Multi-wheel scan: show-all toggle, virtual-wheels collapse, P6 cap

Scan filter now passes Adventure-/P6-/InMotion/V[0-9]+ names through; a
"Show all devices" Switch bypasses the filter entirely when an unknown
wheel doesn't appear. The simulator block becomes a collapsible
"Virtual wheels" section (debug bug header, Album icon per card) and
defaults closed.

WheelRepository now records the last-sent tiltback before each
setMaxSpeed write so the post-reconcile detector can compare intent
against firmware-clamped readback. A new reconcile case keeps stored
values when the wheel clamps between legal and normal, and a per-model
maxSpeedKmh table (P6=130, V11=60, V12HS/HT/PRO=70, V11Y/V12S/V13/V13Pro/V14x2/V9=120)
feeds the slider cap, with a 90 km/h default until model-id arrives.

ExperimentalBanner uses the filled Warning icon. Includes the
btsnoop_hci P6 capture decoder under tools/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: eried

BRANCH.md

@@ -10,6 +10,11 @@ state for any of them. Concretely shipped here:
   V12S / V13 / V13 Pro / V14 50GB / V14 50S / V9 / P6. The wheel reports
   its model ID on connect and the registry maps it to the right command
   variant (horn opcode, max-speed packet shape, etc.).
+- **P6 connect path.** The scan now lists `P6-XXXXXXXX` peripherals, and
+  the InMotion V2 adapter switches to the P6's extended-routing-only
+  command set when it sees that name. Voltage, discharge current, and a
+  rough battery estimate come through; richer telemetry parsing is the
+  remaining work tracked under `docs/BLE_CAPTURE_GUIDE.md`.
 - **Wheel simulator** in the connect screen. Two virtual wheels (V14 and
   P6) feed canned BLE responses through the real adapter pipeline, so the
   whole UI works without hardware. Useful for translation, layout, and
@@ -26,7 +31,12 @@ state for any of them. Concretely shipped here:
 - **V14 owners**: confirm that nothing changed for you. The banner stays
   hidden, the dashboard reads the same values, horn / light / lock /
   safety mode still work.
-- **Owners of any other InMotion wheel** (V11, V12, V13, V9, P6): try
+- **P6 owners**: connecting now works. Confirm the dashboard reports a
+  plausible pack voltage (around 230–240 V at full charge) and that
+  battery current swings positive when accelerating. Speed and the
+  remaining telemetry will read zero until the byte offsets are pinned —
+  the orange banner walks you through filing a labeled capture.
+- **Owners of any other InMotion wheel** (V11, V12, V13, V9): try
   connecting. Telemetry decoding outside the V14 family is unverified,
   so expect wrong values. If anything works or fails, tap the orange
   banner to fire off a wheel report.
@@ -36,11 +46,19 @@ state for any of them. Concretely shipped here:
 
 ## Known limits
 
-- **P6 telemetry on real hardware is not parsed yet.** The simulator
-  pretends the P6 speaks V14-shape framing so the dashboard renders, but
-  on a real P6 the wheel uses a different binary layout and most fields
-  will read zero. Fix is pending a labeled BLE capture from a real P6
-  owner, see `docs/BLE_CAPTURE_GUIDE.md`.
+- **P6 real-hardware support is preliminary.** Connecting to a real P6
+  now works (the BLE name `P6-XXXXXXXX` puts the adapter on the
+  extended-routing protocol the wheel actually speaks) and the dashboard
+  shows live voltage and discharge current plus a rough battery estimate
+  from the pack voltage. The remaining telemetry — speed, PWM, motor
+  temperature, trip distance, the per-pack battery split — is still
+  unmapped because the data block's byte layout differs from V14 and we
+  only have parked captures so far. Help us pin those offsets by recording
+  a labeled session (`docs/BLE_CAPTURE_GUIDE.md`) while riding.
+- **P6 settings, locking, and safety-mode max-speed control are
+  disabled** until the matching control packets are reverse-engineered.
+  The UI doesn't gate them yet, so tapping those buttons on a P6 is a
+  no-op — that should be obvious from the wheel not responding.
 - **KingSong, Veteran, Begode/Gotway, InMotion V1 family (V8 / V10)**:
   their adapters aren't built yet, so connecting won't work. They appear
   in the wheel-report dropdown for users to manually pick if they want

app/src/main/java/com/eried/eucplanet/ble/BleConnectionManager.kt

@@ -63,6 +63,8 @@ class BleConnectionManager @Inject constructor(
     private var gatt: BluetoothGatt? = null
     private var rxCharacteristic: BluetoothGattCharacteristic? = null
     private var currentAddress: String? = null
+    /** BLE advertised name from the most recent connect call, kept across reconnects. */
+    private var currentName: String? = null
     private var shouldReconnect = true
 
