Publish Chimera GFX source

docs/runtime/phase-0.9e-future-rescue-payload-contract.md

@@ -0,0 +1,64 @@
+# Phase 0.9E future rescue payload contract
+
+Date: 2026-07-18
+
+This is a contract for a possible later Phase 0.9F. It is not target source,
+build authorization, transfer authorization, or execution authorization.
+Phase 0.9F design remains blocked while the exact bootstrap implementation and
+output contract are missing.
+
+## Requirements
+
+| # | Requirement | Bootstrap support now |
+|---:|---|---|
+| 1 | loaded only through an independently proven bootstrap | `UNPROVEN` |
+| 2 | never installed | payload policy can require it; bootstrap staging unknown |
+| 3 | never added to autoload | payload policy can require it; actual trigger config unknown |
+| 4 | never modifies elfldr or Manager | payload policy can require it |
+| 5 | creates no device file | bootstrap behavior `UNKNOWN` |
+| 6 | opens targets read-only | future payload requirement |
+| 7 | sends only PS5-to-host file bytes | no current output channel |
+| 8 | binary-safe framing | must be designed |
+| 9 | exact byte count | must be designed |
+| 10 | SHA-256 or complete host hashing | must be designed |
+| 11 | rejects partial transfer | must be designed |
+| 12 | no automatic retry | mandatory; current authorization false |
+| 13 | one file per session | mandatory |
+| 14 | no rename/unlink/upload/install/other-launch/autoload/mount/reboot/service control | mandatory |
+| 15 | hard deadline | missing |
+| 16 | host abort | missing |
+| 17 | live installation untouched | bootstrap and payload both must prove this |
+| 18 | separate output derived from exact bootstrap | missing |
+| 19 | explicit crash/hang model | missing |
+| 20 | no side-effect-free execution claim | mandatory disclosure |
+
+## Required framing properties
+
+A future design must bind:
+
+- protocol version and request identifier;
+- literal source path and component identity;
+- expected exact byte count before accepting output;
+- monotonically increasing chunk offset and bounded chunk length;
+- final byte count and SHA-256;
+- explicit success, rejection, timeout, abort, and short-read terminal states;
+- no resume, reconnect retry, or third attempt;
+- one connection/session and one component;
+- host-side exclusive temporary output, close, reopen, size/hash, and partial
+  deletion/quarantine policy.
+
+## Safety gates before any target source
+
+Target source may not be created merely from this contract. A new phase must
+first provide:
+
+1. exact used bootstrap package and source/binary identity;
+2. proof of independence from both components being recovered;
+3. source-backed host-to-memory or safe temporary-staging semantics;
+4. a bounded, binary-safe result channel;
+5. a restart/reboot model;
+6. a reviewed startup, deadline, abort, crash, and cleanup contract;
+7. separate explicit authority to design target code.
+
+Current machine decision:
+`phase09f_rescue_payload_design_allowed=false`.