diff --git a/core/Makefile b/core/Makefile
index 651b1e0..2051c2c 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -6279,13 +6279,13 @@
   $(foreach device,$(BOARD_SUPER_PARTITION_BLOCK_DEVICES), \
     echo "super_$(device)_device_size=$(BOARD_SUPER_PARTITION_$(call to-upper,$(device))_DEVICE_SIZE)" >> $(1);)
   $(if $(BOARD_SUPER_PARTITION_PARTITION_LIST), \
-    echo "dynamic_partition_list=$(call filter-out-missing-partitions,$(BOARD_SUPER_PARTITION_PARTITION_LIST))" >> $(1))
+    echo "dynamic_partition_list=$(sort $(call filter-out-missing-partitions,$(BOARD_SUPER_PARTITION_PARTITION_LIST)))" >> $(1))
   $(if $(BOARD_SUPER_PARTITION_GROUPS),
     echo "super_partition_groups=$(BOARD_SUPER_PARTITION_GROUPS)" >> $(1))
   $(foreach group,$(BOARD_SUPER_PARTITION_GROUPS), \
     echo "super_$(group)_group_size=$(BOARD_$(call to-upper,$(group))_SIZE)" >> $(1); \
     $(if $(BOARD_$(call to-upper,$(group))_PARTITION_LIST), \
-      echo "super_$(group)_partition_list=$(call filter-out-missing-partitions,$(BOARD_$(call to-upper,$(group))_PARTITION_LIST))" >> $(1);))
+      echo "super_$(group)_partition_list=$(strip $(call filter-out-missing-partitions,$(BOARD_$(call to-upper,$(group))_PARTITION_LIST)))" >> $(1);))
   $(if $(filter true,$(TARGET_USERIMAGES_SPARSE_EXT_DISABLED)), \
     echo "build_non_sparse_super_partition=true" >> $(1))
   $(if $(filter true,$(TARGET_USERIMAGES_SPARSE_F2FS_DISABLED)), \
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 9ffe518..604fe06 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -214,6 +214,22 @@
   actual_partition_tag := $(if $(partition_tag),data,system)
 endif
 endif
+
+# if this is a soong module, verify that LOCAL_COMPATIBILITY_SUITE (legacy) matches
+# LOCAL_SOONG_PROVIDER_TEST_SUITES (new, via TestSuiteInfoProvider instead of AndroidMk stuff),
+# modulo "null-sute", "mts", and "mcts". mts/mcts are automatically added if there's a different
+# suite starting with "m(c)ts-". null-suite seems useless and is sometimes automatically added
+# if no other suites are added.
+ifneq (,$(filter $(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK)))
+  a := $(filter-out null-suite mts mcts,$(sort $(LOCAL_COMPATIBILITY_SUITE)))
+  b := $(filter-out null-suite mts mcts,$(sort $(LOCAL_SOONG_PROVIDER_TEST_SUITES)))
+  ifneq ($(a),$(b))
+    $(error $(LOCAL_MODULE): LOCAL_COMPATIBILITY_SUITE did not match LOCAL_SOONG_PROVIDER_TEST_SUITES$(newline)  LOCAL_COMPATIBILITY_SUITE: $(a)$(newline)  LOCAL_SOONG_PROVIDER_TEST_SUITES: $(b)$(newline))
+  endif
+  a :=
+  b :=
+endif
+
 # For test modules that lack a suite tag, set null-suite as the default.
 # We only support adding a default suite to native tests, native benchmarks, and instrumentation tests.
 # This is because they are the only tests we currently auto-generate test configs for.
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index 2e67aff..8a98c13 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -271,6 +271,7 @@
 LOCAL_SOONG_MODULE_TYPE :=
 LOCAL_SOONG_PROGUARD_DICT :=
 LOCAL_SOONG_PROGUARD_USAGE_ZIP :=
+LOCAL_SOONG_PROVIDER_TEST_SUITES :=
 LOCAL_SOONG_RESOURCE_EXPORT_PACKAGE :=
 LOCAL_SOONG_TRANSITIVE_RES_PACKAGES :=
 LOCAL_SOONG_DEVICE_RRO_DIRS :=
diff --git a/core/soong_config.mk b/core/soong_config.mk
index c3cbaf3..f5c5238 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -467,6 +467,7 @@
   $(call add_json_bool, ProductUseDynamicPartitions, $(filter true,$(PRODUCT_USE_DYNAMIC_PARTITIONS)))
   $(call add_json_bool, ProductRetrofitDynamicPartitions, $(filter true,$(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS)))
   $(call add_json_bool, ProductBuildSuperPartition, $(filter true,$(PRODUCT_BUILD_SUPER_PARTITION)))
+  $(call add_json_bool, BuildingSuperEmptyImage, $(filter true,$(BUILDING_SUPER_EMPTY_IMAGE)))
   $(call add_json_str, BoardSuperPartitionSize, $(BOARD_SUPER_PARTITION_SIZE))
   $(call add_json_str, BoardSuperPartitionMetadataDevice, $(BOARD_SUPER_PARTITION_METADATA_DEVICE))
   $(call add_json_list, BoardSuperPartitionBlockDevices, $(BOARD_SUPER_PARTITION_BLOCK_DEVICES))
diff --git a/shell_utils.sh b/shell_utils.sh
index 3124db5..61b0ebc 100644
--- a/shell_utils.sh
+++ b/shell_utils.sh
@@ -97,8 +97,11 @@
   local out_dir=$(getoutdir)
   local top=$(gettop)
 
-  # return early if out dir is already a symlink
+  # return early if out dir is already a symlink.
   if [[ -L "$out_dir" ]]; then
+    destination=$(readlink "$out_dir")
+    # ensure the destination exists.
