# Phase 1.0DI: live-acquisition boundary

Status: `OFFLINE_WORK_COMPLETE_EXACT_CONSOLE_PERMISSION_REQUIRED`

The DH query is ready, but no byte-exact `appinfo.db` snapshot exists. The
controlled elfldr and Payload Manager expose no binary-safe readback. Official
shsrv v0.7 has a raw `cat` candidate; audited v0.9-v0.19 routes shell output
through `libtelnet` NVT text framing, which cannot be treated as byte-exact
database transport. The deployed family and exact binary identity are unknown.

A shell `grep` is not a substitute: finding the title text does not prove that
it is a `tbl_appinfo.titleId` row, while no output cannot prove absence. There
is no further offline input that can select a safe acquisition route.

The minimum next observation is the already modelled T2 family fingerprint:
one connection to the console's shsrv port 2323, one exact ASCII batch
`help\n`, at most 65,536 received bytes and a ten-second hard deadline. The
collector retains only a sanitized source-family classification, never raw
serial, telemetry or transcript. It performs no file read, transfer, payload
execution, title launch, app termination or device write, and permits no retry
or reconnect.

The tracked window is inactive and target-free. A live attempt requires a new
exact permission containing a numeric target, run ID and bounded time window.
Approval for earlier elfldr runs does not carry to this shsrv observation.