# 008 call-rec + FLAG_SECURE patches

Idempotent apply for LOS 23.2 on `rom-dev01`.

```bash
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py
```

## Attribution

- **Call recording**: EXTENDROM `er.sh` F_CALLREC / AXP GOLDEN
  (`extendrom_call_recording`). steadfasterX EXTENDROM.
- **FLAG_SECURE**: AOSP `Settings.Secure.DISABLE_SECURE_WINDOWS` + DO
  preference `allow_flag_secure_override`. Stock WMS only applies the
  setting when `ro.debuggable=1`; we remove that gate via
  `apply_wms_disable_secure_debuggable_gate.py` so ship images keep
  `ro.debuggable=0` while the toggle still works.

## Touched paths

| Area | Path under `/srv/rom/src/lineage/` |
|------|-------------------------------------|
| Secure call-rec | `frameworks/base/core/java/android/provider/Settings.java` (`ER_ALLOW_ANY_CALL_REC`) |
| Dialer gate | `packages/apps/Dialer/java/com/android/incallui/call/CallRecorder.java` |
| Dialer config | already `call_recording_enabled=true` / audio `4` (verified) |
| Settings controllers | `…/ER_CallRec*.java`, `…/FlagSecureOverride*.java` |
| Settings DO XML + strings | `res/xml/development_settings.xml`, `res/values/strings.xml` |
| Dashboard | `DevelopmentSettingsDashboardFragment.java` |
| Capture path | WMS `updateDisableSecureWindows()` — **no** `ro.debuggable` gate |
| WMS apply | `apply_wms_disable_secure_debuggable_gate.py` |

```bash
python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
```

Backups: `/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots/`  
Markers: `SUNFISH_A16_008_CALL_REC_FLAG_SECURE`,
`SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE`

See `docs/008-call-rec-flag-secure-runbook.md`.