# Safety and threat model

## Non-negotiable boundary

This project uses only userland behavior and public, open-source information.
It excludes kernel and hypervisor code, exploit development, DRM bypass,
proprietary SDK material, leaked or decrypted headers/binaries, direct MMIO or
register writes, clock/SMU/fan control, boost settings, and firmware patches.

No payload or ELF may be transferred to or executed on a PS5 without explicit
approval from Jens in the active task. There is no boot-time or automatic
execution path.

Documented temporary process/kernel runtime changes made by the exact public
loader or SDK may be classified as expected volatile, restored by the loader,
or payload-process-local. They are not automatically unsafe. Persistent writes
and unbounded or unknown effects remain hard blockers.

## Assets and adversaries

Protected assets include the console's stability, display availability, user
data, network credentials, private repository credentials, and the accuracy of
the project's compatibility claims.

Relevant failure or threat sources:

- an incorrect guessed ABI that corrupts stack or memory;
- a command submission that hangs the GPU or display path;
- unbounded waits or incomplete cleanup after partial initialization;
- symbol presence being mistaken for compatible semantics;
- firmware drift;
- malicious or compromised upstream artifacts;
- secrets entering logs, manifests, commits, or remote URLs;
- a build or CI target silently becoming a deployment path.

## Phase-0 controls

| Risk | Control | Verification |
|---|---|---|
| ABI guess is called | No GNM declarations or calls; symbol addresses never escape | `phase0_safety_audit` test |
| GPU work is submitted | No submit/draw/dispatch/flip call sites | source allowlist audit |
| GPU memory changes | No GPU allocator, mapper, resource registration, or command buffer | source and build-graph audit |
| Probe runs accidentally | target disabled by default; runtime acknowledgement; firmware gate | CMake tests and code review |
| Unknown firmware runs | default is `NONE`; discovery build accepts only exact `9.60` | unit test, CMake gate, compatibility file |
| Automatic deployment | no deploy/test/run target; output is compile artifact only | CMake audit |
| Supply-chain substitution | immutable upstream commit and release SHA-256 | lock manifest and bootstrap script |
| Secret disclosure | secret filename ignores, no credential scripts, boolean-only logs | repository scan before push |
| Adapter accidentally claims hardware | compiled queries report unavailable and reject hardware requests | adapter tests |
| Resource lifecycle leaks | context refuses destruction while child handles exist | mock integration tests |
| Phase-1 target enters normal build | separate option defaults off and requires PS5 plus explicit SDL path | configure and source audit |
| Pre-gate SDL side effect | candidate does not link SDL2main; gate precedes `SDL_Init` | source-order audit and ELF imports |
| SDK CRT changes kernel state before `main` | classify exact effects; permanent legacy artifact remains blocked | pinned-source runtime audits and ADR-0010 |

## Probe side-effect statement

After its firmware gate, project code requests only system module loading,
symbol lookup, boolean logging, and module unloading. It does not request a GNM
operation. The pinned SDK source proves that `dlopen` can call
`sceKernelLoadStartModule` and that `dlclose` can call
`sceKernelStopUnloadModule`; module start/stop internals remain unknown.

More importantly, SDK v0.41's payload CRT runs before `main`. Its startup calls
`__patch_init`, which writes process credential capability/attribute fields and
syscall-address limits through the SDK's kernel read/write primitives. The CRT
also sets libc `__isthreaded`, initializes syscall/kernel/log/rtld state, may
load `libSceSysmodule.sprx`, allocates loader bookkeeping, relocates the
payload, and runs constructors. Normal termination runs payload destructors;
project `dlclose` requests module stop/unload only when this open loaded it.
There is no guaranteed cleanup after a hang, crash, partial load, or failed
stop/unload.

Therefore **no GPU mutation or rendering operation is requested by project
code**. The existing ELF remains permanently ineligible by artifact-specific
denylist, independently of the corrected Phase-0.6 classification model.

The firmware-9.60 capability artifact with SHA-256
`4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
is permanently blocked in `manifests/artifact-denylist.json`. Its manifest
states `execution_eligible=false`, and all new manifests default to the same
false value. `tools/check_artifact_execution_policy.py` must be the first
static gate used by repository tooling and Payload Manager integrations:
missing or false eligibility, malformed input, changed bytes, or a denylist
match returns `DENY`. A pass is not execution authorization.

