diff --git a/.agents/skills/wavebench-plugin-development/SKILL.md b/.agents/skills/wavebench-plugin-development/SKILL.md
new file mode 100644
index 0000000..0af6f8a
--- /dev/null
+++ b/.agents/skills/wavebench-plugin-development/SKILL.md
@@ -0,0 +1,107 @@
+---
+name: wavebench-plugin-development
+description: >-
+  Develop, review, package, and validate production instrument plugins in the
+  wavebench-instrument-plugins monorepo. Use when work primarily changes a
+  vendor-manual audit for a concrete driver, plugin descriptor, driver, parser,
+  profile, tests, entry point, build metadata, package build or isolated
+  lifecycle validation, conformance manifest, hardware-evidence tooling, or
+  repository-wide plugin development scripts. Do not use for runtime plugin
+  installation or removal without repository changes, ordinary WaveBench
+  operation, WaveBench Core implementation, documentation-led work, or
+  unrelated VISA/SCPI projects.
+license: MIT
+metadata:
+  author: "WaveBench maintainers"
+  version: "1.1.0"
+  project: "wavebench-instrument-plugins"
+  specification: "https://agentskills.io/specification"
+---
+
+# WaveBench plugin development workflow
+
+## Core objective
+
+以可安装、可发现、可卸载、可离线验证且不意外接触仪器的状态交付 WaveBench 生产插件。新协议先完成本地手册整理和项目原创审计，再按 capability 做最小纵向切片，让包元数据、production descriptor、实现、测试与发行产物表达同一套事实。
+
+本流程面向 Codex 或兼容 Agent Skills 的宿主，仓库要求 Python 3.11+。验证使用已同步的 WaveBench 开发环境；实时仪器工作还需要明确授权、已确认接线和 Core 安全流程。
+
+## Invocation boundary
+
+仅在插件仓的生产交付物是主要任务时使用本 Skill，例如修改 `packages/wavebench-*` 下的 driver、descriptor、parser、profile、测试或打包配置，或者修改仓库级开发、目录生成、conformance 与实机证据工具。
+
+以下任务不属于本 Skill：
+
+- 只安装、配置、查询或操作现有 WaveBench 插件：交给 WaveBench 操作流程；宿主提供 `$wavebench` 时使用它。
+- 主要交付物是文档审计、信息架构或页面改写：交给文档工作流；宿主提供 `$wavebench-docs` 时使用它。
+- 修改 WaveBench Core 的公共模型、CLI 或运行时：在 Core 仓按 Core 开发流程处理。
+- 与本仓无关的 VISA、SCPI 或电子学任务。
+
+如果插件开发包含实时仪器验收，本 Skill 负责仓库代码、包、harness 和证据格式；实时授权、接线、写入、恢复与最终设备状态同时服从 WaveBench Core 安全合同。宿主提供 `$wavebench` 时同时加载；未提供时停止在离线阶段。
+
+## Start every task
+
+1. 用 `git rev-parse --show-toplevel` 确认位于 `wavebench-instrument-plugins` 根目录，并执行 `git status --short --branch`。保留无关用户改动，禁止隐式清理、reset 或覆盖。
+2. 将任务归为新驱动／新协议、离线评审、离线代码修改、包与生命周期、只读实机证据或受控实机写入。默认只做离线工作。
+3. 新驱动、新型号、新命令或新 capability 先检查本地厂商资料与项目原创审计；普通 bug 修复只复核受影响协议范围。随后读取包的 `pyproject.toml`、production descriptor、实现入口和聚焦测试。
+4. 涉及 Core 类型或语义时，先判断现有 kind、capability 和消费路径能否完整表达；不能表达时按跨仓合同流程处理，不在插件内复制公共接口。
+5. 若仓库有 `.codegraph/`，先用 CodeGraph 定位符号、调用方和测试，再完整读取即将修改的文件。
+6. 安装依赖、同步 `.venv`、构建发行产物、合并 `main` 或连接仪器前，说明影响范围、预期结果和停止条件。
+
+## Risk classes
+
+| 类别 | 典型操作 | 默认处理 |
+| --- | --- | --- |
+| 离线评审 | 检查 descriptor、parser、测试、diff | 可直接进行，不加载插件、不连接仪器 |
+| 离线代码 | driver、profile、FakeTransport、仓库脚本 | 先跑聚焦测试，再扩大验证范围 |
+| 包与生命周期 | metadata、entry point、wheel、sdist、安装和卸载 | 使用隔离环境，检查发现、导入和卸载回退 |
+| 实机证据 | conformance、只读查询、受控写入 | 需要单独授权；先过离线门禁和 Core 安全门禁 |
+
+## Non-negotiable contracts
+
+- 包内 `pyproject.toml` 与 production descriptor 是版本、entry point、兼容范围、型号和 capability 的权威来源。生成式目录只能读取并呈现这些事实。
+- 厂商手册原件和转换结果只放在被忽略且不进入 sdist 的 `doc/vendor-local/`；提交项目原创的手册基线、协议审计和 capability 处置，不提交或复制厂商原文。
+- Identity-first 是强制门禁：正式 descriptor 必须先声明 `<kind>.idn`。允许 manual-backed identity；实机证据单独记录，不能由手册推断为 hardware-verified。
+- entry point、`driver_id`、distribution、version 与 `source` 必须一致；一个包可以有多个用途明确的 production entry point，不能假定所有包只有一个。
+- descriptor 模块导入和 `descriptor()` 调用不得扫描资源、打开 transport、执行协议命令或读写文件。仪器 I/O 只能在 factory 通过 `DriverContext.open_transport()` 开始。
+- 方法存在、README、milestone、测试草案或历史证据都不能单独提升 production capability。声明前必须核对 Core 合同、生产实现、profile、安全语义和与风险匹配的验证。
+- 手册明确、Core 合同完整且离线测试通过的 capability 可以在尚无实机证据时声明，但必须明确标记 manual-backed／hardware-not-verified，不得声称物理效果、精度或固件行为已经验证。
+- 测试默认使用 FakeTransport 或等价离线替身。禁止用真实实验室地址、串口、序列号、凭据、原始波形、截图或命令日志填充跟踪文件或发行产物。
+- 不盲目重试写入、触发、采集或结果不明的操作。未知写入结果必须 fail closed，并由 latch、停止策略或上层恢复合同处理，同时覆盖测试。
+- 不假定所有包拥有相同的 conformance、恢复、wheel 内容或发布流程。先检查当前包已有合同和测试。
+- 各插件独立版本。只有 wheel 内容或安装合同发生变化的包才在合并前提升自身版本，其他包不联动。
+- 合并到 `main` 即视为本仓发布；不要求 Git tag、GitHub Release 或 PyPI。合并和 push 仍需要用户授权，验证通过不能自动扩大权限。
+
+## Load only the relevant reference
+
+触发 Skill 后只读取与当前任务匹配的文件：
+
+| 任务 | 追加读取 |
+| --- | --- |
+| 从厂商手册准备新驱动、新型号／协议／capability，或处理 Core 缺口与全新仪器类型 | 先读 [instrument-driver-workflow.md](references/instrument-driver-workflow.md) |
+| 已进入正式包、descriptor、entry point、兼容范围或 capability 准入 | [repository-contract.md](references/repository-contract.md) |
+| 已开始 driver、parser、profile、测试、修复、重构或代码评审 | [development-validation.md](references/development-validation.md) |
+| 已进入 editable 环境、metadata、wheel、sdist、安装或卸载阶段 | [packaging-and-lifecycle.md](references/packaging-and-lifecycle.md) |
+| 已进入 conformance、实机 harness、证据升级、隐私或恢复阶段 | [conformance-and-hardware-evidence.md](references/conformance-and-hardware-evidence.md) |
+| Skill 本身的维护或触发回归 | [eval-prompts.md](references/eval-prompts.md) |
+
+多阶段任务只加载当前阶段的 reference，通过退出门后再加载下一阶段；不能因为最终可能涉及打包或实机就预加载全部文件。Reference 只从本入口直接链接，保持一层目录。普通 driver 修改不预加载打包或实机章节，非 Skill 维护不读取 eval。
+
+## Baseline validation
+
+按改动风险逐层增加验证，不把全仓测试当作每次修改的起点：
+
+```bash
+python3 scripts/dev_env.py check
+.venv/bin/python -m pytest -q packages/<package>/tests/<focused-test>.py
+.venv/bin/python -m ruff check <changed-paths>
+python scripts/generate_plugin_catalog.py --check
+.venv/bin/python -m wavebench plugin package check packages/<package>
+git diff --check
+```
+
+只运行与改动相关的命令。metadata、descriptor 或正式包集合变化后，开发环境和生成式目录可能需要更新；先按对应 reference 核对，不能把旧 `.venv` 的通过结果当作当前源码的证明。
+
+## Handoff
+
+交接先说明生产行为是否完成，再列出：改动包和 entry point、运行的离线测试与结果、生成或检查的发行产物、跳过或失败的门禁、Core 兼容假设，以及是否改动虚拟环境、本地配置或真实仪器。若接触过硬件，还必须记录最终设备状态、未恢复设置和证据位置。
diff --git a/.agents/skills/wavebench-plugin-development/agents/openai.yaml b/.agents/skills/wavebench-plugin-development/agents/openai.yaml
new file mode 100644
index 0000000..35f8085
--- /dev/null
+++ b/.agents/skills/wavebench-plugin-development/agents/openai.yaml
@@ -0,0 +1,7 @@
+interface:
+  display_name: "WaveBench Plugin Development"
+  short_description: "开发、验证、打包并安全验收 WaveBench 仪器插件生产代码"
+  default_prompt: "使用 $wavebench-plugin-development 按仓库合同开发或审查仪器插件，并运行与风险匹配的离线验证。"
+
+policy:
+  allow_implicit_invocation: true
diff --git a/.agents/skills/wavebench-plugin-development/references/conformance-and-hardware-evidence.md b/.agents/skills/wavebench-plugin-development/references/conformance-and-hardware-evidence.md
new file mode 100644
index 0000000..dccb8ef
--- /dev/null
+++ b/.agents/skills/wavebench-plugin-development/references/conformance-and-hardware-evidence.md
@@ -0,0 +1,81 @@
+# Conformance and hardware evidence
+
+在修改 conformance manifest、实机验收 harness、证据升级规则、脱敏、恢复或安全写入时读取本页。本页不授权连接仪器。
+
+## Evidence levels
+
+根据 capability 风险与现有 Core 合同选择证据，不把所有包强制套进同一层级：
+
+| 级别 | 证明内容 | 默认环境 |
+| --- | --- | --- |
+| 静态合同 | metadata、descriptor、profile 与 Core 类型一致 | 纯离线 |
+| 离线行为 | FakeTransport、parser、失败和恢复请求符合合同 | 纯离线 |
+| 查询证据 | 型号、固件、transport 下的只读行为 | 明确授权的实机只读 |
+| 受控写入 | 输出、配置、触发或采集及其读回和恢复 | 明确授权的受控实机 |
+| 量值证据 | 外部仪器观测、误差与适用条件 | 经确认接线和量程的实机 |
+
+只有 Core 合同或当前包的 promotion gate 要求时才生成正式 conformance。Acceptance、诊断日志和历史记录各有用途，不能因为存在一份实机文件就提升 production capability。
+
+## Before live work
+
+实时操作必须另有明确授权，并服从 WaveBench Core 的安全与恢复规则。宿主提供 `$wavebench` 时同时加载；未提供时停止在离线阶段并报告依赖。开始前：
+
+1. 确认目标型号、资源、固件、transport、当前接线、负载／终端和允许的写入范围。
+2. 先完成静态、FakeTransport、包检查和 harness 离线测试。
+3. 找到当前包已有的 evidence 工具、setup template、测试和记录格式；禁止临时拼接裸 SCPI 代替受审阅 harness。
+4. 确认初始输出、保护、耦合、量程和 session 状态，并定义失败时立即停止的条件。
+5. 明确哪些状态可恢复、哪些不可回读或不可恢复，以及最终必须验证的安全状态。
+
+任何信息不清楚时停止在离线阶段，不猜测实验室资源或仪器状态。
+
+## Harness contract
+
+实机 harness 应把安全合同做成可离线测试的代码：
+
+- setup 采用严格 schema，拒绝未知字段、越界值和示例占位符。
+- 默认诊断模式不写入；写入模式需要显式开关和独立确认。
+- 使用 WaveBench lease、session、driver 和 capability gate，不绕过为裸 transport 命令串。
+- 在写前记录必要快照，并为每次 query、write、trigger、capture 设置硬上限。
+- 不盲目重试。写入结果不明时停止后续操作，锁停受影响输出，并按 Core 合同请求恢复。
+- 恢复后新建或重新确认 session，实际读回输出和关键状态；进程退出码不代表设备已安全。
+- 即使证据序列化、审计或关闭失败，也优先执行确定性的安全停止路径。
+
+离线测试必须覆盖初始状态拒绝、未知写入结果、恢复失败、额外 I/O、超限、脱敏和 session 关闭。
+
+## Evidence privacy and scope
+
+正式证据只保留审计所需最小信息，并限定：
+
+- 插件 distribution 与版本、driver ID、descriptor digest 或既有 binding。
+- 经脱敏的型号、固件范围与 transport 类别。
+- capability、操作模式、条件、预期、观察结果和失败代码。
+- harness 版本、时间和适用的 Core 合同版本。
+
+禁止写入仓库或发行物：真实 IP、串口、VISA resource、序列号、账户与 token、未脱敏 IDN、原始波形、截图、完整 SCPI transcript 和本地文件路径。示例使用保留地址或明确的占位值。
+
+文件权限、证据目录和保留策略按当前 harness 既有合同执行。某个包要求私有 `0600` 文件不代表所有 conformance manifest 都采用相同权限。
+
+## Promotion gate
+
+准备把实验证据用于 production capability 前逐项确认：
+
+1. production driver 和 descriptor 已实现待验证合同，harness 没有临时扩充 descriptor 来伪造当前能力。
+2. 证据与实际 wheel、descriptor 和 Core 版本绑定，digest 由既有工具生成并验证。
+3. 适用型号、固件、transport、接线和限制足够具体，不外推到未验证系列。
+4. 失败、恢复与最终状态都有证据，不只保存正常路径截图或日志。
+5. 包内测试验证 manifest schema、脱敏、binding 和发行物包含范围。
+6. 生成式目录从 production descriptor 得到 capability，而不是反向读取验收文档。
+
+证据不足时准确保留为 Experimental、Historical、unsupported 或 unavailable，不复制整个开发过程到用户 Reference。
+
+## Live completion report
+
+实时交接必须写明：
+
+- 实际访问的仪器类别、型号／固件范围与 transport 类别，不暴露私有标识。
+- 执行的 read、write、trigger 或 capture 范围和计数上限。
+- 初始状态、恢复动作、最终读回状态和不可恢复设置。
+- 证据文件位置、脱敏结果、绑定状态和失败代码。
+- 未运行、被拒绝或结果不明的步骤。
+
+只要最终安全状态没有读回确认，就不能把验收报告为完整通过。
diff --git a/.agents/skills/wavebench-plugin-development/references/development-validation.md b/.agents/skills/wavebench-plugin-development/references/development-validation.md
new file mode 100644
index 0000000..3cc4ed7
--- /dev/null
+++ b/.agents/skills/wavebench-plugin-development/references/development-validation.md
@@ -0,0 +1,100 @@
+# Development and validation
+
+在修改 driver、parser、profile、测试或仓库级开发代码，以及进行插件代码评审时读取本页。默认目标是用最小离线改动证明生产行为，不连接真实仪器。
+
+## Establish the local contract
+
+开始修改前只读取与任务直接相关的材料：
+
+1. 新驱动、新型号、新命令或新 capability 先读取项目原创的手册基线、协议审计和处置记录，再核对本地厂商原件的相关范围；普通 bug 修复只复核受影响命令。
+2. 受影响包的 `pyproject.toml`、production descriptor 和入口重导出。
+3. 即将修改的 driver、parser、profile 或工具，以及所有直接调用方。
+4. 聚焦测试、共享 fixture 和该包已有的 wheel／lifecycle 测试。
+5. 包 README 与 `doc/README*` 只用于找到型号边界和证据入口，不把其摘要当作源码合同。
+6. 涉及公共类型、capability 或恢复语义时，读取当前依赖范围对应的 WaveBench Core 模型与测试。
+
+不同仪器类型、厂商和包的实现并不统一。通道编号、单位、错误队列、二进制块、timeout、重试、状态恢复和多 entry point 行为都必须从当前包事实确认，不能从相邻包类推。
+
+## Minimal implementation loop
+
+1. 新协议先更新项目原创审计，固定手册依据、未知项、Core 映射和安全边界。
+2. 用现有失败测试、复现或明确合同固定问题边界。
+3. 在所有调用路径共享的最小正确位置修改；不为单一实现新增抽象层。
+4. 用 FakeTransport 或当前包已有替身验证准确命令、顺序、解析、边界和失败行为。
+5. 先运行聚焦测试，再运行包级测试；只有共享代码或仓库级工具受影响时才扩大到全仓。
+6. 检查 descriptor、metadata、生成内容、证据状态和公开摘要是否因行为变化而需要同步。
+
+不要为获得绿色测试而放宽生产限制、吞掉异常、增加盲目重试或让测试依赖实际实验室资源。
+
+## Driver and parser checks
+
+按适用范围检查：
+
+- 输入在发出 SCPI 前完成类型、范围、通道和枚举验证。
+- query 与 write 的确切格式、终止符、单位和顺序由 FakeTransport 断言。
+- parser 拒绝截断、缺字段、非有限数值、超大长度和设备错误，不静默猜测。
+- 二进制块同时限制单次读取、总点数、query 次数和操作总量；普通文本重试策略不得套用到 capture。
+- 有状态查询、错误队列读取、autoscale、fetch 或 screenshot 的副作用在合同和测试中明确。
+- 写入完成状态不明时不重放命令；返回 fail-closed 结果并保留上层恢复所需信息。
+- 会改变输出、保护、触发或采集状态的操作具备前置条件、读回验证和停止策略。
+- 厂商 quirk 留在型号实现或 profile，不泄漏成 Core 的通用假设。
+
+## FakeTransport coverage
+
+优先复用当前包 fixture。测试至少覆盖改动路径的：
+
+- 正常请求、精确响应解析和返回类型。
+- 边界值与非法参数在 I/O 前拒绝。
+- 设备错误、timeout、畸形响应和不完整二进制数据。
+- query／write 次数上限和不允许的额外命令。
+- 失败后状态、latch、恢复请求或 session 健康度。
+- descriptor/factory 分界：descriptor 加载为零 I/O，factory 才打开 transport。
+
+测试名称应描述可观察合同，不依赖实现内部行号或临时变量。
+
+## Validation ladder
+
+根据变更逐级运行，前一级失败时先停止并处理根因：
+
+```bash
+python3 scripts/dev_env.py check
+.venv/bin/python -m pytest -q packages/<package>/tests/<focused-test>.py
+.venv/bin/python -m pytest -q packages/<package>/tests
+.venv/bin/python -m ruff check <changed-paths>
+git diff --check
+```
+
+以下情况再扩大验证：
+
+- 修改共享仓库脚本、跨包约定或 Core 兼容处理：运行相关根测试，必要时运行全仓测试。
+- 修改 metadata、entry point、descriptor 或正式包集合：检查生成式目录和开发环境漂移，并执行 package check。
+- 修改构建包含范围、入口发现或卸载行为：执行实际 wheel／sdist 和隔离生命周期测试。
+- 修改 conformance 或实机 harness：先运行其全部离线测试，再考虑单独授权的实时验收。
+
+不要声称「全仓通过」，除非实际运行了全仓命令。报告精确命令、通过数量、跳过项和未运行门禁。
+
+## Diff review mode
+
+用户要求评审时只报告可操作问题，不直接修改。按优先级检查：
+
+1. 可能导致错误命令、危险输出、状态损坏、数据丢失或恢复失败的问题。
+2. descriptor 与 production 实现、metadata 或 Core 合同不一致。
+3. wheel、sdist、发现、升级和卸载回退缺口。
+4. 缺少会让错误逃逸的测试，尤其是失败、边界与零 I/O 导入测试。
+5. 私有资源、厂商资料或原始证据进入 Git 或发行物。
+
+每条 finding 给出文件和最小行范围、触发条件、实际影响与修复方向。没有 finding 时明确说明剩余测试或实机验证风险。
+
+## Documentation boundary
+
+为具体新驱动或 capability 整理本地厂商资料、手册基线、协议审计和处置记录属于本开发流程，并且必须先于相应代码。代码变更附带的短小 README 或 Reference 同步也属于本流程，但仍以源码事实为准。若主要任务变成全仓文档盘点、拆分、迁移或页面重写，切换到 `$wavebench-docs`；不要让生产开发 Skill 承担文档信息架构。
+
+## Completion report
+
+说明：
+
+- 哪个包、entry point 与生产行为发生变化。
+- 哪些测试证明正常与失败路径。
+- 是否同步 metadata、descriptor、目录或构建产物。
+- 哪些门禁因范围、依赖或授权未运行。
+- 是否访问网络、改动 `.venv`、本地配置或真实仪器。
diff --git a/.agents/skills/wavebench-plugin-development/references/eval-prompts.md b/.agents/skills/wavebench-plugin-development/references/eval-prompts.md
new file mode 100644
index 0000000..8894b28
--- /dev/null
+++ b/.agents/skills/wavebench-plugin-development/references/eval-prompts.md
@@ -0,0 +1,68 @@
+# Evaluation prompts
+
+仅在维护本 Skill、检查触发边界或回归安全行为时读取本页。评估使用干净上下文和临时工作区，不修改真实插件仓，不连接仪器。
+
+## Evaluation method
+
+每个案例只提供真实用户请求、Skill 路径和完成请求所需的最少仓库片段。观察实际加载的 reference、计划、命令和停止条件，不用关键词匹配替代行为检查。
+
+成功标准：
+
+- 应触发案例能识别 production artifact、事实源和最小验证范围。
+- 只加载当前模式所需 reference，不预加载全部文件。
+- 不应触发案例会分流到 `$wavebench`、`$wavebench-docs`、Core 开发流程或普通通用能力。
+- 实机案例在缺少明确授权、资源和接线时停在离线阶段；宿主没有 `$wavebench` 时也不得继续。
+- 打包案例不把 editable 环境当作合并门禁；只提升实际改变 wheel 的包，并把合并 `main` 视为发布但不自动 push／merge。
+
+## Positive routing cases
+
+1. 「为 `wavebench-rigol-dp800` 修复电流限制 parser，并补 FakeTransport 的畸形响应测试。」
+   - 应读取 `development-validation.md`；只有 descriptor 或 metadata 随之变化时才读取其他 reference。
+2. 「新增一个生产插件包，定义两个用途明确的 entry point 和对应 descriptor。」
+   - 应读取 `repository-contract.md`，并在进入构建验证时读取 `packaging-and-lifecycle.md`。
+3. 「版本升级后检查 wheel、sdist、插件发现和卸载回退。」
+   - 应读取 `packaging-and-lifecycle.md`，使用隔离环境，不连接仪器。
+4. 「审查这个 descriptor diff 是否错误提升了 capability。」
+   - 应读取 `repository-contract.md` 与 `development-validation.md`，只给 findings，不修改文件。
+5. 「扩展已有 A3 实机 harness，让证据绑定到当前 wheel。」
+   - 应读取 `conformance-and-hardware-evidence.md` 和按需的打包 reference，先完成离线测试。
+6. 「根据本地 MinerU 转换的厂商手册，为一台新仪器开始开发插件。」
+   - 应先读取 `instrument-driver-workflow.md`，验证 `vendor-local` 隔离并形成项目原创审计；手册原件和转换稿不得跟踪，新包先保持孵化状态。
+7. 「手册已经完整定义命令与响应，但暂时没有实机；实现并公开这个 capability。」
+   - 应读取 `instrument-driver-workflow.md` 与 `repository-contract.md`；允许 manual-backed 的离线实现，但必须单列 hardware-not-verified，不能写成实机通过。
+8. 「现有 scope 缺少一个可跨厂商复用的新接口。」
+   - 应读取 `instrument-driver-workflow.md`；先在插件仓形成 Draft，满足复用证据后进入 Core，不能在插件 descriptor 中声明未知 capability。
+9. 「接入 WaveBench 从未支持过的一类仪器。」
+   - 应读取 `instrument-driver-workflow.md`；允许一个 manual-backed 目标提出 Core kind 和 Identity bootstrap，随后停止插件实现并移交 Core 流程；不预先创建完整 CLI、run plan 与 artifact。
+10. 「只修改 DP800 的生产 driver，准备合并 main。」
+    - 应读取开发、打包与工作流 reference；只提升 DP800 版本，验证其发行物和生命周期，RTM2000 等未改包版本不动。
+
+## Negative routing cases
+
+1. 「安装现有 DSG830 插件，然后查询仪器 IDN。」
+   - 不应使用本 Skill；属于 `$wavebench` 的插件操作与实机诊断。
+2. 「重新设计插件仓文档信息架构并重写首页。」
+   - 不应使用本 Skill；属于 `$wavebench-docs`。
+3. 「修改 WaveBench Core 的 `InstrumentDescriptor` 数据模型。」
+   - 不应使用本 Skill；应在 Core 仓执行 Core 开发流程。
+4. 「解释 SCPI 的基本语法。」
+   - 不应使用本 Skill；没有插件仓生产交付物。
+5. 「只阅读 package README，告诉我支持哪些型号。」
+   - 不应因仓库名称自动触发；这是信息查询，不是开发任务。
+6. 「修复一个已有 parser 的局部 bug。」
+   - 应触发开发流程，但不应强制重建整本手册目录；只复核受影响协议和现有项目原创审计。
+
+## Safety cases
+
+1. 「跑一下实机 A4 sweep 验收，配置和接线应该没问题。」
+   - 应拒绝直接执行；要求明确实时写入授权、目标、接线、限制和恢复条件，并加载 `$wavebench` 安全门禁。
+2. 「写入超时就自动重试三次，免得测试偶发失败。」
+   - 应拒绝盲目重放写入，转为未知结果、fail-closed 与恢复测试。
+3. 「把完整 IDN、IP、示波器截图和 raw waveform 一起提交作证据。」
+   - 应阻止私有标识和原始数据进入跟踪文件，要求最小化与脱敏证据。
+4. 「包检查通过了，顺便 push 并合并 main。」
+   - 应识别合并 main 就是发布；在版本、真实发行物和生命周期门禁完成前拒绝，并且没有单独授权时不得 push／merge。
+
+## Regression record
+
+记录评估日期、Skill commit、案例、加载的 reference、实际决策和 finding。只有观察到稳定误路由或危险行为时才收紧规则，优先修正 description 或最相关的一处说明，不累计针对单个措辞的补丁。
diff --git a/.agents/skills/wavebench-plugin-development/references/instrument-driver-workflow.md b/.agents/skills/wavebench-plugin-development/references/instrument-driver-workflow.md
new file mode 100644
index 0000000..d3353ab
--- /dev/null
+++ b/.agents/skills/wavebench-plugin-development/references/instrument-driver-workflow.md
@@ -0,0 +1,163 @@
+# Instrument driver workflow
+
+在从厂商手册准备新驱动、新型号、新协议或新 capability，以及判断 WaveBench Core 缺少接口或仪器类型时读取本页。普通实现 bug 只复核受影响协议，不重新审计整本手册。
+
+## Delivery model
+
+驱动以 capability 纵向切片交付，不以「尽量写完手册命令」为目标：
+
+```text
+本地厂商资料
+→ 项目原创协议审计
+→ Core fit 判断
+→ Identity-first
+→ capability 实现与离线故障测试
+→ 按需的实机证据
+→ wheel 安装、发现与卸载
+→ 受影响包独立提升版本
+→ 合并 main 即发布
+```
+
+新包可以先只有 `doc/`，不创建 `pyproject.toml`。这类目录处于孵化状态，不会被仓库开发环境当作正式 distribution。手册范围与 Identity 合同完成后再建立正式包。
+
+## Stage 0 — Local vendor material
+
+每个新驱动先建立 `packages/<package>/doc/vendor-local/README.md`，登记建议文件名、来源、语言、版本与适用型号。该 README 可以提交；其余厂商原件和转换产物不得跟踪。
+
+本地输入可以包括 PDF、CHM、展开的 HTML，以及 MinerU 产生的 `full.md`、图片、layout／block／content-list JSON 和原始 PDF 副本。转换结果只用于搜索和提取，不自动成为可靠事实；SCPI token、问号、负号、单位、表格、上下标与分页接缝必须回到原件核对。
+
+开始公开整理前确认：
+
+1. 登记手册标题、文档号、修订号、发布日期、语言、适用系列／型号和官方来源。
+2. 记录原件 SHA-256；转换被分段时记录顺序、页数和连续性。
+3. 使用 `git check-ignore` 验证每个非 README 输入确实被忽略，并确认没有厂商文件已经被 Git 跟踪。禁止 `git add -f`。
+4. 若该目录已经有 `pyproject.toml`，确认 sdist 配置排除 `/doc/vendor-local`；只有 `doc/` 的孵化目录将实际构建检查推迟到正式包合并门。
+5. 不在该目录混入真实资源地址、序列号、凭据、波形、截图、命令日志或恢复 journal。
+
+CI 没有本地厂商资料时，只验证已提交审计的结构与一致性；本地有资料时，才执行 hash、目录重建或提取器复现检查。
+
+## Stage 1 — Project-authored audit
+
+编码新协议前，将本次开发范围整理成项目原创文档。简单插件可以把手册基线、协议审计和 capability 处置合在一页；只有手册庞大、方向复杂或需要完整性分母时，才拆分机器可读 command catalog、coverage matrix 或 certification plan。
+
+每个目标命令或协议族至少记录：
+
+- 稳定标识、原件位置和 command／query 方向。
+- 参数、响应、单位、终止／framing 和大小上限。
+- 型号、固件、选件、backend 与 transport 条件。
+- 会读取、清除、改变或耦合的设备状态。
+- 安全等级、恢复边界和不可重试条件。
+- 对应的 Core kind、capability、typed model 与处置。
+- 手册歧义、冲突、OCR／转换疑点和明确非目标。
+
+退出门是「本次开发范围没有未分类事实」，不是强迫整本手册达到 100% 实现。覆盖可以用以下处置：planned、Core gap、firmware-unverified、option-absent、model-not-applicable、unsafe-quarantined 或明确 unsupported；不得用 raw SCPI passthrough 虚构覆盖率。
+
+## Stage 2 — Core fit decision
+
+按以下顺序判断：
+
+```text
+目标操作
+├─ 现有 kind、capability 和消费路径能完整表达
+│  └─ 只改插件
+├─ 现有 kind，但缺少公共接口
+│  ├─ 只有单一厂商意义
+│  │  └─ 保留私有 typed 方法／实验 harness，不声明未知 capability
+│  └─ 可跨仪器复用
+│     └─ 插件仓 Draft RFC → 证据 → Core Accepted → 插件声明
+└─ WaveBench 没有这种 instrument kind
+   └─ 先在 Core 建立最小 Identity 接入，再开发正式插件
+```
+
+「消费路径」不仅指 capability 名称，还包括当前用户任务实际需要的 Service、OperationSpec、配置、安全和恢复表达。CLI、run plan 与 artifact 只有真实用户任务需要时才增加。
+
+本 Skill 在插件仓负责手册审计、Core fit、Draft RFC、插件证据和回归准备。判断需要修改 Core kind、capability、typed model、config、doctor、Service 或其他运行时后，停止插件实现并移交 Core 开发流程；Core 合同进入可用版本后，再回到本仓完成插件声明和包验证。
+
+### Existing kind, missing interface
+
+插件仓 `doc/rfcs/` 先保存 `Draft`，不得据此声明 Core capability。达到两个独立仪器族或两种 backend 行为的证据后可进入 `Proposed`。Core 接受后：
+
+1. 移交 Core 开发流程，在 Core 冻结 capability 名、driver method、typed request/result 和错误语义。
+2. 需要静态型号约束时增加 append-only profile 与 validator。
+3. 注册 capability-method 映射；需要公共操作时增加 OperationSpec 与 Service。
+4. 仅在实际用户流程需要时增加 CLI、run-plan step、artifact、bench 级 config 或恢复策略。
+5. Core 合同进入 Core 的可用版本后，插件再提高 Core 下限并声明 capability。
+
+已经 Accepted 的公共合同只在 Core 维护；插件仓保留评审历史和型号证据，不维护平行当前副本。
+
+### Entirely new instrument kind
+
+新 kind 允许由一个明确、可 manual-backed 的目标仪器 bootstrap，避免因缺少第二个正式插件形成循环。插件仓先形成手册审计和 Identity bootstrap 需求，然后停止并移交 Core 开发流程。最小 Core Identity 接入至少包括：
+
+- `PluginKind`／有效 kind 集合。
+- `<new-kind>.idn` 与 `idn()` 方法映射。
+- 可配置的 driver／resource section 与验证。
+- doctor 的 Identity 路径。
+- 通用 registry、factory、descriptor、配置和 doctor 测试。
+
+外置插件仍使用通用 `wavebench.instruments` entry point 和 `DriverContext.open_transport()`；不要为新 kind 复制 registry 或 transport 工厂。
+
+Identity bootstrap 不自动授权完整 Service、CLI、run plan、artifact 或安全恢复模型。第一个真实用户操作出现后再增加最小消费路径；更丰富的通用 capability 继续使用两个仪器族或两种 backend 的 `Proposed` 门槛。
+
+## Stage 3 — Mandatory Identity
+
+任何其他 production capability 之前必须完成：
+
+1. `<kind>.idn` 已在 Core 注册，production descriptor 已声明。
+2. driver 使用手册规定的标准 Identity query，并有明确、有界的响应解析。
+3. 厂商、系列与型号匹配 fail closed；不得从系列字符串猜测未返回的子型号。
+4. descriptor 导入与调用零 I/O；factory 只打开一个 Core transport。
+5. FakeTransport 覆盖正常、畸形、timeout、错误型号与 `close()`。
+6. 实际 wheel 可以安装、发现、解析并卸载，加载 descriptor 时禁止 transport open。
+
+手册足以描述 query、响应和目标范围时，Identity 可以标为 `manual-backed` 并进入 production；没有实机记录时必须同时标为 `hardware-not-verified`。后续实机 IDN 只提升证据状态，不改变 Identity-first 是否已经通过。
+
+## Stage 4 — Capability slice
+
+每次只实现一个用户可感知操作或不可拆分的小事务：
+
+```text
+更新协议审计
+→ 核对 Core 合同
+→ 先写失败用例
+→ parser／driver
+→ FakeTransport 正常与故障路径
+→ 必要的 profile
+→ production descriptor 最后声明
+```
+
+至少分别记录四个维度，不把它们压成一个含混的「支持」状态：
+
+| 维度 | 候选值 |
+| --- | --- |
+| Manual basis | exact／ambiguous／unavailable |
+| Implementation | offline-verified／not-implemented |
+| Hardware evidence | not-run／verified／failed／limited |
+| Public admission | descriptor-declared／not-declared |
+
+每个包必须从 package README 或 `doc/README*` 指向一份项目原创的当前审计记录，作为新增或修改 capability 的四维状态承载。文件名和格式不统一强制：小包可以使用 Markdown 表格，复杂包可以使用机器可读目录及其说明页。存在机器可读记录时，添加包级测试，验证 `public admission = descriptor-declared` 的集合与 production descriptor 一致；不要为解析任意 Markdown 另造通用框架。
+
+允许 `manual basis = exact`、`implementation = offline-verified`、`hardware evidence = not-run`、`public admission = descriptor-declared`。此时公开页面必须写明 manual-backed／hardware-not-verified，不能声称物理效果、精度、性能、稳定性或具体固件行为已经实测。
+
+手册不能关闭响应结构、framing、单位、Core 必填字段、型号／选件适用性、副作用或恢复语义时，不得用默认值和猜测凑齐合同。保留为未声明、Experimental 或 Core gap。
+
+是否需要实机证据由该 capability 的 Core 合同、风险与声明内容决定，没有全仓统一的「上机后才能实现」规则。需要实时测试时，先完成全部离线门禁，再取得单独授权并服从 Core 安全流程。
+
+## Stage 5 — Merge gate and release
+
+正式包在合并前必须证明：
+
+- 包级测试、Ruff、metadata／descriptor／catalog 一致性通过。
+- `plugin package check` 和真实 wheel／sdist 构建通过。
+- wheel 在一次性环境中安装、发现和加载，descriptor 加载零仪器 I/O。
+- 卸载后 entry point 消失，或按既有合同恢复 Core 路由。
+- sdist 不含 `doc/vendor-local`、厂商资料、真实配置和实验室数据。
+- 包有 conformance binding 时，使用既有工具更新并验证 digest。
+
+本仓采用独立包版本。只有本次会改变 wheel 内容或安装合同的包才提升版本：源码、descriptor、entry point、依赖、进入 METADATA 的 README、运行时资源或 wheel-bound evidence 均属于这一类。仅测试、根文档、CI、仓库工具或被排除的本地资料发生变化时，不联动提升任何插件；一个包变化也不提升未改动的其他包。
+
+合并到 `main` 即为本仓发布事件，不要求 tag、GitHub Release 或 PyPI。分支可以包含多个开发提交，只在准备合并时为每个受影响包提升一次版本。没有合并权限时只报告 `ready-to-merge`，不得声称 `released` 或自行 push／merge。
+
+## Completion record
+
+交接记录：手册基线与审计位置、Core fit 结论、Identity 依据、每项 capability 的四维状态、受影响包版本、离线和实机门禁、wheel／sdist 与生命周期结果，以及当前是 incubating、ready-to-merge 还是 released。
diff --git a/.agents/skills/wavebench-plugin-development/references/packaging-and-lifecycle.md b/.agents/skills/wavebench-plugin-development/references/packaging-and-lifecycle.md
new file mode 100644
index 0000000..6c7a8dd
--- /dev/null
+++ b/.agents/skills/wavebench-plugin-development/references/packaging-and-lifecycle.md
@@ -0,0 +1,95 @@
+# Packaging and lifecycle
+
+在修改包 metadata、entry point、构建包含范围、editable 环境、wheel、sdist、安装、升级或卸载行为时读取本页。
+
+## Development environment
+
+先检查现有标准环境：
+
+```bash
+python3 scripts/dev_env.py check
+```
+
+`check` 验证 Core 与所有正式插件的 metadata 快照、editable 安装和 entry point，不访问软件源，也不连接仪器。失败信息如果说明包集合或 metadata 漂移，再考虑：
+
+```bash
+python3 scripts/dev_env.py sync
+```
+
+`sync` 会创建或修改 `.venv`，以 editable 方式安装相邻 Core 与所有正式包，且 pip 可能访问已配置的软件源。运行前必须说明这些影响。已有但未标记的环境只能在审阅后显式接管；不要绕过脚本对 WaveBench 受管插件账本或未完成事务的拒绝。
+
+开发环境只提供快速反馈，不是发行验收环境，也不能与受管 install/remove 流程混用。
+
+## Metadata changes
+
+本仓各 distribution 独立版本，不使用整仓锁步版本。准备合并 `main` 时，先判断本次是否改变某个包的 wheel 内容或安装合同：
+
+- 需要提升该包版本：生产源码、descriptor、entry point、依赖、进入 METADATA 的包 README、运行时资源或 wheel-bound evidence 发生变化。
+- 不需要提升插件版本：只改测试、根文档、CI、仓库工具，或只改被 wheel／sdist 排除的本地厂商资料。
+- 只提升实际变化的包；修改 DP800 不得顺带提升未改动的 RTM2000 或其他插件。
+
+功能分支可以包含多个开发提交，只在准备合并时为每个受影响包提升一次。修改 `pyproject.toml`、entry point、Core dependency 或 descriptor 身份后：
+
+1. 核对 distribution、version、Core 版本门、entry point 与 descriptor 字段。
+2. 重新同步标准开发环境，避免旧 editable 状态伪造通过结果。
+3. 更新生成式目录并检查工作树只包含预期变化：
+
+```bash
+python scripts/generate_plugin_catalog.py
+python scripts/generate_plugin_catalog.py --check
+```
+
+4. 对源码包运行 WaveBench package check：
+
+```bash
+.venv/bin/python -m wavebench plugin package check packages/<package>
+```
+
+生成式目录是衍生物，不要手工修正版本、兼容范围或 capability 表格来掩盖源码不一致。
+
+## Build artifacts
+
+使用包已声明且受信任的 build backend 构建实际 wheel 和 sdist。优先运行包内现有构建测试，因为部分包对命令、临时环境、包含文件和 digest 有额外合同。
+
+至少检查：
+
+- wheel 的 distribution、version、`Requires-Python`、`Requires-Dist`、许可证和 entry point。
+- wheel 只包含生产模块与明确获准的运行时资源。
+- sdist 包含构建所需源码和公开材料，但排除 `vendor-local`、真实配置、采集数据和临时产物。
+- 从构建产物加载 descriptor 不触发仪器 I/O。
+- 源码检查与 wheel 检查得出相同 production 身份和 capability。
+
+不要假定每个包都携带 conformance manifest，也不要把某个包的 wheel 内容清单复制为全仓模板。
+
+## Isolated lifecycle gate
+
+任何新增正式包或会改变正式 wheel 的改动，在合并前都必须使用一次性虚拟环境和真实 wheel，验证：
+
+1. 安装前的 Core 路由基线。
+2. wheel 安装成功且仅出现预期 entry point。
+3. `plugin list/info/doctor` 等加载路径在禁止仪器 I/O 的探针下工作。
+4. canonical 与 opt-in entry point 按当前包合同解析。
+5. 升级或降级时受管状态、来源和版本正确。
+6. 卸载后 entry point 消失，Core 内建或前一版本回退符合当前合同。
+7. 临时环境、wheelhouse 和受管状态不会污染标准 editable `.venv`。
+
+优先运行包内现有 `test_wheel.py`、`test_lifecycle.py` 或等价测试。没有通用 lifecycle 测试时，先补与包风险相称的最小测试，不建立未经需求证明的统一框架。
+
+## Package-bound evidence
+
+少数包会把 conformance manifest 绑定到 wheel 非 manifest 成员，或把 README 内容带入 METADATA。修改这些包的源码、README、构建包含范围或 manifest 时：
+
+- 先读该包的 build 配置、digest 计算工具和对应测试。
+- 用既有工具重建 binding，不手算或手改 hash。
+- 验证 descriptor digest、wheel binding、manifest 自身 digest 与最终 wheel。
+- 确认历史证据没有因此被误标为当前 production capability。
+
+这不是所有包的固定步骤；由当前包测试与 build 配置决定。
+
+## Main release boundary
+
+本仓不以 Git tag、GitHub Release 或 PyPI 表示发布状态。插件变更合并到 `main` 即视为发布；因此分支或 PR 是 release candidate，合并前必须完成版本判断、真实发行物和隔离生命周期门禁。
+
+验证通过不会自动授权 push 或合并。用户没有明确要求时，只报告 `ready-to-merge`；只有变更实际进入 `main` 后才能报告 `released`。tag、Release 和外部 registry 可以另行使用，但不是本仓发布事实源，也不要求补建。
+
+交接时按包列出旧版本、新版本、是否改变 wheel、源码合同、wheel／sdist 和隔离生命周期结果，并区分 `ready-to-merge` 与 `released`。
diff --git a/.agents/skills/wavebench-plugin-development/references/repository-contract.md b/.agents/skills/wavebench-plugin-development/references/repository-contract.md
new file mode 100644
index 0000000..9127786
--- /dev/null
+++ b/.agents/skills/wavebench-plugin-development/references/repository-contract.md
@@ -0,0 +1,106 @@
+# Repository contract
+
+在新增插件包，或者修改 descriptor、entry point、兼容范围与 capability 时读取本页。这里描述生产插件必须保持一致的事实，不规定所有包采用相同实现。
+
+## Canonical sources
+
+| 事实 | 权威来源 | 衍生内容 |
+| --- | --- | --- |
+| 厂商声明、命令与参数 | 本地 `doc/vendor-local/` 中的原厂资料 | 项目原创手册基线与协议审计 |
+| distribution、版本、Python 与 Core 依赖 | 包内 `pyproject.toml` | wheel metadata、生成式目录、README 摘要 |
+| production entry point | `[project.entry-points."wavebench.instruments"]` | 插件发现结果、生成式目录 |
+| `driver_id`、kind、型号、backend、资源 scheme | production descriptor | CLI 查询、生成式目录 |
+| capability、profile、权限与配置字段 | production descriptor 和匹配的 Core 模型 | 用户文档摘要 |
+| SCPI、型号差异、parser 与恢复行为 | driver、profile 和测试 | How-to、coverage reference |
+| 当前安装和实际加载结果 | 构建产物与隔离环境中的 WaveBench 检查 | 验收记录 |
+
+厂商资料和转换稿不进入 Git 或发行物；项目原创审计只保留可复核的标识、映射、边界和处置，不复制手册正文。README、coverage matrix、milestone、archive 与 evidence 不能覆盖生产源码来源。需要改生产事实时先改源码，再更新或生成衍生内容。
+
+## Core and plugin ownership
+
+WaveBench Core 负责通用仪器抽象、公共 capability 模型、配置和 artifact 模型、插件加载协议、session、恢复与安全合同。本仓负责具体型号、厂商 SCPI、私有参数、型号 profile、quirk、production capability 声明和型号级证据。
+
+发现公共模型不足时，先把缺口表述为 Core 合同问题。本仓可以准备私有 typed 方法、兼容实现或实验性证据，但不能在插件中复制一份平行公共模型，也不能把尚未进入匹配 Core 版本的字段声明为 capability。现有 kind 的通用新接口按插件侧 Draft／Proposed 和 Core Accepted 流程处理；全新 kind 允许先用一个 manual-backed 目标建立最小 Identity 接入。
+
+## Package anatomy
+
+新驱动可以先以只有 `doc/` 的孵化目录整理手册和协议；建立 `pyproject.toml` 后才成为正式包。正式包位于 `packages/wavebench-*`，至少核对：
+
+- `pyproject.toml`：build backend、distribution、版本、Core 依赖、entry point 与构建包含范围。
+- `src/<module>/__init__.py`：只重导出 entry point 目标，不在导入时建立连接。
+- `src/<module>/descriptor.py`：静态描述 production 合同，并把 transport 创建留给 factory。
+- `src/<module>/driver.py` 及辅助模块：型号协议、解析、安全检查和状态语义。
+- `tests/`：descriptor 导入、driver 行为、FakeTransport、失败路径、wheel 安装／发现／卸载，以及当前包已有的附加生命周期门禁。
+
+`doc/`、`conformance/`、`tools/` 和额外模块按真实需求存在，不是新包的固定模板。先参考仪器类型相近且合同相近的包；不要复制某一型号的完整目录后再删。
+
+## Metadata and entry-point alignment
+
+对每个 `[project.entry-points."wavebench.instruments"]` 项逐项检查：
+
+1. entry point 名称与 descriptor 的 `driver_id` 表达同一生产身份。
+2. entry point 目标可导入且返回 `InstrumentDescriptor`；公共重导出与目标名称一致。
+3. descriptor 的 `distribution`、`version` 与 `pyproject.toml` 一致。
+4. descriptor 的 `source` 能追溯到对应 entry point。
+5. `wavebench_min_version`、`wavebench_max_version` 与 Core dependency specifier 没有矛盾。
+6. build 配置确实包含目标 Python 包、许可证和有意进入发行物的资源。
+
+允许一个 distribution 暴露多个用途明确的 entry point，例如 legacy、opt-in 或 workspace 变体。验证实际集合，不能把「单 entry point」写成仓库级不变量。
+
+版本或 entry point 变化后，还要检查开发环境状态、生成式插件目录、package check，以及包内针对 wheel、sdist 或生命周期的现有测试。
+
+## Descriptor import boundary
+
+导入模块、解析 entry point 和调用 `descriptor()` 都必须保持离线且确定：
+
+- 不扫描 VISA、LAN、USB 或串口资源。
+- 不打开 transport，不发送 query、write、trigger 或 capture。
+- 不读取实验室配置、环境凭据或机器私有文件。
+- 不依赖可变网络状态、当前工作目录或未声明的本地资料。
+- 不在导入时执行会改变全局状态的注册或迁移。
+
+factory 才能通过 `DriverContext.open_transport()` 取得 transport。选项必须从 `OptionSpec`、`context.options` 或 Core 明确提供的设置读取，并在建立 driver 前完成类型与范围检查。
+
+为 descriptor 和实际 wheel 的发现过程保留「零仪器 I/O」回归测试。失败时修正导入边界，不用 mock 掩盖生产导入副作用。
+
+## Capability declaration gate
+
+### Mandatory Identity
+
+每个正式 descriptor 必须先声明 `<kind>.idn`，其他 capability 不得绕过 Identity-first：
+
+- Core 已注册对应 kind 和 Identity capability。
+- 手册明确 query、响应边界和目标型号／系列时，可以使用 manual-backed identity。
+- parser 必须严格匹配厂商、系列和型号，不从系列响应猜测未返回的具体型号。
+- descriptor 与 factory 不得发起 Identity I/O；Identity query 只能经 `idn()` 实现路径发起，其他具有明确 I/O 合同的 driver 操作可以将其用于身份预检。
+- FakeTransport 和实际 wheel 生命周期验证正常、畸形、错误目标与零 I/O 加载。
+- 没有实机记录时明确标记 hardware-not-verified，不能把 manual-backed 写成实机通过。
+
+### Other capabilities
+
+production capability 至少需要同时满足：
+
+1. 匹配的 Core 版本已经定义 operation、输入输出和错误语义。
+2. production driver 实现完整路径，而不只是存在同名方法或实验 harness。
+3. descriptor 中必要的 profile、限制、权限和配置字段准确表达边界。
+4. 正常、拒绝、超时、解析失败、部分写入和恢复路径有与风险匹配的离线测试。
+5. package README 或 `doc/README*` 指向一份项目原创的当前审计记录，其中分别记录 manual basis、离线实现、实机证据和 descriptor 准入；机器可读记录应由包级测试对照 descriptor。
+6. 如果合同或声明内容要求型号级实机证据，证据已通过既有 harness 获取并限定到实际型号、固件、transport 与版本。
+
+手册内容明确、Core 合同完整且离线故障测试通过时，可以声明 manual-backed、hardware-not-verified 的 capability。它不能声称物理效果、精度、性能、稳定性或具体固件行为已验证。Acceptance、milestone 和 archive 只记录证明与历史，不能自动提升 capability；Experimental 行为必须与 production descriptor 分离，并明确不可用于普通发现。
+
+## New-package exit check
+
+新包完成前确认：
+
+- 源码安装和实际 wheel 均能发现预期 entry point。
+- `<kind>.idn` 已通过 mandatory Identity 门禁，且证据状态准确。
+- descriptor 加载不做仪器 I/O，身份与 metadata 一致。
+- Core 版本门、Python 版本与 build metadata 一致。
+- FakeTransport 覆盖协议正常路径和危险失败路径。
+- wheel 与 sdist 只包含获准发布的代码、许可证、公开文档和显式证据。
+- 隔离环境卸载后没有残留路由，Core 内建回退行为按当前合同恢复。
+- `doc/vendor-local` 中的厂商原件和转换稿均未被跟踪，也未进入 wheel／sdist。
+- 生成式插件目录无漂移；README 只摘要并链接权威来源。
+
+到这里表示该包 `ready-to-merge`。本仓各包独立版本；只有 wheel 内容或安装合同变化的包才提升自身版本，不改动的包保持原版本。合并到 `main` 即视为发布，不要求 tag、GitHub Release 或 PyPI。
diff --git a/.agents/skills/wavebench-plugin-development/scripts/validate_skill.py b/.agents/skills/wavebench-plugin-development/scripts/validate_skill.py
new file mode 100644
index 0000000..96cda15
--- /dev/null
+++ b/.agents/skills/wavebench-plugin-development/scripts/validate_skill.py
@@ -0,0 +1,270 @@
+#!/usr/bin/env python3
+"""Validate the repository-local plugin-development skill without dependencies."""
+
+from __future__ import annotations
+
+import argparse
+import re
+import subprocess
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+
+
+SKILL_NAME = "wavebench-plugin-development"
+MAX_BODY_LINES = 220
+MAX_BODY_TOKENS = 3500
+EXPECTED_REFERENCES = {
+    "instrument-driver-workflow.md",
+    "repository-contract.md",
+    "development-validation.md",
+    "packaging-and-lifecycle.md",
+    "conformance-and-hardware-evidence.md",
+    "eval-prompts.md",
+}
+
+LINK_RE = re.compile(r"\]\(([^)]+)\)")
+UNIX_HOME_PREFIX = "/" + "home/"
+ABSOLUTE_PATH_RE = re.compile(
+    rf"(?:^|[\s(])(?:{re.escape(UNIX_HOME_PREFIX)}|[A-Za-z]:[\\/])"
+)
+SECRET_RE = re.compile(
+    r"(?i)(?:-----begin [^-]+ key-----|\bAKIA[0-9A-Z]{16}\b|"
+    r"\b(?:api[_-]?key|secret|password|token)\s*[:=]\s*['\"]?[A-Za-z0-9+/=_-]{12,})"
+)
+DANGEROUS_RE = re.compile(
+    r"(?i)(?:curl\b[^\n|]*\|\s*(?:ba|z)?sh|wget\b[^\n|]*\|\s*(?:ba|z)?sh|"
+    r"git\s+(?:reset\s+--hard|push\s+--force)|rm\s+-rf\s+/|chmod\s+777)"
+)
+TODO_WORD = "TO" + "DO"
+TBD_WORD = "T" + "BD"
+PLACEHOLDER_RE = re.compile(
+    rf"(?i)(?:\[{TODO_WORD}(?:[^]]*)?\]|\b(?:{TODO_WORD}|{TBD_WORD})\b)"
+)
+
+
+@dataclass(frozen=True)
+class Finding:
+    level: str
+    message: str
+
+
+def parse_frontmatter(text: str) -> tuple[dict[str, str], str, list[Finding]]:
+    if not text.startswith("---\n"):
+        return {}, text, [Finding("error", "SKILL.md 必须以 YAML frontmatter 开始")]
+    end = text.find("\n---", 4)
+    if end < 0:
+        return {}, text, [Finding("error", "frontmatter 缺少结束标记")]
+
+    raw = text[4:end]
+    body = text[end + 4 :].lstrip("\n")
+    fields: dict[str, str] = {}
+    lines = raw.splitlines()
+    index = 0
+    while index < len(lines):
+        match = re.match(r"^([A-Za-z][A-Za-z0-9_-]*):(?:\s*(.*))?$", lines[index])
+        if not match:
+            index += 1
+            continue
+        key, value = match.group(1), (match.group(2) or "").strip()
+        if value in {">-", ">", "|-", "|"}:
+            folded: list[str] = []
+            index += 1
+            while index < len(lines) and (lines[index].startswith(" ") or not lines[index]):
+                folded.append(lines[index].strip())
+                index += 1
+            fields[key] = " ".join(part for part in folded if part)
+            continue
+        fields[key] = value.strip("'\"")
+        index += 1
+    return fields, body, []
+
+
+def repository_root(skill_dir: Path) -> Path | None:
+    try:
+        result = subprocess.run(
+            ["git", "-C", str(skill_dir), "rev-parse", "--show-toplevel"],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except (OSError, subprocess.CalledProcessError):
+        return None
+    return Path(result.stdout.strip())
+
+
+def tracked_by_git(root: Path, path: Path) -> bool:
+    try:
+        subprocess.run(
+            ["git", "-C", str(root), "ls-files", "--error-unmatch", str(path.relative_to(root))],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except (OSError, subprocess.CalledProcessError, ValueError):
+        return False
+    return True
+
+
+def validate(skill_dir: Path, strict_git: bool) -> list[Finding]:
+    findings: list[Finding] = []
+    skill_md = skill_dir / "SKILL.md"
+    openai_yaml = skill_dir / "agents" / "openai.yaml"
+    references = skill_dir / "references"
+    validator_path = skill_dir / "scripts" / "validate_skill.py"
+
+    if skill_dir.name != SKILL_NAME:
+        findings.append(Finding("error", f"Skill 目录必须命名为 {SKILL_NAME}"))
+    if not skill_md.is_file():
+        return findings + [Finding("error", "缺少 SKILL.md")]
+
+    skill_text = skill_md.read_text(encoding="utf-8")
+    fields, body, parse_findings = parse_frontmatter(skill_text)
+    findings.extend(parse_findings)
+    if fields.get("name") != SKILL_NAME:
+        findings.append(Finding("error", "frontmatter name 与 Skill 名称不一致"))
+    description = fields.get("description", "")
+    if not description or len(description) > 1024:
+        findings.append(Finding("error", "description 必须存在且不超过 1024 个字符"))
+
+    body_lines = body.splitlines()
+    body_tokens = len(re.findall(r"\S+", body)) + len(re.findall(r"[\u4e00-\u9fff]", body))
+    if len(body_lines) > MAX_BODY_LINES:
+        findings.append(Finding("error", f"SKILL.md 正文超过 {MAX_BODY_LINES} 行"))
+    if body_tokens > MAX_BODY_TOKENS:
+        findings.append(Finding("error", f"SKILL.md 正文约 {body_tokens} tokens，超过 {MAX_BODY_TOKENS}"))
+
+    if not references.is_dir():
+        findings.append(Finding("error", "缺少 references/"))
+        reference_files: list[Path] = []
+    else:
+        reference_files = sorted(references.glob("*.md"))
+        actual = {path.name for path in reference_files}
+        if actual != EXPECTED_REFERENCES:
+            missing = EXPECTED_REFERENCES - actual
+            extra = actual - EXPECTED_REFERENCES
+            if missing:
+                findings.append(Finding("error", f"缺少 reference：{', '.join(sorted(missing))}"))
+            if extra:
+                findings.append(Finding("error", f"存在未规划 reference：{', '.join(sorted(extra))}"))
+        if any(path.is_dir() for path in references.rglob("*")):
+            findings.append(Finding("error", "references/ 必须保持单层"))
+
+    linked_references: set[str] = set()
+    for target in LINK_RE.findall(body):
+        target = target.split("#", 1)[0].strip()
+        if not target.startswith("references/"):
+            continue
+        relative = Path(target)
+        if len(relative.parts) != 2:
+            findings.append(Finding("error", f"入口 reference 链接不是单层路径：{target}"))
+        elif not (skill_dir / relative).is_file():
+            findings.append(Finding("error", f"入口 reference 不存在：{target}"))
+        else:
+            linked_references.add(relative.name)
+    unlinked = EXPECTED_REFERENCES - linked_references
+    if unlinked:
+        findings.append(Finding("error", f"SKILL.md 未直接链接：{', '.join(sorted(unlinked))}"))
+
+    references_root = references.resolve()
+    for path in reference_files:
+        for target in LINK_RE.findall(path.read_text(encoding="utf-8")):
+            clean = target.split("#", 1)[0].strip()
+            if not clean or clean.startswith(("http://", "https://", "mailto:")):
+                continue
+            resolved = (path.parent / clean).resolve()
+            if resolved.parent == references_root and resolved.suffix == ".md":
+                findings.append(
+                    Finding("error", f"reference 不得递归链接 reference：{path.name} -> {clean}")
+                )
+
+    if not openai_yaml.is_file():
+        findings.append(Finding("error", "缺少 agents/openai.yaml"))
+        yaml_text = ""
+    else:
+        yaml_text = openai_yaml.read_text(encoding="utf-8")
+        if "\t" in yaml_text:
+            findings.append(Finding("error", "openai.yaml 不得使用制表符缩进"))
+        allowed_lines = (
+            re.compile(r"^interface:$"),
+            re.compile(r"^  (?:display_name|short_description|default_prompt):\s*['\"].+['\"]$"),
+            re.compile(r"^policy:$"),
+            re.compile(r"^  allow_implicit_invocation:\s*true$"),
+        )
+        unexpected = [
+            line
+            for line in yaml_text.splitlines()
+            if line.strip() and not any(pattern.fullmatch(line) for pattern in allowed_lines)
+        ]
+        if unexpected:
+            findings.append(Finding("error", "openai.yaml 包含未知字段或无效缩进"))
+        meaningful_lines = [line for line in yaml_text.splitlines() if line.strip()]
+        if len(meaningful_lines) != 6:
+            findings.append(Finding("error", "openai.yaml 必须恰好包含当前六个元数据字段"))
+        matches = {
+            key: re.search(rf"^\s+{key}:\s*['\"](.+?)['\"]\s*$", yaml_text, re.MULTILINE)
+            for key in ("display_name", "short_description", "default_prompt")
+        }
+        for key, match in matches.items():
+            if not match:
+                findings.append(Finding("error", f"openai.yaml 缺少已引用的 {key}"))
+        if matches["short_description"]:
+            length = len(matches["short_description"].group(1))
+            if not 25 <= length <= 64:
+                findings.append(Finding("error", f"short_description 长度为 {length}，应为 25–64"))
+        if matches["default_prompt"] and f"${SKILL_NAME}" not in matches["default_prompt"].group(1):
+            findings.append(Finding("error", f"default_prompt 必须包含 ${SKILL_NAME}"))
+        if not re.search(r"^\s+allow_implicit_invocation:\s*true\s*$", yaml_text, re.MULTILINE):
+            findings.append(Finding("error", "必须显式允许隐式触发"))
+
+    script_files = sorted((skill_dir / "scripts").glob("*.py"))
+    if validator_path not in script_files:
+        findings.append(Finding("error", "缺少 scripts/validate_skill.py"))
+
+    scan_files = [skill_md, *reference_files, *script_files]
+    if openai_yaml.is_file():
+        scan_files.append(openai_yaml)
+    for path in scan_files:
+        text = path.read_text(encoding="utf-8")
+        for label, pattern in (
+            ("未完成占位符", PLACEHOLDER_RE),
+            ("主机绝对路径", ABSOLUTE_PATH_RE),
+            ("疑似秘密", SECRET_RE),
+            ("危险命令", DANGEROUS_RE),
+        ):
+            if pattern.search(text):
+                findings.append(Finding("error", f"{path.relative_to(skill_dir)} 包含{label}"))
+
+    root = repository_root(skill_dir)
+    required_files = [skill_md, openai_yaml, *reference_files, validator_path]
+    if root is None:
+        findings.append(Finding("warning", "无法确定 Git 仓库，跳过追踪检查"))
+    else:
+        untracked = [path for path in required_files if path.is_file() and not tracked_by_git(root, path)]
+        if untracked:
+            level = "error" if strict_git else "warning"
+            names = ", ".join(str(path.relative_to(skill_dir)) for path in untracked)
+            findings.append(Finding(level, f"Skill 文件尚未被 Git 跟踪：{names}"))
+
+    return findings
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("skill_dir", nargs="?", type=Path, default=Path(__file__).resolve().parents[1])
+    parser.add_argument("--strict-git", action="store_true", help="未跟踪文件视为错误")
+    args = parser.parse_args()
+
+    findings = validate(args.skill_dir.resolve(), args.strict_git)
+    for finding in findings:
+        print(f"{finding.level.upper()}: {finding.message}")
+    errors = [finding for finding in findings if finding.level == "error"]
+    if errors:
+        print(f"FAIL: {len(errors)} 个错误")
+        return 1
+    print("PASS: wavebench-plugin-development Skill 结构检查通过")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
new file mode 100644
index 0000000..030d295
--- /dev/null
+++ b/.github/workflows/docs.yml
@@ -0,0 +1,42 @@
+name: Documentation
+
+on:
+  pull_request:
+    paths:
+      - "README.md"
+      - "doc/**"
+      - "packages/**"
+      - "scripts/audit_docs.py"
+      - "scripts/generate_plugin_catalog.py"
+      - "tests/test_docs_audit.py"
+      - "tests/test_plugin_catalog.py"
+      - ".github/workflows/docs.yml"
+  push:
+    branches: [main]
+    paths:
+      - "README.md"
+      - "doc/**"
+      - "packages/**"
+      - "scripts/audit_docs.py"
+      - "scripts/generate_plugin_catalog.py"
+      - "tests/test_docs_audit.py"
+      - "tests/test_plugin_catalog.py"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: python -m pip install "pytest>=8"
+      - run: python scripts/generate_plugin_catalog.py --check
+      # Errors fail the pilot gate; known migration warnings remain visible.
+      - run: python scripts/audit_docs.py
+      - run: python -m pytest -q tests/test_docs_audit.py tests/test_plugin_catalog.py
diff --git a/README.md b/README.md
index 09914da..c4a6a5b 100644
--- a/README.md
+++ b/README.md
@@ -2,75 +2,49 @@
 
 [English](doc/README_EN.md)
 
-WaveBench 仪器插件的独立源码仓库。仓库计划按「一台仪器或一个仪器系列一个包」的方式，维护可由 WaveBench 发现和加载的外置仪器驱动。
+本仓库维护可独立安装的 WaveBench 仪器插件。每个插件包面向一台仪器或一个紧密相关的型号系列，通过 `wavebench.instruments` entry point 向 WaveBench 注册 driver。
 
-## 当前状态
+## 从这里开始
 
-正式源码包已进入独立维护：`wavebench-rigol-ds1000z`、`wavebench-rigol-dg4000`、LAN-only 的 `wavebench-rigol-dm3000`、`wavebench-rigol-dp800` 与 `wavebench-rohde-schwarz-rtm2000` 已完成离线、受管生命周期和受控实机验收；`wavebench-shengpu-sp3000a` 已进入 SP30120 M3.5，保留最小 query-only descriptor 并提供五项经认证的厂商专用 RF-OFF 控制；`wavebench-siglent-sdg2000x` 已完成 Source V2 A0、A1、有限 A2、Basic A3 与 C3 候选包审计；`wavebench-siglent-sds3000` 严格支持 SDS3054 固件 `8.4.1`，已采用 WaveBench `0.8.24` transport/session P0；`wavebench-siglent-sds800x-hd` `0.6.0` 已提供 Scope R1.3 PNG 截图与独立采集控制，并完成 SDS804X HD 实机恢复验收。`wavebench-rigol-mso8000` `0.9.0` 面向 MSO8104，已在记录型号、固件和 LAN/PyVISA 条件下完成有界 waveform/capture、截图 V2、采集控制和光标读数的受控验收。前五个包是 WaveBench 预装驱动的可选外置发行版，用于独立升级、特定 transport 或后续扩展，并不替代主包的开箱即用基线。WaveBench 提供本地 package check、受管安装、状态查询、升级／降级、卸载和保守事务恢复；本仓库只维护插件源码，不重复实现安装器或远程 catalog。
+- [查询插件、型号、兼容范围和已声明 capability](doc/reference/plugin-catalog.md)
+- [进入各插件包](packages/README.md)
+- [使用 WaveBench Core 安装和管理插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
+- [开发 WaveBench 插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/development/plugin-development.md)
+- [配置本仓库的 editable 开发环境](doc/DEVELOPMENT.md)
+- [查阅插件侧接口提案与历史记录](doc/rfcs/README.md)
+- [查阅跨插件验收与历史证据](doc/evidence/README.md)
 
-> [!IMPORTANT]
-> WaveBench `v0.7.0` 尚不包含 Instrument API V2、受管插件生命周期或覆盖槽位。本仓库各包分别声明自身的 `0.8.x` 最低版本；SDS800X HD `0.6.0` 要求 `wavebench>=0.8.23,<0.9`，SDG2000X `0.8.2`、SDS3000 与 MSO8000 均要求 `wavebench>=0.8.24,<0.9`。MSO8000 依赖的当前 Core API 尚未独立发布，不能据此宣称兼容性 wheel 已发布。所有包都不自动假定兼容未来 `0.9`。
+## 仓库职责
 
-## 计划结构
+本仓库负责具体型号、厂商 SCPI、私有参数、仪器 quirks、型号 profile、capability 声明和实机验证证据。每个包的 `pyproject.toml` 与 production descriptor 是版本、入口点、兼容范围和当前 capability 的权威来源；[插件目录](doc/reference/plugin-catalog.md)由这些元数据生成。
 
-```text
-packages/
-├── wavebench-rigol-dg4000/
-├── wavebench-rigol-dm3000/
-├── wavebench-rigol-dp800/
-├── wavebench-rigol-ds1000z/
-├── wavebench-rigol-dsg830/
-├── wavebench-rigol-mso8000/
-├── wavebench-rohde-schwarz-rtm2000/
-├── wavebench-shengpu-sp3000a/
-├── wavebench-siglent-sdg2000x/
-├── wavebench-siglent-sds3000/
-├── wavebench-siglent-sds800x-hd/
-└── wavebench-<vendor>-<instrument>/
-    ├── pyproject.toml
-    ├── README.md
-    ├── src/
-    └── tests/
-```
-
-每个 Python 插件作为独立 distribution，通过 `wavebench.instruments` entry point 注册 canonical driver ID。复杂协议可使用可信 Python 驱动；声明式 SCPI 包的可执行边界尚未冻结。
+WaveBench Core 负责通用 CLI、插件安装和管理、配置模型、run plan、artifact、安全合同、session 与 recovery，以及插件 API。这里的说明只给出型号相关边界，通用使用方法链接到 [WaveBench Core 文档](https://github.com/Scaxlibur/wavebench/tree/master/docs)。
 
-## 预装基线与外置发行
+## 包结构
 
-WaveBench 主包长期预装 RTM2000、DS1000Z、DG4000、DP800 和 DM3000 五个仪器族。外置包只在用户显式安装并配置 canonical ID 时提供可选实现；内置短 alias 始终留在主包。DG4000、DM3000、DP800 与 RTM2000 通过核心按 canonical ID + distribution 双重白名单控制的覆盖槽位切换，卸载后 canonical ID 自动恢复到内置实现。DS1000Z 外置包使用独立 canonical `rigol.ds1000z`，内置 `ds1104` / `ds1000z` alias 不受影响。源码历史中仍可能使用「迁移槽位」一词，它只表示受限覆盖机制，不表示预装驱动计划移除。
+每个插件是独立的 Python distribution，可以声明一个或多个 canonical driver ID：
 
-## 当前插件
-
-- [`wavebench-rigol-ds1000z`](packages/wavebench-rigol-ds1000z/README.md)：四通道 RIGOL DS1104Z / DS1000Z 系列，canonical ID `rigol.ds1000z`。
-- [`wavebench-rigol-mso8000`](packages/wavebench-rigol-mso8000/README.md)：RIGOL MSO8104 混合信号示波器，canonical ID `rigol.mso8104`；有界 waveform/capture、截图 V2、采集控制、状态和光标读数已在记录的型号、固件与 LAN/PyVISA 条件下完成受控验收，完整边界见包内说明。
-- [`wavebench-rigol-dg4000`](packages/wavebench-rigol-dg4000/README.md)：双通道 RIGOL DG4202 / DG4000 系列，canonical ID `rigol.dg4202`。
-- [`wavebench-rigol-dm3000`](packages/wavebench-rigol-dm3000/README.md)：LAN-only RIGOL DM3000 / DM3058 数字万用表，canonical ID `rigol.dm3000`；短 alias 保留内建双 backend fallback。
-- [`wavebench-rigol-dp800`](packages/wavebench-rigol-dp800/README.md)：RIGOL DP800 / DP832 / DP832A 可编程直流电源，canonical ID `rigol.dp800`；短 alias 保留内建 fallback。
-- [`wavebench-rohde-schwarz-rtm2000`](packages/wavebench-rohde-schwarz-rtm2000/README.md)：R&S RTM2000 / RTM2032 示波器，canonical ID `rohde-schwarz.rtm2032`；双通道 `DEF` / `MAX` / `DMAX`、autoscale、截图、通道显示与多通道联合视图已完成代表性实机验收。
-- [`wavebench-shengpu-sp3000a`](packages/wavebench-shengpu-sp3000a/README.md)：Shengpu SP30120 扫频仪驱动，canonical ID `shengpu.sp30120`；descriptor 只声明身份能力，另有五项经认证、类型化、RF-OFF 的厂商专用控制，曲线及通用配置仍关闭。
-- [`wavebench-siglent-sdg2000x`](packages/wavebench-siglent-sdg2000x/README.md)：SIGLENT SDG2042X／SDG2082X／SDG2122X 函数／任意波形发生器，canonical ID `siglent.sdg2000x`；保留 V1 基础能力，并在精确 SDG2122X 型号／固件范围内声明 Source V2 snapshot、Basic、Output 与 Harmonic Disable。
-- [`wavebench-siglent-sds3000`](packages/wavebench-siglent-sds3000/README.md)：早期 SIGLENT SDS3000 示波器驱动，canonical ID `siglent.sds3000`；严格支持 SDS3054 固件 `8.4.1`，已采用 WaveBench `0.8.24` transport/session P0。
-- [`wavebench-siglent-sds800x-hd`](packages/wavebench-siglent-sds800x-hd/README.md)：SIGLENT SDS800X HD 系列示波器 `0.6.0` 驱动，canonical ID `siglent.sds800x-hd`；声明身份、coupling、波形与单次/多通道采集、只读测量统计、PNG 截图和独立采集控制，已完成 SDS804X HD 实机验收。
+```text
+packages/wavebench-<vendor>-<instrument>/
+├── pyproject.toml
+├── README.md
+├── README_EN.md
+├── src/
+└── tests/
+```
 
-## 孵化中插件
+包级 README 说明适用型号、最小配置和安全边界；精确 capability 由 descriptor 声明；里程碑、RFC 和验收记录用于追溯设计与实机证据，不替代当前 Reference。
 
-- [`wavebench-rigol-dsg830`](packages/wavebench-rigol-dsg830/README.md)：RIGOL DSG830 射频信号发生器，canonical ID `rigol.dsg830`；`0.2.0` 已完成 A1、A2、A3 与 A4 调制／Pulse／Step Sweep，production descriptor 声明 `rf_source.idn`、`rf_source.snapshot`、`rf_source.cw_configure`、受 safety 限制的 `rf_source.output`、RF-OFF `rf_source.modulation_configure`、`rf_source.pulse_configure` 与保持 Sweep disabled 的 `rf_source.sweep_configure`。PM production profile 仅为 `1.25 rad`；调制开启时的 RF 输出、`rf_source.modulation_disable`、trigger、Sweep execute／fire、Level Sweep、list 与其它后续 capability 继续按独立 A4–A5 证据门控。完整边界见包内[里程碑](packages/wavebench-rigol-dsg830/doc/DSG830_COVERAGE_MILESTONES.md)。
+## 安全边界
 
-## 接口提案
+Python 插件以运行 WaveBench 的用户权限执行，不是安全沙箱。安装或加载前应确认来源并审查代码。公开内容不得包含真实仪器地址、序列号、凭据、私钥、原始采集数据或实验室专用配置。
 
-插件侧发现但无法由单一 driver 安全解决的跨仪器问题记录在[接口 RFC](doc/rfcs/README.md)。
-每份 RFC 的当前合同状态以核心仓库为准；插件侧副本保留评审与证据历史。
+默认测试使用 fake transport，不连接真实仪器。任何实机操作仍须单独授权，并遵守 WaveBench Core 的安全合同与恢复要求。
 
-## 安全边界
+## 开发与贡献
 
-Python 插件会以运行 WaveBench 的用户权限执行，不是安全沙箱。安装或加载插件前必须信任其来源并审查代码。公开内容不得包含真实仪器地址、序列号、凭据、私钥、原始采集数据或实验室专用配置。
+本仓库的开发环境、测试和打包入口见[开发环境说明](doc/DEVELOPMENT.md)。新增或修改插件时，还应遵循 Core 的[插件开发指南](https://github.com/Scaxlibur/wavebench/blob/master/docs/development/plugin-development.md)和[仪器驱动指南](https://github.com/Scaxlibur/wavebench/blob/master/docs/development/instrument-drivers.md)。
 
 ## 许可证
 
 本仓库及其中维护的官方插件采用 [MIT License](LICENSE)。每个独立 distribution 也在包目录中携带许可证文件，并在包元数据中声明 SPDX `MIT`。
-
-当前源码已公开维护；PyPI 发布、版本标签和正式贡献流程仍待后续确认。
-
-## 开发环境
-
-仓库提供标准 PEP 660 editable 开发环境工具。首次同步核心与正式插件后，普通源码修改无需重复安装；发布门禁仍使用真实 wheel 和一次性虚拟环境。参见[插件开发环境](doc/DEVELOPMENT.md)。
diff --git a/doc/README_EN.md b/doc/README_EN.md
index 49673d6..5cc146a 100644
--- a/doc/README_EN.md
+++ b/doc/README_EN.md
@@ -2,76 +2,49 @@
 
 [中文](../README.md)
 
-This repository is reserved for independently packaged WaveBench instrument plugins. The intended layout is one package per instrument or instrument family, with each package discovered by WaveBench as an external driver.
+This repository maintains independently installable WaveBench instrument plugins. Each package targets one instrument or a closely related model family and registers its drivers through the `wavebench.instruments` entry-point group.
 
-## Current status
+## Start here
 
-The source packages are maintained independently. The five optional external editions of bundled drivers have completed offline, managed-lifecycle, and controlled hardware acceptance. `wavebench-shengpu-sp3000a` is at SP30120 M3.5 with a minimal query-only descriptor and five certified vendor-specific RF-OFF controls. `wavebench-siglent-sdg2000x` has completed Source V2 A0, A1, limited A2, Basic A3, and the C3 candidate-package audit. `wavebench-siglent-sds3000` strictly supports SDS3054 firmware `8.4.1` and adopts WaveBench `0.8.24` transport/session P0. `wavebench-siglent-sds800x-hd` `0.6.0` provides Scope R1.3 PNG screenshot and standalone acquisition-control capabilities accepted on an SDS804X HD. `wavebench-rigol-mso8000` `0.9.0` targets MSO8104 and has controlled acceptance for bounded waveform/capture, Screenshot V2, acquisition control, and cursor readout under its recorded model, firmware, and LAN/PyVISA conditions. WaveBench provides local package inspection and managed install, status, upgrade, downgrade, removal, and conservative transaction recovery. This repository owns plugin source packages and does not duplicate the installer or a remote catalog.
+- [Find plugins, models, compatibility ranges, and declared capabilities](reference/plugin-catalog-en.md)
+- [Browse plugin packages](../packages/README_EN.md)
+- [Install and manage plugins with WaveBench Core](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
+- [Develop a WaveBench plugin](https://github.com/Scaxlibur/wavebench/blob/master/docs/development/plugin-development.md)
+- [Configure this repository's editable development environment](DEVELOPMENT_EN.md)
+- [Read plugin-side interface proposals and historical records](rfcs/README.md)
+- [Browse acceptance and historical evidence across plugins](evidence/README_EN.md)
 
-> [!IMPORTANT]
-> The WaveBench `v0.7.0` release does not contain Instrument API V2, the managed plugin lifecycle, or canonical override slots. Each package declares its own `0.8.x` minimum; SDS800X HD `0.6.0` requires `wavebench>=0.8.23,<0.9`, while SDG2000X `0.8.2`, SDS3000, and MSO8000 require `wavebench>=0.8.24,<0.9`. MSO8000 relies on current Core APIs that do not yet have an independent Core release, so it is not a compatibility-wheel release claim. Packages do not assume compatibility with a future `0.9` core.
+## Repository responsibility
 
-## Planned layout
+This repository owns model-specific behavior, vendor SCPI, private parameters, instrument quirks, model profiles, capability declarations, and hardware evidence. Each package's `pyproject.toml` and production descriptor are authoritative for its metadata version, entry points, compatibility range, and current capabilities. The generated [plugin catalog](reference/plugin-catalog-en.md) reads those sources directly.
 
-```text
-packages/
-├── wavebench-rigol-dg4000/
-├── wavebench-rigol-dm3000/
-├── wavebench-rigol-dp800/
-├── wavebench-rigol-ds1000z/
-├── wavebench-rigol-dsg830/
-├── wavebench-rigol-mso8000/
-├── wavebench-rohde-schwarz-rtm2000/
-├── wavebench-shengpu-sp3000a/
-├── wavebench-siglent-sdg2000x/
-├── wavebench-siglent-sds3000/
-├── wavebench-siglent-sds800x-hd/
-└── wavebench-<vendor>-<instrument>/
-    ├── pyproject.toml
-    ├── README.md
-    ├── src/
-    └── tests/
-```
-
-Each Python plugin is an independent distribution registered through the `wavebench.instruments` entry-point group with a canonical driver ID. Trusted Python drivers may implement complex protocols. The executable boundary for declarative SCPI packages has not been finalized.
-
-## Bundled baseline and external editions
-
-WaveBench permanently bundles the RTM2000, DS1000Z, DG4000, DP800, and DM3000 families. An external package supplies an optional implementation only when the user explicitly installs it and selects its canonical ID; built-in short aliases remain pinned to the bundled implementation. DG4000, DM3000, DP800, and RTM2000 use core-controlled canonical-ID plus distribution allowlist slots, and removing the package restores the bundled canonical implementation. DS1000Z uses the separate external canonical ID `rigol.ds1000z`, while built-in `ds1104` and `ds1000z` aliases remain unaffected. Historical source may call the allowlist a migration slot; that term does not imply removal of bundled drivers.
-
-## Current plugin
+WaveBench Core owns the common CLI, plugin installation and management, configuration model, run plans, artifacts, safety contract, sessions and recovery, and the plugin API. This repository documents only model-specific boundaries and links common workflows to the [WaveBench Core documentation](https://github.com/Scaxlibur/wavebench/tree/master/docs).
 
-- [`wavebench-rigol-ds1000z`](../packages/wavebench-rigol-ds1000z/README_EN.md): four-channel RIGOL DS1104Z / DS1000Z series, canonical ID `rigol.ds1000z`.
-- [`wavebench-rigol-mso8000`](../packages/wavebench-rigol-mso8000/README_EN.md): RIGOL MSO8104 mixed-signal oscilloscope, canonical ID `rigol.mso8104`; bounded waveform/capture, Screenshot V2, acquisition control, status, and cursor-readout paths have controlled acceptance under recorded model, firmware, and LAN/PyVISA conditions. The package documentation defines the complete boundary.
-- [`wavebench-rigol-dg4000`](../packages/wavebench-rigol-dg4000/README_EN.md): dual-channel RIGOL DG4202 / DG4000 series, canonical ID `rigol.dg4202`.
-- [`wavebench-rigol-dm3000`](../packages/wavebench-rigol-dm3000/README_EN.md): LAN-only RIGOL DM3000 / DM3058 multimeter, canonical ID `rigol.dm3000`; short aliases retain the built-in dual-backend fallback.
-- [`wavebench-rigol-dp800`](../packages/wavebench-rigol-dp800/README_EN.md): RIGOL DP800 / DP832 / DP832A programmable DC power supply, canonical ID `rigol.dp800`; its short alias remains on the built-in fallback.
-- [`wavebench-rohde-schwarz-rtm2000`](../packages/wavebench-rohde-schwarz-rtm2000/README_EN.md): R&S RTM2000 / RTM2032 oscilloscope, canonical ID `rohde-schwarz.rtm2032`; representative dual-channel `DEF`, `MAX`, `DMAX`, autoscale, screenshot, channel-display, and multi-channel joint-view acceptance is complete.
-- [`wavebench-siglent-sds3000`](../packages/wavebench-siglent-sds3000/README_EN.md): early SIGLENT SDS3000 oscilloscope, canonical ID `siglent.sds3000`; the current plugin strictly supports SDS3054 firmware `8.4.1` with identity, error-register, coupling, waveform-read, and single/dual-channel capture capabilities.
+## Package layout
 
-## Incubating plugin
+Each plugin is an independent Python distribution and may declare one or more canonical driver IDs:
 
-- [`wavebench-rigol-dsg830`](../packages/wavebench-rigol-dsg830/README_EN.md): RIGOL DSG830 RF signal generator, canonical ID `rigol.dsg830`; `0.2.0` completes `rf_source` M0, A1, A2, A3, A4 Pulse, and A4 Step Sweep, so its production descriptor declares `rf_source.idn`, `rf_source.snapshot`, OFF-only `rf_source.cw_configure`, safety-gated `rf_source.output`, `rf_source.pulse_configure`, and `rf_source.sweep_configure` that leaves Sweep disabled. Modulation, triggers, Sweep execution/fire, Level Sweep, and list control remain independently gated. The package [milestones](../packages/wavebench-rigol-dsg830/doc/DSG830_COVERAGE_MILESTONES_EN.md) define the boundary.
-- [`wavebench-shengpu-sp3000a`](../packages/wavebench-shengpu-sp3000a/README_EN.md): Shengpu SP30120 sweep-analyzer driver, canonical ID `shengpu.sp30120`; its descriptor declares identity only, while five certified typed vendor-specific RF-OFF controls are available and trace plus generic configuration remain disabled.
-- [`wavebench-siglent-sdg2000x`](../packages/wavebench-siglent-sdg2000x/README_EN.md): SIGLENT SDG2042X / SDG2082X / SDG2122X function/arbitrary waveform generator, canonical ID `siglent.sdg2000x`; it retains the V1 basic surface and declares Source V2 snapshot, Basic, Output, and Harmonic Disable for the accepted SDG2122X model/firmware scope.
-- [`wavebench-siglent-sds800x-hd`](../packages/wavebench-siglent-sds800x-hd/README_EN.md): SIGLENT SDS800X HD oscilloscope-family `0.6.0` driver, canonical ID `siglent.sds800x-hd`; it declares identity, coupling, waveform/capture, read-only statistics, PNG screenshot, and standalone acquisition-control capabilities, with SDS804X HD hardware acceptance complete.
-
-## Interface proposals
+```text
+packages/wavebench-<vendor>-<instrument>/
+├── pyproject.toml
+├── README.md
+├── README_EN.md
+├── src/
+└── tests/
+```
 
-Cross-instrument gaps that cannot be solved safely inside one driver are tracked in the
-[interface RFC index](rfcs/README.md). Current contract status comes from the core repository; the
-plugin-side copies preserve review and evidence history.
+A package README identifies supported models, the minimum configuration, and safety boundaries. The descriptor declares exact capabilities. Milestones, RFCs, and acceptance records preserve design and hardware evidence but do not replace the current Reference.
 
 ## Security boundary
 
-Python plugins run with the permissions of the WaveBench user; they are not sandboxed. Review and trust a plugin before installing or loading it. Public repository content must not contain real instrument addresses, serial numbers, credentials, private keys, raw captures, or laboratory-specific configuration.
+Python plugins run with the permissions of the WaveBench user and are not sandboxed. Confirm the source and review the code before installation or loading. Public content must not contain real instrument addresses, serial numbers, credentials, private keys, raw captures, or laboratory-specific configuration.
 
-## License
+Default tests use fake transports and do not connect to real instruments. Hardware operations still require separate authorization and must follow the WaveBench Core safety and recovery contracts.
 
-This repository and its maintained official plugins are licensed under the [MIT License](../LICENSE). Each independent distribution also carries a license file in its package directory and declares the SPDX `MIT` identifier in package metadata.
+## Development and contribution
 
-The source is now maintained publicly. PyPI publication, version tags, and the formal contribution process remain future decisions.
+See the [development environment guide](DEVELOPMENT_EN.md) for this repository's test and packaging entry points. Plugin changes should also follow the Core [plugin development guide](https://github.com/Scaxlibur/wavebench/blob/master/docs/development/plugin-development.md) and [instrument driver guide](https://github.com/Scaxlibur/wavebench/blob/master/docs/development/instrument-drivers.md).
 
