AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/008-call-rec-flag-secure/data-model.md

@@ -0,0 +1,52 @@
+# Data model: `008-call-rec-flag-secure`
+
+## Entities
+
+### SecureSettingCallRec
+
+| Field | Type | Rules |
+|-------|------|--------|
+| key | string | `extendrom_call_recording` |
+| value | int | `0` (default) or `1` |
+| namespace | Secure | `Settings.Secure` |
+
+**Transitions**: DO switch ON → `1`; OFF → `0`; Developer Options master
+disabled → force `0`.
+
+### SecureSettingFlagSecure
+
+| Field | Type | Rules |
+|-------|------|--------|
+| key | string | `disable_secure_windows` (DO pref `allow_flag_secure_override`) |
+| value | int | `0` (default) or `1` |
+| namespace | Secure | `Settings.Secure` |
+
+**Transitions**: same as call-rec.
+
+### DialerCountryPolicy
+
+| Field | Type | Rules |
+|-------|------|--------|
+| iso | string | ISO country from `GeoUtil.getCurrentCountryIso` |
+| allowed | bool | from `call_record_states.xml` unless override ON |
+
+**Effective allow** =
+`CallRecorderService.isEnabled(context)` AND
+(`extendrom_call_recording == 1` OR country map allows iso).
+
+### CapturePolicy
+
+| Field | Type | Rules |
+|-------|------|--------|
+| windowSecure | bool | app set `FLAG_SECURE` |
+| override | bool | `disable_secure_windows == 1` |
+
+**Effective block screenshot** = `windowSecure && !override` (for covered
+system capture paths).
+
+## Relationships
+
+- Both Secure settings are owned by Settings Developer Options controllers.
+- Dialer reads call-rec setting only in `canRecordInCurrentCountry()` (and any
+  equivalent callers).
+- Framework/SystemUI reads FLAG_SECURE override on capture / secure checks.