docs product DRV_16_CONTRACT

DRV-16 — Mobile driver hub and Premium states contract

Date: 2026-10-26. B-BR-DRV-01/20. Freeze before behavior.

Navigation entry

• A real driver-hub route is reachable from Perfil and from Veículos. It is a child of the Perfil tab, so the four-tab shell (Explorar, Comunidade, Mapa, Perfil), existing map deep links and back behavior stay unchanged.
• The hub exposes only existing real destinations: vehicle form/list, ledger entries and monthly indicators/export. No driver function is fabricated.

Access states and retained data

• The hub derives state from the signed session and server-derived Premium status: VERIFIED, OFFLINE, LAPSED, UNAVAILABLE or SIGNED_OUT. It never infers entitlement from a local toggle.
• OFFLINE/UNAVAILABLE retain local vehicle/ledger/monthly actions and a retry. LAPSED still offers read, correction and monthly export of held data; the Premium action opens the existing Premium screen. No checkout, price, trial or trust/reputation change is created.
• SIGNED_OUT offers the existing sign-in flow and never shows another owner's records.

First use and failures

• With no vehicle, the hub explains the vehicle-first path and opens the real vehicle form/list. With a vehicle, it opens real ledger entries and monthly indicators/export.
• Loading uses the shared loading state; vehicle/status failures show actionable retry/error copy. No placeholder success is shown.
• Shift control is not implemented in this phase (DRV-18); the hub does not render a fake shift action. This is an explicit scope boundary, not an acceptance claim for shift forms.

Evidence boundary

JVM route/state tests and owned-emulator Compose tests must cover the hub, states and four-tab/back behavior. The driver mobile/day gates remain later.