Bluetooth codec audit: evidence, tests and qualification contract

Date: 2026-09-22. Read together with the architecture and Auto design.

This file records what was inspected/executed and separately specifies future tests. A table of expected outcomes is not a passing test suite. No new codec framework, runtime policy tests, cross-build, firmware image, installation, radio activation, pairing or physical measurement was performed.

1. Source and artifact identities

Relevant history inspected, not treated as validation:

• Y2Linux f55fff4: hardware-identity-scoped extended-feature-page quirk.
• Y2Linux 72d4831: Reborn/Buildroot/native media integration.
• Y2Linux 79a3d38, 270dba3, 80df0ff: FFmpeg 9 integration/configuration.
• Y2Reborn 77e6732: current BlueALSA ObjectManager and exact-peer PCM rates.
• Y2Reborn a8ae8b6: radio scan lifecycle.
• Y2Reborn 65c6ea0: shared FFmpeg 9 media path.

No root README.md exists in either checkout; architecture, knowledge, version-specific upstream manuals, validation evidence and actual source were used. Missing guessed filenames during discovery were corrected by file listing; they were not counted as product defects or test failures.

Production-source anchors

2. Sanitized hardware evidence

These are selected non-identifying fields read from retained own-Y2 logs. The original source is local/private; no full captures are copied, and no link keys, peer addresses, pairing passkeys or calibration payloads were inspected.

Source: Y2Linux/evidence-private/20260917-m5-protocol/connectivity08-hci-baseline.txt.

The independently retained y2-hci-quirk-capped.txt reports the same capabilities after the diagnostic feature-page correction. That does not mean its tainted diagnostic boot was production-qualified. The CONNECTIVITY-09 public summary records durable native-quirk power-on with no diagnostic module, taint 0 and zero errors/recoveries. The CONNECTIVITY-10 summary records scans with both radios powered, not A2DP data.

The raw HCI features settle advertised capability, not the controller's actual air packet type with a particular sink. No retained connection packet- type, retransmission, sustained credit-progress or headphone transport trace establishes usable EDR audio throughput. Do not convert the 1021×4 buffer report into a throughput benchmark.

Actual peer evidence

Reborn's September 18 inspection used an older deployed Reborn revision 6209f48402a00a077759df042916f0ae2c89783a. Its Bluetooth service check found no connected peer; discovery completed with zero discoverable peers. The retained BlueALSA ObjectManager response is an empty PCM array. It proves the API exists, not a working audio stream.

Therefore the current connected-headphone make/model, advertised optional codecs, accepted rate/format, negotiated codec and heard audio are UNKNOWN. A headset marketing specification cannot substitute for its actual SEP advertisement; multipoint/firmware modes may change what it offers. No peer was connected by this audit just to fill that cell.

3. Ten distinct capability levels

"Plausible" below means a portability assessment, not a build result. "Pending" legal assessment does not assert illegality. "Not observed" does not prove a codec fails.

The full codec matrix in the architecture document covers LHDC, LC3plus, MP3, Opus, FastStream, aptX extensions and LE Audio separately.

4. Checks actually executed in this focused audit

All commands were host-side. Existing binaries were run without recompilation; their relationship to HEAD was not independently rebuilt/proven. No result is reported as a fresh production build or physical qualification.

Focused cached tests

Working directory /home/luca/Dokumente/Code/Y2Reborn:

./target/debug/deps/reborn_platform-a0dab0805802cc10 bluetooth::tests:: --test-threads=1
./target/debug/deps/reborn_audio-610cef8b7603caee --test-threads=1
./target/debug/deps/reborn-569a8d6f5e5b2b9d --test-threads=1

Total: 13 cached host tests passed. They do not test optional encoder initialization, actual SBC streaming, BlueZ/BlueALSA reconfiguration against real daemons, codec ranking, hysteresis or RF conditions. No Auto policy tests exist as an implementation yet. The playback fixture limitations and known failures identified by the previous broad audit are not dismissed by these passes; see validation audit.

A preliminary audio-test invocation used a nonexistent cached-binary suffix and returned exit 127. File discovery corrected it to the command above. This was an invocation error, not a failed codec test. The nonexistent-PCM test emits an expected ALSA error line while passing its assertion.