+    mkdir -p "$destination"
     return 0
   fi
 
diff --git a/tools/aconfig/Cargo.toml b/tools/aconfig/Cargo.toml
index a031b7f..cb8377e 100644
--- a/tools/aconfig/Cargo.toml
+++ b/tools/aconfig/Cargo.toml
@@ -8,8 +8,8 @@
     "aconfig_storage_read_api",
     "aconfig_storage_write_api",
     "aflags",
-    "printflags",
-    "convert_finalized_flags"
+    "convert_finalized_flags",
+    "exported_flag_check",
 ]
 
 resolver = "2"
diff --git a/tools/aconfig/OWNERS b/tools/aconfig/OWNERS
index c92fc7c..0c31938 100644
--- a/tools/aconfig/OWNERS
+++ b/tools/aconfig/OWNERS
@@ -1,6 +1,5 @@
 dzshen@google.com
 opg@google.com
-tedbauer@google.com
 zhidou@google.com
 
 amhk@google.com  #{LAST_RESORT_SUGGESTION}
diff --git a/tools/aconfig/aconfig/src/codegen/java.rs b/tools/aconfig/aconfig/src/codegen/java.rs
index 61802f2..d74e87a 100644
--- a/tools/aconfig/aconfig/src/codegen/java.rs
+++ b/tools/aconfig/aconfig/src/codegen/java.rs
@@ -59,7 +59,8 @@
     let runtime_lookup_required =
         flag_elements.iter().any(|elem| elem.is_read_write) || library_exported;
     let container = (flag_elements.first().expect("zero template flags").container).to_string();
-    let is_platform_container = matches!(container.as_str(), "system" | "product" | "vendor");
+    let is_platform_container =
+        matches!(container.as_str(), "system" | "system_ext" | "product" | "vendor");
     let context = Context {
         flag_elements,
         namespace_flags,
diff --git a/tools/aconfig/exported_flag_check/Android.bp b/tools/aconfig/exported_flag_check/Android.bp
new file mode 100644
index 0000000..184149a
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/Android.bp
@@ -0,0 +1,28 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+rust_defaults {
+    name: "exported-flag-check-defaults",
+    edition: "2021",
+    clippy_lints: "android",
+    lints: "android",
+    srcs: ["src/main.rs"],
+    rustlibs: [
+        "libaconfig_protos",
+        "libanyhow",
+        "libclap",
+        "libregex",
+    ],
+}
+
+rust_binary_host {
+    name: "exported-flag-check",
+    defaults: ["record-finalized-flags-defaults"],
+}
+
+rust_test_host {
+    name: "exported-flag-check-test",
+    defaults: ["record-finalized-flags-defaults"],
+    test_suites: ["general-tests"],
+}
diff --git a/tools/aconfig/exported_flag_check/Cargo.toml b/tools/aconfig/exported_flag_check/Cargo.toml
new file mode 100644
index 0000000..6bc07c5
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "exported-flag-check"
+version = "0.1.0"
+edition = "2021"
+
+[features]
+default = ["cargo"]
+cargo = []
+
+[dependencies]
+aconfig_protos = { path = "../aconfig_protos" }
+anyhow = "1.0.69"
+clap = { version = "4.1.8", features = ["derive"] }
+regex = "1.11.1"
diff --git a/tools/aconfig/exported_flag_check/allow_list.txt b/tools/aconfig/exported_flag_check/allow_list.txt
new file mode 100644
index 0000000..b9c81c4
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/allow_list.txt
@@ -0,0 +1,260 @@
+android.adpf.adpf_viewrootimpl_action_down_boost
+android.app.admin.flags.coexistence_migration_for_supervision_enabled
+android.app.admin.flags.enable_supervision_service_sync
+android.app.admin.flags.lock_now_coexistence
+android.app.admin.flags.permission_migration_for_zero_trust_api_enabled
+android.app.admin.flags.reset_password_with_token_coexistence
+android.app.admin.flags.set_application_restrictions_coexistence
+android.app.admin.flags.set_backup_service_enabled_coexistence
+android.app.admin.flags.set_keyguard_disabled_features_coexistence
+android.app.admin.flags.set_permission_grant_state_coexistence
+android.app.app_restrictions_api
+android.app.enforce_pic_testmode_protocol
+android.app.job.backup_jobs_exemption
+android.app.pic_uses_shared_memory
+android.app.pinner_service_client_api
+android.app.supervision.flags.deprecate_dpm_supervision_apis
+android.app.supervision.flags.enable_sync_with_dpm
+android.app.supervision.flags.supervision_api
+android.app.supervision.flags.supervision_api_on_wear
+android.app.ui_rich_ongoing
+android.appwidget.flags.use_smaller_app_widget_system_radius
+android.car.feature.always_send_initial_value_event
+android.car.feature.android_b_vehicle_properties
+android.car.feature.android_vic_vehicle_properties
+android.car.feature.area_id_config_access
+android.car.feature.async_audio_service_init
+android.car.feature.audio_control_hal_configuration
+android.car.feature.audio_legacy_mode_navigation_volume
+android.car.feature.audio_vendor_freeze_improvements
+android.car.feature.batched_subscriptions
+android.car.feature.car_app_card
+android.car.feature.car_audio_dynamic_devices
+android.car.feature.car_audio_fade_manager_configuration
+android.car.feature.car_audio_min_max_activation_volume
