feat(route): hand the plan to the car instead of asking the driver to retype it

CP-056, and the rule it lifts. This app read the car and wrote nothing
back; it now writes exactly one thing, on a tap, while parked: a `geo:`
destination for whichever navigation app the head unit runs.

The reason is not convenience. A route that ends on this screen has to be
entered again in MG4 Navigator, and the step that gets skipped is the one
that made the numbers true — a plan the car is not following still puts an
arrival charge in front of the driver.

`geo:` carries one point and no waypoints, so sending the destination
cannot pin the road. Where the plan has a charging stop, the stop is what
goes: it is the leg the forecast is about, and the driver sets the rest
after charging. The screen says which one it sent and says the car picks
its own road — on its own line, never in the button's label, because a
button reads as a promise and this one cannot make it.

The bounds are in SECURITY.md, which had also gone stale claiming the app
was offline. Parked gate re-read at the tap rather than trusted from the
render that drew the button; one method, never the rest of the OEM's
command interface; no coordinates in any probe line, because that file
leaves the car on a USB stick.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: malys

CHANGELOG.md

@@ -6,6 +6,24 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 
 ### Added
 
+- **The plan can go to the car's navigation instead of being retyped.** CP-056. A route worked
+  out here used to end on this screen: the driver turned to MG4 Navigator and entered it again,
+  which is where the feature gets abandoned and, worse, where it goes wrong without saying so —
+  a plan the car is not following still shows an arrival charge. One button, while parked, sends
+  a `geo:` destination to whatever navigation app answers.
+
+  **It sends the charging stop, not the destination, whenever there is one.** `geo:` carries a
+  single point and no waypoints, so a route planned *through* somewhere cannot be pinned by its
+  endpoint. The stop is the leg the forecast is about; the driver sets the rest after charging.
+  The screen says which one went, and says plainly that the car picks its own road — a caveat on
+  its own line, never inside the button's label, because a button is read as a promise.
+
+  **This is the first thing EVChargePilot asks a vehicle system to do rather than tell it**, and
+  the boundary that used to say "read-only" now says so with its exception written out. Parked
+  gate re-read at the tap rather than trusted from the render. One method, one tap, one
+  destination. `stopNav`, `goHome` and `setFastestRoute` are not called anywhere in the tree.
+  Nothing about where the driver is going reaches a log or the USB bundle.
+
 - **The unstable build arms its own validation.** Two drives came back with
   `validationModeOn=false` — eleven questions still open, because the toggle sits three taps
   from the dashboard and a driver about to leave has no reason to go looking for it. An unstable

EVHardware

@@ -2,11 +2,38 @@
 
 ## Capability boundary
 
-EVChargePilot is offline and read-only. Its manifest declares only the car permissions needed
-to read speed, energy, exterior environment, climate and vendor-extension data. It has no
-network, location, overlay, installer, boot receiver or vehicle-setting write path.
-
-Trip history and crash reports stay in app-private storage. No telemetry leaves the device.
+EVChargePilot reads the car and does not write to it, with one stated exception. Its manifest
+declares the car permissions needed to read speed, energy, exterior environment, climate and
+vendor-extension data, plus network and location for route planning (CP-043). It has no
+overlay, no installer, no boot receiver and no vehicle-setting write path.
+
+Trip history, evidence captures and crash reports stay in app-private storage. Telemetry never
+leaves the device. What leaves it for a route is origin, destination and road profile, and — only
+when a charging stop is needed — a window of road around that stop. Never a trip, a charge level,
+an odometer, a speed, a climate state or an identifier.
+
+### The one write: handing a destination to the car's navigation
+
+`ChargeStopActivity` can send an `ACTION_VIEW` intent with a `geo:` URI, which moves whichever
+navigation app the driver uses to a destination this app planned. It is the only thing here that
+asks a vehicle system to act rather than to answer, and it exists because the alternative was a
+driver retyping a route — the step that gets skipped, and that silently invalidates every figure
+on the screen when it is done wrong.
+
+Its bounds, all of which are testable:
+
+- **Parked.** The parked gate is re-read at the tap, not trusted from the render that drew the
+  button. A navigation screen changing under someone at 110 km/h is the hazard.
+- **One tap, one destination.** Nothing hands over a destination on a timer, on a route arriving,
+  on a drift, or on anything but a press.
+- **One method.** `IMapNotificationListener` carries `stopNav`, `goHome` and `setFastestRoute`.
+  None of them is called anywhere in this tree, and registering on that interface — which would
+  mean impersonating a navigation provider — is not done.
+- **It cannot lie about what it did.** A destination handed over without the route it belongs to
+  is labelled on screen as exactly that: the car picks its own road, and the plan's figures stop
+  describing the drive if it picks a different one.
+- **No coordinates in any log or probe.** The validation artifact records that a handoff was
+  tapped and whether anything accepted it. Never where to.
 
