run 30

docs/pt2-protocol-summary.md

@@ -302,6 +302,11 @@ Current caution:
 - Even when we answered the actually observed `90`-shifted family directly, the
   branch still collapsed to heartbeat instead of advancing to a stable next
   stage.
+- A larger state/value ladder strongly suggests the hidden rule lives in those
+  payload bytes too:
+  with fixed command bytes, changing opener or selector `state/value` fields
+  systematically shifted the returned families and payloads, especially on the
+  `E8`, `E9`, and `EC` branches.
 
 ## What We Know
 
@@ -344,6 +349,9 @@ Current caution:
   enough to open it.
 - At the moment, opener bytes look more like family/page selectors than like
   things that enable a stable multi-turn conversation after the first response.
+- The protocol surface now looks parameterized rather than flat:
+  command bytes pick broad regions, and `state/value` bytes appear to choose
+  page, subtype, or class within those regions.
 
 ## What We Do Not Know