chimera-gfx-Public/docs/retroarch/phase-1.0b-persistent-write-audit.md

Phase 1.0B persistent-write audit

Conclusion: persistent device writes are fail-closed in the selected smoke paths; device execution remains unauthorized.

Layers

1. The PS5 frontend blocks config reads, supplies no content/config/SRAM/state path and selects a static no-content core.
2. RetroArch VFS accepts only RETRO_VFS_FILE_ACCESS_READ. Write, truncate, remove, rename and mkdir return failure and trip E118.
3. Link-time wrappers reject write-capable open/openat, non-read-only fopen, non-stdio write/fwrite, and all create, temp, rename, unlink, remove, mkdir, rmdir, chmod, chown and truncate calls.
4. A rejected operation returns EROFS, stores the first operation in memory, requests shutdown once and never retries.

stdout and stderr writes remain allowed because the SDK CRT/RetroArch can already use those process streams. They are not file-output authorization. The ELF imports read-only filesystem primitives (open, fopen, read, fread, stat, directory iteration); the frontend has no content/config path, but normal runtime/module implementation can still use read primitives.

Static reachability result

Final link garbage collection removes wrapper bodies for operations with no remaining caller. Reachable application calls to open, fopen and fwrite resolve to __wrap_open, __wrap_fopen and __wrap_fwrite; their only forward edges are read-only opens or stdout/stderr. The underlying libc imports remain because accepted paths forward to them.

No final import is present for rename, unlink, remove, mkdir, chmod, chown, ftruncate, mkstemp, tmpfile or freopen. Static absence alone is not the safety claim: the VFS guards, wrappers, linker map and disassembly together provide the offline evidence.

Explicit exclusions

The profile disables or provides no route for config save, playlist/history, SRAM, savestate, screenshot, recording, shader cache, autoconfig, remap, database, temporary file, installation and autoload. It contains no device path, IP address, sender, transfer or installation package.

Limit: libc internals invoked inside an imported function are not intercepted by linker wrapping. No application path can supply a writable file stream because writable open modes are blocked, but this remains static reasoning, not observed firmware behavior.