aiden/Sony-rcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

run 33

Browse Source
This commit is contained in:
Aiden
2026-05-13 21:20:26 +10:00
parent 6c2d13156b
commit 3e7b8ac50d
14 changed files with 663 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

312
docs/discovery-notes.md
View File

@@ -6755,3 +6755,315 @@ Best current read after HE29:
host-stimulated response families (`2F 95 C9` and `D0 50 26`) and test
whether they represent a deeper camera/base-status layer rather than just more
one-shot siblings.
### HE30: Targeted Follow-Up On `2F 95 C9` And `D0 50 26`
Goal:
- Treat the two new HE29 host-stimulated families as real protocol leads:
- `07 80 2F 95 C9 AE`
- `07 80 D0 50 26 7B`
- Work out whether they are:
- simple one-shot siblings
- a deeper base-status layer
- or part of a real next-turn exchange that we have not answered correctly yet
Strategy:
1. Reproduce each family cleanly and answer **that exact observed family**
2. Try the host-shaped mirror of the observed family
3. Compare the new `2F 95 C9` branch to the older `2F 95 09` branch
4. Probe nearby host-side trigger siblings to see whether the branch is narrow
or family-wide
5. Test whether the new family itself works cold after boot, or only as a
response branch
Checksums:
- host `2F 95 C9` -> `00 00 2F 95 C9 29`
- host `D0 50 26` -> `00 00 D0 50 26 FC`
- older host `2F 95 09` -> `00 00 2F 95 09 E9`
- host `7A 58 26` -> `00 00 7A 58 26 5E`
- host `7A 50 3A` -> `00 00 7A 50 3A 4A`
- host `40 60 30` -> `00 00 40 60 30 4A`
#### HE30a: Exact and host-shaped answers to `07 80 2F 95 C9 AE`
Hypothesis:
- If `2F 95 C9` is a real second-stage family, answering the exact observed
frame or its host-shaped mirror may produce a cleaner third step than the old
`2F 95 09` branch did.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 00 00 80 DA" --frame "00 00 7A 50 26 56" --frame "07 80 2F 95 C9 AE" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-exact-2f95c9.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 00 00 80 DA" --frame "00 00 7A 50 26 56" --frame "00 00 2F 95 C9 29" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-host-2f95c9.txt
```
#### HE30b: Compare new `2F 95 C9` with old `2F 95 09`
Hypothesis:
- The new `2F` branch may be a close sibling of the older `07 C0 2F 95 09 2E`
branch from `EC -> 7B`.
- If so, sending the older host-shaped `2F 95 09` after provoking the new
`2F 95 C9` branch may reveal whether the last data byte is page/subtype rather
than a completely separate family.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 00 00 80 DA" --frame "00 00 7A 50 26 56" --frame "00 00 2F 95 09 E9" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-host-2f9509-after-2f95c9.txt
```
#### HE30c: Exact and host-shaped answers to `07 80 D0 50 26 7B`
Hypothesis:
- If `D0 50 26` is a deeper base-status family, it may respond differently to
exact and host-shaped answers than the selector-space `7A/7B/FB` families do.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 00 00 80 DA" --frame "00 00 40 40 30 6A" --frame "07 80 D0 50 26 7B" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-exact-d05026.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 00 00 80 DA" --frame "00 00 40 40 30 6A" --frame "00 00 D0 50 26 FC" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-host-d05026.txt
```
#### HE30d: Trigger-sibling probes around the `2F 95 C9` branch
Hypothesis:
- The new `2F 95 C9` branch may not belong only to host `7A 50 26`.
- Nearby host-side `7A` siblings might land on related `2F` pages if this is a
small camera-data family rather than a single magic value.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 00 00 80 DA" --frame "00 00 7A 58 26 5E" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-trigger-7a5826.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 00 00 80 DA" --frame "00 00 7A 50 3A 4A" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-trigger-7a503a.txt
```
#### HE30e: Trigger-sibling probes around the `D0 50 26` branch
Hypothesis:
- If `D0 50 26` is tied to a broader base-status surface, nearby host-side
`40/50/C0` style pages may land on related families.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 00 00 80 DA" --frame "00 00 50 40 30 7A" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-trigger-504030.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 00 00 80 DA" --frame "00 00 40 60 30 4A" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-trigger-406030.txt
```
#### HE30f: Cold-start direct tests of the new host-shaped families
Hypothesis:
- If these families are really camera/base-status feed pages, they may work
directly after boot without needing the earlier provoking host frame.
- If they do **not**, they are more likely to be second-stage response branches.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 2F 95 C9 29" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-cold-2f95c9.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --prompt-screen --pre-read 1.0 --frame "00 00 D0 50 26 FC" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-he30-cold-d05026.txt
```
Recommended order:
1. `HE30a` exact/host `2F 95 C9`
