Run 1

docs/discovery-notes.md

@@ -8492,3 +8492,99 @@ So the right next question is:
 - not "does `20 D0` produce any anomalies at all?"
 - but "does `20 D0` represent a more session-like variant of the same broad
   command surface?"
+
+### HE35: Targeted `20 D0` Follow-Up Ladder
+
+Goal: check whether the interesting part of the `20 D0` sweep is specifically
+`cmd=0x01`, whether nearby commands behave similarly, and whether repeating only
+that one frame delays `CONNECT NOT ACT` by itself.
+
+#### HE35a: direct compare `cmd=0x00-0x03` under `20 D0`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x00-0x03 --states 0x20 --values 0xD0 --settle 3.0 --after-each 1.0 --after 2.0 --pause-on-anomaly --log captures/he35-direct-20d0-cmd00-03.txt
+```
+
+What to watch:
+
+- whether `0x01` is still the only anomaly
+- whether `0x00`, `0x02`, or `0x03` produce siblings
+- whether `CONNECT NOT ACT` appears during the short run
+
+#### HE35b: repeat only `cmd=0x01 @ 20 D0`
+
+Target frame:
+
+- `00 00 01 20 D0 AB`
+
+```powershell
+python scripts/serial_probe_response.py --port COM5 --tx-frame "00 00 01 20 D0 AB" --repeat 40 --interval 0.50 --delay 3 --after 3 --frame-size 0 --log captures/he35-repeat-cmd01-20d0.txt
+```
+
+What to watch:
+
+- whether the panel stays out of `CONNECT NOT ACT` while this one frame repeats
+- whether `07 80 40 24 DD 64` appears again
+- whether the response is one-shot only or repeats periodically
+
+#### HE35c: repeat only `cmd=0x01 @ 00 80` baseline control
+
+Target frame:
+
+- `00 00 01 00 80 DB`
+
+```powershell
+python scripts/serial_probe_response.py --port COM5 --tx-frame "00 00 01 00 80 DB" --repeat 40 --interval 0.50 --delay 3 --after 3 --frame-size 0 --log captures/he35-repeat-cmd01-0080-control.txt
+```
+
+Purpose:
+
+- compare the same command byte under the older baseline payload
+- see whether only `20 D0` delays the timeout-like LCD behavior
+
+#### HE35d: slower repeat of `cmd=0x01 @ 20 D0`
+
+```powershell
+python scripts/serial_probe_response.py --port COM5 --tx-frame "00 00 01 20 D0 AB" --repeat 20 --interval 1.50 --delay 3 --after 3 --frame-size 0 --log captures/he35-repeat-cmd01-20d0-slow.txt
+```
+
+Purpose:
+
+- estimate whether the panel cares about this frame's **content**, or whether it
+  only helps when the cadence is dense enough
+
+#### HE35e: neighboring single-frame repeats under `20 D0`
+
+Neighbor frames:
+
+- `00 00 00 20 D0 AA`
+- `00 00 02 20 D0 A8`
+- `00 00 03 20 D0 A9`
+
+```powershell
+python scripts/serial_probe_response.py --port COM5 --tx-frame "00 00 00 20 D0 AA" --repeat 20 --interval 0.50 --delay 3 --after 3 --frame-size 0 --log captures/he35-repeat-cmd00-20d0.txt
+python scripts/serial_probe_response.py --port COM5 --tx-frame "00 00 02 20 D0 A8" --repeat 20 --interval 0.50 --delay 3 --after 3 --frame-size 0 --log captures/he35-repeat-cmd02-20d0.txt
+python scripts/serial_probe_response.py --port COM5 --tx-frame "00 00 03 20 D0 A9" --repeat 20 --interval 0.50 --delay 3 --after 3 --frame-size 0 --log captures/he35-repeat-cmd03-20d0.txt
+```
+
+Purpose:
+
+- test whether the timeout effect belongs to the whole early `20 D0` region
+- or whether `cmd=0x01` is the special case
+
+#### Recommended order
+
+1. `HE35a` direct `0x00-0x03` compare
+2. `HE35b` repeat only `cmd=0x01 @ 20 D0`
+3. `HE35c` baseline `cmd=0x01 @ 00 80` control
+4. `HE35d` slow `cmd=0x01 @ 20 D0`
+5. `HE35e` neighboring repeats
+
+Interpretation guide:
+
+- if only `cmd=0x01 @ 20 D0` delays `CONNECT NOT ACT`, that is our best
+  session-like micro-lead so far
+- if `0x00-0x03 @ 20 D0` all help, then this may be an early-page or
+  low-command-region effect rather than a single magic frame
+- if the same effect also appears at `cmd=0x01 @ 00 80`, then the LCD behavior
+  may be more about traffic density than payload meaning