copy branch

README.md

@@ -150,7 +150,7 @@ Current serial observations:
 - Bench serial-format finding: real hardware talks `38400 8E1`. Earlier `8N1` captures primarily exercised SCI1 parity/error handling and retry echoes, not the normal command path. After switching bench scripts to even parity, the selector-zero CONNECT path can reach `CONNECT:  OK`.
 - Bench CONNECT recovery finding: `CONNECT:NOT ACT` is recoverable without a power cycle. This makes it a normal no-active-session/cleared-state display rather than a terminal latch; tests can now probe from the idle NOT ACT state directly, then separately check whether OK is held or needs periodic CCU-like refresh traffic.
 - Bench CONNECT cadence finding: the `40 -> 80 -> C0` sequence stayed at `CONNECT:NOT ACT` with 10 ms, 50 ms, and 150 ms gaps, but produced `CONNECT: OK` then returned to `CONNECT:NOT ACT` with 700 ms and 1.5 s gaps. At 700 ms, single `40`/`80`/`C0` frames did not work, but all tested two-frame pairs did. Repeated `80 -> 80` at about 700 ms also worked, so the values do not need to differ. The no-power-cycle NOT ACT recovery capture produced repeated `02 00 02 00 00 5A` OK-path responses before heartbeat traffic resumed.
-- Bench special-selector finding: in the CONNECT OK advance sweep, command-5 selector `0x006C` (`05 00 6C 00 00 33`) produced `CONNECT OK` then a blank LCD with the CAM POWER lamp still on, while selector `0x006D` (`05 00 6D 00 00 32`) produced `CONNECT OK` then `COPY IN PROGRESS` then `CONNECT NOT ACT`. A later fresh isolated `ack-006d` run in `captures/connect-ok-advance-special-20260526-153339.txt` reproduced the copy path after a relay power-cycle. Forced ROM decoding confirms `0x006C -> H'2FAF` and `0x006D -> H'3015`; the `0x006D` path sets display selector `F732=H'1903`, a long `F798` countdown, and the ROM contains the `COPY IN PROGRESS` LCD string. The RCP-TX7 manual identifies `COPY IN PROGRESS` as the multi-camera `COPY TO SLAVES` transfer state over the RS232C command-link system, with controls locked until `COPY COMPLETED`.
+- Bench special-selector finding: in the CONNECT OK advance sweep, command-5 selector `0x006C` (`05 00 6C 00 00 33`) produced `CONNECT OK` then a blank LCD with the CAM POWER lamp still on, while selector `0x006D` (`05 00 6D 00 00 32`) produced `CONNECT OK` then `COPY IN PROGRESS` then `CONNECT NOT ACT`. A later fresh isolated `ack-006d` run in `captures/connect-ok-advance-special-20260526-153339.txt` reproduced the copy path after a relay power-cycle. Forced ROM decoding confirms `0x006C -> H'2FAF` and `0x006D -> H'3015`; the `0x006D` path sets display selector `F732=H'1903`, a long `F798` countdown, and the ROM contains the `COPY IN PROGRESS` LCD string. LCD dispatch now traces through `493E[0x19] -> H'930A`, with local table entry `H'9F6A` building `COPY IN PROGRESS` and entry `H'9FDA` building `COPY COMPLETED`; `0x006C` appears to be the completion/exit sibling only after `0x006D` has set the `F795.6/F795.7` copy flags. The RCP-TX7 manual identifies `COPY IN PROGRESS` as the multi-camera `COPY TO SLAVES` transfer state over the RS232C command-link system, with controls locked until `COPY COMPLETED`.
 - ROM report-source finding: the active `02/01 ...` frames exposed during CONNECT OK attempts are autonomous `F870 -> BAF2 -> BA26` report-queue transmissions, not ordinary command-1 readbacks. The ROM sets `FAA2.3/FAA3.7` after sending them, so the CCU probably needs to answer in that continuation window with command `4`, `5`, or `6` to consume the report queue and keep the session alive.
 - Board/P9 finding: traced MCU pin 62 `P91` reaches X24164 pin 6 `SCL`, and MCU pin 68 `P97` reaches the shared X24164 pin 5 `SDA` node. The emulator now treats the ROM's `C121/C08B/C0DB/C10C/C142` P9 routines as an X24164-style two-wire EEPROM bus, with ROM logical addresses `0x000-0x7FF` on the `H'A0/H'A1` control-byte family and `0x800-0xFFF` on `H'E0/H'E1`.
 - EEPROM role finding: `loc_40BB` checks `P7DR.7` and the `F402 == H'6B6F` signature before defaulting EEPROM/shadow tables; `loc_4103` writes ROM default words through `BFE0`, `loc_41D2` reads sixteen 8-byte records into `F7B0-F82F`, and the command-4 path at `BD2B-BD5F` can persist serial table writes when `F76E.7` is set.

build/rom_copy_text_linear.asm

@@ -0,0 +1,203 @@
+; H8/536 ROM disassembly
+; input: ROM\M27C512@DIP28_1.BIN
+; bytes: 65536
+; vector mode: min
+; analysis: linear sweep
+;
+; Notes from the manual:
+; - H8/536 uses the H8/500 CPU instruction set.
+; - In minimum mode the reset vector at H'0000-H'0001 is a 16-bit PC.
+; - The register field is H'FE80-H'FFFF; names below come from appendix B.
+; - @aa:8 short absolute operands use BR as the upper address byte.
+; - SCI baud inference uses section 14.2.8 BRR formulas when SMR/BRR are known.
+; - LCD inference treats E-clock H'F200/H'F201 accesses as status/control and data candidates.
+; - Pass --clock-hz to convert SCI BRR settings into numeric baud rates.
+; - Cycle counts use Appendix A tables A-7/A-8 for on-chip access with no external wait states.
+
+; Memory Map
+; H'0000-H'009F exception_vectors  vectors
+; H'00A0-H'00FF dtc_vectors        dtc_vectors
+; H'0100-H'F67F program_or_external program
+; H'F680-H'FE7F on_chip_ram        ram
+; H'FE80-H'FFFF register_field     registers
+
+; Vectors
+; H'0000 reset                    -> vec_reset_1000 (H'1000)
+; H'0004 invalid_instruction      -> vec_reset_1000 (H'1000)
+; H'0006 zero_divide              -> vec_reset_1000 (H'1000)
+; H'0008 trap_vs                  -> vec_reset_1000 (H'1000)
+; H'0010 address_error            -> vec_reset_1000 (H'1000)
+; H'0012 trace                    -> vec_reset_1000 (H'1000)
+; H'0016 nmi                      -> vec_nmi_4393 (H'4393)
+; H'0020 trapa_0                  -> vec_reset_1000 (H'1000)
+; H'0022 trapa_1                  -> vec_reset_1000 (H'1000)
+; H'0024 trapa_2                  -> vec_reset_1000 (H'1000)
+; H'0026 trapa_3                  -> vec_reset_1000 (H'1000)
+; H'0028 trapa_4                  -> vec_reset_1000 (H'1000)
+; H'002A trapa_5                  -> vec_reset_1000 (H'1000)
+; H'002C trapa_6                  -> vec_reset_1000 (H'1000)
+; H'002E trapa_7                  -> vec_reset_1000 (H'1000)
+; H'0030 trapa_8                  -> vec_reset_1000 (H'1000)
+; H'0032 trapa_9                  -> vec_reset_1000 (H'1000)
+; H'0034 trapa_a                  -> vec_reset_1000 (H'1000)
+; H'0036 trapa_b                  -> vec_reset_1000 (H'1000)
+; H'0038 trapa_c                  -> vec_reset_1000 (H'1000)
+; H'003A trapa_d                  -> vec_reset_1000 (H'1000)
+; H'003C trapa_e                  -> vec_reset_1000 (H'1000)
+; H'003E trapa_f                  -> vec_reset_1000 (H'1000)
+; H'0040 irq0                     -> vec_reset_1000 (H'1000)
