refactor: inline release notes renderer and split KernelSU forks into own docs

Remove the external .github/scripts/render_release_body.py and inline the
renderer as a Python heredoc directly in both workflow call sites (release
job + notes-preview job). No external script or template file dependency.

Split docs/kernelsu.md into per-fork files:
- docs/kernelsu-next.md (KernelSU-Next / pershoot fork)
- docs/kernelsu-classic.md (tiann/KernelSU)
- docs/resukisu.md (ReSukiSU)
Each contains description, source repos, and how the build uses it.
Update docs/index.md accordingly and link from other feature docs.

.github/scripts/render_release_body.py

@@ -1,186 +0,0 @@
-#!/usr/bin/env python3
-"""
-Render release notes dynamically from workflow environment variables.
-
-No static template file is read. The script assembles the markdown directly
-from env vars set by the workflow.
-
-Invoke without a template file argument:
-    python3 .github/scripts/render_release_body.py > release_body.md
-"""
-
-import json
-import os
-from pathlib import Path
-
-ROOT = Path(os.environ.get("GITHUB_WORKSPACE", "."))
-
-def env(name: str, default: str = "") -> str:
-    return os.environ.get(name, default).strip()
-
-def parse_managers(raw: str):
-    raw = raw.strip()
-    if not raw:
-        return []
-    try:
-        data = json.loads(raw)
-    except json.JSONDecodeError:
-        return []
-    if not isinstance(data, list):
-        return []
-    return data
-
-def build_preamble() -> str:
-    return (
-        "# Wild Kernels for GKI2 Devices\n\n"
-        "> [!CAUTION]\n"
-        "> This software is provided for testing and educational purposes only. "
-        "Use at your own risk. The developers are not responsible for any damage, "
-        "data loss, or issues that may occur. Please ensure you have proper backups "
-        "before installation.\n\n"
-        "Join the Telegram group: <https://t.me/WildKernelsTG>\n\n"
-        "---\n\n"
-    )
-
-def build_managers_section(managers) -> str:
-    if not managers:
-        return ""
-    flavor_labels = {"next": "KernelSU-Next", "kernelsu": "KernelSU", "resukisu": "ReSukiSU"}
-    lines = []
-    for m in managers:
-        flavor = m.get("flavor", "")
-        label = flavor_labels.get(flavor, flavor or "unknown")
-        run_id = m.get("run_id")
-        stock = m.get("stock", "")
-        if run_id:
-            url = f"https://github.com/{m.get('owner', '')}/{m.get('repo', '')}/actions/runs/{run_id}"
-            stock_note = f" (stock `{stock[:12]}`)" if stock else ""
-            lines.append(f"- **{label}:** [{url}]({url}){stock_note}")
-        else:
-            lines.append(f"- **{label}:** release assets")
-    return "**Managers:**\n" + "\n".join(lines) + "\n"
-
-def build_ksu_section() -> str:
-    version = env("KSU_VERSION", "unknown")
-    tag = env("KSU_GIT_TAG", "no-tag")
-    branch = env("KSUN_BRANCH", "dev")
-    commit = env("KSUN_COMMIT", "unknown")
-    manager_url = env("KSU_MANAGER", "")
-    manager_note = env("KSU_MANAGER_NOTE", "")
-    parts = ["## KernelSU", ""]
-    parts.append(f"- **Version:** `{version}`")
-    if tag and tag != "no-tag":
-        parts.append(f"- **Tag:** `{tag}`")
-    parts.append(f"- **Branch:** `{branch}`")
-    parts.append(f"- **Commit:** `{commit}`")
-    if manager_url:
-        note = f" — {manager_note}" if manager_note else ""
-        base = manager_url.split("/actions/")[0]
-        parts.append(f"- **Manager:** [{base}]({manager_url}){note}")
-    parts.append("")
-    return "\n".join(parts)
-
