009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

.specify/memory/constitution.md

@@ -11,7 +11,7 @@ This constitution is specific to `AXP_Resurection`. Sibling `sunfish-a16-rom`
 is the KernelSU standby track. It does **not** inherit SSYSTEMS, company
 GitLab, Redmine, or buildout-saar governance.
 
-**Version**: 0.3.0 | **Ratified**: 2026-08-09 | **Last Amended**: 2026-09-16
+**Version**: 0.3.1 | **Ratified**: 2026-08-09 | **Last Amended**: 2026-10-07
 
 ## Core Principles
 
@@ -49,6 +49,13 @@ functionality, except features that are obsolete, incompatible with LineageOS
 23.2 / Android 16 / sunfish, or deliberately substituted (for example Magisk →
 KernelSU-Next; AXP backup tooling → NeoBackup as an external user tool).
 
+Degoogle as far as a free replacement keeps the function. microG plus the
+project-patched Play Store stay. Location uses the LineageOS 23.2 stack so a
+fix stays accurate and fast; do not apply AXP's location lockdown or delete
+the IZat/XTRA/xtwifi blobs. A settings switch, default off, may stop LPP
+(and the LPPE session it carries) plus the `loc_launcher` service that
+starts XTRA and IZat.
+
 `docs/axp-pro-parity.md` and `docs/hardening-backlog.md` are **non-normative**
 product/backlog trackers. A row becomes a requirement only when promoted into a
 feature `spec.md`. For an active feature, this constitution plus that feature's
@@ -578,3 +585,10 @@ Upstream freshness for root stack and similar deps: integrate from newest
 compatible stable/tagged upstream (full git history), verify version codes
 against the matching manager **before** long builds; pin only after LAB works.
 Triggered by stale shallow ReSukiSU mirror yielding `KSU_VERSION=30701`.
+
+### Amendment 0.3.1 — 2026-10-07
+
+Owner: degoogle where a free alternative keeps the function; microG and the
+patched Play Store stay. Location stays on the LineageOS 23.2 code (accurate
+and fast), not AXP's location cuts. Moving apps such as OpenEUICC track the
+latest upstream, not the revision frozen in an AXP zip.