diff --git a/config/common.mk b/config/common.mk
index a07a6a3..346a9ac 100644
--- a/config/common.mk
+++ b/config/common.mk
@@ -55,11 +55,10 @@ endif
 # ---------------------------------------------------------------------------
 # ADB security
 # ---------------------------------------------------------------------------
-ifeq ($(TARGET_BUILD_VARIANT),eng)
-PRODUCT_SYSTEM_EXT_PROPERTIES += ro.adb.secure=0
-else
+ifeq ($(TARGET_BUILD_VARIANT),user)
 PRODUCT_SYSTEM_EXT_PROPERTIES += ro.adb.secure=1
-PRODUCT_NOT_DEBUGGABLE_IN_USERDEBUG := true
+else
+PRODUCT_SYSTEM_EXT_PROPERTIES += ro.adb.secure=0
 endif
 
 # ---------------------------------------------------------------------------
@@ -72,7 +71,10 @@ PRODUCT_PRODUCT_PROPERTIES += \
 # This is PawletOS — declare the platform feature
 # ---------------------------------------------------------------------------
 PRODUCT_COPY_FILES += \
-    vendor/pawlet/config/permissions/me.pawlet.android.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/permissions/me.pawlet.android.xml
+    vendor/pawlet/config/permissions/me.pawlet.android.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/permissions/me.pawlet.android.xml \
+    vendor/pawlet/config/permissions/privapp-permissions-dev.oxmc.configprovisioner.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/permissions/privapp-permissions-dev.oxmc.configprovisioner.xml \
+    vendor/pawlet/config/permissions/privapp-permissions-me.pawlet.settings.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/permissions/privapp-permissions-me.pawlet.settings.xml \
+    vendor/pawlet/config/permissions/privapp-permissions-microg.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/permissions/privapp-permissions-microg.xml
 
 # ---------------------------------------------------------------------------
 # PawletOS platform resource package
@@ -101,6 +103,19 @@ PRODUCT_PACKAGE_OVERLAYS += vendor/pawlet/overlay/static
 PRODUCT_PACKAGES += \
     pawlet-framework-res-overlay
 
+# ---------------------------------------------------------------------------
+# Boot and shutdown animations
+# ---------------------------------------------------------------------------
+#PRODUCT_COPY_FILES += \
+#    vendor/pawlet/media/bootanimation.zip:$(TARGET_COPY_OUT_PRODUCT)/media/bootanimation.zip \
+#    vendor/pawlet/media/shutdownanim.zip:$(TARGET_COPY_OUT_PRODUCT)/media/shutdownanim.zip
+
+# ---------------------------------------------------------------------------
+# MusicFX — system sound effects processor (equalizer, reverb)
+# ---------------------------------------------------------------------------
+PRODUCT_PACKAGES += \
+    MusicFX
+
 # ---------------------------------------------------------------------------
 # Monet / Material You — ThemePicker + Wallpaper & style
 # ---------------------------------------------------------------------------
@@ -108,7 +123,8 @@ PRODUCT_PACKAGES += \
 # This overlay enables Monet color scheme, icon shape, font, and dark mode
 # sections inside the app.
 PRODUCT_PACKAGES += \
-    ThemePickerPawletOverlay
+    ThemePickerPawletOverlay \
+    pawlet-systemui-overlay
 
 # ---------------------------------------------------------------------------
 # Version properties
diff --git a/config/microg.mk b/config/microg.mk
index c3ee134..cf058d4 100644
--- a/config/microg.mk
+++ b/config/microg.mk
@@ -11,3 +11,7 @@
 