     // Write serialization - only one BLE write at a time
@@ -80,7 +82,7 @@ class BleConnectionManager @Inject constructor(
     }
 
     @SuppressLint("MissingPermission")
-    fun connect(address: String) {
+    fun connect(address: String, name: String? = null) {
         // Demo / simulator mode: VIRTUAL:<id> bypasses GATT and connects to a fake wheel.
         val virtualId = VirtualWheelRegistry.parsePseudoAddress(address)
         if (virtualId != null) {
@@ -89,9 +91,17 @@ class BleConnectionManager @Inject constructor(
         }
 
         currentAddress = address
+        // Hold on to the name so the auto-reconnect path keeps the same hint —
+        // otherwise a P6 that briefly drops would come back as an unknown wheel.
+        currentName = name ?: currentName
         shouldReconnect = true
         _connectionState.value = ConnectionState.CONNECTING
 
+        // Adapter pre-selects model from the BLE name; needed for the InMotion
+        // P6 because its legacy carType query returns zeros and we'd otherwise
+        // never identify it before sending V14-shaped queries the wheel ignores.
+        wheelAdapter.notifyConnectingTo(currentName)
+
         val device: BluetoothDevice = bluetoothManager.adapter.getRemoteDevice(address)
         gatt = device.connectGatt(context, false, gattCallback, BluetoothDevice.TRANSPORT_LE)
     }
@@ -136,6 +146,7 @@ class BleConnectionManager @Inject constructor(
     fun disconnect() {
         shouldReconnect = false
         currentAddress = null
+        currentName = null
         rxCharacteristic = null
         writeReady = false
 

app/src/main/java/com/eried/eucplanet/ble/BleScanner.kt

@@ -28,15 +28,24 @@ class BleScanner @Inject constructor(
     private val bluetoothAdapter = bluetoothManager.adapter
     private var scanCallback: ScanCallback? = null
 
+    /**
+     * Start a BLE scan and emit one [BleDevice] per advertisement match.
+     *
+     * @param showAll  when true, every named peripheral is forwarded (matches
+     *                 WheelLog's behaviour). When false, only names that match
+     *                 a known wheel prefix are forwarded — useful for keeping
+     *                 the scan list short and free of unrelated devices in
+     *                 typical usage.
+     */
     @SuppressLint("MissingPermission")
-    fun scanForDevices(): Flow<BleDevice> = callbackFlow {
+    fun scanForDevices(showAll: Boolean = false): Flow<BleDevice> = callbackFlow {
         val scanner = bluetoothAdapter?.bluetoothLeScanner
             ?: throw IllegalStateException("Bluetooth not available")
 
         val callback = object : ScanCallback() {
             override fun onScanResult(callbackType: Int, result: ScanResult) {
                 val name = result.device.name ?: return
-                if (name.startsWith("Adventure-") || name.startsWith("InMotion")) {
+                if (showAll || isLikelyWheel(name)) {
                     trySend(BleDevice(
                         name = name,
                         address = result.device.address,
@@ -63,6 +72,32 @@ class BleScanner @Inject constructor(
         }
     }
 
+    /**
+     * BLE-name allowlist for the default ("known wheels only") scan mode.
+     *
+     * V14 advertises as `Adventure-<id>`, P6 as `P6-<id>`. The InMotion V2
+     * registry covers V8 through V13 — those wheels broadcast as
+     * `V<digits><letters?>-<id>` (V11-…, V11Y-…, V12HS-…, V13Pro-…) per
+     * community captures. We don't have one of each here to confirm, so
+     * the regex errs inclusive. The generic `InMotion` prefix catches
+     * anything that ships with the brand name in the advertised name.
+     * Users with an unusual name can flip the "show all" switch on the
+     * scan screen.
+     */
+    private fun isLikelyWheel(name: String): Boolean {
+        if (name.startsWith("Adventure-")) return true
+        if (name.startsWith("P6-")) return true
+        if (name.startsWith("InMotion")) return true
+        // V8-…, V9-…, V10-…, V11-…, V11Y-…, V12HS-…, V13Pro-…: leading V
+        // followed by at least one digit and at least one more character
+        // (separator, model letter, or further digit). Rejects bare "V" /
+        // "V1" / "V12" beacons, accepts the InMotion V2 family.
+        if (name.length < 3 || name[0] != 'V' || !name[1].isDigit()) return false
+        var i = 2
+        while (i < name.length && name[i].isDigit()) i++
+        return i < name.length
+    }
+
     @SuppressLint("MissingPermission")
     fun stopScan() {
         val scanner = bluetoothAdapter?.bluetoothLeScanner ?: return

