aiden/Sony-rcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

run 29

Browse Source
This commit is contained in:
Aiden
2026-05-13 20:24:40 +10:00
parent cdb8bf1cb9
commit 0a5fcfd976
5 changed files with 299 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

225
docs/discovery-notes.md
View File

@@ -5924,3 +5924,228 @@ Best next move:
- the strongest immediate candidates are:
- `90 -> E8 -> exact 07 80 7A 58 26 D9`
- `90 -> EC -> exact 07 80 FB 50 26 50`
### HE26: Answer The Actually Observed `90`-Shifted Family
Goal:
- Now that `90` is clearly able to shift the family/page opened by `E8` and
`EC`, answer the *observed* downstream frame rather than the older sibling
family we expected from earlier runs.
Hypothesis:
- If opener choice is selecting a page or family, the correct next probe is the
exact frame from that page, not a nearby family member learned under another
opener.
What would count as a hit:
- any fresh non-heartbeat family after the exact observed-frame echo
- a reproducible second-stage branch that only appears when the echoed frame
matches the opener-selected family
- visible evidence that page-matched echoing behaves differently from
sibling-mismatched echoing
#### HE26a: `90 -> E8 -> exact 7A 58 26`
Under `90`, `E8` produced `07 80 7A 58 26 D9`, so answer that exact frame.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 30 C2" --frame "07 80 7A 58 26 D9" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-context-90-e8-exact-7a5826.txt
```
#### HE26b: `90 -> EC -> exact FB 50 26`
Under `90`, `EC` produced `07 80 FB 50 26 50`, so answer that exact frame.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 30 C6" --frame "07 80 FB 50 26 50" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-context-90-ec-exact-fb5026.txt
```
Recommended order:
1. `HE26b` (`90 -> EC -> exact FB 50 26`)
2. `HE26a` (`90 -> E8 -> exact 7A 58 26`)
`EC` still looks like the more stateful branch, so it has the better chance of
showing whether page-matched echoing matters.
### 2026-05-13 Page-Matched Echo Result
Captures:
- `captures/rcp-context-90-e8-exact-7a5826.txt`
- `captures/rcp-context-90-ec-exact-fb5026.txt`
Observed outcomes:
| Setup | Selector result | Page-matched exact echo result |
| --- | --- | --- |
| `90 -> E8 -> exact 7A 58 26` | actual run produced `07 80 7A 50 26 D1` | sending `07 80 7A 58 26 D9` did not open a new family; the queued `7A 50 26 D1` drained, then heartbeat |
| `90 -> EC -> exact FB 50 26` | `07 80 FB 50 26 50` | sending `07 80 FB 50 26 50` did not open a new family; then heartbeat |
Interpretation:
- Page-matched echoing still did **not** create a stable second-stage exchange.
- For `EC`, this is fairly clean: the observed `FB 50 26` family was echoed
back exactly and the branch still collapsed to heartbeat.
- For `E8`, the run is interesting in a different way:
- the earlier `90 -> E8` test had produced sibling `07 80 7A 58 26 D9`
- this repeat instead produced `07 80 7A 50 26 D1`
- sending the page-matched `7A 58 26 D9` frame did not redirect or extend the
branch; the observed `7A 50 26 D1` simply drained out
- So the strongest conclusion is still:
opener choice clearly biases the family/page the selector lands in, but the
downstream family frames still do not behave like obvious prompts the host is
expected to answer.
Best current read:
- We are getting better at steering the RCP into specific family spaces.
- We are **not yet** seeing evidence that matching the page family in our reply
is enough to advance to a deterministic next turn.
- That keeps the focus on:
- context opener
- selector
- family chosen
rather than on any confirmed reply ladder after the family appears.
### HE27: Host State/Value Probing Ladder
Goal:
- Test whether the hidden rule lives in the opener `state/value` bytes, the
selector `state/value` bytes, or both.
- Keep the structure disciplined:
1. vary opener `state/value` with selector fixed
2. vary selector `state/value` with opener fixed
This is the first intentionally broad state/value ladder aimed at the
selector-surface model, rather than raw command discovery.
What would count as a hit:
- a state/value change shifting the opened family while command bytes stay fixed
