aiden/Sony-rcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

run17

Browse Source
This commit is contained in:
Aiden
2026-05-13 18:45:10 +10:00
parent a33fea718d
commit b9e76911bb
16 changed files with 1898 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

416
docs/discovery-notes.md
View File

@@ -3877,3 +3877,419 @@ Overall interpretation:
- Best current model: the startup exchange probably does involve host-presented
status or selector bits, but the currently tested sequences still land in a
one-shot query regime rather than an active maintained session.
## Negative-Space Test Ladder
Goal:
- Find out what the panel quietly ignores versus what changes its internal
parser/session state.
- Check whether repetitive "host heartbeat" traffic alone changes anything.
- Recheck whether a known readable query needs silence afterward, or whether the
act of repetition itself suppresses later behavior.
- See whether a malformed checksum has any special effect beyond the already
known `CONNECT NOT ACT` parser-visible state.
Recommended observation:
- Power-cycle before each test.
- Note any LCD change, especially whether it remains blank/idle or reaches the
usual `CONNECT NOT ACT`.
- Note any visible LED change, even if the serial log looks ordinary.
### NS1: Assumed Host Heartbeat Only
Send only the current assumed host heartbeat frame repeatedly for a longer
window, with no follow-up query.
```powershell
python scripts/serial_probe_response.py --port COM5 --tx-frame "00 00 00 00 80 DA" --repeat 80 --interval 0.25 --delay 3 --after 3 --frame-size 0 --log captures/rcp-negative-heartbeat-only.txt
```
Read goal:
- If this alone eventually changes visible state, cadence may matter more than
command diversity.
- If it remains heartbeat-only and visually inert, the primer/heartbeat frame is
probably necessary but not sufficient.
### 2026-05-13 NS1 Partial Result
User observation from two power-cycled runs:
- During the entire `NS1` script run, the panel did **not** enter
`CONNECT NOT ACT` / `CONNECTION NOT ACT`.
- About 2 seconds after the repeating heartbeat-only script stopped, the panel
entered `CONNECT NOT ACT`.
- Manually interrupting the script showed the same pattern: while the stream was
active, no `CONNECT NOT ACT`; about 2 seconds after transmission ceased, the
panel entered `CONNECT NOT ACT`.
- Once the panel was already in `CONNECT NOT ACT`, restarting the heartbeat-only
script did not immediately clear that state.
Interpretation:
- Continuous transmission of the assumed host heartbeat appears to hold the
panel out of the `CONNECT NOT ACT` display state.
- The transition into `CONNECT NOT ACT` now looks less like "bad packet was
received" and more like "host traffic stopped and a connection/activity timer
expired."
- That suggests the panel may treat regular host traffic as evidence of a live
link, even when the session is not fully active.
- It also suggests `CONNECT NOT ACT` may be a post-timeout idle/failure state
rather than an immediate parse-error state.
- The fact that restarting the stream does not snap the LCD back out of
`CONNECT NOT ACT` implies the entry condition and exit condition are probably
different. Keeping traffic alive may prevent the state, but leaving the state
may require a separate activation/ack/session step.
Next refinement worth doing:
- Repeat `NS1` with different transmit intervals such as `100 ms`, `500 ms`,
and `1.5 s` to estimate the timeout threshold for preventing
`CONNECT NOT ACT`.
### NS2: Primer Only, Short Burst Groups
Use the sequence probe to send the same primer in repeated groups, with a gap
between groups, to see whether grouped startup chatter matters differently than
an uninterrupted stream.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 00 00 80 DA" --repeat 6 --repeat-interval 1.0 --read-after-frame 0.6 --read-after-group 0.6 --log captures/rcp-negative-primer-groups.txt
```
Read goal:
- If a later group produces anything non-heartbeat, the panel may have a boot
window or cadence threshold.
- If every group is ignored, plain primer repetition is probably dead air from
the panel's point of view.
### NS3: Known Readable Query Once, Then Silence
Send a known readable query once after the canonical primer and then do nothing
else for a longer read window.
