chimera-gfx-Public/SAFETY.md

Safety and threat model

Non-negotiable boundary

This project uses only userland behavior and public, open-source information. It excludes kernel and hypervisor code, exploit development, DRM bypass, proprietary SDK material, leaked or decrypted headers/binaries, direct MMIO or register writes, clock/SMU/fan control, boost settings, and firmware patches.

No payload or ELF may be transferred to or executed on a PS5 without explicit approval from Jens in the active task. There is no boot-time or automatic execution path.

Documented temporary process/kernel runtime changes made by the exact public loader or SDK may be classified as expected volatile, restored by the loader, or payload-process-local. They are not automatically unsafe. Persistent writes and unbounded or unknown effects remain hard blockers.

Assets and adversaries

Protected assets include the console's stability, display availability, user data, network credentials, private repository credentials, and the accuracy of the project's compatibility claims.

Relevant failure or threat sources:

• an incorrect guessed ABI that corrupts stack or memory;
• a command submission that hangs the GPU or display path;
• unbounded waits or incomplete cleanup after partial initialization;
• symbol presence being mistaken for compatible semantics;
• firmware drift;
• malicious or compromised upstream artifacts;
• secrets entering logs, manifests, commits, or remote URLs;
• a build or CI target silently becoming a deployment path.

Phase-0 controls

Risk	Control	Verification
ABI guess is called	No GNM declarations or calls; symbol addresses never escape	phase0_safety_audit test
GPU work is submitted	No submit/draw/dispatch/flip call sites	source allowlist audit
GPU memory changes	No GPU allocator, mapper, resource registration, or command buffer	source and build-graph audit
Probe runs accidentally	target disabled by default; runtime acknowledgement; firmware gate	CMake tests and code review
Unknown firmware runs	default is NONE; discovery build accepts only exact 9.60	unit test, CMake gate, compatibility file
Automatic deployment	no deploy/test/run target; output is compile artifact only	CMake audit
Supply-chain substitution	immutable upstream commit and release SHA-256	lock manifest and bootstrap script
Secret disclosure	secret filename ignores, no credential scripts, boolean-only logs	repository scan before push
Adapter accidentally claims hardware	compiled queries report unavailable and reject hardware requests	adapter tests
Resource lifecycle leaks	context refuses destruction while child handles exist	mock integration tests
Phase-1 target enters normal build	separate option defaults off and requires PS5 plus explicit SDL path	configure and source audit
Pre-gate SDL side effect	candidate does not link SDL2main; gate precedes SDL_Init	source-order audit and ELF imports
SDK CRT changes kernel state before main	classify exact effects; permanent legacy artifact remains blocked	pinned-source runtime audits and ADR-0010

Probe side-effect statement

After its firmware gate, project code requests only system module loading, symbol lookup, boolean logging, and module unloading. It does not request a GNM operation. The pinned SDK source proves that dlopen can call sceKernelLoadStartModule and that dlclose can call sceKernelStopUnloadModule; module start/stop internals remain unknown.

More importantly, SDK v0.41's payload CRT runs before main. Its startup calls __patch_init, which writes process credential capability/attribute fields and syscall-address limits through the SDK's kernel read/write primitives. The CRT also sets libc __isthreaded, initializes syscall/kernel/log/rtld state, may load libSceSysmodule.sprx, allocates loader bookkeeping, relocates the payload, and runs constructors. Normal termination runs payload destructors; project dlclose requests module stop/unload only when this open loaded it. There is no guaranteed cleanup after a hang, crash, partial load, or failed stop/unload.

Therefore no GPU mutation or rendering operation is requested by project code. The existing ELF remains permanently ineligible by artifact-specific denylist, independently of the corrected Phase-0.6 classification model.

The firmware-9.60 capability artifact with SHA-256 4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63 is permanently blocked in manifests/artifact-denylist.json. Its manifest states execution_eligible=false, and all new manifests default to the same false value. tools/check_artifact_execution_policy.py must be the first static gate used by repository tooling and Payload Manager integrations: missing or false eligibility, malformed input, changed bytes, or a denylist match returns DENY. A pass is not execution authorization.

