diff --git a/captures/rcp-context-90-e8-exact-7a5826.txt b/captures/rcp-context-90-e8-exact-7a5826.txt new file mode 100644 index 0000000..ad3b652 --- /dev/null +++ b/captures/rcp-context-90-e8-exact-7a5826.txt @@ -0,0 +1,35 @@ +Sequence probe: 5 frames x 2 group(s) on COM5 at 38400 8N1 +FRAME 1: 00 00 90 00 80 4A +FRAME 2: 00 00 E8 40 30 C2 +FRAME 3: 07 80 7A 58 26 D9 +FRAME 4: 00 00 00 00 80 DA +FRAME 5: 00 00 00 00 80 DA +BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +BEGIN group 1/2 +20:18:25.345 TX group=1 frame=1 len=006 00 00 90 00 80 4A +20:18:25.345 RX group=1 frame=1 no RX bytes +20:18:25.853 TX group=1 frame=2 len=006 00 00 E8 40 30 C2 +20:18:25.853 RX group=1 frame=2 ANOMALY 18 RX bytes; first mismatch at byte 6: got 07, heartbeat offset 0 expected 00 +20:18:25.853 RX group=1 frame=2 raw 00 00 00 00 80 DA 07 80 7A 50 26 D1 07 80 7A 50 26 D1 +20:18:26.361 TX group=1 frame=3 len=006 07 80 7A 58 26 D9 +20:18:26.361 RX group=1 frame=3 ANOMALY 12 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 3 expected 00 +20:18:26.361 RX group=1 frame=3 raw 07 80 7A 50 26 D1 07 80 7A 50 26 D1 +20:18:26.897 TX group=1 frame=4 len=006 00 00 00 00 80 DA +20:18:26.897 RX group=1 frame=4 ANOMALY 18 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 0 expected 00 +20:18:26.897 RX group=1 frame=4 raw 07 80 7A 50 26 D1 00 00 00 00 80 DA 00 00 00 00 80 DA +20:18:27.402 TX group=1 frame=5 len=006 00 00 00 00 80 DA +20:18:27.402 RX group=1 frame=5 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes +GROUP 1 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes +BEGIN group 2/2 +20:18:28.556 TX group=2 frame=1 len=006 00 00 90 00 80 4A +20:18:28.556 RX group=2 frame=1 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes +20:18:29.061 TX group=2 frame=2 len=006 00 00 E8 40 30 C2 +20:18:29.061 RX group=2 frame=2 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes +20:18:29.596 TX group=2 frame=3 len=006 07 80 7A 58 26 D9 +20:18:29.596 RX group=2 frame=3 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes +20:18:30.131 TX group=2 frame=4 len=006 00 00 00 00 80 DA +20:18:30.131 RX group=2 frame=4 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes +20:18:30.636 TX group=2 frame=5 len=006 00 00 00 00 80 DA +20:18:30.636 RX group=2 frame=5 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes +GROUP 2 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes +Anomalies: 3 diff --git a/captures/rcp-context-90-ec-exact-fb5026.txt b/captures/rcp-context-90-ec-exact-fb5026.txt new file mode 100644 index 0000000..f044837 --- /dev/null +++ b/captures/rcp-context-90-ec-exact-fb5026.txt @@ -0,0 +1,34 @@ +Sequence probe: 5 frames x 2 group(s) on COM5 at 38400 8N1 +FRAME 1: 00 00 90 00 80 4A +FRAME 2: 00 00 EC 40 30 C6 +FRAME 3: 07 80 FB 50 26 50 +FRAME 4: 00 00 00 00 80 DA +FRAME 5: 00 00 00 00 80 DA +BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +BEGIN group 1/2 +20:18:45.905 TX group=1 frame=1 len=006 00 00 90 00 80 4A +20:18:45.905 RX group=1 frame=1 heartbeat-compatible RX: 6 bytes, offset 0, 1 frames + 0 bytes +20:18:46.442 TX group=1 frame=2 len=006 00 00 EC 40 30 C6 +20:18:46.442 RX group=1 frame=2 ANOMALY 18 RX bytes; first mismatch at byte 6: got 07, heartbeat offset 0 expected 00 +20:18:46.442 RX group=1 frame=2 raw 00 00 00 00 80 DA 07 80 FB 50 26 50 07 80 FB 50 26 50 +20:18:46.948 TX group=1 frame=3 len=006 07 80 FB 50 26 50 +20:18:46.948 RX group=1 frame=3 ANOMALY 18 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 0 expected 00 +20:18:46.948 RX group=1 frame=3 raw 07 80 FB 50 26 50 00 00 00 00 80 DA 00 00 00 00 80 DA +20:18:47.485 TX group=1 frame=4 len=006 00 00 00 00 80 DA +20:18:47.485 RX group=1 frame=4 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes +20:18:48.022 TX group=1 frame=5 len=006 00 00 00 00 80 DA +20:18:48.022 RX group=1 frame=5 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes +GROUP 1 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes +BEGIN group 2/2 +20:18:49.147 TX group=2 frame=1 len=006 00 00 90 00 80 4A +20:18:49.147 RX group=2 frame=1 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes +20:18:49.653 TX group=2 frame=2 len=006 00 00 EC 40 30 C6 +20:18:49.653 RX group=2 frame=2 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes +20:18:50.191 TX group=2 frame=3 len=006 07 80 FB 50 26 50 +20:18:50.191 RX group=2 frame=3 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes +20:18:50.697 TX group=2 frame=4 len=006 00 00 00 00 80 DA +20:18:50.697 RX group=2 frame=4 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes +20:18:51.203 TX group=2 frame=5 len=006 00 00 00 00 80 DA +20:18:51.203 RX group=2 frame=5 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes +GROUP 2 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes +Anomalies: 2 diff --git a/docs/discovery-notes.md b/docs/discovery-notes.md index 94baacf..1940f5f 100644 --- a/docs/discovery-notes.md +++ b/docs/discovery-notes.md @@ -5924,3 +5924,228 @@ Best next move: - the strongest immediate candidates are: - `90 -> E8 -> exact 07 80 7A 58 26 D9` - `90 -> EC -> exact 07 80 FB 50 26 50` + +### HE26: Answer The Actually Observed `90`-Shifted Family + +Goal: + +- Now that `90` is clearly able to shift the family/page opened by `E8` and + `EC`, answer