AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

docs/002-lab-iodes-baseline.md

@@ -0,0 +1,42 @@
+# LAB baseline (iodé) — measured 2026-09-13
+
+**Role:** LAB — second sunfish for flashing our ROM.  
+**Serial:** `11231JEC207477`  
+**As found:** iodé / Lineage `7.8-20260902-sunfish`, Android **16**, patch `2026-08-01`.  
+**Bootloader:** locked (`ro.boot.flash.locked=1`).  
+**Policy:** OK to flash/wipe for experiments after factory rescue is in place.
+
+This is **not** the AXP GOLDEN oracle. Banking apps / Island / microG here are
+LAB-side copies or leftovers — do not treat as AXP Pro parity evidence.
+
+## Snapshot (text-only)
+
+| Item | Value |
+|------|--------|
+| `ro.lineage.version` | `7.8-20260902-sunfish` |
+| `ro.build.version.release` | `16` |
+| microG GmsCore | `0.3.16.252432` |
+| FakeStore / vending | `0.3.16.40226` |
+| GsfProxy | `v0.1.0` |
+| Island | `6.4.2-d46911c9` (user 10 `myisla`) |
+| Magisk/KSU | not found |
+
+Raw logs (moved/copied from early mislabel): host
+`/srv/rom/references/axp/lab/2026-09-13-iodes-baseline/` when present; else
+`/srv/rom/references/axp/golden/2026-09-13/` (same content — LAB).
+
+Factory rescue: [`002-lab-stock-rescue.md`](002-lab-stock-rescue.md).
+
+## Yuh on LAB (log peek 2026-09-13 ~22:15)
+
+Launched on **user 0** (not Island). No Magisk. Bootloader **locked**.
+
+Same core error as GOLDEN within ~4s of open:
+
+`keystore2`: RKP/IRPC for `TRUSTED_ENVIRONMENT` → `Error::Km(HARDWARE_TYPE_UNAVAILABLE)`
+
+Also: Yuh loads `libts.so`; SELinux denials probing `getenforce` / `ps` / `/cache` (root-detect style).  
+No Magisk DenyList involved on LAB → failure is **not** “only Magisk visible”.
+
+Raw: host `…/lab/2026-09-13-iodes-baseline/yuh-2026-09-13/`.
+