philips-tv-speicher-voll/patches/PHASE6-DECISION.md

Phase 6 decision

Outcome

The four defects have actionable fixes and reproducible offline evidence. Three exact source-level patch specifications and a storage-policy implementation plan were produced; all local harnesses pass. No deployable APK/JAR/firmware binary was built because the cryptographic and vendor-build prerequisites do not exist in the workspace. This is the technically correct stopping point.

Answers to the Phase 6 decision questions

1. Real patchability: BUG-001, BUG-002 and BUG-003 are patchable at their exact methods; DESIGN-001 is patchable in TPTvService. BUG-002 requires a bounded durable outbox, not a one-byte KEEP edit.
2. Successfully built: guarded EPG cleanup implementation, exact diffs, GEL/USB/storage models, static verifiers, baseline and central harness. All pass. No signed binary was built.
3. Signing blocker: Channels, GEL and TPTvService share android.uid.system and the Philips platform signer. Its private key or an accepted signer service is required even for /data/app updates.
4. AVB blocker: persistent tvfw or /system changes require a regenerated image/vbmeta accepted by the locked green AVB chain. Root alone is not enough.
5. UID1000 capability: one-time app-data EPG repair is sufficient and was proven. UID1000 cannot sign/update its own APK or alter verified /system.
6. Root need: temporary instrumentation/bind mount and loose system-file experiments need root. Those are not production deployment solutions.
7. Bootloader/firmware access: needed for persistent system/shared-library images unless Philips supplies signed OTA/firmware packaging. A/B/recovery capability exists architecturally but an accessible accepted restore path is not proven.
8. First live patch: BUG-001 as a Philips-platform-signed Channels updated-system APK, one patch only, after rollback is proven. It has the clearest measured benefit. No live test should begin today.
9. Selective adopted storage: not presently justified. Correct retention changed the live EPG DB from 1.62 GiB to ~0.8 MiB and restored 1.62 GiB of /data capacity without USB dependency. Architecture C (internal retained DB) wins.
10. Robust long-term architecture: Philips source-integrated fixes, exact platform signing, rebuilt ART artifacts, narrow/no new SELinux permissions, and a complete OEM A/B image/OTA signed by accepted AVB keys. Use bounded retention/outboxes and keep capacity and eMMC health separate.

Status by patch

Patch	Root cause	Offline implementation	Tests	Deployment
EPG stale cleanup	CONFIRMED exact Runnable logs without mutation	READY as source/SQL spec	PASS including 1.62-GiB snapshot	BLOCKED on signed Channels build/recovery
GEL WorkManager	CONFIRMED exact APPEND_OR_REPLACE callsite	READY as bounded-outbox design/model	PASS	BLOCKED on source/schema integration and signer
USB free size	CONFIRMED property-gated zero default	READY as exact method spec	PASS	BLOCKED on tvfw rebuild, clients/preopt and AVB
Storage monitor	CONFIRMED fixed thresholds + health conflation	READY as state-machine plan	PASS	BLOCKED on TPTvService build/signer

Final recommendation

Send the vendor package with exact evidence and request either Philips-signed updated APKs (Channels first) or a complete TPM191E maintenance firmware. Keep the current repaired television state unchanged. Preserve the phase-5 rollback snapshots until normal use and a longer observation period remain clean.