run 12

docs/discovery-notes.md

@@ -3196,3 +3196,83 @@ python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt
 If this produces the known `B5` response `07 80 6D 20 D8 48`, then the CALL
 path does not consume the one-shot discovery response. If it returns heartbeat
 only, CALL/`0x45` may put the RCP into a similar one-shot consumed state.
+
+### 2026-05-13 CALL `0x45` Then Discovery Result
+
+Capture:
+
+- `captures/rcp-buttons-call-45-followup-discovery-b5.txt`
+
+Observed sequence:
+
+```text
+RCP CALL high:        00 00 15 80 00 CF
+Host CALL high echo:  00 00 15 80 00 CF
+Host CALL low echo:   00 00 15 00 00 4F
+RCP CALL response:    07 80 45 20 D0 68
+Host primer:          00 00 00 00 80 DA
+Host B5 query:        00 00 B5 00 80 6F
+```
+
+Result:
+
+- After the follow-up `00 -> B5` query, the RCP returned heartbeat-compatible
+  traffic only.
+- The known `B5` response `07 80 6D 20 D8 48` did not appear.
+
+Interpretation:
+
+- The CALL/`0x45` path does not unlock the known discovery query.
+- It may consume or bypass the same cold one-shot discovery window, or the RCP
+  may simply ignore discovery-style queries once the CALL event path has been
+  exercised.
+- This pushes the CALL path into the "useful diagnostic but probably not the
+  activation handshake" bucket.
+
+### Cold No-Button CALL Injection Tests
+
+Question: have we tried sending the CALL response frames without first pressing
+the `CALL` button?
+
+Answer: partially, but not in the exact form that now matters.
+
+- Earlier command `0x15` matrix tests sent individual `0x15` frames from a cold
+  panel and saw `CONNECT NOT ACT`, but no non-heartbeat serial response.
+- The newer reproducible `0x45` result depends on sending the CALL-high and
+  CALL-low frames as a pair with a gap. That exact cold/no-button pair has not
+  been tested yet.
+
+Tooling note:
+
+- `scripts/serial_button_response_test.py` now supports `--startup-frame`. These
+  frames are sent automatically after the listen window begins, without waiting
+  for a physical button event.
+
+Test C1: cold CALL pair, 50 ms gap, no physical button press.
+
+```powershell
+python scripts/serial_button_response_test.py --port COM5 --duration 12 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-cold-call-pair-gap-50ms.txt
+```
+
+Test C2: cold CALL pair, 80 ms gap, no physical button press.
+
+```powershell
+python scripts/serial_button_response_test.py --port COM5 --duration 12 --prompt --startup-delay 1.0 --startup-frame-interval 0.08 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-cold-call-pair-gap-80ms.txt
+```
+
+Test C3: cold CALL high only, no physical button press.
+
+```powershell
+python scripts/serial_button_response_test.py --port COM5 --duration 12 --prompt --startup-delay 1.0 --startup-frame "00 00 15 80 00 CF" --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-cold-call-high-only.txt
+```
+
+Test C4: cold CALL low only, no physical button press.
+
+```powershell
+python scripts/serial_button_response_test.py --port COM5 --duration 12 --prompt --startup-delay 1.0 --startup-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-cold-call-low-only.txt
+```
+
+For each test, power-cycle first and do not press any panel buttons. If C1/C2
+produce `0x45`, the host can synthesize the CALL event path. If they do not,
+the RCP's own physical CALL transition is required before the echo pair has
+meaning.