+android.car.feature.car_audio_mute_ambiguity
+android.car.feature.car_evs_query_service_status
+android.car.feature.car_evs_stream_management
+android.car.feature.car_night_global_setting
+android.car.feature.car_power_cancel_shell_command
+android.car.feature.car_property_detailed_error_codes
+android.car.feature.car_property_supported_value
+android.car.feature.car_property_value_property_status
+android.car.feature.cluster_health_monitoring
+android.car.feature.display_compatibility
+android.car.feature.handle_property_events_in_binder_thread
+android.car.feature.persist_ap_settings
+android.car.feature.projection_query_bt_profile_inhibit
+android.car.feature.serverless_remote_access
+android.car.feature.subscription_with_resolution
+android.car.feature.supports_secure_passenger_users
+android.car.feature.switch_user_ignoring_uxr
+android.car.feature.variable_update_rate
+android.car.feature.visible_background_user_restrictions
+android.companion.new_association_builder
+android.companion.ongoing_perm_sync
+android.companion.virtualdevice.flags.camera_multiple_input_streams
+android.companion.virtualdevice.flags.notifications_for_device_streaming
+android.content.pm.get_package_storage_stats
+android.content.res.layout_readwrite_flags
+android.content.res.resources_minor_version_support
+android.content.res.rro_control_for_android_no_overlayable
+android.content.res.self_targeting_android_resource_frro
+android.content.res.system_context_handle_app_info_changed
+android.credentials.flags.settings_activity_enabled
+android.hardware.biometrics.screen_off_unlock_udfps
+android.hardware.devicestate.feature.flags.device_state_property_migration
+android.hardware.devicestate.feature.flags.device_state_rdm_v2
+android.hardware.devicestate.feature.flags.device_state_requester_cancel_state
+android.hardware.usb.flags.enable_interface_name_device_filter
+android.hardware.usb.flags.enable_is_mode_change_supported_api
+android.media.audio.focus_exclusive_with_recording
+android.media.audio.focus_freeze_test_api
+android.media.audio.foreground_audio_control
+android.media.audio.hardening_permission_api
+android.media.audio.hardening_permission_spa
+android.media.audio.ro_foreground_audio_control
+android.media.audiopolicy.audio_mix_test_api
+android.media.codec.aidl_hal_input_surface
+android.media.swcodec.flags.apv_software_codec
+android.media.swcodec.flags.mpeg2_keep_threads_active
+android.media.tv.flags.enable_le_audio_broadcast_ui
+android.media.tv.flags.enable_le_audio_unicast_ui
+android.media.tv.flags.hdmi_control_collect_physical_address
+android.media.tv.flags.hdmi_control_enhanced_behavior
+android.media.tv.flags.tif_unbind_inactive_tis
+android.multiuser.enable_biometrics_to_unlock_private_space
+android.net.platform.flags.mdns_improvement_for_25q2
+android.nfc.nfc_persist_log
+android.nfc.nfc_watchdog
+android.os.adpf_graphics_pipeline
+android.os.android_os_build_vanilla_ice_cream
+android.os.battery_saver_supported_check_api
+android.os.network_time_uses_shared_memory
+android.os.profiling.persist_queue
+android.os.profiling.redaction_enabled
+android.permission.flags.allow_host_permission_dialogs_on_virtual_devices
+android.permission.flags.device_aware_permissions_enabled
+android.permission.flags.device_policy_management_role_split_create_managed_profile_enabled
+android.permission.flags.enable_aiai_proxied_text_classifiers
+android.permission.flags.enable_otp_in_text_classifiers
+android.permission.flags.enable_sqlite_appops_accesses
+android.permission.flags.location_bypass_privacy_dashboard_enabled
+android.permission.flags.note_op_batching_enabled
+android.permission.flags.permission_request_short_circuit_enabled
+android.permission.flags.rate_limit_batched_note_op_async_callbacks_enabled
+android.permission.flags.sensitive_notification_app_protection
+android.permission.flags.supervision_role_permission_update_enabled
+android.permission.flags.unknown_call_package_install_blocking_enabled
+android.permission.flags.updatable_text_classifier_for_otp_detection_enabled
+android.permission.flags.use_profile_labels_for_default_app_section_titles
+android.permission.flags.wallet_role_cross_user_enabled
+android.provider.allow_config_maximum_call_log_entries_per_sim
+android.provider.backup_tasks_settings_screen
+android.provider.flags.new_storage_writer_system_api
+android.service.autofill.fill_dialog_improvements_impl
+android.service.chooser.fix_resolver_memory_leak
+android.service.notification.redact_sensitive_notifications_big_text_style
+android.service.notification.redact_sensitive_notifications_from_untrusted_listeners
+android.view.accessibility.motion_event_observing
+android.view.flags.expected_presentation_time_api
+android.view.flags.toolkit_frame_rate_touch_boost_25q1
