feat(logging): per-UID NDJSON on external storage

Move debug diagnostics off /data/local/tmp/teesim to
/data/media/0/TEESimulator (visible at /sdcard/TEESimulator), so users
can pull them without a root explorer. The logging code runs in the
keystore SELinux domain, so a debug-only media_rw_data_file grant plus
a debug-only diag.sh fragment gate the plane: diag.sh's presence is the
signal service.sh (setup) and action.sh (export) test. customize.sh
extracts diag.sh on debug installs or sweeps the dir on release, since
the release keystore domain cannot remove it itself.

Replace the per-call .bin parcel dumps (a fresh undecodable file per
generateKey) with one NDJSON record per event on the UID's own file,
carrying decoded fields plus the raw parcel as base64 for the offline
parsers. computeIfAbsent makes per-UID writer creation atomic.

module/action.sh

@@ -4,17 +4,6 @@ CONFIG_DIR=/data/adb/tricky_store
 
 . "$MODDIR/action_i18n.sh"
 
-echo "  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo "  ⚠️  $(_msg confirm_header)"
-echo "  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo " "
-echo "  $(_msg confirm_warning_1)"
-echo "  $(_msg confirm_warning_2)"
-echo " "
-echo "  🔊  $(_msg confirm_vol_up)"
-echo "  🔉  $(_msg confirm_vol_down)"
-echo " "
-
 confirm() {
     # Sample getevent in 1s bursts; a piped stream block-buffers and misses
     # a single key-press before the timeout.
@@ -29,6 +18,31 @@ confirm() {
     return 1
 }
 
+# Debug builds ship diag.sh, adding a one-tap log export before the destructive clear-keys action.
+if [ -f "$MODDIR/diag.sh" ]; then
+    . "$MODDIR/diag.sh"
+    echo " "
+    echo "  📦 Export diagnostic logs to /sdcard/Download?"
+    echo "  🔊  Vol-Up = export logs"
+    echo "  🔉  Vol-Down = skip to clear keys"
+    echo " "
+    if confirm; then
+        diag_export
+        exit 0
+    fi
+fi
+
+echo "  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  ⚠️  $(_msg confirm_header)"
+echo "  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo " "
+echo "  $(_msg confirm_warning_1)"
+echo "  $(_msg confirm_warning_2)"
+echo " "
+echo "  🔊  $(_msg confirm_vol_up)"
+echo "  🔉  $(_msg confirm_vol_down)"
+echo " "
+
 if ! confirm; then
     echo " "
     echo "  ❌ $(_msg confirm_cancelled)"

module/customize.sh

@@ -76,6 +76,16 @@ mv "$MODPATH/libsupervisor.so" "$MODPATH/supervisor"
 chmod 755 "$MODPATH/inject"
 chmod 755 "$MODPATH/supervisor"
 
+# Debug builds carry diag.sh (the diagnostic plane); release builds do not. Extract it when
+# present; otherwise sweep any external-storage diagnostics a prior debug install left behind,
+# since the release keystore domain has no grant to remove them itself.
+if unzip -qqjo "$ZIPFILE" "diag.sh" -d "$MODPATH" 2>/dev/null; then
+  chmod 644 "$MODPATH/diag.sh"
+  ui_print "- Debug diagnostic plane enabled"
+else
+  rm -rf /data/media/0/TEESimulator /data/local/tmp/teesim
+fi
+
 # --- Configuration Files ---
 if [ ! -d "$CONFIG_DIR" ]; then
   ui_print "- Creating configuration directory"

module/diag.sh

@@ -0,0 +1,20 @@
+#!/system/bin/sh
+# Debug-only diagnostic plane. Shipped solely in debug ZIPs; its presence is the gate that
+# service.sh (setup) and action.sh (export) test before touching external storage.
+DIAG_DIR=/data/media/0/TEESimulator
+
+diag_setup() {
+    mkdir -p "$DIAG_DIR"
+    chmod 0777 "$DIAG_DIR"
+    chcon u:object_r:media_rw_data_file:s0 "$DIAG_DIR" 2>/dev/null
+}
+
+diag_export() {
+    _ts=$(date +%Y%m%d-%H%M%S)
+    _dest=/sdcard/Download/teesim-logs-$_ts
+    mkdir -p "$_dest"
+    cp -f "$DIAG_DIR"/teesim-uid-* "$_dest"/ 2>/dev/null
+    cp -f /data/adb/tricky_store/logs/certgen.log* "$_dest"/ 2>/dev/null
+    logcat -d -s TEESimulator > "$_dest/logcat.txt" 2>/dev/null
+    echo "  ✅ Saved to $_dest"
+}

module/service.sh

@@ -4,6 +4,12 @@ cd $MODDIR
 # Fork-based supervisor for instant restart
 ./supervisor ./daemon "$MODDIR" &
 
+# Debug builds ship diag.sh; its presence enables the external-storage diagnostic plane.
+if [ -f "$MODDIR/diag.sh" ]; then
+  . "$MODDIR/diag.sh"
+  diag_setup
+fi
+
 # Clear logd size persist properties once boot completes
 (
   until [ "$(getprop sys.boot_completed)" = "1" ]; do

module/uninstall.sh

@@ -11,3 +11,6 @@ rm -rf "$CONFIG_DIR/persistent_keys"
 rm -f "$CONFIG_DIR/tee_status.txt"
 rm -f "$CONFIG_DIR/boot_hash.bin" "$CONFIG_DIR/boot_key.bin"
 rm -f "$CONFIG_DIR/security_patch.txt" "$CONFIG_DIR/security_patch.txt.next" "$CONFIG_DIR/last_bulletin_fetch.json"
+
+# Debug diagnostics live on external storage; remove them on uninstall.
+rm -rf /data/media/0/TEESimulator