009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/patches/008-call-rec-flag-secure/README.md

@@ -10,9 +10,11 @@ python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_f
 
 - **Call recording**: EXTENDROM `er.sh` F_CALLREC / AXP GOLDEN
   (`extendrom_call_recording`). steadfasterX EXTENDROM.
-- **FLAG_SECURE**: AOSP `Settings.Secure.DISABLE_SECURE_WINDOWS` already
-  wired in `WindowManagerService` on A16; DO preference
-  `allow_flag_secure_override` writes that key.
+- **FLAG_SECURE**: AOSP `Settings.Secure.DISABLE_SECURE_WINDOWS` + DO
+  preference `allow_flag_secure_override`. Stock WMS only applies the
+  setting when `ro.debuggable=1`; we remove that gate via
+  `apply_wms_disable_secure_debuggable_gate.py` so ship images keep
+  `ro.debuggable=0` while the toggle still works.
 
 ## Touched paths
 
@@ -24,9 +26,15 @@ python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_f
 | Settings controllers | `…/ER_CallRec*.java`, `…/FlagSecureOverride*.java` |
 | Settings DO XML + strings | `res/xml/development_settings.xml`, `res/values/strings.xml` |
 | Dashboard | `DevelopmentSettingsDashboardFragment.java` |
-| Capture path | stock WMS `disable_secure_windows` (no extra WM patch) |
+| Capture path | WMS `updateDisableSecureWindows()` — **no** `ro.debuggable` gate |
+| WMS apply | `apply_wms_disable_secure_debuggable_gate.py` |
+
+```bash
+python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
+```
 
 Backups: `/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots/`  
-Marker: `SUNFISH_A16_008_CALL_REC_FLAG_SECURE`
+Markers: `SUNFISH_A16_008_CALL_REC_FLAG_SECURE`,
+`SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE`
 
 See `docs/008-call-rec-flag-secure-runbook.md`.

vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py

@@ -5,16 +5,18 @@ Call recording (AXP GOLDEN / EXTENDROM F_CALLREC):
 - Settings.Secure.ER_ALLOW_ANY_CALL_REC = \"extendrom_call_recording\"
 - DO switch + Dialer CallRecorder.canRecordInCurrentCountry early-return
 
-FLAG_SECURE (AOSP A16 already implements WM path):
+FLAG_SECURE (AOSP A16 WM path + project WMS gate removal):
 - DO switch writes Settings.Secure.DISABLE_SECURE_WINDOWS
-  (\"disable_secure_windows\"). WindowManagerService.updateDisableSecureWindows()
-  already honours it on debuggable builds (LAB userdebug).
+  (\"disable_secure_windows\").
+- Also run apply_wms_disable_secure_debuggable_gate.py so WMS honours the
+  setting with ro.debuggable=0 (stock AOSP required debuggable).
 
 Attribution: EXTENDROM (steadfasterX) for call-rec; AOSP DISABLE_SECURE_WINDOWS
-for capture; sunfish-a16 DO wiring.
+for capture; sunfish-a16 DO + WMS gate wiring.
 
 Run on rom-dev01:
   python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py
+  python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
 """
 from __future__ import annotations
 
@@ -125,8 +127,9 @@ public class ER_CallRecInfo extends DeveloperOptionsPreferenceController
 
 FLAG_SECURE_CTRL = """/*
  * sunfish-a16-rom ({marker}): Developer Options gate for AOSP
- * Settings.Secure.DISABLE_SECURE_WINDOWS (WindowManagerService already
- * honours this on debuggable builds).
+ * Settings.Secure.DISABLE_SECURE_WINDOWS. Pair with
+ * apply_wms_disable_secure_debuggable_gate.py so WMS honours the setting
+ * when ro.debuggable=0.
  */
 
 package com.android.settings.development;
@@ -406,8 +409,8 @@ def patch_strings() -> None:
     <!-- {MARKER}: FLAG_SECURE override (writes AOSP disable_secure_windows) -->
     <string name="flag_secure_override_category">Secure window screenshots</string>
     <string name="allow_flag_secure_override">Allow screenshots of secure windows</string>
-    <string name="allow_flag_secure_override_summary">When enabled, apps that set FLAG_SECURE can still be captured by the system screenshot / screen record paths (debuggable builds). Weakens app privacy.</string>
-    <string name="allow_flag_secure_override_details">Writes Settings.Secure.disable_secure_windows. On userdebug/eng, WindowManager treats FLAG_SECURE windows as capturable. Default OFF restores stock secure-window behaviour.</string>
+    <string name="allow_flag_secure_override_summary">When enabled, apps that set FLAG_SECURE can still be captured by the system screenshot / screen record paths. Weakens app privacy. Does not change ro.debuggable.</string>
+    <string name="allow_flag_secure_override_details">Writes Settings.Secure.disable_secure_windows. WindowManager treats FLAG_SECURE windows as capturable while this is ON (project build; ro.debuggable stays 0). Default OFF restores stock secure-window behaviour.</string>
 """
     text = text.replace("</resources>", add + "</resources>", 1)
     path.write_text(text)
@@ -458,6 +461,17 @@ def verify_dialer_config() -> None:
         print("Dialer config.xml: call_recording_audio_source=4 (OK)")
 
