Bluetooth codecs: current capability audit and proposed Auto policy

Bluetooth control optimization — 2026-10-04

The isolated Platform 1.0 Bluetooth pass preserves FFmpeg decode, shared DSP, one negotiated sink conversion and BlueALSA encoding. Reborn now refreshes Bluetooth observations on relevant D-Bus signals and user commands, with a 30s reconciliation backstop, instead of a 20ms worker timer and 2s enumeration. A bounded notified command queue wakes descriptor-based waiting immediately. Pairing/discovery deadlines and transport invalidation remain active while idle; BlueZ owner return recreates the pairing agent. Codec capabilities remain cached by transport epoch, requested and negotiated codec remain separate, and Reborn adds no reconnect loop or encoder. Source validation covers idle wake behavior, command responsiveness, stale PCM removal and owner/agent recovery. Physical peer audio, optional codec CPU and coexistence remain separate gates; the owner has no headset available for this pass. Full receipt is in the sibling Y2Linux repository at docs/validation/Y2-PLATFORM-V1-BLUETOOTH-OPTIMIZATION.md.

Historical audit/design at its 2026-09-22 revisions. Later Hardware Final source/ARM work compiled a private optional-encoder profile and implemented a gated Auto control, while normal radio launch keeps optional endpoints disabled. This supersedes the audit's "no source/binary integration" statement **only for the later candidate**. Fix01 physically demonstrates a bounded CONSYS retry, not peer codec audio. Current application state, current platform contract, and later codec source work separate those scopes. The recommendation below is not implementation authority.

Date: 2026-09-22. Scope: Y2Linux and Y2Reborn as one product.

**Status: AUDIT / DESIGN ONLY. No codec enabled, production code changed, image built, device accessed, or device flashed during this review. Auto is a proposal, not an implemented feature.** Material physical and distribution uncertainties trigger the user's stop condition for implementation.

Audited revisions:

• Y2Linux: be7e64c5dd5c6bdfe39c35e8fbd70e6b4b2c4717.
• Y2Reborn: 011884b7ef13187171225f252c213afeeb6da851.

The existing broad system audit remains relevant. This focused review additionally inspected the retained raw HCI feature/version/buffer-size responses, version-specific BlueALSA/BlueZ source, generated configuration, linked dependencies and current upstream codec/licensing sources. Evidence, executed checks and qualification plan give reproducible inspection locations and explicitly unexecuted test cases.

1. Decision

Keep the native Linux HCI + BlueZ + BlueALSA architecture and the single Reborn decode/DSP pipeline. Do not replace it with another audio server or put codec encoders in Reborn.

The current image provides SBC only, with BlueALSA's normal high-quality SBC setting. It does not provide AAC, aptX, aptX HD or LDAC A2DP encoding. Even SBC headphone playback is not physically qualified by the retained evidence. Adapter bring-up and discovery are different achievements.

Recommended initial release codec set: **SBC, including ordinary high-quality operation and a conservative fallback**. This is a recommendation after qualification, not permission to label today's Bluetooth production-ready. Next candidates: AAC, aptX/aptX HD and LDAC, individually gated by library provenance/licensing, target builds, CPU budget, interoperability and coexistence. SBC XQ is useful to investigate; it is not a separate codec or an unconditional safe fallback. LDAC 990/909 kbps and 88.2/96-kHz operation stay experimental.

Five findings determine the next work:

1. Establish fresh-bond SBC playback, reconnect and sustained Wi-Fi coexistence

   on this Y2 before claiming a multi-codec product.

2. Add truthful typed capability/negotiated-format observation before selection.

   Today's adapter ignores BlueALSA Format and requests S16 for Bluetooth.

3. Keep one connection-retry owner. The existing platform reconnect helper

   requires Trusted, which Reborn's pairing path does not establish.

4. Resolve distribution gates. Radio firmware permission is unestablished;

   FDK-AAC explicitly grants no patent license; LDAC's AOSP NOTICE requests product certification. aptX library choices have materially different terms.

5. Do not promise per-device LDAC quality control or live bitrate reporting from

   stock BlueALSA 4.3.1. Those interfaces do not exist in the inspected version.

Evidence vocabulary

VERIFIED = implementation plus meaningful matching validation; IMPLEMENTED = code exists, runtime/physical proof incomplete; PARTIAL = only part exists; WEAK = architectural/quality concerns; MISSING = no meaningful implementation; UNKNOWN = inadequate evidence; DEPRECATED / DEAD = obsolete path. Confidence is HIGH, MEDIUM or LOW. PROPOSED below labels design, not another evidence grade.

2. Hardware: what is actually established

Sources: HCI driver, core, BTIF, STP, bounded protocol, own controller summary, durable quirk validation. Sanitized raw-response fields and their exact private-source line locations are in the companion evidence document; no addresses, keys or calibration are copied.

Firmware and controller limitations

The checked firmware set includes mt6572_82_patch_e1_0_hdr.bin, mt6572_82_patch_e1_1_hdr.bin, WMT_SOC.cfg, Wi-Fi's WIFI_RAM_CODE_MT6582, and modem_1_2g_n.img for cold RF calibration. This is a shared bootstrap, not five Bluetooth codecs or an Android audio-offload engine. Firmware checks and inventory identify exact owner-supplied files; every relevant redistribution permission is still recorded as unestablished. Preserve private calibration and existing firmware validation; never transplant another unit's records.