the *observed* downstream frame rather than the older sibling + family we expected from earlier runs. + +Hypothesis: + +- If opener choice is selecting a page or family, the correct next probe is the + exact frame from that page, not a nearby family member learned under another + opener. + +What would count as a hit: + +- any fresh non-heartbeat family after the exact observed-frame echo +- a reproducible second-stage branch that only appears when the echoed frame + matches the opener-selected family +- visible evidence that page-matched echoing behaves differently from + sibling-mismatched echoing + +#### HE26a: `90 -> E8 -> exact 7A 58 26` + +Under `90`, `E8` produced `07 80 7A 58 26 D9`, so answer that exact frame. + +```powershell +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 30 C2" --frame "07 80 7A 58 26 D9" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-context-90-e8-exact-7a5826.txt +``` + +#### HE26b: `90 -> EC -> exact FB 50 26` + +Under `90`, `EC` produced `07 80 FB 50 26 50`, so answer that exact frame. + +```powershell +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 30 C6" --frame "07 80 FB 50 26 50" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-context-90-ec-exact-fb5026.txt +``` + +Recommended order: + +1. `HE26b` (`90 -> EC -> exact FB 50 26`) +2. `HE26a` (`90 -> E8 -> exact 7A 58 26`) + +`EC` still looks like the more stateful branch, so it has the better chance of +showing whether page-matched echoing matters. + +### 2026-05-13 Page-Matched Echo Result + +Captures: + +- `captures/rcp-context-90-e8-exact-7a5826.txt` +- `captures/rcp-context-90-ec-exact-fb5026.txt` + +Observed outcomes: + +| Setup | Selector result | Page-matched exact echo result | +| --- | --- | --- | +| `90 -> E8 -> exact 7A 58 26` | actual run produced `07 80 7A 50 26 D1` | sending `07 80 7A 58 26 D9` did not open a new family; the queued `7A 50 26 D1` drained, then heartbeat | +| `90 -> EC -> exact FB 50 26` | `07 80 FB 50 26 50` | sending `07 80 FB 50 26 50` did not open a new family; then heartbeat | + +Interpretation: + +- Page-matched echoing still did **not** create a stable second-stage exchange. +- For `EC`, this is fairly clean: the observed `FB 50 26` family was echoed + back exactly and the branch still collapsed to heartbeat. +- For `E8`, the run is interesting in a different way: + - the earlier `90 -> E8` test had produced sibling `07 80 7A 58 26 D9` + - this repeat instead produced `07 80 7A 50 26 D1` + - sending the page-matched `7A 58 26 D9` frame did not redirect or extend the + branch; the observed `7A 50 26 D1` simply drained out +- So the strongest conclusion is still: + opener choice clearly biases the family/page the selector lands in, but the + downstream family frames still do not behave like obvious prompts the host is + expected to answer. + +Best current read: + +- We are getting better at steering the RCP into specific family spaces. +- We are **not yet** seeing evidence that matching the page family in our reply + is enough to advance to a deterministic next turn. +- That keeps the focus on: + - context opener + - selector + - family chosen + rather than on any confirmed reply ladder after the family appears. + +### HE27: Host State/Value Probing Ladder + +Goal: + +- Test whether the hidden rule lives in the opener `state/value` bytes, the + selector `state/value` bytes, or both. +- Keep the structure disciplined: + 1. vary opener `state/value` with selector fixed + 2. vary selector `state/value` with opener fixed + +This is the first intentionally broad state/value ladder aimed at the +selector-surface model, rather than raw command discovery. + +What would count as a hit: + +- a state/value change shifting the opened family while command bytes stay fixed +- one state/value pair acting like a stronger opener than another +- a selector state/value pair opening a family that the baseline selector does + not +- repeated collapse to the same family regardless of state/value, which would + tell us that the command byte matters more than those fields on that branch + +#### Tier 1: Opener State/Value Sweep With Fixed Selectors + +Use the same selector each time and vary only the opener payload. + +State/value variants: + +- opener baseline: `00 80` +- opener alt 1: `20 D0` +- opener alt 2: `40 30` +- opener alt 3: `60 30` + +Checksums: + +- `90 00 80` -> `00 00 90 00 80 4A` +- `90 20 D0` -> `00 00 90 20 D0 3A` +- `90 40 30` -> `00 00 90 40 30 BA` +- `90 60 30` -> `00 00 90 60 30 9A` +- `AF 00 80` -> `00 00 AF 00 80 75` +- `AF 20 D0` -> `00 00 AF 20 D0 05` +- `AF 40 30` -> `00 00 AF 40 30 85` +- `AF 60 30` -> `00 00 AF 60 30 A5` + +##### HE27a: `90` payload sweep into `E8` + +```powershell +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-0080.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 20 D0 3A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-20d0.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 40 30 BA" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-4030.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 60 30 9A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-6030.txt +``` + +##### HE27b: `90` payload sweep into `EC` + +```powershell +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-0080.