009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

docs/009-magisk-preinstall-runbook.md

@@ -0,0 +1,111 @@
+# 009 Magisk preinstall runbook (AXP / GOLDEN class)
+
+**Device roles**: GOLDEN `11071JEC203839` = `adb` **read-only** oracle.  
+LAB `11231JEC207477` = flash/test only. **Never** flash or Magisk-change GOLDEN.
+
+**Evidence**: `/srv/rom/artifacts/009-axp-los23-port/`  
+**Contract**: `specs/009-axp-los23-port/contracts/magisk-preinstall.md`
+
+## Ship policy (owner 2026-09-17)
+
+- **Clone AXP first (mandatory):** Magisk packaging = EXTENDROM
+  `EXTENDROM_PREROOT_BOOT` method. Copy that flow; do **not** invent alternate
+  Magisk install paths. Only diverge if LOS23 / Magisk version breaks the
+  AXP/EXTENDROM path, and document why.
+- **Magisk clean**: ship Magisk preroot only — **do not** bake GOLDEN modules
+  (`playintegrityfix`, `teesim`, `hosts`, `flag-secure-disabler`,
+  `zygisk_vector`, …). Owner installs modules later if wanted.
+- **Manager UI**: stock **Magisk** upstream (not Magia branding).
+- **Dormant until activation (AXP Pro):** after flash, Magisk is pre-rooted in
+  boot but root must stay inactive until the user opens Magisk and completes
+  Additional Setup. Skipping setup ⇒ no `su` / no Magisk binaries in the OS
+  (undetectable). Do **not** bake Magisk as `PRODUCT_PACKAGE`; do **not**
+  sideload the full Magisk APK before measuring virgin LAB state.
+- **Build host**: LAB/GOLDEN USB **not required** to compile. Phones only for
+  measurement (GOLDEN `adb`) or flash validation (LAB).
+
+## GOLDEN measurement (2026-09-17, live `adb`)
+
+| Item | Value |
+|------|--------|
+| Build | `22.2-2026.003-sunfish-pro` / `BP1A.250505.005` |
+| Magisk binary | **29.0:MAGISK:R** (`29000`) at `/system_ext/bin/magisk` |
+| Also present | `/system_ext/bin/magiskpolicy` |
+| Runtime | `/data/adb/magisk/` full toolkit + `stub.apk`; `magisk.db` |
+| Settings (sqlite via `magisk --sqlite`) | `zygisk=1`, `denylist=1`, `mnt_ns=2`, `bootloop=0` |
+| Manager UI | Magisk app **hidden/renamed** (random pkg `oq.aq.cjn`, `versionName=1.0`) — AXP brands this UI as **Magia** in docs/screenshots; package name is not stable after “Hide the Magisk app” |
+| Modules seen | `flag-secure-disabler`, `hosts`, `playintegrityfix`, `teesim`, `zygisk_vector` |
+| Secure toggles | `allow_signature_fake=1`, `extendrom_call_recording=1` |
+
+**Important:** GOLDEN is already **fully activated**. The virgin
+“preinstalled but not fully activated” UX is the **first-boot / additional
+setup** Magisk flow after an AXP-style preroot image (see AXP setup guide +
+EXTENDROM FAQ: “Requires Additional Setup”). Measure that class from AXP docs +
+EXTENDROM `PREINITDEVICE=userdata` behaviour — do not wipe GOLDEN to re-see it.
+
+## How AXP / EXTENDROM builds Magisk into the ROM
+
+Attribute: **sfX-android `android_vendor_extendrom`** + Magisk APK.
+
+1. `EXTENDROM_PREROOT_BOOT=true` — Magisk is **not** a normal PRODUCT_PACKAGE;
+   it patches **boot / init_boot** at image build time.
+2. Magisk APK (v22+) is unzipped under `out/.magisk/`; `boot_patch.sh` runs via
+   `vendor/extendrom/config/magisk/patch.sh`.
+3. Releasetools inject: patch under
+   `config/magisk/{lineage|axp}/A{version}/0001-build_make_tools_releasetools_common.py`
+   hooks `common.py` `_BuildBootableImage` / prebuilt boot.
+4. Patcher env of note: `KEEPVERITY=true`, `KEEPFORCEENCRYPT=true`,
+   `PREINITDEVICE=userdata`, `BOOTMODE=false`.
+5. Post-flash **virgin**: stub may appear; `/system_ext/bin/magisk` and `su`
+   appear only **after** user activation (AXP FAQ “Revert Magisk activation”).
+   Measure virgin before opening Magisk. GOLDEN already activated is not virgin.
+
+Host reference tree: `/srv/rom/references/extendrom/` on `rom-dev01`.
+
+## Enable Magisk on next bacon (009)
+
+```bash
+export ANDROID_BUILD_TOP=/srv/rom/src/lineage
+export OUT_DIR=/srv/rom/src/lineage/out   # or /srv/rom/out-009 for parallel
+export SUNFISH_A16_MAGISK_PREROOT=1
+# Copy staged runtime into OUT (or re-run prepare):
+#   rsync -a /srv/rom/prebuilts/magisk/runtime/ "$OUT_DIR/.magisk/"
+# or: MAGISK_STAGE_DIR=$OUT_DIR/.magisk vendor/sunfish-a16/magisk/prepare_magisk.sh
+```
+
+Hook is already in `build/make/tools/releasetools/common.py` but **no-ops** unless
+`SUNFISH_A16_MAGISK_PREROOT=1` (008 in-flight stays safe).
+
+1. Clean-flash LAB with Magisk-preroot `009` images (wipe `/data` if LAB had
+   Magisk activated before).
+2. **Virgin check (before opening Magisk):**
+   `adb shell 'which su; which magisk; ps -A | grep magiskd'` — expect no `su`,
+   no Magisk binaries (AXP dormant). Record under `…/magisk/pre-activation.md`.
+3. Open Magisk stub → download/install full Magisk if prompted → complete
+   **Additional setup** → reboot (AXP setup guide).
+4. Confirm `magisk -v` matches pin (target: newest workable stable; host aims
+   at **v30.7** unless regression).
+5. Enable Zygisk + DenyList as needed.
+6. For DenyList smoke (MVP): hide a **non-bank test package** before first open.
+7. Banking DenyList workflow = **deferred** (US3 / Gate E).
+
+## Optional KernelSU recycle (FR-016)
+
+Paths under `/srv/rom/artifacts/007-*/` — debug/reference only. **Not ship.**
+Never gate Magisk acceptance on KSU.
+
+**Hard rule for Magisk LAB:** `sunfish_defconfig` must keep `# CONFIG_KSU is not
+set` (and SusFS off). Magisk + in-kernel ReSukiSU/KSU on the same boot causes
+app `failed to attach` / `start timeout` and hung `su`.
+
+**Full AXP-clone bacon (detached):**  
+`/srv/rom/artifacts/009-axp-los23-port/scripts/009-bacon-axp.sh`  
+session `009-bacon-axp` — Magisk preroot + noksu + Phonesky exact-alarm +
+WMS FLAG_SECURE (no `ro.debuggable` gate). After zip sideload, flash
+artifact `boot.img` (TF IMAGES) to both slots.
+
+## Staged known-good images (FR-013)
+
+Keep prior LAB flashables + SHA-256 under
+`/srv/rom/artifacts/009-axp-los23-port/<build-id>/` before each risky Magisk or
+hardening stage.