The controller transports encoded Classic A2DP packets. SBC, AAC, aptX, aptX HD, LDAC and applicable vendor A2DP codecs can be software encoders on the AP; ordinary aptX/HD do not intrinsically require a Qualcomm Bluetooth controller. They still require a matching remote endpoint, encoder, sufficient CPU and RF budget. A stock firmware command named "codec" in hci.c::setup is not evidence of AP A2DP encoder offload.

LE Audio/LC3 over CIS/BIS requires LE Isochronous Channels introduced in Core 5.2. This controller's 4.0 interface and current driver do not supply that path. Newer BlueZ libraries or an LC3 library cannot add it. Bluetooth SIG LE Audio FAQ. LC3plus over a vendor Classic A2DP endpoint is a separate possibility, and HFP LC3-SWB is a voice profile, not LE Audio or a stereo-music upgrade.

Four ACL credits and the driver's 128-packet software queue/7-frame STP window are relevant latency/backpressure constraints, not a measured bitrate ceiling. Encoded payload alone at 330/660/990 kbps is approximately 41/83/124 kB/s, before RTP/L2CAP/HCI/STP overhead, air retransmissions and antenna sharing. Wi-Fi scans with Bluetooth merely powered do not validate any of these sustained loads. Historical donor Basic Rate workarounds are not this unit's qualified policy.

3. Actual software and build state

Evidence: production defconfig, input lock, service. The companion ledger identifies the ignored retained build tree and exact generated files. Its ARM executable links libsbc.so.1 and no optional codec library; configuration/source inspection also excludes static optional codecs. This does not establish which image is currently installed on a powered device.

The pinned Buildroot recipe couples codecs to independently selected packages: FDK-AAC → --enable-aac; libopenaptx → both aptX variants; libopus → Opus; LAME → MP3 encoder. These are explicit recipe branches, **not compiler autodetection**, but adding an unrelated library can broaden Bluetooth capability. FDK-AAC and libopenaptx are not selected today. There is no existing LDAC, libfreeaptx, LC3plus or LHDC production package in this Buildroot tree.

Upstream 5.0.0, dated 2026-08-27, adds LHDC v3 and changes executable names, PCM rate property names and other interfaces. It also fixes Android-Opus configuration. Do not paste its manual into a 4.3.1 integration or upgrade it incidentally while enabling a codec. Upstream release notes.

BlueZ versus BlueALSA

BlueZ handles discovery, bonds, profile signaling and transport setup. It does not become an AAC/LDAC encoder because audio plugins are enabled. BlueALSA registers local A2DP endpoints, configures the remote transport, encodes PCM and writes acquired transport file descriptors. The per-packet audio data is not passed through a D-Bus method or copied through the bluetoothd process.

CONTROL
UI -> Action/Effect -> Reborn Bluetooth worker -> system D-Bus
                           |                    |       |
                           |               bluetoothd  bluealsa
                           |                bonds/SEP  PCM/encoder
                           +------ typed status/events -------+

DATA
FFmpeg decode -> shared DSP -> final PCM conversion -> ALSA BlueALSA plug-in
 -> PCM pipe -> bluealsa encoder/RTP -> acquired L2CAP transport fd
 -> Linux HCI -> native BTIF/STP/CONSYS -> headphones

RECOVERY OWNERS
CONSYS kernel: shared-radio failures
platform helper: connection retries
Reborn Bluetooth service (proposed): codec attempts / audio-state coordination

4. Codec capability matrix

This table is deliberately wider than the recommended set. Bitrates are nominal encoded payload operating points, not measured Y2 maxima. Every Y2 sustained maximum, encoder CPU percentage and incremental RSS is currently UNKNOWN. CPU/memory categories are architecture-based estimates (LOW confidence), not benchmarks. ARM "plausible" is source portability, not a successful Y2 build.

Sources for the matrix: retained src/a2dp-{sbc,aac,aptx,aptx-hd,ldac,lc3plus,mpeg,opus,faststream}.c and codec-sbc.c in the pinned build; versioned upstream source tree; LHDC v5.0.0 source; current integration prerequisites. The legal sources are separated in §6. Apple's AAC description supports the AAC ecosystem rationale, not an assertion that a particular peer advertised it to this Y2.

Other recognizable codec IDs, PipeWire Opus variants, Samsung proprietary codecs, ATRAC, MPEG-D/USAC and HFP voice codecs must not become UI choices merely because a header names them. a2dp-codecs.c has names for more codecs than a2dp.c has actual encoder endpoints. ASHA/G.722 in newer BlueALSA is a separate hearing-aid profile, not this A2DP-headphone project. Neither ASHA nor LC3-SWB justifies claiming LE Audio.

5. Important codec-specific conclusions

SBC is a useful quality baseline

The service already defaults to high, not a deliberately poor mode. BlueALSA chooses bitpool inside peer limits. In 4.3.1, XQ requests dual channel, 44.1 kHz, 16 blocks, 8 subbands, loudness allocation, bitpool 38; XQ+ uses 47. These yield approximately 452 and 551 kbps. An older release-note number is not the current algorithm. XQ source initialization restricts advertised frequency and channel mode globally. Do not use --sbc-quality=xq as a casual production default: that changes the mandatory fallback's compatibility surface.

