# Phase 1.0AE: minimal BigApp launcher architecture

Status: `V07_NONPERSISTENT_LINEAGE_SELECTED_TARGET_IMPLEMENTATION_BLOCKED`

Date: 2026-07-29

## Objective

Identify the shortest public-source route from the proven raw-ELF VideoOut
failure to one bounded launch-context experiment. This is an offline source
review. It adds no target source, artifact, socket, transfer or execution.

## Source decision

Official shsrv v0.19 is not an acceptable base. Its hbldr path can remount
`/system_ex`, persistently create `FAKE00000`, copy an executable, kill the
running BigApp and enter unbounded ptrace/wait loops.

Official shsrv v0.7 is the selected reference lineage because it launches the
existing VideoPlayer WebApp title `PPSA01659` and contains no fake-app creation
or system-ex remount in its hbldr bundle. Selection is not authorization and
does not prove that the title exists, launches, owns VideoOut or behaves the
same way on firmware 9.60.

## Required minimal callgraph

The future design may model only this sequence:

1. validate one exact payload hash and fixed argument vector;
2. query the foreground user;
3. require that no BigApp is currently running;
4. attach to the source-proven SystemService parent;
5. arm bounded fork and exec observation before launch;
6. request launch of the fixed existing `PPSA01659` title;
7. detach the parent on every path;
8. replace only the newly observed child with the exact payload;
9. restore every temporary instruction and credential mutation;
10. detach the child or terminate only that newly created child on failure;
11. emit a bounded inherited result and stop.

The architecture must fail closed when a BigApp already exists. It must never
call `sceSystemServiceKillApp` as part of the experiment.

## Removed upstream behavior

- general Telnet shell and arbitrary command parsing;
- PATH search, arbitrary filesystem path and target-side ELF read;
- `FAKE00000`, `fakeapp_create_if_missing` and `remount_system_ex`;
- package installation, autoload and persistent writes;
- `hbdbg`, GDB wait and free-form arguments;
- arbitrary root/jail broadening unless separately proven indispensable and
  exactly restored;
- unbounded `waitpid`, `pt_await_child`, `pt_await_exec`, `pt_call` and
  `pt_syscall` loops;
- killing or replacing any pre-existing process;
- retry, reconnect and fallback title selection.

## Unclosed contracts

Target implementation remains blocked until an offline design proves:

- a deadline-capable wait primitive for every wait/step boundary;
- unique child correlation without acting on an unrelated process;
- complete parent detach and child cleanup for every failure edge;
- exact restoration of breakpoint bytes, page protections, credentials,
  environment, root and jail changes;
- bounded ELF size, headers, segments, relocations and allocation;
- exact firmware-9.60 availability and role of `PPSA01659`, or a fail-closed
  observation that does not install or mutate it;
- accepted public evidence for every SystemService/UserService declaration;
- an explicit policy for the unavoidable kernel/ptrace effects.

## Decision

The persistent v0.19 route is rejected. v0.7 is the preferred public-source
reference for a nonpersistent BigApp experiment, but copying or compiling it
is still blocked. The next phase may implement only a host lifecycle model
with injected fake operations and exhaustive failure cleanup. It may not add
PS5 headers, target source, syscall numbers, a target build or device action.