docs(traffic): what the sliced captures settled, and flag FB4s getting no frames

[pyramation]

Summary

A second, action-sliced capture set from the show machine (idle baseline → hand-sent OSC → signals probe walk → idle tail, 8 files) turned up one thing worth acting on, so decode now reports it and PROTOCOL.md records the rest.

169.254.45.4 (FB4E, id 566604) is getting no frames. It announces itself on UDP 9022 in every capture we have, but has zero TCP 3348 traffic in any of them — BEYOND streams to five of the six FB4s, so that projector could only ever have been dark. Announcing and being driven are different things, and only the second one lights a laser, so the device list now says which:

169.254.45.4     00:16:42:fb:04:2c  FB4E id=566604 settings=223
                 no frame stream — BEYOND is not sending to this device

streaming_ips(packets)  # both ends of every TCP 3348 flow
# flagged when the capture has streams at all but not to this device,
# so a discovery-only capture doesn't flag all six

Documented, not code:

• Why OSC can land and do nothing. Those captures deliver 90 OSC packets to port 8000 with no ICMP port-unreachable back, and carry zero packets on 16062 where the earlier paint capture had 675. Panel closed ⇒ no broadcast and gated livecontrol colour addresses, so "arrived" and "changed the colour" were never the same claim. Silence on 16062 is now written down as the first thing to check.
• The handshake is still unseen — no TCP SYN in any of the 8 files, so the encryption conclusion is unchanged and the only capture left worth taking is FB4s power-cycled with BEYOND started afterwards.
• Port roles, stated plainly, because packet counts mislead: 9022 is discovery only (38 packets in a 7s idle baseline); 3348 carries the frames at ~62/s per device, continuous even through a blackout. The frame-rate row in the types table widens to 16–62/s accordingly.
• The non-BEYOND routes, per Pangolin's wiki: FB4 takes OSC on 8000 for its own settings including operation_mode, and in ArtNet mode is a 16-/39-channel DMX fixture. Both control colour/brightness over SD-card content rather than arbitrary geometry. Untested — noted so it isn't rediscovered from scratch.

31 tests (4 new: streaming_ips both directions, discovery traffic isn't a stream, and the flag firing/not firing per device).

Link to Devin session: https://app.devin.ai/sessions/ec43152136134467a853ec0bbf783ea9
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring