Android 9: script apps can't reach TLS 1.3-only or newer-root HTTPS hosts (Maps directions and map data fail) #73

Summary

Since #18, Maps ships as a script app. Its requests go through Makepad's script fetch, which on Android uses the platform's Java HTTPS stack. On Android 9 that stack has no TLS 1.3 and an older certificate store. So Maps requests to hosts that require TLS 1.3, or whose certificate chain ends in a root Android 9 doesn't have, fail:

• Directions fail. Every route request to router.project-osrm.org ends in SSLHandshakeException: Handshake failed. The route sheet shows n/a for time and distance, and no route is drawn. The place sheet also shows n/a · n/a.
• Map data fails for some tiles. The map widget's tile queries to Overpass endpoints fail the same way: overpass.kumi.systems with SSLHandshakeException, and maps.mail.ru with CertPathValidatorException (the chain isn't trusted). Those areas of the map stay blank.

This is MAPS-17 again (home/BACKLOG.md). It was fixed on 2026-09-23 for the native Maps with a reqwest/rustls transport and bundled WebPKI roots (OctoSense-mobile PR #47, brought here in #13). That fix lives only in the native octosense-maps crate, which #18 keeps for comparison builds. The shipped script Maps doesn't use it. On the same phone, before #18, the native Maps returned drive, walk and bike routes (see the second-sync validation in docs/home-migration.md).

Environment

• OnePlus 6T (ONEPLUS A6010), Android 9 (OxygenOS 41_190801).
• Standalone Home 2026092619, built from main at 8b30908 (after mobile: swipeable home pages with the glance page on the left #18 and appcard: take octos-app 78a1a8d — a turn completes on the kernel's durable text #25).
• Network through USB reverse tethering (gnirehtet).

Steps

1. Open Maps (the os.maps script app).
2. Search "Santana Row", confirm with the keyboard's done key, and open the first result.
3. Tap Directions.

Evidence (logcat, trimmed)

Script data fetch: issuing https://router.project-osrm.org/route/v1/driving/…
Script data fetch request error: java.util.concurrent.CompletionException: java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: Handshake failed
MapView: tile z13 x1321 y3178 failed (attempt 1): endpoint https://overpass.kumi.systems/api/interpreter http request error: … javax.net.ssl.SSLHandshakeException: Handshake failed
MapView: tile z13 x1322 y3179 failed (attempt 1): endpoint https://maps.mail.ru/osm/tools/overpass/api/interpreter http request error: … javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException …

In the same run, one tile query got HTTP 504 from overpass-api.de. That's a busy server, not specific to Android 9.

Scope

Every script app request on Android 9 takes this path, so any host that needs TLS 1.3, or a root that Android 9 lacks, fails the same way. On the same phone these worked: Maps place search (photon.komoot.io), the News feeds, and App Hub's live catalog (raw.githubusercontent.com). Android 10 and later have TLS 1.3 in the platform stack, so the ROM target (OnePlus 6 on LineageOS 22 / Android 15) shouldn't be affected. That wasn't checked in this run.

Options

1. Give the script fetch path on Android a TLS stack that doesn't depend on the OS: rustls with bundled roots, as the native Maps had. This fixes every script app at once.
2. Route Maps' route and map-data requests through a host service that uses rustls.
3. Stop supporting Android 9 for the standalone Home (raise minSdk to 29) and say so.

Not covered here

Blank map areas also appear on a Pixel 7 Pro (Android 17), where TLS isn't the problem, so there's a separate, not-yet-identified cause for those.

Moved from OctoSense-ROM#26 (opened by @guofoo on 2026-09-26); OctoSense-ROM is being retired into this repository. Paths under home/ are now crates/shell/ (shell code) or phone/ (Home packaging).