AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

docs/003-gate-handoff.md

@@ -0,0 +1,33 @@
+# 003 gate checklist (handoff → 004)
+
+**Date:** 2026-09-14  
+**Device:** LAB `11231JEC207477` only (GOLDEN untouched)
+
+## Naming (owner clarification)
+
+- **LAB target ROM:** Android **16** / LineageOS **23.2**
+- **GOLDEN:** AXP Pro on Android **15** — reference/read only
+- Do **not** treat “A15” as a synonym for Android 16
+
+## Build / flash
+
+| Item | Status | Evidence |
+|------|--------|----------|
+| Vanilla LOS build | pass | `#### build completed successfully` / `exit=0` 2026-09-14T13:52:46Z |
+| Artifacts + SHA-256 + manifest -r | pass | `/srv/rom/artifacts/003-vanilla/20260914-lineage-23.2-sunfish/` + laptop `.local-artifacts/…` |
+| Unlock + flash LAB | pass | `unlocked: yes`; sideload `Total xfer: 1.00x` |
+| Identity | pass | `ro.lineage.version=23.2-20260914-UNOFFICIAL-sunfish`; no iodé/AXP props |
+| SELinux / encrypt | pass | Enforcing; `encrypted` |
+| P1 hardware smoke | pass | adb + owner confirmation of main functions 2026-09-14 |
+
+## Notes (non-blocking)
+
+- Public **test-keys** banner — expected until `011`
+- `verifiedbootstate=orange` / unlocked — expected
+- Vendor security patch **2023-09-05** — EOL Pixel; document further in `013`
+- Titan M `libnos_datagram` during recovery wipe — ignore; install status 0
+- Platform ASB for this baseline: trust Lineage merges (`ro.build.version.security_patch=2026-09-01`); no separate CVE audit in `003`
+
+## Gate
+
+**`003` complete → proceed to `004` (microG + GSF Proxy + patched Phonesky) on LAB only.**