docs: BUG-16/17/18 — Phase 29 road-test findings (trip missing, clock drift, no RTC)

BUGS.md

@@ -23,6 +23,35 @@ When CLOSED, move the entire entry to Resolved — don't duplicate.
 - **Pi-side hardening shipped 2026-08-12**: `phone-hotspot` now forces public DNS
   (`8.8.8.8`/`1.1.1.1`) and the Settings page surfaces the correct URL per uplink mode.
 
+### BUG-16 — Trip missing from Pi local history (present on server)
+- **Status**: `OPEN` 2026-08-13
+- **Phase**: 29
+- **Symptom**: a drive produced a trip on the server portal but not in the Pi's local
+  trip history.
+- **Hypothesis**: the Pi's trip builder suppresses trips until the car ECU has been
+  reached once (`was_car_ever_connected`), so a mid-drive reboot with a slow/failed OBD
+  reconnect can skip local trip building — while the raw rows still upload and the server
+  (no such guard) builds the trip. Investigate against the raw `tracking` rows for that drive.
+
+### BUG-17 — Server trip timestamps wrong after an offline period
+- **Status**: `OPEN` 2026-08-13
+- **Phase**: 29
+- **Symptom**: two trips from the 2026-08-13 drive have bad timestamps on the server:
+  - Trip **25136** — time is wrong.
+  - Trip **25137** — starts 09:59, then jumps to 14:xx after the first point.
+- **Cause (hypothesis)**: the Pi has no RTC, so while offline it runs on a stale
+  `fake-hwclock` time; when NTP later re-syncs, the clock snaps forward, producing the
+  timestamp jump mid-trip. Root cause is BUG-18.
+
+### BUG-18 — Pi needs offline timekeeping (no RTC)
+- **Status**: `OPEN` 2026-08-13
+- **Phase**: 29
+- **Problem**: the Pi 3 has no real-time clock. Without internet (no NTP) the system clock
+  is wrong across power cycles, corrupting tracking/trip timestamps (BUG-16/BUG-17).
+- **Fix direction**: add a battery-backed RTC (DS3231) on I²C so time survives power-off,
+  and/or derive time from the SIM868 GNSS fix (GPS time) while offline. Keep
+  `systemd-timesyncd` for online sync and fall back to the RTC/GNSS source when offline.
+
 ---
 
 ## Resolved