docs(changelog): cut v0.6.10 — gyro tilt rework + L3/R3 indicator + charge-ETA

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
feat(oled): IMU gyro calibration + centred, correct-direction tilt dot
2026-05-25 07:20:30 -06:00 · 2026-05-25 07:16:51 -06:00 · 2026-05-24 12:39:40 -06:00 · 2026-05-24 12:36:40 -06:00 · 2026-05-24 12:14:17 -06:00 · 2026-05-24 12:02:42 -06:00
18 changed files with 1327 additions and 155 deletions
@@ -93,16 +93,11 @@ jobs:
          mkdir -p artifacts
          cp build/standard/ds5-bridge-oled.uf2 "artifacts/ds5-bridge-oled-${{ github.event.release.tag_name }}.uf2"

-      - name: Build Debug firmware
-        run: |
-          cmake -S . -B build/debug -G Ninja \
-            -DCMAKE_BUILD_TYPE=Release \
-            -DPICO_SDK_PATH="$PICO_SDK_PATH" \
-            -DENABLE_SERIAL=ON \
-            -DENABLE_VERBOSE=ON \
-            -DVERSION="$FIRMWARE_VERSION"
-          cmake --build build/debug --target ds5-bridge
-          cp build/debug/ds5-bridge-oled.uf2 "artifacts/ds5-bridge-oled-debug-${{ github.event.release.tag_name }}.uf2"
+      # The debug build (ENABLE_SERIAL=ON) compiles out tud_connect/disconnect and
+      # comes up as a serial console rather than a working HID/audio bridge — a
+      # developer diagnostic, not an end-user UF2. It is NOT published as a release
+      # download (footgun) — build it on demand with -DENABLE_SERIAL=ON, or use the
+      # PR-CI compile in build.yml. See CHANGELOG/CLAUDE.md.

      - name: Compute UF2 checksums + append to release notes
        env:
@@ -1,77 +1,37 @@
-# Bluetooth microphone investigation — current status
+# Bluetooth microphone — SOLVED

-**TL;DR:** The DualSense's built-in microphone does **not** work when the controller is paired to this dongle over Bluetooth. It works fine when the controller is connected directly to a host over USB. This is a Sony / DS5-firmware-side limitation we currently can't work around without reverse engineering or BT-sniffer access to PS5 ↔ DS5 traffic. The same limitation is documented in the upstream Linux kernel driver (`drivers/hid/hid-playstation.c` line ~1509: *"Bluetooth audio is currently not supported"*).
+**TL;DR:** The DualSense's built-in microphone **works over this dongle's Bluetooth pairing** as of v0.6.8. It is decoded and presented to the host as the standard DualSense USB capture device. Earlier versions of this document concluded the opposite — that it was a Sony-side limitation, probably encrypted, a dead end. **That conclusion was wrong.** The whole thing hinged on a single enable bit. Full credit to **[awalol](https://github.com/awalol/DS5Dongle)** (upstream `mic` branch) for identifying it.

-This file is a hand-off / research log for the next person who tries.
+## How it works

-## What does work
+1. **Enable bit (dongle → DS5).** In the outbound `0x36` BT audio report, the audio-control sub-report's first flag byte (`pkt[4]`) has **bit 0 = mic-enable**. Setting it (`0b11111110` → `0b11111111`; bits 1–7 were already the speaker/haptic enables) tells the DS5 to start streaming its mic. See `src/audio.cpp`.
+2. **Mic frames (DS5 → dongle).** Once enabled, the DS5 tags certain `0x31` BT input reports as mic frames by setting **bit 1 of byte 2** (`(data[2] >> 1) & 1`); the payload is a **71-byte Opus packet at offset +4**. `src/main.cpp:on_bt_data()` routes those to `mic_add_queue()`.
+3. **Decode + present.** `src/audio.cpp` Opus-decodes each frame to mono 48 kHz (480-sample / 10 ms frames), duplicates mono → stereo, and `tud_audio_write`s it to the UAC1 capture endpoint. The host sees a normal DualSense mic.
+4. **Sticky.** Once the DS5 starts streaming it **keeps going for the rest of the session** even after the enable bit / audio output stops (verified: mic stays live with no further `0x36` frames).
+5. **Always-on.** Because the enable normally only rides the audio-gated `0x36` frames, the dongle sends a **control-only `0x36` keep-alive** (enable bit + `SetStateData` + silent haptic, no speaker payload) at ~4 Hz *only until mic frames start arriving*, then stops (sticky takes over). So the mic works with no game audio playing, at minimal extra BT traffic. See `mic_enable_keepalive()` in `src/audio.cpp`.
+6. **Toggle.** Gated by `Config_body.bt_mic_enable` (default on) — OLED **Settings → BT Mic** and the web config tool. Off = no enable sent, no keep-alive, and inbound mic frames are not routed (so it's off host-side even if a previously-enabled DS5 is still streaming). Off by toggle saves DS5 battery (always-on keeps its audio subsystem awake).

- **Direct USB-C from DS5 → host:** mic enumerates as a UAC1 IN endpoint at 48 kHz / 16-bit / 2 channels on `EP 0x82`, max packet 196 bytes. ALSA recognizes it as `card N: Controller [DualSense Wireless Controller]`. `arecord` captures real audio after raising the `Headset Capture Volume` mixer control (it defaults to 0 dB).
- **Our dongle's USB descriptor** correctly mirrors the DS5's UAC1 layout — same interfaces, same alt settings, same endpoint addresses, same packet sizes. Verified with `lsusb -v` against a real DS5.
- **All the firmware-side decode infrastructure for BT mic is in place** (Opus decoder, `mic_fifo` queue, `tud_audio_write` to the IN endpoint, mono → stereo duplication) — see `src/audio.cpp`. It's currently gated behind `if (false)` in `src/main.cpp`'s `on_bt_data()` because we have nothing to feed it.
+## Why the original conclusion was wrong (the lesson)

-## What doesn't, and why
+The earlier investigation ported awalol's *receive* side (the `(data[2]>>1)&1` trigger + Opus decode) and then watched for that bit — but **never sent the enable bit**, because this fork's `audio.cpp` had diverged (the pre-`3a31bd7` SetStateData revert) and sat at `pkt[4] = 0b11111110`. With nothing telling the DS5 to start, it never streamed, so bit 1 of byte 2 never set — which got misread as "the trigger never fires → the channel must be encrypted / it's a dead end."

-The DS5 firmware on the test controller (build date `Jul 4 2025`, queried via feature report 0x20) **does not stream microphone audio over the standard BT-HID L2CAP channels** (PSM 0x11 control + 0x13 interrupt).
+It was never encrypted. It was one un-set bit on the *transmit* side. Lesson: when porting a two-sided protocol, confirm **both** halves (enable *and* receive) before concluding the device "can't" do something.

-What we tried:
+## What we use (host-side)

-1. **Upstream `awalol/DS5Dongle` `mic` branch as reference.** That branch claims to extract a 71-byte Opus packet at `data + 4` of any BT input report where `(data[2] >> 1) & 1` is set. On our DS5 firmware, **bit 1 of byte 2 is never set** (verified across thousands of frames via the `g_31_b2_or` OR mask). The upstream RE was likely done on a different (older) DS5 firmware revision.
-2. **Bit 0 of byte 2** matches roughly all standard input reports — confirmed by reading the supposed "mic prefix" via `0xFD` feature report and seeing live stick X/Y values (not Opus data). Not a mic flag.
-3. **Frame length sweep.** Longest BT 0x31 frame we ever see is 79 bytes — a fully-decoded standard DS5 input report (sticks + IMU + touchpad + battery + sensor timestamp + trailing zeros). No audio bytes appended anywhere.
-4. **Other report IDs.** Counted ALL incoming BT input reports by report ID. Only `0x01` (rare) and `0x31` (common). No 0x33 / 0x35 / 0x36 / 0x39 / etc. The DS5 isn't sending anything mic-shaped on a different ID.
-5. **State configuration matching the kernel.** Set `AllowAudioControl=1`, `AllowMicVolume=1`, `AllowAudioMute=1`, `MicSelect=Internal`, `VolumeMic=0x40`, `MicMute=0`, `AudioPowerSave=0` — exactly what `hid-playstation.c` sets when calling its "Enable microphone" path. DS5 still doesn't stream.
-6. **Bidirectional audio session hypothesis.** Maybe the DS5 only streams mic when there's also active speaker audio (`0x36` packets) flowing. Tested: ran `aplay /dev/zero` simultaneously with `arecord`. No change in BT-side counters, no new report IDs, no longer frames. Disproved.
-7. **State refresh on host UAC1 alt-setting change.** Considered hooking `tud_audio_set_itf_cb(itf=2, alt=1)` to send the DS5 a fresh "enable mic" state update. Not implemented — given the kernel comment and our state matching the kernel's own "enable" sequence, this wouldn't have helped.
+- **`scripts/mic_diag.sh`** — `status` / `capture [secs]` / `watch` / `bt-trace`. `capture` arecords the DualSense mic card and reports peak/RMS/non-zero, the fastest way to confirm real audio.
+- The DualSense capture card's **`Headset` capture control defaults low** — raise it (`amixer -c <card> sset 'Headset' 90%`) or captures look silent.
+- **OLED Diagnostics** `Mic in:` (~100/s when streaming) + `Mic dec=` (480 = good Opus decode) are the on-device confirmation.
+- Vendor HID feature reports `0xFD` / `0xFE` and the BT counters remain useful general audio-debug infra.

-What we **did not** try (real next steps if anyone picks this up):
+## Open follow-ups

- **SDP browse the DS5** over BT after pairing. Discover what L2CAP PSMs / services it advertises beyond HID. If there's a Sony proprietary audio PSM we haven't subscribed to, that's where mic traffic might live.
- **Open additional L2CAP channels** (proprietary audio PSM if found, or standard ones like A2DP=0x19 / RFCOMM=0x03) and watch for unsolicited inbound data.
- **Compare DS5 firmware revisions.** Test with an older DS5 (pre-2024 manufacture) and see if it streams mic over BT — that would tell us whether Sony removed the feature or just nobody documented the protocol. (We only have one DS5; can't test.)
- **BT sniffer** between a PS5 console and a DS5 during voice chat. Tells us exactly what L2CAP channels and bytes Sony uses for mic. Equipment-intensive (~$50–200 for an Ubertooth or commercial sniffer).
- **DS5 firmware disassembly.** Legally fraught, almost certainly EULA-violating.
-
-## Strongest hypothesis: the channel is encrypted
-
-The shape of all the negative evidence — kernel maintainers giving up, no public RE project succeeding, our matching every documented "enable" bit and getting nothing — strongly suggests the channel is **encrypted with a session key derived during pairing**, not just transported on an undocumented PSM. Sony's incentives line up perfectly:
-
- **PR / privacy:** a $40 third-party dongle routing a user's PS5 voice chat to a malicious host is a worst-case PR scenario. Encrypting the mic channel is the obvious defense.
- **GDPR-class regulation:** voice biometrics from a console controller over plaintext BT is the kind of thing EU regulators ask hard questions about.
- **Anti-spoofing:** prevents injecting fake mic data into a PS5 session, which is its own threat model.
-
-Mechanism that fits the evidence:
-
- During pairing, BT Classic SSP produces a link key. The PS5 + DS5 firmware likely run a Sony-proprietary KDF on top of that link key to produce an audio-channel session key.
- Mic audio is transported on a Sony-allocated proprietary L2CAP PSM (not in the standard BT-SIG ranges) and encrypted with that session key (AES-CCM or similar).
- A third-party dongle could connect to the PSM if it knew the number, but without the KDF / session key the payload would be opaque encrypted blobs.
-
-**Implication:** a BT sniffer might tell us the PSM and packet timing/sizes, but not the payload contents. Building a PS5-impersonating dongle that derives valid session keys would require either Sony system-software disassembly or DS5 firmware disassembly — legally fraught, and a much bigger undertaking than what this project is set up for.
-
-This re-frames "we can't get mic over BT" from "we haven't tried hard enough" to "the architecture is intentionally hardened against exactly this." That's not nothing — it's a clear answer to give users who ask, and a clear bar to clear if anyone wants to actually pursue it.
-
-## What we built that's useful regardless
-
-These all stay shipped — they're general-purpose audio-debug infrastructure now:
-
- **`scripts/mic_diag.sh`** with subcommands `status`, `capture [secs]`, `watch`, `bt-trace`. Drives the entire diagnostic loop from the host without needing OLED-relay-through-the-user; reads vendor feature reports via `/dev/hidraw`.
- **Vendor HID feature report `0xFD`** (32 bytes): BT input-report counter, non-0x31 counter, last seen non-0x31 report ID, OR mask of byte 2 across 0x31 frames, length range, hex prefix of last frame.
- **Vendor HID feature report `0xFE`** (82 bytes): full content of the longest 0x31 frame seen, for byte-level inspection.
- **OLED Diagnostics screen** carries BT31/Mic rate + recent frame prefix + opus dec/wrote bytes — useful for any future audio-path debugging at the bench.
- **`src/audio.cpp`** mic-decode infrastructure (Opus decoder on core0, FIFO, mono → stereo duplication, `tud_audio_write` to IN endpoint). Disabled at the `mic_add_queue` call site, ready to re-enable the moment a real mic trigger is identified.
- **`src/state_mgr.cpp`** initial state corrected — `VolumeMic` was `0xff` (out of valid range per spec; max is `0x40`), `MuteControl` had all `*PowerSave` bits set which would have power-gated the audio DSP. These corrections don't enable BT mic but they're the right defaults regardless.
+- **No documented "stop" command.** Disabling mid-session relies on gating the receive side; the DS5 keeps streaming until reconnect. If a real stop/disable bit is found, wire it into the toggle to stop the DS5-side battery drain immediately.
+- **Mono only.** Decoded mono is duplicated to the stereo endpoint; the DS5 mic is mono so this is fine, but the descriptor could be made truly mono (as awalol's branch does) to halve endpoint bandwidth.
+- **Name the `pkt[4]` bits precisely.** `daidr/dualsense-tester`'s `outputStruct.ts` documents the *standard* output report flags but not the `0x36` BT-audio sub-report; the bit meanings beyond bit 0 are inferred from the working speaker/haptic path.

 ## References

- Linux kernel `drivers/hid/hid-playstation.c`. Quoted lines: ~1407–1420 (mic enable/disable), ~1509 (*"Bluetooth audio is currently not supported"*). [Raw source on GitHub mirror](https://raw.githubusercontent.com/torvalds/linux/master/drivers/hid/hid-playstation.c).
- PSDevWiki [DualSense HID Commands](https://www.psdevwiki.com/ps5/DualSense_HID_Commands) — has factory/manufacturer commands (report IDs 128, 129, 160, 164, 165) for BT patches and audio codec selection, but explicitly notes most "do not work with retail controllers". Not a path forward.
- Upstream `awalol/DS5Dongle` branch `mic` (commits `9c197fc feat: mic work`, `3829163 mic mono channel`). RE'd a working mic path for an older DS5 firmware revision; we ported the data plumbing but the BT-side trigger differs on current firmware.
- dualsensectl: `command_microphone on/off` sets `valid_flag0 |= DS_OUTPUT_VALID_FLAG0_AUDIO_CONTROL_ENABLE` and clears `DS_OUTPUT_POWER_SAVE_CONTROL_MIC_MUTE`. Same as what we already do on connect.
-
-## For users asking about the mic
-
-When users report "the mic doesn't work":
-
- **Plug the DS5 into the host via USB.** Mic works out of the box. You may need to raise the `Headset Capture Volume` mixer control if it defaults to 0 dB.
- **Over the dongle's Bluetooth pairing, the mic is currently a known limitation** — not something a firmware update on our side can fix without further reverse engineering of the DS5's proprietary BT audio path.
- The diagnostic tools in `scripts/mic_diag.sh` are available if you want to help reverse engineer this; PRs welcome.
+- Upstream `awalol/DS5Dongle` branch `mic` (commits `9c197fc`, `3829163`) — the source of the enable bit (`pkt[4]` bit 0) and the receive-side decode. awalol confirmed bit 0 is the key.
+- Linux kernel `drivers/hid/hid-playstation.c` (~line 1509, *"Bluetooth audio is currently not supported"*) — still true for the kernel driver; not for this dongle.
+- `daidr/dualsense-tester` — `src/router/DualSense/views/_OutputPanel/outputStruct.ts` for the standard output-report flag layout.
@@ -10,6 +10,64 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Version

