docs(abcip): #611 live member-write gate on Z35162 (native DINT/BIT/REAL members, restored)

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/drivers/AbCip.md

@@ -240,14 +240,14 @@ The driver has two interchangeable wire transports, selected by one `DriverConfi
 - ⚠️ **Native hardware evidence is narrow.** The read-only real-press gate (Task 21, 2026-10-08) proved native reads, browse
   and templates on Z-35162; a user-approved one-off on 2026-10-09 added **scalar native writes on a real CompactLogix**
   (DINT `test2`, BOOL `Program:UN01_Press.xxtest`, REAL `Program:ES03_EM03_Zone3._ff_test`: write, read back, restore, all
-  Good). Still ab_server-only: array, STRING and UDT-member writes and fragmented writes. Mixed STRING/array/scalar
+  Good), and the #611 gate added **native UDT member writes** (DINT, BIT and REAL members of `_EmptyTemperatureSegment`).
+  Still ab_server-only: array and STRING writes, libplctag member writes, and fragmented writes. Mixed STRING/array/scalar
   Multiple Service Packet reads (#582) are proven on the press (one 5-read MSP, values equal to single reads). Results:
   [native-ab-transport-gate-results](../plans/2026-10-07-native-ab-transport-gate-results.md).
 - **libplctag cannot be deleted yet.** Scalar native writes are proven on a CompactLogix (2026-10-09); what remains is #567
-  (fragmented wide-struct writes), array/STRING/UDT-member writes on hardware, and AbLegacy native (simulator-only, no PCCC hardware).
-- Discovered UDT **member writes** (#611) are likewise `ab_server`-only on both transports; the
-  BIT-member argument rests on a read-only hardware observation (the member reads as a 1-byte `0xC1`
-  BOOL). See [Member writes](#member-writes) for the candidate gate tag.
+  (fragmented wide-struct writes), array/STRING writes on hardware, and AbLegacy native (simulator-only, no PCCC hardware).
+- UDT **member writes** (#611) are proven on a real CompactLogix on the **native** transport only (2026-10-09); the
+  libplctag member-write path is `ab_server`-only. See [Member writes](#member-writes).
 - ⚠️ RESIDUAL (#567): wide-struct **fragmented writes** (8-byte alignment) are unit-tested only. Production
   presses are read-only and there is no bench controller, so this cannot be proven; it stays open until a
   bench controller exists.
@@ -465,10 +465,12 @@ when it is browse-committed in `/raw`, and that tag writes like any other atomic
   **libplctag** exposes only the size, cannot tell the two apart, and refuses both `BadNotSupported`. Native additionally refuses a same-width
   mismatch (REAL vs DINT) from the CIP type code — see [Native transport behaviour](#native-transport-behaviour).
   A refusal keeps the handle, warns once per tag and **does not touch driver health**.
-- **Not verified on a real controller.** Production presses are read-only, so member writes are proven on
-  `ab_server` only (Docker patch 0003 serves member paths). A candidate for a future *approved* write gate:
-  Z-35162 controller tag `_EmptyTemperatureSegment` (`UDT_TemperatureProfile_Segment`), which no logic
-  references — its members (`ID`, `Enable`, `RampTime`, …) are all zero and resolve as described above.
+- **Live gate (2026-10-09, user-approved, native transport, restored):** on Z-35162, controller tag
+  `_EmptyTemperatureSegment` (`UDT_TemperatureProfile_Segment`, referenced by no logic) — `ID` (DINT) 0→4242→0,
+  `Enable` (BIT member) false→true→false, `HoldTime` (REAL) 0→42.5→0; every write and read Good, and a full snapshot
+  of all ten members after each write and restore showed only the written member changed. The BIT member is the
+  only BIT in that UDT, so preservation of *sibling bits in the same host SINT* is still `ab_server`-proven only.
+  The libplctag member-write path was not exercised on hardware (ab_server only, Docker patch 0003).
 
 Pre-declared `Members` with `Writable: true` keep working as before — same write path, now width-checked
 (a mistyped declared member is refused where libplctag used to write it).