docs(series4): THOR shows "Connected" for 11 minutes after it stopped checking

Closes the question the last two commits left open -- what the UI actually shows
during the dead window.  It is the bad case.

Captured at 13:15, eleven minutes after THOR's last contact with the unit:

    Connection Status : Connected                  <- false
    Last Updated      : 09/25/2026 01:04:22 PM     <- true, and that is the REFRESH
    Notification      : "Unable to download event(s) ... Did not receive
                         response from unit."  (01:03:31 PM)

Three separable points:

  * The green tile is false -- it reports a live connection not exercised for
    eleven minutes.
  * Last Updated is TRUE, and is the only honest field on the screen.  THOR knows
    when it last succeeded; it renders that as small grey text under the unit
    name, unhighlighted and unmarked as stale, beneath a large green Connected
    tile.  The operator must read a timestamp and do arithmetic to find out the
    headline is wrong.
  * The failure THOR did report was the DOWNLOAD, not the poller stopping.  The
    two are treated as unrelated; nothing states that automatic checking ceased.

So the state is not merely undisplayed: THOR holds the data that would reveal it
and presents a contradicting summary instead.

Adds design consequence 0, ahead of the others because it is the highest-value
fix and the cheapest: connection status must EXPIRE.  If the last successful
check is older than a small multiple of the interval, the state is stale/unknown,
never Connected.  THOR already has the timestamp; it just does not let it
invalidate the summary.

Same screen independently corroborates four of our decodes: memory 14.94/15.00 MB
against the exact 15,000,000-byte total from SUB 0x1C; Unit Date/Time 01:04:20 PM
against the device clock at 0x1C data[13:21]; Scheduler Enabled against 0x47; and
Auto Call Home Disabled against the write[5]=0x04 observed in the 0x7E capture.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ru8Lg9HkkYvX9VWWo65SmL

docs/micromate_protocol_reference.md

@@ -1823,15 +1823,32 @@ independent POLL through the same relay, same moment : succeeds, correct respons
 
 **The unit is reachable.  The link is fine.  THOR is simply not asking.**
 
-Whatever THOR's UI reports in that window, it is wrong:
+**THOR reports `Connection Status: Connected`.**  Captured at 13:15, eleven
+minutes after its last contact with the unit:
 
-| if it shows | why it is false |
+```
-|---|---|
+Connection Status : Connected            <- false; nothing checked in 11 min
-| connected / OK | nothing has been checked for minutes |
+Last Updated      : 09/25/2026 01:04:22 PM   <- true, and that is the REFRESH
-| disconnected / unreachable | it **is** reachable — THOR stopped trying |
+Notification      : "Unable to download event(s) from UM12947 due to:
+                     Did not receive response from unit."  (01:03:31 PM)
+```
 
-The true state is *"I have given up checking this unit"*, and no display in THOR
+Three things worth separating:
-expresses it.  So an operator cannot separate **the unit is down** from **the
+
+1. **The green tile is false.**  It reports a live connection that has not been
+   exercised for eleven minutes.
+2. **`Last Updated` is true** — and it is the only honest field on the screen.
+   THOR *knows* when it last succeeded.  It renders that as small grey text under
+   the unit name, unhighlighted, with nothing marking it stale, beneath a large
+   green **Connected** tile.  The operator must read a timestamp and do mental
+   arithmetic to discover the headline is wrong.
+3. **The failure THOR did report was the download**, not the poller stopping.
+   Those are treated as unrelated events; nothing says "automatic checking has
+   ceased."
+
+So the state *"I have given up checking this unit"* is not merely undisplayed —
+THOR holds the data that would reveal it and presents a contradicting summary
+instead.  So an operator cannot separate **the unit is down** from **the
 poller is asleep** — and those demand completely different responses: a site
 visit versus a mouse click.
 
@@ -1846,6 +1863,10 @@ the unit, the modem, or the link.
 
 ### Design consequences for SFM
 
+0. **Connection status must EXPIRE.**  The single highest-value fix here.  If the
+   last successful check is older than a small multiple of the check interval,
+   the state is *stale / unknown* — never *Connected*.  THOR already has the
+   timestamp; it simply does not let it invalidate the summary.
 1. **Retry must be unbounded with backoff**, never one-and-done.  A transient
    link fault should not take a unit out of service until a human notices.
 2. **A manual check must restart the automatic loop**, or the UI must state