fix(glass): the probe reads the ignition on the scale it answers on

Two faults, one feature. The probe refused every run with "ignition not in
RUN" on a car whose ignition was on: it compared getCurrentIgnitionState(),
which answers on the AAOS IgnitionState scale, against CarIgnitionItem.RUN.
The scales do not line up — RUN is 2 for Katman5, where 2 is OFF — so contact
mis read as 4 and was refused, while contact coupe read as 2 and was let
through. setEsc compared the same two scales; it now refuses only a known
non-RUN ignition, which is what its own documentation always claimed.

Under that, the window actions could not have worked anyway. They wrote
through the vendor hub's setDriveWindow, a setter no application on the head
unit calls, whose eight accepted values nothing explains and whose dropped
writes are indistinguishable from obeyed ones.

VsmGlass reaches the same glass through the VSM already bound for ADAS,
where the commands are established rather than guessed: STOP, UP and AUTO_UP.
UP is a switch held down and not an order — the glass travels only while the
command keeps arriving — which is why a single write looked exactly like a
command that does nothing, and why hold() re-sends it before releasing it.
Reads answer 0-255 rather than the hub's 0-100, and a motor with no position
sensor answers off that scale and is reported as no reading rather than as a
closed window.

SaicVehicleControl now prefers the VSM for every glass read and write and
keeps the hub as the fallback where the methods are absent. GlassProbe holds
each command down instead of writing it once, which is the only way a
momentary command shows up in a position read at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: malys

CHANGELOG.md

@@ -6,6 +6,38 @@ All notable changes to this project are documented here. Format follows
 
 ## [Unreleased]
 
+## [1.9.0] - 2026-08-28
+
+### Fixed
+
+- **The glass probe refused to run on a car whose ignition was on.** It read
+  `getCurrentIgnitionState()`, which answers on the AAOS `IgnitionState` scale, against
+  `CarIgnitionItem.RUN` — and the two scales do not line up: RUN is 2 for Katman5, where 2 is
+  OFF. Contact mis read as 4 and was refused; contact coupé read as 2 and was let through.
+  `setEsc` compared the same two scales and now refuses only a *known* non-RUN ignition, as its
+  own documentation always said it did.
+- **Window actions moved nothing.** They were written through the vendor hub's
+  `setDriveWindow`, a setter no application on the head unit calls, whose accepted values
+  nothing explains and whose dropped writes are indistinguishable from obeyed ones.
+
+### Added
+
+- **`VsmGlass` — the windows through the interface the car's own window switch uses.**
+  `setVehicleWindowStatus(area, command)` and `getVehicleWindowValue(area)`, on the VSM already
+  bound for ADAS. The commands are established rather than guessed: `STOP`, `UP` and `AUTO_UP`.
+  `UP` is a switch held down and not an order — the glass travels only while the command keeps
+  arriving, which is why a single write looked exactly like a command that does nothing, and
+  why `hold()` re-sends it and then releases it. Reads answer 0–255, not the hub's 0–100, and a
+  motor without a position sensor answers off that scale and is reported as no reading rather
+  than as a closed window. VSM-based firmwares only; the hub stays the fallback.
+
+### Changed
+
+- **`SaicVehicleControl` prefers the VSM for every glass read and write**, falling back to the
+  hub only where the VSM does not carry the methods. `GlassProbe` holds each command down for
+  `HOLD_MS` instead of writing it once, which is the only way a momentary command shows up in a
+  position read at all.
+
 ## [1.8.0] - 2026-08-27
 
 ### Added

lib/src/main/java/com/evsuite/hardware/EVHardware.kt

@@ -1578,6 +1578,14 @@ object EVHardware {
     internal fun a9ClassLoader(): ClassLoader? =
         sVsm?.javaClass?.classLoader ?: sCarAdapterClass?.classLoader
 
+    /**
+     * The VSM singleton, for the primitives that live outside this file.
+     *
+     * [VsmGlass] is one of them: the glass belongs with the glass, not in the middle of the
+     * ADAS calls, and it needs the same instance [callVsm] uses rather than a second bind.
+     */
+    internal fun vsmInstance(): Any? = sVsm
+
     private fun callVsm(methodName: String, vararg args: Any?): Any? {
         val vsm = sVsm ?: return null
         return try {
@@ -2713,10 +2721,11 @@ object EVHardware {
     fun setEsc(on: Boolean): Boolean {
         if (!hasDrowsinessAndEsc()) return false
 
