009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

docs/009-fortify-diag-v2-review-20260927.md

@@ -0,0 +1,60 @@
+# Diagnostic v2 review — 2026-09-27
+
+Reviewed local `apply_fortify_diag.py` and generated remote
+`kernel/axp_diag_capture.c` with attempt `20260927T083401Z`, while the plain-v2
+control build was running. No live sources or build jobs were changed.
+
+The direction is useful: record before printing, include event/caller/build
+identifier, and validate SysRq-c without first writing SysRq-x. However, this
+implementation is not yet a validated early-boot recorder.
+
+## Required corrections
+
+1. **Do not map from the failure handler.** `axp_diag_mark_event` calls
+   `axp_diag_map`, which calls ordinary `ioremap` if no mapping exists. This
+   reintroduces mapping in panic/early context. In this tree ARM64 ioremap uses
+   `get_vm_area_caller` and `ioremap_page_range`; mm_init initializes the slab
+   allocator and vmalloc. Mapping after successful mm_init is a reasonable
+   later-stage control, but the failure handler must not try to compensate for
+   an earlier failure with that same ordinary mapping path.
+
+2. **The previously identified early interval is still uncovered.** Remote
+   `init/main.c` calls setup_arch at 565 and parse_early_param at 579; mm_init
+   and the new hook are at 600–604. A successful late SysRq test does not
+   validate a failure in either earlier function or inside mm_init itself.
+
+3. **First-failure retention is not guaranteed.** `axp_first_done` is a plain
+   integer tested before recording and set only after the writes. Concurrent
+   CPUs or recursion can both pass the test. The event writer does not inspect
+   an existing persistent record, despite the stated promise to preserve one;
+   only the milestone writer does. Use a deliberate atomic/reentrancy protocol
+   and an explicit policy for records from previous boots. A build timestamp
+   distinguishes builds, not repeated attempts with the same image.
+
+4. **Milestone format contains an embedded NUL.** The literal `AXPDIAG0,M,`
+   is 10 characters, but memcpy copies 11 and advances by 11. This copies the
+   string terminator before the attempt identifier. Consequently `strings |
+   grep AXPDIAG0` loses the attempt/stage from the same line. Use the literal's
+   length excluding its terminator (for example sizeof(literal)-1).
+
+## Validation scope
+
+A complete new `C` record surviving the actual combo4 recovery sequence would
+be useful evidence for late panic capture. It would not establish early-boot
+coverage. Require the exact expected identifier and complete record; define
+how previous records are archived/cleared before repeating the same image.
+Keep the first failure separate from milestones and subsequent notifier events.
+
+The capture implementation still includes linux/string.h and memcpy calls;
+verify the final ARM64/LTO generated writer does not depend on the FORTIFY
+failure path under test. `no_sanitize("cfi")` alone does not disable FORTIFY.
+
+Do not interpret an empty capture from this v2 as proof against fortify_panic.
+
+## Status
+
+Local `apply_fortify_diag.py` updated to **v3** addressing items 1–4
+(no map-from-handler; early+perm maps in `setup_arch`; atomic latch + durable
+head check; milestone `sizeof(lit)-1`). Residual pre-`early_map` blind spot
+remains documented in the capture plan. plain-v2 build is obsolete — rebuild
+control as plain-v3 before flash.