 ---

+## [0.6.10-oled-edition] — 2026-05-25
+
+Headline: the **Gyro Tilt screen** is now actually usable — it applies the controller's per-unit factory **IMU calibration**, the dot **centres when the controller lies flat**, and tilt **tracks the direction** you move it. Also adds an **L3 / R3 stick-click indicator** on the Status screen and makes the **charge-ETA** robust so it no longer over-reports off a single slow charge step. Everything here is on-dongle display only — **what games receive is unchanged** (the full gyro/accel stream is still forwarded byte-for-byte). UF2s attached to [the GitHub release](https://github.com/MarcelineVPQ/DS5Dongle-OLED-Edition/releases/tag/v0.6.10-oled-edition) (built by `.github/workflows/release.yml`).
+
+### Added
+
+- **L3 / R3 click indicator on the OLED Status screen.** Clicking a stick in now flashes its analog-stick box inverse (white box, black dot) for as long as it's held — previously the stick clicks had no on-screen feedback. Mirrored in the web config tool's OLED Preview.
+
+### Changed
+
+- **Gyro Tilt screen reworked: per-unit IMU calibration, a tilt dot that centres when flat, and intuitive direction.** Three things, all display-only — the host input report (all gyro + accel axes) is still forwarded byte-for-byte, so in-game motion is unaffected:
+  - **Calibration.** The DualSense ships factory gyro/accel bias + sensitivity in feature report `0x05` (which the dongle already fetches and caches at connect). Previously the tilt visuals used raw accel counts; now the cached `0x05` is parsed once per connection (re-read per controller, so it stays correct across the 4 pairing slots) and applied as `(raw − bias) × sensitivity`, keeping the same ±8192 ≈ 1 g scale. A bad/short read is rejected (same sanity gate SDL uses) and it falls back to raw — no regression when calibration is unavailable. The tilt→RGB lightbar mode uses the corrected accel too. Parse/apply mirror SDL's `SDL_hidapi_ps5.c` (zlib-licensed; credit).
+  - **Centred when flat.** The dot is now driven by the X (roll) and **Z** (pitch) axes — the two that read ~0 when the controller lies flat — instead of X/Y. Gravity rests on Y when flat, so the old Y mapping pegged the dot to the bottom edge at rest; it now sits centred.
+  - **Direction follows the controller.** Both axes are negated so tilting left moves the dot left and tilting forward moves it up, instead of mirrored.
+  - The dot centring + direction are mirrored in the web config tool's OLED Preview (its mock IMU now also rests gravity on Y to match real hardware).
+
+### Fixed
+
+- **Charge-ETA no longer balloons off a single slow 10% step.** The Status-screen `~Nm` charge estimate timed each 10% battery step and projected the rest, but one anomalously slow step (e.g. ~47 min — observed reading `~222m` at 70% on the dock) used to drag the whole projection up because the rate was a mean over only 3 steps. Each timed step's bulk-equivalent is now clamped to a 30-min ceiling and the rate is taken as the **median** over the last 5 steps, so a single under-load/anomalous reading can't dominate. Mirrored in the web OLED Preview emulator.
+
+---
+
+## [0.6.9-oled-edition] — 2026-05-24
+
+Headline feature: **on-dongle button remapping** — reassign any of the 16 digital controls, stored on the dongle so it works in every game and on every OS with no host-side software, edited visually in the web config tool's new **Remap** tab (a click-the-controller diagram built on Zacksly's CC BY 3.0 DualSense art). Also ships **packet-loss concealment** for the BT microphone. UF2s attached to [the GitHub release](https://github.com/MarcelineVPQ/DS5Dongle-OLED-Edition/releases/tag/v0.6.9-oled-edition) (built by `.github/workflows/release.yml`); this is the first release without the debug UF2 as a download.
+
+### Added
+
+- **Button remapping.** Any of the 16 digital controls (face buttons, D-pad, shoulders/triggers, stick clicks, Create/Options) can be remapped to any other — stored on the dongle, applied transparently before the host sees the report, so it works on every OS and every game with no host-side software. The remap table lives in its own dedicated flash sector (`PICO_FLASH_SIZE_BYTES - 3·FLASH_SECTOR_SIZE`, magic `DS5\x03`, below the slots sector) and survives reboot; identity (no remap) is the default. Multiple sources mapping to one target OR together (analog L2/R2 take the max); a source can be set to *disabled* (`0xFF`). The remap acts on the **outgoing host report copy only** — the raw input the OLED screens and the PS+Mute reboot combo read is untouched. Edited over the existing `0xF6`/`0xF7` vendor reports with a hardened `RM`+version frame (**no HID-descriptor change**, so Windows enumeration is unaffected) and a revision counter the host polls to confirm a write landed. New `src/remap.{h,cpp}`; apply logic + button set ported from [SundayMoments/DS5_Bridge](https://github.com/SundayMoments/DS5_Bridge) (credit). Dev helper `scripts/remap_test.py` exercises the path over `/dev/hidraw` without the web tool.
+
+### Changed
+
+- **BT microphone now has packet-loss concealment (PLC).** The mic decode path gained a small decoded-frame jitter buffer (8 frames) drained at a steady 10 ms playout cadence: bursty BT delivery is smoothed, and a dropped mic frame during an active session is concealed with an Opus PLC frame (`opus_decode(decoder, NULL, 0, …)`) instead of leaving a hole the host hears as a click/dropout. Playout pre-buffers 3 frames and stops after 300 ms of no real frames (so it never emits comfort noise when the mic is idle). A new **`Mic PLC:`** counter on the Diagnostics screen climbs only when concealment fires — effectively a live BT link-quality gauge. Verified: forced BT loss kept the captured audio gap-free (longest zero-run ~0 ms) while the counter climbed. Design ported from [SundayMoments/DS5_Bridge](https://github.com/SundayMoments/DS5_Bridge) (credit). Adds ~30 ms mic latency (the pre-buffer).
+
+### Companion web tool
+
+- **Visual button-remapping editor (new Remap tab).** `DS5Dongle-OLED-Config-Web` gains a dedicated **Remap** tab built on the new firmware remap protocol: click a button on a live, theme-aware DualSense diagram to reassign it, with the shoulders/triggers (L1/L2/R1/R2) floated to the corners as labeled glyphs + leader lines (they have no target in a front view). Remapped/selected buttons glow; a collapsible full dropdown list is kept as a fallback. Reads the remap block appended to the `0xF7` config response and writes over `0xF6` (func `0x10`), independent of `Config_body`. Controller outline + button glyphs are [Zacksly's "PS5 Button Icons and Controls"](https://zacksly.itch.io/ps5-button-icons-and-controls) (CC BY 3.0, recolored to `currentColor` and cropped), credited in the footer, each asset file, and a bundled license. Strings translated across all 7 locales.
+
+---
+
+## [0.6.8-oled-edition] — 2026-05-24
+
+Two big items: **DualSense microphone over Bluetooth** (long believed impossible — turned out to be a single enable bit; credit [awalol](https://github.com/awalol/DS5Dongle) upstream) and a **USB 3.0 connection-interference watchdog**. UF2s attached to [the GitHub release](https://github.com/MarcelineVPQ/DS5Dongle-OLED-Edition/releases/tag/v0.6.8-oled-edition) (built by `.github/workflows/release.yml`). The companion `DS5Dongle-OLED-Config-Web` config tool gains a **BT microphone** toggle.
+
+### Added
+
+- **DualSense microphone over Bluetooth.** The controller's built-in mic now works over the dongle's BT pairing — decoded from the DS5's Opus stream and presented to the host as the standard DualSense USB capture device, usable by any app (Discord, OBS, in-game voice). This fork had previously documented BT mic as a hard Sony-firmware limitation (likely encrypted); that conclusion was **wrong** — it hinged on a single enable bit (`pkt[4]` bit 0 in the outbound `0x36` audio report). Credit to **[awalol](https://github.com/awalol/DS5Dongle)** (upstream) for identifying it. The DS5 streams mic as 71-byte Opus packets tagged in `0x31` reports (`(data[2]>>1)&1`); `src/audio.cpp` decodes mono→stereo to the UAC1 endpoint. **Always-on:** the enable is sticky once streaming, so a control-only `0x36` keep-alive asserts it at ~4 Hz only until frames arrive, then backs off — mic works with no game audio, at minimal BT traffic. **Toggle:** new `bt_mic_enable` config field (default on; off saves DS5 battery since always-on keeps its audio subsystem awake) — OLED **Settings → BT Mic** and the web config tool's **BT microphone** switch. `BLUETOOTH_AUDIO_NOTES.md` rewritten from "dead end" to the working mechanism; README gains a user-facing **"DualSense Microphone over Bluetooth"** section.
+
+### Fixed
+
+- **Connection no longer hangs permanently on the amber lightbar (USB 3.0 interference recovery).** Users reported the DualSense getting stuck mid-connect (solid amber/yellow, never enumerates) on USB 3.0 host ports while USB 2.0 worked — caused by USB 3.0's broadband ~2.4 GHz RF noise desensitizing the CYW43 Bluetooth radio. The firmware's connection flow had dead-end states (ACL-fail and auth-fail re-inquiry were commented out; the controller-type feature-packet wait had no timeout), so a single lost packet stalled forever until a replug. Added a **connection-attempt watchdog** (`src/bt.cpp`): a 10 s timeout armed when a connection commits to a device and cleared when it reaches USB enumeration; on expiry it tears down via the existing `HCI_EVENT_DISCONNECTION_COMPLETE` path and restarts inquiry, so a stalled connect auto-retries instead of hanging. Re-enabled the ACL-fail / create-connection-reject / auth-fail recovery paths for faster recovery when the controller *does* report a failure. The watchdog is inert during a healthy established session (no effect on normal play, slot-switching, or idle-disconnect). Helps any marginal-RF setup, not just USB 3.0.
+
+### Documentation
+
+- New README section **"USB 3.0 ports & Bluetooth interference"** + a Known Issues bullet: explains the 2.4 GHz RFI cause (referencing Intel's white paper) and lists mitigations (USB 2.0 port, short USB 2.0 extension cable, powered USB 2.0 hub, ferrite bead, distance/line-of-sight).
+
+---
+
 ## [0.6.7-oled-edition] — 2026-05-23

 UF2s attached to [the GitHub release](https://github.com/MarcelineVPQ/DS5Dongle-OLED-Edition/releases/tag/v0.6.7-oled-edition) (built by `.github/workflows/release.yml`).
@@ -90,6 +90,7 @@ add_executable(ds5-bridge
        src/state_mgr.cpp
        src/oled.cpp
        src/slots.cpp
+        src/remap.cpp
 )

 if (ENABLE_BATT_LED)
@@ -1,53 +1,404 @@
-# Pico2W DualSense 5 Bridge
+# Pico2W DualSense 5 Bridge — OLED Edition
+
 [English](./README.md)
-> 将 Pico2W 变成 DS5 手柄的无线适配器

-# 功能特点
- - 支持HD震动
+> 将 Raspberry Pi Pico2W 变成 DualSense (DS5) 手柄的无线适配器 —— 并可选配板载状态显示屏。

-# 使用方法
-1. 按住 Pico 上的BOOTSEL进入刷机
-2. 将 .uf2 文件拖入进去
-3. 将 DS5 手柄进入蓝牙配对模式
-4. Enjoy it
+> **OLED 版**是 **[awalol/DS5Dongle](https://github.com/awalol/DS5Dongle)**（上游）的一个分支，增加了可选的 Pico-OLED-1.3 128×64 显示屏插件，提供 11 个屏幕（状态、4 槽多手柄配对、带收藏与特效预设的灯条调色器、扳机测试、陀螺仪倾斜、触摸板、诊断、CPU/时钟、蓝牙信号强度、音频 VU 表，以及一个持久化设置菜单），外加 DS5 按键组合软重启。核心桥接固件以上游为权威来源；本分支跟踪上游并在其之上叠加插件功能。

-***你可能需要在控制器处于匹配模式时重新插拔 pico***
+---

- 手柄连接到pico以后，系统才会显示设备
+## 🛠️ 网页配置工具

-# Pico 配置调整
-你可以通过网页调整Pico的内部设置
+**[→ 打开 OLED 版网页配置](https://marcelinevpq.github.io/DS5Dongle-OLED-Config-Web/#config)**

- 用于正式固件: https://ds5.awalol.eu.org
- 用于测试固件: https://ds5-dev.awalol.eu.org
+网页工具是一站式方案 —— **无需安装、无需命令行、无需 `picotool`**。一块全新的 Pico 2 W 可以全程在浏览器里从"刚开箱"做到完整刷写并配置完成：

-### Pico W 版本
+- **刷写固件标签页** —— 让 Pico 进入 **BOOTSEL 模式**，然后在浏览器中点击 *Connect to Pico*，再点 *Flash now*。站点会捆绑最新发布的 UF2，你也可以载入自己编译的本地 `.uf2`。基于 WebUSB。

-Pico W 由于性能问题，只能支持震动，不支持扬声器。
-你可以通过开启 `-DPICO_W_BUILD=ON` 编译项去开启 Pico W 固件编译，或者在 Github Action 下载预编译的固件
+  > **什么是 BOOTSEL 模式？** 这是 Pico 内置的刷写模式。进入方法：按住 Pico 上标有 **BOOTSEL** 的白色小按钮，*然后*插入 USB 线（若已插好，则在按住 BOOTSEL 的同时短暂拔插一次）。Pico 会作为可移动磁盘出现在电脑上 —— 看到它就说明已进入 BOOTSEL 模式。网页工具刷完固件后，Pico 会自动重启进入正常模式即可使用。
+- **配置标签页** —— 设备刷好并重新连接后，可编辑振动增益、扬声器音量、轮询率、音频自动触感模式以及其余持久化设置；一键保存到设备闪存。基于 WebHID。
+- **重映射标签页** —— 可视化按键重映射器：在实时 DualSense 示意图上点击某个按键即可把它重新指派为任意其他按键（肩键/扳机会以带标签的图标浮动到角落）。映射保存在设备上并在主机看到报告之前应用，因此在任何游戏、任何操作系统中都生效。基于 WebHID。
+- **OLED 预览标签页** —— 像素级精确模拟全部 11 个 OLED 屏幕。用页面内的 KEY0/KEY1 按钮（或在 DualSense 配对时用手柄的 △ / R1 / 方向键）来导航。循环切换扳机测试预设时，自适应扳机会在手柄上真实触发。

-### USB 唤醒支持
-这是一项实验性的功能。如果你需要该功能，请前往 feat/usb-wake 分支进行编译，或者使用该分支对应的 Github Action 预编译固件。`ds5-bridge-wake.uf2` 为该功能的固件
+可在任何基于 Chromium 的浏览器中使用（Chrome、Edge、Brave、Opera）。Firefox 与 Safari 不提供 WebHID 或 WebUSB，因此那里无法刷写和实时配置 —— 但 OLED 预览仍会用模拟数据渲染。

-极为建议在使用该功能前阅读  #60 和 #61
+> 网页工具源码：**[MarcelineVPQ/DS5Dongle-OLED-Config-Web](https://github.com/MarcelineVPQ/DS5Dongle-OLED-Config-Web)**（[awalol/ds5dongle-config-web](https://github.com/awalol/ds5dongle-config-web) 的分支）。

-### 社区分支
-https://github.com/MarcelineVPQ/DS5Dongle-OLED-Edition
-https://github.com/zurce/DS5Dongle-OLED
+---

-# 当前问题:
- 声音可能有点小卡顿
- 由于编码需要，需要对pico进行超频，当前的参数是1.2V 320MHz。
- 若您的pico使用该超频参数无法启动，请自行增加电压或者降低频率
+## 概述

-# 未来计划
-请查看[DS5Dongle plan](https://github.com/users/awalol/projects/5)
+本项目让 Raspberry Pi Pico2W 作为 DualSense 手柄的蓝牙桥接器，实现无线连接并增强触感支持。

