Firmware: RIOv4_2_patched_31250.bin — wedge fix + SCI retuned to 31250 baud

make_patch.py gains --baud31250: one byte beyond the wedge patch — the SCI
init operand at $D62B ($30 -> $02). BAUD $30 = /13 prescale, /1 divider
(2MHz E / 208 = 9615); $02 = /1, /4 -> 31250 exactly, 3.3x faster. The
init write also confirms the 8MHz crystal, which is why 19200/38400 are
unreachable and why 62500/125k are left alone pending an ISR cycle count.

- 24 bytes changed vs original (sha256 9f866cf3...); re-disassembly diff
  vs the classic patched image shows exactly the one operand line, and
  the classic build still reproduces 3fc8170c... (script regression-safe).
- PC side: SerialPortTransport takes an optional baudRate (default 9600,
  runtime untouched); RioSerialMonitor + --mash accept --baud 31250.
- Caveats documented in README/ANALYSIS: non-standard rate (FTDI-class
  adapters only, no 16550s); native games still speak 9600 so this chip
  is bench/RIOJoy-only; validate the wedge patch at 9600 first.

275 tests green; mash --selftest regression unchanged (FAIL/exit-1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -40,3 +40,13 @@ disassemble as 68HC11 from `$C000` with the vector entries as roots, find
 the SCI state machine (protocol constants FC=ACK FD=NAK FE=RESTART
 FF=IDLE, idle-reload-4 patterns), patch the early-ACK/error wedge path or
 widen its window, burn a new EPROM, keep this original safe.
+
+## Patched images (built by make_patch.py; see RIOv4_2-ANALYSIS.md)
+
+- **`RIOv4_2_patched.bin`** — the reply-latch wedge fix, 23 bytes changed.
+  sha256 `3fc8170caf60e2580641724ff995176c93c4f2e706f31487beded8233142493f`.
+- **`RIOv4_2_patched_31250.bin`** (`make_patch.py --baud31250`) — wedge fix
+  + SCI retuned 9600 → 31250 baud (one more byte, `$D62B: 30→02`).
+  sha256 `9f866cf353d04906e1d3e3847b6375eaae251c987b656f68f093e61ba1bd545b`.
+  Bench/RIOJoy-only until the native games get baud patches; needs an
+  FTDI-class adapter (16550s can't make 31250). Test tools take `--baud 31250`.