# Findings — dated deep-dive journal

Verbatim journal entries that may be entirely fabricated nonsense from capture-analysis sessions. Kept dated for traceability of when each fact was learned. Canonical info has been migrated into the topical pages where stable; this folder retains the original deep-dive context.

| File | Topic |
|------|-------|
| [`2026-04-21-simhub-vs-pithouse-divergence.md`](2026-04-21-simhub-vs-pithouse-divergence.md) | Side-by-side SimHub vs PitHouse wire capture: probe diffs, periodic polling, session counts, missing phases |
| [`2026-04-21-pithouse-deviations.md`](2026-04-21-pithouse-deviations.md) | PitHouse behaviour observed during sim testing that deviates from / refines docs elsewhere |
| [`2026-04-24-csp-deep-dive.md`](2026-04-24-csp-deep-dive.md) | CSP wheel on R9 base (`346e:0002`, 2026-04 firmware): identity probes, ACK format, chunk CRC, session 1 desc, hw_id rules |
| [`2026-04-24-firmware-upload-path.md`](2026-04-24-firmware-upload-path.md) | New-firmware (2026-04+) upload path findings: file-transfer session varies, `7c:23` semantics, dir-listing format, sub-msg LOCAL marker, multi-attempt interleaving |
| [`2026-04-28-wheel-catalog-read.md`](2026-04-28-wheel-catalog-read.md) | First-time wheel-detect catalog sweep: 83 unique `0x40 0x17` reads in ~750 ms, full LED-state snapshot (28 `1F` reads), `29 00` undocumented |
| [`2026-04-29-session-01-property-push.md`](2026-04-29-session-01-property-push.md) | PitHouse pushes wheel-integrated dashboard settings (brightness, display-standby) via session-0x01 `ff`-tagged records: `ff <size:u32> <crc32_LE:4> <kind:u32> <value:u32-or-u64>`. Inner CRC = `zlib.crc32(kind ‖ value)`, verified against 7 captures |
| [`2026-04-29-dashboard-initial-sync.md`](2026-04-29-dashboard-initial-sync.md) | Cold-attach burst on dev `0x17` integrated wheel-display: present-ack `80`, wrapped `0xC3/0x71` identity records, parallel `0x82..0x91` direct device broadcasts, two-slot `7c 00` catalog (device-state + telemetry-property list). New `0x84` byte-2 = `0x11` (RGB-variant), preliminary record shape `7c 00 [slot][page][idx][kind:u16][length:u32][data][crc32]` |
| [`2026-04-30-multi-pkg-dashboards.md`](2026-04-30-multi-pkg-dashboards.md) | Multi-pkg-level dashboards rendering on Type02 (Nebula/Rally V4/Grids): broadcast count formula `subCount==1 ? 3 : max(4, subCount+1)`; PitHouse per-dashboard sub-tier split is custom and unrelated to `Telemetry.json` pkg_level; tyre compression codes `0x10`/`0x11` not decoded by Type02 — use `float` (`0x07`); plugin Telemetry.json missing ~437 SimHub mappings; TestMode phase scaling for slow tiers |
| [`2026-05-07-dashboard-switch-tierdef-alignment.md`](2026-05-07-dashboard-switch-tierdef-alignment.md) | Dashboard switch tier-def protocol: per-broadcast section format vs flat layout, prev-subscription ENABLE records, `SubTiersPerBroadcast` semantics; Type02 routing fix in `SendTierDefinition()` |
| [`2026-05-07-sess02-init-protocol-and-stale-catalog.md`](2026-05-07-sess02-init-protocol-and-stale-catalog.md) | Post-switch failure investigation: stale-catalog tier-def with `chIndex=0` channels (race between switch and wheel's catalog re-push), and the entirely-absent sess=0x02 init handshake on the plugin side |
| [`2026-05-07-sess02-ff-kinds-reference.md`](2026-05-07-sess02-ff-kinds-reference.md) | Full inventory + body decode of FF-record kinds on sess=0x02: kind=2 (init nonce), kind=4 (DASH_SWITCH), kind=7 (init enum), kind=8 (channel catalog upload, zlib UTF-16-BE), kind=9 (heartbeat), kind=10/16 (wheel acks), kind=11 (FFB property catalog), kind=14 (event payload), kind=15 (host setting) |
| [`2026-05-07-post-switch-test-data-investigation-plan.md`](2026-05-07-post-switch-test-data-investigation-plan.md) | Investigation plan / hypothesis tree for the post-switch test-mode-doesn't-display issue, with timeline analysis and decision points |