Build/configuration inspection

Working directory /home/luca/Dokumente/Code/Y2Linux:

rg -n 'VERSION|ENABLE_.*(AAC|APTX|LDAC|MPEG|MP3|SBC|LC3|OPUS|FAST)' out/y2linux-reborn-audio-final/buildroot/build/bluez-alsa-4.3.1/config.h
rg -n '^#define (VERSION|PACKAGE_VERSION)' out/y2linux-reborn-audio-final/buildroot/build/bluez5_utils-5.79/config.h
readelf -d out/y2linux-reborn-audio-final/buildroot/target/usr/bin/bluealsa

Observed BlueALSA version v4.3.1, BlueZ 5.79; optional codec macros undefined. ELF NEEDED list: libasound, libbluetooth, libgio, libgobject, libglib, libsbc, libm, libc, ARM hard-float loader. No FDK/aptX/LDAC/Opus dependency. Generated configuration and source checks complement the ELF result: the absence of a shared dependency alone would not rule out a static encoder.

Additional read-only inspection: Git status/revisions and focused history; Buildroot recipes/config; HCI/BTIF/STP/firmware/reconnect code; BlueZ SEP source; BlueALSA D-Bus/XML/codec source/manuals; Reborn media/PCM/UI/ctl paths; sanitized retained HCI fields. Upstream primary-source browsing checked current codec support, official encoder source and licensing notices. For AOSP pages that the browser could not fetch, read-only curl ...?format=TEXT | base64 -d was used; no dependencies were downloaded into or installed in either repository.

Explicitly not executed

No cargo build/test compilation, Buildroot/kernel build, target codec benchmark, SSH/device access, scan, pair, connect, transport reconfiguration, suspend, flash, partition access or calibration change. No legal clearance was obtained. No new candidate artifact or commit was produced. Documentation links/structure and final worktree scope are checked separately before handoff.

5. Deterministic policy tests to implement — NOT EXECUTED

Tests must call the future production policy/state machine, not an independent lookalike implementation embedded in the test. Use fake monotonic time and a fake backend with recorded calls; no sleeps, network, HCI or real headphone needed. Freeze policy revision and build/qualification allowlists in each case.

Fallback and no-flapping tests — NOT EXECUTED

No-flapping property: automatic visited sets are monotone for a fallback session; next candidate is always unvisited; finite budget implies termination. Property- based event sequences must check that invariant, finite queues, preserved Stop, and at most one live sink writer. Test late/reordered/duplicate D-Bus events, clock jumps, device changes and service restarts—not only happy-path ranking.

Persistence and real-format integration tests — NOT EXECUTED

• Truncated JSON, unknown schema, atomic-write interruption, full/read-only

  filesystem: safe Unknown/Auto behavior, existing bonds untouched, bounded errors.

• 33rd paired device and oversized codec arrays: documented eviction/bounds;

  repeated status polling does not write state; unchanged state does not fsync.

• Forget removes only that device's profile; no raw address/key in exported JSON.
• Actual BlueALSA/BlueZ test harness captures versioned D-Bus signatures and

  SelectCodec-caused object replacement; fake fixtures must be based on captured sanitized real responses, not assumed capabilities invented by the test.

• S16/S24-in-4/S32 boundary vectors: zero, ±full scale, ±one LSB, clipping,

  channel order, silence and dither/noise expectations. Verify exact slave format and samples before encoder; ALSA plug acceptance alone is inadequate.

• Decode both 16/44.1 and 24/96 fixture signals through the same RG/EQ path

  to wired/Bluetooth sink capture; compare pre-sink canonical samples, accounting for intentional sink quantization/rate changes. No second BT DSP path.

• Gapless/crossfade at constant negotiated rate with real media fixtures, encoder

  delay/padding, queue edits and decoder cancellation; separate codec-change interruption from normal track-boundary continuity. Do not claim no regression from synthetic short fixtures alone.

6. Physical qualification plan — NOT EXECUTED

Entry gates and test identity

Follow Y2Linux's standing milestone audit rule before expanding codec/production scope. Use owner-authorized installation and radio actions. An outstanding power/thermal/suspend safety gate is not waived by this plan. Do not conduct unbounded heat/battery stress on an unqualified charging/thermal platform, and do not invent safe temperature thresholds from the currently unqualified sensor readings.

