diff --git a/installer/Makefile b/installer/Makefile
index 6fc3beb..1cc585f 100644
--- a/installer/Makefile
+++ b/installer/Makefile
@@ -45,12 +45,21 @@ $(CONTENT_ID).pkg: installer/pkg.gp4
 installer/pkg.gp4: installer/eboot.bin installer/assets/daemon.elf installer/assets/config.json installer/sce_sys/about/right.sprx installer/sce_sys/param.sfo installer/sce_sys/icon0.png installer/sce_sys/pic1.png $(LIBMODULES) $(ASSETS)
 	cd installer && $(TOOLCHAIN)/bin/$(CDIR)/create-gp4 -out pkg.gp4 --content-id=$(CONTENT_ID) --files "eboot.bin assets/daemon.elf assets/config.json sce_sys/about/right.sprx sce_sys/param.sfo sce_sys/icon0.png sce_sys/pic1.png sce_module/libSceFios2.prx sce_module/libc.prx $(patsubst installer/%,%,$(ASSETS))"
 
+# ATTRIBUTE=0 / CATEGORY=gd are the ONLY values verified to launch on real
+# hardware. A long-standing theory said Apollo's gde/32 + --authinfo were the
+# "universal" combo, but every build carrying them died silently pre-logging on
+# a real console (4/4), while 0/gd launched fine. Isolation order was:
+# authinfo (2 builds), SDL UI, native UI - all still crashed. Same LIBS, same
+# object set, and all installer.c deltas provably safe before the first log
+# call, which leaves param.sfo as the only variable present in 4/4 crashes and
+# absent from the one success. Empirical beats theory: keep 0/gd, no authinfo.
+# Change here only with a console test to back it up.
 installer/sce_sys/param.sfo: installer/Makefile
 	$(TOOLCHAIN)/bin/$(CDIR)/PkgTool.Core sfo_new $@
 	$(TOOLCHAIN)/bin/$(CDIR)/PkgTool.Core sfo_setentry $@ APP_TYPE --type Integer --maxsize 4 --value 1
 	$(TOOLCHAIN)/bin/$(CDIR)/PkgTool.Core sfo_setentry $@ APP_VER --type Utf8 --maxsize 8 --value '$(VERSION)'
-	$(TOOLCHAIN)/bin/$(CDIR)/PkgTool.Core sfo_setentry $@ ATTRIBUTE --type Integer --maxsize 4 --value 32
-	$(TOOLCHAIN)/bin/$(CDIR)/PkgTool.Core sfo_setentry $@ CATEGORY --type Utf8 --maxsize 4 --value 'gde'
+	$(TOOLCHAIN)/bin/$(CDIR)/PkgTool.Core sfo_setentry $@ ATTRIBUTE --type Integer --maxsize 4 --value 0
+	$(TOOLCHAIN)/bin/$(CDIR)/PkgTool.Core sfo_setentry $@ CATEGORY --type Utf8 --maxsize 4 --value 'gd'
 	$(TOOLCHAIN)/bin/$(CDIR)/PkgTool.Core sfo_setentry $@ CONTENT_ID --type Utf8 --maxsize 48 --value '$(CONTENT_ID)'
 	$(TOOLCHAIN)/bin/$(CDIR)/PkgTool.Core sfo_setentry $@ DOWNLOAD_DATA_SIZE --type Integer --maxsize 4 --value 0
 	$(TOOLCHAIN)/bin/$(CDIR)/PkgTool.Core sfo_setentry $@ SYSTEM_VER --type Integer --maxsize 4 --value 0
@@ -60,7 +69,7 @@ installer/sce_sys/param.sfo: installer/Makefile
 
 installer/eboot.bin: $(OBJS)
 	$(LD) $(INTDIR)/*.o -o $(INTDIR)/$(PROJDIR).elf $(LDFLAGS)
-	$(TOOLCHAIN)/bin/$(CDIR)/create-fself-macos -in=$(INTDIR)/$(PROJDIR).elf -out=$(INTDIR)/$(PROJDIR).oelf --eboot "installer/eboot.bin" --paid 0x3800000000000011 --authinfo 000000000000000000000000001C004000FF000000000080000000000000000000000000000000000000008000400040000000000000008000000000000000080040FFFF000000F000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+	$(TOOLCHAIN)/bin/$(CDIR)/create-fself-macos -in=$(INTDIR)/$(PROJDIR).elf -out=$(INTDIR)/$(PROJDIR).oelf --eboot "installer/eboot.bin" --paid 0x3800000000000011
 
 $(INTDIR)/%.o: $(PROJDIR)/%.c
 	$(CC) $(CFLAGS) -o $@ $<
diff --git a/installer/installer.c b/installer/installer.c
index f73ff9e..944b422 100644
--- a/installer/installer.c
+++ b/installer/installer.c
@@ -30,6 +30,30 @@
  * back over FTP. The dialog alone can't say WHICH stage failed. */
 static const char *g_stage = "-";
 
+/* --- pre-main boot marker ------------------------------------------
+ * The wizard died before main() on every packaging experiment, leaving
+ * install.log untouched and the crash handler (installed inside main)
+ * never armed. A constructor runs before main, so it separates the two
+ * failure classes for good:
+ *   no BOOT line at all  -> the loader/SELF never got control (packaging,
+ *                           authinfo, SIGSYS) or a pre-main fault
+ *   BOOT but no stage    -> main started, died before the first ilog()
+ * Async-signal-safe only: raw open/write, no stdio, no malloc. */
+__attribute__((constructor))
+static void boot_marker(void){
+    static const char msg[] = "BOOT installer entered pre-main\n";
+    const char *paths[2];
+    size_t i;
+    paths[0] = "/data/install.log";
+    paths[1] = INST_LOG;
+    for(i = 0; i < 2; i++){
+        int fd = open(paths[i], O_WRONLY | O_APPEND | O_CREAT, 0666);
+        if(fd < 0) continue;
+        { ssize_t w = write(fd, msg, sizeof msg - 1); (void)w; }
+        close(fd);
+    }
+}
+
 static void ilog(const char *tag, int err, long expect, long got){
     FILE *f;
     g_stage = tag;
diff --git a/installer/sce_sys/param.sfo b/installer/sce_sys/param.sfo
index d66106d..47d182a 100644
Binary files a/installer/sce_sys/param.sfo and b/installer/sce_sys/param.sfo differ