Tracing EARN & EARP outputs from Iota.  On L1 they go to vias at (2422,518) and
(2449,518).  On L2 they go to vias at (2455,322) and (2492,323).  Tracing made
difficult by flaws in steve-m's grind-down process, but they appear to go to L4,
where they then seem to go to other vias at (491,1254) and (490,1292).  Found
them on L7: going to immediately adjacent micro-vias at (514,1255) and
(514,1295).  On L8 they go to the earpiece speaker.

Tracing the loudspeaker signal path starting with the physical speaker connector
on L1.  The connector part center is about (1930,212).  The connector footprint
on L1 is damaged by steve-m's grind-down process (almost gone), but there seem
to be micro-vias at (1756,251) and (2005,237).  On L2 they go to (1788,231) and
(2021,264).  On L7 they go to micro-vias at (1784,262) and (1992,252).  On L8
they go by some caps and then back to new micro-vias!  The latter are at
(1902,220) and (1903,259).  On L7 the grind-down damage gets in the way again,
but they appear to go to vias at (1935,218) and (1934,260).  Found them on L3:
going to new vias at (3703,311) and (3739,313).  (It might actually be L4.)
Found them on L7: fat traces to micro-vias at (3870,934) and (3898,869).
Finally on L8 they go to the Winbond chip!  The speaker connection pins appear
to be the two leftmost ones in the top row of 9 pins.

Calypso-Iota Voice Band interface

Tracing the Calypso voice output signal, starting from Calypso ball P14 (VDX).
On L1 it goes to a via at (3401,429).  On L2 it branches: one end goes to
(3366,304) - suspected via back to L1 for a test point, and the other end goes
to (2885,917) - also a suspected via back to L1.  Found the 1st branch on L1:
it's a short trace to another via at (3291,304).  Found the 2nd branch on L1
too: it goes to Iota ball F5 (VDR), matching the Leonardo schematics.

Now let's trace the branch that went to (3291,304) on L1.  On L2 it goes to a
short trace that goes to (3349,197) - suspected micro-via back to L1.  Looking
on L1: yes, indeed the trace seems to lead back here, but then the edge
grind-down damage gets in the way.  Looking at the L1 populated photo, the
trace definitely seems to go to an exposed test point.

The apparent lack of a switch or MUX on the Iota digital voice input strongly
suggests that in Wi-Fi VoIP operation the Calypso DSP acts as a forwarder for
the digital voice samples, which are being fed to it from the VoIP chip via
another interface: MCSI, or perhaps the otherwise unused MODEM UART switched
over to DSP ownership.