Record board/controller identity, kernel/rootfs/Reborn commits, manifest and artifact hashes, BlueZ/BlueALSA/encoder versions/options, headphone model and firmware, distance/orientation, negotiated SEP/PCM/rate/codec, AP/channel/RSSI and traffic description. Use private peer IDs; anonymize public evidence. Use boot/session IDs and monotonic time—retained Y2 wall time is unreliable.

Start with a fresh SBC-only or SBC-capable bond and a second independent peer; then use real AAC, aptX/HD and LDAC peers as available. For each codec report which exact peers were tested, not "all Bluetooth headphones". If no matching peer exists, mark that codec BLOCKED/UNKNOWN, not passed with a mock.

Cross-product matrix

Each enabled production codec/mode runs every applicable lifecycle row in all four Wi-Fi conditions. This is a matrix, not four separate unrelated milestones.

Do not force deep suspend while playback owns an active radio if the platform contract vetoes it. "Veto correctly applied" and "Bluetooth playback survives deep suspend" are different results. Headphone AVRCP controls are another currently missing application integration; codec qualification does not prove them.

LDAC matrix

Test each independently at 44.1 and 48 kHz first; add 88.2/96 only in a separate experimental high-rate pass. Repeat every Wi-Fi context above.

Measure disconnects, audible dropout count/duration, ALSA XRUNs, output starvation, BlueALSA write failures, HCI credit progress, kernel transport errors/recoveries, CPU per process/thread, RSS, temperature validity, power and available battery data. Actual over-air packet loss may be unavailable; label local proxies.

MT6582 CPU/memory benchmark

No usable per-codec target measurements were found or made. Cortex-A7 has NEON and the current toolchain targets hard-float neon-vfpv4; portable C buildability does not guarantee enough single-thread deadline margin at the production CPU frequency. Do not reuse a Cortex-A53/x86 encoder result as a Y2 number.

Benchmark two things separately:

1. Encoder-only fixed PCM input at 16/44.1, 16/48, 24-bit sink input where

   applicable, and LDAC 24/96 experimental. Pin exact encoder build/options; measure CPU-time/audio-time ratio, frame-time distribution and memory. A faster-than-real-time offline encode is necessary but not sufficient.

2. End-to-end playback, same tracks through actual FFmpeg/RG/EQ/resampler,

   ALSA plugin, encoder, radio and headphones. Measure bluealsa threads, Reborn, kernel/IRQ cost, source scanning and UI load concurrently. Measure effective CPU frequency/throttling, not just aggregate utilization across four cores.

Compare SBC High and Conservative, AAC 220/256 with afterburner off/on as an engineering variable, aptX, aptX HD, LDAC fixed modes and ABR. Include silence, music, transient-rich and high-entropy inputs; warm up 60 s, then collect at least 10 min steady-state CPU statistics and the longer RF soak above.

Initial engineering acceptance targets, **proposed and subject to platform budget review**: encoder average ≤35% of one available core at qualified production frequency; 99th-percentile encode time ≤50% of its frame deadline; no missed deadlines, unbounded queue/RSS growth or critical playback-thread starvation under UI/scanner/Wi-Fi load. Record maximum and tail, not just mean. A mode exceeding the allocated power/CPU budget stays experimental even if it can play briefly. Do not hide a saturated single encoder thread inside a low four-core aggregate percentage.

Memory expectations are modest streaming frames for SBC/aptX; FDK/LDAC/Opus have additional encoder state; LC3plus exposes size/scratch queries. These estimates are not measured RSS. At 48 kHz stereo, 100 ms of PCM is 19.2 kB for S16 or 38.4 kB for S32; at 96 kHz S32 it is 76.8 kB. Those simple bounds show that seconds of speculative PCM and duplicate pipelines are unnecessary. Measure actual ALSA/pipe/socket buffers and allocations; library working state and thread stacks are additional. Do not allocate encoders for every candidate simultaneously.

Battery and thermal comparison

Compare codec settings against SBC on the same device/peer/source, screen off, same Wi-Fi condition, listening level, ambient temperature and measured CPU frequency. Repeat runs and report variance. Include 16/44.1 and 24/96 source decode/resampling costs separately from encoder-only cost. If battery current telemetry is not calibrated/reliable, use a qualified external power method or mark energy UNKNOWN; do not infer a battery-life percentage from CPU alone.

