009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

specs/009-axp-los23-port/research.md

@@ -111,15 +111,140 @@ Document impossible-on-sunfish gaps rather than silent omit.
 **Alternatives considered**: Defer all of `011`–`013` — rejected by owner.
 One mega-commit everything — rejected (attribution / bisect).
 
-## Decision: Banking workflow = GOLDEN Magisk DenyList + Island
+## Decision: Release keys yes; bootloader lock no (2026-09-29)
 
-**Decision**: Restore constitution banking steps with **Magisk DenyList**
-(not KSU profiles) + Island: Aurora install → do not open → DenyList → clone
-to Island → first launch in Island. Swissquote PASS hard gate; Yuh honest vs
-GOLDEN attestation FAIL.
+**Decision**:
+
+1. **Sign with definitive / project release keys** — required for Gate G
+   userspace. Move off AOSP test-keys for ship images/OTAs; keep Phonesky and
+   update identity on that key. Keys live only on `rom-dev01`
+   (`/srv/rom/secrets/`), never in the laptop Git tree.
+2. **Do not pursue bootloader relock** as a ship goal. AXP and LineageOS do
+   not lock the bootloader as their normal product path; Magisk preroot and
+   recovery sideload assume unlocked. IOdes-style locked bootloader is an
+   explicit non-goal for this track.
+
+**Rationale**: Clone AXP/LOS norms; avoid a locked-device model that fights
+Magisk EXTENDROM preroot. Signing still matters for update trust and
+PRESIGNED / same-identity sideload.
+
+**Alternatives considered**: IOdes-class locked AVB ship — rejected by owner
+(2026-09-29). Skip release keys entirely — rejected (Gate G / FR signing).
+
+## Decision: Banking workflow deferred (owner future)
+
+**Decision (2026-09-17)**: Banking / Island / Swissquote / Yuh validation is
+**deferred**. Not an MVP acceptance gate. Magisk DenyList-class capability
+still ships (general). Owner may resume US3 later.
+
+**Rationale**: Owner wants updated AXP clone (features, options, hardening,
+security, kernel) first; banks are a personal future problem.
+
+**Alternatives considered**: Keep Swissquote as hard gate — rejected by owner.
+
+## Decision: Updated hardened LOS23 sunfish kernel (FR-017)
+
+**Decision (refined 2026-09-18):** Ship current LineageOS 23.2–compatible
+`sunfish` kernel (`msm-4.14`) with attributable hardening. **Not** an
+unrelated Graphene A13 / stock prebuilt as base. Record applied/skipped list
+in `docs/009-kernel-hardening-map.md`.
+
+**Source priority (owner):**
+
+1. **AXP** — maximum priority; clone their sunfish kernel hardening first
+   (build sources / OTA oracle / GOLDEN). Inherited Divest-era commits that
+   already live *inside* the AXP stack are fine as part of that clone; do
+   **not** separately mine DivestOS EOL trees.
+2. **LOS 23.2** — inventory what the lineage kernel already has; avoid
+   duplicate work.
+3. **IodéOS** — LOS fork, more hardened/deblobbed; clone sources on
+   `rom-dev01` and diff for 4.14-safe ideas worth porting.
+4. **GrapheneOS** — optional extras only when they make sense on non-GKI
+   4.14 sunfish: prefer portable techniques from modern Pixel kernels /
+   docs; historical sunfish A13 patches only if still clearly valuable.
+   Do **not** treat GOS A13 sunfish tree as the base.
+
+**Out of hunt:** DivestOS as a separate research target (EOL).
+
+**Rationale**: AXP-first resurrection; GOS/Iodé as additive; honest skips on
+4.14.
+
+**Inventory (2026-09-18):** LOS `msm-4.14` @ `28f9290ae067` (`4.14.357-openela`).
+AXP `kernel_patches` @ `df3cab2155b3` on host. Graphene/AH sequential probe:
+OK=30 / SKIP_ALREADY=4 / FAIL=12. Iodé `v5-staging` manifest has no sunfish
+4.14 kernel fork. Stage 1 allowlist + apply script under
