feat(validation): arm every open question before the drive, not after it

CP-055. Eleven tickets end "verified on the JVM, never on the car", and each
of them names a different question. Answered one at a time, each costs a
drive, a parking space and an evening; the owner has one vehicle and one
life. So the questions get answered together, and the only way that works is
if everything is armed before departure and records itself.

Nothing here can be operated while driving, and that is a requirement rather
than a convenience: an instrument that needs a tap at 130 km/h is a hazard,
so it was not built. The recording sits at the decisions themselves — the
permission result, the position or its absence, the routing response, its
sections, the charger search including each way out of it, the what-if rows
or its refusal, and the consumption fit — because that is where the truth
is, and a screen that has to be visited is a screen someone forgets.

One artifact, eight named blocks, against the letter of the ticket's scope.
The exporter bundles at most eight evidence files and keeps the newest;
eight validation files would evict the guidance trace, the signal statistics
and the trip record from the very bundle they are meant to travel in. Every
question keeps its own block, and they share a file.

An empty block is an answer. `ValidationQuestion` carries what would have
made each probe fire, so a question that recorded nothing says so and says
why — "no chargers came back" and "the search never ran" close different
tickets, and a blank would not tell them apart. The file is written even
when the toggle was off, because "it was off" explains every empty block and
a missing file explains nothing.

Question 2 can only be read at the start of a process: once any screen has
asked for location, "was it granted without a prompt" is no longer
observable. So arming happens in `ChargePilotApp`, before anything else, and
the checklist says to arm and then restart.

Stable is a no-op whose `record` never invokes its lambda, so a stable build
does not even construct the strings. Binder calls run on their own thread: a
head unit that answers slowly is a finding, one that hangs the UI thread of
a moving car is not.

What leaves the car is stated in the artifact's own notes. No API key, no
typed destination, no origin coordinate. It does carry the names of roads on
the route driven and the raw bytes of the navigation transactions CP-051
asks about, which may hold the destination set in the car's own navigation —
so the checklist says to pick a destination worth sharing. The alternative
was a probe that cannot answer the question it exists for.

`analysis/CP-055_validation_drive.md` is written for someone who has not
read this repository, including the owner six weeks from now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: malys

CHANGELOG.md

@@ -6,6 +6,21 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 
 ### Added
 
+- **One drive answers eight questions, on the unstable channel only.** Eleven tickets ended
+  "verified on a laptop, never on the car", and each named a different question; answered one
+  at a time they would cost eight evenings. There is now one toggle on the evidence screen
+  that arms every remaining question at once, and each of them records itself from the
+  decision it is about — the permission result, the routing response and its sections, the
+  charger search, the what-if rows or its refusal, the model fit, and the car's own navigation
+  transactions. Nothing needs a tap while driving, because an instrument that needs one at
+  130 km/h is a hazard. The diagnostic export carries a single `validation-*.json` in which
+  every question has a named block, including the questions nothing was recorded for: those
+  say what would have made them fire, since "no chargers came back" and "the search never ran"
+  close different tickets. The file carries no API key, no typed destination and no origin
+  coordinate; it does carry road names and the navigation parcel bytes, and it says so in its
+  own notes. `analysis/CP-055_validation_drive.md` is the checklist, written to be followed by
+  someone who has not read the source. Stable contains none of it.
+
 - **The car's numbers are the driver's now, not a specification sheet's.** Usable capacity when
   new, state of health, the charger power floor and the reserve to arrive with were constants in
   the source, each with a comment admitting it should not be. There is a parked-only screen for

