Publish Chimera GFX source

docs/runtime/phase-0.9b-observer-limitations.md

@@ -0,0 +1,108 @@
+# Phase 0.9B observer limitations
+
+Status: **BLOCKED**.
+
+## What was established
+
+- Exact local commits and relevant source-file identities were recorded.
+- Normal SDK v0.41 startup is **UNSAFE** for this phase because
+  `__patch_init()` is reachable before `main` and performs prohibited writes.
+- A `-nostartfiles` link can omit that CRT, but safe observer entry,
+  return/exit, crash cleanup and resource cleanup remain **UNPROVEN**.
+- The hardened controlled route is hash-bound but passes `stdio=-1`.
+- The controlled manager transport sends and closes; it has no receive
+  callback for observer data.
+- The fixed loader exit response cannot carry the requested observation set.
+- Stock Payload Manager HTTP routes and log state are not an admissible
+  replacement output collector.
+
+## What was not built
+
+- no observer source;
+- no target declaration;
+- no PS5 object or ELF;
+- no linker map;
+- no disassembly or reachable callgraph;
+- no artifact import, relocation, string or open-flag report;
+- no double clean target build;
+- no artifact manifest;
+- no install, lifecycle or execution package; and
+- no transfer or execution instructions.
+
+These are intentional consequences of the pre-build hard gates, not omitted
+positive evidence.
+
+## Unsupported or unproven observations
+
+All target observations remain unimplemented. In particular:
+
+- only one possible firmware source exists in the reviewed SDK source;
+- no independent second firmware source is established;
+- firmware 9.60 runtime behavior of the first source is untested;
+- mount layouts and semantics are not runtime-proven;
+- a process sample exists, but complete service mapping does not;
+- no exact listener snapshot and owner-mapping API was established;
+- live and backup paths are absent;
+- live and backup objects, sizes, identities and hashes are absent;
+- authoritative autoload/startup/retry source completeness is absent;
+- stable no-follow behavior on the target filesystem is unproven;
+- atime, audit, cache, counter and scheduler effects remain possible; and
+- output and exit remain blocked.
+
+## Remaining anti-brick blockers
+
+1. two current firmware sources;
+2. literal live paths;
+3. live mount and object identities;
+4. live sizes and SHA-256;
+5. mount and filesystem properties;
+6. process and service inventory;
+7. listener inventory and ownership;
+8. complete autoload/startup/retry state;
+9. existing separate rollback objects;
+10. byte-exact on-device Payload Manager backup (`HARD_BLOCKER`);
+11. independent recovery;
+12. power-loss-safe switch semantics;
+13. component order;
+14. observer startup/exit ABI; and
+15. non-persistent output.
+
+No offline test may promote a stock hash, clear a device blocker, prove
+firmware behavior, or authorize a later action.
+
+## Risk of a later one-shot run
+
+Even if a future artifact were approved, unresolved risks would include:
+
+- the existing loader’s ptrace, credential, mapping, breakpoint and
+  socket-overlap operations before payload entry;
+- loader cleanup failure or a child that does not terminate;
+- crash or return behavior different from the source-reviewed expectation;
+- kernel, audit, cache, atime, scheduler and counter effects from reads;
+- stale or conflicting path plans;
+- concurrent object replacement during observation;
+- incomplete process/service/listener snapshots;
+- output truncation or loss;
+- a false inference from an unsupported result; and
+- operator confusion between observation evidence and installation approval.
+
+One observation could not prove atomic switch semantics, write durability,
+power-loss behavior, recovery independence under actual failure, component
+order, future runtime stability, graphics safety, RetroArch compatibility or
+the absence of every platform side effect.
+
+## Minimum evidence to resume engineering
+
+Resume target engineering only after both items are available in local,
+commit-bound public source and accepted by a new review:
+
+1. a kernelwrite-free startup and termination ABI covering BSS, stack,
+   return/exit, crash behavior and loader cleanup; and
+2. a one-shot response channel that returns bounded observer bytes over the
+   controlled route without a device file, new listener, persistent state,
+   global Payload Manager mutation or post-exit activity.
+
+Until then the exact decision is:
+
+**BLOCKED — OBSERVER STARTUP OR EXIT ABI UNPROVEN; NO PROVEN
+NON-PERSISTENT OUTPUT CHANNEL.**