## Phase-0.5 startup result

The stock v0.41 CRT is `UNSAFE`. Omitting it is mechanically possible, but the
loader caller and its return, cleanup, crash, and pre-entry behavior are
`UNPROVEN`. No minimal startup source or ELF exists, and the corresponding
CMake option fails closed. See `docs/runtime/` and
`manifests/runtime/phase-0.5-startup-audit.json`.

## Phase-0.6 historical lifecycle result

The installed Payload Manager v0.3.1 and elfldr v0.23 are exact public-release
matches. Temporary QA flag, credential, ptrace, mapping, and SDK startup
effects are classified individually. The lifecycle still fails closed because
it has `PERSISTENT_WRITE` and `UNBOUNDED_OR_UNKNOWN` effects: unbounded ptrace
loops, no detached-child watchdog, unresolved return/reaping/cleanup,
incomplete credential restoration, no launch-time hash check, and a manager
upload path that writes `/data/pldmgr/payloads`.

That result remains immutable evidence for the unmodified public-release
chain. It is not the current runtime profile.

## Phase-0.7 offline deployment-readiness result

The hardened elfldr and controlled Payload Manager close the Phase-0.6
implementation blockers with bounded ptrace steps, complete checked credential
restoration, centralized cleanup, a two-second kill/reap watchdog, exact
same-file-descriptor hashing, and receiver-side digest/denylist enforcement.
The lifecycle ELF is a normal SDK v0.41 payload that sends one notification
and calls `_exit`.

The current `controlled-ps5-runtime` profile binds exact firmware 9.60, SDK,
source commits, hashes, sizes, expected effects, a removable controlled
artifact-directory write budget, no payload network, 2000 ms maximum runtime,
and no retry. It is `READY_FOR_HARDENED_RUNTIME_DEPLOYMENT` only:
`installed=false`, `execution_authorized=false`, `transferred=false`, and
`executed=false`.

No PS5 connection, transfer, installation, or execution was used to reach
this decision. Hardware behavior remains unproven. The normal CRT
`__patch_init` path is process-local but means the lifecycle is not a
kernelwrite-free artifact. The old blocked hash remains permanently denied.
See `docs/runtime/phase-0.7-hardening.md` and
`manifests/runtime/phase-0.7-offline-audit.json`.

## Phase-0.8 read-only preflight result

The offline collector-admissibility review is
`READ_ONLY_PREFLIGHT_BLOCKED`. The exact Payload Manager v0.3.1 HTTP handler
sets an in-process active flag for every non-`OPTIONS` request.
`/autoload_status` additionally sets `autoload_triggered` and reads the
autoload configuration. Direct filesystem collection has no pinned collector
or proof excluding atime, audit-log, cache, metadata, service-state, or
on-device-log changes.

No on-device session was started and no PS5 connection was made. Current
firmware, live object identities, listeners, startup state, and rollback
backups remain unobserved. The exact stock Payload Manager backup is therefore
a hard open gate. Installation, lifecycle, execution, and automatic retry
remain unauthorized. See `docs/runtime/phase-0.8-read-only-preflight.md` and
`manifests/runtime/phase-0.8-read-only-preflight.json`.

## Phase-0.9A anti-brick design result

The offline anti-brick layer is `DESIGN_ONLY`. It models exact pre-image
identity, separate reopened backup, inactive staging, quiescence, an atomic
switch, post-switch verification and separately authorized rollback. No such
PS5 switch or recovery primitive is claimed. All fourteen interruption
boundaries remain `UNPROVEN`, so the design is not installation-suitable.

The host simulator performs only in-memory logical writes and cannot connect,
transfer, install, execute, open a target artifact or start a compiler. Its
synthetic atomic primitive is fault-test scaffolding, not hardware evidence.
The byte-exact on-device Payload Manager backup and recovery independent of
both elfldr and Payload Manager remain catastrophic hard gates. No
authorization is granted and automatic retry remains false.

## Phase-0.9B observer feasibility result

The offline result is `BLOCKED`. Normal SDK v0.41 startup is not
kernelwrite-free because `_start()` reaches `__patch_init()` before `main`.
Omitting the CRT is mechanically possible, but safe custom entry, return/exit,
crash handling and loader cleanup remain `UNPROVEN`.

