009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-lab-polish-20261016.md

@@ -0,0 +1,147 @@
+# 009 — Device polish after LAB daily-driver / GOLDEN rebacon (2026-10-16)
+
+Owner test of the current Magisk ship zip. LAB is the daily driver (do not
+wipe/flash without an explicit owner ask). GOLDEN was factory-reset and now
+runs **our** build — it is no longer a live AXP.OS oracle.
+
+**ADB / debug:** GOLDEN `11071JEC203839` (connected). Prefer GOLDEN for
+`logcat` / vendor probes. LAB `11231JEC207477` stays main phone — read-only
+unless the owner says otherwise.
+
+**AXP parity oracle:** code and dumps on `a16.ssystems.de`
+(`/srv/rom/references/axp/`, EXTENDROM, archived golden captures) — **not**
+the live GOLDEN system anymore.
+
+Measured on GOLDEN (our zip): `23.2-20261008-PRO-sunfish`,
+`ro.build.date=Sun Oct 11 08:24:09 UTC 2026`, kernel
+`4.14.357-openela-g28f9290ae067-dirty #81`.
+
+## Priority high
+
+### 1. configstore-hal / VINTF — **root cause + fix in WT**
+
+- Every ~5s: `android.hardware.configstore@1.1::ISurfaceFlingerConfigs/default`
+  must be in VINTF manifest → service aborts and init restarts it.
+- Present on current zip: `/vendor/etc/init/android.hardware.configstore@1.1-service.rc`
+  (service `vendor.configstore-hal`), binary under `/vendor/bin/hw/…`.
+- **Root cause:** `build/make/target/product/base_vendor.mk` pulls
+  `android.hardware.configstore@1.1-service` via
+  `PRODUCT_PACKAGES_SHIPPING_API_LEVEL_29`. Lineage
+  `device/google/sunfish/device-lineage.mk` normally packages
+  `disable_configstore` (Soong `overrides` stub) so the HIDL HAL is **not**
+  installed. Wave 4 treated that as a “lab-only command” and removed it →
+  empty Configstore stanza → real HAL ships → A16 VINTF crash-loop.
+- **Fix (local WT):** `apply_009_drop_lab_only_commands.py` no longer drops
+  `disable_configstore`; it **restores** it if missing. Bacon postflight
+  requires HAL+rc absent and `/vendor/bin/disable_configstore` present.
+- Lands on next bacon/OTA; no live flash of LAB.
+
+### 2. Thermal — keep both; fix false HAL ERROR (WT)
+
+**Why two:** complementary, not duplicates.
+
+| Process | Role |
+|---------|------|
+| `android.hardware.thermal-service.pixel` | Android HAL: temps + cooling device *reporting* (`thermal_info_config.json`) |
+| `thermal-engine` | QC closed-loop: CPU/GPU/`fcc`/`modem` actions in `thermal-engine-sunfish.conf` |
+
+Stock packaging on a16: `device.mk` packs the pixel HAL; vendor +
+`init.hardware.rc` start `vendor.thermal-engine`.
+
+**pixel-thermal ERROR root cause (confirmed):**
+`thermal_info_config_sunfish.json` lists CoolingDevices
+(`thermal-cpufreq-0/7`, `thermal-devfreq-0`, `fcc`) but has **zero**
+`BindedCdev`/`CdevRequest`. Only sunfish among `device/google/*/thermal_info*`
+is unbound like that — by design (engine mitigates). Newer pixel HAL still
+runs `logCoolingDeviceStatus()` ~every few minutes and
+`getCdevMaxRequest()` ERROR-spams for every unbound cdev. Sensors still read
+OK (`skin-therm-monitor`, etc.). Parallel stack works; log was lying.
+
+**Fix:** `apply_009_thermal_cdev_log.py` — skip unbound cdevs in the CDEV log
+(VERBOSE note); real binded-path ERROR unchanged.
+
+**thermal-engine (Magisk su 2026-10-16 after Magisk install):** both services
+`running`, `vendor.thermal.link_ready=1`. Sysfs has full cooling set
+(`fcc`, `thermal-cpufreq-*`, `thermal-devfreq-0`, `modem_*`, `adsp_vdd`, …).