-def build_susfs_section() -> str:
-    variant_envs = [
-        ("android12-5.10", "susfs_commit_android12_5_10"),
-        ("android13-5.10", "susfs_commit_android13_5_10"),
-        ("android13-5.15", "susfs_commit_android13_5_15"),
-        ("android14-5.15", "susfs_commit_android14_5_15"),
-        ("android14-6.1", "susfs_commit_android14_6_1"),
-        ("android15-6.6", "susfs_commit_android15_6_6"),
-        ("android16-6.12", "susfs_commit_android16_6_12"),
-    ]
-    per_variant = []
-    for variant, env_key in variant_envs:
-        sha = env(env_key)
-        if sha and len(sha) == 40:
-            per_variant.append((variant, sha))
-    if per_variant:
-        parts = [
-            "## SUSFS",
-            "",
-            "Pinned SUSFS commits per Android/kernel variant:",
-            "",
-        ]
-        for variant, sha in per_variant:
-            parts.append(f"- **{variant}:** `{sha}`")
-        parts.append("")
-        return "\n".join(parts)
-    sha = env("SUSFS_COMMIT", "")
-    if sha:
-        return f"## SUSFS\n\n- **Commit:** `{sha}`\n"
-    return ""
-
-def build_root_section() -> str:
-    root_flavor = env("ROOT_FLAVOR", "unknown")
-    feature_set = env("FEATURE_SET", "")
-    parts = ["## This Build", ""]
-    parts.append(f"- **Root:** `{root_flavor}`")
-    if feature_set:
-        parts.append(f"- **Feature Set:** `{feature_set}`")
-    parts.append("")
-    return "\n".join(parts)
-
-def build_features_section() -> str:
-    enabled = []
-    if env("USE_SUSFS", "true") == "true":
-        enabled.append("SUSFS")
-    if env("USE_BBG", "true") == "true":
-        enabled.append("Baseband Guard")
-    if env("USE_DS", "true") == "true":
-        enabled.append("DroidSpaces-OSS")
-    if env("USE_NET", "true") == "true":
-        enabled.append("Networking")
-    if env("USE_NTSYNC", "true") == "true":
-        enabled.append("NTSync")
-    if env("USE_PTRACE", "true") == "true":
-        enabled.append("Ptrace Leak Fix")
-    if env("USE_UNICODE", "true") == "true":
-        enabled.append("Unicode Fix")
-    if env("USE_BPF", "true") == "true":
-        enabled.append("BTF / eBPF / FUSE-BPF")
-    if env("USE_PERF", "true") == "true":
-        enabled.append("Performance Tuning")
-
-    if not enabled:
-        return ""
-
-    parts = [
-        "## Features Included",
-        "",
-        "Each feature is documented separately in `docs/`:",
-        "",
-    ]
-    feature_doc_map = [
-        ("SUSFS", "susfs.md"),
-        ("Baseband Guard", "bbg.md"),
-        ("DroidSpaces-OSS", "droidspaces.md"),
-        ("Networking", "networking.md"),
-        ("NTSync", "ntsync.md"),
-        ("Ptrace Leak Fix", "ptrace.md"),
-        ("Unicode Fix", "unicode.md"),
-        ("BTF / eBPF / FUSE-BPF", "bpf.md"),
-        ("Performance Tuning", "performance.md"),
-    ]
-    for feature, doc in feature_doc_map:
-        if feature in enabled:
-            parts.append(f"- [{feature}](docs/{doc})")
-    parts.append("")
-    return "\n".join(parts)
-
-def render() -> str:
-    parts = []
-    parts.append(build_preamble())
-    parts.append(build_root_section())
-    parts.append(build_ksu_section())
-    parts.append(build_susfs_section())
-    parts.append(build_managers_section(parse_managers(env("MANAGER_LIST", ""))))
-    parts.append(build_features_section())
-    return "\n".join(parts)
-
-if __name__ == "__main__":
-    output = render()
-    print(output, end="")
-    step_summary = os.environ.get("GITHUB_STEP_SUMMARY")
-    if step_summary:
-        Path(step_summary).write_text(output)

