run 30

docs/discovery-notes.md

@@ -6149,3 +6149,120 @@ Recommended order:
 That keeps the most stateful branch (`EC`) in front while still giving us a
 comprehensive way to separate opener payload effects from selector payload
 effects.
+
+### 2026-05-13 State/Value Probing Ladder Result
+
+This ladder gave the clearest evidence so far that the `state/value` bytes are
+meaningful and can steer family selection.
+
+#### Tier 1: Opener Payload Sweep
+
+##### `90` opener into `E8`
+
+| Opener payload | Result |
+| --- | --- |
+| `90 00 80` | `07 80 7A 50 26 D1` |
+| `90 20 D0` | `07 80 7A 50 26 D1` |
+| `90 40 30` | `07 80 7A 50 26 D1` |
+| `90 60 30` | `07 80 FA 50 26 51` |
+
+Read:
+
+- `90` opener payload is meaningful on `E8`.
+- `60 30` flips the branch from `7A 50 26` into sibling `FA 50 26`.
+
+##### `90` opener into `EC`
+
+| Opener payload | Result |
+| --- | --- |
+| `90 00 80` | `07 80 7B 58 26 D8` |
+| `90 20 D0` | `07 80 FB 50 26 50` |
+| `90 40 30` | `07 80 7B 50 26 D0` |
+| `90 60 30` | `07 80 7B 50 26 D0` |
+
+Read:
+
+- `90` opener payload clearly changes which sibling family/page `EC` opens.
+- `00 80` gives a shifted `7B 58 26` variant.
+- `20 D0` flips to `FB 50 26`.
+- `40 30` and `60 30` both land on `7B 50 26`.
+
+##### `AF` opener into `E8`
+
+| Opener payload | Result |
+| --- | --- |
+| `AF 00 80` | `07 80 7A 50 26 D1` |
+| `AF 20 D0` | `07 80 C0 40 30 6D` |
+| `AF 40 30` | `07 80 7A 50 26 D1` |
+| `AF 60 30` | `07 80 40 40 30 ED` |
+
+Read:
+
+- `AF` opener payload can either preserve the `E8 -> 7A` branch or collapse it
+  back into heartbeat-family transients.
+- `20 D0` and `60 30` appear hostile or misdirecting on this branch.
+
+##### `AF` opener into `EC`
+
+| Opener payload | Result |
+| --- | --- |
+| `AF 00 80` | `07 80 FB 50 26 50` |
+| `AF 20 D0` | later heartbeat-family `07 80 40 40 30 ED` |
+| `AF 40 30` | later heartbeat-family `07 80 40 40 30 ED` |
+| `AF 60 30` | later heartbeat-family `07 80 40 40 30 ED` |
+
+Read:
+
+- `AF` opener payload is even more selective on `EC`.
+- Only the baseline `00 80` payload opened a structured family.
+- `20 D0`, `40 30`, and `60 30` all collapsed into heartbeat-family behavior.
+
+#### Tier 2: Selector Payload Sweep Under Fixed `90 00 80`
+
+##### `E8` selector payload
+
+| Selector payload | Result |
+| --- | --- |
+| `E8 00 80` | `07 80 7A 40 30 D7` |
+| `E8 20 D0` | `07 80 7A 48 3A D5` |
+| `E8 40 30` | `07 80 7A 50 26 D1` |
+| `E8 60 30` | `07 80 7A 58 26 D9` |
+
+##### `E9` selector payload
+
+| Selector payload | Result |
+| --- | --- |
+| `E9 00 80` | `07 80 7A 20 D8 5F` |
+| `E9 20 D0` | `07 80 7A 24 FD 7E` |
+| `E9 40 30` | `07 80 7A 28 D3 5C` |
+| `E9 60 30` | `07 80 7A 2C D3 58` |
+
+##### `EC` selector payload
+
+| Selector payload | Result |
+| --- | --- |
+| `EC 00 80` | `07 80 FB 40 30 56` |
+| `EC 20 D0` | `07 80 E4 40 30 49` |
+| `EC 40 30` | `07 80 FB 50 26 50` |
+| `EC 60 30` | `07 80 7B 58 26 D8` |
+
+Interpretation:
+
+- Selector `state/value` bytes are strongly meaningful.
+- On `E8` and `E9`, the response family byte stayed at `7A`, while the
+  following bytes changed systematically with selector payload.
+- On `EC`, selector payload changes were even stronger:
+  the family itself shifted among `FB`, `E4`, and `7B`.
+- This is the best current evidence that:
+  - command byte picks a broad selector region
+  - `state/value` bytes pick a page, subtype, or data class within that region
+
+Best current model after HE27:
+
+- opener command matters
+- opener payload matters
+- selector command matters
+- selector payload matters
+- the protocol surface is more parameterized than we first thought
+- but we still do not have a stable proof that the downstream family frames are
+  host prompts rather than readable response blocks