diff --git a/.gitignore b/.gitignore
index 69d58b8..38f7660 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,7 @@
 /los-build/
 /recovery.img
 /recovery-stock.img
+/.ccache/
+/.jack-repository/
+/core
+/hs_err_pid*.log
diff --git a/AGENTS.md b/AGENTS.md
index 99daa96..8ddfe35 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,52 +1,91 @@
 # AGENTS.md — builders_rubenslte
 
-What this repo is: the build driver + documentation for producing a **TWRP
-recovery** (`recovery.img`) for the Samsung Galaxy Tab Active SM-T365
-(codename `rubenslte`, Qualcomm MSM8926, Android 5.1.1 / omni `twrp-5.1`).
+What this repo is: build drivers + documentation for producing **TWRP
+recovery** (`recovery.img`) and a **LineageOS 14.1 ROM** for the Samsung Galaxy
+Tab Active SM-T365 (codename `rubenslte`, Qualcomm MSM8926, Linux kernel 3.4).
 
-Three repos cooperate:
+## Layout / getting your bearings
 
-| Repo | Role |
-|------|------|
-| `builders_rubenslte` (this) | `build_twrp.sh` (driver), `shell.nix` (env), `patches/`, docs |
-| `rubenslte/twrp_device_samsung_rubenslte` | device tree (`BoardConfig.mk`, `mkbootimg.mk`, `dtbtool`) |
-| `rubenslte/android_kernel_samsung_rubenslte` | Samsung msm8226 stock kernel, built from source |
+```
+build_twrp.sh          TWRP driver -> recovery.img (omni twrp-5.1)
+build_los.sh           LOS driver -> boot.img / lineage zip (cm-14.1, Jack)
+shell.nix              nix-shell FHS env for the TWRP build
+shell_los.nix          same package set + host gcc (kernel kconfig `conf`)
+lib/common.sh          shared: env re-entry, patch apply, trailer, image check
+patches/
+  twrp/                omni 5.1 workspace fixes  (applied by build_twrp.sh)
+  kernel/              kernel fixes, shared by BOTH builds
+  los/                 cm-14.1 workspace fixes   (applied by build_los.sh)
+local_manifests/       rubenslte.xml -> device/vendor/kernel/@ gitea
+important_files/       webview.apk restore point (do not delete)
+twrp-build/  los-build/  .ccache/  .jack-repository/   (gitignored workspaces)
+```
 
-This drive builds from **source**: kernel, dt.img and ramdisk are all produced,
-never prebuilt. The artifact is `recovery.img` (currently 10,479,632 bytes with
-the full 19-language pack set, TWRP 3.7.0_9-0) and has passed on-device tests
-on real hardware.
+Five cooperating repos each build consumes (device/vendor/kernel from gitea via
+`local_manifests/rubenslte.xml` for LOS; device tree + kernel shallow clones for
+TWRP): `twrp_device_samsung_rubenslte`, `android_kernel_samsung_rubenslte`
+(shared), `device_samsung_rubenslte`, `android_vendor_samsung_rubenslte`, plus
+the shared millet forks those LOS trees pull in
+(device/samsung/millet-common, kernel/samsung/millet-common etc.).
 
 ## Commands
 
 ```bash
+# TWRP recovery
 ./build_twrp.sh                # full build -> recovery.img at repo root
 ./build_twrp.sh --no-sync      # iteration: skip repo sync / tree refresh / patches
 ./build_twrp.sh clean          # remove twrp-build/ and recovery.img
 ./build_twrp.sh env            # interactive shell inside the nix-shell FHS env
+
+# LineageOS 14.1
+./build_los.sh                 # boot.img (kernel + dt.img + ramdisk), fast gate
+./build_los.sh bacon           # full build -> lineage_rubenslte-*.zip
+./build_los.sh clean           # mka clean
+./build_los.sh env             # interactive shell inside the build env
+# RB_CMD=<cmd> overrides the subcommand (used by relaunch helpers)
 ```
 
-Verification without nix (cheap): `bash -n build_twrp.sh`.
+Verification without nix (cheap): `bash -n lib/common.sh build_twrp.sh
+build_los.sh`. For patch-level verification:
+`patch -p1 --dry-run -d los-build < patches/los/0001-*.patch` etc.
 
 ## How to work here
 
-- The build only runs inside the nix-shell FHS environment (`shell.nix`).
-  `build_twrp.sh` re-enters it via a stdin pipe; **do not rely on
-  `nix-shell --run`** (the `exec android-env` shellHook swallows it) and do not
-  run two nix-shells at once (nix store lock deadlock).
-- A full build is slow (first run downloads ~2-3 GB via `repo sync`; kernel +
-  recovery compile takes a while). For source edits, iterate with
-  `./build_twrp.sh --no-sync` against the existing `twrp-build/` tree.
-- Prefer editing the *device tree repo* (BoardConfig.mk / mkbootimg.mk) over
-  patching the omni tree post-sync. Only use `patches/` for fixes to the
-  upstream 5.1 sources that cannot live in the device tree.
+- Builds only run inside the nix-shell FHS environments (`shell.nix`,
+  `shell_los.nix`). The scripts re-enter via a stdin pipe
+  (`reenter_build_env`); **do not rely on `nix-shell --run`** (the
+  `exec android-env` shellHook swallows it) and do not run two nix-shells at
+  once (nix store lock deadlock).
+- A full build is slow (repo sync downloads GBs; kernel + recovery / bacon
+  compile takes a while). Iterate with `./build_twrp.sh --no-sync` against the
+  existing `twrp-build/` tree; `./build_los.sh bootimage` gates the kernel fast.
+- Prefer editing the *device tree repos* (BoardConfig.mk / mkbootimg.mk /
+  device tree mk) over patching trees post-sync. Only use `patches/` for fixes
+  to upstream 5.1/14.1 sources that cannot live in the device tree. Kernel
+  fixes go in `patches/kernel/` (shared by both builds); tree-specific fixes in
+  `patches/twrp/` or `patches/los/`. Add a row to `patches/README.md`.
+- `repo sync` and `clone_or_update` wipe in-tree edits — patches are re-applied
+  idempotently each full build; on `--no-sync` iters only the `twrp-build/`
+  tree state matters.
+- LOS builds use **Jack only** and in-process (`JACK_SERVER=false
+  JACK_NO_SERVER=1` with jars seeded into `.jack-repository/`). Do not try to
+  switch to the javac fallback — it is broken on cm-14.1 (dangling
+  `with-local/classes.dex`, inspect `build/core/java.mk`),
+  and do not re-enable the Jack server — the host curl/OpenSSL cannot TLS-
+  handshake with the Java 8 jack server, and the mandatory server ninja edge
+  aborts the whole build.
+- Console log noise: the old `warning: command substitution: ignored null byte`
+  should not appear anymore (trailer is appended via a pipeline, see
+  `append_seandroidenforce`). If it returns, the trailer check was changed.
 - Commit style in this repo: short lowercase-imperative subject, no body
   (`Refactor build_twrp.sh and document the recovery build`). Stage with
-  `git add -A`; `recovery.img` and `recovery-stock.img` are intentionally
-  untracked (gitignored).
+  `git add -A`; `recovery.img`/`recovery-stock.img` and the workspaces are
+  intentionally untracked (gitignored).
 
