# 009 — Device polish after LAB daily-driver / GOLDEN rebacon (2026-10-16)

Owner test of the current Magisk ship zip. LAB is the daily driver (do not
wipe/flash without an explicit owner ask). GOLDEN was factory-reset and now
runs **our** build — it is no longer a live AXP.OS oracle.

**ADB / debug:** GOLDEN `11071JEC203839` (connected). Prefer GOLDEN for
`logcat` / vendor probes. LAB `11231JEC207477` stays main phone — read-only
unless the owner says otherwise.

**AXP parity oracle:** code and dumps on `a16.ssystems.de`
(`/srv/rom/references/axp/`, EXTENDROM, archived golden captures) — **not**
the live GOLDEN system anymore.

Measured on GOLDEN (our zip): `23.2-20261008-PRO-sunfish`,
`ro.build.date=Sun Oct 11 08:24:09 UTC 2026`, kernel
`4.14.357-openela-g28f9290ae067-dirty #81`.

## Priority high

### 1. configstore-hal / VINTF — **root cause + fix in WT**

- Every ~5s: `android.hardware.configstore@1.1::ISurfaceFlingerConfigs/default`
  must be in VINTF manifest → service aborts and init restarts it.
- Present on current zip: `/vendor/etc/init/android.hardware.configstore@1.1-service.rc`
  (service `vendor.configstore-hal`), binary under `/vendor/bin/hw/…`.
- **Root cause:** `build/make/target/product/base_vendor.mk` pulls
  `android.hardware.configstore@1.1-service` via
  `PRODUCT_PACKAGES_SHIPPING_API_LEVEL_29`. Lineage
  `device/google/sunfish/device-lineage.mk` normally packages
  `disable_configstore` (Soong `overrides` stub) so the HIDL HAL is **not**
  installed. Wave 4 treated that as a “lab-only command” and removed it →
  empty Configstore stanza → real HAL ships → A16 VINTF crash-loop.
- **Fix (local WT):** `apply_009_drop_lab_only_commands.py` no longer drops
  `disable_configstore`; it **restores** it if missing. Bacon postflight
  requires HAL+rc absent and `/vendor/bin/disable_configstore` present.
- Lands on next bacon/OTA; no live flash of LAB.

### 2. Thermal — keep both; fix false HAL ERROR (WT)

**Why two:** complementary, not duplicates.

| Process | Role |
|---------|------|
| `android.hardware.thermal-service.pixel` | Android HAL: temps + cooling device *reporting* (`thermal_info_config.json`) |
| `thermal-engine` | QC closed-loop: CPU/GPU/`fcc`/`modem` actions in `thermal-engine-sunfish.conf` |

Stock packaging on a16: `device.mk` packs the pixel HAL; vendor +
`init.hardware.rc` start `vendor.thermal-engine`.

**pixel-thermal ERROR root cause (confirmed):**
`thermal_info_config_sunfish.json` lists CoolingDevices
(`thermal-cpufreq-0/7`, `thermal-devfreq-0`, `fcc`) but has **zero**
`BindedCdev`/`CdevRequest`. Only sunfish among `device/google/*/thermal_info*`
is unbound like that — by design (engine mitigates). Newer pixel HAL still
runs `logCoolingDeviceStatus()` ~every few minutes and
`getCdevMaxRequest()` ERROR-spams for every unbound cdev. Sensors still read
OK (`skin-therm-monitor`, etc.). Parallel stack works; log was lying.

**Fix:** `apply_009_thermal_cdev_log.py` — skip unbound cdevs in the CDEV log
(VERBOSE note); real binded-path ERROR unchanged.

**thermal-engine (Magisk su 2026-10-16 after Magisk install):** both services
`running`, `vendor.thermal.link_ready=1`. Sysfs has full cooling set
(`fcc`, `thermal-cpufreq-*`, `thermal-devfreq-0`, `modem_*`, `adsp_vdd`, …).
Boot `dmesg`: early `Couldn't get temp USB port thermal zone rc=-22` (before
zones ready), charger WLC cooling missing (wireless), SELinux deny
`hal_power` → `hal_thermal` find (separate). No live ion/msm_thermal spam in
current buffers after reboot — treat earlier reports as boot noise unless
reproduced under load. Keep engine.

