diff --git a/minimateplus/client.py b/minimateplus/client.py
index fb0ef16..3986f41 100644
--- a/minimateplus/client.py
+++ b/minimateplus/client.py
@@ -583,16 +583,20 @@ def _decode_compliance_config_into(data: bytes, info: DeviceInfo) -> None:
     The *data* argument is the raw bytes returned by read_compliance_config()
     (frames B+C+D concatenated, echo headers stripped).
 
-    Confirmed field locations (BE11529 with 3-step read, 2126 bytes):
+    Confirmed field locations (BE11529 with 3-step read, duplicate detection):
       - cfg[89]  = setup_name: first long ASCII string in cfg[40:250]
-      - cfg[??]  = record_time: float32 BE — offset TBD (scan below)
-      - cfg[??]  = sample_rate: uint16 or float — offset TBD (scan below)
+      - cfg[64]  = record_time: float32 BE (BE11529 shows 3.0 s) ✅ candidate
+      - cfg[52]  = sample_rate: uint16 BE (BE11529 shows 1024 Sa/s) ✅ candidate
       - "Project:"    needle → project string
       - "Client:"     needle → client string
       - "User Name:"  needle → operator string
       - "Seis Loc:"   needle → sensor_location string
       - "Extended Notes" needle → notes string
 
+    ⚠️  record_time and sample_rate offsets are confirmed candidates from
+    diagnostic scan but have NOT yet been validated by changing device settings
+    and re-reading.  Mark as ✅ once validated.
+
     Modifies info.compliance_config in-place.
     """
     if not data or len(data) < 40:
@@ -619,11 +623,16 @@ def _decode_compliance_config_into(data: bytes, info: DeviceInfo) -> None:
     except Exception as exc:
         log.warning("compliance_config: setup_name extraction failed: %s", exc)
 
-    # ── Record Time (⚠️ OFFSET UNCONFIRMED — waiting on diagnostic output) ──
-    # Previous guess of 0x28 was wrong (that offset holds "(L)" string).
-    # The correct offset will be clear once _cfg_diagnostic identifies it.
-    # Temporarily disabled to avoid returning a garbage value.
-    config.record_time = None   # TODO: set once offset confirmed from diagnostic
+    # ── Record Time — float32 BE at cfg[64] ──────────────────────────────────
+    # Diagnostic confirmed: cfg[64] float32_BE = 3.0 on BE11529 (set to 3 s).
+    # Previous guess of 0x28 was wrong (that offset holds the "(L)" label string).
+    # ⚠️  Validate by changing device record time and re-reading — mark ✅ once confirmed.
+    try:
+        if len(data) > 68:
+            config.record_time = struct.unpack_from(">f", data, 64)[0]
+            log.debug("compliance_config: record_time = %.3f s", config.record_time)
+    except Exception as exc:
+        log.warning("compliance_config: record_time extraction failed: %s", exc)
 
     # ── Project strings ───────────────────────────────────────────────────────
     try:
@@ -655,8 +664,15 @@ def _decode_compliance_config_into(data: bytes, info: DeviceInfo) -> None:
     except Exception as exc:
         log.warning("compliance_config: project string extraction failed: %s", exc)
 
-    # ── Sample rate (⚠️ OFFSET UNCONFIRMED — waiting on diagnostic output) ────
-    config.sample_rate = None   # TODO: set once offset confirmed from diagnostic
+    # ── Sample Rate — uint16 BE at cfg[52] ───────────────────────────────────
+    # Diagnostic confirmed: cfg[52] uint16_BE = 1024 on BE11529 (standard mode).
+    # ⚠️  Validate by changing device sample rate and re-reading — mark ✅ once confirmed.
+    try:
+        if len(data) > 54:
+            config.sample_rate = struct.unpack_from(">H", data, 52)[0]
+            log.debug("compliance_config: sample_rate = %d Sa/s", config.sample_rate)
+    except Exception as exc:
+        log.warning("compliance_config: sample_rate extraction failed: %s", exc)
 
     info.compliance_config = config