Update discovery-notes.md
This commit is contained in:
Aiden
@@ -9597,3 +9597,119 @@ Takeaways:
|
||||
- the mixers did not outperform the simpler repeats
|
||||
- current best read: this is another maintained-background surface, not yet a
|
||||
privileged wake-up band
|
||||
|
||||
### HE40: Completion Sweeps For Untouched Areas
|
||||
|
||||
Goal: do a more systematic "dot the i's and cross the t's" pass over the
|
||||
largest command-space areas we still have not really touched.
|
||||
|
||||
Important mode choice for this ladder:
|
||||
|
||||
- **do not use `--pause-on-anomaly`**
|
||||
- these are coverage runs first
|
||||
- we want them to complete and leave a clean map, even if that means the panel
|
||||
falls out of the semi-awake state partway through
|
||||
|
||||
Primary untouched areas from the current map:
|
||||
|
||||
- `0x60-0xFF @ 20 D0`
|
||||
- most of the command space above the sampled `0x20-0x3F @ 40 30` pass
|
||||
- most nonzero host prefix combinations on a known-live slot
|
||||
|
||||
#### Phase 1: extend the `20 D0` surface through the upper command space
|
||||
|
||||
#### HE40a: `0x60-0x7F @ 20 D0`
|
||||
|
||||
```powershell
|
||||
python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x60-0x7F --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmd60-7f.txt
|
||||
```
|
||||
|
||||
#### HE40b: `0x80-0x9F @ 20 D0`
|
||||
|
||||
```powershell
|
||||
python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x80-0x9F --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmd80-9f.txt
|
||||
```
|
||||
|
||||
#### HE40c: `0xA0-0xBF @ 20 D0`
|
||||
|
||||
```powershell
|
||||
python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0xA0-0xBF --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmda0-bf.txt
|
||||
```
|
||||
|
||||
#### HE40d: `0xC0-0xDF @ 20 D0`
|
||||
|
||||
```powershell
|
||||
python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0xC0-0xDF --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmdc0-df.txt
|
||||
```
|
||||
|
||||
#### HE40e: `0xE0-0xFF @ 20 D0`
|
||||
|
||||
```powershell
|
||||
python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0xE0-0xFF --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-20d0-cmde0-ff.txt
|
||||
```
|
||||
|
||||
#### Phase 2: broaden the `40 30` parallel surface
|
||||
|
||||
#### HE40f: `0x40-0x5F @ 40 30`
|
||||
|
||||
```powershell
|
||||
python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x40-0x5F --states 0x40 --values 0x30 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-4030-cmd40-5f.txt
|
||||
```
|
||||
|
||||
#### HE40g: `0x60-0x7F @ 40 30`
|
||||
|
||||
```powershell
|
||||
python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x60-0x7F --states 0x40 --values 0x30 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-4030-cmd60-7f.txt
|
||||
```
|
||||
|
||||
#### HE40h: `0x00-0x1F @ 40 30`
|
||||
|
||||
```powershell
|
||||
python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00 --commands 0x00-0x1F --states 0x40 --values 0x30 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-direct-4030-cmd00-1f.txt
|
||||
```
|
||||
|
||||
#### Phase 3: small host-prefix completion pass on a known live slot
|
||||
|
||||
These are not full protocol sweeps. They are a practical way to check whether
|
||||
nonzero host prefixes hide another aligned surface on a command we already know
|
||||
is live.
|
||||
|
||||
Known live slot chosen for prefix probing:
|
||||
|
||||
- `cmd=0x21`, `state/value=20 D0`
|
||||
|
||||
#### HE40i: `prefix2=0x00-0x0F` on `cmd=0x21 @ 20 D0`
|
||||
|
||||
```powershell
|
||||
python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00 --prefix2s 0x00-0x0F --commands 0x21 --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-prefix2-00-0f-cmd21-20d0.txt
|
||||
```
|
||||
|
||||
#### HE40j: `prefix1=0x00-0x0F` on `cmd=0x21 @ 20 D0`
|
||||
|
||||
```powershell
|
||||
python scripts/serial_direct_response_sweep.py --port COM5 --prefix1s 0x00-0x0F --prefix2s 0x00 --commands 0x21 --states 0x20 --values 0xD0 --settle 3.0 --after-each 0.8 --after 2.0 --log captures/he40-prefix1-00-0f-cmd21-20d0.txt
|
||||
```
|
||||
|
||||
#### Recommended order
|
||||
|
||||
1. `HE40a` `0x60-0x7F @ 20 D0`
|
||||
2. `HE40g` `0x60-0x7F @ 40 30`
|
||||
3. `HE40b` `0x80-0x9F @ 20 D0`
|
||||
4. `HE40f` `0x40-0x5F @ 40 30`
|
||||
5. `HE40c` `0xA0-0xBF @ 20 D0`
|
||||
6. `HE40d` `0xC0-0xDF @ 20 D0`
|
||||
7. `HE40e` `0xE0-0xFF @ 20 D0`
|
||||
8. `HE40h` `0x00-0x1F @ 40 30`
|
||||
9. `HE40i` prefix2 sweep
|
||||
10. `HE40j` prefix1 sweep
|
||||
|
||||
Interpretation guide:
|
||||
|
||||
- if `20 D0` continues to produce aligned families well past `0x5F`, then the
|
||||
maintained-background surface is much broader than we first thought
|
||||
- if `40 30` mirrors the same bands with a parallel surface, that strengthens
|
||||
the "payload pair selects surface, command selects slot" model
|
||||
- if the prefix sweeps stay flat, then prefixes are probably less important
|
||||
than command and payload pair for the surfaces we have been mapping
|
||||
- if one prefix range opens a new aligned family on `cmd=0x21`, that becomes a
|
||||
very strong next branch
|
||||
|
||||
Reference in New Issue
Block a user