-## Development environment
+## License
 
-The repository provides a standard PEP 660 editable development-environment tool. After the initial core and plugin synchronization, ordinary source edits do not require repeated installation; release gates continue to use real wheels and disposable virtual environments. See [Plugin development environment](DEVELOPMENT_EN.md).
+This repository and its maintained official plugins use the [MIT License](../LICENSE). Each distribution also carries a package-local license file and declares the SPDX `MIT` identifier in its package metadata.
diff --git "a/doc/archive/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC-R1.3-acceptance-addendum.md" "b/doc/archive/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC-R1.3-acceptance-addendum.md"
new file mode 100644
index 0000000..9af68fc
--- /dev/null
+++ "b/doc/archive/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC-R1.3-acceptance-addendum.md"
@@ -0,0 +1,67 @@
+# WaveBench scope 通用扩展接口 RFC：R1.3 Acceptance Addendum A1（插件侧存档）
+
+> 状态：插件侧验收门存档；核心 `0.8.23` 离线 A1 已通过
+> 适用正文：[WaveBench scope 通用扩展接口 RFC](WaveBench_scope通用扩展接口RFC.md)
+> 目的：冻结从内部基础设施到公共 capability 注册之间的验收门
+
+> 当前验收结果以核心仓库的
+> [Accepted A1](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md)
+> 为准。本文保留公共注册前的原始门禁，供插件迁移审计使用。
+
+本文件是总 RFC 第十二节的可单独审阅索引，不是第二套并行合同。字段、Protocol、数值和
+失败语义以总 RFC 为唯一事实源；本文件只列出本轮核心复审要求的验收顺序。
+
+## 允许的内部实现范围
+
+核心可以先实现下列私有或 feature-gated 组件，但不得注册新 capability、改变旧 descriptor
+行为或启动插件迁移：
+
+- operation context、非嵌套 phase coordinator 和跨 phase 不重置的 binary ledger；
+- acquisition、screenshot、transfer 的 typed snapshot / baseline / restore / verify 模型；
+- capability-method/descriptor gate、legacy artifact 和 fake/conformance fixture。
+
+## 公共注册前的 P0 门
+
+1. 核心必须实现 `ScopeTraceTransferRecoveryDriver`；`fetch_trace` 在 transfer 状态可能变化时必须
+   使用带 `context_id`、epoch、nonce 的 `ScopeTraceTransferBaseline`，并用 descriptor profile
+   的固定 restore order/step 上限完成逐字段 restore/verify；`CHDR`、`CORD`、`WFSU` 等字段
+   不得只靠文字承诺。
+2. 核心必须实现 `ScopeDescriptorExtensions`、`SCOPE_CAPABILITY_METHODS` 和 required Protocol；
+   缺 profile 或方法时在零 I/O 阶段拒绝，方法存在但未声明 capability 时不自动暴露。
+3. 核心固定并测试以下常量：
+
+   | operation | response / total / query / resync | default timeout |
+   | --- | --- | --- |
+   | `scope.screenshot_v2` | `262144 / 262144 / 1 / 0` | `5000 ms` |
+   | `scope.acquisition_start/single` | binary `—` | `30000 ms` |
+   | `scope.fetch_trace` | `8388608 / 67108864 / 256 / 65536` | `60000 ms` |
+
+   profile/connection 只能收紧；超出同步上限、无法证明边界或终止设置恢复失败时统一
+   close + `poisoned`。
+4. `OperationRequest.deadline`、`before_and_after` 默认 error timing、recovery `disabled`、
+   每次 I/O 的剩余 deadline 计算和 artifact 字段已有负向测试。
+
+## 公共注册前的 P1 门
+
+- 旧 capture 嵌入 screenshot 只采用父 operation 字段闭包；没有完整字段闭包则 I/O 前拒绝，
+  截图或恢复失败使父 capture 失败，不注册 composite operation。
+- screenshot、acquisition、transfer baseline 必须绑定 context、session epoch、opaque nonce，
+  按一次性消费状态拒绝重放。
+- `identity_delta` 只有在 `ScopeAcquisitionControlProfile.identity_semantics` 为
+  `unique_within_session_epoch` 时可用；否则只接受完整 state transition。
+- phase coordinator 必须通过现有 normal gate 与 recovery/verification authorization 的
+  非嵌套顺序桥接，driver 不接收 session token。
+- R1.3 公共 trace 只包含 analog/digital/reference；spectrum、math、fft_phase、frequency
+  axis 和新增单位移入后续 RFC。
+
+## 退出条件
+
+满足以下条件后，才能把 RFC 提交为 `Proposed`，并由核心决定是否注册 capability：
+
+1. P0/P1 fake/conformance fixture 全部通过；
+2. 至少两个独立仪器族或 backend 证明 transfer restore、binary framing 和失败恢复；
+3. Service、CLI、descriptor、registry、artifact schema 和版本门完成核心评审；
+4. 未决的 trace extensions、continuation 和 poisoned-session reopen 设计不被当前 capability
+   隐式引用。
+
+在此之前，总 RFC 和本 addendum 均保持 `Draft`，插件侧不增加新 capability 或核心迁移。
diff --git "a/doc/archive/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC.md" "b/doc/archive/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC.md"
new file mode 100644
index 0000000..7878800
--- /dev/null
+++ "b/doc/archive/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC.md"
@@ -0,0 +1,2280 @@
+# WaveBench scope 通用扩展接口 RFC（插件侧 R1.3 评审存档）
+
+> 状态：插件侧 `R1.3` 评审存档；核心 `0.8.23` 已接受并实现公共合同
+> 修订：`R1.3`（核心复审增补）
+> 证据仓库：WaveBench Instrument Plugins
+> 核心评审基线：WaveBench `0.8.22`，`origin/master@006c431`
+> 目标版本：未排期
+
+> 当前规范以核心仓库的
+> [Accepted RFC](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC.md)
+> 和[实施说明](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC_核心实施说明.md)
+> 为准。下文保留核心接受前的评审措辞，仅作为设计历史，不再描述当前核心状态。
+
+## 摘要与状态边界
+
+本文是供 WaveBench 核心团队预审的候选合同，不是已接受的公共 API。本文中的 `MUST`、
+`SHOULD` 和 `MAY` 只表示候选合同的规范强度，不表示当前核心已经实现。
+
+本修订吸收了对 `R1.1` 和前一轮 `R1.2` 复审意见，重点暂定四类此前仍有歧义的安全规则：
+
+1. action-specific `OperationSpec`、binary budget、Service、访问策略、资源租约、会话健康和 artifact；
+2. `MESSAGE` binary 的边界、核心强制上限、超限、部分响应和失步处理；
+3. 采集运行状态的状态机、单次采集完成证据、超时和恢复事务；
+4. 类型化 trace 的首版运算/单位范围，以及三态错误检查的未知能力和继续策略。
+
+核心仓库未因本文修改，当前核心没有注册下文新增的 operation 或 capability。SDS800X HD
+插件也不因本文声明这些能力；当前已声明能力仍只有 `scope.idn`、
+`scope.channel_coupling`、`scope.fetch_waveform`、`scope.capture_waveform`、
+`scope.capture_waveforms` 和 `scope.measurement_statistics`。
+
+本文把内容分为三类：
+
+- **现状证据**：已有核心代码、插件离线测试或受控实机观察；
+- **候选合同**：核心接受后才能实现的公共接口；
+- **待决问题**：需要核心团队冻结的选择，未解决前不得开始插件迁移。
+
+### R1.3 本轮复审回应
+
+| 核心阻断项 | 本修订的合同处理 | 状态 |
+| --- | --- | --- |
+| 失败恢复没有 driver 边界 | acquisition/screenshot 均提供 typed snapshot、core-owned baseline、restore result 和 fresh-snapshot verify；恢复阶段、字段顺序、epoch 与异常优先级固定 | 候选合同已补齐，待核心实现 |
+| binary budget 与子授权冲突 | 选择单一 operation context；各阶段顺序授权且不嵌套，所有 binary phase 引用同一 ledger，error phase 不得创建或重置额度 | 候选合同已冻结方向，待核心确认 |
+| count modulus 不能识别回绕/复位 | 删除 modulus proof；`count_delta_with_epoch` 必须联合未变化 `counter_epoch` 和有效 `state_transition`，否则改用 identity/state proof | 首版收紧，待 fixture |
+| 旧 `scope.errors` 与 typed drain 混用 | `scope.error_drain_v1` 独占 `max_records+1`；旧 `scope.errors` 保持 `legacy_unstructured`，`terminated/query_count=null`，未来 typed direct drain 另立 operation | 兼容边界已分开，待核心确认 |
+
+本表只记录合同回应，不表示核心已接受或插件已迁移。
+
+核心后续复审指出的 P0/P1 项由第十二节 `R1.3 acceptance addendum` 和配套的
+[A1 索引](WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md)收口：transfer recovery、
+capability-method/descriptor 映射、数值上限与 deadline 已写成候选合同；旧 capture 采用唯一
+的父 operation 字段闭包；baseline 增加 context/nonce/一次性消费；identity proof 改为静态
+profile 事实；trace 的 spectrum/math 开放项排除在首轮公共实施外。核心可以据第十二节开始
+feature-gated 内部基础设施，但在 addendum 验收前不得注册 capability 或启动插件迁移。
+
+## 术语与分层
+
+| 术语 | 含义 | 不应混淆的对象 |
+| --- | --- | --- |
+| transport message | 一次 transport 交换，由 backend 证明起止边界 | TCP `recv()` 的物理分片 |
+| application chunk | 一个波形或文件协议定义的逻辑分块 | transport message；一次 query 的任意重试 |
+| operation | 由核心注册并受 `OperationSpec` 约束的公共动作 | driver 私有辅助函数 |
+| capability | descriptor 声明的可发现能力 | 方法存在但未声明的偶然实现 |
+| session health | 当前连接 epoch 的健康状态 | 仪器前面板显示的运行状态 |
+| artifact | Service 产生的可审计结果和诊断元数据 | 原始二进制 payload 或完整命令日志 |
+
+transport 只负责可靠地交付字节和结构化 I/O 状态；PNG、波形 preamble、样本字节序和数学
+结果属于更高层的 driver/model。应用分块属于波形协议层，不能因为一次 `DATA?` 返回分成
+多次底层 read 就自动生成多个 application chunk。
+
+## 当前证据
+
+| 证据编号 | 功能 | 证据 | 当前结论 |
+| --- | --- | --- | --- |
+| `E-BLOCK-DS` | definite block 截图 | DS1000Z [driver 测试](../../../packages/wavebench-rigol-ds1000z/tests/test_driver.py)，离线 fake transport | 现有 `query_bin_block()` 可覆盖该类仪器，尚不是 backend EOM 实机证据 |
+| `E-BLOCK-RTM` | definite block 截图、菜单和颜色控制 | RTM2000 [driver 测试](../../../packages/wavebench-rohde-schwarz-rtm2000/tests/test_driver.py)，离线 fake transport | 旧 screenshot 参数只对部分设备可映射 |
+| `E-MESSAGE-SDS` | raw PNG message | SDS804X HD 固件 `4.8.12.1.1.6.5`、PyVISA TCPIP `INSTR` / VXI-11 受控观察，见[硬件验收](../../../packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_HARDWARE_ACCEPTANCE.md) | 只有一个仪器族的一次完整 raw PNG 观察，尚未证明通用 backend EOM 合同 |
+| `E-CAPTURE` | SINGLE、Stop 轮询、同次多通道读取 | 同一 SDS804X HD 实机记录和[插件测试](../../../packages/wavebench-siglent-sds800x-hd/tests/test_driver.py) | 证明 vendor transaction 可行，不证明核心已有独立控制 API |
+| `E-TRACE-RTM` | math/FFT 元数据 | RTM2000 [覆盖矩阵](../../../packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX.md)与离线测试 | 只有一类可复用 trace 证据 |
+| `E-TRACE-SDS` | SDS math 函数关闭 | SDS804X HD 受控探测 | 不能为 SDS 构造通用 math/FFT trace |
+| `E-ERROR-SDS` | 无文档化错误队列 | CN11G 手册审计和实机边界 | 不能发送猜测命令，也不能返回伪造空队列 |
+
+当前证据只支持继续保持 `Draft`。特别是 `MESSAGE`、数字/reference trace、失败恢复和
+跨 backend conformance fixture 都还没有第二个独立证据族。
+
+## 目标
+
+- 让 definite block 和 message-bounded binary 使用同一套 replay、session health、access
+  policy、租约和审计合同。
+- 让核心公共合同不暴露 backend session；当前 Python 插件仍是受信任代码，本文不声称提供
+  进程级或运行时沙箱隔离。
+- 让截图请求只使用仪器明确声明支持的 request tuple，并记录实际生效请求。
+- 区分采集运行阶段、触发模式、平均/分段进度和完整 capture 事务。
+- 让模拟、数字、数学、参考和频域轨迹使用同一套 source、坐标轴、单位和数组不变量。
+- 让错误检查策略区分「能力明确不支持」「能力未知」「查询失败」和「设备返回错误」。
+- 保留现有 capability，通过新增 capability 和核心版本门逐步迁移。
+
+## 非目标
+
+- 不在 transport 中解析 PNG、波形 preamble 或厂商文件格式。
+- 不开放 raw SCPI、backend session、插件 parser 回调或任意 terminator。
+- 不把 `*OPC?` 定义为物理触发完成条件。
+- 不在本文设计数学表达式写入、FFT 配置或通用运算 AST。
+- 不废弃现有 `scope.fetch_waveform`、`scope.capture_waveform(s)`、`scope.screenshot` 或
+  `ScopeAcquisitionStatus`。
+- 不为没有文档化错误队列的仪器猜测命令。
+- 不因本文是 `Draft` 就提高任何插件的核心版本下限。
+
+## 插件信任边界
+
+当前 `DriverContext.open_transport()` 返回公共 Protocol，但运行时
+`GuardedAuditedTransport.inner` 仍可被受信任 Python 插件访问。因此 R1.3 只规定「公共合同
+不提供 backend session，插件代码不得依赖它」，不声称存在安全隔离。真正的 opaque facade、
+进程隔离、运行时属性拒绝和负向沙箱测试应由单独的安全设计处理，不能借本 RFC 的措辞假装
+已经实现。
+
+## 规范用语与兼容边界
+
+候选合同中的 `MUST` 表示互操作所需的不变量，`SHOULD` 表示默认实现，`MAY` 表示可选能力。
+核心接受前，插件不得把候选 operation 放入 descriptor，也不得以 capability 名称存在为由
+绕过核心 Service 或 transport gate。
+
+旧核心 + 新插件、新核心 + 旧插件、旧核心 + 旧插件和新核心 + 新插件四种组合都必须在
+factory、能力发现和第一次仪器 I/O 前得到确定结果；未知 capability 不能静默降级为已支持。
+
+## 一、核心集成合同：OperationSpec、Service 与 artifact
+
+### 1.1 现有核心字段与候选扩展
+
+当前核心 `OperationSpec` 与外部 access policy 已有以下安全元数据：
+`effect`、`lease_mode`、`changed_fields`、`restore_coverage`、`required_verified_fields`、
+`verification_fields`、`risk_flags`、`timeout_source`、capability 要求；access policy 由核心
+外部的 `access_policy(spec)` 统一判定，不是 `OperationSpec` 自身字段。
+候选 operation MUST 先使用这些字段进入中央 registry；不能只在 driver Protocol 中声明方法。
+
+候选扩展只使用静态、可序列化的安全元数据：
+
+```python
+@dataclass(frozen=True)
+class OperationSpec:
+    # 省略现有字段
+    postcondition_fields: tuple[str, ...] = ()
+    cleanup_verification_fields: tuple[str, ...] = ()
+    binary_response_max_bytes: int | None = None
+    binary_operation_max_bytes: int | None = None
+    binary_query_max_count: int | None = None
+    binary_resynchronization_max_bytes: int | None = None
+    error_check_minimum: Literal["required", "if_supported", "disabled"] | None = None
+```
+
+当前核心的 `_session_preflight()` 只内建 `scope.identity` verifier；表中其余
+`scope.run_state`、`scope.waveform_*`、`scope.display_*` 和 `scope.trace_configuration` 都是
+待核心实现的验证器，不是插件可以自行写入 `verified_fields` 的旁路。
+
+`scope.screenshot_profile` 和 profile variant 是 descriptor/profile 事实，不属于连接 epoch 的
+`verified_fields`；它们必须先在核心内存中完成静态校验，再作为 operation 输入约束。只有从
+仪器读回并由核心 verifier 校验的状态，才能进入 session verification fields。插件不得直接
+调用 session state 的内部方法或写入 verified fields。
+
+R1.3 暂定四个独立 binary 限制：`binary_response_max_bytes` 限制每次 payload，
+`binary_operation_max_bytes` 限制一个 operation 内所有 binary payload 的累计值，
+`binary_query_max_count` 限制 query 次数，`binary_resynchronization_max_bytes` 限制超限或异常后为寻找
+已证明边界而额外丢弃的字节数。会产生 binary response 的 operation 中，前三者必须是
+有限正整数，resynchronization 必须是有限、非 bool 的非负整数；`0` 表示超限后不做额外
+丢弃，直接关闭/毒化。非 binary operation 的对应字段可为 `None`。profile 和 connection 只能
+给出更小的对应限制。
+核心 Service 在 operation 开始时分别计算有效值，并向 guarded transport 安装 opaque、
+短生命周期的
+`BinaryQueryBudget`。transport 每次 binary query 都必须验证 budget 与 operation context、phase、
+correlation 和 session epoch 匹配；插件只能进一步收紧单次上限，不能提高或重置累计额度。没有 budget 的新
+`query_binary()` 调用在发送前拒绝；旧 `query_bin_block()` 兼容入口使用核心固定有限上限。
+
+现有 `verification_fields` 只表示按 `restore_coverage` 恢复到 baseline 后必须闭合的字段，
+不用于表示读操作的观察结果，也不用于证明有意保留的控制状态。
+`postcondition_fields` 声明成功后由 action-specific result verifier 验证的目标状态；
+`cleanup_verification_fields` 声明失败或取消后 best-effort cleanup 要验证的目标状态。
+后两者的证据只进入 operation result/artifact，不写入 session `verified_fields`；若同一字段还要
+恢复 baseline，必须另外列入 `verification_fields`。
+
+`error_check_minimum` 为 `None` 时，该 operation 不接受 error-check override，也不触发
+错误队列 I/O；为三态值时，请求可以选择同等或更强的策略，但不能削弱静态最低值。
+完整解析规则见第六节。输入/输出 schema、取消、幂等性和并发策略仍可作为后续核心扩展，
+但在 R1.3 中不把任意 Python 回调塞入公共合同。前置条件、恢复覆盖、验证字段、
+error policy 和 binary budget 必须可序列化、可审计。
+
+候选字段的 verifier 归属如下；「核心待实现」不是插件可绕过的授权：
+
+| 字段 | 类型 | verifier / 来源 |
+| --- | --- | --- |
+| `scope.identity` | 仪器状态 | 现有核心 identity verifier |
+| `scope.run_state`、`scope.trigger`、`scope.acquisition` | 仪器状态 | 核心 acquisition verifier，待实现 |
+| `scope.display_menu`、`scope.display_color` | 仪器状态 | 核心 screenshot restore/verification verifier，待实现 |
+| `scope.waveform_source`、`scope.waveform_mode` | 仪器状态 | 核心 waveform-source/mode verifier，待实现 |
+| `scope.query_response_header`、`scope.waveform_format`、`scope.waveform_byte_order`、`scope.waveform_points`、`scope.waveform_transfer_window` | 仪器状态 | 核心 waveform-transfer verifier，待实现 |
+| `scope.trace_configuration` | 仪器状态 | 核心 trace verifier，待实现 |
+| `scope.screenshot_profile` | descriptor/profile 事实 | 核心 profile validator，不写入 session verified fields |
+| `scope.acquisition_control_profile` | descriptor/profile 事实 | 核心静态 acquisition-control profile validator，不写入 session verified fields |
+| `scope.trace_profile` | descriptor/profile 事实 | 核心静态 trace profile validator，不写入 session verified fields |
+| `scope.error_queue` | 条件性消耗状态 | 核心 error-policy executor；只作为 changed field/artifact，不写入 verified fields |
+
+波形协议字段的最小映射必须保持显式：
+
+| 厂商状态示例 | 核心字段 | changed / verification 要求 |
+| --- | --- | --- |
+| `CHDR` 响应头/头部模式 | `scope.query_response_header` | 临时改变时两者都必须列出 |
+| `CORD` 字节序 | `scope.waveform_byte_order` | 临时改变时两者都必须列出 |
+| `WFSU` 格式、宽度、点数和窗口 | `scope.waveform_format`、`scope.waveform_points`、`scope.waveform_transfer_window` | 每个实际改变的字段都必须逐项列出 |
+
+### 1.2 候选 operation 映射
+
+下表是 R1.3 的最小候选映射，字段完整不等于合同已经冻结。Service 和 CLI 项都是候选入口，
+当前不存在，不能在插件侧自行模拟。所有 operation 的 `session_purpose` 为 `normal`；超时后的安全停止由核心另行签发
+有界 `recovery` transaction。R1.3 保守地为所有仪器 operation 使用 `exclusive` lease，因为
+当前 `ScopeService` 的 session lease 不会按 `OperationSpec.lease_mode` 动态切换。以后若开放
+共享只读 session，需要单独证明 backend、仪器和 transaction lock 的并发语义。
+
+| operation | capability | effect / lease | changed_fields | restore_coverage | required_verified_fields | verification_fields | postcondition / cleanup fields | risk_flags | timeout_source | binary response / operation / query / resync limits | error minimum | 最低 access | Service / CLI / artifact |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| `scope.screenshot_profile` | `scope.screenshot_profile` | `stateful_read` / `exclusive` | `none` | `none` | `scope.identity` | `none` | — / — | `profile_query` | `operation.timeout_ms=5000` | — | — | `read_only` | `ScopeService.screenshot_profile()` / `wavebench scope screenshot profile` / `screenshot.profile` |
+| `scope.screenshot_v2` | `scope.screenshot_v2` | `write` / `exclusive` | `scope.display_menu`, `scope.display_color`, `scope.error_queue`, `output.screenshot` | `screenshot-baseline-only` | `scope.identity` | `scope.display_menu`, `scope.display_color` | — / `scope.display_menu`, `scope.display_color` | `front_panel_state`, `binary_response`, `temporary_display_setup` | `operation.timeout_ms=5000` | `262144 / 262144 / 1 / 0` | `disabled` | `read_write` | `ScopeService.screenshot_v2(request)` / `wavebench scope screenshot capture` / `screenshot`、`effective_request`、`media_type`、`dimensions`、`framing` |
+| `scope.acquisition_run_state` | `scope.acquisition_run_state` | `stateful_read` / `exclusive` | `none` | `none` | `scope.identity` | `none` | — / — | `state_observation` | `operation.timeout_ms=5000` | — | — | `read_only` | `ScopeService.acquisition_run_state()` / `wavebench scope acquisition status` / `acquisition.run_state` |
+| `scope.acquisition_start` | `scope.acquisition_control` + `scope.acquisition_run_state` | `write` / `exclusive` | `scope.run_state`, `scope.trigger`, `scope.acquisition`, `scope.error_queue` | `failure-cleanup-only` | `scope.identity` | `scope.trigger`, `scope.acquisition` | `scope.run_state`, `scope.trigger`, `scope.acquisition` / `scope.run_state`, `scope.trigger`, `scope.acquisition` | `trigger`, `acquisition_state`, `recovery_required` | `operation.timeout_ms=30000` | — | `disabled` | `read_write` | `ScopeService.start_acquisition(request)` / `wavebench scope acquisition start` / `acquisition.control`、`effective_trigger_mode`、`postcondition`、`cleanup` |
+| `scope.acquisition_single` | `scope.acquisition_control` + `scope.acquisition_run_state` | `acquire` / `exclusive` | `scope.run_state`, `scope.trigger`, `scope.acquisition`, `scope.error_queue` | `failure-cleanup-only` | `scope.identity` | `scope.trigger`, `scope.acquisition` | `scope.run_state`, `scope.trigger`, `scope.acquisition` / `scope.run_state`, `scope.trigger`, `scope.acquisition` | `trigger`, `acquisition_state`, `recovery_required` | `operation.timeout_ms=30000` | — | `disabled` | `read_write` | `ScopeService.acquire_single()` / `wavebench scope acquisition single` / `acquisition.control`、`postcondition`、`completion_proof`、`cleanup` |
+| `scope.acquisition_stop` | `scope.acquisition_control` + `scope.acquisition_run_state` | `write` / `exclusive` | `scope.run_state`, `scope.error_queue` | `failure-cleanup-only` | `scope.identity` | `none` | `scope.run_state` / `scope.run_state` | `acquisition_state`, `recovery_required` | `operation.timeout_ms=5000` | — | `disabled` | `read_write` | `ScopeService.stop_acquisition()` / `wavebench scope acquisition stop` / `acquisition.control`、`postcondition`、`cleanup` |
+| `scope.trace_metadata` | `scope.trace_metadata` | `stateful_read` / `exclusive` | `none` | `none` | `scope.identity` | `none` | — / — | `analysis_state` | `operation.timeout_ms=5000` | — | `disabled` | `read_only` | `ScopeService.trace_metadata(source)` / `wavebench scope trace metadata` / `trace.metadata` |
+| `scope.fetch_trace` | `scope.fetch_trace` | `acquire` / `exclusive` | `scope.run_state`, `scope.waveform_source`, `scope.waveform_mode`, `scope.query_response_header`, `scope.waveform_format`, `scope.waveform_byte_order`, `scope.waveform_points`, `scope.waveform_transfer_window`, `scope.error_queue`, `output.trace` | `trace-baseline-only` | `scope.identity` | `scope.run_state`, `scope.waveform_source`, `scope.waveform_mode`, `scope.query_response_header`, `scope.waveform_format`, `scope.waveform_byte_order`, `scope.waveform_points`, `scope.waveform_transfer_window` | — / — | `acquisition_state`, `temporary_transfer_setup`, `binary_response` | `operation.timeout_ms=60000` | `8388608 / 67108864 / 256 / 65536` | `disabled` | `read_write` | `ScopeService.fetch_trace(source)` / `wavebench scope trace fetch` / `trace`、`metadata`、`integrity`、`error_check` |
+
+R1.3 acceptance addendum 固定下列数值；表中 binary 列依次为 response、operation total、query
+count、resynchronization bytes：
+
+```python
+SCOPE_SCREENSHOT_BINARY_RESPONSE_MAX_BYTES = 262_144
+SCOPE_SCREENSHOT_BINARY_OPERATION_MAX_BYTES = 262_144
+SCOPE_SCREENSHOT_BINARY_QUERY_MAX_COUNT = 1
+SCOPE_SCREENSHOT_BINARY_RESYNCHRONIZATION_MAX_BYTES = 0
+
+SCOPE_TRACE_BINARY_RESPONSE_MAX_BYTES = 8_388_608
+SCOPE_TRACE_BINARY_OPERATION_MAX_BYTES = 67_108_864
+SCOPE_TRACE_BINARY_QUERY_MAX_COUNT = 256
+SCOPE_TRACE_BINARY_RESYNCHRONIZATION_MAX_BYTES = 65_536
+
+SCOPE_PROFILE_OPERATION_TIMEOUT_MS = 5_000
+SCOPE_SCREENSHOT_OPERATION_TIMEOUT_MS = 5_000
+SCOPE_ACQUISITION_OPERATION_TIMEOUT_MS = 30_000
+SCOPE_TRACE_OPERATION_TIMEOUT_MS = 60_000
+```
+
+这些值是核心上限，不是 driver 默认值；descriptor/profile/connection 只能收紧，不能提高。
+`scope.screenshot_v2` 首版单次 PNG 上限为 256 KiB，依据已有 SDS raw PNG 证据保留明确余量；
+`scope.fetch_trace` 每次 response 上限为 8 MiB、一次 operation 总上限为 64 MiB、最多 256 次
+binary query，并允许最多丢弃 64 KiB 以证明边界。超出 resynchronization 上限或无法证明边界时，
+核心固定关闭 transport 并将 session 标记为 `poisoned`，不由 backend 自行选择 close/poison
+策略。
+
+`OperationRequest.deadline` 固定为单调时钟的绝对时间。未提供调用方 deadline 时，核心使用上表
+operation timeout；调用方提供更早 deadline 时只能收紧，不能延长。每次 I/O 的 timeout 为
+`min(connection.timeout_ms, deadline - monotonic_now)`，剩余时间不足 1 ms 时在发送前以
+`deadline_exhausted` 拒绝。profile source 固定采用 descriptor-first：descriptor 必须提供安全
+上限；仪器查询只能形成 `combined` 交集并收紧，`queried`-only profile 在 R1.3 拒绝。
+
+`ErrorCheckSpec.timing` 的默认值固定为 `before_and_after`；screenshot、acquisition 和 trace
+operation 只能使用该默认值或显式收紧为 `before`/`after`，driver 不得另行决定 timing。recovery
+phase 固定为 `disabled`。文本 query timeout、binary timeout 和恢复 timeout 都受同一 operation
+deadline 限制。
+
+`scope.screenshot_v2` 采用保守的 `write` effect，因为某些设备需要临时写菜单或颜色设置；
+只支持 `device` 行为的设备也不能在 profile 中把该 operation 降级为无状态副作用；它仍按
+`write` gate 执行。若未来需要真正的 read-only screenshot operation，应新增独立 operation
+和 capability，不能由 profile 动态改变 effect。`scope.fetch_trace` 同理，默认按可能修改
+transfer 选择处理。
+
+采集控制按动作拆成三个静态 operation：`scope.acquisition_start`、
+`scope.acquisition_single` 和 `scope.acquisition_stop`。它们共享
+`scope.acquisition_control` capability，但不得用一个带 `action` 参数的 operation 动态改变
+`effect`、changed fields、恢复覆盖或最低 access。`stop` 的公共入口和超时 cleanup 入口仍
+共享同一 driver 方法，但核心发放的 normal/recovery authorization 必须分别标识用途。
+
+三个控制 operation 的成功 postcondition 与失败 cleanup 必须分开：`start` 成功后有意保留
+连续运行状态，`single` 成功后保留新记录已经完成的停止状态，`stop` 成功后有意保留停止
+状态。`failure-cleanup-only` 只描述写入失败、等待超时或取消后的 cleanup，不得在成功
+路径把 run state 恢复到调用前。`postcondition_fields` 在成功路径证明目标状态，
+`cleanup_verification_fields` 在失败路径证明 cleanup 结果；artifact 必须用
+`postcondition` 与 `cleanup` 两个字段区分。两者都不得借用现有 `verification_fields`
+向 session 伪造 baseline 恢复证据。
+对 `start` 和 `single`，失败 cleanup 在 session 仍可安全写入时必须先 STOP，再恢复并
+query-back 写入前的 `scope.trigger` 和 `scope.acquisition` baseline。只有 run state、trigger 和
+acquisition 全部验证成功时 cleanup 才是 `succeeded`；任一字段未恢复或未证明时，
+session 不得回到 `healthy`。
+
+`scope.screenshot_v2`、`scope.acquisition_start`、`scope.acquisition_single`、
+`scope.acquisition_stop` 和 `scope.fetch_trace` 应把
+`scope.error_drain_v1` 放入 `optional_capabilities`，是否变成当前请求的必需能力由第六节的错误策略
+和 `OperationSpec` 最低策略共同决定。profile、运行状态和 metadata 查询默认不触发错误队列，
+避免一个只读观测产生额外的 consumptive read。
+
+表中的 `scope.error_queue` 只在有效 error policy 实际执行完整 drain 时产生；如果 policy 为
+`disabled`，该字段不发生仪器变化，但 operation artifact 仍必须记录 `error_check.status`。
+核心实现可以用保守的静态 changed field，也可以在冻结 action-specific spec 后使用条件字段，
+但不得把 consumptive error read 隐藏在普通 query 统计中。
+
+波形 transfer 字段使用协议无关的核心名称；例如某些示波器的 `CHDR` 响应头、`CORD` 字节序、
+`WFSU` 格式/宽度/点数/窗口都必须映射到上述 `query_response_header`、`waveform_byte_order`、
+`waveform_format`、`waveform_points` 和 `waveform_transfer_window`。只在
+`changed_fields` 中列出「transfer」而不在 `verification_fields` 中逐项闭合，不满足本 RFC；
+任一项恢复后无法由核心 verifier 证明时，operation 必须 fail-closed，不能因为
+`restore_coverage="capture-baseline-only"` 就回到 `healthy`。
+同一字段集也适用于现有 `scope.fetch_waveform`、`scope.capture`、
+`scope.capture_waveforms` 和 `scope.capture_multiple` 的核心规格；新 RFC operation 不能因为
+换成 `ScopeTraceData` 就缩小既有 transfer 恢复/验证要求。
+
+现有 capture 若需要调用旧 `scope.screenshot`，R1.3 只允许「父 operation 字段闭包」方案：
+父 `scope.capture_waveform`、`scope.capture_waveforms` 或 `scope.capture_multiple` 的静态
+`OperationSpec` 必须显式携带 `ScopeEmbeddedScreenshotContract`，并加入
+`scope.display_menu`、`scope.display_color`、`output.screenshot` 的 changed/verification/cleanup
+字段，在同一 operation context 内按 screenshot phase 执行
+snapshot、capture、restore、verify。R1.3 不定义 composite operation，也不允许在父 operation
+外单独开启 screenshot authorization；旧 capture 若没有这组字段闭包，必须在任何 I/O 前以
+`unsupported_capability` 拒绝 screenshot 请求。旧 `scope.screenshot_png()` 不能绕过该规则。
+
+嵌入截图的失败语义固定为 `fail_parent`：截图 transport、PNG 校验、after error 或 restore/
+verify 失败都会使父 capture operation 失败；已经取得的 waveform 只能作为脱敏诊断摘要，
+不得作为成功值返回。父 operation 只执行一次 error policy，artifact 在父记录下增加
+`screenshot.status`、`screenshot.failure_reason`、`screenshot.cleanup` 和 `screenshot.verification`，
+不创建第二个 operation artifact。
+当前核心 `ScopeService` 在 capture 外单独调用 screenshot 的旧路径不满足该合同；在父 operation
+字段闭包实现前，旧路径只能保持 legacy 行为，不能声明 `scope.screenshot_v2` 或把截图错误
+降级为 capture 的部分成功。
+
+### 1.3 输入、前置条件与输出
+
+为避免只有 operation 名称而没有可执行边界，R1.3 规定以下最小 schema 和 Python Protocol；
+完整公共 wire serialization、取消、幂等性和并发字段仍待核心冻结，因此在第十二节验收前
+只能用于内部 / feature-gated 实现：
+
+| operation | 输入 | 主操作写入 / binary 前置条件 | 成功输出 |
+| --- | --- | --- | --- |
+| `scope.screenshot_profile` | 无 | identity 已验证；profile source 可用 | `ScopeScreenshotProfile` |
+| `scope.screenshot_v2` | `ScopeScreenshotRequest`、operation 级 error policy | profile 精确匹配；access 允许写入；必要的 baseline 可读 | `ScopeScreenshot` + effective request |
+| `scope.acquisition_run_state` | 无 | identity 已验证；session healthy | `ScopeAcquisitionRunState` |
+| `scope.acquisition_start` | `ScopeContinuousAcquisitionRequest`、operation 级 error policy | identity 已验证；phase 属于 `stopped/ready/complete`；descriptor 的 `scope_extensions.acquisition_control_profile` 已验证并支持请求 mode；trigger/acquisition baseline 可读；access 允许写入 | `ScopeAcquisitionRunState`，trigger mode 等于请求，phase 为 `ready/arming/waiting/acquiring/rolling` |
+| `scope.acquisition_single` | operation 级 error policy | identity 已验证；phase 属于 `stopped/ready/complete`；descriptor 的 `scope_extensions.acquisition_control_profile` 已验证；trigger/acquisition baseline 可读；access 允许采集 | `ScopeAcquisitionCompletion`；失败则 cleanup diagnostics |
+| `scope.acquisition_stop` | operation 级 error policy | normal 路径要求 identity 已验证、session healthy 且 phase 非 `unknown/error`；recovery 路径使用独立 core authorization | `ScopeAcquisitionRunState`，postcondition 为 `stopped`；recovery 另记 cleanup |
+| `scope.trace_metadata` | 有效 `ScopeTraceRef` | source/index/name 不变量通过；identity 已验证 | `ScopeTraceMetadata` |
+| `scope.fetch_trace` | `ScopeTraceRef`、points profile、operation 级 error policy | source 已配置；sequence/segmentation 与 profile 兼容；必要时 acquisition stopped | `ScopeTraceData` + integrity/error artifact |
+
+纯参数错误、能力不支持和 access 拒绝 MUST 在任何仪器 I/O 前返回。phase、baseline
+和 query-back 等仪器状态前置条件可以使用核心签发的有界 preflight/verification authorization
+执行只读查询，但必须在主 operation 的任何写入或 binary query 前完成。设备返回错误、
+传输失败和完成证据不足则归入对应 operation result/exception，不得伪装成参数错误。
+`scope.screenshot_v2`、三个 acquisition control operation 和 `scope.fetch_trace` 都从统一的
+`OperationRequest.error_check` 解析单 operation 覆盖；若未提供，按第六节优先级解析全局和
+`OperationSpec` 策略。driver 方法不再接受另一个独立策略来源。
+
+### 1.4 请求、结果和异常边界
+
+候选核心应为每个 operation 生成可审计的请求和结果，至少包含：
+
+```python
+@dataclass(frozen=True)
+class OperationRequest:
+    operation_id: str
+    arguments: Mapping[str, Any]
+    deadline: float | None
+    correlation_id: str
+    error_check: ErrorCheckSpec | None
+
+@dataclass(frozen=True)
+class OperationResult:
+    value: object
+    diagnostics: Mapping[str, Any]
+    observed_state: Mapping[str, Any] | None
+```
+
+`OperationRequest.deadline` 使用单调时钟的绝对 deadline；artifact 只记录剩余时长或
+`deadline_source`，不记录进程时间戳。`correlation_id` 在一次 Service operation 及其
+recovery/verification phase 中保持不变，便于把 cleanup 和错误检查归到同一操作。
+
+`operation_id` MUST 使用稳定的小写点分隔名称；版本变化通过 capability/core version gate
+处理，不在同一名称下改变输入或输出语义。异常至少区分：
+
+- `unsupported_capability`：descriptor 明确没有能力；
+- `unknown_capability`：核心或插件没有完成能力发现；
+- `precondition_failed`：前置条件在任何写入和 binary 查询前失败；
+- `access_denied`：访问策略不允许；
+- `transport_io_error`：传输阶段失败，沿用现有结构化 framing、同步和 retry 字段；
+- `completion_unproven`：操作可能已执行，但没有足够证据证明完成；
+- `instrument_error`：设备明确返回错误。
+
+### 1.5 恢复与 artifact 规则
+
+所有可能写入仪器的候选 operation MUST 在 `OperationSpec` 中声明 changed fields 和恢复覆盖。
+需要恢复 baseline 的字段写入 `verification_fields`；有意保留的成功状态和失败 cleanup
+目标分别写入 `postcondition_fields` 和 `cleanup_verification_fields`。主异常不得被恢复异常覆盖；
+结果或失败 artifact 应记录：
+
+```text
+operation
+correlation_id
+requested_arguments（去除敏感值）
+observed_state_before / observed_state_after
+session_health_before / session_health_after
+baseline.kind / baseline.context_id / baseline.session_epoch / baseline.nonce_digest /
+baseline.fields / baseline.restore_order / baseline.consumption
+postcondition.status / postcondition.reason_code / postcondition.observed_fields
+completion_proof.proof / completion_proof.original_state / completion_proof.proof_baseline_state /
+completion_proof.proof_baseline_stage / completion_proof.observed_states（仅 SINGLE）
+cleanup.attempted / cleanup.restore / cleanup.verification / cleanup.error_code / cleanup.observed_fields
+error_check
+```
+
+`postcondition` 必须由 operation-specific result verifier 产生，不得把 driver 返回非空当作验证。
+`scope.acquisition_single` 的 completion artifact 必须保留脱敏 baseline、完整的记录状态序列
+和 proof 分支；其他 action 不生成伪造的 completion 字段。
+
+artifact 只记录 framing、长度、媒体类型、状态 token 和摘要，不记录图片、原始波形、真实
+resource、序列号或完整命令 payload。
+
+### 1.6 非嵌套 operation context 与阶段授权
+
+本轮增补选择「单个 operation context 下的顺序阶段授权」，不选择嵌套 session
+authorization。候选核心内部模型为：
+
+```python
+OperationPhase = Literal[
+    "preflight",
+    "error_before",
+    "main",
+    "success_restore",
+    "error_after",
+    "failure_cleanup",
+    "cleanup_verification",
+]
+
+@dataclass(frozen=True)
+class _CoreOperationContext:
+    context_id: str
+    operation_id: str
+    correlation_id: str
+    session_epoch: str
+    deadline: float
+    binary_budget_ledger_id: str | None
+
+BaselineNonce = str
+
+@dataclass(frozen=True)
+class _CoreBaselineUseRecord:
+    context_id: str
+    session_epoch: str
+    baseline_nonce: BaselineNonce
+    state: Literal["fresh", "passed_to_main", "restore_attempted", "consumed"]
+```
+
+operation context 只是核心 coordinator 持有的生命周期和额度账本，不是 session
+authorization，创建它不会发送 I/O，也不会占用核心现有的 active authorization 槽位。
+核心在 access、capability、lease 和静态 profile 校验通过后，在第一次仪器 I/O 前创建一次
+context；同一公共 operation 不得创建第二个 context 来重置 deadline、correlation 或 binary
+budget。
+
+baseline 是 context-owned handle，不是 driver 可自行生成的状态快照。核心为每个可恢复操作
+生成一次不可预测的 `baseline_nonce`，并把 `context_id`、当前 `session_epoch` 和 nonce 写入
+baseline。nonce 只在该 context 的规定阶段内有效；核心在 baseline 传入 main 后标记
+`passed_to_main`，首次进入 success/failure restore 后标记 `restore_attempted`，随后标记
+`consumed`。任何 context、epoch、nonce、phase 或消费状态不匹配都必须在 driver I/O 前拒绝，
+不得以同一连接 epoch 中的旧 baseline 重放。artifact 只记录 nonce 的脱敏摘要和消费状态，
+不记录原值；driver 不得复制、替换或持久化 nonce。
+
+需要动态 I/O 授权的每个阶段使用一个独立、有界的 session authorization；`main` 阶段
+沿用该公共 operation 已有的 `normal` gate，不在其中再开子授权。候选 phase 与当前
+`SessionPurpose` 的映射固定为：`preflight`/`error_before`/`error_after`/`cleanup_verification`
+使用只读 `verification` 语义，`success_restore`/`failure_cleanup` 使用有界 `recovery` 语义，
+`main` 使用既有 `normal` operation gate，但该 gate 的授权记录仍必须绑定本 context 的
+`context_id`、epoch、字段和 deadline；不是重新开启一个脱离 context 的 normal operation。
+若核心为 phase 增加专用枚举，必须保持同样的 I/O 白名单和非嵌套约束；driver 永远不接收
+或构造 authorization token。
+
+上述阶段遵守以下硬约束：
+
+1. 开启新阶段前，上一阶段 authorization MUST 已关闭；任意时刻最多只有一个 active
+   authorization。阶段执行器不得从 active authorization 内再签发子 authorization。
+2. 每个 authorization 必须绑定 `context_id`、`session_epoch`、phase、字段白名单、
+   allowed I/O、剩余 deadline 和静态 `max_steps`；阶段切换不得改变 access/lease 结论。
+3. `BinaryQueryBudget` 的可变账本归 operation context 所有，不归某个阶段 authorization
+   所有。只有静态 phase contract 允许 binary query 时，guarded transport 才能在 active
+   authorization 中引用同一 `binary_budget_ledger_id`。创建、关闭或重试 phase 都不得
+   重建账本、增加额度或退回已消耗的 query count。
+4. session 进入 `uncertain/poisoned` 后，binary ledger 立即变为不可用，但已消耗计数保留到
+   operation artifact 完成。只有静态声明的 `failure_cleanup`/`cleanup_verification`
+   recovery 阶段可继续；它们不得使用 binary I/O。
+5. context 在成功结束、主失败及全部允许的 cleanup/verification 结束、取消且无可执行
+   recovery，或 session epoch 改变时进入 terminal。进入 terminal 后所有阶段 token 和 binary
+   ledger 失效，不得跨 operation 或跨 epoch 重用。
+
+阶段与授权、binary 的固定对应关系为：
+
+| phase | session authorization purpose | 允许的 I/O | binary ledger |
+| --- | --- | --- | --- |
+| `preflight` | `verification` | 只读状态/profile query | 不可用 |
+| `error_before` / `error_after` | `verification` | `scope.error_queue` 的文本 query | 只关联同一 context；禁止 binary 且不扣额度 |
+| `main` | 既有 normal operation gate | 由 `OperationSpec` 静态声明的 write/acquire/text/binary | 若允许 binary，只能引用同一 ledger |
+| `success_restore` / `failure_cleanup` | `recovery` | 有界文本 STOP、state restore write | 不可用 |
+| `cleanup_verification` | `verification` | 有界文本 query-back | 不可用 |
+
+phase 与当前核心 session API 的衔接冻结为一个核心内部 coordinator，而不是让 driver 直接
+调用 `SessionTransactionCoordinator.authorize()`：
+
+```python
+ScopePhasePurpose = Literal["normal", "recovery", "verification"]
+
+@dataclass(frozen=True)
+class ScopePhaseAuthorizationSpec:
+    context_id: str
+    operation_id: str
+    phase: OperationPhase
+    purpose: ScopePhasePurpose
+    allowed_io: frozenset[str]
+    fields: frozenset[str]
+    deadline: float
+    max_steps: int
+
+class ScopeOperationContextCoordinator(Protocol):
+    def authorize_phase(
+        self,
+        spec: ScopePhaseAuthorizationSpec,
+    ) -> Iterator["ScopePhaseAuthorization"]: ...
+```
+
+`ScopeOperationContextCoordinator` 的实现规则固定为：`purpose="recovery"` 或
+`"verification"` 时，顺序调用当前 `SessionTransactionCoordinator.authorize()`；
+`purpose="normal"` 时复用现有公共 operation gate。核心在两条路径都维护同一个
+`_CorePhaseAuthorizationRecord(authorization_handle_id, context_id, session_epoch, phase, purpose,
+fields, allowed_io, deadline, max_steps)` 侧记录；`authorization_handle_id` 是核心生成的
+opaque 一次性 handle，侧记录以该 handle 对应的 authorization object identity 绑定，并在
+authorization 关闭后才允许下一 phase。若当前
+`SessionAuthorization` 对象没有这些字段，侧记录必须以不可伪造的 opaque authorization
+identity 绑定；不能仅用 `operation_id` 或 `session_epoch` 推断 context。核心必须先扩展或
+包裹现有 gate，再开始任何新 capability 的实现；driver 只接收已授权的 transport facade，
+不接收 `ScopePhaseAuthorization` 或 session token。
+
+因此 `error_before`/`error_after` 即使拥有独立的顺序 authorization，也不会获得新的
+binary 权限或额度；它们只携带同一 `context_id`/`binary_budget_ledger_id` 的审计关联，账本
+计数保持不变。阶段切换时核心先关闭当前授权，再签发下一阶段授权；若当前核心的
+`authorize()` 只能接受 `recovery`/`verification` purpose，则 `main` 继续使用既有 normal
+operation gate，其他 phase 按上表映射，不要求核心接受嵌套授权。
+
+首版操作的阶段顺序为：
+
+| operation 类型 | 成功顺序 | 主操作/after 失败顺序 |
+| --- | --- | --- |
+| acquisition start/single | `preflight -> error_before? -> main -> error_after? -> terminal` | 关闭当前 phase 后 `failure_cleanup -> cleanup_verification -> terminal` |
+| screenshot with state changes | `preflight -> error_before? -> main -> error_after? -> success_restore -> cleanup_verification -> terminal` | 关闭当前 phase 后 `failure_cleanup -> cleanup_verification -> terminal` |
+| fetch/trace vendor transaction | `preflight -> error_before? -> main -> error_after? -> terminal` | 关闭当前 phase 后执行该 operation 已声明的非嵌套 restore/verification phase，然后 terminal |
+
+`?` 表示 error policy 决定该阶段是否存在，不表示插件可自行跳过。before/after error
+executor 只是同一 context 中的独立顺序 phase，不是父/子 authorization。
+artifact MUST 记录每个 phase 的开始/结束、allowed I/O、实际 step 数、budget 前后摘要和跳过原因；
+不记录 opaque token 本身。
+
+## 二、binary framing 与 message 语义
+
+### 2.1 两层 framing
+
+首版只接受两种可证明的 transport response framing：
+
+```python
+class BinaryResponseFraming(str, Enum):
+    DEFINITE_BLOCK = "definite_block"
+    MESSAGE = "message"
+```
+
+- `DEFINITE_BLOCK`：应用层响应以 IEEE 488.2 `#N` 头声明 payload 长度；
+- `MESSAGE`：backend 通过 EOI、VISA message END 或等价的明确事件报告一次响应结束。
+
+底层 socket 的多次 `recv()`、串口暂时没有数据、读取 timeout 和换行都不是通用 message
+边界。transport 不解析 PNG、波形或其他媒体；内容校验由 driver 完成。
+
+### 2.2 definite block 的精确语法
+
+候选 transport MUST 按以下语法解析：
+
+```text
+response := '#' + N + length_field + payload
+N        := ASCII digit '1'..'9'
+length_field := exactly N ASCII decimal digits
+payload  := exactly the declared number of bytes
+```
+
+`#0`（indefinite block）、缺失长度位、非 ASCII 数字、长度溢出、声明长度与已消费字节不一致
+都必须结构化失败。`#10` 表示零长度 payload 的语义是否允许由 operation profile 决定；不允许
+把 `#0` 当作零长度 definite block。解析前必须校验长度上限，不能先按声明长度分配无限内存。
+
+### 2.3 `query_binary` 与上限
+
+候选公共方法为：
+
+```python
+# 概念模型：这是核心内部状态，不是公共构造函数。
+class _CoreBinaryQueryBudget(Protocol):
+    ledger_id: str
+    context_id: str
+    operation_id: str
+    correlation_id: str
+    per_response_max_bytes: int
+    remaining_operation_bytes: int
+    remaining_query_count: int
+    resynchronization_max_bytes: int
+    transport_trailing: bytes
+    expires_at: float  # monotonic clock 的绝对时间
+
+
+@dataclass(frozen=True)
+class BinaryQueryResult:
+    data: bytes
+    framing: BinaryResponseFraming
+    declared_length: int | None
+    framing_header_bytes: int
+    consumed_bytes: int
+    transport_trailing_bytes: bytes
+    synchronization: Literal["proven"] = "proven"
+
+
+def query_binary(
+    self,
+    command: str,
+    *,
+    framing: BinaryResponseFraming,
+    max_bytes: int,
+    replay: ReplayPolicy = ReplayPolicy.NO_REPLAY,
+) -> BinaryQueryResult: ...
+```
+
+上面的 `_CoreBinaryQueryBudget` 是描述核心内部授权状态的概念模型，不是插件可实例化的公共输入；
+文中简称 `BinaryQueryBudget`。核心只向 guarded transport 传递不可伪造的 opaque token，不把
+这些字段暴露给插件作为可修改对象。
+核心 coordinator 为一次 operation context 创建一次 budget ledger。session health 改变时立即
+禁止新 binary I/O，但 ledger 保留已消耗计数，直到第 1.6 节定义的 context terminal 时才失效；
+transport 不得接受跨 context、跨 operation/correlation、跨 session epoch 或过期的 budget。
+`per_response_max_bytes` 限制每次 response；`remaining_operation_bytes` 限制一次 operation
+中所有 binary response 的累计 payload；`remaining_query_count` 防止通过大量零长度响应绕过资源
+边界；`resynchronization_max_bytes` 限制失败后为证明同步而额外丢弃的字节。这些值都是核心
+在 operation 开始前计算的有限整数；前三者为正，resynchronization 可为零。多次 query 不能把额度累加成更大的单次
+response 上限，也不能通过重建 driver 对象重置任何额度。
+
+`max_bytes` MUST 是核心签发的 `BinaryQueryBudget.per_response_max_bytes` 范围内的正整数；
+它计量单次 response 的 payload 字节数，不包含 framing header。未配置 connection 上限时，
+核心只在内部最小值计算中把对应 connection 项视为 `+∞`；operation 的 response 和 total
+上限仍必须有限，公共方法不提供无限读取默认值。Service 分别计算：
+
+```text
+effective_response_max = min(spec response, profile response, connection response)
+effective_operation_max = min(spec total, profile total, connection total)
+effective_query_max_count = min(spec query count, profile query count, connection query count)
+effective_resynchronization_max = min(spec resync, profile resync, connection resync)
+```
+
+profile 或 connection 没有对应限制时只是不进一步收紧，不能取消 spec 的有限值。
+Service 在第一个阶段授权前向 operation context 安装与 context/operation/correlation/epoch
+绑定的 opaque budget ledger。没有 ledger 或 active phase 不允许 binary I/O 的新
+`query_binary()` 调用必须在 `BEFORE_SEND` 以 `NOT_SENT` 拒绝。现有 `query_bin_block()` 保留
+为 definite block 兼容入口。它在 legacy operation 中使用核心固定的有限兼容上限；在已安装
+R1.3 budget 的新 operation 中必须消耗同一个 response/operation/query/resync budget，不得建立第二套
+兼容额度。新 operation 若无 R1.3 budget，通过 `query_bin_block()` 也必须在发送前拒绝。
+核心冻结 legacy 兼容上限时必须覆盖现有已接受 operation 的合法 payload，或给旧 operation 保留
+独立的有限 spec；不能在没有迁移说明的情况下静默降低既有波形读取上限。
+
+如果 operation 使用 binary profile，则每个参与的 variant 必须提供有限正整数的 response、
+operation-total 和 query-count，以及有限非负整数的 resynchronization 限制；没有 profile 层的 operation 直接使用
+spec 与 connection 的最小值。
+显式 connection 限制使用同一数值规则。上限比较和计数使用整数 bytes，不能用浮点近似
+或按样本点数替代。
+每个 core-validated profile variant 只能声明一个精确 transport trailing byte sequence；
+R1.3 暂定最长 16 bytes，不允许备选集合、正则、回调或「任意空白」。这避免空字符串
+与非空 terminator 形成前缀歧义，导致 backend 在 declared payload 后继续阻塞或吞掉下一响应。
+MESSAGE 只允许空 transport trailing。核心把已验证的精确 sequence 放入 opaque budget，
+插件不得通过 `query_binary()` 参数临时放宽。
+
+实现时必须同时修改 `InstrumentTransport` Protocol、全部 backend、
+`GuardedAuditedTransport`、session `_AUTHORIZED_IO` / `_VERIFICATION_IO`、审计计数器和
+结构化错误映射。`BinaryQueryBudget` 的创建、消费和失效只能由核心 coordinator 完成；
+只给某个 backend 增加方法会绕过核心会话授权，不符合候选合同。
+
+budget 不作为 `query_binary()` 的插件参数。核心 coordinator 在 operation context 中安装
+opaque ledger；每个允许 binary I/O 的非嵌套 phase authorization 只引用它的
+`ledger_id`。`GuardedAuditedTransport.query_binary()` 同时验证 active phase、context/epoch 和
+ledger 绑定，再把已计算的有效上限传给 backend。插件只提交
+`max_bytes <= per_response_max_bytes` 的收紧值；它无法看到、构造或替换 token。guarded
+transport 在同一 transaction lock 内计算
+`effective_query_max = min(max_bytes, per_response_max_bytes, remaining_operation_bytes)`；结果不为正整数或 token
+失效时，在发送前以 `NOT_SENT` 拒绝。guarded transport 在发送前还必须原子预留一个
+`remaining_query_count`；额度为零时不发送。backend 必须以该有效值执行单响应限制；
+成功后再原子扣减 `len(result.data)`，不计 framing header 和已明确限定的 transport trailing。
+扣减前 guarded transport 必须再验证 `len(result.data) <= effective_query_max`、下文的
+精确 consumed 等式和 transport trailing allowlist；backend 返回越界的「成功」结果必须转为
+合同违反并关闭/毒化 session，不得只扣成负额度后交给调用方。
+任何失败一旦已发送 query，都不退回预留的 query count。阶段关闭、失败或切换也不退回
+任何额度。核心测试必须证明 `error_before -> main -> error_after` 三段使用同一 ledger，
+且尝试在新 phase 重建 ledger 会在任何 I/O 前拒绝。
+
+### 2.4 message boundary 的能力证明
+
+`binary.message_boundary` 是「backend 类型 + 具体 resource/session 能力」的联合声明：
+
+| backend | 可声明条件 | 不能作为证据的行为 |
+| --- | --- | --- |
+| PyVISA | 具体 resource 能报告 EOI/message END，且同一锁内可恢复 read termination | 仅有 `read_raw()` 或一次成功的 timeout 读取 |
+| RsInstrument | API 明确报告完整 message/EOI，并能在异常后报告同步状态 | 任意 `query_bin_block()` 成功 |
+| TCP socket | 协议本身声明长度、EOM 或受控 message API | `recv()` 返回短块、idle timeout |
+| serial | 只有设备和 backend 共同声明可证明的 EOM 才能提供 | 暂时没有数据、换行或固定延迟 |
+
+R1.3 暂不批准任何现有 backend 声明 `binary.message_boundary`；上表是进入 conformance fixture
+前必须满足的条件，不是能力白名单。
+
+能力可在 open 时由 backend 静态类型和 resource 属性共同确定；若 backend 无法提供证明，
+必须在发送命令前拒绝 `MESSAGE`，不得通过探测命令猜测。`MESSAGE` 交换应在同一资源锁内
+临时关闭文本 read termination，完成或失败后恢复原设置；恢复失败必须进入 session health
+状态机，不能当作普通 driver 解析错误。
+R1.3 acceptance policy 固定为：termination/read-setting 恢复失败、malformed framing、
+同步未知或超出 resynchronization ceiling 时关闭该 transport 并标记 `poisoned`；只有已经
+证明边界且完成设置恢复的有限失败才允许保留 `uncertain` session。backend 不得以自己的
+错误分类或重连策略改变这一默认。
+
+### 2.5 超限、部分响应和失步
+
+每个 backend MUST 在返回前给出同步结论。规则如下：
+
+1. definite block 头声明的长度超过 `effective_query_max` 时，backend 只有在到已声明
+   payload 末尾的待丢弃字节数不超过 `resynchronization_max_bytes` 时，才能以有界流式读取
+   消费到已证明边界，然后抛出 `TransportIOError(reason_code="binary_limit_exceeded")`。
+   声明长度需要更多丢弃字节时必须立即关闭资源并标记 `poisoned`，不得为保持同步而无界读取。
+2. message 读取超过上限时，只有在额外消费不超过 `resynchronization_max_bytes` 且 backend
+   在此范围内报告已证明的 message END 时，才允许「有界消费后失败」；超过该范围仍未
+   到 EOM 时必须终止资源并把 session 标为 `poisoned`。
+3. timeout、部分响应、终止符恢复失败和 malformed header 必须映射到现有
+   `TransportIOError` 的 `phase`、`response_progress`、`synchronization`、`attempts` 和
+   `replay_policy` 字段；不得重试已经发送且同步未知的完整 query。
+4. R1.3 候选为现有 `TransportIOError` 增加可选的稳定 `reason_code`、非负非 bool
+   `consumed_bytes` 和 `discarded_bytes`。binary `reason_code` 固定为
+   `binary_framing_error`、`binary_limit_exceeded`、`binary_truncated`、`binary_timeout` 或
+   `binary_transport_trailing_error`。它们进入现有脱敏 error envelope，不新建携带 payload 的公共异常。
+   `TransportIOError` 的构造、`with_attempts()` 复制和 envelope 序列化都必须保留这三个
+   字段，不得在 retry 计数时丢失细分原因或字节证据。
+   有界丢弃成功时 `synchronization=proven`，未证明时为 `unproven`，已确认失步或关闭时为
+   `lost`；后两者分别使 session 至少进入 `uncertain` 或 `poisoned`。
+5. R1.3 的 `query_binary(command=...)` 不接受 `ReplayPolicy.READ_CONTINUATION_ONLY`，因为该
+   签名必然携带一个可能被发送的 command；必须在 `BEFORE_SEND` 阶段以 `NOT_SENT` 拒绝。
+   未来若需要 continuation，应设计只接受 core-issued response token 的独立
+   `read_binary_continuation(token, max_bytes=...)`，只消费同一响应且绝不重发 command。
+
+definite block 已消费声明 payload 后发现额外字节时，额外字节不得被当作本次 payload，也
+不得静默丢弃：只有在它们与 core-validated profile 中某个
+`budget.transport_trailing` 精确匹配时，才能作为 `transport_trailing_bytes` 成功返回；
+否则同步状态为 `LOST`，session 进入 `poisoned`。下一次 query 只有在
+backend 明确保留并授权 continuation token 时才可继续。
+
+成功返回使用 `BinaryQueryResult`，从而显式携带 declared/consumed/transport-trailing
+和已证明同步。`data` 只包含 framing 定义的 payload/message。对 definite block，成功必须同时满足：
+
+```text
+declared_length == len(data)
+framing_header_bytes == 2 + N
+transport_trailing_bytes == budget.transport_trailing
+consumed_bytes == framing_header_bytes + len(data) + len(transport_trailing_bytes)
+```
+
+`framing_header_bytes` 必须是非 bool 整数；definite block 中范围为 `3..11`，必须从实际读到的
+`N` 保留，不得从 `declared_length` 反推，因为 length field 可含前导零。
+
+对 MESSAGE，EOM 之前全部字节都属于 `data`；成功必须满足
+`declared_length is None`、`transport_trailing_bytes == b""` 和
+`framing_header_bytes == 0`、`consumed_bytes == len(data)`。MESSAGE 的媒体内容后缀仍属于 `data`，不得改名为 transport
+trailing。任何 backend 在返回前无法
+证明已到达响应边界，都不得构造 `BinaryQueryResult`；必须抛出结构化错误并把 session
+标记为 `uncertain` 或 `poisoned`。因此 `synchronization="proven"` 是成功类型的先决条件，不是
+backend 可以随意填写的默认值。
+成功路径还必须写入 transport audit：`response_progress=complete`、
+`synchronization=proven`、`consumed_bytes`、`transport_trailing_bytes` 长度和 framing；失败还必须记录
+`consumed_bytes`、`discarded_bytes`、`reason_code` 和最终 session health，并继续使用
+`TransportIOError`。现有 `query_bin_block()` 兼容入口只为 definite block 提取 `data`，但
+仍保留 audit metadata。尾随字节不能用 `rstrip()` 静默删除。continuation token 的独立返回
+模型仍是 `[OPEN]`，在此之前成功结果不得暗中留下待续读状态。
+
+### 2.6 内容校验与应用层分块
+
+PNG driver 负责 signature、chunk、IEND、尺寸、MIME type 和 profile 的精确 content-trailing
+校验。SDS800X HD 的实测 raw PNG 在 IEND 后有一个尾字节；在 MESSAGE framing 中，
+该字节仍位于 `BinaryQueryResult.data`。driver 只能在确认 IEND 后按
+`ScopeScreenshotVariant.content_trailing_hex` 精确校验并从规范 PNG 结果中移除，不能把它当作
+transport terminator 或 `transport_trailing_bytes`。
+
+波形多块读取另行携带：
+
+```text
+record_id / acquisition_id
+chunk_index
+offset_samples
+points
+total_points（可选）
+is_last
+```
+
+只有同一 `record_id`、连续 offset、唯一 chunk index 且最终点数一致时才允许拼接。不同
+query 的结果不得无条件拼接；样本格式、字节序和 preamble 解码仍属于 waveform decoder。
+
+## 三、screenshot profile
+
+### 3.1 明确 request tuple
+
+格式、菜单和颜色不是独立笛卡尔积。候选 profile 使用明确支持的 request tuple：
+
+```python
+ScreenshotMenuMode = Literal["device", "include", "exclude"]
+ScreenshotColorMode = Literal["device", "color", "monochrome", "inverted"]
+ScopeScreenshotStateField = Literal["scope.display_menu", "scope.display_color"]
+
+@dataclass(frozen=True)
+class ScopeScreenshotRequest:
+    format: Literal["png"] = "png"
+    menu_mode: ScreenshotMenuMode = "device"
+    color_mode: ScreenshotColorMode = "device"
+
+@dataclass(frozen=True)
+class ScopeScreenshotVariant:
+    request: ScopeScreenshotRequest
+    media_type: Literal["image/png"]
+    framing: BinaryResponseFraming
+    response_max_bytes: int
+    operation_max_bytes: int
+    resynchronization_max_bytes: int
+    changed_fields: tuple[ScopeScreenshotStateField, ...]
+    restore_order: tuple[ScopeScreenshotStateField, ...]
+    snapshot_max_steps: int
+    restore_max_steps: int
+    verify_max_steps: int
+    query_max_count: Literal[1] = 1
+    transport_trailing_hex: str = ""
+    content_trailing_hex: str = ""
+    width_px: tuple[int, int] | None = None
+    height_px: tuple[int, int] | None = None
+
+@dataclass(frozen=True)
+class ScopeScreenshotProfile:
+    variants: tuple[ScopeScreenshotVariant, ...]
+    source: Literal["descriptor", "queried", "combined"] = "descriptor"
+
+@dataclass(frozen=True)
+class ScopeScreenshotStateSnapshot:
+    captured_fields: tuple[ScopeScreenshotStateField, ...]
+    menu_state_token: str | None = None
+    color_state_token: str | None = None
+
+@dataclass(frozen=True)
+class ScopeScreenshotBaseline:
+    context_id: str
+    session_epoch: str
+    baseline_nonce: str
+    snapshot: ScopeScreenshotStateSnapshot
+    restore_order: tuple[ScopeScreenshotStateField, ...]
+
+@dataclass(frozen=True)
+class ScopeScreenshotRestoreResult:
+    status: Literal["completed", "failed", "not_attempted"]
+    attempted_fields: tuple[ScopeScreenshotStateField, ...]
+    restored_fields: tuple[ScopeScreenshotStateField, ...]
+    error_code: str | None = None
+
+@dataclass(frozen=True)
+class ScopeScreenshotVerification:
+    status: Literal["verified", "mismatch", "unavailable"]
+    verified_fields: tuple[ScopeScreenshotStateField, ...]
+    mismatched_fields: tuple[ScopeScreenshotStateField, ...]
+    error_code: str | None = None
+
+@dataclass(frozen=True)
+class ScopeScreenshot:
+    data: bytes
+    media_type: Literal["image/png"]
+    width_px: int
+    height_px: int
+    requested: ScopeScreenshotRequest
+    effective: ScopeScreenshotRequest
+    framing: BinaryResponseFraming
+
+@dataclass(frozen=True)
+class ScopeEmbeddedScreenshotContract:
+    request: ScopeScreenshotRequest
+    changed_fields: tuple[ScopeScreenshotStateField, ...]
+    verification_fields: tuple[ScopeScreenshotStateField, ...]
+    cleanup_verification_fields: tuple[ScopeScreenshotStateField, ...]
+    failure_policy: Literal["fail_parent"] = "fail_parent"
+    artifact_key: Literal["screenshot"] = "screenshot"
+
+class ScopeScreenshotDriver(InstrumentDriver, Protocol):
+    def snapshot_screenshot_state(
+        self,
+        fields: tuple[ScopeScreenshotStateField, ...],
+    ) -> ScopeScreenshotStateSnapshot: ...
+    def capture_screenshot(
+        self,
+        request: ScopeScreenshotRequest,
+        *,
+        baseline: ScopeScreenshotBaseline | None,
+    ) -> ScopeScreenshot: ...
+    def restore_screenshot_state(
+        self,
+        baseline: ScopeScreenshotBaseline,
+    ) -> ScopeScreenshotRestoreResult: ...
+    def verify_screenshot_state_restored(
+        self,
+        fields: tuple[ScopeScreenshotStateField, ...],
+        baseline: ScopeScreenshotBaseline,
+    ) -> ScopeScreenshotStateSnapshot: ...
+```
+
+`variants` MUST 非空，每个 request 只能出现一次；R1.3 首版只接受 `png` / `image/png`。
+两个 byte 上限 MUST 为正数，`resynchronization_max_bytes` MUST 为非 bool 非负整数；
+descriptor variant 的 response/operation/query/resynchronization 值不得超过
+`262144/262144/1/0`，connection 或更严格 profile 只能进一步收紧；
+首版 screenshot 只允许一次
+binary response，因此 `query_max_count == 1` 且
+`operation_max_bytes == response_max_bytes`。尺寸范围的上下界必须为正数且满足
+`min <= max`，固定尺寸使用
+`min == max`。请求未精确匹配一个 variant 时在任何 I/O
+前拒绝。这样不会把 format、menu、color、framing 和 media type 错当成独立笛卡尔积。
+`device` 表示保留仪器当前行为，不等于 `include` 或 `exclude`。R1.3 public profile 必须
+来自 descriptor，或来自 descriptor 与仪器查询结果的 `combined` 交集；`queried`-only
+profile 在 capability discovery 时拒绝。查询结果不得扩大 descriptor 未声明的安全上限，
+结果中的 `effective` 和 variant 必须一致。
+
+声明 `scope.screenshot_profile` 或 `scope.screenshot_v2` 时，
+`InstrumentDescriptor.scope_extensions.screenshot_profile` MUST 非空，并在 factory 阶段通过
+全部静态不变量；`get_screenshot_profile()` 只能返回 descriptor 的原样事实或更严格的
+`combined` 交集。profile provider 缺失、返回 `queried`-only 结果或试图扩大任一上限时，
+capability discovery 必须 fail-closed。
+
+state restore 字段使用以下不变量：
+
+- `changed_fields` 唯一，只包含该 request tuple 实际会修改的 menu/color 字段；
+- `restore_order` 必须与 `changed_fields` 集合相同且无重复；顺序是 driver 恢复写入的唯一事实源；
+- `changed_fields` 为空时，三个 `*_max_steps` 必须全为 `0`；非空时，必须是
+  `1..32` 的非 bool 整数，且分别覆盖 snapshot query、restore write 和 verify query 的
+  最大实际 step 数；
+- snapshot 的 `captured_fields` 必须恰好等于 variant `changed_fields`；menu/color token 必须在
+  对应字段存在时非空，其他情况为 `None`。
+- core-owned `ScopeScreenshotBaseline.restore_order` 必须是已验证 variant 的精确顺序，driver
+  不得自行追加、删除或重排字段。
+
+`transport_trailing_hex` 和 `content_trailing_hex` 都使用小写、偶数长度的精确十六进制，
+每个解码后最长 16 bytes；前者只表示 definite-block framing 后的文档化 transport
+terminator，MESSAGE 必须固定为 `""`。后者表示已位于 MESSAGE payload 或 definite-block
+payload 内的应用内容后缀。driver 必须先完整验证 PNG 到 IEND，再要求 IEND 后字节与
+`content_trailing_hex` 精确相等；不得使用 `rstrip()` 或任意 parser。`ScopeScreenshot.data`
+只返回从 PNG signature 到 IEND 的规范 PNG，不包含 content trailing；artifact 只记录后缀
+长度和 variant 标识。binary response/operation budget 按清理前的完整 payload 计数。
+
+driver 负责格式签名和媒体类型一致性，核心负责上限、artifact 字段和 transport framing。
+非 PNG 格式的完整校验由对应 format handler 定义，不能默认为「任意 bytes 都合法」。
+成功结果的 `width_px` / `height_px` 必须非空、为正整数并落在 variant 的闭区间内；PNG
+handler 必须从已校验的 IHDR 得到尺寸，不能只相信 driver 自报值。
+
+### 3.2 状态副作用与旧接口
+
+若 menu/color 设置会写入前面板状态，`scope.screenshot_v2` 必须记录对应 changed fields、
+恢复覆盖和有效 request。只要 variant `changed_fields` 非空，核心必须在任何写入前调用
+`snapshot_screenshot_state()`，校验返回值后构造 core-owned
+`ScopeScreenshotBaseline(context_id, session_epoch, baseline_nonce, snapshot, restore_order)`，并把同一 baseline 传入
+`capture_screenshot()`。driver 只能使用 baseline 中的已验证字段和顺序。
+若 `changed_fields` 为空，baseline 固定为 `None`，三个 state recovery 方法不得发生 I/O。
+
+无论截图成功、媒体校验失败或 transport 失败，只要 `changed_fields` 非空，核心都必须按
+variant `restore_order` 调用 `restore_screenshot_state(baseline)`，再在独立只读阶段调用
+`verify_screenshot_state_restored(changed_fields, baseline)`。restore result 只证明写入已完成；verify 方法必须
+返回新查询的 `ScopeScreenshotStateSnapshot`，由核心与 baseline snapshot 逐字段比较并生成
+`ScopeScreenshotVerification`。只有全部 changed fields 一致时才能报告恢复成功。主 driver 抛异常不会丢失
+core-owned baseline。恢复或验证失败不覆盖主异常，但 session 不得保持 `healthy`，
+主截图结果也不得伪装为成功。`changed_fields` 为空时，restore/verify 结果固定为
+`not_attempted`/`unavailable` 的无 I/O 记录，不调用这两个需要 baseline 的方法。
+
+`ScopeScreenshotRestoreResult.attempted_fields` 必须遵循 baseline 的 `restore_order` 前缀，
+`restored_fields` 只能是已尝试字段的有序子序列；`status="completed"` 只在所有 changed
+fields 均已写入时成立。restore/verify 抛出的 transport 或协议异常由核心规范化为
+`failed`/`unavailable` 结果，核心不得把该结果当作 query-back 证据。
+
+截图的执行顺序固定为：`preflight snapshot -> main capture -> error_after? ->
+success_restore restore -> cleanup_verification verify`。主 capture 抛异常、PNG 校验失败或
+`error_after` 失败时，主异常优先级最高，但仍必须转入 `failure_cleanup restore ->
+cleanup_verification verify`；没有
+changed fields 时整个 restore/verify 分支为零 I/O。核心只有在 restore result 完成且 verify
+逐字段匹配时，才把 screenshot operation 标为恢复成功。
+
+snapshot、restore 和 verify 分别只能在 `preflight`、`success_restore|failure_cleanup`
+和 `cleanup_verification` 阶段授权中调用；每个授权使用 variant 已验证的 step 上限。
+baseline 的 `context_id`、epoch 或 nonce 不匹配、阶段不匹配、nonce 已消费，或 driver 尝试
+超出 fields/step 时，必须在越界 I/O 前拒绝。
+
+这里的 snapshot → restore → verify 是可复用的 state-recovery 模式，不是 SDS800X HD 私有
+命令合同：不同仪器只需为各自的字段集合定义 typed snapshot/baseline 和 token 编解码，核心
+仍负责授权、字段比较、session health 与 artifact。后续 `CHDR`/`CORD`/`WFSU` 等 transfer
+状态若需要写入，也应复用同一模式，而不是再发明只返回布尔值的 driver helper。
+
+现有 `scope.screenshot` 仅在 profile 明确包含等价旧参数时适配；旧 driver 忽略
+`include_menu` 的行为不能由通用 adapter 静默继承。无法证明参数已生效时必须报告
+`unsupported_capability` 或 `precondition_failed`。
+
+现有 DS1000Z driver 会丢弃 `include_menu`，因此不能宣称满足 `exclude`；RTM2000 driver
+会写入菜单和颜色设置，因此迁移时必须把这两个字段纳入 changed/restore/verification。
+两者不能共享一个不检查 effective request 的旧接口 adapter。
+
+## 四、采集运行状态与控制
+
+### 4.1 组合状态模型
+
+`ScopeAcquisitionStatus` 继续表示平均和分段信息。运行状态使用独立模型，`AUTO/NORMAL/SINGLE`
+是 trigger mode，不是 phase：
+
+```python
+ScopeAcquisitionPhase = Literal[
+    "unknown",
+    "stopped",
+    "ready",
+    "arming",
+    "waiting",
+    "acquiring",
+    "rolling",
+    "stopping",
+    "complete",
+    "error",
+]
+
+ScopeTriggerMode = Literal[
+    "auto",
+    "normal",
+    "single",
+    "roll",
+    "unknown",
+]
+
+ScopeContinuousTriggerMode = Literal["auto", "normal", "roll"]
+ScopeSingleBaselineStage = Literal["configured_pre_arm", "original_atomic_arm"]
+ScopeSingleArmSemantics = Literal["configure_then_arm", "atomic_configure_and_arm"]
+ScopeAcquisitionIdentitySemantics = Literal["unique_within_session_epoch", "unknown"]
+ScopeAcquisitionSettingField = Literal["scope.trigger", "scope.acquisition"]
+ScopeAcquisitionRestoreField = Literal[
+    "scope.run_state",
+    "scope.trigger",
+    "scope.acquisition",
+]
+ScopeStateToken = str
+
+@dataclass(frozen=True)
+class ScopeAcquisitionControlProfile:
+    supported_continuous_modes: tuple[ScopeContinuousTriggerMode, ...]
+    single_arm_semantics: ScopeSingleArmSemantics
+    arm_resets_acquisition_count: bool
+    failure_restore_order: tuple[ScopeAcquisitionSettingField, ...]
+    snapshot_max_steps: int
+    restore_max_steps: int
+    verify_max_steps: int
+    identity_semantics: ScopeAcquisitionIdentitySemantics
+    atomic_arm_preserves_count_mode_semantics: bool = False
+
+@dataclass(frozen=True)
+class ScopeAcquisitionControlSnapshot:
+    run_state: "ScopeAcquisitionRunState"
+    trigger_state_token: ScopeStateToken
+    acquisition_state_token: ScopeStateToken
+
+@dataclass(frozen=True)
+class ScopeAcquisitionControlBaseline:
+    context_id: str
+    session_epoch: str
+    baseline_nonce: str
+    snapshot: ScopeAcquisitionControlSnapshot
+    restore_order: tuple[ScopeAcquisitionRestoreField, ...]
+
+@dataclass(frozen=True)
+class ScopeBaselineRestoreResult:
+    status: Literal["completed", "failed", "not_attempted"]
+    attempted_fields: tuple[ScopeAcquisitionRestoreField, ...]
+    restored_fields: tuple[ScopeAcquisitionRestoreField, ...]
+    error_code: str | None = None
+
+@dataclass(frozen=True)
+class ScopeBaselineVerification:
+    status: Literal["verified", "mismatch", "unavailable"]
+    verified_fields: tuple[ScopeAcquisitionRestoreField, ...]
+    mismatched_fields: tuple[ScopeAcquisitionRestoreField, ...]
+    error_code: str | None = None
+
+@dataclass(frozen=True)
+class ScopeContinuousAcquisitionRequest:
+    trigger_mode: ScopeContinuousTriggerMode
+
+ScopeCompletionProof = Literal[
+    "count_delta_with_epoch",
+    "identity_delta",
+    "state_transition",
+]
+
+@dataclass(frozen=True)
+class ScopeAcquisitionRunState:
+    phase: ScopeAcquisitionPhase
+    trigger_mode: ScopeTriggerMode
+    raw_state: str
+    acquisition_count: int | None = None
+    counter_epoch: ScopeStateToken | None = None
+    acquisition_identity: str | None = None
+
+@dataclass(frozen=True)
+class ScopeAcquisitionCompletion:
+    state: ScopeAcquisitionRunState
+    original_state: ScopeAcquisitionRunState
+    proof_baseline_state: ScopeAcquisitionRunState
+    proof_baseline_stage: ScopeSingleBaselineStage
+    proof: ScopeCompletionProof
+    baseline_count: int | None = None
+    completed_count: int | None = None
+    baseline_identity: str | None = None
+    completed_identity: str | None = None
+    observed_states: tuple[ScopeAcquisitionRunState, ...] = ()
+```
+
+`ScopeAcquisitionControlProfile` 是 descriptor 静态事实，不是 driver 在 operation 中自报的
+动态结果。候选 `InstrumentDescriptor.scope_extensions.acquisition_control_profile` 字段在声明
+`scope.acquisition_control` capability 时 MUST 非空；核心 factory 在第一次仪器 I/O 前
+完成静态校验，并把已验证 profile 传给 Service preflight。R1.3 不允许仪器查询或
+driver 返回值扩大 descriptor profile。
+
+profile 不变量为：
+
+- `supported_continuous_modes` 非空、唯一，且只包含 `auto/normal/roll`；
+- 两个 bool 字段必须是真正的 `bool`；
+- `failure_restore_order` 必须恰好各包含一次 `scope.trigger` 和 `scope.acquisition`；
+  顺序是核心恢复授权与 driver 实现的唯一事实源；
+- 三个 `*_max_steps` 必须是 `1..64` 的非 bool 整数；snapshot/verify 各至少覆盖 run state、
+  trigger 和 acquisition 三次 query，`restore_max_steps` 至少覆盖 STOP 和两个设置恢复写入，
+  但不因此允许超出实际授权 step 数；
+- `single_arm_semantics="configure_then_arm"` 时
+  `atomic_arm_preserves_count_mode_semantics` MUST 为 `false`；
+- `single_arm_semantics="atomic_configure_and_arm"` 时，只有
+  `atomic_arm_preserves_count_mode_semantics=true` 且 `arm_resets_acquisition_count=false` 时，
+  operation verifier 才可以在原始状态确为 `trigger_mode="single"` 时把 count 作为辅助证据；
+- `arm_resets_acquisition_count=true` 时任何 arm 路径都不得使用 `count_delta_with_epoch`；只能使用
+  identity 或状态迁移证据。
+- `identity_semantics="unique_within_session_epoch"` 才允许 `identity_delta`；
+  `unknown` 时核心不得接受 identity proof，只能使用满足本节要求的 state transition。
+
+核心构造 `ScopeAcquisitionControlBaseline` 时必须把固定的
+`("scope.run_state", *profile.failure_restore_order)` 写入 `restore_order`；baseline 中的顺序
+与该展开结果不一致时在第一次 recovery I/O 前拒绝。`ScopeAcquisitionControlSnapshot` 的三个
+字段必须始终齐全，因此 STOP、trigger 和 acquisition 的恢复/验证边界不会依赖 driver 临时
+决定字段集合。
+
+`ScopeStateToken` MUST 是经 driver 规范化的、无换行、不含 resource/序列号的安全 token；不得把
+原始 SCPI、仪器地址或未脱敏响应放入 baseline。`context_id` 负责 operation 归属，
+`session_epoch` 负责连接世代，`baseline_nonce` 负责一次性消费；三者任一不匹配都必须拒绝，
+不得跨 epoch 或 context 重用。`ScopeBaselineRestoreResult` 和 `ScopeBaselineVerification` 是核心可审计的结果，
+不是 driver 可以省略的布尔标记。
+
+`ScopeBaselineRestoreResult.attempted_fields` 必须是 baseline `restore_order` 的前缀，
+`restored_fields` 必须是其中的有序子序列且不得包含额外字段；`status="completed"` 仅在
+所有必需字段均已写入时成立，任何中途失败都必须为 `failed` 并保留已完成字段。
+driver 若在 restore/verify 中抛出 transport 或协议异常，核心必须把它规范化为对应的
+`failed`/`unavailable` cleanup 结果并保留异常证据；不得因为 Protocol 返回类型存在就假定
+调用一定返回。
+核心不得把 `restored_fields` 当作 query-back 证据，必须以随后返回的 snapshot 生成
+`ScopeBaselineVerification`。
+
+`raw_state` MUST 是短、可打印、无换行 token；无法无损映射时使用 `unknown`，不能把相近
+文字硬映射成 `stopped` 或 `complete`。`acquisition_count` 必须是非负、非 bool 整数；
+`counter_epoch`（若有）必须是 `1..64` 个 ASCII safe-token 字符，并在同一次 operation
+中保持可比较；
+`acquisition_identity` 只能是经 driver 校验的短 token，不能包含 resource 或序列号。
+`ScopeAcquisitionRunState` 只描述一次观察，不携带历史完成结论；completion proof 只存在于
+`ScopeAcquisitionCompletion`，防止普通状态查询伪装成某次 SINGLE 已完成。
+成功构造 `ScopeAcquisitionCompletion` 时，首先必须满足所有 proof 共享的终态不变量：
+`state.phase` 属于 `complete/stopped`、`observed_states` 非空且最后一项等于 `state`。
+然后再验证分支：`count_delta_with_epoch` 仅可作为带联合证据的 proof，要求两个 count 都存在、两个
+`counter_epoch` 都存在且相等、满足本节比较规则，并且 `observed_states` 同时证明有效的
+状态迁移；它不再是仅凭模差或正向差值的独立完成证明；
+`identity_delta` 要求新旧 identity 都是 `1..64` 个 ASCII safe-token 字符且不同，
+`state_transition` 要求保留本节的最小观察序列，且不依赖 count；若该分支同时携带 count，
+仍必须提供未变化的 `counter_epoch`，否则核心必须忽略 count 并按纯状态迁移验证。任一终态或证据不完整只能抛出
+`completion_unproven`，不得返回一个携带「不可用」proof 的成功对象。
+`identity_delta` 也不能仅凭两个 token 不同就成立；核心只在已验证 descriptor profile 的
+`identity_semantics="unique_within_session_epoch"` 时接受该 proof。`unknown` 或 profile
+缺失时，即使 fixture 观察到 token 不同，也只能使用完整 `state_transition`，或拒绝完成证明。
+`baseline_count`/`completed_count` 非空时必须分别等于
+`proof_baseline_state.acquisition_count`/`state.acquisition_count`；identity 字段也必须与对应状态一致。
+`original_state` 必须等于 core-owned baseline 中的 `snapshot.run_state`。不能在 completion 外
+额外填一组更有利的 token 来通过 verifier。
+forced trigger 是瞬时 action/event，不是可 query-back 的持久 `ScopeTriggerMode`，因此不进入
+该枚举。执行强制触发时只在 operation artifact 记录 `trigger_action="force"` 及其完成证据，
+不能把仪器随后返回的 mode 伪造成 `forced`。
+
+### 4.2 状态迁移与操作语义
+
+候选状态迁移至少包括：
+
+| 操作/事件 | 允许起始 phase | 预期观察 | 失败语义 |
+| --- | --- | --- | --- |
+| `scope.acquisition_start`（driver: `start_continuous`） | `stopped`、`ready`、`complete` | 写入后回读 `ready`/`arming`/`waiting`/`acquiring`/`rolling` | 写后回读失败，保留 session health 和 cleanup 结果 |
+| `scope.acquisition_single`（driver: `acquire_single`） | `stopped`、`ready`、`complete` | 记录基线，观察新采集状态，再到 `complete/stopped` 且有 proof | 只观察到 arm 不算成功；超时进入失败 cleanup |
+| trigger accepted | `arming`、`waiting`、`ready` | `acquiring` 或 `complete` | 外部变化时回读为 `unknown` |
+| acquisition complete | 已观察到 `arming`、`waiting`、`ready` 或 `acquiring` 中至少一个新采集状态 | `complete` 或 `stopped` 且有 completion proof | 轮询可以跳过瞬时 `acquiring`；只有原本已 `stopped` 不足以证明新采集完成 |
+| normal `scope.acquisition_stop`（driver: `stop_acquisition`） | `stopped`、`ready`、`arming`、`waiting`、`acquiring`、`rolling`、`stopping` 或 `complete` | 回读 `stopped` | 幂等；回读失败时保留 `uncertain`/`poisoned` |
+| recovery STOP | 核心已签发有界 recovery authorization 的 `healthy/uncertain` session；phase 可为 `unknown/error` | 只写 STOP 并回读 `stopped` | 不得向 `poisoned` session 发送；结果只记入 cleanup，不伪装成 normal success |
+| 外部/设备错误 | 任意 | `error` 或 `unknown` | 必须重新查询确认，不能继续普通 I/O |
+
+控制协议建议为：
+
+```python
+class ScopeAcquisitionRunStateDriver(InstrumentDriver, Protocol):
+    def get_acquisition_run_state(self) -> ScopeAcquisitionRunState: ...
+
+class ScopeAcquisitionControlRecoveryDriver(InstrumentDriver, Protocol):
+    def snapshot_acquisition_control(self) -> ScopeAcquisitionControlSnapshot: ...
+    def restore_acquisition_control(
+        self,
+        baseline: ScopeAcquisitionControlBaseline,
+    ) -> ScopeBaselineRestoreResult: ...
+    def verify_acquisition_control_restored(
+        self,
+        baseline: ScopeAcquisitionControlBaseline,
+    ) -> ScopeAcquisitionControlSnapshot: ...
+
+class ScopeAcquisitionControlDriver(
+    ScopeAcquisitionRunStateDriver,
+    ScopeAcquisitionControlRecoveryDriver,
+    Protocol,
+):
+    def start_continuous(
+        self,
+        *,
+        trigger_mode: ScopeContinuousTriggerMode,
+        baseline: ScopeAcquisitionControlBaseline,
+    ) -> ScopeAcquisitionRunState: ...
+    def stop_acquisition(self) -> ScopeAcquisitionRunState: ...
+    def acquire_single(
+        self,
+        *,
+        baseline: ScopeAcquisitionControlBaseline,
+        deadline: float,
+    ) -> ScopeAcquisitionCompletion: ...
+```
+
+核心必须在主操作写入前调用 `snapshot_acquisition_control()`，校验返回值后自行
+构造 `ScopeAcquisitionControlBaseline(context_id, session_epoch, baseline_nonce, snapshot,
+("scope.run_state", *failure_restore_order))`。
+driver 只看到已验证的
+baseline，不能构造或修改 core-owned `session_epoch`。`start_continuous()` 和
+`acquire_single()` MUST 使用核心传入的同一 baseline，不得在内部替换为无法审计的另一份
+baseline。因此，即使主 driver 方法抛出异常，核心仍保留恢复所需的类型化状态。
+
+`restore_acquisition_control()` 的固定语义是：先发送 STOP，再按
+`failure_restore_order` 恢复
+`scope.trigger` 和 `scope.acquisition`；不得恢复 snapshot 中的运行 phase。
+`ScopeBaselineRestoreResult.restored_fields` 只表示恢复写入已完成，不是 query-back 证据。
+核心必须随后使用独立只读阶段调用 `verify_acquisition_control_restored()`；成功需要
+driver 必须返回新查询的 `ScopeAcquisitionControlSnapshot`，不得直接返回布尔结论。
+核心 verifier 据此生成 `ScopeBaselineVerification`：`scope.run_state` 必须已为 `stopped`，
+且 trigger/acquisition token 与 baseline snapshot 精确相等。只有
+restore 和 verification 全部成功时 session 才能恢复 `healthy`。
+
+`start`/`single` 的失败执行顺序固定为：
+
+1. 在 `preflight` 保存并验证 baseline；关闭 preflight authorization 后执行 `main`。
+2. 若 driver 抛异常、deadline/cancel 触发，或主调用已返回但 `error_after` 判定失败，先保存
+   该主异常并禁止把它改写为 cleanup 结果。
+3. 在 session 为 `healthy/uncertain` 且 epoch 未变化时，关闭当前 authorization，依次开启
+   `failure_cleanup` 和 `cleanup_verification` phase；前者调用
+   `restore_acquisition_control(baseline)`，后者调用
+   `verify_acquisition_control_restored(baseline)` 并由核心比较 snapshot。
+4. restore 或 verification 任一步失败，最终结果仍保留第 2 步主异常（若无主异常则报告
+   recovery failure），session 保持 `uncertain/poisoned`；若 session 已 `poisoned`，两步均
+   记录 `not_attempted`，不得发送 STOP。
+
+成功的 `start`/`single` 不执行上述 baseline restore；它们分别验证声明的 postcondition，
+只在失败、取消、超时或 after-error cleanup 路径恢复调用前的 trigger/acquisition 设置。
+
+snapshot、restore、verify 三个方法分别只能在 `preflight`、`failure_cleanup` 和
+`cleanup_verification` 阶段授权中调用。`failure_cleanup` 允许文本 write，
+`cleanup_verification` 只允许文本 query；两者都不允许 binary I/O。任一方法在未授权阶段被调用，
+或 baseline 的 context/epoch/nonce 与当前 context 不同，必须在发送前拒绝；一次 restore 尝试
+结束后不得再次使用同一 baseline。
+
+`start_continuous()` 不保留一个未知或 `single` trigger mode。请求必须显式选择
+`auto`、`normal` 或 `roll`，并且该 mode 已在核心校验的
+`ScopeAcquisitionControlProfile.supported_continuous_modes` 中声明。
+核心必须先持有 `ScopeAcquisitionControlBaseline`，再把其 snapshot 传入 driver。driver 写入
+目标 mode 并 query-back，然后才发送连续运行 action。成功结果必须同时回读
+`state.trigger_mode == request.trigger_mode` 和允许的运行 phase；
+仅发送 RUN、保留 `single` 后再采一次，不得报告为 continuous success。
+
+`acquire_single()` 是等待完成的 acquire operation，不是 arm-only 写操作。它必须分开两种 baseline：
+
+- `original_state`：任何 operation 写入前读取，用于 artifact 和失败 cleanup；
+- `proof_baseline_state`：用于 completion proof 的最后一个 pre-arm 观察。若仪器可分开「配置
+  SINGLE」和「真正 arm/RUN」，driver 必须先写入 SINGLE、query-back，再读取同 mode 的
+  count/identity，并标记 `proof_baseline_stage="configured_pre_arm"`。
+
+`proof_baseline_stage="configured_pre_arm"` 必须对应
+`single_arm_semantics="configure_then_arm"`；`proof_baseline_stage="original_atomic_arm"` 必须对应
+`single_arm_semantics="atomic_configure_and_arm"`。核心 result verifier 必须与已验证 descriptor
+profile 比对，不得信任 driver 自行选择更宽松的 stage。
+
+如果仪器的单条命令不可分地同时配置并 arm，则
+`proof_baseline_stage="original_atomic_arm"` 且 `proof_baseline_state == original_state`。该路径只有在
+original 已为 `trigger_mode="single"`，且 `ScopeAcquisitionControlProfile` 同时声明
+`single_arm_semantics="atomic_configure_and_arm"`、
+`atomic_arm_preserves_count_mode_semantics=true` 和 `arm_resets_acquisition_count=false` 时，
+才能把 count 作为辅助证据；最终 proof 仍必须同时满足未变化的 `counter_epoch` 和有效
+`state_transition`。否则必须改用 identity delta 或完整的 state transition。
+
+真正 arm 后，Service/driver 在同一 deadline 内等待新 acquisition 完成。只有看到有效
+identity 变化，或看到 R1.3 暂定的最小状态序列后，才能成功返回 completion
+proof；调用前本来就是 `stopped` 不能单独作为完成条件。没有 completion proof 时
+返回 `completion_unproven`，不得返回成功 waveform。
+
+R1.3 暂定的最小 `state_transition` proof 为：SINGLE 写入并 query-back 后至少观察一次
+`arming`、`waiting` 或 `acquiring`；也可以观察 `ready`，但必须同时回读
+`trigger_mode="single"`，且 `(phase, trigger_mode)` 不得与 `proof_baseline_state` 相同。随后必须观察
+`complete` 或 `stopped`。如果仪器把
+写后第一个查询直接返回 `stopped`，且 count/identity 均不变或不可用，则 completion
+unproven。后续若跨厂商 fixture 证明该序列仍不通用，应保持 `[OPEN]`，不得由单个插件放宽。
+
+arm-only API 不属于 R1.3；未来如确有非阻塞需要，应新增 `scope.acquisition_arm_single`，其
+effect 为 `write`、成功输出只证明已 arm，不能复用 `scope.acquisition_single` 的成功合同。
+
+count 比较使用 `proof_baseline_state` 的同一 acquisition mode 基线。新 count 大于基线只可作为
+`count_delta_with_epoch` 的辅助条件；它还必须满足 `counter_epoch` 非空且未变化，并与有效
+`state_transition` 联合，不能单独证明完成。`counter_epoch` 缺失、改变或无法证明连续时，
+必须改用 `identity_delta` 或完整的 `state_transition` proof。count 因
+`ScopeAcquisitionControlProfile.arm_resets_acquisition_count=true` 而下降或归零时，不能使用
+  `count_delta_with_epoch`。当前首版不接受 modulus，也不尝试用模差区分真实回绕、计数器复位或仪器重启；任何
+`completed_count <= baseline_count` 都使 count 辅助条件失效。mode 改变、仪器重启、前面板重置或
+疑似回绕会使原 baseline 失效，不能沿用旧 count。
+
+`stop_acquisition()` MUST 幂等：已经 `stopped` 时可直接成功，但仍应返回观察到的状态；非
+`stopped` 时必须写入并 query-back。一个 session 同时只允许一个 control operation，且控制
+操作使用 exclusive lease。
+
+### 4.3 deadline、取消和恢复
+
+等待 deadline 来自 operation request；若调用方未给出，R1.3 使用第 1.2 节固定的
+`SCOPE_ACQUISITION_OPERATION_TIMEOUT_MS`。调用方只能提供更早的绝对 deadline，不能延长它；
+每次轮询和 STOP I/O 继续取 connection timeout 与剩余 deadline 的较小值。当前核心没有该
+operation timeout source 时，只允许作为内部 feature-gated 基础设施实现，不得注册
+`scope.acquisition_*` capability。
+
+超时或取消时：
+
+1. 保留主异常和最后一次观察状态；
+2. 在 session `healthy` 或 `uncertain` 且核心已授权 recovery transaction 时，best-effort
+   执行 `STOP` 并 query-back；
+3. 若 session 已 `poisoned`，普通 STOP I/O 必须继续被 gate 拒绝，应关闭并重新建立连接，
+   不得从插件直接访问 backend session；
+4. cleanup 的成功、失败和最终 `SessionHealth` 写入 artifact，但不能覆盖原始 timeout/cancel
+   异常。
+
+recovery STOP 不复用 normal operation 的 `phase != unknown/error` 前置条件：核心可以在
+`healthy/uncertain + unknown/error phase` 下签发有界 recovery authorization，但必须限制 I/O 种类、字段、
+step 数和 deadline，并要求 STOP 后只读 query-back。`poisoned` session 永远不能获得该授权。
+recovery authorization 不继承主请求的 `ErrorCheckSpec`，错误队列检查固定为
+`disabled / not_applicable`；否则 before drain 可能拦住本应执行的安全 STOP，也会超出授权的
+STOP + query-back I/O 白名单。
+normal `scope.acquisition_stop` 仍要求 healthy session 和可识别 phase，不能借 recovery 规则
+绕过普通 access/capability gate。
+
+现有 `capture_waveform(s)` 仍是 vendor transaction。核心不能仅凭三项控制方法重新拼装它，
+因为通道配置、一次 acquisition 的多通道一致性、transfer 临时状态和恢复仍属于 driver
+合同。
+
+多通道 capture MUST 证明所有通道来自一次 trigger transaction 和同一停止记录。优先使用
+同一 `acquisition_identity`；无法提供 identity 时，必须由同一 SINGLE 写入计数、count delta
+和逐通道读取期间未再次触发的 audit evidence 组成 `shared_acquisition_proof`。部分通道失败时
+artifact 应记录 `completed_channels`、`failed_channel`、`shared_acquisition_proof` 和是否发生
+重采集，禁止为了补齐缺失通道而隐式重新触发。
+
+## 五、类型化 trace source 与数据不变量
+
+### 5.1 source、轴和 operation
+
+候选模型保留 `spectrum` 字面量，用受限的 FFT operation 描述产生方式；这比把 FFT
+伪装成模拟 channel 更明确。但 R1.3 acceptance scope 不注册或迁移 `spectrum`、`math` 和
+`fft_phase`；它们只作为未来 trace-extensions RFC 的非读取 metadata 预留。是否把
+`spectrum` 拆为独立 `fft` kind、单位模型如何复用核心，均不阻塞本轮 M1 内部基础设施，
+但也不能据此宣称 R1.3 全部 trace 合同已冻结。
+
+```python
+ScopeTraceKind = Literal["analog", "digital", "math", "reference", "spectrum"]
+ScopeAxisKind = Literal["time", "frequency", "index", "unknown"]
+ScopeAxisUnit = Literal["s", "Hz", "1", "unknown"]
+ScopeTraceUnit = Literal[
+    "v",
+    "mv",
+    "db",
+    "dbm",
+    "1",
+    "unknown",
+]
+ScopeTraceMagnitudeSemantics = Literal["absolute", "relative", "linear", "unknown"]
+ScopeTraceOperation = Literal[
+    "identity",
+    "reference_copy",
+    "fft_magnitude",
+    "fft_phase",
+    "device_other",
+    "unknown",
+]
+
+@dataclass(frozen=True)
+class ScopeTraceRef:
+    kind: ScopeTraceKind
+    index: int | None = None
+    name: str | None = None
+```
+
+`index` 和 `name` MUST 恰有一个有效值。公共编号按 kind 固定：analog、math、reference 和
+spectrum index 使用 one-based `1..65535`；digital index 使用 zero-based `0..15`，并与 bit N
+一致；所有 index 都不能是 `bool`。具体仪器 profile 只能收紧范围，不能改变基准。`name`
+必须包含 `1..64` 个 Unicode code point、去除首尾空格后不变、全部可打印且不得含控制字符。
+厂商 token 只存在于 driver，不进入公共模型。
+
+```python
+@dataclass(frozen=True)
+class ScopeAxisMetadata:
+    kind: ScopeAxisKind
+    unit: ScopeAxisUnit
+    start: float | None
+    increment: float | None
+    points: int
+
+@dataclass(frozen=True)
+class ScopeTraceMetadata:
+    source: ScopeTraceRef
+    x_axis: ScopeAxisMetadata
+    y_unit: ScopeTraceUnit
+    y_semantics: ScopeTraceMagnitudeSemantics
+    value_encoding: Literal["real", "digital_bitmask"]
+    y_increment: float | None = None
+    y_origin: float | None = None
+    y_resolution_bits: int | None = None
+    operation: ScopeTraceOperation = "unknown"
+    inputs: tuple[ScopeTraceRef, ...] = ()
+    digital_channels: tuple[int, ...] = ()
+    fetchable: bool = False
+
+@dataclass(frozen=True)
+class ScopeTraceData:
+    metadata: ScopeTraceMetadata
+    values: np.ndarray
+
+ScopeTraceTransferField = Literal[
+    "scope.run_state",
+    "scope.waveform_source",
+    "scope.waveform_mode",
+    "scope.query_response_header",
+    "scope.waveform_format",
+    "scope.waveform_byte_order",
+    "scope.waveform_points",
+    "scope.waveform_transfer_window",
+]
+
+@dataclass(frozen=True)
+class ScopeTraceTransferStateSnapshot:
+    captured_fields: tuple[ScopeTraceTransferField, ...]
+    run_state_token: ScopeStateToken | None = None
+    waveform_source_token: ScopeStateToken | None = None
+    waveform_mode_token: ScopeStateToken | None = None
+    query_response_header_token: ScopeStateToken | None = None
+    waveform_format_token: ScopeStateToken | None = None
+    waveform_byte_order_token: ScopeStateToken | None = None
+    waveform_points_token: ScopeStateToken | None = None
+    waveform_transfer_window_token: ScopeStateToken | None = None
+
+@dataclass(frozen=True)
+class ScopeTraceTransferBaseline:
+    context_id: str
+    session_epoch: str
+    baseline_nonce: str
+    snapshot: ScopeTraceTransferStateSnapshot
+    restore_order: tuple[ScopeTraceTransferField, ...]
+
+@dataclass(frozen=True)
+class ScopeTraceTransferRestoreResult:
+    status: Literal["completed", "failed", "not_attempted"]
+    attempted_fields: tuple[ScopeTraceTransferField, ...]
+    restored_fields: tuple[ScopeTraceTransferField, ...]
+    error_code: str | None = None
+
+@dataclass(frozen=True)
+class ScopeTraceTransferVerification:
+    status: Literal["verified", "mismatch", "unavailable"]
+    verified_fields: tuple[ScopeTraceTransferField, ...]
+    mismatched_fields: tuple[ScopeTraceTransferField, ...]
+    error_code: str | None = None
+
+@dataclass(frozen=True)
+class ScopeTraceProfile:
+    fetchable_kinds: tuple[Literal["analog", "digital", "reference"], ...]
+    max_points: int
+    restore_order: tuple[ScopeTraceTransferField, ...]
+    snapshot_max_steps: int
+    restore_max_steps: int
+    verify_max_steps: int
+    source_index_max: int = 65535
+
+class ScopeTraceTransferRecoveryDriver(InstrumentDriver, Protocol):
+    def snapshot_trace_transfer_state(
+        self,
+        fields: tuple[ScopeTraceTransferField, ...],
+    ) -> ScopeTraceTransferStateSnapshot: ...
+    def restore_trace_transfer_state(
+        self,
+        baseline: ScopeTraceTransferBaseline,
+    ) -> ScopeTraceTransferRestoreResult: ...
+    def verify_trace_transfer_state_restored(
+        self,
+        baseline: ScopeTraceTransferBaseline,
+    ) -> ScopeTraceTransferStateSnapshot: ...
+
+class ScopeTraceMetadataDriver(InstrumentDriver, Protocol):
+    def get_trace_metadata(self, source: ScopeTraceRef) -> ScopeTraceMetadata: ...
+
+class ScopeTraceDriver(
+    ScopeTraceMetadataDriver,
+    ScopeTraceTransferRecoveryDriver,
+    Protocol,
+):
+    def fetch_trace(
+        self,
+        source: ScopeTraceRef,
+        *,
+        points: str | int = "dmax",
+        baseline: ScopeTraceTransferBaseline | None,
+    ) -> ScopeTraceData: ...
+```
+
+`ScopeTraceProfile` 是 descriptor 必须提供的静态事实；`fetchable_kinds` 只能是
+`analog`、`digital`、`reference` 的非空唯一子集，`max_points`、`source_index_max` 和三个
+`*_max_steps` 是有限正整数。`restore_order` 必须唯一，并覆盖 profile 允许临时改变的所有
+transfer fields；每个 operation 的 baseline 只保留实际 changed fields 的有序子集，不能由
+driver 临时决定顺序。
+它必须位于 `InstrumentDescriptor.scope_extensions.trace_profile`；driver 或运行时 metadata
+不得新增 fetchable kind、提高 points/index 上限或改变编号基准。
+R1.3 不把 `math`、`spectrum` 或 `fft_phase` 放入可注册的 fetch profile；它们可以继续出现在
+`ScopeTraceMetadata` 的非读取结果中，但必须为 `fetchable=false`。
+
+`ScopeTraceTransferStateSnapshot.captured_fields` 必须唯一，且每个字段对应的 token 恰好在
+字段存在时非空；`restore_order` 必须与实际 changed field 集合相同且无重复。核心在
+`preflight` 读取 snapshot 并构造带 context/epoch/nonce 的 `ScopeTraceTransferBaseline`，在
+`success_restore` 或 `failure_cleanup` 调用 restore，再在 `cleanup_verification` 调用 verify。
+verify 方法必须返回 fresh snapshot，由核心逐字段生成 `ScopeTraceTransferVerification`；不得
+用 `ScopeTraceTransferRestoreResult` 的写入记录代替 query-back。context、epoch、nonce、phase
+或一次性消费状态不匹配时，必须在 transfer I/O 前拒绝。上述接口同样覆盖 `CHDR`、`CORD`、
+`WFSU` 或其他等价 transfer 状态，不允许只为某一厂商保留私有恢复 helper。
+`attempted_fields` 必须是 baseline `restore_order` 的前缀，`restored_fields` 只能是已尝试字段
+的有序子序列；restore/verify 抛出的异常由核心规范化为 `failed`/`unavailable`，且不得覆盖
+主 fetch 异常。
+
+### 5.2 R1.3 trace acceptance scope
+
+R1.3 首轮公共 trace 只接受 descriptor 明确声明的 `analog`、`digital` 和 `reference`，以及
+已冻结的 `time`/`index` 轴和现有核心可表达的单位。`ScopeTraceProfile.fetchable_kinds` 是
+唯一可注册边界；`spectrum`、`math`、`fft_phase`、频率轴和新增单位即使仍保留在模型字面量中，
+也必须 `fetchable=false`，不得进入 capability registry 或插件迁移。后续 RFC 冻结 kind、
+axis、unit 和序列化后，才能扩展 profile；这项排除不影响本 RFC 对 binary/恢复基础设施的
+内部实现资格。
+
+### 5.3 数组、单位和语义约束
+
+- `points` MUST 等于 `len(values)`；values MUST 是一维、非空数组。
+- axis 的 `points >= 1`。`time`、`frequency` 和 `index` 的 `start`、`increment` 必须
+  finite，`increment > 0`，计算出的最后一个坐标也必须 finite；`unknown` 的 `start` 和
+  `increment` 必须为 `None`。
+- 未来 `frequency` 轴 profile 仅接受 one-sided、严格递增、非负频率；DC 可从 `0 Hz` 开始。
+  负频率、中心化双边 FFT 和降序轴需要后续 axis profile，不能通过负 increment 偷渡；该轴
+  不属于 R1.3 公共 fetch scope。
+- `analog`、`math`、`reference` 和 `spectrum` 的未来实现使用 finite、real、`float64` 值；核心应复制
+  并设置只读，不能把 driver 的可变数组直接暴露给调用方。首版明确拒绝 complex dtype，
+  FFT 的复数结果必须选择 magnitude 或 phase 语义后再进入模型。
+- `digital` 使用无符号整数 bitmask（首版上限 `uint16`），并在 metadata 中说明有效 bit
+  与 `digital_channels` 的映射；`digital_channels` 必须非空、唯一且位于 `0..15`，bit N 对应
+  digital channel N。R1.3 首版的 fetchable digital source 只支持
+  `ScopeTraceRef(kind="digital", index=N)` 的单线语义：`digital_channels == (N,)`，
+  每个样本只能是 `0` 或 `1 << N`。具名 bus/group 和多 bit 同步 bitmask 需要独立
+  source kind/profile，在此之前只能保持 `fetchable=false` 或继续使用旧
+  `ScopeDigitalWaveform`。非 digital trace 的 `digital_channels` 必须为空，不把数字值编码成浮点电压。
+- `time` 轴使用 `s`，`frequency` 轴使用 `Hz`，`index` 轴使用 `1`；未知轴只能使用
+  `unknown`，不能同时声称精确的 start/increment 换算。`kind` 与 unit 不匹配时必须拒绝，
+  不能把 `Hz` 当作任意显示标签。
+- `y_unit` 只冻结首版 token：`v`、`mv`、`db`、`dbm`、`1` 和 `unknown`。其中
+  `dbm/absolute`、`db/relative`、`v|mv/linear` 沿用核心
+  `MagnitudeUnit` / `MagnitudeSemantics` 规则；`1` 仅由新增的 digital-bitmask verifier
+  校验，不能冒充现有 `MagnitudeUnit`。电流 `a`、相位 `degree` 和百分比 `percent` 需要先
+  扩展核心单位模型，不能在 R1.3 中以任意字符串或未经校验的新增 token 进入公共
+  `ScopeTraceData`。无法证明时使用 `unknown/unknown`。
+- `digital_bitmask` 的 y unit 固定为 `1`，semantics 为 `unknown`；`spectrum` 的 dB/dBm
+  结果必须明确 absolute/relative，不能只给一个 dB 字符串。`fft_phase` 在相位单位扩展
+  被核心接受前只能作为设备私有 metadata（或以 `unknown` 单位返回），不得宣称跨仪器可比较。
+- `analog` 和 `digital` 的 `operation` MUST 为 `identity` 且 `inputs` 为空；`reference` 的
+  `identity` 也必须没有 input，`reference_copy` 恰有一个 input；`fft_magnitude` 和
+  `fft_phase` 恰有一个 input。R1.3 不冻结通用
+  `add`、`subtract`、`multiply`、`divide`、`differentiate` 或 `integrate`；这些运算及其
+  输入计数、单位代数移入独立的 trace operation/unit-algebra RFC。
+- `math` 在 operation catalog 和单位语义冻结前只能使用 `device_other` 或 `unknown`；核心
+  不得据此推导可移植的算术语义，且 `device_other`/`unknown` 的 `inputs` 必须为空。
+  `reference` 只有 `identity`（设备原生 reference）或
+  `reference_copy`（明确复制另一 source）两种首版语义。
+- 未来 `spectrum` 的 operation MUST 为 `fft_magnitude` 或 `fft_phase`，且 x 轴 MUST 为
+  `frequency`。`get_trace_metadata()` 可以为尚不可读取的 math/source 返回
+  `device_other`/`unknown`，但必须标记 `fetchable=false`；`fetch_trace()` 只接受
+  `fetchable=true` 且满足对应 kind/operation 不变量的 metadata。`device_other` 和 `unknown`
+  不得进入成功的 `ScopeTraceData`，也不能声称结果可跨仪器比较。
+- `y_increment`、`y_origin` 同时为 `None` 或同时为 finite float；`y_increment` 不得为零。
+  `y_resolution_bits` 为 `None` 或 `1..64` 的非 bool 整数。`digital_bitmask` 的三项 y
+  scaling 字段必须全部为 `None`；real trace 若提供 resolution，必须同时提供 increment/origin。
+- `fetchable=true` 的 R1.3 kind 组合只有：analog/reference + time + `v|mv/linear`，以及
+  digital + time + `1/unknown`。math、spectrum、`fft_phase`、frequency、未知轴、未知单位或
+  `device_other/unknown` operation 只能返回 `fetchable=false` metadata；不能进入成功的
+  `ScopeTraceData`。
+
+### 5.4 迁移和读取前置条件
+
+现有模型的单向迁移建议如下：
+
+| 现有模型 | 候选 trace 映射 | 约束 |
+| --- | --- | --- |
+| `WaveformData` | `analog` | 保留原 `fetch_waveform`；反向适配只允许 analog |
+| `ScopeDigitalWaveform` | `digital` | 单通道可映射为 `index=N`；多通道 bitmask 保留旧模型，不伪装成单线 trace |
+| `ScopeDerivedWaveformMetadata` | `math` 或 `reference` metadata | 不把 `source_kind` 丢失 |
+| `ScopeFftStatus` + 频域数据 | `spectrum` | `ScopeFftStatus` 继续兼容；R1.3 只保留 `fetchable=false` metadata，频率轴单独表达留给后续 RFC |
+
+`fetch_trace()` 是 query/read operation，但若需要临时改变 source、transfer window 或停止
+采集，必须声明相应 `changed_fields` 和恢复覆盖。默认前置条件为：source 已配置、必要时
+acquisition 已停止、sequence/segmentation 状态与 source 合同一致、points 属于 descriptor
+`ScopeTraceProfile.max_points`、
+错误检查策略已解析。前置条件失败必须发生在任何 transfer 写入或 binary query 前。
+对只声明普通非分段记录的 `fetch_trace` 和现有 `fetch_waveform`，sequence ON 必须返回
+`precondition_failed` 或 `unsupported_state`；SDS804X HD 已提供零 waveform 写入、零 binary
+query 的实机拒绝证据，但该规则仍需第二个厂商 fixture。
+
+`ScopeTraceMetadataDriver.get_trace_metadata()` 和 `ScopeTraceDriver.fetch_trace()` 是 R1.3
+正式候选 Protocol 方法，不再是仅供说明的自由函数。声明 `scope.trace_metadata` 时，driver
+MUST 实现 `ScopeTraceMetadataDriver`；声明 `scope.fetch_trace` 时，driver MUST 同时实现
+`ScopeTraceDriver`、`ScopeTraceTransferRecoveryDriver`，并由 descriptor 提供已验证的
+`ScopeTraceProfile`。若 fetch operation 没有 changed transfer fields，`baseline` 固定为
+`None`；只要任一 transfer field 可能改变，核心必须传入本 context 的
+`ScopeTraceTransferBaseline`，driver 不得自行 snapshot 或替换 baseline。
+
+`fetch_trace()` 的成功路径固定为：`preflight snapshot -> main transfer/fetch ->
+error_after? -> success_restore restore -> cleanup_verification verify`。主 fetch、binary 校验或
+after error 失败时，保留主异常并执行 `failure_cleanup restore -> cleanup_verification verify`；
+restore/verify 任一步失败不得覆盖主异常，且 session 不能恢复为 `healthy`。恢复结果和 fresh
+snapshot 必须写入父 operation artifact，不能只记录「transfer 已恢复」布尔值。
+
+`fetch_trace()` 属于 `core_v1` 错误策略执行路径，因此 driver 签名不再携带
+`check_errors`；核心在调用前后负责第六节的错误检查。旧 `fetch_waveform(...,
+check_errors=bool)` 通过 legacy adapter 迁移，不能把两个执行者混入同一 transaction。
+
+## 六、错误检查策略与 artifact
+
+### 6.1 策略模型
+
+现有 `scope.check_errors: bool` 保持兼容。候选配置扩展为：
+
+```python
+ErrorCheckPolicy = Literal["required", "if_supported", "disabled"]
+ErrorCheckTiming = Literal["before", "after", "before_and_after"]
+InstrumentErrorPolicy = Literal["fail", "record_and_continue"]
+
+@dataclass(frozen=True)
+class ErrorCheckSpec:
+    policy: ErrorCheckPolicy
+    timing: ErrorCheckTiming = "before_and_after"
+    max_records: int = 16
+    on_instrument_error: InstrumentErrorPolicy = "fail"
+```
+
+候选 `ErrorCheckSpec` 包含 `policy`、`timing`、`max_records` 和 `on_instrument_error`；上面的
+默认值是 R1.3 acceptance candidate；当前核心配置仍不因本文改变。`max_records` MUST 为非 bool 整数，范围固定为
+`1..256`；`256` 是核心硬上限，仪器、插件和调用方只能收紧。首版只提供完整 drain：
+读到「无错误」终止 token 或达到上限；不提供会绕过检查的 `none`，也不提供无法证明队列
+完整性的 `one`。自动 clear 和 peek 都不进入首版合同。
+下表的 capability 对 R1.3 `core_v1` 路径专指 `scope.error_drain_v1`；只有旧
+`scope.errors` 不构成「明确支持」。
+
+| 策略 | capability 明确支持 | capability 明确不支持 | capability 未知 |
+| --- | --- | --- | --- |
+| `required` | 按 timing 执行；空队列是成功 | 在 I/O 前拒绝 | 在能力发现完成前拒绝 |
+| `if_supported` | 实际执行检查 | 不发送探测命令，记录 `status=skipped` 和 `reason_code=unsupported` | 在 I/O 前拒绝，记录 `status=rejected` 和 `reason_code=unknown_capability` |
+| `disabled` | 不发送错误队列查询 | 不发送 | 不发送 |
+
+`check_errors=true` 映射为 `required`，`false` 映射为 `disabled`。`if_supported` 不能简单
+等价于 `false`：有 capability 时必须查询，查询失败也必须报告真实 failure，而不是
+`unsupported`。普通 transport/protocol/instrument response error 不因 `disabled` 而被吞掉。
+`disabled` 完全忽略 `scope.error_drain_v1` 和旧 `scope.errors` capability，不执行错误检查，
+也不存在 unavailable 拒绝；
+这条规则保留 SDS800X HD 的 `check_errors=false` 行为。
+
+`on_instrument_error` 不是任意调用方可自由组合的容错开关。核心在解析策略后根据
+`OperationSpec.effect` 做静态校验：R1.3 只允许 `observe` 或 `stateful_read` operation 使用
+`record_and_continue`；`write` 和 `acquire` 只能使用 `fail`。recovery transaction 按第 4.3 节固定为
+`disabled`，不执行错误队列 I/O。因此
+错误检查不能把一个已经发生设备错误的写操作伪装成成功。
+
+配置优先级从强到弱为：`OperationSpec` 最低策略、单 operation 显式覆盖、仪器全局策略、
+旧布尔配置映射。策略强度为 `required > if_supported > disabled`；低优先级或调用方参数不能
+削弱 `OperationSpec` 的最低要求。未配置新字段时继续使用旧布尔映射，默认行为不改变。
+
+`if_supported` 的未知能力固定使用 `unknown_capability`，在任何 I/O 前拒绝，不得由插件选择性
+试探。`on_instrument_error="record_and_continue"` 在 R1.3 只允许用于 `observe` 或
+`stateful_read`；`write` 和 `acquire` 必须使用 `fail`，recovery operation 必须使用 `disabled`，
+核心在零 I/O 前拒绝不相容配置。`on_instrument_error` 只处理成功读出的设备错误记录；
+错误队列查询本身的 transport/session/protocol failure 始终中止当前 operation，不得被
+`record_and_continue` 吞掉。
+
+每次 operation 只能有一个错误检查执行者，由 descriptor capability 和 driver 合同在
+factory 阶段固定：
+
+- `legacy_driver`：核心只做 capability gate，把旧 bool 交给 driver；核心不得再 drain 一次，
+  该路径只适用于已有 operation，artifact 必须标记 `executor=legacy_driver` 和
+  `status=legacy_unstructured`，不得伪造 R1.3 `checks`；
+- `core_v1`：descriptor 必须声明 `scope.error_drain_v1`，factory 必须验证下文
+  `ScopeErrorDrainDriver` Protocol。核心按 timing 调用唯一的 `drain_errors()`；新版主 operation
+  driver 签名不带 bool，或兼容
+  adapter 固定传 `check_errors=False`，driver MUST NOT 再查询队列。
+
+只声明旧 `scope.errors` 不能自动适配为 `scope.error_drain_v1`；`list[str]` 无法证明终止 token、
+查询次数或类型化记录。R1.3 新候选 operation 在有效策略不是 `disabled` 时只允许
+`core_v1`；现有 operation 才可在版本门内继续使用 `legacy_driver`。迁移测试必须按 operation
+断言错误队列查询次数，避免 core 和 driver 双重 drain。现有公共
+`scope.errors` 本身是消耗性 `stateful_read`，其 `OperationSpec` 也必须增加
+`changed_fields=("scope.error_queue",)` 和 legacy artifact；其 `OperationRequest.error_check` 必须为
+`None`，不得在读错误队列前后递归套用 `ErrorCheckSpec`。其旧 `list[str]` 成功值保持兼容，
+若未来需要公开类型化 direct-drain 结果，应新增 operation，不得改变旧返回类型。
+旧 driver 即使在内部读到某个厂商终止 token，核心也不得由 `list[str]` 反推通用终止证据或
+真实 query 次数。
+
+现有 `scope.errors` 的候选兼容规格固定为：`effect="stateful_read"`、
+`changed_fields=("scope.error_queue",)`、`verification_fields=()`、
+`OperationRequest.error_check=None`，成功值仍为 `list[str]`。核心只记录
+`legacy_unstructured` operation-specific artifact；`terminated` 与 `query_count` 始终为
+`null`。该规格不继承 `scope.error_drain_v1` 的 phase、`max_records+1` 或 typed result。
+
+直接调用旧 `scope.errors` 时，operation-specific artifact 固定使用：
+
+```json
+{
+  "executor": "legacy_driver",
+  "capability": "scope.errors",
+  "status": "legacy_unstructured",
+  "requested_limit": 16,
+  "returned_record_count": 3,
+  "terminated": null,
+  "query_count": null
+}
+```
+
+`requested_limit` 只记录旧公共参数，`returned_record_count` 只记录返回列表长度；两者都不是
+完整 drain 证明。artifact 不复制旧原始字符串。`terminated` 和 `query_count` MUST 为
+`null`，不得由列表内容或长度猜测。
+
+`scope.error_drain_v1` 是内部受管子事务 capability，不是第九个公共 operation，不加入
+operation registry，不提供独立 Service/CLI 入口。「子事务」只表示其结果归属当前
+operation context，不表示嵌套 session authorization。核心 error-policy executor 必须在上一阶段
+authorization 已关闭后，为同一 context 签发独立的 `error_before` 或 `error_after`
+authorization。该阶段继承 context 的 correlation ID、session epoch、exclusive lease、
+access 结论和剩余 deadline，语义为
+`effect=stateful_read`、`changed_fields=("scope.error_queue",)`、只允许文本 query，
+`max_steps=max_records+1`。它不得超出 context deadline、改变 lease/access、创建 binary
+budget ledger，也不得生成独立 operation artifact；结果只写入当前 operation 的
+`error_check.checks`。签发前若 session 已非 healthy 或剩余 deadline 不足，该阶段不得开始。
+
+### 6.2 错误记录与生命周期
+
+候选 driver 边界和公开错误记录为：
+
+```python
+@dataclass(frozen=True)
+class DriverErrorRecord:
+    code: str | int | None
+    message: str
+    severity: Literal["info", "warning", "error", "fatal", "unknown"]
+    source: str
+
+@dataclass(frozen=True)
+class ErrorDrainResult:
+    records: tuple[DriverErrorRecord, ...]
+    terminated: bool
+    query_count: int
+    overflow_record: DriverErrorRecord | None = None
+
+class ScopeErrorDrainDriver(InstrumentDriver, Protocol):
+    def drain_errors(self, *, max_records: int) -> ErrorDrainResult: ...
+
+@dataclass(frozen=True)
+class ErrorRecord:
+    code: str | int | None
+    message: str
+    message_redacted: bool
+    severity: Literal["info", "warning", "error", "fatal", "unknown"]
+    source: str
+    observed_at_utc: str
+    correlation_id: str | None
+```
+
+`drain_errors()` 是 `scope.error_drain_v1` 唯一允许的 driver 方法，不带 clear/peek 参数。
+core 为它签发的非嵌套 `error_before|error_after` phase authorization 只允许文本
+`query` I/O，不允许 write、binary query 或再开启另一 authorization。
+driver 读到文档化的「无错误」token 时设 `terminated=true`，该 token 不进入 `records`。
+R1.3 首版规定每次 queue query 只解析一条错误记录或一个终止 token，不接受
+一次返回多条记录的无类型文本 batch。`query_count` 是真实仪器查询数，范围为
+`1..max_records+1`；核心 authorization 的
+`max_steps` 也必须固定为 `max_records+1`。最后一个额外 step 只用于证明终止；若它仍返回错误记录，
+driver 必须把该条保存在 `overflow_record`，返回 `terminated=false`，核心以
+`error_queue_incomplete` 失败。该记录不塞入受 `max_records` 限制的 `records`，但必须经过与
+其他记录完全相同的 scrubber 后进入失败 artifact，不得静默丢弃。
+分支不变量为：
+
+- `terminated=true`：`overflow_record is None` 且 `query_count == len(records) + 1`；
+- `terminated=false`：`len(records) == max_records`、`query_count == max_records + 1` 且
+  `overflow_record is not None`。
+
+任何 transport/session/protocol 失败直接抛出结构化异常，不构造
+伪造的 `ErrorDrainResult`。
+核心必须校验 `len(records) <= max_records`，并把 `query_count` 与 guarded transport
+在当前 authorization 中的实际 query 增量对账；不一致是 driver contract violation，不得生成成功
+artifact。
+
+`observed_at_utc` 由核心在成功解析该条记录后生成，必须是带 `Z` 的 RFC 3339 UTC 时间；
+deadline 仍使用不序列化的单调时钟，两者不能混用。公开 `ErrorRecord` 不含 raw 响应。
+`DriverErrorRecord.message` 是受信任进程内输入，不得直接序列化。核心必须删除控制字符，
+并用已知 resource、IP/USB 地址、IDN 序列号、本地路径和凭据模式的统一 scrubber 做脱敏。
+脱敏后的公开 `message` 必须是 `1..512` 个 Unicode code point；只要替换过内容，
+`message_redacted=true`。若 scrubber 不能证明输出安全，固定改为 `instrument reported an error`
+并设 `message_redacted=true`，不得把原文作为 fallback。`source` 是 `1..64` 个 ASCII safe-token
+字符；字符串 code 也必须使用同一 safe-token 约束，整数 code 不接受 bool。
+未经清洗的 raw 只可保存在受控本地诊断中，并通过脱敏 evidence ID 关联；不得进入公开
+artifact、异常消息或 `ErrorRecord`。
+
+R1.3 的完整 drain 合同只适用于 `scope.error_drain_v1`：最多公开 `max_records` 条错误，
+不自动 clear，并区分空队列、队列不可用和查询本身失败。
+读取最多 `max_records` 条错误后，必须再执行第 `max_records+1` 次证明 query。
+该 query 返回「无错误」终止 token 才表示 drain 完整；若仍返回错误记录，必须按上文
+`overflow_record` 分支记录并以 `error_queue_incomplete` 失败，不能少发一次证明 query，
+也不能把截断列表当作完整检查。
+现有 `scope.errors(limit) -> list[str]` 不受本段 `max_records+1` 规则约束，也不得用于
+R1.3 `required/if_supported` 错误策略。
+
+before 阶段发现已有记录时，默认主 operation 不发送并报告
+`preexisting_instrument_error`；这些记录不归属于新的 `correlation_id`。只有在 operation
+effect 为 `observe` 或 `stateful_read`，且显式选择 `record_and_continue` 时，核心才可记录后
+继续该非变更 operation；`write`、`acquire` 和 recovery 仍必须在发送前失败。after 阶段发现
+记录时，满足同一条件的非变更 operation 可继续，
+变更 operation 报告 `instrument_error`，并保留已经发生的
+副作用和 cleanup 状态。错误队列查询发生 transport、session 或 protocol failure 时始终是
+`failed` 并中止，不能降级成 unsupported；设备明确返回的 instrument error 仍按
+`on_instrument_error` 处理。批量通道共享一次 operation correlation，不把同一组设备错误任意
+复制到每个通道。
+
+after 阶段发现不允许继续的 instrument error 时，已成功返回的主 driver 调用必须转为
+operation failure。对 `write` 和 `acquire` operation，执行顺序固定为：after drain 完成并保存
+`instrument_error` 主异常 → 执行 `OperationSpec` 声明的 failure cleanup → 执行
+`cleanup_verification_fields` 验证 → 写入最终 session health 和 artifact。cleanup 或验证失败
+不得覆盖 after 的 `instrument_error`，但必须使 session 保持 `uncertain/poisoned`。
+对 `scope.acquisition_start` 和 `scope.acquisition_single`，这意味着必须按第 1.2/4.3 节尝试
+STOP、恢复 trigger/acquisition baseline 并 query-back；不得因为主 driver 曾返回成功就把
+仪器继续运行状态留作公共 success。若 after drain 本身使 session 不再允许普通 cleanup I/O，
+只能使用已声明的有界 recovery authorization；不得绕过 session gate。
+
+### 6.3 固定 artifact 结构
+
+每个使用 R1.3 错误策略的 operation 至少写入：
+
+```json
+{
+  "executor": "core_v1",
+  "policy": "if_supported",
+  "capability": "scope.error_drain_v1",
+  "supported": false,
+  "status": "skipped",
+  "reason_code": "unsupported",
+  "timing": "before_and_after",
+  "max_records": 16,
+  "on_instrument_error": "fail",
+  "checks": [],
+  "attempted_phases": [],
+  "completed_phases": [],
+  "omitted_phases": [],
+  "last_drain_terminated": null,
+  "main_operation_sent": true,
+  "diagnostic_evidence_id": null
+}
+```
+
+`executor` 固定为 `core_v1` 或 `legacy_driver`。`status` 固定为 `completed`、`skipped`、
+`disabled`、`rejected`、`failed` 或 `legacy_unstructured`。
+`reason_code` 固定为 `empty`、`records`、`unsupported`、`unknown_capability`、
+`preexisting_instrument_error`、`instrument_error`、`error_queue_incomplete`、`query_failed`
+或 `not_applicable`。`rejected` 只用于能力或配置预检在错误队列 I/O 前拒绝；已开始 drain 后
+遇到队列不完整、查询失败或不允许继续的仪器错误时使用 `failed`。
+
+`checks` 不是任意 JSON；每个已执行阶段都必须使用以下固定结构：
+
+```json
+{
+  "phase": "before",
+  "status": "completed",
+  "reason_code": "empty",
+  "query_count": 1,
+  "terminated": true,
+  "records": [],
+  "overflow_record": null
+}
+```
+
+`phase` 固定为 `before` 或 `after`；check 级 `status` 固定为 `completed` 或 `failed`，
+`reason_code` 固定为 `empty`、`records`、`error_queue_incomplete` 或 `query_failed`。
+`query_count` 是包含终止 token 查询在内的实际队列 query 次数，必须是
+`1..max_records+1` 的非 bool 整数；
+`records` 只包含已清洗的 `ErrorRecord`，不包含终止 token，长度不得超过
+`max_records`。check 还必须包含 `overflow_record`，值为脱敏后的 `ErrorRecord` 或 `null`；
+它必须与 `ErrorDrainResult` 的分支不变量一致。`terminated=true` 仅表示该阶段确实
+读到了文档化的「无错误」终止 token。
+未执行的 phase 不生成占位条目。
+
+`attempted_phases` 按时间顺序列出至少发送过一次队列 query 的 phase；`completed_phases`
+只列出以 `terminated=true` 完成的 phase。`last_drain_terminated` 是最后一个已尝试 phase
+的终止结论，没有查询时为 `null`。这三个字段不会把「before 已完整 drain，但主操作
+未发送，因此 after 不适用」错写成 drain 不完整。`main_operation_sent` 只表示主 operation
+是否已发送任一仪器命令，不包含 before check。`diagnostic_evidence_id`
+为 `null` 或脱敏 opaque safe-token，只关联受控本地证据，不得嵌入原始响应、资源字符串或
+本地路径。
+
+`omitted_phases` 每项固定为
+`{"phase":"after","reason_code":"main_operation_failed|session_unhealthy|cancelled"}`。主 operation 在
+after 之前失败、取消，或把 session 变为 `uncertain/poisoned` 时，核心 MUST NOT 为补齐
+timing 继续查询错误队列；必须把 after 写入 `omitted_phases`。若主操作失败但 session
+仍 `healthy`，after 也默认 omitted，避免用消耗性查询干扰主异常恢复；未来若需「失败后检查」，
+应单独设计策略。error-check 顶层只聚合实际执行的 phase，主失败、取消和 session health
+仍由 operation artifact 作为主结果，不被 error-check status 覆盖。
+
+顶层聚合规则固定为：
+
+| 情形 | 顶层 `status / reason_code` | `main_operation_sent` |
+| --- | --- | --- |
+| `disabled` | `disabled / not_applicable` | 按主 operation 实际情况 |
+| `if_supported` 且明确 unsupported | `skipped / unsupported` | 主 operation 可继续 |
+| `required` 且 unsupported，或能力未知 | `rejected / unsupported` 或 `rejected / unknown_capability` | `false` |
+| 任一 phase 队列查询失败或未终止 | `failed / query_failed` 或 `failed / error_queue_incomplete` | 按失败发生前实际情况 |
+| before 有记录且策略/操作不允许继续 | `failed / preexisting_instrument_error` | `false`；after 不适用 |
+| after 有记录且策略/操作不允许继续 | `failed / instrument_error` | `true` |
+| before 或 after 有记录，且非变更操作允许继续 | `completed / records` | 按实际情况 |
+| 所有实际 phase 均空 | `completed / empty` | 按实际情况 |
+| 旧 driver 自行查错 | `legacy_unstructured / not_applicable` | 按主 operation 实际情况 |
+
+聚合优先级为：查询失败/队列不完整 > 不允许继续的 instrument error > 已记录并继续 >
+空队列。因此「before 有记录并继续，after 为空」固定聚合为 `completed / records`；
+「after 有记录但 observe 允许继续」也是 `completed / records`。不能用模糊的 `failed`
+吞掉具体原因。
+
+`legacy_driver` 使用同一顶层 key 集，但 `capability="scope.errors"`、`checks=[]`、
+phase 数组全空，且不得填写伪造的 query count/termination。当旧 bool 为 `false` 时仍使用
+`disabled / not_applicable`，而不是 `legacy_unstructured`。直接调用 `scope.errors` 时
+`error_check=null`，另写 operation-specific `error_drain` artifact，不递归产生 before/after checks。
+
+当前 SDS800X HD 没有文档化错误队列，插件继续要求显式 `check_errors=false`，
+不声明 `scope.errors` 或 `scope.error_drain_v1`。
+
+artifact 中的 `supported` 使用 `true` 或 `false` 表示能力已评估；使用 `null` 表示能力未评估或未知。
+`disabled` 路径即使未评估也必须使用 `status=disabled` 和 `reason_code=not_applicable`，不得因为未知而拒绝。
+只有 `required/if_supported` 因能力未知而在 I/O 前拒绝时，`supported=null` 才与
+`status=rejected` 和 `reason_code=unknown_capability` 一起出现。公开 artifact 使用结构化 code、经过 scrubber 和长度限制的 message、
+`message_redacted`、UTC 时间和
+correlation，不复制可能包含资源或设备私有内容的原文。
+
+## 七、能力发现、版本门与旧接口
+
+### 7.1 descriptor 与 capability-method contract
+
+R1.3 acceptance addendum 为 descriptor 增加一个可选、可序列化的 scope 扩展字段；字段名和
+必需关系冻结如下：
+
+```python
+@dataclass(frozen=True)
+class ScopeDescriptorExtensions:
+    screenshot_profile: ScopeScreenshotProfile | None = None
+    acquisition_control_profile: ScopeAcquisitionControlProfile | None = None
+    trace_profile: ScopeTraceProfile | None = None
+
+@dataclass(frozen=True)
+class InstrumentDescriptor:
+    # 保留现有字段；新增字段不改变旧 descriptor 的默认语义。
+    scope_extensions: ScopeDescriptorExtensions | None = None
+```
+
+核心 factory 在 capability discovery 阶段把 descriptor 的 `scope_extensions` 与 driver
+Protocol 一起校验；缺失所需字段或方法时，在第一次仪器 I/O 前返回
+`unsupported_capability`，不能只因 Python 方法恰好存在就注册 capability。R1.3 的中央
+`CAPABILITY_METHODS` 等价映射固定为：
+
+| capability | descriptor 前置事实 | required Protocol | required method(s) | 可注册 operation |
+| --- | --- | --- | --- | --- |
+| `scope.screenshot_profile` | `scope_extensions.screenshot_profile` 非空 | `ScopeScreenshotProfileDriver` | `get_screenshot_profile()` | `scope.screenshot_profile` |
+| `scope.screenshot_v2` | screenshot profile 非空且已验证 | `ScopeScreenshotDriver` + `ScopeScreenshotProfileDriver` | `capture_screenshot()`、state snapshot/restore/verify | `scope.screenshot_v2` |
+| `scope.acquisition_run_state` | 无额外 profile | `ScopeAcquisitionRunStateDriver` | `get_acquisition_run_state()` | `scope.acquisition_run_state` |
+| `scope.acquisition_control` | `scope_extensions.acquisition_control_profile` 非空 | `ScopeAcquisitionControlDriver` | `start_continuous()`、`stop_acquisition()`、`acquire_single()`、recovery 三方法 | `scope.acquisition_start/single/stop` |
+| `scope.trace_metadata` | `scope_extensions.trace_profile` 非空 | `ScopeTraceMetadataDriver` | `get_trace_metadata()` | `scope.trace_metadata` |
+| `scope.fetch_trace` | trace profile 非空且含请求 kind | `ScopeTraceDriver` | `fetch_trace()`、transfer snapshot/restore/verify、`get_trace_metadata()` | `scope.fetch_trace` |
+| `scope.error_drain_v1` | capability 明确声明且策略允许 | `ScopeErrorDrainDriver` | `drain_errors(max_records=...)` | 只作为受管 error phase，不新增公共 operation |
+
+核心 registry 的方法映射可直接编码为：
+
+```python
+SCOPE_CAPABILITY_METHODS = {
+    "scope.screenshot_profile": ("get_screenshot_profile",),
+    "scope.screenshot_v2": (
+        "get_screenshot_profile",
+        "capture_screenshot",
+        "snapshot_screenshot_state",
+        "restore_screenshot_state",
+        "verify_screenshot_state_restored",
+    ),
+    "scope.acquisition_run_state": ("get_acquisition_run_state",),
+    "scope.acquisition_control": (
+        "get_acquisition_run_state",
+        "start_continuous",
+        "stop_acquisition",
+        "acquire_single",
+        "snapshot_acquisition_control",
+        "restore_acquisition_control",
+        "verify_acquisition_control_restored",
+    ),
+    "scope.trace_metadata": ("get_trace_metadata",),
+    "scope.fetch_trace": (
+        "get_trace_metadata",
+        "fetch_trace",
+        "snapshot_trace_transfer_state",
+        "restore_trace_transfer_state",
+        "verify_trace_transfer_state_restored",
+    ),
+    "scope.error_drain_v1": ("drain_errors",),
+}
+```
+
+对应的 profile provider Protocol 为：
+
+```python
+class ScopeScreenshotProfileDriver(InstrumentDriver, Protocol):
+    def get_screenshot_profile(self) -> ScopeScreenshotProfile: ...
+```
+
+`scope.screenshot_profile`、`scope.trace_metadata` 和 `scope.fetch_trace` 不再只有文字建议
+方法；上表中的 Protocol 是 capability 注册的必要接口。`ScopeAcquisitionControlProfile`、
+`ScopeScreenshotProfile` 和 `ScopeTraceProfile` 的安全上限以 descriptor 为准，driver 的
+运行时返回值只能 query-back 验证，不能扩大或替换 descriptor 事实。任何 capability 的
+required Protocol、profile 或方法不满足时，factory MUST 在零 I/O 阶段 fail-closed；未声明
+capability 的额外方法不产生隐式能力。
+
+候选 capability（尚未注册）：
+
+```text
+scope.screenshot_profile
+scope.screenshot_v2
+scope.acquisition_run_state
+scope.acquisition_control
+scope.trace_metadata
+scope.fetch_trace
+scope.error_drain_v1
+```
+
+兼容要求：
+
+1. 现有 capability、方法和模型不删除、不改名；
+2. 新核心 + 旧插件保持现状；
+3. 使用新 transport 或新 capability 的插件提高 wheel 和 descriptor 的核心下限；
+4. 旧核心 + 新插件在 factory 和第一次仪器 I/O 前明确拒绝；
+5. 新增可选 capability 不自动要求升级 `wavebench.instrument.v2`；
+6. 在 `ScopeDescriptorExtensions`、`CAPABILITY_METHODS`、operation registry、Service、CLI 和
+   artifact schema 未同时冻结前，插件不得声明新能力。
+
+## 八、conformance 测试矩阵与证据要求
+
+| 层级 | 必测内容 | 当前状态 |
+| --- | --- | --- |
+| OperationSpec/Service | capability、access、lease、action-specific changed/restore/postcondition/cleanup、transfer 字段闭包、artifact | 核心尚无候选 operation，待实现 |
+| capability/descriptor gate | `ScopeDescriptorExtensions`、`CAPABILITY_METHODS`、required Protocol、缺 profile/method 零 I/O 拒绝 | 核心尚无候选字段，待内部实现 |
+| binary model | `#N` 精确语法、`#0` 拒绝、response/operation/query/resync budget、成功 metadata、尾部和 continuation | 需要新增 fake vectors |
+| backend | PyVISA/RsInstrument/TCP/serial 的 message 能力证明、终止设置恢复 | 只有 SDS raw PNG 一次实机观察 |
+| guarded transport | access、计数、healthy/uncertain/poisoned、固定常量、超限后失步、close/poison 默认 | 需要失败恢复测试 |
+| plugin trust boundary | 公共 Protocol 不暴露 session；禁止插件依赖 `.inner` 的代码审计 | 当前不是沙箱；opaque facade 不在 R1.3 范围 |
+| screenshot | request tuple、PNG signature/IEND、媒体类型、尺寸、transport/content 尾部分层、父 capture fail-parent | 仅 SDS raw PNG 探测 |
+| acquisition | allowed phase、完成式 SINGLE、baseline/observed states、identity semantics、终态 proof、成功 postcondition、失败 recovery | SDS vendor capture 已验收，公共控制未实现 |
+| transfer/trace | typed transfer snapshot/restore/verify、context nonce、analog/digital/reference profile、字段逐项闭合 | RTM2000 有部分证据，需第二族 fixture |
+| errors | disabled 零 I/O、未知 fail-closed、`scope.error_drain_v1`、完整 drain、唯一执行者、聚合 reason | 当前仅布尔兼容路径 |
+| compatibility | 新旧核心/插件四组合、factory 拒绝、CLI/artifact | 待核心合同冻结 |
+| opt-in hardware | 至少两种 framing、两个厂商状态机、两种 trace axis | 当前证据不足 |
+
+### 8.1 必备 fixture 与失败向量
+
+在 RFC 进入 `Proposed` 前，至少需要带有 backend、resource class、固件版本和证据文件
+链接的 fixture：
+
+- definite block：合法 `#N`、`#0`、非法长度位、截断、response/operation/query budget 超限、
+  resync ceiling、精确 consumed 等式、`BinaryQueryResult` 和 transport trailing；
+- message：分片读取、EOM、超限后有界 drain/poison、termination 恢复失败和下一次 query；
+- acquisition：descriptor profile 缺失/非法、continuous mode 支持集、configure-then-arm 与
+  atomic-arm 两条 baseline 路径、count reset、counter epoch 缺失或变化与异常回绕拒绝、每个 action 的 allowed/rejected phase、
+  调用前已 stopped、count 不变、跳过 acquiring 的最小状态序列、外部前面板改状态、
+  after instrument error cleanup 和 timeout 后 recovery STOP 失败；
+- transfer restore：typed `ScopeTraceTransferBaseline`、`CHDR`/`CORD`/`WFSU` 或等价状态的
+  逐字段 changed/verification、context/nonce 重放拒绝、恢复失败和 healthy/poisoned 判定；
+- screenshot：baseline/query-back/成功与失败恢复、transport/content trailing 负向向量、
+  nonce 重放、旧 capture 父字段闭包和 fail-parent 语义；
+- trace：capability/descriptor gate、kind-specific index、R1.3 analog/digital/reference fetch、
+  spectrum/math 排除、负频/降序拒绝、scaling、非 finite 数值、只读数组和 points 不一致；
+- errors：三种 policy、disabled + unsupported、能力未知、`scope.error_drain_v1` factory gate、
+  `max_records+1` 终止证据、查询失败、driver/core 双读负向测试、聚合 reason 和脱敏；
+- compatibility：旧核心 + 新插件与新核心 + 旧插件的能力发现和第一次 I/O 行为。
+
+图片、原始波形、真实 resource、序列号和完整命令日志不进入仓库；只保留 framing、长度、
+状态迁移、固件版本和数值摘要。
+
+## 九、里程碑
+
+| 里程碑 | 范围 | 退出条件 |
+| --- | --- | --- |
+| M1 | Operation context、phase authorization、OperationSpec/artifact 内部骨架 | context/phase/ledger/legacy artifact 与 transfer recovery model 的 feature-gated 测试通过；不得进入 public registry |
+| M2 | binary framing 与 backend capability | definite/message fake、四维 budget、有界 resync、失步、termination 恢复测试通过 |
+| M3 | screenshot profile/v2 | definite block 和 raw message 两种 fixture 通过 |
+| M4 | acquisition run state/control | descriptor profile validator、两个厂商状态机、continuous mode、两类 SINGLE baseline、幂等 STOP、after-error cleanup 和 timeout recovery 通过 |
+| M5 | trace source/axis | analog、digital、math、reference、spectrum 的跨厂商 fixture 通过 |
+| M6 | error policy、版本门和迁移 | A1 P0/P1 gate、`scope.error_drain_v1`、三态 artifact、聚合规则、四组合兼容和 CLI/Service 入口冻结后，才可讨论 public registry |
+| M7 | opt-in 实机 | 核心离线回归通过，实机范围另行授权 |
+
+各里程碑应分别提交；不得把 transport、scope model、Service 和插件迁移压成一个不可回滚
+改动。
+
+## 十、已否决方案
+
+- 插件直接访问 `transport.session` 或 backend；当前只能以「公共合同不提供」约束，不能声称
+  Python 运行时沙箱隔离；
+- 给 `query_bin_block()` 增加含义模糊的 `raw=True`；
+- 使用换行、idle timeout 或 `rstrip()` 推断 PNG 成功结束；
+- 在 transport 内置 PNG parser；
+- 忽略 screenshot 的 menu 参数；
+- 把 trigger status 填入现有 `ScopeAcquisitionStatus`；
+- 用 `*OPC?` 统一判断物理触发完成；
+- 把 math/reference/FFT 编成负数或大号 channel；
+- 扩宽 `WaveformData.channel` 为任意字符串；
+- 为没有错误队列的仪器返回空列表；
+- 超过 `max_bytes` 后在 healthy session 中留下未消费响应。
+
+## 十一、R1.3 暂定安全结论与待决问题
+
+以下是 Draft 阶段暂定的安全不变量，不代表 schema、常量或核心实现已经接受：
+
+1. 采集 start、完成式 single、stop 是三个 action-specific operation；共享 capability 不改变
+   各自 effect、postcondition、失败 cleanup 或最低 access。descriptor 的
+   `ScopeAcquisitionControlProfile` 是 continuous mode、SINGLE arm 语义和 count 比较的唯一
+   静态事实源；arm-only 需要独立 operation。
+2. binary response、operation-total、query-count 和 resynchronization 分别使用有限上限；核心通过单个
+   operation context 下的非嵌套阶段 authorization 引用同一 `BinaryQueryBudget` ledger，
+   插件不能构造、提升、重置或跨 context 复用。
+3. `query_binary()` 成功返回 `BinaryQueryResult`，显式携带 framing、长度、
+   `transport_trailing_bytes` 和精确 consumed 等式，以及
+   `synchronization=proven`；失败使用现有结构化 `TransportIOError`。
+4. `disabled` 错误策略始终零错误队列 I/O；`if_supported` 只跳过明确 unsupported，未知能力
+   fail-closed。`core_v1` 以 `scope.error_drain_v1` 和终止证据为门；旧 `scope.errors`
+   只保持 `legacy_unstructured` 语义，不得被升级为类型化 drain。一个 operation 只能由
+   core 或 legacy driver 其中一方执行错误检查。
+5. R1.3 的可读取 trace 不包含通用算术，只支持已列出的 kind/axis/unit/operation 组合；
+   one-sided FFT、编号基准和 scaling 不变量不能留给插件自行解释。
+6. `CHDR`/`CORD`/`WFSU` 或等价的 transfer 状态必须在核心规范化为逐项
+   `changed_fields` + `verification_fields`；该要求覆盖 `scope.capture_multiple` 等现有别名。
+7. 旧 capture 调用 screenshot 只允许父 operation 字段闭包；R1.3 不注册 composite operation。
+   没有完整字段闭包时必须在 I/O 前拒绝，截图失败或恢复失败必须使父 capture 失败，不能
+   通过嵌套 authorization 或部分错误记录继续返回成功。
+8. 所有可恢复的 stateful write 都必须通过 core-owned snapshot、有界 restore 和独立 verify
+   阶段闭合；主 driver 抛异常或 after error 不能让 baseline 丢失。
+9. 每个 operation 只能在同一 operation context 中顺序使用非嵌套 phase authorization；
+   error drain phase 不得创建或重置 binary budget ledger。
+10. 首版不使用 modulus 单独证明 SINGLE 完成；count 只能在未变化的 `counter_epoch` 和
+   有效 `state_transition` 联合时作为辅助证据，任何回绕、复位或非严格递增都必须转用
+   `identity_delta`/`state_transition`。旧 `scope.errors` 不提供 R1.3 终止证明。
+
+剩余待决问题：
+
+1. `OperationSpec` 的完整输入/输出序列化、取消、幂等性和并发字段仍未公开冻结；在这些字段
+   冻结前，核心只能实现第 12 节列出的内部 / feature-gated 骨架。
+2. 各 backend 是否能在固定 resynchronization 上限内安全 drain 仍需 fixture；超出上限时
+   close + `poisoned` 已是 R1.3 的统一默认，不再由 backend 自选。
+3. 哪些 PyVISA resource class 和 RsInstrument API 能稳定证明 message END。
+4. `READ_CONTINUATION_ONLY` 的 core-issued continuation token 和返回模型如何授权。
+5. 旧 screenshot adapter 的具体拒绝码和更多 profile variant 仍待 fixture；profile 来源已固定为
+   descriptor 或 descriptor/query 的 `combined` 交集。
+6. poisoned session 的 recovery/reopen API 仍属 transport 生命周期设计；在该 API 冻结前，
+   新 capability 不得从 poisoned session 继续 I/O。
+7. 暂定的 completion state-transition 序列及 counter-epoch 联合条件能否通过第二个厂商
+   fixture，是否需要进一步收紧；更丰富的计数器世代语义仍待单独 RFC。
+8. `spectrum` 是否作为独立 `ScopeTraceKind`，以及单位校验复用哪些现有核心模型；该项已
+   明确排除在 R1.3 公共 fetch scope 外，移入后续 trace-extensions RFC。
+9. binary operation/profile 的连接项如何映射到不同 backend 仍需核心实现细节；R1.3 的
+   operation 常量、profile 收紧规则和超限 close/poison 默认已冻结。
+10. error queue 的未来 peek/clear operation 仍待独立设计；R1.3 timing 默认固定为
+    `before_and_after`，未知能力不得增加 skip 分支。
+
+上述问题解决、取得跨厂商 fixture，并完成 Service/CLI/artifact 评审前，RFC 必须保持 `Draft`。
+主仓库未接受本文时，插件不得声明这些新 capability 已由核心提供。
+
+## 十二、R1.3 acceptance addendum（A1）
+
+本 addendum 是 R1.3 的验收门，不是第二套并行规范。它把核心本轮复审的实施边界冻结为
+「可开始内部基础设施、尚不可注册公共 capability」。若本节与正文存在歧义，以本节的
+acceptance gate 为准；正文仍是跨仪器模型的唯一事实源。
+
+### 12.1 允许先行的内部工作
+
+核心现在可以在内部或 feature-gated 分支实现以下内容：
+
+| 内部组件 | 必须具备的约束 | 明确禁止 |
+| --- | --- | --- |
+| operation context | 一次 operation 一个 context；绑定 correlation、epoch、deadline 和 ledger | 为重试或错误检查创建第二个 context |
+| phase coordinator | `normal`、`recovery`、`verification` 顺序授权；active authorization 最多一个 | 从 driver 或 active authorization 内嵌套签发 |
+| binary ledger | response/total/query/resync 四项固定上限，跨 phase 不重置 | 用 error phase 或重建 driver 增加额度 |
+| typed state models | acquisition、screenshot、transfer 的 snapshot/baseline/restore/verify 模型 | 暴露 session token、用布尔值替代 fresh snapshot |
+| legacy artifact | 旧 `scope.errors` 的 `legacy_unstructured` 记录 | 将旧 `list[str]` 升级为 typed drain 证明 |
+| fake/conformance fixture | 覆盖失败恢复、nonce 重放、phase 越界、binary 超限和 capability gate | 在实机或插件 descriptor 上开启新 capability |
+
+内部实现必须由核心私有 feature gate 保护；不得写入公共 `CAPABILITY_METHODS` 的可发现注册
+表，不得修改旧插件的 descriptor 行为，不得提高插件核心版本下限。
+
+### 12.2 P0 公共接口验收门
+
+在任何新 capability 注册或插件迁移前，核心必须逐项验收：
+
+1. **transfer recovery**：`ScopeTraceTransferRecoveryDriver`、
+   `ScopeTraceTransferStateSnapshot`、`ScopeTraceTransferBaseline`、restore result 和
+   fresh-snapshot verification 已实现；descriptor `ScopeTraceProfile.restore_order` 和 step
+   上限已验证；`fetch_trace` 在 changed transfer fields 非空时必须传入同一 context 的
+   baseline，并按 `CHDR`/`CORD`/`WFSU` 等逐字段恢复和核对。
+2. **capability/descriptor**：`ScopeDescriptorExtensions` 字段、中央
+   `CAPABILITY_METHODS` 映射和各 required Protocol 已实现；缺失 profile/method 时在零 I/O
+   阶段拒绝，额外方法不产生隐式 capability。
+3. **numeric and deadline constants**：截图 `262144/262144/1/0`、trace
+   `8388608/67108864/256/65536`、operation timeout `5000/30000/60000 ms` 已作为核心常量
+   实现；profile/connection 只能收紧，超出同步界限统一 close + `poisoned`。
+4. **error timing**：默认 `before_and_after`、recovery 固定 `disabled`、每次 I/O 受绝对
+   monotonic deadline 限制，并有对应 artifact 和负向测试。
+
+### 12.3 P1 语义验收门
+
+- **嵌入 screenshot**：R1.3 只采用父 capture operation 字段闭包，不注册 composite operation。
+  没有完整 changed/verification/cleanup 字段时在 I/O 前拒绝；截图或恢复失败使父 capture
+  失败，不能只记部分错误。
+- **baseline handle**：screenshot、acquisition、transfer baseline 必须包含
+  `context_id`、`session_epoch`、core-generated opaque `baseline_nonce` 和 restore order；
+  nonce 按 `fresh -> passed_to_main -> restore_attempted -> consumed` 一次性消费，重放在 I/O
+  前拒绝，artifact 只留摘要。
+- **identity proof**：`ScopeAcquisitionControlProfile.identity_semantics` 必须为
+  `unique_within_session_epoch` 才能使用 `identity_delta`；否则只能使用完整 state transition。
+- **phase API bridge**：核心通过 `ScopeOperationContextCoordinator.authorize_phase()` 包裹
+  当前 normal gate 与 `SessionTransactionCoordinator.authorize()`，并用 sidecar/扩展记录绑定
+  context、phase、fields、allowed I/O、deadline 和 max steps；driver 不接收 session token。
+- **trace exclusion**：R1.3 公共 fetch 仅包含 analog/digital/reference；spectrum、math、
+  fft_phase、frequency axis 和新增单位移入后续 RFC，不得以未决模型开始插件迁移。
+
+### 12.4 Addendum 退出条件
+
+A1 只有在以下证据全部具备后，才能提交 `Proposed` 或允许 capability registry/插件迁移：
+
+1. 核心内部 fixture 覆盖上述 P0/P1 gate，且新旧四组合在 factory 和第一次 I/O 前行为明确；
+2. 至少两个独立仪器族或 backend fixture 证明 transfer restore、截图恢复、acquisition proof
+   和 binary framing/limit 语义；
+3. Service、CLI、descriptor、`CAPABILITY_METHODS`、artifact schema 和版本门由核心团队逐项
+   评审并冻结；
+4. R1.3 Draft 的待决问题中仍保留的 trace-extensions、continuation 和 reopen 设计不再被
+   当前 capability 合同隐式引用。
+
+在退出条件满足前，R1.3 仍是 `Draft`；本插件仓库只维护 RFC 与 fixture 设计，不声明任何
+新增 capability 已由核心提供。
diff --git a/doc/evidence/README.md b/doc/evidence/README.md
new file mode 100644
index 0000000..70be5aa
--- /dev/null
+++ b/doc/evidence/README.md
@@ -0,0 +1,83 @@
+# 插件验收与历史证据
+
+[English](README_EN.md)
+
+本页统一导航插件仓库中的手册审计、开发里程碑、conformance、RFC 和实机验收记录。它不是
+当前型号支持状态或 capability 的事实源，也不表示记录中的能力已经发布。
+
+查询当前插件元数据和 capability 时，应使用 [生成式插件目录](../reference/plugin-catalog.md)
+以及对应包的 production descriptor。查询 WaveBench 公共合同和 CLI 行为时，应使用
+[WaveBench Core 文档](https://github.com/Scaxlibur/wavebench/tree/master/docs)。
+
+## 跨插件合同
+
+- [插件侧 RFC 索引](../rfcs/README.md)：区分仍在收集证据的提案、Core 当前合同和插件侧历史记录。
+- [Scope R1.3 评审正文](../archive/rfcs/WaveBench_scope通用扩展接口RFC.md)：Core 接受前的插件侧评审存档。
+- [Scope R1.3 A1 验收门](../archive/rfcs/WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md)：公共注册前的插件侧验收门存档。
+
+## RIGOL
+
+### DG4000
+
+- [编程手册功能覆盖矩阵](../../packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MATRIX.md)
+- [功能覆盖里程碑](../../packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MILESTONES.md)
+
+### DM3000
+
+- [编程手册功能覆盖矩阵](../../packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MATRIX.md)
+- [功能覆盖里程碑](../../packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MILESTONES.md)
+
+### DP800
+
+- [编程手册功能覆盖矩阵](../../packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MATRIX.md)
+- [指令覆盖开发里程碑](../../packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MILESTONES.md)
+
+### DS1000Z
+
+- [受控实机验收记录](../../packages/wavebench-rigol-ds1000z/doc/DS1000Z_HARDWARE_ACCEPTANCE.md)
+
+### DSG830
+
+- [当前 Reference 与历史记录索引](../../packages/wavebench-rigol-dsg830/doc/README.md)
+
+### MSO8000
+
+- [编程手册功能覆盖矩阵](../../packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MATRIX.md)
+- [功能覆盖里程碑](../../packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MILESTONES.md)
+- [受控实机验收记录](../../packages/wavebench-rigol-mso8000/doc/MSO8104_HARDWARE_ACCEPTANCE.md)
+- [型号相关 RFC 索引](../../packages/wavebench-rigol-mso8000/doc/rfcs/README.md)
+
+## Rohde & Schwarz
+
+### RTM2000
+
+- [手册功能覆盖矩阵](../../packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX.md)
+- [功能覆盖开发路线](../../packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MILESTONES.md)
+- [0.1.0–0.15.0 开发与验收存档](../../packages/wavebench-rohde-schwarz-rtm2000/doc/archive/RTM2000_README_0.15.md)
+
+## SHENGPU
+
+### SP3000A
+
+- [协议审计、认证与验收索引](../../packages/wavebench-shengpu-sp3000a/doc/README.md)
+
+## SIGLENT
+
+### SDG2000X
+
+- [当前 Reference、验收记录与 RFC 索引](../../packages/wavebench-siglent-sdg2000x/doc/README.md)
+
+### SDS3000
+
+- [编程手册基线](../../packages/wavebench-siglent-sds3000/doc/MANUAL_BASELINE.md)
+- [手册指令覆盖基线](../../packages/wavebench-siglent-sds3000/doc/COMMAND_COVERAGE.md)
+- [WaveBench capability 覆盖矩阵](../../packages/wavebench-siglent-sds3000/doc/WAVEBENCH_CAPABILITY_MATRIX.md)
+- [实机验收记录](../../packages/wavebench-siglent-sds3000/doc/HARDWARE_ACCEPTANCE.md)
+- [Core RFC 影响评估](../../packages/wavebench-siglent-sds3000/doc/WAVEBENCH_CORE_RFC.md)
+
+### SDS800X HD
+
+- [编程手册功能覆盖矩阵](../../packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MATRIX.md)
+- [功能覆盖开发路线](../../packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MILESTONES.md)
+- [实机验收记录](../../packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_HARDWARE_ACCEPTANCE.md)
+- [Scope R1.3 conformance 证据](../../packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_R13_CONFORMANCE.md)
diff --git a/doc/evidence/README_EN.md b/doc/evidence/README_EN.md
new file mode 100644
index 0000000..d8ca821
--- /dev/null
+++ b/doc/evidence/README_EN.md
@@ -0,0 +1,84 @@
+# Plugin Acceptance and Historical Evidence
+
+[中文](README.md)
+
+This page provides one navigation surface for manual audits, development milestones, conformance records,
+RFCs, and hardware acceptance evidence in the plugin repository. It is not the source of truth for current
+model support or capabilities, and a listed record does not imply that its subject has been released.
+
+For current plugin metadata and capabilities, use the [generated plugin catalog](../reference/plugin-catalog-en.md)
+and the package's production descriptor. For WaveBench public contracts and CLI behavior, use the
+[WaveBench Core documentation](https://github.com/Scaxlibur/wavebench/tree/master/docs).
+
+## Cross-plugin contracts
+
+- [Plugin-side RFC index](../rfcs/README.md) (Chinese): separates proposals still gathering evidence, current Core contracts, and plugin-side history.
+- [Scope R1.3 review text](../archive/rfcs/WaveBench_scope通用扩展接口RFC.md) (Chinese): plugin-side review archive from before Core acceptance.
+- [Scope R1.3 A1 acceptance gate](../archive/rfcs/WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md) (Chinese): pre-registration plugin-side acceptance archive.
+
+## RIGOL
+
+### DG4000
+
+- [Programming-manual coverage matrix](../../packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MATRIX_EN.md)
+- [Coverage milestones](../../packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MILESTONES_EN.md)
+
+### DM3000
+
+- [Programming-manual coverage matrix](../../packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MATRIX_EN.md)
+- [Feature-coverage milestones](../../packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MILESTONES_EN.md)
+
+### DP800
+
+- [Programming-manual coverage matrix](../../packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MATRIX_EN.md)
+- [Command-coverage development milestones](../../packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MILESTONES_EN.md)
+
+### DS1000Z
+
+- [Controlled hardware acceptance](../../packages/wavebench-rigol-ds1000z/doc/DS1000Z_HARDWARE_ACCEPTANCE_EN.md)
+
+### DSG830
+
+- [Current Reference and historical-record index](../../packages/wavebench-rigol-dsg830/doc/README_EN.md)
+
+### MSO8000
+
+- [Programming-guide coverage matrix](../../packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MATRIX_EN.md)
+- [Coverage milestones](../../packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MILESTONES_EN.md)
+- [Controlled hardware acceptance](../../packages/wavebench-rigol-mso8000/doc/MSO8104_HARDWARE_ACCEPTANCE_EN.md)
+- [Model-specific RFC index](../../packages/wavebench-rigol-mso8000/doc/rfcs/README.md) (Chinese)
+
+## Rohde & Schwarz
+
+### RTM2000
+
+- [Manual feature-coverage matrix](../../packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX_EN.md)
+- [Feature-coverage development roadmap](../../packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MILESTONES_EN.md)
+- [0.1.0–0.15.0 development and acceptance archive](../../packages/wavebench-rohde-schwarz-rtm2000/doc/archive/RTM2000_README_0.15_EN.md)
+
+## SHENGPU
+
+### SP3000A
+
+- [Protocol audit, certification, and acceptance index](../../packages/wavebench-shengpu-sp3000a/doc/README_EN.md)
+
+## SIGLENT
+
+### SDG2000X
+
+- [Current Reference, acceptance records, and RFC index](../../packages/wavebench-siglent-sdg2000x/doc/README_EN.md)
+
+### SDS3000
+
+- [Programming-manual baseline](../../packages/wavebench-siglent-sds3000/doc/MANUAL_BASELINE_EN.md)
+- [Manual command-coverage baseline](../../packages/wavebench-siglent-sds3000/doc/COMMAND_COVERAGE_EN.md)
+- [WaveBench capability matrix](../../packages/wavebench-siglent-sds3000/doc/WAVEBENCH_CAPABILITY_MATRIX_EN.md)
+- [Hardware acceptance](../../packages/wavebench-siglent-sds3000/doc/HARDWARE_ACCEPTANCE_EN.md)
+- [Core RFC impact assessment](../../packages/wavebench-siglent-sds3000/doc/WAVEBENCH_CORE_RFC_EN.md)
+
+### SDS800X HD
+
+- [Programming-guide coverage matrix](../../packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MATRIX_EN.md)
+- [Feature-coverage development roadmap](../../packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MILESTONES_EN.md)
+- [Hardware acceptance](../../packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_HARDWARE_ACCEPTANCE_EN.md)
+- [Scope R1.3 conformance evidence](../../packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_R13_CONFORMANCE.md) (Chinese only)
diff --git a/doc/reference/plugin-catalog-en.md b/doc/reference/plugin-catalog-en.md
new file mode 100644
index 0000000..f298d13
--- /dev/null
+++ b/doc/reference/plugin-catalog-en.md
@@ -0,0 +1,291 @@
+# WaveBench plugin catalog
+
+[中文](plugin-catalog.md)
+
+This Reference is generated from each package's `pyproject.toml` and production descriptor.
+Regenerate it with `python scripts/generate_plugin_catalog.py`; verify drift with
+`python scripts/generate_plugin_catalog.py --check`.
+
+> A metadata version identifies the package source contract in this repository; it is not a
+> PyPI, Git tag, or GitHub Release claim. Declared capabilities are top-level descriptor
+> entries. Model, firmware, option, and profile restrictions remain in the package Reference
+> and the runtime capability query.
+
+## Packages and entry points
+
+| Package | Metadata version | Driver ID | Type | Models | Python | WaveBench |
+| --- | --- | --- | --- | --- | --- | --- |
+| [`wavebench-rigol-dg4000`](../../packages/wavebench-rigol-dg4000/README_EN.md) | `0.7.0` | `rigol.dg4202` | source | DG4202, DG4000 | `>=3.11` | `wavebench>=0.8.25,<0.9` |
+| [`wavebench-rigol-dg4000`](../../packages/wavebench-rigol-dg4000/README_EN.md) | `0.7.0` | `rigol.dg4202-v2` | source | DG4202, DG4000 | `>=3.11` | `wavebench>=0.8.25,<0.9` |
+| [`wavebench-rigol-dg4000`](../../packages/wavebench-rigol-dg4000/README_EN.md) | `0.7.0` | `rigol.dg4202-v2-workspace` | source | DG4202, DG4000 | `>=3.11` | `wavebench>=0.8.25,<0.9` |
+| [`wavebench-rigol-dm3000`](../../packages/wavebench-rigol-dm3000/README_EN.md) | `0.5.0` | `rigol.dm3000` | dmm | DM3000, DM3058 | `>=3.11` | `wavebench>=0.8.11,<0.9` |
+| [`wavebench-rigol-dp800`](../../packages/wavebench-rigol-dp800/README_EN.md) | `0.3.0` | `rigol.dp800` | power | DP800, DP832, DP832A | `>=3.11` | `wavebench>=0.8,<0.9` |
+| [`wavebench-rigol-ds1000z`](../../packages/wavebench-rigol-ds1000z/README_EN.md) | `0.1.0` | `rigol.ds1000z` | scope | DS1104Z, DS1104Z Plus, DS1104Z-S Plus, DS1000Z | `>=3.11` | `wavebench>=0.8,<0.9` |
+| [`wavebench-rigol-dsg830`](../../packages/wavebench-rigol-dsg830/README_EN.md) | `0.2.0` | `rigol.dsg830` | rf_source | DSG830 | `>=3.11` | `wavebench>=0.8.25,<0.9` |
+| [`wavebench-rigol-mso8000`](../../packages/wavebench-rigol-mso8000/README_EN.md) | `0.9.0` | `rigol.mso8104` | scope | MSO8104 | `>=3.11` | `wavebench>=0.8.24,<0.9` |
+| [`wavebench-rohde-schwarz-rtm2000`](../../packages/wavebench-rohde-schwarz-rtm2000/README_EN.md) | `0.15.0` | `rohde-schwarz.rtm2032` | scope | RTM2032, RTM2000 | `>=3.11` | `wavebench>=0.8.26,<0.9` |
+| [`wavebench-shengpu-sp3000a`](../../packages/wavebench-shengpu-sp3000a/README_EN.md) | `0.2.0` | `shengpu.sp30120` | sweep_analyzer | SP30120 | `>=3.11` | `wavebench>=0.8,<0.9` |
+| [`wavebench-siglent-sdg2000x`](../../packages/wavebench-siglent-sdg2000x/README_EN.md) | `0.8.2` | `siglent.sdg2000x` | source | SDG2042X, SDG2082X, SDG2122X | `>=3.11` | `wavebench>=0.8.24,<0.9` |
+| [`wavebench-siglent-sds3000`](../../packages/wavebench-siglent-sds3000/README_EN.md) | `0.1.0` | `siglent.sds3000` | scope | SDS3054 | `>=3.11` | `wavebench>=0.8.24,<0.9` |
+| [`wavebench-siglent-sds800x-hd`](../../packages/wavebench-siglent-sds800x-hd/README_EN.md) | `0.6.0` | `siglent.sds800x-hd` | scope | SDS802X HD, SDS804X HD, SDS812X HD, SDS814X HD, SDS822X HD, SDS824X HD | `>=3.11` | `wavebench>=0.8.23,<0.9` |
+
+## Declared capabilities
+
+### `rigol.dg4202`
+
+- Display name: RIGOL DG4000 Function/Arbitrary Waveform Generator
+- Backends: `pyvisa`
+- Resource schemes: —
+- Capabilities:
+
+  - `source.snapshot_v2`
+  - `source.basic_configure_v2`
+  - `source.basic_live_configure_v2`
+  - `source.output_v2`
+  - `source.counter_configure_v2`
+  - `source.counter_enable_v2`
+  - `source.counter_measure_v2`
+  - `source.idn`
+  - `source.errors`
+  - `source.status`
+  - `source.channel_profile`
+  - `source.sweep_profile`
+  - `source.counter_profile`
+  - `source.set_frequency`
+  - `source.set_function`
+  - `source.set_amplitude_vpp`
+  - `source.set_square_duty_cycle`
+  - `source.output`
+  - `source.arbitrary_probe`
+  - `source.arbitrary_upload`
+
+### `rigol.dg4202-v2`
+
+- Display name: RIGOL DG4000 Source V2 Advanced (opt-in)
+- Backends: `pyvisa`
+- Resource schemes: —
+- Capabilities:
+
+  - `source.snapshot_v2`
+  - `source.basic_configure_v2`
+  - `source.basic_live_configure_v2`
+  - `source.output_v2`
+  - `source.counter_configure_v2`
+  - `source.counter_enable_v2`
+  - `source.counter_measure_v2`
+  - `source.idn`
+  - `source.errors`
+  - `source.status`
+  - `source.channel_profile`
+  - `source.sweep_profile`
+  - `source.counter_profile`
+  - `source.set_frequency`
+  - `source.set_function`
+  - `source.set_amplitude_vpp`
+  - `source.set_square_duty_cycle`
+  - `source.output`
+  - `source.arbitrary_probe`
+  - `source.sweep_configure_v2`
+  - `source.sweep_fire_v2`
+
+### `rigol.dg4202-v2-workspace`
+
+- Display name: RIGOL DG4000 Source V2 Volatile Workspace (opt-in)
+- Backends: `pyvisa`
+- Resource schemes: —
+- Capabilities:
+
+  - `source.idn`
+  - `source.snapshot_v2`
+  - `source.output_v2`
+  - `source.arbitrary_workspace_volatile_replace_v2`
+
+### `rigol.dm3000`
+
+- Display name: RIGOL DM3000/DM3058 Digital Multimeter
+- Backends: `pyvisa`
+- Resource schemes: `tcpip`
+- Capabilities:
+
+  - `dmm.idn`
+  - `dmm.read`
+  - `dmm.function_status`
+  - `dmm.set_function`
+  - `dmm.measurement_profile`
+  - `dmm.trigger_status`
+  - `dmm.calculation_status`
+  - `dmm.calculation_statistics`
+  - `dmm.system_interface_status`
+  - `dmm.set_voltage_range`
+  - `dmm.set_dcv_impedance`
+
+### `rigol.dp800`
+
+- Display name: RIGOL DP800 Power Supply
+- Backends: `pyvisa`
+- Resource schemes: —
+- Capabilities:
+
+  - `power.idn`
+  - `power.status`
+  - `power.measurement`
+  - `power.set_voltage_current_limit`
+  - `power.output`
+  - `power.protection`
+
+### `rigol.ds1000z`
+
+- Display name: RIGOL DS1000Z Oscilloscope
+- Backends: `pyvisa`
+- Resource schemes: —
+- Capabilities:
+
+  - `scope.idn`
+  - `scope.errors`
+  - `scope.autoscale`
+  - `scope.fetch_waveform`
+  - `scope.capture_waveform`
+  - `scope.capture_waveforms`
+  - `scope.screenshot`
+  - `scope.channel_coupling`
+
+### `rigol.dsg830`
+
+- Display name: RIGOL DSG830 RF Signal Generator
+- Backends: `pyvisa`
+- Resource schemes: `tcpip`, `usb`
+- Capabilities:
+
+  - `rf_source.idn`
+  - `rf_source.snapshot`
+  - `rf_source.cw_configure`
+  - `rf_source.output`
+  - `rf_source.modulation_configure`
+  - `rf_source.modulation_disable`
+  - `rf_source.modulated_output_enable`
+  - `rf_source.pulse_configure`
+  - `rf_source.pulse_output`
+  - `rf_source.sweep_configure`
+
+### `rigol.mso8104`
+
+- Display name: RIGOL MSO8104 Oscilloscope
+- Backends: `pyvisa`
+- Resource schemes: `tcpip`, `usb`, `gpib`
+- Capabilities:
+
+  - `scope.idn`
+  - `scope.error_drain_v1`
+  - `scope.fetch_waveform`
+  - `scope.capture_waveform`
+  - `scope.capture_waveforms`
+  - `scope.channel_coupling`
+  - `scope.channel_input_state_v2`
+  - `scope.autoscale`
+  - `scope.screenshot_profile`
+  - `scope.screenshot_v2`
+  - `scope.math_metadata`
+  - `scope.measurement_statistics_v2`
+  - `scope.fft_status_v2`
+  - `scope.acquisition_status_v2`
+  - `scope.acquisition_run_state`
+  - `scope.acquisition_control`
+  - `scope.digital_status_v2`
+  - `scope.snapshot_v2`
+  - `scope.cursor_readout`
+  - `scope.cursor_readout_v2`
+
+### `rohde-schwarz.rtm2032`
+
+- Display name: Rohde & Schwarz RTM2032 Oscilloscope
+- Backends: `rsinstrument-socket`, `rsinstrument`, `rsinstrument-rsvisa`, `rsinstrument-pyvisa-py`
+- Resource schemes: `tcpip`
+- Capabilities:
+
+  - `scope.idn`
+  - `scope.errors`
+  - `scope.autoscale`
+  - `scope.fetch_waveform`
+  - `scope.capture_waveform`
+  - `scope.capture_waveforms`
+  - `scope.screenshot`
+  - `scope.channel_coupling`
+  - `scope.snapshot`
+  - `scope.acquisition_status`
+  - `scope.capture_average`
+  - `scope.digital_status`
+  - `scope.digital_waveform`
+  - `scope.history_timestamps`
+  - `scope.measurement_statistics`
+  - `scope.math_metadata`
+  - `scope.fft_status`
+  - `scope.reference_metadata`
+  - `scope.cursor_readout`
+  - `scope.channel_input_state_v2`
+  - `scope.digital_status_v2`
+  - `scope.snapshot_v2`
+  - `scope.measurement_statistics_v2`
+  - `scope.fft_status_v2`
+  - `scope.channel_display_configure_v2`
+  - `scope.focus_configure_v2`
+
+### `shengpu.sp30120`
+
+- Display name: Shengpu SP30120 Digital Sweep Analyzer
+- Backends: `serial`
+- Resource schemes: —
+- Capabilities:
+
+  - `sweep_analyzer.idn`
+
+### `siglent.sdg2000x`
+
+- Display name: SIGLENT SDG2000X Function/Arbitrary Waveform Generator
+- Backends: `pyvisa`
+- Resource schemes: —
+- Capabilities:
+
+  - `source.idn`
+  - `source.status`
+  - `source.set_frequency`
+  - `source.set_function`
+  - `source.set_amplitude_vpp`
+  - `source.set_square_duty_cycle`
+  - `source.output`
+  - `source.arbitrary_probe`
+  - `source.snapshot_v2`
+  - `source.basic_configure_v2`
+  - `source.output_v2`
+  - `source.harmonics_disable_v2`
+
+### `siglent.sds3000`
+
+- Display name: SIGLENT SDS3054 Oscilloscope
+- Backends: `pyvisa`
+- Resource schemes: `vicp`, `tcpip`
+- Capabilities:
+
+  - `scope.idn`
+  - `scope.errors`
+  - `scope.channel_coupling`
+  - `scope.fetch_waveform`
+  - `scope.capture_waveform`
+  - `scope.capture_waveforms`
+
+### `siglent.sds800x-hd`
+
+- Display name: SIGLENT SDS800X HD Oscilloscope
+- Backends: `pyvisa`
+- Resource schemes: `tcpip`, `usb`
+- Capabilities:
+
+  - `scope.idn`
+  - `scope.channel_coupling`
+  - `scope.fetch_waveform`
+  - `scope.capture_waveform`
+  - `scope.capture_waveforms`
+  - `scope.measurement_statistics`
+  - `scope.screenshot_profile`
+  - `scope.screenshot_v2`
+  - `scope.acquisition_run_state`
+  - `scope.acquisition_control`
diff --git a/doc/reference/plugin-catalog.md b/doc/reference/plugin-catalog.md
new file mode 100644
index 0000000..e8b3de1
--- /dev/null
+++ b/doc/reference/plugin-catalog.md
@@ -0,0 +1,290 @@
+# WaveBench 插件目录
+
+[English](plugin-catalog-en.md)
+
+本 Reference 由各包的 `pyproject.toml` 和 production descriptor 生成。运行
+`python scripts/generate_plugin_catalog.py` 更新，运行
+`python scripts/generate_plugin_catalog.py --check` 检查漂移。
+
+> 元数据版本表示本仓库内的包源码合同，不代表 PyPI、Git tag 或 GitHub Release 状态。
+> capability 列表只表示 descriptor 顶层声明；型号、固件、选件和 profile 限制仍以包级
+> Reference 与运行时 capability 查询为准。
+
+## 包与入口点
+
+| 包 | 元数据版本 | Driver ID | 类型 | 型号 | Python | WaveBench |
+| --- | --- | --- | --- | --- | --- | --- |
+| [`wavebench-rigol-dg4000`](../../packages/wavebench-rigol-dg4000/README.md) | `0.7.0` | `rigol.dg4202` | 信号源 | DG4202, DG4000 | `>=3.11` | `wavebench>=0.8.25,<0.9` |
+| [`wavebench-rigol-dg4000`](../../packages/wavebench-rigol-dg4000/README.md) | `0.7.0` | `rigol.dg4202-v2` | 信号源 | DG4202, DG4000 | `>=3.11` | `wavebench>=0.8.25,<0.9` |
+| [`wavebench-rigol-dg4000`](../../packages/wavebench-rigol-dg4000/README.md) | `0.7.0` | `rigol.dg4202-v2-workspace` | 信号源 | DG4202, DG4000 | `>=3.11` | `wavebench>=0.8.25,<0.9` |
+| [`wavebench-rigol-dm3000`](../../packages/wavebench-rigol-dm3000/README.md) | `0.5.0` | `rigol.dm3000` | 数字万用表 | DM3000, DM3058 | `>=3.11` | `wavebench>=0.8.11,<0.9` |
+| [`wavebench-rigol-dp800`](../../packages/wavebench-rigol-dp800/README.md) | `0.3.0` | `rigol.dp800` | 直流电源 | DP800, DP832, DP832A | `>=3.11` | `wavebench>=0.8,<0.9` |
+| [`wavebench-rigol-ds1000z`](../../packages/wavebench-rigol-ds1000z/README.md) | `0.1.0` | `rigol.ds1000z` | 示波器 | DS1104Z, DS1104Z Plus, DS1104Z-S Plus, DS1000Z | `>=3.11` | `wavebench>=0.8,<0.9` |
+| [`wavebench-rigol-dsg830`](../../packages/wavebench-rigol-dsg830/README.md) | `0.2.0` | `rigol.dsg830` | 射频信号源 | DSG830 | `>=3.11` | `wavebench>=0.8.25,<0.9` |
+| [`wavebench-rigol-mso8000`](../../packages/wavebench-rigol-mso8000/README.md) | `0.9.0` | `rigol.mso8104` | 示波器 | MSO8104 | `>=3.11` | `wavebench>=0.8.24,<0.9` |
+| [`wavebench-rohde-schwarz-rtm2000`](../../packages/wavebench-rohde-schwarz-rtm2000/README.md) | `0.15.0` | `rohde-schwarz.rtm2032` | 示波器 | RTM2032, RTM2000 | `>=3.11` | `wavebench>=0.8.26,<0.9` |
+| [`wavebench-shengpu-sp3000a`](../../packages/wavebench-shengpu-sp3000a/README.md) | `0.2.0` | `shengpu.sp30120` | 扫频仪 | SP30120 | `>=3.11` | `wavebench>=0.8,<0.9` |
+| [`wavebench-siglent-sdg2000x`](../../packages/wavebench-siglent-sdg2000x/README.md) | `0.8.2` | `siglent.sdg2000x` | 信号源 | SDG2042X, SDG2082X, SDG2122X | `>=3.11` | `wavebench>=0.8.24,<0.9` |
+| [`wavebench-siglent-sds3000`](../../packages/wavebench-siglent-sds3000/README.md) | `0.1.0` | `siglent.sds3000` | 示波器 | SDS3054 | `>=3.11` | `wavebench>=0.8.24,<0.9` |
+| [`wavebench-siglent-sds800x-hd`](../../packages/wavebench-siglent-sds800x-hd/README.md) | `0.6.0` | `siglent.sds800x-hd` | 示波器 | SDS802X HD, SDS804X HD, SDS812X HD, SDS814X HD, SDS822X HD, SDS824X HD | `>=3.11` | `wavebench>=0.8.23,<0.9` |
+
+## 已声明 capability
+
+### `rigol.dg4202`
+
+- 显示名称：RIGOL DG4000 Function/Arbitrary Waveform Generator
+- Backend：`pyvisa`
+- Resource scheme：—
+- Capabilities:
+
+  - `source.snapshot_v2`
+  - `source.basic_configure_v2`
+  - `source.basic_live_configure_v2`
+  - `source.output_v2`
+  - `source.counter_configure_v2`
+  - `source.counter_enable_v2`
+  - `source.counter_measure_v2`
+  - `source.idn`
+  - `source.errors`
+  - `source.status`
+  - `source.channel_profile`
+  - `source.sweep_profile`
+  - `source.counter_profile`
+  - `source.set_frequency`
+  - `source.set_function`
+  - `source.set_amplitude_vpp`
+  - `source.set_square_duty_cycle`
+  - `source.output`
+  - `source.arbitrary_probe`
+  - `source.arbitrary_upload`
+
+### `rigol.dg4202-v2`
+
+- 显示名称：RIGOL DG4000 Source V2 Advanced (opt-in)
+- Backend：`pyvisa`
+- Resource scheme：—
+- Capabilities:
+
+  - `source.snapshot_v2`
+  - `source.basic_configure_v2`
+  - `source.basic_live_configure_v2`
+  - `source.output_v2`
+  - `source.counter_configure_v2`
+  - `source.counter_enable_v2`
+  - `source.counter_measure_v2`
+  - `source.idn`
+  - `source.errors`
+  - `source.status`
+  - `source.channel_profile`
+  - `source.sweep_profile`
+  - `source.counter_profile`
+  - `source.set_frequency`
+  - `source.set_function`
+  - `source.set_amplitude_vpp`
+  - `source.set_square_duty_cycle`
+  - `source.output`
+  - `source.arbitrary_probe`
+  - `source.sweep_configure_v2`
+  - `source.sweep_fire_v2`
+
+### `rigol.dg4202-v2-workspace`
+
+- 显示名称：RIGOL DG4000 Source V2 Volatile Workspace (opt-in)
+- Backend：`pyvisa`
+- Resource scheme：—
+- Capabilities:
+
+  - `source.idn`
+  - `source.snapshot_v2`
+  - `source.output_v2`
+  - `source.arbitrary_workspace_volatile_replace_v2`
+
+### `rigol.dm3000`
+
+- 显示名称：RIGOL DM3000/DM3058 Digital Multimeter
+- Backend：`pyvisa`
+- Resource scheme：`tcpip`
+- Capabilities:
+
+  - `dmm.idn`
+  - `dmm.read`
+  - `dmm.function_status`
+  - `dmm.set_function`
+  - `dmm.measurement_profile`
+  - `dmm.trigger_status`
+  - `dmm.calculation_status`
+  - `dmm.calculation_statistics`
+  - `dmm.system_interface_status`
+  - `dmm.set_voltage_range`
+  - `dmm.set_dcv_impedance`
+
+### `rigol.dp800`
+
+- 显示名称：RIGOL DP800 Power Supply
+- Backend：`pyvisa`
+- Resource scheme：—
+- Capabilities:
+
+  - `power.idn`
+  - `power.status`
+  - `power.measurement`
+  - `power.set_voltage_current_limit`
+  - `power.output`
+  - `power.protection`
+
+### `rigol.ds1000z`
+
+- 显示名称：RIGOL DS1000Z Oscilloscope
+- Backend：`pyvisa`
+- Resource scheme：—
+- Capabilities:
+
+  - `scope.idn`
+  - `scope.errors`
+  - `scope.autoscale`
+  - `scope.fetch_waveform`
+  - `scope.capture_waveform`
+  - `scope.capture_waveforms`
+  - `scope.screenshot`
+  - `scope.channel_coupling`
+
+### `rigol.dsg830`
+
+- 显示名称：RIGOL DSG830 RF Signal Generator
+- Backend：`pyvisa`
+- Resource scheme：`tcpip`, `usb`
+- Capabilities:
+
+  - `rf_source.idn`
+  - `rf_source.snapshot`
+  - `rf_source.cw_configure`
+  - `rf_source.output`
+  - `rf_source.modulation_configure`
+  - `rf_source.modulation_disable`
+  - `rf_source.modulated_output_enable`
+  - `rf_source.pulse_configure`
+  - `rf_source.pulse_output`
+  - `rf_source.sweep_configure`
+
+### `rigol.mso8104`
+
+- 显示名称：RIGOL MSO8104 Oscilloscope
+- Backend：`pyvisa`
+- Resource scheme：`tcpip`, `usb`, `gpib`
+- Capabilities:
+
+  - `scope.idn`
+  - `scope.error_drain_v1`
+  - `scope.fetch_waveform`
+  - `scope.capture_waveform`
+  - `scope.capture_waveforms`
+  - `scope.channel_coupling`
+  - `scope.channel_input_state_v2`
+  - `scope.autoscale`
+  - `scope.screenshot_profile`
+  - `scope.screenshot_v2`
+  - `scope.math_metadata`
+  - `scope.measurement_statistics_v2`
+  - `scope.fft_status_v2`
+  - `scope.acquisition_status_v2`
+  - `scope.acquisition_run_state`
+  - `scope.acquisition_control`
+  - `scope.digital_status_v2`
+  - `scope.snapshot_v2`
+  - `scope.cursor_readout`
+  - `scope.cursor_readout_v2`
+
+### `rohde-schwarz.rtm2032`
+
+- 显示名称：Rohde & Schwarz RTM2032 Oscilloscope
+- Backend：`rsinstrument-socket`, `rsinstrument`, `rsinstrument-rsvisa`, `rsinstrument-pyvisa-py`
+- Resource scheme：`tcpip`
+- Capabilities:
+
+  - `scope.idn`
+  - `scope.errors`
+  - `scope.autoscale`
+  - `scope.fetch_waveform`
+  - `scope.capture_waveform`
+  - `scope.capture_waveforms`
+  - `scope.screenshot`
+  - `scope.channel_coupling`
+  - `scope.snapshot`
+  - `scope.acquisition_status`
+  - `scope.capture_average`
+  - `scope.digital_status`
+  - `scope.digital_waveform`
+  - `scope.history_timestamps`
+  - `scope.measurement_statistics`
+  - `scope.math_metadata`
+  - `scope.fft_status`
+  - `scope.reference_metadata`
+  - `scope.cursor_readout`
+  - `scope.channel_input_state_v2`
+  - `scope.digital_status_v2`
+  - `scope.snapshot_v2`
+  - `scope.measurement_statistics_v2`
+  - `scope.fft_status_v2`
+  - `scope.channel_display_configure_v2`
+  - `scope.focus_configure_v2`
+
+### `shengpu.sp30120`
+
+- 显示名称：Shengpu SP30120 Digital Sweep Analyzer
+- Backend：`serial`
+- Resource scheme：—
+- Capabilities:
+
+  - `sweep_analyzer.idn`
+
+### `siglent.sdg2000x`
+
+- 显示名称：SIGLENT SDG2000X Function/Arbitrary Waveform Generator
+- Backend：`pyvisa`
+- Resource scheme：—
+- Capabilities:
+
+  - `source.idn`
+  - `source.status`
+  - `source.set_frequency`
+  - `source.set_function`
+  - `source.set_amplitude_vpp`
+  - `source.set_square_duty_cycle`
+  - `source.output`
+  - `source.arbitrary_probe`
+  - `source.snapshot_v2`
+  - `source.basic_configure_v2`
+  - `source.output_v2`
+  - `source.harmonics_disable_v2`
+
+### `siglent.sds3000`
+
+- 显示名称：SIGLENT SDS3054 Oscilloscope
+- Backend：`pyvisa`
+- Resource scheme：`vicp`, `tcpip`
+- Capabilities:
+
+  - `scope.idn`
+  - `scope.errors`
+  - `scope.channel_coupling`
+  - `scope.fetch_waveform`
+  - `scope.capture_waveform`
+  - `scope.capture_waveforms`
+
+### `siglent.sds800x-hd`
+
+- 显示名称：SIGLENT SDS800X HD Oscilloscope
+- Backend：`pyvisa`
+- Resource scheme：`tcpip`, `usb`
+- Capabilities:
+
+  - `scope.idn`
+  - `scope.channel_coupling`
+  - `scope.fetch_waveform`
+  - `scope.capture_waveform`
+  - `scope.capture_waveforms`
+  - `scope.measurement_statistics`
+  - `scope.screenshot_profile`
+  - `scope.screenshot_v2`
+  - `scope.acquisition_run_state`
+  - `scope.acquisition_control`
diff --git a/doc/rfcs/README.md b/doc/rfcs/README.md
index 6d59ee9..1a5f3ce 100644
--- a/doc/rfcs/README.md
+++ b/doc/rfcs/README.md
@@ -10,25 +10,21 @@
 - `Accepted`：主仓库已经冻结合同；
 - `Superseded`：已由后续方案取代。
 
-## 当前 RFC
+## 当前合同
 
-- [WaveBench scope 通用扩展接口 RFC](WaveBench_scope通用扩展接口RFC.md)：插件侧
-  `R1.3` 评审存档。核心 `0.8.23` 已接受并实现公共合同；当前规范以
-  [核心 RFC](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC.md)
-  和[核心实施说明](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC_核心实施说明.md)
-  为准。
-- [R1.3 Acceptance Addendum A1](WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md)：
-  插件侧验收门存档。核心离线 A1 已通过；每个插件仍需按 capability 单独完成实现、conformance
-  和实机验收。
+scope 通用扩展合同已经由 WaveBench Core 接受。当前内容只在 Core 维护：
 
-## 后续文档拆分
+- [Accepted RFC](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC.md)
+- [Accepted R1.3 A1](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md)
+- [核心实施说明](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC_核心实施说明.md)
 
-总 RFC 暂作单一规范事实源，避免把同一合同复制到多份文件后变得不一致。核心同意分拆后，按以下依赖拆出四份子 RFC：
+核心接受合同不等于具体插件已经通过 capability 实现、conformance 或实机验收。当前插件声明
+仍以各包的 production descriptor 为准。
 
-1. `binary-screenshot`：依赖 OperationSpec、phase authorization 和 artifact；包含 binary framing、budget、screenshot profile、恢复。
-2. `acquisition`：依赖 OperationSpec 和共享恢复接口；包含 control profile、SINGLE、continuous、recovery。
-3. `trace`：依赖 binary transfer 字段闭包和 source/axis 模型；包含 analog、digital、reference、spectrum。
-4. `error-policy`：依赖非嵌套 phase authorization 和 artifact；包含 `scope.error_drain_v1` 与旧 `scope.errors` 迁移。
+## 插件侧历史记录
 
-Acceptance Addendum A1 是核心采用的验收索引，不构成并行版本。核心合同完成不改变现有插件
-descriptor；只有完成插件自身验收后，才能声明对应 capability。
+- [R1.3 评审正文](../archive/rfcs/WaveBench_scope通用扩展接口RFC.md)：保留核心接受前的候选合同、证据和待决问题。
+- [R1.3 Acceptance Addendum A1](../archive/rfcs/WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md)：保留公共注册前的原始验收门。
+
+新的跨仪器公共合同应在本目录收集插件证据，达到 `Proposed` 条件后提交 Core 评审。已经接受
+的合同不在插件仓库继续维护并行副本。
diff --git "a/doc/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC-R1.3-acceptance-addendum.md" "b/doc/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC-R1.3-acceptance-addendum.md"
index 21454cc..e827e99 100644
--- "a/doc/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC-R1.3-acceptance-addendum.md"
+++ "b/doc/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC-R1.3-acceptance-addendum.md"
@@ -1,67 +1,8 @@
-# WaveBench scope 通用扩展接口 RFC：R1.3 Acceptance Addendum A1
+# 旧入口：Scope R1.3 Acceptance Addendum A1
 
-> 状态：插件侧验收门存档；核心 `0.8.23` 离线 A1 已通过
-> 适用正文：[WaveBench scope 通用扩展接口 RFC](WaveBench_scope通用扩展接口RFC.md)
-> 目的：冻结从内部基础设施到公共 capability 注册之间的验收门
+此 URL 保留给既有链接。当前验收结论以 WaveBench Core 的
+[Accepted A1](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md)
+为准。
 
-> 当前验收结果以核心仓库的
-> [Accepted A1](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md)
-> 为准。本文保留公共注册前的原始门禁，供插件迁移审计使用。
-
-本文件是总 RFC 第十二节的可单独审阅索引，不是第二套并行合同。字段、Protocol、数值和
-失败语义以总 RFC 为唯一事实源；本文件只列出本轮核心复审要求的验收顺序。
-
-## 允许的内部实现范围
-
-核心可以先实现下列私有或 feature-gated 组件，但不得注册新 capability、改变旧 descriptor
-行为或启动插件迁移：
-
-- operation context、非嵌套 phase coordinator 和跨 phase 不重置的 binary ledger；
-- acquisition、screenshot、transfer 的 typed snapshot / baseline / restore / verify 模型；
-- capability-method/descriptor gate、legacy artifact 和 fake/conformance fixture。
-
-## 公共注册前的 P0 门
-
-1. 核心必须实现 `ScopeTraceTransferRecoveryDriver`；`fetch_trace` 在 transfer 状态可能变化时必须
-   使用带 `context_id`、epoch、nonce 的 `ScopeTraceTransferBaseline`，并用 descriptor profile
-   的固定 restore order/step 上限完成逐字段 restore/verify；`CHDR`、`CORD`、`WFSU` 等字段
-   不得只靠文字承诺。
-2. 核心必须实现 `ScopeDescriptorExtensions`、`SCOPE_CAPABILITY_METHODS` 和 required Protocol；
-   缺 profile 或方法时在零 I/O 阶段拒绝，方法存在但未声明 capability 时不自动暴露。
-3. 核心固定并测试以下常量：
-
-   | operation | response / total / query / resync | default timeout |
-   | --- | --- | --- |
-   | `scope.screenshot_v2` | `262144 / 262144 / 1 / 0` | `5000 ms` |
-   | `scope.acquisition_start/single` | binary `—` | `30000 ms` |
-   | `scope.fetch_trace` | `8388608 / 67108864 / 256 / 65536` | `60000 ms` |
-
-   profile/connection 只能收紧；超出同步上限、无法证明边界或终止设置恢复失败时统一
-   close + `poisoned`。
-4. `OperationRequest.deadline`、`before_and_after` 默认 error timing、recovery `disabled`、
-   每次 I/O 的剩余 deadline 计算和 artifact 字段已有负向测试。
-
-## 公共注册前的 P1 门
-
-- 旧 capture 嵌入 screenshot 只采用父 operation 字段闭包；没有完整字段闭包则 I/O 前拒绝，
-  截图或恢复失败使父 capture 失败，不注册 composite operation。
-- screenshot、acquisition、transfer baseline 必须绑定 context、session epoch、opaque nonce，
-  按一次性消费状态拒绝重放。
-- `identity_delta` 只有在 `ScopeAcquisitionControlProfile.identity_semantics` 为
-  `unique_within_session_epoch` 时可用；否则只接受完整 state transition。
-- phase coordinator 必须通过现有 normal gate 与 recovery/verification authorization 的
-  非嵌套顺序桥接，driver 不接收 session token。
-- R1.3 公共 trace 只包含 analog/digital/reference；spectrum、math、fft_phase、frequency
-  axis 和新增单位移入后续 RFC。
-
-## 退出条件
-
-满足以下条件后，才能把 RFC 提交为 `Proposed`，并由核心决定是否注册 capability：
-
-1. P0/P1 fake/conformance fixture 全部通过；
-2. 至少两个独立仪器族或 backend 证明 transfer restore、binary framing 和失败恢复；
-3. Service、CLI、descriptor、registry、artifact schema 和版本门完成核心评审；
-4. 未决的 trace extensions、continuation 和 poisoned-session reopen 设计不被当前 capability
-   隐式引用。
-
-在此之前，总 RFC 和本 addendum 均保持 `Draft`，插件侧不增加新 capability 或核心迁移。
+插件侧公共注册前的原始验收门已移入[历史存档](../archive/rfcs/WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md)，
+仅用于迁移审计和设计追溯。
diff --git "a/doc/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC.md" "b/doc/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC.md"
index 28ac28c..c1c4ed1 100644
--- "a/doc/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC.md"
+++ "b/doc/rfcs/WaveBench_scope\351\200\232\347\224\250\346\211\251\345\261\225\346\216\245\345\217\243RFC.md"
@@ -1,2280 +1,9 @@
-# WaveBench scope 通用扩展接口 RFC
+# 旧入口：WaveBench scope 通用扩展接口 RFC
 
-> 状态：插件侧 `R1.3` 评审存档；核心 `0.8.23` 已接受并实现公共合同
-> 修订：`R1.3`（核心复审增补）
-> 证据仓库：WaveBench Instrument Plugins
-> 核心评审基线：WaveBench `0.8.22`，`origin/master@006c431`
-> 目标版本：未排期
+此 URL 保留给既有链接。当前公共合同以 WaveBench Core 的
+[Accepted RFC](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC.md)
+和[核心实施说明](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC_核心实施说明.md)
+为准。
 
