diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/include/loop_uart_proto.h b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/include/loop_uart_proto.h
index 12e84df..882e200 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/include/loop_uart_proto.h
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/include/loop_uart_proto.h
@@ -236,4 +236,8 @@ void lup_frame_reset(void);
 /* --- Process a complete frame (call from main loop context) --- */
 void lup_process_frame(const uint8_t *pkg, uint16_t len);
 
+/* --- Sensor report callback (called when valid 0xC0 frame received) --- */
+typedef void (*lup_sensor_cb_t)(const uint8_t *pkg, uint16_t len);
+void lup_set_sensor_callback(lup_sensor_cb_t cb);
+
 #endif /* __LOOP_UART_PROTO_H__ */
diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/loop_uart_proto.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/loop_uart_proto.c
index 19ca6b6..49d16de 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/loop_uart_proto.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/loop_uart_proto.c
@@ -653,11 +653,21 @@ int lup_feed_byte(uint8_t byte)
     return 0;
 }
 
+/*===========================================================================
+ * Sensor Report Callback
+ *===========================================================================*/
+static lup_sensor_cb_t g_lup_sensor_cb = NULL;
+
+void lup_set_sensor_callback(lup_sensor_cb_t cb)
+{
+    g_lup_sensor_cb = cb;
+}
+
 /*
  * 收到完整帧后的处理：
  *  1. 校验 checksum
- *  2. 如果是当前命令的响应 → 通知状态机
- *  3. 如果是主动上报 (0xC0) → 处理传感器数据
+ *  2. 如果是主动上报 (0xC0) → 调用回调（网络推送等）
+ *  3. 如果是命令响应 → 匹配挂起命令
  */
 void lup_process_frame(const uint8_t *pkg, uint16_t len)
 {
@@ -683,10 +693,11 @@ void lup_process_frame(const uint8_t *pkg, uint16_t len)
     // --- Dispatch by CMD ---
     uint8_t cmd = pkg[3];
 
-    // Active reports (0xC0) are NOT responses to commands
+    // Active reports (0xC0) → trigger callback for network/upstream forwarding
     if (cmd == LUP_CMD_SENSOR_REPORT) {
-        // Sensor report — will be handled in upper layer (uart_srv + TCP JSON)
-        // Don't consume as command response
+        if (g_lup_sensor_cb) {
+            g_lup_sensor_cb(pkg, len);
+        }
         return;
     }
 
diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/tcp_json_srv.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/tcp_json_srv.c
index 069b19f..1bb8d9e 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/tcp_json_srv.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/tcp_json_srv.c
@@ -742,6 +742,39 @@ static void json_process_frame(uint8_t socket, const char *frame) {
 }
 
 
+/*===========================================================================
+ * json_sensor_callback — 注册到 lup_process_frame，0xC0 帧到达时直接推送
+ *===========================================================================*/
+static void json_sensor_callback(const uint8_t *pkg, uint16_t len)
+{
+    // Check: socket active, authed, report enabled
+    if (g_json_socket_listen == 0xFF) return;
+    if (g_json_auth_state != JSON_STATE_AUTHED) return;
+    if (!g_report_active) return;
+
+    LUP_SensorReport sr;
+    memset(&sr, 0, sizeof(sr));
+    int ret = lup_parse_sensor_report(pkg, len, &sr);
+    if (ret != 0) {
+        PRINT("JSON: sensor callback parse failed (%d)\n", ret);
+        return;
+    }
+
+    char data_json[2048];
+    if (format_sensor_json(data_json, sizeof(data_json), &sr) == 0) {
+        char *out = (char *)malloc(TCP_JSON_MAX_FRAME);
+        if (out) {
+            snprintf(out, TCP_JSON_MAX_FRAME,
+                "{\"msg_id\":0,\"cmd\":\"sensor_report\",\"ts\":%lu,"
+                "\"code\":0,\"msg\":\"success\",\"data\":%s}\n",
+                (unsigned long)mstick(), data_json);
+            uint32_t slen = strlen(out);
+            WCHNET_SocketSend(g_json_socket_listen, (uint8_t *)out, &slen);
+            free(out);
+        }
+    }
+}
+
 /*===========================================================================
  * Public API
  *===========================================================================*/
@@ -767,6 +800,9 @@ void tcp_json_srv_init(void) {
         return;
     }
 
+    // Register sensor callback: 0xC0 frames from Loop MCU → TCP push
+    lup_set_sensor_callback(json_sensor_callback);
+
     PRINT("JSON: TCP listen on port %d (socket %d)\n", TCP_JSON_PORT, g_json_socket_listen);
 }
 
diff --git a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/usart_biz.c b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/usart_biz.c
index 69ba924..85dfa37 100644
--- a/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/usart_biz.c
+++ b/vd960DBN/BLE/OnlyUpdateApp_Peripheral/APP/usart_biz.c
@@ -161,22 +161,20 @@ void uart_srv(void)
                 uint8_t cmd = g_pkg_uart_2.pkg[3];
 
                 // --- 所有 0x7F 帧先经过 lup_process_frame 校验 ---
-                // 对于 0xC0 帧: 校验 checksum，但不消费为命令响应
-                // 对于其他帧: 校验 checksum，匹配挂起命令
+                // 0xC0: 校验后通过回调直接推送 TCP JSON
+                // 其他: 校验后匹配挂起命令
                 lup_process_frame(g_pkg_uart_2.pkg, g_pkg_uart_2.offset);
 
                 // --- 传感器上报 (0xC0) 分流 ---
+                // 回调已处理 TCP 推送，此处仅处理 BLE 转发
                 if(cmd == LUP_CMD_SENSOR_REPORT)
                 {
-                    // SensType=0x0C → 多线圈传感信息
-                    if(g_dbn_ble_state_acs_enable.flag == 0){
-                        // 无 BLE ACS 连接 → 标记为 TCP JSON 上报
-                        _report_flag = 1;
-                    }
-                    else{
+                    if(g_dbn_ble_state_acs_enable.flag != 0){
                         // BLE ACS 已连接 → 改 Magic 为 0x8F 发给 BLE
                         g_pkg_uart_2.pkg[0] = 0x8F;
+                        _report_flag = 1;  // 保留给 BLE
                     }
+                    // else: 回调已推送 TCP，直接清理
                 }
 
                 // 调试打印