Upstream/samsung postboot validation

[igorcv88]

I tested NeoZygisk in a KernelSU session that is acquired after Android has already booted (https://github.com/BuSung-dev/Root-My-Galaxy). In this setup the normal module boot hooks have passed, zygote and system_server already exist, and KernelSU is late-loaded by an exploit on a bootloader-locked Samsung device.

Rather than opening a large PR with fork branding, release automation and device-specific packaging mixed together, this PR adds the part that is useful upstream: the lifecycle, the failure boundaries and the complete hardware result.

Tested device

Device: Samsung Galaxy S25 Ultra SM-S938B
Build: BP4A.251205.006.S938BXXSBCZG3
Kernel: 6.6.98-android15-8-pd6ff1cd-abogkiS938BXXSBCZG3-4k
ABI: arm64-v8a
Bootloader: locked
Root: temporary KernelSU loaded after boot by Root My Galaxy

Design decisions

The working path deliberately avoids injecting the already-running zygote.

1. KernelSU is late-loaded and its control channel is verified.
2. The live NeoZygisk runtime is staged under /dev/.neozygisk.
3. Exactly one monitor is attached to init.
4. The current zygote is left untouched.
5. The user runs Soft Reboot from KernelSU Manager once.
6. The new zygote, daemon, socket and library mapping are checked live after Android returns.

The /dev runtime path was required because Samsung DEFEX rejected the zygote opening the injection library from the persistent module directory under /data/adb. /debug_ramdisk was not a usable staging location in this temporary KernelSU environment.

Generation safety

A second failure was reproduced after installing a newer provider package while the previous monitor and /dev runtime were still alive. The next Soft Reboot produced:

monitor: stopped(zygote crashed)
zygote64: unknown
daemon64: running

The daemon being alive was not enough to call the provider healthy. The earlier verifier also printed a stale success result because status only displayed the previous status file.

The tested recovery build added these fail-closed checks:

• exactly one monitor attached to init;
• monitor executable must not end in (deleted);
• running tracer hash must match the installed tracer;
• staged library hash must match the installed library;
• stopped(zygote crashed) is a hard failure;
• status performs a fresh live check;
• installing over a live monitor records the current boot ID and requires a full reboot before activation.

The safe provider-update sequence is therefore: install without Soft Reboot, fully reboot the device, acquire KernelSU again, then run KernelSU Manager Soft Reboot.

Hardware result

After a full reboot, the normal exploit, the guarded provider package and one user-initiated KernelSU Manager Soft Reboot, live verification returned:

PHASE=3.2
RESULT=INJECTION_VERIFIED
DETAIL=healthy same-generation NeoZygisk state verified
WORK=/dev/.neozygisk
RESTART_TRIGGERED_BY_MODULE=0
TARGETED_ZYGOTE_RESTART_USED=0
GLOBAL_SOFT_REBOOT_USED_BY_MODULE=0
MANUAL_KERNELSU_SOFT_REBOOT_REQUIRED=0
FULL_REBOOT_REQUIRED=0
BOOTSTRAP_RESULT=HEALTHY
MONITOR_HEALTHY=1
MONITOR_PID=13835
INIT_TRACER=13835
MONITOR_EXE_DELETED=0
MONITOR_BINARY_MATCH=1
RUNTIME_LIBRARY_MATCH=1
RUNTIME_MONITOR_CRASHED=0
ZYGOTE_PID=24563
SYSTEM_SERVER_PID=24853
DAEMON_PID=24565
RUNTIME_PROP_INJECTED=1
RUNTIME_PROP_DAEMON_RUNNING=1
ACTIVITY_READY=1
CP64_SOCKET_READY=1
LIBRARY_MAPPED_IN_ZYGOTE=1

The runtime reported an injected zygote64, a running zygiskd64, and two loaded modules: Zygisk Assistant and LSPosed. Both were functional after the Soft Reboot.

Relationship to #107

This is not a replacement for the standalone late-injection work in #107. That PR injects an already-running process; this path waits for the next zygote creation produced by the external KernelSU module lifecycle.

The scope is narrower, but it gives a production-device test result for a late-loaded root environment without remote injection into the current Android zygote. It also identifies update-generation checks that are useful regardless of which late-load mechanism is eventually preferred.

Scope of this PR

This PR only adds documentation and a README link. It does not attempt to merge the full PostBoot fork as-is. The complete reference implementation remains available in igorcv88/NeoZygisk-PostBoot, while this change keeps the upstream discussion focused on the tested behavior and the parts that may be worth integrating.

[JingMatrix]

Stop AI content, and I don't understand what is helpful by writing this docs that you should keep for your own.