+        // [IgnitionState], not [CarIgnitionItem]: getCurrentIgnitionState() answers on the
+        // AAOS scale, where the two do not line up — RUN is 2 for Katman5 and OFF is 2 here.
+        // Unreadable is 0 or -1 and is deliberately not a refusal, per the KDoc above.
         val ignition = getCurrentIgnitionState()
-        if (ignition == CarIgnitionItem.OFF || ignition == CarIgnitionItem.ACCESSORY ||
-            ignition == CarIgnitionItem.CRANK
-        ) {
+        if (ignition > 0 && ignition != IgnitionState.ON) {
             AppLogger.w(TAG, "  ESC: vehicle not in RUN (ignition=$ignition) — no action, the " +
                 "reading cannot be trusted yet")
             return false

lib/src/main/java/com/evsuite/hardware/GlassProbe.kt

@@ -94,7 +94,10 @@ object GlassProbe {
         window: Window,
         glass: Glass = VehicleGlass,
         stopped: () -> Boolean = { VehicleWriteGate.decideNow() == VehicleWriteGate.Decision.ALLOWED },
-        ignitionRun: () -> Boolean = { EVHardware.getCurrentIgnitionState() == EVHardware.CarIgnitionItem.RUN },
+        // [IgnitionState], not [CarIgnitionItem]: getCurrentIgnitionState() answers on the AAOS
+        // scale, and the two do not line up — RUN is 2 for Katman5, where 2 is OFF here. Read
+        // against the wrong one, a car with the ignition on refused the probe as if it were off.
+        ignitionRun: () -> Boolean = { EVHardware.getCurrentIgnitionState() == EVHardware.IgnitionState.ON },
         sleep: (Long) -> Unit = { Thread.sleep(it) },
     ): Result {
         val attempts = mutableListOf<Attempt>()
@@ -172,11 +175,23 @@ object GlassProbe {
         return abs(settled - start) < MOVEMENT_PERCENT
     }
 
+    /**
+     * How long each command is held down before the position is read back.
+     *
+     * Shorter than a close, because the sweep sends up to sixteen of them and the driver is
+     * sitting through all of it — long enough for a window to travel further than
+     * [MOVEMENT_PERCENT], which is all the probe has to see.
+     */
+    const val HOLD_MS = 1_500L
+
     /** The real car. */
     object VehicleGlass : Glass {
         override fun position(window: Window): Int? = SaicVehicleControl.windowPercent(window)
+        // Held, not sent once: the commands that move this glass are switches rather than
+        // orders, and a single write travels the window by less than the read can resolve.
+        // Holding a command that *is* an order costs nothing — it simply arrives again.
         override fun send(window: Window, command: Int): Boolean =
-            SaicVehicleControl.setWindow(window, command)
+            SaicVehicleControl.holdWindow(window, command, HOLD_MS)
     }
 
     private const val TAG = "EV_GLASS"

