Question closure register
All questions from the initial research plan are closed with observed or decompiled evidence. “Server-defined” below means the device does not contain the answer; it is not left as a local reverse-engineering guess.
Control plane and protocols
| Initial question |
Resolution |
| Voice-agent HTTP routes and authentication |
Port 80 is LAPI. /info is unauthenticated; factory commands have no Authorization check but are gated by user mode. Full route table and risky operations are in network services. |
| Port 8081 and UDP 5353 |
Port 8081 is Spotify ZeroConf. UDP 5353 carries Spotify/Avahi discovery, including stereo neighbor discovery. |
| okcall/stereo/tgclient IPC |
Call commands/events and Snapcast defaults are mapped. Voice-agent's Telegram subset is auth, contacts, and messages; TDLib's larger API is not proof of Mini features. See calls and stereo. |
| Stock S89 and UDC |
The adbd/usb_monitor executables are absent. The voice-agent monitor condition and live DISCONNECTED/empty-UDC state are documented; ADB is unavailable. See USB gadget. |
| Firmware response schema and marker order |
result.version/platform/label/url/need_update is recovered, along with /tmp/reboot_required and S98's persistent marker. See firmware updater. |
| Telemetry endpoints and sysmon intervals |
Destination URL is supplied by initializeSession, not hardcoded. Sysmon uses 2/5-second collectors and a 300-second report timer. See telemetry and sysmon. |
| Initial question |
Resolution |
| Thirty display positions and glyphs |
Four logical seven-element digit groups plus two colon indicators are mapped. The complete JSON-to-driver permutation is in segment display. |
| Ambient-light curve |
Below 5 → 0%, above 3000 → 100%, otherwise int(19.937704 * ln(0.05*x + 0.75)). See brightness. |
| KWS model, labels, thresholds, playback |
The marusya model uses [1,8,40] input and positive/negative, intentional/unintentional, and location outputs. Quiet defaults are .994/.2; playback is .995/NaN. See local keyword spotter. |
| Telemetry audio capture, trigger, format |
Local Pulse/ALSA ring buffers retain 10–600 seconds. Only sendAudioSample exports selected PCM; it is not continuous upload. See audio capture. |
| Physical keys and touch protocol |
Linux codes 114/115/164/248/704 and all internal types are recovered, along with evdev touch gestures. See buttons. |
| GPIO 446 mute scope |
GPIO 446 is active-low microphone enable: 0 mutes, 1 unmutes. It gates hardware capture, not just voice-agent state. See microphone mute. |
| Twelve versus thirteen RGB entries and timing |
The parser accepts 24 colors; the Mini writer uses only 36 channels, so entry 13 is ignored. duration, seconds, and FPS override semantics are recovered. See LED resources and the complete 97-animation dump. |
| Stereo buffer/role behavior |
Defaults are 1000 ms buffer, 40 ms chunks, FLAC, priority −11. Master/peer conflicts are rejected; pair ID persists. See stereo. |
ntp-ibb-volume-syncer |
It subscribes to Pulse sinks and applies volume to hw:0 control TV-Set; it does not set time. See volume sync. |
Storage, identity, setup, and reset
| Initial question |
Resolution |
| Early UBI failure versus S03 reset |
Post-boot contents prove early UBI recovery format, not S03. The write defect was logical-write versus physical-erase arithmetic leaving stale image-sequence PEBs. See postmortem. |
| AVB state |
AVB_STATE is only the bootloader's verifiedbootstate string; it is absent on this unit. DEVICE_STATE is separately ok or test_required. See device identity. |
| Unifykey write protection |
lock arbitrates writes; it is not root-proof OTP protection. Raw writes remain dangerous and were not attempted. See unifykeys. |
| Session restore/expiry/hardware identity changes |
Restoring data restores credentials verbatim with no local TTL conversion. Server revocation and token upgrade are separate. See session state. |
| Setup failures reaching reset code 4 |
Attach errors 2–6 map to setup codes 5, 6, 3, 7, and 4. Only code 4 calls hwResetDevice; not every expired token or decoder failure resets. See setup and session state. |
| xToken expiry |
TTL is server-enforced, not a Mini constant. Fresh tokens are required after HTTP 400; see xToken. |
| Exact ADSSS logic without JNI |
Framing, RS roots, runtime whitening seed, tone map, delayed impulse, convolution, and WAV output are recovered. A dependency-free browser encoder matches all 161,600 native samples within 3.6e-7 max error. See audio modem. |
Remaining non-local facts
Cloud revocation policy, production telemetry destination selection, and the precise server meaning of each attach error require server documentation or a controlled test account. They are intentionally described as server-defined rather than promoted to unsupported local claims. Every device-side question in the original list now has a documented answer.