Record surface/validated sensor temperature and platform charging state; do not perform a prolonged connected-charger soak until the charging/thermal boundary is safe. A proposed initial quality-mode budget is ≤15% energy increase over SBC under matched conditions; this is a product decision to validate, not a measured result or safety limit. A much costlier mode should be manual/experimental or excluded rather than chosen automatically for branding.

7. Manual inspection and installation guidance

Safe current inventory, no new installation required

On an already owner-accessible Y2, these read-only commands can identify the actual current stack. They were not executed on hardware in this audit:

bluealsa --version
bluetoothd --version
bluealsa-cli status
bluealsa-cli list-pcms
rebornctl status --json
rebornctl audio --json
dbus-send --system --print-reply --dest=org.bluealsa /org/bluealsa org.freedesktop.DBus.Properties.GetAll string:org.bluealsa.Manager1

Some installations put bluetoothd outside PATH; resolve its known installed service executable first rather than claiming a missing daemon. If PCMs exist, use their actual returned path with bluealsa-cli info PCM_PATH and bluealsa-cli -v codec PCM_PATH without a CODEC argument. In 4.3.1 that is query-only. Adding a codec argument is a state-changing operation that terminates the existing PCM. Do not use --force. Keep peer identifiers/private state out of shared output.

Remote MediaEndpoint1 capability observation is via BlueZ ObjectManager on the system bus; no need to read bond files. Do not run scan on, power commands, connect, trust or pair as part of a read-only inventory. If no PCM exists, report that fact; do not invent the remote capability list.

Later owner-controlled qualification/install sequence

1. Confirm current recovery arrangement and platform safety gates. The existing

   installation overview distinguishes first initialization from preserve-data updates and warns about historical coordinate errors. Use the chosen candidate package's verified install/recovery metadata, not historical addresses or a generic scatter/flash recipe from this codec document.

2. Collect current readonly inventory and agree on actual test headphones.
3. After separate implementation/legal approval, build one codec candidate at a

   time through the existing Y2Linux production workflow. Record both commits, source/encoder hashes, generated manifest, image sizes/hashes and recovery fallback. No candidate exists from this audit.

4. The owner chooses/executes the validated userspace/root-image installation

   workflow. Codec work should not require preloader/LK, partition-table, NVRAM, protected-data or calibration updates. If it appears to, stop and re-audit the scope rather than improvise flashing commands.

5. Owner authorizes radio activation, fresh test-device pairing/trust and quiet-

   volume playback. Capture capability and actual negotiated PCM before any benchmark. Run the relevant matrix; retain sanitized receipts, not secrets.

6. If failures occur, stop on SBC or pause audio, preserve diagnostic evidence,

   and use the existing known-good recovery path. Do not solve RF instability by modifying calibration or hiding EDR feature bits.

There is deliberately no dd, scatter-file edit, protected-partition instruction or installation command here. The output of this task is a review/design and qualification contract, not a flashable release.

8. What to keep stable

Keep one kernel CONSYS owner, standard HCI/BlueZ interfaces, private read-only calibration provisioning, mandatory SBC, explicit-peer PCM matching, the common FFmpeg media/DSP path, generation-based playback cancellation, bounded worker channels, and the existing structured observability framework. Extend the real service boundary; do not create another decoder, another radio owner, a codec "AI" selector, or a background fleet of encoders.

9. Handoff scope

Documents created by this focused task:

• docs/architecture/bluetooth-codecs.md.
• docs/audit/bluetooth-codecs/2026-09-22-evidence-and-tests.md.

The previous system connectivity audit's daemon spelling is corrected to the actual v4.3.1 name and linked to this focused review. All other previous audit material and all production files remain untouched. No commits were made; HEADs remain the identities above. No production artifact or installable package was built. The next implementation decision belongs after the documented hardware and distribution gates, not after treating this document as a passing test.

Final documentation checks: 59 relative local links resolve; 21 Markdown tables have consistent column counts; fenced blocks are closed; the illustrative JSON parses. A targeted scan found no copied Bluetooth addresses, key material or unfinished placeholders. These are documentation checks, not codec validation.