The hash-bound hardened elfldr route deliberately gives the payload no
stdout/stderr socket, and the controlled Payload Manager transport does not
receive payload output. Notifications, klog and stock manager HTTP are not a
proven bounded non-persistent result channel. No observer source, target, ELF,
linker map or package was created. All device authorizations remain false, and
no PS5 action occurred. See
`docs/runtime/phase-0.9b-observer-static-audit.md`.

## Phase-0.9C execution-feasibility result

The offline classification is
`BLOCKED_MULTIPLE_FOUNDATIONAL_CONTRACTS`. Source review proves that a normal
SDK entry is side-effecting before `main`; a freestanding entry has no closed
stack/BSS/relocation/TLS, read, monotonic-time, return, exit, or cleanup
contract. A normal `ret` resumes an unproven SceSpZeroConf continuation, and a
watchdog kill is not accepted as safe exit.

The 4096-byte D1 result format passes deterministic host tests, but no current
caller-owned target buffer, copy-out, cleanup finalizer, or manager delivery
exists. Firmware source two is absent; an SDK export name alone is not an ABI.
Filesystem and platform reads may still affect metadata, atime, audit, caches,
counters, service/security state, open bookkeeping, accounting, object
lifetime, or races. No target source, ELF, map or package was built, and no PS5
action or authorization occurred. See
`docs/runtime/phase-0.9c-static-audit.md`.

## Phase-0.9D existing-stack readback result

The offline decision is `BLOCKED_NO_READBACK_PATH`. The full and controlled
Payload Manager profiles contain uploads, installs, deletes, launch-time file
reads, directory/configuration observations, and process actions, but no
binary-safe file-download response. Hardened elfldr returns fixed status text;
its controlled manager transport sends and closes without receiving component
bytes.

The full-profile `server_active_flag` is process-local and only suppresses a
fallback notification in audited source. It is `LOW_VOLATILE`, but has no
in-process reset and must be explicitly accepted in any future permission.
`/autoload_status` is excluded because it sets `autoload_triggered` and can
alter worker timing. No PS5 was contacted, no file was transferred, and no
target, observer, client, backup, package, staging action, or authorization was
created. See `docs/runtime/phase-0.9d-readback-feasibility.md`.

## Phase-0.9E bootstrap provenance gate

The exact external exploit/host and rudimentary port-9020 listener must be
available and provenance-bound before they can be considered an independent
rescue executor. A matching filename, an opaque console backup, a public
upstream, a generic sender command, or a conceptual dependency graph is not
enough. Unknown filesystem staging or autoload effects are brick-relevant and
remain hard stops.

No Phase-0.9F target design is authorized while the receive, mapping,
entrypoint, live-file, output, cleanup, crash, and reboot contracts are
missing. Phase 0.9E permits only local hashing, source/binary inspection,
schemas, manifests, and host-only policy tests. It permits no network socket,
device client, transfer, target build, payload, install, execution, autoload,
retry, or recovery action.

Phase 0.9E-R permits only bounded official `Gezine/Y2JB` GitHub acquisition
and private-origin push. Official metadata excludes every current release
asset from matching the local backup, and official source contains no
port-9020 listener implementation. The ignored official source tree is
inspection-only; downloaded code was not executed. No outer association may
be promoted to opaque inner provenance, and neither an operator attestation
nor host tests are runtime evidence. All device, build, transfer, execution,
installation, lifecycle, autoload, write, and retry authorizations remain
false.

Phase 0.9E-R2 permits only host-side hashing, bounded browser metadata copies,
the exact MediaFire object page, one mandatory official backup, and
source-motivated community assets. Downloaded archives are static evidence:
never execute or restore them, never track them, and remove temporary copies.
The SIECAF parser is read-only and may inspect only public fixed-width
structural metadata; it may not decrypt, guess keys, extract, write, or invoke
`ps5-bar-tool`. MediaFire metadata, structural similarity, and an inner match
would each remain non-runtime evidence. The actual result is
`LOCAL_BACKUP_UNCORRELATED`, so Phase 0.9F and every authorization remain
blocked.

## Phase-1.0E inherited result boundary

Prior RUN A and RUN B permissions were artifact-specific and consumed. RUN A
visibly reached C1; RUN B produced an unreadable notification and no exact
D-stage may be inferred. Phase 1.0E may record those observations and build a
new execution-ineligible diagnostic candidate offline. Its later exact
one-shot authorization was consumed on 2026-07-22.