-# 编译
-需要将pico sdk里面的tinyusb版本升级到最新
+## 功能特点

-# 致谢
- - [rafaelvaloto/Pico_W-Dualsense](https://github.com/rafaelvaloto/Pico_W-Dualsense) - 灵感来源
- - [egormanga/SAxense](https://github.com/egormanga/SAxense) - 震动报文
- - [https://controllers.fandom.com/wiki/Sony_DualSense](https://controllers.fandom.com/wiki/Sony_DualSense) - 数据报文结构
- - [Paliverse/DualSenseX](https://github.com/Paliverse/DualSenseX) - 扬声器数据包报文
+**核心桥接（来自上游）：**
+
+- 通过 Pico2W 完整连接 DualSense
+- HD 触感（高级振动反馈）
+- 无线蓝牙桥接
+- 通过麦克风音量调节触感增益
+- 可配置的 LED 与断连行为
+
+**OLED 版新增：**
+
+- 可选的 Pico-OLED-1.3 状态显示屏，含 **11 个屏幕**（状态、配对槽、灯条、扳机测试、陀螺仪倾斜、触摸板、诊断、CPU/时钟、RSSI、VU 表、设置）
+- **按键重映射** —— 把 16 个数字控件（面板按键、方向键、肩键/扳机、摇杆按下、Create/Options）中的任意一个重新指派为其他按键。映射保存在设备上并在主机看到报告之前应用，因此在**任何游戏和操作系统中都无需任何主机端软件**即可生效；默认为恒等映射（无重映射）。可在[网页配置工具](#️-网页配置工具)的**重映射标签页**中可视化编辑，或通过 `scripts/remap_test.py` 无界面编辑。保存在专属闪存扇区，重启后保留。
+- **4 槽持久化多手柄配对** —— 可绑定至多四个 DualSense，在 OLED 上切换，开机时自动重连槽 0
+- **灯条调色器**，含 4 个用户收藏槽 + 呼吸 / 彩虹 / 渐变特效预设
+- **持久化设置菜单**，涵盖 8 个固件配置字段（振动增益、扬声器音量、轮询率等），并提供按住确认的"重置"与"清除全部槽"操作
+- **OLED 空闲省电阶梯** —— 手动亮度循环（长按 KEY1）、空闲 2 分钟自动深度变暗并显示一个呼吸小点、空闲 15 分钟完全熄屏。按键、手柄配对或输入时立即唤醒。是真正的防烧屏，而不只是调对比度。
+- **软重启**，无需拔 USB：长按 DS5 的 `PS + Mute`（可无界面工作），或在 OLED 插件上**同时按住 KEY0 + KEY1 持续 1 秒**（取代了旧的 KEY0 双击手势 —— 快速翻页时容易误触发）
+- **核心桥接的审计修复** —— 修复音频路径中关键的栈溢出（解决长期存在的"音频卡顿"）、安全加固、看门狗、HID/L2CAP 边界处的长度校验（见 [CHANGELOG.md](./CHANGELOG.md)）
+
+## 硬件
+
+### 必需
+
+| 物品 | 说明 | 大致价格 |
+|---|---|---|
+| **Raspberry Pi Pico 2 W** | 搭载 RP2350 MCU，板载 CYW43 蓝牙/WiFi。[官方产品页](https://www.raspberrypi.com/products/raspberry-pi-pico-2/) | 约 $7 USD |
+| **索尼 DualSense 手柄** | 任何标准 PS5 DualSense（VID `054C:0CE6`）。 | — |
+| **USB-C 线缆** | 将 Pico 2 W 连接到主机 PC。 | — |
+
+### 可选（强烈推荐）
+
+| 物品 | 说明 | 大致价格 |
+|---|---|---|
+| **Waveshare Pico-OLED-1.3** | 128×64 SH1107 OLED 插件板（SKU HIPI1798）。直接插到 Pico 2 W 排针上。固件检测到时自动驱动，缺失时优雅地不做任何动作。[产品页](https://www.waveshare.com/pico-oled-1.3.htm) · [Wiki](https://www.waveshare.com/wiki/Pico-OLED-1.3) | 约 $6 USD |
+| **小散热片**（用于 RP2350） | 固件将 MCU 超频到 320 MHz @ 1.20 V（见[性能 / 超频](#性能--超频)）。持续游玩时小散热片或导热垫有帮助。 | $1–3 USD |
+
+### 哪里购买
+
+Pico 2 W 与 Waveshare Pico-OLED-1.3 在全球都很容易买到：
+
+- **Adafruit**、**Pimoroni**、**The Pi Hut**、**DigiKey**、**Mouser** —— 主要电子元件分销商（美/欧）
+- **Waveshare 自营商店** 购买 OLED 插件
+- 各地区 **Amazon** 店面 —— 搜索 `Raspberry Pi Pico 2 W` 与 `Waveshare Pico-OLED-1.3`（或 SKU `HIPI1798`）
+- **AliExpress（速卖通）** —— 原装 Waveshare 与 Pico 货源以及克隆品；注意查看卖家评分
+
+## 快速开始
+
+### 刷写固件
+
+1. 按住 Pico2W 上的 BOOTSEL 按钮
+2. 通过 USB 将 Pico2W 连接到电脑
+3. 设备会挂载为 USB 存储设备
+4. 将 .uf2 固件文件拖放到该设备上
+
+### 配对手柄
+
+1. 让 DualSense 手柄进入蓝牙配对模式
+2. 等待 Pico2W 检测并连接
+3. 连接后，设备会出现在主机系统中
+
+## 配置
+
+有四种方式配置固件：
+
+**网页配置（推荐，任何基于 Chromium 的浏览器）：** 在 Chrome、Edge、Vivaldi、Brave 或 Opera 中打开 **[DS5 Bridge Config — OLED Edition](https://marcelinevpq.github.io/DS5Dongle-OLED-Config-Web/)**（不支持 Firefox —— Mozilla 拒绝实现 WebHID）。点击 **Connect**，在浏览器对话框中选择 DualSense，然后用熟悉的表单界面编辑任意字段。页面通过 WebHID 直接与 Pico 通信 —— 无驱动、无安装，数据不离开你的机器。源码见 [MarcelineVPQ/DS5Dongle-OLED-Config-Web](https://github.com/MarcelineVPQ/DS5Dongle-OLED-Config-Web)。
+
+**设备端（已装 OLED 插件）：** 使用屏上的**设置**菜单（第 11 个屏幕）。方向键 ▲▼ 移动选择，▶◀ 调整数值，△ 保存到闪存。
+
+**终端 CLI（任何系统、任何浏览器）：** 安装 hidapi，然后使用 `scripts/set_ds5.py`：
+
+```bash
+pip install hidapi
+scripts/set_ds5.py                            # 显示当前配置
+scripts/set_ds5.py --auto-haptics fallback    # 修改某字段并持久化到闪存
+scripts/set_ds5.py --speaker-volume -10 --haptics-gain 1.5
+scripts/set_ds5.py --slot 2                   # 切换活动多槽配对
+scripts/set_ds5.py --version                  # 固件版本
+scripts/set_ds5.py --rssi                     # 实时蓝牙 RSSI（dBm）
+scripts/set_ds5.py --help                     # 完整参数列表
+```
+
+该脚本通过 USB HID 特性报告 `0xF6`/`0xF7`/`0xF8`/`0xF9` 与固件通信 —— 在 Linux、macOS、Windows 的任何终端下都可用，与你用哪个浏览器无关。移植自 [loteran/DS5Dongle](https://github.com/loteran/DS5Dongle) 并为本分支的 `current_slot` 字段做了扩展。
+
+**DualSense 手柄按键（旧式后备方案，无 OLED、无 CLI）：**
+
+### 麦克风音量
+
+控制触感增益倍率。范围：`[1.0 – 2.0]`。
+
+### 扬声器静音
+
+禁用 LED 连接指示灯。手柄重连后生效。
+
+### 麦克风静音
+
+禁用静默断连行为。
+
+## 注意事项
+
+只有在手柄连接之后，Pico 设备才会对系统可见
+
+某些行为需要经过重连周期才会生效
+
+### 低电量 LED 指示
+
+当所连 DualSense 报告其电量等于或低于 10%（且未在充电）时，Pico 板载 LED 会从常亮切换为 1 Hz 闪烁，让你一眼看到警告。一旦手柄插上充电或其报告电量回升，LED 恢复常亮。即使设置了 `disable_pico_led`，该闪烁也会触发 —— 该警告被视为关键，会覆盖 LED 关闭偏好；电量恢复或手柄开始充电后，LED 回到其禁用（熄灭）状态。
+
+如需在编译期退出此功能，用 `-DENABLE_BATT_LED=OFF` 配置。默认为 ON。
+
+## 蓝牙 DualSense 麦克风
+
+**DualSense 的内置麦克风可通过适配器的蓝牙配对工作**（自 v0.6.8 起）。手柄将麦克风以 Opus 音频流式传输；适配器解码后作为标准 DualSense USB 采集设备呈现给主机，因此任何应用（Discord、OBS、游戏内语音）都能像普通麦克风一样使用它。
+
+这一度被认为不可能实现 —— 本分支早期版本曾将其记录为索尼固件的硬性限制（Linux 的 `hid-playstation` 内核驱动至今仍不支持）。结果发现它取决于适配器外发音频报告中的一个使能位。**完全归功于 [awalol](https://github.com/awalol/DS5Dongle)（上游）发现了它。** 更正后的调查记录见 [BLUETOOTH_AUDIO_NOTES.md](./BLUETOOTH_AUDIO_NOTES.md)。
+
+**使用方法：**
+
+- **默认开启。** 配对手柄后一两秒内麦克风便开始流式传输 —— 无需游戏音频（适配器会自行保活该流）。
+- **在主机端调高采集音量** —— 它默认很低。在 Linux 上，用 `arecord -l` 找到声卡，然后例如 `amixer -c <DualSense 声卡> sset 'Headset' 90%`。用 `scripts/mic_diag.sh capture` 验证采集。
+- **关闭它以节省手柄电量** —— OLED **设置 → BT Mic**，或[网页配置工具](#️-网页配置工具)中的 **BT microphone** 开关。常开麦克风会让 DS5 的音频子系统保持唤醒，明显加快耗电，所以不用语音时请关闭。
+
+**注意点：**
+
+- 麦克风音频为**单声道**（解码为单声道，在立体声采集端点上复制）。
+- 会话中途关闭会立即停止主机端的馈送，但手柄会持续流式传输直到下次重连（目前没有已知的"停止"命令）；以关闭状态全新连接则永远不会启用它。
+- OLED **诊断**屏幕的 `Mic in:` 计数器在麦克风流式传输时约为 ~100/s —— 是确认它在工作的快捷方式。
+- **丢包隐藏：** 丢失的麦克风帧（蓝牙链路弱、距离远、干扰）会用 Opus PLC 隐藏，使语音保持连续而不卡顿/中断，代价是少量抖动缓冲延迟（~30 ms）。诊断屏的 `Mic PLC:` 计数器仅在隐藏帧时增长 —— 实质上是一个实时链路质量计。
+
+## 已知问题
+
+- 超频到 320 MHz @ 1.20 V 是稳定蓝牙配对所**必需**的。把电压降到 1.10 V 或时钟降回默认会破坏 CYW43 PIO SPI 总线，蓝牙将停止工作。持续游玩时建议在 RP2350 上加小散热片。
+- 在 Linux + Steam 上，HD 触感未必在每个游戏中都触发；这是游戏侧问题（部分作品仅在 Windows 专用 API 下发送 HD 触感音频）。在《漫威蜘蛛侠：重制版》中测试可用；在《对马岛之魂》中未送达 —— 同一固件、同一手柄。
+- **USB 3.0 端口可能干扰配对** —— 手柄可能卡在常亮的琥珀/黄色灯条上始终连不上，而同一适配器在 USB 2.0 端口上工作正常。这是射频干扰，并非固件 bug；见下文 [USB 3.0 端口与蓝牙干扰](#usb-30-端口与蓝牙干扰)。（自 v0.6.8 起，固件会自动重试卡住的连接而不是一直挂着，能恢复许多 —— 但非全部 —— 边缘情况。）
+
+## USB 3.0 端口与蓝牙干扰
+
+如果适配器在某个端口能用而在另一个不能用，**请先试试 USB 2.0 端口。** USB 3.0 端口（尤其是 USB 3.0 延长线）会发出以 2.4 GHz 附近为中心的宽带射频噪声 —— 正是适配器蓝牙电台与手柄通信所用的频段。这是业界有充分记录的问题（Intel，*"USB 3.0 Radio Frequency Interference Impact on 2.4 GHz Wireless Devices"*），并非本固件特有。该噪声会降低适配器蓝牙接收机的灵敏度，于是手柄可以开始连接（琥珀灯条）但链路太吵无法完成 —— 卡在黄色上。
+
+缓解措施，大致按效果排序：
+
+1. **把适配器插到 USB 2.0 端口**（往往是最简单的修复 —— 许多主板/机箱两者都有）。
+2. **用一根短的 USB 2.0 延长线** 让适配器离 USB 3.0 端口/金属机箱几英寸远，改善对手柄的视线。要特别避免 USB 3.0 延长线。
+3. **使用插在 USB 3.0 端口上的有源 USB 2.0 集线器** —— 集线器会把链路降速并增加距离。
+4. **在靠近适配器处的线缆上夹一个磁环。**
+5. **配对时让手柄更靠近 / 与适配器保持视线。**
+
+固件会自行持续重试卡住的连接，因此灯条变琥珀后让它插着等约 10–20 秒，也许无需拔插即可恢复。
+
+## 性能 / 超频
+
+**你无需为此做任何事 —— 超频已内置在固件中。** 当你刷入本仓库的 UF2 时，Pico 2 W 会自动以下列设置启动。没有单独要运行的工具、没有要编辑的配置文件、没有要烧的熔丝。
+
+内置设置：
+
+- **电压：1.20 V**（`vreg_set_voltage(VREG_VOLTAGE_1_20)`）
+- **时钟：320 MHz**（`set_sys_clock_khz(SYS_CLOCK_KHZ, true)`）
+
+为何必需：在默认时钟/电压下，CYW43 PIO SPI 总线（固件用来与板载蓝牙芯片通信的通路）不可靠，配对会失败。320 MHz @ 1.20 V 是我们验证过能在本板上产生稳定蓝牙链路的最低组合。
+
+如果你自己编译的构建无法启动（不常见 —— 仅当你改过源码时才相关），可尝试在 `src/main.cpp` 中略微提高电压或降低时钟。运行官方 UF2 发布版的最终用户无需改动此处。
+
+持续游玩**建议**在 RP2350 上加小散热片，但配对或短时使用并不需要。
+
+## 编译说明
+
+从源码编译本项目：
+
+1. 安装 Pico SDK 2.2.0（或更新版本）。编译使用 `pico_sdk_import.cmake`。
+2. **在 Pico SDK 内将 TinyUSB 固定到 0.20.0**（`$PICO_SDK_PATH/lib/tinyusb`）。本项目的 `tusb_config.h` 使用了 `TUD_AUDIO_EP_SIZE` 的四参数形式，而 Pico SDK 2.2.0 捆绑的 0.18.0 版本没有它：
+   ```bash
+   cd "$PICO_SDK_PATH/lib/tinyusb"
+   git fetch --tags
+   git checkout 0.20.0
+   ```
+3. 用 CMake + Ninja（或 Make）配置并编译：
+   ```bash
+   cd /path/to/DS5Dongle
+   cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DPICO_SDK_PATH="$PICO_SDK_PATH"
+   cmake --build build --target ds5-bridge
+   ```
+4. UF2 会生成在 `build/ds5-bridge-oled.uf2`。照常用 BOOTSEL 刷写。
+
+值得了解的编译标志：
+
+- `-DENABLE_BATT_LED=ON`（默认）—— DS5 低电量时闪烁 Pico LED。
+- `-DENABLE_SERIAL=ON` —— 将 printf 路由到 USB CDC 用于调试（默认 OFF；生产构建释放 UART）。
+- `-DPICO_W_BUILD=ON` —— 为原版 Pico W 编译（去掉音频、降低时钟）。默认面向 Pico 2 W。
+
+## 诊断与调试工具
+
+排查桥接问题有两种方式 —— 设备端通过 OLED 诊断屏幕，主机端通过 `scripts/mic_diag.sh`（Linux）。主机端更快：无需切屏、无需刷写周期，可在手柄正在使用时运行。
+
+```
+# 一次性快照 —— 适配器在 USB 上吗？ALSA 枚举到了吗？采集流在跑吗？当前有手柄配对吗？
+scripts/mic_diag.sh status
+
+# 对麦克风 IN 端点做 3 秒 arecord —— 报告峰值 / RMS / 非零计数，
+# 以便区分"流是静音的"和"流在产生音频"。
+scripts/mic_diag.sh capture 3
+
+# 同 `status` 但循环运行，仅在状态变化时打印。可用于
+# 捕捉配对完成或音频流开/关的确切时刻。
+scripts/mic_diag.sh watch
+
+# 实时读取固件的 0xFD 厂商特性报告（经由 /dev/hidraw）：
+# 蓝牙输入计数与速率、最近见到的非 0x31 ID、字节前缀，以及
+# 扳机流计数器（收到的主机 0x02 / 置了 AllowTriggerFFB 的 /
+# 转发到蓝牙的）。bt-trace 会给出结论 —— "主机驱动没有发送
+# 扳机 Allow 位" 还是 "已转发但手柄未触动" —— 这原本需要
+# USB 协议分析仪才能判断。
+scripts/mic_diag.sh bt-trace
+```
+
+最初是为排查被搁置的 DS5 蓝牙麦克风调查而写的（见 [BLUETOOTH_AUDIO_NOTES.md](./BLUETOOTH_AUDIO_NOTES.md)）。`0xFD` 特性报告与 `bt-trace` 解码器现在还携带为 [issue #3](https://github.com/MarcelineVPQ/DS5Dongle-OLED-Edition/issues/3)（部分游戏缺少自适应扳机张力）新增的扳机流计数器。
+
+## OLED 显示插件（可选）
+
+如果你把 [Waveshare Pico-OLED-1.3](#硬件) 插到 Pico2W 的排针上，固件会自动将其作为实时状态显示屏驱动。无需任何配置 —— 没有 OLED 时固件会优雅地不做动作。
+
+### 开机启动画面（上电后 1.5 秒）
+
+空屏居中显示固件版本 1.5 秒，然后跳转到状态屏幕。
+
+### 11 个屏幕，用插件上的 KEY0 循环
+
+循环顺序：**状态 → 配对槽 → 灯条 → 扳机测试 → 陀螺仪倾斜 → 触摸板 → 诊断 → CPU/时钟 → 蓝牙信号 → VU 表 → 设置 →** 回绕。**短按 KEY0 前进；短按 KEY1 后退** —— 在*每个*屏幕上都如此。各屏幕内的交互（循环扳机预设、循环灯条模式、移动设置光标、切换槽）都放在 **DualSense 手柄按键**上，绝不放在 KEY0/KEY1 上，因此 OLED 插件上这两个物理按键始终表示同一含义。
+
+每个屏幕还会在左上边缘（KEY0 旁）画 **`>`**、在左下边缘（KEY1 旁）画 **`<`**，让屏上标签与按键在物理上配对。
+
+#### 1. 状态
+
+连接状态、已配对 DualSense 的蓝牙地址、带条形的电量百分比（`+` 充电中 / `*` 已充满 / `!` 错误）、实时摇杆位置、方向键、面板按键（△ ◯ ✕ □）、L1/R1，以及 L2/R2 模拟扳机填充条。链路指示与电量使用小像素图标。
+
+<img src="./assets/oled/oled_sc01.jpg" alt="Status screen on the OLED" width="420">
+
+#### 2. 配对槽
+
+持久化 4 槽多手柄配对。浏览已存手柄、切换活动槽，或清除单个槽。`>` 是光标，`*` 标记当前活动槽。
+
+<img src="./assets/oled/oled_sc02.jpg" alt="Slots screen on the OLED" width="420">
+
+- **方向键 ▲▼** —— 在槽 0–3 间移动光标
+- **△** —— 切换到光标所在槽（断开当前，重连到该槽存储的手柄）
+- **□ 按住 1.5 秒** —— 清除光标所在槽（删除 bd_addr + BTstack 链路密钥）
+- 活动槽会被持久化；适配器下次开机时重连到它
+
+#### 3. 灯条调色器
+
+在各轴上倾斜手柄来调出 R / G / B；固件以 10 Hz 把得到的颜色发送到 DualSense 实际的灯条，因此灯条本身就是可视预览（OLED 是单色的）。
+
+<img src="./assets/oled/oled_sc03.jpg" alt="Lightbar color picker on the OLED" width="420">
+
+- 在手柄上按 **△ ◯ ✕ □** 把当前颜色**保存**到收藏槽 0 / 1 / 2 / 3
+- 在手柄上按 **R1** 循环模式标签：`[LIVE]` → `[FAV0]` → `[FAV1]` → `[FAV2]` → `[FAV3]` → 特效（呼吸 / 彩虹 / 渐变）→ 回到 `[LIVE]`
+- 默认收藏：红、绿、蓝、白
+
+#### 4. 扳机测试
+
+在手柄上按 **△** 循环七种应用到 L2 和 R2 的自适应扳机效果。扣动各扳机来感受效果。
+
+<img src="./assets/oled/oled_sc04.jpg" alt="Trigger Test screen on the OLED" width="420">
+
+循环顺序：**关 → 反馈 → 武器 → 振动 → 弓 → 疾驰 → 机枪 → 关 …** 效果参数依据 [dualsensectl](https://github.com/nowrep/dualsensectl) 的逆向工程按位打包，全部为最大强度。
+
+#### 5. 陀螺仪倾斜
+
+实时 X/Y/Z 加速度计数值，配 40×40 十字准线框。倾斜手柄，点会实时跟随。
+
+<img src="./assets/oled/oled_sc05.jpg" alt="Gyro Tilt screen on the OLED" width="420">
+
+#### 6. 触摸板
+
+触摸板表面的实时渲染。当前手指位置处出现圆点；计数随手指触碰/离开而更新。
+
+<img src="./assets/oled/oled_sc06.jpg" alt="Touchpad screen on the OLED" width="420">
+
+#### 7. 诊断
+
+可滚动的实时计数器列表 —— 运行时间、蓝牙状态、主机 → 蓝牙扳机流（`host02` / `trig` / `tx`）、蓝牙 0x31 输入速率、USB 音频帧/秒、蓝牙 0x32 包/秒，底部还有被搁置的麦克风调查计数器。手柄方向键 ▲/▼ 滚动；右边缘的小 `^` / `v` 标记"上方/下方还有更多"。只读，所以没有光标。无需 UART 线即可验证桥接器在搬运字节。
+
+同一批计数器也通过 HID 特性报告 `0xFD` 导出给主机端工具 —— 见下文 `scripts/mic_diag.sh bt-trace`。
+
+<img src="./assets/oled/oled_sc07.jpg" alt="Diagnostics screen on the OLED" width="420">
+
+#### 8. CPU / 时钟
+
+实时 RP2350 指标：配置的（`Set`）与实际运行的（`Real`）系统时钟（以晶振参考测量）、从稳压器回读的核心电压，以及片上温度（256 次采样平均 + 慢速 EMA，使数值跟踪真实芯片温度而非 ADC 噪声）。
+
+<img src="./assets/oled/oled_sc08.jpg" alt="CPU / Clock diagnostics screen on the OLED" width="420">
+
+同样的遥测也通过 HID 特性报告 `0xFC` 导出给工具。
+
+#### 9. 蓝牙信号
+
+活动链路的实时蓝牙信号强度，以 dBm 显示并带条形。越接近 0 dBm 越强；−90 dBm 为弱。含定性标签（差 / 一般 / 好 / 极佳）。
+
+<img src="./assets/oled/oled_sc09.jpg" alt="BT Signal screen on the OLED" width="420">
+
+#### 10. VU 表
+
+扬声器与触感音频路径的实时峰值表。可在手柄未插入主机时验证音频路由。
+
+<img src="./assets/oled/oled_sc10.jpg" alt="VU Meters screen on the OLED" width="420">
+
+#### 11. 设置
+
+持久化配置编辑器。方向键 ▲▼ 移动选择，▶◀ 调整数值，△ 保存到闪存。包含固件配置字段（振动增益、扬声器音量、空闲超时、轮询率）、音频自动触感控件，以及两个按住确认的操作：
+
+<img src="./assets/oled/oled_sc11.jpg" alt="Settings screen on the OLED" width="420">
+
+- **AutoHap Off / Fallback / Mix / Replace** —— 选择音频自动触感模式。默认 `Fallback` 仅在游戏不发送原生触感数据时（如 Linux 上的《对马岛之魂》）才触发派生震动；确实发送原生触感的游戏（《漫威蜘蛛侠：重制版》）则原样通过。`Mix` 在原生之上叠加派生，`Replace` 完全忽略原生，`Off` 禁用。
+- **AH Gain N%** —— 派生信号增益，0–200%，10% 步进。默认 100%。
+- **AH LP 80/160/250/400 Hz** —— 在包络跟随之前应用到扬声器音频的低通截止。越低越偏重低音，越高越偏临场感。默认 160 Hz。
+- **Reset to defaults** —— 按住 △ 2 秒恢复所有配置字段
+- **Wipe all slots** —— 按住 △ 2 秒删除全部 4 个已配对手柄 + 全部 BTstack 链路密钥
+
+### 按键参考
+
+OLED 插件上的两个物理按键**严格用于导航**：
+
+| 按键 | 动作 |
+|---|---|
+| **KEY0** 短按 | 下一屏（前进） |
+| **KEY1** 短按 | 上一屏（后退） |
+| **KEY1** 长按（≥ 1.5 秒） | 循环 OLED 亮度等级 |
+| **KEY0 + KEY1** 同时按住 ≥ 1 秒 | `watchdog_reboot` —— 无需拔 USB 的软重启 |
+
+各屏幕内的状态变更（循环扳机预设、循环灯条模式、移动设置光标、切换槽、把颜色保存到收藏槽）全部发生在 **DualSense 手柄按键**上 —— 绝不在 KEY0 / KEY1 上 —— 因此这两个物理按键在每个屏幕上始终表示同一含义。各按键对应哪个手柄操作，见上文每个屏幕的小节。
+
+### 引脚定义（标准 Waveshare Pico HAT 布局）
+
+| 功能 | GPIO |
+|---|---|
+| MOSI | 11 |
+| SCK  | 10 |
+| CS   | 9  |
+| DC   | 8  |
+| RST  | 12 |
+| KEY0 | 15 |
+| KEY1 | 17 |
+
+### 软重启恢复
+
+两种无需拔 USB 重启适配器的方式 —— 配对卡住或想要干净状态时很方便：
+
+- **OLED 上同时按住 KEY0 + KEY1 ≥ 1 秒** → `watchdog_reboot`。取代了早期版本的"KEY0 双击"手势，因为快速前进导航总会误触双击计时器。
+- **按住 DualSense 的 `PS + Mute` 2 秒** → `watchdog_reboot`（无论是否装有 OLED 都可用 —— 无界面后备）。
+
+## 致谢
+
+本分支中的部分功能与设计思路借鉴自上游的其他分支，并予以致谢：
+
+- **[zurce/DS5Dongle-OLED](https://github.com/zurce/DS5Dongle-OLED)** —— OLED 状态头部的像素图标（视觉方案）、设置屏 "Reset to defaults" 项使用的"按住以恢复出厂"交互模式（按住 △ 2 秒确认），以及新增配对槽屏上的多槽持久化蓝牙配对系统（4 个已绑定手柄、方向键导航、△ 切换槽、□ 按住清除某槽，外加设置菜单中的 "Wipe all slots"）。
+- **[loteran/DS5Dongle](https://github.com/loteran/DS5Dongle)** —— 独立地重新发现了上游 `3a31bd7` 破坏扬声器/HD 触感输出的回归（提交 `c7a8d3c`）；我们 `src/audio.cpp` 中的修复恢复了同样的 SetStateData 子报告。也是音频自动触感 DSP（1 极点 LP + 包络跟随器，见 设置 → Auto Haptics）以及"不要把 USB 侧 UAC1 音量同步到持久化配置"修复的来源。
+- **[awalol/ds5dongle-config-web](https://github.com/awalol/ds5dongle-config-web)** —— 我们分支版网页配置应用 [MarcelineVPQ/DS5Dongle-OLED-Config-Web](https://github.com/MarcelineVPQ/DS5Dongle-OLED-Config-Web) 的基础。该分支把上游的 Config_body 布局适配为我们的版本，并为我们的新增功能（多槽配对、Auto Haptics）添加了 UI。
+- **[PS5 Button Icons and Controls](https://zacksly.itch.io/ps5-button-icons-and-controls)**（作者 **Zacksly**）—— 网页配置工具重映射标签页所用的 DualSense 控制器轮廓与按键图标，采用 [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/) 授权（已重新着色为 `currentColor` 并裁剪以适配主题）。
+
+## 路线图
+- 请查看 [DS5Dongle plan](https://github.com/users/awalol/projects/5)
+
+## 社区
+- 加入 Discord 服务器：[Discord Server](https://discord.gg/hM4ntchGCa)
+- 如果你遇到 bug，请改为开 issue。
+
+## 参考
+- [rafaelvaloto/Pico_W-Dualsense](https://github.com/rafaelvaloto/Pico_W-Dualsense) —— 项目灵感
+- [egormanga/SAxense](https://github.com/egormanga/SAxense) —— 蓝牙触感 POC
+- [https://controllers.fandom.com/wiki/Sony_DualSense](https://controllers.fandom.com/wiki/Sony_DualSense) —— DualSense 数据报告结构文档
+- [Paliverse/DualSenseX](https://github.com/Paliverse/DualSenseX) —— 扬声器报告数据包
@@ -18,6 +18,7 @@ The web tool is a one-stop shop — **no installs, no command line, no `picotool

