009: publish AXPR23 final source and public documentation

docs/009-eol-20261026.md

@@ -0,0 +1,73 @@
+# AXPR23 — end of life (2026-10-26)
+
+Status: **EOL / archived**. No new features, no new AXPR23 builds. AXPR24
+(LOS24 / Android 17) is the active line. AXPR23 remains the reference for how
+the LOS port, the AXP packaging and the WebView integration were done.
+
+## Final shipped artifact
+
+- ZIP: `AXP-Resurection-Pro-23.2-20261025-sunfish.zip`
+- The signed ZIP is retained in the build archive; generated ROM artifacts are
+  intentionally not stored in Git.
+- SHA-256: `9d205fd3cc945438dfff3a23b129bf88516c7654f5922bc2ee4d478f9485eef0`
+- Status at build: `FLASH_READY`
+- Signed with the project release key
+  (`C=DE, O=AXP-Resurection, OU=sunfish-a16, CN=release`), cert SHA-256
+  `694a8941b64850a2acd0739c3757286c918eb16cc9788a2d7201222f351f1876`.
+- Installed on the designated reference sunfish via A/B `adb sideload` without
+  a wipe; it booted and was verified.
+
+## Verified state on the flashed device
+
+- `ro.lineage.version`: `23.2-20261025-PRO-sunfish`.
+- WebView: `org.axpos.aosmium_wv` only, native provider through Lineage's static
+  RRO (`framework-res__lineage_sunfish__auto_generated_rro_product.apk`), order:
+  Google entries (all `availableByDefault=false`) → AOSmium
+  (`availableByDefault=true`) → AOSP. LOS `webview` prebuilt removed from the
+  image by `apply_009_single_webview.py`.
+- Runtime WebView smoke (harness `com.axpr.wvtest`): HTTPS load, reduced Vanadium
+  UA, JS, WASM, Canvas2D, WebGL 2.0, WebCrypto, Blob fetch, localStorage,
+  AudioContext, WebRTC — all pass; sandboxed renderer with seccomp.
+- `hardened_malloc`: linked statically into 64-bit libc
+  (`h_malloc_info`, `h_malloc_trim`, … present in the runtime APEX libc);
+  32-bit stays Scudo.
+- `configstore` HAL crash loop: gone (0 occurrences; `disable_configstore` stub
+  present, HAL binary and rc absent).
+- No `FATAL EXCEPTION`, ANR, watchdog, tombstone or lowmemorykiller events in the
+  audit window. Remaining errors are AOSP telephony/RIL/SIM messages and
+  expected avc denials from apps probing `/proc` or the sensors HAL touching
+  `diag_device`.
+
+## Known device-side caveat (not part of the ROM)
+
+Vector 2.2 (bootloader-spoof host) ships a `sepolicy.rule` that Magisk 30.7 does
+not load, and it lacks the Android 16 `artd` path, so dexopt fails while Vector
+is installed. Policy-only Magisk module
+`axpr-vector-dex2oat` (v3) fixes it:
+
+- `/sdcard/Download/axpr-vector-dex2oat-v3.zip`
+- SHA-256 `e30194c26070031debad0ad0eabff1065b386de7b103b714220a5c6ae51a9881`
+- Delivered via `post-fs-data.sh` + `magiskpolicy --live` (no binaries, no hooks).
+- With it: `VectorDex2Oat` spoofs its cmdline, `dex2oat returned code 0`,
+  `cmd package compile` succeeds.
+- v3 installed on GOLDEN on 2026-10-26 and verified live: policy rules present
+  (`artd xposed_file`), `cmd package compile -m verify -f com.aurora.store` =
+  Success, 0 `art_exec` aborts. Persistence across reboot is the only remaining
+  confirmation (v3 ships the complete rule set in `policy.rules`).
+
+Details and the full rule list: `docs/010-axpr-webview-los23-port.md`.
+
+## Upstream context
+
+LineageOS 23.2 for sunfish is frozen: last nightly `20261008` (SDK 36, patch
+level 2026-09-01); `24.0` nightlies start `20261015` (SDK 37, patch level
+2026-10-01). LineageOS does not keep both lines per device. Therefore AXPR23
+cannot receive further upstream security patches and is intentionally closed.
+
+## What stays authoritative for AXPR24
+
+- The LOS→AXP port method (`scripts/009-*.sh`, `apply_009_*.py`).
+- AXP packaging/signing shape (release keys, AVB flags, Magisk preroot).
+- WebView adaptation chain Vanadium → Mulch → AOSmium, the prebuilt module
+  pattern and the provider overlay/RRO lesson.
+- The device-side IME/kernel notes in `docs/009-*`.