Android SDK diagnostics: null Auth locale header, measurement/broker errors, and Remote Config dependency constraint

### [READ] Step 1: Are you in the right place?

This report concerns SDK-generated diagnostics and an SDK dependency constraint, supported by caller traces and exact published artifact inspection. Please route the closed-source Auth/Play Services findings if they require a different Firebase support component. No application credentials or raw account logs are attached.

### [REQUIRED] Step 2: Describe your environment

- Android Studio: AI-251.25410.109.2511.13752376; builds performed through Gradle CLI / JBR javac 21.0.6.
- Firebase components: Auth, Remote Config/ABT and Analytics.
- Samsung SM-S938U, Android 16, Google Play Services 26.32.34 (260400-968093310), Firebase BoM 34.15.0, Auth 24.1.0, Analytics 23.2.0, Remote Config 23.1.0, React Native Firebase 25.1.0. Distribution is a signed, non-debuggable direct APK. Authentication and protected application requests complete successfully. These logs still block our runtime acceptance.

### [REQUIRED] Step 3: Describe the problem

#### Steps to reproduce

1. Use the above SDK graph in a signed Android app with a persisted authenticated session.
2. Cold-start the app and capture its process logs through token refresh and foreground use.
3. Observe the nullable locale-header warning and the measurement/broker diagnostics below, while authenticated requests still succeed.

The Auth 24.2.0 observation below is artifact inspection only, not a claim of device reproduction on 24.2.0. The Analytics-exclusion experiment was rejected from source evidence before installation; its predicted ABT warning is not presented as a captured device result.

#### Relevant code / caller evidence

## Auth sends a null optional locale header

During persisted-session token refresh Android logs:

```text
Ignoring header X-Firebase-Locale because its value was null.
```

A temporary diagnostic build forwarding every original log entry traced this to the Firebase Auth internal request builder calling `HttpsURLConnectionImpl.setRequestProperty`, then Android `Platform.logW`. Setting the public Auth language code before React startup did not eliminate the warning. That experiment and all probe code were removed.

Inspection of the published Auth 24.1.0 and 24.2.0 class files finds the same unconditional `URLConnection.setRequestProperty("X-Firebase-Locale", nullableField)` call. The builder also resets that field to null after preparing the request. The internal classes are `zzaem` in 24.1.0 and `zzafj` in 24.2.0 under `com.google.android.gms.internal.firebase-auth-api`.

Requested correction: omit the optional locale header when its value is null, preserving a supplied locale and all authentication/App Check headers. Please confirm the expected public API behavior during token refresh and identify a fixed SDK version.

## Measurement and broker diagnostics

Cold startup and foreground use also produce an empty classloader-path warning, a missing resource package `6a` / resource `0x6a0b0013`, and GoogleApiManager broker `SecurityException` naming `com.google.android.gms`, with Phenotype/FlagStore retries. ProviderInstaller cannot load its remote module, then installs AndroidOpenSSL through CompatProvider.

The caller traces identify:

- measurement initialization → DynamiteModule → DynamiteLoaderV2 → Android DexPathList for the empty path;
- remote measurementdynamite 26.32.34 → `Resources.getResourcePackageName` for the missing resource;
- Google Play Services' internal HandlerThread for the broker error.

Analytics arrives through Remote Config's npm peer dependency and Android autolinking. An experimental exclusion removed all measurement dependencies, but we rejected it before installation: Remote Config 23.1.0 calls `FirebaseABTesting.replaceAllExperiments` even for an empty experiment list, ABT 21.1.1 rejects an absent AnalyticsConnector, and Remote Config logs a new warning. The live Remote Config template has no parameters, targeting conditions or personalization. The supported original dependency graph is retained.

Requested correction: identify the Google Play Services/measurement fix or supported integration correction for these diagnostics; clarify how basic Remote Config activation should work without Analytics when no experiments or Analytics-based targeting are configured. No broad log suppression or security-provider bypass is requested.

This report deliberately separates the Auth header defect from the measurement/broker findings; maintainers may route them to separate issues. No claim is made that a successful request resolves the logged failures.

Separate the Auth header report from the measurement and broker diagnostics. Start by inspecting Auth classes zzaem in 24.1.0 and zzafj in 24.2.0, then review the stated measurement, DynamiteModule, Resources, and Remote Config/ABT caller traces. Done requires identified supported corrections for each finding, confirmation of locale-header behavior, and clarification of Remote Config activation without Analytics.

Written by the indexing model from the issue text.