diff --git a/emu-probes/enetstat.py b/emu-probes/enetstat.py
new file mode 100644
index 0000000..4619cf9
--- /dev/null
+++ b/emu-probes/enetstat.py
@@ -0,0 +1,9 @@
+import socket,sys
+s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
+s.settimeout(3)
+s.bind(("192.168.68.1",0))
+s.sendto(b"enetstat",("192.168.68.200",5002))
+try:
+    print("enetstat ->",s.recvfrom(256)[0].decode())
+except socket.timeout:
+    print("enetstat -> TIMEOUT (old firmware?)")
diff --git a/emu-probes/probe_alive.py b/emu-probes/probe_alive.py
new file mode 100644
index 0000000..1166698
--- /dev/null
+++ b/emu-probes/probe_alive.py
@@ -0,0 +1,22 @@
+import socket,time
+s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
+s.settimeout(3)
+s.bind(("192.168.68.1",0))
+def cmd(c):
+    s.sendto(c.encode(),("192.168.68.200",5002))
+    try:
+        d,_=s.recvfrom(1024); print(c,"->",d.decode(errors="replace").strip())
+    except socket.timeout: print(c,"-> TIMEOUT")
+cmd("ping")
+cmd("mode")
+cmd("info")
+# e:net discovery ??(?? enet ????)
+import struct
+f=bytearray(180); f[0:4]=b"ENet"
+struct.pack_into("<I",f,4,1); struct.pack_into("<H",f,0x0A,31772)
+f[0x12]=1; struct.pack_into("<H",f,0x14,180); struct.pack_into("<H",f,0x18,1)
+s2=socket.socket(socket.AF_INET,socket.SOCK_DGRAM); s2.settimeout(3); s2.bind(("192.168.68.1",0))
+s2.sendto(bytes(f),("192.168.68.200",31772))
+try:
+    d,_=s2.recvfrom(2048); print("enet discovery ->",len(d),"B name=",d[0x1A:0x29])
+except socket.timeout: print("enet discovery -> TIMEOUT")
diff --git a/emu-probes/probe_breathe.py b/emu-probes/probe_breathe.py
new file mode 100644
index 0000000..79aa1cf
--- /dev/null
+++ b/emu-probes/probe_breathe.py
@@ -0,0 +1,49 @@
+import socket,struct,time,math,random
+DUT=("192.168.68.200",31772)
+HOST_IP=[192,168,68,1]
+HOST_MAC=bytes.fromhex("300ed559bb36")
+def env(f,ty,sub,total):
+    f[0:4]=b"ENet"; struct.pack_into("<I",f,4,ty)
+    f[0x0A]=0x1c; f[0x0B]=0x7c; f[0x12]=1
+    struct.pack_into("<H",f,0x14,total); struct.pack_into("<H",f,0x18,sub)
+def enc(src,r,b12):
+    rot=(b12^r)&511; out=bytearray(512)
+    for i in range(512):
+        cnt=((512-rot-i)&255) if i<512-rot else ((rot-(i-(512-rot)))&255)
+        out[i]=src[(i+rot)%512]^cnt
+    return out
+s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
+s.settimeout(2)
+s.bind(("192.168.68.1",0))
+# identity
+f=bytearray(102); env(f,2,1,102)
+f[0x1A:0x1E]=bytes([1,68,168,192]); f[0x1E:0x24]=HOST_MAC
+s.sendto(bytes(f),DUT)
+try: s.recvfrom(2048)
+except socket.timeout: pass
+# claim
+b12=random.randrange(1,2**31); nonce=random.randrange(1,2**31)
+f=bytearray(552); env(f,2,5,552)
+f[0x28:0x2C]=b"AECH"
+struct.pack_into("<I",f,0x88,nonce); struct.pack_into("<I",f,0x8C,b12)
+s.sendto(bytes(f),DUT)
+try:
+    d,_=s.recvfrom(2048); print("AERE ok, B12=%08x"%b12)
+except socket.timeout: print("no AERE")
+print("STREAMING 90s: ch1 breathing 3s period. WATCH THE STRIP NOW")
+t0=time.time(); ctr=0
+while time.time()-t0<90:
+    t=time.time()-t0
+    v=int((math.sin(t*2*math.pi/3)*0.5+0.5)*255)
+    p1=bytearray(512); p1[1]=v
+    r1=random.randrange(1,2**31); r2=random.randrange(1,2**31)
+    f=bytearray(1084); env(f,4,1,1084)
+    struct.pack_into("<I",f,0x1A,ctr)
+    f[0x20]=1; f[0x21]=1
+    struct.pack_into("<I",f,0x22,r1); struct.pack_into("<I",f,0x26,r2)
+    f[0x2E]=2; f[0x32]=1; f[0x35]=2; f[0x37]=2; f[0x38]=1
+    f[0x3C:0x23C]=enc(p1,r1,b12)
+    f[0x23C:0x43C]=enc(bytearray(512),r2,b12)
+    s.sendto(bytes(f),DUT)
+    ctr+=1; time.sleep(0.033)
+print("done")
diff --git a/emu-probes/probe_disc.py b/emu-probes/probe_disc.py
new file mode 100644
index 0000000..293ce03
--- /dev/null
+++ b/emu-probes/probe_disc.py
@@ -0,0 +1,21 @@
+import socket,struct,sys
+f=bytearray(180)
+f[0:4]=b"ENet"
+struct.pack_into("<I",f,4,1)