 ## Invariants — do not "simplify" these
 
+TWRP:
+
 - **`BoardConfig.mk`**: `INSTALLED_DTIMAGE_TARGET` and `BOARD_MKBOOTIMG_ARGS`
   must stay *recursive* (`=`, never `:=`). They are expanded after
   `PRODUCT_OUT`/`KERNEL_OUT` exist; see the `mkbootimg.mk` header comment for
@@ -65,7 +104,16 @@ Verification without nix (cheap): `bash -n build_twrp.sh`.
   variants (T365Y/AUS, T365M/KOR) need their `CONFIG_MACH_RUBENSLTE_*`
   enabled + rebuild.
 - **SEANDROIDENFORCE** trailer and `--dt` are required on boot/recovery images
-  for Samsung bootloaders; the stock core rules don't add them.
+  for Samsung bootloaders; the stock core rules don't add them
+  (`append_seandroidenforce` in `lib/common.sh` appends it to LOS boot.img).
+
+LOS:
+
+- **Jack is the only compile path** for the dex phases (see above).
+- **Kernel patches are shared**: anything touching `android_kernel_samsung_*`
+  goes in `patches/kernel/` and must apply in *both* `twrp-build/` and
+  `los-build/` workspaces. Verify with `patch -p1 --dry-run` in each.
+- **The ROM is bare** — no GApps, `/data` ext4. Don't add GApps packaging.
 
 ## Troubleshooting the image
 
@@ -80,6 +128,11 @@ Verification without nix (cheap): `bash -n build_twrp.sh`.
   binaries (and `recovery/root.ts`); `mkbootimg.mk` strips them anyway.
 - Multi-variant boot failures — dt.img lacks the device's DTB; rebuild with the
   right `CONFIG_MACH_RUBENSLTE_*`.
+- Jack "not readable" jar error — re-seed `.jack-repository/` from
+  `los-build/prebuilts/sdk/tools/jacks/` (and jills) — see `seed_jack_repository`.
+- Bacon JVM SIGSEGV in `host/linux-x86/lib64/libconscrypt_openjdk_jni.so`
+  (`OpenSSLX509Certificate.fromX509PemInputStream`) — host OpenSSL ABI
+  mismatch in the FHS env; known non-trivial, unrelated to the scripts here.
 
-For the full background: `README.md` (this repo), `patches/README.md`, and
-`twrp_device_samsung_rubenslte/README.md`.
\ No newline at end of file
+For the full background: `README.md` (this repo), `patches/README.md`,
+`twrp_device_samsung_rubenslte/README.md`, `local_manifests/rubenslte.xml`.
\ No newline at end of file
diff --git a/README.md b/README.md
index 8226efd..5d8190c 100644
--- a/README.md
+++ b/README.md
@@ -1,22 +1,31 @@
 # builders\_rubenslte
 
-Build scripts for TWRP recoveries (and, eventually, ROMs) for the **Samsung
-Galaxy Tab Active SM-T365** (codename `rubenslte`, Qualcomm MSM8926).
+Build scripts for **TWRP recovery** and a **LineageOS 14.1 ROM** for the
+Samsung Galaxy Tab Active SM-T365 (codename `rubenslte`, Qualcomm MSM8926).
 
-This repo only orchestrates the build. The actual device configuration lives in
-two other repos:
+This repo only orchestrates the builds. The actual device configuration lives in
+other repos:
 
 | Repo | Contents |
 |------|----------|
-| `rubenslte/twrp_device_samsung_rubenslte` | TWRP device tree (BoardConfig.mk, mkbootimg.mk, dtbtool, recovery.fstab) |
-| `rubenslte/android_kernel_samsung_rubenslte` | Samsung msm8226 stock kernel (Linux 3.4), built from source |
-| this repo | `build_twrp.sh` (driver), `shell.nix` (nix-shell env), `patches/` (fixes), docs |
+| `twrp_device_samsung_rubenslte` | TWRP device tree (BoardConfig.mk, mkbootimg.mk, dtbtool, recovery.fstab) |
+| `android_kernel_samsung_rubenslte` | Samsung msm8226 stock kernel (Linux 3.4), built from source |
+| `device_samsung_rubenslte` | LineageOS 14.1 device tree |
+| `android_vendor_samsung_rubenslte` | LOS vendor blobs / proprietary files |
+| `android_kernel_samsung_rubenslte` (shared) | the same gitea kernel clone |
+| this repo | `build_twrp.sh` / `build_los.sh` (drivers), `shell.nix` / `shell_los.nix` (envs), `patches/`, docs |
+
+The LOS device/vendor/kernel trees come in via `local_manifests/rubenslte.xml`
+against the cm-14.1 manifest (the milletwifi/milletlte forks from
+git.cfpi-fpsi.eu provide the shared trees).
 
 ## Quick start
 
 Requirements: a NixOS system (or Nix with `nix-shell`) with network access and
 `nix` in your user's `allowed-users` / `trusted-users`.
 
+### TWRP recovery
+
 ```
 ./build_twrp.sh               # full build -> recovery.img
 ./build_twrp.sh --no-sync     # rebuild without re-syncing/re-patching sources
@@ -24,51 +33,69 @@ Requirements: a NixOS system (or Nix with `nix-shell`) with network access and
 ./build_twrp.sh env           # interactive shell inside the build env
 ```
 
-The first run downloads the omni `twrp-5.1` manifest source (~2-3 GB with the
-kernel and toolchain) and can take over an hour; later `--no-sync` rebuilds are
-much faster. The final artifact is `recovery.img` at the repo root.
+### LineageOS 14.1
 
-## How the build works
+```
+./build_los.sh                # boot.img: kernel + dt.img + ramdisk (fast gate)
+./build_los.sh bacon          # full build -> lineage_rubenslte-*.zip
+./build_los.sh clean          # mka clean
+./build_los.sh env            # interactive shell inside the build env
+```
 
