add baseline logic on final advice per android version

android/0_termux-setup_v2.sh

@@ -35,6 +35,9 @@ rotate_logs() {
 }
 
 setup_logging() {
+  # Save original console fds so interactive tools still work after we redirect stdout/stderr.
+  exec 3>&1 4>&2
+
   # If logging is disabled, still allow --debug to trace to console.
   if [[ "${LOG_ENABLED:-1}" -ne 1 ]]; then
     if [[ "${DEBUG:-0}" -eq 1 ]]; then
@@ -44,9 +47,6 @@ setup_logging() {
     return 0
   fi
 
-  # Save original console fds so interactive tools still work after we redirect stdout/stderr.
-  exec 3>&1 4>&2
-
   mkdir -p "$LOG_DIR" 2>/dev/null || true
 
   if [[ -z "${LOG_FILE:-}" ]]; then
@@ -327,7 +327,7 @@ step_debian_bootstrap_default() {
   proot-distro login debian -- bash -lc '
     set -e
     export DEBIAN_FRONTEND=noninteractive
-    apt-get update -y
+    apt-get update
     apt-get -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold \
       install ca-certificates curl coreutils
   ' || true
@@ -794,9 +794,71 @@ self_check() {
   if have termux-wake-lock; then ok " Termux:API wakelock: available"; else warn " Termux:API wakelock: not available"; fi
   if have termux-notification; then ok " Termux:API notifications: command present"; else warn " Termux:API notifications: missing"; fi
 }
+
 final_advice() {
   # 1) Android-related warnings (only meaningful if we attempted checks)
   local sdk="${CHECK_SDK:-${ANDROID_SDK:-}}"
+  local adb_connected=0
+  local serial="" mon="" mon_fflag=""
+
+  # Best-effort: detect whether an ADB loopback device is already connected.
+  # (We do NOT prompt/pair here; we only check current state.)
+  if have adb; then
+    adb start-server >/dev/null 2>&1 || true
+    if adb_pick_loopback_serial >/dev/null 2>&1; then
+      adb_connected=1
+      serial="$(adb_pick_loopback_serial 2>/dev/null || true)"
+    fi
+  fi
+
+  # Baseline safety gate:
+  # On Android 12-13 (SDK 31-33), IIAB/proot installs can fail if PPK is low (often 32).
+  # Baseline mode does NOT force ADB pairing nor run check_readiness(), so PPK may be unknown.
+  # If PPK is not determined, suggest running --all BEFORE telling user to proceed to proot-distro.
+  if [[ "$MODE" == "baseline" ]]; then
+    if [[ "$sdk" =~ ^[0-9]+$ ]] && (( sdk >= 31 && sdk <= 33 )); then
+      # If we didn't run checks, CHECK_PPK will be empty. Even with adb_connected=1, baseline
+      # still doesn't populate CHECK_PPK unless user ran --check/--all.
+      if [[ "${CHECK_PPK:-}" != "" && "${CHECK_PPK:-}" =~ ^[0-9]+$ ]]; then
+        : # PPK determined -> ok to continue with normal advice below
+      else
+        warn "Android 12-13: PPK value hasn't been verified (max_phantom_processes may be low, e.g. 32)."
+        warn "Before starting the IIAB install, run the complete setup so it can apply/check PPK=256; otherwise the installation may fail:"
+        ok   "  ./0_termux-setupv2.sh --all"
+        return 0
+      fi
+    elif [[ "$sdk" =~ ^[0-9]+$ ]] && (( sdk >= 34 )); then
+      # On Android 14+, rely on "Disable child process restrictions"
+      # Proxy signals: settings_enable_monitor_phantom_procs (or the fflag override).
+      # Baseline does not run check_readiness(), so CHECK_MON is usually empty.
+      if [[ "${CHECK_MON:-}" == "false" ]]; then
+        : # Verified OK (rare in baseline) -> continue
+      else
+        # If ADB is already connected, try to read the flag best-effort (no prompts).
+        if [[ "$adb_connected" -eq 1 && -n "${serial:-}" ]]; then
+          mon_fflag="$(adb_get_child_restrictions_flag "$serial")"
+          if [[ "$mon_fflag" == "true" || "$mon_fflag" == "false" ]]; then
+            mon="$mon_fflag"
+          else
+            mon="$(adb -s "$serial" shell settings get global settings_enable_monitor_phantom_procs 2>/dev/null | tr -d '\r' || true)"
+          fi
+        fi
+
+        if [[ "${mon:-}" == "false" ]]; then
+          : # Restrictions already disabled -> ok to continue
+        else
+          if [[ "${mon:-}" == "true" ]]; then
+            warn "Android 14+: child process restrictions appear ENABLED (monitor=true)."
+          else
+            warn "Android 14+: child process restrictions haven't been verified (monitor flag unreadable/unknown)."
+          fi
+          warn "Before starting the IIAB install, run the complete setup (--all) so it can guide you to verify such setting; otherwise the installation may fail:"
+          ok   "  ./0_termux-setupv2.sh --all"
+          return 0
+        fi
+      fi
+    fi
+  fi
 
   if [[ "${CHECK_NO_ADB:-0}" -eq 1 ]]; then
     # If we could not check, still warn on A12-13 because PPK is critical there