# Phase 1.0EA: expanded launch evidence and cleanup audit

Status: `NEW_FW960_LNC_CANDIDATE_FOUND_ABI_AND_CLEANUP_GATES_STILL_BLOCKED`

This phase is a bounded public-source and offline source-history audit. It
creates no target source or artifact and performs no PS5 operation.

## Newly reviewed candidate

The public `phantomptr/ps5upload` repository was bound at commit
`978add1864eb54351eaddbd242634282ef3cd120`. Its current ShellUI RPC source is
Git blob `b30d17bd0068affd5b4d42550953bc6bd44203f7`; its ptrace implementation is
blob `6b68f26995f746df5b2b0b9fd1495432304e8f35`.

Commit `e3875ffba7cb08e017dcdb537d045af3fddc133d` first introduced the reviewed
route and states that game launch through `sceLncUtilLaunchApp` worked on
firmware 9.60. The implementation constructs a packed 24-byte local parameter
with size, user ID, options, crash-report and check fields, then remotely calls
the export from `SceShellUI`. This is useful independent implementation and
operator-report evidence for a different launch API. It is not independent ABI
provenance: the introducing commit supplies no public specification, header,
binary-derived layout proof or second implementation lineage for that
parameter layout. Exact-name searches for the layout fields produced no other
qualifying public source.

The route also does not satisfy the Chimera end state. It starts a registered
title; it does not bind or replace that title's process with the exact embedded
RetroArch ELF. The previously reviewed shsrv replacement lineage would still
be required for that second operation, so finding the LNC launch candidate does
not remove the replacement ABI or composition gates.

## Cleanup findings

The candidate cannot be imported as a bounded lifecycle implementation:

- attach, remote-call and single-step paths use blocking `waitpid` without an
  absolute deadline;
- launch cleanup discards `pt_munmap` and `pt_detach` results;
- the tracked-attached flag is cleared even when detach fails;
- a dispatched call with unreadable completion is promoted to soft success;
- register restoration and authid restoration include best-effort failures;
- an authid restore failure is logged and execution continues with elevated
  process state until a later operation might repair it;
- its retry/fallback semantics exceed the Chimera one-shot contract.

These are source facts about the candidate, not claims about an observed PS5
failure. The existing Chimera host ownership models remain useful, but no
source-bound target composition currently replaces these failure behaviors
with absolute deadlines, verified restoration and terminal ownership.

## Decision and next step

The direct embedded route selected by DZ remains the minimum architecture, but
target source and build remain blocked. The next gate requires either an
independent public specification or two demonstrably independent,
firmware-applicable implementations that agree on the complete launch and
replacement ABI, followed by a target-source composition whose every blocking
wait, mapping, register, credential, attach and detach edge has a deadline and
verified cleanup result. Console permission is not yet actionable.