tmd750

Imported from swiftraccoon/kenwood (tmd750/AGENTS.md). Install upstream with npx skills add swiftraccoon/kenwood --skill tmd750. Copyright stays with the author.

tmd750 (kenwood-tmd750)

Rules

• No dependency on kenwood-thd75, direct or transitive. tests/seam.rs rejects another model's imports in every source file and in the manifest.
• Dependencies stay at the minimum that works, ideally none beyond the shared workspace crates; the rule is in the root AGENTS.md section Standard.
• Generic transport types are imported directly from kenwood-transport, never re-exported from this crate's transport or error namespace. src/transport.rs owns model USB discovery and the 9600 baud, RTS/CTS, asserted DTR/RTS preset; the shared backend owns only physical I/O.
• src/transport.rs must not implement automatic Transport::reopen. SerialTransport::reopen returns TransportError::ReopenUnsupported. Re-selecting a pinned endpoint after a reboot is transport::reenumeration (pure classification, opens nothing) plus radio::readiness, which verifies a fresh identity through the caller's ControlHost; the host owns open, close, drop and enumeration.
• src/memory/menu_fields.rs is generated by mcp-d75-extract; never hand-edit it. Its doc text lives in the TMD750_TARGET arrays of mcp-d75-extract/src/rustgen.rs, and mcp-d75-extract/tests/tmd750.rs pins one sentence of it.
• data/mcp_d750_menu_schema.json reports writable_registry_field_count 431 and total_public_field_count 436; MCP_D750_MENU_FIELDS in the generated registry must agree, and tests/registry_agreement.rs enforces it.
• Region constants and framing bytes are described in committed code as the official program's transfer behavior, never with decompiled identifiers.
• Committed prose states contracts only: no dated bench narrative, no approval vocabulary, no capture paths, no timings.

CAT contracts (firmware 1.02, type K,2,1, panel USB)

• One command, one reply: Radio::command reads until a line answers the command (?, N, or the typed reply with matching band, address or slot), skipping at most MAX_STALE_LINES other lines, and after a ? the next REJECTION_SETTLE_COMMANDS commands discard what follows their reply within REJECTION_SETTLE_WINDOW. Needed because the radio repeats the reply to the command that follows certain rejected bare commands (AI, BL, FS, FT did; AG, IO, unknown mnemonics did not). No unconditional pre-write drain: every transport read is a capture-transcript record in the REPL.
• Every setter runs the firmware/type gate, requires an exact echo, then reads back. Wire domains were established by writing every value and observing the rejection of the next; a value label the radio did not confirm is marked in the type's doc, not asserted: PC High/Medium/Low order, DL dual/single, LC values, MD 3 as NFM, tone and DCS table index basis.
• Never send TX, RX, BE, PS 0, TN, VX or GP 0,x-style GPS-off writes from library code; VX and TN are read-only types with Unqualified variants. A BT 1 echo takes about 1.6 s, so SetBluetooth keeps at least BLUETOOTH_WRITE_TIMEOUT.
• MD values: 0 FM, 1 DV, 2 AM, 3 NFM, 4 DR (read only; MD band,4 is N). VM band,3 selects DR. ME and MR take three-character selectors; MR band reports AP for the APRS channel, which ME and MR refuse.
• ME addr,<20 fields> stores a channel (echo exact; readback identical except an empty URCALL becomes CQCQCQ); ME addr, clears it (reply ME addr, then N); 19- and 20-field forms are ?/N; ME Pri,... is N. A zero-frequency record is accepted, so never send one.
• DC slot,callsign,memo and CS callsign store their text verbatim and unpadded; DC slot,, is an unset or cleared MY slot, and an unconfigured CS reads NOCALL (N for a lowercase base or -0, ? for an over-length base). On this radio DC is the six-slot MY callsign list selected by DS, not the D75's URCALL/RPT1/RPT2 fields; never copy the D75's DC names or its space padding.

Memory channel storage (image layout, verified on firmware 1.02)

• Flags at 0x2000 (4 bytes: band code or 0xFF empty, lockout, group, raw), records at 0x4000 (40 bytes, six per page, layout in types/stored.rs), names at 0x10000 (16 bytes, NUL padded); one physical index for all three: regular 0-999, program scan interleaved L0,U0,L1,... from 1000 (L05 = 1010), priority 1100, APRS 1101.
• Verified by writing channels over CAT with every tone mode, both shift directions, split, reverse and lockout, reading the pages through McpSession::read_page, and decoding them to the same records; then clearing them. Not established: the band code bits (values 0x01, 0x02, 0x04, 0x05, 0x08 observed), the tone/CTCSS index basis, the name charset beyond ASCII, and the CALL channel slots.
• UP/DW act on the control band (first BC field) and take no argument; selecting a step rounds the VFO down to a multiple of it. The radio acknowledges UP/DW in about 3 ms, shows the new frequency on the next FQ, drops a second step sent within about 15 ms, and answers a setting write sent within about 20 ms with N. frequency_up/frequency_down keep STEP_SPACING between steps, read FQ before and after (polling STEP_READBACK_ATTEMPTS times), return no sooner than STEP_SETTLE after the acknowledgement, and fail with Error::StepNotApplied when the frequency never changes. Every other setter's echo arrives after the change (24 to 60 ms).

