# Phase 1.0D early RetroArch diagnostic

`retroarch_ps5_early_diag.elf` is compile-time profile
`PS5_PROFILE=early-diag` with `CHIMERA_PS5_EARLY_DIAG=1`. It retains the real
RetroArch frontend, static chimera_smokecore, write firewall, bounded runtime,
W^X layout, reverse cleanup, no network, no content/configuration, no dynamic
core, no retry, no autoload, and `_Exit`.

## Diagnostic ladder

The fixed D00-D12 ladder covers RetroArch main, platform begin/result, SDL
begin/result, VideoOut open, buffers, first flip, Pad, AudioOut, core init,
runloop, and shutdown. Each stage owns one bit in an in-memory attempted mask,
so a notification is attempted at most once. Notification failure is recorded
as a raw error and never blocks the primary path. Text is built in a fixed
192-byte buffer; truncation is counted and no dynamic formatting allocation is
used. Login users are represented only by count and numeric IDs.

`sceVideoOutSetBufferAttribute2` is `void` in the pinned SDL source. The
diagnostic stores `CHIMERA_PS5_DIAG_NO_RETURN_VALUE`; it does not fabricate a
success return. Consequently that exact boundary cannot receive a return-code
failure injection. Every representable boundary is injected by the host test.

## Earliest frame

After VideoOut open, direct-memory allocation/mapping, equeue/event setup, and
buffer registration—but before input, audio, core, and runloop—the SDL overlay
writes a full magenta frame, a fixed white rectangle, and an embedded black
pattern. It submits frame ID 0 once and waits once for at most 100,000
microseconds. A failed first flip records D07 and enters bounded teardown; it
does not retry or initialize another buffer chain.

Source callsites are `retroarch.c:6201` for D00 and the
`PS5_PresentEarlyDiagnosticFrame` hunk in
`pkg/ps5/sdl2-ps5-early-diag.patch` for the magenta frame. Disassembly binds
D00 at `main+0xd` (`0x3ccd`), the diagnostic frame helper at `0xfdf90`, its
first-flip call at `0xfe1ec`, the common notification call at `0x4776b`, and
`_Exit` at `0x3cef`.

## Host fault model

ASan/UBSan host tests cover notification failure, truncation and duplicate
suppression; user-service failure and no-login-user; VideoOut open; direct
allocation/map; registration; equeue/event; first flip; Pad; AudioOut; core;
deadline; every cleanup boundary; the write firewall; stable D-code; and
exactly one selected `_Exit` path. No test result is hardware evidence.

Two clean target builds are byte-identical at 1,844,664 bytes and SHA-256
`092bcabc0f8717a648030c592aa0dc900f878952fb14ee453851a29f298ea7ee`.
Their map hash is
`0d4d4614826fa4cbbf11e7374a2d2ecb574a00b55ad9deac17272f9504b254a0`.
The artifact is `execution_eligible=false`.