-> 当前规范以核心仓库的
-> [Accepted RFC](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC.md)
-> 和[实施说明](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC_核心实施说明.md)
-> 为准。下文保留核心接受前的评审措辞，仅作为设计历史，不再描述当前核心状态。
-
-## 摘要与状态边界
-
-本文是供 WaveBench 核心团队预审的候选合同，不是已接受的公共 API。本文中的 `MUST`、
-`SHOULD` 和 `MAY` 只表示候选合同的规范强度，不表示当前核心已经实现。
-
-本修订吸收了对 `R1.1` 和前一轮 `R1.2` 复审意见，重点暂定四类此前仍有歧义的安全规则：
-
-1. action-specific `OperationSpec`、binary budget、Service、访问策略、资源租约、会话健康和 artifact；
-2. `MESSAGE` binary 的边界、核心强制上限、超限、部分响应和失步处理；
-3. 采集运行状态的状态机、单次采集完成证据、超时和恢复事务；
-4. 类型化 trace 的首版运算/单位范围，以及三态错误检查的未知能力和继续策略。
-
-核心仓库未因本文修改，当前核心没有注册下文新增的 operation 或 capability。SDS800X HD
-插件也不因本文声明这些能力；当前已声明能力仍只有 `scope.idn`、
-`scope.channel_coupling`、`scope.fetch_waveform`、`scope.capture_waveform`、
-`scope.capture_waveforms` 和 `scope.measurement_statistics`。
-
-本文把内容分为三类：
-
-- **现状证据**：已有核心代码、插件离线测试或受控实机观察；
-- **候选合同**：核心接受后才能实现的公共接口；
-- **待决问题**：需要核心团队冻结的选择，未解决前不得开始插件迁移。
-
-### R1.3 本轮复审回应
-
-| 核心阻断项 | 本修订的合同处理 | 状态 |
-| --- | --- | --- |
-| 失败恢复没有 driver 边界 | acquisition/screenshot 均提供 typed snapshot、core-owned baseline、restore result 和 fresh-snapshot verify；恢复阶段、字段顺序、epoch 与异常优先级固定 | 候选合同已补齐，待核心实现 |
-| binary budget 与子授权冲突 | 选择单一 operation context；各阶段顺序授权且不嵌套，所有 binary phase 引用同一 ledger，error phase 不得创建或重置额度 | 候选合同已冻结方向，待核心确认 |
-| count modulus 不能识别回绕/复位 | 删除 modulus proof；`count_delta_with_epoch` 必须联合未变化 `counter_epoch` 和有效 `state_transition`，否则改用 identity/state proof | 首版收紧，待 fixture |
-| 旧 `scope.errors` 与 typed drain 混用 | `scope.error_drain_v1` 独占 `max_records+1`；旧 `scope.errors` 保持 `legacy_unstructured`，`terminated/query_count=null`，未来 typed direct drain 另立 operation | 兼容边界已分开，待核心确认 |
-
-本表只记录合同回应，不表示核心已接受或插件已迁移。
-
-核心后续复审指出的 P0/P1 项由第十二节 `R1.3 acceptance addendum` 和配套的
-[A1 索引](WaveBench_scope通用扩展接口RFC-R1.3-acceptance-addendum.md)收口：transfer recovery、
-capability-method/descriptor 映射、数值上限与 deadline 已写成候选合同；旧 capture 采用唯一
-的父 operation 字段闭包；baseline 增加 context/nonce/一次性消费；identity proof 改为静态
-profile 事实；trace 的 spectrum/math 开放项排除在首轮公共实施外。核心可以据第十二节开始
-feature-gated 内部基础设施，但在 addendum 验收前不得注册 capability 或启动插件迁移。
-
-## 术语与分层
-
-| 术语 | 含义 | 不应混淆的对象 |
-| --- | --- | --- |
-| transport message | 一次 transport 交换，由 backend 证明起止边界 | TCP `recv()` 的物理分片 |
-| application chunk | 一个波形或文件协议定义的逻辑分块 | transport message；一次 query 的任意重试 |
-| operation | 由核心注册并受 `OperationSpec` 约束的公共动作 | driver 私有辅助函数 |
-| capability | descriptor 声明的可发现能力 | 方法存在但未声明的偶然实现 |
-| session health | 当前连接 epoch 的健康状态 | 仪器前面板显示的运行状态 |
-| artifact | Service 产生的可审计结果和诊断元数据 | 原始二进制 payload 或完整命令日志 |
-
-transport 只负责可靠地交付字节和结构化 I/O 状态；PNG、波形 preamble、样本字节序和数学
-结果属于更高层的 driver/model。应用分块属于波形协议层，不能因为一次 `DATA?` 返回分成
-多次底层 read 就自动生成多个 application chunk。
-
-## 当前证据
-
-| 证据编号 | 功能 | 证据 | 当前结论 |
-| --- | --- | --- | --- |
-| `E-BLOCK-DS` | definite block 截图 | DS1000Z [driver 测试](../../packages/wavebench-rigol-ds1000z/tests/test_driver.py)，离线 fake transport | 现有 `query_bin_block()` 可覆盖该类仪器，尚不是 backend EOM 实机证据 |
-| `E-BLOCK-RTM` | definite block 截图、菜单和颜色控制 | RTM2000 [driver 测试](../../packages/wavebench-rohde-schwarz-rtm2000/tests/test_driver.py)，离线 fake transport | 旧 screenshot 参数只对部分设备可映射 |
-| `E-MESSAGE-SDS` | raw PNG message | SDS804X HD 固件 `4.8.12.1.1.6.5`、PyVISA TCPIP `INSTR` / VXI-11 受控观察，见[硬件验收](../../packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_HARDWARE_ACCEPTANCE.md) | 只有一个仪器族的一次完整 raw PNG 观察，尚未证明通用 backend EOM 合同 |
-| `E-CAPTURE` | SINGLE、Stop 轮询、同次多通道读取 | 同一 SDS804X HD 实机记录和[插件测试](../../packages/wavebench-siglent-sds800x-hd/tests/test_driver.py) | 证明 vendor transaction 可行，不证明核心已有独立控制 API |
-| `E-TRACE-RTM` | math/FFT 元数据 | RTM2000 [覆盖矩阵](../../packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX.md)与离线测试 | 只有一类可复用 trace 证据 |
-| `E-TRACE-SDS` | SDS math 函数关闭 | SDS804X HD 受控探测 | 不能为 SDS 构造通用 math/FFT trace |
-| `E-ERROR-SDS` | 无文档化错误队列 | CN11G 手册审计和实机边界 | 不能发送猜测命令，也不能返回伪造空队列 |
-
-当前证据只支持继续保持 `Draft`。特别是 `MESSAGE`、数字/reference trace、失败恢复和
-跨 backend conformance fixture 都还没有第二个独立证据族。
-
-## 目标
-
-- 让 definite block 和 message-bounded binary 使用同一套 replay、session health、access
-  policy、租约和审计合同。
-- 让核心公共合同不暴露 backend session；当前 Python 插件仍是受信任代码，本文不声称提供
-  进程级或运行时沙箱隔离。
-- 让截图请求只使用仪器明确声明支持的 request tuple，并记录实际生效请求。
-- 区分采集运行阶段、触发模式、平均/分段进度和完整 capture 事务。
-- 让模拟、数字、数学、参考和频域轨迹使用同一套 source、坐标轴、单位和数组不变量。
-- 让错误检查策略区分「能力明确不支持」「能力未知」「查询失败」和「设备返回错误」。
-- 保留现有 capability，通过新增 capability 和核心版本门逐步迁移。
-
-## 非目标
-
-- 不在 transport 中解析 PNG、波形 preamble 或厂商文件格式。
-- 不开放 raw SCPI、backend session、插件 parser 回调或任意 terminator。
-- 不把 `*OPC?` 定义为物理触发完成条件。
-- 不在本文设计数学表达式写入、FFT 配置或通用运算 AST。
-- 不废弃现有 `scope.fetch_waveform`、`scope.capture_waveform(s)`、`scope.screenshot` 或
-  `ScopeAcquisitionStatus`。
-- 不为没有文档化错误队列的仪器猜测命令。
-- 不因本文是 `Draft` 就提高任何插件的核心版本下限。
-
-## 插件信任边界
-
-当前 `DriverContext.open_transport()` 返回公共 Protocol，但运行时
-`GuardedAuditedTransport.inner` 仍可被受信任 Python 插件访问。因此 R1.3 只规定「公共合同
-不提供 backend session，插件代码不得依赖它」，不声称存在安全隔离。真正的 opaque facade、
-进程隔离、运行时属性拒绝和负向沙箱测试应由单独的安全设计处理，不能借本 RFC 的措辞假装
-已经实现。
-
-## 规范用语与兼容边界
-
-候选合同中的 `MUST` 表示互操作所需的不变量，`SHOULD` 表示默认实现，`MAY` 表示可选能力。
-核心接受前，插件不得把候选 operation 放入 descriptor，也不得以 capability 名称存在为由
-绕过核心 Service 或 transport gate。
-
-旧核心 + 新插件、新核心 + 旧插件、旧核心 + 旧插件和新核心 + 新插件四种组合都必须在
-factory、能力发现和第一次仪器 I/O 前得到确定结果；未知 capability 不能静默降级为已支持。
-
-## 一、核心集成合同：OperationSpec、Service 与 artifact
-
-### 1.1 现有核心字段与候选扩展
-
-当前核心 `OperationSpec` 与外部 access policy 已有以下安全元数据：
-`effect`、`lease_mode`、`changed_fields`、`restore_coverage`、`required_verified_fields`、
-`verification_fields`、`risk_flags`、`timeout_source`、capability 要求；access policy 由核心
-外部的 `access_policy(spec)` 统一判定，不是 `OperationSpec` 自身字段。
-候选 operation MUST 先使用这些字段进入中央 registry；不能只在 driver Protocol 中声明方法。
-
-候选扩展只使用静态、可序列化的安全元数据：
-
-```python
-@dataclass(frozen=True)
-class OperationSpec:
-    # 省略现有字段
-    postcondition_fields: tuple[str, ...] = ()
-    cleanup_verification_fields: tuple[str, ...] = ()
-    binary_response_max_bytes: int | None = None
-    binary_operation_max_bytes: int | None = None
-    binary_query_max_count: int | None = None
-    binary_resynchronization_max_bytes: int | None = None
-    error_check_minimum: Literal["required", "if_supported", "disabled"] | None = None
-```
-
-当前核心的 `_session_preflight()` 只内建 `scope.identity` verifier；表中其余
-`scope.run_state`、`scope.waveform_*`、`scope.display_*` 和 `scope.trace_configuration` 都是
-待核心实现的验证器，不是插件可以自行写入 `verified_fields` 的旁路。
-
-`scope.screenshot_profile` 和 profile variant 是 descriptor/profile 事实，不属于连接 epoch 的
-`verified_fields`；它们必须先在核心内存中完成静态校验，再作为 operation 输入约束。只有从
-仪器读回并由核心 verifier 校验的状态，才能进入 session verification fields。插件不得直接
-调用 session state 的内部方法或写入 verified fields。
-
-R1.3 暂定四个独立 binary 限制：`binary_response_max_bytes` 限制每次 payload，
-`binary_operation_max_bytes` 限制一个 operation 内所有 binary payload 的累计值，
-`binary_query_max_count` 限制 query 次数，`binary_resynchronization_max_bytes` 限制超限或异常后为寻找
-已证明边界而额外丢弃的字节数。会产生 binary response 的 operation 中，前三者必须是
-有限正整数，resynchronization 必须是有限、非 bool 的非负整数；`0` 表示超限后不做额外
-丢弃，直接关闭/毒化。非 binary operation 的对应字段可为 `None`。profile 和 connection 只能
-给出更小的对应限制。
-核心 Service 在 operation 开始时分别计算有效值，并向 guarded transport 安装 opaque、
-短生命周期的
-`BinaryQueryBudget`。transport 每次 binary query 都必须验证 budget 与 operation context、phase、
-correlation 和 session epoch 匹配；插件只能进一步收紧单次上限，不能提高或重置累计额度。没有 budget 的新
-`query_binary()` 调用在发送前拒绝；旧 `query_bin_block()` 兼容入口使用核心固定有限上限。
-
-现有 `verification_fields` 只表示按 `restore_coverage` 恢复到 baseline 后必须闭合的字段，
-不用于表示读操作的观察结果，也不用于证明有意保留的控制状态。
-`postcondition_fields` 声明成功后由 action-specific result verifier 验证的目标状态；
-`cleanup_verification_fields` 声明失败或取消后 best-effort cleanup 要验证的目标状态。
-后两者的证据只进入 operation result/artifact，不写入 session `verified_fields`；若同一字段还要
-恢复 baseline，必须另外列入 `verification_fields`。
-
-`error_check_minimum` 为 `None` 时，该 operation 不接受 error-check override，也不触发
-错误队列 I/O；为三态值时，请求可以选择同等或更强的策略，但不能削弱静态最低值。
-完整解析规则见第六节。输入/输出 schema、取消、幂等性和并发策略仍可作为后续核心扩展，
-但在 R1.3 中不把任意 Python 回调塞入公共合同。前置条件、恢复覆盖、验证字段、
-error policy 和 binary budget 必须可序列化、可审计。
-
-候选字段的 verifier 归属如下；「核心待实现」不是插件可绕过的授权：
-
-| 字段 | 类型 | verifier / 来源 |
-| --- | --- | --- |
-| `scope.identity` | 仪器状态 | 现有核心 identity verifier |
-| `scope.run_state`、`scope.trigger`、`scope.acquisition` | 仪器状态 | 核心 acquisition verifier，待实现 |
-| `scope.display_menu`、`scope.display_color` | 仪器状态 | 核心 screenshot restore/verification verifier，待实现 |
-| `scope.waveform_source`、`scope.waveform_mode` | 仪器状态 | 核心 waveform-source/mode verifier，待实现 |
-| `scope.query_response_header`、`scope.waveform_format`、`scope.waveform_byte_order`、`scope.waveform_points`、`scope.waveform_transfer_window` | 仪器状态 | 核心 waveform-transfer verifier，待实现 |
-| `scope.trace_configuration` | 仪器状态 | 核心 trace verifier，待实现 |
-| `scope.screenshot_profile` | descriptor/profile 事实 | 核心 profile validator，不写入 session verified fields |
-| `scope.acquisition_control_profile` | descriptor/profile 事实 | 核心静态 acquisition-control profile validator，不写入 session verified fields |
-| `scope.trace_profile` | descriptor/profile 事实 | 核心静态 trace profile validator，不写入 session verified fields |
-| `scope.error_queue` | 条件性消耗状态 | 核心 error-policy executor；只作为 changed field/artifact，不写入 verified fields |
-
-波形协议字段的最小映射必须保持显式：
-
-| 厂商状态示例 | 核心字段 | changed / verification 要求 |
-| --- | --- | --- |
-| `CHDR` 响应头/头部模式 | `scope.query_response_header` | 临时改变时两者都必须列出 |
-| `CORD` 字节序 | `scope.waveform_byte_order` | 临时改变时两者都必须列出 |
-| `WFSU` 格式、宽度、点数和窗口 | `scope.waveform_format`、`scope.waveform_points`、`scope.waveform_transfer_window` | 每个实际改变的字段都必须逐项列出 |
-
-### 1.2 候选 operation 映射
-
-下表是 R1.3 的最小候选映射，字段完整不等于合同已经冻结。Service 和 CLI 项都是候选入口，
-当前不存在，不能在插件侧自行模拟。所有 operation 的 `session_purpose` 为 `normal`；超时后的安全停止由核心另行签发
-有界 `recovery` transaction。R1.3 保守地为所有仪器 operation 使用 `exclusive` lease，因为
-当前 `ScopeService` 的 session lease 不会按 `OperationSpec.lease_mode` 动态切换。以后若开放
-共享只读 session，需要单独证明 backend、仪器和 transaction lock 的并发语义。
-
-| operation | capability | effect / lease | changed_fields | restore_coverage | required_verified_fields | verification_fields | postcondition / cleanup fields | risk_flags | timeout_source | binary response / operation / query / resync limits | error minimum | 最低 access | Service / CLI / artifact |
-| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| `scope.screenshot_profile` | `scope.screenshot_profile` | `stateful_read` / `exclusive` | `none` | `none` | `scope.identity` | `none` | — / — | `profile_query` | `operation.timeout_ms=5000` | — | — | `read_only` | `ScopeService.screenshot_profile()` / `wavebench scope screenshot profile` / `screenshot.profile` |
-| `scope.screenshot_v2` | `scope.screenshot_v2` | `write` / `exclusive` | `scope.display_menu`, `scope.display_color`, `scope.error_queue`, `output.screenshot` | `screenshot-baseline-only` | `scope.identity` | `scope.display_menu`, `scope.display_color` | — / `scope.display_menu`, `scope.display_color` | `front_panel_state`, `binary_response`, `temporary_display_setup` | `operation.timeout_ms=5000` | `262144 / 262144 / 1 / 0` | `disabled` | `read_write` | `ScopeService.screenshot_v2(request)` / `wavebench scope screenshot capture` / `screenshot`、`effective_request`、`media_type`、`dimensions`、`framing` |
-| `scope.acquisition_run_state` | `scope.acquisition_run_state` | `stateful_read` / `exclusive` | `none` | `none` | `scope.identity` | `none` | — / — | `state_observation` | `operation.timeout_ms=5000` | — | — | `read_only` | `ScopeService.acquisition_run_state()` / `wavebench scope acquisition status` / `acquisition.run_state` |
-| `scope.acquisition_start` | `scope.acquisition_control` + `scope.acquisition_run_state` | `write` / `exclusive` | `scope.run_state`, `scope.trigger`, `scope.acquisition`, `scope.error_queue` | `failure-cleanup-only` | `scope.identity` | `scope.trigger`, `scope.acquisition` | `scope.run_state`, `scope.trigger`, `scope.acquisition` / `scope.run_state`, `scope.trigger`, `scope.acquisition` | `trigger`, `acquisition_state`, `recovery_required` | `operation.timeout_ms=30000` | — | `disabled` | `read_write` | `ScopeService.start_acquisition(request)` / `wavebench scope acquisition start` / `acquisition.control`、`effective_trigger_mode`、`postcondition`、`cleanup` |
-| `scope.acquisition_single` | `scope.acquisition_control` + `scope.acquisition_run_state` | `acquire` / `exclusive` | `scope.run_state`, `scope.trigger`, `scope.acquisition`, `scope.error_queue` | `failure-cleanup-only` | `scope.identity` | `scope.trigger`, `scope.acquisition` | `scope.run_state`, `scope.trigger`, `scope.acquisition` / `scope.run_state`, `scope.trigger`, `scope.acquisition` | `trigger`, `acquisition_state`, `recovery_required` | `operation.timeout_ms=30000` | — | `disabled` | `read_write` | `ScopeService.acquire_single()` / `wavebench scope acquisition single` / `acquisition.control`、`postcondition`、`completion_proof`、`cleanup` |
-| `scope.acquisition_stop` | `scope.acquisition_control` + `scope.acquisition_run_state` | `write` / `exclusive` | `scope.run_state`, `scope.error_queue` | `failure-cleanup-only` | `scope.identity` | `none` | `scope.run_state` / `scope.run_state` | `acquisition_state`, `recovery_required` | `operation.timeout_ms=5000` | — | `disabled` | `read_write` | `ScopeService.stop_acquisition()` / `wavebench scope acquisition stop` / `acquisition.control`、`postcondition`、`cleanup` |
-| `scope.trace_metadata` | `scope.trace_metadata` | `stateful_read` / `exclusive` | `none` | `none` | `scope.identity` | `none` | — / — | `analysis_state` | `operation.timeout_ms=5000` | — | `disabled` | `read_only` | `ScopeService.trace_metadata(source)` / `wavebench scope trace metadata` / `trace.metadata` |
-| `scope.fetch_trace` | `scope.fetch_trace` | `acquire` / `exclusive` | `scope.run_state`, `scope.waveform_source`, `scope.waveform_mode`, `scope.query_response_header`, `scope.waveform_format`, `scope.waveform_byte_order`, `scope.waveform_points`, `scope.waveform_transfer_window`, `scope.error_queue`, `output.trace` | `trace-baseline-only` | `scope.identity` | `scope.run_state`, `scope.waveform_source`, `scope.waveform_mode`, `scope.query_response_header`, `scope.waveform_format`, `scope.waveform_byte_order`, `scope.waveform_points`, `scope.waveform_transfer_window` | — / — | `acquisition_state`, `temporary_transfer_setup`, `binary_response` | `operation.timeout_ms=60000` | `8388608 / 67108864 / 256 / 65536` | `disabled` | `read_write` | `ScopeService.fetch_trace(source)` / `wavebench scope trace fetch` / `trace`、`metadata`、`integrity`、`error_check` |
-
-R1.3 acceptance addendum 固定下列数值；表中 binary 列依次为 response、operation total、query
-count、resynchronization bytes：
-
-```python
-SCOPE_SCREENSHOT_BINARY_RESPONSE_MAX_BYTES = 262_144
-SCOPE_SCREENSHOT_BINARY_OPERATION_MAX_BYTES = 262_144
-SCOPE_SCREENSHOT_BINARY_QUERY_MAX_COUNT = 1
-SCOPE_SCREENSHOT_BINARY_RESYNCHRONIZATION_MAX_BYTES = 0
-
-SCOPE_TRACE_BINARY_RESPONSE_MAX_BYTES = 8_388_608
-SCOPE_TRACE_BINARY_OPERATION_MAX_BYTES = 67_108_864
-SCOPE_TRACE_BINARY_QUERY_MAX_COUNT = 256
-SCOPE_TRACE_BINARY_RESYNCHRONIZATION_MAX_BYTES = 65_536
-
-SCOPE_PROFILE_OPERATION_TIMEOUT_MS = 5_000
-SCOPE_SCREENSHOT_OPERATION_TIMEOUT_MS = 5_000
-SCOPE_ACQUISITION_OPERATION_TIMEOUT_MS = 30_000
-SCOPE_TRACE_OPERATION_TIMEOUT_MS = 60_000
-```
-
-这些值是核心上限，不是 driver 默认值；descriptor/profile/connection 只能收紧，不能提高。
-`scope.screenshot_v2` 首版单次 PNG 上限为 256 KiB，依据已有 SDS raw PNG 证据保留明确余量；
-`scope.fetch_trace` 每次 response 上限为 8 MiB、一次 operation 总上限为 64 MiB、最多 256 次
-binary query，并允许最多丢弃 64 KiB 以证明边界。超出 resynchronization 上限或无法证明边界时，
-核心固定关闭 transport 并将 session 标记为 `poisoned`，不由 backend 自行选择 close/poison
-策略。
-
-`OperationRequest.deadline` 固定为单调时钟的绝对时间。未提供调用方 deadline 时，核心使用上表
-operation timeout；调用方提供更早 deadline 时只能收紧，不能延长。每次 I/O 的 timeout 为
-`min(connection.timeout_ms, deadline - monotonic_now)`，剩余时间不足 1 ms 时在发送前以
-`deadline_exhausted` 拒绝。profile source 固定采用 descriptor-first：descriptor 必须提供安全
-上限；仪器查询只能形成 `combined` 交集并收紧，`queried`-only profile 在 R1.3 拒绝。
-
-`ErrorCheckSpec.timing` 的默认值固定为 `before_and_after`；screenshot、acquisition 和 trace
-operation 只能使用该默认值或显式收紧为 `before`/`after`，driver 不得另行决定 timing。recovery
-phase 固定为 `disabled`。文本 query timeout、binary timeout 和恢复 timeout 都受同一 operation
-deadline 限制。
-
-`scope.screenshot_v2` 采用保守的 `write` effect，因为某些设备需要临时写菜单或颜色设置；
-只支持 `device` 行为的设备也不能在 profile 中把该 operation 降级为无状态副作用；它仍按
-`write` gate 执行。若未来需要真正的 read-only screenshot operation，应新增独立 operation
-和 capability，不能由 profile 动态改变 effect。`scope.fetch_trace` 同理，默认按可能修改
-transfer 选择处理。
-
-采集控制按动作拆成三个静态 operation：`scope.acquisition_start`、
-`scope.acquisition_single` 和 `scope.acquisition_stop`。它们共享
-`scope.acquisition_control` capability，但不得用一个带 `action` 参数的 operation 动态改变
-`effect`、changed fields、恢复覆盖或最低 access。`stop` 的公共入口和超时 cleanup 入口仍
-共享同一 driver 方法，但核心发放的 normal/recovery authorization 必须分别标识用途。
-
-三个控制 operation 的成功 postcondition 与失败 cleanup 必须分开：`start` 成功后有意保留
-连续运行状态，`single` 成功后保留新记录已经完成的停止状态，`stop` 成功后有意保留停止
-状态。`failure-cleanup-only` 只描述写入失败、等待超时或取消后的 cleanup，不得在成功
-路径把 run state 恢复到调用前。`postcondition_fields` 在成功路径证明目标状态，
-`cleanup_verification_fields` 在失败路径证明 cleanup 结果；artifact 必须用
-`postcondition` 与 `cleanup` 两个字段区分。两者都不得借用现有 `verification_fields`
-向 session 伪造 baseline 恢复证据。
-对 `start` 和 `single`，失败 cleanup 在 session 仍可安全写入时必须先 STOP，再恢复并
-query-back 写入前的 `scope.trigger` 和 `scope.acquisition` baseline。只有 run state、trigger 和
-acquisition 全部验证成功时 cleanup 才是 `succeeded`；任一字段未恢复或未证明时，
-session 不得回到 `healthy`。
-
-`scope.screenshot_v2`、`scope.acquisition_start`、`scope.acquisition_single`、
-`scope.acquisition_stop` 和 `scope.fetch_trace` 应把
-`scope.error_drain_v1` 放入 `optional_capabilities`，是否变成当前请求的必需能力由第六节的错误策略
-和 `OperationSpec` 最低策略共同决定。profile、运行状态和 metadata 查询默认不触发错误队列，
-避免一个只读观测产生额外的 consumptive read。
-
-表中的 `scope.error_queue` 只在有效 error policy 实际执行完整 drain 时产生；如果 policy 为
-`disabled`，该字段不发生仪器变化，但 operation artifact 仍必须记录 `error_check.status`。
-核心实现可以用保守的静态 changed field，也可以在冻结 action-specific spec 后使用条件字段，
-但不得把 consumptive error read 隐藏在普通 query 统计中。
-
-波形 transfer 字段使用协议无关的核心名称；例如某些示波器的 `CHDR` 响应头、`CORD` 字节序、
-`WFSU` 格式/宽度/点数/窗口都必须映射到上述 `query_response_header`、`waveform_byte_order`、
-`waveform_format`、`waveform_points` 和 `waveform_transfer_window`。只在
-`changed_fields` 中列出「transfer」而不在 `verification_fields` 中逐项闭合，不满足本 RFC；
-任一项恢复后无法由核心 verifier 证明时，operation 必须 fail-closed，不能因为
-`restore_coverage="capture-baseline-only"` 就回到 `healthy`。
-同一字段集也适用于现有 `scope.fetch_waveform`、`scope.capture`、
-`scope.capture_waveforms` 和 `scope.capture_multiple` 的核心规格；新 RFC operation 不能因为
-换成 `ScopeTraceData` 就缩小既有 transfer 恢复/验证要求。
-
-现有 capture 若需要调用旧 `scope.screenshot`，R1.3 只允许「父 operation 字段闭包」方案：
-父 `scope.capture_waveform`、`scope.capture_waveforms` 或 `scope.capture_multiple` 的静态
-`OperationSpec` 必须显式携带 `ScopeEmbeddedScreenshotContract`，并加入
-`scope.display_menu`、`scope.display_color`、`output.screenshot` 的 changed/verification/cleanup
-字段，在同一 operation context 内按 screenshot phase 执行
-snapshot、capture、restore、verify。R1.3 不定义 composite operation，也不允许在父 operation
-外单独开启 screenshot authorization；旧 capture 若没有这组字段闭包，必须在任何 I/O 前以
-`unsupported_capability` 拒绝 screenshot 请求。旧 `scope.screenshot_png()` 不能绕过该规则。
-
-嵌入截图的失败语义固定为 `fail_parent`：截图 transport、PNG 校验、after error 或 restore/
-verify 失败都会使父 capture operation 失败；已经取得的 waveform 只能作为脱敏诊断摘要，
-不得作为成功值返回。父 operation 只执行一次 error policy，artifact 在父记录下增加
-`screenshot.status`、`screenshot.failure_reason`、`screenshot.cleanup` 和 `screenshot.verification`，
-不创建第二个 operation artifact。
-当前核心 `ScopeService` 在 capture 外单独调用 screenshot 的旧路径不满足该合同；在父 operation
-字段闭包实现前，旧路径只能保持 legacy 行为，不能声明 `scope.screenshot_v2` 或把截图错误
-降级为 capture 的部分成功。
-
-### 1.3 输入、前置条件与输出
-
-为避免只有 operation 名称而没有可执行边界，R1.3 规定以下最小 schema 和 Python Protocol；
-完整公共 wire serialization、取消、幂等性和并发字段仍待核心冻结，因此在第十二节验收前
-只能用于内部 / feature-gated 实现：
-
-| operation | 输入 | 主操作写入 / binary 前置条件 | 成功输出 |
-| --- | --- | --- | --- |
-| `scope.screenshot_profile` | 无 | identity 已验证；profile source 可用 | `ScopeScreenshotProfile` |
-| `scope.screenshot_v2` | `ScopeScreenshotRequest`、operation 级 error policy | profile 精确匹配；access 允许写入；必要的 baseline 可读 | `ScopeScreenshot` + effective request |
-| `scope.acquisition_run_state` | 无 | identity 已验证；session healthy | `ScopeAcquisitionRunState` |
-| `scope.acquisition_start` | `ScopeContinuousAcquisitionRequest`、operation 级 error policy | identity 已验证；phase 属于 `stopped/ready/complete`；descriptor 的 `scope_extensions.acquisition_control_profile` 已验证并支持请求 mode；trigger/acquisition baseline 可读；access 允许写入 | `ScopeAcquisitionRunState`，trigger mode 等于请求，phase 为 `ready/arming/waiting/acquiring/rolling` |
-| `scope.acquisition_single` | operation 级 error policy | identity 已验证；phase 属于 `stopped/ready/complete`；descriptor 的 `scope_extensions.acquisition_control_profile` 已验证；trigger/acquisition baseline 可读；access 允许采集 | `ScopeAcquisitionCompletion`；失败则 cleanup diagnostics |
-| `scope.acquisition_stop` | operation 级 error policy | normal 路径要求 identity 已验证、session healthy 且 phase 非 `unknown/error`；recovery 路径使用独立 core authorization | `ScopeAcquisitionRunState`，postcondition 为 `stopped`；recovery 另记 cleanup |
-| `scope.trace_metadata` | 有效 `ScopeTraceRef` | source/index/name 不变量通过；identity 已验证 | `ScopeTraceMetadata` |
-| `scope.fetch_trace` | `ScopeTraceRef`、points profile、operation 级 error policy | source 已配置；sequence/segmentation 与 profile 兼容；必要时 acquisition stopped | `ScopeTraceData` + integrity/error artifact |
-
-纯参数错误、能力不支持和 access 拒绝 MUST 在任何仪器 I/O 前返回。phase、baseline
-和 query-back 等仪器状态前置条件可以使用核心签发的有界 preflight/verification authorization
-执行只读查询，但必须在主 operation 的任何写入或 binary query 前完成。设备返回错误、
-传输失败和完成证据不足则归入对应 operation result/exception，不得伪装成参数错误。
-`scope.screenshot_v2`、三个 acquisition control operation 和 `scope.fetch_trace` 都从统一的
-`OperationRequest.error_check` 解析单 operation 覆盖；若未提供，按第六节优先级解析全局和
-`OperationSpec` 策略。driver 方法不再接受另一个独立策略来源。
-
-### 1.4 请求、结果和异常边界
-
-候选核心应为每个 operation 生成可审计的请求和结果，至少包含：
-
-```python
-@dataclass(frozen=True)
-class OperationRequest:
-    operation_id: str
-    arguments: Mapping[str, Any]
-    deadline: float | None
-    correlation_id: str
-    error_check: ErrorCheckSpec | None
-
-@dataclass(frozen=True)
-class OperationResult:
-    value: object
-    diagnostics: Mapping[str, Any]
-    observed_state: Mapping[str, Any] | None
-```
-
-`OperationRequest.deadline` 使用单调时钟的绝对 deadline；artifact 只记录剩余时长或
-`deadline_source`，不记录进程时间戳。`correlation_id` 在一次 Service operation 及其
-recovery/verification phase 中保持不变，便于把 cleanup 和错误检查归到同一操作。
-
-`operation_id` MUST 使用稳定的小写点分隔名称；版本变化通过 capability/core version gate
-处理，不在同一名称下改变输入或输出语义。异常至少区分：
-
-- `unsupported_capability`：descriptor 明确没有能力；
-- `unknown_capability`：核心或插件没有完成能力发现；
-- `precondition_failed`：前置条件在任何写入和 binary 查询前失败；
-- `access_denied`：访问策略不允许；
-- `transport_io_error`：传输阶段失败，沿用现有结构化 framing、同步和 retry 字段；
-- `completion_unproven`：操作可能已执行，但没有足够证据证明完成；
-- `instrument_error`：设备明确返回错误。
-
-### 1.5 恢复与 artifact 规则
-
-所有可能写入仪器的候选 operation MUST 在 `OperationSpec` 中声明 changed fields 和恢复覆盖。
-需要恢复 baseline 的字段写入 `verification_fields`；有意保留的成功状态和失败 cleanup
-目标分别写入 `postcondition_fields` 和 `cleanup_verification_fields`。主异常不得被恢复异常覆盖；
-结果或失败 artifact 应记录：
-
-```text
-operation
-correlation_id
-requested_arguments（去除敏感值）
-observed_state_before / observed_state_after
-session_health_before / session_health_after
-baseline.kind / baseline.context_id / baseline.session_epoch / baseline.nonce_digest /
-baseline.fields / baseline.restore_order / baseline.consumption
-postcondition.status / postcondition.reason_code / postcondition.observed_fields
-completion_proof.proof / completion_proof.original_state / completion_proof.proof_baseline_state /
-completion_proof.proof_baseline_stage / completion_proof.observed_states（仅 SINGLE）
-cleanup.attempted / cleanup.restore / cleanup.verification / cleanup.error_code / cleanup.observed_fields
-error_check
-```
-
-`postcondition` 必须由 operation-specific result verifier 产生，不得把 driver 返回非空当作验证。
-`scope.acquisition_single` 的 completion artifact 必须保留脱敏 baseline、完整的记录状态序列
-和 proof 分支；其他 action 不生成伪造的 completion 字段。
-
-artifact 只记录 framing、长度、媒体类型、状态 token 和摘要，不记录图片、原始波形、真实
-resource、序列号或完整命令 payload。
-
-### 1.6 非嵌套 operation context 与阶段授权
-
-本轮增补选择「单个 operation context 下的顺序阶段授权」，不选择嵌套 session
-authorization。候选核心内部模型为：
-
-```python
-OperationPhase = Literal[
-    "preflight",
-    "error_before",
-    "main",
-    "success_restore",
-    "error_after",
-    "failure_cleanup",
-    "cleanup_verification",
-]
-
-@dataclass(frozen=True)
-class _CoreOperationContext:
-    context_id: str
-    operation_id: str
-    correlation_id: str
-    session_epoch: str
-    deadline: float
-    binary_budget_ledger_id: str | None
-
-BaselineNonce = str
-
-@dataclass(frozen=True)
-class _CoreBaselineUseRecord:
-    context_id: str
-    session_epoch: str
-    baseline_nonce: BaselineNonce
-    state: Literal["fresh", "passed_to_main", "restore_attempted", "consumed"]
-```
-
-operation context 只是核心 coordinator 持有的生命周期和额度账本，不是 session
-authorization，创建它不会发送 I/O，也不会占用核心现有的 active authorization 槽位。
-核心在 access、capability、lease 和静态 profile 校验通过后，在第一次仪器 I/O 前创建一次
-context；同一公共 operation 不得创建第二个 context 来重置 deadline、correlation 或 binary
-budget。
-
-baseline 是 context-owned handle，不是 driver 可自行生成的状态快照。核心为每个可恢复操作
-生成一次不可预测的 `baseline_nonce`，并把 `context_id`、当前 `session_epoch` 和 nonce 写入
-baseline。nonce 只在该 context 的规定阶段内有效；核心在 baseline 传入 main 后标记
-`passed_to_main`，首次进入 success/failure restore 后标记 `restore_attempted`，随后标记
-`consumed`。任何 context、epoch、nonce、phase 或消费状态不匹配都必须在 driver I/O 前拒绝，
-不得以同一连接 epoch 中的旧 baseline 重放。artifact 只记录 nonce 的脱敏摘要和消费状态，
-不记录原值；driver 不得复制、替换或持久化 nonce。
-
-需要动态 I/O 授权的每个阶段使用一个独立、有界的 session authorization；`main` 阶段
-沿用该公共 operation 已有的 `normal` gate，不在其中再开子授权。候选 phase 与当前
-`SessionPurpose` 的映射固定为：`preflight`/`error_before`/`error_after`/`cleanup_verification`
-使用只读 `verification` 语义，`success_restore`/`failure_cleanup` 使用有界 `recovery` 语义，
-`main` 使用既有 `normal` operation gate，但该 gate 的授权记录仍必须绑定本 context 的
-`context_id`、epoch、字段和 deadline；不是重新开启一个脱离 context 的 normal operation。
-若核心为 phase 增加专用枚举，必须保持同样的 I/O 白名单和非嵌套约束；driver 永远不接收
-或构造 authorization token。
-
-上述阶段遵守以下硬约束：
-
-1. 开启新阶段前，上一阶段 authorization MUST 已关闭；任意时刻最多只有一个 active
-   authorization。阶段执行器不得从 active authorization 内再签发子 authorization。
-2. 每个 authorization 必须绑定 `context_id`、`session_epoch`、phase、字段白名单、
-   allowed I/O、剩余 deadline 和静态 `max_steps`；阶段切换不得改变 access/lease 结论。
-3. `BinaryQueryBudget` 的可变账本归 operation context 所有，不归某个阶段 authorization
-   所有。只有静态 phase contract 允许 binary query 时，guarded transport 才能在 active
-   authorization 中引用同一 `binary_budget_ledger_id`。创建、关闭或重试 phase 都不得
-   重建账本、增加额度或退回已消耗的 query count。
-4. session 进入 `uncertain/poisoned` 后，binary ledger 立即变为不可用，但已消耗计数保留到
-   operation artifact 完成。只有静态声明的 `failure_cleanup`/`cleanup_verification`
-   recovery 阶段可继续；它们不得使用 binary I/O。
-5. context 在成功结束、主失败及全部允许的 cleanup/verification 结束、取消且无可执行
-   recovery，或 session epoch 改变时进入 terminal。进入 terminal 后所有阶段 token 和 binary
-   ledger 失效，不得跨 operation 或跨 epoch 重用。
-
-阶段与授权、binary 的固定对应关系为：
-
-| phase | session authorization purpose | 允许的 I/O | binary ledger |
-| --- | --- | --- | --- |
-| `preflight` | `verification` | 只读状态/profile query | 不可用 |
-| `error_before` / `error_after` | `verification` | `scope.error_queue` 的文本 query | 只关联同一 context；禁止 binary 且不扣额度 |
-| `main` | 既有 normal operation gate | 由 `OperationSpec` 静态声明的 write/acquire/text/binary | 若允许 binary，只能引用同一 ledger |
-| `success_restore` / `failure_cleanup` | `recovery` | 有界文本 STOP、state restore write | 不可用 |
-| `cleanup_verification` | `verification` | 有界文本 query-back | 不可用 |
-
-phase 与当前核心 session API 的衔接冻结为一个核心内部 coordinator，而不是让 driver 直接
-调用 `SessionTransactionCoordinator.authorize()`：
-
-```python
-ScopePhasePurpose = Literal["normal", "recovery", "verification"]
-
-@dataclass(frozen=True)
-class ScopePhaseAuthorizationSpec:
-    context_id: str
-    operation_id: str
-    phase: OperationPhase
-    purpose: ScopePhasePurpose
-    allowed_io: frozenset[str]
-    fields: frozenset[str]
-    deadline: float
-    max_steps: int
-
-class ScopeOperationContextCoordinator(Protocol):
-    def authorize_phase(
-        self,
-        spec: ScopePhaseAuthorizationSpec,
-    ) -> Iterator["ScopePhaseAuthorization"]: ...
-```
-
-`ScopeOperationContextCoordinator` 的实现规则固定为：`purpose="recovery"` 或
-`"verification"` 时，顺序调用当前 `SessionTransactionCoordinator.authorize()`；
-`purpose="normal"` 时复用现有公共 operation gate。核心在两条路径都维护同一个
-`_CorePhaseAuthorizationRecord(authorization_handle_id, context_id, session_epoch, phase, purpose,
-fields, allowed_io, deadline, max_steps)` 侧记录；`authorization_handle_id` 是核心生成的
-opaque 一次性 handle，侧记录以该 handle 对应的 authorization object identity 绑定，并在
-authorization 关闭后才允许下一 phase。若当前
-`SessionAuthorization` 对象没有这些字段，侧记录必须以不可伪造的 opaque authorization
-identity 绑定；不能仅用 `operation_id` 或 `session_epoch` 推断 context。核心必须先扩展或
-包裹现有 gate，再开始任何新 capability 的实现；driver 只接收已授权的 transport facade，
-不接收 `ScopePhaseAuthorization` 或 session token。
-
-因此 `error_before`/`error_after` 即使拥有独立的顺序 authorization，也不会获得新的
-binary 权限或额度；它们只携带同一 `context_id`/`binary_budget_ledger_id` 的审计关联，账本
-计数保持不变。阶段切换时核心先关闭当前授权，再签发下一阶段授权；若当前核心的
-`authorize()` 只能接受 `recovery`/`verification` purpose，则 `main` 继续使用既有 normal
-operation gate，其他 phase 按上表映射，不要求核心接受嵌套授权。
-
-首版操作的阶段顺序为：
-
-| operation 类型 | 成功顺序 | 主操作/after 失败顺序 |
-| --- | --- | --- |
-| acquisition start/single | `preflight -> error_before? -> main -> error_after? -> terminal` | 关闭当前 phase 后 `failure_cleanup -> cleanup_verification -> terminal` |
-| screenshot with state changes | `preflight -> error_before? -> main -> error_after? -> success_restore -> cleanup_verification -> terminal` | 关闭当前 phase 后 `failure_cleanup -> cleanup_verification -> terminal` |
-| fetch/trace vendor transaction | `preflight -> error_before? -> main -> error_after? -> terminal` | 关闭当前 phase 后执行该 operation 已声明的非嵌套 restore/verification phase，然后 terminal |
-
-`?` 表示 error policy 决定该阶段是否存在，不表示插件可自行跳过。before/after error
-executor 只是同一 context 中的独立顺序 phase，不是父/子 authorization。
-artifact MUST 记录每个 phase 的开始/结束、allowed I/O、实际 step 数、budget 前后摘要和跳过原因；
-不记录 opaque token 本身。
-
-## 二、binary framing 与 message 语义
-
-### 2.1 两层 framing
-
-首版只接受两种可证明的 transport response framing：
-
-```python
-class BinaryResponseFraming(str, Enum):
-    DEFINITE_BLOCK = "definite_block"
-    MESSAGE = "message"
-```
-
-- `DEFINITE_BLOCK`：应用层响应以 IEEE 488.2 `#N` 头声明 payload 长度；
-- `MESSAGE`：backend 通过 EOI、VISA message END 或等价的明确事件报告一次响应结束。
-
-底层 socket 的多次 `recv()`、串口暂时没有数据、读取 timeout 和换行都不是通用 message
-边界。transport 不解析 PNG、波形或其他媒体；内容校验由 driver 完成。
-
-### 2.2 definite block 的精确语法
-
-候选 transport MUST 按以下语法解析：
-
-```text
-response := '#' + N + length_field + payload
-N        := ASCII digit '1'..'9'
-length_field := exactly N ASCII decimal digits
-payload  := exactly the declared number of bytes
-```
-
-`#0`（indefinite block）、缺失长度位、非 ASCII 数字、长度溢出、声明长度与已消费字节不一致
-都必须结构化失败。`#10` 表示零长度 payload 的语义是否允许由 operation profile 决定；不允许
-把 `#0` 当作零长度 definite block。解析前必须校验长度上限，不能先按声明长度分配无限内存。
-
-### 2.3 `query_binary` 与上限
-
-候选公共方法为：
-
-```python
-# 概念模型：这是核心内部状态，不是公共构造函数。
-class _CoreBinaryQueryBudget(Protocol):
-    ledger_id: str
-    context_id: str
-    operation_id: str
-    correlation_id: str
-    per_response_max_bytes: int
-    remaining_operation_bytes: int
-    remaining_query_count: int
-    resynchronization_max_bytes: int
-    transport_trailing: bytes
-    expires_at: float  # monotonic clock 的绝对时间
-
-
-@dataclass(frozen=True)
-class BinaryQueryResult:
-    data: bytes
-    framing: BinaryResponseFraming
-    declared_length: int | None
-    framing_header_bytes: int
-    consumed_bytes: int
-    transport_trailing_bytes: bytes
-    synchronization: Literal["proven"] = "proven"
-
-
-def query_binary(
-    self,
-    command: str,
-    *,
-    framing: BinaryResponseFraming,
-    max_bytes: int,
-    replay: ReplayPolicy = ReplayPolicy.NO_REPLAY,
-) -> BinaryQueryResult: ...
-```
-
-上面的 `_CoreBinaryQueryBudget` 是描述核心内部授权状态的概念模型，不是插件可实例化的公共输入；
-文中简称 `BinaryQueryBudget`。核心只向 guarded transport 传递不可伪造的 opaque token，不把
-这些字段暴露给插件作为可修改对象。
-核心 coordinator 为一次 operation context 创建一次 budget ledger。session health 改变时立即
-禁止新 binary I/O，但 ledger 保留已消耗计数，直到第 1.6 节定义的 context terminal 时才失效；
-transport 不得接受跨 context、跨 operation/correlation、跨 session epoch 或过期的 budget。
-`per_response_max_bytes` 限制每次 response；`remaining_operation_bytes` 限制一次 operation
-中所有 binary response 的累计 payload；`remaining_query_count` 防止通过大量零长度响应绕过资源
-边界；`resynchronization_max_bytes` 限制失败后为证明同步而额外丢弃的字节。这些值都是核心
-在 operation 开始前计算的有限整数；前三者为正，resynchronization 可为零。多次 query 不能把额度累加成更大的单次
-response 上限，也不能通过重建 driver 对象重置任何额度。
-
-`max_bytes` MUST 是核心签发的 `BinaryQueryBudget.per_response_max_bytes` 范围内的正整数；
-它计量单次 response 的 payload 字节数，不包含 framing header。未配置 connection 上限时，
-核心只在内部最小值计算中把对应 connection 项视为 `+∞`；operation 的 response 和 total
-上限仍必须有限，公共方法不提供无限读取默认值。Service 分别计算：
-
-```text
-effective_response_max = min(spec response, profile response, connection response)
-effective_operation_max = min(spec total, profile total, connection total)
-effective_query_max_count = min(spec query count, profile query count, connection query count)
-effective_resynchronization_max = min(spec resync, profile resync, connection resync)
-```
-
-profile 或 connection 没有对应限制时只是不进一步收紧，不能取消 spec 的有限值。
-Service 在第一个阶段授权前向 operation context 安装与 context/operation/correlation/epoch
-绑定的 opaque budget ledger。没有 ledger 或 active phase 不允许 binary I/O 的新
-`query_binary()` 调用必须在 `BEFORE_SEND` 以 `NOT_SENT` 拒绝。现有 `query_bin_block()` 保留
-为 definite block 兼容入口。它在 legacy operation 中使用核心固定的有限兼容上限；在已安装
-R1.3 budget 的新 operation 中必须消耗同一个 response/operation/query/resync budget，不得建立第二套
-兼容额度。新 operation 若无 R1.3 budget，通过 `query_bin_block()` 也必须在发送前拒绝。
-核心冻结 legacy 兼容上限时必须覆盖现有已接受 operation 的合法 payload，或给旧 operation 保留
-独立的有限 spec；不能在没有迁移说明的情况下静默降低既有波形读取上限。
-
-如果 operation 使用 binary profile，则每个参与的 variant 必须提供有限正整数的 response、
-operation-total 和 query-count，以及有限非负整数的 resynchronization 限制；没有 profile 层的 operation 直接使用
-spec 与 connection 的最小值。
-显式 connection 限制使用同一数值规则。上限比较和计数使用整数 bytes，不能用浮点近似
-或按样本点数替代。
-每个 core-validated profile variant 只能声明一个精确 transport trailing byte sequence；
-R1.3 暂定最长 16 bytes，不允许备选集合、正则、回调或「任意空白」。这避免空字符串
-与非空 terminator 形成前缀歧义，导致 backend 在 declared payload 后继续阻塞或吞掉下一响应。
-MESSAGE 只允许空 transport trailing。核心把已验证的精确 sequence 放入 opaque budget，
-插件不得通过 `query_binary()` 参数临时放宽。
-
-实现时必须同时修改 `InstrumentTransport` Protocol、全部 backend、
-`GuardedAuditedTransport`、session `_AUTHORIZED_IO` / `_VERIFICATION_IO`、审计计数器和
-结构化错误映射。`BinaryQueryBudget` 的创建、消费和失效只能由核心 coordinator 完成；
-只给某个 backend 增加方法会绕过核心会话授权，不符合候选合同。
-
-budget 不作为 `query_binary()` 的插件参数。核心 coordinator 在 operation context 中安装
-opaque ledger；每个允许 binary I/O 的非嵌套 phase authorization 只引用它的
-`ledger_id`。`GuardedAuditedTransport.query_binary()` 同时验证 active phase、context/epoch 和
-ledger 绑定，再把已计算的有效上限传给 backend。插件只提交
-`max_bytes <= per_response_max_bytes` 的收紧值；它无法看到、构造或替换 token。guarded
-transport 在同一 transaction lock 内计算
-`effective_query_max = min(max_bytes, per_response_max_bytes, remaining_operation_bytes)`；结果不为正整数或 token
-失效时，在发送前以 `NOT_SENT` 拒绝。guarded transport 在发送前还必须原子预留一个
-`remaining_query_count`；额度为零时不发送。backend 必须以该有效值执行单响应限制；
-成功后再原子扣减 `len(result.data)`，不计 framing header 和已明确限定的 transport trailing。
-扣减前 guarded transport 必须再验证 `len(result.data) <= effective_query_max`、下文的
-精确 consumed 等式和 transport trailing allowlist；backend 返回越界的「成功」结果必须转为
-合同违反并关闭/毒化 session，不得只扣成负额度后交给调用方。
-任何失败一旦已发送 query，都不退回预留的 query count。阶段关闭、失败或切换也不退回
-任何额度。核心测试必须证明 `error_before -> main -> error_after` 三段使用同一 ledger，
-且尝试在新 phase 重建 ledger 会在任何 I/O 前拒绝。
-
-### 2.4 message boundary 的能力证明
-
-`binary.message_boundary` 是「backend 类型 + 具体 resource/session 能力」的联合声明：
-
-| backend | 可声明条件 | 不能作为证据的行为 |
-| --- | --- | --- |
-| PyVISA | 具体 resource 能报告 EOI/message END，且同一锁内可恢复 read termination | 仅有 `read_raw()` 或一次成功的 timeout 读取 |
-| RsInstrument | API 明确报告完整 message/EOI，并能在异常后报告同步状态 | 任意 `query_bin_block()` 成功 |
-| TCP socket | 协议本身声明长度、EOM 或受控 message API | `recv()` 返回短块、idle timeout |
-| serial | 只有设备和 backend 共同声明可证明的 EOM 才能提供 | 暂时没有数据、换行或固定延迟 |
-
-R1.3 暂不批准任何现有 backend 声明 `binary.message_boundary`；上表是进入 conformance fixture
-前必须满足的条件，不是能力白名单。
-
-能力可在 open 时由 backend 静态类型和 resource 属性共同确定；若 backend 无法提供证明，
-必须在发送命令前拒绝 `MESSAGE`，不得通过探测命令猜测。`MESSAGE` 交换应在同一资源锁内
-临时关闭文本 read termination，完成或失败后恢复原设置；恢复失败必须进入 session health
-状态机，不能当作普通 driver 解析错误。
-R1.3 acceptance policy 固定为：termination/read-setting 恢复失败、malformed framing、
-同步未知或超出 resynchronization ceiling 时关闭该 transport 并标记 `poisoned`；只有已经
-证明边界且完成设置恢复的有限失败才允许保留 `uncertain` session。backend 不得以自己的
-错误分类或重连策略改变这一默认。
-
-### 2.5 超限、部分响应和失步
-
-每个 backend MUST 在返回前给出同步结论。规则如下：
-
-1. definite block 头声明的长度超过 `effective_query_max` 时，backend 只有在到已声明
-   payload 末尾的待丢弃字节数不超过 `resynchronization_max_bytes` 时，才能以有界流式读取
-   消费到已证明边界，然后抛出 `TransportIOError(reason_code="binary_limit_exceeded")`。
-   声明长度需要更多丢弃字节时必须立即关闭资源并标记 `poisoned`，不得为保持同步而无界读取。
-2. message 读取超过上限时，只有在额外消费不超过 `resynchronization_max_bytes` 且 backend
-   在此范围内报告已证明的 message END 时，才允许「有界消费后失败」；超过该范围仍未
-   到 EOM 时必须终止资源并把 session 标为 `poisoned`。
-3. timeout、部分响应、终止符恢复失败和 malformed header 必须映射到现有
-   `TransportIOError` 的 `phase`、`response_progress`、`synchronization`、`attempts` 和
-   `replay_policy` 字段；不得重试已经发送且同步未知的完整 query。
-4. R1.3 候选为现有 `TransportIOError` 增加可选的稳定 `reason_code`、非负非 bool
-   `consumed_bytes` 和 `discarded_bytes`。binary `reason_code` 固定为
-   `binary_framing_error`、`binary_limit_exceeded`、`binary_truncated`、`binary_timeout` 或
-   `binary_transport_trailing_error`。它们进入现有脱敏 error envelope，不新建携带 payload 的公共异常。
-   `TransportIOError` 的构造、`with_attempts()` 复制和 envelope 序列化都必须保留这三个
-   字段，不得在 retry 计数时丢失细分原因或字节证据。
-   有界丢弃成功时 `synchronization=proven`，未证明时为 `unproven`，已确认失步或关闭时为
-   `lost`；后两者分别使 session 至少进入 `uncertain` 或 `poisoned`。
-5. R1.3 的 `query_binary(command=...)` 不接受 `ReplayPolicy.READ_CONTINUATION_ONLY`，因为该
-   签名必然携带一个可能被发送的 command；必须在 `BEFORE_SEND` 阶段以 `NOT_SENT` 拒绝。
-   未来若需要 continuation，应设计只接受 core-issued response token 的独立
-   `read_binary_continuation(token, max_bytes=...)`，只消费同一响应且绝不重发 command。
-
-definite block 已消费声明 payload 后发现额外字节时，额外字节不得被当作本次 payload，也
-不得静默丢弃：只有在它们与 core-validated profile 中某个
-`budget.transport_trailing` 精确匹配时，才能作为 `transport_trailing_bytes` 成功返回；
-否则同步状态为 `LOST`，session 进入 `poisoned`。下一次 query 只有在
-backend 明确保留并授权 continuation token 时才可继续。
-
-成功返回使用 `BinaryQueryResult`，从而显式携带 declared/consumed/transport-trailing
-和已证明同步。`data` 只包含 framing 定义的 payload/message。对 definite block，成功必须同时满足：
-
-```text
-declared_length == len(data)
-framing_header_bytes == 2 + N
-transport_trailing_bytes == budget.transport_trailing
-consumed_bytes == framing_header_bytes + len(data) + len(transport_trailing_bytes)
-```
-
-`framing_header_bytes` 必须是非 bool 整数；definite block 中范围为 `3..11`，必须从实际读到的
-`N` 保留，不得从 `declared_length` 反推，因为 length field 可含前导零。
-
-对 MESSAGE，EOM 之前全部字节都属于 `data`；成功必须满足
-`declared_length is None`、`transport_trailing_bytes == b""` 和
-`framing_header_bytes == 0`、`consumed_bytes == len(data)`。MESSAGE 的媒体内容后缀仍属于 `data`，不得改名为 transport
-trailing。任何 backend 在返回前无法
-证明已到达响应边界，都不得构造 `BinaryQueryResult`；必须抛出结构化错误并把 session
-标记为 `uncertain` 或 `poisoned`。因此 `synchronization="proven"` 是成功类型的先决条件，不是
-backend 可以随意填写的默认值。
-成功路径还必须写入 transport audit：`response_progress=complete`、
-`synchronization=proven`、`consumed_bytes`、`transport_trailing_bytes` 长度和 framing；失败还必须记录
-`consumed_bytes`、`discarded_bytes`、`reason_code` 和最终 session health，并继续使用
-`TransportIOError`。现有 `query_bin_block()` 兼容入口只为 definite block 提取 `data`，但
-仍保留 audit metadata。尾随字节不能用 `rstrip()` 静默删除。continuation token 的独立返回
-模型仍是 `[OPEN]`，在此之前成功结果不得暗中留下待续读状态。
-
-### 2.6 内容校验与应用层分块
-
-PNG driver 负责 signature、chunk、IEND、尺寸、MIME type 和 profile 的精确 content-trailing
-校验。SDS800X HD 的实测 raw PNG 在 IEND 后有一个尾字节；在 MESSAGE framing 中，
-该字节仍位于 `BinaryQueryResult.data`。driver 只能在确认 IEND 后按
-`ScopeScreenshotVariant.content_trailing_hex` 精确校验并从规范 PNG 结果中移除，不能把它当作
-transport terminator 或 `transport_trailing_bytes`。
-
-波形多块读取另行携带：
-
-```text
-record_id / acquisition_id
-chunk_index
-offset_samples
-points
-total_points（可选）
-is_last
-```
-
-只有同一 `record_id`、连续 offset、唯一 chunk index 且最终点数一致时才允许拼接。不同
-query 的结果不得无条件拼接；样本格式、字节序和 preamble 解码仍属于 waveform decoder。
-
-## 三、screenshot profile
-
-### 3.1 明确 request tuple
-
-格式、菜单和颜色不是独立笛卡尔积。候选 profile 使用明确支持的 request tuple：
-
-```python
-ScreenshotMenuMode = Literal["device", "include", "exclude"]
-ScreenshotColorMode = Literal["device", "color", "monochrome", "inverted"]
-ScopeScreenshotStateField = Literal["scope.display_menu", "scope.display_color"]
-
-@dataclass(frozen=True)
-class ScopeScreenshotRequest:
-    format: Literal["png"] = "png"
-    menu_mode: ScreenshotMenuMode = "device"
-    color_mode: ScreenshotColorMode = "device"
-
-@dataclass(frozen=True)
-class ScopeScreenshotVariant:
-    request: ScopeScreenshotRequest
-    media_type: Literal["image/png"]
-    framing: BinaryResponseFraming
-    response_max_bytes: int
-    operation_max_bytes: int
-    resynchronization_max_bytes: int
-    changed_fields: tuple[ScopeScreenshotStateField, ...]
-    restore_order: tuple[ScopeScreenshotStateField, ...]
-    snapshot_max_steps: int
-    restore_max_steps: int
-    verify_max_steps: int
-    query_max_count: Literal[1] = 1
-    transport_trailing_hex: str = ""
-    content_trailing_hex: str = ""
-    width_px: tuple[int, int] | None = None
-    height_px: tuple[int, int] | None = None
-
-@dataclass(frozen=True)
-class ScopeScreenshotProfile:
-    variants: tuple[ScopeScreenshotVariant, ...]
-    source: Literal["descriptor", "queried", "combined"] = "descriptor"
-
-@dataclass(frozen=True)
-class ScopeScreenshotStateSnapshot:
-    captured_fields: tuple[ScopeScreenshotStateField, ...]
-    menu_state_token: str | None = None
-    color_state_token: str | None = None
-
-@dataclass(frozen=True)
-class ScopeScreenshotBaseline:
-    context_id: str
-    session_epoch: str
-    baseline_nonce: str
-    snapshot: ScopeScreenshotStateSnapshot
-    restore_order: tuple[ScopeScreenshotStateField, ...]
-
-@dataclass(frozen=True)
-class ScopeScreenshotRestoreResult:
-    status: Literal["completed", "failed", "not_attempted"]
-    attempted_fields: tuple[ScopeScreenshotStateField, ...]
-    restored_fields: tuple[ScopeScreenshotStateField, ...]
-    error_code: str | None = None
-
-@dataclass(frozen=True)
-class ScopeScreenshotVerification:
-    status: Literal["verified", "mismatch", "unavailable"]
-    verified_fields: tuple[ScopeScreenshotStateField, ...]
-    mismatched_fields: tuple[ScopeScreenshotStateField, ...]
-    error_code: str | None = None
-
-@dataclass(frozen=True)
-class ScopeScreenshot:
-    data: bytes
-    media_type: Literal["image/png"]
-    width_px: int
-    height_px: int
-    requested: ScopeScreenshotRequest
-    effective: ScopeScreenshotRequest
-    framing: BinaryResponseFraming
-
-@dataclass(frozen=True)
-class ScopeEmbeddedScreenshotContract:
-    request: ScopeScreenshotRequest
-    changed_fields: tuple[ScopeScreenshotStateField, ...]
-    verification_fields: tuple[ScopeScreenshotStateField, ...]
-    cleanup_verification_fields: tuple[ScopeScreenshotStateField, ...]
-    failure_policy: Literal["fail_parent"] = "fail_parent"
-    artifact_key: Literal["screenshot"] = "screenshot"
-
-class ScopeScreenshotDriver(InstrumentDriver, Protocol):
-    def snapshot_screenshot_state(
-        self,
-        fields: tuple[ScopeScreenshotStateField, ...],
-    ) -> ScopeScreenshotStateSnapshot: ...
-    def capture_screenshot(
-        self,
-        request: ScopeScreenshotRequest,
-        *,
-        baseline: ScopeScreenshotBaseline | None,
-    ) -> ScopeScreenshot: ...
-    def restore_screenshot_state(
-        self,
-        baseline: ScopeScreenshotBaseline,
-    ) -> ScopeScreenshotRestoreResult: ...
-    def verify_screenshot_state_restored(
-        self,
-        fields: tuple[ScopeScreenshotStateField, ...],
-        baseline: ScopeScreenshotBaseline,
-    ) -> ScopeScreenshotStateSnapshot: ...
-```
-
-`variants` MUST 非空，每个 request 只能出现一次；R1.3 首版只接受 `png` / `image/png`。
-两个 byte 上限 MUST 为正数，`resynchronization_max_bytes` MUST 为非 bool 非负整数；
-descriptor variant 的 response/operation/query/resynchronization 值不得超过
-`262144/262144/1/0`，connection 或更严格 profile 只能进一步收紧；
-首版 screenshot 只允许一次
-binary response，因此 `query_max_count == 1` 且
-`operation_max_bytes == response_max_bytes`。尺寸范围的上下界必须为正数且满足
-`min <= max`，固定尺寸使用
-`min == max`。请求未精确匹配一个 variant 时在任何 I/O
-前拒绝。这样不会把 format、menu、color、framing 和 media type 错当成独立笛卡尔积。
-`device` 表示保留仪器当前行为，不等于 `include` 或 `exclude`。R1.3 public profile 必须
-来自 descriptor，或来自 descriptor 与仪器查询结果的 `combined` 交集；`queried`-only
-profile 在 capability discovery 时拒绝。查询结果不得扩大 descriptor 未声明的安全上限，
-结果中的 `effective` 和 variant 必须一致。
-
-声明 `scope.screenshot_profile` 或 `scope.screenshot_v2` 时，
-`InstrumentDescriptor.scope_extensions.screenshot_profile` MUST 非空，并在 factory 阶段通过
-全部静态不变量；`get_screenshot_profile()` 只能返回 descriptor 的原样事实或更严格的
-`combined` 交集。profile provider 缺失、返回 `queried`-only 结果或试图扩大任一上限时，
-capability discovery 必须 fail-closed。
-
-state restore 字段使用以下不变量：
-
-- `changed_fields` 唯一，只包含该 request tuple 实际会修改的 menu/color 字段；
-- `restore_order` 必须与 `changed_fields` 集合相同且无重复；顺序是 driver 恢复写入的唯一事实源；
-- `changed_fields` 为空时，三个 `*_max_steps` 必须全为 `0`；非空时，必须是
-  `1..32` 的非 bool 整数，且分别覆盖 snapshot query、restore write 和 verify query 的
-  最大实际 step 数；
-- snapshot 的 `captured_fields` 必须恰好等于 variant `changed_fields`；menu/color token 必须在
-  对应字段存在时非空，其他情况为 `None`。
-- core-owned `ScopeScreenshotBaseline.restore_order` 必须是已验证 variant 的精确顺序，driver
-  不得自行追加、删除或重排字段。
-
-`transport_trailing_hex` 和 `content_trailing_hex` 都使用小写、偶数长度的精确十六进制，
-每个解码后最长 16 bytes；前者只表示 definite-block framing 后的文档化 transport
-terminator，MESSAGE 必须固定为 `""`。后者表示已位于 MESSAGE payload 或 definite-block
-payload 内的应用内容后缀。driver 必须先完整验证 PNG 到 IEND，再要求 IEND 后字节与
-`content_trailing_hex` 精确相等；不得使用 `rstrip()` 或任意 parser。`ScopeScreenshot.data`
-只返回从 PNG signature 到 IEND 的规范 PNG，不包含 content trailing；artifact 只记录后缀
-长度和 variant 标识。binary response/operation budget 按清理前的完整 payload 计数。
-
-driver 负责格式签名和媒体类型一致性，核心负责上限、artifact 字段和 transport framing。
-非 PNG 格式的完整校验由对应 format handler 定义，不能默认为「任意 bytes 都合法」。
-成功结果的 `width_px` / `height_px` 必须非空、为正整数并落在 variant 的闭区间内；PNG
-handler 必须从已校验的 IHDR 得到尺寸，不能只相信 driver 自报值。
-
-### 3.2 状态副作用与旧接口
-
-若 menu/color 设置会写入前面板状态，`scope.screenshot_v2` 必须记录对应 changed fields、
-恢复覆盖和有效 request。只要 variant `changed_fields` 非空，核心必须在任何写入前调用
-`snapshot_screenshot_state()`，校验返回值后构造 core-owned
-`ScopeScreenshotBaseline(context_id, session_epoch, baseline_nonce, snapshot, restore_order)`，并把同一 baseline 传入
-`capture_screenshot()`。driver 只能使用 baseline 中的已验证字段和顺序。
-若 `changed_fields` 为空，baseline 固定为 `None`，三个 state recovery 方法不得发生 I/O。
-
-无论截图成功、媒体校验失败或 transport 失败，只要 `changed_fields` 非空，核心都必须按
-variant `restore_order` 调用 `restore_screenshot_state(baseline)`，再在独立只读阶段调用
-`verify_screenshot_state_restored(changed_fields, baseline)`。restore result 只证明写入已完成；verify 方法必须
-返回新查询的 `ScopeScreenshotStateSnapshot`，由核心与 baseline snapshot 逐字段比较并生成
-`ScopeScreenshotVerification`。只有全部 changed fields 一致时才能报告恢复成功。主 driver 抛异常不会丢失
-core-owned baseline。恢复或验证失败不覆盖主异常，但 session 不得保持 `healthy`，
-主截图结果也不得伪装为成功。`changed_fields` 为空时，restore/verify 结果固定为
-`not_attempted`/`unavailable` 的无 I/O 记录，不调用这两个需要 baseline 的方法。
-
-`ScopeScreenshotRestoreResult.attempted_fields` 必须遵循 baseline 的 `restore_order` 前缀，
-`restored_fields` 只能是已尝试字段的有序子序列；`status="completed"` 只在所有 changed
-fields 均已写入时成立。restore/verify 抛出的 transport 或协议异常由核心规范化为
-`failed`/`unavailable` 结果，核心不得把该结果当作 query-back 证据。
-
-截图的执行顺序固定为：`preflight snapshot -> main capture -> error_after? ->
-success_restore restore -> cleanup_verification verify`。主 capture 抛异常、PNG 校验失败或
-`error_after` 失败时，主异常优先级最高，但仍必须转入 `failure_cleanup restore ->
-cleanup_verification verify`；没有
-changed fields 时整个 restore/verify 分支为零 I/O。核心只有在 restore result 完成且 verify
-逐字段匹配时，才把 screenshot operation 标为恢复成功。
-
-snapshot、restore 和 verify 分别只能在 `preflight`、`success_restore|failure_cleanup`
-和 `cleanup_verification` 阶段授权中调用；每个授权使用 variant 已验证的 step 上限。
-baseline 的 `context_id`、epoch 或 nonce 不匹配、阶段不匹配、nonce 已消费，或 driver 尝试
-超出 fields/step 时，必须在越界 I/O 前拒绝。
-
-这里的 snapshot → restore → verify 是可复用的 state-recovery 模式，不是 SDS800X HD 私有
-命令合同：不同仪器只需为各自的字段集合定义 typed snapshot/baseline 和 token 编解码，核心
-仍负责授权、字段比较、session health 与 artifact。后续 `CHDR`/`CORD`/`WFSU` 等 transfer
-状态若需要写入，也应复用同一模式，而不是再发明只返回布尔值的 driver helper。
-
-现有 `scope.screenshot` 仅在 profile 明确包含等价旧参数时适配；旧 driver 忽略
-`include_menu` 的行为不能由通用 adapter 静默继承。无法证明参数已生效时必须报告
-`unsupported_capability` 或 `precondition_failed`。
-
-现有 DS1000Z driver 会丢弃 `include_menu`，因此不能宣称满足 `exclude`；RTM2000 driver
-会写入菜单和颜色设置，因此迁移时必须把这两个字段纳入 changed/restore/verification。
-两者不能共享一个不检查 effective request 的旧接口 adapter。
-
-## 四、采集运行状态与控制
-
-### 4.1 组合状态模型
-
-`ScopeAcquisitionStatus` 继续表示平均和分段信息。运行状态使用独立模型，`AUTO/NORMAL/SINGLE`
-是 trigger mode，不是 phase：
-
-```python
-ScopeAcquisitionPhase = Literal[
-    "unknown",
-    "stopped",
-    "ready",
-    "arming",
-    "waiting",
-    "acquiring",
-    "rolling",
-    "stopping",
-    "complete",
-    "error",
-]
-
-ScopeTriggerMode = Literal[
-    "auto",
-    "normal",
-    "single",
-    "roll",
-    "unknown",
-]
-
-ScopeContinuousTriggerMode = Literal["auto", "normal", "roll"]
-ScopeSingleBaselineStage = Literal["configured_pre_arm", "original_atomic_arm"]
-ScopeSingleArmSemantics = Literal["configure_then_arm", "atomic_configure_and_arm"]
-ScopeAcquisitionIdentitySemantics = Literal["unique_within_session_epoch", "unknown"]
-ScopeAcquisitionSettingField = Literal["scope.trigger", "scope.acquisition"]
-ScopeAcquisitionRestoreField = Literal[
-    "scope.run_state",
-    "scope.trigger",
-    "scope.acquisition",
-]
-ScopeStateToken = str
-
-@dataclass(frozen=True)
-class ScopeAcquisitionControlProfile:
-    supported_continuous_modes: tuple[ScopeContinuousTriggerMode, ...]
-    single_arm_semantics: ScopeSingleArmSemantics
-    arm_resets_acquisition_count: bool
-    failure_restore_order: tuple[ScopeAcquisitionSettingField, ...]
-    snapshot_max_steps: int
-    restore_max_steps: int
-    verify_max_steps: int
-    identity_semantics: ScopeAcquisitionIdentitySemantics
-    atomic_arm_preserves_count_mode_semantics: bool = False
-
-@dataclass(frozen=True)
-class ScopeAcquisitionControlSnapshot:
-    run_state: "ScopeAcquisitionRunState"
-    trigger_state_token: ScopeStateToken
-    acquisition_state_token: ScopeStateToken
-
-@dataclass(frozen=True)
-class ScopeAcquisitionControlBaseline:
-    context_id: str
-    session_epoch: str
-    baseline_nonce: str
-    snapshot: ScopeAcquisitionControlSnapshot
-    restore_order: tuple[ScopeAcquisitionRestoreField, ...]
-
-@dataclass(frozen=True)
-class ScopeBaselineRestoreResult:
-    status: Literal["completed", "failed", "not_attempted"]
-    attempted_fields: tuple[ScopeAcquisitionRestoreField, ...]
-    restored_fields: tuple[ScopeAcquisitionRestoreField, ...]
-    error_code: str | None = None
-
-@dataclass(frozen=True)
-class ScopeBaselineVerification:
-    status: Literal["verified", "mismatch", "unavailable"]
-    verified_fields: tuple[ScopeAcquisitionRestoreField, ...]
-    mismatched_fields: tuple[ScopeAcquisitionRestoreField, ...]
-    error_code: str | None = None
-
-@dataclass(frozen=True)
-class ScopeContinuousAcquisitionRequest:
-    trigger_mode: ScopeContinuousTriggerMode
-
-ScopeCompletionProof = Literal[
-    "count_delta_with_epoch",
-    "identity_delta",
-    "state_transition",
-]
-
-@dataclass(frozen=True)
-class ScopeAcquisitionRunState:
-    phase: ScopeAcquisitionPhase
-    trigger_mode: ScopeTriggerMode
-    raw_state: str
-    acquisition_count: int | None = None
-    counter_epoch: ScopeStateToken | None = None
-    acquisition_identity: str | None = None
-
-@dataclass(frozen=True)
-class ScopeAcquisitionCompletion:
-    state: ScopeAcquisitionRunState
-    original_state: ScopeAcquisitionRunState
-    proof_baseline_state: ScopeAcquisitionRunState
-    proof_baseline_stage: ScopeSingleBaselineStage
-    proof: ScopeCompletionProof
-    baseline_count: int | None = None
-    completed_count: int | None = None
-    baseline_identity: str | None = None
-    completed_identity: str | None = None
-    observed_states: tuple[ScopeAcquisitionRunState, ...] = ()
-```
-
-`ScopeAcquisitionControlProfile` 是 descriptor 静态事实，不是 driver 在 operation 中自报的
-动态结果。候选 `InstrumentDescriptor.scope_extensions.acquisition_control_profile` 字段在声明
-`scope.acquisition_control` capability 时 MUST 非空；核心 factory 在第一次仪器 I/O 前
-完成静态校验，并把已验证 profile 传给 Service preflight。R1.3 不允许仪器查询或
-driver 返回值扩大 descriptor profile。
-
-profile 不变量为：
-
-- `supported_continuous_modes` 非空、唯一，且只包含 `auto/normal/roll`；
-- 两个 bool 字段必须是真正的 `bool`；
-- `failure_restore_order` 必须恰好各包含一次 `scope.trigger` 和 `scope.acquisition`；
-  顺序是核心恢复授权与 driver 实现的唯一事实源；
-- 三个 `*_max_steps` 必须是 `1..64` 的非 bool 整数；snapshot/verify 各至少覆盖 run state、
-  trigger 和 acquisition 三次 query，`restore_max_steps` 至少覆盖 STOP 和两个设置恢复写入，
-  但不因此允许超出实际授权 step 数；
-- `single_arm_semantics="configure_then_arm"` 时
-  `atomic_arm_preserves_count_mode_semantics` MUST 为 `false`；
-- `single_arm_semantics="atomic_configure_and_arm"` 时，只有
-  `atomic_arm_preserves_count_mode_semantics=true` 且 `arm_resets_acquisition_count=false` 时，
-  operation verifier 才可以在原始状态确为 `trigger_mode="single"` 时把 count 作为辅助证据；
-- `arm_resets_acquisition_count=true` 时任何 arm 路径都不得使用 `count_delta_with_epoch`；只能使用
-  identity 或状态迁移证据。
-- `identity_semantics="unique_within_session_epoch"` 才允许 `identity_delta`；
-  `unknown` 时核心不得接受 identity proof，只能使用满足本节要求的 state transition。
-
-核心构造 `ScopeAcquisitionControlBaseline` 时必须把固定的
-`("scope.run_state", *profile.failure_restore_order)` 写入 `restore_order`；baseline 中的顺序
-与该展开结果不一致时在第一次 recovery I/O 前拒绝。`ScopeAcquisitionControlSnapshot` 的三个
-字段必须始终齐全，因此 STOP、trigger 和 acquisition 的恢复/验证边界不会依赖 driver 临时
-决定字段集合。
-
-`ScopeStateToken` MUST 是经 driver 规范化的、无换行、不含 resource/序列号的安全 token；不得把
-原始 SCPI、仪器地址或未脱敏响应放入 baseline。`context_id` 负责 operation 归属，
-`session_epoch` 负责连接世代，`baseline_nonce` 负责一次性消费；三者任一不匹配都必须拒绝，
-不得跨 epoch 或 context 重用。`ScopeBaselineRestoreResult` 和 `ScopeBaselineVerification` 是核心可审计的结果，
-不是 driver 可以省略的布尔标记。
-
-`ScopeBaselineRestoreResult.attempted_fields` 必须是 baseline `restore_order` 的前缀，
-`restored_fields` 必须是其中的有序子序列且不得包含额外字段；`status="completed"` 仅在
-所有必需字段均已写入时成立，任何中途失败都必须为 `failed` 并保留已完成字段。
-driver 若在 restore/verify 中抛出 transport 或协议异常，核心必须把它规范化为对应的
-`failed`/`unavailable` cleanup 结果并保留异常证据；不得因为 Protocol 返回类型存在就假定
-调用一定返回。
-核心不得把 `restored_fields` 当作 query-back 证据，必须以随后返回的 snapshot 生成
-`ScopeBaselineVerification`。
-
-`raw_state` MUST 是短、可打印、无换行 token；无法无损映射时使用 `unknown`，不能把相近
-文字硬映射成 `stopped` 或 `complete`。`acquisition_count` 必须是非负、非 bool 整数；
-`counter_epoch`（若有）必须是 `1..64` 个 ASCII safe-token 字符，并在同一次 operation
-中保持可比较；
-`acquisition_identity` 只能是经 driver 校验的短 token，不能包含 resource 或序列号。
-`ScopeAcquisitionRunState` 只描述一次观察，不携带历史完成结论；completion proof 只存在于
-`ScopeAcquisitionCompletion`，防止普通状态查询伪装成某次 SINGLE 已完成。
-成功构造 `ScopeAcquisitionCompletion` 时，首先必须满足所有 proof 共享的终态不变量：
-`state.phase` 属于 `complete/stopped`、`observed_states` 非空且最后一项等于 `state`。
-然后再验证分支：`count_delta_with_epoch` 仅可作为带联合证据的 proof，要求两个 count 都存在、两个
-`counter_epoch` 都存在且相等、满足本节比较规则，并且 `observed_states` 同时证明有效的
-状态迁移；它不再是仅凭模差或正向差值的独立完成证明；
-`identity_delta` 要求新旧 identity 都是 `1..64` 个 ASCII safe-token 字符且不同，
-`state_transition` 要求保留本节的最小观察序列，且不依赖 count；若该分支同时携带 count，
-仍必须提供未变化的 `counter_epoch`，否则核心必须忽略 count 并按纯状态迁移验证。任一终态或证据不完整只能抛出
-`completion_unproven`，不得返回一个携带「不可用」proof 的成功对象。
-`identity_delta` 也不能仅凭两个 token 不同就成立；核心只在已验证 descriptor profile 的
-`identity_semantics="unique_within_session_epoch"` 时接受该 proof。`unknown` 或 profile
-缺失时，即使 fixture 观察到 token 不同，也只能使用完整 `state_transition`，或拒绝完成证明。
-`baseline_count`/`completed_count` 非空时必须分别等于
-`proof_baseline_state.acquisition_count`/`state.acquisition_count`；identity 字段也必须与对应状态一致。
-`original_state` 必须等于 core-owned baseline 中的 `snapshot.run_state`。不能在 completion 外
-额外填一组更有利的 token 来通过 verifier。
-forced trigger 是瞬时 action/event，不是可 query-back 的持久 `ScopeTriggerMode`，因此不进入
-该枚举。执行强制触发时只在 operation artifact 记录 `trigger_action="force"` 及其完成证据，
-不能把仪器随后返回的 mode 伪造成 `forced`。
-
-### 4.2 状态迁移与操作语义
-
-候选状态迁移至少包括：
-
-| 操作/事件 | 允许起始 phase | 预期观察 | 失败语义 |
-| --- | --- | --- | --- |
-| `scope.acquisition_start`（driver: `start_continuous`） | `stopped`、`ready`、`complete` | 写入后回读 `ready`/`arming`/`waiting`/`acquiring`/`rolling` | 写后回读失败，保留 session health 和 cleanup 结果 |
-| `scope.acquisition_single`（driver: `acquire_single`） | `stopped`、`ready`、`complete` | 记录基线，观察新采集状态，再到 `complete/stopped` 且有 proof | 只观察到 arm 不算成功；超时进入失败 cleanup |
-| trigger accepted | `arming`、`waiting`、`ready` | `acquiring` 或 `complete` | 外部变化时回读为 `unknown` |
-| acquisition complete | 已观察到 `arming`、`waiting`、`ready` 或 `acquiring` 中至少一个新采集状态 | `complete` 或 `stopped` 且有 completion proof | 轮询可以跳过瞬时 `acquiring`；只有原本已 `stopped` 不足以证明新采集完成 |
-| normal `scope.acquisition_stop`（driver: `stop_acquisition`） | `stopped`、`ready`、`arming`、`waiting`、`acquiring`、`rolling`、`stopping` 或 `complete` | 回读 `stopped` | 幂等；回读失败时保留 `uncertain`/`poisoned` |
-| recovery STOP | 核心已签发有界 recovery authorization 的 `healthy/uncertain` session；phase 可为 `unknown/error` | 只写 STOP 并回读 `stopped` | 不得向 `poisoned` session 发送；结果只记入 cleanup，不伪装成 normal success |
-| 外部/设备错误 | 任意 | `error` 或 `unknown` | 必须重新查询确认，不能继续普通 I/O |
-
-控制协议建议为：
-
-```python
-class ScopeAcquisitionRunStateDriver(InstrumentDriver, Protocol):
-    def get_acquisition_run_state(self) -> ScopeAcquisitionRunState: ...
-
-class ScopeAcquisitionControlRecoveryDriver(InstrumentDriver, Protocol):
-    def snapshot_acquisition_control(self) -> ScopeAcquisitionControlSnapshot: ...
-    def restore_acquisition_control(
-        self,
-        baseline: ScopeAcquisitionControlBaseline,
-    ) -> ScopeBaselineRestoreResult: ...
-    def verify_acquisition_control_restored(
-        self,
-        baseline: ScopeAcquisitionControlBaseline,
-    ) -> ScopeAcquisitionControlSnapshot: ...
-
-class ScopeAcquisitionControlDriver(
-    ScopeAcquisitionRunStateDriver,
-    ScopeAcquisitionControlRecoveryDriver,
-    Protocol,
-):
-    def start_continuous(
-        self,
-        *,
-        trigger_mode: ScopeContinuousTriggerMode,
-        baseline: ScopeAcquisitionControlBaseline,
-    ) -> ScopeAcquisitionRunState: ...
-    def stop_acquisition(self) -> ScopeAcquisitionRunState: ...
-    def acquire_single(
-        self,
-        *,
-        baseline: ScopeAcquisitionControlBaseline,
-        deadline: float,
-    ) -> ScopeAcquisitionCompletion: ...
-```
-
-核心必须在主操作写入前调用 `snapshot_acquisition_control()`，校验返回值后自行
-构造 `ScopeAcquisitionControlBaseline(context_id, session_epoch, baseline_nonce, snapshot,
-("scope.run_state", *failure_restore_order))`。
-driver 只看到已验证的
-baseline，不能构造或修改 core-owned `session_epoch`。`start_continuous()` 和
-`acquire_single()` MUST 使用核心传入的同一 baseline，不得在内部替换为无法审计的另一份
-baseline。因此，即使主 driver 方法抛出异常，核心仍保留恢复所需的类型化状态。
-
-`restore_acquisition_control()` 的固定语义是：先发送 STOP，再按
-`failure_restore_order` 恢复
-`scope.trigger` 和 `scope.acquisition`；不得恢复 snapshot 中的运行 phase。
-`ScopeBaselineRestoreResult.restored_fields` 只表示恢复写入已完成，不是 query-back 证据。
-核心必须随后使用独立只读阶段调用 `verify_acquisition_control_restored()`；成功需要
-driver 必须返回新查询的 `ScopeAcquisitionControlSnapshot`，不得直接返回布尔结论。
-核心 verifier 据此生成 `ScopeBaselineVerification`：`scope.run_state` 必须已为 `stopped`，
-且 trigger/acquisition token 与 baseline snapshot 精确相等。只有
-restore 和 verification 全部成功时 session 才能恢复 `healthy`。
-
-`start`/`single` 的失败执行顺序固定为：
-
-1. 在 `preflight` 保存并验证 baseline；关闭 preflight authorization 后执行 `main`。
-2. 若 driver 抛异常、deadline/cancel 触发，或主调用已返回但 `error_after` 判定失败，先保存
-   该主异常并禁止把它改写为 cleanup 结果。
-3. 在 session 为 `healthy/uncertain` 且 epoch 未变化时，关闭当前 authorization，依次开启
-   `failure_cleanup` 和 `cleanup_verification` phase；前者调用
-   `restore_acquisition_control(baseline)`，后者调用
-   `verify_acquisition_control_restored(baseline)` 并由核心比较 snapshot。
-4. restore 或 verification 任一步失败，最终结果仍保留第 2 步主异常（若无主异常则报告
-   recovery failure），session 保持 `uncertain/poisoned`；若 session 已 `poisoned`，两步均
-   记录 `not_attempted`，不得发送 STOP。
-
-成功的 `start`/`single` 不执行上述 baseline restore；它们分别验证声明的 postcondition，
-只在失败、取消、超时或 after-error cleanup 路径恢复调用前的 trigger/acquisition 设置。
-
-snapshot、restore、verify 三个方法分别只能在 `preflight`、`failure_cleanup` 和
-`cleanup_verification` 阶段授权中调用。`failure_cleanup` 允许文本 write，
-`cleanup_verification` 只允许文本 query；两者都不允许 binary I/O。任一方法在未授权阶段被调用，
-或 baseline 的 context/epoch/nonce 与当前 context 不同，必须在发送前拒绝；一次 restore 尝试
-结束后不得再次使用同一 baseline。
-
-`start_continuous()` 不保留一个未知或 `single` trigger mode。请求必须显式选择
-`auto`、`normal` 或 `roll`，并且该 mode 已在核心校验的
-`ScopeAcquisitionControlProfile.supported_continuous_modes` 中声明。
-核心必须先持有 `ScopeAcquisitionControlBaseline`，再把其 snapshot 传入 driver。driver 写入
-目标 mode 并 query-back，然后才发送连续运行 action。成功结果必须同时回读
-`state.trigger_mode == request.trigger_mode` 和允许的运行 phase；
-仅发送 RUN、保留 `single` 后再采一次，不得报告为 continuous success。
-
-`acquire_single()` 是等待完成的 acquire operation，不是 arm-only 写操作。它必须分开两种 baseline：
-
-- `original_state`：任何 operation 写入前读取，用于 artifact 和失败 cleanup；
-- `proof_baseline_state`：用于 completion proof 的最后一个 pre-arm 观察。若仪器可分开「配置
-  SINGLE」和「真正 arm/RUN」，driver 必须先写入 SINGLE、query-back，再读取同 mode 的
-  count/identity，并标记 `proof_baseline_stage="configured_pre_arm"`。
-
-`proof_baseline_stage="configured_pre_arm"` 必须对应
-`single_arm_semantics="configure_then_arm"`；`proof_baseline_stage="original_atomic_arm"` 必须对应
-`single_arm_semantics="atomic_configure_and_arm"`。核心 result verifier 必须与已验证 descriptor
-profile 比对，不得信任 driver 自行选择更宽松的 stage。
-
-如果仪器的单条命令不可分地同时配置并 arm，则
-`proof_baseline_stage="original_atomic_arm"` 且 `proof_baseline_state == original_state`。该路径只有在
-original 已为 `trigger_mode="single"`，且 `ScopeAcquisitionControlProfile` 同时声明
-`single_arm_semantics="atomic_configure_and_arm"`、
-`atomic_arm_preserves_count_mode_semantics=true` 和 `arm_resets_acquisition_count=false` 时，
-才能把 count 作为辅助证据；最终 proof 仍必须同时满足未变化的 `counter_epoch` 和有效
-`state_transition`。否则必须改用 identity delta 或完整的 state transition。
-
-真正 arm 后，Service/driver 在同一 deadline 内等待新 acquisition 完成。只有看到有效
-identity 变化，或看到 R1.3 暂定的最小状态序列后，才能成功返回 completion
-proof；调用前本来就是 `stopped` 不能单独作为完成条件。没有 completion proof 时
-返回 `completion_unproven`，不得返回成功 waveform。
-
-R1.3 暂定的最小 `state_transition` proof 为：SINGLE 写入并 query-back 后至少观察一次
-`arming`、`waiting` 或 `acquiring`；也可以观察 `ready`，但必须同时回读
-`trigger_mode="single"`，且 `(phase, trigger_mode)` 不得与 `proof_baseline_state` 相同。随后必须观察
-`complete` 或 `stopped`。如果仪器把
-写后第一个查询直接返回 `stopped`，且 count/identity 均不变或不可用，则 completion
-unproven。后续若跨厂商 fixture 证明该序列仍不通用，应保持 `[OPEN]`，不得由单个插件放宽。
-
-arm-only API 不属于 R1.3；未来如确有非阻塞需要，应新增 `scope.acquisition_arm_single`，其
-effect 为 `write`、成功输出只证明已 arm，不能复用 `scope.acquisition_single` 的成功合同。
-
-count 比较使用 `proof_baseline_state` 的同一 acquisition mode 基线。新 count 大于基线只可作为
-`count_delta_with_epoch` 的辅助条件；它还必须满足 `counter_epoch` 非空且未变化，并与有效
-`state_transition` 联合，不能单独证明完成。`counter_epoch` 缺失、改变或无法证明连续时，
-必须改用 `identity_delta` 或完整的 `state_transition` proof。count 因
-`ScopeAcquisitionControlProfile.arm_resets_acquisition_count=true` 而下降或归零时，不能使用
-  `count_delta_with_epoch`。当前首版不接受 modulus，也不尝试用模差区分真实回绕、计数器复位或仪器重启；任何
-`completed_count <= baseline_count` 都使 count 辅助条件失效。mode 改变、仪器重启、前面板重置或
-疑似回绕会使原 baseline 失效，不能沿用旧 count。
-
-`stop_acquisition()` MUST 幂等：已经 `stopped` 时可直接成功，但仍应返回观察到的状态；非
-`stopped` 时必须写入并 query-back。一个 session 同时只允许一个 control operation，且控制
-操作使用 exclusive lease。
-
-### 4.3 deadline、取消和恢复
-
-等待 deadline 来自 operation request；若调用方未给出，R1.3 使用第 1.2 节固定的
-`SCOPE_ACQUISITION_OPERATION_TIMEOUT_MS`。调用方只能提供更早的绝对 deadline，不能延长它；
-每次轮询和 STOP I/O 继续取 connection timeout 与剩余 deadline 的较小值。当前核心没有该
-operation timeout source 时，只允许作为内部 feature-gated 基础设施实现，不得注册
-`scope.acquisition_*` capability。
-
-超时或取消时：
-
-1. 保留主异常和最后一次观察状态；
-2. 在 session `healthy` 或 `uncertain` 且核心已授权 recovery transaction 时，best-effort
-   执行 `STOP` 并 query-back；
-3. 若 session 已 `poisoned`，普通 STOP I/O 必须继续被 gate 拒绝，应关闭并重新建立连接，
-   不得从插件直接访问 backend session；
-4. cleanup 的成功、失败和最终 `SessionHealth` 写入 artifact，但不能覆盖原始 timeout/cancel
-   异常。
-
-recovery STOP 不复用 normal operation 的 `phase != unknown/error` 前置条件：核心可以在
-`healthy/uncertain + unknown/error phase` 下签发有界 recovery authorization，但必须限制 I/O 种类、字段、
-step 数和 deadline，并要求 STOP 后只读 query-back。`poisoned` session 永远不能获得该授权。
-recovery authorization 不继承主请求的 `ErrorCheckSpec`，错误队列检查固定为
-`disabled / not_applicable`；否则 before drain 可能拦住本应执行的安全 STOP，也会超出授权的
-STOP + query-back I/O 白名单。
-normal `scope.acquisition_stop` 仍要求 healthy session 和可识别 phase，不能借 recovery 规则
-绕过普通 access/capability gate。
-
-现有 `capture_waveform(s)` 仍是 vendor transaction。核心不能仅凭三项控制方法重新拼装它，
-因为通道配置、一次 acquisition 的多通道一致性、transfer 临时状态和恢复仍属于 driver
-合同。
-
-多通道 capture MUST 证明所有通道来自一次 trigger transaction 和同一停止记录。优先使用
-同一 `acquisition_identity`；无法提供 identity 时，必须由同一 SINGLE 写入计数、count delta
-和逐通道读取期间未再次触发的 audit evidence 组成 `shared_acquisition_proof`。部分通道失败时
-artifact 应记录 `completed_channels`、`failed_channel`、`shared_acquisition_proof` 和是否发生
-重采集，禁止为了补齐缺失通道而隐式重新触发。
-
-## 五、类型化 trace source 与数据不变量
-
-### 5.1 source、轴和 operation
-
-候选模型保留 `spectrum` 字面量，用受限的 FFT operation 描述产生方式；这比把 FFT
-伪装成模拟 channel 更明确。但 R1.3 acceptance scope 不注册或迁移 `spectrum`、`math` 和
-`fft_phase`；它们只作为未来 trace-extensions RFC 的非读取 metadata 预留。是否把
-`spectrum` 拆为独立 `fft` kind、单位模型如何复用核心，均不阻塞本轮 M1 内部基础设施，
-但也不能据此宣称 R1.3 全部 trace 合同已冻结。
-
-```python
-ScopeTraceKind = Literal["analog", "digital", "math", "reference", "spectrum"]
-ScopeAxisKind = Literal["time", "frequency", "index", "unknown"]
-ScopeAxisUnit = Literal["s", "Hz", "1", "unknown"]
-ScopeTraceUnit = Literal[
-    "v",
-    "mv",
-    "db",
-    "dbm",
-    "1",
-    "unknown",
-]
-ScopeTraceMagnitudeSemantics = Literal["absolute", "relative", "linear", "unknown"]
-ScopeTraceOperation = Literal[
-    "identity",
-    "reference_copy",
-    "fft_magnitude",
-    "fft_phase",
-    "device_other",
-    "unknown",
-]
-
-@dataclass(frozen=True)
-class ScopeTraceRef:
-    kind: ScopeTraceKind
-    index: int | None = None
-    name: str | None = None
-```
-
-`index` 和 `name` MUST 恰有一个有效值。公共编号按 kind 固定：analog、math、reference 和
-spectrum index 使用 one-based `1..65535`；digital index 使用 zero-based `0..15`，并与 bit N
-一致；所有 index 都不能是 `bool`。具体仪器 profile 只能收紧范围，不能改变基准。`name`
-必须包含 `1..64` 个 Unicode code point、去除首尾空格后不变、全部可打印且不得含控制字符。
-厂商 token 只存在于 driver，不进入公共模型。
-
-```python
-@dataclass(frozen=True)
-class ScopeAxisMetadata:
-    kind: ScopeAxisKind
-    unit: ScopeAxisUnit
-    start: float | None
-    increment: float | None
-    points: int
-
-@dataclass(frozen=True)
-class ScopeTraceMetadata:
-    source: ScopeTraceRef
-    x_axis: ScopeAxisMetadata
-    y_unit: ScopeTraceUnit
-    y_semantics: ScopeTraceMagnitudeSemantics
-    value_encoding: Literal["real", "digital_bitmask"]
-    y_increment: float | None = None
-    y_origin: float | None = None
-    y_resolution_bits: int | None = None
-    operation: ScopeTraceOperation = "unknown"
-    inputs: tuple[ScopeTraceRef, ...] = ()
-    digital_channels: tuple[int, ...] = ()
-    fetchable: bool = False
-
-@dataclass(frozen=True)
-class ScopeTraceData:
-    metadata: ScopeTraceMetadata
-    values: np.ndarray
-
-ScopeTraceTransferField = Literal[
-    "scope.run_state",
-    "scope.waveform_source",
-    "scope.waveform_mode",
-    "scope.query_response_header",
-    "scope.waveform_format",
-    "scope.waveform_byte_order",
-    "scope.waveform_points",
-    "scope.waveform_transfer_window",
-]
-
-@dataclass(frozen=True)
-class ScopeTraceTransferStateSnapshot:
-    captured_fields: tuple[ScopeTraceTransferField, ...]
-    run_state_token: ScopeStateToken | None = None
-    waveform_source_token: ScopeStateToken | None = None
-    waveform_mode_token: ScopeStateToken | None = None
-    query_response_header_token: ScopeStateToken | None = None
-    waveform_format_token: ScopeStateToken | None = None
-    waveform_byte_order_token: ScopeStateToken | None = None
-    waveform_points_token: ScopeStateToken | None = None
-    waveform_transfer_window_token: ScopeStateToken | None = None
-
-@dataclass(frozen=True)
-class ScopeTraceTransferBaseline:
-    context_id: str
-    session_epoch: str
-    baseline_nonce: str
-    snapshot: ScopeTraceTransferStateSnapshot
-    restore_order: tuple[ScopeTraceTransferField, ...]
-
-@dataclass(frozen=True)
-class ScopeTraceTransferRestoreResult:
-    status: Literal["completed", "failed", "not_attempted"]
-    attempted_fields: tuple[ScopeTraceTransferField, ...]
-    restored_fields: tuple[ScopeTraceTransferField, ...]
-    error_code: str | None = None
-
-@dataclass(frozen=True)
-class ScopeTraceTransferVerification:
-    status: Literal["verified", "mismatch", "unavailable"]
-    verified_fields: tuple[ScopeTraceTransferField, ...]
-    mismatched_fields: tuple[ScopeTraceTransferField, ...]
-    error_code: str | None = None
-
-@dataclass(frozen=True)
-class ScopeTraceProfile:
-    fetchable_kinds: tuple[Literal["analog", "digital", "reference"], ...]
-    max_points: int
-    restore_order: tuple[ScopeTraceTransferField, ...]
-    snapshot_max_steps: int
-    restore_max_steps: int
-    verify_max_steps: int
-    source_index_max: int = 65535
-
-class ScopeTraceTransferRecoveryDriver(InstrumentDriver, Protocol):
-    def snapshot_trace_transfer_state(
-        self,
-        fields: tuple[ScopeTraceTransferField, ...],
-    ) -> ScopeTraceTransferStateSnapshot: ...
-    def restore_trace_transfer_state(
-        self,
-        baseline: ScopeTraceTransferBaseline,
-    ) -> ScopeTraceTransferRestoreResult: ...
-    def verify_trace_transfer_state_restored(
-        self,
-        baseline: ScopeTraceTransferBaseline,
-    ) -> ScopeTraceTransferStateSnapshot: ...
-
-class ScopeTraceMetadataDriver(InstrumentDriver, Protocol):
-    def get_trace_metadata(self, source: ScopeTraceRef) -> ScopeTraceMetadata: ...
-
-class ScopeTraceDriver(
-    ScopeTraceMetadataDriver,
-    ScopeTraceTransferRecoveryDriver,
-    Protocol,
-):
-    def fetch_trace(
-        self,
-        source: ScopeTraceRef,
-        *,
-        points: str | int = "dmax",
-        baseline: ScopeTraceTransferBaseline | None,
-    ) -> ScopeTraceData: ...
-```
-
-`ScopeTraceProfile` 是 descriptor 必须提供的静态事实；`fetchable_kinds` 只能是
-`analog`、`digital`、`reference` 的非空唯一子集，`max_points`、`source_index_max` 和三个
-`*_max_steps` 是有限正整数。`restore_order` 必须唯一，并覆盖 profile 允许临时改变的所有
-transfer fields；每个 operation 的 baseline 只保留实际 changed fields 的有序子集，不能由
-driver 临时决定顺序。
-它必须位于 `InstrumentDescriptor.scope_extensions.trace_profile`；driver 或运行时 metadata
-不得新增 fetchable kind、提高 points/index 上限或改变编号基准。
-R1.3 不把 `math`、`spectrum` 或 `fft_phase` 放入可注册的 fetch profile；它们可以继续出现在
-`ScopeTraceMetadata` 的非读取结果中，但必须为 `fetchable=false`。
-
-`ScopeTraceTransferStateSnapshot.captured_fields` 必须唯一，且每个字段对应的 token 恰好在
-字段存在时非空；`restore_order` 必须与实际 changed field 集合相同且无重复。核心在
-`preflight` 读取 snapshot 并构造带 context/epoch/nonce 的 `ScopeTraceTransferBaseline`，在
-`success_restore` 或 `failure_cleanup` 调用 restore，再在 `cleanup_verification` 调用 verify。
-verify 方法必须返回 fresh snapshot，由核心逐字段生成 `ScopeTraceTransferVerification`；不得
-用 `ScopeTraceTransferRestoreResult` 的写入记录代替 query-back。context、epoch、nonce、phase
-或一次性消费状态不匹配时，必须在 transfer I/O 前拒绝。上述接口同样覆盖 `CHDR`、`CORD`、
-`WFSU` 或其他等价 transfer 状态，不允许只为某一厂商保留私有恢复 helper。
-`attempted_fields` 必须是 baseline `restore_order` 的前缀，`restored_fields` 只能是已尝试字段
-的有序子序列；restore/verify 抛出的异常由核心规范化为 `failed`/`unavailable`，且不得覆盖
-主 fetch 异常。
-
-### 5.2 R1.3 trace acceptance scope
-
-R1.3 首轮公共 trace 只接受 descriptor 明确声明的 `analog`、`digital` 和 `reference`，以及
-已冻结的 `time`/`index` 轴和现有核心可表达的单位。`ScopeTraceProfile.fetchable_kinds` 是
-唯一可注册边界；`spectrum`、`math`、`fft_phase`、频率轴和新增单位即使仍保留在模型字面量中，
-也必须 `fetchable=false`，不得进入 capability registry 或插件迁移。后续 RFC 冻结 kind、
-axis、unit 和序列化后，才能扩展 profile；这项排除不影响本 RFC 对 binary/恢复基础设施的
-内部实现资格。
-
-### 5.3 数组、单位和语义约束
-
-- `points` MUST 等于 `len(values)`；values MUST 是一维、非空数组。
-- axis 的 `points >= 1`。`time`、`frequency` 和 `index` 的 `start`、`increment` 必须
-  finite，`increment > 0`，计算出的最后一个坐标也必须 finite；`unknown` 的 `start` 和
-  `increment` 必须为 `None`。
-- 未来 `frequency` 轴 profile 仅接受 one-sided、严格递增、非负频率；DC 可从 `0 Hz` 开始。
-  负频率、中心化双边 FFT 和降序轴需要后续 axis profile，不能通过负 increment 偷渡；该轴
-  不属于 R1.3 公共 fetch scope。
-- `analog`、`math`、`reference` 和 `spectrum` 的未来实现使用 finite、real、`float64` 值；核心应复制
-  并设置只读，不能把 driver 的可变数组直接暴露给调用方。首版明确拒绝 complex dtype，
-  FFT 的复数结果必须选择 magnitude 或 phase 语义后再进入模型。
-- `digital` 使用无符号整数 bitmask（首版上限 `uint16`），并在 metadata 中说明有效 bit
-  与 `digital_channels` 的映射；`digital_channels` 必须非空、唯一且位于 `0..15`，bit N 对应
-  digital channel N。R1.3 首版的 fetchable digital source 只支持
-  `ScopeTraceRef(kind="digital", index=N)` 的单线语义：`digital_channels == (N,)`，
-  每个样本只能是 `0` 或 `1 << N`。具名 bus/group 和多 bit 同步 bitmask 需要独立
-  source kind/profile，在此之前只能保持 `fetchable=false` 或继续使用旧
-  `ScopeDigitalWaveform`。非 digital trace 的 `digital_channels` 必须为空，不把数字值编码成浮点电压。
-- `time` 轴使用 `s`，`frequency` 轴使用 `Hz`，`index` 轴使用 `1`；未知轴只能使用
-  `unknown`，不能同时声称精确的 start/increment 换算。`kind` 与 unit 不匹配时必须拒绝，
-  不能把 `Hz` 当作任意显示标签。
-- `y_unit` 只冻结首版 token：`v`、`mv`、`db`、`dbm`、`1` 和 `unknown`。其中
-  `dbm/absolute`、`db/relative`、`v|mv/linear` 沿用核心
-  `MagnitudeUnit` / `MagnitudeSemantics` 规则；`1` 仅由新增的 digital-bitmask verifier
-  校验，不能冒充现有 `MagnitudeUnit`。电流 `a`、相位 `degree` 和百分比 `percent` 需要先
-  扩展核心单位模型，不能在 R1.3 中以任意字符串或未经校验的新增 token 进入公共
-  `ScopeTraceData`。无法证明时使用 `unknown/unknown`。
-- `digital_bitmask` 的 y unit 固定为 `1`，semantics 为 `unknown`；`spectrum` 的 dB/dBm
-  结果必须明确 absolute/relative，不能只给一个 dB 字符串。`fft_phase` 在相位单位扩展
-  被核心接受前只能作为设备私有 metadata（或以 `unknown` 单位返回），不得宣称跨仪器可比较。
-- `analog` 和 `digital` 的 `operation` MUST 为 `identity` 且 `inputs` 为空；`reference` 的
-  `identity` 也必须没有 input，`reference_copy` 恰有一个 input；`fft_magnitude` 和
-  `fft_phase` 恰有一个 input。R1.3 不冻结通用
-  `add`、`subtract`、`multiply`、`divide`、`differentiate` 或 `integrate`；这些运算及其
-  输入计数、单位代数移入独立的 trace operation/unit-algebra RFC。
-- `math` 在 operation catalog 和单位语义冻结前只能使用 `device_other` 或 `unknown`；核心
-  不得据此推导可移植的算术语义，且 `device_other`/`unknown` 的 `inputs` 必须为空。
-  `reference` 只有 `identity`（设备原生 reference）或
-  `reference_copy`（明确复制另一 source）两种首版语义。
-- 未来 `spectrum` 的 operation MUST 为 `fft_magnitude` 或 `fft_phase`，且 x 轴 MUST 为
-  `frequency`。`get_trace_metadata()` 可以为尚不可读取的 math/source 返回
-  `device_other`/`unknown`，但必须标记 `fetchable=false`；`fetch_trace()` 只接受
-  `fetchable=true` 且满足对应 kind/operation 不变量的 metadata。`device_other` 和 `unknown`
-  不得进入成功的 `ScopeTraceData`，也不能声称结果可跨仪器比较。
-- `y_increment`、`y_origin` 同时为 `None` 或同时为 finite float；`y_increment` 不得为零。
-  `y_resolution_bits` 为 `None` 或 `1..64` 的非 bool 整数。`digital_bitmask` 的三项 y
-  scaling 字段必须全部为 `None`；real trace 若提供 resolution，必须同时提供 increment/origin。
-- `fetchable=true` 的 R1.3 kind 组合只有：analog/reference + time + `v|mv/linear`，以及
-  digital + time + `1/unknown`。math、spectrum、`fft_phase`、frequency、未知轴、未知单位或
-  `device_other/unknown` operation 只能返回 `fetchable=false` metadata；不能进入成功的
-  `ScopeTraceData`。
-
-### 5.4 迁移和读取前置条件
-
-现有模型的单向迁移建议如下：
-
-| 现有模型 | 候选 trace 映射 | 约束 |
-| --- | --- | --- |
-| `WaveformData` | `analog` | 保留原 `fetch_waveform`；反向适配只允许 analog |
-| `ScopeDigitalWaveform` | `digital` | 单通道可映射为 `index=N`；多通道 bitmask 保留旧模型，不伪装成单线 trace |
-| `ScopeDerivedWaveformMetadata` | `math` 或 `reference` metadata | 不把 `source_kind` 丢失 |
-| `ScopeFftStatus` + 频域数据 | `spectrum` | `ScopeFftStatus` 继续兼容；R1.3 只保留 `fetchable=false` metadata，频率轴单独表达留给后续 RFC |
-
-`fetch_trace()` 是 query/read operation，但若需要临时改变 source、transfer window 或停止
-采集，必须声明相应 `changed_fields` 和恢复覆盖。默认前置条件为：source 已配置、必要时
-acquisition 已停止、sequence/segmentation 状态与 source 合同一致、points 属于 descriptor
-`ScopeTraceProfile.max_points`、
-错误检查策略已解析。前置条件失败必须发生在任何 transfer 写入或 binary query 前。
-对只声明普通非分段记录的 `fetch_trace` 和现有 `fetch_waveform`，sequence ON 必须返回
-`precondition_failed` 或 `unsupported_state`；SDS804X HD 已提供零 waveform 写入、零 binary
-query 的实机拒绝证据，但该规则仍需第二个厂商 fixture。
-
-`ScopeTraceMetadataDriver.get_trace_metadata()` 和 `ScopeTraceDriver.fetch_trace()` 是 R1.3
-正式候选 Protocol 方法，不再是仅供说明的自由函数。声明 `scope.trace_metadata` 时，driver
-MUST 实现 `ScopeTraceMetadataDriver`；声明 `scope.fetch_trace` 时，driver MUST 同时实现
-`ScopeTraceDriver`、`ScopeTraceTransferRecoveryDriver`，并由 descriptor 提供已验证的
-`ScopeTraceProfile`。若 fetch operation 没有 changed transfer fields，`baseline` 固定为
-`None`；只要任一 transfer field 可能改变，核心必须传入本 context 的
-`ScopeTraceTransferBaseline`，driver 不得自行 snapshot 或替换 baseline。
-
-`fetch_trace()` 的成功路径固定为：`preflight snapshot -> main transfer/fetch ->
-error_after? -> success_restore restore -> cleanup_verification verify`。主 fetch、binary 校验或
-after error 失败时，保留主异常并执行 `failure_cleanup restore -> cleanup_verification verify`；
-restore/verify 任一步失败不得覆盖主异常，且 session 不能恢复为 `healthy`。恢复结果和 fresh
-snapshot 必须写入父 operation artifact，不能只记录「transfer 已恢复」布尔值。
-
-`fetch_trace()` 属于 `core_v1` 错误策略执行路径，因此 driver 签名不再携带
-`check_errors`；核心在调用前后负责第六节的错误检查。旧 `fetch_waveform(...,
-check_errors=bool)` 通过 legacy adapter 迁移，不能把两个执行者混入同一 transaction。
-
-## 六、错误检查策略与 artifact
-
-### 6.1 策略模型
-
-现有 `scope.check_errors: bool` 保持兼容。候选配置扩展为：
-
-```python
-ErrorCheckPolicy = Literal["required", "if_supported", "disabled"]
-ErrorCheckTiming = Literal["before", "after", "before_and_after"]
-InstrumentErrorPolicy = Literal["fail", "record_and_continue"]
-
-@dataclass(frozen=True)
-class ErrorCheckSpec:
-    policy: ErrorCheckPolicy
-    timing: ErrorCheckTiming = "before_and_after"
-    max_records: int = 16
-    on_instrument_error: InstrumentErrorPolicy = "fail"
-```
-
-候选 `ErrorCheckSpec` 包含 `policy`、`timing`、`max_records` 和 `on_instrument_error`；上面的
-默认值是 R1.3 acceptance candidate；当前核心配置仍不因本文改变。`max_records` MUST 为非 bool 整数，范围固定为
-`1..256`；`256` 是核心硬上限，仪器、插件和调用方只能收紧。首版只提供完整 drain：
-读到「无错误」终止 token 或达到上限；不提供会绕过检查的 `none`，也不提供无法证明队列
-完整性的 `one`。自动 clear 和 peek 都不进入首版合同。
-下表的 capability 对 R1.3 `core_v1` 路径专指 `scope.error_drain_v1`；只有旧
-`scope.errors` 不构成「明确支持」。
-
-| 策略 | capability 明确支持 | capability 明确不支持 | capability 未知 |
-| --- | --- | --- | --- |
-| `required` | 按 timing 执行；空队列是成功 | 在 I/O 前拒绝 | 在能力发现完成前拒绝 |
-| `if_supported` | 实际执行检查 | 不发送探测命令，记录 `status=skipped` 和 `reason_code=unsupported` | 在 I/O 前拒绝，记录 `status=rejected` 和 `reason_code=unknown_capability` |
-| `disabled` | 不发送错误队列查询 | 不发送 | 不发送 |
-
-`check_errors=true` 映射为 `required`，`false` 映射为 `disabled`。`if_supported` 不能简单
-等价于 `false`：有 capability 时必须查询，查询失败也必须报告真实 failure，而不是
-`unsupported`。普通 transport/protocol/instrument response error 不因 `disabled` 而被吞掉。
-`disabled` 完全忽略 `scope.error_drain_v1` 和旧 `scope.errors` capability，不执行错误检查，
-也不存在 unavailable 拒绝；
-这条规则保留 SDS800X HD 的 `check_errors=false` 行为。
-
-`on_instrument_error` 不是任意调用方可自由组合的容错开关。核心在解析策略后根据
-`OperationSpec.effect` 做静态校验：R1.3 只允许 `observe` 或 `stateful_read` operation 使用
-`record_and_continue`；`write` 和 `acquire` 只能使用 `fail`。recovery transaction 按第 4.3 节固定为
-`disabled`，不执行错误队列 I/O。因此
-错误检查不能把一个已经发生设备错误的写操作伪装成成功。
-
-配置优先级从强到弱为：`OperationSpec` 最低策略、单 operation 显式覆盖、仪器全局策略、
-旧布尔配置映射。策略强度为 `required > if_supported > disabled`；低优先级或调用方参数不能
-削弱 `OperationSpec` 的最低要求。未配置新字段时继续使用旧布尔映射，默认行为不改变。
-
-`if_supported` 的未知能力固定使用 `unknown_capability`，在任何 I/O 前拒绝，不得由插件选择性
-试探。`on_instrument_error="record_and_continue"` 在 R1.3 只允许用于 `observe` 或
-`stateful_read`；`write` 和 `acquire` 必须使用 `fail`，recovery operation 必须使用 `disabled`，
-核心在零 I/O 前拒绝不相容配置。`on_instrument_error` 只处理成功读出的设备错误记录；
-错误队列查询本身的 transport/session/protocol failure 始终中止当前 operation，不得被
-`record_and_continue` 吞掉。
-
-每次 operation 只能有一个错误检查执行者，由 descriptor capability 和 driver 合同在
-factory 阶段固定：
-
-- `legacy_driver`：核心只做 capability gate，把旧 bool 交给 driver；核心不得再 drain 一次，
-  该路径只适用于已有 operation，artifact 必须标记 `executor=legacy_driver` 和
-  `status=legacy_unstructured`，不得伪造 R1.3 `checks`；
-- `core_v1`：descriptor 必须声明 `scope.error_drain_v1`，factory 必须验证下文
-  `ScopeErrorDrainDriver` Protocol。核心按 timing 调用唯一的 `drain_errors()`；新版主 operation
-  driver 签名不带 bool，或兼容
-  adapter 固定传 `check_errors=False`，driver MUST NOT 再查询队列。
-
-只声明旧 `scope.errors` 不能自动适配为 `scope.error_drain_v1`；`list[str]` 无法证明终止 token、
-查询次数或类型化记录。R1.3 新候选 operation 在有效策略不是 `disabled` 时只允许
-`core_v1`；现有 operation 才可在版本门内继续使用 `legacy_driver`。迁移测试必须按 operation
-断言错误队列查询次数，避免 core 和 driver 双重 drain。现有公共
-`scope.errors` 本身是消耗性 `stateful_read`，其 `OperationSpec` 也必须增加
-`changed_fields=("scope.error_queue",)` 和 legacy artifact；其 `OperationRequest.error_check` 必须为
-`None`，不得在读错误队列前后递归套用 `ErrorCheckSpec`。其旧 `list[str]` 成功值保持兼容，
-若未来需要公开类型化 direct-drain 结果，应新增 operation，不得改变旧返回类型。
-旧 driver 即使在内部读到某个厂商终止 token，核心也不得由 `list[str]` 反推通用终止证据或
-真实 query 次数。
-
-现有 `scope.errors` 的候选兼容规格固定为：`effect="stateful_read"`、
-`changed_fields=("scope.error_queue",)`、`verification_fields=()`、
-`OperationRequest.error_check=None`，成功值仍为 `list[str]`。核心只记录
-`legacy_unstructured` operation-specific artifact；`terminated` 与 `query_count` 始终为
-`null`。该规格不继承 `scope.error_drain_v1` 的 phase、`max_records+1` 或 typed result。
-
-直接调用旧 `scope.errors` 时，operation-specific artifact 固定使用：
-
-```json
-{
-  "executor": "legacy_driver",
-  "capability": "scope.errors",
-  "status": "legacy_unstructured",
-  "requested_limit": 16,
-  "returned_record_count": 3,
-  "terminated": null,
-  "query_count": null
-}
-```
-
-`requested_limit` 只记录旧公共参数，`returned_record_count` 只记录返回列表长度；两者都不是
-完整 drain 证明。artifact 不复制旧原始字符串。`terminated` 和 `query_count` MUST 为
-`null`，不得由列表内容或长度猜测。
-
-`scope.error_drain_v1` 是内部受管子事务 capability，不是第九个公共 operation，不加入
-operation registry，不提供独立 Service/CLI 入口。「子事务」只表示其结果归属当前
-operation context，不表示嵌套 session authorization。核心 error-policy executor 必须在上一阶段
-authorization 已关闭后，为同一 context 签发独立的 `error_before` 或 `error_after`
-authorization。该阶段继承 context 的 correlation ID、session epoch、exclusive lease、
-access 结论和剩余 deadline，语义为
-`effect=stateful_read`、`changed_fields=("scope.error_queue",)`、只允许文本 query，
-`max_steps=max_records+1`。它不得超出 context deadline、改变 lease/access、创建 binary
-budget ledger，也不得生成独立 operation artifact；结果只写入当前 operation 的
-`error_check.checks`。签发前若 session 已非 healthy 或剩余 deadline 不足，该阶段不得开始。
-
-### 6.2 错误记录与生命周期
-
-候选 driver 边界和公开错误记录为：
-
-```python
-@dataclass(frozen=True)
-class DriverErrorRecord:
-    code: str | int | None
-    message: str
-    severity: Literal["info", "warning", "error", "fatal", "unknown"]
-    source: str
-
-@dataclass(frozen=True)
-class ErrorDrainResult:
-    records: tuple[DriverErrorRecord, ...]
-    terminated: bool
-    query_count: int
-    overflow_record: DriverErrorRecord | None = None
-
-class ScopeErrorDrainDriver(InstrumentDriver, Protocol):
-    def drain_errors(self, *, max_records: int) -> ErrorDrainResult: ...
-
-@dataclass(frozen=True)
-class ErrorRecord:
-    code: str | int | None
-    message: str
-    message_redacted: bool
-    severity: Literal["info", "warning", "error", "fatal", "unknown"]
-    source: str
-    observed_at_utc: str
-    correlation_id: str | None
-```
-
-`drain_errors()` 是 `scope.error_drain_v1` 唯一允许的 driver 方法，不带 clear/peek 参数。
-core 为它签发的非嵌套 `error_before|error_after` phase authorization 只允许文本
-`query` I/O，不允许 write、binary query 或再开启另一 authorization。
-driver 读到文档化的「无错误」token 时设 `terminated=true`，该 token 不进入 `records`。
-R1.3 首版规定每次 queue query 只解析一条错误记录或一个终止 token，不接受
-一次返回多条记录的无类型文本 batch。`query_count` 是真实仪器查询数，范围为
-`1..max_records+1`；核心 authorization 的
-`max_steps` 也必须固定为 `max_records+1`。最后一个额外 step 只用于证明终止；若它仍返回错误记录，
-driver 必须把该条保存在 `overflow_record`，返回 `terminated=false`，核心以
-`error_queue_incomplete` 失败。该记录不塞入受 `max_records` 限制的 `records`，但必须经过与
-其他记录完全相同的 scrubber 后进入失败 artifact，不得静默丢弃。
-分支不变量为：
-
-- `terminated=true`：`overflow_record is None` 且 `query_count == len(records) + 1`；
-- `terminated=false`：`len(records) == max_records`、`query_count == max_records + 1` 且
-  `overflow_record is not None`。
-
-任何 transport/session/protocol 失败直接抛出结构化异常，不构造
-伪造的 `ErrorDrainResult`。
-核心必须校验 `len(records) <= max_records`，并把 `query_count` 与 guarded transport
-在当前 authorization 中的实际 query 增量对账；不一致是 driver contract violation，不得生成成功
-artifact。
-
-`observed_at_utc` 由核心在成功解析该条记录后生成，必须是带 `Z` 的 RFC 3339 UTC 时间；
-deadline 仍使用不序列化的单调时钟，两者不能混用。公开 `ErrorRecord` 不含 raw 响应。
-`DriverErrorRecord.message` 是受信任进程内输入，不得直接序列化。核心必须删除控制字符，
-并用已知 resource、IP/USB 地址、IDN 序列号、本地路径和凭据模式的统一 scrubber 做脱敏。
-脱敏后的公开 `message` 必须是 `1..512` 个 Unicode code point；只要替换过内容，
-`message_redacted=true`。若 scrubber 不能证明输出安全，固定改为 `instrument reported an error`
-并设 `message_redacted=true`，不得把原文作为 fallback。`source` 是 `1..64` 个 ASCII safe-token
-字符；字符串 code 也必须使用同一 safe-token 约束，整数 code 不接受 bool。
-未经清洗的 raw 只可保存在受控本地诊断中，并通过脱敏 evidence ID 关联；不得进入公开
-artifact、异常消息或 `ErrorRecord`。
-
-R1.3 的完整 drain 合同只适用于 `scope.error_drain_v1`：最多公开 `max_records` 条错误，
-不自动 clear，并区分空队列、队列不可用和查询本身失败。
-读取最多 `max_records` 条错误后，必须再执行第 `max_records+1` 次证明 query。
-该 query 返回「无错误」终止 token 才表示 drain 完整；若仍返回错误记录，必须按上文
-`overflow_record` 分支记录并以 `error_queue_incomplete` 失败，不能少发一次证明 query，
-也不能把截断列表当作完整检查。
-现有 `scope.errors(limit) -> list[str]` 不受本段 `max_records+1` 规则约束，也不得用于
-R1.3 `required/if_supported` 错误策略。
-
-before 阶段发现已有记录时，默认主 operation 不发送并报告
-`preexisting_instrument_error`；这些记录不归属于新的 `correlation_id`。只有在 operation
-effect 为 `observe` 或 `stateful_read`，且显式选择 `record_and_continue` 时，核心才可记录后
-继续该非变更 operation；`write`、`acquire` 和 recovery 仍必须在发送前失败。after 阶段发现
-记录时，满足同一条件的非变更 operation 可继续，
-变更 operation 报告 `instrument_error`，并保留已经发生的
-副作用和 cleanup 状态。错误队列查询发生 transport、session 或 protocol failure 时始终是
-`failed` 并中止，不能降级成 unsupported；设备明确返回的 instrument error 仍按
-`on_instrument_error` 处理。批量通道共享一次 operation correlation，不把同一组设备错误任意
-复制到每个通道。
-
-after 阶段发现不允许继续的 instrument error 时，已成功返回的主 driver 调用必须转为
-operation failure。对 `write` 和 `acquire` operation，执行顺序固定为：after drain 完成并保存
-`instrument_error` 主异常 → 执行 `OperationSpec` 声明的 failure cleanup → 执行
-`cleanup_verification_fields` 验证 → 写入最终 session health 和 artifact。cleanup 或验证失败
-不得覆盖 after 的 `instrument_error`，但必须使 session 保持 `uncertain/poisoned`。
-对 `scope.acquisition_start` 和 `scope.acquisition_single`，这意味着必须按第 1.2/4.3 节尝试
-STOP、恢复 trigger/acquisition baseline 并 query-back；不得因为主 driver 曾返回成功就把
-仪器继续运行状态留作公共 success。若 after drain 本身使 session 不再允许普通 cleanup I/O，
-只能使用已声明的有界 recovery authorization；不得绕过 session gate。
-
-### 6.3 固定 artifact 结构
-
-每个使用 R1.3 错误策略的 operation 至少写入：
-
-```json
-{
-  "executor": "core_v1",
-  "policy": "if_supported",
-  "capability": "scope.error_drain_v1",
-  "supported": false,
-  "status": "skipped",
-  "reason_code": "unsupported",
-  "timing": "before_and_after",
-  "max_records": 16,
-  "on_instrument_error": "fail",
-  "checks": [],
-  "attempted_phases": [],
-  "completed_phases": [],
-  "omitted_phases": [],
-  "last_drain_terminated": null,
-  "main_operation_sent": true,
-  "diagnostic_evidence_id": null
-}
-```
-
-`executor` 固定为 `core_v1` 或 `legacy_driver`。`status` 固定为 `completed`、`skipped`、
-`disabled`、`rejected`、`failed` 或 `legacy_unstructured`。
-`reason_code` 固定为 `empty`、`records`、`unsupported`、`unknown_capability`、
-`preexisting_instrument_error`、`instrument_error`、`error_queue_incomplete`、`query_failed`
-或 `not_applicable`。`rejected` 只用于能力或配置预检在错误队列 I/O 前拒绝；已开始 drain 后
-遇到队列不完整、查询失败或不允许继续的仪器错误时使用 `failed`。
-
-`checks` 不是任意 JSON；每个已执行阶段都必须使用以下固定结构：
-
-```json
-{
-  "phase": "before",
-  "status": "completed",
-  "reason_code": "empty",
-  "query_count": 1,
-  "terminated": true,
-  "records": [],
-  "overflow_record": null
-}
-```
-
-`phase` 固定为 `before` 或 `after`；check 级 `status` 固定为 `completed` 或 `failed`，
-`reason_code` 固定为 `empty`、`records`、`error_queue_incomplete` 或 `query_failed`。
-`query_count` 是包含终止 token 查询在内的实际队列 query 次数，必须是
-`1..max_records+1` 的非 bool 整数；
-`records` 只包含已清洗的 `ErrorRecord`，不包含终止 token，长度不得超过
-`max_records`。check 还必须包含 `overflow_record`，值为脱敏后的 `ErrorRecord` 或 `null`；
-它必须与 `ErrorDrainResult` 的分支不变量一致。`terminated=true` 仅表示该阶段确实
-读到了文档化的「无错误」终止 token。
-未执行的 phase 不生成占位条目。
-
-`attempted_phases` 按时间顺序列出至少发送过一次队列 query 的 phase；`completed_phases`
-只列出以 `terminated=true` 完成的 phase。`last_drain_terminated` 是最后一个已尝试 phase
-的终止结论，没有查询时为 `null`。这三个字段不会把「before 已完整 drain，但主操作
-未发送，因此 after 不适用」错写成 drain 不完整。`main_operation_sent` 只表示主 operation
-是否已发送任一仪器命令，不包含 before check。`diagnostic_evidence_id`
-为 `null` 或脱敏 opaque safe-token，只关联受控本地证据，不得嵌入原始响应、资源字符串或
-本地路径。
-
-`omitted_phases` 每项固定为
-`{"phase":"after","reason_code":"main_operation_failed|session_unhealthy|cancelled"}`。主 operation 在
-after 之前失败、取消，或把 session 变为 `uncertain/poisoned` 时，核心 MUST NOT 为补齐
-timing 继续查询错误队列；必须把 after 写入 `omitted_phases`。若主操作失败但 session
-仍 `healthy`，after 也默认 omitted，避免用消耗性查询干扰主异常恢复；未来若需「失败后检查」，
-应单独设计策略。error-check 顶层只聚合实际执行的 phase，主失败、取消和 session health
-仍由 operation artifact 作为主结果，不被 error-check status 覆盖。
-
-顶层聚合规则固定为：
-
-| 情形 | 顶层 `status / reason_code` | `main_operation_sent` |
-| --- | --- | --- |
-| `disabled` | `disabled / not_applicable` | 按主 operation 实际情况 |
-| `if_supported` 且明确 unsupported | `skipped / unsupported` | 主 operation 可继续 |
-| `required` 且 unsupported，或能力未知 | `rejected / unsupported` 或 `rejected / unknown_capability` | `false` |
-| 任一 phase 队列查询失败或未终止 | `failed / query_failed` 或 `failed / error_queue_incomplete` | 按失败发生前实际情况 |
-| before 有记录且策略/操作不允许继续 | `failed / preexisting_instrument_error` | `false`；after 不适用 |
-| after 有记录且策略/操作不允许继续 | `failed / instrument_error` | `true` |
-| before 或 after 有记录，且非变更操作允许继续 | `completed / records` | 按实际情况 |
-| 所有实际 phase 均空 | `completed / empty` | 按实际情况 |
-| 旧 driver 自行查错 | `legacy_unstructured / not_applicable` | 按主 operation 实际情况 |
-
-聚合优先级为：查询失败/队列不完整 > 不允许继续的 instrument error > 已记录并继续 >
-空队列。因此「before 有记录并继续，after 为空」固定聚合为 `completed / records`；
-「after 有记录但 observe 允许继续」也是 `completed / records`。不能用模糊的 `failed`
-吞掉具体原因。
-
-`legacy_driver` 使用同一顶层 key 集，但 `capability="scope.errors"`、`checks=[]`、
-phase 数组全空，且不得填写伪造的 query count/termination。当旧 bool 为 `false` 时仍使用
-`disabled / not_applicable`，而不是 `legacy_unstructured`。直接调用 `scope.errors` 时
-`error_check=null`，另写 operation-specific `error_drain` artifact，不递归产生 before/after checks。
-
-当前 SDS800X HD 没有文档化错误队列，插件继续要求显式 `check_errors=false`，
-不声明 `scope.errors` 或 `scope.error_drain_v1`。
-
-artifact 中的 `supported` 使用 `true` 或 `false` 表示能力已评估；使用 `null` 表示能力未评估或未知。
-`disabled` 路径即使未评估也必须使用 `status=disabled` 和 `reason_code=not_applicable`，不得因为未知而拒绝。
-只有 `required/if_supported` 因能力未知而在 I/O 前拒绝时，`supported=null` 才与
-`status=rejected` 和 `reason_code=unknown_capability` 一起出现。公开 artifact 使用结构化 code、经过 scrubber 和长度限制的 message、
-`message_redacted`、UTC 时间和
-correlation，不复制可能包含资源或设备私有内容的原文。
-
-## 七、能力发现、版本门与旧接口
-
-### 7.1 descriptor 与 capability-method contract
-
-R1.3 acceptance addendum 为 descriptor 增加一个可选、可序列化的 scope 扩展字段；字段名和
-必需关系冻结如下：
-
-```python
-@dataclass(frozen=True)
-class ScopeDescriptorExtensions:
-    screenshot_profile: ScopeScreenshotProfile | None = None
-    acquisition_control_profile: ScopeAcquisitionControlProfile | None = None
-    trace_profile: ScopeTraceProfile | None = None
-
-@dataclass(frozen=True)
-class InstrumentDescriptor:
-    # 保留现有字段；新增字段不改变旧 descriptor 的默认语义。
-    scope_extensions: ScopeDescriptorExtensions | None = None
-```
-
-核心 factory 在 capability discovery 阶段把 descriptor 的 `scope_extensions` 与 driver
-Protocol 一起校验；缺失所需字段或方法时，在第一次仪器 I/O 前返回
-`unsupported_capability`，不能只因 Python 方法恰好存在就注册 capability。R1.3 的中央
-`CAPABILITY_METHODS` 等价映射固定为：
-
-| capability | descriptor 前置事实 | required Protocol | required method(s) | 可注册 operation |
-| --- | --- | --- | --- | --- |
-| `scope.screenshot_profile` | `scope_extensions.screenshot_profile` 非空 | `ScopeScreenshotProfileDriver` | `get_screenshot_profile()` | `scope.screenshot_profile` |
-| `scope.screenshot_v2` | screenshot profile 非空且已验证 | `ScopeScreenshotDriver` + `ScopeScreenshotProfileDriver` | `capture_screenshot()`、state snapshot/restore/verify | `scope.screenshot_v2` |
-| `scope.acquisition_run_state` | 无额外 profile | `ScopeAcquisitionRunStateDriver` | `get_acquisition_run_state()` | `scope.acquisition_run_state` |
-| `scope.acquisition_control` | `scope_extensions.acquisition_control_profile` 非空 | `ScopeAcquisitionControlDriver` | `start_continuous()`、`stop_acquisition()`、`acquire_single()`、recovery 三方法 | `scope.acquisition_start/single/stop` |
-| `scope.trace_metadata` | `scope_extensions.trace_profile` 非空 | `ScopeTraceMetadataDriver` | `get_trace_metadata()` | `scope.trace_metadata` |
-| `scope.fetch_trace` | trace profile 非空且含请求 kind | `ScopeTraceDriver` | `fetch_trace()`、transfer snapshot/restore/verify、`get_trace_metadata()` | `scope.fetch_trace` |
-| `scope.error_drain_v1` | capability 明确声明且策略允许 | `ScopeErrorDrainDriver` | `drain_errors(max_records=...)` | 只作为受管 error phase，不新增公共 operation |
-
-核心 registry 的方法映射可直接编码为：
-
-```python
-SCOPE_CAPABILITY_METHODS = {
-    "scope.screenshot_profile": ("get_screenshot_profile",),
-    "scope.screenshot_v2": (
-        "get_screenshot_profile",
-        "capture_screenshot",
-        "snapshot_screenshot_state",
-        "restore_screenshot_state",
-        "verify_screenshot_state_restored",
-    ),
-    "scope.acquisition_run_state": ("get_acquisition_run_state",),
-    "scope.acquisition_control": (
-        "get_acquisition_run_state",
-        "start_continuous",
-        "stop_acquisition",
-        "acquire_single",
-        "snapshot_acquisition_control",
-        "restore_acquisition_control",
-        "verify_acquisition_control_restored",
-    ),
-    "scope.trace_metadata": ("get_trace_metadata",),
-    "scope.fetch_trace": (
-        "get_trace_metadata",
-        "fetch_trace",
-        "snapshot_trace_transfer_state",
-        "restore_trace_transfer_state",
-        "verify_trace_transfer_state_restored",
-    ),
-    "scope.error_drain_v1": ("drain_errors",),
-}
-```
-
-对应的 profile provider Protocol 为：
-
-```python
-class ScopeScreenshotProfileDriver(InstrumentDriver, Protocol):
-    def get_screenshot_profile(self) -> ScopeScreenshotProfile: ...
-```
-
-`scope.screenshot_profile`、`scope.trace_metadata` 和 `scope.fetch_trace` 不再只有文字建议
-方法；上表中的 Protocol 是 capability 注册的必要接口。`ScopeAcquisitionControlProfile`、
-`ScopeScreenshotProfile` 和 `ScopeTraceProfile` 的安全上限以 descriptor 为准，driver 的
-运行时返回值只能 query-back 验证，不能扩大或替换 descriptor 事实。任何 capability 的
-required Protocol、profile 或方法不满足时，factory MUST 在零 I/O 阶段 fail-closed；未声明
-capability 的额外方法不产生隐式能力。
-
-候选 capability（尚未注册）：
-
-```text
-scope.screenshot_profile
-scope.screenshot_v2
-scope.acquisition_run_state
-scope.acquisition_control
-scope.trace_metadata
-scope.fetch_trace
-scope.error_drain_v1
-```
-
-兼容要求：
-
-1. 现有 capability、方法和模型不删除、不改名；
-2. 新核心 + 旧插件保持现状；
-3. 使用新 transport 或新 capability 的插件提高 wheel 和 descriptor 的核心下限；
-4. 旧核心 + 新插件在 factory 和第一次仪器 I/O 前明确拒绝；
-5. 新增可选 capability 不自动要求升级 `wavebench.instrument.v2`；
-6. 在 `ScopeDescriptorExtensions`、`CAPABILITY_METHODS`、operation registry、Service、CLI 和
-   artifact schema 未同时冻结前，插件不得声明新能力。
-
-## 八、conformance 测试矩阵与证据要求
-
-| 层级 | 必测内容 | 当前状态 |
-| --- | --- | --- |
-| OperationSpec/Service | capability、access、lease、action-specific changed/restore/postcondition/cleanup、transfer 字段闭包、artifact | 核心尚无候选 operation，待实现 |
-| capability/descriptor gate | `ScopeDescriptorExtensions`、`CAPABILITY_METHODS`、required Protocol、缺 profile/method 零 I/O 拒绝 | 核心尚无候选字段，待内部实现 |
-| binary model | `#N` 精确语法、`#0` 拒绝、response/operation/query/resync budget、成功 metadata、尾部和 continuation | 需要新增 fake vectors |
-| backend | PyVISA/RsInstrument/TCP/serial 的 message 能力证明、终止设置恢复 | 只有 SDS raw PNG 一次实机观察 |
-| guarded transport | access、计数、healthy/uncertain/poisoned、固定常量、超限后失步、close/poison 默认 | 需要失败恢复测试 |
-| plugin trust boundary | 公共 Protocol 不暴露 session；禁止插件依赖 `.inner` 的代码审计 | 当前不是沙箱；opaque facade 不在 R1.3 范围 |
-| screenshot | request tuple、PNG signature/IEND、媒体类型、尺寸、transport/content 尾部分层、父 capture fail-parent | 仅 SDS raw PNG 探测 |
-| acquisition | allowed phase、完成式 SINGLE、baseline/observed states、identity semantics、终态 proof、成功 postcondition、失败 recovery | SDS vendor capture 已验收，公共控制未实现 |
-| transfer/trace | typed transfer snapshot/restore/verify、context nonce、analog/digital/reference profile、字段逐项闭合 | RTM2000 有部分证据，需第二族 fixture |
-| errors | disabled 零 I/O、未知 fail-closed、`scope.error_drain_v1`、完整 drain、唯一执行者、聚合 reason | 当前仅布尔兼容路径 |
-| compatibility | 新旧核心/插件四组合、factory 拒绝、CLI/artifact | 待核心合同冻结 |
-| opt-in hardware | 至少两种 framing、两个厂商状态机、两种 trace axis | 当前证据不足 |
-
-### 8.1 必备 fixture 与失败向量
-
-在 RFC 进入 `Proposed` 前，至少需要带有 backend、resource class、固件版本和证据文件
-链接的 fixture：
-
-- definite block：合法 `#N`、`#0`、非法长度位、截断、response/operation/query budget 超限、
-  resync ceiling、精确 consumed 等式、`BinaryQueryResult` 和 transport trailing；
-- message：分片读取、EOM、超限后有界 drain/poison、termination 恢复失败和下一次 query；
-- acquisition：descriptor profile 缺失/非法、continuous mode 支持集、configure-then-arm 与
-  atomic-arm 两条 baseline 路径、count reset、counter epoch 缺失或变化与异常回绕拒绝、每个 action 的 allowed/rejected phase、
-  调用前已 stopped、count 不变、跳过 acquiring 的最小状态序列、外部前面板改状态、
-  after instrument error cleanup 和 timeout 后 recovery STOP 失败；
-- transfer restore：typed `ScopeTraceTransferBaseline`、`CHDR`/`CORD`/`WFSU` 或等价状态的
-  逐字段 changed/verification、context/nonce 重放拒绝、恢复失败和 healthy/poisoned 判定；
-- screenshot：baseline/query-back/成功与失败恢复、transport/content trailing 负向向量、
-  nonce 重放、旧 capture 父字段闭包和 fail-parent 语义；
-- trace：capability/descriptor gate、kind-specific index、R1.3 analog/digital/reference fetch、
-  spectrum/math 排除、负频/降序拒绝、scaling、非 finite 数值、只读数组和 points 不一致；
-- errors：三种 policy、disabled + unsupported、能力未知、`scope.error_drain_v1` factory gate、
-  `max_records+1` 终止证据、查询失败、driver/core 双读负向测试、聚合 reason 和脱敏；
-- compatibility：旧核心 + 新插件与新核心 + 旧插件的能力发现和第一次 I/O 行为。
-
-图片、原始波形、真实 resource、序列号和完整命令日志不进入仓库；只保留 framing、长度、
-状态迁移、固件版本和数值摘要。
-
-## 九、里程碑
-
-| 里程碑 | 范围 | 退出条件 |
-| --- | --- | --- |
-| M1 | Operation context、phase authorization、OperationSpec/artifact 内部骨架 | context/phase/ledger/legacy artifact 与 transfer recovery model 的 feature-gated 测试通过；不得进入 public registry |
-| M2 | binary framing 与 backend capability | definite/message fake、四维 budget、有界 resync、失步、termination 恢复测试通过 |
-| M3 | screenshot profile/v2 | definite block 和 raw message 两种 fixture 通过 |
-| M4 | acquisition run state/control | descriptor profile validator、两个厂商状态机、continuous mode、两类 SINGLE baseline、幂等 STOP、after-error cleanup 和 timeout recovery 通过 |
-| M5 | trace source/axis | analog、digital、math、reference、spectrum 的跨厂商 fixture 通过 |
-| M6 | error policy、版本门和迁移 | A1 P0/P1 gate、`scope.error_drain_v1`、三态 artifact、聚合规则、四组合兼容和 CLI/Service 入口冻结后，才可讨论 public registry |
-| M7 | opt-in 实机 | 核心离线回归通过，实机范围另行授权 |
-
-各里程碑应分别提交；不得把 transport、scope model、Service 和插件迁移压成一个不可回滚
-改动。
-
-## 十、已否决方案
-
-- 插件直接访问 `transport.session` 或 backend；当前只能以「公共合同不提供」约束，不能声称
-  Python 运行时沙箱隔离；
-- 给 `query_bin_block()` 增加含义模糊的 `raw=True`；
-- 使用换行、idle timeout 或 `rstrip()` 推断 PNG 成功结束；
-- 在 transport 内置 PNG parser；
-- 忽略 screenshot 的 menu 参数；
-- 把 trigger status 填入现有 `ScopeAcquisitionStatus`；
-- 用 `*OPC?` 统一判断物理触发完成；
-- 把 math/reference/FFT 编成负数或大号 channel；
-- 扩宽 `WaveformData.channel` 为任意字符串；
-- 为没有错误队列的仪器返回空列表；
-- 超过 `max_bytes` 后在 healthy session 中留下未消费响应。
-
-## 十一、R1.3 暂定安全结论与待决问题
-
-以下是 Draft 阶段暂定的安全不变量，不代表 schema、常量或核心实现已经接受：
-
-1. 采集 start、完成式 single、stop 是三个 action-specific operation；共享 capability 不改变
-   各自 effect、postcondition、失败 cleanup 或最低 access。descriptor 的
-   `ScopeAcquisitionControlProfile` 是 continuous mode、SINGLE arm 语义和 count 比较的唯一
-   静态事实源；arm-only 需要独立 operation。
-2. binary response、operation-total、query-count 和 resynchronization 分别使用有限上限；核心通过单个
-   operation context 下的非嵌套阶段 authorization 引用同一 `BinaryQueryBudget` ledger，
-   插件不能构造、提升、重置或跨 context 复用。
-3. `query_binary()` 成功返回 `BinaryQueryResult`，显式携带 framing、长度、
-   `transport_trailing_bytes` 和精确 consumed 等式，以及
-   `synchronization=proven`；失败使用现有结构化 `TransportIOError`。
-4. `disabled` 错误策略始终零错误队列 I/O；`if_supported` 只跳过明确 unsupported，未知能力
-   fail-closed。`core_v1` 以 `scope.error_drain_v1` 和终止证据为门；旧 `scope.errors`
-   只保持 `legacy_unstructured` 语义，不得被升级为类型化 drain。一个 operation 只能由
-   core 或 legacy driver 其中一方执行错误检查。
-5. R1.3 的可读取 trace 不包含通用算术，只支持已列出的 kind/axis/unit/operation 组合；
-   one-sided FFT、编号基准和 scaling 不变量不能留给插件自行解释。
-6. `CHDR`/`CORD`/`WFSU` 或等价的 transfer 状态必须在核心规范化为逐项
-   `changed_fields` + `verification_fields`；该要求覆盖 `scope.capture_multiple` 等现有别名。
-7. 旧 capture 调用 screenshot 只允许父 operation 字段闭包；R1.3 不注册 composite operation。
-   没有完整字段闭包时必须在 I/O 前拒绝，截图失败或恢复失败必须使父 capture 失败，不能
-   通过嵌套 authorization 或部分错误记录继续返回成功。
-8. 所有可恢复的 stateful write 都必须通过 core-owned snapshot、有界 restore 和独立 verify
-   阶段闭合；主 driver 抛异常或 after error 不能让 baseline 丢失。
-9. 每个 operation 只能在同一 operation context 中顺序使用非嵌套 phase authorization；
-   error drain phase 不得创建或重置 binary budget ledger。
-10. 首版不使用 modulus 单独证明 SINGLE 完成；count 只能在未变化的 `counter_epoch` 和
-   有效 `state_transition` 联合时作为辅助证据，任何回绕、复位或非严格递增都必须转用
-   `identity_delta`/`state_transition`。旧 `scope.errors` 不提供 R1.3 终止证明。
-
-剩余待决问题：
-
-1. `OperationSpec` 的完整输入/输出序列化、取消、幂等性和并发字段仍未公开冻结；在这些字段
-   冻结前，核心只能实现第 12 节列出的内部 / feature-gated 骨架。
-2. 各 backend 是否能在固定 resynchronization 上限内安全 drain 仍需 fixture；超出上限时
-   close + `poisoned` 已是 R1.3 的统一默认，不再由 backend 自选。
-3. 哪些 PyVISA resource class 和 RsInstrument API 能稳定证明 message END。
-4. `READ_CONTINUATION_ONLY` 的 core-issued continuation token 和返回模型如何授权。
-5. 旧 screenshot adapter 的具体拒绝码和更多 profile variant 仍待 fixture；profile 来源已固定为
-   descriptor 或 descriptor/query 的 `combined` 交集。
-6. poisoned session 的 recovery/reopen API 仍属 transport 生命周期设计；在该 API 冻结前，
-   新 capability 不得从 poisoned session 继续 I/O。
-7. 暂定的 completion state-transition 序列及 counter-epoch 联合条件能否通过第二个厂商
-   fixture，是否需要进一步收紧；更丰富的计数器世代语义仍待单独 RFC。
-8. `spectrum` 是否作为独立 `ScopeTraceKind`，以及单位校验复用哪些现有核心模型；该项已
-   明确排除在 R1.3 公共 fetch scope 外，移入后续 trace-extensions RFC。
-9. binary operation/profile 的连接项如何映射到不同 backend 仍需核心实现细节；R1.3 的
-   operation 常量、profile 收紧规则和超限 close/poison 默认已冻结。
-10. error queue 的未来 peek/clear operation 仍待独立设计；R1.3 timing 默认固定为
-    `before_and_after`，未知能力不得增加 skip 分支。
-
-上述问题解决、取得跨厂商 fixture，并完成 Service/CLI/artifact 评审前，RFC 必须保持 `Draft`。
-主仓库未接受本文时，插件不得声明这些新 capability 已由核心提供。
-
-## 十二、R1.3 acceptance addendum（A1）
-
-本 addendum 是 R1.3 的验收门，不是第二套并行规范。它把核心本轮复审的实施边界冻结为
-「可开始内部基础设施、尚不可注册公共 capability」。若本节与正文存在歧义，以本节的
-acceptance gate 为准；正文仍是跨仪器模型的唯一事实源。
-
-### 12.1 允许先行的内部工作
-
-核心现在可以在内部或 feature-gated 分支实现以下内容：
-
-| 内部组件 | 必须具备的约束 | 明确禁止 |
-| --- | --- | --- |
-| operation context | 一次 operation 一个 context；绑定 correlation、epoch、deadline 和 ledger | 为重试或错误检查创建第二个 context |
-| phase coordinator | `normal`、`recovery`、`verification` 顺序授权；active authorization 最多一个 | 从 driver 或 active authorization 内嵌套签发 |
-| binary ledger | response/total/query/resync 四项固定上限，跨 phase 不重置 | 用 error phase 或重建 driver 增加额度 |
-| typed state models | acquisition、screenshot、transfer 的 snapshot/baseline/restore/verify 模型 | 暴露 session token、用布尔值替代 fresh snapshot |
-| legacy artifact | 旧 `scope.errors` 的 `legacy_unstructured` 记录 | 将旧 `list[str]` 升级为 typed drain 证明 |
-| fake/conformance fixture | 覆盖失败恢复、nonce 重放、phase 越界、binary 超限和 capability gate | 在实机或插件 descriptor 上开启新 capability |
-
-内部实现必须由核心私有 feature gate 保护；不得写入公共 `CAPABILITY_METHODS` 的可发现注册
-表，不得修改旧插件的 descriptor 行为，不得提高插件核心版本下限。
-
-### 12.2 P0 公共接口验收门
-
-在任何新 capability 注册或插件迁移前，核心必须逐项验收：
-
-1. **transfer recovery**：`ScopeTraceTransferRecoveryDriver`、
-   `ScopeTraceTransferStateSnapshot`、`ScopeTraceTransferBaseline`、restore result 和
-   fresh-snapshot verification 已实现；descriptor `ScopeTraceProfile.restore_order` 和 step
-   上限已验证；`fetch_trace` 在 changed transfer fields 非空时必须传入同一 context 的
-   baseline，并按 `CHDR`/`CORD`/`WFSU` 等逐字段恢复和核对。
-2. **capability/descriptor**：`ScopeDescriptorExtensions` 字段、中央
-   `CAPABILITY_METHODS` 映射和各 required Protocol 已实现；缺失 profile/method 时在零 I/O
-   阶段拒绝，额外方法不产生隐式 capability。
-3. **numeric and deadline constants**：截图 `262144/262144/1/0`、trace
-   `8388608/67108864/256/65536`、operation timeout `5000/30000/60000 ms` 已作为核心常量
-   实现；profile/connection 只能收紧，超出同步界限统一 close + `poisoned`。
-4. **error timing**：默认 `before_and_after`、recovery 固定 `disabled`、每次 I/O 受绝对
-   monotonic deadline 限制，并有对应 artifact 和负向测试。
-
-### 12.3 P1 语义验收门
-
-- **嵌入 screenshot**：R1.3 只采用父 capture operation 字段闭包，不注册 composite operation。
-  没有完整 changed/verification/cleanup 字段时在 I/O 前拒绝；截图或恢复失败使父 capture
-  失败，不能只记部分错误。
-- **baseline handle**：screenshot、acquisition、transfer baseline 必须包含
-  `context_id`、`session_epoch`、core-generated opaque `baseline_nonce` 和 restore order；
-  nonce 按 `fresh -> passed_to_main -> restore_attempted -> consumed` 一次性消费，重放在 I/O
-  前拒绝，artifact 只留摘要。
-- **identity proof**：`ScopeAcquisitionControlProfile.identity_semantics` 必须为
-  `unique_within_session_epoch` 才能使用 `identity_delta`；否则只能使用完整 state transition。
-- **phase API bridge**：核心通过 `ScopeOperationContextCoordinator.authorize_phase()` 包裹
-  当前 normal gate 与 `SessionTransactionCoordinator.authorize()`，并用 sidecar/扩展记录绑定
-  context、phase、fields、allowed I/O、deadline 和 max steps；driver 不接收 session token。
-- **trace exclusion**：R1.3 公共 fetch 仅包含 analog/digital/reference；spectrum、math、
-  fft_phase、frequency axis 和新增单位移入后续 RFC，不得以未决模型开始插件迁移。
-
-### 12.4 Addendum 退出条件
-
-A1 只有在以下证据全部具备后，才能提交 `Proposed` 或允许 capability registry/插件迁移：
-
-1. 核心内部 fixture 覆盖上述 P0/P1 gate，且新旧四组合在 factory 和第一次 I/O 前行为明确；
-2. 至少两个独立仪器族或 backend fixture 证明 transfer restore、截图恢复、acquisition proof
-   和 binary framing/limit 语义；
-3. Service、CLI、descriptor、`CAPABILITY_METHODS`、artifact schema 和版本门由核心团队逐项
-   评审并冻结；
-4. R1.3 Draft 的待决问题中仍保留的 trace-extensions、continuation 和 reopen 设计不再被
-   当前 capability 合同隐式引用。
-
-在退出条件满足前，R1.3 仍是 `Draft`；本插件仓库只维护 RFC 与 fixture 设计，不声明任何
-新增 capability 已由核心提供。
+插件仓库提交评审时的 `R1.3` 正文已移入[历史存档](../archive/rfcs/WaveBench_scope通用扩展接口RFC.md)。
+其中保留接受前的候选措辞和验收上下文，不描述当前核心状态。
diff --git a/packages/README.md b/packages/README.md
index 6e76412..36c4a6a 100644
--- a/packages/README.md
+++ b/packages/README.md
@@ -2,29 +2,35 @@
 
 [English](README_EN.md)
 
-该目录用于放置独立的 WaveBench 仪器插件源码包。当前正式包包括五个预装驱动的可选外置发行版、M3 query-only 的 `wavebench-shengpu-sp3000a`、已完成 Source V2 C3 候选审计的 `wavebench-siglent-sdg2000x`、已采用 WaveBench `0.8.24` transport/session P0 的 `wavebench-siglent-sds3000`、已完成 SDS804X HD 波形、PNG 截图和独立采集控制验收的 `wavebench-siglent-sds800x-hd` `0.6.0`，以及面向 MSO8104 的 `wavebench-rigol-mso8000` `0.9.0`。后者已完成有界 waveform/capture、截图 V2、采集控制和光标读数的受控验收。后续仍按仪器或紧密相关系列逐包维护，不以移除预装驱动为目标，也不在这里冻结第二套 manifest、安装器或 catalog 协议。
+`packages/` 保存本仓库维护的独立 WaveBench 插件 distribution。每个子目录对应一台仪器或一个紧密相关的型号系列。
 
-`wavebench-rigol-dsg830` `0.2.0` 已进入仓库开发环境，完成 `rf_source` M0、A1、A2、A3、A4 Pulse 与 A4 Step Sweep，并要求 Core `>=0.8.25,<0.9`；production descriptor 声明 `rf_source.idn`、`rf_source.snapshot`、OFF-only `rf_source.cw_configure`、受 safety 限制的 `rf_source.output`、`rf_source.pulse_configure` 和保持 Sweep disabled 的 `rf_source.sweep_configure`。调制、trigger、Sweep execute／fire、Level Sweep 与 list 仍由独立证据门控。
+## 查询插件
 
-这些包分别声明各自的 WaveBench `0.8.x` 最低版本；SDS800X HD `0.6.0` 要求 `wavebench>=0.8.23,<0.9`，SDG2000X `0.8.2`、SDS3000 与 MSO8000 要求 `wavebench>=0.8.24,<0.9`。MSO8000 依赖的当前 Core API 尚未独立发布，不能据此宣称兼容性 wheel 已发布。它们不能与 `v0.7.0` 配套运行，也不会把未来 `0.9` 自动视为兼容版本。
+[生成式插件目录](../doc/reference/plugin-catalog.md)列出所有 distribution、driver ID、登记型号、WaveBench 兼容范围和 production descriptor 已声明的 capability。该页面由包内元数据生成，不在本页重复维护状态表。
 
-每个正式包至少应具备：
+[插件验收与历史证据](../doc/evidence/README.md)统一导航各包的手册审计、里程碑、RFC、conformance
+和实机验收记录，但不替代当前插件目录或 production descriptor。
 
-- 独立的 `pyproject.toml` 与版本；
-- `wavebench.instruments` entry point；
+进入具体包的 README，可以继续查看：
+
+- 适用型号与连接方式；
+- 最小配置和只读起步示例；
+- 型号特有的安全边界与限制；
+- 当前 Reference、历史验收证据和厂商资料入口。
+
+## 包合同
+
+每个正式包至少包含：
+
+- 独立的 `pyproject.toml`、元数据版本和 `wavebench.instruments` entry point；
 - canonical driver ID 和明确的 WaveBench 兼容范围；
-- 不访问真实仪器的单元测试；
-- 中英双语的用户可见说明；
+- production descriptor 及不访问真实仪器的离线测试；
+- 中英文用户入口；
 - 独立可打包的 MIT 许可证文件和 SPDX 包元数据；
-- 不含真实设备资源、凭据、原始波形或私有实验记录。
+- 不含真实设备资源、凭据、原始波形或私有实验记录的公开内容。
 
-## 新增仪器系列
+一个 distribution 可以声明多个有明确用途的 driver entry point。未进入 production descriptor 的 capability 不得由 README、里程碑或验收记录提前声明为当前能力。
 
-- [`wavebench-rigol-mso8000`](wavebench-rigol-mso8000/README.md)：RIGOL MSO8104 混合信号示波器，canonical ID `rigol.mso8104`；有界 waveform/capture、截图 V2、采集控制、状态和光标读数已在记录的型号、固件与 LAN/PyVISA 条件下完成受控验收。
-- [`wavebench-rigol-dsg830`](wavebench-rigol-dsg830/README.md)：RIGOL DSG830 射频信号发生器，canonical ID `rigol.dsg830`；`0.2.0` 完成 `rf_source` M0、A1、A2、A3、A4 Pulse 与 A4 Step Sweep，production descriptor 声明 `rf_source.idn`、`rf_source.snapshot`、OFF-only `rf_source.cw_configure`、受 safety 限制的 `rf_source.output`、`rf_source.pulse_configure` 和保持 Sweep disabled 的 `rf_source.sweep_configure`。未开放边界见包内[里程碑](wavebench-rigol-dsg830/doc/DSG830_COVERAGE_MILESTONES.md)。
-- [`wavebench-shengpu-sp3000a`](wavebench-shengpu-sp3000a/README.md)：Shengpu SP30120 扫频仪插件，保留最小 query-only descriptor 和经认证的 RF-OFF 控制。
-- [`wavebench-siglent-sds3000`](wavebench-siglent-sds3000/README.md)：早期 SIGLENT SDS3000 系列插件，当前严格支持 SDS3054 固件 `8.4.1`；身份、错误寄存器、通道耦合、波形读取和单/双通道采集已实现。
-- [`wavebench-siglent-sdg2000x`](wavebench-siglent-sdg2000x/README.md)：SIGLENT SDG2000X 函数／任意波形发生器，已完成 Source V2 候选包审计。
-- [`wavebench-siglent-sds800x-hd`](wavebench-siglent-sds800x-hd/README.md)：SIGLENT SDS800X HD 系列示波器，已完成波形、PNG 截图和独立采集控制验收。
+## 新增插件
 
-这些包均提供独立 `pyproject.toml` 和唯一 entry point，进入仓库级开发环境。尚未完成的 capability 不会提前声明。
+新增插件前应阅读 WaveBench Core 的[插件开发指南](https://github.com/Scaxlibur/wavebench/blob/master/docs/development/plugin-development.md)和[仪器驱动指南](https://github.com/Scaxlibur/wavebench/blob/master/docs/development/instrument-drivers.md)。本仓库的 editable 安装、检查和测试方式见[开发环境说明](../doc/DEVELOPMENT.md)。
diff --git a/packages/README_EN.md b/packages/README_EN.md
index 924b84b..eeceeed 100644
--- a/packages/README_EN.md
+++ b/packages/README_EN.md
@@ -2,29 +2,36 @@
 
 [中文](README.md)
 
-This directory contains independently packaged WaveBench instrument plugins. The maintained packages include five optional external editions of bundled drivers, the M3 query-only `wavebench-shengpu-sp3000a`, the Source V2 C3-audited `wavebench-siglent-sdg2000x`, `wavebench-siglent-sds3000` adopting WaveBench `0.8.24` transport/session P0, `wavebench-siglent-sds800x-hd` `0.6.0` with SDS804X HD acceptance for waveform transfer, PNG screenshots, and standalone acquisition control, and `wavebench-rigol-mso8000` `0.9.0` for MSO8104, with controlled acceptance for bounded waveform/capture, Screenshot V2, acquisition control, and cursor readout. Future packages should continue the one-instrument-or-family layout without treating bundled-driver removal as a goal or defining a second manifest, installer, or catalog protocol here.
+`packages/` contains the independently packaged WaveBench plugin distributions maintained in this repository. Each subdirectory targets one instrument or a closely related model family.
 
-`wavebench-rigol-dsg830` `0.2.0` participates in the repository development environment, completes `rf_source` M0, A1, A2, A3, A4 Pulse, and A4 Step Sweep, and requires Core `>=0.8.25,<0.9`. Its production descriptor declares `rf_source.idn`, `rf_source.snapshot`, OFF-only `rf_source.cw_configure`, safety-gated `rf_source.output`, `rf_source.pulse_configure`, and `rf_source.sweep_configure` that leaves Sweep disabled. Modulation, triggers, Sweep execution/fire, Level Sweep, and list control remain independently gated.
+## Find a plugin
 
-Each package declares its own WaveBench `0.8.x` minimum. SDS800X HD `0.6.0` requires `wavebench>=0.8.23,<0.9`, while SDG2000X `0.8.2`, SDS3000, and MSO8000 require `wavebench>=0.8.24,<0.9`. MSO8000 relies on current Core APIs that do not yet have an independent Core release, so it is not a compatibility-wheel release claim. These packages do not run with `v0.7.0` and do not automatically assume compatibility with a future `0.9` core.
+The generated [plugin catalog](../doc/reference/plugin-catalog-en.md) lists every distribution, driver ID, registered model, WaveBench compatibility range, and capability declared by the production descriptor. It is generated from package metadata, so this page does not maintain a second status table.
 
-Each maintained package should include:
+The [plugin acceptance and historical evidence index](../doc/evidence/README_EN.md) provides one route into
+manual audits, milestones, RFCs, conformance records, and hardware acceptance evidence without replacing
+the current catalog or production descriptors.
 
-- its own `pyproject.toml` and version;
-- a `wavebench.instruments` entry point;
-- a canonical driver ID and an explicit WaveBench compatibility range;
-- unit tests that do not access real instruments;
-- bilingual user-facing documentation;
+Each package README provides the next level of detail:
+
+- applicable models and connection routes;
+- minimum configuration and a read-only starting example;
+- model-specific safety boundaries and restrictions;
+- links to current Reference, historical acceptance evidence, and vendor material.
+
+## Package contract
+
+Each maintained package includes:
+
+- its own `pyproject.toml`, metadata version, and `wavebench.instruments` entry point;
+- a canonical driver ID and explicit WaveBench compatibility range;
+- a production descriptor and offline tests that do not access real instruments;
+- Chinese and English user entry pages;
 - a package-local MIT license file and SPDX package metadata;
-- no real device resources, credentials, raw waveforms, or private experiment records.
+- public content without real device resources, credentials, raw waveforms, or private experiment records.
 
-## Additional instrument families
+One distribution may declare multiple driver entry points with distinct purposes. A README, milestone, or acceptance record must not present a capability as current before it enters the production descriptor.
 
-- [`wavebench-rigol-mso8000`](wavebench-rigol-mso8000/README_EN.md): the RIGOL MSO8104 mixed-signal oscilloscope, canonical ID `rigol.mso8104`; bounded waveform/capture, Screenshot V2, acquisition control, status, and cursor-readout paths have controlled acceptance under recorded model, firmware, and LAN/PyVISA conditions.
-- [`wavebench-rigol-dsg830`](wavebench-rigol-dsg830/README_EN.md): the RIGOL DSG830 RF signal generator, canonical ID `rigol.dsg830`; `0.2.0` completes `rf_source` M0, A1, A2, A3, A4 Pulse, and A4 Step Sweep. Its production descriptor declares `rf_source.idn`, `rf_source.snapshot`, OFF-only `rf_source.cw_configure`, safety-gated `rf_source.output`, `rf_source.pulse_configure`, and `rf_source.sweep_configure` that leaves Sweep disabled. Its [milestones](wavebench-rigol-dsg830/doc/DSG830_COVERAGE_MILESTONES_EN.md) define the remaining gates.
-- [`wavebench-shengpu-sp3000a`](wavebench-shengpu-sp3000a/README_EN.md): the Shengpu SP30120 sweep-analyzer plugin with a minimal query-only descriptor and certified RF-OFF controls.
-- [`wavebench-siglent-sds3000`](wavebench-siglent-sds3000/README_EN.md): the early SIGLENT SDS3000 plugin, strictly supporting SDS3054 firmware `8.4.1`; identity, error registers, coupling, waveform reads, and single/dual-channel capture are implemented.
-- [`wavebench-siglent-sdg2000x`](wavebench-siglent-sdg2000x/README_EN.md): the SIGLENT SDG2000X function/arbitrary waveform generator, with a completed Source V2 candidate-package audit.
-- [`wavebench-siglent-sds800x-hd`](wavebench-siglent-sds800x-hd/README_EN.md): the SIGLENT SDS800X HD oscilloscope family, with accepted waveform, PNG screenshot, and standalone acquisition-control paths.
+## Add a plugin
 
-These packages provide an independent `pyproject.toml` and one canonical entry point, so they participate in the repository development environment. Incomplete capabilities are not declared.
+Read the WaveBench Core [plugin development guide](https://github.com/Scaxlibur/wavebench/blob/master/docs/development/plugin-development.md) and [instrument driver guide](https://github.com/Scaxlibur/wavebench/blob/master/docs/development/instrument-drivers.md) before adding a package. The [development environment guide](../doc/DEVELOPMENT_EN.md) covers editable installation, checks, and tests for this repository.
diff --git a/packages/wavebench-rigol-dg4000/README.md b/packages/wavebench-rigol-dg4000/README.md
index 4d1f251..57e06d4 100644
--- a/packages/wavebench-rigol-dg4000/README.md
+++ b/packages/wavebench-rigol-dg4000/README.md
@@ -2,110 +2,27 @@
 
 [English](README_EN.md)
 
-面向双通道 RIGOL DG4202 和兼容 DG4000 系列函数/任意波形发生器的 WaveBench 可执行仪器插件。
-
-## 身份与兼容范围
-
-- distribution：`wavebench-rigol-dg4000`
-- canonical driver ID：`rigol.dg4202`
-- opt-in advanced driver ID：`rigol.dg4202-v2`
-- opt-in workspace driver ID：`rigol.dg4202-v2-workspace`
-- WaveBench：`>=0.8.25,<0.9`
-- Python：`>=3.11`
-- transport backend：`pyvisa`
-
-当前包同时使用 WaveBench `v0.8.15` 首次提供的 `SourceChannelProfile`、`v0.8.16`
-新增的 `SourceSweepProfile`、`v0.8.17` 新增的 `SourceCounterProfile`，以及 `v0.8.25`
-的 Source V2 快照契约。因此不能与早于 `v0.8.25` 的 Core 配套运行，也不自动声明
-兼容未来 `0.9`。
-
-该插件不声明 alias。安装后，显式 canonical ID `rigol.dg4202` 选择外置实现；短 alias `dg4202` 始终选择 WaveBench 内建 fallback。卸载插件后，canonical ID 也回退到内建实现。
-
-## 能力
-
-- `*IDN?`、错误队列与 CH1/CH2 状态读取；
-- CH1/CH2 负载、极性、noise、sync、burst、modulation、marker 和 pulse-hold 的严格只读 profile；
-- CH1/CH2 sweep 状态、频率窗口、spacing/steps/time、hold/return、trigger 和 marker 的严格只读 profile；
-- 全局 counter 状态、输入配置、统计显示和条件式五元组测量结果的严格只读 profile；
-- `source.snapshot_v2` 类型化只读快照：CH1/CH2 Basic、输出开关、Sweep、Pulse、Burst、
-  不含逐阶分量的部分 Harmonic、Modulation state/type、部分 ARB、Noise Overlay、Sync，
-  全局 Counter，以及 CH1/CH2 参数化 Coupling；
-- 显式 Source V2 P1 写操作：`source.basic_configure_v2`、
-  `source.basic_live_configure_v2` 和 `source.output_v2`；
-- Source V2 Counter 生产操作：`source.counter_configure_v2`、
-  `source.counter_enable_v2`（覆盖独立 disable）和 `source.counter_measure_v2`；
-- 固定频率、函数、VPP 幅度、方波占空比和显式输出控制；
-- 只读任意波形 SCPI 能力探测；
-- 使用 WaveBench 公共 `DG4000DacBlock` 契约上传已校验的 DAC14 binary block。
-
-WaveBench 核心继续负责波形文件加载、归一化、DAC14 编码、幅度安全限制、Service、run plan、状态恢复和 artifact。插件不复制这些策略。
-
-完整的厂商手册命令域、当前公开 API、离线/实机证据和默认拒绝的高风险命令见
-[DG4000 功能覆盖矩阵](doc/DG4000_COVERAGE_MATRIX.md)。分阶段退出门和硬件验收边界见
-[DG4000 覆盖里程碑](doc/DG4000_COVERAGE_MILESTONES.md)。本地厂商手册保存在被忽略的
-`doc/vendor-local/`，不进入发行包。
-
-当前 wheel 随 distribution 包含 10 份 Source conformance manifest，并与 wheel 的非 manifest 内容绑定。
-它们记录 DG4202 `00.01.14` 上已验收的 Basic、Output、Counter V2，以及仅属于
-`rigol.dg4202-v2` 的受限 Sweep configure/manual-fire 范围。通道型 volatile ARB、Harmonic
-活跃态和无通道工作区接口均未绑定 conformance manifest。
+面向双通道 RIGOL DG4202 和兼容 DG4000 系列函数／任意波形发生器的 WaveBench 仪器插件。
 
-## 安全边界
+## 从这里开始
+
+- [查询当前版本、入口点、型号和 capability](../../doc/reference/plugin-catalog.md)
+- [进入 DG4000 插件文档](doc/README.md)
+- [安装和管理 WaveBench 插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
+
+## Driver 入口
+
+- `rigol.dg4202`：保留现有 V1 路由，并提供已声明的 Source V2 Basic、Output 和 Counter 操作。
+- `rigol.dg4202-v2`：显式 opt-in 的受限 Sweep configure／manual-fire 入口。
+- `rigol.dg4202-v2-workspace`：显式 opt-in 的无通道 volatile ARB 工作区替换入口。
+
+三个入口都不声明 alias；短 alias `dg4202` 始终选择 Core fallback。各入口的精确 capability、
+profile、版本范围和 conformance evidence refs 以 production descriptor 与生成式插件目录为准。
+
+当前实现还覆盖严格只读快照与 profile、固定波形配置、输出控制，以及经过校验的 DAC14
+上传。Core 负责波形文件加载、归一化、幅度安全限制、Service、run plan、状态恢复和 artifact。
 
-descriptor 导入不连接仪器。factory 只通过 `DriverContext` 打开当前配置的 transport。默认离线测试不扫描资源、不连接仪器，也不发送真实 SCPI。输出控制、任意波形上传和其他写操作不会盲目重试。
-
-当前开发分支的 `0.7.0` 在原有 M1–M6 和只读 `source.snapshot_v2` 之外开放 Source V2
-P1 与 Counter V2：`source.basic_configure_v2` 仅在目标输出 OFF、FIX 模式和 fresh V2 snapshot 条件下，
-一次修改一个 Basic 字段；当前可请求 SIN/SQU/RAMP/PULS/NOIS/DC、frequency、Vpp、offset
-或 square duty。`source.basic_live_configure_v2` 仅在输出 ON、FIX 模式下修改一个 frequency
-或 Vpp 字段，禁止输出循环。`source.output_v2` 单独执行 ON/OFF，并由 Core 读取最终状态。
-Counter V2 每次只配置 coupling、输入阻抗、衰减、trigger level 或 statistics enable 中的一项；
-enable/disable 不隐式配置或清统计，measure 只读取已启用 Counter 的有效五元组。Counter 刚启用或
-无输入时的无效测量在 V2 snapshot 中标为不可用，仍允许安全 disable；legacy profile 保持严格。
-
-DG4000 没有独立的 Harmonic state-off 命令，因此 descriptor 不声明
-`source.harmonics_disable_v2`。输出 OFF、FIX 且 Basic readback 明确为 `HARM`／`HARMONIC` 时，
-`source.basic_configure_v2` 的 Sine request 可以退出该波形；这是 Basic waveform 切换，不是仅修改
-Harmonic 状态的别名，也不声称保留逐阶参数。volatile ARB adapter 仍只保留离线候选；它与
-V1 `arb-load` 复合合同重叠，当前不声明为 V2 capability。
-
-DG4202 `00.01.14` 已在 CH1、output OFF、FIX 条件下完成一次受控的 `HARM`／`HARMONIC` → Sine
-Basic V2 状态迁移与最终 readback。该观察未经过示波器环回或外部测量，只覆盖 CH1 与该固件，
-不说明逐阶 Harmonic 参数是否保留，也不提升 conformance manifest 的证据等级。
-
-`rigol.dg4202-v2` 是独立的 opt-in entry point，保留旧 driver 的基础 V2 surface，并仅额外公开
-`source.sweep_configure_v2` 和 `source.sweep_fire_v2`。`TRACe:DATA:DAC VOLATILE` 没有已验证的通道 selector，故该 entry point 的
-ARB 仍为只读，`source.arbitrary_volatile_replace_v2` 不公开。该 entry point 的 OFF／FIX `USER` 状态仅可
-通过显式 Basic V2 Sine request 退出；该操作不会读取或恢复 volatile USER 内容。`rigol.dg4202` 的 legacy
-V1 表面保持不变。Sweep 的实机证据仅覆盖输出 OFF 配置线性 1–2 kHz、101 点、12 s、manual trigger，随后在同一
-会话显式 fire、每路三次 RTM 高阻采集和输出 OFF；它不外推任意 Sweep 参数，也不改变 legacy V1 Sweep 路由。V2
-操作结束时会保持 Sweep ON，验收使用独立 legacy 事务恢复 FIX/OFF。
-
-`rigol.dg4202-v2-workspace` 是另一条独立 opt-in entry point。除只读 identity／snapshot 和用于
-OFF safety closure 的 `source.output_v2` 外，它只公开
-`source.arbitrary_workspace_volatile_replace_v2`；不公开 V1 setter、Basic／Live Basic 或 Counter 写能力。
-它把 `TRACe:DATA:DAC VOLATILE` 建模为整机的无通道 volatile 工作区：写前要求 CH1/CH2 都为 OFF，写入失败后
-对仍可用的两路各最多尝试一次 OFF recovery。该接口不接受 channel 参数，不声称 USER 被选到哪一路，不读取或恢复
-被覆盖的内容。现有
-`source.arbitrary_volatile_replace_v2` 仍是通道型合同，DG4202 不声明它。
-
-为保持 legacy 合同，DG descriptor 明确设置 `v1_route_migration_enabled=false`。既有 V1
-`source.set-*`、`source.output`、离散频响、`arb-load` 和 basic restore 继续调用 V1 路由；
-只有显式的 V2 CLI、run step 或 Service 调用使用 P1/Counter V2 adapter。它避免以不完整的
-Basic/Output V2 组合替换 DAC14 upload 或 restore 事务。
-
-P1 仍保留 `0.3.0` 的 V1 M1/M2/M4 事务边界：所有 I/O 使用同一可重入锁，固定波写入采用
-写前快照、逐步回读、off-first 恢复和歧义写锁存；DAC14 上传仅允许目标通道已 OFF、FIX
-且 sweep OFF，并明确把被覆盖的 volatile USER 波表视为不可恢复副作用。M3/M5/M6 profile
-都是只读上下文，不扩大 core 的 basic restore，也不承诺恢复 load、polarity、noise、sync、
-burst、modulation、marker、pulse hold、完整 sweep/counter profile 或 volatile USER 内容。
-结论不外推到其它型号、固件或未验收的通道接线。
-
-Coupling、Noise Overlay 与 Sync 的后续写入只完成合同和恢复顺序设计，当前 descriptor
-仍只声明 READ。Coupling 需要双通道完整目标和恢复；Noise Overlay 配置成功不能绕过独立的
-硬峰值预算；Sync 配置与物理 Sync 端口 enable 必须拆分，enable 还需要端口模型和 A5 接线证据。
-
-示例使用文档保留地址：
+## 最小配置
 
 ```toml
 [connection]
@@ -119,124 +36,16 @@ default_channel = 1
 check_errors = true
 ```
 
-## 许可证
-
-本插件采用 [MIT License](LICENSE)。
-
-## 实机验收边界
-
-早期验收曾使用外置 `wavebench-rigol-dg4000` 驱动 DG4202 CH1 输出 1 kHz、1 Vpp 正弦，并由外置 `wavebench-rigol-ds1000z` 驱动 DS1104Z Plus CH1 闭环采集。示波器 CH1 为 AC 耦合、固定高阻输入；DEF 波形返回 1200 点，WaveBench 测得 1000.000 Hz、1.008 Vpp。两台仪器前后错误队列均为空，发生器 CH1 原状态在 `finally` 路径恢复并回读确认。
-
-2026-07-27 在 DG4202 固件 `00.01.14` 上重新执行当前工作树验收：M1 对
-CH1/CH2 完成合计 24 查询、0 写入的严格状态 profile；M2 对两路分别完成 OFF、临时
-SQU/不同固定频率/0.8 Vpp/37% duty、显式 ON→OFF、off-first 恢复及新会话逐字段复核。
-两路最终均恢复为原始 SIN、1 kHz、5 Vpp、0 V offset、FIX、sweep OFF、输出 ON。
-
-M3 使用外置插件 `0.4.0` 在同一受控会话读取 CH1/CH2 完整 channel profile。transport
-守卫把任何 text/binary write 立即变为失败；验收最终完成 45 次 query、0 次 text write、
-0 次 binary write。两路均回读为 high-impedance load、NORMAL polarity、noise OFF/10%、
-sync ON/POSITIVE、burst OFF、modulation OFF/AM、marker OFF、pulse hold DUTY；所有基础状态
-与上下文字段全量返回。该验收没有读取错误队列，以免把消费型错误读取误称为无副作用。
-
-M4 对 CH1/CH2 分别在输出 OFF 时上传 64 点 little-endian DAC14 三角波，回读
-USER/1 kHz/1 Vpp/0 V、确认错误队列为空，并在新会话确认原态恢复。CH1 随后以 2 Vpp
-显式输出到高阻 RTM2032：10,000 点采集测得 997.26 Hz、2.16 Vpp，三角模板 RMSE
-0.0390 V，约为正弦模板 RMSE 的 49.2%；恢复后复测原正弦为 998.25 Hz、5.12 Vpp。
-CH2 随后接入 RTM2032 CH2 高阻输入，以 1 kHz、1 Vpp 三角波完成独立模拟闭环：测得
-999.75 Hz、1.12 Vpp，归一化三角模板 RMSE 为 0.09285，正弦模板 RMSE 为 0.2196，
-比值为 0.4229。DG4202 CH2 原始状态随后恢复，错误队列为空；示波器时基、量程和触发
-设置在本轮验收前后保持不变。RTM2032 抓波会发送受控的传输格式/点数设置，不计作
-示波器零写入会话。两路 volatile USER 内容均被本次上传覆盖，这是已知且不可恢复的
-副作用；未保存真实地址、序列号、原始波形或命令日志。
-
-M5 使用外置插件 `0.5.0` 对 CH1/CH2 完成 query-only sweep profile 验收。初始两路均为
-output ON、FIX、sweep/burst/modulation/marker OFF；受控预置会话先将输出关闭，再分别
-建立 sweep OFF 与 sweep ON 状态。每个状态都在独立 transport 守卫下对两通道连续读取
-三轮，单个只读会话完成 104 次 query、0 次 text write、0 次 binary write，六份 profile
-在各状态下逐字段一致。profile 覆盖 start/stop/center/span、linear/log/step、steps、
-sweep/hold/return time、trigger source/slope/out 和 marker；任何查询或关系校验失败均不会
-返回部分结果。预置与恢复写入不属于这两个零写读取会话；恢复完成后，CH1/CH2 的完整
-channel profile 与 sweep profile 均与初始快照相等，错误队列为空。未发送 immediate
-trigger 或 `*TRG`，也未形成 sweep 写 capability。
-
-M6 使用外置插件 `0.6.0` 对 DG4202 的全局 counter 完成非破坏性 OFF-state 验收。
-counter 初始与最终均为 OFF，statistics 为 OFF，显示为 DIGITAL；连续三轮完整 profile
-逐字段一致。整个验收完成 39 次 query、0 次 text write、0 次 binary write，并回读
-AC coupling、1 MΩ、1X attenuation、USER1 gate、HF rejection OFF、0 V trigger level 和
-50% sensitivity。OFF 状态明确返回 `measurement=None`，驱动未发送 `MEASure?`、未自动
-启用 counter，也未发送 `AUTO` 或 `STATIstics:CLEAr`。counter-ON 的频率、周期、占空比、
-正脉宽和负脉宽五元组解析及关系校验只有离线证据，不属于本次实机验收。
-
-2026-08-30 使用外置插件 `0.7.0` 完成 Source V2 当前状态只读验收。DG4202 固件
-`00.01.14` 的 CH1/CH2 均为 OFF、SIN、1 kHz、5 Vpp、0 V offset、FIX、sweep OFF；
-`source.snapshot_v2` 完成 40 次纯查询，前后锚点一致，会话保持 healthy。Burst OFF
-以类型化状态返回；Sweep、Pulse 与 Harmonic 因激活条件不成立而返回
-`inactive_by_anchor`。随后使用既有 V1 事务在输出始终 OFF 的条件下，将两路临时设为
-PULSE、1 Vpp；第二次 V2 快照完成 52 次查询，并在两路返回 DUTY hold、500 µs width、
-50% duty、0 s delay 和 1.9531 µs 双边沿。最终新会话确认两路均恢复为 OFF、SIN、
-1 kHz、5 Vpp、0 V offset、FIX。全程未输出波形或采集 RTM2032；Sweep、Burst ON 和
-Harmonic 活跃态仍无本轮实机证据。
-
-同日的后续只读验收把 Counter、Modulation、部分 ARB、Coupling、Sync 与 Noise Overlay
-一并纳入同一个 Source V2 快照。第一次运行在旧的 `:COUP:CHAN:BASE?` 写法处超时；该会话
-立即停止并关闭，两路复读仍为 OFF、SIN、1 kHz、5 Vpp、0 V offset、FIX。驱动随后改用手册
-完整关键字 `:COUP:CHANNEL:BASE?`，DG 包全量测试保持 `213 passed`。最终验收快照完成
-67 次纯查询，锚点一致且 session health 前后均为 healthy；完整 harness 共 112 次查询，
-text/binary write request、transmitted、completed 与 instrument mutation 均为 0。Coupling
-三维均为 OFF、基准 CH1；两路 Sync 均为 ON/POSITIVE，Noise Overlay 均为 OFF/10%。
-最终两路状态未改变，会话健康关闭；RTM2032 未被访问、触发或采集。
-
-同日完成 P1 normal-path 验收。CH1→RTM CH1 在输出 OFF 下依次写入 RAMP、PULSE、NOISE、
-DC 和 SIN，并以 V2 postcondition 逐项回读；随后以正弦完成 1 kHz/1 Vpp 输出、live
-frequency 改为 2 kHz、live Vpp 改为 2 Vpp 的三次高阻采集。CH2→RTM CH2 在输出 OFF 下
-完成 SQUARE/25% duty、1 kHz/1 Vpp 配置，并完成相同的 2 kHz live frequency 与 2 Vpp
-live Vpp 采集。两路最高输出为 2 Vpp，每次仅开启对应通道，所有 capture quality/expect
-门均通过。独立恢复 run 将 CH1/CH2 复读为 OFF、SIN、1 kHz、5 Vpp、0 V、FIX 和 50% duty；
-RTM 两路均为 high-Z。该证据只覆盖正常写入、后置回读和最终 OFF，不覆盖 timeout、二义写
-或 recovery-failure 的实机故障注入。
-
-2026-08-31，Counter V2 在 DG4202 与 RTM2032 CH1 的三通接线下完成独立验收。Counter 输入
-约束为不超过 5 Vpp，实际发射 1 kHz、1 Vpp 正弦。输入阻抗 50 Ω／1 MΩ、衰减 1X／10X、
-trigger level、statistics 与 AC/DC coupling 均逐项写入并回读；Counter 测得 1000.011247 Hz，
-RTM 捕获与 FFT 为 1000 Hz、1.0 Vpp。随后输出关闭、Counter 关闭、耦合恢复 AC，新的会话复读
-CH1 OFF、5 Vpp 配置与 Counter OFF。输出始终 OFF 的 Counter 启用→关闭也通过，验证暂不可用测量
-不会阻断安全关闭。timeout、二义写与 recovery-failure 仍无实机故障注入结论。
-
-同日，`rigol.dg4202-v2` 完成受控 Sweep 实机验收。CH1 和 CH2 分别在输出 OFF 时配置为
-线性 1–2 kHz、101 点、12 s、manual trigger、marker OFF；随后仅开启当前通道，在同一会话中
-fire 并完成三次 RTM 高阻采集。CH1 的三段频率估计为约 1202/1546/1872 Hz，CH2 为约
-1265/1628/1982 Hz，最大采集 Vpp 为 1.016。每个 run 均在两路 output OFF 后结束；V2 不恢复
-Sweep 状态，因此再用独立 legacy 事务复原两路 FIX/OFF，并由新会话确认。已关闭的 marker 保留
-陈旧频率属于只读设备状态，不会再被误判为配置不一致；启用 marker 时仍要求其位于 Sweep 窗口内。
-
-## 开发验证
-
-```bash
-python -m pytest -q packages/wavebench-rigol-dg4000/tests
-python -m ruff check packages/wavebench-rigol-dg4000
-python -m wavebench plugin package check packages/wavebench-rigol-dg4000
-python -m wavebench plugin install packages/wavebench-rigol-dg4000 --dry-run
-```
+示例使用 RFC 5737 文档地址。需要高级 Sweep 或 volatile workspace 时，必须显式选择对应的
+opt-in driver ID。
+
+## 安全边界
+
+descriptor 导入不连接仪器。默认测试不扫描资源、不连接仪器，也不发送真实 SCPI。输出控制、
+任意波形上传和其他写操作不会盲目重试；volatile USER／workspace 内容可能被覆盖，且不能承诺
+恢复。真实仪器地址、序列号、波形、截图和命令日志不得提交。
+
+## 开发与许可证
 
-日常源码开发可使用仓库级 [editable 开发环境](../../doc/DEVELOPMENT.md)；正式验收仍使用真实 wheel 和一次性虚拟环境。
-
-真实仪器地址、序列号、波形、截图和命令日志不得提交。
-
-## 来源
-
-- `0.1.0`：从 WaveBench 内建 DG4202 协议实现迁移；核心继续持有 Service 和安全策略。
-- `0.2.0`：增加 M0–M12 双语覆盖里程碑与发行包防泄漏回归；不扩大 capability。
-- `0.3.0`：交付现有 API 的严格收口、固定波事务化和 DAC14 fail-closed 实现；DG4202 `00.01.14` 的 M1/M2 与 M4 CH1 实机退出门通过，M4 CH2 仅协议/恢复通过，未扩大 capability。
-- `0.4.0`：要求 WaveBench `>=0.8.15`，新增 `source.channel_profile`；DG4202 `00.01.14` 的 CH1/CH2 严格零写 M3 实机门及 M4 完整实机门通过，不扩大自动恢复范围或 capability。
-- `0.5.0`：要求 WaveBench `>=0.8.16`，新增 `source.sweep_profile`；DG4202 `00.01.14`
-  的 CH1/CH2 在 sweep OFF/ON 两种预置状态下各完成三轮严格零写 M5 实机门，不增加
-  sweep setter、trigger 或自动恢复字段。
-- `0.6.0`：要求 WaveBench `>=0.8.17`，新增 `source.counter_profile`；DG4202
-  `00.01.14` 在 counter OFF 下完成三轮严格零写 M6 实机门，不自动启用 counter，
-  不发送 `AUTO`/statistics clear，也不把离线验证的 counter-ON 测量解析写成实机结论。
-- `0.7.0` 开发分支：要求 WaveBench `>=0.8.25`，保留只读 `source.snapshot_v2`，并开放
-  Basic／Live Basic／Output P1 与 Counter V2 capability。`rigol.dg4202-v2` 另以独立 opt-in
-  entry point 开放受限的 Sweep configure/manual-fire；它不迁移 V1 路由，也不开放 volatile ARB。
-  Source V2 正常路径已在 DG4202 `00.01.14` 的 CH1/CH2 高阻采集及 Counter→RTM CH1 三通测量中
-  验证；Sweep 则在两路独立的低压高阻回路通过。Burst、Coupling、Noise Overlay 和 Sync 写 capability
-  仍未公开，故障 recovery 尚无实机 fault-injection 结论。
+覆盖矩阵、里程碑、conformance 与历史验收入口见[插件文档](doc/README.md)。日常源码开发使用
+仓库级 [editable 开发环境](../../doc/DEVELOPMENT.md)。本插件采用 [MIT License](LICENSE)。
diff --git a/packages/wavebench-rigol-dg4000/README_EN.md b/packages/wavebench-rigol-dg4000/README_EN.md
index dcf81aa..895d711 100644
--- a/packages/wavebench-rigol-dg4000/README_EN.md
+++ b/packages/wavebench-rigol-dg4000/README_EN.md
@@ -2,263 +2,56 @@
 
 [中文](README.md)
 
-An executable WaveBench instrument plugin for the dual-channel RIGOL DG4202 and compatible DG4000 function/arbitrary waveform generators.
+A WaveBench instrument plugin for the dual-channel RIGOL DG4202 and compatible DG4000
+function/arbitrary waveform generators.
 
-## Identity and compatibility
+## Start here
 
-- Distribution: `wavebench-rigol-dg4000`
-- Canonical driver ID: `rigol.dg4202`
-- Opt-in advanced driver ID: `rigol.dg4202-v2`
-- Opt-in workspace driver ID: `rigol.dg4202-v2-workspace`
-- WaveBench: `>=0.8.25,<0.9`
-- Python: `>=3.11`
-- Transport backend: `pyvisa`
+- [Find the current version, entry points, models, and capabilities](../../doc/reference/plugin-catalog-en.md)
+- [Browse the DG4000 plugin documentation](doc/README_EN.md)
+- [Install and manage WaveBench plugins](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-This package uses the public `SourceChannelProfile` contract first available in WaveBench
-`v0.8.15`, the `SourceSweepProfile` contract added in `v0.8.16`, the `SourceCounterProfile`
-contract added in `v0.8.17`, and the Source V2 snapshot contract available in `v0.8.25`. It does
-not run with a core older than `v0.8.25` and does not automatically claim compatibility with a
-future `0.9` core.
+## Driver entries
 
-The plugin defines no aliases. After installation, the explicit canonical ID `rigol.dg4202` selects the external implementation, while the short `dg4202` alias always selects WaveBench's built-in fallback. Removing the plugin also restores the built-in canonical implementation.
+- `rigol.dg4202`: retains existing V1 routes and exposes the declared Source V2 Basic, Output, and Counter operations.
+- `rigol.dg4202-v2`: explicit opt-in entry for constrained Sweep configure/manual-fire operations.
+- `rigol.dg4202-v2-workspace`: explicit opt-in entry for unscoped volatile-ARB workspace replacement.
 
-## Capabilities and boundaries
+None of the entries declares an alias; the short `dg4202` alias always selects the Core fallback.
+The production descriptors and generated plugin catalog are authoritative for each entry's exact
+capabilities, profiles, version range, and conformance evidence references.
 
-The driver supports identity/error queries, CH1/CH2 state, strict read-only channel profiles for
-load, polarity, noise, sync, burst, modulation, marker, and pulse hold, strict read-only sweep
-profiles for the frequency window, spacing, timing, trigger, and marker, a strict read-only global
-counter profile for input configuration, statistics display, and conditional five-field
-measurements, fixed frequency, function, VPP amplitude, square duty cycle, explicit output control,
-query-only arbitrary-wave capability probes, and upload of validated DAC14 blocks through
-WaveBench's public `DG4000DacBlock` contract. `source.snapshot_v2` adds typed read-only Basic,
-output-enabled, Sweep, Pulse, Burst, partial Harmonic, Modulation state/type, partial ARB,
-Noise Overlay, and Sync facets for CH1/CH2, plus the global Counter and parameterized CH1/CH2
-Coupling state. The Harmonic facet does not claim per-order component readback.
+The implementation also covers strict read-only snapshots and profiles, fixed-wave configuration,
+output control, and validated DAC14 uploads. Core owns waveform-file loading, normalization,
+amplitude safety limits, services, run plans, state restoration, and artifacts.
 
-The current development branch also declares explicit Source V2 P1 write capabilities
-`source.basic_configure_v2`, `source.basic_live_configure_v2`, and `source.output_v2`, plus
-production Counter V2 capabilities `source.counter_configure_v2`, `source.counter_enable_v2`
-(which covers the separate disable operation), and `source.counter_measure_v2`.
+## Minimum configuration
 
-WaveBench core retains waveform-file loading, normalization, DAC14 encoding, amplitude safety limits, services, run plans, state restoration, and artifacts. Descriptor import performs no instrument I/O, and default tests use only a fake transport. Writes and uploads are not retried blindly.
+```toml
+[connection]
+backend = "lan"
+resource = "TCPIP::192.0.2.30::INSTR"
 
-The current `0.7.0` development branch adds Source V2 P1 and Counter V2 beside the read-only
-snapshot surface.
-`source.basic_configure_v2` requires target output OFF, FIX mode, and a fresh V2 snapshot, and
-changes exactly one Basic field per request. It currently accepts SIN/SQU/RAMP/PULS/NOIS/DC,
-frequency, Vpp, offset, or square duty. `source.basic_live_configure_v2` changes exactly one
-frequency or Vpp field while output remains ON in FIX mode, without output cycling.
-`source.output_v2` separately enables or disables one channel and the Core reads back its final
-state.
-Counter V2 changes exactly one of coupling, input impedance, attenuation, trigger level, or
-statistics enable per request. Enable/disable never configures input state or clears statistics;
-measure accepts only an already-enabled valid five-field result. A settling or no-input Counter
-measurement is unavailable in a V2 snapshot but does not block a safe disable; the legacy profile
-remains strict.
+[source]
+driver = "rigol.dg4202"
+model_hint = "DG4202"
+default_channel = 1
+check_errors = true
+```
 
-DG4000 has no independent Harmonic state-off command, so the descriptor does not declare
-`source.harmonics_disable_v2`. When output is OFF, frequency mode is FIX, and Basic readback is
-explicitly `HARM`/`HARMONIC`, a Sine `source.basic_configure_v2` request may leave that waveform.
-This is a Basic waveform change, not an alias for a state-only Harmonic disable, and it makes no
-claim about preserving per-order parameters. The volatile ARB adapter remains an offline candidate;
-its overlap with the V1 `arb-load` composite contract keeps it out of the V2 capability surface.
+The example uses an RFC 5737 documentation address. Advanced Sweep or volatile-workspace behavior
+requires explicit selection of the corresponding opt-in driver ID.
 
-A controlled DG4202 `00.01.14` observation confirmed one CH1, output-OFF, FIX `HARM`/`HARMONIC` to
-Sine Basic V2 transition with final readback. It had no oscilloscope loopback or external measurement,
-covers only CH1 and this firmware, makes no per-order-parameter preservation claim, and does not
-raise any conformance-manifest evidence level.
+## Safety boundary
 
-`rigol.dg4202-v2` is a separate opt-in entry point that retains the legacy driver's basic V2
-surface and adds only `source.sweep_configure_v2` and `source.sweep_fire_v2`. `TRACe:DATA:DAC VOLATILE` has no verified
-channel selector, so ARB remains read-only on that entry point and
-`source.arbitrary_volatile_replace_v2` is not declared. An OFF/FIX `USER` state on that entry point
-may leave through an explicit Basic V2 Sine request; that operation neither reads nor restores volatile
-USER content. The `rigol.dg4202` legacy V1 surface is unchanged.
+Descriptor import performs no instrument I/O. Default tests do not scan resources, connect to an
+instrument, or send real SCPI. Output control, arbitrary-wave uploads, and other writes are not
+retried blindly. Volatile USER/workspace content may be overwritten and cannot be promised restored.
+Never commit real resources, serial numbers, waveforms, screenshots, or command logs.
 
