feat(diagnostics): read-only evidence probes for the open on-car tickets

The 2026-10-13 triage of CP-055, CP-078-081, CP-083, CP-086, CP-087 and
CP-090 found the same gap each time: the bundle cannot say what the app
did between two exports, or what became of a voice line or a window.
These probes record it without reading anything new from the car.

- Monitor journal (unstable, CP-078/079/080): a bounded, atomically
  written monitor-journal.json survives process deaths, which the
  in-memory validation rings cannot. Process start, boot, monitor
  start/suspend/stop/destroy, trip end, ledger entries and page reloads,
  each with wall clock, uptime, odometer and SOC. Exported as Q11 inside
  the existing validation file so the 8-file bundle gains nothing.
  Stable gets a no-op, as for every other probe.
- CP-055 Q1 now fires on isMapNavigating, the guidance signal proven on
  the car, instead of the recorder's flag that never turned true.
- EcoVoice keeps its last 20 outcomes (origin, path, bound, wait,
  process importance) for [eco_driving]: the vendor prompt has no
  completion callback, so this is the only record a line was dispatched.
- [eco_trip_review] always prints the windows inputs, so "never open"
  and "open but not distinguishable" read apart (CP-086).
- AdviceEntry.notifiedAtMs (nullable, no schema bump: older files read
  unchanged) lets a bundle prove notifications stayed out of trips.
- Trips artifact schema 3 carries DrivingStress per tracked trip, to
  show the measurement returns figures on real tracks (CP-090).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: malys

CHANGELOG.md

@@ -6,6 +6,24 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 
 ### Added
 
+- **Read-only evidence probes for the open on-car tickets (CP-055, CP-078–CP-081, CP-083,
+  CP-086, CP-087, CP-090).** Nothing new is read from or written to the car.
+  - *Monitor journal (unstable, CP-078/079/080).* A persistent, bounded (200 lines), atomically
+    written `monitor-journal.json` records process start, boot received (with detection on/off),
+    monitor start/suspension/self-stop/destroy, every trip end (automatic, km, stored, history
+    revision), every battery ledger entry, and dashboard / battery page reloads, each with
+    wall clock, uptime, odometer and charge. It reaches the existing validation file as block
+    Q11; the bundle gains no file.
+  - *Q1 on the proven guidance signal (CP-055).* When `isMapNavigating` turns true the
+    destination probe fires, instead of waiting for a guidance flag never seen on the car.
+  - *Voice outcomes (CP-081/083).* The last 20 voice dispatches (origin, voice path, bind state,
+    wait, process importance) are listed as `voice_event=` in the diagnostic `[eco_driving]`.
+  - *Windows factor (CP-086).* `[eco_trip_review]` always prints the newest trip's open-window
+    samples, open distance above 60 km/h, window residual and whether it was distinguishable.
+  - *Notification time (CP-087).* Advice history entries record when their notification was
+    posted (`notified_at_ms=` in `[battery_advice]`); older files read unchanged.
+  - *Driving stress per trip (unstable, CP-090).* The trips artifact (schema 3) carries
+    `drivingStress` for each exported trip with a track.
 - **Energy page warms when driving is not smooth.** With eco advice on, the page background
   between the cards blends gradually towards the warning colour as the harsh-acceleration share
   rises: none up to 6 %, full at 24 % (the advice mark is 12 %). Eased over a few seconds,

app/proguard-rules.pro

@@ -55,3 +55,9 @@
 -keep class com.evsuite.hardware.telemetry.BatteryLedgerEntry { *; }
 -keep class com.evsuite.hardware.telemetry.BatteryLedgerFile { *; }
 -keep class com.evsuite.hardware.telemetry.BatteryLedgerStore$LedgerEnvelope { *; }
+
+# The monitor journal (CP-080) and the trip artifact's stress rows (CP-090), kept for the
+# same reasons as the stores and artifacts above: persisted by Gson, read by a person.
+-keep class com.evsuite.chargepilot.MonitorJournal$Entry { *; }
+-keep class com.evsuite.chargepilot.MonitorJournal$Envelope { *; }
+-keep class com.evsuite.chargepilot.TripHistoryArtifact$TripStress { *; }

app/src/main/java/com/evsuite/chargepilot/AdviceJournal.kt

@@ -18,6 +18,12 @@ data class AdviceEntry(
     val kind: AdviceKind,
     val text: String,
     val notified: Boolean = false,
+    /**
+     * When the notification for this entry was posted (CP-087). Null for an entry that was not
+     * posted — held back by the daily cap, or not yet flushed — and for every entry written
+     * before this field existed, which is why it needs no schema bump.
+     */
+    val notifiedAtMs: Long? = null,
 )
 
