009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

docs/009-lab-acceptance-20261002-uss4.md

@@ -0,0 +1,27 @@
+# LAB acceptance — 20261002T151944Z (US-S4-1 + Pro branding)
+
+Device: `11231JEC207477`  
+Artifact: `20261002T151944Z-axp-stage1-combo4-cve-hi-releasekeys`  
+Ship: `AXP-Resurection-Pro-23.2-20261002-sunfish.zip`
+
+Sideload + boot/vbmeta/dtbo reinforce 2026-10-02 evening. Owner/ChatGPT artifact
+gates + LAB post-boot checks below.
+
+| Gate | Status | Notes |
+|------|--------|-------|
+| A Boot/HW | pass | `sys.boot_completed=1`, slot `_a` |
+| B Google stack | pass (prior) | microG/Phonesky unchanged this bacon |
+| C Toggles | pass (prior) | Not regressed |
+| D Magisk | pass | `magiskd` pid present; TF Magisk boot reinforced |
+| E Banking | deferred | |
+| F Usability | pass (prior) | |
+| G Hardening | pass (this pack) | AVB **signing** infra flags=3; US-S4-1 OpenSSH/rsync/procmem absent; `init.openssh.rc` present (AXP) |
+
+Props:
+- `ro.lineage.version=23.2-20261002-UNOFFICIAL-AXP-Resurection-Pro-sunfish`
+- `ro.axp.resurection.track=pro`
+- `ro.boot.flash.locked=0`
+- no `/product/bin/sshd`, no `/product/bin/rsync`
+- `/product/etc/init/init.openssh.rc` present
+
+Prior AVB-only ship note: `docs/009-lab-acceptance-20261002-avb.md` (`103558Z`).