diff --git a/docs/instantel_protocol_reference.md b/docs/instantel_protocol_reference.md
index f4b118f..8a8115e 100644
--- a/docs/instantel_protocol_reference.md
+++ b/docs/instantel_protocol_reference.md
@@ -3536,26 +3536,65 @@ steps.  A small common-mode diurnal wobble rides on top of it, but that
 wobble is present on the healthy channels too (it is the unit's normal
 thermal breathing) and is not the fault.
 
-**Open: two candidate mechanisms.**
+**The fault is on the geophone side.**  Operator report (2026-08-25):
+*attaching a different geophone to an affected unit makes the offset go
+away.*  That is the channel-swap test, already run in the field many
+times, and it rules out the unit's analog front-end and any stored
+per-channel zero constant — a constant lives in the unit and would
+survive a sensor swap.
 
-1. *A latched bad zero.*  These units run Sensor Check "Before
-   monitoring", so a baseline is captured at session start.  Disturb the
-   geophone at that instant and the unit bakes a non-zero reading in as
-   "zero".  Fits the discrete steps, the rock-steadiness between them,
-   surviving power cycles, the sensor check still passing, and clearing
-   on a clean re-zero.  Also explains why it is episodic rather than
-   constant — it needs a disturbance at the moment of zeroing.
-2. *A degrading analog front-end.*  Fits BE9558 better: it was clean for
-   nine months, then escalated 3 → 1 → 1 → 193 events over five weeks
-   **and moved from Tran to Long**, which a single bad channel would
-   not do.
+The stored data agrees.  MicL — a separate transducer on its own cable —
+shows no offset during either episode (`|mean|/peak` = 0.17 and 0.02),
+while the geo channels on the same unit at the same moment are pinned.
 
-BE18438 (same channel twice, months apart) looks like (1); BE9558
-(escalating, channel-migrating) looks like (2).  The decisive test is to
-force a clean re-zero on a faulted unit: if the offset clears and stays
-clear it is (1) and fixable in the field — potentially over the wire,
-since we already speak SUB `0x0E` (channel sensor data) and `0x98`
-(trigger test), see §7.10.
+**Two distinct failure patterns**, both geophone-side:
+
+| unit | Tran | Vert | Long | MicL | reading |
+|---|---|---|---|---|---|
+| BE18438 | 0.16 | **0.97** | 0.18 | 0.02 | one element only |
+| BE9558 | 0.90 | 0.81 | **0.99** | 0.17 | all three, Long dominant |
+
+(values are `\|mean\|/peak` on the dominant axis)
+
+BE18438 has a single faulted conductor pair with the other two clean.
+BE9558 has all three geo channels offset by different amounts
+(Long +0.340, Tran +0.037, Vert −0.020) — that points at a shared return
+or ground path in the housing rather than one element.
+
+**Candidate mechanisms.**  A geophone coil is passive and cannot
+generate sustained DC on its own, so an offset originating on the sensor
+side has to come from one of:
+
+1. *Galvanic corrosion at a connector or splice* — dissimilar metals
+   plus moisture form a literal cell.  This generates DC directly, in
+   the tens-of-millivolts range that matches the measured offset
+   (0.29 in/s ÷ 6.206053 in/s per volt ≈ 46 mV referred to the ADC
+   input).  Fits the discrete steps, surviving power cycles, and being
+   cured by swapping the sensor.
+2. *A leakage path to shield or another conductor*, letting the unit's
+   own bias/reference divide into the signal pair.  Best fit for the
+   BE9558 all-three-channels pattern.
+3. *Changed coil DC resistance* (partial short or degraded winding)
+   interacting with the amplifier's input bias current —
+   `V_offset = I_bias × R_source`.  Best fit for the BE18438
+   single-element pattern.  Note the on-device sensor check would not
+   catch this: it measures ring-down frequency and damping, not DC.
+
+**Caveat on the swap test.**  Swapping a geophone requires stopping and
+restarting monitoring, and these units run Sensor Check "Before
+monitoring" — so the restart also re-zeros the channels.  The swap
+therefore does not cleanly separate *"new sensor"* from *"the restart
+re-zeroed it"*.  Two cheap controls settle it: restart monitoring
+**without** swapping (if the offset clears, it was the re-zero), or swap
+the **original** sensor back (if the offset returns, it is the sensor).
+The operator's remedy being a swap rather than a restart is weak
+evidence for the sensor, since a restart is the easier thing to try
+first.
+
+**Best single measurement when it recurs:** DC voltage across the
+suspect geophone's connector pins with the sensor **disconnected from
+the unit**.  A galvanic cell (mechanism 1) shows an open-circuit
+voltage; mechanisms 2 and 3 do not.
 
 **Note:** the surveyed population is subject to survivorship bias —
 flooded events were routinely deleted before this snapshot, so units