-1. **Environment** — everything runs inside the nix-shell FHS environment
-   (`shell.nix`). `nix-shell --run` is unreliable here because the shellHook
-   does `exec android-env`, so `build_twrp.sh` re-enters the environment by
-   piping its own body into `nix-shell` (see `reenter_build_env`).
-2. **Sources** — `repo init/sync` fetches the omni `twrp-5.1` manifest; the
-   device tree and kernel are shallow clones from gitea (and refreshed on each
-   full build).
-3. **Patches** — `patches/*.patch` fix the old 5.1 codebase for modern host
-   tools (see `patches/README.md`). Applied idempotently.
-4. **Toolchain** — arm-eabi-4.8 (gcc 4.8, the same one stock builds used) is
-   downloaded from Android's googlesource and put on `PATH`.
-5. **Kernel** — built from source via the omni kernel build rules
-   (base defconfig + rubenslte variant + selinux defconfigs). The variant
-   defconfig only enables `CONFIG_MACH_RUBENSLTE_OPEN` (see caveats).
-6. **dt.img** — `dtbToolLineage` packs the compiled `.dtb` files; the bootloader
+`RB_CMD=<cmd>` overrides the subcommand (used by relaunch helpers).
+
+## How the builds work
+
+1. **Environment** — everything runs inside a nix-shell FHS environment:
+   `shell.nix` for TWRP, `shell_los.nix` for LOS (same package set + host gcc,
+   which the kernel kconfig host tools need). `nix-shell --run` is unreliable
+   here because the shellHook does `exec android-env`, so the scripts re-enter
+   the environment by piping their body into `nix-shell` (see
+   `reenter_build_env` in `lib/common.sh`).
+2. **Sources** — `repo init/sync` fetches the omni `twrp-5.1` manifest for TWRP
+   and the cm-14.1 manifest + `local_manifests/rubenslte.xml` for LOS. The
+   device tree(s) and kernel are shallow clones from gitea and refreshed on each
+   full build.
+3. **Patches** — `patches/{twrp,kernel,los}/*.patch` fix the old 5.1/14.1
+   codebase for modern host tools (see `patches/README.md`). Applied
+   idempotently so `repo sync` wipes are harmless.
+4. **Toolchain (TWRP)** — arm-eabi-4.8 (gcc 4.8, same as stock builds) is
+   downloaded from Android's googlesource and put on `PATH`. LOS uses the tree
+   prebuilts.
+5. **Compiler (LOS)** — Jack only. The 14.1 javac fallback is incomplete
+   (dangling `with-local/classes.dex` intermediates) and can't build bacon.
+   Jack runs in-process (`JACK_NO_SERVER=1`); the separate Jack server is
+   disabled (`JACK_SERVER=false`) because its curl admin TLS (try `curl`
+   against 0.0.0.0:8077: `SSL routines::unexpected eof`) can't handshake with
+   the Java 8 server on this host, and jack_server_setup.mk's mandatory
+   server-start ninja edge (`update jack ... || exit 47`) hard-aborts ninja.
+   Jack jars are seeded from the tree into `.jack-repository/`.
+6. **Kernel** — built from source via the omni/lineage kernel build rules. The
+   variant defconfig only enables `CONFIG_MACH_RUBENSLTE_OPEN` (EUR).
+7. **dt.img** — `dtbToolLineage` packs the compiled `.dtb` files; the bootloader
    selects the right one for the hardware.
-7. **Recovery ramdisk** — the stock minigzip ramdisk overflows the 10,485,248
+8. **Recovery ramdisk** — the stock minigzip ramdisk overflows the 10,485,248
    byte partition, so `mkbootimg.mk` replaces the core ramdisk rules: drops
-   tzdata and the f2fs tools, keeps only `en.xml`/`pl.xml` languages, and
-   compresses with LZMA (`CONFIG_RD_LZMA=y` in the rubenslte kernel).
+   tzdata and the f2fs tools and compresses with LZMA
+   (`CONFIG_RD_LZMA=y` in the rubenslte kernel). All 19 common TWRP language
+   packs ship as-is.
 
-Image layout of the shipped `recovery.img` (verified component sizes; exact
-offsets are 2048-byte aligned by the bootloader):
+Final artifacts at the repo root: `recovery.img` (TWRP, currently 10,479,632
+bytes) and, after bacon, `los-build/out/target/product/rubenslte/lineage_rubenslte-*.zip`.
+
+## Image layout (shipped `recovery.img`)
 
 ```
 boot image header (base 0x0, pagesize 2048)
-zImage               7,223,736   kernel
-ramdisk              2,841,269   LZMA-compressed (gzip would overflow)
-dt.img                 296,960   QCDT: two EUR dtbs, r02 + r03
+zImage     kernel
+ramdisk    LZMA-compressed, 19-language TWRP 3.7.0_9-0
+dt.img     QCDT: two EUR dtbs, r02 + r03
 SEANDROIDENFORCE trailer
-total               10,366,992   fits the 10,485,248 byte partition
+total      10,479,632   fits the 10,485,248 byte partition
 ```
 
-Artifact facts:
-
-- `recovery.img` — 10,366,992 bytes (fits the 10,485,248 byte partition)
-- sha256 `cf8c711afeb5636f6b01ee253d0643d380f127e7e71e8c1d3a163a148ab97703`
-- TWRP **3.7.0_9-0**, Linux kernel 3.4.x from Samsung source, built for
-  Android 5.1.1 (omni twrp-5.1)
+`build_twrp.sh` prints the image size and sha256 at the end (`verify_image` in
+`lib/common.sh`).
 
 ## Flashing
 
@@ -84,6 +111,17 @@ KNOX warranty bit on flashing — irreversible on this device.
 `recovery-stock.img` (in this directory, git-ignored) is the stock recovery
 image dumped from the device; flash it back to restore the factory recovery.
 
+The ROM zip is flashed from TWRP (it does not touch the bootloader), followed
+by `lineage-*-kernel`, or extract `boot.img` (with the SEANDROIDENFORCE trailer)
+from the zip. The ROM is bare — no GApps — and `/data` is ext4 (F2FS off).
+
+## WebView provider (webview.apk)
+
+The device's WebView (com.android.webview) lives in the vendor tree. If you wipe
+or replace it, the system can fall back to a broken `com.android.webview`.
+Restore point `/system/app/webview/webview.apk`; a safely-stripped variant sits
+in `important_files/` if you need to re-add it.
+
 ## Device notes
 
 - **dt.img is EUR-only.** The kernel is built with `CONFIG_MACH_RUBENSLTE_OPEN`,
@@ -91,30 +129,33 @@ image dumped from the device; flash it back to restore the factory recovery.
   / KOR units need the corresponding `CONFIG_MACH_RUBENSLTE_*` enabled and a
   rebuild, otherwise the device may not boot from this kernel.
 - **`/data` is ext4, no F2FS.** The kernel has no F2FS driver, so the f2fs
-  tools are excluded (`TARGET_USERIMAGES_USE_F2FS` unset in BoardConfig.mk, and
-  `mkbootimg.mk` deletes them from the ramdisk defensively — they can linger in
-  `out/.../root/sbin/` from older f2fs-enabled builds). TWRP's format menu only
-  offers F2FS when `/sbin/mkfs.f2fs` is present, so the option is hidden
-  automatically. Do not format `Data` as F2FS.
-- **`adb shell` needs `/system` mounted.** `adb` itself works in recovery, but
-  the device-side shell is `/system/bin/sh`; until you check **Mount → System**
-  in TWRP you'll see `CANNOT LINK EXECUTABLE DEPENDENCIES: library "libc.so"
-  not found`. The in-TWRP terminal (Advanced → Terminal) always works.
+  tools are excluded. TWRP's format menu only offers F2FS when
+  `/sbin/mkfs.f2fs` is present, so the option is hidden automatically. Do not
+  format `Data` as F2FS.
+- **`adb shell` needs `/system` mounted.** `adb` works in recovery, but the
+  device-side shell is `/system/bin/sh`; until you check **Mount → System** in
+  TWRP you'll see `CANNOT LINK EXECUTABLE DEPENDENCIES: library "libc.so" not
+  found`. The in-TWRP terminal (Advanced → Terminal) always works.
 
