BQ76952: Cannot get balancing to turn on

Tool/software:

Little background: I came from a previous board design utilizing the BQ764002, where although the IC was extremely crude to design for electrically, it was straightforward to communicate with/control.  (All functionality worked.)  Then I came across the BQ76952, which is a couple light-years better on the electrical design side of things--but it's being a royal pain and a half to communicate/control.  
Balance circuitry is based on the low-side reference design provided in SLUAA81A, page 4, figure 2-2.  Even if the FETs don't turn on due to battery voltage or otherwise, I should still see a voltage drop across the corresponding cell resistors (100R per the reference design)--or at the very least, the BQ76952 should trip an alarm/fault flag.

No, I have not used BQStudio, nor do I have an EV2300/2400.  

So far, the BQ76952 is running with basically default configuration, with a custom PCBA directly based on the TI reference design, complete with a tight, clean layout.  Here's what I know at the moment:

• chip powers up fine (1.8v power supply appears)
• default I2C communication works alright
• reading/writing to commands and subcommands is tested functional (reading/writing, as well as entering/exiting CONFIG_MODE)
• high-side FET drive (series config) is tested functional, with 10v across gate-source of the main FETs when enabled
• sleep under no load is tested functional (charge FET turns off, power passing through body diode)
• 4S battery cell voltage readout is tested functional (3.509v, 3.519v, 3.521v, 3.515v).  Note that I am using the exact same battery with the BQ76952 as I did with the BQ764002--and balancing works fine on the latter.
• stack voltage readout is functional (14.0v)
• internal temperature reads 29C (no external temperature sensors connected to TS1 or TS3; TS2 is a control signal with a button on it, so no thermistor there either)
• Some register values:
  • FW_VERSION [0] = 0x9576 [big-endian, so 0x7695]
  • FW_VERSION [2] = 0x3600 [big-endian, so 0x0036]
  • FW_VERSION [4] = 0x2700 [big-endian, so 0x0027]
  • Alarm Raw Status = 0x0683
  • Battery Status = 0x0184
  • Safety Alert A/B/C all = 0x00
  • PF Status A/B/C/D all = 0x00
    
• Configurations I'm setting in CONFIG_MODE after the ALARM_STATUS's INIT_COMPLETE bit is set, and the BATTERY_STATUS's POR bit is set, by entering CONFIG_MODE to write all of these, then exiting CONFIG_MODE:
  • "Balance Config" [reg 0x9335] = 0x0F.
    • Have tried leaving it at the default 0x00, but tried 0x0F in case sleep state was preventing host-initiated balancing.  No change.
    • Also tried setting it to 0x1F just to test that the "disable host-initiated balancing" worked--and when this bit is set, CB_ACTIVE_CELLS always reads 0.  So there is SOME communication/change there.
  • "FET Options" [reg 0x9308] = 0x1D, enabling the predischarge FET
  • "Balance Max Cells" [reg 0x933A] = 8.  It should be fine at 0, but tried this just in case.  No change.
  • "Charge Min Cell V" [reg 0x933B] and "Relax Min Cell V" [reg 0x933F] -> set both to 3000 (mV, so 3.000v) just in case my batteries being below the default 3.9v threshold was an issue.  No change.
  • "Vcell Mode" [reg 0x9304] -> set it to 0x8007 to match the actual cell config, just in case.  No change.

Immediate wiring for the BQ76952:

Note that "VBUSBAT" has a series resistor, series diode, and a 2.2uF capacitor, as per the reference design.  Yes, the REGs are all disabled, as per SLUSE13B, table 16-3.

Expected behavior:

1. Write a bit to CB_ACTIVE_CELLS [sub-cmd 0x0083] ~5x/sec to ensure it doesn't time out
2. The corresponding cell balancing starts

Actual behavior:

1. Write a bit to CB_ACTIVE_CELLS [sub-cmd 0x0083] ~5x/sec to ensure it doesn't time out
2. Nothing happens
3. "Alarm Raw Status" [cmd 0x64] bit "CB" is never set
4. "CBSTATUS1" [sub-cmd 0x0085] is always 0, indicating no balance time

Interestingly, when reading back CB_ACTIVE_CELLS at the same 5x/sec interval, I notice the following:

Something internal to the BQ76952 is CLEARING the register every second on the dot.  According to SLUUBY2B, table 6-9, there are a lot of internal functions that run at a 1-second interval, including "cell balancing"--but this appears to be for automatic cell balancing.  I did notice in https://github.com/LibreSolar/bms-firmware/blob/77c6206b92399028af6a5ca893afecc87236ee7f/drivers/bms_ic/bq769x2/bq769x2.c#L395-L401 that if auto balancing was disabled, they would set "Balance Config" [reg 0x9335] to 0x00.  I tried that--and it did not do anything.

It appears that something is causing the BQ76952 to shut off cell balancing in the 1-second internal loop before actually gating the request to the AFE--but all of the alarm and fail flags are clear.

If the BQ76952 is not reporting any alarms or fails, then why is it refusing to enabling balancing when requested by the host via the CB_ACTIVE_CELLS subcommand?  I've lost several entire days on this singular problem alone...and it stopped being funny a while ago.

By the way: a documentation errata:

• In SLUUBY2B, on page 115, we find  "CB_SET_LVL" [sub-cmd 0x0084] is listed as write-only
• in SLUAA81A, on page 10, we are told that CB_SET_LVL "When read, returns the threshold."  I've tried reading it--and I get back 0x0000 no matter what's written to it.  It appears that SLUAA81A is incorrect.