chimera-gfx-Public/docs/retroarch/phase-1.0dz-direct-launcher-decision.md

Phase 1.0DZ: direct-launcher decision

Status: TITLE_PRESENT_DIRECT_ROUTE_SELECTED_TARGET_BUILD_BLOCKED

This offline consolidation incorporates the consumed Phase 1.0DO through DY observations and the official websrv v0.33 source audit. It performs no PS5 operation and creates no target source or artifact.

The firmware-9.60 snapshot proves an installed appinfo record for FAKE00000. The operator also launched the Homebrew Launcher far enough to observe its local-page error. These facts close only the title-presence and operator-observed browser-reachability premise. They do not prove launch ABI, VideoOut ownership, executable identity, safe process replacement or cleanup. The refused port-8080 attempt proves only that no listener accepted that one connection.

The official websrv is not a suitable dependency. Its generic filesystem and POST routes, package installation, persistent fake-app creation, remount, ptrace, credential/kernel writes, RWX transitions and unbounded waits exceed the Chimera contract. A loopback HTTP server is also unnecessary: the desired end state can be represented more narrowly as one launcher containing one exact, hash-bound RetroArch ELF and no network service.

Minimal future contract

• exact firmware 9.60, exact existing title FAKE00000 and one exact embedded RetroArch artifact;
• no HTTP listener, generic endpoint, device-side payload file or fallback;
• no fake-app creation, remount, installation, autoload or persistent write;
• fail closed if a BigApp is already active; never terminate one implicitly;
• one launch and one replacement transaction with absolute deadlines, restoration, a bounded result channel and no retry or reconnect;
• consumed receipt before a separately authorized console connection.

This is an architecture contract, not implementation permission. Target source and a build remain blocked because public SDK stubs provide export names but not independently corroborated PS5 function declarations, parameter semantics or app_launch_ctx_t layout. The available declarations share the shsrv lineage. The reviewed implementation lineage also does not provide a complete, bounded and source-proven failure restoration/cleanup composition suitable for the contract above. Copying those declarations or merely replacing unbounded loops with guessed timeouts would not close either gap.

Next step

Obtain independent public, firmware-applicable evidence for the three launch function signatures and launch-context layout, then perform a separate offline composition proof for every ptrace, credential, mapping, process and cleanup edge. Only after both gates pass may a hash-bound target artifact be built and audited; console permission would then be requested separately.