Feature/windows systemic

.gitattributes

@@ -80,3 +80,10 @@ Dockerfile*  text eol=lf
 # generic case for any other proto we may vendor.
 *.proto      binary
 
+
+# P1/S10 — generated i18n resources are written with LF by
+# apps/shared/i18n/generators/gen-i18n.ts. Keep them LF on every checkout so the
+# gen-i18n drift gate (-Check) doesn't false-positive on Windows (autocrlf=true).
+apps/android/app/src/main/res/**/strings.xml text eol=lf
+apps/windows/Strings/**/Resources.resw       text eol=lf
+apps/apple/**/*.xcstrings                     text eol=lf

.github/prompts/_page_map.txt

@@ -0,0 +1,66 @@
+1|Dashboard|dashboard|DashboardPage
+2|VehicleDetail|vehicles|VehicleDetailPage
+3|Vehicles|vehicles|VehicleListPage
+4|Charging|charging|ChargingListPage
+5|ChargeDetail|charging|ChargingDetailPage
+6|ChargingCurve|charging|ChargingCurvePage
+7|CostAnalysis|charging|CostAnalysisPage
+8|Drives|driving|DrivesListPage
+9|DriveDetail|driving|DriveDetailPage
+10|DriveScore|driving|DriveScorePage
+11|DrivingDynamics|driving|DrivingDynamicsPage
+12|DrivetrainHealth|driving|DrivetrainHealthPage
+13|Efficiency|driving|EfficiencyPage
+14|SpeedProfile|driving|SpeedProfilePage
+15|RegenEfficiency|driving|RegenEfficiencyPage
+16|RouteEfficiency|driving|RouteEfficiencyPage
+17|Energy|battery|EnergyPage
+18|BatteryHealth|battery|BatteryHealthPage
+19|BatteryCells|battery|BatteryCellsPage
+20|BatteryDegradation|battery|BatteryDegradationPage
+21|EnergyFlow|battery|EnergyFlowPage
+22|VampireDrain|battery|VampireDrainPage
+23|ProjectedRange|battery|ProjectedRangePage
+24|SleepEfficiency|battery|SleepEfficiencyPage
+25|Analytics|analytics|AnalyticsPage
+26|Statistics|analytics|StatisticsPage
+27|Compare|analytics|ComparePage
+28|Mileage|analytics|MileagePage
+29|WeeklyDigest|analytics|WeeklyDigestPage
+30|Timeline|analytics|TimelinePage
+31|LiveMap|maps|MapOverviewPage
+32|Geofences|maps|GeofencesPage
+33|Locations|maps|LocationsPage
+34|NavigationRoute|maps|NavigationRoutePage
+35|TemperatureImpact|maps|TemperatureImpactPage
+36|ClimateControl|vehicle-systems|ClimateControlPage
+37|TirePressure|vehicle-systems|TirePressurePage
+38|Maintenance|vehicle-systems|MaintenancePage
+39|SoftwareUpdates|vehicle-systems|SoftwareUpdatesPage
+40|SafetySettings|vehicle-systems|SafetySettingsPage
+41|MediaPlayer|vehicle-systems|MediaPlayerPage
+42|Alerts|notifications|AlertsPage
+43|AlertStudio|notifications|AlertStudioPage
+44|Notifications|notifications|NotificationsPage
+45|Settings|settings|SettingsPage
+46|SignalExplorer|telemetry|SignalExplorerPage
+47|SignalLogViewer|telemetry|SignalLogViewerPage
+48|SignalDiff|telemetry|SignalDiffPage
+49|SignalGapDetector|telemetry|SignalGapDetectorPage
+50|LiveSignalMonitor|telemetry|LiveSignalMonitorPage
+51|MQTTInspector|telemetry|MQTTInspectorPage
+52|Admin|admin|AdminPage
+53|DevTools|admin|DevToolsPage
+54|APIKeys|admin|APIKeysPage
+55|ApiLogs|admin|ApiLogsPage
+56|FleetAPI|admin|FleetAPIPage
+57|SecurityAccess|admin|SecurityAccessPage
+58|BackupRestore|admin|BackupRestorePage
+59|SystemStatus|system|SystemStatusPage
+60|DataExport|system|DataExportPage
+61|DataRepair|system|DataRepairPage
+62|Commands|system|CommandsPage
+63|Chatbot|system|ChatbotPage
+64|Changelog|system|ChangelogPage
+65|Roadmap|system|RoadmapPage
+66|ChargingHeatmap|charging|ChargingHeatmapPage

