AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/008-call-rec-flag-secure/contracts/flag-secure-surface.md

@@ -0,0 +1,34 @@
+# Contract: FLAG_SECURE / screenshot surface
+
+**Feature**: `008-call-rec-flag-secure`  
+**Consumers**: LAB validation (`quickstart.md`)
+
+## Secure setting
+
+| Item | Value |
+|------|--------|
+| Key | `Settings.Secure.disable_secure_windows` (AOSP `DISABLE_SECURE_WINDOWS`) |
+| Values | `null`/`0` = stock `FLAG_SECURE`; `1` = global capture override |
+| Readback | `adb shell settings get secure disable_secure_windows` |
+| UI preference key | `allow_flag_secure_override` (writes the Secure key above) |
+| Scope | **Global** (all apps); per-app lists not planned |
+| Note | WMS only applies this on **debuggable** builds (`ro.debuggable`) |
+
+## Capture behaviour
+
+| Condition | Expected |
+|-----------|----------|
+| Setting `0`, secure window | System screenshot / screen record blocked as stock |
+| Setting `1`, same window | System screenshot / screen record succeeds |
+| Setting `1`, DRM/HW buffer edge cases | May still fail — document if observed |
+
+## UI
+
+- Developer Options switch; short summary that this weakens app privacy.
+- Reset to `0` when Developer Options master is disabled.
+
+## Evidence
+
+- Setting readback 0/1.
+- Before/after screenshots (or failure toast) stored under
+  `/srv/rom/artifacts/008-call-rec-flag-secure/flag-secure/`.