app/src/main/java/com/eried/eucplanet/ble/InMotionV2Adapter.kt

@@ -32,6 +32,15 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
     @Volatile var detectedModel: InMotionV2Model? = null
         private set
 
+    /**
+     * Use the P6's extended-routing-only command set. Only set by
+     * [notifyConnectingTo] from the BLE name (`P6-XXXXXXXX`) and never flipped
+     * by telemetry — keeping it name-bound means the virtual P6 simulator,
+     * which emits V14-shaped packets, can keep using the V14 command path even
+     * after carType identifies it as a P6.
+     */
+    @Volatile private var useP6Protocol: Boolean = false
+
     /**
      * BLE notifications can split a single AA AA frame across multiple packets.
      * Buffer them here and scan for complete frames. Stays in this adapter so
@@ -40,17 +49,51 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
      */
     private val reassemblyBuffer = ByteArrayOutputStream()
 
-    override fun initSequence(): List<ByteArray> = listOf(
-        InMotionV2Commands.getCarType(),
-        InMotionV2Commands.getSerialNumber(),
-        InMotionV2Commands.getVersions(),
-        InMotionV2Commands.getCurrentSettings(),
-        InMotionV2Commands.getUselessData(),
-        InMotionV2Commands.getStatistics()
-    )
+    /**
+     * Pre-select model from the BLE advertised name. The InMotion P6 uses an
+     * extended-routing-only command set: the legacy `02 [cmd]` queries return
+     * all-zero blobs (verified in real-hardware captures), so we have to know
+     * we're talking to a P6 *before* sending the first init packet. The name
+     * `P6-XXXXXXXX` is the cleanest pre-connect signal — we set the model now
+     * and let [initSequence] / [pollRealtime] / [decode] take the P6 branch.
+     */
+    override fun notifyConnectingTo(deviceName: String?) {
+        if (deviceName != null && deviceName.startsWith("P6-")) {
+            detectedModel = InMotionV2Model.P6
+            useP6Protocol = true
+        }
+    }
+
+    override fun initSequence(): List<ByteArray> {
+        // P6 doesn't answer the V14 carType / settings / stats queries; only the
+        // info bundle (`02 21 06`) returns useful data. Telemetry kicks in via
+        // pollRealtime once the loop starts.
+        if (useP6Protocol) {
+            return listOf(InMotionV2Commands.getP6Info())
+        }
+        return listOf(
+            InMotionV2Commands.getCarType(),
+            InMotionV2Commands.getSerialNumber(),
+            InMotionV2Commands.getVersions(),
+            InMotionV2Commands.getCurrentSettings(),
+            InMotionV2Commands.getUselessData(),
+            InMotionV2Commands.getStatistics()
+        )
+    }
 
-    override fun pollRealtime(): ByteArray = InMotionV2Commands.getRealTimeData()
-    override fun pollSettings(): ByteArray = InMotionV2Commands.getCurrentSettings()
+    override fun pollRealtime(): ByteArray =
+        if (useP6Protocol) InMotionV2Commands.getP6RealTimeData()
+        else InMotionV2Commands.getRealTimeData()
+
+    /**
+     * P6 settings (`02 21 20 …`) come back in a TLV layout we haven't decoded
+     * yet, so re-polling them adds load with no benefit. Returning the realtime
+     * query keeps the polling loop's settings-refresh tick benign — the wheel
+     * just emits another telemetry packet.
+     */
+    override fun pollSettings(): ByteArray =
+        if (useP6Protocol) InMotionV2Commands.getP6RealTimeData()
+        else InMotionV2Commands.getCurrentSettings()
 