Model codec=Sbc and quality=Xq separately. A headset does not advertise an "SBC XQ codec". Check the legal SBC configuration and actual peer behavior; never exceed the peer's bitpool or use NonConformant=true for Auto. A lower bitpool fallback can be proposed inside negotiated bounds; if a peer cannot support the chosen setting, skip it, do not force it.

AAC: useful, but select the encoder deliberately

The inspected implementation uses FDK-AAC, not FFmpeg's AAC decoder or native AAC encoder. Initial product policy should use AAC-LC, stereo 44.1/48 kHz, conformant transport, and a measured target such as 256 kbps clipped to remote limits. That target is a proposal; today's optional-code default would be 220 kbps, with afterburner off. Keep afterburner an engineering benchmark variable, not another ordinary user setting. It improves analysis at extra CPU/memory cost. Do not enable --aac-true-bps or nonconformant fragmentation as a quality shortcut. FDK's actual negotiated profile/rate/VBR behavior must be observed.

aptX families are not interchangeable

Classic aptX and aptX HD have viable software implementations. The stock Buildroot dependency is libopenaptx 0.2.1, GPL-3.0+, not LGPL. libfreeaptx is the LGPL-2.1+ fork supported by BlueALSA's --with-libfreeaptx option; adding it requires a deliberate pinned package. Official AOSP also contains Apache-2.0 aptX/HD encoder source, but it is not a drop-in package/API selected by the current recipe. Do not build a new adapter only to avoid understanding existing library/license choices.

Do not ship arkq/openaptx's reverse-engineered/proprietary archive variants by default; its own README carries a binary-distribution warning. Do not generalize that warning to mean all aptX encoders are equally licensed or prohibited. Adaptive and Lossless are different technologies, absent from this encoder integration. Qualcomm describes Lossless as an Adaptive/Snapdragon Sound capability. Their exclusion is an implementation/platform/licensing conclusion, not a claim that all vendor Classic codecs require Bluetooth 5.2. Qualcomm Lossless description.

LDAC: adaptive does not mean "safe at 990"

Sony's AOSP encoder plus ABR is the relevant source-side implementation. The Linux packaging supplies ldacBT-enc and ldacBT-abr; an LDAC decoder is not needed to transmit to headphones. BlueALSA 4.3.1 advertises 44.1/48/88.2/96 kHz, and initializes its encoder with S32 PCM. This is not a promise of lossless 32-bit reproduction. A codec capability is not the selected rate: LDAC does not imply 96 kHz.

Public fixed operating points are 330/660/990 kbps in the 48-kHz family and 303/606/909 in the 44.1-kHz family. ABR can traverse additional intermediate quality levels: the inspected AOSP ABR table includes 492/396 kbps at 96 kHz. Do not implement a three-value "measured bitrate" enum. Sony overview, AOSP ABR source.

In the pinned encoder thread, ABR observes local transport socket queue depth and blocking writes, not actual over-air packet-loss percentage or headphone buffer health. Its thresholds are 6/4/2 queue units. --ldac-quality=standard sets the starting encoder mode; adding --ldac-abr does not establish a documented 660-kbps ceiling. ABR may increase quality again. Neither the selected LDAC capability blob nor PCM1.CodecConfiguration contains current ABR bitrate.

Consequently:

• Stock 4.3.1 experimental testing can use one fixed daemon-wide quality, or

  uncapped ABR while explicitly treating all its reachable levels as experimental.

• Production Auto must not claim a capped adaptive mode without an enforceable,

  tested per-transport ceiling and actual mode feedback.

• Stock API fallback can change codec after closing/reopening PCM. It cannot

  honestly implement the complete per-device runtime LDAC quality ladder.

• Do not restart the global daemon on every underrun to simulate quality control.

  This would disturb connection ownership and all PCM objects.

• Do not display 660 kbps as live fact merely because Standard was requested.

6. Licensing and redistribution gates

Owner decision for public releases (2026-10-16, Y2Linux Baseline 49). Public images and the public over-the-air updates carry SBC, AAC and LDAC; aptX and aptX HD stay in owner-private builds (tools/production/build.py --public leaves libfreeaptx out). AAC comes from fdk-aac-free 2.0.3: Red Hat's stripped FDK library (AAC-LC only; the HE-AAC SBR/PS parts are removed), upstream gitlab.freedesktop.org/wtaymans/fdk-aac-stripped (branch stripped5), the version Fedora ships after its legal review concluded it is no longer encumbered by AAC patents; A2DP uses AAC-LC. LDAC is Sony's Apache-2.0 code; its NOTICE asks for certification for product use, so Reborn claims no certification and shows no logos. The codec inventory (/etc/y2linux/bluetooth-codecs.json, profile public) marks exactly these three as approved, and public packaging refuses anything else. This is the owner's decision, not a legal opinion.

This is an engineering distribution audit, not a legal clearance. Copyright permission, patent scope, brand/logo use, product certification and firmware redistribution are different questions. A free source download settles none of the others automatically. Review the intended countries and whether Reborn is distributed as source, a binary firmware image, or hardware.

