diff --git a/module/customize.sh b/module/customize.sh
index 8fc5719..8ce7a38 100644
--- a/module/customize.sh
+++ b/module/customize.sh
@@ -79,11 +79,15 @@ chmod 755 "$MODPATH/supervisor"
 # Debug builds carry diag.sh (the diagnostic plane); release builds do not. Extract it when
 # present; otherwise sweep any external-storage diagnostics a prior debug install left behind,
 # since the release keystore domain has no grant to remove them itself.
-if unzip -qqjo "$ZIPFILE" "diag.sh" -d "$MODPATH" 2>/dev/null; then
+# Detect presence by the extracted FILE, not unzip's exit code: the busybox/toybox unzip in
+# the install environment exits 0 even when the entry is absent, so the sweep never ran.
+unzip -qqjo "$ZIPFILE" "diag.sh" -d "$MODPATH" 2>/dev/null
+if [ -f "$MODPATH/diag.sh" ]; then
   chmod 644 "$MODPATH/diag.sh"
   ui_print "- Debug diagnostic plane enabled"
 else
   rm -rf /data/media/0/TEESimulator /data/local/tmp/teesim
+  ui_print "- Release build: swept stale diagnostics"
 fi
 
 # --- Configuration Files ---