Stats: Resume the open charge session across a process restart

A process death while plugged in restarted the live card's "Since …" at
process-launch time: startup repair sealed every open row unconditionally,
so the next tick opened a fresh session stamped with the current time and
history gained a duplicate row for one physical charge.

Android exposes no plug-in timestamp, but the row was already persisted.
Startup repair now probes current battery state (via the existing
BatteryReader sticky read) and reattaches the newest open row when the
evidence is consistent with the same plug event, else seals as before.

Continuity is inferred, not observed, so the guards are best-effort and
biased toward merging: a replug at an unchanged level during the gap is
indistinguishable from an uninterrupted plug. Two things keep that honest
— a resumed row is always flagged partial, and its last power/temperature
readings are dropped so the unobserved gap is never credited to the
aggregates. A wrong merge costs an over-long duration, never invented
averages.

The probe runs synchronously in startup repair rather than on the first
watcher tick: a row held open awaiting a tick renders as a live session
and suppresses the "couldn't start capture" retry when the foreground
service fails to start.

Also fixed, all reachable before this change:

- BootIdSource's -1 sentinel compares equal across two different boots, so
  an unknown boot id is now explicitly disqualifying rather than merely
  degraded — otherwise a resume could splice two boots' elapsed-realtime
  readings into one bogus duration.
- ChargeStatsRepository.currentSession() keyed distinctUntilChangedBy on
  the row id alone while capturing the row inside flatMapLatest, so a
  partial flip on the same row was suppressed for the lifetime of the
  subscription.
- StatsCardPresentation preferred Live whenever a row existed. A resumed
  row stays open by design, so a failed service start would show a frozen
  live card and hide the retry. A failed start now wins.
- The lastCapture stamp is written after the session row is committed, so
  a death in between left an open row that startup repair skipped
  entirely, stranding it and letting the next tick open a second row.

ChargeStatsRecorder gains an injected dispatcher (@StatsDispatcher) so the
new Robolectric test can drive its command loop. The stats test classes now
use per-test temp-file DataStores instead of sharing the app's real path.

Verified on a Pixel 8 (resume across force-stop, unplugged reject,
level-drop reject, and BOOT_MISMATCH plus REBOOT seal across a real
reboot).

Author: d4rken

app/src/main/java/eu/darken/amply/stats/core/BootIdSource.kt

@@ -9,9 +9,14 @@ import javax.inject.Singleton
 /**
  * Reads the device boot count, used to tell a same-boot process restart (resume the open session)
  * from a reboot (seal it — elapsed-time continuity can't survive a power-off). The value can only
- * change across a reboot, which restarts this process, so it is read once and cached. A device that
- * doesn't report [Settings.Global.BOOT_COUNT] yields a constant sentinel; reboots then look like
- * same-boot restarts, which degrades to a partial/interrupted seal rather than anything unsafe.
+ * change across a reboot, which restarts this process, so it is read once and cached.
+ *
+ * A device that doesn't report [Settings.Global.BOOT_COUNT] yields the [UNAVAILABLE] sentinel, which
+ * two different boots would compare *equal* on. So the sentinel is not merely a degraded id — it is
+ * explicitly disqualifying: [StatsSessionEngine.evaluateResume] refuses to resume an open session
+ * when either side is [UNAVAILABLE], because a resume across an unnoticed reboot would splice two
+ * boots' [android.os.SystemClock.elapsedRealtime] readings into one bogus duration. Such a device
+ * always falls back to sealing, which is lossy but never wrong.
  */
 @Singleton
 class BootIdSource @Inject constructor(
@@ -22,10 +27,11 @@ class BootIdSource @Inject constructor(
     fun current(): Long = cached
 
     private fun read(): Long = runCatching {
-        Settings.Global.getInt(context.contentResolver, Settings.Global.BOOT_COUNT, UNAVAILABLE).toLong()
-    }.getOrDefault(UNAVAILABLE.toLong())
+        Settings.Global.getInt(context.contentResolver, Settings.Global.BOOT_COUNT, UNAVAILABLE.toInt()).toLong()
+    }.getOrDefault(UNAVAILABLE)
 