+; H'0042 interval_timer           -> vec_interval_timer_BFC4 (H'BFC4)
+; H'0048 irq1                     -> vec_reset_1000 (H'1000)
+; H'0050 irq2                     -> vec_reset_1000 (H'1000)
+; H'0052 irq3                     -> vec_irq3_3C30 (H'3C30)
+; H'0058 irq4                     -> vec_irq4_3AC7 (H'3AC7)
+; H'005A irq5                     -> vec_reset_1000 (H'1000)
+; H'0062 frt1_ocia                -> vec_frt1_ocia_BEEA (H'BEEA)
+; H'006A frt2_ocia                -> vec_frt2_ocia_BF23 (H'BF23)
+; H'0080 sci1_eri                 -> vec_sci1_eri_BB57 (H'BB57)
+; H'0082 sci1_rxi                 -> vec_sci1_rxi_BB67 (H'BB67)
+; H'0084 sci1_txi                 -> vec_sci1_txi_BA84 (H'BA84)
+; H'0090 ad_adi                   -> vec_ad_adi_3D99 (H'3D99)
+
+; Symbols
+; ram_F738         H'F738 on_chip_ram        ram      r=0 w=2 width=word
+; ram_F73A         H'F73A on_chip_ram        ram      r=0 w=2 width=word
+; ram_F73C         H'F73C on_chip_ram        ram      r=0 w=2 width=word
+; ram_F73E         H'F73E on_chip_ram        ram      r=0 w=3 width=word
+; ram_F740         H'F740 on_chip_ram        ram      r=0 w=2 width=word
+; ram_F742         H'F742 on_chip_ram        ram      r=0 w=3 width=word
+; ram_F754         H'F754 on_chip_ram        ram      r=0 w=3 width=word
+
+; Board Profile
+; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
+; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
+; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
+; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
+
+; LCD/Text Scan
+; search 'CONNECT': not literal, hits=0
+;   near: H'A025 'COMPLETED', H'9F98 'COPY', H'A008 'COPY'
+; LCD text regions
+; region H'9F98-H'A033 count=4   'COPY', 'IN PROGRESS', 'COPY', 'COMPLETED'
+; LCD text candidates
+; text H'9F98   len=14  medium 'COPY' xrefs=2
+; text H'9FB5   len=14  medium 'IN PROGRESS' xrefs=2
+; text H'A008   len=14  medium 'COPY' xrefs=2
+; text H'A025   len=14  medium 'COMPLETED' xrefs=2
+
+9F80: 40 06          CMP:E #H'06, R0 ; cycles=2
+9F82: 00             NOP ; cycles=2
+9F83: 1D F7 3E 06 00 MOV:G.W #H'00, @H'F73E ; refs ram_F73E in on_chip_ram; cycles=9
+9F88: 1D F7 42 06 00 MOV:G.W #H'00, @H'F742 ; refs ram_F742 in on_chip_ram; cycles=11
+9F8D: 1D F7 54 06 00 MOV:G.W #H'00, @H'F754 ; refs ram_F754 in on_chip_ram; cycles=9
+9F92: 1E C1 71       BSR loc_6106 ; cycles=13
+9F95: 20 10          BRA loc_9FA7 ; cycles=8
+9F97: 06             .db H'06
+9F98: 20 20          BRA loc_9FBA ; cycles=7
