feat(traffic): answer whether frames repeat, and make the remaining experiments one command each

[pyramation]

Summary

Two questions came back on PROTOCOL.md: do the encrypted frame bodies ever repeat, and would replaying the plaintext colour/intensity packets with BEYOND closed drive the lasers. This answers the first from captures we already have, and turns the second (plus the other open questions) into a single command an agent can run on the show machine.

Frames never repeat. decode --repeats hashes every 0x00030E02 body per TCP stream. Over 1,161 frames of static content across two captures — the best case for repetition — there are 1,161 distinct bodies, zero bytes constant across all frames, and zero bodies shared between two devices being sent the same scene. Consecutive bodies share 1–21 of 2,360 bytes where chance alone predicts ~9. So each frame carries a nonce/counter: a captured frame can't be replayed, and known-plaintext has nothing to bite on (identical looks → unrelated ciphertext). Recorded in PROTOCOL.md.

bin/session runs one open question end to end — starts the capture, tells the operator what to do at the machine, stops, decodes, and states what the result means, so the answer doesn't depend on getting a tshark filter right under pressure:

session handshake   close BEYOND → capture → launch BEYOND → check for a SYN on 3348
session osc-rgba    RGBA panel open → capture → send OSC → decode --timeline
session replay      transmits (below)

bin/replay builds BEYOND's own live-control lines byte for byte (b'ControlZone 3\r\nRGBA 0, 229\r\n'), amber/white/free colour, optional brightness sweep. It is the only thing in this repo that transmits toward the hardware, so it is gated twice — dry-run unless given both --transmit and an explicit --host, with no host discovery, so the destination is always something a human typed:

./bin/replay --zone all --colour amber --sweep         # prints 54 datagrams, sends nothing
./bin/replay --zone 1 --sweep --transmit --host <ip>   # sends

My expectation is that nothing happens: 16062 has only ever been observed host → network, and the FB4s take their orders on 3348, so this looks like BEYOND narrating itself rather than an input anyone accepts. It's still the only cheap experiment left whose result is unambiguous either way — hence the docs insisting on BEYOND closed (otherwise a change in the room proves nothing about its cause), eyes on the heads, E-stop in reach, never an unattended loop.

The "never transmits" claims in README.md, tools/traffic/README.md, packages/cli/README.md and PROTOCOL.md are narrowed to match reality rather than left true-in-spirit. Nothing the app runs is touched: the desktop Traffic panel exposes no replay or session command, so the app stays observation-only.

Tests pin the exact bytes (build_datagrams order: colour → alpha → brightness; sweep ramps 0→100→0) and the repeat metrics against synthetic repeated/distinct bodies, so a regression that quietly stopped detecting duplicates would fail.

Link to Devin session: https://app.devin.ai/sessions/ec43152136134467a853ec0bbf783ea9
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring