P6: real opcodes for light/horn/setMaxSpeed, real battery and mileage

A second btsnoop capture from a real P6 owner with a settings page open
gave us the missing control opcodes. The InMotion app sends:

- Light: 60 50 [on/off, on/off] (3-byte mirrored, V14 uses 2 bytes)
- Horn: 60 51 [18 01] (V14 sends [02 64] which P6 ignores)
- setMaxSpeed: 60 21 [val_lo val_hi] (single uint16 in 0.01 km/h)
- Flash commit: 60 3e [val_lo val_hi 00 00] right after setMaxSpeed

The P6 path in InMotionV2Adapter now branches to setP6Light, hornP6 and
setP6MaxSpeed when useP6Protocol is on. WheelAdapter gains an optional
setMaxSpeedCommit hook so the repository fires the flash-commit packet
right after the setMaxSpeed write — non-P6 wheels return null and the
behaviour is unchanged.

The realtime parser now reads the real per-pack battery percent at
offsets 20-23 (matched the on-screen 98.94% / 96.90% in the capture)
instead of the previous voltage-curve estimate, plus total mileage as
uint32 LE at offset 58 in 0.01 km units (matched 1773.5 mi). A new
parseP6Settings pulls the current tiltback at offset 13-14 of the
51-byte sub 0x20 settings page so the slider shows the wheel's actual
value.

Speed, PWM, per-sensor temperatures, gear, and the alarm-write opcodes
still wait on a labelled riding capture — the InMotion app stopped
polling sub 0x07 during the rider's actual ride in this trace, so
parked-only frames have all those fields at zero or idle. The btsnoop
analysis tools used for this work land under tools/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: eried

BRANCH.md

@@ -10,11 +10,16 @@ state for any of them. Concretely shipped here:
   V12S / V13 / V13 Pro / V14 50GB / V14 50S / V9 / P6. The wheel reports
   its model ID on connect and the registry maps it to the right command
   variant (horn opcode, max-speed packet shape, etc.).
-- **P6 connect path.** The scan now lists `P6-XXXXXXXX` peripherals, and
-  the InMotion V2 adapter switches to the P6's extended-routing-only
-  command set when it sees that name. Voltage, discharge current, and a
-  rough battery estimate come through; richer telemetry parsing is the
-  remaining work tracked under `docs/BLE_CAPTURE_GUIDE.md`.
+- **P6 connect path + parser pass.** The scan now lists `P6-XXXXXXXX`
+  peripherals; the adapter switches to the extended-routing-only command
+  set when it sees that name. Voltage, discharge current, real per-pack
+  battery percent, total mileage, and current tiltback all parse from
+  real-hardware captures. The control plane now uses the P6-specific
+  opcodes the InMotion app sends — light becomes a 3-byte mirrored
+  packet, horn drops the V14 sound id, setMaxSpeed sends a single
+  uint16 followed by a flash-commit. Speed, PWM, and per-sensor
+  temperatures still wait on a labelled riding capture
+  (`docs/BLE_CAPTURE_GUIDE.md`).
 - **Wheel simulator** in the connect screen. Two virtual wheels (V14 and
   P6) feed canned BLE responses through the real adapter pipeline, so the
   whole UI works without hardware. Useful for translation, layout, and
@@ -31,11 +36,13 @@ state for any of them. Concretely shipped here:
 - **V14 owners**: confirm that nothing changed for you. The banner stays
   hidden, the dashboard reads the same values, horn / light / lock /
   safety mode still work.
-- **P6 owners**: connecting now works. Confirm the dashboard reports a
-  plausible pack voltage (around 230–240 V at full charge) and that
-  battery current swings positive when accelerating. Speed and the
-  remaining telemetry will read zero until the byte offsets are pinned —
-  the orange banner walks you through filing a labeled capture.
+- **P6 owners**: connecting now works and the control plane is wired up
+  properly. Verify horn beeps, light toggles on/off, and that adjusting
+  the tiltback slider actually changes the wheel's speed cap (the
+  flash-commit packet is meant to persist it past sleep). Voltage,
+  per-pack battery, and total mileage should match the InMotion app.
+  Speed, PWM, and temperatures still read zero — those need a labelled
+  riding capture to confirm offsets.
 - **Owners of any other InMotion wheel** (V11, V12, V13, V9): try
   connecting. Telemetry decoding outside the V14 family is unverified,
   so expect wrong values. If anything works or fails, tap the orange

