Phase 1.0E inherited result channel

Status: ONE-SHOT TEST CONSUMED; INCOMPLETE BEFORE D03; NO DEVICE ACTION AUTHORIZED.

Source-bound transport

Hardened elfldr commit 197623058f509eddde18868dafcb92fdcac66464 provides a duplex channel only on its legacy raw-ELF route:

socksrv.c:335-339 invokes elfldr_read for raw ELF input;
elfldr.c:837-923 derives and reads the exact ELF extent, so socket EOF is not the input framing contract;
socksrv.c:139-141 passes the accepted descriptor to elfldr_spawn for the legacy route but passes -1 for the controlled route;
elfldr.c:499-520 duplicates that descriptor to payload stdin, stdout and stderr; and
socksrv.c:421-423 closes the parent copy only after spawn returns.

The Phase-1.0E profile therefore writes results to inherited stdout. It adds no target-side socket, connect, bind, listen, accept or recv, no target address or port, and no loader change. This finding does not apply to the controlled route, whose stdio=-1 contract remains intentionally outputless.

Target frame and write behavior

After each first D00-D12 notification attempt, the target performs exactly one nonblocking, signal-suppressed operation:

send(STDOUT_FILENO, frame, 64, MSG_DONTWAIT | MSG_NOSIGNAL)

There is no send loop or retry. A short write or error is retained only in process memory and cannot block the pre-existing notification/diagnostic path. D11 and D12 are terminal frames. Each 64-byte big-endian frame contains magic CHD10E01, version, size, strict sequence, stage, kind, flags, raw results, notification result/masks, twenty zero bytes and CRC-32 over bytes 0-59.

Host behavior

The host tool validates exact ELF size and SHA-256 before socket creation. It then permits one connect, one sendall, one shutdown(SHUT_WR), bounded receive of at most 65,536 bytes, and one close. It never retries, reconnects, resumes or overwrites an existing trace. The half-close ends only host-to-PS5 input; it leaves payload stdout readable on the same descriptor.

The parser rejects invalid magic/version/size, CRC, reserved bytes, stage, kind, flags or sequence. EOF, timeout or the byte ceiling without a valid terminal frame is incomplete evidence. A valid frame proves code output from the transferred payload process on that connection; it does not prove safe exit, loader cleanup or an unreported graphics boundary.

Static artifact result

retroarch_ps5_result_diag.elf is 1,844,880 bytes with SHA-256 1049c78099a60b472a3fb0e2999e3393b6ad76337a28532a7e53872e7772dedf. Two clean builds from chimera-retroarch commit b9fc037304a14199f35f8229edac26fa5c840509 produced byte-identical ELF and map files. Compared with RUN B, the complete undefined-symbol set changes only by adding send.

The ELF retains the ordinary SDK v0.41 CRT and Phase-1.0D SDL/VideoOut path. Disassembly proves _start calls __patch_init; the statically linked CRT contains its credential/capability and syscall-range helpers. Those bounded, temporary runtime effects are not hidden or reclassified by this channel. No RWX load segment, TLS or non-empty init/fini array exists.

Consumed RUN C result

The exact one-shot permission was consumed on 2026-07-22. The host verified the authorized 1,844,880-byte artifact before connecting, used one connection, one sendall and one write-half-close, then received 3,413 bytes before remote EOF. There was no retry, reconnect, parser error or timeout.

Three 64-byte frames validated: D00, D01 and D02 in strict sequence. D02's raw0=0 proves the bounded in-memory PS5 platform/frontend initialization marks succeeded. The result channel itself is therefore proven on firmware 9.60 for those stages. No D03 or terminal frame arrived. Because D03 is the first operation in sdl2_gfx_init(), this result does not prove entry into the SDL video driver, SDL initialization, VideoOut, a flip, rendering, cleanup or safe exit. Remote EOF is an observed transport boundary, not proof of normal process return.

The ignored local trace is bound by size 1,795 and SHA-256 4ff27a0eac48283cdc4c7ff964226def2689e808e3adea6594d0e77674a676f0. It is not committed because it contains the session address. All authorization fields are false after this consumed attempt.

Offline D02-to-D03 follow-up

Source inspection bounds the unobserved interval but does not identify a root cause. After D02, RetroArch still performs synchronous content-load setup, argument/config processing, driver selection, static-core/content init and the entry into drivers_init(). D03 is the first instrumented operation in sdl2_gfx_init(). Any earlier failure or external termination can therefore produce the observed boundary.

Chimera-retroarch commit f1391c3e6717ff4e2b869007fb9627c9edde52e4 updates only the host receiver, its tests and documentation. Future traces can retain the full bounded receive stream and non-frame stdout losslessly as base64 with byte counts and SHA-256 values. The pre-encoding limit remains 65,536 bytes and trace creation remains exclusive. The client explicitly rejects the consumed RUN-C state. No target code, target artifact, device action or authorization was added.

5.1 KiB Raw Permalink Blame History