+9F9A: 20 20          BRA loc_9FBC ; cycles=7
+9F9C: 20 43          BRA loc_9FE1 ; cycles=7
+9F9E: 4F 50 59       CMP:I #H'5059, R7 ; cycles=3
+9FA1: 20 20          BRA loc_9FC3 ; cycles=8
+9FA3: 20 20          BRA loc_9FC5 ; cycles=8
+9FA5: 20 07          BRA loc_9FAE ; cycles=8
+
+loc_9FA7:
+9FA7: 58 9F 97       MOV:I.W #H'9F97, R0 ; LCD text xref H'9F98 'COPY'; dataflow R0=H'9F97; cycles=3
+9FAA: 1E BA E4       BSR loc_5A91 ; cycles=13
+9FAD: 55 01          MOV:E.B #H'01, R5 ; dataflow R5=H'01; cycles=2
+9FAF: 1E 9F 1A       BSR loc_3ECC ; cycles=14
+9FB2: 20 10          BRA loc_9FC4 ; cycles=7
+9FB4: 06             .db H'06
+9FB5: 20 49          BRA loc_A000 ; cycles=8
+9FB7: 4E 20 50       CMP:I #H'2050, R6 ; cycles=3
+
+loc_9FBA:
+9FBA: 52 4F          MOV:E.B #H'4F, R2 ; dataflow R2=H'4F; cycles=2
+
+loc_9FBC:
+9FBC: 47 52          CMP:E #H'52, R7 ; cycles=2
+9FBE: 45 53          CMP:E #H'53, R5 ; cycles=2
+9FC0: 53 20          MOV:E.B #H'20, R3 ; dataflow R3=H'20; cycles=2
+9FC2: 20 07          BRA loc_9FCB ; cycles=7
+
+loc_9FC4:
+9FC4: 58 9F B4       MOV:I.W #H'9FB4, R0 ; LCD text xref H'9FB5 'IN PROGRESS'; dataflow R0=H'9FB4; cycles=3
+9FC7: 1E BA C7       BSR loc_5A91 ; cycles=14
+9FCA: 55 02          MOV:E.B #H'02, R5 ; dataflow R5=H'02; cycles=2
+9FCC: 1E 9E FD       BSR loc_3ECC ; cycles=13
+9FCF: 1E C1 6A       BSR loc_613C ; cycles=14
+9FD2: 1E BA 2F       BSR loc_5A04 ; cycles=13
+9FD5: 19             RTS ; cycles=13
+9FD6: 00             NOP ; cycles=2
+9FD7: 00             NOP ; cycles=2
+9FD8: 00             NOP ; cycles=2
+9FD9: FF 1D F7 36    SUB.W @(H'1DF7,R7), R6 ; cycles=6
+9FDD: 06             .db H'06
+9FDE: 00             NOP ; cycles=2
+9FDF: 1D F7 38 06 00 MOV:G.W #H'00, @H'F738 ; refs ram_F738 in on_chip_ram; cycles=9
+9FE4: 1D F7 3A 06 00 MOV:G.W #H'00, @H'F73A ; refs ram_F73A in on_chip_ram; cycles=11
+9FE9: 1D F7 3C 06 00 MOV:G.W #H'00, @H'F73C ; refs ram_F73C in on_chip_ram; cycles=9
+9FEE: 1D F7 40 06 00 MOV:G.W #H'00, @H'F740 ; refs ram_F740 in on_chip_ram; cycles=11
+9FF3: 1D F7 3E 06 00 MOV:G.W #H'00, @H'F73E ; refs ram_F73E in on_chip_ram; cycles=9
+9FF8: 1D F7 42 06 00 MOV:G.W #H'00, @H'F742 ; refs ram_F742 in on_chip_ram; cycles=11
+9FFD: 1D F7 54 06 00 MOV:G.W #H'00, @H'F754 ; refs ram_F754 in on_chip_ram; cycles=9
+A002: 1E C1 01       BSR loc_6106 ; cycles=13
+A005: 20 10          BRA loc_A017 ; cycles=8
+A007: 06             .db H'06
+A008: 20 20          BRA loc_A02A ; cycles=7
+A00A: 20 20          BRA loc_A02C ; cycles=7
+A00C: 20 43          BRA loc_A051 ; cycles=7
