run 31

2026-05-13 20:53:52 +10:00
parent 20ebe52096
commit c7997d5131
15 changed files with 523 additions and 0 deletions
--- a/docs/discovery-notes.md
+++ b/docs/discovery-notes.md
@@ -6266,3 +6266,143 @@ Best current model after HE27:
 - the protocol surface is more parameterized than we first thought
 - but we still do not have a stable proof that the downstream family frames are
  host prompts rather than readable response blocks
+
+### HE28: Off-Grid Pair Test
+
+Goal:
+
+- Test whether the two payload bytes behave more like an accepted **pair code**
+  than two semantically independent fields.
+
+Idea:
+
+- We already know these combinations are meaningful on several branches:
+  - `00 80`
+  - `20 D0`
+  - `40 30`
+  - `60 30`
+- Now try mixed combinations that were **not** part of the known-good set:
+  - `00 30`
+  - `20 30`
+  - `40 D0`
+  - `60 80`
+
+What would count as a hit:
+
+- mixed pairs behaving just like nearby known-good pairs, which would support
+  more independent byte meanings
+- mixed pairs mostly collapsing to heartbeat/transients or producing odd
+  outliers, which would support the "2-byte code" model
+- one branch accepting mixed pairs while another rejects them, which would mean
+  pairing rules are selector-specific
+
+Checksums:
+
+- `E8 00 30` -> `00 00 E8 00 30 82`
+- `E8 20 30` -> `00 00 E8 20 30 A2`
+- `E8 40 D0` -> `00 00 E8 40 D0 22`
+- `E8 60 80` -> `00 00 E8 60 80 52`
+- `E9 00 30` -> `00 00 E9 00 30 83`
+- `E9 20 30` -> `00 00 E9 20 30 A3`
+- `E9 40 D0` -> `00 00 E9 40 D0 23`
+- `E9 60 80` -> `00 00 E9 60 80 53`
+- `EC 00 30` -> `00 00 EC 00 30 86`
+- `EC 20 30` -> `00 00 EC 20 30 A6`
+- `EC 40 D0` -> `00 00 EC 40 D0 26`
+- `EC 60 80` -> `00 00 EC 60 80 56`
+
+Keep the opener fixed to the strongest baseline opener for each local map:
+
+- use `90 00 80` before `E8`, `E9`, and `EC`
+
+#### HE28a: Off-grid selector pairs on `E8`
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 00 30 82" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e8-0030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 20 30 A2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e8-2030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 D0 22" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e8-40d0.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 60 80 52" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e8-6080.txt
+```
+
+#### HE28b: Off-grid selector pairs on `E9`
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 00 30 83" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e9-0030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 20 30 A3" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e9-2030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 40 D0 23" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e9-40d0.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 60 80 53" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e9-6080.txt
+```
+
+#### HE28c: Off-grid selector pairs on `EC`
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 00 30 86" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-ec-0030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 20 30 A6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-ec-2030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 D0 26" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-ec-40d0.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 60 80 56" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-ec-6080.txt
+```
+
+Recommended order:
+
+1. `HE28c` (`EC` off-grid pairs)
+2. `HE28a` (`E8` off-grid pairs)
+3. `HE28b` (`E9` off-grid pairs)
+
+That keeps the most expressive selector first, where the pair-code hypothesis is
+most likely to show itself clearly.
+
+### 2026-05-13 Off-Grid Pair Result
+
+This ladder weakens the strict "only a few accepted 2-byte pair codes" model.
+
+#### `E8` off-grid pairs under `90 00 80`
+
+| Selector payload | Result |
+| --- | --- |
+| `E8 00 30` | `07 80 7A 40 26 C1` |
+| `E8 20 30` | `07 80 FA 48 26 49` |
+| `E8 40 D0` | `07 80 7A 50 3A CD` |
+| `E8 60 80` | `07 80 7A 58 30 CF` |
+
+#### `E9` off-grid pairs under `90 00 80`
+
+| Selector payload | Result |
+| --- | --- |
+| `E9 00 30` | `07 80 7A 20 D3 54` |
+| `E9 20 30` | `07 80 7A 24 D3 50` |
+| `E9 40 D0` | `07 80 7A 28 DD 52` |
+| `E9 60 80` | `07 80 7A 2C D8 53` |
+
+#### `EC` off-grid pairs under `90 00 80`
+
+| Selector payload | Result |
+| --- | --- |
+| `EC 00 30` | `07 80 7B 40 26 C0` |
+| `EC 20 30` | `07 80 7B 4C 26 CC` |
+| `EC 40 D0` | `07 80 FB 50 3A 4C` |
+| `EC 60 80` | `07 80 7B 58 30 CE` |
+
+Interpretation:
+
+- The RCP did **not** reject the off-grid mixed combinations.
+- Instead, it returned structured, checksum-valid sibling families in a highly
+  systematic way.
+- That makes the strongest current model:
+  - these are still two separate bytes on the wire
+  - and their meanings appear at least partly compositional, not just a small
+    fixed whitelist of accepted pair codes
+- In other words, the "strict 2-byte enum only" hypothesis is weaker now.
+- A more likely model is:
+  - selector command chooses a region
+  - first payload byte strongly influences one axis/page
+  - second payload byte also influences the returned subtype/data bytes
+  - some selectors, especially `EC`, can still flip whole sibling families (`7B`
+    vs `FB`) depending on the combination
+
+Best current takeaway:
+
+- the `state/value` bytes are meaningful
+- they are not behaving like arbitrary filler
+- but they also are not behaving like only four hardcoded legal pair tokens
+- they look more like a small 2-byte parameter space with selector-specific
+  mapping rules
--- a/docs/pt2-protocol-summary.md
+++ b/docs/pt2-protocol-summary.md
@@ -307,6 +307,10 @@ Current caution:
  with fixed command bytes, changing opener or selector `state/value` fields
  systematically shifted the returned families and payloads, especially on the
  `E8`, `E9`, and `EC` branches.
+- An off-grid pair ladder weakened the strict "only known legal pairs work"
+  model: mixed combinations like `00 30`, `20 30`, and `40 D0` still produced
+  structured sibling responses, so the payload bytes now look more like a small
+  parameter space than a tiny whitelist of accepted pair tokens.

