clean: descriptive comments, remove dead code, fix build errors

- Remove dead step_status() function (never called)
- Add reap_stale() forward declaration, call from ui_init()
- Add descriptive comments throughout installer.c and ui.c
- Add PAD module unload to ui_shutdown()
- Add config.json to Makefile clean target
- Fix step_token missing closing brace
- Update docs/INSTALLER.md to reflect LoadStartModule eviction
- All tests green, EBOOT matches, SHA-256 match after FTP upload

docs/INSTALLER.md

@@ -3,9 +3,10 @@
 ## What it does
 
 One linear flow, forward-only (every No skips ahead, nothing loops back):
-confirm → kill old daemon → copy `evict.elf` + `orbisrpc.bin` to
-`/data/payloads/` (mkdir -p + byte-count + FNV hash read-back) →
-pre-saved config with token (skips entry when valid) → done.
+confirm → evict old daemon (via `sceKernelLoadStartModule`) → copy
+`evict.elf` + `orbisrpc.bin` to `/data/payloads/` (mkdir -p +
+byte-count + FNV hash read-back) → pre-saved config with token
+(skips entry when valid) → done.
 Read-only status screen available via decline.
 
 There is no WiFi check. The installer runs sandboxed, so its socket probe
@@ -13,22 +14,26 @@ measures the app's network stack, not the payload's — and a FAILED line
 reads like a verdict on Discord itself. The daemon reports real reachability
 in its own log once started.
 
-The installer never boots anything. Starting the daemon is Payload Guest's
-`/data/payloads/` directory — pick `evict.elf` first (removes old orbisrpc
-instance), then pick `orbisrpc.bin`. No loopback ports, no injection, no
-boot proof to go wrong.
+The installer never boots anything directly. Starting the daemon is
+Payload Guest's `/data/payloads/` directory — pick `evict.elf` first
+(removes old orbisrpc instance), then pick `orbisrpc.bin`.
+No loopback ports, no injection, no boot proof to go wrong.
 
 ## Install flow
 
 ```
-confirm → SIGTERM/SIGKILL old daemon via daemon.lock
+confirm → sceKernelLoadStartModule(evict.elf) — kills old daemon
         → copy evict.elf to /data/payloads/evict.elf
         → copy orbisrpc.bin to /data/payloads/orbisrpc.bin
-        → save config.json with Discord token
+        → save config.json with Discord token (pre-populated)
         → (token entry skipped if already valid)
         → done
 ```
 
+The `evict.elf` is launched via `sceKernelLoadStartModule` during
+install — it reads `daemon.lock`, kills the running daemon, exits.
+`evict.elf` stays in `/data/payloads/` for future manual use.
+
 ## Navigation law
 
 No branch ever returns to start. Cancel/skip always moves forward. The only
@@ -45,13 +50,15 @@ button on No, which inverts the whole wizard.
   between splash hide and first dialog.
 - Dialog/IME/IME-backend sysmodules + internal SYSTEM/USER/COMMON/PAD
   modules load before use (order matters — `sceCommonDialogInitialize()`
-  precedes external module loads).
+  precedes external module loads; PAD is unloaded on exit).
 - `stat()`/`fstat()` lie about sizes inside the sandbox (observed 4096/4160
   for a 2071552-byte file), so install proof is byte count + FNV hash on
   read-back, and status uses open-existence, never stat.
 - Config writes are atomic (tmp+fsync+rename) with read-back proof.
 - IME wait is bounded; asset key charset validated (bad keys blank the
   activity).
+- `evict.elf` is loaded via `sceKernelLoadStartModule` because `kill()`
+  is blocked by the sandbox (EPERM).
 
 ## Auto-start
 
@@ -63,5 +70,6 @@ shows where, it can't write the queue itself.
 
 `make -f installer/Makefile` (`OO_PS4_TOOLCHAIN`, llvmshim). Staged assets:
 `daemon.elf`, `evict.elf`, `config.json`. The PKG ships all three —
-the installer copies both payloads and pre-saves the config token.
+the installer copies both payloads, launches evict.elf to kill the
+old daemon, and pre-saves the config token.
 Output: `IV0000-ORPC00001_00-ORBISRPCSETUP000.pkg`.