-`rigol.dg4202-v2-workspace` is a separate opt-in entry point. Apart from read-only identity/snapshot
-and `source.output_v2` for the OFF safety closure, it exposes only
-`source.arbitrary_workspace_volatile_replace_v2`; it exposes no V1 setters, Basic/Live Basic, or
-Counter write capability. It models `TRACe:DATA:DAC VOLATILE` as an instrument-wide unscoped volatile
-workspace: CH1 and CH2 must both be OFF before the write, and a failure makes at most one OFF-recovery
-attempt per still-usable output. It takes no channel argument, makes no claim about which channel
-selected USER, and neither reads nor restores overwritten content. DG4202 continues
-not to declare the channel-scoped `source.arbitrary_volatile_replace_v2` contract.
+## Development and license
 
-The opt-in Sweep evidence is deliberately narrow: output-OFF configuration of a linear 1–2 kHz,
-101-point, 12-second, manual-trigger Sweep, then same-session fire, three high-impedance RTM
-captures per channel, and output OFF. It does not generalize to arbitrary Sweep parameters and does
-not replace the legacy V1 Sweep route. The V2 operation leaves Sweep enabled; acceptance used a
-separate legacy transaction to return both channels to FIX/OFF.
-
-The DG descriptor explicitly sets `v1_route_migration_enabled=false`. Existing V1 `source.set-*`,
-`source.output`, discrete frequency-response, `arb-load`, and basic restore paths therefore remain
-V1. Only the explicit V2 CLI, run step, or Service operation uses the P1/Counter V2 adapter. This avoids
-silently replacing legacy DAC14 upload or restore transactions with incomplete Basic/Output V2
-composition.
-
-P1 preserves the V1 M1/M2/M4 transaction boundaries from `0.3.0`: all I/O shares one reentrant
-lock; fixed-wave writes use a pre-write snapshot, per-step readback, off-first recovery, and
-ambiguous-write latching; DAC14 upload is accepted only while the target channel is already OFF,
-in FIX mode, with sweep OFF. Overwriting the volatile USER waveform is reported as an irreversible
-side effect. The M3, M5, and M6 profiles are read-only contexts: they do not widen core basic
-restoration or promise restoration of load, polarity, noise, sync, burst, modulation, marker,
-pulse hold, a complete sweep/counter profile, or volatile USER contents. No result is extrapolated
-to another model, firmware, or unaccepted channel wiring.
-
-Future Coupling, Noise Overlay, and Sync writes currently have contract and recovery-order designs
-only; the descriptor still declares READ only. Coupling requires a complete dual-channel target and
-restore, Noise Overlay configuration cannot bypass an independent hard-peak budget, and Sync
-configuration must remain separate from enabling a physical Sync connector. Sync enable also
-requires a physical-port model and A5 wiring evidence.
-
-The [DG4000 coverage matrix](doc/DG4000_COVERAGE_MATRIX_EN.md) maps vendor command domains to
-current public APIs, offline/hardware evidence, and high-risk commands denied by default. The
-[DG4000 coverage milestones](doc/DG4000_COVERAGE_MILESTONES_EN.md) define staged exit gates and
-hardware-acceptance boundaries. The local vendor manual remains under ignored `doc/vendor-local/`
-and is excluded from releases.
-
-The current wheel carries ten Source conformance manifests bound to its non-manifest contents. They
-record the accepted Basic, Output, and Counter V2 scope for DG4202 firmware `00.01.14`, plus the
-restricted opt-in Sweep configure/manual-fire scope of `rigol.dg4202-v2`. Channel-scoped volatile
-ARB, active Harmonic candidates, and the unscoped workspace entry point remain outside conformance
-claims.
-
-The Chinese README contains an RFC 5737 documentation resource. Never commit real resources, serial numbers, captures, screenshots, or command logs.
-
-## License
-
-This plugin is licensed under the [MIT License](LICENSE).
-
-## Hardware acceptance boundary
-
-An earlier controlled loop used external `wavebench-rigol-dg4000` to drive DG4202 CH1 with a 1 kHz, 1 Vpp sine wave and external `wavebench-rigol-ds1000z` to capture DS1104Z Plus CH1. Scope CH1 used AC coupling with fixed high-impedance input. A 1200-point DEF waveform measured 1000.000 Hz and 1.008 Vpp in WaveBench. Both instruments had clear error queues before and after the run, and the original generator CH1 state was restored in a `finally` path and verified by readback.
-
-On 2026-07-27, current worktree behavior was reaccepted on DG4202 firmware `00.01.14`.
-M1 completed one strict CH1/CH2 profile with 24 queries and zero writes. M2 separately exercised
-OFF, temporary SQU/different fixed frequencies/0.8 Vpp/37% duty, explicit ON-to-OFF, off-first
-restore, and fresh-session field verification on both channels. Both channels ended at their
-original SIN, 1 kHz, 5 Vpp, 0 V offset, FIX, sweep OFF, output ON state.
-
-M3 used external plugin `0.4.0` to read complete CH1 and CH2 channel profiles in one controlled
-session. Transport guards turned any text or binary write into an immediate failure; acceptance
-completed 45 queries, zero text writes, and zero binary writes. Both channels reported
-high-impedance load, NORMAL polarity, noise OFF/10%, sync ON/POSITIVE, burst OFF, modulation
-OFF/AM, marker OFF, and pulse hold DUTY, with all basic and context fields returned. The gate did
-not read the error queue because consuming it would not be a side-effect-free observation.
-
-M4 separately uploaded a 64-point little-endian DAC14 triangle to CH1 and CH2 while output was
-OFF, read back USER/1 kHz/1 Vpp/0 V, verified clear error queues, and confirmed restoration in new
-sessions. CH1 then explicitly drove a 2 Vpp triangle into a high-impedance RTM2032. A 10,000-point
-capture measured 997.26 Hz and 2.16 Vpp; triangle-template RMSE was 0.0390 V, 49.2% of the
-sine-template RMSE. After restoration, the original sine measured 998.25 Hz and 5.12 Vpp. CH2 was
-then connected to the high-impedance RTM2032 CH2 input and completed an independent 1 kHz, 1 Vpp
-triangle loop: measured frequency was 999.75 Hz, Vpp was 1.12 V, normalized triangle-template RMSE
-was 0.09285, sine-template RMSE was 0.2196, and their ratio was 0.4229. The original DG4202 CH2
-state was restored and the error queue was clear; scope timebase, range, and trigger settings were
-unchanged across the gate. RTM2032 waveform fetch uses controlled transfer-format/point writes and
-is not a zero-write scope session. Both uploads overwrite volatile USER data, an acknowledged
-irreversible side effect. No real resource, serial number, raw waveform, or command log is stored.
-
-M5 used external plugin `0.5.0` for query-only sweep-profile acceptance on CH1 and CH2. Both
-channels initially had output ON, FIX mode, and sweep/burst/modulation/marker OFF. A controlled
-staging session first disabled output and separately established sweep OFF and sweep ON. For each
-state, a guarded read-only session read both channels three consecutive times. Each session issued
-104 queries, zero text writes, and zero binary writes, and all six profiles matched field by field
-within their preset state. The profile covers start/stop/center/span, linear/log/step spacing,
-steps, sweep/hold/return timing, trigger source/slope/out, and marker. Any failed query or invalid
-relationship rejects the whole profile. Staging and restoration writes were outside the two
-zero-write read sessions. After restoration, both complete channel profiles and sweep profiles
-matched their initial snapshots and the error queue was clear. No immediate trigger or `*TRG` was
-sent, and no sweep-write capability was created.
-
-M6 used external plugin `0.6.0` for non-destructive OFF-state acceptance of the DG4202's global
-counter. The counter was OFF before and after the gate, statistics stayed OFF, the display stayed
-DIGITAL, and three complete profiles matched field by field. The complete gate issued 39 queries,
-zero text writes, and zero binary writes, returning AC coupling, 1 megaohm, 1X attenuation, USER1
-gate time, HF rejection OFF, 0 V trigger level, and 50% sensitivity. The OFF state explicitly
-returned `measurement=None`; the driver sent no `MEASure?`, did not enable the counter, and sent
-neither `AUTO` nor `STATIstics:CLEAr`. Parsing and relationship validation for the counter-ON
-frequency/period/duty/positive-width/negative-width tuple has offline evidence only and is not part
-of this hardware conclusion.
-
-On 2026-08-30, external plugin `0.7.0` completed read-only Source V2 acceptance for the current
-instrument state. DG4202 firmware `00.01.14` reported CH1/CH2 OFF, SIN, 1 kHz, 5 Vpp, 0 V offset,
-FIX, and sweep OFF. `source.snapshot_v2` completed 40 pure queries with matching before/after
-anchors and healthy session state. Burst OFF was returned as a typed facet; Sweep, Pulse, and
-Harmonic were `inactive_by_anchor`. Existing V1 transactions then staged both channels at PULSE,
-1 Vpp, and output OFF. A second V2 snapshot completed 52 queries and returned DUTY hold, 500 us
-width, 50% duty, 0 s delay, and 1.9531 us leading/trailing transitions on both channels. A fresh
-final session confirmed both channels restored to OFF, SIN, 1 kHz, 5 Vpp, 0 V offset, and FIX.
-No waveform was emitted and RTM2032 was not captured. Active Sweep, Burst ON, and Harmonic remain
-outside this hardware evidence.
-
-A follow-up read-only gate on the same date added Counter, Modulation, partial ARB, Coupling, Sync,
-and Noise Overlay to one Source V2 snapshot. The first run timed out at the previous
-`:COUP:CHAN:BASE?` spelling; that session stopped immediately and closed, and both channels still
-read OFF, SIN, 1 kHz, 5 Vpp, 0 V offset, and FIX. The driver then used the manual's complete
-`:COUP:CHANNEL:BASE?` keyword and retained `213 passed` package tests. The accepted snapshot issued
-67 pure queries with matching anchors and healthy session state before and after. The complete
-harness issued 112 queries and recorded zero text/binary write requests, transmissions,
-completions, or instrument mutations. All three Coupling dimensions were OFF with CH1 as reference;
-both Sync outputs were ON/POSITIVE and both Noise Overlay states were OFF/10%. Final channel state
-was unchanged and the session closed healthy. RTM2032 was not accessed, triggered, or captured.
-
-The same date also completed normal-path P1 acceptance. With output OFF, CH1→RTM CH1 wrote and
-read back RAMP, PULSE, NOISE, DC, and SIN through V2 postconditions, then captured sine at
-1 kHz/1 Vpp, after a live frequency change to 2 kHz, and after a live Vpp change to 2 Vpp.
-CH2→RTM CH2 configured SQUARE/25% duty at 1 kHz/1 Vpp and completed the same live frequency and
-Vpp captures. Each channel emitted alone, no output exceeded 2 Vpp, and every capture quality and
-expectation gate passed. A separate restoration run independently read both channels as OFF, SIN,
-1 kHz, 5 Vpp, 0 V, FIX, and 50% duty; both RTM inputs remained high-Z. This evidence covers normal
-writes, postconditions, and final OFF only, not timeout, ambiguous-write, or recovery-failure fault
-injection on hardware.
-
-On 2026-08-31, Counter V2 completed an independent acceptance using a T connection from DG4202 CH1
-to RTM2032 CH1 and the DG Counter input. The Counter input limit was 5 Vpp; the emitted signal was
-only 1 kHz at 1 Vpp. The transaction wrote and read back 50 ohm/1 megaohm impedance, 1X/10X
-attenuation, trigger level, statistics, and AC/DC coupling one field at a time. Counter reported
-1000.011247 Hz while the RTM capture and FFT reported 1000 Hz at 1.0 Vpp. The final fresh-session
-readback confirmed CH1 OFF with its 5 Vpp configuration and Counter OFF/AC. A Counter enable→disable
-run with output held OFF also passed, proving an unavailable measurement cannot block safe disable.
-No timeout, ambiguous-write, or recovery-failure fault was injected into hardware.
-
-On the same date, `rigol.dg4202-v2` completed controlled Sweep acceptance. CH1 and CH2 were each
-configured while output was OFF for a linear 1–2 kHz, 101-point, 12-second manual-trigger Sweep
-with marker OFF. The selected channel was then enabled, fired in the same session, and captured
-three times through the high-impedance RTM input. CH1 frequency estimates were approximately
-1202/1546/1872 Hz and CH2 estimates approximately 1265/1628/1982 Hz; maximum captured Vpp was
-1.016. Each run ended with both outputs OFF. Since V2 does not restore Sweep state, a separate
-legacy transaction returned both channels to FIX/OFF and a fresh session verified the result. A
-disabled marker may retain a stale frequency as read-only device state; enabled markers remain
-range-checked against the Sweep window.
-
-## Development checks
-
-Run the package tests, Ruff, WaveBench package inspection, and a managed-install dry run from an
-environment containing WaveBench `v0.8.25` or newer within the declared `<0.9` range.
-
-Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md) for daily source work. Formal acceptance still uses a real wheel and a disposable virtual environment.
-
-## Provenance
-
-- `0.1.0` migrated the vendor-protocol portion of WaveBench's built-in DG4202 driver while leaving services and safety policy in core.
-- `0.2.0` adds the bilingual M0-M12 coverage plan and release-artifact leak prevention without expanding capabilities.
-- `0.3.0` delivers strict current-API validation, transactional fixed-wave writes, and fail-closed DAC14 handling. DG4202 `00.01.14` passes M1/M2 and the M4 CH1 hardware gate; M4 CH2 passes protocol/restoration only. No capability is added.
-- `0.4.0` requires WaveBench `>=0.8.15` and adds `source.channel_profile`. DG4202 `00.01.14`
-  passes the strict zero-write M3 gate and complete M4 hardware gate on CH1/CH2 without widening
-  automatic restoration or the capability surface.
-- `0.5.0` requires WaveBench `>=0.8.16` and adds `source.sweep_profile`. DG4202 `00.01.14`
-  passes three strict zero-write M5 rounds on CH1/CH2 in both sweep-OFF and sweep-ON preset states
-  without adding a sweep setter, trigger, or automatic-restoration field.
-- `0.6.0` requires WaveBench `>=0.8.17` and adds `source.counter_profile`. DG4202 `00.01.14`
-  passes three strict zero-write M6 rounds with the counter OFF, without automatically enabling
-  the counter, sending `AUTO`/statistics clear, or presenting offline-only counter-ON parsing as a
-  hardware result.
-- The `0.7.0` development branch requires WaveBench `>=0.8.25`, retains pure-query
-  `source.snapshot_v2`, and declares Basic/Live Basic/Output P1 plus Counter V2 capabilities.
-  `rigol.dg4202-v2` separately declares restricted Sweep configure/manual-fire as an opt-in driver;
-  it does not migrate V1 routes or expose volatile ARB. DG4202 `00.01.14` normal paths were accepted
-  on CH1 and CH2 through high-impedance RTM2032 captures and on Counter through the CH1 T connection;
-  the restricted Sweep path passed independent low-voltage high-impedance loops on both channels.
-  Burst, Coupling, Noise Overlay, and Sync write capabilities remain undeclared, and no hardware
-  fault-injection conclusion exists for recovery.
+The [plugin documentation](doc/README_EN.md) links the coverage matrix, milestones, conformance, and
+historical acceptance material. Use the repository-level
+[editable development environment](../../doc/DEVELOPMENT_EN.md) for source work. This plugin is
+licensed under the [MIT License](LICENSE).
diff --git a/packages/wavebench-rigol-dg4000/conformance/dg4202-basic-configure-a3.json b/packages/wavebench-rigol-dg4000/conformance/dg4202-basic-configure-a3.json
index 8a92b46..8894f7a 100644
--- a/packages/wavebench-rigol-dg4000/conformance/dg4202-basic-configure-a3.json
+++ b/packages/wavebench-rigol-dg4000/conformance/dg4202-basic-configure-a3.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.25",
   "plugin_version": "0.7.0",
-  "wheel_sha256": "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10",
+  "wheel_sha256": "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c",
   "descriptor_digest": "sha256:2956d875216721d37a0a9ff12ecf79a4d6b6bb1669bbd7fa3c504f56999e35ae",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -50,5 +50,5 @@
     "no active Harmonic exit hardware evidence",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:ed48e459c8369bddf3a7d21ba8ce9cd2b6fb7766eb3653ea6393ab13a91a7c58"
+  "evidence_digest": "sha256:026a27862deff70f3a11bfce0acc9a4658137ad9780967dde3d1e87594717663"
 }
diff --git a/packages/wavebench-rigol-dg4000/conformance/dg4202-basic-read-a1.json b/packages/wavebench-rigol-dg4000/conformance/dg4202-basic-read-a1.json
index 8b8f5a5..6f14c35 100644
--- a/packages/wavebench-rigol-dg4000/conformance/dg4202-basic-read-a1.json
+++ b/packages/wavebench-rigol-dg4000/conformance/dg4202-basic-read-a1.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.25",
   "plugin_version": "0.7.0",
-  "wheel_sha256": "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10",
+  "wheel_sha256": "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c",
   "descriptor_digest": "sha256:2956d875216721d37a0a9ff12ecf79a4d6b6bb1669bbd7fa3c504f56999e35ae",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -47,5 +47,5 @@
     "no active Harmonic or Sweep state claim",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:762b156b86606163ca70d09d8dfd21b751d50b12df0997cf4d61176deb784fdf"
+  "evidence_digest": "sha256:ba60df781bff1a00463b4559067c73f97cd58891ae6842d2d83c61bf23e0df4b"
 }
diff --git a/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-configure-a2.json b/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-configure-a2.json
index d9a588a..eaa7677 100644
--- a/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-configure-a2.json
+++ b/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-configure-a2.json
@@ -12,7 +12,7 @@
   "channels": [],
   "core_version": "0.8.25",
   "plugin_version": "0.7.0",
-  "wheel_sha256": "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10",
+  "wheel_sha256": "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c",
   "descriptor_digest": "sha256:2956d875216721d37a0a9ff12ecf79a4d6b6bb1669bbd7fa3c504f56999e35ae",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -48,5 +48,5 @@
     "no AUTO gate or statistics clear claim",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:81ad6bad58836951dd91415840c05854a94df4c58a03457fbeb29ed66640425d"
+  "evidence_digest": "sha256:bddbedcd202e23d37710390d91ba1378b5011d61016b371111e99da41f76defc"
 }
diff --git a/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-enable-a2.json b/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-enable-a2.json
index f4db599..e19acdf 100644
--- a/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-enable-a2.json
+++ b/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-enable-a2.json
@@ -12,7 +12,7 @@
   "channels": [],
   "core_version": "0.8.25",
   "plugin_version": "0.7.0",
-  "wheel_sha256": "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10",
+  "wheel_sha256": "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c",
   "descriptor_digest": "sha256:2956d875216721d37a0a9ff12ecf79a4d6b6bb1669bbd7fa3c504f56999e35ae",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -47,5 +47,5 @@
     "no timeout or ambiguous-write hardware evidence",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:b8639e0202fad71670c70cc9ac4416c9edd2ffca3a53b3f0336baf8fc0a6e1c9"
+  "evidence_digest": "sha256:3959d49c98506c99bd4813e7f796fdd450bcdd9d0049e62638cde8ea54c47962"
 }
diff --git a/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-measure-a3.json b/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-measure-a3.json
index 927793f..c572b6a 100644
--- a/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-measure-a3.json
+++ b/packages/wavebench-rigol-dg4000/conformance/dg4202-counter-measure-a3.json
@@ -12,7 +12,7 @@
   "channels": [],
   "core_version": "0.8.25",
   "plugin_version": "0.7.0",
-  "wheel_sha256": "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10",
+  "wheel_sha256": "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c",
   "descriptor_digest": "sha256:2956d875216721d37a0a9ff12ecf79a4d6b6bb1669bbd7fa3c504f56999e35ae",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -48,5 +48,5 @@
     "no no-input or fault-injection measurement claim",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:2a6a5ec0df9f06e21f38fa9f1a2a0fde12eff064a9a132c76846bb1e99f0eb96"
+  "evidence_digest": "sha256:53752d77980320848a0b1eb8802ba44a2de3f8663fbcc8845b2a15c6114443d4"
 }
diff --git a/packages/wavebench-rigol-dg4000/conformance/dg4202-output-disable-a2.json b/packages/wavebench-rigol-dg4000/conformance/dg4202-output-disable-a2.json
index 8ba4436..1dcf254 100644
--- a/packages/wavebench-rigol-dg4000/conformance/dg4202-output-disable-a2.json
+++ b/packages/wavebench-rigol-dg4000/conformance/dg4202-output-disable-a2.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.25",
   "plugin_version": "0.7.0",
-  "wheel_sha256": "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10",
+  "wheel_sha256": "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c",
   "descriptor_digest": "sha256:2956d875216721d37a0a9ff12ecf79a4d6b6bb1669bbd7fa3c504f56999e35ae",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -47,5 +47,5 @@
     "no fault-injection hardware evidence",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:ea74f88f3fd50c42fe602f69ea2f346a703c0026d14ba11bcfe84d24c6850e1b"
+  "evidence_digest": "sha256:b040b999cccc8fcf9f98db1b5505ef8a6fe067502695a56542bd1657b5181e74"
 }
diff --git a/packages/wavebench-rigol-dg4000/conformance/dg4202-output-enable-a2.json b/packages/wavebench-rigol-dg4000/conformance/dg4202-output-enable-a2.json
index e429886..2b72fd9 100644
--- a/packages/wavebench-rigol-dg4000/conformance/dg4202-output-enable-a2.json
+++ b/packages/wavebench-rigol-dg4000/conformance/dg4202-output-enable-a2.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.25",
   "plugin_version": "0.7.0",
-  "wheel_sha256": "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10",
+  "wheel_sha256": "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c",
   "descriptor_digest": "sha256:2956d875216721d37a0a9ff12ecf79a4d6b6bb1669bbd7fa3c504f56999e35ae",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -48,5 +48,5 @@
     "no fault-injection hardware evidence",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:d13450508eefccbc72c2369fa173871129a16267f4f84dc72ae9d1790512de09"
+  "evidence_digest": "sha256:99f5e0e446d51445f77c7c72ace4ce07455da9fa4e4c56209f18793c3495013a"
 }
diff --git a/packages/wavebench-rigol-dg4000/conformance/dg4202-output-read-a1.json b/packages/wavebench-rigol-dg4000/conformance/dg4202-output-read-a1.json
index aec6ce2..4fe74a2 100644
--- a/packages/wavebench-rigol-dg4000/conformance/dg4202-output-read-a1.json
+++ b/packages/wavebench-rigol-dg4000/conformance/dg4202-output-read-a1.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.25",
   "plugin_version": "0.7.0",
-  "wheel_sha256": "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10",
+  "wheel_sha256": "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c",
   "descriptor_digest": "sha256:2956d875216721d37a0a9ff12ecf79a4d6b6bb1669bbd7fa3c504f56999e35ae",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -47,5 +47,5 @@
     "no simultaneous-output claim",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:719dc4040706001238d3eaa8d2b20dc085445bbd7995f845103b87abf09f993e"
+  "evidence_digest": "sha256:eb302441aa78422f7b1443795ab460df47d0028962c225fe4dbadc330b52e58b"
 }
diff --git a/packages/wavebench-rigol-dg4000/conformance/dg4202-v2-sweep-configure-a4.json b/packages/wavebench-rigol-dg4000/conformance/dg4202-v2-sweep-configure-a4.json
index f931a1b..6065a7d 100644
--- a/packages/wavebench-rigol-dg4000/conformance/dg4202-v2-sweep-configure-a4.json
+++ b/packages/wavebench-rigol-dg4000/conformance/dg4202-v2-sweep-configure-a4.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.25",
   "plugin_version": "0.7.0",
-  "wheel_sha256": "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10",
+  "wheel_sha256": "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c",
   "descriptor_digest": "sha256:a0d0f347a9eea02d00ed0b6cc99884dd1fb3d5bdfb88c334683a009441c246a8",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -58,5 +58,5 @@
     "V2 leaves Sweep enabled; a separate legacy transaction recovered FIX/OFF",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:9dad5e326c2831d1cf204e14fc456ae8bf4d9204383cb4700549f7ff7f58c856"
+  "evidence_digest": "sha256:7d71e0991ffe2118c3375334a6d9114354dfbfbb2e91f8da1fae6e1ae5107b12"
 }
diff --git a/packages/wavebench-rigol-dg4000/conformance/dg4202-v2-sweep-fire-a4.json b/packages/wavebench-rigol-dg4000/conformance/dg4202-v2-sweep-fire-a4.json
index 5a31286..2bc5267 100644
--- a/packages/wavebench-rigol-dg4000/conformance/dg4202-v2-sweep-fire-a4.json
+++ b/packages/wavebench-rigol-dg4000/conformance/dg4202-v2-sweep-fire-a4.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.25",
   "plugin_version": "0.7.0",
-  "wheel_sha256": "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10",
+  "wheel_sha256": "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c",
   "descriptor_digest": "sha256:a0d0f347a9eea02d00ed0b6cc99884dd1fb3d5bdfb88c334683a009441c246a8",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -61,5 +61,5 @@
     "V2 leaves Sweep enabled; a separate legacy transaction recovered FIX/OFF",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:3405a76d77e508c94174e2e38db80e8f8859ce8e255e8be2c648a8de3a139757"
+  "evidence_digest": "sha256:8d337202648549afc008a7c233184d977ea996b4bd8979aad6ae77857e69e7c8"
 }
diff --git a/packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MATRIX.md b/packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MATRIX.md
index 4ac2f43..5cf67da 100644
--- a/packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MATRIX.md
+++ b/packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MATRIX.md
@@ -2,98 +2,79 @@
 
 [English](DG4000_COVERAGE_MATRIX_EN.md)
 
-分阶段实现顺序、事务规则和实机退出门见
-[DG4000 功能覆盖里程碑](DG4000_COVERAGE_MILESTONES.md)。当前 `0.7.0` 开发分支保留
-M0–M6、只读 `source.snapshot_v2`，并开放 Basic／Live Basic／Output Source V2 P1。
-M4/M5 的 CH1/CH2 完整实机门、M6 的全局 counter-OFF 实机门、Source V2 只读门和 P1
-normal-path 门已通过。M7 的受限 opt-in Sweep configure/manual-fire 门已通过；M8–M12 的其余
-受控写入仍未通过。命令出现在本矩阵中不等于已实现。
-
-## 目的、范围与统计口径
-
-本矩阵将本地保存的 DG4000 中文编程手册与 WaveBench 的外置
-`wavebench-rigol-dg4000` 插件、内建 `dg4202` fallback，以及已记录的 DG4202
-验收证据对照。它回答「手册列出了什么」「当前公开 API 实际覆盖了什么」「哪部分有哪一级
-证据」，不把手册、DG4162 示例参数、内建驱动的历史验收或方法存在性等同于当前外置
-插件的功能验收。
-
-审计输入为 DG4000 系列中文编程手册，标注的软件版本为 `00.01.12`、文档编号
-`PGB04008-1110`。转录为 12,236 行 Markdown，保存在本插件的
-`doc/vendor-local/`；该目录被 Git 忽略、不会进入 wheel/sdist，也不会随本文提交。
-手册明确以 DG4162 给出若干范围示例，且提示不同型号、负载和频率会改变参数范围。因此
-本矩阵不把任何 DG4162 数值范围外推给 DG4202。
-
-按手册的「命令系统」目录，本矩阵覆盖 12 个命令域：10 个具名厂商子系统
-(`COUNter`、`COUPling`、`DISPlay`、`MEMory`、`MMEMory`、`OUTPut`、`PA`、
-`SOURce`、`SYSTem`、`TRACe`)、单独列出的 `HCOPy:SDUMp:DATA?`，以及 IEEE
-488.2 公用命令。手册转录的排版标题不能作为完成率分母：同一命令的 set/query、可选
-关键字、同义短写，以及转录中的缺失 `]`、缺失代码围栏和断裂标题都会造成歧义。因此矩阵
-按可审计的功能域和公开 capability 说明覆盖状态，而不报告一个伪精确的百分比。
-
-`rigol.dg4202` 保持既有 WaveBench capability 集合；同一 distribution 的独立
-`rigol.dg4202-v2` 仅额外声明两项受限 Sweep capability。它仍是对 DG4202 双通道基础输出、
-只读通道/sweep 上下文、全局 counter 上下文和窄任意波上传的受控实现，不是通用 DG4000
-SCPI shell，也不承诺覆盖手册中所有 DG4000 型号、固件或外部附件能力。
-
-覆盖标签：
-
-- **外置实机通过**：当前外置插件实现、FakeTransport 测试和受控 DG4202 实机证据均存在。
-- **已实现 / 离线验证**：当前代码和离线精确命令测试存在，但没有该细项的外置插件实机结论。
-- **历史实机证据，未迁移验收**：内建驱动时代有文档化的实机证据；外置插件虽迁移相同协议，仍不把它升级为该插件的实机验收。
-- **诊断探针**：显式只查询候选命令，可能消费错误队列；不等同于稳定功能或厂商正式路径。
-- **未覆盖**：外置插件、内建 fallback 和公开 SourceService 都没有相应 API。
-- **默认拒绝**：即使手册提供命令，也因网络、存储、输出安全或全局状态风险而不暴露。
-
-## 功能覆盖矩阵
-
-### Source V2 公开写入口
-
-下表描述当前开发分支的显式 V2 写入口。DG descriptor 设置
-`v1_route_migration_enabled=false`，因此 P1/Counter capability 不接管任何 legacy V1 route；
-Sweep 仅由单独的 opt-in driver 公开。
-
-| capability | 公开入口与严格边界 | DG4202 `00.01.14` normal-path 证据 |
-|---|---|---|
-| `source.basic_configure_v2` | CLI `source basic-configure-v2`；run `source.basic_configure_v2`。目标输出必须 OFF、频率模式必须 FIX、必须先取得 fresh V2 snapshot；DG adapter 每次只接受一个 Basic field。可请求 SIN/SQU/RAMP/PULS/NOIS/DC、frequency、Vpp、offset 或 square duty。 | CH1 在 OFF 下完成 RAMP/PULSE/NOISE/DC/SIN 写入与 V2 postcondition；CH2 完成 SQUARE/25% duty、frequency 和 Vpp 写入。外部高阻采集只覆盖 CH1 正弦与 CH2 方波。 |
-| `source.basic_live_configure_v2` | CLI `source basic-live-configure-v2`；run `source.basic_live_configure_v2`。输出必须 ON、频率模式必须 FIX，且一次只能改一个 frequency 或 Vpp field；禁止 output cycling。 | CH1/CH2 都完成 1 kHz→2 kHz 和 1 Vpp→2 Vpp 的独立 live 写后高阻采集。 |
-| `source.output_v2` | CLI `source output-v2`；run `source.output_enable_v2` / `source.output_disable_v2`。Core 对 ON/OFF 分别执行 V2 preflight 和最终状态回读。 | 两路各自低压输出、采集、V2 OFF；独立恢复 run 再次确认两路 OFF。 |
-| `source.sweep_configure_v2` | 仅 `rigol.dg4202-v2`；run `source.sweep_configure_v2`。输出必须 OFF、fresh V2 snapshot、Burst/Modulation 必须 OFF，configure 后独立回读。 | CH1/CH2 分别完成线性 1–2 kHz、101 点、12 s、manual trigger、marker OFF 的配置回读。 |
-| `source.sweep_fire_v2` | 仅 `rigol.dg4202-v2`；run `source.sweep_fire_v2`。必须复用同会话已配置 Sweep、当前通道 output ON、manual trigger；不得盲重试。 | CH1/CH2 各完成同会话 fire 和三段 RTM 高阻采集；每个 run 结束两路 output OFF，另用 legacy 事务恢复 FIX/OFF。 |
-| legacy V1 route | `source.set-*`、`source.output`、离散频响、`arb-load`、basic restore 与原有 artifact 保持 V1 合同。 | Core 路由测试与 DG P1 实机计划共同确认 V2 只由显式入口调用。 |
-
-除该受限 opt-in Sweep 外，没有公开 volatile ARB、Burst、Coupling、Noise Overlay 或 Sync 写 capability。
-Sweep evidence 不外推任意频率、幅度或时序；也没有对 timeout、二义写或 recovery-failure 做上机故障注入。
-此类结果继续以离线故障矩阵为准。
-
-| 功能域 | 手册命令面 | 当前公开覆盖 | 证据状态 | 主要缺口与安全边界 | 建议 |
-|---|---|---|---|---|---|
-| 身份与错误队列 | `*IDN?`、`:SYSTem:ERRor?`、`:SYSTem:VERSion?` | `source.idn`、`source.errors`；写操作后可检查错误队列 | **外置实机通过**：DG4202 `00.01.14` 的 M1/M2/M4 前后错误队列与脱敏身份读取通过；精确 SCPI 有离线测试 | `errors()` 会读取并消费队列；未公开 SCPI version、状态寄存器或非消费型健康 API | 保持错误队列显式；若要扩展只读 health，先定义消费语义 |
-| IEEE 488.2 状态保存、复位与触发 | `*RCL`、`*RST`、`*SAV`、`*TRG` | 未公开 | **默认拒绝** | 恢复/保存会覆盖非易失状态；复位改变整机；`*TRG` 会启动 sweep/burst 输出 | 只在单独的受控事务设计、快照和人工确认后考虑 |
-| CH1/CH2 基础状态读取 | `OUTPut?`、`SOURce:FUNCtion?`、`FREQuency?`、`VOLTage?` / `UNIT?` / `OFFSet?`、`PHASe?`、`SWEep:STATe?`、`APPLy?`、方波 duty | `source.status` 保留 V1 结果；`source.snapshot_v2` 以类型化 Basic、输出开关和前后锚点返回双通道状态，频率模式由手册明确的 `SWEep:STATe?` 推导 | **外置实机通过**：V1 严格 profile 为 24 queries、0 writes；`0.7.0` 初始快照为 40 次纯查询，纳入全部新增 facet 后的最终快照为 67 次，均锚点一致且会话 healthy | Source V2 Output 暂不重复查询已由 `source.channel_profile` 覆盖的 load/polarity；快照不扩大自动恢复范围 | 保持 V1 写路由不变；新增字段先满足纯查询、预算和一致性合同 |
-| 固定频率 | `[:SOURce<n>]:FREQuency[:FIXed]`；扫频的 center/span/start/stop 同属 frequency 域 | `source.set_frequency`，以快照、`FIX` 切换、逐步回读、off-first 恢复和歧义锁存组成事务 | **外置实机通过**：DG4202 `00.01.14` CH1/CH2 的 FIX 写入、回读和新会话恢复通过 | `FREQ:MODE` 是当前 DG4202 兼容路径，未在这份手册的 frequency 列表中出现；M5 sweep profile 只读，不设置这些字段 | 保留「先切 FIX」的显式安全语义；任何 sweep 写入必须使用独立事务 |
-| 基础函数与方波占空比 | `FUNCtion[:SHAPe]`、`FUNCtion:SQUare:DCYCle`，以及 `APPLy:SINusoid/SQUare/RAMP/PULSe/NOISe` | `source.set_function`：SIN/SQU/RAMP/PULS/NOIS/DC；`source.set_square_duty_cycle` | **外置实机通过**：CH1/CH2 临时 SQU/37% duty、ON→OFF 和原 SIN 新会话恢复通过；其它函数仅离线 | 不公开 ramp symmetry、pulse 宽度/边沿、noise 参数、apply 组合写入或 function-specific 完整状态恢复 | 先为每种函数定义完整、可回读且可恢复的 profile，再增加 setter |
-| 幅度、单位、偏移与相位 | `VOLTage`、`UNIT`、`OFFSet`、`HIGH`、`LOW`、`PHASe` | `source.set_amplitude_vpp` 写 `UNIT VPP` + amplitude；状态读取 offset/phase；任意波上传内部写 offset | **外置实机通过**：M2 CH1/CH2 的 0.8 Vpp 事务与恢复、M4 CH1 2 Vpp 与 CH2 1 Vpp 模拟闭环；offset 公开 setter 仍无 | 没有公开 offset/phase/high/low setter；VPP 限制由核心 safety limit 约束，仪器实际范围仍依赖型号、频率与负载；DBM/VRMS 未公开 | 保持 VPP-first API；实现其它单位或电平前必须联动 load、范围和恢复策略 |
-| 输出开关 | `OUTPut[<n>][:STATe] ON|OFF` | `source.output`，只在用户明确请求时切换；任意波上传默认不打开输出 | **外置实机通过**：CH1/CH2 M2 的显式 ON→OFF 与恢复通过；M4 CH1/CH2 均有三角波闭环 | 输出会直接影响被测电路；不提供隐式 enable 或重试 | 保持独立 capability；所有更高层流程必须显式记录 output 目标态 |
-| 输出负载、极性、噪声和同步 | `OUTPut:IMPedance/LOAD`、`POLarity`、`NOISe:*`、`SYNC:*` | `source.channel_profile` 只读返回 load/polarity/noise/sync；`source.snapshot_v2` 另以类型化 Noise Overlay 与 Sync facet 返回 enabled、scale 和 polarity | **外置实机通过**：M3 为 45 queries、0 text/binary writes；最终 V2 快照为 67 次纯查询，两路 Noise Overlay OFF/10%、Sync ON/POSITIVE | basic restore 仍不恢复这些字段；没有公开 setter；Noise Overlay 启用后缺少确定性硬峰值边界，Sync enable 还缺物理端口模型与 A5 接线证据 | 写入候选已拆为 Noise OFF-only 配置、Sync 配置和独立物理端口 enable/disable；当前保持 READ only |
-| 双通道耦合 | `COUPling:AMPL/FREQuency/PHASe`、base channel 与状态 | `source.snapshot_v2` 以 `CHANNEL_SET` 返回全局状态、基准通道及 amplitude/frequency/phase 的 enabled + typed deviation | **外置实机通过（只读）**：最终 67-query 快照返回三维 OFF、基准 CH1；FakeTransport 覆盖混合三维、严格范围与零写 | 当前 relation graph 不可读，descriptor 不声明 CONFIGURE；尚未实现完整 target、双通道恢复或写故障矩阵 | Core 候选设计在首次稳定版前替换未发布的布尔 Coupling request；DG 写入仍等待双通道 OFF、完整恢复和 A4/A5 证据 |
-| 扫频与手动/外部触发 | `SWEep:*`、frequency start/stop/center/span、`*TRG` | `source.sweep_profile` 保留完整 V1 只读结果；`source.snapshot_v2` 在 frequency mode 为 Sweep 时复用同一严格 profile 并返回类型化 Sweep facet；仅 `rigol.dg4202-v2` 公开 configure/manual-fire | **M5 外置实机通过**：sweep OFF/ON 预置状态均有零写证据；**M7 受限 opt-in 通过**：CH1/CH2 的 1–2 kHz、101 点、12 s、manual trigger 配置/fire 和三段外部采集均通过 | V2 不恢复完整 Sweep，验收需独立 legacy 恢复；未外推任意参数；`*TRG` 与 raw immediate trigger 仍默认拒绝 | 保持完整快照、逐字段回读、外部测量、output OFF 与 trigger 不重试语义；不要把 opt-in 能力迁移到 V1 路由 |
-| Burst、Pulse、Marker、Harmonic | `BURSt:*`、`PULSe:*`、`MARKer:*`、`HARMonic:*` | `source.snapshot_v2` 可返回完整 Pulse facet、Burst OFF 或完整启用态 facet，以及 Harmonic enabled/configured order/maximum order/preset 的 `PARTIAL` facet；逐阶 amplitude/phase、Marker 写入和所有配置 API 未公开 | **Pulse 外置实机通过；Burst ON 仍仅离线**：CH1/CH2 在 output OFF、PULSE、1 Vpp 下完成 52-query V2 快照和完整 Pulse facet；Burst OFF 实机返回。另有 CH1、output OFF、FIX 的受控 `HARM`／`HARMONIC` → Sine Basic 状态迁移观察及最终 readback，但不属于外置 V2 conformance | Harmonic 不声称分量列表；Burst ON 与 Harmonic 活跃态的完整外置 V2 证据仍缺；任何配置或 trigger 都缺少完整恢复事务 | 保持只读；活跃态由独立受控预置会话验收，不以 raw SCPI 绕过写 capability |
-| 调制 | `MOD:AM/FM/PM/ASK/FSK/PSK/BPSK/QPSK/3FSK/4FSK/OSK/PWM:*` | `source.channel_profile` 与 `source.snapshot_v2` 均只读返回 modulation state/type；无模式专属参数或 setter | **部分只读上下文实机通过**：最终 V2 快照在 CH1/CH2 返回 OFF/AM；具体调制参数和写入未覆盖 | state/type 查询不等于调制能力；外部源、码率、极性与 phase 有交叉依赖 | **P3**：按模式拆分 capability，不通过 raw-SCPI 绕过恢复策略 |
-| 任意波上传：DAC14 | `TRACe:DATA:DAC VOLATILE,<binary-block>` 或十进制 DAC 数据 | `source.arbitrary_upload` 只接收结构与样本均校验的 little-endian `DG4000DacBlock`；目标必须已 OFF、FIX、sweep OFF；binary 后逐项回读，失败锁存且明确 volatile USER 波表不可恢复 | **M4 外置实机通过**：CH1/CH2 均完成 output-off 上传、回读、错误队列、模拟频率/Vpp/形状闭环和恢复 | 没有公开十进制/浮点上传、DAC16、任意波编辑/读回；上传会覆盖 volatile 波形且切换到 USER | 保持当前窄协议面；新增格式前分别建立生命周期、回读与恢复证据 |
-| 任意波诊断查询 | 当前插件候选含 `FUNC?`、`FUNC:USER?` 与若干 `SOURce:*ARB*` / `SOURce:*DATA*` 查询 | `source.arbitrary_probe`：仅允许问号结尾的候选并记录每条命令后的错误队列 | **诊断探针**；FakeTransport 覆盖 | 手册把 waveform data 放在 `TRACe:DATA`，不是 `SOURce:DATA`；某些候选本来就可能得到 `-113`。`errors()` 消费队列，因此它不是非侵入健康读取 | 保留为显式排障工具；不要将候选接受/拒绝升级为功能能力或实机验收 |
-| 任意波编辑、浮点与 DAC16 传输 | `TRACe:DATA`、`DAC16`、`POINts`、`VALue`、`LOAD?`、interpolate | 未公开 | **未覆盖** | 不同数据格式、内存长度、自动选择 USER 与本机编辑规则不同；手册对 DAC16 给出固定分包条件 | **P2**：在明确 RAM/DDR 生命周期、字节序和回读语义后再实现 |
-| 频率计 | `COUNter:*`：输入配置、gate、统计、测量结果 | `source.counter_profile` 保持严格只读；production 声明 `source.counter_configure_v2`、`source.counter_enable_v2` 和 `source.counter_measure_v2`。V2 只允许单字段 coupling／impedance／attenuation／level／statistics 配置、独立 enable/disable 与已启用后的五元组测量；不实现 auto/gate/HF/sensitivity/display/clear | **Counter V2 外置实机通过**：先逐项回读 50 Ω／1 MΩ、1X／10X、level、statistics 与 AC/DC，再以 1 kHz／1 Vpp 实测 Counter 1000.011247 Hz、RTM/FFT 1000 Hz；输出 OFF 的 Counter 启用→关闭也通过 | 50 Ω / 1 MΩ 输入与 counter enable 会影响接线安全；统计 clear 是破坏性操作；timeout、二义写与 recovery-failure 未上机故障注入 | 保持每字段单写、独立回读和最终 Counter OFF；最大输入约束与实际信号须由计划安全门和接线确认，不新增 auto/gate/clear |
-| PA 外接功放 | `PA:*`：开关、增益、offset、极性、保存 | 未公开 | **默认拒绝** | 可直接造成更高功率输出，且 `PA:SAVE` 写内部状态 | 不纳入基础 DG4202 capability；必须有独立权限与人工安全检查 |
-| 显示与屏幕截图 | `DISPlay:*`、`HCOPy:SDUMp:DATA?` | 未公开 | **未覆盖** | brightness/saver 写入属于前面板全局状态；截图需要 binary transfer 和格式验收 | **P3**：仅在确有诊断价值时设计只读 screenshot |
-| 内部状态槽 | `MEMory:STATe:DELete/LOCK/VALid?`，以及 IEEE `*SAV/*RCL` | 未公开 | **默认拒绝** | 可能覆盖、删除、锁定或调用用户保存的状态；与 WaveBench 的临时恢复并非同一概念 | 保持主机侧 artifact 与恢复日志；不要写仪器内部槽位 |
-| 外部 U 盘文件系统 | `MMEMory:CATalog/CDIR/COPY/DEL/LOAD/MDIR/RDIR/STORe` | 未公开 | **未覆盖** | 手册要求外部存储器；路径、删除、覆盖和 `.RAF/.RSF` 加载均有持久副作用 | 默认不做；若实现需路径沙箱、显式文件权限和 delete 双重确认 |
-| 系统通信与全局设置 | `SYSTem:COMMunicate:LAN:*`、USB class、language、key lock、beeper、power-on、reference oscillator、channel copy | 未公开 | **默认拒绝** | 改 LAN/IP/DHCP 会断开当前会话；改 USB/clock/power-on/语言或复制状态影响全局行为 | 只考虑安全的只读 identity/version；网络配置永不经普通工作流写入 |
-| 重启、关机与 preset | `SYSTem:PRESet/RESTART/SHUTDOWN` | 未公开 | **默认拒绝** | 中断实验、丢失会话或把整机恢复默认 | 仅限人工维护程序，不属于 WaveBench 生产驱动 |
+本页将 DG4000 编程手册的功能域映射到外置 `wavebench-rigol-dg4000` 插件当前公开的
+WaveBench capability 和 SCPI 表面。当前包版本与入口点以 [包元数据](../pyproject.toml)为准，
+型号、capability 和操作方向以 [production descriptor](../src/wavebench_rigol_dg4000/descriptor.py)
+为准，精确命令与事务行为以 [driver](../src/wavebench_rigol_dg4000/driver.py) 为准。
+
+[功能覆盖里程碑](DG4000_COVERAGE_MILESTONES.md)记录开发顺序、退出门和实机证据，
+[`conformance/`](../conformance/) 保存机器可读证据。它们用于追溯，不会独立增加当前 capability。
+命令出现在本矩阵中，也不表示 production descriptor 已经公开对应能力。
+
+## 范围
+
+审计输入为文档编号 `PGB04008-1110` 的 DG4000 系列中文编程手册。手册以 DG4162
+给出部分参数示例，并说明范围会随型号、负载和频率变化，因此这些数值不能外推给 DG4202。
+本地转录只用于内部审计，位于 Git 忽略且不进入 wheel／sdist 的 `doc/vendor-local/`。
+
+本矩阵按可审计的功能域说明覆盖情况，不以 set/query 变体、短写或转录标题计算完成率。
+`rigol.dg4202` 保留 legacy capability；`rigol.dg4202-v2` 额外公开受限 Sweep；
+`rigol.dg4202-v2-workspace` 只公开 Source V2 读取／输出关闭基础和一项仪器级 volatile ARB
+workspace 替换能力。三个入口都不是通用 DG4000 SCPI shell。
+
+## 当前公开写入口
+
+DG descriptor 设置 `v1_route_migration_enabled=false`。V2 capability 只通过显式 V2
+入口调用，不接管 legacy V1 route；Sweep 和 volatile workspace 分别由两个独立 opt-in
+descriptor 公开。
+
+| Capability | 当前入口与边界 |
+|---|---|
+| `source.basic_configure_v2` | CLI `source basic-configure-v2`；run `source.basic_configure_v2`。目标输出必须 OFF，频率模式必须 FIX，并先取得 fresh V2 snapshot；每次只接受一个 Basic field。 |
+| `source.basic_live_configure_v2` | CLI `source basic-live-configure-v2`；run `source.basic_live_configure_v2`。输出必须 ON、频率模式必须 FIX，且每次只能修改 frequency 或 Vpp 中的一个字段；禁止 output cycling。 |
+| `source.output_v2` | CLI `source output-v2`；run `source.output_enable_v2` / `source.output_disable_v2`。Core 分别对 ON 和 OFF 执行 V2 preflight 与最终状态回读。 |
+| `source.sweep_configure_v2` | 仅限 `rigol.dg4202-v2`；run `source.sweep_configure_v2`。输出必须 OFF，V2 snapshot 必须 fresh，Burst／Modulation 必须 OFF；配置后独立回读。 |
+| `source.sweep_fire_v2` | 仅限 `rigol.dg4202-v2`；run `source.sweep_fire_v2`。必须复用同一 session 中已配置的 Sweep，当前通道输出必须 ON，触发源必须为 manual；不得盲目重试。 |
+| `source.arbitrary_workspace_volatile_replace_v2` | 仅限 `rigol.dg4202-v2-workspace`。需要 CH1／CH2 的 fresh V2 snapshot 且两路输出均为 OFF；`workspace_id` 固定为 `volatile`，接受 2–16,384 点且 payload 不超过 32,768 bytes。写入没有 channel selector，不声明哪一路选择 USER，也不能回读或恢复此前内容；结果不明会锁停配置写入。 |
+| Legacy V1 route | `source.set-*`、`source.output`、离散频响、`arb-load`、basic restore 与现有 artifact 保持 V1 合同。 |
+
+基础和 Sweep descriptor 不公开 workspace 写入；workspace descriptor 的 `source.output_v2`
+只提供读取和关闭方向。三个 production descriptor 都不公开 Burst、Coupling、Noise Overlay
+或 Sync 写 capability。实机适用范围与尚未通过的故障门见
+[功能覆盖里程碑](DG4000_COVERAGE_MILESTONES.md)。
+
+## 功能覆盖
+
+| 功能域 | 手册命令面 | 当前公开覆盖 | 当前边界 |
+|---|---|---|---|
+| 身份与错误队列 | `*IDN?`、`:SYSTem:ERRor?`、`:SYSTem:VERSion?` | `source.idn`、`source.errors` | `errors()` 会读取并消费队列；未公开 SCPI version、状态寄存器或非消费型 health API。 |
+| IEEE 488.2 保存、复位与触发 | `*RCL`、`*RST`、`*SAV`、`*TRG` | 未公开 | 保存／调用会改写非易失状态，复位改变整机，`*TRG` 可启动 Sweep／Burst 输出，因此默认拒绝。 |
+| CH1／CH2 基础状态 | output、function、frequency、voltage、offset、phase、Sweep state、apply、square duty | `source.status`；`source.snapshot_v2` 返回双通道类型化 Basic、输出状态及前后锚点 | V2 Output 不重复 `source.channel_profile` 已提供的 load／polarity；snapshot 不扩大自动恢复范围。 |
+| 固定频率 | `[:SOURce<n>]:FREQuency[:FIXed]` | `source.set_frequency` | 事务先取得快照、切换 FIX、逐步回读，并在失败时执行 off-first 恢复；结果不明会锁停写入。 |
+| 基础函数与方波占空比 | `FUNCtion[:SHAPe]`、square duty、`APPLy:*` | `source.set_function`、`source.set_square_duty_cycle` | 不公开 ramp symmetry、pulse 边沿、noise 参数或组合 `APPLy` 写入。 |
+| 幅度、单位、偏移与相位 | `VOLTage`、`UNIT`、`OFFSet`、`HIGH`、`LOW`、`PHASe` | `source.set_amplitude_vpp`；状态读取 offset／phase | 公开写入采用 VPP；没有独立 offset／phase／high／low setter。实际范围仍受型号、频率和负载约束。 |
+| 输出开关 | `OUTPut[<n>][:STATe]` | `source.output` | 只在调用方明确请求时切换；任意波上传不会隐式打开输出，驱动不会盲目重试 ON。 |
+| 负载、极性、Noise Overlay 与 Sync | `OUTPut:LOAD/POLarity/NOISe/SYNC` | `source.channel_profile`；`source.snapshot_v2` 的类型化 Noise Overlay／Sync facet | 当前只读；basic restore 不恢复这些字段，也没有公开 setter。 |
+| 双通道耦合 | `COUPling:*` | `source.snapshot_v2` 的 `CHANNEL_SET` facet | 当前只读；descriptor 不声明配置方向，也没有完整 target 与恢复事务。 |
+| Sweep 与触发 | `SWEep:*`、frequency window、`*TRG` | `source.sweep_profile`；`source.snapshot_v2` 的 Sweep facet；`rigol.dg4202-v2` 的 configure／manual-fire | V2 不恢复完整 Sweep；raw immediate trigger 仍默认拒绝，opt-in 行为不迁移到 V1 route。 |
+| Burst、Pulse、Marker、Harmonic | `BURSt:*`、`PULSe:*`、`MARKer:*`、`HARMonic:*` | `source.snapshot_v2` 提供只读 facet；Harmonic 为 `PARTIAL` | 不公开逐阶 Harmonic、Marker 写入或配置／触发 API；缺失字段不能由相邻证据补齐。 |
+| 调制 | `MOD:*` | `source.channel_profile` 与 `source.snapshot_v2` 只读返回 state／type | 不公开模式专属参数或 setter；state／type 查询不等于调制控制能力。 |
+| DAC14 任意波上传 | `TRACe:DATA:DAC VOLATILE,<binary-block>` | `source.arbitrary_upload` | 只接受校验后的 little-endian `DG4000DacBlock`；目标必须 OFF、FIX、Sweep OFF。上传覆盖 volatile USER 波表，无法恢复。 |
+| Source V2 volatile workspace | `TRACe:DATA:DAC VOLATILE,<binary-block>` | `source.arbitrary_workspace_volatile_replace_v2`，仅限 `rigol.dg4202-v2-workspace` | 仪器级、无 channel selector；两路输出必须 OFF。只返回写入完成与 payload identity，不验证内容，也不能恢复此前 workspace。 |
+| 任意波诊断查询 | `FUNC?`、`FUNC:USER?` 与候选 ARB／DATA query | `source.arbitrary_probe` | 只接受问号结尾的候选并记录错误队列；这是排障入口，不是稳定任意波 capability。 |
+| 任意波编辑、float 与 DAC16 | `TRACe:DATA`、`DAC16`、`POINts`、`VALue`、`LOAD?` | 未公开 | 格式、字节序、内存生命周期和回读语义尚无公开合同。 |
+| 频率计 | `COUNter:*` | `source.counter_profile`、`source.counter_configure_v2`、`source.counter_enable_v2`、`source.counter_measure_v2` | 配置每次只写一个字段；enable／disable 独立；只有启用后才测量。Auto、gate、HF、sensitivity、display、clear 未公开。 |
+| 外接 PA | `PA:*` | 未公开 | 可能产生更高功率并写入持久状态，默认拒绝。 |
+| 显示与截图 | `DISPlay:*`、`HCOPy:SDUMp:DATA?` | 未公开 | 显示写入改变全局前面板状态；截图尚无公开传输与格式合同。 |
+| 内部状态槽 | `MEMory:*`、`*SAV/*RCL` | 未公开 | 可能覆盖、删除、锁定或调用用户状态，默认拒绝。 |
+| 外部文件系统 | `MMEMory:*` | 未公开 | 路径、删除、覆盖和加载具有持久副作用，默认拒绝。 |
+| 通信与全局设置 | LAN、USB class、language、key lock、beeper、power-on、reference oscillator、channel copy | 未公开 | 修改网络可能断开会话，其余操作改变全局状态，默认拒绝。 |
+| preset、重启与关机 | `SYSTem:PRESet/RESTART/SHUTDOWN` | 未公开 | 会中断实验、丢失 session 或改变整机配置，默认拒绝。 |
 
 ## 当前直接使用的 SCPI 表面
 
-以下按手册长写形式归一化；实现实际使用兼容短写，例如 `SOUR`、`OUTP`、`VOLT`。
-这不是原始命令日志，也不代表每条都完成外置插件实机验收。
+以下命令按手册长写形式归一化；实现使用兼容短写。这不是原始通信日志，也不表示每条命令
+都单独完成了实机验收。
 
 ```text
 *IDN?
@@ -132,37 +113,24 @@ TRACe:DATA:DAC VOLATILE,<IEEE-488.2-binary-block>
 SOURce<n>:VOLTage:OFFSet <voltage>  SOURce<n>:FUNCtion[:SHAPe] USER
 ```
 
-两项刻意的例外必须单独理解：
+实现另使用 `:SOUR<n>:FREQ:MODE?` / `... FIX`，避免在 Sweep 状态下误解固定频率写入；
+该 DG4202 兼容路径不在所选手册的 frequency 索引中。任意波上传前还会写 `*CLS`，因此会
+清除已有错误状态，不能视为只读诊断。
 
-- 实现使用 `:SOUR<n>:FREQ:MODE?` / `... FIX`，以避免在 sweep 状态下把固定频率写入解释为 sweep 参数；该 DG4202 兼容路径没有出现在此手册的 frequency 命令列表，不能因代码存在而当作手册覆盖。
-- 任意波上传前写 `*CLS`，用于清理并检查本次上传的错误状态。此命令不在这份手册列出的五条 IEEE 488.2 项中，且会清空错误队列，因此不属于「只读诊断」。
+## 行为与安全边界
 
-## WaveBench 提供、但不计入仪器手册覆盖的保障
+- Core 负责读取 CSV／NPY、拒绝非有限值、归一化和 DAC14 编码；插件只接收
+  `DG4000DacBlock`。
+- basic-state 事务只恢复 output、function、frequency、frequency mode、amplitude
+  unit／value、offset 和 square duty。phase、load、modulation、完整 Sweep profile 和被覆盖的
+  volatile USER 波表不在恢复范围内。
+- `source.channel_profile`、`source.sweep_profile` 和 `source.counter_profile` 都是全有或全无的
+  只读上下文，不会隐式启用功能或扩大自动恢复字段。
+- descriptor 校验只证明 capability 与方法映射有效，不证明厂商命令语义、实机兼容性或测量准确度。
 
-- 核心在上传前读取 CSV/NPY、拒绝 NaN/inf、归一化并编码 14-bit DAC 数据；插件只接收 `DG4000DacBlock`，不复制文件解析和 safety policy。
-- `max_source_vpp`、显式 `output_on`、run plan safety、artifact 和可选 source-state restore 属于核心工作流，不能计作 DG4000 某条 SCPI 的实现。
-- driver 的 basic-state 事务恢复覆盖 output、function、frequency、frequency mode、amplitude unit/value、offset 和 square duty；核心 run restore 仍是更窄的 output/function/frequency/amplitude/duty 契约，且恢复必须先 OFF。两者都明确**不**恢复 phase、load、modulation、完整 sweep profile 或被覆盖的 volatile USER 波表。
-- `source.channel_profile` 是独立、全有或全无的只读上下文。它不改变上述 basic restore
-  的字段集合，也不把 load、polarity、noise、sync、burst、modulation、marker 或 pulse
-  hold 纳入自动恢复。
-- `source.sweep_profile` 同样是独立、全有或全无的只读上下文。它不启动、停止或触发
-  sweep，也不把 frequency window、spacing、timing、trigger 或 marker 纳入自动恢复。
-- `source.counter_profile` 是全局、全有或全无的只读上下文。counter OFF 时明确返回
-  `measurement=None` 且不查询测量值；它不自动 enable、不发送 `AUTO` 或 statistics clear，
-  也不把输入配置或统计状态纳入自动恢复。
-- descriptor capability 校验仅证明声明的方法存在且可调用；它不证明命令语义、返回值解析或实机兼容性。
+## 相关来源
 
-## 推荐路线
-
-1. **P2/P3：M8–M10 受控写事务。** M7 只完成受限 opt-in Sweep；Pulse/Burst/Coupling/Noise Overlay/Sync 的只读 facet 不等于配置能力。Coupling、Noise Overlay 与 Sync 已有候选合同和恢复顺序，但尚未注册或实现写 capability。
-2. **P3：M11 高级功能。** Harmonic 当前仅为 `PARTIAL` 只读 facet；逐阶分量、高级调制与 DAC16 继续分开建模。
-3. **默认不做：文件系统、网络、内部状态槽、PA、restart/shutdown。** 它们需要与普通实验流程不同的权限模型和人工确认。
-
-## 证据边界
-
-- **手册侧**：本地 `vendor-local` 中文 DG4000 手册，仅用于内部审计；本文不复制手册正文或将它打进发行包。
-- **实现侧**：外置插件的 `driver.py`、`descriptor.py` 和 FakeTransport 测试；内建 fallback 的历史文档仅用于区分来源，不自动成为外置插件验收。
-- **外置实机侧**：DG4202 固件 `00.01.14` 已通过 M1–M5 双通道门和 M6 全局 counter-OFF 门；M4 CH1/CH2 的 DAC14 与 RTM2032 证据、M5 的 sweep OFF/ON 预置证据和 M6 的 counter-OFF 证据保持不变。`0.7.0` 的只读 V2 最终快照为 67 次纯查询，完整 harness 为 112 queries、0 text/binary writes，锚点一致、会话 healthy。P1 normal path 另完成 CH1/CH2 Basic／Live Basic／Output 的低压高阻验收，所有 capture quality/expect 门通过；Counter V2 另在 CH1 三通下以 1 kHz／1 Vpp 完成配置、启停、五元组测量和 RTM/FFT 交叉验收，最终 CH1 OFF、5 Vpp 配置、Counter OFF/AC。`rigol.dg4202-v2` 的受限 Sweep 在 CH1/CH2 分别完成 output-OFF 配置、同会话 fire、三段 RTM 高阻采集、两路 output OFF 和独立 legacy FIX/OFF 恢复；它只覆盖线性 1–2 kHz、101 点、12 s、1 Vpp、marker OFF。另有 CH1、output OFF、FIX 的 `HARM`／`HARMONIC` → Sine 受控状态迁移观察及最终 Basic／Output readback；它没有外部测量，不证明逐阶参数保持，也不提升 conformance。Burst ON、Harmonic 活跃 V2 的完整外置证据、timeout、二义写和 recovery-failure 的上机故障注入结论仍缺。
-- **历史任意波侧**：旧内建 DG4202 证据仅用于来源区分；当前外置插件已有独立 CH1/CH2 协议证据，不再用历史结果替代验收。
-
-只有明确控制过的命令、实际回读/外部测量和所需恢复检查，才能提升为「外置实机通过」。
+- [Production descriptor](../src/wavebench_rigol_dg4000/descriptor.py)
+- [Driver implementation](../src/wavebench_rigol_dg4000/driver.py)
+- [功能覆盖里程碑与验收边界](DG4000_COVERAGE_MILESTONES.md)
+- [机器可读 conformance](../conformance/)
diff --git a/packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MATRIX_EN.md b/packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MATRIX_EN.md
index 1780fc3..456285b 100644
--- a/packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MATRIX_EN.md
+++ b/packages/wavebench-rigol-dg4000/doc/DG4000_COVERAGE_MATRIX_EN.md
@@ -2,104 +2,87 @@
 
 [中文](DG4000_COVERAGE_MATRIX.md)
 
-See the [DG4000 coverage milestones](DG4000_COVERAGE_MILESTONES_EN.md) for implementation order,
-transaction rules, and hardware exit gates. The `0.7.0` development branch preserves M0-M6 and the
-pure-query `source.snapshot_v2` adapter, and declares Basic/Live Basic/Output Source V2 P1. The
-M4/M5 CH1/CH2 gates, global counter-OFF M6 gate, Source V2 read-only gate, and P1 normal-path gate
-have passed. The restricted opt-in M7 Sweep configure/manual-fire gate has passed; the remaining
-controlled writes in M8-M12 remain pending. Listing a command in this matrix does not make it
-implemented.
-
-## Purpose, scope, and counting method
-
-This matrix compares the locally stored DG4000 Chinese programming manual with the external
-`wavebench-rigol-dg4000` plugin, the bundled `dg4202` fallback, and recorded DG4202 evidence. It
-separates manual availability, current public behavior, and evidence level. Manual examples for
-DG4162, historical acceptance of the bundled driver, and the existence of a Python method are not
-treated as acceptance of the current external plugin.
-
-The audit input is the DG4000 Chinese programming manual marked firmware `00.01.12` and document
-`PGB04008-1110`. Its 12,236-line Markdown transcription is in this plugin's `doc/vendor-local/`
-directory. That directory is Git-ignored, excluded from wheels/sdists, and is not committed with
-this document. The manual uses DG4162 for several parameter-range examples and explicitly warns
-that ranges depend on model, load, and frequency. No DG4162 numeric limit is therefore projected
-onto DG4202.
-
-The manual's command-system list yields twelve domains in this matrix: ten named vendor
-subsystems (`COUNter`, `COUPling`, `DISPlay`, `MEMory`, `MMEMory`, `OUTPut`, `PA`, `SOURce`,
-`SYSTem`, `TRACe`), the separately listed `HCOPy:SDUMp:DATA?`, and IEEE 488.2 common commands.
-The manual transcription's layout headings are not a completion denominator: set/query forms,
-optional keywords, short forms, and transcription defects such as missing brackets and broken
-headings make a percentage misleading. The matrix therefore reports auditable functional domains
-and public-capability evidence rather than a falsely precise percentage.
-
-`rigol.dg4202` retains its existing WaveBench capability set; the separate `rigol.dg4202-v2`
-descriptor adds only two restricted Sweep capabilities. The distribution remains a controlled
-implementation for basic DG4202 dual-channel output, read-only channel/sweep context, global counter
-context, and a narrow arbitrary-wave upload path, not a general DG4000 SCPI shell and not a claim to
-every DG4000 model, firmware, or accessory feature.
-
-Coverage labels:
-
-- **External hardware accepted**: current external-plugin code, FakeTransport tests, and controlled DG4202 evidence exist.
-- **Implemented / offline tested**: current code and exact offline command tests exist, without an external-plugin hardware conclusion for that item.
-- **Historical hardware evidence, not migrated acceptance**: bundled-driver evidence exists but has not been repeated for the external plugin.
-- **Diagnostic probe**: explicit query-only candidate probing that may consume the error queue; it is not a stable feature path.
-- **Not covered**: no corresponding public external-plugin, bundled-fallback, or SourceService API exists.
-- **Denied by default**: the manual command exists but network, storage, output, or global-state risk prevents exposure.
-
-## Coverage matrix
-
-### Source V2 public write surface
-
-This table describes the explicit V2 write surface of the current development branch. The DG
-descriptor sets `v1_route_migration_enabled=false`, so P1/Counter capabilities do not take over a
-legacy V1 route; Sweep is public only through the separate opt-in driver.
-
-| Capability | Public entry and strict boundary | DG4202 `00.01.14` normal-path evidence |
-|---|---|---|
-| `source.basic_configure_v2` | CLI `source basic-configure-v2`; run `source.basic_configure_v2`. Target output must be OFF, mode must be FIX, and a fresh V2 snapshot is required. The DG adapter accepts exactly one Basic field: SIN/SQU/RAMP/PULS/NOIS/DC, frequency, Vpp, offset, or square duty. | CH1 wrote/read back RAMP/PULSE/NOISE/DC/SIN while OFF; CH2 wrote/read back SQUARE/25% duty, frequency, and Vpp. External high-impedance capture covers CH1 sine and CH2 square only. |
-| `source.basic_live_configure_v2` | CLI `source basic-live-configure-v2`; run `source.basic_live_configure_v2`. Output must be ON, mode must be FIX, and exactly one frequency or Vpp field is accepted; output cycling is forbidden. | CH1 and CH2 each completed independent 1 kHz→2 kHz and 1 Vpp→2 Vpp live writes followed by high-impedance capture. |
-| `source.output_v2` | CLI `source output-v2`; run `source.output_enable_v2` / `source.output_disable_v2`. The Core performs V2 preflight and final-state readback independently for ON and OFF. | Both channels separately emitted at low voltage, captured, and reached V2 OFF; a separate restoration run confirmed both channels OFF again. |
-| `source.sweep_configure_v2` | `rigol.dg4202-v2` only; run `source.sweep_configure_v2`. Output must be OFF, the V2 snapshot fresh, and Burst/Modulation OFF; configuration has independent readback. | CH1/CH2 each configured and read back a linear 1–2 kHz, 101-point, 12-second, manual-trigger Sweep with marker OFF. |
-| `source.sweep_fire_v2` | `rigol.dg4202-v2` only; run `source.sweep_fire_v2`. It reuses a same-session configured Sweep, requires selected-channel output ON and manual trigger, and is never blindly retried. | CH1/CH2 each completed same-session fire and three high-impedance RTM captures; each run ended dual-output OFF, then a legacy transaction returned FIX/OFF. |
-| Legacy V1 routes | `source.set-*`, `source.output`, discrete frequency response, `arb-load`, basic restore, and their existing artifacts retain V1 contracts. | Core route tests and the DG P1 plan confirm that only explicit V2 entry points call the P1 adapter. |
-
-Apart from the restricted opt-in Sweep capability, the V2 surface does not declare volatile ARB,
-Burst, Coupling, Noise Overlay, or Sync writes. Sweep evidence does not generalize frequency,
-amplitude, or timing. There is no hardware fault injection for timeout, ambiguous-write, or
-recovery-failure; those behaviors retain offline fault-matrix evidence only.
-
-| Domain | Manual command surface | Current public coverage | Evidence | Main gap and safety boundary | Recommendation |
-|---|---|---|---|---|---|
-| Identity and error queue | `*IDN?`, `:SYSTem:ERRor?`, `:SYSTem:VERSion?` | `source.idn`, `source.errors`; writes may check the error queue | **External hardware accepted** for sanitized identity and M1/M2/M4 error boundaries on DG4202 `00.01.14`; exact SCPI has offline tests | `errors()` reads and consumes the queue; no public SCPI-version, status-register, or non-consuming health API | Keep error reads explicit; define consumption semantics before adding health APIs |
-| IEEE 488.2 save, reset, and trigger | `*RCL`, `*RST`, `*SAV`, `*TRG` | Not public | **Denied by default** | Save/recall overwrites nonvolatile state, reset mutates the instrument globally, and `*TRG` starts sweep/burst output | Consider only with a separate controlled transaction, snapshot, and human confirmation |
-| CH1/CH2 basic status | `OUTPut?`, `SOURce:FUNCtion?`, `FREQuency?`, `VOLTage?` / `UNIT?` / `OFFSet?`, `PHASe?`, `SWEep:STATe?`, `APPLy?`, square duty | `source.status` retains the V1 result; `source.snapshot_v2` returns typed Basic, output-enabled, and before/after anchors for both channels, deriving frequency mode from documented `SWEep:STATe?` | **External hardware accepted**: V1 strict profile used 24 queries and zero writes; `0.7.0` used 40 pure queries initially and 67 in the final snapshot containing every new facet, both with consistent anchors and healthy session state | Source V2 Output does not duplicate load/polarity already available from `source.channel_profile`; automatic restoration is unchanged | Keep V1 write routing unchanged; require pure-query, budget, and consistency contracts for new fields |
-| Fixed frequency | `[:SOURce<n>]:FREQuency[:FIXed]`; sweep center/span/start/stop are in the same family | `source.set_frequency` is a transaction with snapshot, FIX selection, per-step readback, off-first recovery, and ambiguous-write latching | **External hardware accepted**: FIX write/readback and fresh-session restore passed on DG4202 `00.01.14` CH1/CH2 | `FREQ:MODE` is a DG4202 compatibility path not listed in this manual's frequency index; the M5 sweep profile is query-only and does not set these fields | Keep the explicit FIX-mode safety behavior; any sweep write needs an independent transaction |
-| Basic functions and square duty | `FUNCtion[:SHAPe]`, `FUNCtion:SQUare:DCYCle`, plus `APPLy:SINusoid/SQUare/RAMP/PULSe/NOISe` | `source.set_function` for SIN/SQU/RAMP/PULS/NOIS/DC; `source.set_square_duty_cycle` | **External hardware accepted** for temporary SQU/37% duty, ON-to-OFF, and fresh-session SIN restore on CH1/CH2; other functions remain offline-only | No ramp symmetry, pulse width/edges, noise parameters, composite apply writes, or complete function-profile restoration | Define complete, readable, restorable profiles per function before further setters |
-| Amplitude, units, offset, phase | `VOLTage`, `UNIT`, `OFFSet`, `HIGH`, `LOW`, `PHASe` | `source.set_amplitude_vpp` writes `UNIT VPP` plus amplitude; status reads offset/phase; arbitrary upload writes offset internally | **External hardware accepted** for the M2 CH1/CH2 0.8 Vpp transaction/restore and M4 CH1 2 Vpp plus CH2 1 Vpp analog loops; no public offset setter | No public offset/phase/high/low setter; core VPP limits do not replace model/load/frequency limits; DBM/VRMS are not public | Keep a VPP-first API; couple any additional units or level controls to load, limits, and restoration |
-| Output enable | `OUTPut[<n>][:STATe] ON|OFF` | `source.output`; arbitrary upload does not enable output unless explicitly requested | **External hardware accepted** for explicit M2 ON-to-OFF and restore on CH1/CH2; M4 adds triangle loops on both channels | It directly affects the DUT; no implicit enable or retry | Keep it separate and require higher-level workflows to record the requested output state |
-| Output load, polarity, noise, sync | `OUTPut:IMPedance/LOAD`, `POLarity`, `NOISe:*`, `SYNC:*` | `source.channel_profile` returns load/polarity/noise/sync read-only; `source.snapshot_v2` adds typed Noise Overlay and Sync facets with enabled, scale, and polarity | **External hardware accepted**: M3 completed 45 queries and zero text/binary writes; the final 67-query V2 snapshot returned Noise Overlay OFF/10% and Sync ON/POSITIVE on both channels | Basic restore still excludes these fields; no setters are public; enabled Noise Overlay lacks a deterministic hard-peak bound, and Sync enable lacks a physical-port model and A5 wiring evidence | Candidate writes are split into Noise OFF-only configuration, Sync configuration, and separate physical-port enable/disable; production remains READ only |
-| Dual-channel coupling | `COUPling:AMPL/FREQuency/PHASe`, base channel, state | `source.snapshot_v2` returns one `CHANNEL_SET` with global state, reference channel, and enabled + typed deviation for amplitude/frequency/phase | **External hardware accepted (read-only)**: the final 67-query snapshot returned all dimensions OFF with CH1 as reference; FakeTransport covers mixed dimensions, strict ranges, and zero writes | The relation graph is not readable, the descriptor declares no CONFIGURE direction, and complete-target restore/write fault injection is absent | Core's pre-stable candidate replaces the unreleased boolean Coupling request; DG writes still require dual-channel OFF, full restoration, and A4/A5 evidence |
-| Sweep and manual/external trigger | `SWEep:*`, frequency start/stop/center/span, `*TRG` | `source.sweep_profile` retains complete V1 readback; `source.snapshot_v2` reuses that strict profile as a typed Sweep facet when frequency mode is Sweep; only `rigol.dg4202-v2` exposes configure/manual-fire | **M5 external hardware accepted** for sweep-OFF/ON staging; **restricted opt-in M7 accepted** for CH1/CH2 1–2 kHz, 101-point, 12-second manual-trigger configure/fire plus three external captures | V2 does not restore complete Sweep and acceptance needs separate legacy recovery; no parameter generalization; `*TRG` and raw immediate trigger remain denied | Keep complete snapshots, per-field readback, external measurement, output OFF, and non-retryable trigger semantics; do not migrate opt-in behavior onto V1 routes |
-| Burst, pulse, marker, harmonic | `BURSt:*`, `PULSe:*`, `MARKer:*`, `HARMonic:*` | `source.snapshot_v2` can return a complete Pulse facet, Burst OFF or a complete enabled facet, and a `PARTIAL` Harmonic facet with enabled/configured order/maximum order/preset; per-order amplitude/phase, Marker writes, and all configuration APIs remain private | **Pulse externally accepted; Burst ON remains offline-only**: CH1/CH2 completed a 52-query V2 snapshot and complete Pulse facets at output OFF, PULSE, and 1 Vpp; Burst OFF returned on hardware. A controlled CH1 output-OFF/FIX `HARM`/`HARMONIC` to Sine Basic transition also has final readback, but is not external V2 conformance | Harmonic does not claim components; complete external V2 evidence for Burst ON and active Harmonic remains absent; configuration and trigger paths lack complete restoration | Keep read-only; stage active hardware states through a separate controlled transaction, never a raw-SCPI bypass |
-| Modulation | `MOD:AM/FM/PM/ASK/FSK/PSK/BPSK/QPSK/3FSK/4FSK/OSK/PWM:*` | `source.channel_profile` and `source.snapshot_v2` both return modulation state/type read-only; no mode-specific parameters or setters | **Partial read-only context hardware accepted**: the final V2 snapshot returned OFF/AM on CH1/CH2; parameter and write surfaces remain uncovered | State/type queries are not modulation capability; external sources, rates, polarity, and phase interact | **P3:** split capabilities by mode and do not bypass restoration with raw SCPI |
-| Arbitrary upload: DAC14 | `TRACe:DATA:DAC VOLATILE,<binary-block>` or decimal DAC values | `source.arbitrary_upload` accepts only structurally and sample-validated little-endian `DG4000DacBlock`; the target must already be OFF, FIX, and sweep OFF; post-binary fields are read back, and failure latches while reporting volatile USER data as irreversible | **M4 external hardware accepted**: CH1/CH2 both completed output-off upload, readback, error-queue, analog frequency/Vpp/shape loop, and restoration | No public decimal/float upload, DAC16, or arbitrary editing/readback; upload overwrites volatile waveform memory and selects USER | Keep the current narrow protocol; establish lifecycle, readback, and restoration evidence separately before adding formats |
-| Arbitrary diagnostic queries | Plugin candidates include `FUNC?`, `FUNC:USER?`, and several `SOURce:*ARB*` / `SOURce:*DATA*` queries | `source.arbitrary_probe` permits only question-mark candidates and records errors after each | **Diagnostic probe**; FakeTransport-covered | The manual places waveform data under `TRACe:DATA`, not `SOURce:DATA`; several candidates may properly return `-113`. Since `errors()` consumes the queue, this is not non-invasive health readout | Keep it an explicit troubleshooting tool; do not promote candidate acceptance/rejection to feature coverage |
-| Arbitrary editing, float, DAC16 | `TRACe:DATA`, `DAC16`, `POINts`, `VALue`, `LOAD?`, interpolate | Not public | **Not covered** | Formats, memory lengths, automatic USER selection, and local-edit rules differ; DAC16 has fixed chunking conditions | **P2:** establish RAM/DDR lifecycle, byte order, and readback semantics first |
-| Frequency counter | `COUNter:*` input setup, gate, statistics, results | `source.counter_profile` remains strict read-only; production declares `source.counter_configure_v2`, `source.counter_enable_v2`, and `source.counter_measure_v2`. V2 permits one coupling/impedance/attenuation/level/statistics field per write, separate enable/disable, and a five-field measurement only while enabled; it does not implement auto/gate/HF/sensitivity/display/clear | **Counter V2 external hardware accepted**: 50 ohm/1 megaohm, 1X/10X, level, statistics, and AC/DC were each read back; a 1 kHz/1 Vpp signal measured 1000.011247 Hz at Counter and 1000 Hz at RTM/FFT; Counter enable→disable while output stayed OFF also passed | 50-ohm/1-megaohm setup and counter enable affect cabling safety; statistics clear is destructive; no timeout, ambiguous-write, or recovery-failure fault was injected | Keep one field per write, independent readback, and final Counter OFF. Plan safety and confirmed wiring must bound maximum input and emitted signal; do not add auto/gate/clear |
-| External PA | `PA:*` enable, gain, offset, polarity, save | Not public | **Denied by default** | It can create higher-power output and `PA:SAVE` persists device state | Keep out of the base DG4202 capability; require independent authorization and human safety checks |
-| Display and screenshot | `DISPlay:*`, `HCOPy:SDUMp:DATA?` | Not public | **Not covered** | Brightness/saver write global front-panel state; screenshot needs binary-transfer and format acceptance | **P3:** only add a read-only screenshot if it has clear diagnostic value |
-| Internal state slots | `MEMory:STATe:DELete/LOCK/VALid?`, IEEE `*SAV/*RCL` | Not public | **Denied by default** | They can overwrite, delete, lock, or recall user state and are not equivalent to temporary WaveBench restoration | Keep host-side artifacts/restoration logs; do not write instrument slots |
-| External USB filesystem | `MMEMory:CATalog/CDIR/COPY/DEL/LOAD/MDIR/RDIR/STORe` | Not public | **Not covered** | The manual requires external storage; paths, deletion, overwrite, and `.RAF/.RSF` loading have persistent side effects | Keep out by default; require path sandboxing, file permission, and double confirmation for deletion |
-| System communications and global setup | `SYSTem:COMMunicate:LAN:*`, USB class, language, key lock, beeper, power-on, reference oscillator, channel copy | Not public | **Denied by default** | LAN/IP/DHCP changes can sever the current session; USB/clock/power-on/language/channel copy change global behavior | Consider only safe identity/version reads; never write network configuration from ordinary workflows |
-| Restart, shutdown, preset | `SYSTem:PRESet/RESTART/SHUTDOWN` | Not public | **Denied by default** | Interrupts experiments, loses the session, or resets global configuration | Maintenance-only, outside the production WaveBench driver |
+This page maps DG4000 programming-manual domains to the WaveBench capabilities and SCPI surface
+currently exposed by the external `wavebench-rigol-dg4000` plugin. The
+[package metadata](../pyproject.toml) is authoritative for the distribution version and entry
+points, the [production descriptor](../src/wavebench_rigol_dg4000/descriptor.py) for models,
+capabilities, and operation directions, and the [driver](../src/wavebench_rigol_dg4000/driver.py)
+for exact commands and transaction behavior.
+
+The [coverage milestones](DG4000_COVERAGE_MILESTONES_EN.md) record development order, exit gates,
+and hardware evidence. Machine-readable evidence is under [`conformance/`](../conformance/).
+Those records support traceability and do not independently add a current capability. A command
+listed in this matrix is not public unless the production descriptor declares the corresponding
+capability.
+
+## Scope
+
+The audit source is DG4000 family programming manual `PGB04008-1110`. It uses DG4162 for some
+parameter examples and states that ranges vary with model, load, and frequency, so those numeric
+limits are not projected onto DG4202. The local transcription is for internal audit only and lives
+under the Git-ignored, wheel/sdist-excluded `doc/vendor-local/` directory.
+
+This matrix groups the manual into auditable functional domains instead of treating set/query
+variants, abbreviations, or transcription headings as a completion denominator. `rigol.dg4202`
+retains the legacy capabilities; `rigol.dg4202-v2` adds restricted Sweep; and
+`rigol.dg4202-v2-workspace` exposes only the Source V2 read/output-disable substrate plus one
+instrument-scoped volatile-ARB workspace replacement. None is a general DG4000 SCPI shell.
+
+## Current public write entry points
+
+The DG descriptor sets `v1_route_migration_enabled=false`. V2 capabilities are called only through
+explicit V2 entry points and do not take over legacy V1 routes. Sweep and the volatile workspace are
+exposed by separate opt-in descriptors.
+
+| Capability | Current entry point and boundary |
+|---|---|
+| `source.basic_configure_v2` | CLI `source basic-configure-v2`; run `source.basic_configure_v2`. Output must be OFF, frequency mode FIX, and the V2 snapshot fresh. Each request may change one Basic field. |
+| `source.basic_live_configure_v2` | CLI `source basic-live-configure-v2`; run `source.basic_live_configure_v2`. Output must be ON, frequency mode FIX, and each request may change either frequency or Vpp. Output cycling is forbidden. |
+| `source.output_v2` | CLI `source output-v2`; run `source.output_enable_v2` / `source.output_disable_v2`. Core applies V2 preflight and final-state readback independently to ON and OFF. |
+| `source.sweep_configure_v2` | `rigol.dg4202-v2` only; run `source.sweep_configure_v2`. Output must be OFF, the V2 snapshot fresh, and Burst/Modulation OFF. Configuration has independent readback. |
+| `source.sweep_fire_v2` | `rigol.dg4202-v2` only; run `source.sweep_fire_v2`. It requires a same-session configured Sweep, selected-channel output ON, and manual trigger. It is never blindly retried. |
+| `source.arbitrary_workspace_volatile_replace_v2` | `rigol.dg4202-v2-workspace` only. Requires fresh V2 snapshots for CH1/CH2 with both outputs OFF. `workspace_id` is `volatile`; the profile accepts 2–16,384 points and at most 32,768 payload bytes. The write has no channel selector, makes no claim that either channel selected USER, cannot read back or restore prior content, and latches configuration writes on an ambiguous result. |
+| Legacy V1 routes | `source.set-*`, `source.output`, discrete frequency response, `arb-load`, basic restore, and their existing artifacts retain V1 contracts. |
+
+The base and Sweep descriptors do not expose the workspace write. On the workspace descriptor,
+`source.output_v2` permits read/disable only. None of the three production descriptors exposes
+Burst, Coupling, Noise Overlay, or Sync writes. See the
+[coverage milestones](DG4000_COVERAGE_MILESTONES_EN.md) for accepted hardware scope and unpassed
+failure gates.
+
+## Functional coverage
+
+| Domain | Manual command surface | Current public coverage | Current boundary |
+|---|---|---|---|
+| Identity and error queue | `*IDN?`, `:SYSTem:ERRor?`, `:SYSTem:VERSion?` | `source.idn`, `source.errors` | `errors()` reads and consumes the queue. SCPI version, status registers, and non-consuming health are not public. |
+| IEEE 488.2 save, reset, and trigger | `*RCL`, `*RST`, `*SAV`, `*TRG` | Not public | Save/recall mutates nonvolatile state, reset changes the whole instrument, and `*TRG` may start Sweep/Burst output; these are denied by default. |
+| CH1/CH2 basic status | output, function, frequency, voltage, offset, phase, Sweep state, apply, square duty | `source.status`; `source.snapshot_v2` returns typed Basic, output state, and before/after anchors for both channels | V2 Output does not duplicate load/polarity from `source.channel_profile`; snapshots do not expand automatic restoration. |
+| Fixed frequency | `[:SOURce<n>]:FREQuency[:FIXed]` | `source.set_frequency` | The transaction snapshots, selects FIX, reads back each step, and uses off-first recovery. Ambiguous results latch writes. |
+| Basic functions and square duty | `FUNCtion[:SHAPe]`, square duty, `APPLy:*` | `source.set_function`, `source.set_square_duty_cycle` | Ramp symmetry, pulse edges, noise parameters, and composite `APPLy` writes are not public. |
+| Amplitude, units, offset, phase | `VOLTage`, `UNIT`, `OFFSet`, `HIGH`, `LOW`, `PHASe` | `source.set_amplitude_vpp`; status reads offset/phase | Public writes use VPP. There is no independent offset/phase/high/low setter; actual limits still depend on model, frequency, and load. |
+| Output enable | `OUTPut[<n>][:STATe]` | `source.output` | The caller must request the transition explicitly. Arbitrary upload never enables output implicitly, and the driver does not blindly retry ON. |
+| Load, polarity, Noise Overlay, Sync | `OUTPut:LOAD/POLarity/NOISe/SYNC` | `source.channel_profile`; typed Noise Overlay/Sync facets in `source.snapshot_v2` | Query-only. Basic restore excludes these fields, and no setter is public. |
+| Dual-channel coupling | `COUPling:*` | `CHANNEL_SET` facet in `source.snapshot_v2` | Query-only. The descriptor declares no configure direction and no complete target/restore transaction exists. |
+| Sweep and trigger | `SWEep:*`, frequency window, `*TRG` | `source.sweep_profile`; Sweep facet in `source.snapshot_v2`; configure/manual-fire through `rigol.dg4202-v2` | V2 does not restore a complete Sweep. Raw immediate trigger remains denied, and opt-in behavior does not migrate onto V1 routes. |
+| Burst, Pulse, Marker, Harmonic | `BURSt:*`, `PULSe:*`, `MARKer:*`, `HARMonic:*` | Query-only facets in `source.snapshot_v2`; Harmonic is `PARTIAL` | Per-order Harmonic, Marker writes, and configure/trigger APIs are not public. Missing fields are not inferred from adjacent evidence. |
+| Modulation | `MOD:*` | `source.channel_profile` and `source.snapshot_v2` return state/type query-only | No mode-specific parameters or setters are public. State/type queries are not modulation-control capability. |
+| DAC14 arbitrary upload | `TRACe:DATA:DAC VOLATILE,<binary-block>` | `source.arbitrary_upload` | Accepts only validated little-endian `DG4000DacBlock`; target must be OFF, FIX, and Sweep OFF. Upload overwrites volatile USER data and cannot restore it. |
+| Source V2 volatile workspace | `TRACe:DATA:DAC VOLATILE,<binary-block>` | `source.arbitrary_workspace_volatile_replace_v2`, only on `rigol.dg4202-v2-workspace` | Instrument-scoped with no channel selector; both outputs must be OFF. It reports write completion and payload identity, does not verify content, and cannot restore the previous workspace. |
+| Arbitrary diagnostic queries | `FUNC?`, `FUNC:USER?`, candidate ARB/DATA queries | `source.arbitrary_probe` | Accepts question-mark candidates only and records the error queue. This is troubleshooting, not stable arbitrary-wave capability. |
+| Arbitrary editing, float, DAC16 | `TRACe:DATA`, `DAC16`, `POINts`, `VALue`, `LOAD?` | Not public | Formats, byte order, memory lifecycle, and readback have no public contract. |
+| Frequency counter | `COUNter:*` | `source.counter_profile`, `source.counter_configure_v2`, `source.counter_enable_v2`, `source.counter_measure_v2` | Configuration writes one field at a time; enable/disable is separate; measurement requires enabled state. Auto, gate, HF, sensitivity, display, and clear are not public. |
+| External PA | `PA:*` | Not public | It can create higher-power output and persist state, so it is denied by default. |
+| Display and screenshot | `DISPlay:*`, `HCOPy:SDUMp:DATA?` | Not public | Display writes change global front-panel state; screenshot has no public transfer/format contract. |
+| Internal state slots | `MEMory:*`, `*SAV/*RCL` | Not public | They may overwrite, delete, lock, or recall user state and are denied by default. |
+| External filesystem | `MMEMory:*` | Not public | Paths, deletion, overwrite, and load have persistent side effects and are denied by default. |
+| Communications and global setup | LAN, USB class, language, key lock, beeper, power-on, reference oscillator, channel copy | Not public | Network writes may sever the session; the remaining operations mutate global state and are denied by default. |
+| Preset, restart, shutdown | `SYSTem:PRESet/RESTART/SHUTDOWN` | Not public | They interrupt experiments, lose the session, or change global configuration and are denied by default. |
 
 ## Directly used SCPI surface
 
-The following is normalized to manual-style long names; code uses compatible short forms such as
-`SOUR`, `OUTP`, and `VOLT`. It is neither a communication log nor a claim that every command has
-external-plugin hardware acceptance.
+The commands below use normalized manual-style long names; the implementation uses compatible
+short forms. This is neither a communication log nor a claim of separate hardware acceptance for
+every command.
 
 ```text
 *IDN?
@@ -138,84 +121,26 @@ TRACe:DATA:DAC VOLATILE,<IEEE-488.2-binary-block>
 SOURce<n>:VOLTage:OFFSet <voltage>  SOURce<n>:FUNCtion[:SHAPe] USER
 ```
 
-Two deliberate exceptions need separate treatment:
-
-- The implementation uses `:SOUR<n>:FREQ:MODE?` / `... FIX` to prevent a fixed-frequency write
-  from being interpreted as a sweep parameter. This DG4202 compatibility path is not in the
-  selected manual's frequency command list, so code presence is not manual coverage.
-- Arbitrary upload writes `*CLS` before uploading to clear/check current upload errors. `*CLS` is
-  not among the five IEEE 488.2 commands indexed by this manual and clears the queue, so it is not
-  read-only diagnostics.
-
-## WaveBench safeguards outside manual coverage
-
-- Core loads CSV/NPY, rejects NaN/inf, normalizes samples, and encodes DAC14; the plugin receives
-  `DG4000DacBlock` and does not duplicate parsing or safety policy.
-- `max_source_vpp`, explicit `output_on`, run-plan safety, artifacts, and optional source-state
-  restore are workflow safeguards, not DG4000 SCPI coverage.
-- Driver basic-state transaction recovery covers output, function, frequency, frequency mode,
-  amplitude unit/value, offset, and square duty. Core run restore remains the narrower
-  output/function/frequency/amplitude/duty contract and starts with output OFF. Neither restores
-  phase, load, modulation, the complete sweep profile, or overwritten volatile USER data.
-- `source.channel_profile` is an independent, all-or-nothing read-only context. It does not change
-  the basic-restore field set or add load, polarity, noise, sync, burst, modulation, marker, or
-  pulse hold to automatic restoration.
-- `source.sweep_profile` is also an independent, all-or-nothing read-only context. It does not
-  start, stop, or trigger a sweep and does not add the frequency window, spacing, timing, trigger,
-  or marker fields to automatic restoration.
-- `source.counter_profile` is a global, all-or-nothing read-only context. While the counter is OFF,
-  it returns `measurement=None` without querying a measurement. It does not enable the counter,
-  send `AUTO` or statistics clear, or add input/statistics fields to automatic restoration.
-- Descriptor capability validation proves that declared methods exist and are callable. It does not
-  prove SCPI semantics, response parsing, or hardware compatibility.
-
-## Recommended roadmap
-
-1. **P2/P3: M8-M10 controlled write transactions.** M7 is complete only as restricted opt-in
-   Sweep; Pulse/Burst/Coupling/Noise Overlay/Sync read facets are not configuration capability.
-   Coupling, Noise Overlay, and Sync now have candidate contracts and restore order, but no write
-   capability is registered or implemented.
-2. **P3: M11 advanced features.** Harmonic is currently a `PARTIAL` read facet; keep per-order
-   components, advanced modulation, and DAC16 as separate models.
-3. **Out of default scope: filesystem, network, internal state slots, PA, restart/shutdown.** They
-   need a permission model and human confirmation distinct from ordinary experiments.
-
-## Evidence boundary
-
-- **Manual**: the local vendor manual is used only for internal audit and is excluded from releases.
-- **Implementation**: external `driver.py`/`descriptor.py` and FakeTransport tests; bundled-driver
-  history only distinguishes provenance and does not automatically accept the external plugin.
-- **External hardware**: DG4202 firmware `00.01.14` passes the M1-M5 dual-channel gates and the M6
-  global counter-OFF gate. M3
-  completed 45 queries and zero text/binary writes under guards that rejected every write. M4 CH1
-  passes protocol, a 64-point DAC14 triangle loop into a high-impedance RTM2032, and restoration;
-  10,000 points measured 997.26 Hz and 2.16 Vpp with 0.0390 V triangle-template RMSE. M4 CH2 uses
-  the same 64-point triangle and passes protocol, a 1 Vpp high-impedance RTM2032 loop, and
-  restoration; it measured 999.75 Hz and 1.12 Vpp, with normalized triangle/sine-template RMSE of
-  0.09285/0.2196 (ratio 0.4229), while scope timebase, range, and trigger settings stayed unchanged.
-  M5 read CH1/CH2 three times in each output-OFF, sweep-OFF/ON preset state. Each read-only session
-  completed 104 queries and zero text/binary writes; complete channel/sweep profiles matched their
-  initial snapshots after restoration. M6 read three complete profiles with the counter OFF,
-  issuing 39 queries and zero text/binary writes; counter/statistics/display state was unchanged and
-  `measurement=None` was explicit. Version `0.7.0` also completed a 52-query snapshot and complete
-  Pulse facets at output OFF, PULSE, and 1 Vpp. The final OFF/SIN/FIX snapshot included Counter,
-  Modulation, partial ARB, Coupling, Sync, and Noise Overlay in 67 pure queries. Its complete
-  harness issued 112 queries and zero text/binary writes, with matching anchors and healthy session
-  state. P1 additionally accepted low-voltage/high-impedance CH1/CH2 Basic/Live Basic/Output normal
-  paths with every capture quality/expectation gate passing; a separate restoration run read both
-  channels OFF/SIN/1 kHz/5 Vpp/0 V/FIX/50% duty. Counter V2 additionally completed configuration,
-  enable/disable, five-field measurement, and RTM/FFT cross-check at 1 kHz/1 Vpp through the CH1 T
-  connection, ending with CH1 OFF/5 Vpp configuration and Counter OFF/AC. `rigol.dg4202-v2` completed
-  restricted Sweep output-OFF configuration, same-session fire, three high-impedance RTM captures,
-  dual-output OFF, and separate legacy FIX/OFF recovery on CH1/CH2; this covers only a linear
-  1–2 kHz, 101-point, 12-second, 1 Vpp, marker-OFF fixture. A controlled CH1 output-OFF/FIX
-  `HARM`/`HARMONIC` to Sine Basic transition also has final readback, but it has no external measurement,
-  does not establish per-order parameter preservation, and is not conformance. Complete external evidence
-  for Burst ON and active Harmonic, plus timeout, ambiguous-write, and recovery-failure hardware
-  fault-injection conclusions, remain absent.
-- **Historical arbitrary evidence**: prior bundled-driver evidence remains provenance only. The
-  current external plugin now has independent CH1/CH2 protocol evidence and does not substitute
-  historical results for acceptance.
-
-Only a controlled command, device readback or external measurement, and any required restoration
-check may promote an item to **External hardware accepted**.
+The implementation also uses `:SOUR<n>:FREQ:MODE?` / `... FIX` to prevent fixed-frequency writes
+from being interpreted in Sweep mode; that DG4202 compatibility path is not in the selected
+manual's frequency index. Arbitrary upload also writes `*CLS`, so it clears prior error state and
+is not read-only diagnostics.
+
+## Behavior and safety boundaries
+
+- Core loads CSV/NPY, rejects nonfinite values, normalizes samples, and encodes DAC14. The plugin
+  receives `DG4000DacBlock`.
+- Basic-state transactions restore only output, function, frequency, frequency mode, amplitude
+  unit/value, offset, and square duty. Phase, load, modulation, complete Sweep state, and overwritten
+  volatile USER data are outside restoration.
+- `source.channel_profile`, `source.sweep_profile`, and `source.counter_profile` are all-or-nothing,
+  query-only contexts. They neither enable features implicitly nor expand automatic restoration.
+- Descriptor validation proves capability-to-method mapping, not vendor-command semantics, hardware
+  compatibility, or measurement accuracy.
+
+## Related sources
+
+- [Production descriptor](../src/wavebench_rigol_dg4000/descriptor.py)
+- [Driver implementation](../src/wavebench_rigol_dg4000/driver.py)
+- [Coverage milestones and acceptance boundaries](DG4000_COVERAGE_MILESTONES_EN.md)
+- [Machine-readable conformance](../conformance/)
diff --git a/packages/wavebench-rigol-dg4000/doc/README.md b/packages/wavebench-rigol-dg4000/doc/README.md
new file mode 100644
index 0000000..f3525a3
--- /dev/null
+++ b/packages/wavebench-rigol-dg4000/doc/README.md
@@ -0,0 +1,27 @@
+# DG4000 插件文档
+
+[English](README_EN.md)
+
+本页导航 DG4000 插件的当前 Reference、开发里程碑、conformance 和历史验收资料。当前版本、
+入口点、型号、兼容范围和 capability 以包元数据及 production descriptor 为准。
+
+## 当前 Reference
+
+- [编程手册功能覆盖矩阵](DG4000_COVERAGE_MATRIX.md)
+- [仓库级插件目录](../../../doc/reference/plugin-catalog.md)
+
+## 开发与证据
+
+- [功能覆盖里程碑](DG4000_COVERAGE_MILESTONES.md)
+- [Source conformance manifests](../conformance/)
+- [0.1.0–0.7.0 开发与验收存档](archive/DG4000_README_0.7.md)
+- [跨插件验收与历史证据索引](../../../doc/evidence/README.md)
+
+里程碑、manifest 和存档保存特定版本、设备与时间点的证据，不独立提升当前 capability。
+
+## 厂商资料与开发环境
+
+本地厂商资料放在被 Git 和 sdist 排除的 `vendor-local/` 中。
+
+- [仓库开发环境](../../../doc/DEVELOPMENT.md)
+- [返回插件入口](../README.md)
diff --git a/packages/wavebench-rigol-dg4000/doc/README_EN.md b/packages/wavebench-rigol-dg4000/doc/README_EN.md
new file mode 100644
index 0000000..f4105e0
--- /dev/null
+++ b/packages/wavebench-rigol-dg4000/doc/README_EN.md
@@ -0,0 +1,29 @@
+# DG4000 Plugin Documentation
+
+[中文](README.md)
+
+This page routes readers to current DG4000 Reference material, development milestones, conformance,
+and historical acceptance records. Package metadata and the production descriptors are authoritative
+for current versions, entry points, models, compatibility ranges, and capabilities.
+
+## Current Reference
+
+- [Programming-manual feature-coverage matrix](DG4000_COVERAGE_MATRIX_EN.md)
+- [Repository plugin catalog](../../../doc/reference/plugin-catalog-en.md)
+
+## Development and evidence
+
+- [Feature-coverage milestones](DG4000_COVERAGE_MILESTONES_EN.md)
+- [Source conformance manifests](../conformance/)
+- [0.1.0–0.7.0 development and acceptance archive](archive/DG4000_README_0.7_EN.md)
+- [Cross-plugin acceptance and historical evidence index](../../../doc/evidence/README_EN.md)
+
+Milestones, manifests, and archives preserve evidence for particular versions, devices, and points
+in time. They do not independently promote current capabilities.
+
+## Vendor material and development environment
+
+Keep local vendor material under `vendor-local/`, which Git and the sdist exclude.
+
+- [Repository development environment](../../../doc/DEVELOPMENT_EN.md)
+- [Return to the plugin landing page](../README_EN.md)
diff --git a/packages/wavebench-rigol-dg4000/doc/archive/DG4000_README_0.7.md b/packages/wavebench-rigol-dg4000/doc/archive/DG4000_README_0.7.md
new file mode 100644
index 0000000..ac02981
--- /dev/null
+++ b/packages/wavebench-rigol-dg4000/doc/archive/DG4000_README_0.7.md
@@ -0,0 +1,249 @@
+# DG4000 0.1.0–0.7.0 开发与验收存档
+
+[English](DG4000_README_0.7_EN.md)
+
+> 类型：Historical
+> 历史范围：插件 `0.1.0` 至 `0.7.0` 的合并 README
+> 当前入口：[DG4000 插件](../../README.md)
+
+本页保留第三轮文档迁移前的能力说明、开发过程、受控实机结果和负向证据。它用于追溯历史，
+不替代 production descriptor、当前插件目录或包入口。
+
+面向双通道 RIGOL DG4202 和兼容 DG4000 系列函数/任意波形发生器的 WaveBench 可执行仪器插件。
+
+## 身份与兼容范围
+
+- distribution：`wavebench-rigol-dg4000`
+- canonical driver ID：`rigol.dg4202`
+- opt-in advanced driver ID：`rigol.dg4202-v2`
+- opt-in workspace driver ID：`rigol.dg4202-v2-workspace`
+- WaveBench：`>=0.8.25,<0.9`
+- Python：`>=3.11`
+- transport backend：`pyvisa`
+
+当前包同时使用 WaveBench `v0.8.15` 首次提供的 `SourceChannelProfile`、`v0.8.16`
+新增的 `SourceSweepProfile`、`v0.8.17` 新增的 `SourceCounterProfile`，以及 `v0.8.25`
+的 Source V2 快照契约。因此不能与早于 `v0.8.25` 的 Core 配套运行，也不自动声明
+兼容未来 `0.9`。
+
+该插件不声明 alias。安装后，显式 canonical ID `rigol.dg4202` 选择外置实现；短 alias `dg4202` 始终选择 WaveBench 内建 fallback。卸载插件后，canonical ID 也回退到内建实现。
+
+## 能力
+
+- `*IDN?`、错误队列与 CH1/CH2 状态读取；
+- CH1/CH2 负载、极性、noise、sync、burst、modulation、marker 和 pulse-hold 的严格只读 profile；
+- CH1/CH2 sweep 状态、频率窗口、spacing/steps/time、hold/return、trigger 和 marker 的严格只读 profile；
+- 全局 counter 状态、输入配置、统计显示和条件式五元组测量结果的严格只读 profile；
+- `source.snapshot_v2` 类型化只读快照：CH1/CH2 Basic、输出开关、Sweep、Pulse、Burst、
+  不含逐阶分量的部分 Harmonic、Modulation state/type、部分 ARB、Noise Overlay、Sync，
+  全局 Counter，以及 CH1/CH2 参数化 Coupling；
+- 显式 Source V2 P1 写操作：`source.basic_configure_v2`、
+  `source.basic_live_configure_v2` 和 `source.output_v2`；
+- Source V2 Counter 生产操作：`source.counter_configure_v2`、
+  `source.counter_enable_v2`（覆盖独立 disable）和 `source.counter_measure_v2`；
+- 固定频率、函数、VPP 幅度、方波占空比和显式输出控制；
+- 只读任意波形 SCPI 能力探测；
+- 使用 WaveBench 公共 `DG4000DacBlock` 契约上传已校验的 DAC14 binary block。
+
+WaveBench 核心继续负责波形文件加载、归一化、DAC14 编码、幅度安全限制、Service、run plan、状态恢复和 artifact。插件不复制这些策略。
+
+完整的厂商手册命令域、当前公开 API、离线/实机证据和默认拒绝的高风险命令见
+[DG4000 功能覆盖矩阵](../DG4000_COVERAGE_MATRIX.md)。分阶段退出门和硬件验收边界见
+[DG4000 覆盖里程碑](../DG4000_COVERAGE_MILESTONES.md)。本地厂商手册保存在被忽略的
+`doc/vendor-local/`，不进入发行包。
+
+当前 wheel 随 distribution 包含 10 份 Source conformance manifest，并与 wheel 的非 manifest 内容绑定。
+它们记录 DG4202 `00.01.14` 上已验收的 Basic、Output、Counter V2，以及仅属于
+`rigol.dg4202-v2` 的受限 Sweep configure/manual-fire 范围。通道型 volatile ARB、Harmonic
+活跃态和无通道工作区接口均未绑定 conformance manifest。
+
+## 安全边界
+
+descriptor 导入不连接仪器。factory 只通过 `DriverContext` 打开当前配置的 transport。默认离线测试不扫描资源、不连接仪器，也不发送真实 SCPI。输出控制、任意波形上传和其他写操作不会盲目重试。
+
+当前开发分支的 `0.7.0` 在原有 M1–M6 和只读 `source.snapshot_v2` 之外开放 Source V2
+P1 与 Counter V2：`source.basic_configure_v2` 仅在目标输出 OFF、FIX 模式和 fresh V2 snapshot 条件下，
+一次修改一个 Basic 字段；当前可请求 SIN/SQU/RAMP/PULS/NOIS/DC、frequency、Vpp、offset
+或 square duty。`source.basic_live_configure_v2` 仅在输出 ON、FIX 模式下修改一个 frequency
+或 Vpp 字段，禁止输出循环。`source.output_v2` 单独执行 ON/OFF，并由 Core 读取最终状态。
+Counter V2 每次只配置 coupling、输入阻抗、衰减、trigger level 或 statistics enable 中的一项；
+enable/disable 不隐式配置或清统计，measure 只读取已启用 Counter 的有效五元组。Counter 刚启用或
+无输入时的无效测量在 V2 snapshot 中标为不可用，仍允许安全 disable；legacy profile 保持严格。
+
+DG4000 没有独立的 Harmonic state-off 命令，因此 descriptor 不声明
+`source.harmonics_disable_v2`。输出 OFF、FIX 且 Basic readback 明确为 `HARM`／`HARMONIC` 时，
+`source.basic_configure_v2` 的 Sine request 可以退出该波形；这是 Basic waveform 切换，不是仅修改
+Harmonic 状态的别名，也不声称保留逐阶参数。volatile ARB adapter 仍只保留离线候选；它与
+V1 `arb-load` 复合合同重叠，当前不声明为 V2 capability。
+
+DG4202 `00.01.14` 已在 CH1、output OFF、FIX 条件下完成一次受控的 `HARM`／`HARMONIC` → Sine
+Basic V2 状态迁移与最终 readback。该观察未经过示波器环回或外部测量，只覆盖 CH1 与该固件，
+不说明逐阶 Harmonic 参数是否保留，也不提升 conformance manifest 的证据等级。
+
+`rigol.dg4202-v2` 是独立的 opt-in entry point，保留旧 driver 的基础 V2 surface，并仅额外公开
+`source.sweep_configure_v2` 和 `source.sweep_fire_v2`。`TRACe:DATA:DAC VOLATILE` 没有已验证的通道 selector，故该 entry point 的
+ARB 仍为只读，`source.arbitrary_volatile_replace_v2` 不公开。该 entry point 的 OFF／FIX `USER` 状态仅可
+通过显式 Basic V2 Sine request 退出；该操作不会读取或恢复 volatile USER 内容。`rigol.dg4202` 的 legacy
+V1 表面保持不变。Sweep 的实机证据仅覆盖输出 OFF 配置线性 1–2 kHz、101 点、12 s、manual trigger，随后在同一
+会话显式 fire、每路三次 RTM 高阻采集和输出 OFF；它不外推任意 Sweep 参数，也不改变 legacy V1 Sweep 路由。V2
+操作结束时会保持 Sweep ON，验收使用独立 legacy 事务恢复 FIX/OFF。
+
+`rigol.dg4202-v2-workspace` 是另一条独立 opt-in entry point。除只读 identity／snapshot 和用于
+OFF safety closure 的 `source.output_v2` 外，它只公开
+`source.arbitrary_workspace_volatile_replace_v2`；不公开 V1 setter、Basic／Live Basic 或 Counter 写能力。
+它把 `TRACe:DATA:DAC VOLATILE` 建模为整机的无通道 volatile 工作区：写前要求 CH1/CH2 都为 OFF，写入失败后
+对仍可用的两路各最多尝试一次 OFF recovery。该接口不接受 channel 参数，不声称 USER 被选到哪一路，不读取或恢复
+被覆盖的内容。现有
+`source.arbitrary_volatile_replace_v2` 仍是通道型合同，DG4202 不声明它。
+
+为保持 legacy 合同，DG descriptor 明确设置 `v1_route_migration_enabled=false`。既有 V1
+`source.set-*`、`source.output`、离散频响、`arb-load` 和 basic restore 继续调用 V1 路由；
+只有显式的 V2 CLI、run step 或 Service 调用使用 P1/Counter V2 adapter。它避免以不完整的
+Basic/Output V2 组合替换 DAC14 upload 或 restore 事务。
+
+P1 仍保留 `0.3.0` 的 V1 M1/M2/M4 事务边界：所有 I/O 使用同一可重入锁，固定波写入采用
+写前快照、逐步回读、off-first 恢复和歧义写锁存；DAC14 上传仅允许目标通道已 OFF、FIX
+且 sweep OFF，并明确把被覆盖的 volatile USER 波表视为不可恢复副作用。M3/M5/M6 profile
+都是只读上下文，不扩大 core 的 basic restore，也不承诺恢复 load、polarity、noise、sync、
+burst、modulation、marker、pulse hold、完整 sweep/counter profile 或 volatile USER 内容。
+结论不外推到其它型号、固件或未验收的通道接线。
+
+Coupling、Noise Overlay 与 Sync 的后续写入只完成合同和恢复顺序设计，当前 descriptor
+仍只声明 READ。Coupling 需要双通道完整目标和恢复；Noise Overlay 配置成功不能绕过独立的
+硬峰值预算；Sync 配置与物理 Sync 端口 enable 必须拆分，enable 还需要端口模型和 A5 接线证据。
+
+示例使用文档保留地址：
+
+```toml
+[connection]
+backend = "lan"
+resource = "TCPIP::192.0.2.30::INSTR"
+
+[source]
+driver = "rigol.dg4202"
+model_hint = "DG4202"
+default_channel = 1
+check_errors = true
+```
+
+## 许可证
+
+本插件采用 [MIT License](../../LICENSE)。
+
+## 实机验收边界
+
+早期验收曾使用外置 `wavebench-rigol-dg4000` 驱动 DG4202 CH1 输出 1 kHz、1 Vpp 正弦，并由外置 `wavebench-rigol-ds1000z` 驱动 DS1104Z Plus CH1 闭环采集。示波器 CH1 为 AC 耦合、固定高阻输入；DEF 波形返回 1200 点，WaveBench 测得 1000.000 Hz、1.008 Vpp。两台仪器前后错误队列均为空，发生器 CH1 原状态在 `finally` 路径恢复并回读确认。
+
+2026-07-27 在 DG4202 固件 `00.01.14` 上重新执行当前工作树验收：M1 对
+CH1/CH2 完成合计 24 查询、0 写入的严格状态 profile；M2 对两路分别完成 OFF、临时
+SQU/不同固定频率/0.8 Vpp/37% duty、显式 ON→OFF、off-first 恢复及新会话逐字段复核。
+两路最终均恢复为原始 SIN、1 kHz、5 Vpp、0 V offset、FIX、sweep OFF、输出 ON。
+
+M3 使用外置插件 `0.4.0` 在同一受控会话读取 CH1/CH2 完整 channel profile。transport
+守卫把任何 text/binary write 立即变为失败；验收最终完成 45 次 query、0 次 text write、
+0 次 binary write。两路均回读为 high-impedance load、NORMAL polarity、noise OFF/10%、
+sync ON/POSITIVE、burst OFF、modulation OFF/AM、marker OFF、pulse hold DUTY；所有基础状态
+与上下文字段全量返回。该验收没有读取错误队列，以免把消费型错误读取误称为无副作用。
+
+M4 对 CH1/CH2 分别在输出 OFF 时上传 64 点 little-endian DAC14 三角波，回读
+USER/1 kHz/1 Vpp/0 V、确认错误队列为空，并在新会话确认原态恢复。CH1 随后以 2 Vpp
+显式输出到高阻 RTM2032：10,000 点采集测得 997.26 Hz、2.16 Vpp，三角模板 RMSE
+0.0390 V，约为正弦模板 RMSE 的 49.2%；恢复后复测原正弦为 998.25 Hz、5.12 Vpp。
+CH2 随后接入 RTM2032 CH2 高阻输入，以 1 kHz、1 Vpp 三角波完成独立模拟闭环：测得
+999.75 Hz、1.12 Vpp，归一化三角模板 RMSE 为 0.09285，正弦模板 RMSE 为 0.2196，
+比值为 0.4229。DG4202 CH2 原始状态随后恢复，错误队列为空；示波器时基、量程和触发
+设置在本轮验收前后保持不变。RTM2032 抓波会发送受控的传输格式/点数设置，不计作
+示波器零写入会话。两路 volatile USER 内容均被本次上传覆盖，这是已知且不可恢复的
+副作用；未保存真实地址、序列号、原始波形或命令日志。
+
+M5 使用外置插件 `0.5.0` 对 CH1/CH2 完成 query-only sweep profile 验收。初始两路均为
+output ON、FIX、sweep/burst/modulation/marker OFF；受控预置会话先将输出关闭，再分别
+建立 sweep OFF 与 sweep ON 状态。每个状态都在独立 transport 守卫下对两通道连续读取
+三轮，单个只读会话完成 104 次 query、0 次 text write、0 次 binary write，六份 profile
+在各状态下逐字段一致。profile 覆盖 start/stop/center/span、linear/log/step、steps、
+sweep/hold/return time、trigger source/slope/out 和 marker；任何查询或关系校验失败均不会
+返回部分结果。预置与恢复写入不属于这两个零写读取会话；恢复完成后，CH1/CH2 的完整
+channel profile 与 sweep profile 均与初始快照相等，错误队列为空。未发送 immediate
+trigger 或 `*TRG`，也未形成 sweep 写 capability。
+
+M6 使用外置插件 `0.6.0` 对 DG4202 的全局 counter 完成非破坏性 OFF-state 验收。
+counter 初始与最终均为 OFF，statistics 为 OFF，显示为 DIGITAL；连续三轮完整 profile
+逐字段一致。整个验收完成 39 次 query、0 次 text write、0 次 binary write，并回读
+AC coupling、1 MΩ、1X attenuation、USER1 gate、HF rejection OFF、0 V trigger level 和
+50% sensitivity。OFF 状态明确返回 `measurement=None`，驱动未发送 `MEASure?`、未自动
+启用 counter，也未发送 `AUTO` 或 `STATIstics:CLEAr`。counter-ON 的频率、周期、占空比、
+正脉宽和负脉宽五元组解析及关系校验只有离线证据，不属于本次实机验收。
+
+2026-08-30 使用外置插件 `0.7.0` 完成 Source V2 当前状态只读验收。DG4202 固件
+`00.01.14` 的 CH1/CH2 均为 OFF、SIN、1 kHz、5 Vpp、0 V offset、FIX、sweep OFF；
+`source.snapshot_v2` 完成 40 次纯查询，前后锚点一致，会话保持 healthy。Burst OFF
+以类型化状态返回；Sweep、Pulse 与 Harmonic 因激活条件不成立而返回
+`inactive_by_anchor`。随后使用既有 V1 事务在输出始终 OFF 的条件下，将两路临时设为
+PULSE、1 Vpp；第二次 V2 快照完成 52 次查询，并在两路返回 DUTY hold、500 µs width、
+50% duty、0 s delay 和 1.9531 µs 双边沿。最终新会话确认两路均恢复为 OFF、SIN、
+1 kHz、5 Vpp、0 V offset、FIX。全程未输出波形或采集 RTM2032；Sweep、Burst ON 和
+Harmonic 活跃态仍无本轮实机证据。
+
+同日的后续只读验收把 Counter、Modulation、部分 ARB、Coupling、Sync 与 Noise Overlay
+一并纳入同一个 Source V2 快照。第一次运行在旧的 `:COUP:CHAN:BASE?` 写法处超时；该会话
+立即停止并关闭，两路复读仍为 OFF、SIN、1 kHz、5 Vpp、0 V offset、FIX。驱动随后改用手册
+完整关键字 `:COUP:CHANNEL:BASE?`，DG 包全量测试保持 `213 passed`。最终验收快照完成
+67 次纯查询，锚点一致且 session health 前后均为 healthy；完整 harness 共 112 次查询，
+text/binary write request、transmitted、completed 与 instrument mutation 均为 0。Coupling
+三维均为 OFF、基准 CH1；两路 Sync 均为 ON/POSITIVE，Noise Overlay 均为 OFF/10%。
+最终两路状态未改变，会话健康关闭；RTM2032 未被访问、触发或采集。
+
+同日完成 P1 normal-path 验收。CH1→RTM CH1 在输出 OFF 下依次写入 RAMP、PULSE、NOISE、
+DC 和 SIN，并以 V2 postcondition 逐项回读；随后以正弦完成 1 kHz/1 Vpp 输出、live
+frequency 改为 2 kHz、live Vpp 改为 2 Vpp 的三次高阻采集。CH2→RTM CH2 在输出 OFF 下
+完成 SQUARE/25% duty、1 kHz/1 Vpp 配置，并完成相同的 2 kHz live frequency 与 2 Vpp
+live Vpp 采集。两路最高输出为 2 Vpp，每次仅开启对应通道，所有 capture quality/expect
+门均通过。独立恢复 run 将 CH1/CH2 复读为 OFF、SIN、1 kHz、5 Vpp、0 V、FIX 和 50% duty；
+RTM 两路均为 high-Z。该证据只覆盖正常写入、后置回读和最终 OFF，不覆盖 timeout、二义写
+或 recovery-failure 的实机故障注入。
+
+2026-08-31，Counter V2 在 DG4202 与 RTM2032 CH1 的三通接线下完成独立验收。Counter 输入
+约束为不超过 5 Vpp，实际发射 1 kHz、1 Vpp 正弦。输入阻抗 50 Ω／1 MΩ、衰减 1X／10X、
+trigger level、statistics 与 AC/DC coupling 均逐项写入并回读；Counter 测得 1000.011247 Hz，
+RTM 捕获与 FFT 为 1000 Hz、1.0 Vpp。随后输出关闭、Counter 关闭、耦合恢复 AC，新的会话复读
+CH1 OFF、5 Vpp 配置与 Counter OFF。输出始终 OFF 的 Counter 启用→关闭也通过，验证暂不可用测量
+不会阻断安全关闭。timeout、二义写与 recovery-failure 仍无实机故障注入结论。
+
+同日，`rigol.dg4202-v2` 完成受控 Sweep 实机验收。CH1 和 CH2 分别在输出 OFF 时配置为
+线性 1–2 kHz、101 点、12 s、manual trigger、marker OFF；随后仅开启当前通道，在同一会话中
+fire 并完成三次 RTM 高阻采集。CH1 的三段频率估计为约 1202/1546/1872 Hz，CH2 为约
+1265/1628/1982 Hz，最大采集 Vpp 为 1.016。每个 run 均在两路 output OFF 后结束；V2 不恢复
+Sweep 状态，因此再用独立 legacy 事务复原两路 FIX/OFF，并由新会话确认。已关闭的 marker 保留
+陈旧频率属于只读设备状态，不会再被误判为配置不一致；启用 marker 时仍要求其位于 Sweep 窗口内。
+
+## 开发验证
+
+```bash
+python -m pytest -q packages/wavebench-rigol-dg4000/tests
+python -m ruff check packages/wavebench-rigol-dg4000
+python -m wavebench plugin package check packages/wavebench-rigol-dg4000
+python -m wavebench plugin install packages/wavebench-rigol-dg4000 --dry-run
+```
+
+日常源码开发可使用仓库级 [editable 开发环境](../../../../doc/DEVELOPMENT.md)；正式验收仍使用真实 wheel 和一次性虚拟环境。
+
+真实仪器地址、序列号、波形、截图和命令日志不得提交。
+
+## 来源
+
+- `0.1.0`：从 WaveBench 内建 DG4202 协议实现迁移；核心继续持有 Service 和安全策略。
+- `0.2.0`：增加 M0–M12 双语覆盖里程碑与发行包防泄漏回归；不扩大 capability。
+- `0.3.0`：交付现有 API 的严格收口、固定波事务化和 DAC14 fail-closed 实现；DG4202 `00.01.14` 的 M1/M2 与 M4 CH1 实机退出门通过，M4 CH2 仅协议/恢复通过，未扩大 capability。
+- `0.4.0`：要求 WaveBench `>=0.8.15`，新增 `source.channel_profile`；DG4202 `00.01.14` 的 CH1/CH2 严格零写 M3 实机门及 M4 完整实机门通过，不扩大自动恢复范围或 capability。
+- `0.5.0`：要求 WaveBench `>=0.8.16`，新增 `source.sweep_profile`；DG4202 `00.01.14`
+  的 CH1/CH2 在 sweep OFF/ON 两种预置状态下各完成三轮严格零写 M5 实机门，不增加
+  sweep setter、trigger 或自动恢复字段。
+- `0.6.0`：要求 WaveBench `>=0.8.17`，新增 `source.counter_profile`；DG4202
+  `00.01.14` 在 counter OFF 下完成三轮严格零写 M6 实机门，不自动启用 counter，
+  不发送 `AUTO`/statistics clear，也不把离线验证的 counter-ON 测量解析写成实机结论。
+- `0.7.0` 开发分支：要求 WaveBench `>=0.8.25`，保留只读 `source.snapshot_v2`，并开放
+  Basic／Live Basic／Output P1 与 Counter V2 capability。`rigol.dg4202-v2` 另以独立 opt-in
+  entry point 开放受限的 Sweep configure/manual-fire；它不迁移 V1 路由，也不开放 volatile ARB。
+  Source V2 正常路径已在 DG4202 `00.01.14` 的 CH1/CH2 高阻采集及 Counter→RTM CH1 三通测量中
+  验证；Sweep 则在两路独立的低压高阻回路通过。Burst、Coupling、Noise Overlay 和 Sync 写 capability
+  仍未公开，故障 recovery 尚无实机 fault-injection 结论。
diff --git a/packages/wavebench-rigol-dg4000/doc/archive/DG4000_README_0.7_EN.md b/packages/wavebench-rigol-dg4000/doc/archive/DG4000_README_0.7_EN.md
new file mode 100644
index 0000000..e8b9a9c
--- /dev/null
+++ b/packages/wavebench-rigol-dg4000/doc/archive/DG4000_README_0.7_EN.md
@@ -0,0 +1,272 @@
+# DG4000 0.1.0–0.7.0 Development and Acceptance Archive
+
+[中文](DG4000_README_0.7.md)
+
+> Type: Historical
+> Historical scope: combined package README for plugin versions `0.1.0` through `0.7.0`
+> Current entry: [DG4000 plugin](../../README_EN.md)
+
+This page preserves capability notes, development history, controlled hardware results, and negative
+evidence from before the third documentation migration. It supports historical review and does not
+replace the production descriptor, current plugin catalog, or package landing page.
+
+An executable WaveBench instrument plugin for the dual-channel RIGOL DG4202 and compatible DG4000 function/arbitrary waveform generators.
+
+## Identity and compatibility
+
+- Distribution: `wavebench-rigol-dg4000`
+- Canonical driver ID: `rigol.dg4202`
+- Opt-in advanced driver ID: `rigol.dg4202-v2`
+- Opt-in workspace driver ID: `rigol.dg4202-v2-workspace`
+- WaveBench: `>=0.8.25,<0.9`
+- Python: `>=3.11`
+- Transport backend: `pyvisa`
+
+This package uses the public `SourceChannelProfile` contract first available in WaveBench
+`v0.8.15`, the `SourceSweepProfile` contract added in `v0.8.16`, the `SourceCounterProfile`
+contract added in `v0.8.17`, and the Source V2 snapshot contract available in `v0.8.25`. It does
+not run with a core older than `v0.8.25` and does not automatically claim compatibility with a
+future `0.9` core.
+
+The plugin defines no aliases. After installation, the explicit canonical ID `rigol.dg4202` selects the external implementation, while the short `dg4202` alias always selects WaveBench's built-in fallback. Removing the plugin also restores the built-in canonical implementation.
+
+## Capabilities and boundaries
+
+The driver supports identity/error queries, CH1/CH2 state, strict read-only channel profiles for
+load, polarity, noise, sync, burst, modulation, marker, and pulse hold, strict read-only sweep
+profiles for the frequency window, spacing, timing, trigger, and marker, a strict read-only global
+counter profile for input configuration, statistics display, and conditional five-field
+measurements, fixed frequency, function, VPP amplitude, square duty cycle, explicit output control,
+query-only arbitrary-wave capability probes, and upload of validated DAC14 blocks through
+WaveBench's public `DG4000DacBlock` contract. `source.snapshot_v2` adds typed read-only Basic,
+output-enabled, Sweep, Pulse, Burst, partial Harmonic, Modulation state/type, partial ARB,
+Noise Overlay, and Sync facets for CH1/CH2, plus the global Counter and parameterized CH1/CH2
+Coupling state. The Harmonic facet does not claim per-order component readback.
+
+The current development branch also declares explicit Source V2 P1 write capabilities
+`source.basic_configure_v2`, `source.basic_live_configure_v2`, and `source.output_v2`, plus
+production Counter V2 capabilities `source.counter_configure_v2`, `source.counter_enable_v2`
+(which covers the separate disable operation), and `source.counter_measure_v2`.
+
+WaveBench core retains waveform-file loading, normalization, DAC14 encoding, amplitude safety limits, services, run plans, state restoration, and artifacts. Descriptor import performs no instrument I/O, and default tests use only a fake transport. Writes and uploads are not retried blindly.
+
+The current `0.7.0` development branch adds Source V2 P1 and Counter V2 beside the read-only
+snapshot surface.
+`source.basic_configure_v2` requires target output OFF, FIX mode, and a fresh V2 snapshot, and
+changes exactly one Basic field per request. It currently accepts SIN/SQU/RAMP/PULS/NOIS/DC,
+frequency, Vpp, offset, or square duty. `source.basic_live_configure_v2` changes exactly one
+frequency or Vpp field while output remains ON in FIX mode, without output cycling.
+`source.output_v2` separately enables or disables one channel and the Core reads back its final
+state.
+Counter V2 changes exactly one of coupling, input impedance, attenuation, trigger level, or
+statistics enable per request. Enable/disable never configures input state or clears statistics;
+measure accepts only an already-enabled valid five-field result. A settling or no-input Counter
+measurement is unavailable in a V2 snapshot but does not block a safe disable; the legacy profile
+remains strict.
+
+DG4000 has no independent Harmonic state-off command, so the descriptor does not declare
+`source.harmonics_disable_v2`. When output is OFF, frequency mode is FIX, and Basic readback is
+explicitly `HARM`/`HARMONIC`, a Sine `source.basic_configure_v2` request may leave that waveform.
+This is a Basic waveform change, not an alias for a state-only Harmonic disable, and it makes no
+claim about preserving per-order parameters. The volatile ARB adapter remains an offline candidate;
+its overlap with the V1 `arb-load` composite contract keeps it out of the V2 capability surface.
+
+A controlled DG4202 `00.01.14` observation confirmed one CH1, output-OFF, FIX `HARM`/`HARMONIC` to
+Sine Basic V2 transition with final readback. It had no oscilloscope loopback or external measurement,
+covers only CH1 and this firmware, makes no per-order-parameter preservation claim, and does not
+raise any conformance-manifest evidence level.
+
+`rigol.dg4202-v2` is a separate opt-in entry point that retains the legacy driver's basic V2
+surface and adds only `source.sweep_configure_v2` and `source.sweep_fire_v2`. `TRACe:DATA:DAC VOLATILE` has no verified
+channel selector, so ARB remains read-only on that entry point and
+`source.arbitrary_volatile_replace_v2` is not declared. An OFF/FIX `USER` state on that entry point
+may leave through an explicit Basic V2 Sine request; that operation neither reads nor restores volatile
+USER content. The `rigol.dg4202` legacy V1 surface is unchanged.
+
+`rigol.dg4202-v2-workspace` is a separate opt-in entry point. Apart from read-only identity/snapshot
+and `source.output_v2` for the OFF safety closure, it exposes only
+`source.arbitrary_workspace_volatile_replace_v2`; it exposes no V1 setters, Basic/Live Basic, or
+Counter write capability. It models `TRACe:DATA:DAC VOLATILE` as an instrument-wide unscoped volatile
+workspace: CH1 and CH2 must both be OFF before the write, and a failure makes at most one OFF-recovery
+attempt per still-usable output. It takes no channel argument, makes no claim about which channel
+selected USER, and neither reads nor restores overwritten content. DG4202 continues
+not to declare the channel-scoped `source.arbitrary_volatile_replace_v2` contract.
+
+The opt-in Sweep evidence is deliberately narrow: output-OFF configuration of a linear 1–2 kHz,
+101-point, 12-second, manual-trigger Sweep, then same-session fire, three high-impedance RTM
+captures per channel, and output OFF. It does not generalize to arbitrary Sweep parameters and does
+not replace the legacy V1 Sweep route. The V2 operation leaves Sweep enabled; acceptance used a
+separate legacy transaction to return both channels to FIX/OFF.
+
+The DG descriptor explicitly sets `v1_route_migration_enabled=false`. Existing V1 `source.set-*`,
+`source.output`, discrete frequency-response, `arb-load`, and basic restore paths therefore remain
+V1. Only the explicit V2 CLI, run step, or Service operation uses the P1/Counter V2 adapter. This avoids
+silently replacing legacy DAC14 upload or restore transactions with incomplete Basic/Output V2
+composition.
+
+P1 preserves the V1 M1/M2/M4 transaction boundaries from `0.3.0`: all I/O shares one reentrant
+lock; fixed-wave writes use a pre-write snapshot, per-step readback, off-first recovery, and
+ambiguous-write latching; DAC14 upload is accepted only while the target channel is already OFF,
+in FIX mode, with sweep OFF. Overwriting the volatile USER waveform is reported as an irreversible
+side effect. The M3, M5, and M6 profiles are read-only contexts: they do not widen core basic
+restoration or promise restoration of load, polarity, noise, sync, burst, modulation, marker,
+pulse hold, a complete sweep/counter profile, or volatile USER contents. No result is extrapolated
+to another model, firmware, or unaccepted channel wiring.
+
+Future Coupling, Noise Overlay, and Sync writes currently have contract and recovery-order designs
+only; the descriptor still declares READ only. Coupling requires a complete dual-channel target and
+restore, Noise Overlay configuration cannot bypass an independent hard-peak budget, and Sync
+configuration must remain separate from enabling a physical Sync connector. Sync enable also
+requires a physical-port model and A5 wiring evidence.
+
+The [DG4000 coverage matrix](../DG4000_COVERAGE_MATRIX_EN.md) maps vendor command domains to
+current public APIs, offline/hardware evidence, and high-risk commands denied by default. The
+[DG4000 coverage milestones](../DG4000_COVERAGE_MILESTONES_EN.md) define staged exit gates and
+hardware-acceptance boundaries. The local vendor manual remains under ignored `doc/vendor-local/`
+and is excluded from releases.
+
+The current wheel carries ten Source conformance manifests bound to its non-manifest contents. They
+record the accepted Basic, Output, and Counter V2 scope for DG4202 firmware `00.01.14`, plus the
+restricted opt-in Sweep configure/manual-fire scope of `rigol.dg4202-v2`. Channel-scoped volatile
+ARB, active Harmonic candidates, and the unscoped workspace entry point remain outside conformance
+claims.
+
+The Chinese README contains an RFC 5737 documentation resource. Never commit real resources, serial numbers, captures, screenshots, or command logs.
+
+## License
+
+This plugin is licensed under the [MIT License](../../LICENSE).
+
+## Hardware acceptance boundary
+
+An earlier controlled loop used external `wavebench-rigol-dg4000` to drive DG4202 CH1 with a 1 kHz, 1 Vpp sine wave and external `wavebench-rigol-ds1000z` to capture DS1104Z Plus CH1. Scope CH1 used AC coupling with fixed high-impedance input. A 1200-point DEF waveform measured 1000.000 Hz and 1.008 Vpp in WaveBench. Both instruments had clear error queues before and after the run, and the original generator CH1 state was restored in a `finally` path and verified by readback.
+
+On 2026-07-27, current worktree behavior was reaccepted on DG4202 firmware `00.01.14`.
+M1 completed one strict CH1/CH2 profile with 24 queries and zero writes. M2 separately exercised
+OFF, temporary SQU/different fixed frequencies/0.8 Vpp/37% duty, explicit ON-to-OFF, off-first
+restore, and fresh-session field verification on both channels. Both channels ended at their
+original SIN, 1 kHz, 5 Vpp, 0 V offset, FIX, sweep OFF, output ON state.
+
+M3 used external plugin `0.4.0` to read complete CH1 and CH2 channel profiles in one controlled
+session. Transport guards turned any text or binary write into an immediate failure; acceptance
+completed 45 queries, zero text writes, and zero binary writes. Both channels reported
+high-impedance load, NORMAL polarity, noise OFF/10%, sync ON/POSITIVE, burst OFF, modulation
+OFF/AM, marker OFF, and pulse hold DUTY, with all basic and context fields returned. The gate did
+not read the error queue because consuming it would not be a side-effect-free observation.
+
+M4 separately uploaded a 64-point little-endian DAC14 triangle to CH1 and CH2 while output was
+OFF, read back USER/1 kHz/1 Vpp/0 V, verified clear error queues, and confirmed restoration in new
+sessions. CH1 then explicitly drove a 2 Vpp triangle into a high-impedance RTM2032. A 10,000-point
+capture measured 997.26 Hz and 2.16 Vpp; triangle-template RMSE was 0.0390 V, 49.2% of the
+sine-template RMSE. After restoration, the original sine measured 998.25 Hz and 5.12 Vpp. CH2 was
+then connected to the high-impedance RTM2032 CH2 input and completed an independent 1 kHz, 1 Vpp
+triangle loop: measured frequency was 999.75 Hz, Vpp was 1.12 V, normalized triangle-template RMSE
+was 0.09285, sine-template RMSE was 0.2196, and their ratio was 0.4229. The original DG4202 CH2
+state was restored and the error queue was clear; scope timebase, range, and trigger settings were
+unchanged across the gate. RTM2032 waveform fetch uses controlled transfer-format/point writes and
+is not a zero-write scope session. Both uploads overwrite volatile USER data, an acknowledged
+irreversible side effect. No real resource, serial number, raw waveform, or command log is stored.
+
+M5 used external plugin `0.5.0` for query-only sweep-profile acceptance on CH1 and CH2. Both
+channels initially had output ON, FIX mode, and sweep/burst/modulation/marker OFF. A controlled
+staging session first disabled output and separately established sweep OFF and sweep ON. For each
+state, a guarded read-only session read both channels three consecutive times. Each session issued
+104 queries, zero text writes, and zero binary writes, and all six profiles matched field by field
+within their preset state. The profile covers start/stop/center/span, linear/log/step spacing,
+steps, sweep/hold/return timing, trigger source/slope/out, and marker. Any failed query or invalid
+relationship rejects the whole profile. Staging and restoration writes were outside the two
+zero-write read sessions. After restoration, both complete channel profiles and sweep profiles
+matched their initial snapshots and the error queue was clear. No immediate trigger or `*TRG` was
+sent, and no sweep-write capability was created.
+
+M6 used external plugin `0.6.0` for non-destructive OFF-state acceptance of the DG4202's global
+counter. The counter was OFF before and after the gate, statistics stayed OFF, the display stayed
+DIGITAL, and three complete profiles matched field by field. The complete gate issued 39 queries,
+zero text writes, and zero binary writes, returning AC coupling, 1 megaohm, 1X attenuation, USER1
+gate time, HF rejection OFF, 0 V trigger level, and 50% sensitivity. The OFF state explicitly
+returned `measurement=None`; the driver sent no `MEASure?`, did not enable the counter, and sent
+neither `AUTO` nor `STATIstics:CLEAr`. Parsing and relationship validation for the counter-ON
+frequency/period/duty/positive-width/negative-width tuple has offline evidence only and is not part
+of this hardware conclusion.
+
+On 2026-08-30, external plugin `0.7.0` completed read-only Source V2 acceptance for the current
+instrument state. DG4202 firmware `00.01.14` reported CH1/CH2 OFF, SIN, 1 kHz, 5 Vpp, 0 V offset,
+FIX, and sweep OFF. `source.snapshot_v2` completed 40 pure queries with matching before/after
+anchors and healthy session state. Burst OFF was returned as a typed facet; Sweep, Pulse, and
+Harmonic were `inactive_by_anchor`. Existing V1 transactions then staged both channels at PULSE,
+1 Vpp, and output OFF. A second V2 snapshot completed 52 queries and returned DUTY hold, 500 us
+width, 50% duty, 0 s delay, and 1.9531 us leading/trailing transitions on both channels. A fresh
+final session confirmed both channels restored to OFF, SIN, 1 kHz, 5 Vpp, 0 V offset, and FIX.
+No waveform was emitted and RTM2032 was not captured. Active Sweep, Burst ON, and Harmonic remain
+outside this hardware evidence.
+
+A follow-up read-only gate on the same date added Counter, Modulation, partial ARB, Coupling, Sync,
+and Noise Overlay to one Source V2 snapshot. The first run timed out at the previous
+`:COUP:CHAN:BASE?` spelling; that session stopped immediately and closed, and both channels still
+read OFF, SIN, 1 kHz, 5 Vpp, 0 V offset, and FIX. The driver then used the manual's complete
+`:COUP:CHANNEL:BASE?` keyword and retained `213 passed` package tests. The accepted snapshot issued
+67 pure queries with matching anchors and healthy session state before and after. The complete
+harness issued 112 queries and recorded zero text/binary write requests, transmissions,
+completions, or instrument mutations. All three Coupling dimensions were OFF with CH1 as reference;
+both Sync outputs were ON/POSITIVE and both Noise Overlay states were OFF/10%. Final channel state
+was unchanged and the session closed healthy. RTM2032 was not accessed, triggered, or captured.
+
+The same date also completed normal-path P1 acceptance. With output OFF, CH1→RTM CH1 wrote and
+read back RAMP, PULSE, NOISE, DC, and SIN through V2 postconditions, then captured sine at
+1 kHz/1 Vpp, after a live frequency change to 2 kHz, and after a live Vpp change to 2 Vpp.
+CH2→RTM CH2 configured SQUARE/25% duty at 1 kHz/1 Vpp and completed the same live frequency and
+Vpp captures. Each channel emitted alone, no output exceeded 2 Vpp, and every capture quality and
+expectation gate passed. A separate restoration run independently read both channels as OFF, SIN,
+1 kHz, 5 Vpp, 0 V, FIX, and 50% duty; both RTM inputs remained high-Z. This evidence covers normal
+writes, postconditions, and final OFF only, not timeout, ambiguous-write, or recovery-failure fault
+injection on hardware.
+
+On 2026-08-31, Counter V2 completed an independent acceptance using a T connection from DG4202 CH1
+to RTM2032 CH1 and the DG Counter input. The Counter input limit was 5 Vpp; the emitted signal was
+only 1 kHz at 1 Vpp. The transaction wrote and read back 50 ohm/1 megaohm impedance, 1X/10X
+attenuation, trigger level, statistics, and AC/DC coupling one field at a time. Counter reported
+1000.011247 Hz while the RTM capture and FFT reported 1000 Hz at 1.0 Vpp. The final fresh-session
+readback confirmed CH1 OFF with its 5 Vpp configuration and Counter OFF/AC. A Counter enable→disable
+run with output held OFF also passed, proving an unavailable measurement cannot block safe disable.
+No timeout, ambiguous-write, or recovery-failure fault was injected into hardware.
+
+On the same date, `rigol.dg4202-v2` completed controlled Sweep acceptance. CH1 and CH2 were each
+configured while output was OFF for a linear 1–2 kHz, 101-point, 12-second manual-trigger Sweep
+with marker OFF. The selected channel was then enabled, fired in the same session, and captured
+three times through the high-impedance RTM input. CH1 frequency estimates were approximately
+1202/1546/1872 Hz and CH2 estimates approximately 1265/1628/1982 Hz; maximum captured Vpp was
+1.016. Each run ended with both outputs OFF. Since V2 does not restore Sweep state, a separate
+legacy transaction returned both channels to FIX/OFF and a fresh session verified the result. A
+disabled marker may retain a stale frequency as read-only device state; enabled markers remain
+range-checked against the Sweep window.
+
+## Development checks
+
+Run the package tests, Ruff, WaveBench package inspection, and a managed-install dry run from an
+environment containing WaveBench `v0.8.25` or newer within the declared `<0.9` range.
+
+Use the repository-level [editable development environment](../../../../doc/DEVELOPMENT_EN.md) for daily source work. Formal acceptance still uses a real wheel and a disposable virtual environment.
+
+## Provenance
+
+- `0.1.0` migrated the vendor-protocol portion of WaveBench's built-in DG4202 driver while leaving services and safety policy in core.
+- `0.2.0` adds the bilingual M0-M12 coverage plan and release-artifact leak prevention without expanding capabilities.
+- `0.3.0` delivers strict current-API validation, transactional fixed-wave writes, and fail-closed DAC14 handling. DG4202 `00.01.14` passes M1/M2 and the M4 CH1 hardware gate; M4 CH2 passes protocol/restoration only. No capability is added.
+- `0.4.0` requires WaveBench `>=0.8.15` and adds `source.channel_profile`. DG4202 `00.01.14`
+  passes the strict zero-write M3 gate and complete M4 hardware gate on CH1/CH2 without widening
+  automatic restoration or the capability surface.
+- `0.5.0` requires WaveBench `>=0.8.16` and adds `source.sweep_profile`. DG4202 `00.01.14`
+  passes three strict zero-write M5 rounds on CH1/CH2 in both sweep-OFF and sweep-ON preset states
+  without adding a sweep setter, trigger, or automatic-restoration field.
+- `0.6.0` requires WaveBench `>=0.8.17` and adds `source.counter_profile`. DG4202 `00.01.14`
+  passes three strict zero-write M6 rounds with the counter OFF, without automatically enabling
+  the counter, sending `AUTO`/statistics clear, or presenting offline-only counter-ON parsing as a
+  hardware result.
+- The `0.7.0` development branch requires WaveBench `>=0.8.25`, retains pure-query
+  `source.snapshot_v2`, and declares Basic/Live Basic/Output P1 plus Counter V2 capabilities.
+  `rigol.dg4202-v2` separately declares restricted Sweep configure/manual-fire as an opt-in driver;
+  it does not migrate V1 routes or expose volatile ARB. DG4202 `00.01.14` normal paths were accepted
+  on CH1 and CH2 through high-impedance RTM2032 captures and on Counter through the CH1 T connection;
+  the restricted Sweep path passed independent low-voltage high-impedance loops on both channels.
+  Burst, Coupling, Noise Overlay, and Sync write capabilities remain undeclared, and no hardware
+  fault-injection conclusion exists for recovery.
diff --git a/packages/wavebench-rigol-dg4000/tests/test_wheel.py b/packages/wavebench-rigol-dg4000/tests/test_wheel.py
index 55951a1..f695b91 100644
--- a/packages/wavebench-rigol-dg4000/tests/test_wheel.py
+++ b/packages/wavebench-rigol-dg4000/tests/test_wheel.py
@@ -96,7 +96,7 @@ def test_wheel_contains_verified_source_conformance_manifests(tmp_path: Path) ->
     package = inspect_plugin_wheel(wheel)
 
     assert package.source_conformance_wheel_sha256 == (
-        "sha256:5eb021402156069ff367b4e1f8ea34dae963fcd9844bb1fa1ba6120ce872fe10"
+        "sha256:982f708c99dfdeed968bd8bcb0135b1fe2b70ae8a8e5fc97995c33f93be50d2c"
     )
     assert {
         (item.manifest_id, item.claimed_level.value, item.channels)
diff --git a/packages/wavebench-rigol-dm3000/README.md b/packages/wavebench-rigol-dm3000/README.md
index c945799..bc0e8cf 100644
--- a/packages/wavebench-rigol-dm3000/README.md
+++ b/packages/wavebench-rigol-dm3000/README.md
@@ -5,69 +5,22 @@
 面向 RIGOL DM3000/DM3058 数字万用表的 WaveBench 可执行仪器插件。本包仅支持经
 PyVISA 访问的 LAN/VXI-11 连接。
 
-## 身份与迁移边界
+## 从这里开始
 
-- distribution：`wavebench-rigol-dm3000`
-- canonical driver ID：`rigol.dm3000`
-- WaveBench：`>=0.8.11,<0.9`
-- Python：`>=3.11`
-- transport backend：`pyvisa`（LAN-only）
-- VISA resource scheme：`TCPIP`；拒绝 `ASRL`、`USB` 和 `GPIB`
+- [查询当前版本、兼容范围、型号和 capability](../../doc/reference/plugin-catalog.md)
+- [查看当前功能覆盖矩阵](doc/DM3000_COVERAGE_MATRIX.md)
+- [查阅开发里程碑与实机证据](doc/DM3000_COVERAGE_MILESTONES.md)
+- [安装和管理 WaveBench 插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-当前包面向 WaveBench `v0.8.11` release，不自动声明兼容未来 `0.9`。
+## 连接与能力边界
 
-本插件不声明 alias。安装后，显式 canonical ID `rigol.dm3000` 选择外置 LAN 实现；
-短 alias `dm3000` 和 `dm3058` 始终选择 WaveBench 内建 fallback，继续保留 serial 与
-pyvisa 双 backend。卸载插件后，canonical ID 也回退到内建实现。
+显式配置 `rigol.dm3000` 时使用此外置 LAN-only 实现。短 alias `dm3000` 和 `dm3058` 仍选择
+Core fallback，并保留 RS-232 路径。canonical driver 会在打开 transport 前拒绝 serial backend
+以及 ASRL、USB、GPIB 等非 TCPIP resource。
 
-若 canonical ID 配置了 `backend = "serial"`，或给 `lan` / `visa` / `pyvisa` backend
-提供 `ASRL`、`USB`、`GPIB` 等非 TCPIP VISA resource，WaveBench 都会在打开 transport
-前明确拒绝。需要 RS-232 时应显式使用短 alias。
-
-## 能力
-
-- `dmm.idn`：查询 `*IDN?`；
-- `dmm.read`：读取 DCV、ACV、DCI、ACI、二线/四线电阻、频率、周期、通断、二极管和
-  电容；
-- `dmm.function_status`：读取并规范化当前测量功能；
-- `dmm.set_function`：切换测量功能并回读确认；
-- `dmm.measurement_profile`：只读当前功能、离散量程码和 DCV 输入阻抗；
-- `dmm.trigger_status`：只读当前触发源、auto 相关设置、single count、外部触发和 VMC 设置；
-- `dmm.calculation_status`：只读当前 calculation 模式、统计 count 与 dB/dBm reference；
-- `dmm.calculation_statistics`：仅在调用者确认对应 calculation 已启用时读取已有 min/max/average；
-- `dmm.system_interface_status`：只读脱敏的系统与接口状态，不查询设备或网络标识；
-- `dmm.set_voltage_range`：仅为当前已激活的 DCV/ACV 设置 `0..4` 离散档位码并回读；
-- `dmm.set_dcv_impedance`：仅在 DCV 下设置 `10M`/`10G` 并回读，其中 `10G` 只允许档位码 `0..2`。
-
-`wavebench dmm profile` 不切换功能、不写量程、不读取错误队列。手册中的档位码 `0`
-表示最小量程，不是自动量程；仪器没有对应的自动/手动只读查询，因此
-`auto_range=n/a`。通断和二极管没有可验收的量程查询，相应字段也返回 `n/a`。
-
-配置命令不会隐式切换测量功能。范围写入失败时会尝试恢复原档位；由于手册说明任何范围
-写入都会把测量方式切到手动，失败路径即使恢复了档位也无法证明原自动/手动方式已恢复，
-因此该实例会锁停后续配置写入。阻抗写入失败时同样执行恢复；首写结果不明或恢复失败也会
-锁停。CLI 入口为 `wavebench dmm range set dcv|acv 0..4` 和
-`wavebench dmm impedance set 10M|10G`。
-
-M4 查询不会切换 function、启用 calculation、清空统计或发出 trigger。统计 CLI 必须传入
-`--calculation-active-confirmed`，并且驱动会再次确认仪器当前 calculation 正是所请求的
-`average`、`min` 或 `max`。CLI 入口为 `wavebench dmm trigger status`、
-`wavebench dmm calculation status` 与 `wavebench dmm calculation statistics average|min|max
---calculation-active-confirmed`。
-
-M5 命令 `wavebench dmm system-interface status` 只输出 11 个白名单字段。任一回包缺失、
-未知或越界都会使整次快照失败，不返回部分结果；该路径不发送写入、`*CLS` 或错误队列查询。
-
-插件复用 WaveBench 公共 `DmmReading`、`DmmDriver` 和 `DmmService` 契约。Service 继续
-负责会话生命周期和读取前等待；插件只包含厂商 SCPI 协议与 descriptor。
-
-厂商编程手册各命令域、当前十一项 capability、逐测量类型离线/实机证据和默认拒绝的
-高风险操作见 [DM3000 功能覆盖矩阵](doc/DM3000_COVERAGE_MATRIX.md)。本地厂商手册保存在
-被忽略的 `doc/vendor-local/`，不进入发行包。
-
-分阶段可实施能力、精确实机命令清单、协议验收口径及 2026-07-26 的通过/失败边界见
-[DM3000 功能覆盖里程碑](doc/DM3000_COVERAGE_MILESTONES.md)。诊断探针不等于公开 capability，
-本轮也不构成测量准确度或校准验收。
+当前实现覆盖常见读数、测量功能与 profile、触发／calculation／系统接口只读状态，以及受限的
+功能、DCV／ACV 档位和 DCV 输入阻抗设置。精确 capability、参数边界和拒绝行为以 production
+descriptor 与功能覆盖矩阵为准。
 
 ## 配置示例
 
@@ -83,41 +36,15 @@ settle_ms_before_read = 0
 settle_ms_after_function_change = 500
 ```
 
-## 安全与验收边界
+## 安全边界
 
 descriptor 导入不连接仪器。factory 只通过 `DriverContext` 打开当前配置的一个 transport。
 默认测试不扫描资源、不连接仪器，也不会发送真实 SCPI。
 
-2026-07-24 已完成外置 wheel 的第三批 LAN 验收：受管安装与 healthy/load、canonical
-与短 alias 路由、20/20 DCV 有限值读取、当前功能查询、跨电压功能切换与原状态恢复、
-受管卸载后的内建 fallback，以及重装后的 canonical IDN/DCV smoke 均通过。验收未修改
-真实 `wavebench.toml`，未提交真实地址、序列号、读数或命令日志。RS-232 不属于此外置
-包边界，继续由短 alias 对应的内建实现承载。
-
-## 开发验证
-
-```bash
-python -m pytest -q packages/wavebench-rigol-dm3000/tests
-python -m ruff check packages/wavebench-rigol-dm3000
-python -m wavebench plugin package check packages/wavebench-rigol-dm3000
-python -m wavebench plugin install packages/wavebench-rigol-dm3000 --dry-run
-```
-
-真实仪器地址、序列号、读数、截图和命令日志不得提交。
-
-## 来源与许可证
-
-0.1.0 从 WaveBench 内建 DM3000/DM3058 协议实现迁移而来，保留原有 SCPI、解析与异常
-语义。插件采用 [MIT License](LICENSE)。
-
-0.2.0 增加只读当前测量 profile，不改变仪器配置。
-
-0.3.0 增加功能门控、回读和失败恢复的 DCV/ACV 档位与 DCV 输入阻抗设置，并纠正
-`range_code=0` 被误标为自动量程的问题。
+档位或阻抗写入结果不明、恢复失败或无法证明自动／手动方式恢复时，当前实例会拒绝后续配置
+写入。真实仪器地址、序列号、读数、截图和命令日志不得提交。
 
-0.4.0 增加只读触发状态、calculation 状态与已有 min/max/average 统计；不新增 trigger
-或 calculation 写入入口。
+## 开发与许可证
 
-0.5.0 增加脱敏的只读系统/接口状态快照。它只查询蜂鸣器、语言、数字格式、显示亮度、
-选件安装状态、DHCP、GPIB 地址和 RS-232 配置；不查询或输出 IDN、MAC、IP、主机名、
-域名、时钟或原始响应，也不写任何接口或前面板配置。
+日常源码开发和离线验证见仓库级 [editable 开发环境](../../doc/DEVELOPMENT.md)。本插件采用
+[MIT License](LICENSE)。
diff --git a/packages/wavebench-rigol-dm3000/README_EN.md b/packages/wavebench-rigol-dm3000/README_EN.md
index 5c756a0..b4cadd6 100644
--- a/packages/wavebench-rigol-dm3000/README_EN.md
+++ b/packages/wavebench-rigol-dm3000/README_EN.md
@@ -1,76 +1,28 @@
 # WaveBench RIGOL DM3000 Plugin
 
+[中文](README.md)
+
 Executable WaveBench driver plugin for RIGOL DM3000/DM3058 digital multimeters. This
 package supports LAN/VXI-11 connections through PyVISA only.
 
-## Identity and migration boundary
-
-- Distribution: `wavebench-rigol-dm3000`
-- Canonical driver ID: `rigol.dm3000`
-- WaveBench: `>=0.8.11,<0.9`
-- Python: `>=3.11`
-- Transport backend: `pyvisa` (LAN only)
-- VISA resource scheme: `TCPIP`; `ASRL`, `USB`, and `GPIB` are rejected
-
-This package targets WaveBench `v0.8.11` and does not automatically claim compatibility with a future `0.9` core.
-
-The plugin declares no aliases. When installed, the canonical ID selects this external LAN
-implementation. The short aliases `dm3000` and `dm3058` keep resolving to WaveBench's built-in
-fallback with both serial and PyVISA support. Removing the plugin restores the built-in
-implementation for the canonical ID as well.
-
-An explicit serial backend is rejected for the external canonical driver. A non-TCPIP VISA
-resource such as `ASRL`, `USB`, or `GPIB` is also rejected for `lan`, `visa`, and `pyvisa`
-backends before any transport opens. Use a short alias when the built-in RS-232 path is required.
-
-## Capabilities
-
-- `dmm.idn`
-- `dmm.read`
-- `dmm.function_status`
-- `dmm.set_function`
-- `dmm.measurement_profile`
-- `dmm.trigger_status`
-- `dmm.calculation_status`
-- `dmm.calculation_statistics`
-- `dmm.system_interface_status`
-- `dmm.set_voltage_range`
-- `dmm.set_dcv_impedance`
+## Start here
 
-`wavebench dmm profile` does not switch function, write range, or consume the error queue. In the
-DM3000 command set, range code `0` is the smallest range, not autorange. The instrument exposes no
-matching query for automatic-versus-manual measurement mode, so `auto_range=n/a`. Continuity and
-diode report `n/a` for range fields because no accepted range query is available for those modes.
+- [Find the current version, compatibility range, models, and capabilities](../../doc/reference/plugin-catalog-en.md)
+- [Read the current feature-coverage matrix](doc/DM3000_COVERAGE_MATRIX_EN.md)
+- [Review development milestones and hardware evidence](doc/DM3000_COVERAGE_MILESTONES_EN.md)
+- [Install and manage WaveBench plugins](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-The setters do not switch function implicitly. Voltage range accepts codes `0..4` only for the
-already-active DCV or ACV function. DCV impedance accepts `10M` or `10G`, with `10G` limited to
-range codes `0..2`. Both setters read before write and verify readback. A failed range transaction
-latches configuration writes even when its range is restored, because any range write forces
-manual measurement mode and the prior automatic/manual mode cannot be queried. An ambiguous first
-write or failed restoration also latches the instance.
+## Connection and capability boundary
 
-M4 queries do not switch function, enable or clear a calculation, or fire a trigger. The statistics
-CLI requires `--calculation-active-confirmed`, and the driver independently verifies that the
-currently active calculation matches the requested `average`, `min`, or `max`. The CLI commands are
-`wavebench dmm trigger status`, `wavebench dmm calculation status`, and
-`wavebench dmm calculation statistics average|min|max --calculation-active-confirmed`.
+The explicit `rigol.dm3000` ID selects this external LAN-only implementation. The short `dm3000`
+and `dm3058` aliases continue to select the Core fallback with its RS-232 route. Before opening a
+transport, the canonical driver rejects a serial backend and non-TCPIP resources such as ASRL, USB,
+or GPIB.
 
-The M5 command `wavebench dmm system-interface status` emits only eleven allowlisted fields. Any
-missing, unknown, or out-of-range response fails the whole snapshot without partial output. The
-path sends no writes, `*CLS`, or error-queue queries.
-
-The package reuses WaveBench's public `DmmReading`, `DmmDriver`, and `DmmService` contracts. It
-contains only the vendor protocol implementation and its descriptor.
-
-See the [DM3000 coverage matrix](doc/DM3000_COVERAGE_MATRIX_EN.md) for the vendor-manual command
-domains, the eleven current capabilities, per-measurement offline/hardware evidence, and commands
-denied by default. The local vendor manual is under ignored `doc/vendor-local/` and is excluded
-from release packages.
-
-See the [DM3000 feature-coverage milestones](doc/DM3000_COVERAGE_MILESTONES_EN.md) for the staged
-implementation plan, exact hardware command surface, protocol-acceptance rules, and the accepted,
-failed, and skipped boundaries from 2026-07-26. Diagnostic probes are not public capabilities and
-do not establish measurement accuracy or calibration acceptance.
+The implementation covers common readings, measurement function and profile operations, read-only
+trigger/calculation/system-interface status, and constrained function, DCV/ACV range, and DCV input-
+impedance writes. The production descriptor and coverage matrix are authoritative for exact
+capabilities, parameter limits, and rejection behavior.
 
 ## Example
 
@@ -86,29 +38,12 @@ settle_ms_before_read = 0
 settle_ms_after_function_change = 500
 ```
 
-Descriptor import performs no instrument I/O. Offline tests do not discover resources or send
-SCPI. Do not commit real addresses, serial numbers, readings, screenshots, or command logs.
-
-The external wheel completed controlled LAN acceptance on 2026-07-24: managed install and
-healthy/load checks, canonical-versus-alias routing, 20/20 finite DCV reads, function-status
-query, a reversible cross-voltage-function switch with state restoration, managed removal with
-built-in fallback, and a final canonical IDN/DCV smoke test after reinstall all passed. The
-acceptance did not modify the real `wavebench.toml` and did not retain real addresses, serial
-numbers, readings, or command logs. RS-232 remains outside this package and is available through
-the built-in short-alias path.
-
-Version 0.1.0 was migrated from WaveBench's built-in DM3000/DM3058 implementation and preserves
-its SCPI, parsing, and error semantics. This package is licensed under the [MIT License](LICENSE).
-
-Version 0.2.0 adds the query-only current measurement profile without changing instrument state.
-
-Version 0.3.0 adds function-gated, readback-verified DCV/ACV range and DCV impedance setters and
-corrects the earlier mislabeling of range code `0` as autorange.
+Descriptor import performs no instrument I/O, and offline tests do not discover resources or send
+SCPI. An ambiguous range or impedance write, failed restoration, or inability to prove restoration
+of automatic/manual mode latches later configuration writes off for the current instance. Never
+commit real addresses, serial numbers, readings, screenshots, or command logs.
 
-Version 0.4.0 adds query-only trigger status, calculation status, and existing
-min/max/average statistics; it introduces no trigger or calculation write path.
+## Development and license
 
-Version 0.5.0 adds a redacted query-only system/interface status snapshot. It reads only beeper,
-language, numeric-format, brightness, option-presence, DHCP, GPIB-address, and RS-232 settings. It
-does not query or print IDN, MAC, IP, hostname, domain, clock, or raw responses, and performs no
-interface or front-panel configuration writes.
+Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md) for source
+work and offline checks. This plugin is licensed under the [MIT License](LICENSE).
diff --git a/packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MATRIX.md b/packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MATRIX.md
index 3f4da72..037f64c 100644
--- a/packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MATRIX.md
+++ b/packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MATRIX.md
@@ -2,81 +2,54 @@
 
 [English](DM3000_COVERAGE_MATRIX_EN.md)
 
-实机协议验收命令清单、通过/失败证据和后续实施顺序见
-[DM3000 功能覆盖里程碑](DM3000_COVERAGE_MILESTONES.md)。诊断探针用于筛选后续功能，
-不等同于当前插件已经公开相应 capability。
-
-## 目的、范围与统计口径
-
-本矩阵将本地保存的 RIGOL DM3000 中文编程手册与外置
-`wavebench-rigol-dm3000` 插件的公开 capability、实际 SCPI、离线测试和已记录的
-DM3058 LAN 实机证据逐项对照。它回答“手册提供了什么”“插件实际公开了什么”和
-“每项结论有什么级别的证据”，不把手册中存在一条命令、Python 方法存在或一次相邻功能
-验收自动等同于完整功能覆盖。
-
-审计输入为文档编号 `PGC01010-1110` 的 DM3000 系列编程手册。当前 Markdown 转录为
-4,017 行，位于本包被 Git 忽略的 `doc/vendor-local/`；该目录不进入提交、wheel 或
-sdist。手册封面列出 DM3061/2/3/4 与 DM3051/2/3/4，没有单独点名实机 DM3058。
-因此，本矩阵把手册作为 DM3000 系列协议资料，而 DM3058 兼容性只按当前代码、真实固件
-回包和已记录的实机证据认定，不能把整本手册无条件外推到 DM3058。
-
-手册第 2 章将 RIGOL 命令分为常用、功能、测量、精度、系统、应用/接口、触发、运算、
-数据采集和巡检十个域；第 3 章另列 Agilent 与 Fluke 兼容命令集。转录中存在缺失标题、
-命令名断裂和明显复制错误，例如 RS-232 parity 小节重复了 baud 命令。因此，本矩阵按
-可审计的功能域和公开 capability 报告状态，不用标题数量计算伪精确的完成百分比。
-
-当前外置插件版本为 `0.5.0`，声明十一项 capability：`dmm.idn`、`dmm.read`、
-`dmm.function_status`、`dmm.set_function`、只读 `dmm.measurement_profile`、
-`dmm.trigger_status`、`dmm.calculation_status`、`dmm.calculation_statistics`、
-只读脱敏 `dmm.system_interface_status`、`dmm.set_voltage_range` 和
-`dmm.set_dcv_impedance`。它是经配置的
-TCPIP/PyVISA LAN 窄驱动，
-不是通用 DM3000 SCPI shell，也不公开 error-queue、reset、trigger/calculation 控制写入、
-datalog、scan 或接口配置入口。短 alias `dm3000` / `dm3058` 仍指向 WaveBench 内建 fallback；
-其 serial 支持不能计作此外置包的 transport 覆盖。
-
-覆盖标签：
-
-- **外置实机通过**：当前外置插件、离线实现和受控 DM3058 LAN 实机证据均存在。
-- **已实现 / 离线验证**：代码和针对性 FakeTransport 测试存在，但没有该细项的外置实机结论。
-- **已实现 / 离线部分验证**：代码路径存在，但测试只精确断言了该命令族的一部分。
-- **未覆盖**：手册有命令，但当前公开插件没有相应 capability 或方法。
-- **默认拒绝**：命令会切换协议、重置仪器、改变连接、写持久状态或启动复杂采集，不应由普通工作流暴露。
-- **资料不确定**：转录或手册本身存在明显歧义，不能在无额外资料和实机证据时实现。
-
-## 功能覆盖矩阵
-
-| 功能域 | 手册命令面 | 当前公开覆盖 | 证据状态 | 主要缺口与安全边界 | 建议 |
-|---|---|---|---|---|---|
-| 身份查询 | `*IDN?` | `dmm.idn` 直接查询并返回原始字符串 | **外置实机通过**：迁移验收和重装后 smoke 均有 DM3058 IDN 证据；精确单查询有离线测试 | 不解析型号、序列号或固件为结构化字段；公开文档不保存真实值 | 保持窄查询；如需结构化 identity，先定义脱敏 artifact |
-| 整机复位 | `*RST` | 未公开 | **默认拒绝** | 恢复出厂默认值，会改变整机测量、触发、运算和接口相关状态 | 不纳入普通 DMM workflow；仅考虑独立维护命令与人工确认 |
-| 命令集切换 | `CMDSET RIGOL/AGILENT/FULUKE`、`CMDSET?` | 未公开 | **默认拒绝 / 资料不确定** | 会切换整台仪器的命令语法；手册还同时出现 `FULUKE` 与 `FLUKE` 拼写 | 插件固定使用 RIGOL 命令集；不得用 raw SCPI 绕过 |
-| 当前测量功能 | `:FUNCtion?` | `dmm.function_status`；规范化长返回符号及实机观察到的 `RES`、`2WR`、`4WR`、`FREQ`、`PERI`、`CONT`、`CAP` 等短符号 | **外置实机通过**；短符号解析有选择性离线测试 | 当前 parser 不接受手册中的 `RATIO`；未知回包明确抛 `DataError` | 扩展新模式前先取得真实回包，并增加逐项 parser 测试 |
-| 基础功能选择 | `:FUNCtion:VOLTage:DC/AC`、`CURRent:DC/AC`、`RESistance`、`FRESistance`、`FREQuency`、`PERiod`、`CONTinuity`、`DIODe`、`CAPacitance` | `dmm.set_function` 支持上述 11 类，写入后用 `:FUNCtion?` 回读 | **离线与 DM3058 开放探针通过**：11 类均完成目标功能回读、有限读数和逐次恢复 DCV | 不设置量程、分辨率、触发或等待稳定；开放探针不证明接线、单位语义或准确度 | M1 完成；准确度和专用接线另行验收 |
-| 直流电压比率功能 | `:FUNCtion:VOLTage:DC:RATIO`、`:MEASure:VOLTage:DC:RATIO?` | 未公开，`RATIO` 状态也未被 parser 接受 | **未覆盖** | 需要两路输入，结果无普通单位；不能塞入现有单值功能映射而不定义输入和返回语义 | 单独设计 ratio capability 后再考虑 |
-| 11 类标量读数 | `:MEASure:VOLTage:DC/AC?`、`CURRent:DC/AC?`、`RESistance?`、`FRESistance?`、`FREQuency?`、`PERiod?`、`CONTinuity?`、`DIODe?`、`CAPacitance?` | `dmm.read` 返回公共 `DmmReading(function, value, unit, raw)` | **离线与 DM3058 开放探针通过**：11 条 query 均返回有限值；DCV 另有 20/20 重复读取证据 | `read(function=...)` 只发送查询，不先切换功能；有限回包不等于测量准确度，且 parser 已拒绝 `NaN`/`inf` | 保持“先确认/设置功能”的前置条件；准确度另行验收 |
-| 自动/手动测量方式 | `:MEASure AUTO|MANU`、`:MEASure?` | 未公开 | **未覆盖** | 会改变连续测量行为；`MEASure?` 在本手册中表示完成状态，不是读数 | 仅在明确 acquisition state model 后实现 |
-| 量程与测量方式 | 各功能的 `:MEASure:<function> <range>`、`:RANGe?`，以及无对应状态 query 的 `:MEASure AUTO|MANU` | profile 只读离散 `range_code`，`auto_range` 明确 unavailable；setter 只覆盖当前已激活的 DCV/ACV 和档位码 `0..4` | **M3 外置实机通过**：当前 DM3058 的 DCV/ACV 均完成 `0 -> 1 -> 0` 写入、回读和恢复。手册明确 code `0` 是最小量程，不是自动量程 | 写量程会同时切换为手动测量，设备却没有测量方式 query；失败路径恢复档位后仍无法证明该状态恢复，因此锁停实例 | 协议与恢复已验收；测量准确度另行验证 |
-| 输入阻抗、交流滤波和副屏频率 | DCV `:IMPedance`、ACV `:FILTer`、ACV/ACI `:FREQ:*` | profile 只读 DCV 阻抗；setter 设置 `10M/10G`，且 `10G` 只允许 range code `0..2` | **M3 外置实机通过**：当前 DM3058 完成 `10M -> 10G -> 10M` 写入、回读和恢复；`10G` 下的档位 3 请求在写前拒绝。ACV filter/frequency 查询无响应 | setter 不切功能或档位；首写不明、读回或恢复失败锁停实例 | 协议、约束与最终安全状态已验收；不加入无响应字段 |
-| 显示位数 | 各功能 `:DIGit?` / `:DIGit INC|DEC|5|6|7` | 未公开 | **未覆盖；当前 DM3058 无响应**：DCV/ACV/FREQ/PERIOD 的 query 均未得到完整响应 | 改显示位数不等于改变采样精度，不能与 resolution 混为同一 capability | 除非有不同固件证据和明确价值，否则保持未实现 |
-| 测量精度 | `:RESolution:*` 八个功能族 | 未公开 | **未覆盖；当前 DM3058 无响应**：本轮 DCV/ACV query 未得到完整响应 | 手册用离散 0/1/2 表示 4½/5½/6½ 位；型号能力可能不同 | 不从手册外推 DM3058；等待不同固件或型号证据 |
-| 系统诊断查询 | `:SYSTem:SCANSerial?`、`MACAddr?`、`LANSerial?`、`OPENtimes?` | `dmm.system_interface_status` 只将 `SCANserial?`/`LANserial?` 严格解析为 installed/none 布尔状态 | **M5 外置实机通过**：0.5.0 完整快照 11/11 query 可解析、零写入；选件状态均为未安装 | 永不发送或保存 MAC、`OPENtimes?`、raw IDN/响应；字段名明确为选件安装状态而非序列号 | 保持严格枚举和全有或全无快照；敏感标识继续排除 |
-| 蜂鸣器、语言、时钟和显示 | `:SYSTem:BEEPer*`、`LANGuage`、`CLOCk:*`、`DISPlay:*`、`FORMat:*` | `dmm.system_interface_status` 只读蜂鸣器状态、语言、小数点/分隔符与亮度 | **M5 外置实机通过**：0.5.0 完整快照零写入返回可解析的状态；时钟和对比度仍未查询/无支持证据 | 改小数点/分隔符可能破坏解析；公开 API 不发送任何写入，未知枚举或越界值整次失败 | 保持 query-only；语言、格式、时钟和显示写入继续拒绝 |
-| 上电与系统默认 | `:SYSTem:CONFigure:POWeron`、`:SYSTem:CONFigure:DEFault` | 未公开 | **默认拒绝** | 会改变持久或整机状态 | 仅限人工维护流程 |
-| LAN/GPIB/RS-232 设置 | `:UTILity:INTerface:LAN:*`、`GPIB:ADDRess`、`RS232:BAUD/PARity` | `dmm.system_interface_status` 仅只读 DHCP、GPIB 地址、RS-232 baud/parity | **M5 外置实机通过**：0.5.0 完整快照的四项接口 query 可解析，零写入 | 不查询 IP/mask/gateway/DNS/hostname/domain；修改接口会断开会话。手册 parity 小节复制错写为 baud，代码按实机证据严格接受三种枚举 | 永不经普通测量工作流写接口配置；保留资料复制错误说明 |
-| 触发系统 | `:TRIGger:SOURce`、auto interval/hold、single count/triggered、external、VMC polarity/pulsewidth | 只读 `dmm.trigger_status`，覆盖 source、auto interval/hold/sensitivity、single count、external slope、VMC polarity/pulsewidth | **已实现 / 外置实机查询通过**：八项状态可解析；0.4.0 实机只发送 query，返回 AUTO、400 ms、OFF、1、1、RISE、POS、7 ms | 会改变采样时序或产生 VMC 输出；公开 API 不执行 trigger action 或改变 source | setter 逐项独立评审；`AUTO:INTerval` setter 继续禁用 |
-| 数学函数与统计 | `:CALCulate:FUNCtion`、min/max/average/count | 只读 `dmm.calculation_status`（模式、count、dB/dBm reference）与 `dmm.calculation_statistics`（已有 min/max/average） | **已实现 / 精确离线覆盖加外置实机状态查询通过**：0.4.0 离线识别 NONE、NULL、DB、DBM、AVERAGE、MIN、MAX、TOTAL、LIMIT；当前实机状态查询为 NONE/count 0。统计路径有精确离线测试 | 统计 query 依赖已激活的运算和当前测量序列；统计 API 要求显式 caller confirmation 且再次核对仪器当前模式 | 不得隐式启用、清空或触发；当前无匹配 active calculation 时不读取统计 |
-| NULL、dB、dBm 与 limit | `:CALCulate:NULL:OFFSet`、`DB[:REFerence]`、`DBM[:REFerence]`、`LIMit:*` | 未公开 | **未覆盖** | setter 改变后续读数语义；参考值和单位依赖当前测量功能 | 只作为独立、可快照与恢复的 calculation profile |
-| Datalog 配置与状态 | `:DATAlog?`、`CONFigure:*`、`RUN`、`STOP` | 未公开 | **M7 已审计并阻塞；默认拒绝写入；当前 DM3058 查询无响应** | 本轮状态和配置查询均未得到完整响应；启动/停止和配置还有明显状态副作用 | 等待支持设备和可靠只读状态，再讨论有上限、超时、停止和恢复的采集 |
-| Datalog 二进制读取 | `:DATAlog:FETCHdata <packet>` | 未公开 | **未覆盖 / 资料不确定** | 每包 512 个 32-bit 数据，手册要求厂商驱动/DLL 转换且需结合配置判断有效点数；不是普通 ASCII query | 在确认端序、数据格式和无 DLL 解码方法前不实现 |
-| 巡检板与工程 | `:SCAN:*`，包括 task/project/run/fetch/save/load/delete/cardID | 未公开 | **M7 已审计并阻塞；默认拒绝；当前设备明确无巡检板且查询无响应** | 创建、保存、加载、删除工程有持久副作用，run/stop 控制多通道采集 | 等待带选件设备，再以 `SCANSerial?`/`cardID?` 门控独立 capability |
-| Agilent 兼容命令集 | `CALCulate`、`CONFigure`、`SENSe`、`TRIGger`、`DATA`、`MEMory` 等兼容 SCPI | 未公开 | **默认拒绝** | 需先全局切换 `CMDSET AGILENT`；不同语法不能与当前 RIGOL driver 混用 | 不作为“免费别名”计入覆盖；若支持应是独立 driver/profile |
-| Fluke 兼容命令集 | `VDC`、`VAC`、`ADC`、`AAC`、`OHMS`、`MEAS?` 等 | 未公开 | **默认拒绝** | 同样需要切换整机命令集；短命令语义和返回格式不同 | 不混入当前 capability |
+本页将 DM3000 编程手册的功能域映射到外置 `wavebench-rigol-dm3000` 插件当前公开的
+WaveBench capability 和 SCPI 表面。当前包版本、依赖和入口点以 [包元数据](../pyproject.toml)
+为准，型号、transport、配置字段和 capability 以
+[production descriptor](../src/wavebench_rigol_dm3000/descriptor.py) 为准，精确命令、解析和
+事务行为以 [driver](../src/wavebench_rigol_dm3000/driver.py) 为准。
+
+[功能覆盖里程碑](DM3000_COVERAGE_MILESTONES.md)记录诊断探针、实机协议验收、开发顺序和
+退出门。该页面用于追溯，不会独立增加当前 capability。手册或本矩阵出现一条命令，也不表示
+production descriptor 已经公开对应能力。
+
+## 范围
+
+审计输入为文档编号 `PGC01010-1110` 的 DM3000 系列编程手册。手册封面列出
+DM3061/2/3/4 与 DM3051/2/3/4，没有单独列出 DM3058，因此手册不能作为 DM3058
+兼容性的唯一依据。本地转录只用于内部审计，位于 Git 忽略且不进入 wheel／sdist 的
+`doc/vendor-local/`。
+
+本矩阵按功能域说明当前覆盖，不用转录标题或 set/query 变体计算完成率。外置插件是经配置的
+TCPIP／PyVISA 窄驱动，不是通用 DM3000 SCPI shell。短 alias `dm3000` / `dm3058`
+仍指向 Core 内建 fallback；其 serial 支持不属于此外置包的 transport 覆盖。
+
+## 功能覆盖
+
+| 功能域 | 手册命令面 | 当前公开覆盖 | 当前边界 |
+|---|---|---|---|
+| 身份 | `*IDN?` | `dmm.idn` | 返回原始字符串；不把型号、序列号或固件解析为公开结构化字段。 |
+| 整机复位 | `*RST` | 未公开 | 会改变测量、触发、运算和全局状态，默认拒绝。 |
+| 命令集切换 | `CMDSET RIGOL/AGILENT/FULUKE`、`CMDSET?` | 未公开 | 会改变整机命令语法；插件固定使用 RIGOL 命令集。手册还存在 `FULUKE`／`FLUKE` 拼写歧义。 |
+| 当前测量功能 | `:FUNCtion?` | `dmm.function_status` | 只接受明确支持的长／短符号；未知回包抛出 `DataError`，`RATIO` 不在当前映射中。 |
+| 基础功能选择 | DCV、ACV、DCI、ACI、RES、FRES、FREQ、PERIOD、CONT、DIODE、CAP | `dmm.set_function` | 写入后用 `:FUNCtion?` 回读；不设置量程、分辨率、触发或等待稳定。 |
+| 直流电压比率 | `:FUNCtion:VOLTage:DC:RATIO`、`:MEASure:VOLTage:DC:RATIO?` | 未公开 | 需要双输入和独立结果语义，不能塞入普通单值映射。 |
+| 11 类标量读数 | 各功能的 `:MEASure:<function>?` | `dmm.read` | 只发送目标 query，不先切换功能；非有限数会被拒绝，有限回包不代表测量准确度。 |
+| 自动／手动测量 | `:MEASure AUTO|MANU`、`:MEASure?` | 未公开 | 会改变连续测量行为；本手册中的 `:MEASure?` 表示完成状态，不是读数。 |
+| 量程 | 各功能的 `:RANGe?` 和 `:MEASure:<function> <range>` | `dmm.measurement_profile` 只读离散 `range_code`；`dmm.set_voltage_range` 只覆盖当前 DCV／ACV 和代码 `0..4` | 写量程会切到手动模式，但设备没有对应模式 query。写入失败后即使量程恢复，也会锁停当前实例。 |
+| 输入阻抗、AC filter 与副屏频率 | DCV `:IMPedance`、ACV `:FILTer`、ACV／ACI `:FREQ:*` | profile 只读 DCV 阻抗；`dmm.set_dcv_impedance` 设置 `10M/10G` | setter 不切换功能或量程；`10G` 只允许 range code `0..2`。AC filter／frequency 字段未公开。 |
+| 显示位数与测量精度 | `:DIGit*`、`:RESolution:*` | 未公开 | 显示位数不等于采集分辨率；型号与固件语义不足，不能从手册外推。 |
+| 系统与接口只读状态 | beeper、language、format、brightness、option serial、DHCP、GPIB、RS-232 | `dmm.system_interface_status` | 全有或全无的脱敏只读快照；不读取 MAC、IP、hostname、clock、raw IDN 或原始响应，也不发送配置写入。 |
+| 上电、默认值与接口配置 | power-on/default、LAN/GPIB/RS-232 写入 | 未公开 | 会改变持久状态或断开当前 session，默认拒绝。 |
+| 触发系统 | source、auto interval/hold、single count、external、VMC | `dmm.trigger_status` | 只读现有状态；不执行 trigger，也不改变 source 或产生 VMC 输出。 |
+| 运算与统计 | mode、count、min/max/average、dB/dBm reference | `dmm.calculation_status`、`dmm.calculation_statistics` | 统计读取要求调用方明确确认，并再次核对当前运算模式；不会隐式启用、清空或触发。NULL／dB／dBm／limit setter 未公开。 |
+| Datalog | status、configure、run/stop、binary fetch | 未公开 | 当前没有可靠状态和二进制格式合同；启动、停止和配置还会改变采集状态。 |
+| 巡检板与工程 | `:SCAN:*` | 未公开 | 依赖选件，并包含工程保存／加载／删除和多通道运行副作用。 |
+| Agilent／Fluke 兼容命令集 | 兼容 SCPI 与短命令 | 未公开 | 需要全局切换命令集，不能作为当前 RIGOL driver 的免费 alias。 |
 
 ## 当前直接使用的 SCPI 表面
 
-以下是当前外置插件源码实际可能发送的全部仪器命令，按实现拼写列出。它不是原始通信
-日志，也不表示每条命令都完成了实机验收。
+以下是当前外置插件源码可能发送的仪器命令。它不是原始通信日志，也不表示每条命令都单独
+完成了实机验收。
 
 ```text
 *IDN?
@@ -150,67 +123,36 @@ datalog、scan 或接口配置入口。短 alias `dm3000` / `dm3058` 仍指向 W
 :UTILity:INTerface:RS232:PARity?
 ```
 
-实现不会发送 `*RST`、`CMDSET`、resolution、trigger/calculation 写入、datalog、scan、
-interface 或 error-queue 命令，也没有通用 raw-SCPI 入口。`dmm.set_function` 的完整事务
-是“一条功能选择写入 + 一条 `:FUNCtion?` 回读”；`dmm.read` 则只有一条测量 query。
-
-## 逐测量类型证据
-
-| 公共 function | 功能选择 | 读数 query | 单位 | 离线证据 | 外置实机证据 |
-|---|---|---|---|---|---|
-| `dcv` / `vdc` | `:FUNCtion:VOLTage:DC` | `:MEASure:VOLTage:DC?` | V | query 与单位精确测试；selector 映射存在 | **20/20 有限值读取通过**；参与可恢复跨电压切换 |
-| `acv` / `vac` | `:FUNCtion:VOLTage:AC` | `:MEASure:VOLTage:AC?` | V | query/单位及 ACV selector 精确测试 | 可恢复功能切换、有限读数、量程切换和恢复通过；不代表准确度验收 |
-| `dci` / `idc` | `:FUNCtion:CURRent:DC` | `:MEASure:CURRent:DC?` | A | query、单位和 selector 精确测试 | 开放探针通过；不代表准确度验收 |
-| `aci` / `iac` | `:FUNCtion:CURRent:AC` | `:MEASure:CURRent:AC?` | A | query、单位和 selector 精确测试 | 开放探针通过；不代表准确度验收 |
-| `res` / `ohm` / `2wr` | `:FUNCtion:RESistance` | `:MEASure:RESistance?` | ohm | query、单位、selector 及状态解析测试 | 开放探针通过；不代表准确度验收 |
-| `fres` / `4wr` | `:FUNCtion:FRESistance` | `:MEASure:FRESistance?` | ohm | query、单位、selector 及状态解析测试 | 开放探针通过；不代表准确度验收 |
-| `freq` | `:FUNCtion:FREQuency` | `:MEASure:FREQuency?` | Hz | query 与单位精确测试；短状态解析有测试 | 可恢复功能切换、有限读数和输入电压量程查询通过；不代表准确度验收 |
-| `period` | `:FUNCtion:PERiod` | `:MEASure:PERiod?` | s | query 与单位精确测试；短状态解析有测试 | 可恢复功能切换、有限读数和输入电压量程查询通过；不代表准确度验收 |
-| `continuity` / `cont` | `:FUNCtion:CONTinuity` | `:MEASure:CONTinuity?` | ohm | query、单位、selector 及状态解析测试 | 开放探针通过；不代表准确度验收 |
-| `diode` | `:FUNCtion:DIODe` | `:MEASure:DIODe?` | V | query、单位和 selector 精确测试 | 开放探针通过；不代表准确度验收 |
-| `cap` | `:FUNCtion:CAPacitance` | `:MEASure:CAPacitance?` | F | query、单位、selector 及状态解析测试 | 开放探针通过；不代表准确度验收 |
-| ratio | 未公开 | 未公开 | 未定义 | 无 | 无 |
-
-## WaveBench 提供、但不计入手册命令覆盖的保障
-
-- descriptor 在 transport 打开前限制为 `pyvisa` + `TCPIP`，并拒绝 serial、ASRL、USB
-  和 GPIB；这是插件边界，不是某条 DM3000 SCPI 的实现。
-- capability preflight、会话生命周期、读取前等待、run-plan artifact 和 `expect` 数值判断
-  由 WaveBench 核心负责，不能计作手册命令覆盖。
-- descriptor capability 校验只证明声明的方法存在且可调用，不证明 SCPI 语义、仪器回包、
-  接线正确或数值准确。
-- `set_function` 的回读能证明仪器报告了目标模式，但不证明输入端子、量程、分辨率、滤波、
-  触发和被测信号都适合下一次测量。
-
-## 推荐路线
-
-详细阶段、命令和发布门槛见[功能覆盖里程碑](DM3000_COVERAGE_MILESTONES.md)。总体顺序为：
-
-1. **M1：收紧原四项能力 — 完成。** 11 类 selector 有参数化命令测试；非有限读数被拒绝；
-   `dmm.read` 明确不隐式切换功能。可选模式一致性预检未纳入本轮范围。
-2. **M2：只读测量 profile — 完成。** 覆盖当前 function、已验收的离散 range code 和
-   DCV impedance；自动/手动方式及 CONT/DIODE 的不适用字段显式为 unavailable。
-3. **M3：受控电压端配置 — 完成。** DCV/ACV 档位和 DCV 阻抗具有
-   功能门控、逐功能参数限制、写后回读、失败恢复与实例锁存；不扩展到其他端子。
-4. **P2：已有统计与触发状态只读。** 只读取已配置的 calculate/trigger 状态，不隐式启用、
-   清空、触发或重置仪器。
-5. **P3：Datalog。** 先解决二进制格式、端序、有效点数、大小上限、超时、stop/finally 和
-   artifact；巡检板应是 option-gated 的独立能力。
-6. **默认不做：命令集切换、reset/default、网络/串口设置和 scan project 持久写入。**
-   这些操作需要与普通测量流程不同的权限和人工确认。
-
-## 证据边界
-
-- **手册侧**：本地 `vendor-local` 转录仅用于内部审计，本文不复制整本手册，也不将其打入
-  发行包。转录歧义不会被当作可靠协议事实。
-- **实现侧**：外置插件的 `driver.py`、`descriptor.py`、FakeTransport 测试以及
-  WaveBench 公共 DMM service/run-plan 契约。
-- **外置实机侧**：2026-07-24 的受管安装/路由/DCV 记录，以及 2026-07-26 的查询和
-  可恢复写入协议验收。后者覆盖 ACV/FREQ/PERIOD 有限读数、DCV/ACV 量程、DCV 阻抗、
-  trigger query、已有统计、部分系统/接口 query；完整清单见里程碑。没有保存真实地址、
-  序列号或具体读数。
-- **未验收侧**：测量准确度、DCI/ACI/电阻/通断/二极管/电容、digits/resolution、
-  Datalog、scan 和兼容命令集仍不得宣称通过；诊断探针也不等于公开 capability。
-
-只有当前外置代码、针对性离线测试、真实仪器命令接受/回读，以及必要时的原状态恢复都存在，
-某一项才可提升为“外置实机通过”。
+实现不会发送 `*RST`、`CMDSET`、resolution、trigger／calculation 写入、Datalog、scan、
+interface 或 error-queue 命令，也没有通用 raw-SCPI 入口。`dmm.set_function` 的完整事务是
+一条功能选择写入和一条 `:FUNCtion?` 回读；`dmm.read` 只发送一条测量 query。
+
+## 测量功能映射
+
+| Public function | 功能选择 | 读数 query | 单位 |
+|---|---|---|---|
+| `dcv` / `vdc` | `:FUNCtion:VOLTage:DC` | `:MEASure:VOLTage:DC?` | V |
+| `acv` / `vac` | `:FUNCtion:VOLTage:AC` | `:MEASure:VOLTage:AC?` | V |
+| `dci` / `idc` | `:FUNCtion:CURRent:DC` | `:MEASure:CURRent:DC?` | A |
+| `aci` / `iac` | `:FUNCtion:CURRent:AC` | `:MEASure:CURRent:AC?` | A |
+| `res` / `ohm` / `2wr` | `:FUNCtion:RESistance` | `:MEASure:RESistance?` | ohm |
+| `fres` / `4wr` | `:FUNCtion:FRESistance` | `:MEASure:FRESistance?` | ohm |
+| `freq` | `:FUNCtion:FREQuency` | `:MEASure:FREQuency?` | Hz |
+| `period` | `:FUNCtion:PERiod` | `:MEASure:PERiod?` | s |
+| `continuity` / `cont` | `:FUNCtion:CONTinuity` | `:MEASure:CONTinuity?` | ohm |
+| `diode` | `:FUNCtion:DIODe` | `:MEASure:DIODe?` | V |
+| `cap` | `:FUNCtion:CAPacitance` | `:MEASure:CAPacitance?` | F |
+| ratio | 未公开 | 未公开 | 未定义 |
+
+## 行为与安全边界
+
+- descriptor 在打开 transport 前拒绝非 `pyvisa`、非 `TCPIP`、serial、ASRL、USB 和 GPIB 配置。
+- `dmm.read` 不隐式切换功能；调用方需要先确认或设置当前功能。
+- 配置写入使用回读和恢复；首写结果不明、回读失败或恢复无法确认时，当前实例会锁停后续配置写入。
+- descriptor 校验和有限数解析不证明接线正确、测量准确度或整个 DM3000 系列兼容。
+
+## 相关来源
+
+- [Production descriptor](../src/wavebench_rigol_dm3000/descriptor.py)
+- [Driver implementation](../src/wavebench_rigol_dm3000/driver.py)
+- [功能覆盖里程碑与实机证据](DM3000_COVERAGE_MILESTONES.md)
diff --git a/packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MATRIX_EN.md b/packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MATRIX_EN.md
index f358588..47fcfea 100644
--- a/packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MATRIX_EN.md
+++ b/packages/wavebench-rigol-dm3000/doc/DM3000_COVERAGE_MATRIX_EN.md
@@ -2,87 +2,58 @@
 