  > **What is BOOTSEL mode?** It's the Pico's built-in flashing mode. To enter it: press and hold the small white button labeled **BOOTSEL** on the Pico, *then* plug the USB cable in (or, if it's already plugged in, briefly disconnect and reconnect while holding BOOTSEL). The Pico will appear to your computer as a removable drive — that's how you know it's in BOOTSEL mode. After the web tool flashes the firmware, the Pico auto-reboots into normal mode and is ready to use.
 - **Config tab** — once the dongle is flashed and reconnected, edit haptics gain, speaker volume, polling rate, audio auto-haptics mode, and the rest of the persistent settings; save to the dongle's flash with one click. Powered by WebHID.
+- **Remap tab** — visual button remapper: click a button on a live DualSense diagram to reassign it to any other (the shoulders/triggers float to the corners as labeled glyphs). The map is stored on the dongle and applied before the host sees the report, so it works in every game and on every OS. Powered by WebHID.
 - **OLED Preview tab** — pixel-perfect emulation of all 11 OLED screens. Use the in-page KEY0/KEY1 buttons (or the controller's △ / R1 / D-pad when a DualSense is paired) to navigate. Adaptive triggers actually fire on the controller when you cycle the Trigger Test preset.

 Works in any Chromium-based browser (Chrome, Edge, Brave, Opera). Firefox + Safari don't expose WebHID or WebUSB, so flashing and live config aren't available there — the OLED Preview still renders with mock data.
@@ -43,6 +44,7 @@ This project enables the Raspberry Pi Pico2W to function as a Bluetooth bridge f
 **OLED Edition additions:**

 - Optional Pico-OLED-1.3 status display with **11 screens** (status, slots, lightbar, trigger test, gyro tilt, touchpad, diagnostics, CPU/clock, RSSI, VU meters, settings)
+- **Button remapping** — reassign any of the 16 digital controls (face buttons, D-pad, shoulders/triggers, stick clicks, Create/Options) to any other. Stored on the dongle and applied before the host sees the report, so it works in **every game and OS with no host-side software**; identity (no remap) is the default. Edit it visually in the [web config tool](#️-web-config-tool)'s **Remap tab**, or headlessly via `scripts/remap_test.py`. Persisted in its own flash sector, survives reboot.
 - **4-slot persistent multi-controller pairing** — bond up to four DualSenses, switch between them from the OLED, slot 0 reconnects automatically on boot
 - **Lightbar color picker** with 4 user favorite slots + breathing / rainbow / fade effect presets
 - **Persistent settings menu** for the 8 firmware config fields (haptics gain, speaker volume, polling rate, etc.) with hold-to-confirm Reset and Wipe-all-slots actions
@@ -140,11 +142,44 @@ When the connected DualSense reports its battery at or below 10% (and it is not

 To opt out at build time, configure with `-DENABLE_BATT_LED=OFF`. Default is ON.

+## DualSense Microphone over Bluetooth
+
+**The DualSense's built-in microphone works over the dongle's Bluetooth pairing** (since v0.6.8). The controller streams its mic as Opus audio; the dongle decodes it and presents it to the host as the standard DualSense USB capture device, so any app (Discord, OBS, in-game voice) can use it like a normal microphone.
+
+This was long believed impossible — earlier versions of this fork documented it as a hard Sony-firmware limitation (and the Linux `hid-playstation` kernel driver still doesn't support it). It turned out to hinge on a single enable bit in the dongle's outbound audio report. **Full credit to [awalol](https://github.com/awalol/DS5Dongle) (upstream) for identifying it.** The corrected investigation log lives in [BLUETOOTH_AUDIO_NOTES.md](./BLUETOOTH_AUDIO_NOTES.md).
+
+**Using it:**
+
+- **On by default.** Pair the controller and the mic begins streaming within a second or two — no game audio required (the dongle keeps the stream alive on its own).
+- **Raise the capture volume on the host** — it defaults low. On Linux, find the card with `arecord -l`, then e.g. `amixer -c <DualSense card> sset 'Headset' 90%`. Verify capture with `scripts/mic_diag.sh capture`.
+- **Toggle it off to save controller battery** — OLED **Settings → BT Mic**, or the **BT microphone** switch in the [web config tool](#web-config-tool). Always-on mic keeps the DS5's audio subsystem awake, which drains its battery noticeably faster, so disable it if you don't use voice.
+
+**Caveats:**
+
+- Mic audio is **mono** (decoded mono, duplicated across the stereo capture endpoint).
+- Toggling off mid-session stops the host feed immediately, but the controller keeps streaming until it next reconnects (there's no known "stop" command); connecting fresh with the toggle off never enables it.
+- The OLED **Diagnostics** screen's `Mic in:` counter reads ~100/s while the mic is streaming — a quick way to confirm it's live.
+- **Packet-loss concealment:** dropped mic frames (weak BT link, distance, interference) are concealed with Opus PLC so voice stays continuous instead of clicking/cutting out, at a small jitter-buffer latency (~30 ms). The Diag screen's `Mic PLC:` counter climbs only when frames are being concealed — effectively a live link-quality gauge.
+
 ## Known Issues

 - Overclocking to 320 MHz @ 1.20 V is **required** for stable BT pairing. Dropping voltage to 1.10 V or clock to stock breaks the CYW43 PIO SPI bus and BT stops working. A small heatsink on the RP2350 is recommended for sustained gameplay.
 - HD haptics may not fire in every game on Linux + Steam; this is game-side (some titles only send HD-haptic audio under Windows-specific APIs). Tested working in Spider-Man Remastered; not delivered in Ghost of Tsushima — same firmware, same controller.
- **DualSense microphone does not work over the Bluetooth pairing.** This is a Sony / DS5-firmware-side limitation also documented in the upstream Linux kernel driver (`drivers/hid/hid-playstation.c` line ~1509: *"Bluetooth audio is currently not supported"*). The mic works fine when the controller is connected directly to the host via USB-C. See [BLUETOOTH_AUDIO_NOTES.md](./BLUETOOTH_AUDIO_NOTES.md) for the full investigation log + what's already wired firmware-side if a future contributor cracks the BT-side trigger.
+- **USB 3.0 ports can disrupt pairing** — the controller may get stuck on a solid amber/yellow lightbar and never connect, while the same dongle works fine on a USB 2.0 port. This is RF interference, not a firmware bug; see [USB 3.0 ports & Bluetooth interference](#usb-30-ports--bluetooth-interference) below. (As of v0.6.8 the firmware auto-retries a stalled connection instead of hanging, which recovers many — but not all — marginal cases.)
+
+## USB 3.0 ports & Bluetooth interference
+
+If the dongle works on one port but not another, **try a USB 2.0 port first.** USB 3.0 ports and (especially) USB 3.0 extension cables emit broadband RF noise centered near 2.4 GHz — the same band the dongle's Bluetooth radio uses to talk to the controller. This is a well-documented industry issue (Intel, *"USB 3.0 Radio Frequency Interference Impact on 2.4 GHz Wireless Devices"*), not specific to this firmware. The noise desensitizes the dongle's BT receiver, so the controller can start connecting (amber lightbar) but the link is too noisy to complete — it hangs on yellow.
+
+Mitigations, roughly in order of effectiveness:
+
+1. **Plug the dongle into a USB 2.0 port** (often the simplest fix — many motherboards/cases have both).
+2. **Use a short USB 2.0 extension cable** to get the dongle a few inches away from the USB 3.0 ports / metal chassis, improving line-of-sight to the controller. Avoid USB 3.0 extension cables specifically.
+3. **Use a powered USB 2.0 hub** plugged into the USB 3.0 port — the hub downshifts the link and adds distance.
+4. **Clip a ferrite bead** onto the cable near the dongle.
+5. **Keep the controller closer / in line of sight** of the dongle during pairing.
+
+The firmware will keep retrying a stalled connection on its own, so leaving it plugged in for ~10–20 s after the lightbar goes amber may let it recover without a replug.

