Steps to reproduce/复现步骤

1. Install Vector module (KernelSU-Next + Zygisk Next), reboot.
2. Open the manager either way:
   (a) Parasitic: tap the "Vector loaded" notification, or
   am start -c org.matrix.vector.manager.LAUNCH_MANAGER com.android.shell/.BugreportWarningActivity
   (b) Standalone: pm install the module's manager.apk, launch org.matrix.vector.manager/.ui.MainActivity

Expected behaviour/预期行为

Manager opens and activates (connects to the daemon; module/scope management works).

Actual behaviour/实际行为

(a) Parasitic → SIGABRT before UI, during Zygote specialization:
E SELinux : seapp_context_lookup_internal: No match for app with uid 2000,
seinfo platform:privapp:targetSdkVersion=36:partition=system:complete,
name org.matrix.vector.manager
F zygote64: JNI FatalError: com_android_internal_os_Zygote.cpp:2257:
selinux_android_setcontext(2000, 0,
"platform:privapp:targetSdkVersion=36:partition=system:complete",
"org.matrix.vector.manager") failed
F libc : Fatal signal 6 (SIGABRT) in tid (usap64)
(HyperOS seapp_contexts has no rule for a shell-uid platform priv-app; same class as #653.)

(b) Standalone → UI loads but never activates:
W VectorManager: splash: no daemon binder after 2500ms, continuing unactivated
W VectorManager: java.lang.IllegalStateException: Daemon is not active
at org.matrix.vector.manager.ipc.DaemonClient$runIpc$2.invokeSuspend(DaemonClient.kt:39)
at ...DaemonClient.getInstalledPackagesFromAllUsers(DaemonClient.kt:183)

Root cause (debug-build boot log): daemon + system_server bridge are healthy —
I VectorDaemon : Vector daemon started: lateInject=false, proxy=serial
D VectorSystemServer: Registering bridge service for system_server with name serial.
I VectorNative(SS) : Got system server binder via serial on attempt 1.
D VectorNative(SS) : Manager binder from system_server: 0x7e1a1c1035
I VectorDaemon : Successfully injected Vector IPC binder for applications.
— but the MANAGER process is never Zygisk-injected: a manager launch produces ZERO
VectorNative lines for org.matrix.vector.manager, so it can't fetch its daemon binder.
vector-cli status works (Framework 2.2 / API 102), so only the app-side manager handoff is missing.

Unrelated noise (non-fatal): VectorWorkarounds "Failed to bypass systemui_is_cached flag"
(NoSuchFieldException in android.app.FeatureFlagsImpl at Workarounds.kt:46 / VectorDaemon.kt:103).

Xposed Module List/Xposed 模块列表

None enabled (Enabled Modules: 0 - this is the manager itself, before any module).

Root implementation/Root 方案

KernelSU-Next — ksud 3.2.0-75-g7bce6ea5, manager versionCode 33204, kernel 6.6.118-android15-Wild

System Module List/系统模块列表

SUSFS for KernelSU (v2.2.0-R28), Zygisk Next 1.4.5 (836), AlwaysStrong (TEESimulator + PlayIntegrityFork), Vector

Vector version/Vector 版本

3080 (also reproduced identically on canary 3087)

Android version/Android 版本

Android 16 - Xiaomi HyperOS 3 (OS3.0.305.0.WOLCNXM), OEM ROM

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

---- Redacted logcat excerpt (device IDs / app list / accounts removed) ----

Vector v2.2 (3080) debug on KernelSU-Next + Zygisk Next 1.4.5, HyperOS 3 / Android 16

Boot — framework comes up healthy

I VectorDaemon : Vector daemon started: lateInject=false, proxy=serial
I VectorDaemon : Version 2.2 (3080) commit 88f8e1f-JingMatrix-Vector
I VectorDaemon : Waiting system service: package for 1s (x3)
I VectorDaemon : Successfully injected Vector IPC binder for applications.
D VectorSystemServer: Registering bridge service for system_server with name serial.
D VectorSystemServer: Intercepted system service registration with name serial
D VectorNative(SS) : Vector Zygisk module loaded
I VectorNative(SS) : System server process detected. Marking for injection.
V VectorNative(SS) : IPCBridge initialized successfully.
D VectorNative(SS) : Attempting injection into system_server.
I VectorNative(SS) : Got system server binder via serial on attempt 1.
D VectorNative(SS) : Manager binder from system_server: 0x7e1a1c10xx
V VectorNative(SS) : Fetched framework DEX: fd=94, size=4097924
V VectorNative(SS) : Framework ClassLoader created successfully.
V VectorNative(SS) : Framework entry class 'org.matrix.vector.core.Main' located.

Non-fatal workaround miss (HyperOS-specific; ruled out as cause)

E VectorWorkarounds : Failed to bypass systemui_is_cached flag
E VectorWorkarounds : java.lang.NoSuchFieldException: No field systemui_is_cached in class android.app.FeatureFlagsImpl
E VectorWorkarounds : at org.matrix.vector.daemon.utils.WorkaroundsKt.applyNotificationWorkaround(Workarounds.kt:46)
E VectorWorkarounds : at org.matrix.vector.daemon.VectorDaemon.main(VectorDaemon.kt:103)

Launch path (a) — parasitic manager into com.android.shell → SIGABRT

E SELinux : seapp_context_lookup_internal: No match for app with uid 2000, seinfo platform:privapp:targetSdkVersion=36:partition=system:complete, name org.matrix.vector.manager
F zygote64: JNI FatalError called: (org.matrix.vector.manager) com_android_internal_os_Zygote.cpp:2257: selinux_android_setcontext(2000, 0, "platform:privapp:targetSdkVersion=36:partition=system:complete", "org.matrix.vector.manager") failed
F libc : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid (usap64)
F DEBUG : Abort message: 'JNI FatalError called ... selinux_android_setcontext(2000, 0, "platform:privapp:...:complete", "org.matrix.vector.manager") failed'
F DEBUG : NOTE: /data/adb/modules/zygisksu/lib64/libzygisk.so
F DEBUG : #4 pc ... /apex/com.android.art/lib64/libart.so (art::JNI::FatalError(_JNIEnv*, char const*)+172)
F DEBUG : #7 pc 000000000002496c /data/adb/modules/zygisksu/lib64/libzygisk.so

Launch path (b) — standalone-installed manager → UI loads but never activates

W VectorManager: modules: enabled list unavailable, showing none enabled
W VectorManager: java.lang.IllegalStateException: Daemon is not active
W VectorManager: at org.matrix.vector.manager.ipc.DaemonClient$runIpc$2.invokeSuspend(DaemonClient.kt:39)
W VectorManager: at org.matrix.vector.manager.ipc.DaemonClient.runIpc-gIAlu-s(DaemonClient.kt:33)
W VectorManager: at org.matrix.vector.manager.ipc.DaemonClient.getInstalledPackagesFromAllUsers(DaemonClient.kt:183)
W VectorManager: at org.matrix.vector.manager.data.repository.AppRepository$getInstalledApps$2.invokeSuspend(AppRepository.kt:42)
I VectorManager: store: 840 modules from https://backup.modules.lsposed.org/modules.json
W VectorManager: splash: no daemon binder after 2500ms, continuing unactivated

Key observation

During a manager launch there are ZERO VectorNative lines for org.matrix.vector.manager
— the manager process is never Zygisk-injected, so it never fetches its daemon binder,
while system_server injection + the serial bridge + vector-cli (root) all work.