009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

specs/008-call-rec-flag-secure/contracts/flag-secure-surface.md

@@ -12,7 +12,7 @@
 | Readback | `adb shell settings get secure disable_secure_windows` |
 | UI preference key | `allow_flag_secure_override` (writes the Secure key above) |
 | Scope | **Global** (all apps); per-app lists not planned |
-| Note | WMS only applies this on **debuggable** builds (`ro.debuggable`) |
+| Note | Stock AOSP gated WMS on `ro.debuggable`; project removes that gate (`SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE`) so `ro.debuggable` stays `0` |
 
 ## Capture behaviour
 

specs/008-call-rec-flag-secure/research.md

@@ -39,8 +39,12 @@ has `Settings.Secure.DISABLE_SECURE_WINDOWS` wired through
 Options switch (preference key `allow_flag_secure_override`) that writes
 `disable_secure_windows`.
 
-**Constraint**: WMS applies the setting only on debuggable builds
-(`ro.debuggable`). LAB `userdebug` is in scope; `user` retest before release.
+**Constraint (stock AOSP)**: WMS applied the setting only on debuggable builds
+(`ro.debuggable`). **Project decision (2026-09-18):** remove that gate in
+`updateDisableSecureWindows()` (`apply_wms_disable_secure_debuggable_gate.py`)
+so ship images keep `ro.debuggable=0` while the DO toggle works. No other
+secondary gate found in `WindowState.isSecureLocked` / `Task.isSecure`.
+LAB `userdebug` with `ro.debuggable=0` was the motivating case.
 
 **Alternatives rejected**: Magisk `services.jar` dex patchers as shipping
 mechanism.