So the one piece I didn't have the datasheet for, and my training course didn't seem to cover was the surge suppressor. Specifically the cabling from the 8PC modular connector J1 to the M1 phone terminals. I could work out ring (pin 4) and tip (pin 5) easily enough, but I wasn't sure which pair was looped back to the M1. Quick email over to Ness and the datasheet shows that its pin 1 for R1 and pin 8 for TIP. That frustration led me to work on CAN 2 for a bit.