feat(diagnostics): show the navigation transaction census

A vehicle bundle reports firmware 1300R67; the transaction map behind the
probe was read from R69. Two revisions of the same generation are not the
same binary, and an inserted interface method would shift every later code —
producing wrong distances rather than no distances.

The probe now prints every transaction code the adapter sent, marking the
ones this build does not decode, and its report says plainly that the census
must be read before any number above it is trusted. A capture that shows
traffic on undecoded codes, or silence on the decoded ones while guidance is
running, has caught the shift.

Adds the status the probe previously could not express: armed, receiving
traffic, decoding none of it.

Bumps EVHardware to e8ebc8a.

Refs: CP-040

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: malys

EVHardware

@@ -77,11 +77,35 @@ listener on its own, so this displaces neither the navigation app nor the cluste
 - **Behaviour with no guidance running.** If the navigation app publishes nothing when idle,
   the feature only exists for drivers who navigate with the OEM app. This is the single most
   decision-relevant unknown and the probe is built to record it.
+- **Whether R67 numbers the interface as R69 does.** See the section below; the probe is
+  built to answer it in the same capture.
 - **Whether a third-party navigation app feeds the same path.** TomTom broadcasts
   (`com.tomtom.navigation.GUIDE_INFO`) reach `MapService`, so at least one non-SAIC app does.
 
 None of these can be settled off-vehicle, which is why CP-040 carries `on_vehicle_required`.
 
+## Firmware revision risk, and how the probe catches it
+
+A diagnostic bundle captured on the vehicle reports `detected_firmware=SWI68-29958-1300R67`.
+The transaction map above was read from an R69 build of the same generation — two revisions
+apart, not a different family, but not the same binary either.
+
+This matters more than a missing signal would. If SAIC inserted a method into
+`IGeneralNotificationListener` between R67 and R69, every code after the insertion point
+shifts by one. A shifted map does not throw and does not read as unavailable: it decodes
+whatever callback now occupies code 13 and reports it as a remaining distance. Silent wrong
+numbers are the one outcome this project's provenance rules exist to prevent.
+
+`TransactionCensus` therefore counts every code the adapter sends, decoded or not, and the
+probe prints it. Two patterns condemn the map:
+
+- traffic on codes the build does not decode, marked `?` in the trace header; or
+- silence on the decoded codes while guidance is visibly running on the head unit.
+
+Either one means this firmware numbers the interface differently, and no reading from the
+capture may be used until the map is re-derived from an R67 build. Confirming the map is
+therefore part of the vehicle run, not an assumption it rests on.
+
 ## Scored comparison
 
 Scores are against CP-040's four criteria. "Boundary" means the read-only, offline,

analysis/CP-040_route_source.md

@@ -9,6 +9,7 @@ import android.os.SystemClock
 import androidx.appcompat.app.AppCompatActivity
 import com.evsuite.chargepilot.databinding.ActivityNavGuidanceProbeBinding
 import com.evsuite.hardware.saic.NavGuidance
+import com.evsuite.hardware.saic.NavGuidanceReducer
 import com.evsuite.hardware.saic.SaicNavGuidance
 import com.evsuite.hardware.telemetry.EnergyTelemetryReader
 import com.google.android.material.snackbar.Snackbar
@@ -146,14 +147,30 @@ class NavGuidanceProbeActivity : AppCompatActivity() {
         append("- adapter bound: ${SaicNavGuidance.isAvailable}\n")
         append("- listener registered: ${SaicNavGuidance.isListening}\n")
         append("- callbacks seen: ${SaicNavGuidance.latest().events}\n")
+        append("- transaction census: ${census()}\n")
+        append("- codes past the census ceiling: ${SaicNavGuidance.censusBeyondCeiling()}\n")
         append("- trace lines: ${trace.size}${if (trace.size >= TRACE_LINES) " (oldest dropped)" else ""}\n\n")
         append("`dist` and `turn` are raw callback values. Their unit is unproven — state it\n")
         append("by comparing against a distance known independently before using any of this.\n\n")
+        append("The transaction map was read from an R69 build. Check the census before\n")
+        append("trusting any number above: traffic on codes marked `?`, or silence on the\n")
+        append("decoded ones while guidance is clearly running, means this firmware numbers\n")
+        append("the interface differently and every reading here is off by the same shift.\n\n")
         append("```\n")
         trace.forEach { append(it).append('\n') }
         append("```\n")
     }
 
+    /** Decoded codes are named; anything else is flagged, because that is the shift signal. */
+    private fun census(): String {
+        val seen = SaicNavGuidance.census()
+        if (seen.isEmpty()) return "none"
+        return seen.entries.sortedBy { it.key }.joinToString(" ") { (code, count) ->
+            val mark = if (code in NavGuidanceReducer.KNOWN_TRANSACTIONS) "" else "?"
+            "$code$mark=$count"
+        }
+    }
+
     private fun render() {
         val guidance = SaicNavGuidance.latest()
         val listening = SaicNavGuidance.isListening
@@ -163,7 +180,9 @@ class NavGuidanceProbeActivity : AppCompatActivity() {
         binding.probeStatus.text = when {
             !SaicNavGuidance.isAvailable -> getString(R.string.nav_probe_unavailable)
             !listening -> getString(R.string.nav_probe_idle)
-            guidance.events == 0 -> getString(R.string.nav_probe_silent)
+            guidance.events == 0 && SaicNavGuidance.census().isEmpty() ->
+                getString(R.string.nav_probe_silent)
+            guidance.events == 0 -> getString(R.string.nav_probe_undecoded)
             else -> getString(R.string.nav_probe_receiving, guidance.events)
         }
         binding.probeHint.setText(

app/src/unstable/java/com/evsuite/chargepilot/NavGuidanceProbeActivity.kt

@@ -30,4 +30,5 @@
     <string name="nav_probe_refused">Mettez-vous à l’arrêt et attendez une vitesse lisible avant d’armer l’écoute.</string>
     <string name="nav_probe_copied">Trace copiée dans le presse-papiers</string>
     <string name="nav_probe_open">Sonde de guidage</string>
+    <string name="nav_probe_undecoded">Armée · trafic vu, rien de décodé</string>
 </resources>

app/src/unstable/res/values-fr/strings.xml

@@ -30,4 +30,5 @@
     <string name="nav_probe_refused">Park and wait for a readable speed before arming the listener.</string>
     <string name="nav_probe_copied">Trace copied to the clipboard</string>
     <string name="nav_probe_open">Guidance probe</string>
+    <string name="nav_probe_undecoded">Armed · traffic seen, none decoded</string>
 </resources>