The only added target operation is one nonblocking `send` attempt per reached
D-stage through stdout inherited from hardened elfldr's legacy raw-ELF
connection. It may not open a target socket, connect, listen, read requests,
retry, write the device filesystem, install or activate autoload. The host may
model one connect/send/write-half-close/bounded receive with fake sockets, but
no real device use occurs without new exact artifact-specific permission that
also names result reception. EOF, timeout, partial frames and send failure are
terminal, never retry triggers. The normal SDK CRT effects remain explicit;
this result channel is not side-effect-free. RUN C used the permitted single
connection and validated D00-D02 before remote EOF. It did not retry or
reconnect. D03, SDL, VideoOut, rendering, terminal status and cleanup remain
unproven. All authorization fields and artifact eligibility are now false.

## Phase-1.0F startup interval boundary

Phase 1.0F may prepare an exact artifact offline to place I00-I14 checkpoints
inside the source interval after D02 and through entry to D03. These
checkpoints may only reuse the existing nonblocking, signal-suppressed inherited
stdout send. They do not send notifications and may not add a socket, connect,
listener, receive path, address, port, filesystem write, install, autoload,
retry or reconnect.

The distinct `CHD10F01` parser remains offline-only: the live CLI is not
activated for it and must continue to reject the ineligible manifest. Normal
SDK CRT patch effects and the existing SDL/VideoOut imports remain explicit;
the artifact is not side-effect-free and static success is not hardware
evidence. No prior authorization carries forward. Device connection, transfer,
result reception and execution each require a new exact permission.

## Phase-1.0G one-shot runner boundary

Phase 1.0G may prepare and host-test a manifest-driven runner, but its tracked
manifest and approval template remain inactive. The interval protocol cannot
be selected through a free command-line switch. Activation requires both an
exact active manifest and a separate untracked local approval whose artifact,
firmware, target, protocol, limits and unique run identifier agree.

The runner must rehash the actual artifact before transport and exclusively
create and `fsync` a consumed-attempt receipt before opening a socket. This
fail-closed receipt prevents a host crash from silently making the same
permission reusable. Retry, reconnect, resume and trace overwrite remain
forbidden. The current repository contains no active target, run identifier or
authorization; no device action is allowed by Phase 1.0G itself.

The later exact Phase-1.0G authorization was consumed by one attempt. Valid
frames ended at I03 and ordinary stdout proved the deliberate no-argument,
no-menu help/exit path before I04. There was no retry or reconnect. This result
does not authorize another action and does not prove SDL, VideoOut, rendering
or terminal cleanup.

## Phase-1.0H startup-argument boundary

Phase 1.0H may correct only the proven `!HAVE_MENU && argc == 1` exit. The
reviewed profile adds RetroArch's existing verbose flag, generating `-v`, and
must retain null content/config/core paths, static contentless core, write
firewall, bounded runtime and the inherited one-send-per-stage stream. It must
allow H only through an exact active manifest plus separate matching local
approval, never a free protocol switch. No target, run ID, retry, reconnect,
installation, autoload or device-write authority may be tracked by default.

The exact H artifact is offline evidence only. It remains transfer-, execution-
and installation-ineligible, and all authorizations are false. Phase-1.0G
authority was consumed and cannot authorize H. A later action requires a new
exact artifact-specific permission; static success does not prove I04, SDL,
VideoOut, rendering, terminal status or cleanup.

The later exact Phase-1.0H authorization was consumed once. Its trace reached
I04, SDL2 video, VideoOut open and buffer registration, then the first flip
submit returned `-1` and SDL init returned `-1`. The diagnostic pattern was
copied into mapped display memory before the failed submit. D12 also records a
write-firewall rejection during configuration parsing; the exact requested
operation is unobserved. No retry is authorized. Do not infer a visible frame,
runloop entry, complete cleanup or safe exit.

## Phase-1.0I offline postmortem boundary

Phase 1.0I may inspect only the consumed H trace, exact source, ignored local
artifact/map and disassembly. It proves the submitted tuple
`(handle, 0, 1, 0)` and narrows E118 to linked `OPEN` or `STREAM` wrappers. It
does not know the exact blocked operation, original submit `errno`, VideoOut
argument semantics or root cause. The diagnostic/normal frame-zero/frame-one
mismatch is a source candidate only.

No target build, artifact, device client, connection, transfer, execution,
result reception or retry belongs to Phase 1.0I. A later offline design must
capture errno before reporting, transmit the exact write operation and stop
before I04 on a firewall shutdown. Selecting a different frame ID requires a
new ADR, new artifact audit and separate future authorization.

## Phase-1.0O consumed write-free result

The exact M artifact was transferred and executed once. The exclusive receipt
was created before the only connection; there was one send, zero retries and
zero reconnects. No installation, autoload, persistent staging or device
filesystem write occurred. The diagnostic pattern did mutate mapped display
memory and one VideoOut flip submit was attempted, as bounded by the approval.

The run passed I04 with no D13, then reproduced the first flip-submit failure.
D07 reports `-1` and saved errno `0`; E104 is the overlay's generic
`framebuffer_fail` label after that failure, not proof of an allocation fault.
The subsequent D04 after terminal-flagged D12 prevents a successful terminal
classification. Do not infer visible output, event-wait behavior, complete
cleanup or safe exit. The authorization is consumed and no action carries.

## Phase-1.0P offline VideoOut analysis

Phase 1.0P performs source, map, relocation and disassembly inspection only.
It proves the consumed artifact called `sceVideoOutSubmitFlip(handle,0,1,0)`
and received `-1` with saved errno `0`. It does not prove the semantic ABI,
opaque buffer contract, flip ownership, visible presentation or cleanup.

An exported symbol name is not permission to call a status or flip-master
function. No argument experiment, target build, parser relaxation or device
action is permitted by this analysis. The D12-before-D04 order is
source-deterministic, and D12 remains a shutdown request rather than proof of
lifecycle completion.

## Phase-1.0Q public evidence boundary

The bounded official-source inventory found no independent PS5 VideoOut ABI.
SDK v0.41 provides export names only; the PS5 declarations and opaque records
originate together in one SDL lineage, and relevant official ports consume
that same fork. OpenOrbis defines only the analogous PS4 contract.

Do not promote source repetition, a successful registration return, a PS4
constant or an exported status/flip-master name into PS5 semantic proof. No
submit parameter, buffer layout, ownership state or error interpretation may
change from Phase 1.0Q, and no target or device action is authorized.

## Phase-1.0R launch-context boundary

The exact PS5 SDL2main adds no application ID, title identity, LNC setup,
VideoOut ownership or process creation. Its `LoadExec("exit")` occurs only
after `SDL_main` returns, and the tested RetroArch path already performs SDL's
splash-hide call before VideoOut open. Direct and Payload Manager raw-ELF
routes use the same hardened elfldr process constructor.

Do not treat PacBrew packaging, `homebrew.js` path/argument descriptors,
LakeSnes documentation, or the non-unique LNC log as proof of a different
working display context. The exact hbldr/shsrv launcher and runtime active-app
state are unbound. Keep
`NO_SOURCE_PROVEN_LAUNCH_CONTEXT_FIX_TARGET_CHANGE_BLOCKED`: no SDL2main,
LNC/SystemService, submit, VideoOut, target-build, transfer or execution
change is authorized.

## Phase-1.0S hbldr/shsrv boundary

Official source proves that hbldr is materially different from raw elfldr: it
launches a BigApp through SystemService and replaces the resulting process
with a device-resident ELF. This is source evidence for a launch-context
difference, not proof of VideoOut permission, visible output, safe cleanup or
firmware-9.60 behavior. The exact deployed shsrv identity is unknown.

Never invoke or copy the existing route under this gate. It may kill the
running BigApp, performs kernel/ptrace process changes, lacks a hard deadline,
requires prior target staging, and current versions may remount `/system_ex`
and create persistent `FAKE00000` content without an atomic write, rollback or
power-loss protocol. Keep
`BIGAPP_CONTEXT_SOURCE_PROVEN_DEPLOYED_IDENTITY_UNPROVEN_DEVICE_PATH_BLOCKED`.
No port-2323 connection, shsrv request/deployment, hbldr command, target build,
device file, app termination, remount, transfer or execution is authorized.

## Phase-1.0T inactive shsrv identity boundary

The current shsrv source spawns a shell for every accepted connection and its
greeting automatically queries and transmits model, serial number, firmware,
temperatures and CPU frequency. Therefore a nominally read-only `help` request
is not side-effect-free and risks disclosing a device identifier. Phase 1.0T
contains no connector and authorizes no connection.