.github/prompts/detailed-telemetry/adrs/ADR-telemetry-hot-cold-topology.md

@@ -0,0 +1,142 @@
+# ADR-0092 — Telemetry hot/cold topology: Timescale-hot always-on, ClickHouse-cold profile-gated (confirms ADR-0090)
+
+- Status: **Proposed**
+- Date: 2026-06-04
+- Deciders: Platform Architecture, Telemetry Storage owners
+- Consulted: Ingest/Writer team, Analytics/Alerts team, Deployment/Helm owners
+- Informed: All Phase-2 migration authors, Phase-6 cold-tier + CDC owners
+- Template: MADR-Lite (`docs/adr/0000a-template-lite.md`)
+
+> **MADR-Lite note.** This is a **confirmation / scoping** decision, not a fresh
+> trade-off. ADR-0090 already chose the hybrid two-tier topology and is
+> **Accepted**. This ADR pins the **Phase-1 baseline scope** of that decision so
+> Phase 2 and Phase 6 build against a fixed seam. It therefore uses the light
+> template (context, decision, consequences, related decisions) rather than the
+> full option-scoring form.
+
+---
+
+## Context and Problem Statement
+
+ADR-0006 ratified TimescaleDB **provisionally** and deferred the durable choice
+to doc-15 (`planning/40-storage-compute/15-time-series-storage.md`). **ADR-0090
+(Accepted) supersedes ADR-0006** with a **two-tier hybrid**:
+
+- **Hot tier — TimescaleDB (always on).** Serves Q1/Q3 (single-vehicle charts,
+  the last-15-minute alert hot path) and all OLTP JOINs.
+- **Cold tier — ClickHouse (profile-on for fleet+ tiers only).** Serves Q2/Q4
+  (multi-year rollups, fleet-wide degradation analytics).
+- **Wiring — Postgres-WAL CDC → Redpanda → ClickHouse**, target CDC lag ≤ 60s
+  p95, **never on the synchronous ingest path**.
+
+Three forces hardened ADR-0090 and are **not re-opened here**:
+
+1. **H24** — Timescale multi-node was removed in 2.14, so a single Timescale node
+   caps the fleet-wide analytics path; the cold tier exists to lift that cap.
+2. The **"no re-platform at 10k vehicles"** directive — the fleet path must scale
+   without a storage migration.
+3. The **AGPL self-host pillar** — a one-vehicle self-host must come up with a
+   single command and must never be forced to run ClickHouse.
+
+The open question this ADR closes is **not** "which stores" (ADR-0090 settled
+that) but **"what does Phase 1 ship, and where is the cold-tier seam?"** Without
+pinning this, Phase-2 migrations could target the wrong store and a single-vehicle
+self-host could be saddled with an idle ClickHouse + Redpanda + CDC stack.
+
+## Decision Outcome
+
+**Confirm ADR-0090; scope Phase 1 to "hot-tier + CDC-seam-ready."**
+
+1. **Phase 2 builds the two-layer store (`raw_signals` + `canonical_signals`)
+   on TimescaleDB only.** No cold-tier tables are created in Phase 1/2. (The
+   two-layer table shape itself is owned by Phase-1 prompt 01 / ADR-0091 and is
+   out of scope here.)
+
+2. **The cold tier is profile-gated and default OFF.** Phase 6 builds the
+   ClickHouse schema **and** the CDC consumer, activated only by a dedicated
+   **`cold-tier` deployment profile** (Compose profile / Helm value, default
+   disabled). A 1-vehicle self-host therefore never instantiates ClickHouse,
+   Redpanda, or the CDC writer.
+
+3. **CDC is off the synchronous hot path (H24 invariant).** The cold path is
+   Postgres logical replication → Redpanda → cold writer. It is **not** in the
+   ingestor or `ts-writer` synchronous path: hot writes never block on cold
+   availability. The cold-tier failure mode is annotated **`FAIL_OPEN_DEGRADED`**
+   — losing CDC/Redpanda/ClickHouse degrades **analytics freshness only** and
+   **never** stalls or fails a hot write.
+
+4. **The cold seam is designed now, built later.** Phase 1 fixes the contract of
+   the seam — the CDC source (logical-replication slot on `canonical_signals` /
+   `raw_signals`), the Redpanda topic, and the cold-writer consumer contract — so