 ## Performance / Overclocking

@@ -0,0 +1,139 @@
+#!/usr/bin/env python3
+"""
+Host-side dev helper to exercise the firmware button-remap path over the
+already-declared 0xF6 (SET) / 0xF7 (GET) vendor feature reports — no web tool
+needed. Linux only (reads /dev/hidraw directly), same role as mic_diag.sh.
+
+The remap rides 0xF6/0xF7 with a magic+version frame (see src/cmd.cpp):
+  SET 0xF6: [func=0x10]['R']['M'][ver][table[16]]
+  GET 0xF7: <Config_body(35)> ['R']['M'][ver][rev_lo][rev_hi][table[16]]
+
+Usage:
+  remap_test.py get                 # show revision + current table
+  remap_test.py swap CIRCLE CROSS   # swap two buttons (and persist)
+  remap_test.py set SRC TGT         # route SRC -> TGT (one-way)
+  remap_test.py off SRC             # disable SRC (0xFF)
+  remap_test.py reset               # identity (no remap)
+
+Run with sudo if /dev/hidraw needs root.
+"""
+import fcntl, glob, struct, sys
+
+VID, PID = 0x054c, 0x0ce6
+CONFIG_LEN = 35          # sizeof(Config_body), see src/config.h
+PROTO_VER = 1            # kRemapProtoVer
+COUNT = 16               # kRemapCount
+
+# Must match RemapButton order in src/remap.cpp.
+NAMES = ["L2", "L1", "CREATE", "DPAD_UP", "DPAD_LEFT", "DPAD_DOWN",
+         "DPAD_RIGHT", "L3", "R2", "R1", "OPTIONS", "TRIANGLE",
+         "CIRCLE", "CROSS", "SQUARE", "R3"]
+IDX = {n: i for i, n in enumerate(NAMES)}
+
+
+def hidiocg(size):  # HIDIOCGFEATURE(size)
+    return (3 << 30) | (size << 16) | (ord('H') << 8) | 0x07
+
+
+def hidiocs(size):  # HIDIOCSFEATURE(size)
+    return (3 << 30) | (size << 16) | (ord('H') << 8) | 0x06
+
+
+def read_f7(f):
+    """Return (rev, table[16]) or None if the response lacks the remap block."""
+    size = 64  # 1 report-id byte + up to 63 payload
+    buf = bytearray(size)
+    buf[0] = 0xF7
+    fcntl.ioctl(f, hidiocg(size), buf)
+    payload = bytes(buf[1:])  # kernel prepends report id at byte 0
+    blk = payload[CONFIG_LEN:CONFIG_LEN + 5 + COUNT]
+    if len(blk) < 5 + COUNT or blk[0] != ord('R') or blk[1] != ord('M'):
+        return None
+    ver = blk[2]
+    rev = blk[3] | (blk[4] << 8)
+    table = list(blk[5:5 + COUNT])
+    return ver, rev, table
+
+
+def find_dongle():
+    for path in sorted(glob.glob('/dev/hidraw*')):
+        try:
+            f = open(path, 'rb+', buffering=0)
+        except (OSError, PermissionError):
+            continue
+        try:
+            if read_f7(f) is not None:
+                return f, path
+        except OSError:
+            pass
+        f.close()
+    return None, None
+
+
+def write_table(f, table):
+    assert len(table) == COUNT
+    payload = bytes([0xF6, 0x10, ord('R'), ord('M'), PROTO_VER]) + bytes(table)
+    buf = bytearray(payload)
+    fcntl.ioctl(f, hidiocs(len(buf)), buf)
+
+
+def show(label, ver, rev, table):
+    print(f"{label}: proto v{ver}, revision {rev}")
+    active = [(s, t) for s, t in enumerate(table) if t != s]
+    if not active:
+        print("  identity (no remap active)")
+        return
+    for s, t in active:
+        tn = "DISABLED" if t == 0xFF else NAMES[t]
+        print(f"  {NAMES[s]:<10} -> {tn}")
+
+
+def parse_button(arg):
+    key = arg.upper()
+    if key not in IDX:
+        sys.exit(f"unknown button '{arg}'. choices: {', '.join(NAMES)}")
+    return IDX[key]
+
+
+def main():
+    if len(sys.argv) < 2:
+        print(__doc__)
+        sys.exit(2)
+    cmd = sys.argv[1].lower()
+
+    f, path = find_dongle()
+    if f is None:
+        sys.exit("no DS5 dongle with remap support found "
+                 "(check /dev/hidraw permissions and firmware version)")
+    print(f"dongle: {path}")
+    ver, rev, table = read_f7(f)
+
+    if cmd == "get":
+        show("current", ver, rev, table)
+        return
+
+    if cmd == "reset":
+        table = list(range(COUNT))
+    elif cmd == "off" and len(sys.argv) == 3:
+        table[parse_button(sys.argv[2])] = 0xFF
+    elif cmd == "set" and len(sys.argv) == 4:
+        table[parse_button(sys.argv[2])] = parse_button(sys.argv[3])
+    elif cmd == "swap" and len(sys.argv) == 4:
+        a, b = parse_button(sys.argv[2]), parse_button(sys.argv[3])
+        table[a], table[b] = b, a
+    else:
+        print(__doc__)
+        sys.exit(2)
+
+    show("writing", ver, rev, table)
+    write_table(f, table)
+    nver, nrev, ntable = read_f7(f)
+    show("read-back", nver, nrev, ntable)
+    if ntable == table and nrev != rev:
+        print("OK: table applied and revision bumped")
+    else:
+        print("WARNING: read-back mismatch or revision did not change")
+
+
+if __name__ == "__main__":
+    main()
@@ -13,6 +13,7 @@
 #include "utils.h"
 #include "pico/multicore.h"
 #include "pico/util/queue.h"
+#include "pico/time.h"
 #include "config.h"
 #include "state_mgr.h"
 #include "usb.h"
@@ -60,6 +61,24 @@ int32_t  audio_mic_last_decoded() { return g_mic_last_decoded; }
 uint16_t audio_mic_last_want()    { return g_mic_last_want; }
 uint16_t audio_mic_last_wrote()   { return g_mic_last_wrote; }

+// Mic jitter buffer + packet-loss concealment. Decoded mono frames land here
+// (filled as Opus arrives, drained at a steady 10 ms playout cadence) so bursty
+// BT delivery is smoothed and a dropped frame is concealed via Opus PLC instead
+// of underrunning the host with a click/hole. Design ported from
+// SundayMoments/DS5_Bridge (credit there). PLC keeps voice continuous on a
+// lossy BT link (e.g. controller moved away, USB 3.0 RF interference).
+struct mic_decoded_element { int16_t mono[MIC_FRAMES]; };
+static queue_t mic_decode_fifo;
+static constexpr int      MIC_DECODE_DEPTH  = 8;       // jitter-buffer capacity (frames)
+static constexpr int      MIC_PLAYOUT_START = 3;       // pre-buffer before playout begins
+static constexpr uint64_t MIC_FRAME_US      = 10000;  // 10 ms per Opus frame @ 48 kHz
+static constexpr uint64_t MIC_SESSION_US    = 300000; // no real frame this long → stop playout
+static bool     mic_playout_started = false;
+static uint64_t mic_next_playout_us = 0;
+static uint64_t mic_last_real_us    = 0;
+static volatile uint32_t g_mic_plc_frames = 0;        // concealed frames generated (Diag)
+uint32_t audio_mic_plc_frames() { return g_mic_plc_frames; }
+
 struct audio_raw_element {
    float data[512 * 2];
 };
@@ -114,35 +133,122 @@ void mic_add_queue(const uint8_t *data) {
    queue_try_add(&mic_fifo, &packet);
 }

+// Re-assert the DS5 mic-enable (pkt[4] bit 0) so the controller streams its mic
+// even when no audio is being output to it. Normally the enable only rides the
+// 0x36 audio frames, which are gated on active USB audio — so without this, mic
+// only works while a game plays sound. The enable is sticky (the DS5 keeps
+// streaming once it starts), so we send a control-only 0x36 (enable + the
+// load-bearing SetStateData sub-report + a silent haptic block, no speaker
+// payload → makes no sound) at ~4 Hz ONLY until mic frames start arriving, then
+// stop — minimizing BT traffic and DS5 battery. Resumes if the stream stalls.
+static void mic_enable_keepalive() {
+    if (!bt_is_connected() || !get_config().bt_mic_enable) return;
+    const uint64_t now = time_us_64();
+    static uint32_t last_frames = 0;
+    static uint64_t last_frame_us = 0;
+    static uint64_t last_send_us = 0;
+    const uint32_t frames = g_mic_frames;
+    if (frames != last_frames) { last_frames = frames; last_frame_us = now; }
+    if (last_frame_us != 0 && (now - last_frame_us) < 1000000ULL) return; // streaming → sticky, no resend
+    if (last_send_us != 0 && (now - last_send_us) < 250000ULL) return;    // throttle to ~4 Hz while arming
+    last_send_us = now;
+
+    uint8_t pkt[REPORT_SIZE]{};
+    pkt[0] = REPORT_ID;
+    pkt[1] = reportSeqCounter << 4;
+    reportSeqCounter = (reportSeqCounter + 1) & 0x0F;
+    pkt[2] = 0x11 | 1 << 7;
+    pkt[3] = 7;
+    pkt[4] = 0b11111111; // mic-enable (bit 0)
+    const auto buf_len = get_config().audio_buffer_length;
+    pkt[5] = pkt[6] = pkt[7] = pkt[8] = pkt[9] = buf_len;
+    pkt[10] = packetCounter++;
+    pkt[11] = 0x10 | 1 << 7; // SetStateData sub-report (load-bearing — keeps actuators alive)
+    pkt[12] = 63;
+    state_set(pkt + 13, 63);
+    pkt[76] = 0x12 | 1 << 7;  // haptic sub-report; samples left zero = silent
+    pkt[77] = SAMPLE_SIZE;
+    // no speaker sub-report (pkt[142..] stays zero) → control-only, no audio out
+    bt_write(pkt, sizeof(pkt));
+    g_bt_packets++;
+}
+
 void audio_loop() {
    // Mic-in path: pull one Opus packet from the BT-side FIFO, decode to
    // mono PCM, duplicate to stereo (our UAC1 endpoint declares 2 channels),
    // push to the host via tud_audio_write. Runs once per loop iteration so
    // it keeps up with the ~100 Hz arrival rate of mic-tagged BT frames.
    if (mic_decoder != nullptr) {
-        static mic_element packet{};
-        if (queue_try_remove(&mic_fifo, &packet)) {
-            static int16_t mono[MIC_FRAMES];
-            const int decoded = opus_decode(mic_decoder, packet.data,
-                                            MIC_OPUS_SIZE, mono, MIC_FRAMES, 0);
-            g_mic_last_decoded = decoded; // observed in OLED Diag
-            if (decoded > 0) {
-                static int16_t stereo[MIC_FRAMES * 2];
-                for (int i = 0; i < decoded; i++) {
-                    stereo[i * 2]     = mono[i];
-                    stereo[i * 2 + 1] = mono[i];
+        const uint64_t now = time_us_64();
+
+        // Decode stage: drain incoming Opus into the jitter buffer as fast as it
+        // arrives (absorbs bursty BT delivery), up to the buffer's capacity.
+        static mic_element pkt{};
+        while (queue_get_level(&mic_decode_fifo) < MIC_DECODE_DEPTH
+               && queue_try_remove(&mic_fifo, &pkt)) {
+            static mic_decoded_element dec{};
+            const int n = opus_decode(mic_decoder, pkt.data, MIC_OPUS_SIZE,
+                                      dec.mono, MIC_FRAMES, 0);
+            g_mic_last_decoded = n; // observed in OLED Diag
+            if (n > 0) {
+                queue_try_add(&mic_decode_fifo, &dec);
+                mic_last_real_us = now;
+            }
+        }
+
+        // Playout stage: emit one frame every 10 ms. Pre-buffer a few frames to
+        // absorb jitter, then play a real frame if buffered, else conceal with an
+        // Opus PLC frame during an active session (transient loss) so the host
+        // hears continuity instead of a hole. If real frames have been gone for a
+        // while (mic off/idle), stop so we don't emit comfort noise forever.
+        if (!mic_playout_started
+            && queue_get_level(&mic_decode_fifo) >= MIC_PLAYOUT_START) {
+            mic_playout_started = true;
+            mic_next_playout_us = now;
+        }
+        if (mic_playout_started && (int64_t)(now - mic_next_playout_us) >= 0) {
+            static mic_decoded_element out{};
+            bool have = queue_try_remove(&mic_decode_fifo, &out);
+            if (!have) {
+                if (now - mic_last_real_us < MIC_SESSION_US) {
+                    const int n = opus_decode(mic_decoder, nullptr, 0,
+                                              out.mono, MIC_FRAMES, 0); // PLC
+                    if (n > 0) { have = true; g_mic_plc_frames++; }
+                } else {
+                    mic_playout_started = false; // session ended — re-buffer next time
                }
-                const uint16_t want = (uint16_t)(decoded * 2 * sizeof(int16_t));
-                const uint16_t wrote = tud_audio_write(stereo, want);
+            }
+            if (have) {
+                static int16_t stereo[MIC_FRAMES * 2];
+                for (int i = 0; i < MIC_FRAMES; i++) {
+                    stereo[i * 2]     = out.mono[i];
+                    stereo[i * 2 + 1] = out.mono[i];
+                }
+                const uint16_t want = (uint16_t)(MIC_FRAMES * 2 * sizeof(int16_t));
+                g_mic_last_wrote = tud_audio_write(stereo, want);
                g_mic_last_want  = want;
-                g_mic_last_wrote = wrote;
                g_mic_frames++;
+                mic_next_playout_us += MIC_FRAME_US;
+                // Drift guard: if we've fallen many frames behind (loop stall),
+                // resync the cadence instead of bursting to catch up.
+                if ((int64_t)(now - mic_next_playout_us) > (int64_t)(4 * MIC_FRAME_US)) {
+                    mic_next_playout_us = now + MIC_FRAME_US;
+                }
            }
        }
    }

    // 1. 读取 USB 音频数据
-    if (!tud_audio_available()) return;
+    if (!tud_audio_available()) {
+        // Keep the DS5 mic streaming even without output audio — but ONLY once
+        // the host has enumerated us (tud_mounted). Running it during the
+        // fresh-pair feature handshake floods BT TX and delays controller-type
+        // detection past the connection watchdog's timeout, which then tears the
+        // link down (~10-15s "shutdown" on fresh pair). After enumeration the
+        // handshake is done, so it's safe — and always-on mic still works.
+        if (tud_mounted()) mic_enable_keepalive();
+        return;
+    }

    int16_t raw[192];
    uint32_t bytes_read = tud_audio_read(raw, sizeof(raw)); // 每次读入 384 bytes
@@ -276,7 +382,10 @@ void audio_loop() {
        reportSeqCounter = (reportSeqCounter + 1) & 0x0F;
        pkt[2] = 0x11 | 0 << 6 | 1 << 7;
        pkt[3] = 7;
-        pkt[4] = 0b11111110;
+        // bit 0 = mic-enable: tells the DS5 to stream its mic over BT (awalol
+        // confirmed this is the key). Bits 1-7 are the pre-existing speaker/
+        // haptic audio-enable flags. Gated on the bt_mic_enable config toggle.
+        pkt[4] = get_config().bt_mic_enable ? 0b11111111 : 0b11111110;
        const auto buf_len = get_config().audio_buffer_length;
        pkt[5] = buf_len;
        pkt[6] = buf_len;
@@ -323,7 +432,8 @@ void audio_init() {

    // Mic path: queue + decoder live on core0 (audio_loop), separate from
    // the core1 speaker encoder. Mic Opus is mono / 48 kHz / 10 ms frames.
-    queue_init(&mic_fifo, sizeof(mic_element), 2);
+    queue_init(&mic_fifo, sizeof(mic_element), MIC_DECODE_DEPTH);          // deeper: tolerate BT bursts
+    queue_init(&mic_decode_fifo, sizeof(mic_decoded_element), MIC_DECODE_DEPTH); // decoded-PCM jitter buffer
    int dec_error = 0;
    mic_decoder = opus_decoder_create(48000, MIC_CHANNELS, &dec_error);
    if (dec_error != 0 || mic_decoder == nullptr) {
@@ -26,6 +26,7 @@ int32_t  audio_mic_last_decoded(); // last opus_decode return — neg = error, 4
 uint16_t audio_mic_last_want();    // bytes asked of tud_audio_write
 uint16_t audio_mic_last_wrote();   // bytes TinyUSB FIFO actually accepted
 uint8_t  audio_mic_last_toc();     // first byte of last Opus packet (frame config)
+uint32_t audio_mic_plc_frames();   // count of packet-loss-concealment frames generated

