This commit is contained in:
Aiden
2026-05-13 20:24:40 +10:00
parent cdb8bf1cb9
commit 0a5fcfd976
5 changed files with 299 additions and 0 deletions

View File

@@ -0,0 +1,35 @@
Sequence probe: 5 frames x 2 group(s) on COM5 at 38400 8N1
FRAME 1: 00 00 90 00 80 4A
FRAME 2: 00 00 E8 40 30 C2
FRAME 3: 07 80 7A 58 26 D9
FRAME 4: 00 00 00 00 80 DA
FRAME 5: 00 00 00 00 80 DA
BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes
BEGIN group 1/2
20:18:25.345 TX group=1 frame=1 len=006 00 00 90 00 80 4A
20:18:25.345 RX group=1 frame=1 no RX bytes
20:18:25.853 TX group=1 frame=2 len=006 00 00 E8 40 30 C2
20:18:25.853 RX group=1 frame=2 ANOMALY 18 RX bytes; first mismatch at byte 6: got 07, heartbeat offset 0 expected 00
20:18:25.853 RX group=1 frame=2 raw 00 00 00 00 80 DA 07 80 7A 50 26 D1 07 80 7A 50 26 D1
20:18:26.361 TX group=1 frame=3 len=006 07 80 7A 58 26 D9
20:18:26.361 RX group=1 frame=3 ANOMALY 12 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 3 expected 00
20:18:26.361 RX group=1 frame=3 raw 07 80 7A 50 26 D1 07 80 7A 50 26 D1
20:18:26.897 TX group=1 frame=4 len=006 00 00 00 00 80 DA
20:18:26.897 RX group=1 frame=4 ANOMALY 18 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 0 expected 00
20:18:26.897 RX group=1 frame=4 raw 07 80 7A 50 26 D1 00 00 00 00 80 DA 00 00 00 00 80 DA
20:18:27.402 TX group=1 frame=5 len=006 00 00 00 00 80 DA
20:18:27.402 RX group=1 frame=5 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
GROUP 1 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
BEGIN group 2/2
20:18:28.556 TX group=2 frame=1 len=006 00 00 90 00 80 4A
20:18:28.556 RX group=2 frame=1 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
20:18:29.061 TX group=2 frame=2 len=006 00 00 E8 40 30 C2
20:18:29.061 RX group=2 frame=2 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
20:18:29.596 TX group=2 frame=3 len=006 07 80 7A 58 26 D9
20:18:29.596 RX group=2 frame=3 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
20:18:30.131 TX group=2 frame=4 len=006 00 00 00 00 80 DA
20:18:30.131 RX group=2 frame=4 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
20:18:30.636 TX group=2 frame=5 len=006 00 00 00 00 80 DA
20:18:30.636 RX group=2 frame=5 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
GROUP 2 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
Anomalies: 3

View File

@@ -0,0 +1,34 @@
Sequence probe: 5 frames x 2 group(s) on COM5 at 38400 8N1
FRAME 1: 00 00 90 00 80 4A
FRAME 2: 00 00 EC 40 30 C6
FRAME 3: 07 80 FB 50 26 50
FRAME 4: 00 00 00 00 80 DA
FRAME 5: 00 00 00 00 80 DA
BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes
BEGIN group 1/2
20:18:45.905 TX group=1 frame=1 len=006 00 00 90 00 80 4A
20:18:45.905 RX group=1 frame=1 heartbeat-compatible RX: 6 bytes, offset 0, 1 frames + 0 bytes
20:18:46.442 TX group=1 frame=2 len=006 00 00 EC 40 30 C6
20:18:46.442 RX group=1 frame=2 ANOMALY 18 RX bytes; first mismatch at byte 6: got 07, heartbeat offset 0 expected 00
20:18:46.442 RX group=1 frame=2 raw 00 00 00 00 80 DA 07 80 FB 50 26 50 07 80 FB 50 26 50
20:18:46.948 TX group=1 frame=3 len=006 07 80 FB 50 26 50
20:18:46.948 RX group=1 frame=3 ANOMALY 18 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 0 expected 00
20:18:46.948 RX group=1 frame=3 raw 07 80 FB 50 26 50 00 00 00 00 80 DA 00 00 00 00 80 DA
20:18:47.485 TX group=1 frame=4 len=006 00 00 00 00 80 DA
20:18:47.485 RX group=1 frame=4 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
20:18:48.022 TX group=1 frame=5 len=006 00 00 00 00 80 DA
20:18:48.022 RX group=1 frame=5 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
GROUP 1 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
BEGIN group 2/2
20:18:49.147 TX group=2 frame=1 len=006 00 00 90 00 80 4A
20:18:49.147 RX group=2 frame=1 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
20:18:49.653 TX group=2 frame=2 len=006 00 00 EC 40 30 C6
20:18:49.653 RX group=2 frame=2 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
20:18:50.191 TX group=2 frame=3 len=006 07 80 FB 50 26 50
20:18:50.191 RX group=2 frame=3 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
20:18:50.697 TX group=2 frame=4 len=006 00 00 00 00 80 DA
20:18:50.697 RX group=2 frame=4 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
20:18:51.203 TX group=2 frame=5 len=006 00 00 00 00 80 DA
20:18:51.203 RX group=2 frame=5 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
GROUP 2 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
Anomalies: 2

