[pthread] Implemented pthread functions for AVPlayer compatibility

* [fixes-assets] Add SharpEmu icon and fix glfw dependency (temporary fix)

* [reuse] I forgot to add comma

* [readme] update logo

.github/ISSUE_TEMPLATE/game-compatibility.yml

@@ -16,11 +16,6 @@ body:
         Example title:
         Demon’s Souls (PPSA01341)
 
-        **Before reporting:**
-        - Test the game on a **fresh build from `main`**, not an old release.
-        - Copy the **exact commit SHA** shown at the top of the log.
-        - `DEBUG` and `TRACE` lines are diagnostic context, not errors by themselves; report the last milestone or the first `WARNING`, `ERROR`, or `CRITICAL` line connected to the stop.
-
   - type: input
     id: game_name
     attributes:
@@ -78,20 +73,11 @@ body:
     id: logs
     attributes:
       label: Log File
-      description: Attach the **full** log file (`.log`, `.txt`, or `.zip`). Do not paste only a fragment — the maintainer needs the complete log from launch to crash.
+      description: Drag and drop your log file here, or click to browse
     validations:
-      required: true
+      required: false
       accept: ".log,.txt,.zip"
 
-  - type: input
-    id: last_milestone_first_error
-    attributes:
-      label: Last Milestone / First Error
-      description: Paste the **last useful milestone line** or the **first `WARNING`, `ERROR`, or `CRITICAL` line connected to the stop** from the log. `DEBUG`/`TRACE` lines do not count unless a real error follows them.
-      placeholder: "e.g. CpuEngine: native-only  OR  [ERROR] Native backend FAILED: ..."
-    validations:
-      required: true
-
   - type: dropdown
     id: operating_system
     attributes:
@@ -133,8 +119,7 @@ body:
     id: emulator_version
     attributes:
       label: Emulator Version / Commit
-      description: Copy the **exact short SHA** from the top of the log. Do not enter just `0.0.1` without a commit hash.
-      placeholder: e.g. a1b2c3d
+      placeholder: e.g. v0.0.1 / a1b2c3d
     validations:
       required: true
 

.github/pull_request_template.md

@@ -1,27 +0,0 @@
-## Before submitting
-
-Please read our contribution guidelines before opening a pull request:
-
-➡️ [**CONTRIBUTING.md**](https://github.com/sharpemu/sharpemu/blob/main/CONTRIBUTING.md)
-
-By opening this pull request, you confirm that you have read and agree to follow the contribution guidelines.
-
-## Testing
-
-If applicable, list the game(s) you tested and briefly describe the results.
-
-Example:
-
-- Demon's Souls (PPSA01341) – Boots to splash screen.
-- Dreaming Sarah – Save/load works correctly.
-
-If your changes do not affect runtime behavior (e.g. documentation, tooling, CI), write `N/A`.
-
-## Checklist
-
-By submitting this pull request, you confirm that:
-
-- [ ] I have read and followed `CONTRIBUTING.md`.
-- [ ] I tested my changes or marked the testing section as `N/A`.
-- [ ] I wrote this pull request description myself and did not paste AI-generated explanations.
-- [ ] I listed the game(s) I tested (or marked the testing section as `N/A`).

.github/workflows/notify-site.yml

@@ -1,31 +0,0 @@
-# Copyright (C) 2026 SharpEmu Emulator Project
-# SPDX-License-Identifier: GPL-2.0-or-later
-
-# Tells the website repo to rebuild when a release is published, so
-# sharpemu.app/downloads lists the new build within a minute.
-name: Notify website
-
-on:
-  release:
-    types: [published, released, edited, deleted]
-  workflow_dispatch:
-
-jobs:
-  dispatch:
-    runs-on: ubuntu-26.04
-    steps:
-      - name: Trigger sharpemu-site rebuild
-        env:
-          TOKEN: ${{ secrets.SITE_DISPATCH_TOKEN }}
-        run: |
-          if [ -z "$TOKEN" ]; then
-            echo "SITE_DISPATCH_TOKEN is not set — skipping website rebuild."
-            exit 0
-          fi
-          curl -fsS -X POST \
-            -H "Authorization: Bearer $TOKEN" \
-            -H "Accept: application/vnd.github+json" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            https://api.github.com/repos/sharpemu/sharpemu-site/dispatches \
-            -d '{"event_type":"release-published"}'
-          echo "Website rebuild requested."

.github/workflows/pr-build-links.yml

@@ -1,120 +0,0 @@
-# Copyright (C) 2026 SharpEmu Emulator Project
-# SPDX-License-Identifier: GPL-2.0-or-later
-
-# Posts (and keeps updated) a single PR comment linking the per-platform build
-# artifacts once "Build and Release" finishes.
-#
-# This is a workflow_run workflow on purpose: PRs from forks run "Build and
-# Release" with a read-only GITHUB_TOKEN and cannot comment. workflow_run runs
-# afterwards in the base-repo context with a read-write token and does not check
-# out untrusted fork code, so it can comment safely. Because of that, GitHub only
-# triggers it from the copy on the default branch — it does nothing until merged
-# to main.
-name: PR Build Links
-
-on:
-  workflow_run:
-    workflows: ["Build and Release"]
-    types:
-      - completed
-
-permissions:
-  contents: read
-  actions: read
-  pull-requests: write
-
-jobs:
-  comment:
-    name: Post artifact links
-    runs-on: ubuntu-26.04
-    # Only for successful PR builds — artifacts exist only when the build passed.
-    if: >-
-      github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success'
-    steps:
-      - name: Post or update the artifact-links comment
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const run = context.payload.workflow_run;
-            const { owner, repo } = context.repo;
-
-            // Resolve the PR. Same-repo PRs are in workflow_run.pull_requests, but
-            // fork PRs leave it empty AND their head commit is not on a base-repo
-            // branch, so listPullRequestsAssociatedWithCommit misses them too. Match
-            // the open PR by its head "owner:branch" instead, which works for forks.
-            let prNumber;
-            if (run.pull_requests && run.pull_requests.length > 0) {
-              prNumber = run.pull_requests[0].number;
-            } else {
-              let candidates = [];
-              const headOwner = run.head_repository && run.head_repository.owner
-                ? run.head_repository.owner.login
-                : null;
-              if (headOwner && run.head_branch) {
-                const byHead = await github.rest.pulls.list({
-                  owner, repo, state: 'open',
-                  head: `${headOwner}:${run.head_branch}`, per_page: 10,
-                });
-                candidates = byHead.data;
-              }
-              if (candidates.length === 0) {
-                const byCommit = await github.rest.repos.listPullRequestsAssociatedWithCommit({
-                  owner, repo, commit_sha: run.head_sha,
-                });
-                candidates = byCommit.data.filter(pr => pr.state === 'open');
-              }
-              if (candidates.length === 0) {
-                core.info('No open PR for this build; nothing to comment.');
-                return;
-              }
-              prNumber = candidates[0].number;
-            }
-
-            // Collect the per-platform artifacts the build produced.
-            const artifacts = await github.paginate(
-              github.rest.actions.listWorkflowRunArtifacts,
-              { owner, repo, run_id: run.id, per_page: 100 },
-            );
-            const platforms = [
-              { key: 'win-x64', label: 'Windows (win-x64)' },
-              { key: 'linux-x64', label: 'Linux (linux-x64)' },
-              { key: 'osx-x64', label: 'macOS (osx-x64)' },
-            ];
-            const rows = [];
-            for (const platform of platforms) {
-              const artifact = artifacts.find(a => a.name.includes(platform.key));
-              if (!artifact) {
-                continue;
-              }
-              const url = `https://github.com/${owner}/${repo}/actions/runs/${run.id}/artifacts/${artifact.id}`;
-              rows.push(`| ${platform.label} | [\`${artifact.name}\`](${url}) |`);
-            }
-            if (rows.length === 0) {
-              core.info('No platform artifacts on this run; nothing to comment.');
-              return;
-            }
-
-            const marker = '<!-- pr-build-links -->';
-            const body = [
-              marker,
-              `### 📦 Build artifacts — \`${run.head_sha.substring(0, 7)}\``,
-              '',
-              '| Platform | Download |',
-              '| --- | --- |',
-              ...rows,
-              '',
-              `From [build run #${run.run_number}](${run.html_url}). ` +
-                'Downloads require a GitHub login and expire after 90 days.',
-            ].join('\n');
-
-            // Upsert one comment so repeated builds refresh it in place.
-            const comments = await github.paginate(github.rest.issues.listComments, {
-              owner, repo, issue_number: prNumber, per_page: 100,
-            });
-            const existing = comments.find(c => c.body && c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
-            } else {
-              await github.rest.issues.createComment({ owner, repo, issue_number: prNumber, body });
-            }

.github/workflows/workflow.yml

@@ -7,8 +7,6 @@ on:
   push:
     branches:
       - "**"
-    tags:
-      - "v*"
     paths-ignore:
       - "**/*.md"
       - "**/*.png"
@@ -34,44 +32,37 @@ concurrency:
 jobs:
   init:
     name: Init
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     outputs:
+      archive-name: ${{ steps.vars.outputs.archive-name }}
+      artifact-name: ${{ steps.vars.outputs.artifact-name }}
       release-name: ${{ steps.vars.outputs.release-name }}
       release-tag: ${{ steps.vars.outputs.release-tag }}
-      safe-ref: ${{ steps.vars.outputs.safe-ref }}
       short-sha: ${{ steps.vars.outputs.short-sha }}
-      version: ${{ steps.vars.outputs.version }}
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
       - name: Compute workflow variables
         id: vars
         shell: bash
         run: |
           short_sha="${GITHUB_SHA::7}"
           safe_ref="$(echo "${GITHUB_REF_NAME}" | tr '[:upper:]' '[:lower:]' | sed 's#[^a-z0-9._-]#-#g')"
-          version="$(python3 -c 'import sys, xml.etree.ElementTree as ET; version = ET.parse("Directory.Build.props").getroot().findtext(".//SharpEmuVersion"); sys.exit("Directory.Build.props is missing SharpEmuVersion") if not version or not version.strip() else print(version.strip())')"
-          release_tag="v${version}"
-          release_name="SharpEmu v${version}"
-
-          if [ "${GITHUB_REF_TYPE}" = "tag" ] && [ "${GITHUB_REF_NAME}" != "${release_tag}" ]; then
-            echo "Release tag ${GITHUB_REF_NAME} does not match project version ${release_tag}." >&2
-            exit 1
-          fi
+          archive_name="sharpemu-win64-${short_sha}.zip"
+          artifact_name="sharpemu-win64-${short_sha}"
+          release_tag="win64-${safe_ref}-${short_sha}"
+          release_name="SharpEmu win64 ${short_sha}"
 
           {
             echo "short-sha=${short_sha}"
-            echo "safe-ref=${safe_ref}"
+            echo "archive-name=${archive_name}"
+            echo "artifact-name=${artifact_name}"
             echo "release-tag=${release_tag}"
             echo "release-name=${release_name}"
-            echo "version=${version}"
           } >> "$GITHUB_OUTPUT"
 
   reuse:
     name: REUSE Compliance
     needs: init
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -80,7 +71,7 @@ jobs:
         uses: fsfe/reuse-action@v6
 
   build:
-    name: Build win-x64
+    name: Build Archive
     needs:
       - init
       - reuse
@@ -89,6 +80,7 @@ jobs:
       DOTNET_NOLOGO: true
       NUGET_PACKAGES: ${{ github.workspace }}\.nuget\packages
       PUBLISH_DIR: ${{ github.workspace }}\artifacts\publish\win-x64
+      RELEASE_DIR: ${{ github.workspace }}\artifacts\release
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -100,244 +92,69 @@ jobs:
           cache: true
           cache-dependency-path: |
             Directory.Packages.props
-            Directory.Build.props
+            src/**/packages.lock.json
 
       - name: Restore solution
-        run: dotnet restore SharpEmu.slnx
+        run: dotnet restore SharpEmu.slnx --locked-mode
 
       - name: Build solution
         run: dotnet build SharpEmu.slnx -c Release --no-restore
 
-      # Runs every test project in the solution; a test failure fails the build, as
-      # does an aerolib.bin generation failure in the build step above (the MSBuild
-      # task logs an error and returns false).
-      - name: Run tests
-        run: dotnet test SharpEmu.slnx -c Release --no-build --verbosity normal
-
-      - name: Validate synthetic shaders
-        run: dotnet run --project tools/SharpEmu.Tools.ShaderDump/SharpEmu.Tools.ShaderDump.csproj -c Release -- artifacts/shader-dump
-
       - name: Publish win-x64 CLI
         run: dotnet publish src/SharpEmu.CLI/SharpEmu.CLI.csproj -c Release -r win-x64 --self-contained true --no-restore -p:PublishDir="${env:PUBLISH_DIR}"
 
-      - name: Upload build artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: sharpemu-win-x64-${{ needs.init.outputs.short-sha }}
-          path: ${{ env.PUBLISH_DIR }}
-          if-no-files-found: error
-          include-hidden-files: true
-
-  build-posix:
-    name: Build ${{ matrix.rid }}
-    needs:
-      - init
-      - reuse
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-26.04
-            rid: linux-x64
-          - os: macos-latest
-            rid: osx-x64
-    env:
-      DOTNET_NOLOGO: true
-      NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
-      PUBLISH_DIR: ${{ github.workspace }}/artifacts/publish/${{ matrix.rid }}
-      SPIRV_HEADERS_COMMIT: ad9184e76a66b1001c29db9b0a3e87f646c64de0
-      # SpirvModuleBuilder emits SPIR-V 1.5 and VulkanVideoPresenter requests Vulkan 1.2.
-      SPIRV_TARGET_ENV: vulkan1.2
-      SPIRV_TOOLS_COMMIT: 0539c81f69a3daeb706fd3477dca61435b475156
-      SPIRV_TOOLS_VERSION: v2026.2
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Setup .NET SDK
-        uses: actions/setup-dotnet@v5
-        with:
-          dotnet-version: 10.0.103
-          cache: true
-          cache-dependency-path: |
-            Directory.Packages.props
-            Directory.Build.props
-
-      - name: Restore solution
-        run: dotnet restore SharpEmu.slnx
-
-      - name: Build solution
-        run: dotnet build SharpEmu.slnx -c Release --no-restore
-
-      # Also runs on Linux/macOS: the aerolib.bin MSBuild task does platform-sensitive
-      # path handling, so a cross-platform generation regression surfaces here.
-      - name: Run tests
-        run: dotnet test SharpEmu.slnx -c Release --no-build --verbosity normal
-
-      - name: Build pinned SPIRV-Tools
-        if: matrix.rid == 'linux-x64'
+      - name: Create release archive
         run: |
-          git clone --no-checkout --filter=blob:none https://github.com/KhronosGroup/SPIRV-Tools.git "$RUNNER_TEMP/spirv-tools"
-          git -C "$RUNNER_TEMP/spirv-tools" checkout --detach "$SPIRV_TOOLS_COMMIT"
-          test "$(git -C "$RUNNER_TEMP/spirv-tools" rev-parse HEAD)" = "$SPIRV_TOOLS_COMMIT"
+          New-Item -ItemType Directory -Path $env:RELEASE_DIR -Force | Out-Null
 
-          git clone --no-checkout --filter=blob:none https://github.com/KhronosGroup/SPIRV-Headers.git "$RUNNER_TEMP/spirv-tools/external/spirv-headers"
-          git -C "$RUNNER_TEMP/spirv-tools/external/spirv-headers" checkout --detach "$SPIRV_HEADERS_COMMIT"
-          test "$(git -C "$RUNNER_TEMP/spirv-tools/external/spirv-headers" rev-parse HEAD)" = "$SPIRV_HEADERS_COMMIT"
+          $archivePath = Join-Path $env:RELEASE_DIR "${{ needs.init.outputs.archive-name }}"
+          if (Test-Path $archivePath) {
+            Remove-Item $archivePath -Force
+          }
 
-          cmake -S "$RUNNER_TEMP/spirv-tools" -B "$RUNNER_TEMP/spirv-tools-build" \
-            -G Ninja \
-            -DCMAKE_BUILD_TYPE=Release \
-            -DSPIRV_SKIP_TESTS=ON \
-            -DSPIRV_WERROR=OFF
-          cmake --build "$RUNNER_TEMP/spirv-tools-build" --target spirv-val
-
-      - name: Generate and validate synthetic SPIR-V
-        if: matrix.rid == 'linux-x64'
-        run: |
-          dotnet run --project tools/SharpEmu.Tools.ShaderDump/SharpEmu.Tools.ShaderDump.csproj -c Release -- artifacts/shader-dump
-          scripts/validate-synthetic-spirv.sh \
-            "$RUNNER_TEMP/spirv-tools-build/tools/spirv-val" \
-            "$SPIRV_TOOLS_VERSION" \
-            "$SPIRV_TARGET_ENV" \
-            artifacts/shader-dump
-
-      - name: Publish ${{ matrix.rid }} CLI
-        run: dotnet publish src/SharpEmu.CLI/SharpEmu.CLI.csproj -c Release -r ${{ matrix.rid }} --self-contained true --no-restore -p:PublishDir="$PUBLISH_DIR"
-
-      - name: Stage MoltenVK next to the build
-        if: matrix.rid == 'osx-x64'
-        run: scripts/fetch-macos-moltenvk.sh "$PUBLISH_DIR"
+          Compress-Archive -Path (Join-Path $env:PUBLISH_DIR '*') -DestinationPath $archivePath -CompressionLevel Optimal
 
       - name: Upload build artifact
         uses: actions/upload-artifact@v7
         with:
-          name: sharpemu-${{ matrix.rid }}-${{ needs.init.outputs.short-sha }}
-          path: ${{ env.PUBLISH_DIR }}
+          name: ${{ needs.init.outputs.artifact-name }}
+          path: ${{ env.RELEASE_DIR }}\${{ needs.init.outputs.archive-name }}
           if-no-files-found: error
-          include-hidden-files: true
 
   release:
     name: Publish GitHub Release
     needs:
       - init
       - build
-      - build-posix
-    # Versioned releases are immutable and tag-driven. Branch and manual runs
-    # still produce Actions artifacts without modifying a published release.
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-26.04
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Download build artifacts
+      - name: Download build artifact
         uses: actions/download-artifact@v8
         with:
+          name: ${{ needs.init.outputs.artifact-name }}
           path: release
 
-      - name: Package release assets
-        shell: bash
-        env:
-          SHORT_SHA: ${{ needs.init.outputs.short-sha }}
-          VERSION: ${{ needs.init.outputs.version }}
-        run: |
-          set -euo pipefail
-
-          win_dir="release/sharpemu-win-x64-${SHORT_SHA}"
-          linux_dir="release/sharpemu-linux-x64-${SHORT_SHA}"
-          macos_dir="release/sharpemu-osx-x64-${SHORT_SHA}"
-          for package_dir in "${win_dir}" "${linux_dir}" "${macos_dir}"; do
-            test -d "${package_dir}"
-          done
-
-          mkdir -p release-assets
-          (cd "${win_dir}" && zip -q -r "../../release-assets/sharpemu-${VERSION}-win-x64.zip" .)
-
-          chmod +x "${linux_dir}/SharpEmu" "${macos_dir}/SharpEmu"
-          tar -czf "release-assets/sharpemu-${VERSION}-linux-x64.tar.gz" -C "${linux_dir}" .
-          tar -czf "release-assets/sharpemu-${VERSION}-osx-x64.tar.gz" -C "${macos_dir}" .
-
-      - name: Build release notes
-        shell: bash
-        env:
-          MAX_COMMITS: 200
-          RELEASE_TAG: ${{ needs.init.outputs.release-tag }}
-          REPO_URL: ${{ github.server_url }}/${{ github.repository }}
-          SHORT_SHA: ${{ needs.init.outputs.short-sha }}
-          VERSION: ${{ needs.init.outputs.version }}
-        run: |
-          set -euo pipefail
-
-          previous_tag="$(git describe --tags --abbrev=0 --match 'v*' "${RELEASE_TAG}^" 2>/dev/null || true)"
-
-          if [ -n "${previous_tag}" ]; then
-            range="${previous_tag}..${RELEASE_TAG}"
-          else
-            range="${RELEASE_TAG}"
-          fi
-
-          git log --no-merges --reverse --pretty=tformat:"%H%x1f%h%x1f%s" "${range}" > commits.txt
-          total="$(wc -l < commits.txt)"
-
-          {
-            printf 'Automated SharpEmu v%s build for commit [`%s`](%s/commit/%s).\n\n' \
-              "${VERSION}" "${SHORT_SHA}" "${REPO_URL}" "${GITHUB_SHA}"
-
-            if [ -n "${previous_tag}" ]; then
-              printf '## Changes since %s\n\n' "${previous_tag}"
-            else
-              printf '## Changes\n\n'
-            fi
-
-            if [ "${total}" -eq 0 ]; then
-              printf '_No commits since %s._\n' "${previous_tag}"
-            else
-              head -n "${MAX_COMMITS}" commits.txt | while IFS=$'\x1f' read -r sha short subject; do
-                printf -- '- %s ([`%s`](%s/commit/%s))\n' "${subject}" "${short}" "${REPO_URL}" "${sha}"
-              done
-
-              if [ "${total}" -gt "${MAX_COMMITS}" ]; then
-                printf '\n_…and %s more commits._\n' "$((total - MAX_COMMITS))"
-              fi
-            fi
-
-            printf '\n'
-
-            if [ -n "${previous_tag}" ]; then
-              printf '**Full changelog**: %s/compare/%s...%s\n' "${REPO_URL}" "${previous_tag}" "${RELEASE_TAG}"
-            else
-              printf '**Full changelog**: %s/commits/%s\n' "${REPO_URL}" "${RELEASE_TAG}"
-            fi
-          } > release-notes.md
-
-          cat release-notes.md
-
-      - name: Create release
+      - name: Create or update release
         shell: bash
         env:
+          ARCHIVE_NAME: ${{ needs.init.outputs.archive-name }}
           GH_REPO: ${{ github.repository }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_NAME: ${{ needs.init.outputs.release-name }}
           RELEASE_TAG: ${{ needs.init.outputs.release-tag }}
         run: |
-          mapfile -t assets < <(find release-assets -maxdepth 1 -type f \( -name '*.zip' -o -name '*.tar.gz' \) | sort)
-          if [ "${#assets[@]}" -ne 3 ]; then
-            echo "Expected 3 release assets, found ${#assets[@]}." >&2
-            exit 1
-          fi
+          asset_path="release/${ARCHIVE_NAME}"
+          notes="Automated Windows build for commit ${GITHUB_SHA}."
 
           if gh release view "${RELEASE_TAG}" >/dev/null 2>&1; then
-            echo "Release ${RELEASE_TAG} already exists and will not be modified." >&2
-            exit 1
+            gh release upload "${RELEASE_TAG}" "${asset_path}" --clobber
+            gh release edit "${RELEASE_TAG}" --title "${RELEASE_NAME}" --notes "${notes}"
+          else
+            gh release create "${RELEASE_TAG}" "${asset_path}" \
+              --title "${RELEASE_NAME}" \
+              --notes "${notes}" \
+              --target "${GITHUB_SHA}"
           fi
-
-          gh release create "${RELEASE_TAG}" "${assets[@]}" \
-            --verify-tag \
-            --title "${RELEASE_NAME}" \
-            --notes-file release-notes.md

.gitignore

@@ -32,16 +32,8 @@ packages/
 .nuget/
 .dotnet-home/
 .cache/
-__pycache__/
-*.py[cod]
 
 .DS_Store
 Thumbs.db
 Desktop.ini
 ehthumbs.db
-
-.vs/
-.idea/
-.vscode/
-clean_test/
-.debug/

CONTRIBUTING.md

@@ -1,94 +0,0 @@
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-# Contributing
-
-> [!IMPORTANT]
-> The pull request template is mandatory.
->
-> Pull requests that do not follow the template or leave the required checklist incomplete will be closed without review, even if the proposed code is technically correct or beneficial. Please review these contribution guidelines before submitting a pull request.
-
-Contributions are always welcome!
-
-Before opening a pull request, please keep the following in mind:
-
-- Keep PRs small and focused on a single topic.
-- Discuss large architectural changes before implementing them.
-- Follow the project's existing coding style.
-- Do not submit generated code unless you fully understand and can maintain it.
-- Do not introduce Sony proprietary code, firmware, keys, decrypted assets, or other copyrighted PlayStation materials.
-- All reverse engineering should be based on publicly available information, clean-room techniques, or your own original research.
-- Game-specific hacks should be avoided whenever possible. Prefer generic implementations that improve overall compatibility.
-- New features should not break existing behavior.
-- Ensure the project builds successfully before submitting a PR.
-
-If you're unsure about a design decision, feel free to open a discussion or draft PR first.
-
-## Pull Request Expectations
-
-Pull requests should provide real, observable emulator behavior rather than only suppressing errors or unresolved imports.
-
-Changes that only return success, zero, or fabricated handles without implementing the expected state, output, or side effects will generally not be accepted. Functions that create resources, write output structures, register callbacks, or expose runtime state should model the behavior required by the guest.
-
-When applicable, PRs should include:
-
-- The affected game or application.
-- Relevant logs or failing imports.
-- Behavior before and after the change.
-- Real game testing and known limitations.
-
-Avoid submitting large collections of speculative NIDs or unrelated exports. Keep each PR focused on one problem or a closely related set of changes.
-
-Large architectural changes should be discussed with the maintainers before implementation. Contributors are encouraged to ask first when they are uncertain whether a proposed direction fits the project.
-
-Opening a PR does not guarantee that it will be merged. Maintainers evaluate changes based on correctness, evidence, testing, scope, maintenance cost, and the long-term direction of the project.
-
-## AI-Assisted Contributions
-
-AI-assisted development is welcome and may be used for research, reverse engineering, code generation, or documentation.
-
-However, contributors are expected to fully understand every line of code they submit. By opening a pull request, you confirm that you are able to explain, modify, debug, and maintain the submitted code without relying on the AI that generated it.
-
-When submitting an AI-assisted PR:
-
-- Clearly explain **what the change does**, **why it is needed**, and **what problem it solves**, using your own words.
-- Describe **how you verified the change**, including the games, applications, or test cases used.
-- Avoid excessive product-level logging. Use logging only when it provides meaningful diagnostic value.
-- Comments should document design decisions or implementation details in your own words. Avoid generic AI-generated comments that merely restate what the code already does.
-- Be prepared to answer review questions about the implementation. "The AI generated it" is not considered a sufficient explanation.
-- Large AI-generated changes without a clear understanding of the implementation are unlikely to be accepted.
-- If the implementation cannot be reasonably explained during code review, the pull request may be rejected regardless of whether it works.
-
-The quality, correctness, maintainability, and long-term ownership of the submitted code remain the responsibility of the contributor.
-
-## Coding Style
-
-SharpEmu follows a consistent coding style across the project. Please ensure your contributions match the existing style.
-
-- Use **4 spaces** for indentation (no tabs).
-- Use **2 spaces** for XML-based files (e.g. `.csproj`, `.props`, `.targets`, `.xml`, `yml`, GitHub workflow files where applicable).
-- Respect the project's `.editorconfig`.
-- Ensure every text file ends with a **single trailing newline**
-- Avoid formatting-only commits unless they are the purpose of the PR.
-- Keep naming, formatting, and file organization consistent with the surrounding code.
-- Prefer small, focused changes over large refactors.
-
-### REUSE Compliance
-
-This repository follows the REUSE Specification.
-
-Every new file must contain the appropriate SPDX license header. Pull requests that do not comply with the project's REUSE requirements will fail CI and will not be merged.
-
-### Recommended Development Environment
-
-The repository includes an `.editorconfig` and Visual Studio solution files.
-
-For the best experience, we recommend using:
-
-- Visual Studio Code with;
-  - C#
-  - C# Dev Kit
-
-Most editors that support `.editorconfig` will automatically apply the project's formatting rules.

