run 31

docs/pt2-protocol-summary.md

@@ -307,6 +307,10 @@ Current caution:
   with fixed command bytes, changing opener or selector `state/value` fields
   systematically shifted the returned families and payloads, especially on the
   `E8`, `E9`, and `EC` branches.
+- An off-grid pair ladder weakened the strict "only known legal pairs work"
+  model: mixed combinations like `00 30`, `20 30`, and `40 D0` still produced
+  structured sibling responses, so the payload bytes now look more like a small
+  parameter space than a tiny whitelist of accepted pair tokens.
 
 ## What We Know