P6: fix temperatures, add connect-auth handshake, serialise lock taps

Three fixes from a labelled real-hardware capture (FINALP6/NEW CAPTURE)
plus its WIM-rendered values.

1. parseP6Telemetry temperatures: replaced data[28]/4 (MOS) and
   data[30]/4 (motor) with the actual MOS sensor at data[70] read as
   a raw Fahrenheit byte. data[28..29] is the speed-alarm field
   (uint16 LE = 13679 = 85 mph * 100, constant across 2300+ frames in
   the long ride capture). Motor and driver-board temps are not
   present in the realtime 0x87 stream on this firmware, so they are
   no longer reported on P6.

2. Connect-time auth handshake. The P6 silently drops control writes
   (light, horn, auto-headlight, max-speed) at the L2CAP layer until
   the password handshake has run once. Added requiresConnectAuth()
   to WheelAdapter (default false), set true in the P6 path of
   InMotionV2Adapter, and wired runConnectAuthHandshake() into the
   polling loop right after initSequence finishes. V14 wheels are
   unaffected (default false).

3. Mutex around authenticateAndLock. The pending CompletableDeferreds
   were nullable singletons that get clobbered on rapid lock taps,
   stranding the first coroutine's deferred to time out without ever
   writing the lock packet. Added authMutex.withLock to serialise.

Also exposed setP6AutoHeadlight builder for the new 0x2F sub-cmd
(unused for now; UI wiring to follow). Added analysis tools under
tools/ for re-running the offset hunt.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: eried

app/src/main/java/com/eried/eucplanet/ble/InMotionV2Adapter.kt

@@ -156,6 +156,18 @@ class InMotionV2Adapter @Inject constructor() : WheelAdapter {
     override fun verifyAuth(encryptedKey: ByteArray): ByteArray =
         InMotionV2Commands.verifyAuth(encryptedKey)
 
+    /**
+     * The InMotion P6 silently drops control commands (light, horn, auto
+     * headlight, max-speed) until the password auth handshake has run
+     * once after connect. The handshake is a fixed echo (the wheel returns
+     * a 16-byte "encrypted" blob and accepts the same blob back), so
+     * running it adds no security but unlocks the control endpoint.
+     *
+     * V14 family wheels do NOT need this — their light/horn writes work
+     * pre-auth; only lock requires the handshake on demand.
+     */
+    override fun requiresConnectAuth(): Boolean = useP6Protocol
+
     /**
      * Walk the reassembly buffer for complete AA AA frames, parse each, decode,
      * and return the resulting DecodeResults. Mirrors the legacy reassembly that

app/src/main/java/com/eried/eucplanet/ble/InMotionV2Commands.kt

@@ -141,6 +141,23 @@ object InMotionV2Commands {
             byteArrayOf(ControlSubCmd.PLAY_SOUND, 0x18, 0x01)
         )
 
+    /**
+     * P6 Auto Headlight toggle (the "Auto Headlight" switch under General
+     * Settings → Lighting). Wire format: `aa aa 16 05 02 21 60 2f [v] [chk]`,
+     * single-byte payload (1 = ON, 0 = OFF). Verified against the FINAL P6
+     * capture — five toggles by the user produced exactly this frame each
+     * time, with `2f 01 7e` for ON and `2f 00 7f` for OFF.
+     *
+     * On a P6, manual Light (`60 50`) is independent of Auto Headlight: when
+     * Auto Headlight is on, the wheel decides based on ambient light; when
+     * it is off, the user controls the headlight directly via `60 50`.
+     */
+    fun setP6AutoHeadlight(on: Boolean): ByteArray =
+        InMotionV2Protocol.buildExtendedPacket(
+            Command.CONTROL,
+            byteArrayOf(0x2F, if (on) 0x01 else 0x00)
+        )
+
     /**
      * Set the P6 **Speed Limit Alarm** (the threshold above which the wheel
      * beeps). Goes through `60 3e [v_lo v_hi 00 00]` — same opcode the

app/src/main/java/com/eried/eucplanet/ble/InMotionV2Parser.kt

@@ -241,17 +241,30 @@ object InMotionV2Parser {
             ByteUtils.getUint32LE(data, 58) / 100f
         } else 0f
 
