docs: the three new features are described where each of their readers looks

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/claude/verification.md

@@ -177,6 +177,29 @@ precedent, not an exception.
   `/tmp/udpscope-export`) — collect the export table and write it both ways, skipping
   only the file chooser.
 
+- `UDPSCOPE_PROBE_CONDITION_MS` — arms a qualified trigger against the mock and reports the latched
+  `t0`, the measured pulse or band width, and sample values for the window condition. Schedules its
+  own arm and report stages. `UDPSCOPE_PROBE_CONDITION_SHAPE` picks the leg: `0` pulse width `<`
+  (the glitch, the default, needs `--glitch-at`/`--glitch-width`), `1` pulse width `>`, `2` window
+  (uses `sine` with a 1.0 s window and 50 % pre), `3` dropout (needs `--quiet-at`; also uses
+  `sine` with a 1.0 s window and 50 % pre).
+- `UDPSCOPE_PROBE_STATS_MS` — reports every measurement's accumulator (`n`, mean, sd, lo, hi),
+  pauses, reports again with `dn=` per measurement, then resets and reports a third time. Three
+  phases: `phase=0`, `phase=1` (after pause) and `phase=2` (after Reset). Needs
+  `UDPSCOPE_ENABLE_ALL_MS` ahead of it and `UDPSCOPE_PROBE_MEASURE_MS` to add measurements first.
+- `UDPSCOPE_PROBE_SEARCH_MS` — runs a buffer search for the armed condition, cross-checks the live
+  trigger's own `t0` against the nearest hit (`agree=1` is the load-bearing reading), and jumps to
+  hit 0. Reports the resulting `mode=`, `axis=` and `marks placed=`.
+
+The following mock waveform features are what the qualified-condition probes are checked against,
+as distinct from the fault injection below, which exercises ingest:
+
+- `--glitch-at S` / `--glitch-width W` invert the `square` signal for `W` seconds at the start of
+  every square period from stream second `S` onwards — a runt pulse of a known width, which is
+  what a `<` pulse-width trigger and a glitch search are checked against.
+- `--quiet-at S` freezes `sine` at its held value from stream second `S` onwards, so it stops
+  crossing zero: the dropout trigger's input.
+
 The mock also carries one **fault injection** that no probe schedules, because what it exercises is
 the ingest rather than the UI: `--time-glitch-at <stream seconds> --time-glitch-by <seconds>` makes
 **one** packet's time signal jump ahead and then carries on from where the true timeline was, which