# Phase 0.9B observer limitations

Status: **BLOCKED**.

## What was established

- Exact local commits and relevant source-file identities were recorded.
- Normal SDK v0.41 startup is **UNSAFE** for this phase because
  `__patch_init()` is reachable before `main` and performs prohibited writes.
- A `-nostartfiles` link can omit that CRT, but safe observer entry,
  return/exit, crash cleanup and resource cleanup remain **UNPROVEN**.
- The hardened controlled route is hash-bound but passes `stdio=-1`.
- The controlled manager transport sends and closes; it has no receive
  callback for observer data.
- The fixed loader exit response cannot carry the requested observation set.
- Stock Payload Manager HTTP routes and log state are not an admissible
  replacement output collector.

## What was not built

- no observer source;
- no target declaration;
- no PS5 object or ELF;
- no linker map;
- no disassembly or reachable callgraph;
- no artifact import, relocation, string or open-flag report;
- no double clean target build;
- no artifact manifest;
- no install, lifecycle or execution package; and
- no transfer or execution instructions.

These are intentional consequences of the pre-build hard gates, not omitted
positive evidence.

## Unsupported or unproven observations

All target observations remain unimplemented. In particular:

- only one possible firmware source exists in the reviewed SDK source;
- no independent second firmware source is established;
- firmware 9.60 runtime behavior of the first source is untested;
- mount layouts and semantics are not runtime-proven;
- a process sample exists, but complete service mapping does not;
- no exact listener snapshot and owner-mapping API was established;
- live and backup paths are absent;
- live and backup objects, sizes, identities and hashes are absent;
- authoritative autoload/startup/retry source completeness is absent;
- stable no-follow behavior on the target filesystem is unproven;
- atime, audit, cache, counter and scheduler effects remain possible; and
- output and exit remain blocked.

## Remaining anti-brick blockers

1. two current firmware sources;
2. literal live paths;
3. live mount and object identities;
4. live sizes and SHA-256;
5. mount and filesystem properties;
6. process and service inventory;
7. listener inventory and ownership;
8. complete autoload/startup/retry state;
9. existing separate rollback objects;
10. byte-exact on-device Payload Manager backup (`HARD_BLOCKER`);
11. independent recovery;
12. power-loss-safe switch semantics;
13. component order;
14. observer startup/exit ABI; and
15. non-persistent output.

No offline test may promote a stock hash, clear a device blocker, prove
firmware behavior, or authorize a later action.

## Risk of a later one-shot run

Even if a future artifact were approved, unresolved risks would include:

- the existing loader’s ptrace, credential, mapping, breakpoint and
  socket-overlap operations before payload entry;
- loader cleanup failure or a child that does not terminate;
- crash or return behavior different from the source-reviewed expectation;
- kernel, audit, cache, atime, scheduler and counter effects from reads;
- stale or conflicting path plans;
- concurrent object replacement during observation;
- incomplete process/service/listener snapshots;
- output truncation or loss;
- a false inference from an unsupported result; and
- operator confusion between observation evidence and installation approval.

One observation could not prove atomic switch semantics, write durability,
power-loss behavior, recovery independence under actual failure, component
order, future runtime stability, graphics safety, RetroArch compatibility or
the absence of every platform side effect.

## Minimum evidence to resume engineering

Resume target engineering only after both items are available in local,
commit-bound public source and accepted by a new review:

1. a kernelwrite-free startup and termination ABI covering BSS, stack,
   return/exit, crash behavior and loader cleanup; and
2. a one-shot response channel that returns bounded observer bytes over the
   controlled route without a device file, new listener, persistent state,
   global Payload Manager mutation or post-exit activity.

Until then the exact decision is:

**BLOCKED — OBSERVER STARTUP OR EXIT ABI UNPROVEN; NO PROVEN
NON-PERSISTENT OUTPUT CHANNEL.**