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 00 00 80 DA" --frame "00 00 A0 00 80 7A" --read-after-frame 1.2 --read-after-group 5.0 --log captures/rcp-negative-a0-once-then-silence.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 00 00 80 DA" --frame "00 00 B0 00 80 6A" --read-after-frame 1.2 --read-after-group 5.0 --log captures/rcp-negative-b0-once-then-silence.txt
```
Read goal:
- If the panel emits extra delayed frames after the initial block, it may be
expecting a host response or entering a timed wait state.
- If it cleanly returns to heartbeat-only, the one-shot read probably ends the
interaction by itself.
### NS4: Known Readable Query Repeated
Send the same readable query repeatedly after a primer, without power-cycling,
to separate "one-shot per boot" from "suppressed only by mixed traffic."
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 00 00 80 DA" --frame "00 00 A0 00 80 7A" --repeat 5 --repeat-interval 1.0 --read-after-frame 1.0 --read-after-group 0.8 --log captures/rcp-negative-a0-repeat.txt
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 00 00 80 DA" --frame "00 00 B0 00 80 6A" --repeat 5 --repeat-interval 1.0 --read-after-frame 1.0 --read-after-group 0.8 --log captures/rcp-negative-b0-repeat.txt
```
Read goal:
- If only the first group responds, that strengthens the one-shot-per-boot
model.
- If a later group responds again, repeated identical polling may be more valid
than mixed-family polling.
### NS5: Malformed Checksum Once
Send one malformed checksum frame with the same shape as the assumed heartbeat,
then observe whether the panel does anything beyond ordinary heartbeat and the
known parser-visible display state.
```powershell
python scripts/serial_probe_response.py --port COM5 --tx-frame "00 00 00 00 80 00" --repeat 1 --delay 3 --after 8 --frame-size 0 --log captures/rcp-negative-bad-heartbeat-once.txt
python scripts/serial_probe_response.py --port COM5 --tx-frame "00 00 A0 00 80 00" --repeat 1 --delay 3 --after 8 --frame-size 0 --log captures/rcp-negative-bad-a0-once.txt
```
Read goal:
- If malformed frames cause no special serial result beyond heartbeat, checksum
errors are probably tolerated only enough to flip link-visible state.
- If malformed `A0` produces a different visible or serial effect than malformed
heartbeat, the parser may be doing more command-byte inspection before
checksum rejection than expected.
### NS6: Deliberate Silence Control
This is a no-transmit control to compare against all of the above. Just watch RX
with no host traffic.
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 20
```
Read goal:
- Confirm the natural idle pattern and visible state with zero host traffic in
the exact same bench setup.
Recommended order:
1. `NS6` silence control
2. `NS1` heartbeat only
3. `NS3` query once then silence
4. `NS4` repeated same query
5. `NS5` malformed checksum once
6. `NS2` primer groups
### 2026-05-13 Negative-Space Result
Captures:
- `captures/rcp-negative-heartbeat-only.txt`
- `captures/rcp-negative-heartbeat-100ms.txt`
- `captures/rcp-negative-heartbeat-500ms.txt`
- `captures/rcp-negative-heartbeat-1500ms.txt`
- `captures/rcp-negative-primer-groups.txt`
- `captures/rcp-negative-a0-once-then-silence.txt`
- `captures/rcp-negative-b0-once-then-silence.txt`
- `captures/rcp-negative-a0-repeat.txt`
- `captures/rcp-negative-b0-repeat.txt`
- `captures/rcp-negative-bad-heartbeat-once.txt`
- `captures/rcp-negative-bad-a0-once.txt`
#### NS1: Assumed Host Heartbeat Only
Observed serial result:
- The repeated host heartbeat usually left RX at ordinary heartbeat, but some
runs produced a short early structured response burst near the second host
heartbeat:
- `07 80 40 60 30 CD`
- `07 80 40 40 30 ED`
- `07 80 C0 40 30 6D`
- These bursts were transient. After them, the link returned to ordinary
heartbeat RX while the host heartbeat stream continued.
