Per-pack BMS queries (id arg): batSoc source + host_probe7

docs/RE_DART_FINDINGS.md

@@ -306,6 +306,17 @@ every silent run is fully explained by bytes, with no need for exotic
 causes. Current probes use socket-space ids + radix 16 + `opt` payloads
 via `scripts/host_probe6.py`.
 
+### Live results (2026-10-16, host probes with corrected bytes)
+
+- Discovery + directed `queryDeviceInfo` + `BMS`/`EMS` all answer on
+  `10.100.1.1:9000` (replies: `1102` device info, `1706` BMS, `1708` EMS).
+- `DEVICE_APOWER_INFO` (`1307`) answers `{"result": 1, "reason": -1}` —
+  rejected (args or unsupported on this firmware).
+- `BMS` **requires the pack id** (`queryBmsInfoBySocket` passes
+  `arguments={"id"}`): id-less queries return the all-zero `id: 0` slot;
+  `id: 1`/`2` select the `…B1`/`…B2` packs whose `batSoc`/`batSoh` are the
+  charge/health readings. `scripts/host_probe7.py` reads both packs.
+
 ## 14. Direct-connect flow (manual AP join → return to app)
 
 `sections/menus/direct_connect/` owns the SoftAP onboarding path: