@@ -116,6 +116,37 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 
 ### Fixed
 
+- **An unstable build no longer offers the release it was cut from.** The published asset name and
+  the APK's own `versionName` were computed by two different formulas: the workflow named the file
+  `EVChargePilot-unstable-0.2.0.85.apk` while the APK inside it reported `0.2.0-unstable`. The
+  update check compares one against the other, so every launch found an update that was already
+  installed, and installing it changed nothing. The build number now reaches both, and a local
+  build with no run number becomes `0.2.0.0-unstable` — older than any release, which is what a
+  local build is.
+
+- **A `403` is no longer always read as a spent quota.** HeiGIT answers `403` both when the day's
+  allowance is gone and when the key is simply not served on that API, and the screen said "the
+  daily quota for this key is spent" for both. A driver whose key was refused outright was sent
+  away to wait until tomorrow for a key that would never work, however long they waited. The body
+  now decides, and a refused key gets its own message naming the key and the service address.
+
+- **The server's own remaining count no longer locks the local gate shut for good.** A
+  `x-ratelimit-remaining: 0` closed `RoutingQuota` with no way back: refusing locally meant no
+  request went out, and only a request could bring back the header that would reopen it. The count
+  is now believed for five minutes, and a `0` sitting beside an answer the server actually served
+  is not kept at all — a limiter describing a window this app never asked about reads exactly the
+  same as an allowance this app has spent.
+
+- **Geocoding is no longer throttled at a third of what the key allows.** The local limits were
+  third-party guesses and the guesses were low: 1000 a day and 40 a minute against the 3000 and 100
+  the key dashboard actually lists. A local throttle refusing requests the service would have
+  answered is the same broken screen as one that spends a quota, minus the evidence.
+
+- **The unstable update check asks again when the network was not there yet.** The check latched
+  itself for the process after three attempts spanning about forty seconds, so a head unit whose
+  Wi-Fi came up a minute after launch left the tester on an old build until they killed the app.
+  Giving up now releases the latch, and returning to the dashboard checks again.
+
 - **The unstable update check no longer loses its storage question to the vehicle one.** Both were
   asked from `onCreate`, and an activity holds one permission request at a time — the second was
   dropped by the framework, so on the first launch of a fresh unstable install the driver was never
 
@@ -2,6 +2,13 @@ plugins {
     alias(libs.plugins.android.application)
 }
 
+// The rolling unstable build number, passed by the unstable workflow as its run number.
+// It has to reach BOTH the APK's own versionName and the published asset name, because the
+// update check compares one against the other: a build whose versionName stops at "0.2.0"
+// reads as older than the very release it was cut from, so every launch offers the update
+// that is already installed and installing it changes nothing.
+val unstableBuild = (project.findProperty("unstableBuild") ?: "0").toString()
+
 android {
     namespace = "com.evsuite.chargepilot"
     compileSdk = 36
@@ -39,7 +46,10 @@ android {
         create("unstable") {
             dimension = "channel"
             applicationIdSuffix = ".unstable"
-            versionNameSuffix = "-unstable"
+            // Same shape as the asset name: "0.2.0.85-unstable" against a published
+            // "EVChargePilot-unstable-0.2.0.85.apk". A local build has no run number and
+            // becomes 0, which is older than any release — which is what a local build is.
+            versionNameSuffix = ".$unstableBuild-unstable"
         }
     }
 
@@ -101,7 +111,7 @@ if (android.signingConfigs.findByName("platform") == null) {
 // is always tagged "unstable" and overwritten, so the asset name carries the version.
 tasks.register("printUnstableVersion") {
     doLast {
-        println("${android.defaultConfig.versionName}.${project.findProperty("unstableBuild") ?: "0"}")
+        println("${android.defaultConfig.versionName}.$unstableBuild")
     }
 }
 
 
@@ -444,7 +444,7 @@ class ChargeStopActivity : AppCompatActivity() {
                 )
                 announce(
                     when {
-                        result is RoutingTransport.Result.Refused -> refusal(result)
+                        result is RoutingTransport.Result.Refused -> routingRefusal(result)
                         route == null -> getString(R.string.charge_stop_no_route)
                         else -> getString(R.string.charge_stop_ready)
                     }
@@ -1211,25 +1211,6 @@ class ChargeStopActivity : AppCompatActivity() {
         } ?: getString(R.string.charge_stop_charger_source_undated, provider)
     }
 