Directory.Build.props

@@ -9,18 +9,10 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <SharpEmuVersion>0.0.5-nexus</SharpEmuVersion>
-    <Version>$(SharpEmuVersion)</Version>
+    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
 
     <RepoRoot>$([MSBuild]::NormalizeDirectory('$(MSBuildThisFileDirectory)'))</RepoRoot>
 
-    <_HostRidOSPrefix Condition="'$(RuntimeIdentifier)' == '' And '$(MSBuildProjectName)' == 'SharpEmu.CLI' And $([MSBuild]::IsOSPlatform('Windows'))">win</_HostRidOSPrefix>
-    <_HostRidOSPrefix Condition="'$(RuntimeIdentifier)' == '' And '$(MSBuildProjectName)' == 'SharpEmu.CLI' And '$(_HostRidOSPrefix)' == '' And $([MSBuild]::IsOSPlatform('Linux'))">linux</_HostRidOSPrefix>
-    <_HostRidOSPrefix Condition="'$(RuntimeIdentifier)' == '' And '$(MSBuildProjectName)' == 'SharpEmu.CLI' And '$(_HostRidOSPrefix)' == '' And $([MSBuild]::IsOSPlatform('OSX'))">osx</_HostRidOSPrefix>
-    <_HostRidArch Condition="'$(_HostRidOSPrefix)' != '' And '$([System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture)' == 'Arm64'">arm64</_HostRidArch>
-    <_HostRidArch Condition="'$(_HostRidOSPrefix)' != '' And '$(_HostRidArch)' == ''">x64</_HostRidArch>
-    <RuntimeIdentifier Condition="'$(_HostRidOSPrefix)' != ''">$(_HostRidOSPrefix)-$(_HostRidArch)</RuntimeIdentifier>
-
     <BaseIntermediateOutputPath>$(RepoRoot)artifacts/obj/$(MSBuildProjectName)/</BaseIntermediateOutputPath>
     <BaseOutputPath>$(RepoRoot)artifacts/bin/</BaseOutputPath>
 
@@ -40,18 +32,4 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <DebugType>none</DebugType>
     <DebugSymbols>false</DebugSymbols>
   </PropertyGroup>
-
-  <!-- Build provenance surfaced by SharpEmu.Logging.BuildInfo as a banner at the
-       top of the log. Populated from GitHub Actions environment variables when
-       building in CI; empty locally. -->
-  <ItemGroup>
-    <AssemblyMetadata Include="SharpEmu.BuildConfiguration" Value="$(Configuration)" />
-    <AssemblyMetadata Condition="'$(GITHUB_SHA)' != ''" Include="SharpEmu.BuildSha" Value="$(GITHUB_SHA)" />
-    <AssemblyMetadata Condition="'$(GITHUB_REF_NAME)' != ''" Include="SharpEmu.BuildBranch" Value="$(GITHUB_REF_NAME)" />
-    <AssemblyMetadata Condition="'$(GITHUB_REF)' != ''" Include="SharpEmu.BuildRef" Value="$(GITHUB_REF)" />
-    <AssemblyMetadata Condition="'$(GITHUB_EVENT_NAME)' != ''" Include="SharpEmu.BuildEventName" Value="$(GITHUB_EVENT_NAME)" />
-    <AssemblyMetadata Condition="'$(GITHUB_REPOSITORY)' != ''" Include="SharpEmu.BuildRepository" Value="$(GITHUB_REPOSITORY)" />
-    <AssemblyMetadata Condition="'$(GITHUB_SERVER_URL)' != ''" Include="SharpEmu.BuildServerUrl" Value="$(GITHUB_SERVER_URL)" />
-    <AssemblyMetadata Condition="'$(GITHUB_RUN_ID)' != ''" Include="SharpEmu.BuildRunId" Value="$(GITHUB_RUN_ID)" />
-  </ItemGroup>
 </Project>

Directory.Packages.props

@@ -1,34 +1,16 @@
-<!--
+<!--
 Copyright (C) 2026 SharpEmu Emulator Project
 SPDX-License-Identifier: GPL-2.0-or-later
 -->
+
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
   </PropertyGroup>
   <ItemGroup>
-    <PackageVersion Include="Avalonia" Version="12.1.0" />
-    <PackageVersion Include="Avalonia.Desktop" Version="12.1.0" />
-    <PackageVersion Include="Avalonia.Fonts.Inter" Version="12.1.0" />
-    <PackageVersion Include="Avalonia.Themes.Fluent" Version="12.1.0" />
-    <PackageVersion Include="FFmpeg.AutoGen" Version="7.1.1" />
     <PackageVersion Include="Iced" Version="1.21.0" />
-    <PackageVersion Include="Microsoft.Build.Framework" Version="17.14.8" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="3.11.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.12.0" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
-    <PackageVersion Include="NLayer" Version="1.14.0" />
-    <PackageVersion Include="ppy.SDL3-CS" Version="2026.629.0" />
     <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
-    <PackageVersion Include="Silk.NET.Vulkan.Extensions.EXT" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.KHR" Version="2.23.0" />
-    <!-- Reuse the font rasterizer already shipped with Avalonia.Skia. -->
-    <PackageVersion Include="SkiaSharp" Version="3.119.4" />
-    <PackageVersion Include="SkiaSharp.NativeAssets.Linux" Version="3.119.4" />
-    <PackageVersion Include="System.IO.Hashing" Version="10.0.0" />
-    <!-- Transitive of Avalonia.Desktop; pinned. Avalonia 12 requires 0.94.1+. -->
-    <PackageVersion Include="Tmds.DBus.Protocol" Version="0.94.1" />
-    <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.1" />
+    <PackageVersion Include="Silk.NET.Windowing" Version="2.23.0" />
   </ItemGroup>
 </Project>

LICENSES/Apache-2.0.txt

@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

LICENSES/MIT.txt

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2018 Alex Barney
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

REUSE.toml

@@ -7,26 +7,11 @@ path = [
     "global.json",
     "**/packages.lock.json",
     "scripts/ps5_names.txt",
-    "src/SharpEmu.GUI/Languages/**",
-    "src/SharpEmu.ShaderCompiler.Metal/Templates/**",
-    "tests/SharpEmu.ShaderCompiler.Metal.Tests/Goldens/**",
+    "src/SharpEmu.HLE/Aerolib/aerolib.bin",
     "_logs/**",
     ".github/images/**",
-    ".github/pull_request_template.md",
     "assets/images/**"
 ]
 precedence = "aggregate"
 SPDX-FileCopyrightText = "SharpEmu Emulator Project"
 SPDX-License-Identifier = "GPL-2.0-or-later"
-
-[[annotations]]
-path = "src/SharpEmu.GUI/Assets/Fonts/MaterialSymbolsRounded-*.ttf"
-precedence = "aggregate"
-SPDX-FileCopyrightText = "2026 Google LLC"
-SPDX-License-Identifier = "Apache-2.0"
-
-[[annotations]]
-path = "src/SharpEmu.LibAtrac9/**"
-precedence = "aggregate"
-SPDX-FileCopyrightText = "2018 Alex Barney"
-SPDX-License-Identifier = "MIT"

SharpEmu.slnx

@@ -5,24 +5,10 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
 <Solution>
   <Folder Name="/src/">
-    <Project Path="src/SharpEmu.LibAtrac9/SharpEmu.LibAtrac9.csproj" />
     <Project Path="src/SharpEmu.CLI/SharpEmu.CLI.csproj" />
     <Project Path="src/SharpEmu.Core/SharpEmu.Core.csproj" />
-    <Project Path="src/SharpEmu.DebugClient/SharpEmu.DebugClient.csproj" />
-    <Project Path="src/SharpEmu.Debugger/SharpEmu.Debugger.csproj" />
-    <Project Path="src/SharpEmu.GUI/SharpEmu.GUI.csproj" />
     <Project Path="src/SharpEmu.HLE/SharpEmu.HLE.csproj" />
     <Project Path="src/SharpEmu.Libs/SharpEmu.Libs.csproj" />
     <Project Path="src/SharpEmu.Logging/SharpEmu.Logging.csproj" />
-    <Project Path="src/SharpEmu.ShaderCompiler/SharpEmu.ShaderCompiler.csproj" />
-    <Project Path="src/SharpEmu.ShaderCompiler.Metal/SharpEmu.ShaderCompiler.Metal.csproj" />
-    <Project Path="src/SharpEmu.ShaderCompiler.Vulkan/SharpEmu.ShaderCompiler.Vulkan.csproj" />
-    <Project Path="src/SharpEmu.SourceGenerators/SharpEmu.SourceGenerators.csproj" />
-  </Folder>
-  <Folder Name="/tests/">
-    <Project Path="tests/SharpEmu.Libs.Tests/SharpEmu.Libs.Tests.csproj" />
-    <Project Path="tests/SharpEmu.ShaderCompiler.Metal.Tests/SharpEmu.ShaderCompiler.Metal.Tests.csproj" />
-    <Project Path="tests/SharpEmu.ShaderCompiler.Tests/SharpEmu.ShaderCompiler.Tests.csproj" />
-    <Project Path="tests/SharpEmu.SourceGenerators.Tests/SharpEmu.SourceGenerators.Tests.csproj" />
   </Folder>
 </Solution>

docs/aerolib-catalog.md

@@ -1,23 +0,0 @@
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-# Aerolib Catalog
-
-```bash
-# NID to export name
-python scripts/aerolib_catalog.py lookup Zxa0VhQVTsk
-
-# Export name to NID
-python scripts/aerolib_catalog.py lookup sceKernelWaitSema
-
-# A comma can be used for multiple query strings.
-python scripts/aerolib_catalog.py lookup Zxa0VhQVTsk,SaKib2Ug0yI,sceVideoOutOpen,amuBfI-AQc4
-
-# Search export names
-python scripts/aerolib_catalog.py search VideoOut --limit 20
-
-# Export all NID/name pairs to artifacts/aerolib.txt
-python scripts/aerolib_catalog.py export
-```

docs/bink2-bridge.md

@@ -1,66 +0,0 @@
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-# Bink 2 bridge
-
-Demon's Souls plays Bink 2 (.bk2) files through a Bink implementation linked
-directly into eboot.bin. It does not use libSceVideodec, therefore an HLE video
-decoder cannot observe or replace those frames.
-
-By default, SharpEmu leaves Bink decoding to the implementation linked into
-the game (`SHARPEMU_BINK_MODE=guest`).
-
-Set `SHARPEMU_BINK_MODE=native` to use the optional host bridge. It observes
-guest .bk2 opens and presents decoded frames at the guest-flip boundary. The
-host path decodes by calling FFmpeg's C API directly from managed
-code (`src/SharpEmu.Libs/Bink/FfmpegNativeBinkFrameSource.cs`, via the
-[FFmpeg.AutoGen](https://github.com/Ruslan-B/FFmpeg.AutoGen) P/Invoke
-bindings) against a custom FFmpeg build
-(`github.com/sharpemu/ffmpeg-core`, LGPL-2.1) that adds a Bink 2 decoder to
-FFmpeg 7.1.2; see "Supplying the FFmpeg libraries" below for where those
-libraries come from. No proprietary RAD SDK is needed to build or run
-SharpEmu, and there is no C/C++ code of SharpEmu's own involved in decoding
--- SharpEmu.CLI.csproj only downloads a prebuilt release archive.
-
-Set `SHARPEMU_BINK_MODE=skip` only when explicitly testing a title whose
-cinematics are optional.
-
-Set SHARPEMU_BINK_MODE=dummy to retain the open and show a built-in,
-non-decoded placeholder frame. This requires no SDK, but is a visual diagnostic
-only; it does not decode the movie or alter its game logic.
-`SHARPEMU_BINK_MODE=ffmpeg` is an alias for `native`.
-
-## Supplying the FFmpeg libraries
-
-Both `dotnet build` and `dotnet publish` fetch a prebuilt release of
-`github.com/sharpemu/ffmpeg-core` (the tag is pinned in
-`SharpEmu.CLI.csproj`'s `FfmpegRuntimeTag`, matched to the `FFmpeg.AutoGen`
-package version in `Directory.Packages.props` -- both need to agree on the
-same FFmpeg ABI) and copy its dynamically linked libraries into a `plugins`
-folder next to the resulting executable (`artifacts/bin/...` for build,
-`artifacts/publish/...` for publish). No C toolchain is required to build
-SharpEmu; both just download a zip once (cached under
-`$(BaseIntermediateOutputPath)ffmpeg-runtime/`, so later builds/publishes
-reuse it instead of re-fetching). `plugins` is a loose, unpacked folder
-rather than something embedded in the single-file bundle, so the OS loader
-can resolve the libraries' own inter-dependencies (`avcodec` depends on
-`avutil`, etc.) itself.
-
-A plain `dotnet build`/`dotnet publish` with no `-r` still works: it defaults
-to the host machine's own RID (see `Directory.Build.props`), so it fetches
-the matching `ffmpeg-core` archive and populates `plugins` without any extra
-flags. Passing an explicit `-r <rid>` (e.g. to cross-publish `linux-x64` from
-Windows) still overrides that default normally.
-
-To use a different set of FFmpeg libraries, drop them into the build or
-published `plugins` folder yourself (matching FFmpeg's own file-naming and versioning
-conventions, e.g. `avformat-61.dll` / `libavformat.so.61` / matching
-`.dylib`) -- `FfmpegNativeBinkFrameSource` points `ffmpeg.RootPath` at that
-folder and does not otherwise care where the files came from.
-
-If the libraries are absent or fail to load, `FfmpegNativeBinkFrameSource.TryOpen`
-degrades gracefully: SharpEmu logs one informational line ("Bink2 bridge
-could not open movie ...") and leaves the guest's own rendering path
-untouched, rather than crashing.

docs/compute-rejection-diagnostics.md

@@ -1,80 +0,0 @@
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-# Shader rejection diagnostics
-
-`SHARPEMU_STRICT_COMPUTE` controls the rejections listed below for compute dispatches
-and graphics draws. The existing variable name is retained; there is no separate
-`SHARPEMU_STRICT_DRAW` switch. Restart the game after a change. The pipeline cache and
-draw executor read the value when created.
-
-- Unset or `1`: stop on the rejection so that the failure can be diagnosed (default).
-- `0`: skip the affected dispatch or draw. Only this value enables skipping.
-
-The GUI provides this switch under **Environment > Debug**, globally and per game.
-It is on by default. Turning it off saves an explicit `0`; an inherited process
-environment value does not override the GUI choice. Other values retain strict mode.
-
-## Complete skip list
-
-With the switch set to `0`, these are the only handled rejection categories:
-
-| Rejection | Detection point | Operation skipped |
-| --- | --- | --- |
-| Resource-plan extraction throws `ResourcePlanException`, including an unsupported resource expression or a value graph that does not converge | `ShaderProgramCache.CreateEntry` | The dispatch or draw that needs the rejected shader |
-| Shader compilation returns failure or no compiled program, including an unsupported opcode reported by the compiler | `ShaderProgramCache.CompilePermutation` | The dispatch or draw that needs the rejected shader |
-| Indirect image candidates have incompatible image classes (`IncompatibleImageCandidates`) | `ResourceMaterializer.Materialize`, handled by `ShaderProgramCache` | The dispatch or draw that needs those resources |
-| Indirect image expansion exceeds the dense image resource limit (`ImageCapacityExceeded`) | `ResourceMaterializer.Materialize`, handled by `ShaderProgramCache` | The dispatch or draw that needs those resources |
-| A graphics texture's cached image type cannot support the requested view type, such as a 2D view of a 1D image | Vulkan `ValidateDrawImageTypes`, handled by `RenderExecutor.RecordDraw` | The whole indexed or automatic draw |
-
-The last category applies to vertex and pixel resource preparation, not compute
-image binding. It checks available, non-stale cache entries and excludes host movie
-textures. A mismatch detected later in binding remains fatal.
-
-The draw image-type check runs before resource binding and draw recording. Skip mode
-does not create an invalid view or issue the rejected draw. The preparation scope is
-released, and the caller resets the image bindings before the next operation.
-
-## Failures that remain fatal
-
-- Shader decoding failures and invalid shader source reads.
-- Unreadable resource memory, invalid indirect table state, and materialization failures
-  other than the two named categories above.
-- Invalid binding layouts or invalid resource snapshot state.
-- Other image checks, including format, usage, aspect, component mapping, and range
-  checks reached during binding or view creation. The image cache checks are unchanged.
-- Image-type mismatches in compute binding or outside the graphics preparation check.
-- Host allocation failures, device loss, synchronization failures, and unexpected exceptions.
-
-This is not a general exception bypass. Setting the switch to `1` also makes every
-category in the skip list fatal. Supported operations use the same path in both modes.
-
-## Warnings and test limits
-
-Program rejections log `COMPUTE_SKIPPED` or `DRAW_SKIPPED` once per stage, shader hash,
-and code size in each pipeline cache. Draw image-type rejections log `DRAW_SKIPPED`
-once per shader hash, image type, and view type in each draw executor. Warning counts
-are not skipped-operation counts. No rejected permutation is recorded as compiled;
-a later request can retry it.
-
-A skipped operation does not produce its outputs. Missing images, incorrect results,
-later errors, and stalls are possible. FPS can rise because less work is executed.
-Skip-mode smoke tests can check progress and expose other defects, but must record
-the skip warnings. They do not close the skipped defects or establish a final visual
-or performance baseline. This switch does not restore the old renderer.
-
-## PowerShell
-
-Enable strict testing in PowerShell:
-
-```powershell
-$env:SHARPEMU_STRICT_COMPUTE = '1'
-```
-
-Explicitly enable skip mode:
-
-```powershell
-$env:SHARPEMU_STRICT_COMPUTE = '0'
-```

docs/debugger-server.md

@@ -1,177 +0,0 @@
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-# Live debug server
-
-SharpEmu can expose a **live debug server** so an external process can inspect
-and control a running guest over TCP. The server lives in the emulator; the
-companion `SharpEmu.DebugClient` executable is one client, and the wire protocol
-is simple enough to script against directly.
-
-This document describes the moving parts and the wire protocol. For day-to-day
-client usage, see
-[`src/SharpEmu.DebugClient/DEVELOPER_READ.md`](../src/SharpEmu.DebugClient/DEVELOPER_READ.md).
-
-## Layering
-
-| Assembly | Role |
-| -------- | ---- |
-| `SharpEmu.Core` | Defines the dispatcher seam `ICpuDebugHook` / `ICpuDebugFrame` (namespace `SharpEmu.Core.Cpu.Debug`) and the `CpuExecutionOptions.DebugHook` slot. Core has **no** reference to the debugger. |
-| `SharpEmu.Debugger` | The debugger: `DebuggerSession` (implements the hook), `BreakpointStore`, the TCP `DebuggerServer`, the pluggable `IDebugProtocol` with a JSON-lines implementation, and the `DebuggerServerHost` one-call wiring. |
-| `SharpEmu.CLI` | Parses `--debug-server`, builds a `DebuggerServerHost`, hands its `Hook` to `SharpEmuRuntimeOptions.DebugHook`, and manages its lifetime. |
-| `SharpEmu.DebugClient` | A standalone client executable. Depends only on the BCL. |
-
-The dependency direction is important: Core stays debugger-agnostic and only
-publishes the seam. Anything that observes execution implements
-`ICpuDebugHook` and is injected through the options, so the debugger can evolve
-without touching the CPU core.
-
-## Execution model
-
-`CpuDispatcher` enters a fresh frame for the process entry point and for each
-module initializer. When a `DebugHook` is attached it is notified at those
-boundaries:
-
-- `OnFrameEnter(frame)` — before the native backend runs the frame. The
-  `DebuggerSession` decides whether to stop (pause request, breakpoint on the
-  entry address, single-step, or stop-at-entry). To stop, it **parks the
-  emulation thread** inside this call on a gate; the frame stays live, so a
-  client can read and write registers and memory while parked. `continue` /
-  `step` release the gate.
-- `OnFrameExit(frame, result)` — after the frame completes.
-
-Because pausing parks the one thread that owns the guest context, register and
-memory accessors are only served while the session reports `Paused`; otherwise
-they return "not paused" so a client never observes torn state.
-
-### What is and isn't live yet
-
-- **Live:** attach/handshake, run-state tracking, register read/write, memory
-  read/write, breakpoint management, execution breakpoints at frame entry,
-  pause, frame-level step, continue, and stop/resume/terminate events.
-- **Surface only (armed as the backend grows hooks):** per-instruction
-  stepping and data watchpoints (`readwatch` / `writewatch` / `accesswatch`).
-  The verbs and types exist so clients and tooling can be written now.
-
-## Enabling the server
-
-```bash
-SharpEmu --debug-server "/path/to/eboot.bin"            # 127.0.0.1:5714
-SharpEmu --debug-server=0.0.0.0:5714 "/path/to/eboot.bin"
-```
-
-The bind address defaults to loopback; a routable address must be given
-explicitly. With stop-at-entry (the default `DebuggerSessionOptions.StopAtEntry`),
-the guest parks at its first frame until a client connects and issues
-`continue`, giving you a window to set breakpoints before any guest code runs.
-
-## Browser frontend
-
-The dependency-free Python frontend can choose and launch an `eboot.bin`, attach
-to its debugger automatically, and provides execution controls, registers,
-memory inspection, breakpoint management, process output, and a live protocol
-activity stream:
-
-```bash
-./tools/SharpEmu.DebuggerFrontend/run.sh
-```
-
-It connects to `127.0.0.1:5714` and opens `http://127.0.0.1:8765/` by default.
-See [`tools/SharpEmu.DebuggerFrontend/README.md`](../tools/SharpEmu.DebuggerFrontend/README.md)
-for configuration and testing options.
-
-## Wire protocol (json-lines/1)
-
-One JSON object per line, UTF-8, `\n`-terminated, in both directions.
-
-### Requests
-
-A `command` string plus command-specific fields. Numeric fields accept a JSON
-number or a `0x`-prefixed hex string.
-
-| `command` | Fields | Reply `data` |
-| --------- | ------ | ------------ |
-| `ping` | — | — |
-| `status` (`info`) | — | `state`, `breakpoints`, `lastStop?` |
-| `state` | — | `state` |
-| `registers` (`regs`) | — | `registers` (rax..r15, rip, rflags, fs_base, gs_base) |
-| `set-register` | `register`, `value` | — |
-| `read-memory` | `address`, `length` (≤ 65536) | `address`, `length`, `bytes` (hex) |
-| `write-memory` | `address`, `bytes` (hex) | `written` |
-| `list-breakpoints` (`breakpoints`) | — | `breakpoints[]` |
-| `add-breakpoint` (`break`) | `address`, `kind?`, `length?` | `breakpoint` |
-| `remove-breakpoint` (`delete-breakpoint`) | `id` | — |
-| `enable-breakpoint` | `id`, `enabled?` (default true) | — |
-| `continue` (`cont`, `c`) | — | — |
-| `step` (`s`) | — | — |
-| `pause` | — | — |
-
-### Replies
-
-```json
-{"ok":true,"command":"registers","data":{ "registers": { "rax":"0x…", … } }}
-{"ok":false,"command":"read-memory","error":"Target is not paused."}
-```
-
-### Events (unsolicited)
-
-```json
-{"event":"hello","protocol":"json-lines/1","state":"Paused"}
-{"event":"stopped","reason":"Breakpoint","address":"0x…","frameKind":"ProcessEntry","frameLabel":"eboot.bin","registers":{…},"breakpoint":{…}}
-{"event":"resumed"}
-{"event":"terminated"}
-```
-
-`reason` is one of `EntryPoint`, `Breakpoint`, `Watchpoint`, `Step`, `Pause`,
-`Fault`, or `Stall`.
-
-Stall stops include structured evidence in addition to the human-readable
-detail. Import-loop evidence identifies the NID, resolved HLE export, repeating
-guest return site, dispatch count, and first two ABI arguments:
-
-```json
-{
-  "event": "stopped",
-  "reason": "Stall",
-  "stall": {
-    "kind": "ImportLoop",
-    "nid": "9UK1vLZQft4",
-    "instructionPointer": "0x0000000801CE2418",
-    "dispatchIndex": 40667904,
-    "argument0": "0x0000000812345000",
-    "argument1": "0x0000000000000000",
-    "resolved": true,
-    "library": "libKernel",
-    "function": "scePthreadMutexLock"
-  }
-}
-```
-
-The Python frontend uses this evidence to explain the likely failure class and
-rank concrete checks/fixes. Its diagnosis is intentionally labelled heuristic:
-it helps locate the responsible HLE/scheduler path but does not replace tracing.
-
-## Swapping the protocol
-
-`DebuggerServer` takes an `IDebugProtocol` factory. The default is
-`JsonLineDebugProtocol`; a GDB remote serial stub (or any other framing) can be
-dropped in without changing the session or command semantics, which live in
-`DebugCommandDispatcher`.
-
-## Embedding the server
-
-```csharp
-using SharpEmu.Debugger;
-using SharpEmu.Core.Runtime;
-
-await using var host = new DebuggerServerHost();
-host.Start();
-
-var options = new SharpEmuRuntimeOptions { DebugHook = host.Hook };
-using var runtime = SharpEmuRuntime.CreateDefault(options);
-var result = runtime.Run(ebootPath);
-
-host.NotifyRunCompleted();
-```

docs/guest-write-watch.md

@@ -1,57 +0,0 @@
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-# Guest write watch
-
-`GuestWriteWatch` is an optional diagnostic tool. It helps you find managed
-code and HLE code that damage guest memory. The tool starts only if you set one
-or more `SHARPEMU_WATCH_*` environment variables.
-
-The tool monitors writes through the SharpEmu managed virtual-memory APIs. It
-does not monitor stores that native guest code makes directly. Use a platform
-debugger or a hardware watchpoint to monitor these stores.
-
-## Watch modes
-
-- `SHARPEMU_WATCH_WRITE=0x<address>` logs a write that overlaps the eight-byte
-  block at the specified guest address.
-- `SHARPEMU_WATCH_POOL_HEADER=1` monitors the pointer at offset `0x40`. It
-  monitors the first 64 direct mappings that have a size of 64 KiB and
-  protection value `0xF2`.
-- `SHARPEMU_WATCH_VALUE_PATTERN=1` logs an eight-byte write if its lower 32 bits
-  are `1`. The upper 32 bits must look like a small guest-pointer prefix.
-- `SHARPEMU_WATCH_VALUE1=1` logs short writes of value `1` in the high guest
-  memory range. The tool logs a maximum of 128 entries for each process.
-- `SHARPEMU_WATCH_BULK_TORN=1` scans aligned 64-bit words in bulk writes. It
-  finds damaged pointer patterns and byte-shifted pointer patterns. The tool
-  logs a maximum of 64 entries for each process.
-- `SHARPEMU_WATCH_BULK_DEST_HI=0x<high-dword>` scans only writes that have the
-  specified upper 32 bits in the destination address.
-
-For each match, the tool logs the destination address, the data pattern, and the
-managed call stack. The log uses the `watch_write` or `watch_bulk_torn` warning
-tag.
-
-Use these variables together to scan bulk writes in the
-`0x00000080xxxxxxxx` region.
-
-macOS and Linux:
-
-```sh
-SHARPEMU_WATCH_BULK_TORN=1 \
-SHARPEMU_WATCH_BULK_DEST_HI=0x80 \
-SharpEmu /path/to/eboot.bin
-```
-
-Windows PowerShell:
-
-```powershell
-$env:SHARPEMU_WATCH_BULK_TORN = "1"
-$env:SHARPEMU_WATCH_BULK_DEST_HI = "0x80"
-& .\SharpEmu.exe C:\path\to\game\eboot.bin
-```
-
-To reduce unnecessary log entries, use an exact `SHARPEMU_WATCH_WRITE`
-address from a crash dump.

docs/performance-overlay.md

@@ -1,54 +0,0 @@
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-# Performance display
-
-Open **Options → Rendering**, globally or for one game.
-
-- **Performance display:** start with statistics on or off.
-- **Display mode:** Full shows all counters and the frame graph. Minimal shows
-  guest FPS, process CPU usage, process GPU usage, and elapsed session time.
-  Title bar shows the same minimal values in the window title.
-- **Screen corner:** choose any of the four corners. This setting applies only
-  to the on-screen panel.
-
-F1 toggles the display for the current run. F2 cycles clockwise through the
-screen corners. Neither key changes saved settings. The next run uses the saved
-options again. Command+F1 retains its separate Metal HUD shortcut.
-
-`SHARPEMU_OVERLAY=0` starts the display hidden, even when the saved option is on.
-F1 can still show it. RenderDoc's F12 hint remains in the title when available.
-The operating system does not show a title bar in borderless/fullscreen modes.
-
-The launcher passes these options to the game process, including when a separate
-emulator path is configured:
-
-```text
---overlay=on|off
---overlay-mode=full|minimal|titlebar
---overlay-corner=topleft|topright|bottomright|bottomleft
-```
-
-## Usage values
-
-The panel dimensions are separate constants in `PerfOverlay.cs`:
-`PanelWidth` / `PanelHeight` for Full, and
-`MinimalPanelWidth` / `MinimalPanelHeight` for Minimal. Both heights are fixed;
-the renderer clips the panel only when the window is too small.
-
-CPU usage is the emulator process's CPU time divided by wall time and the
-number of logical processors. GPU usage is the busiest GPU engine used by the
-emulator process, not GPU memory usage or total usage by all applications.
-
-Windows supplies the GPU Engine performance counters. Collection runs off the
-render thread and uses the existing statistics refresh interval. Rate counters
-need two samples. Missing counters, unavailable samples, and other platforms
-show **N/A**, not zero. No GPU waits or presentation delays are added.
-
-The full panel keeps cache memory counters and puts CPU/GPU usage on a separate
-line above elapsed time and the Vulkan allocation counters.
-
-The counter interpretation follows [Microsoft's GPU utilization description](https://devblogs.microsoft.com/directx/gpus-in-the-task-manager/).
-Wildcard samples use [PdhGetFormattedCounterArray](https://learn.microsoft.com/en-us/windows/win32/api/pdh/nf-pdh-pdhgetformattedcounterarrayw).

docs/release-use.md

@@ -1,90 +0,0 @@
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-## Release Script
-
-SharpEmu releases are prepared and published using `scripts/release.py`.
-
-The release process consists of two steps:
-
-1. Prepare the version bump through a pull request.
-2. Create and push the release tag after the pull request has been merged.
-
-### Preparing a Release
-
-Run:
-
-```bash
-python scripts/release.py prepare 0.0.2-beta.2
-```
-
-This command will:
-
-- Verify that the working tree is clean.
-- Update the local `main` branch.
-- Create a new branch named `release/0.0.2-beta.2`.
-- Update `SharpEmuVersion` in `Directory.Build.props`.
-- Create a version bump commit.
-- Push the release branch to the remote repository.
-
-Afterwards, open a pull request from:
-
-```text
-release/0.0.2-beta.2
-```
-
-into:
-
-```text
-main
-```
-
-### Publishing a Release
-
-Once the pull request has been merged, update your local repository:
-
-```bash
-git switch main
-git pull --ff-only
-```
-
-Then create and push the release tag:
-
-```bash
-python scripts/release.py tag 0.0.2-beta.2
-```
-
-This command will:
-
-- Verify that the working tree is clean.
-- Confirm that `Directory.Build.props` contains the requested version.
-- Create an annotated Git tag (`v0.0.2-beta.2`).
-- Push the tag to the remote repository.
-
-Pushing the tag automatically triggers the GitHub Release workflow.
-
-### Version Format
-
-Specify the version **without** the `v` prefix.
-
-Examples:
-
-```text
-0.0.2
-0.0.2-alpha.1
-0.0.2-beta.1
-0.0.2-beta.2
-0.0.2-rc.1
-```
-
-The script automatically prefixes the Git tag with `v`.
-
-### Notes
-
-- Run `prepare` only from the `main` branch.
-- Run `tag` only after the version bump pull request has been merged.
-- Do not create release tags manually before merging the version bump.
-- Both commands require a clean working tree.
-- The version in `Directory.Build.props` must exactly match the version passed to the `tag` command.

docs/sharpemu-gui-undocumented-env-vars.md

@@ -1,433 +0,0 @@
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-# SharpEmu: environment variables that are not on the GUI options pages
-
-## Scope
-
-This list contains each `SHARPEMU_*` environment variable in the repository that the GUI does not show.
-The GUI shows 14 variables on its **Options** and **Game options** pages. This list does not contain them:
-`SHARPEMU_BTHID_UNAVAILABLE`, `SHARPEMU_CRASH_CAPTURE`, `SHARPEMU_DEFAULT_PROFILE`,
-`SHARPEMU_DISABLE_IMPORT_LOOP_GUARD`, `SHARPEMU_DUMP_SPIRV`, `SHARPEMU_LOG_DIRECT_MEMORY`, `SHARPEMU_LOG_IO`,
-`SHARPEMU_LOG_NP`, `SHARPEMU_PROFILE_PERFORMANCE`, `SHARPEMU_PROFILE_PERFORMANCE_FRAME_TRACE`,
-`SHARPEMU_RENDERDOC`, `SHARPEMU_VK_DISABLE_IMPLICITS`, `SHARPEMU_STRICT_COMPUTE`, `SHARPEMU_VK_VALIDATION`, `SHARPEMU_WRITABLE_APP0`.
-
-The list contains 269 variables. The source was examined on 2026-09-19, branch `dev`.
-The descriptions come from the code that reads each variable. The emulator was not started for this list.
-
-## How to use a variable
-
-1. Set the variable in the shell before you start the emulator or the GUI.
-2. You can also enter additional env vars using the button next to the "Play" button from GUI.
-3. The GUI also accepts a variable in the `EnvironmentToggles` list of its settings file. Write `NAME` or `NAME=value`. An entry without a value gets the value `1`.
-4. The emulator reads most variables one time, when it starts. Start the game again after a change.
-5. If the **Value** column shows `1`, only the value `1` turns the function on, unless the row gives other values.
-
-## Number of variables in each group
-
-| Group | Variables |
-| --- | --- |
-| Behavior switches | 19 |
-| GPU and Vulkan | 59 |
-| Metal | 10 |
-| Audio and video | 6 |
-| Input | 5 |
-| Memory and CPU | 19 |
-| Loader | 11 |
-| Debugger | 1 |
-| Log channels | 72 |
-| Traces | 25 |
-| Data dumps | 12 |
-| Performance measurement | 17 |
-| Internal | 1 |
-| Tests and tools | 12 |
-
-## Behavior switches
-
-These variables change how the emulator operates.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_AGC_VERSION13_DEFAULTS` | text (`legacy`, `generic` or `0`) | Selects the register defaults for AGC version 13 requests. The default uses the version 11 compact tables. The values `legacy`, `generic` and `0` use the older generic layout. | `AgcExports.Init.cs` |
-| `SHARPEMU_DISABLE_LLE_LIBC` | `1` | Stops the use of the guest libc module for libc exports. The emulator then uses its HLE handlers for these exports. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_HLE_FAST_MEMCPY` | `0` | Set to `0` to stop the native fast-path stub for the guest libc `memcpy` and `memmove`, so those imports use the managed HLE gateway again. | `DirectExecutionBackend.FastPath.cs` |
-| `SHARPEMU_HLE_FAST_PATH` | `0` | Set to `0` to stop the native fast-path stubs for `pthread_self` and `pthread_getspecific`, so those imports use the managed HLE gateway again. The stubs are on by default on macOS x64 and are off on any run that traces imports or pthreads. | `DirectExecutionBackend.FastPath.cs` |
-| `SHARPEMU_HOLD_FIRST_FLIP_MS` | number | Stops the thread that submits the flip for this number of milliseconds on one guest flip. The range is 0 to 60000 and the default is 0 (off). `SHARPEMU_HOLD_FLIP_NUMBER` selects the flip. | `VideoOutExports.cs` |
-| `SHARPEMU_HOLD_FLIP_NUMBER` | number | Selects the guest flip that `SHARPEMU_HOLD_FIRST_FLIP_MS` holds. The minimum is 1 and the default is 1 (the first flip). | `VideoOutExports.cs` |
-| `SHARPEMU_IGNORE_GUEST_EXCEPTIONS` | `1` | `sceKernelRaiseException` returns OK and does not call the installed guest exception handler. Default is off. | `KernelExceptionCompatExports.cs` |
-| `SHARPEMU_IMPORT_LOOP_GUARD_SECONDS` | number | When `SHARPEMU_DISABLE_IMPORT_LOOP_GUARD=0` enables the guard, sets how long an import call pattern can repeat before a guest exit. The default is 5 seconds; 0 turns the guard off. | `DirectExecutionBackend.Imports.cs`, `DirectExecutionBackend.cs` |
-| `SHARPEMU_NET_REDIRECT` | IP address | Sends guest `connect` and `sendto` traffic to this host IP address. When unset, the emulator permits outbound guest traffic only to loopback addresses. If the value is not a valid IP address, the emulator keeps the original destination and permits the traffic. | `KernelSocketCompatExports.cs` |
-| `SHARPEMU_NO_FLIP_PACING` | `1` | Stops flip pacing. The emulator completes each flip immediately and does not wait for the display refresh time. The default is off. | `VideoOutExports.cs`, `VideoOutExports.FlipRequests.cs` |
-| `SHARPEMU_OVERLAY` | `0` | Hides the performance overlay at start, even when the video options have the overlay on. All other values use the video options. | `PerfOverlay.cs`, `PerformanceOverlayState.cs` |
-| `SHARPEMU_POSIX_GPU_FAULT_FAST_PATH` | `0` | Set to `0` to stop the POSIX fault bridge from offering GPU-tracked page faults to the GPU memory tracker before it builds the Win64 exception context. The fault then takes the full handler order again. | `DirectExecutionBackend.PosixSignals.cs` |
-| `SHARPEMU_RETAIN_SUBMITTED_INDEX_DATA` | `0` | The default is on. The emulator keeps a copy of submitted index data until the translated draws run. Set to `0` to stop this copy. Use `0` only for a comparison test. | `AgcExports.SubmittedGeometry.cs` |
-| `SHARPEMU_RETAIN_SUBMITTED_VERTEX_DATA` | `0` | The default is on. The emulator keeps a copy of submitted vertex data until the translated draws run. Set to `0` to stop this copy. Use `0` only for a comparison test. | `AgcExports.SubmittedGeometry.cs` |
-| `SHARPEMU_SAVEDATA_DIR` | path | Set the root directory for save data. The default is `user/savedata` next to the executable. When this variable is set, the emulator does not move save data from the old layout. | `SaveDataStorage.cs`, `SaveDataExports.cs` |
-| `SHARPEMU_STALL_WATCHDOG_SECONDS` | number (seconds) | Sets the time without import progress before the stall watchdog operates. The default is 20. The watchdog writes a snapshot and stops the process with exit code 4. It does not operate when a guest thread is ready or a known wait is in progress. `0` stops the watchdog. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_STRICT_RWLOCK_WRITER_PREFERENCE` | `1` | Set to `1` to make a guest thread take a free pthread rwlock as the exclusive writer. By default, the thread gets a compatibility writer record and the lock has no writer thread. | `KernelPthreadExtendedCompatExports.cs` |
-| `SHARPEMU_TEMP0_DIR` | path | Set the host directory for the guest `temp0` mount. The default is `user/temp/<app name>/temp0` next to the executable. When unset, the kernel code sets this variable to the default path. | `AppContentExports.cs`, `KernelMemoryCompatExports.cs` |
-| `SHARPEMU_TRACE_TITLE_SHADER_STATE` | `1` | The SPIR-V translator changes the pixel shader at address 0x0000000500781200 for diagnosis. The first float output then shows the execution state, the wave mask state, and the export state as colors. Default is off. | `Gen5SpirvTranslator.cs` |
-
-## GPU and Vulkan
-
-These variables change the GPU path or the Vulkan presenter.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_ASYNC_GUEST_READBACK` | `0` | `0` makes a guest thread that reads GPU-written buffer memory wait until the render thread has copied the data back. The default starts the copy on the render thread and lets the guest thread wait for it on a separate readback slot, so the render thread continues. | `GuestBufferCache.cs` |
-| `SHARPEMU_CAPTURE_PIXEL_EXEC_PCS` | list (`pc:register` pairs) | At each given instruction PC, the pixel shader writes the execution flag to the given VGPR register. The value is 1.0 when the flag is set and 0.0 when it is not. `SHARPEMU_CAPTURE_PIXEL_VGPR_ADDRESS` must match the shader address. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_CAPTURE_PIXEL_IMAGE_ADDRESS` | hex address | Selects the pixel shader for the image capture by its program address. The default is no capture. Use it with `SHARPEMU_CAPTURE_PIXEL_IMAGE_PC`. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_CAPTURE_PIXEL_IMAGE_PC` | number (instruction PC) | Sets the image instruction whose result the SPIR-V translator copies to four VGPR registers. `SHARPEMU_CAPTURE_PIXEL_IMAGE_ADDRESS` must match the shader address. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_CAPTURE_PIXEL_IMAGE_VGPR_BASE` | number (0 to 252) | Sets the first VGPR register that receives the captured image components. The default is 248. Values above 252 use the default. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_CAPTURE_PIXEL_VGPR_ADDRESS` | hex address | Selects the pixel shader for the VGPR capture, execution capture and path marker functions by its program address. The default is no capture. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_CAPTURE_PIXEL_VGPR_DEST_BASE` | number (0 to 252) | Sets the first destination VGPR register for `SHARPEMU_CAPTURE_PIXEL_VGPR_SOURCES`. The default is 248. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_CAPTURE_PIXEL_VGPR_IGNORE_EXEC` | `1` | Makes the VGPR capture copies occur without the execution flag guard. The default applies the guard. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_CAPTURE_PIXEL_VGPR_PC` | number (instruction PC) | Sets the instruction PC at which the translator copies the source VGPR registers. `SHARPEMU_CAPTURE_PIXEL_VGPR_ADDRESS` must match the shader address. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_CAPTURE_PIXEL_VGPR_POINTS` | list (`pc:source:destination` triples) | At each given instruction PC, the pixel shader copies the source VGPR register to the destination register. Register numbers must be less than 256. `SHARPEMU_CAPTURE_PIXEL_VGPR_ADDRESS` must match the shader address. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_CAPTURE_PIXEL_VGPR_SOURCES` | list (one to four register numbers) | Gives the source VGPR registers that the translator copies at `SHARPEMU_CAPTURE_PIXEL_VGPR_PC`. The copies go to the registers that start at the destination base. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_DETILE` | `1` or `0` | Controls the detile step for tiled surfaces. The default detiles only the trusted swizzle modes. `1` also detiles the approximate modes and `0` uploads all surfaces as raw data. | `GnmTiling.cs` |
-| `SHARPEMU_DISABLE_FILL_CLEAR` | `1` | Stops the adaptation that treats a transparent premultiplied fill draw as a target overwrite. The default keeps the adaptation on. | `ShaderPipelineCache.Adaptations.cs` |
-| `SHARPEMU_ENABLE_CHUNKED_DRAWS` | `1` | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_FORCE_ATTRIBUTE_FRAGMENT` | number (attribute location) | The Vulkan presenter reads the number into a field. No code uses the field, so the variable has no effect. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_FORCE_DEFAULT_RASTER_STATE` | `1` | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_FORCE_FULLSCREEN_PIPELINE` | `1` | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_FORCE_FULLSCREEN_VERTEX` | `1` | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_FORCE_PACKED_EXPORT_ONE` | `1` | The SPIR-V translator replaces each packed half-float export component with the constant 1.0. This applies to all shaders. Default is off. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_PACKED_EXPORT_STORE_ONE` | `1` | The SPIR-V translator writes (1.0, 1.0) to the packed half-float pair before the export reads it. This applies only to the pixel shader at guest address 0x0000000500781200. Default is off. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_PACKED_STORE_EXEC_VALUES` | `1` | Each packed half-float store writes 1.0 when the EXEC mask is active and 0.5 when it is not. This shows the EXEC state as a color. This applies only to the pixel shader at guest address 0x0000000500781200. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_PIXEL_EXPORT_ADDRESS` | hex address | Sets the shader address filter for the pixel export debug overrides. The value is a hex address, and the `0x` prefix is optional. When unset, the overrides apply to all pixel shaders. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_PIXEL_EXPORT_PACK_VGPR_BASE` | number | Float pixel outputs read four vector registers that start at this base plus four times the export target. The translator packs the values to half-float and unpacks them again. The address filters select the shaders. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_PIXEL_EXPORT_VGPR_ADDRESS` | hex address | Sets the shader address filter for the two VGPR base overrides. The `0x` prefix is optional. When unset, the filter from `SHARPEMU_FORCE_PIXEL_EXPORT_ADDRESS` applies. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_PIXEL_EXPORT_VGPR_BASE` | number | Float pixel outputs read four vector registers that start at this base plus four times the export target. These values replace the decoded export sources. The address filters select the shaders. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_PIXEL_MAGENTA` | `1` | Each selected pixel shader export writes opaque magenta. The control flow, EXEC mask, geometry and raster state stay the same. Use `SHARPEMU_FORCE_PIXEL_EXPORT_ADDRESS` to select one shader. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_SOLID_FRAGMENT` | `1` | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect at this time. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_FORCE_TITLE_COMPARE_4D4` | `1` | The compare instruction at shader PC 0x4D4 always gives the result true. This applies only to the shader at guest address 0x0000000500781200. Default is off. | `Gen5SpirvTranslator.Alu.cs` |
-| `SHARPEMU_FORCE_TITLE_COMPARE_540` | `1` | The compare instruction at shader PC 0x540 always gives the result true. This applies only to the shader at guest address 0x0000000500781200. Default is off. | `Gen5SpirvTranslator.Alu.cs` |
-| `SHARPEMU_FORCE_TITLE_DEFAULT_RASTER_STATE` | `1` | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect at this time. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_FORCE_TITLE_EARLY_COLOR` | `1` | The pixel shader at guest address 0x0000000500781200 writes a constant to its first output and returns at once. A float output gets opaque magenta. An integer output gets zero. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_TITLE_EXPORT_EXEC` | `1` | The translator sets the EXEC mask to true and writes 1 to 64-bit register 126 before each pixel export store. This applies only to the pixel shader at guest address 0x0000000500781200. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_TITLE_FULLSCREEN_VERTEX` | `1` | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect at this time. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_FORCE_TITLE_SINGLE_MRT` | `1` | The translator declares only the first pixel output for the pixel shader at guest address 0x0000000500781200. It does not declare the other render target outputs. Default is off. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_FORCE_TITLE_SOLID_FRAGMENT` | `1` | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect at this time. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_FORCE_TITLE_VERTEX_OUTPUTS_ONE` | `1` | Vertex export targets 32 to 35 write the vector (1, 1, 1, 1). This applies only to the vertex shader at guest address 0x0000000500780000. Default is off. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_GPU_BACKEND` | `vulkan` or `metal` | Selects the guest GPU backend. The default is Vulkan. The value `metal` works only on macOS, and other hosts show a warning and use Vulkan. | `GuestGpu.cs` |
-| `SHARPEMU_GPU_WAIT_SPIN_US` | number (microseconds) | Sets how long a wait for GPU work polls before it blocks. A short poll saves the wake-up delay when the GPU finishes soon. `0` blocks at once. The default is 150. | `GpuWaitSpin.cs` |
-| `SHARPEMU_GRAPHICS_SUBGROUPS` | `0` or `1` | Set `1` to use native Vulkan subgroup operations in graphics shaders. Set `0` to use the fallback path. When unset, the presenter uses them only if the subgroup size is 32 and the vertex and fragment stages support subgroups. | `VulkanVideoPresenter.cs`, `VulkanVideoPresenter.Device.Setup.cs` |
-| `SHARPEMU_IMAGE_LOOKUP_MEMO` | `0` | `0` turns off the image lookup memo. The default keeps the result of each image lookup that found an image with the same backing, and gives it again for the same request until an image is registered or removed. | `GuestImageCache.Lookup.cs` |
-| `SHARPEMU_MARK_PIXEL_PCS` | list of `pc:register` pairs | Makes the SPIR-V pixel shader write the float value 1.0 to a shader register when execution reaches the given instruction PC. Use decimal numbers, a register below 256, and a comma between pairs. It has an effect only for the shader address in `SHARPEMU_CAPTURE_PIXEL_VGPR_ADDRESS`. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_MAX_GUEST_WORK_PER_RENDER` | number | Sets the maximum number of guest command stream slices that the Vulkan presenter runs in one render pass. The default is 1024, or 256 on macOS. The value must be more than 0. | `VulkanVideoPresenter.cs`, `VulkanVideoPresenter.CommandStream.cs` |
-| `SHARPEMU_RENDERDOC_CAPTURE_TIMEOUT_SECONDS` | number (seconds) | Set the maximum time for a RenderDoc frame capture. The emulator discards a capture that does not end in this time. The range is 1 to 120. The default is 15. | `RenderDocCapture.cs` |
-| `SHARPEMU_RENDERDOC_DLL` | path | Set the path of the RenderDoc library file. The emulator tries this path first. When unset or when the load fails, it searches the default library name and the known install paths. | `RenderDocCapture.cs` |
-| `SHARPEMU_RENDERDOC_WAIT` | number (seconds) or `enter` | Set to make the emulator wait before it starts Vulkan, so that you can attach RenderDoc. `enter` waits until you press Enter. A number waits that many seconds, from 1 to 300. Other text waits 15 seconds. | `VulkanVideoPresenter.Device.Setup.cs` |
-| `SHARPEMU_RENDER_WORK_BUDGET_MS` | number (milliseconds) | Set the maximum time that one render call uses for queued guest work in the Vulkan presenter. Work that remains stays in the queue for the next frame. `0` removes the limit. The default is 12 on macOS and 0 on other hosts. | `VulkanVideoPresenter.cs`, `VulkanVideoPresenter.RenderLoop.cs` |
-| `SHARPEMU_RESOURCE_PREFETCH` | `0` | `0` makes the shader resource materialization read each guest word one at a time. The default reads adjacent words of descriptors and the flattened resource table in one read of resident guest memory. A range that the GPU may still own is read word by word as before. | `ShaderProgramCache.cs`, `RawReadPrefetch.cs` |
-| `SHARPEMU_SHADER_MAX_STEPS` | number | Set the maximum number of dispatcher loop steps in each translated shader invocation. The limit makes sure that an incorrect loop stops. `0` removes the limit. The default is 100000. | `Gen5SpirvTranslator.cs`, `Gen5MslTranslator.cs` |
-| `SHARPEMU_SHADER_PREWARM` | `0` | `0` turns off the shader prewarm list. By default, each compute program that a game compiles is added at once to `shader-prewarm.bin` in `user/pipeline_cache/<title id>/`, so a stopped game keeps the list. At the next launch after a change of the shader translator or of the GPU driver, background threads translate the listed programs again and create their pipelines, so that the driver compiles them before the game asks for them. The `shader-prewarm.stamp` file names the build and driver that last did this; with the same build and driver, the launch does no prewarm work. The log shows `Shader prewarm done` and `Shader prewarm hits`. On Windows it replaces the cache file by default; on Linux it works beside the cache file. It has no effect with the per-shader cache files of `SHARPEMU_VK_PIPELINE_CACHE_SHARDS`. | `VulkanVideoPresenter.ShaderPrewarm.cs`, `ShaderPrewarmList.cs`, `ShaderProgramCache.cs` |
-| `SHARPEMU_SKIP_ALL_COMPUTE` | `1` | Set to `1` to make the Metal presenter skip all compute dispatches. The Vulkan presenter reads the value but does not use it. The default is off. | `MetalVideoPresenter.Compute.cs`, `VulkanVideoPresenter.cs` |
-| `SHARPEMU_SKIP_TALL_COMPUTE_Z` | number | Effect not clear from the code. The Vulkan presenter reads the number into a field for a minimum Z group count. No code uses that field. The default is 0. | `VulkanVideoPresenter.cs` |
-| `SHARPEMU_SRT_NATIVE` | `0` | `0` turns off the compiled shader resource (SRT) evaluator. By default, the resource plan of each shader is compiled once to .NET code (`DynamicMethod`) on a low-priority background thread named `SRT compiler`; until it is ready, the plan is evaluated by the interpreter, so the first use of a new shader does not wait for the compilation. With `0`, every plan always uses the interpreter. The compiled path is also off when the runtime does not support dynamic code, for example in a Native AOT build. | `CompiledResourceEvaluator.cs`, `ShaderResourcePlan.cs`, `RuntimeValueEvaluator.cs` |
-| `SHARPEMU_SUSPEND_POINTS_IN_FLIGHT` | `0` | `0` makes `sceAgcSuspendPoint` wait until the frame boundary it queued is processed. The default lets one boundary wait behind the graphics commands, so the guest CPU can run one frame ahead. A wait that follows its own queue's store to the same label still sees that value when the title rewrites the label for the next frame (Dead Cells). | `CommandStreamQueue.cs`, `GpuCommandInterpreter.cs` |
-| `SHARPEMU_VK_DEBUG_LABELS` | `1` | Turns on Vulkan object names and command labels for capture tools. `SHARPEMU_VK_VALIDATION=1` also turns them on. Default is off because the labels add overhead to each draw. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_VK_DEVICE` | text (part of a device name) | Selects the Vulkan device whose name contains this text. The comparison ignores case. When unset, the presenter gives a score to each device and prefers a discrete GPU. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanVideoPresenter.cs` |
-| `SHARPEMU_VK_PIPELINE_CACHE_PATH` | path | Sets the path of the Vulkan pipeline cache file. The path can contain environment variables. Default is `user/pipeline_cache/<title id>/` below the application directory. The shader prewarm list goes to the same directory. With the per-shader cache, the files go to a `.shards` directory next to this path. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanPipelineCacheStorage.cs` |
-| `SHARPEMU_VK_PIPELINE_CACHE` | `0`, `1` or `file` | Selects the Vulkan pipeline cache file, which keeps the driver's compiled pipelines. `1` or `file` saves and loads one cache file. `0` keeps the cache in memory only on every system. The default is memory only on Windows: the GPU driver keeps its own shader cache on disk, and the shader prewarm list (`SHARPEMU_SHADER_PREWARM`) rebuilds it after an update. Linux keeps a cache file by default, and macOS keeps per-shader files. | `VulkanVideoPresenter.Device.Setup.cs` |
-| `SHARPEMU_VK_PIPELINE_CACHE_SHARDS` | `1` or `0` | `1` keeps one Vulkan pipeline cache file for each compute shader and for each vertex and pixel shader pair, in `vulkan-pipeline-cache.bin.shards`, also on Windows. `0` keeps the whole cache in one file. The default is `1` on macOS and `0` on other systems: NVIDIA adds about 2 MB of driver data to every cache file, so a file for each shader uses much more disk. A shard file loads when its pipeline is first created, and a save writes only the files that got new pipelines. The shard mode removes the old single file when `SHARPEMU_VK_PIPELINE_CACHE_PATH` is not set. A cache file that grows over 256 MiB is emptied, so the next launch starts it again. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanVideoPresenter.PipelineCacheShards.cs` |
-| `SHARPEMU_VK_PIPELINE_CACHE_LEGACY_SHARDS` | `1` | `1` names the per-shader cache files by the guest shader hash. The default names them by a hash of the translated SPIR-V, so a translator change does not load records that no longer match. | `VulkanVideoPresenter.PipelineCacheShards.cs` |
-
-## Metal
-
-These variables apply to the Metal backend.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_GPU_DETILE` | `0` | The Metal backend decodes supported tiled texture data on the GPU by default. Set `0` to decode all tiled textures on the CPU. | `MetalTextureSnapshots.cs`, `GuestGpuTypes.cs` |
-| `SHARPEMU_LOG_GPU_DETILE` | `1` | Writes each texture tile mode and each GPU detile decision one time to stderr. It applies to the Metal texture path only. The emulator reads the value one time at start. | `MetalTextureSnapshots.cs` |
-| `SHARPEMU_METAL_CAP_DRAWABLE` | `1` | Limits the long edge of the Metal drawable to 1920 pixels and keeps the aspect ratio. The default is off, so the drawable uses the full window pixel size. | `MetalVideoPresenter.cs` |
-| `SHARPEMU_METAL_DBG` | `solid` or `uv` | Replaces the Metal present fragment shader with a test shader. `solid` shows a green frame. `uv` shows the value of vertex attribute 0. All other values use the normal present shader. | `MetalVideoPresenter.cs` |
-| `SHARPEMU_METAL_FULL_DRAWABLE` | `1` | Cancels `SHARPEMU_METAL_CAP_DRAWABLE=1`, so the Metal drawable uses the full window pixel size. It has no effect when the cap is off. | `MetalVideoPresenter.cs` |
-| `SHARPEMU_NO_TEXTURE_SKIP` | `1` | Stops the reuse of cached texture snapshots in the Metal backend, so each texture is copied again. Use it to make sure that a snapshot is not stale. The default is off. | `MetalTextureSnapshots.cs` |
-| `SHARPEMU_REUSE_GUEST_TEXTURE_SNAPSHOTS` | `0` | The default is on. The Metal backend uses a guest texture snapshot again when the snapshot key is the same. Set to `0` to make a new snapshot each time. | `MetalTextureSnapshots.cs` |
-| `SHARPEMU_TEXTURE_DUMP_DIR` | path | Set a directory to make the Metal backend write raw texture source bytes to `.bin` files. The file name contains the address, size, pitch, format and tile mode. The limit is 200 files. | `MetalTextureSnapshots.cs` |
-| `SHARPEMU_TEXTURE_LINEAR_DUMP_DIR` | path | Set a directory to make the Metal backend write the linear texture bytes to `.linear.bin` files. The file name contains the address, size, pitch, format and tile mode. The limit is 200 files. | `MetalTextureSnapshots.cs` |
-| `SHARPEMU_TRACE_STORAGE_IMAGE_INIT_ADDRESS` | hex address | The Metal backend writes an `agc.storage_initial_data` trace line when it makes the texture at this guest address. The line shows the upload state and the read result of the initial data. | `MetalTextureSnapshots.cs` |
-
-## Audio and video
-
-These variables apply to audio output and video playback.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_ALSA_DEVICE` | text (ALSA device name) | Sets the ALSA playback device on Linux. The default is `default`. | `PosixAlsaAudioStream.cs` |
-| `SHARPEMU_AUDIO_LATENCY_MS` | number (milliseconds) | Sets the target depth of the SDL audio queue, which is the playback latency. The default is 60. Values of zero or less use the default. | `SdlHostAudio.cs` |
-| `SHARPEMU_BINK_MODE` | text (`native`, `ffmpeg`, `dummy`, `skip`, `guest`) | Selects how the emulator handles Bink movies. `native` or `ffmpeg` decodes on the host and is the default. `dummy` shows a placeholder frame, `skip` skips the movie, and `guest` lets the guest decode. | `HostMovieBridge.cs` |
-| `SHARPEMU_LOG_MOVIE_SYNC` | `1` | Records the difference between the movie clock and the guest audio position during movie playback. The emulator reads the value one time at start. | `MediaFramePlayback.cs` |
-| `SHARPEMU_MOVIE_CLOCK` | `wall` | Sets the time base for host-decoded movie playback. By default, playback follows the guest audio clock and uses the wall clock when no guest audio flows. `wall` makes playback always use the wall clock. | `MediaFramePlayback.cs` |
-| `SHARPEMU_TRACE_AVPLAYER_IMAGES` | `1` | Set to `1` to write `[AVPLAYER][TRACE]` lines for video buffer addresses and the first 16 video frame payloads. It also marks the video buffer ranges for image traces in other components. The default is off. | `AvPlayerExports.cs` |
-
-## Input
-
-These variables apply to the controller and input libraries.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_AUTO_CROSS` | list (seconds, for example `40,52,64`) | Presses the Cross button for 0.4 seconds at each time in the list. The times are seconds from process start. The default is no automatic press. | `PadExports.cs` |
-| `SHARPEMU_BTHID_CB_FAIL` | text (`nf` or `ni`) | Makes `sceBluetoothHidRegisterCallback` return an error. `nf` returns NOT_FOUND and `ni` returns NOT_IMPLEMENTED. The default returns the usual result. | `BluetoothHidExports.cs` |
-| `SHARPEMU_BTHID_EVENT_CODE` | number (decimal or `0x` hex) | Sets the event code of the synthetic Bluetooth HID callback event. The default is 0. It has an effect only with `SHARPEMU_BTHID_FIRE_CALLBACK=1`. | `BluetoothHidExports.cs` |
-| `SHARPEMU_BTHID_EVENT_SIZE` | number (bytes, decimal or `0x` hex) | Sets the size of the zeroed event structure for the synthetic Bluetooth HID callback. The default is 256. It has an effect only with `SHARPEMU_BTHID_FIRE_CALLBACK=1`. | `BluetoothHidExports.cs` |
-| `SHARPEMU_BTHID_FIRE_CALLBACK` | `1` | Calls the registered Bluetooth HID guest callback one time with a zeroed event structure. The call occurs at the first `sceBluetoothHidRegisterDevice`. The default is off. | `BluetoothHidExports.cs` |
-
-## Memory and CPU
-
-These variables apply to guest memory and guest code execution.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_DISABLE_GUEST_ALLOCATOR_HOLE_RECOVERY` | `1` | Stops the Windows fault recovery for a guest allocator that reads an empty pool node. The default recovers the fault and continues at the allocator fallback code. | `DirectExecutionBackend.Exceptions.cs` |
-| `SHARPEMU_DISABLE_MITIGATION_RELAUNCH` | `1` | Stops the Windows relaunch of the emulator as a child process with Control Flow Guard and CET shadow stacks off. The default starts the child process. | `Program.cs`, `SelfLoader.cs` |
-| `SHARPEMU_DISABLE_NATIVE_GUEST_WORKERS` | `1` | Stops the use of native worker threads for guest thread execution on Windows. The default uses the native workers. | `DirectExecutionBackend.NativeWorker.cs` |
-| `SHARPEMU_DISABLE_POSIX_SIGNALS` | `1` | Does not install the POSIX signal handlers on Linux and macOS. The emulator then cannot recover guest faults. | `DirectExecutionBackend.PosixSignals.cs` |
-| `SHARPEMU_DISABLE_RAW_HANDLER` | `1` | Does not install the raw vectored exception handler on Windows. On POSIX hosts it stops the raw sentinel recovery. The default keeps the two functions on. | `DirectExecutionBackend.Exceptions.cs`, `DirectExecutionBackend.PosixSignals.cs` |
-| `SHARPEMU_IGNORE_INT41` | `0` or `false` | The fault handler skips guest `int 0x41` instructions and continues at the next instruction by default. Set `0` or `false` to stop this recovery. The emulator shows a warning for the first 16 traps and then for each 65536th trap. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Exceptions.cs` |
-| `SHARPEMU_IGNORE_STACK_CHK` | `1` | Recovers from a guest stack-protector failure call (NID `Ou3iL1abvng`) when a UD2 instruction follows the call. The emulator sets the return address to the function epilogue 20 bytes before. It does this only when the code bytes match the known pattern. | `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LAZY_RESERVE_PRIME_MB` | number | Sets the number of megabytes that the emulator commits at the start of each reserve-only memory region. The default is 64 and the maximum is 4096. The value 0 turns the initial commit off. | `PhysicalVirtualMemory.cs` |
-| `SHARPEMU_NATIVE_WORKER_MAX_CONCURRENT` | number | Sets the maximum number of native guest worker runs that execute at the same time. The default is 2. The emulator limits the value to the range 1 to 64. | `DirectExecutionBackend.NativeWorker.cs`, `DirectExecutionBackend.cs` |
-| `SHARPEMU_GUEST_AFFINITY` | `1` | Applies the guest thread affinity to the host threads. The default leaves host threads unpinned, because pinning let spinning guest workers starve the render thread. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_RENDER_CORE` | `0` | `0` turns off the render core reservation. On Windows hosts with 8 to 64 logical processors, the default gives the render thread the last physical core of the fastest efficiency class with a high priority, and keeps guest threads off that core. | `HostLaneReservation.cs`, `VulkanVideoPresenter.Present.cs`, `DirectExecutionBackend.cs` |
-| `SHARPEMU_RESERVED_HOST_LANES` | number | Set the number of host logical processors that guest thread affinity does not use. The emulator keeps these processors for its own threads. The default is three eighths of the processor count, with a minimum of 2. It has an effect only with `SHARPEMU_GUEST_AFFINITY=1`. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_TSC_FREQ_HZ` | number (Hz, minimum 1000000) | Sets the TSC frequency that the kernel library reports to the guest. When unset, the emulator uses the calibrated RDTSC frequency, then the CPUID frequency, then the host stopwatch frequency. | `KernelRuntimeCompatExports.cs` |
-| `SHARPEMU_WATCH_BULK_DEST_HI` | hex number | Limits the `SHARPEMU_WATCH_BULK_TORN` scan to writes whose upper 32 address bits equal this value. When unset, the scan uses the direct-memory address band. | `GuestWriteWatch.cs` |
-| `SHARPEMU_WATCH_BULK_TORN` | `1` | Examines each aligned 8-byte value in managed bulk writes to guest memory. It reports torn values and shifted pointer values with a stack trace. It writes a maximum of 64 reports for each kind. | `GuestWriteWatch.cs` |
-| `SHARPEMU_WATCH_POOL_HEADER` | `1` | Monitors the header slot at offset 0x40 of each pool mapping with size 0x10000 and protection 0xF2. It reports each managed write to a monitored slot with a stack trace. It monitors a maximum of 64 slots. | `GuestWriteWatch.cs` |
-| `SHARPEMU_WATCH_VALUE1` | `1` | Reports managed writes of 1 to 8 bytes that have the value 1 and go to the direct-memory address band. Each report has a stack trace. It writes a maximum of 128 reports. | `GuestWriteWatch.cs` |
-| `SHARPEMU_WATCH_VALUE_PATTERN` | `1` | Reports each managed 8-byte write whose low half is 1 and whose high half is between 1 and 0xFFFF. Each report has a stack trace. | `GuestWriteWatch.cs` |
-| `SHARPEMU_WATCH_WRITE` | hex address | Monitors the 8 bytes at this guest address. It reports each managed write that touches these bytes with the address, the length, the first value, and a stack trace. Default is off. | `GuestWriteWatch.cs` |
-
-## Loader
-
-These variables apply to the program loader and the module system.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_AMPR_INDEX_CACHE` | path (directory) | Sets the directory for the AMPR file index cache. The default is `SharpEmu/ampr-index` in the local application data folder. | `AmprFileRegistry.cs` |
-| `SHARPEMU_AMPR_REINDEX` | `1` | Ignores the AMPR index cache on disk and scans the application file tree again. Use it after manual changes to the application files. | `AmprFileRegistry.cs` |
-| `SHARPEMU_APP0_DIR` | path (directory) | Sets the host directory for the guest `/app0` mount. The default is the directory of the loaded executable. The directory name also identifies the per-application data folders. | `SharpEmuRuntime.cs`, `KernelMemoryCompatExports.cs`, `AppContentExports.cs` |
-| `SHARPEMU_DEVLOG_APP_DIR` | path (directory) | Sets the host directory for the guest devlog application path. The default is `user/game_logs/<title id>/devlog/app` below the emulator directory. | `KernelMemoryCompatExports.cs` |
-| `SHARPEMU_DISABLE_RED_ZONE_PATCH` | `1` | Stops the load-time patch that protects the guest stack red zone on Windows and macOS. The default applies the patch. The vector store split for Rosetta stays on when it is necessary. | `GuestRedZonePatcher.cs` |
-| `SHARPEMU_DOWNLOAD0_DIR` | path (directory) | Sets the host directory for the guest `/download0` mount. The default is a `download0` folder in the per-application writable directory. The emulator sets the variable to the default when it is not set. | `KernelMemoryCompatExports.cs` |
-| `SHARPEMU_GUEST_ARGS` | text | Adds arguments to the guest process entry frame after the image name. White space divides the arguments. The emulator uses only the first two. | `CpuDispatcher.cs` |
-| `SHARPEMU_HOSTAPP_DIR` | path | Sets the host directory for the guest `/hostapp` mount. The default is `user/game_logs/<title id>/hostapp` below the emulator directory. The emulator makes the directory if it is absent. | `KernelMemoryCompatExports.cs`, `KernelGameLogPathTests.cs` |
