diff --git a/TASKS.md b/TASKS.md
index c0b91f4..527c89f 100644
--- a/TASKS.md
+++ b/TASKS.md
@@ -28,6 +28,12 @@
 - [x] mDNS sensor discovery (`esp-ctl discover`)
 - [x] Probe filter in esp-ctl (`listen -f probe`)
 - [x] OTA fleet to same firmware (ca526ef)
+- [x] CSI packet counter in STATUS (`csi_count=`)
+- [x] Raw uptime in STATUS (`uptime_s=`)
+- [x] WiFi reconnect EVENT emission
+- [x] SCANRATE command (BLE scan interval tuning, 5-300s)
+- [x] PROBERATE command (probe dedup cooldown tuning, 1-300s)
+- [x] Fix: promiscuous mode disables CSI on original ESP32 — guarded with `#if`
 
 ## Completed: v0.5 - BLE Scanning
 
@@ -89,8 +95,9 @@
 - NVS keys: `send_rate`, `tx_power`, `adaptive`, `threshold`, `ble_scan`, `target_ip`, `target_port`, `hostname`
 - EVENT packets now include sensor hostname: `EVENT,<hostname>,motion=... rate=... wander=...`
 - ALERT_DATA format: `ALERT_DATA,<hostname>,<deauth|disassoc>,<sender_mac>,<target_mac>,<rssi>`
-- STATUS now includes `temp=` field (chip temperature in Celsius)
+- STATUS now includes `temp=`, `uptime_s=`, `csi_count=` fields
 - PROBE_DATA format: `PROBE_DATA,<hostname>,<mac>,<rssi>,<ssid>`
-- Probe requests deduped per MAC (10s cooldown) to limit volume
+- Probe requests deduped per MAC (default 10s cooldown, tunable via PROBERATE)
 - mDNS service: `_esp-csi._udp` on data port (for sensor discovery)
 - HOSTNAME command: `HOSTNAME <name>` sets NVS + mDNS, `HOSTNAME` queries current
+- **ESP32 limitation:** Promiscuous mode (deauth/probe detection) disabled — breaks CSI. Works on ESP32-C6+.
diff --git a/docs/CHEATSHEET.md b/docs/CHEATSHEET.md
index e0131aa..9ab5c6f 100644
--- a/docs/CHEATSHEET.md
+++ b/docs/CHEATSHEET.md
@@ -34,7 +34,7 @@ idf.py reconfigure                      # Re-fetch managed components
 ## Remote Management (esp-cmd)
 
 ```bash
-esp-cmd <host> STATUS                   # Uptime, heap, RSSI, rate, version, adaptive, motion
+esp-cmd <host> STATUS                   # Uptime, heap, RSSI, rate, version, adaptive, motion, csi_count
 esp-cmd <host> IDENTIFY                 # LED solid 5s (find the device)
 esp-cmd <host> RATE 50                  # Set ping rate to 50 Hz (disables adaptive)
 esp-cmd <host> POWER 15                 # Set TX power to 15 dBm (NVS saved)
@@ -43,6 +43,8 @@ esp-cmd <host> ADAPTIVE OFF             # Disable adaptive sampling
 esp-cmd <host> THRESHOLD 0.005          # Set motion sensitivity (NVS saved)
 esp-cmd <host> OTA http://pi:8070/fw    # Trigger OTA update (use esp-ota instead)
 esp-cmd <host> HOSTNAME mydevice         # Set hostname (NVS saved, mDNS updated)
+esp-cmd <host> SCANRATE 60              # BLE scan restart interval (5-300s)
+esp-cmd <host> PROBERATE 5              # Probe dedup cooldown (1-300s)
 esp-cmd <host> REBOOT                   # Restart device
 ```
 
@@ -131,8 +133,8 @@ nc -lu 5500                             # Listen for CSI packets
 socat UDP-RECV:5500 STDOUT              # Alternative listener
 nc -lu 5500 | head -1                   # See one packet
 nc -lu 5500 | wc -l                     # Count packets/sec (Ctrl+C)
-esp-ctl listen -f probe -n 5            # Capture 5 probe requests
-esp-ctl listen -f alert                 # Monitor deauth/disassoc alerts
+esp-ctl listen -f probe -n 5            # Capture 5 probe requests (ESP32-C6+ only)
+esp-ctl listen -f alert                 # Monitor deauth/disassoc alerts (ESP32-C6+ only)
 ```
 
 ## Firmware Variants
@@ -172,6 +174,10 @@ ALERT_DATA,<hostname>,deauth|disassoc,sender_mac,target_mac,rssi
 PROBE_DATA,<hostname>,mac,rssi,ssid
 ```
 
+**Note:** On original ESP32, promiscuous mode (ALERT_DATA, PROBE_DATA) is disabled
+because it breaks CSI data collection at the driver level. These packet types are
+only generated on ESP32-C6 and newer chips.
+
 ## Source Paths
 
 | File | Purpose |