feat(chargepilot): retain trip evidence and fix OTA

- keep retained trip averages within bounded history
- trigger OTA from version double-tap instead of startup
- fall back to API 28 archive signatures without weakening certificate matching

Author: malys

.codegraph/.gitignore

@@ -0,0 +1,5 @@
+# CodeGraph data files — local to each machine, not for committing.
+# Ignore everything in .codegraph/ except this file itself, so transient
+# files (the database, daemon.pid, sockets, logs) never show up in git.
+*
+!.gitignore

AGENTS.md

@@ -58,8 +58,9 @@ workspace MIT default. EVHardware remains separately licensed.
   already list *except* primary emulated storage, and fall back only to this app's directory on
   the same volume. Never require positive proof that a volume is removable — this head unit
   cannot give it, and demanding it is why exports found nothing.
-- The unstable channel checks GitHub's rolling `unstable` pre-release at start and downloads a
-  newer APK (`app/src/unstable/.../update/`). It is the second HTTP entry point and stays inside
+- The unstable channel checks GitHub's rolling `unstable` pre-release only after the driver
+  double-taps the version on the Energy dashboard, then downloads a newer APK
+  (`app/src/unstable/.../update/`). It is the second HTTP entry point and stays inside
   the same rules: `https` plus an exact-match host allowlist on the initial URL and every
   redirect hop, a size ceiling on the declared and the transferred length, and the archive only
   reaches shared storage after its signing certificate is proven identical to the running app's.

CHANGELOG.md

@@ -6,6 +6,17 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 
 ### Added
 
+- **Unstable automatic history now keeps model-worthy drives.** Automatically detected trips are
+  persisted only when their measured distance exceeds 5 km; manual recordings remain explicit and
+  are always kept. Existing storage bounds remain unchanged: 200 summaries and 512 KiB, with old
+  sample tracks evicted before trip summaries. At the same trip boundary, Q6 records the app's
+  gross and regeneration-adjusted averages beside the vehicle's raw published average, so the
+  next drive can establish why they diverge without assuming equivalent units or reset rules.
+
+- Unstable trip-history artifacts now include `socModelFit`, computed from full stored tracks
+  during export. CP-055 Q6 is recorded before validation artifact is written, so model evidence
+  no longer depends on reopening Charging stop after a drive.
+
 - **The energy screen says whether this drive is a careful one.** A sixth readout tile reads
   *better than usual*, *usual* or *worse than usual* with the signed distance from the driver's
   own fitted expectation for this speed and this outside temperature — their history, not a
@@ -33,6 +44,11 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 
 ### Fixed
 
+- **Finished-trip eco advice no longer drops persisted samples.** Trip tracks keep the first
+  telemetry frame after each five-second boundary, commonly around 5.3 seconds apart. Replay used
+  the stricter five-second live gap and discarded those intervals; it now uses the stored-track
+  cadence while live monitoring keeps its original sleep-gap guard.
+
 - **The advice line said nothing about having nothing to say.** With the switch on and no lever
   measurable — no fitted model yet, or too little movement in the window — the line simply was
   not drawn, which reads exactly like a switch that did nothing. It now states which it is, the

EVHardware

@@ -103,8 +103,10 @@ unique temporary file and atomic rename.
 Automatic detection is enabled by default. A foreground service owns the sampler so detection
 and recording continue when the driver opens another app. On firmware where speed stays
 unavailable, ten consecutive misses suspend idle background polling; opening the dashboard
-performs a bounded retry. Active trips remain fail-closed and under manual control. A trip's
-reported duration is the time actually covered by usable samples, not wall clock: a suspended
+performs a bounded retry. Active trips remain fail-closed and under manual control. The unstable
+build keeps automatically detected trips only above 5 km, concentrating the same bounded history
+budget on drives useful to the local consumption model. Manual recordings are always kept. A
+trip's reported duration is the time actually covered by usable samples, not wall clock: a suspended
 sampler adds nothing to duration, distance or energy, so consumption averages compare values
 measured over the same interval.
 

README.md

@@ -88,9 +88,9 @@ and never asks for anything.
 
 ## On arrival, parked
 
-1. Open **Charging stop** once more and search the same destination again. This is what refits
-   the consumption model with the drive you have just done, and that refit is question 6's
-   answer.
+1. Open **Charging stop** once more and search the same destination again to exercise the screen
+   path. Export independently refits the model from stored tracks and records question 6, so
+   forgetting this tap no longer loses model evidence.
 2. Plug in the USB stick.
 3. **View diagnostics** → **Export to USB** → pick the stick. Wait for the confirmation naming
    the file.

analysis/CP-055_validation_drive.md

@@ -9,6 +9,8 @@ import android.graphics.Color
 import android.graphics.drawable.ColorDrawable
 import android.os.Bundle
 import android.os.IBinder
+import android.view.GestureDetector
+import android.view.MotionEvent
 import android.view.View
 import android.widget.ImageView
 import android.widget.TextView
@@ -83,10 +85,6 @@ class MainActivity : PrimaryNavigationActivity() {
         outcome.filterValues { !it }.keys.forEach {
             AppLogger.w(TAG, "vehicle permission denied: $it")
         }
-        // An activity holds one permission request at a time; a second launched while this one
-        // is in flight is dropped by the framework. The unstable update check asks for storage
-        // access of its own, so it starts here, once this dialog has been answered.
-        UpdateHook.checkInBackground(this)
     }
 