lib/src/main/java/com/evsuite/hardware/VsmGlass.kt

@@ -0,0 +1,170 @@
+package com.evsuite.hardware
+
+import java.lang.reflect.Method
+
+/**
+ * The glass, through the VSM — the interface the car's own window switch goes through.
+ *
+ * EVHardware reached the windows through the vendor hub until now
+ * ([com.evsuite.hardware.saic.SaicVehicleControl]), and that path is the whole reason the
+ * glass actions shipped refused: its setter takes a value no application on the head unit
+ * ever writes, so what the eight accepted values do was never more than a guess, and a value
+ * the service drops looks exactly like one it obeys.
+ *
+ * The VSM carries the same glass under two methods whose meaning is settled by use:
+ *
+ *   • `setVehicleWindowStatus(area, command)` — the commands in [Command]
+ *   • `getVehicleWindowValue(area)` — a position, 0 closed to [VALUE_MAX] open
+ *
+ * Areas are `0..3`: front left, front right, rear left, rear right.
+ *
+ * **Per generation.** VSM-based firmwares only. SWI68 and SWI165 reach the VSM through
+ * `VehicleSettingManager`, SWI69, SWI131 and SWI132 through `CarVehicleSettingClient`, and
+ * both expose these names. SWI133 is VPM-based and carries neither, so [isAvailable] answers
+ * false there and the caller keeps the hub instead of writing into nothing.
+ */
+object VsmGlass {
+
+    /** The scale `getVehicleWindowValue` answers on: 0 fully closed, 255 fully open. */
+    const val VALUE_MAX = 255
+
+    /** The largest command `setVehicleWindowStatus` carries. */
+    const val COMMAND_MAX = 7
+
+    /** How often a held command is re-sent while the glass travels. */
+    const val PULSE_MS = 120L
+
+    /** How long [hold] keeps a command down when the caller names no duration. */
+    const val HOLD_MS = 5_000L
+
+    /**
+     * The commands whose effect is established.
+     *
+     * [UP] is a switch held down, not an order: the window travels while the command keeps
+     * arriving and stops the instant it does not — which is why sending it once and waiting
+     * looked exactly like a command that does nothing at all. [AUTO_UP] is the one-shot close
+     * the door switch performs, and only the trims whose motors carry a position sensor obey
+     * it; [hold] works on both, so it is what a close falls back to.
+     *
+     * No opening command is named here. Nothing on the head unit sends one, so any value
+     * written down would be a guess — [GlassProbe] finds them on the car instead.
+     */
+    object Command {
+        const val STOP = 0
+        const val UP = 1
+        const val AUTO_UP = 3
+    }
+
+    private val INT = Int::class.javaPrimitiveType!!
+    private val AREAS = 0..3
+
+    // Looked up once per VSM class rather than per call: a hold writes eight times a second,
+    // and `getMethod` on every one of them is forty lookups for a single close.
+    @Volatile private var owner: Class<*>? = null
+    @Volatile private var setter: Method? = null
+    @Volatile private var getter: Method? = null
+
+    /** The VSM with its two methods resolved, or null when there is nothing to call. */
+    @Synchronized
+    private fun vsm(): Any? {
+        val vsm = EVHardware.vsmInstance() ?: return null
+        if (owner !== vsm.javaClass) {
+            owner = vsm.javaClass
+            setter = method(vsm, "setVehicleWindowStatus", INT, INT)
+            getter = method(vsm, "getVehicleWindowValue", INT)
+        }
+        return vsm
+    }
+
+    private fun method(vsm: Any, name: String, vararg types: Class<*>): Method? = try {
+        vsm.javaClass.getMethod(name, *types)
+    } catch (e: Exception) {
+        AppLogger.w(TAG, "  VSM: $name absent — ${e.javaClass.simpleName}")
+        null
+    }
+
+    /** True when this firmware's VSM carries the glass setter. */
+    val isAvailable: Boolean
+        get() = FirmwareInfo.isVsmBased() && vsm() != null && setter != null
+
+    /**
+     * One window's position, 0 closed to [VALUE_MAX] open, or null when there is no reading.
+     *
+     * Null covers two cases that must not be told apart by guessing: the method is absent, or
+     * the motor has no position sensor and answers a fixed value off the scale. The standard
+     * trim is the second one, and calling its sentinel "closed" would let a close skip a
+     * window that is wide open.
+     */
+    fun value(area: Int): Int? {
+        val vsm = vsm() ?: return null
+        val get = getter ?: return null
+        if (area !in AREAS) return null
+        return try {
+            (get.invoke(vsm, area) as? Number)?.toInt()?.takeIf { it in 0..VALUE_MAX }
+        } catch (e: Exception) {
+            AppLogger.w(TAG, "  VSM: getVehicleWindowValue($area) exc: ${e.message}")
+            null
+        }
+    }
+
+    /** The same position in percent — the scale the catalogue and the rules speak in. */
+    fun percent(area: Int): Int? = value(area)?.let { it * 100 / VALUE_MAX }
+
+    /** Sends [command] once to each of [areas]. One write, for the commands that are orders. */
+    fun send(areas: List<Int>, command: Int): Boolean =
+        gate(areas, command)?.let { targets -> targets.map { write(it, command) }.all { it } } ?: false
+
+    /**
+     * Holds [command] down on [areas] for [durationMs], then releases it with [Command.STOP].
+     *
+     * This is what [Command.UP] needs: it moves the glass only while it keeps arriving, so a
+     * single write travels the window by whatever it manages before the next frame — nothing
+     * a position read can see. A command that is an order rather than a switch is unharmed by
+     * being repeated, which is what lets [GlassProbe] sweep both kinds the same way.
+     *
+     * Blocking for [durationMs] — call it off the main thread. The standstill gate is checked
+     * once, before the first write: a hold is one gesture, and abandoning it halfway would
+     * leave the glass part-way up with nothing on the way to finish it.
+     */
+    fun hold(
+        areas: List<Int>,
+        command: Int,
+        durationMs: Long = HOLD_MS,
+        sleep: (Long) -> Unit = { Thread.sleep(it) },
+    ): Boolean {
+        val targets = gate(areas, command) ?: return false
+        var ok = true
+        val deadline = System.currentTimeMillis() + durationMs
+        while (System.currentTimeMillis() < deadline) {
+            targets.forEach { if (!write(it, command)) ok = false }
+            sleep(PULSE_MS)
+        }
+        targets.forEach { write(it, Command.STOP) }
+        return ok
+    }
+
+    /** The areas worth writing to, or null when the call is refused before any write. */
+    private fun gate(areas: List<Int>, command: Int): List<Int>? {
+        if (command !in 0..COMMAND_MAX) return null
+        val targets = areas.filter { it in AREAS }
+        if (targets.isEmpty()) return null
+        if (vsm() == null || setter == null) return null
+        // [T-904] Vehicle write: allowed only when stopped, refused if speed unreadable.
+        if (!VehicleWriteGate.allow("VSM setVehicleWindowStatus")) return null
+        return targets
+    }
+
+    private fun write(area: Int, command: Int): Boolean {
+        val vsm = EVHardware.vsmInstance() ?: return false
+        val set = setter ?: return false
+        return try {
+            set.invoke(vsm, area, command)
+            true
+        } catch (e: Exception) {
+            AppLogger.w(TAG, "  VSM: setVehicleWindowStatus($area, $command) exc: ${e.message}")
+            false
+        }
+    }
+
+    private const val TAG = "EV_GLASS"
+}