View File

@@ -5924,3 +5924,228 @@ Best next move:
- the strongest immediate candidates are: - the strongest immediate candidates are:
- `90 -> E8 -> exact 07 80 7A 58 26 D9` - `90 -> E8 -> exact 07 80 7A 58 26 D9`
- `90 -> EC -> exact 07 80 FB 50 26 50` - `90 -> EC -> exact 07 80 FB 50 26 50`
### HE26: Answer The Actually Observed `90`-Shifted Family
Goal:
- Now that `90` is clearly able to shift the family/page opened by `E8` and
`EC`, answer the *observed* downstream frame rather than the older sibling
family we expected from earlier runs.
Hypothesis:
- If opener choice is selecting a page or family, the correct next probe is the
exact frame from that page, not a nearby family member learned under another
opener.
What would count as a hit:
- any fresh non-heartbeat family after the exact observed-frame echo
- a reproducible second-stage branch that only appears when the echoed frame
matches the opener-selected family
- visible evidence that page-matched echoing behaves differently from
sibling-mismatched echoing
#### HE26a: `90 -> E8 -> exact 7A 58 26`
Under `90`, `E8` produced `07 80 7A 58 26 D9`, so answer that exact frame.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 30 C2" --frame "07 80 7A 58 26 D9" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-context-90-e8-exact-7a5826.txt
```
#### HE26b: `90 -> EC -> exact FB 50 26`
Under `90`, `EC` produced `07 80 FB 50 26 50`, so answer that exact frame.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 30 C6" --frame "07 80 FB 50 26 50" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-context-90-ec-exact-fb5026.txt
```
Recommended order:
1. `HE26b` (`90 -> EC -> exact FB 50 26`)
2. `HE26a` (`90 -> E8 -> exact 7A 58 26`)
`EC` still looks like the more stateful branch, so it has the better chance of
showing whether page-matched echoing matters.
### 2026-05-13 Page-Matched Echo Result
Captures:
- `captures/rcp-context-90-e8-exact-7a5826.txt`
- `captures/rcp-context-90-ec-exact-fb5026.txt`
Observed outcomes:
| Setup | Selector result | Page-matched exact echo result |
| --- | --- | --- |
| `90 -> E8 -> exact 7A 58 26` | actual run produced `07 80 7A 50 26 D1` | sending `07 80 7A 58 26 D9` did not open a new family; the queued `7A 50 26 D1` drained, then heartbeat |
| `90 -> EC -> exact FB 50 26` | `07 80 FB 50 26 50` | sending `07 80 FB 50 26 50` did not open a new family; then heartbeat |
Interpretation:
- Page-matched echoing still did **not** create a stable second-stage exchange.
- For `EC`, this is fairly clean: the observed `FB 50 26` family was echoed
back exactly and the branch still collapsed to heartbeat.
- For `E8`, the run is interesting in a different way:
- the earlier `90 -> E8` test had produced sibling `07 80 7A 58 26 D9`
- this repeat instead produced `07 80 7A 50 26 D1`
- sending the page-matched `7A 58 26 D9` frame did not redirect or extend the
branch; the observed `7A 50 26 D1` simply drained out
- So the strongest conclusion is still:
opener choice clearly biases the family/page the selector lands in, but the
downstream family frames still do not behave like obvious prompts the host is
expected to answer.
Best current read:
- We are getting better at steering the RCP into specific family spaces.
- We are **not yet** seeing evidence that matching the page family in our reply
is enough to advance to a deterministic next turn.
- That keeps the focus on:
- context opener
- selector
- family chosen
rather than on any confirmed reply ladder after the family appears.
### HE27: Host State/Value Probing Ladder
Goal:
- Test whether the hidden rule lives in the opener `state/value` bytes, the
selector `state/value` bytes, or both.
- Keep the structure disciplined:
1. vary opener `state/value` with selector fixed
2. vary selector `state/value` with opener fixed
This is the first intentionally broad state/value ladder aimed at the
selector-surface model, rather than raw command discovery.
What would count as a hit:
- a state/value change shifting the opened family while command bytes stay fixed
- one state/value pair acting like a stronger opener than another
- a selector state/value pair opening a family that the baseline selector does
not
- repeated collapse to the same family regardless of state/value, which would
tell us that the command byte matters more than those fields on that branch
#### Tier 1: Opener State/Value Sweep With Fixed Selectors
Use the same selector each time and vary only the opener payload.
State/value variants:
- opener baseline: `00 80`
- opener alt 1: `20 D0`
- opener alt 2: `40 30`
- opener alt 3: `60 30`
Checksums:
- `90 00 80` -> `00 00 90 00 80 4A`
- `90 20 D0` -> `00 00 90 20 D0 3A`
- `90 40 30` -> `00 00 90 40 30 BA`
- `90 60 30` -> `00 00 90 60 30 9A`
- `AF 00 80` -> `00 00 AF 00 80 75`
- `AF 20 D0` -> `00 00 AF 20 D0 05`
- `AF 40 30` -> `00 00 AF 40 30 85`
- `AF 60 30` -> `00 00 AF 60 30 A5`
