diff --git a/build/check-bundle-size.ts b/build/check-bundle-size.ts
index 80f80a0c..f358b02d 100644
--- a/build/check-bundle-size.ts
+++ b/build/check-bundle-size.ts
@@ -9,7 +9,7 @@ const BUDGET_BYTES: Record<string, number> = {
   // guarded flash editor, verification exporter, upstream Finalmouse driver,
   // the dedicated Viper Mini protocol driver, and Viper V3 sleep/low-power plus
   // asymmetric lift-off protocol and controls. Preview fixtures remain dev-only.
-  ".js": 325_000,
+  ".js": 340_000,
 };
 
 const ASSETS = join("dist", "assets");
diff --git a/src/capture-format.test.ts b/src/capture-format.test.ts
index 576c306f..8b2287d6 100644
--- a/src/capture-format.test.ts
+++ b/src/capture-format.test.ts
@@ -7,6 +7,8 @@ import {
   diffSectors,
   formatCaptureMarkdown,
   formatProfileVerificationMarkdown,
+  formatProfileWriteProbeBackupMarkdown,
+  formatProfileWriteProbeReportMarkdown,
   type CaptureExport,
 } from "./capture-format.ts";
 
@@ -115,6 +117,27 @@ test("profile verification exports geometry, raw replies, directory and every fo
     currentProfileReply: new Uint8Array([0x11, 0xff, 0x40, 0x00, 0x02]),
     directory: new Uint8Array([0x00, 0x02, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff]),
     directoryCrcValid: true,
+    dpiCapabilities: {
+      featureId: 0x2201,
+      featureIndex: 0x0d,
+      featureVersion: 1,
+      kind: "legacy",
+      replies: [
+        { name: "getFeature", bytes: new Uint8Array([0x11, 0xff, 0x00, 0x0d, 0x00, 0x00, 0x01]) },
+        { name: "getSensorDpiList", bytes: new Uint8Array([0x11, 0xff, 0x10, 0x00, 0x64, 0xe0, 0x32, 0x0c, 0x80]) },
+      ],
+      decodedValues: [100, 150, 200],
+      error: null,
+    },
+    reportRateCapabilities: {
+      featureId: 0x8060,
+      featureIndex: 0x0e,
+      featureVersion: 0,
+      kind: "legacy",
+      replies: [{ name: "getReportRateList", bytes: new Uint8Array([0x11, 0xff, 0x00, 0x8b]) }],
+      decodedValues: [125, 250, 500, 1000],
+      error: null,
+    },
     profiles: [{
       sector: 2,
       enabled: true,
@@ -128,6 +151,11 @@ test("profile verification exports geometry, raw replies, directory and every fo
   assert.match(markdown, /Profile format: 8 · FORMAT 8/);
   assert.match(markdown, /Sector geometry: 4 × 8 bytes/);
   assert.match(markdown, /### Directory sector 0/);
+  assert.match(markdown, /### Device capability replies/);
+  assert.match(markdown, /DPI values: 100 DPI, 150 DPI, 200 DPI/);
+  assert.match(markdown, /DPI getSensorDpiList: `11 ff 10 00 64 e0 32 0c 80`/);
+  assert.match(markdown, /Report rate values: 125 Hz, 250 Hz, 500 Hz, 1000 Hz/);
+  assert.match(markdown, /Report rate getReportRateList: `11 ff 00 8b`/);
   assert.match(markdown, /### Profile sector 0x0002/);
   assert.match(markdown, /"reportRateWireless": 8000/);
   assert.match(markdown, /no profile flash was written/);
@@ -152,3 +180,40 @@ test("verification formatting accepts every recovered profile format", () => {
     assert.match(markdown, new RegExp(`Profile format: ${profileFormatId} · test`));
   }
 });
+
+test("write-probe reports embed the recovery backup and restoration verdict", () => {
+  const backup = {
+    formatId: 4,
+    sector: 1,
+    sectorSize: 8,
+    originalMode: "Host" as const,
+    originalCurrentSector: 0,
+    directory: new Uint8Array([0, 1, 1, 0, 0, 0, 0xaa, 0xbb]),
+    profile: new Uint8Array([1, 1, 0, 0, 0, 0, 0x12, 0x34]),
+    dpiOptions: [50, 100, 150],
+    reportRates: [125, 250, 500, 1000],
+  };
+  const recovery = formatProfileWriteProbeBackupMarkdown(backup);
+  assert.match(recovery, /profile-write probe recovery backup/);
+  assert.match(recovery, /Original profile sector 0x0001/);
+  assert.match(recovery, /01 01 00 00 00 00 12 34/);
+
+  const report = formatProfileWriteProbeReportMarkdown({
+    backup,
+    steps: [{
+      setting: "dpi",
+      intended: "1000 DPI",
+      storedExactly: true,
+      liveConfirmed: true,
+      restored: true,
+      error: null,
+    }],
+    restored: true,
+    modeRestored: true,
+    ok: true,
+  });
+  assert.match(report, /profile-write verification — PASSED/);
+  assert.match(report, /Live value confirmed: true/);
+  assert.match(report, /Final profile restored: true/);
+  assert.match(report, /profile-write probe recovery backup/);
+});
diff --git a/src/capture-format.ts b/src/capture-format.ts
index 3f458238..b73bdeea 100644
--- a/src/capture-format.ts
+++ b/src/capture-format.ts
@@ -1,3 +1,8 @@
+import type {
+  ProfileContentWriteProbeBackup,
+  ProfileContentWriteProbeReport,
+} from "./devices/logitech/hidpp";
+
 /**
  * Export format for profile-layout confirmations.
  *
@@ -113,6 +118,18 @@ export interface ProfileVerificationExport {
   directory: Uint8Array;
   directoryCrcValid: boolean;
   profiles: ProfileVerificationProfile[];
+  dpiCapabilities?: ProfileVerificationCapability | null;
+  reportRateCapabilities?: ProfileVerificationCapability | null;
+}
+
+export interface ProfileVerificationCapability {
+  featureId: number;
+  featureIndex: number;
+  featureVersion: number;
+  kind: "legacy" | "extended";
+  replies: Array<{ name: string; bytes: Uint8Array }>;
+  decodedValues: number[];
+  error: string | null;
 }
 
 function hexBlock(bytes: Uint8Array): string {
@@ -129,9 +146,82 @@ const hexByte = (value: number): string => `0x${value.toString(16).padStart(2, "
 
 const hexWord = (value: number): string => `0x${value.toString(16).padStart(4, "0")}`;
 
+function capabilityLines(
+  label: string,
+  capability: ProfileVerificationCapability | null | undefined,
+  unit: string,
+): string[] {
+  if (capability === undefined) return [];
+  if (capability === null) return [`- ${label}: not exposed`];
+  const lines = [
+    `- ${label}: feature ${hexWord(capability.featureId)}, index ${hexByte(capability.featureIndex)}, version ${capability.featureVersion}, ${capability.kind}`,
+    `- ${label} values: ${capability.decodedValues.length > 0 ? capability.decodedValues.map((value) => `${value} ${unit}`).join(", ") : "none decoded"}`,
+  ];
+  if (capability.error) lines.push(`- ${label} read warning: ${capability.error}`);
+  for (const reply of capability.replies) {
+    lines.push(`- ${label} ${reply.name}: \`${[...reply.bytes].map((byte) => byte.toString(16).padStart(2, "0")).join(" ")}\``);
+  }
+  return lines;
+}
+
+/** Recovery bundle copied before the first destructive verification write. */
+export function formatProfileWriteProbeBackupMarkdown(backup: ProfileContentWriteProbeBackup): string {
+  return [
+    "## OpenMouse profile-write probe recovery backup",
+    "",
+    `- Profile format: ${backup.formatId}`,
+    `- Sector: ${hexWord(backup.sector)}`,
+    `- Sector size: ${backup.sectorSize} bytes`,
+    `- Original mode: ${backup.originalMode}`,
+    `- Original current sector: ${hexWord(backup.originalCurrentSector)}`,
+    `- DPI options: ${backup.dpiOptions.join(", ")}`,
+    `- Report rates: ${backup.reportRates.join(", ")} Hz`,
+    "",
+    "### Original directory sector",
+    "",
+    "```",
+    hexBlock(backup.directory),
+    "```",
+    "",
+    `### Original profile sector ${hexWord(backup.sector)}`,
+    "",
+    "```",
+    hexBlock(backup.profile),
+    "```",
+    "",
+    "Keep this text until OpenMouse reports that the original profile and mode were restored.",
+  ].join("\n");
+}
+
+export function formatProfileWriteProbeReportMarkdown(report: ProfileContentWriteProbeReport): string {
+  const verdict = report.ok ? "PASSED" : "FAILED";
+  return [
+    `## OpenMouse profile-write verification — ${verdict}`,
+    "",
+    ...report.steps.flatMap((step) => [
+      `### ${step.setting}`,
+      "",
+      `- Intended value: ${step.intended}`,
+      `- Stored exactly: ${step.storedExactly}`,
+      `- Live value confirmed: ${step.liveConfirmed === null ? "not applicable" : step.liveConfirmed}`,
+      `- Original restored: ${step.restored}`,
+      ...(step.error ? [`- Error: ${step.error}`] : []),
+      "",
+    ]),
+    `- Final profile restored: ${report.restored}`,
+    `- Original mode restored: ${report.modeRestored}`,
+    "",
+    formatProfileWriteProbeBackupMarkdown(report.backup),
+  ].join("\n");
+}
+
 /** Markdown verification bundle suitable for an issue or a test fixture. */
 export function formatProfileVerificationMarkdown(capture: ProfileVerificationExport): string {
   const { info } = capture;
+  const capabilitySection = [
+    ...capabilityLines("DPI", capture.dpiCapabilities, "DPI"),
+    ...capabilityLines("Report rate", capture.reportRateCapabilities, "Hz"),
+  ];
   const sections = [
     "## OpenMouse profile-format verification",
     "",
@@ -150,6 +240,7 @@ export function formatProfileVerificationMarkdown(capture: ProfileVerificationEx
     `- getInfo: \`${[...capture.infoReply].map((byte) => byte.toString(16).padStart(2, "0")).join(" ")}\``,
     `- getMode: \`${[...capture.modeReply].map((byte) => byte.toString(16).padStart(2, "0")).join(" ")}\``,
     `- getCurrentProfile: \`${[...capture.currentProfileReply].map((byte) => byte.toString(16).padStart(2, "0")).join(" ")}\``,
+    ...(capabilitySection.length > 0 ? ["", "### Device capability replies", "", ...capabilitySection] : []),
     "",
     "### Directory sector 0",
     "",
diff --git a/src/capture-panel.ts b/src/capture-panel.ts
index a32aeea1..39eb07a3 100644
--- a/src/capture-panel.ts
+++ b/src/capture-panel.ts
@@ -3,10 +3,16 @@ import {
   diffSectors,
   formatCaptureMarkdown,
   formatProfileVerificationMarkdown,
+  formatProfileWriteProbeBackupMarkdown,
+  formatProfileWriteProbeReportMarkdown,
   type ProfileVerificationExport,
   type SectorBytes,
   type SectorDiff,
 } from "./capture-format";
+import type {
+  ProfileContentWriteProbeBackup,
+  ProfileContentWriteProbeReport,
+} from "./devices/logitech/hidpp";
 import { escapeHtml } from "./ui/dom";
 
 /**
@@ -28,13 +34,22 @@ export interface CaptureProfileSource {
   reproduce(before: Uint8Array, after: Uint8Array): Uint8Array;
 }
 
+interface CaptureWriteProbe {
+  supported: boolean;
+  reason: string;
+  prepare?(): Promise<ProfileContentWriteProbeBackup>;
+  run?(backup: ProfileContentWriteProbeBackup): Promise<ProfileContentWriteProbeReport>;
+}
+
 interface CaptureContext {
   device: string | null;
   profileFormat: string | null;
   profiles: CaptureProfileSource | null;
+  /** Null outside Logitech; otherwise the button remains visible. */
+  writeProbe: CaptureWriteProbe | null;
 }
 
-let context: CaptureContext = { device: null, profileFormat: null, profiles: null };
+let context: CaptureContext = { device: null, profileFormat: null, profiles: null, writeProbe: null };
 /** Sector -> bytes, taken before the vendor-app change. */
 let snapshot: Map<number, Uint8Array> | null = null;
 let diffs: SectorDiff[] = [];
@@ -97,6 +112,12 @@ function setCaptureMessage(message: string): void {
 export function refreshCapturePanel(): void {
   renderActions();
   renderDiffs();
+  const probe = document.querySelector<HTMLButtonElement>("#capture-write-probe");
+  if (probe) {
+    probe.hidden = context.writeProbe === null;
+    probe.disabled = context.writeProbe?.supported !== true;
+    probe.title = context.writeProbe?.reason ?? "";
+  }
 }
 
 async function takeSnapshot(): Promise<void> {
@@ -211,6 +232,34 @@ export function bindCapturePanel(): void {
     });
   });
 
+  document.querySelector<HTMLButtonElement>("#capture-write-probe")?.addEventListener("click", (event) => {
+    const button = event.currentTarget as HTMLButtonElement;
+    const source = context.writeProbe;
+    if (!source?.supported || !source.prepare || !source.run) return;
+    button.disabled = true;
+    setCaptureMessage("Reading and copying the recovery backup…");
+    void source.prepare().then(async (backup) => {
+      await navigator.clipboard.writeText(formatProfileWriteProbeBackupMarkdown(backup));
+      const approved = window.confirm(
+        "Recovery backup copied. This test performs six profile-sector erase/write cycles, temporarily changes the profile name, DPI, and polling rate, then restores the exact original after every step. Do not disconnect or power off the mouse. Run the probe now?",
+      );
+      if (!approved) {
+        setCaptureMessage("Recovery backup copied. Write probe cancelled before any flash write.");
+        return;
+      }
+      setCaptureMessage("Running write probe. Do not disconnect or power off the mouse…");
+      const report = await source.run!(backup);
+      await navigator.clipboard.writeText(formatProfileWriteProbeReportMarkdown(report));
+      setCaptureMessage(report.ok
+        ? "Write probe passed and the original profile was restored. Report copied."
+        : `Write probe failed. Recovery report copied; profile restored: ${report.restored}, mode restored: ${report.modeRestored}.`);
+    }).catch((error) => {
+      setCaptureMessage(error instanceof Error ? error.message : "Could not run the profile write probe.");
+    }).finally(() => {
+      button.disabled = false;
+    });
+  });
+
   document.querySelector<HTMLButtonElement>("#capture-reset")?.addEventListener("click", () => {
     snapshot = null;
     diffs = [];
diff --git a/src/control-template.ts b/src/control-template.ts
index 417bfb8b..82fa17ca 100644
--- a/src/control-template.ts
+++ b/src/control-template.ts
@@ -154,6 +154,7 @@ export function controlTemplate(buildLabel: string): string {
           <small style="color:#77777c;font-size:.64rem"><strong style="color:#a8a8ae">Verify a format:</strong> copy a read-only bundle containing the memory geometry, full directory, every profile and all CRC results. To map an individual setting, snapshot the profiles, change only that setting in G HUB or Onboard Memory Manager, compare, mark the change and copy the comparison.</small>
           <div style="display:flex;flex-wrap:wrap;gap:.4rem;align-items:center">
             <button id="capture-verification" type="button" class="is-primary">Copy verification data</button>
+            <button id="capture-write-probe" type="button" hidden style="border-color:#7d3038;background:#32181c;color:#ff9ca5">Verify profile writes</button>
             <button id="capture-snapshot" type="button">Snapshot profiles</button>
             <button id="capture-compare" type="button">Compare</button>
             <button id="capture-reset" type="button">Clear</button>
diff --git a/src/control.ts b/src/control.ts
index a3053887..93416bd8 100644
--- a/src/control.ts
+++ b/src/control.ts
@@ -69,10 +69,13 @@ import {
   capabilitiesForFormat,
   clampDpi,
   describeOffset,
+  dpiStageCapabilitiesForOptions,
   reportRatesFor,
+  reportRatesForDevice,
   validateProfileName,
-  validateReportRate,
   reproduceProfile,
+  supportsFactoryReset,
+  supportsProfileWriteProbe,
   stageLodLevel,
   validateBunnyHoppingMs,
   type DpiStageCapabilities,
@@ -493,7 +496,7 @@ function showSlotsPreview(): void {
     supportedPollingRates: [125, 250, 500, 1000, 2000, 4000, 8000],
     liftOffDistance: "Low",
     supportedLiftOffDistances: ["Low", "Medium", "High"],
-    onboardProfileFormat: { id: 7, name: "unnamed (v6 + bunny hopping)", base: "v6", supported: true, verified: true },
+    onboardProfileFormat: { id: 7, name: "unnamed (v6 + bunny hopping)", base: "v6", supported: true, verified: true, writable: true },
     gamingSurfaceMode: "Auto",
     lightforceSwitchMode: "Hybrid",
     activeProfile: 1,
@@ -766,15 +769,15 @@ function configureProfileCapture(status: MouseStatus | null): void {
   const logitechClient = status?.brand === "Logitech" ? activeClient as LogitechHidppClient | null : null;
   const formatId = status?.onboardProfileFormat?.id ?? null;
   const captureOpen = document.querySelector<HTMLButtonElement>("#capture-open");
-  if (captureOpen) captureOpen.hidden = logitechClient === null || formatId === null;
+  if (captureOpen) captureOpen.hidden = logitechClient === null;
   const resetButton = document.querySelector<HTMLButtonElement>("#reset-logitech-profiles");
   if (resetButton) {
-    resetButton.hidden = logitechClient === null || formatId === null;
-    const supported = formatId === 7;
-    resetButton.disabled = settingInProgress || !supported;
+    const supported = logitechClient !== null && supportsFactoryReset(formatId);
+    resetButton.hidden = !supported;
+    resetButton.disabled = settingInProgress;
     resetButton.title = supported
       ? "Permanently restore every onboard profile to Logitech defaults"
-      : `Factory defaults have not been captured for profile format ${formatId ?? "unknown"}`;
+      : "";
   }
   setCaptureContext({
     device: activeDevice ? describeHidDevice(activeDevice) : status?.name ?? null,
@@ -811,6 +814,22 @@ function configureProfileCapture(status: MouseStatus | null): void {
         reproduce: (before, after) => reproduceProfile(before, after, formatId),
       }
       : null,
+    writeProbe: logitechClient === null
+      ? null
+      : supportsProfileWriteProbe(formatId)
+        ? {
+          supported: true,
+          reason: `Run the guarded write probe for profile format ${formatId}`,
+          prepare: () => logitechClient.prepareProfileContentWriteProbe(),
+          run: (backup: Parameters<LogitechHidppClient["runProfileContentWriteProbe"]>[0]) =>
+            logitechClient.runProfileContentWriteProbe(backup),
+        }
+        : {
+          supported: false,
+          reason: formatId === null
+            ? "This Logitech mouse does not report an onboard-profile format"
+            : `The guarded write probe does not support profile format ${formatId}`,
+        },
   });
 }
 