-| `SHARPEMU_LLE_LIBC_ALL` | `1` | Sends all libc imports to the guest libc module and not to the HLE handlers. `SHARPEMU_DISABLE_LLE_LIBC=1` and `SHARPEMU_LLE_LIBC_SAFE_ONLY=off` have priority. Default is off. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_LLE_LIBC_SAFE_ONLY` | `1`, `0`, `off`, `false` or `none` | Controls which libc imports use the guest libc module. Unset or `1` uses guest code only for exports on the safe list. `0` uses guest code for all libc exports, and `off`, `false` or `none` uses HLE for all of them. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_PRELOAD_ALL_SCE_MODULES` | `1` | Set to `1` to preload all system modules. When unset, the runtime does not preload the modules in its internal skip list. | `SharpEmuRuntime.cs` |
-
-## Debugger
-
-These variables apply to the debug server.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_SENTINEL_PROBE` | `1` | Set to `1` to call the native entry stub with the unresolved sentinel address 0xFFFE before the guest entry. The emulator writes a log line before and after the call. The default is off. | `DirectExecutionBackend.cs`, `Gen5NativeReturnSmokeTests.cs` |
-
-## Log channels
-
-Each variable adds one group of messages to the log. The default is off.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_LOG_ACM` | `1` | Writes `acm.` trace lines from the Acm library handlers to stderr. Default is off. | `AcmExports.cs` |
-| `SHARPEMU_LOG_AGC_SHADER` | `1` | Writes only the AGC shader trace lines and the Vulkan shader trace lines. `SHARPEMU_LOG_AGC=1` also turns this on. Default is off. | `AgcExports.cs`, `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_LOG_AGC` | `1` | Starts the full AGC trace: command submissions, shader creation, draws and dispatches. It also turns on the AGC shader trace and the Vulkan shader trace. Default is off. | `AgcExports.cs`, `RenderExecutor.Trace.cs`, `AgcExports.ShaderState.cs` |
-| `SHARPEMU_LOG_AJM` | `1` | Writes `ajm.` trace lines to stderr: context initialization, codec registration, split buffer descriptors and ATRAC9 decode state. Default is off. | `AjmExports.cs`, `Atrac9DecodeState.cs` |
-| `SHARPEMU_LOG_ALLOC_IMPORTS` | `1` | Writes more trace lines for `sceKernelGetGPI` (the returned mask) and for the PRT aperture set call (the raw register values). Default is off. | `KernelRuntimeCompatExports.cs` |
-| `SHARPEMU_LOG_ALL_IMPORTS` | `1` | Writes a debug line for each import stub during setup. The lines show if the import uses a direct bridge, a trampoline, HLE or a runtime symbol. Default is off. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_LOG_AMPR_READS` | `1` | Writes only the AMPR file read trace lines and the pak directory tracker lines. `SHARPEMU_LOG_AMPR=1` also turns this on. Default is off. | `AmprExports.cs`, `PakDirectoryTracker.cs` |
-| `SHARPEMU_LOG_AMPR` | `1` | Writes trace lines for AMPR command buffers, APR submissions and waits, and the pak directory tracker. It also turns on the AMPR read trace. Default is off. | `AmprExports.cs`, `KernelAprCompatExports.cs`, `PakDirectoryTracker.cs` |
-| `SHARPEMU_LOG_APP_CONTENT` | `1` | Writes an `app_content` trace line to stderr for each AppContent call. The default is off. | `AppContentExports.cs` |
-| `SHARPEMU_LOG_AUDIO_OUT2` | `1` | Writes an `audio_out2` trace line to stderr for each AudioOut2 operation. The default is off. | `AudioOut2Exports.cs` |
-| `SHARPEMU_LOG_AUDIO_OUT` | `1` | Records `sceAudioOutOutput` calls and the peak amplitude of the submitted samples. It writes the first 8 calls and then every 200th call. The emulator reads the value one time at start. | `AudioOutExports.cs` |
-| `SHARPEMU_LOG_BOOTSTRAP` | `1` | Writes a trace line for each call through the bootstrap bridge import. The line shows the handle, the symbol name and the output address. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_CONTEXT` | `1` | Writes `guest_context` trace lines to stderr. Each import dispatch shows the NID, the return address, the managed thread, the guest thread and the fiber. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_DATA_REBIND` | `1` | Writes one `[RUNTIME]` line for each imported data relocation. The line shows if the relocation is rebound, unresolved or write-failed. | `SharpEmuRuntime.cs` |
-| `SHARPEMU_LOG_DISCMAP` | `1` | Writes a trace line for each DiscMap call. The line shows the export name, the path, the offset and the size. | `DiscMapExports.cs` |
-| `SHARPEMU_LOG_DISCORD` | `1` | Writes `[DISCORD]` messages from the rich presence client of the GUI to stderr. The default is off. | `DiscordRichPresence.cs` |
-| `SHARPEMU_LOG_DLSYM` | `1` | Writes a trace line for each successful `sceKernelDlsym` call. The line shows the module handle, the symbol name and the resolved address. | `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_EQUEUE` | `1` | Writes trace lines for kernel event queue operations. The emulator reads the value one time at start. | `KernelEventQueueCompatExports.cs` |
-| `SHARPEMU_LOG_EVENT_FLAG` | `1` | Writes trace lines for kernel event flag operations. The emulator reads the value one time at start. | `KernelEventFlagCompatExports.cs` |
-| `SHARPEMU_LOG_EXPECTED_IMPORT_RESULTS` | `1` | Shows import error results that the emulator knows as usual, for example file-not-found probes, timeouts and busy trylocks. It shows the first 8 results for each NID and result, and then every 10000th. The default hides these results. | `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_FIBER` | `1` | Writes `fiber` trace lines for the Fiber library calls. It also writes a line for each fiber context transfer in the CPU backend. | `FiberExports.cs`, `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_FILE` | path | Writes all log entries to this file with timestamps and appends to an existing file. The file receives every log level. `SHARPEMU_LOG_LEVEL` then limits only the console output. | `SharpEmuLog.cs` |
-| `SHARPEMU_LOG_FMOD` | `1` | Writes a trace line for the FMOD `system_set_output` compatibility call. The line shows the system address, the output type and the call count. | `FmodCompatExports.cs` |
-| `SHARPEMU_LOG_GUARDS` | `1` | Writes a trace line for each C++ static guard operation. The line shows the guard address, the guard word, the state flags and the owner thread. | `CxxAbiExports.cs` |
-| `SHARPEMU_LOG_GUEST_EXCEPTIONS` | `1` | Writes `guest_exception` trace lines when the emulator raises and delivers a guest exception. The lines show the target thread and the exception type. | `DirectExecutionBackend.cs`, `KernelExceptionCompatExports.cs` |
-| `SHARPEMU_LOG_GUEST_THREADS` | `1` | Writes guest thread scheduler messages to stderr. The messages show thread state changes, yields, wakes, exits, nested callbacks and affinity failures. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs`, `KernelRuntimeCompatExports.cs` |
-| `SHARPEMU_LOG_GUEST_THREAD_SNAPSHOTS` | `1` | Writes one snapshot line for each guest thread every second. The line shows the state, the import count, the last NID, the last return address and the block reason. The ready-dispatch thread then wakes every second. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_LOG_HTTP2` | `1` | Writes an `http2` trace line for each Http2 library call. The line shows the operation, the id and four arguments. | `Http2Exports.cs` |
-| `SHARPEMU_LOG_HTTP` | `1` | Writes an `http` trace line for each Http library call. The line shows the operation, the id and four arguments. | `HttpExports.cs` |
-| `SHARPEMU_LOG_IO_FILTER` | text | Limits the `SHARPEMU_LOG_IO` output to paths that contain this text. The comparison ignores case. When unset, the emulator shows all paths. | `KernelMemoryCompatExports.cs` |
-| `SHARPEMU_LOG_JSON` | `1` | Writes a `json` trace line for each Json library call. Text values show a maximum of 128 characters. | `JsonExports.cs` |
-| `SHARPEMU_LOG_LAZY_COMMIT` | `1` | Writes a trace line for every lazy memory commit fault. The default shows only the first 16 faults and then every 256th fault. | `DirectExecutionBackend.Exceptions.cs` |
-| `SHARPEMU_LOG_LEVEL` | text | Sets the minimum log level. The values are `Trace`, `Debug`, `Info`, `Warning` or `Warn`, `Error`, `Critical` or `Fatal`, and `None`. The default is `Info`, and the comparison ignores case. | `SharpEmuLog.cs` |
-| `SHARPEMU_LOG_LIBC_ALLOC` | `1` | Writes a trace line for each guest libc allocation call. The line shows the size, the alignment, the result address and the return address of the caller. | `KernelMemoryCompatExports.cs` |
-| `SHARPEMU_LOG_NET` | `1` | Writes `net` trace lines for Net library calls and debug lines for kernel socket operations. It also writes each payload that the guest sends on a connected socket to stdout as text. | `NetExports.cs`, `KernelSocketCompatExports.cs` |
-| `SHARPEMU_LOG_NGS2` | `1` | Writes trace lines for Ngs2 audio library calls. The default is off. | `Ngs2Exports.cs` |
-| `SHARPEMU_LOG_NO_COLOR` | `1` | Stops the use of colors in the console log. The values `1`, `true`, `yes` and `on` are accepted. The console log has no colors when the output is redirected. | `SharpEmuLog.cs` |
-| `SHARPEMU_LOG_NP_WEB_API2` | `1` | Writes an `npwebapi2` trace line for each NpWebApi2 call. The line shows the operation, the id, the first argument and the initialized state. | `NpWebApi2Exports.cs` |
-| `SHARPEMU_LOG_OPEN` | `1` | Writes trace lines for guest file open operations to stderr. The default is off. | `KernelMemoryCompatExports.cs` |
-| `SHARPEMU_LOG_PLAYGO` | `1` | Writes `playgo` trace lines for PlayGo calls. For single-entry locus queries it shows the first 32 calls and then every 1000th call. | `PlayGoExports.cs` |
-| `SHARPEMU_LOG_POINTER_WINDOW_SIZE` | hex number | Sets the byte size of each memory window that `SHARPEMU_LOG_POINTER_WINDOWS` shows after a guest fault. The value is hexadecimal, with or without `0x`. The default is 0x80. | `DirectExecutionBackend.Exceptions.cs` |
-| `SHARPEMU_LOG_POSIX_SIGNALS` | `1` | Writes a trace line for every POSIX signal that the fault handler receives. When unset, the log shows only the first 16 signals and then every 1024th signal. | `DirectExecutionBackend.PosixSignals.cs` |
-| `SHARPEMU_LOG_PROC_PARAM_PTRS` | `1` | Shows the pointer fields in the process parameter block. This dump is part of the `SHARPEMU_LOG_PROC_PARAM` trace, so set that variable also. | `KernelRuntimeCompatExports.cs` |
-| `SHARPEMU_LOG_PROC_PARAM` | `1` | Shows the address and the contents of the process parameter block of the guest program. The default is off. | `KernelRuntimeCompatExports.cs` |
-| `SHARPEMU_LOG_PS5_USER_SLOTS` | `1` | Adds four 0x60-byte memory dumps to the IL2CPP exception diagnostic. The dumps start at the fixed guest address 0x801A73110 and have a step of 0x51C8 bytes. | `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_PSML` | `1` | Writes `psml.` trace lines for the PSML library calls to stderr. The default is off. | `PsmlExports.cs` |
-| `SHARPEMU_LOG_PTHREADS` | `1` | Writes trace lines for the pthread calls of the guest. It also starts the condition variable trace of `SHARPEMU_LOG_PTHREAD_CONDS`. The default is off. | `KernelPthreadCompatExports.cs`, `KernelExports.cs` |
-| `SHARPEMU_LOG_PTHREAD_CONDS` | `1` | Writes a `pthread_cond_` trace line for each condition variable operation. The line shows the waiter count, the signal epoch, and the result. | `KernelPthreadCompatExports.cs` |
-| `SHARPEMU_LOG_PTHREAD_FASTPATH` | `1` | Writes trace lines for the mutex fast path. It shows the first 16 fast-path unlocks with the mutex object words. It shows one busy result for each mutex address. | `KernelPthreadCompatExports.cs` |
-| `SHARPEMU_LOG_PTHREAD_MUTEX_FILTER` | list of hex addresses | Limits the mutex trace to the given mutex addresses. Use a comma, a semicolon, or a space between the hexadecimal addresses. The listed mutexes are in the trace even if `SHARPEMU_LOG_PTHREADS` is not set. | `KernelPthreadCompatExports.cs` |
-| `SHARPEMU_LOG_REFSCAN_ADDRS` | list of hex addresses | After a guest fault, scans executable guest memory from 0x800000000 to 0x810000000 for instructions that refer to the given addresses. It shows a maximum of 24 hits for each address. Use a comma between the hexadecimal addresses. | `DirectExecutionBackend.Exceptions.cs` |
-| `SHARPEMU_LOG_REGISTER_WINDOWS` | `1` | After a guest fault, shows a 0x80-byte memory window at each general register value that is 0x10000 or more. The default is off. | `DirectExecutionBackend.Exceptions.cs` |
-| `SHARPEMU_LOG_SAVEDATA` | `1` | Writes `savedata.` and `save_data_dialog.` trace lines for the save data calls to stderr. The default is off. | `SaveDataExports.cs`, `SaveDataDialogExports.cs` |
-| `SHARPEMU_LOG_SEMA` | `1` | Writes trace lines for the kernel semaphore operations. The emulator reads the value one time at start. The default is off. | `KernelSemaphoreCompatExports.cs` |
-| `SHARPEMU_LOG_SHARE` | `1` | Writes `share.` trace lines for the Share library calls to stderr. The default is off. | `ShareExports.cs` |
-| `SHARPEMU_LOG_SSL` | `1` | Writes an `ssl.` trace line for each SSL library call. The line shows the operation, the identifier, and the first argument. | `SslExports.cs` |
-| `SHARPEMU_LOG_STACK_CHK` | `1` | Writes diagnostic lines when the guest calls the stack check failure import. The lines show the return address, the guard registers, and the stack slots from rbp-0x10 to rbp-0x80. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_STDIO` | `1` | Writes trace lines for the libc stdio calls of the guest. The emulator reads the value one time at start. The default is off. | `LibcStdioExports.cs` |
-| `SHARPEMU_LOG_STRLEN_BURSTS` | `1` | Writes a warning when the guest calls `strlen` 24 times in sequence. The warning shows the return address and the last five different imports before the burst. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_STRLEN` | `1` | Keeps `strlen` calls in the import trace. When unset, the import trace does not show `strlen` calls. It also starts the burst detection of `SHARPEMU_LOG_STRLEN_BURSTS`. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_THREAD_MODE` | `1` | Writes `[THREADMODE]` lines when a native guest worker thread is created, starts a guest run, and stops a guest run. Each line shows the host thread identifiers. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.NativeWorker.cs` |
-| `SHARPEMU_LOG_USER_SERVICE` | `1` | Writes trace lines for the user service library calls. Each line includes the guest return address of the call. | `UserServiceExports.cs` |
-| `SHARPEMU_LOG_USLEEP` | `1` | Writes trace lines for `usleep` calls: the first 32 calls and then every 10000th call. It also stops the native inline `usleep` stub and the leaf import path, so each call goes through the traced handler. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs`, `KernelRuntimeCompatExports.cs` |
-| `SHARPEMU_LOG_VIDEOOUT_FPS` | `1` | Writes periodic frame rate lines with flip, present, draw, pipeline, and buffer pool counts. `SHARPEMU_PROFILE_PERFORMANCE=1` starts the same output. | `VideoOutExports.cs` |
-| `SHARPEMU_LOG_VIDEOOUT` | `1` | Writes `videoout.` trace lines for the video output calls, such as flip events and frame dumps. The default is off. | `VideoOutExports.cs` |
-| `SHARPEMU_LOG_VK_RESOURCES` | `1` | Writes a `vk.global_buffer` trace line one time for each new guest buffer that the Vulkan presenter binds. The line shows the base address and the size. | `VulkanVideoPresenter.Draws.Recording.cs`, `VulkanVideoPresenter.GuestBuffers.cs` |
-| `SHARPEMU_LOG_VMEM` | `1` | Writes debug lines for guest virtual memory operations and `[HOSTMEM]` lines for host memory operations. The default is off. | `PhysicalVirtualMemory.cs`, `HostMemory.cs`, `PosixHostMemory.cs` |
-| `SHARPEMU_LOG_WIDE_PRINTF_ARGS` | `1` | Writes trace lines for the arguments of printf format calls, such as string arguments. Use `SHARPEMU_LOG_WIDE_PRINTF_FILTER` to limit the output. | `KernelMemoryCompatExports.cs` |
-| `SHARPEMU_LOG_WIDE_PRINTF_FILTER` | text | Limits the `SHARPEMU_LOG_WIDE_PRINTF_ARGS` trace to format strings that contain this text. The comparison is case-sensitive. When unset, the trace includes all format strings. | `KernelMemoryCompatExports.cs` |
-| `SHARPEMU_LOG_WIDE_PRINTF` | `1` | Writes a trace line for each wide-character printf call. The line shows the first 160 characters of the format and of the result. | `KernelMemoryCompatExports.cs` |
-| `SHARPEMU_LOG_WIDE` | `1` | Shows the first 32 bytes at the string address for each `wcslen` call. The default is off. | `KernelMemoryCompatExports.cs` |
-| `SHARPEMU_PERIODIC_SNAPSHOT_SECONDS` | number (seconds) | Set a number of seconds to write the stall watchdog snapshot at that interval. The default is 0, which writes no periodic snapshot. The stall watchdog must be on. | `DirectExecutionBackend.cs` |
-
-## Traces
-
-Each variable records a detailed sequence of events. Traces can be large.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_LOG_IMPORT_FILTER` | text | Writes a trace line for each import that contains this text. The emulator compares the text with the library name, the export name and the NID, and ignores case. When unset, the filter selects no imports. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_IMPORT_FRAMES` | `1` | Adds the guest frame chain to each traced import. It applies only to imports that `SHARPEMU_LOG_ALL_IMPORTS` or `SHARPEMU_LOG_IMPORT_FILTER` selects. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_IMPORT_PERIODIC` | `1` | Starts the periodic import trace. It shows the early import bands and every 100000th import dispatch. The default is off because the stderr output decreases the speed. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_IMPORT_RECENT` | `1` | Writes the recent import history after each traced import. It applies only to imports that `SHARPEMU_LOG_ALL_IMPORTS` or `SHARPEMU_LOG_IMPORT_FILTER` selects. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_PROBE_IMPORT_RET_ADDRESS` | hex address | Set a guest return address. When an import call returns to this address, the emulator writes an `import-return-address-probe` line with the thread, NID, stack and frame values. The limit is 2048 lines. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_PROBE_IMPORT_RET` | text (NID or `*`) | Set an import NID, or `*` for all imports. For the first 8 applicable import calls, the emulator writes the bytes and the disassembly before the return address. The default is off. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs`, `DirectExecutionBackend.Diagnostics.cs` |
-| `SHARPEMU_RTC_PROBE_RANGE` | hex address range (`start-end`) | Set a range of guest addresses. When a caller of `sceRtcGetCurrentTick` returns into this range, the emulator writes 0x100 bytes of code near that return address. It does this one time only. | `RtcExports.cs` |
-| `SHARPEMU_TRACE_AGC_EQ_ACCESSORS` | `1` | Set to `1` to write an `agc.eq_accessor` line for calls to the AGC event accessor functions. Each line shows the accessor, the event address, the result and the event bytes. After 64 lines, the emulator writes only at power-of-two counts. | `AgcExports.Events.cs` |
-| `SHARPEMU_TRACE_DCC_WRITERS` | `1` | Writes a `[GPU][DCC_WRITER]` line with the shader program and a call stack for each GPU buffer write that overlaps DCC metadata. It also writes `[GPU][BOUNDED_FILL_REFUSED]` lines when a fill shader is not changed into a buffer fill. Each kind writes a maximum of 64 lines. | `DccWriterTrace.cs` |
-| `SHARPEMU_TRACE_FOCUSED_CONTINUATION` | `1` | Set to `1` to write `focused_continuation` lines for guest thread continuations. The emulator writes a line only when the stack pointer is in the range 0x6FFFAC000000 to 0x6FFFAC200000. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_TRACE_FRAME_PACKETS` | `1` | Writes a `[FRAMEPKT]` line at a flip with the draw count and the dispatch count of the frame. It shows the first 8 flips, each 60th flip, and each flip that has no draws. Default is off. | `AgcExports.CommandStream.cs` |
-| `SHARPEMU_TRACE_GPU_MEMORY_ADDRESS` | hex address or `auto` | Writes `[GPU][MEMORY_TRACE]` lines for GPU memory events that touch the page of the given address. The value `auto` selects the page of the first device-address fault. Default is off. | `GuestGpuMemoryHook.cs` |
-| `SHARPEMU_TRACE_GPU_READS` | `1` | Writes a `[GPU][SYNC_READ]` line with the shader hash, the stage and the address when a shader resource read must wait for GPU-written memory. It writes one line for each shader and page, and a maximum of 64 lines. | `GpuReadTrace.cs`, `VulkanVideoPresenter.Pipelines.cs` |
-| `SHARPEMU_TRACE_GUEST_IMAGES` | `1`, `present` or `every:N[@M]` | `1` and `present` write Vulkan present trace lines (`vk.present_taken`, `vk.present_dropped`, `vk.present_sample`) and up to 64 Metal `agc.texture_fallback` lines. The code reads the `every:N[@M]` form, but no code uses the result. Default is off. | `VulkanVideoPresenter.Draws.Recording.cs`, `VulkanVideoPresenter.Present.cs`, `MetalTextureSnapshots.cs` |
-| `SHARPEMU_TRACE_GUEST_IMAGE_ADDRS` | list of hex addresses or `*` | The guest image write tracker writes `[WT][LIFETIME]` lines for each tracked range that contains a listed address. `*` selects all ranges. The Vulkan presenter also reads the list, but no code uses that filter. | `GuestImageWriteTracker.cs`, `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_TRACE_GUEST_IMAGE_FORMAT` | text (Vulkan format name) | Effect not clear from the code. The Vulkan presenter keeps the name for an image filter that compares the image format, but no code calls the filter. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_TRACE_GUEST_IMAGE_HEIGHT` | number | Effect not clear from the code. The Vulkan presenter keeps the number for an image filter that compares the image height, but no code calls the filter. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_TRACE_GUEST_IMAGE_WIDTH` | number | Effect not clear from the code. The Vulkan presenter keeps the number for an image filter that compares the image width, but no code calls the filter. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_TRACE_GUEST_MEMORY_LIFETIME` | list of source names or `*` | The guest image write tracker writes `[WT][LIFETIME]` lines for each tracked range that has a listed source name. Use a comma or a semicolon between names. `*` selects all sources. | `GuestImageWriteTracker.cs` |
-| `SHARPEMU_TRACE_GUEST_WRITES` | list of hex addresses or `*` | Effect not clear from the code. The Vulkan presenter reads the list in an address filter for guest image writes, but no code calls the filter. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_TRACE_PACKED_EXPORT` | `1` | The SPIR-V translator writes `[AGC][PACKED-EXPORT]` and `[AGC][TITLE-IR]` lines for packed export analysis. It does this only for the shader program at address 0x0000000500781200. Default is off. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_ADDRS` | list of hex addresses or `*` | Writes a `vk.present_sample` trace line when the presenter shows a guest image at a listed address. It records the first presentation of each address unless `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_OCCURRENCE` is set. | `VulkanVideoPresenter.Draws.Recording.cs`, `VulkanVideoPresenter.RenderLoop.cs` |
-| `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_OCCURRENCE` | number | Selects which presentation of an address in `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_ADDRS` the presenter records. Default is 0, which selects the first presentation. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_TRACE_TITLE_INTERFACE` | `1` | The SPIR-V translator writes `[AGC][TITLE-INTERFACE]` lines with the export and interpolation instructions of a shader. It does this only for the programs at addresses 0x0000000500780000 and 0x0000000500781200. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_TRACE_WRITER_ADDRESS` | hex address | Writes a `[GPU][TARGET_WRITER]` line with the shader program and a call stack for each GPU buffer write that covers this guest address. It writes a maximum of 64 lines. Default is off. | `DccWriterTrace.cs` |
-
-## Data dumps
-
-Each variable writes data to files.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_DUMP_FAULT_STACK_WINDOW` | `1` | Writes the full stack window from RSP-0x300 to RSP+0x100 to the error output when a guest fault report occurs. The default writes only the short stack list. | `DirectExecutionBackend.Exceptions.cs` |
-| `SHARPEMU_DUMP_FIXED_SOLID_FRAGMENT` | path | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect. | `VulkanVideoPresenter.Draws.Recording.cs` |
-| `SHARPEMU_DUMP_SPIRV_ADDRESS` | hex address | Limits the shader dump of `SHARPEMU_DUMP_SPIRV=1` to the shader at this guest address. The default writes all shaders. | `ShaderProgramCache.cs` |
-| `SHARPEMU_DUMP_VIDEOOUT` | `1` | Writes submitted VideoOut frame buffers as BMP files with a text metadata file. It writes a maximum of 8 frames and skips a frame that did not change. | `VideoOutExports.cs`, `VideoOutExports.FlipRequests.cs` |
-| `SHARPEMU_GUEST_IMAGE_DUMP_CONTINUOUS` | `1` | Writes a swapchain dump for each presented frame, not only for the first one. It needs `SHARPEMU_GUEST_IMAGE_DUMP_DIR` and an active presented-image trace. Each dump waits for the GPU, so the frame rate decreases. | `VulkanVideoPresenter.Present.Frames.cs` |
-| `SHARPEMU_GUEST_IMAGE_DUMP_DIR` | path | Sets the directory for raw swapchain dumps. The presenter writes `present-NNNN-WxH-format.bgra` files there when `SHARPEMU_TRACE_GUEST_IMAGES` is `1` or `present`. The presenter makes the directory if it is absent. | `VulkanVideoPresenter.Present.Frames.cs` |
-| `SHARPEMU_LOG_DISASM_ADDRS` | list of hex addresses | Adds more addresses to the fault disassembly dump. Use a comma between the addresses. The emulator uses this list only when `SHARPEMU_LOG_DISASM` is `1`, and it shows 48 instructions for each address. | `DirectExecutionBackend.Exceptions.cs` |
-| `SHARPEMU_LOG_DISASM` | `1` | Writes guest disassembly to stderr when a guest fault, an abort or an illegal instruction occurs. It shows the code before the fault address, before the stack return address and before three frame return addresses. | `DirectExecutionBackend.Exceptions.cs` |
-| `SHARPEMU_LOG_IL2CPP_EXCEPTION` | `1` | Writes a diagnostic dump when the guest calls the unresolved import with NID `cfwBSQyr5Ys`. The dump shows the registers, the code pointers on the stack and the frame pointer chain. The emulator writes a maximum of 4 dumps. | `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_LOG_POINTER_WINDOWS` | list of hex addresses | Writes a memory window for each address when a guest access fault occurs. Use a comma between the addresses. The window size is 0x80 bytes unless `SHARPEMU_LOG_POINTER_WINDOW_SIZE` sets a different size. | `DirectExecutionBackend.Exceptions.cs` |
-| `SHARPEMU_SHADER_SPIRV_DUMP_DIR` | path | Set a directory for shader dumps. When set, the Vulkan presenter writes each SPIR-V module to a numbered `.spv` file. The `SHARPEMU_DUMP_SPIRV=1` dumps also use this directory. Their default is `shader-dumps` next to the executable. | `VulkanVideoPresenter.Pipelines.cs`, `ShaderProgramCache.cs`, `VulkanVideoPresenter.Device.Setup.cs` |
-| `SHARPEMU_SWAPCHAIN_DUMP_EVERY` | number (frames) | Set a number N to trace the presented swapchain image at each Nth present. This operates only when `SHARPEMU_TRACE_GUEST_IMAGES` is `1` or `present`. The default is 0, which traces only the first presented image. | `VulkanVideoPresenter.Present.Frames.cs`, `VulkanVideoPresenter.Draws.Recording.cs` |
-
-## Performance measurement
-
-Each variable records timings or counts.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_LOG_AUDIO_QUEUE` | `1` | Writes one `[PERF][AUDIO]` line per second for each SDL audio stream. The line shows the queue depth in milliseconds, the submit rate, the fill percentage and the drops. The emulator reads the value one time at start. | `SdlHostAudio.cs` |
-| `SHARPEMU_PERF_HLE_NODICT` | `1` | Use with `SHARPEMU_PERF_HLE=1`. Set to `1` to stop the call count dictionary and the top call count report. The dispatch time report stays on. | `DirectExecutionBackend.Diagnostics.cs` |
-| `SHARPEMU_PERF_HLE` | `1` | Set to `1` to measure the time of each HLE import dispatch. After each 500000 calls, the emulator writes `[PERF][HLE]` lines with the call counts and the cost of the top exports. The default is off. | `DirectExecutionBackend.Diagnostics.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_PERF_MEM` | `1` | Set to `1` to count the POSIX fault signals that the signal handler receives. The emulator writes a `[PERF][MEM] posix_faults` line after each 100000 signals. This has an effect only on POSIX hosts. | `DirectExecutionBackend.PosixSignals.cs` |
-| `SHARPEMU_PROFILE_DCB_PARSE` | `1` | Set to `1` to measure the time to parse draw command buffers. The emulator writes `[PERF][DCB_PARSE]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `DcbParseProfile.cs` |
-| `SHARPEMU_PROFILE_DCB_SUBMISSION` | `1` | Set to `1` to measure command buffer submission and geometry snapshot work. The emulator writes `[PERF][DCB_SUBMIT]`, `[PERF][VERTEX_SNAPSHOT]` and `[PERF][SNAPSHOT_PREPASS]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `DcbSubmissionProfile.cs` |
-| `SHARPEMU_PROFILE_GPU_DRAWS` | `1` | Use with the render profile. Writes a GPU timestamp after each draw and dispatch, so that the `[PERF][GPU_INTERVAL]` lines give the GPU time of each pipeline. The default writes only two timestamps for each submission for the `[PERF][GPU_BUSY]` lines, because one timestamp for each draw can change the GPU time. | `VulkanCommandProfile.cs` |
-| `SHARPEMU_PROFILE_GUEST_IMAGE_TRACKER` | `1` | Set to `1` to record counters for the guest image write tracker. The emulator writes `[PERF][GUEST_IMAGE_TRACKER]` and `[PERF][GUEST_IMAGE_TRACKER_RANGE]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `GuestImageWriteTracker.cs` |
-| `SHARPEMU_PROFILE_GUEST_RIP_INTERVAL_MS` | number (milliseconds) | Set the time between samples of the guest code profiler. The value must be more than 0. The default is 2. | `DirectExecutionBackend.GuestSampler.cs` |
-| `SHARPEMU_PROFILE_GUEST_RIP_REPORT_S` | number (seconds) | Set the time between reports of the guest code profiler. The value must be more than 0. The default is 15. | `DirectExecutionBackend.GuestSampler.cs` |
-| `SHARPEMU_PROFILE_GUEST_RIP_THREAD` | text | Set a text filter for the guest code profiler. The profiler samples only guest threads whose name contains this text. The comparison ignores case. When unset, the profiler samples all guest threads. | `DirectExecutionBackend.GuestSampler.cs` |
-| `SHARPEMU_PROFILE_GUEST_RIP` | `1` | Set to `1` to start a sample profiler for guest code. The profiler records the instruction address of each guest thread and writes `[PERF][GUEST]` reports. The default is off. | `DirectExecutionBackend.GuestSampler.cs`, `DirectExecutionBackend.Imports.cs` |
-| `SHARPEMU_PROFILE_GUEST_SCHEDULER` | `1` | Set to `1` to record guest thread scheduler statistics. The emulator writes `[PERF][GUEST_SCHED]` lines. With `SHARPEMU_PROFILE_PERFORMANCE_FRAME_TRACE=1`, it also records guest thread flow events. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `DirectExecutionBackend.GuestSchedulerProfile.cs`, `GuestThreadFlowProfile.cs` |
-| `SHARPEMU_PROFILE_RENDER_REPORT_S` | number (seconds) | Set the time between render profile reports. The value can be a decimal number and must be more than 0. The default is 5. | `RenderPhaseProfile.cs` |
-| `SHARPEMU_PROFILE_RENDER` | `1` | Set to `1` to measure the time of each render thread phase. The emulator writes `[PERF][RENDER]`, `[PERF][RENDER_MS]` and related lines. With `SHARPEMU_PROFILE_PERFORMANCE_FRAME_TRACE=1`, it also records GPU memory access counters. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `RenderPhaseProfile.cs`, `GpuMemoryAccessProfile.cs` |
-| `SHARPEMU_PROFILE_SYNC_ON_ADDRESS` | `1` | Set to `1` to start the detailed sync-on-address profile. The emulator also records the guest call stack for each wait and wake call. It writes `[PERF][SYNC_ADDR]` and `[PERF][SYNC_THREAD]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` starts the profile without the call stack. | `KernelSyncOnAddressProfile.cs`, `KernelSyncOnAddressCompatExports.cs` |
-| `SHARPEMU_PROFILE_TEXTURE_PREPARATION` | `1` | Set to `1` to measure texture preparation work. The emulator writes `[PERF][TEXTURE_PREP]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `TexturePreparationProfile.cs` |
-
-## Internal
-
-The emulator sets these variables for its own processes. Do not set them manually.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_MITIGATED_CHILD` | `1` | The Windows launcher sets this variable to 1 when it starts the child process with CFG and CET mitigations off. The child accepts the `--sharpemu-mitigated-child` argument only when the value is 1. Do not set it manually. | `Program.cs`, `EmulatorProcess.cs` |
-
-## Tests and tools
-
-Only the tests, the scripts or the build tools read these variables.
-
-| Variable | Value | Function | Code that reads it |
-| --- | --- | --- | --- |
-| `SHARPEMU_BACKING_VIEW_FAULT_WORKER` | `1` | The backing view fault test sets this for its child process. The value `1` tells the child to do the fault sequence. Do not set it manually. | `BackingViewFaultTests.cs`, `GuestFaultWorker.cs` |
-| `SHARPEMU_BUFFER_FAULT_WORKER` | `1` | The guest buffer fault test sets this for its child process. The value `1` tells the child to do the fault sequence. Do not set it manually. | `GuestBufferFaultTests.cs`, `GuestFaultWorker.cs` |
-| `SHARPEMU_FAULT_WORKER_REPORT` | path | The fault test parent sets this to a temporary file path for its child process. The child writes its result (`completed` or `skipped`) to this file. When unset, the child writes the result to the error stream. | `GuestFaultWorker.cs` |
-| `SHARPEMU_IMAGE_FAULT_WORKER` | `1` | The guest image fault test sets this for its child process. The value `1` tells the child to do the fault sequence. Do not set it manually. | `GuestImageFaultTests.cs`, `GuestFaultWorker.cs` |
-| `SHARPEMU_NATIVE_RETURN_SMOKE_WORKER` | `1` | The native return smoke test sets this for its child process. The value `1` tells the child to run the synthetic guest entry. Do not set it manually. | `Gen5NativeReturnSmokeTests.cs` |
-| `SHARPEMU_SOCKET_CONNECTION_TEST_WORKER` | `1` | The kernel socket connection test sets this for its child process. The value `1` tells the child to do the connect sequence. Do not set it manually. | `KernelSocketConnectionTests.cs` |
-| `SHARPEMU_TEST_REFERENCE_SPIRV_DIR` | path | Sets the directory that contains the reference compiled shader files for the GPU image tests. The tests make sure that each file has the recorded SHA-256 hash. When unset, these tests skip the reference comparison. | `ImageTestHarness.cs` |
-| `SHARPEMU_TEST_REQUIRE_DEVICE` | `1` | Makes a GPU test fail when a Vulkan or Metal device or a device feature is missing. Default is to skip the test. | `ImageTestHarness.cs`, `MetalRuntimeTests.cs` |
-| `SHARPEMU_TEST_REQUIRE_REFERENCE_SPIRV` | `1` | Makes a test fail when a reference shader file, its directory, or a necessary device is missing. Default is to skip the test. | `ImageTestHarness.cs`, `GuestFaultWorker.cs` |
-| `SHARPEMU_TEST_VK_VALIDATION` | `1` | Loads the Vulkan validation layer in the headless test device and prints the validation messages. Default is off. | `HeadlessVulkan.cs` |
-| `SHARPEMU_THREAD_CONTEXT_TEST_WORKER` | `1` | The Windows thread context capture test sets this for its child process. The value `1` tells the child to do the capture sequence. Do not set it manually. | `WindowsThreadContextCaptureTests.cs`, `GuestFaultWorker.cs` |
-| `SHARPEMU_UPDATE_GOLDENS` | `1` | Makes the Metal golden tests write the generated shader text to the golden files in the source tree. Default is to compare the generated text with the golden files. | `MslGoldenTests.cs` |
-
-## Variables that the code reads but does not use
-
-The code reads these variables into a field or a filter. No other code uses that field or filter.
-Thus they have no effect, or only a part of their function operates. The rows above give the details.
-
-- `SHARPEMU_DUMP_FIXED_SOLID_FRAGMENT`
-- `SHARPEMU_ENABLE_CHUNKED_DRAWS`
-- `SHARPEMU_FORCE_ATTRIBUTE_FRAGMENT`
-- `SHARPEMU_FORCE_DEFAULT_RASTER_STATE`
-- `SHARPEMU_FORCE_FULLSCREEN_PIPELINE`
-- `SHARPEMU_FORCE_FULLSCREEN_VERTEX`
-- `SHARPEMU_FORCE_SOLID_FRAGMENT`
-- `SHARPEMU_FORCE_TITLE_DEFAULT_RASTER_STATE`
-- `SHARPEMU_FORCE_TITLE_FULLSCREEN_VERTEX`
-- `SHARPEMU_FORCE_TITLE_SOLID_FRAGMENT`
-- `SHARPEMU_SKIP_TALL_COMPUTE_Z`
-- `SHARPEMU_TRACE_GUEST_IMAGE_FORMAT`
-- `SHARPEMU_TRACE_GUEST_IMAGE_HEIGHT`
-- `SHARPEMU_TRACE_GUEST_IMAGE_WIDTH`
-- `SHARPEMU_TRACE_GUEST_WRITES`