 /**
@@ -49,11 +55,27 @@ class AdviceJournal(
     @Synchronized
     fun append(entry: AdviceEntry): Boolean = write((read() + entry).takeLast(maxEntries))
 
-    /** Marks the given entries as notified; the rest stay as they are. */
+    /**
+     * Marks the given entries as notified, and stamps [nowMs] on those that were [posted]; the
+     * rest stay as they are.
+     */
     @Synchronized
-    fun markNotified(entries: Collection<AdviceEntry>): Boolean {
+    fun markNotified(
+        entries: Collection<AdviceEntry>,
+        posted: Collection<AdviceEntry> = emptyList(),
+        nowMs: Long? = null,
+    ): Boolean {
         val marked = entries.toSet()
-        return write(read().map { if (it in marked) it.copy(notified = true) else it })
+        val stamped = posted.toSet()
+        return write(
+            read().map {
+                when (it) {
+                    in stamped -> it.copy(notified = true, notifiedAtMs = nowMs)
+                    in marked -> it.copy(notified = true)
+                    else -> it
+                }
+            }
+        )
     }
 
     private fun write(entries: List<AdviceEntry>): Boolean {

app/src/main/java/com/evsuite/chargepilot/BatteryAdvisor.kt

@@ -220,7 +220,11 @@ internal class BatteryAdvisor(
             .filterKeys { it !in spent }
             .map { (kind, list) -> post(manager, kind, list.last()); list.last() }
         // What the cap held back is still in the history; it is not queued for tomorrow.
-        journal.markNotified(waiting.filter { entry -> posted.any { it.kind == entry.kind } } + posted)
+        journal.markNotified(
+            waiting.filter { entry -> posted.any { it.kind == entry.kind } } + posted,
+            posted,
+            nowMs,
+        )
     }
 
     // The head unit runs API 28, where no permission gates a notification. POST_NOTIFICATIONS is

app/src/main/java/com/evsuite/chargepilot/BatteryHealthActivity.kt

@@ -84,6 +84,9 @@ class BatteryHealthActivity : PrimaryNavigationActivity() {
                 speedObservedAtMs = snapshot.timestampMs
                 if (value.batteryRevision != loadedBatteryRevision) {
                     loadedBatteryRevision = value.batteryRevision
+                    ValidationProbe.monitor(snapshot) {
+                        "battery page reloaded revision ${value.batteryRevision}"
+                    }
                     load()
                 }
                 renderApply()

app/src/main/java/com/evsuite/chargepilot/ChargePilotApp.kt

@@ -12,6 +12,8 @@ class ChargePilotApp : Application() {
         // Unstable arms the validation probes here so a drive is recorded without anyone
         // opening a screen first; stable does nothing, and contains none of this.
         EvidenceCaptureHook.startProbes(this)
+        // CP-080: a small elapsedRealtime here is a fresh boot; a large one, a restarted process.
+        ValidationProbe.monitor(null) { "process start" }
         // The vehicle voice binds asynchronously; asking now means the first coach line, or the
         // settings test, finds it bound. Idempotent, and a car without it just falls back.
         if (EcoCoach.voiceEnabled(this)) EcoVoice.connect(this)

