cogan17 · Oct 18, 2026 · Oct 18, 2026
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -119,15 +119,15 @@ jobs:
           BUILD_TIME_INPUT: ${{ inputs.BUILD_TIME }}
           LTO_INPUT: ${{ inputs.LTO }}
           BBG_INPUT: ${{ inputs.BBG }}
+          NETWORKING_INPUT: ${{ inputs.NETWORKING }}
         run: |
           set -euo pipefail
-          if [[ "$ROOT_MANAGER_INPUT" == "KernelSU Next + SUSFS" || "$ROOT_MANAGER_INPUT" == "KSUN + SUSFS & BakaSU + SUSFS" ]]; then
-            # The device-tested candidate (Issue #19): fullLTO, BBG on, a sublevel whose trees are locked.
-            [[ "$KERNEL_VERSION_INPUT" == "6.1" && "${LTO_INPUT:-}" == fullLTO* && "${BBG_INPUT:-true}" == "true" ]] \
-              || { echo "::error::KSUN+SUSFS needs kernel 6.1, a fullLTO package and BBG enabled" >&2; exit 1; }
-            python3 scripts/ksun_susfs_sublevel.py resolve "${KERNEL_SUBLEVEL_INPUT:-lts}" \
-              || { echo "::error::KSUN+SUSFS is not verified for sublevel ${KERNEL_SUBLEVEL_INPUT}" >&2; exit 1; }
-          fi
+          case "$LTO_INPUT" in
+            "noneLTO + NoMount + Clean LTO"|"thinLTO + NoMount + Clean LTO"|"fullLTO + NoMount + Clean LTO") ;;
+            *) echo "::error::Invalid LTO package" >&2; exit 1 ;;
+          esac
+          case "$BBG_INPUT" in true|false) ;; *) echo "::error::BBG must be true or false" >&2; exit 1 ;; esac
+          case "$NETWORKING_INPUT" in true|false) ;; *) echo "::error::Networking must be true or false" >&2; exit 1 ;; esac
           # Cogan builds kernel 6.1 only (owner decision 2026-10-16); the form offers nothing else.
           [[ "$KERNEL_VERSION_INPUT" == "6.1" ]] || { echo "::error::Cogan builds kernel 6.1 only" >&2; exit 1; }
           # "lts" (any case), "Auto" or empty mean the latest pinned sublevel.
@@ -160,6 +160,9 @@ jobs:
           KERNEL_VERSION_INPUT: ${{ inputs.KERNEL_VERSION }}
           KERNEL_SUBLEVEL_INPUT: ${{ inputs.KERNEL_SUBLEVEL }}
           BUILD_TIME_INPUT: ${{ inputs.BUILD_TIME }}
+          LTO_INPUT: ${{ inputs.LTO }}
+          BBG_INPUT: ${{ inputs.BBG }}
+          NETWORKING_INPUT: ${{ inputs.NETWORKING }}
         run: |
           {
             echo "## Cogan Kernel — Validation Summary"
@@ -169,13 +172,12 @@ jobs:
             echo "- Root manager: ${ROOT_MANAGER_INPUT}"
             echo "- Kernel: ${KERNEL_VERSION_INPUT} / sublevel ${KERNEL_SUBLEVEL_INPUT}"
             echo "- Build time: ${BUILD_TIME_INPUT}"
+            echo "- LTO: ${LTO_INPUT}; BBG: ${BBG_INPUT}; Networking: ${NETWORKING_INPUT}"
             echo "- Status validasi: ${VALIDATION_OUTCOME}"
             if [[ "${VALIDATION_OUTCOME}" != "success" ]]; then
               echo ""
               echo "**Persiapan gagal; kompilasi tidak dijalankan.**"
-              if [[ "${ROOT_MANAGER_INPUT}" == "KernelSU Next + SUSFS" || "${ROOT_MANAGER_INPUT}" == "KSUN + SUSFS & BakaSU + SUSFS" ]]; then
-                echo "KSUN + SUSFS butuh paket fullLTO, BBG aktif dan sublevel yang sudah diverifikasi: lts atau 167–177."
-              elif [[ "${ROOT_MANAGER_INPUT}" == *SUSFS* || "${ROOT_MANAGER_INPUT}" == "All variants (advanced)" ]]; then
+              if [[ "${ROOT_MANAGER_INPUT}" == *SUSFS* || "${ROOT_MANAGER_INPUT}" == "All variants (advanced)" ]]; then
                 echo "Varian SUSFS butuh sublevel lts atau 167 ke atas. Periksa pesan error pertama pada langkah **Validate sublevel, build time and optional features**."
               else
                 echo "Periksa pesan error pertama pada langkah **Validate sublevel, build time and optional features**."
@@ -192,13 +194,12 @@ jobs:
             echo "- Root manager: ${ROOT_MANAGER_INPUT}"
             echo "- Kernel: ${KERNEL_VERSION_INPUT} / sublevel ${KERNEL_SUBLEVEL_INPUT}"
             echo "- Build time: ${BUILD_TIME_INPUT}"
+            echo "- LTO: ${LTO_INPUT}; BBG: ${BBG_INPUT}; Networking: ${NETWORKING_INPUT}"
             echo "- Validation: ${VALIDATION_OUTCOME}"
             if [[ "${VALIDATION_OUTCOME}" != "success" ]]; then
               echo ""
               echo "**Preparation failed; no kernel compilation ran.**"
-              if [[ "${ROOT_MANAGER_INPUT}" == "KernelSU Next + SUSFS" || "${ROOT_MANAGER_INPUT}" == "KSUN + SUSFS & BakaSU + SUSFS" ]]; then
-                echo "KSUN + SUSFS needs a fullLTO package, BBG enabled and a verified sublevel: lts or 167–177."
-              elif [[ "${ROOT_MANAGER_INPUT}" == *SUSFS* || "${ROOT_MANAGER_INPUT}" == "All variants (advanced)" ]]; then
+              if [[ "${ROOT_MANAGER_INPUT}" == *SUSFS* || "${ROOT_MANAGER_INPUT}" == "All variants (advanced)" ]]; then
                 echo "SUSFS variants need sublevel lts or 167 and newer. Inspect the first error in **Validate sublevel, build time and optional features**."
               else
                 echo "Inspect the first error in **Validate sublevel, build time and optional features**."