docs/windows-crash-capture.md

@@ -1,48 +0,0 @@
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-# Windows crash capture
-
-In the launcher, open **Options > Logging** and enable **Crash dumps** before
-you start a game. The same toggle is available in each game's Logging settings.
-It sets `SHARPEMU_CRASH_CAPTURE` and is off by default.
-
-For a diagnostic run on Windows x64, you can also set it from PowerShell:
-
-```powershell
-$env:SHARPEMU_CRASH_CAPTURE = '1'
-.\SharpEmu.exe
-```
-
-Start a new launcher from that PowerShell window. The game process starts a
-hidden helper before runtime initialization. No SDK or debugger install is
-required. Look for `[CRASH][INFO] Crash capture ready` in the game log.
-
-The helper writes a full dump beside the run log. Without a log path, it uses
-`user/logs` beside the executable. Names include the game process ID:
-
-- `<run>.crash-<pid>.dmp`: the memory dump.
-- `<run>.crash-<pid>.dmp.capture.log`: capture status and errors.
-
-Full dumps can use many GB of disk space and contain private process data.
-Keep them local until you choose to share them. There is no automatic upload.
-
-The helper uses Windows debugger events. It passes first-chance exceptions to
-the application and captures only second-chance, unhandled exceptions. Normal
-handled page faults do not create dumps. A normal exit or a forced process
-termination does not create a dump either. The original crash is not suppressed.
-
-This option changes debugger presence and can change timing. Do not use it for
-FPS comparisons. Do not attach WinDbg, ProcDump, or another native debugger at
-the same time. Capture failures are recorded when possible; no capture method
-can cover every process termination. A failed write can leave an incomplete dump.
-
-This is separate from the `DOTNET_Dbg*` settings. It does not change them.
-To disable a GUI selection, turn off **Crash dumps** before the next game launch.
-If you set the option in PowerShell, close the launcher and run:
-
-```powershell
-Remove-Item Env:SHARPEMU_CRASH_CAPTURE -ErrorAction SilentlyContinue
-```

global.json

@@ -1,6 +1,6 @@
 {
     "sdk": {
         "version": "10.0.103",
-        "rollForward": "latestFeature"
+        "rollForward": "disable"
     }
 }

scripts/aerolib_catalog.py

@@ -1,198 +0,0 @@
-#!/usr/bin/env python3
-
-# Copyright (C) 2026 SharpEmu Emulator Project
-# SPDX-License-Identifier: GPL-2.0-or-later
-
-from __future__ import annotations
-
-import argparse
-import base64
-import hashlib
-import re
-import sys
-from pathlib import Path
-
-
-NID_SUFFIX = bytes.fromhex("518d64a635ded8c1e6b039b1c3e55230")
-NID_PATTERN = re.compile(r"^[A-Za-z0-9+-]{11}$")
-DEFAULT_NAMES_FILE = Path(__file__).resolve().with_name("ps5_names.txt")
-DEFAULT_EXPORT_FILE = Path(__file__).resolve().parents[1] / "artifacts" / "aerolib.txt"
-
-
-def compute_nid(export_name: str) -> str:
-    digest = hashlib.sha1(export_name.encode("utf-8") + NID_SUFFIX).digest()
-    encoded = base64.b64encode(digest[:8][::-1]).decode("ascii")
-    return encoded.rstrip("=").replace("/", "-")
-
-
-def read_names(path: Path) -> list[str]:
-    try:
-        return [
-            line.strip()
-            for line in path.read_text(encoding="utf-8").splitlines()
-            if line.strip()
-        ]
-    except OSError as error:
-        raise SystemExit(f"Unable to read catalog '{path}': {error}") from error
-
-
-def write_pair(nid: str, export_name: str) -> None:
-    print(f"{nid}\t{export_name}")
-
-
-def lookup(args: argparse.Namespace) -> int:
-    values = [value.strip() for value in args.value.split(",") if value.strip()]
-    names = read_names(args.names)
-    name_set = set(names)
-
-    result = 0
-
-    for value in values:
-        if NID_PATTERN.fullmatch(value):
-            found = False
-
-            for export_name in names:
-                if compute_nid(export_name) == value:
-                    write_pair(value, export_name)
-                    found = True
-                    break
-
-            if not found:
-                print(f"NID not found in catalog: {value}", file=sys.stderr)
-                result = 1
-
-            continue
-
-        write_pair(compute_nid(value), value)
-
-        if value not in name_set:
-            print(
-                f"Warning: export name is not present in the catalog: {value}",
-                file=sys.stderr,
-            )
-    return result
-
-
-def search(args: argparse.Namespace) -> int:
-    names = read_names(args.names)
-    if args.regex:
-        try:
-            pattern = re.compile(args.query, 0 if args.case_sensitive else re.IGNORECASE)
-        except re.error as error:
-            print(f"Invalid regular expression: {error}", file=sys.stderr)
-            return 2
-
-        matches = (name for name in names if pattern.search(name))
-    elif args.case_sensitive:
-        matches = (name for name in names if args.query in name)
-    else:
-        query = args.query.casefold()
-        matches = (name for name in names if query in name.casefold())
-
-    count = 0
-    for export_name in matches:
-        write_pair(compute_nid(export_name), export_name)
-        count += 1
-        if args.limit and count >= args.limit:
-            break
-
-    if count == 0:
-        print(f"No catalog names matched: {args.query}", file=sys.stderr)
-        return 1
-    return 0
-
-
-def export_catalog(args: argparse.Namespace) -> int:
-    pairs = [(compute_nid(name), name) for name in read_names(args.names)]
-    if args.sort == "nid":
-        pairs.sort(key=lambda pair: (pair[0], pair[1]))
-    elif args.sort == "name":
-        pairs.sort(key=lambda pair: pair[1])
-
-    args.output.parent.mkdir(parents=True, exist_ok=True)
-    try:
-        with args.output.open("w", encoding="utf-8", newline="\n") as output:
-            output.write("# NID\tExportName\n")
-            for nid, export_name in pairs:
-                output.write(f"{nid}\t{export_name}\n")
-    except OSError as error:
-        print(f"Unable to write catalog '{args.output}': {error}", file=sys.stderr)
-        return 1
-
-    print(f"Wrote {len(pairs)} entries to {args.output}")
-    return 0
-
-
-def create_parser() -> argparse.ArgumentParser:
-    parser = argparse.ArgumentParser(
-        description="Inspect the SharpEmu PS5 export-name/NID catalog.",
-        epilog=(
-            "Examples:\n"
-            "  python scripts/aerolib_catalog.py lookup Zxa0VhQVTsk\n"
-            "  python scripts/aerolib_catalog.py lookup sceKernelWaitSema\n"
-            "  python scripts/aerolib_catalog.py search VideoOut --limit 20\n"
-            "  python scripts/aerolib_catalog.py export"
-        ),
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-    )
-    parser.add_argument(
-        "--names",
-        type=Path,
-        default=DEFAULT_NAMES_FILE,
-        help=f"source name list (default: {DEFAULT_NAMES_FILE})",
-    )
-
-    subparsers = parser.add_subparsers(dest="command", required=True)
-
-    lookup_parser = subparsers.add_parser(
-        "lookup", help="resolve a NID or calculate the NID for an export name"
-    )
-    lookup_parser.add_argument(
-        "value", help="11-character NID or exact export name; comma-separated values are supported"
-    )
-    lookup_parser.set_defaults(handler=lookup)
-
-    search_parser = subparsers.add_parser(
-        "search", help="find export names and print matching NID/name pairs"
-    )
-    search_parser.add_argument("query", help="name substring or regular expression")
-    search_parser.add_argument(
-        "--limit", type=int, default=50, help="maximum matches; 0 means unlimited"
-    )
-    search_parser.add_argument(
-        "--case-sensitive", action="store_true", help="match case exactly"
-    )
-    search_parser.add_argument(
-        "--regex", action="store_true", help="treat the query as a regular expression"
-    )
-    search_parser.set_defaults(handler=search)
-
-    export_parser = subparsers.add_parser(
-        "export", help="write every NID/name pair to a tab-separated text file"
-    )
-    export_parser.add_argument(
-        "output",
-        type=Path,
-        nargs="?",
-        default=DEFAULT_EXPORT_FILE,
-        help=f"output file (default: {DEFAULT_EXPORT_FILE})",
-    )
-    export_parser.add_argument(
-        "--sort",
-        choices=("source", "nid", "name"),
-        default="nid",
-        help="output ordering (default: nid)",
-    )
-    export_parser.set_defaults(handler=export_catalog)
-
-    return parser
-
-
-def main() -> int:
-    parser = create_parser()
-    args = parser.parse_args()
-    return args.handler(args)
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

scripts/fetch-macos-moltenvk.sh

@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (C) 2026 SharpEmu Emulator Project
-# SPDX-License-Identifier: GPL-2.0-or-later
-#
-# Downloads the official (universal x86_64+arm64) MoltenVK dylib and stages
-# it next to a SharpEmu build as libvulkan.1.dylib. The macOS build runs as
-# an x86-64 process under Rosetta 2, so Homebrew's arm64-only Vulkan
-# libraries cannot be used; the presenter looks for this app-local copy.
-#
-# Usage: scripts/fetch-macos-moltenvk.sh [output-dir]
-#        (default output: artifacts/bin/Debug/net10.0/osx-x64)
-set -euo pipefail
-
-MVK_VERSION="${MVK_VERSION:-v1.4.0}"
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-OUT_DIR="${1:-$REPO_ROOT/artifacts/bin/Debug/net10.0/osx-x64}"
-
-if [[ ! -d "$OUT_DIR" ]]; then
-  echo "output directory does not exist: $OUT_DIR (build first?)" >&2
-  exit 2
-fi
-
-WORK_DIR="$(mktemp -d)"
-trap 'rm -rf "$WORK_DIR"' EXIT
-
-echo ">> Downloading MoltenVK $MVK_VERSION..."
-curl -sL -o "$WORK_DIR/mvk.tar" \
-  "https://github.com/KhronosGroup/MoltenVK/releases/download/$MVK_VERSION/MoltenVK-macos.tar"
-tar -xf "$WORK_DIR/mvk.tar" -C "$WORK_DIR" \
-  MoltenVK/MoltenVK/dynamic/dylib/macOS/libMoltenVK.dylib
-
-DYLIB="$WORK_DIR/MoltenVK/MoltenVK/dynamic/dylib/macOS/libMoltenVK.dylib"
-file "$DYLIB" | grep -q x86_64 || { echo "downloaded dylib lacks x86_64 slice" >&2; exit 3; }
-
-cp "$DYLIB" "$OUT_DIR/libMoltenVK.dylib"
-cp "$DYLIB" "$OUT_DIR/libvulkan.1.dylib"
-echo ">> Staged libMoltenVK.dylib + libvulkan.1.dylib in $OUT_DIR"

scripts/generate_aerolib_binary.py

@@ -0,0 +1,53 @@
+# Copyright (C) 2026 SharpEmu Emulator Project
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+#!/usr/bin/env python3
+
+import struct
+import hashlib
+from base64 import b64encode as base64enc
+from binascii import unhexlify as uhx
+from pathlib import Path
+
+NAMES = 'scripts/ps5_names.txt'
+OUTPUT = 'src/SharpEmu.HLE/Aerolib/aerolib.bin'
+
+def name2nid(name):
+    symbol = hashlib.sha1(name.encode() + uhx('518D64A635DED8C1E6B039B1C3E55230')).digest()
+    id_val = struct.unpack('<Q', symbol[:8])[0]
+    nid = base64enc(uhx('%016x' % id_val), b'+-').rstrip(b'=')
+    return nid.decode('utf-8')
+
+def generate():
+    names_path = Path(NAMES)
+    output_path = Path(OUTPUT)
+    
+    entries = []
+    with open(names_path, 'r', encoding='utf-8') as f:
+        for line in f:
+            name = line.strip()
+            if name:
+                nid = name2nid(name)
+                entries.append((nid, name))
+    
+    print(f"Found {len(entries)} entries")
+
+    data = bytearray()
+    data.extend(struct.pack('<I', len(entries)))
+    
+    for nid, name in entries:
+        nid_bytes = nid.encode('utf-8')
+        name_bytes = name.encode('utf-8')
+        data.append(len(nid_bytes))
+        data.extend(nid_bytes)
+        data.extend(struct.pack('<H', len(name_bytes)))
+        data.extend(name_bytes)
+    
+    with open(output_path, 'wb') as f:
+        f.write(data)
+    
+    print(f"Generated: {output_path} ({len(data):,} bytes)")
+    print(f"Total entries: {len(entries)}")
+
+if __name__ == "__main__":
+    generate()