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 20 D0 3A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-20d0.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 40 30 BA" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-4030.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 60 30 9A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-6030.txt +``` + +##### HE27c: `AF` payload sweep into `E8` + +```powershell +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 00 80 75" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-0080.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 20 D0 05" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-20d0.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 40 30 85" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-4030.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 60 30 A5" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-6030.txt +``` + +##### HE27d: `AF` payload sweep into `EC` + +```powershell +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 00 80 75" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-0080.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 20 D0 05" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-20d0.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 40 30 85" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-4030.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 60 30 A5" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-6030.txt +``` + +#### Tier 2: Selector State/Value Sweep With Fixed Openers + +Now hold the opener steady and vary only selector `state/value`. + +Selector checksums: + +- `E8 00 80` -> `00 00 E8 00 80 32` +- `E8 20 D0` -> `00 00 E8 20 D0 42` +- `E8 40 30` -> `00 00 E8 40 30 C2` +- `E8 60 30` -> `00 00 E8 60 30 E2` +- `E9 00 80` -> `00 00 E9 00 80 33` +- `E9 20 D0` -> `00 00 E9 20 D0 43` +- `E9 40 30` -> `00 00 E9 40 30 C3` +- `E9 60 30` -> `00 00 E9 60 30 E3` +- `EC 00 80` -> `00 00 EC 00 80 36` +- `EC 20 D0` -> `00 00 EC 20 D0 46` +- `EC 40 30` -> `00 00 EC 40 30 C6` +- `EC 60 30` -> `00 00 EC 60 30 E6` + +##### HE27e: `90` opener with selector payload sweep on `E8` + +```powershell +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 00 80 32" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-0080.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 20 D0 42" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-20d0.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-4030.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 60 30 E2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-6030.txt +``` + +##### HE27f: `90` opener with selector payload sweep on `E9` + +```powershell +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 00 80 33" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-0080.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 20 D0 43" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-20d0.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 40 30 C3" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-4030.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 60 30 E3" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-6030.txt +``` + +##### HE27g: `90` opener with selector payload sweep on `EC` + +```powershell +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 00 80 36" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-0080.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 20 D0 46" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-20d0.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-4030.txt +python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 60 30 E6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-6030.txt +``` + +Recommended order: + +1. `HE27b` (`90` payload sweep into `EC`) +2. `HE27d` (`AF` payload sweep into `EC`) +3. `HE27g` (`90` opener with selector payload sweep on `EC`) +4. `HE27a` (`90` payload sweep into `E8`) +5. `HE27c` (`AF` payload sweep into `E8`) +6. `HE27e` / `HE27f` (`90` opener with selector payload sweep on `E8` / `E9`) + +That keeps the most stateful branch (`EC`) in front while still giving us a +comprehensive way to separate opener payload effects from selector payload +effects. diff --git a/docs/pt2-protocol-summary.md b/docs/pt2-protocol-summary.md index 49f3066..0d03252 100644 --- a/docs/pt2-protocol-summary.md +++ b/docs/pt2-protocol-summary.md @@ -299,6 +299,9 @@ Current caution: `90 -> E8` yielded sibling `07 80 7A 58 26 D9`, `90 -> EC` yielded sibling `07 80 FB 50 26 50`, but the downstream exact echoes still collapsed to heartbeat. +- Even when we answered the actually observed `90`-shifted family directly, the + branch still collapsed to heartbeat instead of advancing to a stable next + stage. ## What We Know diff --git a/docs/pt2-state-map.md b/docs/pt2-state-map.md index 0f55529..e68a7ad 100644 --- a/docs/pt2-state-map.md +++ b/docs/pt2-state-map.md @@ -305,6 +305,8 @@ What is still missing: - a deterministic multi-turn reply ladder - evidence that the downstream family frames are actually prompts the host is expected to answer, rather than readable blocks with no immediate follow-up +- evidence that even page-matched exact echoes are meaningful next-turn host + replies; current tests still collapsed to heartbeat ## What Feels Stable Right Now