App 2.41.0, server 2.9.0: recordings reach the server

A finished signal recording goes to an outbox and is sent gzipped with the car's token (PUT /v1/logs/{name}); the service retries every 2 minutes while the car is offline. The server keeps the newest 200 on a new volume (LOGS_DIR); reading takes a token of its own (LOGS_TOKEN). fetch-logs in the dev shell fetches new ones into logs/. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6
SPECS: app 2.40.4 published
2026-10-27 10:22:40 +01:00 · 2026-10-27 09:23:20 +01:00 · 2026-10-27 09:19:33 +01:00 · 2026-10-27 00:56:39 +01:00 · 2026-10-27 00:55:26 +01:00 · 2026-10-27 00:32:50 +01:00
37 changed files with 1765 additions and 180 deletions
@@ -41,3 +41,7 @@ mise.local.toml
 # CarPlay diagnostic exports: vendor software, never committed
 /dump/
 # The car's own recordings (fetch-logs, or copied off a USB stick): its data, not the code's.
 /logs/
 /signal-recording-*.txt
@@ -21,7 +21,8 @@ MG4 head unit (Android 9, AAOS, MT2712)
 - **server/** — Go 1.27 API at `https://car.k8s.stinnesbeck.com`: stores telemetry, consumption
  and charging in InfluxDB, pairs cars by QR code, carries settings typed on a phone, relays
  app releases from the private forge, and serves the roads for the Grid's map from
-  OpenStreetMap vector tiles (OpenFreeMap), fetched per tile on demand and cached on a volume. It does **not** talk to ABRP. See `server/README.md`.
+  OpenStreetMap vector tiles (OpenFreeMap), fetched per tile on demand and cached on a volume, and keeps the signal recordings the car sends
  (read with their own token, `fetch-logs`). It does **not** talk to ABRP. See `server/README.md`.
 - **k8s/** — plain Kubernetes manifests (InfluxDB, server, Grafana with three provisioned
  dashboards, Traefik routes). See `k8s/README.md`.
 - **EVHardware/** — vendored shared vehicle layer (PolyForm Noncommercial, see `LICENSE.md`).
@@ -76,12 +77,12 @@ Repository: `ssh://git@git.stinnesbeck.com:2222/nils/mg4.git` (remote `origin`),
 | Tab | Contents |
 |---|---|
-| Overview | value tiles (battery, range, range/usage/energy since start, 5-min averages of range, usage, power, speed), vehicle info (odometer, lease allowance and the odometer against it), tyre pressures; read every 0.2 s on a background thread. Styles (Settings → Overview style): Tiles, Gauges (`GaugeView` needles), Cockpit (`RingView` rings, `TraceView` power trace), Retro (`RetroView`, seven-segment VFD), Futuristic (`FlowView`, animated energy flow), Sci-fi (`SciFiView`, starship console), Cartoon (`CartoonView`), MG (`OctagonView`, octagonal dials after the classic MG dashboards), and on `ClusterCanvasView`: Minimal, Terminal, Nixie tubes, Chronograph, Grid (`GridView`, neon lines over a moving grid floor, power as a light-cycle trail from `ClusterValues.powerTrail`), Grid with map (the same `GridView` over the roads round the car: GPS while it is shown, tiles from the server's `/v1/map/roads` through `MapRoads`, cached in `files/map`; `RoadTile`, `MapGeometry`), Time circuits (`TimeCircuitsView`, the time machine's LED rows with `Segments14` letters and a flux capacitor), Quest (`QuestView`, a fantasy game interface), Visor (`VisorView`, a helmet display with a motion tracker of the power trail), Empire (`EmpireView`, a strategy game with an isometric world and ages by odometer, `EmpireAge`); the drawn styles share `ClusterValues`. A style shown in its own palette (Sci-fi, Cartoon, Nixie, Time circuits, Quest, Empire; Retro, Terminal, Grid and Visor with "Original") gives the whole app its colours (`StylePalette`, `res/values/style_palettes.xml`) instead of the accent colour. A button in the navigation's header hides the navigation for a full-width Overview (`PREF_OVERVIEW_FULLSCREEN`); a swipe in from the left edge (`EdgeSwipe`) brings it back; without the app's own full screen the car's sidebar takes that edge, so a tab at the left edge (`edge_tab`) is tapped or swiped instead. Pages change only by the navigation (the pager's own swiping is off) |
+| Overview | value tiles (battery, range, range/usage/energy since start, 5-min averages of range, usage, power, speed), vehicle info (odometer, lease allowance and the odometer against it), tyre pressures; read every 0.2 s on a background thread. Styles (Settings → Overview style): Tiles, Gauges (`GaugeView` needles), Cockpit (`RingView` rings, `TraceView` power trace), Retro (`RetroView`, seven-segment VFD), Futuristic (`FlowView`, animated energy flow), Sci-fi (`SciFiView`, starship console), Cartoon (`CartoonView`), MG (`OctagonView`, octagonal dials after the classic MG dashboards), and on `ClusterCanvasView`: Minimal, Terminal, Nixie tubes, Chronograph, Grid (`GridView`, neon lines over a moving grid floor, power as a light-cycle trail from `ClusterValues.powerTrail`), Grid with map (the same `GridView` over the roads round the car, top-down: GPS while it is shown, tiles from the server's `/v1/map/roads` through `MapRoads`, cached in `files/map`; `RoadTile`, `MapGeometry`; the map is `MapLayerView`, a hardware layer drawn once and moved and turned by the GPU every display frame), Time circuits (`TimeCircuitsView`, the time machine's LED rows with `Segments14` letters and a flux capacitor), Quest (`QuestView`, a fantasy game interface), Visor (`VisorView`, a helmet display with a motion tracker of the power trail), Empire (`EmpireView`, a strategy game with an isometric world and ages by odometer, `EmpireAge`); the drawn styles share `ClusterValues`. A style shown in its own palette (Sci-fi, Cartoon, Nixie, Time circuits, Quest, Empire; Retro, Terminal, Grid and Visor with "Original") gives the whole app its colours (`StylePalette`, `res/values/style_palettes.xml`) instead of the accent colour. A button in the navigation's header hides the navigation for a full-width Overview (`PREF_OVERVIEW_FULLSCREEN`); a swipe in from the left edge (`EdgeSwipe`) brings it back; without the app's own full screen the car's sidebar takes that edge, so a tab at the left edge (`edge_tab`) is tapped or swiped instead. Pages change only by the navigation (the pager's own swiping is off) |
 | Consumption / Charging | period totals, daily log, charging sessions and curve |
 | Live data | on/off, ABRP API key and user token, upload frequency |
 | Server | URL, pairing by QR, ingest token, installation ID (read-only), config import |
 | Settings | drive mode (Eco, Normal, Sport, Snow, Custom; the lit one is what the car reports; changes only in P at a standstill, `DriveModeWrite`; "Set at start" sets the last confirmed choice again when the service starts with the head unit), full screen, voice key, Overview style with the accent colour beside it (offered only for styles drawn in it, `OverviewStyle.usesAccent`; Retro, Terminal, Grid (and Grid with map, sharing Grid's choice) and Visor add "Original" for their own palette, `hasOriginal`), tyre unit, battery and charging price (one card on wide screens), version, update check, install from USB, About |
-| Logs | signal recorder (`SignalRecorder`/`SignalRecording`: every property and vendor getter via `VendorSurfaceProbe.capture`, again and again for 3 minutes, plus steering-wheel key broadcasts; lists what changed, rarest first; saved to the app and a USB stick; how to find where the car publishes something), update log (every install step, with the platform's words), upload log |
+| Logs | signal recorder (`SignalRecorder`/`SignalRecording`: every property and vendor getter via `VendorSurfaceProbe.capture`, again and again for 3 minutes, plus change events of the driver-assistance block it subscribes to, `EVHardware.listenToProperties` with `AssistBlock`, and steering-wheel key broadcasts; lists what changed, rarest first; saved to the app, a USB stick and the server, through `LogOutbox`, which sends it again later when the car is offline; how to find where the car publishes something), update log (every install step, with the platform's words), upload log |
 Key classes (`app/src/main/java/com/evsuite/abrp/`): `AbrpUploadService` (foreground service,
 15 s tick), `TelemetryUploader` (+ `TelemetryQueue`, persisted), `TelemetryPayload` (server
@@ -110,6 +111,7 @@ nix develop                                   # JDK 21, Android SDK, Go
 ./gradlew testStableDebugUnitTest testUnstableDebugUnitTest lintStableDebug
 build-car                                     # build/car/NilsMG4-unstable-<version>.apk + .sha256
 publish-car                                   # pre-release car-<version> on the forge (needs a token)
 fetch-logs                                    # the car's recordings from the server into logs/ (needs LOGS_TOKEN)
 cd server && go vet ./... && go test ./... && govulncheck ./...
 ```
@@ -0,0 +1,24 @@
 package com.evsuite.hardware
 /**
 * The block of vendor properties the head unit's driver-assistance manager
 * (`CarAdvancedAssistedDrivingManager`, its `AAD_*` ids) lives in: global vendor properties
 * `0x21x0A1xx`, of any value type — `0x2140A101` (int) to `0x2160A15B` (float, `AAD_EPTCCTRGTSPD`,
 * by its name the cruise control's target speed) and the rest of the same block. Used to choose
 * what the signal recorder listens to; nothing here is ever written. Pure, unit-tested.
 */
 object AssistBlock {
    private const val GROUP_MASK = 0xF0000000.toInt()
    private const val GROUP_VENDOR = 0x20000000
    private const val AREA_MASK = 0x0F000000
    private const val AREA_GLOBAL = 0x01000000
    private const val BLOCK_MASK = 0x0000FF00
    private const val BLOCK = 0x0000A100
    /** Whether [propertyId] is a global vendor property in the assistance block. */
    fun contains(propertyId: Int): Boolean =
        propertyId and GROUP_MASK == GROUP_VENDOR &&
            propertyId and AREA_MASK == AREA_GLOBAL &&
            propertyId and BLOCK_MASK == BLOCK
 }
@@ -320,6 +320,144 @@ object EVHardware {
        ignitionCallbacks.remove(callback)
    }
    // -------------------------------------------------------------------------
    // Listening to properties (the app's signal recorder) — read only
    // -------------------------------------------------------------------------
    /** Why the last [listenToProperties] returned null, in a few words; null after a success. */
    @Volatile var listenProblem: String? = null
        private set
    /** A subscription made by [listenToProperties]; [close] ends it. */
    class PropertyListening internal constructor(
        /** Properties subscribed to, and those the car service refused. */
        val subscribed: Int,
        val refused: Int,
        private val stop: () -> Unit,
    ) : AutoCloseable {
        override fun close() = stop()
    }
    /**
     * Subscribes to every CarPropertyManager property whose id [admit] accepts, the way the
     * head unit's own managers do (`CarAdvancedAssistedDrivingManager` registers each of its
     * `AAD_*` ids for change events and never polls them), and hands each change event to
     * [onEvent] as (property id, area, value as text) on the car service's thread. A vendor HAL
     * may fill a property from the car network only while someone listens, so a poll alone can
     * read its default. ON_CHANGE properties are asked for every change, CONTINUOUS ones for
     * 1 Hz within their limits. Read only: nothing is set. Null when there is no
     * CarPropertyManager or no way to subscribe, with the reason in [listenProblem];
     * [PropertyListening.close] unsubscribes.
     *
     * Android 9's car library (the MG4's) names the calls `registerListener(CarPropertyEventListener,
     * int, float)` and `unregisterListener`; Android 10 renamed them `registerCallback` and
     * `unregisterCallback`. Both are looked for. Unsubscribing goes property by property: the
     * one-argument `unregisterListener` of Android 9 removes entries from the list it walks and so
     * leaves every other property subscribed.
     */
    fun listenToProperties(admit: (Int) -> Boolean, onEvent: (Int, Int, String) -> Unit): PropertyListening? {
        listenProblem = null
        val cpm = sCarPropertyManager ?: run {
            listenProblem = "no car service"
            return null
        }
        return try {
            val methods = cpm.javaClass.methods
            val register = methods.firstOrNull {
                (it.name == "registerListener" || it.name == "registerCallback") && it.parameterCount == 3 &&
                    it.parameterTypes[1] == Int::class.javaPrimitiveType &&
                    it.parameterTypes[2] == Float::class.javaPrimitiveType
            } ?: run {
                listenProblem = "no way to subscribe"
                return null
            }
            val callbackType = register.parameterTypes[0]
            val unregister = methods.firstOrNull {
                it.name == register.name.replaceFirst("register", "unregister") && it.parameterCount == 2 &&
                    it.parameterTypes[0] == callbackType && it.parameterTypes[1] == Int::class.javaPrimitiveType
            }
            val unregisterAll = methods.firstOrNull {
                it.name == register.name.replaceFirst("register", "unregister") && it.parameterCount == 1 &&
                    it.parameterTypes[0] == callbackType
            }
            if (!callbackType.isInterface) {
                listenProblem = "unexpected listener type ${callbackType.simpleName}"
                return null
            }
            val proxy = Proxy.newProxyInstance(callbackType.classLoader, arrayOf(callbackType)) { self, method, args ->
                when (method.name) {
                    "onChangeEvent" -> {
                        val cpv = args?.getOrNull(0)
                        if (cpv != null) {
                            try {
                                val type = cpv.javaClass
                                val id = type.getMethod("getPropertyId").invoke(cpv) as Int
                                val area = type.getMethod("getAreaId").invoke(cpv) as Int
                                onEvent(id, area, com.evsuite.hardware.probe.VendorSurfaceRules.render(
                                    type.getMethod("getValue").invoke(cpv)))
                            } catch (e: Exception) {
                                AppLogger.d(TAG, "listen: event unreadable: ${e.readFailureReason()}")
                            }
                        }
                        null
                    }
                    "onErrorEvent" -> {
                        val id = args?.getOrNull(0) as? Int
                        val area = args?.getOrNull(1) as? Int
                        if (id != null) onEvent(id, area ?: AREA_GLOBAL, "error event")
                        null
                    }
                    "equals" -> self === args?.getOrNull(0)
                    "hashCode" -> System.identityHashCode(self)
                    "toString" -> "PropertyListening"
                    else -> null
                }
            }
            val configs = cpm.javaClass.getMethod("getPropertyList").invoke(cpm) as? List<*> ?: return null
            val subscribedIds = ArrayList<Int>()
            var refused = 0
            for (config in configs) {
                if (config == null) continue
                val type = config.javaClass
                val id = runCatching { type.getMethod("getPropertyId").invoke(config) as Int }.getOrNull() ?: continue
                if (!admit(id)) continue
                val continuous = runCatching { type.getMethod("getChangeMode").invoke(config) as Int }.getOrNull() == 2
                val rate = if (!continuous) 0f else {
                    val min = runCatching { type.getMethod("getMinSampleRate").invoke(config) as Float }.getOrNull() ?: 0f
                    val max = runCatching { type.getMethod("getMaxSampleRate").invoke(config) as Float }.getOrNull() ?: 1f
                    1f.coerceIn(min, maxOf(min, max))
                }
                try {
                    if (register.invoke(cpm, proxy, id, rate) == false) refused++ else subscribedIds.add(id)
                } catch (e: Exception) {
                    refused++
                    AppLogger.d(TAG, "listen: 0x%08X refused: %s".format(id, e.readFailureReason()))
                }
            }
            AppLogger.i(TAG, "listening to ${subscribedIds.size} properties ($refused refused) via ${register.name}")
            PropertyListening(subscribedIds.size, refused) {
                for (id in subscribedIds) {
                    try {
                        if (unregister != null) unregister.invoke(cpm, proxy, id)
                    } catch (e: Exception) {
                        AppLogger.d(TAG, "listen: unsubscribe 0x%08X failed: %s".format(id, e.readFailureReason()))
                    }
                }
                if (unregister == null) {
                    try {
                        unregisterAll?.invoke(cpm, proxy)
                    } catch (e: Exception) {
                        AppLogger.d(TAG, "listen: unsubscribe failed: ${e.readFailureReason()}")
                    }
                }
            }
        } catch (e: Exception) {
            listenProblem = e.readFailureReason()
            AppLogger.w(TAG, "listenToProperties: ${e.readFailureReason()}")
            null
        }
    }
    /** Unregisters the CarPropertyManager proxy (call from Service.onDestroy). */
    fun unregisterIgnitionPropertyCallback() {
        val cpm = sCarPropertyManager ?: return
@@ -0,0 +1,29 @@
 package com.evsuite.hardware
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
 class AssistBlockTest {
    @Test
    fun `the assistance manager's properties are in the block`() {
        // First and last int, the target speed and the object distance (floats).
