validation(device): isolated FR-014 flash candidate

[Zhanfg]

Purpose

Isolated physical-device validation candidate for FR-014 only. Do not merge or publish as a release.

Reviewed runtime base: 9154127d3c6c2cea8828b236a7a791bfcf382b41.
Candidate commit: 857e963d5c7e3a4e5a879b70231adc95326bd6bb.

Audited runtime diff from reviewed base

• remove module/FLASH_REVIEW_BLOCKED so this one candidate can be installed for physical validation;
• add inert module/FR014_DEVICE_CANDIDATE marker containing the reviewed base identity.

The only third diff is repository-side scripts/package_module.sh: candidate packaging requires the FR-014 marker and refuses any ZIP that still contains the review blocker. It is not part of the module runtime.

No boot patch, restore, service, ABI, WebUI, KPM, credential, transaction, or installer runtime implementation differs from the reviewed base.

Candidate CI

Exact candidate SHA 857e963d5c7e3a4e5a879b70231adc95326bd6bb:

• Build #239 (31245717266): PASS
• Flash safety #126 (31245717261): PASS

Build #239 passed source/WebUI validation, pinned dependency hashes, Android ARM64 Public1158 CLI rebuild, kp-safemode build, ARM64 ABI inspection, complete module validation, deterministic double-package comparison, and artifact upload.

Flash safety #126 passed destructive fault injection, bootloop auto-rollback contract, Magisk/KernelSU/APatch installer simulation, off-device recovery export contract, ABI contract, and candidate deterministic package gate.

Exact artifact identity

GitHub artifact ID: 9018433008
Artifact name: patchnest-module-0.13.5-2-0.13.3
Outer downloaded artifact SHA-256: bfdd1aedece034330b4507ae0c220bbeb103d3b19fa10297b0f54f417170fb9a

Inner installable module:

• filename: PatchNest-Module.zip
• size: 1,978,990 bytes
• SHA-256: a252add7f7bd01c361089a5b27d28e22e1c6a52f1ddf4e1161bdeede97ffbf0e
• workflow sidecar reports the same SHA-256.

Direct artifact inspection confirmed:

• FR014_DEVICE_CANDIDATE present;
• FLASH_REVIEW_BLOCKED absent;
• no ../ or ./ archive paths;
• transaction/restore/device validation helpers present;
• kpatch, kptools, kp-safemode, and magiskboot are ARM64 Android ELF binaries;
• provenance/kpatch-public1158.json source commit is 7fed93c4e259a6edf191c1a9900874babb232c4b and its binary SHA equals the packaged bin/kpatch SHA 252a3fc0e1f674e78917bdfaa159e8274104e8a5a4eeda5d2c5720f939f33ee4.

Mandatory physical FR-014 sequence

This exact ZIP is the only candidate allowed for the test. Do not rebuild locally or substitute another artifact.

1. Install candidate on a supported ARM64 A/B test device.
2. Reboot once so module service environment is established.
3. Run packaged device_validation.sh preflight; exact active slot/boot target must resolve and unpack.
4. Run export_recovery_boot.sh with PATCHNEST_DEVICE_TEST_UNLOCK=RECOVERY_EXPORT.
5. Copy the exported recovery boot image + JSON manifest off the phone to the host computer and independently verify SHA-256 equals the value printed by the device.
6. Only after step 5, perform the normal PatchNest patch + destructive write from WebUI.
7. Before reboot, retain the off-device recovery image and candidate ZIP/hash.
8. Cold boot; require Android sys.boot_completed=1.
9. Run device_validation.sh postboot; require hello1158, kpver, KPM query/list, secure committed key, no pending transaction/recovery marker, and live rollback eligibility.
10. Normal reboot once more and repeat postboot to prove persistence.
11. Run device_validation.sh rollback-negative; production validator must reject foreign-device and stale-byte binding copies without changing real boot/binding.
12. Optional only with a separately reviewed diagnostic KPM: run kpm-cycle with its explicit unlock token.
13. Controlled software recovery test: run arm_auto_recovery.sh with PATCHNEST_DEVICE_TEST_UNLOCK=AUTO_RECOVERY, reboot, allow service to perform exact transaction-bound restore and request the second reboot, then run verify_auto_recovery.sh.
14. Separately verify the manual transaction-bound restore path using device_validation.sh restore with PATCHNEST_DEVICE_TEST_UNLOCK=RESTORE_BOUND_BACKUP, reboot, then run postrestore.
15. Verify the off-device original boot image is usable as the bootloader/fastboot recovery material for failures too early for module scripts to run. This is the non-userspace recovery layer; software auto-recovery cannot substitute for it.
16. Attach all evidence bundles plus host-side SHA-256 output to PR review: harden flash-readiness gates before next release #5/validation(device): isolated FR-014 flash candidate #7 for review.

Only after all physical evidence passes may PR #5 be marked ready, the release branch remove FLASH_REVIEW_BLOCKED, and PatchNest be described as truly flashable.