diff --git a/.github/workflows/ksun-susfs-apply-check.yml b/.github/workflows/ksun-susfs-apply-check.yml
@@ -1,6 +1,19 @@
 name: KSUN SUSFS Patch Apply Check
 on:
   workflow_dispatch:
+    inputs:
+      KERNEL_SUBLEVEL:
+        description: "Kernel Sublevel (lts atau angka; SUSFS 6.1.167 ke atas)"
+        type: string
+        default: "lts"
+      BBG:
+        description: "BBG"
+        type: boolean
+        default: true
+      NETWORKING:
+        description: "Networking"
+        type: boolean
+        default: true
 
 permissions:
   contents: read
@@ -10,41 +23,39 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 25
     steps:
-      - name: Checkout project dev
+      - name: Checkout project
         uses: actions/checkout@v4
         with:
-          ref: dev
           persist-credentials: false
 
-      - name: Fetch pinned SUSFS source archive
-        shell: bash
+      - name: Resolve current kernel pin
+        id: source
+        env:
+          SUBLEVEL_INPUT: ${{ inputs.KERNEL_SUBLEVEL }}
         run: |
-          set -Eeuo pipefail
-          mkdir -p "$RUNNER_TEMP/susfs"
-          curl --fail --location --retry 2 --connect-timeout 20 \
-            'https://gitlab.com/pershoot/susfs4ksu/-/archive/a9bb4dd3ed248ada636b480bfdff70af704f1463/susfs4ksu-a9bb4dd3ed248ada636b480bfdff70af704f1463.tar.gz' \
-            -o "$RUNNER_TEMP/susfs.tar.gz"
-          tar -xzf "$RUNNER_TEMP/susfs.tar.gz" -C "$RUNNER_TEMP/susfs" --strip-components=1
+          set -euo pipefail
+          sublevel="$(python3 scripts/ksun_susfs_sublevel.py resolve "$SUBLEVEL_INPUT")"
+          commit="$(python3 scripts/ksun_susfs_sublevel.py commit "$sublevel")"
+          echo "sublevel=$sublevel" >> "$GITHUB_OUTPUT"
+          echo "commit=$commit" >> "$GITHUB_OUTPUT"
 