        for (id in intArrayOf(0x2140A101, 0x2140A171, 0x2160A15B, 0x2160A12C, 0x2160A114)) {
            assertTrue("0x%08X".format(id), AssistBlock.contains(id))
        }
    }
    @Test
    fun `other properties are not`() {
        for (id in intArrayOf(
            0x2140A0FF, // the block before
            0x2140A201, // the block after
            0x11400400, // a standard (system) property
            0x2340A101, // not global
            0x0140A101, // no group
        )) {
            assertFalse("0x%08X".format(id), AssistBlock.contains(id))
        }
    }
 }
@@ -0,0 +1,105 @@
 package com.evsuite.hardware
 import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNotNull
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 class PropertyListeningTest {
    class Config(val propertyId: Int, val changeMode: Int, val minSampleRate: Float, val maxSampleRate: Float)
    class Value(val propertyId: Int, val areaId: Int, val value: Any)
    /** Shaped like Android 9's CarPropertyManager, the car's: registerListener, and an
     *  unregisterListener(listener) that skips every other property as the car's does. */
    class Android9Manager(private val configs: List<Config>) {
        interface CarPropertyEventListener {
            fun onChangeEvent(value: Any?)
            fun onErrorEvent(propertyId: Int, areaId: Int)
        }
        val active = LinkedHashMap<Int, MutableList<CarPropertyEventListener>>()
        val rates = HashMap<Int, Float>()
        fun getPropertyList(): List<Config> = configs
        fun registerListener(listener: CarPropertyEventListener, propertyId: Int, rate: Float): Boolean {
            active.getOrPut(propertyId) { ArrayList() }.add(listener)
            rates[propertyId] = rate
            return true
        }
        fun unregisterListener(listener: CarPropertyEventListener) {
            val ids = active.keys.toMutableList()
            var i = 0
            while (i < ids.size) {
                unregisterListener(listener, ids[i])
                if (active[ids[i]] == null) ids.removeAt(i) // as SparseArray.remove under keyAt(i)
                i++
            }
        }
        fun unregisterListener(listener: CarPropertyEventListener, propertyId: Int) {
            val list = active[propertyId] ?: return
            list.remove(listener)
            if (list.isEmpty()) active.remove(propertyId)
        }
        fun fire(propertyId: Int, value: Any) {
            active[propertyId]?.toList()?.forEach { it.onChangeEvent(Value(propertyId, 0x01000000, value)) }
        }
    }
    class NoListeners {
        fun getPropertyList(): List<Config> = emptyList()
    }
    private val field = EVHardware::class.java.getDeclaredField("sCarPropertyManager").apply { isAccessible = true }
    @After
    fun reset() = field.set(null, null)
    @Test
    fun `subscribes through Android 9's registerListener and unsubscribes every property`() {
        val manager = Android9Manager(listOf(
            Config(0x2160A15B, 1, 0f, 0f),     // in the block, on change
            Config(0x2140A15A, 1, 0f, 0f),
            Config(0x2160A1A3, 2, 0f, 10f),    // continuous
            Config(0x2140A101, 1, 0f, 0f),
            Config(0x11400400, 1, 0f, 0f),     // outside the block
        ))
        field.set(null, manager)
        val heard = ArrayList<String>()
        val listening = EVHardware.listenToProperties(AssistBlock::contains) { id, area, value ->
            heard += "%08X/%d=%s".format(id, area, value)
        }
        assertNotNull(EVHardware.listenProblem, listening)
        assertEquals(4, listening!!.subscribed)
        assertEquals(0, listening.refused)
        assertEquals(setOf(0x2160A15B, 0x2140A15A, 0x2160A1A3, 0x2140A101), manager.active.keys)
        assertEquals(0f, manager.rates[0x2160A15B])
        assertEquals(1f, manager.rates[0x2160A1A3])
        manager.fire(0x2160A15B, 90f)
        assertEquals(1, heard.size)
        assertTrue(heard[0], heard[0].startsWith("2160A15B/16777216="))
        listening.close()
        assertTrue(manager.active.toString(), manager.active.isEmpty())
    }
    @Test
    fun `says why when there is no way to subscribe`() {
        field.set(null, NoListeners())
        assertNull(EVHardware.listenToProperties(AssistBlock::contains) { _, _, _ -> })
        assertEquals("no way to subscribe", EVHardware.listenProblem)
        field.set(null, null)
        assertNull(EVHardware.listenToProperties(AssistBlock::contains) { _, _, _ -> })
        assertEquals("no car service", EVHardware.listenProblem)
    }
 }
@@ -39,8 +39,9 @@ top. Those are Fatih's reads the car needs and upstream does not have — the ve
 ids `0x21401553`–`56`, the vendor mileage `0x21401566` for the odometer, the charging status
 from `0x2140F409`, SoC, range, power, pack voltage and current on SWI69 as on SWI68, and SWI69
 speed already in km/h — plus translated comments and, from this fork, the gear's raw code
-(`EVHardware.getGearRaw`, `EnergySnapshot.gearRaw`) and a drive mode write without the binder
+(`EVHardware.getGearRaw`, `EnergySnapshot.gearRaw`), a drive mode write without the binder
-fallback (`writeDriveModeProperty`). To take upstream again, merge three ways with
+fallback (`writeDriveModeProperty`), and read-only listening to properties for the signal
 recorder (`listenToProperties`, `AssistBlock`). To take upstream again, merge three ways with
 `e4e1158` as the base.
 The car app links EVHardware into its APK, so the **built app** may only be used and passed on
@@ -110,3 +110,10 @@ That screen needs a `file://` URI on the car build: a read grant on our FileProv
 when it comes from the system user (`not exported from UID 1000`), and the installer reports the
 unreadable file as "There was a problem parsing the package". On the emulator the session still
 installs silently.
 The refusal does not always come at once: the platform may also answer a moment later, through
 the session's result (`OtaInstallResultReceiver`). Since 2.40.1 that answer opens the installer
 screen too, as does a confirmation the platform asks for but cannot show; only **Cancel** on that
 screen ends the update there. And if the session says nothing at all for 20 s, the app abandons
 it and opens the installer screen. Before 2.40.1 a late refusal ended in a short message only:
 the update downloaded and then nothing seemed to happen.
@@ -95,7 +95,7 @@ with the server using a token of its own, obtained by pairing with a phone (belo
 | **Live data** | Live data on/off, ABRP credentials for sending directly from the car, upload frequency |
 | **Server** | Server URL, pairing by QR code, ingest token, installation ID, config import |
 | **Settings** | Full screen, voice key, Overview style and accent colour, tyre pressure unit; drive mode (Eco, Normal, Sport, Snow, Custom: changes only in P at a standstill; the highlighted one is what the car reports; with "Set at start" the last confirmed choice is set again when the car starts, while it is still in P); battery (manual SoH, usable capacity) and charging price; entry on the phone; version, update check, install from USB stick, About |
-| **Logs** | Signal recorder (records every value the head unit offers for 3 minutes and lists what changed, to find where the car publishes something; saved to a USB stick too), update log (every install step), upload log |
+| **Logs** | Signal recorder (records every value the head unit offers for 3 minutes, listens to the driver-assistance values for every change they report, and lists what changed, to find where the car publishes something; sent to your server, and saved to a USB stick too), update log (every install step), upload log |
 - **Opening the app:** the MG4 launcher does not list third-party apps. **Double-press the
  voice key** on the steering wheel and the app comes to the front (switch on the Settings
@@ -78,7 +78,9 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
  (`AAD_EPTCCTRGTSPD` `0x2160A15B` 0.0, `AAD_ACC_OBJ_*` 0.0 / -128.0, modes 0). A signal recording
  of all 1,194 values while the set speed was 101, 90 and 80 km/h shows none of those numbers
  (also tried as m/s, mph and ×2/×10/×16/×64) outside the actual speed, and the ACC buttons send
-  no key broadcast. Most likely only the instrument cluster has it.
+  no key broadcast. Most likely only the instrument cluster has it. Not yet tried: listening
  (subscribing) instead of polling, as the head unit's own manager does — the recorder does it
  since 2.40.3; a drive with ACC will tell.
 ## To do
@@ -138,6 +140,103 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
  confirmed car facts, app structure, UI conventions, build/test/ship, documents. It replaces
  upstream's EVABRPUploader text. The test emulator is now in the flake: `nix run .#car-emulator`
  (Android 9 AOSP at 1920×720, 160 dpi; the car build installs as the system user — checked).
 - 2026-10-27 — App 2.41.0, server 2.9.0: **recordings reach the server** (owner: "can we make
  it so that we can upload the logs to an endpoint in the server, and you can get the logs from
  there? that way i don't have to carry a usb stick"). A finished signal recording goes to
  `files/log-outbox` (`LogOutbox`, at most 10 waiting) and is sent at once, gzipped, with the car's
  token: `PUT /v1/logs/{name}`. Offline, 401 (not paired yet), 404 (a server without logs), 408,
  429 or 5xx keep it, and the service's tick sends it again, at most every 2 minutes; any other
  refusal drops it. The Logs tab says "Sent to the server." or how many wait and why. Server
  (`logs.go`): `LOGS_DIR` on a new 1Gi volume `mg4-server-logs`, the newest 200 files and none
  older than 180 days, names as the app's only, up to 2 MB sent and 8 MB unpacked, UTF-8 only; the
  same name replaces itself. Reading (`GET /v1/logs`, `GET /v1/logs/{name}`) takes `LOGS_TOKEN`, a
  new optional Secret value that must differ from `INGEST_TOKEN`; the car's token cannot read, the
  read token cannot write. `fetch-logs` in the dev shell fetches the new ones into `logs/`
  (gitignored, as are the recordings copied into the checkout's top folder), token from
  `~/.config/nilsmg4/logs-token`. Tested: server unit tests (both tokens, refusals, pruning,
  config); the real server code in a harness on this machine took the 08:52 recording gzipped as
  the app sends it (204), refused the car's token for reading (401), and `fetch-logs` brought it
  back byte for byte, once. The app's own sending could not be pointed at that harness (the app
  takes https only); on the emulator the recording lands in the outbox and the Logs tab says it
  waits. Not tried on the car.
 - 2026-10-27 — App 2.40.4 published (`car-2.40.4`).
 - 2026-10-27 — App 2.40.4: **the recorder's listening works on Android 9**. Both recordings
  from the car (08:49 and 08:52, 2.40.3) said "listening to the assistance properties: not
  possible": `listenToProperties` looked only for `registerCallback`, Android 10's name; the car's
  car library (Android 9) has `registerListener(CarPropertyEventListener, int, float)` and
  `unregisterListener`, as the app's `CarPropertyAdapter` already knew. It now takes either, and
  unsubscribes property by property (Android 9's one-argument `unregisterListener` removes
  entries from the list it walks and would leave every other property subscribed). A failure now
  says why (`EVHardware.listenProblem`: no car service, no way to subscribe, or the exception).
  Tested with a stand-in manager of Android 9's shape (`PropertyListeningTest`). Correction to
  2.40.3: the ignition listener it was compared with also looks only for `registerCallback`, so
  it most likely never subscribes on the car either (it reads the state once at start); left as
  it is. What the polled part of the two recordings shows of the block: `0x2160A15B` (by name
  the target speed) 0.0 throughout; `0x2140A15A` between 3 and 7 every few captures;
  `0x2160A1A3`/`0x2160A1A4` counting up by 0.1; speeds 8–33 km/h. Not tried on the car.
 - 2026-10-27 — App 2.40.3 published (`car-2.40.3`; also carries 2.40.1 and 2.40.2).
 - 2026-10-27 — App 2.40.3: **the signal recorder listens** (owner: "is there really nothing we
  can do about the readout of the cruise control set point"). The 2.32.0 recording only polled.
  The head unit's `CarAdvancedAssistedDrivingManager` never polls its 108 `AAD_*` properties: it
  registers a listener for each (`registerListener(…, 0.0f)`, on change), and a vendor HAL may
  fill a value from the car network only while someone listens — which would read as the
  defaults we saw. EVHardware gains `listenToProperties` (read only: the CarPropertyManager's
  `registerCallback` per admitted property, rate 0 for ON_CHANGE, 1 Hz within limits for
  CONTINUOUS, one proxy, `unregisterCallback` on close) and `AssistBlock` (global vendor
  properties `0x21x0A1xx`, which holds all 108 `AAD_*` ids; tested). The recorder subscribes to
  that block for its 3 minutes; `SignalRecording.event` counts every event and puts value changes
  on the timeline; the file and the Logs tab list the properties heard, those with changing
  values first ("heard …"). Emulator (no car service): the recorder notes that listening is not
  possible, records, saves the new section; no crash. The subscription itself is the same
  reflection as the ignition listener that works on the car, but untried on the car.
 - 2026-10-27 — App 2.40.2: **the map moves on the GPU** (owner: "is the map screen gpu
  accelerated? it looks a bit slow on update"). It was hardware-rendered, but every frame (20 a
  second) recomputed every road point on the main thread, rebuilt all paths, and drew the big
  roads three times for the glow; and the car jumped with each GPS fix (1 Hz). Now the map is
  its own view under the Grid (`MapLayerView`, `LAYER_TYPE_HARDWARE`): drawn once into a GPU
  texture round an anchor and only redrawn when tiles come or go or the car is ~280 layout units
  (≈230 m) from the anchor; each display frame (`postOnAnimation`, only while that style is on
  screen and the map shows) sets its translation, pivot and rotation, which the GPU composites.
  The car glides towards each fix (eased, snaps beyond 200 m), the heading eases; GridView over
  the map no longer animates itself (only the readings redraw it), the "far roads fainter" sort
  is a fixed dark gradient towards the top. Layer size on the car about 2500 px square (~25 MB).
  Measured on the emulator: with SwiftShader (software GPU) old and new both ~57 ms a frame, and
  with the host's Intel GPU (`-gpu host`) both run at the display rate (~18 ms) — the emulator
  is too fast to show the car's slowness, so the gain on the head unit is reasoned, not
  measured. Not tried on the car.
 - 2026-10-27 — App 2.40.1: **an update that downloaded but never reached the installer** (owner:
  "sometimes … downloads the update but then doesn't start the installer"). The car refuses the
  installer session ("Not allowed to install non-system apps on internal storage"); only a
  refusal thrown at once led to the installer screen. A refusal that came back through the
  session's result was a toast and nothing else. Now any answer but success, the confirmation and
  the driver's own cancel opens the installer screen with the verified APK (path and session id
  ride on the result intent; `goAsync` for the copy), a confirmation that cannot be shown does
  too, and a session silent for 20 s is abandoned for it. Emulator, with a throwaway build whose
  session bytes were damaged (refused later, status 4 `INSTALL_PARSE_FAILED_NOT_APK`) and which
  read the update from Downloads: the installer screen opened by itself, Install, now 2.40.1; the
  update log shows every step. The 20 s watch is untested (no way to make a session stay silent).
  Not tried on the car. OTA.md updated.
 - 2026-10-27 — App 2.40.0 published (`car-2.40.0`).
 - 2026-10-27 — App 2.40.0: **Grid with map straight from above, full height** (owner: 2.39.2
  "does not look right"; wanted the map over the whole height and fully top-down). The map is
  the whole background in map mode: orthographic, heading up, 1.2 layout units per metre (about
  400 m ahead, 125 m behind, 450 m to each side on the car's screen), the car 150 units above
  the bottom edge; ground grid every 50 m fixed to the ground; roads from 250 m ahead fainter;
  the camera, the sky and the floor are gone there. The speed moves to a panel under the gears
  (120 units), and the battery wall, the clock, the gears and the disc get dark panels. The
  plain Grid is unchanged. Emulator with the Berlin tiles, both layouts. Not tried on the car.
 - 2026-10-27 — App 2.39.2 published (`car-2.39.2`).