scripts/release.py

@@ -1,466 +0,0 @@
-#!/usr/bin/env python3
-
-# Copyright (C) 2026 SharpEmu Emulator Project
-# SPDX-License-Identifier: GPL-2.0-or-later
-
-from __future__ import annotations
-
-import argparse
-import re
-import subprocess
-import sys
-from pathlib import Path
-
-
-VERSION_PATTERN = re.compile(r"^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$")
-VERSION_ELEMENT_PATTERN = re.compile(
-    r"(<SharpEmuVersion>)([^<]+)(</SharpEmuVersion>)"
-)
-
-
-class ReleaseError(RuntimeError):
-    pass
-
-
-def run_git(
-    *args: str,
-    cwd: Path,
-    capture_output: bool = False,
-) -> str:
-    command = ["git", *args]
-
-    try:
-        result = subprocess.run(
-            command,
-            cwd=cwd,
-            check=True,
-            text=True,
-            capture_output=capture_output,
-        )
-    except FileNotFoundError:
-        raise ReleaseError("Git was not found in PATH.") from None
-    except subprocess.CalledProcessError as error:
-        stderr = error.stderr.strip() if error.stderr else ""
-        detail = f"\n{stderr}" if stderr else ""
-
-        raise ReleaseError(
-            f"Git command failed: {' '.join(command)}{detail}"
-        ) from error
-
-    return result.stdout.strip() if capture_output else ""
-
-
-def find_repository_root(script_path: Path) -> Path:
-    root = run_git(
-        "rev-parse",
-        "--show-toplevel",
-        cwd=script_path.resolve().parent,
-        capture_output=True,
-    )
-
-    return Path(root)
-
-
-def get_status(repository_root: Path) -> str:
-    return run_git(
-        "status",
-        "--porcelain",
-        cwd=repository_root,
-        capture_output=True,
-    )
-
-
-def ensure_clean_worktree(repository_root: Path) -> None:
-    status = get_status(repository_root)
-
-    if status:
-        raise ReleaseError(
-            "The working tree is not clean.\n\n"
-            f"{status}\n\n"
-            "Commit, stash, or remove these changes first."
-        )
-
-
-def get_current_branch(repository_root: Path) -> str:
-    branch = run_git(
-        "branch",
-        "--show-current",
-        cwd=repository_root,
-        capture_output=True,
-    )
-
-    if not branch:
-        raise ReleaseError(
-            "HEAD is detached. Switch to a branch before continuing."
-        )
-
-    return branch
-
-
-def ensure_branch_does_not_exist(
-    repository_root: Path,
-    branch: str,
-    remote: str,
-) -> None:
-    local_branch = run_git(
-        "branch",
-        "--list",
-        branch,
-        cwd=repository_root,
-        capture_output=True,
-    )
-
-    if local_branch:
-        raise ReleaseError(f"Branch {branch} already exists locally.")
-
-    remote_branch = run_git(
-        "ls-remote",
-        "--heads",
-        remote,
-        branch,
-        cwd=repository_root,
-        capture_output=True,
-    )
-
-    if remote_branch:
-        raise ReleaseError(
-            f"Branch {branch} already exists on {remote}."
-        )
-
-
-def ensure_tag_does_not_exist(
-    repository_root: Path,
-    tag: str,
-    remote: str,
-) -> None:
-    local_tag = run_git(
-        "tag",
-        "--list",
-        tag,
-        cwd=repository_root,
-        capture_output=True,
-    )
-
-    if local_tag:
-        raise ReleaseError(f"Tag {tag} already exists locally.")
-
-    remote_tag = run_git(
-        "ls-remote",
-        "--tags",
-        remote,
-        f"refs/tags/{tag}",
-        cwd=repository_root,
-        capture_output=True,
-    )
-
-    if remote_tag:
-        raise ReleaseError(f"Tag {tag} already exists on {remote}.")
-
-
-def get_previous_tag(repository_root: Path) -> str:
-    try:
-        return run_git(
-            "describe",
-            "--tags",
-            "--abbrev=0",
-            "--match",
-            "v*",
-            "HEAD",
-            cwd=repository_root,
-            capture_output=True,
-        )
-    except ReleaseError:
-        return ""
-
-
-def get_release_commits(
-    repository_root: Path,
-    previous_tag: str,
-) -> list[str]:
-    revision_range = f"{previous_tag}..HEAD" if previous_tag else "HEAD"
-
-    output = run_git(
-        "log",
-        "--no-merges",
-        "--reverse",
-        "--pretty=tformat:%h %s",
-        revision_range,
-        cwd=repository_root,
-        capture_output=True,
-    )
-
-    return output.splitlines()
-
-
-def print_release_notes_preview(repository_root: Path) -> None:
-    previous_tag = get_previous_tag(repository_root)
-    commits = get_release_commits(repository_root, previous_tag)
-
-    print()
-
-    if previous_tag:
-        print(f"Commits since {previous_tag} ({len(commits)}):")
-    else:
-        print(f"Commits in this release ({len(commits)}):")
-
-    if not commits:
-        print("  (none)")
-
-    for commit in commits:
-        print(f"  {commit}")
-
-    print()
-    print("These commits go into the generated release notes.")
-
-
-def read_version(props_path: Path) -> str:
-    if not props_path.exists():
-        raise ReleaseError(f"Version file not found: {props_path}")
-
-    content = props_path.read_text(encoding="utf-8")
-    match = VERSION_ELEMENT_PATTERN.search(content)
-
-    if match is None:
-        raise ReleaseError(
-            f"SharpEmuVersion was not found in {props_path.name}."
-        )
-
-    return match.group(2).strip()
-
-
-def update_version(props_path: Path, version: str) -> str:
-    content = props_path.read_text(encoding="utf-8")
-    current_version = read_version(props_path)
-
-    if current_version == version:
-        raise ReleaseError(
-            f"SharpEmuVersion is already set to {version}."
-        )
-
-    updated_content, replacement_count = VERSION_ELEMENT_PATTERN.subn(
-        rf"\g<1>{version}\g<3>",
-        content,
-        count=1,
-    )
-
-    if replacement_count != 1:
-        raise ReleaseError(
-            "Expected exactly one SharpEmuVersion element."
-        )
-
-    props_path.write_text(
-        updated_content,
-        encoding="utf-8",
-        newline="\n",
-    )
-
-    return current_version
-
-
-def prepare_release(
-    repository_root: Path,
-    props_path: Path,
-    version: str,
-    remote: str,
-) -> None:
-    ensure_clean_worktree(repository_root)
-
-    current_branch = get_current_branch(repository_root)
-
-    if current_branch != "main":
-        raise ReleaseError(
-            f"Prepare must be run from main, not {current_branch}."
-        )
-
-    run_git(
-        "pull",
-        "--ff-only",
-        remote,
-        "main",
-        cwd=repository_root,
-    )
-
-    branch = f"release/{version}"
-    ensure_branch_does_not_exist(
-        repository_root,
-        branch,
-        remote,
-    )
-
-    previous_version = read_version(props_path)
-
-    run_git(
-        "switch",
-        "-c",
-        branch,
-        cwd=repository_root,
-    )
-
-    try:
-        update_version(props_path, version)
-
-        relative_props_path = props_path.relative_to(repository_root)
-
-        run_git(
-            "add",
-            relative_props_path.as_posix(),
-            cwd=repository_root,
-        )
-        run_git(
-            "commit",
-            "-m",
-            f"chore: bump version to {version}",
-            cwd=repository_root,
-        )
-        run_git(
-            "push",
-            "-u",
-            remote,
-            branch,
-            cwd=repository_root,
-        )
-    except Exception:
-        print(
-            "\nPrepare failed. The release branch may still exist locally.",
-            file=sys.stderr,
-        )
-        raise
-
-    print()
-    print(f"Prepared release {previous_version} -> {version}")
-    print(f"Branch pushed: {branch}")
-    print()
-    print("Open a pull request from:")
-    print(f"  {branch}")
-    print("into:")
-    print("  main")
-    print()
-    print("After merging the PR, run:")
-    print(f"  python scripts/release.py tag {version}")
-
-
-def create_release_tag(
-    repository_root: Path,
-    props_path: Path,
-    version: str,
-    remote: str,
-) -> None:
-    ensure_clean_worktree(repository_root)
-
-    current_branch = get_current_branch(repository_root)
-
-    if current_branch != "main":
-        raise ReleaseError(
-            f"Tagging must be run from main, not {current_branch}."
-        )
-
-    run_git(
-        "pull",
-        "--ff-only",
-        remote,
-        "main",
-        cwd=repository_root,
-    )
-
-    current_version = read_version(props_path)
-
-    if current_version != version:
-        raise ReleaseError(
-            "Version mismatch:\n"
-            f"  Directory.Build.props: {current_version}\n"
-            f"  Requested tag:         {version}"
-        )
-
-    tag = f"v{version}"
-
-    ensure_tag_does_not_exist(
-        repository_root,
-        tag,
-        remote,
-    )
-
-    print_release_notes_preview(repository_root)
-
-    run_git(
-        "tag",
-        "-a",
-        tag,
-        "-m",
-        f"SharpEmu {version}",
-        cwd=repository_root,
-    )
-    run_git(
-        "push",
-        remote,
-        tag,
-        cwd=repository_root,
-    )
-
-    print()
-    print(f"Successfully pushed tag {tag}.")
-    print("The release workflow should start automatically.")
-
-
-def parse_arguments() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(
-        description="Prepare or tag a SharpEmu release."
-    )
-
-    subparsers = parser.add_subparsers(
-        dest="command",
-        required=True,
-    )
-
-    for command in ("prepare", "tag"):
-        subparser = subparsers.add_parser(command)
-        subparser.add_argument(
-            "version",
-            help="Version without the v prefix, e.g. 0.0.2-beta.2.",
-        )
-        subparser.add_argument(
-            "--remote",
-            default="origin",
-            help="Git remote. Default: origin.",
-        )
-
-    arguments = parser.parse_args()
-
-    if not VERSION_PATTERN.fullmatch(arguments.version):
-        parser.error(
-            "Version must look like 0.0.2, "
-            "0.0.2-beta.2, or 0.0.2-rc.1."
-        )
-
-    return arguments
-
-
-def main() -> int:
-    arguments = parse_arguments()
-
-    try:
-        repository_root = find_repository_root(Path(__file__))
-        props_path = repository_root / "Directory.Build.props"
-
-        if arguments.command == "prepare":
-            prepare_release(
-                repository_root,
-                props_path,
-                arguments.version,
-                arguments.remote,
-            )
-        else:
-            create_release_tag(
-                repository_root,
-                props_path,
-                arguments.version,
-                arguments.remote,
-            )
-    except ReleaseError as error:
-        print(f"Error: {error}", file=sys.stderr)
-        return 1
-
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

scripts/test-linux-docker.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (C) 2026 SharpEmu Emulator Project
-# SPDX-License-Identifier: GPL-2.0-or-later
-#
-# Smoke-tests the linux-x64 build inside an amd64 container. Useful from any
-# host (including Apple Silicon, where Docker runs the amd64 image under
-# emulation) to confirm the cross-platform layer keeps working on Linux.
-#
-# Usage: scripts/test-linux-docker.sh /path/to/eboot.bin
-set -euo pipefail
-
-GAME_PATH="${1:-}"
-if [[ -z "$GAME_PATH" || ! -f "$GAME_PATH" ]]; then
-  echo "usage: $0 <path-to-eboot.bin>" >&2
-  exit 2
-fi
-
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-GAME_DIR="$(cd "$(dirname "$GAME_PATH")" && pwd)"
-GAME_FILE="$(basename "$GAME_PATH")"
-PUBLISH_DIR="$REPO_ROOT/artifacts/publish/SharpEmu.CLI/Debug/net10.0/linux-x64"
-
-echo ">> Publishing linux-x64 self-contained build..."
-dotnet publish "$REPO_ROOT/src/SharpEmu.CLI" \
-  -c Debug -r linux-x64 --self-contained -p:PublishSingleFile=false
-
-echo ">> Running inside linux/amd64 container..."
-docker run --rm --platform linux/amd64 \
-  -v "$PUBLISH_DIR":/app:ro \
-  -v "$GAME_DIR":/game:ro \
-  mcr.microsoft.com/dotnet/runtime-deps:10.0 \
-  /app/SharpEmu --log-level=info "/game/$GAME_FILE"

scripts/validate-synthetic-spirv.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (C) 2026 SharpEmu Emulator Project
-# SPDX-License-Identifier: GPL-2.0-or-later
-
-set -euo pipefail
-
-if [ "$#" -ne 4 ]; then
-  echo "usage: $0 <spirv-val> <expected-version> <target-env> <module-directory>" >&2
-  exit 2
-fi
-
-validator=$1
-expected_version=$2
-target_env=$3
-module_directory=$4
-
-if [ ! -x "$validator" ]; then
-  echo "SPIR-V validator is not executable: $validator" >&2
-  exit 2
-fi
-
-if [ ! -d "$module_directory" ]; then
-  echo "SPIR-V module directory does not exist: $module_directory" >&2
-  exit 2
-fi
-
-validator_version="$("$validator" --version | head -n 1)"
-if [[ "$validator_version" != *"SPIRV-Tools $expected_version"* ]]; then
-  echo "unexpected SPIRV-Tools version: $validator_version (expected $expected_version)" >&2
-  exit 2
-fi
-
-echo "Validator: $validator_version"
-echo "Target environment: $target_env"
-
-mapfile -d '' modules < <(find "$module_directory" -type f -name '*.spv' -print0 | sort -z)
-if [ "${#modules[@]}" -eq 0 ]; then
-  echo "no SPIR-V modules found in $module_directory" >&2
-  exit 1
-fi
-
-failures=0
-for module in "${modules[@]}"; do
-  echo "Validating module: $module"
-  if ! "$validator" --target-env "$target_env" "$module"; then
-    echo "SPIR-V validation failed: $module" >&2
-    failures=1
-  fi
-done
-
-if [ "$failures" -ne 0 ]; then
-  exit 1
-fi
-
-echo "Validated ${#modules[@]} synthetic SPIR-V modules."

src/SharpEmu.CLI/SharpEmu.CLI.csproj

@@ -7,63 +7,32 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
   <ItemGroup>
     <ProjectReference Include="..\SharpEmu.Core\SharpEmu.Core.csproj" />
-    <ProjectReference Include="..\SharpEmu.Debugger\SharpEmu.Debugger.csproj" />
-    <ProjectReference Include="..\SharpEmu.GUI\SharpEmu.GUI.csproj" />
     <ProjectReference Include="..\SharpEmu.Logging\SharpEmu.Logging.csproj" />
   </ItemGroup>
 
   <PropertyGroup>
-    <!-- GUI subsystem so starting without arguments opens the frontend with no
-         console window; CLI mode re-attaches to the parent terminal's console. -->
-    <OutputType>WinExe</OutputType>
+    <OutputType>Exe</OutputType>
     <AssemblyName>SharpEmu</AssemblyName>
-    <!-- osx-x64 is the macOS target: the CPU backend executes guest x86-64
-         natively, so on Apple Silicon it runs under Rosetta 2. -->
-    <RuntimeIdentifiers>win-x64;linux-x64;osx-x64;osx-arm64</RuntimeIdentifiers>
-    <!-- A plain "dotnet publish" with no -r defaults $(RuntimeIdentifier) to
-         the host's own RID; see Directory.Build.props, which is where that
-         default actually has to live (PublishDir's RID suffix is decided
-         there, evaluated before this file, so a default set only here would
-         be too late for it). -->
+    <RuntimeIdentifiers>win-x64;linux-x64;osx-arm64</RuntimeIdentifiers>
     <SelfContained>true</SelfContained>
     <PublishSingleFile>true</PublishSingleFile>
-    <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
+    <!-- <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract> -->
     <EnableCompressionInSingleFile>true</EnableCompressionInSingleFile>
     <ImplicitUsings>enable</ImplicitUsings>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
-    <!-- Server GC reserves one large heap range per logical processor. On
-         high-core-count hosts those ranges can overlap fixed PS5 image bases
-         before the guest address space is established. Workstation GC avoids
-         that collision and keeps the emulator's required mappings available. -->
-    <ServerGarbageCollection>false</ServerGarbageCollection>
-    <ConcurrentGarbageCollection>true</ConcurrentGarbageCollection>
-    <TieredPGO>true</TieredPGO>
-  </PropertyGroup>
-
-  <!-- Background GC's write-watch revisit calls FlushProcessWriteBuffers,
-       which on macOS uses thread_get_register_pointer_values; under Rosetta 2
-       that Mach call can stall indefinitely on threads executing translated
-       guest code, wedging the whole runtime (every allocating thread then
-       blocks behind the never-finishing GC). Non-concurrent GC never takes
-       that path. Windows and Linux keep concurrent GC. -->
-  <PropertyGroup Condition="$([System.String]::Copy('$(RuntimeIdentifier)').StartsWith('osx'))">
-    <ConcurrentGarbageCollection>false</ConcurrentGarbageCollection>
+    <Version>0.0.1</Version>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(Configuration)' == 'Release'">
     <GenerateDocumentationFile>false</GenerateDocumentationFile>
     <DebugType>none</DebugType>
     <DebugSymbols>false</DebugSymbols>
+    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(RuntimeIdentifier)' == 'win-x64' Or '$(RuntimeIdentifier)' == ''">
     <ApplicationIcon>..\..\assets\images\SharpEmu.ico</ApplicationIcon>
     <Win32Icon>..\..\assets\images\SharpEmu.ico</Win32Icon>
-    <ApplicationManifest>app.manifest</ApplicationManifest>
-  </PropertyGroup>
-
-  <PropertyGroup>
-    <NoWarn>$(NoWarn);1591</NoWarn>
   </PropertyGroup>
 
   <ItemGroup>
@@ -72,112 +41,6 @@ SPDX-License-Identifier: GPL-2.0-or-later
       <TargetPath>LICENSE.txt</TargetPath>
       <Visible>False</Visible>
     </Content>
-    <Content Include="..\SharpEmu.GUI\Languages\*.json" Condition="'$(Configuration)' != 'Release'">
-      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
-      <TargetPath>Languages\%(Filename)%(Extension)</TargetPath>
-      <Visible>False</Visible>
-    </Content>
-    <Content Include="..\SharpEmu.LibAtrac9\LICENSE.txt">
-      <CopyToPublishDirectory>Always</CopyToPublishDirectory>
-      <TargetPath>licenses\LibAtrac9.txt</TargetPath>
-      <ExcludeFromSingleFile>true</ExcludeFromSingleFile>
-      <Visible>False</Visible>
-    </Content>
   </ItemGroup>
 
-  <Target Name="KeepLibAtrac9External" BeforeTargets="_ComputeFilesToBundle">
-    <ItemGroup>
-      <ResolvedFileToPublish Update="@(ResolvedFileToPublish)"
-        Condition="'%(Filename)%(Extension)' == 'SharpEmu.LibAtrac9.dll'">
-        <ExcludeFromSingleFile>true</ExcludeFromSingleFile>
-        <RelativePath>plugins\SharpEmu.LibAtrac9.dll</RelativePath>
-      </ResolvedFileToPublish>
-    </ItemGroup>
-  </Target>
-
-  <!-- These are native debug symbols emitted by Skia/HarfBuzz, not managed
-       symbols that single-file publish can bundle. They are not needed at
-       runtime and would otherwise add more than 100 MB to every release. -->
-  <Target Name="RemoveNativeDebugSymbols" AfterTargets="Publish">
-    <ItemGroup>
-      <_NativeDebugSymbols Include="$(PublishDir)**\*.pdb" />
-    </ItemGroup>
-    <Delete Files="@(_NativeDebugSymbols)" />
-  </Target>
-
-  <!-- Native FFmpeg libraries publish into a subfolder next to the
-       executable instead of sitting loose beside it, so the publish
-       directory stays uncluttered as more native deps get added. The folder
-       name is a fixed constant, not derived from the RID/architecture: each
-       publish output only ever holds one architecture's binaries anyway, so
-       varying the name added a class of bugs (RID resolution timing, host-OS
-       vs. target-RID mixups) for no benefit. Runtime code (FfmpegRuntime)
-       uses the same literal "plugins" folder name. -->
-  <PropertyGroup>
-    <NativeLibraryFolderName>plugins</NativeLibraryFolderName>
-  </PropertyGroup>
-
-  <PropertyGroup>
-    <FfmpegRuntimeTag>3b502d4</FfmpegRuntimeTag>
-    <FfmpegRuntimeDir>
-      $(BaseIntermediateOutputPath)ffmpeg-runtime/$(FfmpegRuntimeTag)/$(RuntimeIdentifier)</FfmpegRuntimeDir>
-    <FfmpegRuntimePackage Condition="'$(RuntimeIdentifier)' == 'win-x64'">ffmpeg-windows-x64.zip</FfmpegRuntimePackage>
-    <FfmpegRuntimePackage Condition="'$(RuntimeIdentifier)' == 'linux-x64'">ffmpeg-linux-x64.zip</FfmpegRuntimePackage>
-    <FfmpegRuntimePackage Condition="'$(RuntimeIdentifier)' == 'osx-x64'">ffmpeg-macos-x64.zip</FfmpegRuntimePackage>
-    <FfmpegRuntimePackage Condition="'$(RuntimeIdentifier)' == 'osx-arm64'">ffmpeg-macos-arm64.zip</FfmpegRuntimePackage>
-    <FfmpegRuntimeArchive>$(FfmpegRuntimeDir)/$(FfmpegRuntimePackage)</FfmpegRuntimeArchive>
-    <FfmpegRuntimeExtractDir>$(FfmpegRuntimeDir)/extracted</FfmpegRuntimeExtractDir>
-  </PropertyGroup>
-
-  <Target Name="FetchFfmpegRuntime"
-    BeforeTargets="Publish;Build"
-    Condition="'$(RuntimeIdentifier)' != '' And '$(FfmpegRuntimePackage)' != ''">
-    <DownloadFile
-      SourceUrl="https://github.com/sharpemu/ffmpeg-core/releases/download/$(FfmpegRuntimeTag)/$(FfmpegRuntimePackage)"
-      DestinationFolder="$(FfmpegRuntimeDir)"
-      Condition="!Exists('$(FfmpegRuntimeArchive)')" />
-    <Unzip
-      SourceFiles="$(FfmpegRuntimeArchive)"
-      DestinationFolder="$(FfmpegRuntimeExtractDir)"
-      Condition="!Exists('$(FfmpegRuntimeExtractDir)')" />
-  </Target>
-
-  <Target Name="PublishFfmpegRuntime"
-    AfterTargets="Publish"
-    DependsOnTargets="FetchFfmpegRuntime"
-    Condition="'$(RuntimeIdentifier)' != '' And '$(FfmpegRuntimePackage)' != ''">
-    <!-- Keyed off the target $(RuntimeIdentifier), not the host OS: publishing
-         e.g. linux-x64 from a Windows machine is a supported cross-publish,
-         and the extracted archive's own layout (bin/*.dll vs lib/*.so*) only
-         depends on which platform's ffmpeg-core package was fetched. -->
-    <ItemGroup>
-      <_FfmpegRuntimeFiles Condition="$(RuntimeIdentifier.StartsWith('win'))"
-        Include="$(FfmpegRuntimeExtractDir)/bin/*.dll" />
-      <_FfmpegRuntimeFiles Condition="!$(RuntimeIdentifier.StartsWith('win'))"
-        Include="$(FfmpegRuntimeExtractDir)/lib/*.so;$(FfmpegRuntimeExtractDir)/lib/*.so.*;$(FfmpegRuntimeExtractDir)/lib/*.dylib" />
-    </ItemGroup>
-    <Copy SourceFiles="@(_FfmpegRuntimeFiles)"
-      DestinationFolder="$(PublishDir)$(NativeLibraryFolderName)"
-      SkipUnchangedFiles="true" />
-  </Target>
-
-  <!-- Mirrors PublishFfmpegRuntime for plain `dotnet build`: devs running
-       straight out of the build output directory (no publish step) still
-       need the FFmpeg plugins present, otherwise AvPlayer/Bink video probing
-       throws NotSupportedException the first time a guest opens a movie. -->
-  <Target Name="BuildFfmpegRuntime"
-    AfterTargets="Build"
-    DependsOnTargets="FetchFfmpegRuntime"
-    Condition="'$(RuntimeIdentifier)' != '' And '$(FfmpegRuntimePackage)' != ''">
-    <ItemGroup>
-      <_FfmpegRuntimeFiles Condition="$(RuntimeIdentifier.StartsWith('win'))"
-        Include="$(FfmpegRuntimeExtractDir)/bin/*.dll" />
-      <_FfmpegRuntimeFiles Condition="!$(RuntimeIdentifier.StartsWith('win'))"
-        Include="$(FfmpegRuntimeExtractDir)/lib/*.so;$(FfmpegRuntimeExtractDir)/lib/*.so.*;$(FfmpegRuntimeExtractDir)/lib/*.dylib" />
-    </ItemGroup>
-    <Copy SourceFiles="@(_FfmpegRuntimeFiles)"
-      DestinationFolder="$(OutDir)$(NativeLibraryFolderName)"
-      SkipUnchangedFiles="true" />
-  </Target>
-
 </Project>

src/SharpEmu.CLI/app.manifest

@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-
-<!--
-Copyright (C) 2026 SharpEmu Emulator Project
-SPDX-License-Identifier: GPL-2.0-or-later
--->
-
-<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
-  <assemblyIdentity version="1.0.0.0" name="SharpEmu" />
-  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
-    <application>
-      <!-- Required by Avalonia NativeControlHost on Windows 10 and 11. -->
-      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />
-    </application>
-  </compatibility>
-  <asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
-    <asmv3:windowsSettings>
-      <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2</dpiAwareness>
-    </asmv3:windowsSettings>
-  </asmv3:application>
-</assembly>

src/SharpEmu.CLI/packages.lock.json

@@ -0,0 +1,149 @@
+{
+  "version": 2,
+  "dependencies": {
+    "net10.0": {
+      "Microsoft.NET.ILLink.Tasks": {
+        "type": "Direct",
+        "requested": "[10.0.3, )",
+        "resolved": "10.0.3",
+        "contentHash": "0B6nZyCHWXnvmlB559oduOspVdNOnpNXPjhpWVMovLPAsDVG7A4jJR9rzECf67JUzxP8/ee/wA8clwIzJcWNFA=="
+      },
+      "Microsoft.DotNet.PlatformAbstractions": {
+        "type": "Transitive",
+        "resolved": "3.1.6",
+        "contentHash": "jek4XYaQ/PGUwDKKhwR8K47Uh1189PFzMeLqO83mXrXQVIpARZCcfuDedH50YDTepBkfijCZN5U/vZi++erxtg=="
+      },
+      "Microsoft.Extensions.DependencyModel": {
+        "type": "Transitive",
+        "resolved": "9.0.9",
+        "contentHash": "fNGvKct2De8ghm0Bpfq0iWthtzIWabgOTi+gJhNOPhNJIowXNEUE2eZNW/zNCzrHVA3PXg2yZ+3cWZndC2IqYA=="
+      },
+      "Silk.NET.Core": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "D7AT/nnwlB+4RZ84XY8QNGBZMJI5z9l4CSSETIJ1wCfRJzRt/341y3MRZ4HbnFz4r/IGaWOEZr86iE+0/65yyQ==",
+        "dependencies": {
+          "Microsoft.DotNet.PlatformAbstractions": "3.1.6",
+          "Microsoft.Extensions.DependencyModel": "9.0.9"
+        }
+      },
+      "Silk.NET.GLFW": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "UIs4sH57xlPUNHQ/1bt9rymPWlGy8IMDCNv86h0iM4TOA1CkIx0XM/n/tA4AReh1zQkNrvkxPEdZ3Blvy1dyXg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Ultz.Native.GLFW": "3.4.0"
+        }
+      },
+      "Silk.NET.Maths": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "r8PdIVzME8EH0qAgbmRPO87I4GfgR2j8TofT7EMuRJDf1QluoQwnVypDoFJjQ2ZBSRsGYk5unYxxogI05Ogsmw=="
+      },
+      "Silk.NET.Windowing.Common": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "ThStSinmY9KQI8DGiF5XEhkLJVnBcgRTBTzL9ijg1wMZAYuckz7ykrNw04fjRm2Gryh6tCNGbvz2XaY0efeFzg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Maths": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing.Glfw": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "aYBudKmENmvLRn9p15HbdvlQTnnXskcDfTfbYwSb/4fr263rGLwYuDw/txUEc2jihHJiWCp5+75Y7z5wTJWl7g==",
+        "dependencies": {
+          "Silk.NET.GLFW": "2.23.0",
+          "Silk.NET.Windowing.Common": "2.23.0"
+        }
+      },
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      },
+      "sharpemu.core": {
+        "type": "Project",
+        "dependencies": {
+          "Iced": "[1.21.0, )",
+          "SharpEmu.HLE": "[1.0.0, )",
+          "SharpEmu.Libs": "[1.0.0, )",
+          "SharpEmu.Logging": "[1.0.0, )"
+        }
+      },
+      "sharpemu.hle": {
+        "type": "Project"
+      },
+      "sharpemu.libs": {
+        "type": "Project",
+        "dependencies": {
+          "SharpEmu.HLE": "[1.0.0, )",
+          "Silk.NET.Vulkan": "[2.23.0, )",
+          "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
+          "Silk.NET.Windowing": "[2.23.0, )"
+        }
+      },
+      "sharpemu.logging": {
+        "type": "Project"
+      },
+      "Iced": {
+        "type": "CentralTransitive",
+        "requested": "[1.21.0, )",
+        "resolved": "1.21.0",
+        "contentHash": "dv5+81Q1TBQvVMSOOOmRcjJmvWcX3BZPZsIq31+RLc5cNft0IHAyNlkdb7ZarOWG913PyBoFDsDXoCIlKmLclg=="
+      },
+      "Silk.NET.Vulkan": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "3/irtlSWXZ3eTi8N6nelI6L34NTB8ZJHpqVMNzZx2aX7Ek9YEQ34NoQW8/Tljrtmkg8KRhHW8hKTEzZaKV8PgA==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0"
+        }
+      },
+      "Silk.NET.Vulkan.Extensions.KHR": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "uRaf4j+SmH3DumjSSSUbFg33BnsGZUyXGj93O9NgGKZSJN3OTmNmQDxRew+/KiVLcgH6qzbto8aNGZ++j9GFWg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "OPNPmt/lRyUKVYrFLQXVxyATqD3MKLc1iY1oKx1/2GppgmZxVZPwN12tekrQ4C7408kgB1L5JD1Wnirqqeb2kg==",
+        "dependencies": {
+          "Silk.NET.Windowing.Common": "2.23.0",
+          "Silk.NET.Windowing.Glfw": "2.23.0"
+        }
+      }
+    },
+    "net10.0/linux-x64": {
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      }
+    },
+    "net10.0/osx-arm64": {
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      }
+    },
+    "net10.0/win-x64": {
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      }
+    }
+  }
+}

src/SharpEmu.Core/Cpu/CpuDispatcher.cs

@@ -3,7 +3,6 @@
 
 using System.Buffers.Binary;
 using System.Text;
-using SharpEmu.Core.Cpu.Debugging;
 using SharpEmu.Core.Cpu.Native;
 using SharpEmu.Core.Loader;
 using SharpEmu.Core.Memory;
@@ -19,22 +18,15 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         ModuleInitializer,
     }
 
-    // The top of the x86-64 user address space (0x7FFD..0x7FFF) is only
-    // freely mappable on Windows; on macOS/Linux it hosts the dyld shared
-    // cache / vdso and (under Rosetta 2) the translator runtime, so POSIX
-    // hosts use the equivalent layout one slot lower at 0x6FFx.
-    private static readonly ulong StackBaseAddress = OperatingSystem.IsWindows() ? 0x7FFF_F000_0000UL : 0x6FFF_F000_0000UL;
+    private const ulong StackBaseAddress = 0x7FFF_F000_0000UL;
     private const ulong StackSize = 0x0020_0000UL;
-    private static readonly ulong TlsBaseAddress = OperatingSystem.IsWindows() ? 0x7FFE_0000_0000UL : 0x6FFE_0000_0000UL;
+    private const ulong TlsBaseAddress = 0x7FFE_0000_0000UL;
     private const ulong TlsSize = 0x0001_0000UL;
-    // The static TLS blocks live at negative offsets from the TCB (FreeBSD
-    // amd64 variant II). Keep every host in sync with GuestTlsTemplate's
-    // startup reservation; PS5 modules routinely reach beyond one host page.
-    private const ulong TlsPrefixSize = GuestTlsTemplate.StartupStaticTlsReservation;
-    private static readonly ulong BootstrapStubBaseAddress = OperatingSystem.IsWindows() ? 0x7FFD_F000_0000UL : 0x6FFD_F000_0000UL;
-    private static readonly ulong BootstrapPayloadBaseAddress = OperatingSystem.IsWindows() ? 0x7FFD_E000_0000UL : 0x6FFD_E000_0000UL;
-    private static readonly ulong DynlibFallbackStubBaseAddress = OperatingSystem.IsWindows() ? 0x7FFD_D000_0000UL : 0x6FFD_D000_0000UL;
-    private static readonly ulong ReturnToHostStubBaseAddress = OperatingSystem.IsWindows() ? 0x7FFD_C000_0000UL : 0x6FFD_C000_0000UL;
+    private const ulong TlsPrefixSize = 0x0000_1000UL;
+    private const ulong BootstrapStubBaseAddress = 0x7FFD_F000_0000UL;
+    private const ulong BootstrapPayloadBaseAddress = 0x7FFD_E000_0000UL;
+    private const ulong DynlibFallbackStubBaseAddress = 0x7FFD_D000_0000UL;
+    private const ulong ReturnToHostStubBaseAddress = 0x7FFD_C000_0000UL;
     private const ulong BootstrapRegionSize = 0x0000_1000UL;
     private const ulong ReturnToHostStubStride = 0x0100_0000UL;
     private const ulong BootstrapPayloadResultOffset = 0x28UL;
@@ -133,20 +125,6 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         }
     }
 