@@ -2135,7 +2154,7 @@ function renderBunnyHop(): void {
   row.hidden = !supported;
   if (!supported || !active) return;
 
-  const locked = lastProfileFormat?.verified !== true;
+  const locked = lastProfileFormat?.writable !== true;
   // Show the staged value, so a background refresh cannot snap the control back
   // to what is still on the device.
   // A never-written byte counts as off, so the toggle starts in the off state
@@ -2180,7 +2199,9 @@ function dpiAxisLockedAt(index: number): boolean {
 
 function dpiSlotLimits(): DpiStageCapabilities | null {
   const format = lastProfileFormat;
-  return format ? capabilitiesForFormat(format.id).dpiStages : null;
+  return format
+    ? dpiStageCapabilitiesForOptions(capabilitiesForFormat(format.id).dpiStages, dpiOptions)
+    : null;
 }
 
 /**
@@ -2195,7 +2216,7 @@ function dpiSlotsAvailable(): boolean {
 
 /** True while the flash write sequence for stage tables is still unproven. */
 function dpiSlotsLocked(): boolean {
-  return !PROFILE_DPI_WRITES_ENABLED || lastProfileFormat?.verified !== true;
+  return !PROFILE_DPI_WRITES_ENABLED || lastProfileFormat?.writable !== true;
 }
 
 /**
@@ -2521,16 +2542,31 @@ function renameOnboardProfile(sector: number): void {
 let stagedProfileRates: { wireless: number | null; wired: number | null } = { wireless: null, wired: null };
 const PROFILE_RATE_KEY = "logitech-profile-rate";
 
+function profileReportRateOptions(link: "wireless" | "wired"): number[] {
+  const format = lastProfileFormat;
+  const rates = format ? capabilitiesForFormat(format.id).reportRates : null;
+  const activeLink = latestDeviceStatus?.connectionType === "Wireless" ? "wireless" : "wired";
+  return reportRatesForDevice(
+    rates,
+    link,
+    latestDeviceStatus?.supportedPollingRates ?? [],
+    activeLink,
+    (format?.id ?? 6) < 6,
+  );
+}
+
 function setProfileReportRate(link: "wireless" | "wired", hz: number): void {
   const entry = editedProfileEntry();
   if (!entry || !activeClient) return;
-  const rates = lastProfileFormat ? capabilitiesForFormat(lastProfileFormat.id).reportRates : null;
-  const invalid = validateReportRate(hz, rates, link);
-  if (invalid) {
-    setText("#polling-note", invalid);
+  // Formats 1-5 have one shared interval byte. Use the wired slot as the
+  // canonical staged value rather than pretending they store two rates.
+  const selectedLink = (lastProfileFormat?.id ?? 6) < 6 ? "wired" : link;
+  const allowed = profileReportRateOptions(selectedLink);
+  if (!allowed.includes(hz)) {
+    setText("#polling-note", `This mouse supports ${allowed.join(", ")} Hz for that profile link.`);
     return;
   }
-  stagedProfileRates = { ...stagedProfileRates, [link]: hz };
+  stagedProfileRates = { ...stagedProfileRates, [selectedLink]: hz };
 
   const stored = { wireless: entry.reportRateWireless, wired: entry.reportRateWired };
   const wanted = {
@@ -2547,8 +2583,8 @@ function setProfileReportRate(link: "wireless" | "wired", hz: number): void {
   stageChange({
     key: PROFILE_RATE_KEY,
     group: PROFILE_SECTOR_GROUP,
-    label: `${link === "wired" ? "Wired" : "Wireless"} ${hz.toLocaleString()} Hz`,
-    command: `Set profile ${link} report rate to ${hz} Hz`,
+    label: `${selectedLink === "wired" && (lastProfileFormat?.id ?? 6) >= 6 ? "Wired " : selectedLink === "wireless" ? "Wireless " : ""}${hz.toLocaleString()} Hz`,
+    command: `Set profile ${selectedLink} report rate to ${hz} Hz`,
     progress: "Writing the report rate to the profile…",
     // No preview: profile rates are not part of MouseStatus.
     apply: writeStagedProfileSector,
@@ -2574,21 +2610,29 @@ function renderProfileRates(): void {
   }
   if (!available || !entry || !rates) return;
 
-  const locked = lastProfileFormat?.verified !== true;
-  for (const link of ["wireless", "wired"] as const) {
+  const locked = lastProfileFormat?.writable !== true;
+  const shared = (lastProfileFormat?.id ?? 6) < 6;
+  const wirelessSlider = document.querySelector<HTMLElement>("#profile-rate-wireless");
+  const wiredSlider = document.querySelector<HTMLElement>("#profile-rate-wired");
+  if (wirelessSlider) wirelessSlider.hidden = shared;
+  if (wiredSlider) wiredSlider.hidden = false;
+  const links: Array<"wireless" | "wired"> = shared ? ["wired"] : ["wireless", "wired"];
+  for (const link of links) {
     const value = stagedProfileRates[link]
       ?? (link === "wired" ? entry.reportRateWired : entry.reportRateWireless);
     renderRateSlider(
       document.querySelector<HTMLElement>(`#profile-rate-${link}`),
-      reportRatesFor(rates, link),
+      profileReportRateOptions(link),
       value,
-      { label: link === "wired" ? "Wired" : "Wireless", disabled: locked || settingInProgress },
+      { label: shared ? "All connections" : link === "wired" ? "Wired" : "Wireless", disabled: locked || settingInProgress },
     );
   }
 
-  setText("#polling-note", `Stored in this profile, one rate per link. Up to ${
-    reportRatesFor(rates, "wireless").at(-1)?.toLocaleString()} Hz wireless, ${
-    reportRatesFor(rates, "wired").at(-1)?.toLocaleString()} Hz over the cable.`);
+  setText("#polling-note", shared
+    ? `Stored in this profile as one shared interval, up to ${profileReportRateOptions("wired").at(-1)?.toLocaleString()} Hz.`
+    : `Stored in this profile, one rate per link. Up to ${
+      reportRatesFor(rates, "wireless").at(-1)?.toLocaleString()} Hz wireless, ${
+      reportRatesFor(rates, "wired").at(-1)?.toLocaleString()} Hz over the cable.`);
 }
 
 function renderDpiSlots(): void {
@@ -2629,6 +2673,7 @@ function renderDpiSlots(): void {
 
   const locked = dpiSlotsLocked();
   const levels = lastProfileFormat ? capabilitiesForFormat(lastProfileFormat.id).supportedLods : [];
+  const profileHasLod = levels.length > 0;
 
   // The preset row writes host DPI, so it stands down while slots are shown.
   const presets = document.querySelector<HTMLElement>("#dpi-presets");
@@ -2666,7 +2711,7 @@ function renderDpiSlots(): void {
         <button type="button" class="dpi-axis-lock${axisLocked ? " is-locked" : ""}" data-dpi-axis-lock="${index}"${locked ? " disabled" : ""} title="${axisLocked ? "X and Y are linked — click to set them separately" : "X and Y are separate — click to link them"}" aria-label="Link X and Y for slot ${index + 1}" aria-pressed="${axisLocked}">${axisLocked ? ICON_LINKED : ICON_UNLINKED}</button>
         <input type="number" data-dpi-slot="${index}" data-dpi-axis="y" aria-label="Slot ${index + 1} Y DPI" min="${limits.minDpi}" max="${limits.maxDpi}" step="${limits.stepDpi}" value="${stage.y}"${locked || axisLocked ? " disabled" : ""} />
         <div class="lod-select" data-lod-select="${index}">
-          <button type="button" class="lod-select-value" data-lod-toggle="${index}"${locked ? " disabled" : ""} aria-haspopup="listbox" aria-expanded="false" aria-label="Slot ${index + 1} lift-off"><span>${level ?? "—"}</span><i aria-hidden="true"></i></button>
+          <button type="button" class="lod-select-value" data-lod-toggle="${index}"${locked || !profileHasLod ? " disabled" : ""} aria-haspopup="listbox" aria-expanded="false" aria-label="Slot ${index + 1} lift-off" title="${profileHasLod ? "Set lift-off distance" : "This profile format has no lift-off setting"}"><span>${level ?? "—"}</span><i aria-hidden="true"></i></button>
           <ul class="lod-select-menu" role="listbox" data-dpi-slot-lod="${index}" aria-label="Slot ${index + 1} lift-off">${lodOptions}</ul>
         </div>
       </div>`;
@@ -2700,7 +2745,7 @@ async function reloadOnboardProfiles(): Promise<void> {
 
 async function resetLogitechProfiles(): Promise<void> {
   const client = activeClient;
-  if (!client || settingInProgress || lastProfileFormat?.id !== 7) return;
+  if (!client || settingInProgress || !supportsFactoryReset(lastProfileFormat?.id)) return;
 
   const stagedWarning = hasPendingChanges()
     ? "\n\nYour staged, unflashed changes will also be discarded."
@@ -2825,6 +2870,7 @@ function renderOnboardProfiles(): void {
   const hostOpened = editedProfile === "host";
   const hostRunning = lastDeviceMode === "Host";
   const profileLayoutVerified = lastProfileFormat?.verified === true;
+  const profileContentsWritable = lastProfileFormat?.writable === true;
   const profileNameLimit = lastProfileFormat ? capabilitiesForFormat(lastProfileFormat.id).maxNameLength : null;
   // Host is a live, volatile source rather than a stored profile, so it is
   // listed apart from them rather than mixed in.
@@ -2875,7 +2921,7 @@ function renderOnboardProfiles(): void {
           <small style="color:#77777c;font-size:.62rem">${escapeHtml(detail)}</small>
         </span>
       </button>
-      <button type="button" data-profile-rename="${profile.sector}" ${locked || !nameable ? "disabled" : ""} title="${!nameable ? "This profile format has no name field" : "Rename this profile"}" aria-label="Rename profile ${profile.sector}" style="display:flex;padding:.3rem;border:1px solid #3a3a3f;border-radius:5px;background:#19191c;cursor:${locked || !nameable ? "not-allowed" : "pointer"};opacity:${locked || !nameable ? ".4" : "1"}">
+      <button type="button" data-profile-rename="${profile.sector}" ${locked || !nameable || !profileContentsWritable ? "disabled" : ""} title="${!nameable ? "This profile format has no name field" : !profileContentsWritable ? "Profile-content writes have not been verified on hardware" : "Rename this profile"}" aria-label="Rename profile ${profile.sector}" style="display:flex;padding:.3rem;border:1px solid #3a3a3f;border-radius:5px;background:#19191c;cursor:${locked || !nameable || !profileContentsWritable ? "not-allowed" : "pointer"};opacity:${locked || !nameable || !profileContentsWritable ? ".4" : "1"}">
         ${ICON_RENAME}
       </button>
       <button type="button" data-profile-activate="${profile.sector}" ${locked || running || !profile.enabled ? "disabled" : ""} title="${running ? "The mouse is running this profile" : !profile.enabled ? "Enable this profile before switching to it" : "Switch the mouse to this profile"}" aria-label="Switch to profile ${profile.sector}" aria-pressed="${running}" style="display:flex;padding:.3rem;border:1px solid ${running ? "#4a4a52" : "#3a3a3f"};border-radius:5px;background:#19191c;cursor:${locked || running || !profile.enabled ? "not-allowed" : "pointer"};opacity:${locked || !profile.enabled ? ".4" : "1"}">
diff --git a/src/devices/logitech/TESTING.md b/src/devices/logitech/TESTING.md
deleted file mode 100644
index 4ab450c5..00000000
--- a/src/devices/logitech/TESTING.md
+++ /dev/null
@@ -1,92 +0,0 @@
-# Logitech hardware test checklist
-
-Test in Chrome or Edge over HTTPS. Close Logitech G HUB and Logitech Gaming
-Software first — they hold the same vendor interface open and the mouse will
-stop answering. Select the vendor collection (`usagePage 0xff00`, `usage
-0x0001`), not the plain pointer collection.
-
-Supported identifiers:
-
-- `046d:c54d`, `046d:c547` — Lightspeed receivers
-- `046d:c539` — HERO-era Lightspeed receiver
-- `046d:c0a8` — PRO X 2 Superstrike (USB)
-- `046d:c07e` — G402 / G402 Hyperion Fury (wired)
-- `046d:c08f` — G403 HERO (wired)
-
-## Receiver-attached and Superstrike devices
-
-1. Confirm the model, battery, connection type, DPI, polling rate, and
-   lift-off distance are read correctly.
-2. Change one setting at a time and confirm each write, then reload and confirm
-   it persisted.
-
-## G402 (direct-connect, HID++ device index `0xFF`)
-
-The G402 is addressed as the mouse itself rather than a receiver slot, and it
-exposes only the legacy feature set: Adjustable DPI `0x2201` and Report Rate
-`0x8060`. It has no lift-off, gaming-surface, battery, or hall-effect controls,
-so those cards stay hidden.
-
-1. Confirm the sidebar and title show the mouse, and that the connection reads
-   **Wired**.
-2. Confirm the firmware list and the HID++ device details section populate.
-3. Confirm the DPI presets offer 420 / 840 / 1596 / 3192 — the nearest steps on
-   the G402's 84-DPI grid — and that the reported DPI matches what Logitech
-   Gaming Software shows, allowing for its rounding (2436 is shown as "2400").
-4. Stage a DPI change and flash it. The driver writes `0x2201` function 3 as a
-   short request and re-reads the value; a mismatch is reported as an error
-   rather than being assumed to have worked.
-5. Confirm the sensor card (lift-off distance) is hidden — the G402 has no
-   `0x2202` feature to drive it.
-6. Confirm the polling-rate buttons show the active rate but are **disabled**,
-   with the note explaining the rate lives in the onboard profile.
-7. Confirm the mouse stays in onboard mode: its own DPI-stage buttons must keep
-   working after OpenMouse writes a DPI value. The driver deliberately does not
-   switch the G402 into host-control mode.
-8. Reload the page and confirm the DPI written in step 4 is still reported.
-
-## G403 HERO (direct-connect, HID++ device index `0xFF`)
-
-The G403 HERO reports HID++ 4.2 and takes the same direct-connect path as the
-G402: legacy Adjustable DPI `0x2201` and legacy Report Rate `0x8060`, no
-`0x2202`, so the lift-off/sensor card stays hidden. Its sensor range is much
-wider (100–25,600 DPI in steps of 50) and its onboard profile uses format `2`
-with seven 256-byte sectors, so none of the G402's profile offsets apply to it.
-
-1. Confirm the sidebar and title show the mouse and the connection reads
-   **Wired**.
-2. Confirm the firmware list and the HID++ device details section populate.
-3. Confirm the DPI presets offer 400 / 800 / 1600 / 3200 / 6400 / 8000 — all
-   exact multiples on the 50-DPI grid — and that the reported DPI matches G HUB.
-4. Stage a DPI change and flash it. The driver writes `0x2201` function 3 as a
-   short request and re-reads the value; a mismatch is reported as an error.
-5. Confirm the polling-rate buttons show the active rate but are **disabled**.
-   The reference trace shows `0x8060` advertising 125/250/500/1000 Hz, and its
-   function 2 is not a verified setter on this generation.
-6. Confirm the mouse stays in onboard mode: its own DPI-stage button must keep
-   working after OpenMouse writes a DPI value.
-7. Reload the page and confirm the DPI written in step 4 is still reported.
-
-RGB lighting (`0x8070`, logo and wheel zones) is deliberately not implemented —
-the write packet is unverified and the panel has no Logitech lighting controls.
-
-Persistent polling-rate and DPI-stage changes need a CRC-checked rewrite of the
-1024-byte profile sector and are intentionally not implemented. Record the
-device identifier, protocol version, and any failing setting in the issue or
-pull request. Do not use factory reset during initial testing.
-
-## G309 LIGHTSPEED (receiver-attached, Model ID `B03C40B10000`)
-
-The G309 exposes Extended Adjustable DPI `0x2202` and Mode Status `0x8090`, but
-only the power-mode half of Mode Status is meaningful: the status1 byte that
-would carry the gaming-surface and LightForce fields is reserved and reads 0.
-The `0x2202` sensor likewise reports lift-off level 0, the feature's "no
-lift-off control" value. OpenMouse treats both as absent, so those cards stay
-hidden.
-
-1. Confirm the model, battery, connection type, DPI, and polling rate are read
-   correctly.
-2. Confirm the sensor card (lift-off distance), the gaming-surface card, and
-   the LightForce switch are all hidden.
-3. Change the DPI and polling rate and confirm each write persists after a
-   reload.
diff --git a/src/devices/logitech/hidpp.test.ts b/src/devices/logitech/hidpp.test.ts
index fb5374e6..cab4432a 100644
--- a/src/devices/logitech/hidpp.test.ts
+++ b/src/devices/logitech/hidpp.test.ts
@@ -7,23 +7,14 @@ import {
   decodeBatteryLevelState,
   decodeReportRateBitmap,
   decodeUnifiedBatteryState,
-  hidppDeviceIndex,
   hidpp10ErrorMessage,
   hidppErrorForRequest,
   hidppErrorMessage,
   isDirectConnection,
-  isDirectConnectProduct,
   OnboardOnlyError,
-  legacyDpiFallback,
   withSoftwareId,
 } from "./protocol.ts";
-
-import { hasLiftOffControl, isPowerOnlyModeStatus } from "./hidpp.ts";
-
-const G402 = 0xc07e;
-const G403_HERO = 0xc08f;
-const LIGHTSPEED_RECEIVER = 0xc54d;
-const SUPERSTRIKE_USB = 0xc0a8;
+import { isWiredHidppConnection, supportsLiveLiftOffControl } from "./hidpp.ts";
 
