run 8

docs/discovery-notes.md

@@ -2959,3 +2959,78 @@ python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt
 
 For each run, power-cycle first, press and hold `CALL` for about 2 seconds, then
 release after either the watch frame appears or the next heartbeat appears.
+
+### 2026-05-13 CALL Timing-Bracket Result
+
+Captures:
+
+- `captures/rcp-buttons-call-exact-echo-delay-20ms.txt`
+- `captures/rcp-buttons-call-exact-echo-delay-50ms.txt`
+- `captures/rcp-buttons-call-exact-echo-delay-80ms.txt`
+- `captures/rcp-buttons-call-exact-echo-delay-120ms.txt`
+
+User procedure:
+
+- Each run used the same two-frame exact CALL echo pair.
+- Button hold timing was kept as accurate and consistent as possible.
+
+Observed result:
+
+| Delay | Result |
+| --- | --- |
+| 20 ms | heartbeat only; no `0x45` response |
+| 50 ms | heartbeat/CALL traffic only; no `0x45` response |
+| 80 ms | new response `07 80 45 30 D0 78` |
+| 120 ms | heartbeat/CALL traffic only; no `0x45` response |
+
+Comparison of known CALL-response-family frames:
+
+```text
+07 80 45 20 D0 68
+07 80 45 30 D0 78
+```
+
+Both frames are checksum-valid under the current XOR-with-`0x5A` hypothesis.
+They share prefix `07 80`, command/status byte `45`, and value byte `D0`. The
+state/status byte changed from `20` to `30`, with the checksum changing from
+`68` to `78` as expected.
+
+Interpretation:
+
+- The RCP appears to have a CALL-related `0x45` response family.
+- The observed `0x45` response is timing-sensitive but not locked only to the
+  original 50 ms response delay.
+- The `0x20` vs `0x30` byte may represent a CALL/button substate, link/session
+  substate, or timing/window state.
+- This is stronger evidence that the panel is responding meaningfully to host
+  traffic, even though the LCD state still has not been driven active.
+
+Next CALL timing tests should watch both known `0x45` family frames:
+
+```powershell
+python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --respond-to-call --respond-once --response-delay 0.06 --response-frame "00 00 15 80 00 CF" --response-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-call-exact-echo-delay-60ms.txt
+python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --respond-to-call --respond-once --response-delay 0.07 --response-frame "00 00 15 80 00 CF" --response-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-call-exact-echo-delay-70ms.txt
+python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --respond-to-call --respond-once --response-delay 0.08 --response-frame "00 00 15 80 00 CF" --response-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-call-exact-echo-delay-80ms-v2.txt
+python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --respond-to-call --respond-once --response-delay 0.09 --response-frame "00 00 15 80 00 CF" --response-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-call-exact-echo-delay-90ms.txt
+python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --respond-to-call --respond-once --response-delay 0.10 --response-frame "00 00 15 80 00 CF" --response-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-call-exact-echo-delay-100ms.txt
+```
+
+If the `0x45` family repeats in the 60-100 ms window, the next step is to test
+whether the host can answer the RCP's `0x45` response with a checksum-valid
+host-shaped frame using command byte `0x45`.
+
+Tooling note:
+
+- `scripts/serial_button_response_test.py` now supports
+  `--followup-on-watch-frame` with one or more `--followup-frame` values. This
+  lets the host answer a reproduced RCP response immediately in the same run.
+
+Possible follow-up test after reproducing a `0x45` response:
+
+```powershell
+python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --respond-to-call --respond-once --response-delay 0.08 --response-frame "00 00 15 80 00 CF" --response-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --followup-on-watch-frame --followup-frame "00 00 45 00 80 9F" --log captures/rcp-buttons-call-45-followup-host-shaped.txt
+```
+
+This test is deliberately secondary. Run it only after the `0x45` family
+repeats, so any change can be attributed to the follow-up rather than to the
+initial CALL echo timing.