# Phase 1.0AB: offline live-adapter feasibility

Status: `PARTIAL_FEASIBILITY_LIVE_IMPLEMENTATION_BLOCKED`

Date: 2026-07-22

This phase audits the local Windows host runtime and models lifecycle ordering
with synthetic traces only. It adds no socket import, address, DNS, live
adapter, CLI or device action.

## Bound local runtime

| Object | Identity |
|---|---|
| Python | 3.13.2, MSC v.1942, 64-bit AMD64 |
| `socket.py` | 38,741 bytes; SHA-256 `523695ac3383799547b421b4fe18004de1e80181e97181b6d7a10533b47f4c49` |
| `selectors.py` | 20,060 bytes; SHA-256 `b3d6cebd4a3a03b4a614f12f171622ce4e4ba3295b9e8b89e2bde051003106eb` |
| `_socket.pyd` | 84,984 bytes; SHA-256 `8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db` |
| `select.pyd` | 32,248 bytes; SHA-256 `baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1` |
| monotonic clock | `QueryPerformanceCounter()`, monotonic, non-adjustable, reported resolution `1e-07` seconds |
| default selector | `SelectSelector` on this runtime |

These identities are local host evidence only. They are not portable to a
different Python build and say nothing about the PS5.

## Source-bound findings

The local `_socket` interface states that:

- `setblocking(False)` is equivalent to timeout `0.0`;
- `connect_ex` returns an error number instead of raising for connection
  results;
- `send` returns a byte count that may be smaller than the supplied buffer;
- `recv` returns at most the requested bytes and returns empty bytes after
  remote close and drained data;
- `close` makes the local socket object unusable.

The local `selectors.py` documents a maximum wait parameter. On Windows its
`SelectSelector` passes readers, writers and exceptional writers to
`select.select`, merges exceptional sockets into writable results, and returns
an empty readiness set after `InterruptedError`. Therefore a pending connect
must inspect `SO_ERROR` after writability, and every empty/interrupted return
must recompute the remaining monotonic budget.

## Feasibility matrix

| Part | Classification | Reason |
|---|---|---|
| receipt before socket creation | `FEASIBLE_FROM_EXISTING_HOST_MODEL` | X/AA exclusive evidence already models this order |
| numeric-address-only input | `DESIGN_REQUIRED` | DNS must be excluded; no address parser is added here |
| nonblocking mode before connect | `FEASIBLE_FROM_LOCAL_RUNTIME` | exact local `_socket` contract exists |
| pending connect completion | `PARTIAL` | readiness plus `SO_ERROR` is source-bound; exact accepted Windows error set still needs implementation review |
| complete batch send | `FEASIBLE_FROM_LOCAL_RUNTIME` | repeated readiness and explicit partial-send loop are available |
| bounded receive memory | `FEASIBLE_FROM_EXISTING_MODEL` | 65,536-byte collector bound already exists |
| hard wall-clock deadline | `PARTIAL` | monotonic remaining budgets are feasible; selector/scheduler overshoot cannot be proven impossible |
| prompt-independent completion | `FEASIBLE_FROM_Z` | only deadline sealing is accepted |
| EOF behavior | `FEASIBLE_FAIL_CLOSED` | empty receive must be failure, never completion |
| local descriptor cleanup | `FEASIBLE_BY_DESIGN` | unregister/selector close/socket close can run in `finally` |
| remote shell cleanup | `UNPROVEN` | local close does not attest remote exit or firmware behavior |
| retry/reconnect/resume | `EXCLUDED` | forbidden by contract |

Overall classification: `PARTIAL_FEASIBILITY_LIVE_IMPLEMENTATION_BLOCKED`.

## Existing-client comparison

Earlier one-shot ELF runners used blocking `sendall`, write-half-close and
bounded receive for a different raw-ELF protocol. Their result manifests prove
those consumed runs only. They are not reusable for shsrv: Z sends a tiny shell
batch, must keep the write direction open while receiving, ignores prompts and
seals only at deadline. `sendall` also hides individual partial-send progress;
the future contract requires an explicit nonblocking send loop.

## Decision

The required sequence is implementable in principle on the exact local host,
but a hard scheduling bound and remote cleanup cannot be proven offline. A live
adapter remains blocked. The next permitted phase may build only a dormant,
target-free adapter around an injected syscall facade and fake OS results. It
must not import or instantiate a real socket until a later dedicated review.