 - 2026-10-27 — App 2.39.2: **Grid with map seen from higher up** (owner: the map looked like a
  fish-eye; wanted it more top-down). The map has its own pinhole camera now: 45° down, 300 m
  up, the car on its axis just above the read-outs, the top of the floor about 420 m ahead
  (scale there ~60 % of the car's, before ~1/20 at 900 m); the floor starts at half height in
  map mode and the speed is 170 instead of 210 units; the floor's grid becomes a ground grid
  (a line every 50 m, fixed to the ground, turning with the roads); roads from 250 m ahead
  fainter; the power disc gets a dark backing over the map. Emulator with the Berlin tiles,
  both layouts. Not tried on the car.
 - 2026-10-26 — Server 2.8.0 image pushed and pinned in `k8s/server.yaml` by digest
  `sha256:8b8d94e0562833d196162866b7fdc6910d5dd219f6eb84572d4d5c91b74f7ff1` (checked with skopeo);
  app 2.39.1 published (`car-2.39.1`). Not applied yet: the owner applies it.
 - 2026-10-26 — App 2.39.1 and server 2.8.0: **the map's roads come from OpenFreeMap, on
  demand.** In the car, server 2.7.0 logged `overpass answered 502`, `overpass could not be
  reached`, and the owner saw 429s: the public Overpass limits per IP, and a tile takes it ~40 s
@@ -165,9 +165,11 @@ films' other side.
 ## Grid with map
-The Grid, with the roads round the car from OpenStreetMap (through OpenFreeMap) laid on its floor as light lanes, in
+The Grid over a map: the roads round the car from OpenStreetMap (through OpenFreeMap) fill the
-the floor's perspective and turned with the direction you drive: motorways glow brightest, then
+whole screen as light lanes, straight from above and turned with the direction you drive, about
-main roads, then the smaller streets, fading towards the horizon. The car is the chevron on the
+400 m ahead and 450 m to each side: motorways glow brightest, then main roads, then the smaller
 streets, the far ones fainter, over a ground grid every 50 m that turns and slides with them.
 The speed, the battery wall, the power disc and the clock stand on dark panels over the map. The car is the chevron on the
 floor, and between GPS fixes it runs on with the speed. The roads come through the car's own
 server, which fetches only the map tiles you drive through and keeps them (see the README); the car also keeps
 the last few hundred tiles itself. Without GPS, the server or the roads, the floor says so and
@@ -34,8 +34,8 @@ android {
        applicationId "com.stinnesbeck.nilsmg4"
        minSdk 27
        targetSdk 36
-        versionCode 143
+        versionCode 150
-        versionName "2.39.1"
+        versionName "2.41.0"
        // Nothing about the server ships in the APK: its URL and ingest token are entered in
        // the app's Server tab (ServerConfig), and the database is only reachable by the server.
@@ -223,6 +223,7 @@ public class AbrpUploadService extends Service {
        consumptionTracker.sample(vehicle);
        chargeSessionTracker.sample(vehicle);
        consumptionCloudClient.syncIfDue(consumptionTracker, chargeSessionTracker, sampleMs);
        LogOutbox.sendIfDue(this); // recordings the car could not send when they ended
        UploadSettings settings = UploadSettings.from(prefs);
        // Live data goes to the server, to ABRP directly, or both; with neither set up there is
@@ -23,10 +23,14 @@ import android.os.SystemClock;
 * the trail; the floor stands still when the speed is unread.
 *
 * With a map ("Grid with map", {@link MapRoads}): the roads round the car from OpenStreetMap lie
- * on the floor in its perspective, heading up, the bigger ones glowing brighter, with the car
+ * under everything, heading up, the bigger ones glowing brighter, with the car as a light
- * as a light marker a little way up the floor; between GPS fixes the car's position runs on
+ * marker low on the screen; between GPS fixes the car's position runs on
- * with the speed. The floor's tiles are then 40 m, so they move with the roads, and the trail
+ * with the speed. The map is then the whole background, straight from above (about
- * makes way for the map. Without a fix, a server or the roads, the plain floor with a line
+ * 400 m ahead, 450 m to each side), over a ground grid (a line every 50 m) that turns and slides
 * with the roads, fading into the dark towards the top. It is its own view under this one
 * ({@link MapLayerView}): drawn once into a hardware layer and moved and turned by the GPU each
 * display frame, the car gliding between fixes; the speed, the battery wall, the disc and the clock stand on dark panels over
 * it, and the trail makes way for the map. Without a fix, a server or the roads, the plain floor with a line
 * saying why.
 *
 * Two palettes: the original cyan, or the chosen accent colour ({@link #setAccentPalette}). A
@@ -39,11 +43,6 @@ final class GridView extends ClusterCanvasView {
    /** Battery segments in the light wall, disc segments, metres per grid tile. */
    private static final int WALL = 20, DISC = 60;
    private static final float TILE_M = 4f;
    /**
     * The map: metres per depth step of the floor, the car's depth (just above the read-outs),
     * the nearest depth drawn, how far ahead, and the depth from which roads are drawn fainter.
     */
    private static final float MAP_UNIT_M = 40f, CAR_DEPTH = 1.6f, NEAR = 0.6f, FAR_M = 900f, FADE_DEPTH = 5f;
    private final Paint line = new Paint(Paint.ANTI_ALIAS_FLAG);
    private final Paint fill = new Paint(Paint.ANTI_ALIAS_FLAG);
@@ -58,13 +57,10 @@ final class GridView extends ClusterCanvasView {
    private final int accent, accentLight;
    /** Null for the plain Grid. */
    private final MapRoads map;
-    /** Per road class, near and far (from {@link #FADE_DEPTH}). */
+    /** The map under this view (a hardware layer, moved by the GPU); null for the plain Grid. */
-    private final Path[] roads = new Path[RoadTile.CLASSES * 2];
+    private final MapLayerView mapLayer;
-    private float heading = Float.NaN;
+    private final Paint fade = new Paint();
-    /** The pen while a road is added: the last point, and whether it continues from there. */
+    private int fadeFor = -1;
    private float penX, penY;
    private boolean penDown;
    private Path penPath;
    private int main, light, dim, alert;
    /** The floor's position within one tile (0..1) and the disc's inner ring angle. */
@@ -79,7 +75,7 @@ final class GridView extends ClusterCanvasView {
    GridView(Context context, MapRoads map) {
        super(context);
        this.map = map;
-        for (int i = 0; i < roads.length; i++) roads[i] = new Path();
+        mapLayer = map == null ? null : new MapLayerView(context, map);
        accent = AccentColor.resolve(context, R.attr.evAccent);
        accentLight = AccentColor.resolve(context, R.attr.evAccentLight);
        line.setStyle(Paint.Style.STROKE);
@@ -95,9 +91,24 @@ final class GridView extends ClusterCanvasView {
        dim = AccentColor.withAlpha(main, 0x40);
        alert = useAccent ? 0xFFFFFFFF : 0xFFFF8A1F;
        skyFor = -1;
        if (mapLayer != null) mapLayer.setColours(main, light);
        invalidate();
    }
    /** The map layer, for the pane to put under this view; null for the plain Grid. */
    MapLayerView mapLayer() {
        return mapLayer;
    }
    @Override
    void setValues(ClusterValues values) {
        super.setValues(values);
        if (mapLayer != null) {
            mapLayer.setSpeed(v.speedKmh);
            mapLayer.kick();
        }
    }
    @Override
    protected void onDraw(Canvas c) {
        super.onDraw(c);
@@ -105,25 +116,32 @@ final class GridView extends ClusterCanvasView {
        if (w <= 0 || h <= 0) return;
        float u = Math.min(h / 640f, w / 1100f);
        advance();
-        c.drawColor(0xFF000000);
+        // With a map, the map layer underneath is the whole background (this view stays clear
-
+        // there), and the rest stands on dark panels over it.
        boolean mapShown = mapLayer != null && mapLayer.isShowing();
        float horizon = h * 0.55f;
-        drawSky(c, w, horizon);
+        if (mapShown) {
-        drawFloor(c, w, h, horizon, u);
+            drawCar(c, w, h, u);
-        boolean mapShown = map != null && drawMap(c, w, h, horizon, u);
+        } else {
            c.drawColor(0xFF000000);
            drawSky(c, w, horizon);
            drawFloor(c, w, h, horizon, u);
        }
        if (map != null && !mapShown) drawMapState(c, w, h, horizon, u);
        if (mapShown) drawPanels(c, w, horizon, u);
        drawGears(c, w, u);
        drawClock(c, w, u);
-        drawSpeed(c, w, horizon, u);
+        if (mapShown) drawMapSpeed(c, w, u);
        else drawSpeed(c, w, horizon, u);
        drawWall(c, horizon, u);
-        drawDisc(c, w, u);
+        drawDisc(c, w, mapShown, u);
        if (!mapShown) drawTrail(c, w, h, u);
        drawReadouts(c, w, h, u);
        if (mapShown) drawAttribution(c, w, h, u);
        boolean moving = v.speedKmh != null && v.speedKmh > 0.5f;
-        // The map costs more per frame: 20 a second is smooth enough for it.
+        // Over the map only the readings change; the map layer moves itself.
-        keepAnimating(moving, mapShown ? 50 : 33);
+        keepAnimating(moving && !mapShown, 33);
    }
    /** Moves the floor by the distance driven since the last frame, and turns the disc. */
@@ -132,8 +150,7 @@ final class GridView extends ClusterCanvasView {
        float dt = lastFrame == 0 ? 0f : Math.min(0.2f, (now - lastFrame) / 1000f);
        lastFrame = now;
        if (v.speedKmh != null && v.speedKmh > 0.5f) {
-            float tile = map != null ? MAP_UNIT_M : TILE_M;
+            floorPhase = (floorPhase + v.speedKmh / 3.6f * dt / TILE_M) % 1f;
            floorPhase = (floorPhase + v.speedKmh / 3.6f * dt / tile) % 1f;
        }
        if (v.powerKw != null) discTurn = (discTurn + v.powerKw * 3f * dt) % 360f;
    }
@@ -172,118 +189,51 @@ final class GridView extends ClusterCanvasView {
    // ---------- Map ----------
-    /** The roads round the car on the floor; false when there is nothing to draw. */
+    /** Over the map: the far roads fading into the dark towards the top, and the car. */
-    private boolean drawMap(Canvas c, float w, float h, float horizon, float u) {
+    private void drawCar(Canvas c, float w, float h, float u) {
-        MapRoads.Fix fix = map.fix();
+        float carSx = w / 2f, carSy = h - MapLayerView.CAR_FROM_BOTTOM * u;
-        java.util.Collection<RoadTile> tiles = map.tiles();
+        if (fadeFor != (int) (carSy + h)) {
-        if (fix == null || tiles.isEmpty()) return false;
+            fade.setShader(new LinearGradient(0, 0, 0, carSy, 0xB0000000, 0x00000000, Shader.TileMode.CLAMP));
-        // Heading up: ease round the shorter way; north up until the car has moved.
+            fadeFor = (int) (carSy + h);
        float target = Float.isNaN(fix.bearing) ? (Float.isNaN(heading) ? 0f : heading) : fix.bearing;
        if (Float.isNaN(heading)) heading = target;
        else heading = (heading + (((target - heading) % 360f + 540f) % 360f - 180f) * 0.2f + 360f) % 360f;
        // Between fixes the car runs on with the speed, for at most 2.5 s.
        double mpu = MapGeometry.metresPerUnit(fix.lat);
        float ran = 0f;
        if (v.speedKmh != null && !Float.isNaN(fix.bearing)) {
            ran = v.speedKmh / 3.6f * Math.min(2.5f, (SystemClock.elapsedRealtime() - fix.elapsedMs) / 1000f);
        }
-        double run = Math.toRadians(Float.isNaN(fix.bearing) ? 0f : fix.bearing);
+        c.drawRect(0, 0, w, carSy, fade);
-        double carX = MapGeometry.worldX(fix.lon) + ran * Math.sin(run) / mpu;
+        // A light-cycle chevron pointing ahead.
        double carY = MapGeometry.worldY(fix.lat) - ran * Math.cos(run) / mpu;
        float sin = (float) Math.sin(Math.toRadians(heading)), cos = (float) Math.cos(Math.toRadians(heading));
        float lane = w * 0.09f, depth = h - horizon, vx = w / 2f, m = (float) mpu;
        double range = FAR_M / mpu;
        for (Path p : roads) p.reset();
        for (RoadTile tile : tiles) {
            double ox = (double) tile.x * MapGeometry.EXTENT - carX, oy = (double) tile.y * MapGeometry.EXTENT - carY;
            if (ox > range || oy > range || ox + 2 * MapGeometry.EXTENT < -range || oy + 2 * MapGeometry.EXTENT < -range) {
                continue;
            }
            float fx = (float) ox, fy = (float) oy;
            for (int i = 0; i < tile.points.length; i++) {
                int[] b = tile.bounds[i];
                if (fx + b[2] < -range || fx + b[0] > range || fy + b[3] < -range || fy + b[1] > range) continue;
                int cls = tile.classes[i];
                int[] pts = tile.points[i];
                penDown = false;
                float pa = 0f, pf = 0f;
                for (int k = 0; k < pts.length; k += 2) {
                    float east = (fx + pts[k]) * m, north = -(fy + pts[k + 1]) * m;
                    float fwd = east * sin + north * cos, side = east * cos - north * sin;
                    if (k > 0) segment(cls, pa, pf, side, fwd, vx, horizon, lane, depth);
                    pa = side;
                    pf = fwd;
                }
            }
        }
        c.save();
        c.clipRect(0, horizon, w, h);
        line.setStrokeJoin(Paint.Join.ROUND);
        line.setStrokeCap(Paint.Cap.ROUND);
        // Far roads thin and faint, so the horizon stays a line rather than a tangle.
        for (int cls = RoadTile.CLASSES - 1; cls >= 0; cls--) {
            line.setColor(AccentColor.withAlpha(cls == 0 ? light : main, cls >= 3 ? 0x30 : 0x50));
            line.setStrokeWidth((cls == 0 ? 1.6f : 1f) * u);
            c.drawPath(roads[cls * 2 + 1], line);
        }
        line.setColor(AccentColor.withAlpha(main, 0x80));
        line.setStrokeWidth(1.4f * u);
        c.drawPath(roads[3 * 2], line);
        line.setColor(AccentColor.withAlpha(main, 0xC0));
        line.setStrokeWidth(2f * u);
        c.drawPath(roads[2 * 2], line);
        glow(c, roads[2], main, 2.4f * u);
        glow(c, roads[0], light, 3.2f * u);
        line.setStrokeJoin(Paint.Join.MITER);
        line.setStrokeCap(Paint.Cap.SQUARE);
        c.restore();
        // The car: a light-cycle chevron pointing ahead.
        float cy = horizon + depth / CAR_DEPTH;
        path.reset();
-        path.moveTo(vx, cy - 16f * u);
+        path.moveTo(carSx, carSy - 18f * u);
-        path.lineTo(vx + 11f * u, cy + 10f * u);
+        path.lineTo(carSx + 12f * u, carSy + 11f * u);
-        path.lineTo(vx, cy + 4f * u);
+        path.lineTo(carSx, carSy + 5f * u);
-        path.lineTo(vx - 11f * u, cy + 10f * u);
+        path.lineTo(carSx - 12f * u, carSy + 11f * u);
        path.close();
        fill.setColor(light);
        c.drawPath(path, fill);
        glow(c, path, light, 1.5f * u);
        return true;
    }
-    /** One stretch of road from (a0, f0) to (a1, f1) in metres (side, ahead), cut at the near edge. */
+    /** Dark panels under the battery wall and the clock, so the map does not run through them. */
-    private void segment(int cls, float a0, float f0, float a1, float f1, float vx, float horizon, float lane,
+    private void drawPanels(Canvas c, float w, float horizon, float u) {
-                         float depth) {
+        chamfer(16f * u, 78f * u, 360f * u, horizon + 86f * u, 14f * u);
-        float d0 = CAR_DEPTH + f0 / MAP_UNIT_M, d1 = CAR_DEPTH + f1 / MAP_UNIT_M;
+        fill.setColor(0xC8000000);
-        Path p = roads[cls * 2 + (Math.min(d0, d1) > FADE_DEPTH ? 1 : 0)];
+        c.drawPath(path, fill);
-        if ((d0 < NEAR && d1 < NEAR) || (f0 > FAR_M && f1 > FAR_M)) {
+        chamfer(w - 210f * u, 12f * u, w - 12f * u, 82f * u, 10f * u);
-            penDown = false;
+        c.drawPath(path, fill);
-            return;
+        // Behind the gears as well.
