AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/008-call-rec-flag-secure/contracts/call-recording-surface.md

@@ -0,0 +1,32 @@
+# Contract: Call recording surface
+
+**Feature**: `008-call-rec-flag-secure`  
+**Consumers**: LAB validation (`quickstart.md`)
+
+## Secure setting
+
+| Item | Value |
+|------|--------|
+| Key | `Settings.Secure.extendrom_call_recording` |
+| Values | `null`/`0` = stock country rules; `1` = ignore country deny |
+| Readback | `adb shell settings get secure extendrom_call_recording` |
+| Write | Developer Options switch or `settings put secure … 0\|1` |
+
+## Dialer behaviour
+
+| Condition | Expected |
+|-----------|----------|
+| Feature off / setting `0` | `CallRecorder.canRecordInCurrentCountry()` uses `call_record_states.xml` |
+| Setting `1` and recording enabled | `canRecordInCurrentCountry()` true → record control available |
+| `call_recording_enabled` false | Still disabled (override does not invent recording capability) |
+
+## UI
+
+- Developer Options entry with legal responsibility summary (EXTENDROM-style).
+- Reset to `0` when Developer Options master is disabled.
+
+## Evidence
+
+- Setting readback 0/1.
+- In-call record start with setting `1` produces a file; note path under
+  `/srv/rom/artifacts/008-call-rec-flag-secure/call-rec/`.