 test("HID++ requests use a nonzero software ID", () => {
   assert.equal(withSoftwareId(0x00), 0x05);
@@ -35,27 +26,24 @@ test("HID++ software ID replaces an existing low nibble", () => {
   assert.equal(withSoftwareId(0x1e), 0x15);
 });
 
-test("wired G402 and G403 HERO are addressed as the mouse itself, not a receiver slot", () => {
-  for (const productId of [G402, G403_HERO]) {
-    assert.equal(isDirectConnectProduct(productId), true);
-    assert.equal(hidppDeviceIndex(productId), DEVICE_INDEX_DIRECT);
-    assert.equal(hidppDeviceIndex(productId), 0xff);
-  }
+test("runtime probing alone classifies direct and receiver connections", () => {
+  assert.equal(isDirectConnection(DEVICE_INDEX_DIRECT), true);
+  assert.equal(isDirectConnection(DEVICE_INDEX_RECEIVER), false);
+  assert.equal(isDirectConnection(null), false);
 });
 
-test("receiver-attached and USB Superstrike devices keep index 0x01", () => {
-  for (const productId of [LIGHTSPEED_RECEIVER, 0xc539, 0xc547, SUPERSTRIKE_USB]) {
-    assert.equal(isDirectConnectProduct(productId), false);
-    assert.equal(hidppDeviceIndex(productId), DEVICE_INDEX_RECEIVER);
-  }
+test("extended DPI does not imply lift-off or mode-status controls", () => {
+  assert.equal(supportsLiveLiftOffControl(false, null), false, "0 means no LOD control");
+  assert.equal(supportsLiveLiftOffControl(true, "Medium"), false, "legacy DPI has no LOD field");
+  assert.equal(supportsLiveLiftOffControl(false, "Low"), true);
 });
 
-test("runtime probing classifies unknown wired mice as direct connections", () => {
-  const unknownG102ProductId = 0xc084;
-  assert.equal(isDirectConnectProduct(unknownG102ProductId), false);
-  assert.equal(isDirectConnection(unknownG102ProductId, DEVICE_INDEX_DIRECT), true);
-  assert.equal(isDirectConnection(unknownG102ProductId, DEVICE_INDEX_RECEIVER), false);
-  assert.equal(isDirectConnection(G402, null), true, "known PIDs still use the pre-probe fast path");
+test("the active transport comes from HID++ identity instead of a product exception", () => {
+  const transports = { USB: "C0A8", Wireless: "40BD" };
+  assert.equal(isWiredHidppConnection(0xc0a8, transports, false), true);
+  assert.equal(isWiredHidppConnection(0x40bd, transports, false), false);
+  assert.equal(isWiredHidppConnection(0xc54d, transports, false), false, "receiver PID is not the mouse's USB transport");
+  assert.equal(isWiredHidppConnection(0xc07e, {}, true), true, "old direct devices use the probed-index fallback");
 });
 
 test("the legacy report-rate bitmap decodes the G402's advertised rates", () => {
@@ -94,36 +82,6 @@ test("an unrecognised HID++ error still reports its raw code", () => {
   assert.match(hidppErrorMessage(0x7f), /0x7f/);
 });
 
-test("the legacy DPI fallback matches the grid G402 hardware advertises", () => {
-  // Captured from hardware: getSensorDpiList replied 00 FC | E0 54 | 0F C0,
-  // meaning minimum 252, range step 84, maximum 4032.
-  const options = legacyDpiFallback(G402);
-  assert.equal(options[0], 252);
-  assert.equal(options.at(-1), 4032);
-  assert.equal(options.every((dpi, index) => index === 0 || dpi - options[index - 1] === 84), true);
-  // The value the mouse reports while vendor software displays "2400".
-  assert.equal(options.includes(2436), true);
-});
-
-test("the legacy DPI fallback covers the G403 HERO's 100-25,600 range", () => {
-  const options = legacyDpiFallback(G403_HERO);
-  assert.equal(options[0], 100);
-  assert.equal(options.at(-1), 25600);
-  assert.equal(options.every((dpi, index) => index === 0 || dpi - options[index - 1] === 50), true);
-  // The DPI values the preset buttons offer must all be on the grid.
-  for (const dpi of [400, 800, 1600, 3200, 6400, 8000]) {
-    assert.equal(options.includes(dpi), true);
-  }
-});
-
-test("the legacy DPI fallback stays empty for receiver-attached mice", () => {
-  // Those answer getSensorDpiList properly, and inventing a grid for them would
-  // offer DPI values their sensor may not have.
-  for (const productId of [LIGHTSPEED_RECEIVER, SUPERSTRIKE_USB]) {
-    assert.deepEqual(legacyDpiFallback(productId), []);
-  }
-});
-
 test("the two battery features use different charging enums", () => {
   // 0x1004 UNIFIED_BATTERY.
   assert.equal(decodeUnifiedBatteryState(0x00), "Discharging");
@@ -158,25 +116,3 @@ test("an onboard-only mouse is told how to get itself supported", () => {
   assert.doesNotMatch(unknown.message, /format (\d|null)/);
   assert.match(unknown.message, /Copy verification data/);
 });
-
-test("the G309's mode status is power-only and exposes no surface or LightForce controls", () => {
-  // Model id captured from hardware: 0x8090 V2 with only the power-mode half.
-  assert.equal(isPowerOnlyModeStatus("B03C40B10000"), true);
-  // Every other model keeps the status1 fields, and unknown/absent ids must
-  // not be silently downgraded.
-  assert.equal(isPowerOnlyModeStatus("B03C40B10001"), false);
-  assert.equal(isPowerOnlyModeStatus(""), false);
-  assert.equal(isPowerOnlyModeStatus(null), false);
-  assert.equal(isPowerOnlyModeStatus(undefined), false);
-});
-
-test("a sensor without lift-off control advertises no lift-off levels", () => {
-  // 0x2201 legacy DPI carries no lod byte at all.
-  assert.equal(hasLiftOffControl(true, null), false);
-  // 0x2202 byte 0 is the "no lift-off control" value, as on the G309.
-  assert.equal(hasLiftOffControl(false, 0), false);
-  assert.equal(hasLiftOffControl(false, null), false);
-  // The levels 1-4 (Low/Medium/High/Extra high) are driveable.
-  assert.equal(hasLiftOffControl(false, 1), true);
-  assert.equal(hasLiftOffControl(false, 2), true);
-});
diff --git a/src/devices/logitech/hidpp.ts b/src/devices/logitech/hidpp.ts
index c68d9deb..a4e04ef6 100644
--- a/src/devices/logitech/hidpp.ts
+++ b/src/devices/logitech/hidpp.ts
@@ -5,12 +5,9 @@ import {
   decodeBatteryLevelState,
   decodeReportRateBitmap,
   decodeUnifiedBatteryState,
-  hidppDeviceIndex,
   hidppErrorForRequest,
   isDirectConnection,
-  isDirectConnectProduct,
   OnboardOnlyError,
-  legacyDpiFallback,
   withSoftwareId,
 } from "./protocol.ts";
 import {
@@ -24,11 +21,13 @@ import {
 import {
   ONBOARD_MODE,
   PROFILE_FN,
+  PROFILE_NAME_MAX_CHARS,
   applyCrc,
   capabilitiesForFormat,
   decodeLiftOffLevel,
   decodeOnboardProfile,
   describeProfileFormat,
+  dpiStageCapabilitiesForOptions,
   encodeDpiStages,
   encodeProfileName,
   encodeReportRate,
@@ -39,8 +38,10 @@ import {
   parseDirectory,
   parseProfilesInfo,
   profileCrc,
+  reportRatesForDevice,
   setDirectoryEnabled,
   storedCrc,
+  supportsProfileWriteProbe,
   validateBunnyHoppingMs,
   type OnboardProfile,
   type ProfileFormatCapabilities,
@@ -60,6 +61,18 @@ export interface OnboardProfileVerification {
   directory: Uint8Array;
   directoryCrcValid: boolean;
   profiles: OnboardProfile[];
+  dpiCapabilities: VerificationCapability | null;
+  reportRateCapabilities: VerificationCapability | null;
+}
+
+export interface VerificationCapability {
+  featureId: number;
+  featureIndex: number;
+  featureVersion: number;
+  kind: "legacy" | "extended";
+  replies: Array<{ name: string; bytes: Uint8Array }>;
+  decodedValues: number[];
+  error: string | null;
 }
 
 /**
@@ -97,6 +110,35 @@ export interface ProfileWriteProbe {
   restored: boolean;
 }
 
+export interface ProfileContentWriteProbeBackup {
+  formatId: number;
+  sector: number;
+  sectorSize: number;
+  originalMode: "Onboard" | "Host";
+  originalCurrentSector: number;
+  directory: Uint8Array;
+  profile: Uint8Array;
+  dpiOptions: number[];
+  reportRates: number[];
+}
+
+export interface ProfileContentWriteProbeStep {
+  setting: "name" | "dpi" | "polling";
+  intended: string;
+  storedExactly: boolean;
+  liveConfirmed: boolean | null;
+  restored: boolean;
+  error: string | null;
+}
+
+export interface ProfileContentWriteProbeReport {
+  backup: ProfileContentWriteProbeBackup;
+  steps: ProfileContentWriteProbeStep[];
+  restored: boolean;
+  modeRestored: boolean;
+  ok: boolean;
+}
+
 /**
  * A Logitech device that speaks HID++ but exposes no sensor, so it is not a
  * mouse. Its own type so the shell can report it as a wrong choice rather than
@@ -118,34 +160,6 @@ export class NotAMouseError extends Error {
 }
 
 const LOGITECH_VENDOR_ID = 0x046d;
-// HID++ control interfaces, including the PRO X 2 Superstrike USB interface.
-const LOGITECH_RECEIVER_PRODUCT_IDS = new Set([0xc54d, 0xc539, 0xc0a8, 0xc547]);
-
-/**
- * Models whose 0x8090 mode-status feature drives the power-mode switch only.
- * The status1 byte that carries the gaming-surface and LightForce fields is
- * reserved on them and reads 0, which would otherwise decode as "Auto" and
- * "Optical" and offer controls the mouse does not have. Keyed on the firmware
- * model id, like the Superstrike detection.
- */
-const MODE_STATUS_POWER_ONLY_MODEL_IDS: ReadonlySet<string> = new Set([
-  "B03C40B10000", // G309 LIGHTSPEED
-]);
-
-/** Whether 0x8090 on this model is the power-mode-only variant. */
-export function isPowerOnlyModeStatus(modelId: string | null | undefined): boolean {
-  return MODE_STATUS_POWER_ONLY_MODEL_IDS.has(modelId ?? "");
-}
-
-/**
- * Whether the mouse exposes lift-off levels it can drive: only extended DPI
- * (0x2202) carries one, and its byte 0 is the "no lift-off control" value, so
- * a legacy-DPI mouse or a sensor reporting 0 advertises no levels.
- */
-export function hasLiftOffControl(legacyDpi: boolean, lodByte: number | null): boolean {
-  return !legacyDpi && lodByte !== null && lodByte !== 0;
-}
-
 const SHORT_REPORT_ID = 0x10;
 const LONG_REPORT_ID = 0x11;
 const FEATURE = {
@@ -176,6 +190,36 @@ const REPORT_RATE_HZ = [125, 250, 500, 1000, 2000, 4000, 8000] as const;
 
 export type LogitechMouseStatus = MouseStatus;
 
+/**
+ * Extended DPI alone does not imply adjustable lift-off distance. Some mice,
+ * including the G309, expose 0x2202 but return the protocol's "no LOD control"
+ * value. Legacy DPI never carries LOD either.
+ */
+export function supportsLiveLiftOffControl(
+  legacyDpi: boolean,
+  liftOffDistance: LogitechMouseStatus["liftOffDistance"],
+): boolean {
+  return !legacyDpi && liftOffDistance !== null;
+}
+
+/**
+ * Resolves the active physical link from HID++ identity transport IDs. A
+ * receiver's USB PID does not match the paired mouse's Wireless transport ID;
+ * a mouse connected by cable matches its own USB transport ID. Direct-index
+ * probing remains the fallback for older devices that omit identity data.
+ */
+export function isWiredHidppConnection(
+  productId: number,
+  transportIds: Record<string, string>,
+  directIndex: boolean,
+): boolean {
+  const activeId = productId.toString(16).padStart(4, "0").toUpperCase();
+  const activeTransport = Object.entries(transportIds)
+    .find(([, transportId]) => transportId.toUpperCase() === activeId)?.[0];
+  if (activeTransport !== undefined) return activeTransport === "USB";
+  return directIndex;
+}
+
 interface BatteryReading {
   percent: number | null;
   state: LogitechMouseStatus["batteryState"];
@@ -217,12 +261,13 @@ export class LogitechHidppClient {
   private dpiFeatureResolved: ResolvedFeature | null = null;
   private rateFeatureResolved: ResolvedFeature | null = null;
   private reportRateFeatureIndex: number | null = null;
+  private supportedPollingRatesCache: number[] | null = null;
   private livePollingRateHz: number | null = null;
   /** Discovered by resolveDeviceIndex; null until the mouse has answered. */
   private resolvedDeviceIndex: number | null = null;
   /** Last format read from 0x8100, so a refusal can name it. */
   private profileFormatId: number | null = null;
-  private isSuperstrikeDevice = false;
+  private wiredConnection = false;
   /** Lift-off levels this device advertised; the single source of truth for both UI and validation. */
   private lodCapabilities: ProfileFormatCapabilities = capabilitiesForFormat(null);
   private supportedLods: Array<NonNullable<LogitechMouseStatus["liftOffDistance"]>> = ["Medium", "High"];
@@ -281,18 +326,17 @@ export class LogitechHidppClient {
   }
 
