# Runbook: `008` call-rec + FLAG_SECURE (LAB)

**LAB serial**: `11231JEC207477` only — never GOLDEN.  
**Apply** (on `rom-dev01`):

```bash
python3 /srv/rom/src/lineage/vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py
```

Idempotent (second run = all “already”). Marker:
`SUNFISH_A16_008_CALL_REC_FLAG_SECURE`.

**Evidence**: `/srv/rom/artifacts/008-call-rec-flag-secure/`  
**Logs**: `/srv/rom/logs/008-build/`  
**Backups**: `/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots/`

## Secure keys

| Key | Default | Source |
|-----|---------|--------|
| `extendrom_call_recording` | `0` | AXP GOLDEN / EXTENDROM (`ER_ALLOW_ANY_CALL_REC`) |
| `disable_secure_windows` | `0` | AOSP A16 `Settings.Secure.DISABLE_SECURE_WINDOWS` (DO UI key `allow_flag_secure_override`) |

GOLDEN dump: `extendrom_call_recording=1` in
`.local-artifacts/002-golden/…/settings/secure-*.txt`.

## Call-rec — EXTENDROM `F_CALLREC` (applied)

| Step | LOS 23.2 path | Status |
|------|---------------|--------|
| Dialer config | `packages/apps/Dialer/.../callrecord/res/values/config.xml` | already `enabled=true`, audio `4` |
| Controllers | `Settings/.../ER_CallRecPreferenceController.java` + `ER_CallRecInfo.java` | applied |
| Dashboard | `DevelopmentSettingsDashboardFragment.java` | applied |
| DO XML | `Settings/res/xml/development_settings.xml` | applied |
| Strings | `Settings/res/values/strings.xml` | applied |
| Secure const | `frameworks/base/.../Settings.java` `ER_ALLOW_ANY_CALL_REC` | applied |
| Dialer gate | `Dialer/.../CallRecorder.java` `canRecordInCurrentCountry` | applied |

## FLAG_SECURE — A16 inventory (applied via DO only)

AOSP already implements the capture path:

- `WindowState.isSecureLocked()` → early false if
  `mWmService.getDisableSecureWindows()`
- `WindowManagerService.updateDisableSecureWindows()` reads
  `Settings.Secure.DISABLE_SECURE_WINDOWS`
- **Only when** `ro.debuggable` / `SYSTEM_DEBUGGABLE` is true (LAB
  `userdebug` OK; `user` needs retest / possible gate lift later)

Project work: Settings DO writes that Secure key (no Magisk / no jar patcher).

## Validation

See `specs/008-call-rec-flag-secure/quickstart.md`.

After bacon + flash Magisk-free:

```bash
adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
adb -s 11231JEC207477 shell settings get secure disable_secure_windows
```

## `user` vs `userdebug`

LAB = `userdebug` (DO + WMS secure-windows disable active). Before release
(`011`), re-check on `user`: DO visibility (like `005`) and whether
`updateDisableSecureWindows` still no-ops when not debuggable — document
outcome; do not silently claim `user` PASS.