Primary legal sources: FDK NOTICE, libopenaptx COPYING, libfreeaptx source/license, AOSP aptX encoder, AOSP aptX HD encoder, openaptx warning, ldacBT license, LDAC certification NOTICE, Sony certification/contact entry, LC3plus header terms, Fraunhofer licensing, older LC3plus royalty overview, Opus grants, LAME license guidance.

Do not use LDAC/aptX/Hi-Res logos or claim certification based solely on a successful encode. Sony's public page distinguishes free source implementation from sink licensing, while its NOTICE still asks for certification. That tension requires a product-specific answer, not a blanket assertion that Linux encoding is forbidden or automatically certified. Likewise, do not declare aptX patents expired everywhere without jurisdiction-specific evidence.

7. PCM and precision contract

Current, inspected path

16-bit FLAC -> FFmpeg s16 ----+
                            +-> stereo FLTP at source rate
24/96 FLAC -> FFmpeg s32 ----+   -> shared volume/ReplayGain/EQ/limiter
                                -> FFmpeg final swresample
                                -> packed S16, 44.1 or 48 kHz requested for BT
                                -> ALSA "bluealsa:" plug wrapper
                                -> BlueALSA SBC S16 encoder -> A2DP

media.c creates canonical_swr with the decoder rate on both sides and FLTP output; output_swr performs final sink-rate/format adaptation. Bluetooth status matches exact connected peer, A2DP-source, mode=sink, stereo 44.1/48 kHz. ALSA adapter chooses S16 whenever output is Bluetooth. It does not select based on PCM1.Format.

The shipped ALSA bluealsa definition is itself a type plug wrapper, not necessarily a conversion-free raw PCM. Current rate matching reduces accidental resampling for SBC, but a future wider-format codec could silently receive an S16-derived signal converted again by ALSA. Inspect the slave's negotiated format; accepting an application S32 buffer through plug is not precision proof.

FLTP is 32-bit IEEE floating point, approximately 24 significant binary bits, not 32-bit integer precision. S32 buffers in parts of playback/crossfade do not change that. Preserve the common DSP's existing precision; a future wider DSP decision is separate work, not a Bluetooth codec change. The existing broad audio audit also records unresolved gapless/transition/limiter/lifecycle concerns. This review does not certify those features merely because the user asks that they not regress.

Negotiated final format, not codec-name inference

The AAC capability helpers also recognize 5.1/7.1 channel configurations for applicable profiles. They are not an invitation to add surround output: Reborn's canonical/player contract is stereo, and initial codec selection must request and validate two channels explicitly.

A future SinkSpec must contain actual format, physical and valid bit widths, rate, channel layout, device identity and transport generation. Always validate properties after selection and again at open. Handle unknown values as a failed candidate, not an implicit S16 conversion.

Use one final sink converter. Prefer exact source rate **within an already qualified common set** when starting a new audio session; otherwise 44.1-family sources → 44.1, 48-family sources → 48, then an available qualified alternative. Do not upsample 44.1 to 96 for a logo. Start with 44.1/48 for Auto even on LDAC; 24/96 is downsampled once at the sink boundary until separately qualified. Do not reconfigure the Bluetooth rate at every track boundary: keep it stable through gapless/crossfade and let the final converter handle source changes.

Volume ownership also needs an explicit contract. BlueALSA 4.3.1 defaults to software attenuation and persists volume state; Reborn already applies volume in its shared DSP. Establish a controlled neutral encoder-side gain or a clearly defined remote-volume arrangement, with quiet-level physical testing. Never force a headset to maximum volume just to simplify gain accounting. Do not let independent persisted attenuation or AVRCP events create two volume authorities.

8. Production negotiation architecture — PROPOSED

Responsibilities and typed state

AppModel: Auto/manual intent, output choice, playback intent
    | Action/Effect
BluetoothService (existing worker extended, one bounded coordinator)
    +-- BlueZ adapter: paired device + remote SEP capability observations
    +-- BlueALSA adapter: local runtime inventory + usable codec intersection
    +-- pure CodecPolicy: ordered eligible candidates, no I/O
    +-- negotiation state machine: bounded attempts and generation checks
    +-- bounded DeviceProfileStore: preferences / compact stability evidence
    | SinkReady(actual format, transport generation)
Playback owner: stop/quiesce/open/resume the SAME media pipeline
    | service events
AppModel -> UI and rebornctl: preference distinct from actual negotiated state

No generic plugin architecture, per-codec service threads, new DSP or external policy daemon is needed. Wire strings are decoded once inside the BlueALSA adapter; arbitrary strings do not propagate through application policy.

Illustrative types, not implementation:

Codec = Sbc | Aac | Aptx | AptxHd | Ldac
ObservedCodec = Known(Codec) | Unknown { standard_id, vendor_id, vendor_codec_id }
Preference = Auto | Prefer(Codec)       // manual means preference + safe fallback
SbcQuality = NormalHigh | Conservative | Xq | XqPlus
LdacQuality = Adaptive { ceiling } | Fixed(Connection | Standard | High)
CapabilityState = Unknown | Observed { connection_epoch, endpoints }
Stability = Unproven | StableInContext | Suspect | SuppressedForSession

CodecState {
  compiled_local, runtime_enabled_local,
  advertised_remote, mutually_usable,
  requested_preference, policy_choice, negotiation_attempt,
  negotiated: Option<ActualPcmAndCodec>,
  requested_quality, observed_quality: Option<QualityObservation>,
  fallback_reason, fallback_count, stability,
  bluez_owner_epoch, bluealsa_owner_epoch, connection_epoch, sink_epoch
}

SBC XQ is a quality mode. Unknown advertised codecs may appear in diagnostics, not in the selectable menu. Per-device codec preferences belong in the service profile store; global default Auto belongs in app settings. Do not persist a second authoritative copy in AppModel.

