Publish Chimera GFX source

docs/runtime/phase-0.9e-r2-community-backup-correlation.md

@@ -0,0 +1,70 @@
+# Phase 0.9E-R2 community backup correlation
+
+Date: 2026-07-19
+
+Only the three named official GitHub repositories and their release metadata
+were inspected. No mirror or general scene download was used. Metadata,
+source trees, and release assets were read statically; downloaded archives
+were not executed.
+
+## Candidate matrix
+
+| Family | Relevant release identity | Firmware statement | Public system backup | Components/autoload | Decision |
+|---|---|---|---|---|---|
+| `itsPLK/ps5-y2jb-autoloader` | `v0.8-a0146a2`, commit `a0146a2a9229fa5df5b5127257bf2e11ffc6d2de` | 4.03–12.70 | no; README explicitly says the project does not distribute preconfigured system backups | Lapse blob `190996c…`, P2JB blob `510bf4b…`, elfldr submodule `148b71c…`, Payload Manager submodule `5d33ce1…`; exploit and localhost elfldr auto-load, later payloads use `autoload.txt` | `THIRD_PARTY_BUILD_FROM_PUBLIC_SOURCE_POSSIBLE`, but unbound |
+| `owendswang/Y2JB-P2JB-bdj_unpatch` | `v1.4-autoloader`, commit `9990e917cdb24c249ce24f4ff18e6e869e99cf51` | tag README says 9.00–12.40 disc; downloaded backup name says 7.61 | yes | Gezine Y2JB base declared; Lapse/P2JB blobs and embedded elfldr are identifiable; no Payload Manager identity at this tag | downloaded candidate inner and structure do not match |
+| `lz-anonz/Y2X` | `v1.3`, commit `2ae881259be647738713b83a6a91ffe693ccf9af` | 4.03–12.70 | no current large release asset despite README backup wording | P2JB/Lapse, v1/v2 embedded elfldr, Payload Manager 0.3.1 and FTP; v2 auto-loads Manager/FTP and warns against kstuff in autoload | excluded by asset inventory; no large download |
+
+## itsPLK
+
+The relevant tag was published 2026-06-10 09:05:51Z, before the local inner
+ZIP timestamp. Its official assets are only:
+
+- `download0.dat`, 336789504 bytes,
+  SHA-256 `268c82f7a8f581c804949a86c259c982953ff479c13a3dc9f9da02c354b32d6e`;
+- `y2jb_update.zip`, 1152857 bytes,
+  SHA-256 `301599b05e7eb7224025ef9ed6ebc896d86d2c14bba5c32ced5a88bdf2c3517e`.
+
+Its README's firmware range, “Autoloader” naming, timing, and credit to Rush
+for creating a backup make the family plausible. The same README explicitly
+says itsPLK does not distribute such backups. No public hash, backup asset,
+MediaFire link, or maker attestation binds this source to the local bytes.
+Accordingly it is not an official itsPLK release and is not promoted to
+`THIRD_PARTY_REPACK_PROVENANCE_BOUND`.
+
+## owendswang
+
+Release `v1.4-autoloader` published 2026-06-10 09:01:19Z includes:
+
+- `download0_Y2JB+autoloader-20260609.zip`, 333151616 bytes;
+- `PS5-12.20-backup-Y2JB+autoloader-20260609-en.zip`, 498991549 bytes;
+- `PS5-7.61-backup-Y2JB+autoloader-20260609-en.zip`, 504425435 bytes.
+
+The 7.61 backup was the sole downloaded community candidate because its
+family, date, and size were concrete matches. Its local download exactly
+matched GitHub size and SHA-256
+`8552d7c3c7bb3f078d967f56dfe1b488b37e3ed13e10c5fe97ae222482d56897`.
+Its inner is 504627200 bytes with SHA-256
+`d4f9b1ba4e32af175a3431a7734085d5420370ebb79f9a32852eb824a90e190e`.
+The local inner is 262144 bytes smaller, has a different full hash, differs
+byte-for-byte, and has version/count 3/62 rather than 6/58. Normalized
+segment layout and section hashes also differ.
+
+Classification: no `COMMUNITY_INNER_BYTE_MATCH`.
+
+## lz-anonz
+
+Release `v1.3` published 2026-06-10 21:58:27Z has only:
+
+- `USB-ps5_autoloader.rar`, 904337 bytes;
+- `v1.3-download0-Y2X-P2JB+Lapse.rar`, 521801 bytes.
+
+The source contains autoload and embedded components, but the current release
+does not expose a system-backup object to compare. README language is not a
+byte identity. No large asset was downloaded.
+
+## Download bound
+
+One of the maximum three allowed community backups was downloaded. It used one
+attempt, no resume, and no retry. The other two families had no public large
+candidate justified by their own release metadata.