fix(telemetry): stop the estimate flickering, and stop the history eating itself

Five defects in the paths that feed EVChargePilot's range figure and its
trip store.

The adaptive range gated on the live battery power reading. The question
that gate asks is whether this firmware can measure power at all, and the
answer does not change between two polls — but one unanswered sample
erased a figure computed from stored trips and the pack's charge, neither
of which had moved. Latched instead: never published means refuse, once
published stays published.

Trips that happened to agree gave a band of exactly zero. "266,7 ± 0,0
km" reads as a measurement, which is the one thing provenance exists to
stop an estimate doing; the spread of eight of one driver's trips is not
the error of extrapolating to a pack. The band gets a floor.

Quarantining a corrupt history copied it aside and left the original, so
every later read failed on it again and wrote another copy — one file per
read, unbounded, where the driver cannot see them. The original now goes.

Bounding the file re-encoded every remaining trip after each evicted
track, up to two hundred trips of four thousand samples, on the path that
ends a drive. The envelope's size is arithmetic, so eviction subtracts as
it goes.

Decimation dropped the newest sample. The track halves when the sample
just added overflows it, and on an even-sized track that sample sits at an
odd index — so every doubling discarded the most recent moment of the
trip, which is the one a model can least do without.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: malys

CHANGELOG.md

@@ -6,6 +6,39 @@ All notable changes to this project are documented here. Format follows
 
 ## [Unreleased]
 
+### Fixed
+
+- **A momentarily unreadable battery power no longer blanks a settled range estimate.**
+  `AdaptiveRangeEstimator` gated on the live power reading, so one sample the firmware failed to
+  answer erased a figure computed from stored trips and the pack's charge — neither of which had
+  moved. The question the gate asks is "can this firmware measure power at all", and that answer
+  does not change between two polls, so it is latched: a firmware that has never published power
+  still refuses to borrow another firmware's history, and one that published it a second ago is
+  not treated as having lost the ability since.
+
+- **An estimate no longer claims a band of exactly zero.** Eight of one driver's trips that
+  happened to agree produced "266,7 ± 0,0 km", which reads as a measurement — the one thing
+  provenance exists to stop an estimate doing. The spread of a handful of trips is not the error
+  of extrapolating to a whole pack: terrain, load, weather and speed all sit outside the fit. The
+  band now has a floor of ten percent of the estimate.
+
+- **A corrupt trip history no longer multiplies itself.** `EnergyTripHistoryStore.quarantine`
+  copied the unreadable file aside and left the original in place, so the next read failed to
+  parse it again and wrote another copy — one file per read, unbounded, in storage the driver
+  cannot see. The original now goes, by rename or by copy-then-delete, and a copy that itself
+  fails is removed rather than left behind.
+
+- **Ending a drive no longer re-encodes the whole history once per evicted track.** Bounding the
+  file measured every remaining trip again after each step, over as many as two hundred trips of
+  four thousand samples, on the path that closes a trip. The envelope's size is arithmetic —
+  empty envelope, plus each trip, plus one comma between each pair — so eviction now subtracts as
+  it goes and each trip is serialised once.
+
+- **Decimating a track no longer throws away the newest sample.** `TripSampleTrack` halves itself
+  when the sample just added overflows it, and on an even-sized track that sample sits at an odd
+  index: taking every second one from the start discarded the most recent moment of the trip at
+  every doubling. It is now kept explicitly.
+
 ### Added
 
 - **`SaicNav.probeTransaction` — what a navigation transaction replies, recorded rather than

lib/src/main/java/com/evsuite/hardware/telemetry/AdaptiveRangeEstimator.kt

@@ -1,5 +1,6 @@
 package com.evsuite.hardware.telemetry
 
+import kotlin.math.max
 import kotlin.math.sqrt
 
 /**
@@ -13,6 +14,16 @@ class AdaptiveRangeEstimator(
     private val maxConsumptionSamples: Int = MAX_CONSUMPTION_SAMPLES,
     private val minimumConsumptionSamples: Int = MINIMUM_CONSUMPTION_SAMPLES,
 ) {
+    /**
+     * Whether this vehicle has ever published battery power to this instance.
+     *
+     * The capability question is "can this firmware measure power at all", and the answer does
+     * not change between two polls. Asking the live reading instead made a single unreadable
+     * sample blank an estimate computed from stored trips and the pack's charge — neither of
+     * which had moved — so the figure flickered for a reason that had nothing to do with it.
+     */
+    private var powerEverPublished = false
+
     init {
         require(minimumConsumptionSamples >= 2) { "at least two samples are needed for spread" }
         require(maxConsumptionSamples >= minimumConsumptionSamples) {
@@ -23,18 +34,18 @@ class AdaptiveRangeEstimator(
     /**
      * Estimates remaining range without replacing [EnergySnapshot.rangeKm].
      *
-     * A current power reading is the capability gate. A firmware that cannot publish battery
-     * power must never reuse another firmware's stored history to claim an adaptive range.
+     * Battery power is the capability gate, latched rather than sampled: a firmware that has
+     * never published it must not reuse another firmware's stored history to claim an adaptive
+     * range, but one that published it a second ago has not lost the ability since.
      */
     fun estimate(
         snapshot: EnergySnapshot,
         currentTrip: EnergyTripSummary?,
         recentTrips: List<EnergyTripSummary>,
         missingReason: UnavailableReason = UnavailableReason.SIGNAL_ABSENT,
     ): Provenanced<Double> {
-        if (snapshot.batteryPowerKw?.isFinite() != true) {
-            return Provenanced.unavailable(missingReason)
-        }
+        if (snapshot.batteryPowerKw?.isFinite() == true) powerEverPublished = true
+        if (!powerEverPublished) return Provenanced.unavailable(missingReason)
 