-        }
+        chamfer(w / 2f - 150f * u, 12f * u, w / 2f + 150f * u, 72f * u, 10f * u);
-        boolean cut = false;
+        c.drawPath(path, fill);
-        if (d0 < NEAR || d1 < NEAR) {
+    }
-            float t = (NEAR - d0) / (d1 - d0);
+
-            float a = a0 + (a1 - a0) * t, d = NEAR;
+    /** The speed over the map: smaller, on a panel under the gears. */
-            if (d0 < NEAR) {
+    private void drawMapSpeed(Canvas c, float w, float u) {
-                a0 = a;
+        chamfer(w / 2f - 130f * u, 80f * u, w / 2f + 130f * u, 232f * u, 14f * u);
-                d0 = d;
+        fill.setColor(0xC8000000);
-                cut = true;
+        c.drawPath(path, fill);
-            } else {
+        line.setColor(dim);
-                a1 = a;
+        line.setStrokeWidth(1.5f * u);
-                d1 = d;
+        c.drawPath(path, line);
-            }
+        text.setTypeface(thin);
-        }
+        text.setTextSize(120f * u);
-        float x0 = vx + a0 / MAP_UNIT_M * lane / d0, y0 = horizon + depth / d0;
+        text.setTextAlign(Paint.Align.CENTER);
-        float x1 = vx + a1 / MAP_UNIT_M * lane / d1, y1 = horizon + depth / d1;
+        glowText(c, fmt(v.speedKmh, "%.0f", "—"), w / 2f, 194f * u, light, u);
-        if (!penDown || cut || p != penPath || x0 != penX || y0 != penY) p.moveTo(x0, y0);
+        caption(c, "KM/H", w / 2f, 220f * u, u, Paint.Align.CENTER);
        p.lineTo(x1, y1);
        penPath = p;
        penX = x1;
        penY = y1;
        penDown = true;
    }
    /** Why the map is not there, on the floor. */
@@ -393,8 +343,13 @@ final class GridView extends ClusterCanvasView {
    // ---------- Power disc ----------
    /** Zero at the top, −50 kW a quarter turn anticlockwise, 150 kW three quarters clockwise. */
-    private void drawDisc(Canvas c, float w, float u) {
+    private void drawDisc(Canvas c, float w, boolean overMap, float u) {
        float cx = w - 170f * u, cy = 238f * u, outer = 132f * u, ring = 22f * u;
        if (overMap) {
            // The map runs under the disc: a dark backing keeps it readable.
            fill.setColor(0xD0000000);
            c.drawCircle(cx, cy, outer + 16f * u, fill);
        }
        line.setColor(dim);
        line.setStrokeWidth(1.5f * u);
        c.drawCircle(cx, cy, outer + 10f * u, line);
@@ -0,0 +1,156 @@
 package com.evsuite.abrp;
 import android.content.Context;
 import android.util.Log;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.OutputStreamWriter;
 import java.io.Writer;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 import java.util.regex.Pattern;
 import java.util.zip.GZIPOutputStream;
 /**
 * Files from the Logs tab (signal recordings) on their way to the car server, so they reach the
 * owner without a USB stick: kept in {@code files/log-outbox} until the server has them
 * ({@code PUT /v1/logs/{name}}, gzip, the ingest token in the header), sent at once and, when
 * that fails, again from the service's tick, at most every {@link #RETRY_MS}. At most
 * {@link #MAX_FILES} wait; the oldest goes first. Names are the app's own and say nothing about
 * where the car is.
 */
 final class LogOutbox {
    static final String DIR = "log-outbox";
    static final int MAX_FILES = 10;
    static final long RETRY_MS = 2 * 60_000L;
    private static final String TAG = "EVABRP.LogOutbox";
    /** As the server accepts them. */
    private static final Pattern NAME = Pattern.compile("[a-z0-9][a-z0-9-]{0,79}\\.txt");
    /** What to do with a file after the server's answer. */
    enum Outcome { SENT, DROP, KEEP }
    private static long lastFailureMs;
    private static String lastResult;
    private LogOutbox() {}
    /** SENT for a 2xx; KEEP for what may pass later (no answer, 401 before pairing, 408, 429,
     *  5xx, and a 404 from a server without logs yet); DROP for any other refusal. */
    static Outcome outcome(int status) {
        if (status >= 200 && status < 300) return Outcome.SENT;
        if (status <= 0 || status == 401 || status == 404 || status == 408 || status == 429 || status >= 500) {
            return Outcome.KEEP;
        }
        return Outcome.DROP;
    }
    static boolean validName(String name) {
        return name != null && NAME.matcher(name).matches();
    }
    /** The names to remove so that at most [max] remain: the oldest (by name, which starts
     *  with what they are and ends in the time) beyond the newest [max]. */
    static List<String> surplus(List<String> names, int max) {
        List<String> sorted = new ArrayList<>(names);
        Collections.sort(sorted);
        return sorted.size() <= max ? Collections.emptyList() : sorted.subList(0, sorted.size() - max);
    }
    /** Puts [text] in the outbox as [name]; false when it could not be written. */
    static synchronized boolean add(Context context, String name, List<String> text) {
        if (!validName(name)) return false;
        File dir = new File(context.getFilesDir(), DIR);
        if (!dir.isDirectory() && !dir.mkdirs()) return false;
        File tmp = new File(dir, name + ".tmp");
        try (Writer out = new OutputStreamWriter(new FileOutputStream(tmp), StandardCharsets.UTF_8)) {
            for (String line : text) out.write(line + "\n");
        } catch (Exception e) {
            tmp.delete();
            return false;
        }
        if (!tmp.renameTo(new File(dir, name))) {
            tmp.delete();
            return false;
        }
        for (String old : surplus(waiting(dir), MAX_FILES)) new File(dir, old).delete();
        lastFailureMs = 0; // something new: try at once
        return true;
    }
    /** Sends what waits, unless the last attempt failed less than {@link #RETRY_MS} ago. Blocking:
     *  call it off the main thread. */
    static void sendIfDue(Context context) {
        synchronized (LogOutbox.class) {
            if (lastFailureMs != 0 && System.currentTimeMillis() - lastFailureMs < RETRY_MS) return;
        }
        send(context);
    }
    /** Sends every waiting file, oldest first, until one fails. Blocking. */
    static synchronized void send(Context context) {
        File dir = new File(context.getFilesDir(), DIR);
        List<String> names = waiting(dir);
        if (names.isEmpty()) return;
        ServerConfig config = ServerConfig.get(context);
        if (!config.isConfigured()) {
            lastResult = "no server set up";
            lastFailureMs = System.currentTimeMillis();
            return;
        }
        Collections.sort(names);
        for (String name : names) {
            File file = new File(dir, name);
            int status;
            try {
                byte[] body = gzip(Files.readAllBytes(file.toPath()));
                status = ServerHttp.send("PUT", config.url + "/v1/logs/" + name, "Bearer " + config.token,
                        "text/plain; charset=utf-8", "gzip", body).status;
            } catch (Exception e) {
                Log.w(TAG, "Log not sent: " + e.getClass().getSimpleName());
                status = 0;
            }
            Outcome outcome = outcome(status);
            if (outcome == Outcome.KEEP) {
                lastResult = status == 0 ? "server not reached" : "server answered " + status;
                lastFailureMs = System.currentTimeMillis();
                return;
            }
            file.delete();
            lastResult = outcome == Outcome.SENT ? "sent" : "refused by the server (" + status + ")";
            Log.i(TAG, "Log " + name + ": " + lastResult);
        }
        lastFailureMs = 0;
    }
    /** For the Logs tab: whether the last file reached the server, or why not yet. */
    static synchronized String status(Context context) {
        int waiting = waiting(new File(context.getFilesDir(), DIR)).size();
        if (waiting == 0) return lastResult == null ? null : "sent".equals(lastResult)
                ? context.getString(R.string.log_outbox_sent) : lastResult;
        return context.getString(R.string.log_outbox_waiting, waiting, lastResult == null ? "…" : lastResult);
    }
    private static List<String> waiting(File dir) {
        String[] names = dir.list();
        List<String> out = new ArrayList<>();
        if (names == null) return out;
        for (String n : Arrays.asList(names)) if (validName(n)) out.add(n);
        return out;
    }
    private static byte[] gzip(byte[] data) throws java.io.IOException {
        ByteArrayOutputStream buf = new ByteArrayOutputStream(data.length / 4 + 64);
        try (GZIPOutputStream z = new GZIPOutputStream(buf)) {
            z.write(data);
        }
        return buf.toByteArray();
    }
 }
@@ -358,6 +358,8 @@ public class MainActivity extends AppCompatActivity {
                new QuestView(this), visorView, new EmpireView(this));
        View[] canvasPanes = new View[canvasStyles.size()];
        for (int i = 0; i < canvasPanes.length; i++) canvasPanes[i] = drawnPane(canvasStyles.get(i));
        // Grid with map: its map layer goes under it, in the same pane.
        ((android.widget.FrameLayout) canvasPanes[canvasStyles.indexOf(gridMapView)]).addView(gridMapView.mapLayer(), 0);
        View[] fixedPanes = { vehiclePane, gaugesPane, cockpitPane, retroPane,
                futuristicPane, sciFiPane, cartoonPane, mgPane };
        // By OverviewStyle ordinal: the fixed styles, then the canvas styles in their order.
@@ -0,0 +1,223 @@
 package com.evsuite.abrp;
 import android.content.Context;
 import android.graphics.Canvas;
 import android.graphics.Paint;
 import android.graphics.Path;
 import android.os.SystemClock;
 import android.view.View;
 /**
 * The map under "Grid with map": the roads round the car and a ground grid, straight from
 * above, heading up — drawn once into a hardware layer (a GPU texture) and then only moved and
 * turned, by the view's own translation and rotation, once per display frame. Nothing is
 * redrawn while driving until new tiles arrive or the car nears the layer's edge; then it is
 * drawn again round the car. {@link GridView} draws everything else on top.
 *
 * The layer is a square about twice the distance from the car to the farthest screen corner,
 * plus a margin, so it covers the screen at any angle; the car sits {@link #CAR_FROM_BOTTOM}
 * layout units above the bottom edge.
 */
 final class MapLayerView extends View {
    /** Pixels (layout units) per metre, the car's height above the bottom edge, grid spacing. */
    static final float MAP_SCALE = 1.2f, CAR_FROM_BOTTOM = 150f;
    private static final float GRID_M = 50f;
    /** How far the car may move from the layer's centre before it is drawn again, in layout units. */
    private static final float MARGIN = 280f;
    private final MapRoads map;
    private final Paint line = new Paint(Paint.ANTI_ALIAS_FLAG);
    private final Path[] roads = new Path[RoadTile.CLASSES];
    private final Path grid = new Path();
    private int main = 0xFF18E6FF, light = 0xFFC8FCFF;
    /** The layer's centre (world tile units) and what it was drawn from. */
    private double anchorX = Double.NaN, anchorY;
    private int drawnVersion = -1;
    private float drawnScale;
    /** The car as shown, eased towards where it is (world tile units), and the heading. */
    private double shownX = Double.NaN, shownY;
    private float heading = Float.NaN;
    private boolean showing, ticking;
    /** The car's speed, from the readings; NaN when unread. */
    private float speedMps = Float.NaN;
    MapLayerView(Context context, MapRoads map) {
        super(context);
        this.map = map;
        for (int i = 0; i < roads.length; i++) roads[i] = new Path();
        line.setStyle(Paint.Style.STROKE);
        line.setStrokeJoin(Paint.Join.ROUND);
        line.setStrokeCap(Paint.Cap.ROUND);
        setLayerType(LAYER_TYPE_HARDWARE, null);
        setVisibility(INVISIBLE);
        setWillNotDraw(false);
    }
    void setColours(int main, int light) {
        this.main = main;
        this.light = light;
        invalidate();
    }
    /** Whether the map is there to be seen (a fix and roads). */
    boolean isShowing() {
        return showing;
    }
    /** Layout units, as GridView uses them, for this size. */
    private float unit() {
        View parent = (View) getParent();
        int w = parent == null ? getWidth() : parent.getWidth() - parent.getPaddingLeft() - parent.getPaddingRight();
        int h = parent == null ? getHeight() : parent.getHeight() - parent.getPaddingTop() - parent.getPaddingBottom();
        return Math.min(h / 640f, w / 1100f);
    }
    @Override
    protected void onMeasure(int widthSpec, int heightSpec) {
        int w = MeasureSpec.getSize(widthSpec), h = MeasureSpec.getSize(heightSpec);
        float u = Math.min(h / 640f, w / 1100f);
        int side = (int) (2 * (Math.hypot(w / 2f, h - CAR_FROM_BOTTOM * u) + MARGIN * u));
        setMeasuredDimension(Math.max(side, 1), Math.max(side, 1));
    }
    /** The car's speed in km/h, or null when unread; GridView passes it with every reading. */
    void setSpeed(Float kmh) {
        speedMps = kmh == null ? Float.NaN : kmh / 3.6f;
    }
    /** Starts the frame loop if it is not running; GridView calls it with every reading. */
    void kick() {
        if (!ticking && isAttachedToWindow()) {
            ticking = true;
            postOnAnimation(this::tick);
        }
    }
    /** One display frame: where the car is, which way, and the layer moved there. */
    private void tick() {
        View pane = (View) getParent();
        if (pane == null || !pane.isShown()) {
            ticking = false;
            return;
        }
        MapRoads.Fix fix = map.fix();
        boolean ready = fix != null && !map.tiles().isEmpty() && getWidth() > 0;
        if (ready != showing) {
            showing = ready;
            setVisibility(ready ? VISIBLE : INVISIBLE);
        }
        if (!ready) {
            ticking = false;
            return;
        }
        float target = Float.isNaN(fix.bearing) ? (Float.isNaN(heading) ? 0f : heading) : fix.bearing;
        if (Float.isNaN(heading)) heading = target;
        else heading = (heading + (((target - heading) % 360f + 540f) % 360f - 180f) * 0.12f + 360f) % 360f;
        // Between fixes the car runs on with the speed (at most 2.5 s), and what is shown glides
        // there rather than jumping with each fix.
        double mpu = MapGeometry.metresPerUnit(fix.lat);
        float ran = Float.isNaN(fix.bearing) || Float.isNaN(speedMps) ? 0f
                : speedMps * Math.min(2.5f, (SystemClock.elapsedRealtime() - fix.elapsedMs) / 1000f);
        double run = Math.toRadians(Float.isNaN(fix.bearing) ? 0f : fix.bearing);
        double carX = MapGeometry.worldX(fix.lon) + ran * Math.sin(run) / mpu;
        double carY = MapGeometry.worldY(fix.lat) - ran * Math.cos(run) / mpu;
        if (Double.isNaN(shownX) || Math.hypot(carX - shownX, carY - shownY) * mpu > 200) {
            shownX = carX;
            shownY = carY;
        } else {
            shownX += (carX - shownX) * 0.15;
            shownY += (carY - shownY) * 0.15;
        }
        float u = unit(), px = MAP_SCALE * u;
        if (drawnVersion != map.version() || Double.isNaN(anchorX) || drawnScale != px
                || Math.hypot(shownX - anchorX, shownY - anchorY) * mpu * px > MARGIN * u) {
            build(shownX, shownY, mpu);
            drawnScale = px;
            invalidate(); // the only redraw of the layer
        }
        // The car's spot in the layer goes to its spot on screen, turned round it.
