@@ -4,6 +4,16 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 
 ## [Unreleased]
 
+### Added
+
+- **A route source exists after all, and the unstable channel can prove it.** The head unit's
+  adapter service fans remaining distance, remaining time, guidance status and road name out to
+  any registered listener, so a route no longer requires a network, a permission or an account.
+  A parked-armed probe in the unstable channel records that fan-out over a drive and reports it
+  as a copyable trace. Nothing is displayed as a value: the distance callbacks carry no proven
+  unit and the status codes no documented meaning, so every reading stays raw pending the
+  on-vehicle run. The stable channel is unchanged and gains no capability.
+
 ### Security
 
 - The application declares an empty task affinity, reducing launcher-task hijacking exposure on
 
@@ -0,0 +1,131 @@
+# CP-040 — Route and destination source
+
+Date: 2026-09-02
+
+Decision owner: pending. This document states the finding and the recommendation; the
+network question at the end of it is the owner's, not this session's.
+
+Firmware examined: `saicadapterservice_overseas_eh32` (R69 EH32), decompiled sources under
+workspace `apks/`.
+
+## Verdict in one line
+
+The head unit **does** publish remaining distance and remaining time to the destination, to
+any process that registers as a listener on its general service — no Android permission, no
+network, no account. That closes the question CP-040 was written to answer. It does **not**
+close Phase 4, because it carries no elevation, no chargers and no alternative routes.
+
+## What was actually found
+
+`SaicNav` recorded that the map adapter answers no synchronous question about a trip. That
+is correct and remains correct. What it did not record is where the guidance goes instead.
+
+The navigation app calls into `com.saicmotor.adapterservice`:
+
+| Call | Transaction | Payload |
+| --- | --- | --- |
+| `remainingDistanceChange` | `IMapService` 39 | one int, logged as `remainingDistance` |
+| `remainingTimesChange` | `IMapService` 38 | one int, logged as `remainingMinutes` |
+| `guideStatusChange` | `IMapService` 29 | one int |
+| `guideInfosChange` | `IMapService` 30 | icon, distance to next manoeuvre, direction text |
+
+`MapService` stores each of these and forwards it to `GeneralService`, which fans it out over
+a `RemoteCallbackList` to every registered `IGeneralNotificationListener`:
+
+| Callback | Transaction |
+| --- | --- |
+| `guideStatusChange` | 1 |
+| `guideInfosChange` | 2 |
+| `roadInfoChange` | 3 |
+| `remainingTimesChange` | 12 |
+| `remainingDistanceChange` | 13 |
+
+Registration is `IGeneralService.registerNotificationListener`, transaction 1, on
+`com.saicmotor.adapterservice/.services.GeneralService`.
+
+Implemented as `EVHardware/lib/.../saic/SaicNavGuidance.kt`; the probe that captures it is
+`EVChargePilot/app/src/unstable/.../NavGuidanceProbeActivity.kt`.
+
+## Two traps found on the way, both avoided
+
+**`IMapNotificationListener` is the wrong direction.** It is tempting because
+`IMapService.registerNotificationListener` is transaction 1 and the name matches. But that
+interface carries `goHome`, `zoomIn`, `stopNav`, `setFastestRoute` and `startNavFromEVRout` —
+it is the channel the head unit uses to *command the navigation app*, not a feed of guidance.
+Registering on it would make this app impersonate a navigation provider, and every method on
+it is a write. It is out of bounds for a read-only app. `IGeneralNotificationListener` is the
+observer side and is what is used.
+
+**The callbacks are not `oneway`.** The generated proxy calls
+`transact(code, data, reply, 0)` and then `readException()`, and `GeneralService` fans out
+while holding the lock on its callback list. A listener that blocks therefore stalls every
+other consumer of guidance, the instrument cluster included. `SaicNavGuidance` does one
+parcel read and one volatile write per callback and nothing else — no I/O, no lock, no
+allocation beyond the immutable state object. Unrecognised transactions are answered without
+being parsed, so unrelated callbacks cost a reply and nothing more.
+
+Registration is additive: `RemoteCallbackList.register` appends and the list drops a dead
+listener on its own, so this displaces neither the navigation app nor the cluster.
+
+## What is still unproven
+
+- **The unit of `remainingDistance`.** The service logs the value without naming a unit and
+  `distanceUnitChange` exists as a separate concern. Metres and kilometres are both plausible
+  and the difference is a factor of a thousand. Nothing is converted anywhere in the code;
+  the value is carried as `remainingDistanceRaw`.
