run 20

captures/rcp-heartbeat-echo-exact-fa502651.txt

@@ -0,0 +1,34 @@
+Sequence probe: 5 frames x 2 group(s) on COM5 at 38400 8N1
+FRAME 1: 00 00 A0 00 80 7A
+FRAME 2: 00 00 E8 40 30 C2
+FRAME 3: 07 80 FA 50 26 51
+FRAME 4: 00 00 00 00 80 DA
+FRAME 5: 00 00 00 00 80 DA
+BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes
+BEGIN group 1/2
+19:14:29.009  TX group=1 frame=1 len=006  00 00 A0 00 80 7A
+19:14:29.009  RX group=1 frame=1 heartbeat-compatible RX: 6 bytes, offset 0, 1 frames + 0 bytes
+19:14:29.544  TX group=1 frame=2 len=006  00 00 E8 40 30 C2
+19:14:29.544  RX group=1 frame=2 ANOMALY 18 RX bytes; first mismatch at byte 6: got 07, heartbeat offset 0 expected 00
+19:14:29.544  RX group=1 frame=2 raw 00 00 00 00 80 DA 07 80 7A 50 26 D1 07 80 7A 50 26 D1
+19:14:30.052  TX group=1 frame=3 len=006  07 80 FA 50 26 51
+19:14:30.052  RX group=1 frame=3 ANOMALY 18 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 0 expected 00
+19:14:30.052  RX group=1 frame=3 raw 07 80 7A 50 26 D1 00 00 00 00 80 DA 00 00 00 00 80 DA
+19:14:30.591  TX group=1 frame=4 len=006  00 00 00 00 80 DA
+19:14:30.591  RX group=1 frame=4 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+19:14:31.127  TX group=1 frame=5 len=006  00 00 00 00 80 DA
+19:14:31.127  RX group=1 frame=5 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+GROUP 1 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+BEGIN group 2/2
+19:14:32.256  TX group=2 frame=1 len=006  00 00 A0 00 80 7A
+19:14:32.256  RX group=2 frame=1 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
+19:14:32.792  TX group=2 frame=2 len=006  00 00 E8 40 30 C2
+19:14:32.792  RX group=2 frame=2 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+19:14:33.328  TX group=2 frame=3 len=006  07 80 FA 50 26 51
+19:14:33.328  RX group=2 frame=3 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+19:14:33.833  TX group=2 frame=4 len=006  00 00 00 00 80 DA
+19:14:33.833  RX group=2 frame=4 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
+19:14:34.339  TX group=2 frame=5 len=006  00 00 00 00 80 DA
+19:14:34.339  RX group=2 frame=5 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
+GROUP 2 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+Anomalies: 2