+   Phase 6 can implement against a stable interface. No cold code ships in Phase 1.
+
+5. **The CDC-lag SLO number (≤ 60s p95) is owned by the TL-register
+   (Phase-1 prompt 06)** and is **measured via OTel (H10)**. This ADR records the
+   target's existence and ownership but defers the authoritative number and its
+   alerting to the register.
+
+### Decision in one line
+
+> Ship the hot tier (Timescale, always-on) and the two-layer store on it in
+> Phase 2; design the cold seam now but gate ClickHouse + CDC behind a default-OFF
+> `cold-tier` profile built in Phase 6, with CDC permanently off the hot write path.
+
+## Consequences
+
+- ✅ **Self-host stays one-command-up.** Default profile = hot tier only; no
+  ClickHouse/Redpanda/CDC for a single-vehicle deployment.
+- ✅ **Fleet path uncapped.** The cold tier lifts the single-node Timescale
+  analytics cap (H24) for fleet+ tiers without a re-platform.
+- ✅ **Hot writes are never coupled to cold availability** (`FAIL_OPEN_DEGRADED`);
+  a stuck/absent ClickHouse degrades analytics freshness only.
+- ✅ **Stable seam for Phase 6.** The CDC topic + cold-writer contract are fixed in
+  Phase 1, so Phase 6 implements against a known interface.
+- ➖ **Two stores at fleet+.** Operators on fleet tier run and observe both
+  Timescale and ClickHouse (plus Redpanda + CDC).
+- ➖ **CDC lag on cold analytics.** Fleet-wide rollups trail real time by the CDC
+  lag (target ≤ 60s p95, owned by the TL-register); acceptable for Q2/Q4 (rollups
+  / degradation), never used for the alert hot path (Q1/Q3 stay on the hot tier).
+
+## Confirmation
+
+- Phase-2 migrations create `raw_signals` / `canonical_signals` on TimescaleDB
+  only; no ClickHouse DDL appears in Phase 1/2 (migration review).
+- The `cold-tier` profile is **absent or disabled by default** in Compose and Helm
+  values; enabling it is the only way ClickHouse/Redpanda/CDC instantiate
+  (`helm template` / `docker compose config` review).
+- The ingestor and `ts-writer` synchronous paths contain **no** call that blocks on
+  ClickHouse/Redpanda/CDC (writer review + a failure-injection test asserting hot
+  writes succeed with the cold tier down).
+- The CDC-lag SLO is registered and OTel-measured in the Phase-1 prompt-06
+  TL-register, not hard-coded here.
+
+## Related Decisions
+
+- **ADR-0090** — Time-series storage hybrid (Timescale + ClickHouse), **Accepted**
+  — *confirmed, not re-decided,* by this ADR.
+- **ADR-0006** — TimescaleDB (provisional) — *superseded* by ADR-0090; recorded
+  here for lineage.
+- **ADR-0017** — Two-layer signal store — the layers placed by this topology.
+- **ADR-0091** — Telemetry two-layer store is the system of record (Phase-1
+  prompt 01) — defines the table shape that lives on the hot tier here.
+- **ADR-0342** — Collector topology — upstream of the ingest path referenced by
+  the hot-path invariant.
+- **ADR-0345** — Retention — governs hot-tier compression/retention and the
+  cold-tier horizon the CDC seam ultimately feeds.
+
+## Out of Scope
+
+- The two-layer table DDL / shape (Phase 2 / ADR-0091).
+- The ClickHouse schema and the CDC consumer implementation (Phase 6).
+- The authoritative CDC-lag SLO number and its alert wiring (Phase-1 prompt 06
+  TL-register).
+
+## Notes
+
+The ADR-0090 / ADR-0006 / ADR-0017 / ADR-0342 / ADR-0345 documents, the
+`docs/adr/0000a-template-lite.md` template, and `planning/40-storage-compute/15-time-series-storage.md` §9
+cited above were referenced from the Phase-1 prompt brief; the corresponding
+files are not yet present in the repository at authoring time. Reviewers should
+reconcile these citations against the canonical `docs/adr/` set before moving the
+status from **Proposed** to **Accepted**. No proto, SQL, or Kotlin was touched by
+this docs-only change.

