Zone bypass command (paradox/control/zones/<key>) silently has no effect on SP4000 (Spectra/Magellan)

[madmen2302]

Panel: SP4000, firmware 5.40 build 8 (Spectra/Magellan family), IP150 connection (module version 20, firmware 5.6)
PAI version: 3.7.0, Home Assistant OS add-on build

What I'm trying to do

Bypass a single zone (a PIR that has occasional false triggers from wind/birds) via MQTT, using the documented mechanism:

mqtt pub -t paradox/control/zones/<key> -m bypass

What I've verified works

• Partition control (paradox/control/partitions/Area_1 with arm/disarm/arm_stay/etc.) works reliably and has for weeks — confirmed via PAI's own logs (Partition command: Area_1=arm user: None etc., logged at INFO).
• PAI is healthy, connected, and processing other commands during all tests below (verified via docker logs).
• Confirmed via Correct method for bypassing zones #475 that this exact mechanism (MQTT switch with command_topic: paradox/control/zones/<key>, payload bypass/clear_bypass) has worked for at least one other MG-series panel (MG5050) owner.

What I've tried, and how I verified each attempt

I tried three plausible values for <key>, checked three different ways:

1. Zone_07 (the sanitized key used in the zone's own state topic, paradox/states/zones/Zone_07/open — matches sanitize_key()'s actual output for the panel's raw label "Zone 07", confirmed by calling it directly in the running container)
2. Zone 07 (the raw panel label with a space, as reported in Zone labels loaded: ... Zone 07 ... at startup)
3. 7 (raw numeric zone index)

Verification methods used for each, in order of reliability:

• docker logs (filtered and unfiltered, with --since, and live -f tailing) — the _mqtt_handle_zone_control handler logs at logger.info/logger.warning for received/accepted/refused, none of which ever appeared for any of the 3 key variants, even though the identical logging pattern for partition commands appears immediately and reliably.
• Enabled HOMEASSISTANT_PUBLISH_ZONE_PROPERTIES: [open, tamper, bypassed] + restart — no paradox/states/zones/Zone_07/bypassed topic was ever published, not even an initial false baseline, after startup.
• Enabled MQTT_PUBLISH_COMMAND_STATUS: true + restart, then live-subscribed to paradox/interface/command_status before publishing each test command — this is the code path that fires unconditionally on both "accepted" and "refused" outcomes inside _mqtt_handle_zone_control. Zero messages appeared for any of the 3 key variants.
• Live end-to-end test: armed the partition (armed_away) with the zone confirmed physically open at the time, watched Area_1.alarm flip to true — confirming the zone was not bypassed at the panel, despite the bypass command having been sent (and re-sent across multiple PAI restarts) beforehand.

Confirmed present in the installed package

• paradox/hardware/spectra_magellan/panel.py: control_zones() is implemented, ZONE_ACTIONS = dict(bypass=0x10, clear_bypass=0x10) is defined.
• paradox/interfaces/mqtt/basic.py: on_connect subscribes to get_control_topic_prefix("zone") + "/#" → confirmed via direct introspection in the running container that this resolves to paradox/control/zones, matching what I published to.
• paradox.py: control_zone(zone, command) does self.storage.get_container("zone").select(zone) — I could not find where zone objects get keyed (raw label vs sanitized) without instrumenting the running code further, which is why I'm filing this rather than continuing to guess against a live security panel.

Question

Is there a known-correct <key> format for this panel family that I'm missing, or is zone control simply not wired up correctly for SP4000/Spectra-Magellan specifically (separate from EVO, per the "MG branch is as-is" note in #475)? Happy to enable DEBUG logging and provide full logs of a live attempt if that's useful — this is a home/vacation-property panel I have full remote SSH access to for testing.