chimera-gfx-Public/docs/retroarch/phase-1.0ea-expanded-launch-evidence.md

Phase 1.0EA: expanded launch evidence and cleanup audit

Status: NEW_FW960_LNC_CANDIDATE_FOUND_ABI_AND_CLEANUP_GATES_STILL_BLOCKED

This phase is a bounded public-source and offline source-history audit. It creates no target source or artifact and performs no PS5 operation.

Newly reviewed candidate

The public phantomptr/ps5upload repository was bound at commit 978add1864eb54351eaddbd242634282ef3cd120. Its current ShellUI RPC source is Git blob b30d17bd0068affd5b4d42550953bc6bd44203f7; its ptrace implementation is blob 6b68f26995f746df5b2b0b9fd1495432304e8f35.

Commit e3875ffba7cb08e017dcdb537d045af3fddc133d first introduced the reviewed route and states that game launch through sceLncUtilLaunchApp worked on firmware 9.60. The implementation constructs a packed 24-byte local parameter with size, user ID, options, crash-report and check fields, then remotely calls the export from SceShellUI. This is useful independent implementation and operator-report evidence for a different launch API. It is not independent ABI provenance: the introducing commit supplies no public specification, header, binary-derived layout proof or second implementation lineage for that parameter layout. Exact-name searches for the layout fields produced no other qualifying public source.

The route also does not satisfy the Chimera end state. It starts a registered title; it does not bind or replace that title's process with the exact embedded RetroArch ELF. The previously reviewed shsrv replacement lineage would still be required for that second operation, so finding the LNC launch candidate does not remove the replacement ABI or composition gates.

Cleanup findings

The candidate cannot be imported as a bounded lifecycle implementation:

• attach, remote-call and single-step paths use blocking waitpid without an absolute deadline;
• launch cleanup discards pt_munmap and pt_detach results;
• the tracked-attached flag is cleared even when detach fails;
• a dispatched call with unreadable completion is promoted to soft success;
• register restoration and authid restoration include best-effort failures;
• an authid restore failure is logged and execution continues with elevated process state until a later operation might repair it;
• its retry/fallback semantics exceed the Chimera one-shot contract.

These are source facts about the candidate, not claims about an observed PS5 failure. The existing Chimera host ownership models remain useful, but no source-bound target composition currently replaces these failure behaviors with absolute deadlines, verified restoration and terminal ownership.

Decision and next step

The direct embedded route selected by DZ remains the minimum architecture, but target source and build remain blocked. The next gate requires either an independent public specification or two demonstrably independent, firmware-applicable implementations that agree on the complete launch and replacement ABI, followed by a target-source composition whose every blocking wait, mapping, register, credential, attach and detach edge has a deadline and verified cleanup result. Console permission is not yet actionable.