# Closure parity — AXP (GOLDEN) vs AXPR (LAB) — 2026-10-09

Status after **wave 3** boot on LAB slot `_a`. Swissquote 9.11.0 in Island
**PASS** (owner confirmed). Root cause for the prior `-69` / `onPrivilegedAccess`
was **Lineage tools on system** (`bash`, `htop`, `nano`, `unrar`,
`system/addon.d/50-lineage.sh`), removed in wave 3 — not Magisk PIF/cmdline.

GOLDEN was not on USB for this pass; oracle uses
`/srv/rom/references/axp/golden/2026-09-13/` plus prior live diffs.

## Ship candidate (closure baseline)

| Item | Value |
|------|--------|
| Dir | `20261009T145241Z-axp-stage1-combo4-cve-hi-releasekeys` |
| Zip | `AXP-Resurection-Pro-23.2-20261009-sunfish.zip` |
| SHA256 | `7cd20e4d218bc04f0b4a31838a5bb9040db36148a2b38d90342b3bc9f224a5fd` |
| `boot.img` | Same dir (Magisk preroot, AVB flags 0) |
| deblob | wave1 euicc + wave2 carrier/rcs + wave3 lineage tools |
| Do not re-sideload | Owner booted this zip once |

## Identity / Gate G (LAB measured)

| Check | LAB | GOLDEN ref | Notes |
|-------|-----|------------|-------|
| `ro.build.type` | `user` | `user` | OK |
| `ro.build.tags` | `release-keys` | `release-keys` | OK |
| `ro.debuggable` | `0` | `0` | OK |
| SPL system | `2026-09-01` | `2026-03-03` | LOS23 newer |
| SPL vendor | `2023-09-05` | `2023-08-05` | deliberate AXPR guard |
| SELinux | Enforcing | Enforcing | OK |
| Boot state | orange / unlocked | same | OK |
| Phonesky | `/system/priv-app/Phonesky` | AXP path variant | function OK |
| microG | `/system_ext/app/GmsCore` | often `/data` update on GOLDEN | version may differ |

## System surface (commands)

**Removed in wave 3 (was LAB-only, absent on GOLDEN):** `bash`, `htop`,
`nano`, `unrar`, `addon.d/50-lineage.sh`.

**Wave 4 drops:** Qualcomm `diag_*`, `test_diag`, `imsrcsd`, AOSP debug bins
(`bpftool`, `alloctop`, `pbtombstone` system copy, `apexd-lsof.sh`). Not
required for Swissquote PASS.

**Keep (2026-10-16 correction):** `disable_configstore` — AOSP override for the
HIDL configstore HAL; required on A16 VINTF. See
`docs/009-lab-polish-20261016.md`.

**Kept like GOLDEN:** `curl` (`/system/bin`), `vim` (`/system_ext`).

## Recovery / boot

Sunfish: **recovery-as-boot** only (`boot_a` / `boot_b`). No `fastboot flash
recovery`. Scratch install: flash `boot.img` to both slots → recovery → factory
reset → sideload full zip → reboot system.

## Repo vs next bacon

- Wave 4 (`apply_009_drop_lab_only_commands.py`) runs when `AXP_DEBLOB_WAVE4=1`.
  The booted closure zip may predate that flag.
- **Next OTA** must use `scripts/009-rebuild-from-los.sh`, which always enables
  wave 4 and `hardened_malloc`. Not optional.
- Host keys: `/srv/rom/secrets/android-certs` (2026-10-09); `~/.android-certs`
  symlinks there. Backup `~/backups/android-certs-secrets-20261009T1517Z.tar.gz`.

## Physical-SIM call gate

Before any wave beyond carrier/rcs deblob: owner places a **mobile-network**
voice call on LAB (SIM in slot, not Wi‑Fi calling only). Note result and time
in `docs/009-handoff-20261008.md`.

## GOLDEN parity capture

When GOLDEN `11071JEC203839` is on USB (read-only oracle):

```bash
adb -s 11071JEC203839 shell pm list packages -f | sort > /tmp/golden-packages.txt
adb -s 11231JEC207477 shell pm list packages -f | sort > /tmp/lab-packages.txt
diff -u /tmp/golden-packages.txt /tmp/lab-packages.txt
adb -s 11071JEC203839 shell cat /proc/cmdline > /tmp/golden-cmdline.txt
adb -s 11231JEC207477 shell cat /proc/cmdline > /tmp/lab-cmdline.txt
```

Offline fallback: `/srv/rom/references/axp/golden/2026-09-13/` (not a live
cmdline). Refresh this doc when a live GOLDEN dump exists.

## Follow-on bacons (not the booted closure zip)

| Script | Purpose |
|--------|---------|
| `scripts/009-bacon-wave4-deblob.sh` | wave 4 lab-only command drops |
| `scripts/009-bacon-hardened-malloc.sh` | **Final ship:** wave 4 + hardened_malloc (2 GiB), AVB flags 0 |

Launch on `rom-dev01` via `rom-detach`; never two ninjas on one `out/`.

## Scratch reinstall

Owner-driven virgin `/data` with the **same** closure zip: flash `boot.img` to
both slots → recovery factory reset → sideload → reboot system from menu.

## Open (non-blocking)

- LOS 23 nightly rebase; regen plan/tasks.