-      - name: Prepare locked SUSFS patch
-        shell: bash
+      - name: Fetch selected kernel and check production patch series
+        env:
+          KERNEL_COMMIT: ${{ steps.source.outputs.commit }}
+          SUBLEVEL: ${{ steps.source.outputs.sublevel }}
+          BBG: ${{ inputs.BBG }}
+          NETWORKING: ${{ inputs.NETWORKING }}
         run: |
-          set -Eeuo pipefail
-          python3 scripts/prepare_susfs_kernel_patch.py \
-            "$RUNNER_TEMP/susfs/kernel_patches/50_add_susfs_in_gki-android14-6.1.patch" \
-            "$RUNNER_TEMP/prepared-susfs.patch"
-
-      - name: Fetch locked kernel and check patch
-        shell: bash
-        run: |
-          set -Eeuo pipefail
-          git clone --filter=blob:none --no-checkout \
-            https://github.com/ahmed-alnassif/GKI-Duchamp-6.1.git \
-            "$RUNNER_TEMP/kernel"
-          cd "$RUNNER_TEMP/kernel"
-          git fetch --filter=blob:none origin a7ba124af5a535078d3f83b3e145f9cc8ec651b8
-          git checkout --detach a7ba124af5a535078d3f83b3e145f9cc8ec651b8
-          test "$(git rev-parse HEAD)" = a7ba124af5a535078d3f83b3e145f9cc8ec651b8
-          test -z "$(git status --porcelain)"
-          git apply --check --verbose "$RUNNER_TEMP/prepared-susfs.patch"
-          echo 'PASS: git apply --check'
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/ksun-susfs/kernel"
+          kernel="$RUNNER_TEMP/ksun-susfs/kernel"
+          git -C "$kernel" init -q
+          git -C "$kernel" fetch -q --depth=1 https://github.com/ahmed-alnassif/GKI-Duchamp-6.1.git "$KERNEL_COMMIT"
+          git -C "$kernel" checkout -q --detach FETCH_HEAD
+          python3 scripts/stage_ksun_susfs_candidate.py "$kernel" "$RUNNER_TEMP/ksun-susfs/ksun" "$SUBLEVEL"
+          {
+            echo '## KSUN + SUSFS — Patch Apply Check'
+            echo "Kernel: 6.1.$SUBLEVEL ($KERNEL_COMMIT); BBG=$BBG; Networking=$NETWORKING"
+            echo 'Patch berhasil diterapkan pada source terpilih. Kompilasi dan uji perangkat belum dijalankan.'
+            echo 'Patches applied to the selected source. Compilation and device testing have not run.'
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
@@ -49,6 +49,7 @@ jobs:
           python3 -m unittest discover -s tests -p 'test_ksun_susfs_preflight.py'
           python3 -m unittest discover -s tests -p 'test_ksun_susfs_replay.py'
           python3 -m unittest discover -s tests -p 'test_ksun_susfs_sublevel.py'
+          python3 -m unittest discover -s tests -p 'test_ksun_susfs_options.py'
           python3 -m unittest discover -s tests -p 'test_ksun_susfs_resolved_config.py'
           python3 -m unittest discover -s tests -p 'test_cogan_manual_update.py'
           python3 -m unittest discover -s tests -p 'test_apk_identity.py'

diff --git a/README.en.md b/README.en.md
@@ -54,7 +54,7 @@ A generic kernel built from GKI 6.1 sources ([GKI-Duchamp-6.1](https://github.co
 | KernelSU | `KernelSU` | KernelSU | ❌ | |
 | KernelSU + SUSFS | `KernelSU+SuSFS` | KernelSU | ✅ | |
 | KernelSU Next | `KernelSU-Next` | KernelSU Next | ❌ | |
-| KernelSU Next + SUSFS | `KernelSU-Next+SuSFS` | KernelSU Next (pershoot fork) | ✅ | Kernel **6.1.167–6.1.177** (`lts` = 177; every sublevel has locked trees), Full LTO, BBG enabled. BBRv3 and extra networking are **always on** (the Networking box is ignored) |
+| KernelSU Next + SUSFS | `KernelSU-Next+SuSFS` | KernelSU Next (pershoot fork) | ✅ | Kernel **6.1.167 and newer** from Manual Update pins (`lts` = current pin). None/Thin/Full LTO, BBG and Networking follow the form; no historical trial evidence or recorded trees required |
 | BakaSU + SUSFS | `BakaSU+SuSFS` | BakaSU | ✅ | **Suspended upstream** at pin `2489b38582a0`; waiting for a SUSFS compatibility update |
 | KSUN + SUSFS & BakaSU + SUSFS | `KernelSU-Next+SuSFS` and `BakaSU+SuSFS` | Both, separate ZIPs | ✅ | The two variants above in one run (KSUN + SUSFS rules apply) |
 | Vanilla | `Vanilla` | ❌ | ❌ | No root |
@@ -166,7 +166,7 @@ Open **Actions → Cogan Kernel Builder → Run workflow** in your repository.
 | Build Revision | Optional, `r` + digits (e.g. `r9`). Used in the kernel version (`6.1.177-Cogan-r9-…`), the ZIP name, the flasher banner and the release name; when empty, the run number is used. Rebuilding on the same day? Bump the revision (`r10`) so release names do not clash |
 | Kernel Sublevel | `lts` = latest, or just the number (e.g. `177`, not `6.1.177`); 6.1.160 and newer, SUSFS variants 6.1.167 and newer |
 | Build Time | `N` = real build time, or a fixed time such as `Thu Jan 1 00:00:00 UTC 2026` |
-| Networking | BBRv3 and extra networking (enabled by default; always on for KSUN + SUSFS) |
+| Networking | BBRv3 and extra networking (enabled by default; can be disabled for every variant) |
 | BBG | Baseband Guard (enabled by default) |
 