## Priority medium

### 3. OpenEUICC / EuiccDisabler — **fix in WT**

- `im.angry.openeuicc` installed (`/system_ext/priv-app/OpenEUICC`).
- Crash path is **GoogleParts**
  `device/google/sunfish/parts/.../EuiccDisabler.java`
  (`org.lineageos.settings.EuiccDisabler`), not EuiccPolicy Kotlin (that
  already guards). Stack: `Unknown package: com.google.android.euicc`.
- **Fix:** `apply_009_euicc_disabler_guard.py` — skip missing packages before
  `setApplicationEnabledSetting`. Does not retarget to OpenEUICC / does not
  disable `im.angry.openeuicc`. Wired into ship bacon after wave1 euicc drop.

### 4. MediaCodec / media_quality — **closed (expected on phone)**

Reproduced 2026-10-16 on GOLDEN (Jelly browser → HW VP9 `c2.qti.vp9.decoder`):

- `media_quality service unavailable, skipping updatePictureProfile` is
  **ALOGI**. `MediaQualityService` only starts when
  `mediaQualityFw() && isTv` (`SystemServer.java`). Phones never publish
  `media_quality`; MediaCodec skips picture profiles. Not a VINTF/codec bug.
- `Failed to query component interface …: 6` = `BAD_INDEX` while probing C2
  allocator params; same session then creates pools **OK** and plays video.
- **No ROM fix.** Do not ship TV MediaQuality just to silence an INFO line.

### 5. Audio SLIM_0_RX Format — **root cause known; no simple ship fix**

Reproduced on every speaker open (browser video). Audio still works.

- Card id: `sm6150bolerosnd` (Bolero / CDC-DMA, not classic Slimbus).
- Proprietary `audio.primary.sm6150.so` (vendor blob) defaults
  `is_slimbus_interface=true` and only clears it for an allowlist of
  full card names (`sm6150-idp-snd-card`, `sm6150-qrd-snd-card`, …).
  **`sm6150bolerosnd` is missing** → HAL looks up `SLIM_0_RX Format`, which
  does not exist; Bolero expects `WSA_CDC_DMA_RX_0 Format` (same logic exists
  in CAF `platform.c` behind `!is_slimbus_interface`).
- Soft-fail: ALOGE then continues (channel map / playback OK).
- **Fix would mean** rebuilding/replacing `audio.primary.sm6150` from CAF with
  one card-name allowlist line — not a mixer_paths XML tweak. Deferred unless
  we deliberately take on audio HAL from source (risk vs log noise).

## Build hygiene

- Kernel uname shows `-dirty` on this bacon — rebuild from a clean tree or
  document intentional WT deltas in the artifact notes.
- Non–Direct Boot apps (e.g. Metrolist) can crash before unlock — app issue,
  not ROM.

## Does not need changes (this session)

F2FS / storage, AVB/verity, encryption, SELinux enforcing, Wi‑Fi / BT / calls /
camera / video / audio functional path. Nora display-during-video is device-
specific, not ROM.

## Next bacon / OTA note

This list is **device polish**, not the full upstream OTA path. Still follow
`docs/009-ota-rebuild-checklist.md` + `docs/009-upstream-rebase-ota.md` for
sync / Magisk / apps gates. Land polish as vendor apply scripts + postflight
checks where possible.

### Host commands (2026-10-16 polish bacon)

```bash
# From laptop (after WT edits):
./scripts/009-sync-ota-stage-to-host.sh
./scripts/009-relaunch-polish-bacon.sh

# On rom-dev01:
cat /srv/rom/artifacts/detach-bacon009polish20261016.status
tmux attach -t bacon009polish20261016   # optional
```

Apply wiring in ship bacon (order): euicc guard → thermal CDEV log → … → wave4
`drop_lab_only_commands` (configstore restore). See
`scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh`.