Observed LCD/timing result from user notes:
- `100 ms` interval: `CONNECT NOT ACT` appeared near the end before the script
fully finished.
- `500 ms` interval: `CONNECT NOT ACT` appeared once the script finished.
- `1500 ms` interval: the panel timed out at the very end, just before the
script finished.
- Earlier manual observation also still stands: while the heartbeat stream is
actively running, the panel can remain out of `CONNECT NOT ACT`, then fall
into it roughly 2 seconds after traffic stops.
Read:
- Regular heartbeat traffic clearly affects the panel's visible connection
timeout behavior.
- The panel is not treating `00 00 00 00 80 DA` as a full activation command,
but it does appear to treat it as meaningful host-presence traffic.
- The brief `0x40` / `0xC0` response bursts suggest some heartbeat cadences can
momentarily steer the panel into a different readable state family even
without an explicit query.
#### NS2: Primer Groups
Observed result:
- Repeated single-frame primer groups produced only heartbeat-compatible RX.
- No anomalies were logged.
Read:
- Sparse primer pings alone do not seem to provoke the panel into a readable
state.
- Grouped startup chatter is weaker than a continuous heartbeat stream.
#### NS3: Known Query Once, Then Silence
Observed result:
| Sequence | Immediate response | Tail behavior |
| --- | --- | --- |
| `00 -> A0`, then silence | `07 80 68 40 30 C5` repeated | a short additional `07 80 68 40 30 C5` tail, then heartbeat only |
| `00 -> B0`, then silence | `07 80 6C 40 30 C1` repeated | a short additional `07 80 6C 40 30 C1` tail, then heartbeat only |
Read:
- A successful one-shot readable query continues to drain out a short burst for
a moment even after host transmission stops.
- After that short burst, the panel returns cleanly to ordinary heartbeat-only
behavior.
#### NS4: Known Query Repeated
Observed result:
| Repeated sequence | Result |
| --- | --- |
| `00 -> A0`, repeated 5 times | only group 1 produced `07 80 68 40 30 C5`; groups 2-5 were heartbeat only |
| `00 -> B0`, repeated 5 times | only group 1 produced `07 80 6C 40 30 C1`; groups 2-5 were heartbeat only |
Read:
- Repeating the exact same known-good readable query does **not** make it
reusable.
- This strengthens the one-shot-per-boot model for these query families.
#### NS5: Malformed Checksum Once
Observed result:
- A malformed heartbeat-shaped frame `00 00 00 00 80 00` produced only ordinary
heartbeat RX afterward.
- A malformed `A0`-shaped frame `00 00 A0 00 80 00` also produced only
ordinary heartbeat RX afterward.
Read:
- Malformed frames do not seem to trigger a special serial reaction on their
own.
- Whatever visible `CONNECT NOT ACT` behavior malformed frames may cause on the
LCD, it is not accompanied by a distinctive RX response block in these runs.
Overall interpretation:
- Silence and malformed traffic are serially boring.
- Successful readable queries still behave as one-shot bursts followed by a
return to heartbeat.
- Repeating those same queries still does not reopen them.
- Continuous heartbeat traffic is the one negative-space case that clearly
changes panel behavior:
- it can delay or suppress entry into `CONNECT NOT ACT`
- it can sometimes provoke brief `0x40` / `0xC0` response-family bursts
without any explicit query command
## Heartbeat-Maintained Reuse Test
Goal:
- Check whether keeping a host heartbeat alive between query attempts makes the
one-shot readable blocks reusable without power-cycling.
Working idea:
- Earlier repeat tests used `primer -> query` groups with idle gaps.
- The new negative-space tests suggest steady heartbeat traffic may hold the
panel in a more connection-aware state.
- So the next question is whether interleaving regular heartbeats between query
attempts can reopen `A0` or `B0`.
