Sync library with live findings: raw socket docs, wire reply parsing, pack-id BMS, empty-slot guard

docs/BATTERY_POC.md

@@ -86,9 +86,21 @@ instead: install the Frida hook (`blutter_out/blutter_frida.js` pattern —
 log `Socket Manager send object: ` / `receive object: `), tap *Refresh* in
 the app while joined to the AP, and compare its TX bytes against ours.
 
-## Limits
+## Status (2026-10-16) — live round-trip works
 
-- No live round-trip has succeeded yet from an isolated container netns
-  (all probes `ECONNREFUSED`); first success needs a `10.100.1.x` source.
+Two-way comms verified against `10.100.1.1:9000` from a host on
+`10.100.1.0/24`: discovery → `1102` device-info reply (versions, `FHP_SN`,
+`BMS_SN`), per-pack BMS reads (`{"id": 1}` / `{"id": 2}` → live `batSoc`),
+EMS telemetry. `get_battery()` runs that exact sequence (discovery,
+apower, BMS packs 1–2, EMS) and returns the first SoC found; an all-zero
+BMS slot is skipped, not reported as 0 %.
+
+`DEVICE_APOWER_INFO` answers `{"result": 1, "reason": -1}` on the tested
+unit — SoC comes from the BMS packs instead.
+
+Remaining limits:
+
+- Needs L2 reachability to `10.100.1.1` (host on the device AP or bridged
+  container); the app's own socket port `18000` is closed on this unit.
 - BLE field order and `X-Device-*` binding remain open
   (`RE_DART_FINDINGS.md` Open items).

docs/RE_DART_FINDINGS.md

@@ -494,23 +494,25 @@ keepAlive 10 s, LWT, QoS 0, event names), `MethodHandlerManager` handler list,
 
 Still open:
 
-1. Exact BLE frame field order & the 2-byte magic semantics (confirm with `btsnoop`).
-2. ~~Exact `encryptObject` radix + trailing-header handling~~ — **resolved
-   from disassembly (see §5): radix 32, plaintext header first
-   (`S1 || transform(S2)`), `decryptData` marker model. Remaining: first
-   confirmed live round-trip.**
+1. Live verification of the BLE frame layout (settled from disassembly in
+   §9 — `magic ++ crc ++ totalLen ++ sn ++ content`, radix-32 CRC pairs —
+   but no live BLE exchange yet) and the GATT service/notify
+   characteristics (write char matches `0000f002-…`).
+2. ~~Exact `encryptObject` radix + framing~~ — **resolved live (2026-10-16,
+   see §5 and `tests/fixtures/*.bin`): radix 16, plaintext header first
+   (`S1 || transform(S2)`) both directions.** (An earlier radix-32 reading
+   of a nearby `0x20` literal is superseded.) The `decryptData`
+   `0x58`-marker model is kept for the unverified Bluetooth path only.
 3. ~~Local HTTP port + TLS behavior for `https://IP:PORT`~~ — **revised (2026-10-13,
    §8 empirical):** no HTTP/TLS port exists on the device at all (only 53 + 9000).
    Either local mode is socket-only on this firmware, or the HTTP service is
    state-dependent and wasn't running. Revisit if a `/terminal` response is ever
    captured from the SoftAP.
-4. ~~Local socket port confirmation~~ — **partially resolved: `9000` open on
-   one unit** (§8 empirical); the `0x4650` constant is not listening there,
-   so the port may be firmware-/device-dependent. Remaining: first confirmed
-   RPC round-trip — the corrected request bytes (raw `S1 || transform(S2)`,
-   radix 32, int `snno`, seconds `timeStamp`, true SN
-   `A03X2516013210060005`) are ready via
-   `battery --probe`; needs a host on `10.100.1.0/24`.
+4. ~~Local socket round-trip~~ — **done (2026-10-16): full two-way RPC on
+   `10.100.1.1:9000`** (discovery → `1102` info, per-pack BMS `batSoc`,
+   EMS telemetry). Remaining: the live endpoint's exact role for port 9000
+   vs the app's `18000` constant (closed here), and the `1102 = req + 1`
+   reply-numbering rule across more commands.
 5. Which class in `classes5.dex` sets the `X-Device-*` headers and their exact values
    (string-pool location confirmed; class binding in progress — §13).
 6. (Tooling, optional) Enable REA's DEX tools: obtain a **jadx-headless-mcp 0.7.1** JAR