Sony-rcp/docs/pt2-state-map.md

Sony PT2 Protocol State Map

This document is a working state map for the Sony RCP-TX7 PT2-era control protocol as currently observed on the bench. It is intentionally more structural than pt2-protocol-summary.md: the goal here is to show how host inputs appear to move the panel between response families and contexts.

This is not yet a true finite-state-machine proof. It is a practical model of what currently seems to change the panel's response surface.

How To Read This

• state means an inferred protocol context, not a confirmed Sony term.
• stable means reproduced across multiple clean runs.
• unstable means seen more than once or clearly real, but not deterministic.
• one-shot means usually group-1 or post-boot only, then gone.

State Layers

The current evidence suggests the panel behavior is shaped by several layers:

1. physical/link state
2. host-presence / cadence state
3. selector / query context
4. downstream family response surface
5. unknown session-advance / active-control state

We have good evidence for layers 1-4. Layer 5 is still missing.

Baseline States

S0: Idle / Not Active

Observed behavior:

• RCP sends repeating heartbeat:
  • 00 00 00 00 80 DA
• LCD may remain idle or later enter CONNECT NOT ACT

Known transitions:

• host traffic can move the panel into parser-visible but still not-active states
• CALL and CAM POWER can still emit panel-origin frames here

Confidence: high

S1: Host Present / Cadence-Held

Observed behavior:

• repeating host heartbeat
  • 00 00 00 00 80 DA can keep the panel out of CONNECT NOT ACT while traffic continues
• this does not by itself create reusable reads or a full active session

Known side effects:

• some cadence patterns provoke transient families:
  • 07 80 40 40 30 ED
  • 07 80 40 60 30 CD
  • 07 80 C0 40 30 6D

Confidence: high

Discovery / Query Surface

S2: Discovery Query Window

Canonical shape:

00 00 00 00 80 DA
00 00 XX 00 80 checksum
-> 07 80 ...

Stable one-shot reads:

• 00 -> A0 -> 07 80 68 40 30 C5
• 00 -> B0 -> 07 80 6C 40 30 C1
• 00 -> B5 -> 07 80 6D 20 D8 48

Properties:

• usually one-shot after boot
• repeating the same query often drains to heartbeat only
• appears to be a readable/capability surface, not an activation handshake

Confidence: high

Event Path

S3: Synthetic CALL Event Path

Host stimulus:

00 00 15 80 00 CF
00 00 15 00 00 4F

Stable response:

• 07 80 45 20 D0 68

Sibling seen once:

• 07 80 45 30 D0 78

Properties:

• physical CALL button not required
• looks like a real event-path branch
• has not led to activation or reusable reads

Confidence: high

Selector-Like Context Surface

The strongest current "state map" behavior lives here. Certain host-side values look less like direct commands and more like selector/context entries that open different downstream response families.

S4: Context-Opened Selector Space

Current best evidence says the selector surface is opened not by a single magic byte, but by a small family of host-side context setters.

Observed:

• A0 + E8 can produce 7A 50 26 family output
• A0 + EC tends to produce 7B-family output
• 90 + E8 produced 7A 50 26
• 90 + E9 produced 7A 28 D3
• 90 + EC produced 7B 50 26
• AF + E9 produced 7A 28 D3
• AF + EC produced 7B 50 26
• AF + E8 produced the sibling FA 50 26 family
• bare heartbeat + E8 produced 7A 50 26
• bare heartbeat + E9 produced 7A 28 D3
• bare heartbeat + EC did not open 7B; it stayed in heartbeat-family behavior
• later downstream-behavior tests showed opener choice can also bias which sibling family appears at the selector result itself:
  • 90 + E8 produced 7A 58 26
  • 90 + EC produced FB 50 26
  • AF + EC preserved 7B 50 26

Nuance:

• A0 is not the only opener.
• A0 is not sufficient to make every selector deterministic.
• A later control repeat of A0 + E9 produced heartbeat only, even though earlier A0 + E9 runs produced 07 80 7A 28 D3 5C.
• EC appears stricter than E8/E9, because heartbeat alone was enough for E8/E9 but not for EC.
• opener choice has a stronger observed effect on branch entry than on downstream reply handling

Confidence: high that a context-opener family exists; medium-high on the exact rules for each selector.

Ex Selector Neighborhood

These are the clearest currently mapped selector-like host entries.

