Firmware validation harness: instrumented RIO_TAP mash test in RioSerialMonitor

New --mash mode (tools/RioSerialMonitor/MashTest.cs) mechanizes the
wedge-patch validation plan from RIOv4_2-ANALYSIS.md:
- Runs the live link with the app's >5s reset-recovery DISABLED so a
  board wedge stays observable, and echoes lamps on every press
  (lamp/reply collisions are the wedge trigger).
- Gap timing uses ANY AnalogReply packet (0xFE sentinels included -
  a sentinel still proves the reply path is alive); logs a gap
  histogram + top-10 longest gaps with timestamps.
- WEDGE detector: analog silent past the threshold (default 2s) ->
  beep + banner; on resume, classifies self-recovered (patched
  expectation) vs button-revived (button event within 300ms of resume,
  the unpatched signature) vs unresolved at run end.
- Board self-reported RestartCount/AbandonCount/FullBufferCount
  snapshotted before/after via CheckRequest, delta printed
  (7-bit wrap-aware).
- Fixed-layout summary teed to riomash-<label>-<stamp>.log so
  baseline-vs-patched runs diff directly. Exit 0 = no wedge, 1 = wedge.

--mash --selftest drives the whole instrument against a scripted
in-memory board (SelftestTransport) that goes silent at t=4.0s and
revives 200ms after a button at t=6.5s: verified end-to-end - alarm at
6.0s, wedge classified button-revived (2.75s), counter delta +4/+0/+1,
verdict FAIL, exit 1. Use it to sanity-check the alarm at the cabinet.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

RIOv4_2-ANALYSIS.md

@@ -154,6 +154,23 @@ chip), then run the `RIO_TAP` two-handed 8-button mash test. Expect: no
 permanent analog mute; any collision self-recovers without a game-start
 reset. Compare dropout counts to the 2026-07-03/04 baseline taps.
 
+**Instrumented harness** (2026-07-17): the mash protocol is mechanized in
+`tools/RioSerialMonitor` —
+
+    dotnet run --project tools/RioSerialMonitor -- --mash COM1 300 --label patched
+
+It disables the app's own >5 s reset-recovery (a wedge must stay observable),
+echoes lamps on every press (lamp/reply collisions are the trigger), and logs
+to `riomash-<label>-<stamp>.log`: analog-gap histogram + longest gaps, WEDGE
+events with beep/banner and a self-recovered vs button-revived classification
+(button within 300 ms of resume = the unpatched revival signature), and the
+board's own RestartCount/AbandonCount/FullBufferCount before/after with the
+delta (7-bit wrap-aware). Exit 0 = no wedge, 1 = wedge seen. Run once with
+`--label baseline` on the original chip (control: prove the test still bites),
+then `--label patched`; the fixed-layout summary blocks diff directly.
+`--mash --selftest` runs a scripted in-memory board that fakes a
+button-revived wedge — use it to sanity-check the alarm before a session.
+
 ## Firmware memory map (as decoded so far)
 
 | addr | meaning |