 ## Reporting
 

SECURITY.md

@@ -5,6 +5,7 @@ import android.content.ComponentName
 import android.content.Context
 import android.content.Intent
 import android.content.ServiceConnection
+import android.net.Uri
 import android.os.Bundle
 import android.os.IBinder
 import android.view.View
@@ -20,6 +21,7 @@ import com.evsuite.chargepilot.route.RouteWhatIf
 import com.evsuite.chargepilot.route.RoutingCredentials
 import com.evsuite.chargepilot.route.RoutingTransport
 import com.evsuite.hardware.FirmwareInfo
+import com.evsuite.hardware.saic.NavigationHandoff
 import com.evsuite.hardware.telemetry.ChargeStopPlan
 import com.evsuite.hardware.telemetry.EnergySnapshot
 import com.evsuite.hardware.telemetry.EnergyTripHistoryStore
@@ -91,6 +93,9 @@ class ChargeStopActivity : AppCompatActivity() {
 
     private var message: String? = null
 
+    /** The plan the handoff button would send, set by the render that offered it. */
+    private var handoff: Handoff? = null
+
     private val gateExpiry = Runnable { render() }
 
     private val locationPermission = registerForActivityResult(
@@ -146,6 +151,7 @@ class ChargeStopActivity : AppCompatActivity() {
             startActivity(Intent(this, VehicleSettingsActivity::class.java))
         }
         binding.searchAction.setOnClickListener { search() }
+        binding.navigateAction.setOnClickListener { navigate() }
         worker.execute { loadRate() }
         render()
     }
@@ -492,6 +498,9 @@ class ChargeStopActivity : AppCompatActivity() {
             binding.chargerPlace.visibility = View.GONE
             binding.chargerSource.visibility = View.GONE
             binding.routeWhatIf.visibility = View.GONE
+            binding.navigateAction.visibility = View.GONE
+            binding.navigateNote.visibility = View.GONE
+            handoff = null
             return
         }
         binding.chargeStopPlan.visibility = View.VISIBLE
@@ -539,6 +548,7 @@ class ChargeStopActivity : AppCompatActivity() {
 
         renderCharger(plan, charger)
         renderWhatIf(whatIf, alternative)
+        renderHandoff(place, plan, charger)
 
