# 007 parallel track — ReSukiSU / SusFS on Magisk `009` ROM

**Status (2026-10-10):** active **parallel** path. Not Magisk ship. Not deleted.
Docs under `007-*` stay; this file is the bridge to the **current** closure ROM.

**Why keep it:** Sept 2026 LAB bring-up **booted** ReSukiSU + SusFS v1.5.5 with
matched `boot`+`vendor` (`docs/007-lab-results-20260916.md`). Owner may want
to retry that stack on today’s Magisk `009` tree (Stage1/CVE/hardening +
userspace), especially for hide experiments (e.g. PairIP-class apps) without
throwing away Magisk ship.

## Parallelism rules

| Rule | Detail |
|------|--------|
| Ship zip | Magisk EXTENDROM preroot only (`009` bacon). Never enable `CONFIG_KSU` in the Magisk ship bacon. |
| Experiment | Separate `boot.img` (and usually matched vendor modules) built from the **same** LOS/`009` kernel tree **or** a worktree clone — flash LAB only. |
| Coexistence | Do **not** run Magisk + KernelSU in the same boot. A/B slots or keep last Magisk zip to restore. |
| GOLDEN | Never flash. |
| Spec | FR-016 optional recycle; `specs/007-kernelsu-sunfish/` remains valid standby. Sibling workspace `sunfish-a16-rom` may hold older KSU dirt — prefer re-integrating onto current `009` kernel. |

## What already worked (do not reinvent)

| Item | Result |
|------|--------|
| ReSukiSU + SusFS boot | PASS (matched vendor, SELinux `vendor_kernel_modules`) |
| Manager + `susfs_init` | PASS |
| Banking hide alone | **Not** enough (Swissquote/Yuh FAIL `-69` on that stack) |
| Boot-only SusFS flash | FAIL (module CRC / vibrator hang) — always match vendor `.ko` |

Runbook detail: [`007-kernelsu-runbook.md`](007-kernelsu-runbook.md).  
Lab write-up: [`007-lab-results-20260916.md`](007-lab-results-20260916.md).

## Recommended trial on current ROM

1. Keep Magisk closure zip + both slots known-good.
2. On `rom-dev01`, from the **current** `009` kernel (not the Sept-only image):
   - refresh ReSukiSU / SusFS to newest compatible (non-shallow; record
     `KSU_VERSION` + manager APK — AGENTS.md upstream freshness).
   - integrate per `007-kernelsu-runbook.md` (manual hooks + SusFS).
   - build `bootimage` (+ vendor modules from same build).
3. Disable Magisk for that boot (KSU boot has no Magisk preroot).
4. Flash LAB: matched `boot` + vendor modules path from runbook; vbmeta
   disable-verity as before if required for the experiment.
5. Install matching spoofed manager; smoke `sys.boot_completed`, SusFS version,
   then optional banking / Wallapop probes.
6. Restore Magisk ship zip/slot when done.

Artifacts: `/srv/rom/artifacts/007-kernelsu/` (separate from
`009-axp-los23-port/`).

## Do-not

- Merge KSU into `scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh`
- Reuse Sept `boot-resukisu-*.img` on Oct Magisk userspace without matching
  kernel/vendor ABI
- Treat bank PASS as already proven on KSU (it was not)
- Delete `007-*` docs or `specs/007-kernelsu-sunfish/`