chimera-gfx-Public/docs/retroarch/phase-1.0ae-minimal-bigapp-launcher-architecture.md

Phase 1.0AE: minimal BigApp launcher architecture

Status: V07_NONPERSISTENT_LINEAGE_SELECTED_TARGET_IMPLEMENTATION_BLOCKED

Date: 2026-07-29

Objective

Identify the shortest public-source route from the proven raw-ELF VideoOut failure to one bounded launch-context experiment. This is an offline source review. It adds no target source, artifact, socket, transfer or execution.

Source decision

Official shsrv v0.19 is not an acceptable base. Its hbldr path can remount /system_ex, persistently create FAKE00000, copy an executable, kill the running BigApp and enter unbounded ptrace/wait loops.

Official shsrv v0.7 is the selected reference lineage because it launches the existing VideoPlayer WebApp title PPSA01659 and contains no fake-app creation or system-ex remount in its hbldr bundle. Selection is not authorization and does not prove that the title exists, launches, owns VideoOut or behaves the same way on firmware 9.60.

Required minimal callgraph

The future design may model only this sequence:

1. validate one exact payload hash and fixed argument vector;
2. query the foreground user;
3. require that no BigApp is currently running;
4. attach to the source-proven SystemService parent;
5. arm bounded fork and exec observation before launch;
6. request launch of the fixed existing PPSA01659 title;
7. detach the parent on every path;
8. replace only the newly observed child with the exact payload;
9. restore every temporary instruction and credential mutation;
10. detach the child or terminate only that newly created child on failure;
11. emit a bounded inherited result and stop.

The architecture must fail closed when a BigApp already exists. It must never call sceSystemServiceKillApp as part of the experiment.

Removed upstream behavior

• general Telnet shell and arbitrary command parsing;
• PATH search, arbitrary filesystem path and target-side ELF read;
• FAKE00000, fakeapp_create_if_missing and remount_system_ex;
• package installation, autoload and persistent writes;
• hbdbg, GDB wait and free-form arguments;
• arbitrary root/jail broadening unless separately proven indispensable and exactly restored;
• unbounded waitpid, pt_await_child, pt_await_exec, pt_call and pt_syscall loops;
• killing or replacing any pre-existing process;
• retry, reconnect and fallback title selection.

Unclosed contracts

Target implementation remains blocked until an offline design proves:

• a deadline-capable wait primitive for every wait/step boundary;
• unique child correlation without acting on an unrelated process;
• complete parent detach and child cleanup for every failure edge;
• exact restoration of breakpoint bytes, page protections, credentials, environment, root and jail changes;
• bounded ELF size, headers, segments, relocations and allocation;
• exact firmware-9.60 availability and role of PPSA01659, or a fail-closed observation that does not install or mutate it;
• accepted public evidence for every SystemService/UserService declaration;
• an explicit policy for the unavoidable kernel/ptrace effects.

Decision

The persistent v0.19 route is rejected. v0.7 is the preferred public-source reference for a nonpersistent BigApp experiment, but copying or compiling it is still blocked. The next phase may implement only a host lifecycle model with injected fake operations and exhaustive failure cleanup. It may not add PS5 headers, target source, syscall numbers, a target build or device action.