+- **The meaning of `guideStatus` codes.** Undocumented; carried raw.
+- **Behaviour with no guidance running.** If the navigation app publishes nothing when idle,
+  the feature only exists for drivers who navigate with the OEM app. This is the single most
+  decision-relevant unknown and the probe is built to record it.
+- **Whether a third-party navigation app feeds the same path.** TomTom broadcasts
+  (`com.tomtom.navigation.GUIDE_INFO`) reach `MapService`, so at least one non-SAIC app does.
+
+None of these can be settled off-vehicle, which is why CP-040 carries `on_vehicle_required`.
+
+## Scored comparison
+
+Scores are against CP-040's four criteria. "Boundary" means the read-only, offline,
+minimal-permission boundary stated in `PRODUCT.md`.
+
+| Source | Offline | Permission cost | Firmware stability | Boundary | Verdict |
+| --- | --- | --- | --- | --- | --- |
+| **OEM adapter guidance listener** | full | none | unproven; private interface, transaction codes are firmware-specific and must be evidence-gated per generation | intact — read-only, additive registration | **recommended for remaining distance and time** |
+| Manual destination entry + straight-line estimate | full | none | not firmware-dependent | intact | fallback only; a great-circle distance is wrong by 15–30 % on real roads and cannot see terrain |
+| Destination handed in by intent from another app | full | none | not firmware-dependent | intact | no such app exists today; keep as an interface, not a plan |
+| External routing engine (ORS, GraphHopper, Valhalla) | no | `INTERNET`, plus API-key handling | stable | **breaks it** — stable variant becomes networked | the only source that yields elevation and alternative routes |
+| ABRP `get_next_charge` | no | `INTERNET` | undocumented contract | breaks it, and adds an unagreed dependency | rejected, per `PLAN.md` |
+| Do not build Phase 4 | — | — | — | intact | still available, and still acceptable |
+
+## Recommendation
+
+**Take the adapter listener, and split Phase 4 in two.**
+
+1. **CP-041 arrival SOC becomes buildable** on remaining distance from the listener, once the
+   probe returns a unit and an idle-behaviour answer from the vehicle. It stays offline,
+   permission-free and inside the stated boundary. Its band must widen for the absent grade
+   term, per the CP-031 decision.
+
+2. **Everything else in the driver's stated goal stays blocked on a network decision.**
+   Elevation profile, charger locations and "via the departmental road instead" cannot come
+   from the head unit. They need a routing engine, and that means `INTERNET` in the stable
+   variant, a `PRODUCT.md` rewrite and a fresh CP-091 pass. That decision is not taken here.
+
+## Do-not-build option
+
+If the probe shows the adapter publishes nothing when the OEM navigation is idle, and the
+driver does not use the OEM navigation, then the listener is dead weight: delete
+`SaicNavGuidance` and the probe, mark CP-041 and CP-042 `blocked` permanently, and ship
+without Phase 4. That remains an acceptable outcome.
+
+## Security note
+
+No permission is added by this work; `mise run permissions` passes unchanged. The listener
+exists only in the unstable variant's reachable UI. Should CP-041 promote it to stable, the
+promotion needs its own CP-091 entry, because a stable build would then hold a registration
+on a head-unit service for the life of the process.
+
+## Next step
+
+Run the probe on the vehicle: park, arm, start a guidance in the car's own navigation, drive a
+leg whose distance is known independently, then park and copy the trace. The trace answers the
+unit question and the idle question together.