-        // Per-sensor temperatures: byte / 4 = degrees Celsius.
-        // - Off 28: MOS temperature. Verified at v1:23 = 27.75 C ≈ 82 F label.
-        // - Off 30: motor temperature. Verified at v1:23 = 51.00 C ≈ 124 F label.
-        // Driver-board temp would land near 32-33 C (= 91 F label) but no
-        // single-byte offset in the labelled frame fits cleanly — leaving
-        // it un-parsed until a longer labelled capture lets us nail it.
-        val mosTempC = if (data.size > 28) data[28].toInt() and 0xFF else 0
-        val motorTempC = if (data.size > 30) data[30].toInt() and 0xFF else 0
+        // MOS temperature: byte at offset 70, raw degrees Fahrenheit.
+        // Verified against the FINAL P6 capture (NEW CAPTURE/btsnoop_hci.log):
+        // labelled MOS=72 °F at video t=120 s reads 0x48 = 72 across the
+        // entire capture, and the OLD ride capture's data[70] drifts
+        // 67-80 °F (19-27 °C) plausibly with riding heat.
+        //
+        // The previous offsets 28/30 with byte/4 were a numerical
+        // coincidence: data[28..29] is the speed-alarm pair (uint16 LE in
+        // 0.01 km/h, value 13679 = 85 mph for our wheel) and the low byte
+        // 0x6f /4 = 27.75 happened to land near a hot-wheel MOS reading in
+        // the old capture. Across 2300+ frames in the long ride capture,
+        // data[28] is constant at 111 — confirming it is not a sensor.
+        //
+        // Motor and driver-board temperatures do not appear in the realtime
+        // 0x87 stream on this firmware (every candidate offset is either
+        // a static config byte or a wrap-around counter). The InMotion app
+        // shows them as 79 °F on a parked wheel, which is most likely a
+        // cached default rather than a live sensor read. We therefore only
+        // expose MOS until a different request unlocks the other sensors.
         val temps = mutableListOf<Float>()
-        if (mosTempC > 0) temps.add(mosTempC / 4f)
-        if (motorTempC > 0) temps.add(motorTempC / 4f)
+        if (data.size > 70) {
+            val mosF = data[70].toInt() and 0xFF
+            if (mosF > 0) temps.add((mosF - 32) * 5f / 9f)
+        }
 
         // Park vs Drive: offset 80 = 0x49 when the wheel is engaged
         // (rider on, motor under load), 0x00 when lifted off / park-mode,

app/src/main/java/com/eried/eucplanet/ble/WheelAdapter.kt

@@ -97,6 +97,22 @@ interface WheelAdapter {
     fun requestAuthKey(): ByteArray?
     fun verifyAuth(encryptedKey: ByteArray): ByteArray?
 
+    /**
+     * Whether the wheel needs the password auth handshake to be run once
+     * right after [initSequence] finishes, before any control writes. Set to
+     * true for wheels where the firmware silently drops control commands
+     * (light, horn, max-speed) until the connect-time handshake completes.
+     *
+     * Confirmed cases:
+     *  - InMotion P6: requires auth at connect, otherwise the dashboard
+     *    Light / Auto Headlight toggles look successful at the L2CAP layer
+     *    but the wheel never obeys.
+     *
+     * Default false (no extra writes); the lock path runs auth on demand
+     * via [requestAuthKey] / [verifyAuth] regardless of this flag.
+     */
+    fun requiresConnectAuth(): Boolean = false
+
     /**
      * Process a raw BLE notification and return zero or more decoded results.
      *

app/src/main/java/com/eried/eucplanet/data/repository/WheelRepository.kt

@@ -22,6 +22,8 @@ import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
 import kotlinx.coroutines.withTimeoutOrNull
 import javax.inject.Inject
 import javax.inject.Singleton
@@ -110,6 +112,14 @@ class WheelRepository @Inject constructor(
     private var pendingAuthKeyDeferred: CompletableDeferred<ByteArray>? = null
     private var pendingAuthConfirmDeferred: CompletableDeferred<Boolean>? = null
 
+    // Serialise the lock auth handshake so rapid taps can't strand each
+    // other's deferreds. Without this, two concurrent toggleLock() calls
+    // both write the singleton `pendingAuthKeyDeferred`; the first call's
+    // deferred is overwritten and times out without ever reaching the
+    // setLock write — exactly the symptom seen on the P6 ("lock doesn't
+    // work" while WIM works because WIM serialises taps in its UI).
+    private val authMutex = Mutex()
+
     private var lastConnectedAddress: String? = null
     private var initState = 0
     private var pollingActive = false
@@ -223,20 +233,20 @@ class WheelRepository @Inject constructor(
      * requestAuthKey → receive 16-byte key → verifyAuth → receive confirm → setLock
      * handshake; otherwise we just send setLock directly.
      */
-    private suspend fun authenticateAndLock(locked: Boolean): Boolean {
-        val lockPacket = wheelAdapter.setLock(locked) ?: return false
+    private suspend fun authenticateAndLock(locked: Boolean): Boolean = authMutex.withLock {
+        val lockPacket = wheelAdapter.setLock(locked) ?: return@withLock false
 
         if (!wheelAdapter.capabilities.needsAuthForLock) {
             bleManager.writeCommand(lockPacket)
-            return true
+            return@withLock true
         }
 
         val authReqPacket = wheelAdapter.requestAuthKey()
         val verifyBuilder = wheelAdapter::verifyAuth
         if (authReqPacket == null) {
             // Capabilities say auth is required but adapter exposes no key request — bug.
             Log.e(TAG, "Lock: adapter requires auth but provides no requestAuthKey()")
-            return false
+            return@withLock false
         }
 
