# Phase 1.0DM: bounded snapshot observer

Status: `OFFLINE_ARTIFACT_BUILT_AUDITED_INACTIVE`

DM replaces the rejected daemon route with one single-purpose raw-elfldr
process. It opens only `/system_data/priv/mms/appinfo.db` using `O_RDONLY`,
`O_CLOEXEC` and `O_NOFOLLOW`, rejects non-regular, empty or larger-than-64-MiB
objects, and transmits only over inherited stdout. It creates no socket,
listener, connection or filesystem output on the target.

The stream is `CHS10DM1` begin frame, exact declared file bytes and a terminal
frame. Metadata is checked before and after. A process-wide 20-second alarm
interrupts reads or sends; short progress is continued, while errors terminate
without reconnect or a second file open. The host parser requires exact length,
matching terminal metadata and an SQLite 3 header, then computes SHA-256.

The stock SDK linker script marks text RWE. The build tool accepts only the
pinned v0.41 script hash and mechanically derives a build-local variant whose
text segment is RE. The resulting 109,896-byte ELF has load flags RE/RW/RW and
SHA-256 `147b5bede0f0b5b7d2be903bc72ff0d0541a2cdc28eae7d86b6bf95e1978ebdf`;
two consecutive builds produced identical ELF bytes. Linker maps differ in
non-runtime build metadata and are not identity evidence.

Normal SDK CRT effects still apply, and runtime/cleanup are unproven. The ELF
is therefore inactive and transfer-/execution-ineligible. The one-shot host
runner and consumed-receipt gate exist but its tracked activation is inert; a
separate exact approval remains mandatory before any socket is opened.