1.9 KiB
Safe future live-test plan
No deployment is authorized by this document. Begin only after a matching
platform-signed artifact, static validation and the recovery gates in
RECOVERY-PLAN.md exist. Test one patch per build.
Candidate order
- EPG cleanup (clearest root cause and measurable result).
- USB free-size.
- GEL bounded outbox.
- Storage monitor policy.
The first binary candidate should be a Philips-signed Channels updated-system
APK in /data/app, not a /system overwrite. Until that exists, the already
validated UID1000 one-time EPG data repair is the only proven live mechanism.
Per-patch protocol
BEFORE: preserve golden binaries/data, hashes, current package paths, signer/version, storage/EPG/GEL/USB metrics, logs, slot/AVB state and user-visible TV baseline. Prove rollback after a cold boot.
DEPLOY: verify input and output hashes/signature, install through the single approved path, and make no other change. Never pair changed DEX with golden ODEX/VDEX manually.
RESTART: stop/start only the minimal affected package when supported; a shared-library image requires the vendor-defined reboot. Record downtime and all startup/linkage errors.
VALIDATE: run software gates plus Live TV, picture/audio, zapping, channel
list, favorites, Guide/Now-Next, recordings/timers/reminders, standby/wake,
network/ADB and low-storage UI. Add target metrics: EPG cutoff/plateau; USB vs
df; GEL graph/outbox bounds; storage hysteresis/health separation.
ROLLBACK: trigger rollback on signature/linkage failure, crashloop, boot-time regression, missing TV function, data corruption, wrong units, event loss, unexpected storage UI or inability to collect evidence. Restore the known-good artifact/slot, validate hashes and rerun the baseline.
Minimum release soak is 30 days including power interruption and USB removal; EPG must cross several daily cleanup cycles.