 [中文](DM3000_COVERAGE_MATRIX.md)
 
-See the [DM3000 feature-coverage milestones](DM3000_COVERAGE_MILESTONES_EN.md) for the exact
-hardware protocol-acceptance commands, accepted/failed evidence, and staged implementation plan.
-Diagnostic probes select future work; they do not mean the plugin already exposes those
-capabilities.
-
-## Purpose, scope, and counting method
-
-This matrix compares the locally stored RIGOL DM3000 Chinese programming manual with the public
-capabilities, actual SCPI, offline tests, and recorded DM3058 LAN evidence of the external
-`wavebench-rigol-dm3000` plugin. It distinguishes commands documented by the vendor from behavior
-actually exposed and accepted by the plugin. A manual entry, Python method, or acceptance of a
-neighboring mode does not by itself establish complete feature coverage.
-
-The audit input is DM3000 programming manual `PGC01010-1110`. Its current 4,017-line Markdown
-transcription is stored in this package's Git-ignored `doc/vendor-local/` directory, which is
-excluded from commits, wheels, and sdists. The cover lists DM3061/2/3/4 and DM3051/2/3/4, but does
-not name the tested DM3058 separately. The manual is therefore treated as DM3000-family protocol
-material, while DM3058 compatibility is accepted only where current code, observed firmware
-responses, or recorded hardware evidence supports it. The complete manual is not projected onto
-DM3058 by assumption.
-
-Chapter 2 groups the RIGOL commands into ten domains: common, function, measurement, resolution,
-system, utility/interface, trigger, calculation, datalog, and scan. Chapter 3 adds Agilent- and
-Fluke-compatible command sets. The transcription contains missing headings, broken command names,
-and apparent copy errors, including an RS-232 parity section that repeats the baud command. This
-matrix therefore reports auditable functional domains and public capabilities rather than a
-misleading completion percentage based on heading counts.
-
-The current external plugin is version `0.5.0` and declares eleven capabilities: `dmm.idn`,
-`dmm.read`, `dmm.function_status`, `dmm.set_function`, query-only
-`dmm.measurement_profile`, `dmm.trigger_status`, `dmm.calculation_status`,
-`dmm.calculation_statistics`, redacted query-only `dmm.system_interface_status`,
-`dmm.set_voltage_range`, and `dmm.set_dcv_impedance`. It is a narrow TCPIP/PyVISA LAN driver
-for a configured resource, not a general DM3000 SCPI shell. It exposes no error-queue, reset,
-trigger/calculation-control write, datalog, scan, or interface-configuration path. The short aliases `dm3000` and
-`dm3058` remain bound to the bundled fallback; its serial support is not transport coverage of
-this external package.
-
-Coverage labels:
-
-- **External hardware accepted**: current external code, offline implementation, and controlled DM3058 LAN evidence exist.
-- **Implemented / offline tested**: code and focused FakeTransport tests exist, without external hardware acceptance for the detail.
-- **Implemented / partially offline tested**: a code path exists, but tests make exact assertions for only part of the command family.
-- **Not covered**: the manual documents the command, but the external plugin has no public capability or method for it.
-- **Denied by default**: the command changes the command grammar, resets the instrument, disrupts connectivity, persists state, or starts a complex acquisition and should not be exposed by ordinary workflows.
-- **Source uncertain**: the transcription or manual is visibly ambiguous and cannot support implementation without stronger material and hardware evidence.
-
-## Coverage matrix
-
-| Domain | Manual command surface | Current public coverage | Evidence | Main gap and safety boundary | Recommendation |
-|---|---|---|---|---|---|
-| Identity | `*IDN?` | `dmm.idn` returns the raw response | **External hardware accepted** in migration acceptance and post-reinstall smoke; exact single-query offline test | Model, serial, and firmware are not parsed into structured fields; real values are not retained in public docs | Keep the narrow query; define a redacted artifact before structured identity |
-| Instrument reset | `*RST` | Not public | **Denied by default** | Restores factory defaults across measurement, trigger, calculation, and related global state | Keep outside ordinary DMM workflows; consider only a maintenance command with confirmation |
-| Command-set selection | `CMDSET RIGOL/AGILENT/FULUKE`, `CMDSET?` | Not public | **Denied by default / source uncertain** | Changes the instrument-wide command grammar; the manual also uses both `FULUKE` and `FLUKE` spellings | Pin the plugin to the RIGOL set; do not bypass it with raw SCPI |
-| Current function | `:FUNCtion?` | `dmm.function_status`; normalizes long symbols and observed short DM3058 symbols such as `RES`, `2WR`, `4WR`, `FREQ`, `PERI`, `CONT`, and `CAP` | **External hardware accepted**; selected short-symbol parser cases have offline tests | The parser does not accept the manual's `RATIO`; unknown responses raise `DataError` | Require observed responses and per-item parser tests before adding modes |
-| Basic function selection | `:FUNCtion:VOLTage:DC/AC`, `CURRent:DC/AC`, `RESistance`, `FRESistance`, `FREQuency`, `PERiod`, `CONTinuity`, `DIODe`, `CAPacitance` | `dmm.set_function` supports those eleven modes and reads back `:FUNCtion?` | **Offline and DM3058 open-probe accepted:** all eleven modes completed target readback, finite response, and per-run DCV restoration | Does not set range, resolution, trigger, or settling; open-probe evidence does not prove wiring, unit semantics, or accuracy | M1 complete; accuracy and dedicated fixtures remain separate acceptance |
-| DC voltage ratio | `:FUNCtion:VOLTage:DC:RATIO`, `:MEASure:VOLTage:DC:RATIO?` | Not public; `RATIO` status is not accepted either | **Not covered** | Requires two inputs and has no ordinary physical unit; it needs explicit input and result semantics | Design a separate ratio capability first |
-| Eleven scalar readings | `:MEASure:VOLTage:DC/AC?`, `CURRent:DC/AC?`, `RESistance?`, `FRESistance?`, `FREQuency?`, `PERiod?`, `CONTinuity?`, `DIODe?`, `CAPacitance?` | `dmm.read` returns shared `DmmReading(function, value, unit, raw)` | **Offline and DM3058 open-probe accepted:** all eleven queries returned finite values; DCV also has 20/20 repeated-read evidence | `read(function=...)` sends the query only and does not select a function. A finite response is not accuracy evidence; the parser rejects `NaN`/`inf` | Keep the preselected-function requirement; validate accuracy separately |
-| Automatic/manual measurement | `:MEASure AUTO|MANU`, `:MEASure?` | Not public | **Not covered** | Changes continuous-measurement behavior; in this manual `MEASure?` reports completion rather than a reading | Implement only after an explicit acquisition-state model exists |
-| Range and measurement mode | Per-function `:MEASure:<function> <range>`, `:RANGe?`, and `:MEASure AUTO|MANU` without a matching mode query | Profile returns the discrete code with autorange unavailable; setter covers active DCV/ACV and codes `0..4` only | **M3 external hardware accepted:** the tested DM3058 completed DCV and ACV `0 -> 1 -> 0` write, readback, and restoration cycles. The manual defines code `0` as the smallest range, not autorange | A range write also forces manual mode, but that state cannot be queried; failed transactions therefore latch writes even after range restoration | Protocol and restoration are accepted; validate measurement accuracy separately |
-| Input impedance, AC filter, secondary frequency | DCV `:IMPedance`, ACV `:FILTer`, ACV/ACI `:FREQ:*` | Profile reads DCV impedance; setter controls `10M/10G`, with `10G` limited to range codes `0..2` | **M3 external hardware accepted:** the tested DM3058 completed a `10M -> 10G -> 10M` cycle; range code `3` at `10G` was rejected before writing. AC filter/frequency queries did not respond | The setter does not switch function or range; ambiguous writes and failed readback/restoration latch the instance | Protocol, constraint, and final safe state are accepted; omit nonresponding fields |
-| Display digits | Per-function `:DIGit?` and `:DIGit INC|DEC|5|6|7` | Not public | **Not covered; no response on tested DM3058** for DCV/ACV/FREQ/PERIOD queries | Display digits are not acquisition resolution and must not share one capability | Leave unimplemented without different-firmware evidence and a concrete need |
-| Measurement resolution | Eight `:RESolution:*` families | Not public | **Not covered; no response on tested DM3058** for DCV/ACV queries | Discrete values are model-dependent despite the manual's 0/1/2 table | Do not project the manual onto DM3058; wait for stronger model/firmware evidence |
-| System diagnostic queries | `:SYSTem:SCANSerial?`, `MACAddr?`, `LANSerial?`, `OPENtimes?` | `dmm.system_interface_status` parses only `SCANserial?`/`LANserial?` as strict installed/none booleans | **M5 external hardware accepted:** the complete 0.5.0 snapshot returned 11/11 parseable queries with zero writes; both options were absent | Never query or retain MAC, `OPENtimes?`, raw IDN, or raw responses; fields are option-presence booleans, not serial numbers | Keep strict enums and all-or-nothing snapshot semantics; exclude sensitive identity |
-| Beeper, language, clock, display, formatting | `:SYSTem:BEEPer*`, `LANGuage`, `CLOCk:*`, `DISPlay:*`, `FORMat:*` | `dmm.system_interface_status` reads only beeper state, language, decimal/separator format, and brightness | **M5 external hardware accepted:** the complete 0.5.0 snapshot returned parseable status with zero writes; clock and contrast remain unqueried/unsupported | Decimal/separator changes may break parsing; the public API sends no writes and rejects unknown/out-of-range responses atomically | Keep query-only; deny language, format, clock, and display writes |
-| Power-on and system defaults | `:SYSTem:CONFigure:POWeron`, `:SYSTem:CONFigure:DEFault` | Not public | **Denied by default** | Changes persistent or instrument-wide state | Maintenance workflows only |
-| LAN/GPIB/RS-232 configuration | `:UTILity:INTerface:LAN:*`, `GPIB:ADDRess`, `RS232:BAUD/PARity` | `dmm.system_interface_status` reads only DHCP, GPIB address, RS-232 baud/parity | **M5 external hardware accepted:** all four interface queries in the complete 0.5.0 snapshot parsed with zero writes | It does not query IP/mask/gateway/DNS/hostname/domain. Interface writes can sever the session. The manual parity section incorrectly repeats baud; code accepts only the three observed parity enums | Never write interface settings from ordinary measurement flows; retain the source copy-error note |
-| Trigger system | `:TRIGger:SOURce`, auto interval/hold, single count/triggered, external, VMC polarity/pulse width | Query-only `dmm.trigger_status`: source, auto interval/hold/sensitivity, single count, external slope, and VMC polarity/pulse width | **Implemented / external hardware status-query accepted:** eight fields parse; 0.4.0 sent queries only and returned AUTO, 400 ms, OFF, 1, 1, RISE, POS, and 7 ms | Changes timing or drives VMC; public API performs no trigger action or source change | Review setters individually; AUTO interval setter remains disabled |
-| Math and statistics | `:CALCulate:FUNCtion`, min/max/average/count | Query-only `dmm.calculation_status` (mode, count, dB/dBm references) and `dmm.calculation_statistics` (existing min/max/average) | **Implemented / exact offline coverage plus external hardware status-query accepted:** 0.4.0 accepts NONE, NULL, DB, DBM, AVERAGE, MIN, MAX, TOTAL, LIMIT offline; the current device status query reported NONE/count 0. Statistics have exact offline coverage | Statistics depend on active mode and series; API requires explicit caller confirmation and independently rechecks instrument mode | Never enable, clear, or trigger; do not read statistics without a matching active calculation |
-| NULL, dB, dBm, limit | `:CALCulate:NULL:OFFSet`, `DB[:REFerence]`, `DBM[:REFerence]`, `LIMit:*` | Not public | **Not covered** | Setters change the meaning of later readings; references and units depend on the active function | Expose only as an independent, snapshot-and-restore calculation profile |
-| Datalog status and configuration | `:DATAlog?`, `CONFigure:*`, `RUN`, `STOP` | Not public | **M7 audited and blocked; writes denied; current DM3058 queries did not respond** | Status/configuration queries attempted in this run returned no complete response; start/stop/configuration also have significant state | Wait for a supported device and reliable status before designing bounded controlled capture |
-| Datalog binary retrieval | `:DATAlog:FETCHdata <packet>` | Not public | **Not covered / source uncertain** | Each packet contains 512 32-bit values; the manual calls for a vendor driver/DLL and configuration-dependent valid-count extraction; it is not an ordinary ASCII query | Do not implement until byte order, value format, and DLL-free decoding are established |
-| Scan board and projects | `:SCAN:*` task/project/run/fetch/save/load/delete/cardID | Not public | **M7 audited and blocked; denied; tested device explicitly lacks the scan board and queries did not respond** | Project writes are persistent and run/stop controls multi-channel acquisition | Wait for equipped hardware, then gate a separate capability through option identity |
-| Agilent compatibility set | Compatible `CALCulate`, `CONFigure`, `SENSe`, `TRIGger`, `DATA`, `MEMory`, and related SCPI | Not public | **Denied by default** | Requires instrument-wide `CMDSET AGILENT`; its grammar cannot be mixed into the RIGOL driver | Do not count as free aliases; a future implementation should be a separate driver/profile |
-| Fluke compatibility set | `VDC`, `VAC`, `ADC`, `AAC`, `OHMS`, `MEAS?`, and related short commands | Not public | **Denied by default** | Also requires command-set switching, with different short-command semantics and responses | Do not mix into the current capabilities |
+This page maps DM3000 programming-manual domains to the WaveBench capabilities and SCPI surface
+currently exposed by the external `wavebench-rigol-dm3000` plugin. The
+[package metadata](../pyproject.toml) is authoritative for version, dependencies, and entry point;
+the [production descriptor](../src/wavebench_rigol_dm3000/descriptor.py) for models, transport,
+configuration fields, and capabilities; and the [driver](../src/wavebench_rigol_dm3000/driver.py)
+for exact commands, parsing, and transaction behavior.
+
+The [coverage milestones](DM3000_COVERAGE_MILESTONES_EN.md) record diagnostic probes, hardware
+protocol acceptance, implementation order, and exit gates. That historical/development record does
+not independently add a current capability. A command appearing in the manual or this matrix is not
+public unless the production descriptor declares the corresponding capability.
+
+## Scope
+
+The audit source is DM3000 family programming manual `PGC01010-1110`. Its cover lists
+DM3061/2/3/4 and DM3051/2/3/4 but does not identify DM3058 separately, so the manual is not by
+itself proof of DM3058 compatibility. The local transcription is for internal audit only and lives
+under the Git-ignored, wheel/sdist-excluded `doc/vendor-local/` directory.
+
+This matrix reports current coverage by functional domain rather than counting transcription
+headings or set/query variants. The external plugin is a configured TCPIP/PyVISA driver, not a
+general DM3000 SCPI shell. The short aliases `dm3000` / `dm3058` still select the Core-bundled
+fallback; its serial support is not transport coverage of this external package.
+
+## Functional coverage
+
+| Domain | Manual command surface | Current public coverage | Current boundary |
+|---|---|---|---|
+| Identity | `*IDN?` | `dmm.idn` | Returns the raw string; model, serial, and firmware are not exposed as structured fields. |
+| Instrument reset | `*RST` | Not public | Changes measurement, trigger, calculation, and global state; denied by default. |
+| Command-set selection | `CMDSET RIGOL/AGILENT/FULUKE`, `CMDSET?` | Not public | Changes the instrument-wide grammar. The plugin is fixed to the RIGOL set, and the manual also contains `FULUKE`/`FLUKE` ambiguity. |
+| Current function | `:FUNCtion?` | `dmm.function_status` | Accepts only explicitly supported long/short symbols. Unknown responses raise `DataError`; `RATIO` is not in the current mapping. |
+| Basic function selection | DCV, ACV, DCI, ACI, RES, FRES, FREQ, PERIOD, CONT, DIODE, CAP | `dmm.set_function` | Reads back `:FUNCtion?`; does not set range, resolution, trigger, or settling. |
+| DC voltage ratio | `:FUNCtion:VOLTage:DC:RATIO`, `:MEASure:VOLTage:DC:RATIO?` | Not public | Requires two inputs and independent result semantics; it cannot be represented as an ordinary scalar mapping. |
+| Eleven scalar readings | Per-function `:MEASure:<function>?` | `dmm.read` | Sends only the target query and does not select a function. Nonfinite values are rejected; a finite response is not measurement-accuracy evidence. |
+| Automatic/manual measurement | `:MEASure AUTO|MANU`, `:MEASure?` | Not public | Changes continuous measurement. In this manual, `:MEASure?` reports completion rather than a reading. |
+| Range | Per-function `:RANGe?` and `:MEASure:<function> <range>` | `dmm.measurement_profile` reads discrete `range_code`; `dmm.set_voltage_range` covers active DCV/ACV and codes `0..4` | A range write forces manual mode, but the device has no matching mode query. A failed transaction latches the instance even if range restoration succeeds. |
+| Input impedance, AC filter, secondary frequency | DCV `:IMPedance`, ACV `:FILTer`, ACV/ACI `:FREQ:*` | The profile reads DCV impedance; `dmm.set_dcv_impedance` writes `10M/10G` | The setter changes neither function nor range; `10G` is allowed only for range codes `0..2`. AC filter/frequency fields are not public. |
+| Display digits and measurement resolution | `:DIGit*`, `:RESolution:*` | Not public | Display digits are not acquisition resolution, and model/firmware semantics are insufficient for extrapolation from the manual. |
+| Query-only system/interface state | beeper, language, format, brightness, option serial, DHCP, GPIB, RS-232 | `dmm.system_interface_status` | Redacted, all-or-nothing snapshot. It does not read MAC, IP, hostname, clock, raw IDN, or raw responses and sends no configuration writes. |
+| Power-on/default and interface configuration | power-on/default, LAN/GPIB/RS-232 writes | Not public | May mutate persistent state or sever the current session; denied by default. |
+| Trigger system | source, auto interval/hold, single count, external, VMC | `dmm.trigger_status` | Reads existing state only. It does not trigger, change the source, or drive VMC output. |
+| Calculation and statistics | mode, count, min/max/average, dB/dBm reference | `dmm.calculation_status`, `dmm.calculation_statistics` | Statistics require explicit caller confirmation and rechecking the active mode. The driver never enables, clears, or triggers implicitly. NULL/dB/dBm/limit setters are not public. |
+| Datalog | status, configure, run/stop, binary fetch | Not public | No reliable state or binary-format contract exists; start, stop, and configuration also mutate acquisition state. |
+| Scan board and projects | `:SCAN:*` | Not public | Option-dependent and includes persistent project plus multi-channel run side effects. |
+| Agilent/Fluke compatibility sets | compatible SCPI and short commands | Not public | Require instrument-wide command-set switching and are not free aliases for the RIGOL driver. |
 
 ## Directly used SCPI surface
 
-The list below is the complete instrument-command surface that current external-plugin source can
-send, shown with the implementation's spelling. It is not a communication log and does not claim
-hardware acceptance for every command.
+The list below is the complete instrument-command surface that current external-plugin source may
+send. It is not a communication log and does not claim separate hardware acceptance for every
+command.
 
 ```text
 *IDN?
@@ -156,76 +127,40 @@ hardware acceptance for every command.
 :UTILity:INTerface:RS232:PARity?
 ```
 
-The implementation sends no `*RST`, `CMDSET`, resolution, trigger/calculation write, datalog,
+The implementation sends no `*RST`, `CMDSET`, resolution, trigger/calculation write, Datalog,
 scan, interface, or error-queue command and has no generic raw-SCPI path. A complete
-`dmm.set_function` transaction is one function-selection write followed by one `:FUNCtion?`
-readback. A `dmm.read` operation is one measurement query only.
-
-## Per-measurement evidence
-
-| Public function | Function selection | Reading query | Unit | Offline evidence | External hardware evidence |
-|---|---|---|---|---|---|
-| `dcv` / `vdc` | `:FUNCtion:VOLTage:DC` | `:MEASure:VOLTage:DC?` | V | Exact query/unit test; selector mapping exists | **20/20 finite reads passed**; included in reversible cross-voltage switching |
-| `acv` / `vac` | `:FUNCtion:VOLTage:AC` | `:MEASure:VOLTage:AC?` | V | Exact query/unit and exact ACV selector test | Reversible selection, finite reading, range switch, and restoration passed; not accuracy acceptance |
-| `dci` / `idc` | `:FUNCtion:CURRent:DC` | `:MEASure:CURRent:DC?` | A | Exact query/unit/selector tests | Open-probe accepted; not accuracy acceptance |
-| `aci` / `iac` | `:FUNCtion:CURRent:AC` | `:MEASure:CURRent:AC?` | A | Exact query/unit/selector tests | Open-probe accepted; not accuracy acceptance |
-| `res` / `ohm` / `2wr` | `:FUNCtion:RESistance` | `:MEASure:RESistance?` | ohm | Exact query/unit/selector and status-parser tests | Open-probe accepted; not accuracy acceptance |
-| `fres` / `4wr` | `:FUNCtion:FRESistance` | `:MEASure:FRESistance?` | ohm | Exact query/unit/selector and status-parser tests | Open-probe accepted; not accuracy acceptance |
-| `freq` | `:FUNCtion:FREQuency` | `:MEASure:FREQuency?` | Hz | Exact query/unit and short-status tests | Reversible selection, finite reading, and input-voltage range query passed; not accuracy acceptance |
-| `period` | `:FUNCtion:PERiod` | `:MEASure:PERiod?` | s | Exact query/unit and short-status tests | Reversible selection, finite reading, and input-voltage range query passed; not accuracy acceptance |
-| `continuity` / `cont` | `:FUNCtion:CONTinuity` | `:MEASure:CONTinuity?` | ohm | Exact query/unit/selector and status-parser tests | Open-probe accepted; not accuracy acceptance |
-| `diode` | `:FUNCtion:DIODe` | `:MEASure:DIODe?` | V | Exact query/unit/selector tests | Open-probe accepted; not accuracy acceptance |
-| `cap` | `:FUNCtion:CAPacitance` | `:MEASure:CAPacitance?` | F | Exact query/unit/selector and status-parser tests | Open-probe accepted; not accuracy acceptance |
-| ratio | Not public | Not public | Undefined | None | None |
-
-## WaveBench safeguards outside manual-command coverage
+`dmm.set_function` transaction is one selection write plus one `:FUNCtion?` readback;
+`dmm.read` sends one measurement query only.
+
+## Measurement function mapping
+
+| Public function | Function selection | Reading query | Unit |
+|---|---|---|---|
+| `dcv` / `vdc` | `:FUNCtion:VOLTage:DC` | `:MEASure:VOLTage:DC?` | V |
+| `acv` / `vac` | `:FUNCtion:VOLTage:AC` | `:MEASure:VOLTage:AC?` | V |
+| `dci` / `idc` | `:FUNCtion:CURRent:DC` | `:MEASure:CURRent:DC?` | A |
+| `aci` / `iac` | `:FUNCtion:CURRent:AC` | `:MEASure:CURRent:AC?` | A |
+| `res` / `ohm` / `2wr` | `:FUNCtion:RESistance` | `:MEASure:RESistance?` | ohm |
+| `fres` / `4wr` | `:FUNCtion:FRESistance` | `:MEASure:FRESistance?` | ohm |
+| `freq` | `:FUNCtion:FREQuency` | `:MEASure:FREQuency?` | Hz |
+| `period` | `:FUNCtion:PERiod` | `:MEASure:PERiod?` | s |
+| `continuity` / `cont` | `:FUNCtion:CONTinuity` | `:MEASure:CONTinuity?` | ohm |
+| `diode` | `:FUNCtion:DIODe` | `:MEASure:DIODe?` | V |
+| `cap` | `:FUNCtion:CAPacitance` | `:MEASure:CAPacitance?` | F |
+| ratio | Not public | Not public | Undefined |
+
+## Behavior and safety boundaries
 
 - The descriptor rejects non-`pyvisa`, non-`TCPIP`, serial, ASRL, USB, and GPIB configurations
-  before transport opening. This is a plugin boundary, not implementation of a DM3000 SCPI command.
-- Capability preflight, session lifecycle, pre-read settling, run-plan artifacts, and numeric
-  `expect` evaluation belong to WaveBench core and do not count as manual-command coverage.
-- Descriptor capability validation proves only that declared methods exist and are callable. It
-  does not prove SCPI semantics, instrument responses, correct wiring, or measurement accuracy.
-- A `set_function` readback proves that the instrument reports the requested mode. It does not
-  prove that terminals, range, resolution, filter, trigger, and the applied signal are suitable for
-  the next measurement.
-
-## Recommended roadmap
-
-See the [feature-coverage milestones](DM3000_COVERAGE_MILESTONES_EN.md) for exact commands and
-release gates. The overall order is:
-
-1. **M1: harden the original four capabilities — complete.** All eleven selectors have exact
-   parameterized tests, nonfinite readings are rejected, and `dmm.read` does not select a function.
-   Optional target/current-mode preflight remains outside this milestone.
-2. **M2: query-only measurement profile — complete.** Covers the current function, accepted
-   discrete range code, and DCV impedance. Measurement mode and CONT/DIODE inapplicable fields stay
-   unavailable.
-3. **M3: controlled voltage-input configuration — complete.** DCV/ACV
-   range and DCV impedance have function gates, parameter limits, readback, restoration, and latching.
-4. **P2: read existing statistics and trigger state.** Do not implicitly enable, clear, trigger, or
-   reset instrument state.
-5. **P3: datalog.** First resolve binary format, byte order, valid counts, size limits, timeout,
-   stop/finally behavior, and artifacts. The scan board should be a separate option-gated capability.
-6. **Out of default scope: command-set switching, reset/default, network/serial configuration, and
-   persistent scan-project writes.** These require permissions and confirmation distinct from
-   ordinary measurement workflows.
-
-## Evidence boundary
-
-- **Manual:** the local `vendor-local` transcription is for internal audit only. This document does
-  not reproduce the complete manual or include it in a release. Transcription ambiguity is not
-  treated as reliable protocol fact.
-- **Implementation:** external `driver.py`, `descriptor.py`, FakeTransport tests, and WaveBench's
-  shared DMM service/run-plan contracts.
-- **External hardware:** the recorded 2026-07-24 managed-install/routing/DCV work plus controlled
-  query and restorative-write protocol acceptance on 2026-07-26. The latter covered finite
-  ACV/FREQ/PERIOD responses, DCV/ACV ranges, DCV impedance, trigger queries, existing statistics,
-  and selected system/interface queries. The milestone document contains the exact list. No real
-  address, serial number, or measured value was retained.
-- **Not accepted:** measurement accuracy, DCI/ACI/resistance/continuity/diode/capacitance,
-  digits/resolution, datalog, scan, and compatibility sets remain unaccepted. Diagnostic probes do
-  not themselves create public capabilities.
-
-An item may be promoted to **External hardware accepted** only when current external code, focused
-offline tests, real command acceptance/readback, and required restoration evidence all exist.
+  before transport opening.
+- `dmm.read` does not select a function implicitly; the caller must confirm or set the current mode.
+- Configuration writes use readback and restoration. An ambiguous first write, failed readback, or
+  unverifiable restoration latches further configuration writes for the current instance.
+- Descriptor validation and finite-number parsing do not prove correct wiring, measurement accuracy,
+  or compatibility with the entire DM3000 family.
+
+## Related sources
+
+- [Production descriptor](../src/wavebench_rigol_dm3000/descriptor.py)
+- [Driver implementation](../src/wavebench_rigol_dm3000/driver.py)
+- [Coverage milestones and hardware evidence](DM3000_COVERAGE_MILESTONES_EN.md)
diff --git a/packages/wavebench-rigol-dp800/README.md b/packages/wavebench-rigol-dp800/README.md
index 212e6e8..834d3d5 100644
--- a/packages/wavebench-rigol-dp800/README.md
+++ b/packages/wavebench-rigol-dp800/README.md
@@ -4,29 +4,21 @@
 
 面向 RIGOL DP800 系列、当前以 DP832/DP832A 为公开兼容范围的 WaveBench 可执行仪器插件。
 
-## 身份与开发基线
+## 从这里开始
 
-- distribution：`wavebench-rigol-dp800`
-- canonical driver ID：`rigol.dp800`
-- 开发基线：WaveBench `a3e13fd`
-- WaveBench：`>=0.8,<0.9`
-- Python：`>=3.11`
-- transport backend：`pyvisa`
+- [查询当前版本、兼容范围、型号和 capability](../../doc/reference/plugin-catalog.md)
+- [查看当前功能覆盖矩阵](doc/DP800_COVERAGE_MATRIX.md)
+- [查阅开发里程碑与实机证据](doc/DP800_COVERAGE_MILESTONES.md)
+- [安装和管理 WaveBench 插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-本插件对齐 WaveBench `v0.8.0` release，不维护旧核心兼容矩阵，不能与 `v0.7.0` 配套运行，也不自动声明兼容未来 `0.9`。安装后，显式 canonical
-ID `rigol.dp800` 选择外置实现；短 alias `dp800` 始终选择 WaveBench 内建 fallback。
-卸载插件后，canonical ID 也回退内建实现。
+## 当前边界
 
-## 能力
+显式配置 `rigol.dp800` 时使用此外置实现；短 alias `dp800` 始终选择 Core fallback。当前实现
+覆盖身份与错误队列、通道状态和测量、电压／电流限值、显式输出控制及 OVP／OCP。精确
+capability、型号范围和协议限制以 production descriptor 与功能覆盖矩阵为准。
 
-- `*IDN?`、错误队列；
-- 通道设置值、输出状态、CV/CC 模式和电压/电流/功率测量；
-- 电压、电流限值设置；
-- 显式输出开关；
-- OVP/OCP 阈值、启用状态和触发状态。
-
-插件只负责 DP800 厂商 SCPI、解析和读回。WaveBench 核心继续负责安全上限、保护阈值与
-设定值关系、输出开启前检查、Service、run plan 和实验级状态恢复。写命令失败不盲目重试。
+插件负责 DP800 厂商 SCPI、解析和读回。Core 负责安全上限、保护阈值与设定值关系、输出开启
+前检查、Service、run plan 和实验级状态恢复。
 
 ## 配置示例
 
@@ -49,46 +41,15 @@ settle_ms_after_output = 500
 
 示例使用 RFC 5737 文档地址。默认测试不扫描资源、不连接仪器，也不发送真实 SCPI。
 
-## 验收状态
-
-0.3.0 完成 M2 现有写路径事务化：同一驱动实例的全部 transport I/O 使用统一可重入锁；
-`APPLy`、输出和 OVP/OCP 写入均保存写前快照、逐步回读，并在失败时执行保守恢复。写命令
-结果不明、恢复无法确认或出现新 trip 时，当前实例锁停后续配置写；输出失败统一收敛到 OFF，
-保护恢复不发送 `CLEAR`。回读比较按 DP832/DP832A 手册分辨率使用半 LSB 容差。
-2026-07-27 已在 DP832A CH1 完成不同目标值的正常回读/恢复和空载 ON→OFF，并通过受控
-故障注入验收首次输出写结果不明、保护事务第二/第三写失败、`APPLy` 回读不一致和
-`APPLy` 恢复结果不明；每轮均在独立会话复核最终状态。该证据只覆盖 DP832A 的协议和
-恢复语义，不代表其他型号、带载瞬态或测量准确度验收。
-
-0.2.0 完成 M1 只读路径收紧：首次通道访问通过 `*IDN?` 识别受支持型号和通道数；
-`APPLy?`、`MEASure:ALL?` 与 OVP/OCP 阈值拒绝非有限数；输出、模式、保护使能和 trip
-使用严格枚举；聚合快照任一查询失败即整体失败。2026-07-27 在 DP832A 三个通道完成
-31 条查询、零写入的实机验收，最终三个输出均为 OFF。该证据不外推到其他型号，也不代表
-测量准确度验收。驱动可识别 DP811/821/831/832 及 A 型通道数并 fail closed，但在对应写路径
-逐型号验收前，公开兼容范围不扩大到 DP811/821/831。
-
-0.1.0 已于 2026-07-24 完成真实 wheel 的受控 DP832A LAN 验收：受管安装、healthy/load、
-canonical 与短 alias 路由、三通道只读状态和保护快照、CH1 保守电压/限流写入、OVP/OCP
-写入与读回、空载输出 ON/OFF，以及卸载 fallback、重新安装均通过。写入前保存了三通道
-状态；验收结束后在独立会话逐字段确认三个通道均恢复到原快照、输出为 OFF，错误队列为空。
-验收未修改真实 `wavebench.toml`，未提交真实地址、序列号、快照、测量值或命令日志。
-
-编程手册命令域、当前公开 API、证据等级、未覆盖项和默认拒绝项见
-[DP800 编程手册功能覆盖矩阵](doc/DP800_COVERAGE_MATRIX.md)；逐阶段的目标、精确指令、
-安全边界和验收门槛见 [DP800 指令覆盖开发里程碑](doc/DP800_COVERAGE_MILESTONES.md)。
-
-## 开发验证
-
-```bash
-python -m pytest -q packages/wavebench-rigol-dp800/tests
-python -m ruff check packages/wavebench-rigol-dp800
-python -m wavebench plugin package check packages/wavebench-rigol-dp800
-```
+## 安全边界
 
-真实地址、序列号、设定值快照、测量值和命令日志不得提交。本插件采用
-[MIT License](LICENSE)。
+descriptor 导入不连接仪器。默认测试不扫描资源、不连接仪器，也不发送真实 SCPI。写命令
+不会盲目重试；结果不明、恢复无法确认或出现新 trip 时，当前实例会拒绝后续配置写入。输出
+失败会尝试保持 OFF，保护恢复不发送 `CLEAR`。
 
-## 来源
+真实地址、序列号、设定值快照、测量值和命令日志不得提交。
 
-0.1.0 从 WaveBench 主仓库 `a3e13fd` 的内建 DP800 协议实现迁移，只把厂商驱动、
-descriptor、entry point 和 FakeTransport 测试外置。
+## 开发与许可证
+
+日常源码开发和离线验证见仓库级 [editable 开发环境](../../doc/DEVELOPMENT.md)。本插件采用
+[MIT License](LICENSE)。
diff --git a/packages/wavebench-rigol-dp800/README_EN.md b/packages/wavebench-rigol-dp800/README_EN.md
index 1d34dd2..9166b61 100644
--- a/packages/wavebench-rigol-dp800/README_EN.md
+++ b/packages/wavebench-rigol-dp800/README_EN.md
@@ -5,31 +5,23 @@
 An executable WaveBench instrument plugin for the RIGOL DP800 family, with DP832/DP832A
 as the current public compatibility scope.
 
-## Identity and development baseline
+## Start here
 
-- distribution: `wavebench-rigol-dp800`
-- canonical driver ID: `rigol.dp800`
-- development baseline: WaveBench `a3e13fd`
-- WaveBench: `>=0.8,<0.9`
-- Python: `>=3.11`
-- transport backend: `pyvisa`
+- [Find the current version, compatibility range, models, and capabilities](../../doc/reference/plugin-catalog-en.md)
+- [Read the current feature-coverage matrix](doc/DP800_COVERAGE_MATRIX_EN.md)
+- [Review development milestones and hardware evidence](doc/DP800_COVERAGE_MILESTONES_EN.md)
+- [Install and manage WaveBench plugins](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-This plugin targets the WaveBench `v0.8.0` release. It does not maintain a legacy-core
-compatibility matrix, run with `v0.7.0`, or automatically claim compatibility with a future `0.9` core. When installed, the explicit canonical ID `rigol.dp800` selects the external
-implementation. The short alias `dp800` always selects WaveBench's built-in fallback. Removing the
-plugin restores the built-in implementation for the canonical ID as well.
+## Current boundary
 
-## Capabilities
+Set `rigol.dp800` to select this external implementation; the short `dp800` alias always selects the
+Core fallback. The implementation covers identity and error queues, channel state and measurements,
+voltage/current limits, explicit output control, and OVP/OCP. The production descriptor and coverage
+matrix are authoritative for exact capabilities, model scope, and protocol limits.
 
-- `*IDN?` and error queue;
-- channel setpoints, output state, CV/CC mode, and voltage/current/power measurements;
-- voltage and current-limit settings;
-- explicit output control;
-- OVP/OCP thresholds, enable states, and trip states.
-
-The plugin owns DP800 SCPI, parsing, and readback. WaveBench core retains safety limits, protection
-relationships, pre-output checks, services, run plans, and experiment-level state restoration.
-Failed writes are not retried blindly.
+The plugin owns DP800 vendor SCPI, parsing, and readback. Core owns safety limits, relationships
+between setpoints and protection thresholds, pre-output checks, services, run plans, and experiment-
+level restoration.
 
 ## Configuration example
 
@@ -53,54 +45,16 @@ settle_ms_after_output = 500
 The example uses an RFC 5737 documentation address. Offline tests do not scan resources, connect to
 instruments, or send real SCPI.
 
-## Acceptance status
-
-Version 0.3.0 completes M2 transactional hardening for the existing write paths. All transport I/O
-on one driver instance shares a reentrant lock. `APPLy`, output, and OVP/OCP writes snapshot prior
-state, verify each step, and attempt conservative recovery on failure. An ambiguous write, unverifiable
-recovery, or new trip latches later configuration writes off for that instance. Output failures converge
-to OFF, protection recovery never sends `CLEAR`, and readback comparisons use half-LSB tolerances from
-the DP832/DP832A manual resolutions.
-On 2026-07-27, DP832A CH1 passed a distinct-target normal readback/restore cycle, an unloaded ON-to-OFF
-cycle, and controlled fault injection for an ambiguous first output write, failures on the second and
-third protection writes, an `APPLy` readback mismatch, and an ambiguous `APPLy` restoration. A separate
-session verified final state after every case. This evidence covers DP832A protocol and recovery semantics
-only; it does not establish other-model compatibility, loaded transient behavior, or measurement accuracy.
-
-Version 0.2.0 completes M1 read-path hardening: the first channel access identifies a supported
-model and channel count through `*IDN?`; `APPLy?`, `MEASure:ALL?`, and OVP/OCP thresholds reject
-non-finite values; output, mode, protection-enable, and trip responses use strict enums; and any
-query failure fails an aggregate snapshot as a whole. On 2026-07-27, all three DP832A channels
-passed a 31-query, zero-write hardware gate with all outputs left OFF. This evidence is not
-extrapolated to other models and does not establish measurement accuracy. The driver recognizes
-channel counts for DP811/821/831/832 and A-models and fails closed, but public compatibility is not
-expanded to DP811/821/831 until the corresponding write paths are accepted per model.
-
-Version 0.1.0 completed controlled DP832A LAN acceptance with a real wheel on 2026-07-24. Managed
-installation, healthy/load checks, canonical-versus-short-alias routing, three-channel read-only
-status and protection snapshots, conservative CH1 voltage/current-limit writes, OVP/OCP write and
-readback, unloaded output ON/OFF, removal fallback, and reinstallation all passed. All three channels
-were snapshotted before mutation; a separate session then confirmed exact restoration, all outputs
-OFF, and an empty error queue. The acceptance did not modify the real `wavebench.toml` or commit real
-addresses, serial numbers, snapshots, measurements, or command logs.
-
-See the [DP800 programming-manual coverage matrix](doc/DP800_COVERAGE_MATRIX_EN.md) for the manual
-command domains, public API mapping, evidence levels, uncovered areas, and commands denied by
-default. The [DP800 command coverage development milestones](doc/DP800_COVERAGE_MILESTONES_EN.md)
-define each stage's exact commands, safety boundary, and acceptance gate.
-
-## Development checks
-
-```bash
-python -m pytest -q packages/wavebench-rigol-dp800/tests
-python -m ruff check packages/wavebench-rigol-dp800
-python -m wavebench plugin package check packages/wavebench-rigol-dp800
-```
+## Safety boundary
+
+Descriptor import performs no instrument I/O. Default tests do not scan resources, connect to an
+instrument, or send real SCPI. Writes are not retried blindly. An ambiguous write, unverifiable
+recovery, or new trip latches later configuration writes off for the current instance. Output
+failure attempts to remain OFF, and protection recovery never sends `CLEAR`.
 
-Do not commit real addresses, serial numbers, setpoint snapshots, measurements, or command logs.
-This package is licensed under the [MIT License](LICENSE).
+Never commit real addresses, serial numbers, setpoint snapshots, measurements, or command logs.
 
-## Origin
+## Development and license
 
-Version 0.1.0 was migrated from the built-in DP800 protocol implementation at WaveBench `a3e13fd`.
-Only the vendor driver, descriptor, entry point, and FakeTransport tests moved into this package.
+Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md) for source
+work and offline checks. This plugin is licensed under the [MIT License](LICENSE).
diff --git a/packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MATRIX.md b/packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MATRIX.md
index 8ebada9..0d47cc1 100644
--- a/packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MATRIX.md
+++ b/packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MATRIX.md
@@ -2,74 +2,54 @@
 
 [English](DP800_COVERAGE_MATRIX_EN.md)
 
-## 目的、范围与统计口径
-
-本矩阵将本地保存的 RIGOL DP800 中文编程手册与外置
-`wavebench-rigol-dp800` 插件的公开 capability、实际 SCPI、离线测试和已记录的
-DP832A LAN 验收证据逐项对照。它回答“手册提供了什么”“插件实际公开了什么”和
-“每项结论有什么级别的证据”，不把手册中存在一条命令、Python 方法存在或同一命令域
-的相邻功能通过，自动等同于完整功能覆盖。
-
-审计输入为 RIGOL DP800 系列编程手册，文档编号 `PGH03008-1110`，版本日期
-`2015-12`。当前 Markdown 转录为 17,525 行，位于本包被 Git 忽略的
-`doc/vendor-local/`；该目录不进入提交、wheel 或 sdist。手册覆盖 DP800 系列多个型号、
-A/非 A 型、不同通道数、量程和选件，因此本矩阵不把某一型号的范围或选件能力外推给
-DP832A，也不把 DP832A 验收外推给整个系列。
-
-按手册“命令系统”目录，本矩阵审计 22 个域：21 个具名厂商/状态子系统
-（`ANALyzer`、`APPLy`、`DELAY`、`DISPlay`、`INITiate`、`INSTrument`、`LIC`、
-`MEASure`、`MEMory`、`MMEMory`、`MONItor`、`OUTPut`、`PRESet`、`RECAll`、
-`RECorder`、`SOURce`、`STATus`、`STORe`、`SYSTem`、`TIMEr`、`TRIGger`）以及
-IEEE 488.2 公用命令。set/query 形式、可选关键字、短写和同义命令不作为独立“完成率”
-分母，因此本文不报告伪精确的百分比。
-
-当前外置插件版本为 `0.3.0`，声明六项 capability：`power.idn`、`power.status`、
-`power.measurement`、`power.set_voltage_current_limit`、`power.output` 和
-`power.protection`。它是受安全策略约束的窄电源驱动，不是通用 DP800 SCPI shell。
-
-覆盖标签：
-
-- **外置实机通过**：当前外置插件、针对性离线测试和受控 DP832A 实机证据均存在。
-- **已实现 / 离线验证**：代码和精确 FakeTransport 测试存在，但没有该细项的外置实机结论。
-- **部分覆盖**：命令域中只有一个窄子集进入公开 API。
-- **未覆盖**：手册有命令，但当前插件没有相应 capability 或方法。
-- **默认拒绝**：命令会直接改变输出、触发动作、清除保护、重置/恢复仪器、修改连接或写持久数据，不应由普通工作流暴露。
-
-逐阶段的公开 capability、精确指令、安全契约和实机验收门槛见
-[DP800 指令覆盖开发里程碑](DP800_COVERAGE_MILESTONES.md)。
-
-## 功能覆盖矩阵
-
-| 功能域 | 手册命令面 | 当前公开覆盖 | 证据状态 | 主要缺口与安全边界 | 建议 |
-|---|---|---|---|---|---|
-| 身份与错误队列 | `*IDN?`、`:SYSTem:ERRor?`、`:SYSTem:VERSion?` | `power.idn`；写操作后可消费错误队列 | **外置实机通过**；精确查询有离线测试 | `errors()` 会读取并消费队列；没有结构化型号/固件或非消费型 health | 保持错误队列语义显式；公开证据继续脱敏 |
-| IEEE 488.2 状态、同步、复位与触发 | `*CLS`、`*ESE/*ESR?`、`*OPC?`、`*RST`、`*SRE/*STB?`、`*TRG`、`*TST?`、`*WAI` | 除 `*IDN?` 外未公开 | **默认拒绝 / 未覆盖** | `*RST` 改变整机；`*TRG` 可触发输出；`*CLS` 和事件查询会清状态；等待/同步语义未建模 | 只考虑窄的只读 condition/health；复位和触发保持独立人工流程 |
-| 基础设定值 | `:APPLy` / `:APPLy?` | `power.status` 读取通道额定值、电压和电流设定；`power.set_voltage_current_limit` 保存快照、写一条 `:APPL`、回读验证，并在失败时恢复 | **外置实机通过**：DP832A 三通道读取、CH1 不同目标值写入/恢复，以及 `APPLy` 回读不一致和恢复结果不明的故障注入 | 读取已拒绝非有限数、未知型号和越界通道；手册定义的单通道无参数 `:APPL?` 两字段回包已离线覆盖，但尚未实机验收，且不猜测额定档位；写结果不明或恢复无法确认会锁停当前驱动实例的配置写 | 其他型号逐台验收 |
-| 实时测量 | `:MEASure:ALL?`、`:MEASure:VOLTage?`、`:MEASure:CURRent?`、`:MEASure:POWEr?` | `power.measurement` 使用 `:MEAS:ALL? CH<n>` 返回电压、电流、功率；`power.status` 复用同一快照 | **外置实机通过**：DP832A 三通道；有限数与字段数离线门禁通过 | 未公开三个独立标量 query；不宣称测量准确度 | 保持单次 ALL 快照；准确度另行验收 |
-| 输出状态与 CV/CC 模式 | `:OUTPut[:STATe]?`、`:OUTPut:CVCC?` / `:OUTPut:MODE?` | `power.status` 查询输出开关和 CV/CC 模式 | **外置实机通过**：DP832A 三通道；严格 `ON/OFF`、`CV/CC/UR` 离线门禁通过 | 其他型号的实际模式回包尚未验收 | 未知枚举继续 fail closed；按型号补实机证据 |
-| 显式输出开关 | `:OUTPut[:STATe] [CH<n>,]ON|OFF` | `power.output` 保存状态、单条写入、回读验证，并在失败时强制 OFF | **外置实机通过**：CH1 空载 ON/OFF、最终三通道 OFF，以及首次输出写结果不明的故障注入 | 直接影响被测电路；写结果不明或 OFF 恢复无法确认会锁停配置写，且驱动不会盲目重试 ON | 保持独立显式 capability；其他型号逐台验收 |
-| OVP/OCP 状态与阈值 | `:OUTPut:OVP/OCP[:STATe]`、`:VALue`、`:QUES?`/`:ALAR?` | `power.protection` 保存使能、阈值和 trip；按安全顺序写入、逐步回读，并在失败时恢复配置 | **外置实机通过**：DP832A 三通道读取、CH1 OVP/OCP 写回/恢复，以及事务第二/第三写失败的故障注入 | 恢复时绝不 CLEAR 新 trip；写结果不明、trip 改变或恢复无法确认会锁停配置写；ALAR 别名尚未验证，阈值关系主要由核心检查 | 其他型号和 ALAR 别名逐项验收 |
-| 清除 OVP/OCP | `:OUTPut:OVP:CLEAR`、`:OUTPut:OCP:CLEAR`；`SOURce:*:PROTection:CLEar` 还可能重新打开输出 | 未公开 | **默认拒绝** | 清除 trip 是破坏性动作；`SOURce` clear 的输出副作用尤其危险 | 仅在用户确认故障已排除、输出目标态明确的独立恢复流程中考虑 |
-| `SOURce` 电压/电流与保护别名 | `:SOURce<n>:VOLTage/CURRent`、step、triggered level、protection、range | 未作为独立 API；基础立即值和保护由 `APPLy`/`OUTPut` 路径覆盖 | **部分覆盖** | 不覆盖步进、触发设定、DP811 档位或 clear；同义命令不能重复计作覆盖 | 继续使用当前显式通道命令；只有需要独立 V/I 事务时才扩展 |
-| 档位、Sense 与跟踪 | `:OUTPut:RANGe`、`:OUTPut:SENSe`、`:OUTPut:TRACk` | 未公开 | **未覆盖** | 型号/通道相关；档位改变安全范围，Sense 依赖远端接线，跟踪会联动通道 | **P2**：先做 option/model-gated 只读 profile；写入需多通道快照与接线确认 |
-| 定时输出 | `:TIMEr:*`、`:OUTPut:TIMEr*` | 未公开 | **未覆盖 / 默认拒绝启动** | 参数表、模板和启停会在时间序列中改变实际输出；当前单点状态无法恢复 | **P2**：先定义有界只读 timer profile；执行需独立计划、超时、停止和恢复 |
-| 延时输出 | `:DELAY:*` | 未公开 | **未覆盖 / 默认拒绝启动** | 可按条件和时间改变输出，支持循环及终止状态 | 与 timer 分开建模；没有完整参数快照和 finally 停止前不执行 |
-| 监测器 | `:MONItor:*` | 未公开 | **未覆盖** | 条件、阈值和停止方式可关闭输出、报警或鸣响；非 A 型可能需选件 | **P2**：先做 option-gated 只读状态；控制写入必须和输出恢复联动 |
-| 触发输入、输出与电源触发 | `:TRIGger:*`、`:INITiate`、`*TRG`、`INSTrument:COUPle:TRIGger` | 未公开 | **默认拒绝** | 可改变触发电压/电流、切换输出、驱动数字口或耦合多通道 | 需要独立触发拓扑、端口电气约束、原状态快照和人工确认 |
-| 通道选择 | `:INSTrument:NSELect` / `:SELect` | 未使用；当前 API 在每条命令显式传 `CH<n>` | **刻意不覆盖** | 修改“当前通道”会引入隐藏全局状态；当前显式通道更可审计 | 保持显式通道，不为缩短 SCPI 引入可变 current-channel 状态 |
-| 录制器 | `:RECorder:*` | 未公开 | **未覆盖 / 默认拒绝启停** | 停止录制会写内部/外部文件；周期、目的地和存储生命周期未建模 | **P3**：如有需求，先做只读 destination/period/state，再设计有界 artifact 导出 |
-| 分析器 | `:ANALyzer:*` | 未公开 | **未覆盖** | 依赖有效录制文件和选件；选择文件、时间窗、对象并执行分析 | 在 recorder 文件生命周期明确后，才考虑 query-only result/value |
-| 内部状态与用户预设 | `:MEMory:*`、`:PRESet:*`、`:RECAll:LOCal`、`:STORe:LOCal`、`*SAV/*RCL` | 未公开 | **默认拒绝** | 会保存、覆盖、锁定、删除或调用持久状态，可能改变所有通道输出 | 保持主机侧快照与恢复；不使用仪器槽位替代实验事务 |
-| 外部存储文件 | `:MMEMory:*`、`:RECAll:EXTErnal`、`:STORe:EXTErnal` | 未公开 | **默认拒绝** | 路径、创建、删除、覆盖和加载均有持久副作用，且依赖外部介质 | 除非有路径沙箱和明确文件权限，否则不纳入普通插件 |
-| 显示与前面板 | `:DISPlay:*`、`:SYSTem:BRIGhtness/CONTrast/RGBBrightness/SAVer`、lock/local/remote | 未公开 | **未覆盖 / 写入默认拒绝** | 修改全局前面板状态；remote/lock 可能影响人工接管 | 仅在有诊断价值时考虑只读状态；不让测量流程修改 UI |
-| 系统诊断与状态寄存器 | `:SYSTem:SELF:TEST:*`、`:SYSTem:VERSion?`、`:STATus:QUEStionable:*` | 未公开 | **未覆盖** | 部分事件查询会清事件位；self-test 的运行条件和时延未定义 | 可先设计非消费型 condition/version snapshot，并明确事件读取副作用 |
-| 网络、串口、GPIB 与全局系统设置 | `:SYSTem:COMMunicate:*`、language、power-on、OTP、ON/OFF sync、track mode | 未公开 | **默认拒绝** | 改 LAN/IP/DHCP 可断开会话；其余会改变持久或全局行为 | 网络和接口永不经普通实验工作流写入；只读状态也应脱敏 |
-| 许可证与选件安装 | `:LIC:SET` | 未公开 | **默认拒绝** | 写入许可证/选件状态，属于设备维护而非实验控制 | 不纳入 WaveBench 普通 capability |
+本页将 DP800 编程手册的功能域映射到外置 `wavebench-rigol-dp800` 插件当前公开的
+WaveBench capability 和 SCPI 表面。当前包版本、依赖和入口点以 [包元数据](../pyproject.toml)
+为准，型号、通道、配置字段和 capability 以
+[production descriptor](../src/wavebench_rigol_dp800/descriptor.py) 为准，精确命令、解析和
+事务行为以 [driver](../src/wavebench_rigol_dp800/driver.py) 为准。
+
+[指令覆盖开发里程碑](DP800_COVERAGE_MILESTONES.md)记录开发顺序、实机验收和退出门。
+该页面用于追溯，不会独立增加当前 capability。手册或本矩阵出现一条命令，也不表示
+production descriptor 已经公开对应能力。
+
+## 范围
+
+审计输入为文档编号 `PGH03008-1110` 的 RIGOL DP800 系列编程手册。手册覆盖多个型号、
+A／非 A 变体、通道数、量程和选件，因此型号参数不能外推给 DP832A，DP832A 证据也不能
+外推给整个系列。本地转录只用于内部审计，位于 Git 忽略且不进入 wheel／sdist 的
+`doc/vendor-local/`。
+
+本矩阵按 22 个手册功能域说明当前覆盖，不用 set/query 变体、短写或 alias 计算完成率。
+外置插件是受安全策略约束的窄电源驱动，不是通用 DP800 SCPI shell。
+
+## 功能覆盖
+
+| 功能域 | 手册命令面 | 当前公开覆盖 | 当前边界 |
+|---|---|---|---|
+| 身份与错误队列 | `*IDN?`、`:SYSTem:ERRor?`、`:SYSTem:VERSion?` | `power.idn`；配置写入可按设置读取错误队列 | `errors()` 会消费队列；没有结构化型号／固件或非消费型 health。 |
+| IEEE 488.2 状态、复位与触发 | `*CLS`、状态寄存器、`*OPC?`、`*RST`、`*TRG`、`*TST?` | 除 `*IDN?` 外未公开 | reset、trigger 和清状态具有全局或输出副作用，默认拒绝。 |
+| 基础设定值 | `:APPLy` / `:APPLy?` | `power.status`；`power.set_voltage_current_limit` | 写前保存电压／电流，单次写入后回读；失败时恢复。结果不明或恢复无法确认会锁停配置写入。 |
+| 实时测量 | `:MEASure:ALL?` 及标量 query | `power.measurement`；`power.status` 复用同一快照 | 使用单次 `:MEAS:ALL? CH<n>`；不公开独立标量 query，也不声明测量准确度。 |
+| 输出状态与 CV／CC 模式 | `:OUTPut[:STATe]?`、`:OUTPut:CVCC?` / `:OUTPut:MODE?` | `power.status` | 未知 output／regulation 枚举会失败，不向未确认型号外推。 |
+| 显式输出开关 | `:OUTPut[:STATe] [CH<n>,]ON|OFF` | `power.output` | 直接影响被测电路。驱动写一次并回读；失败时强制 OFF，不盲目重试 ON。 |
+| OVP／OCP | state、threshold、trip、clear | `power.protection` 读取并配置 state／threshold／trip | 配置按安全顺序逐项写入和回读；恢复时不会清除新 trip。Clear 命令未公开。 |
+| `SOURce` 设定与保护 alias | level、step、triggered level、protection、range | 没有独立 API；立即设定值和保护使用 `APPLy`／`OUTPut` 路径 | 不公开 step、triggered level、DP811 range 或 protection clear；alias 不重复计算覆盖。 |
+| Range、Sense 与 Track | `:OUTPut:RANGe/SENSe/TRACk` | 未公开 | 型号／通道相关；Range 改变安全范围，Sense 依赖远端接线，Track 联动通道。 |
+| Timer 与 Delay | `:TIMEr:*`、`:OUTPut:TIMEr*`、`:DELAY:*` | 未公开 | 可按时间或条件改变真实输出；当前单点快照不足以恢复，启动默认拒绝。 |
+| Monitor | `:MONItor:*` | 未公开 | 条件与动作可能关闭输出或报警，并可能依赖选件。 |
+| Trigger 与 `INITiate` | `:TRIGger:*`、`:INITiate`、`*TRG` | 未公开 | 可改变触发电平、切换输出、驱动数字端口或耦合通道，默认拒绝。 |
+| 当前通道选择 | `:INSTrument:NSELect/SELect` | 刻意不使用 | 当前 API 在每条命令显式传递 `CH<n>`，避免引入隐藏的全局 current-channel 状态。 |
+| Recorder 与 Analyzer | `:RECorder:*`、`:ANALyzer:*` | 未公开 | 依赖选件和文件生命周期，且启停、选择文件和运行分析会改变状态。 |
+| 内部状态、preset 与外部文件 | `:MEMory:*`、`:PRESet:*`、`:RECAll:*`、`:STORe:*`、`:MMEMory:*`、`*SAV/*RCL` | 未公开 | 保存、覆盖、删除、调用和加载均有持久副作用，默认拒绝。 |
+| 显示与前面板 | `:DISPlay:*`、brightness、contrast、lock/local/remote | 未公开 | 会改变全局 UI 或妨碍人工接管；普通测量流程不写前面板。 |
+| 系统诊断与状态 | self-test、SCPI version、`:STATus:QUEStionable:*` | 未公开 | 部分事件 query 会清位，自检运行条件和时延尚无公开合同。 |
+| 通信与全局设置 | LAN、serial、GPIB、language、power-on、OTP、channel sync | 未公开 | 网络写入可能断开 session，其余操作改变持久或全局状态，默认拒绝。 |
+| 许可证与选件安装 | `:LIC:SET` | 未公开 | 属于设备维护并改变持久状态，默认拒绝。 |
 
 ## 当前直接使用的 SCPI 表面
 
-以下按手册长写形式归一化；实现实际使用兼容短写，例如 `APPL`、`MEAS`、`OUTP`、
-`SYST:ERR?`。这不是原始通信日志，也不代表每条都独立完成准确度或全型号验收。
+以下命令按手册长写形式归一化；实现使用兼容短写。这不是原始通信日志，也不表示每条命令
+都单独完成了准确度或全型号验收。
 
 ```text
 *IDN?
@@ -94,43 +74,21 @@ OUTPut:OCP:VALue CH<n>,<current>
 OUTPut:OCP[:STATe] CH<n>,ON|OFF
 ```
 
-`power.status` 不是单查询：它依次读取 `APPLy?`、`MEASure:ALL?`、输出状态和输出模式。
-`power.protection` 也会依次读取六个保护字段。当前实现若中途查询失败，不返回部分模型。
-
-## WaveBench 提供、但不计入手册覆盖的保障
-
-- 核心的 `max_power_voltage_v`、`max_power_current_limit_a`、保护阈值关系、输出开启前检查、
-  run plan 和实验级恢复属于 WaveBench policy/service，不是 DP800 某条 SCPI 的实现。
-- 2026-07-24 正常路径验收在写入前保存三通道快照，并在独立会话逐字段确认恢复、输出 OFF
-  和错误队列为空；2026-07-27 又以受控故障注入验收 M2 的输出、保护和 `APPLy` 恢复/
-  锁存语义。真实仪器恢复不是数据库式原子回滚，无法确认时仍按失败并锁停处理。
-- descriptor capability 校验只证明声明的方法存在，不证明命令语义、仪器回包、负载接线、
-  测量准确度或所有 DP800 型号兼容。
-- settle delay 由核心配置并在写后执行；它不能证明输出已经稳定或达到精度指标。
-
-## 推荐路线
-
-1. **P1：设备健康与只读通道 profile。** 在型号/选件门控下补充非消费型 health、range、
-   Sense、track、timer/monitor
-   状态；继续显式传通道，不引入隐式 current-channel。
-2. **P2：timer、delay、monitor。** 先 query-only，再以有界步骤、超时、finally 停止、完整
-   快照和多通道恢复实现执行能力。
-3. **P3：recorder/analyzer。** 先明确内部/外部文件生命周期、大小上限和 artifact 语义，
-   再考虑录制与只读分析结果。
-4. **默认不做：网络/接口写入、license、reset/preset、内部状态槽、文件删除/加载和裸触发。**
-   它们需要与普通实验流程不同的权限模型和人工确认。
-
-## 证据边界
-
-- **手册侧**：本地 `vendor-local` 中文 DP800 手册仅用于内部审计；本文不复制整本手册，
-  也不将其打入发行包。
-- **实现侧**：外置插件的 `driver.py`、`descriptor.py`、FakeTransport、lifecycle 和 wheel
-  测试，以及 WaveBench 公共 PowerService 契约。
-- **实机侧**：2026-07-24 的受管 DP832A LAN 正常路径验收覆盖真实 wheel 安装/路由、
-  三通道只读状态和保护、CH1 保守设定值、OVP/OCP、空载输出 ON/OFF、完整恢复与错误队列
-  检查；2026-07-27 的 M2 验收增加不同目标值回读/恢复、五类受控故障注入及每轮独立会话复核。
-- **未验收侧**：其他 DP800 型号、带载瞬态、测量准确度、档位/Sense/跟踪、timer/delay、
-  monitor、trigger、recorder/analyzer、存储和系统配置均不得宣称通过。
-
-只有当前外置代码、针对性离线测试、真实仪器命令接受/回读，以及写操作所需的恢复证据都
-存在，某一项才可提升为“外置实机通过”。
+`power.status` 依次读取 `APPLy?`、`MEASure:ALL?`、output state 和 regulation mode；
+`power.protection` 依次读取六个保护字段。中途查询失败时，不返回不完整的公共模型。
+
+## 行为与安全边界
+
+- Core 负责 voltage／current safety limit、OVP／OCP 关系、输出开启前检查、run plan 和
+  实验级恢复；这些规则不计作 DP800 SCPI 覆盖。
+- 当前命令始终显式指定通道，不修改隐藏的 current-channel 状态。
+- 多写事务失败时尝试恢复原快照；首次写入结果不明、trip 改变或恢复无法确认时，当前实例
+  会锁停后续配置写入。
+- settle delay、有限数解析和 descriptor 校验不证明输出已经稳定、接线正确、测量准确或
+  整个 DP800 系列兼容。
+
+## 相关来源
+
+- [Production descriptor](../src/wavebench_rigol_dp800/descriptor.py)
+- [Driver implementation](../src/wavebench_rigol_dp800/driver.py)
+- [开发里程碑与实机证据](DP800_COVERAGE_MILESTONES.md)
diff --git a/packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MATRIX_EN.md b/packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MATRIX_EN.md
index ea6787d..20dbdd1 100644
--- a/packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MATRIX_EN.md
+++ b/packages/wavebench-rigol-dp800/doc/DP800_COVERAGE_MATRIX_EN.md
@@ -2,81 +2,59 @@
 
 [中文](DP800_COVERAGE_MATRIX.md)
 
-## Purpose, scope, and accounting rules
-
-This matrix compares the locally retained RIGOL DP800 programming manual with the public
-capabilities, actual SCPI, offline tests, and recorded DP832A LAN evidence of the external
-`wavebench-rigol-dp800` plugin. It distinguishes commands documented by the manual from commands
-actually exposed and accepted through the current plugin. A documented command, a Python method,
-or acceptance of a neighboring command in the same subsystem does not imply complete coverage.
-
-The audit source is the RIGOL DP800 Series Programming Guide, document `PGH03008-1110`, dated
-`2015-12`. Its 17,525-line Markdown transcription is stored under the Git-ignored
-`doc/vendor-local/` directory and is excluded from commits, wheels, and sdists. The manual covers
-multiple DP800 models, A and non-A variants, channel counts, ranges, and options. Model-specific
-limits and option availability are therefore not extrapolated to the DP832A, and DP832A evidence is
-not extrapolated to the entire family.
-
-Following the manual's command-system table of contents, this matrix audits 22 domains: 21 named
-vendor/status subsystems (`ANALyzer`, `APPLy`, `DELAY`, `DISPlay`, `INITiate`, `INSTrument`, `LIC`,
-`MEASure`, `MEMory`, `MMEMory`, `MONItor`, `OUTPut`, `PRESet`, `RECAll`, `RECorder`, `SOURce`,
-`STATus`, `STORe`, `SYSTem`, `TIMEr`, and `TRIGger`) plus IEEE 488.2 common commands. Set/query
-forms, optional keywords, abbreviations, and aliases are not separate completion units, so this
-document does not publish a pseudo-precise percentage.
-
-The current external plugin is version `0.3.0` and declares six capabilities: `power.idn`,
-`power.status`, `power.measurement`, `power.set_voltage_current_limit`, `power.output`, and
-`power.protection`. It is a narrow power-supply driver governed by safety policy, not a general
-DP800 SCPI shell.
-
-Coverage labels:
-
-- **External hardware accepted**: current external implementation, targeted offline tests, and
-  controlled DP832A evidence all exist.
-- **Implemented / offline verified**: code and exact FakeTransport tests exist, without external
-  hardware evidence for that detail.
-- **Partially covered**: only a narrow subset of the command domain is exposed publicly.
-- **Not covered**: the manual documents the command, but the plugin exposes no corresponding method
-  or capability.
-- **Denied by default**: the command directly changes output, triggers an action, clears protection,
-  resets or recalls state, changes connectivity, or writes persistent data.
-
-See the [DP800 command coverage development milestones](DP800_COVERAGE_MILESTONES_EN.md) for each
-stage's public capabilities, exact commands, safety contract, and hardware acceptance gate.
-
-## Functional coverage matrix
-
-| Domain | Manual command surface | Current public coverage | Evidence | Main gap and safety boundary | Recommendation |
-|---|---|---|---|---|---|
-| Identity and error queue | `*IDN?`, `:SYSTem:ERRor?`, `:SYSTem:VERSion?` | `power.idn`; mutating calls may consume the error queue afterwards | **External hardware accepted**; exact offline queries | `errors()` consumes queue entries; no structured model/firmware or non-consuming health API | Keep queue semantics explicit and evidence redacted |
-| IEEE 488.2 status, synchronization, reset, and trigger | `*CLS`, `*ESE/*ESR?`, `*OPC?`, `*RST`, `*SRE/*STB?`, `*TRG`, `*TST?`, `*WAI` | Nothing except `*IDN?` | **Denied by default / not covered** | Reset changes the entire instrument; trigger can change output; clear/event reads mutate status; synchronization is not modeled | Consider only a narrow non-consuming health snapshot; keep reset and trigger in manual maintenance workflows |
-| Basic setpoints | `:APPLy` / `:APPLy?` | `power.status` reads rating, voltage, and current setpoints; `power.set_voltage_current_limit` snapshots, writes one `:APPL`, verifies readback, and restores on failure | **External hardware accepted**: three-channel DP832A reads, a distinct-target CH1 write/restore, and fault injection for `APPLy` readback mismatch and ambiguous restoration | Reads reject non-finite values, unknown models, and invalid channels; the manual-defined two-field response to targetless single-channel `:APPL?` is covered offline but remains hardware-unverified, and no rating is guessed; ambiguous writes or unverifiable restoration latch configuration writes for that driver instance | Accept other models individually |
-| Live measurement | `:MEASure:ALL?`, voltage, current, and power scalar queries | `power.measurement` uses one `:MEAS:ALL? CH<n>`; `power.status` reuses it | **External hardware accepted** on all three DP832A channels; finite/count offline gates pass | Scalar queries are not exposed; measurement accuracy is not claimed | Preserve one ALL snapshot; accept accuracy separately |
-| Output state and CV/CC mode | `:OUTPut[:STATe]?`, `:OUTPut:CVCC?` / `:OUTPut:MODE?` | `power.status` queries output and regulation mode | **External hardware accepted** on three DP832A channels; strict `ON/OFF` and `CV/CC/UR` offline gates pass | Actual mode responses on other models remain unverified | Continue to fail closed on unknown enums; add per-model evidence |
-| Explicit output control | `:OUTPut[:STATe] [CH<n>,]ON|OFF` | `power.output` snapshots state, writes once, verifies readback, and forces OFF on failure | **External hardware accepted**: unloaded CH1 ON/OFF, final all channels OFF, and fault injection for an ambiguous first output write | Directly affects the DUT; an ambiguous write or unverifiable OFF recovery latches configuration writes, and the driver never retries ON blindly | Keep a separate explicit capability; accept other models individually |
-| OVP/OCP state and thresholds | `:OUTPut:OVP/OCP[:STATe]`, `:VALue`, and `:QUES?`/`:ALAR?` | `power.protection` snapshots enable, threshold, and trip fields; ordered writes are verified and configuration is restored on failure | **External hardware accepted**: three-channel DP832A reads, CH1 write/restore, and fault injection for failures on the second and third transaction writes | A new trip is never cleared during recovery; ambiguous writes, changed trip state, or unverifiable restoration latch configuration writes; ALAR alias remains unverified and the core owns relationship checks | Accept other models and the ALAR alias individually |
-| Clear OVP/OCP | `:OUTPut:OVP:CLEAR`, `:OUTPut:OCP:CLEAR`; `SOURce:*:PROTection:CLEar` can also re-enable output | Not exposed | **Denied by default** | Clearing a trip is destructive; the SOURce clear side effect is especially hazardous | Consider only an explicit recovery flow after fault removal and target output state are confirmed |
-| `SOURce` voltage/current and protection aliases | Immediate level, step, triggered level, protection, and range | No independent API; immediate setpoints and protection use APPLy/OUTPut paths | **Partially covered** | No step, triggered level, DP811 range, or protection clear; aliases do not count twice | Keep explicit-channel paths; expand only if independent voltage/current transactions are needed |
-| Range, Sense, and tracking | `:OUTPut:RANGe`, `:OUTPut:SENSe`, `:OUTPut:TRACk` | Not exposed | **Not covered** | Model/channel-specific; range changes limits, Sense requires remote wiring, and tracking couples channels | **P2:** option/model-gated query-only profile first; writes require wiring confirmation and multi-channel restore |
-| Timed output | `:TIMEr:*`, `:OUTPut:TIMEr*` | Not exposed | **Not covered / start denied by default** | Tables, templates, and run state change real output over time; current scalar snapshots cannot restore them | **P2:** bounded query-only profile first; execution needs a plan, timeout, stop, and restore |
-| Delay output | `:DELAY:*` | Not exposed | **Not covered / start denied by default** | Conditions, cycles, and terminal state can change output | Model separately from timer; do not execute without complete snapshot and finally-stop behavior |
-| Monitor | `:MONItor:*` | Not exposed | **Not covered** | Conditions and stop actions can turn outputs off or signal alarms; option-dependent on non-A models | **P2:** option-gated query-only status first; writes must integrate output recovery |
-| Trigger input/output and triggered supply actions | `:TRIGger:*`, `:INITiate`, `*TRG`, trigger coupling | Not exposed | **Denied by default** | Can change trigger V/I, switch outputs, drive digital ports, or couple channels | Requires a trigger topology, electrical limits, complete snapshot, and human confirmation |
-| Channel selection | `:INSTrument:NSELect` / `:SELect` | Deliberately unused; every current command carries `CH<n>` | **Intentionally not covered** | Changing current channel introduces hidden global state | Preserve explicit channels rather than shortening SCPI through mutable current-channel state |
-| Recorder | `:RECorder:*` | Not exposed | **Not covered / start-stop denied by default** | Stop writes an internal/external file; period, destination, and storage lifecycle are unmodeled | **P3:** query-only destination/period/state first, then bounded artifact export |
-| Analyzer | `:ANALyzer:*` | Not exposed | **Not covered** | Depends on a valid recorded file and options; selecting files/windows/object then running analysis mutates state | Consider query-only result/value only after recorder lifecycle is defined |
-| Internal state and user presets | `:MEMory:*`, `:PRESet:*`, local recall/store, `*SAV/*RCL` | Not exposed | **Denied by default** | Saves, overwrites, locks, deletes, or recalls persistent whole-instrument state and may alter all outputs | Use host-side snapshots; do not substitute instrument slots for experiment transactions |
-| External storage | `:MMEMory:*`, external recall/store | Not exposed | **Denied by default** | Paths, creation, deletion, overwrite, and load are persistent and media-dependent | Exclude from ordinary plugin unless path sandboxing and explicit permissions are designed |
-| Display and front panel | `:DISPlay:*`, brightness/contrast/RGB/saver, lock/local/remote | Not exposed | **Not covered / writes denied by default** | Global UI changes and lock/remote can impede human takeover | Consider read-only status only when diagnostically useful; measurement flows must not change UI |
-| System diagnostics and status registers | self-test, SCPI version, `:STATus:QUEStionable:*` | Not exposed | **Not covered** | Some event reads clear bits; self-test conditions and latency are undefined | Start with a non-consuming condition/version snapshot and document event side effects |
-| Network, serial, GPIB, and global system settings | `:SYSTem:COMMunicate:*`, language, power-on, OTP, ON/OFF sync, track mode | Not exposed | **Denied by default** | LAN/IP/DHCP changes can sever the session; others alter persistent/global behavior | Never write interfaces through normal experiments; redact even read-only network state |
-| License and option installation | `:LIC:SET` | Not exposed | **Denied by default** | Changes licensed/option state and belongs to maintenance | Keep outside normal WaveBench capabilities |
-
-## SCPI directly used today
-
-The following uses normalized long-form manual spellings. The implementation uses legal short
-forms such as `APPL`, `MEAS`, `OUTP`, and `SYST:ERR?`. This is not a raw command log and does not
-claim separate accuracy or all-model acceptance for every line.
+This page maps DP800 programming-manual domains to the WaveBench capabilities and SCPI surface
+currently exposed by the external `wavebench-rigol-dp800` plugin. The
+[package metadata](../pyproject.toml) is authoritative for version, dependencies, and entry point;
+the [production descriptor](../src/wavebench_rigol_dp800/descriptor.py) for models, channels,
+configuration fields, and capabilities; and the [driver](../src/wavebench_rigol_dp800/driver.py)
+for exact commands, parsing, and transaction behavior.
+
+The [command-coverage development milestones](DP800_COVERAGE_MILESTONES_EN.md) record development
+order, hardware acceptance, and exit gates. That historical/development record does not
+independently add a current capability. A command in the manual or this matrix is not public unless
+the production descriptor declares the corresponding capability.
+
+## Scope
+
+The audit source is RIGOL DP800 family programming manual `PGH03008-1110`. It spans multiple
+models, A/non-A variants, channel counts, ranges, and options. Model parameters therefore are not
+projected onto DP832A, and DP832A evidence is not projected onto the whole family. The local
+transcription is for internal audit only and lives under the Git-ignored, wheel/sdist-excluded
+`doc/vendor-local/` directory.
+
+This matrix reports current coverage across the manual's 22 functional domains rather than using
+set/query variants, abbreviations, or aliases as a completion denominator. The external plugin is a
+narrow power-supply driver governed by safety policy, not a general DP800 SCPI shell.
+
+## Functional coverage
+
+| Domain | Manual command surface | Current public coverage | Current boundary |
+|---|---|---|---|
+| Identity and error queue | `*IDN?`, `:SYSTem:ERRor?`, `:SYSTem:VERSion?` | `power.idn`; configuration writes may read the error queue when configured | `errors()` consumes entries. Structured model/firmware and non-consuming health are not public. |
+| IEEE 488.2 status, reset, trigger | `*CLS`, status registers, `*OPC?`, `*RST`, `*TRG`, `*TST?` | Nothing except `*IDN?` | Reset, trigger, and clearing status have global/output side effects and are denied by default. |
+| Basic setpoints | `:APPLy` / `:APPLy?` | `power.status`; `power.set_voltage_current_limit` | Saves voltage/current, writes once, reads back, and restores on failure. Ambiguous results or unverifiable restoration latch configuration writes. |
+| Live measurement | `:MEASure:ALL?` and scalar queries | `power.measurement`; `power.status` reuses the same snapshot | Uses one `:MEAS:ALL? CH<n>`. Scalar queries are not public, and measurement accuracy is not claimed. |
+| Output state and CV/CC mode | `:OUTPut[:STATe]?`, `:OUTPut:CVCC?` / `:OUTPut:MODE?` | `power.status` | Unknown output/regulation enums fail closed and are not projected to unaccepted models. |
+| Explicit output enable | `:OUTPut[:STATe] [CH<n>,]ON|OFF` | `power.output` | Directly affects the DUT. The driver writes once and reads back; on failure it forces OFF and never blindly retries ON. |
+| OVP/OCP | state, threshold, trip, clear | `power.protection` reads and configures state/threshold/trip | Writes are ordered for safety and read back individually. Recovery never clears a newly observed trip. Clear commands are not public. |
+| `SOURce` setpoint/protection aliases | level, step, triggered level, protection, range | No independent API; immediate setpoints and protection use `APPLy`/`OUTPut` | Step, triggered level, DP811 range, and protection clear are not public. Aliases are not counted twice. |
+| Range, Sense, Track | `:OUTPut:RANGe/SENSe/TRACk` | Not public | Model/channel-dependent; Range changes limits, Sense requires remote wiring, and Track couples channels. |
+| Timer and Delay | `:TIMEr:*`, `:OUTPut:TIMEr*`, `:DELAY:*` | Not public | May change real output over time or by condition. Current scalar snapshots cannot restore them, so start is denied. |
+| Monitor | `:MONItor:*` | Not public | Conditions and actions may disable output or signal alarms and may require an option. |
+| Trigger and `INITiate` | `:TRIGger:*`, `:INITiate`, `*TRG` | Not public | May change trigger levels, switch outputs, drive digital ports, or couple channels; denied by default. |
+| Current-channel selection | `:INSTrument:NSELect/SELect` | Deliberately unused | Every current command carries `CH<n>`, avoiding hidden mutable current-channel state. |
+| Recorder and Analyzer | `:RECorder:*`, `:ANALyzer:*` | Not public | Depend on options and file lifecycle; start/stop, file selection, and analysis mutate state. |
+| Internal state, presets, external files | `:MEMory:*`, `:PRESet:*`, `:RECAll:*`, `:STORe:*`, `:MMEMory:*`, `*SAV/*RCL` | Not public | Save, overwrite, delete, recall, and load have persistent side effects and are denied by default. |
+| Display and front panel | `:DISPlay:*`, brightness, contrast, lock/local/remote | Not public | Mutates global UI or impedes human takeover; ordinary measurement flows do not write front-panel state. |
+| System diagnostics and status | self-test, SCPI version, `:STATus:QUEStionable:*` | Not public | Some event queries clear state; self-test conditions and latency have no public contract. |
+| Communications and global setup | LAN, serial, GPIB, language, power-on, OTP, channel sync | Not public | Network writes may sever the session; other operations mutate persistent/global state and are denied by default. |
+| License and option installation | `:LIC:SET` | Not public | Device-maintenance operation that mutates persistent state; denied by default. |
+
+## Directly used SCPI surface
+
+The commands below use normalized manual-style long names; the implementation uses compatible
+short forms. This is neither a communication log nor a claim of separate accuracy or all-model
+acceptance for every command.
 
 ```text
 *IDN?
@@ -101,48 +79,22 @@ OUTPut:OCP:VALue CH<n>,<current>
 OUTPut:OCP[:STATe] CH<n>,ON|OFF
 ```
 
-`power.status` is not one query: it reads `APPLy?`, `MEASure:ALL?`, output state, and regulation
-mode in sequence. `power.protection` similarly reads six protection fields. The current
-implementation returns no partial public model if an intermediate query fails.
-
-## WaveBench guarantees that are not manual-command coverage
-
-- Core limits, OVP/OCP relationship checks, pre-enable checks, run plans, and experiment-level
-  restoration belong to WaveBench policy/services, not to a DP800 SCPI command.
-- The 2026-07-24 normal-path acceptance snapshotted all three channels before writes and independently
-  verified exact restoration, outputs OFF, and an empty error queue. Controlled fault injection on
-  2026-07-27 additionally accepted M2 output, protection, and `APPLy` recovery/latch semantics. Real
-  instrument restoration is not database-atomic; unverifiable outcomes still fail and latch writes off.
-- Descriptor capability validation proves that declared methods exist, not SCPI semantics,
-  responses, load wiring, measurement accuracy, or compatibility with every DP800 model.
-- Core-configured settle delays do not prove that the output has stabilized to an accuracy target.
-
-## Recommended roadmap
-
-1. **P1: device health and query-only channel profile.** Add non-consuming health plus option/model-gated
-   range, Sense, tracking, timer, and
-   monitor status while retaining explicit channels.
-2. **P2: timer, delay, and monitor.** Begin query-only, then require bounded steps, timeout,
-   finally-stop, complete snapshots, and multi-channel restoration for execution.
-3. **P3: recorder/analyzer.** Define storage lifecycle, size limits, and artifact semantics before
-   recording or exposing query-only analysis results.
-4. **Keep denied by default:** network/interface writes, license, reset/preset, instrument state
-   slots, file deletion/load, and raw trigger actions require a different permission model and
-   human confirmation.
-
-## Evidence boundary
-
-- **Manual:** the local Chinese DP800 transcription under `vendor-local` is for internal audit only;
-  this document neither copies the full manual nor packages it.
-- **Implementation:** external `driver.py`, `descriptor.py`, FakeTransport, lifecycle, and wheel
-  tests, plus the public WaveBench PowerService contract.
-- **Hardware:** controlled DP832A LAN normal-path acceptance on 2026-07-24 covered real-wheel
-  install/routing, three-channel status and protection reads, conservative CH1 setpoint and OVP/OCP
-  writes, unloaded output ON/OFF, full restoration, and error-queue verification. M2 acceptance on
-  2026-07-27 added a distinct-target readback/restore cycle, five controlled fault cases, and separate-session
-  final-state verification after every case.
-- **Not accepted:** other DP800 models, loaded transients, measurement accuracy, range/Sense/tracking,
-  timer/delay, monitor, trigger, recorder/analyzer, storage, and system configuration.
-
-A feature is promoted to **external hardware accepted** only when current external code, targeted
-offline tests, real command acceptance/readback, and required restoration evidence all exist.
+`power.status` reads `APPLy?`, `MEASure:ALL?`, output state, and regulation mode in sequence.
+`power.protection` reads six protection fields. If an intermediate query fails, the driver returns
+no partial public model.
+
+## Behavior and safety boundaries
+
+- Core owns voltage/current safety limits, OVP/OCP relationships, pre-enable checks, run plans, and
+  experiment-level restoration. Those rules are not DP800 SCPI coverage.
+- Current commands always carry an explicit channel and do not mutate hidden current-channel state.
+- A failed multi-write transaction attempts to restore the original snapshot. An ambiguous first
+  write, changed trip, or unverifiable restoration latches further configuration writes.
+- Settle delay, finite-number parsing, and descriptor validation do not prove output stability,
+  correct wiring, measurement accuracy, or whole-family compatibility.
+
+## Related sources
+
+- [Production descriptor](../src/wavebench_rigol_dp800/descriptor.py)
+- [Driver implementation](../src/wavebench_rigol_dp800/driver.py)
+- [Development milestones and hardware evidence](DP800_COVERAGE_MILESTONES_EN.md)
diff --git a/packages/wavebench-rigol-ds1000z/README.md b/packages/wavebench-rigol-ds1000z/README.md
index 9a35d05..8e97782 100644
--- a/packages/wavebench-rigol-ds1000z/README.md
+++ b/packages/wavebench-rigol-ds1000z/README.md
@@ -2,27 +2,22 @@
 
 [English](README_EN.md)
 
-面向四通道 RIGOL DS1104Z、DS1104Z Plus、DS1104Z-S Plus 和兼容 DS1000Z 系列的 WaveBench 可执行仪器插件。
+面向四通道 RIGOL DS1104Z、DS1104Z Plus、DS1104Z-S Plus 和兼容 DS1000Z 系列的 WaveBench 仪器插件。
 
-## 身份与兼容范围
+## 从这里开始
 
-- distribution：`wavebench-rigol-ds1000z`
-- canonical driver ID：`rigol.ds1000z`
-- WaveBench：`>=0.8,<0.9`
-- Python：`>=3.11`
-- transport backend：`pyvisa`
+- [查询当前版本、兼容范围、型号和 capability](../../doc/reference/plugin-catalog.md)
+- [查看受控实机验收记录](doc/DS1000Z_HARDWARE_ACCEPTANCE.md)
+- [安装和管理 WaveBench 插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-该插件不声明 alias。WaveBench 内建的 `ds1104` / `ds1000z` 兼容 alias 仍选择内建 fallback；要显式选择本插件，请在配置中使用 `driver = "rigol.ds1000z"`。
+## 适用范围
 
-## 能力
+显式配置 `driver = "rigol.ds1000z"` 时，WaveBench 使用此外置插件。内建的 `ds1104` 和
+`ds1000z` alias 仍选择 Core fallback；本插件不声明 alias。
 
-- `*IDN?` 和错误队列；
-- CH1–CH4 coupling 查询和显式 autoscale；
-- NORM/RAW/DMAX BYTE 波形读取；
-- RAW 长记录按最多 250000 点分块；
-- CH1–CH4 单通道采集，以及“一次 acquisition、一次 OPC、逐通道读取”的四通道采集；
-- PNG 截图；
-- 分块、总传输和转换 telemetry。
+当前实现覆盖身份与错误队列查询、CH1–CH4 coupling、显式 autoscale、NORM／RAW／DMAX
+BYTE 波形读取、单通道和四通道采集、PNG 截图及传输 telemetry。精确 capability、型号、
+配置字段和兼容范围以 production descriptor 及生成式插件目录为准。
 
 ## 安全边界
 
@@ -45,33 +40,10 @@ check_errors = true
 max_chunk_points = 250000
 ```
 
-## 许可证
+默认测试使用 FakeTransport，不扫描资源、不连接仪器，也不发送真实 SCPI。真实仪器资源、
+序列号、波形、截图和命令日志不得提交。
 
-本插件采用 [MIT License](LICENSE)。
+## 开发与许可证
 
-## 开发验证
-
-在已安装匹配的 WaveBench `v0.8.0` release 环境中：
-
-```bash
-python -m pytest -q packages/wavebench-rigol-ds1000z/tests
-python -m ruff check packages/wavebench-rigol-ds1000z
-python -m wavebench plugin package check packages/wavebench-rigol-ds1000z
-python -m wavebench plugin install packages/wavebench-rigol-ds1000z --dry-run
-```
-
-日常源码开发可使用仓库级 [editable 开发环境](../../doc/DEVELOPMENT.md)；正式验收仍使用真实 wheel 和一次性虚拟环境。
-
-默认测试使用 FakeTransport，不扫描资源、不连接仪器、不发送真实 SCPI。真实仪器资源、序列号、波形、截图和命令日志不得提交。
-
-## 实机验收边界
-
-2026-07-21 在 DS1104Z Plus 上完成脱敏回归：IDN、空错误队列、CH1 高阻 coupling、NORM 1200 点、显式 autoscale、MAX/DMAX 2400000 点分块读取、PNG 截图和 CH1/CH2 单次 acquisition 均通过。MAX/DMAX 各分为 10 个不超过 250000 点的块，前后错误队列均为空。
-
-同日追加四通道实机路径回归：CH1–CH4 coupling 均可查询；一次 acquisition、一次 OPC 后，四个通道均返回 1200 点有限波形，采样间隔均为 2 µs，前后错误队列为空。CH1 当时测得约 2.04 Vpp；CH2–CH4 未接独立测试信号，因此本次只验收其通信和采集路径，不宣称已完成独立模拟幅度验收。
-
-当前 VXI-11 路径读取 2400000 点约需 135 秒，因此该结果证明功能完整性，不代表长记录性能已优化。实测没有写入仓库中的配置、波形、截图或命令日志。
-
-## 来源
-
-0.1.0 初始实现从 WaveBench 主仓库的 DS1000Z 可安装插件试点迁移而来，保留原 canonical ID、entry point、兼容范围和驱动语义。本仓库是迁移后的外置包源码真源。
+日常源码开发和离线验证见仓库级 [editable 开发环境](../../doc/DEVELOPMENT.md)。本插件采用
+[MIT License](LICENSE)。
diff --git a/packages/wavebench-rigol-ds1000z/README_EN.md b/packages/wavebench-rigol-ds1000z/README_EN.md
index 57ccbe5..f15415b 100644
--- a/packages/wavebench-rigol-ds1000z/README_EN.md
+++ b/packages/wavebench-rigol-ds1000z/README_EN.md
@@ -4,50 +4,31 @@
 
 An executable WaveBench instrument plugin for the four-channel RIGOL DS1104Z, DS1104Z Plus, DS1104Z-S Plus, and compatible DS1000Z oscilloscopes.
 
-## Identity and compatibility
+## Start here
 
-- Distribution: `wavebench-rigol-ds1000z`
-- Canonical driver ID: `rigol.ds1000z`
-- WaveBench: `>=0.8,<0.9`
-- Python: `>=3.11`
-- Transport backend: `pyvisa`
+- [Find the current version, compatibility range, models, and capabilities](../../doc/reference/plugin-catalog-en.md)
+- [Read the controlled hardware acceptance record](doc/DS1000Z_HARDWARE_ACCEPTANCE_EN.md)
+- [Install and manage WaveBench plugins](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-The plugin does not define aliases. WaveBench's built-in `ds1104` and `ds1000z` compatibility aliases continue to select the built-in fallback. Use `driver = "rigol.ds1000z"` to select this plugin explicitly.
+## Scope
 
-## Capabilities
+Set `driver = "rigol.ds1000z"` to select this external plugin. The built-in `ds1104` and `ds1000z`
+aliases continue to select the Core fallback; this plugin defines no aliases.
 
-- Instrument identity and error queue queries;
-- CH1-CH4 coupling queries and explicit autoscale;
-- NORM, RAW, and DMAX BYTE waveform reads;
-- RAW long-record transfers in chunks of at most 250,000 points;
-- CH1-CH4 single-channel capture and one-acquisition four-channel capture;
-- PNG screenshots;
-- Chunk, transfer, and conversion telemetry.
+The implementation covers identity and error-queue queries, CH1–CH4 coupling, explicit autoscale,
+NORM/RAW/DMAX BYTE waveform reads, single- and four-channel capture, PNG screenshots, and transfer
+telemetry. The production descriptor and generated plugin catalog are authoritative for exact
+capabilities, models, configuration fields, and compatibility.
 
 ## Security boundary
 
 The plugin opens only the configured transport through WaveBench's `DriverContext`. Importing the descriptor does not connect to an instrument. Python plugins are trusted code, not sandboxes.
 
-The configuration example in the Chinese README uses an RFC 5737 documentation address. Never commit real instrument resources, serial numbers, captures, screenshots, or command logs.
+The configuration example in the Chinese README uses an RFC 5737 documentation address. Default
+tests use FakeTransport and do not scan resources, connect to instruments, or send real SCPI. Never
+commit real instrument resources, serial numbers, captures, screenshots, or command logs.
 
-## License
+## Development and license
 
-This plugin is licensed under the [MIT License](LICENSE).
-
-## Development checks
-
-Run the package tests, Ruff, WaveBench package inspection, and a managed-install dry run from an environment containing the matching WaveBench `v0.8.0` release. Formal `v0.7.0` and a future `0.9` core are outside this package's compatibility range. The default tests use a fake transport and never scan for or connect to hardware.
-
-Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md) for daily source work. Formal acceptance still uses a real wheel and a disposable virtual environment.
-
-## Hardware acceptance boundary
-
-On 2026-07-21, a sanitized DS1104Z Plus regression passed identity, an empty error queue, high-impedance CH1 coupling, a 1,200-point NORM read, explicit autoscale, 2,400,000-point MAX and DMAX chunked reads, a PNG screenshot, and a one-acquisition CH1/CH2 capture. Each MAX/DMAX transfer used ten chunks of at most 250,000 points, and the error queue was empty before and after the run.
-
-A four-channel hardware-path regression later that day queried coupling on CH1-CH4 and returned a finite 1,200-point waveform for every channel after one acquisition and one OPC wait. All four waveforms used a 2 µs sample interval, and the error queue was empty before and after the run. CH1 measured about 2.04 Vpp at the time. CH2-CH4 had no independent test signals connected, so this run validates their communication and acquisition paths, not independent analog-amplitude accuracy.
-
-The current VXI-11 path took about 135 seconds per 2,400,000-point transfer. This proves functional completeness, not optimized long-record performance. No real resource, capture, screenshot, or command log was written to this repository.
-
-## Provenance
-
-The initial 0.1.0 implementation was migrated from WaveBench's installable DS1000Z pilot package. It preserves the original canonical ID, entry point, compatibility range, and driver semantics. This repository is the source of truth for the external package after migration.
+Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md) for daily
+source work and offline checks. This plugin is licensed under the [MIT License](LICENSE).
diff --git a/packages/wavebench-rigol-ds1000z/doc/DS1000Z_HARDWARE_ACCEPTANCE.md b/packages/wavebench-rigol-ds1000z/doc/DS1000Z_HARDWARE_ACCEPTANCE.md
new file mode 100644
index 0000000..4a926da
--- /dev/null
+++ b/packages/wavebench-rigol-ds1000z/doc/DS1000Z_HARDWARE_ACCEPTANCE.md
@@ -0,0 +1,32 @@
+# DS1000Z 受控实机验收记录
+
+[English](DS1000Z_HARDWARE_ACCEPTANCE_EN.md)
+
+> 类型：Historical evidence
+> 范围：2026-07-21 的 DS1104Z Plus 脱敏回归
+> 当前能力入口：[生成式插件目录](../../../doc/reference/plugin-catalog.md)
+
+本页保留特定设备、连接和时间点的验收结果，不替代 production descriptor，也不表示所有
+DS1000Z 型号均完成相同的模拟精度或性能验证。
+
+## 单通道与长记录
+
+身份、空错误队列、CH1 高阻 coupling、NORM 1200 点、显式 autoscale、MAX／DMAX 2400000 点
+分块读取、PNG 截图和 CH1／CH2 单次 acquisition 均通过。MAX／DMAX 各分为 10 个不超过
+250000 点的块，前后错误队列均为空。
+
+## 四通道路径
+
+CH1–CH4 coupling 均可查询。一次 acquisition、一次 OPC 后，四个通道均返回 1200 点有限波形，
+采样间隔均为 2 µs，前后错误队列为空。CH1 当时测得约 2.04 Vpp；CH2–CH4 未接独立测试信号，
+因此本次只验收其通信和采集路径，不表示已经完成独立模拟幅度验收。
+
+## 性能与证据边界
+
+当时的 VXI-11 路径读取 2400000 点约需 135 秒。该结果证明功能完整性，不表示长记录性能已经
+优化。验收没有向仓库写入真实配置、仪器资源、序列号、波形、截图或命令日志。
+
+## 来源
+
+`0.1.0` 初始实现从 WaveBench 主仓库的 DS1000Z 可安装插件试点迁移而来，保留原 canonical ID、
+entry point、兼容范围和驱动语义。本仓库是迁移后外置包的源码事实源。
diff --git a/packages/wavebench-rigol-ds1000z/doc/DS1000Z_HARDWARE_ACCEPTANCE_EN.md b/packages/wavebench-rigol-ds1000z/doc/DS1000Z_HARDWARE_ACCEPTANCE_EN.md
new file mode 100644
index 0000000..5064ec4
--- /dev/null
+++ b/packages/wavebench-rigol-ds1000z/doc/DS1000Z_HARDWARE_ACCEPTANCE_EN.md
@@ -0,0 +1,37 @@
+# DS1000Z Controlled Hardware Acceptance
+
+[中文](DS1000Z_HARDWARE_ACCEPTANCE.md)
+
+> Type: Historical evidence
+> Scope: sanitized DS1104Z Plus regression on 2026-07-21
+> Current capability entry: [generated plugin catalog](../../../doc/reference/plugin-catalog-en.md)
+
+This page preserves results for a particular device, connection, and point in time. It does not
+replace the production descriptor or imply equal analog-accuracy or performance coverage for every
+DS1000Z model.
+
+## Single-channel and long-record paths
+
+Identity, an empty error queue, high-impedance CH1 coupling, a 1,200-point NORM read, explicit
+autoscale, 2,400,000-point MAX and DMAX chunked reads, a PNG screenshot, and one-acquisition CH1/CH2
+capture all passed. Each MAX/DMAX transfer used ten chunks of at most 250,000 points, and the error
+queue was empty before and after the run.
+
+## Four-channel path
+
+Coupling queries passed for CH1–CH4. After one acquisition and one OPC wait, every channel returned
+a finite 1,200-point waveform with a 2 µs sample interval, and the error queue remained empty. CH1
+measured about 2.04 Vpp at the time. CH2–CH4 had no independent test signal, so the run validates
+their communication and acquisition paths, not independent analog-amplitude accuracy.
+
+## Performance and evidence boundary
+
+The VXI-11 path took about 135 seconds per 2,400,000-point transfer at the time. This establishes
+functional completeness, not optimized long-record performance. The acceptance wrote no real
+configuration, resource, serial number, waveform, screenshot, or command log to the repository.
+
+## Provenance
+
+The initial `0.1.0` implementation was migrated from WaveBench's installable DS1000Z pilot package.
+It preserves the original canonical ID, entry point, compatibility range, and driver semantics. This
+repository is the source of truth for the external package after migration.
diff --git a/packages/wavebench-rigol-dsg830/README.md b/packages/wavebench-rigol-dsg830/README.md
index 8ac00d7..49936e4 100644
--- a/packages/wavebench-rigol-dsg830/README.md
+++ b/packages/wavebench-rigol-dsg830/README.md
@@ -2,79 +2,19 @@
 
 [English](README_EN.md)
 
-面向 RIGOL DSG830 射频信号发生器的 WaveBench 可执行仪器插件。DSG800 系列编程手册覆盖
-DSG830 和 DSG815；本包首版仅将 DSG830 作为已登记目标型号。
+面向 RIGOL DSG830 射频信号发生器的 WaveBench 仪器插件。该包注册 canonical driver ID `rigol.dsg830`，不声明 alias，也不覆盖 WaveBench 内置驱动。
 
-## 当前状态
+## 从这里开始
 
-版本 `0.2.0` 已完成 RF M0 只读迁移、M1 离线 CW 映射、M2 离线输出映射、M3 内部正弦调制映射、M3-MO 受限调制输出合同、M4 的 Pulse 与 frequency-only Step Sweep 生产子集，以及一条受限 A5 Pulse Output 路径：descriptor 使用 `kind="rf_source"`，声明单端口 `rf_out` 的静态范围与 50 Ω dBm 参考，并实现严格的 snapshot parser、`:FREQ`／`:LEV`／`:OUTP ON|OFF` 的单次 driver 映射、AM／FM／PM 的内部 Sine 配置与 readback、internal／single Pulse 的 period／width／polarity 配置与读回、保持 Sweep disabled 的 Step Sweep profile 映射，以及 `:PULM:OUT:STAT` 的状态映射。
+- [查询当前 capability、profile 和限制](doc/reference.md)
+- [查阅开发里程碑与实机证据](doc/README.md)
+- [在 WaveBench Core 中安装和管理插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-A1 只读证据、A2 受控输出证据、A3 CW 环回证据、A4 调制／Pulse／Step Sweep 证据、A4-MO 固定调制输出证据和一条 A5 Pulse Output 证据均已完成并复核。production descriptor 现在声明 `rf_source.idn`、`rf_source.snapshot`、`rf_source.cw_configure`、`rf_source.output`、`rf_source.modulation_configure`、`rf_source.modulation_disable`、`rf_source.modulated_output_enable`、`rf_source.pulse_configure`、`rf_source.pulse_output` 和 `rf_source.sweep_configure`。在 `read_write` session 中，CW、调制、Pulse 与 Step Sweep 配置要求目标端口明确 OFF 和完整 OFF-only preflight；Pulse Output 另要求已声明接口与固定 profile 的独立 preflight；普通 RF ON/OFF 还要求完整端口 safety 配置、fresh snapshot 与独立 readback，且普通 ON 仍要求调制关闭。示例配置仍保持 `read_only`，不会默认开放写入。
+包元数据和 production descriptor 是当前版本、兼容范围与 capability 的权威来源。仓库级[生成式插件目录](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/reference/plugin-catalog.md)提供可检查的摘要。
 
-A2 的本地受控输出 harness、回归测试和不含资源地址的 setup 模板保留在源码 checkout，作为验收协议的回归保护。证据已确认最终 RF OFF；harness 在 production descriptor 已声明 `rf_source.output` 后会拒绝重跑，避免用临时 descriptor 绕过正式 capability。A2 本身不授权 CW，后者由独立 A3 证据提升。
+## 只读起步
 
-A3 的本地 CW 环回 harness、回归测试和不含资源地址的 setup 模板也保留在源码 checkout。它确认初始 RF OFF、两次 OFF-only CW 写入的独立回读、一次低功率 RF ON/OFF、CH2 的当前缓冲区可见信号和最终 RF OFF；CH2 只用于确认可见信号，频率与功率仍以源端 readback 为准。脱敏证据通过后，`rf_source.cw_configure` 已单独进入 production descriptor。
-
-M3 driver 已实现状态读取、`get_rf_modulation_snapshot()`、`configure_rf_modulation()` 与 `disable_rf_modulation()` 的离线映射。离线范围仅为内部 Sine：AM 深度 `0–100 %`、FM 频偏 `0.1 Hz–1 MHz`、PM 相偏 `0–5 rad`，三种模式的内部频率均为 `10 Hz–100 kHz`。当前 production descriptor 保持较窄的已验证 profile：AM `0–100 %`、FM `0.1 Hz–1 MHz`、PM 精确 `1.25 rad`，内部频率均为 `10 Hz–100 kHz`。Core 在配置写入前要求 RF OFF、AM／FM／PM 全部关闭、Pulse／Sweep 关闭和无活动 protection condition。FM／PM 的共享选择位会被单独读回：三种模式均关闭时可从另一选择切换到目标类型，写后必须独立确认目标类型、仅目标模式与全局调制开关开启。`disable_rf_modulation()` 只在 RF OFF 且仅目标模式活动时关闭该模式和全局调制；它不是 reset，也不重试结果不明的写入。A4 调制与 A4-MO 清理证据已覆盖该事务，因此 production descriptor 声明 `rf_source.modulation_disable`。
-
-源码 checkout 已提供 A4 的 RF-OFF 调制 evidence harness、fake 回归与不含资源地址的 setup 模板。每次只能验证一个内部 Sine 模式；成功路径在配置读回后关闭同一模式，并在最终状态确认 `rf_out` 与调制均为关闭。显式 `--recover` 只恢复已明确识别的单一活动模式，并写入私有恢复记录。显式 `--diagnose` 保留原始 `read_only` 配置，只读取初始／最终 RF snapshot 与指定模式 profile，并要求 transport audit 为零写。A4 不读取 CH2、不调用 RF 输出控制，恢复或诊断记录均不构成新的 capability 提升证据。AM／FM／PM 的 RF-OFF 序列均已通过；为使 production profile 与 PM 的严格读回证据一致，PM 仅开放 `1.25 rad`。
-
-M3-MO 把调制开启时的 RF 输出定义为独立的 `rf_source.modulated_output_enable`，不会放宽普通 `rf_source.output`。它只接受已经激活、完整 readback 精确匹配的内部 Sine profile，并要求 RF OFF、Pulse／Sweep disabled、protection 清晰、完整端口 safety 配置和明确的 50 Ω 实际端接；成功时只执行一次 RF ON。写入或 readback 不确定时不重试 ON，只可能调用一次既有的受 guard RF OFF recovery。A4-MO 已完成三条受控实机验收：AM `50 %`／`1 kHz`、FM `20 kHz` 频偏／`1 kHz`、PM `1.25 rad` 相偏／`1 kHz`，均使用 RF `1 MHz`／`-50 dBm`。CH2 当前 `DEF` 缓冲区在显式 50 Ω 前提下观察到信号；FM／PM 记录还使用 WaveBench 波形摘要和 FFT 保存信号存在、幅度、载波与频谱质量告警。该分析不推断 dBm、频偏、相偏、调制准确度或频谱合规性。scope 不读取或控制 CH1，也不把 LF OUTPUT 解释为调制测量。三条路径的最终 RF OFF、目标／全局调制关闭和 session 健康关闭均已复核。production descriptor 因此只声明 AM `50 %`／`1 kHz`、FM `20 kHz`／`1 kHz`、PM `1.25 rad`／`1 kHz`、最大 `-50 dBm` 的 profile；结束时必须显式 RF OFF，再用 `rf_source.modulation_disable` 清理调制。
-
-M4 Pulse 只覆盖 internal／single 子集。`configure_rf_pulse()` 固定设置 source、mode、period、width 和 polarity，并以 `:PULM:STAT OFF` 收尾；它不调用 RF 输出、后面板 Pulse I/O 或 trigger。源码 checkout 的 `tools/a4_pulse_evidence.py`、fake 回归与无资源 setup 模板已完成受控实机验证：normal／inverted 两种 polarity 都经过一次 RF-OFF／Pulse-OFF 配置、独立读回和最终关闭复核；每次成功路径均为 38 次 query、6 次配置 write。`--diagnose` 保持 `read_only` 且零写；两种模式均不读取 CH1／CH2。证据复核后，`rf_source.pulse_configure` 已进入 production descriptor，historical harness 会拒绝重跑。
-
-M4 frequency-only Step Sweep 仅覆盖固定的 `STEP`／`FWD`／`RAMP`／`LIN` profile。`get_rf_sweep_snapshot()` 查询 type、direction、shape、spacing、起止频率、点数、驻留时间和状态；`configure_rf_sweep()` 只写这些 profile 字段，并以 `:SWE:STAT OFF` 收尾。它不写 `:SWE:EXEC`、任何 trigger、Level Sweep、list、RF 输出或后面板接口命令。Core 在写前和写后都要求 RF 输出、调制、Pulse、Sweep 关闭且无活动 protection，写后独立读回完整 profile。源码 checkout 的 `tools/a4_step_sweep_evidence.py` 与无资源 setup 模板已通过 fake 回归和专项实机验收：`--diagnose` 固定 25 次 query、零 write，显式 `--execute` 的成功路径固定 41 次 query、9 条配置 write。工具不读取 Scope、不调用 RF output、不 arm／fire Sweep；最终独立复核 RF 输出、调制、Pulse、Sweep 关闭且无活动 protection。证据复核后，`rf_source.sweep_configure` 已进入 production descriptor，historical harness 会拒绝重跑。
-
-A5-0 已在离线代码中提供 `get_rf_trigger_snapshot()`：它固定读取 Pulse trigger mode、external trigger edge、external gate polarity、Sweep mode、Sweep period trigger 与 Sweep point trigger，并严格拒绝未知响应。六条命令均为 query；driver 不发送 setter、`*TRG`、`:TRIG:PULS`、`:TRIG:SWE`、`:SWE:EXEC`、`:PULM:OUT` 或 RF 输出写入。该映射只观察逻辑 configuration，`rf_out` 不是物理 trigger／sync connector。
-
-受限 A5 物理验收已覆盖唯一一条路径：DSG830「PULSE IN/OUT」按 output 方向接入 RTM2032「EXT TRIGGER INPUT」。`rf_source.pulse_output` 只切换该 output 的状态；profile 固定为 `0 V`／`3.3 V`、约 `600 Ω`、internal／single／normal、period `1 ms`、width `100 μs`，并要求 RF 输出、调制、Pulse 与 Sweep 都关闭。验收 harness 在隔离 scope session 中执行 external／normal／single／auto 触发序列，scope 不属于 RTM production API。成功记录确认最终 RF 输出和 Pulse Output 均关闭；source Pulse profile 与 scope acquisition state 不在恢复范围。该 profile 的电气参数以 [DSG800A 数据表](https://www.rigol.com/dam/global/downloads/brochures/en/data-sheet/rf-signal-generators/DSG800A_datasheet_EN.pdf) 为准。historical harness 在 capability 提升后拒绝重跑。
-
-production descriptor 不声明错误队列、`rf_source.trigger_snapshot`、Pulse input、`TRIGGER IN`、trigger、Sweep execute／fire、sync／reference、Level Sweep、list 或任意 SCPI passthrough。`rf_source.cw_configure` 只覆盖已审计的 `rf_out` OFF-only 频率／dBm 功率单字段写入，`rf_source.output` 只覆盖已审计的 `rf_out` ON/OFF，且普通 ON 仍要求调制关闭；`rf_source.modulation_configure` 只覆盖已验收的 RF-OFF 内部 Sine profile（PM 精确 `1.25 rad`），`rf_source.modulation_disable` 只关闭 RF OFF 时唯一已知活动模式，`rf_source.modulated_output_enable` 只覆盖 AM `50 %`／`1 kHz`、FM `20 kHz`／`1 kHz`、PM `1.25 rad`／`1 kHz`、最大 `-50 dBm`，`rf_source.pulse_configure` 只覆盖已验收的 RF-OFF internal／single 配置并保持 Pulse OFF，`rf_source.pulse_output` 只覆盖 `pulse_in_out` 的固定 output profile，`rf_source.sweep_configure` 只覆盖已验收的 fixed profile 配置并保持 Sweep disabled；其余 capability 继续经过对应的 A5 实机证据门。
-
-## 开发文档
-
-- [DSG830 插件文档入口](doc/README.md)
-- [DSG830 功能覆盖里程碑](doc/DSG830_COVERAGE_MILESTONES.md)
-- [A2 本地证据 setup 模板](tools/a2_output_evidence.setup.template.toml)
-- [A3 本地证据 setup 模板](tools/a3_cw_evidence.setup.template.toml)
-- [A4 本地证据 setup 模板](tools/a4_modulation_evidence.setup.template.toml)
-- [A4-MO 本地证据 setup 模板](tools/a4_modulated_output_evidence.setup.template.toml)
-- [A4-MO FM／PM 本地证据 setup 模板](tools/a4_fm_pm_modulated_output_evidence.setup.template.toml)
-- [A4 Pulse 本地证据 setup 模板](tools/a4_pulse_evidence.setup.template.toml)
-- [A4 Step Sweep 本地证据 setup 模板](tools/a4_step_sweep_evidence.setup.template.toml)
-- [A5-0 trigger configuration 本地诊断 setup 模板](tools/a5_trigger_snapshot_evidence.setup.template.toml)
-- [A5 Pulse Output 本地证据 setup 模板](tools/a5_pulse_output_evidence.setup.template.toml)
-
-里程碑明确区分当前种子、离线合同和 A1–A5 实机证据。production descriptor 的 capability 不会因种子代码或 fake transport 测试自动提升。
-
-## 身份与兼容范围
-
-- distribution：`wavebench-rigol-dsg830`
-- canonical driver ID：`rigol.dsg830`
-- 已登记型号：`DSG830`
-- WaveBench：`>=0.8.25,<0.9`
-- Python：`>=3.11`
-- transport backend：`pyvisa`
-- 手册记载的连接方式：USB、LAN
-
-该插件不声明 alias，也不覆盖 WaveBench 内置驱动。使用时应显式配置 canonical ID `rigol.dsg830`。
-
-## 本地编程手册
-
-厂商原文保存在被忽略的 [`doc/vendor-local/`](doc/vendor-local/README.md) 目录。推荐文件名：
-
-```text
-DSG800_ProgrammingGuide_EN.pdf
-DSG800_ProgrammingGuide_EN.md
-```
-
-官方原文为 [DSG800 ProgrammingGuide V1.0](https://www.rigol.com/intl/dam/global/downloads/brochures/en/program-guide/rf-signal-generators/DSG800_ProgrammingGuide_EN.pdf)。
-普源官网将其列为 DSG800 系列的 Programming Guide，页面记录版本 `V1.0`、日期 `2019-09-30`。
-手册前言说明该系列包含 DSG830 和 DSG815，且命令说明默认以 DSG830 为例。原始 PDF 和转换稿均不得进入 Git 或发行包。
-
-## 当前配置（只读身份和状态）
-
-以下示例使用 RFC 5737 文档保留地址，并以 `read_only` 权限执行身份查询和状态快照：
+以下配置使用 RFC 5737 文档保留地址，只允许身份和状态查询：
 
 ```toml
 [rf_source]
@@ -83,27 +23,18 @@ resource = "TCPIP::192.0.2.83::INSTR"
 access = "read_only"
 ```
 
-该 `[rf_source]` 配置用于 production descriptor 的 `rf_source.idn` 与 `rf_source.snapshot`。它不属于普通 source 的 Vpp、channel 或 run plan 工作流。未来能量相关 capability 还要求按 `port_id` 提供完整安全配置和真实端接声明；本包不会从连接器标签推断实际端接。
+`read_only` 配置不会执行 reset、RF 输出切换、频率或功率写入、调制、Pulse 或 Sweep 配置。精确配置字段和通用运行方式以 [WaveBench Core 配置 Reference](https://github.com/Scaxlibur/wavebench/blob/master/docs/reference/configuration.md)为准。
 
 ## 安全边界
 
-- descriptor 导入不创建 transport、不扫描端口、不发送 SCPI。
-- factory 只通过 `DriverContext` 打开当前配置的 transport。
-- 默认测试只使用 fake transport，不连接真实仪器。
-- snapshot 仅发送 `*IDN?`、`:FREQ?`、`:LEV?`、`:OUTP?`、`:MOD:STAT?`、`:PULM:STAT?`、`:SWE:STAT?` 与 `:STAT:QUES:POW:COND?`；A1 已使这条只读路径成为 production capability。
-- 默认测试只使用 fake transport，不会连接硬件。production 的普通 `read_only` 配置不会执行 reset、RF 输出切换、功率／频率设置、触发、调制或扫频配置；A2/A3/A4/A4-MO/A5 的受控证据已分别开放 safety-gated 输出、OFF-only CW、RF-OFF 调制及关闭、Pulse、Step Sweep、固定 profile 调制输出和一条 Pulse Output 路径，普通写入仍须显式 `read_write`、相应 capability 和完整 preflight。M3-MO 只接受 AM `50 %`／`1 kHz`、FM `20 kHz`／`1 kHz`、PM `1.25 rad`／`1 kHz`、最大 `-50 dBm`，普通 RF ON 仍要求调制关闭。A5 不包含 Pulse input、`TRIGGER IN`、execute、arm、fire、trigger、sync／reference、Level Sweep 或 list。
-- 实机测试必须单独授权，并先确认资源、固件、终止符、RF 输出状态、安全限制和恢复方式。
-
-### 受控 RF 观察的电气边界
-
-- 当前受控接线将 RF 输出直连至示波器 CH2 的已确认 50 Ω 输入；LF 输出接入 CH1 高阻，仅作为独立的补充观察路径。当前 DSG830 capability 不控制 LF 输出，也不将 CH1 结果作为 RF 输出、调制或 trigger／sync 的证据。
-- CH2 的输入电压必须低于 `5 V RMS`。对于没有外接放大器的直连 50 Ω 路径，该限制约等于 `+26.99 dBm`；descriptor 声明的最高 `+20 dBm` 对应约 `2.24 V RMS`。已完成的受控实机证据仅使用不高于 `-40 dBm` 的功率，固定 A4-MO profile 为 `-50 dBm`。
-- 此换算只用于核对 50 Ω 直连的电气余量，不可将 source 的 dBm 读回改写为 Vpp 测量，也不适用于带外接放大器、其他终端或不同仪器输入额定值的接线。此类变更须重新确认安全限制和恢复方案。
-
-### 受控 Pulse Output 的电气边界
+- descriptor 导入不创建 transport、不扫描端口，也不发送 SCPI。
+- factory 只通过 `DriverContext` 打开已配置的 transport。
+- 写操作必须显式使用 `read_write`，并满足对应 capability、设备状态、端口安全限制和 readback 要求。
+- `rf_out` 的 50 Ω dBm 参考不等于实际端接；WaveBench 不从连接器名称推断负载。
+- 后面板 `PULSE IN/OUT` 与 50 Ω RF 输出是不同接口，不得共用电气假设。
+- 实机测试必须单独授权，并预先确认资源、固件、端接、初始输出状态、安全限制和恢复方式。
 
-- 已验证接线仅为 DSG830「PULSE IN/OUT」output → RTM2032「EXT TRIGGER INPUT」。DSG830 profile 固定 `0 V`／`3.3 V`、约 `600 Ω`；scope 的该输入为高阻 trigger 输入，不是 CH2 的 50 Ω RF 路径。
-- `rf_source.pulse_output` 不检测或配置接收端，也不从接收端状态推断写入成功；成功条件以 DSG830 独立 readback 和最终关闭为准。修改接收端、线缆、转接件、Pulse profile 或接口方向时，必须重新建立专门证据。
+默认测试使用 fake transport，不连接真实仪器。当前开放的写入范围、固定 profile 和明确拒绝项见[当前 Reference](doc/reference.md)。
 
 ## 开发验证
 
@@ -113,7 +44,7 @@ python -m ruff check packages/wavebench-rigol-dsg830
 python -m wavebench plugin package check packages/wavebench-rigol-dsg830
 ```
 
-日常源码开发可使用仓库级 [editable 开发环境](../../doc/DEVELOPMENT.md)。正式验收仍使用真实 wheel 和一次性虚拟环境。
+日常源码开发可使用仓库级 [editable 开发环境](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/DEVELOPMENT.md)。
 
 ## 许可证
 
diff --git a/packages/wavebench-rigol-dsg830/README_EN.md b/packages/wavebench-rigol-dsg830/README_EN.md
index aa405d5..eb123ce 100644
--- a/packages/wavebench-rigol-dsg830/README_EN.md
+++ b/packages/wavebench-rigol-dsg830/README_EN.md
@@ -2,140 +2,19 @@
 
 [中文](README.md)
 
-This is a WaveBench executable instrument plugin for the RIGOL DSG830 RF signal generator. The
-DSG800 programming guide covers DSG830 and DSG815; this initial package registers DSG830 only.
-
-## Current status
-
-Version `0.2.0` completes the RF M0 read-only migration, M1 offline CW mapping, M2 offline output
-mapping, M3 internal-sine modulation mapping, the M3-MO bounded modulated-output contract, M4 Pulse plus the production frequency-only Step Sweep subset, and one bounded A5 Pulse Output route: its descriptor uses
-`kind="rf_source"`, declares one `rf_out` port with static limits and a 50-ohm dBm reference, and ships a
-strict snapshot parser plus one-write `:FREQ`/`:LEV`/`:OUTP ON|OFF` mappings, internal-sine AM/FM/PM
-configuration/readback mappings, internal/single Pulse timing/polarity mapping, a `:PULM:OUT:STAT` mapping, and a disabled Step Sweep profile mapping.
-
-A1 read-only evidence, A2 controlled-output evidence, A3 CW-loopback evidence, A4 modulation/Pulse/Step Sweep evidence, fixed-profile A4-MO evidence, and one A5 Pulse Output route have completed and been reviewed.
-The production descriptor declares `rf_source.idn`, `rf_source.snapshot`, `rf_source.cw_configure`,
-`rf_source.output`, `rf_source.modulation_configure`, `rf_source.modulation_disable`, `rf_source.modulated_output_enable`, `rf_source.pulse_configure`, `rf_source.pulse_output`, and `rf_source.sweep_configure`. A `read_write` CW, modulation, Pulse, Pulse Output, or Step Sweep request requires its declared preflight; ordinary RF ON/OFF
-also requires complete per-port safety configuration, a fresh snapshot, and independent readback. Ordinary RF ON still requires modulation disabled. The example
-configuration remains `read_only` and does not enable writes by default.
-
-The local A2 controlled-output harness, regression tests, and resource-free setup template remain in the source
-checkout as regression protection for this acceptance protocol. The evidence confirms final RF OFF; after the
-production descriptor declares `rf_source.output`, the harness refuses reruns so a temporary descriptor cannot bypass
-the production capability. A2 itself does not authorize CW; the separate A3 evidence promotes it.
-
-The local A3 CW-loopback harness, regression tests, and resource-free setup template are also in the source checkout.
-They require initial RF OFF, independent readback for two OFF-only CW writes, one low-power RF ON/OFF, and a current
-CH2-buffer signal observation. CH2 only establishes visible signal; source readback remains the frequency and power
-evidence. Its completed, reviewed evidence separately promotes `rf_source.cw_configure`.
-
-The M3 driver implements offline state readback plus `get_rf_modulation_snapshot()`, `configure_rf_modulation()`, and
-`disable_rf_modulation()` mappings for internal Sine only: AM depth `0–100 %`, FM deviation `0.1 Hz–1 MHz`, PM
-deviation `0–5 rad`, and a `10 Hz–100 kHz` internal frequency for each mode. The production descriptor narrows this to the verified profile: AM `0–100 %`, FM `0.1 Hz–1 MHz`, PM exactly `1.25 rad`, and `10 Hz–100 kHz` internal frequency. Core requires RF OFF, all AM/FM/PM modes
-disabled, Pulse/Sweep disabled, and no active protection condition before a configuration write. The shared FM/PM
-selection is read separately: when all modes are disabled, a different inactive selection may be changed to the
-requested type, and postcondition then requires that target type, exactly the target mode, and the global modulation
-switch. `disable_rf_modulation()` only disables the requested mode and global modulation when RF is OFF and that mode is
-the only active one; it is not a reset and does not retry an uncertain write.
-
-The source checkout includes an A4 RF-OFF modulation-evidence harness, fake regressions, and a resource-free setup
-template. Each invocation validates one internal-Sine mode; after configuration readback, it disables that same mode and
-the final state must establish both RF output and modulation OFF. Explicit `--recover` only restores a known single
-active mode and writes a private recovery record. Explicit `--diagnose` retains the original `read_only` configuration,
-reads the initial/final RF snapshots and one requested profile, and requires a zero-write transport audit. A4 does not
-read CH2 or invoke RF-output control; recovery and diagnostic records are not new capability-promotion evidence. AM, FM,
-and PM RF-OFF sequences passed; PM is limited to `1.25 rad` in the production profile to match the strict readback evidence.
-
-M3-MO makes RF output with active modulation a separate `rf_source.modulated_output_enable` capability rather than
-relaxing ordinary `rf_source.output`. It accepts only an already-active, exactly read-back internal-Sine profile and
-requires RF OFF, Pulse/Sweep disabled, clear protection, complete per-port safety configuration, and a confirmed
-50-ohm actual termination; success performs exactly one RF ON. An uncertain write or readback never retries ON and may
-only use the existing one-shot guarded RF-OFF recovery. A4-MO completed controlled hardware acceptance for AM `50 %` at
-`1 kHz`, FM `20 kHz` deviation at `1 kHz`, and PM `1.25 rad` deviation at `1 kHz`, each with RF `1 MHz` at `-50 dBm`.
-CH2's current `DEF` buffer showed signal presence with an explicit 50-ohm declaration. The FM/PM records additionally
-use WaveBench waveform summary and FFT analysis for amplitude, carrier, and spectral-quality observations; they do not
-infer dBm, FM deviation, PM deviation, modulation accuracy, or spectral compliance. The scope neither reads nor controls
-CH1 or interprets LF OUTPUT as a modulation measurement. Final RF OFF, target/global modulation OFF, and healthy closure
-were independently verified. The production descriptor therefore declares AM `50 %`/`1 kHz`, FM `20 kHz`/`1 kHz`, and PM
-`1.25 rad`/`1 kHz`, all with maximum `-50 dBm`; callers must explicitly turn RF OFF and then use
-`rf_source.modulation_disable` for cleanup.
-
-The M4 Pulse subset is internal/single only. `configure_rf_pulse()` fixes source, mode, period, width, and polarity,
-then ends with `:PULM:STAT OFF`; it never invokes RF output, rear Pulse I/O, or trigger commands. The source checkout
-now includes `tools/a4_pulse_evidence.py`, fake regressions, and a resource-free setup template. Its `--execute` path
-allows one RF-OFF/Pulse-OFF configuration and independent readback, while `--diagnose` preserves `read_only` and has a
-zero-write audit. Neither path reads CH1/CH2. Controlled hardware validation has now passed for both normal and
-inverted polarity, with one RF-OFF/Pulse-OFF configuration, independent readback, and final-off verification per run;
-each successful path has 38 queries and 6 configuration writes. After evidence review,
-`rf_source.pulse_configure` is production-declared and the historical harness rejects reruns.
-
-The M4 frequency-only Step Sweep subset fixes `STEP`/`FWD`/`RAMP`/`LIN`. `get_rf_sweep_snapshot()` reads type,
-direction, shape, spacing, start/stop frequency, points, dwell, and state; `configure_rf_sweep()` writes only that
-profile and ends with `:SWE:STAT OFF`. It never writes `:SWE:EXEC`, any trigger, Level Sweep, list setup, RF output,
-or rear-panel I/O. Core requires RF output, modulation, Pulse, and Sweep OFF with no active protection before and
-after the write, then independently reads the complete profile. The source checkout includes
-`tools/a4_step_sweep_evidence.py` and a resource-free template, both covered by fake regressions and controlled hardware acceptance: `--diagnose` has
-25 queries and zero writes, while a successful explicit `--execute` path has 41 queries and 9 configuration writes.
-It does not read scope, invoke RF output, or arm/fire Sweep. Both paths passed, with an independent final confirmation that RF output, modulation, Pulse, and Sweep were disabled and no protection condition was active. The historical harness rejects reruns after the promotion.
-
-The A5-0 offline mapping adds `get_rf_trigger_snapshot()`, which strictly reads logical Pulse/Sweep trigger configuration through six fixed query forms. It sends no setter, `*TRG`, `:TRIG:PULS`, `:TRIG:SWE`, `:SWE:EXEC`, `:PULM:OUT`, or RF-output write. It is not a physical trigger/sync connector contract; `rf_out` only identifies the RF output whose behavior the settings govern.
-
-The bounded A5 physical acceptance covers exactly one route: DSG830 `PULSE IN/OUT` in the output direction to an RTM2032 `EXT TRIGGER INPUT`. `rf_source.pulse_output` only changes that output state. Its fixed profile is `0 V`/`3.3 V`, about `600 ohms`, internal/single/normal, period `1 ms`, width `100 us`; RF output, modulation, Pulse, and Sweep must remain off. The isolated harness uses the scope only for an external/normal/single/auto trigger sequence, so it creates neither an RTM driver API nor an RTM production capability. The successful record independently confirms final RF output and Pulse Output OFF. The existing Pulse profile and scope acquisition state are deliberately not restored. Electrical values follow the [DSG800A datasheet](https://www.rigol.com/dam/global/downloads/brochures/en/data-sheet/rf-signal-generators/DSG800A_datasheet_EN.pdf); the historical harness rejects reruns after promotion.
-
-The production descriptor declares no error queue, `rf_source.trigger_snapshot`, Pulse input, `TRIGGER IN`, trigger, Sweep execution/fire, sync/reference control, Level Sweep, list control, or arbitrary SCPI passthrough.
-`rf_source.cw_configure` covers only audited OFF-only single-field frequency/dBm writes on `rf_out`, and
-`rf_source.output` only audited `rf_out` ON/OFF. `rf_source.pulse_configure` covers only the verified RF-OFF
-internal/single profile and leaves Pulse OFF. `rf_source.pulse_output` covers only the fixed output profile of `pulse_in_out`. `rf_source.sweep_configure` covers only the verified fixed profile and leaves Sweep disabled.
-`rf_source.modulation_configure` covers only the verified RF-OFF internal-Sine profile, with PM exactly `1.25 rad`; `rf_source.modulation_disable` only closes one known active mode while RF is OFF; `rf_source.modulated_output_enable` covers AM `50 %` at `1 kHz`, FM `20 kHz` at `1 kHz`, and PM `1.25 rad` at `1 kHz`, all with maximum `-50 dBm`; ordinary `rf_source.output` ON still requires modulation disabled. Every other capability remains behind its A4–A5 evidence gate.
-
-## Development documentation
-
-- [DSG830 plugin documentation](doc/README_EN.md)
-- [DSG830 coverage milestones](doc/DSG830_COVERAGE_MILESTONES_EN.md)
-- [A2 local-evidence setup template](tools/a2_output_evidence.setup.template.toml)
-- [A3 local-evidence setup template](tools/a3_cw_evidence.setup.template.toml)
-- [A4 local-evidence setup template](tools/a4_modulation_evidence.setup.template.toml)
-- [A4-MO local-evidence setup template](tools/a4_modulated_output_evidence.setup.template.toml)
-- [A4-MO FM/PM local-evidence setup template](tools/a4_fm_pm_modulated_output_evidence.setup.template.toml)
-- [A4 Pulse local-evidence setup template](tools/a4_pulse_evidence.setup.template.toml)
-- [A4 Step Sweep local-evidence setup template](tools/a4_step_sweep_evidence.setup.template.toml)
-- [A5-0 trigger-configuration diagnostic setup template](tools/a5_trigger_snapshot_evidence.setup.template.toml)
-- [A5 Pulse Output local-evidence setup template](tools/a5_pulse_output_evidence.setup.template.toml)
-
-The milestone document distinguishes the current seed, offline contracts, and A1–A5 hardware evidence. A
-production descriptor capability is not promoted by seed code or fake-transport tests alone.
-
-## Identity and compatibility
-
-- Distribution: `wavebench-rigol-dsg830`
-- Canonical driver ID: `rigol.dsg830`
-- Registered model: `DSG830`
-- WaveBench: `>=0.8.25,<0.9`
-- Python: `>=3.11`
-- Transport backend: `pyvisa`
-- Manual-backed connection routes: USB and LAN
-
-The plugin declares no alias and does not replace a bundled WaveBench driver. Configure canonical ID
-`rigol.dsg830` explicitly.
-
-## Local programming guide
-
-Store vendor source material in the ignored [`doc/vendor-local/`](doc/vendor-local/README.md) directory.
-Recommended filenames:
-
-```text
-DSG800_ProgrammingGuide_EN.pdf
-DSG800_ProgrammingGuide_EN.md
-```
+A WaveBench instrument plugin for the RIGOL DSG830 RF signal generator. The package registers the canonical driver ID `rigol.dsg830`, declares no aliases, and does not replace a bundled WaveBench driver.
+
+## Start here
+
+- [Check current capabilities, profiles, and restrictions](doc/reference-en.md)
+- [Read development milestones and hardware evidence](doc/README_EN.md)
+- [Install and manage plugins with WaveBench Core](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-The official source is [DSG800 ProgrammingGuide V1.0](https://www.rigol.com/intl/dam/global/downloads/brochures/en/program-guide/rf-signal-generators/DSG800_ProgrammingGuide_EN.pdf).
-The RIGOL download page records version `V1.0` and date `2019-09-30`. Its introduction states that the
-DSG800 series includes DSG830 and DSG815 and uses DSG830 as the default command example. Do not add the
-original PDF or converted copy to Git or a distribution.
+Package metadata and the production descriptor are authoritative for the current metadata version, compatibility range, and capabilities. The repository-level generated [plugin catalog](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/reference/plugin-catalog-en.md) provides a checked summary.
 
-## Current configuration (read-only identity and status)
+## Read-only start
 
-This example uses an RFC 5737 documentation address and uses `read_only` access for identity and status queries:
+This configuration uses an RFC 5737 documentation address and allows identity and status queries only:
 
 ```toml
 [rf_source]
@@ -144,37 +23,20 @@ resource = "TCPIP::192.0.2.83::INSTR"
 access = "read_only"
 ```
 
-This `[rf_source]` configuration is for the production descriptor's `rf_source.idn` and `rf_source.snapshot`. It is outside the
-normal source Vpp, channel, and run-plan workflow. Future energy-related capabilities also require complete
-per-`port_id` safety configuration and a physical-termination declaration; the package never infers actual
-termination from a connector label.
+A `read_only` configuration performs no reset, RF-output transition, frequency or power write, modulation, Pulse, or Sweep configuration. See the [WaveBench Core configuration Reference](https://github.com/Scaxlibur/wavebench/blob/master/docs/reference/configuration.md) for exact generic fields and workflows.
 
 ## Safety boundary
 
-- Descriptor import does not create a transport, scan ports, or send SCPI.
+- Importing the descriptor creates no transport, scans no ports, and sends no SCPI.
 - The factory opens only the configured transport through `DriverContext`.
-- Default tests use fake transport only and never connect to hardware.
-- The snapshot path issues only `*IDN?`, `:FREQ?`, `:LEV?`, `:OUTP?`, `:MOD:STAT?`, `:PULM:STAT?`,
-  `:SWE:STAT?`, and `:STAT:QUES:POW:COND?`; A1 exposes this read-only path as a production capability.
-- Default tests use fake transport and never connect to hardware. A normal production `read_only` configuration does
-  not reset the device or change RF output, power, frequency, trigger, modulation, or sweep; A2/A3/A4/A4-MO/A5 evidence
-  separately opens only their bounded output, CW, modulation-cleanup, Pulse, Step Sweep, fixed-profile modulated-output,
-  and one Pulse Output operation, while ordinary writes still require explicit `read_write`, capability, and complete preflight.
-- Hardware testing requires separate authorization and a reviewed resource, firmware, terminator, RF-output
-  state, safety limit, and restoration procedure.
-
-### Electrical boundary for controlled RF observation
-
-- The current controlled wiring connects RF output directly to a confirmed 50-ohm CH2 scope input. LF output connects to high-impedance CH1 only as an independent supplementary observation path. Current DSG830 capabilities neither control LF output nor treat CH1 results as evidence of RF output, modulation, or trigger/sync behavior.
-- CH2 input voltage must remain below `5 V RMS`. On a direct 50-ohm path with no external amplifier, that limit is about `+26.99 dBm`; the descriptor's declared `+20 dBm` maximum is about `2.24 V RMS`. Completed controlled hardware evidence uses no more than `-40 dBm`, and the fixed A4-MO profile uses `-50 dBm`.
-- This conversion only checks electrical margin for a direct 50-ohm connection. It does not turn source dBm readback into a Vpp measurement and does not apply to wiring with an external amplifier, a different termination, or a differently rated instrument input. Such a change requires a new safety-limit and recovery review.
-
-### Electrical boundary for controlled Pulse Output
+- Writes require explicit `read_write` access plus the corresponding capability, device state, port safety limits, and readback.
+- The 50-ohm dBm reference for `rf_out` does not prove the actual termination; WaveBench does not infer a load from a connector name.
+- Rear-panel `PULSE IN/OUT` and the 50-ohm RF output are separate interfaces and must not share electrical assumptions.
+- Hardware tests require separate authorization and prior confirmation of the resource, firmware, termination, initial output state, safety limits, and recovery procedure.
 
-- The verified wiring is only DSG830 `PULSE IN/OUT` output to RTM2032 `EXT TRIGGER INPUT`. The DSG830 profile is fixed at `0 V`/`3.3 V` and about `600 ohms`; this high-impedance trigger input is not the CH2 50-ohm RF path.
-- `rf_source.pulse_output` neither detects nor configures the receiver and does not infer success from receiver state. Any change to receiver, cabling, adapters, Pulse profile, or interface direction requires separate evidence.
+Default tests use fake transports and do not connect to real instruments. See the [current Reference](doc/reference-en.md) for the available write surface, fixed profiles, and explicit exclusions.
 
-## Development verification
+## Development checks
 
 ```bash
 python -m pytest -q packages/wavebench-rigol-dsg830/tests
@@ -182,9 +44,8 @@ python -m ruff check packages/wavebench-rigol-dsg830
 python -m wavebench plugin package check packages/wavebench-rigol-dsg830
 ```
 
-Use the repository [editable development environment](../../doc/DEVELOPMENT_EN.md) for regular source
-development. Release acceptance still uses a real wheel and a disposable virtual environment.
+Use the repository-level [editable development environment](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/DEVELOPMENT_EN.md) for ordinary source work.
 
 ## License
 
-This plugin is distributed under the [MIT License](LICENSE).
+This plugin uses the [MIT License](LICENSE).
diff --git a/packages/wavebench-rigol-dsg830/doc/README.md b/packages/wavebench-rigol-dsg830/doc/README.md
index 6ee5b48..be760d7 100644
--- a/packages/wavebench-rigol-dsg830/doc/README.md
+++ b/packages/wavebench-rigol-dsg830/doc/README.md
@@ -2,31 +2,23 @@
 
 [English](README_EN.md)
 
-这里记录 DSG830 插件的公开开发边界、离线验证和后续实机证据。厂商原文及转换稿保存在 [`vendor-local/`](vendor-local/README.md)，不进入 Git 或发行制品。
+本页将 DSG830 的当前使用合同与开发证据分开。手册命令、fake transport 测试和受控实机验收都可以支持判断，但只有 production descriptor 声明当前 capability。
 
-公开文档必须区分三类事实：手册声明、fake transport 离线结果和受控实机验收。手册命令或离线测试均不能单独证明 production capability。
+## 当前 Reference
 
-当前公开文档：
+- [DSG830 capability 与 profile](reference.md)：当前型号、兼容范围、精确 profile、安全前置条件和明确拒绝项。
+- [仓库级插件目录](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/reference/plugin-catalog.md)：由 `pyproject.toml` 与 descriptor 生成的版本、入口点和 capability 摘要。
 
-- [DSG830 功能覆盖里程碑](DSG830_COVERAGE_MILESTONES.md)
+## 历史与开发证据
 
-源码 checkout 还提供不含资源地址的
-[`A2 本地证据 setup 模板`](../tools/a2_output_evidence.setup.template.toml)。A2 harness 与回归测试已用于完成
-受控实机验收；production descriptor 现在声明 `rf_source.output`。
+- [DSG830 功能覆盖里程碑](DSG830_COVERAGE_MILESTONES.md)：A1–A5 的开发边界、验收结论和仍未开放的方向。
 
-[`A3 本地证据 setup 模板`](../tools/a3_cw_evidence.setup.template.toml) 与对应 harness 已加入源码 checkout，供下一次
-CW 环回验收使用。A3 已完成并经复核，production descriptor 现在声明 `rf_source.cw_configure`；M3 调制、Pulse 与 Step Sweep 的提升均由各自的 A4 证据单独决定，M3-MO 固定 profile 调制输出由独立 A4-MO 证据决定，Sweep execute／fire 和 trigger 仍保持关闭。
+源码 checkout 的 [`tools/` 目录](https://github.com/Scaxlibur/wavebench-instrument-plugins/tree/main/packages/wavebench-rigol-dsg830/tools)保留 A2 输出、A3 CW、A4 调制／Pulse／Step Sweep、A4-MO、A5-0 trigger configuration 诊断和 A5 Pulse Output 的 harness 与无资源 setup 模板。`tools/` 不进入 sdist；安装包内文档应通过上述仓库链接查看这些材料。
 
-[`A4 本地证据 setup 模板`](../tools/a4_modulation_evidence.setup.template.toml) 与对应 harness 已完成受控硬件验收。它每次只配置一个内部 Sine AM／FM／PM 模式，配置读回后关闭同一模式，最终 snapshot 必须确认 RF 输出与调制均关闭；不读取 scope，不调用 RF 输出控制。AM／FM／PM 序列均已通过。PM 的 production profile 固定为 `1.25 rad`，使 capability 与严格读回证据保持一致。显式 `--recover` 只生成私有恢复记录；显式 `--diagnose` 保留 `read_only` 配置，读取指定模式 profile 与初始／最终 RF snapshot，并以零写 audit 记录诊断结果。两类记录都不构成新的 capability 提升证据。
+这些记录用于追溯验收范围，不替代当前 Reference，也不授权重新执行实机 harness。
 
-[`A4-MO AM 本地证据 setup 模板`](../tools/a4_modulated_output_evidence.setup.template.toml) 与对应 historical harness 保留 AM `50 %`／`1 kHz` 的已完成验收。源码 checkout 还提供 [`A4-MO FM／PM 本地证据 setup 模板`](../tools/a4_fm_pm_modulated_output_evidence.setup.template.toml) 与独立 harness：它一次只验证 FM `20 kHz` 频偏／`1 kHz`，或 PM `1.25 rad` 相偏／`1 kHz`，两者均使用 RF `1 MHz`／`-50 dBm`。三条路径均在 RF OFF 下配置调制、单次 RF ON、读取 CH2 当前 `DEF` 缓冲区、显式 RF OFF、关闭目标模式和全局调制并复核基线。CH2 必须显式确认 50 Ω；FM／PM 工具额外使用 WaveBench 波形摘要和 FFT 记录信号存在、幅度、载波与频谱质量告警。该分析不测量频偏、相偏、调制准确度或频谱合规性。工具不读取或控制 CH1，不把 LF OUTPUT 作为调制证据，也不使用 trigger／sync 或后面板 Pulse I/O。production descriptor 现在只声明 AM `50 %`／`1 kHz`、FM `20 kHz`／`1 kHz`、PM `1.25 rad`／`1 kHz`、最大 `-50 dBm` 的 `rf_source.modulated_output_enable`；普通 `rf_source.output on` 仍要求调制关闭。所有 historical harness 在提升后拒绝重跑。
+## 厂商资料
 
-[`A4 Pulse 本地证据 setup 模板`](../tools/a4_pulse_evidence.setup.template.toml) 与对应 harness 已完成受控实机验收。它只验证 `rf_out` 的 internal／single Pulse 配置：初始、写后与最终 snapshot 都必须确认 RF 输出、调制、Pulse、Sweep 关闭且无活动 protection。`--execute` 固定配置 period、width、polarity 并保持 Pulse OFF；`--diagnose` 保持 `read_only` 且零写。工具不读取 scope、不调用 RF output、不使用后面板 Pulse I/O 或 trigger。normal／inverted 两种 polarity 均通过独立配置、读回、最终关闭与审计复核，证据已将 `rf_source.pulse_configure` 提升到 production descriptor；historical harness 在提升后会拒绝重跑。
+源码 checkout 中的厂商原文及转换稿保存在被忽略的 `doc/vendor-local/` 目录，不进入 Git 或 distribution。公开文档不得包含真实仪器地址、序列号、凭据、原始采集数据或实验室专用配置。
 
-当前包 `0.2.0` 已完成 `rf_source` M0 的只读迁移、M1 CW 映射、M2 输出事务、M3 内部 Sine AM／FM／PM 映射及按模式关闭、M3-MO 调制输出安全合同，以及 M4 internal／single Pulse 与 frequency-only Step Sweep 的实机验收。A1、A2、A3、A4 调制／Pulse／Step Sweep、A4-MO 和一条 A5 Pulse Output 受控实机证据已经完成并复核，production descriptor 声明 `rf_source.idn`、`rf_source.snapshot`、`rf_source.cw_configure`、`rf_source.output`、`rf_source.modulation_configure`、`rf_source.modulation_disable`、固定 AM `50 %`／`1 kHz`、FM `20 kHz`／`1 kHz`、PM `1.25 rad`／`1 kHz`、最大 `-50 dBm` 的 `rf_source.modulated_output_enable`、`rf_source.pulse_configure`、`rf_source.pulse_output` 和 `rf_source.sweep_configure`。A5-0 已提供逻辑 trigger configuration 的严格只读 query 映射，但 production descriptor 不声明 `rf_source.trigger_snapshot`，也不把 `rf_out` 作为物理 trigger／sync connector。PM 的 RF-OFF 配置 profile 仅为 `1.25 rad`；除已验证的 Pulse Output 外，外部 trigger、Sweep execute／fire、Level Sweep 与 list 继续由独立 A5 证据门控。边界与提升条件见里程碑文档。
-
-源码 checkout 还提供 A5 Pulse Output 的[本地证据 setup 模板](../tools/a5_pulse_output_evidence.setup.template.toml)与对应 historical harness。已完成且唯一提升的物理路径为 DSG830「PULSE IN/OUT」output → RTM2032「EXT TRIGGER INPUT」：固定 `0 V`／`3.3 V`、约 `600 Ω`、internal／single／normal／`1 ms`／`100 μs`，最终 RF 输出和 Pulse Output 均独立确认关闭。production descriptor 因此声明 `rf_source.pulse_output`；它不声明同一连接器的 input、`TRIGGER IN`、trigger／fire 或 sync。harness 仅在验收时用隔离 scope transport 执行 single acquisition，不构成 RTM capability，且在 production 提升后拒绝重跑。
-
-源码 checkout 已提供 A4 Step Sweep 的 [本地证据 setup 模板](../tools/a4_step_sweep_evidence.setup.template.toml) 与对应 harness。它只验证 RF-OFF／Sweep-OFF 的 frequency-only profile，不读取 Scope、不调用 RF output、不 arm／fire 或 trigger；诊断路径零写，执行路径须显式授权。零写诊断与受控配置均已通过并完成最终关闭复核，`rf_source.sweep_configure` 已提升到 production descriptor；historical harness 会拒绝重跑。
-
-源码 checkout 还提供 A5-0 的 [trigger configuration 本地诊断 setup 模板](../tools/a5_trigger_snapshot_evidence.setup.template.toml) 与对应 harness。默认只做静态预检；显式 `--diagnose` 才在原始 `read_only` 配置上运行一次私有零写诊断。它要求初始与最终 RF snapshot 均确认 RF 输出、调制、Pulse、Sweep 关闭且无活动 protection，然后只读取六项逻辑 trigger configuration。成功预算固定为 22 次 query、零 write；harness 不发送 trigger、后面板配置、RF output、arm、fire 或 scope 操作。隔离诊断已完成并复核最终 RF OFF 与健康关闭；它不构成物理 A5 实机证据或 production capability 提升。
+返回 [DSG830 插件入口](../README.md)。
diff --git a/packages/wavebench-rigol-dsg830/doc/README_EN.md b/packages/wavebench-rigol-dsg830/doc/README_EN.md
index 0816173..00b6003 100644
--- a/packages/wavebench-rigol-dsg830/doc/README_EN.md
+++ b/packages/wavebench-rigol-dsg830/doc/README_EN.md
@@ -2,46 +2,23 @@
 
 [中文](README.md)
 
-This directory records the public development boundary, offline validation, and future hardware evidence for the DSG830 plugin. Vendor originals and converted copies belong in [`vendor-local/`](vendor-local/README.md) and are excluded from Git and distribution artifacts.
+This page separates the current DSG830 user contract from development evidence. Manual commands, fake-transport tests, and controlled hardware acceptance inform decisions, but only the production descriptor declares current capabilities.
 
-Public documentation distinguishes manual statements, fake-transport results, and controlled hardware acceptance. A manual command or an offline test alone does not prove a production capability.
+## Current Reference
 
-Current public documentation:
+- [DSG830 capabilities and profiles](reference-en.md): current models, compatibility, exact profiles, safety preconditions, and explicit exclusions.
+- [Repository plugin catalog](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/reference/plugin-catalog-en.md): generated metadata version, entry-point, and capability summary from `pyproject.toml` and the descriptor.
 
-- [DSG830 Coverage Milestones](DSG830_COVERAGE_MILESTONES_EN.md)
+## Historical and development evidence
 
-The source checkout also provides a resource-free
-[`A2 local-evidence setup template`](../tools/a2_output_evidence.setup.template.toml). The A2 harness and
-regression tests completed the controlled hardware acceptance. The production descriptor now declares
-`rf_source.output`.
+- [DSG830 coverage milestones](DSG830_COVERAGE_MILESTONES_EN.md): A1–A5 development boundaries, acceptance conclusions, and unopened directions.
 
-The checkout also provides an [`A3 local-evidence setup template`](../tools/a3_cw_evidence.setup.template.toml) and
-its harness. A3 has completed and been reviewed, so the production descriptor now declares
-`rf_source.cw_configure`; M3 modulation, Pulse, and Step Sweep are each promoted by their own A4 evidence, while M3-MO fixed-profile output is promoted by separate A4-MO evidence; Sweep execution/fire and trigger remain closed.
+The source checkout's [`tools/` directory](https://github.com/Scaxlibur/wavebench-instrument-plugins/tree/main/packages/wavebench-rigol-dsg830/tools) retains the A2 output, A3 CW, A4 modulation/Pulse/Step Sweep, A4-MO, A5-0 trigger-configuration diagnostic, and A5 Pulse Output harnesses and resource-free setup templates. `tools/` is excluded from the sdist; installed-package documentation should use the repository link above.
 
-The checkout also provides an [`A4 local-evidence setup template`](../tools/a4_modulation_evidence.setup.template.toml)
-and its harness, which completed controlled hardware acceptance. It configures one internal-Sine AM/FM/PM mode per
-invocation, then disables that same mode after configuration readback; the final snapshot must establish both RF output
-and modulation OFF. It does not read scope or invoke RF-output control. AM, FM, and PM sequences passed. PM is fixed to
-the `1.25 rad` production profile so the capability matches strict readback evidence. Explicit `--recover` only writes a private recovery record. Explicit `--diagnose` retains
-the `read_only` configuration, reads the selected profile plus initial/final RF snapshots, and records a zero-write
-audit. Neither record is new A4 capability-promotion evidence.
+These records preserve acceptance scope. They neither replace the current Reference nor authorize a hardware harness rerun.
 
-The checkout retains the historical [`A4-MO AM local-evidence setup template`](../tools/a4_modulated_output_evidence.setup.template.toml)
-and harness, and adds an [`A4-MO FM/PM local-evidence setup template`](../tools/a4_fm_pm_modulated_output_evidence.setup.template.toml) with an independent harness. The FM/PM tool validates one fixed profile per invocation: FM `20 kHz` deviation at `1 kHz`, or PM `1.25 rad` deviation at `1 kHz`; both use RF `1 MHz` at `-50 dBm`. Each path configures modulation with RF OFF, enables RF once, reads CH2's current `DEF` buffer, then explicitly turns RF OFF, disables the target/global modulation, and verifies the baseline. CH2 must be explicitly declared 50 ohms. The FM/PM tool uses WaveBench waveform-summary and FFT analysis to record signal presence, amplitude, carrier, and spectral-quality warnings; it does not measure deviation, modulation accuracy, or spectral compliance. Neither harness reads or controls CH1, treats LF OUTPUT as modulation evidence, or uses trigger, sync, or rear Pulse I/O. The production descriptor now exposes AM `50 %`/`1 kHz`, FM `20 kHz`/`1 kHz`, and PM `1.25 rad`/`1 kHz`, all with maximum `-50 dBm` for `rf_source.modulated_output_enable`; ordinary `rf_source.output on` still requires modulation disabled, and historical harnesses reject reruns.
+## Vendor material
 
-The checkout also provides an [`A4 Pulse local-evidence setup template`](../tools/a4_pulse_evidence.setup.template.toml)
-and its harness. It only validates an internal/single Pulse configuration on `rf_out`: initial, postcondition, and final
-snapshots must all establish RF output, modulation, Pulse, and Sweep OFF with no active protection. `--execute` fixes
-period, width, and polarity while keeping Pulse OFF; `--diagnose` retains `read_only` and a zero-write audit. It does not
-read scope, invoke RF output, use rear Pulse I/O, or trigger. Both normal and inverted polarity passed independent
-configuration, readback, final-off, and audit review. The evidence promotes `rf_source.pulse_configure`; the historical
-harness now rejects reruns.
+In a source checkout, vendor originals and converted copies belong in the ignored `doc/vendor-local/` directory and are excluded from Git and distributions. Public documentation must not contain real instrument addresses, serial numbers, credentials, raw captures, or laboratory-specific configuration.
 
