run 20

docs/discovery-notes.md

@@ -4935,3 +4935,69 @@ Next branch worth testing:
 - try host-shaped and exact echoes of `07 80 FA 50 26 51`
 - probe whether `FA` / `7A` correspond to nearby explicit host queries such as
   `00 -> FA` or `00 -> 7A`
+
+### HE8: Exact Echo Of `07 80 FA 50 26 51`
+
+Recreate the `E8` host-mirror path that previously produced
+`07 80 FA 50 26 51`, then immediately send the exact `FA` frame back.
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 A0 00 80 7A" --frame "00 00 E8 40 30 C2" --frame "07 80 FA 50 26 51" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-heartbeat-echo-exact-fa502651.txt
+```
+
+### HE9: Host-Shaped Mirror Of `07 80 FA 50 26 51`
+
+Host-shaped checksum for `00 00 FA 50 26 ??` is `D6`.
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 A0 00 80 7A" --frame "00 00 E8 40 30 C2" --frame "00 00 FA 50 26 D6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-heartbeat-echo-host-fa5026.txt
+```
+
+What would count as a hit:
+
+- any fresh structured response after the `FA` echo or mirror
+- a repeat of `07 80 FA 50 26 51` or `07 C0 7A 50 A6 11`
+- any new family in the `50` / `7A` / `FA` region
+- visible panel behavior changing beyond the usual `CONNECT NOT ACT`
+
+### 2026-05-13 `FA` Echo Follow-Up Result
+
+Captures:
+
+- `captures/rcp-heartbeat-echo-exact-fa502651.txt`
+- `captures/rcp-heartbeat-echo-host-fa5026.txt`
+
+Result summary:
+
+- Both runs behaved the same way.
+- In group 1, the host-shaped `E8` step
+  `00 00 E8 40 30 C2` produced a new structured family:
+  `07 80 7A 50 26 D1`
+- That `7A` family appeared twice immediately after the `E8` host-mirror step in
+  both runs.
+- The following `FA` step, whether exact echo `07 80 FA 50 26 51` or
+  host-shaped mirror `00 00 FA 50 26 D6`, did not produce a fresh distinct
+  reply. The receive window only showed one more `07 80 7A 50 26 D1` followed by
+  heartbeat.
+- In group 2, both runs were heartbeat-only after the same sequence.
+
+Interpretation:
+
+- The meaningful branch point still appears to be the host-shaped `E8` frame,
+  not the subsequent `FA` echo/mirror.
+- `07 80 FA 50 26 51` is not yet behaving like a value the host should directly
+  answer to advance the exchange.
+- `07 80 7A 50 26 D1` is now a stronger candidate for a real sibling response
+  family in this branch than `07 C0 7A 50 A6 11`, because it reproduced in both
+  HE8 and HE9 group-1 runs.
+- The fact that HE8 and HE9 were serially identical suggests the panel likely
+  emitted a delayed/queued `7A`-family response from the `E8` host-mirror step,
+  rather than parsing the `FA` follow-up as a meaningful new command.
+
+Best current model of this branch:
+
+- `00 00 E8 40 30 C2` can lead into a `7A` / `FA` response family.
+- `07 80 FA 50 26 51` may be one branch member, but answering it directly did
+  not produce a second-stage exchange.
+- The next useful probe should probably target `07 80 7A 50 26 D1` directly, or
+  compare exact-vs-host handling of `7A` rather than `FA`.