docs: record Y2JB homebrew chain

docs/HANDOFF.md

@@ -248,6 +248,18 @@ is asserted by the output but upstream measured it only on 12.60; do not present
 that as independently verified on 13.20. Do not send another kernel exploit in
 an already exploited session. Disable temporary TCP 50000 when not needed.
 
+The user then closed YouTube. A connection-only probe confirmed TCP 9021 remained
+accessible and no immediate crash was observed. Using that surviving loader,
+kstuff-lite v1.11 and ShadowMountPlus 1.7beta3 were downloaded again, verified
+against the hashes in `docs/payload-evidence/`, and sent in order with more than
+four seconds between them. KStuff reported its app.db and SceShellUI patches;
+ShadowMountPlus detected 13.20, installed ShellCore hooks, initialized KStuff
+runtime control, synchronized zero games and exposed its API only at
+`127.0.0.1:10101`. No mount, game, API, suspend/resume or shutdown test was made.
+Temporary payload copies were removed. This confirms the full startup chain
+YouTube → Y2JB → Relapse → KStuff → ShadowMountPlus on this boot, not prolonged
+stability.
+
 FTP used `ps5-payload-dev/ftpsrv` v0.21.1, SHA-256
 `7d4b31c83eae4e056580482a3a074e1db25922efc74ac1e439473b45d71a5938`.
 Active-mode tests failed with `550 Bad file descriptor`; passive mode succeeded.
@@ -263,6 +275,16 @@ install or start the Y2JB autoloader. itsPLK autoloader v0.9.1 has no supported
 kernel exploit for 13.20; v1.0.0-dev-794049f adds Relapse but remains experimental
 and has not been installed in this test.
 
+The proposed long-term integration uses the Y2JB Autoloader only for
+YouTube/Y2JB → Relapse → ELF loader. The external Payload Manager on net-utils01
+retains ownership of post-jailbreak payload discovery, integrity checks,
+dependency ordering and audit logs. Do not configure KStuff or ShadowMountPlus
+in `autoload.txt` for that design. The autoloader's default loopback-only ELF
+loader is incompatible with an external sender; a reviewed LAN-accessible loader
+is required, protected by the existing source-specific TCP 9021 firewall rule.
+The full contract and session-state model are documented in
+`docs/Y2JB_TEST_2026-10-02.md` and `docs/payload-evidence/README.md`.
+
 **Server memory constraint:** net-utils01 has about 1.9 GiB RAM and no swap;
 `/tmp` is tmpfs. Staging approximately 622 MiB of Y2JB files there caused severe
 memory pressure with SSH/HTTP stalls; removal restored SSH. Use a verified