Fix EQ preset command (0xF010) and document share format

The previous EQ preset command (0x4006) was wrong, so presets had no
effect. earctl confirms the real command set: EQ preset is 0xF010 with
payload [mode, 0x00].

- protocol.py: correct EQ preset frames; start the frame sequence number
  at 1 to match the reference implementation.
- docs/PROTOCOL.md: document the verified command table and the decoded
  Nothing X Advanced-EQ QR share format (gzip+base64, 8 bands of
  gain/frequency/Q float32 + profile name).

https://claude.ai/code/session_014KrpftzUgVFGFXVUU3DUTT

Author: claude

docs/PROTOCOL.md

@@ -41,12 +41,33 @@ This is implemented as `crc16ansi()` + `build_frame()` in
 so frames are now generated programmatically instead of hardcoded.
 
 Source of the algorithm: Gadgetbridge `CheckSums.getCRC16ansi` and
-`NothingProtocol`. Note: the real Ear (3) appears to **not strictly validate**
-the CRC (frames with a wrong CRC still took effect), but we compute it correctly
-anyway for compatibility.
+`NothingProtocol`, and `DaanHessen/earctl` for the command set. Note: the real
+Ear (3) appears to **not strictly validate** the CRC (frames with a wrong CRC
+still took effect), but we compute it correctly anyway for compatibility.
 
-Commands: `0xf00f` = ANC set, `0xc01e` = ANC status query, `0x4006` = EQ preset
-(EQ command/payload is a reconstruction, pending hardware confirmation).
+### Commands (from earctl, verified frame format)
+
+| Command                    | Value    | Payload                          |
+|----------------------------|----------|----------------------------------|
+| Set ANC                    | `0xF00F` | `[01, mode, 00]`                 |
+| ANC status (request)       | `0xC01E` | `[03]`                           |
+| Set EQ preset              | `0xF010` | `[mode, 00]` (0=Balanced, 1=More Bass, 2=More Treble, 3=Voice) |
+| Set custom EQ (3-band)     | `0xF041` | bass/mid/treble gains            |
+| Request advanced EQ        | `0xC04C` | —                                |
+| Enable advanced EQ         | `0xF04F` | —                                |
+
+### Nothing X share format (Advanced EQ QR codes)
+
+A shared Nothing X "Advanced equaliser profile" QR encodes **gzip + base64** of:
+
+```
+00 | 0x60 (= 96, band-data length) | 8 bands | 01 | name_len | name (ASCII)
+```
+
+Each band is three little-endian float32 values: **gain (dB), frequency (Hz),
+Q**. Example (Balanced Bass, band 1): gain `+6.0`, freq `30.0`, Q `0.1`.
+Decoded from real QR samples; lets us import/export Nothing-X-compatible
+profiles.
 
 ### Known ANC frames (13-byte frames)
 

src/nothing_ear/bluetooth/protocol.py

@@ -28,7 +28,7 @@
 
 CMD_ANC = 0xF00F
 CMD_ANC_STATUS = 0xC01E
-CMD_EQ = 0x4006
+CMD_EQ = 0xF010
 
 
 class ANCMode(Enum):
@@ -95,7 +95,7 @@ def anc_frame(mode: ANCMode, fsn: int = 0) -> bytes:
 
 
 def eq_preset_frame(preset: EQPreset, fsn: int = 0) -> bytes:
-    return build_frame(CMD_EQ, bytes([0x01, 0x01, _EQ_VALUE[preset]]), fsn)
+    return build_frame(CMD_EQ, bytes([_EQ_VALUE[preset], 0x00]), fsn)
 
 
 def query_anc_frame(fsn: int = 0) -> bytes:
@@ -120,7 +120,7 @@ def __init__(self, address: str, channel: int = RFCOMM_CHANNEL):
         self.address = address
         self.channel = channel
         self._sock: socket.socket | None = None
-        self._fsn = 0
+        self._fsn = 1
 
     def connect(self) -> None:
         sock = socket.socket(

tests/test_protocol.py

@@ -45,7 +45,7 @@ def test_all_eq_frames_are_valid_and_have_selector():
     for preset, value in expected.items():
         data = bytes.fromhex(EQ_COMMANDS[preset])
         assert data[0] == PACKET_PREAMBLE
-        assert data[10] == value
+        assert data[8] == value
 
 
 def test_every_eq_preset_has_a_frame():