fix: IC-7300 spectrum scope never rendered — wrong frame framing

The rig's 0x27 waveform frames carry the same leading main-scope selector byte
as the dual-scope IC-7610/9700 (`27 00 00 <seq> <total> …`), but the code keyed
the layout off the CI-V address and treated the 7300 as selector-less, reading
the sequence from Data[1] (always 0x00) so every frame hit the `seq == 0`
guard and was dropped — blank scope. The waveform parser now detects the
leading selector byte from the frame itself (address-independent), and the
scope config/set commands (mode, span, edges) include the selector the 7300
requires. The IC-7610/9700 path is byte-for-byte unchanged (main → idx 2, sub
frames skipped). Confirmed against a real IC-7300 CI-V capture.

changelog.json

@@ -3,9 +3,13 @@
     "version": "0.20.11",
     "date": "2026-07-23",
     "en": [
+      "Fixed the spectrum scope never displaying on the IC-7300: its CI-V waveform frames actually carry the same leading main-scope selector byte as the dual-scope IC-7610/9700, but OpsLog assumed the 7300 omitted it — so it read the frame sequence number from the wrong byte (always 0), discarded every frame, and drew nothing. The frame layout is now detected from the data itself, so the 7300 (and other single-scope Icoms) render correctly, in both center and fixed modes. The IC-7610/9700 are unaffected.",
+      "IC-7300 scope: the center/fixed mode and edge-frequency commands now include the selector byte the rig requires, so switching the scope between center-on-VFO and fixed span from OpsLog is accepted instead of being rejected.",
       "Closing OpsLog no longer switches off the scope display on the radio itself: turning the scope off used to send both 'stop CI-V data' and 'display off', so quitting blanked a local IC-7300's own scope screen. It now only stops the CI-V data stream on disable and never touches the radio's display (the display-on command is sent solely when enabling)."
     ],
     "fr": [
+      "Correction du scope spectral qui ne s'affichait jamais sur l'IC-7300 : ses trames de forme d'onde CI-V portent en réalité le même octet sélecteur de scope en tête que les IC-7610/9700 (dual-scope), mais OpsLog supposait que le 7300 ne l'envoyait pas — il lisait donc le numéro de séquence de la trame sur le mauvais octet (toujours 0), jetait toutes les trames et ne dessinait rien. La disposition des trames est maintenant détectée à partir des données elles-mêmes, donc le 7300 (et les autres Icom mono-scope) s'affichent correctement, en mode centre comme en fixe. Les IC-7610/9700 ne sont pas affectés.",
+      "Scope IC-7300 : les commandes de mode centre/fixe et de fréquences de bords incluent maintenant l'octet sélecteur requis par la radio, donc basculer le scope entre centre-sur-VFO et span fixe depuis OpsLog est accepté au lieu d'être rejeté.",
       "Fermer OpsLog n'éteint plus le scope sur la radio elle-même : couper le scope envoyait à la fois « stop données CI-V » et « affichage OFF », donc quitter éteignait l'écran scope d'un IC-7300 local. Désormais seule la diffusion des données CI-V est coupée à la désactivation, l'affichage de la radio n'est jamais touché (la commande d'allumage n'est envoyée qu'à l'activation)."
     ]
   },

internal/cat/icomserial.go

@@ -224,11 +224,14 @@ func (b *IcomSerial) Connect() error {
 			idAddr = f.Data[1]
 		}
 	}
-	// Dual-scope rigs (IC-7610/9700) prefix each waveform frame with a main/sub
-	// selector byte; single-scope rigs (IC-7300…) do not. Decide from the
-	// IDENTIFIED model, NOT the configured address: an IC-7300 run at 0x98 must
-	// still parse single-scope frames (this was the "scope blank on the 7300" bug).
-	b.dualScope = idAddr == 0x98 || idAddr == 0xA2
+	// Whether the rig's scope protocol carries a leading main/sub SELECTOR byte on
+	// every 0x27 frame and command. The IC-7610/9700 (dual scope) do — and the logs
+	// prove the IC-7300 does too (frames arrive as `27 00 00 <seq> <total> …` and a
+	// mode read answers `27 14 00 <mode>`), even though it has a single scope. The
+	// waveform parser auto-detects this per-frame regardless, so a 7300 at a
+	// non-default address still RENDERS; this flag only drives the SET/read commands
+	// (mode, span, edges), which need the 0x00 selector to be accepted on the 7300.
+	b.dualScope = idAddr == 0x98 || idAddr == 0xA2 || idAddr == 0x94
 	// Defer the DSP snapshot until the rig actually answers CI-V. Over the network
 	// the rig may still be booting (or off) at Connect, so an immediate readDSP
 	// would time out and leave every control at 0 / off with no retry. ReadState
@@ -603,12 +606,20 @@ func (b *IcomSerial) scopeLoop(spec chan civ.Decoded, done chan struct{}) {
 				rawN++
 				applog.Printf("icom scope raw #%d: len=%d data=[% X]", rawN, len(f.Data), f.Data)
 			}
+			// Frame layout after the 0x00 sub-command byte is one of:
+			//   [selector][seq][total][data…]  (IC-7610/9700 AND, as the logs prove,
+			//                                    the IC-7300 — selector 0x00 = main)
+			//   [seq][total][data…]             (a rig with no selector byte)
+			// The sequence starts at 1, so a 0x00 at Data[1] can only be the main-scope
+			// selector — never a valid sequence. Keying this off the rig ADDRESS was the
+			// long-standing "blank scope on the IC-7300" bug: the 7300 DOES send the
+			// selector, so idx stayed 1, seq was read as 0x00, and every frame was
+			// dropped. Detect it from the byte itself instead — address-independent.
 			idx := 1
-			if b.dualScope {
-				if len(f.Data) < 2 || f.Data[1] != 0x00 {
-					continue // only the MAIN scope
-				}
-				idx = 2
+			if len(f.Data) >= 2 && f.Data[1] == 0x00 {
+				idx = 2 // leading main-scope selector byte present
+			} else if b.dualScope {
+				continue // dual-scope rig SUB frame (selector != 0x00) — main only
 			}
 			if len(f.Data) < idx+2 {
 				continue