fix(system-mode): complete PR5A lifecycle and PR5B transaction

[Jordan231111]

Summary

• complete roadmap PR5A on the existing MuMuPlayer 1.4.46 VM with a released-versus-current same-target lifecycle and verified external image restore
• complete conditional PR5B with one shared, host-authorized System Mode transaction for app/recovery/addon routes
• persist versioned target/source/artifact-bound receipts, originals, ownership, journals, manifest copies, and boot proof
• recover interrupted install/uninstall states deterministically and uninstall only exact hash-verified manifest-owned paths
• remove recovery filename activation, select init/runtime/policy by proven layout, and keep release System Mode unavailable
• harden temporary AVD transport ownership after MuMu exposed a colliding emulator-5554 alias
• fix the inherited Android 6 x86_64 manager extraction failure by porting official Magisk's cf12087e2 multi-arch removal with Kitsune's libmagisk32.so layout

Proven before/after fixes

• released complete uninstall left the manager package; the new exact uninstall removes manager, root, and owned paths
• PR Harden Kitsune release and System Mode lifecycle #26 had no durable ownership record; live staged process death now restores the prior BOOT_VERIFIED transaction and exact digests
• a completed pre-final transaction left .install-manifest.json.new; the final System Mode code removes staging after both durable manifest publications and before COMMITTED, proven by focused regression and live MuMu before/after
• boot verification could depend on the remounted script filesystem and a wrongly named recovery applet; verification/recovery now relocate correctly to boot tmpfs
• permissive/unlabeled targets no longer fail enforcing-only context ownership checks
• stale/occupied AVD transports are rejected using transport disappearance, boot ID, and expected AVD identity
• hosted API 23 release setup failed twice with Unable to extract files despite valid root in diagnostic run 30710846323; run 30711902171 now shows both debug and release setup returning result=true, rebooting, obtaining root, completing concurrent su and corpus checks, restoring the ramdisk byte-for-byte, and deleting the temporary AVD

Qualification

• 127 Python host tests
• app JVM tests and app/shared/stub debug lint
• Bash syntax and ShellCheck 0.11.0 error-severity checks
• exact all-ABI debug/release app+stub builds, signer separation, historical-certificate rejection, native mode, APK integrity, and 16 KiB ELF/ZIP alignment
• temporary ARM64 Android 6/API 23 and Android 16/API 36 local normal patched-ramdisk debug/release lifecycles, concurrent su, corpus runs, stock restoration, and AVD deletion
• hosted x86_64 API 23/29/35 exact-artifact lifecycles and aggregate product gate: Kitsune CI 30711902171
• official-upstream resolution, SBOM/license/dependency/RustSec, historical-submodule, signer, and hidden-manager contracts: security run 30711902170
• MuMu Android 12/API 32 ARM64: released comparison, three cold boots/player cycles, root policy, minimal module, upgrade/reinstall, live staged-process-death rollback, exact uninstall, and verified restore
• exact System Mode code commit c86bdce439cba1b0317073a0a50dfda95dfde688: transactional upgrade, clean COMMITTED state, cold boot to BOOT_VERIFIED, root, exact uninstall, and another verified restore

Boundaries

This is an experimental exact-version qualification, not a stable release or a brand-wide MuMu claim. The starting snapshot contained released legacy System Mode; every failure boundary was covered on the host, while only staged process death was injected live. Release System Mode remains excluded, API 23–24 System Mode remains excluded, and production signing/update service, maintained-stable forward-port, enforcing/multi-target/OTA matrices, physical-device coverage, and Zygisk/Hide/SuList release contracts remain later roadmap gates.

Detailed evidence: docs/system-mode/mumu-pr5a-pr5b-2026-08-01.md