Seed socket payloads with opt (communicate factory) + host_probe4

docs/RE_DART_FINDINGS.md

@@ -106,7 +106,12 @@ Null/empty payload ⇒ `len == 0`, `crc == ""`, no `dataArea` key.
 - The `communicate` factory (`0xc9264c`) builds the `data` map from the
   caller's `arguments` (e.g. `queryAPowerData` passes `{"update": 2}` with
   cmd `deviceApowerInfo`/`0x19`, operate `query`) and calls the ctor with
-  a named `data:` argument.
+  a named `data:` argument. On socket mode it **always seeds the map with
+  `"opt"`** (the operation type — `0` for query) before merging arguments,
+  so the app's apower query sends
+  `dataArea = {"opt": 0, "update": 2}` and its device-info query sends
+  `{"opt": 0, "minProtocolVer": "V1.00.00"}` (empty/non-query args still
+  yield `{"opt": 0}`). This matches the live capture sizes (§8).
 
 ## 4. `CommunicationCmd` (raw → name)