+android.view.inputmethod.concurrent_input_methods
+android.view.inputmethod.ime_switcher_revamp
+android.view.inputmethod.imm_userhandle_hostsidetests
+android.webkit.mainline_apis
+android.widget.flags.use_wear_material3_ui
+com.android.aconfig.test.disabled_rw_exported
+com.android.aconfig.test.enabled_fixed_ro_exported
+com.android.aconfig.test.enabled_ro_exported
+com.android.aconfig.test.exported.exported_flag
+com.android.aconfig.test.forcereadonly.fro_exported
+com.android.adservices.ondevicepersonalization.flags.on_device_personalization_apis_enabled
+com.android.appsearch.flags.app_open_event_indexer_enabled
+com.android.appsearch.flags.apps_indexer_enabled
+com.android.appsearch.flags.enable_app_functions_schema_parser
+com.android.appsearch.flags.enable_apps_indexer_incremental_put
+com.android.appsearch.flags.enable_contacts_index_first_middle_and_last_names
+com.android.appsearch.flags.enable_document_limiter_replace_tracking
+com.android.appsearch.flags.enable_enterprise_empty_batch_result_fix
+com.android.bluetooth.flags.allow_switching_hid_and_hogp
+com.android.bluetooth.flags.bt_offload_socket_api
+com.android.bluetooth.flags.channel_sounding
+com.android.bluetooth.flags.fix_started_module_race
+com.android.bluetooth.flags.le_subrate_api
+com.android.bluetooth.flags.leaudio_broadcast_monitor_source_sync_status
+com.android.bluetooth.flags.leaudio_broadcast_volume_control_for_connected_devices
+com.android.bluetooth.flags.leaudio_multiple_vocs_instances_api
+com.android.bluetooth.flags.metadata_api_inactive_audio_device_upon_connection
+com.android.bluetooth.flags.settings_can_control_hap_preset
+com.android.bluetooth.flags.unix_file_socket_creation_failure
+com.android.graphics.flags.icon_load_drawable_return_null_when_uri_decode_fails
+com.android.graphics.hwui.flags.animated_image_drawable_filter_bitmap
+com.android.hardware.input.manage_key_gestures
+com.android.healthfitness.flags.activity_intensity_db
+com.android.healthfitness.flags.add_missing_access_logs
+com.android.healthfitness.flags.architecture_improvement
+com.android.healthfitness.flags.cloud_backup_and_restore
+com.android.healthfitness.flags.cycle_phases
+com.android.healthfitness.flags.d2d_file_deletion_bug_fix
+com.android.healthfitness.flags.dependency_injection
+com.android.healthfitness.flags.development_database
+com.android.healthfitness.flags.ecosystem_metrics
+com.android.healthfitness.flags.ecosystem_metrics_db_changes
+com.android.healthfitness.flags.export_import
+com.android.healthfitness.flags.export_import_fast_follow
+com.android.healthfitness.flags.export_import_nice_to_have
+com.android.healthfitness.flags.expressive_theming_enabled
+com.android.healthfitness.flags.health_connect_mappings
+com.android.healthfitness.flags.immediate_export
+com.android.healthfitness.flags.logcat_censor_iae
+com.android.healthfitness.flags.new_information_architecture
+com.android.healthfitness.flags.onboarding
+com.android.healthfitness.flags.permission_metrics
+com.android.healthfitness.flags.permission_tracker_fix_mapping_init
+com.android.healthfitness.flags.personal_health_record_database
+com.android.healthfitness.flags.personal_health_record_disable_d2d
+com.android.healthfitness.flags.personal_health_record_disable_export_import
+com.android.healthfitness.flags.personal_health_record_enable_d2d_and_export_import
+com.android.healthfitness.flags.personal_health_record_entries_screen
+com.android.healthfitness.flags.personal_health_record_lock_screen_banner
+com.android.healthfitness.flags.personal_health_record_telemetry
+com.android.healthfitness.flags.personal_health_record_telemetry_private_ww
+com.android.healthfitness.flags.personal_health_record_ui_telemetry
+com.android.healthfitness.flags.phr_fhir_basic_complex_type_validation
+com.android.healthfitness.flags.phr_fhir_complex_type_validation
+com.android.healthfitness.flags.phr_fhir_oneof_validation
+com.android.healthfitness.flags.phr_fhir_primitive_type_validation
+com.android.healthfitness.flags.phr_fhir_structural_validation
+com.android.healthfitness.flags.phr_read_medical_resources_fix_query_limit
+com.android.healthfitness.flags.phr_upsert_fix_parcel_size_calculation
+com.android.healthfitness.flags.phr_upsert_fix_use_shared_memory
+com.android.icu.icu_v_api
+com.android.internal.telephony.flags.async_init_carrier_privileges_tracker
+com.android.internal.telephony.flags.cleanup_carrier_app_update_enabled_state_logic
+com.android.internal.telephony.flags.oem_enabled_satellite_phase_2
+com.android.internal.telephony.flags.remap_disconnect_cause_sip_request_cancelled
+com.android.libcore.hpke_v_apis
+com.android.libcore.read_only_dynamic_code_load
+com.android.libcore.v_apis
+com.android.media.audio.hardening_impl
+com.android.media.audio.hardening_strict