.github/prompts/detailed-telemetry/adrs/ADR-telemetry-normalizer-scaling.md

@@ -0,0 +1,174 @@
+# ADR-0093 — Ingestor normalization is taxonomy-driven (registry over hand-coded `when`)
+
+- Status: **Proposed**
+- Date: 2026-06-04
+- Deciders: Platform Architecture, Ingest/Normalize owners
+- Consulted: Telemetry Storage owners, Analytics/Alerts (taxonomy) team
+- Informed: All Phase-4 normalizer authors, Phase-3 event-shape owners
+- Template: MADR-Lite (`docs/adr/0000a-template-lite.md`)
+
+> **MADR-Lite note.** This is a **single-axis structural** decision — *how* the
+> normalizer scales from 3 canonical branches to the full ~40-signal taxonomy —
+> not a multi-store trade-off. The recommendation is clear and the alternatives
+> are degenerate (keep hand-coding N branches). It therefore uses the light
+> template (context, decision, consequences, related decisions) rather than the
+> full option-scoring form.
+
+---
+
+## Context and Problem Statement
+
+Today the ingestor normalizer
+(`backend/services/ingestor/src/main/kotlin/io/otelog/ingestor/normalize/SignalNormalizer.kt`)
+is a hand-coded `when (signal.kind)` with **three** canonical branches —
+`vehicle.odometer_km`, `vehicle.battery.state_of_charge_pct`, and
+`vehicle.speed_mps` — plus a `vendor.*` catch-all. Each canonical branch
+**hand-writes its own** range/finiteness validation and its own per-event
+mapping. Unknown-and-not-vendor kinds are dropped.
+
+The full canonical taxonomy is **~40 signals** (doc-08 §4), populated into
+`packages/contract-events/proto/io/otelog/signals/v1/canonical_signals.proto` by
+the alerts taxonomy program (`alerts/phase-2-signal-taxonomy`). Each signal is
+described by a `SignalDescriptor` carrying its canonical name, SI unit,
+value-kind, validation bounds, and `privacy_class`.
+
+**The problem.** Scaling the current pattern to ~40 signals means ~40 hand-coded
+`when` branches. That would:
+
+- **Re-implement validation ~40 times** (range + finiteness copied per branch),
+  inviting drift and copy bugs.
+- **Drift from the taxonomy** — the proto descriptor (SI unit, bounds,
+  value-kind, `privacy_class`) and the normalizer's per-branch literals become
+  two sources of truth that must be hand-kept in sync.
+- **Force a code change for every taxonomy addition**, even when the descriptor
+  already fully specifies the new signal's mapping.
+
+We must record, before Phase 4 implements the scale-out, **which model the
+normalizer follows**.
+
+## Decision Outcome
+
+**Adopt a registry-driven, taxonomy-keyed normalizer.** Retire the per-kind
+canonical `when` for canonical signals; keep the `vendor.*` catch-all and the
+drop-unknown rule unchanged.
+
+1. **Introduce a `CanonicalSignalRegistry` (framework-free, `:domain:*` — H31).**
+   The registry is the in-memory projection of the
+   `canonical_signals.proto` descriptors, keyed by canonical `kind`:
+
+   ```
+   kind → SignalDescriptor { si_unit, value_kind, min, max, finiteness, privacy_class }
+   ```
+
+   It is **pure Kotlin** with no proto/framework imports. The proto read happens
+   in an **adapter** (`:adapter:*`) that hydrates the registry at startup; the
+   domain registry never sees a generated proto type. This preserves the H31
+   domain-purity boundary.
+
+2. **`SignalNormalizer` becomes a generic, descriptor-driven mapping:**
+   - validate the envelope (unchanged);
+   - **look up `signal.kind` in the registry**;
+   - if found → apply **one generic validator** parameterized by the
+     descriptor (`min`/`max`/`finiteness`/`value_kind`) and emit the
+     canonical-sample event (Phase 3 shape) carrying the canonical kind, the SI
+     value, and the descriptor's `privacy_class`;
+   - if not found **but** `vendor.*` → **vendor passthrough (unchanged)**;
+   - if not found **and** not `vendor.*` → **drop (unchanged, H14
+     drop-unknown)**.
+
+3. **Validation is unified here; event-shape reconciliation is deferred to
+   Phase 3.** The three existing per-signal typed events (`VehicleSeenEvent`,
+   battery, speed) may be **kept as promoted typed events fed alongside the
+   generic sample** *or* subsumed — that reconciliation is **Phase 3's** call.
+   But the **validation logic must be unified now**: one generic
+   descriptor-driven validator, not per-branch copies. No branch may keep its
+   own private range/finiteness check after Phase 4.
+
+### Decision in one line
+
+> Drive normalization from the `SignalDescriptor` registry built from
+> `canonical_signals.proto` — one generic validator + mapping keyed on `kind` —
+> so the ~40-signal taxonomy scales without ~40 hand-coded `when` branches; keep
+> the `vendor.*` catch-all and drop-unknown rule, and read the proto only in an