     /**
      * Horn dispatch. V14 family models (V14g/V14s/V13/V13PRO/V11Y) use the
@@ -143,6 +186,7 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
     override fun onDisconnect() {
         reassemblyBuffer.reset()
         detectedModel = null
+        useP6Protocol = false
     }
 
     /** Internal decode of an unwrapped V2 packet. Called from [onRawNotification]. */
@@ -152,6 +196,38 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
             0x04 -> parseTelemetryForModel(data)?.let { DecodeResult.Telemetry(it) } ?: DecodeResult.Unknown
             0x11 -> InMotionV2Parser.parseTotalStats(data)?.let { DecodeResult.TotalDistance(it.totalDistanceKm) } ?: DecodeResult.Unknown
             0x20 -> parseSettingsForModel(data)?.let { DecodeResult.Settings(it) } ?: DecodeResult.Unknown
+            0x21 -> decodeP6Extended(data)
+            else -> DecodeResult.Unknown
+        }
+    }
+
+    /**
+     * Unwrap a P6-style extended-routing response. The frame body looks like
+     * `02 (sub|0x80) (01 00) (payload)` for sub 0x06 (info) and 0x07 (realtime),
+     * and `02 (sub|0x80) (payload)` for sub 0x10 / 0x11 / 0x60 etc. We only
+     * decode the two we trust today; the rest pass through silently.
+     */
+    private fun decodeP6Extended(data: ByteArray): DecodeResult {
+        if (data.size < 3 || data[0] != 0x02.toByte()) return DecodeResult.Unknown
+        val sub = data[1].toInt() and 0x7F
+        return when (sub) {
+            0x07 -> {
+                // realtime: skip the `02 87 01 00` prefix to land on the data block
+                if (data.size < 4) return DecodeResult.Unknown
+                val telem = InMotionV2Parser.parseP6Telemetry(data.copyOfRange(4, data.size))
+                telem?.let { DecodeResult.Telemetry(it) } ?: DecodeResult.Unknown
+            }
+            0x06 -> {
+                // info bundle: skip `02 86 01 00`, then ASCII serial follows the
+                // 0x01 record marker. We surface the serial as the model name so
+                // the dashboard has *something* to identify the wheel until a
+                // proper P6 parser lands.
+                if (data.size < 4) return DecodeResult.Unknown
+                val serial = InMotionV2Parser.parseP6Serial(data.copyOfRange(4, data.size))
+                if (serial != null) {
+                    DecodeResult.ModelName("InMotion P6 ($serial)", InMotionV2Model.P6)
+                } else DecodeResult.Unknown
+            }
             else -> DecodeResult.Unknown
         }
     }

app/src/main/java/com/eried/eucplanet/ble/InMotionV2Commands.kt

@@ -64,6 +64,22 @@ object InMotionV2Commands {
     fun getRealTimeData(): ByteArray =
         InMotionV2Protocol.buildPacket(Flags.DEFAULT, Command.REAL_TIME_INFO, byteArrayOf())
 
+    // --- InMotion P6 (extended-routing-only variant) ---
+    //
+    // The P6 ignores the legacy `02 [cmd]` queries (carType returns all zeros in
+    // captures) and only responds to extended-routing queries `02 21 [sub]`.
+    // Confirmed sub-commands seen on a real P6 (firmware A14219B): 0x06 info
+    // bundle (serial + version), 0x07 realtime telemetry, 0x04 total stats.
+    // We send only the info + realtime queries — settings (sub 0x20) and ride
+    // history (sub 0x10/0x11) have a TLV-style layout we haven't reverse-
+    // engineered yet, so polling them just produces unparsed bytes.
+
+    fun getP6Info(): ByteArray =
+        InMotionV2Protocol.buildExtendedPacket(0x06, byteArrayOf())
+
+    fun getP6RealTimeData(): ByteArray =
+        InMotionV2Protocol.buildExtendedPacket(0x07, byteArrayOf())
+
     // --- Control commands ---
 