 ## Troubleshooting
 
-- `make: *** [.../mkbootimg.mk:24: /dt.img] Błąd 255` — the custom bootimg
-  rules are included before the kernel tasks define their paths; the recursive
-  variables in BoardConfig.mk are what keep `/dt.img` from collapsing to an
-  absolute base path. Don't "simplify" them to `:=`.
-- Image won't fit the partition — the ramdisk must stay LZMA and trimmed;
+- `make: *** [.../mkbootimg.mk:24: /dt.img] Błąd 255` (TWRP) — the custom
+  bootimg rules are included before the kernel tasks define their paths; the
+  recursive variables in BoardConfig.mk are what keep `/dt.img` from collapsing
+  to an absolute base path. Don't "simplify" them to `:=`.
+- Image won't fit the partition (TWRP) — the ramdisk must stay LZMA and trimmed;
   re-check `mkbootimg.mk` if you add files under `twres/` or `system/`.
 - `mkfs.f2fs` reappears in the ramdisk after a rebuild — stale copy in
   `out/target/product/rubenslte/root/sbin/` (the core rule `cp -R`s the boot
   root into the recovery root without wiping it first). Delete them and
   `recovery/root.ts`; `mkbootimg.mk` strips them from the packed image anyway.
+- Jack complaints "not readable" about `jack-3.36.CANDIDATE.jar` — the
+  `.jack-repository/` seed is incomplete; `seed_jack_repository` re-copies from
+  `los-build/prebuilts/sdk/tools/jacks/` (keep jills too).
+- `curl` TLS error against the Jack server — expected; Jack runs in-process,
+  the server path is disabled on purpose.
 - `nix-shell --run ...` produces no output — known limitation of the
-  `exec android-env` shellHook; use `./build_twrp.sh` or `./build_twrp.sh env`.
+  `exec android-env` shellHook; use the wrapper scripts or `... env`.
 - Parallel `nix-shell` invocations can deadlock on the nix store — run builds
   sequentially.
 
@@ -145,6 +186,8 @@ image dumped from the device; flash it back to restore the factory recovery.
 
 - https://git.cfpi-fpsi.eu/rubenslte/twrp_device_samsung_rubenslte
 - https://git.cfpi-fpsi.eu/rubenslte/android_kernel_samsung_rubenslte
+- https://git.cfpi-fpsi.eu/rubenslte/device_samsung_rubenslte
+- https://git.cfpi-fpsi.eu/rubenslte/android_vendor_samsung_rubenslte
 - https://github.com/matteo0026/android_device_samsung_rubenslte
 - https://github.com/matteo0026/twrp_device_samsung_milletlte
-- https://github.com/matteo0026/twrp_device_samsung_matisselte
+- https://github.com/matteo0026/twrp_device_samsung_matisselte
\ No newline at end of file
diff --git a/build_los.sh b/build_los.sh
new file mode 100755
index 0000000..29231fb
--- /dev/null
+++ b/build_los.sh
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Build LineageOS 14.1 for the Samsung Galaxy Tab Active SM-T365 (rubenslte,
+# msm8226) inside the nix-shell FHS environment (shell_los.nix).
+#
+# The LOS 14.1 source tree is a cm-14.1 repo manifest with local manifests
+# (device/vendor/kernel from git.cfpi-fpsi.eu, millet forks for shared trees);
+# see los-build/.repo/local_manifests/rubenslte.xml and README.md.
+#
+# Usage:
+#   ./build_los.sh              build boot.img (kernel + dt.img + ramdisk, fast gate)
+#   ./build_los.sh bacon        full build -> lineage_rubenslte-*.zip
+#   ./build_los.sh clean        mka clean (no jack --config clean: no server)
+#   ./build_los.sh env          interactive shell inside the build env
+#
+# Also honors RB_CMD=<cmd> as an override (used by relaunch helpers).
+set -euo pipefail
+
+SCRIPT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT"
+
+source lib/common.sh
+
+CMD="${RB_CMD:-${1:-bootimage}}"
+[ $# -gt 1 ] && echo "warning: ignoring extra args: $*"
+
+reenter_build_env \
+    "$SCRIPT/shell_los.nix" \
+    RUBENSLTE_LOS_IN_ENV \
+    "export RB_CMD='$CMD'"
+
+export LC_ALL=C LANG=C
+
+# ccache (prebuilt from the tree) to speed up rebuild cycles.
+export USE_CCACHE=1
+export CCACHE_DIR="$SCRIPT/.ccache"
+
+# Jack compile, as the LOS 14.1 javac fallback leaves dangling with-local
+# intermediates (build/core/java.mk) and cannot build bacon.
+# The jack-admin TLS is broken here (curl TLS1.3 vs Java 8 server), so
+# JACK_SERVER=false disables jack_server_setup.mk's mandatory server-start
+# ninja edge (its "update jack ... || exit 47" aborts ninja), and
+# JACK_NO_SERVER=1 runs Jack in-process for the actual compile.
+export JACK_SERVER=false
+export JACK_NO_SERVER=1
+export JACK_REPOSITORY="$SCRIPT/.jack-repository"
+seed_jack_repository "$JACK_REPOSITORY" "$SCRIPT/los-build/prebuilts/sdk/tools/jacks"
+
+cd "$SCRIPT/los-build"
+
+# Re-apply any source-tree patches lost on repo sync (idempotent).
+apply_patches patches/kernel
+apply_patches patches/los
+
+export TOP="$PWD"
+export ANDROID_BUILD_TOP="$TOP"
+
+set +eu
+source build/envsetup.sh >/dev/null 2>&1
+lunch lineage_rubenslte-userdebug >/dev/null 2>&1
+set -e
+
+if [ -z "${TARGET_PRODUCT:-}" ]; then
+    echo "[!] lunch failed - TARGET_PRODUCT not set"
+    exit 1
+fi
+
+case "$CMD" in
+    clean) mka clean ;;
+    env) exec bash ;;
+    *) mka "$CMD" ;;
+esac
+RC=$?
+
+# Samsung bootloaders require the SEANDROIDENFORCE trailer on boot images.
+BOOT_IMG="$SCRIPT/los-build/out/target/product/rubenslte/boot.img"
+if [ "$RC" -eq 0 ] && [ "$CMD" != "clean" ]; then
+    append_seandroidenforce "$BOOT_IMG"
+fi
+
+exit "$RC"
\ No newline at end of file
diff --git a/build_twrp.sh b/build_twrp.sh
index cc56e70..e115dde 100755
--- a/build_twrp.sh
+++ b/build_twrp.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Build a TWRP recovery image for the Samsung Galaxy Tab Active SM-T365
-# (codename rubenslte, msm8226).
+# (codename rubenslte, msm8226) inside the nix-shell FHS environment (shell.nix).
 #
 # Usage:
 #   ./build_twrp.sh            build recovery.img (default)
@@ -8,15 +8,15 @@
 #   ./build_twrp.sh clean      remove twrp-build/ and recovery.img
 #   ./build_twrp.sh env        drop into the interactive nix-shell build env
 #
-# The build runs inside the nix-shell FHS environment defined in shell.nix.
 # `nix-shell --run` cannot be relied on here, so when invoked from the host the
-# script re-executes itself *inside* the env via a stdin pipe
-# (RUBENSLTE_BUILD_IN_ENV prevents infinite recursion).
+# script re-executes itself *inside* the env via a stdin pipe.
 set -euo pipefail
 
