Document BullTron live BLE capture

docs/command-catalog.md

@@ -2,6 +2,9 @@
 
 Status: decompiled from BullTron Android app `1.1.33`. Entries are based on code paths, not live BLE captures.
 
+Update: the main BLE flow and several command frames are now confirmed by an
+Android HCI snoop capture. See `docs/live-capture.md`.
+
 ## Services
 
 | Service UUID | Purpose | Evidence |
@@ -94,6 +97,38 @@ For `D206` and `D210` responses, the app treats the acknowledgement as a fixed 8
 | Single register write | `fff2` | write hex frame | `D206<register><value><crc>` | `D206` ack | Generic settings/control write |
 | Multi-register write | `fff2` | write hex frame | `D210<start><count><payload><crc>` | `D210` ack | Generic settings/config write |
 
+## Live Capture Confirmed Reads
+
+The following read frames were observed in the HCI snoop capture. All listed
+frames have valid Modbus CRC16 using the app's swapped CRC representation.
+
+| Payload | Start | Count | Notes |
+| --- | ---: | ---: | --- |
+| `D2030000003ED7B9` | `0x0000` | `0x003E` | Main live telemetry block |
+| `D203003E0009F7A3` | `0x003E` | `0x0009` | Extra cell/pack data block |
+| `D2030057000CE7BC` | `0x0057` | `0x000C` | Additional info/status block |
+| `D20300640001D676` | `0x0064` | `0x0001` | Residue time / heating flag |
+| `D20300800029965F` | `0x0080` | `0x0029` | Settings/system block |
+| `D20300A900208791` | `0x00A9` | `0x0020` | System/settings block |
+| `D20300A900254792` | `0x00A9` | `0x0025` | Extended system/settings block |
+| `D20300C90003C656` | `0x00C9` | `0x0003` | Password/control-code field |
+| `D20300CC00021797` | `0x00CC` | `0x0002` | Small settings/status field |
+| `D20300D900054791` | `0x00D9` | `0x0005` | Small settings/status field |
+
+The capture also confirms time sync:
+
+```text
+D21000D400031A070A122E2C9FE4
+```
+
+with acknowledgement:
+
+```text
+D21000D40003D393
+```
+
+The system/settings screen writes `AT+PRODUCTINFO=?` to `fff3`.
+
 ## Live Telemetry Register Map
 
 Read command: