3.8 KiB
Selective adopted-storage design
Candidate matrix
| Candidate | Observed size | Owner / label | Opener and boot timing | Reconstructible | USB failure / fallback | Decision |
|---|---|---|---|---|---|---|
EPG EpgDatabase.db schedule payload |
1,742,053,376 B before repair; ~806,912 B after reacquisition | system:system, system_app_data_file |
Channels UID1000 provider; needed for Guide, not Android boot | schedule yes; channel/mapping/favorite/recording relations not assumed so | Live TV must retain an internal minimal DB; reacquire schedule | Architecture C now; optional A only with OEM integration |
| GEL WorkManager DB | 229,453,824 B pathological snapshot; tiny after repair | system:system, system_app_data_file |
GEL/WorkManager, system-app startup | derived work history partly; undelivered actions are not disposable | internal bounded outbox required | Fix queue; do not move |
| Downloads/media cache | not measured as a dominant /data cause |
package-specific | consumer-specific, normally post-boot | only explicitly cached/downloadable objects | missing-volume UI and internal metadata | Eligible case-by-case after inventory |
| Updated-system APK code/data | package-dependent | Package Manager types | package/runtime dependent | generally no | Android package move is whole-package, not selective | Not a DB-path solution |
| Accounts, Settings, PM, boot/FBE metadata | not relevant to recovered leak | core platform types | early/boot-critical | no | no safe USB fallback | Excluded |
Architecture A — configurable EPG path
Channels keeps authoritative channel, mapping, favorites, Now/Next and recording/reminder links internally. After vold reports the expected adopted UUID mounted, an OEM helper opens a narrowly typed private-ext4 schedule-cache directory. It validates UUID, schema, generation and integrity before switching the provider's schedule backend. Removal closes that pool and immediately returns to the internal minimal provider. This needs Philips source, a narrow SELinux type, explicit volume callbacks and OTA/schema migration tests. It must not use emulated/FUSE storage, symlinks or a boot bind mount.
Architecture B — internal live DB plus archive
Keep current guide data internal and place optional old/archive payloads on
adopted storage. This reduces neither the repaired seven-day working set nor
the need for retention, complicates queries and cross-volume consistency, and
has little demonstrated product value. Never rely on cross-volume SQLite
ATTACH for atomic transactions. Classification: possible but unjustified.
Architecture C — retention only
Keep EPG internal and deploy BUG-001's bounded cleanup. Phase 5 reduced the DB from 1.62 GiB to about 0.8 MiB while the Guide, Live TV, favorites and timers remained functional; the seven-day offline test retained 7,387 rows in a 4.06-MiB database. This is the preferred architecture because it removes the actual leak without USB power, mount-order, locking, recovery or OTA coupling.
Migration and failure gates
If A is ever built, default the feature off. Copy only reconstructible schedule rows into a versioned temporary generation, check integrity, fsync file and directory, then atomically switch an app-level marker. Retain the internal fallback. A missing, slow, full, removed, corrupt, reformatted or UUID-changed USB device is a normal tested state. Factory reset, OTA, standby power loss, 1,000 remove/reinsert cycles and fsync latency must never impair Android boot or Live TV. Adopted media is encrypted/device-bound and is not a backup.
Decision
Select C for this television. Reconsider A only if a future measured,
reconstructible payload remains large after retention and Philips can ship the
required source, SELinux and recoverable firmware changes. Reject moving whole
/data.