        float half = getWidth() / 2f;
        float inX = half + (float) ((shownX - anchorX) * mpu) * px;
        float inY = half + (float) ((shownY - anchorY) * mpu) * px;
        float carSx = pane.getPaddingLeft() + (pane.getWidth() - pane.getPaddingLeft() - pane.getPaddingRight()) / 2f;
        float carSy = pane.getHeight() - pane.getPaddingBottom() - CAR_FROM_BOTTOM * u;
        setPivotX(inX);
        setPivotY(inY);
        setRotation(-heading);
        setTranslationX(carSx - getLeft() - inX);
        setTranslationY(carSy - getTop() - inY);
        postOnAnimation(this::tick);
    }
    /** The roads and the grid in metres east and south of an anchor at the car. */
    private void build(double atX, double atY, double mpu) {
        anchorX = atX;
        anchorY = atY;
        drawnVersion = map.version();
        float m = (float) mpu;
        for (Path p : roads) p.reset();
        float u = unit();
        double reach = getWidth() / 2f / (MAP_SCALE * u);
        double range = reach / mpu;
        for (RoadTile tile : map.tiles()) {
            double ox = (double) tile.x * MapGeometry.EXTENT - atX, oy = (double) tile.y * MapGeometry.EXTENT - atY;
            if (ox > range || oy > range || ox + MapGeometry.EXTENT < -range || oy + MapGeometry.EXTENT < -range) {
                continue;
            }
            float fx = (float) ox, fy = (float) oy;
            for (int i = 0; i < tile.points.length; i++) {
                int[] b = tile.bounds[i];
                if (fx + b[2] < -range || fx + b[0] > range || fy + b[3] < -range || fy + b[1] > range) continue;
                Path p = roads[tile.classes[i]];
                int[] pts = tile.points[i];
                p.moveTo((fx + pts[0]) * m, (fy + pts[1]) * m);
                for (int k = 2; k < pts.length; k += 2) p.lineTo((fx + pts[k]) * m, (fy + pts[k + 1]) * m);
            }
        }
        // Grid lines on whole multiples of GRID_M east and north, so they stay put on the ground.
        grid.reset();
        float r = (float) reach;
        float offE = (float) ((atX * mpu) % GRID_M), offS = (float) ((atY * mpu) % GRID_M);
        int lines = (int) (r / GRID_M) + 1;
        for (int k = -lines; k <= lines; k++) {
            float x = k * GRID_M - offE, y = k * GRID_M - offS;
            grid.moveTo(x, -r);
            grid.lineTo(x, r);
            grid.moveTo(-r, y);
            grid.lineTo(r, y);
        }
    }
    @Override
    protected void onDraw(Canvas c) {
        if (Double.isNaN(anchorX) || drawnScale <= 0f) return;
        float u = unit(), px = drawnScale;
        c.save();
        c.translate(getWidth() / 2f, getHeight() / 2f);
        c.scale(px, px);
        stroke(c, grid, AccentColor.withAlpha(main, 0x26), 1f * u / px);
        stroke(c, roads[3], AccentColor.withAlpha(main, 0xA0), 1.6f * u / px);
        stroke(c, roads[2], AccentColor.withAlpha(main, 0xD8), 2.2f * u / px);
        glow(c, roads[1], main, 2.6f * u / px);
        glow(c, roads[0], light, 3.4f * u / px);
        c.restore();
    }
    private void stroke(Canvas c, Path p, int colour, float width) {
        line.setColor(colour);
        line.setStrokeWidth(width);
        c.drawPath(p, line);
    }
    /** As GridView's glow: two wide faint strokes under a sharp one. */
    private void glow(Canvas c, Path p, int colour, float width) {
        stroke(c, p, AccentColor.withAlpha(colour, 0x18), width * 6f);
        stroke(c, p, AccentColor.withAlpha(colour, 0x40), width * 3f);
        stroke(c, p, colour, width);
    }
 }
@@ -65,6 +65,8 @@ final class MapRoads {
        return t;
    });
    private volatile Fix fix;
    /** Goes up whenever a tile arrives or is dropped, so a view knows to rebuild its shapes. */
    private volatile int version;
    /** The last bearing while moving; GPS has none at a standstill. */
    private volatile float bearing = Float.NaN;
    private volatile boolean serverMissing;
@@ -100,6 +102,10 @@ final class MapRoads {
        return f == null || SystemClock.elapsedRealtime() - f.elapsedMs > FIX_FRESH_MS ? null : f;
    }
    int version() {
        return version;
    }
    Collection<RoadTile> tiles() {
        return tiles.values();
    }
@@ -116,7 +122,10 @@ final class MapRoads {
    /** Queues the 3×3 tiles round (cx, cy), the car's own first, and forgets far ones. */
    private void want(int cx, int cy) {
        for (Long key : tiles.keySet()) {
-            if (Math.abs(MapGeometry.keyX(key) - cx) > 2 || Math.abs(MapGeometry.keyY(key) - cy) > 2) tiles.remove(key);
+            if (Math.abs(MapGeometry.keyX(key) - cx) > 2 || Math.abs(MapGeometry.keyY(key) - cy) > 2) {
                tiles.remove(key);
                version++;
            }
        }
        int[][] order = { {0, 0}, {0, -1}, {1, 0}, {0, 1}, {-1, 0}, {1, -1}, {1, 1}, {-1, 1}, {-1, -1} };
        long now = SystemClock.elapsedRealtime();
@@ -152,6 +161,7 @@ final class MapRoads {
        }
        if (cached != null) {
            tiles.put(key, cached);
            version++;
            if (System.currentTimeMillis() - file.lastModified() < DISK_AGE_MS) return;
        }
        ServerConfig config = ServerConfig.get(context);
@@ -172,6 +182,7 @@ final class MapRoads {
            }
            failedAt.remove(key);
            tiles.put(key, tile);
            version++;
            save(file, r.body);
        } catch (Exception e) {
            Log.w(TAG, "Map tile not loaded: " + e.getClass().getSimpleName());
@@ -59,6 +59,12 @@ final class ServerHttp {
     */
    static Response send(String method, String url, String authorization, String contentType, byte[] body)
            throws Exception {
        return send(method, url, authorization, contentType, null, body);
    }
    /** As above, with a {@code Content-Encoding} ({@code "gzip"}) for the body, or null. */
    static Response send(String method, String url, String authorization, String contentType,
            String contentEncoding, byte[] body) throws Exception {
        HttpURLConnection connection = (HttpURLConnection) new URL(url).openConnection();
        try {
            connection.setRequestMethod(method);
@@ -69,6 +75,7 @@ final class ServerHttp {
                connection.setDoOutput(true);
                connection.setFixedLengthStreamingMode(body.length);
                connection.setRequestProperty("Content-Type", contentType);
                if (contentEncoding != null) connection.setRequestProperty("Content-Encoding", contentEncoding);
                try (OutputStream out = connection.getOutputStream()) { out.write(body); }
            }
            int status = connection.getResponseCode();
@@ -7,6 +7,8 @@ import android.content.IntentFilter;
 import android.os.Bundle;
 import android.os.Environment;
 import com.evsuite.hardware.AssistBlock;
 import com.evsuite.hardware.EVHardware;
 import com.evsuite.hardware.probe.VendorSurfaceProbe;
 import java.io.File;
@@ -26,15 +28,19 @@ import java.util.Map;
 * The signal recorder on the Logs tab: for {@link #DURATION_MS} it reads every value the
 * head unit offers (`VendorSurfaceProbe.capture`: every CarPropertyManager property and every
 * value getter of the vendor objects, read only) again and again, and every steering-wheel key
- * the head unit reports, into a {@link SignalRecording}. The driver notes the times they do
+ * the head unit reports, into a {@link SignalRecording}. It also listens, as the head unit's own
 * driver-assistance manager does, to the properties of the assistance block
 * ({@link AssistBlock}): subscribed for change events the whole time, because a value that is
 * only filled while someone listens reads as its default when polled (2.40.3, still the
 * cruise control). The driver notes the times they do
 * what is to be found; the values that change then are the leads. (Built to find the adaptive
 * cruise control, 2.32.0: on SWI68 the head unit gets none of it, see SPECS.md.)
 *
 * A full capture is far heavier than the Overview's reading, so the next one waits at least
 * {@link #MIN_INTERVAL_MS} and at least as long as the last one took: the recorder uses at most
 * half the time. It runs on its own thread, on after the app leaves the screen (the service
- * keeps the process), and stops by itself. At the end the recording goes to the app's storage
+ * keeps the process), and stops by itself. At the end the recording goes to the app's storage,
- * and to the app's folder on every USB stick plugged in.
+ * to the app's folder on every USB stick plugged in, and to the car server ({@link LogOutbox}).
 */
 final class SignalRecorder {
@@ -85,6 +91,22 @@ final class SignalRecorder {
        } catch (RuntimeException ignored) {
            // No key reports: the properties are recorded all the same.
        }
        EVHardware.PropertyListening listening = null;
        try {
            listening = EVHardware.INSTANCE.listenToProperties(AssistBlock.INSTANCE::contains,
                    (id, area, value) -> {
                        rec.event(System.currentTimeMillis(),
                                String.format(Locale.US, "CPM 0x%08X/%d", id, area), value);
                        return kotlin.Unit.INSTANCE;
                    });
        } catch (Throwable t) {
            rec.note(System.currentTimeMillis(), "listening failed: " + t.getClass().getSimpleName());
        }
        rec.note(System.currentTimeMillis(), listening == null
                ? "listening to the assistance properties: not possible ("
                        + EVHardware.INSTANCE.getListenProblem() + ")"
                : "listening to " + listening.getSubscribed() + " assistance properties ("
                        + listening.getRefused() + " refused)");
        try {
            long end = startedMs + DURATION_MS;
            while (running && System.currentTimeMillis() < end) {
@@ -99,6 +121,13 @@ final class SignalRecorder {
        } catch (Throwable t) {
            rec.note(System.currentTimeMillis(), "recorder stopped: " + t.getClass().getSimpleName());
        } finally {
            if (listening != null) {
                try {
                    listening.close();
                } catch (Throwable ignored) {
                    // the car service is gone
                }
            }
            if (keysRegistered) {
                try {
                    app.unregisterReceiver(keys);
@@ -130,7 +159,10 @@ final class SignalRecorder {
        text.add("Steering-wheel keys and notes:");
        text.addAll(rec.notes());
        text.add("");
-        text.add("Changed values, the rarest first:");
+        text.add("Assistance properties heard (" + rec.events() + " change events), changing ones first:");
        text.addAll(rec.heard());
        text.add("");
        text.add("Changed values (polled), the rarest first:");
        text.addAll(rec.summary());
        text.add("");
        text.add("Everything, in order:");
@@ -149,6 +181,12 @@ final class SignalRecorder {
                // A volume that cannot say what it is gets nothing.
            }
        }
        // And to the server, so it reaches the owner without a stick; the service sends it again
        // later when the car is offline now.
        if (LogOutbox.add(app, name, text)) {
            LogOutbox.send(app);
            places.add("for the server");
        }
        return places.isEmpty() ? "not saved" : "saved: " + String.join(", ", places);
    }
@@ -168,14 +206,19 @@ final class SignalRecorder {
        long elapsed = (running ? System.currentTimeMillis() : startedMs + DURATION_MS) - startedMs;
        if (running) {
            out.add(context.getString(R.string.signal_recorder_running, elapsed / 60_000, (elapsed / 1000) % 60,
-                    recording.captures()));
+                    recording.captures(), recording.events()));
        } else {
            out.add(context.getString(R.string.signal_recorder_done, SignalRecording.time(startedMs),
-                    recording.captures(), result == null ? "…" : result));
+                    recording.captures(), recording.events(), result == null ? "…" : result));
            String sent = LogOutbox.status(context);
            if (sent != null) out.add(sent);
        }
        // Steering-wheel keys and the like first: few, and each one a lead.
        List<String> notes = recording.notes();
        out.addAll(notes.subList(Math.max(0, notes.size() - 10), notes.size()));
        // Then what the listening heard, changing properties first.
        List<String> heard = recording.heard();
        for (String line : heard.subList(0, Math.min(12, heard.size()))) out.add("heard " + line);
        out.addAll(recording.summary());
        return out;
    }
@@ -16,6 +16,10 @@ import java.util.TreeSet;
 * feature on and off, changes a setting). It keeps what changed, when, and per value how
 * often and through which values, so the value that follows the action stands out: it
 * changes a few times, at the moments the driver noted.
 *
 * Besides the captures (polled), it keeps the change events of the properties the recorder
 * listens to ({@link #event}): how many per property and through which values. A value the
 * head unit only fills while someone listens shows up there and nowhere else.
 * Pure Java, unit-tested.
 */
 final class SignalRecording {
@@ -31,6 +35,10 @@ final class SignalRecording {
    private final List<String> notes = new ArrayList<>();
    private final Map<String, Integer> changes = new HashMap<>();
    private final Map<String, LinkedHashSet<String>> seen = new HashMap<>();
    private int events;
    private final Map<String, String> lastEvent = new HashMap<>();
    private final Map<String, Integer> eventCounts = new HashMap<>();
    private final Map<String, LinkedHashSet<String>> eventValues = new HashMap<>();
    static String time(long ms) {
        return new SimpleDateFormat("HH:mm:ss", Locale.US).format(new Date(ms));
@@ -65,6 +73,45 @@ final class SignalRecording {
        notes.add(time(ms) + "  " + what);
    }
    /**
     * A change event from a property listened to. Every one is counted; the timeline gets a
     * line only when the value differs from that property's last event.
     */
    synchronized void event(long ms, String key, String value) {
        events++;
        eventCounts.merge(key, 1, Integer::sum);
        String before = lastEvent.put(key, value);
        if (value.equals(before)) return;
        lines.add(time(ms) + "  heard " + key + " = " + value);
        LinkedHashSet<String> values = eventValues.computeIfAbsent(key, k -> new LinkedHashSet<>());
        if (values.size() < VALUES_KEPT) values.add(shorten(value));
    }
    synchronized int events() {
        return events;
    }
    /**
     * Every property that sent events: first those that sent different values, the fewest
     * events first (the leads), then those that only ever repeated one value.
     */
    synchronized List<String> heard() {
        List<String> keys = new ArrayList<>(eventCounts.keySet());
        keys.sort((a, b) -> {
            boolean va = eventValues.get(a).size() > 1, vb = eventValues.get(b).size() > 1;
            if (va != vb) return va ? -1 : 1;
            int c = Integer.compare(eventCounts.get(a), eventCounts.get(b));
            return c != 0 ? c : a.compareTo(b);
        });
        List<String> out = new ArrayList<>();
        for (String key : keys) {
            LinkedHashSet<String> values = eventValues.get(key);
            out.add(key + "  " + eventCounts.get(key) + " events  " + String.join(" → ", values)
                    + (values.size() >= VALUES_KEPT ? " …" : ""));
        }
        return out;
    }
    /** The notes alone, in order. */
    synchronized List<String> notes() {
        return new ArrayList<>(notes);
@@ -223,11 +223,13 @@
    <string name="drive_mode_unreadable">Not changed: speed or gear unreadable.</string>
    <string name="drive_mode_unknown">an unknown mode (%1$s)</string>
    <string name="label_signal_recorder">Signal recorder</string>
-    <string name="signal_recorder_hint">Records every value the head unit offers for 3 minutes, plus the steering-wheel keys it reports, and lists what changed, the rarest first. To find a signal: start it, note the times you switch the feature on and off or change it, and look for the values that changed then. With a USB stick plugged in, the whole recording is saved on it too (Android/data/…/files).</string>
+    <string name="signal_recorder_hint">Records every value the head unit offers for 3 minutes, listens to the driver-assistance properties for every change they report, and notes the steering-wheel keys; then lists what changed, the rarest first. To find a signal: start it, note the times you switch the feature on and off or change it, and look for the values that changed then. The whole recording goes to your server (later, if the car is offline), and with a USB stick plugged in it is saved on it too (Android/data/…/files).</string>
    <string name="btn_signal_record">Record 3 minutes</string>
    <string name="btn_signal_stop">Stop recording</string>
-    <string name="signal_recorder_running">Recording: %1$d:%2$02d of 3:00, %3$d captures. Keys reported, then values changed so far, the rarest first:</string>
+    <string name="signal_recorder_running">Recording: %1$d:%2$02d of 3:00, %3$d captures, %4$d change events heard. Keys reported, then assistance properties heard, then values changed so far, the rarest first:</string>
-    <string name="signal_recorder_done">Recording from %1$s: %2$d captures, %3$s. Keys reported, then values changed, the rarest first:</string>
+    <string name="signal_recorder_done">Recording from %1$s: %2$d captures, %3$d change events heard, %4$s. Keys reported, then assistance properties heard, then values changed, the rarest first:</string>
    <string name="log_outbox_sent">Sent to the server.</string>
    <string name="log_outbox_waiting">Not on the server yet (%1$d waiting: %2$s); it is sent again every 2 minutes.</string>
    <string name="call_log_empty">No upload attempted yet.</string>
    <string name="update_log_title">Updates, newest first:</string>
    <string name="btn_flush_now">Upload now</string>
@@ -0,0 +1,45 @@
 package com.evsuite.abrp;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 import org.junit.Test;
 import java.util.Arrays;
 import java.util.Collections;
 public class LogOutboxTest {
    @Test
    public void whatTheServerSaysDecidesTheFile() {
        assertEquals(LogOutbox.Outcome.SENT, LogOutbox.outcome(204));
        assertEquals(LogOutbox.Outcome.SENT, LogOutbox.outcome(200));
        // Worth another try: no answer, not paired yet, a server without logs yet, busy, broken.