EVHardware

@@ -0,0 +1,107 @@
+# CP-055 — The validation drive
+
+Date written: 2026-09-05
+Status: instrument built, drive not yet done
+
+One drive answers eight questions. They accumulated because eleven tickets could be finished
+on a laptop and verified nowhere else, and answering them one at a time would cost eight
+evenings and eight parking spaces. Everything below is armed before departure and records
+itself; nothing on this page asks anyone to operate a screen while the car is moving.
+
+**Read this page alone.** It does not assume the repository has been read, and it should still
+work six weeks from now.
+
+## What you need
+
+- The **unstable** build of EVChargePilot installed on the head unit. With the car connected,
+  `mise run run-unstable` from the repository builds it, installs it and launches it; it sits
+  beside the stable app rather than replacing it. The stable build contains none of this — no
+  probe, no toggle, no recording — by construction.
+- A **USB stick**, formatted so the head unit can write to it.
+- The **routing key** and the **charger key** already saved in the app (Charging stop →
+  *Routing key*). Without them the route and charger questions cannot fire.
+- The **vehicle figures** saved (Charging stop → *Vehicle*): usable capacity, state of health,
+  minimum charger power, reserve. The defaults are an MG4 Comfort at 100 % health.
+- Trip history that already contains a few drives. Question 6 asks whether the consumption
+  model can be fitted, and a model is fitted from past drives, not from this one alone.
+
+## Before leaving, parked
+
+1. Open the app. On the dashboard, check that **Automatic trips** is on, or start a trip by
+   hand with **Start trip**. A drive nobody recorded teaches question 6 nothing.
+2. Go to **View diagnostics** → **Open evidence capture** → **Arm validation drive**. The line
+   under the button must read *Validation mode on*.
+3. **Close the app completely and reopen it.** This matters: question 2 asks whether Android
+   grants fine location without ever showing a prompt, and that can only be observed at the
+   start of a process, before any screen of the app has asked for anything. Arming, then
+   restarting, is what produces a clean reading.
+4. In the **car's own navigation** — not this app — enter a destination and start guidance.
+   That is what question 1 needs: the transactions being probed can only carry a destination if
+   the car has one.
+5. In the app, open **Charging stop**, type a destination and press **Search**, then pick a
+   result. Choose somewhere far enough that the plan says a stop is needed; if the battery is
+   nearly full, pick somewhere further away. A plan with no stop never searches for a charger,
+   and question 5 stays blank.
+6. Note the charge percentage and the outside temperature the dashboard shows. Two lines in a
+   notebook are worth an hour of guessing later.
+
+**Choose a destination you are willing to share.** The bundle records the names of the roads on
+the route and the raw bytes of the car's own destination transactions. It leaves the car on a
+USB stick. Use a town, a service area, a shop — not home.
+
+## The drive
+
+The shape matters more than the exact roads:
+
+- **A long motorway leg**, 60 km or more, held at a steady speed between 110 and 130 km/h.
+  Question 6 needs the charge gauge to move several times — it steps about 2 % every 4 km — and
+  the model needs to have seen more than one speed across the history it is fitted from.
+- **A departmental section**, 15 km or more, at 70 to 90 km/h. Question 3 asks whether the
+  routing sections look like real roads, and a route made only of motorway cannot show that.
+- **One planned charge stop** on the way, from step 5 above. You do not have to actually
+  charge; the question is whether usable chargers come back for that stretch of road.
+
+While driving, do nothing. The screen can be off. Every probe is already armed, and none of
+them needs a tap.
+
+## On arrival, parked
+
+1. Open **Charging stop** once more and search the same destination again. This is what refits
+   the consumption model with the drive you have just done, and that refit is question 6's
+   answer.
+2. Plug in the USB stick.
+3. **View diagnostics** → **Export to USB** → pick the stick. Wait for the confirmation naming
+   the file.
+4. Take the stick out. Nothing else is needed; the app keeps nothing that has to be cleaned up.
+
+## What lands on the stick
+
+One zip. Inside it, `evidence/validation-SWI68-…json` is this drive's answers: eight blocks,
+one per question, each naming the ticket it belongs to. Alongside it are the guidance trace,
+the signal statistics and the trip record, which the export has always carried.
+
+A block that is empty says why it is empty — either "validation mode was off" or the condition
+that would have made it fire. That is deliberate: "no chargers came back" and "the search never
+ran" close different tickets, and a blank would not tell them apart.
+
+The file contains no API key, no destination text typed into the app, and no coordinate of
+where the car was. It does contain road names and the destination bytes described above.
+
+## What is being asked
+
+| # | Ticket | Question |
+| --- | --- | --- |
+| 1 | CP-051 | Do the navigation service's transactions 38 and 39 carry the destination the driver already entered in the car? |
+| 2 | CP-043 | Is fine location granted at startup without a prompt, because vehicle speed shares its permission group? |
+| 3 | CP-049 | Do real routing steps produce sections that look like roads? |
+| 4 | CP-049 | Does the routing instance return a second route when asked for alternatives? |
+| 5 | CP-048 | Does Open Charge Map return usable chargers along a French motorway? |
+| 6 | CP-052 | Do the charge segments the consumption model needs appear on a real drive? |
+| 7 | CP-049 | Does the route what-if produce rows on this firmware, or a refusal? |
+| 8 | CP-046 | Is a refused or missing location survivable from end to end? |
+
+## Afterwards
+
+Turn the toggle off (**Disarm validation drive**) once the bundle is safely off the car. Then
+the answers go back into the tickets above: each one closes against this bundle, or says what
+it still does not know.

