diff --git a/captures/rcp-outside-confirm-00-40-4f-8f-ef.txt b/captures/rcp-outside-confirm-00-40-4f-8f-ef.txt new file mode 100644 index 0000000..1aea827 --- /dev/null +++ b/captures/rcp-outside-confirm-00-40-4f-8f-ef.txt @@ -0,0 +1,25 @@ +Primer/candidate sweep: primer 00 00 00 00 80 DA, 4 candidates on COM5 at 38400 8N1 +CANDIDATE 0x40 BASELINE heartbeat-compatible RX: 30 bytes, offset 0, 5 frames + 0 bytes +17:29:04.719 TX primer frame 006 00 00 00 00 80 DA +17:29:05.328 TX candidate 0x40 frame 006 00 00 40 00 80 9A +17:29:05.328 CANDIDATE 0x40 heartbeat-compatible RX: 36 bytes, offset 0, 6 frames + 0 bytes +Completed candidate 1/4 +CANDIDATE 0x4F BASELINE heartbeat-compatible RX: 30 bytes, offset 0, 5 frames + 0 bytes +17:29:23.089 TX primer frame 006 00 00 00 00 80 DA +17:29:23.700 TX candidate 0x4F frame 006 00 00 4F 00 80 95 +17:29:23.700 CANDIDATE 0x4F ANOMALY 30 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 0 expected 00 +17:29:23.700 CANDIDATE 0x4F raw 07 80 0A 04 AB 78 00 00 00 00 80 DA 00 00 00 00 80 DA 00 00 00 00 80 DA 00 00 00 00 80 DA +Completed candidate 2/4 +CANDIDATE 0x8F BASELINE heartbeat-compatible RX: 30 bytes, offset 0, 5 frames + 0 bytes +17:29:37.161 TX primer frame 006 00 00 00 00 80 DA +17:29:37.771 TX candidate 0x8F frame 006 00 00 8F 00 80 55 +17:29:37.771 CANDIDATE 0x8F ANOMALY 42 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 3 expected 00 +17:29:37.771 CANDIDATE 0x8F raw 07 80 0C 04 AB 7E 07 80 0C 04 AB 7E 07 80 0C 04 AB 7E 07 80 0C 04 AB 7E 07 80 0C 04 AB 7E 07 80 0C 04 AB 7E 07 80 0C 04 AB 7E +Completed candidate 3/4 +CANDIDATE 0xEF BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +17:29:50.128 TX primer frame 006 00 00 00 00 80 DA +17:29:50.739 TX candidate 0xEF frame 006 00 00 EF 00 80 35 +17:29:50.739 CANDIDATE 0xEF ANOMALY 42 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 3 expected 00 +17:29:50.739 CANDIDATE 0xEF raw 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D +Completed candidate 4/4 +Anomalies: 3 diff --git a/captures/rcp-outside-repeat-00-40.txt b/captures/rcp-outside-repeat-00-40.txt new file mode 100644 index 0000000..58b9d41 --- /dev/null +++ b/captures/rcp-outside-repeat-00-40.txt @@ -0,0 +1,8 @@ +Primer/candidate sweep: primer 00 00 00 00 80 DA, 1 candidates on COM5 at 38400 8N1 +CANDIDATE 0x40 BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +17:30:37.587 TX primer frame 006 00 00 00 00 80 DA +17:30:38.198 TX candidate 0x40 frame 006 00 00 40 00 80 9A +17:30:38.198 CANDIDATE 0x40 ANOMALY 42 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 3 expected 00 +17:30:38.198 CANDIDATE 0x40 raw 07 80 50 40 30 FD 07 80 50 40 30 FD 07 80 50 40 30 FD 07 80 50 40 30 FD 07 80 50 40 30 FD 07 80 50 40 30 FD 07 80 50 40 30 FD +Completed candidate 1/1 +Anomalies: 1 diff --git a/captures/rcp-outside-repeat-00-4f.txt b/captures/rcp-outside-repeat-00-4f.txt new file mode 100644 index 0000000..864c5a4 --- /dev/null +++ b/captures/rcp-outside-repeat-00-4f.txt @@ -0,0 +1,8 @@ +Primer/candidate sweep: primer 00 00 00 00 80 DA, 1 candidates on COM5 at 38400 8N1 +CANDIDATE 0x4F BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +17:31:00.234 TX primer frame 006 00 00 00 00 80 DA +17:31:00.843 TX candidate 0x4F frame 006 00 00 4F 00 80 95 +17:31:00.843 CANDIDATE 0x4F ANOMALY 42 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 3 expected 00 +17:31:00.843 CANDIDATE 0x4F raw 07 80 0A 04 6B B8 07 80 0A 04 6B B8 07 80 0A 04 6B B8 07 80 0A 04 6B B8 07 80 0A 04 6B B8 07 80 0A 04 6B B8 07 80 0A 04 6B B8 +Completed candidate 1/1 +Anomalies: 1 diff --git a/captures/rcp-outside-repeat-00-8f.txt b/captures/rcp-outside-repeat-00-8f.txt new file mode 100644 index 0000000..f9cbff3 --- /dev/null +++ b/captures/rcp-outside-repeat-00-8f.txt @@ -0,0 +1,8 @@ +Primer/candidate sweep: primer 00 00 00 00 80 DA, 1 candidates on COM5 at 38400 8N1 +CANDIDATE 0x8F BASELINE heartbeat-compatible RX: 30 bytes, offset 0, 5 frames + 0 bytes +17:31:14.997 TX primer frame 006 00 00 00 00 80 DA +17:31:15.606 TX candidate 0x8F frame 006 00 00 8F 00 80 55 +17:31:15.606 CANDIDATE 0x8F ANOMALY 30 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 0 expected 00 +17:31:15.606 CANDIDATE 0x8F raw 07 80 0C 04 AB 7E 00 00 00 00 80 DA 00 00 00 00 80 DA 00 00 00 00 80 DA 00 00 00 00 80 DA +Completed candidate 1/1 +Anomalies: 1 diff --git a/captures/rcp-outside-repeat-00-ef.txt b/captures/rcp-outside-repeat-00-ef.txt new file mode 100644 index 0000000..3c2b8a0 --- /dev/null +++ b/captures/rcp-outside-repeat-00-ef.txt @@ -0,0 +1,8 @@ +Primer/candidate sweep: primer 00 00 00 00 80 DA, 1 candidates on COM5 at 38400 8N1 +CANDIDATE 0xEF BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +17:31:32.705 TX primer frame 006 00 00 00 00 80 DA +17:31:33.316 TX candidate 0xEF frame 006 00 00 EF 00 80 35 +17:31:33.316 CANDIDATE 0xEF ANOMALY 42 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 3 expected 00 +17:31:33.316 CANDIDATE 0xEF raw 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D 07 80 0F 04 AB 7D +Completed candidate 1/1 +Anomalies: 1 diff --git a/captures/rcp-outside-single-40.txt b/captures/rcp-outside-single-40.txt new file mode 100644 index 0000000..e2f2d8c --- /dev/null +++ b/captures/rcp-outside-single-40.txt @@ -0,0 +1,5 @@ +Direct response sweep: 1 frames x 1 cycles (1 total) on COM5 at 38400 8N1 +BASELINE heartbeat-compatible RX: 30 bytes, offset 0, 5 frames + 0 bytes +17:31:55.314 TX cycle=1 p1=0x00 p2=0x00 cmd=0x40 state=0x00 value=0x80 frame 006 00 00 40 00 80 9A +FINAL heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +Anomalies: 0 diff --git a/captures/rcp-outside-single-4f.txt b/captures/rcp-outside-single-4f.txt new file mode 100644 index 0000000..231088a --- /dev/null +++ b/captures/rcp-outside-single-4f.txt @@ -0,0 +1,5 @@ +Direct response sweep: 1 frames x 1 cycles (1 total) on COM5 at 38400 8N1 +BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +17:32:13.163 TX cycle=1 p1=0x00 p2=0x00 cmd=0x4F state=0x00 value=0x80 frame 006 00 00 4F 00 80 95 +FINAL heartbeat-compatible RX: 23 bytes, offset 1, 3 frames + 5 bytes +Anomalies: 0 diff --git a/captures/rcp-outside-single-8f.txt b/captures/rcp-outside-single-8f.txt new file mode 100644 index 0000000..971c2e3 --- /dev/null +++ b/captures/rcp-outside-single-8f.txt @@ -0,0 +1,5 @@ +Direct response sweep: 1 frames x 1 cycles (1 total) on COM5 at 38400 8N1 +BASELINE heartbeat-compatible RX: 30 bytes, offset 0, 5 frames + 0 bytes +17:32:29.421 TX cycle=1 p1=0x00 p2=0x00 cmd=0x8F state=0x00 value=0x80 frame 006 00 00 8F 00 80 55 +FINAL heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +Anomalies: 0 diff --git a/captures/rcp-outside-single-ef.txt b/captures/rcp-outside-single-ef.txt new file mode 100644 index 0000000..3642d55 --- /dev/null +++ b/captures/rcp-outside-single-ef.txt @@ -0,0 +1,5 @@ +Direct response sweep: 1 frames x 1 cycles (1 total) on COM5 at 38400 8N1 +BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +17:32:43.238 TX cycle=1 p1=0x00 p2=0x00 cmd=0xEF state=0x00 value=0x80 frame 006 00 00 EF 00 80 35 +FINAL heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes +Anomalies: 0 diff --git a/docs/discovery-notes.md b/docs/discovery-notes.md index 6fdc646..ed8f4a9 100644 --- a/docs/discovery-notes.md +++ b/docs/discovery-notes.md @@ -3543,3 +3543,69 @@ Interpretation: like a CALL lamp/tally command. - The CALL `0x45` family remains useful as a probe point, but the lamp control is