# 009 — OTA rebuild checklist (re-read before every `bacon009ota` launch)

**Target (current):** `lineage-23.2-20261008-nightly-sunfish` manifest pin.  
**Zip name:** `AXP-Resurection-Pro-23.2-20261008-sunfish.zip` (`LOS_DATE=20261008`).  
**Host:** `rom-dev01` only, detached: `/srv/rom/artifacts/bin/rom-detach`.

## A. Upstream pin (not the LOS signed zip)

- [ ] `LOS_MANIFEST` = official `build-manifest.xml` (SHA256 recorded in `docs/009-version-pins.md`).
- [ ] First time or after long drift: `LOS_SYNC=1` + `repo sync --force-sync` + pin all projects to manifest.
- [ ] Re-run without sync: `LOS_SYNC=0` (tree already pinned).
- [ ] Post-sync: `repo manifest -r` diff vs nightly → **0 revision diffs** on common projects.
- [ ] Do **not** sync to “tip of lineage-23.2” only; pin exact nightly.

## B. Staged sources on host (laptop → rom-dev01)

`AXP_PROJECT_SOURCE` must carry **both**:

- [ ] `vendor/sunfish-a16/` (patches, magisk, hardening.mk, BoardConfig.mk, …)
- [ ] `scripts/009-*.sh` used by rebuild (entry: `009-rebuild-from-los.sh`)

`009-rebuild-from-los.sh` rsyncs **only** `vendor/sunfish-a16` into the tree; bacon runs from **`$STAGE/scripts/`** — keep them in sync.

## C. Mandatory ship flags (OTA path)

- [ ] `AXP_DEBLOB_WAVE4=1` (wave 4 deblob)
- [ ] `012` hardened_malloc (via `009-bacon-hardened-malloc.sh`)
- [ ] `AXP_AVB_FLAGS=0` / `WITH_AVB=true`
- [ ] `LINEAGE_BUILDTYPE=PRO`, lunch `lineage_sunfish-user`, `TARGET_RELEASE=bp4a`
- [ ] Release keys: `/srv/rom/secrets/android-certs` → never in git

## D. LOS device wiring (lost on `repo forall reset` — re-apply every bacon)

`apply_009_product_includes.py` must run before breakfast:

- [ ] `lineage_sunfish.mk`: `gms.mk` + `magisk.mk` + **`apps.mk`** (`sunfish-a16-009-product-includes`)
- [ ] `magisk.mk` also `inherit-product`s `apps.mk` (belt-and-suspenders if product block drifts)
- [ ] `BoardConfigLineage.mk`: `-include vendor/sunfish-a16/BoardConfig.mk` (`sunfish-a16-009-board-config`) — **AVB + super size**

## E. Secrets / signing (host only)

`apply_009_axp_identity.py` after wiring:

- [ ] Copy release keys → `vendor/lineage-priv/keys/`
- [ ] Copy `avb.pem` + `avb_pkmd.bin` → `vendor/sunfish-a16/certs/`
- [ ] `ANDROID_CERTS_DIR=/srv/rom/secrets/android-certs`
- [ ] Pre-breakfast guards: `avb.pem`, `releasekey.pk8` exist
- [ ] Post-breakfast: `MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES` → `vendor/lineage-priv/keys`
- [ ] Post-breakfast: `BOARD_AVB_KEY_PATH` → `vendor/sunfish-a16/certs/avb.pem`

## F. Kernel pack (same msm-4.14 SHA as nightly manifest)

- [ ] Reset kernel to `git rev-parse HEAD` of pinned `kernel/google/msm-4.14` (not a stale laptop SHA).
- [ ] Stage1 + combo4 + FORTIFY + CVE clean + hi-batch1–3 + lock-scope USB
- [ ] **US-S5-1:** `CONFIG_SECURITY_YAMA` **unset** (like GOLDEN); `SLAB_FREELIST_RANDOM=y`; USERFAULTFD off
- [ ] `KSYM_NAME_LEN=192`; no KernelSU in defconfig

## G. Userspace applies (AXP ports on **A16 / LOS 23** tree)

Naming: `apply_009_a15_*` = patches **sourced from legacy AXP product**, ported to **Android 16** — not SDK 35.

