feat(nav): ask transactions 38 and 39 what they actually reply

CP-051 has a transaction number and no answer. CP-040 found 38 and 39
declared on `IMapService` while surveying the navigation adapter and never
called them, and the reason to call them now is worth stating plainly: the
destination a driver has already entered in the car's own navigation costs
no keyboard on a head unit, no geocoding request, no second quota, and no
request carrying text the driver typed off the vehicle.

`probeTransaction` records the reply and does not interpret it. Reading the
bytes as a typed value would be guessing the shape, and the failure mode of
guessing wrong is not obvious: a latitude read as a longitude routes to the
wrong continent and looks like an ordinary number while doing it. So the
probe answers with the payload's length and its first 128 bytes in hex, and
a session at a desk decides what they mean. "Unbound", "no answer" and
"unmarshallable" are answers too, and each is returned as plainly as a
payload is — a probe that cannot distinguish silence from failure teaches
nothing.

Read-only, like every vehicle access in this library. The reply may contain
the destination that is set in the car's navigation, which is the point of
the probe and the reason the caller's artifact says so: that file leaves the
car on a USB stick.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: malys

CHANGELOG.md

@@ -8,6 +8,16 @@ All notable changes to this project are documented here. Format follows
 
 ### Added
 
+- **`SaicNav.probeTransaction` — what a navigation transaction replies, recorded rather than
+  interpreted.** CP-040 saw transactions 38 and 39 declared on `IMapService` and never called
+  them; CP-051 wants to know whether they carry the destination the driver has already entered
+  in the car's own navigation, because that destination costs no keyboard and no geocoding
+  request. The probe returns the reply's bytes and its length, and refuses to read them as a
+  typed value: a latitude read as a longitude routes to the wrong continent while looking like
+  an ordinary number. Read-only, capped at 128 bytes, and it answers "unbound" or "no answer"
+  as plainly as it answers with a payload. Called only by the unstable channel's validation
+  probe (CP-055).
+
 - **A consumption model for a car that publishes no battery power — which is this car.**
   `CarPropertyEvidence` has recorded since 2026-09-04 that SWI68 never publishes battery power:
   three diagnostic bundles, 51 samples, zero readings. The consequence was that the kWh model

lib/src/main/java/com/evsuite/hardware/saic/SaicNav.kt

@@ -46,4 +46,44 @@ object SaicNav {
      */
     fun totalMileageKm(): Int? =
         SaicAidl.callInt(binder(), DESCRIPTOR, TX_GET_TOTAL_MILEAGE)?.takeIf { it > 0 }
+
+    /**
+     * The two transactions CP-040 saw declared on this interface and never called.
+     *
+     * They are the candidates for "where is the driver already going", which would remove the
+     * typed address, the keyboard and a geocoding request from the charge-stop screen.
+     */
+    val DESTINATION_TRANSACTIONS = listOf(38, 39)
+
+    /**
+     * What a transaction actually replies, recorded rather than interpreted.
+     *
+     * CP-051 exists because the transaction numbers are known and the answer is not. Reading
+     * the reply as a typed value would be guessing the shape; a latitude read as a longitude
+     * routes to the wrong continent and looks like an ordinary number while doing it. So this
+     * returns the bytes, and a session at a desk decides what they mean.
+     *
+     * **The reply may contain the destination that is set in the car's navigation.** That is
+     * the point of the probe, and it is why the artifact carrying this says so — the file
+     * leaves the car on a USB stick.
+     *
+     * @return one line, always: unbound, unanswered, or the payload in hex.
+     */
+    fun probeTransaction(code: Int, maxBytes: Int = MAX_PROBE_BYTES): String {
+        val target = binder() ?: return "tx=$code unbound"
+        return SaicAidl.callParcel(target, DESCRIPTOR, code) { reply ->
+            val start = reply.dataPosition()
+            val available = reply.dataAvail()
+            val hex = runCatching {
+                reply.marshall()
+                    .drop(start)
+                    .take(maxBytes)
+                    .joinToString("") { byte -> "%02x".format(byte.toInt() and 0xff) }
+            }.getOrElse { "unmarshallable(${it.javaClass.simpleName})" }
+            "tx=$code answered bytes=$available hex=$hex"
+        } ?: "tx=$code no answer"
+    }
+
+    /** Enough for a coordinate pair, a name and their headers; not enough to be a log dump. */
+    private const val MAX_PROBE_BYTES = 128
 }