2. `HE30c` exact/host `D0 50 26`
3. `HE30f` cold-start direct tests
4. `HE30b` old-vs-new `2F` comparison
5. `HE30d` and `HE30e` trigger-sibling probes
Reasoning:
- First check whether the new families themselves can be answered meaningfully.
- Then check whether they are direct-feed candidates or only response branches.
- Only after that spend time mapping nearby siblings.
### 2026-05-13 HE30 Results
This ladder did not produce a stable multi-turn exchange, but it did reveal a
stronger family structure around both new HE29 branches.
#### HE30a: Answering `07 80 2F 95 C9 AE`
Logs:
- `captures/rcp-he30-exact-2f95c9.txt`
- `captures/rcp-he30-host-2f95c9.txt`
Result:
- Group 1, host `00 00 7A 50 26 56` again produced:
- `07 80 2F 95 C9 AE`
- Answering that with either:
- exact `07 80 2F 95 C9 AE`
- or host `00 00 2F 95 C9 29`
produced no new stage.
- Group 2 was heartbeat-only in both runs.
Read:
- `2F 95 C9` is real and reproducible as a one-shot branch under the `7A 50 26`
host feed.
- But it still does **not** behave like an immediate prompt that the host can
simply echo back.
#### HE30b: Comparing new `2F 95 C9` to old `2F 95 09`
Log:
- `captures/rcp-he30-host-2f9509-after-2f95c9.txt`
Result:
- This run did **not** reproduce the new `2F 95 C9` branch first.
- Instead, the initial host heartbeat itself provoked:
- `07 80 C0 40 30 6D`
- After that, host `00 00 7A 50 26 56` and host `00 00 2F 95 09 E9` stayed
heartbeat-compatible only.
Read:
- This run did not establish a useful direct relationship between `2F 95 C9`
and the older `2F 95 09` branch.
- It does reinforce that these branches are timing/context-sensitive and can be
pre-empted by fallback-family behavior.
#### HE30c: Answering `07 80 D0 50 26 7B`
Logs:
- `captures/rcp-he30-exact-d05026.txt`
- `captures/rcp-he30-host-d05026.txt`
Result:
- The originally observed `07 80 D0 50 26 7B` did **not** reproduce exactly.
- Instead, `00 00 40 40 30 6A` produced sibling families:
- exact-answer run: `07 80 50 78 26 D3`
- host-answer run: `07 80 50 50 26 FB`
- Answering those with either:
- exact `07 80 D0 50 26 7B`
- or host `00 00 D0 50 26 FC`
did not open a new stage.
- Group 2 was heartbeat-only in both runs.
Read:
- The `40`-triggered branch is real, but the stable thing is not a single
fixed `D0` family.
- It looks more like a **parameterized `50 xx 26` sibling strip** that can vary
by context.
#### HE30d: `7A` trigger siblings
Logs:
- `captures/rcp-he30-trigger-7a5826.txt`
- `captures/rcp-he30-trigger-7a503a.txt`
Result:
- `00 00 7A 58 26 5E` produced:
- `07 80 2F 65 F2 65`
- `00 00 7A 50 3A 4A` produced:
- `07 80 2F 95 52 35`
- Both appeared in group 1 only.
- Group 2 was heartbeat-only.
Read:
- This is a strong result.
- The `7A` host-fed branch is not a single magic trigger for one fixed
`2F 95 C9` reply.
- It looks like a **family mapping**:
host-side `7A ...` variants can produce related `2F ...` response variants.
#### HE30e: `40/50` trigger siblings
Logs:
- `captures/rcp-he30-trigger-504030.txt`
- `captures/rcp-he30-trigger-406030.txt`
Result:
- `00 00 50 40 30 7A` produced:
- `07 80 D4 50 26 7F`
- `00 00 40 60 30 4A` produced:
- `07 80 50 58 26 F3`
- Both appeared in group 1 only.
- Group 2 was heartbeat-only.
Read:
- This is the matching strong result on the heartbeat/base-status side.
- The `40/50` host-fed branch also looks like a **family mapping**, not a lone
one-off response.
#### HE30f: Cold-start direct tests
Logs:
- `captures/rcp-he30-cold-2f95c9.txt`
- `captures/rcp-he30-cold-d05026.txt`
Result:
- Cold host `00 00 2F 95 C9 29` did not reproduce the `2F` branch directly.
- Instead, on the second group tail it drifted into:
- `07 80 40 40 30 ED`
- Cold host `00 00 D0 50 26 FC` did not reproduce the `D0`/`50` branch
directly.
- Instead, on the second group tail it drifted into:
- `07 80 C0 40 30 6D`
Read:
- These new families do **not** currently look like valid cold-start camera feed
pages by themselves.
- They look more like second-stage response families or branch-local pages that
require earlier context/stimulus.
### HE30 Overall Read
Most important change in our model:
- We now have good evidence for two additional **parameterized response
surfaces**:
- host `7A ...` -> RCP `2F ...`
- host `40/50 ...` -> RCP `50/D4 ...`
Concrete examples:
- `7A 50 26` -> `2F 95 C9`
- `7A 58 26` -> `2F 65 F2`
- `7A 50 3A` -> `2F 95 52`
- `40 40 30` -> `50 78 26` or `50 50 26`
- `50 40 30` -> `D4 50 26`
- `40 60 30` -> `50 58 26`
What this suggests:
- some host-fed family frames are acting more like **query/page selectors**
within a deeper status space
- and the resulting RCP families are parameterized, not isolated one-offs
What it does **not** yet suggest:
- that we have found the full active-session feed
- that these second-stage families can simply be echoed back to advance the
conversation
- that they are valid cold-start traffic on their own
Best next move after HE30:
- Stay narrow and **dense-map one family at a time**, especially:
- the host `7A ...` -> RCP `2F ...` surface
- the host `40/50 ...` -> RCP `50/D4 ...` surface
- Those now look more promising than continuing to brute-force entirely new
top-level selectors.