From 1ebcf225f12e418cc4d72e07e554ef74f54066cf Mon Sep 17 00:00:00 2001
From: Matthew Carroll <matthew.finn.carroll@gmail.com>
Date: Wed, 9 Sep 2026 21:02:09 -0700
Subject: [PATCH] lf nrz demod: start the bitstream at the first edge

The samples before the first level change were counted as bits, and where no
edge arrives inside ten clocks the long-run flush fired first and invented ten
of them out of the quiet lead-in. The count sat on a rounding boundary, so one
sample of jitter in that edge added or dropped a leading bit and rotated the
rest of the word - while startIdx, derived from the same count, held i % clk and
could name no sample.

A level change can only fall on a bit boundary, so start there and report it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 CHANGELOG.md     |  1 +
 common/lfdemod.c | 25 +++++++++++++++++++------
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ceef461b4..d79d185ba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ This project uses the changelog in accordance with [keepchangelog](http://keepac
 ## [unreleased][unreleased]
 - Fixed `lf t55xx detect` - PSK1 now detects at every bit rate and subcarrier. (@iceman1001)
 - Fixed `lf t55xx detect` - FSK was skipped entirely when the field-clock pair measured as neither legal pair, losing FSK1 at RF/32 and RF/40 and every variant at RF/16 (@iceman1001)
+- Fixed `lf nrz demod` - the samples before the first level change were counted as bits, rotating the word whenever that edge moved (@mfcarroll)
 - Fixed `lf t55xx dump/read` - blocks were extracted at a bit offset cached from the last `detect`  The offset is now anchored in graph samples (@iceman1001)
 - Fixed `lf t55xx write --verify` - a successful write could be reported as a validation failure, both from the rotated read above and from the pre-write config decoding the post-write signal into garbage (@iceman1001)
 - Fixed `lf t55xx detect` - the automatic detect after a block 0 write reported a password that was never supplied (@iceman1001)
diff --git a/common/lfdemod.c b/common/lfdemod.c
index 33ee616cc..6c742a0d4 100644
--- a/common/lfdemod.c
+++ b/common/lfdemod.c
@@ -1902,18 +1902,31 @@ int nrzRawDemod(uint8_t *dest, size_t *size, int *clk, const int *invert, int *s
         if (dest[i] <= low)  bit = 0;
         dest[i] = bit;
     }
-    //now demod based on clock (rf/32 = 32 1's for one 1 bit, 32 0's for one 0 bit)
+    // start on the first level change: it is the earliest sample known to be a
+    // bit boundary.  counting the samples before it as bits rotated the stream
+    // whenever that edge moved by one, and left startIdx naming no sample
     size_t lastBit = 0;
     size_t numBits = 0;
+    bool anchored = false;
     for (i = 21; i < *size - 20; i++) {
+
+        bool edge = (dest[i] != dest[i - 1]);
+
+        if (anchored == false) {
+            if (edge == false) {
+                continue;
+            }
+            *startIdx = (int)i;
+            if (g_debugMode == 2) prnt("DEBUG NRZ: startIdx %i", *startIdx);
+            lastBit = i - 1;
+            anchored = true;
+            continue;
+        }
+
         //if transition detected or large number of same bits - store the passed bits
-        if (dest[i] != dest[i - 1] || (i - lastBit) == (10 * *clk)) {
+        if (edge || (i - lastBit) == (10 * *clk)) {
             memset(dest + numBits, dest[i - 1] ^ *invert, (i - lastBit + (*clk / 4)) / *clk);
             numBits += (i - lastBit + (*clk / 4)) / *clk;
-            if (lastBit == 0) {
-                *startIdx = i - (numBits * *clk);
-                if (g_debugMode == 2) prnt("DEBUG NRZ: startIdx %i", *startIdx);
-            }
             lastBit = i - 1;
         }
     }