-    private companion object {
-        const val UNAVAILABLE = -1
+    companion object {
+        /** Boot identity could not be determined — never usable to prove two observations share a boot. */
+        const val UNAVAILABLE = -1L
     }
 }

app/src/main/java/eu/darken/amply/stats/core/ChargeStatsRecorder.kt

@@ -1,6 +1,7 @@
 package eu.darken.amply.stats.core
 
 import android.os.BatteryManager
+import android.os.SystemClock
 import androidx.room.withTransaction
 import dagger.Lazy
 import eu.darken.amply.battery.core.BatteryReadout
@@ -10,10 +11,11 @@ import eu.darken.amply.common.debug.logging.log
 import eu.darken.amply.common.debug.logging.logTag
 import eu.darken.amply.stats.core.db.BatterySampleEntity
 import eu.darken.amply.stats.core.db.ChargeSessionEntity
+import eu.darken.amply.stats.core.db.StatsDao
 import eu.darken.amply.stats.core.db.StatsDatabase
 import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CoroutineDispatcher
 import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.channels.Channel
 import kotlinx.coroutines.flow.first
@@ -41,8 +43,9 @@ class ChargeStatsRecorder @Inject constructor(
     private val preferences: StatsPreferences,
     private val bootIdSource: BootIdSource,
     private val batteryReader: BatteryReader,
+    @StatsDispatcher dispatcher: CoroutineDispatcher,
 ) {
-    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private val scope = CoroutineScope(SupervisorJob() + dispatcher)
     private val commands = Channel<Command>(Channel.UNLIMITED)
 
     // Mutated only by the single consumer coroutine below — no locking needed.
@@ -54,8 +57,8 @@ class ChargeStatsRecorder @Inject constructor(
 
     init {
         scope.launch {
-            // Runs before any command: seals sessions left open by an unclean shutdown, and seeds the
-            // capturing flag from the durable preference.
+            // Runs before any command: reconciles sessions left open by an unclean shutdown, and seeds
+            // the capturing flag from the durable preference.
             startupRepair()
             for (command in commands) {
                 try {
@@ -92,10 +95,12 @@ class ChargeStatsRecorder @Inject constructor(
         try {
             capturing = preferences.isCaptureEnabledNow()
             // Only touch the DB when we might have data — avoids creating an empty stats.db for users
-            // who never enabled statistics. A dangling open row can only exist after prior recording,
-            // which always stamps lastCapture.
-            if (preferences.lastCaptureWallMillis.first() == null) return
-            sealDanglingSessions()
+            // who never enabled statistics. The lastCapture stamp alone is not a sound existence test:
+            // it is written after the row is committed, so a process death in between leaves an open
+            // row with no stamp. Capture being enabled is therefore also sufficient — such a user gets
+            // a stats.db on the next tick anyway, so opening it here costs nothing.
+            if (!capturing && preferences.lastCaptureWallMillis.first() == null) return
+            reconcileDanglingSessions()
         } catch (e: CancellationException) {
             throw e
         } catch (e: Exception) {
@@ -243,24 +248,70 @@ class ChargeStatsRecorder @Inject constructor(
     }
 
     /**
-     * Seal every session left open by an unclean shutdown (process kill / reboot). Never resumes:
-     * losing the monitor mid-charge breaks curve/elapsed continuity, so the session is closed
-     * honestly and the next plug opens a fresh one. This also sidesteps having to trust the boot
-     * count — a resumed session would risk a negative post-reboot duration.
+     * Reconcile sessions left open by an unclean shutdown (process kill / reboot). The newest row is
+     * offered to [StatsSessionEngine.evaluateResume] against the battery state observed right now; if
+     * the same plug event is still underway it is reattached, keeping the true plug-in time and one
+     * history row per physical charge. Everything else is sealed as before.
+     *
+     * The probe happens here rather than on the first watcher tick on purpose. A held-open row would
+     * be rendered as a live session by the dashboard for as long as no tick arrives — which also
+     * suppresses the "couldn't start capture" retry when the foreground service fails to start — and
+     * would need leak guards on the disable/clear paths. Resolving synchronously costs one sticky
+     * broadcast read and leaves [onSample] untouched.
      */
-    private suspend fun sealDanglingSessions() {
+    private suspend fun reconcileDanglingSessions() {
         val dao = database.get().statsDao()
         val open = dao.openSessions()
         if (open.isEmpty()) return
         val currentBoot = bootIdSource.current()
-        open.forEach { row ->
-            val sealed = sealFromLastKnown(row, currentBoot)
-            // Drop a dangling row that never captured anything (same rule as a live seal).
-            if (StatsSessionEngine.isDiscardable(sealed)) dao.deleteSession(sealed.id) else dao.updateSession(sealed)
-        }
+        // Capture is off, so no tick is coming to advance a resumed row — seal everything, as before.
+        // Ordered by id (monotonic), matching the row `openSessionFlow` shows as live; `openSessions`
+        // orders by elapsed-realtime, which disagrees across a reboot.
+        val candidate = if (capturing) open.maxByOrNull { it.id } else null
+        val resumed = candidate?.let { resumeOrNull(it, currentBoot) }
+        open.filter { it.id != resumed?.id }.forEach { row -> sealDangling(dao, row, currentBoot) }
         open.maxOfOrNull { it.runningLastWallMillis ?: it.startedAtWallMillis }?.let { purgeOldSamples(it) }
     }
 
