### Group `0x2B` host base-status polling (host → dev `0x13`)

PitHouse polls the wheelbase's runtime status (motor temperature, MOSFET
temperature, fault state, etc.) via `Group 0x2B`. Each poll is a 1-byte
sub-cmd; response echoes the sub-cmd and appends 2 bytes of value.

See [`../devices/wheelbase-0x13.md` § Group `0x2B`](../devices/wheelbase-0x13.md)
for the full read-only command table.

**Frame layout (request):**

```
7E [N] 2B 13 [cmd_id] [checksum]
```

**Frame layout (response):**

```
7E [N] AB 31 [cmd_id echo] [value: 2 B] [checksum]
```

`AB` = `0x2B | 0x80`; `0x31` = nibble-swap of `0x13`.

**Observed sub-cmds and response values** (from
[`sim/wheel_sim.py`](../../../sim/wheel_sim.py) `_plugin_probe_rsp`,
captures verified across multiple connects):

| Sub-cmd | Resp value | DB name | Notes |
|---------|------------|---------|-------|
| `0x01` | `00 00` | `state` | Operating state |
| `0x02` | `00 00` | `state-err` | Last error code |
| `0x04` | `01 2C` | `mcu-temp` | BE u16 = 300 (raw °C ×10 = 30.0 °C) |
| `0x05` | `01 2C` | `mosfet-temp` | BE u16 = 300 |
| `0x06` | `01 2C` | `motor-temp` | BE u16 = 300 |

Temperature decoding follows the
[`ServiceParameter` × 0.1 transform](../telemetry/service-parameter-transforms.md).

PitHouse polls the temperature triplet (`04`/`05`/`06`) every state-change
event (pause, session end, focus change). The bare `state` and `state-err`
reads happen at connect and on resume. A bare `Group 0x2B` frame addressed to
dev `0x13` with payload `02 00 00` is also observed — this is the synthetic
*probe* form generated by `MozaPlugin.ProbeMozaDevice` and is answered
directly by the sim's `_PROBE_SYNTH` table (it expects only that the response
arrives framed; payload echoed verbatim).

Plugin does not implement these polls.
