doc: update protocl ref

CLAUDE.md

@@ -137,10 +137,10 @@ counter and streams data for any valid 5A request; using `chunk_num * 0x0400` is
 confirmed from the BW wire capture. `bulk_waveform_term_params()` returns 10 bytes.
 Do not swap them.
 
-### SUB 5A — event-time metadata lives in A5 frame 7
+### SUB 5A — event-time metadata lives in a middle A5 frame (position variable)
 
-The bulk stream sends 9+ A5 response frames. Frame 7 (0-indexed) contains the compliance
-setup as it existed when the event was recorded:
+The bulk stream sends 9+ A5 response frames. One of the middle frames contains the
+compliance setup as it existed when the event was recorded:
 
 ```
 "Project:"      → project description
@@ -148,10 +148,14 @@ setup as it existed when the event was recorded:
 "User Name:"    → operator name      ← NOT in the 0C record
 "Seis Loc:"     → sensor location    ← NOT in the 0C record
 "Extended Notes"→ notes
+"Geo: "         → geo threshold (in/s) — always present
 ```
 
+**Metadata frame position is variable:** fi==7 for blast events (4-2-26 capture),
+fi==6 for desk-thump events (2026-04-14 confirmed).
+
 **IMPORTANT — 5A "Project:" is session-start config, NOT per-event (confirmed 2026-04-05):**
-The "Project:" string in the A5 frame 7 payload reflects the compliance setup from when
+The "Project:" string in the metadata frame reflects the compliance setup from when
 the *monitoring session first started*, not the individual event's project name.  The per-
 event project name is correctly stored in the 210-byte 0C waveform record and must be
 used as the authoritative source.  `_decode_a5_metadata_into` therefore only sets
@@ -160,8 +164,27 @@ used as the authoritative source.  `_decode_a5_metadata_into` therefore only set
 "Client:", "User Name:", "Seis Loc:", and "Extended Notes" are **NOT** present in the 0C
 record — 5A remains the sole source for those fields and they are set unconditionally.
 
-`stop_after_metadata=True` (default) stops the 5A loop as soon as `b"Project:"` appears,
-then sends the termination frame.
+**Metadata frame detection uses `_METADATA_FRAME_NEEDLES` (CORRECTED 2026-04-15):**
+`stop_after_metadata=True` stops the 5A loop as soon as any needle in
+`_METADATA_FRAME_NEEDLES` is found in the frame, then sends the termination frame.
+`_decode_a5_waveform` uses the same tuple to skip the frame instead of decoding it as ADC
+samples.  The tuple is:
+
+```python
+_METADATA_FRAME_NEEDLES = (
+    b"Project:", b"Client:", b"User Name:", b"Seis Loc:",
+    b"Extended Notes", b"Geo: ",
+)
+```
+
+**Do NOT check only `b"Project:"`.** The old single-needle check caused a critical bug
+(confirmed 2026-04-15): the metadata frame was decoded as waveform ADC samples, making
+the serial number bytes `"BE11529\0"` appear at sample ~929 followed by `0xFF 0xFF` fill,
+truncating the second half of every waveform.  Root cause unknown (may be that the
+Project/Client etc. label strings appear differently under certain conditions), but
+`b"Geo: "` is the reliable universal anchor — monitoring cannot operate without a geo
+threshold configured.  The check is applied against the full `db` (= `rsp.data`) bytes,
+not `db[7:]`, to eliminate any off-by-7 edge case.
 
 ### SUB 5A — STRT record layout and rectime_seconds (CORRECTED 2026-04-14)