Thank you so much! Yeah, I've tried the lk as well. All img files from he OTA zip, actually. It certainly seems that /data is being decrypted successfully. I haven't tried pulling any of the files with ADB, but I would think if file and folder names are looking right, that the decryption is working.
As near as I can tell, it appears this would
require the use of FDE (Full Device Encryption) and not FBE (File-Based Encryption). Yet so far I've only managed to get FBE and not managed to cause it to do FDE. One of the dialogs during setup almost sounds like choosing between FBE/FDE, but I chose the one I would expect to generate FDE yet still ended up with FBE.
Then after some persistence I think I've figured out the answer to my own question. I suspect @Ninji's TWRP build was based on TWRP's minimal OmniROM manifest:
https://github.com/minimal-manifest-twrp/pl...ifest_twrp_omniBranch twrp-9.0. Took a bit of adjustment to get my first build operational, but I have a successful build. Now dealing with the above issue and working on building the kernel from source.