@ProfileUser private static void enableCriticalAppsIfNeeded(final Context context, final DevicePolicies policies) {
		final Set<String> pkgs = CriticalAppsManager.detectCriticalPackages(context.getPackageManager());
		for (final String pkg : pkgs) try {
			policies.enableSystemApp(pkg);        // FIXME: Don't re-enable explicitly cloned system apps. (see ClonedHiddenSystemApps)
			policies.invoke(DevicePolicyManager::setApplicationHidden, pkg, false);
		} catch (final IllegalArgumentException ignored) {}		// Ignore non-existent packages.
	}
This is the normal procedure after ManagedProvision finished its provisioning, running in profile.
engine/src/main/java/com/oasisfeng/island/provisioning/IslandProvisioning.java