@@ -11,9 +11,19 @@ All notable changes to this project are documented here. Format follows
 - Probe-only vendor charge readings for the telemetry evidence: `BMS_CHRG_STS`, the AC and DC
   plug states and the kWh-since-plug-in counter, ids from MG4Control's SWI133 readings and
   unproven on SWI68. Recorded as `candidate.vendor*`; nothing reads them as values yet.
+- `RuntimeInterfaceProbe.componentMap()`, part of `survey()`: every service the
+  `com.saicmotor.*` packages declare, with its exported flag and permission, from
+  PackageManager metadata only. Nothing is bound or called; capped at 64 packages and
+  40 services per package, with the cut recorded.
+- `windows.widestPercent` in the telemetry evidence, from `EnergySnapshot.widestWindowPercent`.
+- `SocConsumptionFitter.describe()` ends with the solve's outcome once both gates pass:
+  `fit=ready rmse=…` or `fit=refused(<guard>)`. The existing prefix is unchanged.
 
 ### Fixed
 
+- **`SaicCharging.chargeLimitPercent()` answers null outside 40–100 %.** SWI68 answered `5`,
+  a code rather than a percent; callers now take their "limit unreadable" path. The setter
+  is unchanged.
 - **The battery ledger ignores readings taken on the factory clock.** A head unit woken by a
   night charge runs on its late-2018 clock until it syncs; one such entry sorted first in the
   ledger and split the charge. `BatteryLedgerRecorder` now drops samples before 2025-01-01.
 
@@ -1,6 +1,7 @@
 package com.evsuite.hardware.probe
 
 import android.content.Context
+import android.content.pm.PackageManager
 import android.os.IBinder
 import com.evsuite.hardware.EVHardware
 import com.evsuite.hardware.FirmwareInfo
@@ -61,6 +62,7 @@ object RuntimeInterfaceProbe {
      * it from a capture that has been up for a while.
      */
     fun connect(context: Context) {
+        packages = context.applicationContext.packageManager
         SaicHub.connect(context)
         engMode.connect(context)
     }
@@ -276,6 +278,80 @@ object RuntimeInterfaceProbe {
         add(vehicleProperty())
         add(vehicleCharging())
         add(carDiagnostics())
+        addAll(componentMap())
+    }
+
+    /** Kept from [connect], so [componentMap] needs no extra argument from the callers. */
+    @Volatile private var packages: PackageManager? = null
+
+    /**
+     * Every service the vendor packages declare in their manifests, as PackageManager lists it.
+     *
+     * The hub maps above can only name what someone already guessed to ask for. This is the
+     * other direction: what is installed, which services each package declares, and whether an
+     * unprivileged caller may reach them — RI-001, RI-003, RI-004, RI-007 and RI-008 each start
+     * by not knowing which component publishes their signal.
+     *
+     * Manifest metadata only. Nothing is bound, no transaction is sent and no vendor class is
+     * loaded, so this cannot reach a write on any interface. Visibility of other packages holds
+     * because the target is API 28; a later target needs `QUERY_ALL_PACKAGES`, and without it
+     * this would read as a head unit with no vendor packages at all.
+     */
+    fun componentMap(): List<InterfaceProbe> {
+        val pm = packages ?: return listOf(
+            InterfaceProbe(COMPONENT_MAP, null, BindVerdict.ABSENT, note = NOT_CONNECTED),
+        )
+        val names = try {
+            pm.getInstalledPackages(0).map { it.packageName }
+                .filter { name -> COMPONENT_PREFIXES.any { name.startsWith(it) } }.sorted()
+        } catch (e: RuntimeException) {
+            return listOf(
+                InterfaceProbe(COMPONENT_MAP, null, BindVerdict.DENIED, note = e.javaClass.name),
+            )
+        }
+        return listOf(componentSummary(names)) + names.take(MAX_COMPONENT_PACKAGES).map { name ->
+            val services = try {
+                pm.getPackageInfo(name, PackageManager.GET_SERVICES).services.orEmpty()
+                    .map { ServiceRow(it.name, it.exported, it.permission) }
+            } catch (e: PackageManager.NameNotFoundException) {
+                return@map InterfaceProbe("$COMPONENT_MAP:$name", null, BindVerdict.ABSENT)
+            } catch (e: RuntimeException) {
+                return@map InterfaceProbe(
+                    "$COMPONENT_MAP:$name", null, BindVerdict.DENIED, note = e.javaClass.name,
+                )
+            }
+            componentEntry(name, services)
+        }
+    }
+
+    /** One declared service, as the manifest states it. */
+    internal data class ServiceRow(val name: String, val exported: Boolean, val permission: String?)
+
+    /** How many vendor packages there are, and how many of them the entries below list. */
+    internal fun componentSummary(names: List<String>): InterfaceProbe = InterfaceProbe(
+        COMPONENT_MAP, null, BindVerdict.ANSWERED,
+        mapOf(
+            "packages" to names.size.toString(),
+            "listed" to minOf(names.size, MAX_COMPONENT_PACKAGES).toString(),
+        ),
+        COMPONENT_NOTE,
+    )
+
+    /**
+     * One package's services, keyed by class name, the value kept as the manifest's own words.
+     *
+     * A package that declares none is still ANSWERED: the manifest was read and said so.
+     */
+    internal fun componentEntry(pkg: String, services: List<ServiceRow>): InterfaceProbe {
+        val values = LinkedHashMap<String, String?>()
+        values["services"] = services.size.toString()
+        services.take(MAX_COMPONENT_SERVICES).forEach {
+            values[it.name] = "exported=${it.exported} permission=${it.permission}"
+        }
+        if (services.size > MAX_COMPONENT_SERVICES) {
+            values["truncated"] = (services.size - MAX_COMPONENT_SERVICES).toString()
+        }
+        return InterfaceProbe("$COMPONENT_MAP:$pkg", null, BindVerdict.ANSWERED, values)
     }
 