Phase-0.5 startup result

The stock v0.41 CRT is UNSAFE. Omitting it is mechanically possible, but the loader caller and its return, cleanup, crash, and pre-entry behavior are UNPROVEN. No minimal startup source or ELF exists, and the corresponding CMake option fails closed. See docs/runtime/ and manifests/runtime/phase-0.5-startup-audit.json.

Phase-0.6 historical lifecycle result

The installed Payload Manager v0.3.1 and elfldr v0.23 are exact public-release matches. Temporary QA flag, credential, ptrace, mapping, and SDK startup effects are classified individually. The lifecycle still fails closed because it has PERSISTENT_WRITE and UNBOUNDED_OR_UNKNOWN effects: unbounded ptrace loops, no detached-child watchdog, unresolved return/reaping/cleanup, incomplete credential restoration, no launch-time hash check, and a manager upload path that writes /data/pldmgr/payloads.

That result remains immutable evidence for the unmodified public-release chain. It is not the current runtime profile.

Phase-0.7 offline deployment-readiness result

The hardened elfldr and controlled Payload Manager close the Phase-0.6 implementation blockers with bounded ptrace steps, complete checked credential restoration, centralized cleanup, a two-second kill/reap watchdog, exact same-file-descriptor hashing, and receiver-side digest/denylist enforcement. The lifecycle ELF is a normal SDK v0.41 payload that sends one notification and calls _exit.

The current controlled-ps5-runtime profile binds exact firmware 9.60, SDK, source commits, hashes, sizes, expected effects, a removable controlled artifact-directory write budget, no payload network, 2000 ms maximum runtime, and no retry. It is READY_FOR_HARDENED_RUNTIME_DEPLOYMENT only: installed=false, execution_authorized=false, transferred=false, and executed=false.

No PS5 connection, transfer, installation, or execution was used to reach this decision. Hardware behavior remains unproven. The normal CRT __patch_init path is process-local but means the lifecycle is not a kernelwrite-free artifact. The old blocked hash remains permanently denied. See docs/runtime/phase-0.7-hardening.md and manifests/runtime/phase-0.7-offline-audit.json.

Phase-0.8 read-only preflight result

The offline collector-admissibility review is READ_ONLY_PREFLIGHT_BLOCKED. The exact Payload Manager v0.3.1 HTTP handler sets an in-process active flag for every non-OPTIONS request. /autoload_status additionally sets autoload_triggered and reads the autoload configuration. Direct filesystem collection has no pinned collector or proof excluding atime, audit-log, cache, metadata, service-state, or on-device-log changes.

No on-device session was started and no PS5 connection was made. Current firmware, live object identities, listeners, startup state, and rollback backups remain unobserved. The exact stock Payload Manager backup is therefore a hard open gate. Installation, lifecycle, execution, and automatic retry remain unauthorized. See docs/runtime/phase-0.8-read-only-preflight.md and manifests/runtime/phase-0.8-read-only-preflight.json.

Phase-0.9A anti-brick design result

The offline anti-brick layer is DESIGN_ONLY. It models exact pre-image identity, separate reopened backup, inactive staging, quiescence, an atomic switch, post-switch verification and separately authorized rollback. No such PS5 switch or recovery primitive is claimed. All fourteen interruption boundaries remain UNPROVEN, so the design is not installation-suitable.

The host simulator performs only in-memory logical writes and cannot connect, transfer, install, execute, open a target artifact or start a compiler. Its synthetic atomic primitive is fault-test scaffolding, not hardware evidence. The byte-exact on-device Payload Manager backup and recovery independent of both elfldr and Payload Manager remain catastrophic hard gates. No authorization is granted and automatic retry remains false.

Phase-0.9B observer feasibility result

The offline result is BLOCKED. Normal SDK v0.41 startup is not kernelwrite-free because _start() reaches __patch_init() before main. Omitting the CRT is mechanically possible, but safe custom entry, return/exit, crash handling and loader cleanup remain UNPROVEN.

The hash-bound hardened elfldr route deliberately gives the payload no stdout/stderr socket, and the controlled Payload Manager transport does not receive payload output. Notifications, klog and stock manager HTTP are not a proven bounded non-persistent result channel. No observer source, target, ELF, linker map or package was created. All device authorizations remain false, and no PS5 action occurred. See docs/runtime/phase-0.9b-observer-static-audit.md.

