docs: record the 2026-08-25 body-codec and geo-scale findings

Brings the protocol reference, CLAUDE.md and the codec RE status doc up
to date with everything confirmed in this pass.

instantel_protocol_reference.md
  - Changelog row for the five findings.
  - S7.6.1: scope table showing the 32000 scale correction applies to
    series-3 waveform, series-3 histogram and series-4 Thor alike, with
    the measured before/after ratios for each.
  - S15: closed "Full channel ID mapping in SUB 5A stream" — resolved by
    the segment-header channel id ([channel][00][00][segment], 0x46=Tran
    0x47=Vert 0x48=Long 0x49=MicL, 1697/1697 verified).  Four new open
    questions: variable-prefix segment descriptors, the histogram codec
    missing peak intervals (26% of channels), UM-series IDF decoding
    ~1000x low, and the Thor per-count LSB residual.
  - NEW Appendix E — Known Device Faults.  Documents the field-observed
    "offset" fault: symptom, why it floods the ACH queue (pedestal
    exceeds the unit's own geo trigger level), the episode table, the
    detection rule that works, what the data rules out (not the
    geophone, not the battery, not environmental, not condensation),
    and the two remaining candidate mechanisms with the test that
    separates them.  Explicitly flags that it is NOT a decode artifact,
    since that mistake has already been made once.

CLAUDE.md
  - Body-codec section: the four framing cases and the channel-id
    finding, with the corpus result.
  - "What's NOT solved": replaced the stale walker-edge-cases bullet
    with the four genuinely open items.

waveform_codec_re_status.md
  - Scale scope table matching the protocol reference.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HgTe8CamXAHcAmaQ6QNcog

CLAUDE.md

@@ -223,6 +223,44 @@ custom delta + RLE + variable-width codec.
   `NN + 2` for int8 blocks).  Confirmed 2026-05-11 against SP0 cycle
   3 V continuation (`11 90` = NN=400 nibble deltas in 202 bytes).
 
+### Framing cases added 2026-05-11 → 2026-08-25
+
+Four more block-framing cases, each of which had been causing **silent
+channel truncation** — `walk_body` ends its loop on an unrecognised tag
+and `decode_waveform_v2` returns whatever channels it got, so an
+unhandled tag surfaces as short channels with no error raised.  Found by
+diffing 75 production events against their preserved Blastware ASCII
+exports (`<store>/<serial>/<file>_ASCII.TXT`).
+
+- **Wide-NN RLE `0X NN`** — the 12-bit NN encoding documented above for
+  `1X`/`2X` **also applies to the `00 NN` RLE tag**.  A narrow run maxes
+  out at NN=0xFC, so a quiet stretch longer than 252 samples must use
+  the wide form (e.g. `01 0c` = 268 repeats).
+- **`30 NN` is not capped at NN=0x10** — data-section blocks reach at
+  least NN=0x18.  The `NN × 1.5 + 2` length formula was already right;
+  only the guard was wrong.
+- **`40 NN` segment headers are variable width** — NN is the *count of
+  int16 BE continuation deltas for the PREVIOUS channel*, so the header
+  is `2*NN + 16` bytes and every field after the deltas shifts by
+  `2*NN`.  `40 01` (18 B) and `40 03` (22 B) both occur alongside the
+  common `40 02` (20 B).
+- **Tagless segment headers** — a header can appear with **no `40 NN`
+  tag at all**: just the 14-byte tail
+  `[field2:2][len:2][channel_id:4][marker:2][anchors:4]`.  This is the
+  NN=0 case (previous channel needed no continuation deltas).
+
+**The header "counter" is really a channel id.**  The 4-byte field long
+documented as a "monotonic uint32 LE counter" is
+`[channel_id][00][00][segment_index]`, with `0x46`=Tran `0x47`=Vert
+`0x48`=Long `0x49`=MicL — verified on **1697/1697** segment headers
+across the corpus, zero disagreements.  `decode_waveform_v2` now takes
+the channel from this field rather than from rotation position; a single
+missed or extra header (exactly what tagless headers caused) desyncs
+rotation and corrupts every channel after it.
+
+Corpus result, end to end through the production path:
+**exact 37 → 72, truncated 23 → 3, full-length value errors 15 → 0.**
+
 ### What's NOT solved
 
 - **MicL channel conversion to dB(L)** — the codec emits MicL as
@@ -230,9 +268,29 @@ custom delta + RLE + variable-width codec.
   shows mic in dB(L) with ~6 dB quantization steps.  Need to map
   ADC counts → dB(L) for direct comparison; likely
   `dB = 20*log10(|counts|) + offset` or similar.
-- **Walker edge cases** — SP0/SS0/SV0 don't walk the full event due
-  to block-length quirks past the first few segments.  Every sample
-  reached is correct; the walker just needs robustness improvements.
+- **Variable-prefix segment descriptors** — 3 of the 75 ground-truth
+  production events still truncate.  The walk reaches a segment header
+  whose channel-id field is preceded by a *variable-width* prefix (2, 4
+  or 6 bytes observed; the standard tagless form always has 4), carrying
+  an `01 00` marker instead of `02 00`.  The marker is **not** simply an
+  anchor count — `01 00` records appear with both 2- and 4-byte anchor
+  fields in the same file.  Examples: `BE12599/N599LPNB.JF0W` @1155,
+  `BE12599/N599LPWJ.980W` @849, `BE9558/K558LOF2.820W` @1485.
+- **Histogram codec misses the peak interval** — 301 of 1141 series-3
+  histogram channels (26%) decode a peak below 95% of the
+  device-reported PPV (one reads 0.0300 against a device PPV of 0.1200,
+  exactly 1/4).  Not a scale error — that would be a uniform 2.34%.
+  Lives in `histogram_codec.decode_histogram_body`, untouched by the
+  2026-08-25 waveform pass.
+- **Micromate (UM-series) IDF decode is ~1000× low** — e.g.
+  `UM11402_20260406130113.IDFW` gives a Tran peak of 0.0009 in/s against
+  a device-reported 1.1168.  The Thor IDF path decodes sanely, so this
+  is UM-specific.
+- **Thor IDF per-count LSB** — after the 32000 geo full-scale
+  correction, series-4 Thor peaks sit at a median 0.983 of the
+  device-reported peak (was 0.960 under 32768).  Closer but not exact;
+  Thor likely uses its own per-count LSB rather than the BW
+  16-count/0.005 in/s convention.
 
 ### Decoded sample counts (across the fixture bundle)