009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

specs/008-call-rec-flag-secure/research.md

@@ -39,8 +39,12 @@ has `Settings.Secure.DISABLE_SECURE_WINDOWS` wired through
 Options switch (preference key `allow_flag_secure_override`) that writes
 `disable_secure_windows`.
 
-**Constraint**: WMS applies the setting only on debuggable builds
-(`ro.debuggable`). LAB `userdebug` is in scope; `user` retest before release.
+**Constraint (stock AOSP)**: WMS applied the setting only on debuggable builds
+(`ro.debuggable`). **Project decision (2026-09-18):** remove that gate in
+`updateDisableSecureWindows()` (`apply_wms_disable_secure_debuggable_gate.py`)
+so ship images keep `ro.debuggable=0` while the DO toggle works. No other
+secondary gate found in `WindowState.isSecureLocked` / `Task.isSecure`.
+LAB `userdebug` with `ro.debuggable=0` was the motivating case.
 
 **Alternatives rejected**: Magisk `services.jar` dex patchers as shipping
 mechanism.