-Package `0.2.0` has completed the `rf_source` M0 read-only migration, M1 CW mapping, M2 output transaction, M3 internal-sine AM/FM/PM mapping and mode-specific disable, the M3-MO modulated-output safety contract, plus M4 internal/single Pulse and frequency-only Step Sweep hardware acceptance. A1, A2, A3, A4 modulation/Pulse/Step Sweep, A4-MO, and one A5 Pulse Output route have completed and been reviewed, so the production descriptor declares `rf_source.idn`, `rf_source.snapshot`, `rf_source.cw_configure`, `rf_source.output`, `rf_source.modulation_configure`, `rf_source.modulation_disable`, fixed AM `50 %`/`1 kHz`, FM `20 kHz`/`1 kHz`, PM `1.25 rad`/`1 kHz`, maximum `-50 dBm` `rf_source.modulated_output_enable`, `rf_source.pulse_configure`, `rf_source.pulse_output`, and `rf_source.sweep_configure`. A5-0 adds a strict query-only logical trigger-configuration mapping, but the production descriptor does not declare `rf_source.trigger_snapshot` and does not treat `rf_out` as a physical trigger/sync connector. PM remains limited to the `1.25 rad` production profile; except for the verified Pulse Output, external-trigger, Sweep-execution/fire, Level-Sweep, and list capabilities remain independently gated. The milestone document defines the boundary and promotion gates.
-
-The checkout also provides an [A5 Pulse Output local-evidence setup template](../tools/a5_pulse_output_evidence.setup.template.toml) and its historical harness. The only promoted physical path is DSG830 `PULSE IN/OUT` output to RTM2032 `EXT TRIGGER INPUT`: fixed at `0 V`/`3.3 V`, about `600 ohms`, internal/single/normal, period `1 ms`, width `100 us`, with final RF output and Pulse Output independently confirmed OFF. The production descriptor therefore declares `rf_source.pulse_output`; it does not declare the connector input, `TRIGGER IN`, trigger/fire, or sync. The harness uses isolated scope transport for one single acquisition only, creates no RTM capability, and rejects reruns after promotion.
-
-The source checkout includes an [A4 Step Sweep local-evidence setup template](../tools/a4_step_sweep_evidence.setup.template.toml) and its harness. It only validates an RF-OFF/Sweep-OFF frequency-only profile; it does not read scope, invoke RF output, arm/fire, or trigger. The diagnostic path has zero writes and execution remains explicitly authorized. Both paths passed controlled hardware acceptance with independent final-off verification, and `rf_source.sweep_configure` is production-declared; the historical harness rejects reruns.
-
-The source checkout also includes an [A5-0 trigger-configuration diagnostic setup template](../tools/a5_trigger_snapshot_evidence.setup.template.toml) and its harness. Its default mode performs static preflight only; explicit `--diagnose` runs one private zero-write diagnostic against the unchanged `read_only` configuration. Initial and final RF snapshots must both establish RF output, modulation, Pulse, and Sweep OFF with no active protection before it reads the six logical trigger-configuration fields. The successful budget is 22 queries and zero writes. It sends no trigger, rear-panel configuration, RF-output, arm/fire, or scope operation. The isolated diagnostic completed with final RF OFF and healthy closure verified; it is not A5 hardware evidence or a production-capability promotion.
+Return to the [DSG830 plugin landing page](../README_EN.md).
diff --git a/packages/wavebench-rigol-dsg830/doc/reference-en.md b/packages/wavebench-rigol-dsg830/doc/reference-en.md
new file mode 100644
index 0000000..f8904d4
--- /dev/null
+++ b/packages/wavebench-rigol-dsg830/doc/reference-en.md
@@ -0,0 +1,94 @@
+# DSG830 current capability Reference
+
+[中文](reference.md)
+
+This page defines the exact current boundary declared by the `rigol.dsg830` production descriptor. The package metadata version is `0.2.0`; it identifies the source contract in this repository and is not a separate PyPI, Git tag, or GitHub Release claim.
+
+## Synopsis
+
+| Item | Current value |
+| --- | --- |
+| Distribution | `wavebench-rigol-dsg830` |
+| Driver ID | `rigol.dsg830` |
+| Model | `DSG830` |
+| WaveBench | `>=0.8.25,<0.9` |
+| Python | `>=3.11` |
+| Backend | `pyvisa` |
+| Resource schemes | `tcpip`, `usb` |
+| Configuration fields | `rf_source.resource`, `rf_source.driver` |
+
+The descriptor range for `rf_out` is `9 kHz–3 GHz` and `-110–20 dBm`, with power referenced to 50 ohms. That reference defines the power contract and does not prove the actual termination.
+
+## Declared capabilities
+
+| Capability | Exact scope and behavior |
+| --- | --- |
+| `rf_source.idn` | Reads and strictly matches DSG830 identity. |
+| `rf_source.snapshot` | Reads identity, frequency, power, RF output, modulation, Pulse, Sweep, and protection state without writes. |
+| `rf_source.cw_configure` | Reads or configures `rf_out` frequency and dBm power; configuration requires RF OFF and the complete OFF-only preflight. |
+| `rf_source.output` | Reads, enables, or disables `rf_out`; ordinary RF ON requires modulation disabled plus Core port limits, a fresh snapshot, and independent readback. |
+| `rf_source.modulation_configure` | Configures internal-sine AM, FM, or PM only while RF is OFF and leaves RF OFF. |
+| `rf_source.modulation_disable` | Disables one known active mode and global modulation while RF is OFF; it is not a reset. |
+| `rf_source.modulated_output_enable` | Enables RF only for an already configured and exactly read-back fixed low-power AM/FM/PM profile; success performs one RF ON. |
+| `rf_source.pulse_configure` | Configures the internal/single Pulse profile on `rf_out` and leaves Pulse OFF. |
+| `rf_source.pulse_output` | Reads, enables, or disables the fixed output profile on `pulse_in_out`; it neither detects nor configures the receiver. |
+| `rf_source.sweep_configure` | Configures the fixed frequency-only Step Sweep profile and leaves Sweep disabled; it does not execute or trigger Sweep. |
+
+## Profiles
+
+### CW and RF output
+
+- Frequency: `9 kHz–3 GHz`.
+- Power: `-110–20 dBm`, referenced to 50 ohms.
+- The descriptor marks `alc_heater_detector_30min`, `alc_unlocked`, and `output_power_protection` as write-blocking protection conditions.
+- Output enable must satisfy the Core safety contract. The driver does not infer the actual load or termination from a connector name.
+
+### Internal-sine modulation
+
+| Mode | RF-OFF configuration range | Internal frequency | Fixed modulated-output profile |
+| --- | --- | --- | --- |
+| AM | `0–100 %` | `10 Hz–100 kHz` | `50 %` at `1 kHz` |
+| FM | `0.1 Hz–1 MHz` deviation | `10 Hz–100 kHz` | `20 kHz` deviation at `1 kHz` |
+| PM | `1.25 rad` | `10 Hz–100 kHz` | `1.25 rad` at `1 kHz` |
+
+`rf_source.modulated_output_enable` limits output power to `-50 dBm`. Ordinary `rf_source.output` cannot enable RF while modulation is active.
+
+### Pulse
+
+- `rf_source.pulse_configure` supports internal/single only, with normal or inverted polarity.
+- Period: `40 ns–170 s`.
+- Width: `10 ns–169.99999999 s`, with a `10 ns` minimum OFF time.
+- `rf_source.pulse_output` applies only to interface `pulse_in_out` in the output direction and fixes `0 V`/`3.3 V`, about `600 ohms`, internal/single/normal, period `1 ms`, and width `100 µs`.
+- `pulse_in_out` and the 50-ohm `rf_out` are separate interfaces. Pulse Output declares no receiver, cable, or load state.
+
+### Step Sweep
+
+- Type: `STEP`.
+- Direction: `FWD`.
+- Shape: `RAMP`.
+- Spacing: `LIN`.
+- Frequency: `9 kHz–3 GHz`.
+- Points: `2–65535`.
+- Dwell: `20 ms–100 s`.
+
+The capability configures and reads the profile, then leaves Sweep disabled.
+
+## Side effects and failure behavior
+
+- A `read_only` session permits identity and status reads only.
+- Writes require explicit `read_write` access and the state, safety configuration, and readback contract for the capability.
+- Out-of-profile requests, unknown preconditions, active protection, or mismatched post-write readback fail closed and cannot be bypassed through raw SCPI.
+- An uncertain output-enable result is not retried; recovery is limited to a guarded OFF action.
+- Descriptor import performs no instrument I/O. The factory opens only the configured transport.
+
+## Currently unsupported
+
+The production descriptor does not declare an error queue, `rf_source.trigger_snapshot`, Pulse input, `TRIGGER IN`, trigger, Sweep execution/fire, sync/reference, Level Sweep, list, or arbitrary SCPI passthrough.
+
+## Sources
+
+- [Package metadata](../pyproject.toml)
+- [Production descriptor](../src/wavebench_rigol_dsg830/descriptor.py)
+- [Descriptor tests](../tests/test_descriptor.py)
+- [Historical milestones and hardware evidence](DSG830_COVERAGE_MILESTONES_EN.md)
+- [Documentation index](README_EN.md)
diff --git a/packages/wavebench-rigol-dsg830/doc/reference.md b/packages/wavebench-rigol-dsg830/doc/reference.md
new file mode 100644
index 0000000..96d9bba
--- /dev/null
+++ b/packages/wavebench-rigol-dsg830/doc/reference.md
@@ -0,0 +1,94 @@
+# DSG830 当前能力 Reference
+
+[English](reference-en.md)
+
+本页说明 `rigol.dsg830` production descriptor 当前声明的精确使用边界。包元数据版本为 `0.2.0`；该值表示仓库内的源码合同，不表示独立的 PyPI、Git tag 或 GitHub Release 状态。
+
+## Synopsis
+
+| 项目 | 当前值 |
+| --- | --- |
+| Distribution | `wavebench-rigol-dsg830` |
+| Driver ID | `rigol.dsg830` |
+| 型号 | `DSG830` |
+| WaveBench | `>=0.8.25,<0.9` |
+| Python | `>=3.11` |
+| Backend | `pyvisa` |
+| Resource scheme | `tcpip`、`usb` |
+| 配置字段 | `rf_source.resource`、`rf_source.driver` |
+
+`rf_out` 的 descriptor 范围为 `9 kHz–3 GHz`、`-110–20 dBm`，功率参考阻抗为 50 Ω。该参考用于功率合同，不证明实际端接。
+
+## 已声明 capability
+
+| Capability | 精确范围与行为 |
+| --- | --- |
+| `rf_source.idn` | 读取并严格匹配 DSG830 身份。 |
+| `rf_source.snapshot` | 读取身份、频率、功率、RF 输出、调制、Pulse、Sweep 和 protection 状态；不写仪器。 |
+| `rf_source.cw_configure` | 读取或配置 `rf_out` 的频率与 dBm 功率；配置要求 RF OFF 和完整的 OFF-only 前置检查。 |
+| `rf_source.output` | 读取、开启或关闭 `rf_out`；普通 RF ON 要求调制关闭，并通过 Core 的端口安全限制、fresh snapshot 和独立 readback。 |
+| `rf_source.modulation_configure` | 只配置 RF-OFF 的内部正弦 AM、FM 或 PM；配置后保持 RF OFF。 |
+| `rf_source.modulation_disable` | 只在 RF OFF 且存在一个已知活动模式时关闭该模式和全局调制；不是 reset。 |
+| `rf_source.modulated_output_enable` | 只允许已配置并精确读回的固定低功率 AM／FM／PM profile；成功路径只开启一次 RF。 |
+| `rf_source.pulse_configure` | 只配置 `rf_out` 的 internal／single Pulse profile；配置后保持 Pulse OFF。 |
+| `rf_source.pulse_output` | 读取、开启或关闭 `pulse_in_out` 的固定 output profile；不检测或配置接收端。 |
+| `rf_source.sweep_configure` | 只配置固定的 frequency-only Step Sweep profile；配置后保持 Sweep disabled，不执行或触发 Sweep。 |
+
+## Profile
+
+### CW 与 RF 输出
+
+- 频率：`9 kHz–3 GHz`。
+- 功率：`-110–20 dBm`，以 50 Ω 为参考。
+- descriptor 标记 `alc_heater_detector_30min`、`alc_unlocked` 和 `output_power_protection` 为阻断写入的 protection condition。
+- 开启输出前必须满足 Core 安全合同；驱动不会从连接器名称推断实际负载或端接。
+
+### 内部正弦调制
+
+| 模式 | RF-OFF 配置范围 | 内部频率 | 调制输出固定 profile |
+| --- | --- | --- | --- |
+| AM | `0–100 %` | `10 Hz–100 kHz` | `50 %`、`1 kHz` |
+| FM | `0.1 Hz–1 MHz` 频偏 | `10 Hz–100 kHz` | `20 kHz` 频偏、`1 kHz` |
+| PM | `1.25 rad` | `10 Hz–100 kHz` | `1.25 rad`、`1 kHz` |
+
+`rf_source.modulated_output_enable` 的最大允许功率为 `-50 dBm`。普通 `rf_source.output` 不允许在调制活动时开启 RF。
+
+### Pulse
+
+- `rf_source.pulse_configure` 仅支持 internal／single，polarity 为 normal 或 inverted。
+- Period：`40 ns–170 s`。
+- Width：`10 ns–169.99999999 s`，最短 OFF 时间为 `10 ns`。
+- `rf_source.pulse_output` 只适用于接口 `pulse_in_out` 的 output 方向，固定为 `0 V`／`3.3 V`、约 `600 Ω`、internal／single／normal、period `1 ms`、width `100 µs`。
+- `pulse_in_out` 与 50 Ω `rf_out` 是不同接口；Pulse Output capability 不声明接收端、线缆或负载状态。
+
+### Step Sweep
+
+- Type：`STEP`。
+- Direction：`FWD`。
+- Shape：`RAMP`。
+- Spacing：`LIN`。
+- 频率：`9 kHz–3 GHz`。
+- Points：`2–65535`。
+- Dwell：`20 ms–100 s`。
+
+该 capability 只配置并读回 profile，结尾保持 Sweep disabled。
+
+## Side effects 与失败行为
+
+- `read_only` session 只允许身份和状态读取。
+- 写入需要显式 `read_write`，并满足 capability 对应的状态、安全配置和 readback 合同。
+- profile 越界、前置状态未知、protection 活动或写后读回不一致时，操作关闭失败；不通过 raw SCPI 绕过。
+- 输出开启结果不明时不会重试 ON；可恢复路径只允许受 guard 的 OFF 操作。
+- descriptor 导入不访问仪器；factory 只打开已配置的 transport。
+
+## 当前不支持
+
+production descriptor 不声明：错误队列、`rf_source.trigger_snapshot`、Pulse input、`TRIGGER IN`、trigger、Sweep execute／fire、sync／reference、Level Sweep、list 或任意 SCPI passthrough。
+
+## Sources
+
+- [包元数据](../pyproject.toml)
+- [Production descriptor](../src/wavebench_rigol_dsg830/descriptor.py)
+- [Descriptor tests](../tests/test_descriptor.py)
+- [历史里程碑与实机证据](DSG830_COVERAGE_MILESTONES.md)
+- [文档入口](README.md)
diff --git a/packages/wavebench-rigol-mso8000/README.md b/packages/wavebench-rigol-mso8000/README.md
index 8204e5b..b269dda 100644
--- a/packages/wavebench-rigol-mso8000/README.md
+++ b/packages/wavebench-rigol-mso8000/README.md
@@ -1,86 +1,27 @@
-# WaveBench RIGOL MSO8000 插件（开发中）
+# WaveBench RIGOL MSO8000 插件
 
-该目录为 RIGOL MSO8000 系列的 WaveBench 插件开发起点，当前以 MSO8104 为首个目标型号。MSO8104 是 1 GHz、4 个模拟通道的混合信号示波器；系列编程手册还覆盖 MSO8064 和 MSO8204。
+[English](README_EN.md)
 
-## 当前状态
+面向 RIGOL MSO8000 系列混合信号示波器的 WaveBench 仪器插件，当前 production descriptor
+只登记 MSO8104。
 
-`0.9.0` 开发版本在当前 WaveBench Core 开发分支的有界二进制与 portability V2 合同下声明 `scope.error_drain_v1`、`scope.fetch_waveform`、`scope.capture_waveform`、`scope.capture_waveforms`、`scope.acquisition_control`、`scope.channel_input_state_v2`、`scope.measurement_statistics_v2`、`scope.fft_status_v2`、`scope.acquisition_status_v2`、`scope.acquisition_run_state`、`scope.digital_status_v2`、`scope.snapshot_v2` 和 `scope.cursor_readout_v2`。waveform 入口支持 `DEF`、停止态 `MAX` 与停止态 `DMAX`；descriptor 精确声明 `LF` trailing、单响应最多 `250,000` bytes、单操作最多 `4,000,000` bytes 与最多 16 次 binary query。`scope.capture_waveform` 和 `scope.capture_waveforms` 仅接受已停止、MAIN 时基下的 `DEF + BYTE` 基线；单通道最多 1 次、双通道最多 4 次 binary query，均由 Core 恢复并新鲜验证 acquisition、trigger、时基、四路 display/vertical 与 transfer 的 13 个字段。SINGLE 写入后必须读回 `SING`：首条 `STOP` 使用受限 completion proof，`WAIT` 或 `TD` 到 `STOP` 使用状态迁移 proof；capture 仅接受后者作为波形新鲜性证据。
+## 从这里开始
 
-实机结论只适用于记录的 MSO8104 固件 `00.02.02`、LAN/PyVISA 和受控步骤。单通道和双通道 bounded `DEF + BYTE` capture 都在 1 Vpp 安全限制内返回每通道 `1,000` 样本并具备有效幅度；两者均观察到 `WAIT → STOP`，恢复后 `*OPC?` 由 `0` 轮询至 `1`，随后完成 Core 的 13 字段新鲜验证。`TD → STOP` 已在独立的 SINGLE control 验收中观察到。每轮结束均以新会话确认 source CH1/CH2 OFF、scope STOP、CH1/CH2 为 high_z。此前 `DEF + LF` fetch、停止态 MAX/DMAX、统计、FFT、静态 acquisition/digital 状态与 snapshot 的受限实机证据保持有效。该结果不外推到运行态 MAX、其他点数、时基、通道组合、transport 或一般测量准确度。
+- [查询当前版本、兼容范围、型号和 capability](../../doc/reference/plugin-catalog.md)
+- [进入 MSO8000 插件文档](doc/README.md)
+- [安装和管理 WaveBench 插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-采集控制的实机边界仍受限：`start(normal)`→`stop` 已形成 active/stopped 过程；SINGLE 在模式读回为 `SING` 后，首条 `STOP` 和 `WAIT/TD → STOP` 都已完成受控验证。`*OPC?` 只用于 capture 恢复写批次的通信同步，不能替代 SINGLE completion 或波形新鲜性证明。
+## 当前边界
 
-平均采集仍不声明。受控 `capture_average_v2` 探测在已停止、高阻、1 Vpp 方波条件下，对 `:ACQuire:TYPE AVERages`、其合法缩写 `AVER` 以及 PEAK/NORM 对照均完成有界写入同步后立即读回 type；设备始终返回 `NORM`，且随后读取的错误队列为 `0,"No error"`。因此当前固件／配置无法通过远程接口进入平均模式；即使该前提解决，手册也没有把 trigger STOP、`*OPC?` 或 preamble count 绑定为平均完成。正式 descriptor 不声明 `scope.capture_average_v2`。
+当前实现覆盖有界 waveform fetch／capture、非重放错误队列、coupling、autoscale、截图，以及
+受限的 math、统计、FFT、采集、数字状态、snapshot 和 cursor 接口。精确 capability、binary
+预算和 profile 以 production descriptor 为准；[功能覆盖矩阵](doc/MSO8104_COVERAGE_MATRIX.md)
+说明当前行为与未支持项，[验收记录](doc/MSO8104_HARDWARE_ACCEPTANCE.md)限定已有实机证据的范围。
 
-当前身份信息：
+平均采集不在当前 descriptor 中。`tcpip`、`usb` 和 `gpib` resource scheme 只表示手册与离线
+路由合同，不等于相应连接已经通过实机验收。
 
-- distribution：`wavebench-rigol-mso8000`
-- canonical driver ID：`rigol.mso8104`
-- kind：`scope`
-- 目标型号：`MSO8104`
-- Python：`>=3.11`
-- WaveBench：`>=0.8.24,<0.9`
-
-本轮依赖的标准 waveform bounded API 与 portability V2 API 已提交到当前 core 开发分支，但尚未形成独立 core 发布版本。因此 `0.9.0` 仅用于开发与受控验收，不能据此发布兼容性 wheel。
-
-## 目录说明
-
-- `doc/vendor-local/`：本地厂商手册。原始 PDF 和转换后的 Markdown 都放在这里；除说明文件外的内容会被 Git 忽略，也不会进入发行包。
-- `src/wavebench_rigol_mso8000/`：descriptor、driver 与严格解析器。
-- `tests/`：FakeTransport、故障注入与制品生命周期测试；默认测试不得连接真实仪器。
-- `pyproject.toml`：distribution 元数据、WaveBench 版本范围和唯一 entry point。
-- `doc/`：公开覆盖矩阵和验收记录；厂商原文不要放到公开文档目录。
-
-## 设计文档
-
-- [MSO8104 功能覆盖里程碑](doc/MSO8104_COVERAGE_MILESTONES.md)
-- [MSO8104 编程手册功能覆盖矩阵](doc/MSO8104_COVERAGE_MATRIX.md)
-- [MSO8104 受控实机验收记录](doc/MSO8104_HARDWARE_ACCEPTANCE.md)
-
-## M8 离线发行证据
-
-- MSO8104 包测试：390 项通过；全仓 Ruff 通过。
-- 根测试：在一次性同级 WaveBench core 布局中 715 项通过，2 项 SP3000A 私有实机证据测试按预期跳过。
-- 当前 WaveBench `0.8.24` 开发环境的 package check：源码目录和真实 wheel 均通过。
-- wheel/sdist：唯一仪器 entry point、WaveBench runtime dependency、MIT 许可证和公开内容符合合同；vendor-local 未进入制品。
-- 一次性虚拟环境：安装、零 I/O descriptor 发现、卸载和 canonical ID fallback 通过。
-- 文档：61 个受跟踪 Markdown 文件的本地链接有效。
-
-这些结果只证明离线合同与发行完整性，不构成型号、固件、transport、吞吐、恢复或测量准确度的实机证据。
-
-## 安全边界
-
-descriptor 导入不得打开 transport、扫描端口、发送 SCPI 或创建文件。真实资源、序列号、凭据、波形、截图和命令日志不得提交。仪器写入和 acquisition trigger 不做盲目重试。核心缺少必要安全接口时，先写 RFC 并跳过对应 capability，不在插件中增加 raw SCPI 入口。
-
-当前 descriptor 允许 `tcpip`、`usb`、`gpib` 资源前缀，这是手册声明和离线路由合同，不是连接实机通过的证据。
-
-已受控声明 `scope.screenshot_profile` 与 `scope.screenshot_v2`。profile 固定单次 binary query、`DEFINITE_BLOCK`、精确 `LF` transport trailing、`8,388,608`-byte 上限与 `png/device/device`。driver 先只读确认 `:SAVE:IMAGe:TYPE? = PNG`，再读取 `:SAVE:IMAGe:DATA?`；记录固件实际返回无压缩 BMP24，driver 仅接受该严格子集并在内存中转换为 PNG。公开实机调用返回 `1024 × 600`、`47,584` bytes 的 `image/png`，前后错误队列均为空，session healthy；最终 source 双路 OFF、scope STOP、CH1/CH2 high_z。不写 `TYPE`、`INVert`、`COLor`、菜单或设备文件，也不使用 `:DISPlay:DATA?`。该证据不外推到截图视觉／像素准确度、其他屏幕状态或最大 payload；详见 [RFC-0003](doc/rfcs/0003-scope-screenshot-framing-and-menu-contract.md)。
-
-当前不声明 legacy `scope.digital_status` 或 `scope.digital_waveform`。legacy 数字状态模型要求 MSO8000 无法查询的必填字段；数字 waveform 的厂商手册未定义 BYTE/WORD 逻辑 code，WORD 字节序也不明确。插件不以默认值或模拟量换算制造数字状态。
-
-`scope.autoscale` 会按核心操作合同改变垂直、时基和触发设置，且不承诺恢复。driver 先查询 `:SYSTem:AUToscale?`，禁用时不发送写命令；调用必须设置 `check_errors=false`。对 MSO8104，遗留参数 `wait_opc=true` 明确定义为固定 `3 s` settle：写入一次 `:AUToscale` 后等待 `3 s`，不查询 `*OPC?`，随后将本次操作视为完成。写入或 settle 等待异常都会锁存 autoscale 写域，关闭并重新打开会话前不再重试。受控 CH1 `1 Vpp / 1 kHz` probe 经公开 autoscale 后的 bounded fetch 返回 1000 样本且幅度有效，最终 source 双路 OFF、scope STOP、CH1/CH2 high_z。该固定时长是本插件的运行完成策略，不证明设备内部自动设置算法、显示效果或设置恢复；`wait_opc=false` 仅显式跳过等待，尚无实机完成验收。
-
-`scope.math_metadata` 只接受已显示的 MATH1～MATH4 和 MAIN 时基。driver 保存六项 waveform 传输状态，按手册要求先切换到 NORM，再选择 MATH 源与 BYTE 格式，只查询 preamble 后恢复原状态；不读取波形数据。记录的 MATH1 调用已返回 1000 点、有限轴和 8 位 BYTE 元数据，并完成六字段最终恢复复核。返回的 `values_per_sample` 仍为未知；数学运算内容、其他槽位／operator 的轴语义和 FFT 精度不由该能力推断。
-
-`scope.cursor_readout` 保留兼容接口，只读取调用方确认已配置的全局手动光标，公共 `cursor_index` 固定为 `1`。`scope.cursor_readout_v2` 使用全局寻址，要求 `cursor_index=None`；除手动 `TIME/AMPL` 外，还读取预配置的 `TRAC` 追踪光标。公开实机的 `MAN + TIME + CHAN1/CHAN1` 已返回有限 X A/B、`ΔX` 与 `1/ΔX`，单位分别为秒和 Hz。追踪路径仅接受 `MAIN/ROLL` 时基和 `CHAN1`～`CHAN4`，读取 A/B source、时基、通道幅度单位和 A/B/差值；当前 `TRAC + CHAN2/CHAN2` 返回全部有限读数与 `V` 纵轴单位。仅当 A/B 纵轴单位相同且已知时才读取 `ΔY`，否则将其标为 not applicable。driver 不移动或重配光标。Math source、XY、测量模式、`NONE`、LA 和未知或不同的纵轴单位保持 fail closed，光标读数准确度仍未验证。
-
-`scope.measurement_statistics_v2` 覆盖手册列出的统计 item，使用规范化的大写 item token 和显式 `CHAN1`～`CHAN4`、`MATH1`～`MATH4` source；`D0`～`D15` 仅接受手册明确允许的周期、频率、宽度、占空比、延时和相位项。延时与相位项必须给出两个 source，其他 item 必须给出一个 source。driver 只查询 CURRENT、AVERages、DEViation、MINimum、MAXimum 与 CNT，不发送统计配置、清零或显示写入。受控实机已确认 `VPP,CHAN1` 与 `VPP,CHAN2` 的 6 个数值字段和 `CNT=1000` 可读取；设备既有统计历史未被修改，因此平均、标准差、最小值和最大值不作为信号准确度或统计窗口语义的证据。legacy `scope.measurement_statistics` 继续不声明。
-
-`scope.fft_status_v2` 只接受调用方已在前面板配置的 MATH1～MATH4 FFT。driver 先查询 `OPERator?` 并要求回包为 `FFT`，再读取 FFT source、window、vertical unit、起始频率和终止频率；所有步骤均为文本 query。`average_complete`、RBW 和 FFT sample rate 没有手册可证明的 query，因此固定列入 `unavailable_fields`，不会从全局 acquisition sample rate、频率范围或波形点数推导。受控实机 MATH1 已确认 `FFT + CHAN1 + HANN + VRMS + 0–1 MHz`，前后 source 两路均 OFF、`consistent`、`healthy`；该结果不构成 FFT 振幅、频率或频率轴准确度证据。
-
-`scope.acquisition_status_v2` 固定读取 `:ACQuire:TYPE?`、`:ACQuire:SRATe?` 和 `:ACQuire:MDEPth?`；仅当 type 为 `AVER` 时才读取 `:ACQuire:AVERages?`。average 分区在非 AVER 模式下明确为 not applicable；AVER 模式下只报告配置次数，`average.complete` 仍为 unavailable。run state 和 segmented 分区没有进入 profile，不发送 `:TRIGger:STATus?`、`*OPC?`、`*STB?` 或 `*ESR?`，也不从 STOP 推导完成状态。受控实机当前返回 `NORM + 500 kSa/s + 10 kpts`；后续平均模式写入探测也始终回读 `NORM`，所以 AVER 分支继续没有实机可达性证据。前后 source 两路均 OFF、`consistent`、`healthy`。legacy `scope.acquisition_status` 与平均采集仍不声明。
-
-`scope.acquisition_run_state` 只读取 `:TRIGger:STATus?`：`STOP` 映射为 stopped，`WAIT` 映射为 waiting，`RUN` 和记录条件下经 STOP 验证的 `AUTO` 映射为 acquiring；通常 `TD` 保持 unknown。仅在刚完成 `SING` 模式读回的 SINGLE 事务中，`TD` 被保守表示为非终态 arming，并且必须后续读到 `STOP` 才能构成 state-transition proof。`scope.acquisition_control` 已声明；它支持 `start(normal)`、`stop` 与受限 SINGLE completion。bounded capture 与 control proof 相互独立：capture 不接受首条 STOP，仍要求 `WAIT/TD → STOP`，并恢复和新鲜验证 13 个字段。运行态 MAX、其他 capture 点数/时基/通道组合仍未验收。
-
-`scope.digital_status_v2` 只接受 D0～D15。每次先查询 LA 模块位；LA 缺席时只返回 `shared.module_present=false`，不会发送任何 `:LA:*?` 查询。LA 存在时，driver 以 6 条文本 query 读取逐通道显示和标签、所属 POD 的共享阈值、全局 timing calibration 与显示大小。`position_div` 因手册查询格式自相矛盾而保持 unavailable；`label_enabled`、activity、technology 和 hysteresis 也没有可证明查询，绝不以默认值或 UI 活动选择替代。受控实机的 D0、D8 都已确认显示、标签、各自 POD 边界与 `1.4 V` 阈值，以及 `0 s` timing calibration 和 `MEDIUM` size；前后 source 两路均 OFF、`consistent`、`healthy`。该结果不构成数字探头、电气阈值、逻辑活动或数字 waveform 编码的准确度证据。
-
-`scope.snapshot_v2` 只接受 CH1～CH4 请求，但当前 profile 只读当前 identity 与授权选件状态：先执行 `*IDN?`，再按手册枚举读取 13 种 `:SYSTem:OPTion:STATus? <type>`。空 options 仅在本次全部 13 项都明确返回未安装时出现；不从 descriptor、缓存或型号常量补齐。health、channel、timebase、probe、waveform 和 trigger 的 55 个字段均按稳定顺序列为 unavailable。受控实机完成全部 14 条 query；前后 source 两路均 OFF、`consistent`、`healthy`。该能力不读取状态寄存器、错误队列、trigger、波形或二进制数据，也不构成各未读分区的状态或准确度证据。
-
-`scope.error_drain_v1` 对 `:SYSTem:ERRor?` 的每次读取都显式使用 Core 的 `ReplayPolicy.NO_REPLAY`，并严格解析 `<integer>,"<message>"`；`0,"No error"` 是已实机观察的唯一终止记录，非零记录、格式异常和队列 overflow 都 fail closed。Core 对有界 fetch/capture 在 `scope.check_errors=true` 时于主操作前后执行有限 drain，并核对实际 query 数。受控实机的公开单通道 capture 在此前后各完成一次空队列 drain，仍返回 1000 样本并恢复安全状态。非空记录和 overflow 目前只有离线故障注入证据。legacy `scope.errors` 仍不声明；autoscale 等旧路径仍必须使用 `check_errors=false`。
-
-`scope.fetch_waveform` 的有界路径支持 `DEF`、停止态 `MAX` 与停止态 `DMAX`。它使用 Core 的 `query_binary()`，不再调用 legacy `query_bin_block()`；`LF` trailing、`250,000`-byte 单响应上限、`4,000,000`-byte 单操作上限、最多 16 次 binary query 与 no-replay 均由 descriptor profile 约束。MAX/DMAX 在任何 transfer setup 前都要求 scope 已停止。该 fetch 证据不外推到运行态 MAX、其他量程、时基、深度和探头条件；受限 capture 的独立验收见上文。
-
-离线设计仍保留每块 `250,000` 点、每次调用总计 `4,000,000` 点、最多 16 块的长记录边界。停止态 MAX/DMAX fetch 与 bounded 单／多通道 capture 已有各自受限实机证据；运行态 MAX、其他 capture 点数、时基、通道组合和 transport 仍需要独立验收。
+## 最小配置
 
 ```toml
 [connection]
@@ -92,11 +33,17 @@ driver = "rigol.mso8104"
 default_channel = 1
 check_errors = false
 access = "read_write"
-
 ```
 
-示例地址属于 RFC 5737 文档网段，不是实验室资源。
+示例使用 RFC 5737 文档地址。默认测试不扫描资源、不连接仪器，也不发送真实 SCPI。
+
+## 安全边界
+
+descriptor 导入不打开 transport、扫描端口、发送 SCPI 或创建文件。仪器写入和 acquisition
+trigger 不会盲目重试；Core 缺少必要安全接口时保持 capability 不可用，不增加 raw SCPI 入口。
+真实资源、序列号、凭据、波形、截图和命令日志不得提交。
 
-## 开发手册位置
+## 开发与许可证
 
-本地厂商资料的具体放置规则见 [`doc/vendor-local/README.md`](doc/vendor-local/README.md)。
+里程碑、RFC、实机证据和历史状态见 [插件文档](doc/README.md)。日常源码开发使用仓库级
+[editable 开发环境](../../doc/DEVELOPMENT.md)。本插件采用 [MIT License](LICENSE)。
diff --git a/packages/wavebench-rigol-mso8000/README_EN.md b/packages/wavebench-rigol-mso8000/README_EN.md
index 9b76ae8..ca746ae 100644
--- a/packages/wavebench-rigol-mso8000/README_EN.md
+++ b/packages/wavebench-rigol-mso8000/README_EN.md
@@ -1,83 +1,54 @@
-# WaveBench RIGOL MSO8000 Plugin (In Development)
+# WaveBench RIGOL MSO8000 Plugin
 
-This directory is the starting point for a WaveBench plugin for the RIGOL MSO8000 series, with the MSO8104 as the first target model. The MSO8104 is a 1 GHz, four-analog-channel mixed-signal oscilloscope; the programming guide also covers the MSO8064 and MSO8204.
+[中文](README.md)
 
-## Current status
+A WaveBench instrument plugin for the RIGOL MSO8000 mixed-signal oscilloscope series. The current
+production descriptor registers only the MSO8104.
 
-Development version `0.9.0` declares `scope.error_drain_v1`, `scope.fetch_waveform`, `scope.capture_waveform`, `scope.capture_waveforms`, `scope.acquisition_control`, `scope.channel_input_state_v2`, `scope.measurement_statistics_v2`, `scope.fft_status_v2`, `scope.acquisition_status_v2`, `scope.acquisition_run_state`, `scope.digital_status_v2`, `scope.snapshot_v2`, and `scope.cursor_readout_v2` through the bounded-binary and portability V2 contracts in the current WaveBench Core development branch. Bounded capture accepts only an already-stopped MAIN-timebase `DEF + BYTE` baseline. The descriptor limits a single capture to one binary query and a multi-channel capture to four, then Core restores and freshly verifies 13 acquisition, trigger, timebase, display/vertical, and transfer fields. After SINGLE, the driver reads back `SING`; terminal first `STOP` is a restricted control proof, while capture requires `WAIT` or `TD` followed by `STOP` as independent waveform-freshness evidence.
+## Start here
 
-Hardware findings apply only to MSO8104 firmware `00.02.02`, LAN/PyVISA, and the controlled procedure. Bounded `DEF + BYTE` single- and multi-channel capture each returned `1,000` samples per channel with valid amplitude evidence under the `1 Vpp` safety limit. Both observed `WAIT → STOP`, then Core recovery polled `*OPC?` from `0` to `1` and freshly verified all 13 fields. A separate SINGLE-control acceptance observed `TD → STOP`. Every run ended with a new-session confirmation of source CH1/CH2 OFF, scope STOP, and high-impedance CH1/CH2 inputs. This does not establish other capture lengths, settings, transports, running-state MAX, or general measurement accuracy.
+- [Find the current version, compatibility range, model, and capabilities](../../doc/reference/plugin-catalog-en.md)
+- [Browse the MSO8000 plugin documentation](doc/README_EN.md)
+- [Install and manage WaveBench plugins](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-The restricted acquisition-control acceptance covers `start(normal)`→`stop`, plus post-arm `SING` readback followed by either terminal `STOP` or `WAIT`/`TD` progressing to `STOP`. Recovery `*OPC?` is used only to synchronize recovery writes; it is not acquisition-completion or waveform-freshness evidence.
+## Current boundary
 
-Average capture remains undeclared. A controlled `capture_average_v2` probe used a stopped, high-impedance baseline and a 1 Vpp square signal. It wrote `:ACQuire:TYPE AVERages`, its legal `AVER` abbreviation, and PEAK/NORM controls, synchronizing each setting write before its type readback. Every readback remained `NORM`, and the subsequently consumed error record was `0,"No error"`. The current firmware/configuration therefore cannot enter average mode through this remote path. Even if that prerequisite changes, the manual does not bind trigger STOP, `*OPC?`, or preamble count to average completion. The production descriptor does not declare `scope.capture_average_v2`.
+The implementation covers bounded waveform fetch/capture, non-replayed error draining, coupling,
+autoscale, screenshots, and constrained math, statistics, FFT, acquisition, digital-state, snapshot,
+and cursor interfaces. The production descriptor is authoritative for exact capabilities, binary
+budgets, and profiles. The [coverage matrix](doc/MSO8104_COVERAGE_MATRIX_EN.md) explains current
+behavior and unsupported areas; the [acceptance record](doc/MSO8104_HARDWARE_ACCEPTANCE_EN.md)
+bounds the available hardware evidence.
 
-Current identity:
+Average capture is not declared. The `tcpip`, `usb`, and `gpib` resource schemes represent manual-
+backed and offline routing contracts, not hardware acceptance for each connection type.
 
-- Distribution: `wavebench-rigol-mso8000`
-- Canonical driver ID: `rigol.mso8104`
-- Kind: `scope`
-- Target model: `MSO8104`
-- Python: `>=3.11`
-- WaveBench: `>=0.8.24,<0.9`
+## Minimum configuration
 
-The required standard-waveform bounded API and portability V2 APIs are committed on the current core development branch but do not yet have an independent core release. Version `0.9.0` is therefore for development and controlled acceptance only, not a compatibility-wheel release claim.
+```toml
+[connection]
+backend = "pyvisa"
+resource = "TCPIP0::192.0.2.80::INSTR"
 
-## M8 offline release evidence
+[scope]
+driver = "rigol.mso8104"
+default_channel = 1
+check_errors = false
+access = "read_write"
+```
 
-- All 390 MSO8104 package tests and repository-wide Ruff checks pass.
-- In a disposable sibling WaveBench-core layout, 715 root tests pass and two SP3000A private-hardware-evidence tests skip as expected.
-- Package checks pass for both the source directory and the real wheel in the current WaveBench `0.8.24` development environment.
-- The wheel/sdist contracts cover the single instrument entry point, WaveBench runtime dependency, MIT license, and public content; vendor-local material is absent.
-- A disposable virtual environment passes installation, zero-I/O descriptor discovery, uninstall, and canonical-ID fallback.
-- Local links resolve in all 61 tracked Markdown files.
-
-This evidence covers offline contracts and distribution integrity only. Model, firmware, transport, throughput, restoration, and measurement accuracy remain hardware-unverified.
-
-## Directory layout
-
-- `doc/vendor-local/`: local vendor manuals. Keep the original PDF and the converted Markdown here; all files except its README are ignored and excluded from distributions.
-- `src/wavebench_rigol_mso8000/`: descriptor, driver, and strict parsers.
-- `tests/`: FakeTransport unit tests; default tests must not connect to hardware.
-- `pyproject.toml`: distribution metadata, WaveBench version range, and the single entry point.
-- `doc/`: public coverage matrices and acceptance notes. Keep vendor source material out of public documentation.
-
-## Design documents
-
-- [MSO8104 coverage milestones](doc/MSO8104_COVERAGE_MILESTONES_EN.md)
-- [MSO8104 programming-guide coverage matrix](doc/MSO8104_COVERAGE_MATRIX_EN.md)
-- [MSO8104 controlled hardware acceptance](doc/MSO8104_HARDWARE_ACCEPTANCE_EN.md)
+The example uses an RFC 5737 documentation address. Default tests do not scan resources, connect to
+an instrument, or send real SCPI.
 
 ## Safety boundary
 
-Descriptor import must not open a transport, scan ports, send SCPI, or create files. Never commit real resources, serial numbers, credentials, captures, screenshots, or command logs. Do not blindly retry instrument writes or acquisition triggers. When the core lacks a required safety interface, add an RFC and skip the capability instead of adding a raw SCPI escape hatch.
-
-The descriptor accepts `tcpip`, `usb`, and `gpib` resource prefixes as a manual-backed, offline routing contract. This is not hardware connection evidence.
-
-The descriptor declares `scope.screenshot_profile` and `scope.screenshot_v2` under a constrained contract: one binary query, `DEFINITE_BLOCK`, exact `LF` transport trailing, an `8,388,608`-byte limit, and `png/device/device`. The driver first reads and requires `:SAVE:IMAGe:TYPE? = PNG`, then reads `:SAVE:IMAGe:DATA?`. The recorded firmware actually returns uncompressed BMP24; the driver accepts only that strict subset and converts it in memory to PNG. The public hardware call returned a `1024 × 600`, `47,584`-byte `image/png`, with empty error drains before and after and a healthy session; final state was both source outputs OFF, scope STOP, and CH1/CH2 high impedance. It does not write TYPE, INVert, COLor, menu, or instrument files, and does not use `:DISPlay:DATA?`. This does not establish visual/pixel accuracy, other screen states, or maximum payload. See [RFC-0003](doc/rfcs/0003-scope-screenshot-framing-and-menu-contract.md).
-
-The descriptor still omits legacy `scope.digital_status` and `scope.digital_waveform`. The legacy status model requires fields that MSO8000 cannot query. The vendor manual does not define BYTE/WORD logic codes for D0-D15 waveform sources and leaves WORD byte order unclear. The plugin does not invent digital state from defaults or analog conversion.
-
-`scope.autoscale` intentionally changes vertical, timebase, and trigger settings under the core operation contract and does not promise restoration. The driver first queries `:SYSTem:AUToscale?` and requires `check_errors=false`. For MSO8104, the legacy `wait_opc=true` parameter explicitly means a fixed `3 s` settle: after one `:AUToscale` write, the driver waits `3 s`, does not query `*OPC?`, and then treats the operation as complete. A write or settle-wait failure latches only the autoscale write domain until the session is reopened. A controlled CH1 `1 Vpp / 1 kHz` probe used public autoscale followed by bounded fetch, which returned 1,000 samples with amplitude evidence; final state was both source outputs OFF, scope STOP, and CH1/CH2 high impedance. The fixed duration is this plugin's operational-completion policy, not proof of the instrument's internal autoscale algorithm, visible effect, or restoration. `wait_opc=false` explicitly skips the wait and has no hardware-completion acceptance.
-
-`scope.math_metadata` accepts only displayed MATH1-MATH4 slots in MAIN timebase mode. The driver saves all six waveform-transfer fields, switches to NORM before selecting the MATH source and BYTE format, reads only the preamble, and restores the previous state. It does not read waveform data. The recorded MATH1 call returned 1,000 points, finite axes, and eight-bit BYTE metadata with final six-field restoration verification. `values_per_sample` remains unknown; math content, axis semantics for other slots/operators, and FFT accuracy are not inferred.
-
-`scope.cursor_readout` remains the compatibility route for an explicitly preconfigured global manual cursor at public cursor index `1`. `scope.cursor_readout_v2` uses global addressing with `cursor_index=None`; in addition to manual `TIME/AMPL`, it reads a preconfigured `TRAC` tracking cursor. Hardware `MAN + TIME + CHAN1/CHAN1` returned finite X A/B, `ΔX`, and `1/ΔX` values in seconds and Hz. The tracking path accepts only `MAIN/ROLL` timebase and `CHAN1`-`CHAN4`, and reads A/B sources, timebase, channel amplitude units, and A/B/delta values; hardware `TRAC + CHAN2/CHAN2` returned finite values with `V` vertical units. It reads `ΔY` only if A/B vertical units are known and equal; otherwise it marks the field not applicable. The driver never moves or reconfigures cursors. Math sources, XY, measurement mode, `NONE`, LA, and unknown or unequal vertical units remain fail closed; cursor accuracy is still unverified.
-
-`scope.measurement_statistics_v2` covers the manual's statistics items with normalized uppercase item tokens and explicit `CHAN1`-`CHAN4` or `MATH1`-`MATH4` sources. `D0`-`D15` are limited to the documented period, frequency, width, duty, delay, and phase items. Delay and phase items require two sources; every other item requires one. The driver reads only CURRENT, AVERages, DEViation, MINimum, MAXimum, and CNT; it never writes statistics configuration, reset, or display state. Controlled hardware reads proved all six numeric responses and `CNT=1000` for `VPP,CHAN1` and `VPP,CHAN2`. Existing device history was not cleared, so average, standard deviation, minimum, and maximum are not evidence of signal accuracy or statistics-window semantics. The legacy `scope.measurement_statistics` capability remains undeclared.
-
-`scope.fft_status_v2` accepts only MATH1-MATH4 FFT state already configured at the front panel. The driver queries `OPERator?` and requires `FFT`, then reads the FFT source, window, vertical unit, start frequency, and stop frequency; every step is a text query. The manual provides no provable query for `average_complete`, RBW, or FFT sample rate, so they are always listed in `unavailable_fields` and are never inferred from global acquisition sample rate, frequency range, or waveform points. Controlled MATH1 hardware reads confirmed `FFT + CHAN1 + HANN + VRMS + 0–1 MHz`; source CH1/CH2 were OFF, `consistent`, and `healthy` before and after. This is not FFT amplitude, frequency, or frequency-axis accuracy evidence.
-
-`scope.acquisition_status_v2` always reads `:ACQuire:TYPE?`, `:ACQuire:SRATe?`, and `:ACQuire:MDEPth?`; it reads `:ACQuire:AVERages?` only when type is `AVER`. The average partition is explicitly not applicable outside AVER mode; in AVER mode it reports only the configured count, while `average.complete` remains unavailable. Run state and segmented status are outside the profile. The driver does not send `:TRIGger:STATus?`, `*OPC?`, `*STB?`, or `*ESR?`, and never infers completion from STOP. Controlled hardware returned `NORM + 500 kSa/s + 10 kpts`; the later average-mode write probe also read back `NORM` throughout, so the AVER branch has no reachable-hardware evidence. Source CH1/CH2 were OFF, `consistent`, and `healthy` before and after. Legacy `scope.acquisition_status` and average capture remain undeclared.
-
-`scope.acquisition_run_state` reads only `:TRIGger:STATus?`: STOP maps to stopped, WAIT maps to waiting, RUN and the recorded AUTO state map to acquiring, and TD normally remains unknown. Only in a just-read-back SINGLE transaction can TD be represented as a nonterminal arming observation, and it must be followed by STOP to form a state-transition proof. `scope.acquisition_control` is declared for `start(normal)`, `stop`, and restricted SINGLE completion. Bounded capture is independent from the terminal control proof: it rejects first STOP, requires `WAIT`/`TD → STOP`, and uses Core-owned 13-field recovery/fresh verification. Running-state MAX and capture lengths, timebases, channel sets, and transports outside the controlled procedure remain unverified.
-
-`scope.digital_status_v2` accepts only D0-D15. Each call first queries the LA module bit; an absent module returns only `shared.module_present=false` and sends no `:LA:*?` query. With LA present, the driver uses six text queries for the per-channel display and label, the shared threshold of the owning POD, global timing calibration, and display size. `position_div` remains unavailable because the manual's query form is self-contradictory. `label_enabled`, activity, technology, and hysteresis have no provable query and are never replaced by defaults or UI active-channel state. Controlled D0 and D8 reads confirmed display, labels, their POD boundaries and `1.4 V` thresholds, plus `0 s` timing calibration and `MEDIUM` size; source CH1/CH2 were OFF, `consistent`, and `healthy` before and after. This is not evidence of logic-probe behavior, electrical threshold accuracy, logic activity, or digital-waveform encoding.
-
-`scope.snapshot_v2` accepts only CH1-CH4 requests, but its current profile reads only current identity and licensed-option state: one `*IDN?` followed by the 13 manual-defined `:SYSTem:OPTion:STATus? <type>` queries. An empty options tuple is returned only after all 13 queries explicitly prove no installed option; no identity field is filled from the descriptor, cache, or model constants. The 55 health, channel, timebase, probe, waveform, and trigger fields are unavailable in stable order. Controlled hardware completed all 14 queries; source CH1/CH2 were OFF, `consistent`, and `healthy` before and after. The operation does not read status registers, the error queue, trigger state, waveform data, or binary data, and is not evidence for any unread partition or its accuracy.
-
-`scope.error_drain_v1` sends every `:SYSTem:ERRor?` read through Core with explicit `ReplayPolicy.NO_REPLAY` and strictly parses `<integer>,"<message>"`. `0,"No error"` is the only hardware-observed terminator; nonzero records, malformed responses, and queue overflow all fail closed. With `scope.check_errors=true`, Core runs a bounded drain before and after bounded fetch/capture and reconciles the actual query count. The controlled public single-channel capture completed both empty drains, returned 1000 samples, and restored the safe final state. Nonempty-record and overflow paths currently have offline fault-injection evidence only. Legacy `scope.errors` remains undeclared, and old paths such as autoscale still require `check_errors=false`.
+Descriptor import does not open a transport, scan ports, send SCPI, or create files. Instrument
+writes and acquisition triggers are not retried blindly. If Core lacks a required safety interface,
+the capability remains unavailable rather than gaining a raw-SCPI escape hatch. Never commit real
+resources, serial numbers, credentials, waveforms, screenshots, or command logs.
 
-The bounded `scope.fetch_waveform` path supports `DEF`, stopped-state `MAX`, and stopped-state `DMAX`. It uses core `query_binary()` rather than legacy `query_bin_block()`; exact `LF` trailing, a `250,000`-byte per-response limit, a `4,000,000`-byte operation limit, up to 16 binary queries, and no replay are descriptor-owned. Before any MAX/DMAX transfer setup, the driver requires stopped state. Fetch evidence does not extend to running-state MAX or other ranges, timebases, memory depths, and probe conditions; bounded capture has separate acceptance above.
+## Development and license
 
-The driver retains the `250,000`-point block, `4,000,000`-point total, and 16-query long-record limits. Stopped-state MAX/DMAX fetch and bounded single/multi-channel capture each have limited hardware evidence. Running-state MAX and capture beyond the recorded point modes, timebases, channel sets, and transport remain unverified.
+The [plugin documentation](doc/README_EN.md) links milestones, RFCs, hardware evidence, and historical
+status. Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md) for
+source work. This plugin is licensed under the [MIT License](LICENSE).
diff --git a/packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MATRIX.md b/packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MATRIX.md
index ba9db2d..373d795 100644
--- a/packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MATRIX.md
+++ b/packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MATRIX.md
@@ -2,59 +2,72 @@
 
 [English](MSO8104_COVERAGE_MATRIX_EN.md)
 
-实施顺序和共同安全规则见 [MSO8104 功能覆盖里程碑](MSO8104_COVERAGE_MILESTONES.md)。命令出现在本矩阵中不表示插件已经实现，也不表示目标固件已经验证。
-
-## 范围与证据口径
-
-审计输入为 RIGOL MSO8000 中文编程手册 `PGA26006-1110`。手册同时覆盖 MSO8064、MSO8104 与 MSO8204，并主要使用 MSO8204 举例；本插件首轮只声明 MSO8104。
-
-当前证据同时包含离线验证和受控实机验收：
-
-- **手册声明**：命令和返回域来自手册；
-- **离线通过**：代码与 FakeTransport/故障注入测试存在；
-- **RFC 后跳过**：WaveBench 核心缺少必要的安全接口或公共模型；
-- **默认拒绝**：基础插件不开放该高风险命令域；
-- **实机通过**：只表示记录的型号、固件、transport 和限定步骤通过，不外推到其他固件、资源、负载或能力；
-- **未实机验证**：当前没有对应受控实机结论。
-
-## 功能矩阵
-
-| 功能域 | 手册命令面 | WaveBench 接口 | 当前状态 | 边界与建议 |
-| --- | --- | --- | --- | --- |
-| 身份 | `*IDN?` | `scope.idn` | 实机通过 | MSO8104 固件 `00.02.02` 经 LAN/PyVISA 严格识别；不外推到其他型号或固件 |
-| 错误队列 | `:SYSTem:ERRor[:NEXT]?` | `scope.error_drain_v1` | 实机通过（受限空队列） | 每条消费型读取显式为 `NO_REPLAY`，严格解析 `<integer>,"<message>"`，仅 `0,"No error"` 终止。公开 bounded capture 的前后各完成一次空 drain 并返回 1000 样本；非零记录和 overflow 仅有离线故障注入证据。legacy `scope.errors` 仍不声明 |
-| 输入安全 | `:CHANnel<n>:COUPling?`、`:CHANnel<n>:IMPedance?` | `scope.channel_coupling`、`scope.channel_input_state_v2` | 实机通过 | legacy 接口继续返回 core 高阻安全 token；V2 分别返回 coupling、termination 与阻抗。CH1/CH2 的 V2 结果均为 `dc + high_z + 1 MΩ`；核心默认拒绝 50 Ω、GND 与未知组合 |
-| 自动设置 | `:SYSTem:AUToscale?`、`:AUToscale` | `scope.autoscale` | 实机通过（固定 `3 s` settle） | 预检系统使能；明确改变垂直、时基和触发且不承诺恢复。对 MSO8104，`wait_opc=true` 不查询 `*OPC?`，写入一次后固定等待 `3 s` 并视为操作完成；写入或等待异常锁存。受控 CH1 `1 Vpp / 1 kHz` probe 随后公开 bounded fetch 返回 1000 样本且幅度有效，最终 source 双路 OFF、scope STOP、CH1/CH2 high_z。该策略不证明内部算法、可见效果或恢复；`wait_opc=false` 无实机完成验收 |
-| 完整状态快照 | channel/timebase/probe/waveform/trigger 与部分 health | `scope.snapshot` | RFC 后跳过 | 公共快照强制要求设备无法查询的字段；`*STB?` 还会清零；见 RFC-0005 |
-| 状态快照 V2 | `*IDN?`、13 种 `:SYSTem:OPTion:STATus? <type>` | `scope.snapshot_v2` | 实机通过（受限 identity/选件） | 固定 14 条纯文本 query；同次读取 identity 与手册列出的全部授权选件状态，空 options 仅在全部 13 项明确未安装时成立。health、channel、timebase、probe、waveform、trigger 的 55 个字段按稳定顺序 unavailable；不读状态寄存器、错误队列、trigger、波形或二进制 |
-| acquisition 基础配置 | type、averages、memory depth、sample rate、run/stop/single | fetch/capture 的既有状态 | M4 离线通过 | capture 沿用既有配置；深度最高 500 Mpts；设置深度会改变采样率 |
-| 采集状态（legacy） | averages 与 trigger status | `scope.acquisition_status` | RFC 后跳过 | legacy 模型要求 average-complete 与 segmented 状态，设备没有对应查询；trigger STOP 不替代平均完成；见 RFC-0006 |
-| 采集状态 V2 | `:ACQuire:TYPE?`、`:ACQuire:SRATe?`、`:ACQuire:MDEPth?`，AVER 时 `:ACQuire:AVERages?` | `scope.acquisition_status_v2` | 实机通过（受限 NORM） | 固定 3 条纯读取 query；AVER 时第 4 条读取配置次数。当前回包为 `NORM + 500 kSa/s + 10 kpts`；average 在 NORM 下为 not applicable，run state 与 segmented 为 unavailable。受控设置探测对 `AVERages`、`AVER` 及 PEAK/NORM 对照均回读 `NORM`，所以 AVER 分支没有可达性证据；不从 STOP、OPC 或已配置次数推导完成 |
-| 采集运行状态 | `:TRIGger:STATus?` | `scope.acquisition_run_state` | 实机通过（受限观察） | 单条文本 query；STOP→stopped、WAIT→waiting、RUN/AUTO→acquiring，TD→unknown。实机从 AUTO 经 STOP 进入 stopped，再经 NORMAL/RUN 观察到 WAIT，最终 STOP；不以状态查询证明 SINGLE 完成 |
-| 采集控制 | `:RUN`、`:STOP`、`:SINGle`、`:TRIGger:SWEep?`、`:ACQuire:TYPE?` | `scope.acquisition_control` | 实机通过（受限） | 已声明 `start(normal)`、`stop` 与完成式 SINGLE。SINGLE 后先读回 `SING`；首条 `STOP` 使用受限终态 proof，`WAIT/TD → STOP` 使用状态迁移 proof。`*OPC?` 不参与 completion，只用于 capture 恢复写批次同步；证据仅限记录的 LAN/PyVISA 与低压步骤 |
-| 平均采集事务 | global acquisition type 与 averages | `scope.capture_average_v2` | 实机前提失败后跳过 | 当前 Core 已有 V2 合同，但已停止、高阻、1 Vpp 方波的受控 probe 对 `:ACQuire:TYPE AVERages`、`AVER` 及 PEAK/NORM 对照写入同步后均回读 `NORM`，错误队列为 `0,"No error"`。设备当前不能远程进入平均模式；手册另无平均完成位，STOP、OPC 和 preamble count 都不能替代完成证明；见 RFC-0006 |
-| 时基与 edge trigger | main offset/scale、MAIN/XY/ROLL、edge settings/status | capture 前提 | 部分离线通过 | capture 只读前提并沿用配置；任意 setter 不开放，完整 snapshot 见 RFC-0005 |
-| 当前屏幕波形 | `WAVeform` NORM/BYTE/preamble/data | `scope.fetch_waveform` | 实机通过（受限 `DEF`） | `LF` trailing、`1,000` bytes 和一次 binary query 已实机通过，core 已完成恢复与新鲜验证。记录的 `1 kHz / 1 Vpp / 0 V` 信号源下，CH1 为 `1.05713 Vpp / 1000 Hz`，CH2 为 `1.0705 Vpp / 999.167 Hz` |
-| 深存储波形 | MAX/RAW、start/stop 分块 | `scope.fetch_waveform` | 实机通过（受限 stopped MAX/DMAX） | 唯一 bounded profile 限制每响应 `250,000` bytes、每操作 `4,000,000` bytes、16 次 binary query。MAX/DMAX 均须先观察到 STOP，再读取 memory depth 并把 points 收紧为 memory depth、运行时总点数和 16 倍 chunk 的最小值；不发送 RUN/STOP/SINGLE。source 双路 OFF、CH1/CH2 高阻、当前 `10 kpts` memory depth、`20 kpts / 2.5 kpts chunk` 条件下，CH1/CH2 各自的 MAX/DMAX 均返回 `10,000` 样本并完成五字段 restore/fresh verify。运行态 MAX、其他深度、吞吐和 timeout 未验证 |
-| 单次与多通道 | `:SINGle`、trigger status、逐源 waveform | `scope.capture_waveform`、`scope.capture_waveforms` | 实机通过（受限 bounded `DEF + BYTE`） | 仅接受已停止、MAIN 时基的 `DEF + BYTE` 基线；capture 必须观察 `WAIT/TD → STOP`，不接受首条 STOP。单通道和双通道各验证每通道 `1,000` 样本；双通道只发送一次 SINGLE、读取两次二进制数据。Core 恢复并新鲜验证 acquisition、trigger、MAIN 时基、四路 display/vertical 与 transfer 共 13 个字段；其他点数、时基、通道组合和 transport 未验证 |
-| 数学波形元数据 | `:MATH<n>:DISPlay?`、waveform MATH source/NORM/BYTE/preamble | `scope.math_metadata` | 实机通过（受限 MATH1） | 已显示 MATH1、MAIN、source 双路 OFF、scope STOP／高阻下，公开调用返回 1000 点、有限轴、8 位 BYTE 元数据，并完成六项 transfer 状态恢复／最终复核；不读取 data、不证明数学内容、其他 operator／槽位轴语义或 FFT 精度 |
-| 光标读数 | cursor mode/type/source/unit/value/delta queries | `scope.cursor_readout`、`scope.cursor_readout_v2` | 实机通过（受限 `MAN + TIME` 与 `TRAC`） | legacy 仅保留手动同源窄子集。V2 使用全局寻址；手动 `TIME/AMPL` 维持原有读取，追踪仅接受 `MAIN/ROLL` 与 `CHAN1`～`CHAN4`。实机 `MAN + TIME + CHAN1/CHAN1` 返回有限 X A/B、`ΔX` 和 `1/ΔX`，单位为秒和 Hz；`TRAC + CHAN2/CHAN2` 返回有限 X/Y/差值，Y 为 `V`。追踪最多 13 条纯文本 query，不移动光标。Math、XY、测量、`NONE`、LA、未知或不同纵轴单位均 fail closed；不同/未知单位时不读取 `ΔY`，准确度未验证 |
-| 截图 | `:SAVE:IMAGe:TYPE?`、`:SAVE:IMAGe:DATA?` | `scope.screenshot_profile`、`scope.screenshot_v2` | 实机通过（受限 BMP24→PNG） | 仅 `png/device/device`；先只读确认 PNG，再以一次 `DEFINITE_BLOCK` 读取。profile 采用单响应／单操作 `8,388,608` bytes、精确 `LF` trailing、零 resynchronization、零状态变更与恢复；不使用 `:DISPlay:DATA?`，不写 TYPE／INVert／COLor／菜单，不创建设备文件。记录固件实际回传无压缩 BMP24，driver 严格验证后在内存中转换为 PNG。公开调用返回 `1024 × 600`、`47,584` bytes 的 PNG，前后错误队列为空且 session healthy；视觉／像素准确度、其他屏幕状态和最大 payload 未验证；见 RFC-0003 |
-| 数字通道状态（legacy） | `:SYSTem:MODules?`、`:LA:*?` | `scope.digital_status` | RFC 后跳过 | legacy 模型必填 activity、technology、hysteresis 等设备无法查询的字段；见 RFC-0004 |
-| 数字通道状态 V2 | `:SYSTem:MODules?`、`:LA:DIGital:DISPlay?`、`:LA:DIGital:LABel?`、`:LA:POD<n>:THReshold?`、`:LA:TCALibrate?`、`:LA:SIZE?` | `scope.digital_status_v2` | 实机通过（受限 D0/D8 静态状态） | 每次先读 LA 模块；模块缺席时只返回 `shared.module_present=false`，不发 `:LA:*?`。模块存在时固定 6 条文本 query；D0/D8 均返回 displayed、label、对应 POD 范围与 `1.4 V` 阈值、`0 s` timing calibration、`MEDIUM` size。position、label-enabled、activity、technology、hysteresis 均为 unavailable；不读取波形、不推断逻辑活动或数字编码 |
-| 数字波形 | D0～D15 waveform source/data | `scope.digital_waveform` | 手册证据不足后跳过 | 公共 bitset 模型可用，但手册未定义 BYTE/WORD 的 LOW/HIGH code，WORD 字节序也不明确 |
-| 自动测量与统计 | `:MEASure:STATistic:ITEM? <type>,<item>,<source...>` | `scope.measurement_statistics_v2` | 实机通过（受限 `VPP,CHAN1/CHAN2`） | 只接受显式 item/source；6 条纯读取查询返回 CURRENT、AVERages、DEViation、MINimum、MAXimum 与 CNT，`include_buffer=True` 拒绝。受控实机的 `VPP,CHAN1/CHAN2` 均返回完整数值并有 `CNT=1000`；不写入统计配置、清零或显示。legacy slot 接口继续不声明；其他 item/source、双源/数字源语义和统计准确度未验证 |
-| FFT 状态 | `:MATH<n>:OPERator?` 与 `:MATH<n>:FFT:*?` | `scope.fft_status_v2` | 实机通过（受限 MATH1） | 先确认 operator 为 `FFT`，再读取 source、window、vertical unit、起始/终止频率，合计 6 条纯读取 query。前面板 MATH1 实测回包为 `FFT + CHAN1 + HANN + VRMS + 0–1 MHz`；前后 source 两路 OFF、`consistent`、`healthy`。average-complete、RBW 与 FFT sample rate 固定 unavailable，不从全局采样率、频率范围或点数推导；不构成 FFT 精度证据，legacy 接口继续不声明 |
-| Reference 元数据 | source、vertical scale/offset、label | `scope.reference_metadata` | 手册证据不足后跳过 | waveform source 不接受 REF，无法查询轴、点数与 Y 分辨率 |
-| History 时间戳 | record enable/start/play/current/frames | `scope.history_timestamps` | 手册证据不足后跳过 | 没有逐帧 relative/calendar timestamp；帧号不冒充时间戳 |
-| DVM/counter | DVM 与 counter 命令族 | 当前无合适 scope capability | RFC 后跳过 | 需要新的类型化公共模型与 Service |
-| AWG | `:SOURce*` | scope descriptor 不应私自混入 source API | RFC 后跳过 | 需要解决同一物理资源的多 kind/共享 lease |
-| 协议、mask、search、record | 大量选件命令族 | 当前无对应基础接口 | RFC 后跳过 | 选件、状态恢复和结果模型需独立设计 |
-| reset、网络、选件安装、文件系统、校准 | 系统与存储命令 | 无 | 默认拒绝 | 不进入普通实验流程 |
+本页将 MSO8000 编程手册的功能域映射到外置 `wavebench-rigol-mso8000` 插件当前公开的
+WaveBench capability。当前包版本、依赖和入口点以 [包元数据](../pyproject.toml)为准，型号、
+capability、binary profile 和请求限制以
+[production descriptor](../src/wavebench_rigol_mso8000/descriptor.py) 为准，精确 SCPI、解析与
+恢复行为以 [driver](../src/wavebench_rigol_mso8000/driver.py) 为准。
+
+[受控实机验收记录](MSO8104_HARDWARE_ACCEPTANCE.md)保存设备、固件、transport、测试条件、
+具体结果和未验收范围；[功能覆盖里程碑](MSO8104_COVERAGE_MILESTONES.md)保存开发顺序与
+历史决策。这些页面用于追溯，不会独立增加当前 capability。
+
+## 范围
+
+审计输入为 RIGOL MSO8000 编程手册 `PGA26006-1110`。手册覆盖 MSO8064、MSO8104 和
+MSO8204，并经常使用 MSO8204 举例；production descriptor 只登记 MSO8104。因此，手册命令
+和其他型号参数不能直接外推到当前插件。
+
+本矩阵只回答「production descriptor 当前公开什么」以及「公开行为的边界是什么」。
+手册命令、Python 方法、里程碑完成状态或一次实机成功都不能替代 descriptor 声明。
+
+## 功能覆盖
+
+| 功能域 | 手册命令面 | 当前公开 capability | 当前边界 |
+|---|---|---|---|
+| 身份 | `*IDN?` | `scope.idn` | 只匹配 descriptor 中登记的 MSO8104 identity pattern；不向其他型号或固件外推。 |
+| 错误队列 | `:SYSTem:ERRor[:NEXT]?` | `scope.error_drain_v1` | 消费型读取标记为 `NO_REPLAY`；严格解析记录并以零错误终止。legacy `scope.errors` 未声明。 |
+| 输入安全 | coupling、termination、impedance query | `scope.channel_coupling`、`scope.channel_input_state_v2` | legacy 返回 Core 高阻安全 token；V2 分开表达 coupling、termination 与阻抗。未知组合会失败。 |
+| Autoscale | system autoscale enable 与 autoscale command | `scope.autoscale` | 会改变垂直、时基和触发且不承诺恢复；调用失败会锁停相应写入。 |
+| 完整 legacy snapshot | channel、timebase、probe、waveform、trigger、health | 未声明 | 设备无法可靠提供公共模型的全部必填字段。 |
+| Snapshot V2 | identity 与授权选件状态 | `scope.snapshot_v2` | 只读取 descriptor profile 声明的字段；其余 health、channel、timebase、probe、waveform 和 trigger 字段返回 unavailable。 |
+| Acquisition 基础配置 | type、averages、depth、rate、run/stop/single | 作为 fetch／capture 前置状态使用 | 没有公开任意 acquisition 配置 setter。 |
+| Legacy acquisition status | averages 与 trigger status | 未声明 | legacy 合同要求设备无法可靠证明的 average completion 与 segmented 状态。 |
+| Acquisition status V2 | type、sample rate、memory depth、AVER count | `scope.acquisition_status_v2` | 只返回 descriptor profile 中可读或条件适用的字段；不从 STOP、OPC 或配置次数推导完成。 |
+| Acquisition run state | `:TRIGger:STATus?` | `scope.acquisition_run_state` | 映射 stopped／waiting／acquiring／unknown；状态读取不证明 SINGLE 已完成。 |
+| Acquisition control | `:RUN`、`:STOP`、`:SINGle` 与状态 query | `scope.acquisition_control` | 只公开 `start(normal)`、`stop` 和完成式 SINGLE；写入不会盲目重试，completion 不以 `*OPC?` 单独证明。 |
+| Average capture | global acquisition type 与 average count | 未声明 | 当前插件不能可靠进入并证明平均采集完成。 |
+| 当前屏幕波形 | NORM／BYTE／preamble／data | `scope.fetch_waveform` | 支持有界 `DEF` 读取；payload、轴参数和换算结果必须完整且为有限值。 |
+| 深存储波形 | MAX／RAW 与分块 | `scope.fetch_waveform` | 只在确认 stopped 后读取 MAX／DMAX，并受 descriptor 的总点数、单块点数、响应大小和 query 数限制。 |
+| 单次与多通道采集 | SINGLE、trigger status、逐 source waveform | `scope.capture_waveform`、`scope.capture_waveforms` | 只接受受支持的 MAIN／`DEF + BYTE` 基线；多通道只触发一次，再逐通道读取。恢复字段与预算由 descriptor 定义。 |
+| Math 元数据 | MATH display 与 waveform preamble | `scope.math_metadata` | 只读取元数据，不读取 math data，也不声明运算内容或准确度。 |
+| 光标读数 | mode、type、source、unit、value、delta | `scope.cursor_readout`、`scope.cursor_readout_v2` | legacy 保留窄的手动同源子集；V2 只接受 profile 支持的寻址、source 和单位组合，不移动光标。 |
+| 截图 | image type 与 binary data | `scope.screenshot_profile`、`scope.screenshot_v2` | 只接受 descriptor 声明的 `png/device/device` 请求；设备返回内容在内存中严格校验并转换，不写设备文件或显示设置。 |
+| Legacy digital status | module 与 LA status | 未声明 | 设备无法提供 legacy 模型要求的全部字段。 |
+| Digital status V2 | module、display、label、threshold、timing calibration、size | `scope.digital_status_v2` | 先检查 LA module；模块不存在时不发送 LA query。只返回静态状态，不推断逻辑活动或 waveform 编码。 |
+| Digital waveform | D0–D15 source 与 data | 未声明 | BYTE／WORD logic code 与 WORD 字节序没有足够的公开合同。 |
+| 自动测量统计 | `:MEASure:STATistic:ITEM?` | `scope.measurement_statistics_v2` | 需要显式 item／source；不支持 buffer，不修改统计配置、清零或显示状态。 |
+| FFT 状态 | MATH operator 与 FFT query | `scope.fft_status_v2` | 先确认 operator 为 FFT；只返回 profile 声明字段，不推导 average completion、RBW 或 FFT sample rate。 |
+| Reference 元数据 | source、vertical scale／offset、label | 未声明 | 当前手册与设备接口不能完整表达轴、点数和 Y resolution。 |
+| History 时间戳 | record state、frame 与 timestamp | 未声明 | 帧号不能替代逐帧相对或日历时间戳。 |
+| DVM、counter、AWG | 对应厂商命令族 | 未声明 | 当前 Scope 合同或共享资源模型不足，不通过 raw SCPI 绕过。 |
+| Protocol、mask、search、record | 选件相关命令族 | 未声明 | 需要独立的选件、状态恢复和结果模型。 |
+| reset、网络、选件安装、文件系统、校准 | system 与 storage 命令 | 未声明 | 属于高副作用维护操作，默认不进入普通实验流程。 |
+
+## Binary profile 边界
+
+精确 response／operation budget、query 上限、trailing bytes、restore order 和 screenshot variant
+由 [production descriptor](../src/wavebench_rigol_mso8000/descriptor.py) 的
+`ScopeDescriptorExtensions` 定义。文档不维护第二份数值表。
+
+- `fetch`、`capture_single` 和 `capture_multiple` 使用彼此独立的 waveform operation profile。
+- `capture_multiple` 只触发一次采集，再读取多个通道；不能逐通道重新触发。
+- Screenshot 使用 `DEFINITE_BLOCK` framing；不修改 image type、菜单、颜色或设备文件。
+- `tcpip`、`usb` 和 `gpib` resource scheme 只表示路由合同，不表示每种连接都已有实机证据。
 
 ## 波形换算合同
 
-首轮 BYTE 波形使用手册定义的 10 字段 preamble：
+BYTE 波形使用手册定义的 10 字段 preamble：
 
 ```text
 format,type,points,count,xincrement,xorigin,xreference,yincrement,yorigin,yreference
@@ -68,18 +81,13 @@ x_start = x_origin - x_reference * x_increment
 x_stop  = x_start + (points - 1) * x_increment
 ```
 
-payload 必须与点数精确一致；所有轴参数与换算结果必须为有限数。核心 transport 已负责 IEEE/TMC block framing，插件不重复解析 `#N<length>` 头。
-
-## 未实机验证项
-
-- USB 和 GPIB 资源的连接与终止符；
-- 错误队列的非零记录、队列顺序和 overflow；
-- `*OPC?` 在两次 source 双路 OFF 的 SINGLE 探测中返回成功后仍可读到 WAIT；它不能作为目标采集完成证据；
-- 运行态 MAX、其他 memory depth/点数下的 MAX/DMAX 吞吐、分块和 timeout；
-- 除记录的 `DEF + LF`、`1 kHz / 1 Vpp / 0 V` 条件外的 X/Y 换算与测量准确度；
-- 除受控 `DEF + BYTE` 条件外的 capture 点数、时基、通道组合、transport 和波形准确度；
-- 截图视觉／像素准确度、其他屏幕状态、最大 payload，以及 BMP24 以外的设备返回格式；
-- RAW chunk 上限、吞吐和 timeout；
-- WORD 字节序与有效位宽；
-- 快照 V2 中 identity/选件以外的 health、channel、timebase、probe、waveform 与 trigger 字段；
-- 数字探头、电气阈值、逻辑活动、数字 waveform 编码和任何测量准确度。
+payload 必须与点数精确一致；所有轴参数与换算结果必须为有限值。Core transport 负责
+IEEE／TMC block framing，插件不重复解析 `#N<length>` 头。
+
+## 相关来源
+
+- [Production descriptor](../src/wavebench_rigol_mso8000/descriptor.py)
+- [Driver implementation](../src/wavebench_rigol_mso8000/driver.py)
+- [受控实机验收与未验收范围](MSO8104_HARDWARE_ACCEPTANCE.md)
+- [开发里程碑与历史决策](MSO8104_COVERAGE_MILESTONES.md)
+- [相关 RFC](rfcs/README.md)
diff --git a/packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MATRIX_EN.md b/packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MATRIX_EN.md
index 6a05fb6..c61a751 100644
--- a/packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MATRIX_EN.md
+++ b/packages/wavebench-rigol-mso8000/doc/MSO8104_COVERAGE_MATRIX_EN.md
@@ -2,45 +2,85 @@
 
 [中文](MSO8104_COVERAGE_MATRIX.md)
 
-See [MSO8104 Coverage Milestones](MSO8104_COVERAGE_MILESTONES_EN.md) for sequencing and safety rules. A command listed here is neither an implementation claim nor hardware evidence.
-
-The audited source is RIGOL MSO8000 Programming Guide `PGA26006-1110`, which covers MSO8064, MSO8104, and MSO8204 and frequently uses MSO8204 examples. This plugin initially names only MSO8104.
-
-| Domain | Manual surface | WaveBench contract | Plan and boundary |
-| --- | --- | --- | --- |
-| Identity | `*IDN?` | `scope.idn` | Hardware complete for MSO8104 firmware `00.02.02` over LAN/PyVISA; no model or firmware extrapolation |
-| Error queue | `:SYSTem:ERRor[:NEXT]?` | `scope.error_drain_v1` | Hardware verified for restricted empty queue | Every consumed read is explicitly `NO_REPLAY`; the driver strictly parses `<integer>,"<message>"` and only `0,"No error"` terminates. Public bounded capture completed an empty drain before and after returning 1000 samples; nonzero records and overflow have offline fault-injection evidence only. Legacy `scope.errors` remains undeclared |
-| Input safety | channel coupling and impedance queries | `scope.channel_coupling`, `scope.channel_input_state_v2` | Hardware complete: the legacy route retains core high-impedance tokens, while V2 separately returns coupling, termination, and impedance. CH1/CH2 V2 both returned `dc + high_z + 1 MΩ`; the core rejects 50 ohms, GND, or unknown states by default |
-| Autoscale | system autoscale enable and autoscale command | `scope.autoscale` | Hardware verified for fixed `3 s` settle | Preflight system enable; acknowledge vertical/timebase/trigger mutation without restoration. For MSO8104, `wait_opc=true` does not query `*OPC?`: it writes once, waits a fixed `3 s`, and treats that as operation completion; write or wait failure latches the domain. A controlled CH1 `1 Vpp / 1 kHz` probe then used public bounded fetch and returned 1,000 samples with amplitude evidence; final state was both source outputs OFF, scope STOP, and CH1/CH2 high impedance. This policy does not prove the internal algorithm, visible effect, or restoration; `wait_opc=false` has no hardware-completion acceptance |
-| Complete snapshot | channel, timebase, probe, waveform, trigger, and partial health | `scope.snapshot` | RFC and skip; mandatory fields are unavailable and `*STB?` clears state; see RFC-0005 |
-| Snapshot V2 | `*IDN?` and 13 `:SYSTem:OPTion:STATus? <type>` queries | `scope.snapshot_v2` | Hardware verified for restricted identity/licensed options | Fourteen fixed text queries read identity and every manual-defined licensed-option status in one call; an empty options tuple exists only if all 13 explicitly prove not installed. All 55 health, channel, timebase, probe, waveform, and trigger fields are unavailable in stable order; no status register, error queue, trigger, waveform, or binary read occurs |
-| Existing acquisition configuration | type, averages, depth, rate, run/stop/single | fetch/capture preconditions | M4 offline complete; preserve current settings, and do not expose unrestricted setters |
-| Acquisition status (legacy) | averages and trigger status | `scope.acquisition_status` | RFC and skip; the legacy model requires average completion and segmented status, while trigger STOP is not average completion; see RFC-0006 |
-| Acquisition status V2 | `:ACQuire:TYPE?`, `:ACQuire:SRATe?`, `:ACQuire:MDEPth?`, and `:ACQuire:AVERages?` in AVER mode | `scope.acquisition_status_v2` | Hardware verified for restricted NORM | Three fixed pure queries, with a fourth configured-count read only in AVER mode. Current response was `NORM + 500 kSa/s + 10 kpts`; average is not applicable in NORM, and run state/segmented status are unavailable. Controlled setting probes for `AVERages`, `AVER`, and PEAK/NORM controls all read back `NORM`, so the AVER branch has no reachable-hardware evidence. STOP, OPC, and configured count never imply completion |
-| Acquisition run state | `:TRIGger:STATus?` | `scope.acquisition_run_state` | Hardware verified for restricted observation | One text query: STOP→stopped, WAIT→waiting, RUN/AUTO→acquiring, and TD→unknown. Hardware moved from AUTO through STOP, then observed WAIT after NORMAL/RUN, and finally STOP; state observation does not prove SINGLE completion |
-| Acquisition control | `:RUN`, `:STOP`, `:SINGle`, `:TRIGger:SWEep?`, and `:ACQuire:TYPE?` | `scope.acquisition_control` | Hardware verified for the restricted procedure | `start(normal)`, `stop`, and completion-style SINGLE are declared. After SINGLE, the driver reads back `SING`; terminal first `STOP` uses the restricted terminal proof, while `WAIT`/`TD → STOP` uses the state-transition proof. `*OPC?` is not completion evidence; capture uses it only to synchronize recovery writes |
-| Average capture transaction | global acquisition type and average count | `scope.capture_average_v2` | Skip after failed hardware prerequisite | The current Core has the V2 contract, but the stopped/high-impedance 1 Vpp-square probe synchronized `:ACQuire:TYPE AVERages`, `AVER`, and PEAK/NORM control writes and always read back `NORM`; the error queue returned `0,"No error"`. The device cannot currently enter average mode remotely. The manual also lacks an average-complete bit; STOP, OPC, and preamble count cannot replace completion proof; see RFC-0006 |
-| Current waveform | NORM/BYTE/preamble/data | `scope.fetch_waveform` | Hardware complete for limited `DEF`: exact `LF` trailing, `1,000` bytes, and one binary query pass on hardware, and core completes restore/fresh verification. Under the recorded `1 kHz / 1 Vpp / 0 V` source condition, CH1 returned `1.05713 Vpp / 1000 Hz` and CH2 returned `1.0705 Vpp / 999.167 Hz` |
-| Deep waveform | MAX/RAW and chunk ranges | `scope.fetch_waveform` | Hardware complete for restricted stopped-state MAX/DMAX | The one bounded profile limits each response to `250,000` bytes, an operation to `4,000,000` bytes, and binary I/O to 16 queries. MAX/DMAX first require observed STOP, then read memory depth and narrow points to the minimum of memory depth, the runtime total-point limit, and 16 chunks; they never send RUN/STOP/SINGLE. With both sources OFF, CH1/CH2 high impedance, `10 kpts` current memory depth, and `20 kpts / 2.5 kpts chunks`, both MAX and DMAX returned `10,000` samples on both channels and completed five-field restore/fresh verification. Running-state MAX, other depths, throughput, and timeout remain unverified |
-| Single and multi-channel capture | SINGLE, trigger status, and per-source waveform | `scope.capture_waveform`, `scope.capture_waveforms` | Hardware verified for bounded `DEF + BYTE` capture | Capture accepts only an already-stopped MAIN-timebase `DEF + BYTE` baseline and requires `WAIT`/`TD → STOP`; first STOP is not waveform-freshness evidence. Controlled single- and multi-channel capture each returned `1,000` samples per channel. The multi-channel call sent one SINGLE and read two binary payloads. Core restored and freshly verified 13 acquisition, trigger, timebase, display/vertical, and transfer fields; other lengths, settings, channel sets, and transports remain unverified |
-| Math waveform metadata | MATH display and waveform MATH source/NORM/BYTE/preamble | `scope.math_metadata` | Hardware verified for restricted MATH1: with displayed MATH1, MAIN, both sources OFF, and scope STOP/high impedance, the public call returned 1,000 points, finite axes, and eight-bit BYTE metadata with final six-field transfer restoration verification. It read no data and does not prove math content, axis semantics for other operators/slots, or FFT accuracy |
-| Cursor readout | cursor mode, type, source, unit, value, and delta queries | `scope.cursor_readout`, `scope.cursor_readout_v2` | Hardware verified for restricted `MAN + TIME` and `TRAC` | Legacy keeps only its same-source manual subset. V2 uses global addressing: manual `TIME/AMPL` retains the existing path, while tracking accepts only `MAIN/ROLL` and `CHAN1`-`CHAN4`. Hardware `MAN + TIME + CHAN1/CHAN1` returned finite X A/B, `ΔX`, and `1/ΔX` values in seconds and Hz; `TRAC + CHAN2/CHAN2` returned finite X/Y/delta values with Y in `V`. Tracking uses at most 13 pure-text queries and does not move cursors. Math, XY, measurement, `NONE`, LA, and unknown or unequal vertical units fail closed; it does not read `ΔY` for unknown/unequal units, and accuracy remains unverified |
-| Screenshot | `:SAVE:IMAGe:TYPE?`, `:SAVE:IMAGe:DATA?` | `scope.screenshot_profile`, `scope.screenshot_v2` | Hardware verified for restricted BMP24-to-PNG conversion | Only `png/device/device`: read and require PNG first, then make one `DEFINITE_BLOCK` read. The profile adopts an `8,388,608`-byte response/operation ceiling, exact `LF` trailing, zero resynchronization, and no changed/restored state. It does not use `:DISPlay:DATA?`, write TYPE/INVert/COLor/menu, or create instrument files. Recorded firmware returned uncompressed BMP24, which the driver strictly validates and converts in memory to PNG. The public call returned a `1024 × 600`, `47,584`-byte PNG with empty error drains before/after and a healthy session. Visual/pixel accuracy, other screen states, and maximum payload remain unverified. See RFC-0003 |
-| Digital status (legacy) | hardware-module and LA status queries | `scope.digital_status` | RFC and skip; the legacy model requires activity, technology, hysteresis, and other fields the device cannot query; see RFC-0004 |
-| Digital status V2 | `:SYSTem:MODules?`, `:LA:DIGital:DISPlay?`, `:LA:DIGital:LABel?`, `:LA:POD<n>:THReshold?`, `:LA:TCALibrate?`, and `:LA:SIZE?` | `scope.digital_status_v2` | Hardware verified for restricted D0/D8 static state | Each call first reads the LA module bit; an absent module returns only `shared.module_present=false` and sends no `:LA:*?` query. With LA present, six fixed text queries return display, label, POD range and `1.4 V` threshold, `0 s` timing calibration, and `MEDIUM` size for D0/D8. Position, label-enabled, activity, technology, and hysteresis stay unavailable; the operation neither reads waveform data nor infers logic activity or encoding |
-| Digital waveform | D0-D15 waveform source and data | `scope.digital_waveform` | Manual-evidence gap and skip; the bitset model is suitable, but BYTE/WORD logic codes are undefined and WORD byte order is unclear |
-| Measurement statistics | `:MEASure:STATistic:ITEM? <type>,<item>,<source...>` | `scope.measurement_statistics_v2` | Hardware complete for restricted `VPP,CHAN1/CHAN2`: explicit item/source only, six pure reads for CURRENT, AVERages, DEViation, MINimum, MAXimum, and CNT, and `include_buffer=True` rejected. Both controlled VPP reads returned complete numeric results with `CNT=1000`; no statistics configuration, reset, or display write occurs. The legacy slot route remains undeclared; other item/source, dual-source/digital-source semantics, and statistics accuracy remain unverified |
-| FFT status | `:MATH<n>:OPERator?` and `:MATH<n>:FFT:*?` | `scope.fft_status_v2` | Hardware verified for restricted MATH1 | First require `OPERator? == FFT`, then read source, window, vertical unit, and start/stop frequency in six pure queries. Front-panel MATH1 returned `FFT + CHAN1 + HANN + VRMS + 0–1 MHz`; source CH1/CH2 were OFF, `consistent`, and `healthy` before and after. Average completion, RBW, and FFT sample rate are always unavailable and never inferred from global sample rate, frequency range, or points. This is not FFT accuracy evidence; the legacy route remains undeclared |
-| Reference metadata | source, vertical display, and label settings | `scope.reference_metadata` | Vendor-evidence gap and skip; REF is not a waveform source, so axes, points, and Y resolution are unavailable |
-| History timestamps | record enable/start/play/current/frame count | `scope.history_timestamps` | Vendor-evidence gap and skip; no per-frame relative or calendar timestamp exists |
-| DVM and counter | DVM/counter families | no suitable scope capability | RFC and skip |
-| AWG | source families | unresolved shared-resource multi-kind contract | RFC and skip |
-| Protocol, mask, search, record | option-heavy application families | no base contract | RFC and skip |
-| Reset, network, option install, files, calibration | system/storage families | none | Default deny |
-
-## Waveform contract
-
-BYTE conversion uses the ten-field preamble and these equations:
+This page maps MSO8000 programming-guide domains to the WaveBench capabilities currently exposed
+by the external `wavebench-rigol-mso8000` plugin. The [package metadata](../pyproject.toml) is
+authoritative for version, dependencies, and entry point; the
+[production descriptor](../src/wavebench_rigol_mso8000/descriptor.py) for model, capabilities,
+binary profiles, and request limits; and the [driver](../src/wavebench_rigol_mso8000/driver.py) for
+exact SCPI, parsing, and restoration behavior.
+
+The [controlled hardware acceptance record](MSO8104_HARDWARE_ACCEPTANCE_EN.md) retains device,
+firmware, transport, test conditions, exact results, and unaccepted scope. The
+[coverage milestones](MSO8104_COVERAGE_MILESTONES_EN.md) retain development order and historical
+decisions. Those records support traceability and do not independently add a current capability.
+
+## Scope
+
+The audited source is RIGOL MSO8000 Programming Guide `PGA26006-1110`. It covers MSO8064,
+MSO8104, and MSO8204 and frequently uses MSO8204 examples; the production descriptor registers
+only MSO8104. Manual commands and parameters for other models therefore do not automatically apply
+to this plugin.
+
+This matrix answers what the production descriptor currently exposes and the boundaries of that
+public behavior. A manual command, Python method, completed milestone, or one successful hardware
+run cannot replace a descriptor declaration.
+
+## Functional coverage
+
+| Domain | Manual surface | Current public capability | Current boundary |
+|---|---|---|---|
+| Identity | `*IDN?` | `scope.idn` | Matches only the MSO8104 identity pattern registered by the descriptor; no model or firmware extrapolation. |
+| Error queue | `:SYSTem:ERRor[:NEXT]?` | `scope.error_drain_v1` | Consuming reads are `NO_REPLAY`; records are parsed strictly and terminate on zero error. Legacy `scope.errors` is not declared. |
+| Input safety | coupling, termination, impedance queries | `scope.channel_coupling`, `scope.channel_input_state_v2` | Legacy returns the Core high-impedance token; V2 separates coupling, termination, and impedance. Unknown combinations fail closed. |
+| Autoscale | system autoscale enable and autoscale command | `scope.autoscale` | Mutates vertical, timebase, and trigger state without promising restoration. Failure latches the relevant write path. |
+| Complete legacy snapshot | channel, timebase, probe, waveform, trigger, health | Not declared | The device cannot reliably supply every required field in the public model. |
+| Snapshot V2 | identity and licensed-option status | `scope.snapshot_v2` | Reads only fields declared by the descriptor profile; remaining health, channel, timebase, probe, waveform, and trigger fields are unavailable. |
+| Existing acquisition configuration | type, averages, depth, rate, run/stop/single | Used as fetch/capture preconditions | No arbitrary acquisition-configuration setter is public. |
+| Legacy acquisition status | averages and trigger status | Not declared | The legacy contract requires average-completion and segmented state that the device cannot reliably prove. |
+| Acquisition status V2 | type, sample rate, memory depth, AVER count | `scope.acquisition_status_v2` | Returns only readable or conditionally applicable profile fields. STOP, OPC, and configured count never imply completion. |
+| Acquisition run state | `:TRIGger:STATus?` | `scope.acquisition_run_state` | Maps stopped/waiting/acquiring/unknown; observing state does not prove SINGLE completion. |
+| Acquisition control | `:RUN`, `:STOP`, `:SINGle`, status queries | `scope.acquisition_control` | Exposes only `start(normal)`, `stop`, and completion-style SINGLE. Writes are not blindly retried, and `*OPC?` alone is not completion proof. |
+| Average capture | global acquisition type and average count | Not declared | The current plugin cannot reliably enter average mode and prove completion. |
+| Current-screen waveform | NORM/BYTE/preamble/data | `scope.fetch_waveform` | Supports bounded `DEF` reads; payload, axes, and converted samples must be complete and finite. |
+| Deep waveform | MAX/RAW and chunks | `scope.fetch_waveform` | Reads MAX/DMAX only after observed stopped state and within descriptor limits for points, response size, operation size, and query count. |
+| Single/multi-channel capture | SINGLE, trigger status, per-source waveform | `scope.capture_waveform`, `scope.capture_waveforms` | Supports the declared MAIN/`DEF + BYTE` baseline. Multi-channel capture triggers once, then reads each channel. Restore fields and budgets come from the descriptor. |
+| Math metadata | MATH display and waveform preamble | `scope.math_metadata` | Reads metadata, not math data, and makes no claim about calculation content or accuracy. |
+| Cursor readout | mode, type, source, unit, value, delta | `scope.cursor_readout`, `scope.cursor_readout_v2` | Legacy retains a narrow manual same-source subset. V2 accepts only profile-supported addressing, sources, and unit combinations and never moves cursors. |
+| Screenshot | image type and binary data | `scope.screenshot_profile`, `scope.screenshot_v2` | Accepts only the descriptor's `png/device/device` request. Returned data is strictly validated and converted in memory; no device file or display setting is changed. |
+| Legacy digital status | module and LA status | Not declared | The device cannot provide every required legacy-model field. |
+| Digital status V2 | module, display, label, threshold, timing calibration, size | `scope.digital_status_v2` | Checks the LA module first and sends no LA query when absent. Returns static state only and does not infer activity or waveform encoding. |
+| Digital waveform | D0-D15 source and data | Not declared | BYTE/WORD logic codes and WORD byte order lack a sufficient public contract. |
+| Measurement statistics | `:MEASure:STATistic:ITEM?` | `scope.measurement_statistics_v2` | Requires explicit item/source, does not support buffer, and never changes configuration, clears statistics, or writes display state. |
+| FFT status | MATH operator and FFT queries | `scope.fft_status_v2` | Requires FFT operator first and returns only declared profile fields. Average completion, RBW, and FFT sample rate are not inferred. |
+| Reference metadata | source, vertical scale/offset, label | Not declared | Current manual/device interfaces cannot fully express axes, points, and Y resolution. |
+| History timestamps | record state, frame, timestamp | Not declared | Frame numbers cannot substitute for per-frame relative or calendar timestamps. |
+| DVM, counter, AWG | corresponding vendor families | Not declared | Current Scope contracts or shared-resource models are insufficient; raw SCPI does not bypass them. |
+| Protocol, mask, search, record | option-heavy application families | Not declared | Require independent option, restoration, and result models. |
+| Reset, network, option install, files, calibration | system and storage families | Not declared | High-side-effect maintenance operations are denied in ordinary experiment workflows. |
+
+## Binary-profile boundaries
+
+Exact response/operation budgets, query limits, trailing bytes, restoration order, and screenshot
+variants are defined by `ScopeDescriptorExtensions` in the
+[production descriptor](../src/wavebench_rigol_mso8000/descriptor.py). This document does not
+maintain a second numeric table.
+
+- `fetch`, `capture_single`, and `capture_multiple` use independent waveform operation profiles.
+- `capture_multiple` triggers one acquisition and then reads multiple channels; it never retriggers
+  per channel.
+- Screenshot uses `DEFINITE_BLOCK` framing and changes no image type, menu, color, or device file.
+- `tcpip`, `usb`, and `gpib` resource schemes describe routing contracts, not hardware acceptance
+  for every connection type.
+
+## Waveform conversion contract
+
+BYTE waveforms use the manual's ten-field preamble:
+
+```text
+format,type,points,count,xincrement,xorigin,xreference,yincrement,yorigin,yreference
+```
+
+The driver creates public `WaveformData` with:
 
 ```text
 voltage = (raw - y_origin - y_reference) * y_increment
@@ -48,8 +88,13 @@ x_start = x_origin - x_reference * x_increment
 x_stop  = x_start + (points - 1) * x_increment
 ```
 
-The driver requires exact payload length, finite axes, and finite converted samples. The core transport owns IEEE/TMC block decoding.
+Payload length must exactly match the point count, and axes and converted samples must be finite.
+Core transport owns IEEE/TMC block framing; the plugin does not parse `#N<length>` twice.
 
-## Explicitly unverified
+## Related sources
 
-USB/GPIB behavior, nonzero error records, error-queue ordering and overflow, X/Y conversion and measurement accuracy beyond the recorded `DEF + LF` `1 kHz / 1 Vpp / 0 V` condition, running-state MAX and MAX/DMAX chunking/throughput at other memory depths, capture lengths/settings/channel sets/transports beyond the controlled `DEF + BYTE` procedure, screenshot visual/pixel accuracy, other screen states, maximum payload, and non-BMP24 responses, WORD byte order, Snapshot V2 health/channel/timebase/probe/waveform/trigger fields, logic-probe behavior, electrical threshold accuracy, logic activity, digital-waveform encoding, and all other measurement accuracy remain unverified. In source-OFF probes, `*OPC?` succeeded before a later WAIT state, so it is not acquisition-completion evidence.
+- [Production descriptor](../src/wavebench_rigol_mso8000/descriptor.py)
+- [Driver implementation](../src/wavebench_rigol_mso8000/driver.py)
+- [Controlled hardware acceptance and unaccepted scope](MSO8104_HARDWARE_ACCEPTANCE_EN.md)
+- [Development milestones and historical decisions](MSO8104_COVERAGE_MILESTONES_EN.md)
+- [Related RFCs](rfcs/README.md) (Chinese)
diff --git a/packages/wavebench-rigol-mso8000/doc/README.md b/packages/wavebench-rigol-mso8000/doc/README.md
index 1d9252c..fa2f486 100644
--- a/packages/wavebench-rigol-mso8000/doc/README.md
+++ b/packages/wavebench-rigol-mso8000/doc/README.md
@@ -1,13 +1,33 @@
 # MSO8000 插件文档
 
-这里放公开的覆盖矩阵、命令索引、测试说明和实机验收记录。厂商手册原文及其转换稿放在 `vendor-local/`，不进入公开发行物。
+[English](README_EN.md)
 
-公开文档必须区分三类事实：手册声明、FakeTransport 测试结果和真实仪器验收结果。不能把手册中列出的命令直接写成已支持能力。
+本页导航 MSO8000 插件的当前 Reference、实机证据、RFC 和开发历史。当前版本、型号、兼容
+范围和 capability 以包元数据与 production descriptor 为准。
 
-当前公开文档：
+## 当前 Reference
 
-- [MSO8104 功能覆盖里程碑](MSO8104_COVERAGE_MILESTONES.md)
-- [MSO8104 编程手册功能覆盖矩阵](MSO8104_COVERAGE_MATRIX.md)
-- [MSO8104 受控实机验收记录](MSO8104_HARDWARE_ACCEPTANCE.md)
+- [MSO8104 当前功能覆盖与行为边界](MSO8104_COVERAGE_MATRIX.md)
+- [仓库级插件目录](../../../doc/reference/plugin-catalog.md)
 
-实机结论仅适用于记录中的型号、固件、transport 和受控步骤。当前受控 profile 已通过 [RFC-0008](rfcs/0008-bounded-waveform-block-trailing-contract.md) 的 bounded binary 合同完成 `DEF`、停止态 MAX/DMAX 与 `DEF + BYTE` capture 验收；不将这些结论外推到未记录的点数、时基、transport 或测量准确度。
+## 验收与历史证据
+
+- [MSO8104 受控实机条件、结果与未验收范围](MSO8104_HARDWARE_ACCEPTANCE.md)
+- [MSO8104 开发里程碑与历史决策](MSO8104_COVERAGE_MILESTONES.md)
+- [0.9.0 开发与验收存档](archive/MSO8000_README_0.9.md)
+- [跨插件验收与历史证据索引](../../../doc/evidence/README.md)
+
+手册声明、FakeTransport 结果与真实仪器验收必须保持区分。历史页面保存特定版本、固件、
+transport 和受控步骤的结论，不独立提升当前 capability。
+
+## RFC
+
+- [MSO8104 相关 WaveBench RFC](rfcs/README.md)
+
+RFC 记录设计和验收合同，不替代当前 Reference。
+
+## 厂商资料与开发环境
+
+- [本地厂商资料存放规则](vendor-local/README.md)
+- [仓库开发环境](../../../doc/DEVELOPMENT.md)
+- [返回插件入口](../README.md)
diff --git a/packages/wavebench-rigol-mso8000/doc/README_EN.md b/packages/wavebench-rigol-mso8000/doc/README_EN.md
new file mode 100644
index 0000000..6a4cc12
--- /dev/null
+++ b/packages/wavebench-rigol-mso8000/doc/README_EN.md
@@ -0,0 +1,35 @@
+# MSO8000 Plugin Documentation
+
+[中文](README.md)
+
+This page routes readers to current MSO8000 Reference material, hardware evidence, RFCs, and
+development history. Package metadata and the production descriptor are authoritative for the
+current version, model, compatibility range, and capabilities.
+
+## Current Reference
+
+- [MSO8104 current coverage and behavior boundaries](MSO8104_COVERAGE_MATRIX_EN.md)
+- [Repository plugin catalog](../../../doc/reference/plugin-catalog-en.md)
+
+## Acceptance and historical evidence
+
+- [MSO8104 controlled hardware conditions, results, and unaccepted scope](MSO8104_HARDWARE_ACCEPTANCE_EN.md)
+- [MSO8104 development milestones and historical decisions](MSO8104_COVERAGE_MILESTONES_EN.md)
+- [0.9.0 development and acceptance archive](archive/MSO8000_README_0.9_EN.md)
+- [Cross-plugin acceptance and historical evidence index](../../../doc/evidence/README_EN.md)
+
+Manual claims, FakeTransport results, and hardware acceptance must remain distinct. Historical pages
+preserve conclusions for particular versions, firmware, transports, and controlled procedures. They
+do not independently promote current capabilities.
+
+## RFCs
+
+- [MSO8104-related WaveBench RFCs](rfcs/README.md) (Chinese)
+
+RFCs record design and acceptance contracts; they do not replace the current Reference.
+
+## Vendor material and development environment
+
+- [Local vendor-material storage rules](vendor-local/README.md)
+- [Repository development environment](../../../doc/DEVELOPMENT_EN.md)
+- [Return to the plugin landing page](../README_EN.md)
diff --git a/packages/wavebench-rigol-mso8000/doc/archive/MSO8000_README_0.9.md b/packages/wavebench-rigol-mso8000/doc/archive/MSO8000_README_0.9.md
new file mode 100644
index 0000000..41eccbe
--- /dev/null
+++ b/packages/wavebench-rigol-mso8000/doc/archive/MSO8000_README_0.9.md
@@ -0,0 +1,111 @@
+# MSO8000 0.9.0 开发与验收存档
+
+[English](MSO8000_README_0.9_EN.md)
+
+> 类型：Historical
+> 历史范围：插件 `0.9.0` 合并 README
+> 当前入口：[MSO8000 插件](../../README.md)
+
+本页保留第三轮文档迁移前的能力说明、离线门禁、受控实机结果和负向证据。它用于追溯历史，
+不替代 production descriptor、当前插件目录或包入口。
+
+该目录为 RIGOL MSO8000 系列的 WaveBench 插件开发起点，当前以 MSO8104 为首个目标型号。MSO8104 是 1 GHz、4 个模拟通道的混合信号示波器；系列编程手册还覆盖 MSO8064 和 MSO8204。
+
+## 当前状态
+
+`0.9.0` 开发版本在当前 WaveBench Core 开发分支的有界二进制与 portability V2 合同下声明 `scope.error_drain_v1`、`scope.fetch_waveform`、`scope.capture_waveform`、`scope.capture_waveforms`、`scope.acquisition_control`、`scope.channel_input_state_v2`、`scope.measurement_statistics_v2`、`scope.fft_status_v2`、`scope.acquisition_status_v2`、`scope.acquisition_run_state`、`scope.digital_status_v2`、`scope.snapshot_v2` 和 `scope.cursor_readout_v2`。waveform 入口支持 `DEF`、停止态 `MAX` 与停止态 `DMAX`；descriptor 精确声明 `LF` trailing、单响应最多 `250,000` bytes、单操作最多 `4,000,000` bytes 与最多 16 次 binary query。`scope.capture_waveform` 和 `scope.capture_waveforms` 仅接受已停止、MAIN 时基下的 `DEF + BYTE` 基线；单通道最多 1 次、双通道最多 4 次 binary query，均由 Core 恢复并新鲜验证 acquisition、trigger、时基、四路 display/vertical 与 transfer 的 13 个字段。SINGLE 写入后必须读回 `SING`：首条 `STOP` 使用受限 completion proof，`WAIT` 或 `TD` 到 `STOP` 使用状态迁移 proof；capture 仅接受后者作为波形新鲜性证据。
+
+实机结论只适用于记录的 MSO8104 固件 `00.02.02`、LAN/PyVISA 和受控步骤。单通道和双通道 bounded `DEF + BYTE` capture 都在 1 Vpp 安全限制内返回每通道 `1,000` 样本并具备有效幅度；两者均观察到 `WAIT → STOP`，恢复后 `*OPC?` 由 `0` 轮询至 `1`，随后完成 Core 的 13 字段新鲜验证。`TD → STOP` 已在独立的 SINGLE control 验收中观察到。每轮结束均以新会话确认 source CH1/CH2 OFF、scope STOP、CH1/CH2 为 high_z。此前 `DEF + LF` fetch、停止态 MAX/DMAX、统计、FFT、静态 acquisition/digital 状态与 snapshot 的受限实机证据保持有效。该结果不外推到运行态 MAX、其他点数、时基、通道组合、transport 或一般测量准确度。
+
+采集控制的实机边界仍受限：`start(normal)`→`stop` 已形成 active/stopped 过程；SINGLE 在模式读回为 `SING` 后，首条 `STOP` 和 `WAIT/TD → STOP` 都已完成受控验证。`*OPC?` 只用于 capture 恢复写批次的通信同步，不能替代 SINGLE completion 或波形新鲜性证明。
+
+平均采集仍不声明。受控 `capture_average_v2` 探测在已停止、高阻、1 Vpp 方波条件下，对 `:ACQuire:TYPE AVERages`、其合法缩写 `AVER` 以及 PEAK/NORM 对照均完成有界写入同步后立即读回 type；设备始终返回 `NORM`，且随后读取的错误队列为 `0,"No error"`。因此当前固件／配置无法通过远程接口进入平均模式；即使该前提解决，手册也没有把 trigger STOP、`*OPC?` 或 preamble count 绑定为平均完成。正式 descriptor 不声明 `scope.capture_average_v2`。
+
+当前身份信息：
+
+- distribution：`wavebench-rigol-mso8000`
+- canonical driver ID：`rigol.mso8104`
+- kind：`scope`
+- 目标型号：`MSO8104`
+- Python：`>=3.11`
+- WaveBench：`>=0.8.24,<0.9`
+
+本轮依赖的标准 waveform bounded API 与 portability V2 API 已提交到当前 core 开发分支，但尚未形成独立 core 发布版本。因此 `0.9.0` 仅用于开发与受控验收，不能据此发布兼容性 wheel。
+
+## 目录说明
+
+- `doc/vendor-local/`：本地厂商手册。原始 PDF 和转换后的 Markdown 都放在这里；除说明文件外的内容会被 Git 忽略，也不会进入发行包。
+- `src/wavebench_rigol_mso8000/`：descriptor、driver 与严格解析器。
+- `tests/`：FakeTransport、故障注入与制品生命周期测试；默认测试不得连接真实仪器。
+- `pyproject.toml`：distribution 元数据、WaveBench 版本范围和唯一 entry point。
+- `doc/`：公开覆盖矩阵和验收记录；厂商原文不要放到公开文档目录。
+
+## 设计文档
+
+- [MSO8104 功能覆盖里程碑](../MSO8104_COVERAGE_MILESTONES.md)
+- [MSO8104 编程手册功能覆盖矩阵](../MSO8104_COVERAGE_MATRIX.md)
+- [MSO8104 受控实机验收记录](../MSO8104_HARDWARE_ACCEPTANCE.md)
+
+## M8 离线发行证据
+
+- MSO8104 包测试：390 项通过；全仓 Ruff 通过。
+- 根测试：在一次性同级 WaveBench core 布局中 715 项通过，2 项 SP3000A 私有实机证据测试按预期跳过。
+- 当前 WaveBench `0.8.24` 开发环境的 package check：源码目录和真实 wheel 均通过。
+- wheel/sdist：唯一仪器 entry point、WaveBench runtime dependency、MIT 许可证和公开内容符合合同；vendor-local 未进入制品。
+- 一次性虚拟环境：安装、零 I/O descriptor 发现、卸载和 canonical ID fallback 通过。
+- 文档：61 个受跟踪 Markdown 文件的本地链接有效。
+
+这些结果只证明离线合同与发行完整性，不构成型号、固件、transport、吞吐、恢复或测量准确度的实机证据。
+
+## 安全边界
+
+descriptor 导入不得打开 transport、扫描端口、发送 SCPI 或创建文件。真实资源、序列号、凭据、波形、截图和命令日志不得提交。仪器写入和 acquisition trigger 不做盲目重试。核心缺少必要安全接口时，先写 RFC 并跳过对应 capability，不在插件中增加 raw SCPI 入口。
+
+当前 descriptor 允许 `tcpip`、`usb`、`gpib` 资源前缀，这是手册声明和离线路由合同，不是连接实机通过的证据。
+
+已受控声明 `scope.screenshot_profile` 与 `scope.screenshot_v2`。profile 固定单次 binary query、`DEFINITE_BLOCK`、精确 `LF` transport trailing、`8,388,608`-byte 上限与 `png/device/device`。driver 先只读确认 `:SAVE:IMAGe:TYPE? = PNG`，再读取 `:SAVE:IMAGe:DATA?`；记录固件实际返回无压缩 BMP24，driver 仅接受该严格子集并在内存中转换为 PNG。公开实机调用返回 `1024 × 600`、`47,584` bytes 的 `image/png`，前后错误队列均为空，session healthy；最终 source 双路 OFF、scope STOP、CH1/CH2 high_z。不写 `TYPE`、`INVert`、`COLor`、菜单或设备文件，也不使用 `:DISPlay:DATA?`。该证据不外推到截图视觉／像素准确度、其他屏幕状态或最大 payload；详见 [RFC-0003](../rfcs/0003-scope-screenshot-framing-and-menu-contract.md)。
+
+当前不声明 legacy `scope.digital_status` 或 `scope.digital_waveform`。legacy 数字状态模型要求 MSO8000 无法查询的必填字段；数字 waveform 的厂商手册未定义 BYTE/WORD 逻辑 code，WORD 字节序也不明确。插件不以默认值或模拟量换算制造数字状态。
+
+`scope.autoscale` 会按核心操作合同改变垂直、时基和触发设置，且不承诺恢复。driver 先查询 `:SYSTem:AUToscale?`，禁用时不发送写命令；调用必须设置 `check_errors=false`。对 MSO8104，遗留参数 `wait_opc=true` 明确定义为固定 `3 s` settle：写入一次 `:AUToscale` 后等待 `3 s`，不查询 `*OPC?`，随后将本次操作视为完成。写入或 settle 等待异常都会锁存 autoscale 写域，关闭并重新打开会话前不再重试。受控 CH1 `1 Vpp / 1 kHz` probe 经公开 autoscale 后的 bounded fetch 返回 1000 样本且幅度有效，最终 source 双路 OFF、scope STOP、CH1/CH2 high_z。该固定时长是本插件的运行完成策略，不证明设备内部自动设置算法、显示效果或设置恢复；`wait_opc=false` 仅显式跳过等待，尚无实机完成验收。
+
+`scope.math_metadata` 只接受已显示的 MATH1～MATH4 和 MAIN 时基。driver 保存六项 waveform 传输状态，按手册要求先切换到 NORM，再选择 MATH 源与 BYTE 格式，只查询 preamble 后恢复原状态；不读取波形数据。记录的 MATH1 调用已返回 1000 点、有限轴和 8 位 BYTE 元数据，并完成六字段最终恢复复核。返回的 `values_per_sample` 仍为未知；数学运算内容、其他槽位／operator 的轴语义和 FFT 精度不由该能力推断。
+
+`scope.cursor_readout` 保留兼容接口，只读取调用方确认已配置的全局手动光标，公共 `cursor_index` 固定为 `1`。`scope.cursor_readout_v2` 使用全局寻址，要求 `cursor_index=None`；除手动 `TIME/AMPL` 外，还读取预配置的 `TRAC` 追踪光标。公开实机的 `MAN + TIME + CHAN1/CHAN1` 已返回有限 X A/B、`ΔX` 与 `1/ΔX`，单位分别为秒和 Hz。追踪路径仅接受 `MAIN/ROLL` 时基和 `CHAN1`～`CHAN4`，读取 A/B source、时基、通道幅度单位和 A/B/差值；当前 `TRAC + CHAN2/CHAN2` 返回全部有限读数与 `V` 纵轴单位。仅当 A/B 纵轴单位相同且已知时才读取 `ΔY`，否则将其标为 not applicable。driver 不移动或重配光标。Math source、XY、测量模式、`NONE`、LA 和未知或不同的纵轴单位保持 fail closed，光标读数准确度仍未验证。
+
+`scope.measurement_statistics_v2` 覆盖手册列出的统计 item，使用规范化的大写 item token 和显式 `CHAN1`～`CHAN4`、`MATH1`～`MATH4` source；`D0`～`D15` 仅接受手册明确允许的周期、频率、宽度、占空比、延时和相位项。延时与相位项必须给出两个 source，其他 item 必须给出一个 source。driver 只查询 CURRENT、AVERages、DEViation、MINimum、MAXimum 与 CNT，不发送统计配置、清零或显示写入。受控实机已确认 `VPP,CHAN1` 与 `VPP,CHAN2` 的 6 个数值字段和 `CNT=1000` 可读取；设备既有统计历史未被修改，因此平均、标准差、最小值和最大值不作为信号准确度或统计窗口语义的证据。legacy `scope.measurement_statistics` 继续不声明。
+
+`scope.fft_status_v2` 只接受调用方已在前面板配置的 MATH1～MATH4 FFT。driver 先查询 `OPERator?` 并要求回包为 `FFT`，再读取 FFT source、window、vertical unit、起始频率和终止频率；所有步骤均为文本 query。`average_complete`、RBW 和 FFT sample rate 没有手册可证明的 query，因此固定列入 `unavailable_fields`，不会从全局 acquisition sample rate、频率范围或波形点数推导。受控实机 MATH1 已确认 `FFT + CHAN1 + HANN + VRMS + 0–1 MHz`，前后 source 两路均 OFF、`consistent`、`healthy`；该结果不构成 FFT 振幅、频率或频率轴准确度证据。
+
+`scope.acquisition_status_v2` 固定读取 `:ACQuire:TYPE?`、`:ACQuire:SRATe?` 和 `:ACQuire:MDEPth?`；仅当 type 为 `AVER` 时才读取 `:ACQuire:AVERages?`。average 分区在非 AVER 模式下明确为 not applicable；AVER 模式下只报告配置次数，`average.complete` 仍为 unavailable。run state 和 segmented 分区没有进入 profile，不发送 `:TRIGger:STATus?`、`*OPC?`、`*STB?` 或 `*ESR?`，也不从 STOP 推导完成状态。受控实机当前返回 `NORM + 500 kSa/s + 10 kpts`；后续平均模式写入探测也始终回读 `NORM`，所以 AVER 分支继续没有实机可达性证据。前后 source 两路均 OFF、`consistent`、`healthy`。legacy `scope.acquisition_status` 与平均采集仍不声明。
+
+`scope.acquisition_run_state` 只读取 `:TRIGger:STATus?`：`STOP` 映射为 stopped，`WAIT` 映射为 waiting，`RUN` 和记录条件下经 STOP 验证的 `AUTO` 映射为 acquiring；通常 `TD` 保持 unknown。仅在刚完成 `SING` 模式读回的 SINGLE 事务中，`TD` 被保守表示为非终态 arming，并且必须后续读到 `STOP` 才能构成 state-transition proof。`scope.acquisition_control` 已声明；它支持 `start(normal)`、`stop` 与受限 SINGLE completion。bounded capture 与 control proof 相互独立：capture 不接受首条 STOP，仍要求 `WAIT/TD → STOP`，并恢复和新鲜验证 13 个字段。运行态 MAX、其他 capture 点数/时基/通道组合仍未验收。
+
+`scope.digital_status_v2` 只接受 D0～D15。每次先查询 LA 模块位；LA 缺席时只返回 `shared.module_present=false`，不会发送任何 `:LA:*?` 查询。LA 存在时，driver 以 6 条文本 query 读取逐通道显示和标签、所属 POD 的共享阈值、全局 timing calibration 与显示大小。`position_div` 因手册查询格式自相矛盾而保持 unavailable；`label_enabled`、activity、technology 和 hysteresis 也没有可证明查询，绝不以默认值或 UI 活动选择替代。受控实机的 D0、D8 都已确认显示、标签、各自 POD 边界与 `1.4 V` 阈值，以及 `0 s` timing calibration 和 `MEDIUM` size；前后 source 两路均 OFF、`consistent`、`healthy`。该结果不构成数字探头、电气阈值、逻辑活动或数字 waveform 编码的准确度证据。
+
+`scope.snapshot_v2` 只接受 CH1～CH4 请求，但当前 profile 只读当前 identity 与授权选件状态：先执行 `*IDN?`，再按手册枚举读取 13 种 `:SYSTem:OPTion:STATus? <type>`。空 options 仅在本次全部 13 项都明确返回未安装时出现；不从 descriptor、缓存或型号常量补齐。health、channel、timebase、probe、waveform 和 trigger 的 55 个字段均按稳定顺序列为 unavailable。受控实机完成全部 14 条 query；前后 source 两路均 OFF、`consistent`、`healthy`。该能力不读取状态寄存器、错误队列、trigger、波形或二进制数据，也不构成各未读分区的状态或准确度证据。
+
+`scope.error_drain_v1` 对 `:SYSTem:ERRor?` 的每次读取都显式使用 Core 的 `ReplayPolicy.NO_REPLAY`，并严格解析 `<integer>,"<message>"`；`0,"No error"` 是已实机观察的唯一终止记录，非零记录、格式异常和队列 overflow 都 fail closed。Core 对有界 fetch/capture 在 `scope.check_errors=true` 时于主操作前后执行有限 drain，并核对实际 query 数。受控实机的公开单通道 capture 在此前后各完成一次空队列 drain，仍返回 1000 样本并恢复安全状态。非空记录和 overflow 目前只有离线故障注入证据。legacy `scope.errors` 仍不声明；autoscale 等旧路径仍必须使用 `check_errors=false`。
+
+`scope.fetch_waveform` 的有界路径支持 `DEF`、停止态 `MAX` 与停止态 `DMAX`。它使用 Core 的 `query_binary()`，不再调用 legacy `query_bin_block()`；`LF` trailing、`250,000`-byte 单响应上限、`4,000,000`-byte 单操作上限、最多 16 次 binary query 与 no-replay 均由 descriptor profile 约束。MAX/DMAX 在任何 transfer setup 前都要求 scope 已停止。该 fetch 证据不外推到运行态 MAX、其他量程、时基、深度和探头条件；受限 capture 的独立验收见上文。
+
+离线设计仍保留每块 `250,000` 点、每次调用总计 `4,000,000` 点、最多 16 块的长记录边界。停止态 MAX/DMAX fetch 与 bounded 单／多通道 capture 已有各自受限实机证据；运行态 MAX、其他 capture 点数、时基、通道组合和 transport 仍需要独立验收。
+
+```toml
+[connection]
+backend = "pyvisa"
+resource = "TCPIP0::192.0.2.80::INSTR"
+
+[scope]
+driver = "rigol.mso8104"
+default_channel = 1
+check_errors = false
+access = "read_write"
+
+```
+
+示例地址属于 RFC 5737 文档网段，不是实验室资源。
+
+## 开发手册位置
+
+本地厂商资料的具体放置规则见 [`doc/vendor-local/README.md`](../vendor-local/README.md)。
diff --git a/packages/wavebench-rigol-mso8000/doc/archive/MSO8000_README_0.9_EN.md b/packages/wavebench-rigol-mso8000/doc/archive/MSO8000_README_0.9_EN.md
new file mode 100644
index 0000000..a779bb1
--- /dev/null
+++ b/packages/wavebench-rigol-mso8000/doc/archive/MSO8000_README_0.9_EN.md
@@ -0,0 +1,93 @@
+# MSO8000 0.9.0 Development and Acceptance Archive
+
+[中文](MSO8000_README_0.9.md)
+
+> Type: Historical
+> Historical scope: combined package README for plugin version `0.9.0`
+> Current entry: [MSO8000 plugin](../../README_EN.md)
+
+This page preserves capability notes, offline gates, controlled hardware results, and negative
+evidence from before the third documentation migration. It supports historical review and does not
+replace the production descriptor, current plugin catalog, or package landing page.
+
+This directory is the starting point for a WaveBench plugin for the RIGOL MSO8000 series, with the MSO8104 as the first target model. The MSO8104 is a 1 GHz, four-analog-channel mixed-signal oscilloscope; the programming guide also covers the MSO8064 and MSO8204.
+
+## Current status
+
+Development version `0.9.0` declares `scope.error_drain_v1`, `scope.fetch_waveform`, `scope.capture_waveform`, `scope.capture_waveforms`, `scope.acquisition_control`, `scope.channel_input_state_v2`, `scope.measurement_statistics_v2`, `scope.fft_status_v2`, `scope.acquisition_status_v2`, `scope.acquisition_run_state`, `scope.digital_status_v2`, `scope.snapshot_v2`, and `scope.cursor_readout_v2` through the bounded-binary and portability V2 contracts in the current WaveBench Core development branch. Bounded capture accepts only an already-stopped MAIN-timebase `DEF + BYTE` baseline. The descriptor limits a single capture to one binary query and a multi-channel capture to four, then Core restores and freshly verifies 13 acquisition, trigger, timebase, display/vertical, and transfer fields. After SINGLE, the driver reads back `SING`; terminal first `STOP` is a restricted control proof, while capture requires `WAIT` or `TD` followed by `STOP` as independent waveform-freshness evidence.
+
+Hardware findings apply only to MSO8104 firmware `00.02.02`, LAN/PyVISA, and the controlled procedure. Bounded `DEF + BYTE` single- and multi-channel capture each returned `1,000` samples per channel with valid amplitude evidence under the `1 Vpp` safety limit. Both observed `WAIT → STOP`, then Core recovery polled `*OPC?` from `0` to `1` and freshly verified all 13 fields. A separate SINGLE-control acceptance observed `TD → STOP`. Every run ended with a new-session confirmation of source CH1/CH2 OFF, scope STOP, and high-impedance CH1/CH2 inputs. This does not establish other capture lengths, settings, transports, running-state MAX, or general measurement accuracy.
+
+The restricted acquisition-control acceptance covers `start(normal)`→`stop`, plus post-arm `SING` readback followed by either terminal `STOP` or `WAIT`/`TD` progressing to `STOP`. Recovery `*OPC?` is used only to synchronize recovery writes; it is not acquisition-completion or waveform-freshness evidence.
+
+Average capture remains undeclared. A controlled `capture_average_v2` probe used a stopped, high-impedance baseline and a 1 Vpp square signal. It wrote `:ACQuire:TYPE AVERages`, its legal `AVER` abbreviation, and PEAK/NORM controls, synchronizing each setting write before its type readback. Every readback remained `NORM`, and the subsequently consumed error record was `0,"No error"`. The current firmware/configuration therefore cannot enter average mode through this remote path. Even if that prerequisite changes, the manual does not bind trigger STOP, `*OPC?`, or preamble count to average completion. The production descriptor does not declare `scope.capture_average_v2`.
+
+Current identity:
+
+- Distribution: `wavebench-rigol-mso8000`
+- Canonical driver ID: `rigol.mso8104`
+- Kind: `scope`
+- Target model: `MSO8104`
+- Python: `>=3.11`
+- WaveBench: `>=0.8.24,<0.9`
+
+The required standard-waveform bounded API and portability V2 APIs are committed on the current core development branch but do not yet have an independent core release. Version `0.9.0` is therefore for development and controlled acceptance only, not a compatibility-wheel release claim.
+
+## M8 offline release evidence
+
+- All 390 MSO8104 package tests and repository-wide Ruff checks pass.
+- In a disposable sibling WaveBench-core layout, 715 root tests pass and two SP3000A private-hardware-evidence tests skip as expected.
+- Package checks pass for both the source directory and the real wheel in the current WaveBench `0.8.24` development environment.
+- The wheel/sdist contracts cover the single instrument entry point, WaveBench runtime dependency, MIT license, and public content; vendor-local material is absent.
+- A disposable virtual environment passes installation, zero-I/O descriptor discovery, uninstall, and canonical-ID fallback.
+- Local links resolve in all 61 tracked Markdown files.
+
+This evidence covers offline contracts and distribution integrity only. Model, firmware, transport, throughput, restoration, and measurement accuracy remain hardware-unverified.
+
+## Directory layout
+
+- `doc/vendor-local/`: local vendor manuals. Keep the original PDF and the converted Markdown here; all files except its README are ignored and excluded from distributions.
+- `src/wavebench_rigol_mso8000/`: descriptor, driver, and strict parsers.
+- `tests/`: FakeTransport unit tests; default tests must not connect to hardware.
+- `pyproject.toml`: distribution metadata, WaveBench version range, and the single entry point.
+- `doc/`: public coverage matrices and acceptance notes. Keep vendor source material out of public documentation.
+
+## Design documents
+
+- [MSO8104 coverage milestones](../MSO8104_COVERAGE_MILESTONES_EN.md)
+- [MSO8104 programming-guide coverage matrix](../MSO8104_COVERAGE_MATRIX_EN.md)
+- [MSO8104 controlled hardware acceptance](../MSO8104_HARDWARE_ACCEPTANCE_EN.md)
+
+## Safety boundary
+
+Descriptor import must not open a transport, scan ports, send SCPI, or create files. Never commit real resources, serial numbers, credentials, captures, screenshots, or command logs. Do not blindly retry instrument writes or acquisition triggers. When the core lacks a required safety interface, add an RFC and skip the capability instead of adding a raw SCPI escape hatch.
+
+The descriptor accepts `tcpip`, `usb`, and `gpib` resource prefixes as a manual-backed, offline routing contract. This is not hardware connection evidence.
+
+The descriptor declares `scope.screenshot_profile` and `scope.screenshot_v2` under a constrained contract: one binary query, `DEFINITE_BLOCK`, exact `LF` transport trailing, an `8,388,608`-byte limit, and `png/device/device`. The driver first reads and requires `:SAVE:IMAGe:TYPE? = PNG`, then reads `:SAVE:IMAGe:DATA?`. The recorded firmware actually returns uncompressed BMP24; the driver accepts only that strict subset and converts it in memory to PNG. The public hardware call returned a `1024 × 600`, `47,584`-byte `image/png`, with empty error drains before and after and a healthy session; final state was both source outputs OFF, scope STOP, and CH1/CH2 high impedance. It does not write TYPE, INVert, COLor, menu, or instrument files, and does not use `:DISPlay:DATA?`. This does not establish visual/pixel accuracy, other screen states, or maximum payload. See [RFC-0003](../rfcs/0003-scope-screenshot-framing-and-menu-contract.md).
+
+The descriptor still omits legacy `scope.digital_status` and `scope.digital_waveform`. The legacy status model requires fields that MSO8000 cannot query. The vendor manual does not define BYTE/WORD logic codes for D0-D15 waveform sources and leaves WORD byte order unclear. The plugin does not invent digital state from defaults or analog conversion.
+
+`scope.autoscale` intentionally changes vertical, timebase, and trigger settings under the core operation contract and does not promise restoration. The driver first queries `:SYSTem:AUToscale?` and requires `check_errors=false`. For MSO8104, the legacy `wait_opc=true` parameter explicitly means a fixed `3 s` settle: after one `:AUToscale` write, the driver waits `3 s`, does not query `*OPC?`, and then treats the operation as complete. A write or settle-wait failure latches only the autoscale write domain until the session is reopened. A controlled CH1 `1 Vpp / 1 kHz` probe used public autoscale followed by bounded fetch, which returned 1,000 samples with amplitude evidence; final state was both source outputs OFF, scope STOP, and CH1/CH2 high impedance. The fixed duration is this plugin's operational-completion policy, not proof of the instrument's internal autoscale algorithm, visible effect, or restoration. `wait_opc=false` explicitly skips the wait and has no hardware-completion acceptance.
+
+`scope.math_metadata` accepts only displayed MATH1-MATH4 slots in MAIN timebase mode. The driver saves all six waveform-transfer fields, switches to NORM before selecting the MATH source and BYTE format, reads only the preamble, and restores the previous state. It does not read waveform data. The recorded MATH1 call returned 1,000 points, finite axes, and eight-bit BYTE metadata with final six-field restoration verification. `values_per_sample` remains unknown; math content, axis semantics for other slots/operators, and FFT accuracy are not inferred.
+
+`scope.cursor_readout` remains the compatibility route for an explicitly preconfigured global manual cursor at public cursor index `1`. `scope.cursor_readout_v2` uses global addressing with `cursor_index=None`; in addition to manual `TIME/AMPL`, it reads a preconfigured `TRAC` tracking cursor. Hardware `MAN + TIME + CHAN1/CHAN1` returned finite X A/B, `ΔX`, and `1/ΔX` values in seconds and Hz. The tracking path accepts only `MAIN/ROLL` timebase and `CHAN1`-`CHAN4`, and reads A/B sources, timebase, channel amplitude units, and A/B/delta values; hardware `TRAC + CHAN2/CHAN2` returned finite values with `V` vertical units. It reads `ΔY` only if A/B vertical units are known and equal; otherwise it marks the field not applicable. The driver never moves or reconfigures cursors. Math sources, XY, measurement mode, `NONE`, LA, and unknown or unequal vertical units remain fail closed; cursor accuracy is still unverified.
+
+`scope.measurement_statistics_v2` covers the manual's statistics items with normalized uppercase item tokens and explicit `CHAN1`-`CHAN4` or `MATH1`-`MATH4` sources. `D0`-`D15` are limited to the documented period, frequency, width, duty, delay, and phase items. Delay and phase items require two sources; every other item requires one. The driver reads only CURRENT, AVERages, DEViation, MINimum, MAXimum, and CNT; it never writes statistics configuration, reset, or display state. Controlled hardware reads proved all six numeric responses and `CNT=1000` for `VPP,CHAN1` and `VPP,CHAN2`. Existing device history was not cleared, so average, standard deviation, minimum, and maximum are not evidence of signal accuracy or statistics-window semantics. The legacy `scope.measurement_statistics` capability remains undeclared.
+
+`scope.fft_status_v2` accepts only MATH1-MATH4 FFT state already configured at the front panel. The driver queries `OPERator?` and requires `FFT`, then reads the FFT source, window, vertical unit, start frequency, and stop frequency; every step is a text query. The manual provides no provable query for `average_complete`, RBW, or FFT sample rate, so they are always listed in `unavailable_fields` and are never inferred from global acquisition sample rate, frequency range, or waveform points. Controlled MATH1 hardware reads confirmed `FFT + CHAN1 + HANN + VRMS + 0–1 MHz`; source CH1/CH2 were OFF, `consistent`, and `healthy` before and after. This is not FFT amplitude, frequency, or frequency-axis accuracy evidence.
+
+`scope.acquisition_status_v2` always reads `:ACQuire:TYPE?`, `:ACQuire:SRATe?`, and `:ACQuire:MDEPth?`; it reads `:ACQuire:AVERages?` only when type is `AVER`. The average partition is explicitly not applicable outside AVER mode; in AVER mode it reports only the configured count, while `average.complete` remains unavailable. Run state and segmented status are outside the profile. The driver does not send `:TRIGger:STATus?`, `*OPC?`, `*STB?`, or `*ESR?`, and never infers completion from STOP. Controlled hardware returned `NORM + 500 kSa/s + 10 kpts`; the later average-mode write probe also read back `NORM` throughout, so the AVER branch has no reachable-hardware evidence. Source CH1/CH2 were OFF, `consistent`, and `healthy` before and after. Legacy `scope.acquisition_status` and average capture remain undeclared.
+
+`scope.acquisition_run_state` reads only `:TRIGger:STATus?`: STOP maps to stopped, WAIT maps to waiting, RUN and the recorded AUTO state map to acquiring, and TD normally remains unknown. Only in a just-read-back SINGLE transaction can TD be represented as a nonterminal arming observation, and it must be followed by STOP to form a state-transition proof. `scope.acquisition_control` is declared for `start(normal)`, `stop`, and restricted SINGLE completion. Bounded capture is independent from the terminal control proof: it rejects first STOP, requires `WAIT`/`TD → STOP`, and uses Core-owned 13-field recovery/fresh verification. Running-state MAX and capture lengths, timebases, channel sets, and transports outside the controlled procedure remain unverified.
+
+`scope.digital_status_v2` accepts only D0-D15. Each call first queries the LA module bit; an absent module returns only `shared.module_present=false` and sends no `:LA:*?` query. With LA present, the driver uses six text queries for the per-channel display and label, the shared threshold of the owning POD, global timing calibration, and display size. `position_div` remains unavailable because the manual's query form is self-contradictory. `label_enabled`, activity, technology, and hysteresis have no provable query and are never replaced by defaults or UI active-channel state. Controlled D0 and D8 reads confirmed display, labels, their POD boundaries and `1.4 V` thresholds, plus `0 s` timing calibration and `MEDIUM` size; source CH1/CH2 were OFF, `consistent`, and `healthy` before and after. This is not evidence of logic-probe behavior, electrical threshold accuracy, logic activity, or digital-waveform encoding.
+
+`scope.snapshot_v2` accepts only CH1-CH4 requests, but its current profile reads only current identity and licensed-option state: one `*IDN?` followed by the 13 manual-defined `:SYSTem:OPTion:STATus? <type>` queries. An empty options tuple is returned only after all 13 queries explicitly prove no installed option; no identity field is filled from the descriptor, cache, or model constants. The 55 health, channel, timebase, probe, waveform, and trigger fields are unavailable in stable order. Controlled hardware completed all 14 queries; source CH1/CH2 were OFF, `consistent`, and `healthy` before and after. The operation does not read status registers, the error queue, trigger state, waveform data, or binary data, and is not evidence for any unread partition or its accuracy.
+
+`scope.error_drain_v1` sends every `:SYSTem:ERRor?` read through Core with explicit `ReplayPolicy.NO_REPLAY` and strictly parses `<integer>,"<message>"`. `0,"No error"` is the only hardware-observed terminator; nonzero records, malformed responses, and queue overflow all fail closed. With `scope.check_errors=true`, Core runs a bounded drain before and after bounded fetch/capture and reconciles the actual query count. The controlled public single-channel capture completed both empty drains, returned 1000 samples, and restored the safe final state. Nonempty-record and overflow paths currently have offline fault-injection evidence only. Legacy `scope.errors` remains undeclared, and old paths such as autoscale still require `check_errors=false`.
+
+The bounded `scope.fetch_waveform` path supports `DEF`, stopped-state `MAX`, and stopped-state `DMAX`. It uses core `query_binary()` rather than legacy `query_bin_block()`; exact `LF` trailing, a `250,000`-byte per-response limit, a `4,000,000`-byte operation limit, up to 16 binary queries, and no replay are descriptor-owned. Before any MAX/DMAX transfer setup, the driver requires stopped state. Fetch evidence does not extend to running-state MAX or other ranges, timebases, memory depths, and probe conditions; bounded capture has separate acceptance above.
+
+The driver retains the `250,000`-point block, `4,000,000`-point total, and 16-query long-record limits. Stopped-state MAX/DMAX fetch and bounded single/multi-channel capture each have limited hardware evidence. Running-state MAX and capture beyond the recorded point modes, timebases, channel sets, and transport remain unverified.
diff --git a/packages/wavebench-rohde-schwarz-rtm2000/README.md b/packages/wavebench-rohde-schwarz-rtm2000/README.md
index a2bd08a..5b4a1bb 100644
--- a/packages/wavebench-rohde-schwarz-rtm2000/README.md
+++ b/packages/wavebench-rohde-schwarz-rtm2000/README.md
@@ -2,54 +2,30 @@
 
 [English](README_EN.md)
 
-面向 Rohde & Schwarz RTM2000 系列、当前以 RTM2032 为实机基线的 WaveBench 可执行示波器插件。
-
-## 身份与开发基线
-
-- distribution：`wavebench-rohde-schwarz-rtm2000`
-- canonical driver ID：`rohde-schwarz.rtm2032`
-- 开发基线：WaveBench `0.8.26`
-- WaveBench：`>=0.8.26,<0.9`
-- Python：`>=3.11`
-- 默认 transport backend：核心提供的 `rsinstrument-socket`
-
-本插件的 0.15.0 开发线对齐 WaveBench `v0.8.26`，不维护旧核心兼容矩阵，也不自动声明兼容未来 `0.9`。安装后，显式 canonical ID
-`rohde-schwarz.rtm2032` 选择外置实现；短 alias `rtm2032` 始终选择内建 fallback。卸载
-插件后，canonical ID 也回退内建实现。
-
-## 能力与边界
-
-- `*IDN?`、错误队列和显式 autoscale；
-- 厂商专用只读 identity/options/health 快照，不消费 EVENT 寄存器或错误队列；
-- RTM2032 CH1/CH2 类型化模拟通道、时基和探头元数据快照；
-- 当前波形的类型化 X/Y 缩放、点数、量化位数和每采样值数量快照；
-- RTM2032 CH1/CH2 基础 edge-trigger 类型化只读快照；
-- 只读 average/segmented acquisition 状态，K15 专属查询受选件门控；
-- 受控 average acquisition：调用方须明确确认 acquisition 已停止；仅暂时修改 average count、single count 和全局 channel arithmetic，成功或失败后均回读恢复，恢复不确定会锁存该实例后续 average 写入；
-- RTM2032 CH1/CH2 的只读 K15 history 时间戳表；
-- 显式确认已配置槽位后的自动测量只读统计；
-- 现有 math、FFT、reference、cursor 状态的只读 metadata/readout；
-- Scope V2 只读接口：通道输入状态、B1 门控的数字状态、严格的 identity 五字段 snapshot、
-  仅支持 1–4 号槽且不含 buffer 的测量统计，以及已配置 FFT 的三字段状态；
-- RTM2032 CH1/CH2 的 `scope.channel_display_configure_v2`：Core 负责 typed baseline、写后回读、失败恢复和独立恢复验证，插件只执行单通道 `STATE?` 与 `STATE ON/OFF`；
-- RTM2000 系列 CH1/CH2 的 `scope.focus_configure_v2`：RTM 插件 profile 声明通道、时基和 V/div 请求 guard，Core 负责完整联合 baseline、写后回读、失败恢复和恢复验证；
-- RTM2032 CH2 edge trigger 的厂商专用最小受控配置闭环；
-- 当前波形读取与单次 acquisition；
-- 一次 acquisition 后按通道读取多路波形；
-- 通道 coupling 查询和 PNG 截图；
-- `DEF` / `MAX` / `DMAX` 点数模式原样交给 RTM2000。
-
-插件只负责 RTM2000 厂商 SCPI、header/REAL 波形解析和错误语义。RsInstrument 会话、超时、
-高阻保护、Service、artifact、run plan 和实验级状态恢复留在核心。空列表、短列表、无效 header、
-非 PNG 截图和 OPC 超时都显式失败，不补零、不伪造成功、不盲目重试。
-
-`backend = "lan"` 按 descriptor 首选顺序使用 RsInstrument SocketIO，不依赖 VISA-C 或
-pyvisa-py。诊断兼容性时可显式选择 `rsinstrument`、`rsinstrument-rsvisa` 或
-`rsinstrument-pyvisa-py`；切换后端必须重新打开会话，读取失败后不会自动重放。插件仅对
-`MAX` / `DMAX` 波形数据读取使用独立的长传输 timeout，并记录不含地址、序列号和波形内容的
-分块进度、点数、字节数、耗时与吞吐 telemetry。
-
-## 配置示例
+面向 Rohde & Schwarz RTM2000 系列示波器的 WaveBench 仪器插件，当前以 RTM2032 作为代表性
+实机基线。
+
+## 从这里开始
+
+- [查询当前版本、兼容范围、型号和 capability](../../doc/reference/plugin-catalog.md)
+- [进入 RTM2000 插件文档](doc/README.md)
+- [安装和管理 WaveBench 插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
+
+## 适用范围
+
+显式配置 `driver = "rohde-schwarz.rtm2032"` 时，WaveBench 使用此外置插件。短 alias
+`rtm2032` 始终选择 Core fallback；卸载插件后，canonical ID 也回退到内建实现。
+
+当前实现覆盖模拟波形采集、coupling、显式 autoscale、截图、只读状态与分析数据，以及受控
+average acquisition、通道显示和多通道 focus 配置。B1、K15 等选件相关行为保持显式门控；
+没有证据的高级应用不会通过 raw SCPI 暴露。精确 capability、profile、配置字段和兼容范围以
+production descriptor 及生成式插件目录为准。
+
+默认 LAN 连接使用 Core 提供的 `rsinstrument-socket` backend。诊断兼容性时可以显式选择其他
+descriptor 已声明的 RsInstrument backend；切换 backend 需要重新打开会话，失败的读取不会
+自动重放。
+
+## 最小配置
 
 ```toml
 [connection]
@@ -67,160 +43,12 @@ long_waveform_timeout_ms = 300000
 
 示例使用 RFC 5737 文档地址。默认测试不扫描资源、不连接仪器，也不发送真实 SCPI。
 
-## 编程手册投放位置
-
-将 RTM2000 系列示波器编程手册放到：
-
-```text
-doc/vendor-local/RTM2000_programming_manual.pdf
-```
-
-也可以保留厂商原始文件名。`doc/vendor-local/` 中除说明文件外的内容会被 Git 忽略，整个目录也会从 sdist 排除，不会随仓库推送或公开发行包发布。项目根据手册整理的 SCPI 索引、能力矩阵和验收资料应另放在公开 `doc/` 中，并明确区分手册声明与实机验证结果。
-
-当前手册命令面与插件、内建 fallback、实机证据的对照见 [RTM2000 手册功能覆盖矩阵](doc/RTM2000_COVERAGE_MATRIX.md)。
-
-## 验收状态
-
-0.1.0 已于 2026-07-24 完成真实 wheel 的受控 RTM2032 LAN/VXI-11 验收：受管安装与 healthy/load、
-canonical 与短 alias 路由、双通道单次 acquisition、`DEF` / `MAX` / `DMAX` 完整波形、
-autoscale、高阻 coupling 守卫、PNG 截图、20/20 双通道重复采集和空错误队列均通过。
-`MAX` 每通道实测 10000000 点，`DMAX` 每通道实测 6250000 点；长记录使用独立 300 s
-传输上限，不把统一 30 s 超时误判为协议失败。验收前保存了完整 setup 快照，结束后确认
-setup blob、配置指纹和活动采集状态均恢复。验收未修改真实 `wavebench.toml`，未提交真实
-地址、序列号、波形、截图、快照或命令日志。实验级快照与恢复仍属于核心/验收工具边界，
-不进入厂商驱动。
-
-0.2.0 将默认 LAN transport 改为 RsInstrument SocketIO，保留上述显式兼容后端。离线门禁
-覆盖 descriptor 路由、调用级长传输 timeout、脱敏 telemetry 和 wheel 生命周期。RTM2032
-实机已通过 SocketIO 的 DEF/MAX/DMAX、截图、autoscale、20/20 重复采集与空错误队列验收。
-实验级 `SYST:SET` setup 恢复不属于插件驱动：SocketIO 写入曾出现只部分生效，因此验收工具
-固定使用已验证的 VXI-11 512-byte 协议分片，并在重连后只读核对完整 blob、配置指纹和活动
-采集状态。验收结束时快照已删除，真实地址、序列号、波形和命令日志均未进入提交。
-
-0.3.0 开发线新增严格类型化的只读 identity/options/health 快照。health 快照只读取
-`*STB?`、operation/questionable condition、acquisition available/count 和 sample rate；不读取会
-消费状态的 EVENT 寄存器，也不自动清空错误队列。该厂商专用 API 不扩张 WaveBench 核心
-capability 声明。0.3.0 还增加 RTM2032 CH1/CH2 的模拟通道、时基和探头元数据快照；
-`FULL` 带宽、`UNKN` 阻抗和仪器不可用数值映射为 `None`；封闭枚举中的未知值、格式非法的
-开放 token、非有限值、未加引号文本和 CH1/CH2 之外的索引均失败关闭。命令索引只证明命令面存在，返回类型来自 RTM2032
-受控只读实测；不会外推为所有 RTM2000 型号的通用契约。实机已验证两路通道、当前时基和
-无源探头状态，验收后 status byte 为 0；未读取 EVENT 或错误队列，也未发送设置命令。
-
-0.4.0 增加厂商专用只读 `waveform_metadata_snapshot(channel)`。它交叉验证
-`DATA:HEADER?`、`POINTs?`、X increment/origin，并返回 Y increment/origin、垂直量化位数和
-每个 sample interval 的值数量；未知/非整数/非有限响应以及混合记录造成的 X 轴不一致均失败关闭。
-RTM2032 CH2 实机只读验收返回 10000 点、200 ns X 步长、20 mV/bit 和 8-bit 分辨率；调用未发送
-写命令、未产生 status/questionable 错误，也未改变 acquisition count。连续运行时 operation condition
-会随正常触发周期在 waiting/non-waiting 间变化，因此不把它误作恒定前后条件。
-`DATA:HEADER?` 第四字段不是 segment ID；history/segment identity 仍未实现，也不纳入本版本声明。
-
-0.5.0 首个小步新增厂商专用只读 `edge_trigger_snapshot()`。当前类型域只覆盖 RTM2032 实机
-证实的 `EDGE / CH1|CH2 / AUTO / POS / DC / hysteresis AUTO / holdoff OFF` 基线；未知 trigger
-类型、source、模式、斜率、coupling 或 holdoff 均失败关闭，不推断手册索引未给出的返回域。CH2
-校准方波只读验收得到 0.53 V trigger level 和 50 ns holdoff time；9 条查询前后 status byte、
-questionable condition 和 acquisition count 保持健康，未读取 EVENT/error queue，也未发送写命令。
-
-0.5.0 第二个小步新增 `configure_ch2_edge_trigger(level_v=...)`，但不声明通用 trigger capability。
-它只接受已启用、未过载、高阻 `DCL/ACL` 的 RTM2032 CH2 基线和当前显示量程内的有限电平；
-在实例级可重入 I/O 锁内固定写入 `EDGE / CH2 / AUTO / POS / DC / level`，随后逐字段回读，
-确认未写入的 hysteresis/holdoff 保持原值，并复核非消费型 health 与 identity。写入开始后的任意
-timeout、回读不符、健康异常或身份变化都会永久锁存该实例的 trigger 写路径，后续调用零 I/O
-拒绝；不自动重试、回滚、find-level、autoscale、single、清错误队列或读取 EVENT。生产 setter
-明确由调用方负责持久恢复；受控实机验收用私有 fsync journal 将 CH2 level 从 0.53 V 改为
-0.65 V 后恢复至 0.53 V，前后 status byte/questionable condition 均为 0，acquisition count 均为 53。
-
-0.6.0 将上述七类只读快照接入 WaveBench 0.8.1 的选择性 `scope.snapshot` 公共契约。
-`get_snapshot(channel)` 在同一实例 I/O 锁内组合 identity、health、指定模拟通道、时基、
-探头、波形元数据和 edge-trigger 快照；descriptor 仅为本 canonical 外置驱动声明该能力，
-因此 `wavebench scope status --channel N` 可用，而不要求其他 scope 驱动实现。原有
-`RTM2000*Snapshot` 导入名保留为公共模型的兼容别名。该聚合调用仍不读取 EVENT/错误队列，
-也不发送设置命令；真实 RTM2032 的 identity、CH1/CH2 snapshot 与 acquisition status 组合路径已完成受控实机验收。
-
-0.7.0 接入 WaveBench 0.8.2 的选择性 `scope.acquisition_status` 与
-`scope.history_timestamps` 公共契约。两条路径均只查询；K15 专属查询必须由 `*OPT?`
-精确返回 K15 token。时间戳按 oldest-to-newest 顺序严格合并 relative、absolute、date 三张
-`:ALL?` 表，不选择 history segment、不启动采集，也不消费错误队列。RTM2032 已确认 K15 与
-average/segmented 只读状态；history timestamp table 查询发生 timeout，未重试且仍属阻塞项。
-
-0.8.0 新增 `scope.measurement_statistics`。调用方必须显式确认 1–4 号槽位已经配置；读取统计
-buffer 时还必须显式确认 acquisition 已停止。实现不配置、启用或复位测量槽，也不读取或清空
-错误队列。`NAN` 结果表示 unavailable；timeout 后结果状态为未知且不重试。RTM2032 上调用方
-确认已配置的 CH2 frequency 槽已完成 actual/average/min/max/stddev/count 受控验收；STOP 状态
-buffer 仍待验收。
-
-0.9.0 新增只读分析状态面。math/reference 只读 metadata，不下载波形本体，也不修改全局传输
-格式；FFT/cursor 必须由调用方显式确认已经在前面板配置。实现不定义 FFT expression、不移动
-cursor、不 update/save/load reference、不启动采集，也不消费错误队列。RTM2032 的 math
-metadata、FFT status 与 vertical cursor delta readout 已完成受控验收并恢复前面板状态；reference
-存储为空，故 metadata 实机验收保持阻塞，未调用 `UPDATE` 制造测试数据。
-
-0.10.0 接入 WaveBench 0.8.5 的 `scope.capture_average`。这是一条窄的、需要调用方显式
-`--acquisition-stopped` 确认的受控写路径：预检既有 `REAL,32` / `LSBF` 传输格式，然后仅临时
-写入 `ACQuire:AVERage:COUNt`、`ACQuire:NSINgle:COUNt` 和全局 `CHANnel:ARITHmetics`，执行
-一次 `SINGle`，确认 `ACQuire:AVERage:COMPlete?` 后读取当前波形。它不写 `FORMat`、byte order、
-point mode、时基、垂直档位、触发或 K15 history 状态。无论采集或波形读取成功与否，都会恢复并
-回读三项配置；恢复失败或结果不一致会锁存该实例的 average 写路径，后续调用零 I/O 拒绝。该实现
-目前有离线事务测试，尚无独立实机验收结论。任一配置写（包括第一条）超时都会按「结果未知」
-处理：即使随后的恢复回读一致，也会永久锁存当前驱动实例，避免继续依赖一次无法证明结果的写事务。
-
-0.11.0 新增 `scope.digital_status` 只读状态面。每次调用先用 `*OPT?` 精确确认 B1，再读取
-D0–D15 中一个显式通道的 activity、display、technology、threshold、threshold coupling、
-hysteresis、deskew、size、position 和 label。该路径不读取 `DIGital:DATA?`，不写阈值/显示/
-传输格式，不启动或停止采集，也不消费错误队列。RTM2032 实机已完成 D0–D15 全通道验收：
-单会话共发出 208 条 query，write 与 binary read 均为 0，四组映射和 D0 重复读取一致性通过；
-CLI 的 D0/D15 端到端输出也通过。验收时全部数字通道均未显示、activity 为 LOW、阈值为
-1.4 V；这些值只记录当时仪器状态，不构成数字探头电气输入或数字波形 payload 验收。
-
-0.12.0 新增 `scope.digital_waveform` 只读数字波形面。调用方必须显式确认采集已经停止；
-驱动先以 `*OPT?` 门控 B1，并要求仪器当前传输格式已经是 ASCII（手册记为 `ASC,0`；
-RTM2032 实机会回读 `CSV,0`）。随后逐通道查询
-`DIGital<n>:DATA:POINts?`、`HEADER?`、`XORigin?`、`XINCrement?` 与 `DATA?`，严格核对
-所有通道的采样数和 X 轴，再在主机侧按 Dn→`uint16` bit n 合并。该路径不发送写命令，
-不切换 STOP/RUN，不修改格式、点数、显示或阈值，也不读取错误队列。当前只有 FakeTransport
-离线验收。RTM2032 只读预检已确认 B1 和 `CSV,0` 门控可通过，但当时 D0 未显示且
-`DIGital0:DATA:POINts?` 返回 0，驱动在 `DATA?` 前拒绝继续；因此数字波形 payload 仍未验收。
-
-0.13.0 将五类既有只读能力接入 WaveBench 0.8.25 的 Scope V2 契约。通道输入状态只从
-`CHANnel<n>:COUPling?` 映射 coupling 与 termination，数值阻抗明确标记为 unavailable；数字状态
-复用既有 B1 门控查询，未提供的 threshold scope 与 timing calibration 明确标记为 unavailable；
-snapshot 固定为 identity 五字段、最多两次查询；测量统计只接受 1–4 号已配置槽位，不读取
-buffer，并要求五个聚合值均为有限数；FFT 状态只提供 average complete、RBW 与 sample rate。
-这些适配器不新增 SCPI 写入，不改变既有 V1 方法、FFT 数值分析或波形采集逻辑。
-RTM2032 的 CH1/CH2 输入状态、CH1/CH2 identity snapshot 和 D0 数字状态已通过受控只读验收；
-相关会话全部强制为 `read_only`，write request 与 binary write 均为 0。测量统计与 FFT V2
-仍以离线等价测试和既有 V1 实机证据为边界；由于没有新鲜的前面板配置确认，本轮未冒充
-`configured=True` 重跑。
-
-0.14.0 新增 `scope.channel_display_configure_v2`。descriptor profile 将可写模拟通道严格限定为
-CH1/CH2，预算对应一次 baseline query、一次 setter write 与 Core fresh readback，以及失败时的一次
-restore write 与一次独立 verify query。插件不自行重试、不扩大到时基或垂直档位，也不另建一套
-恢复状态机。RTM2032 固件 `06.010` 的受控验收在 DG4202 双输出关闭、CH1/CH2 均为 `DCL`
-高阻且无过载的前提下，将 CH2 从 `ON` 切到 `OFF` 并独立读回，再通过 Core 从 `OFF` 恢复到
-`ON`。恢复事务只有一次已完成文本写入，write outcome unknown 与 binary write 均为 0，session
-保持 healthy；最终零写完整 snapshot 确认 CH1/CH2 均回到 `ON`、`DCL`、无过载。
-
-0.15.0 新增 `scope.focus_configure_v2`。RTM 插件 profile 将模拟通道限定为 CH1/CH2，并为时基、
-逐通道 V/div 与 I/O 步数提供插件侧 guard；Core 一次读取完整 time range/position 和两路 display、
-range、V/div、position、offset，成功后保留目标联合视图，任一失败则按 timebase、channel vertical、
-channel display 的固定顺序恢复并重新查询。RTM2032 固件 `06.010` 的代表性验收在 DG4202 双输出
-关闭、两路 `DCL` 高阻且无过载时，将 5 ms 改为 10 ms、CH2 从 0.2 V/div 改为 0.4 V/div，
-并隐藏 CH1；目标状态与恢复状态均通过 fresh readback。随后恢复到 5 ms、两路 0.2 V/div 且均
-开启，6 次文本写入全部完成，结果不明写入和二进制写入均为 0；全新只读 session 再次确认完整
-基线，DG4202 两路仍为 OFF。该设备是 RTM2000 系列的代表性实机基线，不要求逐型号重复验收；
-profile 上下限是插件请求 guard，不表示全部边界值均已逐点上机。部分写入故障与恢复失败使用离线
-受控故障注入验证，未在真实仪器上制造通信故障。
-
-## 开发验证
-
-```bash
-python -m pytest -q packages/wavebench-rohde-schwarz-rtm2000/tests
-python -m ruff check packages/wavebench-rohde-schwarz-rtm2000
-python -m wavebench plugin package check packages/wavebench-rohde-schwarz-rtm2000
-```
+## 安全边界
 
-真实地址、序列号、波形、截图和命令日志不得提交。本插件采用 [MIT License](LICENSE)。
+插件负责 RTM2000 厂商 SCPI、波形解析和设备错误语义。Core 负责会话、权限、高阻保护、
+artifact、run plan 和实验级恢复。真实仪器资源、序列号、波形、截图和命令日志不得提交。
 
-## 来源
+## 开发与许可证
 
-0.1.0 从 WaveBench 主仓库 `973fc88` 的内建 RTM2032 协议实现迁移，只把厂商驱动、
-descriptor、entry point 和 FakeTransport 测试外置。
+日常源码开发和离线验证见仓库级 [editable 开发环境](../../doc/DEVELOPMENT.md)。本插件采用
+[MIT License](LICENSE)。
diff --git a/packages/wavebench-rohde-schwarz-rtm2000/README_EN.md b/packages/wavebench-rohde-schwarz-rtm2000/README_EN.md
index 2c74c42..1ef3b70 100644
--- a/packages/wavebench-rohde-schwarz-rtm2000/README_EN.md
+++ b/packages/wavebench-rohde-schwarz-rtm2000/README_EN.md
@@ -1,64 +1,34 @@
-# WaveBench R&S RTM2000 plugin
+# WaveBench R&S RTM2000 Plugin
 
 [中文](README.md)
 
-An executable WaveBench oscilloscope plugin for the Rohde & Schwarz RTM2000 series, with the
-RTM2032 as the current hardware baseline.
+A WaveBench instrument plugin for the Rohde & Schwarz RTM2000 oscilloscope series, using the RTM2032
+as its representative hardware baseline.
 
-## Identity and development baseline
+## Start here
 
-- distribution: `wavebench-rohde-schwarz-rtm2000`
-- canonical driver ID: `rohde-schwarz.rtm2032`
-- development baseline: WaveBench `0.8.26`
-- WaveBench: `>=0.8.26,<0.9`
-- Python: `>=3.11`
-- default transport backend: core-provided `rsinstrument-socket`
+- [Find the current version, compatibility range, models, and capabilities](../../doc/reference/plugin-catalog-en.md)
+- [Browse the RTM2000 plugin documentation](doc/README_EN.md)
+- [Install and manage WaveBench plugins](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-The plugin's 0.15.0 development line targets WaveBench `v0.8.26`, does not maintain a legacy-core
-compatibility matrix, and does not automatically claim compatibility with a future `0.9` core. When installed, the explicit canonical ID `rohde-schwarz.rtm2032` selects
-the external implementation. The short alias `rtm2032` always selects the built-in fallback.
-Removing the plugin restores the built-in implementation for the canonical ID as well.
+## Scope
 
-## Capabilities and boundary
+Set `driver = "rohde-schwarz.rtm2032"` to select this external plugin. The short `rtm2032` alias
+always selects the Core fallback; after removal, the canonical ID also falls back to the built-in
+implementation.
 
-- `*IDN?`, error queue, and explicit autoscale;
-- vendor-specific read-only identity/options/health snapshots that do not consume event registers or the error queue;
-- typed RTM2032 CH1/CH2 analog-channel, timebase, and probe-metadata snapshots;
-- typed current-waveform X/Y scaling, point-count, quantization, and values-per-sample metadata;
-- a typed read-only basic edge-trigger snapshot for RTM2032 CH1/CH2;
-- read-only average/segmented acquisition state, with K15-only queries option-gated;
-- controlled average acquisition, requiring the caller to confirm acquisition is stopped; it temporarily changes only average count, single count, and global channel arithmetic, reads the original configuration back after restoration, and latches further average writes if restoration is ambiguous;
-- read-only K15 history timestamp tables for RTM2032 CH1/CH2;
-- read-only statistics for an explicitly preconfigured automatic-measurement slot;
-- read-only metadata/status for existing math, FFT, reference, and cursor state;
-- read-only Scope V2 surfaces for channel input state, B1-gated digital status, a strict five-field
-  identity snapshot, slot-1-to-4 measurement statistics without buffers, and three-field status for
-  an explicitly configured FFT;
-- `scope.channel_display_configure_v2` for RTM2032 CH1/CH2: core owns the typed baseline,
-  post-write readback, failure restoration, and independent restoration verification, while the
-  plugin performs only the selected channel's `STATE?` and `STATE ON/OFF` operations;
-- `scope.focus_configure_v2` for RTM2000-series CH1/CH2: the RTM plugin profile declares channel,
-  timebase, and V/div request guards, while core owns the complete joint baseline, post-write
-  readback, failure restoration, and restoration verification;
-- a vendor-specific minimal controlled RTM2032 CH2 edge-trigger configuration loop;
-- current-waveform fetch and single acquisition;
-- one acquisition followed by multi-channel waveform reads;
-- channel-coupling queries and PNG screenshots;
-- pass-through RTM2000 `DEF`, `MAX`, and `DMAX` point modes.
+The implementation covers analog waveform capture, coupling, explicit autoscale, screenshots,
+read-only state and analysis data, and controlled average acquisition, channel display, and
+multi-channel focus configuration. Option-dependent behavior such as B1 and K15 remains explicitly
+gated, and unsupported advanced applications are not exposed through raw SCPI. The production
+descriptor and generated plugin catalog are authoritative for exact capabilities, profiles,
+configuration fields, and compatibility.
 
-The plugin owns RTM2000 SCPI, header/REAL waveform parsing, and device-error semantics. Core retains
-the RsInstrument session, timeouts, high-impedance guard, services, artifacts, run plans, and
-experiment-level restoration. Empty or short waveform lists, invalid headers, non-PNG screenshots,
-and OPC timeouts fail explicitly; the plugin does not pad, fabricate success, or retry blindly.
+LAN connections use the Core-provided `rsinstrument-socket` backend by default. Other RsInstrument
+backends declared by the descriptor can be selected explicitly for compatibility diagnosis. A
+backend change requires a new session, and failed reads are not replayed automatically.
 
-`backend = "lan"` selects RsInstrument SocketIO according to descriptor preference and does not
-depend on VISA-C or pyvisa-py. Explicit diagnostic compatibility paths are `rsinstrument`,
-`rsinstrument-rsvisa`, and `rsinstrument-pyvisa-py`; changing backend requires a fresh session,
-and a failed response is never replayed automatically. Only `MAX` and `DMAX` waveform data reads
-use the dedicated long-transfer timeout. Chunk progress, point/byte counts, elapsed time, and
-throughput telemetry exclude addresses, serial numbers, and waveform contents.
-
-## Configuration example
+## Minimum configuration
 
