run 15

docs/discovery-notes.md

@@ -3543,3 +3543,69 @@ Interpretation:
   like a CALL lamp/tally command.
 - The CALL `0x45` family remains useful as a probe point, but the lamp control
   is probably elsewhere in the protocol or needs more session context.
+
+### 2026-05-13 Outside-Region Clean Confirmation Result
+
+Captures:
+
+- `captures/rcp-outside-confirm-00-40-4f-8f-ef.txt`
+- `captures/rcp-outside-repeat-00-40.txt`
+- `captures/rcp-outside-repeat-00-4f.txt`
+- `captures/rcp-outside-repeat-00-8f.txt`
+- `captures/rcp-outside-repeat-00-ef.txt`
+- `captures/rcp-outside-single-40.txt`
+- `captures/rcp-outside-single-4f.txt`
+- `captures/rcp-outside-single-8f.txt`
+- `captures/rcp-outside-single-ef.txt`
+
+Goal:
+
+- Clean-confirm whether the paused direct-sweep outliers `0x40`, `0x4F`,
+  `0x8F`, and `0xEF` are real primer-dependent queries outside the mapped
+  `A/B/C` table.
+- Check whether they also work as single first-frame commands after boot.
+
+Primer-pair result:
+
+```text
+primer:    00 00 00 00 80 DA
+candidate: 00 00 CMD 00 80 CHECKSUM
+```
+
+Observed responses:
+
+| Pair | Multi-candidate confirm run | Single-candidate repeat | Current read |
+| --- | --- | --- | --- |
+| `00 -> 40` | heartbeat only in the 4-candidate pass | `07 80 50 40 30 FD` repeated | confirmed real, but missed once in the shared sweep |
+| `00 -> 4F` | `07 80 0A 04 AB 78` | `07 80 0A 04 6B B8` repeated | confirmed real, response bytes vary across runs |
+| `00 -> 8F` | `07 80 0C 04 AB 7E` repeated | `07 80 0C 04 AB 7E` once, then heartbeat | confirmed real and stable in content |
+| `00 -> EF` | `07 80 0F 04 AB 7D` repeated | `07 80 0F 04 AB 7D` repeated | confirmed real; differs from earlier paused-sweep `07 80 0F 04 EB 3D` |
+
+Single-frame control result:
+
+All of these stayed heartbeat-compatible when sent as the first host frame
+after boot, with no anomalies recorded:
+
+- `00 00 40 00 80 9A`
+- `00 00 4F 00 80 95`
+- `00 00 8F 00 80 55`
+- `00 00 EF 00 80 35`
+
+Interpretation:
+
+- `0x40`, `0x4F`, `0x8F`, and `0xEF` are now confirmed as real
+  primer-dependent readable/query responses outside the clean `A/B/C` map.
+- None of the four behave like direct first-frame activation/session commands.
+  They sit much closer to the broader query/status surface than to an
+  unlatching handshake.
+- `0x40` appears slightly context- or timing-sensitive because it missed in the
+  shared 4-candidate pass but reproduced cleanly when isolated.
+- `0x4F` and `0xEF` need extra caution: the response family is real, but the
+  value bytes are not yet fully nailed down across all captures.
+  - `0x4F` has been seen as both `07 80 0A 04 AB 78` and
+    `07 80 0A 04 6B B8`.
+  - `0xEF` has been seen as both `07 80 0F 04 AB 7D` and the earlier paused
+    direct-sweep `07 80 0F 04 EB 3D`.
+- Best current model: these are legitimate outer-table queries whose returned
+  payload can still depend on selector context, prior sequence, or exactly when
+  in the panel's internal state machine they are sampled.

docs/pt2-protocol-summary.md

@@ -196,7 +196,11 @@ What does not work:
 - The RCP sends heartbeat continuously when not active.
 - The RCP can parse host traffic and produce structured, checksum-valid
   responses.
-- The B/A/C command regions expose one-shot readable response blocks.
+- The B/A/C command regions expose the cleanest currently mapped one-shot
+  readable response blocks.
+- Commands outside B/A/C have also been tested; most were heartbeat-only,
+  `CONNECT NOT ACT` parser-visible, CALL-path related, or context-sensitive
+  rather than part of the stable mapped response table.
 - The CALL event path can be synthesized by the host without pressing the
   physical button.
 - The panel can remain visibly at `CONNECT NOT ACT` while still responding in