docs: version bumps, revision history, session-scoped 0x0e findings, changelog

Bring every document current with tonight's verified state: the spec
moves to 6.4 with revision rows for the 07-02/07-03 work, the sysfs
reference is re-dated, the TrueForce protocol doc records the two
firmware behaviours discovered during the auto-restore reproduction
(type-0x0e only acts inside an initialised session; an idle session's
range change is firmware-reverted after about a minute) plus the
auto-restore cross-reference, and the changelog gets the 90-degree
closure and profile-slot entries.

Author: mescon

CHANGELOG.md

@@ -12,6 +12,30 @@ Over one hundred commits since the `v0.9-pre-simplification` tag on
 by theme. See `git log v0.9-pre-simplification..HEAD` for the full
 chronology.
 
+### The 90-degree saga closed; profile slots done right (2026-07-03)
+
+- **Launch-time 90-degree reset: root-caused and fixed.** A usbmon
+  capture of an AC EVO launch showed the game's SDK session pushing an
+  operating range of 90 degrees in a TrueForce interface-2 packet
+  (type 0x0e - previously misdocumented as a frequency config; its
+  canonical init value 2700.0 is the wheel's max range). The new
+  `wheel_range_restore` (default on) restores the pre-reset range
+  automatically - detection to restore measured under 100 ms against
+  a faithful replay of the game traffic - behind safety gates:
+  external-and-exactly-90 only, desktop mode only, wheel stationary,
+  widen-only, three strikes per session, explicit writes supersede.
+  Game-side alternative documented: AC EVO's "Steering lock" setting
+  pushes its configured value once touched and re-applied.
+- **Profile slot select settled against the wheel's OLED**: fn2 SET is
+  the plain profile index (a capture-note misparse had briefly
+  suggested a [mode_class, slot] encoding; writing that switches to
+  profile 2), fn1 GET returns [profile, mode], and fn3 returns each
+  slot's user-assigned NAME - exposed as the new read-only
+  `wheel_profile_names` attribute.
+- Firmware behaviours documented from the reproduction work: type-0x0e
+  is session-scoped, and an idle TF session's range change is
+  reverted by the firmware itself after about a minute.
+
 ### Hardening, identity, and protocol resolutions (2026-07-02, later)
 
 - **Ten review findings fixed** (commit `c2b3a65`) after an adversarial

docs/RS50_PROTOCOL_SPECIFICATION.md

@@ -1,7 +1,7 @@
 # Logitech RS50 Protocol Specification
 
-**Document Version**: 6.3
-**Date**: 2026-07-02
+**Document Version**: 6.4
+**Date**: 2026-07-03
 **Author**: Verified from USB capture analysis
 **Status**: Protocol reference for Linux driver development
 
@@ -1554,3 +1554,5 @@ This returns the PAGE ID at each index. G Hub queries indices 0x00 through ~0x1F
 | 6.0 | 2026-02-04 | Verified feature table, SW_ID behaviour, LIGHTSYNC two-feature architecture |
 | 6.1 | 2026-04-21 | 8-way D-pad, G Pro coverage, per-feature SET fn numbers (damping fn=1, TRUEFORCE fn=3), FFB filter flags bitfield, centre calibration (feature 0x812C, G Pro sub-device 0x05), `wheel_calibrate` sysfs attribute |
 | 6.2 | 2026-06-29 | Corrected the D-pad section: the hat is a standard HID Hat Switch (value 0 = Up, clockwise) decoded natively by the kernel, not a custom byte-0 decode. The previous direction table and the `rs50_process_dpad()`/`RS50_DPAD_*` references were the removed, scrambled implementation (issue #22) |
+| 6.3 | 2026-07-02 | Resolved the three unknown features (0x80A4 axis response curves, 0x1BC0 ReportHidUsages, compat 0x15 = Brake Force); compat catalog identical to native; sub-device map (5.3); HID++ error packets, SW_ID and 0x12-report semantics from Logitech's official specs; DeviceInfo identity decode; LIGHTSYNC official lineage (9.10); registry cross-checks |
+| 6.4 | 2026-07-03 | Profile feature settled live against the OLED: fn2 SET = plain [profile,0,0], fn1 GET = [profile, mode], fn3 = per-slot profile names; catalog rows 0x02/0x03 corrected (DeviceInfo / DeviceNameType); launch-time 90-degree reset root-caused to the SDK's type-0x0e operating-range push (see TRUEFORCE_PROTOCOL.md) |

docs/SYSFS_API.md

@@ -5,7 +5,7 @@
 - Logitech RS50 Direct Drive Wheel Base (USB `046d:c276`)
 - Logitech G Pro Racing Wheel (USB `046d:c272` Xbox/PC, `046d:c268` PS/PC)
 
-**Version**: 2026-04-29
+**Version**: 2026-07-03
 
 Most of the attributes documented here are shared between the RS50 and G Pro (the two wheels share the settings code path). Attributes that are currently G Pro-only or RS50-only are called out inline.
 

docs/TRUEFORCE_PROTOCOL.md

@@ -163,9 +163,24 @@ why the launch-time range reset never produced a HID++ broadcast: it
 does not go through the HID++ range feature at all. Games push their
 configured steering rotation here at session start; a game whose
 rotation setting is 90 (or defaulted) locks the wheel to 90 degrees.
-The kernel driver's 20 s range poll detects the change and updates
-`wheel_range`; re-applying the desired range via HID++ afterwards
-sticks (the SDK write is one-shot at session init).
+The kernel driver's 20 s range poll detects the change and, by
+default, restores the pre-reset range automatically (the
+`wheel_range_restore` sysfs attribute; verified end-to-end with a
+detection-to-restore latency of ~60 ms against a faithful replay of
+the game traffic). Re-applying a range via HID++ sticks - the SDK
+write is one-shot at session init.
+
+Two firmware behaviours discovered while reproducing this
+(2026-07-03, live wheel):
+
+- **Type-`0x0e` is session-scoped**: a bare `0x0e` packet on an
+  otherwise idle interface is ignored; the range write only takes
+  effect inside an initialised TF session (init sequence sent).
+- **Idle revert**: if a TF session goes quiet (no stream packets,
+  roughly a minute) the firmware reverts the session's range change
+  on its own and broadcasts the restored value over HID++. A running
+  game keeps its session alive, which is why real launch-time resets
+  persist.
 
 AC EVO's init also differs from the canonical G Hub init in two more
 packets: a type-`0x0b` with float `1.0` (purpose unknown) and a