 WITH_GMS := true
 $(call inherit-product, vendor/partner_gms/products/gms.mk)
+
+# Location — provided by microG's UnifiedNlp backend
+PRODUCT_COPY_FILES += \
+    frameworks/native/data/etc/android.hardware.location.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.location.xml
diff --git a/config/permissions/pawlet-rpi-base-hardware.xml b/config/permissions/pawlet-rpi-base-hardware.xml
new file mode 100644
index 0000000..90d4d35
--- /dev/null
+++ b/config/permissions/pawlet-rpi-base-hardware.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+     Copyright (C) 2025-2026 oxmc / PawletOS
+     SPDX-License-Identifier: Apache-2.0
+
+     Base hardware and software feature declarations for all PawletOS RPi devices.
+     Only declare features the hardware actually has. Device-specific additions
+     (camera, microphone, location) are declared per-variant in device makefiles.
+-->
+<permissions>
+
+    <!-- Hardware present on all RPi variants -->
+    <feature name="android.hardware.audio.output" />
+    <feature name="android.hardware.bluetooth" />
+    <feature name="android.hardware.ethernet" />
+    <feature name="android.hardware.usb.host" />
+    <feature name="android.hardware.usb.accessory" />
+    <feature name="android.hardware.touchscreen" />
+    <feature name="android.hardware.screen.portrait" />
+    <feature name="android.hardware.screen.landscape" />
+
+    <!-- Core Android software features -->
+    <feature name="android.software.app_widgets" />
+    <feature name="android.software.home_screen" />
+    <feature name="android.software.input_methods" />
+    <feature name="android.software.backup" />
+    <feature name="android.software.autofill" />
+    <feature name="android.software.credentials" />
+    <feature name="android.software.print" />
+    <feature name="android.software.picture_in_picture" />
+    <feature name="android.software.activities_on_secondary_displays" />
+    <feature name="android.software.companion_device_setup" />
+    <feature name="android.software.controls" />
+    <feature name="android.software.managed_users" />
+    <feature name="android.software.device_admin" />
+    <feature name="android.software.window_magnification" />
+    <feature name="android.software.cant_save_state" />
+
+</permissions>
diff --git a/config/permissions/pawlet-rpi-phone-hardware.xml b/config/permissions/pawlet-rpi-phone-hardware.xml
new file mode 100644
index 0000000..a420391
--- /dev/null
+++ b/config/permissions/pawlet-rpi-phone-hardware.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+     Copyright (C) 2025-2026 oxmc / PawletOS
+     SPDX-License-Identifier: Apache-2.0
+
+     Phone-form-factor additions for PawletOS RPi phone variants.
+     Included on top of pawlet-rpi-base-hardware.xml (via rpi_common.mk).
+     Declares features that make this a "phone" device without claiming
+     hardware the RPi does not physically have (no IMU, no GPS, no secure element).
+-->
+<permissions>
+
+    <!-- Telephony framework — required for Dialer and Messaging -->
+    <feature name="android.software.telecom" />
+
+    <!-- Microphone — USB mic assumed for phone use case -->
+    <feature name="android.hardware.microphone" />
+
+    <!-- Voice input — depends on microphone being present -->
+    <feature name="android.software.voice_recognizers" />
+
+    <!-- Screen lock — appropriate for a phone-like device -->
+    <feature name="android.software.secure_lock_screen" />
+
+</permissions>
diff --git a/config/permissions/privapp-permissions-dev.oxmc.configprovisioner.xml b/config/permissions/privapp-permissions-dev.oxmc.configprovisioner.xml
new file mode 100644
index 0000000..46c93be
--- /dev/null
+++ b/config/permissions/privapp-permissions-dev.oxmc.configprovisioner.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<permissions>
+    <privapp-permissions package="dev.oxmc.configprovisioner">
+        <permission name="android.permission.CHANGE_COMPONENT_ENABLED_STATE"/>
+        <permission name="android.permission.WRITE_SECURE_SETTINGS"/>
+        <permission name="android.permission.INSTALL_PACKAGES"/>
+        <permission name="android.permission.WRITE_APN_SETTINGS"/>
+    </privapp-permissions>
+</permissions>
diff --git a/config/permissions/privapp-permissions-me.pawlet.settings.xml b/config/permissions/privapp-permissions-me.pawlet.settings.xml
new file mode 100644
index 0000000..1ea2774
--- /dev/null
+++ b/config/permissions/privapp-permissions-me.pawlet.settings.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<permissions>
+    <privapp-permissions package="me.pawlet.settings">
+        <permission name="android.permission.WRITE_SECURE_SETTINGS"/>
+    </privapp-permissions>
+</permissions>
diff --git a/config/permissions/privapp-permissions-microg.xml b/config/permissions/privapp-permissions-microg.xml
new file mode 100644
index 0000000..c9741c2
--- /dev/null
+++ b/config/permissions/privapp-permissions-microg.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+     Copyright (C) 2025-2026 oxmc / PawletOS
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+         http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<permissions>
+    <!-- Grant signature spoofing to MicroG packages only.
+         FAKE_PACKAGE_SIGNATURE is signature|privileged so it cannot be
+         requested by arbitrary apps; this file is the only grant path. -->
+    <privapp-permissions package="com.google.android.gms">
+        <permission name="android.permission.FAKE_PACKAGE_SIGNATURE"/>
+    </privapp-permissions>
+    <privapp-permissions package="com.android.vending">
+        <permission name="android.permission.FAKE_PACKAGE_SIGNATURE"/>
+    </privapp-permissions>
+    <privapp-permissions package="com.google.android.gsf">
+        <permission name="android.permission.FAKE_PACKAGE_SIGNATURE"/>
+    </privapp-permissions>
+</permissions>
diff --git a/config/rpi_common.mk b/config/rpi_common.mk
index 1fefdb4..ed87531 100644
--- a/config/rpi_common.mk
+++ b/config/rpi_common.mk
@@ -10,9 +10,15 @@
 #
 
