# Phase 0.9D existing-stack readback feasibility

Date: 2026-07-18
Decision: `BLOCKED_NO_READBACK_PATH`

## Route search, in required order

| Order | Candidate | Source result | Binary framing | Short-read / EOF / size | Decision |
|---:|---|---|---|---|---|
| 1 | Payload Manager download | no endpoint exists | absent | absent | `ABSENT` |
| 2 | Payload Manager file read | internal reads are not returned to HTTP client | absent | absent | `ABSENT` |
| 3 | elfldr response or host pipe | controlled route returns fixed status text and disables payload stdio; legacy stdio requires a payload process | no file protocol | no file completeness contract | rejected |
| 4 | exploit host | README sends host-to-PS5; implementation absent | no reverse framing | unproven | rejected |
| 5 | browser/USB host | browser uploads toward PS5; USB move writes device storage | reverse direction or mutating | no host-copy contract | rejected |
| 6 | repository tools | deploy scripts send through port 9021 only | no reverse framing | absent | rejected |
| 7 | no route | all audited paths exhausted | — | — | selected |

Hardened elfldr `socksrv.c:288-375` sends only rejection, error, or
`Controlled payload exited` status. The payload data is discarded after
loading and controlled stdio is `-1`. Controlled Manager
`verified_launcher.c:31-184` verifies and sends a descriptor to elfldr and then
closes; `ps5_launcher.c:18-69` exposes connect/send/close only. Neither side
contains a receive path for component bytes.

## Flag semantics

### `server_active_flag`

- Declaration and initial value: static volatile integer initialized to zero,
  `src/log_server.c:20-23`.
- Sole writer: `log_server_set_active()` assigns one.
- Sole reader: `pldmgr_server_is_active()`, used by
  `src/autoload.c:101` only to suppress fallback notification behavior while a
  browser/server request has occurred.
- Reset: none in the process.
- Lifetime: process-local; it cannot persist as this variable after process
  exit or reboot. Exact manager process lifetime on hardware is unobserved.
- No source path connects it to filesystem writes, autoload enablement,
  payload launch, request authorization, shutdown, or boot configuration.
- Disconnect does not reset it; a crash/process exit destroys the process
  state.

Classification: `LOW_VOLATILE`, not `ANTI_BRICK_CRITICAL`. Because there is no
reset semantic within the running process, any otherwise observational route
remains `PARTIAL` and a future permission must explicitly accept this effect,
log-ring changes, connection state, buffers, sockets, and counters.

### `autoload_triggered`

- Declaration/initial value: static volatile integer zero,
  `src/autoload.c:31`.
- Writers: `pldmgr_autoload_get_status()` sets one (`:45`);
  `pldmgr_autoload_reset()` sets zero (`:235`).
- Readers: autoload worker wait logic at `:82-86`.
- `/autoload_status` calls the mutating getter before building its response
  (`src/http_server.c:1037-1041`).
- Reset is explicit clear/resume logic, not disconnect cleanup.
- It is process-local, but can change worker timing and therefore launch
  behavior while that process exists.

Classification: `HIGH_FUNCTIONAL`. `/autoload_status` is excluded from
Windows 1 and 2. The later duplicate route at `http_server.c:1104-1111` is
unreachable because the first identical comparison already matches.

## Path inventory

| Literal path | Source | Meaning | Live status | Evidence |
|---|---|---|---|---|
| `/data/pldmgr` | controlled Manager `include/pldmgr.h:8` | base device directory | configured default only | source literal |
| `/data/pldmgr/payloads` | same `:12` | payload storage | configured default only | source literal |
| `/data/pldmgr/autoload.txt` | same `:9` | Manager autoload list | configured default only | source literal |
| `/data/pldmgr/pldmgr_config.txt` | same `:10` | Manager config | configured default only | source literal |
| `/data/pldmgr/repository_cache.json` | same `:11` | repository cache | configured default only | source literal |
| `/data/pldmgr/sources.json` | same `:14` | repository sources | configured default only | source literal |
| `/mnt/usb0/pldmgr` … `/mnt/usb7/pldmgr` | `payload_mgr.c:201-218` | USB scan roots | possible source directories | source literal/pattern |
| `/data/pldmgr/payloads/chimera-controlled` | controlled Manager source/profile | controlled staging directory | explicitly not installed | offline candidate only |
| `/data/pldmgr/payloads/elfldr/elfldr_v0.23.elf` | historical Phase-0.6 manifest/tool input | stock identity reference | not runtime-observed | `reference_only` |
| `/data/pldmgr/payloads/pldmgr/pldmgr_v0.3.1.elf` | historical Phase-0.6 manifest/tool input | stock identity reference | not runtime-observed | `reference_only` |
| `/data/payload.elf` | elfldr README example | generic manual launch example | not a current mapping | documentation example |
| `/user/temp/payload_<pid>.self` | elfldr self-loader source | temporary converted image | runtime-generated, not component live path | source template |
| `/system/vsh/app/NPXS40112/eboot.bin` | elfldr bootstrap source | injection victim executable | not an elfldr installation path | source literal |

No audited input binds an actual live elfldr or Manager object to a current
path. The package/reference paths and configured defaults therefore produce
`PATH_CONFLICT`; no future readback window may guess.

## Readback decision matrix

- `NEW_OBSERVER_FEASIBILITY`: `BLOCKED`
- `EXISTING_STACK_MANUAL_FACT_COLLECTION`: `PARTIAL`
- `EXISTING_STACK_SINGLE_READBACK`: `BLOCKED_NO_READBACK_PATH`
- `EXISTING_STACK_REPEAT_READBACK`: `BLOCKED`
- `ELFLDR_INDEPENDENT_RECOVERY`: `PARTIAL`
- `PAYLOAD_MANAGER_INDEPENDENT_RECOVERY`: `PARTIAL`
- `SIDE_BY_SIDE_FEASIBILITY`: `BLOCKED`
- `DEVICE_WRITE`: `NOT_AUTHORIZED`
- `TARGET_EXECUTION`: `NOT_AUTHORIZED`
- `INSTALLATION`: `NOT_AUTHORIZED`

There is no possible first readback component: the component-risk order cannot
override an absent transport. A missing metadata query would merely reduce a
copy to `SOURCE_MAPPING_PARTIAL`; here the earlier condition—getting complete
binary bytes—already fails.

## Explicitly acceptable only after later consent

A future read-only request could reasonably entail sockets, temporary buffers,
heap allocation, connection/request counters, scheduler activity, cache or
atime effects, audit/process/network accounting, stdout logging, ring logging,
and a process-local `server_active_flag=1`. These effects are not claimed
absent. They are acceptable only if the chosen route has no device-file write,
launch, autoload, service, or persistent configuration effect and the
artifact-specific permission names them.

No such permission is requested in Phase 0.9D.