# Phase 1.0E inherited result channel

Status: **ONE-SHOT TEST CONSUMED; INCOMPLETE BEFORE D03; NO DEVICE ACTION AUTHORIZED**.

## Source-bound transport

Hardened elfldr commit `197623058f509eddde18868dafcb92fdcac66464`
provides a duplex channel only on its legacy raw-ELF route:

- `socksrv.c:335-339` invokes `elfldr_read` for raw ELF input;
- `elfldr.c:837-923` derives and reads the exact ELF extent, so socket EOF is
  not the input framing contract;
- `socksrv.c:139-141` passes the accepted descriptor to `elfldr_spawn` for the
  legacy route but passes `-1` for the controlled route;
- `elfldr.c:499-520` duplicates that descriptor to payload stdin, stdout and
  stderr; and
- `socksrv.c:421-423` closes the parent copy only after spawn returns.

The Phase-1.0E profile therefore writes results to inherited stdout. It adds no
target-side `socket`, `connect`, `bind`, `listen`, `accept` or `recv`, no target
address or port, and no loader change. This finding does **not** apply to the
controlled route, whose `stdio=-1` contract remains intentionally outputless.

## Target frame and write behavior

After each first D00-D12 notification attempt, the target performs exactly one
nonblocking, signal-suppressed operation:

```c
send(STDOUT_FILENO, frame, 64, MSG_DONTWAIT | MSG_NOSIGNAL)
```

There is no send loop or retry. A short write or error is retained only in
process memory and cannot block the pre-existing notification/diagnostic path.
D11 and D12 are terminal frames. Each 64-byte big-endian frame contains magic
`CHD10E01`, version, size, strict sequence, stage, kind, flags, raw results,
notification result/masks, twenty zero bytes and CRC-32 over bytes 0-59.

## Host behavior

The host tool validates exact ELF size and SHA-256 before socket creation. It
then permits one connect, one `sendall`, one `shutdown(SHUT_WR)`, bounded
receive of at most 65,536 bytes, and one close. It never retries, reconnects,
resumes or overwrites an existing trace. The half-close ends only host-to-PS5
input; it leaves payload stdout readable on the same descriptor.

The parser rejects invalid magic/version/size, CRC, reserved bytes, stage,
kind, flags or sequence. EOF, timeout or the byte ceiling without a valid
terminal frame is incomplete evidence. A valid frame proves code output from
the transferred payload process on that connection; it does not prove safe
exit, loader cleanup or an unreported graphics boundary.

## Static artifact result

`retroarch_ps5_result_diag.elf` is 1,844,880 bytes with SHA-256
`1049c78099a60b472a3fb0e2999e3393b6ad76337a28532a7e53872e7772dedf`.
Two clean builds from chimera-retroarch commit
`b9fc037304a14199f35f8229edac26fa5c840509` produced byte-identical ELF and
map files. Compared with RUN B, the complete undefined-symbol set changes only
by adding `send`.

The ELF retains the ordinary SDK v0.41 CRT and Phase-1.0D SDL/VideoOut path.
Disassembly proves `_start` calls `__patch_init`; the statically linked CRT
contains its credential/capability and syscall-range helpers. Those bounded,
temporary runtime effects are not hidden or reclassified by this channel.
No RWX load segment, TLS or non-empty init/fini array exists.

## Consumed RUN C result

The exact one-shot permission was consumed on 2026-07-22. The host verified
the authorized 1,844,880-byte artifact before connecting, used one connection,
one `sendall` and one write-half-close, then received 3,413 bytes before remote
EOF. There was no retry, reconnect, parser error or timeout.

Three 64-byte frames validated: D00, D01 and D02 in strict sequence. D02's
`raw0=0` proves the bounded in-memory PS5 platform/frontend initialization
marks succeeded. The result channel itself is therefore proven on firmware
9.60 for those stages. No D03 or terminal frame arrived. Because D03 is the
first operation in `sdl2_gfx_init()`, this result does not prove entry into the
SDL video driver, SDL initialization, VideoOut, a flip, rendering, cleanup or
safe exit. Remote EOF is an observed transport boundary, not proof of normal
process return.

The ignored local trace is bound by size 1,795 and SHA-256
`4ff27a0eac48283cdc4c7ff964226def2689e808e3adea6594d0e77674a676f0`.
It is not committed because it contains the session address. All authorization
fields are false after this consumed attempt.

## Offline D02-to-D03 follow-up

Source inspection bounds the unobserved interval but does not identify a root
cause. After D02, RetroArch still performs synchronous content-load setup,
argument/config processing, driver selection, static-core/content init and the
entry into `drivers_init()`. D03 is the first instrumented operation in
`sdl2_gfx_init()`. Any earlier failure or external termination can therefore
produce the observed boundary.

Chimera-retroarch commit `f1391c3e6717ff4e2b869007fb9627c9edde52e4`
updates only the host receiver, its tests and documentation. Future traces can
retain the full bounded receive stream and non-frame stdout losslessly as
base64 with byte counts and SHA-256 values. The pre-encoding limit remains
65,536 bytes and trace creation remains exclusive. The client explicitly
rejects the consumed RUN-C state. No target code, target artifact, device
action or authorization was added.