verify(micromate): 11.0BD confirmed on hardware -- every inference held

UM20147 read over USB by mm_client_check.py.  The Thor firmware line was
entirely inference until now, and two of its three differences were covered
only by SYNTHESISED test frames.  All three held:

- flags = 0x03 identifies the line -> reported firmware_line="thor".  That is
  only reachable if `10 03` in the flags position destuffs before indexing,
  since 0x03 is ETX -- so the escaped-flags case is confirmed too.
- the model string is shorter -> reported "MM/ISEE/S" exactly.  Anchoring the
  search on b"MM/" rather than a fixed span is what made this work.
- the 0x1C block is 4 bytes longer with the extras TRAILING, so from-the-start
  offsets survive -> battery 3.55 V and a clock correct to the second.

That last one is the one that mattered.  Series III's from-the-end offsets
would have given this unit 577.92 V, which is why mm_client_check watches for
an impossible voltage: it is a free self-check on exactly the inference most
likely to be wrong.

Also clean: serial UM20147, 5 setups (factory.MMB -> test2.mmb), active setup
test2.mmb, 15,000,000 B total and free, 21 reads / 2,165 B in.

"One protocol stack drives the whole fleet regardless of firmware line" -- the
headline finding of 2026-09-23 -- is now demonstrated by a working client
rather than by matching response SUBs.

Test and docstring claims downgraded from inference to confirmed where the
hardware settled them, and left as synthesised-frame notes where it did not:
the BEHAVIOUR is confirmed but raw BD bytes are still not in the repo.

Added --capture DIR to mm_client_check: writes a raw_bw_*/raw_s3_* pair in the
layout scratch/mm_frame_parse.py already reads, so a run on an unfamiliar unit
becomes a test fixture without setting up a relay.  Verified by round-tripping
its own output through that parser: 28 frames, 0 bad checksums.

Still not covered: a download from a BD unit (UM20147 had no events stored, so
the chunk walk remains CB-only), raw BD fixture bytes, a monitoring unit, a
nearly-full buffer, and the inbound call-home session.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ru8Lg9HkkYvX9VWWo65SmL

tests/test_micromate_framing.py

@@ -236,10 +236,13 @@ def test_thor_firmware_line_survives_destuffing():
 
     A parser that does not destuff ends the frame at byte 2 on half the fleet.
 
-    SYNTHESISED: no 11.0BD capture is on disk -- UM20147's sweep was recorded
-    on 2026-09-23 and those bins never landed in the repo.  Built by re-stuffing
-    the captured POLL probe reply's payload with flags flipped to 0x03, so the
-    only difference from a real frame is the one byte under test.
+    SYNTHESISED frame, but the BEHAVIOUR IS CONFIRMED on real hardware:
+    UM20147 (11.0BD) was read over USB on 2026-09-30 and reported
+    firmware_line="thor", which is only reachable if `10 03` in the flags
+    position destuffed correctly.  Raw BD bytes are still not in the repo, so
+    this frame stays synthesised -- built by re-stuffing the captured POLL
+    probe reply with flags flipped to 0x03, so the only difference from a real
+    frame is the one byte under test.
     """
     real = unstuff(RSP_POLL_PROBE[1:-1])[:-1]
     payload = bytes([real[0], FLAGS_THOR]) + real[2:]