diff --git a/dwt/notes/CROSS.md b/dwt/notes/CROSS.md
index a4dab6f..9e3941b 100644
--- a/dwt/notes/CROSS.md
+++ b/dwt/notes/CROSS.md
@@ -61,7 +61,10 @@ Facts that change the transport assumption (details + quotes in
 2. **Wire format is binary, not text.** Request = `u32 be opcode` + opcode
    arguments (each word big-endian). Response framing =
    `u32 be (payload_len+1)` + `u8 flag` + payload. Opcode 7 is a no-op that
-   answers `00 00 00 07 00 "Done\n"` — the cheapest liveness test.
+   answers 11 bytes: `00 00 00 07 | 00 | 44 6F 6E 65 0A 00` (len field = 7 =
+   payload 6 + flag 1; payload is `"Done\n"` **plus its NUL**, because the
+   handler passes the 6-byte C string at `0x07EB6CE9`). The cheapest liveness
+   test.
 3. **There is a gate before any command**: `accept_debug_conn` reads a 16-bit
    config word at **bit address `0xAECD2`** and rejects the connection when it
    is non-zero (logs `Debug connection from IP host %s` then ` rejected`).
diff --git a/dwt/notes/rdebug-static.md b/dwt/notes/rdebug-static.md
index ad90907..dc1a65b 100644
--- a/dwt/notes/rdebug-static.md
+++ b/dwt/notes/rdebug-static.md
@@ -508,7 +508,8 @@ No allow-list and no confirmation dialog were found on this path.
    required; without it there is nothing to connect to).
 4. Connect to TCP port **771** and send `u32 be 7` (`0x00000007`) — opcode 7 is
    the no-op. A correct reply proves the accept path and framing:
-   `00 00 00 07 00 'D' 'o' 'n' 'e' '\n'`.
+   `00 00 00 07 | 00 | 44 6F 6E 65 0A 00` (11 bytes; the 6-byte payload
+   includes the NUL of `"Done\n"` and the length field counts payload+flag).
 5. If the handshake fires (`dwt_prf`) and replies with 16 bytes, capture them
    and try echoing them back; if the session survives, send
    `u32 be 2` + `u32 be <addr*8>` + `u32 be 4` and check for 4 bytes of ROM