GB-M0-R4-R2 — Read-only Buds SPP decoder + durable private capture

[PNHD]

Goal

Turn the physically proven SM-R510 SppNew RFCOMM stream into a safe, independently implemented, read-only GalaxyBridge decoder without sending any Buds commands.

Accepted baseline

Physical owner evidence for GB-M0-R4-R1B is accepted.

• Branch: feature/gb-m0-feasibility
• Baseline HEAD: 53bb959ba12fa44444ccd8b045e37ccd87ebd317
• Target: Galaxy Buds2 Pro / SM-R510
• RFCOMM UUID: 2e73a4ad-332d-41fc-90e2-16bef06523f2
• SDP-resolved RFCOMM channel observed: 27
• Connection established in ~1.6–1.9 s
• Stable for ~60 s
• 3363 bytes received
• commands sent: 0
• iPhone audio remained OK; no Watch audio takeover; audio remained OK after disconnect

Architecture candidate accepted for Buds M0: WATCH_RFCOMM_BRIDGE.

Offline evidence finding

The recoverable portion of the R1B raw stream contains multiple complete modern SPP frames. Independent offline parsing found complete frames with valid framing/CRC, including:

• 0x61 EXTENDED_STATUS_UPDATED
• 0xC2 SPATIAL_AUDIO_DATA
• 0x63 VERSION_INFO
• 0x41 METERING_REPORT
• 0x47 USAGE_REPORT_V2
• diagnostic/debug families

The first 0x61 frame is sufficient to justify a minimum read-only status decoder candidate. Do not add a status request unless unsolicited status proves insufficient.

Privacy gate

The captured stream also contains a serial-number-bearing message. Raw captures therefore contain private device identifiers.

Requirements:

• raw capture stays local/private by default
• do not commit raw capture or serial-bearing payloads
• do not upload raw private capture to public GitHub
• shared/exported summaries must redact serial/device identifiers

Implementation

1. Implement an independent streaming decoder for modern SPP frames:
   • SOM 0xFD
   • 2-byte little-endian header
   • size bounds
   • request/response + fragment metadata
   • message ID
   • payload
   • CRC16-CCITT validation
   • EOM 0xDD
   • arbitrary RFCOMM chunk boundaries / multiple frames per read
   • malformed/truncated frame recovery with strict bounds
2. Add frame summaries: timestamp/offset, ID, size, CRC validity, redacted type name when known.
3. Decode minimum 0x61 EXTENDED_STATUS_UPDATED read-only fields needed for M0, beginning with revision, L/R battery, placement/coupling and noise-control mode. Clearly label uncertain/unsupported fields.
4. Add durable binary capture to app-private/local test storage so evidence is not truncated by Logcat. Bound each M0 session (e.g. 64 KiB) and never auto-upload it.
5. Produce a redacted share/export summary that never emits serial-bearing payloads.
6. Use synthetic/sanitized test vectors in repository tests. Do not commit the owner's raw capture.

Hard safety constraints

• RFCOMM writes remain exactly zero.
• No status query yet.
• No ANC/control writes.
• No FOTA/reset/debug/unknown writes.
• No alternate UUID probing needed in this task.
• No GPL/AGPL implementation copying; external projects are protocol/reference evidence only unless source is permissively licensed and attribution is preserved.

Physical validation

On real Watch6 + SM-R510 with iPhone audio active:

• connect exactly once to SppNew
• capture <= 90 s read-only
• decoder reports frames with CRC statistics
• 0x61 status appears and is decoded if received
• iPhone audio remains uninterrupted
• commands sent remains 0

Evidence bundle

Create a PM ZIP after the run containing redacted summary, parser/test output, screenshots, commit patch/diff, build results and SHA256 manifest. Do not include the private raw serial-bearing binary by default; report its local path + hash only.

Acceptance

Maximum initial status: PARTIAL — READ_ONLY_DECODE_VERIFIED until PM reviews parser implementation and physical evidence.

Keep PR #3 draft/unmerged. Do not start Buds controls or head tracking.

[PNHD]

PM review — R4-R2 evidence bundle

Reviewed uploaded GB-M0-R4-R2-PM-EVIDENCE.zip (SHA-256 E28833F9D77658C4DC0A2A766FECFF40DB54434F155E8BDDF9EB8413371FC9C5) plus remote commit 45076414cd61b624ebca8e9f624f09b5f58a1c65.

Corrected physical verdict

The R4-R2 attempt was validly targeted to SM-R510 / suffix AB:E4 using SppNew 2e73a4ad-332d-41fc-90e2-16bef06523f2, but it failed at the Classic ACL paging layer:

HCI_ERR_PAGE_TIMEOUT / PAGE_TIMEOUT (0x04)

This is not a protocol-level SPP refusal. SDP could not complete because the base Classic connection was not established. Do not infer that SppNew is inert, and do not switch UUIDs solely because of this run.

R1B remains the accepted physical topology proof: the same SM-R510/SppNew path connected successfully, remained up ~60 s, received 3363 bytes with zero commands sent, while iPhone audio remained uninterrupted and did not switch to Watch.

Current physical classification: PARTIAL — VALID_ATTEMPT_TRANSIENT_PAGE_TIMEOUT; WATCH_RFCOMM_BRIDGE remains the M0 architecture candidate.

Code-review blockers before another hardware capture

1. CRC16 init is wrong for the Buds protocol. BudsSppDecoder.kt starts CRC at 0xFFFF. Galaxy Buds reference implementations use CRC16-CCITT with initial value 0x0000. The permissively licensed MIT BudsPro-Headtracking/Crc16.py independently confirms init=0. Fix before trusting real-frame CRC results.
2. 0x61 Buds2 Pro field offsets are wrong. Correct minimum layout: [0] revision, [1] ear type, [2] L battery, [3] R battery, [4] coupled, [5] main connection, [6] packed placements (L high nibble / R low nibble), [7] case battery, [12] noise-control mode. Current code incorrectly uses [6]/[7] as separate placements, [8] case battery, [9] noise mode.
3. Tests are self-referential. createFrame() uses the same CRC implementation under test, so tests can pass with a protocol-incompatible CRC. Add at least one hard-coded/sanitized known-valid wire frame or independently generated fixed vector.
4. Parsed frame model is missing absolute/session stream offset, despite the task requirement.
5. bytesReceived currently measures captured bytes, not total transport bytes once the 64 KiB cap is reached. Separate total bytes received from bounded captured bytes.
6. 0xCD redaction test is insufficient. It currently checks only the message name. Add a report/export test proving a serial-bearing payload cannot leak into shareable output.
7. Evidence manifest has a wrong FINAL HEAD string; 02-GIT-STATUS.txt and GitHub correctly show 45076414cd61b624ebca8e9f624f09b5f58a1c65. Fix evidence generation next run.

Gate

Do not run Standard SPP yet. A PAGE_TIMEOUT occurs before SDP/service selection, so changing the RFCOMM UUID would not address that failure at that moment.

Next task: GB-M0-R4-R2R1 — parser correctness + privacy/test hardening, then one controlled same-SppNew physical retry. No protocol writes. No ANC/status query/head tracking.