Christen RIO 4.3: RIOv4_3.bin is the production firmware

Final gate passed: 120s mash at 549 presses/min sustained (heaviest
stress run of the campaign) — zero wedges, counters flat, NAK 0, all
247 resends healed. RIOv4_3rc1 renamed to RIOv4_3.bin (same bytes,
sha dc59bd51cae3...); README/ANALYSIS promote it, production table
updated (native-game cabinets -> RIOv4_3.bin; FastRIO 4.3 variant is
build-on-demand with the documented flag set + acceptance ladder).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -41,37 +41,40 @@ the SCI state machine (protocol constants FC=ACK FD=NAK FE=RESTART
 FF=IDLE, idle-reload-4 patterns), patch the early-ACK/error wedge path or
 widen its window, burn a new EPROM, keep this original safe.
 
-## Current work candidate — `RIOv4_3rc1.bin`
+## RIO 4.3 — `RIOv4_3.bin` (current production firmware)
 
-Built by `make_patch.py --e0thresh=5 --checkrepaint RIOv4_2.bin
-RIOv4_3rc1.bin`; sha256
-`dc59bd51cae34781cf42f338e44a020b249a4030acc3c584af916aee9ca881e3`
+**Christened 2026-07-19** after full on-hardware certification. Built
+by `make_patch.py --e0thresh=5 --checkrepaint RIOv4_2.bin RIOv4_3.bin`;
+sha256 `dc59bd51cae34781cf42f338e44a020b249a4030acc3c584af916aee9ca881e3`
 (68 bytes changed vs stock). 9600 baud, native-game compatible. On the
 stock v4.2 base it carries:
 
 1. **Reply-latch wedge fix** (edits 1-2) — bench-certified.
-2. **E0-display threshold, N=5** (edit 5) — bench-certified 2026-07-19
-   (held `F0000000` sub-threshold, flipped to `E0000105` at the 5th
-   teardown; mash regression clean).
-3. **Check self-test display repaint** (edit 6, NEW) — the CheckRequest
-   handler previously left a stale `04000000` frame on the display; a
-   10-byte cave at `$E020` now repaints `F0000000` after every check,
-   then re-renders the `E0` readout only if a counter is at/over
-   threshold. **Needs on-hardware verification**: after a burn, any
-   version+check exchange (tray connect, monitor, mash start) must
-   leave the display reading `F0000000`, not `04000000`; then re-run
-   `--e0test` (expect the certified behavior unchanged) and a mash
-   spot-check.
+2. **E0-display threshold, N=5** (edit 5) — certified: display holds
+   `F0000000` through sub-threshold error events, flips to the live
+   `E0` readout at the 5th teardown (`E0000105` on the bench).
+3. **Check self-test display repaint** (edit 6) — certified both ways:
+   version+check leaves `F0000000` when healthy, and re-renders the E0
+   readout when counters are over threshold (`E0000305` on the bench)
+   instead of stock's stale `04000000`.
 
-Once edit 6 is verified on the cockpit, this image is christened
-**RIO 4.3**.
+Certification runs (all in `testlogs/` + RIOv4_2-ANALYSIS.md): two
+`--e0test` acceptance passes (display verified by eye at each step) and
+a 120 s mash at **549 presses/min sustained** — zero wedges, board
+counters flat, zero NAK, 247 resends all healed
+(`riomash-rio43rc1-9600-20260719-164901.log`).
+
+A FastRIO 4.3 variant does not exist yet; when wanted, build it with
+`make_patch.py --baud31250 --widen-ackwait --e0thresh=5 --checkrepaint`
+and run the same acceptance ladder before deploying.
 
 ## Archive
 
 All prior generations live in [`archive/`](archive/) with their
 disassemblies: `RIOv4_2_patched` (wedge fix only), `_31250`/`_31250v2`
 (FastRIO speed builds), `_62500`/`_125000` (speed-ladder science runs),
-and the `_e0t5` pair (threshold without check-repaint; the 9600 one is
-in the socket as of 2026-07-19 until rc1 is burned). Bench verdicts and
-per-edit history: RIOv4_2-ANALYSIS.md. The pristine dump `RIOv4_2.bin`
-stays at top level — it is the source every patch builds from.
+and the `_e0t5` pair (threshold without check-repaint). Bench verdicts
+and per-edit history: RIOv4_2-ANALYSIS.md. The pristine dump
+`RIOv4_2.bin` stays at top level — it is the source every patch builds
+from. RIO 4.3 is in the cockpit socket as of 2026-07-19; the original
+AMD chip and the retired e0t5 burn are labeled and preserved.