lib/src/main/java/com/evsuite/hardware/saic/SaicVehicle.kt

@@ -3,6 +3,8 @@ package com.evsuite.hardware.saic
 import android.content.Context
 import android.os.IBinder
 import com.evsuite.hardware.A9Climate
+import com.evsuite.hardware.GlassProbe
+import com.evsuite.hardware.VsmGlass
 
 /**
  * The vendor vehicle service the head unit's HVAC and charging screens talk to.
@@ -297,13 +299,12 @@ object SaicCharging {
  * same shape holds elsewhere in the service — the tailgate is `get = 100`, `set = 1` — so a
  * status range and a command range simply are not the same thing on this interface.
  *
- * **What the seven commands mean is not known.** No head-unit application writes this
- * property: the settings, HVAC, launcher, system UI and telematics APKs all carry the SDK
- * and none of them calls the setter, so the firmware offers no example to read the values
- * off. Until one is identified, the command is passed through as the caller gave it and
- * anything outside 0–7 is refused here rather than sent to be dropped — a refusal in the
- * history is the honest report, and the value that moves the glass is then one experiment
- * away rather than hidden behind a scale that cannot work.
+ * **The hub is the fallback, not the path.** No head-unit application writes this property,
+ * so the firmware offers no example to read the seven values off, and the command is passed
+ * through as the caller gave it with anything outside 0–7 refused here rather than sent to
+ * be dropped. The VSM carries the same glass under a setter the car's own window switch
+ * goes through, where the commands *are* established — [VsmGlass]. Every read and write
+ * below prefers it and falls back to the hub only on a firmware whose VSM does not have it.
  *
  * The electric tailgate is deliberately absent: the launcher defines OPEN and CLOSE as the
  * same value (1.0f), so it is a pulse whose direction depends on state this cannot read.
@@ -350,11 +351,16 @@ object SaicVehicleControl {
      * is the other half — a rule that vents the driver's window alone cannot be written with
      * an all-or-nothing call.
      */
-    enum class Window(internal val readCode: Int, internal val writeCode: Int) {
-        DRIVER(TX_GET_DRIVER_WINDOW, TX_SET_DRIVER_WINDOW),
-        PASSENGER(TX_GET_PASSENGER_WINDOW, TX_SET_PASSENGER_WINDOW),
-        REAR_LEFT(TX_GET_LEFT_REAR_WINDOW, TX_SET_LEFT_REAR_WINDOW),
-        REAR_RIGHT(TX_GET_RIGHT_REAR_WINDOW, TX_SET_RIGHT_REAR_WINDOW)
+    enum class Window(
+        internal val readCode: Int,
+        internal val writeCode: Int,
+        /** The same window's number on the VSM, which addresses glass by area — [VsmGlass]. */
+        internal val area: Int,
+    ) {
+        DRIVER(TX_GET_DRIVER_WINDOW, TX_SET_DRIVER_WINDOW, 0),
+        PASSENGER(TX_GET_PASSENGER_WINDOW, TX_SET_PASSENGER_WINDOW, 1),
+        REAR_LEFT(TX_GET_LEFT_REAR_WINDOW, TX_SET_LEFT_REAR_WINDOW, 2),
+        REAR_RIGHT(TX_GET_RIGHT_REAR_WINDOW, TX_SET_RIGHT_REAR_WINDOW, 3)
     }
 
