AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

specs/009-axp-los23-port/contracts/magisk-preinstall.md

@@ -0,0 +1,38 @@
+# Contract: Magisk preinstall (AXP / GOLDEN class)
+
+**Ship root**: Magisk (newest stable that works on this stack)  
+**Not ship**: KernelSU / SusFS (`007` optional recycle only)
+
+## Behavioural contract
+
+1. After a clean `009` flash, Magisk is **present** in an AXP-like
+   **preinstalled but not fully activated** state (exact files/UI measured
+   from GOLDEN — document in LAB runbook).
+2. Owner can complete activation on LAB using documented steps.
+3. DenyList-class configuration can hide root from banking packages before
+   first process start (GOLDEN workflow).
+4. Magisk version in the version-pin record is newest workable stable, not an
+   accidental stale host copy.
+
+## Banking interaction
+
+Aurora install → do not open → DenyList (incl. processes) → Island clone →
+first launch in Island. Banks MUST NOT receive root.
+
+## Out of contract
+
+- Shipping Magia branding specifically ( Magisk upstream UI OK if behaviour
+  matches).
+- Requiring KernelSU coexistence on the same ship image.
+
+## Verification
+
+```bash
+# After flash (pre-activation): document paths/props matching GOLDEN notes
+adb shell ls -l /system_ext/bin/magisk 2>/dev/null || true
+adb shell pm list packages | grep -iE 'magisk|magia'
+
+# After activation: Magisk app reports version; DenyList configurable
+```
+
+Evidence under `/srv/rom/artifacts/009-axp-los23-port/magisk/`.