The offline parser must receive an already supplied transcript on stdin. It
must never persist raw input, serial, model or telemetry, and may retain file
metadata only for an independently supplied literal absolute path. `help`
identifies at most a source family; `stat` is metadata only; `sum` is a weak
16-bit rotating checksum and may cause atime/cache/accounting effects. None
can prove an exact binary. Wildcards, path discovery, content commands,
`hbldr`, launch, writes, signals, mounts, retry and reconnect remain forbidden.
All future windows are `DESIGNED_NOT_ACTIVE` and require separate exact review.

## Phase-1.0U bounded local inventory

Phase 1.0U found no deployed shsrv candidate within the declared Chimera,
attachment, known-download and ZIP-entry-name scope. This is not a global host
or device absence claim. The official source checkout, host telnet wrapper and
PacBrew recipe remain non-deployed references and must never be substituted
for exact installed bytes. No discovered script or binary was executed.

The inventory grants no connection, shell command, target build, transfer,
execution, installation, write, retry or launch-context experiment. Only the
next offline inactive collector-design phase may proceed. A future live
collector remains blocked behind a new exact approval and the Phase-1.0T
serial/telemetry side-effect acceptance.

## Phase-1.0V inactive collector-model boundary

Phase 1.0V is an offline stdin model with no network transport. It bounds raw
and sanitized input to 65,536 bytes, permits at most 256 chunks, rejects
incomplete Telnet controls and invalid UTF-8, and seals after one result. It
retains only the Phase-1.0T sanitized record. The internal bytearray is cleared,
but physical memory erasure is not proven.

The tracked activation and approval remain empty and false. Do not add an
address, port, command, socket, connect/send path, automatic reply, persistent
raw transcript, retry, reconnect, resume or fallback under this phase. Host
model success is not device, prompt, cleanup or deployed-identity evidence.

## Phase-1.0W reviewed inactive client architecture

Self-review remediates doubled-IAC state, empty-chunk accounting, path
allowlisting, firmware/compile metadata validation and numeric-parser error
normalization. Physical memory erasure remains unproven. The new policy accepts
only synthetic dual records and returns a frozen data plan; the fake transport
has no network primitives.

Keep the tracked activation and approval empty. Port 2323, one connection,
ten-second deadline and T2/T3 command tokens are future constraints, not
authority. A consumed receipt, exclusive sanitized output, monotonic deadline,
network transport, Telnet reply/prompt contract and deterministic close remain
missing. Do not connect, render shell lines or issue a request under this phase.

## Phase-1.0X inactive injected transport

The X orchestrator accepts only an already validated immutable session plan,
an injected adapter, an injected monotonic clock and a caller-owned host
evidence directory. Repository tests supply only fake adapters. The consumed
receipt is exclusively created and file-flushed before adapter open. Output is
sanitized, exclusively created and bound to the reopened receipt hash. There
is no overwrite, delete, raw-transcript persistence, target persistence, retry
or second open.

Do not interpret file `fsync` as directory-entry durability. A partial file is
invalid and deliberately not cleaned up; the run remains consumed. Deadline
checks surround adapter boundaries but cannot preempt a blocking real adapter.
Exact prompt and Telnet framing, OS socket timeouts, live close behavior and
deployed shsrv identity remain blockers. No real adapter, address, port,
connection, request or authority may be added under X.

## Phase-1.0Y offline shsrv framing

The Y model accepts synthetic bytes only. It distinguishes raw v0.7-v0.8 from
`libtelnet`/NVT v0.9-v0.19, never opens a transport and never formats a command.
Neither audited family proactively negotiates or server-echoes input. Current
source rejects unsupported `WILL`/`DO`; legacy source passes Telnet controls
into the shell. Future Chimera input must therefore emit no IAC commands.

A terminal `$ ` is not a live completion proof. `PWD` is not forcibly
overwritten, the external Telnet client's local echo is undefined, wire chunks
are arbitrary, and current pipe/socket handlers do not complete short writes.
The server also has no bounded session deadline. Preserve deadline-based
partial-result rejection, keep all authority false, and do not add a real
network adapter under Y.

## Phase-1.0Z offline passive batch

The Z contract produces one target-free ASCII/LF byte batch from a validated W
plan. It permits only `help`, or ordered `stat` and `sum` for one normalized
literal path. NUL, CR, IAC and shell separators cannot enter the batch. It has
no CLI, address, transport, clock or file output and authorizes no device use.

