feat(scratch): recover captures from the socat relay log -- validated byte-exact

The bench relay runs socat with -x, which hex-dumps every forwarded byte in both
directions.  That makes its log a complete second copy of every capture taken
through it, independent of whether seismo_lab was recording.

On 2026-09-25 a capture's .bin files never left the Windows machine and the
session was rebuilt from the relay log instead.  When the real bins turned up
afterwards, the reconstruction was byte-for-byte IDENTICAL in both directions
(3,595 and 4,004 bytes) -- verified again through the committed script, not just
the ad-hoc version used at the time.  So this is a validated fallback, not a lossy
approximation.

Adds scratch/socat_log_split.py, with --from-line/--to-line for picking one
session out of a log that spans several (split on the "accepting connection"
markers, or the frame walk runs sessions together).

Also documents the -x flag and the fallback in the session-provenance section, so
the next person runs the relay in a way that keeps the safety net.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ru8Lg9HkkYvX9VWWo65SmL

docs/micromate_protocol_reference.md

@@ -1757,12 +1757,29 @@ Three sittings, all on the same unit:
 | 2026-09-23 | 5 events (4 waveform, 1 histogram) | the event chain + `0x5A` |
 | 2026-09-24 | 5 events | **Thor pushing a setup**, via a recording relay |
 
-The 2026-09-24 sitting used a different topology worth noting, because it is
+The 2026-09-24/25 sittings used a topology worth keeping, because it is
 reusable: `socat` on mint-mac shares `/dev/ttyACM0` on TCP, seismo_lab's TCP
 bridge relays Thor to it and records both directions.  Thor is configured with
 the unit at `127.0.0.1:<bridge port>` exactly as if it were a field modem.  No
 modem, no SIM, and **nothing on the production Thor box is touched.**
 
+**Run the relay with `-x` and keep its log.**  It hex-dumps every forwarded byte
+in both directions, which makes it a complete second copy of every capture,
+independent of whether seismo_lab was recording:
+
+```
+socat -d -d -x TCP-LISTEN:12345,reuseaddr,fork /dev/ttyACM0,raw,echo=0,b115200 \
+    > ~/mm-captures/socat_<ts>.log 2>&1
+```
+
+That paid off on 2026-09-25, when a capture's `.bin` files never left the Windows
+machine — the session was rebuilt from the relay log with
+`scratch/socat_log_split.py`.  When the real bins arrived later the
+reconstruction was **byte-for-byte identical in both directions** (3,595 and
+4,004 bytes), so the log is a validated fallback rather than an approximation.
+Sessions concatenate in one log; split them on the `accepting connection`
+markers.
+
 ⚠ Firmware is the single biggest caveat on this document.  Every finding here
 is from one unit on the Blastware build.  A `11.0BD` unit has not been
 touched.