 **Build output:** a green run lists numbered artifacts you can download directly (no extraction needed):
@@ -178,7 +178,7 @@ Open **Actions → Cogan Kernel Builder → Run workflow** in your repository.
 | `3-MANAGER-SPOOFED_<root manager>_<version>.apk` | The same manager with a random package name, from the same commit; BakaSU CI builds are copied to `cogan-mirror` because Actions artifacts expire | Install **one**: 2 or 3 |
 | `4-NOMOUNT-MODULE_<version>.zip` | Official NoMount module, the same version as the NoMount in the kernel | Install in the manager → Modules |
 
-`build-…` and `build-env-…` artifacts are internal; ignore them. The run summary shows the same table with SHA256 values, plus a **Kernel features** line (e.g. `SUSFS, BBRv3 (default), BBG, NoMount, Full LTO`) read from the built config. The same line shows in Kernel Flasher while flashing. **Cogan Manual Update** pins all these versions together. When upstream has something newer (a GKID 6.1 kernel sublevel, SUSFS, a root manager or NoMount), the run summary shows a **🔔 Reminder**: run Cogan Manual Update (`update` → `kernel-6.1`, `susfs`, `root-managers` or `nomount`), then rebuild. The SUSFS reminder only appears on SUSFS variants. The KSUN + SUSFS variant gets no kernel or SUSFS reminder: its SUSFS is the frozen v2 source, and a new kernel sublevel can only be used after its trees are recorded with `scripts/ksun_susfs_sublevel.py record`.
+`build-…` and `build-env-…` artifacts are internal; ignore them. The run summary shows the same table with SHA256 values, plus a **Kernel features** line (e.g. `SUSFS, BBRv3 (default), BBG, NoMount, Full LTO`) read from the built config. The same line shows in Kernel Flasher while flashing. **Cogan Manual Update** pins all these versions together. When upstream has something newer (a GKID 6.1 kernel sublevel, SUSFS, a root manager or NoMount), the run summary shows a **🔔 Reminder**: run Cogan Manual Update (`update` → `kernel-6.1`, `susfs`, `root-managers` or `nomount`), then rebuild. The SUSFS reminder only appears on SUSFS variants. KSUN + SUSFS follows the same current kernel pin and gets kernel reminders. The pershoot fork's bundled SUSFS is updated separately from generic SUSFS. All LTO/BBG/Networking combinations can run without historical trial evidence; patch checksums, source compatibility and the resolved build configuration are checked on each build. Old test records remain an archive, not a feature unlock requirement.
 
 **Updating components:** open **Actions → Cogan Manual Update**.
 - `check` only reports versions.

diff --git a/README.md b/README.md
@@ -54,7 +54,7 @@ Kernel generik yang dibangun dari sumber GKI 6.1 ([GKI-Duchamp-6.1](https://gith
 | KernelSU | `KernelSU` | KernelSU | ❌ | |
 | KernelSU + SUSFS | `KernelSU+SuSFS` | KernelSU | ✅ | |
 | KernelSU Next | `KernelSU-Next` | KernelSU Next | ❌ | |
-| KernelSU Next + SUSFS | `KernelSU-Next+SuSFS` | KernelSU Next (fork pershoot) | ✅ | Kernel **6.1.167–6.1.177** (`lts` = 177; tiap sublevel punya tree terkunci), Full LTO, BBG aktif. BBRv3 dan paket jaringan tambahan **selalu aktif** (centang Networking diabaikan) |
+| KernelSU Next + SUSFS | `KernelSU-Next+SuSFS` | KernelSU Next (fork pershoot) | ✅ | Kernel **6.1.167 ke atas** dari pin Manual Update (`lts` = pin terbaru). None/Thin/Full LTO, BBG dan Networking mengikuti form; tidak perlu data percobaan atau pencatatan tree lama |
 | BakaSU + SUSFS | `BakaSU+SuSFS` | BakaSU | ✅ | **Ditahan upstream** pada pin `2489b38582a0`; menunggu pembaruan kompatibilitas SUSFS |
 | KSUN + SUSFS & BakaSU + SUSFS | `KernelSU-Next+SuSFS` dan `BakaSU+SuSFS` | Keduanya, ZIP terpisah | ✅ | Dua varian di atas dalam satu run (aturan KSUN + SUSFS berlaku) |
 | Vanilla | `Vanilla` | ❌ | ❌ | Tanpa root |
@@ -166,7 +166,7 @@ Buka **Actions → Cogan Kernel Builder → Run workflow** di repositori Anda.
 | Build Revision | Opsional, format `r` + angka (mis. `r9`). Dipakai di versi kernel (`6.1.177-Cogan-r9-…`), nama ZIP, banner flasher dan nama rilis; tanpa isian dipakai nomor run. Build ulang di hari yang sama? Naikkan revisinya (`r10`) agar nama rilis tidak bentrok |
 | Kernel Sublevel | `lts` = terbaru, atau angka saja (mis. `177`, bukan `6.1.177`); tersedia 6.1.160 ke atas, varian SUSFS 6.1.167 ke atas |
 | Build Time | `N` = waktu build asli, atau waktu tetap seperti `Thu Jan 1 00:00:00 UTC 2026` |
-| Networking | BBRv3 dan paket jaringan tambahan (default aktif; KSUN + SUSFS selalu aktif) |
+| Networking | BBRv3 dan paket jaringan tambahan (default aktif; bisa dimatikan pada semua varian) |
 | BBG | Baseband Guard (default aktif) |
 
