run 3

docs/discovery-notes.md

@@ -9626,23 +9626,27 @@ python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --pre
 
 #### HE40b: `0x80-0x9F @ 20 D0`
 
+Had several anomolys without entering CONNECT NOT ACT
 ```powershell
 python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x80-0x9F --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmd80-9f.txt
 ```
 
 #### HE40c: `0xA0-0xBF @ 20 D0`
 
+Did not enter CONNECT NOT ACT until half way through the run
 ```powershell
 python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0xA0-0xBF --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmda0-bf.txt
 ```
 
 #### HE40d: `0xC0-0xDF @ 20 D0`
+Stayed alive for half the run
 
 ```powershell
 python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0xC0-0xDF --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmdc0-df.txt
 ```
 
 #### HE40e: `0xE0-0xFF @ 20 D0`
+Stayed alive for half the run
 
 ```powershell
 python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0xE0-0xFF --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmde0-ff.txt
@@ -9651,19 +9655,19 @@ python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --pre
 #### Phase 2: broaden the `40 30` parallel surface
 
 #### HE40f: `0x40-0x5F @ 40 30`
-
+Stayed alive the whole run
 ```powershell
 python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x40-0x5F --states 0x40 --values 0x30 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-4030-cmd40-5f.txt
 ```
 
 #### HE40g: `0x60-0x7F @ 40 30`
-
+Stayed alive whole run
 ```powershell
 python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x60-0x7F --states 0x40 --values 0x30 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-4030-cmd60-7f.txt
 ```
 
 #### HE40h: `0x00-0x1F @ 40 30`
-
+Stayed alive whole run
 ```powershell
 python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x00-0x1F --states 0x40 --values 0x30 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-4030-cmd00-1f.txt
 ```
@@ -9679,13 +9683,13 @@ Known live slot chosen for prefix probing:
 - `cmd=0x21`, `state/value=20 D0`
 
 #### HE40i: `prefix2=0x00-0x0F` on `cmd=0x21 @ 20 D0`
-
+Stayed alive whole run
 ```powershell
 python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00-0x0F --commands 0x21 --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-prefix2-00-0f-cmd21-20d0.txt
 ```
 
 #### HE40j: `prefix1=0x00-0x0F` on `cmd=0x21 @ 20 D0`
-
+Stayed alive whole run
 ```powershell
 python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00-0x0F --prefix2s 0x00 --commands 0x21 --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-prefix1-00-0f-cmd21-20d0.txt
 ```
@@ -9713,3 +9717,93 @@ Interpretation guide:
   than command and payload pair for the surfaces we have been mapping
 - if one prefix range opens a new aligned family on `cmd=0x21`, that becomes a
   very strong next branch
+
+#### HE40 results
+
+Your bench notes on panel behavior:
+
+- `HE40b` (`0x80-0x9F @ 20 D0`): several anomalies without entering
+  `CONNECT NOT ACT`
+- `HE40c` (`0xA0-0xBF @ 20 D0`): note added in the docs, but no matching
+  capture file was present yet in `captures/`
+- `HE40d` (`0xC0-0xDF @ 20 D0`): panel stayed alive for about half the run
+- `HE40e` (`0xE0-0xFF @ 20 D0`): panel stayed alive for about half the run
+- `HE40f/g/h` (`40 30` command sweeps): panel stayed alive for the whole run
+- `HE40i/j` (prefix sweeps): panel stayed alive for the whole run
+
+Structured results:
+
+#### `0x60-0x7F @ 20 D0`
+
+- `0x61` -> `07 80 58 24 DD 7C`
+- `0x62` and `0x63` then drain more of that same `58 24 DD 7C` family
+- this extends the `20 D0` maintained surface cleanly upward into the `0x60`
+  band
+
+#### `0x80-0x9F @ 20 D0`
+
+- `0x81` -> `07 80 60 24 DD 44`
+- same broad shape as the earlier `48/50/58` families, but now stepping into a
+  new `0x60` family block
+
+#### `0xC0-0xDF @ 20 D0`
+
+- `0xC1` -> `07 80 70 24 DD 54`
+
+#### `0xE0-0xFF @ 20 D0`
+
+- `0xE1` -> `07 80 78 24 DD 5C`
+
+Taken together, the confirmed `20 D0` ladder now includes:
+
+- `0x01` -> `07 80 40 24 DD 64`
+- `0x21` -> `07 80 48 24 DD 6C`
+- `0x41` -> `07 80 50 24 DD 74`
+- `0x61` -> `07 80 58 24 DD 7C`
+- `0x81` -> `07 80 60 24 DD 44`
+- `0xC1` -> `07 80 70 24 DD 54`
+- `0xE1` -> `07 80 78 24 DD 5C`
+
+That is a much stronger pattern than a few isolated hits. It looks like a real
+upper command lattice.
+
+#### `0x00-0x1F @ 40 30`
+
+- `0x01` -> `07 80 40 28 D3 66`
+
+#### `0x40-0x5F @ 40 30`
+
+- `0x41` -> `07 80 50 28 D3 76`
+
+#### `0x60-0x7F @ 40 30`
+
+- `0x61` -> `07 80 58 28 D3 7E`
+
+This confirms the `40 30` surface is a true aligned parallel of the `20 D0`
+surface, not just a one-region curiosity.
+
+#### Prefix completion on `cmd=0x21 @ 20 D0`
+
+The prefix passes did **not** stay flat.
+
+- `HE40i` varying `prefix2`, with `00 01 21 20 D0 8A`, opened:
+  - `07 40 24 12 9D B6`
+- `HE40j` varying `prefix1`, with `01 00 21 20 D0 8A`, opened:
+  - `07 80 48 24 9D 2C`
+
+That makes prefixes more interesting than the earlier simple model assumed.
+They do not yet look like the main thing selecting the broad maintained
+surfaces, but they clearly can perturb a known-live slot into a different
+response family.
+
+Takeaways:
+
+- the upper command space is **not** untouched noise; it continues the same
+  structured lattice far above `0x5F`
+- `20 D0` now looks like a very broad maintained-background class
+- `40 30` mirrors it as a clean parallel surface
+- nonzero prefixes are not dead:
+  - they can open altered variants on a known live command slot
+- the only obvious completion gap from this pass is `HE40c`:
+  - `0xA0-0xBF @ 20 D0` still needs its matching capture if we want the ladder
+    complete