# Phase 1.0M write-free defaults correction

Status: **OFFLINE ARTIFACT AUDITED; DEVICE ACTION BLOCKED**.

The consumed Phase-1.0K trace identified one blocked `MKDIR` before I04, and
Phase 1.0L bound it to the built-in playlist directory creation in
`config_set_defaults()`. Phase 1.0M makes only the corresponding offline source
correction in the separate `chimera-retroarch` fork.

For `CHIMERA_PS5_NO_FILESYSTEM_WRITES`, RetroArch now skips the directory
existence probe and `path_mkdir()` at that source site. It still calculates
`new_path` and all subsequent in-memory playlist paths. The write-diagnostic
profile has `HAVE_CONFIGFILE=0`, so the separate legacy migration block is not
compiled. All 17 `--wrap` write-firewall options remain in the link contract.

## Static callgraph delta

The exact old Phase-1.0J function contained:

```text
0x26845 -> path_is_directory
0x26856 -> path_mkdir
```

In the exact Phase-1.0M ELF, `config_set_defaults` retains six calls to
`fill_pathname_join_special` for this playlist block and contains no call to
`path_is_directory` or `path_mkdir`. The generic `path_mkdir` symbol remains in
the binary, but is no longer reachable from this defaults function. Link-time
garbage collection retains the actually referenced `__wrap_open`,
`__wrap_fopen` and `__wrap_fwrite`; each still enters the common fail-closed
write blocker.

## Reproducible artifact

Two clean builds from RetroArch source commit
`12cf1d783c41eb303987e49a5a920805a59ef7a4` produced identical outputs:

| Evidence | Size | SHA-256 |
|---|---:|---|
| `retroarch_ps5_write_diag.elf` | 1,845,208 | `c99a0856309a357ad2667d89b4924e4063ad214cae09c8a419457b0732f583cd` |
| linker map | 637,728 | `6768ffc7267b9b362c3b953571e5dfeed1e70004a3e19f41ef500c3f26272719` |
| normalized disassembly | n/a | `141a620484784e5e01ec0cb2a51f77b67712bc484aae6de0f139ba1e28922c87` |

The ELF remains ET_DYN, entry `0xff220`, with `R-X`, `R--` and `RW-` LOAD
segments and no RWX LOAD segment. Init/fini arrays are empty, TLS is absent and
BSS is 697,632 bytes. It has 142 undefined dynamic symbols, seven DT_NEEDED
modules and 1,055 relocations (142 GLOB_DAT, 913 RELATIVE). `send` is the only
network primitive; socket creation, connect, listener, receive and GNM imports
are absent.

The artifact, map and audit JSON remain ignored local evidence and are not
committed. The SDK v0.41 CRT effects remain inherited under ADR-0010. Static
acceptance by the hardened-loader model is not runtime proof.

All current authorization fields are false. This new artifact is
`execution_eligible=false`, `transfer_eligible=false` and
`installation_eligible=false`. No PS5 connection, request, transfer, result
reception, execution, device write, retry or reconnect occurred in Phase 1.0M.

The Chimera GFX whole-tree secrets scan passed. The sibling RetroArch
changed-file scan found zero matches; its whole-tree scan separately flags
pre-existing upstream BearSSL/mbedTLS sample-key fixtures, so no whole-tree
RetroArch PASS is claimed.