Version-specific discovery and selection

1. Read org.bluealsa.Manager1 at /org/bluealsa: Version, Profiles,

   Codecs. Filter A2DP-source: entries (actual D-Bus spelling, not the lowercase command-line profile argument). This is the enabled daemon inventory, not a full compiled-library inventory. Compare against a generated firmware codec manifest to identify disabled/missing/mismatched capabilities.

2. Subscribe to BlueZ ObjectManager and property changes for the selected

   Device1. After profile discovery, enumerate its remote org.bluez.MediaEndpoint1 sink objects. Read UUID, Codec, Capabilities, Device; parse vendor IDs from bounded codec blobs where necessary. In 5.79 source these properties are exported without a separate Vendor property, despite newer/general documentation discussing one.

3. Read BlueALSA ObjectManager PCMs, matching exact device, A2DP-source and

   Mode=sink. Call that PCM's GetCodecs(), signature a{sa{sv}}. In 4.3.1 its Capabilities, SupportedChannels, SupportedSampling are already intersected with enabled local capabilities. Do not label this result a complete list of all codecs advertised by the headphones.

4. Unknown/missing SEP discovery is Unknown, not remote supports only SBC.

   Existing actually negotiated SBC can remain a safe baseline when complete inventory is unavailable. A2DP UUID alone says nothing about optional codecs.

5. Compute a candidate. Ask playback to quiesce/close the old PCM first. Call

   SelectCodec(name, {Channels: byte, Sampling: uint32}) in 4.3.1. Use a validated codec configuration only where policy genuinely needs it; never disable conformance checks. In 5.0 the rate key is Rate, requiring an explicit version adapter, not speculative support.

6. A successful method return means accepted request, not proven audio. Observe

   new/current PCM1.Codec, CodecConfiguration, Format, Channels, Sampling, then open exact PCM and confirm Running plus write progress. Reconfiguration can destroy/recreate PCM objects. Reject stale generation callbacks even if an object path is reused.

7. Report requested, policy-selected and negotiated values separately. If the

   remote/stack instead establishes SBC, observe and validate SBC; never report the requested LDAC as active. Clear active state on owner/transport loss.

The 4.3.1 GetCodecs implementation deduplicates equal codec IDs and picks the first matching remote SEP for selection. Different endpoints with the same codec can have different capabilities. Keep raw remote observations separately; do not invent a union configuration that no individual endpoint accepts. If the adapter cannot select the desired endpoint safely, skip that candidate. This needs real multi-SEP fixtures and peer tests.

Sources: local bluealsa-iface.xml, `bluealsa-dbus.c::{ba_variant_populate_remote_sep, bluealsa_pcm_get_codecs,bluealsa_pcm_select_codec},doc/org.bluealsa.PCM1.7.rst`, BlueZ profiles/audio/a2dp.c::register_remote_sep and versioned BlueZ API. Reborn must not register competing endpoints, acquire BlueALSA's media fd, run bluetoothctl parsers, or send vendor HCI commands to select a codec.

Quality-control gap: honest implementation boundary

Codec/rate selection and actual-format observation are possible with existing standard interfaces. Per-device live LDAC quality/ABR ceilings, current bitrate and structured encoder-error/queue metrics are not available in stock 4.3.1. Do not invent D-Bus properties and write UI against them as if they existed.

For the full target, prefer a small reviewed/upstreamable **BlueALSA transport extension**, with validated per-PCM quality request, allowed ceiling, actual encoder mode/bitrate and aggregated errors. Keep ABR inside the encoder owner; Reborn supplies limits and policy, not per-packet decisions. A namespaced API must be feature-detected and versioned. Its implementation/locking/error-path review is separate future work. Newer 5.0 documentation alone does not supply this quality API either.

Without that extension, ship only behavior the stock interface can support: codec choice and bounded codec fallback; one fixed LDAC daemon quality in an explicit experimental image; observed_bitrate=null where not known. Do not advertise the complete adaptive-quality UX yet.

9. Auto policy — deterministic proposal, not an asserted quality ranking

Eligibility precedes ranking

compiled ∩ runtime-enabled ∩ actually mutually usable
    ∩ distribution-approved ∩ platform-qualified-for-context
    ∩ supported PCM formats/rates ∩ acceptable resource budget
    minus session failures and per-device/context exclusions
        -> ranked candidates, always preserving conformant SBC fallback

No legal/qualification waiver is inferred from manual mode. Laboratory firmware may have a visibly experimental allowlist; production Auto must not select it. On today's reviewed image the effective list is SBC only. No headphone profile has been supplied or observed in this audit.

Future initial policy profiles below apply **only after the named codec/mode passes all gates**. They express engineering tradeoffs, not a claim that AAC always sounds better than aptX or LDAC always sounds better than SBC.

