109 lines
4.3 KiB
Markdown
109 lines
4.3 KiB
Markdown
# Phase 0.9B observer limitations
|
||
|
||
Status: **BLOCKED**.
|
||
|
||
## What was established
|
||
|
||
- Exact local commits and relevant source-file identities were recorded.
|
||
- Normal SDK v0.41 startup is **UNSAFE** for this phase because
|
||
`__patch_init()` is reachable before `main` and performs prohibited writes.
|
||
- A `-nostartfiles` link can omit that CRT, but safe observer entry,
|
||
return/exit, crash cleanup and resource cleanup remain **UNPROVEN**.
|
||
- The hardened controlled route is hash-bound but passes `stdio=-1`.
|
||
- The controlled manager transport sends and closes; it has no receive
|
||
callback for observer data.
|
||
- The fixed loader exit response cannot carry the requested observation set.
|
||
- Stock Payload Manager HTTP routes and log state are not an admissible
|
||
replacement output collector.
|
||
|
||
## What was not built
|
||
|
||
- no observer source;
|
||
- no target declaration;
|
||
- no PS5 object or ELF;
|
||
- no linker map;
|
||
- no disassembly or reachable callgraph;
|
||
- no artifact import, relocation, string or open-flag report;
|
||
- no double clean target build;
|
||
- no artifact manifest;
|
||
- no install, lifecycle or execution package; and
|
||
- no transfer or execution instructions.
|
||
|
||
These are intentional consequences of the pre-build hard gates, not omitted
|
||
positive evidence.
|
||
|
||
## Unsupported or unproven observations
|
||
|
||
All target observations remain unimplemented. In particular:
|
||
|
||
- only one possible firmware source exists in the reviewed SDK source;
|
||
- no independent second firmware source is established;
|
||
- firmware 9.60 runtime behavior of the first source is untested;
|
||
- mount layouts and semantics are not runtime-proven;
|
||
- a process sample exists, but complete service mapping does not;
|
||
- no exact listener snapshot and owner-mapping API was established;
|
||
- live and backup paths are absent;
|
||
- live and backup objects, sizes, identities and hashes are absent;
|
||
- authoritative autoload/startup/retry source completeness is absent;
|
||
- stable no-follow behavior on the target filesystem is unproven;
|
||
- atime, audit, cache, counter and scheduler effects remain possible; and
|
||
- output and exit remain blocked.
|
||
|
||
## Remaining anti-brick blockers
|
||
|
||
1. two current firmware sources;
|
||
2. literal live paths;
|
||
3. live mount and object identities;
|
||
4. live sizes and SHA-256;
|
||
5. mount and filesystem properties;
|
||
6. process and service inventory;
|
||
7. listener inventory and ownership;
|
||
8. complete autoload/startup/retry state;
|
||
9. existing separate rollback objects;
|
||
10. byte-exact on-device Payload Manager backup (`HARD_BLOCKER`);
|
||
11. independent recovery;
|
||
12. power-loss-safe switch semantics;
|
||
13. component order;
|
||
14. observer startup/exit ABI; and
|
||
15. non-persistent output.
|
||
|
||
No offline test may promote a stock hash, clear a device blocker, prove
|
||
firmware behavior, or authorize a later action.
|
||
|
||
## Risk of a later one-shot run
|
||
|
||
Even if a future artifact were approved, unresolved risks would include:
|
||
|
||
- the existing loader’s ptrace, credential, mapping, breakpoint and
|
||
socket-overlap operations before payload entry;
|
||
- loader cleanup failure or a child that does not terminate;
|
||
- crash or return behavior different from the source-reviewed expectation;
|
||
- kernel, audit, cache, atime, scheduler and counter effects from reads;
|
||
- stale or conflicting path plans;
|
||
- concurrent object replacement during observation;
|
||
- incomplete process/service/listener snapshots;
|
||
- output truncation or loss;
|
||
- a false inference from an unsupported result; and
|
||
- operator confusion between observation evidence and installation approval.
|
||
|
||
One observation could not prove atomic switch semantics, write durability,
|
||
power-loss behavior, recovery independence under actual failure, component
|
||
order, future runtime stability, graphics safety, RetroArch compatibility or
|
||
the absence of every platform side effect.
|
||
|
||
## Minimum evidence to resume engineering
|
||
|
||
Resume target engineering only after both items are available in local,
|
||
commit-bound public source and accepted by a new review:
|
||
|
||
1. a kernelwrite-free startup and termination ABI covering BSS, stack,
|
||
return/exit, crash behavior and loader cleanup; and
|
||
2. a one-shot response channel that returns bounded observer bytes over the
|
||
controlled route without a device file, new listener, persistent state,
|
||
global Payload Manager mutation or post-exit activity.
|
||
|
||
Until then the exact decision is:
|
||
|
||
**BLOCKED — OBSERVER STARTUP OR EXIT ABI UNPROVEN; NO PROVEN
|
||
NON-PERSISTENT OUTPUT CHANNEL.**
|