3.1 KiB
3.1 KiB
Phase 7G – Cold-boot recovery matrix
Ratings are conditional on the failure mode stated. “Likely” is not a tested cold-boot guarantee. No recovery command was executed.
| Scenario | Android boot / ADB | Primary rollback | Stock APK fallback | USB/full restore | Rating |
|---|---|---|---|---|---|
A. bad Channels /data/app update |
likely boots; package/provider may crash; ADB likely | cmd package uninstall-system-updates org.droidtv.channels if ADB works |
yes by PM; data-schema compatibility unproven | official package not locally available | RECOVERABLE, conditional; cold boot untested |
B. bad GEL /data/app update |
likely boots; GEL/candeebug process may loop | uninstall system update | yes; WorkManager DB rollback risk | same | RECOVERABLE, conditional |
C. bad TPTvService /data/app update |
persistent/core service may loop and degrade boot/UI; ADB uncertain | uninstall update if ADB reaches stable shell | yes mechanically; migrated data unknown | same | RECOVERABLE WITH RECOVERY / UNKNOWN until tested |
D. bad tvfw.jar in system image |
system_server not directly bootclasspath-dependent, but many TV clients can fail | A/B slot fallback if truly functional, else OEM full firmware | no PM fallback; JAR is system image content | needed if both slot/fallback fail | HIGH RISK |
| E. system_server does not boot | UI absent; adbd availability unknown | inactive-slot fallback/boot control | n/a | OEM recovery required if fallback fails | HIGH RISK / UNKNOWN |
| F. Android UI does not boot but system/adbd do | ADB may work | remove updated app or revert slot | for APK update yes | possible only with official file/procedure | RECOVERABLE if ADB proven in failure |
| G. ADB does not start | no normal-shell rollback | boot-control automatic rollback only | cannot trigger PM rollback | requires known recovery/USB full firmware | RECOVERABLE WITH USB FIRMWARE, currently UNKNOWN |
Safe mode and recovery deletion
- A model-specific safe-mode entry and behavior are not documented in local resources; do not rely on generic Android TV instructions.
- Direct deletion of
/data/appin recovery is not documented or approved. The proper normal-boot path is PackageManager'suninstall-system-updates. - A factory reset would remove data-side updates but also destroys user data; it is a last resort, not a validated rollback plan.
A/B fallback strength
Static A/B partitions, Boot-Control HAL, UpdateEngine and update_verifier
strongly support automatic rollback if the new slot never becomes successful.
However bootctl is unavailable and current bootable/successful/retry counters
could not be read. An end-to-end failed-slot test was neither authorized nor
performed. Treat A/B recovery as architecturally likely, not proven for a
manually modified image.
Deployment gate
Before the first Channels live update:
- OEM/platform-signed candidate.
- Equivalent-device install, reboot, crash and uninstall-update drill.
- Proved data rollback or restorable backup.
- Official full firmware and exact 43PUS7394/12 USB recovery procedure.
- Stable ADB access after intentional candidate failure in the lab.