Phase-0.9C execution-feasibility result

The offline classification is BLOCKED_MULTIPLE_FOUNDATIONAL_CONTRACTS. Source review proves that a normal SDK entry is side-effecting before main; a freestanding entry has no closed stack/BSS/relocation/TLS, read, monotonic-time, return, exit, or cleanup contract. A normal ret resumes an unproven SceSpZeroConf continuation, and a watchdog kill is not accepted as safe exit.

The 4096-byte D1 result format passes deterministic host tests, but no current caller-owned target buffer, copy-out, cleanup finalizer, or manager delivery exists. Firmware source two is absent; an SDK export name alone is not an ABI. Filesystem and platform reads may still affect metadata, atime, audit, caches, counters, service/security state, open bookkeeping, accounting, object lifetime, or races. No target source, ELF, map or package was built, and no PS5 action or authorization occurred. See docs/runtime/phase-0.9c-static-audit.md.

Phase-0.9D existing-stack readback result

The offline decision is BLOCKED_NO_READBACK_PATH. The full and controlled Payload Manager profiles contain uploads, installs, deletes, launch-time file reads, directory/configuration observations, and process actions, but no binary-safe file-download response. Hardened elfldr returns fixed status text; its controlled manager transport sends and closes without receiving component bytes.

The full-profile server_active_flag is process-local and only suppresses a fallback notification in audited source. It is LOW_VOLATILE, but has no in-process reset and must be explicitly accepted in any future permission. /autoload_status is excluded because it sets autoload_triggered and can alter worker timing. No PS5 was contacted, no file was transferred, and no target, observer, client, backup, package, staging action, or authorization was created. See docs/runtime/phase-0.9d-readback-feasibility.md.

Phase-0.9E bootstrap provenance gate

The exact external exploit/host and rudimentary port-9020 listener must be available and provenance-bound before they can be considered an independent rescue executor. A matching filename, an opaque console backup, a public upstream, a generic sender command, or a conceptual dependency graph is not enough. Unknown filesystem staging or autoload effects are brick-relevant and remain hard stops.

No Phase-0.9F target design is authorized while the receive, mapping, entrypoint, live-file, output, cleanup, crash, and reboot contracts are missing. Phase 0.9E permits only local hashing, source/binary inspection, schemas, manifests, and host-only policy tests. It permits no network socket, device client, transfer, target build, payload, install, execution, autoload, retry, or recovery action.

Phase 0.9E-R permits only bounded official Gezine/Y2JB GitHub acquisition and private-origin push. Official metadata excludes every current release asset from matching the local backup, and official source contains no port-9020 listener implementation. The ignored official source tree is inspection-only; downloaded code was not executed. No outer association may be promoted to opaque inner provenance, and neither an operator attestation nor host tests are runtime evidence. All device, build, transfer, execution, installation, lifecycle, autoload, write, and retry authorizations remain false.

Phase 0.9E-R2 permits only host-side hashing, bounded browser metadata copies, the exact MediaFire object page, one mandatory official backup, and source-motivated community assets. Downloaded archives are static evidence: never execute or restore them, never track them, and remove temporary copies. The SIECAF parser is read-only and may inspect only public fixed-width structural metadata; it may not decrypt, guess keys, extract, write, or invoke ps5-bar-tool. MediaFire metadata, structural similarity, and an inner match would each remain non-runtime evidence. The actual result is LOCAL_BACKUP_UNCORRELATED, so Phase 0.9F and every authorization remain blocked.

Phase-1.0E inherited result boundary

Prior RUN A and RUN B permissions were artifact-specific and consumed. RUN A visibly reached C1; RUN B produced an unreadable notification and no exact D-stage may be inferred. Phase 1.0E may record those observations and build a new execution-ineligible diagnostic candidate offline. Its later exact one-shot authorization was consumed on 2026-07-22.

The only added target operation is one nonblocking send attempt per reached D-stage through stdout inherited from hardened elfldr's legacy raw-ELF connection. It may not open a target socket, connect, listen, read requests, retry, write the device filesystem, install or activate autoload. The host may model one connect/send/write-half-close/bounded receive with fake sockets, but no real device use occurs without new exact artifact-specific permission that also names result reception. EOF, timeout, partial frames and send failure are terminal, never retry triggers. The normal SDK CRT effects remain explicit; this result channel is not side-effect-free. RUN C used the permitted single connection and validated D00-D02 before remote EOF. It did not retry or reconnect. D03, SDL, VideoOut, rendering, terminal status and cleanup remain unproven. All authorization fields and artifact eligibility are now false.

Phase-1.0F startup interval boundary

Phase 1.0F may prepare an exact artifact offline to place I00-I14 checkpoints inside the source interval after D02 and through entry to D03. These checkpoints may only reuse the existing nonblocking, signal-suppressed inherited stdout send. They do not send notifications and may not add a socket, connect, listener, receive path, address, port, filesystem write, install, autoload, retry or reconnect.

The distinct CHD10F01 parser remains offline-only: the live CLI is not activated for it and must continue to reject the ineligible manifest. Normal SDK CRT patch effects and the existing SDL/VideoOut imports remain explicit; the artifact is not side-effect-free and static success is not hardware evidence. No prior authorization carries forward. Device connection, transfer, result reception and execution each require a new exact permission.

Phase-1.0G one-shot runner boundary

Phase 1.0G may prepare and host-test a manifest-driven runner, but its tracked manifest and approval template remain inactive. The interval protocol cannot be selected through a free command-line switch. Activation requires both an exact active manifest and a separate untracked local approval whose artifact, firmware, target, protocol, limits and unique run identifier agree.

The runner must rehash the actual artifact before transport and exclusively create and fsync a consumed-attempt receipt before opening a socket. This fail-closed receipt prevents a host crash from silently making the same permission reusable. Retry, reconnect, resume and trace overwrite remain forbidden. The current repository contains no active target, run identifier or authorization; no device action is allowed by Phase 1.0G itself.

The later exact Phase-1.0G authorization was consumed by one attempt. Valid frames ended at I03 and ordinary stdout proved the deliberate no-argument, no-menu help/exit path before I04. There was no retry or reconnect. This result does not authorize another action and does not prove SDL, VideoOut, rendering or terminal cleanup.

Phase-1.0H startup-argument boundary

Phase 1.0H may correct only the proven !HAVE_MENU && argc == 1 exit. The reviewed profile adds RetroArch's existing verbose flag, generating -v, and must retain null content/config/core paths, static contentless core, write firewall, bounded runtime and the inherited one-send-per-stage stream. It must allow H only through an exact active manifest plus separate matching local approval, never a free protocol switch. No target, run ID, retry, reconnect, installation, autoload or device-write authority may be tracked by default.

The exact H artifact is offline evidence only. It remains transfer-, execution- and installation-ineligible, and all authorizations are false. Phase-1.0G authority was consumed and cannot authorize H. A later action requires a new exact artifact-specific permission; static success does not prove I04, SDL, VideoOut, rendering, terminal status or cleanup.

The later exact Phase-1.0H authorization was consumed once. Its trace reached I04, SDL2 video, VideoOut open and buffer registration, then the first flip submit returned -1 and SDL init returned -1. The diagnostic pattern was copied into mapped display memory before the failed submit. D12 also records a write-firewall rejection during configuration parsing; the exact requested operation is unobserved. No retry is authorized. Do not infer a visible frame, runloop entry, complete cleanup or safe exit.

Phase-1.0I offline postmortem boundary

Phase 1.0I may inspect only the consumed H trace, exact source, ignored local artifact/map and disassembly. It proves the submitted tuple (handle, 0, 1, 0) and narrows E118 to linked OPEN or STREAM wrappers. It does not know the exact blocked operation, original submit errno, VideoOut argument semantics or root cause. The diagnostic/normal frame-zero/frame-one mismatch is a source candidate only.

No target build, artifact, device client, connection, transfer, execution, result reception or retry belongs to Phase 1.0I. A later offline design must capture errno before reporting, transmit the exact write operation and stop before I04 on a firewall shutdown. Selecting a different frame ID requires a new ADR, new artifact audit and separate future authorization.