+    /**
+     * Reattach [row] if the charge it recorded is still running, else null. In-memory state is
+     * installed only *after* the durable write returns: command failures are logged and swallowed
+     * (see the loop above), and a remembered-but-unwritten session would let a later tick open a
+     * second row against a row the database still has open.
+     */
+    private suspend fun resumeOrNull(row: ChargeSessionEntity, currentBoot: Long): ChargeSessionEntity? {
+        val readout = batteryReader.read()
+        val probe = ResumeProbe(
+            elapsedRealtimeMillis = SystemClock.elapsedRealtime(),
+            bootId = currentBoot,
+            plugged = (readout.plugged ?: 0) != 0,
+            percent = readout.levelPercent,
+        )
+        return when (val decision = StatsSessionEngine.evaluateResume(row, probe)) {
+            is ResumeDecision.Reject -> {
+                log(TAG) { "Not resuming session ${row.id}: ${decision.reason}" }
+                null
+            }
+
+            is ResumeDecision.Resume -> {
+                database.get().statsDao().updateSession(decision.session)
+                openSession = decision.session
+                // Continue the existing cadence instead of restarting it, so the resumed session
+                // doesn't force an extra curve point on top of the one it already has.
+                lastRecordedElapsed = decision.session.runningLastElapsedRealtimeMillis
+                lastRecordedPercent = decision.session.runningLastPercent
+                log(TAG, Logging.Priority.INFO) { "Resumed charge session ${decision.session.id}" }
+                decision.session
+            }
+        }
+    }
+
+    private suspend fun sealDangling(dao: StatsDao, row: ChargeSessionEntity, currentBoot: Long) {
+        val sealed = sealFromLastKnown(row, currentBoot)
+        // Drop a dangling row that never captured anything (same rule as a live seal).
+        if (StatsSessionEngine.isDiscardable(sealed)) dao.deleteSession(sealed.id) else dao.updateSession(sealed)
+    }
+
     private fun sealFromLastKnown(row: ChargeSessionEntity, currentBoot: Long): ChargeSessionEntity {
         val reason = if (row.bootId != currentBoot) StatsSealReason.REBOOT else StatsSealReason.INTERRUPTED
         return StatsSessionEngine.seal(

app/src/main/java/eu/darken/amply/stats/core/ChargeStatsRepository.kt

@@ -35,14 +35,17 @@ class ChargeStatsRepository @Inject constructor(
      * The in-progress charge session of the current boot, or null when nothing is open, as a live flow
      * for the dashboard card. The curve is a bounded recent window (decimated) so a session that stays
      * open for days at an OEM charge limit never triggers an unbounded reload on every appended sample.
-     * `distinctUntilChangedBy(id)` keeps the inner sample flow subscribed across the per-tick session-row
-     * updates (the open row's start fields are immutable, so only a change of session identity matters),
-     * avoiding a redundant curve re-query on every fold.
+     * `distinctUntilChangedBy` keeps the inner sample flow subscribed across the per-tick session-row
+     * updates, avoiding a redundant curve re-query on every fold. It keys on identity **plus every row
+     * field this flow actually renders**: `partial` flips when a session is resumed after a process
+     * restart, and since the row is captured inside `flatMapLatest`, an id-only key would pin the stale
+     * copy for the lifetime of the subscription. The remaining projected fields (the start columns) are
+     * immutable once the row exists.
      */
     @OptIn(ExperimentalCoroutinesApi::class)
     fun currentSession(): Flow<StatsLiveSession?> =
         database.get().statsDao().openSessionFlow(bootIdSource.current())
-            .distinctUntilChangedBy { it?.id }
+            .distinctUntilChangedBy { row -> row?.let { it.id to it.partial } }
             .flatMapLatest { row ->
                 if (row == null) {
                     flowOf(null)