- one state/value pair acting like a stronger opener than another
- a selector state/value pair opening a family that the baseline selector does
not
- repeated collapse to the same family regardless of state/value, which would
tell us that the command byte matters more than those fields on that branch
#### Tier 1: Opener State/Value Sweep With Fixed Selectors
Use the same selector each time and vary only the opener payload.
State/value variants:
- opener baseline: `00 80`
- opener alt 1: `20 D0`
- opener alt 2: `40 30`
- opener alt 3: `60 30`
Checksums:
- `90 00 80` -> `00 00 90 00 80 4A`
- `90 20 D0` -> `00 00 90 20 D0 3A`
- `90 40 30` -> `00 00 90 40 30 BA`
- `90 60 30` -> `00 00 90 60 30 9A`
- `AF 00 80` -> `00 00 AF 00 80 75`
- `AF 20 D0` -> `00 00 AF 20 D0 05`
- `AF 40 30` -> `00 00 AF 40 30 85`
- `AF 60 30` -> `00 00 AF 60 30 A5`
##### HE27a: `90` payload sweep into `E8`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 20 D0 3A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 40 30 BA" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 60 30 9A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-6030.txt
```
##### HE27b: `90` payload sweep into `EC`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 20 D0 3A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 40 30 BA" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 60 30 9A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-6030.txt
```
##### HE27c: `AF` payload sweep into `E8`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 00 80 75" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 20 D0 05" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 40 30 85" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 60 30 A5" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-6030.txt
```
##### HE27d: `AF` payload sweep into `EC`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 00 80 75" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 20 D0 05" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 40 30 85" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 60 30 A5" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-6030.txt
```
#### Tier 2: Selector State/Value Sweep With Fixed Openers
Now hold the opener steady and vary only selector `state/value`.
Selector checksums:
- `E8 00 80` -> `00 00 E8 00 80 32`
- `E8 20 D0` -> `00 00 E8 20 D0 42`
- `E8 40 30` -> `00 00 E8 40 30 C2`
- `E8 60 30` -> `00 00 E8 60 30 E2`
- `E9 00 80` -> `00 00 E9 00 80 33`
- `E9 20 D0` -> `00 00 E9 20 D0 43`
- `E9 40 30` -> `00 00 E9 40 30 C3`
- `E9 60 30` -> `00 00 E9 60 30 E3`
- `EC 00 80` -> `00 00 EC 00 80 36`
- `EC 20 D0` -> `00 00 EC 20 D0 46`
- `EC 40 30` -> `00 00 EC 40 30 C6`
- `EC 60 30` -> `00 00 EC 60 30 E6`
##### HE27e: `90` opener with selector payload sweep on `E8`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 00 80 32" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 20 D0 42" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 60 30 E2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-6030.txt
```
##### HE27f: `90` opener with selector payload sweep on `E9`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 00 80 33" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 20 D0 43" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 40 30 C3" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 60 30 E3" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-6030.txt
```
##### HE27g: `90` opener with selector payload sweep on `EC`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 00 80 36" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 20 D0 46" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 60 30 E6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-6030.txt
```
Recommended order:
1. `HE27b` (`90` payload sweep into `EC`)
2. `HE27d` (`AF` payload sweep into `EC`)
3. `HE27g` (`90` opener with selector payload sweep on `EC`)
4. `HE27a` (`90` payload sweep into `E8`)
5. `HE27c` (`AF` payload sweep into `E8`)
6. `HE27e` / `HE27f` (`90` opener with selector payload sweep on `E8` / `E9`)
That keeps the most stateful branch (`EC`) in front while still giving us a
comprehensive way to separate opener payload effects from selector payload
effects.