-    public bool TryInstallAdditionalModule(
-        IReadOnlyDictionary<ulong, string> importStubs,
-        IReadOnlyDictionary<string, ulong> runtimeSymbols,
-        out string? error)
-    {
-        if (_nativeCpuBackend is not DirectExecutionBackend backend)
-        {
-            error = "the active CPU backend does not support runtime modules";
-            return false;
-        }
-
-        return backend.TryInstallAdditionalModule(importStubs, runtimeSymbols, out error);
-    }
-
     private OrbisGen2Result DispatchEntryCore(
         ulong entryPoint,
         Generation generation,
@@ -287,23 +265,7 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
             entryFrameDiagnostic,
             Environment.NewLine,
             "CpuEngine: native-only");
-        // Frame boundaries an attached debugger observes; null hook = a branch.
-        var debugHook = executionOptions.DebugHook;
-        var debugFrame = debugHook is null
-            ? null
-            : new CpuContextDebugFrame(
-                frameKind == EntryFrameKind.ProcessEntry
-                    ? CpuDebugFrameKind.ProcessEntry
-                    : CpuDebugFrameKind.ModuleInitializer,
-                entryPoint,
-                processImageName,
-                context,
-                effectiveImportStubs);
-        debugHook?.OnFrameEnter(debugFrame!);
-
         _nativeCpuBackend ??= new DirectExecutionBackend(_moduleManager);
-        // Let backend stall reports reference the same frame as entry.
-        (_nativeCpuBackend as DirectExecutionBackend)?.SetActiveDebugFrame(debugFrame);
         if (_nativeCpuBackend.TryExecute(
                 context,
                 entryPoint,
@@ -313,7 +275,6 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
                 executionOptions,
                 out var nativeResult))
         {
-            debugHook?.OnFrameExit(debugFrame!, nativeResult);
             LastSessionSummary = new CpuSessionSummary(
                 nativeResult,
                 nativeResult == OrbisGen2Result.ORBIS_GEN2_OK
@@ -328,8 +289,6 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
             return nativeResult;
         }
 
-        debugHook?.OnFrameExit(debugFrame!, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_IMPLEMENTED);
-
         var backendName = string.IsNullOrWhiteSpace(_nativeCpuBackend.BackendName)
             ? "native-backend"
             : _nativeCpuBackend.BackendName;
@@ -406,19 +365,11 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
 
     private static bool InitializeTls(CpuContext context, ulong tlsBase)
     {
-        if (!context.TryWriteUInt64(tlsBase - 0xF0, 0) ||
-            !context.TryWriteUInt64(tlsBase + 0x00, tlsBase) ||
-            !context.TryWriteUInt64(tlsBase + 0x10, tlsBase) ||
-            !context.TryWriteUInt64(tlsBase + 0x28, 0xC0DEC0DECAFEBA00UL) ||
-            !context.TryWriteUInt64(tlsBase + 0x60, tlsBase))
-        {
-            return false;
-        }
-
-        // Seed the static TLS block below the thread pointer with the main
-        // module's initialized thread-locals (variant II layout).
-        SharpEmu.HLE.GuestTlsTemplate.SeedThreadBlock(context, tlsBase);
-        return true;
+        return context.TryWriteUInt64(tlsBase - 0xF0, 0) &&
+               context.TryWriteUInt64(tlsBase + 0x00, tlsBase) &&
+               context.TryWriteUInt64(tlsBase + 0x10, tlsBase) &&
+               context.TryWriteUInt64(tlsBase + 0x28, 0xC0DEC0DECAFEBABEUL) &&
+               context.TryWriteUInt64(tlsBase + 0x60, tlsBase);
     }
 
     private static bool InitializeGuestFrameChainSentinel(CpuContext context)
@@ -444,52 +395,33 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         ulong programExitHandlerAddress)
     {
         var imageName = string.IsNullOrWhiteSpace(processImageName) ? "eboot.bin" : processImageName;
-        var arguments = new List<string>(3) { imageName };
-        var configuredArguments = Environment.GetEnvironmentVariable("SHARPEMU_GUEST_ARGS");
-        if (!string.IsNullOrWhiteSpace(configuredArguments))
-        {
-            // The PS5 entry-parameter ABI exposes three inline argv pointers.
-            // Two compatibility arguments are therefore safe without changing
-            // the fixed 0x20-byte structure expected by existing titles.
-            var compatibilityArguments = configuredArguments.Split(
-                (char[]?)null,
-                StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
-            arguments.AddRange(compatibilityArguments.Take(2));
-        }
-
-        var cursor = context[CpuRegister.Rsp];
-        var argumentAddresses = new ulong[arguments.Count];
-        for (var index = arguments.Count - 1; index >= 0; index--)
-        {
-            var encoded = Encoding.UTF8.GetBytes(arguments[index] + '\0');
-            cursor = AlignDown(cursor - (ulong)encoded.Length, 16);
-            if (!context.Memory.TryWrite(cursor, encoded))
-            {
-                return false;
-            }
-
-            argumentAddresses[index] = cursor;
-        }
-
-        const ulong entryParamsSize = 0x20;
-        var entryParamsAddress = AlignDown(cursor - entryParamsSize, 16);
-        if (!TryWriteUInt32(context, entryParamsAddress + 0x00, (uint)arguments.Count) ||
-            !TryWriteUInt32(context, entryParamsAddress + 0x04, 0) ||
-            !context.TryWriteUInt64(entryParamsAddress + 0x08, argumentAddresses[0]) ||
-            !context.TryWriteUInt64(
-                entryParamsAddress + 0x10,
-                argumentAddresses.Length > 1 ? argumentAddresses[1] : 0) ||
-            !context.TryWriteUInt64(
-                entryParamsAddress + 0x18,
-                argumentAddresses.Length > 2 ? argumentAddresses[2] : 0))
+        var encodedNameLength = Encoding.UTF8.GetByteCount(imageName);
+        Span<byte> argv0Buffer = encodedNameLength + 1 <= 512
+            ? stackalloc byte[encodedNameLength + 1]
+            : new byte[encodedNameLength + 1];
+        if (Encoding.UTF8.GetBytes(imageName.AsSpan(), argv0Buffer) != encodedNameLength)
         {
             return false;
         }
 
-        if (arguments.Count > 1)
+        argv0Buffer[encodedNameLength] = 0;
+        var cursor = context[CpuRegister.Rsp];
+
+        var argv0Address = AlignDown(cursor - (ulong)argv0Buffer.Length, 16);
+        if (!context.Memory.TryWrite(argv0Address, argv0Buffer))
         {
-            Console.Error.WriteLine(
-                $"[DISPATCHER] Guest arguments: {string.Join(' ', arguments.Skip(1))}");
+            return false;
+        }
+
+        const ulong entryParamsSize = 0x20;
+        var entryParamsAddress = AlignDown(argv0Address - entryParamsSize, 16);
+        if (!TryWriteUInt32(context, entryParamsAddress + 0x00, 1) ||
+            !TryWriteUInt32(context, entryParamsAddress + 0x04, 0) ||
+            !context.TryWriteUInt64(entryParamsAddress + 0x08, argv0Address) ||
+            !context.TryWriteUInt64(entryParamsAddress + 0x10, 0) ||
+            !context.TryWriteUInt64(entryParamsAddress + 0x18, 0))
+        {
+            return false;
         }
 
         var entryStackPointer = entryParamsAddress - sizeof(ulong);
@@ -727,13 +659,6 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         return _virtualMemory.TryWrite(address, buffer);
     }
 
-    /// <summary>
-    /// True when the disposed native backend left its session state alive
-    /// because guest workers were still executing guest code. The guest
-    /// address space must then stay mapped as well.
-    /// </summary>
-    internal bool NativeSessionLeaked { get; private set; }
-
     public void Dispose()
     {
         if (_nativeCpuBackend is IDisposable disposableBackend)
@@ -741,7 +666,6 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
             disposableBackend.Dispose();
         }
 
-        NativeSessionLeaked = _nativeCpuBackend is DirectExecutionBackend { GuestSessionLeaked: true };
         _nativeCpuBackend = null;
     }
 }

src/SharpEmu.Core/Cpu/CpuExecutionOptions.cs

@@ -1,26 +1,15 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-using SharpEmu.Core.Cpu.Debugging;
-
 namespace SharpEmu.Core.Cpu;
 
 public readonly struct CpuExecutionOptions
 {
     public bool EnableDisasmDiagnostics { get; init; }
-
+    
     public CpuExecutionEngine CpuEngine { get; init; }
 
     public bool StrictDynlibResolution { get; init; }
 
     public int ImportTraceLimit { get; init; }
-
-    /// <summary>
-    /// An optional debugger attached to this execution session. When set, the
-    /// dispatcher notifies it at each frame boundary via
-    /// <see cref="ICpuDebugHook.OnFrameEnter"/> / <see cref="ICpuDebugHook.OnFrameExit"/>.
-    /// Null when no debugger is attached, which is the default and imposes no
-    /// runtime cost.
-    /// </summary>
-    public ICpuDebugHook? DebugHook { get; init; }
 }

src/SharpEmu.Core/Cpu/Debugging/CpuContextDebugFrame.cs

@@ -1,66 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using SharpEmu.HLE;
-
-namespace SharpEmu.Core.Cpu.Debugging;
-
-/// <summary>
-/// Adapts a live <see cref="CpuContext"/> to <see cref="ICpuDebugFrame"/>. The
-/// dispatcher creates one of these around the guest context it is about to run
-/// and passes it to the attached <see cref="ICpuDebugHook"/>; every accessor
-/// forwards directly to the underlying context.
-/// </summary>
-internal sealed class CpuContextDebugFrame : ICpuDebugFrame
-{
-    private readonly CpuContext _context;
-
-    internal CpuContextDebugFrame(
-        CpuDebugFrameKind kind,
-        ulong entryPoint,
-        string label,
-        CpuContext context,
-        IReadOnlyDictionary<ulong, string> importStubs)
-    {
-        Kind = kind;
-        EntryPoint = entryPoint;
-        Label = label ?? string.Empty;
-        _context = context ?? throw new ArgumentNullException(nameof(context));
-        ImportStubs = importStubs ?? new Dictionary<ulong, string>();
-    }
-
-    public CpuDebugFrameKind Kind { get; }
-
-    public Generation Generation => _context.TargetGeneration;
-
-    public ulong EntryPoint { get; }
-
-    public string Label { get; }
-
-    public ICpuMemory Memory => _context.Memory;
-
-    public ulong GetRegister(CpuRegister register) => _context[register];
-
-    public void SetRegister(CpuRegister register, ulong value) => _context[register] = value;
-
-    public ulong Rip
-    {
-        get => _context.Rip;
-        set => _context.Rip = value;
-    }
-
-    public ulong Rflags
-    {
-        get => _context.Rflags;
-        set => _context.Rflags = value;
-    }
-
-    public ulong FsBase => _context.FsBase;
-
-    public ulong GsBase => _context.GsBase;
-
-    public void GetXmm(int registerIndex, out ulong low, out ulong high)
-        => _context.GetXmmRegister(registerIndex, out low, out high);
-
-    public IReadOnlyDictionary<ulong, string> ImportStubs { get; }
-}

src/SharpEmu.Core/Cpu/Debugging/CpuDebugFrameKind.cs

@@ -1,18 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-namespace SharpEmu.Core.Cpu.Debugging;
-
-/// <summary>
-/// Identifies the kind of guest entry frame a debugger is observing. The
-/// dispatcher enters a fresh frame for the process entry point and for every
-/// module initializer, so the debug layer can label stops accordingly.
-/// </summary>
-public enum CpuDebugFrameKind
-{
-    /// <summary>The guest process entry point (<c>eboot.bin</c> start).</summary>
-    ProcessEntry,
-
-    /// <summary>A module DT_INIT / initializer routine.</summary>
-    ModuleInitializer,
-}

src/SharpEmu.Core/Cpu/Debugging/CpuStallInfo.cs

@@ -1,70 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-namespace SharpEmu.Core.Cpu.Debugging;
-
-/// <summary>The kind of execution stall the backend detected.</summary>
-public enum CpuStallKind
-{
-    /// <summary>
-    /// The guest is repeatedly re-dispatching the same import with no forward
-    /// progress — most commonly a spin on a mutex lock/unlock pair.
-    /// </summary>
-    ImportLoop,
-}
-
-/// <summary>
-/// Details of a detected stall handed to <see cref="ICpuDebugHook.OnStall"/>.
-/// Reported from the emulation thread at the point the backend recognises the
-/// livelock, before it forces the guest out of the loop.
-/// </summary>
-public readonly struct CpuStallInfo
-{
-    public CpuStallInfo(
-        CpuStallKind kind,
-        string? nid,
-        ulong instructionPointer,
-        long dispatchIndex,
-        ulong argument0,
-        ulong argument1,
-        string detail,
-        string? libraryName = null,
-        string? functionName = null)
-    {
-        Kind = kind;
-        Nid = nid;
-        InstructionPointer = instructionPointer;
-        DispatchIndex = dispatchIndex;
-        Argument0 = argument0;
-        Argument1 = argument1;
-        Detail = detail ?? string.Empty;
-        LibraryName = libraryName;
-        FunctionName = functionName;
-    }
-
-    public CpuStallKind Kind { get; }
-
-    /// <summary>The NID of the import being spun on, when known.</summary>
-    public string? Nid { get; }
-
-    /// <summary>The guest return address of the looping import dispatch.</summary>
-    public ulong InstructionPointer { get; }
-
-    /// <summary>The import dispatch counter at detection time.</summary>
-    public long DispatchIndex { get; }
-
-    /// <summary>The first two guest ABI arguments at stall detection.</summary>
-    public ulong Argument0 { get; }
-
-    public ulong Argument1 { get; }
-
-    /// <summary>The resolved HLE export, when the NID is registered.</summary>
-    public string? LibraryName { get; }
-
-    public string? FunctionName { get; }
-
-    public bool IsResolved => !string.IsNullOrWhiteSpace(FunctionName);
-
-    /// <summary>A human-readable one-line summary of the stall.</summary>
-    public string Detail { get; }
-}

src/SharpEmu.Core/Cpu/Debugging/ICpuDebugFrame.cs

@@ -1,66 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using SharpEmu.HLE;
-
-namespace SharpEmu.Core.Cpu.Debugging;
-
-/// <summary>
-/// A live view of the guest CPU state at a dispatch boundary, handed to an
-/// <see cref="ICpuDebugHook"/> so a debugger can read and mutate registers and
-/// guest memory without taking a dependency on the concrete
-/// <c>CpuContext</c>/<c>CpuDispatcher</c> types.
-/// </summary>
-/// <remarks>
-/// The frame instance is only valid for the duration of the hook call that
-/// receives it (between <see cref="ICpuDebugHook.OnFrameEnter"/> and the
-/// matching <see cref="ICpuDebugHook.OnFrameExit"/>). Reads and writes are
-/// forwarded straight to the underlying guest context, so mutations made from
-/// a hook are observed by the CPU backend when it resumes the frame.
-/// </remarks>
-public interface ICpuDebugFrame
-{
-    /// <summary>The kind of frame being executed.</summary>
-    CpuDebugFrameKind Kind { get; }
-
-    /// <summary>The guest ABI generation this frame targets.</summary>
-    Generation Generation { get; }
-
-    /// <summary>The guest virtual address the frame begins executing at.</summary>
-    ulong EntryPoint { get; }
-
-    /// <summary>
-    /// A human-readable label for the frame (process image name or module name).
-    /// </summary>
-    string Label { get; }
-
-    /// <summary>Guest-addressable memory for this frame.</summary>
-    ICpuMemory Memory { get; }
-
-    /// <summary>Reads a general-purpose register.</summary>
-    ulong GetRegister(CpuRegister register);
-
-    /// <summary>Overwrites a general-purpose register.</summary>
-    void SetRegister(CpuRegister register, ulong value);
-
-    /// <summary>The instruction pointer.</summary>
-    ulong Rip { get; set; }
-
-    /// <summary>The flags register.</summary>
-    ulong Rflags { get; set; }
-
-    /// <summary>The FS segment base (guest TLS pointer).</summary>
-    ulong FsBase { get; }
-
-    /// <summary>The GS segment base.</summary>
-    ulong GsBase { get; }
-
-    /// <summary>Reads the 128-bit value of an XMM register.</summary>
-    void GetXmm(int registerIndex, out ulong low, out ulong high);
-
-    /// <summary>
-    /// The import stubs (guest address to NID) resolved for this frame, so a
-    /// debugger can annotate calls into HLE exports.
-    /// </summary>
-    IReadOnlyDictionary<ulong, string> ImportStubs { get; }
-}

src/SharpEmu.Core/Cpu/Debugging/ICpuDebugHook.cs

@@ -1,49 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using SharpEmu.HLE;
-
-namespace SharpEmu.Core.Cpu.Debugging;
-
-/// <summary>
-/// The seam the CPU dispatcher uses to notify an attached debugger when guest
-/// execution crosses a frame boundary. Implemented outside of Core (for
-/// example by <c>SharpEmu.Debugger</c>) and supplied through
-/// <see cref="CpuExecutionOptions.DebugHook"/>.
-/// </summary>
-/// <remarks>
-/// This is intentionally coarse-grained: it exposes the entry and exit of each
-/// dispatched frame rather than per-instruction stepping. Per-instruction
-/// control requires cooperation from the native execution backend and is layered
-/// on top of this seam as the backend gains support; keeping the dispatcher-level
-/// contract stable lets the debugger infrastructure exist independently of that
-/// work. Implementations must be thread-safe: frames may be dispatched from the
-/// dedicated emulation thread while a debug server services clients on its own
-/// threads.
-/// </remarks>
-public interface ICpuDebugHook
-{
-    /// <summary>
-    /// Invoked immediately before the native backend begins executing a frame.
-    /// The debugger may inspect or mutate <paramref name="frame"/> and may block
-    /// the calling thread (for example, to honour a pause request) before
-    /// returning to allow execution to proceed.
-    /// </summary>
-    void OnFrameEnter(ICpuDebugFrame frame);
-
-    /// <summary>
-    /// Invoked after a frame completes, whether it returned to the host or
-    /// terminated with an error. <paramref name="frame"/> reflects the final
-    /// guest state.
-    /// </summary>
-    void OnFrameExit(ICpuDebugFrame frame, OrbisGen2Result result);
-
-    /// <summary>
-    /// Invoked from the emulation thread when the backend detects an execution
-    /// stall (for example a mutex spin loop) in the running frame, before it
-    /// forces the guest out of the loop. As with <see cref="OnFrameEnter"/>, the
-    /// implementation may inspect <paramref name="frame"/> and block to honour a
-    /// break before returning to let the backend proceed.
-    /// </summary>
-    void OnStall(ICpuDebugFrame frame, CpuStallInfo info);
-}

src/SharpEmu.Core/Cpu/Emulation/BmiInstructionEmulator.cs

@@ -1,305 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Numerics;
-
-namespace SharpEmu.Core.Cpu.Emulation;
-
-/// <summary>
-/// Pure software implementations of the BMI1, BMI2 and ABM general-purpose-register
-/// bit-manipulation instructions.
-///
-/// The direct-execution backend runs guest PS5 code natively on the host CPU. The PS5's
-/// Zen 2 cores implement BMI1/BMI2/ABM, but a host CPU that predates those extensions raises
-/// #UD (STATUS_ILLEGAL_INSTRUCTION) when it meets one of these opcodes. This class provides the
-/// register-only arithmetic so the exception handler can finish the instruction in software and
-/// resume, instead of aborting the title.
-///
-/// The methods deliberately operate on plain integers rather than on the OS CONTEXT record so the
-/// semantics can be unit-tested in isolation; the unsafe register/memory plumbing lives in the
-/// backend adapter. Each method returns the result already masked to the operand width and, where
-/// the instruction is defined to touch flags, updates <paramref name="eflags"/> in place. Flags
-/// documented as "undefined" by the vendor manuals are left untouched so behaviour stays
-/// deterministic across hosts.
-/// </summary>
-public static class BmiInstructionEmulator
-{
-    private const uint FlagCarry = 1u << 0;
-    private const uint FlagZero = 1u << 6;
-    private const uint FlagSign = 1u << 7;
-    private const uint FlagOverflow = 1u << 11;
-
-    private static ulong WidthMask(GprOperandSize size) =>
-        size == GprOperandSize.Bits64 ? ulong.MaxValue : 0xFFFF_FFFFUL;
-
-    private static int WidthBits(GprOperandSize size) => (int)size;
-
-    private static bool SignSet(ulong value, GprOperandSize size) =>
-        size == GprOperandSize.Bits64 ? (value >> 63) != 0 : (value & 0x8000_0000UL) != 0;
-
-    private static uint WithFlag(uint eflags, uint flag, bool set) =>
-        set ? eflags | flag : eflags & ~flag;
-
-    // Applies the CF/ZF/SF/OF set shared by ANDN/BLS*/BZHI: OF is always cleared, ZF and SF follow
-    // the result, and the caller supplies CF because each instruction defines it differently.
-    private static uint ApplyLogicFlags(uint eflags, ulong result, GprOperandSize size, bool carry)
-    {
-        eflags = WithFlag(eflags, FlagCarry, carry);
-        eflags = WithFlag(eflags, FlagZero, result == 0);
-        eflags = WithFlag(eflags, FlagSign, SignSet(result, size));
-        eflags = WithFlag(eflags, FlagOverflow, false);
-        return eflags;
-    }
-
-    /// <summary>ANDN: <c>dest = (~src1) &amp; src2</c>. CF and OF are cleared.</summary>
-    public static ulong Andn(ulong src1, ulong src2, GprOperandSize size, ref uint eflags)
-    {
-        var result = (~src1 & src2) & WidthMask(size);
-        eflags = ApplyLogicFlags(eflags, result, size, carry: false);
-        return result;
-    }
-
-    /// <summary>BLSI: isolate the lowest set bit, <c>dest = (-src) &amp; src</c>. CF = (src != 0).</summary>
-    public static ulong Blsi(ulong src, GprOperandSize size, ref uint eflags)
-    {
-        var mask = WidthMask(size);
-        var s = src & mask;
-        var result = ((0UL - s) & s) & mask;
-        eflags = ApplyLogicFlags(eflags, result, size, carry: s != 0);
-        return result;
-    }
-
-    /// <summary>BLSMSK: mask up to and including the lowest set bit, <c>dest = (src - 1) ^ src</c>. CF = (src == 0).</summary>
-    public static ulong Blsmsk(ulong src, GprOperandSize size, ref uint eflags)
-    {
-        var mask = WidthMask(size);
-        var s = src & mask;
-        var result = ((s - 1) ^ s) & mask;
-        eflags = ApplyLogicFlags(eflags, result, size, carry: s == 0);
-        return result;
-    }
-
-    /// <summary>BLSR: reset the lowest set bit, <c>dest = (src - 1) &amp; src</c>. CF = (src == 0).</summary>
-    public static ulong Blsr(ulong src, GprOperandSize size, ref uint eflags)
-    {
-        var mask = WidthMask(size);
-        var s = src & mask;
-        var result = ((s - 1) & s) & mask;
-        eflags = ApplyLogicFlags(eflags, result, size, carry: s == 0);
-        return result;
-    }
-
-    /// <summary>
-    /// BEXTR: extract <c>len</c> bits of <paramref name="src"/> starting at bit <c>start</c>, where
-    /// start = control[7:0] and len = control[15:8]. Only ZF (per result) and cleared CF/OF are defined.
-    /// </summary>
-    public static ulong Bextr(ulong src, ulong control, GprOperandSize size, ref uint eflags)
-    {
-        var bits = WidthBits(size);
-        var start = (int)(control & 0xFF);
-        var length = (int)((control >> 8) & 0xFF);
-
-        ulong result;
-        if (start >= bits)
-        {
-            result = 0;
-        }
-        else
-        {
-            var shifted = (src & WidthMask(size)) >> start;
-            if (length == 0)
-            {
-                result = 0;
-            }
-            else if (length >= bits)
-            {
-                result = shifted;
-            }
-            else
-            {
-                result = shifted & ((1UL << length) - 1);
-            }
-        }
-
-        result &= WidthMask(size);
-        eflags = WithFlag(eflags, FlagZero, result == 0);
-        eflags = WithFlag(eflags, FlagCarry, false);
-        eflags = WithFlag(eflags, FlagOverflow, false);
-        return result;
-    }
-
-    /// <summary>
-    /// BZHI: zero the bits of <paramref name="src"/> from bit position <c>index[7:0]</c> upward.
-    /// CF is set when the requested position is at or beyond the operand width.
-    /// </summary>
-    public static ulong Bzhi(ulong src, ulong index, GprOperandSize size, ref uint eflags)
-    {
-        var bits = WidthBits(size);
-        var mask = WidthMask(size);
-        var s = src & mask;
-        var n = (int)(index & 0xFF);
-
-        ulong result;
-        bool carry;
-        if (n >= bits)
-        {
-            result = s;
-            carry = true;
-        }
-        else
-        {
-            result = s & ((1UL << n) - 1);
-            carry = false;
-        }
-
-        eflags = ApplyLogicFlags(eflags, result, size, carry);
-        return result;
-    }
-
-    /// <summary>TZCNT: count trailing zero bits. If src == 0 the result is the operand width and CF is set.</summary>
-    public static ulong Tzcnt(ulong src, GprOperandSize size, ref uint eflags)
-    {
-        var bits = WidthBits(size);
-        var s = src & WidthMask(size);
-
-        ulong result;
-        bool carry;
-        if (s == 0)
-        {
-            result = (ulong)bits;
-            carry = true;
-        }
-        else
-        {
-            result = (ulong)(size == GprOperandSize.Bits64
-                ? BitOperations.TrailingZeroCount(s)
-                : BitOperations.TrailingZeroCount((uint)s));
-            carry = false;
-        }
-
-        eflags = WithFlag(eflags, FlagCarry, carry);
-        eflags = WithFlag(eflags, FlagZero, result == 0);
-        return result;
-    }
-
-    /// <summary>LZCNT: count leading zero bits. If src == 0 the result is the operand width and CF is set.</summary>
-    public static ulong Lzcnt(ulong src, GprOperandSize size, ref uint eflags)
-    {
-        var bits = WidthBits(size);
-        var s = src & WidthMask(size);
-
-        ulong result;
-        bool carry;
-        if (s == 0)
-        {
-            result = (ulong)bits;
-            carry = true;
-        }
-        else
-        {
-            result = (ulong)(size == GprOperandSize.Bits64
-                ? BitOperations.LeadingZeroCount(s)
-                : BitOperations.LeadingZeroCount((uint)s));
-            carry = false;
-        }
-
-        eflags = WithFlag(eflags, FlagCarry, carry);
-        eflags = WithFlag(eflags, FlagZero, result == 0);
-        return result;
-    }
-
-    /// <summary>RORX: rotate <paramref name="src"/> right by <paramref name="count"/> (masked to the operand width). No flags.</summary>
-    public static ulong Rorx(ulong src, int count, GprOperandSize size)
-    {
-        var bits = WidthBits(size);
-        var mask = WidthMask(size);
-        var s = src & mask;
-        var rotate = count & (bits - 1);
-        if (rotate == 0)
-        {
-            return s;
-        }
-
-        return ((s >> rotate) | (s << (bits - rotate))) & mask;
-    }
-
-    /// <summary>SARX: arithmetic shift right by <paramref name="count"/> (masked to the operand width). No flags.</summary>
-    public static ulong Sarx(ulong src, int count, GprOperandSize size)
-    {
-        var bits = WidthBits(size);
-        var mask = WidthMask(size);
-        var shift = count & (bits - 1);
-        if (size == GprOperandSize.Bits64)
-        {
-            return (ulong)((long)src >> shift);
-        }
-
-        return (ulong)(uint)((int)(uint)src >> shift) & mask;
-    }
-
-    /// <summary>SHLX: logical shift left by <paramref name="count"/> (masked to the operand width). No flags.</summary>
-    public static ulong Shlx(ulong src, int count, GprOperandSize size)
-    {
-        var bits = WidthBits(size);
-        var mask = WidthMask(size);
-        var shift = count & (bits - 1);
-        return (src << shift) & mask;
-    }
-
-    /// <summary>SHRX: logical shift right by <paramref name="count"/> (masked to the operand width). No flags.</summary>
-    public static ulong Shrx(ulong src, int count, GprOperandSize size)
-    {
-        var bits = WidthBits(size);
-        var mask = WidthMask(size);
-        var s = src & mask;
-        var shift = count & (bits - 1);
-        return s >> shift;
-    }
-
-    /// <summary>PDEP: deposit contiguous low bits of <paramref name="src"/> into the positions selected by <paramref name="mask"/>. No flags.</summary>
-    public static ulong Pdep(ulong src, ulong mask, GprOperandSize size)
-    {
-        var bits = WidthBits(size);
-        var selector = mask & WidthMask(size);
-        ulong result = 0;
-        var bit = 0;
-        for (var i = 0; i < bits; i++)
-        {
-            var position = 1UL << i;
-            if ((selector & position) != 0)
-            {
-                if (((src >> bit) & 1UL) != 0)
-                {
-                    result |= position;
-                }
-
-                bit++;
-            }
-        }
-
-        return result & WidthMask(size);
-    }
-
-    /// <summary>PEXT: gather the bits of <paramref name="src"/> selected by <paramref name="mask"/> into contiguous low bits. No flags.</summary>
-    public static ulong Pext(ulong src, ulong mask, GprOperandSize size)
-    {
-        var bits = WidthBits(size);
-        var selector = mask & WidthMask(size);
-        ulong result = 0;
-        var bit = 0;
-        for (var i = 0; i < bits; i++)
-        {
-            if ((selector & (1UL << i)) != 0)
-            {
-                if (((src >> i) & 1UL) != 0)
-                {
-                    result |= 1UL << bit;
-                }
-
-                bit++;
-            }
-        }
-
-        return result & WidthMask(size);
-    }
-}

src/SharpEmu.Core/Cpu/Emulation/GprOperandSize.cs

@@ -1,14 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-namespace SharpEmu.Core.Cpu.Emulation;
-
-/// <summary>
-/// Operand width for the emulated general-purpose-register instructions. The numeric value is the
-/// bit width, so it can double as the "count leading/trailing zeros of an all-zero source" result.
-/// </summary>
-public enum GprOperandSize
-{
-    Bits32 = 32,
-    Bits64 = 64,
-}