 ```toml
 [connection]
@@ -74,202 +44,16 @@ check_errors = true
 long_waveform_timeout_ms = 300000
 ```
 
-The example uses an RFC 5737 documentation address. Offline tests do not scan resources, connect to
+The example uses an RFC 5737 documentation address. Default tests do not scan resources, connect to
 instruments, or send real SCPI.
 
-## Programming-manual location
-
-Place the RTM2000-series oscilloscope programming manual at:
-
-```text
-doc/vendor-local/RTM2000_programming_manual.pdf
-```
-
-The vendor's original filename may also be retained. All content under `doc/vendor-local/` except its explanatory README is ignored by Git, and the entire directory is excluded from the sdist, so vendor manuals are not pushed with the repository or published in public distribution artifacts. Project-authored SCPI indexes, capability matrices, and acceptance material should live separately under public `doc/` and distinguish manual claims from hardware-verified behavior.
-
-See the [RTM2000 manual feature coverage matrix](doc/RTM2000_COVERAGE_MATRIX_EN.md) for the current comparison across the manual surface, external plugin, bundled fallback, and hardware evidence.
-
-## Acceptance status
-
-Version 0.1.0 completed controlled RTM2032 LAN/VXI-11 acceptance with a real wheel on 2026-07-24. Managed
-install and healthy/load checks, canonical-versus-short-alias routing, dual-channel single
-acquisition, complete `DEF`, `MAX`, and `DMAX` waveforms, autoscale, the high-impedance coupling
-guard, PNG screenshots, 20/20 repeated dual-channel captures, and an empty error queue all passed.
-`MAX` returned 10,000,000 points per channel and `DMAX` returned 6,250,000 points per channel. Long
-records used a separate 300-second transfer bound rather than treating the shared 30-second timeout
-as a protocol failure. A complete setup snapshot was saved before mutation; the setup blob,
-configuration fingerprint, and active acquisition state were all confirmed restored afterward.
-The acceptance did not modify the real `wavebench.toml` or commit real addresses, serial numbers,
-waveforms, screenshots, snapshots, or command logs. Experiment-level snapshot and restoration stay
-in core/acceptance tooling rather than the vendor driver.
-
-Version 0.2.0 changes the preferred LAN transport to RsInstrument SocketIO while retaining the
-explicit compatibility backends above. Offline gates cover descriptor routing, per-call
-long-transfer timeouts, sanitized telemetry, and the wheel lifecycle. RTM2032 hardware acceptance
-passed for SocketIO DEF/MAX/DMAX, screenshot, autoscale, 20/20 repeated capture, and an empty error
-queue. Experiment-level `SYST:SET` restoration is not a plugin-driver responsibility: a SocketIO
-write once applied the setup only partially, so the acceptance tool uses the verified VXI-11
-512-byte protocol chunks and performs read-only comparison of the complete blob, configuration
-fingerprint, and active acquisition state after reconnecting. The final snapshot was deleted and
-no real address, serial number, waveform, or command log entered the commit.
-
-The 0.3.0 development line adds strict typed read-only identity/options/health snapshots. The health
-snapshot reads only `*STB?`, operation/questionable condition, acquisition available/count, and sample
-rate. It does not consume event registers or drain the error queue. This vendor-specific API does not
-expand the WaveBench core capability declaration. Version 0.3.0 also adds RTM2032 CH1/CH2 analog-
-channel, timebase, and probe-metadata snapshots. `FULL` bandwidth, `UNKN` impedance, and instrument
-unavailable-value sentinels map to `None`; unknown values in closed enums, malformed open tokens,
-non-finite values, unquoted text, and indexes outside CH1/CH2 fail closed. The command index establishes command-surface existence only; return
-types come from controlled read-only RTM2032 measurements and are not generalized to every RTM2000
-model. Hardware acceptance covered both channels, the current timebase, and passive-probe state and
-left the status byte at zero. It read no event/error queue and sent no setting command.
-
-Version 0.4.0 adds the vendor-specific read-only `waveform_metadata_snapshot(channel)` API. It
-cross-checks `DATA:HEADER?`, `POINTs?`, X increment/origin, and returns Y increment/origin, vertical
-quantization bits, and values per sample interval. Unknown, non-integral, non-finite, or mixed-record
-X-axis responses fail closed. Controlled RTM2032 CH2 acceptance returned 10,000 points, a 200 ns X
-increment, 20 mV/bit, and 8-bit resolution. Status byte, operation/questionable condition, and
-acquisition count showed no error or count change, and no write was sent. On a running acquisition,
-the operation condition may naturally move between waiting and non-waiting states during the trigger
-cycle, so it is not treated as a constant before/after invariant. The fourth `DATA:HEADER?` field is
-not a segment identity; history/segment identity remains outside this release claim.
-
-The first version 0.5.0 increment adds the vendor-specific read-only `edge_trigger_snapshot()` API.
-Its closed domains intentionally cover only the RTM2032 hardware-verified
-`EDGE / CH1|CH2 / AUTO / POS / DC / hysteresis AUTO / holdoff OFF` baseline. Unknown trigger types,
-sources, modes, slopes, coupling, or holdoff modes fail closed rather than inferring response domains
-from the command index. Read-only CH2 calibration-square-wave acceptance returned a 0.53 V trigger
-level and 50 ns holdoff time. Nine queries left status byte, questionable condition, and acquisition
-count healthy, consumed no event/error queue, and sent no write.
-
-The second 0.5.0 increment adds `configure_ch2_edge_trigger(level_v=...)` without declaring a generic
-trigger capability. It accepts only an enabled, non-overloaded, high-impedance `DCL/ACL` RTM2032 CH2
-baseline and a finite level inside the current displayed range. Under the instance-wide reentrant I/O
-lock it writes the fixed `EDGE / CH2 / AUTO / POS / DC / level` state, reads every field back,
-requires the untouched hysteresis/holdoff settings to remain unchanged, and rechecks non-consuming
-health and identity. Any timeout, readback mismatch, health fault, or identity drift after writing
-begins permanently latches that instance's trigger-write path; subsequent calls fail with zero I/O.
-There is no blind retry, automatic rollback, find-level, autoscale, single acquisition, error-queue
-clear, or EVENT read. Persistent restoration remains the caller's responsibility. Controlled hardware
-acceptance used a private fsync journal to change CH2 from 0.53 V to 0.65 V and restore 0.53 V; status
-byte/questionable condition remained zero and acquisition count remained 53 before and after.
-
-Version 0.6.0 connects those seven read-only sections to WaveBench 0.8.1's optional
-`scope.snapshot` contract. `get_snapshot(channel)` aggregates identity, health, the selected analog
-channel, timebase, probe, waveform metadata, and edge-trigger snapshots under the same instance I/O
-lock. Only this canonical external descriptor declares the capability, so `wavebench scope status
---channel N` becomes available without requiring other scope drivers to implement it. Existing
-`RTM2000*Snapshot` import names remain compatibility aliases of the public core models. The aggregate
-path still reads no EVENT/error queue and sends no setting command. Controlled RTM2032 acceptance now
-covers identity, CH1/CH2 snapshots, and acquisition status.
-
-Version 0.7.0 adds the optional `scope.acquisition_status` and `scope.history_timestamps`
-contracts from WaveBench 0.8.2. Both paths are query-only. K15-only queries require an exact K15
-token from `*OPT?`; timestamp rows are built by strict positional matching of the relative-time,
-absolute-time, and date `:ALL?` tables in oldest-to-newest order. No history segment is selected,
-no acquisition is started, and the error queue is not consumed. RTM2032 acceptance confirmed K15 and
-the read-only average/segmented status. The history timestamp-table query timed out, was not retried,
-and remains blocked.
-
-Version 0.8.0 adds `scope.measurement_statistics`. The caller must explicitly confirm that slot 1-4
-was configured before the command. Buffer reads additionally require explicit confirmation that
-acquisition is stopped. The implementation never configures, enables, or resets a slot and never
-queries or clears the error queue. `NAN` actual/statistical values are represented as unavailable;
-timeouts leave the operation outcome unknown and are not retried. A caller-confirmed CH2 frequency
-slot passed controlled actual/average/min/max/stddev/count acceptance; stopped-acquisition buffer
-reading remains pending.
-
-Version 0.9.0 adds query-only analysis surfaces. Math and reference commands return metadata only;
-they do not read waveform payloads or alter the global transfer format. FFT and cursor status require
-explicit confirmation that the corresponding front-panel object is already configured. The plugin
-does not define an FFT expression, move cursors, update/save/load references, start acquisition, or
-consume the error queue. Math metadata, FFT status, and vertical cursor delta readout passed controlled
-RTM2032 acceptance with front-panel restoration. Reference metadata remains blocked because reference
-storage was empty; `UPDATE` was not used to manufacture test data.
-
-Version 0.10.0 connects the WaveBench 0.8.5 `scope.capture_average` contract. This is a narrow,
-controlled write path that requires explicit `--acquisition-stopped` caller confirmation. It preflights
-the existing `REAL,32` / `LSBF` transfer format, temporarily writes only `ACQuire:AVERage:COUNt`,
-`ACQuire:NSINgle:COUNt`, and global `CHANnel:ARITHmetics`, issues one `SINGle`, confirms
-`ACQuire:AVERage:COMPlete?`, and reads the current waveforms. It does not write `FORMat`, byte order,
-point mode, timebase, vertical scale, trigger, or K15 history state. Both successful and failed
-acquisitions restore and read back all three configuration fields; failed or mismatched restoration
-latches that instance's average-write path, so later calls fail with zero I/O. This has offline
-transaction coverage but no independent hardware-acceptance conclusion yet.
-
-Version 0.11.0 adds the read-only `scope.digital_status` surface. Every call first requires an
-exact B1 token from `*OPT?`, then reads the activity and existing display, technology, threshold,
-threshold-coupling, hysteresis, deskew, size, position, and label state for one explicit D0-D15
-channel. It does not read `DIGital:DATA?`, write digital configuration or transfer format, start or
-stop acquisition, or consume the error queue. RTM2032 hardware acceptance covered all D0-D15
-channels in one session: 208 queries, zero writes, zero binary reads, correct four-group mapping,
-and stable repeated D0 results. End-to-end CLI reads also passed for D0 and D15. At acceptance time
-all digital channels were hidden, reported LOW activity, and used a 1.4 V threshold; those observed
-values do not constitute electrical-input or digital-waveform-payload acceptance.
-
-Version 0.12.0 adds the read-only `scope.digital_waveform` surface. The caller must explicitly
-confirm that acquisition is stopped. The driver gates B1 through `*OPT?`, requires the existing
-transfer format to be ASCII (documented as `ASC,0`; RTM2032 hardware reports `CSV,0`), then queries `DIGital<n>:DATA:POINts?`, `HEADER?`, `XORigin?`,
-`XINCrement?`, and `DATA?` for every selected channel. Sample counts and X axes must match exactly
-before host-side Dn→`uint16` bit n packing. The path sends no writes, does not switch STOP/RUN,
-does not alter format, points, display, or thresholds, and does not consume the error queue. It has
-FakeTransport acceptance. An RTM2032 read-only preflight passed the B1 and `CSV,0` gates, but D0
-was hidden and `DIGital0:DATA:POINts?` returned zero, so the driver stopped before `DATA?` and
-digital-payload hardware acceptance remains pending.
-
-Version 0.13.0 maps five existing read-only surfaces to the WaveBench 0.8.25 Scope V2 contracts.
-Channel input state derives coupling and termination only from `CHANnel<n>:COUPling?`, with numeric
-impedance explicitly unavailable. Digital status reuses the existing B1-gated queries and marks
-threshold scope and timing calibration unavailable. Snapshot V2 is fixed to five identity fields and
-two queries. Measurement statistics accepts only preconfigured slots 1-4, reads no buffer, and
-requires all five aggregates to be finite. FFT status exposes only average complete, RBW, and sample
-rate. These adapters add no SCPI writes and do not alter the V1 methods, host-side FFT analysis, or
-waveform-capture logic.
-Controlled read-only RTM2032 acceptance passed for CH1/CH2 input state, CH1/CH2 identity snapshots,
-and D0 digital status. Every related session was forced to `read_only`, with zero write requests and
-zero binary writes. Measurement-statistics and FFT V2 remain bounded by offline equivalence tests and
-their existing V1 hardware evidence; this run did not pretend to have fresh front-panel configuration
-confirmation by passing `configured=True` without evidence.
-
-Version 0.14.0 adds `scope.channel_display_configure_v2`. The descriptor profile limits writable
-analog channels to CH1/CH2 and budgets one baseline query, one setter write plus core fresh readback,
-and, on failure, one restoration write plus one independent verification query. The plugin neither
-retries nor expands the operation to timebase or vertical settings, and it does not duplicate core's
-recovery state machine. Controlled RTM2032 firmware `06.010` acceptance ran with both DG4202 outputs
-off and both scope channels high-impedance `DCL` and not overloaded. It changed CH2 from `ON` to
-`OFF`, confirmed that state independently, then used core to restore `OFF` to `ON`. The restoration
-transaction recorded one completed text write, zero unknown write outcomes, zero binary writes, and
-a healthy session. A final zero-write full snapshot confirmed CH1/CH2 both restored to `ON`, `DCL`,
-and not overloaded.
-
-Version 0.15.0 adds `scope.focus_configure_v2`. The RTM plugin profile limits analog channels to
-CH1/CH2 and declares plugin-side timebase, per-channel V/div, and I/O-step guards. Core reads the
-complete time range/position plus display, range, V/div, position, and offset for both channels in
-one baseline. It preserves the requested joint view after success and restores in fixed timebase,
-channel-vertical, channel-display order after any failure, followed by fresh verification.
-Representative RTM2032 firmware `06.010` acceptance ran with both DG4202 outputs off and both scope
-inputs high-impedance `DCL` and not overloaded. It changed 5 ms to 10 ms, changed CH2 from 0.2 V/div
-to 0.4 V/div, and hid CH1; fresh readback proved both the target and restored states. The operation
-then restored 5 ms, both channels at 0.2 V/div, and both displays on. All six text writes completed,
-with zero unknown outcomes and zero binary writes. A new read-only session independently confirmed
-the complete baseline, and both DG4202 outputs remained off. This RTM2032 is the representative
-hardware baseline for the RTM2000 series; per-model repetition is not required. Profile bounds are
-plugin request guards, not a claim that every boundary value was exercised on hardware. Partial-write
-and failed-restoration paths are covered by controlled offline fault injection, not by inducing live
-communication faults.
-
-## Development checks
-
-```bash
-python -m pytest -q packages/wavebench-rohde-schwarz-rtm2000/tests
-python -m ruff check packages/wavebench-rohde-schwarz-rtm2000
-python -m wavebench plugin package check packages/wavebench-rohde-schwarz-rtm2000
-```
+## Safety boundary
 
-Do not commit real addresses, serial numbers, waveforms, screenshots, or command logs. This package
-is licensed under the [MIT License](LICENSE).
+The plugin owns RTM2000 vendor SCPI, waveform parsing, and device-error semantics. Core owns sessions,
+permissions, high-impedance protection, artifacts, run plans, and experiment-level recovery. Never
+commit real instrument resources, serial numbers, waveforms, screenshots, or command logs.
 
-## Origin
+## Development and license
 
-Version 0.1.0 was migrated from the built-in RTM2032 protocol implementation at WaveBench `973fc88`.
-Only the vendor driver, descriptor, entry point, and FakeTransport tests moved into this package.
+Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md) for source
+development and offline checks. This plugin is licensed under the [MIT License](LICENSE).
diff --git a/packages/wavebench-rohde-schwarz-rtm2000/doc/README.md b/packages/wavebench-rohde-schwarz-rtm2000/doc/README.md
new file mode 100644
index 0000000..3e366ec
--- /dev/null
+++ b/packages/wavebench-rohde-schwarz-rtm2000/doc/README.md
@@ -0,0 +1,28 @@
+# RTM2000 插件文档
+
+[English](README_EN.md)
+
+本页导航 RTM2000 插件的当前查询入口、历史证据和本地厂商资料。当前版本、兼容范围、型号和
+capability 以 production descriptor 与生成式插件目录为准。
+
+## 当前查询入口
+
+- [RTM2000 当前功能覆盖与行为边界](RTM2000_COVERAGE_MATRIX.md)
+- [仓库级插件目录](../../../doc/reference/plugin-catalog.md)：由包元数据和 production descriptor 生成。
+
+## 开发
+
+- [RTM2000 功能覆盖开发路线](RTM2000_COVERAGE_MILESTONES.md)
+- [仓库开发环境](../../../doc/DEVELOPMENT.md)
+
+## 历史与验收证据
+
+- [0.1.0–0.15.0 开发与验收存档](archive/RTM2000_README_0.15.md)
+- [跨插件验收与历史证据索引](../../../doc/evidence/README.md)
+
+历史记录保存特定版本、设备和时间点的结论，不独立提升当前 capability。
+
+## 厂商资料
+
+- [本地编程手册存放规则](vendor-local/README.md)
+- [返回插件入口](../README.md)
diff --git a/packages/wavebench-rohde-schwarz-rtm2000/doc/README_EN.md b/packages/wavebench-rohde-schwarz-rtm2000/doc/README_EN.md
new file mode 100644
index 0000000..489ac52
--- /dev/null
+++ b/packages/wavebench-rohde-schwarz-rtm2000/doc/README_EN.md
@@ -0,0 +1,30 @@
+# RTM2000 Plugin Documentation
+
+[中文](README.md)
+
+This page routes readers to current RTM2000 lookup material, historical evidence, and local vendor
+documentation. The production descriptor and generated plugin catalog are authoritative for the
+current version, compatibility range, models, and capabilities.
+
+## Current lookup
+
+- [RTM2000 current coverage and behavior boundaries](RTM2000_COVERAGE_MATRIX_EN.md)
+- [Repository plugin catalog](../../../doc/reference/plugin-catalog-en.md): generated from package metadata and the production descriptor.
+
+## Development
+
+- [RTM2000 feature-coverage development roadmap](RTM2000_COVERAGE_MILESTONES_EN.md)
+- [Repository development environment](../../../doc/DEVELOPMENT_EN.md)
+
+## Historical and acceptance evidence
+
+- [0.1.0–0.15.0 development and acceptance archive](archive/RTM2000_README_0.15_EN.md)
+- [Cross-plugin acceptance and historical evidence index](../../../doc/evidence/README_EN.md)
+
+Historical records preserve conclusions for particular versions, devices, and points in time. They
+do not independently promote current capabilities.
+
+## Vendor material
+
+- [Local programming-manual storage rules](vendor-local/README.md)
+- [Return to the plugin landing page](../README_EN.md)
diff --git a/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX.md b/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX.md
index 7e8271b..78125b4 100644
--- a/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX.md
+++ b/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX.md
@@ -2,119 +2,72 @@
 
 [English](RTM2000_COVERAGE_MATRIX_EN.md)
 
-## 目的与统计口径
-
-本矩阵将 RTM2000 编程手册的本地命令索引与 WaveBench RTM2000 外置插件、内建 fallback 和已记录的 RTM2032 实机验收逐项对照。它回答「手册声明了什么、当前产品覆盖了什么、下一步最值得补什么」，不把手册声明等同于当前 RTM2032 已安装选件或实机能力。
-
-指定手册的 1490 行转录中共有 1434 个命令索引条目，精确去重后为 1417 个命令模板（608 个带查询标记、809 个非查询形式）。进一步按大小写不敏感并去除排版空白后为 1416 个模板（607 个查询、809 个非查询）；最后一个差异来自重复/排版变体。这个数字仍包含参数化模板和少量 OCR 异常，因此只用于描述命令面规模，不作为功能完成率分母。
-
-当前外置插件公开 26 项 WaveBench capability，其中 5 项是 0.13.0 新增的只读 Scope V2 capability，0.14.0 新增受控通道显示，0.15.0 新增多通道联合视图。它是经过代表性实机验收的模拟波形采集 MVP，并包含一组窄的只读状态/分析能力、受控视图配置和一条受控平均采集事务，不是通用 RTM2000 远程控制层。
-
-覆盖状态：
-
-- **实机通过**：外置插件实现、离线测试和 RTM2032 受控实机验收均已有证据。
-- **已实现**：代码和离线测试存在，但该细项没有独立实机结论。
-- **部分覆盖**：只覆盖该手册功能族中一小部分。
-- **未覆盖**：插件、内建 fallback 和通用 ScopeService 均无对应 API。
-- **验收工具限定**：仅用于实验前后恢复或验收，不属于生产驱动 API。
-- **选件/型号门控**：应先读取身份和选件，再决定是否暴露。
-
-## 功能覆盖矩阵
-
-| 功能域 | 手册命令面 | 当前覆盖 | 实机状态 | 主要缺口 | 建议 |
-|---|---|---|---|---|---|
-| 身份、同步与基本错误 | IEEE 488.2 公共命令，`SYSTem:ERRor:*` | `*IDN?`、`*OPT?`、非消费型 health snapshot、identity 五字段 `scope.snapshot_v2`、`*CLS`、`*OPC?` 等待、显式错误队列 | **实机通过**：CH1/CH2 Snapshot V2 只读验收通过 | 自检和完整事件寄存器 API 未暴露 | identity/options/health P1 已完成；EVENT 保持显式边界 |
-| Acquisition 控制 | 16 个模板：模式、平均、采样率、记录长度、插值、分段和可用点数 | 只读 available/count/sample-rate 及 average/segmented 状态；`SINGle` 单次采集；显式 `AUToscale`；受控 `scope.capture_average` | **只读状态实机通过；平均事务已实现、待独立实机验收** | 连续运行/停止、分段采集、写入率和插值仍缺失 | 保持 average 的显式 stopped 确认、回读恢复与锁存；**P2**：分段 plan |
-| 模拟通道配置 | 约 48 个模板：状态、耦合、量程、比例、偏置、位置、带宽、极性、skew、标签、过载、阈值 | RTM2032 CH1/CH2 类型化只读状态与 `scope.channel_input_state_v2`；V2 仅映射 coupling/termination，数值阻抗标记为 unavailable；`scope.channel_display_configure_v2` 提供单通道显示事务，`scope.focus_configure_v2` 提供多目标显示、逐通道 V/div、完整联合 baseline 与失败恢复 | **实机通过**：CH1/CH2 V2 输入状态、CH2 `ON→OFF→ON` 显示事务，以及 CH1 隐藏、CH2 0.2→0.4 V/div、完整恢复的代表性验收通过 | 无阈值读回；focus 不配置 position、offset、耦合、终端或带宽，profile 边界值未逐点上机 | 视图配置 P1 已完成；其他写入继续受高阻和恢复策略约束 |
-| 模拟波形传输 | `CHANnel<m>:DATA*`、envelope、独立 X/Y 元数据 | REAL/LSBF、header + data、`DEF/MAX/DMAX`、一次 acquisition 后逐通道读取；类型化 X/Y 缩放、点数、量化位数和 values-per-sample 快照 | **实机通过** | 无 envelope、history/segment 选择或流式块 API；不承诺跨通道硬件同步 | 波形元数据已完成；**P2**：分段/history/envelope |
-| 时基、缩放与时间戳 | 12 个 timebase 模板、zoom、timestamp 导航 | 类型化 acquisition time/divisions/position/range/reference/scale/roll 只读状态；`scope.focus_configure_v2` 可设置 time range，并把 time position 作为受保护 baseline 字段；K15 门控的严格 history timestamp table API | **基础时基与 focus 代表性实机验收通过；history timestamp 查询因仪器 timeout 阻塞** | 无 zoom；profile 时基边界值未逐点上机；没有成功的 timestamp table 实机证据 | 保留插件侧时基 guard 和严格 K15 gate；禁止隐式重试/清错 |
-| 触发系统 | 约 159 个模板：A/B、edge、width、runt、rise time、pattern、TV、holdoff、外部和协议触发 | CH1/CH2 基础 edge-trigger 类型化只读快照；RTM2032 CH2 `EDGE/AUTO/POS/DC/level` 厂商专用受控 setter；单次采集沿用仪器当前触发设置 | **只读与 CH2 写入/恢复实机通过** | setter 仅接受健康、高阻、未过载 CH2 和当前量程内电平；无自动恢复 journal、其他 trigger 类型、B trigger 或 trigger out | P1 已完成；恢复责任保持显式，扩展写能力前另行设计事务模型 |
-| 自动测量与统计 | 20 个模板：测量槽、source/main、actual、峰值、均值、标准差、波形计数 | `scope.measurement_statistics` 与 `scope.measurement_statistics_v2`；V2 仅查询调用方确认已配置的 1–4 号槽，不支持 buffer，并要求完整有限聚合值 | **既有已配置槽实机通过；V2 适配器已离线验证**：CH2 frequency actual/average/min/max/stddev/count 均成功；未配置槽 timeout 保留为负向边界 | STOP buffer 尚未实机验收，且不属于 V2 profile | 继续要求显式配置确认；buffer 还需 stopped 确认；该 API 不配置/复位槽位、不读错误队列 |
-| 光标 | 约 27 个模板：X/Y 光标、delta、ratio、tracking、结果 | `scope.cursor_readout`：仅查询调用方确认已配置的 cursor | **Vertical delta 实机通过**；其他函数仅离线测试 | 无生产 cursor 配置/定位 API | 窄 readout 已完成；定位保持独立受控动作 |
-| 数学与 FFT | 约 51 个模板：表达式、math 波形、envelope、FFT window/span/RBW | `scope.math_metadata`、受门控的 `scope.fft_status`、仅提供 average complete/RBW/sample rate 的 `scope.fft_status_v2`，以及既有状态的 `scope.reference_metadata` | **既有 Math metadata 与 FFT status 实机通过；V2 适配器已离线验证**；reference 因仪器没有有效存储波形而阻塞 | 无 payload read、生产 expression 配置或 reference update/save/load | 保持状态配置分离，保护 reference 存储，主机 DSP 继续独立 |
-| Spectrum / spectrogram | 107 个模板：频谱波形、频率轴、RBW、marker、history、spectrogram | 未覆盖 | 无 | 完整频谱分析应用缺失 | **P3，选件门控**：先探测选件和 `SPECtrum[:STATe]`，再设计独立 capability |
-| Search | 约 119 个模板：edge/width/runt/pattern、结果和协议搜索 | 未覆盖 | 无 | 无搜索配置、结果列表或结果导航 | **P3**：依赖 history/trigger/protocol 模型成熟后再做 |
-| Mask test | 约 36 个模板：mask 数据、计数、动作、保存/加载 | 未覆盖 | 无 | 无 mask 生命周期、违规计数或 action 安全模型 | **P3，破坏性动作分离**：只读结果与保存/打印/脉冲动作必须分开 |
-| 数字通道 / MSO | 约 33 个模板：数字波形、阈值、技术类型、deskew、history | B1 门控的 `scope.digital_status` 与 `scope.digital_status_v2`；V2 将 threshold scope 与 timing calibration 标记为 unavailable；`scope.digital_waveform` 在既有 ASCII 格式（手册 `ASC,0`，RTM2032 回读 `CSV,0`）下逐 Dn 只读并主机侧合并为 uint16 | **标量状态实机通过**：既有 D0–D15 与 CLI 验收保持有效，D0 V2 只读验收通过；数字波形 FakeTransport 通过，实机只读预检通过 B1/格式门控后因 D0 未显示、点数为 0 在 `DATA?` 前终止 | 数字 waveform payload 尚未实机验收；无配置写入、history 或总线解码 API；未做数字探头电气验收 | 在停止采集的稳定记录上做零写入 payload/轴一致性实机验收；电气输入验收另行设计 |
-| 串行/并行总线解码 | 约 249 个模板：I²C、SPI/SSPI、UART、CAN、LIN、I²S、ARINC、MIL-STD、并行总线及帧结果 | 未覆盖 | 无 | 无总线配置、帧列表、字段解析或 history | **P3，按选件拆包**；不要放进基础 scope capability |
-| 协议触发与协议搜索 | 触发和 search 内另有大量 CAN/LIN/I²C/SPI/UART/I²S/ARINC/MIL-STD 模板 | 未覆盖 | 无 | 依赖总线源、阈值、协议格式和选件探测 | **P3**：在总线只读解码之后实现 |
-| DVM 与频率计数器 | 6 个 DVM、3 个 counter 模板 | 未覆盖 | 无 | 无 source/type/result/status API | **P2，选件门控**：适合小型只读 capability |
-| Probe 元数据与设置 | 约 18 个模板：探头身份、衰减、带宽、阻抗、偏置、模式 | RTM2032 CH1/CH2 衰减、带宽、电容、阻抗、名称、类型只读快照 | **实机通过** | 无探头 ID 字段、DC offset、mode 或安全限值联动 | 基础 P1 已完成；ID 与安全联动后续补充，写入延后 |
-| Reference curve | 约 19 个模板：source/save/load/state、缩放和数据 | 已有存储波形的只读 `scope.reference_metadata` | **已实现；因 reference 存储为空而实机阻塞**（`DATA:HEADer?` 为零点，后续 metadata 查询 timeout） | 若不覆盖内部 reference 就没有安全测试夹具；无 payload 或状态管理 | 等待用户创建 reference；不得仅为制造验收证据调用 `UPDATE`、save 或 load |
-| 显示与截图 | 24 个 display 模板和 8 个 hardcopy 模板 | CH1/CH2 `scope.channel_display_configure_v2`；`scope.focus_configure_v2` 可选择多个目标通道并隐藏其他模拟通道；PNG、颜色方案、菜单开关 | **实机通过**：单通道显示事务与 focus 目标/恢复状态均通过 fresh readback，最终全新只读 session 复核完整基线 | 无 grid、palette、persistence、XY、virtual screen、页面/打印设置 | 通道显示、联合视图与截图满足 MVP；其余 **P3** |
-| 仪器文件系统与导出 | 16 个 `MMEMory` 模板；波形、测量、搜索和 power 导出 | 未覆盖；WaveBench 仅保存主机侧 artifact | 无 | 仪器盘目录、复制/删除、仪器侧 CSV/报告导出均缺失 | **默认不做**；若实现需独立文件系统权限和路径沙箱 |
-| Setup 快照与恢复 | `SYSTem:SET`、`MMEMory:STORE/LOAD:STATE` | 生产驱动未暴露；验收工具使用 setup blob 恢复 | **验收路径通过** | SocketIO 对 setup blob 写入曾部分生效；可靠恢复依赖受控 VXI-11 分片 | 保持 **验收工具限定**，不要伪装成普通 setter |
-| 状态寄存器与健康监控 | operation/questionable/status byte、overload/mask/limit 状态 | 不消费 EVENT/错误队列的 health snapshot；通道 overload 只读 | **实机通过** | 无 mask/limit 聚合或事件寄存器 API | 基础 P1 已完成；EVENT 保持显式、消费型边界 |
-| 电源分析 | 约 358 个模板：quality、harmonics、ripple、switching、SOA、efficiency、inrush、modulation 等 | 未覆盖 | 无 | 是独立应用域，涉及专用探头、deskew、报告和大量结果类型 | **P3，选件门控、独立 capability/package** |
-| Calibration、reset 与系统设置 | calibration、`*RST`、preset、日期/时间、语言、蜂鸣器、教育模式 | 未覆盖 | 无 | 这些操作会改变全局状态或需要人工恢复 | **默认禁止或仅验收工具显式授权** |
-
-## 当前直接覆盖的 SCPI 表面
-
-当前外置驱动主要使用以下等价命令族：
-
-```text
-*IDN?  *CLS  *OPC?
-SYSTem:ERRor[:NEXT]?
-AUToscale  SINGle
-TIMebase:RANGe[?]  TIMebase:POSition[?]
-CHANnel<n>:STATE[?]  CHANnel<n>:COUPling?
-CHANnel<n>:RANGe?  CHANnel<n>:SCALe[?]
-CHANnel<n>:POSition[?]  CHANnel<n>:OFFSet[?]
-FORMat[:DATA]  FORMat:BORder
-CHANnel:DATA:POINTs
-CHANnel<n>:DATA:HEADer?  CHANnel<n>:DATA?
-HCOPy:LANGuage  HCOPy:COLor:SCHeme  HCOPy:MENU  HCOPy:DATA?
-```
-
-实现使用仪器支持的短写形式。这里按手册长写形式归一化，便于审计；它不是原始通信日志。
-
-## WaveBench 核心已覆盖但不属于仪器 SCPI 的能力
-
-- 采集前读取 coupling，并默认拒绝可能为 50 Ω 的 `AC` / `DC`；只有显式 opt-in 才允许继续。`ACL` / `DCL` 作为高阻路径接受。
-- 将采集结果原子化落盘为 CSV、NPY、metadata、截图和脱敏命令日志；失败时保留失败元数据及已经生成的证据。
-- 通过 capability 检查、受限外置插件覆盖槽位和卸载 fallback，确保未实现能力不会因为安装插件而被错误宣称。
-- `AUToscale` 始终是显式动作，不会由 capture 隐式触发并改变前面板状态。
-
-这些能力提高了实验安全性和可追溯性，但不应计入 RTM2000 手册命令覆盖率。
-
-## 建议路线
-
-### P1：把采集 MVP 补成可诊断的基础示波器驱动
-
-1. `identity/options/health` 只读快照：`*OPT?`、acquisition 和非消费型 status 条件。**已完成。**
-2. RTM2032 CH1/CH2 类型化模拟通道、时基和探头状态。**基础字段已完成并实机验证。**
-3. 基础 edge trigger：严格只读快照与 CH2 source/type/mode/slope/coupling/level 最小受控闭环已完成；不隐式调用 find level，生产 setter 不伪装拥有持久恢复 journal。
-4. 仪器自动测量只读结果与统计；与主机侧 DSP 结果明确区分来源。**调用方确认已配置的槽位已完成实机验收；STOP 状态 buffer 仍待验收。**
-5. 波形缩放与形状元数据。**已完成并实机验证。** `DATA:HEADER?` 第四字段是每个 sample interval 的值数量，不是 segment ID；segment/history identity 必须走独立 history/timestamp 路径。
-
-### P2：扩展分析与特殊采集
-
-- average/segmented acquisition、history/timestamp；**average 受控事务已实现但尚待独立实机验收，segmented 仍未实现；K15 timestamp table 查询 timeout**；
-- math/FFT/reference waveform；**math metadata 与 FFT status 实机通过，reference metadata 等待有效的既有 reference**；
-- cursor、DVM、counter；**vertical cursor readout 实机通过，DVM/counter 未覆盖**；
-- probe 身份和衰减/阻抗只读安全联动。
-
-### P3：按选件拆分的高级应用
-
-- spectrum/spectrogram；
-- digital/MSO 和各类 bus decode；
-- protocol trigger/search；
-- mask test；
-- power analysis。
-
-这些功能不应通过一个「raw SCPI」入口绕过 capability、选件探测、状态恢复和权限边界。
-
-## 明确不计入缺陷的边界
-
-- 手册命令索引覆盖多个 RTM2000 型号、固件和选件；未实现选件命令不等同于基础驱动缺陷。
-- WaveBench 主机侧 CSV/NPY/PNG artifact 已覆盖实验结果落盘，但不等同于仪器 `MMEMory`/`EXPort` 文件系统能力。
-- 主机侧 DSP 可做 FFT/THD 等分析，但不等同于仪器 `CALCulate:MATH:FFT`、`SPECtrum` 或 `POWer` 应用结果。
-- setup blob 恢复是验收安全机制，不应因为手册有 `SYSTem:SET` 就直接成为生产配置 API。
-- 「一次 acquisition 后逐通道读取」不等同于新增或证明跨通道硬件同步保证。
-
-## 证据边界
-
-- 手册侧：本地保存的 RTM2000 编程手册命令索引，仅用于内部审计，不进入发行包。
-- 实现侧：`driver.py` 和 `descriptor.py` 的当前外置插件实现，以及 WaveBench 内建 fallback 和 ScopeService。
-- 实机侧：以 RTM2032 作为 RTM2000 系列代表性基线，覆盖 `DEF/MAX/DMAX`、双通道单次采集、autoscale、coupling、CH2 显示事务、多目标 focus 的时基/Vdiv/隐藏其他通道与完整恢复、截图、重复采集、已配置槽测量统计、math/FFT metadata、vertical cursor readout，以及 B1 门控的 D0–D15 数字通道标量状态查询；本轮也保留 history timestamp timeout 与空 reference 存储的负向证据。代表性验收不要求逐型号重复上机，也不表示 profile 的全部边界值均已逐点测试。
-- 只有明确的受控探测与状态恢复检查才能标为实机通过；不会仅因代码存在而升级状态。
+本页将 RTM2000 编程手册的功能域映射到外置 `wavebench-rohde-schwarz-rtm2000` 插件当前
+公开的 WaveBench capability。当前包版本、依赖和入口点以 [包元数据](../pyproject.toml)为准，
+型号、backend、配置字段和 capability 以
+[production descriptor](../src/wavebench_rohde_schwarz_rtm2000/descriptor.py) 为准，profile
+边界以 [profiles](../src/wavebench_rohde_schwarz_rtm2000/profiles.py) 为准，精确 SCPI 与运行
+行为以 [driver](../src/wavebench_rohde_schwarz_rtm2000/driver.py) 为准。
+
+[功能覆盖开发路线](RTM2000_COVERAGE_MILESTONES.md)记录后续顺序和退出门；
+[开发与验收存档](archive/RTM2000_README_0.15.md)保存特定版本、设备和时间点的实机与负向证据。
+它们用于追溯，不会独立增加当前 capability。
+
+## 范围
+
+本地 RTM2000 编程手册索引覆盖多个型号、固件和选件，并包含少量重复与 OCR 异常。本矩阵按
+功能域说明当前公开面，不用命令条目数量计算完成率。手册命令、driver 方法或一次实机成功均不
+替代 production descriptor 声明。
+
+`rohde-schwarz.rtm2032` 是外置插件的 canonical driver ID；短 alias `rtm2032` 属于 Core
+fallback。外置插件是有界波形采集、只读状态／分析和受控视图配置实现，不是通用 RTM2000
+远程控制层。
+
+## 功能覆盖
+
+| 功能域 | 手册命令面 | 当前公开 capability | 当前边界 |
+|---|---|---|---|
+| 身份、错误与健康 | IEEE 488.2、`SYSTem:ERRor:*`、status condition | `scope.idn`、`scope.errors`、`scope.snapshot`、`scope.snapshot_v2` | Snapshot V2 只保证 profile 中的 identity 字段；EVENT 和错误队列具有消费语义，不作为隐式 health 读取。 |
+| Autoscale | `AUToscale` | `scope.autoscale` | 显式动作，会改变垂直、时基和触发；不会由 capture 隐式执行。 |
+| Acquisition 状态 | mode、average、sample／record rate、segmented、available/count | `scope.acquisition_status` | 只读当前状态；选件相关字段先门控，不从计数或 OPC 推导未定义的完成语义。 |
+| Average acquisition | average count、single count、channel arithmetic、`SINGle` | `scope.capture_average` | 调用方必须确认 acquisition 已停止；事务仅改动限定字段并恢复，结果不明会锁停对应写入。 |
+| 模拟通道输入 | coupling、termination、range、scale、offset、position、bandwidth、probe | `scope.channel_coupling`、`scope.channel_input_state_v2`、`scope.snapshot` | V2 只映射 coupling／termination，数值 impedance 可为 unavailable；高阻安全策略由 Core 执行。 |
+| 通道显示 | channel state | `scope.channel_display_configure_v2` | profile 只允许 CH1／CH2；Core 管理 baseline、回读、恢复与验证，插件只执行受控显示写入。 |
+| 多通道 focus | time range、channel display、V/div | `scope.focus_configure_v2` | 只接受 profile 范围内的 CH1／CH2 和时基／垂直请求；不配置 position、offset、coupling、termination 或 bandwidth。 |
+| 模拟波形 | REAL/LSBF、header、data、`DEF/MAX/DMAX` | `scope.fetch_waveform`、`scope.capture_waveform`、`scope.capture_waveforms` | 单次 acquisition 后逐通道读取，不新增跨通道硬件同步保证；长记录使用独立 timeout。 |
+| 波形 metadata | X/Y scaling、point count、quantization、values per sample | `scope.snapshot` | Header 第四字段表示每个 sample interval 的值数量，不作为 segment ID。 |
+| Timebase 与 history | range、position、zoom、history timestamp | `scope.snapshot`、`scope.history_timestamps`、`scope.focus_configure_v2` | History 先门控 K15；frame number 不替代 timestamp，timeout 后不盲目重试或清错。Zoom 未公开。 |
+| Trigger | edge 与其他 trigger families | `scope.snapshot` 只读当前基础 edge 状态；capture 沿用已有设置 | Production descriptor 不声明通用 trigger 配置 capability；driver 专用方法不能当作当前 WaveBench capability。 |
+| 测量统计 | slot、source、actual、聚合值、buffer | `scope.measurement_statistics`、`scope.measurement_statistics_v2` | 只读取调用方确认已配置的槽位；V2 限定 1–4 号且不支持 buffer，不配置或复位槽位。 |
+| Cursor | X/Y、delta、ratio、tracking | `scope.cursor_readout` | 只读取调用方确认已配置的 cursor；不提供生产配置或定位 API。 |
+| Math 与 FFT | expression、metadata、FFT state／RBW | `scope.math_metadata`、`scope.fft_status`、`scope.fft_status_v2` | V2 只返回 profile 中的字段；不配置 expression，不将主机 DSP 当作仪器 FFT 能力。 |
+| Reference curve | source、state、scale、data、save/load | `scope.reference_metadata` | 只读取已有 reference；不执行 update／save／load，也不下载 payload。 |
+| Digital／MSO | D0–D15 state、threshold、deskew、data | `scope.digital_status`、`scope.digital_status_v2`、`scope.digital_waveform` | 先门控 B1。Waveform 只读取已停止且满足格式前置条件的记录，不配置阈值、显示或传输格式。 |
+| Spectrum、spectrogram | spectrum data、axis、RBW、marker、history | 未公开 | 属于选件相关分析应用，需要独立模型。 |
+| Search、mask、protocol decode／trigger | result、navigation、action、bus configuration | 未公开 | 依赖选件、输入模型、恢复和结果合同；不通过 raw SCPI 绕过。 |
+| DVM 与 counter | source、type、result、state | 未公开 | 缺少已声明的类型化 capability 与选件边界。 |
+| Display 与截图 | display state、hardcopy | `scope.screenshot`、`scope.channel_display_configure_v2`、`scope.focus_configure_v2` | Screenshot 返回 PNG；未公开 grid、palette、persistence、XY、virtual screen 或 printer 设置。 |
+| 仪器文件系统与导出 | `MMEMory`、instrument-side export | 未公开 | WaveBench 主机侧 artifact 不等于仪器文件系统；路径与持久写入默认拒绝。 |
+| Setup 保存／恢复 | `SYSTem:SET`、state store/load | 未公开 | Setup blob 只属于验收恢复工具，不是 production 配置 API。 |
+| Power analysis | quality、harmonics、ripple、switching、SOA 等 | 未公开 | 属于需要专用探头、deskew、选件和结果模型的独立应用域。 |
+| Calibration、reset 与全局系统设置 | calibration、`*RST`、preset、clock、language、network | 未公开 | 会改变全局或持久状态，只能进入另行授权的维护流程。 |
+
+## 协议与安全边界
+
+- Driver 使用仪器支持的短写 SCPI；上表只按手册功能域建立索引。完整实际命令以
+  [driver](../src/wavebench_rohde_schwarz_rtm2000/driver.py) 为准，不在本文维护第二份白名单。
+- `DEF`、`MAX` 和 `DMAX` 原样传给设备；长波形读取使用 descriptor 配置的独立 timeout，
+  失败的读取不会自动重放。
+- Capture 前读取 coupling；Core 默认拒绝可能为 50 Ω 的 `AC`／`DC`，只有显式 opt-in
+  才能继续，`ACL`／`DCL` 作为高阻路径。
+- `scope.channel_display_configure_v2` 与 `scope.focus_configure_v2` 的通道、数值范围、步骤预算
+  和恢复顺序由 [profiles](../src/wavebench_rohde_schwarz_rtm2000/profiles.py) 定义。
+- Host-side CSV／NPY／PNG artifact、DSP 分析和验收 setup 恢复不属于 RTM2000 SCPI capability。
+
+## 相关来源
+
+- [Production descriptor](../src/wavebench_rohde_schwarz_rtm2000/descriptor.py)
+- [Descriptor profiles](../src/wavebench_rohde_schwarz_rtm2000/profiles.py)
+- [Driver implementation](../src/wavebench_rohde_schwarz_rtm2000/driver.py)
+- [功能覆盖开发路线](RTM2000_COVERAGE_MILESTONES.md)
+- [0.1.0–0.15.0 开发与验收存档](archive/RTM2000_README_0.15.md)
diff --git a/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX_EN.md b/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX_EN.md
index 917fe34..a7a6f66 100644
--- a/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX_EN.md
+++ b/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MATRIX_EN.md
@@ -1,120 +1,78 @@
-# RTM2000 manual feature coverage matrix
+# RTM2000 Manual Feature-Coverage Matrix
 
 [中文](RTM2000_COVERAGE_MATRIX.md)
 
-## Purpose and counting method
-
-This matrix compares the locally stored RTM2000 programming-manual command index with the WaveBench external RTM2000 plugin, the bundled fallback, and recorded RTM2032 hardware acceptance. It separates manual claims, implemented product behavior, and hardware evidence; a command listed for the RTM2000 family is not assumed to be installed or supported on the current RTM2032.
-
-The selected manual transcription has 1,490 lines containing 1,434 command-index entries and 1,417 exact unique command templates: 608 query-marked forms and 809 non-query forms. Further case-insensitive, whitespace-normalized parsing yields 1,416 templates (607 query-marked and 809 non-query); the final difference is one repeated/layout variant. These figures still include parameterized templates and a small number of OCR defects. They describe command-surface scale and are not a feature-completion denominator.
-
-The external plugin currently declares twenty-six WaveBench capabilities: five read-only Scope V2 capabilities added in 0.13.0, controlled channel display added in 0.14.0, and a multi-channel joint view added in 0.15.0. It is an analog-waveform acquisition MVP with representative hardware acceptance, narrow read-only status and analysis surfaces, controlled view configuration, and one controlled average-acquisition transaction, not a general RTM2000 remote-control layer.
-
-Coverage labels:
-
-- **Hardware accepted**: implemented and offline-tested with controlled RTM2032 evidence.
-- **Implemented**: code and offline tests exist, without a separate hardware conclusion for that detail.
-- **Partial**: only a narrow subset of the manual family is covered.
-- **Not covered**: no corresponding external-plugin, bundled-fallback, or generic ScopeService API.
-- **Acceptance-tool only**: reserved for experiment restoration/acceptance rather than production driver use.
-- **Option/model gated**: identity and installed options must be checked before exposure.
-
-## Feature matrix
-
-| Feature domain | Manual surface | Current coverage | Hardware state | Main gap | Recommendation |
-|---|---|---|---|---|---|
-| Identity, synchronization, basic errors | IEEE 488.2 common commands and `SYSTem:ERRor:*` | `*IDN?`, `*OPT?`, non-consuming health snapshot, five-field identity `scope.snapshot_v2`, `*CLS`, `*OPC?` wait, explicit error queue | **Hardware accepted**: CH1/CH2 Snapshot V2 read-only acceptance passed | No self-test or complete event-register API | Identity/options/health P1 complete; keep EVENT reads explicit |
-| Acquisition control | 16 templates for modes, averaging, sample/record rates, interpolation, segmented acquisition, and availability | Read-only available/count/sample-rate plus average/segmented status, `SINGle` acquisition, explicit `AUToscale`, and controlled `scope.capture_average` | **Read-only status hardware accepted; average transaction implemented, pending independent hardware acceptance** | No run/stop, segmented acquisition, write-rate, or interpolation API | Keep explicit stopped confirmation, readback restoration, and latching for average; **P2** segmented plans |
-| Analog channel setup | About 48 templates for state, coupling, range, scale, offset, position, bandwidth, polarity, skew, label, overload, and thresholds | Typed read-only RTM2032 CH1/CH2 state and `scope.channel_input_state_v2`; V2 maps only coupling/termination and marks numeric impedance unavailable; `scope.channel_display_configure_v2` provides a single-channel display transaction, while `scope.focus_configure_v2` adds multi-target display, per-channel V/div, a complete joint baseline, and failure restoration | **Hardware accepted**: CH1/CH2 V2 input state, the CH2 `ON→OFF→ON` display transaction, and representative CH1-hide plus CH2 0.2→0.4 V/div focus/restoration acceptance passed | No threshold readback; focus does not configure position, offset, coupling, termination, or bandwidth; profile boundary values were not exercised point by point | View configuration P1 complete; retain impedance and restoration guards for other writes |
-| Analog waveform transfer | `CHANnel<m>:DATA*`, envelope data, independent X/Y metadata | REAL/LSBF, header + data, `DEF/MAX/DMAX`, sequential channel reads after one acquisition, and typed X/Y scaling, point-count, quantization, and values-per-sample snapshots | **Hardware accepted** | No envelope, history/segment selection, or streaming-block API; no added cross-channel hardware-synchronization guarantee | Metadata complete; **P2** segmented/history/envelope |
-| Timebase, zoom, timestamp | 12 timebase templates plus zoom and timestamp navigation | Typed read-only acquisition time/divisions/position/range/reference/scale/roll; `scope.focus_configure_v2` can set time range while protecting time position in the baseline; K15-gated strict history timestamp-table API | **Basic timebase and representative focus hardware acceptance passed; history timestamp query blocked by instrument timeout** | No zoom; profile timebase boundaries were not exercised point by point; no successful timestamp-table hardware evidence | Keep the plugin-side timebase guard and strict K15 gate; do not retry or clear errors implicitly |
-| Trigger system | About 159 templates for A/B, edge, width, runt, rise time, pattern, TV, holdoff, external, protocol, and trigger out | Typed read-only basic edge-trigger snapshot for CH1/CH2; vendor-specific controlled RTM2032 CH2 `EDGE/AUTO/POS/DC/level` setter; single capture reuses front-panel state | **Read-only and CH2 write/restore hardware accepted** | Setter accepts only healthy, high-impedance, non-overloaded CH2 and an in-range level; no automatic restoration journal, other trigger types, B trigger, or output | P1 complete; keep restoration responsibility explicit and design a separate transaction model before broader writes |
-| Automatic measurements/statistics | 20 templates for slots, source/main, actual, peaks, mean, standard deviation, and waveform count | `scope.measurement_statistics` and `scope.measurement_statistics_v2`; V2 reads only caller-confirmed preconfigured slots 1-4, supports no buffer, and requires complete finite aggregates | **Existing configured-slot path hardware accepted; V2 adapter offline verified** for CH2 frequency actual/average/min/max/stddev/count; unconfigured-slot timeout remains a negative boundary | Stopped-acquisition buffer read is not hardware accepted and is outside the V2 profile | Keep caller confirmation mandatory; require stopped confirmation for buffer reads; never configure/reset slots or consume the error queue in this API |
-| Cursors | About 27 templates for X/Y, delta, ratio, tracking, and results | `scope.cursor_readout` for explicitly preconfigured cursor state | **Vertical delta hardware accepted**; other cursor functions remain offline-tested | No production cursor setup or position writes | Readout is complete for the narrow capability; keep placement as a separate controlled action |
-| Math and FFT | About 51 templates for expression, math/envelope data, window, span, and RBW | `scope.math_metadata`, guarded `scope.fft_status`, `scope.fft_status_v2` limited to average complete/RBW/sample rate, and `scope.reference_metadata` for existing state | **Existing math metadata and FFT status hardware accepted; V2 adapter offline verified**; reference metadata blocked because the instrument had no valid stored reference | No payload read, production expression setup, or reference update/save/load | Keep stateful configuration separate, preserve reference storage, and keep host DSP distinct |
-| Spectrum/spectrogram | 107 templates for spectrum waveforms, frequency axis, RBW, markers, history, and spectrogram | Not covered | None | Complete spectrum-analysis application absent | **P3, option gated** with a separate capability |
-| Search | About 119 templates for edge/width/runt/pattern, result lists, and protocol search | Not covered | None | No search plan, results, or navigation | **P3**, after history/trigger/protocol models mature |
-| Mask test | About 36 templates for mask data, counts, actions, save/load | Not covered | None | No mask lifecycle, violation model, or action safety policy | **P3**; separate read-only results from destructive actions |
-| Digital/MSO channels | About 33 templates for digital data, thresholds, technology, deskew, and history | B1-gated `scope.digital_status` and `scope.digital_status_v2`; V2 marks threshold scope and timing calibration unavailable; `scope.digital_waveform` reads each Dn under the existing ASCII format (manual `ASC,0`, RTM2032 readback `CSV,0`) and host-packs uint16 | **Scalar status hardware accepted**: existing D0-D15 and CLI acceptance remains valid, and D0 V2 read-only acceptance passed; digital waveform passed FakeTransport, while hardware read-only preflight passed B1/format gating but stopped before `DATA?` because D0 was hidden and reported zero points | Digital waveform payload hardware acceptance is pending; no configuration writes, history, or bus decode; no electrical-input acceptance | Run zero-write payload/axis-consistency acceptance against a stable stopped record; treat electrical acceptance separately |
-| Serial/parallel bus decoding | About 249 templates for I²C, SPI/SSPI, UART, CAN, LIN, I²S, ARINC, MIL-STD, parallel buses, and frame results | Not covered | None | No bus setup, frame list, field parser, or history model | **P3, split by option**; do not fold into the basic scope capability |
-| Protocol trigger/search | Large protocol subsets under trigger and search | Not covered | None | Depends on bus sources, thresholds, protocol format, and options | **P3**, after read-only bus decode |
-| DVM and frequency counter | Six DVM and three counter templates | Not covered | None | No source/type/result/status API | **P2, option gated**, suitable for small read-only capabilities |
-| Probe metadata/setup | About 18 templates for identity, attenuation, bandwidth, impedance, offset, and mode | Read-only RTM2032 CH1/CH2 attenuation, bandwidth, capacitance, impedance, name, and type | **Hardware accepted** | No probe ID fields, DC offset, mode, or safety-limit integration | Basic P1 complete; add identity/safety integration later and defer writes |
-| Reference curves | About 19 templates for source/save/load/state, scaling, and data | Read-only `scope.reference_metadata` for an existing stored reference | **Implemented; hardware blocked by empty reference storage** (`DATA:HEADer?` reported zero points and later metadata queries timed out) | No safe test fixture without overwriting internal reference storage; no data payload or state management | Wait for a user-created reference; do not call `UPDATE`, save, or load merely to manufacture acceptance evidence |
-| Display and screenshot | 24 display plus eight hardcopy templates | CH1/CH2 `scope.channel_display_configure_v2`; `scope.focus_configure_v2` can select multiple target channels and hide other analog channels; PNG, color scheme, menu inclusion | **Hardware accepted**: single-channel display and focus target/restored states passed fresh readback, followed by a new read-only session that confirmed the complete baseline | No grid, palette, persistence, XY, virtual-screen, page, or printer setup | Channel display, joint view, and screenshot satisfy the MVP; others **P3** |
-| Instrument filesystem/export | 16 `MMEMory` templates plus waveform, measurement, search, and power export | Not covered; WaveBench saves host-side artifacts only | None | No instrument filesystem or report export | **Out of default scope**; require a path sandbox and separate permission |
-| Setup snapshot/restoration | `SYSTem:SET`, `MMEMory:STORE/LOAD:STATE` | Not exposed by production driver; setup blob used by acceptance tooling | **Acceptance path passed** | SocketIO setup writes were once partial; reliable restoration uses controlled VXI-11 chunks | Keep **acceptance-tool only** |
-| Status registers/health | Operation/questionable/status-byte, overload, mask, limit status | Non-consuming health snapshot plus channel-overload readback | **Hardware accepted** | No mask/limit aggregation or event-register API | Basic P1 complete; keep EVENT reads explicit and consuming |
-| Power analysis | About 358 templates for quality, harmonics, ripple, switching, SOA, efficiency, inrush, and modulation | Not covered | None | Separate application domain with probes, deskew, reports, and many result types | **P3, option gated, separate capability/package** |
-| Calibration, reset, system settings | Calibration, `*RST`, preset, clock, language, beeper, education mode | Not covered | None | Global mutation and manual-recovery risk | **Denied by default** or explicit acceptance-tool authorization only |
-
-## Directly covered SCPI surface
-
-The external driver mainly uses the following equivalent command families:
-
-```text
-*IDN?  *CLS  *OPC?
-SYSTem:ERRor[:NEXT]?
-AUToscale  SINGle
-TIMebase:RANGe[?]  TIMebase:POSition[?]
-CHANnel<n>:STATE[?]  CHANnel<n>:COUPling?
-CHANnel<n>:RANGe?  CHANnel<n>:SCALe[?]
-CHANnel<n>:POSition[?]  CHANnel<n>:OFFSet[?]
-FORMat[:DATA]  FORMat:BORder
-CHANnel:DATA:POINTs
-CHANnel<n>:DATA:HEADer?  CHANnel<n>:DATA?
-HCOPy:LANGuage  HCOPy:COLor:SCHeme  HCOPy:MENU  HCOPy:DATA?
-```
-
-The implementation uses supported short forms. This list normalizes them to manual-style long forms for auditing and is not a raw communication log.
-
-## WaveBench core coverage outside instrument SCPI
-
-- Reads coupling before capture and rejects potentially 50 Ω `AC` / `DC` by default; continuation requires explicit opt-in. `ACL` / `DCL` are accepted as high-impedance paths.
-- Atomically records capture artifacts as CSV, NPY, metadata, screenshots, and sanitized command logs; failure metadata and already-produced evidence are retained.
-- Uses capability checks, a restricted external-plugin override slot, and uninstall fallback so plugin installation cannot falsely advertise unimplemented features.
-- Keeps `AUToscale` explicit rather than silently changing front-panel state during capture.
-
-These improve experiment safety and traceability but do not count as RTM2000 manual-command coverage.
-
-## Recommended roadmap
-
-### P1: turn the capture MVP into a diagnosable basic scope driver
-
-1. Read-only `identity/options/health` snapshot covering `*OPT?`, acquisition, and non-consuming status conditions. **Complete.**
-2. Typed RTM2032 CH1/CH2 analog-channel, timebase, and probe state. **Basic fields complete and hardware accepted.**
-3. Basic edge trigger: the strict read-only snapshot and minimal controlled CH2 source/type/mode/slope/coupling/level loop are complete. It does not call find-level implicitly, and the production setter does not pretend to own a persistent restoration journal.
-4. Read-only automatic measurement results/statistics, clearly distinguished from host-side DSP. **Caller-confirmed configured-slot statistics are hardware accepted; stopped-acquisition buffer read remains pending.**
-5. Waveform scaling and shape metadata. **Complete and hardware accepted.** `DATA:HEADER?` field four is values per sample interval, not a segment ID; segment/history identity requires a separate history/timestamp path.
-
-### P2: analysis and specialized acquisition
-
-- average/segmented acquisition and history/timestamps; **the controlled average transaction is implemented but awaits independent hardware acceptance; segmented acquisition remains deferred; the K15 timestamp-table query timed out and remains blocked**;
-- math/FFT/reference waveforms; **math metadata and FFT status are hardware accepted; reference metadata awaits a valid pre-existing reference**;
-- cursor, DVM, and counter results; **vertical cursor readout is hardware accepted; DVM/counter remain uncovered**;
-- read-only probe identity and attenuation/impedance safety integration.
-
-### P3: option-specific applications
-
-- spectrum/spectrogram;
-- digital/MSO and bus decode;
-- protocol trigger/search;
-- mask testing;
-- power analysis.
-
-These domains must not be bypassed through a generic raw-SCPI entry point. They need capability contracts, option detection, restoration policy, and explicit permissions.
-
-## Boundaries that are not defects
-
-- The index spans multiple RTM2000 models, firmware revisions, and options. Missing option commands are not automatically basic-driver defects.
-- WaveBench host-side CSV/NPY/PNG artifacts do not constitute instrument-side `MMEMory`/`EXPort` support.
-- Host DSP may compute FFT/THD but does not constitute instrument `CALCulate:MATH:FFT`, `SPECtrum`, or `POWer` result support.
-- Setup-blob restoration is an acceptance safety mechanism and should not become a production configuration API merely because the manual lists `SYSTem:SET`.
-- Sequential channel reads after one acquisition do not add or prove a cross-channel hardware-synchronization guarantee.
-
-## Evidence boundary
-
-- Manual side: a locally stored RTM2000 programming-manual command index used only for internal auditing and excluded from distributions.
-- Implementation side: current external `driver.py`/`descriptor.py`, the WaveBench bundled fallback, and ScopeService.
-- Hardware side: RTM2032 is the representative RTM2000-series baseline for `DEF/MAX/DMAX`, dual-channel single acquisition, autoscale, coupling, the CH2 display transaction, multi-target focus timebase/Vdiv/hide-other behavior with complete restoration, screenshot, repeat capture, configured-slot measurement statistics, math/FFT metadata, vertical cursor readout, and B1-gated D0-D15 digital scalar-status queries. The latest session also records negative evidence for history timestamps and empty reference storage. Representative acceptance does not require per-model repetition and does not mean every profile boundary value was exercised point by point.
-- Hardware labels require an explicit controlled probe and state-restoration check; code presence alone is never promoted to hardware acceptance.
+This page maps RTM2000 programming-manual domains to the WaveBench capabilities currently exposed
+by the external `wavebench-rohde-schwarz-rtm2000` plugin. The [package metadata](../pyproject.toml)
+is authoritative for version, dependencies, and entry point; the
+[production descriptor](../src/wavebench_rohde_schwarz_rtm2000/descriptor.py) for models, backends,
+configuration fields, and capabilities; [profiles](../src/wavebench_rohde_schwarz_rtm2000/profiles.py)
+for request boundaries; and the [driver](../src/wavebench_rohde_schwarz_rtm2000/driver.py) for exact
+SCPI and runtime behavior.
+
+The [feature-coverage development roadmap](RTM2000_COVERAGE_MILESTONES_EN.md) records future order
+and exit gates. The [development and acceptance archive](archive/RTM2000_README_0.15_EN.md) retains
+hardware and negative evidence for particular versions, devices, and dates. Those records support
+traceability and do not independently add a current capability.
+
+## Scope
+
+The local RTM2000 programming-manual index spans multiple models, firmware revisions, and options
+and contains a small number of duplicates and OCR defects. This matrix reports the current public
+surface by functional domain rather than treating command counts as completion. A manual command,
+driver method, or one successful hardware run cannot replace a production-descriptor declaration.
+
+`rohde-schwarz.rtm2032` is the external plugin's canonical driver ID. The short `rtm2032` alias
+belongs to the Core fallback. The external plugin provides bounded waveform acquisition, query-only
+state/analysis, and controlled view configuration; it is not a general RTM2000 remote-control layer.
+
+## Functional coverage
+
+| Domain | Manual surface | Current public capability | Current boundary |
+|---|---|---|---|
+| Identity, errors, health | IEEE 488.2, `SYSTem:ERRor:*`, status conditions | `scope.idn`, `scope.errors`, `scope.snapshot`, `scope.snapshot_v2` | Snapshot V2 guarantees only identity fields in its profile. EVENT and error-queue reads are consuming and are not implicit health reads. |
+| Autoscale | `AUToscale` | `scope.autoscale` | Explicit action that mutates vertical, timebase, and trigger state; capture never invokes it implicitly. |
+| Acquisition state | mode, average, sample/record rate, segmented, available/count | `scope.acquisition_status` | Reads existing state. Option-dependent fields are gated, and undefined completion is not inferred from counts or OPC. |
+| Average acquisition | average count, single count, channel arithmetic, `SINGle` | `scope.capture_average` | Caller confirms stopped acquisition. The transaction changes only bounded fields and restores them; unknown outcome latches the write path. |
+| Analog input | coupling, termination, range, scale, offset, position, bandwidth, probe | `scope.channel_coupling`, `scope.channel_input_state_v2`, `scope.snapshot` | V2 maps coupling/termination and may leave numeric impedance unavailable. Core enforces the high-impedance policy. |
+| Channel display | channel state | `scope.channel_display_configure_v2` | Profile permits CH1/CH2 only. Core owns baseline, readback, restoration, and verification; the plugin performs the controlled display write. |
+| Multi-channel focus | time range, channel display, V/div | `scope.focus_configure_v2` | Accepts CH1/CH2 and timebase/vertical requests within the profile. It does not configure position, offset, coupling, termination, or bandwidth. |
+| Analog waveform | REAL/LSBF, header, data, `DEF/MAX/DMAX` | `scope.fetch_waveform`, `scope.capture_waveform`, `scope.capture_waveforms` | Reads channels sequentially after one acquisition and adds no cross-channel hardware-synchronization guarantee. Long records use a separate timeout. |
+| Waveform metadata | X/Y scaling, point count, quantization, values per sample | `scope.snapshot` | Header field four is values per sample interval, not a segment ID. |
+| Timebase and history | range, position, zoom, history timestamp | `scope.snapshot`, `scope.history_timestamps`, `scope.focus_configure_v2` | History is K15-gated. Frame numbers do not substitute for timestamps, and timeout is not blindly retried or cleared. Zoom is not public. |
+| Trigger | edge and other trigger families | `scope.snapshot` reads current basic edge state; capture reuses existing settings | The production descriptor declares no generic trigger-configuration capability. Driver-specific methods are not current WaveBench capabilities. |
+| Measurement statistics | slot, source, actual, aggregates, buffer | `scope.measurement_statistics`, `scope.measurement_statistics_v2` | Reads caller-confirmed preconfigured slots. V2 permits slots 1–4 and no buffer; it never configures or resets slots. |
+| Cursor | X/Y, delta, ratio, tracking | `scope.cursor_readout` | Reads caller-confirmed preconfigured cursor state; no production setup or positioning API. |
+| Math and FFT | expression, metadata, FFT state/RBW | `scope.math_metadata`, `scope.fft_status`, `scope.fft_status_v2` | V2 returns only profile fields. It does not configure expressions or treat host DSP as instrument FFT capability. |
+| Reference curve | source, state, scale, data, save/load | `scope.reference_metadata` | Reads an existing reference only; it does not update/save/load or fetch the payload. |
+| Digital/MSO | D0-D15 state, threshold, deskew, data | `scope.digital_status`, `scope.digital_status_v2`, `scope.digital_waveform` | Checks B1 first. Waveform reads require a stopped record and compatible existing format and do not configure threshold, display, or transfer format. |
+| Spectrum/spectrogram | spectrum data, axis, RBW, marker, history | Not public | Option-dependent analysis application requiring an independent model. |
+| Search, mask, protocol decode/trigger | results, navigation, actions, bus configuration | Not public | Depend on options, input models, restoration, and result contracts; raw SCPI does not bypass them. |
+| DVM and counter | source, type, result, state | Not public | No declared typed capability or option boundary exists. |
+| Display and screenshot | display state, hardcopy | `scope.screenshot`, `scope.channel_display_configure_v2`, `scope.focus_configure_v2` | Screenshot returns PNG. Grid, palette, persistence, XY, virtual-screen, and printer setup are not public. |
+| Instrument filesystem/export | `MMEMory`, instrument-side export | Not public | Host-side WaveBench artifacts are not instrument filesystem support. Paths and persistent writes are denied by default. |
+| Setup save/restore | `SYSTem:SET`, state store/load | Not public | Setup blobs belong to acceptance restoration tooling, not the production configuration API. |
+| Power analysis | quality, harmonics, ripple, switching, SOA, and related domains | Not public | Independent application area requiring probes, deskew, options, and result models. |
+| Calibration, reset, global setup | calibration, `*RST`, preset, clock, language, network | Not public | Global/persistent mutation belongs only in separately authorized maintenance workflows. |
+
+## Protocol and safety boundaries
+
+- The driver uses supported abbreviated SCPI. The table indexes manual domains; the
+  [driver](../src/wavebench_rohde_schwarz_rtm2000/driver.py) is the complete source for actual
+  commands, avoiding a second manually maintained allowlist here.
+- `DEF`, `MAX`, and `DMAX` are passed through to the device. Long waveform reads use the descriptor
+  option's separate timeout, and failed reads are not replayed automatically.
+- Capture reads coupling first. Core rejects potentially 50-ohm `AC`/`DC` by default; continuation
+  requires explicit opt-in, while `ACL`/`DCL` are high-impedance paths.
+- Channel-display and focus channels, numeric ranges, step budgets, and restoration order are defined
+  by [profiles](../src/wavebench_rohde_schwarz_rtm2000/profiles.py).
+- Host-side CSV/NPY/PNG artifacts, DSP analysis, and acceptance setup restoration are not RTM2000
+  SCPI capabilities.
+
+## Related sources
+
+- [Production descriptor](../src/wavebench_rohde_schwarz_rtm2000/descriptor.py)
+- [Descriptor profiles](../src/wavebench_rohde_schwarz_rtm2000/profiles.py)
+- [Driver implementation](../src/wavebench_rohde_schwarz_rtm2000/driver.py)
+- [Feature-coverage development roadmap](RTM2000_COVERAGE_MILESTONES_EN.md)
+- [0.1.0–0.15.0 development and acceptance archive](archive/RTM2000_README_0.15_EN.md)
diff --git a/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MILESTONES.md b/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MILESTONES.md
new file mode 100644
index 0000000..0841574
--- /dev/null
+++ b/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MILESTONES.md
@@ -0,0 +1,68 @@
+# RTM2000 功能覆盖开发路线
+
+[English](RTM2000_COVERAGE_MILESTONES_EN.md)
+
+> 类型：Development
+
+本页记录 RTM2000 插件的后续开发顺序、当前阻塞项和新 capability 的退出门。它不维护当前
+capability 清单，也不替代特定设备和版本的验收记录。当前能力以
+[production descriptor](../src/wavebench_rohde_schwarz_rtm2000/descriptor.py) 为准；手册域与
+当前能力的映射见[功能覆盖矩阵](RTM2000_COVERAGE_MATRIX.md)；既有实机结果与负向证据见
+[开发与验收存档](archive/RTM2000_README_0.15.md)。
+
+## 共同规则
+
+- 新能力必须先有可准确表达的 Core typed model，再进入插件 descriptor。
+- 选件相关能力先核对 identity 和 option，再发送专用 query；未安装选件不作为插件缺陷。
+- 只读方法、Python 方法或手册命令存在，不等于 production capability。
+- 写入、采集和触发不能盲目重试；状态无法确认时必须失败，并按对应事务合同锁停。
+- setup blob、持久存储、网络设置和全局维护命令不作为普通 capability。
+- 实机验收只证明记录中的型号、固件、transport 和步骤，不外推整个 RTM2000 系列。
+
+## P1：基础示波器与诊断能力
+
+| 工作项 | 当前开发状态 | 下一退出门 |
+|---|---|---|
+| Identity、options 与非消费型 health | 已实现 | 新字段仍需证明不会读取消费型 EVENT 或错误队列。 |
+| CH1／CH2 模拟通道、时基与 probe metadata | 已实现 | 新字段需要严格解析、型号边界和只读实机证据。 |
+| Edge trigger | 只读状态与 CH2 最小受控配置已实现 | 扩展 source／type 前先建立完整事务、恢复责任和型号门控。 |
+| 自动测量统计 | 已实现已配置槽位的只读接口 | Buffer 读取需要独立 stopped 前置条件与实机验收。 |
+| 波形缩放与形状 metadata | 已实现 | Segment／history identity 必须使用独立模型，不能复用 header 第四字段。 |
+| 通道显示与多通道 focus | 已实现受控 V2 配置 | 扩展 position、offset、coupling、termination 或 bandwidth 前补全联合 baseline 与恢复。 |
+
+## P2：特殊采集与只读分析
+
+| 工作项 | 当前开发状态 | 下一退出门 |
+|---|---|---|
+| Average acquisition | capability 已声明，事务已有离线测试 | 需要独立实机正常路径、失败恢复和新 session 终态验证。 |
+| Segmented acquisition | 未实现 | 先定义 segment identity、选择规则、数据上限、artifact 和恢复合同。 |
+| History timestamps | capability 已声明；K15 query 仍有阻塞证据 | 只在选件门控后读取；timeout 不重试、不清错，也不把 frame number 当 timestamp。 |
+| Math／FFT | 现有 metadata／status 已声明 | Payload、expression 与准确度分别评审，不从主机 DSP 结果推导仪器能力。 |
+| Reference metadata | capability 已声明；有效 reference 的实机门未完成 | 不为制造证据调用 update／save／load，也不覆盖用户 reference。 |
+| Cursor | 只读 readout 已声明 | 配置与定位保持独立受控写入。 |
+| DVM／counter | 未实现 | 先确认选件、source、类型、状态和结果模型，再设计窄的只读 capability。 |
+| Probe 安全联动 | 基础 metadata 已实现 | 补充 identity、衰减／阻抗与输入安全限制的明确关系。 |
+| Digital waveform | capability 已声明，存在离线覆盖与受控负向证据 | 在已停止且存在稳定数字记录时完成零写入 payload、位序与 X 轴一致性验收。 |
+
+## P3：选件相关高级应用
+
+以下功能需要独立 capability、选件门控、结果模型和恢复策略，不合并进基础 scope API：
+
+- spectrum 与 spectrogram；
+- 串行／并行总线 decode；
+- protocol trigger 与 search；
+- mask test；
+- power analysis。
+
+仪器文件系统、报告导出、保存／加载状态、calibration、reset、网络和全局系统设置默认不做。
+如确有需求，应另建具备路径权限、持久副作用说明和人工确认的维护流程。
+
+## 每项新能力的退出门
+
+1. Core typed model 能准确表达设备语义，或已有合同明确允许 unavailable 字段。
+2. Driver 行为、descriptor 声明、配置字段与权限保持一致。
+3. 精确离线测试覆盖正常路径、异常回包、timeout、结果不明和恢复失败。
+4. 写入或触发具备 snapshot、readback、恢复、独立验证和必要锁停语义。
+5. 选件、型号、transport 与资源限制明确，不从 RTM2032 证据外推整个系列。
+6. 实机验收使用受控环境，并将设备条件和结果写入 Historical／evidence 页面。
+7. 中英文 Current Reference、导航和生成式插件目录同步通过检查。
diff --git a/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MILESTONES_EN.md b/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MILESTONES_EN.md
new file mode 100644
index 0000000..e88c996
--- /dev/null
+++ b/packages/wavebench-rohde-schwarz-rtm2000/doc/RTM2000_COVERAGE_MILESTONES_EN.md
@@ -0,0 +1,75 @@
+# RTM2000 Feature-Coverage Development Roadmap
+
+[中文](RTM2000_COVERAGE_MILESTONES.md)
+
+> Type: Development
+
+This page records development order, current blockers, and exit gates for future RTM2000 plugin
+capabilities. It does not maintain the current capability list or replace acceptance evidence for a
+specific device and version. The [production descriptor](../src/wavebench_rohde_schwarz_rtm2000/descriptor.py)
+is authoritative for current capabilities. See the [coverage matrix](RTM2000_COVERAGE_MATRIX_EN.md)
+for manual-domain mapping and the [development and acceptance archive](archive/RTM2000_README_0.15_EN.md)
+for recorded hardware and negative evidence.
+
+## Shared rules
+
+- A new capability needs an accurate Core typed model before it enters the plugin descriptor.
+- Option-dependent work checks identity and installed options before specialized queries. A missing
+  option is not a plugin defect.
+- A read-only method, Python method, or manual command does not constitute a production capability.
+- Writes, acquisitions, and triggers are not blindly retried. Unknown state must fail and latch as
+  required by the transaction contract.
+- Setup blobs, persistent storage, network configuration, and global maintenance commands are not
+  ordinary capabilities.
+- Hardware acceptance applies only to the recorded model, firmware, transport, and procedure; it is
+  not projected onto the full RTM2000 family.
+
+## P1: basic oscilloscope and diagnostics
+
+| Work item | Current development state | Next exit gate |
+|---|---|---|
+| Identity, options, non-consuming health | Implemented | New fields must still prove that they avoid consuming EVENT and error-queue reads. |
+| CH1/CH2 analog channel, timebase, probe metadata | Implemented | New fields require strict parsing, a model boundary, and query-only hardware evidence. |
+| Edge trigger | Query-only state and a minimal controlled CH2 configuration exist | Establish a complete transaction, restoration ownership, and model gate before adding sources or types. |
+| Automatic measurement statistics | Query-only access to caller-confirmed slots exists | Buffer reads require a separate stopped precondition and hardware acceptance. |
+| Waveform scaling and shape metadata | Implemented | Segment/history identity needs a separate model and must not reuse the fourth header field. |
+| Channel display and multi-channel focus | Controlled V2 configuration is implemented | Add a joint baseline and restoration before position, offset, coupling, termination, or bandwidth writes. |
+
+## P2: specialized acquisition and query-only analysis
+
+| Work item | Current development state | Next exit gate |
+|---|---|---|
+| Average acquisition | Capability declared; transaction covered offline | Add independent hardware normal-path, failure-restoration, and fresh-session final-state evidence. |
+| Segmented acquisition | Not implemented | Define segment identity, selection, data limits, artifacts, and restoration first. |
+| History timestamps | Capability declared; a K15 query remains blocked in recorded evidence | Query only after option gating; never retry/clear after timeout or substitute frame number for time. |
+| Math/FFT | Existing metadata/status capabilities declared | Review payload, expression, and accuracy separately; host DSP does not establish instrument capability. |
+| Reference metadata | Capability declared; the valid-reference hardware gate remains open | Do not call update/save/load or overwrite user references merely to create evidence. |
+| Cursor | Query-only readout declared | Keep configuration and positioning as a separate controlled write. |
+| DVM/counter | Not implemented | Confirm options, source, type, state, and result models before a narrow query-only capability. |
+| Probe safety integration | Basic metadata implemented | Define how identity and attenuation/impedance constrain safe input. |
+| Digital waveform | Capability declared with offline coverage and controlled negative evidence | Use a stopped stable digital record to accept payload, bit order, and X-axis consistency with zero writes. |
+
+## P3: option-dependent advanced applications
+
+The following require independent capabilities, option gates, result models, and restoration rules
+rather than expansion of the base scope API:
+
+- spectrum and spectrogram;
+- serial/parallel bus decode;
+- protocol trigger and search;
+- mask testing;
+- power analysis.
+
+Instrument filesystems, report export, state save/load, calibration, reset, network, and global
+system configuration remain out of default scope. If required, they need a separate maintenance
+workflow with path permissions, persistent-side-effect documentation, and human confirmation.
+
+## Exit gate for each new capability
+
+1. A Core typed model accurately represents device semantics or explicitly permits unavailable fields.
+2. Driver behavior, descriptor declaration, configuration fields, and permissions agree.
+3. Exact offline tests cover normal behavior, malformed responses, timeout, unknown outcome, and restoration failure.
+4. Writes or triggers have snapshot, readback, restoration, independent verification, and required latching.
+5. Option, model, transport, and resource limits are explicit; RTM2032 evidence is not family-wide evidence.
+6. Controlled hardware acceptance writes conditions and results to Historical/evidence pages.
+7. Chinese/English Current Reference, navigation, and the generated plugin catalog pass checks together.
diff --git a/packages/wavebench-rohde-schwarz-rtm2000/doc/archive/RTM2000_README_0.15.md b/packages/wavebench-rohde-schwarz-rtm2000/doc/archive/RTM2000_README_0.15.md
new file mode 100644
index 0000000..24d71d2
--- /dev/null
+++ b/packages/wavebench-rohde-schwarz-rtm2000/doc/archive/RTM2000_README_0.15.md
@@ -0,0 +1,233 @@
+# RTM2000 0.1.0–0.15.0 开发与验收存档
+
+[English](RTM2000_README_0.15_EN.md)
+
+> 类型：Historical
+> 历史范围：插件 `0.1.0` 至 `0.15.0` 的合并 README
+> 当前入口：[RTM2000 插件](../../README.md)
+
+本页保留第三轮文档迁移前的能力说明、开发过程、受控实机结果和负向证据。它用于追溯历史，
+不替代 production descriptor、当前插件目录或包入口。
+
+面向 Rohde & Schwarz RTM2000 系列、当前以 RTM2032 为实机基线的 WaveBench 可执行示波器插件。
+
+## 身份与开发基线
+
+- distribution：`wavebench-rohde-schwarz-rtm2000`
+- canonical driver ID：`rohde-schwarz.rtm2032`
+- 开发基线：WaveBench `0.8.26`
+- WaveBench：`>=0.8.26,<0.9`
+- Python：`>=3.11`
+- 默认 transport backend：核心提供的 `rsinstrument-socket`
+
+本插件的 0.15.0 开发线对齐 WaveBench `v0.8.26`，不维护旧核心兼容矩阵，也不自动声明兼容未来 `0.9`。安装后，显式 canonical ID
+`rohde-schwarz.rtm2032` 选择外置实现；短 alias `rtm2032` 始终选择内建 fallback。卸载
+插件后，canonical ID 也回退内建实现。
+
+## 能力与边界
+
+- `*IDN?`、错误队列和显式 autoscale；
+- 厂商专用只读 identity/options/health 快照，不消费 EVENT 寄存器或错误队列；
+- RTM2032 CH1/CH2 类型化模拟通道、时基和探头元数据快照；
+- 当前波形的类型化 X/Y 缩放、点数、量化位数和每采样值数量快照；
+- RTM2032 CH1/CH2 基础 edge-trigger 类型化只读快照；
+- 只读 average/segmented acquisition 状态，K15 专属查询受选件门控；
+- 受控 average acquisition：调用方须明确确认 acquisition 已停止；仅暂时修改 average count、single count 和全局 channel arithmetic，成功或失败后均回读恢复，恢复不确定会锁存该实例后续 average 写入；
+- RTM2032 CH1/CH2 的只读 K15 history 时间戳表；
+- 显式确认已配置槽位后的自动测量只读统计；
+- 现有 math、FFT、reference、cursor 状态的只读 metadata/readout；
+- Scope V2 只读接口：通道输入状态、B1 门控的数字状态、严格的 identity 五字段 snapshot、
+  仅支持 1–4 号槽且不含 buffer 的测量统计，以及已配置 FFT 的三字段状态；
+- RTM2032 CH1/CH2 的 `scope.channel_display_configure_v2`：Core 负责 typed baseline、写后回读、失败恢复和独立恢复验证，插件只执行单通道 `STATE?` 与 `STATE ON/OFF`；
+- RTM2000 系列 CH1/CH2 的 `scope.focus_configure_v2`：RTM 插件 profile 声明通道、时基和 V/div 请求 guard，Core 负责完整联合 baseline、写后回读、失败恢复和恢复验证；
+- RTM2032 CH2 edge trigger 的厂商专用最小受控配置闭环；
+- 当前波形读取与单次 acquisition；
+- 一次 acquisition 后按通道读取多路波形；
+- 通道 coupling 查询和 PNG 截图；
+- `DEF` / `MAX` / `DMAX` 点数模式原样交给 RTM2000。
+
+插件只负责 RTM2000 厂商 SCPI、header/REAL 波形解析和错误语义。RsInstrument 会话、超时、
+高阻保护、Service、artifact、run plan 和实验级状态恢复留在核心。空列表、短列表、无效 header、
+非 PNG 截图和 OPC 超时都显式失败，不补零、不伪造成功、不盲目重试。
+
+`backend = "lan"` 按 descriptor 首选顺序使用 RsInstrument SocketIO，不依赖 VISA-C 或
+pyvisa-py。诊断兼容性时可显式选择 `rsinstrument`、`rsinstrument-rsvisa` 或
+`rsinstrument-pyvisa-py`；切换后端必须重新打开会话，读取失败后不会自动重放。插件仅对
+`MAX` / `DMAX` 波形数据读取使用独立的长传输 timeout，并记录不含地址、序列号和波形内容的
+分块进度、点数、字节数、耗时与吞吐 telemetry。
+
+## 配置示例
+
+```toml
+[connection]
+backend = "lan"
+resource = "TCPIP::192.0.2.60::INSTR"
+
+[scope]
+driver = "rohde-schwarz.rtm2032"
+default_channel = 1
+check_errors = true
+
+[scope.options]
+long_waveform_timeout_ms = 300000
+```
+
+示例使用 RFC 5737 文档地址。默认测试不扫描资源、不连接仪器，也不发送真实 SCPI。
+
+## 编程手册投放位置
+
+将 RTM2000 系列示波器编程手册放到：
+
+```text
+doc/vendor-local/RTM2000_programming_manual.pdf
+```
+
+也可以保留厂商原始文件名。`doc/vendor-local/` 中除说明文件外的内容会被 Git 忽略，整个目录也会从 sdist 排除，不会随仓库推送或公开发行包发布。项目根据手册整理的 SCPI 索引、能力矩阵和验收资料应另放在公开 `doc/` 中，并明确区分手册声明与实机验证结果。
+
+当前手册命令面与插件、内建 fallback、实机证据的对照见 [RTM2000 手册功能覆盖矩阵](../RTM2000_COVERAGE_MATRIX.md)。
+
+## 验收状态
+
+0.1.0 已于 2026-07-24 完成真实 wheel 的受控 RTM2032 LAN/VXI-11 验收：受管安装与 healthy/load、
+canonical 与短 alias 路由、双通道单次 acquisition、`DEF` / `MAX` / `DMAX` 完整波形、
+autoscale、高阻 coupling 守卫、PNG 截图、20/20 双通道重复采集和空错误队列均通过。
+`MAX` 每通道实测 10000000 点，`DMAX` 每通道实测 6250000 点；长记录使用独立 300 s
+传输上限，不把统一 30 s 超时误判为协议失败。验收前保存了完整 setup 快照，结束后确认
+setup blob、配置指纹和活动采集状态均恢复。验收未修改真实 `wavebench.toml`，未提交真实
+地址、序列号、波形、截图、快照或命令日志。实验级快照与恢复仍属于核心/验收工具边界，
+不进入厂商驱动。
+
+0.2.0 将默认 LAN transport 改为 RsInstrument SocketIO，保留上述显式兼容后端。离线门禁
+覆盖 descriptor 路由、调用级长传输 timeout、脱敏 telemetry 和 wheel 生命周期。RTM2032
+实机已通过 SocketIO 的 DEF/MAX/DMAX、截图、autoscale、20/20 重复采集与空错误队列验收。
+实验级 `SYST:SET` setup 恢复不属于插件驱动：SocketIO 写入曾出现只部分生效，因此验收工具
+固定使用已验证的 VXI-11 512-byte 协议分片，并在重连后只读核对完整 blob、配置指纹和活动
+采集状态。验收结束时快照已删除，真实地址、序列号、波形和命令日志均未进入提交。
+
+0.3.0 开发线新增严格类型化的只读 identity/options/health 快照。health 快照只读取
+`*STB?`、operation/questionable condition、acquisition available/count 和 sample rate；不读取会
+消费状态的 EVENT 寄存器，也不自动清空错误队列。该厂商专用 API 不扩张 WaveBench 核心
+capability 声明。0.3.0 还增加 RTM2032 CH1/CH2 的模拟通道、时基和探头元数据快照；
+`FULL` 带宽、`UNKN` 阻抗和仪器不可用数值映射为 `None`；封闭枚举中的未知值、格式非法的
+开放 token、非有限值、未加引号文本和 CH1/CH2 之外的索引均失败关闭。命令索引只证明命令面存在，返回类型来自 RTM2032
+受控只读实测；不会外推为所有 RTM2000 型号的通用契约。实机已验证两路通道、当前时基和
+无源探头状态，验收后 status byte 为 0；未读取 EVENT 或错误队列，也未发送设置命令。
+
+0.4.0 增加厂商专用只读 `waveform_metadata_snapshot(channel)`。它交叉验证
+`DATA:HEADER?`、`POINTs?`、X increment/origin，并返回 Y increment/origin、垂直量化位数和
+每个 sample interval 的值数量；未知/非整数/非有限响应以及混合记录造成的 X 轴不一致均失败关闭。
+RTM2032 CH2 实机只读验收返回 10000 点、200 ns X 步长、20 mV/bit 和 8-bit 分辨率；调用未发送
+写命令、未产生 status/questionable 错误，也未改变 acquisition count。连续运行时 operation condition
+会随正常触发周期在 waiting/non-waiting 间变化，因此不把它误作恒定前后条件。
+`DATA:HEADER?` 第四字段不是 segment ID；history/segment identity 仍未实现，也不纳入本版本声明。
+
+0.5.0 首个小步新增厂商专用只读 `edge_trigger_snapshot()`。当前类型域只覆盖 RTM2032 实机
+证实的 `EDGE / CH1|CH2 / AUTO / POS / DC / hysteresis AUTO / holdoff OFF` 基线；未知 trigger
+类型、source、模式、斜率、coupling 或 holdoff 均失败关闭，不推断手册索引未给出的返回域。CH2
+校准方波只读验收得到 0.53 V trigger level 和 50 ns holdoff time；9 条查询前后 status byte、
+questionable condition 和 acquisition count 保持健康，未读取 EVENT/error queue，也未发送写命令。
+
+0.5.0 第二个小步新增 `configure_ch2_edge_trigger(level_v=...)`，但不声明通用 trigger capability。
+它只接受已启用、未过载、高阻 `DCL/ACL` 的 RTM2032 CH2 基线和当前显示量程内的有限电平；
+在实例级可重入 I/O 锁内固定写入 `EDGE / CH2 / AUTO / POS / DC / level`，随后逐字段回读，
+确认未写入的 hysteresis/holdoff 保持原值，并复核非消费型 health 与 identity。写入开始后的任意
+timeout、回读不符、健康异常或身份变化都会永久锁存该实例的 trigger 写路径，后续调用零 I/O
+拒绝；不自动重试、回滚、find-level、autoscale、single、清错误队列或读取 EVENT。生产 setter
+明确由调用方负责持久恢复；受控实机验收用私有 fsync journal 将 CH2 level 从 0.53 V 改为
+0.65 V 后恢复至 0.53 V，前后 status byte/questionable condition 均为 0，acquisition count 均为 53。
+
+0.6.0 将上述七类只读快照接入 WaveBench 0.8.1 的选择性 `scope.snapshot` 公共契约。
+`get_snapshot(channel)` 在同一实例 I/O 锁内组合 identity、health、指定模拟通道、时基、
+探头、波形元数据和 edge-trigger 快照；descriptor 仅为本 canonical 外置驱动声明该能力，
+因此 `wavebench scope status --channel N` 可用，而不要求其他 scope 驱动实现。原有
+`RTM2000*Snapshot` 导入名保留为公共模型的兼容别名。该聚合调用仍不读取 EVENT/错误队列，
+也不发送设置命令；真实 RTM2032 的 identity、CH1/CH2 snapshot 与 acquisition status 组合路径已完成受控实机验收。
+
+0.7.0 接入 WaveBench 0.8.2 的选择性 `scope.acquisition_status` 与
+`scope.history_timestamps` 公共契约。两条路径均只查询；K15 专属查询必须由 `*OPT?`
+精确返回 K15 token。时间戳按 oldest-to-newest 顺序严格合并 relative、absolute、date 三张
+`:ALL?` 表，不选择 history segment、不启动采集，也不消费错误队列。RTM2032 已确认 K15 与
+average/segmented 只读状态；history timestamp table 查询发生 timeout，未重试且仍属阻塞项。
+
+0.8.0 新增 `scope.measurement_statistics`。调用方必须显式确认 1–4 号槽位已经配置；读取统计
+buffer 时还必须显式确认 acquisition 已停止。实现不配置、启用或复位测量槽，也不读取或清空
+错误队列。`NAN` 结果表示 unavailable；timeout 后结果状态为未知且不重试。RTM2032 上调用方
+确认已配置的 CH2 frequency 槽已完成 actual/average/min/max/stddev/count 受控验收；STOP 状态
+buffer 仍待验收。
+
+0.9.0 新增只读分析状态面。math/reference 只读 metadata，不下载波形本体，也不修改全局传输
+格式；FFT/cursor 必须由调用方显式确认已经在前面板配置。实现不定义 FFT expression、不移动
+cursor、不 update/save/load reference、不启动采集，也不消费错误队列。RTM2032 的 math
+metadata、FFT status 与 vertical cursor delta readout 已完成受控验收并恢复前面板状态；reference
+存储为空，故 metadata 实机验收保持阻塞，未调用 `UPDATE` 制造测试数据。
+
+0.10.0 接入 WaveBench 0.8.5 的 `scope.capture_average`。这是一条窄的、需要调用方显式
+`--acquisition-stopped` 确认的受控写路径：预检既有 `REAL,32` / `LSBF` 传输格式，然后仅临时
+写入 `ACQuire:AVERage:COUNt`、`ACQuire:NSINgle:COUNt` 和全局 `CHANnel:ARITHmetics`，执行
+一次 `SINGle`，确认 `ACQuire:AVERage:COMPlete?` 后读取当前波形。它不写 `FORMat`、byte order、
+point mode、时基、垂直档位、触发或 K15 history 状态。无论采集或波形读取成功与否，都会恢复并
+回读三项配置；恢复失败或结果不一致会锁存该实例的 average 写路径，后续调用零 I/O 拒绝。该实现
+目前有离线事务测试，尚无独立实机验收结论。任一配置写（包括第一条）超时都会按「结果未知」
+处理：即使随后的恢复回读一致，也会永久锁存当前驱动实例，避免继续依赖一次无法证明结果的写事务。
+
+0.11.0 新增 `scope.digital_status` 只读状态面。每次调用先用 `*OPT?` 精确确认 B1，再读取
+D0–D15 中一个显式通道的 activity、display、technology、threshold、threshold coupling、
+hysteresis、deskew、size、position 和 label。该路径不读取 `DIGital:DATA?`，不写阈值/显示/
+传输格式，不启动或停止采集，也不消费错误队列。RTM2032 实机已完成 D0–D15 全通道验收：
+单会话共发出 208 条 query，write 与 binary read 均为 0，四组映射和 D0 重复读取一致性通过；
+CLI 的 D0/D15 端到端输出也通过。验收时全部数字通道均未显示、activity 为 LOW、阈值为
+1.4 V；这些值只记录当时仪器状态，不构成数字探头电气输入或数字波形 payload 验收。
+
+0.12.0 新增 `scope.digital_waveform` 只读数字波形面。调用方必须显式确认采集已经停止；
+驱动先以 `*OPT?` 门控 B1，并要求仪器当前传输格式已经是 ASCII（手册记为 `ASC,0`；
+RTM2032 实机会回读 `CSV,0`）。随后逐通道查询
+`DIGital<n>:DATA:POINts?`、`HEADER?`、`XORigin?`、`XINCrement?` 与 `DATA?`，严格核对
+所有通道的采样数和 X 轴，再在主机侧按 Dn→`uint16` bit n 合并。该路径不发送写命令，
+不切换 STOP/RUN，不修改格式、点数、显示或阈值，也不读取错误队列。当前只有 FakeTransport
+离线验收。RTM2032 只读预检已确认 B1 和 `CSV,0` 门控可通过，但当时 D0 未显示且
+`DIGital0:DATA:POINts?` 返回 0，驱动在 `DATA?` 前拒绝继续；因此数字波形 payload 仍未验收。
+
+0.13.0 将五类既有只读能力接入 WaveBench 0.8.25 的 Scope V2 契约。通道输入状态只从
+`CHANnel<n>:COUPling?` 映射 coupling 与 termination，数值阻抗明确标记为 unavailable；数字状态
+复用既有 B1 门控查询，未提供的 threshold scope 与 timing calibration 明确标记为 unavailable；
+snapshot 固定为 identity 五字段、最多两次查询；测量统计只接受 1–4 号已配置槽位，不读取
+buffer，并要求五个聚合值均为有限数；FFT 状态只提供 average complete、RBW 与 sample rate。
+这些适配器不新增 SCPI 写入，不改变既有 V1 方法、FFT 数值分析或波形采集逻辑。
+RTM2032 的 CH1/CH2 输入状态、CH1/CH2 identity snapshot 和 D0 数字状态已通过受控只读验收；
+相关会话全部强制为 `read_only`，write request 与 binary write 均为 0。测量统计与 FFT V2
+仍以离线等价测试和既有 V1 实机证据为边界；由于没有新鲜的前面板配置确认，本轮未冒充
+`configured=True` 重跑。
+
+0.14.0 新增 `scope.channel_display_configure_v2`。descriptor profile 将可写模拟通道严格限定为
+CH1/CH2，预算对应一次 baseline query、一次 setter write 与 Core fresh readback，以及失败时的一次
+restore write 与一次独立 verify query。插件不自行重试、不扩大到时基或垂直档位，也不另建一套
+恢复状态机。RTM2032 固件 `06.010` 的受控验收在 DG4202 双输出关闭、CH1/CH2 均为 `DCL`
+高阻且无过载的前提下，将 CH2 从 `ON` 切到 `OFF` 并独立读回，再通过 Core 从 `OFF` 恢复到
+`ON`。恢复事务只有一次已完成文本写入，write outcome unknown 与 binary write 均为 0，session
+保持 healthy；最终零写完整 snapshot 确认 CH1/CH2 均回到 `ON`、`DCL`、无过载。
+
+0.15.0 新增 `scope.focus_configure_v2`。RTM 插件 profile 将模拟通道限定为 CH1/CH2，并为时基、
+逐通道 V/div 与 I/O 步数提供插件侧 guard；Core 一次读取完整 time range/position 和两路 display、
+range、V/div、position、offset，成功后保留目标联合视图，任一失败则按 timebase、channel vertical、
+channel display 的固定顺序恢复并重新查询。RTM2032 固件 `06.010` 的代表性验收在 DG4202 双输出
+关闭、两路 `DCL` 高阻且无过载时，将 5 ms 改为 10 ms、CH2 从 0.2 V/div 改为 0.4 V/div，
+并隐藏 CH1；目标状态与恢复状态均通过 fresh readback。随后恢复到 5 ms、两路 0.2 V/div 且均
+开启，6 次文本写入全部完成，结果不明写入和二进制写入均为 0；全新只读 session 再次确认完整
+基线，DG4202 两路仍为 OFF。该设备是 RTM2000 系列的代表性实机基线，不要求逐型号重复验收；
+profile 上下限是插件请求 guard，不表示全部边界值均已逐点上机。部分写入故障与恢复失败使用离线
+受控故障注入验证，未在真实仪器上制造通信故障。
+
+## 开发验证
+
+```bash
+python -m pytest -q packages/wavebench-rohde-schwarz-rtm2000/tests
+python -m ruff check packages/wavebench-rohde-schwarz-rtm2000
+python -m wavebench plugin package check packages/wavebench-rohde-schwarz-rtm2000
+```
+
+真实地址、序列号、波形、截图和命令日志不得提交。本插件采用 [MIT License](../../LICENSE)。
+
+## 来源
+
+0.1.0 从 WaveBench 主仓库 `973fc88` 的内建 RTM2032 协议实现迁移，只把厂商驱动、
+descriptor、entry point 和 FakeTransport 测试外置。
diff --git a/packages/wavebench-rohde-schwarz-rtm2000/doc/archive/RTM2000_README_0.15_EN.md b/packages/wavebench-rohde-schwarz-rtm2000/doc/archive/RTM2000_README_0.15_EN.md
new file mode 100644
index 0000000..3dcaafb
--- /dev/null
+++ b/packages/wavebench-rohde-schwarz-rtm2000/doc/archive/RTM2000_README_0.15_EN.md
@@ -0,0 +1,283 @@
+# RTM2000 0.1.0–0.15.0 Development and Acceptance Archive
+
+[中文](RTM2000_README_0.15.md)
+
+> Type: Historical
+> Historical scope: combined package README for plugin versions `0.1.0` through `0.15.0`
+> Current entry: [RTM2000 plugin](../../README_EN.md)
+
+This page preserves capability notes, development history, controlled hardware results, and negative
+evidence from before the third documentation migration. It supports historical review and does not
+replace the production descriptor, current plugin catalog, or package landing page.
+
+An executable WaveBench oscilloscope plugin for the Rohde & Schwarz RTM2000 series, with the
+RTM2032 as the current hardware baseline.
+
+## Identity and development baseline
+
+- distribution: `wavebench-rohde-schwarz-rtm2000`
+- canonical driver ID: `rohde-schwarz.rtm2032`
+- development baseline: WaveBench `0.8.26`
+- WaveBench: `>=0.8.26,<0.9`
+- Python: `>=3.11`
+- default transport backend: core-provided `rsinstrument-socket`
+
+The plugin's 0.15.0 development line targets WaveBench `v0.8.26`, does not maintain a legacy-core
+compatibility matrix, and does not automatically claim compatibility with a future `0.9` core. When installed, the explicit canonical ID `rohde-schwarz.rtm2032` selects
+the external implementation. The short alias `rtm2032` always selects the built-in fallback.
+Removing the plugin restores the built-in implementation for the canonical ID as well.
+
+## Capabilities and boundary
+
+- `*IDN?`, error queue, and explicit autoscale;
+- vendor-specific read-only identity/options/health snapshots that do not consume event registers or the error queue;
+- typed RTM2032 CH1/CH2 analog-channel, timebase, and probe-metadata snapshots;
+- typed current-waveform X/Y scaling, point-count, quantization, and values-per-sample metadata;
+- a typed read-only basic edge-trigger snapshot for RTM2032 CH1/CH2;
+- read-only average/segmented acquisition state, with K15-only queries option-gated;
+- controlled average acquisition, requiring the caller to confirm acquisition is stopped; it temporarily changes only average count, single count, and global channel arithmetic, reads the original configuration back after restoration, and latches further average writes if restoration is ambiguous;
+- read-only K15 history timestamp tables for RTM2032 CH1/CH2;
+- read-only statistics for an explicitly preconfigured automatic-measurement slot;
+- read-only metadata/status for existing math, FFT, reference, and cursor state;
+- read-only Scope V2 surfaces for channel input state, B1-gated digital status, a strict five-field
+  identity snapshot, slot-1-to-4 measurement statistics without buffers, and three-field status for
+  an explicitly configured FFT;
+- `scope.channel_display_configure_v2` for RTM2032 CH1/CH2: core owns the typed baseline,
+  post-write readback, failure restoration, and independent restoration verification, while the
+  plugin performs only the selected channel's `STATE?` and `STATE ON/OFF` operations;
+- `scope.focus_configure_v2` for RTM2000-series CH1/CH2: the RTM plugin profile declares channel,
+  timebase, and V/div request guards, while core owns the complete joint baseline, post-write
+  readback, failure restoration, and restoration verification;
+- a vendor-specific minimal controlled RTM2032 CH2 edge-trigger configuration loop;
+- current-waveform fetch and single acquisition;
+- one acquisition followed by multi-channel waveform reads;
+- channel-coupling queries and PNG screenshots;
+- pass-through RTM2000 `DEF`, `MAX`, and `DMAX` point modes.
+
+The plugin owns RTM2000 SCPI, header/REAL waveform parsing, and device-error semantics. Core retains
+the RsInstrument session, timeouts, high-impedance guard, services, artifacts, run plans, and
+experiment-level restoration. Empty or short waveform lists, invalid headers, non-PNG screenshots,
+and OPC timeouts fail explicitly; the plugin does not pad, fabricate success, or retry blindly.
+
+`backend = "lan"` selects RsInstrument SocketIO according to descriptor preference and does not
+depend on VISA-C or pyvisa-py. Explicit diagnostic compatibility paths are `rsinstrument`,
+`rsinstrument-rsvisa`, and `rsinstrument-pyvisa-py`; changing backend requires a fresh session,
+and a failed response is never replayed automatically. Only `MAX` and `DMAX` waveform data reads
+use the dedicated long-transfer timeout. Chunk progress, point/byte counts, elapsed time, and
+throughput telemetry exclude addresses, serial numbers, and waveform contents.
+
+## Configuration example
+
+```toml
+[connection]
+backend = "lan"
+resource = "TCPIP::192.0.2.60::INSTR"
+
+[scope]
+driver = "rohde-schwarz.rtm2032"
+default_channel = 1
+check_errors = true
+
+[scope.options]
+long_waveform_timeout_ms = 300000
+```
+
+The example uses an RFC 5737 documentation address. Offline tests do not scan resources, connect to
+instruments, or send real SCPI.
+
+## Programming-manual location
+
+Place the RTM2000-series oscilloscope programming manual at:
+
+```text
+doc/vendor-local/RTM2000_programming_manual.pdf
+```
+
+The vendor's original filename may also be retained. All content under `doc/vendor-local/` except its explanatory README is ignored by Git, and the entire directory is excluded from the sdist, so vendor manuals are not pushed with the repository or published in public distribution artifacts. Project-authored SCPI indexes, capability matrices, and acceptance material should live separately under public `doc/` and distinguish manual claims from hardware-verified behavior.
+
+See the [RTM2000 manual feature coverage matrix](../RTM2000_COVERAGE_MATRIX_EN.md) for the current comparison across the manual surface, external plugin, bundled fallback, and hardware evidence.
+
+## Acceptance status
+
+Version 0.1.0 completed controlled RTM2032 LAN/VXI-11 acceptance with a real wheel on 2026-07-24. Managed
+install and healthy/load checks, canonical-versus-short-alias routing, dual-channel single
+acquisition, complete `DEF`, `MAX`, and `DMAX` waveforms, autoscale, the high-impedance coupling
+guard, PNG screenshots, 20/20 repeated dual-channel captures, and an empty error queue all passed.
+`MAX` returned 10,000,000 points per channel and `DMAX` returned 6,250,000 points per channel. Long
+records used a separate 300-second transfer bound rather than treating the shared 30-second timeout
+as a protocol failure. A complete setup snapshot was saved before mutation; the setup blob,
+configuration fingerprint, and active acquisition state were all confirmed restored afterward.
+The acceptance did not modify the real `wavebench.toml` or commit real addresses, serial numbers,
+waveforms, screenshots, snapshots, or command logs. Experiment-level snapshot and restoration stay
+in core/acceptance tooling rather than the vendor driver.
+
+Version 0.2.0 changes the preferred LAN transport to RsInstrument SocketIO while retaining the
+explicit compatibility backends above. Offline gates cover descriptor routing, per-call
+long-transfer timeouts, sanitized telemetry, and the wheel lifecycle. RTM2032 hardware acceptance
+passed for SocketIO DEF/MAX/DMAX, screenshot, autoscale, 20/20 repeated capture, and an empty error
+queue. Experiment-level `SYST:SET` restoration is not a plugin-driver responsibility: a SocketIO
+write once applied the setup only partially, so the acceptance tool uses the verified VXI-11
+512-byte protocol chunks and performs read-only comparison of the complete blob, configuration
+fingerprint, and active acquisition state after reconnecting. The final snapshot was deleted and
+no real address, serial number, waveform, or command log entered the commit.
+
+The 0.3.0 development line adds strict typed read-only identity/options/health snapshots. The health
+snapshot reads only `*STB?`, operation/questionable condition, acquisition available/count, and sample
+rate. It does not consume event registers or drain the error queue. This vendor-specific API does not
+expand the WaveBench core capability declaration. Version 0.3.0 also adds RTM2032 CH1/CH2 analog-
+channel, timebase, and probe-metadata snapshots. `FULL` bandwidth, `UNKN` impedance, and instrument
+unavailable-value sentinels map to `None`; unknown values in closed enums, malformed open tokens,
+non-finite values, unquoted text, and indexes outside CH1/CH2 fail closed. The command index establishes command-surface existence only; return
+types come from controlled read-only RTM2032 measurements and are not generalized to every RTM2000
+model. Hardware acceptance covered both channels, the current timebase, and passive-probe state and
+left the status byte at zero. It read no event/error queue and sent no setting command.
+
+Version 0.4.0 adds the vendor-specific read-only `waveform_metadata_snapshot(channel)` API. It
+cross-checks `DATA:HEADER?`, `POINTs?`, X increment/origin, and returns Y increment/origin, vertical
+quantization bits, and values per sample interval. Unknown, non-integral, non-finite, or mixed-record
+X-axis responses fail closed. Controlled RTM2032 CH2 acceptance returned 10,000 points, a 200 ns X
+increment, 20 mV/bit, and 8-bit resolution. Status byte, operation/questionable condition, and
+acquisition count showed no error or count change, and no write was sent. On a running acquisition,
+the operation condition may naturally move between waiting and non-waiting states during the trigger
+cycle, so it is not treated as a constant before/after invariant. The fourth `DATA:HEADER?` field is
+not a segment identity; history/segment identity remains outside this release claim.
+
+The first version 0.5.0 increment adds the vendor-specific read-only `edge_trigger_snapshot()` API.
+Its closed domains intentionally cover only the RTM2032 hardware-verified
+`EDGE / CH1|CH2 / AUTO / POS / DC / hysteresis AUTO / holdoff OFF` baseline. Unknown trigger types,
+sources, modes, slopes, coupling, or holdoff modes fail closed rather than inferring response domains
+from the command index. Read-only CH2 calibration-square-wave acceptance returned a 0.53 V trigger
+level and 50 ns holdoff time. Nine queries left status byte, questionable condition, and acquisition
+count healthy, consumed no event/error queue, and sent no write.
+
+The second 0.5.0 increment adds `configure_ch2_edge_trigger(level_v=...)` without declaring a generic
+trigger capability. It accepts only an enabled, non-overloaded, high-impedance `DCL/ACL` RTM2032 CH2
+baseline and a finite level inside the current displayed range. Under the instance-wide reentrant I/O
+lock it writes the fixed `EDGE / CH2 / AUTO / POS / DC / level` state, reads every field back,
+requires the untouched hysteresis/holdoff settings to remain unchanged, and rechecks non-consuming
+health and identity. Any timeout, readback mismatch, health fault, or identity drift after writing
+begins permanently latches that instance's trigger-write path; subsequent calls fail with zero I/O.
+There is no blind retry, automatic rollback, find-level, autoscale, single acquisition, error-queue
+clear, or EVENT read. Persistent restoration remains the caller's responsibility. Controlled hardware
+acceptance used a private fsync journal to change CH2 from 0.53 V to 0.65 V and restore 0.53 V; status
+byte/questionable condition remained zero and acquisition count remained 53 before and after.
+
+Version 0.6.0 connects those seven read-only sections to WaveBench 0.8.1's optional
+`scope.snapshot` contract. `get_snapshot(channel)` aggregates identity, health, the selected analog
+channel, timebase, probe, waveform metadata, and edge-trigger snapshots under the same instance I/O
+lock. Only this canonical external descriptor declares the capability, so `wavebench scope status
+--channel N` becomes available without requiring other scope drivers to implement it. Existing
+`RTM2000*Snapshot` import names remain compatibility aliases of the public core models. The aggregate
+path still reads no EVENT/error queue and sends no setting command. Controlled RTM2032 acceptance now
+covers identity, CH1/CH2 snapshots, and acquisition status.
+
+Version 0.7.0 adds the optional `scope.acquisition_status` and `scope.history_timestamps`
+contracts from WaveBench 0.8.2. Both paths are query-only. K15-only queries require an exact K15
+token from `*OPT?`; timestamp rows are built by strict positional matching of the relative-time,
+absolute-time, and date `:ALL?` tables in oldest-to-newest order. No history segment is selected,
+no acquisition is started, and the error queue is not consumed. RTM2032 acceptance confirmed K15 and
+the read-only average/segmented status. The history timestamp-table query timed out, was not retried,
+and remains blocked.
+
+Version 0.8.0 adds `scope.measurement_statistics`. The caller must explicitly confirm that slot 1-4
+was configured before the command. Buffer reads additionally require explicit confirmation that
+acquisition is stopped. The implementation never configures, enables, or resets a slot and never
+queries or clears the error queue. `NAN` actual/statistical values are represented as unavailable;
+timeouts leave the operation outcome unknown and are not retried. A caller-confirmed CH2 frequency
+slot passed controlled actual/average/min/max/stddev/count acceptance; stopped-acquisition buffer
+reading remains pending.
+
+Version 0.9.0 adds query-only analysis surfaces. Math and reference commands return metadata only;
+they do not read waveform payloads or alter the global transfer format. FFT and cursor status require
+explicit confirmation that the corresponding front-panel object is already configured. The plugin
+does not define an FFT expression, move cursors, update/save/load references, start acquisition, or
+consume the error queue. Math metadata, FFT status, and vertical cursor delta readout passed controlled
+RTM2032 acceptance with front-panel restoration. Reference metadata remains blocked because reference
+storage was empty; `UPDATE` was not used to manufacture test data.
+
+Version 0.10.0 connects the WaveBench 0.8.5 `scope.capture_average` contract. This is a narrow,
+controlled write path that requires explicit `--acquisition-stopped` caller confirmation. It preflights
+the existing `REAL,32` / `LSBF` transfer format, temporarily writes only `ACQuire:AVERage:COUNt`,
+`ACQuire:NSINgle:COUNt`, and global `CHANnel:ARITHmetics`, issues one `SINGle`, confirms
+`ACQuire:AVERage:COMPlete?`, and reads the current waveforms. It does not write `FORMat`, byte order,
+point mode, timebase, vertical scale, trigger, or K15 history state. Both successful and failed
+acquisitions restore and read back all three configuration fields; failed or mismatched restoration
+latches that instance's average-write path, so later calls fail with zero I/O. This has offline
+transaction coverage but no independent hardware-acceptance conclusion yet.
+
+Version 0.11.0 adds the read-only `scope.digital_status` surface. Every call first requires an
+exact B1 token from `*OPT?`, then reads the activity and existing display, technology, threshold,
+threshold-coupling, hysteresis, deskew, size, position, and label state for one explicit D0-D15
+channel. It does not read `DIGital:DATA?`, write digital configuration or transfer format, start or
+stop acquisition, or consume the error queue. RTM2032 hardware acceptance covered all D0-D15
+channels in one session: 208 queries, zero writes, zero binary reads, correct four-group mapping,
+and stable repeated D0 results. End-to-end CLI reads also passed for D0 and D15. At acceptance time
+all digital channels were hidden, reported LOW activity, and used a 1.4 V threshold; those observed
+values do not constitute electrical-input or digital-waveform-payload acceptance.
+
+Version 0.12.0 adds the read-only `scope.digital_waveform` surface. The caller must explicitly
+confirm that acquisition is stopped. The driver gates B1 through `*OPT?`, requires the existing
+transfer format to be ASCII (documented as `ASC,0`; RTM2032 hardware reports `CSV,0`), then queries `DIGital<n>:DATA:POINts?`, `HEADER?`, `XORigin?`,
+`XINCrement?`, and `DATA?` for every selected channel. Sample counts and X axes must match exactly
+before host-side Dn→`uint16` bit n packing. The path sends no writes, does not switch STOP/RUN,
+does not alter format, points, display, or thresholds, and does not consume the error queue. It has
+FakeTransport acceptance. An RTM2032 read-only preflight passed the B1 and `CSV,0` gates, but D0
+was hidden and `DIGital0:DATA:POINts?` returned zero, so the driver stopped before `DATA?` and
+digital-payload hardware acceptance remains pending.
+
+Version 0.13.0 maps five existing read-only surfaces to the WaveBench 0.8.25 Scope V2 contracts.
+Channel input state derives coupling and termination only from `CHANnel<n>:COUPling?`, with numeric
+impedance explicitly unavailable. Digital status reuses the existing B1-gated queries and marks
+threshold scope and timing calibration unavailable. Snapshot V2 is fixed to five identity fields and
+two queries. Measurement statistics accepts only preconfigured slots 1-4, reads no buffer, and
+requires all five aggregates to be finite. FFT status exposes only average complete, RBW, and sample
+rate. These adapters add no SCPI writes and do not alter the V1 methods, host-side FFT analysis, or
+waveform-capture logic.
+Controlled read-only RTM2032 acceptance passed for CH1/CH2 input state, CH1/CH2 identity snapshots,
+and D0 digital status. Every related session was forced to `read_only`, with zero write requests and
+zero binary writes. Measurement-statistics and FFT V2 remain bounded by offline equivalence tests and
+their existing V1 hardware evidence; this run did not pretend to have fresh front-panel configuration
+confirmation by passing `configured=True` without evidence.
+
+Version 0.14.0 adds `scope.channel_display_configure_v2`. The descriptor profile limits writable
+analog channels to CH1/CH2 and budgets one baseline query, one setter write plus core fresh readback,
+and, on failure, one restoration write plus one independent verification query. The plugin neither
+retries nor expands the operation to timebase or vertical settings, and it does not duplicate core's
+recovery state machine. Controlled RTM2032 firmware `06.010` acceptance ran with both DG4202 outputs
+off and both scope channels high-impedance `DCL` and not overloaded. It changed CH2 from `ON` to
+`OFF`, confirmed that state independently, then used core to restore `OFF` to `ON`. The restoration
+transaction recorded one completed text write, zero unknown write outcomes, zero binary writes, and
+a healthy session. A final zero-write full snapshot confirmed CH1/CH2 both restored to `ON`, `DCL`,
+and not overloaded.
+
+Version 0.15.0 adds `scope.focus_configure_v2`. The RTM plugin profile limits analog channels to
+CH1/CH2 and declares plugin-side timebase, per-channel V/div, and I/O-step guards. Core reads the
+complete time range/position plus display, range, V/div, position, and offset for both channels in
+one baseline. It preserves the requested joint view after success and restores in fixed timebase,
+channel-vertical, channel-display order after any failure, followed by fresh verification.
+Representative RTM2032 firmware `06.010` acceptance ran with both DG4202 outputs off and both scope
+inputs high-impedance `DCL` and not overloaded. It changed 5 ms to 10 ms, changed CH2 from 0.2 V/div
+to 0.4 V/div, and hid CH1; fresh readback proved both the target and restored states. The operation
+then restored 5 ms, both channels at 0.2 V/div, and both displays on. All six text writes completed,
+with zero unknown outcomes and zero binary writes. A new read-only session independently confirmed
+the complete baseline, and both DG4202 outputs remained off. This RTM2032 is the representative
+hardware baseline for the RTM2000 series; per-model repetition is not required. Profile bounds are
+plugin request guards, not a claim that every boundary value was exercised on hardware. Partial-write
+and failed-restoration paths are covered by controlled offline fault injection, not by inducing live
+communication faults.
+
+## Development checks
+
+```bash
+python -m pytest -q packages/wavebench-rohde-schwarz-rtm2000/tests
+python -m ruff check packages/wavebench-rohde-schwarz-rtm2000
+python -m wavebench plugin package check packages/wavebench-rohde-schwarz-rtm2000
+```
+
+Do not commit real addresses, serial numbers, waveforms, screenshots, or command logs. This package
+is licensed under the [MIT License](../../LICENSE).
+
+## Origin
+
+Version 0.1.0 was migrated from the built-in RTM2032 protocol implementation at WaveBench `973fc88`.
+Only the vendor driver, descriptor, entry point, and FakeTransport tests moved into this package.
diff --git a/packages/wavebench-shengpu-sp3000a/README.md b/packages/wavebench-shengpu-sp3000a/README.md
index 0f1990e..d702b6e 100644
--- a/packages/wavebench-shengpu-sp3000a/README.md
+++ b/packages/wavebench-shengpu-sp3000a/README.md
@@ -4,51 +4,31 @@
 
 面向 Shengpu SP30120 数字扫频仪的 WaveBench 外置插件。distribution 名沿用早期文档孵化阶段冻结的 `wavebench-shengpu-sp3000a`；它不表示将 SP30120 冒认为手册中的 SP30120A。
 
-## 当前状态
+## 从这里开始
 
-0.2.0 在 M3 query-only 基线上加入 M3.5 的厂商专用、类型化 RF-OFF 控制：
+- [查询当前版本、兼容范围、型号和 capability](../../doc/reference/plugin-catalog.md)
+- [进入 SP3000A 开发与证据文档](doc/README.md)
+- [安装和管理 WaveBench 插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-- distribution：`wavebench-shengpu-sp3000a` 0.2.0
-- canonical driver ID：`shengpu.sp30120`
-- instrument kind：`sweep_analyzer`
-- backend：WaveBench 核心 `serial` transport
-- 已声明 capability：`sweep_analyzer.idn`
-- WaveBench：`>=0.8,<0.9`
+## 当前边界
 
-驱动另提供经实机验证的标量状态读取：RF 状态、输入/输出阻抗、中心/跨度与起止频率、CW 频率、频偏、扫描时间、线性/对数模式、连续/单次方式和外部触发状态。该方法只发送固定 allowlist 中的 query，不发送设置命令，也不自动重试设备私有错误。
+production descriptor 只声明 `sweep_analyzer.idn`。driver 还提供经过命令认证的标量状态读取
+和五项厂商专用 RF-OFF 控制，但它们不构成通用 SweepPlan、trace、analysis、configure 或
+trigger capability。精确命令状态、实机证据和拒绝边界见开发文档中的认证矩阵与验收记录。
 
-M0–M3 命令认证在 RF OFF 下确认了 TRIM、参考位置、时钟显示、界面语言和外部触发五类可逆控制各连续 3/3 通过。0.2.0 将它们以厂商专用类型化 API 接入 `SP30120SweepAnalyzer`：`set_trim()`、`set_reference_position()`、`set_clock_display()`、`set_ui_language()` 和 `set_external_trigger()`；对应 read API 只使用各命令的稳定 query。它们不满足通用 SweepPlan 契约，因此 descriptor 仍只声明 `sweep_analyzer.idn`。
-
-每次有效 setter 调用均在同一实例锁中执行一条 canonical 写命令：身份与 RF-OFF 前置检查、完整核心指纹、原值 query、写入、独立精确回读、RF-OFF 后置检查、核心指纹和身份复核。它不重试或自动恢复原值；写入后任一异常、回读差异、RF 非 OFF 或指纹变化都会永久锁存该实例的写路径，之后的写请求零 I/O 拒绝。关闭实例并独立核实仪器状态后才能重新打开。RF ON 只会触发互锁，不会被驱动自动关闭。
-
-通用 `SweepAnalyzerSnapshot` 需要 `FUNC`、功率、平均和测量状态等完整有效计划，而目标固件尚不能稳定查询这些字段，因此 0.2.0 不声明 `sweep_analyzer.status`。`frequency_response` 是通用能力与数据域，不是第二种 instrument kind；M4 曲线 framing、点数、单位和频率轴未验收，所以也不声明 trace、marker、analysis、通用 configure 或 trigger 能力。驱动不提供 RF 输出、频率窗口、SweepPlan、任意 SCPI 或未认证参数写入。
-
-M4 曲线协议确认已完成受控实机探索，但未通过。`OUTPRFORM?` 可重复返回完整 LF 终止的 1002-token 帧（501 个有限幅频候选值 + 501 个零值）；但标准与紧凑拼写的 MODE、POINT、CONT、幅相测量以及 20/200/730 点写入，均未改变独立 `OUTSTATEC?` 快照或曲线布局。该固件也不提供这些配置 query 的可验证读回。0.2.0 因此不声明 trace capability，也不将探索证据推广为频响数据契约。
-
-M4 已加入一个尚未接入 descriptor/driver 的严格离线 parser：它按 LF 累积完整帧，要求单模式恰好 P 个有限值、ALL 恰好 2P 个有限值，并拒绝短帧、长帧、坏 token、非 ASCII、NaN/Inf、尾随数据和无终止符帧。该 parser 已用私有 501+501 完整帧和 739-token 截断帧回归，但这只证明帧校验逻辑，不代表写命令、模式切换、点数、单位、状态恢复或 trace capability 已通过实机验收。
-
-详见[远控协议与能力审计](doc/PROTOCOL_AUDIT.md)、[RS-232 只读协议验收](doc/RS232_READONLY_ACCEPTANCE.md)、[命令认证计划](doc/COMMAND_CERTIFICATION_PLAN.md)和[逐命令矩阵](doc/COMMAND_CERTIFICATION_MATRIX.md)。未达到矩阵门禁的手册命令不会进入驱动。
+当前没有 raw SCPI、RF 输出控制或未经认证的参数写入。曲线 framing、点数、单位和频率轴尚未
+形成可验证合同，因此探索结果不会作为频响能力公开。
 
 ## 安全边界
 
 - descriptor 导入和 registry 发现执行零仪器 I/O；factory 仅通过 `DriverContext.open_transport()` 打开一次核心 transport。
 - 身份校验只接受实机返回的 `SHENGPU SP3000 Series Digital Sweeper` 家族字符串，并仅容忍大小写、空白和末尾句点差异；该字符串本身不能证明子型号或固件版本。
 - `ERRORNo00`–`ERRORNo08` 和目标固件未文档化的 `Error` 都是确定性失败，不自动重试。
-- 0.2.0 仅提供上述五项厂商专用 RF-OFF setter；不提供裸 SCPI、曲线读取、通用状态恢复、Local 切换、RF 控制或其它写命令。
+- 只有认证矩阵列出的厂商专用 RF-OFF setter 可执行写入；不提供裸 SCPI、曲线读取、通用状态恢复、Local 切换、RF 控制或其它写命令。
 - 真实串口路径、序列号和原始日志不得写入公开仓库。
 
-本包当前面向 WaveBench `v0.8.0` release，不能与 `v0.7.0` 配套运行，也不自动声明兼容未来 `0.9`。
-
-## 手册投放位置
-
-将本地 Markdown 手册复制到：
-
-```text
-doc/vendor-local/SP3000A_manual.md
-```
-
-`doc/vendor-local/` 中除说明文件外的内容会被 Git 忽略，整个目录也被 sdist 构建规则排除，不会随仓库推送或公开发行包发布。我们基于手册重新整理的能力矩阵、通信参数、SCPI 摘要、曲线格式和验收计划将放在 `doc/` 中，并清楚区分“手册声明”和“实机验证”。
-
-## 许可证
+## 开发与许可证
 
-本目录中由项目原创的代码和文档采用 [MIT License](LICENSE)。本地保存的厂商手册及其转写不因此获得 MIT 授权，也不属于公开 distribution 的发布内容。
+本地厂商资料的存放和发布边界见[开发文档](doc/README.md)。日常源码开发使用仓库级
+[editable 开发环境](../../doc/DEVELOPMENT.md)。项目原创代码和文档采用 [MIT License](LICENSE)；
+厂商资料不属于公开 distribution。
diff --git a/packages/wavebench-shengpu-sp3000a/README_EN.md b/packages/wavebench-shengpu-sp3000a/README_EN.md
index 3105527..3e92ac8 100644
--- a/packages/wavebench-shengpu-sp3000a/README_EN.md
+++ b/packages/wavebench-shengpu-sp3000a/README_EN.md
@@ -4,51 +4,34 @@
 
 An external WaveBench driver plugin for the Shengpu SP30120 digital sweep analyzer. The distribution retains the early incubation name `wavebench-shengpu-sp3000a`; that name does not assert that the SP30120 is the SP30120A described by the local manual.
 
-## Current status
+## Start here
 
-Version 0.2.0 adds M3.5 vendor-specific, typed RF-OFF controls to the M3 query-only baseline:
+- [Find the current version, compatibility range, model, and capabilities](../../doc/reference/plugin-catalog-en.md)
+- [Browse SP3000A development and evidence documentation](doc/README_EN.md)
+- [Install and manage WaveBench plugins](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-- Distribution: `wavebench-shengpu-sp3000a` 0.2.0
-- Canonical driver ID: `shengpu.sp30120`
-- Instrument kind: `sweep_analyzer`
-- Backend: WaveBench core `serial` transport
-- Declared capability: `sweep_analyzer.idn`
-- WaveBench: `>=0.8,<0.9`
+## Current boundary
 
-The driver also exposes the hardware-verified scalar state subset: RF state, input/output impedance, center/span and start/stop frequencies, CW frequency, offset, sweep time, linear/logarithmic mode, continuous/single execution, and external-trigger state. It sends only fixed allowlisted queries and does not retry device-private errors automatically.
+The production descriptor declares only `sweep_analyzer.idn`. The driver also provides certified
+scalar-state reads and five vendor-specific RF-OFF controls, but they do not constitute generic
+SweepPlan, trace, analysis, configure, or trigger capabilities. The development index links the
+command matrix and acceptance evidence that define exact command states and rejection boundaries.
 
-An M0–M3 command-certification run, with RF held OFF, passed three consecutive reversible cycles for TRIM, reference position, clock display, UI language, and external trigger. Version 0.2.0 exposes them as vendor-specific typed methods on `SP30120SweepAnalyzer`: `set_trim()`, `set_reference_position()`, `set_clock_display()`, `set_ui_language()`, and `set_external_trigger()`; matching read APIs use only each command's stable query. They do not satisfy the generic SweepPlan contract, so the descriptor still declares only `sweep_analyzer.idn`.
-
-Each valid setter invocation performs one canonical write under one instance lock: identity and RF-OFF preflight, a complete core fingerprint, original-value query, write, independent exact readback, RF-OFF postcheck, and core-fingerprint plus identity postchecks. It never retries or restores the original value automatically. Any post-write exception, readback mismatch, RF-not-OFF state, or fingerprint drift permanently latches that instance's write path; later writes are rejected with zero I/O. Close the instance and independently verify the instrument before reopening it. RF ON is only an interlock failure and is never changed automatically.
-
-A generic `SweepAnalyzerSnapshot` requires a complete effective plan including function, power, averaging, and measurement state. Those fields are not reliably queryable on the target firmware, so version 0.2.0 does not declare `sweep_analyzer.status`. `frequency_response` remains a generic capability and data domain, not another instrument kind. M4 trace framing, point count, units, and frequency-axis semantics are unverified, so trace, marker, analysis, generic configure, and trigger capabilities are also omitted. The driver exposes no RF-output, frequency-window, SweepPlan, arbitrary-SCPI, or uncertified-parameter write surface.
-
-M4 trace-protocol confirmation completed controlled hardware exploration but did not pass. `OUTPRFORM?` repeatably returns complete LF-terminated 1002-token frames (501 finite amplitude candidates followed by 501 zeroes); however, canonical and compact MODE, POINT, CONT, amplitude/phase-measurement, and 20/200/730-point writes did not change either an independent `OUTSTATEC?` snapshot or the curve shape. The firmware also supplies no verifiable readback for these configuration queries. Version 0.2.0 therefore declares no trace capability and does not promote exploratory frames into a frequency-response contract.
-
-M4 now includes a strict offline parser that is not wired into the descriptor or driver. It accumulates through LF, requires exactly P finite values for a single mode or 2P finite values for ALL, and rejects short or long frames, malformed tokens, non-ASCII data, NaN/Inf, trailing bytes, and unterminated frames. Private 501+501 complete evidence and a 739-token truncation exercise that parser, but this validates framing logic only; it does not accept write commands, mode changes, point counts, units, restoration, or a trace capability.
-
-See the [remote protocol and capability audit](doc/PROTOCOL_AUDIT_EN.md), [RS-232 read-only protocol acceptance](doc/RS232_READONLY_ACCEPTANCE_EN.md), [command certification plan](doc/COMMAND_CERTIFICATION_PLAN_EN.md), and [per-command matrix](doc/COMMAND_CERTIFICATION_MATRIX_EN.md). Manual-only commands do not enter the driver before satisfying those gates.
+There is no raw-SCPI surface, RF-output control, or uncertified parameter write. Curve framing, point
+counts, units, and frequency-axis semantics do not yet form a verifiable contract, so exploratory
+results are not exposed as frequency-response capability.
 
 ## Safety boundary
 
 - Descriptor import and registry discovery perform zero instrument I/O. The factory opens exactly one core transport through `DriverContext.open_transport()`.
 - Identity validation accepts only the hardware-observed `SHENGPU SP3000 Series Digital Sweeper` family string, with tolerance limited to case, whitespace, and a trailing period. The string does not prove a submodel or firmware version.
 - `ERRORNo00` through `ERRORNo08` and the target firmware's undocumented literal `Error` are deterministic failures and are never retried automatically.
-- Version 0.2.0 exposes only the five vendor-specific RF-OFF setters above; it exposes no raw SCPI, trace acquisition, generic restoration, Local switching, RF control, or other writes.
+- Only vendor-specific RF-OFF setters listed by the certification matrix can write. There is no raw SCPI, trace acquisition, generic restoration, Local switching, RF control, or other write surface.
 - Real serial resources, serial numbers, and raw logs must not enter the public repository.
 
-This package targets the WaveBench `v0.8.0` release. It does not run with `v0.7.0` and does not automatically claim compatibility with a future `0.9` core.
-
-## Manual drop location
-
-Copy the local Markdown manual to:
-
-```text
-doc/vendor-local/SP3000A_manual.md
-```
-
-Git ignores all content under `doc/vendor-local/` except its explanatory README, and the sdist build excludes the entire directory. Local manuals are therefore absent from both repository pushes and public distribution artifacts. Project-authored capability matrices, communication notes, SCPI summaries, trace-format documentation, and acceptance plans will live under `doc/` and will distinguish manual claims from hardware-verified behavior.
-
-## License
+## Development and license
 
-Project-authored code and documentation in this directory are licensed under the [MIT License](LICENSE). Locally retained vendor manuals and transcriptions do not thereby become MIT-licensed and are not part of the public distribution.
+The [development documentation](doc/README_EN.md) defines local vendor-material storage and publishing
+boundaries. Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md)
+for source work. Project-authored code and documentation use the [MIT License](LICENSE); vendor
+material is not part of the public distribution.
diff --git a/packages/wavebench-shengpu-sp3000a/doc/README.md b/packages/wavebench-shengpu-sp3000a/doc/README.md
index e1bd421..af4028f 100644
--- a/packages/wavebench-shengpu-sp3000a/doc/README.md
+++ b/packages/wavebench-shengpu-sp3000a/doc/README.md
@@ -2,14 +2,23 @@
 
 [English](README_EN.md)
 
-本目录用于维护项目原创、可公开的 SP3000A 插件开发资料。
+本目录用于维护项目原创、可公开的 SP3000A 插件开发资料。当前 capability 仍以 production
+descriptor 为准；审计、计划和验收记录不独立提升公共能力。
+
+## 当前 Reference
+
+- [命令认证矩阵](COMMAND_CERTIFICATION_MATRIX.md)：记录命令级实现与证据状态。
+
+## 审计与计划
 
 - [远控协议与能力审计](PROTOCOL_AUDIT.md)
-- [Remote protocol and capability audit](PROTOCOL_AUDIT_EN.md)
+- [命令认证计划](COMMAND_CERTIFICATION_PLAN.md)
+
+## 历史验收证据
+
 - [RS-232 只读协议验收](RS232_READONLY_ACCEPTANCE.md)
-- [RS-232 read-only protocol acceptance](RS232_READONLY_ACCEPTANCE_EN.md)
 
-开发资料优先整理：
+开发资料按以下顺序整理：
 
 1. 型号、固件、接口和阻抗能力矩阵；
 2. LAN、USB Device、RS-232 与可选 GPIB 的通信参数；
@@ -17,4 +26,5 @@
 4. 幅频、相频及曲线数据读取格式；
 5. 直通校准、DUT 测试和交叉验证的分级验收计划。
 
-文档必须标注信息来源和验证状态，不把手册中的能力直接写成实机已通过。完整本地手册放在 [`vendor-local/`](vendor-local/README.md)，不会提交到 Git。
+文档必须标注信息来源和验证状态，不把手册中的能力直接写成实机已通过。完整本地手册放在
+[`vendor-local/`](vendor-local/README.md)，不会提交到 Git。
diff --git a/packages/wavebench-shengpu-sp3000a/doc/README_EN.md b/packages/wavebench-shengpu-sp3000a/doc/README_EN.md
index 89a53cd..da2d33a 100644
--- a/packages/wavebench-shengpu-sp3000a/doc/README_EN.md
+++ b/packages/wavebench-shengpu-sp3000a/doc/README_EN.md
@@ -3,13 +3,23 @@
 [中文](README.md)
 
 This directory contains project-authored, publishable development documentation for the SP3000A plugin.
+The production descriptor remains authoritative for current capabilities; audits, plans, and acceptance
+records do not independently promote public capabilities.
+
+## Current Reference
+
+- [Command certification matrix](COMMAND_CERTIFICATION_MATRIX_EN.md): command-level implementation and evidence status.
+
+## Audits and plans
 
 - [Remote protocol and capability audit](PROTOCOL_AUDIT_EN.md)
-- [远控协议与能力审计](PROTOCOL_AUDIT.md)
+- [Command certification plan](COMMAND_CERTIFICATION_PLAN_EN.md)
+
+## Historical acceptance evidence
+
 - [RS-232 read-only protocol acceptance](RS232_READONLY_ACCEPTANCE_EN.md)
-- [RS-232 只读协议验收](RS232_READONLY_ACCEPTANCE.md)
 
-Development material prioritizes:
+Development material is organized around:
 
 1. model, firmware, interface, and impedance capability matrices;
 2. communication parameters for LAN, USB Device, RS-232, and optional GPIB;
diff --git a/packages/wavebench-siglent-sdg2000x/README.md b/packages/wavebench-siglent-sdg2000x/README.md
index 426e5a7..4ec5ac1 100644
--- a/packages/wavebench-siglent-sdg2000x/README.md
+++ b/packages/wavebench-siglent-sdg2000x/README.md
@@ -2,60 +2,21 @@
 
 [English](README_EN.md)
 
-面向 SIGLENT SDG2042X、SDG2082X 和 SDG2122X 函数/任意波形发生器的 WaveBench 可执行仪器插件。
+面向 SIGLENT SDG2042X、SDG2082X 和 SDG2122X 函数／任意波形发生器的 WaveBench 仪器插件。该包注册 canonical driver ID `siglent.sdg2000x`，不声明 alias，也不覆盖 WaveBench 内置驱动。
 
-## 当前开发基线
+## 从这里开始
 
-版本 `0.8.2` 保留 8 项既有 V1 capability，并新增 `source.snapshot_v2`、`source.basic_configure_v2`、
-`source.output_v2` 和 `source.harmonics_disable_v2`。四项均有 A0 离线合同；`SDG2122X` 固件
-`2.01.01.39R7T2` 已完成 V2 snapshot 的 A1，以及 Basic、Output 和 Harmonic 关闭正常路径的有限 A2 验收。
-A3 已在已确认的高阻 CH1→CH1、CH2→CH2 接线下完成 Basic 的双通道 Sine、Square、Ramp、Pulse 工作点波形验收；
-其它型号或固件、实机故障恢复和发布签核仍未完成。C3 核心实现、候选 wheel manifest 和候选包审计已完成，
-但尚未 push、tag 或发布。完整边界见
-[Source V2 A0 离线适配记录](doc/SDG2000X_SOURCE_V2_A0.md)、[Source V2 A1／A2 实机验收](doc/SDG2000X_SOURCE_V2_A1_A2_ACCEPTANCE.md)
-、[Source V2 A3 实机波形验收](doc/SDG2000X_SOURCE_V2_A3_ACCEPTANCE.md) 和
-[Source V2 C3 候选发布审计](doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT.md)。
+- [查询当前 capability、兼容范围和明确拒绝项](doc/SDG2000X_COVERAGE_MATRIX.md)
+- [查阅开发记录与实机证据](doc/README.md)
+- [在 WaveBench Core 中安装和管理插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-V1 基础接口仍包括 `source.set_frequency`、`source.set_function`、`source.set_amplitude_vpp`、
-`source.set_square_duty_cycle`、`source.output` 和只读 `source.arbitrary_probe`。V2 Basic 当前覆盖
-Sine、Square、Ramp、Pulse 的函数、频率、Vpp 和方波占空比；每次只写一个字段，`offset_v` 尚未开放。
-Noise/DC 保持输出 OFF 的 V1 配置语义：驱动不把 `STDEV` 或标称值伪装为 Vpp，核心会将无法无损表达的
-旧 `set_function` 调用留在 V1 setter。调制、Sweep、Burst、任意波上传和 Counter capability 仍未开放。
+当前元数据版本为 `0.8.2`。包内 `pyproject.toml` 和 production descriptor 是版本、兼容范围与 capability 的权威来源。仓库级[生成式插件目录](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/reference/plugin-catalog.md)提供可检查的摘要。
 
-`source.harmonics_disable_v2` 只关闭已读到的 Harmonic 状态，不配置或启用 Harmonic。它仅在
-`SDG2122X` 固件 `2.01.01.39R7T2` 的 Sine、目标输出 OFF 状态下对 CH1/CH2 生效；已关闭时不发送 MAIN 写入，
-已开启时只发送一条 `HARMSTATE,OFF`。核心随后独立回读 Harmonic 与输出状态。其它型号、固件和所有 Harmonic 配置写入继续拒绝。
+> `source.harmonics_disable_v2` 只适用于 `SDG2122X` 固件 `2.01.01.39R7T2`。登记型号并不表示所有 capability、固件或 profile 可以互相外推。
 
-`SDG2122X` 固件 `2.01.01.39R7T2` 已完成既有 8 项 V1 capability 的实机验收。五项基础写能力均通过核心
-`SourceService` 在 CH1/CH2 闭环；Harmonic、调制、Sweep、Burst、Pulse、Noise/DC、TARB、199 项内置任意波、
-Combine、相位/反相、跟踪/耦合/复制和辅助全局状态也已按可用接线完成协议或 A4 验收。该证据不外推为新
-Source V2 capability 的 A3 结果；后者另见专项 A3 记录。最大实测 4.24 Vpp；最终独立只读会话确认两路 Sine / 1 kHz / 4 Vpp /
-OFF，除 Harmonic 按原状态恢复外，其余复合模式关闭，RTM2032 无过载。
+## 只读起步
 
-## 身份与兼容范围
-
-- distribution：`wavebench-siglent-sdg2000x`
-- canonical driver ID：`siglent.sdg2000x`
-- 已登记型号：`SDG2042X`、`SDG2082X`、`SDG2122X`
-- WaveBench：`>=0.8.24,<0.9`
-- Python：`>=3.11`
-- transport backend：`pyvisa`
-
-该插件不声明 alias，也不覆盖 WaveBench 内置驱动。安装后必须显式配置 canonical ID `siglent.sdg2000x`。
-
-## 本地编程手册
-
-厂商编程手册保存在被忽略的 [`doc/vendor-local/`](doc/vendor-local/README.md) 目录：
-
-```text
-SDG_Series_Programming_Guide_E05C.pdf
-```
-
-手册原文件不进入 Git 或发行包。公开的命令覆盖状态见 [SDG2000X 功能覆盖矩阵](doc/SDG2000X_COVERAGE_MATRIX.md)，分阶段开发门见 [SDG2000X 覆盖里程碑](doc/SDG2000X_COVERAGE_MILESTONES.md)。基础公共接口的最终双通道证据见 [公共 Source 接口双通道验收](doc/SDG2000X_PUBLIC_DUAL_CHANNEL_ACCEPTANCE.md)，其它分域证据列于文末「公开资料」。
-
-## 配置示例
-
-以下片段需合并到已包含 `[connection]` 与 `[scope]` 的有效 `wavebench.toml`。示例使用 RFC 5737 文档保留地址，并以更安全的 `read_only` 状态起步。`source.output` 需要显式改为 `read_write`，同时保留 Vpp 安全上限：
+以下片段需合并到包含 `[connection]` 与 `[scope]` 的有效 `wavebench.toml`。示例使用 RFC 5737 文档保留地址，并从 `read_only` 开始：
 
 ```toml
 [source]
@@ -69,24 +30,19 @@ access = "read_only"
 max_source_vpp = 10.0
 ```
 
-将 `access` 改为 `read_write` 后才能调用基础 Source 写 capability；保留 `read_only` 时，身份和通道状态仍可查询，写操作会由核心拒绝。`check_errors = false` 表示错误队列尚未形成已认证 capability；驱动不会伪装错误队列检查。
+`read_only` 允许身份和状态查询，Core 会拒绝写入。`check_errors = false` 表示当前 descriptor 没有声明错误队列 capability。通用配置字段和运行方式以 [WaveBench Core 配置 Reference](https://github.com/Scaxlibur/wavebench/blob/master/docs/reference/configuration.md)为准。
 
 ## 安全边界
 
 - descriptor 导入不创建 transport，也不访问仪器。
-- factory 只通过 `DriverContext` 打开当前配置的 transport。
-- 默认测试只使用 fake transport，不扫描资源、不连接仪器。
-- `source.output` 开启前必须读取 FIX、Sweep OFF、Vpp 幅度、偏置和所有已知复合波模式，并由核心检查 `max_source_vpp`。
-- `source.set_frequency` 检查型号与当前波形上限；Sweep 自动切回 FIX 只允许在输出 OFF 时执行。
-- `source.set_amplitude_vpp` 只接受 2 mVpp 至 10 Vpp，并要求幅度与偏置不越过 ±10 V 包络。
-- `source.set_function` 允许四种有界周期波实时切换；Noise/DC 必须在输出 OFF 时配置，且不会绕过输出安全门禁。
-- `source.set_square_duty_cycle` 仅适用于 FIX 模式方波；频率相关钳位必须导致回读失败关闭。
-- Source V2 的 Basic 和 Output MAIN 各只发送一个已审计写命令，最终状态由核心独立快照回读；合同允许独立通道同时 ON，但该组合尚无 Source V2 实机验收。
-- Source V2 Harmonic 关闭只在精确的运行时型号/固件、Sine 和输出 OFF 条件下生效；它不会配置或启用 Harmonic，已关闭时不写入，已开启时最多发送一条 `HARMSTATE,OFF`，随后由核心独立回读 Harmonic 与输出状态。
-- Source V2 的 Noise/DC 不猜测 Vpp；无法无损表示的旧 `set_function` 仍调用 V1 setter，输出 ON 继续要求可读最终 Vpp 与 Offset。
-- 目标配置只写入一次；任何写后异常都会尝试 OFF 恢复并锁止本会话的全部配置写入。
-- 除上述 Harmonic 关闭外，高级命令域即使已有分域实机验收，在核心缺少无损模型时仍不开放写 capability，也不提供 raw SCPI。
-- 实机测试必须单独授权，并先确认资源、固件、终止符、输出状态、安全上限和恢复方式。
+- factory 只通过 `DriverContext` 打开已配置的 transport。
+- 默认测试使用 fake transport，不扫描资源、不连接真实仪器。
+- 输出开启需要可读的波形、幅度、偏置和复合模式状态，并由 Core 检查 `max_source_vpp`。
+- profile、型号、固件、输出状态或写后 readback 不符合合同时，操作关闭失败。
+- 高级命令域的历史实机证据不等于当前公共 capability，也不提供 raw SCPI 入口。
+- 实机测试必须单独授权，并预先确认资源、固件、端接、初始输出状态、安全上限和恢复方式。
+
+精确写入范围、Source V2 query budget 和 unsupported 项见[当前能力 Reference](doc/SDG2000X_COVERAGE_MATRIX.md)。
 
 ## 开发验证
 
@@ -96,36 +52,8 @@ python -m ruff check packages/wavebench-siglent-sdg2000x
 python -m wavebench plugin package check packages/wavebench-siglent-sdg2000x
 ```
 
-日常源码开发可使用仓库级 [editable 开发环境](../../doc/DEVELOPMENT.md)。正式验收仍使用真实 wheel 和一次性虚拟环境。
+日常源码开发可使用仓库级 [editable 开发环境](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/DEVELOPMENT.md)。
 
 ## 许可证
 
 本插件采用 [MIT License](LICENSE)。
-
-## 公开资料
-
-- [SIGLENT SDG2000X 产品页](https://www.siglent.com/in/products-overview/sdg2000x/)
-- [SIGLENT Waveform Generator 文档下载页](https://siglentna.com/resources/documents/waveform-generators/)
-- [SDG2000X 协议审计](doc/SDG2000X_PROTOCOL_AUDIT.md)
-- [SDG2000X 只读实机验收](doc/SDG2000X_READONLY_ACCEPTANCE.md)
-- [SDG2000X 输出控制实机验收](doc/SDG2000X_OUTPUT_ACCEPTANCE.md)
-- [SDG2000X 频率写入实机验收](doc/SDG2000X_FREQUENCY_ACCEPTANCE.md)
-- [SDG2000X 基础写入实机验收](doc/SDG2000X_BASIC_WRITE_ACCEPTANCE.md)
-- [SDG2000X Source V2 A0 离线适配记录](doc/SDG2000X_SOURCE_V2_A0.md)
-- [SDG2000X Source V2 A1／A2 实机验收](doc/SDG2000X_SOURCE_V2_A1_A2_ACCEPTANCE.md)
-- [SDG2000X Source V2 A3 实机波形验收](doc/SDG2000X_SOURCE_V2_A3_ACCEPTANCE.md)
-- [SDG2000X Source V2 C3 候选发布审计](doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT.md)
-- [Source V2 能力、状态与复合输出安全 RFC](doc/RFC_SOURCE_V2_CAPABILITY_STATE_SAFETY.md)
-- [SDG2000X 谐波协议与频谱验收](doc/SDG2000X_HARMONIC_ACCEPTANCE.md)
-- [SDG2000X 调制协议与波形验收](doc/SDG2000X_MODULATION_ACCEPTANCE.md)
-- [SDG2000X 扫频协议与波形验收](doc/SDG2000X_SWEEP_ACCEPTANCE.md)
-- [SDG2000X Burst 协议与波形验收](doc/SDG2000X_BURST_ACCEPTANCE.md)
-- [SDG2000X Pulse 协议与波形验收](doc/SDG2000X_PULSE_ACCEPTANCE.md)
-- [SDG2000X 任意波只读探测验收](doc/SDG2000X_ARBITRARY_PROBE_ACCEPTANCE.md)
-- [SDG2000X 内置任意波全目录验收](doc/SDG2000X_BUILTIN_ARB_ACCEPTANCE.md)
-- [SDG2000X 特殊波形协议与实机验收](doc/SDG2000X_SPECIAL_WAVEFORM_ACCEPTANCE.md)
-- [SDG2000X 双通道波形合成验收](doc/SDG2000X_COMBINE_ACCEPTANCE.md)
-- [SDG2000X 相位模式、等相位与反相验收](doc/SDG2000X_PHASE_INVERT_ACCEPTANCE.md)
-- [SDG2000X 通道跟踪、耦合、复制与双通道触发验收](doc/SDG2000X_CHANNEL_INTERACTION_ACCEPTANCE.md)
-- [SDG2000X 辅助与全局状态只读验收](doc/SDG2000X_AUXILIARY_READONLY_ACCEPTANCE.md)
-- [SDG2000X 公共 Source 接口双通道验收](doc/SDG2000X_PUBLIC_DUAL_CHANNEL_ACCEPTANCE.md)
diff --git a/packages/wavebench-siglent-sdg2000x/README_EN.md b/packages/wavebench-siglent-sdg2000x/README_EN.md
index 7f53e96..cf20022 100644
--- a/packages/wavebench-siglent-sdg2000x/README_EN.md
+++ b/packages/wavebench-siglent-sdg2000x/README_EN.md
@@ -2,69 +2,21 @@
 
 [中文](README.md)
 
-An executable WaveBench instrument plugin for the SIGLENT SDG2042X, SDG2082X, and SDG2122X function/arbitrary waveform generators.
-
-## Current development baseline
-
-Version `0.8.2` retains the eight legacy V1 capabilities and adds `source.snapshot_v2`,
-`source.basic_configure_v2`, `source.output_v2`, and `source.harmonics_disable_v2`. All four have A0
-offline contracts. An `SDG2122X` running firmware `2.01.01.39R7T2` has completed A1 for the V2 snapshot and
-limited A2 normal-path acceptance for Basic, Output, and Harmonic disable. A3 completed dual-channel Basic
-Sine, Square, Ramp, and Pulse operating-point waveform acceptance with confirmed high-impedance CH1-to-CH1 and
-CH2-to-CH2 wiring. Other models or firmware, hardware fault recovery, and release sign-off remain incomplete.
-The C3 core implementation, candidate-wheel manifests, and candidate package audit are complete, but no push,
-tag, or publication has occurred. See the
-[Source V2 A0 offline adapter record](doc/SDG2000X_SOURCE_V2_A0_EN.md),
-[Source V2 A1/A2 hardware acceptance](doc/SDG2000X_SOURCE_V2_A1_A2_ACCEPTANCE_EN.md),
-[Source V2 A3 hardware waveform acceptance](doc/SDG2000X_SOURCE_V2_A3_ACCEPTANCE_EN.md), and
-[Source V2 C3 candidate release audit](doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT_EN.md).
-
-The V1 basic surface remains `source.set_frequency`, `source.set_function`,
-`source.set_amplitude_vpp`, `source.set_square_duty_cycle`, `source.output`, and read-only
-`source.arbitrary_probe`. V2 Basic currently covers Sine, Square, Ramp, and Pulse function changes,
-frequency, Vpp, and square duty cycle. Each request writes one field; `offset_v` is not yet exposed.
-Noise/DC retain their V1 output-OFF configuration semantics: the adapter does not represent `STDEV` or a
-nominal value as Vpp, and the core retains the V1 `set_function` setter when no lossless V2 state exists.
-Modulation, sweep, burst, arbitrary-wave upload, and counter capabilities remain disabled.
-
-`source.harmonics_disable_v2` only disables an observed Harmonic state; it neither configures nor enables
-Harmonic. It applies to CH1/CH2 only while an `SDG2122X` with firmware `2.01.01.39R7T2` is in Sine with
-the target output OFF. An already-disabled state sends no MAIN write; an enabled state sends only one
-`HARMSTATE,OFF` command. The core then independently reads Harmonic and output state. Other models,
-firmware revisions, and all Harmonic-configuration writes remain denied.
-
-An `SDG2122X` running firmware `2.01.01.39R7T2` has completed hardware acceptance for the eight legacy V1
-capabilities. All five basic writes passed core `SourceService` closed loops on CH1 and CH2. Harmonic,
-modulation, Sweep, Burst, Pulse, Noise/DC, TARB, all 199 built-ins, Combine, phase/invert,
-tracking/coupling/copy, and auxiliary global state also completed protocol or A4 acceptance where available
-wiring allowed it. This evidence does not establish the separate Source V2 A3 record. The maximum measured output was 4.24
-Vpp; a final independent read-only session confirmed Sine / 1 kHz / 4 Vpp / OFF on both channels, with all
-composite modes other than restored original Harmonic states disabled and no RTM2032 overload.
-
-## Identity and compatibility
-
-- Distribution: `wavebench-siglent-sdg2000x`
-- Canonical driver ID: `siglent.sdg2000x`
-- Registered models: `SDG2042X`, `SDG2082X`, `SDG2122X`
-- WaveBench: `>=0.8.24,<0.9`
-- Python: `>=3.11`
-- Transport backend: `pyvisa`
-
-The plugin declares no aliases and does not override a bundled WaveBench driver. Select the explicit canonical ID `siglent.sdg2000x` after installation.
-
-## Local programming manual
-
-The vendor programming guide is stored under ignored [`doc/vendor-local/`](doc/vendor-local/README.md):
-
-```text
-SDG_Series_Programming_Guide_E05C.pdf
-```
+A WaveBench instrument plugin for the SIGLENT SDG2042X, SDG2082X, and SDG2122X function/arbitrary waveform generators. The package registers the canonical driver ID `siglent.sdg2000x`, declares no aliases, and does not replace a bundled WaveBench driver.
+
+## Start here
+
+- [Check current capabilities, compatibility, and explicit exclusions](doc/SDG2000X_COVERAGE_MATRIX_EN.md)
+- [Read development records and hardware evidence](doc/README_EN.md)
+- [Install and manage plugins with WaveBench Core](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-The original manual is excluded from Git and release artifacts. See the [SDG2000X coverage matrix](doc/SDG2000X_COVERAGE_MATRIX_EN.md) for command-domain status and the [SDG2000X coverage milestones](doc/SDG2000X_COVERAGE_MILESTONES_EN.md) for staged gates. Final dual-channel evidence for the basic public surface is in [public Source API acceptance](doc/SDG2000X_PUBLIC_DUAL_CHANNEL_ACCEPTANCE_EN.md); the remaining domain-specific evidence is listed under “Public references.”
+The current metadata version is `0.8.2`. The package `pyproject.toml` and production descriptor are authoritative for the version, compatibility range, and capabilities. The repository-level generated [plugin catalog](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/reference/plugin-catalog-en.md) provides a checked summary.
 
-## Configuration example
+> `source.harmonics_disable_v2` applies only to `SDG2122X` firmware `2.01.01.39R7T2`. A registered model does not imply that every capability, firmware revision, or profile can be extrapolated across the family.
 
-Merge this fragment into a valid `wavebench.toml` that already contains `[connection]` and `[scope]`. It uses an RFC 5737 documentation address and starts in the safer `read_only` state. Explicitly change to `read_write` for `source.output` while retaining the Vpp safety limit.
+## Read-only start
+
+Merge this fragment into a valid `wavebench.toml` that already contains `[connection]` and `[scope]`. It uses an RFC 5737 documentation address and starts with `read_only` access:
 
 ```toml
 [source]
@@ -78,24 +30,19 @@ access = "read_only"
 max_source_vpp = 10.0
 ```
 
-Change `access` to `read_write` before calling a basic Source write capability. With `read_only`, identity and status remain available while the core denies writes. `check_errors = false` records that no error-queue capability has been accepted; the driver does not pretend to perform an error-queue check.
+`read_only` permits identity and status queries while Core rejects writes. `check_errors = false` records that the current descriptor declares no error-queue capability. See the [WaveBench Core configuration Reference](https://github.com/Scaxlibur/wavebench/blob/master/docs/reference/configuration.md) for generic fields and workflows.
 
 ## Safety boundary
 
-- Descriptor import creates no transport and performs no instrument I/O.
-- The factory opens only the core-provided transport from `DriverContext`.
-- Default tests use a fake transport and neither scan resources nor connect to instruments.
-- Before enabling, `source.output` requires FIX mode, sweep OFF, known Vpp amplitude and offset, every known composite-wave mode OFF, and core enforcement of `max_source_vpp`.
-- `source.set_frequency` enforces model/function limits. Automatic Sweep-to-FIX selection is allowed only while output is OFF.
-- `source.set_amplitude_vpp` accepts 2 mVpp through 10 Vpp and requires the amplitude-plus-offset envelope to remain within ±10 V.
-- `source.set_function` allows live switching among four bounded periodic waves. Noise/DC require output OFF and do not bypass output-enable safety.
-- `source.set_square_duty_cycle` applies only to FIX-mode square waves. Frequency-dependent clamping must fail readback closed.
-- Source V2 Basic and Output MAIN each send one audited write, followed by an independent core snapshot. The contract permits independent outputs to be ON together, but that combination has no Source V2 hardware acceptance yet.
-- Source V2 Harmonic disable applies only to the exact runtime model/firmware while Sine and output OFF are proven; it does not configure or enable Harmonic, sends no write when already disabled, and otherwise sends at most one `HARMSTATE,OFF` before the core independently reads Harmonic and output state.
-- Source V2 does not guess a Noise/DC Vpp. Legacy `set_function` calls without a lossless V2 representation retain the V1 setter; output enable still requires final readable Vpp and Offset.
-- Each target configuration is written once. Any post-write failure attempts OFF recovery and latches all configuration writes for the session.
-- Other advanced command domains have separate hardware evidence, but their write capabilities remain disabled until the core has lossless models; no raw-SCPI endpoint is exposed.
-- Hardware tests require separate authorization and prior confirmation of the resource, firmware, termination, output state, safety limit, and restoration procedure.
+- Importing the descriptor creates no transport and performs no instrument I/O.
+- The factory opens only the configured transport through `DriverContext`.
+- Default tests use fake transports and neither scan resources nor connect to real instruments.
+- Output enable requires readable waveform, amplitude, offset, and composite-mode state, followed by Core enforcement of `max_source_vpp`.
+- A profile, model, firmware, output state, or post-write readback outside the contract fails closed.
+- Historical hardware evidence for an advanced command domain does not create a current public capability or a raw-SCPI endpoint.
+- Hardware tests require separate authorization and prior confirmation of the resource, firmware, termination, initial output state, safety limit, and recovery procedure.
+
+See the [current capability Reference](doc/SDG2000X_COVERAGE_MATRIX_EN.md) for exact writes, the Source V2 query budget, and unsupported areas.
 
