009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

specs/009-axp-los23-port/quickstart.md

@@ -49,29 +49,31 @@ adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
 3. Configure DenyList-class hide for a banking package **before** first open.
 4. Save Magisk version + screenshots under `…/magisk/`.
 
-## 4. Banking (Gate E)
+## 4. Banking (Gate E) — deferred
 
-1. Aurora → install Swissquote → **do not open**.
-2. DenyList → Island clone → first launch in Island → login.
-3. Repeat attempt for Yuh; classify PASS / attestation-like-GOLDEN /
-   packaging regression.
-4. Confirm banks lack root.
+Skip for MVP. Owner future. Magisk DenyList can still be smoke-tested with a
+non-bank test package under Gate D.
 
 ## 5. Usability + WebView (Gate F)
 
 1. Confirm bundled categories vs pin record.
 2. `adb shell cmd webviewupdate current` → LOS default; chooser still listed.
 
-## 6. Hardening / signing class (Gate G)
+## 6. Hardening / signing + kernel (Gate G)
 
-1. Run the hardening/signing checklist defined for this build stage.
-2. Any missing GOLDEN-class item → written impossible/gap note (no silent
+1. Userspace: follow `docs/009-hardening-signing-checklist.md` (release keys;
+   unlocked AVB; no bootloader lock).
+2. Kernel: `docs/009-gate-g-kernel-attribution.md` (Stage1+combo4+FORTIFY).
+2. Record kernel rev + hardening patches applied/skipped (FR-017).
+3. Any missing GOLDEN-class item → written impossible/gap note (no silent
    skip).
+4. Do **not** block on localization AXP-vs-LOS compare (FR-018 later).
 
 ## Pass criteria
 
 All boxes in [acceptance-gates.md](./contracts/acceptance-gates.md) for the
-claimed stage. Full resurrection acceptance = Gates A–G.
+claimed stage **except Gate E** (deferred). Full clone acceptance for current
+owner priority = Gates A–D + F–G.
 
 ## Notes
 
@@ -79,3 +81,4 @@ claimed stage. Full resurrection acceptance = Gates A–G.
 - Call-recording legality is the user’s responsibility.
 - If project Phonesky misbehaves vs GOLDEN needs → stop and reconsider; do
   not accept Gate B.
+- Localization hardening compare is explicitly postponed.