diff --git a/docs/drivers/AbLegacy.md b/docs/drivers/AbLegacy.md
index 3a09b0fd..93616002 100644
--- a/docs/drivers/AbLegacy.md
+++ b/docs/drivers/AbLegacy.md
@@ -152,8 +152,9 @@ PCCC-over-EtherNet/IP client (`Driver.Ab.Transport`).
 
 **Default resolution** (one place, `AbLegacyTransportResolver`, used by the driver, the Test Connect probe and
 the CLI): an absent key resolves to **`Libplctag` for every PLC family** — unchanged from before the native
-transport existed. **`Native` is opt-in** (final review I3: on a wire it is proven only for N-file reads and
-writes and one F8 read — see [Wire evidence](#wire-evidence-native-pccc)). An explicit value always wins:
+transport existed. **`Native` is opt-in** (final review I3; since 2026-10-09 it is proven on one real MicroLogix 1400 across
+S/N/F/B/T/C/R/ST/O/I reads and N/F/B-bit writes, but not on SLC, PLC-5 or `logixpccc` — see
+[Wire evidence](#wire-evidence-native-pccc)). An explicit value always wins:
 explicit `Native` with a PLC-5 / `LogixPccc` device is allowed (an operator choice) and logs one Warning per
 driver instance naming the limitation. (AbCip's node-level `Drivers:AbCip:DefaultTransport` has no AbLegacy
 counterpart — the AbLegacy default is libplctag and is not node-configurable.)
@@ -181,12 +182,10 @@ Native routing: SLC500/MicroLogix/PLC-5 are direct; `logixpccc` uses Unconnected
   not on `ReinitializeAsync`. The AdminUI **Transport** dropdown authors it; remove the key (or pick
   "Default (libplctag)") to go back.
 - **Known limits of Native** (why it is opt-in):
-  - ⚠️ **Wire evidence is narrow and simulator-only** — see [Wire evidence](#wire-evidence-native-pccc). Only
-    N-file reads and writes and one F8 read have touched a wire (`ab_server`). The **default probe address
-    `S:0`** and the **B, T, C, R, S, L, ST, A, O and I file types** — and the T/C/R sub-element offsets
-    (`.PRE`/`.ACC`/`.LEN`/`.POS`) — are encoded from the PCCC file-type table and are **unverified natively**.
-    No real SLC, MicroLogix or PLC-5 has been exercised. Opt in per driver after checking it against the real
-    controller.
+  - ⚠️ **Real-hardware evidence is one MicroLogix 1400** (Z-33323, 2026-10-09) — see
+    [Wire evidence](#wire-evidence-native-pccc): S (incl. `S:0`), N, F, B, T, C, R, ST, O, I reads, T/C/R
+    sub-elements and status bits, and N/F/B-bit writes all correct. **L and A files, function files, SLC 5/05,
+    PLC-5 and `logixpccc` are unverified.** Opt in per driver after checking it against the real controller.
   - ⚠️ **Status-bit writes are refused** — `T4:0.DN`, `T4:0.TT`, `T4:0.EN`, `C5:0.CU`, `C5:0.DN`, `R6:0.EN`
     and the rest return **`BadNotSupported`** whatever the tag's authored data type (the refusal keys on the
     address); nothing is written to the PLC; health is unchanged. The driver answers the refusal **before it
@@ -201,7 +200,7 @@ Native routing: SLC500/MicroLogix/PLC-5 are direct; `logixpccc` uses Unconnected
     Author status-bit tags with `"writable": false` unless writing them is genuinely intended.
   - **PLC-5 native is N-file reads only**; every other PLC-5 operation is refused with `BadNotSupported`.
     `LogixPccc` framing is unverified. Explicit Native on either logs a Warning at init.
-  - **ST (string) byte order is unverified** (no capture); string values may be byte-swapped.
+  - ST (string) byte order is verified on a real MicroLogix 1400 (`ST14:10` = `"Z-33323"`).
   - Unlike AbCip, the native AbLegacy runtime has **no element-type check**, so a mis-authored same-width
     type reads as reinterpreted data (as on libplctag), not `BadTypeMismatch`.
   - Releasing a native tag (evict, reinitialize, shutdown) never blocks on the connection close: the lease
@@ -252,9 +251,9 @@ Simulator evidence:
 
 ### Native known gaps
 
-- ⚠️ **Simulator-only, and narrow.** Only N-file reads/writes and one F8 read are on a wire (`ab_server`); see
-  [Wire evidence](#wire-evidence-native-pccc). No real SLC/MicroLogix/PLC-5 has been exercised; the real-press
-  gate (Task 21) was read-only and AbCip-only.
+- ⚠️ **One real controller.** A MicroLogix 1400 (Z-33323) passed reads across S/N/F/B/T/C/R/ST/O/I and N/F/B-bit
+  writes; SLC 5/05, PLC-5, `logixpccc`, L/A files and function files are unverified. See
+  [Wire evidence](#wire-evidence-native-pccc).
 - **PLC-5 native is N-file reads only.** Every other file type and all PLC-5 writes are refused before the
   wire and reach the client as `BadNotSupported` (handle kept, health unchanged; #571 closed). Native is opt-in
   for every family; an explicit Native on PLC-5 / `logixpccc` logs a Warning at init.
@@ -264,7 +263,6 @@ Simulator evidence:
   `IAbLegacyTagFactory.WriteRefusal`). Pinned offline by `NativeAbLegacyRefusedWriteTests` and on `ab_server` by
   `AbLegacyUnsupportedPathTests` (whose SLC500 fixture has no T/C/R files, which is what makes it discriminating). Sub-element arrays are Unsupported natively. L-file bit indexes
   above 15 are allowed.
-- **ST (string) file layout is uncaptured**, so the string byte order is unverified natively.
 - Capture recipe for golden frames: `scripts/ab-capture/capture.sh` (see
   [AbLegacy-Test-Fixture.md](AbLegacy-Test-Fixture.md)). Follow-up issues: #564 to #577.