Yeah, someone in the city had just the phone for sale, and it got here really fast.
The "Design Manual" says there is test code at the top of memory, but doesn't go into detail. Maybe some combination of inputs during reset jumps there? There is a bunch of info on how to program/verify the OTP version; maybe some piece of that can also be used on the ROM version?
