# 009 — Sideload system package updates (FR-019)

Owner cadence: refresh bundled **system / privileged** packages about every
**2–3 months** without a full ROM reflash. **No** AXP OTA / external repos.

Status: **stub** — fill before final ship (task T046a). Packaging of the
shipping image MUST already preserve update eligibility.

## In scope

| Component | Intended update path | Signing constraint |
|-----------|----------------------|--------------------|
| microG GmsCore / companions | `adb install -r` / recovery sideload of upstream APK | **PRESIGNED** / same signer as shipped |
| Magisk | Magisk app self-update and/or documented boot re-patch | Manager + boot image must stay matched |
| Project Phonesky | Sideload project-signed APK | **Same project key** across releases |
| Other bundled system apps | Sideload matching-signer APK (or recovery zip if priv-app needs it) | Same identity as image |

## Out of scope

- Network OTA / AXP update servers
- Full `bacon` + clean flash for routine APK bumps (still OK for kernel /
  framework / Magisk boot changes when required)

## Checklist before claiming FR-019 done

- [ ] Each row above has a concrete command/runbook step
- [ ] `pm install` / PackageManager does not reject for signature mismatch
- [ ] Privileged permissions still grant after update (or re-flash privapp XML noted)
- [ ] Magisk version after update matches kernel/boot expectation
- [ ] Record new versions in `docs/009-version-pins.md`