 # ---------------------------------------------------------------------------
-# MicroG (disabled until vendor/partner_gms is synced and manifest entry uncommented)
+# MicroG — open-source Google Play Services replacement
 # ---------------------------------------------------------------------------
-#$(call inherit-product, vendor/pawlet/config/microg.mk)
+$(call inherit-product, vendor/pawlet/config/microg.mk)
+
+# ---------------------------------------------------------------------------
+# Base hardware and software feature declarations for all RPi devices
+# ---------------------------------------------------------------------------
+PRODUCT_COPY_FILES += \
+    vendor/pawlet/config/permissions/pawlet-rpi-base-hardware.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/pawlet-rpi-base-hardware.xml
 
 # ---------------------------------------------------------------------------
 # RPi boot control HAL (A/B seamless updates via misc partition)
@@ -33,4 +39,5 @@ PRODUCT_PACKAGES += \
 PRODUCT_SOONG_NAMESPACES += device/pawlet/rpi
 
 PRODUCT_PACKAGES += \
-    PawletUpdaterRpiOverlay
+    PawletUpdaterRpiOverlay \
+    PawletSettings
diff --git a/hal/boot_control/rpi/BootControl.cpp b/hal/boot_control/rpi/BootControl.cpp
index 723bcb5..8c5c8ee 100644
--- a/hal/boot_control/rpi/BootControl.cpp
+++ b/hal/boot_control/rpi/BootControl.cpp
@@ -63,7 +63,7 @@ void BootControl::initDefaultMisc(PawletBootControl* ctrl) {
 }
 
 bool BootControl::readMisc(PawletBootControl* ctrl) {
-    android::base::unique_fd fd(
+    ::android::base::unique_fd fd(
             open(misc_device_.c_str(), O_RDONLY | O_CLOEXEC));
     if (fd.get() < 0) {
         PLOG(ERROR) << "Cannot open misc for reading: " << misc_device_;
@@ -104,7 +104,7 @@ bool BootControl::writeMisc(const PawletBootControl& in) {
     ctrl.crc32 = 0;
     ctrl.crc32 = computeCrc32(&ctrl, sizeof(ctrl) - sizeof(uint32_t));
 