         val samples = consumptionSamples(currentTrip, recentTrips)
         if (samples.size < minimumConsumptionSamples) {
@@ -55,8 +66,13 @@ class AdaptiveRangeEstimator(
             delta * delta
         } / (samples.size - 1).toDouble()
         val consumptionSpread = sqrt(variance)
-        val rangeUncertaintyKm = estimatedKm * consumptionSpread / meanConsumption
-        if (!rangeUncertaintyKm.isFinite()) return Provenanced.unavailable(missingReason)
+        val observedBandKm = estimatedKm * consumptionSpread / meanConsumption
+        if (!observedBandKm.isFinite()) return Provenanced.unavailable(missingReason)
+        // A floor, because the spread of at most eight of one driver's trips is not the model's
+        // error. Trips that happened to agree produce a band of exactly zero, and "266.7 ± 0.0
+        // km" reads as a measurement — the one thing Provenance exists to stop an estimate
+        // doing. The floor is what the model cannot claim to know better than.
+        val rangeUncertaintyKm = max(observedBandKm, estimatedKm * MIN_RELATIVE_UNCERTAINTY)
         return Provenanced.estimated(estimatedKm, rangeUncertaintyKm)
     }
 
@@ -95,5 +111,14 @@ class AdaptiveRangeEstimator(
 
         /** Three observations permit a centre and a non-degenerate observed spread. */
         const val MINIMUM_CONSUMPTION_SAMPLES = 3
+
+        /**
+         * The narrowest band this model is allowed to claim, as a fraction of the estimate.
+         *
+         * Eight trips of one driver do not measure the error of extrapolating to a whole pack:
+         * terrain, load, weather and speed all sit outside the fit. Ten percent is the width
+         * below which the figure would invite more trust than the method can carry.
+         */
+        const val MIN_RELATIVE_UNCERTAINTY = 0.10
     }
 }

lib/src/main/java/com/evsuite/hardware/telemetry/EnergyTripHistoryStore.kt

@@ -105,31 +105,62 @@ class EnergyTripHistoryStore(
         val trips: List<StoredTrip>? = null,
     )
 
-    /** The unreadable file keeps its contents under a new name; the history starts again. */
+    /**
+     * The unreadable file keeps its contents under a new name; the history starts again.
+     *
+     * The original has to go, by rename or by copy-then-delete. Leaving it in place made every
+     * later read fail to parse it again and write another quarantine copy — one file per read,
+     * without a bound, in storage the driver cannot see. When even the copy fails the partial
+     * is removed rather than left behind: nothing was preserved, so nothing should accumulate.
+     */
     private fun quarantine() {
         val kept = File(target.parentFile, "${target.name}.quarantine.${System.currentTimeMillis()}")
-        if (!target.renameTo(kept)) {
-            runCatching { target.copyTo(kept, overwrite = true) }
-        }
+        if (target.renameTo(kept)) return
+        if (runCatching { target.copyTo(kept, overwrite = true) }.isSuccess) target.delete()
+        else kept.delete()
     }
 
+    /**
+     * Applies the three bounds, costing one serialisation per trip rather than one per step.
+     *
+     * The envelope is `{...,"trips":[t1,t2,...]}`, so its size is the empty envelope plus every
+     * trip's own JSON plus one comma between each pair. Keeping that arithmetic lets eviction
+     * subtract as it goes. Measuring the whole file again after every dropped track re-encoded
+     * a graph of up to two hundred trips and four thousand samples each, once per step, on the
+     * path that ends a drive.
+     */
     private fun bound(trips: List<StoredTrip>): List<StoredTrip> {
-        var candidate = trips.take(maxTrips.coerceAtLeast(1))
+        val candidate = trips.take(maxTrips.coerceAtLeast(1)).toMutableList()
+        val sizes = candidate.mapTo(ArrayList()) { sizeOf(it) }
+        var total = totalOf(sizes)
+
         // Tracks first: a trip without its track is still a trip, a missing trip is not.
-        while (sizeOf(candidate) > maxBytes && candidate.any { it.samples != null }) {
+        while (total > maxBytes) {
             val oldest = candidate.indexOfLast { it.samples != null }
-            candidate = candidate.toMutableList().also {
-                it[oldest] = it[oldest].copy(samples = null)
-            }
+            if (oldest < 0) break
+            val stripped = candidate[oldest].copy(samples = null)
+            candidate[oldest] = stripped
+            sizes[oldest] = sizeOf(stripped)
+            total = totalOf(sizes)
         }
-        while (sizeOf(candidate) > maxBytes && candidate.size > 1) {
-            candidate = candidate.dropLast(1)
+        while (total > maxBytes && candidate.size > 1) {
+            candidate.removeAt(candidate.lastIndex)
+            sizes.removeAt(sizes.lastIndex)
+            total = totalOf(sizes)
         }
         return candidate
     }
 
