2.9 KiB
Recovery plan before any future live patch
Current gate
NO-GO for deployment today. No patched binary, accepted Philips signer, verified firmware packer, proven bootloader entry, or independently tested recovery/USB restore route exists. The commands below are procedural templates, not instructions executed in Phase 6.
Golden component records
| Component | TV path | SHA-256 | owner:group / mode / label | Runtime impact |
|---|---|---|---|---|
| Channels | /system/priv-app/channels/channels.apk |
3a44bc...04d34f |
root:root 0644 system_file |
EPG/TV provider |
| GEL | /system/app/gel/gel.apk |
29a68e...d383d7 |
same | GEL actions/WorkManager |
| TPTvService | /system/app/TPTvService/TPTvService.apk |
75f492...41ecd |
same | persistent TV/storage service |
| tvfw | /system/framework/tvfw.jar |
a00617...8d11ad |
same | registered TV shared library |
Full APK/JAR and ARM ODEX/VDEX hashes are in baseline/hashes.sha256. Local
golden copies are immutable. Before a test, also record package dump, slot,
AVB state, process state, current APK path, data DB hashes/sizes, owners, modes,
SELinux labels and a bootable OEM firmware copy.
Rollback by deployment type
- Platform-signed
/data/appupdate: use only a previously lab-validated Package Manager “uninstall system update” procedure for that exact Android build, then restart the affected process or reboot through the approved test plan. Do not assume a command spelling until it is confirmed read-only/help output and tested on a recoverable device. Base/systemremains intact. - Volatile instrumentation/bind mount: stop the affected process, remove the test mechanism from a root/engineering environment, restore its mount namespace, then restart. If that cannot be done, controlled reboot returns to the verified base only if no persistent boot hook was added.
- A/B image: keep the known-good slot untouched. The new slot must have a boot-success timeout and automatic/manual slot fallback already proven. Never mark it successful before TV, ADB and storage validation.
- Full firmware: use only Philips-signed recovery media and a procedure demonstrated on the same platform. Preserve the original firmware and all hashes offline.
Crash and bootloop response
For an app crash with working ADB, collect logs/package state first, then invoke
the prevalidated rollback. For a tvfw linkage failure or system_server/boot
loop, ADB may never become available; rollback must therefore be possible from
boot control, recovery or signed USB media without Android userspace. Existing
init/recovery hooks and A/B layout are evidence of capability, not proof that a
publicly accessible restore path accepts our image.
Do not start any system/shared-library test until cold-boot recovery, power-loss recovery and return-to-stock hashes have been demonstrated end-to-end.