# Phase 1.0EB: public launch and replacement source matrix

Status: `PUBLIC_SOURCE_MATRIX_EXHAUSTED_EXTERNAL_ABI_EVIDENCE_REQUIRED`

This offline phase compares every qualifying public candidate found in the
bounded searches through 2026-07-30. Clones remain under ignored `build/`
paths. No candidate program or binary was executed, no proprietary library was
opened, and no PS5 operation occurred.

## Source matrix

| Lineage | Launch contract | ELF replacement | Firmware 9.60 evidence | Result |
|---|---|---|---|---|
| official shsrv/websrv | local `sceSystemServiceLaunchApp` and `app_launch_ctx_t` declarations | BigApp replacement | deployed identity and safe behavior unproven | architecture reference only |
| sonicloader | declaration block derives from shsrv | copies same replacement lineage | operator claims only | not independent |
| phantomptr/ps5upload | `sceLncUtilLaunchApp`, packed 24-byte local parameter | none | source author reports launch success | independent implementation, no ABI provenance |
| manos555555/PS5-Upload-Suite | `sceLncUtilLaunchApp` with guessed 256-byte block, then NULL and SystemService fallbacks | none | no exact result contract | contradicts 24-byte candidate; probing code, not ABI evidence |
| astrelsky/libhijacker | daemon/process spawner, not BigApp launch | loads ELF in separate process | no applicable BigApp/VideoOut proof | different architecture with unbounded polling |
| etaHEN public tree | only `hbldr_launch` declaration found | implementation absent from visible source | not source-bound | incomplete and inadmissible as proof |

The two independent LNC candidates do not agree on the parameter contract.
The 256-byte candidate explicitly describes its size as typical and tries
fallbacks, so successful launch could not identify which ABI path worked. The
24-byte candidate supplies a concrete layout but no independent provenance.
Neither performs the embedded RetroArch replacement.

The only reviewed BigApp replacement implementations share the official
shsrv/websrv lineage. Sonicloader is derivative. The etaHEN tree contains an
`hbldr_launch` header but no matching implementation in the visible source
tree. Its tracked binary libraries are outside Chimera's public-source-only
boundary and were not inspected. Libhijacker is independently useful for a
separate daemon process but does not establish BigApp VideoOut ownership and
contains polling without the required deadline contract.

## Exact external evidence request

Further target work requires a new public, redistribution-compatible evidence
package containing all of the following:

1. declarations and complete field layout for the chosen PS5 title-launch API,
   with derivation or an independently reviewable specification;
2. the full source of the firmware-applicable BigApp process selection and
   replacement path, including every structure and constant it consumes;
3. evidence that the selected title/context owns usable VideoOut on firmware
   9.60, without inferring this from successful title launch alone;
4. explicit semantics for every wait, stop, return and error state;
5. source-permitted replacement of every blocking wait with an absolute
   monotonic deadline and a terminal kill/reap policy;
6. checked rollback for registers, credentials, mappings, descriptors,
   breakpoints, attachment state and the target process;
7. license and provenance sufficient to cite or reuse the declarations without
   proprietary or leaked SDK material.

A binary dump, symbol list, operator statement, fallback experiment or new
device authorization cannot satisfy this request. Unknown or conflicting
evidence remains `STOP`.

## Decision and next step

All work that can be completed safely from the available public evidence is
done. No ADR can accept an ABI while the independent candidates conflict, and
no target source or artifact may be created. The next step is external evidence
acquisition using the seven-item request above. Once supplied, the first local
action is a provenance/lineage audit; only a passing audit can open a new ADR
and the bounded target-composition phase.