+> H31 adapter that hydrates a framework-free domain registry.
+
+## Consequences
+
+- ✅ **Scales to N signals.** Adding a taxonomy signal is a descriptor entry in
+  `canonical_signals.proto`, not a new normalizer branch — no ingestor code
+  change for a well-described signal.
+- ✅ **One validation path.** Range/finiteness/value-kind checks live in a single
+  generic validator parameterized by the descriptor; no per-branch duplication
+  to drift.
+- ✅ **Taxonomy is the single source of truth.** The proto descriptors (SI unit,
+  bounds, value-kind, `privacy_class`) drive runtime behavior directly; the
+  normalizer can no longer silently disagree with the taxonomy.
+- ✅ **`vendor.*` and drop-unknown semantics preserved.** Unknown-but-`vendor.*`
+  still passes through; unknown-and-not-`vendor.*` is still dropped (H14).
+- ➖ **A registry hydration step is added.** Startup must build the registry from
+  the proto descriptors before the normalizer serves traffic; a missing/partial
+  registry is a startup-fail, not a per-event surprise.
+- ➖ **Init-order gotcha (`by lazy`).** A sealed/enum registry with an **eager**
+  `val ALL = listOf(...)` companion can NPE on class-init ordering (repo memory:
+  sealed type + eager `val ALL = listOf(...)` → init-order NPE). Phase 4 **must**
+  use `val ALL by lazy { ... }` (and lazy descriptor collections generally) so
+  the list is materialized after all members are initialized.
+- ➖ **H31 adapter boundary must hold.** The proto descriptor read lives in an
+  `:adapter:*` hydrator; the `:domain:*` registry + validator stay framework-free.
+  A domain type importing a generated proto class is a boundary violation.
+- ➖ **Event-shape reconciliation still pending.** Whether the three typed events
+  are kept-alongside or subsumed is **deferred to Phase 3**; Phase 4 ships the
+  unified validator + generic sample regardless of that outcome.
+
+## Confirmation
+
+- Phase-4 `SignalNormalizer` contains **no per-canonical-kind `when` branch**
+  with an inline range/finiteness check; the canonical path is a single
+  registry lookup + generic validator (code review + a test asserting two
+  different canonical kinds traverse the same validator).
+- The `CanonicalSignalRegistry` and its validator carry **no framework/proto
+  imports** (H31 module-boundary lint / dependency check); the proto read is in
+  an adapter hydrator.
+- The registry's eager collection is materialized via **`by lazy`**, verified by
+  a registry-init test that touches `ALL` from a cold class load without NPE.
+- `vendor.*` passthrough and the drop-unknown branch are preserved (parametrized
+  normalizer tests: a `vendor.*` kind passes through, an unknown non-vendor kind
+  drops).
+- Each emitted canonical sample carries the descriptor's `privacy_class`
+  (ADR-0331) and the SI value (ingest test).
+
+## Related Decisions
+
+- **ADR-0814** — Vertical-slice per-signal pattern — this ADR **generalizes** it:
+  the per-signal shape it established is now driven by the descriptor registry
+  rather than re-coded per slice.
+- **ADR-0331** — `privacy_class` carried on the signal — the registry surfaces
+  `privacy_class` from the descriptor so the emitted sample carries it.
+- **ADR-0091** — Two-layer store is the system of record (Phase-1 prompt 01) —
+  the canonical sample the registry-driven normalizer emits lands in
+  `canonical_signals`; its vendor passthrough lands in `raw_signals`.
+- **Alerts taxonomy program** (`alerts/phase-2-signal-taxonomy`) — owns the
+  `SignalDescriptor` fields the registry consumes; this ADR makes that taxonomy
+  the runtime source of truth for normalization.
+
+## Out of Scope
+
+- Implementing the registry, the generic validator, or the hydration adapter
+  (Phase 4 / normalizer scale-out).
+- The canonical-sample event shape and the typed-event reconciliation
+  (kept-alongside vs subsumed) — Phase 3.
+- Any change to the proto, SQL, or Kotlin source (this is a docs-only ADR draft).
+
+## Notes
+
+The `SignalNormalizer.kt`, `canonical_signals.proto`, the
+`alerts/phase-2-signal-taxonomy` README, the
+`docs/adr/0000a-template-lite.md` template, and ADR-0814 / ADR-0331 cited above
+were referenced from the Phase-1 prompt brief; the corresponding files are not
+all present in the repository at authoring time. Reviewers should reconcile
+these citations against the canonical `backend/services/ingestor`,
+`packages/contract-events`, and `docs/adr/` sets before moving the status from
+**Proposed** to **Accepted**. The `by lazy` init-order note is drawn from repo
+memory (sealed type + eager `val ALL = listOf(...)` → init-order NPE) and must
+be honored by the Phase-4 implementation. No proto, SQL, or Kotlin was touched
+by this docs-only change.