AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/008-call-rec-flag-secure/quickstart.md

@@ -0,0 +1,69 @@
+# Quickstart: `008` call-rec + FLAG_SECURE (LAB)
+
+**Device**: LAB only `11231JEC207477`  
+**Build**: bacon/image with `008-call-rec-flag-secure` applied  
+**Evidence root**: `/srv/rom/artifacts/008-call-rec-flag-secure/`
+
+## Prerequisites
+
+- Magisk **not** required (must work without it).
+- Developer Options enabled.
+- Contracts: [call-recording-surface.md](./contracts/call-recording-surface.md),
+  [flag-secure-surface.md](./contracts/flag-secure-surface.md).
+
+## 1. Defaults
+
+```bash
+adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
+adb -s 11231JEC207477 shell settings get secure disable_secure_windows
+# expect 0 or null
+```
+
+## 2. Call recording (region unlock)
+
+1. Open **Developer Options** → enable **Disable call recording restrictions**.
+2. Confirm:
+
+```bash
+adb shell settings get secure extendrom_call_recording
+# expect 1
+```
+
+3. Place or receive a call with Dialer → start recording → stop → confirm file
+   (Downloads / Dialer recordings — note path).
+4. Disable the switch (or turn off Developer Options) → confirm setting `0`
+   and that a restricted country would hide/deny record (or document LAB
+   country ISO + XML flag).
+
+Store notes + path under `…/call-rec/`.
+
+## 3. FLAG_SECURE override
+
+1. Enable **Allow screenshots of secure windows** in Developer Options.
+2. Confirm:
+
+```bash
+adb shell settings get secure disable_secure_windows
+# expect 1
+```
+
+3. Open an app/window that sets `FLAG_SECURE` (e.g. password manager, banking
+   login, or a tiny test APK).
+4. With toggle **OFF**: system screenshot should fail / blank.
+5. With toggle **ON**: screenshot or screen record should succeed.
+6. Toggle OFF again → secure behaviour restored.
+
+Store images/notes under `…/flag-secure/`.
+
+## 4. Pass criteria
+
+- [ ] Both settings default OFF after fresh boot / DO off  
+- [ ] Call-rec ON → recording works; OFF → stock policy  
+- [ ] FLAG_SECURE ON → capture works; OFF → blocked  
+- [ ] No Magisk installed for the successful run  
+
+## Notes
+
+- User is responsible for call-recording legality.
+- DRM-protected surfaces may still resist capture; note exceptions.
+- `user` build retest before release claims (`011`).