# Sony PT2 Protocol State Map This document is a working state map for the Sony RCP-TX7 PT2-era control protocol as currently observed on the bench. It is intentionally more structural than [pt2-protocol-summary.md](pt2-protocol-summary.md): the goal here is to show how host inputs appear to move the panel between response families and contexts. This is not yet a true finite-state-machine proof. It is a practical model of what currently seems to change the panel's response surface. ## How To Read This - `state` means an inferred protocol context, not a confirmed Sony term. - `stable` means reproduced across multiple clean runs. - `unstable` means seen more than once or clearly real, but not deterministic. - `one-shot` means usually group-1 or post-boot only, then gone. ## State Layers The current evidence suggests the panel behavior is shaped by several layers: 1. physical/link state 2. host-presence / cadence state 3. selector / query context 4. downstream family response surface 5. unknown session-advance / active-control state We have good evidence for layers 1-4. Layer 5 is still missing. ## Baseline States ### S0: Idle / Not Active Observed behavior: - RCP sends repeating heartbeat: - `00 00 00 00 80 DA` - LCD may remain idle or later enter `CONNECT NOT ACT` Known transitions: - host traffic can move the panel into parser-visible but still not-active states - CALL and CAM POWER can still emit panel-origin frames here Confidence: high ### S1: Host Present / Cadence-Held Observed behavior: - repeating host heartbeat - `00 00 00 00 80 DA` can keep the panel out of `CONNECT NOT ACT` while traffic continues - this does not by itself create reusable reads or a full active session Known side effects: - some cadence patterns provoke transient families: - `07 80 40 40 30 ED` - `07 80 40 60 30 CD` - `07 80 C0 40 30 6D` Confidence: high ## Discovery / Query Surface ### S2: Discovery Query Window Canonical shape: ```text 00 00 00 00 80 DA 00 00 XX 00 80 checksum -> 07 80 ... ``` Stable one-shot reads: - `00 -> A0` -> `07 80 68 40 30 C5` - `00 -> B0` -> `07 80 6C 40 30 C1` - `00 -> B5` -> `07 80 6D 20 D8 48` Properties: - usually one-shot after boot - repeating the same query often drains to heartbeat only - appears to be a readable/capability surface, not an activation handshake Confidence: high ## Event Path ### S3: Synthetic CALL Event Path Host stimulus: ```text 00 00 15 80 00 CF 00 00 15 00 00 4F ``` Stable response: - `07 80 45 20 D0 68` Sibling seen once: - `07 80 45 30 D0 78` Properties: - physical CALL button not required - looks like a real event-path branch - has not led to activation or reusable reads Confidence: high ## Selector-Like Context Surface The strongest current "state map" behavior lives here. Certain host-side values look less like direct commands and more like selector/context entries that open different downstream response families. ### S4: `A0`-Contexted Selector Space Current best evidence says `A0` is not always just a neutral primer. On at least the `EC` and `E8` branches, it appears to be part of the context that opens the family space. Observed: - `A0 + E8` can produce `7A 50 26` family output - `A0 + EC` tends to produce `7B`-family output - `E8` without `A0` fell back to `07 80 40 40 30 ED` - `E9` without `A0` also fell back to `07 80 40 40 30 ED` - `EC` without leading `A0` falls back to `07 80 C0 40 30 6D` Nuance: - `A0` is not sufficient to make every selector deterministic. - A later control repeat of `A0 + E9` produced heartbeat only, even though earlier `A0 + E9` runs produced `07 80 7A 28 D3 5C`. Confidence: high that `A0` is contextual; medium on the exact scope of that context. ## `Ex` Selector Neighborhood These are the clearest currently mapped selector-like host entries. | Host-side entry | Typical downstream result | Current read | | --- | --- | --- | | `00 00 E6 40 30 CC` | `07 80 40 40 30 ED` after later heartbeat | heartbeat-family bias | | `00 00 E7 40 30 CD` | `07 80 40 40 30 ED` after later heartbeat | heartbeat-family bias | | `00 00 E8 