run 19

docs/pt2-protocol-summary.md

@@ -188,6 +188,37 @@ What does not work:
 - The CALL path is real and useful for probing, but is not currently the
   activation handshake.
 
+## Heartbeat / Cadence Behavior
+
+Plain host heartbeat traffic has turned out to matter, but not in the simple
+"session OK" way we first hoped.
+
+Confirmed behavior:
+
+- Repeating `00 00 00 00 80 DA` can keep the panel out of `CONNECT NOT ACT`
+  while the traffic continues.
+- When that traffic stops, the panel typically falls into `CONNECT NOT ACT`
+  after a short timeout.
+- Once the panel is already in `CONNECT NOT ACT`, resuming heartbeat alone does
+  not immediately make it active again.
+- Keeping heartbeat running does not by itself make one-shot reads like
+  `00 -> A0` or `00 -> B0` reusable.
+
+Heartbeat-only or heartbeat-heavy runs can also provoke transient structured
+responses:
+
+- `07 80 40 40 30 ED`
+- `07 80 40 60 30 CD`
+- `07 80 C0 40 30 6D`
+
+Best current interpretation:
+
+- Some host traffic satisfies a "host present" or link-alive condition.
+- That is still separate from whatever camera/session information makes the
+  panel truly active.
+- The `0x40` / `0xC0` heartbeat-family responses look cadence- or
+  context-sensitive rather than like a generic `ACK`.
+
 ## Known Response Families
 
 These are the response frames that are stable enough to treat as known working
@@ -201,9 +232,13 @@ confirmed Sony definition.
 | `07 80 6D 20 D8 48` | `00 -> B5` | high | readable discovery/status block |
 | `07 80 45 20 D0 68` | synthetic CALL high/low pair | high | CALL event-path response |
 | `07 80 45 30 D0 78` | CALL timing test, seen once | low | sibling CALL-response-family frame |
+| `07 80 50 40 30 FD` | `00 -> 40` | medium-high | explicit readable/query family outside the main B/A/C map |
 | `07 80 40 40 30 ED` | some heartbeat-only cadence runs | medium | transient heartbeat/context response family |
 | `07 80 40 60 30 CD` | some heartbeat-only cadence runs | low-medium | transient heartbeat/context response family |
 | `07 80 C0 40 30 6D` | some heartbeat-only cadence runs | medium | transient heartbeat/context response family |
+| `07 80 E8 40 30 45` | context-sensitive `A0` path in some runs | medium | variant readable/query family, likely selector- or timing-sensitive |
+| `07 80 FA 50 26 51` | host-shaped mirror of `07 80 E8 40 30 45` | low-medium | new structured response family worth focused follow-up |
+| `07 C0 7A 50 A6 11` | exact echo of `07 80 E8 40 30 45` | low | new structured response family worth focused follow-up |
 
 Current caution:
 
@@ -213,6 +248,10 @@ Current caution:
   acknowledgements.
 - The `45` family behaves like an event response, not a generic accept.
 - The `40` / `C0` family currently looks state- or cadence-sensitive.
+- Exact and host-shaped echoes of the `40` / `C0` / `50` heartbeat-adjacent
+  families did not advance the session.
+- The first echo experiments that produced genuinely new structured output were
+  on the `E8` branch, not the `40` / `C0` branch.
 
 ## What We Know
 
@@ -231,6 +270,12 @@ Current caution:
   physical button.
 - The panel can remain visibly at `CONNECT NOT ACT` while still responding in
   protocol-specific ways.
+- Heartbeat maintenance can hold the panel out of `CONNECT NOT ACT`, but that
+  still does not create a fully active session.
+- The heartbeat-induced `0x40` / `0xC0` families are real, but they usually act
+  more like transient state/context responses than like camera-data streaming.
+- The most promising new echo-derived lead is now the `E8` / `FA` / `7A`
+  response branch.
 
 ## What We Do Not Know