docs: reconcile the E-1608 README with the real-board run and the scan lookup

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -120,10 +120,9 @@ analog outputs, eight digital lines and a 32-bit counter). Its connection form t
 to look up (optionally with the subnet to sweep). A **Scan network** row at the top of the form probes every
 network interface of the host for boards (about a second and a half), lists each one by address and MAC, and a
 click on a result fills the address, or **Use MAC** fills the MAC and leaves the address empty. Results are not
-saved: only the filled field is. A MAC with no subnet is now looked up on every interface, not only the default
-route's, because a single limited broadcast leaves through the default route alone and missed a board on another
-interface (found on a real board on 2026-11-02, where the board was on `net0` and the default route was
-`wlan0`). The form also groups the acquisition settings (scan rate, external clock,
+saved: only the filled field is. A MAC with no subnet is looked up by a broadcast sent on every up interface: a
+single limited broadcast leaves through the default route only, and on 2026-11-02 it missed a real board on
+`net0` while the default route was `wlan0`. The form also groups the acquisition settings (scan rate, external clock,
 trigger, restart after an overrun, factory calibration, the digital poll rate), a range per analog input, and the
 direction and initial value of each digital line. The analog inputs are the plotted channels; each digital input
 and the counter is an extra channel only if you ask for it. Two side-stack tabs belong to it: **Analog out**
@@ -133,12 +132,17 @@ Acquisition is hardware-paced only (the scan rate or an external clock), the cha
 or below 250 kS/s, and the form refuses more. With the command-line options, a run that names no `aiN` key gets
 `ai0=BIP10V`; naming any `aiN` key drops that default, so `ai1=BIP5V` alone is channel 1 alone.
 
-**This kind has not been run against a board.** It is verified against `tools/mock_e1608.py`, a protocol mock written
-from two independent implementations of the wire protocol. The following rest on a single reference or the two
-disagree, and are the first thing to check when a board is attached (the mock's header lists the same items):
-the counter reset command (0x31, from one reference only); the pacer value (the source sends the *aggregate*
+**This kind has been run against a real board once, on 2026-11-02, with one channel.** The board was at
+169.254.88.75 on `net0`, `ai0=BIP10V` single-ended with the input grounded, `scan_rate=1000`, for 7 s: the connection
+and handshake succeeded, the source configured one channel and streamed it at the declared 1000 S/s (about 1250
+samples in the first 1.25 s, no gaps, no overflows, no `[e1608]` errors), and the readings sat within a few LSB of
+0 V (about 0.9 to 1.8 mV on a +-10 V range). Nothing else has been run on hardware; everything else is verified only
+against `tools/mock_e1608.py`, a protocol mock written from two independent implementations of the wire protocol.
+The following rest on a single reference or the two disagree, and are the first thing to check with more of the board
+exercised (the mock's header lists the same items):
+the counter reset command (0x31, from one reference only; not run on the board); the pacer value (the source sends the *aggregate*
 rate, `round(80e6 / (scan_rate * channels) - 1)`, as one reference does; the other sends the per-channel
-frequency); the scan-start trigger option bits (none 0, rising 4, falling 8, high 12, low 16, one reference only);
+frequency; the two differ only with two or more channels, so the one-channel run cannot settle it); the scan-start trigger option bits (none 0, rising 4, falling 8, high 12, low 16, one reference only);
 whether the handshake may answer status 2 ("code ignored"; one reference accepts it, the other refuses it, and the
 source accepts it); the first frame id; and the maximum frame size. Two further things
 are worth a look on a board even though the mock's header does not flag them: the calibration memory layout and

docs/claude/build-and-run.md

@@ -127,8 +127,8 @@ required; a MAC with no `address` is looked up by a broadcast sent on every inte
 The enabled channels times `scan_rate` must not exceed 250 kS/s. `tools/mock_e1608.py` is a protocol
 mock of the board for development (UDP discovery and handshake, TCP commands, a scan stream with a sine
 per channel, calibration memory, `--port`, `--mac`, `--log FILE`, `--drop-after S` and `--overrun-after S`
-switches, `--code N`); there is no real board in the loop, and the mock's header lists the items whose
-layout is unverified. Errors are written to stderr as `[e1608] ...`, once per distinct message.
+switches, `--code N`); the mock stands in for the board (a real board has been run once, with one channel; see
+the README), and the mock's header lists the items whose layout is unverified. Errors are written to stderr as `[e1608] ...`, once per distinct message.
 
 ```sh
 python3 tools/mock_e1608.py --port 54711 &

docs/claude/verification.md

@@ -442,7 +442,10 @@ precedent, not an exception.
 - `UDPSCOPE_PROBE_E1608_RECONNECT=8000` -- reads the source after the mock dropped the link and 500 ms
   later checks the frame count moved on. The reading's own entry is in `probe-readings.md`.
 - `UDPSCOPE_PROBE_E1608_SCAN=1000` with `UDPSCOPE_EXIT_AFTER_MS=6500`, run as `--source e1608 --source-opt
-  address=127.0.0.1` against `tools/mock_e1608.py` on its default port 54211 (the form scans that port) -- builds
+  address=127.0.0.1`. Start `tools/mock_e1608.py` first on its default port 54211 (the form scans that port; do
+  not pass `--port`) and kill it afterwards. The value is the delay of phase 1; phase 2 follows 2 s after it and
+  phase 3 (the line) 2 s after that, so phase 3 runs 4 s after phase 1 and the delay must stay below about
+  2500 ms for the line to print before the exit at 6500 ms. It builds
   the connection form, presses **Scan network**, expects the mock to be listed, clicks the result (address
   filled, MAC and subnet cleared), presses **Use MAC** (MAC filled, the others cleared), scans again and checks
   the results were replaced. `UDPSCOPE_PROBE_E1608_SCAN_MAC` names another board (a real one) instead of the