.github/workflows/main.yml

@@ -1148,7 +1148,166 @@ jobs:
 
         : > release_body.md
 
-        python3 .github/scripts/render_release_body.py > release_body.md
+        python3 - <<'PYEOF' > release_body.md
+        import json
+        import os
+        from pathlib import Path
+
+        def env(name, default=""):
+            return os.environ.get(name, default).strip()
+
+        def parse_managers(raw):
+            raw = raw.strip()
+            if not raw:
+                return []
+            try:
+                data = json.loads(raw)
+            except json.JSONDecodeError:
+                return []
+            return data if isinstance(data, list) else []
+
+        def build_preamble():
+            return (
+                "# Wild Kernels for GKI2 Devices\n\n"
+                "> [!CAUTION]\n"
+                "> This software is provided for testing and educational purposes only. "
+                "Use at your own risk. The developers are not responsible for any damage, "
+                "data loss, or issues that may occur. Please ensure you have proper backups "
+                "before installation.\n\n"
+                "Join the Telegram group: <https://t.me/WildKernelsTG>\n\n"
+                "---\n\n"
+            )
+
+        def build_managers_section(managers):
+            if not managers:
+                return ""
+            flavor_labels = {"next": "KernelSU-Next", "kernelsu": "KernelSU", "resukisu": "ReSukiSU"}
+            lines = []
+            for m in managers:
+                flavor = m.get("flavor", "")
+                label = flavor_labels.get(flavor, flavor or "unknown")
+                run_id = m.get("run_id")
+                stock = m.get("stock", "")
+                if run_id:
+                    url = f"https://github.com/{m.get('owner','')}/{m.get('repo','')}/actions/runs/{run_id}"
+                    stock_note = f" (stock `{stock[:12]}`)" if stock else ""
+                    lines.append(f"- **{label}:** [{url}]({url}){stock_note}")
+                else:
+                    lines.append(f"- **{label}:** release assets")
+            return "**Managers:**\n" + "\n".join(lines) + "\n"
+
+        def build_ksu_section():
+            version = env("KSU_VERSION", "unknown")
+            tag = env("KSU_GIT_TAG", "no-tag")
+            branch = env("KSUN_BRANCH", "dev")
+            commit = env("KSUN_COMMIT", "unknown")
+            manager_url = env("KSU_MANAGER", "")
+            manager_note = env("KSU_MANAGER_NOTE", "")
+            parts = ["## KernelSU", ""]
+            parts.append(f"- **Version:** `{version}`")
+            if tag and tag != "no-tag":
+                parts.append(f"- **Tag:** `{tag}`")
+            parts.append(f"- **Branch:** `{branch}`")
+            parts.append(f"- **Commit:** `{commit}`")
+            if manager_url:
+                note = f" — {manager_note}" if manager_note else ""
+                base = manager_url.split("/actions/")[0]
+                parts.append(f"- **Manager:** [{base}]({manager_url}){note}")
+            parts.append("")
+            return "\n".join(parts)
+
+        def build_susfs_section():
+            variant_envs = [
+                ("android12-5.10", "susfs_commit_android12_5_10"),
+                ("android13-5.10", "susfs_commit_android13_5_10"),
+                ("android13-5.15", "susfs_commit_android13_5_15"),
+                ("android14-5.15", "susfs_commit_android14_5_15"),
+                ("android14-6.1", "susfs_commit_android14_6_1"),
+                ("android15-6.6", "susfs_commit_android15_6_6"),
+                ("android16-6.12", "susfs_commit_android16_6_12"),
+            ]
+            per_variant = []
+            for variant, env_key in variant_envs:
+                sha = env(env_key)
+                if sha and len(sha) == 40:
+                    per_variant.append((variant, sha))
+            if per_variant:
+                parts = ["## SUSFS", "", "Pinned SUSFS commits per Android/kernel variant:", ""]
+                for variant, sha in per_variant:
+                    parts.append(f"- **{variant}:** `{sha}`")
+                parts.append("")
+                return "\n".join(parts)
+            sha = env("SUSFS_COMMIT", "")
+            if sha:
+                return f"## SUSFS\n\n- **Commit:** `{sha}`\n"
+            return ""
+
+        def build_root_section():
+            root_flavor = env("ROOT_FLAVOR", "unknown")
+            feature_set = env("FEATURE_SET", "")
+            parts = ["## This Build", ""]
+            parts.append(f"- **Root:** `{root_flavor}`")
+            if feature_set:
+                parts.append(f"- **Feature Set:** `{feature_set}`")
+            parts.append("")
+            return "\n".join(parts)
+
+        def build_features_section():
+            enabled = []
+            if env("USE_SUSFS", "true") == "true":
+                enabled.append("SUSFS")
+            if env("USE_BBG", "true") == "true":
+                enabled.append("Baseband Guard")
+            if env("USE_DS", "true") == "true":
+                enabled.append("DroidSpaces-OSS")
+            if env("USE_NET", "true") == "true":
+                enabled.append("Networking")
+            if env("USE_NTSYNC", "true") == "true":
+                enabled.append("NTSync")
+            if env("USE_PTRACE", "true") == "true":
+                enabled.append("Ptrace Leak Fix")
+            if env("USE_UNICODE", "true") == "true":
+                enabled.append("Unicode Fix")
+            if env("USE_BPF", "true") == "true":
+                enabled.append("BTF / eBPF / FUSE-BPF")
+            if env("USE_PERF", "true") == "true":
+                enabled.append("Performance Tuning")
+            if not enabled:
+                return ""
+            parts = ["## Features Included", "", "Each feature is documented separately in `docs/`:", ""]
+            feature_doc_map = [
+                ("SUSFS", "susfs.md"),
+                ("Baseband Guard", "bbg.md"),
+                ("DroidSpaces-OSS", "droidspaces.md"),
+                ("Networking", "networking.md"),
+                ("NTSync", "ntsync.md"),
+                ("Ptrace Leak Fix", "ptrace.md"),
+                ("Unicode Fix", "unicode.md"),
+                ("BTF / eBPF / FUSE-BPF", "bpf.md"),
+                ("Performance Tuning", "performance.md"),
+            ]
+            for feature, doc in feature_doc_map:
+                if feature in enabled:
+                    parts.append(f"- [{feature}](docs/{doc})")
+            parts.append("")
+            return "\n".join(parts)
+
+        def render():
+            parts = []
+            parts.append(build_preamble())
+            parts.append(build_root_section())
+            parts.append(build_ksu_section())
+            parts.append(build_susfs_section())
+            parts.append(build_managers_section(parse_managers(env("MANAGER_LIST", ""))))
+            parts.append(build_features_section())
+            return "\n".join(parts)
+
+        output = render()
+        print(output, end="")
+        summary = os.environ.get("GITHUB_STEP_SUMMARY")
+        if summary:
+            Path(summary).write_text(output)
+        PYEOF
 
