Sony-rcp/docs/pt2-state-map.md

Sony PT2 Protocol State Map

This document is a working state map for the Sony RCP-TX7 PT2-era control protocol as currently observed on the bench. It is intentionally more structural than pt2-protocol-summary.md: the goal here is to show how host inputs appear to move the panel between response families and contexts.

This is not yet a true finite-state-machine proof. It is a practical model of what currently seems to change the panel's response surface.

How To Read This

• state means an inferred protocol context, not a confirmed Sony term.
• stable means reproduced across multiple clean runs.
• unstable means seen more than once or clearly real, but not deterministic.
• one-shot means usually group-1 or post-boot only, then gone.

State Layers

The current evidence suggests the panel behavior is shaped by several layers:

1. physical/link state
2. host-presence / cadence state
3. selector / query context
4. downstream family response surface
5. unknown session-advance / active-control state

We have good evidence for layers 1-4. Layer 5 is still missing.

Baseline States

S0: Idle / Not Active

Observed behavior:

• RCP sends repeating heartbeat:
  • 00 00 00 00 80 DA
• LCD may remain idle or later enter CONNECT NOT ACT

Known transitions:

• host traffic can move the panel into parser-visible but still not-active states
• CALL and CAM POWER can still emit panel-origin frames here

Confidence: high

S1: Host Present / Cadence-Held

Observed behavior:

• repeating host heartbeat
  • 00 00 00 00 80 DA can keep the panel out of CONNECT NOT ACT while traffic continues
• this does not by itself create reusable reads or a full active session

Known side effects:

• some cadence patterns provoke transient families:
  • 07 80 40 40 30 ED
  • 07 80 40 60 30 CD
  • 07 80 C0 40 30 6D

Confidence: high

Discovery / Query Surface

S2: Discovery Query Window

Canonical shape:

00 00 00 00 80 DA
00 00 XX 00 80 checksum
-> 07 80 ...

Stable one-shot reads:

• 00 -> A0 -> 07 80 68 40 30 C5
• 00 -> B0 -> 07 80 6C 40 30 C1
• 00 -> B5 -> 07 80 6D 20 D8 48

Properties:

• usually one-shot after boot
• repeating the same query often drains to heartbeat only
• appears to be a readable/capability surface, not an activation handshake

Confidence: high

Event Path

S3: Synthetic CALL Event Path

Host stimulus:

00 00 15 80 00 CF
00 00 15 00 00 4F

Stable response:

• 07 80 45 20 D0 68

Sibling seen once:

• 07 80 45 30 D0 78

Properties:

• physical CALL button not required
• looks like a real event-path branch
• has not led to activation or reusable reads

Confidence: high

Selector-Like Context Surface

The strongest current "state map" behavior lives here. Certain host-side values look less like direct commands and more like selector/context entries that open different downstream response families.

S4: A0-Contexted Selector Space

Current best evidence says A0 is not always just a neutral primer. On at least the EC branch, it appears to be part of the context that opens the family space.

Observed:

• A0 + EC tends to produce 7B-family output
• EC without leading A0 falls back to 07 80 C0 40 30 6D

Confidence: medium-high

Ex Selector Neighborhood

These are the clearest currently mapped selector-like host entries.

Host-side entry	Typical downstream result	Current read
00 00 E6 40 30 CC	07 80 40 40 30 ED after later heartbeat	heartbeat-family bias
00 00 E7 40 30 CD	07 80 40 40 30 ED after later heartbeat	heartbeat-family bias
00 00 E8 40 30 C2	07 80 7A 50 26 D1	stable selector into 7A family
00 00 E9 40 30 C3	07 80 7A 28 D3 5C	sibling selector into related 7A family
00 00 EA 40 30 C0	07 80 C0 40 30 6D after later heartbeat	alternate heartbeat-family bias
00 00 EB 40 30 C1	07 80 40 40 30 ED after later heartbeat	heartbeat-family bias
00 00 EC 40 30 C6	07 80 7B 50 26 D0 or 07 80 FB 50 26 50	selector into mixed sibling family space

Current interpretation:

• this is not a flat command block
• some Ex values bias toward heartbeat-family transients
• some open structured 7A / 7B / FB families

Confidence: medium-high

Downstream Family Branches

B1: E8 -> 7A 50 26

Stable branch:

00 00 A0 00 80 7A
00 00 E8 40 30 C2
-> 07 80 7A 50 26 D1

What we know:

• reproducible in group 1
• exact echo of 07 80 7A 50 26 D1 did not advance state
• host-shaped mirror of 7A 50 26 did not advance state

Read:

• E8 is the active selector
• 7A 50 26 D1 is a downstream family response, not yet a meaningful next host turn

Confidence: medium-high

B2: E9 -> 7A 28 D3

Stable branch:

00 00 A0 00 80 7A
00 00 E9 40 30 C3
-> 07 80 7A 28 D3 5C

What we know:

• reproducible in group 1
• exact and host-shaped replies to 7A 28 D3 5C did not advance state

Read:

• E9 looks like a sibling selector to E8
• payload differences may represent page/class selection rather than random drift

Confidence: medium

B3: EC -> 7B / FB

Observed branch space:

00 00 A0 00 80 7A
00 00 EC 40 30 C6
-> 07 80 7B 50 26 D0
or
-> 07 80 FB 50 26 50

Important details:

• without leading A0, EC fell back to 07 80 C0 40 30 6D
• short and long spacing with A0 still favored 07 80 7B 50 26 D0
• exact 7B echo once produced:
  • 07 C0 2F 95 09 2E
• later 2F follow-ups did not create a stable next stage
• exact and host-shaped FB handling did not create a stable next stage

Read:

• EC is the most stateful selector branch seen so far
• A0 seems to be part of its selection context
• 7B is the most stable downstream family on this branch
• FB is real but currently looks like a sibling observation, not a clear reply target

Confidence: medium

Current Transition Sketch

S0 idle/not-active
  -> host heartbeat cadence
S1 host-present/cadence-held
  -> one-shot discovery query surface
S2 discovery/query window
  -> selector/context entry
S4 A0-contexted selector space
    -> E8 -> B1 (7A 50 26 family)
    -> E9 -> B2 (7A 28 D3 family)
    -> EC -> B3 (7B / FB family)
    -> E6/E7/EB -> heartbeat-family transient
    -> EA / no-A0-EC -> C0-family transient

What is still missing:

• the transition from any of these branches into a stable active/session state
• a deterministic multi-turn reply ladder

What Feels Stable Right Now

• RS-232 electrical layer and 6-byte frame model
• idle heartbeat behavior
• CONNECT NOT ACT not being identical to active/inactive protocol state
• one-shot discovery surface
• CALL synthetic event path
• Ex neighborhood acting like a selector-like surface
• A0 mattering as branch context on at least EC

What Still Feels Slippery

• exact conditions that choose 7B vs FB on EC
• whether E8/E9/EC are true page selectors, class selectors, or partial capability requests
• whether any downstream family reply is actually something the host is expected to answer
• how this selector space relates to the real session activation handshake

Best Next Uses Of This Map

This map is meant to help us ask sharper questions, for example:

• does A0 act as selector context on E8 and E9, not just EC?
• do nearby Ex values continue the family strip?
• do host state/value bytes on A0 or Ex shift the selected family?
• is there a separate session-maintenance stream that must coexist with these selector reads?