chimera-gfx-Public/docs/runtime/phase-0.9e-reboot-and-crash-model.md

Phase 0.9E reboot and crash model

Date: 2026-07-18

Classification: REBOOT_RECOVERY_UNPROVEN

State model

State	Evidence	Expected lifetime	Reboot statement
exact exploit/browser state	implementation absent	unknown	UNPROVEN
exact port-9020 listener state	implementation absent	unknown	UNPROVEN
hardened elfldr entry process	main.c source	temporary by design	hardware behavior unproven
embedded bootstrap in SceRedisServer	main.c/bootstrap.c	temporary injection stage	likely process/kernel state, not a proven recovery mechanism
elfldr.elf port-9021 service	socksrv.c	process-local background service by design	README says rest-mode resume, not reboot persistence
controlled Manager	source/offline artifact	process-local when launched	explicitly not installed in current controlled-runtime evidence
Manager configuration/autoload files	source paths only	filesystem-persistent if actually present	current device values and use unobserved
Y2JB-named SIECAF backup	host file	host-persistent	not proof of device installation

The hardened elfldr README states that the port-9021 service survives payload crashes and resumes after rest mode. It does not say that the service survives a full reboot. Source creates process state and does not install a boot item, but the complete device bootstrap/autoload environment is not available.

Crash cases

• A payload crash under hardened port 9021 is isolated by design from the service process. That is source architecture, not a tested firmware-9.60 guarantee.
• A crash in the unknown port-9020 listener may terminate a process, exploit state, or more. No cleanup, watchdog, retry, or restart path is available for audit.
• A malformed or truncated 9020 transfer has unknown allocation, mapping, execution, and close behavior.
• A hang has no proven host abort, deadline, or recovery response.
• No source proves that a bad payload cannot create persistent state; a future rescue contract must explicitly prohibit such writes.

Anti-brick boundary

A session crash is not automatically brick-relevant if live files, autoload, configuration, mounts, and boot state remain unchanged and a reboot or fresh jailbreak session restores the executor. Those premises are not yet proven for the actual chain.

Consequently:

• restartable_after_reboot=unproven;
• no guarantee is made that reboot always restores access;
• no automatic retry is permitted;
• no future device phase may rely on reboot recovery until the exact package and its state transitions are audited.

Minimum evidence to promote to REBOOT_RECOVERY_SUPPORTED_BY_DESIGN is an exact source-bound trigger/listener implementation proving that all bootstrap state is session-local or safely reproducible, plus an exact operator procedure that does not rely on a live component or autoload.