+`vendor/sunfish-a16/patches/009-kernel-hardening/`. CVE mega deferred.
+Ledger: `docs/009-kernel-hardening-map.md`.
+
+## Decision: Location / localization hardening — do not extra-cap (FR-018)
+
+**Decision (2026-09-18):** For this Magisk track, **do not** port AXP-class
+aggressive location lockdown (kernel or userspace) beyond stock LOS 23.2
+defaults. No “non-hardening location” Settings toggle for MVP — that is
+extra product surface; simpler and matches owner GPS frustration to **leave
+LOS location behaviour**. FR-018 compare doc may still note what AXP did,
+for later curiosity, without shipping those caps.
+
+**Alternatives considered**: (1) Clone AXP location caps — rejected (slow /
+frustrating fixes). (2) Owner toggle to disable caps — deferred; only if
+LOS defaults prove insufficient and owner asks later.
+
+
+## Decision: Bundled store client = Droidify; no NeoLauncher
+
+**Decision (2026-09-17):** Ship **Droidify** as the F-Droid-class client
+instead of stock F-Droid (lighter; many repos by default). Do **not**
+integrate NeoLauncher — keep LOS Launcher3. Aurora remains for Play-sideload
+workflow.
+
+## Decision: No AXP external repos / OTA servers
+
+**Decision:** Do not wire AXP market/F-Droid remote repos or AXP OTA update
+endpoints. AXP infra is EOL / servers down — no product sense. Periodic
+system-package refresh is **owner sideload** (FR-019), not network OTA.
+
+## Decision: Sideloadable system package refreshes (FR-019)
+
+**Decision (2026-09-17):** Final ROM MUST keep **microG**, **Magisk**,
+**project Phonesky**, and other bundled system/privileged apps
+**updateable without full reflash**, on a ~**2–3 month** cadence the owner
+drives. Prefer PackageManager-compatible sideload (same signing identity;
+PRESIGNED microG; continuous project key for Phonesky). Magisk: document
+manager self-update and/or recovery/boot re-patch when APK sideload alone is
+not enough. Deliver a short recovery/sideload runbook before ship; do **not**
+reintroduce AXP OTA.
+
+## Decision: Private DNS + Internet connectivity (sans axp.os)
+
+**Decision:** Port AXP-class **Private DNS** provider presets. Keep AXP-class
+**Internet connectivity** / special INTERNET permission behaviour where it
+still fits LOS 23.2, but strip any hard dependency on `axp.os` branding or
+endpoints.
+
+## Decision: Restore Disable app on Android 16
+
+**Decision:** Investigate and re-expose classic **Disable application** UX on
+A16/LOS23 where Archive replaced or hid it. Owner prefers Disable over
+Archive. Exact Settings/PackageManager patch path TBD from AXP/LOS delta
+research — must remain attributable and reversible.
+
+## Decision: AXP build sources as compile oracle
+
+**Decision:** On `rom-dev01`, prefer cloning/checking out AXP **build** +
+EXTENDROM (and axpos.org developer building docs already mirrored under
+`/srv/rom/references/axp/archive/`) to see how Magisk preroot / product packages
+are wired — before treating GOLDEN `adb` as the compile guide. GOLDEN stays the
+runtime compatibility oracle.
+
+**Decision**: Do **not** freeze localization/location lockdown policy in this
+feature’s acceptance. Later compare how much AXP “capea” location vs stock
+LOS (owner historically complains AXP is aggressive). Until then, avoid
+inventing extra location lockdown beyond what the clone already implies;
+matrix row = deferred.
+
+**Alternatives considered**: Blind-copy all AXP location patches now —
+rejected (owner wants a deliberate compare first).
 
-**Alternatives considered**: Rootless-only banking gate — incomplete vs AXP.
-Insular rename — GOLDEN runs Island.
 
 ## Decision: Version freshness policy