analysis/CP-055_validation_drive.md

@@ -101,7 +101,12 @@ class ChargeStopActivity : AppCompatActivity() {
         // The result map is not the answer: on this platform a permission from an already held
         // group can be granted without a prompt, and a coarse-only grant is a refusal of what
         // was asked for. What counts is whether fine location is held now.
-        if (place != null && LocationSource.hasPrecise(this)) route(place) else render()
+        val granted = LocationSource.hasPrecise(this)
+        ValidationProbe.record(ValidationQuestion.LOCATION_FALLBACK) {
+            "permission result: fine=$granted, and the request " +
+                if (place != null) "continues the route that asked for it" else "had nothing waiting"
+        }
+        if (place != null && granted) route(place) else render()
     }
 
     private val connection = object : ServiceConnection {
@@ -183,8 +188,23 @@ class ChargeStopActivity : AppCompatActivity() {
         // power and the kWh model therefore never trains on it (CP-052). Refitted on each
         // load rather than stored: it is a few thousand samples of arithmetic on a worker
         // thread, and a cache would only add a way for the two to disagree.
-        model = (SocConsumptionFitter().fit(trips, generation) as? SocConsumptionFitResult.Ready)
-            ?.model
+        val fit = SocConsumptionFitter().fit(trips, generation)
+        model = (fit as? SocConsumptionFitResult.Ready)?.model
+        ValidationProbe.record(ValidationQuestion.SOC_SEGMENTS) {
+            val head = "trips=${trips.size} samples=${trips.sumOf { it.samples?.size ?: 0 }} " +
+                "rate=${rate?.let { r -> probeFormat(r.percentPerKm, "%.3f") + " %/km" } ?: "none"}"
+            when (fit) {
+                is SocConsumptionFitResult.Ready -> fit.model.let { m ->
+                    "$head fit=ready segments=${m.segmentCount} " +
+                        "speed=${probeFormat(m.envelope.minSpeedKmh, "%.0f")}..${
+                            probeFormat(m.envelope.maxSpeedKmh, "%.0f")} km/h " +
+                        "temp=${probeFormat(m.envelope.minOutsideTempCelsius, "%.0f")}..${
+                            probeFormat(m.envelope.maxOutsideTempCelsius, "%.0f")} C " +
+                        "rmse=${probeFormat(m.residualRmsePercentPer100Km, "%.2f")} %/100 km"
+                }
+                is SocConsumptionFitResult.Unavailable -> "$head fit=unavailable(${fit.reason})"
+            }
+        }
     }
 