     - name: Publish release notes preview
       run: |
@@ -1249,7 +1408,163 @@ jobs:
           # KSU version not computed here; render will show placeholder if release job skipped
         run: |
           set -e
-          python3 .github/scripts/render_release_body.py > release_body.md
+          python3 - <<'PYEOF' > release_body.md
+          import json
+          import os
+          from pathlib import Path
+
+          def env(name, default=""):
+              return os.environ.get(name, default).strip()
+
+          def parse_managers(raw):
+              raw = raw.strip()
+              if not raw:
+                  return []
+              try:
+                  data = json.loads(raw)
+              except json.JSONDecodeError:
+                  return []
+              return data if isinstance(data, list) else []
+
+          def build_preamble():
+              return (
+                  "# Wild Kernels for GKI2 Devices\n\n"
+                  "> [!CAUTION]\n"
+                  "> This software is provided for testing and educational purposes only. "
+                  "Use at your own risk. The developers are not responsible for any damage, "
+                  "data loss, or issues that may occur. Please ensure you have proper backups "
+                  "before installation.\n\n"
+                  "Join the Telegram group: <https://t.me/WildKernelsTG>\n\n"
+                  "---\n\n"
+              )
+
+          def build_managers_section(managers):
+              if not managers:
+                  return ""
+              flavor_labels = {"next": "KernelSU-Next", "kernelsu": "KernelSU", "resukisu": "ReSukiSU"}
+              lines = []
+              for m in managers:
+                  flavor = m.get("flavor", "")
+                  label = flavor_labels.get(flavor, flavor or "unknown")
+                  run_id = m.get("run_id")
+                  stock = m.get("stock", "")
+                  if run_id:
+                      url = f"https://github.com/{m.get('owner','')}/{m.get('repo','')}/actions/runs/{run_id}"
+                      stock_note = f" (stock `{stock[:12]}`)" if stock else ""
+                      lines.append(f"- **{label}:** [{url}]({url}){stock_note}")
+                  else:
+                      lines.append(f"- **{label}:** release assets")
+              return "**Managers:**\n" + "\n".join(lines) + "\n"
+
+          def build_ksu_section():
+              version = env("KSU_VERSION", "unknown")
+              tag = env("KSU_GIT_TAG", "no-tag")
+              branch = env("KSUN_BRANCH", "dev")
+              commit = env("KSUN_COMMIT", "unknown")
+              manager_url = env("KSU_MANAGER", "")
+              manager_note = env("KSU_MANAGER_NOTE", "")
+              parts = ["## KernelSU", ""]
+              parts.append(f"- **Version:** `{version}`")
+              if tag and tag != "no-tag":
+                  parts.append(f"- **Tag:** `{tag}`")
+              parts.append(f"- **Branch:** `{branch}`")
+              parts.append(f"- **Commit:** `{commit}`")
+              if manager_url:
+                  note = f" — {manager_note}" if manager_note else ""
+                  base = manager_url.split("/actions/")[0]
+                  parts.append(f"- **Manager:** [{base}]({manager_url}){note}")
+              parts.append("")
+              return "\n".join(parts)
+
+          def build_susfs_section():
+              variant_envs = [
+                  ("android12-5.10", "susfs_commit_android12_5_10"),
+                  ("android13-5.10", "susfs_commit_android13_5_10"),
+                  ("android13-5.15", "susfs_commit_android13_5_15"),
+                  ("android14-5.15", "susfs_commit_android14_5_15"),
+                  ("android14-6.1", "susfs_commit_android14_6_1"),
+                  ("android15-6.6", "susfs_commit_android15_6_6"),
+                  ("android16-6.12", "susfs_commit_android16_6_12"),
+              ]
+              per_variant = []
+              for variant, env_key in variant_envs:
+                  sha = env(env_key)
+                  if sha and len(sha) == 40:
+                      per_variant.append((variant, sha))
+              if per_variant:
+                  parts = ["## SUSFS", "", "Pinned SUSFS commits per Android/kernel variant:", ""]
+                  for variant, sha in per_variant:
+                      parts.append(f"- **{variant}:** `{sha}`")
+                  parts.append("")
+                  return "\n".join(parts)
+              sha = env("SUSFS_COMMIT", "")
+              if sha:
+                  return f"## SUSFS\n\n- **Commit:** `{sha}`\n"
+              return ""
+
+          def build_root_section():
+              root_flavor = env("ROOT_FLAVOR", "unknown")
+              feature_set = env("FEATURE_SET", "")
+              parts = ["## This Build", ""]
+              parts.append(f"- **Root:** `{root_flavor}`")
+              if feature_set:
+                  parts.append(f"- **Feature Set:** `{feature_set}`")
+              parts.append("")
+              return "\n".join(parts)
+
+          def build_features_section():
+              enabled = []
+              if env("USE_SUSFS", "true") == "true":
+                  enabled.append("SUSFS")
+              if env("USE_BBG", "true") == "true":
+                  enabled.append("Baseband Guard")
+              if env("USE_DS", "true") == "true":
+                  enabled.append("DroidSpaces-OSS")
+              if env("USE_NET", "true") == "true":
+                  enabled.append("Networking")
+              if env("USE_NTSYNC", "true") == "true":
+                  enabled.append("NTSync")
+              if env("USE_PTRACE", "true") == "true":
+                  enabled.append("Ptrace Leak Fix")
+              if env("USE_UNICODE", "true") == "true":
+                  enabled.append("Unicode Fix")
+              if env("USE_BPF", "true") == "true":
+                  enabled.append("BTF / eBPF / FUSE-BPF")
+              if env("USE_PERF", "true") == "true":
+                  enabled.append("Performance Tuning")
+              if not enabled:
+                  return ""
+              parts = ["## Features Included", "", "Each feature is documented separately in `docs/`:", ""]
+              feature_doc_map = [
+                  ("SUSFS", "susfs.md"),
+                  ("Baseband Guard", "bbg.md"),
+                  ("DroidSpaces-OSS", "droidspaces.md"),
+                  ("Networking", "networking.md"),
+                  ("NTSync", "ntsync.md"),
+                  ("Ptrace Leak Fix", "ptrace.md"),
+                  ("Unicode Fix", "unicode.md"),
+                  ("BTF / eBPF / FUSE-BPF", "bpf.md"),
+                  ("Performance Tuning", "performance.md"),
+              ]
+              for feature, doc in feature_doc_map:
+                  if feature in enabled:
+                      parts.append(f"- [{feature}](docs/{doc})")
+              parts.append("")
+              return "\n".join(parts)
+
+          def render():
+              parts = []
+              parts.append(build_preamble())
+              parts.append(build_root_section())
+              parts.append(build_ksu_section())
+              parts.append(build_susfs_section())
+              parts.append(build_managers_section(parse_managers(env("MANAGER_LIST", ""))))
+              parts.append(build_features_section())
+              return "\n".join(parts)
+
+          output = render()
+          print(output, end="")
+          PYEOF
           {
             echo "## Release Notes Preview (CI Summary)"
             echo

