009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-handoff-20261008.md

@@ -4,11 +4,20 @@ Start here. Older remaining-work docs still describe the tree from before
 LAB booted the 2026-10-08 zip. This file is the execution map for the
 final ROM. Do not commit unless the owner asks. Do not flash GOLDEN.
 
+**Before every OTA bacon on host:** re-read
+[`009-ota-rebuild-checklist.md`](009-ota-rebuild-checklist.md) (includes bundled
+apps / `apps.mk` + US-S4-3 as of 2026-10-10).
+
+**Device roles (2026-10-16):** LAB = owner daily driver (no wipe/flash without
+ask). GOLDEN runs our build (debug OK). AXP oracle = a16 refs, not live GOLDEN.
+Polish backlog: [`009-lab-polish-20261016.md`](009-lab-polish-20261016.md)
+(configstore + EuiccDisabler fixes in WT for next bacon).
+
 ## Hard rules already paid for
 
-- LAB only: `11231JEC207477`. GOLDEN `11071JEC203839` is the live oracle.
-  It may be plugged in at the same time. Never flash, wipe, or change Magisk
-  on it. Always `adb -s 11231JEC207477`.
+- LAB `11231JEC207477` = owner daily driver — no wipe/flash without explicit
+  ask. GOLDEN `11071JEC203839` = test phone (our build OK). AXP oracle =
+  `a16.ssystems.de` refs, not live GOLDEN. Use `adb -s <serial>` deliberately.
 - Do not factory-reset LAB except an **owner-driven scratch** (recovery wipe +
   sideload closure zip). The recovery screen "Can't load Android system /
   data may be corrupt / reason=init_user0_failed" is **not** corrupt data.
@@ -28,6 +37,13 @@ final ROM. Do not commit unless the owner asks. Do not flash GOLDEN.
 
 ## Running now
 
+**Polish full bacon (2026-10-16, host):** session `bacon009polish20261016`,
+stage `worktree-20261016-polish`, `LOS_DATE=20261016`, fixes in
+[`009-lab-polish-20261016.md`](009-lab-polish-20261016.md). Status/log:
+`/srv/rom/artifacts/detach-bacon009polish20261016.*`. Laptop relaunch:
+`scripts/009-sync-ota-stage-to-host.sh` + `scripts/009-relaunch-polish-bacon.sh`.
+Migration export: [`009-laptop-migration-20261016.md`](009-laptop-migration-20261016.md).
+
 **Closure baseline (booted, Swissquote Island PASS):** wave 3 zip
 `20261009T145241Z-axp-stage1-combo4-cve-hi-releasekeys`
 SHA256 `7cd20e4d218bc04f0b4a31838a5bb9040db36148a2b38d90342b3bc9f224a5fd`.
@@ -40,11 +56,12 @@ exits `-69` in Island after wave 3 (Lineage tools removal). Parity notes:
 | Item | Status |
 |------|--------|
 | Keys → `/srv/rom/secrets/android-certs` | done |
-| Scratch reinstall (virgin `/data`, same closure zip) | `boot_a`/`boot_b` flashed 2026-10-09; recovery **unauthorized** — owner: USB auth → Factory reset → sideload zip in `/tmp/axp-closure-scratch/` (laptop) or host artifact dir |
+| Interim scratch (wave 3 only, `/data` limpio) | **done** 2026-10-09: sideload `7cd20e4d…` `Total xfer: 2.00x` — reboot system from recovery |
+| **Final scratch** (wave 4 + malloc zip) | **sideloaded** 2026-10-09 ~20:10 local on LAB `11231JEC207477`. Boot both slots `75dd81bf…`. Zip `47a7e545…` `Total xfer: 2.00x`. Reboot system from recovery, then owner test |
 | `~/.android-certs.pre-secrets-20261009` removed on host | done |
 | GOLDEN package/cmdline parity | needs GOLDEN USB or reference dump |
-| `bacon009wave4` (diag drop) | **running** `2026-10-09T15:29:17Z` — log `detach-bacon009wave4-20261009T152917Z.log` |
-| `bacon012malloc` (hardened_malloc) | **queue after wave4** (one `out/`): `rom-detach bacon012malloc -- /srv/rom/artifacts/bin/009-bacon-hardened-malloc.sh` |
+| `bacon009wave4b` | **stopped** 2026-10-09 ~16:11 UTC (avoid duplicate full ROM) |
+| `bacon009final` (wave 4 + malloc) | **FLASH_READY** `20261009T172104Z-axp-stage1-combo4-cve-hi-releasekeys`. Bacon exit 0; wrapper exit 1 was postflight `simg2img` on raw-ext4 `vendor.img` (script fixed: sparse-magic check). Postflight tail re-run 17:50 UTC: wave 4 + US-S4-2 OK. Bootanimation stays Lineage (no AXP asset in GOLDEN/PRO payload) |
 | Physical-SIM call gate | owner — before more radio deblob |
 | Git commit of repo closure deltas | owner asked 2026-10-09 |
 
@@ -632,13 +649,22 @@ Not committed. Do not revert while picking up a later item.
   the identity/kernel applies. Laptop scripts were rsynced to
   `/srv/rom/artifacts/bin/`.
 
-## Docs that will lie to you
+## Docs hygiene (2026-10-10)
 
-- `docs/009-axp-graphene-remaining.md` — pre-boot order. Pointer added.
-- `docs/009-hardening-signing-checklist.md` — still says test-keys,
-  `userdebug`, and "hardened_malloc later". The booted zip is `user` +
-  `release-keys`, and malloc is the bacon in flight.
-- `docs/009-user-zip-audit-20261007.md` — an older unflashed zip. Jelly is
-  **kept** now; that audit's "Jelly absent" line is obsolete.
-- `docs/009-version-pins.md` — still right for microG, Magisk 30.7, Phonesky,
-  OpenEUICC. Add the malloc pin when that bacon is accepted.
+Index refreshed: `docs/README.md`, `specs/README.md`, `docs/archive/README.md`.
+Upstream rebase / first OTA: `docs/009-upstream-rebase-ota.md`.
+Remaining roadmap: `docs/009-axp-graphene-remaining.md` (rewritten).
+
+Still treat as **historical** (banners added): all `009-fortify-*`,
+`009-cve-bisect-plan.md`, `009-lab-acceptance-20261002-*`,
+`009-user-zip-audit-20261007.md`.
+
+**Parallel (keep, not historical trash):** `007-*` +
+`docs/007-parallel-on-009.md` — ReSukiSU/SusFS retry on current Magisk ROM;
+never into Magisk ship bacon.
+
+Still polish when touching them: `009-hardening-signing-checklist.md` and
+`009-gate-g-kernel-attribution.md` mid-body tables may still show older
+`test-keys` / Oct-1 artifacts — prefer closure parity for measured LAB state.
+`009-version-pins.md` — microG / Magisk 30.7 / Phonesky OK; add upstream LOS
+pin when the next rebase starts.