app/src/main/java/com/evsuite/chargepilot/DiagnosticsActivity.kt

@@ -298,6 +298,9 @@ class DiagnosticsActivity : PrimaryNavigationActivity() {
             // CP-081: whether the SAIC voice service is bound. False with the voice on means
             // every line fell back to an Android engine the car does not have.
             appendLine("vehicle_voice_bound=${SaicTts.isAvailable}")
+            // CP-081/083: the last outcomes, in memory since this process started. path=vehicle is
+            // the car's voice service accepting the line, not proof it was heard.
+            EcoVoice.recentEvents().forEach { appendLine(it.line()) }
             DashboardFrame.eco.describe().forEach(::appendLine)
             appendLine()
             // CP-075. The same verdict the trip screen shows for the newest drive, so a bundle
@@ -313,7 +316,12 @@ class DiagnosticsActivity : PrimaryNavigationActivity() {
             BatteryDigestStore(File(filesDir, BatteryDigestStore.FILE_NAME)).read().takeLast(7)
                 .forEach { appendLine("digest=$it") }
             AdviceJournal.of(filesDir).read().takeLast(20)
-                .forEach { appendLine("advice=${it.atMs} ${it.kind} notified=${it.notified} ${it.text}") }
+                .forEach {
+                    appendLine(
+                        "advice=${it.atMs} ${it.kind} notified=${it.notified} " +
+                            "notified_at_ms=${it.notifiedAtMs} ${it.text}"
+                    )
+                }
             appendLine()
             appendLine("[property_probe]")
             appendLine(getString(R.string.diagnostics_properties))
@@ -348,10 +356,17 @@ class DiagnosticsActivity : PrimaryNavigationActivity() {
         val trips = EnergyTripHistoryStore(File(filesDir, HISTORY_FILE)).read()
         val latest = trips.maxByOrNull { it.summary.startedAtMs }
             ?: return listOf("no_trip_recorded")
-        val review = reviewHistory(filesDir, trips).reviews[latest.summary.startedAtMs]
+        val history = reviewHistory(filesDir, trips)
+        val review = history.reviews[latest.summary.startedAtMs]
             ?: return listOf("no_trip_recorded")
         listOf("started_at_epoch_ms=${latest.summary.startedAtMs}") +
-            EcoTripReviewer.describe(review)
+            EcoTripReviewer.describe(review) +
+            // CP-086: whether or not a finding was made, so "never open" and "not
+            // distinguishable" read apart.
+            EcoTripReviewer.describeWindows(
+                latest,
+                history.attributions[latest.summary.startedAtMs],
+            )
     }.getOrElse { listOf("unavailable: ${it.javaClass.simpleName}") }
 
     /**

app/src/main/java/com/evsuite/chargepilot/EcoCoach.kt

@@ -133,7 +133,7 @@ class EcoCoach(context: Context) {
         if (line == spokenLine || nowMs - lastSpokeAtMs < SPEAK_COOLDOWN_MS) return
         spokenLine = line
         lastSpokeAtMs = nowMs
-        EcoVoice.say(app, line)
+        EcoVoice.say(app, line, EcoVoice.Origin.COACH)
     }
 
     /**

app/src/main/java/com/evsuite/chargepilot/EcoTripReview.kt

@@ -239,6 +239,23 @@ object EcoTripReviewer {
         )
     }
 
+    /**
+     * CP-086. The window-open inputs and residual as computed, finding or not. Null where the
+     * attribution produced no window-open residual.
+     */
+    fun describeWindows(trip: StoredTrip, attribution: EnergyAttributionResult?): List<String> {
+        val residual = (attribution as? EnergyAttributionResult.Ready)?.attribution?.residuals
+            ?.firstOrNull { it.context == ResidualContext.WINDOWS_OPEN }
+        val openSamples = trip.samples.orEmpty().count { (it.widestWindowPercent ?: 0) > 0 }
+        val distinguishable = residual?.let { it.finding == ResidualFinding.DISTINGUISHABLE }
+        return listOf(
+            "windows_open_samples=$openSamples",
+            "windows_open_fast_km=${format(openFastDistanceKm(trip))}",
+            "windows_residual_kwh=${residual?.let { format(it.estimate.valueKwh) }}",
+            "windows_distinguishable=$distinguishable",
+        )
+    }
+
     /** Trapezoid distance over the intervals open and above the speed at both ends. */
     private fun openFastDistanceKm(trip: StoredTrip): Double =
         trip.samples.orEmpty().zipWithNext().sumOf { (previous, current) ->

app/src/main/java/com/evsuite/chargepilot/EcoVoice.kt

@@ -1,11 +1,13 @@
 package com.evsuite.chargepilot
 
+import android.app.ActivityManager
 import android.content.Context
 import android.media.AudioAttributes
 import android.speech.tts.TextToSpeech
 import android.speech.tts.UtteranceProgressListener
 import com.evsuite.hardware.AppLogger
 import com.evsuite.hardware.saic.SaicTts
+import java.util.ArrayDeque
 import java.util.concurrent.CountDownLatch
 import java.util.concurrent.Executors
 import java.util.concurrent.TimeUnit
@@ -33,6 +35,45 @@ object EcoVoice {
     private const val INIT_TIMEOUT_SECONDS = 5L
     private const val SPEAK_TIMEOUT_SECONDS = 30L
 
