Edit 7: RIOv4_3 reports firmware version 4.3

The VersionReply builder at $C6EA hardcoded 4.2; --reportversion=4.3
patches the minor operand byte ($C6FF: 02->03). Verified no host
software gates on the value (legacy prints it, RIOJoy parses it, native
games ignore it — Cyd). Rebuilt RIOv4_3.bin: 69 bytes vs stock, sha
6d67a2fc7713...; docs updated. Chips burned before this edit still
announce 4.2 — re-burn to pick up the number; all other bytes match
the certified image.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -44,9 +44,10 @@ widen its window, burn a new EPROM, keep this original safe.
 ## RIO 4.3 — `RIOv4_3.bin` (current production firmware)
 
 **Christened 2026-07-19** after full on-hardware certification. Built
-by `make_patch.py --e0thresh=5 --checkrepaint RIOv4_2.bin RIOv4_3.bin`;
-sha256 `dc59bd51cae34781cf42f338e44a020b249a4030acc3c584af916aee9ca881e3`
-(68 bytes changed vs stock). 9600 baud, native-game compatible. On the
+by `make_patch.py --e0thresh=5 --checkrepaint --reportversion=4.3
+RIOv4_2.bin RIOv4_3.bin`; sha256
+`6d67a2fc77130b601fdb0ac02042dd4d0a98ac7e29a8077d588987a81073939c`
+(69 bytes changed vs stock). 9600 baud, native-game compatible. On the
 stock v4.2 base it carries:
 
 1. **Reply-latch wedge fix** (edits 1-2) — bench-certified.
@@ -57,6 +58,12 @@ stock v4.2 base it carries:
    version+check leaves `F0000000` when healthy, and re-renders the E0
    readout when counters are over threshold (`E0000305` on the bench)
    instead of stock's stale `04000000`.
+4. **Version bump** (edit 7, `--reportversion=4.3`) — the VersionReply
+   now announces **4.3** (one operand byte at `$C6FF`). Nothing
+   host-side validates the value (native games verified not to check
+   it). The certification runs below were made on the pre-edit-7 bytes;
+   the only delta is the version literal. Chips burned before this edit
+   report 4.2 — re-burn to announce 4.3.
 
 Certification runs (all in `testlogs/` + RIOv4_2-ANALYSIS.md): two
 `--e0test` acceptance passes (display verified by eye at each step) and

RIOv4_2-ANALYSIS.md

@@ -550,5 +550,10 @@ sessions fits this model.
 presses/min sustained (1129 presses — the heaviest stress run of the
 campaign), zero wedges, counters flat, NAK 0, 247 resends all healed
 (`testlogs/riomash-rio43rc1-9600-20260719-164901.log`). `RIOv4_3rc1`
-renamed to **`RIOv4_3.bin`** (same bytes, sha `dc59bd51cae3…`) — the
-production firmware for native-game cabinets.
+renamed to **`RIOv4_3.bin`** — the production firmware for native-game
+cabinets. Post-christening, **edit 7** (`--reportversion=4.3`, one
+operand byte at `$C6FF` in the VersionReply builder `$C6EA`) makes the
+board announce 4.3; final sha256 `6d67a2fc7713…` (69 bytes vs stock).
+No host software validates the version value (native games verified
+not to check it — Cyd, 2026-07-19); tools will print `firmware: 4.3`
+after the next burn.

RIOv4_3.bin

@@ -5,7 +5,7 @@
 &6�
�	&0~�$�')��
 & �
�	&�
�&~�8�
�$!실싯㎧헊%식523889~찌
시;�&식F싱(
시;�'�~헟�
&
 싫決�;�'�~�^�&
-심시;�'u~혃�&
+심시;�'u~혃�&
 심4시;�'d~��&
 심h시;�'S~혩�&
 심쑞�;�'B~짖�&시%쌀굵혾시;�'\~쨔�&싯努�J시;�'H~쫑�&*싯喧�p시;�'4~쭝싯㎧�;�

RIOv4_3.disasm.asm

@@ -820,7 +820,7 @@ C6F7  86 04                        LDAA #$04
 C6F9  84 7F                        ANDA #$7F
 C6FB  A7 00                        STAA $00,X
 C6FD  08                           INX
-C6FE  86 02                        LDAA #$02
+C6FE  86 03                        LDAA #$03
 C700  84 7F                        ANDA #$7F
 C702  A7 00                        STAA $00,X
 C704  BD D6 3B                     JSR $D63B

make_patch.py

@@ -52,6 +52,14 @@ CHECKREPAINT = "--checkrepaint" in sys.argv
 assert not CHECKREPAINT or E0T is not None, \
     "--checkrepaint requires --e0thresh (it re-renders E0 via the gated $D5F2)"
 
+# --reportversion=M.N (edit 7): the major.minor bytes the VersionReply returns.
+REPORTVER = None
+for a in sys.argv:
+    if a.startswith("--reportversion="):
+        REPORTVER = tuple(int(x) for x in a.split("=", 1)[1].split("."))
+        assert len(REPORTVER) == 2 and all(0 <= v <= 127 for v in REPORTVER), \
+            f"--reportversion must be M.N with 7-bit values: {REPORTVER}"
+
 args = [a for a in sys.argv[1:] if not a.startswith("--")]
 SRC = args[0] if len(args) > 0 else "RIOv4_2.bin"
 if len(args) > 1:
@@ -165,6 +173,16 @@ if CHECKREPAINT:
              0x39]               # $E029  RTS
     patch(0xE020, [0xFF] * len(cave6), cave6)
 
+# --- edit 7 (--reportversion=M.N): version bytes in the VersionReply --------
+# The reply builder at $C6EA loads the payload with LDAA #$04 ($C6F7) and
+# LDAA #$02 ($C6FE) — hardcoded "4.2". Nothing host-side validates the value
+# (legacy app prints it, RIOJoy parses it, native games ignore it — verified
+# by Cyd 2026-07-19), so the christened firmware can announce itself.
+if REPORTVER is not None:
+    assert d[0xC6F7] == 0x86 and d[0xC6FE] == 0x86, "expected LDAA #imm pair at $C6F7/$C6FE"
+    patch(0xC6F8, [0x04], [REPORTVER[0]])
+    patch(0xC6FF, [0x02], [REPORTVER[1]])
+
 open(DST, "wb").write(d)
 new_sha = hashlib.sha256(d).hexdigest()
 # byte-diff report