Host-side entry	Typical downstream result	Current read
00 00 E6 40 30 CC	07 80 40 40 30 ED after later heartbeat	heartbeat-family bias
00 00 E7 40 30 CD	07 80 40 40 30 ED after later heartbeat	heartbeat-family bias
00 00 E8 40 30 C2	07 80 7A 50 26 D1	stable selector into 7A family
00 00 E9 40 30 C3	07 80 7A 28 D3 5C	sibling selector into related 7A family
00 00 EA 40 30 C0	07 80 C0 40 30 6D after later heartbeat	alternate heartbeat-family bias
00 00 EB 40 30 C1	07 80 40 40 30 ED after later heartbeat	heartbeat-family bias
00 00 EC 40 30 C6	07 80 7B 50 26 D0 or 07 80 FB 50 26 50	selector into mixed sibling family space

Current interpretation:

• this is not a flat command block
• some Ex values bias toward heartbeat-family transients
• some open structured 7A / 7B / FB families

Confidence: medium-high

Downstream Family Branches

B1: E8 -> 7A 50 26

Stable branch:

00 00 A0 00 80 7A
00 00 E8 40 30 C2
-> 07 80 7A 50 26 D1

What we know:

• reproducible in group 1
• exact echo of 07 80 7A 50 26 D1 did not advance state
• host-shaped mirror of 7A 50 26 did not advance state
• opened by more than one context:
  • A0
  • 90
  • bare heartbeat
• AF has at least once shifted this branch to sibling FA 50 26 51
• 90 has at least once shifted this branch to sibling 7A 58 26 D9

Read:

• E8 is the active selector
• 7A 50 26 D1 is a downstream family response, not yet a meaningful next host turn
• context affects which sibling family E8 opens

Confidence: medium-high

B2: E9 -> 7A 28 D3

Stable branch:

00 00 A0 00 80 7A
00 00 E9 40 30 C3
-> 07 80 7A 28 D3 5C

What we know:

• reproducible in group 1
• exact and host-shaped replies to 7A 28 D3 5C did not advance state
• without A0, E9 fell back to 07 80 40 40 30 ED
• with A0, a later control repeat returned only heartbeat, so this branch is less deterministic than E8
• also opened by:
  • 90
  • AF
  • bare heartbeat

Read:

• E9 looks like a sibling selector to E8
• payload differences may represent page/class selection rather than random drift
• E9 appears more timing- or state-sensitive than E8

Confidence: medium

B3: EC -> 7B / FB

Observed branch space:

00 00 A0 00 80 7A
00 00 EC 40 30 C6
-> 07 80 7B 50 26 D0
or
-> 07 80 FB 50 26 50

Important details:

• without leading A0, EC fell back to 07 80 C0 40 30 6D
• 90 and AF also opened 7B 50 26
• bare heartbeat alone did not
• short and long spacing with A0 still favored 07 80 7B 50 26 D0
• exact 7B echo once produced:
  • 07 C0 2F 95 09 2E
• later 2F follow-ups did not create a stable next stage
• exact and host-shaped FB handling did not create a stable next stage

Read:

• EC is the most stateful selector branch seen so far
• EC needs a stronger context class than plain heartbeat
• 7B is the most stable downstream family on this branch
• FB is real but currently looks like a sibling observation, not a clear reply target
• opener choice can bias EC between 7B and FB

Confidence: medium

Current Transition Sketch

S0 idle/not-active
  -> host heartbeat cadence
S1 host-present/cadence-held
  -> one-shot discovery query surface
S2 discovery/query window
  -> selector/context entry
S4 A0-contexted selector space
    -> E8 -> B1 (7A / FA family space)
    -> E9 -> B2 (7A 28 D3 family)
    -> EC -> B3 (7B / FB family space)
    -> E6/E7/EB -> heartbeat-family transient
    -> EA / no-A0-EC -> C0-family transient

What is still missing:

• the transition from any of these branches into a stable active/session state
• a deterministic multi-turn reply ladder
• evidence that the downstream family frames are actually prompts the host is expected to answer, rather than readable blocks with no immediate follow-up
• evidence that even page-matched exact echoes are meaningful next-turn host replies; current tests still collapsed to heartbeat

What Feels Stable Right Now

• RS-232 electrical layer and 6-byte frame model
• idle heartbeat behavior
• CONNECT NOT ACT not being identical to active/inactive protocol state
• one-shot discovery surface
• CALL synthetic event path
• Ex neighborhood acting like a selector-like surface
• A0 mattering as branch context on at least EC

What Still Feels Slippery

• exact conditions that choose 7B vs FB on EC
• whether E8/E9/EC are true page selectors, class selectors, or partial capability requests
• whether any downstream family reply is actually something the host is expected to answer
• how this selector space relates to the real session activation handshake

Best Next Uses Of This Map

This map is meant to help us ask sharper questions, for example:

• does A0 act as selector context on E8 and E9, not just EC?
• do nearby Ex values continue the family strip?
• do host state/value bytes on A0 or Ex shift the selected family?
• is there a separate session-maintenance stream that must coexist with these selector reads?