app/src/main/java/eu/darken/amply/stats/core/StatsModule.kt

@@ -2,10 +2,14 @@ package eu.darken.amply.stats.core
 
 import dagger.Binds
 import dagger.Module
+import dagger.Provides
 import dagger.hilt.InstallIn
 import dagger.hilt.components.SingletonComponent
 import dagger.multibindings.IntoSet
 import eu.darken.amply.monitor.core.ChargeMonitorWatcher
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.Dispatchers
+import javax.inject.Qualifier
 
 /**
  * Contributes [ChargeStatsWatcher] into the shared [Set] of [ChargeMonitorWatcher]s the
@@ -18,4 +22,20 @@ abstract class StatsModule {
     @Binds
     @IntoSet
     abstract fun bindStatsWatcher(impl: ChargeStatsWatcher): ChargeMonitorWatcher
+
+    companion object {
+        @Provides
+        @StatsDispatcher
+        fun statsDispatcher(): CoroutineDispatcher = Dispatchers.IO
+    }
 }
+
+/**
+ * The dispatcher [ChargeStatsRecorder] runs its serialized command loop on. Injected rather than
+ * hardcoded purely so tests can substitute a deterministic scheduler; production is always
+ * [Dispatchers.IO]. Qualified (and scoped to the stats feature) so this doesn't become an
+ * unqualified app-wide `CoroutineDispatcher` binding.
+ */
+@Qualifier
+@Retention(AnnotationRetention.BINARY)
+annotation class StatsDispatcher

app/src/main/java/eu/darken/amply/stats/core/StatsSealReason.kt

@@ -9,7 +9,12 @@ enum class StatsSealReason {
     /** Charger removed — the normal, complete end of a session. */
     UNPLUGGED,
 
-    /** Reopened an open session after a process restart within the same boot; curve has a gap. */
+    /**
+     * Found open after a process restart and *not* resumable — the charge it recorded could not be
+     * shown to still be running (unplugged since, level dropped, unknown boot). A restart that is
+     * consistent with the same plug event reattaches the row instead of sealing it, so this reason
+     * means the evidence failed, not merely that the process died.
+     */
     INTERRUPTED,
 
     /** Open session found after a reboot; elapsed-time continuity across power-off can't be trusted. */

app/src/main/java/eu/darken/amply/stats/core/StatsSessionEngine.kt

@@ -18,6 +18,49 @@ sealed interface StatsTransition {
     data object Ignore : StatsTransition
 }
 
+/**
+ * Current battery state observed at process start, used to reconcile a session left open by a
+ * process death. Deliberately *not* a [StatsSample]: that type's contract is "built from the exact
+ * intent the charge-session service evaluated", while this comes from an independent sticky read
+ * before any service tick exists.
+ */
+data class ResumeProbe(
+    val elapsedRealtimeMillis: Long,
+    val bootId: Long,
+    val plugged: Boolean,
+    val percent: Int?,
+)
+
+/** Outcome of reconciling a dangling open session against a [ResumeProbe]. */
+sealed interface ResumeDecision {
+
+    /** Reattach [session] — the same plug event is still in progress, as far as can be told. */
+    data class Resume(val session: ChargeSessionEntity) : ResumeDecision
+
+    /** Seal the row instead; [reason] is for diagnostics only. */
+    data class Reject(val reason: Reason) : ResumeDecision
+
+    enum class Reason {
+        /** Row is already sealed — nothing to reconcile. */
+        CLOSED,
+
+        /** No external power now, so whatever charge was underway has ended. */
+        UNPLUGGED,
+
+        /** Boot identity is unknown on either side, so a same-boot claim can't be made. */
+        BOOT_UNKNOWN,
+
+        /** A reboot happened; elapsed-realtime readings from two boots can't be compared. */
+        BOOT_MISMATCH,
+
+        /** Probe predates the row's last sample — the clock base can't be the one we recorded against. */
+        TIME_WENT_BACKWARDS,
+
+        /** Charge level fell while we weren't looking, so the device discharged in the gap. */
+        LEVEL_DROPPED,
+    }
+}
+
 /**
  * Pure charge-session segmentation and online aggregation. Holds no state itself: the open session
  * is a [ChargeSessionEntity] the recorder loads from (and persists to) Room, so every decision
@@ -69,6 +112,51 @@ object StatsSessionEngine {
         return zeroDuration && noLevelGain && sealed.runningSampleCount <= 1
     }
 
