docs(rawcli): roadmap — MVP transponders, binary-autocomplete bug, MFC-first

Captures the named-transponder MVP (NTAG21x/UL EV1 done; MIFARE Classic next; then ICODE
SLIX/SLIX2/NTAG5), the UX contract (all hints in the completion dropdown, hex + binary), the
binary-mode autocomplete bug (entry._regroup_after resetting buf.document cancels the menu), and
the 15693 header-builder + per-chip-identify foundations.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/rawcli-todo.md

@@ -0,0 +1,56 @@
+# rawcli — catalog & memory-hinting roadmap
+
+The MVP is a list of **named transponders**, each surfaced through the **same UX**: a command
+catalog + a datasheet memory map, both offered as **autocomplete suggestions in the completion
+dropdown** — never on the bottom bar, never in command output.
+
+## The UX contract (applies to every transponder)
+
+- Completion dropdown offers: command names (by letter → `READ(`), opcodes (by hex/binary value →
+  raw byte inserted, command as the label), and page/block landmarks with datasheet roles.
+- **Must work in both hex AND binary entry modes**, rendering in the active base.
+- Function-call args are base-10 (`READ(4)`); raw bytes are hex, `0b` to intermix binary.
+
+## BUG — binary-mode autocomplete does not fire in the live prompt
+
+The completer logic is correct when fed the text directly (hex and binary), but in the running
+REPL the completion menu doesn't reliably appear while entering **binary**.
+- Prime suspect: `entry._regroup_after` sets `buf.document = Document(...)` directly on
+  auto-spacing, which resets prompt_toolkit's `complete_state` and cancels the menu. Binary
+  regroups every 8 digits, so it bites almost immediately.
+- Fix direction: regroup via a completion-preserving path (don't replace `buf.document`
+  wholesale); re-arm `complete_while_typing` after regroup. Also confirm the Ctrl-t / Ctrl-_
+  toggle actually flips the breadcrumb to `0b`.
+- Verify on hardware in binary mode (needs a tag on the antenna).
+
+## Priority 1 — MIFARE Classic (do this first)
+
+- **Identify**: distinguish 1K (SAK 0x08) / 4K (0x18) / Mini (0x09); today only named, no map.
+- **Memory map** (block → role), mirroring the NTAG page map:
+  - Block 0 = manufacturer block: UID + BCC + SAK + ATQA + manufacturer data.
+  - Sector trailer (block 3,7,…,63 on 1K; last block of each sector on 4K): **Key A (0-5),
+    access bits (6-8) + GPB (9), Key B (10-15)** — the access bits are the bit-level detail.
+  - Other blocks = data block (with sector number).
+  - 4K: sectors 0-31 are 4 blocks; sectors 32-39 are 16 blocks each.
+- **Catalog**: READ/WRITE/HALT exist; note that reads/writes need prior AUTH (Key A/B) — the
+  authenticate step is the reader's job before these.
+- Autocomplete must work in hex + binary (see the bug above).
+
+## After MFC — 15693 vicinity chips: ICODE SLIX, ICODE SLIX2, NTAG5
+
+1. **15693 header builder** (shared foundation). Replace the ad-hoc `bytes([0x02, cmd, …])` with a
+   real request-header builder: flags (data rate, addressed-vs-nonaddressed + 8-byte UID, option,
+   protocol-extension) + command + NXP **manufacturer code 0x04** for ICODE/NTAG5 custom commands.
+2. **Per-chip identify.** Today identify stamps `"ISO15693"` generically; resolve the actual IC
+   (UID mfg byte `E0 04…` + GET_SYSTEM_INFO / IC-reference) so catalog + map key off SLIX2 / NTAG5.
+3. **Catalogs + memory maps** per chip (blocks, config, counters, EAS/AFI, password/AES) — sourced
+   from the models in `transponders/hf/iso15693/nxp/` (`icode_slix`, `icode_slix2`, `ntag5_*`).
+4. Same autocomplete UX (hex + binary).
+
+## Also queued
+
+- **T5577 config block (block 0)** bitfield decode (modulation, bit-rate, block count, PWD/AOR) —
+  currently just "config block".
+- NTAG I2C plus (model exists, identify names it) — catalog + map.
+
+See [[project_rawcli_mvp]] in memory for the named-transponder scope.