AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

vendor/sunfish-a16/patches/008-call-rec-flag-secure/README.md

@@ -0,0 +1,32 @@
+# 008 call-rec + FLAG_SECURE patches
+
+Idempotent apply for LOS 23.2 on `rom-dev01`.
+
+```bash
+python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py
+```
+
+## Attribution
+
+- **Call recording**: EXTENDROM `er.sh` F_CALLREC / AXP GOLDEN
+  (`extendrom_call_recording`). steadfasterX EXTENDROM.
+- **FLAG_SECURE**: AOSP `Settings.Secure.DISABLE_SECURE_WINDOWS` already
+  wired in `WindowManagerService` on A16; DO preference
+  `allow_flag_secure_override` writes that key.
+
+## Touched paths
+
+| Area | Path under `/srv/rom/src/lineage/` |
+|------|-------------------------------------|
+| Secure call-rec | `frameworks/base/core/java/android/provider/Settings.java` (`ER_ALLOW_ANY_CALL_REC`) |
+| Dialer gate | `packages/apps/Dialer/java/com/android/incallui/call/CallRecorder.java` |
+| Dialer config | already `call_recording_enabled=true` / audio `4` (verified) |
+| Settings controllers | `…/ER_CallRec*.java`, `…/FlagSecureOverride*.java` |
+| Settings DO XML + strings | `res/xml/development_settings.xml`, `res/values/strings.xml` |
+| Dashboard | `DevelopmentSettingsDashboardFragment.java` |
+| Capture path | stock WMS `disable_secure_windows` (no extra WM patch) |
+
+Backups: `/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots/`  
+Marker: `SUNFISH_A16_008_CALL_REC_FLAG_SECURE`
+
+See `docs/008-call-rec-flag-secure-runbook.md`.