# Research: `008-call-rec-flag-secure`

## Decision: Call-rec = AXP GOLDEN / EXTENDROM native model

**Decision**: Port EXTENDROM `F_CALLREC` (same behaviour as AXP GOLDEN), not
Magisk Dialer RRO.

**GOLDEN evidence**: LAB dump already has
`extendrom_call_recording=1` in
`.local-artifacts/002-golden/20260915-spoofing-phonesky/settings/secure-*.txt`.

**Mechanism** (`/srv/rom/references/extendrom/er.sh`):

1. Overlay Dialer `config.xml`: `call_recording_enabled=true`,
   `call_recording_audio_source=4`.
2. Settings DO: category + legal info + switch
   `extendrom_call_recording`.
3. Controllers: `ER_CallRecPreferenceController` /
   `ER_CallRecInfo` → `Settings.Secure.ER_ALLOW_ANY_CALL_REC`.
4. `Settings.java`:
   `ER_ALLOW_ANY_CALL_REC = "extendrom_call_recording"`.
5. Dialer `CallRecorder.canRecordInCurrentCountry()`: if Secure int == 1,
   return `true` before country XML map.

**Secure key (product)**: `extendrom_call_recording` (GOLDEN-compatible).
Do **not** invent `allow_call_recording_any_region` for call-rec.

**Alternatives rejected**:

- Magisk static RRO of `call_record_states.xml` — always-on, not native ROM,
  no DO parity with GOLDEN.
- Blind A11 overlay-only without Dialer Java gate — may no-op on A16.

## Decision: FLAG_SECURE = AOSP `disable_secure_windows` + DO

**Decision**: Do **not** invent a second frameworks hook. LOS 23.2 / A16 already
has `Settings.Secure.DISABLE_SECURE_WINDOWS` wired through
`WindowManagerService` → `WindowState.isSecureLocked()`. Ship a Developer
Options switch (preference key `allow_flag_secure_override`) that writes
`disable_secure_windows`.

**Constraint (stock AOSP)**: WMS applied the setting only on debuggable builds
(`ro.debuggable`). **Project decision (2026-09-18):** remove that gate in
`updateDisableSecureWindows()` (`apply_wms_disable_secure_debuggable_gate.py`)
so ship images keep `ro.debuggable=0` while the DO toggle works. No other
secondary gate found in `WindowState.isSecureLocked` / `Task.isSecure`.
LAB `userdebug` with `ro.debuggable=0` was the motivating case.

**Alternatives rejected**: Magisk `services.jar` dex patchers as shipping
mechanism.

## Decision: Packaging = `vendor/sunfish-a16` apply like `005`

Idempotent script under `patches/008-call-rec-flag-secure/`, EXTENDROM/`er.sh`
attribution for call-rec.

## Decision: Combined feature directory

One Spec Kit feature absorbs roadmap `008` + `009`.

## Decision: No Magisk artifacts in the repo

Owner-supplied Magisk zips were temporary agent aids only; removed from the
working tree. Implementation references EXTENDROM + GOLDEN dumps + A16 source
inventory.