009: publish AXPR23 final source and public documentation

docs/009-kernel-hardening-map.md

@@ -245,6 +245,39 @@ against Kconfig `depends on` before flipping.
   IDs); Lineage rarely matches AXP here.
 - **Flash**: owner on return; agent does not need to flash for this phase.
 
+## 2026-10-16 cgroup and dirty-source audit
+
+The 20261016 GOLDEN build reports a cgroup v2 mount, but the kernel exposes no
+v2 controllers at the root. `/proc/cgroups` also lacks `memory` and `pids`, and
+the log contains:
+
+```text
+Activation of cgroup controller +memory failed ... Invalid argument
+```
+
+The source Kconfig has independent `MEMCG` and `CGROUP_PIDS` options, but the
+ship defconfig does not enable either. This is a real kernel configuration gap,
+not an Android app issue. `lmkd` still works through the legacy low-memory path,
+so it is not an immediate boot blocker, but Android 16 UID memory isolation is
+incomplete.
+
+Do not flip these options directly in the current ship tree. A candidate must
+be built in a disposable clean worktree, retain `SLAB_FREELIST_RANDOM=y`, Yama
+unset, `USERFAULTFD` off and all existing ship patches, then be checked for:
+
+1. boot and USB/ADB recovery;
+2. cgroup v2 `memory`/`pids` controller availability and UID activation;
+3. lmkd behavior, memory pressure, camera, media, radio, Wi-Fi and Bluetooth;
+4. kernel module ABI and vendor SPL compatibility.
+
+The current host kernel is also intentionally patched in place: 503 modified
+paths contain the Stage1/CVE/hardening result, and 13 untracked `*.orig` patch
+backups remain. That is why `uname` ends in `-dirty`. Do not delete or reset
+those files in the canonical tree. A future final bacon should use a disposable
+worktree with patch provenance recorded and no `.orig` residue, or explicitly
+document why the generated kernel is accepted as dirty. The current 20261016
+artifact remains the rollback/reference build until that decision is made.
+
 ## 2026 catalog refresh (started 2026-09-19)
 
 CIP `kernel-sec` cloned at `/srv/rom/references/cip-kernel-sec` @ `025be706`