Phase-1.0O consumed write-free result

The exact M artifact was transferred and executed once. The exclusive receipt was created before the only connection; there was one send, zero retries and zero reconnects. No installation, autoload, persistent staging or device filesystem write occurred. The diagnostic pattern did mutate mapped display memory and one VideoOut flip submit was attempted, as bounded by the approval.

The run passed I04 with no D13, then reproduced the first flip-submit failure. D07 reports -1 and saved errno 0; E104 is the overlay's generic framebuffer_fail label after that failure, not proof of an allocation fault. The subsequent D04 after terminal-flagged D12 prevents a successful terminal classification. Do not infer visible output, event-wait behavior, complete cleanup or safe exit. The authorization is consumed and no action carries.

Phase-1.0P offline VideoOut analysis

Phase 1.0P performs source, map, relocation and disassembly inspection only. It proves the consumed artifact called sceVideoOutSubmitFlip(handle,0,1,0) and received -1 with saved errno 0. It does not prove the semantic ABI, opaque buffer contract, flip ownership, visible presentation or cleanup.

An exported symbol name is not permission to call a status or flip-master function. No argument experiment, target build, parser relaxation or device action is permitted by this analysis. The D12-before-D04 order is source-deterministic, and D12 remains a shutdown request rather than proof of lifecycle completion.

Phase-1.0Q public evidence boundary

The bounded official-source inventory found no independent PS5 VideoOut ABI. SDK v0.41 provides export names only; the PS5 declarations and opaque records originate together in one SDL lineage, and relevant official ports consume that same fork. OpenOrbis defines only the analogous PS4 contract.

Do not promote source repetition, a successful registration return, a PS4 constant or an exported status/flip-master name into PS5 semantic proof. No submit parameter, buffer layout, ownership state or error interpretation may change from Phase 1.0Q, and no target or device action is authorized.

Phase-1.0R launch-context boundary

The exact PS5 SDL2main adds no application ID, title identity, LNC setup, VideoOut ownership or process creation. Its LoadExec("exit") occurs only after SDL_main returns, and the tested RetroArch path already performs SDL's splash-hide call before VideoOut open. Direct and Payload Manager raw-ELF routes use the same hardened elfldr process constructor.

Do not treat PacBrew packaging, homebrew.js path/argument descriptors, LakeSnes documentation, or the non-unique LNC log as proof of a different working display context. The exact hbldr/shsrv launcher and runtime active-app state are unbound. Keep NO_SOURCE_PROVEN_LAUNCH_CONTEXT_FIX_TARGET_CHANGE_BLOCKED: no SDL2main, LNC/SystemService, submit, VideoOut, target-build, transfer or execution change is authorized.

Phase-1.0S hbldr/shsrv boundary

Official source proves that hbldr is materially different from raw elfldr: it launches a BigApp through SystemService and replaces the resulting process with a device-resident ELF. This is source evidence for a launch-context difference, not proof of VideoOut permission, visible output, safe cleanup or firmware-9.60 behavior. The exact deployed shsrv identity is unknown.

Never invoke or copy the existing route under this gate. It may kill the running BigApp, performs kernel/ptrace process changes, lacks a hard deadline, requires prior target staging, and current versions may remount /system_ex and create persistent FAKE00000 content without an atomic write, rollback or power-loss protocol. Keep BIGAPP_CONTEXT_SOURCE_PROVEN_DEPLOYED_IDENTITY_UNPROVEN_DEVICE_PATH_BLOCKED. No port-2323 connection, shsrv request/deployment, hbldr command, target build, device file, app termination, remount, transfer or execution is authorized.

Phase-1.0T inactive shsrv identity boundary

The current shsrv source spawns a shell for every accepted connection and its greeting automatically queries and transmits model, serial number, firmware, temperatures and CPU frequency. Therefore a nominally read-only help request is not side-effect-free and risks disclosing a device identifier. Phase 1.0T contains no connector and authorizes no connection.

The offline parser must receive an already supplied transcript on stdin. It must never persist raw input, serial, model or telemetry, and may retain file metadata only for an independently supplied literal absolute path. help identifies at most a source family; stat is metadata only; sum is a weak 16-bit rotating checksum and may cause atime/cache/accounting effects. None can prove an exact binary. Wildcards, path discovery, content commands, hbldr, launch, writes, signals, mounts, retry and reconnect remain forbidden. All future windows are DESIGNED_NOT_ACTIVE and require separate exact review.