   /**
-   * True when the vendor interface belongs to the mouse itself (G402, G403
-   * HERO) instead of a receiver. Written as a getter because
-   * `useDefineForClassFields` runs field initializers before the `device`
-   * parameter property is assigned.
+   * True when the vendor interface belongs to the mouse itself instead of a
+   * receiver. Written as a getter because `useDefineForClassFields` runs
+   * field initializers before the `device` parameter property is assigned.
    */
   private get isDirectConnect(): boolean {
-    return isDirectConnection(this.device.productId, this.resolvedDeviceIndex);
+    return isDirectConnection(this.resolvedDeviceIndex);
   }
 
   /** HID++ device index: the receiver's first slot, or the mouse itself. */
   private get deviceIndex(): number {
-    return this.resolvedDeviceIndex ?? hidppDeviceIndex(this.device.productId);
+    return this.resolvedDeviceIndex ?? DEVICE_INDEX_DIRECT;
   }
 
   /**
@@ -300,23 +344,13 @@ export class LogitechHidppClient {
    *
    * A mouse reached through its receiver answers on the receiver's pairing slot
    * (0x01); the same mouse plugged in by cable answers as itself (0xFF). That
-   * cannot be read from the descriptors, and deriving it from a list of product
-   * ids only works for the handful of ids on the list — every other mouse
-   * plugged in directly was addressed as a receiver and never replied.
-   *
-   * So ask. The root feature query is the cheapest request there is, and the
-   * wrong index simply times out.
+   * cannot be read from descriptors or safely derived from product IDs. Probe
+   * both indexes and choose the one that exposes a DPI sensor feature.
    */
   private async resolveDeviceIndex(): Promise<void> {
     if (this.resolvedDeviceIndex !== null) return;
-    // Only a receiver forwards to a pairing slot; anything else is the mouse's
-    // own endpoint and answers as itself. Ordering by "is this a known
-    // receiver" rather than by the direct-connect id list matters for mice that
-    // are on neither list — a wired G102 is its own endpoint, and asking it as
-    // though it were behind a receiver is what made it look mode-locked.
-    const candidates = LOGITECH_RECEIVER_PRODUCT_IDS.has(this.device.productId)
-      ? [DEVICE_INDEX_RECEIVER, DEVICE_INDEX_DIRECT]
-      : [DEVICE_INDEX_DIRECT, DEVICE_INDEX_RECEIVER];
+    const candidates = [DEVICE_INDEX_DIRECT, DEVICE_INDEX_RECEIVER];
+    let firstAnsweringIndex: number | null = null;
 
     for (const candidate of candidates) {
       this.resolvedDeviceIndex = candidate;
@@ -325,7 +359,22 @@ export class LogitechHidppClient {
       const answered = await this.request(0x00, 0x00, FEATURE.firmware >> 8, FEATURE.firmware & 0xff)
         .then(() => true)
         .catch((error: unknown) => !(error instanceof HidppTimeoutError));
-      if (answered) return;
+      if (!answered) continue;
+      firstAnsweringIndex ??= candidate;
+
+      // A receiver can answer root requests at 0xFF even though the paired
+      // mouse lives at 0x01. A sensor feature identifies the actual mouse
+      // index without a receiver or device PID list.
+      for (const sensorFeature of [FEATURE.extendedDpi, FEATURE.adjustableDpi]) {
+        const reply = await this.request(0x00, 0x00, sensorFeature >> 8, sensorFeature & 0xff).catch(() => null);
+        if ((reply?.[3] ?? 0) !== 0) return;
+      }
+    }
+    // Preserve the useful NotAMouseError path for a responding Logitech
+    // keyboard or headset; readStatus will find no DPI feature there.
+    if (firstAnsweringIndex !== null) {
+      this.resolvedDeviceIndex = firstAnsweringIndex;
+      return;
     }
     this.resolvedDeviceIndex = null;
     throw new Error("The mouse did not answer on any HID++ device index.");
@@ -346,24 +395,17 @@ export class LogitechHidppClient {
     return hasHidppCollection(device.collections);
   }
 
-  /** Known receivers, kept as the fast path for the WebHID picker's filters. */
-  static isKnownReceiver(device: HIDDevice): boolean {
-    return device.vendorId === LOGITECH_VENDOR_ID
-      && (LOGITECH_RECEIVER_PRODUCT_IDS.has(device.productId) || isDirectConnectProduct(device.productId));
-  }
-
   static async requestReceiver(): Promise<LogitechHidppClient | null> {
     if (!navigator.hid) {
       throw new Error("WebHID is unavailable. Use Chrome or Edge on desktop.");
     }
 
     const devices = await navigator.hid.requestDevice({
-      filters: [...LOGITECH_RECEIVER_PRODUCT_IDS].map((productId) => ({
+      filters: [{
         vendorId: LOGITECH_VENDOR_ID,
-        productId,
         usagePage: 0xff00,
         usage: 0x0001,
-      })),
+      }],
     });
     const device = devices[0];
     return device ? new LogitechHidppClient(device) : null;
@@ -428,9 +470,7 @@ export class LogitechHidppClient {
     const supportsSeparateDpiAxes = dpiFeature.legacy
       ? false
       : await this.readDpiCapabilities(dpiFeature.index);
-    const supportedPollingRates = reportRateFeature.legacy
-      ? await this.readLegacyReportRates(reportRateFeature.index)
-      : await this.readSupportedPollingRates(reportRateFeature.index);
+    const supportedPollingRates = await this.getSupportedPollingRateOptions();
     const pollingRateHz = reportRateFeature.legacy
       ? await this.readLegacyReportRate(reportRateFeature.index)
       : await this.readPollingRate(reportRateFeature.index);
@@ -441,21 +481,28 @@ export class LogitechHidppClient {
       : undefined;
     const modeStatusFeature = await this.getFeature(FEATURE.modeStatus);
     const modeStatus = modeStatusFeature.index ? await this.readModeStatus(modeStatusFeature.index) : null;
-    const modeStatusCarriesControls = !isPowerOnlyModeStatus(identity.modelId);
     // One extra request; the layout it selects is worth surfacing in diagnostics.
     const onboardProfileFormat = profilesFeature.index
       ? await this.request(profilesFeature.index, PROFILE_FN.getInfo)
         .then((reply) => describeProfileFormat(parseProfilesInfo(reply).profileFormatId))
         .catch(() => null)
       : null;
-    const isSuperstrike = this.isSuperstrike(identity);
-    this.isSuperstrikeDevice = isSuperstrike;
     // Keyed on the reported profile format, not the model, so another mouse on
     // the same format gets the same limits without being named here.
     this.profileFormatId = onboardProfileFormat?.id ?? null;
     this.lodCapabilities = capabilitiesForFormat(onboardProfileFormat?.id);
     this.supportedLods = [...this.lodCapabilities.supportedLods];
-    const wired = this.device.productId === 0xc0a8 || this.isDirectConnect;
+    const wired = isWiredHidppConnection(this.device.productId, identity.transportIds, this.isDirectConnect);
+    this.wiredConnection = wired;
+    const liftOffDistance = decodeLiftOffLevel(dpiState.lod, this.lodCapabilities);
+    const hasLiveLiftOffControl = supportsLiveLiftOffControl(dpiFeature.legacy, liftOffDistance);
+    const rateLimits = this.lodCapabilities.reportRates;
+    const connectionRateCeiling = rateLimits
+      ? (wired ? rateLimits.wiredMaxHz : rateLimits.wirelessMaxHz)
+      : null;
+    const effectiveSupportedPollingRates = connectionRateCeiling
+      ? supportedPollingRates.filter((rate) => rate <= connectionRateCeiling)
+      : supportedPollingRates;
 
     return {
       brand: "Logitech",
@@ -478,33 +525,33 @@ export class LogitechHidppClient {
       dpiY: dpiState.dpiY,
       supportsSeparateDpiAxes,
       analogButtonTuning,
-      liftOffDistance: decodeLiftOffLevel(dpiState.lod, this.lodCapabilities),
+      liftOffDistance,
       onboardProfileFormat,
-      gamingSurfaceMode: modeStatus === null || !modeStatusCarriesControls
+      // HID++ exposes no per-field support mask for status1. A power-only
+      // variant can leave it reserved at zero, which would falsely decode as
+      // Surface Auto and LightForce Optical. Only expose that control bank when
+      // the sensor positively reports the related live LOD capability; this is
+      // deliberately conservative and avoids a product/model exception.
+      gamingSurfaceMode: modeStatus === null || !hasLiveLiftOffControl
         ? null
         : decodeModeStatus(modeStatus, MODE_STATUS.gamingSurface),
-      lightforceSwitchMode: modeStatus === null || !modeStatusCarriesControls
+      lightforceSwitchMode: modeStatus === null || !hasLiveLiftOffControl
         ? null
         : decodeModeStatus(modeStatus, MODE_STATUS.lightforce),
-      // The USB connection exposes the Superstrike as a 1 kHz device. Its
-      // Lightspeed receiver can use the higher rates advertised by HID++.
-      pollingRateHz: isSuperstrike && wired ? Math.min(pollingRateHz, 1000) : pollingRateHz,
-      supportedPollingRates: isSuperstrike && wired
-        ? supportedPollingRates.filter((rate) => rate <= 1000)
-        : supportedPollingRates,
+      // Some profile formats have different wired and wireless ceilings. The
+      // active transport comes from HID++ identity rather than a USB PID.
+      pollingRateHz: connectionRateCeiling ? Math.min(pollingRateHz, connectionRateCeiling) : pollingRateHz,
+      supportedPollingRates: effectiveSupportedPollingRates,
       // Lift-off distance is only reachable through extended DPI (0x2202). On a
       // mouse that exposes just legacy 0x2201 there is nothing to drive, so
       // report an empty set rather than offering buttons that can only fail.
-      // The same applies when the sensor reports no lift-off level (byte 0 is
-      // the feature's "no lift-off control" value), which is how a 0x2202 mouse
-      // without LOD, like the G309, advertises its lack of one. Otherwise the
-      // levels come from the profile format, which is where the count and the
-      // byte encoding are both established.
-      supportedLiftOffDistances: hasLiftOffControl(dpiFeature.legacy, dpiState.lod) ? this.supportedLods : [],
+      // Otherwise the levels come from the profile format, which is where the
+      // count and the byte encoding are both established.
+      supportedLiftOffDistances: hasLiveLiftOffControl ? this.supportedLods : [],
       connectionType: wired ? "Wired" : "Wireless",
       // Without this the shell falls back to its "2.4 GHz receiver" wording,
       // which is wrong for a mouse plugged straight into USB.
-      connectionDetail: this.isDirectConnect ? "Wired USB" : undefined,
+      connectionDetail: wired ? "Wired USB" : undefined,
       activeProfile: profileState.activeProfile,
       deviceMode: profileState.deviceMode,
       unitId: identity.unitId,
@@ -528,8 +575,12 @@ export class LogitechHidppClient {
       // CRC-checked sector rewrite that is not implemented here.
       throw new Error("This mouse stores its polling rate in the onboard profile. Change it in Logitech's own software; OpenMouse can only read it.");
     }
-    if (this.isSuperstrikeDevice && this.device.productId === 0xc0a8 && pollingRateHz > 1000) {
-      throw new Error("The Superstrike USB connection supports up to 1000 Hz. Use the Lightspeed receiver for higher rates.");
+    const rateLimits = this.lodCapabilities.reportRates;
+    const connectionRateCeiling = rateLimits
+      ? (this.wiredConnection ? rateLimits.wiredMaxHz : rateLimits.wirelessMaxHz)
+      : null;
+    if (connectionRateCeiling !== null && pollingRateHz > connectionRateCeiling) {
+      throw new Error(`This connection supports up to ${connectionRateCeiling} Hz.`);
     }
     const resolved = await this.resolveReportRateFeature();
     if (resolved.legacy) {
@@ -561,12 +612,14 @@ export class LogitechHidppClient {
     }
     if (resolved.legacy) {
       const advertised = await this.readLegacyDpiList(resolved.index);
-      // A mouse that answers the DPI list with nothing usable would otherwise
-      // leave the panel with no DPI control at all. Its documented sensor range
-      // is a safe stand-in; every value is still verified by the read-back in
-      // setLegacyDpi.
-      this.dpiOptionsCache = advertised.length === 0
-        ? legacyDpiFallback(this.device.productId)
+      const formatLimits = capabilitiesForFormat(this.profileFormatId).dpiStages;
+      // Empty legacy lists fall back to the profile format's captured grid,
+      // never to a model/PID-specific table.
+      this.dpiOptionsCache = advertised.length === 0 && formatLimits
+        ? Array.from(
+          { length: Math.floor((formatLimits.maxDpi - formatLimits.minDpi) / formatLimits.stepDpi) + 1 },
+          (_, step) => formatLimits.minDpi + step * formatLimits.stepDpi,
+        )
         : advertised;
       return this.dpiOptionsCache;
     }
@@ -869,8 +922,8 @@ export class LogitechHidppClient {
     }
     const info = parseProfilesInfo(await this.request(feature.index, PROFILE_FN.getInfo));
     const format = describeProfileFormat(info.profileFormatId);
-    if (!format.verified) {
-      throw new Error(`Profile format ${format.id} has not been verified on hardware; refusing to write.`);
+    if (!format.writable) {
+      throw new Error(`Profile format ${format.id} profile-content writes have not been verified on hardware.`);
     }
 
     // A profile can be edited without the mouse being switched to it, so the
@@ -920,16 +973,52 @@ export class LogitechHidppClient {
     }
 
     if (values.dpiStages) {
-      const invalid = validateDpiStagePlan(values.dpiStages, capabilitiesForFormat(formatId).dpiStages);
+      const liveDpiOptions = await this.getDpiOptions();
+      const dpiCapabilities = dpiStageCapabilitiesForOptions(
+        capabilitiesForFormat(formatId).dpiStages,
+        liveDpiOptions,
+      );
+      const invalid = validateDpiStagePlan(
+        values.dpiStages,
+        dpiCapabilities,
+        formatId < 6,
+      );
       if (invalid) throw new Error(invalid);
-      updated = encodeDpiStages(updated, formatId, values.dpiStages);
+      for (const [index, stage] of values.dpiStages.stages.entries()) {
+        if (!liveDpiOptions.includes(stage.x) || !liveDpiOptions.includes(stage.y)) {
+          throw new Error(`Slot ${index + 1} uses a DPI value the connected mouse did not advertise.`);
+        }
+      }
+      updated = encodeDpiStages(updated, formatId, values.dpiStages, dpiCapabilities);
     }
 
     // The two links are stored separately, so each is set on its own.
     if (values.reportRateWirelessHz) {
+      const liveRates = await this.getSupportedPollingRateOptions();
+      const allowed = reportRatesForDevice(
+        capabilitiesForFormat(formatId).reportRates,
+        "wireless",
+        liveRates,
+        this.wiredConnection ? "wired" : "wireless",
+        formatId < 6,
+      );
+      if (!allowed.includes(values.reportRateWirelessHz)) {
+        throw new Error("The connected mouse did not advertise that profile report rate.");
+      }
       updated = encodeReportRate(updated, formatId, "wireless", values.reportRateWirelessHz);
     }
     if (values.reportRateWiredHz) {
+      const liveRates = await this.getSupportedPollingRateOptions();
+      const allowed = reportRatesForDevice(
+        capabilitiesForFormat(formatId).reportRates,
+        "wired",
+        liveRates,
+        this.wiredConnection ? "wired" : "wireless",
+        formatId < 6,
+      );
+      if (!allowed.includes(values.reportRateWiredHz)) {
+        throw new Error("The connected mouse did not advertise that profile report rate.");
+      }
       updated = encodeReportRate(updated, formatId, "wired", values.reportRateWiredHz);
     }
 