 SCRIPT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$SCRIPT"
 
+source lib/common.sh
+
 RECOVERY_PARTITION_SIZE=10485248
 
 MANIFEST_URL="https://github.com/minimal-manifest-twrp/platform_manifest_twrp_omni.git"
@@ -27,16 +27,7 @@ TOOLCHAIN_URL="https://android.googlesource.com/platform/prebuilts/gcc/linux-x86
 TOOLCHAIN_DIR="prebuilts/gcc/linux-x86/arm/arm-eabi-4.8"
 
 usage() {
-    sed -n '2,9p' "$0" | sed 's/^# \{0,1\}//'
-}
-
-reenter_build_env() {
-    if [ -z "${RUBENSLTE_BUILD_IN_ENV:-}" ]; then
-        echo "[*] Re-entering build inside the nix-shell FHS environment ..."
-        printf 'export RUBENSLTE_BUILD_IN_ENV=1\nbash "%s"\n' "$SCRIPT/build_twrp.sh" \
-            | nix-shell shell.nix
-        exit $?
-    fi
+    usage_from_header
 }
 
 clone_or_update() {
@@ -53,22 +44,6 @@ clone_or_update() {
     fi
 }
 
-apply_patches() {
-    local p log
-    for p in "$SCRIPT"/patches/*.patch; do
-        log="$(mktemp)"
-        if patch -p1 -s < "$p" >"$log" 2>&1; then
-            echo "[*] Applied patch: $(basename "$p")"
-        elif grep -q -E 'Reversed|already applied' "$log"; then
-            echo "[*] Patch already applied: $(basename "$p")"
-        else
-            echo "[!] WARNING: patch failed: $(basename "$p")"
-            cat "$log"
-        fi
-        rm -f "$log"
-    done
-}
-
 fetch_toolchain() {
     if [ -x "$TOOLCHAIN_DIR/bin/arm-eabi-gcc" ]; then
         return
@@ -78,20 +53,6 @@ fetch_toolchain() {
     curl -L --fail "$TOOLCHAIN_URL" | tar -xz -C "$TOOLCHAIN_DIR"
 }
 
-verify_image() {
-    local img="$1"
-    [ -f "$img" ] || { echo "ERROR: $img was not produced" >&2; exit 1; }
-    local size
-    size="$(stat -c%s "$img")"
-    echo "[*] $img: $size bytes (partition budget: $RECOVERY_PARTITION_SIZE)"
-    if [ "$size" -gt "$RECOVERY_PARTITION_SIZE" ]; then
-        echo "ERROR: image exceeds the recovery partition" >&2
-        exit 1
-    fi
-    sha256sum "$img"
-    echo "Done: $img"
-}
-
 do_build() {
     export LC_ALL=C LANG=C LC_CTYPE=C
 
@@ -105,7 +66,8 @@ do_build() {
         repo sync -c -j"$(nproc)"
         clone_or_update "device tree" "$DEVICE_TREE_URL" device/samsung/rubenslte
         clone_or_update "kernel" "$KERNEL_URL" kernel/samsung/rubenslte
-        apply_patches
+        apply_patches patches/twrp
+        apply_patches patches/kernel
     fi
 
     fetch_toolchain
@@ -119,7 +81,7 @@ do_build() {
     mka recoveryimage
 
     cp out/target/product/rubenslte/recovery.img "$SCRIPT/"
-    verify_image "$SCRIPT/recovery.img"
+    verify_image "$SCRIPT/recovery.img" "$RECOVERY_PARTITION_SIZE"
 }
 
 do_clean() {
@@ -127,7 +89,7 @@ do_clean() {
 }
 
 do_env() {
-    exec nix-shell shell.nix
+    exec nix-shell "$SCRIPT/shell.nix"
 }
 
