philips-tv-speicher-voll/patches/gel-workmanager/PATCH-PLAN.md

Patch plan – bound GEL WorkManager history

Target and evidence boundary

/system/app/gel/gel.apk, GatheringService.onStartCommand() feeding GELWorker under unique name GEL_WORK. SHA-256: 29A68E6B09700ED4CCDF312C0B99EEE0C3F67E329A537FE87ED4341A71D383D7. The exact app callsite loads policy integer 4. The embedded AndroidX enqueue implementation proves this is the APPEND_OR_REPLACE leaf-dependency path. See ROOT-CAUSE.md and the executable verifier.

Design

1. Classify events as idempotent/coalescible or durable.
2. Persist all events in a bounded outbox; UPSERT only verified periodic/state families and keep durable events in monotonic FIFO order.
3. Enqueue one unique GEL_DRAIN worker with ExistingWorkPolicy.KEEP, plus a single periodic KEEP watchdog for crash/race recovery.
4. Acknowledge outbox rows only after dispatch; retry the same WorkSpec when work remains. Never represent the outbox as a dependency chain.
5. Set a short result-retention period, call pruneWork() after idle batches, and expose counters: WorkSpec count, dependency depth, oldest completion, DB/WAL bytes and enqueue latency.

Pseudocode:

outbox.enqueue(classify(intent), serialize(intent));
WorkRequest request = oneShot(GELDrainWorker.class);
wm.enqueueUniqueWork("GEL_DRAIN", KEEP, request);
// GELDrainWorker drains bounded persisted events FIFO, then succeeds

Do not blindly replace every event with REPLACE: that could lose non- idempotent telemetry. The event classification is a release gate.

Migration

At first patched start, if no RUNNING work exists and graph depth/DB size exceeds a conservative threshold, cancel only obsolete completed GEL work, prune, checkpoint, and retain any bounded outbox. Never delete the entire app data automatically. Log a privacy-safe migration result.

Acceptance

10.000 alarms and service intents: dependency depth remains O(1), completed rows are pruned, DB remains under a vendor-defined cap (suggested <10 MiB), latest event latency remains seconds rather than minutes, reboot/power loss does not duplicate non-idempotent delivery.