@@ -1063,6 +1152,202 @@ export class LogitechHidppClient {
     };
   }
 
+  /**
+   * Reads and retains everything required to recover a legacy format-2/3/4 profile before
+   * the semantic write probe starts. The UI copies this object first.
+   */
+  async prepareProfileContentWriteProbe(): Promise<ProfileContentWriteProbeBackup> {
+    await this.open();
+    const feature = await this.getFeature(FEATURE.onboardProfiles);
+    if (!feature.index) throw new Error("This mouse does not expose onboard-profile controls.");
+    const info = parseProfilesInfo(await this.request(feature.index, PROFILE_FN.getInfo));
+    if (!supportsProfileWriteProbe(info.profileFormatId)) {
+      throw new Error(`The guided content probe currently supports profile formats 2, 3, and 4, not ${info.profileFormatId}.`);
+    }
+    const sectorSize = info.sectorSize > 0 && info.sectorSize <= 1024 ? info.sectorSize : 255;
+    const modeReply = await this.request(feature.index, PROFILE_FN.getMode);
+    const originalMode = modeReply[3] === ONBOARD_MODE.onboard ? "Onboard" : "Host";
+    const currentReply = await this.request(feature.index, PROFILE_FN.getCurrentProfile);
+    const originalCurrentSector = ((currentReply[3] ?? 0) << 8) | (currentReply[4] ?? 0);
+    const directory = await this.readProfileSector(feature.index, 0x0000, sectorSize);
+    if (profileCrc(directory) !== storedCrc(directory)) throw new Error("The profile directory checksum is invalid.");
+    const target = parseDirectory(directory).find((entry) => entry.enabled) ?? parseDirectory(directory)[0];
+    if (!target) throw new Error("The mouse reported no profile to test.");
+    const profile = await this.readProfileSector(feature.index, target.sector, sectorSize);
+    if (profileCrc(profile) !== storedCrc(profile)) throw new Error("The profile checksum is invalid.");
+
+    const dpiFeature = await this.resolveDpiFeature();
+    const rateFeature = await this.resolveReportRateFeature();
+    if (!dpiFeature.index || !dpiFeature.legacy || !rateFeature.index || !rateFeature.legacy) {
+      throw new Error("Format-4 verification requires legacy DPI and report-rate features.");
+    }
+    return {
+      formatId: info.profileFormatId,
+      sector: target.sector,
+      sectorSize,
+      originalMode,
+      originalCurrentSector,
+      directory,
+      profile,
+      dpiOptions: await this.getDpiOptions(),
+      reportRates: await this.readLegacyReportRates(rateFeature.index),
+    };
+  }
+
+  /**
+   * Applies temporary format-2/3/4 name, DPI and rate values, confirms each sector
+   * read-back, confirms live DPI/rate, and restores the original after every
+   * step. The caller must copy the backup before invoking this method.
+   */
+  async runProfileContentWriteProbe(
+    backup: ProfileContentWriteProbeBackup,
+  ): Promise<ProfileContentWriteProbeReport> {
+    await this.open();
+    if (!supportsProfileWriteProbe(backup.formatId)) {
+      throw new Error("Only profile formats 2, 3, and 4 are supported by this probe.");
+    }
+    const feature = await this.getFeature(FEATURE.onboardProfiles);
+    if (!feature.index) throw new Error("This mouse does not expose onboard-profile controls.");
+    const info = parseProfilesInfo(await this.request(feature.index, PROFILE_FN.getInfo));
+    if (info.profileFormatId !== backup.formatId || info.sectorSize !== backup.sectorSize) {
+      throw new Error("The connected mouse no longer matches the copied backup.");
+    }
+    const sameBytes = (left: Uint8Array, right: Uint8Array): boolean =>
+      left.length === right.length && left.every((byte, index) => byte === right[index]);
+    const currentDirectory = await this.readProfileSector(feature.index, 0x0000, backup.sectorSize);
+    const currentProfile = await this.readProfileSector(feature.index, backup.sector, backup.sectorSize);
+    if (!sameBytes(currentDirectory, backup.directory) || !sameBytes(currentProfile, backup.profile)) {
+      throw new Error("The profile changed after the recovery backup was copied; take a new backup.");
+    }
+
+    const dpiFeature = await this.resolveDpiFeature();
+    const rateFeature = await this.resolveReportRateFeature();
+    if (!dpiFeature.index || !dpiFeature.legacy || !rateFeature.index || !rateFeature.legacy) {
+      throw new Error("The required legacy DPI or report-rate feature disappeared.");
+    }
+
+    const original = decodeOnboardProfile(
+      backup.profile,
+      backup.formatId,
+      { sector: backup.sector, enabled: true },
+      false,
+    );
+    const temporaryName = original.name === "OM_VERIFY" ? "OM_VERIFY_2" : "OM_VERIFY";
+    const currentDpi = original.dpiStages[original.defaultDpiIndex ?? 0]?.x;
+    const temporaryDpi = backup.dpiOptions.includes(1000) && currentDpi !== 1000
+      ? 1000
+      : backup.dpiOptions.find((dpi) => dpi !== currentDpi);
+    const currentRate = original.reportRateWired;
+    const temporaryRate = backup.reportRates.includes(500) && currentRate !== 500
+      ? 500
+      : backup.reportRates.find((rate) => rate !== currentRate);
+    if (!temporaryDpi || !temporaryRate || original.defaultDpiIndex === null || original.dpiStages.length === 0) {
+      throw new Error("The mouse did not advertise an alternate safe DPI and polling rate.");
+    }
+
+    const dpiStages = original.dpiStages.map((stage) => ({ ...stage }));
+    dpiStages[original.defaultDpiIndex] = { x: temporaryDpi, y: temporaryDpi, lod: 0 };
+    const runtimeDpiLimits = {
+      maxStages: 5,
+      minDpi: Math.min(...backup.dpiOptions),
+      maxDpi: Math.max(...backup.dpiOptions),
+      // The selected probe value is checked against the exact advertised list
+      // above. A unit step avoids pretending a sparse device list is uniform.
+      stepDpi: 1,
+    };
+    const maximumRate = Math.max(...backup.reportRates);
+    const runtimeRateLimits = { wirelessMaxHz: maximumRate, wiredMaxHz: maximumRate };
+    const candidates = [
+      {
+        setting: "name" as const,
+        intended: temporaryName,
+        bytes: encodeProfileName(backup.profile, backup.formatId, temporaryName, PROFILE_NAME_MAX_CHARS),
+        confirmLive: null,
+      },
+      {
+        setting: "dpi" as const,
+        intended: `${temporaryDpi} DPI`,
+        bytes: encodeDpiStages(
+          backup.profile,
+          backup.formatId,
+          { stages: dpiStages, defaultIndex: original.defaultDpiIndex },
+          runtimeDpiLimits,
+        ),
+        confirmLive: async () => (await this.readLegacyDpi(dpiFeature.index)).dpi === temporaryDpi,
+      },
+      {
+        setting: "polling" as const,
+        intended: `${temporaryRate} Hz`,
+        bytes: encodeReportRate(backup.profile, backup.formatId, "wired", temporaryRate, runtimeRateLimits),
+        confirmLive: async () => (await this.readLegacyReportRate(rateFeature.index)) === temporaryRate,
+      },
+    ];
+
+    const steps: ProfileContentWriteProbeStep[] = [];
+    for (const candidate of candidates) {
+      const step: ProfileContentWriteProbeStep = {
+        setting: candidate.setting,
+        intended: candidate.intended,
+        storedExactly: false,
+        liveConfirmed: null,
+        restored: false,
+        error: null,
+      };
+      try {
+        await this.setOnboardMode("Host");
+        await this.writeProfileSector(feature.index, backup.sector, candidate.bytes);
+        const readBack = await this.readProfileSector(feature.index, backup.sector, backup.sectorSize);
+        step.storedExactly = sameBytes(readBack, candidate.bytes)
+          && profileCrc(readBack) === storedCrc(readBack);
+        if (!step.storedExactly) throw new Error("The temporary sector did not read back exactly.");
+        if (candidate.confirmLive) {
+          // Legacy devices reject setCurrentProfile while host mode is active.
+          // Enter onboard mode first, matching the normal profile selector.
+          await this.setOnboardMode("Onboard");
+          await this.setCurrentProfile(backup.sector);
+          step.liveConfirmed = await candidate.confirmLive();
+          if (!step.liveConfirmed) throw new Error("The live HID++ value did not match the temporary profile value.");
+        }
+      } catch (error) {
+        step.error = error instanceof Error ? error.message : "The verification step failed.";
+      } finally {
+        await this.setOnboardMode("Host").catch(() => undefined);
+        try {
+          await this.writeProfileSector(feature.index, backup.sector, backup.profile);
+          const restored = await this.readProfileSector(feature.index, backup.sector, backup.sectorSize);
+          step.restored = sameBytes(restored, backup.profile)
+            && profileCrc(restored) === storedCrc(restored);
+        } catch (error) {
+          step.error ??= error instanceof Error ? error.message : "Could not restore the original profile.";
+        }
+      }
+      steps.push(step);
+      if (!step.restored) break;
+    }
+
+    let modeRestored = false;
+    try {
+      // setCurrentProfile is an onboard-mode operation on legacy hardware. If
+      // the mouse started in host mode, briefly select its original sector in
+      // onboard mode and only then return it to host mode.
+      await this.setOnboardMode("Onboard");
+      if (backup.originalCurrentSector > 0) await this.setCurrentProfile(backup.originalCurrentSector);
+      if (backup.originalMode === "Host") await this.setOnboardMode("Host");
+      const mode = await this.request(feature.index, PROFILE_FN.getMode);
+      modeRestored = mode[3] === (backup.originalMode === "Onboard" ? ONBOARD_MODE.onboard : ONBOARD_MODE.host);
+    } catch {
+      modeRestored = false;
+    }
+    const finalProfile = await this.readProfileSector(feature.index, backup.sector, backup.sectorSize).catch(() => null);
+    const restored = finalProfile !== null && sameBytes(finalProfile, backup.profile)
+      && profileCrc(finalProfile) === storedCrc(finalProfile);
+    const ok = steps.length === candidates.length
+      && steps.every((step) => step.storedExactly && step.restored && step.error === null
+        && (step.liveConfirmed === null || step.liveConfirmed))
+      && restored && modeRestored;
+    return { backup, steps, restored, modeRestored, ok };
+  }
+
   /**
    * Reads and decodes every onboard profile. Deliberately not part of
    * readStatus: a full pass is ~80 HID++ round trips, far too slow for the
@@ -1128,6 +1413,9 @@ export class LogitechHidppClient {
       profiles.push(decodeOnboardProfile(bytes, info.profileFormatId, entry, entry.sector === currentSector));
     }
 
+    const dpiCapabilities = await this.readDpiVerificationCapability();
+    const reportRateCapabilities = await this.readReportRateVerificationCapability();
+
     return {
       info,
       infoReply,
@@ -1139,9 +1427,103 @@ export class LogitechHidppClient {
       directory,
       directoryCrcValid: profileCrc(directory) === storedCrc(directory),
       profiles,
+      dpiCapabilities,
+      reportRateCapabilities,
     };
   }
 
+  private async verificationFeature(
+    extendedId: number,
+    legacyId: number,
+  ): Promise<VerificationCapability | null> {
+    for (const [featureId, kind] of [[extendedId, "extended"], [legacyId, "legacy"]] as const) {
+      try {
+        const featureReply = await this.request(0x00, 0x00, featureId >> 8, featureId & 0xff);
+        const featureIndex = featureReply[3] ?? 0;
+        if (!featureIndex) continue;
+        return {
+          featureId,
+          featureIndex,
+          featureVersion: featureReply[6] ?? 0,
+          kind,
+          replies: [{ name: "getFeature", bytes: featureReply }],
+          decodedValues: [],
+          error: null,
+        };
+      } catch {
+        // Missing optional features must not prevent the profile dump.
+      }
+    }
+    return null;
+  }
+
+  private async readDpiVerificationCapability(): Promise<VerificationCapability | null> {
+    const resolved = await this.verificationFeature(FEATURE.extendedDpi, FEATURE.adjustableDpi);
+    if (!resolved) return null;
+    const result = resolved;
+    try {
+      if (result.kind === "legacy") {
+        result.replies.push({
+          name: "getSensorDpiList",
+          bytes: await this.request(result.featureIndex, 0x10, 0x00),
+        });
+        result.replies.push({
+          name: "getSensorDpi",
+          bytes: await this.request(result.featureIndex, 0x20, 0x00),
+        });
+      } else {
+        result.replies.push({
+          name: "getSensorCapabilities",
+          bytes: await this.request(result.featureIndex, 0x10, 0x00),
+        });
+        const listBytes: number[] = [];
+        for (let page = 0; page < 32; page += 1) {
+          const reply = await this.request(result.featureIndex, 0x20, 0x00, 0x00, page);
+          result.replies.push({ name: `getSensorDpiList page ${page}`, bytes: reply });
+          listBytes.push(...reply.slice(6));
+          if (listBytes.some((value, index) => index > 0 && listBytes[index - 1] === 0 && value === 0)) break;
+        }
+        result.replies.push({
+          name: "getSensorDpi",
+          bytes: await this.request(result.featureIndex, 0x50),
+        });
+      }
+      result.decodedValues = await this.getDpiOptions();
+    } catch (error) {
+      result.error = error instanceof Error ? error.message : "Could not read DPI capabilities.";
+    }
+    return result;
+  }
+
+  private async readReportRateVerificationCapability(): Promise<VerificationCapability | null> {
+    const resolved = await this.verificationFeature(FEATURE.extendedReportRate, FEATURE.reportRate);
+    if (!resolved) return null;
+    const result = resolved;
+    try {
+      if (result.kind === "legacy") {
+        const listReply = await this.request(result.featureIndex, 0x00);
+        result.replies.push({ name: "getReportRateList", bytes: listReply });
+        result.replies.push({
+          name: "getReportRate",
+          bytes: await this.request(result.featureIndex, 0x10),
+        });
+        result.decodedValues = decodeReportRateBitmap(listReply[3] ?? 0);
+      } else {
+        const listReply = await this.request(result.featureIndex, 0x10);
+        result.replies.push({ name: "getSupportedReportRates", bytes: listReply });
+        result.replies.push({
+          name: "getReportRate",
+          bytes: await this.request(result.featureIndex, 0x20),
+        });
+        const flags = ((listReply[3] ?? 0) << 8) | (listReply[4] ?? 0);
+        result.decodedValues = REPORT_RATE_HZ.filter((_rate, index) => (flags & (1 << index)) !== 0);
+      }
+    } catch (error) {
+      result.error = error instanceof Error ? error.message : "Could not read report-rate capabilities.";
+    }
+    return result;
+  }
+
   /**
    * memoryRead returns 16 bytes per call and rejects a read running past the
    * end of the sector, so a sector length that is not a multiple of 16 needs its
@@ -1301,9 +1683,7 @@ export class LogitechHidppClient {
   private async setLegacyDpi(featureIndex: number, dpi: number): Promise<number> {
     await this.ensureHostControl();
     // setSensorDpi(sensor 0, dpi): params = [sensorIdx, dpiHi, dpiLo]. Three
-    // bytes fit a short request, which is the form direct-connect mice were
-    // verified with; receiver-attached HERO mice have always been driven with
-    // the long form.
+    // Direct endpoints use the short form; receiver-attached mice use long.
     if (this.isDirectConnect) {
       await this.request(featureIndex, 0x30, 0x00, dpi >> 8, dpi & 0xff);
     } else {
@@ -1326,6 +1706,16 @@ export class LogitechHidppClient {
     return decodeReportRateBitmap(reply[3] ?? 0);
   }
 
+  private async getSupportedPollingRateOptions(): Promise<number[]> {
+    if (this.supportedPollingRatesCache !== null) return this.supportedPollingRatesCache;
+    const feature = await this.resolveReportRateFeature();
+    const rates = feature.legacy
+      ? await this.readLegacyReportRates(feature.index)
+      : await this.readSupportedPollingRates(feature.index);
+    this.supportedPollingRatesCache = rates;
+    return rates;
+  }
+
   private async readLegacyReportRate(featureIndex: number): Promise<number> {
     if (!featureIndex) {
       throw new Error("This Logitech mouse does not expose report-rate controls.");
@@ -1583,10 +1973,6 @@ export class LogitechHidppClient {
     return { unitId: unitId === "00000000" ? null : unitId, modelId, transportIds };
   }
 
