diff --git a/src/host_stream/app_header_init.c b/src/host_stream/app_header_init.c
index a54ab8a..5fe5507 100644
--- a/src/host_stream/app_header_init.c
+++ b/src/host_stream/app_header_init.c
@@ -13,6 +13,8 @@
 #include "stdc_app.h"
 #include "kdp2_host_stream.h"
 #include "event_recorder.h"
+#include "can_bus.h"
+#include "bt_uart.h"
 
 //#define ENABLE_DBG_LOG
 
@@ -189,6 +191,39 @@ static void print_yolo_result(kp_app_yolo_result_t *yolo_data)
             break;  /* 找到一輛車就夠了 */
         }
 
+        /* ── [CAN] vehicle speed control + BLE status notify ────────────
+         * 偵測到 vehicle(class=2)：限速 10，並透過 BLE 通知目前 CAN 狀態。
+         * 無 vehicle：恢復正常速度 240，並通知解除。
+         * 只在狀態改變時呼叫，keepalive thread 會持續維持最新速度。
+         * ---------------------------------------------------------------- */
+        {
+            static int s_can_vehicle_detected = -1;  /* -1 = 未初始化 */
+            int vehicle_now = (cur_level == 1) ? 1 : 0;
+
+            if (vehicle_now != s_can_vehicle_detected) {
+                uint8_t speed = vehicle_now ? 10 : 240;
+
+                /* 送 CAN 速度指令 */
+                can_bus_send_control_cmd(speed);
+
+                /* 透過 BLE 通知目前 CAN bus 狀態 */
+                {
+                    char json[128];
+                    snprintf(json, sizeof(json),
+                        "{\"response_type\":\"can_status\","
+                        "\"content\":{"
+                        "\"vehicle_detected\":%d,"
+                        "\"speed_cmd\":%u}}",
+                        vehicle_now, (unsigned)speed);
+                    bt_uart_send_json(json);
+                }
+
+                printf("[YOLO] CAN speed cmd: %u (%s)\n",
+                       speed, vehicle_now ? "vehicle detected" : "clear");
+                s_can_vehicle_detected = vehicle_now;
+            }
+        }
+
         /* 狀態有變化時，檢查 debounce */
         if (cur_level != s_cw_level ||
             strcmp(cur_type, s_cw_type) != 0)
diff --git a/src/host_stream/event_recorder.c b/src/host_stream/event_recorder.c
index c8f32ea..d2d5993 100644
--- a/src/host_stream/event_recorder.c
+++ b/src/host_stream/event_recorder.c
@@ -55,8 +55,6 @@ static int msg_send(const char *fifo,
                     unsigned int data_size,
                     int has_response)
 {
-    MsgContext tMsgCtx;
-
     /* Speed control has moved to direct CAN control frames.
      * Avoid MsgBroker FIFO dependency (/tmp/canbus/c0/command.fifo). */
     if (cmd && strcmp(cmd, "setSpeed") == 0 && data && data_size >= 1) {
@@ -64,6 +62,12 @@ static int msg_send(const char *fifo,
         return 0;
     }
 
+#if 0
+    /* Legacy: IPC path via MsgBroker FIFO → separate CAN bus process.
+     * No longer used: all speed commands go through can_bus_send_control_cmd()
+     * above.  Kept for reference in case other cmd types are needed later. */
+    MsgContext tMsgCtx;
+
     if (!fifo || !host || !cmd)
         return -1;
 
@@ -81,6 +85,12 @@ static int msg_send(const char *fifo,
     tMsgCtx.dwDataSize = data_size;
 
     return MsgBroker_SendMsg(fifo, &tMsgCtx);
+#else
+    (void)fifo;
+    (void)host;
+    (void)has_response;
+    return -1;
+#endif
 }
 
 /* ── Config ──────────────────────────────────────────────────────────────── */