docs/index.md

@@ -4,63 +4,63 @@ Per-feature documentation for the GKI2 kernels built from this repository.
 
 ## Root Implementations
 
-| Feature | Doc | Source |
-|---------|-----|--------|
-| KernelSU-Next | [kernelsu.md](kernelsu.md) | [KernelSU-Next/KernelSU-Next](https://github.com/KernelSU-Next/KernelSU-Next) |
-| KernelSU | [kernelsu.md](kernelsu.md) | [tiann/KernelSU](https://github.com/tiann/KernelSU) |
-| ReSukiSU | [kernelsu.md](kernelsu.md) | [ReSukiSU/ReSukiSU](https://github.com/ReSukiSU/ReSukiSU) |
-| NoMount | [nomount.md](nomount.md) | [maxsteeel/nomount](https://github.com/maxsteeel/nomount) |
+| Root Flavor | Description | Upstream |
+|-------------|-------------|----------|
+| KernelSU-Next | Root solution for GKI devices, original KernelSU-Next implementation, always at latest dev-tip. SUSFS-enabled builds sourced from pershoot fork. | [KernelSU-Next/KernelSU-Next](https://github.com/KernelSU-Next/KernelSU-Next) · [pershoot/KernelSU-Next](https://github.com/pershoot/KernelSU-Next) |
+| KernelSU (Classic) | Original KernelSU by tiann, pinned to verified commit. SUSFS patches applied during build. | [tiann/KernelSU](https://github.com/tiann/KernelSU) |
+| ReSukiSU | ReSukiSU root fork, pinned to verified commit. Own SUSFS pins per flavor. | [ReSukiSU/ReSukiSU](https://github.com/ReSukiSU/ReSukiSU) |
+| NoMount | Metamodule providing mount-related functionality alongside root implementations. | [maxsteeel/nomount](https://github.com/maxsteeel/nomount) |
 
 ## Root Hiding & Security
 
-| Feature | Doc | Source |
-|---------|-----|--------|
-| SUSFS | [susfs.md](susfs.md) | [simonpunk/susfs4ksu](https://gitlab.com/simonpunk/susfs4ksu) |
-| Baseband Guard | [bbg.md](bbg.md) | [vc-teahouse/Baseband-guard](https://github.com/vc-teahouse/Baseband-guard) |
+| Feature | Description | Source |
+|---------|-------------|--------|
+| SUSFS | Root-hiding add-on for KernelSU using kernel patches and a userspace module. | [simonpunk/susfs4ksu](https://gitlab.com/simonpunk/susfs4ksu) |
+| Baseband Guard | Lightweight LSM blocking unauthorized writes to critical partitions and device nodes. | [vc-teahouse/Baseband-guard](https://github.com/vc-teahouse/Baseband-guard) |
 