+A00E: 4F 50 59       CMP:I #H'5059, R7 ; cycles=3
+A011: 20 20          BRA loc_A033 ; cycles=8
+A013: 20 20          BRA loc_A035 ; cycles=8
+A015: 20 07          BRA loc_A01E ; cycles=8
+
+loc_A017:
+A017: 58 A0 07       MOV:I.W #H'A007, R0 ; LCD text xref H'A008 'COPY'; dataflow R0=H'A007; cycles=3
+A01A: 1E BA 74       BSR loc_5A91 ; cycles=13
+A01D: 55 01          MOV:E.B #H'01, R5 ; dataflow R5=H'01; cycles=2
+A01F: 1E 9E AA       BSR loc_3ECC ; cycles=14
+A022: 20 10          BRA loc_A034 ; cycles=7
+A024: 06             .db H'06
+A025: 20 20          BRA loc_A047 ; cycles=8
+A027: 43 4F          CMP:E #H'4F, R3 ; cycles=2
+A029: 4D 50 4C       CMP:I #H'504C, R5 ; cycles=3
+
+loc_A02C:
+A02C: 45 54          CMP:E #H'54, R5 ; cycles=2
+A02E: 45 44          CMP:E #H'44, R5 ; cycles=2
+A030: 20 20          BRA loc_A052 ; cycles=7
+A032: 20 07          BRA loc_A03B ; cycles=7
+
+loc_A034:
+A034: 58 A0 24       MOV:I.W #H'A024, R0 ; LCD text xref H'A025 'COMPLETED'; dataflow R0=H'A024; cycles=3
+A037: 1E BA 57       BSR loc_5A91 ; cycles=14
+A03A: 55 02          MOV:E.B #H'02, R5 ; dataflow R5=H'02; cycles=2
+A03C: 1E 9E 8D       BSR loc_3ECC ; cycles=13
+A03F: 1E C0 FA       BSR loc_613C ; cycles=14
+A042: 1E B9 BF       BSR loc_5A04 ; cycles=13
+A045: 19             RTS ; cycles=13
+A046: 00             NOP ; cycles=2
+
+loc_A047:
+A047: 00             NOP ; cycles=2
+A048: 00             NOP ; cycles=2
+A049: FF 1E C2 FB    BTST.W #11, @(H'1EC2,R7) ; cycles=6
+A04D: 19             RTS ; cycles=13
+A04E: 00             NOP ; cycles=2
+A04F: 00             NOP ; cycles=2
+A050: 00             NOP ; cycles=2
+
+loc_A051:
+A051: FF 1D F7 36    SUB.W @(H'1DF7,R7), R6 ; cycles=6
+A055: 06             .db H'06
+A056: 00             NOP ; cycles=2
+A057: 1D F7 38 06 00 MOV:G.W #H'00, @H'F738 ; refs ram_F738 in on_chip_ram; cycles=9
+A05C: 1D F7 3A 06 00 MOV:G.W #H'00, @H'F73A ; refs ram_F73A in on_chip_ram; cycles=11
+A061: 1D F7 3C 06 00 MOV:G.W #H'00, @H'F73C ; refs ram_F73C in on_chip_ram; cycles=9
+A066: 1D F7 40 06 00 MOV:G.W #H'00, @H'F740 ; refs ram_F740 in on_chip_ram; cycles=11
+A06B: 1D F7 3E 06 00 MOV:G.W #H'00, @H'F73E ; refs ram_F73E in on_chip_ram; cycles=9
+A070: 1D F7 42 06 00 MOV:G.W #H'00, @H'F742 ; refs ram_F742 in on_chip_ram; cycles=11
+A075: 1D F7 54 07 00 B9 MOV:G.W #H'00B9, @H'F754 ; refs ram_F754 in on_chip_ram; cycles=9
+A07B: 59 00 A9       MOV:I.W #H'00A9, R1 ; dataflow R1=H'00A9; cycles=3
+A07E: 58 00 00       MOV:I.W #H'0000, R0 ; dataflow R0=H'0000; cycles=3

