Seed socket payloads with opt (communicate factory) + host_probe4

docs/BATTERY_POC.md

@@ -69,6 +69,11 @@ python3 -m franklinwh_agate_client.battery \
   --sn A03X2516013210060005 --host 10.100.1.1 --ports 9000,18000 --probe
 ```
 
+> Prefer the standalone scripts in `scripts/` — they need no install and
+> track the latest corrections: `host_probe4.py` is current (socket-space
+> ids + `opt`-seeded payloads). Copy the file content and run
+> `python3 host_probe4.py --sn A03X2516013210060005 --ports 9000`.
+
 Expected: `secret key for ...: 1c (radix 32)`, then per-variant `tx`
 (encrypted envelope, starts with the ASCII header
 `{"cmdType":25,"equipNo":"A03X2516013210060005",`) and `rx` bytes.

docs/RE_DART_FINDINGS.md

@@ -106,7 +106,12 @@ Null/empty payload ⇒ `len == 0`, `crc == ""`, no `dataArea` key.
 - The `communicate` factory (`0xc9264c`) builds the `data` map from the
   caller's `arguments` (e.g. `queryAPowerData` passes `{"update": 2}` with
   cmd `deviceApowerInfo`/`0x19`, operate `query`) and calls the ctor with
-  a named `data:` argument.
+  a named `data:` argument. On socket mode it **always seeds the map with
+  `"opt"`** (the operation type — `0` for query) before merging arguments,
+  so the app's apower query sends
+  `dataArea = {"opt": 0, "update": 2}` and its device-info query sends
+  `{"opt": 0, "minProtocolVer": "V1.00.00"}` (empty/non-query args still
+  yield `{"opt": 0}`). This matches the live capture sizes (§8).
 
 ## 4. `CommunicationCmd` (raw → name)