Bear with me, I'm a noob at this. I am trying to get an old Sony stereo amplifier/tuner deck (STR-D511) working with a JP1.x remote (URC-1067, i.e. "the red-button Comcast Remote"). The long-term plan is to control several devices (TV, DVD, stereo, from different vendors) from this remote, but I figured I should get the stereo working first since there are no known codes for it.
I have the original remote, but it is failing, and the usual fixes (conductive paint, tinfoil) don't hold for very long. I built a receiver for LIRC and grabbed the codes that I could from the original remote. It uses the SONY12 protocol, described at (http://www.sbprojects.com/knowledge/ir/sirc.php). Each code consists of a 5-bit device address and 7-bit command, sent LSB-first. It is mostly pretty straightforward, except for the multitude of addresses (the single "tuner" deck is expressed as multiple subsystems, e.g. the main volume, surround volume, channel presets, etc. all have separate addresses).
I bashed together a quick python script to display the LIRC captured codes in proper MSB-first (address, command) pairs. However, I can't seem to get these working with the JP1 remote. Mainly, I believe the deck is not responding to the addresses as captured by LIRC, or I am not entering them in RMIR correctly. Watching the output in (win)LIRC's IRGRAPH, the OEM remote sends many button codes with different addresses depending on the last input selected on the remote, and for some, sends a command with several addresses in sequence (LIRC's irrecord captures "a" code for these, but which one is anyone's guess.)
So, to find out which address(es) the deck responds to, I tried creating a device upgrade consisting of the command 0x00 (corresponding to "station preset 0") for addresses 0 ~ 15, mapped to the 0..9 buttons and a few others on the JP1 remote. However, none of them works. Pressing buttons on the reprogrammed JP1 remote and OEM remote side-by-side with IRGRAPH open, I notice a funny thing:
For a few of the addresses, the output looks correct compared to the OEM remote (but apparently they do not match any address the deck responds to). A proper code looks something like this. There is a long start pulse, the 7 command bits (0x00), followed by 5 address bits (this is address 0x01):

However, for others, I get a bizarre output that looks nothing like SONY12. An example:

The effect is repeatable and seems to key on the device address. Addresses 1, 2, 3, 5, 6, 11, 12, produce correct output; the rest produce the bizarre output.
This occurs on both the Sony Combo (12/15/20) and Sony Combo (12/20) protocols as defined in RMIR. (The "Sony12/15" option only supports 2 device addresses; whereas I've encountered no less than 8 for the same deck.)
So... I don't quite know where to go from here. I suspect I am not inputting the address in the format RMIR expects. Some questions for the gurus:
What format does RMIR expect for the address/command in the Sony Combo protocols? I.e. does it expect canonical numeric (MSB-first) representation, or LSB-first as sent by the remote? Since the command portion (corresponding to the 'Device' byte in RMIR's upgrade editor 'Functions' tab) is only 5 bits, does it expect those bits left- or right-justified? Same goes for the command portion: I chose cmd=0x00 for test as it is pretty safe from these issues, but someday I will want more than 1 button to work
Thanks in advance!