[Moto G6 Plus Questions & Answers] f1r3br4nd:
As I was going through the trial-and-error of rooting my phone for the first time, I ended up with both Magisk and SuperSU installed. I have used the "complete uninstall" option to make SuperSU uninstall itself. I used TWRP to restore the system image I had backed up before rooting, and reinstall Magisk. On the Magisk side, I turned on the "Magisk Hide" option for Google, Google Pay, Google Play Store, Google Services Framework, and Netflix. I also enabled "Magisk Core Only Mode" in the settings. The ctsProfile and basicIntegrity checks say true but Google Pay still says I have a "rooted or otherwise modified device" and now Google Play doesn't even show me the "Device certification" field in the settings-- it just ends at "Play Store version"

I should have kept closer track of what root-using apps I installed and removed, but the ones I have right now are: AdFree, Apps2SD PRO, BusyBox Free, Call Recorder Add-on (installed as a Magisk module), ConnectBot, Root Checker, and Titanium Backup.

My questions for the experts:

Is it better to flash unSU.zip via TWRP or just restore the old boot partition and flash Magisk again?

Are there any other places where I should undo changes besides system and boot?

Let's say I get desperate and try to re-flash the latest stock images. What is the best way to preserve my apps and configurations this time around?

I have not found anything about the "Device certification" being outright missing from Google Play settings... does anybody know what causes this and how to fix it?

For my fellow noobs who might in the future find this post, here are some details on how I got to where I am (a working, rooted, non-bricked Moto G6plus but not yet able to use Google Pay, and installed entirely within Linux). I had to piece this together from various places, so hopefully if you find this post you can go straight to the ones that ended up working for me... and learn from my mistake-- do _not_ install SuperSU if you want to your device to pass SafetyNet checks. If I got any of the facts wrong, please correct me and I will update.

TWRP is a recovery tool which you can use to backup and install partitions on android.

There are various already rooted system images floating around, in various states of completeness and compatibility. I nearly bricked my phone that way. Luckily I was able to restore it using the stock image and instructions posted here.

There is little in the way of Linux-specific instructions. Don't try to look for Odin or "Android USB" drivers or whatever. All you need is to run sudo apt-get install android-tools and it will give you adb and fastboot. Then, create the following file... /etc/udev/rules.d/70-android.rules (owned by root, readable by all) and put the following in this file:

SUBSYSTEM=="usb", ATTRS{idVendor}=="22b8", ATTRS{idProduct}="2eb7", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTRS{idVendor}=="04e8", ATTRS{idProduct}="685d", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTRS{idVendor}=="04e8", ATTRS{idProduct}="685d", ENV{ID_MM_DEVICE_IGNORE}="1"

Finally, run (only need to do this once) sudo service udev restart. Non-Debian-based distros might have different syntax for package installation and udev restart but the basic idea is the same. From this point forward, you can follow the same command line instructions as Windows users.

Make sure you have at least 10 or so Gb free on the phone's SD card.

The basic root process seems to be: unlock boot loader, download a zipfile with EITHER SuperSU OR Magisk and save it to the SD card on your droid. Drop your phone into fastboot mode, push the TWRP image onto it.

Your droid will reboot into the TWRP app. At this point you back up the following partitions: boot,dsp,efs1,efs2,fsg,logo,oem,system,system_image,vendor_image.

Then, still in TWRP you select the zip file you earlier put at the top level of the SD card and flash it. It will make the necessary changes to enable root for apps that you want to have root and then reboot the phone.

I didn't understand initially but SuperSU and Magisk are two alternate ways of rooting your droid-- both can grant root access to apps. The difference is that SuperSU modifies several special partitions including system, while Magisk somehow gives you root without permanently modifying any of the partitions (don't ask me how). The problem is that lately Android OS checks for modified system partitions via SafetyNet. If the OS detects alterations it prevents you from using Google Pay and causes your Google Play account to flag your device as uncertified which apparently will prevent you from installing certain apps. Unlike SuperSU, Magisk can hide itself allowing you to have a rooted phone while still enjoying the benefits of having a certified device.