-    private fun sizeOf(trips: List<StoredTrip>): Int =
-        gson.toJson(TripHistoryFile(trips = trips)).toByteArray(Charsets.UTF_8).size
+    /** Empty envelope, plus every trip, plus the comma between each pair. */
+    private fun totalOf(sizes: List<Int>): Int =
+        emptyEnvelopeBytes + sizes.sum() + (sizes.size - 1).coerceAtLeast(0)
+
+    private val emptyEnvelopeBytes: Int by lazy {
+        gson.toJson(TripHistoryFile(trips = emptyList())).toByteArray(Charsets.UTF_8).size
+    }
+
+    private fun sizeOf(trip: StoredTrip): Int =
+        gson.toJson(trip).toByteArray(Charsets.UTF_8).size
 
     private fun write(file: TripHistoryFile): Boolean {
         val bytes = gson.toJson(file).toByteArray(Charsets.UTF_8)

lib/src/main/java/com/evsuite/hardware/telemetry/TripSample.kt

@@ -71,12 +71,21 @@ class TripSampleTrack(
 
     fun samples(): List<TripSample> = samples.toList()
 
-    /** Halves the track in place and doubles the interval, keeping first and last. */
+    /**
+     * Halves the track in place and doubles the interval, keeping first and last.
+     *
+     * The last sample is kept explicitly rather than by parity. Decimation is triggered by the
+     * sample that has just been added, and on an even-sized track that sample sits at an odd
+     * index — taking every second one from the start would throw away the newest moment of the
+     * trip at every doubling, which is the one a model is least able to do without.
+     */
     private fun decimate() {
+        val newest = samples.lastIndex
         var write = 0
         for (read in samples.indices) {
-            if (read % 2 == 0) samples[write++] = samples[read]
+            if (read % 2 == 0 && read != newest) samples[write++] = samples[read]
         }
+        samples[write++] = samples[newest]
         while (samples.size > write) samples.removeAt(samples.size - 1)
         intervalMs *= 2
     }

lib/src/test/java/com/evsuite/hardware/telemetry/AdaptiveRangeEstimatorTest.kt

@@ -26,7 +26,36 @@ class AdaptiveRangeEstimatorTest {
 
         assertEquals(Provenance.ESTIMATED, estimate.provenance)
         assertEquals(200.0, estimate.value!!, 1e-9)
-        assertEquals(0.0, estimate.uncertainty!!, 1e-9)
+        // Trips that happened to agree do not make the model certain: the band falls back to
+        // its floor rather than to zero, which would read as a measurement.
+        assertEquals(20.0, estimate.uncertainty!!, 1e-9)
+    }
+
+    @Test fun `an estimate never claims a band narrower than the model's floor`() {
+        val estimate = estimator.estimate(
+            snapshot(energyKwh = 40f), null,
+            listOf(trip(20.0, 3L), trip(20.0, 2L), trip(20.0, 1L)),
+        )
+
+        assertEquals(
+            estimate.value!! * AdaptiveRangeEstimator.MIN_RELATIVE_UNCERTAINTY,
+            estimate.uncertainty!!,
+            1e-9,
+        )
+        assertTrue(estimate.uncertainty!! > 0.0)
+    }
+
+    @Test fun `a momentarily unreadable power signal does not blank a settled estimate`() {
+        val history = listOf(trip(20.0, 3L), trip(20.0, 2L), trip(20.0, 1L))
+        val withPower = snapshot(energyKwh = 40f)
+        val withoutPower = withPower.copy(batteryPowerKw = null)
+
+        assertEquals(Provenance.ESTIMATED, estimator.estimate(withPower, null, history).provenance)
+        // The capability was established a sample ago and the car has not lost it since; the
+        // estimate depends on stored trips and pack charge, neither of which moved.
+        val next = estimator.estimate(withoutPower, null, history)
+        assertEquals(Provenance.ESTIMATED, next.provenance)
+        assertEquals(200.0, next.value!!, 1e-9)
     }
 
     @Test fun `volatile consumption widens the band without moving the estimate`() {
@@ -74,7 +103,7 @@ class AdaptiveRangeEstimatorTest {
         )
 
         assertEquals(200.0, estimate.value!!, 1e-9)
-        assertEquals(0.0, estimate.uncertainty!!, 1e-9)
+        assertEquals(20.0, estimate.uncertainty!!, 1e-9)
     }
 
     private fun trip(consumption: Double, endedAtMs: Long): EnergyTripSummary {