 // Called from on_bt_data() in main.cpp when the DS5 sends a mic-tagged
 // 0x31 input report. Buffer must point at MIC_OPUS_SIZE (71) bytes of
@@ -26,6 +26,15 @@
 #define MTU_CONTROL 672
 #define MTU_INTERRUPT 672

+// Connection-attempt watchdog: if a connection commits to a device (inquiry
+// found one / incoming request accepted) but doesn't reach USB-enumeration
+// within this window, tear down and retry. Catches the silent stalls caused by
+// USB 3.0 2.4 GHz RF interference on the CYW43 BT radio (DualSense stuck on the
+// amber init lightbar, never enumerates) — see README troubleshooting. A
+// healthy or slow re-pair finishes well under 6 s, so 10 s never trips a real
+// connection but heals before the user reaches to replug.
+#define CONNECT_WATCHDOG_TIMEOUT_US (10 * 1000 * 1000)
+
 using std::unordered_map;
 using std::vector;
 using std::queue;
@@ -54,6 +63,12 @@ struct send_element {

 absolute_time_t inactive_time = 0; // 手柄长时间静默

+// Connection-attempt watchdog timestamp. 0 == not armed; armed == a connection
+// attempt is in flight (committed to a device, not yet USB-enumerating). Set
+// when an attempt begins, cleared the instant the controller type is identified
+// (USB connects) and on every teardown. Checked by bt_connection_watchdog_tick().
+static absolute_time_t connect_attempt_started = 0;
+
 // Multi-slot pairing state. Modeled on zurce/DS5Dongle-OLED.
 static int g_current_slot = 0;

@@ -166,6 +181,35 @@ bool bt_disconnect() {
    return true;
 }

+// Called every main-loop iteration. If a connection attempt has stalled past
+// the timeout, tear it down so the state machine retries instead of hanging
+// (e.g. on the amber lightbar under USB 3.0 RF interference). Inert unless a
+// connection attempt is in flight, so it never touches a healthy session.
+void bt_connection_watchdog_tick() {
+    if (connect_attempt_started == 0) return; // not armed
+    if (absolute_time_diff_us(connect_attempt_started, get_absolute_time())
+            < CONNECT_WATCHDOG_TIMEOUT_US) {
+        return;
+    }
+    printf("[BT] Connection watchdog: attempt stalled, recovering\n");
+    connect_attempt_started = 0; // disarm; the next attempt re-arms
+
+    if (acl_handle != HCI_CON_HANDLE_INVALID) {
+        // ACL is up but setup stalled (auth/encryption/L2CAP/feature-wait).
+        // Route through the proven HCI_EVENT_DISCONNECTION_COMPLETE teardown.
+        bt_disconnect();
+    } else {
+        // No ACL yet (stalled before/at create-connection) — reset by hand
+        // and kick a fresh inquiry.
+        device_found = false;
+        new_pair = false;
+        gap_inquiry_stop();
+        gap_inquiry_start(30);
+        gap_connectable_control(1);
+        update_discoverable();
+    }
+}
+
 void bt_get_signal_strength(int8_t *rssi) {
    // gap_read_rssi() completes asynchronously, so this function can only
    // return the last cached RSSI value. Trigger a refresh afterwards so a
@@ -298,6 +342,7 @@ static void hci_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *p
            if (device_found) {
                printf("[HCI] Connecting to %s...\n", bd_addr_to_str(current_device_addr));
                new_pair = true;
+                connect_attempt_started = get_absolute_time(); // arm connection watchdog
                hci_send_cmd(&hci_create_connection, current_device_addr,
                             hci_usable_acl_packet_types(), 0, 0, 0, 1);
                break;
@@ -317,8 +362,9 @@ static void hci_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *p
            if (opcode == HCI_OPCODE_HCI_CREATE_CONNECTION && status != ERROR_CODE_SUCCESS) {
                device_found = false;
                new_pair = false;
+                connect_attempt_started = 0; // disarm; failed before an ACL existed
                printf("[HCI] Create connection rejected, restart inquiry\n");
-                // gap_inquiry_start(30);
+                gap_inquiry_start(30);
            }
            break;
        }
@@ -350,8 +396,9 @@ static void hci_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *p
            } else {
                device_found = false;
                new_pair = false;
+                connect_attempt_started = 0; // disarm; no ACL was established
                printf("[HCI] ACL connect failed status=0x%02X, restart inquiry\n", status);
-                // gap_inquiry_start(30);
+                gap_inquiry_start(30);
            }
            break;
        }
@@ -401,7 +448,11 @@ static void hci_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *p
            if (status != ERROR_CODE_SUCCESS) {
                printf("[HCI] Authentication failed, drop stored key for %s\n", bd_addr_to_str(current_device_addr));
                gap_drop_link_key_for_bd_addr(current_device_addr);
-                // gap_inquiry_start(30);
+                connect_attempt_started = 0; // disarm; teardown below re-inquires
+                // ACL is still up — route through the clean disconnect path
+                // (HCI_EVENT_DISCONNECTION_COMPLETE restarts inquiry) rather
+                // than leaving a half-open ACL.
+                bt_disconnect();
            } else {
                hci_send_cmd(&hci_set_connection_encryption, handle, 1);
            }
@@ -438,6 +489,7 @@ static void hci_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *p
                bd_addr_copy(current_device_addr, addr);
                gap_inquiry_stop();
                hci_send_cmd(&hci_accept_connection_request, addr, 0x01);
+                connect_attempt_started = get_absolute_time(); // arm watchdog (incoming path)
            }
            break;
        }
@@ -451,6 +503,7 @@ static void hci_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *p
            const uint8_t reason = hci_event_disconnection_complete_get_reason(packet);
            device_found = false;
            new_pair = false;
+            connect_attempt_started = 0; // disarm — every teardown clears here
            acl_handle = HCI_CON_HANDLE_INVALID;
            bt_rssi = 0;
            hid_control_cid = 0;
@@ -508,6 +561,7 @@ static void l2cap_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t
                    printf("Connected DSE Controller\n");
                    check_dse = false;
                    is_dse = true;
+                    connect_attempt_started = 0; // fully up — disarm watchdog
 #if !ENABLE_SERIAL
                    tud_connect();
 #endif
@@ -515,6 +569,7 @@ static void l2cap_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t
                    printf("Connected DS5 Controller\n");
                    check_dse = false;
                    is_dse = false;
+                    connect_attempt_started = 0; // fully up — disarm watchdog
 #if !ENABLE_SERIAL
                    tud_connect();
 #endif
@@ -693,6 +748,11 @@ vector<uint8_t> get_feature_data(uint8_t reportId, uint16_t len) {
    return ret;
 }

+std::vector<uint8_t> bt_peek_feature(uint8_t reportId) {
+    auto it = feature_data.find(reportId);
+    return (it != feature_data.end()) ? it->second : std::vector<uint8_t>{};
+}
+
 void set_feature_data(uint8_t reportId, uint8_t *data, uint16_t len) {
    if (hid_control_cid != 0) {
        uint8_t get_feature[len + 2];
@@ -22,9 +22,18 @@ void bt_send_control(uint8_t *data, uint16_t len);
 void bt_write(const uint8_t *data, uint16_t len);
 void bt_get_signal_strength(int8_t *rssi);
 std::vector<uint8_t> get_feature_data(uint8_t reportId,uint16_t len);
+// Side-effect-free read of an already-cached feature report (empty vector if it
+// hasn't arrived yet). Unlike get_feature_data(), never issues an L2CAP request,
+// so it is safe to poll every frame — used by the OLED IMU-calibration parse.
+std::vector<uint8_t> bt_peek_feature(uint8_t reportId);
 void init_feature();
 void set_feature_data(uint8_t reportId, uint8_t* data,uint16_t len);

+// Connection-attempt watchdog: call once per main-loop iteration. Recovers a
+// stalled connection (auto re-inquiry) so a transient RF glitch — e.g. USB 3.0
+// 2.4 GHz interference — doesn't hang the dongle on the amber lightbar.
+void bt_connection_watchdog_tick();
+
 // OLED add-on accessors.
 bool bt_is_connected();
 void bt_get_addr(uint8_t out[6]);
@@ -14,6 +14,7 @@
 #include "device/usbd.h"
 #include "pico/time.h"
 #include "slots.h"
+#include "remap.h"
 #include "hardware/clocks.h"
 #include "hardware/adc.h"
 #include "hardware/vreg.h"
@@ -86,11 +87,34 @@ bool is_pico_cmd(uint8_t report_id) {
 uint16_t pico_cmd_get(uint8_t report_id, uint8_t *buffer, uint16_t reqlen) {
    if (report_id == 0xf7) {
        printf("[HID] Receive 0xf7 getting config\n");
-        if (sizeof(Config_body) > reqlen) {
+        const size_t cfg_len = sizeof(Config_body);
+        if (cfg_len > reqlen) {
            printf("[Config] Warning: Config_body overflow\n");
        }
-        const auto len = std::min(sizeof(Config_body),static_cast<size_t>(reqlen));
-        memcpy(buffer,&get_config(),len);
+        const auto len = std::min(cfg_len, static_cast<size_t>(reqlen));
+        memcpy(buffer, &get_config(), len);
+
+        // OLED Edition: append the button-remap block right after Config_body
+        // when the host asked for enough room. Old clients request exactly
+        // sizeof(Config_body) and never see it; new web tools read config +
+        // remap in one GET (the 0xF6/0xF7 reports are 63 bytes, plenty).
+        //   [+0]      'R'
+        //   [+1]      'M'
+        //   [+2]      protocol version (kRemapProtoVer)
+        //   [+3..+4]  revision uint16 LE (bumps on each successful set)
+        //   [+5..+20] 16-byte remap table (source idx -> target idx, 0xFF=off)
+        constexpr size_t kRemapBlock = 5 + kRemapCount;
+        if (reqlen >= cfg_len + kRemapBlock) {
+            uint8_t *p = buffer + cfg_len;
+            p[0] = 'R';
+            p[1] = 'M';
+            p[2] = kRemapProtoVer;
+            const uint16_t rev = remap_revision();
+            p[3] = (uint8_t)(rev & 0xFF);
+            p[4] = (uint8_t)((rev >> 8) & 0xFF);
+            remap_get(p + 5);
+            return cfg_len + kRemapBlock;
+        }
        return len;
    }
    if (report_id == 0xf8) {
@@ -268,4 +292,25 @@ void pico_cmd_set(uint8_t report_id, uint8_t const *buffer, uint16_t bufsize) {
        sleep_ms(150);
        tud_connect();
    }
+    // 0x10 set button-remap table (OLED Edition). Hardened framing so a stray
+    // write to 0xF6 can't corrupt the map: magic 'R''M' + protocol version gate
+    // before remap_set() (which itself validates each entry <16 or 0xFF=off).
+    //   [0]      0x10  func-id
+    //   [1]      'R'
+    //   [2]      'M'
+    //   [3]      protocol version (must == kRemapProtoVer)
+    //   [4..19]  16-byte remap table
+    if (buffer[0] == 0x10) {
+        constexpr uint16_t kNeed = 4 + kRemapCount;
+        if (bufsize < kNeed) {
+            printf("[CMD] 0x10 remap-set too short (%u<%u)\n", bufsize, kNeed);
+            return;
+        }
+        if (buffer[1] != 'R' || buffer[2] != 'M' || buffer[3] != kRemapProtoVer) {
+            printf("[CMD] 0x10 remap-set bad magic/version\n");
+            return;
+        }
+        if (remap_set(buffer + 4)) printf("[CMD] remap set ok (rev=%u)\n", remap_revision());
+        else                       printf("[CMD] remap set rejected (invalid table)\n");
+    }
 }
@@ -109,6 +109,10 @@ void config_valid() {
        body->screen_off_timeout = 15;    // mirrors the original 15-min off tier
        printf("[Config] screen_off_timeout invalid, defaulting to 15 min\n");
    }
+    if (body->bt_mic_enable > 1) {        // 0xFF erased / upgrade → default ON
+        body->bt_mic_enable = 1;
+        printf("[Config] bt_mic_enable invalid, defaulting to 1 (on)\n");
+    }
    if (body->config_version != CONFIG_VERSION) {
        body->config_version = CONFIG_VERSION;
        printf("[Config] Warning: Config may breaking change\n");
@@ -39,6 +39,11 @@ struct __attribute__((packed)) Config_body {
    // idle timer is 64-bit µs so the full range is representable. Issue #5.
    uint8_t screen_dim_timeout;
    uint8_t screen_off_timeout;
+    // DualSense mic over Bluetooth (Phase I). 0 = off, 1 = on (default). When on,
+    // the dongle asserts the DS5 mic-enable bit so the controller streams its mic
+    // over BT and the dongle decodes it to the USB capture endpoint. Costs extra
+    // DS5 battery (keeps its audio subsystem awake), hence the toggle.
+    uint8_t bt_mic_enable;
 };

 struct __attribute__((packed)) Config {
@@ -22,6 +22,7 @@
 #include "battery_led.h"
 #endif
 #include "oled.h"
+#include "remap.h"

 // Pico SDK speciifically for waiting on conditions
 #include "pico/critical_section.h"
@@ -118,7 +119,12 @@ void interrupt_loop() {

    // TODO: Refactor for better code reuse
    if (get_config().polling_rate_mode != 2) {
-        if (!tud_hid_report(0x01, interrupt_in_data, 63)) {
+        // Remap acts on the OUTGOING copy only — interrupt_in_data stays raw so
+        // the reboot combo above and every OLED screen keep seeing physical input.
+        uint8_t out[63];
+        memcpy(out, interrupt_in_data, 63);
+        remap_apply(out);
+        if (!tud_hid_report(0x01, out, 63)) {
            printf("[USBHID] tud_hid_report error\n");
        }
        return;
@@ -137,6 +143,9 @@ void interrupt_loop() {
    }
    critical_section_exit(&report_cs);

+    // Remap the snapshot, not interrupt_in_data (outgoing copy only — see above).
+    if (should_send) remap_apply(safe_report);
+
    // Only send to TinyUSB if we actually grabbed fresh data
    if (should_send) {
        if (!tud_hid_report(0x01, safe_report, 63)) {
@@ -189,11 +198,24 @@ void on_bt_data(CHANNEL_TYPE channel, uint8_t *data, uint16_t len) {
        }
    }

-    // Mic-add tap DISABLED — was decoding standard input (button/stick
-    // bytes) as Opus and producing INT16_MIN garbage on the USB IN
-    // endpoint. Re-enable once we identify the actual mic transport.
-    // (Standard input handling below resumes — Status screen + HID
-    //  reports to host need this.)
+    // Mic-in tap (TEST): once the dongle asserts the mic-enable bit in the
+    // outgoing 0x36 audio report (pkt[4] bit 0, see audio.cpp — awalol
+    // confirmed this is the key), the DS5 streams its mic as a 71-byte Opus
+    // packet at data+4 of a 0x31 report with bit 1 of data[2] set. Route those
+    // to the mic decoder instead of treating them as a standard input report.
+    // The length guard (4-byte header + 71-byte Opus) keeps a stray short
+    // frame from over-reading. The diagnostic counters above still observe
+    // these frames, so the Diag screen's data[2] OR-mask will show bit 1 set
+    // once the enable bit takes effect.
+    // A mic-tagged 0x31 frame carries Opus audio at data+4, NOT a standard input
+    // report — so it must ALWAYS be diverted here (decoded when mic is on, dropped
+    // when off), never fall through to the input handler below. Letting it through
+    // would copy Opus bytes into interrupt_in_data and corrupt sticks/buttons.
+    if (channel == INTERRUPT && data[1] == 0x31 && ((data[2] >> 1) & 1)
+        && len >= 75) {
+        if (get_config().bt_mic_enable) mic_add_queue(data + 4);
+        return;
+    }

    if (channel == INTERRUPT && data[1] == 0x31) {
        if ((data[56] & 1) != (interrupt_in_data[53] & 1)) {
@@ -364,6 +386,7 @@ int main() {
    critical_section_init(&report_cs);

    config_load();
+    remap_load();

    bt_init();
    bt_register_data_callback(on_bt_data);
@@ -381,6 +404,7 @@ int main() {
        watchdog_update();
 #endif
        cyw43_arch_poll();
+        bt_connection_watchdog_tick();
        tud_task();
        audio_loop();
        interrupt_loop();
@@ -126,14 +126,15 @@ constexpr int kLbModeHost = 8;
 constexpr int kNumLbModes = 9;

 // Settings screen state
-constexpr int kNumSettingsItems = 15; // 8 fields + 3 auto-haptic + 2 screen-timeout + Reset + Wipe
+constexpr int kNumSettingsItems = 16; // 8 fields + 3 auto-haptic + 2 screen-timeout + BT mic + Reset + Wipe
 constexpr int kSettingsAutoHapEnaIdx  = 8;
 constexpr int kSettingsAutoHapGainIdx = 9;
 constexpr int kSettingsAutoHapLpIdx   = 10;
 constexpr int kSettingsScrDimIdx      = 11;
 constexpr int kSettingsScrOffIdx      = 12;
-constexpr int kSettingsResetIdx       = 13;
-constexpr int kSettingsWipeSlotsIdx   = 14;
+constexpr int kSettingsBtMicIdx       = 13;
+constexpr int kSettingsResetIdx       = 14;
+constexpr int kSettingsWipeSlotsIdx   = 15;
 Config_body settings_local{};
 int settings_sel = 0;
 bool settings_dirty = false;
@@ -272,6 +273,16 @@ void rect_filled(int x, int y, int w, int h) {
            px(x + i, y + j, true);
 }

