From 3f11eab49ff8ef7344062455349798e8297afad7 Mon Sep 17 00:00:00 2001 From: fenleon Date: Fri, 16 Oct 2026 00:07:32 +0200 Subject: [PATCH] registration: postdata presents the login run's anisette set (one set session-wide) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The A/B ladder 2026-10-15/16: fresh postdata mint was not the prefpane discriminator — the prefpane now passes with a fresh GENUINE stamp through the whole chain, pinning the 400 on the validation-data mint itself (rng_pad130 of scrambleBody). --- .../kotlin/dev/fenn/imessage/registration/GsaLoginChain.kt | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/registration/src/main/kotlin/dev/fenn/imessage/registration/GsaLoginChain.kt b/registration/src/main/kotlin/dev/fenn/imessage/registration/GsaLoginChain.kt index bf3ee3f..1ff82ff 100644 --- a/registration/src/main/kotlin/dev/fenn/imessage/registration/GsaLoginChain.kt +++ b/registration/src/main/kotlin/dev/fenn/imessage/registration/GsaLoginChain.kt @@ -171,6 +171,11 @@ class GsaLoginChain( * has minted one, immediately before the delegate sign-in. Skipped when the spd lacks * the adsid/idms.hb pair (a pre-2FA login carries neither); failures are logged, never * fatal — the sign-in decides its own verdict. + * + * The anisette presented is the LOGIN RUN's set ([lastLoginAnisette]) — the accepted wire + * reuses ONE set session-wide (2026-10-15 decode), so the device record is trusted under + * the same OTP window the PET is issued under. Falls back to a fresh mint only when no + * login run has happened (e.g. direct test calls). */ suspend fun postdataLiveness(spd: GsaSpd?, pushTokenHex: String? = null) { val adsid = spd?.adsid @@ -184,7 +189,7 @@ class GsaLoginChain( GsaPostdataRequest( adsid = adsid, hbToken = hb, - anisette = cpd().headersFor(), + anisette = lastLoginAnisette.ifEmpty { cpd().headersFor() }, clientInfo = headerConfig?.clientInfo ?: GsaHeaderConfig.AOSKIT_CLIENT_INFO, hardwareHeaders = headerConfig?.hardwareHeaders ?: emptyMap(), pushToken = pushTokenHex,