# Phase 1.0L write-firewall result analysis

Status: **ONE-SHOT AUTHORIZATION CONSUMED; FIRST WRITE IS MKDIR**.

The exact ignored Phase-1.0J artifact ran once on firmware 9.60 through the
manifest-gated Phase-1.0K runner. The host received a valid terminal trace
with no parser error, retry or reconnect:

```text
D00 D01 D02(0) I00 I01 I02 I03 D13(6,1) D12(6,118)
```

`D13` is source-defined as `(first_blocked_write, write_block_count)`. Enum
value 6 is `CHIMERA_SMOKE_WRITE_MKDIR`; the count was one. `D12` records
shutdown reason 6 (`WRITE_FIREWALL`) and first error 118
(`E118_WRITE_BLOCKED`). The J guard observed shutdown and returned before I04,
so this run did not enter SDL, VideoOut or rendering.

## Bounded cause

The exact source, map, disassembly and relocation evidence agree on this
bounded call chain:

```text
I03
  -> retroarch_parse_input_and_config()
  -> config_load()
  -> config_set_defaults()
  -> built-in playlist default-directory check
  -> path_mkdir()
  -> path_mkdir_cb
  -> mkdir write-firewall wrapper
  -> chimera_ps5_smoke_block_write(MKDIR)
```

The source site is `configuration.c:3357` at artifact source commit
`2e385265ab893dbba5898178dde5e108d3dbfa19`. The ELF map binds
`config_set_defaults=0x22ba0`, `path_mkdir=0x188f0` and
`chimera_ps5_smoke_block_write=0x466d0`. Disassembly contains the conditional
`path_mkdir` call at `0x26856`. The `path_mkdir_cb` relocation at `0x17c280`
resolves to the wrapper at `0x15ae0`, which passes operation value 6.

The runtime pathname was not included in D13 and is therefore **UNOBSERVED**.
This evidence proves the operation category and compiled source route, not an
on-device path identity or successful filesystem mutation. The firewall
returned failure; no project filesystem write is evidenced.
Normal SDK CRT effects remain inherited under ADR-0010, so the run is not
classified as globally side-effect-free.

## Next offline boundary

A later artifact phase may make one scoped source correction: when
`CHIMERA_PS5_NO_FILESYSTEM_WRITES` is defined, skip the built-in playlist
directory creation in `config_set_defaults` while preserving all in-memory
path derivation and every write wrapper. It must then rebuild twice, re-audit
the complete artifact and remain ineligible. It must not weaken the firewall,
permit a real mkdir, infer a device path, or inherit this consumed authority.

The historical H flip result remains separate. This K run intentionally never
reached the dormant J D07 errno instrumentation, so flip errno, successful
presentation and cleanup remain unproven.

All current authorization and eligibility values are false. There is no
connection, transfer, execution, result-receive, retry or reconnect authority.