+// XOR-invert every pixel in a region (used to flash a control "pressed").
+void rect_invert(int x, int y, int w, int h) {
+    for (int j = 0; j < h; j++)
+        for (int i = 0; i < w; i++) {
+            const int xx = x + i, yy = y + j;
+            if (xx < 0 || xx >= kW || yy < 0 || yy >= kH) continue;
+            fb[yy * kRowBytes + (xx / 8)] ^= 1 << (7 - (xx % 8));
+        }
+}
+
 void draw_char(int x, int y, char c) {
    if (c < 0x20 || c > 0x7E) return;
    const uint8_t *g = kFont5x7[c - 0x20];
@@ -549,6 +560,15 @@ ChargeEta g_charge_eta{};
 // the "?") as soon as the first clean step completes.
 constexpr float kDefaultStepUs = 15.0f * 60.0f * 1000000.0f;

+// Ceiling on a single timed step's bulk-equivalent duration. A genuine idle 10%
+// step on this dongle is ~15 min; anything past ~30 min is almost always an
+// anomalous/under-load sample (e.g. the controller in use while charging, or a
+// battery-nibble bounce) that would otherwise balloon the projection — observed
+// reading ~222m at 70% off one ~47-min step. We clamp such samples instead of
+// trusting them, and pair that with a median over kRing steps so one bad reading
+// can't dominate the estimate.
+constexpr float kMaxStepUs = 30.0f * 60.0f * 1000000.0f;
+
 // Relative time the step *ending* at `to_level` (10% units, 1..10) takes vs a
 // bulk step. Tuned to the Li-ion CV taper: ~80% onward stretches out.
 static float charge_step_weight(int to_level) {
@@ -558,7 +578,7 @@ static float charge_step_weight(int to_level) {
 }

 void sample_charge_eta() {
-    constexpr int kRing = 3;                 // average the last few steps
+    constexpr int kRing = 5;                 // median over the last few steps
    static float    ring[kRing] = {0};       // bulk-equivalent step durations (us)
    static int      ring_count = 0;
    static int      ring_head = 0;
@@ -597,7 +617,9 @@ void sample_charge_eta() {
        if (first_step_pending) {
            first_step_pending = false;
        } else {
-            ring[ring_head] = dur / charge_step_weight(step);
+            float be = dur / charge_step_weight(step);
+            if (be > kMaxStepUs) be = kMaxStepUs;   // clamp under-load/anomalous outliers
+            ring[ring_head] = be;
            ring_head = (ring_head + 1) % kRing;
            if (ring_count < kRing) ring_count++;
        }
@@ -619,9 +641,18 @@ void sample_charge_eta() {
        const bool measured = (ring_count > 0);
        float bulk;
        if (measured) {
-            bulk = 0.0f;
-            for (int i = 0; i < ring_count; i++) bulk += ring[i];
-            bulk /= (float)ring_count;
+            // Median of the timed steps — robust to a single slow/fast outlier
+            // in a way the old mean wasn't (one 47-min under-load step used to
+            // drag the whole projection up). kRing is tiny, so insertion-sort.
+            float tmp[kRing];
+            for (int i = 0; i < ring_count; i++) tmp[i] = ring[i];
+            for (int i = 1; i < ring_count; i++) {
+                const float v = tmp[i];
+                int j = i - 1;
+                while (j >= 0 && tmp[j] > v) { tmp[j + 1] = tmp[j]; j--; }
+                tmp[j + 1] = v;
+            }
+            bulk = tmp[ring_count / 2];
        } else {
            bulk = kDefaultStepUs;
        }
@@ -693,11 +724,15 @@ __attribute__((noinline)) void render_screen() {
        int lx = (kContentX + 2) + (interrupt_in_data[0] * 27) / 255;
        int ly = 32 + (interrupt_in_data[1] * 27) / 255;
        rect_filled(lx - 1, ly - 1, 3, 3);
+        // L3 (left stick click) — invert the whole box as a pressed indicator.
+        if (interrupt_in_data[8] & 0x40) rect_invert(kContentX, 30, 32, 32);

        rect_outline(96, 30, 32, 32);
        int rx = 98 + (interrupt_in_data[2] * 27) / 255;
        int ry = 32 + (interrupt_in_data[3] * 27) / 255;
        rect_filled(rx - 1, ry - 1, 3, 3);
+        // R3 (right stick click) — invert the whole box.
+        if (interrupt_in_data[8] & 0x80) rect_invert(96, 30, 32, 32);

        // L2/R2 analog trigger bars (vertical, fill from bottom). L2 sits
        // just right of the shifted left stick box.
@@ -826,7 +861,7 @@ void sample_diag_rates() {

 // Row list ordered by relevance: always-useful at top, parked-mic-investigation
 // data at bottom. To add a row, bump kNumDiagRows and add a case.
-constexpr int kNumDiagRows = 11;
+constexpr int kNumDiagRows = 12;
 __attribute__((noinline))
 void format_diag_row(int idx, char* line, size_t n) {
    switch (idx) {
@@ -871,7 +906,10 @@ void format_diag_row(int idx, char* line, size_t n) {
                     (long)audio_mic_last_decoded(),
                     (unsigned)audio_mic_last_wrote());
            break;
-        case 10: {
+        case 10:
+            snprintf(line, n, "Mic PLC: %lu", (unsigned long)audio_mic_plc_frames());
+            break;
+        case 11: {
            uint8_t pfx[6]; bt_31_mic_prefix(pfx);
            snprintf(line, n, "%02X %02X %02X %02X %02X %02X",
                     pfx[0], pfx[1], pfx[2], pfx[3], pfx[4], pfx[5]);
@@ -1015,6 +1053,85 @@ __attribute__((noinline)) void render_screen_triggers() {
    flush_fb();
 }

+// --- IMU calibration (DS5 feature report 0x05) ---------------------------
+// The DualSense ships per-unit gyro/accel calibration in feature report 0x05,
+// which bt.cpp already fetches and caches at connect (init_feature). Parsing it
+// lets the Gyro Tilt screen and the tilt->RGB lightbar mode use bias- and
+// sensitivity-corrected accel instead of raw counts, so the tilt dot recenters
+// per controller. Parse + apply mirror SDL's SDL_hidapi_ps5.c (zlib-licensed)
+// LoadCalibrationData/ApplyCalibrationData (credit); feature_data[0x05]'s byte
+// layout matches SDL's data[] (index 0 = report id, calibration words from 1).
+//
+// imu_apply keeps accel in the same +-8192 == 1g count space the callers already
+// scale by, so existing /8192 (gyro screen) and +-8192 (lightbar) math is
+// unchanged — calibration only removes the per-axis zero offset and corrects gain.
+struct ImuCal { int16_t bias; float sens; };  // 0..2 gyro P/Y/R, 3..5 accel X/Y/Z
+ImuCal g_imu_cal[6];
+bool   g_imu_cal_valid = false;   // a plausible calibration was loaded
+bool   g_imu_cal_tried = false;   // 0x05 has been seen this connection (good or bad)
+
+constexpr float kGyroResPerDeg = 1024.0f;
+constexpr float kAccelResPerG  = 8192.0f;
+
+inline int16_t cal_ld16(const std::vector<uint8_t>& d, int i) {
+    return (int16_t)((uint16_t)d[i] | ((uint16_t)d[i + 1] << 8));
+}
+
+__attribute__((noinline))
+void imu_cal_parse(const std::vector<uint8_t>& d) {
+    g_imu_cal_valid = false;
+    if (d.size() < 35) return;                 // SDL requires >= 35 calibration bytes
+
+    const int16_t gPB = cal_ld16(d, 1),  gYB = cal_ld16(d, 3),  gRB = cal_ld16(d, 5);
+    const int16_t gPp = cal_ld16(d, 7),  gPm = cal_ld16(d, 9);
+    const int16_t gYp = cal_ld16(d, 11), gYm = cal_ld16(d, 13);
+    const int16_t gRp = cal_ld16(d, 15), gRm = cal_ld16(d, 17);
+    const int16_t gSp = cal_ld16(d, 19), gSm = cal_ld16(d, 21);
+    const int16_t aXp = cal_ld16(d, 23), aXm = cal_ld16(d, 25);
+    const int16_t aYp = cal_ld16(d, 27), aYm = cal_ld16(d, 29);
+    const int16_t aZp = cal_ld16(d, 31), aZm = cal_ld16(d, 33);
+
+    const float num = (float)(gSp + gSm) * kGyroResPerDeg;
+    g_imu_cal[0] = { gPB, num / (float)(gPp - gPm) };
+    g_imu_cal[1] = { gYB, num / (float)(gYp - gYm) };
+    g_imu_cal[2] = { gRB, num / (float)(gRp - gRm) };
+
+    int16_t r;
+    r = aXp - aXm; g_imu_cal[3] = { (int16_t)(aXp - r / 2), 2.0f * kAccelResPerG / (float)r };
+    r = aYp - aYm; g_imu_cal[4] = { (int16_t)(aYp - r / 2), 2.0f * kAccelResPerG / (float)r };
+    r = aZp - aZm; g_imu_cal[5] = { (int16_t)(aZp - r / 2), 2.0f * kAccelResPerG / (float)r };
+
+    // Sanity gate (same as SDL): a wild bias or a gain off by >50% means a bad
+    // factory cal or a short/garbled read — fall back to raw rather than amplify it.
+    for (int i = 0; i < 6; i++) {
+        const float divisor = (i < 3) ? 64.0f : 1.0f;
+        const int   ab      = g_imu_cal[i].bias < 0 ? -g_imu_cal[i].bias : g_imu_cal[i].bias;
+        float       gain    = 1.0f - g_imu_cal[i].sens / divisor;
+        if (gain < 0) gain = -gain;
+        if (ab > 1024 || gain > 0.5f) return;  // leave g_imu_cal_valid = false
+    }
+    g_imu_cal_valid = true;
+}
+
+// Poll once per frame from oled_loop: parse 0x05 the first time it is available
+// for this controller, and reset on disconnect so the next controller re-reads.
+void imu_cal_service() {
+    if (!bt_is_connected()) { g_imu_cal_valid = false; g_imu_cal_tried = false; return; }
+    if (g_imu_cal_tried) return;
+    auto d = bt_peek_feature(0x05);
+    if (d.size() < 35) return;                 // not arrived yet — retry next frame
+    imu_cal_parse(d);
+    g_imu_cal_tried = true;
+}
+
+// index 0..2 gyro, 3..5 accel. Returns the calibrated value in the same count
+// scale the raw value used (+-8192 == 1g for accel); identity when no valid
+// calibration is loaded, so behaviour matches the pre-calibration firmware.
+inline int16_t imu_apply(int index, int16_t raw) {
+    if (!g_imu_cal_valid) return raw;
+    return (int16_t)((float)(raw - g_imu_cal[index].bias) * g_imu_cal[index].sens);
+}
+
 __attribute__((noinline)) void render_screen_gyro() {
    fb_clear();
    draw_text(kContentX, 0, "Gyro Tilt");
@@ -1023,6 +1140,9 @@ __attribute__((noinline)) void render_screen_gyro() {
        memcpy(&ax, &interrupt_in_data[21], 2);
        memcpy(&ay, &interrupt_in_data[23], 2);
        memcpy(&az, &interrupt_in_data[25], 2);
+        ax = imu_apply(3, ax);  // bias/sensitivity-corrected accel (identity if no cal)
+        ay = imu_apply(4, ay);
+        az = imu_apply(5, az);
        char buf[16];
        snprintf(buf, sizeof(buf), "X%+5d", ax); draw_text(kContentX, 10, buf);
        snprintf(buf, sizeof(buf), "Y%+5d", ay); draw_text(50, 10, buf);
@@ -1032,8 +1152,15 @@ __attribute__((noinline)) void render_screen_gyro() {
        rect_outline(bx, by, bw, bh);
        for (int x = bx + 1; x < bx + bw - 1; x++) px(x, by + bh / 2, true);
        for (int y = by + 1; y < by + bh - 1; y++) px(bx + bw / 2, y, true);
-        int dx = ((int)ax * (bw / 2 - 3)) / 8192;
-        int dy = ((int)ay * (bh / 2 - 3)) / 8192;
+        // Plot the two axes that read ~0 when the controller lies flat: X (roll,
+        // left/right) and Z (pitch, fwd/back). Gravity rests on Y when flat, so
+        // driving the dot from Y pegged it to the bottom edge at rest — using Z
+        // keeps the dot centred flat and it tracks as you tilt. (Readout above
+        // still shows all three raw axes.)
+        // Negated so the dot follows the tilt direction: tilt left -> dot left,
+        // tilt forward -> dot up (gravity pulls the opposite way on the axis).
+        int dx = -((int)ax * (bw / 2 - 3)) / 8192;
+        int dy = -((int)az * (bh / 2 - 3)) / 8192;
        int cx = bx + bw / 2 + dx;
        int cy = by + bh / 2 + dy;
        if (cx < bx + 2) cx = bx + 2;
@@ -1212,6 +1339,9 @@ void lightbar_compute_mode(int mode, uint32_t now_ms) {
        memcpy(&ax, &interrupt_in_data[21], 2);
        memcpy(&ay, &interrupt_in_data[23], 2);
        memcpy(&az, &interrupt_in_data[25], 2);
+        ax = imu_apply(3, ax);  // calibrated accel keeps the +-8192 == 1g scale below
+        ay = imu_apply(4, ay);
+        az = imu_apply(5, az);
        const int rr = ((int)ax + 8192) * 255 / 16384;
        const int gg = ((int)ay + 8192) * 255 / 16384;
        const int bb = ((int)az + 8192) * 255 / 16384;
@@ -1416,6 +1546,7 @@ void settings_adjust(int delta) {
            c.screen_off_timeout = (uint8_t)v;
            break;
        }
+        case 13: c.bt_mic_enable ^= 1; break; // BT mic on/off
    }
 }

@@ -1517,8 +1648,9 @@ __attribute__((noinline)) void format_settings_item(int idx, char* line, size_t
            if (c.screen_off_timeout == 0) snprintf(line, n, "%s ScrOff off", cur);
            else snprintf(line, n, "%s ScrOff %umin", cur, c.screen_off_timeout);
            break;
-        case 13: snprintf(line, n, "%s Reset to defaults", cur); break;
-        case 14: snprintf(line, n, "%s Wipe all slots", cur); break;
+        case 13: snprintf(line, n, "%s BT Mic %s", cur, c.bt_mic_enable ? "on" : "off"); break;
+        case 14: snprintf(line, n, "%s Reset to defaults", cur); break;
+        case 15: snprintf(line, n, "%s Wipe all slots", cur); break;
    }
 }