 **Hasil build:** saat run hijau, artifact bernomor bisa langsung diunduh (tidak perlu diekstrak):
@@ -178,7 +178,7 @@ Buka **Actions → Cogan Kernel Builder → Run workflow** di repositori Anda.
 | `3-MANAGER-SPOOFED_<root manager>_<versi>.apk` | Manager yang sama dengan nama paket acak, dari commit yang sama; build CI BakaSU disalin ke `cogan-mirror` karena artifact Actions kedaluwarsa | Install **salah satu**: 2 atau 3 |
 | `4-NOMOUNT-MODULE_<versi>.zip` | Modul NoMount resmi, versi sama dengan NoMount di kernel | Pasang di manager → Modul |
 
-Artifact `build-…` dan `build-env-…` adalah file internal; abaikan saja. Ringkasan run berisi tabel yang sama beserta SHA256, dan baris **Fitur kernel** (mis. `SUSFS, BBRv3 (default), BBG, NoMount, Full LTO`) yang dibaca dari config hasil build. Baris yang sama muncul di Kernel Flasher saat flash. Semua versi ini dikunci bersama oleh **Cogan Manual Update**. Kalau upstream punya versi yang lebih baru (sublevel kernel GKID 6.1, SUSFS, root manager atau NoMount), ringkasan run menampilkan **🔔 Pengingat**: jalankan Cogan Manual Update (`update` → `kernel-6.1`, `susfs`, `root-managers` atau `nomount`), lalu build ulang. Pengingat SUSFS hanya muncul di varian SUSFS. Varian KSUN + SUSFS tidak mendapat pengingat kernel dan SUSFS: SUSFS-nya sumber v2 yang dibekukan, dan sublevel kernel baru baru bisa dipakai setelah tree-nya dicatat dengan `scripts/ksun_susfs_sublevel.py record`.
+Artifact `build-…` dan `build-env-…` adalah file internal; abaikan saja. Ringkasan run berisi tabel yang sama beserta SHA256, dan baris **Fitur kernel** (mis. `SUSFS, BBRv3 (default), BBG, NoMount, Full LTO`) yang dibaca dari config hasil build. Baris yang sama muncul di Kernel Flasher saat flash. Semua versi ini dikunci bersama oleh **Cogan Manual Update**. Kalau upstream punya versi yang lebih baru (sublevel kernel GKID 6.1, SUSFS, root manager atau NoMount), ringkasan run menampilkan **🔔 Pengingat**: jalankan Cogan Manual Update (`update` → `kernel-6.1`, `susfs`, `root-managers` atau `nomount`), lalu build ulang. Pengingat SUSFS hanya muncul di varian SUSFS. KSUN + SUSFS mengikuti pin kernel terbaru yang sama dan mendapat pengingat kernel. SUSFS bawaan fork pershoot diperbarui terpisah dari SUSFS generik. Semua kombinasi LTO/BBG/Networking bisa dijalankan tanpa bukti percobaan lama; checksum patch, kompatibilitas source dan konfigurasi hasil build tetap diperiksa pada setiap build. Catatan uji lama disimpan sebagai arsip, bukan syarat membuka fitur.
 
 **Memperbarui komponen:** buka **Actions → Cogan Manual Update**.
 - `check` hanya menampilkan laporan versi.