### HR1: `A0` With Heartbeat Maintenance
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 00 00 80 DA" --frame "00 00 A0 00 80 7A" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 4 --frame-interval 0.25 --read-after-frame 0.35 --read-after-group 0.5 --log captures/rcp-heartbeat-maintained-a0.txt
```
### HR2: `B0` With Heartbeat Maintenance
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 00 00 80 DA" --frame "00 00 B0 00 80 6A" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 4 --frame-interval 0.25 --read-after-frame 0.35 --read-after-group 0.5 --log captures/rcp-heartbeat-maintained-b0.txt
```
### HR3: Denser Heartbeat Maintenance Around `A0`
```powershell
python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --frame "00 00 A0 00 80 7A" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 4 --frame-interval 0.10 --read-after-frame 0.25 --read-after-group 0.5 --log captures/rcp-heartbeat-maintained-a0-dense.txt
```
What to watch for:
- group 1 only responds:
heartbeat maintenance is not enough; the latch still dominates
- later groups respond with the same readable block:
heartbeat maintenance partially reopens the one-shot query path
- later groups do not return `A0`/`B0` but do return `0x40`/`0xC0` blocks:
heartbeat cadence may be moving the panel into a different selector/state
family instead of truly reusing the original query
### 2026-05-13 Heartbeat-Maintained Reuse Result
Captures:
- `captures/rcp-heartbeat-maintained-a0.txt`
- `captures/rcp-heartbeat-maintained-b0.txt`
- `captures/rcp-heartbeat-maintained-a0-dense.txt`
User LCD observation:
- In all three heartbeat-maintained runs, the panel never entered
`CONNECT NOT ACT` / `CONNECTION NOT ACT` while the script was running.
#### HR1: `A0` With Heartbeat Maintenance
Observed result:
- Group 1:
- `A0` produced `07 80 68 40 30 C5`
- the next heartbeat frame drained the tail of that same `A0` burst
- Groups 2-4:
- `A0` produced heartbeat-compatible RX only
- surrounding heartbeat frames also stayed heartbeat-only
Read:
- Keeping heartbeat traffic alive after the first `A0` response did not make
`A0` reusable.
- It did, however, keep the panel in the non-`CONNECT NOT ACT` display state.
#### HR2: `B0` With Heartbeat Maintenance
Observed result:
- Group 1:
- `B0` produced one readable block `07 80 6C 40 30 C1`
- Groups 2-4:
- `B0` produced heartbeat-compatible RX only
- surrounding heartbeat frames stayed heartbeat-only
Read:
- Same outcome as `A0`: heartbeat maintenance did not reopen the one-shot query
path for `B0`.
#### HR3: Denser Heartbeat Maintenance Around `A0`
Observed result:
- Group 1:
- the second heartbeat frame, before `A0`, provoked `07 80 40 40 30 ED`
- the following `A0` frame itself produced only heartbeat-compatible RX
- Groups 2-4:
- no `A0` response
- surrounding heartbeat frames stayed heartbeat-compatible
Read:
- Denser heartbeat traffic can push the panel into the transient `0x40` family
state before the `A0` query arrives.
- In that case, the heartbeat-induced `0x40` response appears to consume the
one-shot response opportunity and suppress the `A0` block.
Overall interpretation:
- Heartbeat maintenance is strong enough to affect the panel's visible
connection state, but not strong enough by itself to make `A0`/`B0`
reusable.
- The latch/one-shot behavior still dominates the readable query families.
- Dense heartbeat traffic can compete with or displace a later explicit query by
provoking a transient `0x40`-family response first.
- Best current model:
- heartbeat cadence helps hold a "live host present" condition
- a separate selector/query opportunity still exists only once per boot or
once per internal state phase
- some heartbeat cadences can spend that opportunity on `0x40`/`0xC0` family
responses instead of `A0`/`B0`
Next branch worth testing:
- intentionally provoke the transient heartbeat-induced `0x40`/`0xC0` family,
then immediately query nearby commands to see whether that state exposes a new
readable page
- or combine heartbeat maintenance with the synthetic CALL path, to test
whether "host present" plus an event-path trigger behaves differently than
"host present" plus a plain table query