Sync library with live findings: raw socket docs, wire reply parsing, pack-id BMS, empty-slot guard

docs/RE_DART_FINDINGS.md

@@ -494,23 +494,25 @@ keepAlive 10 s, LWT, QoS 0, event names), `MethodHandlerManager` handler list,
 
 Still open:
 
-1. Exact BLE frame field order & the 2-byte magic semantics (confirm with `btsnoop`).
-2. ~~Exact `encryptObject` radix + trailing-header handling~~ — **resolved
-   from disassembly (see §5): radix 32, plaintext header first
-   (`S1 || transform(S2)`), `decryptData` marker model. Remaining: first
-   confirmed live round-trip.**
+1. Live verification of the BLE frame layout (settled from disassembly in
+   §9 — `magic ++ crc ++ totalLen ++ sn ++ content`, radix-32 CRC pairs —
+   but no live BLE exchange yet) and the GATT service/notify
+   characteristics (write char matches `0000f002-…`).
+2. ~~Exact `encryptObject` radix + framing~~ — **resolved live (2026-10-16,
+   see §5 and `tests/fixtures/*.bin`): radix 16, plaintext header first
+   (`S1 || transform(S2)`) both directions.** (An earlier radix-32 reading
+   of a nearby `0x20` literal is superseded.) The `decryptData`
+   `0x58`-marker model is kept for the unverified Bluetooth path only.
 3. ~~Local HTTP port + TLS behavior for `https://IP:PORT`~~ — **revised (2026-10-13,
    §8 empirical):** no HTTP/TLS port exists on the device at all (only 53 + 9000).
    Either local mode is socket-only on this firmware, or the HTTP service is
    state-dependent and wasn't running. Revisit if a `/terminal` response is ever
    captured from the SoftAP.
-4. ~~Local socket port confirmation~~ — **partially resolved: `9000` open on
-   one unit** (§8 empirical); the `0x4650` constant is not listening there,
-   so the port may be firmware-/device-dependent. Remaining: first confirmed
-   RPC round-trip — the corrected request bytes (raw `S1 || transform(S2)`,
-   radix 32, int `snno`, seconds `timeStamp`, true SN
-   `A03X2516013210060005`) are ready via
-   `battery --probe`; needs a host on `10.100.1.0/24`.
+4. ~~Local socket round-trip~~ — **done (2026-10-16): full two-way RPC on
+   `10.100.1.1:9000`** (discovery → `1102` info, per-pack BMS `batSoc`,
+   EMS telemetry). Remaining: the live endpoint's exact role for port 9000
+   vs the app's `18000` constant (closed here), and the `1102 = req + 1`
+   reply-numbering rule across more commands.
 5. Which class in `classes5.dex` sets the `X-Device-*` headers and their exact values
    (string-pool location confirmed; class binding in progress — §13).
 6. (Tooling, optional) Enable REA's DEX tools: obtain a **jadx-headless-mcp 0.7.1** JAR