docs/pt2-protocol.md

@@ -560,6 +560,8 @@ The `0x006D` copy path is now confirmed outside the earlier all-suite ordering c
 - Command 5 compares `R5` against `0x006C`, `0x006D`, and `0x006E`; those selectors call `BE70` to append the selector to the `F970` processing queue.
 - Selector `0x006C` dispatches to `H'2FAF`. Forced decoding shows it manipulates `F76E`, `F795`, `F797`, `F799`, can set display selector `F732=H'1904`, sets `FB02=H'14`, and calls the `48FA` display/report bridge.
 - Selector `0x006D` dispatches to `H'3015`. Forced decoding shows it sets `F731.7`, loads `F798=H'C8`, sets `F795.6/F795.7`, sets display selector `F732=H'1903`, sets `FB02=H'64`, calls `48FA`, then sets `F76E.6`.
+- The LCD dispatch for these states is now traced: `loc_48FA` reads the high byte at `F732`, so `F732=H'1903/H'1904` selects display page `0x19`, not direct page `0x03/0x04`. `493E[0x19] -> H'930A`; that page's local table at `H'931C` includes `H'9F6A` for `COPY` / `IN PROGRESS` and `H'9FDA` for `COPY` / `COMPLETED`. The low byte at `F733` is the substate selector: `0x03` is in-progress and `0x04` is completed.
+- This makes the likely copy handshake: `0x006D` starts copy and sets the `F795.6/F795.7` in-progress flags; `0x006C` is the completion/exit sibling only when those flags are live. Sending `0x006C` alone can therefore blank or clear state instead of displaying `COPY COMPLETED`.
 - The FRT1 timer path decrements `F797` and `F798`; when either reaches zero, it clears `F731.7`. This matches the observed transient display modes falling back to `CONNECT:NOT ACT`.
 - The string `COPY IN PROGRESS` is present in the ROM LCD resources, so the `006D` result is not a generic serial artifact.
 - Manual interpretation: the RCP-TX7 operating manual describes `COPY IN PROGRESS` as the LCD state shown during the multi-camera `COPY TO SLAVES` data-transfer operation over the RS232C command-link system. During that state, all linked RCP units display the message and their buttons/knobs are locked until `COPY COMPLETED`. Therefore selector `0x006D` is best treated as entering a command-link copy/data-transfer state, not as a normal CCU connection ACK.

scenarios/copy-step-006c-only.json

@@ -0,0 +1,41 @@
+{
+  "name": "copy-step-006c-only",
+  "notes": [
+    "Control run: recover to CONNECT OK, then send only command-5 selector 0x006C.",
+    "Expected from ROM model: 006C alone may clear/blank state because the 006D copy-in-progress flags are not live."
+  ],
+  "steps": [
+    {
+      "action": "power_cycle",
+      "off_seconds": 1.5
+    },
+    {
+      "action": "wait_ready",
+      "timeout": 10.0,
+      "heartbeats": 2,
+      "require": true
+    },
+    {
+      "action": "drain",
+      "seconds": 0.25
+    },
+    {
+      "action": "send",
+      "label": "ok_baseline_1",
+      "frame": "04 00 00 80 00 DE",
+      "listen": 0.7
+    },
+    {
+      "action": "send",
+      "label": "ok_baseline_2",
+      "frame": "04 00 00 80 00 DE",
+      "listen": 1.0
+    },
+    {
+      "action": "send",
+      "label": "copy_complete_candidate_006c_only",
+      "frame": "05 00 6C 00 00 33",
+      "listen": 8.0
+    }
+  ]
+}

scenarios/copy-step-006d-006c-1000ms.json

@@ -0,0 +1,47 @@
+{
+  "name": "copy-step-006d-006c-1000ms",
+  "notes": [
+    "Recover to CONNECT OK, send 006D, then send 006C 1 second later.",
+    "This gives the LCD time to visibly enter COPY IN PROGRESS before the completion candidate arrives."
+  ],
+  "steps": [
+    {
+      "action": "power_cycle",
+      "off_seconds": 1.5
+    },
+    {
+      "action": "wait_ready",
+      "timeout": 10.0,
+      "heartbeats": 2,
+      "require": true
+    },
+    {
+      "action": "drain",
+      "seconds": 0.25
+    },
+    {
+      "action": "send",
+      "label": "ok_baseline_1",
+      "frame": "04 00 00 80 00 DE",
+      "listen": 0.7
+    },
+    {
+      "action": "send",
+      "label": "ok_baseline_2",
+      "frame": "04 00 00 80 00 DE",
+      "listen": 1.0
+    },
+    {
+      "action": "send",
+      "label": "copy_start_006d",
+      "frame": "05 00 6D 00 00 32",
+      "listen": 1.0
+    },
+    {
+      "action": "send",
+      "label": "copy_complete_candidate_006c",
+      "frame": "05 00 6C 00 00 33",
+      "listen": 10.0
+    }
+  ]
+}