Phase-1.0U bounded local inventory

Phase 1.0U found no deployed shsrv candidate within the declared Chimera, attachment, known-download and ZIP-entry-name scope. This is not a global host or device absence claim. The official source checkout, host telnet wrapper and PacBrew recipe remain non-deployed references and must never be substituted for exact installed bytes. No discovered script or binary was executed.

The inventory grants no connection, shell command, target build, transfer, execution, installation, write, retry or launch-context experiment. Only the next offline inactive collector-design phase may proceed. A future live collector remains blocked behind a new exact approval and the Phase-1.0T serial/telemetry side-effect acceptance.

Phase-1.0V inactive collector-model boundary

Phase 1.0V is an offline stdin model with no network transport. It bounds raw and sanitized input to 65,536 bytes, permits at most 256 chunks, rejects incomplete Telnet controls and invalid UTF-8, and seals after one result. It retains only the Phase-1.0T sanitized record. The internal bytearray is cleared, but physical memory erasure is not proven.

The tracked activation and approval remain empty and false. Do not add an address, port, command, socket, connect/send path, automatic reply, persistent raw transcript, retry, reconnect, resume or fallback under this phase. Host model success is not device, prompt, cleanup or deployed-identity evidence.

Phase-1.0W reviewed inactive client architecture

Self-review remediates doubled-IAC state, empty-chunk accounting, path allowlisting, firmware/compile metadata validation and numeric-parser error normalization. Physical memory erasure remains unproven. The new policy accepts only synthetic dual records and returns a frozen data plan; the fake transport has no network primitives.

Keep the tracked activation and approval empty. Port 2323, one connection, ten-second deadline and T2/T3 command tokens are future constraints, not authority. A consumed receipt, exclusive sanitized output, monotonic deadline, network transport, Telnet reply/prompt contract and deterministic close remain missing. Do not connect, render shell lines or issue a request under this phase.

Phase-1.0X inactive injected transport

The X orchestrator accepts only an already validated immutable session plan, an injected adapter, an injected monotonic clock and a caller-owned host evidence directory. Repository tests supply only fake adapters. The consumed receipt is exclusively created and file-flushed before adapter open. Output is sanitized, exclusively created and bound to the reopened receipt hash. There is no overwrite, delete, raw-transcript persistence, target persistence, retry or second open.

Do not interpret file fsync as directory-entry durability. A partial file is invalid and deliberately not cleaned up; the run remains consumed. Deadline checks surround adapter boundaries but cannot preempt a blocking real adapter. Exact prompt and Telnet framing, OS socket timeouts, live close behavior and deployed shsrv identity remain blockers. No real adapter, address, port, connection, request or authority may be added under X.

Phase-1.0Y offline shsrv framing

The Y model accepts synthetic bytes only. It distinguishes raw v0.7-v0.8 from libtelnet/NVT v0.9-v0.19, never opens a transport and never formats a command. Neither audited family proactively negotiates or server-echoes input. Current source rejects unsupported WILL/DO; legacy source passes Telnet controls into the shell. Future Chimera input must therefore emit no IAC commands.

A terminal $ is not a live completion proof. PWD is not forcibly overwritten, the external Telnet client's local echo is undefined, wire chunks are arbitrary, and current pipe/socket handlers do not complete short writes. The server also has no bounded session deadline. Preserve deadline-based partial-result rejection, keep all authority false, and do not add a real network adapter under Y.

Phase-1.0Z offline passive batch

The Z contract produces one target-free ASCII/LF byte batch from a validated W plan. It permits only help, or ordered stat and sum for one normalized literal path. NUL, CR, IAC and shell separators cannot enter the batch. It has no CLI, address, transport, clock or file output and authorizes no device use.

Incoming IAC fails closed; the model never sends a Telnet reply. Prompt text and remote EOF are not completion boundaries. Only an explicit synthetic hard-deadline event can seal, and incomplete help/stat/sum output remains invalid. This does not prove live timeout preemption. A future T3 read may still cause atime, cache, accounting and scheduler effects, while the automatic sensitive greeting and shell/connection state require explicit acceptance. Keep all authority false and add no real adapter under Z.

