The tag accepted 51840 but sent a header of 51792 and 50807 units of data,
about 69.5 days. Add the capture as a vector and correct the spec: the end
marker's length tracks delivered data, and at least one bit error changed
between reads, so the errors aren't all fixed in storage.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move hardware results into the sections implementers follow: history
counts are 4-byte units, frames can be 160 bytes, transfers are padded and
end with a length field, and status and marks are raw values. Add real
frame vectors and the capture replay format so other languages can test.
Change history_count to request units, with a margin for stop records.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Capture a 120 s live session and a 22320-unit history read from a real tag
(firmware 1.8), with a replay test and a CSV export of the history.
Record hardware results in the spec: the core protocol holds, history
counts are 4-byte units, the end marker carries a length, the tag holds
stored bit errors, and voltage doesn't show vehicle state on a Prius.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Spec with pseudocode and test vectors, APK disassembly, analysis tools,
shelved reference Python and the macOS BLE probe. Findings are not yet
validated against a real tag. The vendor XAPK and nested lib clone are
excluded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EinWd3UT2Xw7UakFtTp6hn
