run 25

docs/pt2-state-map.md

@@ -0,0 +1,290 @@
+# Sony PT2 Protocol State Map
+
+This document is a working state map for the Sony RCP-TX7 PT2-era control
+protocol as currently observed on the bench. It is intentionally more structural
+than [pt2-protocol-summary.md](pt2-protocol-summary.md): the goal here is to
+show how host inputs appear to move the panel between response families and
+contexts.
+
+This is not yet a true finite-state-machine proof. It is a practical model of
+what currently seems to change the panel's response surface.
+
+## How To Read This
+
+- `state` means an inferred protocol context, not a confirmed Sony term.
+- `stable` means reproduced across multiple clean runs.
+- `unstable` means seen more than once or clearly real, but not deterministic.
+- `one-shot` means usually group-1 or post-boot only, then gone.
+
+## State Layers
+
+The current evidence suggests the panel behavior is shaped by several layers:
+
+1. physical/link state
+2. host-presence / cadence state
+3. selector / query context
+4. downstream family response surface
+5. unknown session-advance / active-control state
+
+We have good evidence for layers 1-4. Layer 5 is still missing.
+
+## Baseline States
+
+### S0: Idle / Not Active
+
+Observed behavior:
+
+- RCP sends repeating heartbeat:
+  - `00 00 00 00 80 DA`
+- LCD may remain idle or later enter `CONNECT NOT ACT`
+
+Known transitions:
+
+- host traffic can move the panel into parser-visible but still not-active
+  states
+- CALL and CAM POWER can still emit panel-origin frames here
+
+Confidence: high
+
+### S1: Host Present / Cadence-Held
+
+Observed behavior:
+
+- repeating host heartbeat
+  - `00 00 00 00 80 DA`
+  can keep the panel out of `CONNECT NOT ACT` while traffic continues
+- this does not by itself create reusable reads or a full active session
+
+Known side effects:
+
+- some cadence patterns provoke transient families:
+  - `07 80 40 40 30 ED`
+  - `07 80 40 60 30 CD`
+  - `07 80 C0 40 30 6D`
+
+Confidence: high
+
+## Discovery / Query Surface
+
+### S2: Discovery Query Window
+
+Canonical shape:
+
+```text
+00 00 00 00 80 DA
+00 00 XX 00 80 checksum
+-> 07 80 ...
+```
+
+Stable one-shot reads:
+
+- `00 -> A0` -> `07 80 68 40 30 C5`
+- `00 -> B0` -> `07 80 6C 40 30 C1`
+- `00 -> B5` -> `07 80 6D 20 D8 48`
+
+Properties:
+
+- usually one-shot after boot
+- repeating the same query often drains to heartbeat only
+- appears to be a readable/capability surface, not an activation handshake
+
+Confidence: high
+
+## Event Path
+
+### S3: Synthetic CALL Event Path
+
+Host stimulus:
+
+```text
+00 00 15 80 00 CF
+00 00 15 00 00 4F
+```
+
+Stable response:
+
+- `07 80 45 20 D0 68`
+
+Sibling seen once:
+
+- `07 80 45 30 D0 78`
+
+Properties:
+
+- physical CALL button not required
+- looks like a real event-path branch
+- has not led to activation or reusable reads
+
+Confidence: high
+
+## Selector-Like Context Surface
+
+The strongest current "state map" behavior lives here. Certain host-side values
+look less like direct commands and more like selector/context entries that open
+different downstream response families.
+
+### S4: `A0`-Contexted Selector Space
+
+Current best evidence says `A0` is not always just a neutral primer. On at
+least the `EC` branch, it appears to be part of the context that opens the
+family space.
+
+Observed:
+
+- `A0 + EC` tends to produce `7B`-family output
+- `EC` without leading `A0` falls back to `07 80 C0 40 30 6D`
+
+Confidence: medium-high
+
+## `Ex` Selector Neighborhood
+
+These are the clearest currently mapped selector-like host entries.
