bitwelder,
I forgot to mention, that I already tried those P4 pads before posting. Nothing. This thermostat is offered is several versions. Some can control additional equipment like humidifier, boiler, etc. I'd say those pads are for the extra prongs (that plug into the wall plate) to control that equipment. But right - they do look very much like a serial port quartet.
nmvR,
The P4 pads have short traces to the north (per my first photo), then they go on the other side and connect to the unpopulated pads for R1010 - R1013 (NE of the wifi chip). Those (missing) resistors are then connected back to component side to D16 - D19, which is where some transistors would be. There are a quite a few unpopulated pads in that area - the U16, U20, and north of that.
Per the microcontroller's datasheet it has 4 UARTs. And another DEBUG UART. But there's no way I can follow the traces for that.
I am at my limit for the time spent on chasing this...
Thank you both for your comments!
tjk