+    /**
+     * Reconcile a session left open by a process death against the battery state observed at the next
+     * process start. Resuming keeps the real plug-in time and one history row for one physical charge;
+     * the alternative (always sealing) restarts the session at process-launch time, which reads as a
+     * wrong "Since …" and splits one charge into two rows.
+     *
+     * Continuity here is **inferred, not observed** — nothing survived the gap to witness it. A replug
+     * at an equal-or-higher level is indistinguishable from an uninterrupted plug, and a level *drop*
+     * while plugged is possible (heavy load, weak charger, thermal throttling, an OEM hold). So these
+     * guards are best-effort and deliberately biased toward merging: an occasional merged plug cycle
+     * beats fragmenting real sessions. Two things keep that bias honest, both applied on [Resume]:
+     * the row is flagged [ChargeSessionEntity.partial], and the last power/temperature readings are
+     * dropped so [fold] credits **nothing** for the unobserved gap (see the null handling in
+     * [creditInterval]). A wrong merge therefore costs an over-long duration — never invented
+     * power/temperature averages.
+     */
+    fun evaluateResume(row: ChargeSessionEntity, probe: ResumeProbe): ResumeDecision {
+        val lastObserved = row.runningLastElapsedRealtimeMillis ?: row.startedElapsedRealtimeMillis
+        val reason = when {
+            row.endedAtWallMillis != null -> ResumeDecision.Reason.CLOSED
+            !probe.plugged -> ResumeDecision.Reason.UNPLUGGED
+            // Checked before equality: the sentinel compares equal to itself across *different* boots.
+            probe.bootId == BootIdSource.UNAVAILABLE ||
+                row.bootId == BootIdSource.UNAVAILABLE -> ResumeDecision.Reason.BOOT_UNKNOWN
+            probe.bootId != row.bootId -> ResumeDecision.Reason.BOOT_MISMATCH
+            probe.elapsedRealtimeMillis < lastObserved -> ResumeDecision.Reason.TIME_WENT_BACKWARDS
+            droppedLevel(row.runningLastPercent, probe.percent) -> ResumeDecision.Reason.LEVEL_DROPPED
+            else -> null
+        }
+        if (reason != null) return ResumeDecision.Reject(reason)
+        return ResumeDecision.Resume(
+            row.copy(
+                // The curve has a hole and the continuity is inferred — never present this as a clean
+                // plug→unplug history.
+                partial = true,
+                runningLastPowerMilliwatts = null,
+                runningLastTemperatureTenthsC = null,
+            ),
+        )
+    }
+
+    /** True only when both readings exist and the level fell — a missing reading is not evidence. */
+    private fun droppedLevel(lastPercent: Int?, probePercent: Int?): Boolean =
+        lastPercent != null && probePercent != null && probePercent < lastPercent
+
     fun open(sample: StatsSample, partial: Boolean): ChargeSessionEntity = ChargeSessionEntity(
         startedAtWallMillis = sample.wallMillis,
         startedElapsedRealtimeMillis = sample.elapsedRealtimeMillis,

app/src/main/java/eu/darken/amply/stats/core/db/ChargeSessionEntity.kt

@@ -40,8 +40,10 @@ data class ChargeSessionEntity(
 
     /**
      * True when the session does not represent a clean plug→unplug: capture was enabled mid-charge,
-     * started already at 100%, or the session was sealed by process recovery / reboot. The UI labels
-     * these as partial rather than presenting them as complete histories.
+     * started already at 100%, the session was sealed by process recovery / reboot, or it was resumed
+     * after a process restart (start time and totals are real, but the curve has a gap and continuity
+     * across that gap is inferred rather than observed). The UI labels these as partial rather than
+     * presenting them as complete histories.
      */
     val partial: Boolean = false,