# 009 — Remaining path after Magisk closure

**Updated 2026-10-10.** Older “post clean-429 / leave test-keys” execution
order is obsolete. Resume: [`009-handoff-20261008.md`](009-handoff-20261008.md).
Closure: [`009-closure-parity-20261009.md`](009-closure-parity-20261009.md).

Authoritative requirements: `specs/009-axp-los23-port/spec.md` + constitution.
KernelSU stays out of Magisk ship boots (optional recycle only).

## Already landed (LAB closure, 2026-10-09)

| Layer | Status |
|-------|--------|
| Stage1 + combo4 + Clang FORTIFY | Ship |
| CVE clean-offset + hi batches 1–3 | Ship (`CVE-2022-49980` one-liner denylisted; lock-scope companion applied) |
| Magisk 30.7 EXTENDROM preroot | Ship |
| `user` + project `release-keys` | Ship |
| AVB flags 0 (unlocked) | Ship |
| Deblob waves 1–4 (selective; not AXP `Deblob.sh`) | Ship |
| `hardened_malloc` (64-bit; SF/camera exclusions) | Ship |
| Call-rec / FLAG_SECURE DO toggles (`008`) | Ship |
| Private DNS / connectivity (no axp.os endpoints) | Ship |
| Swissquote usable in Island | **PASS** |
| Bootanimation | Lineage (no AXP asset in PRO payload) |

## Still open / next

| Item | Notes |
|------|--------|
| **Upstream LOS 23.2 rebase + first project OTA zip** | [`009-upstream-rebase-ota.md`](009-upstream-rebase-ota.md) — bacon scripts ready; sync automation not |
| **Yuh in Island on LAB** | Open — Play A16/sunfish filter + install-source; see [`009-yuh-golden-lab-hypothesis.md`](009-yuh-golden-lab-hypothesis.md) |
| Wallapop / PairIP-class apps | Root cause 2026-10-10: Yama `ptrace_scope=2` (US-S5-1 + `apply_009_yama_ptrace.py`). PairIP's anti-debug ptrace is denied, so it dies with SIGSEGV. GOLDEN kernel has no Yama. Next OTA leaves `CONFIG_SECURITY_YAMA` unset |
| FR-019 APK sideload cadence | Stub: [`009-sideload-system-updates.md`](009-sideload-system-updates.md) |
| Release-key custody polish | Keys under `/srv/rom/secrets/`; offline copy confirm |
| Physical-SIM call gate | Owner before more radio deblob |
| Leftover high-offset CVE / failed Stage1 probes | Optional, small batches |
| KernelSU / SusFS parallel retry | Keep `007-*`; bridge [`007-parallel-on-009.md`](007-parallel-on-009.md) — never mix into Magisk ship bacon |
| Bootloader lock | Wont (AXP/LOS unlocked norm) |

## Suggested order (default)

1. Owner supplies new LOS sunfish build pin → follow `009-upstream-rebase-ota.md`.
2. Rebacon with `scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh` (+ wave4/malloc wrappers if still required).
3. LAB sideload smoke: Magisk, Island, Swissquote, radio.
4. Yuh / Play compatibility experiments (LAB only).
5. Fill FR-019 sideload commands when packaging is frozen.

## Do-not

- Reflash full-503 / old `kh-cve` / FORTIFY-broken zips.
- Bulk-apply high-offset CVE without review.
- Mix KernelSU into Magisk ship boots.
- Run AXP `Deblob.sh` defaults.
- Treat “AXP/Graphene-class” as requiring locked bootloader.