+com.android.media.extractor.flags.extractor_mp4_enable_apv
+com.android.media.extractor.flags.extractor_sniff_midi_optimizations
+com.android.media.flags.enable_cross_user_routing_in_media_router2
+com.android.media.flags.enable_notifying_activity_manager_with_media_session_status_change
+com.android.media.metrics.flags.mediametrics_to_module
+com.android.media.projection.flags.media_projection_connected_display
+com.android.media.projection.flags.media_projection_connected_display_no_virtual_device
+com.android.net.ct.flags.certificate_transparency_job
+com.android.net.ct.flags.certificate_transparency_service
+com.android.net.flags.restrict_local_network
+com.android.net.flags.tethering_active_sessions_metrics
+com.android.net.thread.flags.thread_mobile_enabled
+com.android.nfc.module.flags.nfc_hce_latency_events
+com.android.org.conscrypt.flags.certificate_transparency_checkservertrusted_api
+com.android.permission.flags.add_banners_to_privacy_sensitive_apps_for_aaos
+com.android.permission.flags.app_permission_fragment_uses_preferences
+com.android.permission.flags.archiving_read_only
+com.android.permission.flags.decluttered_permission_manager_enabled
+com.android.permission.flags.enable_coarse_fine_location_prompt_for_aaos
+com.android.permission.flags.enhanced_confirmation_backport_enabled
+com.android.permission.flags.expressive_design_enabled
+com.android.permission.flags.livedata_refactor_permission_timeline_enabled
+com.android.permission.flags.odad_notifications_supported
+com.android.permission.flags.permission_timeline_attribution_label_fix
+com.android.permission.flags.private_profile_supported
+com.android.permission.flags.safety_center_enabled_no_device_config
+com.android.permission.flags.safety_center_issue_only_affects_group_status
+com.android.permission.flags.wear_compose_material3
+com.android.permission.flags.wear_privacy_dashboard_enabled_read_only
+com.android.providers.contactkeys.flags.contactkeys_strip_fix
+com.android.providers.media.flags.enable_backup_and_restore
+com.android.providers.media.flags.enable_malicious_app_detector
+com.android.providers.media.flags.enable_mark_media_as_favorite_api
+com.android.providers.media.flags.enable_modern_photopicker
+com.android.providers.media.flags.enable_photopicker_search
+com.android.providers.media.flags.enable_photopicker_transcoding
+com.android.providers.media.flags.enable_stable_uris_for_external_primary_volume
+com.android.providers.media.flags.enable_stable_uris_for_public_volume
+com.android.providers.media.flags.enable_unicode_check
+com.android.providers.media.flags.index_media_latitude_longitude
+com.android.providers.media.flags.version_lockdown
+com.android.ranging.flags.ranging_stack_updates_25q4
+com.android.server.backup.enable_read_all_external_storage_files
+com.android.server.telecom.flags.allow_system_apps_resolve_voip_calls
+com.android.server.telecom.flags.telecom_app_label_proxy_hsum_aware
+com.android.server.telecom.flags.telecom_main_user_in_block_check
+com.android.server.telecom.flags.telecom_main_user_in_get_respond_message_app
+com.android.server.updates.certificate_transparency_installer
+com.android.system.virtualmachine.flags.terminal_gui_support
+com.android.tradeinmode.flags.enable_trade_in_mode
+com.android.update_engine.minor_changes_2025q4
+com.android.uwb.flags.uwb_fira_3_0_25q4
+com.android.wifi.flags.network_provider_battery_charging_status
+com.android.wifi.flags.p2p_dialog2
+com.android.wifi.flags.shared_connectivity_broadcast_receiver_test_api
+com.android.wifi.flags.wep_disabled_in_apm
+com.android.window.flags.untrusted_embedding_state_sharing
+vendor.vibrator.hal.flags.enable_pwle_v2
+vendor.vibrator.hal.flags.remove_capo
\ No newline at end of file
diff --git a/tools/aconfig/exported_flag_check/src/main.rs b/tools/aconfig/exported_flag_check/src/main.rs
new file mode 100644
index 0000000..866a700
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/src/main.rs
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//! `exported-flag-check` is a tool to ensures that exported flags are used as intended
+use anyhow::{ensure, Result};
+use clap::Parser;
+use std::{collections::HashSet, fs::File, path::PathBuf};
+
+mod utils;
+
+use utils::{
+    check_all_exported_flags, extract_flagged_api_flags, get_exported_flags_from_binary_proto,
+    read_finalized_flags,
+};
+
+const ABOUT: &str = "CCheck Exported Flags
+
+This tool ensures that exported flags are used as intended. Exported flags, marked with
+`is_exported: true` in their declaration, are designed to control access to specific API
+features. This tool identifies and reports any exported flags that are not currently
+associated with an API feature, preventing unnecessary flag proliferation and maintaining
+a clear API design.