40 30 C2` | `07 80 7A 50 26 D1` | stable selector into `7A` family | | `00 00 E9 40 30 C3` | `07 80 7A 28 D3 5C` | sibling selector into related `7A` family | | `00 00 EA 40 30 C0` | `07 80 C0 40 30 6D` after later heartbeat | alternate heartbeat-family bias | | `00 00 EB 40 30 C1` | `07 80 40 40 30 ED` after later heartbeat | heartbeat-family bias | | `00 00 EC 40 30 C6` | `07 80 7B 50 26 D0` or `07 80 FB 50 26 50` | selector into mixed sibling family space | Current interpretation: - this is not a flat command block - some `Ex` values bias toward heartbeat-family transients - some open structured `7A` / `7B` / `FB` families Confidence: medium-high ## Downstream Family Branches ### B1: `E8 -> 7A 50 26` Stable branch: ```text 00 00 A0 00 80 7A 00 00 E8 40 30 C2 -> 07 80 7A 50 26 D1 ``` What we know: - reproducible in group 1 - exact echo of `07 80 7A 50 26 D1` did not advance state - host-shaped mirror of `7A 50 26` did not advance state Read: - `E8` is the active selector - `7A 50 26 D1` is a downstream family response, not yet a meaningful next host turn Confidence: medium-high ### B2: `E9 -> 7A 28 D3` Stable branch: ```text 00 00 A0 00 80 7A 00 00 E9 40 30 C3 -> 07 80 7A 28 D3 5C ``` What we know: - reproducible in group 1 - exact and host-shaped replies to `7A 28 D3 5C` did not advance state - without `A0`, `E9` fell back to `07 80 40 40 30 ED` - with `A0`, a later control repeat returned only heartbeat, so this branch is less deterministic than `E8` Read: - `E9` looks like a sibling selector to `E8` - payload differences may represent page/class selection rather than random drift - `E9` appears more timing- or state-sensitive than `E8` Confidence: medium ### B3: `EC -> 7B / FB` Observed branch space: ```text 00 00 A0 00 80 7A 00 00 EC 40 30 C6 -> 07 80 7B 50 26 D0 or -> 07 80 FB 50 26 50 ``` Important details: - without leading `A0`, `EC` fell back to `07 80 C0 40 30 6D` - short and long spacing with `A0` still favored `07 80 7B 50 26 D0` - exact `7B` echo once produced: - `07 C0 2F 95 09 2E` - later `2F` follow-ups did not create a stable next stage - exact and host-shaped `FB` handling did not create a stable next stage Read: - `EC` is the most stateful selector branch seen so far - `A0` seems to be part of its selection context - `7B` is the most stable downstream family on this branch - `FB` is real but currently looks like a sibling observation, not a clear reply target Confidence: medium ## Current Transition Sketch ```text S0 idle/not-active -> host heartbeat cadence S1 host-present/cadence-held -> one-shot discovery query surface S2 discovery/query window -> selector/context entry S4 A0-contexted selector space -> E8 -> B1 (7A 50 26 family) -> E9 -> B2 (7A 28 D3 family) -> EC -> B3 (7B / FB family) -> E6/E7/EB -> heartbeat-family transient -> EA / no-A0-EC -> C0-family transient ``` What is still missing: - the transition from any of these branches into a stable active/session state - a deterministic multi-turn reply ladder ## What Feels Stable Right Now - RS-232 electrical layer and 6-byte frame model - idle heartbeat behavior - `CONNECT NOT ACT` not being identical to active/inactive protocol state - one-shot discovery surface - CALL synthetic event path - `Ex` neighborhood acting like a selector-like surface - `A0` mattering as branch context on at least `EC` ## What Still Feels Slippery - exact conditions that choose `7B` vs `FB` on `EC` - whether `E8/E9/EC` are true page selectors, class selectors, or partial capability requests - whether any downstream family reply is actually something the host is expected to answer - how this selector space relates to the real session activation handshake ## Best Next Uses Of This Map This map is meant to help us ask sharper questions, for example: - does `A0` act as selector context on `E8` and `E9`, not just `EC`? - do nearby `Ex` values continue the family strip? - do host `state/value` bytes on `A0` or `Ex` shift the selected family? - is there a separate session-maintenance stream that must coexist with these selector reads?