probably elsewhere in the protocol or needs more session context. + +### 2026-05-13 Outside-Region Clean Confirmation Result + +Captures: + +- `captures/rcp-outside-confirm-00-40-4f-8f-ef.txt` +- `captures/rcp-outside-repeat-00-40.txt` +- `captures/rcp-outside-repeat-00-4f.txt` +- `captures/rcp-outside-repeat-00-8f.txt` +- `captures/rcp-outside-repeat-00-ef.txt` +- `captures/rcp-outside-single-40.txt` +- `captures/rcp-outside-single-4f.txt` +- `captures/rcp-outside-single-8f.txt` +- `captures/rcp-outside-single-ef.txt` + +Goal: + +- Clean-confirm whether the paused direct-sweep outliers `0x40`, `0x4F`, + `0x8F`, and `0xEF` are real primer-dependent queries outside the mapped + `A/B/C` table. +- Check whether they also work as single first-frame commands after boot. + +Primer-pair result: + +```text +primer: 00 00 00 00 80 DA +candidate: 00 00 CMD 00 80 CHECKSUM +``` + +Observed responses: + +| Pair | Multi-candidate confirm run | Single-candidate repeat | Current read | +| --- | --- | --- | --- | +| `00 -> 40` | heartbeat only in the 4-candidate pass | `07 80 50 40 30 FD` repeated | confirmed real, but missed once in the shared sweep | +| `00 -> 4F` | `07 80 0A 04 AB 78` | `07 80 0A 04 6B B8` repeated | confirmed real, response bytes vary across runs | +| `00 -> 8F` | `07 80 0C 04 AB 7E` repeated | `07 80 0C 04 AB 7E` once, then heartbeat | confirmed real and stable in content | +| `00 -> EF` | `07 80 0F 04 AB 7D` repeated | `07 80 0F 04 AB 7D` repeated | confirmed real; differs from earlier paused-sweep `07 80 0F 04 EB 3D` | + +Single-frame control result: + +All of these stayed heartbeat-compatible when sent as the first host frame +after boot, with no anomalies recorded: + +- `00 00 40 00 80 9A` +- `00 00 4F 00 80 95` +- `00 00 8F 00 80 55` +- `00 00 EF 00 80 35` + +Interpretation: + +- `0x40`, `0x4F`, `0x8F`, and `0xEF` are now confirmed as real + primer-dependent readable/query responses outside the clean `A/B/C` map. +- None of the four behave like direct first-frame activation/session commands. + They sit much closer to the broader query/status surface than to an + unlatching handshake. +- `0x40` appears slightly context- or timing-sensitive because it missed in the + shared 4-candidate pass but reproduced cleanly when isolated. +- `0x4F` and `0xEF` need extra caution: the response family is real, but the + value bytes are not yet fully nailed down across all captures. + - `0x4F` has been seen as both `07 80 0A 04 AB 78` and + `07 80 0A 04 6B B8`. + - `0xEF` has been seen as both `07 80 0F 04 AB 7D` and the earlier paused + direct-sweep `07 80 0F 04 EB 3D`. +- Best current model: these are legitimate outer-table queries whose returned + payload can still depend on selector context, prior sequence, or exactly when + in the panel's internal state machine they are sampled. diff --git a/docs/pt2-protocol-summary.md b/docs/pt2-protocol-summary.md index 605d280..c3f878a 100644 --- a/docs/pt2-protocol-summary.md +++ b/docs/pt2-protocol-summary.md @@ -196,7 +196,11 @@ What does not work: - The RCP sends heartbeat continuously when not active. - The RCP can parse host traffic and produce structured, checksum-valid responses. -- The B/A/C command regions expose one-shot readable response blocks. +- The B/A/C command regions expose the cleanest currently mapped one-shot + readable response blocks. +- Commands outside B/A/C have also been tested; most were heartbeat-only, + `CONNECT NOT ACT` parser-visible, CALL-path related, or context-sensitive + rather than part of the stable mapped response table. - The CALL event path can be synthesized by the host without pressing the physical button. - The panel can remain visibly at `CONNECT NOT ACT` while still responding in