+
+This tool works as follows:
+
+  - Read API signature files from source tree (*current.txt files) [--api-signature-file]
+  - Read the current aconfig flag values from source tree [--parsed-flags-file]
+  - Read the previous finalized-flags.txt files from prebuilts/sdk [--finalized-flags-file]
+  - Extract the flags slated for API by scanning through the API signature files
+  - Merge the found flags with the recorded flags from previous API finalizations
+  - Error if exported flags are not in the set
+";
+
+#[derive(Parser, Debug)]
+#[clap(about=ABOUT)]
+struct Cli {
+    #[arg(long)]
+    parsed_flags_file: PathBuf,
+
+    #[arg(long)]
+    api_signature_file: Vec<PathBuf>,
+
+    #[arg(long)]
+    finalized_flags_file: PathBuf,
+}
+
+fn main() -> Result<()> {
+    let args = Cli::parse();
+
+    let mut flags_used_with_flaggedapi_annotation = HashSet::new();
+    for path in &args.api_signature_file {
+        let file = File::open(path)?;
+        let flags = extract_flagged_api_flags(file)?;
+        flags_used_with_flaggedapi_annotation.extend(flags);
+    }
+
+    let file = File::open(args.parsed_flags_file)?;
+    let all_flags = get_exported_flags_from_binary_proto(file)?;
+
+    let file = File::open(args.finalized_flags_file)?;
+    let already_finalized_flags = read_finalized_flags(file)?;
+
+    let exported_flags = check_all_exported_flags(
+        &flags_used_with_flaggedapi_annotation,
+        &all_flags,
+        &already_finalized_flags,
+    )?;
+
+    println!("{}", exported_flags.join("\n"));
+
+    ensure!(
+        exported_flags.is_empty(),
+        "Flags {} are exported but not used to guard any API. \
+    Exported flag should be used to guard API",
+        exported_flags.join(",")
+    );
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test() {
+        let input = include_bytes!("../tests/api-signature-file.txt");
+        let flags_used_with_flaggedapi_annotation = extract_flagged_api_flags(&input[..]).unwrap();
+
+        let input = include_bytes!("../tests/flags.protobuf");
+        let all_flags_to_be_finalized = get_exported_flags_from_binary_proto(&input[..]).unwrap();
+
+        let input = include_bytes!("../tests/finalized-flags.txt");
+        let already_finalized_flags = read_finalized_flags(&input[..]).unwrap();
+
+        let exported_flags = check_all_exported_flags(
+            &flags_used_with_flaggedapi_annotation,
+            &all_flags_to_be_finalized,
+            &already_finalized_flags,
+        )
+        .unwrap();
+
+        assert_eq!(1, exported_flags.len());
+    }
+}
diff --git a/tools/aconfig/exported_flag_check/src/utils.rs b/tools/aconfig/exported_flag_check/src/utils.rs
new file mode 100644
index 0000000..2c30424
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/src/utils.rs
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use aconfig_protos::ParsedFlagExt;
+use anyhow::{anyhow, Context, Result};
+use regex::Regex;
+use std::{
+    collections::HashSet,
+    io::{BufRead, BufReader, Read},
+};
+
+pub(crate) type FlagId = String;
+
+/// Grep for all flags used with @FlaggedApi annotations in an API signature file (*current.txt
+/// file).
+pub(crate) fn extract_flagged_api_flags<R: Read>(mut reader: R) -> Result<HashSet<FlagId>> {
+    let mut haystack = String::new();
+    reader.read_to_string(&mut haystack)?;
+    let regex = Regex::new(r#"(?ms)@FlaggedApi\("(.*?)"\)"#).unwrap();
+    let iter = regex.captures_iter(&haystack).map(|cap| cap[1].to_owned());
+    Ok(HashSet::from_iter(iter))
+}
+
+/// Read a list of flag names. The input is expected to be plain text, with each line containing
+/// the name of a single flag.
+pub(crate) fn read_finalized_flags<R: Read>(reader: R) -> Result<HashSet<FlagId>> {
+    BufReader::new(reader)
+        .lines()
+        .map(|line_result| line_result.context("Failed to read line from finalized flags file"))
+        .collect()
+}
+
+/// Parse a ProtoParsedFlags binary protobuf blob and return the fully qualified names of flags
+/// have is_exported as true.