Phase-1.0AA offline fake-adapter integration

AA accepts only exact built-in fake adapter, fake clock and fake evidence-store types. Subclasses and arbitrary injected implementations are rejected, so the module cannot be repurposed as a live transport boundary. It creates an exclusive consumed receipt before fake open, permits one complete Z batch, seals only at a valid synthetic hard deadline and closes exactly once.

EOF, blocked receive, early or missing deadline, data at/after deadline, IAC, partial output and evidence collisions are failures. A receipt remains after a failed fake attempt; no cleanup deletes it. Logical event-buffer clearing does not prove physical erasure. Host fsync does not prove directory-entry durability, and the synthetic clock cannot prove OS preemption. Keep every authorization false and do not add a network adapter or device action under AA.

Phase-1.0AB offline live-adapter feasibility

AB binds the local Python 3.13.2 Windows socket/select implementation but adds no network import or adapter. Its trace model accepts synthetic operations only and requires receipt-before-creation, nonblocking-before-connect, readiness and SO_ERROR, positive bounded send/receive progress, deadline-only sealing, sanitization, local close and then output.

Selector timeout is a maximum requested wait, not proof that host scheduling cannot overshoot. Local close is not proof of remote shsrv/process cleanup. Numeric-address parsing and the exact accepted Windows pending-connect error set still require implementation review. Keep live implementation, socket creation, DNS, target retention, connection and request as hard stops under AB.

Phase-1.0AC offline dormant-adapter boundary

AC executes only against the exact built-in fake syscall facade and fake clock. A precommitted receipt marker must precede synthetic creation; nonblocking setup precedes synthetic connect; partial progress is explicit; EOF, zero progress and data at the deadline fail. One fake local close is attempted after every successfully opened path. Unused fake events are logically discarded, which does not prove physical erasure or remote cleanup.

The module has no live adapter protocol, socket/selector import, DNS, address, CLI, real clock or file output. All authorization remains false. AC permits only a later offline inactive numeric-target/activation design; it does not permit a transport implementation, connection, request or device action.

Controls required before Phase 1

Phase 1 cannot begin until all of the following are recorded in a new ADR:

1. explicit hardware-test approval;
2. an allowlisted firmware and reproducible console identification method;
3. proven function signatures and data layouts from acceptable public sources;
4. a bounded timeout and operator recovery plan;
5. independently reviewed cleanup and crash-log paths;
6. a one-step-at-a-time test case with an SDL software/VideoOut fallback;
7. an explicit statement of exactly which buffer or GPU state may mutate.

Approval for one test does not authorize later tests.

Timeout, watchdog, cleanup, and logs

The Phase-0 loop is statically bounded by the 21-entry manifest and always attempts module cleanup after lookup begins. Dynamic-loader calls do not expose a documented cancellation API, so an in-process forced timeout would risk leaking loader state. The default NONE gate blocks the project-requested module open. The 9.60 build gate does not remove the SDK CRT blocker and grants no execution authority.

Before any approved hardware observation, a separate supervisor design must define a wall-clock deadline, progress events, operator-visible failure state, and a recovery action that does not kill a thread while it owns loader or GPU state. The probe already emits deterministic JSON-line stage events suitable for a redacted crash/timeout log; it never emits addresses. Later GPU phases must add explicit per-operation deadlines and prove cleanup for each partially completed state transition.

Disabled Phase-1 candidate

The candidate source contains one SDL window-surface update, but it is outside every default target and automated test. Its default NONE build exits before SDL initialization. Project code contains no direct VideoOut or GNM prototype. The pinned SDL backend's flip-event wait has no proven finite timeout; this is recorded as a hardware blocker rather than hidden behind a forced thread kill. See docs/phase1/HARDWARE_TEST_PLAN.md.

Incident rule

On an unexpected return code, missing cleanup confirmation, display anomaly, hang, reset, or firmware mismatch: stop, preserve non-sensitive logs, mark the compatibility entry as failed or unknown, and do not retry automatically.