feat: recording outlives the screen that started it

The sampler ran between the activity's onStart and onStop, which made the trip
log a function of where the driver was looking. Ten minutes in the media app and
the accumulator — correctly refusing to integrate across a gap it cannot account
for — returned a trip whose distance and energy simply omitted that stretch.

TripRecordingService takes over the sampler, the trip session and the history
file; MainActivity binds to it and renders what it publishes. Sampling runs while
a dashboard is bound or a trip is recording, and the service stops itself when
neither holds, so nothing reads vehicle properties on behalf of nobody. Starting
is an intent, which is what makes it a started service and lets it outlive the
unbind; stopping is a binder call, because the dashboard is by definition on
screen when a trip can be stopped. The history append moves off the main thread,
and the shutdown waits for it rather than racing the trip the driver just ended.

The foreground type is derived from the permission actually held rather than from
the manifest, and it is specialUse: the platform's catalogue has no entry for
recording a car's own telemetry to local storage, dataSync describes sending it
somewhere this app cannot reach, and from Android 15 that type carries a daily
cap a long drive would hit. POST_NOTIFICATIONS stays undeclared — the target head
unit is API 28, where it does not exist, and a permission never requested on a
screen the driver reaches is a permission the app does not have.

Verified on the API 28 1920x720 emulator: the service exists while the dashboard
is visible, is gone within seconds of leaving it with no trip running, and
survives an activity restart without a second sampler. The recording-survives-
background path still needs a car: the emulator publishes no speed, so the
parked-gated control that starts a trip cannot be reached there.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: malys

.github/security/permission-allowlist.txt

@@ -4,3 +4,7 @@ android.car.permission.CAR_ENERGY
 android.car.permission.CAR_EXTERIOR_ENVIRONMENT
 android.car.permission.CONTROL_CAR_CLIMATE
 android.car.permission.CAR_VENDOR_EXTENSION
+# Trip recording outlives the dashboard, which on API 26+ requires a foreground service.
+# Install-time permissions, no vehicle access, no network.
+android.permission.FOREGROUND_SERVICE
+android.permission.FOREGROUND_SERVICE_SPECIAL_USE

CHANGELOG.md

@@ -6,6 +6,17 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 
 ### Added
 
+- **A trip keeps recording while the driver looks at something else.** Sampling used to live
+  between the dashboard's `onStart` and `onStop`, so switching to the media app for ten minutes
+  left a hole in the middle of the drive: the accumulator refuses to integrate across a gap
+  longer than five seconds, correctly, since it has no idea what the car did in between, and the
+  trip came back missing the distance and energy of the part nobody was watching. A foreground
+  service now owns the sampler and the trip history, and the dashboard is one of its readers. It
+  samples while a dashboard is bound or a trip is recording, and stops itself when neither is
+  true, so nothing reads vehicle properties for nobody. The service claims only the foreground
+  type its held permissions back, and the notification stays a low-importance status line — it
+  never interrupts a moving car.
+
 - **Every figure on the dashboard now says what kind of claim it is.** The energy work ahead is
   mostly inference — the MG4 publishes no per-consumer counters, so the climate share, the speed
   comparison and the arrival state of charge will all be models — and a model drawn in the same

app/src/main/AndroidManifest.xml

@@ -16,6 +16,19 @@
     <uses-permission android:name="android.car.permission.CONTROL_CAR_CLIMATE" />
     <uses-permission android:name="android.car.permission.CAR_VENDOR_EXTENSION" />
 
+    <!-- Trip recording keeps sampling while the driver looks at another app, which on API 26+
+         means a foreground service. Both permissions are install-time and neither reaches the
+         vehicle: FOREGROUND_SERVICE allows the service at all, and FOREGROUND_SERVICE_SPECIAL_USE
+         backs the one type that fits. The platform's catalogue has no entry for recording a
+         vehicle's own energy telemetry to local storage — `dataSync` describes transferring data
+         to somewhere else, which this app has no permission to do and no code for, and from
+         Android 15 it carries a daily runtime cap a long drive would hit. POST_NOTIFICATIONS is
+         deliberately absent: the target head unit runs API 28, where it does not exist, and a
+         permission this app never asks for on a screen the driver reaches is a permission it
+         does not have. -->
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
+
     <application
         android:name=".ChargePilotApp"
         android:allowBackup="false"
@@ -36,6 +49,15 @@
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
         </activity>
+
+        <service
+            android:name=".TripRecordingService"
+            android:exported="false"
+            android:foregroundServiceType="specialUse">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="Records the vehicle's own energy telemetry to app-private storage for the duration of a trip the driver started. No data leaves the car." />
+        </service>
     </application>
 