@@ -1731,6 +1863,9 @@ void oled_loop() {
    // Track charge progress every frame — before the power-ladder early-returns
    // below, so step timing stays correct even while the panel is dimmed/off.
    sample_charge_eta();
+    // Parse the DS5's per-unit IMU calibration once it lands (no-op until then),
+    // so the tilt screen + tilt->RGB lightbar use corrected accel. See imu_apply().
+    imu_cal_service();
    // Drive the controller LED every frame (any screen / power state): charging
    // pulse, selected OLED mode, or hand-off to the host. See lightbar_service().
    lightbar_service();
@@ -0,0 +1,197 @@
+// Button remapping. See remap.h. Flash-sector pattern mirrors slots.cpp;
+// the apply logic + button set are ported from SundayMoments/DS5_Bridge.
+
+#include "remap.h"
+
+#include <cstring>
+#include <cstdio>
+#include <algorithm>
+
+#include "hardware/flash.h"
+#include "hardware/sync.h"
+
+namespace {
+
+// Source/target button indices. Order is arbitrary but MUST match the web
+// editor's expectation (DS5Dongle-OLED-Config-Web src/protocol/remap.ts).
+enum RemapButton : uint8_t {
+    RemapL2, RemapL1, RemapCreate, RemapDpadUp, RemapDpadLeft, RemapDpadDown,
+    RemapDpadRight, RemapL3, RemapR2, RemapR1, RemapOptions, RemapTriangle,
+    RemapCircle, RemapCross, RemapSquare, RemapR3, RemapButtonCount,
+};
+static_assert(RemapButtonCount == kRemapCount, "kRemapCount must match RemapButton");
+
+// interrupt_in_data[8]: shoulders / sticks / system bits.
+constexpr uint8_t kL1Bit = 0x01, kR1Bit = 0x02, kL2Bit = 0x04, kR2Bit = 0x08,
+                  kCreateBit = 0x10, kOptionsBit = 0x20, kL3Bit = 0x40, kR3Bit = 0x80;
+// interrupt_in_data[7]: D-pad hat (low nibble) + face buttons (high nibble).
+constexpr uint8_t kSquareBit = 0x10, kCrossBit = 0x20, kCircleBit = 0x40,
+                  kTriangleBit = 0x80, kDpadMask = 0x0F;
+// D-pad hat values.
+constexpr uint8_t kUp = 0, kUpRight = 1, kRight = 2, kDownRight = 3, kDown = 4,
+                  kDownLeft = 5, kLeft = 6, kUpLeft = 7, kNeutral = 8;
+
+constexpr uint32_t REMAP_MAGIC = 0x44533503u; // "DS5\x03"
+constexpr uint32_t REMAP_FLASH_OFFSET = PICO_FLASH_SIZE_BYTES - 3u * FLASH_SECTOR_SIZE;
+
+struct __attribute__((packed)) RemapData {
+    uint32_t magic;
+    uint8_t  table[kRemapCount];
+};
+static_assert(sizeof(RemapData) <= FLASH_PAGE_SIZE);
+static_assert(REMAP_FLASH_OFFSET % FLASH_SECTOR_SIZE == 0);
+
+RemapData g_remap{};
+bool      g_active   = false; // false = identity → remap_apply() fast-returns
+uint16_t  g_revision = 0;
+
+const RemapData *flash_remap() {
+    return reinterpret_cast<const RemapData *>(XIP_BASE + REMAP_FLASH_OFFSET);
+}
+
+void set_identity() {
+    for (int i = 0; i < kRemapCount; i++) g_remap.table[i] = (uint8_t) i;
+}
+
+void recompute_active() {
+    g_active = false;
+    for (int i = 0; i < kRemapCount; i++) {
+        if (g_remap.table[i] != i) { g_active = true; return; }
+    }
+}
+
+bool valid_table(const uint8_t *t) {
+    for (int i = 0; i < kRemapCount; i++) {
+        if (t[i] >= kRemapCount && t[i] != 0xFF) return false; // <16 or disabled
+    }
+    return true;
+}
+
+bool save_to_flash() {
+    alignas(4) uint8_t page[FLASH_PAGE_SIZE];
+    memset(page, 0xff, sizeof(page));
+    memcpy(page, &g_remap, sizeof(g_remap));
+
+    const uint32_t interrupts = save_and_disable_interrupts();
+    flash_range_erase(REMAP_FLASH_OFFSET, FLASH_SECTOR_SIZE);
+    flash_range_program(REMAP_FLASH_OFFSET, page, sizeof(page));
+    restore_interrupts(interrupts);
+
+    RemapData verify{};
+    memcpy(&verify, flash_remap(), sizeof(verify));
+    if (memcmp(&verify, &g_remap, sizeof(g_remap)) == 0) {
+        printf("[Remap] flash write verified\n");
+        return true;
+    }
+    printf("[Remap] flash write VERIFY FAILED\n");
+    return false;
+}
+
+bool dpad_has(uint8_t dir, RemapButton b) {
+    switch (b) {
+        case RemapDpadUp:    return dir == kUp || dir == kUpRight || dir == kUpLeft;
+        case RemapDpadRight: return dir == kRight || dir == kUpRight || dir == kDownRight;
+        case RemapDpadDown:  return dir == kDown || dir == kDownRight || dir == kDownLeft;
+        case RemapDpadLeft:  return dir == kLeft || dir == kUpLeft || dir == kDownLeft;
+        default:             return false;
+    }
+}
+
+uint8_t dpad_from(bool up, bool right, bool down, bool left) {
+    if (up && right && !down && !left) return kUpRight;
+    if (right && down && !up && !left) return kDownRight;
+    if (down && left && !up && !right) return kDownLeft;
+    if (left && up && !right && !down) return kUpLeft;
+    if (up && !down)    return kUp;
+    if (right && !left) return kRight;
+    if (down && !up)    return kDown;
+    if (left && !right) return kLeft;
+    return kNeutral;
+}
+
+} // namespace
+
+void remap_load() {
+    memcpy(&g_remap, flash_remap(), sizeof(g_remap));
+    if (g_remap.magic != REMAP_MAGIC || !valid_table(g_remap.table)) {
+        printf("[Remap] flash sector empty/invalid, defaulting to identity\n");
+        g_remap.magic = REMAP_MAGIC;
+        set_identity();
+        save_to_flash();
+    }
+    recompute_active();
+    printf("[Remap] loaded (active=%d)\n", g_active);
+}
+
+void remap_get(uint8_t out[kRemapCount]) { memcpy(out, g_remap.table, kRemapCount); }
+
+uint16_t remap_revision() { return g_revision; }
+
+bool remap_set(const uint8_t *table) {
+    if (!valid_table(table)) return false;
+    memcpy(g_remap.table, table, kRemapCount);
+    g_remap.magic = REMAP_MAGIC;
+    recompute_active();
+    g_revision++;
+    return save_to_flash();
+}
+
+void remap_apply(uint8_t *report) {
+    if (!g_active) return; // identity → no-op (hot-path fast return)
+
+    bool    src[kRemapCount]{};
+    uint8_t src_analog[kRemapCount]{};
+    const uint8_t dir = report[7] & kDpadMask;
+
+    src[RemapL2]        = (report[8] & kL2Bit) != 0;
+    src[RemapL1]        = (report[8] & kL1Bit) != 0;
+    src[RemapCreate]    = (report[8] & kCreateBit) != 0;
+    src[RemapDpadUp]    = dpad_has(dir, RemapDpadUp);
+    src[RemapDpadLeft]  = dpad_has(dir, RemapDpadLeft);
+    src[RemapDpadDown]  = dpad_has(dir, RemapDpadDown);
+    src[RemapDpadRight] = dpad_has(dir, RemapDpadRight);
+    src[RemapL3]        = (report[8] & kL3Bit) != 0;
+    src[RemapR2]        = (report[8] & kR2Bit) != 0;
+    src[RemapR1]        = (report[8] & kR1Bit) != 0;
+    src[RemapOptions]   = (report[8] & kOptionsBit) != 0;
+    src[RemapTriangle]  = (report[7] & kTriangleBit) != 0;
+    src[RemapCircle]    = (report[7] & kCircleBit) != 0;
+    src[RemapCross]     = (report[7] & kCrossBit) != 0;
+    src[RemapSquare]    = (report[7] & kSquareBit) != 0;
+    src[RemapR3]        = (report[8] & kR3Bit) != 0;
+
+    for (int i = 0; i < kRemapCount; i++) src_analog[i] = src[i] ? 0xFF : 0;
+    src_analog[RemapL2] = report[4]; // L2 analog
+    src_analog[RemapR2] = report[5]; // R2 analog
+
+    bool    tgt[kRemapCount]{};
+    uint8_t tgt_analog[kRemapCount]{};
+    for (int s = 0; s < kRemapCount; s++) {
+        const uint8_t t = g_remap.table[s];
+        if (t >= kRemapCount) continue; // 0xFF = disabled (source produces nothing)
+        if (src[s]) tgt[t] = true;
+        tgt_analog[t] = std::max(tgt_analog[t], src_analog[s]); // OR digital / max analog
+    }
+
+    report[4] = tgt_analog[RemapL2];
+    report[5] = tgt_analog[RemapR2];
+
+    // Byte 7 is entirely D-pad + face (all 8 bits) — rebuild it.
+    report[7] = dpad_from(tgt[RemapDpadUp], tgt[RemapDpadRight],
+                          tgt[RemapDpadDown], tgt[RemapDpadLeft]);
+    if (tgt[RemapSquare])   report[7] |= kSquareBit;
+    if (tgt[RemapCross])    report[7] |= kCrossBit;
+    if (tgt[RemapCircle])   report[7] |= kCircleBit;
+    if (tgt[RemapTriangle]) report[7] |= kTriangleBit;
+
+    // Byte 8 is entirely shoulders/sticks/Create/Options (all 8 bits) — rebuild it.
+    report[8] = 0;
+    if (tgt[RemapL1])      report[8] |= kL1Bit;
+    if (tgt[RemapR1])      report[8] |= kR1Bit;
+    if (tgt[RemapL2])      report[8] |= kL2Bit;
+    if (tgt[RemapR2])      report[8] |= kR2Bit;
+    if (tgt[RemapCreate])  report[8] |= kCreateBit;
+    if (tgt[RemapOptions]) report[8] |= kOptionsBit;
+    if (tgt[RemapL3])      report[8] |= kL3Bit;
+    if (tgt[RemapR3])      report[8] |= kR3Bit;
+}
@@ -0,0 +1,43 @@
+//
+// Button remapping — a 16-entry table persisted in its own flash sector,
+// applied to the OUTGOING host HID report only (never the raw interrupt_in_data
+// the OLED / reboot-combo logic reads). Edited from the web config tool over the
+// already-declared 0xF6/0xF7 vendor reports. Apply logic + button set ported
+// from SundayMoments/DS5_Bridge (credit).
+//
+
+#ifndef DS5_BRIDGE_REMAP_H
+#define DS5_BRIDGE_REMAP_H
+
+#include <cstdint>
+
+// Number of remappable buttons (see RemapButton in remap.cpp). The table maps
+// source index -> target index; 0xFF means "disabled" (source does nothing).
+constexpr int kRemapCount = 16;
+
+// Wire-protocol version for the remap get/set framing carried over the existing
+// 0xF6/0xF7 vendor reports (see cmd.cpp). Bump only on incompatible layout
+// changes so the web tool can refuse a mismatched firmware.
+constexpr uint8_t kRemapProtoVer = 1;
+
+// Load the table from its dedicated flash sector. Call once at boot, after
+// config_load(). A fresh/invalid sector defaults to identity (no remap).
+void remap_load();
+
+// Remap a 63-byte DS5 input-report COPY in place (buttons live in report[4,5,7,8]).
+// No-op fast path when the table is identity. Must only ever touch the outgoing
+// host report, not the raw interrupt_in_data.
+void remap_apply(uint8_t *report);
+
+// Validate + store + persist a new 16-entry table (each entry < 16, or 0xFF =
+// disabled). Bumps the revision on success. Returns false if the table is invalid.
+bool remap_set(const uint8_t *table);
+
+// Copy the current 16-entry table out.
+void remap_get(uint8_t out[kRemapCount]);
+
+// Monotonic counter bumped on each successful remap_set — the web polls it to
+// confirm a write landed. Runtime only (not persisted).
+uint16_t remap_revision();
+
+#endif // DS5_BRIDGE_REMAP_H
Author	SHA1	Message	Date
MarcelineVPQandClaude Opus 4.7	c879b24364	docs(changelog): cut v0.6.10 — gyro tilt rework + L3/R3 indicator + charge-ETA Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 07:20:30 -06:00
MarcelineVPQandClaude Opus 4.7	c7e6c5b914	feat(oled): IMU gyro calibration + centred, correct-direction tilt dot Rework the Gyro Tilt screen (and the tilt->RGB lightbar) using the DS5's own factory IMU calibration, and fix two long-standing tilt-dot quirks. All three are display-only — the host input report (every gyro + accel axis) is still forwarded byte-for-byte, so in-game motion is unaffected. - Calibration: parse feature report 0x05 (already cached by bt.cpp) into per-axis bias + sensitivity and apply (raw-bias)*sens to the accel the tilt visuals use, keeping the +-8192 == 1g scale. Re-read per connection so it tracks across the 4 pairing slots; sanity-gated with raw fallback. New side-effect-free bt_peek_feature() accessor (never issues an L2CAP request, safe to poll). Parse/apply mirror SDL's SDL_hidapi_ps5.c (zlib). - Centred when flat: drive the dot from X (roll) + Z (pitch) instead of X + Y. Gravity rests on Y when flat, so the old Y mapping pegged the dot to the bottom edge at rest; it now sits centred. - Direction: negate both axes so the dot follows the tilt (tilt left -> dot left, tilt forward -> dot up) instead of mirroring it. Also fold in this session's charge-ETA robustness fix: cap each timed 10% step at 30 min and take the median over the last 5 steps, so one slow step can't balloon the estimate (was reading ~222m at 70% off a single ~47-min step). Shares src/oled.cpp with the gyro work. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-25 07:16:51 -06:00
MarcelineVPQandClaude Opus 4.7	7e21a1fbea	docs(changelog): note L3/R3 Status-screen click indicator under [Unreleased] Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 12:39:40 -06:00
MarcelineVPQandClaude Opus 4.7	3556cdedb3	feat(oled): invert the stick box on L3/R3 click (Status screen) The two analog-stick boxes on the Status screen had no L3/R3 (stick-click) indicator. Add a rect_invert() helper and XOR-invert the whole box on click so it flashes inverse — the position dot inverts with it (black dot on a white box). Bits 0x40 (L3) / 0x80 (R3) on interrupt_in_data[8]. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 12:36:40 -06:00
MarcelineVPQandClaude Opus 4.7	a7f20cfd5a	docs(cn): rewrite README.CN.md to match the OLED Edition README The Chinese README was still the upstream stub (awalol.eu.org links, Pico W notes, USB-wake branch) — never adapted for this fork. Replaced with a full translation of the current README: web config tool (incl. Remap tab), button remapping, BT mic + PLC, all 11 OLED screens, overclock, build, diagnostics, USB 3.0 interference, and Zacksly CC BY 3.0 credit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 12:14:17 -06:00
MarcelineVPQandClaude Opus 4.7	a3881a4bda	docs(changelog): cut v0.6.9 — button remapping + visual web remap editor + mic PLC Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 12:02:42 -06:00
MarcelineVPQandClaude Opus 4.7	3d90ad4aa2	docs: highlight button remapping (README + CHANGELOG) README: add a "Button remapping" feature bullet and a "Remap tab" entry under the Web Config Tool section. CHANGELOG [Unreleased]: add a Companion web tool note documenting the visual Remap editor + Zacksly CC BY 3.0 asset attribution. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 11:58:32 -06:00
MarcelineVPQandClaude Opus 4.7	1b1944c006	feat(remap): on-dongle button remapping over 0xF6/0xF7 16-entry source→target table in its own flash sector (-3, magic DS5\x03), identity default, 0xFF = disabled. Applied to the OUTGOING host report copy only — raw interrupt_in_data (OLED screens + PS+Mute reboot combo) stays physical. Edited via the existing 0xF6/0xF7 vendor reports with a hardened RM+version frame (no HID-descriptor change, so Windows enumeration is unaffected) plus a revision counter the host polls to confirm a write. Apply logic + button set ported from SundayMoments/DS5_Bridge (credit). scripts/remap_test.py exercises the path over /dev/hidraw without the web tool. Verified on hardware: swap applied, read back, survived reboot. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 10:42:29 -06:00
MarcelineVPQandClaude Opus 4.7	da63e2bb72	feat(audio): mic packet-loss concealment (jitter buffer + Opus PLC) The BT mic decode path gained a decoded-frame jitter buffer (8 frames) drained at a steady 10 ms playout cadence. Bursty BT delivery is smoothed; a dropped mic frame during an active session is concealed with an Opus PLC frame (opus_decode(decoder, NULL, 0, ...)) instead of leaving a hole the host hears as a click/dropout. Playout pre-buffers 3 frames and stops after 300 ms of no real frames so it never emits comfort noise when the mic is idle. New "Mic PLC:" Diagnostics counter climbs only when concealment fires (a live link-quality gauge). Verified on hardware: forced BT loss kept captured audio gap-free (longest zero-run ~0 ms) while the counter climbed; clean link leaves it idle. Adds ~30 ms mic latency (the pre-buffer). Design ported from SundayMoments/DS5_Bridge (credit). Unreleased — batching with the next feature. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 09:27:11 -06:00
MarcelineVPQandClaude Opus 4.7	9920516f52	ci(release): stop publishing the debug UF2 as a release download The debug build (ENABLE_SERIAL=ON) compiles out tud_connect/disconnect and enumerates as a serial console, not a working HID/audio bridge — an end user who downloads it gets a non-functional dongle. Keep it buildable on demand (-DENABLE_SERIAL=ON) and in build.yml PR CI for compile coverage, but don't ship it on the public release page. Releases now upload the standard UF2 only. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 01:44:32 -06:00
MarcelineVPQandClaude Opus 4.7	1c4e34f8da	docs(changelog): cut v0.6.8 — BT microphone + USB 3.0 connection watchdog Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 01:31:06 -06:00
MarcelineVPQandClaude Opus 4.7	20b41d80a1	feat: DualSense BT microphone + USB 3.0 connection watchdog BT microphone over Bluetooth: the DS5 mic now works over the dongle's BT pairing — decoded from the controller's Opus stream to the USB capture endpoint. Hinges on pkt[4] bit 0 (mic-enable) in the outbound 0x36 audio report; credit to awalol (upstream) for identifying it. Mic-tagged 0x31 frames ((data[2]>>1)&1) are ALWAYS diverted out of the input path (decoded when on, dropped when off) so Opus payload can never corrupt sticks/buttons. Always-on via a sticky-latch keep-alive that only runs post-enumeration (tud_mounted) so it never floods the fresh-pair handshake (which otherwise delayed controller detection past the watchdog and tore the link down). Toggle: bt_mic_enable config field (default on) — OLED Settings + web config. README gains a "DualSense Microphone over Bluetooth" section; BLUETOOTH_AUDIO_NOTES.md rewritten from "dead end" to the working mechanism. USB 3.0 connection watchdog: auto-recovers a stalled connection (re-inquiry) instead of hanging on the amber lightbar, for USB 3.0 ~2.4 GHz RF interference that desensitizes the CYW43 BT radio. Re-enabled the ACL-fail / auth-fail / create-connection-reject recovery paths. README "USB 3.0 ports & Bluetooth interference" section with mitigations. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 01:30:37 -06:00