diff --git a/docs/discovery-notes.md b/docs/discovery-notes.md
index 205f027..00359d5 100644
--- a/docs/discovery-notes.md
+++ b/docs/discovery-notes.md
@@ -9597,3 +9597,119 @@ Takeaways:
 - the mixers did not outperform the simpler repeats
 - current best read: this is another maintained-background surface, not yet a
   privileged wake-up band
+
+### HE40: Completion Sweeps For Untouched Areas
+
+Goal: do a more systematic "dot the i's and cross the t's" pass over the
+largest command-space areas we still have not really touched.
+
+Important mode choice for this ladder:
+
+- **do not use `--pause-on-anomaly`**
+- these are coverage runs first
+- we want them to complete and leave a clean map, even if that means the panel
+  falls out of the semi-awake state partway through
+
+Primary untouched areas from the current map:
+
+- `0x60-0xFF @ 20 D0`
+- most of the command space above the sampled `0x20-0x3F @ 40 30` pass
+- most nonzero host prefix combinations on a known-live slot
+
+#### Phase 1: extend the `20 D0` surface through the upper command space
+
+#### HE40a: `0x60-0x7F @ 20 D0`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x60-0x7F --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmd60-7f.txt
+```
+
+#### HE40b: `0x80-0x9F @ 20 D0`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x80-0x9F --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmd80-9f.txt
+```
+
+#### HE40c: `0xA0-0xBF @ 20 D0`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0xA0-0xBF --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmda0-bf.txt
+```
+
+#### HE40d: `0xC0-0xDF @ 20 D0`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0xC0-0xDF --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmdc0-df.txt
+```
+
+#### HE40e: `0xE0-0xFF @ 20 D0`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0xE0-0xFF --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmde0-ff.txt
+```
+
+#### Phase 2: broaden the `40 30` parallel surface
+
+#### HE40f: `0x40-0x5F @ 40 30`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x40-0x5F --states 0x40 --values 0x30 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-4030-cmd40-5f.txt
+```
+
+#### HE40g: `0x60-0x7F @ 40 30`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x60-0x7F --states 0x40 --values 0x30 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-4030-cmd60-7f.txt
+```
+
+#### HE40h: `0x00-0x1F @ 40 30`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x00-0x1F --states 0x40 --values 0x30 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-4030-cmd00-1f.txt
+```
+
+#### Phase 3: small host-prefix completion pass on a known live slot
+
+These are not full protocol sweeps. They are a practical way to check whether
+nonzero host prefixes hide another aligned surface on a command we already know
+is live.
+
+Known live slot chosen for prefix probing:
+
+- `cmd=0x21`, `state/value=20 D0`
+
+#### HE40i: `prefix2=0x00-0x0F` on `cmd=0x21 @ 20 D0`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00-0x0F --commands 0x21 --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-prefix2-00-0f-cmd21-20d0.txt
+```
+
+#### HE40j: `prefix1=0x00-0x0F` on `cmd=0x21 @ 20 D0`
+
+```powershell
+python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00-0x0F --prefix2s 0x00 --commands 0x21 --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-prefix1-00-0f-cmd21-20d0.txt
+```
+
+#### Recommended order
+
+1. `HE40a` `0x60-0x7F @ 20 D0`
+2. `HE40g` `0x60-0x7F @ 40 30`
+3. `HE40b` `0x80-0x9F @ 20 D0`
+4. `HE40f` `0x40-0x5F @ 40 30`
+5. `HE40c` `0xA0-0xBF @ 20 D0`
+6. `HE40d` `0xC0-0xDF @ 20 D0`
+7. `HE40e` `0xE0-0xFF @ 20 D0`
+8. `HE40h` `0x00-0x1F @ 40 30`
+9. `HE40i` prefix2 sweep
+10. `HE40j` prefix1 sweep
+
+Interpretation guide:
+
+- if `20 D0` continues to produce aligned families well past `0x5F`, then the
+  maintained-background surface is much broader than we first thought
+- if `40 30` mirrors the same bands with a parallel surface, that strengthens
+  the "payload pair selects surface, command selects slot" model
+- if the prefix sweeps stay flat, then prefixes are probably less important
+  than command and payload pair for the surfaces we have been mapping
+- if one prefix range opens a new aligned family on `cmd=0x21`, that becomes a
+  very strong next branch