-  private isSuperstrike(identity: DeviceIdentity): boolean {
-    return this.device.productId === 0xc0a8 || identity.modelId?.startsWith("40BD") === true;
-  }
-
   private async ensureHostControl(): Promise<void> {
     // Direct-connect mice accept live 0x2201 DPI writes while still in onboard
     // mode. Switching them to host control is a persistent state change that
diff --git a/src/devices/logitech/onboard-profiles.test.ts b/src/devices/logitech/onboard-profiles.test.ts
index c28aff11..c758ba80 100644
--- a/src/devices/logitech/onboard-profiles.test.ts
+++ b/src/devices/logitech/onboard-profiles.test.ts
@@ -14,11 +14,15 @@ import {
   clampBunnyHopMs,
   clampDpi,
   decodeLiftOffLevel,
+  describeProfileFormat,
+  dpiStageCapabilitiesForOptions,
   encodeDpiStages,
   encodeProfileName,
   encodeReportRate,
   factoryProfileForFormat,
+  supportsFactoryReset,
   reportRatesFor,
+  reportRatesForDevice,
   validateBunnyHoppingMs,
   validateProfileName,
   validateReportRate,
@@ -107,6 +111,153 @@ const G402_SECTOR = (() => {
   return sector;
 })();
 
+/** Three format-2 profiles captured read-only from a G502 (PID 0xc332). */
+const G502_SECTORS = [
+  bytes(`
+    01 00 00 a4 06 00 00 00 00 00 00 00 00 ff ff ff
+    ff 00 08 00 ff ff ff ff ff ff ff ff ff ff ff ff
+    80 01 00 01 80 01 00 02 80 01 00 04 90 00 00 00
+    90 00 00 00 90 00 00 00 80 02 00 09 80 02 00 0b
+    90 00 00 00 90 02 00 00 80 02 00 20 ff ff ff ff
+    ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+    80 01 00 01 80 01 00 02 80 01 00 04 90 00 00 00
+    90 00 00 00 90 00 00 00 80 02 00 09 80 02 00 0b
+    90 00 00 00 90 02 00 00 80 02 00 20 ff ff ff ff
+    ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+    50 00 52 00 4f 00 46 00 49 00 4c 00 45 00 5f 00
+    4e 00 41 00 4d 00 45 00 5f 00 44 00 45 00 46 00
+    41 00 55 00 4c 00 54 00 00 00 00 00 00 00 00 00
+    03 00 00 00 00 00 1f 40 64 00 00 03 00 00 00 00
+    00 1f 40 64 00 00 ff ff ff ff ff ff ff ff ff ff
+    ff ff ff ff ff ff ff ff ff ff ff ff ff ff 40 f7
+  `),
+  bytes(`
+    01 00 00 46 05 00 00 00 00 00 00 00 00 ff ff ff
+    ff 00 22 00 ff ff ff ff ff ff ff ff ff ff ff ff
+    80 01 00 01 80 01 00 02 80 01 00 04 90 00 00 00
+    90 00 00 00 90 00 00 00 80 02 00 09 80 02 00 0b
+    90 00 00 00 90 02 00 00 80 02 00 20 ff ff ff ff
+    ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+    80 01 00 01 80 01 00 02 80 01 00 04 90 00 00 00
+    90 00 00 00 90 00 00 00 80 02 00 09 80 02 00 0b
+    90 00 00 00 90 02 00 00 80 02 00 20 ff ff ff ff
+    ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+    50 00 52 00 4f 00 46 00 49 00 4c 00 45 00 5f 00
+    4e 00 41 00 4d 00 45 00 5f 00 44 00 45 00 46 00
+    41 00 55 00 4c 00 54 00 00 00 00 00 00 00 00 00
+    03 00 00 00 00 00 1f 40 64 00 00 03 00 00 00 00
+    00 1f 40 64 00 00 ff ff ff ff ff ff ff ff ff ff
+    ff ff ff ff ff ff ff ff ff ff ff ff 00 ff 11 38
+  `),
+  bytes(`
+    02 00 00 60 09 00 00 00 00 00 00 00 00 ff ff ff
+    ff 00 03 00 ff ff ff ff ff ff ff ff ff ff ff ff
+    80 01 00 01 80 01 00 02 80 01 00 04 80 01 00 08
+    80 01 00 10 90 0b ff ff 80 02 01 06 80 02 01 19
+    90 00 00 00 90 02 ff ff 90 01 ff ff ff ff ff ff
+    ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+    80 01 00 01 80 01 00 02 80 02 01 17 80 02 01 3d
+    80 02 03 17 ff ff ff ff 80 02 01 1b 80 02 01 1d
+    80 02 01 27 80 02 01 2b 80 02 03 2b ff ff ff ff
+    ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+    50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 20 00
+    33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+    01 ff ff ff 00 00 00 00 00 00 00 01 ff ff ff 00
+    00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff
+    ff ff ff ff ff ff ff ff ff ff ff ff ff ff 3f c6
+  `),
+];
+
+const G502_INFO_REPLY = bytes("ff 0e 05 01 02 01 03 03 0b 10 01 00 0a 01 00 00 00 00 00");
+const G502_HERO_INFO_REPLY = bytes("ff 0c 05 01 02 01 05 05 0b 10 01 00 0a 01 00 00 00 00 00");
+const G502_DIRECTORY = (() => {
+  const sector = new Uint8Array(256).fill(0xff);
+  sector.set(bytes("00 01 01 00 00 02 00 00 00 03 00 00 ff ff 00 00"));
+  sector.set([0x03, 0xbc], sector.length - 2);
+  return sector;
+})();
+
+/** G502 LIGHTSPEED format-3 sectors captured read-only (PID 0xc08d). */
+const G502_LIGHTSPEED_PROFILE_1 = bytes(`
+  01 00 00 58 02 e8 03 dc 05 00 00 00 00 ff ff ff
+  ff 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  80 01 00 01 80 01 00 02 80 01 00 04 80 01 00 08
+  80 01 00 10 80 02 00 29 90 04 00 00 90 03 00 00
+  90 0c 00 00 90 02 00 00 90 01 00 00 ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  80 01 00 01 80 01 00 02 80 01 00 04 80 01 00 08
+  80 01 00 10 80 02 00 29 90 04 00 00 90 03 00 00
+  90 0c 00 00 90 02 00 00 90 01 00 00 ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  50 00 52 00 4f 00 46 00 49 00 4c 00 45 00 5f 00
+  4e 00 41 00 4d 00 45 00 5f 00 44 00 45 00 46 00
+  41 00 55 00 4c 00 54 00 00 00 00 00 00 00 00 00
+  01 fd 76 00 00 00 00 00 00 00 00 01 fd 76 00 00
+  00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff 00 42 3b
+`);
+
+/** Profiles 2-5 were byte-identical in the same format-3 capture. */
+const G502_LIGHTSPEED_FACTORY_PROFILE = bytes(`
+  01 01 00 90 01 20 03 40 06 80 0c 00 19 ff ff ff
+  ff 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  80 01 00 01 80 01 00 02 80 01 00 04 80 01 00 08
+  80 01 00 10 90 07 00 00 90 04 00 00 90 03 00 00
+  90 0c 00 00 90 02 00 00 90 01 00 00 ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  03 00 00 00 00 00 1f 40 00 00 00 03 00 00 00 00
+  00 1f 40 00 00 00 ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff 3e 23
+`);
+
+const G502_LIGHTSPEED_INFO_REPLY = bytes(
+  "ff 09 05 01 03 01 05 01 0b 10 00 ff 0a 04 00 00 00 00 00",
+);
+const G502_LIGHTSPEED_DIRECTORY = (() => {
+  const sector = new Uint8Array(255).fill(0xff);
+  sector.set(bytes("00 01 01 ff 00 02 00 ff 00 03 00 ff 00 04 00 ff 00 05 00 ff"));
+  sector.set([0x40, 0x37], sector.length - 2);
+  return sector;
+})();
+
+/** G102 LIGHTSYNC format-4 sector captured read-only (PID 0xc092). */
+const G102_LIGHTSYNC_PROFILE = bytes(`
+  01 01 01 32 00 d0 07 40 06 00 00 00 00 ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  80 01 00 01 80 01 00 02 80 01 00 04 80 01 00 08
+  80 01 00 10 90 05 ff 00 ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+  50 00 52 00 4f 00 46 00 49 00 4c 00 45 00 5f 00
+  4e 00 41 00 4d 00 45 00 5f 00 44 00 45 00 46 00
+  41 00 55 00 4c 00 54 00 00 00 00 00 00 00 00 00
+  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+  00 00 00 00 00 00 00 00 00 00 00 00 ff 68 27
+`);
+
+const G102_LIGHTSYNC_INFO_REPLY = bytes(
+  "ff 0f 05 01 04 01 01 01 06 10 00 ff 0a 01 00 00 00 00 00",
+);
+const G102_LIGHTSYNC_DIRECTORY = (() => {
+  const sector = new Uint8Array(255).fill(0xff);
+  sector.set(bytes("00 01 01 00 ff ff 00 00"));
+  sector.set([0x58, 0x7c], sector.length - 2);
+  return sector;
+})();
+
 test("parses getOnboardProfilesInfo", () => {
   assert.deepEqual(parseProfilesInfo(INFO_REPLY), {
     memoryModelId: 1,
@@ -254,14 +405,263 @@ test("decodes the captured G402 format-1 profile without v6 mojibake", () => {
   assert.equal(profile.name, null);
   assert.equal(profile.defaultDpiIndex, 2);
   assert.deepEqual(profile.dpiStages, [420, 840, 1596, 3192].map((dpi) => ({ x: dpi, y: dpi, lod: 0 })));
-  assert.equal(profile.reportRateWireless, null);
+  assert.equal(profile.reportRateWireless, 1000);
   assert.equal(profile.reportRateWired, 1000);
   assert.equal(profile.angleSnapping, false);
   assert.equal(profile.powerSaveTimeoutSeconds, null);
   assert.equal(profile.powerOffTimeoutSeconds, null);
+
+  const limits = capabilitiesForFormat(1).dpiStages;
+  assert.deepEqual(limits, { maxStages: 5, minDpi: 252, maxDpi: 4032, stepDpi: 84 });
+  assert.ok(limits);
+  const grid = Array.from(
+    { length: Math.floor((limits.maxDpi - limits.minDpi) / limits.stepDpi) + 1 },
+    (_, step) => limits.minDpi + step * limits.stepDpi,
+  );
+  assert.equal(grid.includes(2436), true, "the format grid includes the value shown as 2400 by vendor UI");
+});
+
+test("decodes all captured G502 format-2 profiles", () => {
+  const expected = [
+    { name: "PROFILE_NAME_DEFAULT", dpi: 1700, rate: 1000 },
+    { name: "PROFILE_NAME_DEFAULT", dpi: 1350, rate: 1000 },
+    { name: "Profile 3", dpi: 2400, rate: 500 },
+  ];
+
+  G502_SECTORS.forEach((sector, index) => {
+    const profile = decodeOnboardProfile(
+      sector,
+      2,
+      { sector: index + 1, enabled: index === 0 },
+      false,
+    );
+    assert.equal(sector.length, 256);
+    assert.equal(profile.crcValid, true);
+    assert.equal(profile.name, expected[index].name);
+    assert.equal(profile.defaultDpiIndex, 0);
+    assert.deepEqual(profile.dpiStages, [{ x: expected[index].dpi, y: expected[index].dpi, lod: 0 }]);
+    assert.equal(profile.reportRateWireless, expected[index].rate);
+    assert.equal(profile.reportRateWired, expected[index].rate);
+    assert.equal(profile.angleSnapping, false);
+  });
+});
+
+test("parses the captured G502 format-2 geometry and directory", () => {
+  assert.deepEqual(
+    { verified: describeProfileFormat(2).verified, writable: describeProfileFormat(2).writable },
+    { verified: true, writable: true },
+  );
+  assert.deepEqual(parseProfilesInfo(G502_INFO_REPLY), {
+    memoryModelId: 1,
+    profileFormatId: 2,
+    profileCount: 3,
+    sectorCount: 16,
+    sectorSize: 256,
+  });
+  assert.deepEqual(parseProfilesInfo(G502_HERO_INFO_REPLY), {
+    memoryModelId: 1,
+    profileFormatId: 2,
+    profileCount: 5,
+    sectorCount: 16,
+    sectorSize: 256,
+  });
+  assert.equal(profileCrc(G502_DIRECTORY), storedCrc(G502_DIRECTORY));
+  assert.deepEqual(parseDirectory(G502_DIRECTORY), [
+    { sector: 1, enabled: true },
+    { sector: 2, enabled: false },
+    { sector: 3, enabled: false },
+  ]);
+});
+
+test("format-2 probe encoders use limits collected live from the wired G502", () => {
+  const heroLimits = capabilitiesForFormat(2).dpiStages;
+  assert.deepEqual(heroLimits, { maxStages: 5, minDpi: 100, maxDpi: 25600, stepDpi: 50 });
+  assert.deepEqual(
+    dpiStageCapabilitiesForOptions(heroLimits, [100, 150, 200, 11950, 12000]),
+    { maxStages: 5, minDpi: 100, maxDpi: 12000, stepDpi: 50 },
+    "the older G502 is narrowed to its live 12K sensor grid",
+  );
+  const original = decodeOnboardProfile(G502_SECTORS[0], 2, { sector: 1, enabled: true }, false);
+  const stages = original.dpiStages.map((stage) => ({ ...stage }));
+  stages[original.defaultDpiIndex!] = { x: 1000, y: 1000, lod: 0 };
+  const dpi = encodeDpiStages(
+    G502_SECTORS[0],
+    2,
+    { stages, defaultIndex: original.defaultDpiIndex! },
+    { maxStages: 5, minDpi: 100, maxDpi: 12000, stepDpi: 1 },
+  );
+  assert.equal(decodeOnboardProfile(dpi, 2, { sector: 1, enabled: true }, false).dpiStages[0].x, 1000);
+
+  const rate = encodeReportRate(
+    G502_SECTORS[0],
+    2,
+    "wired",
+    500,
+    { wirelessMaxHz: 1000, wiredMaxHz: 1000 },
+  );
+  assert.equal(decodeOnboardProfile(rate, 2, { sector: 1, enabled: true }, false).reportRateWired, 500);
+
+  const named = encodeProfileName(G502_SECTORS[0], 2, "OM_VERIFY", PROFILE_NAME_MAX_CHARS);
+  assert.equal(decodeOnboardProfile(named, 2, { sector: 1, enabled: true }, false).name, "OM_VERIFY");
+  for (const sector of [dpi, rate, named]) assert.equal(profileCrc(sector), storedCrc(sector));
+});
+
+test("decodes all captured G502 LIGHTSPEED format-3 profiles", () => {
+  const configured = decodeOnboardProfile(
+    G502_LIGHTSPEED_PROFILE_1,
+    3,
+    { sector: 1, enabled: true },
+    true,
+  );
+  assert.equal(G502_LIGHTSPEED_PROFILE_1.length, 255);
+  assert.equal(configured.crcValid, true);
+  assert.equal(configured.name, "PROFILE_NAME_DEFAULT");
+  assert.equal(configured.defaultDpiIndex, 0);
+  assert.deepEqual(
+    configured.dpiStages,
+    [600, 1000, 1500].map((dpi) => ({ x: dpi, y: dpi, lod: 0 })),
+  );
+  assert.equal(configured.reportRateWireless, 1000);
+  assert.equal(configured.reportRateWired, 1000);
+  assert.equal(configured.isCurrent, true);
+
+  for (let sector = 2; sector <= 5; sector += 1) {
+    const profile = decodeOnboardProfile(
+      G502_LIGHTSPEED_FACTORY_PROFILE,
+      3,
+      { sector, enabled: false },
+      false,
+    );
+    assert.equal(G502_LIGHTSPEED_FACTORY_PROFILE.length, 255);
+    assert.equal(profile.crcValid, true);
+    assert.equal(profile.name, null);
+    assert.equal(profile.defaultDpiIndex, 1);
+    assert.deepEqual(
+      profile.dpiStages,
+      [400, 800, 1600, 3200, 6400].map((dpi) => ({ x: dpi, y: dpi, lod: 0 })),
+    );
+    assert.equal(profile.reportRateWireless, 1000);
+    assert.equal(profile.reportRateWired, 1000);
+    assert.equal(profile.isCurrent, false);
+  }
+});
+
+test("parses the captured G502 LIGHTSPEED format-3 geometry and directory", () => {
+  assert.deepEqual(
+    { verified: describeProfileFormat(3).verified, writable: describeProfileFormat(3).writable },
+    { verified: true, writable: false },
+  );
+  assert.deepEqual(parseProfilesInfo(G502_LIGHTSPEED_INFO_REPLY), {
+    memoryModelId: 1,
+    profileFormatId: 3,
+    profileCount: 5,
+    sectorCount: 16,
+    sectorSize: 255,
+  });
+  assert.equal(profileCrc(G502_LIGHTSPEED_DIRECTORY), storedCrc(G502_LIGHTSPEED_DIRECTORY));
+  assert.deepEqual(parseDirectory(G502_LIGHTSPEED_DIRECTORY), [
+    { sector: 1, enabled: true },
+    { sector: 2, enabled: false },
+    { sector: 3, enabled: false },
+    { sector: 4, enabled: false },
+    { sector: 5, enabled: false },
+  ]);
+});
+
+test("format-3 probe encoders accept limits collected live from the mouse", () => {
+  const original = decodeOnboardProfile(G502_LIGHTSPEED_PROFILE_1, 3, { sector: 1, enabled: true }, true);
+  const stages = original.dpiStages.map((stage) => ({ ...stage }));
+  stages[original.defaultDpiIndex!] = { x: 800, y: 800, lod: 0 };
+  const dpi = encodeDpiStages(
+    G502_LIGHTSPEED_PROFILE_1,
+    3,
+    { stages, defaultIndex: original.defaultDpiIndex! },
+    { maxStages: 5, minDpi: 100, maxDpi: 25600, stepDpi: 1 },
+  );
+  assert.equal(decodeOnboardProfile(dpi, 3, { sector: 1, enabled: true }, true).dpiStages[0].x, 800);
+
+  const rate = encodeReportRate(
+    G502_LIGHTSPEED_PROFILE_1,
+    3,
+    "wired",
+    500,
+    { wirelessMaxHz: 1000, wiredMaxHz: 1000 },
+  );
+  assert.equal(decodeOnboardProfile(rate, 3, { sector: 1, enabled: true }, true).reportRateWired, 500);
+
+  const named = encodeProfileName(G502_LIGHTSPEED_PROFILE_1, 3, "OM_VERIFY", PROFILE_NAME_MAX_CHARS);
+  assert.equal(decodeOnboardProfile(named, 3, { sector: 1, enabled: true }, true).name, "OM_VERIFY");
+  for (const sector of [dpi, rate, named]) assert.equal(profileCrc(sector), storedCrc(sector));
+});
+
+test("decodes the captured G102 LIGHTSYNC format-4 profile", () => {
+  const profile = decodeOnboardProfile(
+    G102_LIGHTSYNC_PROFILE,
+    4,
+    { sector: 1, enabled: true },
+    false,
+  );
+  assert.equal(G102_LIGHTSYNC_PROFILE.length, 255);
+  assert.equal(profile.crcValid, true);
+  assert.equal(profile.name, "PROFILE_NAME_DEFAULT");
+  assert.equal(profile.defaultDpiIndex, 1);
+  assert.deepEqual(
+    profile.dpiStages,
+    [50, 2000, 1600].map((dpi) => ({ x: dpi, y: dpi, lod: 0 })),
+  );
+  assert.equal(profile.reportRateWireless, 1000);
+  assert.equal(profile.reportRateWired, 1000);
+  assert.equal(profile.angleSnapping, null);
+  assert.equal(profile.isCurrent, false, "the capture was taken while the mouse was in host mode");
+});
+
+test("parses the captured G102 LIGHTSYNC format-4 geometry and directory", () => {
+  assert.deepEqual(
+    { verified: describeProfileFormat(4).verified, writable: describeProfileFormat(4).writable },
+    { verified: true, writable: true },
+  );
+  assert.deepEqual(parseProfilesInfo(G102_LIGHTSYNC_INFO_REPLY), {
+    memoryModelId: 1,
+    profileFormatId: 4,
+    profileCount: 1,
+    sectorCount: 16,
+    sectorSize: 255,
+  });
+  assert.equal(profileCrc(G102_LIGHTSYNC_DIRECTORY), storedCrc(G102_LIGHTSYNC_DIRECTORY));
+  assert.deepEqual(parseDirectory(G102_LIGHTSYNC_DIRECTORY), [
+    { sector: 1, enabled: true },
+  ]);
+});
+
+test("format-4 encoders prepare reversible scalar DPI, shared-rate and name probes", () => {
+  const capabilities = capabilitiesForFormat(4);
+  assert.deepEqual(capabilities.dpiStages, { maxStages: 5, minDpi: 50, maxDpi: 8000, stepDpi: 50 });
+  assert.deepEqual(reportRatesFor(capabilities.reportRates, "wired"), [125, 250, 500, 1000]);
+
+  const original = decodeOnboardProfile(G102_LIGHTSYNC_PROFILE, 4, { sector: 1, enabled: true }, false);
+  const stages = original.dpiStages.map((stage) => ({ ...stage }));
+  stages[original.defaultDpiIndex!] = { x: 1000, y: 1000, lod: 0 };
+  const dpi = encodeDpiStages(G102_LIGHTSYNC_PROFILE, 4, {
+    stages,
+    defaultIndex: original.defaultDpiIndex!,
+  });
+  assert.equal(decodeOnboardProfile(dpi, 4, { sector: 1, enabled: true }, false).dpiStages[1].x, 1000);
+  assert.equal(profileCrc(dpi), storedCrc(dpi));
+
+  const rate = encodeReportRate(G102_LIGHTSYNC_PROFILE, 4, "wired", 500);
+  assert.equal(rate[0], 2, "legacy profiles store the USB interval in milliseconds");
+  assert.equal(decodeOnboardProfile(rate, 4, { sector: 1, enabled: true }, false).reportRateWired, 500);
+
+  const named = encodeProfileName(G102_LIGHTSYNC_PROFILE, 4, "OM_VERIFY");
+  assert.equal(decodeOnboardProfile(named, 4, { sector: 1, enabled: true }, false).name, "OM_VERIFY");
+  assert.equal(profileCrc(named), storedCrc(named));
 });
 
