# FriiDump Candidate14 Linux Raw-I/O Capability Contract

Candidate14 closes the Linux authorization ambiguity exposed by the Candidate13
GCC-4244 B101 diagnostic.

## Evidence that required the correction

Candidate11 completed an exact Linux GameCube dump while its executable carried:

```text
cap_sys_rawio=ep
```

Candidate12 and Candidate13 executables had no file capability. Candidate13's
instrumented live run showed that ordinary `READ(10)` commands reached the
GCC-4244, while every HLDS `0xE7` memory-read command failed host-side with:

```text
transport_result=-1
errno=1 (EPERM)
scsi_status=0xFF
sense=00/00/00
```

The difference was authorization, not media state, drive identity, seed
geometry, or Candidate12's DAT/lock-reporting corrections.

## Candidate14 behavior

Candidate14:

- checks effective `CAP_SYS_RAWIO` before known vendor-command paths;
- refuses the operation before seed retrieval or Xbox unlock when authority is
  absent;
- prints exact `setcap` and `getcap` commands for the running executable;
- records the preflight failure in the native report;
- issues STOP UNIT after a failed preflight;
- refuses vendor-command execution when the entire process is root;
- accepts a normal-user process whose exact executable has
  `cap_sys_rawio=ep`;
- emits an explicit Linux configure/build warning;
- provides a maintained capability install/status/remove helper;
- documents that rebuilds and file replacement clear capabilities.

## Security boundary

The supported configuration is not an unprivileged process. It is a
least-privilege process with one elevated Linux capability attached to one
validated executable.

Do not:

- run the whole program with `sudo`;
- install FriiDump setuid-root;
- grant `CAP_SYS_ADMIN` or broader capabilities;
- assume a copied or rebuilt executable retained its xattr;
- apply a capability before verifying the exact executable being tested.

## Build boundary

The build itself never invokes `sudo` and never applies a capability silently.
It prints a warning and leaves the binary unprivileged. The explicit capability
phase is a separate installation action requiring user authorization.