Given the pinout previously described on https://embedded-elixir.com/post/2019-01-18-nerves-at-home-desk-controller/

All the buttons are active when grounded.

The serial port signal comes out of what was described as RX at 9600 baud.  It contains the height packets as described  for a short time after pressing the direction buttons.  0x01, 0x01, height high, height low  There is a 14ms gap between packets, allowing some type of framing.

Press the M button & RX sends out 0x01, 0x06, 0x00, 0x00 for a short time, then height packets for a short time.  0x01, 0x06, 0x00, 0x00 means it's waiting for you to press a preset button to set a preset.

Each burst of packets begins with a 2 byte packet 0x01, 0xaa & ends with 2 byte packet 0x01, 0x05.  The 0x01, 0xaa is not related to the number of packets.

Hold down the M button through the wait & height packets & it switches to outputting 0x01, 0x02, 0x00, 0x80.  This means the keypad is locked.  Pressing any button causes it to generate a burst of 0x01, 0x02, 0x00, 0x80 lock packets.  Hold the M button to cause the lock packets to turn back into height packets.

The memory recall pin is 5V inactive & doesn't connect to a button.  Combined with the direction buttons, it forms a 3 bit code which identifies 5 possible states of the 4 preset buttons.  The button states are:

Recall low, up high, down high -> preset 1 pressed

Recall low, up high, down low  -> preset 2 pressed

Recall low, up low, down high  -> preset 3 pressed

Recall high, up low, down low  -> preset 4 pressed

Recall high, up high, down high -> no preset button pressed.

Select a preset & the desk moves to the preset as you get a burst of height packets.  The motors do slow down as they approach the preset height.  Press any other button to abort the preset movement.  Select a preset after M to set a single preset.  The wait packets immediately turn into a burst of 0x01, 0x06, 0x01, 0x00 to confirm it was set.  Then come height packets.

It seems UART TX isn't used & UART RX is just intended to update a display.  The lion kingdom is leaning towards a board with no buttons, just an LED & IR for each desk.  The board tapes to the bottom of the desk in place of the OEM  button panel.  Maybe the button panel could be spliced in.  With the stock preset algorithm, this system now just translates IR codes to button presses.  There's some kind of LED flashing to replace the numeric display.

The board that reverse engineered the protocol had just a UART header for the UART pins, some buttons to emulate the buttons, & some jumpers to select the preset.  The jumpers went low by pressing a button.