2.5 KiB
2.5 KiB
Phase 7M – Final deployment matrix
| Path | Targets | Root | Signer / AVB | Cold-boot risk | Rollback / persistence | OTA compatibility | Rating |
|---|---|---|---|---|---|---|---|
| 1. Philips-signed updated-system APK | Channels, GEL, TPTvService separately | no | exact Platform signer; no AVB change | low–medium for Channels/GEL, high for persistent TPTvService; must be lab-tested | persistent /data/app; PM fallback to stock /system APK; data rollback unproven |
OEM OTA may replace/remove/supersede; test | BEST for first Channels candidate when gates pass |
| 2. Official vendor firmware with patch | all APKs, tvfw, policy | no user root | OEM Platform, payload and AVB signing | lowest achievable with OEM QA/A/B recovery | vendor-supported full/incremental rollback | native | BEST PRODUCTION |
| 3. Temporary runtime instrumentation | behavior prototype only | instrumentation/root authority likely | no durable signer/AVB change | process crash; normally reboot clears | temporary and fragile | not relevant | TEST ONLY |
| 4. Root + bind mount | APK/JAR prototype, not coherent release | yes every boot | cannot satisfy shared UID; underlying AVB intact but ART/labels remain | high; boot-service ordering and client crash risk | nonstandard mount removal/reboot | conflicts with OTA assumptions | HIGH RISK / NO-GO |
| 5. Modified system image | all system targets | build/flash authority | Platform signer plus accepted AVB/vbmeta required | very high without proven A/B/USB recovery | A/B only if accepted and tested | must regenerate payload/meta | HIGH RISK / NO-GO today |
| 6. Full modified firmware | all components/partitions | OEM process | complete Platform/payload/AVB/container keys | high for independent build, low only under OEM QA | full A/B/vendor recovery possible if supplied | becomes the OTA | GOOD only as official OEM build; otherwise NO-GO |
First live candidate
BUG-001 as a Platform-signed Channels updated-system APK remains technically the
best first candidate because /system stays intact and PackageManager has a
documented fallback. It is not yet authorized or safe to install. Missing:
- OEM Platform signature/lineage;
- real data migration and uninstall-update rollback test;
- cold boot/ADB failure drill on equivalent hardware;
- official full firmware and model-specific USB recovery procedure.
Until all four exist, the production decision remains NO-GO and the manual read-only EPG health check is the operational fallback.