# Quickstart: `008` call-rec + FLAG_SECURE (LAB)

**Device**: LAB only `11231JEC207477`  
**Build**: bacon/image with `008-call-rec-flag-secure` applied  
**Evidence root**: `/srv/rom/artifacts/008-call-rec-flag-secure/`

## Prerequisites

- Magisk **not** required (must work without it).
- Developer Options enabled.
- Contracts: [call-recording-surface.md](./contracts/call-recording-surface.md),
  [flag-secure-surface.md](./contracts/flag-secure-surface.md).

## 1. Defaults

```bash
adb -s 11231JEC207477 shell settings get secure extendrom_call_recording
adb -s 11231JEC207477 shell settings get secure disable_secure_windows
# expect 0 or null
```

## 2. Call recording (region unlock)

1. Open **Developer Options** → enable **Disable call recording restrictions**.
2. Confirm:

```bash
adb shell settings get secure extendrom_call_recording
# expect 1
```

3. Place or receive a call with Dialer → start recording → stop → confirm file
   (Downloads / Dialer recordings — note path).
4. Disable the switch (or turn off Developer Options) → confirm setting `0`
   and that a restricted country would hide/deny record (or document LAB
   country ISO + XML flag).

Store notes + path under `…/call-rec/`.

## 3. FLAG_SECURE override

1. Enable **Allow screenshots of secure windows** in Developer Options.
2. Confirm:

```bash
adb shell settings get secure disable_secure_windows
# expect 1
```

3. Open an app/window that sets `FLAG_SECURE` (e.g. password manager, banking
   login, or a tiny test APK).
4. With toggle **OFF**: system screenshot should fail / blank.
5. With toggle **ON**: screenshot or screen record should succeed.
6. Toggle OFF again → secure behaviour restored.

Store images/notes under `…/flag-secure/`.

## 4. Pass criteria

- [ ] Both settings default OFF after fresh boot / DO off  
- [ ] Call-rec ON → recording works; OFF → stock policy  
- [ ] FLAG_SECURE ON → capture works; OFF → blocked  
- [ ] No Magisk installed for the successful run  

## Notes

- User is responsible for call-recording legality.
- DRM-protected surfaces may still resist capture; note exceptions.
- `user` build retest before release claims (`011`).