BootStateManager.apply and PatchLevelManager.initialize ran after initializeInterceptors, so keystore2 cached ro.boot.* and ro.build.version.security_patch from the un-spoofed values during hook init. Move both before the interceptor so the hook sees the spoofed snapshot. ConfigurationManager stays between them since it only loads files and is independent of prop state.