-    /**
-     * A refusal the driver can act on. The detail travels only where it means something to
-     * them — seconds to wait, a status code — never the transport's own English reason string.
-     */
-    private fun refusal(result: RoutingTransport.Result.Refused): String = when (result.reason) {
-        RoutingTransport.Reason.NOT_CONFIGURED -> getString(R.string.charge_stop_not_configured)
-        RoutingTransport.Reason.BUSY -> getString(R.string.routing_refused_busy)
-        RoutingTransport.Reason.QUOTA_MINUTE ->
-            getString(R.string.routing_refused_quota_minute, result.detail.orEmpty())
-        RoutingTransport.Reason.QUOTA_DAY -> getString(R.string.routing_refused_quota_day)
-        RoutingTransport.Reason.TRANSPORT -> getString(R.string.routing_refused_transport)
-        RoutingTransport.Reason.SERVER_DAILY_LIMIT -> getString(R.string.routing_refused_server_day)
-        RoutingTransport.Reason.SERVER_RATE_LIMIT ->
-            getString(R.string.routing_refused_server_minute)
-        RoutingTransport.Reason.SERVER_REJECTED ->
-            getString(R.string.routing_refused_server, result.detail.orEmpty())
-        RoutingTransport.Reason.UNREADABLE -> getString(R.string.routing_refused_unreadable)
-    }
-
     private fun announce(text: String) {
         message = text
         render()
 
@@ -138,7 +138,7 @@ class DestinationActivity : AppCompatActivity() {
                 places = found.orEmpty()
                 showPlaces()
                 when {
-                    result is RoutingTransport.Result.Refused -> announce(refusal(result))
+                    result is RoutingTransport.Result.Refused -> announce(routingRefusal(result))
                     places.isEmpty() && !quiet ->
                         announce(getString(R.string.charge_stop_no_results))
                     places.isNotEmpty() -> announce(getString(R.string.charge_stop_choose))
@@ -228,25 +228,6 @@ class DestinationActivity : AppCompatActivity() {
         showFavorites(typed())
     }
 
-    /**
-     * A refusal the driver can act on. The detail travels only where it means something to
-     * them — seconds to wait, a status code — never the transport's own English reason string.
-     */
-    private fun refusal(result: RoutingTransport.Result.Refused): String = when (result.reason) {
-        RoutingTransport.Reason.NOT_CONFIGURED -> getString(R.string.charge_stop_not_configured)
-        RoutingTransport.Reason.BUSY -> getString(R.string.routing_refused_busy)
-        RoutingTransport.Reason.QUOTA_MINUTE ->
-            getString(R.string.routing_refused_quota_minute, result.detail.orEmpty())
-        RoutingTransport.Reason.QUOTA_DAY -> getString(R.string.routing_refused_quota_day)
-        RoutingTransport.Reason.TRANSPORT -> getString(R.string.routing_refused_transport)
-        RoutingTransport.Reason.SERVER_DAILY_LIMIT -> getString(R.string.routing_refused_server_day)
-        RoutingTransport.Reason.SERVER_RATE_LIMIT ->
-            getString(R.string.routing_refused_server_minute)
-        RoutingTransport.Reason.SERVER_REJECTED ->
-            getString(R.string.routing_refused_server, result.detail.orEmpty())
-        RoutingTransport.Reason.UNREADABLE -> getString(R.string.routing_refused_unreadable)
-    }
-
     private fun announce(text: String) {
         binding.destinationStatus.text = text
     }
 
@@ -161,6 +161,10 @@ class MainActivity : PrimaryNavigationActivity() {
      */
     override fun onStart() {
         super.onStart()
+        // Unstable only, and a no-op unless the last check gave up without reaching GitHub:
+        // the hook latches itself. This is what makes a head unit whose Wi-Fi arrived after
+        // launch still find the update, without polling for it. Stable contains no updater.
+        UpdateHook.checkInBackground(this)
         loadRecentTrips()
         // The consumption fit reads the whole trip history, so it happens once per visit to
         // this screen and only when there is actually a plan being followed.
 