        for (int status : new int[] {0, 401, 404, 408, 429, 500, 502, 503}) {
            assertEquals(String.valueOf(status), LogOutbox.Outcome.KEEP, LogOutbox.outcome(status));
        }
        // Refused for good: it would never pass.
        for (int status : new int[] {400, 403, 413, 415}) {
            assertEquals(String.valueOf(status), LogOutbox.Outcome.DROP, LogOutbox.outcome(status));
        }
    }
    @Test
    public void namesAreTheServersKind() {
        assertTrue(LogOutbox.validName("signal-recording-20261027-085240.txt"));
        assertFalse(LogOutbox.validName("signal-recording-20261027-085240.txt.tmp"));
        assertFalse(LogOutbox.validName("../escape.txt"));
        assertFalse(LogOutbox.validName("Upper.txt"));
        assertFalse(LogOutbox.validName(null));
    }
    @Test
    public void theOldestGoBeyondTheLimit() {
        assertEquals(Arrays.asList("signal-recording-20261027-084921.txt"),
                LogOutbox.surplus(Arrays.asList("signal-recording-20261027-085240.txt",
                        "signal-recording-20261027-084921.txt", "signal-recording-20261027-090000.txt"), 2));
        assertEquals(Collections.emptyList(),
                LogOutbox.surplus(Collections.singletonList("signal-recording-20261027-085240.txt"), 2));
    }
 }
@@ -63,4 +63,22 @@ public class SignalRecordingTest {
        assertTrue(r.lines().get(4).endsWith("key 287 down"));
        assertEquals(1, r.notes().size());
    }
    @Test
    public void heardPropertiesWithChangingValuesComeFirst() {
        SignalRecording r = new SignalRecording();
        for (int i = 0; i < 5; i++) r.event(i * 1000, "CPM 0x2140A10A/0", "1"); // repeats one value
        r.event(1000, "CPM 0x2160A15B/0", "0.0");
        r.event(2000, "CPM 0x2160A15B/0", "101.0");
        r.event(3000, "CPM 0x2160A15B/0", "101.0");
        r.event(4000, "CPM 0x2160A15B/0", "90.0");
        List<String> heard = r.heard();
        assertEquals(2, heard.size());
        assertEquals("CPM 0x2160A15B/0  4 events  0.0 → 101.0 → 90.0", heard.get(0));
        assertEquals("CPM 0x2140A10A/0  5 events  1", heard.get(1));
        assertEquals(9, r.events());
        // The timeline holds only the changes: 0.0, 101.0, 90.0 and the first 1.
        long lines = r.lines().stream().filter(l -> l.contains("heard ")).count();
        assertEquals(4, lines);
    }
 }
@@ -16,10 +16,17 @@ import android.widget.Toast;
 * STATUS_PENDING_USER_ACTION is the case worth understanding: the platform is saying it will
 * install, but wants the driver to confirm. That happens when the app is not granted a silent
 * install, and the only correct response is to launch the confirmation activity it hands us.
 *
 * Any other failure — on the car the session is refused, "Not allowed to install non-system
 * apps on internal storage", and that answer can come here rather than as an exception — opens
 * Android's installer screen with the verified APK, as {@link OtaUpdater#install} does for an
 * immediate refusal. Only a cancel by the driver ends there.
 */
 public final class OtaInstallResultReceiver extends BroadcastReceiver {
    static final String ACTION_INSTALL_RESULT = "com.stinnesbeck.nilsmg4.OTA_INSTALL_RESULT";
    static final String EXTRA_APK = "com.stinnesbeck.nilsmg4.extra.APK";
    static final String EXTRA_SESSION = "com.stinnesbeck.nilsmg4.extra.SESSION";
    private static final String TAG = "EVABRP.Update";
@@ -31,12 +38,16 @@ public final class OtaInstallResultReceiver extends BroadcastReceiver {
        Log.i(TAG, "OTA install result: status=" + status + " msg=" + message);
        UpdateLog.record(context, "Install result: status " + status
                + (message != null ? ", " + message : ""));
        int session = intent.getIntExtra(EXTRA_SESSION, -1);
        if (session >= 0) OtaUpdater.noteAnswer(session);
        String apkPath = intent.getStringExtra(EXTRA_APK);
        switch (status) {
            case PackageInstaller.STATUS_PENDING_USER_ACTION:
                Intent confirm = intent.getParcelableExtra(Intent.EXTRA_INTENT);
                if (confirm == null) {
-                    toast(context, context.getString(R.string.ota_install_failed, "no confirm intent"));
+                    UpdateLog.record(context, "No confirmation screen offered");
                    openInstallerScreen(context, apkPath, "no confirm intent");
                    return;
                }
                confirm.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
@@ -44,23 +55,52 @@ public final class OtaInstallResultReceiver extends BroadcastReceiver {
                    context.startActivity(confirm);
                } catch (Throwable t) {
                    Log.e(TAG, "OTA confirm UI failed: " + t.getMessage());
-                    toast(context, context.getString(R.string.ota_install_failed,
+                    UpdateLog.record(context, "Confirmation screen failed: " + t.getClass().getSimpleName());
-                            t.getClass().getSimpleName()));
+                    openInstallerScreen(context, apkPath, t.getClass().getSimpleName());
                }
                break;
            case PackageInstaller.STATUS_SUCCESS:
                toast(context, context.getString(R.string.ota_install_success));
                break;
            case PackageInstaller.STATUS_FAILURE_ABORTED:
                // The driver cancelled: nothing opens again.
                toast(context, context.getString(R.string.ota_install_failed,
                        message != null ? message : "cancelled"));
                break;
            default:
                // The status message is the package manager's own words — INSTALL_FAILED_*
-                // and friends. Surfaced verbatim, because guessing at it is what made the
+                // and friends — kept verbatim in the update log, because guessing at it is what
-                // previous failure unreadable.
+                // made an earlier failure unreadable. Then the installer screen, which the car
-                toast(context, context.getString(R.string.ota_install_failed,
+                // allows where it refuses the session.
-                        message != null ? message : "status " + status));
+                openInstallerScreen(context, apkPath, message != null ? message : "status " + status);
                break;
        }
    }
    /**
     * Opens Android's installer screen for the APK at [apkPath] off the main thread (it is
     * copied to Downloads first); a toast with [why] when there is none or it cannot open.
     */
    private void openInstallerScreen(Context context, String apkPath, String why) {
        java.io.File apk = apkPath == null ? null : new java.io.File(apkPath);
        if (apk == null || !apk.isFile()) {
            toast(context, context.getString(R.string.ota_install_failed, why));
            return;
        }
        PendingResult pending = goAsync();
        Context app = context.getApplicationContext();
        new Thread(() -> {
            try {
                if (!OtaUpdater.openInstallerScreen(app, apk)) {
                    new android.os.Handler(android.os.Looper.getMainLooper()).post(() ->
                            toast(app, app.getString(R.string.ota_install_failed, why)));
                }
            } finally {
                pending.finish();
            }
        }, "ota-fallback").start();
    }
    private static void toast(Context context, String text) {
        Toast.makeText(context.getApplicationContext(), text, Toast.LENGTH_LONG).show();
    }
@@ -464,23 +464,59 @@ final class OtaUpdater {
    static InstallResult install(Context context, File apk) {
        if (!archiveIsThisPackage(context, apk)) return InstallResult.UNREADABLE_ARCHIVE;
        try {
-            commitSession(context, apk);
+            int sessionId = commitSession(context, apk);
            watchForAnswer(context, sessionId, apk);
            return InstallResult.SESSION_STARTED;
        } catch (Throwable t) {
            Log.w(TAG, "OTA session install failed; trying system install UI", t);
            UpdateLog.record(context, "Installer session failed: " + t);
-            try {
+            return openInstallerScreen(context, apk) ? InstallResult.INSTALL_UI_STARTED : InstallResult.SESSION_FAILED;
                launchInstallerActivity(context, apk);
                UpdateLog.record(context, "Opened the system installer instead");
                return InstallResult.INSTALL_UI_STARTED;
            } catch (Throwable fallback) {
                Log.w(TAG, "OTA install UI failed", fallback);
                UpdateLog.record(context, "System installer failed too: " + fallback);
                return InstallResult.SESSION_FAILED;
            }
        }
    }
    /** The installer screen for [apk], as the fallback; false if even that could not open. */
    static boolean openInstallerScreen(Context context, File apk) {
        try {
            launchInstallerActivity(context, apk);
            UpdateLog.record(context, "Opened the system installer instead");
            return true;
        } catch (Throwable fallback) {
            Log.w(TAG, "OTA install UI failed", fallback);
            UpdateLog.record(context, "System installer failed too: " + fallback);
            return false;
        }
    }
    /** How long a committed session may stay silent before the installer screen is opened. */
    private static final long ANSWER_WAIT_MS = 20_000L;
    /** Sessions the platform has answered (any status), so the watch knows to stand down. */
    private static final java.util.Set<Integer> answered =
            java.util.Collections.synchronizedSet(new java.util.HashSet<>());
    /** The platform said something about [sessionId]; called by {@link OtaInstallResultReceiver}. */
    static void noteAnswer(int sessionId) {
        answered.add(sessionId);
    }
    /**
     * A committed session normally answers within a second or two: installed (the app
     * restarts), refused, or "confirm on screen". If it says nothing at all, the update would
     * end silently after its download, so the installer screen is opened instead.
     */
    private static void watchForAnswer(Context context, int sessionId, File apk) {
        Context app = context.getApplicationContext();
        new android.os.Handler(android.os.Looper.getMainLooper()).postDelayed(() -> {
            if (answered.contains(sessionId)) return;
            UpdateLog.record(app, "No answer from the installer after " + ANSWER_WAIT_MS / 1000 + " s");
            try {
                app.getPackageManager().getPackageInstaller().abandonSession(sessionId);
            } catch (Throwable ignored) {
                // already gone
            }
            new Thread(() -> openInstallerScreen(app, apk), "ota-fallback").start();
        }, ANSWER_WAIT_MS);
    }
    /**
     * True if the archive parses and declares our own package name.
     *
@@ -510,7 +546,8 @@ final class OtaUpdater {
        }
    }
-    private static void commitSession(Context context, File apk) throws Exception {
+    /** Commits [apk] to a new installer session and returns its id. */
    private static int commitSession(Context context, File apk) throws Exception {
        PackageInstaller installer = context.getPackageManager().getPackageInstaller();
        PackageInstaller.SessionParams params = new PackageInstaller.SessionParams(
                PackageInstaller.SessionParams.MODE_FULL_INSTALL);
@@ -533,7 +570,10 @@ final class OtaUpdater {
            }
            Intent callback = new Intent(context, OtaInstallResultReceiver.class)
                    .setAction(OtaInstallResultReceiver.ACTION_INSTALL_RESULT)
-                    .setPackage(context.getPackageName());
+                    .setPackage(context.getPackageName())
                    // Where the verified APK is, for the installer screen if the session fails.
                    .putExtra(OtaInstallResultReceiver.EXTRA_APK, apk.getAbsolutePath())
                    .putExtra(OtaInstallResultReceiver.EXTRA_SESSION, sessionId);
            // MUTABLE: the platform fills in EXTRA_STATUS and, when it wants the driver to
            // confirm, EXTRA_INTENT. An immutable PendingIntent would arrive empty.
            PendingIntent pending = PendingIntent.getBroadcast(context, sessionId, callback,
@@ -543,6 +583,7 @@ final class OtaUpdater {
            session.commit(pending.getIntentSender());
            committed = true;
            Log.i(TAG, "OTA session " + sessionId + " committed (" + apk.length() + " bytes)");
            return sessionId;
        } finally {
            // Abandon failed staging, but always close our local handle after a commit too.
            if (!committed) {
@@ -161,10 +161,46 @@
              echo "Published $tag ($(basename "$apk") and .sha256) at $forge/$repo/releases/tag/$tag"
            '';
          };
          # Fetches the files the car sent from its Logs tab (signal recordings) from the car
          # server into logs/ (gitignored), those not there yet. Needs the server's LOGS_TOKEN,
          # from $LOGS_TOKEN or ~/.config/nilsmg4/logs-token; sent in a header, never printed.
          fetchLogs = pkgs.writeShellApplication {
            name = "fetch-logs";
            runtimeInputs = [ pkgs.curl pkgs.jq pkgs.coreutils pkgs.git ];
            text = ''
              server=''${SERVER_URL:-https://car.k8s.stinnesbeck.com}
              token=''${LOGS_TOKEN:-}
              if [ -z "$token" ] && [ -f "$HOME/.config/nilsmg4/logs-token" ]; then
                token=$(tr -d '[:space:]' < "$HOME/.config/nilsmg4/logs-token")
              fi
              if [ -z "$token" ]; then
                echo "fetch-logs: no token. Put the server's LOGS_TOKEN in ~/.config/nilsmg4/logs-token (or \$LOGS_TOKEN)." >&2
                exit 1
              fi
              root=$(git rev-parse --show-toplevel)
              mkdir -p "$root/logs"
              auth=(-H "Authorization: Bearer $token")
              fetched=0
              while IFS= read -r name; do
                # The server only stores such names; anything else is not a path to write to.
                if ! [[ "$name" =~ ^[a-z0-9][a-z0-9-]{0,79}\.txt$ ]]; then
                  echo "fetch-logs: skipping an unexpected name" >&2
                  continue
                fi
                [ -f "$root/logs/$name" ] && continue
                curl -sSf "''${auth[@]}" -o "$root/logs/$name.part" "$server/v1/logs/$name"
                mv "$root/logs/$name.part" "$root/logs/$name"
                echo "logs/$name"
                fetched=$((fetched + 1))
              done < <(curl -sSf "''${auth[@]}" "$server/v1/logs" | jq -r '.logs[].name')
              echo "fetch-logs: $fetched new"
            '';
          };
        in
        {
          default = pkgs.mkShell {
-            packages = [ jdk android.androidsdk buildCar publishCar pkgs.go pkgs.gopls pkgs.govulncheck pkgs.influxdb2-server pkgs.influxdb2-cli ];
+            packages = [ jdk android.androidsdk buildCar publishCar fetchLogs pkgs.go pkgs.gopls pkgs.govulncheck pkgs.influxdb2-server pkgs.influxdb2-cli ];
            ANDROID_HOME = sdk;
            ANDROID_SDK_ROOT = sdk;
@@ -179,6 +215,7 @@
              echo "  ./gradlew assembleUnstableDebug   # build that can update itself (OTA)"
              echo "  build-car                         # unstable build signed for the car"
              echo "  publish-car                       # publish it for the in-app updater"
              echo "  fetch-logs                        # the car's recordings from the server, into logs/"
            '';
          };
        });
@@ -7,7 +7,7 @@ is applied automatically. Apply them yourself.
 |---|---|
 | `namespace.yaml` | Namespace `mg4` |
 | `influxdb.yaml` | InfluxDB 2.7.12 StatefulSet (10Gi PVC, default storage class), cluster-internal Service, NetworkPolicy admitting only the server and Grafana |
-| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem) and Service |
+| `server.yaml` | Go server Deployment (1 replica, non-root, read-only root filesystem), Service, and two 1Gi PVCs: the map tile cache and the logs the car sends |
 | `grafana.yaml` | Grafana 13.2.3 Deployment (1Gi PVC), Service; datasource and dashboards provisioned |
 | `grafana/` | The provisioned InfluxDB datasource and the MG4 dashboards (Live, Consumption, Charging) |
 | `ingress.yaml` | Traefik `IngressRoute`s for car.k8s.stinnesbeck.com and Grafana, TLS from Traefik's default certificate |
@@ -22,7 +22,8 @@ is applied automatically. Apply them yourself.
   covered by Traefik's default certificate.
