philips-tv-speicher-voll/patches/VALIDATION.md

Phase 6 validation report

Validation date: 2026-08-26. Scope is offline engineering only; no patched binary was installed and no TV state was changed during the validation run.

Automated result

python patches/tests/run_all.py --write-hashes completed successfully:

• all five golden inputs matched their pinned SHA-256 hashes;
• EPG synthetic tests passed empty, boundary, current/future, 30-day,

  1-year, multi-batch and idempotent cases;

• the GEL stock DEX verifier matched the exact GEL_WORK policy-4 enqueue instructions;
• bounded-outbox tests passed 10,000 coalescible and 10,000 FIFO events, O(1) active WorkSpec, caps and crash retry;
• USB tests passed DeviceManager validation, StatFs fallback, >2-TiB, true zero and unknown states;
• storage policy tests passed low debounce, critical, hysteresis, notification deduplication, unknown measurement and health/capacity separation.

Hashes of the central small artifacts are in artifacts/hashes.sha256.

Historic EPG snapshot result

On a disposable byte-identical copy of the 1,742,053,376-byte DB, the seven-day algorithm deleted 3,063,863 of 3,071,250 schedule rows in 1,532 transactions (maximum 2,000 rows), retained 7,387, and shrank the FULL-auto-vacuum DB to 4,059,136 bytes. integrity_check=ok; the oldest retained end time equaled the cutoff, future data remained, and an immediate second run changed neither bytes nor hash. Runtime was 141.609 seconds; slowest batch 1,391 ms. See epg-stale-cleanup/phase6-full-snapshot-result.json.

Binary static-validation status

Golden APK/JAR archives and DEX callsites were parseable; manifests, DEX counts, certificates, v2/v3 signing blocks and preopt inventory were recorded. There is no patched APK/JAR to re-decompile, compare, align or signature-verify. Those gates are NOT RUN / BLOCKED, not passed: Philips source/build configuration, platform private key, AVB key and proven recovery route are absent. Emitting a randomly signed package would not satisfy Package Manager or shared UID.

Remaining release gates

Vendor-source integration, rebuilt-DEX comparison, unchanged manifest/resource diff, exact signer-lineage verification, ARM preopt/client linkage, recoverable image or accepted /data/app deployment, acquisition-lock contention, standby/power-loss, 30-day soak and full user-visible TV regression all remain. The status is offline patch design validated; live firmware binary NO-GO.