diff --git a/RESEARCH.md b/RESEARCH.md
index d4bf7f8..cd54cad 100644
--- a/RESEARCH.md
+++ b/RESEARCH.md
@@ -1066,3 +1066,38 @@ been reported — the first vidconsole puts (console_announce banner or
   enabled). Sequence of late checkpoints: yellow (misc_init_r) → pink
   (board_late_init) → light-gray (main_loop).
 - WDT still off (autostart=n).
+
+## Round 28 — reset mechanism identified: sync abort → panic → PSCI reset; PANIC_HANG to capture the dump
+
+Round 26/27 analysis (user: reset in <1 s after the black screen,
+WDT autostart already off). The reset mechanism is now proven from
+source, not guessed:
+
+- coreboot's mtk_wdt_init() DISABLES the MTK WDT (clears WDT_ENABLE);
+  depthcharge never touches it; U-Boot's mtk_wdt_probe() even stops
+  it. Hardware watchdog ruled out.
+- arch/arm/mach-mediatek/mt8183/init.c: reset_cpu() →
+  psci_system_reset() (SMC into BL31) — instant warm reset.
+- lib/panic.c: CONFIG_PANIC_HANG unset → panic() → do_reset() →
+  reset_cpu() → PSCI.
+- arch/arm/lib/interrupts_64.c: do_sync() → show_regs →
+  panic("Resetting CPU ...").
+
+⇒ ANY synchronous abort after the video probe = instant reset to the
+depthcharge menu, <1 s. Matches the observation exactly. (Also
+retroactively plausible for earlier "resets".)
+
+### Round 28 payload (`d1e78b0f…`, flashed, cmp+vbutil OK)
+
+CONFIG_PANIC_HANG=y — on an abort, U-Boot now prints the full
+exception dump ("Synchronous Abort" handler, esr, FAR, registers, PC)
+through the vidconsole and HANGS with the text visible instead of
+resetting. Plus R27's pink (board_late_init, y=860) and R26's
+light-gray (main_loop, y=900) bands.
+
+### Ask to the user
+
+Reboot, select Internal storage. Expect: bands → black → then either
+frozen black with WHITE TEXT (transcribe it! esr/FAR/ELR tell us the
+exact fault), or a hang at some band stage. Report the band stack
+(yellow/pink/gray) and any text.
diff --git a/krane-uboot-payload.bin b/krane-uboot-payload.bin
index 1c061b8..4bfb46a 100644
Binary files a/krane-uboot-payload.bin and b/krane-uboot-payload.bin differ
diff --git a/krane-uboot.bin b/krane-uboot.bin
index 86c7e45..9752e28 100644
Binary files a/krane-uboot.bin and b/krane-uboot.bin differ