+Boot `dmesg`: early `Couldn't get temp USB port thermal zone rc=-22` (before
+zones ready), charger WLC cooling missing (wireless), SELinux deny
+`hal_power` → `hal_thermal` find (separate). No live ion/msm_thermal spam in
+current buffers after reboot — treat earlier reports as boot noise unless
+reproduced under load. Keep engine.
+
+## Priority medium
+
+### 3. OpenEUICC / EuiccDisabler — **fix in WT**
+
+- `im.angry.openeuicc` installed (`/system_ext/priv-app/OpenEUICC`).
+- Crash path is **GoogleParts**
+  `device/google/sunfish/parts/.../EuiccDisabler.java`
+  (`org.lineageos.settings.EuiccDisabler`), not EuiccPolicy Kotlin (that
+  already guards). Stack: `Unknown package: com.google.android.euicc`.
+- **Fix:** `apply_009_euicc_disabler_guard.py` — skip missing packages before
+  `setApplicationEnabledSetting`. Does not retarget to OpenEUICC / does not
+  disable `im.angry.openeuicc`. Wired into ship bacon after wave1 euicc drop.
+
+### 4. MediaCodec / media_quality — **closed (expected on phone)**
+
+Reproduced 2026-10-16 on GOLDEN (Jelly browser → HW VP9 `c2.qti.vp9.decoder`):
+
+- `media_quality service unavailable, skipping updatePictureProfile` is
+  **ALOGI**. `MediaQualityService` only starts when
+  `mediaQualityFw() && isTv` (`SystemServer.java`). Phones never publish
+  `media_quality`; MediaCodec skips picture profiles. Not a VINTF/codec bug.
+- `Failed to query component interface …: 6` = `BAD_INDEX` while probing C2
+  allocator params; same session then creates pools **OK** and plays video.
+- **No ROM fix.** Do not ship TV MediaQuality just to silence an INFO line.
+
+### 5. Audio SLIM_0_RX Format — **root cause known; no simple ship fix**
+
+Reproduced on every speaker open (browser video). Audio still works.
+
+- Card id: `sm6150bolerosnd` (Bolero / CDC-DMA, not classic Slimbus).
+- Proprietary `audio.primary.sm6150.so` (vendor blob) defaults
+  `is_slimbus_interface=true` and only clears it for an allowlist of
+  full card names (`sm6150-idp-snd-card`, `sm6150-qrd-snd-card`, …).
+  **`sm6150bolerosnd` is missing** → HAL looks up `SLIM_0_RX Format`, which
+  does not exist; Bolero expects `WSA_CDC_DMA_RX_0 Format` (same logic exists
+  in CAF `platform.c` behind `!is_slimbus_interface`).
+- Soft-fail: ALOGE then continues (channel map / playback OK).
+- **Fix would mean** rebuilding/replacing `audio.primary.sm6150` from CAF with
+  one card-name allowlist line — not a mixer_paths XML tweak. Deferred unless
+  we deliberately take on audio HAL from source (risk vs log noise).
+
+## Build hygiene
+
+- Kernel uname shows `-dirty` on this bacon — rebuild from a clean tree or
+  document intentional WT deltas in the artifact notes.
+- Non–Direct Boot apps (e.g. Metrolist) can crash before unlock — app issue,
+  not ROM.
+
+## Does not need changes (this session)
+
+F2FS / storage, AVB/verity, encryption, SELinux enforcing, Wi‑Fi / BT / calls /
+camera / video / audio functional path. Nora display-during-video is device-
+specific, not ROM.
+
+## Next bacon / OTA note
+
+This list is **device polish**, not the full upstream OTA path. Still follow
+`docs/009-ota-rebuild-checklist.md` + `docs/009-upstream-rebase-ota.md` for
+sync / Magisk / apps gates. Land polish as vendor apply scripts + postflight
+checks where possible.
+
+### Host commands (2026-10-16 polish bacon)
+
+```bash
+# From laptop (after WT edits):
+./scripts/009-sync-ota-stage-to-host.sh
+./scripts/009-relaunch-polish-bacon.sh
+
+# On rom-dev01:
+cat /srv/rom/artifacts/detach-bacon009polish20261016.status
+tmux attach -t bacon009polish20261016   # optional
+```
+
+Apply wiring in ship bacon (order): euicc guard → thermal CDEV log → … → wave4
+`drop_lab_only_commands` (configstore restore). See
+`scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh`.