+pub(crate) fn get_exported_flags_from_binary_proto<R: Read>(
+    mut reader: R,
+) -> Result<HashSet<FlagId>> {
+    let mut buffer = Vec::new();
+    reader.read_to_end(&mut buffer)?;
+    let parsed_flags = aconfig_protos::parsed_flags::try_from_binary_proto(&buffer)
+        .map_err(|_| anyhow!("failed to parse binary proto"))?;
+    let iter = parsed_flags
+        .parsed_flag
+        .into_iter()
+        .filter(|flag| flag.is_exported())
+        .map(|flag| flag.fully_qualified_name());
+    Ok(HashSet::from_iter(iter))
+}
+
+fn get_allow_list() -> Result<HashSet<FlagId>> {
+    let allow_list: HashSet<FlagId> =
+        include_str!("../allow_list.txt").lines().map(|x| x.into()).collect();
+    Ok(allow_list)
+}
+
+/// Filter out the flags have is_exported as true but not used with @FlaggedApi annotations
+/// in the source tree, or in the previously finalized flags set.
+pub(crate) fn check_all_exported_flags(
+    flags_used_with_flaggedapi_annotation: &HashSet<FlagId>,
+    all_flags: &HashSet<FlagId>,
+    already_finalized_flags: &HashSet<FlagId>,
+) -> Result<Vec<FlagId>> {
+    let allow_list = get_allow_list()?;
+    let new_flags: Vec<FlagId> = all_flags
+        .difference(flags_used_with_flaggedapi_annotation)
+        .cloned()
+        .collect::<HashSet<_>>()
+        .difference(already_finalized_flags)
+        .cloned()
+        .collect::<HashSet<_>>()
+        .difference(&allow_list)
+        .cloned()
+        .collect();
+
+    Ok(new_flags.into_iter().collect())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_extract_flagged_api_flags() {
+        let api_signature_file = include_bytes!("../tests/api-signature-file.txt");
+        let flags = extract_flagged_api_flags(&api_signature_file[..]).unwrap();
+        assert_eq!(
+            flags,
+            HashSet::from_iter(vec![
+                "record_finalized_flags.test.foo".to_string(),
+                "this.flag.is.not.used".to_string(),
+            ])
+        );
+    }
+
+    #[test]
+    fn test_read_finalized_flags() {
+        let input = include_bytes!("../tests/finalized-flags.txt");
+        let flags = read_finalized_flags(&input[..]).unwrap();
+        assert_eq!(
+            flags,
+            HashSet::from_iter(vec![
+                "record_finalized_flags.test.bar".to_string(),
+                "record_finalized_flags.test.baz".to_string(),
+            ])
+        );
+    }
+
+    #[test]
+    fn test_disabled_or_read_write_flags_are_ignored() {
+        let bytes = include_bytes!("../tests/flags.protobuf");
+        let flags = get_exported_flags_from_binary_proto(&bytes[..]).unwrap();
+        assert_eq!(
+            flags,
+            HashSet::from_iter(vec![
+                "record_finalized_flags.test.foo".to_string(),
+                "record_finalized_flags.test.not_enabled".to_string()
+            ])
+        );
+    }
+}
diff --git a/tools/aconfig/exported_flag_check/tests/api-signature-file.txt b/tools/aconfig/exported_flag_check/tests/api-signature-file.txt
new file mode 100644
index 0000000..2ad559f
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/tests/api-signature-file.txt
@@ -0,0 +1,15 @@
+// Signature format: 2.0
+package android {
+
+  public final class C {
+    ctor public C();
+  }
+
+  public static final class C.inner {
+    ctor public C.inner();
+    field @FlaggedApi("record_finalized_flags.test.foo") public static final String FOO = "foo";
+    field @FlaggedApi("this.flag.is.not.used") public static final String BAR = "bar";
+  }
+
+}
+
diff --git a/tools/aconfig/exported_flag_check/tests/finalized-flags.txt b/tools/aconfig/exported_flag_check/tests/finalized-flags.txt
new file mode 100644
index 0000000..7fbcb3d
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/tests/finalized-flags.txt
@@ -0,0 +1,2 @@
+record_finalized_flags.test.bar
+record_finalized_flags.test.baz
diff --git a/tools/aconfig/exported_flag_check/tests/flags.declarations b/tools/aconfig/exported_flag_check/tests/flags.declarations
new file mode 100644
index 0000000..f86dbfa
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/tests/flags.declarations
@@ -0,0 +1,18 @@
+package: "record_finalized_flags.test"
+container: "system"
+
+flag {
+    name: "foo"
+    namespace: "test"
+    description: "FIXME"
+    bug: ""
+    is_exported:true
+}
+
+flag {
+    name: "not_enabled"
+    namespace: "test"
+    description: "FIXME"
+    bug: ""
+    is_exported:true
+}
diff --git a/tools/aconfig/exported_flag_check/tests/flags.protobuf b/tools/aconfig/exported_flag_check/tests/flags.protobuf
new file mode 100644
index 0000000..be64ef9
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/tests/flags.protobuf
Binary files differ
diff --git a/tools/aconfig/exported_flag_check/tests/flags.values b/tools/aconfig/exported_flag_check/tests/flags.values
new file mode 100644
index 0000000..ff6225d
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/tests/flags.values
@@ -0,0 +1,13 @@
+flag_value {
+    package: "record_finalized_flags.test"
+    name: "foo"
+    state: ENABLED
+    permission: READ_ONLY
+}
+
+flag_value {
+    package: "record_finalized_flags.test"
+    name: "not_enabled"
+    state: DISABLED
+    permission: READ_ONLY
+}
diff --git a/tools/aconfig/exported_flag_check/tests/generate-flags-protobuf.sh b/tools/aconfig/exported_flag_check/tests/generate-flags-protobuf.sh
new file mode 100755
index 0000000..701189c
--- /dev/null
+++ b/tools/aconfig/exported_flag_check/tests/generate-flags-protobuf.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+aconfig create-cache \
+    --package record_finalized_flags.test \
+    --container system \
+    --declarations flags.declarations \
+    --values flags.values \
+    --cache flags.protobuf
diff --git a/tools/otatools_package/Android.bp b/tools/otatools_package/Android.bp
new file mode 100644
index 0000000..5c7bfc7
--- /dev/null
+++ b/tools/otatools_package/Android.bp
@@ -0,0 +1,65 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    // See: http://go/android-license-faq
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+java_genrule_host {
+    name: "otatools_package_dep_jars",
+    tools: ["soong_zip"],
+    compile_multilib: "first",
+    cmd: "mkdir -p $(genDir)/framework && " +
+        "cp $(in) $(genDir)/framework && " +
+        "$(location soong_zip) -o $(out) -C $(genDir) -D $(genDir)/framework",
+    srcs: [
+        ":apksigner",
+        ":boot_signer",
+        ":signapk",
+        ":verity_signer",
+    ],
+    out: ["otatools_package_dep_jars.zip"],
+}
+
+genrule {
+    name: "otatools_package_cert_files",
+    tools: ["soong_zip"],
+    cmd: "mkdir -p $(genDir)/tmp/ && " +
+        "echo $(in) > $(genDir)/tmp/zip_files.list && " +
+        "$(location soong_zip) -o $(out) -l $(genDir)/tmp/zip_files.list ",
+    srcs: [
+        ":soong_generated_otatools_package_filegroup",
+    ],
+    out: ["otatools_package_cert_files.zip"],
+}
+
+java_genrule_host {
+    name: "otatools_package",
+    tools: ["merge_zips"],
+    compile_multilib: "first",
+    cmd: "$(location merge_zips) $(out) $(in)",
+    srcs: [
+        ":otatools_package_cert_files",
+        ":otatools_package_dep_jars",
+        ":otatools_package_releasetools",
+    ],
+    // TODO: Rename as "otatools.zip" when the rest files are ready.
+    out: ["otatools_temp.zip"],
+    dist: {
+        targets: [
+            "otatools-package-temp",
+        ],
+    },
+}
diff --git a/tools/releasetools/Android.bp b/tools/releasetools/Android.bp
index 3467152..2232385 100644
--- a/tools/releasetools/Android.bp
+++ b/tools/releasetools/Android.bp
@@ -650,3 +650,12 @@
         unit_test: true,
     },
 }
+
+genrule {
+    name: "otatools_package_releasetools",
+    tools: ["soong_zip"],
+    srcs: ["**/*"],
+    cmd: "find build/make/tools/releasetools -name '*.pyc' -prune -o \\( -type f -o -type l \\) -print | sort > $(genDir)/files.txt && " +
+        "$(location soong_zip) -o $(out) -C build/make/tools -l $(genDir)/files.txt",
+    out: ["otatools_package_releasetools.zip"],
+}
diff --git a/tools/releasetools/build_image.py b/tools/releasetools/build_image.py
index b6c96c4..08b4d6a 100755
--- a/tools/releasetools/build_image.py
+++ b/tools/releasetools/build_image.py
@@ -49,8 +49,8 @@
 # Use a fixed timestamp (01/01/2009 00:00:00 UTC) for files when packaging
 # images. (b/24377993, b/80600931)
 FIXED_FILE_TIMESTAMP = int((
-    datetime.datetime(2009, 1, 1, 0, 0, 0, 0, None) -
-    datetime.datetime.utcfromtimestamp(0)).total_seconds())
+    datetime.datetime(2009, 1, 1, 0, 0, 0, 0, datetime.UTC) -
+    datetime.datetime.fromtimestamp(0, datetime.UTC)).total_seconds())
 
 
 class BuildImageError(Exception):
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index b6cbb15..e5f5f92 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -2993,7 +2993,7 @@
     os.chmod(filename, perms)
 
     # Use a fixed timestamp so the output is repeatable.
-    # Note: Use of fromtimestamp rather than utcfromtimestamp here is
+    # Note: Use of fromtimestamp without specifying a timezone here is
     # intentional. zip stores datetimes in local time without a time zone
     # attached, so we need "epoch" but in the local time zone to get 2009/01/01
     # in the zip archive.