run 21

docs/discovery-notes.md

@@ -5001,3 +5001,68 @@ Best current model of this branch:
   not produce a second-stage exchange.
 - The next useful probe should probably target `07 80 7A 50 26 D1` directly, or
   compare exact-vs-host handling of `7A` rather than `FA`.
+
+### HE10: Exact Echo Of `07 80 7A 50 26 D1`
+
+Recreate the host-shaped `E8` path that now reproducibly yields
+`07 80 7A 50 26 D1`, then immediately send that exact `7A` frame back.
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 A0 00 80 7A" --frame "00 00 E8 40 30 C2" --frame "07 80 7A 50 26 D1" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-heartbeat-echo-exact-7a5026d1.txt
+```
+
+### HE11: Host-Shaped Mirror Of `07 80 7A 50 26 D1`
+
+Host-shaped checksum for `00 00 7A 50 26 ??` is `56`.
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 A0 00 80 7A" --frame "00 00 E8 40 30 C2" --frame "00 00 7A 50 26 56" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-heartbeat-echo-host-7a5026.txt
+```
+
+What would count as a hit:
+
+- any new non-heartbeat response after the `7A` echo or mirror
+- a stable second-stage family after `07 80 7A 50 26 D1`
+- recurrence of `FA`, `7A`, or another new `50`-region family
+- any visible panel behavior change beyond the usual `CONNECT NOT ACT`
+
+### 2026-05-13 `7A` Echo Follow-Up Result
+
+Captures:
+
+- `captures/rcp-heartbeat-echo-exact-7a5026d1.txt`
+- `captures/rcp-heartbeat-echo-host-7a5026.txt`
+
+Result summary:
+
+- Both runs again point to the host-shaped `E8` step as the meaningful branch
+  trigger.
+- In group 1, `00 00 E8 40 30 C2` reproduced `07 80 7A 50 26 D1` in both tests.
+- The exact-echo run was the cleanest:
+  - `00 00 E8 40 30 C2` produced one `07 80 7A 50 26 D1`
+  - exact echo `07 80 7A 50 26 D1` produced only heartbeat afterwards
+- The host-shaped mirror run behaved like the earlier `FA` tests:
+  - `00 00 E8 40 30 C2` produced `07 80 7A 50 26 D1` twice
+  - host-shaped `00 00 7A 50 26 56` then only drained one more
+    `07 80 7A 50 26 D1` followed by heartbeat
+- In group 2, both tests were heartbeat-only after the same sequence.
+
+Interpretation:
+
+- `07 80 7A 50 26 D1` is now a confirmed reproducible response family on the
+  host-shaped `E8` branch.
+- But directly echoing `7A`, whether exact or host-shaped, still did not create
+  a second-stage exchange, visible state change, or reusable session behavior.
+- This makes `7A` look more like another readable/event family emitted by the
+  branch, not yet like the next host command the panel expects.
+- The asymmetry is useful:
+  - host-shaped `E8` can provoke `7A`
+  - `7A` itself does not obviously provoke anything back
+
+Best current model of the `E8` branch:
+
+- `00 00 E8 40 30 C2` is the active stimulus.
+- `07 80 7A 50 26 D1` is the most reproducible downstream response in that
+  branch.
+- `07 80 FA 50 26 51` and `07 C0 7A 50 A6 11` remain side-family observations,
+  but neither has overtaken `7A` as the strongest lead.

docs/pt2-protocol-summary.md

@@ -239,7 +239,7 @@ confirmed Sony definition.
 | `07 80 E8 40 30 45` | context-sensitive `A0` path in some runs | medium | variant readable/query family, likely selector- or timing-sensitive |
 | `07 80 FA 50 26 51` | host-shaped mirror of `07 80 E8 40 30 45`, seen once | low-medium | new structured response family on the `E8` branch; follow-up echo did not advance state |
 | `07 C0 7A 50 A6 11` | exact echo of `07 80 E8 40 30 45`, seen once | low | new structured response family on the `E8` branch; not yet repeated |
-| `07 80 7A 50 26 D1` | host-shaped `E8` branch in HE8/HE9 group 1 | medium | reproducible sibling response family in the `E8` / `FA` / `7A` branch |
+| `07 80 7A 50 26 D1` | host-shaped `E8` branch, reproduced across HE8-HE11 group 1 | medium-high | reproducible downstream response family in the `E8` / `FA` / `7A` branch |
 
 Current caution:
 
@@ -257,6 +257,9 @@ Current caution:
   clean second-stage response; both follow-up tests instead repeated the
   `07 80 7A 50 26 D1` branch after the host-shaped `E8` step and then went
   back to heartbeat.
+- Directly echoing or host-mirroring `07 80 7A 50 26 D1` also did not advance
+  the exchange; the active trigger still appears to be the host-shaped
+  `00 00 E8 40 30 C2` step.
 
 ## What We Know