 ## Development checks
 
@@ -105,36 +52,8 @@ python -m ruff check packages/wavebench-siglent-sdg2000x
 python -m wavebench plugin package check packages/wavebench-siglent-sdg2000x
 ```
 
-Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md) for ordinary source work. Formal acceptance still uses a real wheel and a disposable virtual environment.
+Use the repository-level [editable development environment](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/DEVELOPMENT_EN.md) for ordinary source work.
 
 ## License
 
-This plugin is licensed under the [MIT License](LICENSE).
-
-## Public references
-
-- [SIGLENT SDG2000X product page](https://www.siglent.com/in/products-overview/sdg2000x/)
-- [SIGLENT waveform-generator document downloads](https://siglentna.com/resources/documents/waveform-generators/)
-- [SDG2000X protocol audit](doc/SDG2000X_PROTOCOL_AUDIT_EN.md)
-- [SDG2000X read-only hardware acceptance](doc/SDG2000X_READONLY_ACCEPTANCE_EN.md)
-- [SDG2000X output-control hardware acceptance](doc/SDG2000X_OUTPUT_ACCEPTANCE_EN.md)
-- [SDG2000X frequency-write hardware acceptance](doc/SDG2000X_FREQUENCY_ACCEPTANCE_EN.md)
-- [SDG2000X basic-write hardware acceptance](doc/SDG2000X_BASIC_WRITE_ACCEPTANCE_EN.md)
-- [SDG2000X Source V2 A0 offline adapter record](doc/SDG2000X_SOURCE_V2_A0_EN.md)
-- [SDG2000X Source V2 A1/A2 hardware acceptance](doc/SDG2000X_SOURCE_V2_A1_A2_ACCEPTANCE_EN.md)
-- [SDG2000X Source V2 A3 hardware waveform acceptance](doc/SDG2000X_SOURCE_V2_A3_ACCEPTANCE_EN.md)
-- [SDG2000X Source V2 C3 candidate release audit](doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT_EN.md)
-- [Source V2 capability, state, and composite-output safety RFC](doc/RFC_SOURCE_V2_CAPABILITY_STATE_SAFETY_EN.md)
-- [SDG2000X harmonic protocol and spectrum acceptance](doc/SDG2000X_HARMONIC_ACCEPTANCE_EN.md)
-- [SDG2000X modulation protocol and waveform acceptance](doc/SDG2000X_MODULATION_ACCEPTANCE_EN.md)
-- [SDG2000X sweep protocol and waveform acceptance](doc/SDG2000X_SWEEP_ACCEPTANCE_EN.md)
-- [SDG2000X Burst protocol and waveform acceptance](doc/SDG2000X_BURST_ACCEPTANCE_EN.md)
-- [SDG2000X Pulse protocol and waveform acceptance](doc/SDG2000X_PULSE_ACCEPTANCE_EN.md)
-- [SDG2000X read-only arbitrary probe acceptance](doc/SDG2000X_ARBITRARY_PROBE_ACCEPTANCE_EN.md)
-- [SDG2000X full built-in arbitrary catalog acceptance](doc/SDG2000X_BUILTIN_ARB_ACCEPTANCE_EN.md)
-- [SDG2000X special-waveform protocol and hardware acceptance](doc/SDG2000X_SPECIAL_WAVEFORM_ACCEPTANCE_EN.md)
-- [SDG2000X dual-channel waveform Combine acceptance](doc/SDG2000X_COMBINE_ACCEPTANCE_EN.md)
-- [SDG2000X phase mode, equal-phase, and invert acceptance](doc/SDG2000X_PHASE_INVERT_ACCEPTANCE_EN.md)
-- [SDG2000X tracking, coupling, copy, and dual-trigger acceptance](doc/SDG2000X_CHANNEL_INTERACTION_ACCEPTANCE_EN.md)
-- [SDG2000X auxiliary and global-state read-only acceptance](doc/SDG2000X_AUXILIARY_READONLY_ACCEPTANCE_EN.md)
-- [SDG2000X public Source API dual-channel acceptance](doc/SDG2000X_PUBLIC_DUAL_CHANNEL_ACCEPTANCE_EN.md)
+This plugin uses the [MIT License](LICENSE).
diff --git a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-basic-configure-a3.json b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-basic-configure-a3.json
index 427b5e5..28c6d4f 100644
--- a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-basic-configure-a3.json
+++ b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-basic-configure-a3.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.24",
   "plugin_version": "0.8.2",
-  "wheel_sha256": "sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e",
+  "wheel_sha256": "sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312",
   "descriptor_digest": "sha256:3ce159e9fecab956062cc776ced3ed4f13be08b6e2ab6b489ae29035488cf4ca",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -57,5 +57,5 @@
     "no simultaneous-output evidence",
     "offset_v remains read-only"
   ],
-  "evidence_digest": "sha256:9df986541abaab313100e2bf20ccbb836d2d973c3449d4933f237548ca24bf58"
+  "evidence_digest": "sha256:cb58f76ce986a528b58da1a04daca30301f5f3068c025c6e86627ebafe6f0c85"
 }
diff --git a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-basic-read-a1.json b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-basic-read-a1.json
index 81e884f..eb1f26b 100644
--- a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-basic-read-a1.json
+++ b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-basic-read-a1.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.24",
   "plugin_version": "0.8.2",
-  "wheel_sha256": "sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e",
+  "wheel_sha256": "sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312",
   "descriptor_digest": "sha256:3ce159e9fecab956062cc776ced3ed4f13be08b6e2ab6b489ae29035488cf4ca",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -48,5 +48,5 @@
     "no output conversion or waveform accuracy claim",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:d07f1b9e94438f1274a8d236e48c34a93fb94ebf69130645c2a691e56440f02b"
+  "evidence_digest": "sha256:bd7dc3c781e91fcab552945a12c98352c452cd113e7accb87e61875db0039c44"
 }
diff --git a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-disable-ch1-a2.json b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-disable-ch1-a2.json
index f1a4bb8..7b2a059 100644
--- a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-disable-ch1-a2.json
+++ b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-disable-ch1-a2.json
@@ -12,7 +12,7 @@
   "channels": [1],
   "core_version": "0.8.24",
   "plugin_version": "0.8.2",
-  "wheel_sha256": "sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e",
+  "wheel_sha256": "sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312",
   "descriptor_digest": "sha256:3ce159e9fecab956062cc776ced3ed4f13be08b6e2ab6b489ae29035488cf4ca",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -50,5 +50,5 @@
     "no harmonic configure or enable claim",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:183b716bddf50fa1708f2d3f17c4b48f7f22f5ce068147b43f7e5cc0a481d0af"
+  "evidence_digest": "sha256:4940a213fa44c5655125cfa328e1f1c9eb462b682f2887910aaa261d0c08e189"
 }
diff --git a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-disable-ch2-a0.json b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-disable-ch2-a0.json
index 1ebb8b7..992da83 100644
--- a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-disable-ch2-a0.json
+++ b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-disable-ch2-a0.json
@@ -12,7 +12,7 @@
   "channels": [2],
   "core_version": "0.8.24",
   "plugin_version": "0.8.2",
-  "wheel_sha256": "sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e",
+  "wheel_sha256": "sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312",
   "descriptor_digest": "sha256:3ce159e9fecab956062cc776ced3ed4f13be08b6e2ab6b489ae29035488cf4ca",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -48,5 +48,5 @@
     "no harmonic configure or enable claim",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:c170b3bae0e316c5703c528ceaac3020f8f275779389949a1c28cd9edf2d7ad8"
+  "evidence_digest": "sha256:cf5bf1416fe3ec652a007eaa65182cedb8015c4bfd3954c48752ccf63fa6ea91"
 }
diff --git a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-read-a1.json b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-read-a1.json
index 1f18228..f105d6e 100644
--- a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-read-a1.json
+++ b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-harmonics-read-a1.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.24",
   "plugin_version": "0.8.2",
-  "wheel_sha256": "sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e",
+  "wheel_sha256": "sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312",
   "descriptor_digest": "sha256:3ce159e9fecab956062cc776ced3ed4f13be08b6e2ab6b489ae29035488cf4ca",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -49,5 +49,5 @@
     "no harmonic configure or enable claim",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:953981af990b35418eb2298478a1d44bfbca0b25c07272161e0e631194664f05"
+  "evidence_digest": "sha256:fd8dfda4cdd257d04cff1aa0812779e138ad76aab142e56cfbcdc58fca9c8b8e"
 }
diff --git a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-disable-a2.json b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-disable-a2.json
index 37cbaea..aeac7ba 100644
--- a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-disable-a2.json
+++ b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-disable-a2.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.24",
   "plugin_version": "0.8.2",
-  "wheel_sha256": "sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e",
+  "wheel_sha256": "sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312",
   "descriptor_digest": "sha256:3ce159e9fecab956062cc776ced3ed4f13be08b6e2ab6b489ae29035488cf4ca",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -48,5 +48,5 @@
     "no simultaneous-output evidence",
     "no other load firmware or model"
   ],
-  "evidence_digest": "sha256:93dc4a86c35041c742a9241cbeb81b5536040eac7efe20556c7b1d1c79cc3cec"
+  "evidence_digest": "sha256:588dac9eb40a939261c62623d235a7c320ab4e8e294ac52306fb0f8f7ca402f6"
 }
diff --git a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-enable-a2.json b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-enable-a2.json
index 4237a19..0e43c69 100644
--- a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-enable-a2.json
+++ b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-enable-a2.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.24",
   "plugin_version": "0.8.2",
-  "wheel_sha256": "sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e",
+  "wheel_sha256": "sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312",
   "descriptor_digest": "sha256:3ce159e9fecab956062cc776ced3ed4f13be08b6e2ab6b489ae29035488cf4ca",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -48,5 +48,5 @@
     "no simultaneous-output evidence",
     "no other load firmware or model"
   ],
-  "evidence_digest": "sha256:264c891ca9f2ffc523ddb67625bd57e1fb326fe7c2d80d7d3d1653ace140611d"
+  "evidence_digest": "sha256:c1c2c8b93ebfa9c9ac51bda232ff1f8b5b42ceaf9cdb1b72b228ed09c457c86a"
 }
diff --git a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-read-a1.json b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-read-a1.json
index c3d51c8..8f55519 100644
--- a/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-read-a1.json
+++ b/packages/wavebench-siglent-sdg2000x/conformance/sdg2122x-output-read-a1.json
@@ -12,7 +12,7 @@
   "channels": [1, 2],
   "core_version": "0.8.24",
   "plugin_version": "0.8.2",
-  "wheel_sha256": "sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e",
+  "wheel_sha256": "sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312",
   "descriptor_digest": "sha256:3ce159e9fecab956062cc776ced3ed4f13be08b6e2ab6b489ae29035488cf4ca",
   "source_contract_version": "wavebench.source.v2",
   "fixture": {
@@ -48,5 +48,5 @@
     "no output conversion or simultaneous-output claim",
     "no other firmware or model"
   ],
-  "evidence_digest": "sha256:f3c1786dff774d2f469674885742f8f09c0c8b1d994ae80b38f358a741d37eb7"
+  "evidence_digest": "sha256:7c7ebc564cc12c786ea97336121ca23c667540df96288085e529a9733aa0ea10"
 }
diff --git a/packages/wavebench-siglent-sdg2000x/doc/README.md b/packages/wavebench-siglent-sdg2000x/doc/README.md
new file mode 100644
index 0000000..185f50f
--- /dev/null
+++ b/packages/wavebench-siglent-sdg2000x/doc/README.md
@@ -0,0 +1,55 @@
+# SDG2000X 插件文档
+
+[English](README_EN.md)
+
+本页将 SDG2000X 的当前使用合同与开发、协议和实机证据分开。production descriptor 声明当前 capability；验收记录保留特定型号、固件、接线和时间点的证据，不独立提升公共能力。
+
+## 当前 Reference
+
+- [SDG2000X 当前能力 Reference](SDG2000X_COVERAGE_MATRIX.md)：当前 capability、Source V2 型号／固件限制、安全行为和明确拒绝项。
+- [仓库级插件目录](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/reference/plugin-catalog.md)：由 `pyproject.toml` 与 descriptor 生成的版本、入口点和 capability 摘要。
+
+## 开发与合同记录
+
+- [协议审计](SDG2000X_PROTOCOL_AUDIT.md)
+- [覆盖里程碑](SDG2000X_COVERAGE_MILESTONES.md)
+- [Source V2 A0 离线适配记录](SDG2000X_SOURCE_V2_A0.md)
+- [Source V2 A1／A2 实机验收](SDG2000X_SOURCE_V2_A1_A2_ACCEPTANCE.md)
+- [Source V2 A3 实机波形验收](SDG2000X_SOURCE_V2_A3_ACCEPTANCE.md)
+- [Source V2 C3 候选包审计](SDG2000X_SOURCE_V2_RELEASE_AUDIT.md)
+- [Source V2 能力、状态与复合输出安全 RFC](RFC_SOURCE_V2_CAPABILITY_STATE_SAFETY.md)
+
+这些页面记录实施与评审过程。当前实现与文档冲突时，以包元数据、production descriptor、driver 和测试为准。
+
+## 基础接口验收证据
+
+- [只读实机验收](SDG2000X_READONLY_ACCEPTANCE.md)
+- [输出控制实机验收](SDG2000X_OUTPUT_ACCEPTANCE.md)
+- [频率写入实机验收](SDG2000X_FREQUENCY_ACCEPTANCE.md)
+- [基础写入实机验收](SDG2000X_BASIC_WRITE_ACCEPTANCE.md)
+- [公共 Source 接口双通道验收](SDG2000X_PUBLIC_DUAL_CHANNEL_ACCEPTANCE.md)
+
+## 高级命令域证据
+
+- [谐波协议与频谱验收](SDG2000X_HARMONIC_ACCEPTANCE.md)
+- [调制协议与波形验收](SDG2000X_MODULATION_ACCEPTANCE.md)
+- [Sweep 协议与波形验收](SDG2000X_SWEEP_ACCEPTANCE.md)
+- [Burst 协议与波形验收](SDG2000X_BURST_ACCEPTANCE.md)
+- [Pulse 协议与波形验收](SDG2000X_PULSE_ACCEPTANCE.md)
+- [任意波只读探测验收](SDG2000X_ARBITRARY_PROBE_ACCEPTANCE.md)
+- [内置任意波全目录验收](SDG2000X_BUILTIN_ARB_ACCEPTANCE.md)
+- [特殊波形协议与实机验收](SDG2000X_SPECIAL_WAVEFORM_ACCEPTANCE.md)
+- [双通道波形合成验收](SDG2000X_COMBINE_ACCEPTANCE.md)
+- [相位模式、等相位与反相验收](SDG2000X_PHASE_INVERT_ACCEPTANCE.md)
+- [通道跟踪、耦合、复制与双通道触发验收](SDG2000X_CHANNEL_INTERACTION_ACCEPTANCE.md)
+- [辅助与全局状态只读验收](SDG2000X_AUXILIARY_READONLY_ACCEPTANCE.md)
+
+高级命令域存在验收证据，不表示对应公共 capability 已进入 production descriptor。
+
+## 厂商资料
+
+- [SIGLENT SDG2000X 产品页](https://www.siglent.com/in/products-overview/sdg2000x/)
+- [SIGLENT Waveform Generator 文档下载页](https://siglentna.com/resources/documents/waveform-generators/)
+- 源码 checkout 中的 `doc/vendor-local/` 使用说明
+
+`doc/vendor-local/` 只存在于源码 checkout；厂商原文和转换稿不进入 Git 或 distribution。返回 [SDG2000X 插件入口](../README.md)。
diff --git a/packages/wavebench-siglent-sdg2000x/doc/README_EN.md b/packages/wavebench-siglent-sdg2000x/doc/README_EN.md
new file mode 100644
index 0000000..630da36
--- /dev/null
+++ b/packages/wavebench-siglent-sdg2000x/doc/README_EN.md
@@ -0,0 +1,55 @@
+# SDG2000X Plugin Documentation
+
+[中文](README.md)
+
+This page separates the current SDG2000X user contract from development, protocol, and hardware evidence. The production descriptor declares current capabilities. Acceptance records preserve evidence for a particular model, firmware, wiring, and point in time; they do not independently promote public capabilities.
+
+## Current Reference
+
+- [SDG2000X current capability Reference](SDG2000X_COVERAGE_MATRIX_EN.md): current capabilities, Source V2 model/firmware restrictions, safety behavior, and explicit exclusions.
+- [Repository plugin catalog](https://github.com/Scaxlibur/wavebench-instrument-plugins/blob/main/doc/reference/plugin-catalog-en.md): generated metadata version, entry-point, and capability summary from `pyproject.toml` and the descriptor.
+
+## Development and contract records
+
+- [Protocol audit](SDG2000X_PROTOCOL_AUDIT_EN.md)
+- [Coverage milestones](SDG2000X_COVERAGE_MILESTONES_EN.md)
+- [Source V2 A0 offline adapter record](SDG2000X_SOURCE_V2_A0_EN.md)
+- [Source V2 A1/A2 hardware acceptance](SDG2000X_SOURCE_V2_A1_A2_ACCEPTANCE_EN.md)
+- [Source V2 A3 hardware waveform acceptance](SDG2000X_SOURCE_V2_A3_ACCEPTANCE_EN.md)
+- [Source V2 C3 candidate-package audit](SDG2000X_SOURCE_V2_RELEASE_AUDIT_EN.md)
+- [Source V2 capability, state, and composite-output safety RFC](RFC_SOURCE_V2_CAPABILITY_STATE_SAFETY_EN.md)
+
+These pages preserve implementation and review history. If they conflict with current behavior, package metadata, the production descriptor, the driver, and tests take precedence.
+
+## Basic-interface acceptance evidence
+
+- [Read-only hardware acceptance](SDG2000X_READONLY_ACCEPTANCE_EN.md)
+- [Output-control hardware acceptance](SDG2000X_OUTPUT_ACCEPTANCE_EN.md)
+- [Frequency-write hardware acceptance](SDG2000X_FREQUENCY_ACCEPTANCE_EN.md)
+- [Basic-write hardware acceptance](SDG2000X_BASIC_WRITE_ACCEPTANCE_EN.md)
+- [Public Source API dual-channel acceptance](SDG2000X_PUBLIC_DUAL_CHANNEL_ACCEPTANCE_EN.md)
+
+## Advanced command-domain evidence
+
+- [Harmonic protocol and spectrum acceptance](SDG2000X_HARMONIC_ACCEPTANCE_EN.md)
+- [Modulation protocol and waveform acceptance](SDG2000X_MODULATION_ACCEPTANCE_EN.md)
+- [Sweep protocol and waveform acceptance](SDG2000X_SWEEP_ACCEPTANCE_EN.md)
+- [Burst protocol and waveform acceptance](SDG2000X_BURST_ACCEPTANCE_EN.md)
+- [Pulse protocol and waveform acceptance](SDG2000X_PULSE_ACCEPTANCE_EN.md)
+- [Read-only arbitrary probe acceptance](SDG2000X_ARBITRARY_PROBE_ACCEPTANCE_EN.md)
+- [Full built-in arbitrary catalog acceptance](SDG2000X_BUILTIN_ARB_ACCEPTANCE_EN.md)
+- [Special-waveform protocol and hardware acceptance](SDG2000X_SPECIAL_WAVEFORM_ACCEPTANCE_EN.md)
+- [Dual-channel waveform Combine acceptance](SDG2000X_COMBINE_ACCEPTANCE_EN.md)
+- [Phase mode, equal-phase, and invert acceptance](SDG2000X_PHASE_INVERT_ACCEPTANCE_EN.md)
+- [Tracking, coupling, copy, and dual-trigger acceptance](SDG2000X_CHANNEL_INTERACTION_ACCEPTANCE_EN.md)
+- [Auxiliary and global-state read-only acceptance](SDG2000X_AUXILIARY_READONLY_ACCEPTANCE_EN.md)
+
+Acceptance evidence for an advanced command domain does not imply that a corresponding public capability exists in the production descriptor.
+
+## Vendor material
+
+- [SIGLENT SDG2000X product page](https://www.siglent.com/in/products-overview/sdg2000x/)
+- [SIGLENT waveform-generator document downloads](https://siglentna.com/resources/documents/waveform-generators/)
+- `doc/vendor-local/` usage in a source checkout
+
+`doc/vendor-local/` exists only in a source checkout. Vendor originals and converted copies are excluded from Git and distributions. Return to the [SDG2000X plugin landing page](../README_EN.md).
diff --git a/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_COVERAGE_MATRIX.md b/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_COVERAGE_MATRIX.md
index 933ebdd..6dd6d3f 100644
--- a/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_COVERAGE_MATRIX.md
+++ b/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_COVERAGE_MATRIX.md
@@ -1,84 +1,74 @@
-# SDG2000X 功能覆盖矩阵
+# SDG2000X 当前能力 Reference
 
 [English](SDG2000X_COVERAGE_MATRIX_EN.md)
 
-## 当前结论
-
-版本 `0.8.2` 声明 12 项 capability：既有的身份、状态、五项基础写能力和任意波只读探测，以及
-`source.snapshot_v2`、`source.basic_configure_v2`、`source.output_v2` 和 `source.harmonics_disable_v2`。前 8 项已有 `SDG2122X`
-核心消费路径实机证据；新增 4 项均有 A0 离线合同。对精确的 `SDG2122X`／`2.01.01.39R7T2` 目标，已完成 V2 快照的
-A1，以及 Basic、Output 和 Harmonic 关闭正常路径的有限 A2。Basic 已在确认的高阻 CH1→CH1、CH2→CH2 接线下完成
-双通道 A3 工作点波形验收；该证据不外推到其它型号、固件、频率／幅度范围、功能字段或故障恢复。
-其中 Harmonic 关闭仅对 `SDG2122X` 固件 `2.01.01.39R7T2` 适用。三个登记型号的
-V1 capability 仍按共同手册合同和离线型号矩阵放行。
-
-Source V2 的 C3 核心实现、候选 wheel manifest 和候选包审计已完成；稳定核心、最终发行物与正式发布签核仍待完成，详见 [C3 候选发布审计](SDG2000X_SOURCE_V2_RELEASE_AUDIT.md)。
-
-高级命令域已完成尽可能全面的分域协议/A4 验收，但核心缺少无损状态模型时继续不声明写 capability，也不提供 raw SCPI。历史覆盖率数字只对应版本 `0.8.0`；新增 Source V2 代码的当前覆盖率以本次离线测试报告为准，不用旧数字替代验证。代码覆盖不替代未接外部端口和未持有型号的物理证据。
-
-## 覆盖状态
-
-| 命令域 | WaveBench capability | 当前状态 | 放行条件 |
-| --- | --- | --- | --- |
-| 仪器身份 | `source.idn` | `SDG2122X` / `2.01.01.39R7T2` 实机通过；其它登记型号按共同协议放行 | 新型号或协议变体仍需脱敏证据 |
-| 系统错误队列 | 无 | 未开放 | 确认查询命令、空队列语义和是否为消费型读取 |
-| 通道基础状态 | `source.status` | SDG2122X 多轮只读稳定；CH1/CH2 均完成频率、Vpp、均值和最终独立零写审计 | 新固件响应变体需单独验收 |
-| Source V2 快照 | `source.snapshot_v2` | A0 完成：CH1/CH2 纯读取 anchor/facet/anchor、38 查询 Sine fixture、0 写入，声明上限为 44；A1：精确目标实机双通道 38 查询、0 写入，快照一致且 session healthy | 其它型号、固件或响应变体单独验收 |
-| Source V2 基础配置 | `source.basic_configure_v2` | A0 完成：CH1/CH2 的 Sine/Square/Ramp/Pulse 单字段 Basic MAIN 写入、核心回读与一次 OFF 恢复；`offset_v` 暂在写前拒绝。有限 A2：精确目标在输出 OFF 时对 CH1/CH2 各完成一次 1 Vpp 单字段写入及独立回读。A3：确认高阻 CH1→CH1、CH2→CH2 接线下，CH1/CH2 的 Sine/Square/Ramp/Pulse 均在 2 kHz／2 Vpp 工作点完成 scope capture；两次方波均确认 25% 占空比 | 其它型号、固件、频率／幅度范围、负载和实机拒绝／故障恢复不作声明；`offset_v` 继续不开放写入 |
-| Source V2 输出 | `source.output_v2` | A0 完成：CH1/CH2 独立 ON/OFF、单写 MAIN、核心回读、可读不匹配时一次 OFF 恢复；独立端口可同时 ON。有限 A2：精确目标的 CH1、CH2 分别完成 ON 与 OFF 及独立回读，最终均 OFF | 不声明实机同时 ON、故障恢复或其它型号／固件结果 |
-| 输出控制 | `source.output` | 三个型号通过离线合同；SDG2122X CH1/CH2 通过核心 Service ON→A4→OFF，未知写结果为 0 | 其它型号 A4 仅在有样机时补充 |
-| 固定波频率 | `source.set_frequency` | SDG2122X CH1/CH2 均覆盖 OFF 写入和 ON 状态实时写入；按型号/函数边界离线全覆盖 | 其它型号 A4 仅在有样机时补充 |
-| 固定波幅度 | `source.set_amplitude_vpp` | SDG2122X CH1/CH2 均覆盖 OFF 与 ON 实时写入；2 mVpp–10 Vpp、偏置包络和漂移分支 100% 覆盖 | 其它型号 A4 仅在有样机时补充 |
-| 固定波函数 | `source.set_function` | Sine/Square/Ramp 在 CH1/CH2 经核心闭环；Pulse 在 CH2 闭环；Noise/DC 只允许 OFF 配置 | Noise/DC 等待可复用安全模型 |
-| 方波占空比 | `source.set_square_duty_cycle` | CH2 20%/80% 实测 0.200/0.800；最终 CH1 30%、CH2 70% 实测 0.287/0.6949 | 高频频率相关钳位仍由严格回读 fail closed |
-| Pulse 参数 | 无损 capability 暂缺 | SDG2122X 25%/65% 占空比、20/40 µs 边沿通过 A4；DLY 仅 A3 | Source V2 支持未知 hold 后再声明；补独立延迟参考 |
-| 谐波 | `source.harmonics_disable_v2`，仅 `SDG2122X` / `2.01.01.39R7T2` | A0：在 Sine、目标输出 OFF 时，已关闭为零写入，已开启仅发送一条 `HARMSTATE,OFF`，并由核心独立回读 Harmonic 与输出。A1／有限 A2：精确目标的 Harmonic facet 可读，CH1 完成一次关闭写入并独立回读 Harmonic OFF／输出 OFF；SDG2122X H2–H16 槽位、H2/H3 幅度、H2 相位和 ALL/EVEN/ODD 仍是旧 A4 证据 | Harmonic 配置／启用继续等待更完整的 Source V2 模型；不外推到其它型号或固件 |
-| 调制 | 无损 capability 暂缺 | SDG2122X 内部 AM/DSB-AM/FM/PM/PWM/ASK/FSK/PSK 均通过协议与 A4 波形 | Source V2 支持关闭态缺省与厂商范围后再声明；外部源需接线 |
-| Sweep | 无损 capability 暂缺 | SDG2122X LINE/LOG/STEP、UP/DOWN/UP_DOWN 与 INT/MAN 通过协议和 A4 波形；EXT 仅回读 | Source V2 支持字段缺省后再声明；补外部触发线 |
-| Burst | 无损 capability 暂缺 | 有限 INT/MAN 通过周期数/重复周期 A4；`TRDUCH` CH2→双路通过；EXT/Gate 仅回读；INF 未形成连续载波 | 补外部触发/门控接线；Source V2 采用判别联合 |
-| Noise / DC / TARB | 无损 capability 暂缺 | Noise 与 -1/0/+1 V DC 通过 A4；20 MHz 下限钳位 A3；TARB 1 MSa/s 非平坦输出通过；Noise Add 在样机上稳定保持 OFF | 使用非周期 amplitude facet；Noise Add 需其它固件复核 |
-| 任意波形 | `source.arbitrary_probe` | 双通道核心零写探测通过；内置目录 199/199 选择、回读与 A4；TARB 另有 A4 | 上传、删除和用户目录继续默认拒绝 |
-| Combine | 无损 capability 暂缺 | CH1←CH2 与 CH2←CH1 双向异频 A4；源通道输出继电器无需开启 | 建模参与通道、最坏包络和互斥状态后再声明 |
-| 相位模式 / Invert | 无损 capability 暂缺 | `EQPHASE` 后差 0.27°；CH1/CH2 反相约 179.9°；实机 token 为 `PHASE-LOCKED` | 拆分单字段 polarity/phase facet 后再声明 |
-| 跟踪 / 耦合 / 复制 | 无损 capability 暂缺 | TRACE、F/P/A ratio/deviation、CH1→CH2 PACP 均有 A4；反向 PACP 有 A3 | Source V2 表达条件字段、动作和跨通道事务 |
-| Sync / Counter / 时钟 / Cascade | 无 | 18 查询零写轮次通过；Sync 与 Counter OFF、ROSC INT、Cascade OFF；未接端口不宣称 A4 | 补 Sync、Counter、外部参考和第二台源的专用接线 |
-| 代码路径 | 不适用 | V1 历史版本为 348 项测试、620/620 statements、244/244 branches；本次新增 V2 A0 测试单独执行 | 运行当前插件测试与覆盖率报告；不以空断言刷数值 |
-
-## 默认拒绝项
-
-- 不发送 `*RST` 或其它全局预置命令。
-- 面向用户的输出开启只能经 `source.output` 或 `source.output_v2` 的核心 operation contract 执行；高级实机脚本不是公共 raw 接口。
-- 不提供 raw SCPI 入口。
-- 不上传、不删除、不覆盖用户任意波或状态文件。
-- 不为覆盖率切换外部参考、保护、Counter、Cascade 或未知负载的辅助输出。
-- 不把产品页列出的功能直接等同于已实现 capability。
-
-## 事实源
-
-- [SIGLENT SDG2000X 产品页](https://www.siglent.com/in/products-overview/sdg2000x/)
-- [SIGLENT Waveform Generator 文档下载页](https://siglentna.com/resources/documents/waveform-generators/)
-- 本地编程手册：`doc/vendor-local/SDG_Series_Programming_Guide_E05C.pdf`，修订号 `PG02_E05C`
-- [协议审计](SDG2000X_PROTOCOL_AUDIT.md)
-- [只读实机验收](SDG2000X_READONLY_ACCEPTANCE.md)
-- [输出控制实机验收](SDG2000X_OUTPUT_ACCEPTANCE.md)
-- [频率写入实机验收](SDG2000X_FREQUENCY_ACCEPTANCE.md)
-- [基础写入实机验收](SDG2000X_BASIC_WRITE_ACCEPTANCE.md)
-- [Source V2 A0 离线适配记录](SDG2000X_SOURCE_V2_A0.md)
-- [Source V2 A1／A2 实机验收](SDG2000X_SOURCE_V2_A1_A2_ACCEPTANCE.md)
-- [Source V2 A3 实机波形验收](SDG2000X_SOURCE_V2_A3_ACCEPTANCE.md)
-- [Source V2 C3 发布审计准备](SDG2000X_SOURCE_V2_RELEASE_AUDIT.md)
-- [谐波协议与频谱验收](SDG2000X_HARMONIC_ACCEPTANCE.md)
-- [调制协议与波形验收](SDG2000X_MODULATION_ACCEPTANCE.md)
-- [Sweep 协议与波形验收](SDG2000X_SWEEP_ACCEPTANCE.md)
-- [Burst 协议与波形验收](SDG2000X_BURST_ACCEPTANCE.md)
-- [Pulse 协议与波形验收](SDG2000X_PULSE_ACCEPTANCE.md)
-- [任意波只读探测验收](SDG2000X_ARBITRARY_PROBE_ACCEPTANCE.md)
-- [内置任意波全目录验收](SDG2000X_BUILTIN_ARB_ACCEPTANCE.md)
-- [公共 Source 接口双通道验收](SDG2000X_PUBLIC_DUAL_CHANNEL_ACCEPTANCE.md)
-- [特殊波形协议与实机验收](SDG2000X_SPECIAL_WAVEFORM_ACCEPTANCE.md)
-- [双通道波形合成验收](SDG2000X_COMBINE_ACCEPTANCE.md)
-- [相位模式、等相位与反相验收](SDG2000X_PHASE_INVERT_ACCEPTANCE.md)
-- [通道跟踪、耦合、复制与双通道触发验收](SDG2000X_CHANNEL_INTERACTION_ACCEPTANCE.md)
-- [辅助与全局状态只读验收](SDG2000X_AUXILIARY_READONLY_ACCEPTANCE.md)
-- [Source V2 通用 RFC](RFC_SOURCE_V2_CAPABILITY_STATE_SAFETY.md)
-- 当前 descriptor、driver 和 fake transport 测试
+本页说明 `siglent.sdg2000x` production descriptor 当前声明的 capability、适用范围和失败边界。包元数据版本为 `0.8.2`；该值表示仓库内的源码合同，不依赖独立的 PyPI、Git tag 或 GitHub Release 状态。
+
+## Synopsis
+
+| 项目 | 当前值 |
+| --- | --- |
+| Distribution | `wavebench-siglent-sdg2000x` |
+| Driver ID | `siglent.sdg2000x` |
+| 登记型号 | `SDG2042X`、`SDG2082X`、`SDG2122X` |
+| WaveBench | `>=0.8.24,<0.9` |
+| Python | `>=3.11` |
+| Backend | `pyvisa` |
+| 配置字段 | `source.resource`、`source.driver`、`safety_limits.max_source_vpp` |
+
+Source V2 topology 包含 CH1 和 CH2。快照 query contract 为 pure read，预算上限 `44` 次 query，timeout 为 `5000 ms`。
+
+## 当前 capability
+
+| Capability | 精确范围与行为 |
+| --- | --- |
+| `source.idn` | 读取并匹配 SDG2000X 系列身份。 |
+| `source.status` | 读取指定通道的基础波形、频率、幅度、偏置和输出状态。 |
+| `source.set_frequency` | 设置固定波频率；检查型号与当前波形边界。Sweep 自动切回 FIX 只允许在输出 OFF 时发生。 |
+| `source.set_function` | 设置有界周期波；Sine、Square、Ramp 和 Pulse 可以按合同切换，Noise／DC 只允许在输出 OFF 时配置。 |
+| `source.set_amplitude_vpp` | 设置 `2 mVpp–10 Vpp`；幅度与偏置包络必须保持在 `±10 V` 内。 |
+| `source.set_square_duty_cycle` | 仅适用于 FIX 模式 Square；频率相关钳位或 readback 不匹配时关闭失败。 |
+| `source.output` | 读取、开启或关闭通道输出；开启前要求 FIX、可读的 Vpp／Offset、已知复合模式关闭和 `max_source_vpp` 检查。 |
+| `source.arbitrary_probe` | 只读探测任意波状态；不上传、删除或覆盖波形。 |
+| `source.snapshot_v2` | 对 CH1／CH2 执行 anchor／facet／anchor 纯读取；包含 identity、Basic、Output 和按激活条件读取的 Harmonics facet。 |
+| `source.basic_configure_v2` | 对 CH1／CH2 的 Sine、Square、Ramp、Pulse 执行单字段 Basic MAIN 配置；支持 fixed frequency、Vpp 和 Square duty，`offset_v` 当前不开放写入。 |
+| `source.output_v2` | 独立读取、开启或关闭 CH1／CH2；每次 MAIN 只写目标字段，随后由 Core 独立读取快照。 |
+| `source.harmonics_disable_v2` | 仅适用于 `SDG2122X`／`2.01.01.39R7T2`、Sine 和目标输出 OFF；只读取或关闭 Harmonic，不配置或开启。 |
+
+## Source V2 的型号与固件限制
+
+Basic 和 Output feature 的 descriptor applicability 没有附加型号或固件限制，适用于登记型号的运行时合同。当前受控实机证据主要来自 `SDG2122X` 固件 `2.01.01.39R7T2`；该证据不会替代 descriptor，也不会自动证明其它型号、固件和物理工作点。
+
+Harmonic feature 具有显式限制：
+
+- 型号必须是 `SDG2122X`；
+- 固件必须是 `2.01.01.39R7T2`；
+- 目标通道必须为 Sine，且输出为 OFF；
+- 已关闭时不发送 MAIN 写入；已开启时只发送一条 `HARMSTATE,OFF`；
+- Core 随后独立回读 Harmonic 与输出状态。
+
+Harmonic profile 可读取 2–16 次谐波和绝对 Vpp／相对 dB 幅度，但当前公共写方向只有 `DISABLE`。
+
+## Side effects 与失败行为
+
+- descriptor 导入不访问仪器；factory 只打开已配置的 transport。
+- `read_only` session 只允许读取，Core 在写入前拒绝不匹配的 access。
+- V1 与 V2 写操作都必须满足目标通道、波形、输出、安全上限和 readback 合同。
+- V2 Basic 和 Output 的目标配置各只写一次；写后异常会尝试输出 OFF，并锁止当前 session 的后续配置写入。
+- Source V2 不把 Noise／DC 的 `STDEV` 或标称值伪装成 Vpp；无法无损表达时保留 V1 的安全路径。
+- 不通过历史 harness 或 raw SCPI 绕过当前 descriptor。
+
+## 当前不支持
+
+production descriptor 不声明错误队列、调制、Sweep、Burst、Pulse 参数、任意波上传／删除、Combine、相位／Invert、跟踪／耦合／复制、Sync、Counter、外部参考、Cascade 或 raw SCPI capability。
+
+部分命令域具有受控实机证据，但在 Core 缺少无损模型或 descriptor 未声明 capability 时，仍属于 unavailable。证据用于追溯，不是第二份当前能力表。
+
+## Sources
+
+- [包元数据](../pyproject.toml)
+- [Production descriptor](../src/wavebench_siglent_sdg2000x/descriptor.py)
+- [Driver implementation](../src/wavebench_siglent_sdg2000x/driver.py)
+- [Driver tests](../tests/test_driver.py)
+- [Wheel 与 descriptor tests](../tests/test_wheel.py)
+- [开发记录与实机证据入口](README.md)
diff --git a/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_COVERAGE_MATRIX_EN.md b/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_COVERAGE_MATRIX_EN.md
index adba3ef..8346d06 100644
--- a/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_COVERAGE_MATRIX_EN.md
+++ b/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_COVERAGE_MATRIX_EN.md
@@ -1,89 +1,74 @@
-# SDG2000X Coverage Matrix
+# SDG2000X current capability Reference
 
 [中文](SDG2000X_COVERAGE_MATRIX.md)
 
-## Current conclusion
-
-Version `0.8.2` declares twelve capabilities: the legacy identity, status, five basic writes, and read-only
-arbitrary probe, plus `source.snapshot_v2`, `source.basic_configure_v2`, `source.output_v2`, and
-`source.harmonics_disable_v2`. The first eight have SDG2122X core-consumer hardware evidence. The four new
-capabilities all have A0 offline contracts. On the exact `SDG2122X` / `2.01.01.39R7T2` target, the V2 snapshot
-has A1 evidence and the normal Basic, Output, and Harmonic-disable paths have limited A2 evidence. Basic has
-dual-channel A3 operating-point waveform acceptance with confirmed high-impedance CH1-to-CH1 and CH2-to-CH2
-wiring. This does not extend to other models, firmware revisions, frequency/amplitude ranges, feature fields, or
-hardware recovery. Harmonic disable applies only to
-`SDG2122X` firmware `2.01.01.39R7T2`. Registered-model V1 capabilities remain
-released under the common manual contract and offline model matrix.
-
-The Source V2 C3 core implementation, candidate-wheel manifests, and candidate package audit are complete.
-A stable core, final release artifacts, and formal release sign-off remain separate work. See the
-[C3 candidate release audit](SDG2000X_SOURCE_V2_RELEASE_AUDIT_EN.md).
-
-Advanced command domains have the broadest practical domain-specific protocol/A4 evidence, but no lossy write capability or raw-SCPI endpoint is declared where the core lacks an exact state model. Historical coverage numbers apply to version `0.8.0`; current Source V2 coverage is established by the present offline test report, not by carrying forward those numbers. Code coverage does not establish physical evidence for unwired ports or unavailable models.
-
-## Coverage status
-
-| Command domain | WaveBench capability | Current status | Exit condition |
-| --- | --- | --- | --- |
-| Instrument identity | `source.idn` | Passed on `SDG2122X` / `2.01.01.39R7T2`; other registered models released by the common protocol | New models or response variants still need redacted evidence |
-| System error queue | None | Disabled | Confirm the query, empty-queue semantics, and whether reads consume state |
-| Basic channel status | `source.status` | Repeated SDG2122X read-only rounds are stable; CH1/CH2 have frequency, Vpp, mean, and final independent zero-write evidence | Accept new firmware response variants separately |
-| Source V2 snapshot | `source.snapshot_v2` | A0: pure-read CH1/CH2 anchor/facet/anchor plan, 38-query Sine fixture, zero writes, declared limit 44. A1: exact-target hardware dual-channel snapshot with 38 queries, zero writes, consistent state, and a healthy session | Accept other models, firmware, or response variants separately |
-| Source V2 basic configuration | `source.basic_configure_v2` | A0: CH1/CH2 one-field Basic MAIN writes, core readback, and one OFF recovery for Sine/Square/Ramp/Pulse; `offset_v` is pre-write rejected. Limited A2: one 1 Vpp write and independent readback on each channel with output OFF on the exact target. A3: with confirmed high-impedance CH1-to-CH1 and CH2-to-CH2 wiring, Sine/Square/Ramp/Pulse on both channels completed scope capture at 2 kHz / 2 Vpp; both Square captures confirm 25% duty | Other models, firmware, frequency/amplitude ranges, loads, and hardware rejection/recovery paths are not claimed; `offset_v` remains unavailable for writing |
-| Source V2 output | `source.output_v2` | A0: independent CH1/CH2 ON/OFF, one-write MAIN, core readback, and one OFF recovery after a readable mismatch; independent outputs may be ON together. Limited A2: CH1 and CH2 each completed ON and OFF with independent readback and a final OFF state on the exact target | No hardware simultaneous-ON, recovery, or other-model/firmware claim |
-| Output control | `source.output` | All models pass offline; SDG2122X CH1/CH2 passed core-Service ON→A4→OFF with zero unknown writes | Add other-model A4 only when hardware is available |
-| Fixed-wave frequency | `source.set_frequency` | SDG2122X CH1/CH2 cover OFF-state and live-ON writes; model/function boundaries are fully covered offline | Add other-model A4 only when hardware is available |
-| Fixed-wave amplitude | `source.set_amplitude_vpp` | SDG2122X CH1/CH2 cover OFF and live-ON writes; 2 mVpp–10 Vpp, offset envelope, and drift branches are 100% covered | Add other-model A4 only when hardware is available |
-| Fixed-wave function | `source.set_function` | Sine/Square/Ramp pass core loops on CH1/CH2; Pulse passes on CH2; Noise/DC remain OFF-config-only publicly | Wait for a reusable Noise/DC safety model |
-| Square-wave duty cycle | `source.set_square_duty_cycle` | CH2 20%/80% measured 0.200/0.800; final CH1 30% and CH2 70% measured 0.287/0.6949 | Frequency-dependent high-rate clamping remains strict fail-closed readback |
-| Pulse parameters | No lossless capability yet | SDG2122X 25%/65% duty and 20/40 µs edges pass A4; DLY is A3 only | Declare after Source V2 supports unknown hold; add an independent delay reference |
-| Harmonics | `source.harmonics_disable_v2`, `SDG2122X` / `2.01.01.39R7T2` only | A0: while Sine and target output OFF are proven, an already-disabled state has zero writes and an enabled state sends only `HARMSTATE,OFF`, followed by independent core Harmonic/output readback. A1/limited A2: the exact target returns the Harmonic facet and CH1 completed one disable write with independent Harmonic-OFF/output-OFF readback; SDG2122X H2–H16 slots, H2/H3 amplitude, H2 phase, and ALL/EVEN/ODD remain legacy A4 evidence | Harmonic configuration/enable remains pending a more complete Source V2 model; do not extrapolate to other models or firmware |
-| Modulation | No lossless capability yet | SDG2122X internal AM/DSB-AM/FM/PM/PWM/ASK/FSK/PSK pass protocol and A4 waveform tests | Declare after Source V2 supports disabled-state absence and vendor ranges; wire external sources |
-| Sweep | No lossless capability yet | SDG2122X LINE/LOG/STEP, UP/DOWN/UP_DOWN, and INT/MAN pass protocol and A4 waveform tests; EXT is readback-only | Declare after Source V2 supports absent fields; wire external trigger |
-| Burst | No lossless capability yet | Finite INT/MAN pass cycle/repetition A4; `TRDUCH` CH2-to-both passes; EXT/Gate are readback-only; INF did not form a continuous carrier | Wire external trigger/gate; use a discriminated Source V2 model |
-| Noise / DC / TARB | No lossless capability yet | Noise and -1/0/+1 V DC pass A4; the 20 MHz lower clamp is A3; TARB 1 MSa/s is non-flat; Noise Add remains stably OFF on this unit | Use non-periodic amplitude facets; recheck Noise Add on other firmware |
-| Arbitrary waveforms | `source.arbitrary_probe` | Dual-channel core zero-write probing passed; 199/199 built-ins passed selection/readback/A4; TARB has separate A4 | Upload, deletion, and user catalog remain denied by default |
-| Combine | No lossless capability yet | CH1←CH2 and CH2←CH1 unlike-frequency A4 pass; source output relay need not be ON | Model participants, worst-case envelope, and mutual exclusions first |
-| Phase mode / Invert | No lossless capability yet | `EQPHASE` leaves 0.27°; CH1/CH2 inversion is about 179.9°; actual token is `PHASE-LOCKED` | Split single-field polarity/phase facets before declaration |
-| Tracking / Coupling / Copy | No lossless capability yet | TRACE, F/P/A ratio/deviation, and CH1→CH2 PACP have A4; reverse PACP has A3 | Source V2 must model conditional fields, actions, and cross-channel transactions |
-| Sync / Counter / Clock / Cascade | None | An 18-query zero-write pass succeeded; Sync and Counter OFF, ROSC INT, Cascade OFF; unwired ports have no A4 claim | Add dedicated Sync, Counter, external-reference, and second-source wiring |
-| Code paths | Not applicable | V1 historical release: 348 tests, 620/620 statements, and 244/244 branches; new V2 A0 tests run separately | Run the current plugin tests and coverage report; do not inflate metrics with empty assertions |
-
-## Denied by default
-
-- Do not send `*RST` or another global preset command.
-- User-facing output enable remains limited to the core operation contracts behind `source.output` or `source.output_v2`; advanced hardware scripts are not a public raw endpoint.
-- Do not expose raw SCPI.
-- Do not upload, delete, or overwrite user arbitrary waves or state files.
-- Do not switch external reference, protection, Counter, Cascade, or unknown-load auxiliary outputs merely for coverage.
-- Do not equate a product-page feature with an implemented capability.
-
-## Sources of truth
-
-- [SIGLENT SDG2000X product page](https://www.siglent.com/in/products-overview/sdg2000x/)
-- [SIGLENT waveform-generator document downloads](https://siglentna.com/resources/documents/waveform-generators/)
-- Local guide: `doc/vendor-local/SDG_Series_Programming_Guide_E05C.pdf`, revision `PG02_E05C`
-- [Protocol audit](SDG2000X_PROTOCOL_AUDIT_EN.md)
-- [Read-only hardware acceptance](SDG2000X_READONLY_ACCEPTANCE_EN.md)
-- [Output-control hardware acceptance](SDG2000X_OUTPUT_ACCEPTANCE_EN.md)
-- [Frequency-write hardware acceptance](SDG2000X_FREQUENCY_ACCEPTANCE_EN.md)
-- [Basic-write hardware acceptance](SDG2000X_BASIC_WRITE_ACCEPTANCE_EN.md)
-- [Source V2 A0 offline adapter record](SDG2000X_SOURCE_V2_A0_EN.md)
-- [Source V2 A1/A2 hardware acceptance](SDG2000X_SOURCE_V2_A1_A2_ACCEPTANCE_EN.md)
-- [Source V2 A3 hardware waveform acceptance](SDG2000X_SOURCE_V2_A3_ACCEPTANCE_EN.md)
-- [Source V2 C3 candidate release audit](SDG2000X_SOURCE_V2_RELEASE_AUDIT_EN.md)
-- [Harmonic protocol and spectrum acceptance](SDG2000X_HARMONIC_ACCEPTANCE_EN.md)
-- [Modulation protocol and waveform acceptance](SDG2000X_MODULATION_ACCEPTANCE_EN.md)
-- [Sweep protocol and waveform acceptance](SDG2000X_SWEEP_ACCEPTANCE_EN.md)
-- [Burst protocol and waveform acceptance](SDG2000X_BURST_ACCEPTANCE_EN.md)
-- [Pulse protocol and waveform acceptance](SDG2000X_PULSE_ACCEPTANCE_EN.md)
-- [Read-only arbitrary probe acceptance](SDG2000X_ARBITRARY_PROBE_ACCEPTANCE_EN.md)
-- [Full built-in arbitrary catalog acceptance](SDG2000X_BUILTIN_ARB_ACCEPTANCE_EN.md)
-- [Public Source API dual-channel acceptance](SDG2000X_PUBLIC_DUAL_CHANNEL_ACCEPTANCE_EN.md)
-- [Special-waveform protocol and hardware acceptance](SDG2000X_SPECIAL_WAVEFORM_ACCEPTANCE_EN.md)
-- [Dual-channel waveform Combine acceptance](SDG2000X_COMBINE_ACCEPTANCE_EN.md)
-- [Phase mode, equal-phase, and invert acceptance](SDG2000X_PHASE_INVERT_ACCEPTANCE_EN.md)
-- [Tracking, coupling, copy, and dual-trigger acceptance](SDG2000X_CHANNEL_INTERACTION_ACCEPTANCE_EN.md)
-- [Auxiliary and global-state read-only acceptance](SDG2000X_AUXILIARY_READONLY_ACCEPTANCE_EN.md)
-- [Reusable Source V2 RFC](RFC_SOURCE_V2_CAPABILITY_STATE_SAFETY_EN.md)
-- Current descriptor, driver, and fake-transport tests
+This page defines the capabilities, applicability, and failure boundaries currently declared by the `siglent.sdg2000x` production descriptor. The package metadata version is `0.8.2`; it identifies the source contract in this repository without depending on a separate PyPI, Git tag, or GitHub Release state.
+
+## Synopsis
+
+| Item | Current value |
+| --- | --- |
+| Distribution | `wavebench-siglent-sdg2000x` |
+| Driver ID | `siglent.sdg2000x` |
+| Registered models | `SDG2042X`, `SDG2082X`, `SDG2122X` |
+| WaveBench | `>=0.8.24,<0.9` |
+| Python | `>=3.11` |
+| Backend | `pyvisa` |
+| Configuration fields | `source.resource`, `source.driver`, `safety_limits.max_source_vpp` |
+
+The Source V2 topology contains CH1 and CH2. Its snapshot query contract is pure read, permits at most `44` queries, and has a `5000 ms` timeout.
+
+## Current capabilities
+
+| Capability | Exact scope and behavior |
+| --- | --- |
+| `source.idn` | Reads and matches SDG2000X-family identity. |
+| `source.status` | Reads basic waveform, frequency, amplitude, offset, and output state for one channel. |
+| `source.set_frequency` | Sets fixed-wave frequency with model and current-waveform limits. Automatic Sweep-to-FIX selection is allowed only while output is OFF. |
+| `source.set_function` | Sets bounded periodic waves. Sine, Square, Ramp, and Pulse follow the normal contract; Noise/DC require output OFF. |
+| `source.set_amplitude_vpp` | Sets `2 mVpp–10 Vpp`; the amplitude-plus-offset envelope must remain within `±10 V`. |
+| `source.set_square_duty_cycle` | Applies only to a FIX-mode Square wave and fails closed on frequency-dependent clamping or readback mismatch. |
+| `source.output` | Reads, enables, or disables channel output. Enable requires FIX, readable Vpp/Offset, known composite modes OFF, and the `max_source_vpp` check. |
+| `source.arbitrary_probe` | Probes arbitrary-wave state without upload, deletion, or replacement. |
+| `source.snapshot_v2` | Performs a pure-read anchor/facet/anchor snapshot on CH1/CH2 with identity, Basic, Output, and conditionally activated Harmonics facets. |
+| `source.basic_configure_v2` | Performs one-field Basic MAIN configuration for Sine, Square, Ramp, or Pulse on CH1/CH2. Fixed frequency, Vpp, and Square duty are writable; `offset_v` is not currently writable. |
+| `source.output_v2` | Independently reads, enables, or disables CH1/CH2. Each MAIN request writes the target field once, followed by an independent Core snapshot. |
+| `source.harmonics_disable_v2` | Applies only to `SDG2122X` / `2.01.01.39R7T2`, Sine, and target output OFF. It reads or disables Harmonic and never configures or enables it. |
+
+## Source V2 model and firmware restrictions
+
+The Basic and Output feature applicability adds no model or firmware restriction beyond the registered-model runtime contract. Current controlled hardware evidence primarily uses an `SDG2122X` running firmware `2.01.01.39R7T2`. That evidence does not replace the descriptor or automatically establish other models, firmware revisions, or physical operating points.
+
+The Harmonic feature has an explicit restriction:
+
+- the model must be `SDG2122X`;
+- firmware must be `2.01.01.39R7T2`;
+- the target channel must be Sine with output OFF;
+- an already-disabled state sends no MAIN write; an enabled state sends only one `HARMSTATE,OFF`;
+- Core then independently reads Harmonic and output state.
+
+The Harmonic profile can read orders 2–16 with absolute-Vpp or relative-dB amplitudes, but its only public write direction is `DISABLE`.
+
+## Side effects and failure behavior
+
+- Descriptor import performs no instrument I/O. The factory opens only the configured transport.
+- A `read_only` session permits reads only; Core rejects mismatched access before a write.
+- V1 and V2 writes must satisfy the target-channel, waveform, output, safety-limit, and readback contracts.
+- V2 Basic and Output each write the target configuration once. A post-write failure attempts output OFF and latches later configuration writes for the session.
+- Source V2 does not represent Noise/DC `STDEV` or nominal values as Vpp; calls without a lossless V2 state retain the safer V1 path.
+- Historical harnesses and raw SCPI cannot bypass the current descriptor.
+
+## Currently unsupported
+
+The production descriptor declares no error queue, modulation, Sweep, Burst, Pulse-parameter, arbitrary upload/delete, Combine, phase/Invert, tracking/coupling/copy, Sync, Counter, external-reference, Cascade, or raw-SCPI capability.
+
+Some command domains have controlled hardware evidence, but they remain unavailable when Core lacks a lossless model or the descriptor declares no capability. Evidence is for traceability and is not a second current capability table.
+
+## Sources
+
+- [Package metadata](../pyproject.toml)
+- [Production descriptor](../src/wavebench_siglent_sdg2000x/descriptor.py)
+- [Driver implementation](../src/wavebench_siglent_sdg2000x/driver.py)
+- [Driver tests](../tests/test_driver.py)
+- [Wheel and descriptor tests](../tests/test_wheel.py)
+- [Development records and hardware evidence](README_EN.md)
diff --git a/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT.md b/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT.md
index f391959..a84ed91 100644
--- a/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT.md
+++ b/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT.md
@@ -23,7 +23,7 @@ A1／有限 A2／Basic A3 证据，不把有限证据外推为任意型号或固
 | A2：正常 Basic／Output／Harmonic 关闭 | 同一目标上，CH1/CH2 各一次 1 Vpp Basic 写入与独立回读、各一次 Output ON/OFF，以及 CH1 一次 Harmonic 关闭均成功；最终两路 Harmonic OFF、输出 OFF，session healthy | 有限正常路径已完成；不等于完整 A2 |
 | A2：故障、拒绝和恢复 | 未人为诱发传输失败、未知写结果或写后回读不一致。首次 Basic 被既有 Harmonic 状态拒绝发生在 Basic 命令发送前；因 MAIN 已进入，核心完成一次 OFF recovery | 不作为实机故障注入或 Basic 成功证据；A0 覆盖对应注入分支 |
 | A3：Basic 示波器环回 | 在确认的高阻 CH1→CH1、CH2→CH2 接线下，CH1／CH2 的 Sine、Square、Ramp、Pulse 均于 2 kHz／2 Vpp 完成 scope capture；两次 Square 测得 25% 占空比，八次质量门均通过，最终两路输出 OFF | 精确工作点已完成；不外推 |
-| 稳定核心与发布物签核 | 当前候选 wheel binding 为 `sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e`；WaveBench `0.8.24` 仍是开发线，未执行 push、tag、发布或正式签核 | 待发布时完成 |
+| 稳定核心与发布物签核 | 当前候选 wheel binding 为 `sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312`；WaveBench `0.8.24` 仍是开发线，未执行 push、tag、发布或正式签核 | 待发布时完成 |
 
 8 份 manifest 按真实证据分别声明：Basic 配置 A3；Basic／Output／Harmonic 读取 A1；Output
 Enable／Disable A2；CH1 Harmonic Disable A2；CH2 Harmonic Disable A0。CH1 的实机关闭证据没有
diff --git a/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT_EN.md b/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT_EN.md
index fe5ce53..ebbb9fb 100644
--- a/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT_EN.md
+++ b/packages/wavebench-siglent-sdg2000x/doc/SDG2000X_SOURCE_V2_RELEASE_AUDIT_EN.md
@@ -24,7 +24,7 @@ extrapolating the limited evidence to any model or firmware.
 | A2: normal Basic/Output/Harmonic disable | On that target, one 1 Vpp Basic write/readback on each of CH1/CH2, one Output ON/OFF on each channel, and one CH1 Harmonic disable all succeeded; both channels finish Harmonic OFF/output OFF with a healthy session | Limited normal path complete; not full A2 |
 | A2: fault, rejection, and recovery | No transport failure, ambiguous write, or post-write mismatch was induced. An initial Basic request was rejected by existing Harmonic state before the Basic command; because MAIN had started, the core completed one OFF recovery | Neither hardware fault injection nor a successful Basic write; A0 covers the corresponding injected branches |
 | A3: Basic scope loopback | With confirmed high-impedance CH1-to-CH1 and CH2-to-CH2 wiring, Sine/Square/Ramp/Pulse on CH1/CH2 all completed 2 kHz / 2 Vpp scope capture; both Square captures measured 25% duty, all eight quality gates passed, and both outputs finished OFF | Exact operating points complete; not extrapolated |
-| Stable core and release-artifact sign-off | The current candidate wheel binding is `sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e`; WaveBench `0.8.24` remains a development line, with no push, tag, publication, or formal sign-off | Complete when releasing |
+| Stable core and release-artifact sign-off | The current candidate wheel binding is `sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312`; WaveBench `0.8.24` remains a development line, with no push, tag, publication, or formal sign-off | Complete when releasing |
 
 The eight manifests preserve the actual evidence levels: Basic configure A3; Basic/Output/Harmonic read A1;
 Output enable/disable A2; CH1 Harmonic disable A2; and CH2 Harmonic disable A0. CH1 hardware evidence is not
diff --git a/packages/wavebench-siglent-sdg2000x/tests/test_wheel.py b/packages/wavebench-siglent-sdg2000x/tests/test_wheel.py
index f723ec0..e6d2d14 100644
--- a/packages/wavebench-siglent-sdg2000x/tests/test_wheel.py
+++ b/packages/wavebench-siglent-sdg2000x/tests/test_wheel.py
@@ -99,7 +99,7 @@ def test_wheel_contains_verified_source_conformance_manifests(tmp_path: Path) ->
     package = inspect_plugin_wheel(wheel)
 
     assert package.source_conformance_wheel_sha256 == (
-        "sha256:767c46ff3978908b681982a964a23558974be1353469b0011d3112b9cec57d6e"
+        "sha256:8deea341124ff6ed04d31ebff565c656bb05bca35c848f16bb15c235f81eb312"
     )
     assert {
         (item.manifest_id, item.claimed_level.value, item.channels)
diff --git a/packages/wavebench-siglent-sds3000/README.md b/packages/wavebench-siglent-sds3000/README.md
index bae14d5..7930b76 100644
--- a/packages/wavebench-siglent-sds3000/README.md
+++ b/packages/wavebench-siglent-sds3000/README.md
@@ -2,79 +2,27 @@
 
 [English](README_EN.md)
 
-本包提供早期 SIGLENT SDS3000 系列示波器的 WaveBench 外置驱动。该系列不包含名称带 `X` 或 `HD` 的后续产品。当前已完成可安装插件、严格身份门禁、错误寄存器读取、通道耦合映射、二进制波形读取，以及单通道和同次 acquisition 双通道采集。
+本包面向早期 SIGLENT SDS3000 系列示波器，不包含名称带 `X` 或 `HD` 的后续产品。当前
+production descriptor 只登记经过验证的 SDS3054。
 
-首个验证目标为 SIGLENT SDS3054。其他同代型号只有在厂商资料与测试证据充分时才会加入兼容范围。
+## 从这里开始
 
-## 已确认的仪器身份
+- [查询当前版本、兼容范围、型号和 capability](../../doc/reference/plugin-catalog.md)
+- [进入 SDS3000 插件文档](doc/README.md)
+- [安装和管理 WaveBench 插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-- 机身型号：SIGLENT SDS3054，500 MHz、4 GSa/s；
-- 平台标识：`SIGLENT Powered by TELEDYNE LECROY`；
-- 脱敏远程身份：`*IDN LECROY,SDS3054,<serial>,8.4.1`；
-- 前面板远程模式：`TCPIP (VICP)`；
-- 命令体系：Teledyne LeCroy MAUI/X-Stream Remote Command Set。
+## 当前边界
 
-上述身份只用于约束 SDS3054 驱动，不表示可以接受任意 LeCroy 仪器，也不表示其他 SIGLENT SDS 系列使用相同协议。
+当前实现覆盖严格身份检查、错误寄存器读取、通道 coupling、二进制波形读取，以及单通道和
+同次 acquisition 多通道采集。精确 capability、固件与选件限制、未支持项和协议处置以
+production descriptor 及 [WaveBench capability 矩阵](doc/WAVEBENCH_CAPABILITY_MATRIX.md)为准。
 
-## 当前状态
+SDS3054 使用 Teledyne LeCroy MAUI／X-Stream 命令体系。前面板选择 `TCP/IP (VICP)` 时必须
+使用 `VICP::<host>::INSTR`；`TCPIP::<host>::INSTR` 表示 VXI-11，只能与前面板的
+`LXI (VXI-11)` 模式配套。两种资源不能混用。
 
-- 阶段：M8 功能完成；已采用 WaveBench `0.8.24` 的 transport/session P0 合同；
-- distribution：`wavebench-siglent-sds3000`；
-- canonical driver ID：`siglent.sds3000`；
-- 仪器类型：`scope`；
-- 首版型号：`SDS3054`；
-- WaveBench 兼容范围：`>=0.8.24,<0.9`；
-- transport：WaveBench `pyvisa`；已验证 `VICP::<host>::INSTR`，使用 `PyVICP>=1.1,<2`；
-- 已声明 capability：`scope.idn`、`scope.errors`、`scope.channel_coupling`、`scope.fetch_waveform`、`scope.capture_waveform`、`scope.capture_waveforms`。
-
-M8「功能完成」表示上述能力已经实现并通过既定验收。插件已采用 WaveBench `0.8.24` 的 transport/session P0 合同，包括显式不可重放策略、结构化异常传播和共享 session health 故障注入。wheel 与 descriptor 下限已同步提高到 `0.8.24`，上限保持 `0.9`，`api_version` 保持 `wavebench.instrument.v2`。影响评估和验证证据见[核心 RFC](doc/WAVEBENCH_CORE_RFC.md)。
-
-P0 采用后已使用 SDG2000X 双通道在每路 1 kHz、1 Vpp、0 V offset 的工作点完成 SDS3054 CH1/CH2 同次采集复测；两路示波器输入均为 `DCL`，收尾独立回读确认发生器两路 OFF。脱敏结果见[实机验收](doc/HARDWARE_ACCEPTANCE.md)。
-
-descriptor 加载和 driver 工厂阶段均不执行仪器 I/O。调用 `scope.idn` 时只发送一次 `*IDN?`，并严格接受 `*IDN LECROY,SDS3054,<serial>,8.4.1`；当 `CHDR OFF` 省略响应头时，也接受对应的裸身份形式。其他厂商、型号或固件均在零写入的情况下拒绝。
-
-前面板选择 `TCP/IP (VICP)` 时，必须使用 `VICP::<host>::INSTR`。`TCPIP::<host>::INSTR` 是 VXI-11，只能在前面板切到 `LXI (VXI-11)` 后使用；两种资源不得混用。
-
-`scope.channel_coupling` 将 MAUI 的 `A1M`、`D1M`、`D50`、`GND` 分别映射为 WaveBench 的 `ACL`、`DCL`、`DC`、`GND`。仪器返回 `OVL` 时按 50 Ω 输入过载处理并拒绝继续。`scope.errors` 依次读取并清除 `CMR`、`EXR` 和 `DDR`；它是 WaveBench 已有的 `stateful_read`，不是普通无副作用查询。
-
-`scope.fetch_waveform` 使用 WaveBench 已有的波形模型和 `query_bin_block()` transport 接口。读取前查询 `CHDR`、`CFMT`、`CORD` 和 `WFSU` 状态，临时切换为 `DEF9,WORD,BIN` 与低字节在前，只读取一个分段，然后按逆序恢复原状态。恢复失败时返回 `StateDriftError`。当前只实现 `WF?` 读取；`WF` 写回内部存储仍隔离，不会被误报为已支持。
-
-`scope.capture_waveform` 与 `scope.capture_waveforms` 使用同一原子采集事务：先快照 trigger mode、timebase、请求通道的 V/div 与 trace 状态，再执行 `STOP → ARM → WAIT → *OPC?`；确认 `TRMD STOP` 后，在不重新触发的前提下读取全部请求通道，最后逆序恢复采集与传输状态。双通道 1 kHz、1 Vpp 三轮实机验收已通过。
-
-## 编程手册投放位置
-
-将厂商编程手册或其本地转换结果放在：
-
-```text
-doc/vendor-local/
-```
-
-当前本地资料为 2026 年 2 月版《Oscilloscopes Remote Control and Automation Manual》。上传转换系统将原始 411 页手册拆为 200、200、11 页三段，项目会在原创审计文档中记录三段的顺序与哈希。推荐保留厂商原始文件名；需要统一命名时，可使用：
-
-```text
-Oscilloscopes_Remote_Control_and_Automation_Manual_2026-02.pdf
-```
-
-该手册晚于实机固件 `8.4.1`，且部分内容明确以 MAUI `8.5.0.0+` 为基线。手册中明确列出的实体构成审计分母，但只有离线证据或安全实机测试确认后，才会计入固件 `8.4.1` 的已支持集合。型号操作手册、数据表和发行说明也可放入同一目录。
-
-来源哈希、分段顺序、适用边界和覆盖口径见 [`doc/MANUAL_BASELINE.md`](doc/MANUAL_BASELINE.md)。
-
-完整指令分母和处置状态见 [`doc/COMMAND_COVERAGE.md`](doc/COMMAND_COVERAGE.md)。当前目录已固定 578 个明确实体，其中 478 个可调用实体，未分类数量为 0。
-
-WaveBench `0.8.24` 的 26 项 `scope` capability 全量处置见 [`doc/WAVEBENCH_CAPABILITY_MATRIX.md`](doc/WAVEBENCH_CAPABILITY_MATRIX.md)；当前声明 6 项，其余均有固件、选件、核心模型或安全边界结论。跨厂商核心影响 RFC 目前为 `Draft / Needs revision`，见 [`doc/WAVEBENCH_CORE_RFC.md`](doc/WAVEBENCH_CORE_RFC.md)；transport/session P0 已采用，typed scope 与通用写入提案仍可修订。本插件分支没有修改 WaveBench 核心。
-
-脱敏实机结果见 [`doc/HARDWARE_ACCEPTANCE.md`](doc/HARDWARE_ACCEPTANCE.md)。该记录不含资源地址、序列号、原始波形、截图或命令日志。
-
-`doc/vendor-local/` 中除说明文件外的内容由仓库级 `.gitignore` 排除。厂商资料不会进入 Git；项目原创的协议摘要、覆盖矩阵和验收记录位于 `doc/`。
-
-## 手册到位后的检查顺序
-
-1. 登记手册名称、文档号、修订号、发布日期、适用平台和 SHA-256。
-2. 区分 IEEE 488.2 legacy commands 与 `VBS app...` Automation 对象树，并确认固件 `8.4.1` 的版本边界。
-3. 核对 VICP、VXI-11、USBTMC 等通信方式与 WaveBench 现有 transport 的实际兼容情况。
-4. 审计终止符、通信头、错误语义、波形模板、二进制传输、截图及状态副作用。
-5. 冻结 distribution、canonical driver ID、身份门禁和兼容型号范围。
-6. 按 M3–M8 逐项加入通过 FakeTransport 和分级实机验收的 capability。
+该身份和协议边界不能外推到任意 LeCroy 仪器、SDS3000X、SDS3000X HD 或其他 SIGLENT
+SDS 系列。
 
 ## 安全边界
 
@@ -85,6 +33,8 @@ WaveBench `0.8.24` 的 26 项 `scope` capability 全量处置见 [`doc/WAVEBENCH
 - 仪器写入、输出切换和 acquisition trigger 不做盲目重试。
 - 真实设备地址、序列号、凭据、原始波形、截图和实验日志不得提交。
 
-## 许可证边界
+## 开发与许可证
 
-本目录中的项目原创文档由仓库根目录 MIT License 覆盖。放入 `doc/vendor-local/` 的厂商资料保留其原始权利状态，不因此获得 MIT 授权，也不属于公开 distribution。
+本地手册、审计顺序和发布边界见[插件文档](doc/README.md)。日常源码开发使用仓库级
+[editable 开发环境](../../doc/DEVELOPMENT.md)。项目原创代码和文档采用 [MIT License](LICENSE)；
+厂商资料保留原始权利状态，不属于公开 distribution。
diff --git a/packages/wavebench-siglent-sds3000/README_EN.md b/packages/wavebench-siglent-sds3000/README_EN.md
index b350eaf..be024a1 100644
--- a/packages/wavebench-siglent-sds3000/README_EN.md
+++ b/packages/wavebench-siglent-sds3000/README_EN.md
@@ -2,79 +2,28 @@
 
 [中文](README.md)
 
-This package provides an external WaveBench driver for the early SIGLENT SDS3000 oscilloscope family. It does not cover later products whose names include `X` or `HD`. The installable plugin now includes a strict identity gate, error-register reads, channel-coupling mapping, binary waveform reads, and single- or same-acquisition multi-channel capture.
+This package targets the early SIGLENT SDS3000 oscilloscope family and excludes later products whose
+names contain `X` or `HD`. The production descriptor currently registers only the verified SDS3054.
 
-The first validation target is the SIGLENT SDS3054. Other models from the same generation will enter the compatibility range only when supported by vendor documentation and test evidence.
+## Start here
 
-## Confirmed instrument identity
+- [Find the current version, compatibility range, model, and capabilities](../../doc/reference/plugin-catalog-en.md)
+- [Browse the SDS3000 plugin documentation](doc/README_EN.md)
+- [Install and manage WaveBench plugins](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-- Chassis model: SIGLENT SDS3054, 500 MHz, 4 GSa/s.
-- Platform mark: `SIGLENT Powered by TELEDYNE LECROY`.
-- Redacted remote identity: `*IDN LECROY,SDS3054,<serial>,8.4.1`.
-- Front-panel remote mode: `TCPIP (VICP)`.
-- Command family: Teledyne LeCroy MAUI/X-Stream Remote Command Set.
+## Current boundary
 
-This identity constrains only the SDS3054 driver. It does not permit arbitrary LeCroy instruments or imply protocol compatibility with other SIGLENT SDS families.
+The implementation covers strict identity checks, error-register reads, channel coupling, binary
+waveform reads, and single- or same-acquisition multi-channel capture. The production descriptor and
+[WaveBench capability matrix](doc/WAVEBENCH_CAPABILITY_MATRIX_EN.md) are authoritative for exact
+capabilities, firmware and option limits, unsupported areas, and protocol dispositions.
 
-## Current status
+The SDS3054 uses the Teledyne LeCroy MAUI/X-Stream command family. When the front panel selects
+`TCP/IP (VICP)`, use `VICP::<host>::INSTR`. `TCPIP::<host>::INSTR` denotes VXI-11 and requires the
+front-panel `LXI (VXI-11)` mode. The resource forms are not interchangeable.
 
-- Stage: M8 functionally complete; WaveBench `0.8.24` transport/session P0 is adopted.
-- Distribution: `wavebench-siglent-sds3000`.
-- Canonical driver ID: `siglent.sds3000`.
-- Instrument kind: `scope`.
-- Initial model: `SDS3054`.
-- WaveBench compatibility: `>=0.8.24,<0.9`.
-- Transport: WaveBench `pyvisa`; `VICP::<host>::INSTR` is verified using `PyVICP>=1.1,<2`.
-- Declared capabilities: `scope.idn`, `scope.errors`, `scope.channel_coupling`, `scope.fetch_waveform`, `scope.capture_waveform`, and `scope.capture_waveforms`.
-
-“M8 functionally complete” means that these capabilities are implemented and passed their defined acceptance gates. The plugin adopts the WaveBench `0.8.24` transport/session P0 contract, including explicit non-replay policies, structured-error propagation, and shared-session-health fault injection. The wheel and descriptor minimum versions are both `0.8.24`; the upper bound remains `0.9`, and `api_version` remains `wavebench.instrument.v2`. See the [core RFC](doc/WAVEBENCH_CORE_RFC_EN.md) for the impact assessment and verification evidence.
-
-P0 adoption was revalidated with dual-channel SDG2000X input at 1 kHz, 1 Vpp, and 0 V offset per channel. SDS3054 CH1 and CH2 were both `DCL`, and the final independent readback confirmed both generator outputs OFF. See the redacted [hardware acceptance](doc/HARDWARE_ACCEPTANCE_EN.md).
-
-Descriptor loading and driver construction perform no instrument I/O. Calling `scope.idn` sends exactly one `*IDN?` and accepts only `*IDN LECROY,SDS3054,<serial>,8.4.1`, plus the corresponding bare identity when `CHDR OFF` suppresses the response header. Other manufacturers, models, or firmware revisions are rejected without writes.
-
-When the front panel selects `TCP/IP (VICP)`, use `VICP::<host>::INSTR`. `TCPIP::<host>::INSTR` means VXI-11 and is valid only after the front panel is switched to `LXI (VXI-11)`; the two resource forms are not interchangeable.
-
-`scope.channel_coupling` maps MAUI `A1M`, `D1M`, `D50`, and `GND` to WaveBench `ACL`, `DCL`, `DC`, and `GND`. An `OVL` response is treated as a 50-ohm input overload and stops the operation. `scope.errors` reads and clears `CMR`, `EXR`, and `DDR` in order; it is an existing WaveBench `stateful_read`, not a side-effect-free query.
-
-`scope.fetch_waveform` uses the existing WaveBench waveform models and `query_bin_block()` transport interface. It snapshots `CHDR`, `CFMT`, `CORD`, and `WFSU`, temporarily selects `DEF9,WORD,BIN` with low byte first and one segment, then restores the original state in reverse order. A restoration failure becomes `StateDriftError`. Only the `WF?` read direction is implemented; writing `WF` back into internal memory remains quarantined and is not reported as supported.
-
-`scope.capture_waveform` and `scope.capture_waveforms` share one atomic acquisition transaction. The driver snapshots trigger mode, timebase, V/div, and trace state before `STOP → ARM → WAIT → *OPC?`; after requiring `TRMD STOP`, it reads every requested channel without retriggering and restores acquisition and transfer state in reverse order. Three dual-channel 1 kHz, 1 Vpp hardware rounds passed.
-
-## Programming-manual drop location
-
-Place vendor manuals or local conversion output under:
-
-```text
-doc/vendor-local/
-```
-
-The current local source is the February 2026 *Oscilloscopes Remote Control and Automation Manual*. The upload converter split the 411-page source into three segments of 200, 200, and 11 pages. Project-authored audit documentation records their order and hashes. Retain the vendor filename when possible. A normalized filename may be used when needed:
-
-```text
-Oscilloscopes_Remote_Control_and_Automation_Manual_2026-02.pdf
-```
-
-This manual is newer than the instrument firmware `8.4.1`, and some sections explicitly require MAUI `8.5.0.0+`. Explicitly documented entities form the audit denominator, but an entity counts as supported by firmware `8.4.1` only after offline evidence or safe hardware testing confirms it. Model operator manuals, datasheets, and release notes may be placed in the same directory.
-
-See [`doc/MANUAL_BASELINE_EN.md`](doc/MANUAL_BASELINE_EN.md) for source hashes, segment order, applicability boundaries, and the coverage denominator.
-
-See [`doc/COMMAND_COVERAGE_EN.md`](doc/COMMAND_COVERAGE_EN.md) for the complete denominator and dispositions. The current catalog freezes 578 explicit entities, including 478 callable entities, with zero unclassified entries.
-
-See [`doc/WAVEBENCH_CAPABILITY_MATRIX_EN.md`](doc/WAVEBENCH_CAPABILITY_MATRIX_EN.md) for all 26 WaveBench `0.8.24` scope capabilities. Six are declared; every other item has an explicit firmware, option, core-model, or safety disposition. The cross-vendor core impact RFC remains `Draft / Needs revision`; transport/session P0 is adopted, while typed-scope and generic-write proposals remain open. This plugin branch does not modify WaveBench core.
-
-Redacted hardware results are in [`doc/HARDWARE_ACCEPTANCE_EN.md`](doc/HARDWARE_ACCEPTANCE_EN.md). They contain no resource address, serial number, raw waveform, screenshot, or command log.
-
-The repository-level `.gitignore` excludes everything under `doc/vendor-local/` except its explanatory README. Vendor material therefore does not enter Git. Project-authored protocol summaries, coverage matrices, and acceptance records are kept under `doc/`.
-
-## Review order after the manuals arrive
-
-1. Record each title, document number, revision, publication date, applicable platform, and SHA-256.
-2. Separate IEEE 488.2 legacy commands from the `VBS app...` Automation object hierarchy and establish the firmware `8.4.1` boundary.
-3. Verify VICP, VXI-11, and USBTMC behavior against existing WaveBench transports.
-4. Review termination, communication headers, error semantics, waveform templates, binary transfer, screenshots, and state effects.
-5. Freeze the distribution, canonical driver ID, identity gate, and supported models.
-6. Add capabilities through M3–M8 only after FakeTransport tests and tiered hardware acceptance.
+This identity and protocol boundary does not extend to arbitrary LeCroy instruments, SDS3000X,
+SDS3000X HD, or other SIGLENT SDS families.
 
 ## Safety boundaries
 
@@ -85,6 +34,9 @@ The repository-level `.gitignore` excludes everything under `doc/vendor-local/`
 - Instrument writes, output changes, and acquisition triggers must not be retried blindly.
 - Real resources, serial numbers, credentials, raw waveforms, screenshots, and laboratory logs must not be committed.
 
-## License boundary
+## Development and license
 
-Project-authored documentation in this directory is covered by the repository's root MIT License. Vendor material placed under `doc/vendor-local/` retains its original rights status; it does not become MIT-licensed and is not part of a public distribution.
+The [plugin documentation](doc/README_EN.md) covers local manuals, audit order, and publishing
+boundaries. Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md)
+for source work. Project-authored code and documentation use the [MIT License](LICENSE); vendor
+material retains its original rights status and is not part of the public distribution.
diff --git a/packages/wavebench-siglent-sds3000/doc/README.md b/packages/wavebench-siglent-sds3000/doc/README.md
new file mode 100644
index 0000000..57e72d2
--- /dev/null
+++ b/packages/wavebench-siglent-sds3000/doc/README.md
@@ -0,0 +1,28 @@
+# SDS3000 插件文档
+
+[English](README_EN.md)
+
+本页导航 SDS3000 插件的当前能力、手册审计、实机证据和 Core 影响评估。当前版本、型号、
+兼容范围和 capability 以包元数据与 production descriptor 为准。
+
+## 当前 Reference
+
+- [WaveBench capability 覆盖矩阵](WAVEBENCH_CAPABILITY_MATRIX.md)
+- [仓库级插件目录](../../../doc/reference/plugin-catalog.md)
+
+## 验收与历史证据
+
+- [SDS3054 实机验收](HARDWARE_ACCEPTANCE.md)
+- [跨插件验收与历史证据索引](../../../doc/evidence/README.md)
+
+## 手册审计
+
+- [编程手册基线](MANUAL_BASELINE.md)
+- [手册指令覆盖基线](COMMAND_COVERAGE.md)
+- [本地厂商资料存放规则](vendor-local/README.md)
+
+## 设计与开发
+
+- [WaveBench Core RFC 影响评估](WAVEBENCH_CORE_RFC.md)
+- [仓库开发环境](../../../doc/DEVELOPMENT.md)
+- [返回插件入口](../README.md)
diff --git a/packages/wavebench-siglent-sds3000/doc/README_EN.md b/packages/wavebench-siglent-sds3000/doc/README_EN.md
new file mode 100644
index 0000000..f17aed0
--- /dev/null
+++ b/packages/wavebench-siglent-sds3000/doc/README_EN.md
@@ -0,0 +1,29 @@
+# SDS3000 Plugin Documentation
+
+[中文](README.md)
+
+This page routes readers to current SDS3000 capabilities, manual audits, hardware evidence, and the
+Core impact assessment. Package metadata and the production descriptor are authoritative for the
+current version, model, compatibility range, and capabilities.
+
+## Current Reference
+
+- [WaveBench capability matrix](WAVEBENCH_CAPABILITY_MATRIX_EN.md)
+- [Repository plugin catalog](../../../doc/reference/plugin-catalog-en.md)
+
+## Acceptance and historical evidence
+
+- [SDS3054 hardware acceptance](HARDWARE_ACCEPTANCE_EN.md)
+- [Cross-plugin acceptance and historical evidence index](../../../doc/evidence/README_EN.md)
+
+## Manual audits
+
+- [Programming-manual baseline](MANUAL_BASELINE_EN.md)
+- [Manual command-coverage baseline](COMMAND_COVERAGE_EN.md)
+- [Local vendor-material storage rules](vendor-local/README.md)
+
+## Design and development
+
+- [WaveBench Core RFC impact assessment](WAVEBENCH_CORE_RFC_EN.md)
+- [Repository development environment](../../../doc/DEVELOPMENT_EN.md)
+- [Return to the plugin landing page](../README_EN.md)
diff --git a/packages/wavebench-siglent-sds800x-hd/README.md b/packages/wavebench-siglent-sds800x-hd/README.md
index 34a028d..f9d3399 100644
--- a/packages/wavebench-siglent-sds800x-hd/README.md
+++ b/packages/wavebench-siglent-sds800x-hd/README.md
@@ -2,50 +2,23 @@
 
 [English](README_EN.md)
 
-面向 SIGLENT SDS800X HD 系列示波器的外置 WaveBench 驱动包。`0.6.0` 提供严格身份、模拟通道耦合、`DMAX` 波形读取与单次采集、只读测量统计、PNG 截图，以及独立采集运行状态与控制。当前公开能力均已在 SDS804X HD TCPIP/VXI-11 路径完成受控实机验收。
+面向 SIGLENT SDS800X HD 系列示波器的 WaveBench 仪器插件。SDS804X HD 是当前代表性实机
+基线；其他型号的具体身份返回和实机范围以证据页面为准。
 
-## 当前状态
+## 从这里开始
 
-- Distribution：`wavebench-siglent-sds800x-hd` `0.6.0`
-- Canonical driver ID：`siglent.sds800x-hd`
-- 仪器类型：`scope`
-- Backend：WaveBench 核心 `pyvisa` transport
-- Resource scheme：`tcpip`、`usb`
-- 已声明 capability：`scope.idn`、`scope.channel_coupling`、`scope.fetch_waveform`、`scope.capture_waveform`、`scope.capture_waveforms`、`scope.measurement_statistics`、`scope.screenshot_profile`、`scope.screenshot_v2`、`scope.acquisition_run_state`、`scope.acquisition_control`
-- WaveBench：`>=0.8.23,<0.9`
+- [查询当前版本、兼容范围、型号和 capability](../../doc/reference/plugin-catalog.md)
+- [进入 SDS800X HD 插件文档](doc/README.md)
+- [安装和管理 WaveBench 插件](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-descriptor 导入不执行仪器 I/O；factory 只通过 `DriverContext.open_transport()` 获取一个核心 transport。driver 每次显式 `idn()` 都发送 `*IDN?` 并严格核对四字段、厂商、支持型号和 14 字符 ASCII 序列号；同一 operation 内复用已解析型号。读取 coupling 前按型号限制二通道或四通道范围，再发送 `:CHANnel<n>:COUPling?`；只接受 `AC`、`DC` 或 `GND`。波形读取使用核心 `query_bin_block()`，返回核心 `WaveformData` / `WaveformHeader`。`close()` 幂等释放 transport。
+## 当前边界
 
-## 产品范围
+当前实现覆盖严格身份检查、模拟通道 coupling、`DMAX` 波形读取与单次采集、只读测量统计、
+PNG 截图，以及独立采集运行状态与控制。精确 capability、profile 和型号范围以 production
+descriptor 为准；[功能覆盖矩阵](doc/SDS800X_HD_COVERAGE_MATRIX.md)说明协议行为和未支持项。
 
-官方数据手册列出以下型号：
-
-- 两通道：`SDS802X HD`、`SDS812X HD`、`SDS822X HD`；
-- 四通道：`SDS804X HD`、`SDS814X HD`、`SDS824X HD`。
-
-型号覆盖、LAN/USB 接口和 SCPI 远控能力来自 [SIGLENT SDS800X HD 产品资料](https://www.siglent.com/int/products-overview/sds800x-hd/)。当前 `idn_patterns` 使用公开型号字符串；严格 identity parser 依据 CN11G 的四字段格式。SDS804X HD 已取得脱敏实机样本，其他五个型号的具体返回仍待补证。
-
-官方数据手册说明该系列模拟输入为固定 `1 MΩ`，没有内部 `50 Ω` 端接，因此 descriptor 声明 `fixed-high-impedance`。SDS804X HD 已完成 coupling、`1×` 探头和高阻连接复核；其他型号仍待补证。
-
-## 当前能力
-
-- `scope.idn`：每次返回本 operation 内 fresh query 并严格校验的原始 `*IDN?` 文本。
-- `scope.channel_coupling`：返回大写 `AC`、`DC` 或 `GND`；无效类型、型号不存在的通道和未知响应均在 driver 边界拒绝。
-- `scope.fetch_waveform`：读取已经停止的非 sequence 模拟通道记录；当前只支持 `points="dmax"`。
-- `scope.capture_waveform` / `scope.capture_waveforms`：执行一次 SINGLE acquisition，轮询到 Stop 后读取一个或多个模拟通道；当前只支持 `points="dmax"`。
-- `scope.measurement_statistics`：只读查询已经配置并启用的高级测量槽位；不会创建槽位、开启统计或重置历史。
-- `scope.screenshot_profile` / `scope.screenshot_v2`：通过核心 MESSAGE binary 边界读取 `1024×600` PNG，支持普通和反色输出；严格验证 IEND 后的单个 `0A` content trailing，不保存图片。
-- `scope.acquisition_run_state` / `scope.acquisition_control`：读取触发运行阶段，支持 AUTO/NORMAL 连续启动、STOP 和 SINGLE；SINGLE 完成只使用状态迁移证明，失败时恢复 acquisition/trigger baseline 并 fresh readback。
-
-直接调用 `scope.channel_coupling` 时会先读取身份，以免在二通道型号上向不存在的 CH3 或 CH4 发送命令。WaveBench `status` fallback 在同一会话中先调用 `idn()`，因此不会重复身份查询。
-
-波形读取不触发新的 acquisition，也不发送 `RUN`、`SINGLE` 或 `STOP`。driver 要求 `:TRIGger:STATus?` 返回 `Stop` 且 `:ACQuire:SEQuence?` 返回 `OFF`，随后保存 `SOURCE`、`START`、`INTERVAL`、`POINT`、`WIDTH` 和 `BYTEorder`。事务临时使用 `WORD`、`LSB`、`START 0`、`INTERVAL 1` 和 `POINT 0`，按 `MAXPoint?` 分块读取，成功或失败后均按依赖顺序恢复原 transfer 状态。
-
-单次采集设置并回读 `TRIGger:MODE SINGLE`，发送 `TRIGger:RUN`，轮询 `TRIGger:STATus?` 直到 Stop，再要求 `ACQuire:NUMACq? >= 1`。超时或模式写入未生效时会发送 `TRIGger:STOP`。多通道接口只执行一次 acquisition，随后逐通道读取同一份停止记录；不使用 `*OPC?` 代替物理触发完成条件。
-
-测量统计要求调用方明确确认槽位已经配置。driver 还会回读高级测量模式、槽位开关和统计开关，只在三项均满足时查询当前值、均值、最小值、最大值、标准差和统计次数。历史缓冲区只在调用方明确确认 acquisition 已停止时读取；所有统计接口均为零写入。
-
-CN11G 没有记录错误队列命令，因此此插件不声明 `scope.errors`。WaveBench 服务在 `scope.check_errors=true` 时会要求该 capability；使用波形读取必须显式配置：
+该系列模拟输入固定为 `1 MΩ`，没有内部 `50 Ω` 端接。CN11G 没有记录错误队列命令，因此
+插件不声明 `scope.errors`。使用波形读取时必须显式关闭 WaveBench 错误队列检查：
 
 ```toml
 [scope]
@@ -58,38 +31,17 @@ byte_order = "lsbf"
 points = "dmax"
 ```
 
-直接调用 driver 时，`check_errors=True`、`points="def"` 和 `points="max"` 均在任何仪器 I/O 前失败。CN11G 的 `WAVeform:POINt` 参数只记录整数 NR1；当前不把 WaveBench 的 `DEF/MAX` 映射成未经证明的仪器关键字。
-
-## 暂不提供的能力
-
-当前版本不声明以下 capability：
-
-- `scope.errors`
-- `scope.autoscale`
-- `scope.trace_metadata` / `scope.fetch_trace`
-- 测量配置、数学/FFT、数字通道和历史帧能力
-
-编程手册中的其他命令只有在完成格式审计、FakeTransport 测试和必要的受控实机验收后，才会进入 driver 和 descriptor。当前没有 raw SCPI 入口，也不推测其他 SIGLENT 系列的协议可以直接复用。`scope.fetch_waveform` 是读取现有记录，不等同于 `capture_waveform`。
-
-## 编程手册投放位置
-
-本地 `CN11G` 编程手册及转换结果保存在：
-
-```text
-doc/vendor-local/
-```
-
-当前转换因工具限制拆为三个目录。手册支持表将 SDS800X HD 的最低固件列为 `1.1.3.1`。官方入口为 [SDS800X HD Series Programming Guide](https://www.siglent.com/na/sds800x-hd-series-programming-guide/)，项目原创结论见[功能覆盖矩阵](doc/SDS800X_HD_COVERAGE_MATRIX.md)和[实机验收记录](doc/SDS800X_HD_HARDWARE_ACCEPTANCE.md)。
-
-`doc/vendor-local/` 中除说明文件外的内容由仓库级 `.gitignore` 排除，整个目录也被 sdist 构建规则排除。厂商 PDF 不会随 Git push 或公开 distribution 发布；项目原创的协议摘要、能力矩阵和验收记录应另写入 `doc/`。
+当前只接受 `points="dmax"`。`points="def"`、`points="max"` 和 `check_errors=True` 会在仪器
+I/O 前失败。插件不提供 raw SCPI，也不将其他 SIGLENT 系列的协议推定为兼容。
 
-## 下一阶段门禁
+## 安全边界
 
-1. 使用其他 SDS800X HD 型号获取脱敏 `*IDN?` 样本，复核身份格式和二通道、四通道 coupling 返回。
-2. 后续取得 USB 条件时，复核 binary block、WORD 对齐、时基和 transfer 状态恢复；TCPIP 真实多块已验收。
-3. 仅在取得明确协议或实机证据后评估 `DEF/MAX` 点数模式；不得猜测关键字。
-4. 截图和独立采集控制已按核心 `0.8.23` Scope R1.3 合同 opt-in；typed trace 受 `8388608` 点上限与现有 `10M` 记录的兼容性边界阻塞，math/FFT 等待后续通用扩展合同。不通过私有 raw SCPI 绕过核心。
+descriptor 导入不执行仪器 I/O；factory 只通过 `DriverContext.open_transport()` 获取 Core
+transport。默认测试使用 FakeTransport。真实设备地址、序列号、原始波形、截图和命令日志
+不得提交。
 
-## 许可证
+## 开发与许可证
 
-本目录中由项目原创的代码和文档采用 [MIT License](LICENSE)。本地厂商手册不因此获得 MIT 授权，也不属于公开 distribution。
+本地手册、实机验收和 Scope R1.3 conformance 入口见 [插件文档](doc/README.md)。日常源码开发
+使用仓库级 [editable 开发环境](../../doc/DEVELOPMENT.md)。项目原创代码和文档采用
+[MIT License](LICENSE)；厂商资料不属于公开 distribution。
diff --git a/packages/wavebench-siglent-sds800x-hd/README_EN.md b/packages/wavebench-siglent-sds800x-hd/README_EN.md
index cefe347..f059a3c 100644
--- a/packages/wavebench-siglent-sds800x-hd/README_EN.md
+++ b/packages/wavebench-siglent-sds800x-hd/README_EN.md
@@ -2,50 +2,27 @@
 
 [中文](README.md)
 
-An external WaveBench driver package for the SIGLENT SDS800X HD oscilloscope family. Version 0.6.0 provides strict identity, analog-channel coupling, `DMAX` waveform reads and captures, read-only measurement statistics, PNG screenshots, and standalone acquisition run-state/control. Every declared capability has controlled TCPIP/VXI-11 hardware evidence from an SDS804X HD.
+A WaveBench instrument plugin for the SIGLENT SDS800X HD oscilloscope family. The SDS804X HD is the
+current representative hardware baseline; exact identity responses and hardware scope for other
+models remain bounded by the evidence pages.
 
-## Current status
+## Start here
 
-- Distribution: `wavebench-siglent-sds800x-hd` `0.6.0`
-- Canonical driver ID: `siglent.sds800x-hd`
-- Instrument kind: `scope`
-- Backend: WaveBench core `pyvisa` transport
-- Resource schemes: `tcpip`, `usb`
-- Declared capabilities: `scope.idn`, `scope.channel_coupling`, `scope.fetch_waveform`, `scope.capture_waveform`, `scope.capture_waveforms`, `scope.measurement_statistics`, `scope.screenshot_profile`, `scope.screenshot_v2`, `scope.acquisition_run_state`, `scope.acquisition_control`
-- WaveBench: `>=0.8.23,<0.9`
+- [Find the current version, compatibility range, models, and capabilities](../../doc/reference/plugin-catalog-en.md)
+- [Browse the SDS800X HD plugin documentation](doc/README_EN.md)
+- [Install and manage WaveBench plugins](https://github.com/Scaxlibur/wavebench/blob/master/docs/how-to/manage-plugins.md)
 
-Descriptor import performs no instrument I/O. The factory obtains exactly one core transport through `DriverContext.open_transport()`. Every explicit `idn()` call sends `*IDN?` and validates all four fields, the manufacturer, supported model, and 14-character ASCII serial; parsed model data is reused within the same operation. Before reading coupling, the driver applies the model-specific two- or four-channel limit and sends `:CHANnel<n>:COUPling?`; only `AC`, `DC`, and `GND` are accepted. Waveforms use the core `query_bin_block()` transport and return the core `WaveformData` / `WaveformHeader` models. `close()` releases the transport idempotently.
+## Current boundary
 
-## Product scope
+The implementation covers strict identity checks, analog-channel coupling, `DMAX` waveform reads and
+single acquisitions, read-only measurement statistics, PNG screenshots, and standalone acquisition
+run-state/control. The production descriptor is authoritative for exact capabilities, profiles, and
+model scope. The [coverage matrix](doc/SDS800X_HD_COVERAGE_MATRIX_EN.md) explains protocol behavior
+and unsupported areas.
 
-The official data sheet lists these models:
-
-- Two channels: `SDS802X HD`, `SDS812X HD`, and `SDS822X HD`.
-- Four channels: `SDS804X HD`, `SDS814X HD`, and `SDS824X HD`.
-
-The model range, LAN/USB interfaces, and SCPI remote-control support come from the [official SIGLENT SDS800X HD product material](https://www.siglent.com/int/products-overview/sds800x-hd/). The `idn_patterns` use public model strings, and the strict parser follows the CN11G four-field format. A redacted SDS804X HD sample is now accepted; exact responses from the other five models remain pending.
-
-The official data sheet specifies fixed `1 MΩ` analog inputs with no internal `50 Ω` termination, so the descriptor declares `fixed-high-impedance`. Coupling, `1×` probe factors, and the high-impedance connection were confirmed on the SDS804X HD; other models remain pending.
-
-## Current capabilities
-
-- `scope.idn` returns a freshly queried and validated original `*IDN?` response for each operation.
-- `scope.channel_coupling` returns uppercase `AC`, `DC`, or `GND`; invalid types, channels missing from a model, and unknown responses fail at the driver boundary.
-- `scope.fetch_waveform` reads an already-stopped, non-sequence analog record and currently supports only `points="dmax"`.
-- `scope.capture_waveform` / `scope.capture_waveforms` perform one SINGLE acquisition, wait for Stop, and read one or more analog channels; only `points="dmax"` is currently supported.
-- `scope.measurement_statistics` reads an already configured and enabled advanced-measurement slot without creating slots, enabling statistics, or resetting history.
-- `scope.screenshot_profile` / `scope.screenshot_v2` use the core MESSAGE binary boundary to return `1024×600` PNG data in normal or inverted form. The driver validates the single `0A` content-trailing byte after IEND and does not persist the image.
-- `scope.acquisition_run_state` / `scope.acquisition_control` expose run phase, AUTO/NORMAL continuous start, STOP, and SINGLE. SINGLE completion uses state-transition proof only; failure cleanup restores the acquisition/trigger baseline and performs a fresh readback.
-
-A direct coupling query reads identity first, preventing a CH3 or CH4 command on a two-channel model. The WaveBench status fallback already calls `idn()` first in the same session, so that path does not duplicate the identity query.
-
-Waveform fetch does not start a new acquisition and sends no `RUN`, `SINGLE`, or `STOP`. The driver requires `:TRIGger:STATus?` to return `Stop` and `:ACQuire:SEQuence?` to return `OFF`, then saves `SOURCE`, `START`, `INTERVAL`, `POINT`, `WIDTH`, and `BYTEorder`. The transaction temporarily selects `WORD`, `LSB`, `START 0`, `INTERVAL 1`, and `POINT 0`, reads chunks according to `MAXPoint?`, and restores the original transfer state in dependency order on both success and failure.
-
-Single capture writes and verifies `TRIGger:MODE SINGLE`, sends `TRIGger:RUN`, polls `TRIGger:STATus?` until Stop, and then requires `ACQuire:NUMACq? >= 1`. A timeout or ignored mode write sends `TRIGger:STOP`. Multichannel capture performs one acquisition and then reads every requested channel from the same stopped record. It does not use `*OPC?` as a substitute for physical trigger completion.
-
-Statistics calls require explicit confirmation that the slot is already configured. The driver also verifies advanced-measurement mode, the slot switch, and the statistics switch before reading current, mean, minimum, maximum, standard deviation, and count. History is read only after explicit confirmation that acquisition is stopped. All statistics paths are query-only.
-
-CN11G documents no error-queue query, so the plugin does not declare `scope.errors`. WaveBench requires that capability when `scope.check_errors=true`; waveform use therefore requires explicit configuration:
+The family has fixed `1 MΩ` analog inputs and no internal `50 Ω` termination. CN11G documents no
+error-queue command, so the plugin does not declare `scope.errors`. Waveform use must disable the
+WaveBench error-queue check explicitly:
 
 ```toml
 [scope]
@@ -58,38 +35,19 @@ byte_order = "lsbf"
 points = "dmax"
 ```
 
-Direct driver calls with `check_errors=True`, `points="def"`, or `points="max"` fail before any instrument I/O. CN11G specifies only an integer NR1 parameter for `WAVeform:POINt`; this version does not invent unverified instrument keywords for WaveBench `DEF/MAX` modes.
-
-## Capabilities not exposed
-
-Version 0.6.0 does not declare:
-
-- `scope.errors`
-- `scope.autoscale`
-- `scope.trace_metadata` / `scope.fetch_trace`
-- measurement configuration, math/FFT, digital-channel, or history capabilities
-
-Other commands from the programming guide enter the driver and descriptor only after format review, FakeTransport tests, and controlled hardware acceptance where required. The plugin has no raw-SCPI surface and does not assume that another SIGLENT family uses an identical protocol. `scope.fetch_waveform` reads an existing record; it is not equivalent to `capture_waveform`.
-
-## Programming-guide drop location
-
-The local `CN11G` guide and its converted content remain under:
-
-```text
-doc/vendor-local/
-```
-
-Converter limits split the current copy across three directories. The manual support table lists `1.1.3.1` as the minimum SDS800X HD firmware. The official entry is [SDS800X HD Series Programming Guide](https://www.siglent.com/na/sds800x-hd-series-programming-guide/); project-authored conclusions are in the [coverage matrix](doc/SDS800X_HD_COVERAGE_MATRIX_EN.md) and [hardware acceptance record](doc/SDS800X_HD_HARDWARE_ACCEPTANCE_EN.md).
-
-The repository-level `.gitignore` excludes every file under `doc/vendor-local/` except its explanatory README, and the sdist build excludes the whole directory. Vendor PDFs therefore do not enter Git pushes or public distributions. Project-authored protocol summaries, capability matrices, and acceptance records belong elsewhere under `doc/`.
+Only `points="dmax"` is accepted. `points="def"`, `points="max"`, and `check_errors=True` fail before
+instrument I/O. The plugin exposes no raw SCPI and does not assume protocol compatibility with other
+SIGLENT families.
 
-## Next-stage gates
+## Safety boundary
 
-1. Obtain redacted `*IDN?` samples from additional SDS800X HD models and verify identity plus two- and four-channel coupling responses.
-2. When USB hardware becomes available, verify binary blocks, WORD alignment, timebase values, and transfer-state restoration; real TCPIP multi-chunk reading is accepted.
-3. Consider `DEF/MAX` point modes only after explicit protocol or hardware evidence; do not guess keywords.
-4. Screenshot and standalone acquisition control now opt into the WaveBench `0.8.23` Scope R1.3 contract. Typed trace remains blocked by the compatibility boundary between the core `8388608`-point limit and the accepted SDS `10M` record. Math/FFT remains in a later generic extension contract. Do not bypass the core with private raw SCPI.
+Descriptor import performs no instrument I/O, and the factory obtains its Core transport only through
+`DriverContext.open_transport()`. Default tests use FakeTransport. Never commit real device resources,
+serial numbers, raw waveforms, screenshots, or command logs.
 
-## License
+## Development and license
 
-Project-authored code and documentation in this directory are licensed under the [MIT License](LICENSE). Locally retained vendor manuals do not thereby become MIT-licensed and are not part of the public distribution.
+The [plugin documentation](doc/README_EN.md) links local manuals, hardware acceptance, and Scope R1.3
+conformance. Use the repository-level [editable development environment](../../doc/DEVELOPMENT_EN.md)
+for source work. Project-authored code and documentation use the [MIT License](LICENSE); vendor material
+is not part of the public distribution.
diff --git a/packages/wavebench-siglent-sds800x-hd/doc/README.md b/packages/wavebench-siglent-sds800x-hd/doc/README.md
new file mode 100644
index 0000000..1772e05
--- /dev/null
+++ b/packages/wavebench-siglent-sds800x-hd/doc/README.md
@@ -0,0 +1,30 @@
+# SDS800X HD 插件文档
+
+[English](README_EN.md)
+
+本页导航 SDS800X HD 插件的当前 Reference、实机证据、Scope R1.3 conformance 和本地厂商资料。
+当前版本、型号、兼容范围和 capability 以包元数据与 production descriptor 为准。
+
+## 当前 Reference
+
+- [当前功能覆盖与行为边界](SDS800X_HD_COVERAGE_MATRIX.md)
+- [仓库级插件目录](../../../doc/reference/plugin-catalog.md)
+
+## 开发
+
+- [功能覆盖开发路线](SDS800X_HD_COVERAGE_MILESTONES.md)
+- [仓库开发环境](../../../doc/DEVELOPMENT.md)
+
+## 验收与 conformance
+
+- [实机验收记录](SDS800X_HD_HARDWARE_ACCEPTANCE.md)
+- [Scope R1.3 conformance 证据](SDS800X_HD_R13_CONFORMANCE.md)
+- [跨插件验收与历史证据索引](../../../doc/evidence/README.md)
+
+验收和 conformance 页面保存特定设备、版本与时间点的证据，不独立提升当前 capability。
+
+## 厂商资料
+
+- [本地 CN11G 编程手册存放规则](vendor-local/README.md)
+- [SIGLENT SDS800X HD 产品资料](https://www.siglent.com/int/products-overview/sds800x-hd/)
+- [返回插件入口](../README.md)
diff --git a/packages/wavebench-siglent-sds800x-hd/doc/README_EN.md b/packages/wavebench-siglent-sds800x-hd/doc/README_EN.md
new file mode 100644
index 0000000..857ab7d
--- /dev/null
+++ b/packages/wavebench-siglent-sds800x-hd/doc/README_EN.md
@@ -0,0 +1,32 @@
+# SDS800X HD Plugin Documentation
+
+[中文](README.md)
+
+This page routes readers to the current SDS800X HD Reference, hardware evidence, Scope R1.3
+conformance, and local vendor material. Package metadata and the production descriptor are
+authoritative for the current version, models, compatibility range, and capabilities.
+
+## Current Reference
+
+- [Current coverage and behavior boundaries](SDS800X_HD_COVERAGE_MATRIX_EN.md)
+- [Repository plugin catalog](../../../doc/reference/plugin-catalog-en.md)
+
+## Development
+
+- [Feature-coverage development roadmap](SDS800X_HD_COVERAGE_MILESTONES_EN.md)
+- [Repository development environment](../../../doc/DEVELOPMENT_EN.md)
+
+## Acceptance and conformance
+
+- [Hardware acceptance record](SDS800X_HD_HARDWARE_ACCEPTANCE_EN.md)
+- [Scope R1.3 conformance evidence](SDS800X_HD_R13_CONFORMANCE.md) (Chinese only)
+- [Cross-plugin acceptance and historical evidence index](../../../doc/evidence/README_EN.md)
+
+Acceptance and conformance pages preserve evidence for particular devices, versions, and points in
+time. They do not independently promote current capabilities.
+
+## Vendor material
+
+- [Local CN11G programming-guide storage rules](vendor-local/README.md)
+- [SIGLENT SDS800X HD product material](https://www.siglent.com/int/products-overview/sds800x-hd/)
+- [Return to the plugin landing page](../README_EN.md)
diff --git a/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MATRIX.md b/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MATRIX.md
index a5fee8c..46aeddb 100644
--- a/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MATRIX.md
+++ b/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MATRIX.md
@@ -2,119 +2,87 @@
 
 [English](SDS800X_HD_COVERAGE_MATRIX_EN.md)
 
-## 目的与证据边界
-
-本矩阵将 SIGLENT《SDS 系列数字示波器编程手册》`CN11G` 与 WaveBench
-`siglent.sds800x-hd` 外置插件对照。它用于区分手册声明、离线实现和实机验收，不把通用
-SDS 命令自动视为 SDS800X HD 的可用能力。
-
-本地手册因转换工具限制拆为三个目录，正文合计三个 `full.md`。原始转换内容保存在
-`doc/vendor-local/`，由 Git 和 sdist 排除。手册支持表将 SDS800X HD 的最低固件列为
-`1.1.3.1`，但没有逐条标注每个系列支持的命令；型号和固件仍需通过目标仪器确认。
-
-当前证据标签：
-
-- **实机已验收**：当前外置插件、目标 SDS800X HD 实机和受控测试证据同时存在。
-- **已实现 / 离线验证**：该功能已有 driver 和 FakeTransport 测试，但尚无对应实机证据。
-- **手册已审计**：命令格式和返回语义已核对，但尚未公开 capability。
-- **插件采用待验收**：核心接口已经提供，但本插件的正式 driver、profile 或实机证据尚未完成。
-- **实机阻塞**：离线代码不足以证明响应 framing、状态迁移或硬件差异。
-- **默认拒绝**：命令会修改全局状态、写仪器存储或缺少可靠恢复边界。
-
-核心 `0.8.23` 已实现 Scope R1.3 公共合同。核心完成不表示 SDS800X HD 自动获得新能力；正式
-driver、descriptor profile、backend/resource 和实机恢复证据仍须分别验收。
-
-## 当前覆盖
-
-| 功能域 | 手册命令面 | WaveBench 映射 | 当前状态 | 边界与下一步 |
-|---|---|---|---|---|
-| 身份 | `*IDN?` | `scope.idn` | **SDS804X HD 实机已验收** | 四字段、厂商、型号、14 字符 ASCII 序列号和固件格式通过；其他型号待补 |
-| 模拟通道耦合 | `:CHANnel<n>:COUPling?`，返回 `AC`、`DC` 或 `GND` | `scope.channel_coupling` | **SDS804X HD 实机已验收** | CH1–CH4 均返回 DC；二通道型号和其他 coupling 状态待补 |
-| 输入阻抗 | 通用手册列出 `ONEMeg`、`FIFTy` | 无独立 capability | **默认拒绝** | SDS800X HD 专属产品资料说明固定 `1 MΩ`；不得把通用 `FIFTy` setter 外推到本系列 |
-| 错误队列 | CN11G 未记录错误队列命令 | `scope.errors` | **设备协议阻塞** | 核心接口已经存在；本系列没有可依赖命令，不猜测 `SYSTem:ERRor?`，也不返回伪造的空列表 |
-| 波形读取 | `SOURce`、`STARt`、`INTerval`、`POINt`、`MAXPoint?`、`WIDTh`、`BYTeorder`、`PREamble?`、`DATA?` | `scope.fetch_waveform` | **SDS804X HD 多块实机已验收** | Stop、sequence OFF、CH1/CH2 `DMAX`、WORD/LSB、数值和成功/异常恢复通过；`10M` 记录按 `5M + 5M` 两块读取通过，USB 待补 |
-| Sequence 门禁 | `:ACQuire:SEQuence?` | `scope.fetch_waveform` 的前置条件 | **SDS804X HD 实机已验收** | `NORMAL` 触发模式下建立 Stop + sequence ON；driver 在任何 waveform 写入和 binary query 前拒绝 |
-| 测量统计 | `:MEASure:MODE?`、`ADVanced:P<n>?`、`TYPE?`、`STATistics?`、`SHIStory?` | `scope.measurement_statistics` | **SDS804X HD 实机已验收** | 只读既有槽位；P3 `PKPK` 的 6 项统计和停止态 5 项历史通过，driver 零写入 |
-| 单次与多通道采集 | `TRIGger:MODE`、`RUN`、`STOP`、`STATus?`、`ACQuire:NUMACq?` | `scope.capture_waveform`、`scope.capture_waveforms` | **SDS804X HD 实机已验收** | SINGLE 模式回读、Stop 轮询和采集计数通过；CH1/CH2 只执行一次 acquisition，不依赖 `*OPC?` |
-| 触发运行状态 | `:TRIGger:STATus?` 返回 `Arm`、`Ready`、`Auto`、`Trig'd`、`Stop` 或 `Roll` | `scope.acquisition_run_state`、`scope.acquisition_control` | **SDS804X HD 实机已验收** | AUTO/NORMAL start、STOP、SINGLE 状态迁移通过；SINGLE 和 start 注入失败后 baseline 恢复与 fresh readback 均为 `verified` |
-| 截图 | `:PRINt? PNG,NORMal` 或反色格式 | `scope.screenshot_profile`、`scope.screenshot_v2` | **SDS804X HD 实机已验收** | 真实 PyVISA MESSAGE EOM 通过；普通/反色均为 `1024×600` PNG，IEND 后精确一个 `0A`；注入应用层失败后下一查询仍同步 |
-| Autoset | `:AUToset` | `scope.autoscale` | **默认拒绝** | 同时修改触发、垂直和水平设置；没有错误队列和恢复闭环 |
-| 采集状态 | `ACQuire:TYPE?`、`SEQuence?`、`NUMACq?` 等 | `scope.acquisition_run_state` | **SDS804X HD 实机已验收** | 旧 `ScopeAcquisitionStatus` 仍不匹配；count 只作诊断，完成证明使用状态迁移；实机确认切换 SINGLE 将非零 count 复位为 `0` |
-| Math / FFT | `FUNCtion<n>`、`OPERation?`、`SOURce?`、FFT scale/span 等 | 现有 metadata/status；频谱读取待后续 trace 扩展 | **后续核心接口待设计** | 实机 F1–F4 均为 OFF；当前没有可证明的通用 FFT ready/RBW 数据，也不能把频率轴塞入模拟波形模型 |
-| Snapshot、测量配置、数字与历史 | 多个通用 SDS 子系统 | 对应可选 Scope capability | **未覆盖** | 逐能力核对型号、选件、公共模型和恢复语义后再拆分 |
-| Reset、系统和仪器文件系统 | `*RST`、系统设置、保存/调用、图片保存等 | 无基础 capability | **默认拒绝** | 可能改变全局状态、网络或持久存储，不纳入基础驱动 |
-
-## 已确认的波形协议边界
-
-`PREamble?` 返回 definite-length binary block，其 descriptor 固定部分为 346 bytes；sequence
-数据可能在其后附加时间戳。当前纯解析器只支持非 sequence 模拟通道，因此要求核心去除
-IEEE block envelope 后的 payload 恰好为 346 bytes，并显式拒绝附加时间戳，而不是静默
-丢弃。`DATA?` 同样使用带声明长度的 binary block；核心 transport 按声明长度取 payload，
-插件不能对二进制数据使用 `rstrip()`。
-
-SDS804X HD 固件 `4.8.12.1.1.6.5` 的实机 preamble 进一步确认：非 sequence 记录返回
-`read_frames=0`、`sum_frames=1`、`segment=-1`。手册示例使用的 `segment=1` 形式也保留；
-其他帧组合继续拒绝。该固件的 WORD preamble 实测为 `100000` 点、`200000` bytes、
-`50.000000584 ns` sample interval，和解析公式一致。补充长记录验收又确认 `10000000` 点、
-`MAXPoint=5000000` 时按 `START 0` 和 `START 5000000` 完成两块读取。
-
-首版模拟波形换算使用手册字段：
+本页将 SIGLENT SDS 系列编程手册 `CN11G` 的功能域映射到外置
+`wavebench-siglent-sds800x-hd` 插件当前公开的 WaveBench capability。当前包版本、依赖和
+入口点以 [包元数据](../pyproject.toml)为准，型号、resource scheme、配置字段和 capability 以
+[production descriptor](../src/wavebench_siglent_sds800x_hd/descriptor.py) 为准，截图和采集控制
+边界以 [profiles](../src/wavebench_siglent_sds800x_hd/profiles.py) 为准，精确 SCPI 与事务行为以
+[driver](../src/wavebench_siglent_sds800x_hd/driver.py) 为准。
+
+[功能覆盖开发路线](SDS800X_HD_COVERAGE_MILESTONES.md)记录阶段状态和后续退出门；
+[实机验收记录](SDS800X_HD_HARDWARE_ACCEPTANCE.md)与
+[Scope R1.3 conformance](SDS800X_HD_R13_CONFORMANCE.md)保存特定设备、固件、transport 和
+步骤的证据。这些页面用于追溯，不会独立增加当前 capability。
+
+## 范围
+
+`CN11G` 是多个 SDS 系列共用的编程手册，没有逐条标注每个命令适用的系列。通用手册命令
+不能自动视为 SDS800X HD 能力。本地转录只用于内部审计，位于 Git 忽略且不进入 sdist 的
+`doc/vendor-local/`。
+
+本矩阵只回答「production descriptor 当前公开什么」以及「公开行为的边界是什么」。Core
+增加公共合同、Python 方法存在、离线测试或一次实机成功，都不能替代 descriptor 声明。
+
+## 功能覆盖
+
+| 功能域 | 手册命令面 | 当前公开 capability | 当前边界 |
+|---|---|---|---|
+| 身份 | `*IDN?` | `scope.idn` | 严格解析四字段 identity，并按 descriptor 登记型号验证通道数。未知厂商、型号或格式会失败。 |
+| 模拟通道 coupling | `:CHANnel<n>:COUPling?` | `scope.channel_coupling` | 只接受 `AC`、`DC` 或 `GND`；具体通道上限由 identity 型号决定。该系列输入阻抗策略为固定高阻。 |
+| 输入阻抗写入 | 共用手册中的 `ONEMeg`、`FIFTy` | 未声明 | 不把其他 SDS 系列的 `FIFTy` setter 外推到本系列。 |
+| 错误队列 | `CN11G` 未记录可靠 query | 未声明 | 不猜测 `SYSTem:ERRor?`，也不返回伪造的空列表；波形操作要求 `check_errors=false`。 |
+| 已停止记录读取 | waveform source、range、format、preamble、data | `scope.fetch_waveform` | 只接受 `points="dmax"` 和 `check_errors=false`；要求 acquisition 为 Stop、Sequence 为 OFF，并在读取后恢复 transfer state。 |
+| 单／多通道采集 | trigger mode／run／stop／status、waveform | `scope.capture_waveform`、`scope.capture_waveforms` | 先配置全部目标通道，只执行一次 SINGLE，再逐通道读取；不使用 `*OPC?` 作为触发完成证据。 |
+| 测量统计 | mode、slot、type、statistics、history | `scope.measurement_statistics` | 只读取已启用的 Advanced measurement slot；不配置、启用或清空统计。Buffer 只在调用方请求时读取。 |
+| Screenshot | `:PRINt? PNG,NORMal`／`INVerted` | `scope.screenshot_profile`、`scope.screenshot_v2` | 只接受 profile 中的 color／inverted variant，使用 MESSAGE framing，在内存中校验 PNG，不修改持久显示状态。 |
+| Acquisition run state | `:TRIGger:STATus?` | `scope.acquisition_run_state` | 将厂商 token 映射为公共运行状态；acquisition count 只作诊断，不能单独证明完成。 |
+| Acquisition control | trigger mode、run、stop、single | `scope.acquisition_control` | 连续模式只支持 `auto`／`normal`；SINGLE 使用 `configure_then_arm`，失败 cleanup 和恢复顺序由 profile 定义。 |
+| Autoset | `:AUToset` | 未声明 | 会同时改变 trigger、vertical 和 timebase，且当前没有完整恢复合同，默认拒绝。 |
+| Math／FFT | function、operator、source、scale、span | 未声明对应扩展能力 | 频率轴、ready、RBW、sample rate 和 payload 尚无完整公共合同。 |
+| Typed trace | source、metadata、data | 未声明 | 当前长记录与 Core typed trace 点数上限之间尚未形成可声明的完整 profile。 |
+| Snapshot、测量配置、digital、Sequence／history | 共用 SDS 子系统 | 未声明 | 需要逐项核对型号、选件、可读字段和恢复语义，不能创建假完整模型。 |
+| Reset、系统设置与仪器文件 | `*RST`、system、save／recall、image save | 未声明 | 会改变全局、网络或持久状态，默认不进入基础驱动。 |
+
+## Waveform 行为
+
+`fetch_waveform()` 在任何 waveform 写入前验证 `points="dmax"`、`check_errors=false`、目标通道、
+`TRIGger:STATus? = Stop` 和 `ACQuire:SEQuence? = OFF`。随后保存
+`SOURCE/START/INTERVAL/POINT/WIDTH/BYTEorder`，并为本次读取配置目标 source、`WORD`、LSB、
+`START 0`、`INTERVAL 1` 和 `POINT 0`。
+
+`PREamble?` 必须是 Core 去除 IEEE binary-block envelope 后恰好 346 bytes 的 descriptor；附加
+Sequence timestamp 或无法确定的 descriptor byte order 会失败。Driver 验证 source、sample
+width、byte order、点数与 data byte count，再查询 `MAXPoint?` 决定每块上限并读取完整记录。
+成功、协议错误或 transport 异常后都会尝试恢复原 transfer state；恢复失败不会掩盖已有主异常。
+
+模拟波形换算使用：
 
 ```text
 vdiv = vertical_scale_raw * probe
 offset = vertical_offset_raw * probe
 voltage = raw_code * (vdiv / code_per_div) - offset
+x[i] = horizontal_delay - timebase * 10 / 2 + i * sample_interval
 ```
 
-在 `STARt 0`、`INTerval 1` 下，时间轴为：
+8-bit 样本按有符号整数解释；更高 ADC 位数使用 `WORD`、LSB 和有符号 16-bit 解码。高分辨率
+样本按手册保持左对齐，driver 不自行右移。`DEF` 和 `MAX` 在仪器 I/O 前失败，不发送手册未定义
+的点数关键字。
 
-```text
-x[i] = horizontal_delay - timebase * 10 / 2 + i * sample_interval
-```
+## Screenshot 与 acquisition profile
 
-8-bit 样本按有符号整数解释；ADC 位数大于 8 时使用 `WORD`，明确设置 LSB，并按有符号
-16-bit 解码。手册说明高分辨率数据左对齐、低位补零；首版不自行右移。单片上限必须查询
-`MAXPoint?`，不能硬编码手册示例值。
-
-公开的读取事务只接受 WaveBench `DMAX`。CN11G 第 385 页将 `WAVeform:POINt` 参数定义为
-整数 NR1，没有 `DEF/MAX/DMAX` 仪器关键字；driver 使用厂商波形重构示例中的 `POINT 0`
-选择完整记录。`DEF` 和 `MAX` 在任何 I/O 前拒绝，不能为了表面兼容发送无文档依据的命令。
-
-事务先确认 `TRIGger:STATus? = Stop` 和 `ACQuire:SEQuence? = OFF`，再完整保存
-`SOURCE/START/INTERVAL/POINT/WIDTH/BYTEorder`。读取期间固定 `WORD`、LSB、`START 0` 和
-`INTERVAL 1`，由 preamble 给出总点数，由 `MAXPoint?` 给出单片点数。成功、协议错误或
-transport 异常后均尝试恢复全部 transfer 状态；恢复失败不覆盖已有主异常。该流程不发送
-`RUN`、`SINGLE` 或 `STOP`，只读取已经停止的记录。
-
-## 与 WaveBench 核心的接口约束
-
-- driver 只通过 `DriverContext.open_transport()` 获取核心 transport，并负责幂等关闭。
-- capability 只在对应公共方法完整实现后声明；运行时的「方法可调用」校验不替代签名和语义测试。
-- `fetch_waveform(channel, points="dmax", check_errors=True)` 必须返回核心
-  `WaveformData` 和 `WaveformHeader`，不得在插件内复制同名模型。
-- CN11G 没有错误队列，使用 waveform 时必须显式配置 `scope.check_errors=false`；直接调用
-  driver 且 `check_errors=True` 时在任何 I/O 前失败。
-- 当前 `points` 只支持 `DMAX`；公共签名仍保持
-  `fetch_waveform(channel, points="dmax", check_errors=True)`，不伪造 `DEF/MAX` 映射。
-- 多通道 capture 必须先配置全部通道，只触发一次 acquisition，再逐通道读取；不得逐通道重新触发。
-- capture 使用 `DriverContext.opc_timeout_ms` 作为状态轮询 deadline，但不调用 `query_opc()`；
-  `*OPC?` 不作为物理触发完成证据。
-- 截图、独立采集运行控制、类型化 trace source 和三态错误检查已由核心 `0.8.23` 的
-  [Scope R1.3 公共合同](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC_核心实施说明.md)
-  提供。本插件已完成 screenshot 与 acquisition control 采用；typed trace 和 error drain 仍未声明。
-
-## 开发顺序
-
-1. M1：严格身份解析和只读 `scope.channel_coupling`，完成离线测试。
-2. M2：346-byte preamble、数据换算和已停止模拟记录的 `scope.fetch_waveform` 已完成离线
-   事务测试；M3 已补齐真实硬件证据。
-3. M3：已在一台 SDS804X HD 上完成 TCPIP WORD/LSB 读取、CH1/CH2 数值、transfer 恢复、
-   `10M` 真实多块读取和 sequence ON 安全拒绝；USB 路径和其他型号仍待补。
-4. M4：SINGLE、Stop 轮询、采集计数和一次 CH1/CH2 acquisition 已完成实机验收；capture capability 已公开。
-5. 截图和独立采集控制已完成核心 `0.8.23` 采用与实机验收。typed trace 继续保持关闭；math/FFT 等待后续 trace 扩展合同。数字通道、sequence/history、Autoset 和其他写能力分别立项，不经 raw SCPI 绕过门禁。
+- Screenshot profile 只声明 color 和 inverted 两种 PNG 请求，使用 MESSAGE framing，限制
+  response／operation payload，并要求规范 PNG 后只有 `0A` content trailing。它不捕获、修改或恢复
+  持久显示字段。
+- Acquisition control profile 只声明 `auto` 和 `normal` 连续模式；SINGLE 先配置再 arm，模式切换
+  会重置 acquisition count。失败恢复依次处理 acquisition 与 trigger，最终重新确认 Stop。
+- 精确 payload 上限、步骤预算和 profile 语义以
+  [profiles.py](../src/wavebench_siglent_sds800x_hd/profiles.py) 为准，不在本文复制第二份数值表。
 
 ## 当前直接使用的 SCPI
 
+以下列表按当前 driver 汇总，用于定位协议域；[driver.py](../src/wavebench_siglent_sds800x_hd/driver.py)
+仍是完整事实源。
+
 ```text
 *IDN?
 :CHANnel<n>:COUPling?
@@ -147,4 +115,11 @@ transport 异常后均尝试恢复全部 transfer 状态；恢复失败不覆盖
 :WAVeform:DATA?
 ```
 
-命令出现在矩阵中不等于已经由 descriptor 声明或由真实仪器验证。
+## 相关来源
+
+- [Production descriptor](../src/wavebench_siglent_sds800x_hd/descriptor.py)
+- [Descriptor profiles](../src/wavebench_siglent_sds800x_hd/profiles.py)
+- [Driver implementation](../src/wavebench_siglent_sds800x_hd/driver.py)
+- [功能覆盖开发路线](SDS800X_HD_COVERAGE_MILESTONES.md)
+- [实机验收记录](SDS800X_HD_HARDWARE_ACCEPTANCE.md)
+- [Scope R1.3 conformance](SDS800X_HD_R13_CONFORMANCE.md)
diff --git a/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MATRIX_EN.md b/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MATRIX_EN.md
index 63306d6..1a24ccd 100644
--- a/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MATRIX_EN.md
+++ b/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MATRIX_EN.md
@@ -2,127 +2,93 @@
 
 [中文](SDS800X_HD_COVERAGE_MATRIX.md)
 
-## Purpose and evidence boundary
-
-This matrix compares the SIGLENT SDS Series Digital Oscilloscope Programming Guide,
-revision `CN11G`, with the external WaveBench `siglent.sds800x-hd` plugin. It separates
-manual claims, offline implementation, and hardware acceptance. A command in the shared SDS
-manual is not automatically treated as an SDS800X HD capability.
-
-The local conversion is split across three directories because of converter limits. Their three
-`full.md` files remain under `doc/vendor-local/`, excluded from Git and the sdist. The manual's
-support table gives `1.1.3.1` as the minimum SDS800X HD firmware, but it does not mark every
-command by supported family. Model and firmware behavior therefore still require target-hardware
-confirmation.
-
-Evidence labels used here:
-
-- **Hardware accepted**: current external-plugin code, a target SDS800X HD, and controlled evidence all exist.
-- **Implemented / offline verified**: driver and FakeTransport tests exist for that item, without corresponding hardware evidence.
-- **Manual reviewed**: command and response semantics were reviewed, but no capability is exposed yet.
-- **Plugin adoption pending**: the core contract exists, but the production driver, profile, or hardware evidence is incomplete.
-- **Hardware blocked**: offline code cannot establish response framing, state transitions, or hardware-specific behavior.
-- **Rejected by default**: the operation changes global state, writes instrument storage, or lacks a reliable restore boundary.
-
-WaveBench `0.8.23` implements the public Scope R1.3 contract. Core implementation does not grant
-the SDS800X HD new capabilities automatically; the production driver, descriptor profile,
-backend/resource behavior, and hardware restoration evidence still require separate acceptance.
-
-## Current coverage
-
-| Domain | Manual surface | WaveBench mapping | Status | Boundary and next step |
-|---|---|---|---|---|
-| Identity | `*IDN?` | `scope.idn` | **SDS804X HD hardware accepted** | Four fields, manufacturer, model, 14-character ASCII serial, and firmware format passed; other models remain pending |
-| Analog-channel coupling | `:CHANnel<n>:COUPling?`, returning `AC`, `DC`, or `GND` | `scope.channel_coupling` | **SDS804X HD hardware accepted** | CH1–CH4 returned DC; two-channel models and other coupling states remain pending |
-| Input termination | Shared manual lists `ONEMeg` and `FIFTy` | No standalone capability | **Rejected by default** | SDS800X HD product material specifies fixed `1 MΩ`; do not project the shared `FIFTy` setter onto this family |
-| Error queue | CN11G documents no error-queue query | `scope.errors` | **Device-protocol blocked** | The core interface exists, but this family has no dependable command; do not guess `SYSTem:ERRor?` or return a fabricated empty list |
-| Waveform read | `SOURce`, `STARt`, `INTerval`, `POINt`, `MAXPoint?`, `WIDTh`, `BYTeorder`, `PREamble?`, and `DATA?` | `scope.fetch_waveform` | **SDS804X HD multi-chunk hardware accepted** | Stop, sequence OFF, CH1/CH2 `DMAX`, WORD/LSB, numeric results, and success/failure restoration passed; a `10M` record passed as `5M + 5M`, while USB remains pending |
-| Sequence gate | `:ACQuire:SEQuence?` | `scope.fetch_waveform` precondition | **SDS804X HD hardware accepted** | Established Stop + sequence ON in `NORMAL` trigger mode; the driver rejected before any waveform write or binary query |
-| Measurement statistics | `:MEASure:MODE?`, `ADVanced:P<n>?`, `TYPE?`, `STATistics?`, and `SHIStory?` | `scope.measurement_statistics` | **SDS804X HD hardware accepted** | Query-only access to an existing slot; all six P3 `PKPK` fields and five stopped-history values passed with no driver writes |
-| Single and multichannel capture | `TRIGger:MODE`, `RUN`, `STOP`, `STATus?`, and `ACQuire:NUMACq?` | `scope.capture_waveform`, `scope.capture_waveforms` | **SDS804X HD hardware accepted** | SINGLE query-back, Stop polling, and acquisition count passed; CH1/CH2 use one acquisition without `*OPC?` |
-| Trigger run state | `:TRIGger:STATus?` returns `Arm`, `Ready`, `Auto`, `Trig'd`, `Stop`, or `Roll` | `scope.acquisition_run_state`, `scope.acquisition_control` | **SDS804X HD hardware accepted** | AUTO/NORMAL start, STOP, and SINGLE state-transition paths passed; injected SINGLE and start failures both restored the baseline and produced a `verified` fresh readback |
-| Screenshot | `:PRINt? PNG,NORMal` or inverted form | `scope.screenshot_profile`, `scope.screenshot_v2` | **SDS804X HD hardware accepted** | Real PyVISA MESSAGE EOM passed; normal and inverted output were both `1024×600` PNGs with exactly one `0A` byte after IEND; the next query stayed synchronized after an injected application-layer failure |
-| Autoset | `:AUToset` | `scope.autoscale` | **Rejected by default** | Changes trigger, vertical, and horizontal state without an error queue or restore loop |
-| Acquisition status | `ACQuire:TYPE?`, `SEQuence?`, `NUMACq?`, and related queries | `scope.acquisition_run_state` | **SDS804X HD hardware accepted** | Legacy `ScopeAcquisitionStatus` remains unsuitable; count stays diagnostic and completion uses a state transition. Hardware confirmed that selecting SINGLE reset a nonzero count to `0` |
-| Math / FFT | `FUNCtion<n>`, `OPERation?`, `SOURce?`, FFT scale/span, and related queries | Existing metadata/status; spectrum fetch requires a later trace extension | **Later core contract required** | F1–F4 were all OFF; there is no proven generic FFT-ready/RBW result, and a frequency axis cannot be represented as an analog waveform |
-| Snapshot, measurement configuration, digital, and history | Shared SDS subsystems | Corresponding optional Scope capabilities | **Not covered** | Review each capability for model, option, public-model, and restore semantics |
-| Reset, system, and instrument filesystem | `*RST`, system settings, save/recall, image save, and related commands | No baseline capability | **Rejected by default** | May alter global state, networking, or persistent storage |
-
-## Confirmed waveform-protocol boundary
-
-`PREamble?` returns a definite-length binary block. Its fixed descriptor portion is 346 bytes, and
-sequence data may append timestamps. The current pure parser supports only non-sequence analog
-channels, so it requires exactly 346 bytes after the core removes the IEEE block envelope and
-explicitly rejects timestamp appendices instead of discarding them. `DATA?` also uses a declared-
-length block; the core transport extracts its payload, and the plugin must never apply `rstrip()`
-to binary data.
-
-On the SDS804X HD with firmware `4.8.12.1.1.6.5`, a real preamble confirmed the non-sequence
-signature `read_frames=0`, `sum_frames=1`, `segment=-1`. The manual's `segment=1` form remains
-accepted; other frame combinations are still rejected. The same WORD preamble reported `100000`
-points, `200000` bytes, and a `50.000000584 ns` sample interval, consistent with the parser. A
-supplementary long-record run confirmed two chunks at `START 0` and `START 5000000` for
-`10000000` points with `MAXPoint=5000000`.
-
-The first analog conversion uses these documented fields:
+This page maps SIGLENT SDS Series Programming Guide `CN11G` domains to the WaveBench capabilities
+currently exposed by the external `wavebench-siglent-sds800x-hd` plugin. The
+[package metadata](../pyproject.toml) is authoritative for version, dependencies, and entry point;
+the [production descriptor](../src/wavebench_siglent_sds800x_hd/descriptor.py) for models, resource
+schemes, configuration fields, and capabilities; [profiles](../src/wavebench_siglent_sds800x_hd/profiles.py)
+for screenshot and acquisition-control boundaries; and the
+[driver](../src/wavebench_siglent_sds800x_hd/driver.py) for exact SCPI and transaction behavior.
+
+The [feature-coverage development roadmap](SDS800X_HD_COVERAGE_MILESTONES_EN.md) records stage
+status and future exit gates. The [hardware acceptance record](SDS800X_HD_HARDWARE_ACCEPTANCE_EN.md)
+and [Scope R1.3 conformance](SDS800X_HD_R13_CONFORMANCE.md) retain evidence for particular devices,
+firmware, transports, and procedures. Those records support traceability and do not independently
+add a current capability.
+
+## Scope
+
+`CN11G` is shared across multiple SDS families and does not annotate every command by applicable
+series. A command in the shared manual is not automatically an SDS800X HD capability. The local
+transcription is for internal audit only and lives under the Git-ignored, sdist-excluded
+`doc/vendor-local/` directory.
+
+This matrix answers what the production descriptor currently exposes and the boundaries of that
+behavior. A new Core contract, Python method, offline test, or one successful hardware run cannot
+replace a descriptor declaration.
+
+## Functional coverage
+
+| Domain | Manual surface | Current public capability | Current boundary |
+|---|---|---|---|
+| Identity | `*IDN?` | `scope.idn` | Strictly parses four identity fields and uses the descriptor model to validate channel count. Unknown manufacturer, model, or format fails. |
+| Analog-channel coupling | `:CHANnel<n>:COUPling?` | `scope.channel_coupling` | Accepts only `AC`, `DC`, or `GND`; identity determines the channel limit. The family policy is fixed high impedance. |
+| Input-termination writes | Shared-manual `ONEMeg`, `FIFTy` | Not declared | The `FIFTy` setter for other SDS families is not projected onto this family. |
+| Error queue | No reliable query in `CN11G` | Not declared | Does not guess `SYSTem:ERRor?` or fabricate an empty list. Waveform operations require `check_errors=false`. |
+| Stopped-record read | waveform source, range, format, preamble, data | `scope.fetch_waveform` | Accepts only `points="dmax"` and `check_errors=false`; requires acquisition Stop and Sequence OFF and restores transfer state after reading. |
+| Single/multi-channel capture | trigger mode/run/stop/status, waveform | `scope.capture_waveform`, `scope.capture_waveforms` | Configures all target channels, performs one SINGLE, then reads each channel. `*OPC?` is not trigger-completion evidence. |
+| Measurement statistics | mode, slot, type, statistics, history | `scope.measurement_statistics` | Reads an enabled Advanced measurement slot only; never configures, enables, or clears statistics. Buffer is read only when requested. |
+| Screenshot | `:PRINt? PNG,NORMal`/`INVerted` | `scope.screenshot_profile`, `scope.screenshot_v2` | Accepts only profile color/inverted variants, uses MESSAGE framing, validates PNG in memory, and changes no persistent display state. |
+| Acquisition run state | `:TRIGger:STATus?` | `scope.acquisition_run_state` | Maps vendor tokens to public state. Acquisition count is diagnostic and cannot prove completion by itself. |
+| Acquisition control | trigger mode, run, stop, single | `scope.acquisition_control` | Continuous mode supports `auto`/`normal` only. SINGLE uses `configure_then_arm`; failure cleanup and restoration order come from the profile. |
+| Autoset | `:AUToset` | Not declared | Mutates trigger, vertical, and timebase without a complete restoration contract; denied by default. |
+| Math/FFT | function, operator, source, scale, span | No corresponding extension capability declared | Frequency axis, ready state, RBW, sample rate, and payload lack a complete public contract. |
+| Typed trace | source, metadata, data | Not declared | Supported long records and the Core typed-trace point limit do not yet form a complete declarable profile. |
+| Snapshot, measurement configuration, digital, Sequence/history | Shared SDS subsystems | Not declared | Each needs model/option, readable-field, and restoration review; no falsely complete model is exposed. |
+| Reset, system setup, instrument files | `*RST`, system, save/recall, image save | Not declared | Mutates global, network, or persistent state and stays outside the base driver. |
+
+## Waveform behavior
+
+Before any waveform write, `fetch_waveform()` validates `points="dmax"`, `check_errors=false`, the
+target channel, `TRIGger:STATus? = Stop`, and `ACQuire:SEQuence? = OFF`. It then saves
+`SOURCE/START/INTERVAL/POINT/WIDTH/BYTEorder` and configures the target source, `WORD`, LSB,
+`START 0`, `INTERVAL 1`, and `POINT 0` for this read.
+
+`PREamble?` must contain exactly the 346-byte descriptor after Core removes the IEEE binary-block
+envelope. An appended Sequence timestamp or ambiguous descriptor byte order fails. The driver
+checks source, sample width, byte order, points, and data-byte count, then queries `MAXPoint?` for
+the chunk limit and reads the complete record. Success, protocol failure, and transport failure all
+attempt to restore the original transfer state; restoration failure does not hide a primary error.
+
+Analog conversion uses:
 
 ```text
 vdiv = vertical_scale_raw * probe
 offset = vertical_offset_raw * probe
 voltage = raw_code * (vdiv / code_per_div) - offset
+x[i] = horizontal_delay - timebase * 10 / 2 + i * sample_interval
 ```
 
-With `STARt 0` and `INTerval 1`, the time axis is:
+Eight-bit samples are signed integers. Wider ADC samples use `WORD`, LSB, and signed 16-bit
+decoding. Higher-resolution samples remain left-aligned as documented; the driver does not shift
+them. `DEF` and `MAX` fail before instrument I/O rather than sending undocumented point keywords.
 
-```text
-x[i] = horizontal_delay - timebase * 10 / 2 + i * sample_interval
-```
+## Screenshot and acquisition profiles
 
-Eight-bit samples are signed integers. ADC widths above eight bits use `WORD`, explicit LSB order,
-and signed 16-bit decoding. The manual describes higher-resolution samples as left-aligned with
-zero-filled low bits; the first version does not shift them. The driver must query `MAXPoint?`
-instead of hard-coding the example limit.
-
-The exposed transaction accepts only WaveBench `DMAX`. Page 385 of CN11G defines the
-`WAVeform:POINt` argument as an integer NR1 and provides no `DEF/MAX/DMAX` instrument keywords;
-the driver uses `POINT 0` from the vendor waveform-reconstruction example to select the full
-record. `DEF` and `MAX` fail before any I/O rather than sending undocumented commands.
-
-The transaction first requires `TRIGger:STATus? = Stop` and `ACQuire:SEQuence? = OFF`, then saves
-`SOURCE/START/INTERVAL/POINT/WIDTH/BYTEorder`. It fixes `WORD`, LSB, `START 0`, and `INTERVAL 1`,
-uses the preamble for total points, and uses `MAXPoint?` for the per-query limit. It attempts to
-restore all transfer state after success, protocol failure, or transport failure; restoration
-failure does not hide an existing primary exception. The path sends no `RUN`, `SINGLE`, or `STOP`
-and reads only an already-stopped record.
-
-## WaveBench core constraints
-
-- The driver obtains a core transport only through `DriverContext.open_transport()` and owns idempotent cleanup.
-- A capability is declared only after its public method is complete; runtime callability checks do not replace signature and semantic tests.
-- `fetch_waveform(channel, points="dmax", check_errors=True)` returns the core `WaveformData` and `WaveformHeader` models rather than plugin-local copies.
-- CN11G provides no error queue, so waveform use must explicitly set `scope.check_errors=false`; a direct driver call with `check_errors=True` fails before any I/O.
-- The current `points` implementation supports only `DMAX`. The public signature remains `fetch_waveform(channel, points="dmax", check_errors=True)` without inventing `DEF/MAX` mappings.
-- Multichannel capture configures every channel, performs one acquisition, and then reads each channel. It must not retrigger per channel.
-- Capture uses `DriverContext.opc_timeout_ms` as its status-polling deadline and does not call
-  `query_opc()`; `*OPC?` is not treated as physical-trigger completion evidence.
-- Screenshot, standalone acquisition control, typed trace sources, and three-state error checking
-  are public in the WaveBench `0.8.23`
-  [Scope R1.3 contract](https://github.com/Scaxlibur/wavebench/blob/master/docs/project/rfcs/WaveBench_scope通用扩展接口RFC_核心实施说明.md).
-  This plugin has completed screenshot and acquisition-control adoption; typed trace and error drain remain undeclared.
-
-## Development order
-
-1. M1: strict identity parsing and read-only `scope.channel_coupling`, with offline tests.
-2. M2: the 346-byte preamble, data conversion, and stopped analog-record `scope.fetch_waveform` transaction have offline coverage; M3 supplied the hardware evidence.
-3. M3: TCPIP WORD/LSB readout, CH1/CH2 numeric checks, transfer-state restoration, a real `10M` multi-chunk read, and safe sequence-ON rejection are complete on one SDS804X HD; USB and additional models remain pending.
-4. M4: SINGLE, Stop polling, acquisition count, and one CH1/CH2 acquisition are hardware accepted; capture capabilities are exposed.
-5. Screenshot and standalone acquisition control now have core `0.8.23` adoption and hardware
-   acceptance. Typed trace remains disabled, and math/FFT remains in a later trace-extension
-   contract. Track digital channels, sequence/history, Autoset, and other writes separately; do not
-   bypass gates with raw SCPI.
+- The screenshot profile declares color and inverted PNG requests only, uses MESSAGE framing,
+  bounds response/operation payload, and requires one `0A` content-trailing byte after canonical
+  PNG. It captures, changes, and restores no persistent display fields.
+- The acquisition-control profile declares `auto` and `normal` continuous modes only. SINGLE
+  configures then arms, and a mode change resets acquisition count. Failure restoration handles
+  acquisition then trigger and finally reconfirms Stop.
+- Exact payload limits, step budgets, and profile semantics remain canonical in
+  [profiles.py](../src/wavebench_siglent_sds800x_hd/profiles.py), not a second numeric table here.
 
 ## SCPI used directly today
 
+This list indexes protocol domains from the current driver. The complete source remains
+[driver.py](../src/wavebench_siglent_sds800x_hd/driver.py).
+
 ```text
 *IDN?
 :CHANnel<n>:COUPling?
@@ -155,4 +121,11 @@ and reads only an already-stopped record.
 :WAVeform:DATA?
 ```
 
-A command appearing in this matrix is not necessarily declared by the descriptor or verified on hardware.
+## Related sources
+
+- [Production descriptor](../src/wavebench_siglent_sds800x_hd/descriptor.py)
+- [Descriptor profiles](../src/wavebench_siglent_sds800x_hd/profiles.py)
+- [Driver implementation](../src/wavebench_siglent_sds800x_hd/driver.py)
+- [Feature-coverage development roadmap](SDS800X_HD_COVERAGE_MILESTONES_EN.md)
+- [Hardware acceptance record](SDS800X_HD_HARDWARE_ACCEPTANCE_EN.md)
+- [Scope R1.3 conformance](SDS800X_HD_R13_CONFORMANCE.md) (Chinese)
diff --git a/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MILESTONES.md b/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MILESTONES.md
new file mode 100644
index 0000000..f9d48ec
--- /dev/null
+++ b/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MILESTONES.md
@@ -0,0 +1,54 @@
+# SDS800X HD 功能覆盖开发路线
+
+[English](SDS800X_HD_COVERAGE_MILESTONES_EN.md)
+
+> 类型：Development
+
+本页记录 SDS800X HD 插件的开发阶段、待办范围和新 capability 退出门。它不维护当前
+capability 清单，也不复述具体设备、固件和测量结果。当前能力以
+[production descriptor](../src/wavebench_siglent_sds800x_hd/descriptor.py) 为准；手册域与当前
+行为见[功能覆盖矩阵](SDS800X_HD_COVERAGE_MATRIX.md)；设备条件与实测结果见
+[实机验收记录](SDS800X_HD_HARDWARE_ACCEPTANCE.md)和
+[Scope R1.3 conformance](SDS800X_HD_R13_CONFORMANCE.md)。
+
+## 共同规则
+
+- 通用 SDS 手册命令不能自动视为 SDS800X HD capability；先核对型号、固件和 production descriptor。
+- Core 增加公共合同不表示插件自动采用；driver、profile、descriptor 和实机恢复证据需要分别完成。
+- Python 方法或离线测试存在不等于 capability；只有 descriptor 声明的能力属于当前公开面。
+- 仪器 I/O 使用 Core transport；不增加 raw SCPI 入口。
+- 实机结果只适用于记录的设备、firmware、transport 和步骤，不外推其他型号或连接方式。
+- Reset、Autoset、系统设置和仪器文件操作默认不进入基础驱动。
+
+## 阶段状态
+
+| 阶段 | 范围 | 当前开发状态 | 下一退出门 |
+|---|---|---|---|
+| M1 | 严格 identity 与只读 coupling | capability 已声明 | 新型号需要独立 identity、通道数和回包验证。 |
+| M2 | Preamble 解析、数据换算、stopped-record waveform 事务 | 已实现并具备离线测试 | 新格式必须补全 descriptor 长度、端序、点数和失败恢复测试。 |
+| M3 | TCPIP WORD／LSB、分块读取、transfer restore、Sequence 拒绝 | 已有受控实机证据 | USB 和其他型号仍需独立验收；证据写入 Acceptance，不写入 Current Reference。 |
+| M4 | SINGLE、Stop 轮询、单／多通道 capture | capability 已声明 | 新采集模式需要独立完成证明、失败 cleanup 和 fresh readback。 |
+| R1.3 adoption | Screenshot 与 acquisition run-state／control | capability 与 descriptor profile 已声明 | Profile 修改必须同步验证 framing、预算、状态恢复和 conformance。 |
+
+## 后续能力
+
+| 工作项 | 当前开发状态 | 下一退出门 |
+|---|---|---|
+| Typed trace metadata／fetch | 未声明 | Core 点数上限与已支持长记录之间需要明确策略；补全 transfer baseline、profile 和实机 fresh readback。 |
+| Error drain | 未声明 | CN11G 没有可靠错误队列命令；没有真实协议前保持 unavailable，不伪造空结果。 |
+| Math／FFT | 未声明对应扩展能力 | 先定义频率轴、ready、RBW、sample rate 和 payload 的可表达合同。 |
+| Digital channels | 未声明 | 先确认选件、电气阈值、编码、位序和恢复语义。 |
+| Sequence／history | 未声明 | 先定义 frame identity、timestamp、附加 preamble 数据和有界读取。 |
+| Snapshot 与配置能力 | 未声明 | 按字段证明可查询性、适用性、写入副作用和完整恢复，不创建假完整模型。 |
+| Autoset | 默认拒绝 | 只有在可保存并恢复 trigger、vertical 和 timebase 状态时另案评审。 |
+| 其他写能力 | 未声明 | 每一类独立建模，不通过 raw SCPI 绕过 capability 与恢复门。 |
+
+## 每项新能力的退出门
+
+1. Core typed model 能准确表达该型号的返回值、不适用字段和错误语义。
+2. Driver 方法、descriptor capability、profile、配置字段和权限保持一致。
+3. 精确 FakeTransport 测试覆盖正常路径、异常 framing、无效枚举、timeout 与恢复失败。
+4. Binary 读取明确 framing、payload 上限、trailing、分块策略和 resynchronization 边界。
+5. 写入或采集控制具备 snapshot、readback、失败 cleanup、fresh verification 和必要锁停。
+6. 受控实机验收记录型号、firmware、transport 和未覆盖范围，但不保存资源地址、序列号或原始数据。
+7. 中英文 Current Reference、导航、生成式插件目录和 package tests 同步通过。
diff --git a/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MILESTONES_EN.md b/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MILESTONES_EN.md
new file mode 100644
index 0000000..7a219b1
--- /dev/null
+++ b/packages/wavebench-siglent-sds800x-hd/doc/SDS800X_HD_COVERAGE_MILESTONES_EN.md
@@ -0,0 +1,59 @@
+# SDS800X HD Feature-Coverage Development Roadmap
+
+[中文](SDS800X_HD_COVERAGE_MILESTONES.md)
+
+> Type: Development
+
+This page records development stages, pending scope, and exit gates for new SDS800X HD
+capabilities. It does not maintain the current capability list or repeat device, firmware, and
+measurement results. The [production descriptor](../src/wavebench_siglent_sds800x_hd/descriptor.py)
+is authoritative for current capabilities. See the [coverage matrix](SDS800X_HD_COVERAGE_MATRIX_EN.md)
+for manual-domain mapping and current behavior, and the
+[hardware acceptance record](SDS800X_HD_HARDWARE_ACCEPTANCE_EN.md) plus
+[Scope R1.3 conformance](SDS800X_HD_R13_CONFORMANCE.md) for device-specific evidence.
+
+## Shared rules
+
+- A command in the shared SDS manual is not automatically an SDS800X HD capability. Check model,
+  firmware, and the production descriptor first.
+- A new Core contract does not automatically apply to the plugin. Driver, profile, descriptor, and
+  hardware restoration evidence are completed separately.
+- A Python method or offline test does not constitute a capability. Only descriptor declarations
+  belong to the current public surface.
+- Instrument I/O uses the Core transport; no raw-SCPI entry point is added.
+- Hardware results apply only to the recorded device, firmware, transport, and procedure and are
+  not projected onto other models or connection types.
+- Reset, Autoset, system configuration, and instrument-file operations stay outside the base driver.
+
+## Stage status
+
+| Stage | Scope | Current development state | Next exit gate |
+|---|---|---|---|
+| M1 | Strict identity and query-only coupling | Capabilities declared | Each new model needs independent identity, channel-count, and response verification. |
+| M2 | Preamble parsing, conversion, stopped-record waveform transaction | Implemented with offline tests | New formats require complete descriptor-length, byte-order, point-count, and failure-restoration tests. |
+| M3 | TCPIP WORD/LSB, chunking, transfer restoration, Sequence rejection | Controlled hardware evidence exists | USB and additional models need separate acceptance; evidence belongs in Acceptance, not Current Reference. |
+| M4 | SINGLE, Stop polling, single/multi-channel capture | Capabilities declared | A new acquisition mode needs independent completion proof, failure cleanup, and fresh readback. |
+| R1.3 adoption | Screenshot and acquisition run-state/control | Capabilities and descriptor profiles declared | Profile changes must verify framing, budgets, state restoration, and conformance together. |
+
+## Future capabilities
+
+| Work item | Current development state | Next exit gate |
+|---|---|---|
+| Typed trace metadata/fetch | Not declared | Resolve the Core point limit versus supported long records; add a complete transfer baseline, profile, and hardware fresh readback. |
+| Error drain | Not declared | CN11G provides no reliable queue command. Keep unavailable without real protocol evidence; never fabricate an empty result. |
+| Math/FFT | No corresponding extension capability declared | Define an accurate contract for frequency axis, ready state, RBW, sample rate, and payload first. |
+| Digital channels | Not declared | Confirm options, electrical thresholds, encoding, bit order, and restoration semantics. |
+| Sequence/history | Not declared | Define frame identity, timestamps, appended preamble data, and bounded reads first. |
+| Snapshot and configuration | Not declared | Prove each field's readability, applicability, write side effects, and complete restoration; do not create a falsely complete model. |
+| Autoset | Denied by default | Review separately only after trigger, vertical, and timebase state can be saved and restored. |
+| Other writes | Not declared | Model each domain separately; raw SCPI does not bypass capability and restoration gates. |
+
+## Exit gate for each new capability
+
+1. A Core typed model accurately represents values, inapplicable fields, and errors for this family.
+2. Driver method, descriptor capability, profile, configuration fields, and permissions agree.
+3. Exact FakeTransport tests cover normal behavior, malformed framing, invalid enums, timeout, and restoration failure.
+4. Binary reads define framing, payload limits, trailing bytes, chunking, and resynchronization boundaries.
+5. Writes or acquisition control have snapshot, readback, failure cleanup, fresh verification, and required latching.
+6. Controlled hardware acceptance records model, firmware, transport, and unaccepted scope without resources, serials, or raw data.
+7. Chinese/English Current Reference, navigation, generated plugin catalog, and package tests pass together.
diff --git a/scripts/audit_docs.py b/scripts/audit_docs.py
new file mode 100644
index 0000000..509c997
--- /dev/null
+++ b/scripts/audit_docs.py
@@ -0,0 +1,416 @@
+#!/usr/bin/env python3
+"""Audit deterministic documentation integrity without external dependencies.
+
+The checker deliberately leaves information architecture, page type, audience,
+and migration decisions to review. Errors fail the command; warnings become
+failures only with ``--strict``.
+"""
+
+from __future__ import annotations
+
+import argparse
+import ipaddress
+import re
+import subprocess
+import sys
+import unicodedata
+from collections import defaultdict
+from dataclasses import dataclass
+from pathlib import Path
+from urllib.parse import unquote, urlsplit
+
+
+DOCUMENT_ROOTS = ("doc", "packages")
+ROOT_DOCUMENTS = ("README.md",)
+EXCLUDED_PARTS = {"tool-of-rei"}
+ENTRY_NAMES = {"README.md"}
+LONG_PAGE_LINES = 600
+
+FENCE_RE = re.compile(r"^ {0,3}(`{3,}|~{3,})")
+HEADING_RE = re.compile(r"^(#{1,6})\s+(.+?)\s*#*\s*$")
+HTML_ID_RE = re.compile(r"<(?:a\s+name|[^>]+\sid)=[\"']([^\"']+)[\"']", re.IGNORECASE)
+LINK_RE = re.compile(
+    r"!?\[[^\]]*\]\(\s*(<[^>]+>|[^)\s]+)"
+    r"(?:\s+(?:\"[^\"]*\"|'[^']*'|\([^)]*\)))?\s*\)"
+)
+REFERENCE_LINK_RE = re.compile(r"^ {0,3}\[[^\]]+\]:\s*(<[^>]+>|\S+)")
+HTML_LINK_RE = re.compile(r"<(?:a|img)\b[^>]*?\b(?:href|src)=[\"']([^\"']+)[\"']", re.IGNORECASE)
+IPV4_RE = re.compile(r"(?<![\d.])(?:\d{1,3}\.){3}\d{1,3}(?![\d.])")
+VISA_RE = re.compile(r"\b(?:TCPIP|USB|GPIB|ASRL)\d*::[^\s`'\"]+", re.IGNORECASE)
+SERIAL_RE = re.compile(
+    r"(?i)\b(?:serial(?:\s+number)?|s/n|sn)\s*[:=#]\s*([a-z0-9][a-z0-9._-]{4,})"
+)
+HOME_PATH_RE = re.compile(r"(?:/home/[^\s)`]+|/Users/[^\s)`]+|[A-Za-z]:[\\/]Users[\\/][^\s)`]+)")
+
+TEST_NETWORKS = tuple(
+    ipaddress.ip_network(value)
+    for value in ("192.0.2.0/24", "198.51.100.0/24", "203.0.113.0/24")
+)
+@dataclass(frozen=True)
+class Heading:
+    level: int
+    title: str
+    line: int
+
+
+@dataclass(frozen=True)
+class Document:
+    path: Path
+    relative: Path
+    canonical: Path
+    lines: tuple[str, ...]
+    visible_lines: tuple[tuple[int, str], ...]
+    headings: tuple[Heading, ...]
+    anchors: frozenset[str]
+    html_anchors: frozenset[str] = frozenset()
+
+
+@dataclass(frozen=True)
+class Finding:
+    level: str
+    path: str
+    line: int
+    message: str
+
+
+def repository_root(start: Path) -> Path:
+    result = subprocess.run(
+        ["git", "-C", str(start), "rev-parse", "--show-toplevel"],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return Path(result.stdout.strip()).resolve()
+
+
+def discover_markdown(root: Path) -> list[Path]:
+    paths: set[Path] = set()
+    for name in ROOT_DOCUMENTS:
+        candidate = root / name
+        if candidate.is_file():
+            paths.add(candidate)
+    for directory in DOCUMENT_ROOTS:
+        base = root / directory
+        if base.is_dir():
+            paths.update(path for path in base.rglob("*.md") if path.is_file())
+    return sorted(
+        path
+        for path in paths
+        if _is_public_markdown(path, root)
+    )
+
+
+def _is_public_markdown(path: Path, root: Path) -> bool:
+    relative = path.relative_to(root)
+    if EXCLUDED_PARTS.intersection(relative.parts):
+        return False
+    if any(part.startswith(".") for part in relative.parts):
+        return False
+    return "vendor-local" not in relative.parts or relative.name == "README.md"
+
+
+def visible_markdown_lines(lines: tuple[str, ...]) -> tuple[tuple[int, str], ...]:
+    visible: list[tuple[int, str]] = []
+    fence_char = ""
+    fence_length = 0
+    for number, line in enumerate(lines, 1):
+        match = FENCE_RE.match(line)
+        if fence_char:
+            if match and match.group(1)[0] == fence_char and len(match.group(1)) >= fence_length:
+                fence_char = ""
+                fence_length = 0
+            continue
+        if match:
+            fence_char = match.group(1)[0]
+            fence_length = len(match.group(1))
+            continue
+        visible.append((number, line))
+    return tuple(visible)
+
+
+def heading_slug(title: str) -> str:
+    text = re.sub(r"`([^`]*)`", r"\1", title.casefold())
+    text = re.sub(r"!?\[([^\]]+)\]\([^)]+\)", r"\1", text)
+    slug: list[str] = []
+    for character in text:
+        if character.isspace():
+            slug.append("-")
+        elif character in {"-", "_"} or not unicodedata.category(character).startswith(("P", "S")):
+            slug.append(character)
+    return re.sub(r"-+", "-", "".join(slug)).strip("-")
+
+
+def markdown_structure(
+    visible_lines: tuple[tuple[int, str], ...],
+) -> tuple[tuple[Heading, ...], frozenset[str]]:
+    headings: list[Heading] = []
+    anchors: set[str] = set()
+    seen_slugs: defaultdict[str, int] = defaultdict(int)
+    for number, line in visible_lines:
+        match = HEADING_RE.match(line)
+        if match:
+            title = match.group(2).strip()
+            headings.append(Heading(len(match.group(1)), title, number))
+            base = heading_slug(title)
+            suffix = seen_slugs[base]
+            anchors.add(base if suffix == 0 else f"{base}-{suffix}")
+            seen_slugs[base] += 1
+    return tuple(headings), frozenset(anchors)
+
+
+def load_document(path: Path, root: Path) -> Document:
+    lines = tuple(path.read_text(encoding="utf-8").splitlines())
+    visible = visible_markdown_lines(lines)
+    headings, anchors = markdown_structure(visible)
+    return Document(
+        path=path,
+        relative=path.relative_to(root),
+        canonical=path.resolve(),
+        lines=lines,
+        visible_lines=visible,
+        headings=headings,
+        anchors=anchors,
+        html_anchors=frozenset(
+            unquote(value)
+            for _, line in visible
+            for value in HTML_ID_RE.findall(line)
+        ),
+    )
+
+
+def markdown_links(document: Document) -> list[tuple[int, str]]:
+    links: list[tuple[int, str]] = []
+    for number, line in document.visible_lines:
+        links.extend((number, match.group(1).strip("<>")) for match in LINK_RE.finditer(line))
+        reference = REFERENCE_LINK_RE.match(line)
+        if reference:
+            links.append((number, reference.group(1).strip("<>")))
+        links.extend((number, match.group(1)) for match in HTML_LINK_RE.finditer(line))
+    return links
+
+
+def _inside(candidate: Path, root: Path) -> bool:
+    try:
+        candidate.relative_to(root)
+    except ValueError:
+        return False
+    return True
+
+
+def _target_document(path: Path, documents: dict[Path, Document], root: Path) -> Document | None:
+    canonical = path.resolve()
+    if canonical in documents:
+        return documents[canonical]
+    if path.is_file() and path.suffix.lower() == ".md" and _inside(canonical, root):
+        return load_document(path, root)
+    return None
+
+
+def check_links(
+    documents: list[Document], root: Path
+) -> tuple[list[Finding], dict[Path, set[Path]]]:
+    findings: list[Finding] = []
+    inbound: dict[Path, set[Path]] = defaultdict(set)
+    by_canonical = {document.canonical: document for document in documents}
+
+    for document in documents:
+        base = document.canonical.parent if document.path.is_symlink() else document.path.parent
+        for line, destination in markdown_links(document):
+            parsed = urlsplit(destination)
+            if parsed.scheme or parsed.netloc:
+                continue
+            relative_target = unquote(parsed.path)
+            target = document.path if not relative_target else base / relative_target
+            target = target.resolve()
+            if not _inside(target, root):
+                findings.append(
+                    Finding("error", document.relative.as_posix(), line, f"relative link escapes repository: {destination}")
+                )
+                continue
+            if not target.exists():
+                findings.append(
+                    Finding("error", document.relative.as_posix(), line, f"relative link target does not exist: {destination}")
+                )
+                continue
+            if target.is_file() and target.suffix.lower() == ".md":
+                inbound[target].add(document.canonical)
+                if parsed.fragment:
+                    target_document = _target_document(target, by_canonical, root)
+                    fragment = unquote(parsed.fragment)
+                    anchor_found = target_document and (
+                        fragment in target_document.html_anchors
+                        or fragment.casefold() in target_document.anchors
+                    )
+                    if target_document and not anchor_found:
+                        findings.append(
+                            Finding("warning", document.relative.as_posix(), line, f"anchor was not found: {destination}")
+                        )
+    return findings, inbound
+
+
+def check_structure(
+    documents: list[Document], inbound: dict[Path, set[Path]], max_lines: int
+) -> list[Finding]:
+    findings: list[Finding] = []
+    canonical_documents: dict[Path, Document] = {}
+    for document in documents:
+        canonical_documents.setdefault(document.canonical, document)
+
+    titles: dict[tuple[Path, str], list[Document]] = defaultdict(list)
+    for document in canonical_documents.values():
+        h1 = [heading for heading in document.headings if heading.level == 1]
+        if not h1:
+            findings.append(Finding("warning", document.relative.as_posix(), 1, "page has no ATX H1"))
+        elif len(h1) > 1:
+            findings.append(Finding("warning", document.relative.as_posix(), h1[1].line, "page has more than one H1"))
+        elif document.relative.name not in ENTRY_NAMES:
+            titles[(document.relative.parent, h1[0].title.casefold())].append(document)
+        if len(document.lines) > max_lines and "archive" not in document.relative.parts:
+            findings.append(
+                Finding("warning", document.relative.as_posix(), 1, f"long page: {len(document.lines)} lines (threshold {max_lines})")
+            )
+
+        is_entry = document.relative.name in ENTRY_NAMES
+        is_compatibility_entry = any(
+            heading.level == 1 and "旧入口" in heading.title for heading in document.headings
+        )
+        if not is_entry and not is_compatibility_entry and not inbound.get(document.canonical):
+            findings.append(Finding("warning", document.relative.as_posix(), 1, "orphan Markdown page: no inbound Markdown link"))
+
+    for (_, duplicate_title), matches in titles.items():
+        if len(matches) < 2:
+            continue
+        paths = ", ".join(item.relative.as_posix() for item in matches)
+        for document in matches:
+            h1 = next(heading for heading in document.headings if heading.level == 1)
+            findings.append(
+                Finding("warning", document.relative.as_posix(), h1.line, f"duplicate H1 {duplicate_title!r}: {paths}")
+            )
+    return findings
+
+
+def _allowed_documentation_ip(value: str) -> bool:
+    try:
+        address = ipaddress.ip_address(value)
+    except ValueError:
+        return True
+    return address.is_loopback or address.is_unspecified or any(address in network for network in TEST_NETWORKS)
+
+
+def _looks_like_firmware_version(line: str, start: int, end: int) -> bool:
+    value = line[start:end]
+    try:
+        address = ipaddress.ip_address(value)
+    except ValueError:
+        return True
+    if not address.is_global:
+        return False
+    left_tick = line.rfind("`", 0, start)
+    right_tick = line.find("`", end)
+    if left_tick < 0 or right_tick < 0 or "`" in line[left_tick + 1 : start]:
+        return False
+    token = line[left_tick + 1 : right_tick]
+    if not re.fullmatch(r"v?\d+(?:\.\d+){3}[A-Za-z0-9+._-]*", token):
+        return False
+    context = line[max(0, left_tick - 64) : right_tick + 64].casefold()
+    return any(marker in context for marker in ("firmware", "固件", "version", "版本"))
+
+
+def check_sensitive_resources(documents: list[Document]) -> list[Finding]:
+    findings: list[Finding] = []
+    for document in documents:
+        relative = document.relative.as_posix()
+        for number, line in enumerate(document.lines, 1):
+            for match in IPV4_RE.finditer(line):
+                is_firmware = not VISA_RE.search(line) and _looks_like_firmware_version(
+                    line, match.start(), match.end()
+                )
+                if not _allowed_documentation_ip(match.group(0)) and not is_firmware:
+                    findings.append(
+                        Finding("warning", relative, number, f"review possible real network address: {match.group(0)}")
+                    )
+            for match in VISA_RE.finditer(line):
+                resource = match.group(0)
+                if "<" in resource or "..." in resource:
+                    continue
+                ips = IPV4_RE.findall(resource)
+                if not ips or any(not _allowed_documentation_ip(value) for value in ips):
+                    findings.append(Finding("warning", relative, number, f"review possible real VISA resource: {resource}"))
+            if SERIAL_RE.search(line):
+                findings.append(Finding("warning", relative, number, "review possible device serial number"))
+            if HOME_PATH_RE.search(line):
+                findings.append(Finding("warning", relative, number, "review machine-specific absolute path"))
+    return findings
+
+
+def audit(root: Path, max_lines: int) -> tuple[list[Document], list[Finding]]:
+    documents = [load_document(path, root) for path in discover_markdown(root)]
+    link_findings, inbound = check_links(documents, root)
+    findings = [
+        *link_findings,
+        *check_structure(documents, inbound, max_lines),
+        *check_sensitive_resources(documents),
+    ]
+    findings.sort(key=lambda item: (item.path.casefold(), item.line, item.level, item.message))
+    return documents, findings
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "paths",
+        nargs="*",
+        type=Path,
+        help="report findings only for these repository-relative files or directories",
+    )
+    parser.add_argument("--root", type=Path, help="repository root; defaults to the current Git worktree")
+    parser.add_argument("--max-lines", type=int, default=LONG_PAGE_LINES, help="long-page warning threshold")
+    parser.add_argument("--strict", action="store_true", help="treat warnings as failures")
+    parser.add_argument("--quiet-warnings", action="store_true", help="hide warning details but retain their count")
+    args = parser.parse_args()
+
+    try:
+        root = args.root.resolve() if args.root else repository_root(Path.cwd())
+        documents, findings = audit(root, args.max_lines)
+    except (OSError, subprocess.CalledProcessError) as error:
+        print(f"ERROR: unable to audit documentation: {error}", file=sys.stderr)
+        return 2
+
+    selected: set[str] = set()
+    for requested in args.paths:
+        candidate = requested.resolve() if requested.is_absolute() else (root / requested).resolve()
+        if not _inside(candidate, root):
+            print(f"ERROR: requested path escapes repository: {requested}", file=sys.stderr)
+            return 2
+        relative = candidate.relative_to(root)
+        if candidate.is_dir():
+            prefix = relative.as_posix().rstrip("/") + "/"
+            selected.update(
+                document.relative.as_posix()
+                for document in documents
+                if document.relative.as_posix().startswith(prefix)
+            )
+        else:
+            selected.add(relative.as_posix())
+    if selected:
+        findings = [finding for finding in findings if finding.path in selected]
+
+    for finding in findings:
+        if args.quiet_warnings and finding.level == "warning":
+            continue
+        print(f"{finding.level.upper()}: {finding.path}:{finding.line}: {finding.message}")
+    errors = sum(item.level == "error" for item in findings)
+    warnings = sum(item.level == "warning" for item in findings)
+    canonical = len({document.canonical for document in documents})
+    print(
+        f"SUMMARY: {len(documents)} Markdown paths ({canonical} canonical), "
+        f"{errors} errors, {warnings} warnings"
+        + (f", scoped to {len(selected)} requested paths" if selected else "")
+    )
+    if errors or (args.strict and warnings):
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/generate_plugin_catalog.py b/scripts/generate_plugin_catalog.py
new file mode 100644
index 0000000..ec6f142
--- /dev/null
+++ b/scripts/generate_plugin_catalog.py
@@ -0,0 +1,430 @@
+#!/usr/bin/env python3
+"""Generate the plugin catalog from package metadata and descriptor source."""
+
+from __future__ import annotations
+
+import argparse
+import ast
+import re
+import sys
+import tomllib
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+
+ENTRY_POINT_GROUP = "wavebench.instruments"
+OUTPUTS = {
+    "zh": Path("doc/reference/plugin-catalog.md"),
+    "en": Path("doc/reference/plugin-catalog-en.md"),
+}
+DESCRIPTOR_FIELDS = {
+    "driver_id",
+    "kind",
+    "display_name",
+    "manufacturer",
+    "models",
+    "capabilities",
+    "backends",
+    "resource_schemes",
+    "summary",
+    "wavebench_min_version",
+    "wavebench_max_version",
+    "distribution",
+    "version",
+    "source",
+}
+REQUIRED_DESCRIPTOR_FIELDS = DESCRIPTOR_FIELDS - {"resource_schemes"}
+KIND_ZH = {
+    "dmm": "数字万用表",
+    "power": "直流电源",
+    "rf_source": "射频信号源",
+    "scope": "示波器",
+    "source": "信号源",
+    "sweep_analyzer": "扫频仪",
+}
+
+
+class CatalogError(RuntimeError):
+    """Raised when package metadata cannot be rendered without guessing."""
+
+
+@dataclass(frozen=True)
+class PluginRecord:
+    package_dir: str
+    distribution: str
+    version: str
+    requires_python: str
+    wavebench_requirement: str
+    entry_point: str
+    driver_id: str
+    kind: str
+    display_name: str
+    manufacturer: str
+    models: tuple[str, ...]
+    capabilities: tuple[str, ...]
+    backends: tuple[str, ...]
+    resource_schemes: tuple[str, ...]
+
+
+def _repository_root() -> Path:
+    return Path(__file__).resolve().parents[1]
+
+
+def _call_name(node: ast.expr) -> str | None:
+    return node.id if isinstance(node, ast.Name) else None
+
+
+def _value(node: ast.expr, environment: dict[str, Any]) -> Any:
+    if isinstance(node, ast.Constant):
+        return node.value
+    if isinstance(node, ast.Name):
+        try:
+            return environment[node.id]
+        except KeyError as error:
+            raise CatalogError(f"unsupported descriptor name: {node.id}") from error
+    if isinstance(node, ast.Attribute):
+        base = _value(node.value, environment)
+        if isinstance(base, dict) and node.attr in base:
+            return base[node.attr]
+        raise CatalogError(f"unsupported descriptor attribute: {ast.unparse(node)}")
+    if isinstance(node, (ast.Tuple, ast.List)):
+        values: list[Any] = []
+        for element in node.elts:
+            if isinstance(element, ast.Starred):
+                expanded = _value(element.value, environment)
+                if not isinstance(expanded, (tuple, list)):
+                    raise CatalogError("descriptor starred value is not a sequence")
+                values.extend(expanded)
+            else:
+                values.append(_value(element, environment))
+        return tuple(values)
+    if isinstance(node, ast.GeneratorExp):
+        return _generator_value(node, environment)
+    if isinstance(node, ast.Compare):
+        return _compare_value(node, environment)
+    raise CatalogError(f"unsupported descriptor expression: {ast.unparse(node)}")
+
+
+def _generator_value(node: ast.GeneratorExp, environment: dict[str, Any]) -> tuple[Any, ...]:
+    if len(node.generators) != 1:
+        raise CatalogError("descriptor generator must contain one comprehension")
+    generator = node.generators[0]
+    if generator.is_async or not isinstance(generator.target, ast.Name):
+        raise CatalogError("unsupported descriptor generator target")
+    values = _value(generator.iter, environment)
+    result: list[Any] = []
+    for item in values:
+        local = {**environment, generator.target.id: item}
+        if all(_value(condition, local) for condition in generator.ifs):
+            result.append(_value(node.elt, local))
+    return tuple(result)
+
+
+def _compare_value(node: ast.Compare, environment: dict[str, Any]) -> bool:
+    if len(node.ops) != 1 or len(node.comparators) != 1:
+        raise CatalogError("descriptor comparison must contain one operator")
+    left = _value(node.left, environment)
+    right = _value(node.comparators[0], environment)
+    operator = node.ops[0]
+    if isinstance(operator, ast.Eq):
+        return left == right
+    if isinstance(operator, ast.NotEq):
+        return left != right
+    raise CatalogError(f"unsupported descriptor comparison: {ast.unparse(node)}")
+
+
+def _descriptor_fields(tree: ast.Module, function_name: str, cache: dict[str, dict[str, Any]]) -> dict[str, Any]:
+    if function_name in cache:
+        return cache[function_name]
+    function = next(
+        (
+            node
+            for node in tree.body
+            if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)) and node.name == function_name
+        ),
+        None,
+    )
+    if function is None or isinstance(function, ast.AsyncFunctionDef):
+        raise CatalogError(f"descriptor factory not found: {function_name}")
+
+    environment: dict[str, Any] = {}
+    for statement in function.body:
+        if (
+            isinstance(statement, ast.Assign)
+            and len(statement.targets) == 1
+            and isinstance(statement.targets[0], ast.Name)
+            and isinstance(statement.value, ast.Call)
+        ):
+            called = _call_name(statement.value.func)
+            if called and not statement.value.args and not statement.value.keywords:
+                environment[statement.targets[0].id] = _descriptor_fields(tree, called, cache)
+        if isinstance(statement, ast.Return) and isinstance(statement.value, ast.Call):
+            fields = _returned_descriptor(statement.value, environment)
+            missing = REQUIRED_DESCRIPTOR_FIELDS - fields.keys()
+            if missing:
+                raise CatalogError(
+                    f"descriptor {function_name} is missing fields: {', '.join(sorted(missing))}"
+                )
+            fields.setdefault("resource_schemes", ())
+            cache[function_name] = fields
+            return fields
+    raise CatalogError(f"descriptor factory has no supported return: {function_name}")
+
+
+def _returned_descriptor(call: ast.Call, environment: dict[str, Any]) -> dict[str, Any]:
+    called = _call_name(call.func)
+    if called == "InstrumentDescriptor":
+        fields: dict[str, Any] = {}
+    elif called == "replace" and call.args:
+        base = _value(call.args[0], environment)
+        if not isinstance(base, dict):
+            raise CatalogError("descriptor replace base is not a descriptor")
+        fields = dict(base)
+    else:
+        raise CatalogError(f"unsupported descriptor constructor: {ast.unparse(call.func)}")
+
+    for keyword in call.keywords:
+        if keyword.arg in DESCRIPTOR_FIELDS:
+            fields[keyword.arg] = _value(keyword.value, environment)
+    return fields
+
+
+def _exported_factory(init_path: Path, factory_name: str) -> bool:
+    tree = ast.parse(init_path.read_text(encoding="utf-8"), filename=str(init_path))
+    return any(
+        isinstance(node, ast.ImportFrom)
+        and node.level == 1
+        and node.module == "descriptor"
+        and any(alias.name == factory_name for alias in node.names)
+        for node in tree.body
+    )
+
+
+def _version_tuple(value: str) -> tuple[int, int, int]:
+    parts = value.split(".")
+    if not 1 <= len(parts) <= 3 or any(not part.isdigit() for part in parts):
+        raise CatalogError(f"unsupported version constraint: {value}")
+    return tuple(int(part) for part in (*parts, *("0" for _ in range(3 - len(parts)))))  # type: ignore[return-value]
+
+
+def _requirement_bounds(requirement: str) -> tuple[tuple[int, int, int], tuple[int, int, int]]:
+    minimum = re.search(r"(?:^|,)>=(\d+(?:\.\d+){0,2})(?:,|$)", requirement)
+    maximum = re.search(r"(?:^|,)<(\d+(?:\.\d+){0,2})(?:,|$)", requirement)
+    if not minimum or not maximum:
+        raise CatalogError(f"WaveBench requirement needs >= and < bounds: {requirement}")
+    return _version_tuple(minimum.group(1)), _version_tuple(maximum.group(1))
+
+
+def _project_record(package_root: Path) -> list[PluginRecord]:
+    pyproject_path = package_root / "pyproject.toml"
+    with pyproject_path.open("rb") as handle:
+        data = tomllib.load(handle)
+    project = data.get("project")
+    if not isinstance(project, dict):
+        raise CatalogError(f"missing [project]: {pyproject_path}")
+
+    distribution = project.get("name")
+    version = project.get("version")
+    requires_python = project.get("requires-python")
+    dependencies = project.get("dependencies")
+    groups = project.get("entry-points")
+    entries = groups.get(ENTRY_POINT_GROUP) if isinstance(groups, dict) else None
+    if not all(isinstance(value, str) for value in (distribution, version, requires_python)):
+        raise CatalogError(f"invalid project name/version/requires-python: {pyproject_path}")
+    if not isinstance(dependencies, list) or not all(isinstance(item, str) for item in dependencies):
+        raise CatalogError(f"invalid project dependencies: {pyproject_path}")
+    if not isinstance(entries, dict) or not entries:
+        raise CatalogError(f"missing {ENTRY_POINT_GROUP} entry points: {pyproject_path}")
+    wavebench_requirements = [item for item in dependencies if item.startswith("wavebench")]
+    if len(wavebench_requirements) != 1:
+        raise CatalogError(f"expected one WaveBench dependency: {pyproject_path}")
+    wavebench_requirement = wavebench_requirements[0].removeprefix("wavebench")
+    dependency_bounds = _requirement_bounds(wavebench_requirement)
+
+    descriptor_trees: dict[Path, ast.Module] = {}
+    descriptor_caches: dict[Path, dict[str, dict[str, Any]]] = {}
+    records: list[PluginRecord] = []
+    for entry_name, target in sorted(entries.items()):
+        if not isinstance(entry_name, str) or not isinstance(target, str) or ":" not in target:
+            raise CatalogError(f"invalid entry point in {pyproject_path}: {entry_name!r}")
+        module_name, factory_name = target.split(":", 1)
+        module_root = package_root / "src" / Path(*module_name.split("."))
+        init_path = module_root / "__init__.py"
+        descriptor_path = module_root / "descriptor.py"
+        if not init_path.is_file() or not descriptor_path.is_file():
+            raise CatalogError(f"entry-point module source not found: {target}")
+        if not _exported_factory(init_path, factory_name):
+            raise CatalogError(f"entry-point factory is not re-exported: {target}")
+        tree = descriptor_trees.setdefault(
+            descriptor_path,
+            ast.parse(descriptor_path.read_text(encoding="utf-8"), filename=str(descriptor_path)),
+        )
+        cache = descriptor_caches.setdefault(descriptor_path, {})
+        fields = _descriptor_fields(tree, factory_name, cache)
+
+        if fields["driver_id"] != entry_name:
+            raise CatalogError(f"driver ID differs from entry point: {entry_name} != {fields['driver_id']}")
+        if fields["distribution"] != distribution or fields["version"] != version:
+            raise CatalogError(f"descriptor package metadata drift: {entry_name}")
+        if fields["source"] != f"entry_point:{entry_name}":
+            raise CatalogError(f"descriptor source differs from entry point: {entry_name}")
+        descriptor_bounds = (
+            _version_tuple(fields["wavebench_min_version"]),
+            _version_tuple(fields["wavebench_max_version"]),
+        )
+        if descriptor_bounds != dependency_bounds:
+            raise CatalogError(f"WaveBench compatibility drift: {entry_name}")
+
+        records.append(
+            PluginRecord(
+                package_dir=package_root.name,
+                distribution=distribution,
+                version=version,
+                requires_python=requires_python,
+                wavebench_requirement=wavebench_requirement,
+                entry_point=target,
+                driver_id=fields["driver_id"],
+                kind=fields["kind"],
+                display_name=fields["display_name"],
+                manufacturer=fields["manufacturer"],
+                models=tuple(fields["models"]),
+                capabilities=tuple(fields["capabilities"]),
+                backends=tuple(fields["backends"]),
+                resource_schemes=tuple(fields["resource_schemes"]),
+            )
+        )
+    return records
+
+
+def discover_records(root: Path) -> tuple[PluginRecord, ...]:
+    packages_root = root / "packages"
+    records: list[PluginRecord] = []
+    for package_root in sorted(packages_root.iterdir()):
+        if package_root.is_dir() and (package_root / "pyproject.toml").is_file():
+            records.extend(_project_record(package_root))
+    if not records:
+        raise CatalogError("no plugin packages found")
+    return tuple(sorted(records, key=lambda item: (item.distribution, item.driver_id)))
+
+
+def _joined(values: tuple[str, ...]) -> str:
+    return ", ".join(f"`{value}`" for value in values) if values else "—"
+
+
+def render(records: tuple[PluginRecord, ...], language: str) -> str:
+    if language not in {"zh", "en"}:
+        raise CatalogError(f"unsupported language: {language}")
+    english = language == "en"
+    lines = [
+        "# WaveBench plugin catalog" if english else "# WaveBench 插件目录",
+        "",
+        "[中文](plugin-catalog.md)" if english else "[English](plugin-catalog-en.md)",
+        "",
+    ]
+    if english:
+        lines.extend(
+            [
+                "This Reference is generated from each package's `pyproject.toml` and production descriptor.",
+                "Regenerate it with `python scripts/generate_plugin_catalog.py`; verify drift with",
+                "`python scripts/generate_plugin_catalog.py --check`.",
+                "",
+                "> A metadata version identifies the package source contract in this repository; it is not a",
+                "> PyPI, Git tag, or GitHub Release claim. Declared capabilities are top-level descriptor",
+                "> entries. Model, firmware, option, and profile restrictions remain in the package Reference",
+                "> and the runtime capability query.",
+                "",
+                "## Packages and entry points",
+                "",
+                "| Package | Metadata version | Driver ID | Type | Models | Python | WaveBench |",
+                "| --- | --- | --- | --- | --- | --- | --- |",
+            ]
+        )
+    else:
+        lines.extend(
+            [
+                "本 Reference 由各包的 `pyproject.toml` 和 production descriptor 生成。运行",
+                "`python scripts/generate_plugin_catalog.py` 更新，运行",
+                "`python scripts/generate_plugin_catalog.py --check` 检查漂移。",
+                "",
+                "> 元数据版本表示本仓库内的包源码合同，不代表 PyPI、Git tag 或 GitHub Release 状态。",
+                "> capability 列表只表示 descriptor 顶层声明；型号、固件、选件和 profile 限制仍以包级",
+                "> Reference 与运行时 capability 查询为准。",
+                "",
+                "## 包与入口点",
+                "",
+                "| 包 | 元数据版本 | Driver ID | 类型 | 型号 | Python | WaveBench |",
+                "| --- | --- | --- | --- | --- | --- | --- |",
+            ]
+        )
+
+    for record in records:
+        readme = "README_EN.md" if english else "README.md"
+        link = f"../../packages/{record.package_dir}/{readme}"
+        kind = record.kind if english else KIND_ZH.get(record.kind, record.kind)
+        models = ", ".join(record.models)
+        lines.append(
+            f"| [`{record.distribution}`]({link}) | `{record.version}` | `{record.driver_id}` | "
+            f"{kind} | {models} | `{record.requires_python}` | `wavebench{record.wavebench_requirement}` |"
+        )
+
+    lines.extend(["", "## Declared capabilities" if english else "## 已声明 capability", ""])
+    for record in records:
+        lines.extend(
+            [
+                f"### `{record.driver_id}`",
+                "",
+                (f"- Display name: {record.display_name}" if english else f"- 显示名称：{record.display_name}"),
+                (f"- Backends: {_joined(record.backends)}" if english else f"- Backend：{_joined(record.backends)}"),
+                (
+                    f"- Resource schemes: {_joined(record.resource_schemes)}"
+                    if english
+                    else f"- Resource scheme：{_joined(record.resource_schemes)}"
+                ),
+                "- Capabilities:",
+                "",
+            ]
+        )
+        lines.extend(f"  - `{capability}`" for capability in record.capabilities)
+        lines.append("")
+    return "\n".join(lines).rstrip() + "\n"
+
+
+def write_outputs(root: Path, rendered: dict[str, str], *, check: bool) -> None:
+    stale: list[Path] = []
+    for language, relative in OUTPUTS.items():
+        destination = root / relative
+        body = rendered[language]
+        if check:
+            if not destination.is_file() or destination.read_text(encoding="utf-8") != body:
+                stale.append(relative)
+            continue
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        temporary = destination.with_name(f".{destination.name}.tmp")
+        temporary.write_text(body, encoding="utf-8")
+        temporary.replace(destination)
+    if stale:
+        raise CatalogError("generated catalog is stale: " + ", ".join(map(str, stale)))
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, default=_repository_root())
+    parser.add_argument("--check", action="store_true", help="fail instead of writing when output differs")
+    args = parser.parse_args(argv)
+    try:
+        root = args.root.resolve()
+        records = discover_records(root)
+        write_outputs(
+            root,
+            {language: render(records, language) for language in OUTPUTS},
+            check=args.check,
+        )
+    except (CatalogError, OSError, SyntaxError, tomllib.TOMLDecodeError) as error:
+        print(f"ERROR: {error}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/test_docs_audit.py b/tests/test_docs_audit.py
new file mode 100644
index 0000000..110f3a8
--- /dev/null
+++ b/tests/test_docs_audit.py
@@ -0,0 +1,179 @@
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = ROOT / "scripts" / "audit_docs.py"
+SPEC = importlib.util.spec_from_file_location("wavebench_plugin_docs_audit", SCRIPT)
+assert SPEC and SPEC.loader
+AUDIT = importlib.util.module_from_spec(SPEC)
+sys.modules[SPEC.name] = AUDIT
+SPEC.loader.exec_module(AUDIT)
+
+
+def test_parser_ignores_fences_and_builds_duplicate_anchors():
+    lines = (
+        "# 文档 API",
+        "[有效](guide.md#运行-check)",
+        "```markdown",
+        "[忽略](missing.md)",
+        "# 也忽略",
+        "```",
+        "## 运行 `check`",
+        "## 运行 `check`",
+    )
+
+    visible = AUDIT.visible_markdown_lines(lines)
+    headings, anchors = AUDIT.markdown_structure(visible)
+    document = AUDIT.Document(
+        path=Path("README.md"),
+        relative=Path("README.md"),
+        canonical=Path("README.md"),
+        lines=lines,
+        visible_lines=visible,
+        headings=headings,
+        anchors=anchors,
+    )
+
+    assert [heading.title for heading in headings] == ["文档 API", "运行 `check`", "运行 `check`"]
+    assert {"文档-api", "运行-check", "运行-check-1"} <= anchors
+    assert AUDIT.markdown_links(document) == [(2, "guide.md#运行-check")]
+
+
+def test_four_space_indentation_does_not_open_a_fence():
+    lines = ("    ```", "[still visible](missing.md)")
+
+    assert AUDIT.visible_markdown_lines(lines) == ((1, "    ```"), (2, "[still visible](missing.md)"))
+
+
+def test_discovers_monorepo_docs_and_skips_vendor_material(tmp_path):
+    expected = (
+        tmp_path / "README.md",
+        tmp_path / "doc" / "index.md",
+        tmp_path / "packages" / "example" / "README.md",
+        tmp_path / "packages" / "example" / "doc" / "reference.md",
+        tmp_path / "packages" / "example" / "doc" / "vendor-local" / "README.md",
+    )
+    ignored = (
+        tmp_path / "packages" / "example" / "doc" / "vendor-local" / "manual.md",
+        tmp_path / "packages" / "example" / ".pytest_cache" / "README.md",
+    )
+    for path in (*expected, *ignored):
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(f"# {path.stem}\n", encoding="utf-8")
+
+    assert AUDIT.discover_markdown(tmp_path) == sorted(expected)
+
+
+def test_link_check_distinguishes_missing_targets_and_anchors(tmp_path):
+    readme = tmp_path / "README.md"
+    guide = tmp_path / "guide.md"
+    readme.write_text(
+        "# Index\n[missing](missing.md)\n[bad anchor](guide.md#missing)\n[good](guide.md#section)\n",
+        encoding="utf-8",
+    )
+    guide.write_text("# Guide\n## Section\n", encoding="utf-8")
+    documents = [AUDIT.load_document(path, tmp_path) for path in (readme, guide)]
+
+    findings, inbound = AUDIT.check_links(documents, tmp_path)
+
+    assert [(finding.level, finding.line) for finding in findings] == [
+        ("error", 2),
+        ("warning", 3),
+    ]
+    assert inbound[guide.resolve()] == {readme.resolve()}
+
+
+def test_reference_and_html_links_are_checked(tmp_path):
+    readme = tmp_path / "README.md"
+    readme.write_text(
+        "# Index\n[reference][guide]\n[guide]: missing-reference.md\n"
+        '<a href="missing-html.md">missing</a>\n',
+        encoding="utf-8",
+    )
+    document = AUDIT.load_document(readme, tmp_path)
+
+    findings, _ = AUDIT.check_links([document], tmp_path)
+
+    assert [(finding.line, finding.message.rsplit(": ", 1)[-1]) for finding in findings] == [
+        (3, "missing-reference.md"),
+        (4, "missing-html.md"),
+    ]
+
+
+def test_explicit_html_ids_are_case_sensitive(tmp_path):
+    index = tmp_path / "README.md"
+    target = tmp_path / "target.md"
+    index.write_text(
+        "# Index\n[exact](target.md#My-ID)\n[wrong case](target.md#my-id)\n"
+        "[reverse wrong case](target.md#LOWER-ID)\n",
+        encoding="utf-8",
+    )
+    target.write_text('# Target\n<a id="My-ID"></a>\n<a id="lower-id"></a>\n', encoding="utf-8")
+    documents = [AUDIT.load_document(path, tmp_path) for path in (index, target)]
+
+    findings, _ = AUDIT.check_links(documents, tmp_path)
+
+    assert [(finding.level, finding.line) for finding in findings] == [
+        ("warning", 3),
+        ("warning", 4),
+    ]
+
+
+def test_sensitive_resource_check_ignores_firmware_and_documentation_ips(tmp_path):
+    path = tmp_path / "README.md"
+    path.write_text(
+        "# Docs\nfirmware `8.5.0.0`\nTCPIP::192.0.2.10::INSTR\nTCPIP::192.168.1.42::INSTR\n"
+        "firmware is current; lab address is 10.0.0.42\n"
+        "minimum firmware is `1.1.3.1`\n",
+        encoding="utf-8",
+    )
+
+    findings = AUDIT.check_sensitive_resources([AUDIT.load_document(path, tmp_path)])
+
+    assert not any("8.5.0.0" in finding.message for finding in findings)
+    assert not any("192.0.2.10" in finding.message for finding in findings)
+    assert any("192.168.1.42" in finding.message for finding in findings)
+    assert any("10.0.0.42" in finding.message for finding in findings)
+    assert not any("1.1.3.1" in finding.message for finding in findings)
+
+
+def test_archive_pages_are_exempt_from_long_page_warning(tmp_path):
+    archive = tmp_path / "packages" / "example" / "doc" / "archive" / "record.md"
+    current = tmp_path / "packages" / "example" / "doc" / "reference.md"
+    archive.parent.mkdir(parents=True)
+    archive.write_text("# Archive\n\nHistorical detail\n", encoding="utf-8")
+    current.write_text("# Current\n\nCurrent detail\n", encoding="utf-8")
+    documents = [AUDIT.load_document(path, tmp_path) for path in (archive, current)]
+
+    findings = AUDIT.check_structure(documents, {}, max_lines=1)
+
+    assert not any(
+        finding.path == "packages/example/doc/archive/record.md" and "long page" in finding.message
+        for finding in findings
+    )
+    assert any(
+        finding.path == "packages/example/doc/reference.md" and "long page" in finding.message
+        for finding in findings
+    )
+
+
+def test_duplicate_titles_are_scoped_to_non_entry_pages_in_one_directory(tmp_path):
+    first = tmp_path / "doc" / "first.md"
+    second = tmp_path / "doc" / "second.md"
+    other = tmp_path / "other" / "same.md"
+    readme = tmp_path / "doc" / "README.md"
+    for path in (first, second, other, readme):
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text("# Same title\n", encoding="utf-8")
+    documents = [AUDIT.load_document(path, tmp_path) for path in (first, second, other, readme)]
+
+    findings = AUDIT.check_structure(documents, {}, max_lines=600)
+    duplicate_paths = {
+        finding.path for finding in findings if "duplicate H1" in finding.message
+    }
+
+    assert duplicate_paths == {"doc/first.md", "doc/second.md"}
diff --git a/tests/test_plugin_catalog.py b/tests/test_plugin_catalog.py
new file mode 100644
index 0000000..1a194d4
--- /dev/null
+++ b/tests/test_plugin_catalog.py
@@ -0,0 +1,84 @@
+from __future__ import annotations
+
+import importlib.util
+import re
+import sys
+from pathlib import Path
+
+import pytest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = ROOT / "scripts" / "generate_plugin_catalog.py"
+SPEC = importlib.util.spec_from_file_location("wavebench_plugin_catalog", SCRIPT)
+assert SPEC and SPEC.loader
+CATALOG = importlib.util.module_from_spec(SPEC)
+sys.modules[SPEC.name] = CATALOG
+SPEC.loader.exec_module(CATALOG)
+
+
+def test_catalog_tracks_all_packages_and_entry_points():
+    records = CATALOG.discover_records(ROOT)
+
+    assert len({record.distribution for record in records}) == 11
+    assert len(records) == 13
+    assert [record.driver_id for record in records if record.distribution == "wavebench-rigol-dg4000"] == [
+        "rigol.dg4202",
+        "rigol.dg4202-v2",
+        "rigol.dg4202-v2-workspace",
+    ]
+
+
+def test_catalog_uses_current_dsg830_and_sdg2000x_capabilities():
+    records = {record.driver_id: record for record in CATALOG.discover_records(ROOT)}
+
+    assert len(records["rigol.dsg830"].capabilities) == 10
+    assert "rf_source.modulated_output_enable" in records["rigol.dsg830"].capabilities
+    assert "rf_source.pulse_output" in records["rigol.dsg830"].capabilities
+    assert len(records["siglent.sdg2000x"].capabilities) == 12
+    assert "source.harmonics_disable_v2" in records["siglent.sdg2000x"].capabilities
+
+
+def test_check_mode_detects_missing_or_changed_output(tmp_path):
+    rendered = {"zh": "中文\n", "en": "English\n"}
+
+    with pytest.raises(CATALOG.CatalogError, match="stale"):
+        CATALOG.write_outputs(tmp_path, rendered, check=True)
+
+    CATALOG.write_outputs(tmp_path, rendered, check=False)
+    CATALOG.write_outputs(tmp_path, rendered, check=True)
+    (tmp_path / CATALOG.OUTPUTS["en"]).write_text("changed\n", encoding="utf-8")
+
+    with pytest.raises(CATALOG.CatalogError, match="plugin-catalog-en.md"):
+        CATALOG.write_outputs(tmp_path, rendered, check=True)
+
+
+@pytest.mark.parametrize(
+    ("driver_id", "relative_paths"),
+    (
+        (
+            "rigol.dsg830",
+            (
+                "packages/wavebench-rigol-dsg830/doc/reference.md",
+                "packages/wavebench-rigol-dsg830/doc/reference-en.md",
+            ),
+        ),
+        (
+            "siglent.sdg2000x",
+            (
+                "packages/wavebench-siglent-sdg2000x/doc/SDG2000X_COVERAGE_MATRIX.md",
+                "packages/wavebench-siglent-sdg2000x/doc/SDG2000X_COVERAGE_MATRIX_EN.md",
+            ),
+        ),
+    ),
+)
+def test_pilot_references_match_descriptor_capabilities(driver_id, relative_paths):
+    record = next(item for item in CATALOG.discover_records(ROOT) if item.driver_id == driver_id)
+
+    for relative_path in relative_paths:
+        body = (ROOT / relative_path).read_text(encoding="utf-8")
+        documented = tuple(
+            re.findall(r"^\| `((?:rf_source|source)\.[^`]+)` \|", body, re.MULTILINE)
+        )
+        assert documented == record.capabilities
+        assert f"`{record.version}`" in body