     /**
@@ -137,6 +135,23 @@ class MainActivity : PrimaryNavigationActivity() {
         binding.driftLine.setOnClickListener { forgetPlan() }
         binding.aboutAction.text = getString(R.string.about_version_badge, appVersion())
         binding.aboutAction.setOnClickListener { showAbout() }
+        val versionGestures = GestureDetector(this, object : GestureDetector.SimpleOnGestureListener() {
+            override fun onDown(event: MotionEvent): Boolean = true
+
+            override fun onSingleTapConfirmed(event: MotionEvent): Boolean {
+                binding.aboutAction.performClick()
+                return true
+            }
+
+            override fun onDoubleTap(event: MotionEvent): Boolean {
+                UpdateHook.checkInBackground(this@MainActivity)
+                return true
+            }
+        })
+        binding.aboutAction.setOnTouchListener { _, event ->
+            versionGestures.onTouchEvent(event)
+            true
+        }
         renderUnavailable()
         requestVehiclePermissions()
         if (TripRecordingService.isAutomaticDetectionEnabled(this)) {
@@ -153,12 +168,7 @@ class MainActivity : PrimaryNavigationActivity() {
         val missing = VehiclePermissions.missing {
             ContextCompat.checkSelfPermission(this, it) == PackageManager.PERMISSION_GRANTED
         }
-        // Unstable only, and nothing waits on it: the check runs on its own thread and speaks
-        // only when a newer build is already downloaded. Stable contains no updater. It starts
-        // here when there is no vehicle dialog to collide with, and from that dialog's answer
-        // when there is.
-        if (missing.isEmpty()) UpdateHook.checkInBackground(this)
-        else vehiclePermissions.launch(missing)
+        if (missing.isNotEmpty()) vehiclePermissions.launch(missing)
     }
 
     /**
@@ -167,10 +177,6 @@ class MainActivity : PrimaryNavigationActivity() {
      */
     override fun onStart() {
         super.onStart()
-        // Unstable only, and a no-op unless the last check gave up without reaching GitHub:
-        // the hook latches itself. This is what makes a head unit whose Wi-Fi arrived after
-        // launch still find the update, without polling for it. Stable contains no updater.
-        UpdateHook.checkInBackground(this)
         pack = VehicleSettings.read(this).pack
         loadRecentTrips()
         // The consumption fit reads the whole trip history, so it happens once per visit to

app/src/main/java/com/evsuite/chargepilot/MainActivity.kt

@@ -217,7 +217,11 @@ class TripRecordingService : Service() {
     }
 
     /** Called through the binder: the dashboard is on screen whenever a trip can be stopped. */
-    fun stopTrip(onSaved: (() -> Unit)? = null) {
+    fun stopTrip(onSaved: (() -> Unit)? = null) = finishTrip(false, onSaved)
+
+    private fun stopAutomaticTrip() = finishTrip(true, null)
+
+    private fun finishTrip(automaticallyDetected: Boolean, onSaved: (() -> Unit)?) {
         val endedAt = latestSnapshot?.timestampMs ?: System.currentTimeMillis()
         val recorded = EnergyTripSession.stop(endedAt)
         detector.reset()
@@ -229,6 +233,16 @@ class TripRecordingService : Service() {
             stopWhenNobodyNeedsIt()
             return
         }
+        TripAverageEvidence.record(recorded.summary)
+        if (!AutomaticTripRetention.shouldStore(automaticallyDetected, recorded.summary)) {
+            AppLogger.i(
+                TAG,
+                "automatic trip not stored; distance_km=${recorded.summary.recordedDistanceKm}",
+            )
+            updateNotification()
+            stopWhenNobodyNeedsIt()
+            return
+        }
         // Appending rewrites the history file, and the tap that triggers it arrives on the main
         // thread, so the write goes to the sampler's thread — which has nothing else to do
         // between two one-second reads. Shutting the service down waits for that write: this
@@ -304,7 +318,7 @@ class TripRecordingService : Service() {
             val result = detector.add(value)
             when (result.event) {
                 TripDetector.Event.START -> beginTrip(value)
-                TripDetector.Event.STOP -> stopTrip()
+                TripDetector.Event.STOP -> stopAutomaticTrip()
                 null -> Unit
             }
             if (result.event == null && result.state != previousState) {

app/src/main/java/com/evsuite/chargepilot/TripRecordingService.kt

@@ -0,0 +1,11 @@
+package com.evsuite.chargepilot
+
+import com.evsuite.hardware.telemetry.EnergyTripSummary
+
+/** Stable keeps the existing automatic-trip behaviour unchanged. */
+internal object AutomaticTripRetention {
+    fun shouldStore(
+        @Suppress("UNUSED_PARAMETER") automaticallyDetected: Boolean,
+        @Suppress("UNUSED_PARAMETER") summary: EnergyTripSummary,
+    ): Boolean = true
+}

app/src/stable/java/com/evsuite/chargepilot/AutomaticTripRetention.kt

@@ -0,0 +1,8 @@
+package com.evsuite.chargepilot
+
+import com.evsuite.hardware.telemetry.EnergyTripSummary
+
+/** Stable records no development evidence. */
+internal object TripAverageEvidence {
+    fun record(@Suppress("UNUSED_PARAMETER") summary: EnergyTripSummary) = Unit
+}