# Phase 0.9E reboot and crash model

Date: 2026-07-18

Classification: `REBOOT_RECOVERY_UNPROVEN`

## State model

| State | Evidence | Expected lifetime | Reboot statement |
|---|---|---|---|
| exact exploit/browser state | implementation absent | unknown | `UNPROVEN` |
| exact port-9020 listener state | implementation absent | unknown | `UNPROVEN` |
| hardened elfldr entry process | `main.c` source | temporary by design | hardware behavior unproven |
| embedded bootstrap in `SceRedisServer` | `main.c`/`bootstrap.c` | temporary injection stage | likely process/kernel state, not a proven recovery mechanism |
| `elfldr.elf` port-9021 service | `socksrv.c` | process-local background service by design | README says rest-mode resume, not reboot persistence |
| controlled Manager | source/offline artifact | process-local when launched | explicitly not installed in current controlled-runtime evidence |
| Manager configuration/autoload files | source paths only | filesystem-persistent if actually present | current device values and use unobserved |
| Y2JB-named `SIECAF` backup | host file | host-persistent | not proof of device installation |

The hardened elfldr README states that the port-9021 service survives payload
crashes and resumes after rest mode. It does not say that the service survives
a full reboot. Source creates process state and does not install a boot item,
but the complete device bootstrap/autoload environment is not available.

## Crash cases

- A payload crash under hardened port 9021 is isolated by design from the
  service process. That is source architecture, not a tested firmware-9.60
  guarantee.
- A crash in the unknown port-9020 listener may terminate a process, exploit
  state, or more. No cleanup, watchdog, retry, or restart path is available for
  audit.
- A malformed or truncated 9020 transfer has unknown allocation, mapping,
  execution, and close behavior.
- A hang has no proven host abort, deadline, or recovery response.
- No source proves that a bad payload cannot create persistent state; a future
  rescue contract must explicitly prohibit such writes.

## Anti-brick boundary

A session crash is not automatically brick-relevant if live files, autoload,
configuration, mounts, and boot state remain unchanged and a reboot or fresh
jailbreak session restores the executor. Those premises are not yet proven for
the actual chain.

Consequently:

- `restartable_after_reboot=unproven`;
- no guarantee is made that reboot always restores access;
- no automatic retry is permitted;
- no future device phase may rely on reboot recovery until the exact package
  and its state transitions are audited.

Minimum evidence to promote to `REBOOT_RECOVERY_SUPPORTED_BY_DESIGN` is an
exact source-bound trigger/listener implementation proving that all bootstrap
state is session-local or safely reproducible, plus an exact operator procedure
that does not rely on a live component or autoload.