docs(01-02): extend 08.08 md5 row with 3-way split + add two 84033544 back-pointers (DOC-04)

research/08.08-print-abi.md

@@ -161,14 +161,14 @@ The print-job submission ends with a single MQTT command published to the printe
 
 | Field | Type | Source in `PrintParams` (Studio -> ABI) | Notes |
 |---|---|---|---|
-| `sequence_id` | string (decimal) | See [§6.2](06.02-mqtt.md#mqtt-sequence_id) | Stock plugin always emits `"20001"` for `project_file` on a fresh process (every ABI `02.05.00`–`02.08.02`). Reusing that value across restarts yields `err_code` 84033544. We seed randomly in 20000–29999 and increment. |
+| `sequence_id` | string (decimal) | See [§6.2](06.02-mqtt.md#mqtt-sequence_id) | Stock plugin always emits `"20001"` for `project_file` on a fresh process (every ABI `02.05.00`–`02.08.02`). Reusing that value across restarts yields `err_code` 84033544. We seed randomly in 20000–29999 and increment. See the 84033544 readings block in [§10.04](10.04-mqtt-signing.md). |
 | `command` | string | constant `"project_file"` | Selects the firmware handler. |
 | `param` | string | derived from `plate_index` | Always `Metadata/plate_<N>.gcode`; resolves to a path inside the uploaded 3mf. |
 | `project_id`, `profile_id`, `task_id`, `subtask_id` | strings | cloud task IDs from `POST /v1/user-service/my/task` (cloud) or `"0"` placeholder (LAN / Developer Mode) | Sent as **strings**, not numbers. |
 | `subtask_name` | string | `project_name` (falls back to `task_name`) | Shown on the printer screen. |
 | `file` | string | `project_name` / `task_name` via `pick_remote_name` | Basename of the `.3mf`. Stock **ignores `dst_file`** even on `sdcard_print` (a probe with `dst_file="cache/obn-nonexistent-L1.gcode.3mf"` still published `file:"obn-probe-L1.gcode.3mf"`). On `local_print` it matches the uploaded FTPS/brtc name. |
 | `url` / `url_enc` | string | `opts.url` | Tells firmware **how to locate** the `.3mf` on `local_print`. **`sdcard_print` omits both keys** (stock `02.05.00`–`02.08.02`) — firmware looks the file up by `file` + `md5:"from_sd_card"`. Cleartext `url` uses one of several schemes (`ftp://`, `brtc://emmc/`, `file://`, presigned `https://…` for cloud); `url_enc` is the same URL RSA-encrypted with the **printer's device-cert public key** using **PKCS#1 v1.5** padding (direct RSA, no AES session-key wrap — the observed ≤~245-byte ciphertext equals the RSA-2048 PKCS#1 v1.5 ceiling of `256−11=245` and rules out OAEP-SHA1, which would cap at 214; independently cross-validated in [issue #47](https://github.com/ClusterM/open-bamboo-networking/issues/47), on-wire confirmation of the padding still pending). Non-Developer-Mode firmware requires `url_enc`; Developer Mode accepts plain `url`. Full scheme semantics: see **URL schemes** below. |
-| `md5` | string | literal `"from_sd_card"` | Stock `02.05.00`–`02.08.02` always emit this literal — on `sdcard_print` **and** on FTPS `local_print`, even when `ftp_file_md5` is filled with a hex sentinel (Studio never assigns that field). A real file hash never appeared in any captured LAN `project_file`. Cloud `PATCH` uses a different `md5` — see [§8.8.3](#883-bambu_network_start_local_print_with_record). |
+| `md5` | string | literal `"from_sd_card"` | Stock `02.05.00`–`02.08.02` always emit this literal — on `sdcard_print` **and** on FTPS `local_print`, even when `ftp_file_md5` is filled with a hex sentinel (Studio never assigns that field). A real file hash never appeared in any captured LAN `project_file`. Cloud `PATCH` uses a different `md5` — see [§8.8.3](#883-bambu_network_start_local_print_with_record). Beyond stock, the value is a 3-way semantics split: ours = literal `"from_sd_card"` (kept as-is, this row); beambam = uppercase md5 of the inner `Metadata/plate_N.gcode`; Doridian #72 = whole-.3mf md5 — wrong value → `0x0500403F` / `83902527` or `84033544`. Source: INTERESTING_REPOS.md cross-check #4 |
 | `bed_type` | string | `task_bed_type` (defaults to `"auto"`) | One of the `MachineBedTypeString` values. |
 | `bed_leveling`, `flow_cali`, `vibration_cali`, `layer_inspect`, `timelapse`, `use_ams` | bool | matching `task_*` flags | Per-print toggles from the `SelectMachineDialog` checkboxes. |
 | `ams_mapping` | int array | `ams_mapping` (Studio passes a JSON array string `[0,-1,...]`) | Index = filament slot in the 3mf, value = AMS tray id (`-1` = no mapping, `255` = virtual tray). Legacy single-AMS shape. Empty string → `[]` even with `use_ams=true` (stock `02.05.03` / `02.08.02`); there is no `[0]` fallback. |
@@ -542,7 +542,7 @@ Drive it with [`tools/plugin_runner.sh`](../tools/plugin_runner.sh) `--abi 02.08
 - `--user-info @<obn.auth.json>` even for the LAN-only runs — signing material comes from the cloud session.
 - `--auto-stop` on anything that can actually start a print.
 
-Two safe dry runs: `--action sdcard_print` with `dst_file` naming a file that isn't on the SD card publishes the full `project_file` and uploads nothing, and reusing `sequence_id` `"20001"` across process restarts makes firmware reject with `mqtt message verify failed` / `err_code` 84033544 — in both cases the plugin's serialization is already on the wire, which is all the probe needs.
+Two safe dry runs: `--action sdcard_print` with `dst_file` naming a file that isn't on the SD card publishes the full `project_file` and uploads nothing, and reusing `sequence_id` `"20001"` across process restarts makes firmware reject with `mqtt message verify failed` / `err_code` 84033544 — in both cases the plugin's serialization is already on the wire, which is all the probe needs. See the 84033544 readings block in [§10.04](10.04-mqtt-signing.md).
 
 Finally diff the *key sets* of the captured bodies rather than eyeballing them: the control run is the baseline, and a key that appears only in the numeric run (`plateId`) is the whole point of the exercise.