run 31

2026-05-13 20:53:52 +10:00
parent 20ebe52096
commit c7997d5131
15 changed files with 523 additions and 0 deletions
--- a/docs/discovery-notes.md
+++ b/docs/discovery-notes.md
@@ -6266,3 +6266,143 @@ Best current model after HE27:
 - the protocol surface is more parameterized than we first thought
 - but we still do not have a stable proof that the downstream family frames are
  host prompts rather than readable response blocks
+
+### HE28: Off-Grid Pair Test
+
+Goal:
+
+- Test whether the two payload bytes behave more like an accepted **pair code**
+  than two semantically independent fields.
+
+Idea:
+
+- We already know these combinations are meaningful on several branches:
+  - `00 80`
+  - `20 D0`
+  - `40 30`
+  - `60 30`
+- Now try mixed combinations that were **not** part of the known-good set:
+  - `00 30`
+  - `20 30`
+  - `40 D0`
+  - `60 80`
+
+What would count as a hit:
+
+- mixed pairs behaving just like nearby known-good pairs, which would support
+  more independent byte meanings
+- mixed pairs mostly collapsing to heartbeat/transients or producing odd
+  outliers, which would support the "2-byte code" model
+- one branch accepting mixed pairs while another rejects them, which would mean
+  pairing rules are selector-specific
+
+Checksums:
+
+- `E8 00 30` -> `00 00 E8 00 30 82`
+- `E8 20 30` -> `00 00 E8 20 30 A2`
+- `E8 40 D0` -> `00 00 E8 40 D0 22`
+- `E8 60 80` -> `00 00 E8 60 80 52`
+- `E9 00 30` -> `00 00 E9 00 30 83`
+- `E9 20 30` -> `00 00 E9 20 30 A3`
+- `E9 40 D0` -> `00 00 E9 40 D0 23`
+- `E9 60 80` -> `00 00 E9 60 80 53`
+- `EC 00 30` -> `00 00 EC 00 30 86`
+- `EC 20 30` -> `00 00 EC 20 30 A6`
+- `EC 40 D0` -> `00 00 EC 40 D0 26`
+- `EC 60 80` -> `00 00 EC 60 80 56`
+
+Keep the opener fixed to the strongest baseline opener for each local map:
+
+- use `90 00 80` before `E8`, `E9`, and `EC`
+
+#### HE28a: Off-grid selector pairs on `E8`
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 00 30 82" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e8-0030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 20 30 A2" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e8-2030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 40 D0 22" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e8-40d0.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E8 60 80 52" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e8-6080.txt
+```
+
+#### HE28b: Off-grid selector pairs on `E9`
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 00 30 83" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e9-0030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 20 30 A3" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e9-2030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 40 D0 23" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e9-40d0.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 E9 60 80 53" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-e9-6080.txt
+```
+
+#### HE28c: Off-grid selector pairs on `EC`
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 00 30 86" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-ec-0030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 20 30 A6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-ec-2030.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 40 D0 26" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-ec-40d0.txt
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 90 00 80 4A" --frame "00 00 EC 60 80 56" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-pairtest-ec-6080.txt
+```
+
+Recommended order:
+
+1. `HE28c` (`EC` off-grid pairs)
+2. `HE28a` (`E8` off-grid pairs)
+3. `HE28b` (`E9` off-grid pairs)
+
+That keeps the most expressive selector first, where the pair-code hypothesis is
+most likely to show itself clearly.
+
+### 2026-05-13 Off-Grid Pair Result
+
+This ladder weakens the strict "only a few accepted 2-byte pair codes" model.
+
+#### `E8` off-grid pairs under `90 00 80`
+
+| Selector payload | Result |
+| --- | --- |
+| `E8 00 30` | `07 80 7A 40 26 C1` |
+| `E8 20 30` | `07 80 FA 48 26 49` |
+| `E8 40 D0` | `07 80 7A 50 3A CD` |
+| `E8 60 80` | `07 80 7A 58 30 CF` |
+
+#### `E9` off-grid pairs under `90 00 80`
+
+| Selector payload | Result |
+| --- | --- |
+| `E9 00 30` | `07 80 7A 20 D3 54` |
+| `E9 20 30` | `07 80 7A 24 D3 50` |
+| `E9 40 D0` | `07 80 7A 28 DD 52` |
+| `E9 60 80` | `07 80 7A 2C D8 53` |
+
+#### `EC` off-grid pairs under `90 00 80`
+
+| Selector payload | Result |
+| --- | --- |
+| `EC 00 30` | `07 80 7B 40 26 C0` |
+| `EC 20 30` | `07 80 7B 4C 26 CC` |
+| `EC 40 D0` | `07 80 FB 50 3A 4C` |
+| `EC 60 80` | `07 80 7B 58 30 CE` |
+
+Interpretation:
+
+- The RCP did **not** reject the off-grid mixed combinations.
+- Instead, it returned structured, checksum-valid sibling families in a highly
+  systematic way.
+- That makes the strongest current model:
+  - these are still two separate bytes on the wire
+  - and their meanings appear at least partly compositional, not just a small
+    fixed whitelist of accepted pair codes
+- In other words, the "strict 2-byte enum only" hypothesis is weaker now.
+- A more likely model is:
+  - selector command chooses a region
+  - first payload byte strongly influences one axis/page
+  - second payload byte also influences the returned subtype/data bytes
+  - some selectors, especially `EC`, can still flip whole sibling families (`7B`
+    vs `FB`) depending on the combination
+
+Best current takeaway:
+
+- the `state/value` bytes are meaningful
+- they are not behaving like arbitrary filler
+- but they also are not behaving like only four hardcoded legal pair tokens
+- they look more like a small 2-byte parameter space with selector-specific
+  mapping rules