Add allowlisted diagnostic jobs and MG4 ADB plan

PLAN.md

@@ -40,6 +40,7 @@ Core operation must work without cloud access. Optional remote access is a later
   - generate a sanitized support bundle
 - Touch-focused web dashboard
 - Native Android WebView shell with editable trusted dashboard URL and reconnect controls
+- Read-only ADB connection health and device/display identity for one explicitly configured head unit
 - Raspberry Pi bootstrap, systemd service, health check, update, and uninstall scripts
 - Automated tests, production builds, and operator documentation
 
@@ -80,6 +81,7 @@ MG4 Android app / browser
 Fastify API + static React app  <---->  SQLite
           |
           +---- system status collectors
+          +---- allowlisted read-only ADB collectors
           +---- allowlisted job handlers
           +---- controlled artifact storage
           +---- audit and diagnostic services
@@ -207,6 +209,37 @@ Artifacts live under one configured data directory; API callers never provide fi
 - Preserve Android soft-keyboard behavior and support file chooser/download flows without broad storage permissions.
 - Optimize for landscape and offer immersive mode without making navigation recovery difficult.
 
+### MG4 infotainment and ADB boundary
+
+The hardware baseline is sourced from the captured MG4 Luxury 2022 profile at
+`https://git.molberg.cloud/alex/mg4-luxury-2022-info` (capture dated 2026-07-30;
+reference commit `162a6636df89e1df2bba7ffc14550a37b3f9e9d5`). Treat it as a device-specific
+reference, not proof for other model years, trims, regions, or software builds.
+
+- The tested head unit is Android 9/API 28 on arm64, with ADB enabled but no root,
+  no `su`, and SELinux enforcing. The companion must not depend on root or system
+  partition changes.
+- Display 0 is 1920×720 at 160 dpi, but the usable app area is 1778×640 because of
+  an 80 px top status bar and 142 px left navigation bar. Use Android window insets;
+  do not model the navigation bar as a bottom inset.
+- The physical pixels are non-square. Emulator checks cannot validate the apparent
+  shape of circles, gauges, artwork, or logos; those require the real display.
+- Car UX restrictions are enforced while moving. Version 1 is parked-use software
+  unless a later native activity is explicitly designed, declared, and validated as
+  distraction optimized.
+- The Pi is the only intended ADB host. A future bridge must target one configured
+  device, use argument-array process execution, enforce timeouts and output bounds,
+  expose unavailable/unauthorized/offline states, and register every operation in a
+  typed server-side allowlist. No API accepts a shell string, arbitrary ADB arguments,
+  a package/component supplied by a client, or an unrestricted file path.
+- Begin with read-only device identity, connection health, display, package/version,
+  and carefully selected `dumpsys` collectors. Any app launch, input injection, file
+  transfer, or settings change is a separate state-changing capability requiring an
+  explicit threat model, parked-state policy, confirmation policy, and audit trail.
+- Do not use ADB or the exported SAIC vehicle service to actuate vehicle hardware in
+  this project. Vehicle telemetry and vendor APIs remain a later, read-only research
+  track until permissions, semantics, privacy, and parked-vehicle tests are documented.
+
 ### Web experience
 
 The web app must remain usable for desktop/mobile setup, but the primary runtime layout targets 1920×720 landscape.
@@ -229,7 +262,7 @@ Primary areas:
 
 ## 6. Delivery roadmap
 
-The repository currently contains planning documentation only. Status should be updated as work lands: `[ ]` pending, `[~]` in progress, `[x]` complete, `[!]` blocked.
+The repository contains a working MVP and tracks remaining delivery work here. Status markers are: `[ ]` pending, `[~]` in progress, `[x]` complete, `[!]` blocked.
 
 ### Milestone 0 — Decisions and scaffold
 
@@ -243,7 +276,7 @@ The repository currently contains planning documentation only. Status should be
 
 ### Milestone 1 — Secure authenticated vertical slice
 
-- [~] Implement SQLite migrations for users, sessions, settings, audit events, and job runs. User, session, and audit tables are complete; settings and job runs follow with Milestone 2.
+- [~] Implement SQLite migrations for users, sessions, settings, audit events, and job runs. User, session, audit, and job-run tables are complete; settings remain pending.
 - [x] Implement atomic first-admin setup, login, logout, session expiry/revocation, CSRF, and throttling.
 - [x] Build setup/login screens and authenticated application shell.
 - [x] Implement `GET /healthz` and authenticated system status with per-field availability.
@@ -254,23 +287,25 @@ The repository currently contains planning documentation only. Status should be
 
 ### Milestone 2 — Jobs, audit, and diagnostics
 
-- [ ] Implement the typed job registry, runner, timeouts, progress events, persistence, and restart recovery.
-- [ ] Add refresh-health, network-diagnostics, and sanitized-support-bundle jobs.
+- [x] Implement the typed job registry, runner, timeouts, progress events, persistence, and restart recovery.
+- [x] Add refresh-health, network-diagnostics, and sanitized-support-bundle jobs.
 - [ ] Implement action-bound confirmation infrastructure for higher-risk future jobs.
 - [ ] Build the jobs/history UI and audit timeline.
-- [ ] Add bounded output, central redaction, support-bundle manifest, and retention behavior.
+- [~] Add bounded output, central redaction, support-bundle manifest, and retention behavior. Output bounding, central redaction, and the support-bundle manifest are complete; retention remains pending.
 
 **Exit:** the three initial jobs run only through the allowlist, expose live progress, persist safe results, and create attributable audit events.
 
-### Milestone 3 — Android client
+### Milestone 3 — ADB transport and Android client
 
+- [ ] Implement one-device ADB configuration, connection/authorization state, timeouts, output bounds, and test fixtures.
+- [ ] Add allowlisted, read-only device identity and display collectors with per-field availability.
 - [ ] Create the Kotlin project with minimum SDK 28 and landscape support.
 - [ ] Implement URL setup/storage, trusted-origin navigation, and narrow cleartext policy.
 - [ ] Implement WebView session behavior, soft keyboard, refresh, loading, and offline/error screens.
 - [ ] Implement safe file chooser/download behavior where supported.
 - [ ] Produce a debug APK in CI or a documented compatible Android build environment.
 
-**Exit:** the app builds and can load/authenticate against the local dashboard in an emulator or test device; actual MG4 behavior remains explicitly unverified until hardware testing.
+**Exit:** the Pi reports truthful ADB/head-unit connection state through read-only allowlisted collectors, and the app builds and can load/authenticate against the local dashboard in an emulator or test device; actual MG4 behavior remains explicitly unverified until hardware testing.
 
 ### Milestone 4 — Pi deployment
 
@@ -381,6 +416,7 @@ Version 1 is complete only when:
 - real status is visible without fabricated fallback data;
 - the three initial jobs are allowlisted, validated, bounded, streamed, persisted, and audited;
 - a sanitized support bundle can be generated and inspected;
+- configured ADB device/display identity is read through bounded, read-only collectors with honest offline and unauthorized states;
 - the web UI is usable at 1920×720 and handles connection failure honestly;
 - the Android app builds and loads only its configured trusted origin;
 - lint, typecheck, automated tests, server/web builds, and Android build pass;