Clarify Game and Service mode contracts and synchronization limits

README.md

@@ -27,6 +27,8 @@ This repository brings together the implementation, the research history, negati
 
 There is no honest completion percentage. Several essential steps still need measured proof. This is beyond a protocol sketch, but it is still several major milestones away from a usable full body tracking system. See [the detailed status and milestones](docs/PUBLIC_STATUS.md).
 
+**Game and Service:** Service supports tracker maintenance and OTA with the controllers powered off, reducing competition for the shared Roy radio. Game remotely requests mode1 on compatible custom tracker firmware and checks the actual applied state. Mode1 changes operating cadence; it does not by itself prove LED and camera phase synchronization or working controller coexistence. [Exact mode contracts](docs/ROY_AND_COEXISTENCE.md).
+
 ## Start here
 
 1. Read [QUICK_SETUP.md](QUICK_SETUP.md). It separates what is included from the source, assets and configuration you still need.

docs/ROY_AND_COEXISTENCE.md

@@ -1,5 +1,16 @@
 # Onboard Roy, SRAM lifecycle and controller coexistence
 
+## Game and Service are different operating contracts
+
+| Flow | Roy and tracker behavior | Controller requirement and evidence boundary |
+| --- | --- | --- |
+| Service | The service Roy RAM variant supports maintenance and the separately authorized tracker OTA path. Update operations use tracker mode0. It drops the game BLE phase lock and uses service scheduling. | Keep the normal controllers powered off for the reviewed service procedure. This reduces competition for the shared radio and is a coexistence precondition, not a guarantee of interference free RF. |
+| Game | The host remotely requests tracker mode1 from the compatible custom tracker firmware, then requires fresh identity and nonce bound replies showing the actual mode, N and pending state. | Eventual gameplay must coexist with the controllers. A controller off bench run does not prove that capability. The recorded 393-v2 mode1/N2/pending0 result proves only its bounded radio mode check. |
+
+Roy's game/service module choice and the tracker's mode0/mode1 state are related but separate state machines. Loading a Roy module does not itself prove that the tracker changed mode. A request ACK is also insufficient; observe the actual applied state and preserve the mode lease and cleanup gates.
+
+Here mode1 changes the custom tracker's operating timing/cadence to the Frame research configuration. It does not mean setting the tracker to the same RF carrier frequency as the headset, and it does not by itself establish phase synchronization with camera exposure. RF channel selection, polling cadence, tracker timer phase, LED emission timing and camera exposure are separate quantities. Phase commands and measured camera clock mappings need their own proof. Stable optical identity and optical plus IMU tracking remain unfinished.
+
 Roy is the onboard Nordic radio path. Temporary executable SRAM is firmware-specific; preserving stock flash does not make an arbitrary debugger operation harmless. Record checkpoint/readback, MPU layout, code/data ranges, cache/trace controls, stock image hash and exact executable source before mutation. No external receiver satisfies the target.
 
 Original210: code2043bytes under2045byte limit, CODE0x2001151c/entry0x2001151d, DATA0x20010c18/2048bytes, existing executable MPU region0x20011000..0x20012000 and static MPU count3. Native code hash`63d319d4b424bc5a291558e41d9a740962b20eeb33dba77ba288d0c1d0480575`. This is the admitted single-peer build. Do not enlarge limits or substitute a similarly named later source.

verification/PACKAGE_MANIFEST.json

@@ -166,8 +166,8 @@
   },
   {
     "path": "docs/ROY_AND_COEXISTENCE.md",
-    "bytes": 4341,
-    "sha256": "c80049b525b9612dded8d1d70ae6baf41991ba4f2789510e2c6b6bde73a9c2e1"
+    "bytes": 6147,
+    "sha256": "e9aec99a0b026df2bdd8350b824d457ea33c77465908e8ba646437c5e8380f0e"
   },
   {
     "path": "docs/SOFTWARE_AND_BUILD.md",
@@ -456,8 +456,8 @@
   },
   {
     "path": "README.md",
-    "bytes": 7958,
-    "sha256": "9c33fc91690773c4270aca531cd95e2280038723e429c89be3431d3ed11cba60"
+    "bytes": 8397,
+    "sha256": "ad9c826b0c41dc4b9e1489da3e7688208614706c4fbb59e2c38bb87b4d2fe1ed"
   },
   {
     "path": "research/INDEX.md",

verification/PACKAGE_VERIFICATION.json

@@ -2,8 +2,8 @@
   "verified": true,
   "files": 1097,
   "manifested_files": 1095,
-  "bytes": 61401151,
-  "local_links_checked": 44498,
+  "bytes": 61403396,
+  "local_links_checked": 44499,
   "allowlisted_extensions": [
     ".json",
     ".md",
@@ -50,8 +50,8 @@
     "public_edition_note": "Frozen handoff inventory/translation counts retained as provenance. 54 ledger entries from Hinata reference replace verbatim prose with links to attributed factual digest; IDs and original source locations retained. See PUBLICATION_CHANGES.json."
   },
   "errors": [],
-  "manifest_sha256": "f7c939f22f6b11882f8c3626e424bdbc00ccba8adceb24a5af16d38bc069dd84",
-  "completed_utc": "2026-10-15T11:03:31.257266+00:00",
+  "manifest_sha256": "4707d71b331bd3178fea25d43a4f79a5e58539eecc14f1a808901f89a1213bb0",
+  "completed_utc": "2026-10-15T11:12:53.604508+00:00",
   "publication_edition": true,
   "approved_presentation_assets": 2,
   "full_build_tested": false