Good point indeed, I forgot that I do enable the fake seal bit patch. Other than that I never found any reason for the other changes -- dbus-server (imho one of the most annoying) stops doing credential checks just because of the openmode flag, and for the other few processes there's FIXED_ORIGIN. Just installing anything is usually enough for develsh to "Recover" the * token set.

One question: why do you mention CAL here? Is the libcal stuff stored in whatever BB5 uses as storage now? All of the kernel-addressable NAND is certainly fully writable in any mode (but in closed mode you need at least one of sys_module or a GRP I forgot about) and in fact one of the glaring points where a N9/50 can be relatively easily bricked.

I think that those apps just refuse to run when openmode is detected. For the simple checks, a simple workaround can be used; if they really use BB5 features it might actually be impossible, but the fact that it is impossible is exactly the reason why open mode will be allowed for the foreseeable future.

Fortunately, it seems that the number is much lower than I expected.

Any of those solutions implies keeping the device in "closed mode", so it would defeat the DRM parts of Aegis, and I've already deduced that is not going to happen.
Yes, every Nokian has been very quick to say that Aegis is not for DRM, but I've seen plenty of indications that at least some people in there still think that is the case (e.g. drive, odnp stuff) because they are going way more than necessary for just say protecting your past gps fixes from prying eyes, and because of the reluctance of the remaining developers to share information.

I do have a few proposals too:
- Make dbus-server not automatically ignore credentials on unclean boots, but rather make it listen to a env var like the dpkg script does. Same for other apps. This way you can enable credential enforcing even in unclean boots if you wish.
- The other extreme: fix all the apps that are expecting armed aegis protected storage, so that they also work even if it is missing (even if it means storing data in $HOME).

The first might probably happen, the second will certainly not.