# Phase 0.9E-R2 community backup correlation

Date: 2026-07-19

Only the three named official GitHub repositories and their release metadata
were inspected. No mirror or general scene download was used. Metadata,
source trees, and release assets were read statically; downloaded archives
were not executed.

## Candidate matrix

| Family | Relevant release identity | Firmware statement | Public system backup | Components/autoload | Decision |
|---|---|---|---|---|---|
| `itsPLK/ps5-y2jb-autoloader` | `v0.8-a0146a2`, commit `a0146a2a9229fa5df5b5127257bf2e11ffc6d2de` | 4.03–12.70 | no; README explicitly says the project does not distribute preconfigured system backups | Lapse blob `190996c…`, P2JB blob `510bf4b…`, elfldr submodule `148b71c…`, Payload Manager submodule `5d33ce1…`; exploit and localhost elfldr auto-load, later payloads use `autoload.txt` | `THIRD_PARTY_BUILD_FROM_PUBLIC_SOURCE_POSSIBLE`, but unbound |
| `owendswang/Y2JB-P2JB-bdj_unpatch` | `v1.4-autoloader`, commit `9990e917cdb24c249ce24f4ff18e6e869e99cf51` | tag README says 9.00–12.40 disc; downloaded backup name says 7.61 | yes | Gezine Y2JB base declared; Lapse/P2JB blobs and embedded elfldr are identifiable; no Payload Manager identity at this tag | downloaded candidate inner and structure do not match |
| `lz-anonz/Y2X` | `v1.3`, commit `2ae881259be647738713b83a6a91ffe693ccf9af` | 4.03–12.70 | no current large release asset despite README backup wording | P2JB/Lapse, v1/v2 embedded elfldr, Payload Manager 0.3.1 and FTP; v2 auto-loads Manager/FTP and warns against kstuff in autoload | excluded by asset inventory; no large download |

## itsPLK

The relevant tag was published 2026-06-10 09:05:51Z, before the local inner
ZIP timestamp. Its official assets are only:

- `download0.dat`, 336789504 bytes,
  SHA-256 `268c82f7a8f581c804949a86c259c982953ff479c13a3dc9f9da02c354b32d6e`;
- `y2jb_update.zip`, 1152857 bytes,
  SHA-256 `301599b05e7eb7224025ef9ed6ebc896d86d2c14bba5c32ced5a88bdf2c3517e`.

Its README's firmware range, “Autoloader” naming, timing, and credit to Rush
for creating a backup make the family plausible. The same README explicitly
says itsPLK does not distribute such backups. No public hash, backup asset,
MediaFire link, or maker attestation binds this source to the local bytes.
Accordingly it is not an official itsPLK release and is not promoted to
`THIRD_PARTY_REPACK_PROVENANCE_BOUND`.

## owendswang

Release `v1.4-autoloader` published 2026-06-10 09:01:19Z includes:

- `download0_Y2JB+autoloader-20260609.zip`, 333151616 bytes;
- `PS5-12.20-backup-Y2JB+autoloader-20260609-en.zip`, 498991549 bytes;
- `PS5-7.61-backup-Y2JB+autoloader-20260609-en.zip`, 504425435 bytes.

The 7.61 backup was the sole downloaded community candidate because its
family, date, and size were concrete matches. Its local download exactly
matched GitHub size and SHA-256
`8552d7c3c7bb3f078d967f56dfe1b488b37e3ed13e10c5fe97ae222482d56897`.
Its inner is 504627200 bytes with SHA-256
`d4f9b1ba4e32af175a3431a7734085d5420370ebb79f9a32852eb824a90e190e`.
The local inner is 262144 bytes smaller, has a different full hash, differs
byte-for-byte, and has version/count 3/62 rather than 6/58. Normalized
segment layout and section hashes also differ.

Classification: no `COMMUNITY_INNER_BYTE_MATCH`.

## lz-anonz

Release `v1.3` published 2026-06-10 21:58:27Z has only:

- `USB-ps5_autoloader.rar`, 904337 bytes;
- `v1.3-download0-Y2X-P2JB+Lapse.rar`, 521801 bytes.

The source contains autoload and embedded components, but the current release
does not expose a system-backup object to compare. README language is not a
byte identity. No large asset was downloaded.

## Download bound

One of the maximum three allowed community backups was downloaded. It used one
attempt, no resume, and no retry. The other two families had no public large
candidate justified by their own release metadata.