 </manifest>

app/src/main/java/com/evsuite/chargepilot/MainActivity.kt

@@ -1,6 +1,11 @@
 package com.evsuite.chargepilot
 
+import android.content.ComponentName
+import android.content.Context
+import android.content.Intent
+import android.content.ServiceConnection
 import android.os.Bundle
+import android.os.IBinder
 import android.widget.TextView
 import androidx.appcompat.app.AlertDialog
 import androidx.appcompat.app.AppCompatActivity
@@ -10,80 +15,84 @@ import com.evsuite.hardware.EVHardware
 import com.evsuite.hardware.FirmwareInfo
 import com.evsuite.hardware.diag.CrashLogger
 import com.evsuite.hardware.telemetry.EnergySnapshot
-import com.evsuite.hardware.telemetry.EnergyTelemetryReader
-import com.evsuite.hardware.telemetry.EnergyTripHistoryStore
 import com.evsuite.hardware.telemetry.EnergyTripSession
 import com.evsuite.hardware.telemetry.Provenanced
-import java.io.File
 import java.util.Locale
 import java.util.concurrent.Executors
-import java.util.concurrent.ScheduledFuture
-import java.util.concurrent.TimeUnit
 
 class MainActivity : AppCompatActivity() {
 
     private lateinit var binding: ActivityMainBinding
-    private lateinit var reader: EnergyTelemetryReader
-    private lateinit var tripStore: EnergyTripHistoryStore
     private lateinit var provenance: ProvenanceText
-    private val sampler = Executors.newSingleThreadScheduledExecutor { runnable ->
-        Thread(runnable, "chargepilot-sampler")
+    /** Ten binder reads and a disk read for the diagnostics report; not the main thread's work. */
+    private val background = Executors.newSingleThreadExecutor { runnable ->
+        Thread(runnable, "chargepilot-diagnostics")
     }
-    private var samplingTask: ScheduledFuture<*>? = null
-    /** Written by the sampler thread, read by the main thread on a control tap. */
-    @Volatile private var latest: EnergySnapshot? = null
+
+    /** The recorder owns the sampler; this screen is one of its readers. */
+    private var recorder: TripRecordingService? = null
     /** The last frame drawn, so the diagnostics report can explain what the screen shows. */
     @Volatile private var latestReadings: DashboardReadings = DashboardReadings.empty()
 
+    private val connection = object : ServiceConnection {
+        override fun onServiceConnected(name: ComponentName?, service: IBinder?) {
+            val bound = (service as? TripRecordingService.LocalBinder)?.service ?: return
+            recorder = bound
+            bound.setListener(::render)
+            bound.latest?.let(::render)
+        }
+
+        override fun onServiceDisconnected(name: ComponentName?) {
+            recorder = null
+        }
+    }
+
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         binding = ActivityMainBinding.inflate(layoutInflater)
         setContentView(binding.root)
 
         provenance = ProvenanceText(this)
-        reader = EnergyTelemetryReader(applicationContext)
-        tripStore = EnergyTripHistoryStore(File(filesDir, "trips.json"))
         binding.tripAction.setOnClickListener { toggleTrip() }
         binding.diagnosticsAction.setOnClickListener { showDiagnostics() }
         renderUnavailable()
     }
 
+    /**
+     * Binding is what makes the recorder sample for this screen; it keeps sampling after the
+     * unbind only when a trip is actually being recorded.
+     */
     override fun onStart() {
         super.onStart()
-        samplingTask = sampler.scheduleWithFixedDelay(::sample, 0L, 1L, TimeUnit.SECONDS)
+        bindService(
+            Intent(this, TripRecordingService::class.java), connection, Context.BIND_AUTO_CREATE
+        )
     }
 
     override fun onStop() {
-        samplingTask?.cancel(false)
-        samplingTask = null
+        recorder?.setListener(null)
+        recorder = null
+        unbindService(connection)
         super.onStop()
     }
 
     override fun onDestroy() {
-        sampler.shutdownNow()
+        background.shutdownNow()
         super.onDestroy()
     }
 
-    private fun sample() {
-        val value = runCatching { reader.read() }
-            .onFailure { AppLogger.w(TAG, "telemetry sample failed: ${it.message}") }
-            .getOrNull() ?: return
-        latest = value
-        EnergyTripSession.add(value)
-        runOnUiThread { render(value) }
-    }
-
     private fun toggleTrip() {
-        val value = latest ?: return
+        val service = recorder
         if (EnergyTripSession.isRecording) {
-            val summary = EnergyTripSession.stop(value.timestampMs) ?: return
-            if (!tripStore.append(summary)) {
-                AppLogger.w(TAG, "trip history could not be saved")
+            if (service == null) {
+                AppLogger.w(TAG, "trip stop ignored: recorder not bound")
+                return
             }
+            service.stopTrip()
+            service.latest?.let(::render)
         } else {
-            EnergyTripSession.start(value)
+            TripRecordingService.start(this)
         }
-        render(value)
     }
 
     private fun render(value: EnergySnapshot) {
@@ -165,7 +174,7 @@ class MainActivity : AppCompatActivity() {
      * built on the sampler thread and only the dialog itself touches the main one.
      */
     private fun showDiagnostics() {
-        sampler.execute {
+        background.execute {
             val body = diagnosticsReport()
             runOnUiThread {
                 if (isFinishing || isDestroyed) return@runOnUiThread