 
+def apply_wms_gate() -> None:
+    """Invoke sibling script that drops the ro.debuggable gate in WMS."""
+    import subprocess
+    import sys
+
+    sibling = Path(__file__).resolve().parent / "apply_wms_disable_secure_debuggable_gate.py"
+    r = subprocess.run([sys.executable, str(sibling)], check=False)
+    if r.returncode != 0:
+        raise SystemExit(f"WMS disable-secure gate apply failed: {r.returncode}")
+
+
 def main() -> None:
     if not TREE.is_dir():
         raise SystemExit(f"LOS tree missing: {TREE}")
@@ -475,6 +489,7 @@ def main() -> None:
     patch_development_xml()
     patch_dashboard()
     verify_dialer_config()
+    apply_wms_gate()
     print("done:", MARKER)
 
 

vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Remove AOSP ro.debuggable gate on Settings.Secure.DISABLE_SECURE_WINDOWS.
+
+LOS 23.2 / A16 WindowManagerService.updateDisableSecureWindows() returns early
+unless SystemProperties.getBoolean(\"ro.debuggable\") is true. That blocks the
+Developer Options toggle on builds that keep ro.debuggable=0 (including this
+project's LAB image labelled userdebug).
+
+This patch removes ONLY that gate. Behaviour:
+  disable_secure_windows=0 → stock FLAG_SECURE (mDisableSecureWindows=false)
+  disable_secure_windows=1 → mDisableSecureWindows=true; isSecureLocked()/Task.isSecure()
+                              honour the override (no second debuggable check elsewhere)
+
+Does NOT change ro.debuggable, Build.IS_DEBUGGABLE, ViewServer, or screen-share
+protections (DISABLE_SCREEN_SHARE_PROTECTIONS_FOR_APPS_AND_NOTIFICATIONS).
+
+Audit (LOS23 frameworks/base, 2026-09-18): sole gate is updateDisableSecureWindows();
+WindowState.isSecureLocked / Task.isSecure only call getDisableSecureWindows().
+
+Run on rom-dev01:
+  python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/\\
+      apply_wms_disable_secure_debuggable_gate.py
+"""
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+TREE = Path("/srv/rom/src/lineage")
+MARKER = "SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE"
+BAK_ROOT = Path("/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots")
+WMS = (
+    TREE
+    / "frameworks/base/services/core/java/com/android/server/wm/"
+    "WindowManagerService.java"
+)
+
+OLD = """        void updateDisableSecureWindows() {
+            if (!SystemProperties.getBoolean(SYSTEM_DEBUGGABLE, false)) {
+                return;
+            }
+
+            boolean disableSecureWindows;
+"""
+
+NEW = f"""        void updateDisableSecureWindows() {{
+            // {MARKER}: honour Settings.Secure.DISABLE_SECURE_WINDOWS even when
+            // ro.debuggable=0. Stock AOSP gated this on SYSTEM_DEBUGGABLE; ship
+            // builds keep debuggable off and use the Secure setting alone.
+            boolean disableSecureWindows;
+"""
+
+
+def backup(path: Path) -> None:
+    BAK_ROOT.mkdir(parents=True, exist_ok=True)
+    dest = BAK_ROOT / path.name
+    if not dest.exists():
+        shutil.copy2(path, dest)
+        print(f"backup -> {dest}")
+
+
+def main() -> int:
+    if not WMS.is_file():
+        print(f"ERROR: missing {WMS}")
+        return 2
+    text = WMS.read_text()
+    if MARKER in text:
+        print(f"already applied: {WMS}")
+        return 0
+    if OLD not in text:
+        print("ERROR: expected updateDisableSecureWindows debuggable gate not found")
+        print("(tree already diverged — inspect manually)")
+        return 3
+    backup(WMS)
+    WMS.write_text(text.replace(OLD, NEW, 1))
+    print(f"applied -> {WMS}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())