[Google Pixel XL Guides, News, & Discussion] fiveighteen:
Besides a hiccup with originally flashing the wrong SuperSU file, I got everything to work on the first try... this never happens lol.

Here's my experience:

1. Unlock your bootloader and take the latest OTA

2. Set up a PIN in Settings/Security/Screen Lock (for TWRP to decrypt storage)

3. Transfer following files to internal storage:

TWRP -- twrp-3.0.2-0-RC1-fastboot-marlin.img

TWRP -- twrp-pixel-installer-marlin-3.0.2-0-RC1.zip

ROM -- purenexus_marlin-7.1.1-20170215-OFFICIAL.zip (can skip to stay on stock ROM)

ROM -- NOF26W_vendor.img

ROOT -- SuperSU-v2.79.zip (The stable version, not an "SR" version! It won't work due to SELinux handling changes.)

ROOT -- libandroid_runtime_pixelxl_NOF26V.tar (extract files to folder, move folder to internal storage)

ROOT -- suhide-v0.55.zip

ROOT -- suhide-rm-v0.51.zip

ROOT -- RootSwitch-1.3.3.2.apk (second post, requires sign up)

KERNEL -- ElementalX-P-1.06.zip​

From fresh, unlocked, stock phone:

4. Reboot to bootloader, plug into PC, and type

fastboot boot C:\path\to\twrp-3.0.2-0-RC1-fastboot-marlin.img

If you accidentally flash TWRP to your device instead of temporarily booting the image, download the latest factory image for your device and reflash the boot image.​

5. From the TWRP image, Install -> twrp-pixel-installer-marlin-3.0.2-0-RC1.zip

6. Wipe data/factory reset

7. Install -> purenexus_marlin-7.1.1-20170215-OFFICIAL.zip

8. Install -> twrp-pixel-installer-marlin-3.0.2-0-RC1.zip (AGAIN) -- reboot system (~3 mins)

9. You'll get a "Vendor error" upon boot. Reboot to recovery, Install --> Image --> Vendor --> NOF26W_vendor.img -- reboot system

10. Reboot to Recovery, Mount -> System

11. Use Advanced -> File Manager to rename "/system/system/lib/libandroid_runtime.so" and "/system/system/lib64/libandroid_runtime.so" files to libandroid_runtime.so.bak

12. Use Advanced -> File Manager to copy libandroid_runtime.so files from the extracted libandroid_runtime_pixelxl_NOF26V.tar to /system/system/lib and /system/system/lib64, respectively

13. Use Advanced -> File Manager to set permissions on each file (select the file -> chmod --> 0644)-- reboot system

If your phone sits on the Google splash screen and doesn't get to the bouncing balls, you probably don't have the right lib files for your build.

If you want to give up, delete the libandroid_runtime.so files and rename the ones from .bak to .so (remember in both lib and lib64 folders), or just flash the system.img in fastboot.

If it boots, Safety Net should PASS (you're not rooted yet)

14. Reboot to Recovery, use File Manager to delete fstab.marlin (select the file, delete)

15. Install -> SuperSU-v2.79.zip -- reboot system

Safety Net should FAIL (you're rooted!)​

16. Download and install "Suhide GUI" from the Google Play Store and open/close it to grant root access

17. Install RootSwitch v1.3.3.2 and open/close it to grant root access

If you run these after installing suhide instead of before, there is a glitch where the SuperSU prompt for root access doesn't appear.

You can go to Settings/SuperSU/Settings and change Default access -> Grant in order to still get root access.​

18. Reboot to Recovery, Install -> suhide-v0.55.zip -- reboot system

19. Open Suhide GUI and set apps to hide

UID -- Android Pay

UID -- Pokemon GO

UID -- SafetyNet attest

UID -- SafetNet Playground

UID -- Snapchat

Process -- com.android.vending

Process -- com.google.android.gms

Process -- com.google.android.gms.feedback

Process -- com.google.android.gms.persistent

Process -- com.google.process.gapps

Additional services found here.

Additional services found here.

If Android Pay detects root, tap Add a Card, then back out and try paying again. That seems to reset the root check.​

20. Open RootSwitch and test on/off

Safety Net (and rest of apps) should FAIL with it on, PASS with it off (hidden root!)​

21. Reboot to Recovery, Install -> ElementalX-P-1.06.zip

22. Set the I/O Scheduler based on what you prioritize the most:

Better battery life: FIOPS

Better multitasking: CFQ

23. Set the I/O Read Ahead Buffer based on how much flash storage you have remaining:

Less than 8GB: 128KB

8GB: 512KB

16GB: 1024KB

More than 32GB: 2048KB

Update:

4. From TWRP, Install -> purenexus_marlin-7.1.1-20170215-OFFICIAL.zip

5. Install -> twrp-pixel-installer-marlin-3.0.2-0-RC1.zip (AGAIN) -- reboot system (~5 mins)

6. You'll get a "Vendor error" upon boot. Reboot to recovery, Install --> Image --> Vendor --> NOF26W_vendor.img -- reboot system

7. Reboot to Recovery, Mount -> System

8. Use Advanced -> File Manager to rename "/system/system/lib/libandroid_runtime.so" and "/system/system/lib64/libandroid_runtime.so" files to libandroid_runtime.so.bak

9. Use Advanced -> File Manager to copy libandroid_runtime.so files from the extracted libandroid_runtime_pixelxl_NOF26V.tar to /system/system/lib and /system/system/lib64, respectively

10. Use Advanced -> File Manager to set permissions on each file (select the file -> chmod --> 0644)-- reboot system

If your phone sits on the Google splash screen and doesn't get to the bouncing balls, you probably don't have the right lib files for your build.

If you want to give up, delete the libandroid_runtime.so files and rename the ones from .bak to .so (remember in both lib and lib64 folders), or just flash the system.img in fastboot.

If it boots, Safety Net should PASS (you're not rooted yet)

11. Reboot to Recovery, use File Manager to delete fstab.marlin (select the file, delete)

12. Install -> SuperSU-v2.79.zip -- reboot system

Safety Net should FAIL (you're rooted!)​

13. If you don't already have suhide set up:

13.1. Download and install "Suhide GUI" from the Google Play Store and open/close it to grant root access

13.2. Install RootSwitch v1.3.3.2 and open/close it to grant root access

If you run these after installing suhide instead of before, there is a glitch where the SuperSU prompt for root access doesn't appear.

You can go to Settings/SuperSU/Settings and change Default access -> Grant in order to still get root access.​

13.3. Reboot to Recovery, Install -> suhide-v0.55.zip -- reboot system

13.4. Open Suhide GUI and set apps to hide

UID -- Android Pay

UID -- Pokemon GO

UID -- SafetyNet attest

UID -- SafetNet Playground

UID -- Snapchat

Process -- com.android.vending

Process -- com.google.android.gms

Process -- com.google.android.gms.feedback

Process -- com.google.android.gms.persistent

Process -- com.google.process.gapps

Additional services found here.

If Android Pay detects root, tap Add a Card, then back out and try paying again. That seems to reset the root check.​

14. Open RootSwitch and test on/off

Safety Net (and rest of apps) should FAIL with it on, PASS with it off (hidden root!)​

15. Reboot to Recovery, Install -> ElementalX-P-1.06.zip

16. Set the I/O Scheduler based on what you prioritize the most:

Better battery life: FIOPS

Better multitasking: CFQ

17. Set the I/O Read Ahead Buffer based on how much flash storage you have remaining:

Less than 8GB: 128KB

8GB: 512KB

16GB: 1024KB

More than 32GB: 2048KB

Uninstallation/Modification:

Reflashing will not remove suhide due to it installing to the data partition. Flash suhide-rm-v0.51.zip in TWRP. Otherwise, you will get stuck on the bouncing balls at boot after trying to root again.

Thanks to [MENTION=522448]Fenny[/MENTION], [MENTION=2245716]laxattack[/MENTION] (his steps that I mostly followed), [MENTION=3900528]yearn2burn[/MENTION] (his tips from painful experiences), and [MENTION=5811506]Saber[/MENTION] (I/O Schedulers and read ahead buffer info).