[boburning]

Program and dependency

• v3 slice: DISP-04
• Base: main at c31d928
• Depends on merged DISP-03 implementation feat(display): integrate settings with trusted session composer (DISP-03) #608 and merged DISP-03 ledger update docs(program): complete DISP-03 integration #609; both are present in current main.
• Program transport/reference: Transport: final autonomous SSD202D work program v3 #432. This PR is an implementation deliverable, not a transport PR.

Summary

• add one versioned, signed-source authority for reviewed built-in display profiles
• qualify exact Mini Plus + system + core tuples for GB/GBC with Gambatte and GBA with gpSP
• keep Auto behavior unchanged and mark unreviewed devices, cores, CRT effects, bezels, and custom content unavailable
• bind each filter descriptor and implementation to fixed runtime paths, byte sizes, and SHA-256 values
• reject stale authorities, unknown devices/systems/cores, unsafe paths, unsupported geometry, filter drift, and incomplete profile dispositions
• compose bounded integer-pixel/correct-aspect private RetroArch configuration without changing global RetroArch settings
• verify descriptor and implementation bytes on-device before exposing a filter path
• include the policy and helper in the complete atomic launch/session Warm bundle and affected-component CI scope

Validation

• focused native: 8/8 passed
• full optimized shell suite: 799/799 passed across eight shards; slowest shard was 94 seconds
• focused display shell suite: 15/15 passed
• focused provenance, legacy-manifest, and dependency validation: passed after final regeneration
• CI scope contract: passed
• focused cppcheck: exited 0
• clang-format dry run: passed
• git diff --check: passed
• signed hardware workflow: https://github.com/boburning/BloomOS/actions/runs/33350464921 (passed in 6m45s)

Signed artifact for exact runtime commit b36e2eb:

• archive: 199861824 bytes
• archive SHA-256: d957635c14d781d2101110b0fcb58fde6232e1b3167c96fb47887ff31b3ee3f8
• manifest SHA-256: a75012b612ef9244f7ad7b16b27c09339a5dbd5bc23c4ff216075d7de9f71776
• signature SHA-256: 1d55c70c3c6c59f5a051bf21726dbc26114f8ef4d89adf4afc6601581a91256d
• payload manifest SHA-256: 2212158d91b2bdd5b12a7f075ce4b974f1e080abec6298a29b9321c487384dbf
• build-info SHA-256: 8d0499c161e14062439e1efd75fa487a9bd4f2a3d6c047bf4e409f6a045f08bd
• SHA256SUMS and Ed25519 signature verified

The documentation evidence commit 667ef77 and CI-only validator fix f6b4796 do not change runtime bytes.

Mini Plus evidence

A hash-differential Warm overlay used the complete 12-file launch/session bundle extracted from the verified signed artifact. No Full update, reboot, network component, Wi-Fi action, profile mutation, credential mutation, listener mutation, ROM copy, Save mutation, or global RetroArch mutation occurred.

• exact Mini Plus + GB + Gambatte selected plus-gb-gambatte-lcd3x-v1
• effective axes: Integer Pixels, LCD, bezel Auto
• generated 480x432 viewport at 80,24 for reviewed 160x144 / 10:9 geometry
• exact LCD3x descriptor and implementation passed on-device size/hash verification
• private RetroArch config SHA-256: cf539c91ce78cdd96cb2c7f02252f4e4bb263c6c47879c22ce3f1457bce97190
• real RetroArch reached canonical RUNNING with gambatte_libretro.so and Recent recorded
• global RetroArch config retained SHA-256 336ee748ca06bba32582087efc867f811f465558df158056b9a25689bf36672e
• canonical settings retained SHA-256 31fe5ad0969bc8a9e831d10b77752da4712b30d0b96082c8243a6fa495316c9d
• Wi-Fi remained enabled and associated before, during, and after testing
• launch/session candidate rolled back; temporary fixture and deployer removed
• one Shell overlay made from six exact files in the same signed artifact remains active intentionally
• installed baseline remains known_good v0.1.0-dev-2933f706; aggregate health is green; no RetroArch process remains

Machine-readable evidence: docs/validation/display/plus-disp04-built-in-profiles-20260831.json

Limitations

• Both the Auto comparison and selected-profile run ended with forced_kill_required in the existing remote game-smoke/session-stop path. This PR does not claim a clean stop or save-flush pass.
• The running-game framebuffer capture was black. No visible filter-output claim is made, and no private ROM-derived frame is committed.
• Evidence is remote SSH/process/config/integrity evidence, not physical LCD, controls, audio, gameplay, or save-semantic certification.
• GB was exercised on Mini Plus. GBC and GBA remain host-validated; Mini V1-V4 and Mini Flip/my285 remain untested.
• The policy therefore retains device_evidence_status as pending rather than overstating qualification.

Links

• Depends on: feat(display): integrate settings with trusted session composer (DISP-03) #608
• Preceding ledger update: docs(program): complete DISP-03 integration #609
• Program transport/reference: Transport: final autonomous SSD202D work program v3 #432

[boburning]

CI reconciliation: the first shell run found that the DISP-04 validator required the RetroArch COPYING file even when Actions intentionally left the pinned RetroArch submodule uninitialized. The focused correction accepts only the exact reviewed GPL-3.0 hash when both parent and nested revisions match build/dependencies.lock; initialized trees still verify source bytes. A synthetic uninitialized-source fixture now passes, while stale/altered authorities continue to fail closed. Focused display shell validation is 6/6 green.