+struct.pack_into("<H",f,0x0A,31772)
+f[0x12]=1
+struct.pack_into("<H",f,0x14,180)
+struct.pack_into("<H",f,0x18,1)
+f[0x1A:0x1A+8]=b"HIL-TEST"
+s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
+s.settimeout(5)
+s.bind(("192.168.68.1",0))
+s.sendto(bytes(f),("192.168.68.200",31772))
+try:
+    d,a=s.recvfrom(2048)
+    print("REPLY",len(d),"from",a)
+    print("magic",d[0:4],"type",struct.unpack_from("<I",d,4)[0],"sub",hex(struct.unpack_from("<H",d,0x18)[0]),"len",struct.unpack_from("<H",d,0x14)[0])
+    print("name",d[0x1A:0x29])
+    print("ip_rev",d[0x41:0x45].hex(),"mac",d[0x49:0x4F].hex())
+except socket.timeout:
+    print("TIMEOUT no reply")
diff --git a/emu-probes/probe_rdm.py b/emu-probes/probe_rdm.py
new file mode 100644
index 0000000..3fc41f5
--- /dev/null
+++ b/emu-probes/probe_rdm.py
@@ -0,0 +1,60 @@
+import socket,struct,time
+
+DUT=("192.168.68.200",31772)
+UID=bytes.fromhex("7fff0ae09229")
+SRC=bytes.fromhex("0107340000aa")
+
+def build(dest,cc,pid,pd):
+    f=bytearray(1084)
+    f[0:4]=b"ENet"
+    f[4]=4
+    f[0x0A]=0x1c; f[0x0B]=0x7c
+    f[0x12]=1
+    struct.pack_into("<H",f,0x14,1084)
+    f[0x18]=1
+    f[0x20]=2
+    f[0x2A]=0xCC
+    f[0x2E]=1
+    f[0x30]=0
+    msg_len=24+len(pd)
+    struct.pack_into("<I",f,0x34,msg_len+1)
+    f[0x38]=1
+    f[0x3C]=1
+    f[0x3D]=msg_len
+    f[0x3E:0x44]=dest
+    f[0x44:0x4A]=SRC
+    f[0x4A]=1
+    f[0x4F]=cc
+    struct.pack_into(">H",f,0x50,pid)
+    f[0x52]=len(pd)
+    f[0x53:0x53+len(pd)]=pd
+    s=0xCC+sum(f[0x3C:0x53+len(pd)])
+    struct.pack_into(">H",f,0x53+len(pd),s&0xFFFF)
+    return bytes(f)
+
+def uid64(b): return int.from_bytes(b,"big")
+v=uid64(UID)
+branch_pd=(v-1).to_bytes(6,"big")+(v+1).to_bytes(6,"big")
+
+s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM)
+s.settimeout(1.5)
+s.bind(("192.168.68.1",0))
+
+def probe(tag,frame,n=6):
+    ok=0
+    for i in range(n):
+        s.sendto(frame,DUT)
+        try:
+            d,a=s.recvfrom(2048)
+            rl=struct.unpack_from("<H",d,0x28)[0]
+            print("%s #%d reply %dB rlen=%d d0=%02x"%(tag,i,len(d),rl,d[0x2A]))
+            ok+=1
+        except socket.timeout:
+            print("%s #%d TIMEOUT"%(tag,i))
+        time.sleep(0.3)
+    print("%s: %d/%d replied"%(tag,ok,n))
+
+probe("UNMUTE",build(b"\xff"*6,0x10,0x0003,b""))
+probe("BRANCH",build(b"\xff"*6,0x10,0x0001,branch_pd))
+probe("GET_DI",build(UID,0x20,0x0060,b""))
+probe("BRANCH2",build(b"\xff"*6,0x10,0x0001,branch_pd))
diff --git a/emu-probes/probe_relay.py b/emu-probes/probe_relay.py
new file mode 100644
index 0000000..fdab64e
--- /dev/null
+++ b/emu-probes/probe_relay.py
@@ -0,0 +1,9 @@
+import socket,struct
+f=bytearray(180); f[0:4]=b"ENet"
+struct.pack_into("<I",f,4,1); struct.pack_into("<H",f,0x0A,31772)
+f[0x12]=1; struct.pack_into("<H",f,0x14,180); struct.pack_into("<H",f,0x18,1)
+s=socket.socket(socket.AF_INET,socket.SOCK_DGRAM); s.settimeout(5); s.bind(("192.168.58.7",0))
+s.sendto(bytes(f),("192.168.58.7",31772))
+try:
+    d,a=s.recvfrom(2048); print("REPLY",len(d),"from",a,"ip_rev",d[0x41:0x45].hex(),"name",d[0x1A:0x29])
+except socket.timeout: print("TIMEOUT")
diff --git a/src/tests.rs b/src/tests.rs
index a0a060c..f545d09 100644
--- a/src/tests.rs
+++ b/src/tests.rs
@@ -366,7 +366,7 @@ pub fn device2(dev_ip: [u8; 4], dev_mac: [u8; 6], secs: u64, relay: Option<([u8;
                 let b = &buf[..n];
                 if b.len() == 180 && &b[0..4] == b"ENet" && g32(b, 4) == 1 {
                     // 真机处理延迟 ~160ms (指纹对齐)
-                    std::thread::sleep(Duration::from_millis(150));
+                    // instant reply: SL scan ignores 150ms-delayed replies
                     let mut r = resp_t.clone();
                     patch_dev(&mut r, dev_ip, dev_mac);
                     patch_259_host(&mut r, src, b);