009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-closure-parity-20261009.md

@@ -38,9 +38,13 @@ GOLDEN was not on USB for this pass; oracle uses
 **Removed in wave 3 (was LAB-only, absent on GOLDEN):** `bash`, `htop`,
 `nano`, `unrar`, `addon.d/50-lineage.sh`.
 
-**Still LAB-only vs GOLDEN (deferred wave 4):** Qualcomm `diag_*`, `test_diag`,
-`imsrcsd`, `disable_configstore`, AOSP debug bins (`bpftool`, `alloctop`,
-`pbtombstone`, `apexd-lsof.sh`). Not required for Swissquote PASS.
+**Wave 4 drops:** Qualcomm `diag_*`, `test_diag`, `imsrcsd`, AOSP debug bins
+(`bpftool`, `alloctop`, `pbtombstone` system copy, `apexd-lsof.sh`). Not
+required for Swissquote PASS.
+
+**Keep (2026-10-16 correction):** `disable_configstore` — AOSP override for the
+HIDL configstore HAL; required on A16 VINTF. See
+`docs/009-lab-polish-20261016.md`.
 
 **Kept like GOLDEN:** `curl` (`/system/bin`), `vim` (`/system_ext`).
 
@@ -52,10 +56,10 @@ reset → sideload full zip → reboot system.
 
 ## Repo vs next bacon
 
-- `apply_009_drop_lab_only_commands.py` exists but is **commented out** in the
-  ship script (wave 4 deferred).
-- Optional later: `scripts/009-bacon-hardened-malloc.sh` (012) — separate bacon;
-  not in the booted wave 3 image.
+- Wave 4 (`apply_009_drop_lab_only_commands.py`) runs when `AXP_DEBLOB_WAVE4=1`.
+  The booted closure zip may predate that flag.
+- **Next OTA** must use `scripts/009-rebuild-from-los.sh`, which always enables
+  wave 4 and `hardened_malloc`. Not optional.
 - Host keys: `/srv/rom/secrets/android-certs` (2026-10-09); `~/.android-certs`
   symlinks there. Backup `~/backups/android-certs-secrets-20261009T1517Z.tar.gz`.
 
@@ -85,7 +89,7 @@ cmdline). Refresh this doc when a live GOLDEN dump exists.
 | Script | Purpose |
 |--------|---------|
 | `scripts/009-bacon-wave4-deblob.sh` | wave 4 lab-only command drops |
-| `scripts/009-bacon-hardened-malloc.sh` | 012 hardened_malloc (2 GiB regions) |
+| `scripts/009-bacon-hardened-malloc.sh` | **Final ship:** wave 4 + hardened_malloc (2 GiB), AVB flags 0 |
 
 Launch on `rom-dev01` via `rom-detach`; never two ninjas on one `out/`.