EnvelopeCodec message layer; scripts are thin business-API wrappers

docs/BATTERY_POC.md

@@ -69,10 +69,12 @@ python3 -m franklinwh_agate_client.battery \
   --sn A03X2516013210060005 --host 10.100.1.1 --ports 9000,18000 --probe
 ```
 
-> Prefer the standalone scripts in `scripts/` — they need no install and
-> track the latest corrections: `host_probe4.py` is current (socket-space
-> ids + `opt`-seeded payloads). Copy the file content and run
-> `python3 host_probe4.py --sn A03X2516013210060005 --ports 9000`.
+> Prefer the standalone scripts in `scripts/` — thin wrappers over the
+> library business API (run from the repo root, e.g.
+> `python3 scripts/host_probe7.py --sn …`). Wire bytes always come from
+> `EnvelopeCodec` (`protocol/messages.py`); scripts never reimplement the
+> cipher. Current: `host_probe6.py` (variants), `host_probe7.py` (BMS
+> packs), `host_probe8.py` (wattage).
 
 Expected: `secret key for ...: 1c (radix 32)`, then per-variant `tx`
 (encrypted envelope, starts with the ASCII header

docs/RE_DART_FINDINGS.md

@@ -188,8 +188,14 @@ marker model is kept for the unverified Bluetooth path.
    failures keep accumulating ("receive incomplete data").
 
 So requests are `S1 || transform(S2)` (split at the computable header
-length) while responses are `s || 0x58 || transform(tail)` (split at the
-second `0x58` marker). Both halves share the one additive stream.
+length); live socket replies use the identical framing and split
+(`decrypt_wire` locates the header at the 2nd comma — no ids needed up
+front). Both halves share the one additive stream.
+
+Library shape: `protocol/messages.py:EnvelopeCodec` owns the bytes
+(`encode`/`decode` under one device key); `device_local`,
+`battery` and `power` implement the business calls on top; `scripts/`
+are thin CLI wrappers over those calls.
 
 Live corroboration (2026-10-15, PCAPdroid capture of the working app): a
 request frame opens with the ASCII header