Correct 04000000 finding: CheckRequest self-test leftover, not test mode

Bench refutation (display is static under axis movement; version-only
exchanges leave it alone) kills the A-9-E chord theory. Real mechanism:
the CheckRequest handler at $C5A6 runs a full self-test — sets the
test-display flag $2421, brackets itself with TestModeChange 0x8C,
lamp pattern, pod scan, five-channel encoder sweep — and returns
without repainting, leaving the channel-4 frame (04000000) as a stale
cosmetic snapshot. Board fully healthy; no reset needed. PROTOCOL.md
now warns hosts that 0x8C fires around every check. Candidate firmware
fix (repaint cave off $C5E4) noted for a future burn.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/PROTOCOL.md

@@ -91,6 +91,14 @@ from [`g_baRIOLengthsA`](../legacy/riovjoy2.cpp#L171).
 | 0x8B | KeyReleased       | RIO→PC  | 2 | `pad`, `index` |
 | 0x8C | TestModeChange    | RIO→PC  | 1 | `mode` (0 = exit) |
 
+> **TestModeChange fires on every CheckRequest too** (firmware v4.2,
+> handler `$C5A6`): the board's check self-test brackets itself with
+> `0x8C` mode≠0 / mode=0, flashes the lamps, and leaves a stale
+> `04000000` frame on the 8-digit diagnostic display (cosmetic; see
+> [hardware/display-board-1408.md](hardware/display-board-1408.md)).
+> Hosts should treat `0x8C` around a check as routine, not as the
+> operator entering keypad test mode.
+
 ### Reset targets (ResetRequest payload)
 
 `0` = general/all, `1` = throttle, `2` = left pedal, `3` = right pedal,