-    android::base::unique_fd fd(
+    ::android::base::unique_fd fd(
             open(misc_device_.c_str(), O_WRONLY | O_CLOEXEC));
     if (fd.get() < 0) {
         PLOG(ERROR) << "Cannot open misc for writing: " << misc_device_;
@@ -124,12 +124,12 @@ bool BootControl::writeMisc(const PawletBootControl& in) {
 
 bool BootControl::copyBootPartition(const std::string& src,
                                     const std::string& dst) {
-    android::base::unique_fd src_fd(open(src.c_str(), O_RDONLY | O_CLOEXEC));
+    ::android::base::unique_fd src_fd(open(src.c_str(), O_RDONLY | O_CLOEXEC));
     if (src_fd.get() < 0) {
         PLOG(ERROR) << "Cannot open source boot partition: " << src;
         return false;
     }
-    android::base::unique_fd dst_fd(open(dst.c_str(), O_WRONLY | O_CLOEXEC));
+    ::android::base::unique_fd dst_fd(open(dst.c_str(), O_WRONLY | O_CLOEXEC));
     if (dst_fd.get() < 0) {
         PLOG(ERROR) << "Cannot open dest boot partition: " << dst;
         return false;
@@ -178,7 +178,7 @@ ndk::ScopedAStatus BootControl::getCurrentSlot(int32_t* out) {
     // The RPi firmware writes the booted slot into the kernel cmdline via
     // androidboot.slot_suffix, which init propagates to ro.boot.slot_suffix.
     const std::string suffix =
-            android::base::GetProperty("ro.boot.slot_suffix", "");
+            ::android::base::GetProperty("ro.boot.slot_suffix", "");
     if (suffix == "_b") {
         *out = 1;
     } else {
diff --git a/hal/boot_control/rpi/android.hardware.boot-service.pawlet_rpi.xml b/hal/boot_control/rpi/android.hardware.boot-service.pawlet_rpi.xml
index bdb8ed2..23ccc4e 100644
--- a/hal/boot_control/rpi/android.hardware.boot-service.pawlet_rpi.xml
+++ b/hal/boot_control/rpi/android.hardware.boot-service.pawlet_rpi.xml
@@ -1,7 +1,6 @@
 <manifest version="1.0" type="device">
     <hal format="aidl">
         <name>android.hardware.boot</name>
-        <version>3</version>
         <fqname>IBootControl/default</fqname>
     </hal>
 </manifest>
diff --git a/media/bootanimation.zip b/media/bootanimation.zip
new file mode 100644
index 0000000..6f66dcb
Binary files /dev/null and b/media/bootanimation.zip differ
diff --git a/media/shutdownanim.zip b/media/shutdownanim.zip
new file mode 100644
index 0000000..3601396
Binary files /dev/null and b/media/shutdownanim.zip differ
diff --git a/overlay/frameworks/base/core/res/res/values/config.xml b/overlay/frameworks/base/core/res/res/values/config.xml
index 6432532..9271337 100644
--- a/overlay/frameworks/base/core/res/res/values/config.xml
+++ b/overlay/frameworks/base/core/res/res/values/config.xml
@@ -52,4 +52,7 @@
   <!-- Allow apps to opt into Material You dynamic colors via
          DynamicColors.applyToActivitiesIfAvailable(). -->
   <bool name="config_dynamic_color_support">true</bool>
+
+  <!-- Default wallpaper picker. -->
+  <string name="config_wallpaperPickerPackage" translatable="false">com.android.wallpaper</string>
 </resources>
diff --git a/overlay/systemui/Android.bp b/overlay/systemui/Android.bp
new file mode 100644
index 0000000..c125ee6
--- /dev/null
+++ b/overlay/systemui/Android.bp
@@ -0,0 +1,9 @@
+// Copyright (C) 2025-2026 oxmc / PawletOS
+//
+// SPDX-License-Identifier: Apache-2.0
+
+runtime_resource_overlay {
+    name: "pawlet-systemui-overlay",
+    resource_dirs: ["res"],
+    product_specific: true,
+}
diff --git a/overlay/systemui/AndroidManifest.xml b/overlay/systemui/AndroidManifest.xml
new file mode 100644
index 0000000..0baa705
--- /dev/null
+++ b/overlay/systemui/AndroidManifest.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Copyright (C) 2025-2026 oxmc / PawletOS
+  SPDX-License-Identifier: Apache-2.0
+-->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="me.pawlet.overlay.systemui">
+
+    <overlay
+        android:targetPackage="com.android.systemui"
+        android:priority="1" />
+
+    <application
+        android:label="PawletOS SystemUI Overlay"
+        android:hasCode="false" />
+
+</manifest>
diff --git a/overlay/systemui/res/values/config.xml b/overlay/systemui/res/values/config.xml
new file mode 100644
index 0000000..e69b8eb
--- /dev/null
+++ b/overlay/systemui/res/values/config.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+     Copyright (C) 2025-2026 oxmc / PawletOS
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+         http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+
+<!-- SystemUI overrides for PawletOS.
+     Targets com.android.systemui — do not add framework (android) config here. -->
+
+<resources>
+  <!-- RPi has no battery — hide the battery indicator from the status bar.
+       config_statusBarIconsToExclude is the default for getIconHideList() when
+       Settings.Secure/icon_blacklist is unset; adding "battery" here hides the
+       BatteryMeterView via BatteryMeterViewController's TunerService listener. -->
+  <string-array name="config_statusBarIconsToExclude" translatable="false">
+    <item>@*android:string/status_bar_rotate</item>
+    <item>@*android:string/status_bar_headset</item>
+    <item>@*android:string/status_bar_battery</item>
+  </string-array>
+</resources>
diff --git a/build/envsetup.sh b/vendorsetup.sh
similarity index 74%
rename from build/envsetup.sh
rename to vendorsetup.sh
index 53c7395..9a1ee3a 100644
--- a/build/envsetup.sh
+++ b/vendorsetup.sh
@@ -8,9 +8,6 @@
 #
 # PawletOS build environment helpers.
 # Adapted from vendor/lineage/build/envsetup.sh (The LineageOS Project).
-# Source after AOSP's envsetup.sh:
-#   source build/envsetup.sh
-#   source vendor/pawlet/build/envsetup.sh
 #
 
