# Phase 1.0F startup interval diagnostic

Status: **OFFLINE ARTIFACT PREPARED; NO DEVICE ACTION AUTHORIZED**.

Phase-1.0E RUN C proved D00-D02 and returned D02 raw result `0`, then the
inherited stream reached EOF before D03. Phase 1.0F adds fifteen stream-only
checkpoints inside that source interval. It creates no new observation route,
does not explain RUN C retrospectively and is not hardware evidence.

## Bounded design

The `interval-diag` profile retains D00-D12 and uses separate frame magic
`CHD10F01`. I00-I14 occupy indices 13-27. Each reached checkpoint performs at
most one nonblocking, signal-suppressed 64-byte `send` on the raw-elfldr socket
already inherited as stdout. It never retries a short write or failure.

The interval functions do not call the notification ABI, create/connect a
socket, listen, receive, open a device file, persist state, install, autoload,
launch another payload or contain an address/port. The existing D-stage
notifications remain unchanged. The controlled elfldr route still has
`stdio=-1` and cannot carry this result stream.

| Stage | Source location | Boundary |
|---|---|---|
| I00 | `retroarch.c:6038` | before CLI content-load dispatch |
| I01 | `tasks/task_content.c:1413` | content-load entry |
| I02 | `tasks/task_content.c:1437` | frontend environment callback returned |
| I03 | `retroarch.c:7817` | `retroarch_main_init()` entry |
| I04 | `retroarch.c:7839` | argument/config parsing returned |
| I05 | `retroarch.c:7981` | before driver lookup |
| I06 | `retroarch.c:7987` | audio driver found |
| I07 | `retroarch.c:7993` | video driver found |
| I08 | `retroarch.c:7999` | input driver found |
| I09 | `retroarch.c:8005` | camera driver found |
| I10 | `retroarch.c:8034` | core initialization begins |
| I11 | `retroarch.c:8048` | core result, raw0 `0` or `-1` |
| I12 | `retroarch.c:8116` | before `drivers_init()` |
| I13 | `gfx/video_driver.c:3385` | internal video initialization entry |
| I14 | `gfx/drivers/sdl2_gfx.c:329` | SDL2 video entry immediately before D03 |

I-frame notification masks are read-only snapshots of earlier D-stage state.
Their notification-result field is the sentinel `INT32_MIN`, not a PS5 call
result.

## Artifact identity

Source repository: private `chimera-retroarch`, branch
`codex/ps5-d02-d03-interval-diagnostic`, commit
`0eaf68d6de4dc9757d85cc7ad5c714b1d151c8f8`.

| Local ignored output | Bytes | SHA-256 |
|---|---:|---|
| `build/phase10f/interval-a/retroarch_ps5_interval_diag.elf` | 1,845,152 | `e8bfc01c61bfb14b5814280a6e5442f1a5ad05ace5439d1c09e7e5ee00cd0055` |
| `build/phase10f/interval-a/retroarch_ps5_interval_diag.map` | 637,603 | `638642b750b8d5b108cf6c73215a3f1759bcb6da0b29ee0a0ade5c47e8b7b2d5` |

Two independent `make clean` builds produced byte-identical ELF and map files.
The outputs remain ignored; Git contains hashes only.

## Static audit

- ET_DYN, x86-64, entry `0xff110`, four program headers;
- three PT_LOAD segments with R-E, R-- and RW- permissions; no RWX segment;
- zero-byte preinit/init/fini arrays and no TLS section;
- `.bss` section 697,632 bytes; load zero-fill 697,636 bytes;
- 1,055 relocations: 142 `R_X86_64_GLOB_DAT`, 913 `R_X86_64_RELATIVE`;
- seven DT_NEEDED modules and 142 undefined symbols, exactly matching the
  Phase-1.0E result artifact;
- one `send` relocation; no `socket`, `connect`, `bind`, `listen`, `accept`,
  `recv` or GNM import;
- all fifteen I-stage callsites bind to the two interval wrappers; disassembly
  shows those wrappers call only notification-state access and the existing
  frame emitter;
- linker map binds all objects, the pinned SDL2 archive and SDK startup objects.

Static strings include dormant generic RetroArch features and the SDK CRT
contains `__patch_init`, kernel copy helpers and temporary credential/capability
logic. Claims therefore rely on source selection, linker map, symbols and
disassembly—not string absence. Existing startup effects remain exactly as
classified in Phase 1.0E, so the artifact is not side-effect-free. The linked
write firewall blocks reachable write/create/truncate/rename/delete operations.

## Test result and gate

ASan/UBSan C tests, malformed/range/duplicate checks, 8 Phase-1.0D Python
cases, 14 Phase-1.0E/F parser cases and the structural validator pass. No PS5
connection, request, transfer, receive or execution occurred.

All authorization fields remain false. The artifact is
`execution_eligible=false`, `transfer_eligible=false` and
`installation_eligible=false`. The inactive template in
`docs/approvals/phase-1.0f-device-test-template.md` grants nothing. A later
one-shot test requires a new exact permission explicitly covering result
reception.