diff --git a/docs/micromate_protocol_reference.md b/docs/micromate_protocol_reference.md
index 9aaf771..222a595 100644
--- a/docs/micromate_protocol_reference.md
+++ b/docs/micromate_protocol_reference.md
@@ -1823,15 +1823,32 @@ independent POLL through the same relay, same moment : succeeds, correct respons
 
 **The unit is reachable.  The link is fine.  THOR is simply not asking.**
 
-Whatever THOR's UI reports in that window, it is wrong:
+**THOR reports `Connection Status: Connected`.**  Captured at 13:15, eleven
+minutes after its last contact with the unit:
 
-| if it shows | why it is false |
-|---|---|
-| connected / OK | nothing has been checked for minutes |
-| disconnected / unreachable | it **is** reachable — THOR stopped trying |
+```
+Connection Status : Connected            <- false; nothing checked in 11 min
+Last Updated      : 09/25/2026 01:04:22 PM   <- true, and that is the REFRESH
+Notification      : "Unable to download event(s) from UM12947 due to:
+                     Did not receive response from unit."  (01:03:31 PM)
+```
 
-The true state is *"I have given up checking this unit"*, and no display in THOR
-expresses it.  So an operator cannot separate **the unit is down** from **the
+Three things worth separating:
+
+1. **The green tile is false.**  It reports a live connection that has not been
+   exercised for eleven minutes.
+2. **`Last Updated` is true** — and it is the only honest field on the screen.
+   THOR *knows* when it last succeeded.  It renders that as small grey text under
+   the unit name, unhighlighted, with nothing marking it stale, beneath a large
+   green **Connected** tile.  The operator must read a timestamp and do mental
+   arithmetic to discover the headline is wrong.
+3. **The failure THOR did report was the download**, not the poller stopping.
+   Those are treated as unrelated events; nothing says "automatic checking has
+   ceased."
+
+So the state *"I have given up checking this unit"* is not merely undisplayed —
+THOR holds the data that would reveal it and presents a contradicting summary
+instead.  So an operator cannot separate **the unit is down** from **the
 poller is asleep** — and those demand completely different responses: a site
 visit versus a mouse click.
 
@@ -1846,6 +1863,10 @@ the unit, the modem, or the link.
 
 ### Design consequences for SFM
 
+0. **Connection status must EXPIRE.**  The single highest-value fix here.  If the
+   last successful check is older than a small multiple of the check interval,
+   the state is *stale / unknown* — never *Connected*.  THOR already has the
+   timestamp; it simply does not let it invalidate the summary.
 1. **Retry must be unbounded with backoff**, never one-and-done.  A transient
    link fault should not take a unit out of service until a human notices.
 2. **A manual check must restart the automatic loop**, or the UI must state