docs(who-13): document observed DIMENSION 27 model name and oracle boundaries

.gitattributes

@@ -7,7 +7,14 @@ knowledge/** text eol=lf
 
 # Large complete Machine KB files; hydrate before reading or building.
 knowledge/claims/claims.jsonl filter=lfs diff=lfs merge=lfs -text
+knowledge/id-registry.json filter=lfs diff=lfs merge=lfs -text
+knowledge/inputs/claim-context.json filter=lfs diff=lfs merge=lfs -text
 knowledge/inputs/claim-records.json filter=lfs diff=lfs merge=lfs -text
+knowledge/inputs/id-registry.json filter=lfs diff=lfs merge=lfs -text
+knowledge/inputs/reference-records.json filter=lfs diff=lfs merge=lfs -text
+knowledge/llm/llm-corpus.md filter=lfs diff=lfs merge=lfs -text
+knowledge/reference/entities.jsonl filter=lfs diff=lfs merge=lfs -text
+knowledge/retrieval/chunks.jsonl filter=lfs diff=lfs merge=lfs -text
 
 # Preserve review tables byte-for-byte; hydrate before examining their evidence.
 project/review/**/*.tsv filter=lfs diff=lfs merge=lfs -text

functional/who-13-integration-gateway/dimensions.md

@@ -185,3 +185,31 @@ The evidence therefore establishes a readable gateway property with a two-value
 ZigBee `WHO 13` explicitly defines `DIMENSION 17` as hardware version. That is established for the ZigBee interface revision documented in [ZigBee Network Management](zigbee-network-management.md#dimension-16-and-17---firmware-and-hardware-versions), but numeric equality does not establish the same meaning for classic SCS/TCP gateways.
 
