More test run data

docs/discovery-notes.md

@@ -674,6 +674,11 @@ Recommended first direct sweep:
 python scripts/serial_direct_response_sweep.py --port COM5 --commands "0x00-0xFF" --states 0x00 --values 0x80 --after-each 0.6 --stop-on-anomaly --log captures/rcp-direct-cmd-00-ff.txt
 ```
 
+For a long sweep where every anomaly should be logged but the panel needs a
+fresh power cycle before continuing, use `--pause-on-anomaly` instead of
+`--stop-on-anomaly`. After the prompt, power-cycle the RCP, wait for the normal
+heartbeat, then press Enter.
+
 What to watch for:
 
 - If the script reports `Anomalies: 0`, the panel never sent raw bytes that
@@ -2035,3 +2040,120 @@ If this range is quiet, continue with neighboring command regions:
 python scripts/serial_primer_candidate_sweep.py --port COM5 --candidates "0xA0-0xAF" --prompt-power-cycle --log captures/rcp-primer-sweep-a0-af.txt
 python scripts/serial_primer_candidate_sweep.py --port COM5 --candidates "0xC0-0xCF" --prompt-power-cycle --log captures/rcp-primer-sweep-c0-cf.txt
 ```
+
+### 2026-05-13 Primer Sweep A/B/C Region Result
+
+Captures:
+
+- `captures/rcp-primer-sweep-a0-af.txt`
+- `captures/rcp-primer-sweep-b1-bf.tx`
+- `captures/rcp-primer-sweep-c0-cf.txt`
+
+These sweeps used a fresh power cycle before each candidate, with the standard
+primer shape before the selected request:
+
+```text
+primer:    00 00 00 00 80 DA
+candidate: 00 00 CMD 00 80 CHECKSUM
+```
+
+New selected-command response map:
+
+| Selected command | Observed RCP response |
+| ---: | --- |
+| `A0` | `07 80 68 40 30 C5` |
+| `A1` | `07 80 68 20 D8 4D` |
+| `A2` | `07 80 34 10 0C F5` |
+| `A3` | `07 80 34 10 2C D5` |
+| `A4` | `07 80 69 40 30 C4` |
+| `A5` | `07 80 69 20 D8 4C` |
+| `A6` | `07 80 1A 08 C6 09` |
+| `A7` | `07 80 1A 08 D6 19` |
+| `A8` | `07 80 6A 40 30 C7` |
+| `A9` | `07 80 6A 20 D8 4F` |
+| `AA` | `07 80 35 10 0C F4` |
+| `AB` | `07 80 35 10 2C D4` |
+| `AC` | `07 80 6B 40 30 C6` |
+| `AD` | `07 80 6B 20 D8 4E` |
+| `AE` | `07 80 0D 04 A3 77` |
+| `AF` | `07 80 0D 04 AB 7F` |
+| `B1` | `07 80 6C 20 D8 49` |
+| `B6` | `07 80 1B 08 C6 08` |
+| `B7` | `07 80 1B 08 F6 38` |
+| `B8` | `07 80 EE 40 30 43` |
+| `B9` | `07 80 6E 20 D8 4B` |
+| `BA` | `07 80 37 10 0C F6` |
+| `BB` | `07 80 37 10 2C D6` |
+| `BC` | `07 80 EF 40 30 42` |
+| `BD` | `07 80 6F 20 D8 4A` |
+| `BE` | heartbeat only |
+| `BF` | heartbeat only |
+| `C0` | heartbeat only |
+| `C1` | `07 80 70 20 D8 55` |
+| `C2` | `07 80 38 10 0C F9` |
+| `C3` | `07 80 38 10 2C D9` |
+| `C4` | `07 80 71 40 30 DC` |
+| `C5` | `07 80 71 20 D8 54` |
+| `C6` | `07 80 1C 08 C6 0F` |
+| `C7` | `07 80 1C 08 D6 1F` |
+| `C8` | `07 80 72 40 30 DF` |
+| `C9` | `07 80 72 20 D8 57` |
+| `CA` | `07 80 39 10 0C F8` |
+| `CB` | `07 80 39 10 2C D8` |
+| `CC` | `07 80 F3 40 30 5E` |
+| `CD` | `07 80 73 20 D8 56` |
+| `CE` | `07 80 0E 04 A3 74` |
+| `CF` | `07 80 0E 04 AB 7C` |
+
+Interpretation:
+
+- The RCP has a much larger one-shot readable status/query surface than first
+  assumed.
+- The `A0-CF` region looks highly structured. Most commands return stable
+  six-byte responses with the same `07 80` prefix and valid XOR checksum.
+- Pairs often share a response command byte and differ in state/value fields:
+  `A0/A1`, `A2/A3`, `A4/A5`, `A6/A7`, and similar patterns continue through
+  the `B` and `C` regions.
+- `BE`, `BF`, and `C0` are current no-response candidates in this mapping.
+- This strongly supports a discovery/status table model: the CCU may read a
+  specific set of one-shot blocks, then choose a later activation/session
+  command based on the returned table values.
+
+### 2026-05-13 Paused Direct Sweep Result
+
+Capture:
+
+- `captures/rcp-direct-remaining-after-b5-pause.txt`
+
+The paused direct sweep logged anomalies and then allowed a manual power cycle
+before continuing. Because the script continues with the next command after the
+pause, this run is useful for finding response-producing commands, but it is
+not a clean `00 -> B5 -> candidate` post-discovery sweep.
+
+Response hits observed in this run:
+
+| Command at anomaly | Observed RCP response | Caution |
+| ---: | --- | --- |
+| `B5` | `07 80 6D 20 D8 48` | expected known query response |
+| `40` | `07 80 50 40 30 FD` | repeated twice in this run |
+| `6D` | `07 80 5B 20 D8 7E` | may depend on prior `6C` |
+| `4F` | `07 80 0A 04 AB 78` | needs clean one-per-boot confirmation |
+| `8F` | `07 80 0C 04 AB 7E` | may depend on prior sequence |
+| `A0` | `07 80 E8 40 30 45` | differs from primer-sweep `A0` response |
+| `B0` | `07 80 6C 40 30 C1` | known response |
+| `CF` | `07 80 0E 04 AB 7C` | matches primer-sweep `CF` response |
+| `EF` | `07 80 0F 04 EB 3D` | needs clean one-per-boot confirmation |
+| `B1` | `07 80 6C 20 D8 49` | known response |
+| `B3` | `07 80 36 10 2C D7` | known response |
+| `B6` | `07 80 1B 08 C6 08` | known response |
+| `B8` | `07 80 6E 40 30 C3` | differs from primer-sweep `B8` response |
+| `BA` | `07 80 37 10 0C F6` | matches primer-sweep `BA` response |
+| `BC` | `07 80 6F 40 30 C2` | differs from primer-sweep `BC` response |
+
+Next confirmations:
+
+- Retest `40`, `4F`, `8F`, `EF`, and the differing `A0/B8/BC` cases as clean
+  one-per-boot primer pairs.
+- If a response differs between a plain/direct command and a primer-pair query,
+  treat the first host frame as a mode/context selector rather than only a
+  generic wake-up primer.