docs(ablegacy): #592 real MicroLogix 1400 evidence (native reads/writes pass; libplctag fails S/O/I/status bits)

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/drivers/AbLegacy.md

@@ -210,18 +210,45 @@ Native routing: SLC500/MicroLogix/PLC-5 are direct; `logixpccc` uses Unconnected
 
 ### Wire evidence (native PCCC)
 
-Everything below is against the `ab_server` simulator; no real PCCC controller has been exercised.
+**Real controller (2026-10-09, user-directed):** MicroLogix 1400 **Z-33323** (`ab://10.201.44.231/`, empty path),
+chosen because it was idle (`N10:150/0` cycle-in-progress and `B3:0/4` false, pump input `I:0/0` off, `O:0` = 0
+before and after). Read pass, each address on libplctag then native (raw output in
+[the gate-results doc](../plans/2026-10-07-native-ab-transport-gate-results.md)):
+
+| Address(es) | libplctag | Native |
+|---|---|---|
+| `S:0` (default probe), `S:57` (= 1400), `S:4` | **BadCommunicationError** | Good (4, 1400, clock) |
+| `N9:0`, `N9:4`, `N7:255` | Good | Good, equal |
+| `F8:226` (2.1), `F8:214` (200.0) | Good | Good, equal |
+| `B3:24`, `B3:28` (0x0905), bits `/0`, `/8`, `/9`, `B3:132/14` | Good | Good, equal |
+| `T4:15/93/14/11.PRE`, `.ACC`, `.DN`; `T40:3/12.PRE` | Good | Good, equal |
+| `C5:0.PRE/.ACC`, `C5:1.PRE`, `C5:8.DN` | Good | Good, equal |
+| `R6:0.LEN`, `.POS` | Good | Good, equal |
+| `R6:0.DN` (and `.EN`) | **BadCommunicationError** | Good |
+| `ST14:10` (`"Z-33323"`), `ST14:0` | Good | Good, equal — **ST byte order correct** |
+| `O:0`, `O:0/3`, `I:0`, `I:0/0` | **BadCommunicationError** | Good |
+
+Native writes on the same idle press, each restored to 0 and verified: `N7:23` 0→4242→0 (neighbours `N7:22/24`
+unchanged), `F8:190` 0→42.5→0, `B3:200` bit RMW `/5` set → 32, `/3` set → 40, `/5` clear → 8, `/3` clear → 0
+(neighbours `B3:199/201` unchanged). Addresses vetted against the sibling Z-33756 program export (no ladder,
+symbol, HMI, panel or migration reference) and Z-33323's own symbol table, and read 0 beforehand.
+⚠️ **libplctag (the default) cannot read `S`, `O`, `I` or control status bits on this controller**, and the
+numbered forms (`S2:0`, `O0:0`, `I1:0`) are rejected by the address parser — so the default probe `S:0` fails on a
+real MicroLogix under the default transport (tracked as a follow-up issue). Not tested on hardware: L and A files
+(no press has them), function files, PLC-5, SLC, `logixpccc`.
+
+Simulator evidence:
 
 | What | Evidence |
 |---|---|
 | N-file read (`N7:0`) | libplctag captures `slc500-read-n7`, `micrologix-read-n7`, `plc5-read-n7` (codec byte parity) + native `AbLegacyReadSmokeTests` read on all three profiles |
 | N-file write (`N7:5`) | capture `slc500-write-n7` + native `AbLegacyReadSmokeTests` write/read round trip (SLC 500) |
 | F-file read (`F8`) | one capture, `slc500-read-f8` (codec parity only; no native F write on a wire) |
-| S (incl. the default probe `S:0`), B, T, C, R, L, ST, A, O, I | **none** — encoded from the PCCC file-type table |
+| S (incl. `S:0`), B, T, C, R, ST, O, I | **real MicroLogix 1400 (above)**; L and A: none |
 | MicroLogix function files (RTC/HSC/...), PLC-5 octal I/O | **none** — parsed only; native refuses function files as Unsupported |
 | Bit-within-word write (`B3:0/5`) | `ab_server` SLC500 + MicroLogix, both transports (`AbLegacyBitWriteTests`): the driver RMWs the parent word, only the addressed bit changes (the parent-word read-modify-write is not atomic against ladder writes to the same word). PLC-5 native refuses it (`BadNotSupported`, #571) |
 | Indirect addressing (`N7:[N7:0]`) | `ab_server` N-file, both transports (#646) - resolved by the driver, the transport sees the composed address |
-| T/C/R sub-elements (`.PRE`/`.ACC`/`.LEN`/`.POS`), 6-byte T/C/R element layout | **none** |
+| T/C/R sub-elements (`.PRE`/`.ACC`/`.LEN`/`.POS`, status bits) | **real MicroLogix 1400 (above)** |
 
 ### Native known gaps