 cmd="${1:-build}"
@@ -148,7 +110,7 @@ for a in "$@"; do
 done
 
 case "$cmd" in
-    build) reenter_build_env; do_build ;;
+    build) reenter_build_env "$SCRIPT/shell.nix" RUBENSLTE_BUILD_IN_ENV; do_build ;;
     clean) do_clean ;;
     env) do_env ;;
 esac
\ No newline at end of file
diff --git a/lib/common.sh b/lib/common.sh
new file mode 100644
index 0000000..bd665ad
--- /dev/null
+++ b/lib/common.sh
@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# Shared helpers for the builders_rubenslte build scripts.
+# Source after setting `SCRIPT` to the repo root and `set -euo pipefail`.
+# Every function is idempotent so iteration (`--no-sync`, re-runs) is safe.
+
+# Print the script's usage() from its header comments (lines 2-9).
+usage_from_header() {
+    sed -n '2,9p' "$0" | sed 's/^# \{0,1\}//'
+}
+
+# Re-execute the current script inside the nix-shell FHS build environment.
+# `env_file`   - nix expression (absolute path, e.g. "$SCRIPT/shell.nix")
+# `in_env_var` - name of the env var that marks "already inside" (prevents recursion)
+# `pre_exec`   - optional shell snippet (e.g. export RB_CMD=...) echoed before re-entry
+#
+# `nix-shell --run` cannot be used here: shell.nix's shellHook `exec`s into the
+# FHS env and swallows any `--run` argument, so we feed the command via stdin.
+reenter_build_env() {
+    local env_file="$1" in_env_var="$2" pre_exec="${3:-}"
+    if [ -z "${!in_env_var:-}" ]; then
+        echo "[*] Re-entering build inside the nix-shell FHS env: $(basename "$env_file") ..."
+        local script_path
+        case "$0" in
+            /*) script_path="$0" ;;
+            *) script_path="$SCRIPT/$(basename "$0")" ;;
+        esac
+        {
+            printf 'export %s=1\n' "$in_env_var"
+            [ -n "$pre_exec" ] && printf '%s\n' "$pre_exec"
+            printf 'bash "%s"\n' "$script_path"
+        } | nix-shell "$env_file"
+        exit $?
+    fi
+    echo "[*] Already inside the nix-shell FHS env."
+}
+
+# Apply every *.patch under `dir_pattern` (repo-root-relative, e.g.
+# "patches/twrp") from the current working directory (the tree root), using
+# `patch -p1`. Checked reverse-first so re-running is a true no-op: GNU patch
+# can otherwise *re-apply* an already-applied hunk (duplicating it) and still
+# exit 0. Never run the real forward apply when the change is already present.
+apply_patches() {
+    local dir_pattern="$1" p log
+    for p in "$SCRIPT"/"$dir_pattern"/*.patch; do
+        [ -e "$p" ] || continue
+        if patch -p1 -s -R --dry-run < "$p" >/dev/null 2>&1; then
+            echo "[*] Already applied: $dir_pattern/$(basename "$p")"
+        elif patch -p1 -s --dry-run < "$p" >/dev/null 2>&1; then
+            patch -p1 -s < "$p"
+            echo "[*] Applied $dir_pattern patch: $(basename "$p")"
+        else
+            log="$(mktemp)"
+            patch -p1 -s < "$p" >"$log" 2>&1 || true
+            echo "[!] WARNING: patch failed: $dir_pattern/$(basename "$p")"
+            cat "$log"
+            rm -f "$log"
+        fi
+    done
+}
+
+# Samsung bootloaders require the SEANDROIDENFORCE trailer on boot/recovery
+# images. Appends it if missing. Never uses command substitution on the image
+# (avoids bash "ignored null byte" warnings) - a pipeline test is enough.
+append_seandroidenforce() {
+    local img="$1"
+    [ -f "$img" ] || return 0
+    if tail -c 16 "$img" | grep -q 'SEANDROIDENFORCE'; then
+        echo "[*] $img already has the SEANDROIDENFORCE trailer"
+    else
+        echo "[*] Appending SEANDROIDENFORCE trailer to $img"
+        printf 'SEANDROIDENFORCE' >> "$img"
+    fi
+}
+
+# Check an image exists, report size vs the partition budget (if given) and
+# fail loudly on overflow (TWRP omni overflows the recovery partition easily).
+verify_image() {
+    local img="$1" budget="${2:-}"
+    [ -f "$img" ] || { echo "ERROR: $img was not produced" >&2; exit 1; }
+    local size
+    size="$(stat -c%s "$img")"
+    if [ -n "$budget" ]; then
+        echo "[*] $img: $size bytes (partition budget: $budget)"
+        if [ "$size" -gt "$budget" ]; then
+            echo "ERROR: $img exceeds the partition budget" >&2
+            exit 1
+        fi
+    else
+        echo "[*] $img: $size bytes"
+    fi
+    sha256sum "$img"
+    echo "Done: $img"
+}
+
+# Populate JACK_REPOSITORY if empty. In-process Jack (JACK_NO_SERVER=1) only
+# runs when the repository holds the jack/jill jars; a repo sync replaces the
+# prebuilts so we (re)seed it with -n (never overwrite a valid copy).
+seed_jack_repository() {
+    local repo="$1" src="$2"
+    mkdir -p "$repo"
+    cp -n "$src"/jack-*.jar "$repo/" 2>/dev/null || true
+    cp -n "$src"/jill-*.jar "$repo/" 2>/dev/null || true
+}
\ No newline at end of file
diff --git a/patches/README.md b/patches/README.md
index a6e2314..2bffcd4 100644
--- a/patches/README.md
+++ b/patches/README.md
@@ -1,20 +1,52 @@
 # Patches
 
-These patches make the omni `twrp-5.1` sources (2015-era) build on a modern
-host toolchain. They are applied automatically by `build_twrp.sh` and are
-idempotent (already-applied patches are detected and skipped).
+These patches make the 2015-era sources build on a modern host toolchain, and
+fix the small LOS 14.1 source-tree issues this project hit. They are applied
+automatically by the build scripts (`build_twrp.sh` and `build_los.sh`) and are
+idempotent (already-applied patches are detected and skipped), so re-running
+after a `repo sync` is safe.
+
+Applied by which script:
+
+- `patches/twrp/` — **build_twrp.sh** (applied at the root of the omni twrp-5.1
+  workspace in `twrp-build/`)
+- `patches/kernel/` — **both** scripts (applied at `kernel/samsung/rubenslte/`
+  in each workspace, the gitea kernel clone `android_kernel_samsung_rubenslte`)
+- `patches/los/` — **build_los.sh** (applied at the root of the cm-14.1
+  workspace in `los-build/`)
+
+## TWRP / omni 5.1 (`patches/twrp/`)
 
 | Patch | File(s) | Problem fixed |
 |-------|---------|---------------|
 | `0001-host-cflags-suppress-stringop-truncation.patch` | `build/core/combo/HOST_linux-x86*.mk` | `-Werror=stringop-truncation` errors with host GCC >= 8 |
 | `0002-build-core-fix-ar-absolute-paths.patch` | `build/core/definitions.mk` | host `ar`/absolute path handling in whole-archive extraction breaks with newer binutils; extract to a temp dir instead |
-| `0003-kernel-add-missing-ARCH_MSM-config-and-defconfig-fixes.patch` | `kernel/.../arch/arm/mach-msm/Kconfig`, `msm8926-sec_rubenslte_defconfig` | adds the missing `ARCH_MSM` Kconfig entry and enables `CONFIG_OF`/`ARCH_MSM` in the variant defconfig (fresh kernel tree lacks them) |
-| `0004-recovery-add-std-gnu++11-for-nullptr-support.patch` | `bootable/recovery/Android.mk` | adds `-std=gnu++11` for `nullptr` under the recovery Clang build |
-| `0005-build-core-combo-remove-icf-safe-for-BFD-ld.patch` | `build/core/combo/TARGET_linux-arm.mk` | `-Wl,--icf=safe` is gold-only; commented out for the BFD linker supplied by the toolchain download |
-| `0006-kernel-timeconst-pl-fix-deprecated-defined-array.patch` | `kernel/.../kernel/timeconst.pl` | `defined(@array)` removed in Perl 5.22+; use `!@val` |
-| `0007-scripts-Makefile-modpost-treat-section-mismatches-as-non-fatal.patch` | `kernel/.../scripts/Makefile.modpost` | drops the `-E` flag so section mismatches are warnings, not errors (newer host binutils) |
-| `0008-build-core-tasks-kernel-fix-KERNEL_CONFIG_OVERRIDE-ordering-and-passthrough.patch` | `build/core/tasks/kernel.mk` | applies the additional config before the override, drops the clobbering `oldconfig` after override, and passes the override on the kernel build command line |
+| `0003-recovery-add-std-gnu++11-for-nullptr-support.patch` | `bootable/recovery/Android.mk` | adds `-std=gnu++11` for `nullptr` under the recovery Clang build |
+| `0004-build-core-combo-remove-icf-safe-for-BFD-ld.patch` | `build/core/combo/TARGET_linux-arm.mk` | `-Wl,--icf=safe` is gold-only; commented out for the BFD linker supplied by the toolchain download |
+| `0005-build-core-tasks-kernel-fix-KERNEL_CONFIG_OVERRIDE-ordering-and-passthrough.patch` | `build/core/tasks/kernel.mk` | applies the additional config before the override, drops the clobbering `oldconfig` after override, and passes the override on the kernel build command line |
 