app/src/main/java/com/eried/eucplanet/ble/InMotionV2Adapter.kt

@@ -65,11 +65,13 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
     }
 
     override fun initSequence(): List<ByteArray> {
-        // P6 doesn't answer the V14 carType / settings / stats queries; only the
-        // info bundle (`02 21 06`) returns useful data. Telemetry kicks in via
-        // pollRealtime once the loop starts.
+        // P6: query info bundle for serial, then settings page A so the UI
+        // shows the current tiltback. Telemetry kicks in via pollRealtime.
         if (useP6Protocol) {
-            return listOf(InMotionV2Commands.getP6Info())
+            return listOf(
+                InMotionV2Commands.getP6Info(),
+                InMotionV2Commands.getP6Settings()
+            )
         }
         return listOf(
             InMotionV2Commands.getCarType(),
@@ -86,13 +88,11 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
         else InMotionV2Commands.getRealTimeData()
 
     /**
-     * P6 settings (`02 21 20 …`) come back in a TLV layout we haven't decoded
-     * yet, so re-polling them adds load with no benefit. Returning the realtime
-     * query keeps the polling loop's settings-refresh tick benign — the wheel
-     * just emits another telemetry packet.
+     * Periodic settings refresh. The P6 returns a 51-byte settings page on
+     * `02 21 20 [20]`; the parser pulls the current tiltback at offset 13-14.
      */
     override fun pollSettings(): ByteArray =
-        if (useP6Protocol) InMotionV2Commands.getP6RealTimeData()
+        if (useP6Protocol) InMotionV2Commands.getP6Settings()
         else InMotionV2Commands.getCurrentSettings()
 
     /**
@@ -102,6 +102,7 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
      * isn't yet known the V14 path is the safer default.
      */
     override fun horn(): ByteArray {
+        if (useP6Protocol) return InMotionV2Commands.hornP6()
         val m = detectedModel
         return if (m == null || m.hornOpcode == InMotionV2Model.HORN_PLAY_BEEP) {
             InMotionV2Commands.horn()
@@ -110,7 +111,9 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
         }
     }
 
-    override fun setLight(on: Boolean): ByteArray = InMotionV2Commands.setLight(on)
+    override fun setLight(on: Boolean): ByteArray =
+        if (useP6Protocol) InMotionV2Commands.setP6Light(on)
+        else InMotionV2Commands.setLight(on)
 
     /**
      * Max speed dispatch. Models that can carry alarm thresholds in the same
@@ -122,6 +125,7 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
      * just means the wheel keeps whatever alarm value it had configured.
      */
     override fun setMaxSpeed(tiltbackKmh: Float, alarmKmh: Float): ByteArray {
+        if (useP6Protocol) return InMotionV2Commands.setP6MaxSpeed(tiltbackKmh)
         val m = detectedModel
         return if (m == null || m.maxSpeedHasAlarms) {
             InMotionV2Commands.setMaxSpeedV14(tiltbackKmh, alarmKmh)
@@ -130,6 +134,14 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
         }
     }
 
+    /**
+     * P6 follows up `60 21 [val]` with `60 3e [val 00 00]` to commit the new
+     * tiltback to flash; without it the change is volatile. The repository
+     * sends both back to back when this returns non-null.
+     */
+    override fun setMaxSpeedCommit(tiltbackKmh: Float): ByteArray? =
+        if (useP6Protocol) InMotionV2Commands.commitP6MaxSpeed(tiltbackKmh) else null
+
     override fun setVolume(percent: Int): ByteArray = InMotionV2Commands.setVolume(percent)
     override fun setDRL(on: Boolean): ByteArray = InMotionV2Commands.setDRL(on)
     override fun setLock(locked: Boolean): ByteArray = InMotionV2Commands.setLock(locked)
@@ -228,6 +240,13 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
                     DecodeResult.ModelName("InMotion P6 ($serial)", InMotionV2Model.P6)
                 } else DecodeResult.Unknown
             }
+            0x20 -> {
+                // settings page A: `02 a0 [body]` — the body starts with a 0x20
+                // sub-cmd echo and the parser pulls tiltback at offset 13-14.
+                if (data.size < 3) return DecodeResult.Unknown
+                val settings = InMotionV2Parser.parseP6Settings(data.copyOfRange(2, data.size))
+                settings?.let { DecodeResult.Settings(it) } ?: DecodeResult.Unknown
+            }
             else -> DecodeResult.Unknown
         }
     }

