docs(debt): name what KytyPS5 does for sceAmprMeasureCommandSizeReadFile

docs/dev/debt/libSceAmpr.md

@@ -8,6 +8,7 @@
 
 - [sceAmprAmmSetPageTablePoolOccupancyNotificationThreshold](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - throws as unimplemented. The `(int threshold)` signature follows [drakmor/ampr_emu](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/src/sceampr_exports.cpp#L336-L337), where the export passes the threshold to `sceKernelMapperSetPageTablePoolOccupancyNotificationThreshold(int)`; not measured on a console. The thresholds the kernel rejects, their error codes and how the notification is delivered are unknown, and no title is known to call it (Planet Zoo, PPSA18026, imports it).
 - [AMPR command buffer null arguments](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - the result for a null command buffer is unknown for `sceAmprCommandBufferConstructor`, `sceAmprAprCommandBufferConstructor`, `sceAmprCommandBufferReset`, `sceAmprCommandBufferSetBuffer` and `sceAmprCommandBufferGetSize`; the first four return `SCE_KERNEL_ERROR_EINVAL` here, and `sceAmprCommandBufferGetSize` chooses 0, but none of the null behaviour has been confirmed on a PS5.
+- [sceAmprMeasureCommandSizeReadFile](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - takes no argument and returns the size of the host command record every time, so it never fails; the commit that added it names no measurement. KytyPS5 (PS5, `src/libs/libAmpr.cpp`, commit 5e837a9beac82c031868eaad9348d6a48245fb99), the only one of the three emulators with libSceAmpr (shadPS4 and fpPS4 only list the names), takes four arguments and returns `KERNEL_ERROR_EINVAL` when the destination range or the file offset is out of range, and otherwise 0x14, or 0x18 when the offset needs more than 32 bits. `sceAmprMeasureCommandSizeReadFileGather`, `sceAmprMeasureCommandSizeReadFileScatter` and `sceAmprMeasureCommandSizeReadFileGatherScatter` take arguments here and refuse invalid ones. Which signature is right is not measured.
 - [AMPR WriteAddressFromCounterPairOnCompletion](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - the pair of an even counter n is assumed to give counter n in the low 32 bits and n + 1 in the high 32 bits. Wait compare values, wait flush and counter index ranges follow the [ampr_emu](https://github.com/drakmor/ampr_emu) reimplementation; the flush is accepted and has no effect, as commands run in order
 - [AMPR command buffer offsets](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - recording with a current offset greater than the bound memory size throws before calculating remaining capacity or writing a command. This validates the emulator's own command-buffer encoding; the console's response to a corrupted opaque buffer object is unknown.
 - [AMPR command sizes](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - non-`Nop` commands use host encoding with an 8-byte header, exceeding console sizes. On overflow, the buffer expands up to a 32 MiB cap on the guest heap, relocating `base` and `size`; below this cap a full buffer avoids `EBUSY`, placing commands in host memory not allocated by the guest, and AMM submits resolve original pointers to expanded memory. Rebinding the same memory via `SetBuffer` frees prior expansions and resets that buffer's offset and commands to 0. Beyond the cap, appends return `EBUSY`. `Nop(n)` is n dwords and `NopWithData(n)` (n + 1) dwords with header `0x5452000F | payloadDwords << 8 | (type & 0xF) << 12`, and `ConstructNop` writes its word before payload and zeroes padding (FW 13.42, #10936); null `base` reports before count or range. `NopWithData` and `ConstructNop` stop at the record without trailing zeros. The at-start flag of `_04_00` writes is ignored; commands run in order.