captures/rcp-heartbeat-echo-host-fa5026.txt

@@ -0,0 +1,34 @@
+Sequence probe: 5 frames x 2 group(s) on COM5 at 38400 8N1
+FRAME 1: 00 00 A0 00 80 7A
+FRAME 2: 00 00 E8 40 30 C2
+FRAME 3: 00 00 FA 50 26 D6
+FRAME 4: 00 00 00 00 80 DA
+FRAME 5: 00 00 00 00 80 DA
+BASELINE heartbeat-compatible RX: 24 bytes, offset 0, 4 frames + 0 bytes
+BEGIN group 1/2
+19:14:48.447  TX group=1 frame=1 len=006  00 00 A0 00 80 7A
+19:14:48.447  RX group=1 frame=1 heartbeat-compatible RX: 6 bytes, offset 0, 1 frames + 0 bytes
+19:14:48.984  TX group=1 frame=2 len=006  00 00 E8 40 30 C2
+19:14:48.984  RX group=1 frame=2 ANOMALY 18 RX bytes; first mismatch at byte 6: got 07, heartbeat offset 0 expected 00
+19:14:48.984  RX group=1 frame=2 raw 00 00 00 00 80 DA 07 80 7A 50 26 D1 07 80 7A 50 26 D1
+19:14:49.493  TX group=1 frame=3 len=006  00 00 FA 50 26 D6
+19:14:49.493  RX group=1 frame=3 ANOMALY 18 RX bytes; first mismatch at byte 0: got 07, heartbeat offset 0 expected 00
+19:14:49.493  RX group=1 frame=3 raw 07 80 7A 50 26 D1 00 00 00 00 80 DA 00 00 00 00 80 DA
+19:14:50.030  TX group=1 frame=4 len=006  00 00 00 00 80 DA
+19:14:50.030  RX group=1 frame=4 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+19:14:50.563  TX group=1 frame=5 len=006  00 00 00 00 80 DA
+19:14:50.563  RX group=1 frame=5 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+GROUP 1 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+BEGIN group 2/2
+19:14:51.692  TX group=2 frame=1 len=006  00 00 A0 00 80 7A
+19:14:51.692  RX group=2 frame=1 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
+19:14:52.198  TX group=2 frame=2 len=006  00 00 E8 40 30 C2
+19:14:52.198  RX group=2 frame=2 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
+19:14:52.733  TX group=2 frame=3 len=006  00 00 FA 50 26 D6
+19:14:52.733  RX group=2 frame=3 heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+19:14:53.239  TX group=2 frame=4 len=006  00 00 00 00 80 DA
+19:14:53.239  RX group=2 frame=4 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
+19:14:53.744  TX group=2 frame=5 len=006  00 00 00 00 80 DA
+19:14:53.744  RX group=2 frame=5 heartbeat-compatible RX: 12 bytes, offset 0, 2 frames + 0 bytes
+GROUP 2 TAIL heartbeat-compatible RX: 18 bytes, offset 0, 3 frames + 0 bytes
+Anomalies: 2

docs/discovery-notes.md

@@ -4935,3 +4935,69 @@ Next branch worth testing:
 - try host-shaped and exact echoes of `07 80 FA 50 26 51`
 - probe whether `FA` / `7A` correspond to nearby explicit host queries such as
   `00 -> FA` or `00 -> 7A`
+
+### HE8: Exact Echo Of `07 80 FA 50 26 51`
+
+Recreate the `E8` host-mirror path that previously produced
+`07 80 FA 50 26 51`, then immediately send the exact `FA` frame back.
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 A0 00 80 7A" --frame "00 00 E8 40 30 C2" --frame "07 80 FA 50 26 51" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-heartbeat-echo-exact-fa502651.txt
+```
+
+### HE9: Host-Shaped Mirror Of `07 80 FA 50 26 51`
+
+Host-shaped checksum for `00 00 FA 50 26 ??` is `D6`.
+
+```powershell
+python scripts/serial_sequence_probe.py --port COM5 --prompt --frame "00 00 A0 00 80 7A" --frame "00 00 E8 40 30 C2" --frame "00 00 FA 50 26 D6" --frame "00 00 00 00 80 DA" --frame "00 00 00 00 80 DA" --repeat 2 --frame-interval 0.20 --read-after-frame 0.30 --read-after-group 0.8 --log captures/rcp-heartbeat-echo-host-fa5026.txt
+```
+
+What would count as a hit:
+
+- any fresh structured response after the `FA` echo or mirror
+- a repeat of `07 80 FA 50 26 51` or `07 C0 7A 50 A6 11`
+- any new family in the `50` / `7A` / `FA` region
+- visible panel behavior changing beyond the usual `CONNECT NOT ACT`
+
+### 2026-05-13 `FA` Echo Follow-Up Result
+
+Captures:
+
+- `captures/rcp-heartbeat-echo-exact-fa502651.txt`
+- `captures/rcp-heartbeat-echo-host-fa5026.txt`
+
+Result summary:
+
+- Both runs behaved the same way.
+- In group 1, the host-shaped `E8` step
+  `00 00 E8 40 30 C2` produced a new structured family:
+  `07 80 7A 50 26 D1`
+- That `7A` family appeared twice immediately after the `E8` host-mirror step in
+  both runs.
+- The following `FA` step, whether exact echo `07 80 FA 50 26 51` or
+  host-shaped mirror `00 00 FA 50 26 D6`, did not produce a fresh distinct
+  reply. The receive window only showed one more `07 80 7A 50 26 D1` followed by
+  heartbeat.
+- In group 2, both runs were heartbeat-only after the same sequence.
+
+Interpretation:
+
+- The meaningful branch point still appears to be the host-shaped `E8` frame,
+  not the subsequent `FA` echo/mirror.
+- `07 80 FA 50 26 51` is not yet behaving like a value the host should directly
+  answer to advance the exchange.
+- `07 80 7A 50 26 D1` is now a stronger candidate for a real sibling response
+  family in this branch than `07 C0 7A 50 A6 11`, because it reproduced in both
+  HE8 and HE9 group-1 runs.
+- The fact that HE8 and HE9 were serially identical suggests the panel likely
+  emitted a delayed/queued `7A`-family response from the `E8` host-mirror step,
+  rather than parsing the `FA` follow-up as a meaningful new command.
+
+Best current model of this branch:
+
+- `00 00 E8 40 30 C2` can lead into a `7A` / `FA` response family.
+- `07 80 FA 50 26 51` may be one branch member, but answering it directly did
+  not produce a second-stage exchange.
+- The next useful probe should probably target `07 80 7A 50 26 D1` directly, or
+  compare exact-vs-host handling of `7A` rather than `FA`.