         // Step 1: Request auth key from wheel
@@ -250,15 +260,15 @@ class WheelRepository @Inject constructor(
 
         if (key == null) {
             Log.e(TAG, "Lock: auth key timeout")
-            return false
+            return@withLock false
         }
         authKey = key
         Log.i(TAG, "Lock: got auth key (${key.size} bytes): ${key.joinToString(" ") { "%02X".format(it) }}")
 
         // Step 2: Verify auth by echoing the key back
         val verifyPacket = verifyBuilder(key) ?: run {
             Log.e(TAG, "Lock: adapter returned null for verifyAuth")
-            return false
+            return@withLock false
         }
         val confirmDeferred = CompletableDeferred<Boolean>()
         pendingAuthConfirmDeferred = confirmDeferred
@@ -270,14 +280,14 @@ class WheelRepository @Inject constructor(
 
         if (!confirmed) {
             Log.e(TAG, "Lock: auth verify failed or timeout")
-            return false
+            return@withLock false
         }
         Log.i(TAG, "Lock: auth verified, sending lock=$locked")
 
         // Step 3: Send lock/unlock command
         Log.i(TAG, "Lock packet (${lockPacket.size} bytes): ${lockPacket.joinToString(" ") { "%02X".format(it) }}")
         bleManager.writeCommand(lockPacket)
-        return true
+        true
     }
 
     fun setDRL(on: Boolean) {
@@ -344,10 +354,21 @@ class WheelRepository @Inject constructor(
     private suspend fun runPollingLoop() {
         val initSequence = wheelAdapter.initSequence()
         var realtimeCycle = 0
+        var connectAuthDone = !wheelAdapter.requiresConnectAuth()
         while (pollingActive && bleManager.connectionState.value == ConnectionState.CONNECTED) {
             if (initState < initSequence.size) {
                 bleManager.writeCommand(initSequence[initState])
                 initState++
+            } else if (!connectAuthDone) {
+                // Wheels that silently drop control commands until the password
+                // auth handshake has run once (the P6 today). Run it inline
+                // before normal polling — once it completes, light/horn/max-speed
+                // writes start being honoured. We mark it done even on failure
+                // so we don't loop on an authentication that's never going to
+                // succeed; the user can still use telemetry and the lock path
+                // re-runs auth on demand.
+                runConnectAuthHandshake()
+                connectAuthDone = true
             } else {
                 // Normal polling - realtime data, interleaved with periodic settings refresh
                 // so externally-changed state (lock via InMotion app, etc.) is detected.
@@ -362,6 +383,35 @@ class WheelRepository @Inject constructor(
         }
     }
 
+    /**
+     * Run the password handshake right after init completes for wheels that
+     * gate control writes on it (the P6). Mirrors [authenticateAndLock]'s
+     * auth steps but stops after the verify ACK — there is no lock packet
+     * to send. Failure is logged and ignored; the user keeps their telemetry.
+     */
+    private suspend fun runConnectAuthHandshake() {
+        val authReqPacket = wheelAdapter.requestAuthKey() ?: return
+        val keyDeferred = CompletableDeferred<ByteArray>()
+        pendingAuthKeyDeferred = keyDeferred
+        bleManager.writeCommand(authReqPacket)
+        Log.i(TAG, "Connect-auth: requesting auth key…")
+        val key = withTimeoutOrNull(4000L) { keyDeferred.await() }
+        pendingAuthKeyDeferred = null
+        if (key == null) {
+            Log.w(TAG, "Connect-auth: key timeout — control commands may not work until lock toggle")
+            return
+        }
+        authKey = key
+        val verifyPacket = wheelAdapter.verifyAuth(key) ?: return
+        val confirmDeferred = CompletableDeferred<Boolean>()
+        pendingAuthConfirmDeferred = confirmDeferred
+        bleManager.writeCommand(verifyPacket)
+        val ok = withTimeoutOrNull(4000L) { confirmDeferred.await() } ?: false
+        pendingAuthConfirmDeferred = null
+        if (ok) Log.i(TAG, "Connect-auth: verified, control endpoint primed")
+        else Log.w(TAG, "Connect-auth: verify failed — control commands may not work")
+    }
+
     // --- Speed limits reconciliation on (re)connect ---
 
     /**