run 4

docs/pt2-protocol-summary.md

@@ -479,6 +479,21 @@ Current caution:
   - startup/beacon pages
   - then a small recurring maintained scan set
   - then additional camera-state detail pages we still have not identified
+- A later no-pause HE38 pass broadened the same idea:
+  - `0x21 @ 20 D0` -> `07 80 48 24 DD 6C`
+  - `0x41-0x43 @ 20 D0` -> `07 80 50 24 DD 74`
+  - while the baseline control in the same `0x20-0x3F` region stayed on the
+    older `20 D8` style (`07 80 4A 20 D8 6F`)
+- That suggests `20 D0` is not just shifting one command or one small pocket;
+  it may be selecting a broader `.. 24 DD ..` maintained-background surface
+  across multiple command bands.
+- The paused HE38 runs strengthened that structure further:
+  - `0x20-0x3F @ 20 D0` maps cleanly through `48/49/4A/.../4F 24 DD`
+  - `0x20-0x3F @ 00 80` maps the same area through `4A/4B/4C/.../4F 20 D8`
+  - `0x20-0x3F @ 40 30` maps it again through `48/49/4A/.../4F 28 D3`
+- So the best current model is a parallel set of response surfaces selected in
+  part by the host payload pair, with the remaining question being which surface
+  behaves like the true maintained background layer for an active panel.
 
 ## What We Do Not Know