scenarios/copy-step-006d-006c-2500ms.json

@@ -0,0 +1,47 @@
+{
+  "name": "copy-step-006d-006c-2500ms",
+  "notes": [
+    "Recover to CONNECT OK, send 006D, then send 006C 2.5 seconds later.",
+    "This tests whether completion remains accepted after the in-progress display has settled."
+  ],
+  "steps": [
+    {
+      "action": "power_cycle",
+      "off_seconds": 1.5
+    },
+    {
+      "action": "wait_ready",
+      "timeout": 10.0,
+      "heartbeats": 2,
+      "require": true
+    },
+    {
+      "action": "drain",
+      "seconds": 0.25
+    },
+    {
+      "action": "send",
+      "label": "ok_baseline_1",
+      "frame": "04 00 00 80 00 DE",
+      "listen": 0.7
+    },
+    {
+      "action": "send",
+      "label": "ok_baseline_2",
+      "frame": "04 00 00 80 00 DE",
+      "listen": 1.0
+    },
+    {
+      "action": "send",
+      "label": "copy_start_006d",
+      "frame": "05 00 6D 00 00 32",
+      "listen": 2.5
+    },
+    {
+      "action": "send",
+      "label": "copy_complete_candidate_006c",
+      "frame": "05 00 6C 00 00 33",
+      "listen": 10.0
+    }
+  ]
+}

scenarios/copy-step-006d-006c-250ms.json

@@ -0,0 +1,47 @@
+{
+  "name": "copy-step-006d-006c-250ms",
+  "notes": [
+    "Recover to CONNECT OK, send 006D, then send 006C 250 ms later.",
+    "This tests whether completion must arrive while the 006D copy flags are freshly live."
+  ],
+  "steps": [
+    {
+      "action": "power_cycle",
+      "off_seconds": 1.5
+    },
+    {
+      "action": "wait_ready",
+      "timeout": 10.0,
+      "heartbeats": 2,
+      "require": true
+    },
+    {
+      "action": "drain",
+      "seconds": 0.25
+    },
+    {
+      "action": "send",
+      "label": "ok_baseline_1",
+      "frame": "04 00 00 80 00 DE",
+      "listen": 0.7
+    },
+    {
+      "action": "send",
+      "label": "ok_baseline_2",
+      "frame": "04 00 00 80 00 DE",
+      "listen": 1.0
+    },
+    {
+      "action": "send",
+      "label": "copy_start_006d",
+      "frame": "05 00 6D 00 00 32",
+      "listen": 0.25
+    },
+    {
+      "action": "send",
+      "label": "copy_complete_candidate_006c",
+      "frame": "05 00 6C 00 00 33",
+      "listen": 10.0
+    }
+  ]
+}

scenarios/copy-step-006d-only.json

@@ -0,0 +1,41 @@
+{
+  "name": "copy-step-006d-only",
+  "notes": [
+    "Recover to CONNECT OK, then send command-5 selector 0x006D.",
+    "Expected from ROM model: 006D starts the copy state, displays COPY IN PROGRESS, then eventually times out if no completion/CCU transfer follows."
+  ],
+  "steps": [
+    {
+      "action": "power_cycle",
+      "off_seconds": 1.5
+    },
+    {
+      "action": "wait_ready",
+      "timeout": 10.0,
+      "heartbeats": 2,
+      "require": true
+    },
+    {
+      "action": "drain",
+      "seconds": 0.25
+    },
+    {
+      "action": "send",
+      "label": "ok_baseline_1",
+      "frame": "04 00 00 80 00 DE",
+      "listen": 0.7
+    },
+    {
+      "action": "send",
+      "label": "ok_baseline_2",
+      "frame": "04 00 00 80 00 DE",
+      "listen": 1.0
+    },
+    {
+      "action": "send",
+      "label": "copy_start_006d",
+      "frame": "05 00 6D 00 00 32",
+      "listen": 10.0
+    }
+  ]
+}