@@ -9,5 +9,11 @@
             android:exported="false"
             android:configChanges="uiMode"
             android:screenOrientation="landscape" />
+
+        <activity
+            android:name=".NavGuidanceProbeActivity"
+            android:exported="false"
+            android:configChanges="uiMode"
+            android:screenOrientation="landscape" />
     </application>
 </manifest>
@@ -2,6 +2,7 @@ package com.evsuite.chargepilot
 
 import android.content.ClipData
 import android.content.ClipboardManager
+import android.content.Intent
 import android.os.Bundle
 import android.os.SystemClock
 import androidx.appcompat.app.AppCompatActivity
@@ -59,6 +60,9 @@ class EvidenceCaptureActivity : AppCompatActivity() {
         fileStore = EvidenceCaptureFileStore(File(filesDir, "evidence"))
         binding.captureAction.setOnClickListener { requestToggle() }
         binding.copyAction.setOnClickListener { copyMarkdown() }
+        binding.navProbeAction.setOnClickListener {
+            startActivity(Intent(this, NavGuidanceProbeActivity::class.java))
+        }
         render(CaptureViewState.empty())
     }
 
 
@@ -0,0 +1,192 @@
+package com.evsuite.chargepilot
+
+import android.content.ClipData
+import android.content.ClipboardManager
+import android.os.Bundle
+import android.os.Handler
+import android.os.Looper
+import android.os.SystemClock
+import androidx.appcompat.app.AppCompatActivity
+import com.evsuite.chargepilot.databinding.ActivityNavGuidanceProbeBinding
+import com.evsuite.hardware.saic.NavGuidance
+import com.evsuite.hardware.saic.SaicNavGuidance
+import com.evsuite.hardware.telemetry.EnergyTelemetryReader
+import com.google.android.material.snackbar.Snackbar
+import java.util.ArrayDeque
+import java.util.Locale
+
+/**
+ * Records what the head unit's navigation actually reports during a drive.
+ *
+ * This is the CP-040 instrument. It answers three questions a decision needs and that no
+ * amount of desk work can settle: whether the adapter accepts the registration at all, what
+ * the remaining-distance callback carries and in which unit, and — the one that decides
+ * whether the feature exists — whether anything arrives when no guidance is running.
+ *
+ * **Cost while it runs.** The listener itself is push-driven and costs nothing when the
+ * navigation app is silent. This screen adds one 1 Hz tick that reads two volatile fields and
+ * compares them, which is a fifth of what the dashboard already does. The trace is a bounded
+ * ring; a long drive overwrites its oldest lines rather than growing. Nothing is written to
+ * disk and no service is started.
+ *
+ * The tick outlives [onStop] on purpose: a capture is meant to survive the screen going dark
+ * over three hours of motorway. It stops at [onDestroy], and so does the registration.
+ */
+class NavGuidanceProbeActivity : AppCompatActivity() {
+
+    private lateinit var binding: ActivityNavGuidanceProbeBinding
+    private lateinit var reader: EnergyTelemetryReader
+
+    private val ticker = Handler(Looper.getMainLooper())
+    private val trace = ArrayDeque<String>()
+    private var lastEvents = -1
+    private var visible = false
+    private var startedAtElapsedMs: Long? = null
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        binding = ActivityNavGuidanceProbeBinding.inflate(layoutInflater)
+        setContentView(binding.root)
+        reader = EnergyTelemetryReader(applicationContext)
+        SaicNavGuidance.connect(applicationContext)
+        binding.probeAction.setOnClickListener { toggle() }
+        binding.copyAction.setOnClickListener { copyTrace() }
+        ticker.post(tick)
+        render()
+    }
+
+    override fun onStart() {
+        super.onStart()
+        visible = true
+        render()
+    }
+
+    override fun onStop() {
+        visible = false
+        super.onStop()
+    }
+
+    override fun onDestroy() {
+        ticker.removeCallbacks(tick)
+        SaicNavGuidance.stop()
+        super.onDestroy()
+    }
+
+    private val tick = object : Runnable {
+        override fun run() {
+            record(SaicNavGuidance.latest())
+            if (visible) render()
+            ticker.postDelayed(this, TICK_MS)
+        }
+    }
+
+    /**
+     * Appends a line only when the listener actually saw something new.
+     *
+     * A drive that produces no line is the finding, not a failure of this screen — which is
+     * why the trace is never padded with repeats of an unchanged state.