         // ORS routes are OpenStreetMap under ODbL. Showing this is the licence, not a courtesy.
         binding.chargeStopAttribution.visibility =
@@ -624,6 +634,77 @@ class ChargeStopActivity : AppCompatActivity() {
      * confirmed are on their own line under it, because a dataset is wrong the day it is
      * published and the driver is the one who finds out.
      */
+    /**
+     * Offers to hand the plan to the car's navigation, and says what that hand-off cannot do.
+     *
+     * **The charging stop wins over the destination when there is one.** `geo:` carries a single
+     * point, so a route planned *through* somewhere cannot be pinned by sending its endpoint —
+     * the car would pick its own road and every figure on this screen would quietly become a
+     * figure about a different trip. Sending the stop pins the leg the forecast is actually
+     * about, and the driver sets the rest after charging. A stop with no charger found has no
+     * coordinates, so that case falls back to the destination and says so.
+     *
+     * The caveat is a separate line, never the button's label. A button is read as a promise and
+     * this one cannot make it: nothing here can stop the car choosing another road.
+     */
+    private fun renderHandoff(
+        place: OrsGeocode.Place,
+        plan: ChargeStopPlan.Plan,
+        charger: Found?,
+    ) {
+        val stop = (plan as? ChargeStopPlan.Plan.Stop)?.let { charger }
+        val target = if (stop != null) {
+            Handoff(stop.charger.latitude, stop.charger.longitude, stop.charger.name, toStop = true)
+        } else {
+            Handoff(place.latitude, place.longitude, place.label, toStop = false)
+        }
+        handoff = target
+        binding.navigateAction.visibility = View.VISIBLE
+        binding.navigateNote.visibility = View.VISIBLE
+        binding.navigateNote.setText(
+            if (target.toStop) R.string.charge_stop_navigate_stop
+            else R.string.charge_stop_navigate_destination
+        )
+        render()
+    }
+
+    /**
+     * Sends it. The first thing this application asks a vehicle system to do rather than tell it.
+     *
+     * Parked, on a tap, once. The gate is re-read here and not trusted from [render]: the button
+     * was enabled at some earlier moment and the car may have moved since, and a navigation
+     * screen changing under someone at 110 is the hazard this whole screen is arranged around.
+     */
+    private fun navigate() {
+        val target = handoff ?: return
+        if (ParkedDeletionPolicy.gate(speedKmh, speedObservedAtMs, System.currentTimeMillis())
+            != ParkedDeletionGate.PARKED
+        ) {
+            announce(getString(R.string.charge_stop_moving))
+            return
+        }
+        val uri = NavigationHandoff.geoUri(target.latitude, target.longitude, target.label)
+            ?: run {
+                announce(getString(R.string.charge_stop_navigate_bad_place))
+                return
+            }
+        val intent = Intent(Intent.ACTION_VIEW, Uri.parse(uri))
+        // No coordinates in the probe line: this file leaves the car on a USB stick.
+        ValidationProbe.record(ValidationQuestion.NAVIGATION_HANDOFF) {
+            "driver tapped the handoff, to=${if (target.toStop) "charging stop" else "destination"}"
+        }
+        val sent = runCatching { startActivity(intent) }.isSuccess
+        ValidationProbe.record(ValidationQuestion.NAVIGATION_HANDOFF) {
+            if (sent) "accepted by something" else "nothing accepted ACTION_VIEW geo:"
+        }
+        announce(
+            getString(
+                if (sent) R.string.charge_stop_navigate_sent
+                else R.string.charge_stop_navigate_none
+            )
+        )
+    }
+
     private fun renderCharger(plan: ChargeStopPlan.Plan, charger: Found?) {
         if (plan !is ChargeStopPlan.Plan.Stop) {
             binding.chargerPlace.visibility = View.GONE
@@ -710,6 +791,7 @@ class ChargeStopActivity : AppCompatActivity() {
         for (index in 0 until binding.destinationResults.childCount) {
             binding.destinationResults.getChildAt(index).isEnabled = usable
         }
+        binding.navigateAction.isEnabled = usable
 
         binding.chargeStopStatus.text = message ?: when (gate) {
             ParkedDeletionGate.MOVING -> getString(R.string.charge_stop_moving)
@@ -730,6 +812,14 @@ class ChargeStopActivity : AppCompatActivity() {
         String.format(Locale.getDefault(), pattern, value)
 
     /** A charger, where it falls on this route, and the charge left on reaching it. */
+    /** What the button would send, held between the render that offered it and the tap. */
+    private data class Handoff(
+        val latitude: Double,
+        val longitude: Double,
+        val label: String?,
+        val toStop: Boolean,
+    )
+
     private data class Found(
         val charger: OpenChargeMap.Charger,
         val alongKm: Double,

app/src/main/java/com/evsuite/chargepilot/ChargeStopActivity.kt

@@ -172,6 +172,26 @@
                 android:textAppearance="@style/Text.EV.Body"
                 android:visibility="gone" />
 
+            <!-- CP-056. The action that ends this screen: the plan stops being something the
+                 driver has to copy. Its caveat is a sibling and never the button's own label,
+                 because a driver reads a button as a promise and this one cannot make it. -->
+            <com.google.android.material.button.MaterialButton
+                android:id="@+id/navigateAction"
+                style="@style/Widget.EVChargePilot.Button"
+                android:layout_width="1400dp"
+                android:layout_height="@dimen/touch_target"
+                android:layout_marginTop="@dimen/spacing_lg"
+                android:text="@string/charge_stop_navigate"
+                android:visibility="gone" />
+
+            <TextView
+                android:id="@+id/navigateNote"
+                android:layout_width="1400dp"
+                android:layout_height="wrap_content"
+                android:layout_marginTop="@dimen/spacing_sm"
+                android:textAppearance="@style/Text.EV.Secondary"
+                android:visibility="gone" />
+
             <TextView
                 android:id="@+id/chargeStopAttribution"
                 android:layout_width="1400dp"