The CPU-pressure row's aptX qualification does not prove reduced load just from the name; if no measurements establish a benefit, the row reduces to SBC High → Conservative. CPU budget is a filter, not an excuse to continuously switch a working codec. Existing stable sessions stay in place unless meaningful failure thresholds are crossed.

Why these defaults: capped LDAC offers a plausible wider-input quality path without automatically targeting 990; HD offers 24-bit input at moderate fixed payload; FDK AAC provides useful compatibility and lower payload if CPU allows; aptX is a plausible lower-cost alternative. Standard high-quality SBC is a serious fallback. Under congestion, payload and measured stability outrank codec branding. All ordering is revisioned and can be changed by qualification results.

For a peer offering SBC/AAC/LDAC, the first unknown session therefore uses SBC; after a compatible baseline and approved codec qualification, normal-context order is capped LDAC → AAC → SBC High → Conservative. That differs intentionally from blindly choosing 990 on first contact. During experimental qualification, an explicit laboratory profile may start with capped LDAC to exercise that path.

Precisely, persist baseline_observed after the 30-minute stable SBC observation defined below. At the next connection session, this permits the ranked list of already release-qualified optional codecs; do not interrupt the baseline session to upgrade. A known-good optional codec may lead the list when higher choices are unproven on that peer. A successful SBC baseline alone does not permanently pin Auto to SBC: only failures, exclusions or resource/context gates do that. This is deterministic device learning, not in-session exploration.

LDAC Connection Priority can be attempted once as a downgrade from capped Standard after persistent congestion; if it remains unstable, use the remaining Auto list. Do not assert that 303/330 is always acoustically preferable to well-encoded AAC. If AAC is already proven for this device/context, prefer that proven AAC fallback over introducing an unproven low-LDAC setting.

Stickiness, source format and coexistence

• Keep a demonstrated working choice for the session. Device history may promote

  a stable choice above an unproven higher-ranked choice, but never restore a codec excluded by the new firmware's legal/hardware allowlist.

• Treat Wi-Fi Off, ConnectedIdle, ActiveTraffic, Scanning and Unknown separately.

  Current code does not expose a complete traffic-load classifier. Proposed classification uses existing scan state plus low-rate byte-counter deltas, not permanent packet capture. Unknown uses the conservative context.

• Proposed active threshold: ≥128 kbit/s combined Wi-Fi traffic averaged over

  10 s, or ≥2 scans in 60 s. Hold that context 60 s after the last qualifying event. These are initial testable policy constants, not measured RF limits.

• One scan or Wi-Fi becoming connected must not interrupt healthy playback.

  At most lower an available ABR ceiling; change codec only for meaningful instability or the next session. Never automatically turn Wi-Fi off.

• Choose qualified source-family rate at session start, then hold it across

  track changes. A 16-bit source does not require wider output, and a 24-bit source does not justify an unqualified RF mode.

• No automatic 990/909 or 96-kHz promotion in the initial production policy.

  Manual High remains experimental until separately qualified. Do not show a setting that the daemon cannot actually apply and verify.

10. Fallback state machine — PROPOSED

Disconnected -> AwaitProfile/Capabilities -> SelectCandidate -> Selecting
                     ^                         |                 |
                     |                    failed/timeout         v
                 new connection <------- next candidate     AwaitActualPCM
                                                               |
                                                       validate / open
                                                               v
                                                        RunningUnproven
                                                               |
                                                     stable observation
                                                               v
                                                         RunningStable
                                                               |
                                                      repeated failure
                                                               v
                    Exhausted <- no candidates <- Quiesce / Downgrade

All deadlines use monotonic time. Key state by daemon-owner and connection generation; stale completion cannot reopen a previous device or revive playback after Stop. No busy wait, no per-packet logs, no hidden reconnect loop.

Initial limits and observable causes

Stock Reborn cannot currently attribute all these events: it lacks structured BlueALSA encoder errors/queue telemetry and currently samples only a few PCM properties. Do not implement the threshold by scraping warning text or calling every decoder underrun a radio failure. Missing telemetry remains unknown.

Bounded retries and no flapping

• Construct at most six distinct codec/mode candidates, including SBC High and

  Conservative. An LDAC Connection downgrade consumes a candidate slot; if adding it would exceed six after a congestion failure, remove fixed-rate aptX HD first, then aptX if AAC is already proven in that context. Never remove both SBC fallback modes to make room for optional experiments.

• Each candidate gets one selection attempt per fallback session, except the

  single service-restart retry above; the visited set survives rapid connection- epoch changes as described below. Maximum seven selection attempts across the fallback session. Initial startup and each later recovery episode have a 45-s deadline; entering recovery does not reset the session's candidate/attempt budget. Reserve the final 15 s for a conformant SBC startup: by 30 s stop launching optional candidates and select the untried SBC baseline. Conservative SBC is attempted if budget remains after a prompt High failure. Quiesce/reconciliation time is inside the same budget, not an unbounded prelude.

• A D-Bus client timeout does not cancel the remote method. Never issue competing

  SelectCodec calls while an earlier operation can still reconfigure the stream. Reconcile actual transport state/epochs after a bounded settling wait; accept a verified safe SBC transport or terminate as exhausted if safe serialization cannot be established. Ignore stale replies and do not extend the deadline.

• While audio still works, no policy-driven codec reconfiguration more often

  than once per 60 s. Same-transport ABR reduction may occur sooner; ABR remains inside BlueALSA with a fixed maximum. A fatal stream can fall through without waiting 60 s, but only to an untried candidate.