##### HE27a: `90` payload sweep into `E8`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 20 D0 3A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 40 30 BA" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 60 30 9A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-e8-6030.txt
```
##### HE27b: `90` payload sweep into `EC`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 20 D0 3A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 40 30 BA" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 60 30 9A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-90-ec-6030.txt
```
##### HE27c: `AF` payload sweep into `E8`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 00 80 75" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 20 D0 05" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 40 30 85" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 60 30 A5" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-e8-6030.txt
```
##### HE27d: `AF` payload sweep into `EC`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 00 80 75" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 20 D0 05" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 40 30 85" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 AF 60 30 A5" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-af-ec-6030.txt
```
#### Tier 2: Selector State/Value Sweep With Fixed Openers
Now hold the opener steady and vary only selector `state/value`.
Selector checksums:
- `E8 00 80` -> `00 00 E8 00 80 32`
- `E8 20 D0` -> `00 00 E8 20 D0 42`
- `E8 40 30` -> `00 00 E8 40 30 C2`
- `E8 60 30` -> `00 00 E8 60 30 E2`
- `E9 00 80` -> `00 00 E9 00 80 33`
- `E9 20 D0` -> `00 00 E9 20 D0 43`
- `E9 40 30` -> `00 00 E9 40 30 C3`
- `E9 60 30` -> `00 00 E9 60 30 E3`
- `EC 00 80` -> `00 00 EC 00 80 36`
- `EC 20 D0` -> `00 00 EC 20 D0 46`
- `EC 40 30` -> `00 00 EC 40 30 C6`
- `EC 60 30` -> `00 00 EC 60 30 E6`
##### HE27e: `90` opener with selector payload sweep on `E8`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 00 80 32" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 20 D0 42" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 30 C2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 60 30 E2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e8-6030.txt
```
##### HE27f: `90` opener with selector payload sweep on `E9`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 00 80 33" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 20 D0 43" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 40 30 C3" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 60 30 E3" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-e9-6030.txt
```
##### HE27g: `90` opener with selector payload sweep on `EC`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 00 80 36" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-0080.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 20 D0 46" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-20d0.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 30 C6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-4030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 60 30 E6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-statevalue-sel-ec-6030.txt
```
Recommended order:
1. `HE27b` (`90` payload sweep into `EC`)
2. `HE27d` (`AF` payload sweep into `EC`)
3. `HE27g` (`90` opener with selector payload sweep on `EC`)
4. `HE27a` (`90` payload sweep into `E8`)
5. `HE27c` (`AF` payload sweep into `E8`)
6. `HE27e` / `HE27f` (`90` opener with selector payload sweep on `E8` / `E9`)
That keeps the most stateful branch (`EC`) in front while still giving us a
comprehensive way to separate opener payload effects from selector payload
effects.

View File

@@ -299,6 +299,9 @@ Current caution:
`90 -> E8` yielded sibling `07 80 7A 58 26 D9`, `90 -> EC` yielded sibling `90 -> E8` yielded sibling `07 80 7A 58 26 D9`, `90 -> EC` yielded sibling
`07 80 FB 50 26 50`, but the downstream exact echoes still collapsed to `07 80 FB 50 26 50`, but the downstream exact echoes still collapsed to
heartbeat. heartbeat.
- Even when we answered the actually observed `90`-shifted family directly, the
branch still collapsed to heartbeat instead of advancing to a stable next
stage.
## What We Know ## What We Know

View File

@@ -305,6 +305,8 @@ What is still missing:
- a deterministic multi-turn reply ladder - a deterministic multi-turn reply ladder
- evidence that the downstream family frames are actually prompts the host is - evidence that the downstream family frames are actually prompts the host is
expected to answer, rather than readable blocks with no immediate follow-up expected to answer, rather than readable blocks with no immediate follow-up
- evidence that even page-matched exact echoes are meaningful next-turn host
replies; current tests still collapsed to heartbeat
## What Feels Stable Right Now ## What Feels Stable Right Now