 ## Kernel Modules & Compatibility
 
-| Feature | Doc | Source |
-|---------|-----|--------|
-| NTSync | [ntsync.md](ntsync.md) | Internal (synthesized from kernel feature set) |
+| Feature | Description | Source |
+|---------|-------------|--------|
+| NTSync | High-performance synchronization primitives compatible with Windows NT kernel API. | Internal |
 
 ## Networking
 
-| Feature | Doc | Source |
-|---------|-----|--------|
-| TCP Congestion Control (BBRv1, BBRv3, CUBIC, BIC, Westwood, HTCP) | [networking.md](networking.md) | Upstream kernel |
-| WireGuard | [networking.md](networking.md) | [wireguard/wireguard-linux-compat](https://git.zx2c4.com/wireguard-linux-compat/) |
-| IP Set / IPv6 NAT | [networking.md](networking.md) | Upstream kernel |
-| Conntrack / connmark | [networking.md](networking.md) | Upstream kernel |
-| CIFS (SMB/CIFS) | [networking.md](networking.md) | Upstream kernel |
-| TTL Target | [networking.md](networking.md) | Upstream kernel |
+| Feature | Description | Source |
+|---------|-------------|--------|
+| TCP Congestion Control | BBRv1, BBRv3, CUBIC, BIC, Westwood, HTCP | Upstream kernel |
+| WireGuard | Built-in VPN support | [wireguard/wireguard-linux-compat](https://git.zx2c4.com/wireguard-linux-compat/) |
+| IP Set / IPv6 NAT | Advanced firewall capabilities | Upstream kernel |
+| Conntrack / connmark | Connection marking for packet classification | Upstream kernel |
+| CIFS | SMB/CIFS network filesystem | Upstream kernel |
+| TTL Target | Network packet manipulation | Upstream kernel |
 
 ## Filesystem & Storage
 
-| Feature | Doc | Source |
-|---------|-----|--------|
-| TMPFS Extended Attributes | [tmpfs.md](tmpfs.md) | Upstream kernel |
-| TMPFS POSIX ACLs | [tmpfs.md](tmpfs.md) | Upstream kernel |
+| Feature | Description | Source |
+|---------|-------------|--------|
+| TMPFS Extended Attributes | Extended attributes on tmpfs | Upstream kernel |
+| TMPFS POSIX ACLs | POSIX ACL support on tmpfs | Upstream kernel |
 
 ## Debugging, Tracing & BPF
 
-| Feature | Doc | Source |
-|---------|-----|--------|
-| BTF / eBPF / FUSE-BPF | [bpf.md](bpf.md) | Upstream kernel |
-| Ptrace Leak Fix | [ptrace.md](ptrace.md) | Upstream kernel community |
-| Unicode Fix | [unicode.md](unicode.md) | Internal |
+| Feature | Description | Source |
+|---------|-------------|--------|
+| BTF / eBPF / FUSE-BPF | BPF Type Format, extended BPF, FUSE-BPF interaction | Upstream kernel |
+| Ptrace Leak Fix | Fixes ptrace info leak on kernels older than 5.16 | Upstream kernel community |
+| Unicode Fix | Prevents path traversal via non-printable Unicode (experimental) | Internal |
 
 ## Performance
 
-| Feature | Doc | Source |
-|---------|-----|--------|
-| Performance Tuning | [performance.md](performance.md) | Upstream kernel |
+| Feature | Description | Source |
+|---------|-------------|--------|
+| Performance Tuning | Kernel configuration and tuning options | Upstream kernel |
 
 ## Container Runtime
 
-| Feature | Doc | Source |
-|---------|-----|--------|
-| DroidSpaces-OSS | [droidspaces.md](droidspaces.md) | [ravindu644/Droidspaces-OSS](https://github.com/ravindu644/Droidspaces-OSS) |
+| Feature | Description | Source |
+|---------|-------------|--------|
+| DroidSpaces-OSS | LXC-inspired container runtime for Android/Linux | [ravindu644/Droidspaces-OSS](https://github.com/ravindu644/Droidspaces-OSS) |
 