     /**
@@ -365,6 +441,18 @@ object RuntimeInterfaceProbe {
      */
     private val CODE_SWEEP = (0x0..0x12).toList()
 
+    private const val COMPONENT_MAP = "componentMap"
+    private val COMPONENT_PREFIXES = listOf("com.saicmotor.", "com.saicvehicleservice.")
+
+    /** A bundle is pasted and read; a few hundred lines of manifest is the useful end of it. */
+    internal const val MAX_COMPONENT_PACKAGES = 64
+    internal const val MAX_COMPONENT_SERVICES = 40
+
+    private const val NOT_CONNECTED = "connect() was not called, so there is no PackageManager"
+    private const val COMPONENT_NOTE =
+        "PackageManager GET_SERVICES only: nothing bound, called or loaded. exported=false or " +
+            "a permission we do not hold means unreachable from EVSuite, not absent."
+
     /**
      * What ABSENT means when there is no adapter client to ask. Carried on every swept entry
      * rather than stated once at the top of the bundle: a later session reads one entry, not the
 
@@ -91,4 +91,25 @@ class RuntimeInterfaceProbeTest {
         val calls = RuntimeInterfaceProbe.CONFIG_CALLS
         assertEquals(calls.size, calls.values.map { it.code }.toSet().size)
     }
+
+    @Test
+    fun `the component map keeps the manifest's words and says when it stopped listing`() {
+        val rows = (0 until RuntimeInterfaceProbe.MAX_COMPONENT_SERVICES + 3).map {
+            RuntimeInterfaceProbe.ServiceRow("com.saicmotor.x.Service$it", it == 0, null)
+        }
+        val entry = RuntimeInterfaceProbe.componentEntry("com.saicmotor.x", rows)
+        assertEquals("componentMap:com.saicmotor.x", entry.name)
+        assertEquals(BindVerdict.ANSWERED, entry.verdict)
+        assertEquals((rows.size).toString(), entry.values["services"])
+        assertEquals("exported=true permission=null", entry.values["com.saicmotor.x.Service0"])
+        assertEquals("3", entry.values["truncated"])
+        assertEquals(RuntimeInterfaceProbe.MAX_COMPONENT_SERVICES + 2, entry.values.size)
+    }
+
+    @Test
+    fun `a package that declares no service was still read`() {
+        val entry = RuntimeInterfaceProbe.componentEntry("com.saicmotor.y", emptyList())
+        assertEquals(BindVerdict.ANSWERED, entry.verdict)
+        assertEquals(mapOf("services" to "0"), entry.values)
+    }
 }