[Sony Xperia XZ Premium ROMs, Kernels, Recoveries, ] LSS4181:
Still problems.

Flashed the Customized CN FTF (47.2.A.2.33) with Flashtool and after confirming the stock ROM works, I went on to boot (not flash) Twrp-Q-v2.img. This time it worked so I checked for things and pushed some necessary files to the SD card.

I don't really know the right order to flash, so I left recovery to bootloader to flash OEM image first (as well as actually flashing the recovery), then booted the Twrp-Q-v2 image again (because the stock kernel will not boot to the recovery image by default), and from this time onwards I got stuck with a black screen.

Strangely, the device is accessible by adb and I could get a dmesg (see attachment). I can also find the /tmp/recovery.log (see below), but the rest of the stuffs are not accessible.

Starting TWRP 3.1.1-0-cd00a8b3 on Mon Jun 22 05:00:04 1970
(pid 569)
BOARD_HAS_NO_REAL_SDCARD := true
RECOVERY_SDCARD_ON_DATA := true
I:Lun file '/sys/class/android_usb/android0/f_mass_storage/lun0/file' does not exist, USB storage mode disabled
TW_INCLUDE_CRYPTO := true
I:TW_BRIGHTNESS_PATH := /sys/class/leds/wled/brightness
I:Found brightness file at '/sys/class/leds/wled/brightness'
I:TWFunc::Set_Brightness: Setting brightness control to 4095
I:LANG: en
Starting the UI...
setting DRM_FORMAT_RGB565 and GGL_PIXEL_FORMAT_RGB_565
cannot find/open a drm device: No such file or directory
fb0 reports (possibly inaccurate):
vi.bits_per_pixel = 32
vi.red.offset = 0 .length = 8
vi.green.offset = 8 .length = 8
vi.blue.offset = 16 .length = 8
setting GGL_PIXEL_FORMAT_RGBA_8888
double buffered
framebuffer: 0 (1080 x 1920)

EDIT: Interestingly, if I boot to the official TWRP, this time it'll stuck on Sony logo. After going back to bootloader, fastboot flash boot (extracted from Treble-xzp-0.8.zip), and Twrp-Q-v2 recovery, I could use fastboot boot to enter TWRP again without issues, but I won't be able to reboot the recovery (stuck on Sony logo), and if I do fastboot boot Twrp-Q-v2.img again I'll encounter the same black screen issue unless I repeat the procedure.

EDIT 2: Tried flashing Resurrection Remix (A only)... stuck on Sony logo. Maybe I should try AEX. From the looks of it, I cannot keep booting to your TWRP. I need to boot to something else before booting to your TWRP again.

EDIT 3: Flashed AEX and it booted. However, the Bluetooth is broken (crashing).

12-19 13:52:19.647 4367 4367 D AndroidRuntime: Shutting down VM
12-19 13:52:19.649 4367 4367 E AndroidRuntime: FATAL EXCEPTION: main
12-19 13:52:19.649 4367 4367 E AndroidRuntime: Process: com.android.bluetooth, PID: 4367
12-19 13:52:19.649 4367 4367 E AndroidRuntime: java.lang.RuntimeException: Unable to instantiate application com.android.bluetooth.btservice.AdapterApp: java.lang.ClassNotFoundException: Didn't find class "com.android.bluetooth.btservice.AdapterApp" on path: DexPathList[[zip file "/system/framework/javax.obex.jar", zip file "/system/app/Bluetooth/Bluetooth.apk"],nativeLibraryDirectories=[/system/app/Bluetooth/lib/arm64, /system/app/Bluetooth/Bluetooth.apk!/lib/arm64-v8a, /system/lib64, /system/lib64]]
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at android.app.LoadedApk.makeApplication(LoadedApk.java:1069)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5903)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at android.app.ActivityThread.access$1100(ActivityThread.java:202)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1658)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at android.os.Handler.dispatchMessage(Handler.java:106)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at android.os.Looper.loop(Looper.java:193)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at android.app.ActivityThread.main(ActivityThread.java:6739)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at java.lang.reflect.Method.invoke(Native Method)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:495)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:858)
12-19 13:52:19.649 4367 4367 E AndroidRuntime: Caused by: java.lang.ClassNotFoundException: Didn't find class "com.android.bluetooth.btservice.AdapterApp" on path: DexPathList[[zip file "/system/framework/javax.obex.jar", zip file "/system/app/Bluetooth/Bluetooth.apk"],nativeLibraryDirectories=[/system/app/Bluetooth/lib/arm64, /system/app/Bluetooth/Bluetooth.apk!/lib/arm64-v8a, /system/lib64, /system/lib64]]
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at dalvik.system.BaseDexClassLoader.findClass(BaseDexClassLoader.java:134)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at java.lang.ClassLoader.loadClass(ClassLoader.java:379)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at java.lang.ClassLoader.loadClass(ClassLoader.java:312)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at android.app.AppComponentFactory.instantiateApplication(AppComponentFactory.java:50)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at android.app.Instrumentation.newApplication(Instrumentation.java:1121)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	at android.app.LoadedApk.makeApplication(LoadedApk.java:1061)
12-19 13:52:19.649 4367 4367 E AndroidRuntime:	... 9 more
12-19 13:52:19.657 4367 4367 I Process : Sending signal. PID: 4367 SIG: 9
12-19 13:52:19.668 1259 2596 I ActivityManager: Process com.android.bluetooth (pid 4367) has died: psvc PER

EDIT 4: Now that AEX booted and works, can I flash Gapps, Magisk, etc. at this point? I recall (with AOSP) if I flash GApps AFTER I have booted to the system once the system would then be unable to boot.

EDIT 5: Flashed Magisk and some modules now it bootlooped at Sony logo... Guess I really can't flash it after booting. However, it's already clear that I cannot boot to TWRP twice in a row (the phone has to be successfully booted to something else before booting to TWRP again or it'll get stuck)... so I'll have to find a solution myself (yup, it'd stuck on TWRP logo if I do).

EDIT 6: It seems the following procedure works, though exactly what the cause could be is unknown.

1. Fastboot boot to TWRP-Q and do something that needs to reboot to recovery again. Don't reboot recovery, go to bootloader instead.

2. Fastboot boot to official TWRP (twrp-3.2.3-0-maple), let it stuck on Sony logo, then return to Fastboot mode.

3. Fastboot boot to TWRP-Q again. This time it'll properly boot without being stuck (or auto-reboot).

EDIT 7: Tried to reflash the GSI and such (to start over) yet this time that method doesn't work anymore. The official TWRP managed to get stuck on TWRP logo and now I can't get out without booting into the GSI once. Will look for ways to break the loop...

EDIT 8: Looks like I simply can't use Magisk here, for now. The AVB 1.0 (which the boot image has been signed with) might be interfering... By the way... when I was flashing the stock FW using FlashTool, I used 47.1 FSC which still works, and I intentionally left out the five "Misc TA" parts (FOTA-RESET, AUTO-BOOT, etc.) because I thought it might be unsafe to flash. What are those Misc TA parts do and do I need to flash them as well (and are they safe to flash)? The stock FW could work without them.