009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

docs/009-us-s4-userspace-hardening.md

@@ -0,0 +1,52 @@
+# US-S4 — Userspace hardening (first stage)
+
+Status 2026-10-02. No bacon solely for this doc.
+
+## Stage 0 — LAB baseline (measure, closed)
+
+On LAB `11231JEC207477` after AVB ship `20261002T103558Z` (+ boot/vbmeta reinforce):
+
+| Check | Result |
+|-------|--------|
+| SELinux | Enforcing |
+| Encryption | `ro.crypto.state=encrypted`, `ro.crypto.type=file` |
+| Verified boot | orange / `flash.locked=0` (unlocked Magisk track) |
+| `security.perf_harden` | 1 (already) |
+| Yama / `ptrace_scope` | **done** (US-S5-1 `162840Z`) — `CONFIG_SECURITY_YAMA=y` |
+
+## Stage 1 — US-S4-1 drop product OpenSSH / rsync / procmem
+
+**Oracle**: `AXP.OS-22.2-20260324-PRO-sunfish.zip` product (+ system) images —
+no `sshd`/`ssh`/`rsync`/`procmem` binaries; orphan `init.openssh.rc` only.
+
+**Shipped in tree**: `vendor/sunfish-a16/hardening.mk` +
+`patches/009-axp-los23-port/hardening/README.md`.
+
+Removes Lineage product OpenSSH binaries + `rsync`, `procmem` (DEBUG).
+**Keeps** `init.openssh.rc` (AXP PRO still has it). Admin path: adb + Magisk.
+
+LAB verify after flash: no `/product/bin/sshd`, no `/product/bin/rsync`,
+`/product/etc/init/init.openssh.rc` present, Magisk still up.
+
+## Stage 2 — US-S4-2 drop Jelly + Gallery2
+
+**Oracle**: AXP PRO product has neither; Fossify on system_ext. See
+`docs/009-axp-pro-product-apps-20260324.md`.
+
+Wired: `apply_009_drop_jelly_gallery2.py`, `NoLineageJelly` phony override,
+hardening.mk filter, bacon gate. Pending next bacon + LAB.
+
+## Later candidates (one per bacon when risk unclear)
+
+1. Mount / noexec where stock sunfish already allows (verify HW first)
+2. Package-visibility / query hardening (high app-compat risk → later)
+3. Further debug-tool trim (`adb_root` only if LAB proves unused)
+
+Promote from `docs/hardening-backlog.md` only with upstream attribution.
+
+## Out of scope here
+
+- `WITH_AVB=true` / flags 0
+- Bootloader relock
+- `lineage_sunfish-user` default lunch (US-S6)
+- Kernel Yama / more CVE (US-S5)