docs/pt2-protocol-summary.md

@@ -237,8 +237,9 @@ confirmed Sony definition.
 | `07 80 40 60 30 CD` | some heartbeat-only cadence runs | low-medium | transient heartbeat/context response family |
 | `07 80 C0 40 30 6D` | some heartbeat-only cadence runs | medium | transient heartbeat/context response family |
 | `07 80 E8 40 30 45` | context-sensitive `A0` path in some runs | medium | variant readable/query family, likely selector- or timing-sensitive |
-| `07 80 FA 50 26 51` | host-shaped mirror of `07 80 E8 40 30 45` | low-medium | new structured response family worth focused follow-up |
+| `07 80 FA 50 26 51` | host-shaped mirror of `07 80 E8 40 30 45`, seen once | low-medium | new structured response family on the `E8` branch; follow-up echo did not advance state |
-| `07 C0 7A 50 A6 11` | exact echo of `07 80 E8 40 30 45` | low | new structured response family worth focused follow-up |
+| `07 C0 7A 50 A6 11` | exact echo of `07 80 E8 40 30 45`, seen once | low | new structured response family on the `E8` branch; not yet repeated |
+| `07 80 7A 50 26 D1` | host-shaped `E8` branch in HE8/HE9 group 1 | medium | reproducible sibling response family in the `E8` / `FA` / `7A` branch |
 
 Current caution:
 
@@ -252,6 +253,10 @@ Current caution:
   families did not advance the session.
 - The first echo experiments that produced genuinely new structured output were
   on the `E8` branch, not the `40` / `C0` branch.
+- Directly echoing or host-mirroring `07 80 FA 50 26 51` did not produce a
+  clean second-stage response; both follow-up tests instead repeated the
+  `07 80 7A 50 26 D1` branch after the host-shaped `E8` step and then went
+  back to heartbeat.
 
 ## What We Know
 
@@ -274,7 +279,7 @@ Current caution:
   still does not create a fully active session.
 - The heartbeat-induced `0x40` / `0xC0` families are real, but they usually act
   more like transient state/context responses than like camera-data streaming.
-- The most promising new echo-derived lead is now the `E8` / `FA` / `7A`
+- The most promising new echo-derived lead is now the `E8` / `7A` / `FA`
   response branch.
 
 ## What We Do Not Know