# Phase 0.9D bootstrap and recovery chain

Date: 2026-07-18
Status: `DESIGN_ONLY`

This is an offline source audit. It does not establish current device state,
firmware behavior, persistence, a live path, or recovery success.
No PS5 was contacted.

## Source-bound chain

```mermaid
flowchart LR
    A["External jailbreak / exploit host<br/>source absent from audited trees"]
    B["Rudimentary exploit ELF loader<br/>port 9020 per elfldr README"]
    C["elfldr bootstrap<br/>bdj.elf -> SceRedisServer"]
    D["elfldr socket service<br/>elfldr.elf, port 9021"]
    E["Payload Manager ELF<br/>manual or external autoloader"]
    F["Payload Manager HTTP service"]

    A --> B --> C --> D --> E --> F
```

The public and hardened elfldr `README.md:3-19` describe host-to-console
delivery to a rudimentary exploit loader on port 9020. The exploit and its host
implementation are not present in any audited tree, so its repeatability and
recovery behavior are unproven. Hardened elfldr `main.c:28-89` enters through
`bdj.elf`, temporarily attaches to `SceRedisServer`, and
`bootstrap.c:38-81` starts the socket server. `socksrv.c:477-507` names that
service `elfldr.elf`, removes an already running process with that name, and
listens on port 9021.

The Payload Manager README describes either manual loading or placement by an
external autoloader. Its `deploy.sh` only sends an ELF to elfldr; it does not
install, read back, or recover a device file. The external autoloader,
jailbreak host, browser exploit, and any USB recovery implementation are absent
from the audited sources.

## Dependency and recovery graph

| Component | Commit | Persistence | Start mechanism | Boot critical | Failure impact | Recovery executor | Self-dependent | Depends on elfldr | Depends on Manager | After reboot | Evidence / classification |
|---|---|---|---|---|---|---|---:|---:|---:|---|---|
| Jailbreak/exploit host | not present | `UNPROVEN` | user/browser/host, details absent | `UNPROVEN` | bootstrap unavailable if absent | itself/external | unknown | no | no | `UNPROVEN` | README description only; `UNPROVEN` |
| Rudimentary port-9020 loader | not present | session behavior `UNPROVEN` | exploit chain | `UNPROVEN` | elfldr cannot be bootstrapped through the described route | external exploit chain | unknown | no | no | `UNPROVEN` | README description only; `UNPROVEN` |
| Hardened elfldr bootstrap | `197623058f509eddde18868dafcb92fdcac66464` | source shows process injection, not filesystem installation | sent to port 9020 | no source proof | no port-9021 service | port-9020 chain, if still available | no | no | no | `UNPROVEN` | source plus missing upstream executor; `PARTIAL` |
| elfldr socket service | same | process-local in source | bootstrap creates `elfldr.elf` | no source proof | no normal Payload Manager launch transport | bootstrap | no | no | no | `UNPROVEN` | source; `PARTIAL` |
| Public/full Payload Manager | public base `cfbc70f30f419b09bf2b52283f7409e2d3117ee1` | external autoloader or manual, exact current deployment unknown | elfldr or external autoloader | `UNPROVEN` | management UI/listener unavailable | elfldr/manual route | no | yes | no | `UNPROVEN` | README/source; `PARTIAL` |
| Controlled minimal Manager source | `e23d94ff91233aa770e2342800c1467875bdef44` | explicitly not installed by the Phase-0.7 record | would require a separately authorized transfer and launch | no | no impact on current device because installation is unproven | none in this phase | no | yes | no | not installed | source/offline record; `UNPROVEN` as device runtime |

## Bootstrap questions

1. **Original exploit start:** only described as a BD-J or WebKit-style host
   route to a rudimentary loader; implementation and current operator sequence
   are absent. `UNPROVEN`.
2. **Direct browser/exploit delivery:** the elfldr README proves only that an
   elfldr ELF is sent host-to-console. Exact browser assets are absent.
3. **elfldr storage:** source proves a process service, not a persistent
   filesystem installation. Current storage is `UNPROVEN`.
4. **Payload Manager storage:** README permits manual or external-autoloader
   use; actual current storage is `UNPROVEN`.
5. **Automatic start:** controlled by an external autoloader and/or Manager
   configuration not present as current device evidence.
6. **Manual-only files:** any ELF sent to elfldr can be manually launched in
   principle; current availability is not proven.
7. **Gone after reboot:** process state and volatile flags are source-local,
   but device restart behavior of the complete chain is `UNPROVEN`.
8. **Persistent after reboot:** no current artifact or configuration is proven
   persistent.
9. **Exploit after broken elfldr:** conceptually independent in the README,
   but source and current operability of the original exploit are absent:
   `PARTIAL`.
10. **Exploit after broken Manager:** same `PARTIAL` result.
11. **Independent recovery payload:** the README permits sending another ELF
    through port 9020, but neither the executor nor a recovery payload is
    audited: `PARTIAL`, not recovery proof.
12. **Write-back through original chain:** no source-bound file-write contract
    is present: `UNPROVEN`.
13. **Ignore a wrong non-autoload file:** plausible, but live path and
    configuration are unobserved: `UNPROVEN`.
14. **Boot-loop potential:** depends on unknown persistent autoload state:
    `UNPROVEN`.
15. **Automatic-start configuration:** external autoloader configuration is
    absent. Manager uses `/data/pldmgr/autoload.txt` and
    `/data/pldmgr/pldmgr_config.txt`, but this does not prove the current
    bootstrap configuration.
16. **Keep automatic start disabled:** design policy requires it; actual
    current state has no non-mutating source-bound attestation.
17. **Recovery after reboot:** external exploit restart is only described:
    `PARTIAL`.
18. **Recovery after crash/hang:** elfldr source restarts its accept loop and
    uses a controlled watchdog, but recovery of a broken persistent file is
    absent.
19. **USB/browser/host independent path:** upload and launch paths exist;
    no audited PS5-to-host readback or independent restore path exists.
20. **Unproven answers:** current persistence, live paths, installed versions,
    autoload state, exploit repeatability, boot-loop behavior, write-back,
    power-loss recovery, and post-reboot recovery all remain hardware facts.

## Recovery classification

- elfldr: `PARTIAL`. The described port-9020 bootstrap does not depend on the
  port-9021 elfldr service, but its implementation and current operability are
  missing.
- Payload Manager: `PARTIAL` with a `CROSS_DEPENDENT` restore shape. Manual
  launch through elfldr is described, but durable restoration and verification
  are absent.
- Byte-exact file recovery for either component: `UNPROVEN`.