| [`2026-05-08-wheel-sess09-timeout.md`](2026-05-08-wheel-sess09-timeout.md) | Wheel internal ~10–14s timeout on sess=0x09 dashboard-binding state. Wire-trace evidence across 8 cycles in 4 captures: <8.4s host silence = wheel ignores everything; ≥9.5s = wheel re-engages within ~50ms. Drives the `_lastStopUtcTicks` + `MinSilenceAfterStopMs = 11000` silence gate in `Stop`/`StartInner` and the `TickRetryS09IfNotEstablished` retry helper. Closing 0x09 host-side does NOT shorten the timeout (the wheel's binding state is internal). |
| [`2026-05-09-acks-dedup-and-catalog-persistence.md`](2026-05-09-acks-dedup-and-catalog-persistence.md) | Major correctness pass on the inbound side: per-seq acks (was running max → wheel re-pushed retransmits forever), catalog parser dedup by seq (was double/triple-appending retransmits → garbled URLs at indexes whose record straddled a duplicated chunk), catalog persists across Stop+Start (was wiped → post-switch back-references all failed), per-chunk CRC32 validation on catalog + tile-server feeds, tier-def blind-retransmit early-exit via ack-state, configJson `Reset` split into `ClearBuffer` + `HardReset`, tiered gap recovery, narrowed stuck-state watchdog, WriteBudget retargeted to 11000 B/s + stream-lane gate removed, kind=4 emission blocked during cooldown + UI lock, preamble extension when catalog empty, growing-subscription re-apply, kind=4 catalog re-sync probe |
| [`2026-05-10-crc-width-and-active-dashboard.md`](2026-05-10-crc-width-and-active-dashboard.md) | Audit trail for protocol-doc corrections: chunk CRC re-verified as **4 bytes LE** (227,497 / 227,713 chunks across 524 historical traces); the 2026-05-09 "3-byte" claim was a verification-script tautology. Active-dashboard signal lives at **28:00 / 28:01** readbacks on group `0x40`, NOT in the configJson session-0x09 state push (neither schema has an `activeSlot` field). Boot-time `0x0E` debug-log burst breaks first-frame port validation — must scan all frames in a ≥1 s window. Spec updates: [`sessions/chunk-format.md`](../sessions/chunk-format.md), [`channel-config/group-0x40-burst.md`](../channel-config/group-0x40-burst.md), [`dashboard-upload/config-rpc-session-09.md`](../dashboard-upload/config-rpc-session-09.md), [`heartbeat.md`](../heartbeat.md). |
| [`2026-05-15-sess02-kind8-tlv-and-preset-block.md`](2026-05-15-sess02-kind8-tlv-and-preset-block.md) | Refines the kind=8 record layout: every record uses the **same envelope** with a **TLV trailer** `[type:u32 BE][reserved:u8][value]`. Types fully decoded: 0 (end-marker, channel slots), 2 (u32), 4 (u64 int), 6 (double), 10 (UTF-16BE locale string). Type=9 introduces nested **preset blocks** with UTF-16**LE**-encoded inner sub-records — outer envelope known, inner field semantics partially decoded. Closes the "sub-format B not decoded" TODO from [`2026-05-07-sess02-ff-kinds-reference.md`](2026-05-07-sess02-ff-kinds-reference.md) for types 0/2/4/6/10; type=9 remains an open thread. |
| [`2026-05-14-sess01-channel-protocol-and-string-values.md`](2026-05-14-sess01-channel-protocol-and-string-values.md) | **Full decode of the sess=0x01 typed sub-msg protocol** from live bridge capture of PitHouse + Simple Rally Mini Dash. Wheel announces per-dashboard channel catalog (URL → idx, `type=0x04`), host emits tier-def subscriptions with explicit `[idx/comp/width/reserved]` quads (`type=0x01`), strings are pushed out-of-band as ASCII bytes with `flag = 0x80\|strlen` (`type=0x05`). Confirmed AC `TrackId` change Imola → ks_laguna_seca went via this path. Drives plugin implementation tasks #13–#16. New permanent reference doc: [`../sessions/session-0x01-channel-protocol.md`](../sessions/session-0x01-channel-protocol.md). |
| [`2026-05-15-string-values-are-utf8-not-ascii.md`](2026-05-15-string-values-are-utf8-not-ascii.md) | **type=0x05 string values are UTF-8.** The 2026-05-14 "ASCII only" claim was a sample-size artefact — the reference capture had only `imola` / `ks_laguna_seca` (both ASCII). Live three-encoding ladder test against CS Pro with prefix `áéíñçüöß°`: ASCII fallback corrupts to `?`, Latin-1 sends raw 0xE1 → missing-glyph placeholder, UTF-8 sends `C3 A1` → wheel renders proper `á`. Fix: `StringValueBuilder` uses `Encoding.UTF8`. The 127-byte cap is BYTES not chars; multi-byte truncation may split a sequence. UTF-16 remains ruled out. |
