009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_009_a15_small_ports.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""The A15 small-port applier matches AXP behavior and the A16 return type."""
+import importlib.util
+import os
+import pathlib
+import subprocess
+import tempfile
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+APPLIER = ROOT / "vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_a15_small.py"
+
+
+def load_applier():
+    spec = importlib.util.spec_from_file_location("apply_009_a15_small", APPLIER)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def write(path: pathlib.Path, text: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(text)
+
+
+class A15SmallPortTest(unittest.TestCase):
+    def test_applier_on_a16_fixtures(self) -> None:
+        src = load_applier()
+        with tempfile.TemporaryDirectory() as tmp:
+            tree = pathlib.Path(tmp)
+            write(
+                tree / "frameworks/base/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/LockoutFrameworkImpl.java",
+                src.LOCKOUT_OLD + "\n",
+            )
+            write(
+                tree / "frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java",
+                src.SERIAL_OLD,
+            )
+            write(
+                tree / "frameworks/base/packages/SystemUI/src/com/android/systemui/screenshot/ImageExporter.java",
+                "import android.os.Build;\nimport java.time.format.DateTimeFormatter;\n"
+                + src.EXIF_OLD,
+            )
+            write(
+                tree / "bootable/recovery/install/install.cpp",
+                src.RECOVERY_OLD,
+            )
+            env = os.environ.copy()
+            env["SUNFISH_A16_TREE"] = str(tree)
+            subprocess.check_call(["python3", str(APPLIER)], env=env)
+            subprocess.check_call(["python3", str(APPLIER)], env=env)
+            lockout = (tree / "frameworks/base/services/core/java/com/android/server/biometrics/sensors/fingerprint/hidl/LockoutFrameworkImpl.java").read_text()
+            ams = (tree / "frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java").read_text()
+            exif = (tree / "frameworks/base/packages/SystemUI/src/com/android/systemui/screenshot/ImageExporter.java").read_text()
+            recovery = (tree / "bootable/recovery/install/install.cpp").read_text()
+            self.assertIn("MAX_FAILED_ATTEMPTS_LOCKOUT_PERMANENT = 5", lockout)
+            self.assertNotIn("= 20", lockout)
+            self.assertIn("final String buildSerial = Build.UNKNOWN;", ams)
+            self.assertNotIn("sTheRealBuildSerial :", ams)
+            self.assertNotIn("TAG_SOFTWARE", exif)
+            self.assertNotIn("TAG_DATETIME_ORIGINAL", exif)
+            self.assertNotIn("import android.os.Build;", exif)
+            self.assertNotIn("DateTimeFormatter", exif)
+            self.assertIn("TAG_IMAGE_WIDTH", exif)
+            self.assertIn("Serial number constraint not permitted", recovery)
+            self.assertIn("return false;", recovery)
+            self.assertNotIn("return INSTALL_ERROR", recovery)
+            self.assertNotIn("serial_number_match", recovery)
+
+
+if __name__ == "__main__":
+    unittest.main()