chimera-gfx-Public/docs/runtime/phase-0.9b-observer-limitations.md

Phase 0.9B observer limitations

Status: BLOCKED.

What was established

• Exact local commits and relevant source-file identities were recorded.
• Normal SDK v0.41 startup is UNSAFE for this phase because __patch_init() is reachable before main and performs prohibited writes.
• A -nostartfiles link can omit that CRT, but safe observer entry, return/exit, crash cleanup and resource cleanup remain UNPROVEN.
• The hardened controlled route is hash-bound but passes stdio=-1.
• The controlled manager transport sends and closes; it has no receive callback for observer data.
• The fixed loader exit response cannot carry the requested observation set.
• Stock Payload Manager HTTP routes and log state are not an admissible replacement output collector.

What was not built

• no observer source;
• no target declaration;
• no PS5 object or ELF;
• no linker map;
• no disassembly or reachable callgraph;
• no artifact import, relocation, string or open-flag report;
• no double clean target build;
• no artifact manifest;
• no install, lifecycle or execution package; and
• no transfer or execution instructions.

These are intentional consequences of the pre-build hard gates, not omitted positive evidence.

Unsupported or unproven observations

All target observations remain unimplemented. In particular:

• only one possible firmware source exists in the reviewed SDK source;
• no independent second firmware source is established;
• firmware 9.60 runtime behavior of the first source is untested;
• mount layouts and semantics are not runtime-proven;
• a process sample exists, but complete service mapping does not;
• no exact listener snapshot and owner-mapping API was established;
• live and backup paths are absent;
• live and backup objects, sizes, identities and hashes are absent;
• authoritative autoload/startup/retry source completeness is absent;
• stable no-follow behavior on the target filesystem is unproven;
• atime, audit, cache, counter and scheduler effects remain possible; and
• output and exit remain blocked.

Remaining anti-brick blockers

1. two current firmware sources;
2. literal live paths;
3. live mount and object identities;
4. live sizes and SHA-256;
5. mount and filesystem properties;
6. process and service inventory;
7. listener inventory and ownership;
8. complete autoload/startup/retry state;
9. existing separate rollback objects;
10. byte-exact on-device Payload Manager backup (HARD_BLOCKER);
11. independent recovery;
12. power-loss-safe switch semantics;
13. component order;
14. observer startup/exit ABI; and
15. non-persistent output.

No offline test may promote a stock hash, clear a device blocker, prove firmware behavior, or authorize a later action.

Risk of a later one-shot run

Even if a future artifact were approved, unresolved risks would include:

• the existing loader’s ptrace, credential, mapping, breakpoint and socket-overlap operations before payload entry;
• loader cleanup failure or a child that does not terminate;
• crash or return behavior different from the source-reviewed expectation;
• kernel, audit, cache, atime, scheduler and counter effects from reads;
• stale or conflicting path plans;
• concurrent object replacement during observation;
• incomplete process/service/listener snapshots;
• output truncation or loss;
• a false inference from an unsupported result; and
• operator confusion between observation evidence and installation approval.

One observation could not prove atomic switch semantics, write durability, power-loss behavior, recovery independence under actual failure, component order, future runtime stability, graphics safety, RetroArch compatibility or the absence of every platform side effect.

Minimum evidence to resume engineering

Resume target engineering only after both items are available in local, commit-bound public source and accepted by a new review:

1. a kernelwrite-free startup and termination ABI covering BSS, stack, return/exit, crash behavior and loader cleanup; and
2. a one-shot response channel that returns bounded observer bytes over the controlled route without a device file, new listener, persistent state, global Payload Manager mutation or post-exit activity.

Until then the exact decision is:

BLOCKED — OBSERVER STARTUP OR EXIT ABI UNPROVEN; NO PROVEN NON-PERSISTENT OUTPUT CHANNEL.