gated run

docs/pt2-protocol.md

@@ -611,6 +611,68 @@ This fits the real panel behavior:
 - Correct fake-CCU traffic can wake it to `CONNECT:  OK`.
 - Without richer CCU state, readouts illuminate but show placeholders like `----`.
 
+## Active-State Local-Control Watch
+
+Bench evidence now suggests `CONNECT: OK` is maintained by an ongoing CCU refresh stream, not by one magic wake frame. This creates a useful local-control test: keep the RCP in the active state and press/turn physical controls while logging device TX.
+
+Two JSON scenarios are set up for that:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\active-control-report-watch-quiet.json --parity E --log captures\active-control-report-watch-quiet.txt --result-json captures\active-control-report-watch-quiet-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\active-control-report-watch-broad.json --parity E --log captures\active-control-report-watch-broad.txt --result-json captures\active-control-report-watch-broad-result.json
+.\.venv\Scripts\python.exe scripts\serial_scenario.py scenarios\active-control-report-watch-gated.json --parity E --log captures\active-control-report-watch-gated.txt --result-json captures\active-control-report-watch-gated-result.json
+```
+
+The quiet scenario sends the selector-zero OK seed, then refreshes `E000[0x0093]=0x9020` every 0.60 s. This is the lowest-noise active hold that has already kept `CONNECT: OK` alive.
+
+The broad scenario streams `E000[0x008F]=0x1800` and `E000[0x0093]=0xFFFF` every cycle. This is noisier, but may open more local-control/status gates.
+
+The gated scenario first seeds candidate secondary-table feature bits with command 6:
+
+```text
+06 00 15 80 00 C9  ; E400[0x0015] OTHERS/COPY visibility candidate
+06 01 0F 18 00 4A  ; E400[0x008F] shutter/OTHERS bits 11+12
+06 01 13 FF FF 4E  ; E400[0x0093] broad local-report/status gate candidate
+```
+
+Then it streams `E000[0x008F]=0x1800` and `E000[0x0093]=0x90FF`. This is the better next watch if quiet/broad E000-only refreshes do not produce local-control TX.
+
+After a run, summarize unexpected device frames with:
+
+```powershell
+.\.venv\Scripts\python.exe scripts\serial_scenario_unexpected.py captures\active-control-report-watch-quiet.txt --show-all
+.\.venv\Scripts\python.exe scripts\serial_scenario_unexpected.py captures\active-control-report-watch-broad.txt --show-all
+.\.venv\Scripts\python.exe scripts\serial_scenario_unexpected.py captures\active-control-report-watch-gated.txt --show-all
+```
+
+Expected refresh responses are ignored by default: heartbeat, table readbacks, and `02 00 02 00 00 5A`. Any remaining checksum-valid frame is a candidate local-control report. This is where physical button/dial reports should appear if the RCP only talks while the CCU keeps the selector tables active.
+
+The unexpected-frame summarizer also labels known autonomous button frames so they are not mistaken for newly unlocked controls:
+
+```text
+00 00 15 80 00 CF  ; known CALL active report
+00 00 15 00 00 4F  ; known CALL inactive report
+00 00 07 80 00 DD  ; known CAM POWER report
+```
+
+First quiet/broad watch captures on 2026-05-26 showed no unexpected checksum-valid frames in the observed window:
+
+```text
+active-control-report-watch-quiet: 114 detected frames, all expected refresh/heartbeat/readback
+active-control-report-watch-broad: 133 detected frames, all expected refresh/heartbeat/readback
+```
+
+Those runs stopped mid-scenario, so this is not a full negative proof. The practical interpretation is narrower: E000 active-state refresh alone did not make the pressed controls emit visible TX in the watched window. The gated command-6 version is the next ROM-supported test.
+
+The first gated watch capture produced a new periodic active-state response:
+
+```text
+02 00 04 00 00 5C  ; gated 0x0004 transition candidate, seen twice
+01 00 04 00 00 5F  ; gated 0x0004 active response candidate, seen 328 times
+```
+
+After treating those as expected gated refresh traffic, the capture had zero novel frames. A direct search found no known CALL/CAM POWER frames in that log. So the gated setup changed the session/status response shape, but it did not yet prove that physical controls beyond the already-known autonomous buttons are reporting.
+
 ## What Is Still Unknown
 
 - The official PT2 names for commands and selectors.
@@ -635,7 +697,7 @@ This fits the real panel behavior:
 5. Dump selector table state before and after CONNECT OK.
 6. Seed selectors `0x003`, `0x040`, and `0x0F6` after selector-zero OK and watch lamps/readouts.
 7. Mine selector dispatch handlers for known UI text terms: `IRIS`, `GAIN`, `SHUTTER`, `BARS`, `BLACK`, `CALL`, `AUTO`, `DIAG`.
-8. Build a fake-CCU streamer that repeatedly writes a small selector set and logs which RCP reports appear.
+8. Run the active-control watch scenarios and map any unexpected frames back to physical controls.
 
 ## Source Files And Reports