chimera-gfx-Public/docs/retroarch/phase-1.0k-write-diag-one-shot-runner.md

Phase 1.0K write-diagnostic one-shot runner

Status: OFFLINE RUNNER PREPARED; NO DEVICE AUTHORIZATION.

Phase 1.0K adds host-only parsing and authorization support for the unchanged, ignored Phase-1.0J artifact. It creates no target artifact and performs no PS5 connection, transfer, execution or result reception.

Exact binding

Object	Identity
Chimera GFX Phase J	05d316e4d48660ab24d116153f094ef7e2f69522
RetroArch J artifact source	2e385265ab893dbba5898178dde5e108d3dbfa19
RetroArch K host runner	ee965a0be3cd3e0032330680e7614c766688410a
Runner source SHA-256	4ee58f08ff51cff3624cbc072c0e915e8c415eb8cd98185fa0d6a20c02b7c330
J artifact	1,845,208 bytes; SHA-256 6ff0f7ea391da5f15ea43512a871078133e896a6900ae9f8f3fa75711abb8009
J linker map	637,728 bytes; SHA-256 19f1cf851ad8f99d31d5de3a14591f81faa83589c18e93cd60be96ebef5d7719

The runner change touches host code and tests only. The artifact source, artifact bytes, SDL overlay and target protocol emitter remain unchanged.

Wire contract

J extends historical diagnostics without renumbering them. The parser therefore uses this exact 30-entry table:

0..12   D00..D12
13..27  I00..I14
28      C1
29      D13

Magic is CHD10J01, version is 1 and every frame is 64 bytes in big-endian wire order with CRC-32 over the first 60 bytes. A wrong table, including an apparently natural but incorrect D13, C1 suffix, is rejected before socket creation.

Fail-closed activation contract

The CLI has no protocol selector. J is selected only by an exact active PHASE_1_0K_WRITE_DIAG_ONE_SHOT_RUNNER manifest. Before transport the runner requires:

• exact artifact name, profile, size and SHA-256;
• execution_eligible=true and transfer_eligible=true in a separately reviewed active manifest;
• explicit one-shot connection, transfer, execution and reception authority;
• a separate untracked approval for exact firmware 9.60, target, port, timeout and unique run ID;
• false installation, autoload, device-write, retry, reconnect, resume and automatic-reboot fields;
• exact agreement on magic, frame size and the complete wire table.

The runner rehashes the artifact and durably creates an exclusive consumed-run receipt before any socket. It permits one connection, one sendall, one write-half-close and bounded reception. Trace creation is exclusive, capture is capped at 65,536 bytes, and there is no retry, reconnect, resume or overwrite.

The tracked manifest and approval template are deliberately inactive: no target, port or run ID is present; every authorization and artifact eligibility field is false. These files cannot activate transport.

Offline evidence and limits

Fake-socket tests cover fragmented J frames, C1/D13 index preservation, terminal D12, exact manifest selection, incorrect stage-table rejection, inactive-manifest rejection before transport, consumed-run protection and the inherited timeout/capture limits.

This phase provides no firmware evidence. E118's historical operation, J runtime behavior, submit errno, visible presentation and complete cleanup all remain unproven. A future device action would require a new, exact, artifact-specific permission and a separately reviewed active record.