# Design: native call-recording unlock + FLAG_SECURE override (`008`/`009`)

**Date**: 2026-09-16  
**Status**: Landed via Magisk `009` ship pack (2026-10). Spec:
`specs/008-call-rec-flag-secure/`  
**LAB only**: `11231JEC207477`.

> **Scope note:** “No Magisk/LSPosed/Zygisk” applies to **these two native
> toggles** (they are ROM Settings/framework). It does **not** mean the ROM
> ships without Magisk — Magisk preroot is a separate `009` requirement.

## Problem

1. Lineage Dialer can refuse call recording based on **country / carrier**
   rules even when the user wants to record.
2. Apps set `FLAG_SECURE` so screenshots / screen capture fail; we want an
   optional **global** override (project-specific; not AXP Pro catalog).

## Goals (MVP)

Two **Developer Options** switches (same UX pattern as `005`
`allow_signature_fake`):

| Toggle (plain language) | Secure setting | Default | Effect when ON |
|-------------------------|----------------|---------|----------------|
| Disable call recording restrictions | `extendrom_call_recording` (GOLDEN / EXTENDROM) | `0` | Country/region limits ignored; Dialer may record |
| Allow screenshots of secure windows | `disable_secure_windows` (AOSP; DO pref `allow_flag_secure_override`) | `0` | Global: ignore `FLAG_SECURE` for screenshots / screen capture (debuggable builds) |

- **Global only** — product requirement; no per-app lists (not planned).
- OFF = stock Android / LOS behaviour.
- No root modules required at runtime.

## Non-goals

- Full AXP call-recording policy UI (auto-record rules, etc.).
- Per-app FLAG_SECURE lists (out of scope permanently for this project).
- Banking / KernelSU (`007` incomplete).
- Shipping Magisk zips.

## Approaches considered

### Call recording

| Approach | Pros | Cons |
|----------|------|------|
| **A. EXTENDROM / AXP GOLDEN native F_CALLREC** (chosen) | Same Secure key as GOLDEN (`extendrom_call_recording=1` observed); DO + Dialer gate; attributable | Re-validate paths on LOS 23.2 / A16 |
| B. Magisk Dialer RRO (`call_record_states.xml`) | Tiny | Not native; no GOLDEN parity; rejected |
| C. Blind-copy A11 overlays only | Fast | May no-op without Dialer Java gate |

**Choice: A.** Primary sources:
`/srv/rom/references/extendrom/er.sh` (F_CALLREC),
`overlays/call-rec`, `config/call-rec/…/CallRecPreferenceController.java`.
Secure string: `Settings.Secure.ER_ALLOW_ANY_CALL_REC = "extendrom_call_recording"`.

Also enable Dialer `call_recording_enabled` / audio source as needed for
sunfish (EXTENDROM sets `call_recording_enabled=true`,
`call_recording_audio_source=4`), after verifying LOS 23.2 Dialer still uses
those resources.

### FLAG_SECURE

| Approach | Pros | Cons |
|----------|------|------|
| **A. DO → AOSP `DISABLE_SECURE_WINDOWS`** (chosen) | Already in WMS on A16; tiny surface | Debuggable-only gate in stock WMS |
| B. Magisk `services.jar` patcher | Works on `user` | Not native ROM |
| C. Duplicate frameworks hooks under another Secure key | — | Redundant with AOSP |

**Choice: A.** Wire Settings DO to `disable_secure_windows`.

## Design

### Settings / UI

- Category under Developer Options (new or shared “Privacy overrides” /
  EXTENDROM-style categories).
- Two `SwitchPreference`s + short legal/risk summaries (call recording:
  user responsible for local law — EXTENDROM wording as reference).
- Controllers mirror `005` / EXTENDROM `DeveloperOptionsPreferenceController`:
  write `Settings.Secure` 0/1; reset to 0 when Developer Options master is
  disabled.

### Call recording path

1. Inventory LOS 23.2 Dialer: where country/carrier recording is blocked
   (`isCountryAllowed` or successor).
2. When `extendrom_call_recording=1`, treat as allowed (GOLDEN).
3. Ensure recording feature is compiled/enabled for Dialer on sunfish
   (`config.xml` / product overlay as required).
4. LAB: enable toggle → place/receive call → record → file exists; disable →
   region block behaviour restored (or stock deny if in restricted region).

### FLAG_SECURE path

1. Confirmed A16: `WindowManagerService` + `WindowState.isSecureLocked()` already
   honour `Settings.Secure.DISABLE_SECURE_WINDOWS`.
2. DO switch writes that key (UI title: Allow screenshots of secure windows).
3. LAB userdebug: OFF blocked / ON capturable; document DRM exceptions.

### Packaging

- Patches under `vendor/sunfish-a16/patches/008-…` (idempotent apply script
  like `005-sigspoof`), attributed to EXTENDROM/`er.sh` F_CALLREC (call-rec)
  and native frameworks work (FLAG_SECURE).
- No Magisk in the bacon zip; no Magisk zips in the meta-repo.

### Validation

- LAB serial only; document settings get/put and screenshots/logs under
  `/srv/rom/artifacts/008-…`.
- Does not reopen `007` banking gates.

## Relationship to roadmap numbers

| Roadmap # | Theme | This feature |
|-----------|--------|--------------|
| 008 | Call recording | Included |
| 009 | FLAG_SECURE | Included (global only) |

Single Spec Kit directory: `specs/008-call-rec-flag-secure/`.