+    /** CP-081/083: enough to cover a drive's coach lines and the test, bounded against a loop. */
+    private const val MAX_EVENTS = 20
+
+    /** Who asked for a line. */
+    enum class Origin { TEST, COACH, TRIP_END }
+
+    /** Which voice took it; [NONE] when neither did. */
+    enum class Path { VEHICLE, PLATFORM, NONE }
+
+    /**
+     * One dispatch and what became of it, for the diagnostic report.
+     *
+     * The vendor prompt has no completion callback, so [Path.VEHICLE] means the car's voice
+     * service accepted the line, never that it was heard. [importance] is this process's own at
+     * dispatch: above `IMPORTANCE_FOREGROUND` (100) the app was not in front.
+     */
+    data class Event(
+        val atMs: Long,
+        val origin: Origin,
+        val path: Path,
+        val bound: Boolean,
+        val waitedMs: Long,
+        val importance: Int?,
+    ) {
+        fun line(): String = "voice_event=$atMs origin=${origin.name.lowercase()} " +
+            "path=${path.name.lowercase()} bound=$bound waited_ms=$waitedMs importance=$importance"
+    }
+
+    /** In memory only, guarded by itself: the report reads it, the worker writes it. */
+    private val events = ArrayDeque<Event>()
+
+    /** The newest [MAX_EVENTS] outcomes, oldest first. */
+    fun recentEvents(): List<Event> = synchronized(events) { events.toList() }
+
+    private fun remember(event: Event) = synchronized(events) {
+        if (events.size >= MAX_EVENTS) events.removeFirst()
+        events.addLast(event)
+    }
+
     private val worker = Executors.newSingleThreadExecutor { runnable ->
         Thread(runnable, "chargepilot-voice").apply { isDaemon = true }
     }
@@ -46,12 +87,14 @@ object EcoVoice {
     /**
      * Speaks [text] and reports, on the worker thread, whether anything took it.
      *
+     * @param origin who asked, recorded with the outcome.
      * @param interrupt true only for the driver's own test from the settings screen; a coach line
      *   queues behind whatever the car is already announcing.
      */
     fun say(
         context: Context,
         text: String,
+        origin: Origin,
         interrupt: Boolean = false,
         onResult: ((Boolean) -> Unit)? = null,
     ) {
@@ -60,17 +103,30 @@ object EcoVoice {
             return
         }
         val app = context.applicationContext
+        val atMs = System.currentTimeMillis()
+        val importance = runCatching {
+            ActivityManager.RunningAppProcessInfo()
+                .also { ActivityManager.getMyMemoryState(it) }.importance
+        }.getOrNull()
         runCatching {
             worker.execute {
-                val spoken = runCatching { speakBlocking(app, text, interrupt) }
+                val outcome = runCatching { speakBlocking(app, text, interrupt) }
                     .onFailure { AppLogger.w(TAG, "speech failed: ${it.message}") }
-                    .getOrDefault(false)
+                    .getOrNull()
+                remember(
+                    Event(
+                        atMs, origin, outcome?.first ?: Path.NONE,
+                        SaicTts.isAvailable, outcome?.second ?: 0L, importance,
+                    )
+                )
+                val spoken = outcome != null && outcome.first != Path.NONE
                 runCatching { onResult?.invoke(spoken) }
             }
         }.onFailure { onResult?.invoke(false) }
     }
 
-    private fun speakBlocking(app: Context, text: String, interrupt: Boolean): Boolean {
+    /** The path that took the line, and how long the vendor bind was waited for. */
+    private fun speakBlocking(app: Context, text: String, interrupt: Boolean): Pair<Path, Long> {
         connect(app)
         var waited = 0L
         while (!SaicTts.isAvailable && waited < BIND_WAIT_MS) {
@@ -79,9 +135,9 @@ object EcoVoice {
         }
         if (SaicTts.isAvailable && SaicTts.speak(text, interrupt, app.packageName)) {
             AppLogger.d(TAG, "spoken by the vehicle voice service")
-            return true
+            return Path.VEHICLE to waited
         }
-        return speakWithPlatformEngine(app, text)
+        return (if (speakWithPlatformEngine(app, text)) Path.PLATFORM else Path.NONE) to waited
     }
 
     /**