009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

specs/009-axp-los23-port/plan.md

@@ -6,11 +6,13 @@
 
 ## Summary
 
-Resurrect **AXP.OS Pro on LOS22 / GOLDEN** as a single shippable LineageOS
-23.2 / Android 16 `sunfish` ROM on **LAB**: vanilla `003` base + full AXP
-capability set (Google stack, selectable spoofing, Island banking workflow,
-selectable call-recording unlock, Magisk like GOLDEN, bundled usability apps,
-GOLDEN-class hardening/signing/AVB posture).
+Resurrect **AXP.OS Pro on LOS22 / GOLDEN** as an **updated AXP-class clone**
+on LineageOS 23.2 / Android 16 `sunfish` (**LAB**): vanilla `003` base + AXP
+capability set (Google stack, selectable spoofing, selectable call-recording
+unlock, Magisk like GOLDEN, bundled usability apps / options surface,
+GOLDEN-class userspace hardening/signing/AVB, **updated hardened sunfish
+kernel**). **Banking/Island/Swissquote validation deferred** (owner future).
+**Localization hardening AXP-vs-LOS compare deferred** (FR-018).
 
 **Explicit exceptions:** LOS23 WebView default (Aosmium EOL) with unlocked
 provider chooser; Phonesky = project's recent patched artifact (reconsider if
@@ -22,7 +24,9 @@ packaging where they already match; replace the KernelSU ship path with
 AXP-style Magisk preinstall (newest Magisk); pin newest stable microG and
 bundled apps; keep Phonesky on the existing host pipeline; measure Magisk
 “preinstalled but not fully activated” behaviour on GOLDEN before freezing LAB
-setup docs.
+setup docs; port attributable kernel hardening onto current LOS23 sunfish
+kernel; stage userspace hardening; leave location-policy compare for later.
+
 
 ## Technical Context
 
@@ -88,7 +92,7 @@ specs/009-axp-los23-port/
 │   ├── magisk-preinstall.md
 │   ├── webview-surface.md
 │   └── acceptance-gates.md
-└── tasks.md                # /speckit-tasks (not this command)
+└── tasks.md                # /speckit-tasks (generated)
 ```
 
 ### Host + tree