app/src/main/java/com/eried/eucplanet/ble/InMotionV2Commands.kt

@@ -80,6 +80,67 @@ object InMotionV2Commands {
     fun getP6RealTimeData(): ByteArray =
         InMotionV2Protocol.buildExtendedPacket(0x07, byteArrayOf())
 
+    /**
+     * Read settings page A (`02 21 20 [20]`). Comes back as a 51-byte body
+     * with current tiltback at offset 13-14 (uint16 LE / 100, km/h).
+     */
+    fun getP6Settings(): ByteArray =
+        InMotionV2Protocol.buildExtendedPacket(0x20, byteArrayOf(0x20))
+
+    /**
+     * Set the P6 tiltback / max speed.
+     *
+     * P6 takes a 2-byte uint16 LE value in 0.01 km/h units, NOT the V14's
+     * 4-byte (tilt + alarm) packet. From a real-hardware capture, the
+     * InMotion app pairs each `60 21 [val]` write with a `60 3e [val 00 00]`
+     * commit-to-flash write a few hundred milliseconds later. We mimic that
+     * pairing — the caller writes both packets back to back.
+     */
+    fun setP6MaxSpeed(tiltbackKmh: Float): ByteArray {
+        val v = ByteUtils.putUint16LE((tiltbackKmh * 100).toInt())
+        return InMotionV2Protocol.buildExtendedPacket(
+            Command.CONTROL,
+            byteArrayOf(ControlSubCmd.SET_MAX_SPEED, v[0], v[1])
+        )
+    }
+
+    /**
+     * Persist-to-flash companion to [setP6MaxSpeed]. The InMotion app sends
+     * this immediately after the `60 21` write; without it the change is
+     * volatile and gets lost when the wheel sleeps.
+     */
+    fun commitP6MaxSpeed(tiltbackKmh: Float): ByteArray {
+        val v = ByteUtils.putUint16LE((tiltbackKmh * 100).toInt())
+        return InMotionV2Protocol.buildExtendedPacket(
+            Command.CONTROL,
+            byteArrayOf(0x3E, v[0], v[1], 0x00, 0x00)
+        )
+    }
+
+    /**
+     * P6 light: `60 50 [on/off, on/off]`. The second byte mirrors the first
+     * — V14 uses a 1-byte arg and is silently ignored by the P6, which is
+     * why the watch / phone toggle didn't take on Gio's wheel.
+     */
+    fun setP6Light(on: Boolean): ByteArray {
+        val v = if (on) 0x01.toByte() else 0x00.toByte()
+        return InMotionV2Protocol.buildExtendedPacket(
+            Command.CONTROL,
+            byteArrayOf(ControlSubCmd.SET_LIGHT, v, v)
+        )
+    }
+
+    /**
+     * P6 horn: `60 51 [18 01]`. V14 sends `[02 64]` (sound id + volume) and
+     * the P6 ignores it. Args here are taken verbatim from the InMotion app
+     * capture and produce the standard P6 chirp.
+     */
+    fun hornP6(): ByteArray =
+        InMotionV2Protocol.buildExtendedPacket(
+            Command.CONTROL,
+            byteArrayOf(ControlSubCmd.PLAY_SOUND, 0x18, 0x01)
+        )
+
     // --- Control commands ---
 
