diff --git a/RIOv4_2-ANALYSIS.md b/RIOv4_2-ANALYSIS.md
index 8115c2f3..d95d3f52 100644
--- a/RIOv4_2-ANALYSIS.md
+++ b/RIOv4_2-ANALYSIS.md
@@ -154,6 +154,23 @@ chip), then run the `RIO_TAP` two-handed 8-button mash test. Expect: no
 permanent analog mute; any collision self-recovers without a game-start
 reset. Compare dropout counts to the 2026-07-03/04 baseline taps.
 
+**Instrumented harness** (2026-07-17): the mash protocol is mechanized in
+`tools/RioSerialMonitor` —
+
+    dotnet run --project tools/RioSerialMonitor -- --mash COM1 300 --label patched
+
+It disables the app's own >5 s reset-recovery (a wedge must stay observable),
+echoes lamps on every press (lamp/reply collisions are the trigger), and logs
+to `riomash-<label>-<stamp>.log`: analog-gap histogram + longest gaps, WEDGE
+events with beep/banner and a self-recovered vs button-revived classification
+(button within 300 ms of resume = the unpatched revival signature), and the
+board's own RestartCount/AbandonCount/FullBufferCount before/after with the
+delta (7-bit wrap-aware). Exit 0 = no wedge, 1 = wedge seen. Run once with
+`--label baseline` on the original chip (control: prove the test still bites),
+then `--label patched`; the fixed-layout summary blocks diff directly.
+`--mash --selftest` runs a scripted in-memory board that fakes a
+button-revived wedge — use it to sanity-check the alarm before a session.
+
 ## Firmware memory map (as decoded so far)
 
 | addr | meaning |