-The kernel patches (`0003`, `0006`, `0007`) target `kernel/samsung/rubenslte`
-as checked out by `build_twrp.sh`; the others target the omni `twrp-5.1`
-manifest sources — they only apply in the repo workspace, not on a host.
\ No newline at end of file
+These target the omni `twrp-5.1` manifest sources — they only apply inside the
+repo workspace, not on a host.
+
+## Kernel (`patches/kernel/`)
+
+All target `kernel/samsung/rubenslte/...` as checked out by either build
+script. Shared by both builds.
+
+| Patch | File(s) | Problem fixed |
+|-------|---------|---------------|
+| `0001-kernel-arch-msm-config-and-defconfig-fixes.patch` | `arch/arm/mach-msm/Kconfig`, `arch/arm/configs/msm8926-sec_rubenslte_defconfig` | adds the missing `ARCH_MSM` Kconfig entry and enables `CONFIG_OF`/`ARCH_MSM` in the variant defconfig (fresh kernel tree lacks them) |
+| `0002-kernel-timeconst-pl-fix.patch` | `kernel/timeconst.pl` | `defined(@array)` removed in Perl 5.22+; use `!@val` |
+| `0003-kernel-modpost-nonfatal.patch` | `scripts/Makefile.modpost` | drops the `-E` flag so section mismatches are warnings, not errors (newer host binutils) |
+| `0004-kernel-dtc-fcommon-host-build.patch` | `scripts/dtc/Makefile` | `-fcommon` for the flex/bison host objects (GCC 10 default `-fno-common` breaks the dtc host build) |
+
+## LineageOS 14.1 (`patches/los/`)
+
+| Patch | File(s) | Problem fixed |
+|-------|---------|---------------|
+| `0001-device-millet-common-allow-rubenslte.patch` | `device/samsung/millet-common/Android.mk` | include the sub-makefiles for rubenslte (the millet-common shared tree only guards `milletwifi millet3g milletlte`) |
+| `0002-vendor-cmsdk-droiddoc-support-libs-classpath.patch` | `vendor/cmsdk/Android.mk` | droiddoc crash `java.lang.NullPointerException` in `ExecutableMemberDocImpl.position` ("Class android.support.annotation.RestrictTo not found"): put `android-support-annotations` (and `$(cmsdk_LOCAL_JAVA_LIBRARIES)`) on the docs classpath |
+
+Anything needed from the shared millet kernel/device trees that can't be
+expressed in a device repo should go under `patches/kernel/` (kernel) or
+`patches/los/` (other millet-common/vendor trees).
\ No newline at end of file
diff --git a/patches/0003-kernel-add-missing-ARCH_MSM-config-and-defconfig-fixes.patch b/patches/kernel/0001-kernel-arch-msm-config-and-defconfig-fixes.patch
similarity index 100%
rename from patches/0003-kernel-add-missing-ARCH_MSM-config-and-defconfig-fixes.patch
rename to patches/kernel/0001-kernel-arch-msm-config-and-defconfig-fixes.patch
diff --git a/patches/0006-kernel-timeconst-pl-fix-deprecated-defined-array.patch b/patches/kernel/0002-kernel-timeconst-pl-fix.patch
similarity index 100%
rename from patches/0006-kernel-timeconst-pl-fix-deprecated-defined-array.patch
rename to patches/kernel/0002-kernel-timeconst-pl-fix.patch
diff --git a/patches/0007-scripts-Makefile-modpost-treat-section-mismatches-as-non-fatal.patch b/patches/kernel/0003-kernel-modpost-nonfatal.patch
similarity index 100%
rename from patches/0007-scripts-Makefile-modpost-treat-section-mismatches-as-non-fatal.patch
rename to patches/kernel/0003-kernel-modpost-nonfatal.patch
diff --git a/patches/kernel/0004-kernel-dtc-fcommon-host-build.patch b/patches/kernel/0004-kernel-dtc-fcommon-host-build.patch
new file mode 100644
index 0000000..6d41a65
--- /dev/null
+++ b/patches/kernel/0004-kernel-dtc-fcommon-host-build.patch
@@ -0,0 +1,15 @@
+diff --git a/kernel/samsung/rubenslte/scripts/dtc/Makefile b/kernel/samsung/rubenslte/scripts/dtc/Makefile
+index 2a48022c..51531eab 100755
+--- a/kernel/samsung/rubenslte/scripts/dtc/Makefile
++++ b/kernel/samsung/rubenslte/scripts/dtc/Makefile
+@@ -21,8 +21,8 @@ HOSTCFLAGS_srcpos.o := $(HOSTCFLAGS_DTC)
+ HOSTCFLAGS_treesource.o := $(HOSTCFLAGS_DTC)
+ HOSTCFLAGS_util.o := $(HOSTCFLAGS_DTC)
+ 
+-HOSTCFLAGS_dtc-lexer.lex.o := $(HOSTCFLAGS_DTC)
+-HOSTCFLAGS_dtc-parser.tab.o := $(HOSTCFLAGS_DTC)
++HOSTCFLAGS_dtc-lexer.lex.o := $(HOSTCFLAGS_DTC) -fcommon
++HOSTCFLAGS_dtc-parser.tab.o := $(HOSTCFLAGS_DTC) -fcommon
+ 
+ # dependencies on generated files need to be listed explicitly
+ $(obj)/dtc-lexer.lex.o: $(obj)/dtc-parser.tab.h
\ No newline at end of file
diff --git a/patches/los/0001-device-millet-common-allow-rubenslte.patch b/patches/los/0001-device-millet-common-allow-rubenslte.patch
new file mode 100644
index 0000000..73335fb
--- /dev/null
+++ b/patches/los/0001-device-millet-common-allow-rubenslte.patch
@@ -0,0 +1,12 @@
+diff --git a/device/samsung/millet-common/Android.mk b/device/samsung/millet-common/Android.mk
+index ec6b235..00644d8 100644
+--- a/device/samsung/millet-common/Android.mk
++++ b/device/samsung/millet-common/Android.mk
+@@ -16,6 +16,6 @@
+ 
+ LOCAL_PATH := $(call my-dir)
+ 
+-ifneq ($(filter milletwifi millet3g milletlte,$(TARGET_DEVICE)),)
++ifneq ($(filter milletwifi millet3g milletlte rubenslte,$(TARGET_DEVICE)),)
+ include $(call all-subdir-makefiles,$(LOCAL_PATH))
+ endif
\ No newline at end of file