API contracts

• McpSession::exit is the only exit API: one E/ACK, then no baud change, reconnect, retry or CAT on that handle; the caller closes and drops the transport.
• Exit retires the handle's protocol state, so further managed traffic returns McpError::ConnectionRetired; an incomplete exchange returns McpError::RecoveryRequired instead and prohibits exit.
• Radio::probe_mcp is the one fixed read-until-exit operation: success is McpProbeOutcome::AwaitingCatVerification, it never sends CAT on the probed connection, never opens, closes, reopens or selects a transport, and cannot report post-exit CAT.
• Radio::recover resolves every journaled page before any radio I/O: each page needs unique journal membership and exactly one matching PagePatch of the exact page length, else McpError::RecoveryIntentCount or McpError::DuplicateRecoveryPage. An empty journal performs no protocol operation, and the report covers the journaled patch bits only.
• BytePatch, PagePatch, ConfigHeader and RadioConfig have private fields, validated constructors and read-only accessors; header failures use FileError, and there is no unchecked header constructor.
• Applying or comparing a page requires its exact length.
• PatchPlanner::set validates the whole assignment before any claim changes, so a rejected field leaves the previous plan intact and never retains a prefix.
• The private fixed-text frame writer admits exactly the PM1 page, the PM Off MY1 page and the 69 channel name-table pages (256-byte grid from 0x10000, inside the writable global region); every other page is refused before a frame is built. ChannelNameUpdate writes one channel's sixteen name bytes through it with a whole-page guard; an unnamed channel is sixteen NUL bytes.

Reflector Terminal lifecycle

• radio::terminal::lifecycle::TerminalLifecycle owns entry, the MMDVM handoff and restoration; it sends CAT, MCP and MMDVM frames and enforces the order, but opens no endpoint and writes no file. The caller implements three traits: ControlHost (serial CAT/MCP endpoint), ModemHost (modem link open and reopen), and TerminalJournal (durable backup, plan, pre-write intent and checkpoint). The two model MCP engines stay separate; this is TM-D750 only.
• Gateway Off writes the Terminal pages over the modem link; an active Terminal route writes over the control endpoint and never sends the modem link CAT. program_terminal refuses any target other than the exact qualified identity, requires the fresh Gateway to equal the observed one, records intent before each write, and acknowledges exactly one exit. The checkpoint records only a pass that entered MCP.
• TerminalRecovery::finish rewrites the reverse plan only when the modem connection was confirmed closed; otherwise the report is Blocked. It runs verify_readiness before and after the reverse write and verifies the restored identity and Gateway on a fresh connection before reporting Verified. verify_readiness waits SETTLE, re-enumerates the pinned endpoint, and retries only an entirely silent ID timeout within its budget and attempt cap; observe_control opens once and sends no reboot wait.
• TerminalLifecycle and verify_readiness never reopen a serial endpoint; the ControlHost/ModemHost own every open and close. Timing budgets (SETTLE, READINESS_BUDGET, WINDOW, POLL_INTERVAL) are host policy sized from observation, not firmware guarantees.

Commands

Regenerate the registry and manifest with the extractor (the command below without --check), then rerun it with --check, which fails on any difference instead of writing. The assembly, ilspycmd and language-file paths are local, so the command is not reproducible from the repository alone:

cargo run -p mcp-d75-extract -- extract --model tmd750 \
  --assembly <mcp_d750.exe> --ilspycmd <ilspycmd> --language-file <english.lng> \
  --mcp-version 1.00 --firmware 1.00 \
  --output tmd750/data/mcp_d750_menu_schema.json \
  --rust-output tmd750/src/memory/menu_fields.rs --strict-known-layout --check

Testing

• MockTransport scripting: one expect(write, reply) per write() call, in order. The session sends a write header and its data as ONE write, so script the concatenated frame. A queued reply is delivered in as many read() chunks as the caller asks for, with remainders re-queued. expect_hang scripts a timeout; assert_complete() proves every scripted exchange was consumed.