     * docs/experiments/kernel-channel-switch-offload.md. */
     int fastretune_fw = 0;
     /* env: DEVOURER_DIS_CCA — Jaguar2/3 MAC carrier-sense disable at bring-up
      * (primary CCA 0x520[14] + EDCCA [15]): injected/beacon TX stops deferring to

diff --git a/src/jaguar2/HalJaguar2.cpp b/src/jaguar2/HalJaguar2.cpp
@@ -1342,7 +1342,7 @@ bool HalJaguar2::fast_retune(uint8_t channel, uint8_t bw,
    * carries the same SINGLE_CHANNELSWITCH_V2 offload as the 8822B's
    * (on-air-validated) one. Mode 2 additionally accepts band changes — the
    * firmware reprograms the band block itself (bench-measured ~2 ms
-   * cross-band, docs/kernel-channel-switch-offload.md) — which the software
+   * cross-band, docs/experiments/kernel-channel-switch-offload.md) — which the software
    * path cannot. 20/40 MHz only (the 80 MHz primary-idx pairing stays on the
    * sw path). */
   if (_cfg.tuning.fastretune_fw > 0 &&

diff --git a/src/jaguar2/HalJaguar2.h b/src/jaguar2/HalJaguar2.h
@@ -184,7 +184,7 @@ class HalJaguar2 {
    * (central ch, primary-ch idx, bw, IQK_UPDATE_EN), the switch the vendor
    * driver runs behind its rtw_ch_switch_offload=1 module parameter. The
    * 8822B firmware executes the whole RF/BB retune (~1 ms on-air dark time,
-   * bench: docs/kernel-channel-switch-offload.md) and reports C2H
+   * bench: docs/experiments/kernel-channel-switch-offload.md) and reports C2H
    * CUR_CHANNEL; devourer corroborates by polling the RF18 channel field
    * instead, so TX-only sessions need no C2H drain — and the confirm read
    * doubles as the compose-cache re-prime. Returns false when the readback

diff --git a/src/jaguar3/RadioManagementJaguar3.h b/src/jaguar3/RadioManagementJaguar3.h
@@ -52,7 +52,7 @@ class RadioManagementJaguar3 {
                    ChannelWidth_t bwmode, bool cache_rf);
 
   /* Firmware fast-path enabler (H2C 0x1D SINGLE_CHANNELSWITCH_V2 — protocol
-   * + bench: docs/kernel-channel-switch-offload.md). The sender is injected
+   * + bench: docs/experiments/kernel-channel-switch-offload.md). The sender is injected
    * by the device layer so the H2C rides HalJaguar3's HMEBOX box counter —
    * shared with the coex runtime thread's H2Cs and serialized by the same
    * _reg_mu that serializes FastRetune against the coex tick. Unset =