 2. **Create the Secrets.** `cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml` (gitignored), replace
   every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,
-   approval password for pairing, the forge token for app updates) and `grafana-admin`.
+   approval password for pairing, the forge token for app updates, the token that reads the
   car's logs) and `grafana-admin`.
   Keep the template itself on placeholders only.
 3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
   secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
@@ -54,6 +55,14 @@ the forge that can only **read** the `nils/mg4` repository, put it there, apply
 restart the server. Without it, updates are off (the car's updater gets a 404). `FORGE_URL`
 and `FORGE_REPO` are set in `server.yaml`.
 ## Logs from the car
 The car sends its signal recordings to the server (`server/README.md`, "Logs from the car"),
 which keeps them on the `mg4-server-logs` volume at `LOGS_DIR`. Reading them needs `LOGS_TOKEN`
 from the `mg4-server` Secret: `openssl rand -hex 32`, put it there (it must differ from
 `INGEST_TOKEN`), apply the Secret and restart the server. For `fetch-logs` on your machine, put
 the same value in `~/.config/nilsmg4/logs-token`. Without it the car still sends; nobody can read.
 ## Agent access
 [`agent-access/`](agent-access/README.md) creates a service account limited to the `mg4`
@@ -30,6 +30,9 @@ stringData:
  # relays the releases to the car; k8s/README.md, "App updates"). Leave it empty to switch
  # updates off.
  FORGE_TOKEN: CHANGE-ME-read-only-forge-token
  # Reads the files the car sends from its Logs tab (GET /v1/logs). At least 24 characters and
  # not the INGEST_TOKEN. Leave it empty to switch reading off; the car can still send.
  LOGS_TOKEN: CHANGE-ME-openssl-rand-hex-32
 ---
 apiVersion: v1
 kind: Secret
@@ -16,6 +16,22 @@ spec:
    requests:
      storage: 1Gi
 ---
 # The files the car sends from its Logs tab (signal recordings), read with LOGS_TOKEN. Unlike
 # the map cache these are not fetched again, so they get a volume of their own.
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: mg4-server-logs
  namespace: mg4
  labels:
    app.kubernetes.io/name: mg4-server
    app.kubernetes.io/part-of: mg4
 spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 1Gi
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -47,7 +63,7 @@ spec:
      containers:
        - name: server
          # Pinned by digest so a re-pushed tag cannot change what runs (version in SPECS.md).
-          image: git.stinnesbeck.com/nils/mg4-server@sha256:e5da9452a9dbdfabe3340766cc51f18bb1418b2588ab534714550470abe1ce29
+          image: git.stinnesbeck.com/nils/mg4-server@sha256:8b8d94e0562833d196162866b7fdc6910d5dd219f6eb84572d4d5c91b74f7ff1
          ports:
            - name: http
              containerPort: 8080
@@ -73,12 +89,16 @@ spec:
              value: https://tiles.openfreemap.org/planet
            - name: MAP_CACHE_DIR
              value: /var/cache/mg4-maps
            # Files from the car's Logs tab, kept on the volume below (the newest 200, at most
            # 180 days). Reading them needs LOGS_TOKEN from the Secret; empty switches reading off.
            - name: LOGS_DIR
              value: /var/lib/mg4-logs
            - name: INFLUX_TOKEN
              valueFrom:
                secretKeyRef:
                  name: influxdb-auth
                  key: admin-token
-          # INGEST_TOKEN, APPROVAL_PASSWORD, FORGE_TOKEN.
+          # INGEST_TOKEN, APPROVAL_PASSWORD, FORGE_TOKEN, LOGS_TOKEN.
          envFrom:
            - secretRef:
                name: mg4-server
@@ -107,10 +127,15 @@ spec:
          volumeMounts:
            - name: maps
              mountPath: /var/cache/mg4-maps
            - name: logs
              mountPath: /var/lib/mg4-logs
      volumes:
        - name: maps
          persistentVolumeClaim:
            claimName: mg4-server-maps
        - name: logs
          persistentVolumeClaim:
            claimName: mg4-server-logs
 ---
 apiVersion: v1
 kind: Service
@@ -25,6 +25,8 @@ Environment only; the server refuses to start when a required value is missing.
 | `FORGE_URL`, `FORGE_REPO`, `FORGE_TOKEN` | optional; app updates (below). The token only needs to read the repository |
 | `MAP_TILES_URL` | a TileJSON naming the vector tiles the map's roads come from; default OpenFreeMap's `https://tiles.openfreemap.org/planet`, `off` switches maps off, otherwise https only |
 | `MAP_CACHE_DIR` | where fetched map tiles are kept across restarts (the manifest mounts a volume there); empty keeps them in memory only |
 | `LOGS_DIR` | where the files the car sends from its Logs tab are kept (the manifest mounts a volume there); empty switches logs off |
 | `LOGS_TOKEN` | optional, at least 24 characters and not the `INGEST_TOKEN`; reads those files (below). Empty: the car can send, nobody can read |
 | `LISTEN_ADDR` | default `:8080` |
 ## Endpoints
@@ -43,6 +45,7 @@ with (403 otherwise); the shared token works for any.
 - `PUT /v1/charging-sessions/{sessionId}` — a finished charging session (AC or DC, as far as the car was awake) with its curve.
 - `GET /v1/consumption/history/{installationId}` — the car reads its own totals back.
 - `GET /v1/health` — `{"status":"ok"}`.
 - `PUT /v1/logs/{name}` — a file from the car's Logs tab (below).
 A malformed request is a 400 naming the field; a database failure is a 500 without detail.
@@ -79,6 +82,26 @@ and is kept, and the car hears 503 with `Retry-After: 10` and gets the tile on i
 404 when maps are off. The log says `map tile fetched` with the size, never the tile.
 Map data © OpenStreetMap contributors (ODbL), tiles © OpenMapTiles, served by OpenFreeMap.
 ## Logs from the car
 So a signal recording reaches the owner without a USB stick. The car sends each one when it ends
 (again later when it is offline) with its own token: `PUT /v1/logs/{name}`, plain UTF-8 text,
 gzipped (`Content-Encoding: gzip`) or not; at most 2 MB as sent and 8 MB unpacked. The name is
 the app's (`signal-recording-20261027-085240.txt`: lower-case letters, digits and dashes,
 `.txt`); the same name again replaces the file, so a retry is harmless. 204 when stored. The
 newest 200 files are kept, none older than 180 days.
 Reading takes `LOGS_TOKEN`, which can do nothing else, and the car's token cannot read:
 ```sh
 curl -H "Authorization: Bearer $LOGS_TOKEN" https://car.k8s.stinnesbeck.com/v1/logs          # {logs: [{name, bytes, received}]}, newest first
 curl -H "Authorization: Bearer $LOGS_TOKEN" https://car.k8s.stinnesbeck.com/v1/logs/<name>   # the text
 ```
 `fetch-logs` in the dev shell fetches the new ones into `logs/` (token from
 `~/.config/nilsmg4/logs-token`). 404 when reading is off. The log says `log received` with the
 name and size, never the contents.
 ## Settings from a phone
 The ABRP credentials are long to type on the car. With pairing on, the car (with its own token)
@@ -21,6 +21,7 @@ import (
 //	     /v1/settings/…, /settings                settings typed on a phone (handoff_http.go)
 //	GET  /v1/app/…                               app updates from the forge (releases.go)
 //	POST /v1/map/roads                           the roads of one map tile (maps.go)
 //	     /v1/logs/…                              files from the Logs tab, read with LOGS_TOKEN (logs.go)
 //
 // A car authenticates with the shared INGEST_TOKEN or with its own token from pairing
 // (pairing_http.go).
@@ -34,6 +35,8 @@ type API struct {
 	Releases *Releases
 	// Maps serves the roads for the Overview's map from OpenStreetMap vector tiles (maps.go); nil is off.
 	Maps *Maps
 	// Logs keeps the files the car sends from its Logs tab (logs.go); nil is off.
 	Logs *Logs
 	// PublicURL is the server's address as a phone reaches it, for the pairing QR code;
 	// derived from the request when empty.
 	PublicURL string
@@ -54,6 +57,7 @@ func (a *API) Routes() http.Handler {
 	a.handoffRoutes(mux)
 	a.releaseRoutes(mux)
 	a.mapRoutes(mux)
 	a.logRoutes(mux)
 	return mux
 }
@@ -0,0 +1,248 @@
 package main
 import (
 	"bytes"
 	"compress/gzip"
 	"crypto/subtle"
 	"errors"
 	"io"
 	"log/slog"
 	"net/http"
 	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
 	"sync"
 	"time"
 	"unicode/utf8"
 )
 // Logs keeps the text files the car sends from its Logs tab (signal recordings) on a volume,
 // so they reach the owner without a USB stick. The car sends with its ingest token; reading
 // needs LOGS_TOKEN, a token of its own, so neither the car's token can read them nor this one
 // write anything.
 //
 //	PUT /v1/logs/{name}   one file from the car (ingest token); the same name again replaces it
 //	GET /v1/logs          the files, newest first (LOGS_TOKEN)
 //	GET /v1/logs/{name}   one file (LOGS_TOKEN)
 //
 // The newest maxLogFiles files younger than maxLogAge are kept. A file's contents never go to
 // the server log, only its name and size.
 type Logs struct {
 	Dir string
 	// ReadToken is LOGS_TOKEN; empty switches reading off (the car can still send).
 	ReadToken string
 	mu  sync.Mutex
 	now func() time.Time
 }
 const (
 	maxLogWireBytes = 2 << 20 // as sent, gzip or not
 	maxLogBytes     = 8 << 20 // as stored
 	maxLogFiles     = 200
 	maxLogAge       = 180 * 24 * time.Hour
 )
 // logName is what a file may be called: the app's own names, e.g. signal-recording-20261027-085240.txt.
 var logName = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{0,79}\.txt$`)
 // NewLogs keeps the files in dir, which must exist.
 func NewLogs(dir, readToken string) *Logs {
 	return &Logs{Dir: dir, ReadToken: readToken, now: time.Now}
 }
 func (a *API) logRoutes(mux *http.ServeMux) {
 	if a.Logs == nil {
 		return
 	}
 	mux.HandleFunc("PUT /v1/logs/{name}", a.putLog)
 	mux.HandleFunc("GET /v1/logs", a.Logs.list)
 	mux.HandleFunc("GET /v1/logs/{name}", a.Logs.get)
 }
 func (a *API) putLog(w http.ResponseWriter, r *http.Request) {
 	if _, ok := a.authenticate(r); !ok {
 		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unauthorized"})
 		return
 	}
 	name := r.PathValue("name")
 	if !logName.MatchString(name) {
 		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "name must be lower-case letters, digits and dashes, ending in .txt"})
 		return
 	}
 	text, status, msg := readLogBody(r)
 	if status != 0 {
 		writeJSON(w, status, map[string]string{"error": msg})
 		return
 	}
 	if err := a.Logs.save(name, text); err != nil {
 		slog.Error("log not stored", "name", name, "error", err)
 		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "internal server error"})
 		return
 	}
 	slog.Info("log received", "name", name, "bytes", len(text))
 	w.WriteHeader(http.StatusNoContent)
 }
 // readLogBody is the request's text, un-gzipped when it says so; a status and message when it
 // is too large, not gzip after all, or not UTF-8 text.
 func readLogBody(r *http.Request) ([]byte, int, string) {
 	wire, err := io.ReadAll(io.LimitReader(r.Body, maxLogWireBytes+1))
 	if err != nil {
 		return nil, http.StatusBadRequest, "body could not be read"
 	}
 	if len(wire) > maxLogWireBytes {
 		return nil, http.StatusRequestEntityTooLarge, "body is too large"
 	}
 	text := wire
 	switch strings.ToLower(r.Header.Get("Content-Encoding")) {
 	case "", "identity":
 	case "gzip":
 		zr, err := gzip.NewReader(bytes.NewReader(wire))
 		if err != nil {
 			return nil, http.StatusBadRequest, "body is not gzip"
 		}
 		text, err = io.ReadAll(io.LimitReader(zr, maxLogBytes+1))
 		if err != nil {
 			return nil, http.StatusBadRequest, "body is not gzip"
 		}
 	default:
 		return nil, http.StatusUnsupportedMediaType, "only gzip or no encoding"
 	}
 	if len(text) > maxLogBytes {
 		return nil, http.StatusRequestEntityTooLarge, "body is too large"
 	}
 	if !utf8.Valid(text) {
 		return nil, http.StatusBadRequest, "body is not UTF-8 text"
 	}
 	return text, 0, ""
 }
 // save writes the file whole (a temporary file renamed into place), then prunes.
 func (l *Logs) save(name string, text []byte) error {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	tmp, err := os.CreateTemp(l.Dir, ".incoming-*")
 	if err != nil {
 		return err
 	}
 	defer os.Remove(tmp.Name()) // gone after the rename; cleans up after a failure
 	if _, err := tmp.Write(text); err != nil {
 		tmp.Close()
 		return err
 	}
 	if err := tmp.Close(); err != nil {
 		return err
 	}
 	if err := os.Rename(tmp.Name(), filepath.Join(l.Dir, name)); err != nil {
 		return err
 	}
 	l.prune()
 	return nil
 }
 type logEntry struct {
 	Name     string    `json:"name"`
 	Bytes    int64     `json:"bytes"`
 	Received time.Time `json:"received"`
 }
 // entries are the stored files, newest first.
 func (l *Logs) entries() ([]logEntry, error) {
 	dir, err := os.ReadDir(l.Dir)
 	if err != nil {
 		return nil, err
 	}
 	var out []logEntry
 	for _, e := range dir {
 		if !e.Type().IsRegular() || !logName.MatchString(e.Name()) {
 			continue
 		}
 		info, err := e.Info()
 		if err != nil {
 			continue
 		}
 		out = append(out, logEntry{Name: e.Name(), Bytes: info.Size(), Received: info.ModTime().UTC()})
 	}
 	sort.Slice(out, func(i, j int) bool {
 		if !out[i].Received.Equal(out[j].Received) {
 			return out[i].Received.After(out[j].Received)
 		}
 		return out[i].Name > out[j].Name
 	})
 	return out, nil
 }
 // prune removes all but the newest maxLogFiles and anything older than maxLogAge.
 func (l *Logs) prune() {
 	entries, err := l.entries()
 	if err != nil {
 		return
 	}
 	cutoff := l.now().Add(-maxLogAge)
 	for i, e := range entries {
 		if i >= maxLogFiles || e.Received.Before(cutoff) {
 			if err := os.Remove(filepath.Join(l.Dir, e.Name)); err != nil && !errors.Is(err, os.ErrNotExist) {
 				slog.Warn("old log not removed", "name", e.Name, "error", err)
 			}
 		}
 	}
 }
 // mayRead accepts LOGS_TOKEN only, compared in constant time; main refuses a short one.