 ---
 

docs/kernelsu-classic.md

@@ -0,0 +1,27 @@
+# KernelSU (Classic)
+
+Classic KernelSU is a root solution for Android GKI devices that operates in kernel mode and grants root permission to userspace applications from kernel space. It is the original implementation by `tiann`.
+
+## Source
+
+- **Upstream:** [tiann/KernelSU](https://github.com/tiann/KernelSU) (`main` branch)
+- **Pinned commit:** `932014ab5b2c9b74a3d11e2ec4d17dd10fc9442e`
+
+Pinned in `main.yml` as `PIN_KERNELSU` and resolved via `pick` so builds are always verified against an exact commit.
+
+## How This Repo Uses It
+
+- Built when `root_flavor` is **`KernelSU`** or **`All`**.
+- SUSFS patches are applied during the build workflow (when `use_susfs` is enabled) rather than sourced from a SUSFS-enabled fork.
+- Resolved at the pinned commit in verified mode; at latest `main` tip in latest mode.
+
+## Manager
+
+The KernelSU manager APK is built from `tiann/KernelSU`. The manager version should match the kernel version (e.g., kernel version `30100` → manager version `30100`).
+
+## Related
+
+- [kernelsu-next.md](kernelsu-next.md) — KernelSU-Next
+- [resukisu.md](resukisu.md) — ReSukiSU
+- [susfs.md](susfs.md) — root hiding add-on
+- [index.md](../index.md) — full feature index

docs/kernelsu-next.md

@@ -0,0 +1,26 @@
+# KernelSU-Next
+
+KernelSU-Next is a root solution for Android GKI devices that operates in kernel mode and grants root permission to userspace applications from kernel space.
+
+## Source
+
+- **Official:** [KernelSU-Next/KernelSU-Next](https://github.com/KernelSU-Next/KernelSU-Next) (`dev` branch)
+- **SUSFS-enabled fork:** [pershoot/KernelSU-Next](https://github.com/pershoot/KernelSU-Next) (`dev-susfs` branch, used when `use_susfs` is enabled)
+
+## How This Repo Uses It
+
+- Built when `root_flavor` is **`KernelSU-Next`** or **`All`**.
+- With SUSFS enabled, kernel sources come from the `pershoot/KernelSU-Next` fork.
+- Without SUSFS, kernel sources come from the official `KernelSU-Next/KernelSU-Next` `dev` branch.
+- Always resolves at latest dev-tip (not pinned).
+
+## Manager
+
+The KernelSU-Next manager APK is built from the official `KernelSU-Next/KernelSU-Next` repo and must match the kernel version (e.g., kernel version `30100` → manager version `30100`).
+
+## Related
+
+- [kernelsu-classic.md](kernelsu-classic.md) — classic KernelSU
+- [resukisu.md](resukisu.md) — ReSukiSU
+- [susfs.md](susfs.md) — root hiding add-on
+- [index.md](../index.md) — full feature index

docs/kernelsu.md

@@ -1,38 +0,0 @@
-# KernelSU / KernelSU-Next / ReSukiSU
-
-KernelSU is a root solution for Android GKI devices that operates in kernel mode and grants root permission to userspace applications directly from kernel space.
-
-This repository builds kernels that integrate KernelSU, KernelSU-Next, and ReSukiSU depending on the selected `root_flavor` at build time.
-
-## Source Locations
-
-| Implementation | Upstream Repository | Branch Used |
-|----------------|---------------------|-------------|
-| KernelSU-Next (manager) | [KernelSU-Next/KernelSU-Next](https://github.com/KernelSU-Next/KernelSU-Next) | `dev` |
-| KernelSU-Next (kernel with SUSFS) | [pershoot/KernelSU-Next](https://github.com/pershoot/KernelSU-Next) | `dev-susfs` (when SUSFS enabled) |
-| KernelSU (classic) | [tiann/KernelSU](https://github.com/tiann/KernelSU) | `main` |
-| ReSukiSU | [ReSukiSU/ReSukiSU](https://github.com/ReSukiSU/ReSukiSU) | `main` |
-
-## Manager
-
-Each root implementation ships its own KernelSU Manager APK. The manager must match the kernel version for full compatibility.
-
-- **KernelSU-Next manager:** built from the official `KernelSU-Next/KernelSU-Next` repo at `dev`-tip.
-- **KernelSU manager:** built from `tiann/KernelSU`.
-- **ReSukiSU manager:** built from `ReSukiSU/ReSukiSU`.
-
-## Version Compatibility
-
-Ensure the manager version and the kernel version match. For example, if the kernel reports version `30100`, use manager version `30100`.
-
-## SUSFS Integration
-
-When `use_susfs` is enabled, KernelSU-Next kernels are sourced from the `pershoot/KernelSU-Next` fork on the `dev-susfs` branch. Classic KernelSU and ReSukiSU get SUSFS patches applied during the build workflow.
-
-For more on the root-hiding side of SUSFS, see [susfs.md](susfs.md).
-
-## Related
-
-- [susfs.md](susfs.md) — root hiding add-on
-- [nomount.md](nomount.md) — NoMount metamodule
-- [index.md](../index.md) — full feature index