+     */
+    private fun record(guidance: NavGuidance) {
+        if (guidance.events == lastEvents) return
+        lastEvents = guidance.events
+        if (guidance.events == 0) return
+        val since = startedAtElapsedMs?.let { (SystemClock.elapsedRealtime() - it) / 1_000L } ?: 0L
+        if (trace.size >= TRACE_LINES) trace.removeFirst()
+        trace.addLast(
+            String.format(
+                Locale.ROOT,
+                "%5ds n=%-4d status=%-4s dist=%-8s min=%-6s turn=%-8s road=%s",
+                since, guidance.events,
+                guidance.guideStatus.show(),
+                guidance.remainingDistanceRaw.show(),
+                guidance.remainingMinutes.show(),
+                guidance.nextTurnDistanceRaw.show(),
+                guidance.road ?: guidance.direction ?: DASH,
+            )
+        )
+    }
+
+    /** Rechecks speed at the moment of the press; a disabled button is not a safety boundary. */
+    private fun toggle() {
+        if (SaicNavGuidance.isListening) {
+            SaicNavGuidance.stop()
+            startedAtElapsedMs = null
+            lastEvents = -1
+            render()
+            return
+        }
+        val speed = runCatching { reader.read().speedKmh }.getOrNull()
+        if (EvidenceCapturePolicy.gate(speed) != EvidenceCaptureGate.PARKED) {
+            Snackbar.make(binding.root, R.string.nav_probe_refused, Snackbar.LENGTH_LONG).show()
+            return
+        }
+        if (SaicNavGuidance.start()) {
+            startedAtElapsedMs = SystemClock.elapsedRealtime()
+            trace.clear()
+            lastEvents = -1
+        }
+        render()
+    }
+
+    private fun copyTrace() {
+        val clipboard = getSystemService(ClipboardManager::class.java) ?: return
+        clipboard.setPrimaryClip(ClipData.newPlainText("nav-guidance", markdown()))
+        Snackbar.make(binding.root, R.string.nav_probe_copied, Snackbar.LENGTH_SHORT).show()
+    }
+
+    /**
+     * The report a CP-040 decision is written from.
+     *
+     * It states the unit question rather than hiding it: whoever reads the trace has to say
+     * what `dist` was in, and the only way to know is to compare it against a distance the
+     * driver already knows.
+     */
+    private fun markdown(): String = buildString {
+        append("# CP-040 — navigation guidance trace\n\n")
+        append("- adapter bound: ${SaicNavGuidance.isAvailable}\n")
+        append("- listener registered: ${SaicNavGuidance.isListening}\n")
+        append("- callbacks seen: ${SaicNavGuidance.latest().events}\n")
+        append("- trace lines: ${trace.size}${if (trace.size >= TRACE_LINES) " (oldest dropped)" else ""}\n\n")
+        append("`dist` and `turn` are raw callback values. Their unit is unproven — state it\n")
+        append("by comparing against a distance known independently before using any of this.\n\n")
+        append("```\n")
+        trace.forEach { append(it).append('\n') }
+        append("```\n")
+    }
+
+    private fun render() {
+        val guidance = SaicNavGuidance.latest()
+        val listening = SaicNavGuidance.isListening
+        binding.probeAction.setText(
+            if (listening) R.string.nav_probe_stop else R.string.nav_probe_start
+        )
+        binding.probeStatus.text = when {
+            !SaicNavGuidance.isAvailable -> getString(R.string.nav_probe_unavailable)
+            !listening -> getString(R.string.nav_probe_idle)
+            guidance.events == 0 -> getString(R.string.nav_probe_silent)
+            else -> getString(R.string.nav_probe_receiving, guidance.events)
+        }
+        binding.probeHint.setText(
+            when {
+                !SaicNavGuidance.isAvailable -> R.string.nav_probe_hint_unavailable
+                listening -> R.string.nav_probe_hint_running
+                else -> R.string.nav_probe_hint_ready
+            }
+        )
+        binding.probeTrace.text = if (trace.isEmpty()) {
+            getString(R.string.nav_probe_no_data)
+        } else {
+            trace.joinToString("\n")
+        }
+        binding.copyAction.isEnabled = trace.isNotEmpty()
+    }
+
+    private fun Int?.show(): String = this?.toString() ?: DASH
+
+    private companion object {
+        const val TICK_MS = 1_000L
+        /** Three hours of change at one line per second would not fit; the newest lines win. */
+        const val TRACE_LINES = 300
+        const val DASH = "—"
+    }
+}
@@ -112,6 +112,14 @@
                 android:layout_height="@dimen/touch_target"
                 android:layout_marginTop="@dimen/spacing_sm"
                 android:text="@string/evidence_copy" />
+
+            <com.google.android.material.button.MaterialButton
+                android:id="@+id/navProbeAction"
+                style="@style/Widget.EV.Button.Outlined"
+                android:layout_width="match_parent"
+                android:layout_height="@dimen/touch_target"
+                android:layout_marginTop="@dimen/spacing_sm"
+                android:text="@string/nav_probe_open" />
         </LinearLayout>
     </LinearLayout>
 </LinearLayout>