 func (l *Logs) mayRead(w http.ResponseWriter, r *http.Request) bool {
 	if l.ReadToken == "" {
 		writeJSON(w, http.StatusNotFound, map[string]string{"error": "reading logs is off (no LOGS_TOKEN)"})
 		return false
 	}
 	supplied, ok := strings.CutPrefix(r.Header.Get("Authorization"), "Bearer ")
 	if !ok || subtle.ConstantTimeCompare([]byte(supplied), []byte(l.ReadToken)) != 1 {
 		writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unauthorized"})
 		return false
 	}
 	return true
 }
 func (l *Logs) list(w http.ResponseWriter, r *http.Request) {
 	if !l.mayRead(w, r) {
 		return
 	}
 	l.mu.Lock()
 	entries, err := l.entries()
 	l.mu.Unlock()
 	if err != nil {
 		slog.Error("logs not listed", "error", err)
 		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "internal server error"})
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"logs": append([]logEntry{}, entries...)})
 }
 func (l *Logs) get(w http.ResponseWriter, r *http.Request) {
 	if !l.mayRead(w, r) {
 		return
 	}
 	name := r.PathValue("name")
 	if !logName.MatchString(name) {
 		writeJSON(w, http.StatusNotFound, map[string]string{"error": "no such log"})
 		return
 	}
 	l.mu.Lock()
 	text, err := os.ReadFile(filepath.Join(l.Dir, name))
 	l.mu.Unlock()
 	if errors.Is(err, os.ErrNotExist) {
 		writeJSON(w, http.StatusNotFound, map[string]string{"error": "no such log"})
 		return
 	}
 	if err != nil {
 		slog.Error("log not read", "name", name, "error", err)
 		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "internal server error"})
 		return
 	}
 	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
 	w.WriteHeader(http.StatusOK)
 	_, _ = w.Write(text)
 }
@@ -0,0 +1,212 @@
 package main
 import (
 	"bytes"
 	"compress/gzip"
 	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 )
 const testLogsToken = "logs-read-token-0123456789abcdef"
 func newLogsAPI(t *testing.T) (*API, string) {
 	t.Helper()
 	api, _ := newTestAPI()
 	dir := t.TempDir()
 	api.Logs = NewLogs(dir, testLogsToken)
 	return api, dir
 }
 func gzipped(t *testing.T, text string) []byte {
 	t.Helper()
 	var b bytes.Buffer
 	zw := gzip.NewWriter(&b)
 	if _, err := zw.Write([]byte(text)); err != nil {
 		t.Fatal(err)
 	}
 	if err := zw.Close(); err != nil {
 		t.Fatal(err)
 	}
 	return b.Bytes()
 }
 func putLog(t *testing.T, h http.Handler, name, token string, body []byte, encoding string) *httptest.ResponseRecorder {
 	t.Helper()
 	req := httptest.NewRequest("PUT", "/v1/logs/"+name, bytes.NewReader(body))
 	req.Header.Set("Authorization", "Bearer "+token)
 	req.Header.Set("Content-Type", "text/plain; charset=utf-8")
 	if encoding != "" {
 		req.Header.Set("Content-Encoding", encoding)
 	}
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	return rec
 }
 func TestTheCarSendsALogAndTheOwnerReadsIt(t *testing.T) {
 	api, _ := newLogsAPI(t)
 	h := api.Routes()
 	const name = "signal-recording-20261027-085240.txt"
 	text := "Signal recording, 37 captures\nlistening to 108 assistance properties\n"
 	if rec := putLog(t, h, name, testToken, gzipped(t, text), "gzip"); rec.Code != http.StatusNoContent {
 		t.Fatalf("put: %d %s", rec.Code, rec.Body)
 	}
 	rec := do(t, h, "GET", "/v1/logs", testLogsToken, "")
 	if rec.Code != 200 {
 		t.Fatalf("list: %d %s", rec.Code, rec.Body)
 	}
 	var list struct {
 		Logs []logEntry `json:"logs"`
 	}
 	if err := json.Unmarshal(rec.Body.Bytes(), &list); err != nil || len(list.Logs) != 1 || list.Logs[0].Name != name ||
 		list.Logs[0].Bytes != int64(len(text)) {
 		t.Fatalf("list: %v %s", err, rec.Body)
 	}
 	rec = do(t, h, "GET", "/v1/logs/"+name, testLogsToken, "")
 	if rec.Code != 200 || rec.Body.String() != text || !strings.HasPrefix(rec.Header().Get("Content-Type"), "text/plain") {
 		t.Fatalf("get: %d %q", rec.Code, rec.Body)
 	}
 	// Sent again (a retry), it replaces itself.
 	if rec := putLog(t, h, name, testToken, []byte("again\n"), ""); rec.Code != http.StatusNoContent {
 		t.Fatalf("put again: %d", rec.Code)
 	}
 	if rec := do(t, h, "GET", "/v1/logs/"+name, testLogsToken, ""); rec.Body.String() != "again\n" {
 		t.Fatalf("replaced: %q", rec.Body)
 	}
 }
 func TestLogTokensDoNotCross(t *testing.T) {
 	api, _ := newLogsAPI(t)
 	h := api.Routes()
 	name := "signal-recording-1.txt"
 	if rec := putLog(t, h, name, testLogsToken, []byte("x"), ""); rec.Code != http.StatusUnauthorized {
 		t.Fatalf("the read token wrote: %d", rec.Code)
 	}
 	if rec := putLog(t, h, name, testToken, []byte("x"), ""); rec.Code != http.StatusNoContent {
 		t.Fatalf("put: %d", rec.Code)
 	}
 	for _, path := range []string{"/v1/logs", "/v1/logs/" + name} {
 		for _, token := range []string{"", testToken, testLogsToken + "x"} {
 			if rec := do(t, h, "GET", path, token, ""); rec.Code != http.StatusUnauthorized {
 				t.Fatalf("GET %s with %q: %d", path, token, rec.Code)
 			}
 		}
 	}
 }
 func TestReadingIsOffWithoutALogsToken(t *testing.T) {
 	api, _ := newLogsAPI(t)
 	api.Logs.ReadToken = ""
 	h := api.Routes()
 	if rec := putLog(t, h, "a.txt", testToken, []byte("x"), ""); rec.Code != http.StatusNoContent {
 		t.Fatalf("put: %d", rec.Code)
 	}
 	if rec := do(t, h, "GET", "/v1/logs", "", ""); rec.Code != http.StatusNotFound {
 		t.Fatalf("list: %d", rec.Code)
 	}
 }
 func TestBadLogsAreRefused(t *testing.T) {
 	api, dir := newLogsAPI(t)
 	h := api.Routes()
 	for _, c := range []struct {
 		name, encoding string
 		body           []byte
 		want           int
 	}{
 		{"..%2Fescape.txt", "", []byte("x"), http.StatusBadRequest},
 		{"Upper.txt", "", []byte("x"), http.StatusBadRequest},
 		{"no-suffix", "", []byte("x"), http.StatusBadRequest},
 		{".hidden.txt", "", []byte("x"), http.StatusBadRequest},
 		{"a.txt", "gzip", []byte("not gzip"), http.StatusBadRequest},
 		{"a.txt", "br", []byte("x"), http.StatusUnsupportedMediaType},
 		{"a.txt", "", []byte{0xff, 0xfe, 0x00}, http.StatusBadRequest},
 		{"a.txt", "", make([]byte, maxLogWireBytes+1), http.StatusRequestEntityTooLarge},
 		{"a.txt", "gzip", gzipped(t, strings.Repeat("a", maxLogBytes+1)), http.StatusRequestEntityTooLarge},
 	} {
 		if rec := putLog(t, h, c.name, testToken, c.body, c.encoding); rec.Code != c.want {
 			t.Errorf("%s %s: %d, want %d (%s)", c.name, c.encoding, rec.Code, c.want, rec.Body)
 		}
 	}
 	if files, _ := os.ReadDir(dir); len(files) != 0 {
 		t.Fatalf("stored: %v", files)
 	}
 	if rec := do(t, h, "GET", "/v1/logs/missing.txt", testLogsToken, ""); rec.Code != http.StatusNotFound {
 		t.Fatalf("missing: %d", rec.Code)
 	}
 }
 func TestOldAndSurplusLogsArePruned(t *testing.T) {
 	dir := t.TempDir()
 	l := NewLogs(dir, testLogsToken)
 	// The new file gets the real time as its own, so the others are placed before it.
 	now := time.Now()
 	old := filepath.Join(dir, "old.txt")
 	if err := os.WriteFile(old, []byte("x"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.Chtimes(old, now.Add(-maxLogAge-time.Hour), now.Add(-maxLogAge-time.Hour)); err != nil {
 		t.Fatal(err)
 	}
 	for i := 0; i < maxLogFiles+5; i++ {
 		p := filepath.Join(dir, fmt.Sprintf("f-%03d.txt", i))
 		if err := os.WriteFile(p, []byte("x"), 0o600); err != nil {
 			t.Fatal(err)
 		}
 		at := now.Add(-time.Duration(maxLogFiles+5-i) * time.Minute)
 		if err := os.Chtimes(p, at, at); err != nil {
 			t.Fatal(err)
 		}
 	}
 	if err := l.save("new.txt", []byte("y")); err != nil {
 		t.Fatal(err)
 	}
 	entries, _ := l.entries()
 	if len(entries) != maxLogFiles || entries[0].Name != "new.txt" {
 		t.Fatalf("%d kept, first %s", len(entries), entries[0].Name)
 	}
 	if _, err := os.Stat(old); !os.IsNotExist(err) {
 		t.Fatal("the old one is still there")
 	}
 	if _, err := os.Stat(filepath.Join(dir, "f-000.txt")); !os.IsNotExist(err) {
 		t.Fatal("the oldest surplus one is still there")
 	}
 }
 func TestLogsConfig(t *testing.T) {
 	base := map[string]string{"INFLUX_URL": "http://i", "INFLUX_TOKEN": "t", "INFLUX_ORG": "o", "INGEST_TOKEN": testToken}
 	env := func(extra map[string]string) func(string) string {
 		return func(k string) string {
 			if v, ok := extra[k]; ok {
 				return v
 			}
 			return base[k]
 		}
 	}
 	for _, c := range []struct {
 		extra map[string]string
 		ok    bool
 	}{
 		{map[string]string{}, true},
 		{map[string]string{"LOGS_DIR": "/l"}, true},
 		{map[string]string{"LOGS_DIR": "/l", "LOGS_TOKEN": testLogsToken}, true},
 		{map[string]string{"LOGS_TOKEN": testLogsToken}, false},
 		{map[string]string{"LOGS_DIR": "/l", "LOGS_TOKEN": "short"}, false},
 		{map[string]string{"LOGS_DIR": "/l", "LOGS_TOKEN": testToken}, false},
 	} {
 		if _, err := loadConfig(env(c.extra)); (err == nil) != c.ok {
 			t.Errorf("%v: %v", c.extra, err)
 		}
 	}
 }
@@ -36,6 +36,8 @@ type config struct {
 	forgeToken   string
 	mapTilesURL  string
 	mapCacheDir  string
 	logsDir      string
 	logsToken    string
 }
 // loadConfig reads the environment and fails closed: a missing InfluxDB setting or a
@@ -55,6 +57,8 @@ func loadConfig(getenv func(string) string) (config, error) {
 		forgeToken:   getenv("FORGE_TOKEN"),
 		mapTilesURL:  getenv("MAP_TILES_URL"),
 		mapCacheDir:  getenv("MAP_CACHE_DIR"),
 		logsDir:      getenv("LOGS_DIR"),
 		logsToken:    getenv("LOGS_TOKEN"),
 	}
 	if c.listenAddr == "" {
 		c.listenAddr = ":8080"
@@ -89,6 +93,17 @@ func loadConfig(getenv func(string) string) (config, error) {
 			return config{}, errors.New("MAP_TILES_URL must be an https URL or \"off\"")
 		}
 	}
 	// Logs from the car are optional (LOGS_DIR); reading them needs a token of their own, as
 	// long as the ingest token, and never the ingest token itself.
 	if c.logsToken != "" && c.logsDir == "" {
 		return config{}, errors.New("LOGS_TOKEN is set but LOGS_DIR is not")
 	}
 	if c.logsToken != "" && len(c.logsToken) < minIngestTokenLength {
 		return config{}, fmt.Errorf("LOGS_TOKEN must be at least %d characters", minIngestTokenLength)
 	}
 	if c.logsToken != "" && c.logsToken == c.ingestToken {
 		return config{}, errors.New("LOGS_TOKEN must differ from INGEST_TOKEN")
 	}
 	if c.approvalPass != "" && len(c.approvalPass) < minApprovalPasswordLength {
 		return config{}, fmt.Errorf("APPROVAL_PASSWORD must be at least %d characters", minApprovalPasswordLength)
 	}
@@ -127,6 +142,13 @@ func main() {
 		}
 		api.Maps = NewMaps(cfg.mapTilesURL, cfg.mapCacheDir, mapUserAgent)
 	}
 	if cfg.logsDir != "" {
 		if err := os.MkdirAll(cfg.logsDir, 0o700); err != nil {
 			slog.Error("logs directory not usable", "error", err)
 			os.Exit(1)
 		}
 		api.Logs = NewLogs(cfg.logsDir, cfg.logsToken)
 	}
 	srv := &http.Server{
 		Addr:              cfg.listenAddr,
@@ -142,7 +164,7 @@ func main() {
 	go func() {
 		slog.Info("listening", "addr", cfg.listenAddr, "bucket", cfg.influxBucket,
 			"pairing", pairing.Enabled(), "pairedDevices", len(devices), "appUpdates", releases.enabled(),
-			"maps", api.Maps != nil)
+			"maps", api.Maps != nil, "logs", api.Logs != nil, "logsReadable", api.Logs != nil && cfg.logsToken != "")
 		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 			slog.Error("server failed", "error", err)
 			os.Exit(1)
Author	SHA1	Message	Date
nilsandClaude Opus 5.5	eebe840b6a	App 2.41.0, server 2.9.0: recordings reach the server A finished signal recording goes to an outbox and is sent gzipped with the car's token (PUT /v1/logs/{name}); the service retries every 2 minutes while the car is offline. The server keeps the newest 200 on a new volume (LOGS_DIR); reading takes a token of its own (LOGS_TOKEN). fetch-logs in the dev shell fetches new ones into logs/. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 10:22:40 +01:00
nilsandClaude Opus 5.5	16e6f349da	SPECS: app 2.40.4 published Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 09:23:20 +01:00
nilsandClaude Opus 5.5	60ab3118a1	App 2.40.4: the recorder's listening works on Android 9 listenToProperties looked only for registerCallback (Android 10); the car's car library has registerListener/unregisterListener. Take either, unsubscribe property by property, and say why when it fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 09:19:33 +01:00
nilsandClaude Opus 5.5	097467f4e0	SPECS: app 2.40.3 published Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 00:56:39 +01:00
nilsandClaude Opus 5.5	e90031d6b0	App 2.40.3: the signal recorder listens to the assistance properties The ACC recording of 2.32.0 only polled, and the AAD_* properties read their defaults. The head unit's own assistance manager never polls them: it subscribes to each for change events, and a vendor HAL may fill a value only while someone listens. EVHardware gains a read-only listenToProperties and AssistBlock (global vendor properties 0x21x0A1xx, all 108 AAD_* ids); the recorder subscribes to that block for its three minutes and lists the properties heard, those with changing values first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 00:55:26 +01:00
nilsandClaude Opus 5.5	f7c489858e	App 2.40.2: the Grid map moves on the GPU The map was hardware-rendered, but every frame recomputed every road point, rebuilt every path and drew the big roads three times, at 20 frames a second, and the car jumped with each GPS fix. Now it is its own view under the Grid (MapLayerView, a hardware layer): drawn once into a GPU texture and only redrawn when tiles change or after about 230 m; each display frame only sets its translation and rotation. The car glides between fixes, and the Grid over the map redraws only with the readings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 00:32:50 +01:00
nilsandClaude Opus 5.5	c3c47f5159	App 2.40.1: an update always reaches the installer screen The car refuses the installer session, and only a refusal thrown at once opened the installer screen; one that came back through the session's result ended in a toast, so the update downloaded and then nothing seemed to happen. Now any result but success or the driver's cancel opens the installer screen with the verified APK, as does a confirmation that cannot be shown, and a session silent for 20 s is abandoned for it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 00:18:31 +01:00
nilsandClaude Opus 5.5	9ef058cb44	SPECS: app 2.40.0 published Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 00:12:47 +01:00
nilsandClaude Opus 5.5	69b1adee2b	App 2.40.0: Grid with map straight from above, full height The map fills the whole screen, top-down and heading up, about 400 m ahead and 450 m to each side, over a ground grid that turns with it. The speed moves to a panel under the gears; the battery wall, the clock, the gears and the disc stand on dark panels over the map. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 00:12:06 +01:00
nilsandClaude Opus 5.5	90c2c75fc6	SPECS: app 2.39.2 published Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 00:06:51 +01:00
nilsandClaude Opus 5.5	2d7b324899	App 2.39.2: Grid with map seen from higher up The map gets its own camera, tilted 45 degrees down from about 300 m up, so roads keep their shape some 400 m ahead instead of collapsing into the horizon. In map mode the floor starts at half height, the speed is a little smaller, the floor's grid is fixed to the ground and turns with the roads, and the power disc has a dark backing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-27 00:06:07 +01:00
nilsandClaude Opus 5.5	09cbd21634	k8s: pin server 2.8.0; app 2.39.1 published Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6	2026-10-26 23:56:28 +01:00