 ## What We Know

--- a/docs/pt2-state-map.md
+++ b/docs/pt2-state-map.md
@@ -213,9 +213,43 @@ Observed examples:
  - `EC 20 D0` -> `E4 40 30`
  - `EC 40 30` -> `FB 50 26`
  - `EC 60 30` -> `7B 58 26`
+- off-grid mixed pairs still produced structured families rather than rejection:
+  - `E8 40 D0` -> `7A 50 3A`
+  - `E9 40 D0` -> `7A 28 DD`
+  - `EC 40 D0` -> `FB 50 3A`
+  - `EC 00 30` -> `7B 40 26`

 That strongly suggests the `state/value` fields are not filler. They likely
 select a page, subtype, class, or data register within the selector space.
+It also weakens the idea that only a tiny fixed whitelist of pair codes is
+accepted; the space appears more compositional than that.
+
+## Family Classification Table
+
+This table is a practical aid for reading captures. It separates:
+
+- target families: structured families that appear to be intended branch results
+- sibling families: alternate structured results in the same selector space
+- fallback families: repeatable collapse/transient outcomes that usually mean
+  context or parameters were not what the branch wanted
+- heartbeat-only: no useful branch opened
+
+| Selector / context area | Target families | Sibling families | Fallback families | Notes |
+| --- | --- | --- | --- | --- |
+| `E8` family space | `07 80 7A 50 26 D1`, `07 80 7A 40 30 D7`, `07 80 7A 48 3A D5`, `07 80 7A 58 26 D9`, `07 80 7A 50 3A CD`, `07 80 7A 40 26 C1`, `07 80 7A 58 30 CF` | `07 80 FA 50 26 51`, `07 80 FA 48 26 49` | `07 80 40 40 30 ED`, `07 80 C0 40 30 6D` | `E8` usually lives in the `7A` family; some opener/payload combinations flip it into sibling `FA`. |
+| `E9` family space | `07 80 7A 28 D3 5C`, `07 80 7A 20 D8 5F`, `07 80 7A 24 FD 7E`, `07 80 7A 2C D3 58`, `07 80 7A 20 D3 54`, `07 80 7A 24 D3 50`, `07 80 7A 28 DD 52`, `07 80 7A 2C D8 53` | none clearly separated yet | `07 80 40 40 30 ED` | `E9` has been the most internally consistent: it stays in `7A` while the trailing bytes move with parameters. |
+| `EC` family space | `07 80 7B 50 26 D0`, `07 80 7B 58 26 D8`, `07 80 7B 40 26 C0`, `07 80 7B 4C 26 CC`, `07 80 7B 58 30 CE` | `07 80 FB 50 26 50`, `07 80 FB 40 30 56`, `07 80 FB 50 3A 4C`, `07 80 E4 40 30 49`, `07 C0 2F 95 09 2E` | `07 80 C0 40 30 6D`, `07 80 40 40 30 ED` | `EC` is the richest and touchiest branch. It can land in `7B`, `FB`, or `E4` families depending on context and payload. |
+| Heartbeat-context transients | none | none | `07 80 40 40 30 ED`, `07 80 40 60 30 CD`, `07 80 C0 40 30 6D` | These show up when traffic shape or context is recognized but does not open the intended structured branch. |
+| Query/discovery surface | `07 80 68 40 30 C5`, `07 80 6C 40 30 C1`, `07 80 6D 20 D8 48` | `07 80 E8 40 30 45` and related context-sensitive variants | heartbeat-only after one-shot window is spent | This area still looks more like one-shot readable blocks than selector-space family behavior. |
+
+Working rule of thumb:
+
+- if the family is `7A`, `7B`, `FB`, `FA`, or `E4`, you are probably still in a
+  meaningful selector/result space
+- if the family is `40`/`C0` after a branch attempt, you probably hit a
+  fallback/transient outcome
+- if you only get heartbeat, the branch likely did not open or the one-shot
+  window was already gone

 ## Downstream Family Branches