     private fun search() {
@@ -237,6 +257,9 @@ class ChargeStopActivity : AppCompatActivity() {
             return
         }
         if (!LocationSource.hasPrecise(this)) {
+            ValidationProbe.record(ValidationQuestion.LOCATION_FALLBACK) {
+                "route asked without a fine grant: the prompt is being requested"
+            }
             pending = place
             locationPermission.launch(
                 arrayOf(
@@ -247,6 +270,12 @@ class ChargeStopActivity : AppCompatActivity() {
             return
         }
         val origin = LocationSource.lastKnown(this)
+        ValidationProbe.record(ValidationQuestion.LOCATION_FALLBACK) {
+            // Age and altitude, never the position itself: this file leaves the car.
+            origin?.let {
+                "fix held: age=${it.ageMs / 1000}s altitude=${it.altitudeMetres != null}"
+            } ?: "fine grant held but no fix within ${LocationSource.MAX_AGE_MS / 1000}s: refused"
+        }
         if (origin == null) {
             announce(getString(R.string.charge_stop_no_position))
             return
@@ -270,6 +299,23 @@ class ChargeStopActivity : AppCompatActivity() {
             val routes = (result as? RoutingTransport.Result.Ok)
                 ?.let { OrsDirections.parse(it.body) }.orEmpty()
             val route = routes.firstOrNull()
+            ValidationProbe.record(ValidationQuestion.ROUTE_ALTERNATIVES) {
+                "asked alternatives=$ALTERNATIVES, " + when (result) {
+                    is RoutingTransport.Result.Ok ->
+                        "answered ${result.body.length} chars, parsed ${routes.size} route(s)"
+                    is RoutingTransport.Result.Refused -> "refused(${result.reason})"
+                }
+            }
+            ValidationProbe.record(ValidationQuestion.ROUTE_SECTIONS) {
+                route?.let { r ->
+                    "route ${probeFormat(r.distanceKm, "%.1f")} km in " +
+                        "${probeFormat(r.durationMinutes, "%.0f")} min, ${r.sections.size} section(s): " +
+                        r.sections.take(VALIDATION_SECTIONS).joinToString(" | ") { section ->
+                            "${section.road ?: "unnamed"} ${probeFormat(section.distanceKm, "%.1f")} km " +
+                                "@${section.impliedSpeedKmh?.let { v -> probeFormat(v, "%.0f") } ?: "?"}"
+                        }
+                } ?: "no route parsed"
+            }
             // The road ahead, which is the only elevation a forecast can use: CP-031 refused
             // the altitude behind the car and that refusal stands.
             val grade = route?.let {
@@ -309,6 +355,21 @@ class ChargeStopActivity : AppCompatActivity() {
                     RouteWhatIf.alternative(best, it, effective, settings.pack)
                 }
             }
+            ValidationProbe.record(ValidationQuestion.WHAT_IF) {
+                val body = when (whatIf) {
+                    null -> "no route, so no what-if"
+                    is RouteWhatIf.Result.Unavailable -> "unavailable(${whatIf.reason})"
+                    is RouteWhatIf.Result.Ready -> "ready rows=${whatIf.options.size} " +
+                        "headline=${whatIf.headline?.speedKmh?.toString() ?: "none"} " +
+                        whatIf.options.joinToString(" | ") { option ->
+                            "${option.speedKmh}: ${probeFormat(option.affectedKm, "%.0f")} km " +
+                                "${probeFormat(option.delayMinutes, "%.0f")} min " +
+                                "${probeFormat(option.savedPercentLow, "%.1f")}..${
+                                    probeFormat(option.savedPercentHigh, "%.1f")} %"
+                        }
+                }
+                "$body | second road=${alternative?.viaLabel ?: "none"}"
+            }
             runOnUiThread {
                 if (isFinishing || isDestroyed) return@runOnUiThread
                 render(place, route, plan, effective, charger, grade, whatIf, alternative)
@@ -358,16 +419,41 @@ class ChargeStopActivity : AppCompatActivity() {
         rate: SocRate?,
         settings: VehicleSettings.Values,
     ): Found? {
-        val credentials = RoutingCredentials.readCharger(this) ?: return null
+        val credentials = RoutingCredentials.readCharger(this) ?: run {
+            ValidationProbe.record(ValidationQuestion.CHARGERS) { "no charger key configured" }
+            return null
+        }
         val window = RouteGeometry.window(
             route.points,
             (afterKm - OpenChargeMap.WINDOW_KM).coerceAtLeast(0.0),
             afterKm,
         )
-        if (window.size < 2) return null
+        if (window.size < 2) {
+            ValidationProbe.record(ValidationQuestion.CHARGERS) {
+                "the ${OpenChargeMap.WINDOW_KM} km window before km " +
+                    "${probeFormat(afterKm, "%.0f")} held ${window.size} route point(s): no search"
+            }
+            return null
+        }
         val result = chargers.get(credentials, OpenChargeMap.PATH, OpenChargeMap.query(window))
-        val body = (result as? RoutingTransport.Result.Ok)?.body ?: return null
-        return OpenChargeMap.parse(body, settings.minChargerPowerKw)
+        val body = (result as? RoutingTransport.Result.Ok)?.body ?: run {
+            ValidationProbe.record(ValidationQuestion.CHARGERS) {
+                "search refused(${(result as? RoutingTransport.Result.Refused)?.reason})"
+            }
+            return null
+        }
+        val found = OpenChargeMap.parse(body, settings.minChargerPowerKw)
+        ValidationProbe.record(ValidationQuestion.CHARGERS) {
+            val powers = found.mapNotNull { it.powerKw }
+            "window ends at km ${probeFormat(afterKm, "%.0f")}, " +
+                "min ${probeFormat(settings.minChargerPowerKw, "%.0f")} kW: " +
+                "${found.size} charger(s), power " +
+                (powers.minOrNull()?.let { low ->
+                    "${probeFormat(low, "%.0f")}..${probeFormat(powers.max(), "%.0f")} kW"
+                } ?: "unpublished") +
+                ", operational=${found.count { it.operational == true }}"
+        }
+        return found
             .mapNotNull { charger ->
                 val alongKm = RouteGeometry.distanceAlongKm(
                     route.points,
@@ -636,6 +722,10 @@ class ChargeStopActivity : AppCompatActivity() {
         message = null
     }
 
+    /** Probe text is read at a desk, not by a driver: point decimals, whatever the locale. */
+    private fun probeFormat(value: Double, pattern: String): String =
+        String.format(Locale.ROOT, pattern, value)
+
     private fun format(value: Double, pattern: String): String =
         String.format(Locale.getDefault(), pattern, value)
 
@@ -655,5 +745,7 @@ class ChargeStopActivity : AppCompatActivity() {
          */
         const val ALTERNATIVES = 2
 
+        /** Enough sections for a validation line to show the shape of a route, not all of it. */
+        const val VALIDATION_SECTIONS = 8
     }
 }