- [ ] 005 sigspoof, 008 call rec / FLAG_SECURE
- [ ] 009 disable-app, DNS, connectivity, SUPL, branding, identity, cmdline, yama (inert without Yama built)
- [ ] AXP reboot/Wi‑Fi/BT timeouts (`apply_009_a15_reboot_timeouts.py`, `apply_009_a15_settings_timeouts.py`) — **no `.rej`**, fail-closed
- [ ] `apply_009_a15_small.py`
- [ ] Wave4: `apply_009_drop_lab_only_commands.py` when `AXP_DEBLOB_WAVE4=1`
- [ ] OpenSSH / carrier / euicc / lineage-tools drops

## H. Product surface (match **current LAB bacon**)

- [ ] **Jelly** on `product` (postflight US-S4-2: `Jelly.apk`)
- [ ] **AuroraStore**, **Droidify**, **FossifyGallery** on `system_ext/app/…` (postflight **US-S4-3**; absent from `product`) — [`009-bundled-apps-axp-parity.md`](009-bundled-apps-axp-parity.md)
- [ ] Pre-`mka` guard: `GmsCore`/`GsfProxy`/`Phonesky` + AuroraStore/Droidify/FossifyGallery/OpenEUICC in `PRODUCT_PACKAGES`
- [ ] Prebuilts symlinked: `/srv/rom/prebuilts/axp-apps/*.apk` → `vendor/sunfish-a16/prebuilt/`
- [ ] No Gallery2 / Glimpse on product (`hardening.mk` filter-out; Fossify replaces gallery UX)
- [ ] `hardening.mk`: `PRODUCT_PACKAGES += Jelly`
- [ ] microG + Phonesky prebuilts + GmsCore JNI extract
- [ ] Magisk 30.7 preroot, `out/.magisk/READY`

## I. Vendor SPL / identity

- [ ] `VENDOR_SECURITY_PATCH = 2023-09-05` (no rollback to 2023-08-05 on upgrade)
- [ ] `LINEAGE_BUILD_DATE` = `LOS_DATE` when set (`.axp-los-date`)

## J. Post-build (LAB only)

- [ ] Sideload full zip; Magisk boot/dtbo/vbmeta reinforce if needed
- [ ] Smoke: boot, Magisk, Island, Wallapop work profile, radio
- [ ] Record artifact SHA256 + `repo manifest -r` under `009-axp-los23-port/`

## Known failure modes (2026-10-10)

| Symptom | Cause | Fix |
|--------|--------|-----|
| LAB has microG but **no Aurora/Droidify/Fossify** | `apps.mk` never inherited (OTA before 2026-10-10 fix) | Rebacon with staged WT; postflight US-S4-3 |
| Maps brown / microG broken, JNI OK on host push only | GmsCore `.so` not in image | Rebacon; postflight must see `system_ext/app/GmsCore/lib/arm64/libconscrypt_gmscore_jni.so` |
| BT sepolicy not `lineage-priv/keys` | `gms.mk`/`magisk.mk` not inherited | `apply_009_product_includes.py` |
| Postflight US-S4-2 Gallery2 | Old gate expected Gallery2 on product | Current ship: **Jelly only** (Fossify is US-S4-3) |
| Bacon `exit=1` as root after `mka` OK | `git safe.directory` on hardened_malloc tree | `sudo -u android-build` + `apply_012` safe.directory |
| AVB key empty / wrong path | `BoardConfig.mk` not included | board include in same script |
| `missing vendor/sunfish-a16/certs` | identity not copying from secrets | `ANDROID_CERTS_DIR` + identity.py |
| `repo sync` hook errors | project object-store drift | `--force-sync` after `forall` clean |
| `patch_incomplete` | AXP patch drift on A16 | fail-closed + marker grep (not silent continue) |