     /**

app/src/main/java/com/eried/eucplanet/ble/InMotionV2Parser.kt

@@ -197,17 +197,51 @@ object InMotionV2Parser {
         if (data.size < 4) return null
         val voltage = ByteUtils.getUint16LE(data, 0) / 100f
         val current = ByteUtils.getInt16LE(data, 2) / 100f
-        val batteryPercent = ((voltage - 165f) / 70f * 100f).toInt().coerceIn(0, 100)
+
+        // Real per-pack battery percent at offsets 20-23 of the data block
+        // (98.94 / 96.90 in the real-P6 capture, matched the on-screen 98%).
+        // Falls back to a voltage estimate while frames are still partial.
+        val battery1 = if (data.size >= 22) ByteUtils.getUint16LE(data, 20) / 100f else 0f
+        val battery2 = if (data.size >= 24) ByteUtils.getUint16LE(data, 22) / 100f else 0f
+        val batteryPercent = if (battery1 > 0f || battery2 > 0f) {
+            ((battery1 + battery2) / 2f).toInt().coerceIn(0, 100)
+        } else {
+            ((voltage - 165f) / 70f * 100f).toInt().coerceIn(0, 100)
+        }
+
+        // Total mileage as uint32 LE at offset 58, in 0.01 km units.
+        // (Matched on-screen 1773.2 mi / 2853.72 km.)
+        val tripDistanceKm = if (data.size >= 62) {
+            ByteUtils.getUint32LE(data, 58) / 100f
+        } else 0f
+
         return WheelData(
             voltage = voltage,
             current = current,
             batteryPercent = batteryPercent,
-            battery1Percent = batteryPercent.toFloat(),
-            battery2Percent = batteryPercent.toFloat(),
+            battery1Percent = battery1.takeIf { it > 0f } ?: batteryPercent.toFloat(),
+            battery2Percent = battery2.takeIf { it > 0f } ?: batteryPercent.toFloat(),
+            tripDistance = tripDistanceKm,
             timestamp = System.currentTimeMillis()
         )
     }
 
+    /**
+     * Parse the P6 settings response (sub 0x20 with arg 0x20). The 51-byte
+     * body has current tiltback at offset 13-14 as uint16 LE in 0.01 km/h.
+     * Only that field is filled in today — alarm thresholds at 17-19 are
+     * present in the bytes but we don't have a labelled capture confirming
+     * which is alarm-1 / alarm-2 / alarm-3, so they stay at their defaults.
+     */
+    fun parseP6Settings(data: ByteArray): WheelSettings? {
+        if (data.size < 21) return null
+        // First byte echoes the sub-cmd (0x20). Skip it.
+        val d = if (data[0] == 0x20.toByte()) data.copyOfRange(1, data.size) else data
+        if (d.size < 14) return null
+        val tiltback = ByteUtils.getUint16LE(d, 12) / 100f
+        return WheelSettings(maxSpeedKmh = tiltback)
+    }
+
     /**
      * Extract the ASCII serial from the data block of a `21 02 86 01 00 …` info
      * bundle response. Returns null if the layout doesn't match what we've seen.

app/src/main/java/com/eried/eucplanet/ble/WheelAdapter.kt

@@ -73,6 +73,14 @@ interface WheelAdapter {
     fun horn(): ByteArray?
     fun setLight(on: Boolean): ByteArray?
     fun setMaxSpeed(tiltbackKmh: Float, alarmKmh: Float): ByteArray?
+
+    /**
+     * Optional second packet to send right after [setMaxSpeed], used by the P6
+     * to commit the new tiltback to flash via `60 3e [val 00 00]`. Return null
+     * for wheels that persist the change in a single write.
+     */
+    fun setMaxSpeedCommit(tiltbackKmh: Float): ByteArray? = null
+
     fun setVolume(percent: Int): ByteArray?
     fun setDRL(on: Boolean): ByteArray?
     fun setLock(locked: Boolean): ByteArray?

app/src/main/java/com/eried/eucplanet/data/repository/WheelRepository.kt

@@ -292,6 +292,9 @@ class WheelRepository @Inject constructor(
         // tiltback, the readback-based detector would lock the toggle on.
         lastSentTiltbackKmh = tiltbackKmh
         wheelAdapter.setMaxSpeed(tiltbackKmh, beepKmh)?.let { bleManager.writeCommand(it) }
+        // Some wheels (P6) need a follow-up flash-commit packet for the change
+        // to persist past sleep. Adapter returns null for wheels that don't.
+        wheelAdapter.setMaxSpeedCommit(tiltbackKmh)?.let { bleManager.writeCommand(it) }
     }
 
     suspend fun toggleSafetySpeed() {