 test("factory reset image is exact, CRC-valid and limited to captured geometry", () => {
+  assert.equal(supportsFactoryReset(7), true);
+  for (const format of [1, 2, 3, 4, 5, 6, 8, null, undefined]) {
+    assert.equal(supportsFactoryReset(format), false, `format ${format ?? "missing"}`);
+  }
   const factory = factoryProfileForFormat(7, 255);
   assert.ok(factory);
   assert.deepEqual([...factory], [...SECTOR_2]);
@@ -418,9 +818,26 @@ test("report-rate ceilings differ per link and per format", () => {
   assert.equal(validateReportRate(8000, rates, "wireless"), null);
   assert.match(validateReportRate(8000, rates, "wired") ?? "", /Wired report rate/);
   assert.equal(validateReportRate(1000, rates, "wired"), null);
-
+  assert.deepEqual(
+    reportRatesForDevice(rates, "wireless", [125, 500, 1000, 2000], "wireless", false),
+    [125, 500, 1000, 2000],
+  );
+  assert.deepEqual(
+    reportRatesForDevice(rates, "wired", [125, 500, 1000, 2000], "wireless", false),
+    [125, 250, 500, 1000],
+    "the disconnected wired link keeps its captured format ceiling",
+  );
+  assert.deepEqual(
+    reportRatesForDevice({ wirelessMaxHz: 1000, wiredMaxHz: 1000 }, "wired", [125, 500, 1000], "wired", true),
+    [125, 500, 1000],
+    "a shared legacy interval uses the exact live bitmap",
+  );
+
+  // Format 8 reports the same split; this replaces the old Superstrike PID
+  // exception with a format capability.
+  assert.deepEqual(capabilitiesForFormat(8).reportRates, { wirelessMaxHz: 8000, wiredMaxHz: 1000 });
   // Formats whose ceilings were never captured offer nothing.
-  assert.equal(capabilitiesForFormat(8).reportRates, null);
+  assert.equal(capabilitiesForFormat(6).reportRates, null);
   assert.deepEqual(reportRatesFor(null, "wireless"), []);
   assert.match(validateReportRate(1000, null, "wireless") ?? "", /not known/);
 });
@@ -481,10 +898,15 @@ test("DPI slot limits are per format, not global", () => {
   const format7 = capabilitiesForFormat(7).dpiStages;
   assert.deepEqual(format7, { maxStages: 5, minDpi: 100, maxDpi: 32000, stepDpi: 50 });
 
-  // Base v1 has no stage table, and no other format's range was ever captured,
-  // so slots must not be offered rather than borrowing format 7's numbers.
+  // Format 1 uses the grid captured from the G402. Uncaptured formats must not
+  // borrow either it or format 7's limits.
+  assert.deepEqual(capabilitiesForFormat(1).dpiStages, {
+    maxStages: 5,
+    minDpi: 252,
+    maxDpi: 4032,
+    stepDpi: 84,
+  });
   assert.equal(capabilitiesForFormat(8).dpiStages, null);
-  assert.equal(capabilitiesForFormat(1).dpiStages, null);
   assert.equal(capabilitiesForFormat(6).dpiStages, null);
   assert.equal(capabilitiesForFormat(null).dpiStages, null);
 
@@ -530,8 +952,8 @@ test("lift-off limits come from the profile format, not the model", () => {
   // Format 8 carries the analog-button block, so it is the Superstrike format.
   assert.deepEqual(capabilitiesForFormat(8).supportedLods, ["Low", "High"]);
 
-  // Anything else keeps what the driver assumed before limits were per format.
-  assert.deepEqual(capabilitiesForFormat(1).supportedLods, ["Medium", "High"]);
+  // The G402 capture did not expose a lift-off setting for format 1.
+  assert.deepEqual(capabilitiesForFormat(1).supportedLods, []);
 
   // getInfo is allowed to fail, so an absent format must not throw.
   assert.deepEqual(capabilitiesForFormat(null).supportedLods, ["Medium", "High"]);
diff --git a/src/devices/logitech/onboard-profiles.ts b/src/devices/logitech/onboard-profiles.ts
index c59ea79c..edd66140 100644
--- a/src/devices/logitech/onboard-profiles.ts
+++ b/src/devices/logitech/onboard-profiles.ts
@@ -47,7 +47,24 @@ const PROFILE_FORMAT_NAMES: Record<number, string> = {
  * Add a format here only after a dump from that device decodes sensibly with a
  * matching CRC.
  */
-const VERIFIED_FORMATS = new Set([7]);
+const VERIFIED_FORMATS = new Set([2, 3, 4, 7]);
+const WRITABLE_FORMATS = new Set([2, 4, 7]);
+const PROFILE_WRITE_PROBE_FORMATS = new Set([2, 3, 4]);
+const FACTORY_RESET_FORMATS = new Set([7]);
+
+/** Whether this format has a reversible guided write probe. */
+export function supportsProfileWriteProbe(profileFormatId: number | null | undefined): boolean {
+  return profileFormatId !== null
+    && profileFormatId !== undefined
+    && PROFILE_WRITE_PROBE_FORMATS.has(profileFormatId);
+}
+
+/** Whether a complete, byte-for-byte reset image exists for this format. */
+export function supportsFactoryReset(profileFormatId: number | null | undefined): boolean {
+  return profileFormatId !== null
+    && profileFormatId !== undefined
+    && FACTORY_RESET_FORMATS.has(profileFormatId);
+}
 
 export interface ProfileFormat {
   id: number;
@@ -58,6 +75,8 @@ export interface ProfileFormat {
   supported: boolean;
   /** The layout has been confirmed against real hardware. */
   verified: boolean;
+  /** Profile-content writes have been applied and restored on hardware. */
+  writable: boolean;
 }
 
 export function describeProfileFormat(profileFormatId: number): ProfileFormat {
@@ -67,6 +86,7 @@ export function describeProfileFormat(profileFormatId: number): ProfileFormat {
     base: profileFormatId >= 6 ? "v6" : "v1",
     supported: profileFormatId >= 1 && profileFormatId <= 8,
     verified: VERIFIED_FORMATS.has(profileFormatId),
+    writable: WRITABLE_FORMATS.has(profileFormatId),
   };
 }
 
@@ -161,6 +181,37 @@ const DEFAULT_FORMAT_CAPABILITIES: ProfileFormatCapabilities = {
 };
 
 const FORMAT_CAPABILITIES: Record<number, ProfileFormatCapabilities> = {
+  // Format 1 capture: five scalar slots on a 252-4032 grid in steps of 84.
+  1: {
+    supportedLods: [],
+    lodEncoding: LOD_ENCODING,
+    dpiStages: { maxStages: 5, minDpi: 252, maxDpi: 4032, stepDpi: 84 },
+    reportRates: { wirelessMaxHz: 1000, wiredMaxHz: 1000 },
+    maxNameLength: null,
+    bunnyHop: false,
+  },
+  // LOGAN is shared by G502 generations. The HERO capture advertises the
+  // widest observed grid; callers narrow it to the connected sensor's live
+  // DPI list so an older 12K G502 is never offered the HERO's 25.6K ceiling.
+  2: {
+    supportedLods: [],
+    lodEncoding: LOD_ENCODING,
+    dpiStages: { maxStages: 5, minDpi: 100, maxDpi: 25600, stepDpi: 50 },
+    reportRates: { wirelessMaxHz: 1000, wiredMaxHz: 1000 },
+    maxNameLength: PROFILE_NAME_MAX_CHARS,
+    bunnyHop: false,
+  },
+  // A G102 LIGHTSYNC on format 4 reported five scalar slots, 50-8000 DPI in
+  // steps of 50, and 125/250/500/1000 Hz through the capability collector.
+  // Its DPI, rate, and name writes were applied, read back live, and restored.
+  4: {
+    supportedLods: [],
+    lodEncoding: LOD_ENCODING,
+    dpiStages: { maxStages: 5, minDpi: 50, maxDpi: 8000, stepDpi: 50 },
+    reportRates: { wirelessMaxHz: 1000, wiredMaxHz: 1000 },
+    maxNameLength: PROFILE_NAME_MAX_CHARS,
+    bunnyHop: false,
+  },
   // Pro X Superlight 2. Three levels, counted from one. Five slots, from the
   // 5x5 stage table in the registration and confirmed against a real profile.
   7: {
@@ -182,13 +233,41 @@ const FORMAT_CAPABILITIES: Record<number, ProfileFormatCapabilities> = {
     supportedLods: ["Low", "High"],
     lodEncoding: LOD_ENCODING,
     dpiStages: null,
-    reportRates: null,
+    // Captured behavior: the wireless link reaches 8 kHz while USB is capped
+    // at 1 kHz. Transport selection is resolved from HID++ identity data.
+    reportRates: { wirelessMaxHz: 8000, wiredMaxHz: 1000 },
     // The name region is part of base v6, which format 8 shares.
     maxNameLength: PROFILE_NAME_MAX_CHARS,
     bunnyHop: true,
   },
 };
 
+function greatestCommonDivisor(left: number, right: number): number {
+  let a = Math.abs(left);
+  let b = Math.abs(right);
+  while (b !== 0) [a, b] = [b, a % b];
+  return a;
+}
+
+/** Narrows format storage limits to the DPI grid advertised by this sensor. */
+export function dpiStageCapabilitiesForOptions(
+  formatCapabilities: DpiStageCapabilities | null,
+  dpiOptions: readonly number[],
+): DpiStageCapabilities | null {
+  if (formatCapabilities === null || dpiOptions.length === 0) return formatCapabilities;
+  const values = [...new Set(dpiOptions)]
+    .filter((value) => Number.isInteger(value) && value > 0)
+    .sort((left, right) => left - right);
+  if (values.length === 0) return formatCapabilities;
+  const stepDpi = values.reduce(greatestCommonDivisor);
+  return {
+    maxStages: formatCapabilities.maxStages,
+    minDpi: values[0],
+    maxDpi: values.at(-1)!,
+    stepDpi: stepDpi || formatCapabilities.stepDpi,
+  };
+}
+
 export function capabilitiesForFormat(profileFormatId: number | null | undefined): ProfileFormatCapabilities {
   if (profileFormatId === null || profileFormatId === undefined) return DEFAULT_FORMAT_CAPABILITIES;
   return FORMAT_CAPABILITIES[profileFormatId] ?? DEFAULT_FORMAT_CAPABILITIES;
@@ -272,7 +351,8 @@ interface ProfileLayout {
 }
 
 const LAYOUT_V1: ProfileLayout = {
-  reportRateWireless: null,
+  // Formats 1-5 store one shared report interval, regardless of transport.
+  reportRateWireless: 0x00,
   reportRateWired: 0x00,
   dpi: 0x01,
   angleSnapping: 0x11,
@@ -431,7 +511,7 @@ const FACTORY_PROFILE_FORMAT_7 = `
 
 /** Returns a fresh, CRC-valid factory sector only for a captured geometry. */
 export function factoryProfileForFormat(profileFormatId: number, sectorSize: number): Uint8Array | null {
-  if (profileFormatId !== 7 || sectorSize !== 255) return null;
+  if (!supportsFactoryReset(profileFormatId) || sectorSize !== 255) return null;
   return Uint8Array.from(
     FACTORY_PROFILE_FORMAT_7.trim().split(/\s+/),
     (byte) => Number.parseInt(byte, 16),
@@ -488,7 +568,7 @@ function decodeDpi(bytes: Uint8Array, offset: number): { stages: DpiStage[]; def
 }
 
