docs: reconcile the E-1608 README with the real-board run and the scan lookup

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -120,10 +120,9 @@ analog outputs, eight digital lines and a 32-bit counter). Its connection form t
 to look up (optionally with the subnet to sweep). A **Scan network** row at the top of the form probes every
 network interface of the host for boards (about a second and a half), lists each one by address and MAC, and a
 click on a result fills the address, or **Use MAC** fills the MAC and leaves the address empty. Results are not
-saved: only the filled field is. A MAC with no subnet is now looked up on every interface, not only the default
-route's, because a single limited broadcast leaves through the default route alone and missed a board on another
-interface (found on a real board on 2026-11-02, where the board was on `net0` and the default route was
-`wlan0`). The form also groups the acquisition settings (scan rate, external clock,
+saved: only the filled field is. A MAC with no subnet is looked up by a broadcast sent on every up interface: a
+single limited broadcast leaves through the default route only, and on 2026-11-02 it missed a real board on
+`net0` while the default route was `wlan0`. The form also groups the acquisition settings (scan rate, external clock,
 trigger, restart after an overrun, factory calibration, the digital poll rate), a range per analog input, and the
 direction and initial value of each digital line. The analog inputs are the plotted channels; each digital input
 and the counter is an extra channel only if you ask for it. Two side-stack tabs belong to it: **Analog out**
@@ -133,12 +132,17 @@ Acquisition is hardware-paced only (the scan rate or an external clock), the cha
 or below 250 kS/s, and the form refuses more. With the command-line options, a run that names no `aiN` key gets
 `ai0=BIP10V`; naming any `aiN` key drops that default, so `ai1=BIP5V` alone is channel 1 alone.
 
-**This kind has not been run against a board.** It is verified against `tools/mock_e1608.py`, a protocol mock written
-from two independent implementations of the wire protocol. The following rest on a single reference or the two
-disagree, and are the first thing to check when a board is attached (the mock's header lists the same items):
-the counter reset command (0x31, from one reference only); the pacer value (the source sends the *aggregate*
+**This kind has been run against a real board once, on 2026-11-02, with one channel.** The board was at
+169.254.88.75 on `net0`, `ai0=BIP10V` single-ended with the input grounded, `scan_rate=1000`, for 7 s: the connection
+and handshake succeeded, the source configured one channel and streamed it at the declared 1000 S/s (about 1250
+samples in the first 1.25 s, no gaps, no overflows, no `[e1608]` errors), and the readings sat within a few LSB of
+0 V (about 0.9 to 1.8 mV on a +-10 V range). Nothing else has been run on hardware; everything else is verified only
+against `tools/mock_e1608.py`, a protocol mock written from two independent implementations of the wire protocol.
+The following rest on a single reference or the two disagree, and are the first thing to check with more of the board
+exercised (the mock's header lists the same items):
+the counter reset command (0x31, from one reference only; not run on the board); the pacer value (the source sends the *aggregate*
 rate, `round(80e6 / (scan_rate * channels) - 1)`, as one reference does; the other sends the per-channel
-frequency); the scan-start trigger option bits (none 0, rising 4, falling 8, high 12, low 16, one reference only);
+frequency; the two differ only with two or more channels, so the one-channel run cannot settle it); the scan-start trigger option bits (none 0, rising 4, falling 8, high 12, low 16, one reference only);
 whether the handshake may answer status 2 ("code ignored"; one reference accepts it, the other refuses it, and the
 source accepts it); the first frame id; and the maximum frame size. Two further things
 are worth a look on a board even though the mock's header does not flag them: the calibration memory layout and