run 24

docs/discovery-notes.md

@@ -5294,3 +5294,71 @@ Best current follow-up:
 - treat `EC` as the next strong lead and test exact/host-shaped handling of
   `07 80 7B 50 26 D0`
 - optionally try `ED` next to see whether the `7B` branch continues
+
+### HE16: Exact Echo Of `07 80 7B 50 26 D0`
+
+Recreate the `EC` selector path, then immediately send the exact `7B`-family
+response back to the panel.
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 A0 00 80 7A" --frame "00 00 EC 40 30 C6" --frame "07 80 7B 50 26 D0" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-heartbeat-echo-exact-7b5026d0.txt
+```
+
+### HE17: Host-Shaped Mirror Of `07 80 7B 50 26 D0`
+
+Host-shaped checksum for `00 00 7B 50 26 ??` is `57`.
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 A0 00 80 7A" --frame "00 00 EC 40 30 C6" --frame "00 00 7B 50 26 57" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-heartbeat-echo-host-7b5026.txt
+```
+
+What would count as a hit:
+
+- any non-heartbeat response after the exact or host-shaped `7B 50 26` frame
+- a repeat of `07 80 7B 50 26 D0`
+- crossover into the `7A`-family branches or any new sibling family
+- any sign that `EC` is a second-stage exchange rather than just another
+  selector-produced readable response
+
+### 2026-05-13 `EC` Mirror Result
+
+Captures:
+
+- `captures/rcp-heartbeat-echo-exact-7b5026d0.txt`
+- `captures/rcp-heartbeat-echo-host-7b5026.txt`
+
+Result summary:
+
+- `EC` did not behave exactly like the earlier `E8` / `E9` branches.
+- In the host-shaped mirror run:
+  - `00 00 EC 40 30 C6` reproduced `07 80 7B 50 26 D0` in group 1
+  - host-shaped mirror `00 00 7B 50 26 57` did not advance the exchange; it
+    only drained one more `07 80 7B 50 26 D0` and then returned to heartbeat
+- In the exact-echo run:
+  - the `EC` selector step itself did not expose the `7B` family inside the
+    immediate read window
+  - but exact echo `07 80 7B 50 26 D0` produced a fresh new family:
+    `07 C0 2F 95 09 2E`
+  - that new family appeared twice in group 1, then the run returned to
+    heartbeat
+- Group 2 was heartbeat-only in both runs.
+
+Interpretation:
+
+- `EC` is the first `Ex` selector case so far where the exact downstream echo
+  appears to matter more than the host-shaped mirror.
+- That makes the `7B` branch more interesting than the `7A` branches:
+  - `E8` / `E9` downstream `7A` echoes did not produce a clean second-stage
+    family
+  - exact `7B` echo produced `07 C0 2F 95 09 2E`
+- `07 C0 2F 95 09 2E` is now a strong follow-up target. It may be:
+  - a second-stage response
+  - a different page/family reached through exact `7B` echo
+  - or a context-specific branch member that only appears on the exact-echo
+    path
+
+Best current follow-up:
+
+- test exact and host-shaped handling of `07 C0 2F 95 09 2E`
+- optionally compare whether exact `EC -> 7B` echo is timing-sensitive, since
+  the host-shaped mirror path did not reach the same family