 /** Formats 1-5 store one little-endian DPI value per slot, without X/Y or LOD. */
-function decodeDpiV1(bytes: Uint8Array, offset: number): { stages: DpiStage[]; defaultIndex: number | null } {
+function decodeLegacyDpi(bytes: Uint8Array, offset: number): { stages: DpiStage[]; defaultIndex: number | null } {
   const rawDefaultIndex = bytes[offset];
   const stages: DpiStage[] = [];
   for (let stage = 0; stage < DPI_STAGE_SLOTS; stage += 1) {
@@ -509,7 +589,7 @@ function decodeReportRate(bytes: Uint8Array, offset: number | null): number | nu
 }
 
 /** Formats 1-5 store the USB polling interval in milliseconds. */
-function decodeReportRateV1(bytes: Uint8Array, offset: number | null): number | null {
+function decodeLegacyReportRate(bytes: Uint8Array, offset: number | null): number | null {
   if (offset === null) return null;
   const intervalMs = bytes[offset];
   if (intervalMs === undefined || intervalMs === 0xff || intervalMs === 0) return null;
@@ -527,6 +607,24 @@ export function reportRatesFor(
   return REPORT_RATE_HZ.filter((rate) => rate <= ceiling);
 }
 
+/**
+ * Intersects format storage support with the rates advertised by the active
+ * hardware link. Legacy formats share one interval byte, so their live list
+ * applies to the whole profile; v6 formats retain the captured limit for the
+ * inactive link because the mouse cannot advertise that link while disconnected.
+ */
+export function reportRatesForDevice(
+  capabilities: ReportRateCapabilities | null,
+  link: "wireless" | "wired",
+  liveRates: readonly number[],
+  activeLink: "wireless" | "wired",
+  sharedInterval: boolean,
+): number[] {
+  const storedRates = reportRatesFor(capabilities, link);
+  if (!sharedInterval && link !== activeLink) return storedRates;
+  return storedRates.filter((rate) => liveRates.includes(rate));
+}
+
 export function validateReportRate(
   hz: number,
   capabilities: ReportRateCapabilities | null,
@@ -550,8 +648,11 @@ export function encodeReportRate(
   profileFormatId: number,
   link: "wireless" | "wired",
   hz: number,
+  capabilitiesOverride?: ReportRateCapabilities | null,
 ): Uint8Array {
-  const capabilities = capabilitiesForFormat(profileFormatId).reportRates;
+  const capabilities = capabilitiesOverride === undefined
+    ? capabilitiesForFormat(profileFormatId).reportRates
+    : capabilitiesOverride;
   const invalid = validateReportRate(hz, capabilities, link);
   if (invalid) throw new Error(invalid);
   const layout = layoutForFormat(profileFormatId);
@@ -559,7 +660,9 @@ export function encodeReportRate(
   if (offset === null) throw new Error("This profile format has no report-rate setting.");
 
   const result = sector.slice();
-  result[offset] = REPORT_RATE_HZ.indexOf(hz as (typeof REPORT_RATE_HZ)[number]);
+  result[offset] = profileFormatId < 6
+    ? Math.round(1000 / hz)
+    : REPORT_RATE_HZ.indexOf(hz as (typeof REPORT_RATE_HZ)[number]);
   return applyCrc(result);
 }
 
@@ -586,8 +689,12 @@ export function encodeProfileName(
   sector: Uint8Array,
   profileFormatId: number,
   name: string,
+  maxLengthOverride?: number | null,
 ): Uint8Array {
-  const invalid = validateProfileName(name, capabilitiesForFormat(profileFormatId).maxNameLength);
+  const maxLength = maxLengthOverride === undefined
+    ? capabilitiesForFormat(profileFormatId).maxNameLength
+    : maxLengthOverride;
+  const invalid = validateProfileName(name, maxLength);
   if (invalid) throw new Error(invalid);
   const offset = layoutForFormat(profileFormatId).profileName;
 
@@ -641,6 +748,7 @@ export interface DpiStagePlan {
 export function validateDpiStagePlan(
   plan: DpiStagePlan,
   capabilities: DpiStageCapabilities | null,
+  legacyScalar = false,
 ): string | null {
   if (capabilities === null) {
     return "DPI slots are not known for this profile format.";
@@ -661,8 +769,11 @@ export function validateDpiStagePlan(
         return `Slot ${index + 1} ${axis} DPI must be a multiple of ${stepDpi}.`;
       }
     }
-    // 0 is the "unused stage" marker, so an in-use slot cannot carry it.
-    if (!Number.isInteger(stage.lod) || stage.lod < 1 || stage.lod > 3) {
+    if (legacyScalar) {
+      if (stage.x !== stage.y) return `Slot ${index + 1} must use the same X and Y DPI.`;
+      if (stage.lod !== 0) return `Slot ${index + 1} cannot store lift-off distance.`;
+    } else if (!Number.isInteger(stage.lod) || stage.lod < 1 || stage.lod > 3) {
+      // 0 is the "unused stage" marker on formats with per-stage lift-off.
       return `Slot ${index + 1} has an invalid lift-off level.`;
     }
   }
@@ -698,8 +809,13 @@ export function encodeDpiStages(
   sector: Uint8Array,
   profileFormatId: number,
   plan: DpiStagePlan,
+  capabilitiesOverride?: DpiStageCapabilities | null,
 ): Uint8Array {
-  const invalid = validateDpiStagePlan(plan, capabilitiesForFormat(profileFormatId).dpiStages);
+  const legacyScalar = profileFormatId < 6;
+  const capabilities = capabilitiesOverride === undefined
+    ? capabilitiesForFormat(profileFormatId).dpiStages
+    : capabilitiesOverride;
+  const invalid = validateDpiStagePlan(plan, capabilities, legacyScalar);
   if (invalid) throw new Error(invalid);
   const layout = layoutForFormat(profileFormatId);
   if (layout.dpi === null) throw new Error("This profile format has no DPI stages.");
@@ -711,6 +827,13 @@ export function encodeDpiStages(
   const gShift = result[layout.dpi + 1] ?? 0;
   if (gShift >= plan.stages.length) result[layout.dpi + 1] = plan.defaultIndex;
 
+  if (legacyScalar) {
+    for (let stage = 0; stage < DPI_STAGE_SLOTS; stage += 1) {
+      writeUint16LE(result, layout.dpi + 2 + stage * 2, plan.stages[stage]?.x ?? 0);
+    }
+    return applyCrc(result);
+  }
+
   for (let stage = 0; stage < DPI_STAGE_SLOTS; stage += 1) {
     const base = layout.dpi + 2 + stage * 5;
     const entry = plan.stages[stage];
@@ -769,7 +892,7 @@ export function reproduceProfile(before: Uint8Array, after: Uint8Array, profileF
 
   const copyRate = (offset: number | null): void => {
     if (offset === null) return;
-    const hz = legacyLayout ? decodeReportRateV1(after, offset) : decodeReportRate(after, offset);
+    const hz = legacyLayout ? decodeLegacyReportRate(after, offset) : decodeReportRate(after, offset);
     if (hz === null) return;
     if (legacyLayout) result[offset] = 1000 / hz;
     else {
@@ -781,7 +904,7 @@ export function reproduceProfile(before: Uint8Array, after: Uint8Array, profileF
   copyRate(layout.reportRateWired);
 
   if (layout.dpi !== null) {
-    const dpi = legacyLayout ? decodeDpiV1(after, layout.dpi) : decodeDpi(after, layout.dpi);
+    const dpi = legacyLayout ? decodeLegacyDpi(after, layout.dpi) : decodeDpi(after, layout.dpi);
     if (dpi.defaultIndex !== null) result[layout.dpi] = dpi.defaultIndex;
     result[layout.dpi + 1] = after[layout.dpi + 1];
     // Stages are re-encoded from decoded values, not copied, so their
@@ -815,7 +938,7 @@ export function reproduceProfile(before: Uint8Array, after: Uint8Array, profileF
     if (seconds !== null) writeUint16LE(result, offset, seconds);
   }
 
-  const name = legacyLayout ? null : decodeName(after, layout.profileName);
+  const name = profileFormatId === 1 ? null : decodeName(after, layout.profileName);
   if (name !== null) {
     const encoded = new Uint8Array(0x30);
     encoded.set(after.slice(layout.profileName, layout.profileName + 0x30).map(() => 0));
@@ -852,7 +975,7 @@ export function decodeOnboardProfile(
   const legacyLayout = profileFormatId < 6;
   const dpi = layout.dpi === null
     ? { stages: [], defaultIndex: null }
-    : legacyLayout ? decodeDpiV1(bytes, layout.dpi) : decodeDpi(bytes, layout.dpi);
+    : legacyLayout ? decodeLegacyDpi(bytes, layout.dpi) : decodeDpi(bytes, layout.dpi);
   const angleSnappingByte = bytes[layout.angleSnapping];
 
   return {
@@ -861,14 +984,14 @@ export function decodeOnboardProfile(
     isCurrent,
     // The v1 region is byte text, not UTF-16. This G402 capture contains
     // non-text device data there, so do not manufacture a mojibake name.
-    name: legacyLayout ? null : decodeName(bytes, layout.profileName),
+    name: profileFormatId === 1 ? null : decodeName(bytes, layout.profileName),
     dpiStages: dpi.stages,
     defaultDpiIndex: dpi.defaultIndex,
     reportRateWireless: legacyLayout
-      ? decodeReportRateV1(bytes, layout.reportRateWireless)
+      ? decodeLegacyReportRate(bytes, layout.reportRateWireless)
       : decodeReportRate(bytes, layout.reportRateWireless),
     reportRateWired: legacyLayout
-      ? decodeReportRateV1(bytes, layout.reportRateWired)
+      ? decodeLegacyReportRate(bytes, layout.reportRateWired)
       : decodeReportRate(bytes, layout.reportRateWired),
     angleSnapping: angleSnappingByte === undefined || angleSnappingByte === 0xff
       ? null
diff --git a/src/devices/logitech/protocol.ts b/src/devices/logitech/protocol.ts
index 01884366..9c6dbd01 100644
--- a/src/devices/logitech/protocol.ts
+++ b/src/devices/logitech/protocol.ts
@@ -12,37 +12,12 @@ export const DEVICE_INDEX_RECEIVER = 0x01;
 /** A mouse addressed over its own USB interface answers on 0xFF. */
 export const DEVICE_INDEX_DIRECT = 0xff;
 
-/**
- * Logitech mice whose vendor interface is the mouse itself rather than a
- * receiver. They answer HID++ on device index 0xFF and keep their writable
- * settings in an onboard profile.
- *
- * - 0xc07e — G402 / G402 Hyperion Fury (wired)
- * - 0xc08f — G403 HERO (wired)
- *
- * This module deliberately imports nothing, so both the driver and the WebHID
- * filters in ../vendors can read it without a cycle.
- */
-export const LOGITECH_DIRECT_PRODUCT_IDS = [0xc07e, 0xc08f] as const;
-
-const DIRECT_PRODUCT_ID_SET: ReadonlySet<number> = new Set(LOGITECH_DIRECT_PRODUCT_IDS);
-
-export function isDirectConnectProduct(productId: number): boolean {
-  return DIRECT_PRODUCT_ID_SET.has(productId);
-}
-
 /**
  * Whether this HID++ endpoint is the mouse itself rather than a receiver.
- * Runtime probing is authoritative for unknown Logitech product IDs; the PID
- * list is only the pre-probe fast path.
+ * Runtime device-index probing is authoritative; product IDs do not decide it.
  */
-export function isDirectConnection(productId: number, resolvedDeviceIndex: number | null): boolean {
-  return resolvedDeviceIndex === DEVICE_INDEX_DIRECT
-    || (resolvedDeviceIndex === null && isDirectConnectProduct(productId));
-}
-
-export function hidppDeviceIndex(productId: number): number {
-  return isDirectConnectProduct(productId) ? DEVICE_INDEX_DIRECT : DEVICE_INDEX_RECEIVER;
+export function isDirectConnection(resolvedDeviceIndex: number | null): boolean {
+  return resolvedDeviceIndex === DEVICE_INDEX_DIRECT;
 }
 
 /** HID++ 2.0 error codes, reported in byte 4 of a 0xFF error response. */
@@ -118,30 +93,6 @@ export function decodeReportRateBitmap(bitflags: number): number[] {
   return rates.sort((left, right) => left - right);
 }
 
-/**
- * Sensor grids for direct-connect mice, used only when one answers the legacy
- * DPI-list request with nothing usable. Every value is still confirmed by the
- * read-back after a write, so a wrong entry surfaces as a rejected change
- * rather than a silently wrong setting.
- */
-const LEGACY_DPI_GRIDS: ReadonlyMap<number, { min: number; step: number; max: number }> = new Map([
-  // G402: hardware advertises 252 to 4032 in steps of 84 — not the 240/80
-  // quoted by vendor software, which rounds these to marketing numbers (2436
-  // is displayed as "2400"). Captured from a getSensorDpiList reply of
-  // 00 FC | E0 54 | 0F C0.
-  [0xc07e, { min: 252, step: 84, max: 4032 }],
-  // G403 HERO: the HERO sensor's documented 100-25,600 range in steps of 50.
-  [0xc08f, { min: 100, step: 50, max: 25600 }],
-]);
-
-export function legacyDpiFallback(productId: number): number[] {
-  const grid = LEGACY_DPI_GRIDS.get(productId);
-  if (!grid) return [];
-  const options: number[] = [];
-  for (let dpi = grid.min; dpi <= grid.max; dpi += grid.step) options.push(dpi);
-  return options;
-}
-
 export type BatteryChargeState =
   | "Charging" | "Charging slowly" | "Almost full" | "Full" | "Discharging" | "Unknown";
 
diff --git a/src/devices/mouse-types.ts b/src/devices/mouse-types.ts
index 97ccfb3a..8af7fa42 100644
--- a/src/devices/mouse-types.ts
+++ b/src/devices/mouse-types.ts
@@ -122,6 +122,8 @@ export interface MouseStatus {
     supported: boolean;
     /** False when the layout comes from vendor code but was never confirmed on hardware. */
     verified: boolean;
+    /** False until profile-content writes were applied and restored on hardware. */
+    writable: boolean;
   } | null;
   gamingSurfaceMode?: "On" | "Off" | "Auto" | null;
   lightforceSwitchMode?: "Hybrid" | "Optical" | null;
diff --git a/src/devices/vendors.ts b/src/devices/vendors.ts
index 18b4e4fd..ddf3e287 100644
--- a/src/devices/vendors.ts
+++ b/src/devices/vendors.ts
@@ -1,5 +1,4 @@
 import { EGG_WE_HID_FILTERS } from "./endgame/egg-we-control.ts";
-import { LOGITECH_DIRECT_PRODUCT_IDS } from "./logitech/protocol.ts";
 
 export const VENDOR_ID = {
   pulsar: 0x3710,
@@ -53,22 +52,9 @@ export const RAZER_DEATHADDER_ESSENTIAL_FILTERS: HIDDeviceFilter[] = [0x006e, 0x
 
 export const TEEVOLUTION_PRODUCT_IDS = [0xf520, 0xf523, 0xf5bb, 0xf522] as const;
 
-// Logitech HID++ control interfaces addressed through a receiver slot (HID++
-// device index 0x01). 0xc54d and 0xc547 are newer Lightspeed receivers, 0xc539
-// is HERO-era Lightspeed, and 0xc0a8 is the PRO X 2 Superstrike USB interface.
-export const LOGITECH_RECEIVER_PRODUCT_IDS = [0xc54d, 0xc539, 0xc0a8, 0xc547] as const;
-
-// Every Logitech product with an HID++ control interface, receiver-addressed or
-// not. Direct-connect product IDs live in ./logitech/protocol so the driver and
-// these filters cannot disagree about which index a mouse answers on.
-export const LOGITECH_PRODUCT_IDS = [
-  ...LOGITECH_RECEIVER_PRODUCT_IDS,
-  ...LOGITECH_DIRECT_PRODUCT_IDS,
-] as const;
-
 /**
- * Every Logitech HID++ control interface, not only the product ids listed
- * above: a mouse we have never seen should still be offered. The usage page
+ * Every Logitech HID++ control interface: a mouse we have never seen should
+ * still be offered. The usage page
  * keeps this to HID++ endpoints, but it cannot tell a mouse from a keyboard or
  * a headset — the driver decides that after connecting, by looking for a sensor
  * feature, and reports a clear message when there is none.