Waydroid (Android 16 + Kitsune Mask): daemon and system_server bridge OK (`vector-cli status` works) but no app process is ever injected — manager stays "Not activated"

Start with org.matrix.vector.manager.ipc.DaemonClient.kt:39 and the code comments or entry points that select --late-inject and read the LATE_INJECT runtime flag. Reproduce the missing app-side injection on the stated Waydroid image, then determine whether a supported root/Zygisk stack or an explicit configuration path can make the manager binder available.

Environment

• Waydroid 1.6.3 on NixOS 26.05 (x86_64), image WayDroid-ATV/waydroid-builds a16-qpr0 (LineageOS 23, Android 16 / SDK 36, mainline vendor)
• Root: Kitsune Mask 26.3.1 / versionCode 26301 (magisk -v → 0fe46c5a-delta:MAGISK:R), built-in Zygisk (zygisk=1 in magisk.db)
• Vector v2.2 (Vector-v2.2-3080-Release.zip) installed with magisk --install-module; manager org.matrix.vector.manager installed with pm install (the same symptom was reproduced earlier with LSPosed v1.11.0-7209-zygisk-release.zip)
• ro.dalvik.vm.native.bridge is not involved; libzygisk.so is present in zygote and in app processes

What works

The daemon and the system_server bridge are healthy — this is not a mangled manager/daemon setup:

I VectorDaemon     : Vector daemon started: lateInject=false, proxy=serial
D VectorSystemServer: Registering bridge service for `system_server` with name `serial`.
I VectorNative(SS) : Got system server binder via serial on attempt 1.
I VectorNative(SS) : Manager binder from system_server: ...
I VectorDaemon     : Successfully injected Vector framework into system_server.
I VectorDaemon     : Successfully hooked Activity Supervisor for Manager redirection
I VectorZygiskBridge: onTransact: action=SEND_BINDER, callerUid=0
I VectorDaemon     : Successfully injected Vector IPC binder for applications.

and, using the channel that does not depend on the app-side handoff:

$ waydroid shell -- sh /data/adb/modules/zygisk_vector/cli status
Framework Version: 2.2
Version Code: 3080
API Version: 102
Enabled Modules: 0

What fails

No app process is ever Zygisk-injected, so the manager can never obtain its binder:

W VectorManager: splash: no daemon binder after 2500ms, continuing unactivated
W VectorManager: java.lang.IllegalStateException: Daemon is not active
        at org.matrix.vector.manager.ipc.DaemonClient$runIpc$2.invokeSuspend(DaemonClient.kt:39)

Evidence that it is the Zygisk layer, not Vector:

• logcat after launching apps contains no VectorNative / VectorZygiskBridge lines for any app (only the single system_server one above) — i.e. the module's Zygisk companion never runs in app processes.
• /proc/<manager-pid>/maps contains /system/lib64/libzygisk.so but no Vector native library, i.e. Zygisk injects its loader, and the module payload is never entered.
• The same is true for every other app (no injection, no module logs), regardless of scopes.

Why (as far as I could trace it on Waydroid)

Two stacked problems, both Waydroid-specific:

1. Zygisk on Waydroid needs the Kitsune Mask canary (the community waydroid_magisk tool says so, and the "stable" Zygisk toggle is a no-op there). With the stable build above, the module companions simply never run in app processes.
2. The canary cannot be installed on these images: its --setup-sbin step aborts, e.g.

$ waydroid shell -- /system/etc/init/magisk/magisk64 --auto-selinux --setup-sbin /system/etc/init/magisk
clone_attr /sbin -> /root failed: No data available (os error 61)
rc=1
→ init: Could not start service 'magisk_late' ... Cannot find '/sbin/magisk'

(guest SELinux is Disabled; the old stable two-argument --setup-sbin <dir> <tmpdir> form still works, the canary's 1-argument Magisk 27 form does not; details in waydroid/waydroid#2433 — I filed it there since nitanmarcel/waydroid-magisk is archived).

3. Vector's --late-inject mode (proxy name serial_vector, which would side-step exactly the kind of service-name collisions seen on Android 16) needs the LATE_INJECT runtime flag, which (per the code comments) comes from NeoZygisk — and NeoZygisk/ZygiskNext all require Magisk versionCode >= 26402, which is unreachable for the same reason (the canary is the only build above 26401 and it will not install).

Question

• Is Waydroid supported at all by Vector, and if so what root/Zygisk stack do you recommend for it? (My reading is that today it is "not really possible", but I would rather be told than guess.)
• Would you accept a change that lets --late-inject be forced without the NeoZygisk-provided runtime flag (e.g. via a config/db switch)? On Waydroid that flag is the only thing standing between the daemon and a working app-side channel, and the proxy name serial_vector avoids the collision entirely.
• If the answer is "fix your Zygisk first": is "Zygisk companion never runs in app processes even though libzygisk.so is mapped everywhere" a known Waydroid symptom, and is there any diagnostic you would like from this image? It is a throwaway VM, so I can iterate freely.