 # ---------------------------------------------------------------------------
@@ -140,50 +137,6 @@ function pawlet_img()
     bash "$mkimg"
 }
 
-# ---------------------------------------------------------------------------
-# aospremote — add an 'aosp' git remote pointing at AOSP upstream
-# ---------------------------------------------------------------------------
-function aospremote()
-{
-    local T=$(git rev-parse --show-toplevel 2>/dev/null)
-    if [ -z "$T" ]; then
-        echo "Git repository not found."
-        return 1
-    fi
-    git remote rm aosp 2>/dev/null
-
-    if [ -f "$T/.gitupstream" ]; then
-        local REMOTE=$(cat "$T/.gitupstream" | cut -d ' ' -f 1)
-        git remote add aosp ${REMOTE}
-    else
-        local PROJECT=$(pwd -P | sed -e "s#$ANDROID_BUILD_TOP/##; s#-caf.*##; s#/default##")
-        if [ $PROJECT = "build/make" ]; then
-            PROJECT="build"
-        fi
-        if (echo $PROJECT | grep -qv "^device"); then
-            local PFX="platform/"
-        fi
-        git remote add aosp https://android.googlesource.com/${PFX}${PROJECT}
-    fi
-    echo "Remote 'aosp' created"
-}
-
-# ---------------------------------------------------------------------------
-# pawletremote — add a 'pawlet' git remote for the PawletOS Gitea instance
-# ---------------------------------------------------------------------------
-function pawletremote()
-{
-    if ! git rev-parse --git-dir &>/dev/null; then
-        echo ".git directory not found."
-        return 1
-    fi
-    git remote rm pawlet 2>/dev/null
-    local PROJECT=$(pwd -P | sed -e "s#$ANDROID_BUILD_TOP/##; s#/#_#g" \
-        -e "s#platform/#android/#g")
-    git remote add pawlet https://git.oxmc.me/PawletOS/${PROJECT}
-    echo "Remote 'pawlet' created"
-}
-
 # ---------------------------------------------------------------------------
 # repopick — cherry-pick patches from a Gerrit-style review server
 # ---------------------------------------------------------------------------
@@ -224,4 +177,4 @@ function pawlet_version()
     echo "PawletOS ${ver:-unknown} (${type:-UNOFFICIAL})"
 }
 
-echo "PawletOS build helpers loaded. Try: breakfast rpi5 | brunch rpi4"
+echo "PawletOS build helpers loaded."