AXP-Resurection/docs/009-lab-polish-20261016.md

009 — Device polish after LAB daily-driver / GOLDEN rebacon (2026-10-16)

Owner test of the current Magisk ship zip. LAB is the daily driver (do not wipe/flash without an explicit owner ask). GOLDEN was factory-reset and now runs our build — it is no longer a live AXP.OS oracle.

ADB / debug: GOLDEN 11071JEC203839 (connected). Prefer GOLDEN for logcat / vendor probes. LAB 11231JEC207477 stays main phone — read-only unless the owner says otherwise.

AXP parity oracle: code and dumps on a16.ssystems.de (/srv/rom/references/axp/, EXTENDROM, archived golden captures) — not the live GOLDEN system anymore.

Measured on GOLDEN (our zip): 23.2-20261008-PRO-sunfish, ro.build.date=Sun Oct 11 08:24:09 UTC 2026, kernel 4.14.357-openela-g28f9290ae067-dirty #81.

Priority high

1. configstore-hal / VINTF — root cause + fix in WT

• Every ~5s: android.hardware.configstore@1.1::ISurfaceFlingerConfigs/default must be in VINTF manifest → service aborts and init restarts it.
• Present on current zip: /vendor/etc/init/android.hardware.configstore@1.1-service.rc (service vendor.configstore-hal), binary under /vendor/bin/hw/….
• Root cause: build/make/target/product/base_vendor.mk pulls android.hardware.configstore@1.1-service via PRODUCT_PACKAGES_SHIPPING_API_LEVEL_29. Lineage device/google/sunfish/device-lineage.mk normally packages disable_configstore (Soong overrides stub) so the HIDL HAL is not installed. Wave 4 treated that as a “lab-only command” and removed it → empty Configstore stanza → real HAL ships → A16 VINTF crash-loop.
• Fix (local WT): apply_009_drop_lab_only_commands.py no longer drops disable_configstore; it restores it if missing. Bacon postflight requires HAL+rc absent and /vendor/bin/disable_configstore present.
• Lands on next bacon/OTA; no live flash of LAB.

2. Thermal — keep both; fix false HAL ERROR (WT)

Why two: complementary, not duplicates.

Process	Role
android.hardware.thermal-service.pixel	Android HAL: temps + cooling device reporting (thermal_info_config.json)
thermal-engine	QC closed-loop: CPU/GPU/fcc/modem actions in thermal-engine-sunfish.conf

Stock packaging on a16: device.mk packs the pixel HAL; vendor + init.hardware.rc start vendor.thermal-engine.

pixel-thermal ERROR root cause (confirmed): thermal_info_config_sunfish.json lists CoolingDevices (thermal-cpufreq-0/7, thermal-devfreq-0, fcc) but has zero BindedCdev/CdevRequest. Only sunfish among device/google/*/thermal_info* is unbound like that — by design (engine mitigates). Newer pixel HAL still runs logCoolingDeviceStatus() ~every few minutes and getCdevMaxRequest() ERROR-spams for every unbound cdev. Sensors still read OK (skin-therm-monitor, etc.). Parallel stack works; log was lying.

Fix: apply_009_thermal_cdev_log.py — skip unbound cdevs in the CDEV log (VERBOSE note); real binded-path ERROR unchanged.

thermal-engine (Magisk su 2026-10-16 after Magisk install): both services running, vendor.thermal.link_ready=1. Sysfs has full cooling set (fcc, thermal-cpufreq-*, thermal-devfreq-0, modem_*, adsp_vdd, …). Boot dmesg: early Couldn't get temp USB port thermal zone rc=-22 (before zones ready), charger WLC cooling missing (wireless), SELinux deny hal_power → hal_thermal find (separate). No live ion/msm_thermal spam in current buffers after reboot — treat earlier reports as boot noise unless reproduced under load. Keep engine.

Priority medium

3. OpenEUICC / EuiccDisabler — fix in WT

• im.angry.openeuicc installed (/system_ext/priv-app/OpenEUICC).
• Crash path is GoogleParts device/google/sunfish/parts/.../EuiccDisabler.java (org.lineageos.settings.EuiccDisabler), not EuiccPolicy Kotlin (that already guards). Stack: Unknown package: com.google.android.euicc.
• Fix: apply_009_euicc_disabler_guard.py — skip missing packages before setApplicationEnabledSetting. Does not retarget to OpenEUICC / does not disable im.angry.openeuicc. Wired into ship bacon after wave1 euicc drop.

4. MediaCodec / media_quality — closed (expected on phone)

Reproduced 2026-10-16 on GOLDEN (Jelly browser → HW VP9 c2.qti.vp9.decoder):

• media_quality service unavailable, skipping updatePictureProfile is ALOGI. MediaQualityService only starts when mediaQualityFw() && isTv (SystemServer.java). Phones never publish media_quality; MediaCodec skips picture profiles. Not a VINTF/codec bug.
• Failed to query component interface …: 6 = BAD_INDEX while probing C2 allocator params; same session then creates pools OK and plays video.
• No ROM fix. Do not ship TV MediaQuality just to silence an INFO line.

5. Audio SLIM_0_RX Format — root cause known; no simple ship fix

Reproduced on every speaker open (browser video). Audio still works.

• Card id: sm6150bolerosnd (Bolero / CDC-DMA, not classic Slimbus).
• Proprietary audio.primary.sm6150.so (vendor blob) defaults is_slimbus_interface=true and only clears it for an allowlist of full card names (sm6150-idp-snd-card, sm6150-qrd-snd-card, …). sm6150bolerosnd is missing → HAL looks up SLIM_0_RX Format, which does not exist; Bolero expects WSA_CDC_DMA_RX_0 Format (same logic exists in CAF platform.c behind !is_slimbus_interface).
• Soft-fail: ALOGE then continues (channel map / playback OK).
• Fix would mean rebuilding/replacing audio.primary.sm6150 from CAF with one card-name allowlist line — not a mixer_paths XML tweak. Deferred unless we deliberately take on audio HAL from source (risk vs log noise).

Build hygiene

• Kernel uname shows -dirty on this bacon — rebuild from a clean tree or document intentional WT deltas in the artifact notes.
• Non–Direct Boot apps (e.g. Metrolist) can crash before unlock — app issue, not ROM.

Does not need changes (this session)

F2FS / storage, AVB/verity, encryption, SELinux enforcing, Wi‑Fi / BT / calls / camera / video / audio functional path. Nora display-during-video is device- specific, not ROM.

Next bacon / OTA note

This list is device polish, not the full upstream OTA path. Still follow docs/009-ota-rebuild-checklist.md + docs/009-upstream-rebase-ota.md for sync / Magisk / apps gates. Land polish as vendor apply scripts + postflight checks where possible.

Host commands (2026-10-16 polish bacon)

# From laptop (after WT edits):
./scripts/009-sync-ota-stage-to-host.sh
./scripts/009-relaunch-polish-bacon.sh

# On rom-dev01:
cat /srv/rom/artifacts/detach-bacon009polish20261016.status
tmux attach -t bacon009polish20261016   # optional

Apply wiring in ship bacon (order): euicc guard → thermal CDEV log → … → wave4 drop_lab_only_commands (configstore restore). See scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh.