[Android Software Development] osm0sis:
I've been formatting every time in LOS Recovery to correctly clean flash, so that's already done.

7 Pro is tied up right now. I'll just see if I can modify system to allow adb insecure during boot on my 9 Pro so I can just dump the logcat and find the missing permissions directly.

Edit: `sed -i 's/secure=1/secure=0/g' /mnt/system/system/build.prop` and...

@Nikhil Success!

02-14 03:22:47.764 4216 4216 E System : ******************************************
02-14 03:22:47.764 4216 4216 E System : ************ Failure starting system services
02-14 03:22:47.764 4216 4216 E System : java.lang.IllegalStateException: Signature|privileged permissions not in privapp-permissions allowlist: {com.google.android.googlequicksearchbox (/system/priv-app/Velvet): android.permission.MODIFY_AUDIO_ROUTING}
02-14 03:22:47.764 4216 4216 E System :	at com.android.server.pm.permission.PermissionManagerServiceImpl.onSystemReady(PermissionManagerServiceImpl.java:4410)
02-14 03:22:47.764 4216 4216 E System :	at com.android.server.pm.permission.PermissionManagerService$PermissionManagerServiceInternalImpl.onSystemReady(PermissionManagerService.java:739)
02-14 03:22:47.764 4216 4216 E System :	at com.android.server.pm.PackageManagerService.systemReady(PackageManagerService.java:4124)
02-14 03:22:47.764 4216 4216 E System :	at com.android.server.SystemServer.startOtherServices(SystemServer.java:2727)
02-14 03:22:47.764 4216 4216 E System :	at com.android.server.SystemServer.run(SystemServer.java:940)
02-14 03:22:47.764 4216 4216 E System :	at com.android.server.SystemServer.main(SystemServer.java:650)
02-14 03:22:47.764 4216 4216 E System :	at java.lang.reflect.Method.invoke(Native Method)
02-14 03:22:47.764 4216 4216 E System :	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
02-14 03:22:47.764 4216 4216 E System :	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:914)
02-14 03:22:47.764 4216 4216 E Zygote : System zygote died with fatal exception
02-14 03:22:47.764 4216 4216 E Zygote : java.lang.IllegalStateException: Signature|privileged permissions not in privapp-permissions allowlist: {com.google.android.googlequicksearchbox (/system/priv-app/Velvet): android.permission.MODIFY_AUDIO_ROUTING}
02-14 03:22:47.764 4216 4216 E Zygote :	at com.android.server.pm.permission.PermissionManagerServiceImpl.onSystemReady(PermissionManagerServiceImpl.java:4410)
02-14 03:22:47.764 4216 4216 E Zygote :	at com.android.server.pm.permission.PermissionManagerService$PermissionManagerServiceInternalImpl.onSystemReady(PermissionManagerService.java:739)
02-14 03:22:47.764 4216 4216 E Zygote :	at com.android.server.pm.PackageManagerService.systemReady(PackageManagerService.java:4124)
02-14 03:22:47.764 4216 4216 E Zygote :	at com.android.server.SystemServer.startOtherServices(SystemServer.java:2727)
02-14 03:22:47.764 4216 4216 E Zygote :	at com.android.server.SystemServer.run(SystemServer.java:940)
02-14 03:22:47.764 4216 4216 E Zygote :	at com.android.server.SystemServer.main(SystemServer.java:650)
02-14 03:22:47.764 4216 4216 E Zygote :	at java.lang.reflect.Method.invoke(Native Method)
02-14 03:22:47.764 4216 4216 E Zygote :	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:548)
02-14 03:22:47.764 4216 4216 E Zygote :	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:914)
02-14 03:22:47.764 4216 4216 D AndroidRuntime: Shutting down VM

And I can confirm adding android.permission.MODIFY_AUDIO_ROUTING to etc/permissions/com.google.android.googlequicksearchbox.xml gets the device booting. 🎉