# Contract: FLAG_SECURE / screenshot surface

**Feature**: `008-call-rec-flag-secure`  
**Consumers**: LAB validation (`quickstart.md`)

## Secure setting

| Item | Value |
|------|--------|
| Key | `Settings.Secure.disable_secure_windows` (AOSP `DISABLE_SECURE_WINDOWS`) |
| Values | `null`/`0` = stock `FLAG_SECURE`; `1` = global capture override |
| Readback | `adb shell settings get secure disable_secure_windows` |
| UI preference key | `allow_flag_secure_override` (writes the Secure key above) |
| Scope | **Global** (all apps); per-app lists not planned |
| Note | Stock AOSP gated WMS on `ro.debuggable`; project removes that gate (`SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE`) so `ro.debuggable` stays `0` |

## Capture behaviour

| Condition | Expected |
|-----------|----------|
| Setting `0`, secure window | System screenshot / screen record blocked as stock |
| Setting `1`, same window | System screenshot / screen record succeeds |
| Setting `1`, DRM/HW buffer edge cases | May still fail — document if observed |

## UI

- Developer Options switch; short summary that this weakens app privacy.
- Reset to `0` when Developer Options master is disabled.

## Evidence

- Setting readback 0/1.
- Before/after screenshots (or failure toast) stored under
  `/srv/rom/artifacts/008-call-rec-flag-secure/flag-secure/`.