009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

docs/hardening-backlog.md

@@ -55,31 +55,32 @@ Status: `candidate` | `investigate` | `accepted→spec` | `rejected` | `los-prov
 
 The kernel base remains the LineageOS 23.2-compatible sunfish kernel.
 
+**Priority (009 / owner 2026-09-18):** AXP clone first → LOS inventory →
+IodéOS diff → optional Graphene (modern techniques / selective A13).
+**Do not** separately mine DivestOS EOL. See `docs/009-kernel-hardening-map.md`.
+
 ```text
-                         ┌─ historical GOS sunfish
+                         ┌─ AXP sunfish (max priority clone)
                          │
-LOS23/A16 sunfish 4.14 ←─┼─ AXP own + DivestOS
+LOS23/A16 sunfish 4.14 ←─┼─ LOS23 already-present
       OUR BASE           │
-                         ├─ modern GOS techniques
+                         ├─ IodéOS (LOS fork, hardened/deblobbed)
                          │
-                         └─ original upstream fixes
+                         └─ Graphene optional (modern / selective A13)
 ```
 
 **Not:** GrapheneOS Android 13 (or any old GrapheneOS) kernel tree as our base.
+**Not:** DivestOS as a hunt target (EOL).
 
-Candidate hardening comes from four classes:
+Candidate hardening comes from:
 
-1. **Historical GrapheneOS sunfish** — device-specific patches/configuration known
-   to have run on sunfish (real commits, not only `.config`).
-2. **AXP.OS / DivestOS sunfish** — audit the actual patch stack; distinguish
-   AXP-owned changes from inherited changes.
-3. **Modern GrapheneOS** — use current kernel hardening as a source of
-   techniques/security properties; adapt/backport only where feasible on
-   non-GKI Linux 4.14; do not assume current Pixel kernel patches cherry-pick
-   cleanly.
-4. **Original upstream** — where a GrapheneOS/AXP/Divest patch derives from AOSP,
-   Android common, Linux stable, or another upstream source, prefer the
-   appropriate original upstream fix when practical.
+1. **AXP.OS sunfish** — primary; audit actual patch stack on `rom-dev01`.
+2. **LineageOS 23.2 msm-4.14** — what is already applied.
+3. **IodéOS** — diff vs LOS for extra hardening/deblob worth porting.
+4. **GrapheneOS** — optional: modern Pixel techniques adaptable to 4.14;
+   historical sunfish A13 only if clearly still valuable.
+5. **Original upstream** — when a patch derives from Linux/AOSP common,
+   prefer upstream form when practical.
 
 For each candidate record:
 
@@ -96,6 +97,10 @@ For each candidate record:
 - test result;
 - final decision.
 
+**Location:** do not extra-cap vs LOS (owner GPS UX); skip AXP location
+lockdown in this track unless revisited later.
+
+
 ## Much later / evaluate
 
 | Idea | Notes | Status |