• A failed codec/mode is not automatically promoted again in this session.

  Track changes, scans and repeated UI refreshes do not reset the failure set.

• Reconnects within five minutes retain the fallback session and attempt set.

  A session ends after five minutes disconnected, explicit Forget, or a deliberate advanced "Retry preferred" operation. Reboot preserves the compact failure history, rather than immediately repeating a known bad high mode.

• Ordinary reconnect to a previously successful, not failed/suppressed

  current codec may reopen its newly observed PCM once per connection epoch, without another SelectCodec or promotion. This is a separate resume transition, not an opportunity to retry failed candidates. Revalidate format/gates and preserve paused intent. If the stack negotiates an allowed lower fallback, observe it honestly instead of immediately forcing the old higher codec. A failed resume enters the remaining fallback list; repeated reconnects are bounded by the connection-owner contract below.

• A user-requested Retry creates a fresh bounded budget; it cannot race with an

  existing negotiation. Background upgrade probing is excluded from version one.

• Persistent two-failure evidence suppresses that codec/context for the next

  three connection sessions; a user can explicitly retry. Count sessions rather than trusting Y2's currently unreliable wall clock. A software/capability fingerprint change marks history stale rather than treating it as permanent.

For a finite ordered candidate vector C, record each attempt in a monotone visited set V; automatic fallback always chooses from C \ V, never removes an element from V, and never upgrades. Thus one session cannot oscillate LDAC → SBC → LDAC. Resuming the current nonfailed codec is not a promotion or a fresh fallback selection. This is a design invariant, not a proved property of today's nonexistent Auto implementation; test vectors are in the companion file.

Connection retry and audio recovery must not fight

Y2 reconnect helper is already the preferred-device connection owner; BlueZ built-in reconnect is disabled. It makes bounded-rate requests but can keep trying once per minute indefinitely. Do not add another independent Device1.Connect loop inside CodecPolicy.

The full design needs a narrow coordination contract: codec reconfiguration, intentional disconnect and exhausted-audio recovery can inhibit helper retries; only the connection owner performs bounded profile reconnect requests. An exhausted codec session stays exhausted even if the current helper reconnects the link. Reconnection alone does not reset codec attempts. A transient app-only lease must expire safely on crash; explicit user radio/disconnect intent must remain authoritative. This contract is currently missing and blocks a claim of complete end-to-end bounded fallback.

Initial proposed connection-owner limit: at most two automatic profile reconnect requests for one unexpected loss, 10-s request deadline, 2-s backoff and a 25-s total recovery budget. These limits are separate from the codec-selection budget and are not implemented by today's helper. Do not overlap requests after a client timeout; reconcile a late remote completion or stop. Exhaustion waits for explicit user Connect or a genuinely new peer-initiated connection, not a once-per-minute timer forever. Known user/headphone-off intent bypasses automatic retries. Qualify these deadlines with real devices before adoption.

Fresh pairing also must explicitly establish the user's approved trust policy. Do not trust every discovered device. The helper requires paired + trusted + AudioSink; Reborn's current pairing code does not set Trusted. Qualify fresh onboarding without preconfigured owner bonds.

Playback continuity and volume safety

Close/quiesce the old sink before reconfiguration, invalidate old PCM jobs, then open the observed new sink. Preserve queue identity, track, user pause state, DSP settings and logical position. Hold only a bounded amount of canonical PCM; do not decode minutes ahead during negotiations. Reconfigure the final converter, not the decoder/DSP authority. Do not replay stale old-rate buffers.

Codec changes in Classic A2DP are not guaranteed sample-continuous. A short audible gap may be unavoidable; no claim of seamless fallback. Do not guess exact heard position from bytes merely queued to Bluetooth. Use the existing playback clock/delay contract and expose interruption diagnostics. Rate changes at ordinary queue boundaries should be avoided so gapless is not unnecessarily broken. Existing Runtime::load probe-before-worker-stop behavior and sink generation/cancellation tests deserve attention before expanding this path.

On genuine peer disappearance preserve paused intent; never start wired output automatically at an unsafe volume. Current core changes Bluetooth output to Wired and pauses on BluetoothDisconnected; deliberate codec reconfiguration must not be mistaken for this user-visible unplug event.

11. Bounded per-device persistence — PROPOSED

Store under Reborn's existing private state root, not BlueZ's bond/key files. One versioned atomic JSON record set, maximum 32 paired devices, **six codec entries/device**, two qualification contexts (quiet/congested), saturating small counters. Evict forgotten/unpaired entries first, then least recently used.

Fields: schema/policy revision; private paired-device identity; capability and firmware/encoder fingerprints; optional manual preference; last stable codec/rate/quality ceiling per context; stable-session count; capped failure count; baseline_observed; remaining suppressed-session count; latest bounded reason code. Do not store packet histories, media titles, SSIDs, bond keys or raw calibration. Unknown vendor capability blobs need not be persisted.

An initial stable observation means 30 minutes of progressing playback without codec-attributed faults in the recorded context. It permits a device-history hint, not product qualification. High-quality mode history must be based on observed mode, not just requested mode. Do not manufacture "highest stable 660" while ABR feedback is unavailable.