Incoming IAC fails closed; the model never sends a Telnet reply. Prompt text
and remote EOF are not completion boundaries. Only an explicit synthetic
hard-deadline event can seal, and incomplete help/stat/sum output remains
invalid. This does not prove live timeout preemption. A future T3 read may
still cause atime, cache, accounting and scheduler effects, while the automatic
sensitive greeting and shell/connection state require explicit acceptance.
Keep all authority false and add no real adapter under Z.

## Phase-1.0AA offline fake-adapter integration

AA accepts only exact built-in fake adapter, fake clock and fake evidence-store
types. Subclasses and arbitrary injected implementations are rejected, so the
module cannot be repurposed as a live transport boundary. It creates an
exclusive consumed receipt before fake open, permits one complete Z batch,
seals only at a valid synthetic hard deadline and closes exactly once.

EOF, blocked receive, early or missing deadline, data at/after deadline, IAC,
partial output and evidence collisions are failures. A receipt remains after a
failed fake attempt; no cleanup deletes it. Logical event-buffer clearing does
not prove physical erasure. Host `fsync` does not prove directory-entry
durability, and the synthetic clock cannot prove OS preemption. Keep every
authorization false and do not add a network adapter or device action under AA.

## Phase-1.0AB offline live-adapter feasibility

AB binds the local Python 3.13.2 Windows socket/select implementation but adds
no network import or adapter. Its trace model accepts synthetic operations only
and requires receipt-before-creation, nonblocking-before-connect, readiness and
`SO_ERROR`, positive bounded send/receive progress, deadline-only sealing,
sanitization, local close and then output.

Selector timeout is a maximum requested wait, not proof that host scheduling
cannot overshoot. Local `close` is not proof of remote shsrv/process cleanup.
Numeric-address parsing and the exact accepted Windows pending-connect error set
still require implementation review. Keep live implementation, socket creation,
DNS, target retention, connection and request as hard stops under AB.

## Phase-1.0AC offline dormant-adapter boundary

AC executes only against the exact built-in fake syscall facade and fake
clock. A precommitted receipt marker must precede synthetic creation;
nonblocking setup precedes synthetic connect; partial progress is explicit;
EOF, zero progress and data at the deadline fail. One fake local close is
attempted after every successfully opened path. Unused fake events are logically discarded,
which does not prove physical erasure or remote cleanup.

The module has no live adapter protocol, socket/selector import, DNS, address,
CLI, real clock or file output. All authorization remains false. AC permits
only a later offline inactive numeric-target/activation design; it does not
permit a transport implementation, connection, request or device action.

## Controls required before Phase 1

Phase 1 cannot begin until all of the following are recorded in a new ADR:

1. explicit hardware-test approval;
2. an allowlisted firmware and reproducible console identification method;
3. proven function signatures and data layouts from acceptable public sources;
4. a bounded timeout and operator recovery plan;
5. independently reviewed cleanup and crash-log paths;
6. a one-step-at-a-time test case with an SDL software/VideoOut fallback;
7. an explicit statement of exactly which buffer or GPU state may mutate.

Approval for one test does not authorize later tests.

## Timeout, watchdog, cleanup, and logs

The Phase-0 loop is statically bounded by the 21-entry manifest and always
attempts module cleanup after lookup begins. Dynamic-loader calls do not expose
a documented cancellation API, so an in-process forced timeout would risk
leaking loader state. The default `NONE` gate blocks the project-requested
module open. The 9.60 build gate does not remove the SDK CRT blocker and grants
no execution authority.

Before any approved hardware observation, a separate supervisor design must
define a wall-clock deadline, progress events, operator-visible failure state,
and a recovery action that does not kill a thread while it owns loader or GPU
state. The probe already emits deterministic JSON-line stage events suitable
for a redacted crash/timeout log; it never emits addresses. Later GPU phases
must add explicit per-operation deadlines and prove cleanup for each partially
completed state transition.

## Disabled Phase-1 candidate

The candidate source contains one SDL window-surface update, but it is outside
every default target and automated test. Its default `NONE` build exits before
SDL initialization. Project code contains no direct VideoOut or GNM prototype.
The pinned SDL backend's flip-event wait has no proven finite timeout; this is
recorded as a hardware blocker rather than hidden behind a forced thread kill.
See `docs/phase1/HARDWARE_TEST_PLAN.md`.

## Incident rule

On an unexpected return code, missing cleanup confirmation, display anomaly,
hang, reset, or firmware mismatch: stop, preserve non-sensitive logs, mark the
compatibility entry as failed or unknown, and do not retry automatically.