@@ -0,0 +1,30 @@
+package com.evsuite.chargepilot
+
+import android.content.Context
+import com.evsuite.chargepilot.route.RoutingTransport
+
+/**
+ * A refusal the driver can act on. The detail travels only where it means something to them —
+ * seconds to wait, a status code — never the transport's own English reason string.
+ *
+ * One mapping, because there was two: the destination screen and the charging-stop screen each
+ * carried a private copy, word for word, and a reason added to [RoutingTransport.Reason] had to
+ * be spelled twice or one screen would fail to compile — which is the good case. The bad one is
+ * the two drifting apart and a driver being told different things about the same refusal.
+ */
+internal fun Context.routingRefusal(result: RoutingTransport.Result.Refused): String =
+    when (result.reason) {
+        RoutingTransport.Reason.NOT_CONFIGURED -> getString(R.string.charge_stop_not_configured)
+        RoutingTransport.Reason.BUSY -> getString(R.string.routing_refused_busy)
+        RoutingTransport.Reason.QUOTA_MINUTE ->
+            getString(R.string.routing_refused_quota_minute, result.detail.orEmpty())
+        RoutingTransport.Reason.QUOTA_DAY -> getString(R.string.routing_refused_quota_day)
+        RoutingTransport.Reason.TRANSPORT -> getString(R.string.routing_refused_transport)
+        RoutingTransport.Reason.SERVER_DAILY_LIMIT -> getString(R.string.routing_refused_server_day)
+        RoutingTransport.Reason.SERVER_KEY_REFUSED -> getString(R.string.routing_refused_server_key)
+        RoutingTransport.Reason.SERVER_RATE_LIMIT ->
+            getString(R.string.routing_refused_server_minute)
+        RoutingTransport.Reason.SERVER_REJECTED ->
+            getString(R.string.routing_refused_server, result.detail.orEmpty())
+        RoutingTransport.Reason.UNREADABLE -> getString(R.string.routing_refused_unreadable)
+    }
@@ -22,20 +22,14 @@ import java.util.Locale
  * refused, the screen says the server rejected the request and the driver keeps a key that
  * never leaked — which is the failure this project prefers.
  *
- * **Quota, and the honesty about it.** Directions limits were read from ORS's own documentation
- * (2000 a day, 40 a minute). The geocoding numbers below could not be: on 2026-09-04 the plans
- * page is a JavaScript application that serves no readable figures, and the numbers commonly
- * published for it — 1000 a day, 100 a minute — come from third parties. The day figure is used
- * as an assumed ceiling, safe in the direction that matters: if the real allowance is larger
- * nothing breaks, and [RoutingQuota.observe] corrects the count from the server's own header the
- * moment a request comes back. **The per-minute figure is not**, and [RoutingQuota.observe]
- * does not correct it — only the day count reads the server's header, because a shared key can
- * be spent by another client between two of our own requests, which a minute-sized window
- * rarely lives long enough to matter for. Typing one destination on a head-unit keyboard, with
- * autocomplete firing per pause, is enough distinct prefixes to reach a wrong-and-too-generous
- * per-minute assumption before the address is finished — the driver then spends the rest of that
- * minute refused. [PER_MINUTE] is kept at [RoutingQuota.DIRECTIONS_PER_MINUTE], the one number
- * here with real confirmation, rather than a third-party guess this app cannot check.
+ * **Quota.** Geocoding has a budget of its own, separate from directions: the key dashboard
+ * lists it among the micro endpoints at 3000 a day and 100 a minute, read there on 2026-09-14.
+ * Both numbers were third-party guesses until then, and the guesses were low — a local throttle
+ * refusing requests the service would have answered is the same broken screen as one that spends
+ * a quota, minus the evidence. [RoutingQuota.observe] still corrects the day count from the
+ * server's own header, because a shared key can be spent by another client between two of our
+ * own requests; the minute count is not corrected, and at 100 a minute a driver typing one
+ * address on a head-unit keyboard cannot reach it.
  */
 object OrsGeocode {
 