docs/resukisu.md

@@ -0,0 +1,27 @@
+# ReSukiSU
+
+ReSukiSU is a root solution for Android GKI devices that operates in kernel mode and grants root permission to userspace applications from kernel space. It is a fork/variant of KernelSU maintained by the ReSukiSU project.
+
+## Source
+
+- **Upstream:** [ReSukiSU/ReSukiSU](https://github.com/ReSukiSU/ReSukiSU) (`main` branch)
+- **Pinned commit:** `03b60f260cce36f23efbd26c9c334edfdc9ce7eb`
+
+Pinned in `main.yml` as `PIN_RESUKISU` and resolved via `pick` so builds are always verified against an exact commit.
+
+## How This Repo Uses It
+
+- Built when `root_flavor` is **`ReSukiSU`** or **`All`**.
+- SUSFS patches are applied during the build workflow (when `use_susfs` is enabled), and ReSukiSU also has its own per-flavor SUSFS pins.
+- Resolved at the pinned commit in verified mode; at latest `main` tip in latest mode.
+
+## Manager
+
+The ReSukiSU manager APK is built from `ReSukiSU/ReSukiSU`. The manager version should match the kernel version (e.g., kernel version `30100` → manager version `30100`).
+
+## Related
+
+- [kernelsu-next.md](kernelsu-next.md) — KernelSU-Next
+- [kernelsu-classic.md](kernelsu-classic.md) — classic KernelSU
+- [susfs.md](susfs.md) — root hiding add-on
+- [index.md](../index.md) — full feature index

docs/susfs.md

@@ -2,13 +2,10 @@
 
 SUSFS is a KernelSU add-on that provides root-hiding mechanisms using kernel patches and a userspace module.
 
-Implemented by [simonpunk](https://gitlab.com/simonpunk/susfs4ksu), the kernel patches are integrated into the builds from this repository when `use_susfs` is enabled.
-
 ## Source
 
 - **Upstream:** [simonpunk/susfs4ksu](https://gitlab.com/simonpunk/susfs4ksu)
-- **Module (userspace add-on):** [susfs4ksu-module by sidex15](https://github.com/sidex15/susfs4ksu-module)
-- **Recommended module:** [sidex15/susfs4ksu-module](https://github.com/sidex15/susfs4ksu-module)
+- **Module (userspace add-on):** [sidex15/susfs4ksu-module](https://github.com/sidex15/susfs4ksu-module)
 
 ## Capabilities
 
@@ -24,22 +21,15 @@ SUSFS provides multiple root-hiding and spoofing capabilities:
 | `HIDE_KSU_SUSFS_SYMBOLS` | Automatically hide KSU and SUSFS symbols from `/proc/kallsyms`. Effective on all processes. |
 | `SPOOF_CMDLINE_OR_BOOTCONFIG` | Spoof `/proc/bootconfig` (GKI) or `/proc/cmdline` (non-GKI) output with a user-defined file. Effective on all processes. |
 | `OPEN_REDIRECT` | Redirect a target path to be opened with another user-defined path. Both paths must exist before they can be added. Requires SELinux permissions for both paths. Effective only on processes with a pre-defined UID scheme. |
-| `SUS_MAP` | Hide mmapped real files from `/proc/<pid>/[maps\|smaps\|smaps_rollup\|map_files\|mem\|pagemap]`. No anonymous-memory support; does not hide inline/PLT hooks caused by the injected library itself. May not evade strong injection detection. Effective only on zygote-spawned unmounted user app processes with `uid >= 10000`. |
+| `SUS_MAP` | Hide mmapped real files from `/proc/<pid>/[maps|smaps|smaps_rollup|map_files|mem|pagemap]`. No anonymous-memory support; does not hide inline/PLT hooks caused by the injected library itself. May not evade strong injection detection. Effective only on zygote-spawned unmounted user app processes with `uid >= 10000`. |
 | `AVC_SPOOF` | Spoof procfs AVC denial logs. Enabled at runtime via the sidex15 module — not a build-time Kconfig option. |
 
 ## Build Integration
 
-In this repository, SUSFS kernel patches are applied per Android/kernel version variant. The pinned SUSFS commits per variant are defined in the build workflow (see `.github/workflows/main.yml`).
+In this repository, SUSFS kernel patches are applied per Android/kernel version variant. The pinned SUSFS commits per variant are defined in the build workflow (`.github/workflows/main.yml`).
 
 SUSFS is always built at the latest branch tip when the root flavor is KernelSU-Next; for KernelSU and ReSukiSU, it uses the audited pinned commits.
 
-## Usage Notes
-
-- Some capabilities are effective only on zygote-spawned user app processes with `uid >= 10000`. This is a fundamental limitation of how the hooks are applied.
-- `OPEN_REDIRECT` does **not** bypass detections by itself; SELinux permissions for both paths are the user's responsibility.
-- `SUS_MAP` does not hide inline or PLT hooks caused by the injected library itself, and may not evade strong injection detection.
-
 ## Related
 
-- [kernelsu.md](kernelsu.md) — root implementation
 - [index.md](../index.md) — full feature index