AXP-Resurection/docs/009-closure-parity-20261009.md

Closure parity — AXP (GOLDEN) vs AXPR (LAB) — 2026-10-09

Status after wave 3 boot on LAB slot _a. Swissquote 9.11.0 in Island PASS (owner confirmed). Root cause for the prior -69 / onPrivilegedAccess was Lineage tools on system (bash, htop, nano, unrar, system/addon.d/50-lineage.sh), removed in wave 3 — not Magisk PIF/cmdline.

GOLDEN was not on USB for this pass; oracle uses /srv/rom/references/axp/golden/2026-09-13/ plus prior live diffs.

Ship candidate (closure baseline)

Item	Value
Dir	20261009T145241Z-axp-stage1-combo4-cve-hi-releasekeys
Zip	AXP-Resurection-Pro-23.2-20261009-sunfish.zip
SHA256	7cd20e4d218bc04f0b4a31838a5bb9040db36148a2b38d90342b3bc9f224a5fd
boot.img	Same dir (Magisk preroot, AVB flags 0)
deblob	wave1 euicc + wave2 carrier/rcs + wave3 lineage tools
Do not re-sideload	Owner booted this zip once

Identity / Gate G (LAB measured)

Check	LAB	GOLDEN ref	Notes
ro.build.type	user	user	OK
ro.build.tags	release-keys	release-keys	OK
ro.debuggable	0	0	OK
SPL system	2026-09-01	2026-03-03	LOS23 newer
SPL vendor	2023-09-05	2023-08-05	deliberate AXPR guard
SELinux	Enforcing	Enforcing	OK
Boot state	orange / unlocked	same	OK
Phonesky	/system/priv-app/Phonesky	AXP path variant	function OK
microG	/system_ext/app/GmsCore	often /data update on GOLDEN	version may differ

System surface (commands)

Removed in wave 3 (was LAB-only, absent on GOLDEN): bash, htop, nano, unrar, addon.d/50-lineage.sh.

Wave 4 drops: Qualcomm diag_*, test_diag, imsrcsd, AOSP debug bins (bpftool, alloctop, pbtombstone system copy, apexd-lsof.sh). Not required for Swissquote PASS.

Keep (2026-10-16 correction): disable_configstore — AOSP override for the HIDL configstore HAL; required on A16 VINTF. See docs/009-lab-polish-20261016.md.

Kept like GOLDEN: curl (/system/bin), vim (/system_ext).

Recovery / boot

Sunfish: recovery-as-boot only (boot_a / boot_b). No fastboot flash recovery. Scratch install: flash boot.img to both slots → recovery → factory reset → sideload full zip → reboot system.

Repo vs next bacon

• Wave 4 (apply_009_drop_lab_only_commands.py) runs when AXP_DEBLOB_WAVE4=1. The booted closure zip may predate that flag.
• Next OTA must use scripts/009-rebuild-from-los.sh, which always enables wave 4 and hardened_malloc. Not optional.
• Host keys: /srv/rom/secrets/android-certs (2026-10-09); ~/.android-certs symlinks there. Backup ~/backups/android-certs-secrets-20261009T1517Z.tar.gz.

Physical-SIM call gate

Before any wave beyond carrier/rcs deblob: owner places a mobile-network voice call on LAB (SIM in slot, not Wi‑Fi calling only). Note result and time in docs/009-handoff-20261008.md.

GOLDEN parity capture

When GOLDEN 11071JEC203839 is on USB (read-only oracle):

adb -s 11071JEC203839 shell pm list packages -f | sort > /tmp/golden-packages.txt
adb -s 11231JEC207477 shell pm list packages -f | sort > /tmp/lab-packages.txt
diff -u /tmp/golden-packages.txt /tmp/lab-packages.txt
adb -s 11071JEC203839 shell cat /proc/cmdline > /tmp/golden-cmdline.txt
adb -s 11231JEC207477 shell cat /proc/cmdline > /tmp/lab-cmdline.txt

Offline fallback: /srv/rom/references/axp/golden/2026-09-13/ (not a live cmdline). Refresh this doc when a live GOLDEN dump exists.

Follow-on bacons (not the booted closure zip)

Script	Purpose
scripts/009-bacon-wave4-deblob.sh	wave 4 lab-only command drops
scripts/009-bacon-hardened-malloc.sh	Final ship: wave 4 + hardened_malloc (2 GiB), AVB flags 0

Launch on rom-dev01 via rom-detach; never two ninjas on one out/.

Scratch reinstall

Owner-driven virgin /data with the same closure zip: flash boot.img to both slots → recovery factory reset → sideload → reboot system from menu.

Open (non-blocking)

• LOS 23 nightly rebase; regen plan/tasks.