+
+| Host-side entry | Typical downstream result | Current read |
+| --- | --- | --- |
+| `00 00 E6 40 30 CC` | `07 80 40 40 30 ED` after later heartbeat | heartbeat-family bias |
+| `00 00 E7 40 30 CD` | `07 80 40 40 30 ED` after later heartbeat | heartbeat-family bias |
+| `00 00 E8 40 30 C2` | `07 80 7A 50 26 D1` | stable selector into `7A` family |
+| `00 00 E9 40 30 C3` | `07 80 7A 28 D3 5C` | sibling selector into related `7A` family |
+| `00 00 EA 40 30 C0` | `07 80 C0 40 30 6D` after later heartbeat | alternate heartbeat-family bias |
+| `00 00 EB 40 30 C1` | `07 80 40 40 30 ED` after later heartbeat | heartbeat-family bias |
+| `00 00 EC 40 30 C6` | `07 80 7B 50 26 D0` or `07 80 FB 50 26 50` | selector into mixed sibling family space |
+
+Current interpretation:
+
+- this is not a flat command block
+- some `Ex` values bias toward heartbeat-family transients
+- some open structured `7A` / `7B` / `FB` families
+
+Confidence: medium-high
+
+## Downstream Family Branches
+
+### B1: `E8 -> 7A 50 26`
+
+Stable branch:
+
+```text
+00 00 A0 00 80 7A
+00 00 E8 40 30 C2
+-> 07 80 7A 50 26 D1
+```
+
+What we know:
+
+- reproducible in group 1
+- exact echo of `07 80 7A 50 26 D1` did not advance state
+- host-shaped mirror of `7A 50 26` did not advance state
+
+Read:
+
+- `E8` is the active selector
+- `7A 50 26 D1` is a downstream family response, not yet a meaningful next host
+  turn
+
+Confidence: medium-high
+
+### B2: `E9 -> 7A 28 D3`
+
+Stable branch:
+
+```text
+00 00 A0 00 80 7A
+00 00 E9 40 30 C3
+-> 07 80 7A 28 D3 5C
+```
+
+What we know:
+
+- reproducible in group 1
+- exact and host-shaped replies to `7A 28 D3 5C` did not advance state
+
+Read:
+
+- `E9` looks like a sibling selector to `E8`
+- payload differences may represent page/class selection rather than random
+  drift
+
+Confidence: medium
+
+### B3: `EC -> 7B / FB`
+
+Observed branch space:
+
+```text
+00 00 A0 00 80 7A
+00 00 EC 40 30 C6
+-> 07 80 7B 50 26 D0
+or
+-> 07 80 FB 50 26 50
+```
+
+Important details:
+
+- without leading `A0`, `EC` fell back to `07 80 C0 40 30 6D`
+- short and long spacing with `A0` still favored `07 80 7B 50 26 D0`
+- exact `7B` echo once produced:
+  - `07 C0 2F 95 09 2E`
+- later `2F` follow-ups did not create a stable next stage
+- exact and host-shaped `FB` handling did not create a stable next stage
+
+Read:
+
+- `EC` is the most stateful selector branch seen so far
+- `A0` seems to be part of its selection context
+- `7B` is the most stable downstream family on this branch
+- `FB` is real but currently looks like a sibling observation, not a clear reply
+  target
+
+Confidence: medium
+
+## Current Transition Sketch
+
+```text
+S0 idle/not-active
+  -> host heartbeat cadence
+S1 host-present/cadence-held
+  -> one-shot discovery query surface
+S2 discovery/query window
+  -> selector/context entry
+S4 A0-contexted selector space
+    -> E8 -> B1 (7A 50 26 family)
+    -> E9 -> B2 (7A 28 D3 family)
+    -> EC -> B3 (7B / FB family)
+    -> E6/E7/EB -> heartbeat-family transient
+    -> EA / no-A0-EC -> C0-family transient
+```
+
+What is still missing:
+
+- the transition from any of these branches into a stable active/session state
+- a deterministic multi-turn reply ladder
+
+## What Feels Stable Right Now
+
+- RS-232 electrical layer and 6-byte frame model
+- idle heartbeat behavior
+- `CONNECT NOT ACT` not being identical to active/inactive protocol state
+- one-shot discovery surface
+- CALL synthetic event path
+- `Ex` neighborhood acting like a selector-like surface
+- `A0` mattering as branch context on at least `EC`
+
+## What Still Feels Slippery
+
+- exact conditions that choose `7B` vs `FB` on `EC`
+- whether `E8/E9/EC` are true page selectors, class selectors, or partial
+  capability requests
+- whether any downstream family reply is actually something the host is expected
+  to answer
+- how this selector space relates to the real session activation handshake
+
+## Best Next Uses Of This Map
+
+This map is meant to help us ask sharper questions, for example:
+
+- does `A0` act as selector context on `E8` and `E9`, not just `EC`?
+- do nearby `Ex` values continue the family strip?
+- do host `state/value` bytes on `A0` or `Ex` shift the selected family?
+- is there a separate session-maintenance stream that must coexist with these
+  selector reads?