Write on changed preference, a new stable milestone, or session termination; coalesce automatic writes to at most once per five minutes, skip unchanged content, and flush a pending summary during orderly shutdown. Atomic temporary file + rename + appropriate file/directory sync; no per-packet/XRUN writes. Corrupt/unsupported schema resets learning to Unknown/Auto safely, without removing bonds or inventing negotiated codec state. Migration must preserve an unsupported manual preference as unavailable, not silently relabel it active.

12. Observability and UI — PROPOSED

Use the existing bounded event ring/structured logger, not another telemetry system. Events: inventory ready/mismatch, remote capability snapshot, candidate selection, attempt started/completed/timed out, actual codec/format changed, quality ceiling changed, transport lost/restored, fallback and exhausted. Fields include device pseudonym, session/sink epochs, correlation ID, codec, rate/channels/format, request vs observation, bounded reason code and elapsed time. Aggregate underruns/blocked writes periodically; never log audio packets. Logs stay in RAM by default; diagnostic persistence is deliberate and bounded.

Packet loss is null/not_observable unless an actual reliable source supplies it. Local TIOCOUTQ, RSSI and ALSA underruns are not packet-loss percentage. Protect Bluetooth MACs/device names in exported bundles; no bond keys, passkeys or raw SDP/HCI payload capture by default.

The following command/schema is not implemented today:

rebornctl bluetooth status --json

Illustrative hypothetical state, not a captured Y2 result:

{
  "schema": 1,
  "device": "paired-device-1",
  "local_enabled": ["sbc", "aac", "ldac"],
  "remote_capabilities_state": "observed",
  "remote_codecs": ["sbc", "aac", "ldac"],
  "mutually_usable": ["sbc", "aac", "ldac"],
  "preference": "auto",
  "policy_choice": "ldac",
  "negotiated": {"codec": "aac", "rate_hz": 48000, "channels": 2, "format": "s16le"},
  "requested_quality": null,
  "observed_bitrate_bps": null,
  "stability": "suppressed_ldac_for_session",
  "fallback_count": 1,
  "latest_fallback_reason": "transport_start_timeout"
}

Actual current tools are rebornctl status --json, audio --json, logs/events, and radio on/off/scan. The parser currently rejects bluetooth status; do not present the proposed command as an installation check that already works.

Normal UI: Codec: Auto and Active: SBC/AAC/LDAC, from observed state only. Display "Negotiating" or "Unavailable" when appropriate. If bitrate is not observable, use "LDAC · Adaptive" only when adaptive mode itself is confirmed; otherwise simply "LDAC". Never synthesize a live kbps value from preferences.

Manual menu includes only compiled, runtime-enabled, release-approved codecs. Show an unsupported-on-this-headphone choice disabled with explanation, or reject it without disturbing working playback. If a previously saved preference is unavailable, preserve it as an unavailable preference and visibly show the actual fallback in Audio Info. Manual means "prefer", not "lie about strict success". Keep ordinary fallback quiet—no popup. Show one warning only when no usable Bluetooth audio connection can be established. Advanced diagnostics may explain why Auto chose differently.

13. Build changes required later, not made here

Explicitly enumerate approved configure enables/disables and runtime codecs; never use --all-codecs. In 4.3.1 some optional codecs are not runtime-enabled by default even if compiled: check Manager1.Codecs rather than assuming library presence. Generate a read-only codec manifest from actual configured outputs, not hand-written marketing metadata. Record encoder versions, options, license status, quality profile and qualification ID with the firmware artifact.

Cross-build assertions must reject unexpected encoders, format adapters, missing source/license files and disagreement among manifest, configure output, ELF dependencies and runtime inventory. No downloads at playback time. No broad FFmpeg encoder enablement; file AAC/MP3/Opus decoding remains independent.

14. Qualification, release categories and next sequence

The full test and physical matrix covers remote capabilities, CPU/memory/thermal/battery, four Wi-Fi states, LDAC fixed/adaptive modes, lifecycle/failure injection and precision checks. All physical codec qualification remains outstanding; host policy tests cannot prove radio, CPU, battery or headphone behavior.

Proposed correction sequence:

1. Close SBC baseline evidence and the pairing/trust/reconnect ownership gap.

   Refresh the Y2Linux standing milestone audit with actual evidence before any production-scope expansion; this document does not activate a milestone.

2. Add typed observations and exact PCM-format contract; expose truthful existing

   SBC state. Add fake-bus stale-generation/malformed/unsupported tests.

3. Add the pure policy plus bounded negotiation coordinator, SBC conservative

   fallback and compact persistence. Prove no flapping/exhaustion behavior.

4. Resolve exact dependency/distribution decisions; qualify optional codecs one

   at a time, starting with the actual owner's available headphone capabilities. AAC is high user value; aptX is an attractive lower-CPU comparison; measure.

5. Only then add LDAC quality extension/capability telemetry if the platform

   results justify it. Keep a small codec menu and one pipeline.

6. Produce a candidate through the existing production packaging workflow, with

   explicit codec manifest/source/legal payload and test identities. Stop for owner-controlled physical installation/qualification—never touch protected partitions or calibration as part of codec work.

**No implementation, commits, new production artifact or installation occurred in this audit.** The next useful external input is real headphone capability and baseline playback evidence, not permission to enable every encoder.