Publish Chimera GFX source

docs/retroarch/phase-1.0ea-expanded-launch-evidence.md

@@ -0,0 +1,59 @@
+# Phase 1.0EA: expanded launch evidence and cleanup audit
+
+Status: `NEW_FW960_LNC_CANDIDATE_FOUND_ABI_AND_CLEANUP_GATES_STILL_BLOCKED`
+
+This phase is a bounded public-source and offline source-history audit. It
+creates no target source or artifact and performs no PS5 operation.
+
+## Newly reviewed candidate
+
+The public `phantomptr/ps5upload` repository was bound at commit
+`978add1864eb54351eaddbd242634282ef3cd120`. Its current ShellUI RPC source is
+Git blob `b30d17bd0068affd5b4d42550953bc6bd44203f7`; its ptrace implementation is
+blob `6b68f26995f746df5b2b0b9fd1495432304e8f35`.
+
+Commit `e3875ffba7cb08e017dcdb537d045af3fddc133d` first introduced the reviewed
+route and states that game launch through `sceLncUtilLaunchApp` worked on
+firmware 9.60. The implementation constructs a packed 24-byte local parameter
+with size, user ID, options, crash-report and check fields, then remotely calls
+the export from `SceShellUI`. This is useful independent implementation and
+operator-report evidence for a different launch API. It is not independent ABI
+provenance: the introducing commit supplies no public specification, header,
+binary-derived layout proof or second implementation lineage for that
+parameter layout. Exact-name searches for the layout fields produced no other
+qualifying public source.
+
+The route also does not satisfy the Chimera end state. It starts a registered
+title; it does not bind or replace that title's process with the exact embedded
+RetroArch ELF. The previously reviewed shsrv replacement lineage would still
+be required for that second operation, so finding the LNC launch candidate does
+not remove the replacement ABI or composition gates.
+
+## Cleanup findings
+
+The candidate cannot be imported as a bounded lifecycle implementation:
+
+- attach, remote-call and single-step paths use blocking `waitpid` without an
+  absolute deadline;
+- launch cleanup discards `pt_munmap` and `pt_detach` results;
+- the tracked-attached flag is cleared even when detach fails;
+- a dispatched call with unreadable completion is promoted to soft success;
+- register restoration and authid restoration include best-effort failures;
+- an authid restore failure is logged and execution continues with elevated
+  process state until a later operation might repair it;
+- its retry/fallback semantics exceed the Chimera one-shot contract.
+
+These are source facts about the candidate, not claims about an observed PS5
+failure. The existing Chimera host ownership models remain useful, but no
+source-bound target composition currently replaces these failure behaviors
+with absolute deadlines, verified restoration and terminal ownership.
+
+## Decision and next step
+
+The direct embedded route selected by DZ remains the minimum architecture, but
+target source and build remain blocked. The next gate requires either an
+independent public specification or two demonstrably independent,
+firmware-applicable implementations that agree on the complete launch and
+replacement ABI, followed by a target-source composition whose every blocking
+wait, mapping, register, credential, attach and detach edge has a deadline and
+verified cleanup result. Console permission is not yet actionable.