     private val WINDOW_READS = Window.entries.map { it.readCode }
@@ -369,7 +375,8 @@ object SaicVehicleControl {
      * window open" is `> 0`, and a rule closing them cares about the worst case.
      */
     fun widestWindowPercent(): Int? =
-        WINDOW_READS.mapNotNull { code -> SaicAidl.callFloat(binder(), DESCRIPTOR, code) }
+        if (VsmGlass.isAvailable) Window.entries.mapNotNull { VsmGlass.percent(it.area) }.maxOrNull()
+        else WINDOW_READS.mapNotNull { code -> SaicAidl.callFloat(binder(), DESCRIPTOR, code) }
             .takeIf { it.isNotEmpty() }
             ?.max()
             ?.toInt()
@@ -379,18 +386,39 @@ object SaicVehicleControl {
      * One window's position in percent, 0 closed to 100 open. Null when it does not answer.
      */
     fun windowPercent(window: Window): Int? =
-        SaicAidl.callFloat(binder(), DESCRIPTOR, window.readCode)?.toInt()?.takeIf { it >= 0 }
+        if (VsmGlass.isAvailable) VsmGlass.percent(window.area)
+        else SaicAidl.callFloat(binder(), DESCRIPTOR, window.readCode)?.toInt()?.takeIf { it >= 0 }
 
     /**
      * Sends one glass command to one window.
      *
      * [command] is a command in `0..`[WINDOW_COMMAND_MAX], **not** a position — see the class
      * KDoc. A value outside that range is refused here and returns false: the service would
      * accept the call and drop the value, which is indistinguishable from having moved.
+     *
+     * [VsmGlass.Command.UP] is held down rather than written once, because that is the only
+     * way it moves anything — see [holdWindow]. The hub path has no such notion and cannot
+     * acquire one: it is one write there whatever the value.
      */
     fun setWindow(window: Window, command: Int): Boolean {
         if (command !in 0..WINDOW_COMMAND_MAX) return false
-        return SaicAidl.callVoid(binder(), DESCRIPTOR, window.writeCode, command.toFloat())
+        if (!VsmGlass.isAvailable)
+            return SaicAidl.callVoid(binder(), DESCRIPTOR, window.writeCode, command.toFloat())
+        return if (command == VsmGlass.Command.UP) VsmGlass.hold(listOf(window.area), command)
+        else VsmGlass.send(listOf(window.area), command)
+    }
+
+    /**
+     * Holds [command] on one window for [durationMs], then releases it.
+     *
+     * What [GlassProbe] sweeps with, and the reason a close works on the trims whose motors
+     * have no position sensor: those obey nothing but a switch held down. Falls back to a
+     * single write on the hub, which is all that path offers.
+     */
+    fun holdWindow(window: Window, command: Int, durationMs: Long = VsmGlass.HOLD_MS): Boolean {
+        if (command !in 0..WINDOW_COMMAND_MAX) return false
+        return if (VsmGlass.isAvailable) VsmGlass.hold(listOf(window.area), command, durationMs)
+        else SaicAidl.callVoid(binder(), DESCRIPTOR, window.writeCode, command.toFloat())
     }
 
     /** Each window individually, for the diagnostic — this is what confirms the scale. */
@@ -404,6 +432,11 @@ object SaicVehicleControl {
      */
     fun setAllWindows(command: Int): Boolean {
         if (command !in 0..WINDOW_COMMAND_MAX) return false
+        if (VsmGlass.isAvailable) {
+            val areas = Window.entries.map { it.area }
+            return if (command == VsmGlass.Command.UP) VsmGlass.hold(areas, command)
+            else VsmGlass.send(areas, command)
+        }
         val value = command.toFloat()
         // Every window attempted even if one refuses: three closed beats none closed, and
         // the caller still learns that it was not complete.