Validate RS50 shared-HID++ OLED, coexistence, telemetry, and layouts

[PeposCJ]

What changed

• identifies public HID++ display feature 0x8130 and its ten fixed layouts
• records successful static, live telemetry, bounded-stream, and iRacing
  coexistence OLED experiments
• documents why exclusive DirectInput is unsafe for production coexistence
• adds the closed shared-HID++ protocol and exact RS50 MI_01 transport
• adds separately armed Builds G-J for one-shot, bounded, coexistence, and
  stationary telemetry experiments
• adds Build K, an offline-validated fixed A-J visual gallery
• documents firmware and protocol findings about bars, graphics, typography,
  text fields, and the absence of a confirmed framebuffer
• adds a hash-gated, file-only inspector that validates all embedded font
  records and renders a local representative sample
• keeps all experimental physical routes out of the LogiDynamicDash app

Verified physical results

Build C replaced the RS50 Dynamic Test fallback with four OLED text rows.
Build D proved the complete live telemetry path while stationary in the
iRacing pits, rendering SPEED / 0 KMH / GEAR / N.

Build D also showed why exclusive DirectInput cannot be the production route:
shift LEDs stopped updating and normal FFB centering disappeared. USBPcap
records RESET_ALL → SET_GLOBAL_GAINS(0xFFFF) → RESET_ALL around
Acquire/Unacquire. Reloading the circuit restored normal behavior.

Build G proved a shared-HID++ one-shot with no observed LED, FFB, torque, or
wheel-position change. Build H then rendered all five fixed frames and
captured exactly one discovery, five setters, and six responses, with no
0x8123, 0x807A, 0x807B, or MI_02 host operation.

Build I passed with iRacing running. All five OLED frames rendered; centering,
FFB, and shift LEDs worked before and after; and no movement, torque impulse,
input loss, or disconnect was observed. Its capture contains one discovery,
five setters, six exact responses, continuous TRUEFORCE traffic, and no
endpoint-0 operation to runtime feature 0x8123.

OLED visual-capability finding

Static firmware analysis and the recovered descriptors show that 0x8130 is
a typed firmware renderer, not a host framebuffer:

• layouts C-E contain firmware-drawn bars/gauges driven by normalized bytes;
• layouts F-J expose fixed text regions and layout-selected typography;
• layout I also contains fixed decoration/glyphs;
• font descriptors and coordinates are selected inside firmware;
• the five built-in proportional bitmap fonts are 9, 16, 18, 27, and 37 px;
• the internal monochrome framebuffer is 128 x 64 (1024 bytes), but no
  recovered host command accepts those bytes;
• host requests contain no font ID, font size, coordinates, pixels, bitmap,
  color, image format, drawing opcode, or arbitrary-length stream.

The supported production assumption is therefore fixed layouts with bounded
values/text. This is not yet proof that no separate undocumented framebuffer
exists. Unknown rim features will not be probed by guessing.

Safety boundary

The transport accepts only Root discovery and canonical typed Layout A-J
feature-0x8130 transactions on the exact RS50 shared HID collections.
Build K contains one discovery and ten source-fixed A-J setters, with three
seconds per layout. It has no caller-controlled visual data, retry, telemetry,
DirectInput, FFB, LED operation, raw HID surface, or unknown rim-feature
request.

LogiDynamicDash does not reference or construct Builds G-K or copy the
physical transport into its output.

Validation

• 134 LogiDynamicDash/RS50 tests
• 121 LogiDynamicExplorer tests
• Build E-K source-surface audits
• offline firmware-font inspector audit, exact DFU run, 480 validated glyph
  records, representative BMP inspection, and invalid-hash rejection
• Build I/J fake-only verification
• solution build with 0 warnings and 0 errors
• application dependency isolation: no transport DLL or HidSharp
• dotnet format
• git diff --check

Next physical checkpoint

Build K is compiled and validated offline but has not been executed. K1 will
show fixed Layouts A-J for three seconds each while G HUB and iRacing are
closed. Video and a high-buffer USBPcap capture will classify:

• actual bars and gauge geometry;
• built-in graphics, icons, and decoration;
• relative font sizes and styles;
• whether data-free layouts A/B expose useful internal state.

K1 requires a fresh explicit operator authorization, a ten-second baseline,
no interaction with the wheel during the 30-second sequence, and a
ten-second post-check. Any unexpected physical effect or protocol response
ends further testing.

Build J remains unexecuted and is not part of K1.

This remains a draft research PR targeting research/hid-explorer. Do not
merge this research branch to main; validated findings will be implemented
there later as a separate integration.