run 30

docs/discovery-notes.md

@@ -6149,3 +6149,120 @@ Recommended order:
 That keeps the most stateful branch (`EC`) in front while still giving us a
 comprehensive way to separate opener payload effects from selector payload
 effects.
+
+### 2026-05-13 State/Value Probing Ladder Result
+
+This ladder gave the clearest evidence so far that the `state/value` bytes are
+meaningful and can steer family selection.
+
+#### Tier 1: Opener Payload Sweep
+
+##### `90` opener into `E8`
+
+| Opener payload | Result |
+| --- | --- |
+| `90 00 80` | `07 80 7A 50 26 D1` |
+| `90 20 D0` | `07 80 7A 50 26 D1` |
+| `90 40 30` | `07 80 7A 50 26 D1` |
+| `90 60 30` | `07 80 FA 50 26 51` |
+
+Read:
+
+- `90` opener payload is meaningful on `E8`.
+- `60 30` flips the branch from `7A 50 26` into sibling `FA 50 26`.
+
+##### `90` opener into `EC`
+
+| Opener payload | Result |
+| --- | --- |
+| `90 00 80` | `07 80 7B 58 26 D8` |
+| `90 20 D0` | `07 80 FB 50 26 50` |
+| `90 40 30` | `07 80 7B 50 26 D0` |
+| `90 60 30` | `07 80 7B 50 26 D0` |
+
+Read:
+
+- `90` opener payload clearly changes which sibling family/page `EC` opens.
+- `00 80` gives a shifted `7B 58 26` variant.
+- `20 D0` flips to `FB 50 26`.
+- `40 30` and `60 30` both land on `7B 50 26`.
+
+##### `AF` opener into `E8`
+
+| Opener payload | Result |
+| --- | --- |
+| `AF 00 80` | `07 80 7A 50 26 D1` |
+| `AF 20 D0` | `07 80 C0 40 30 6D` |
+| `AF 40 30` | `07 80 7A 50 26 D1` |
+| `AF 60 30` | `07 80 40 40 30 ED` |
+
+Read:
+
+- `AF` opener payload can either preserve the `E8 -> 7A` branch or collapse it
+  back into heartbeat-family transients.
+- `20 D0` and `60 30` appear hostile or misdirecting on this branch.
+
+##### `AF` opener into `EC`
+
+| Opener payload | Result |
+| --- | --- |
+| `AF 00 80` | `07 80 FB 50 26 50` |
+| `AF 20 D0` | later heartbeat-family `07 80 40 40 30 ED` |
+| `AF 40 30` | later heartbeat-family `07 80 40 40 30 ED` |
+| `AF 60 30` | later heartbeat-family `07 80 40 40 30 ED` |
+
+Read:
+
+- `AF` opener payload is even more selective on `EC`.
+- Only the baseline `00 80` payload opened a structured family.
+- `20 D0`, `40 30`, and `60 30` all collapsed into heartbeat-family behavior.
+
+#### Tier 2: Selector Payload Sweep Under Fixed `90 00 80`
+
+##### `E8` selector payload
+
+| Selector payload | Result |
+| --- | --- |
+| `E8 00 80` | `07 80 7A 40 30 D7` |
+| `E8 20 D0` | `07 80 7A 48 3A D5` |
+| `E8 40 30` | `07 80 7A 50 26 D1` |
+| `E8 60 30` | `07 80 7A 58 26 D9` |
+
+##### `E9` selector payload
+
+| Selector payload | Result |
+| --- | --- |
+| `E9 00 80` | `07 80 7A 20 D8 5F` |
+| `E9 20 D0` | `07 80 7A 24 FD 7E` |
+| `E9 40 30` | `07 80 7A 28 D3 5C` |
+| `E9 60 30` | `07 80 7A 2C D3 58` |
+
+##### `EC` selector payload
+
+| Selector payload | Result |
+| --- | --- |
+| `EC 00 80` | `07 80 FB 40 30 56` |
+| `EC 20 D0` | `07 80 E4 40 30 49` |
+| `EC 40 30` | `07 80 FB 50 26 50` |
+| `EC 60 30` | `07 80 7B 58 26 D8` |
+
+Interpretation:
+
+- Selector `state/value` bytes are strongly meaningful.
+- On `E8` and `E9`, the response family byte stayed at `7A`, while the
+  following bytes changed systematically with selector payload.
+- On `EC`, selector payload changes were even stronger:
+  the family itself shifted among `FB`, `E4`, and `7B`.
+- This is the best current evidence that:
+  - command byte picks a broad selector region
+  - `state/value` bytes pick a page, subtype, or data class within that region
+
+Best current model after HE27:
+
+- opener command matters
+- opener payload matters
+- selector command matters
+- selector payload matters
+- the protocol surface is more parameterized than we first thought
+- but we still do not have a stable proof that the downstream family frames are
+  host prompts rather than readable response blocks

docs/pt2-protocol-summary.md

@@ -302,6 +302,11 @@ Current caution:
 - Even when we answered the actually observed `90`-shifted family directly, the
   branch still collapsed to heartbeat instead of advancing to a stable next
   stage.
+- A larger state/value ladder strongly suggests the hidden rule lives in those
+  payload bytes too:
+  with fixed command bytes, changing opener or selector `state/value` fields
+  systematically shifted the returned families and payloads, especially on the
+  `E8`, `E9`, and `EC` branches.
 
 ## What We Know
 
@@ -344,6 +349,9 @@ Current caution:
   enough to open it.
 - At the moment, opener bytes look more like family/page selectors than like
   things that enable a stable multi-turn conversation after the first response.
+- The protocol surface now looks parameterized rather than flat:
+  command bytes pick broad regions, and `state/value` bytes appear to choose
+  page, subtype, or class within those regions.
 
 ## What We Do Not Know
 

docs/pt2-state-map.md

@@ -184,6 +184,39 @@ Current interpretation:
 
 Confidence: medium-high
 
+## Parameterized Selector Behavior
+
+The latest state/value ladder suggests the selector surface is not just
+"command byte picks one response family." It appears parameterized.
+
+Current best read:
+
+- opener command matters
+- opener `state/value` payload matters
+- selector command matters
+- selector `state/value` payload matters
+
+Observed examples:
+
+- `90 + E8`:
+  - `E8 00 80` -> `7A 40 30`
+  - `E8 20 D0` -> `7A 48 3A`
+  - `E8 40 30` -> `7A 50 26`
+  - `E8 60 30` -> `7A 58 26`
+- `90 + E9`:
+  - `E9 00 80` -> `7A 20 D8`
+  - `E9 20 D0` -> `7A 24 FD`
+  - `E9 40 30` -> `7A 28 D3`
+  - `E9 60 30` -> `7A 2C D3`
+- `90 + EC`:
+  - `EC 00 80` -> `FB 40 30`
+  - `EC 20 D0` -> `E4 40 30`
+  - `EC 40 30` -> `FB 50 26`
+  - `EC 60 30` -> `7B 58 26`
+
+That strongly suggests the `state/value` fields are not filler. They likely
+select a page, subtype, class, or data register within the selector space.
+
 ## Downstream Family Branches
 
 ### B1: `E8 -> 7A 50 26`