009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

docs/009-lab-acceptance-20261002-avb.md

@@ -0,0 +1,22 @@
+# LAB acceptance note — 20261002T103558Z (AVB infra ship)
+
+Device: `11231JEC207477`  
+Artifact: `20261002T103558Z-axp-stage1-combo4-cve-hi-releasekeys`  
+Ship zip twin: `AXP-Resurection-Pro-23.2-20261002-sunfish.zip` (= lineage zip bytes)
+
+
+Owner smoke 2026-10-02: no errors reported after sideload + boot/vbmeta reinforce.
+
+| Gate | Status | Notes |
+|------|--------|-------|
+| A Boot/HW | pass (owner) | Boots home; Wi‑Fi/BT/call smoke OK per owner |
+| B Google stack | pass (prior+owner) | microG/Phonesky path unchanged this bacon |
+| C Toggles | pass (prior) | Spoof / call-rec not regressed this bacon |
+| D Magisk | pass | `magiskd` present; preroot; unlocked orange |
+| E Banking | deferred | Not MVP |
+| F Usability | pass (prior) | Bundled apps / WebView LOS |
+| G Hardening | partial | Release-keys + AVB **signing** infra (flags 3); US-S4 stage0 measure done; US-S4-1 code pending next content bacon |
+
+`ro.lineage.version` on this flash is still `23.2-20261002-UNOFFICIAL-sunfish`
+(pre-branding.mk). Next content bacon picks up
+`…-UNOFFICIAL-AXP-Resurection-Pro-…`.