diff --git a/patches/los/0002-vendor-cmsdk-droiddoc-support-libs-classpath.patch b/patches/los/0002-vendor-cmsdk-droiddoc-support-libs-classpath.patch
new file mode 100644
index 0000000..1d2a136
--- /dev/null
+++ b/patches/los/0002-vendor-cmsdk-droiddoc-support-libs-classpath.patch
@@ -0,0 +1,15 @@
+diff --git a/vendor/cmsdk/Android.mk b/vendor/cmsdk/Android.mk
+index dc2b714..3eff5ef 100644
+--- a/vendor/cmsdk/Android.mk
++++ b/vendor/cmsdk/Android.mk
+@@ -207,7 +207,8 @@ cmplat_docs_src_files := \
+     $(call all-html-files-under, $(cyanogenmod_sdk_src))
+ 
+ cmplat_docs_java_libraries := \
+-    org.cyanogenmod.platform.sdk
++    org.cyanogenmod.platform.sdk \
++    android-support-annotations \
++    $(cmsdk_LOCAL_JAVA_LIBRARIES)
+ 
+ # SDK version as defined
+ cmplat_docs_SDK_VERSION := 14.0
\ No newline at end of file
diff --git a/patches/0001-host-cflags-suppress-stringop-truncation.patch b/patches/twrp/0001-host-cflags-suppress-stringop-truncation.patch
similarity index 100%
rename from patches/0001-host-cflags-suppress-stringop-truncation.patch
rename to patches/twrp/0001-host-cflags-suppress-stringop-truncation.patch
diff --git a/patches/0002-build-core-fix-ar-absolute-paths.patch b/patches/twrp/0002-build-core-fix-ar-absolute-paths.patch
similarity index 100%
rename from patches/0002-build-core-fix-ar-absolute-paths.patch
rename to patches/twrp/0002-build-core-fix-ar-absolute-paths.patch
diff --git a/patches/0004-recovery-add-std-gnu++11-for-nullptr-support.patch b/patches/twrp/0003-recovery-add-std-gnu++11-for-nullptr-support.patch
similarity index 100%
rename from patches/0004-recovery-add-std-gnu++11-for-nullptr-support.patch
rename to patches/twrp/0003-recovery-add-std-gnu++11-for-nullptr-support.patch
diff --git a/patches/0005-build-core-combo-remove-icf-safe-for-BFD-ld.patch b/patches/twrp/0004-build-core-combo-remove-icf-safe-for-BFD-ld.patch
similarity index 100%
rename from patches/0005-build-core-combo-remove-icf-safe-for-BFD-ld.patch
rename to patches/twrp/0004-build-core-combo-remove-icf-safe-for-BFD-ld.patch
diff --git a/patches/0008-build-core-tasks-kernel-fix-KERNEL_CONFIG_OVERRIDE-ordering-and-passthrough.patch b/patches/twrp/0005-build-core-tasks-kernel-fix-KERNEL_CONFIG_OVERRIDE-ordering-and-passthrough.patch
similarity index 100%
rename from patches/0008-build-core-tasks-kernel-fix-KERNEL_CONFIG_OVERRIDE-ordering-and-passthrough.patch
rename to patches/twrp/0005-build-core-tasks-kernel-fix-KERNEL_CONFIG_OVERRIDE-ordering-and-passthrough.patch
diff --git a/shell_los.nix b/shell_los.nix
new file mode 100644
index 0000000..a9c3fea
--- /dev/null
+++ b/shell_los.nix
@@ -0,0 +1,61 @@
+# FHS build environment for the LineageOS 14.1 (rubenslte) build.
+# Same package set as shell.nix (TWRP env) plus a host gcc: the kernel kconfig
+# host tools (`conf`) and kernel/scripts are compiled with the host compiler
+# during the LOS build, while the omni 5.1 TWRP build only needs them from the
+# device's arm-eabi toolchain.
+#
+# Intentionally kept as a separate file: the TWRP build is device-tested, so
+# shell.nix is not touched. Keep the two packages sets in sync where possible.
+let
+  pkgs = import (fetchTarball {
+    url = "https://github.com/NixOS/nixpkgs/archive/nixos-22.11.tar.gz";
+  }) {};
+
+  fhs = pkgs.buildFHSUserEnv {
+    name = "android-env";
+
+    targetPkgs = pkgs: with pkgs; [
+      git         # the device/kernel clones (and `repo` plumbing)
+      gitRepo     # AOSP `repo` multi-repo tool
+      gnumake     # `mka` -> make for the bacon build
+      gcc         # host C compiler for kernel kconfig host tools
+      python2     # cm-14.1 era build scripts expect python2
+      python3     # modern `repo` runs under python3
+      curl        # tarball downloads
+      openssl     # used by a few AOSP host tools
+      procps      # `ps`/`pidof` referenced by build scripts
+      util-linux  # uuidgen and friends used during image building
+      android-tools # adb / fastboot for flashing and testing
+      jdk8        # 14.1 needs java <=8 (signapk, dx, jack)
+      schedtool   # legacy tool invoked by some build scripts
+      m4 gperf bison flex   # classic AOSP host toolchain
+      which       # jack-admin / diagnose helpers probe PATH
+      perl        # kernel/scripting helper (timeconst.pl, etc.)
+      libxml2     # xml libs used by host tools
+      zip unzip   # packaging
+      lzop        # legacy lzo support
+      xz          # LZMA ramdisk compression
+      gnupg       # gpg for repo manifest verification (optional)
+      nettools    # minor networking helpers used by host scripts
+    ];
+
+    multiPkgs = pkgs: with pkgs; [
+      zlib
+      ncurses5
+      pkgsi686Linux.gcc9
+      pkgsi686Linux.libstdcxx5
+    ];
+
+    runScript = "bash";
+    profile = "export ANDROID_JAVA_HOME=${pkgs.jdk8.home}";
+  };
+in pkgs.stdenv.mkDerivation {
+  name = "android-env-shell";
+  nativeBuildInputs = [ fhs ];
+  shellHook = ''
+    if [ -n "$BASH_EXECUTION_STRING" ]; then
+      exec android-env -c "$BASH_EXECUTION_STRING"
+    fi
+    exec android-env
+  '';
+}
\ No newline at end of file