fix: IC-7300 spectrum scope never rendered — wrong frame framing

The rig's 0x27 waveform frames carry the same leading main-scope selector byte
as the dual-scope IC-7610/9700 (`27 00 00 <seq> <total> …`), but the code keyed
the layout off the CI-V address and treated the 7300 as selector-less, reading
the sequence from Data[1] (always 0x00) so every frame hit the `seq == 0`
guard and was dropped — blank scope. The waveform parser now detects the
leading selector byte from the frame itself (address-independent), and the
scope config/set commands (mode, span, edges) include the selector the 7300
requires. The IC-7610/9700 path is byte-for-byte unchanged (main → idx 2, sub
frames skipped). Confirmed against a real IC-7300 CI-V capture.

internal/cat/icomserial.go

@@ -224,11 +224,14 @@ func (b *IcomSerial) Connect() error {
 			idAddr = f.Data[1]
 		}
 	}
-	// Dual-scope rigs (IC-7610/9700) prefix each waveform frame with a main/sub
-	// selector byte; single-scope rigs (IC-7300…) do not. Decide from the
-	// IDENTIFIED model, NOT the configured address: an IC-7300 run at 0x98 must
-	// still parse single-scope frames (this was the "scope blank on the 7300" bug).
-	b.dualScope = idAddr == 0x98 || idAddr == 0xA2
+	// Whether the rig's scope protocol carries a leading main/sub SELECTOR byte on
+	// every 0x27 frame and command. The IC-7610/9700 (dual scope) do — and the logs
+	// prove the IC-7300 does too (frames arrive as `27 00 00 <seq> <total> …` and a
+	// mode read answers `27 14 00 <mode>`), even though it has a single scope. The
+	// waveform parser auto-detects this per-frame regardless, so a 7300 at a
+	// non-default address still RENDERS; this flag only drives the SET/read commands
+	// (mode, span, edges), which need the 0x00 selector to be accepted on the 7300.
+	b.dualScope = idAddr == 0x98 || idAddr == 0xA2 || idAddr == 0x94
 	// Defer the DSP snapshot until the rig actually answers CI-V. Over the network
 	// the rig may still be booting (or off) at Connect, so an immediate readDSP
 	// would time out and leave every control at 0 / off with no retry. ReadState
@@ -603,12 +606,20 @@ func (b *IcomSerial) scopeLoop(spec chan civ.Decoded, done chan struct{}) {
 				rawN++
 				applog.Printf("icom scope raw #%d: len=%d data=[% X]", rawN, len(f.Data), f.Data)
 			}
+			// Frame layout after the 0x00 sub-command byte is one of:
+			//   [selector][seq][total][data…]  (IC-7610/9700 AND, as the logs prove,
+			//                                    the IC-7300 — selector 0x00 = main)
+			//   [seq][total][data…]             (a rig with no selector byte)
+			// The sequence starts at 1, so a 0x00 at Data[1] can only be the main-scope
+			// selector — never a valid sequence. Keying this off the rig ADDRESS was the
+			// long-standing "blank scope on the IC-7300" bug: the 7300 DOES send the
+			// selector, so idx stayed 1, seq was read as 0x00, and every frame was
+			// dropped. Detect it from the byte itself instead — address-independent.
 			idx := 1
-			if b.dualScope {
-				if len(f.Data) < 2 || f.Data[1] != 0x00 {
-					continue // only the MAIN scope
-				}
-				idx = 2
+			if len(f.Data) >= 2 && f.Data[1] == 0x00 {
+				idx = 2 // leading main-scope selector byte present
+			} else if b.dualScope {
+				continue // dual-scope rig SUB frame (selector != 0x00) — main only
 			}
 			if len(f.Data) < idx+2 {
 				continue