App 2.40.3: the signal recorder listens to the assistance properties

The ACC recording of 2.32.0 only polled, and the AAD_* properties read
their defaults. The head unit's own assistance manager never polls them:
it subscribes to each for change events, and a vendor HAL may fill a
value only while someone listens. EVHardware gains a read-only
listenToProperties and AssistBlock (global vendor properties 0x21x0A1xx,
all 108 AAD_* ids); the recorder subscribes to that block for its three
minutes and lists the properties heard, those with changing values first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6

SPECS.md

@@ -78,7 +78,9 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   (`AAD_EPTCCTRGTSPD` `0x2160A15B` 0.0, `AAD_ACC_OBJ_*` 0.0 / -128.0, modes 0). A signal recording
   of all 1,194 values while the set speed was 101, 90 and 80 km/h shows none of those numbers
   (also tried as m/s, mph and ×2/×10/×16/×64) outside the actual speed, and the ACC buttons send
-  no key broadcast. Most likely only the instrument cluster has it.
+  no key broadcast. Most likely only the instrument cluster has it. Not yet tried: listening
+  (subscribing) instead of polling, as the head unit's own manager does — the recorder does it
+  since 2.40.3; a drive with ACC will tell.
 
 ## To do
 
@@ -138,6 +140,20 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   confirmed car facts, app structure, UI conventions, build/test/ship, documents. It replaces
   upstream's EVABRPUploader text. The test emulator is now in the flake: `nix run .#car-emulator`
   (Android 9 AOSP at 1920×720, 160 dpi; the car build installs as the system user — checked).
+- 2026-10-27 — App 2.40.3: **the signal recorder listens** (owner: "is there really nothing we
+  can do about the readout of the cruise control set point"). The 2.32.0 recording only polled.
+  The head unit's `CarAdvancedAssistedDrivingManager` never polls its 108 `AAD_*` properties: it
+  registers a listener for each (`registerListener(…, 0.0f)`, on change), and a vendor HAL may
+  fill a value from the car network only while someone listens — which would read as the
+  defaults we saw. EVHardware gains `listenToProperties` (read only: the CarPropertyManager's
+  `registerCallback` per admitted property, rate 0 for ON_CHANGE, 1 Hz within limits for
+  CONTINUOUS, one proxy, `unregisterCallback` on close) and `AssistBlock` (global vendor
+  properties `0x21x0A1xx`, which holds all 108 `AAD_*` ids; tested). The recorder subscribes to
+  that block for its 3 minutes; `SignalRecording.event` counts every event and puts value changes
+  on the timeline; the file and the Logs tab list the properties heard, those with changing
+  values first ("heard …"). Emulator (no car service): the recorder notes that listening is not
+  possible, records, saves the new section; no crash. The subscription itself is the same
+  reflection as the ignition listener that works on the car, but untried on the car.
 - 2026-10-27 — App 2.40.2: **the map moves on the GPU** (owner: "is the map screen gpu
   accelerated? it looks a bit slow on update"). It was hardware-rendered, but every frame (20 a
   second) recomputed every road point on the main thread, rebuilt all paths, and drew the big