@@ -62,20 +56,15 @@ object OrsGeocode {
      * keyboard, where the gap between two letters routinely exceeds a physical keyboard's,
      * still coalesces into one request instead of firing after nearly every letter.
      *
-     * 500ms measured as unusable: a driver typing one destination spent the whole local
-     * per-minute allowance before the address was finished, because a touchscreen's own
-     * typing cadence is slower than what that number assumed.
+     * Not a quota number: at [PER_MINUTE] a driver cannot type fast enough to reach the
+     * allowance at any debounce worth using. This is the head unit's own cadence — 500ms fires
+     * between two letters of the same word on this keyboard, and answers a prefix nobody meant.
      */
     const val SUGGEST_DEBOUNCE_MS = 900L
 
-    /**
-     * Assumed, not verified — see the class note. Brought down to the one number this app
-     * does have real confirmation for, [RoutingQuota.DIRECTIONS_PER_MINUTE]: the geocode
-     * endpoint's own per-minute figure was a guess that let this local throttle wave through
-     * requests the server was already refusing, so every one of them still spent a wait.
-     */
-    const val PER_DAY = 1000
-    const val PER_MINUTE = RoutingQuota.DIRECTIONS_PER_MINUTE
+    /** The geocoding endpoint's own allowance, from the key dashboard on 2026-09-14. */
+    const val PER_DAY = 3000
+    const val PER_MINUTE = 100
 
     /** More than a driver reads on a head unit while parked. */
     const val MAX_RESULTS = 5
 
@@ -23,8 +23,9 @@ class RoutingQuota(
 
     private val spent = ArrayDeque<Long>()
 
-    /** Fewer than the day's count if the server has told us otherwise. */
+    /** Fewer than the day's count if the server has told us otherwise, and when it said so. */
     private var remainingFromServer: Int? = null
+    private var remainingObservedAtMs: Long = 0L
 
     sealed interface Verdict {
         object Allowed : Verdict
@@ -43,11 +44,20 @@ class RoutingQuota(
             val oldest = spent.first { nowMs - it < MINUTE_MS }
             return Verdict.Wait(secondsUntil(oldest + MINUTE_MS, nowMs), Window.MINUTE)
         }
-        val serverExhausted = remainingFromServer?.let { it <= 0 } ?: false
-        if (spent.size >= dayLimit || serverExhausted) {
+        if (spent.size >= dayLimit) {
             val oldest = spent.firstOrNull() ?: nowMs
             return Verdict.Wait(secondsUntil(oldest + DAY_MS, nowMs), Window.DAY)
         }
+        // The server's own number closes the gate, but only for as long as it is fresh. Held
+        // for ever it is a deadlock: refusing locally means no request goes out, and only a
+        // request can bring back the header that would reopen it. Re-checking costs one
+        // refusal every [SERVER_TRUST_MS] and is the only thing that ever says "you may again".
+        val serverSaysNone = remainingFromServer?.let { it <= 0 } == true
+        if (serverSaysNone && nowMs - remainingObservedAtMs < SERVER_TRUST_MS) {
+            return Verdict.Wait(
+                secondsUntil(remainingObservedAtMs + SERVER_TRUST_MS, nowMs), Window.DAY
+            )
+        }
         return Verdict.Allowed
     }
 
@@ -60,8 +70,11 @@ class RoutingQuota(
 
     /** The server's own count wins over ours: it knows about other clients on the same key. */
     @Synchronized
-    fun observe(remaining: Int?) {
-        if (remaining != null && remaining >= 0) remainingFromServer = remaining
+    fun observe(remaining: Int?, nowMs: Long = System.currentTimeMillis()) {
+        if (remaining != null && remaining >= 0) {
+            remainingFromServer = remaining
+            remainingObservedAtMs = nowMs
+        }
     }
 
     @Synchronized
@@ -82,6 +95,13 @@ class RoutingQuota(
         const val DIRECTIONS_PER_DAY = 2000
         const val DIRECTIONS_PER_MINUTE = 40
 
+        /**
+         * How long the server's own remaining count is believed. Long enough that a real
+         * exhaustion is not hammered, short enough that a number read wrong — or read from a
+         * limiter describing a window this app never asked about — costs minutes, not a day.
+         */
+        const val SERVER_TRUST_MS = 5 * 60_000L
+
         const val MINUTE_MS = 60_000L
         const val DAY_MS = 24 * 60 * 60 * 1000L
     }