 `DIMENSION 20` has the separately scoped historical PIC-version interpretation above. That evidence does not establish a full version tuple or applicability to the F454/MH202 captures. The remaining questions are tracked in [Open Questions](../../reverse-engineering/open-questions.md#who-13-gateway-properties).
+
+## Observed implementation extension: `DIMENSION 27`
+
+`DIMENSION 27` is not defined by the preserved classic SCS/TCP `WHO 13` specification, the ZigBee `WHO 13` registry, or the canonical MyHOME Suite `3.5.38` `OPEN.db` functional model.
+
+Read-only physical gateway captures in `OpenWebNet-HA/MyHOME` at revision `eca7e51091ef75a2c10b74d0305fc9a8708624e4` establish a readable empty-`WHERE` machine-descriptor / model-name property on `*#13**27##` whose populated value is carried as `#`-separated decimal ASCII character codes inside a single `DIMENSION` parameter:
+
+- Physical `F461` Firmware `2.0.11` (`WHO 13` `DIMENSION 15 = 200`, diagnostic `WHO 1013` `DIMENSION 1` `OBJECT_MODEL = 134`) answered `*#13**27##` on the command session with `*#13**27*70#52#54#49##` (`"F461"`) followed by `*#*1##` (`ACK`) and mirrored `*#13**27*70#52#54#49##` on the event session ([Pinned F461 capture](https://github.com/OpenWebNet-HA/MyHOME/blob/eca7e51091ef75a2c10b74d0305fc9a8708624e4/tests/fixtures/traces/f461_live_2026-10-23/myhome_trace_F461_live_2026-10-23.json#L6358-L6411)).
+- Physical `MyHomeServer1` Firmware `3.87.13` (`WHO 13` `DIMENSION 15 = 200`, diagnostic `WHO 1013` `DIMENSION 1` `OBJECT_MODEL = 67`) answered `*#13**27##` on the command session with `*#13**27*77#121#72#111#109#101#83#101#114#118#101#114#49##` (`"MyHomeServer1"`) followed by `*#*1##` (`ACK`) and mirrored the same value frame on the event session ([Pinned MyHomeServer1 capture](https://github.com/OpenWebNet-HA/MyHOME/blob/eca7e51091ef75a2c10b74d0305fc9a8708624e4/tests/fixtures/traces/myhomeserver1_live_2026-10-24/myhome_trace_MyHomeServer1_live_2026-10-24.json#L1300-L1353)).
+
+In the pinned `own-firmware-oracle` `who13-identification` v3 suite at revision `836843800a25def1d14f40aa82d09dd0bf901db0` (`oracle_version=3`, full simulated-PIC harness, `reset=each` on `F450 020010` and `reset=0` on the other 11 targets, declared `settle_ms=3000`), `*#13**27##` never crashes a gateway daemon and produces four distinct command-socket outcomes across the 12 emulated gateway Firmwares:
+
+| Gateway model | Firmware | Command-socket `reply` / `verdict` | Recorded output (`*#13**27##`) | Decoded / framing note | Original result |
+| --- | --- | --- | --- | --- | --- |
+| F450 | `020010` | `ack` / `out` | `own:*#13**27*72#79#83#84##` | `"HOST"` (factory fallback) | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/F450/020010/oracle/full/who13-identification.tsv#L25) |
+| F453 | `010100` | `ack` / `out` | `own:*#13**27*66#84#87#69#66##` | `"BTWEB"` (recovery configuration) | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/F453/010100/oracle/full/who13-identification.tsv#L25) |
+| F453AV | `030014` | `ack` / `out` | `own:*#13**27*66#84#87#69#66##` | `"BTWEB"` (recovery configuration) | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/F453AV/030014/oracle/full/who13-identification.tsv#L25) |
+| F454 | `020051` | `ack` / `out` | `own:*#13**27*72#79#83#84##` | `"HOST"` (factory fallback) | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/F454/020051/oracle/full/who13-identification.tsv#L25) |
+| F459 | `020105` | `ack` / `out` | `own:*#13**27*72#79#83#84##` | `"HOST"` (factory fallback) | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/F459/020105/oracle/full/who13-identification.tsv#L25) |
+| F460 | `020012` | `ack` / `out` | `own:*#13**27*72#79#83#84##` | `"HOST"` (factory fallback) | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/F460/020012/oracle/full/who13-identification.tsv#L25) |
+| F461 | `020011` | `ack` / `out` | `own:*#13**27*72#79#83#84##` | `"HOST"` (factory fallback) | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/F461/020011/oracle/full/who13-identification.tsv#L25) |
+| H4684 | `020054` | `nack` / `silent` | `-` | Clean refusal | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/H4684/020054/oracle/full/who13-identification.tsv#L25) |
+| MH200 | `020102` | `-` / `out` | `own:*#13**27*#*#*1##` | Unterminated empty `*#13**27*#` + `*#*1##` | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/MH200/020102/oracle/full/who13-identification.tsv#L25) |
+| MH200N | `010108` | `-` / `out` | `own:*#13**27*#*#*1##` | Unterminated empty `*#13**27*#` + `*#*1##` | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/MH200N/010108/oracle/full/who13-identification.tsv#L25) |
+| MH202 | `010024` | `ack` / `out` | `own:*#13**27*72#79#83#84##` | `"HOST"` (factory fallback) | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/MH202/010024/oracle/full/who13-identification.tsv#L25) |
+| MyHomeServer1 | `028206` | `-` / `out` | `own:*#13**27*#*#*1##` | Unterminated empty `*#13**27*#` + `*#*1##` | [Pinned result](https://github.com/OpenWebNet-HA/own-firmware-oracle/blob/836843800a25def1d14f40aa82d09dd0bf901db0/results/MyHomeServer1/028206/oracle/full/who13-identification.tsv#L25) |
+
+On `MH200` Firmware `020102`, `MH200N` Firmware `010108`, and `MyHomeServer1` Firmware `028206` (whose staged factory configuration has an empty descriptor string, unlike the populated physical `MyHomeServer1` `3.87.13` unit above), the Firmware formats an unterminated `*#13**27*#` (a single `#` rather than `##`) concatenated directly on the command socket with `*#*1##`, yielding `own:*#13**27*#*#*1##` (`reply=-`). Because a `##`-delimited stream reader absorbs the command-session `*#*1##` `ACK` into that single malformed frame and never receives a separate `ACK` delimiter, clients must not send `*#13**27##` blindly on command sessions to gateways whose descriptor may be empty unless bounded by an explicit timeout and recovery policy, and decoders should treat generic fallback strings (`"HOST"`, `"BTWEB"`) and `*#13**27*#...` empty-descriptor artefacts as non-identifying for unique product discrimination. Write support (`*#13**#27*...##`), non-ASCII character encodings, maximum string length, and physical `H4684` / `MH200` hardware behavior remain unresolved; see [WHO 13 DIMENSION 27 model-name review](../../project/review/who13-dimension-27-model-name.md).