     /**

app/src/main/java/com/eried/eucplanet/ble/InMotionV2Model.kt

@@ -25,7 +25,18 @@ enum class InMotionV2Model(
      * Horn opcode varies: V13/V14/V11Y use `playBeep(0x02)`, the older models
      * use `playSound(0x18)`. Stored as the sub-cmd byte.
      */
-    val hornOpcode: Byte
+    val hornOpcode: Byte,
+    /**
+     * Upper bound for the user-configurable tiltback slider in km/h. Numbers
+     * mirror WheelLog's `InmotionAdapterV2.getMaxSpeed()` table; P6 isn't in
+     * WheelLog so it gets 130 km/h to match community-reported top speeds.
+     * This is *not* the firmware-enforced cap — V14 firmware steps
+     * 70 → 80 → 90 km/h depending on revision and break-in mileage. The slider
+     * just lets the user request up to this value; the wheel clamps further
+     * if needed and the repository's reconcile logic now keeps the user's
+     * stored value rather than overwriting it with the clamp.
+     */
+    val maxSpeedKmh: Int
 ) {
     /**
      * The P6 actually uses an extended-routing-only variant of the V2 protocol
@@ -35,18 +46,18 @@ enum class InMotionV2Model(
      * has the model already wired in. The flags here are placeholders that
      * keep the simulator on the V14 command path.
      */
-    P6(     21, "InMotion P6",         maxSpeedHasAlarms = true,  hornOpcode = 0x18),
-    V11(    61, "InMotion V11",        maxSpeedHasAlarms = false, hornOpcode = 0x18),
-    V11Y(   62, "InMotion V11y",       maxSpeedHasAlarms = true,  hornOpcode = 0x02),
-    V12HS(  71, "InMotion V12 HS",     maxSpeedHasAlarms = false, hornOpcode = 0x18),
-    V12HT(  72, "InMotion V12 HT",     maxSpeedHasAlarms = false, hornOpcode = 0x18),
-    V12PRO( 73, "InMotion V12 Pro",    maxSpeedHasAlarms = false, hornOpcode = 0x18),
-    V13(    81, "InMotion V13",        maxSpeedHasAlarms = true,  hornOpcode = 0x02),
-    V13PRO( 82, "InMotion V13 Pro",    maxSpeedHasAlarms = true,  hornOpcode = 0x02),
-    V14_50GB(91, "InMotion V14 50GB",  maxSpeedHasAlarms = true,  hornOpcode = 0x02),
-    V14_50S( 92, "InMotion V14 50S",   maxSpeedHasAlarms = true,  hornOpcode = 0x02),
-    V12S(  111, "InMotion V12S",       maxSpeedHasAlarms = true,  hornOpcode = 0x18),
-    V9(    121, "InMotion V9",         maxSpeedHasAlarms = true,  hornOpcode = 0x18);
+    P6(     21, "InMotion P6",         maxSpeedHasAlarms = true,  hornOpcode = 0x18, maxSpeedKmh = 130),
+    V11(    61, "InMotion V11",        maxSpeedHasAlarms = false, hornOpcode = 0x18, maxSpeedKmh = 60),
+    V11Y(   62, "InMotion V11y",       maxSpeedHasAlarms = true,  hornOpcode = 0x02, maxSpeedKmh = 120),
+    V12HS(  71, "InMotion V12 HS",     maxSpeedHasAlarms = false, hornOpcode = 0x18, maxSpeedKmh = 70),
+    V12HT(  72, "InMotion V12 HT",     maxSpeedHasAlarms = false, hornOpcode = 0x18, maxSpeedKmh = 70),
+    V12PRO( 73, "InMotion V12 Pro",    maxSpeedHasAlarms = false, hornOpcode = 0x18, maxSpeedKmh = 70),
+    V13(    81, "InMotion V13",        maxSpeedHasAlarms = true,  hornOpcode = 0x02, maxSpeedKmh = 120),
+    V13PRO( 82, "InMotion V13 Pro",    maxSpeedHasAlarms = true,  hornOpcode = 0x02, maxSpeedKmh = 120),
+    V14_50GB(91, "InMotion V14 50GB",  maxSpeedHasAlarms = true,  hornOpcode = 0x02, maxSpeedKmh = 120),
+    V14_50S( 92, "InMotion V14 50S",   maxSpeedHasAlarms = true,  hornOpcode = 0x02, maxSpeedKmh = 120),
+    V12S(  111, "InMotion V12S",       maxSpeedHasAlarms = true,  hornOpcode = 0x18, maxSpeedKmh = 120),
+    V9(    121, "InMotion V9",         maxSpeedHasAlarms = true,  hornOpcode = 0x18, maxSpeedKmh = 120);
 
     companion object {
         /** Horn sub-cmd byte for `playBeep` (V13/V14/V11Y per WheelLog). */