app/src/main/res/layout/activity_charge_stop.xml

@@ -321,6 +321,14 @@ Consommation %6$s %% par km</string>
     <string name="charge_stop_charger_none">Aucune borne utilisable sur cette portion. Rechargez avant.</string>
     <string name="charge_stop_charger_absent">Ajoutez une clé Open Charge Map pour savoir où vous arrêter.</string>
     <string name="charge_stop_charger">%1$s\u2009· à %2$s km · %3$s kW · %4$s</string>
+    <!-- CP-056. Le passage de relais. La note n’est jamais repliée dans le libellé du bouton :
+         un conducteur lit un bouton comme une promesse, et « geo: » ne porte qu’un point. -->
+    <string name="charge_stop_navigate">Y aller</string>
+    <string name="charge_stop_navigate_stop">Envoie l\u2019arrêt de recharge à la navigation de la voiture. Elle choisit sa route : suivez-la et ce plan décrit le même trajet, prenez-en une autre et les chiffres ci-dessus ne parlent plus de lui. Redonnez la destination finale après la recharge.</string>
+    <string name="charge_stop_navigate_destination">Envoie la destination à la navigation de la voiture. Elle choisit sa route : les chiffres ci-dessus décrivent ce plan, pas forcément ce que la voiture fera.</string>
+    <string name="charge_stop_navigate_none">Rien sur cette tête de série n\u2019a accepté de destination. L\u2019itinéraire reste ici ; saisissez-le vous-même dans la navigation de la voiture.</string>
+    <string name="charge_stop_navigate_sent">Envoyé à la navigation de la voiture.</string>
+    <string name="charge_stop_navigate_bad_place">Ce lieu n\u2019a pas de coordonnées utilisables : rien n\u2019a été envoyé.</string>
     <string name="charge_stop_charger_arrival">Environ %1$s %% restants à l\u2019arrivée sur place.</string>
     <string name="charge_stop_charger_source">%1$s · dernière confirmation %2$s. C\u2019est un enregistrement, pas une promesse : la borne peut avoir disparu, être occupée ou en panne.</string>
     <string name="charge_stop_charger_source_undated">%1$s · aucune date de confirmation. C\u2019est un enregistrement, pas une promesse : la borne peut avoir disparu, être occupée ou en panne.</string>

app/src/main/res/values-fr/strings.xml

@@ -326,6 +326,15 @@ Spending %6$s %% per km</string>
     <string name="charge_stop_charger_none">No usable charger found on that stretch of road. Charge before it.</string>
     <string name="charge_stop_charger_absent">Add an Open Charge Map key to be told where to stop.</string>
     <string name="charge_stop_charger">%1$s\u2009· %2$s km along · %3$s kW · %4$s</string>
+    <!-- CP-056. The handoff. Its note is never folded into the button label: a driver reads a
+         button as a promise, and "geo:" carries one point, so a route planned through a charging
+         stop cannot be pinned by its endpoint. -->
+    <string name="charge_stop_navigate">Navigate to this</string>
+    <string name="charge_stop_navigate_stop">Sends the charging stop to the car\u2019s navigation. It picks its own road, so drive it and this plan describes the same trip; go another way and the figures above stop being about it. Set the final destination again after charging.</string>
+    <string name="charge_stop_navigate_destination">Sends the destination to the car\u2019s navigation. It picks its own road, so the figures above describe this plan, not necessarily what the car will do.</string>
+    <string name="charge_stop_navigate_none">Nothing on this head unit accepted a destination. The route stays here; enter it in the car\u2019s navigation yourself.</string>
+    <string name="charge_stop_navigate_sent">Sent to the car\u2019s navigation.</string>
+    <string name="charge_stop_navigate_bad_place">That place has no usable coordinates, so nothing was sent.</string>
     <string name="charge_stop_charger_arrival">About %1$s %% left on arrival there.</string>
     <string name="charge_stop_charger_source">%1$s · last confirmed %2$s. This is a record, not a promise: it may be gone, busy or broken.</string>
     <string name="charge_stop_charger_source_undated">%1$s · no confirmation date. This is a record, not a promise: it may be gone, busy or broken.</string>