src/SharpEmu.Core/Cpu/Emulation/ShaInstructionEmulator.cs

@@ -1,149 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Numerics;
-
-namespace SharpEmu.Core.Cpu.Emulation;
-
-/// <summary>
-/// Calculates the results of the SHA extension instructions for instruction recovery.
-/// Dword 0 of a value is bits 31:0 and dword 3 is bits 127:96, as in the Intel SDM.
-/// </summary>
-public static class ShaInstructionEmulator
-{
-    public static UInt128 Sha1Rnds4(UInt128 source1, UInt128 source2, int function)
-    {
-        var a = Dword(source1, 3);
-        var b = Dword(source1, 2);
-        var c = Dword(source1, 1);
-        var d = Dword(source1, 0);
-        var e = 0u;
-        var k = (function & 3) switch
-        {
-            0 => 0x5A827999u,
-            1 => 0x6ED9EBA1u,
-            2 => 0x8F1BBCDCu,
-            _ => 0xCA62C1D6u,
-        };
-
-        // The first message dword already carries E (SHA1NEXTE adds it).
-        for (var round = 0; round < 4; round++)
-        {
-            var next = Sha1Function(function, b, c, d) + BitOperations.RotateLeft(a, 5) + Dword(source2, 3 - round) + e + k;
-            e = d;
-            d = c;
-            c = BitOperations.RotateLeft(b, 30);
-            b = a;
-            a = next;
-        }
-
-        return FromDwords(d, c, b, a);
-    }
-
-    public static UInt128 Sha1Nexte(UInt128 source1, UInt128 source2)
-    {
-        var e = BitOperations.RotateLeft(Dword(source1, 3), 30);
-        return FromDwords(Dword(source2, 0), Dword(source2, 1), Dword(source2, 2), Dword(source2, 3) + e);
-    }
-
-    public static UInt128 Sha1Msg1(UInt128 source1, UInt128 source2)
-    {
-        var w0 = Dword(source1, 3);
-        var w1 = Dword(source1, 2);
-        var w2 = Dword(source1, 1);
-        var w3 = Dword(source1, 0);
-        var w4 = Dword(source2, 3);
-        var w5 = Dword(source2, 2);
-        return FromDwords(w5 ^ w3, w4 ^ w2, w3 ^ w1, w2 ^ w0);
-    }
-
-    public static UInt128 Sha1Msg2(UInt128 source1, UInt128 source2)
-    {
-        var w13 = Dword(source2, 2);
-        var w14 = Dword(source2, 1);
-        var w15 = Dword(source2, 0);
-        var w16 = BitOperations.RotateLeft(Dword(source1, 3) ^ w13, 1);
-        var w17 = BitOperations.RotateLeft(Dword(source1, 2) ^ w14, 1);
-        var w18 = BitOperations.RotateLeft(Dword(source1, 1) ^ w15, 1);
-        var w19 = BitOperations.RotateLeft(Dword(source1, 0) ^ w16, 1);
-        return FromDwords(w19, w18, w17, w16);
-    }
-
-    // SHA256RNDS2 takes its two round-constant-plus-message dwords from XMM0[63:0].
-    public static UInt128 Sha256Rnds2(UInt128 source1, UInt128 source2, UInt128 xmm0)
-    {
-        var a = Dword(source2, 3);
-        var b = Dword(source2, 2);
-        var c = Dword(source1, 3);
-        var d = Dword(source1, 2);
-        var e = Dword(source2, 1);
-        var f = Dword(source2, 0);
-        var g = Dword(source1, 1);
-        var h = Dword(source1, 0);
-
-        for (var round = 0; round < 2; round++)
-        {
-            var t1 = Ch(e, f, g) + BigSigma1(e) + Dword(xmm0, round) + h;
-            var t2 = Maj(a, b, c) + BigSigma0(a);
-            h = g;
-            g = f;
-            f = e;
-            e = d + t1;
-            d = c;
-            c = b;
-            b = a;
-            a = t1 + t2;
-        }
-
-        return FromDwords(f, e, b, a);
-    }
-
-    public static UInt128 Sha256Msg1(UInt128 source1, UInt128 source2)
-    {
-        var w4 = Dword(source2, 0);
-        var w3 = Dword(source1, 3);
-        var w2 = Dword(source1, 2);
-        var w1 = Dword(source1, 1);
-        var w0 = Dword(source1, 0);
-        return FromDwords(w0 + SmallSigma0(w1), w1 + SmallSigma0(w2), w2 + SmallSigma0(w3), w3 + SmallSigma0(w4));
-    }
-
-    public static UInt128 Sha256Msg2(UInt128 source1, UInt128 source2)
-    {
-        var w14 = Dword(source2, 2);
-        var w15 = Dword(source2, 3);
-        var w16 = Dword(source1, 0) + SmallSigma1(w14);
-        var w17 = Dword(source1, 1) + SmallSigma1(w15);
-        var w18 = Dword(source1, 2) + SmallSigma1(w16);
-        var w19 = Dword(source1, 3) + SmallSigma1(w17);
-        return FromDwords(w16, w17, w18, w19);
-    }
-
-    public static uint Dword(UInt128 value, int index) => (uint)(value >> (32 * index));
-
-    public static UInt128 FromDwords(uint dword0, uint dword1, uint dword2, uint dword3) =>
-        ((UInt128)dword3 << 96) | ((UInt128)dword2 << 64) | ((UInt128)dword1 << 32) | dword0;
-
-    private static uint Sha1Function(int function, uint b, uint c, uint d) => (function & 3) switch
-    {
-        0 => (b & c) ^ (~b & d),
-        2 => (b & c) ^ (b & d) ^ (c & d),
-        _ => b ^ c ^ d,
-    };
-
-    private static uint Ch(uint e, uint f, uint g) => (e & f) ^ (~e & g);
-
-    private static uint Maj(uint a, uint b, uint c) => (a & b) ^ (a & c) ^ (b & c);
-
-    private static uint BigSigma0(uint x) =>
-        BitOperations.RotateRight(x, 2) ^ BitOperations.RotateRight(x, 13) ^ BitOperations.RotateRight(x, 22);
-
-    private static uint BigSigma1(uint x) =>
-        BitOperations.RotateRight(x, 6) ^ BitOperations.RotateRight(x, 11) ^ BitOperations.RotateRight(x, 25);
-
-    private static uint SmallSigma0(uint x) =>
-        BitOperations.RotateRight(x, 7) ^ BitOperations.RotateRight(x, 18) ^ (x >> 3);
-
-    private static uint SmallSigma1(uint x) =>
-        BitOperations.RotateRight(x, 17) ^ BitOperations.RotateRight(x, 19) ^ (x >> 10);
-}

src/SharpEmu.Core/Cpu/Emulation/Sse4aBitFieldEmulator.cs

@@ -1,48 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-namespace SharpEmu.Core.Cpu.Emulation;
-
-/// <summary>
-/// Calculates the bit-field results for SSE4a instruction recovery.
-/// </summary>
-public static class Sse4aBitFieldEmulator
-{
-    public static bool IsValidBitField(int length, int index)
-    {
-        var len = length & 0x3F;
-        var idx = index & 0x3F;
-        return (len != 0 || idx == 0) && (len == 0 ? idx == 0 : idx + len <= 64);
-    }
-
-    public static ulong ExtractBitField(ulong value, int length, int index)
-    {
-        var len = length & 0x3F;
-        var idx = index & 0x3F;
-        if (len == 0)
-        {
-            len = 64;
-        }
-
-        // Results past bit 63 are undefined; limit the field to the remaining bits.
-        len = Math.Min(len, 64 - idx);
-        var mask = len == 64 ? ulong.MaxValue : (1UL << len) - 1;
-        return (value >> idx) & mask;
-    }
-
-    public static ulong InsertBitField(ulong destination, ulong source, int length, int index)
-    {
-        var len = length & 0x3F;
-        var idx = index & 0x3F;
-        if (len == 0)
-        {
-            len = 64;
-        }
-
-        len = Math.Min(len, 64 - idx);
-        var fieldMask = len == 64 ? ulong.MaxValue : (1UL << len) - 1;
-        var destinationClearMask = fieldMask << idx;
-        var sourceField = (source & fieldMask) << idx;
-        return (destination & ~destinationClearMask) | sourceField;
-    }
-}

src/SharpEmu.Core/Cpu/Native/CpuPatcher.cs

@@ -26,21 +26,22 @@ public sealed unsafe class CpuPatcher : IDisposable
 
     internal unsafe class UnsafeCodeReader : Iced.Intel.CodeReader
     {
-        private readonly byte* _start;
-        private readonly ulong _length;
-        public ulong Position { get; private set; }
+        private byte* _start;
+        private byte* _current;
+        private int _length;
 
-        public UnsafeCodeReader(byte* start, ulong length)
+        public UnsafeCodeReader(byte* start, int length)
         {
             _start = start;
+            _current = start;
             _length = length;
         }
 
         public override int ReadByte()
         {
-            if (Position >= _length)
+            if (_current >= _start + _length)
                 return -1;
-            return _start[Position++];
+            return *_current++;
         }
     }
 }

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Amd64Compat.cs

@@ -1,189 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Threading;
-using Iced.Intel;
-using SharpEmu.Core.Cpu.Emulation;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-// Recover supported instructions only after an illegal-instruction fault.
-// Leave native instructions and unrelated register values unchanged.
-public sealed partial class DirectExecutionBackend
-{
-    // Byte offset of Xmm0 within the Win64 CONTEXT record: FltSave (the XMM_SAVE_AREA32/FXSAVE
-    // image) starts right after Rip at offset 256, and XmmRegisters[0] sits 160 bytes into that
-    // area (32-byte header + 8 legacy x87/MMX slots x 16 bytes). 256 + 160 = 416 (0x1A0). Cross-
-    // checked against this file's own Win64ContextSize (0x4D0): rebuilding the whole CONTEXT
-    // layout field-by-field from offset 0 lands on the same 0x4D0 total, which would not happen
-    // if this offset (or anything before it) were wrong.
-    private const int Win64ContextXmm0Offset = 0x1A0;
-
-    private static int _sse4aSoftwareFallbackAnnounced;
-    private static long _sse4aInstructionsEmulated;
-    private static int _monitorxSoftwareFallbackAnnounced;
-    private static long _monitorxInstructionsEmulated;
-
-    private unsafe bool TryRecoverAmdCompatInstruction(void* contextRecord, ulong rip)
-    {
-        if (TryRecoverMonitorxMwaitx(contextRecord, rip))
-        {
-            return true;
-        }
-
-        // EXTRQ and INSERTQ need the current vector register values.
-        // Use recovery only when the signal context contains these values.
-        return (OperatingSystem.IsWindows() || _posixXmmContextBridged) &&
-            TryRecoverSse4aExtractInsert(contextRecord, rip);
-    }
-
-    private unsafe bool TryRecoverMonitorxMwaitx(void* contextRecord, ulong rip)
-    {
-        // MONITORX (0F 01 FA) and MWAITX (0F 01 FB) are fixed 3-byte encodings with no
-        // ModRM/SIB/displacement/immediate, so a raw byte compare is sufficient and unambiguous.
-        var opcode = new byte[3];
-        if (!TryReadExecutableBytes(rip, opcode) ||
-            opcode[0] != 0x0F || opcode[1] != 0x01 || (opcode[2] != 0xFA && opcode[2] != 0xFB))
-        {
-            return false;
-        }
-
-        // PS5 titles use this pair in idle/wait loops: MONITORX arms a monitor on a cache line
-        // and MWAITX blocks until that line is written (or a timeout elapses). Hosts without
-        // the extension raise #UD on either one. We do not model the monitor itself, only its
-        // observable effect on guest forward progress: MONITORX becomes a no-op (arming a
-        // watch we never honour has no side effect of its own) and MWAITX becomes a plain
-        // thread yield, i.e. treat the awaited condition as already satisfied so the guest
-        // loop keeps making progress instead of executing an illegal opcode forever.
-        if (opcode[2] == 0xFB)
-        {
-            Thread.Yield();
-        }
-
-        WriteCtxU64(contextRecord, CTX_RIP, rip + 3);
-
-        Interlocked.Increment(ref _monitorxInstructionsEmulated);
-        if (Interlocked.Exchange(ref _monitorxSoftwareFallbackAnnounced, 1) == 0)
-        {
-            Console.Error.WriteLine(
-                "[LOADER][INFO] Host lacks AMD MONITORX/MWAITX used by the guest; " +
-                "emulating those instructions in software.");
-        }
-
-        return true;
-    }
-
-    private unsafe bool TryRecoverSse4aExtractInsert(void* contextRecord, ulong rip)
-    {
-        if (!OperatingSystem.IsWindows() && !_posixXmmContextBridged ||
-            !TryReadFaultingInstruction(rip, out var instruction))
-        {
-            return false;
-        }
-
-        var isExtrq = instruction.Mnemonic == Mnemonic.Extrq;
-        var isInsertq = instruction.Mnemonic == Mnemonic.Insertq;
-        if (!isExtrq && !isInsertq)
-        {
-            return false;
-        }
-
-        var isImmediateExtrq = isExtrq && instruction.OpCount == 3;
-        var isRegisterExtrq = isExtrq && instruction.OpCount == 2;
-        var isImmediateInsertq = isInsertq && instruction.OpCount == 4;
-        if (!isImmediateExtrq && !isRegisterExtrq && !isImmediateInsertq)
-        {
-            return false;
-        }
-
-        if (instruction.GetOpKind(0) != OpKind.Register ||
-            !TryGetXmmOffset(instruction.GetOpRegister(0), out var destOffset))
-        {
-            return false;
-        }
-
-        var destLow = ReadCtxU64(contextRecord, destOffset);
-        if (isExtrq)
-        {
-            int length;
-            int index;
-            if (isRegisterExtrq)
-            {
-                if (instruction.GetOpKind(1) != OpKind.Register ||
-                    !TryGetXmmOffset(instruction.GetOpRegister(1), out var controlOffset))
-                {
-                    return false;
-                }
-
-                // AMD defines the register form's field length in xmm2[5:0] and its start
-                // index in xmm2[13:8]. Other control bits do not affect the instruction.
-                var control = ReadCtxU64(contextRecord, controlOffset);
-                length = (int)(control & 0x3F);
-                index = (int)((control >> 8) & 0x3F);
-            }
-            else
-            {
-                length = (int)instruction.GetImmediate(1);
-                index = (int)instruction.GetImmediate(2);
-            }
-
-            WriteCtxU64(contextRecord, destOffset, Sse4aBitFieldEmulator.ExtractBitField(destLow, length, index));
-            WriteCtxU64(contextRecord, destOffset + 8, 0);
-        }
-        else
-        {
-            if (instruction.GetOpKind(1) != OpKind.Register ||
-                !TryGetXmmOffset(instruction.GetOpRegister(1), out var srcOffset))
-            {
-                return false;
-            }
-
-            var length = (int)instruction.GetImmediate(2);
-            var index = (int)instruction.GetImmediate(3);
-            WriteCtxU64(contextRecord, destOffset, Sse4aBitFieldEmulator.InsertBitField(
-                destLow, ReadCtxU64(contextRecord, srcOffset), length, index));
-            WriteCtxU64(contextRecord, destOffset + 8, 0);
-        }
-
-        WriteCtxU64(contextRecord, CTX_RIP, rip + (ulong)instruction.Length);
-
-        Interlocked.Increment(ref _sse4aInstructionsEmulated);
-        if (Interlocked.Exchange(ref _sse4aSoftwareFallbackAnnounced, 1) == 0)
-        {
-            Console.Error.WriteLine(
-                "[LOADER][INFO] Host lacks SSE4a EXTRQ/INSERTQ used by the guest; " +
-                "emulating those instructions in software.");
-        }
-
-        return true;
-    }
-
-    // Maps an Iced XMM register to its byte offset in the Win64 CONTEXT record. Written as an
-    // explicit switch (rather than arithmetic on the Register enum) to match the style already
-    // used by TryGetGprSlot/TryGetGpr64Offset in DirectExecutionBackend.IllegalInstruction.cs.
-    private static bool TryGetXmmOffset(Register register, out int offset)
-    {
-        switch (register)
-        {
-            case Register.XMM0: offset = Win64ContextXmm0Offset + 16 * 0; return true;
-            case Register.XMM1: offset = Win64ContextXmm0Offset + 16 * 1; return true;
-            case Register.XMM2: offset = Win64ContextXmm0Offset + 16 * 2; return true;
-            case Register.XMM3: offset = Win64ContextXmm0Offset + 16 * 3; return true;
-            case Register.XMM4: offset = Win64ContextXmm0Offset + 16 * 4; return true;
-            case Register.XMM5: offset = Win64ContextXmm0Offset + 16 * 5; return true;
-            case Register.XMM6: offset = Win64ContextXmm0Offset + 16 * 6; return true;
-            case Register.XMM7: offset = Win64ContextXmm0Offset + 16 * 7; return true;
-            case Register.XMM8: offset = Win64ContextXmm0Offset + 16 * 8; return true;
-            case Register.XMM9: offset = Win64ContextXmm0Offset + 16 * 9; return true;
-            case Register.XMM10: offset = Win64ContextXmm0Offset + 16 * 10; return true;
-            case Register.XMM11: offset = Win64ContextXmm0Offset + 16 * 11; return true;
-            case Register.XMM12: offset = Win64ContextXmm0Offset + 16 * 12; return true;
-            case Register.XMM13: offset = Win64ContextXmm0Offset + 16 * 13; return true;
-            case Register.XMM14: offset = Win64ContextXmm0Offset + 16 * 14; return true;
-            case Register.XMM15: offset = Win64ContextXmm0Offset + 16 * 15; return true;
-            default:
-                offset = 0;
-                return false;
-        }
-    }
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Diagnostics.cs

@@ -7,9 +7,7 @@ using System.Collections.Generic;
 using System.Linq;
 using System.Runtime.InteropServices;
 using System.Threading;
-using SharpEmu.Core.Cpu.Disasm;
 using SharpEmu.HLE;
-using SharpEmu.Logging;
 
 namespace SharpEmu.Core.Cpu.Native;
 
@@ -17,129 +15,6 @@ public sealed partial class DirectExecutionBackend
 {
 	private static readonly ConcurrentDictionary<ulong, byte> _knownExecutablePages = new();
 
-	private static readonly bool _perfHleHistogram =
-		string.Equals(System.Environment.GetEnvironmentVariable("SHARPEMU_PERF_HLE"), "1", System.StringComparison.Ordinal);
-	private static readonly System.Collections.Concurrent.ConcurrentDictionary<string, long> _perfHleCounts = new();
-	private static long _perfHleTotal;
-	private static long _perfHleDispatchTicks;
-
-	private sealed class PerfHleExportCost
-	{
-		public long Calls;
-		public long Ticks;
-	}
-
-	private static readonly System.Collections.Concurrent.ConcurrentDictionary<string, PerfHleExportCost> _perfHleCosts = new();
-
-	/// <summary>
-	/// Name of the export currently being dispatched on this thread, so the
-	/// gateway can attribute its elapsed time once the call returns. Answering
-	/// "which export is worth optimising" needs cost per export, not just call
-	/// counts — a rare expensive call and a hot cheap one look identical in a
-	/// frequency histogram.
-	/// </summary>
-	[System.ThreadStatic]
-	private static string? _perfHleCurrentExport;
-
-	private static long _perfHleFirstTimestamp;
-
-	private static void RecordPerfHleDispatchTime(long ticks)
-	{
-		var total = System.Threading.Interlocked.Add(ref _perfHleDispatchTicks, ticks);
-		var calls = System.Threading.Interlocked.Read(ref _perfHleTotal);
-
-		var name = _perfHleCurrentExport;
-		if (name is not null)
-		{
-			var cost = _perfHleCosts.GetOrAdd(name, static _ => new PerfHleExportCost());
-			System.Threading.Interlocked.Increment(ref cost.Calls);
-			System.Threading.Interlocked.Add(ref cost.Ticks, ticks);
-		}
-
-		if (calls > 0 && calls % 500000 == 0)
-		{
-			var frequency = (double)System.Diagnostics.Stopwatch.Frequency;
-			var avgUs = (double)total / frequency * 1_000_000.0 / calls;
-			var first = System.Threading.Interlocked.CompareExchange(ref _perfHleFirstTimestamp, 0, 0);
-			var wallSeconds = first == 0
-				? 0
-				: (double)(System.Diagnostics.Stopwatch.GetTimestamp() - first) / frequency;
-			System.Console.Error.WriteLine(
-				$"[PERF][HLE] managed_dispatch_avg={avgUs:F3}us " +
-				$"total_managed_s={(double)total / frequency:F2} " +
-				$"wall_s={wallSeconds:F2} " +
-				$"cores={(wallSeconds > 0 ? total / frequency / wallSeconds : 0):F2}");
-
-			var snapshot = new System.Collections.Generic.List<System.Collections.Generic.KeyValuePair<string, PerfHleExportCost>>(_perfHleCosts.Count + 16);
-			foreach (var kvp in _perfHleCosts)
-			{
-				snapshot.Add(kvp);
-			}
-
-			var top = snapshot
-				.OrderByDescending(kvp => System.Threading.Interlocked.Read(ref kvp.Value.Ticks))
-				.Take(12)
-				.Select(kvp =>
-				{
-					var seconds = System.Threading.Interlocked.Read(ref kvp.Value.Ticks) / frequency;
-					var callCount = System.Threading.Interlocked.Read(ref kvp.Value.Calls);
-					var cores = wallSeconds > 0 ? seconds / wallSeconds : 0;
-					var perCallUs = callCount > 0 ? seconds * 1_000_000.0 / callCount : 0;
-					return $"{kvp.Key}: {cores:F2}cores {seconds:F1}s n={callCount} {perCallUs:F2}us/call";
-				});
-			System.Console.Error.WriteLine($"[PERF][HLE] cost: {string.Join(" | ", top)}");
-
-			if (SharpEmu.HLE.GuestFastPath.Enabled)
-			{
-				var fastPath = SharpEmu.HLE.GuestFastPath.SnapshotCounters();
-				System.Console.Error.WriteLine(
-					$"[PERF][HLE] fast_path: self_hits={fastPath.SelfHits} " +
-					$"getspecific_hits={fastPath.GetspecificHits} blocks={fastPath.Blocks}");
-			}
-		}
-	}
-
-	private static readonly bool _perfHleNoDict =
-		string.Equals(System.Environment.GetEnvironmentVariable("SHARPEMU_PERF_HLE_NODICT"), "1", System.StringComparison.Ordinal);
-
-	private static void RecordPerfHleCall(string name)
-	{
-		_perfHleCurrentExport = name;
-		var total = System.Threading.Interlocked.Increment(ref _perfHleTotal);
-		if (total == 1)
-		{
-			System.Threading.Interlocked.CompareExchange(
-				ref _perfHleFirstTimestamp,
-				System.Diagnostics.Stopwatch.GetTimestamp(),
-				0);
-		}
-
-		if (!_perfHleNoDict)
-		{
-			_perfHleCounts.AddOrUpdate(name, 1, static (_, v) => v + 1);
-		}
-
-		if (total % 500000 == 0 && !_perfHleNoDict)
-		{
-			// Snapshot via foreach (a safe moving enumerator) before sorting.
-			// LINQ over a ConcurrentDictionary uses ICollection.CopyTo, which
-			// throws ArgumentException if another thread adds a key between the
-			// Count read and the copy — that exception was being swallowed into
-			// a CPU_TRAP return and crashing the guest.
-			var snapshot = new System.Collections.Generic.List<System.Collections.Generic.KeyValuePair<string, long>>(_perfHleCounts.Count + 16);
-			foreach (var kvp in _perfHleCounts)
-			{
-				snapshot.Add(kvp);
-			}
-
-			var top = snapshot
-				.OrderByDescending(kvp => kvp.Value)
-				.Take(20)
-				.Select(kvp => $"{kvp.Key}={kvp.Value}");
-			System.Console.Error.WriteLine($"[PERF][HLE] total={total} top: {string.Join(", ", top)}");
-		}
-	}
-
 	private void RecordRecentImportTrace(
 		long dispatchIndex,
 		string nid,
@@ -148,18 +23,15 @@ public sealed partial class DirectExecutionBackend
 		ulong arg1,
 		ulong arg2)
 	{
-		var trace = _recentImportTrace;
-		trace[_recentImportTraceWriteIndex] = new RecentImportTraceEntry(
+		_recentImportTrace[_recentImportTraceWriteIndex] = new RecentImportTraceEntry(
 			dispatchIndex,
 			nid,
 			returnRip,
 			arg0,
 			arg1,
-			arg2,
-			GuestThreadExecution.CurrentGuestThreadHandle,
-			Environment.CurrentManagedThreadId);
-		_recentImportTraceWriteIndex = (_recentImportTraceWriteIndex + 1) % trace.Length;
-		if (_recentImportTraceCount < trace.Length)
+			arg2);
+		_recentImportTraceWriteIndex = (_recentImportTraceWriteIndex + 1) % _recentImportTrace.Length;
+		if (_recentImportTraceCount < _recentImportTrace.Length)
 		{
 			_recentImportTraceCount++;
 		}
@@ -167,21 +39,20 @@ public sealed partial class DirectExecutionBackend
 
 	private void DumpRecentImportTrace()
 	{
-		var trace = _recentImportTrace;
-		if (trace is null || _recentImportTraceCount == 0)
+		if (_recentImportTraceCount == 0)
 		{
 			return;
 		}
-		Log.Info($"   Recent import calls for managed={Environment.CurrentManagedThreadId} guest=0x{GuestThreadExecution.CurrentGuestThreadHandle:X16} ({_recentImportTraceCount}):");
-		int num = (_recentImportTraceWriteIndex - _recentImportTraceCount + trace.Length) % trace.Length;
+		Console.Error.WriteLine($"[LOADER][INFO]   Recent import calls ({_recentImportTraceCount}):");
+		int num = (_recentImportTraceWriteIndex - _recentImportTraceCount + _recentImportTrace.Length) % _recentImportTrace.Length;
 		for (int i = 0; i < _recentImportTraceCount; i++)
 		{
-			int num2 = (num + i) % trace.Length;
-			var entry = trace[num2];
+			int num2 = (num + i) % _recentImportTrace.Length;
+			var entry = _recentImportTrace[num2];
 			if (!string.IsNullOrEmpty(entry.Nid))
 			{
-				Log.Info(
-					$"     #{entry.DispatchIndex} managed={entry.ManagedThreadId} guest=0x{entry.GuestThreadHandle:X16} nid={entry.Nid} ret=0x{entry.ReturnRip:X16} " +
+				Console.Error.WriteLine(
+					$"[LOADER][INFO]     #{entry.DispatchIndex} nid={entry.Nid} ret=0x{entry.ReturnRip:X16} " +
 					$"rdi=0x{entry.Arg0:X16} rsi=0x{entry.Arg1:X16} rdx=0x{entry.Arg2:X16}");
 			}
 		}
@@ -220,12 +91,12 @@ public sealed partial class DirectExecutionBackend
 						list.Add(num7);
 						if (num2 < 32)
 						{
-							Log.Info($"Suspicious unresolved pointer: slot=0x{num7:X16} value=0x{value2:X16}");
+							Console.Error.WriteLine($"[LOADER][INFO] Suspicious unresolved pointer: slot=0x{num7:X16} value=0x{value2:X16}");
 							num2++;
 						}
 						if (num >= 16384)
 						{
-							Log.Warning($"Suspicious unresolved pointer scan reached cap ({16384}); truncating.");
+							Console.Error.WriteLine($"[LOADER][WARNING] Suspicious unresolved pointer scan reached cap ({16384}); truncating.");
 							return list;
 						}
 					}
@@ -235,7 +106,7 @@ public sealed partial class DirectExecutionBackend
 		}
 		if (num != 0)
 		{
-			Log.Warning($"Suspicious unresolved pointer hits: {num}");
+			Console.Error.WriteLine($"[LOADER][WARNING] Suspicious unresolved pointer hits: {num}");
 		}
 		return list;
 	}
@@ -247,65 +118,21 @@ public sealed partial class DirectExecutionBackend
 		{
 			return;
 		}
-		const int preludeSize = 192;
-		Span<byte> prelude = stackalloc byte[preludeSize];
-		if (returnRip >= preludeSize && cpuContext.Memory.TryRead(returnRip - preludeSize, prelude))
-		{
-			Console.Error.WriteLine(
-				$"[LOADER][TRACE] Import#{dispatchIndex} pre-return bytes @0x{returnRip - preludeSize:X16}: " +
-				BitConverter.ToString(prelude.ToArray()).Replace("-", " "));
-
-			List<DecodedInst>? bestCallChain = null;
-			var preludeAddress = returnRip - preludeSize;
-			for (var startOffset = 0; startOffset < preludeSize; startOffset++)
-			{
-				var cursor = preludeAddress + (ulong)startOffset;
-				var candidate = new List<DecodedInst>();
-				while (cursor < returnRip && candidate.Count < 96 &&
-					IcedDecoder.TryReadGuestBytes(cpuContext.Memory, cursor, 15, out var instructionBytes) &&
-					IcedDecoder.TryDecode(cursor, instructionBytes, out var instruction) &&
-					instruction.Length > 0 &&
-					cursor + (ulong)instruction.Length <= returnRip)
-				{
-					candidate.Add(instruction);
-					cursor += (ulong)instruction.Length;
-				}
-
-				if (cursor == returnRip &&
-					candidate.Count > 0 &&
-					string.Equals(candidate[^1].Mnemonic, "Call", StringComparison.OrdinalIgnoreCase) &&
-					(bestCallChain is null || candidate.Count > bestCallChain.Count))
-				{
-					bestCallChain = candidate;
-				}
-			}
-
-			if (bestCallChain is not null)
-			{
-				Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} pre-return disassembly:");
-				foreach (var instruction in bestCallChain.TakeLast(32))
-				{
-					Console.Error.WriteLine(
-						$"[LOADER][TRACE]   0x{instruction.Rip:X16}: {instruction.Text} " +
-						$"bytes={IcedDecoder.FormatBytes(instruction.Bytes)}");
-				}
-			}
-		}
 		Span<byte> destination = stackalloc byte[128];
 		if (!cpuContext.Memory.TryRead(returnRip, destination))
 		{
-			Log.Debug($"Import#{dispatchIndex} return-rip probe: unreadable @0x{returnRip:X16}");
+			Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} return-rip probe: unreadable @0x{returnRip:X16}");
 			return;
 		}
 		string value = BitConverter.ToString(destination.ToArray()).Replace("-", " ");
-		Log.Debug($"Import#{dispatchIndex} return-rip bytes @0x{returnRip:X16}: {value}");
+		Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} return-rip bytes @0x{returnRip:X16}: {value}");
 		if (destination[0] == byte.MaxValue && (destination[1] == 21 || destination[1] == 37))
 		{
 			int num = BitConverter.ToInt32(destination.Slice(2, 4));
 			ulong num2 = returnRip + 6 + (ulong)num;
 			if (cpuContext.TryReadUInt64(num2, out var value2))
 			{
-				Log.Debug($"Import#{dispatchIndex} return-rip slot: [0x{num2:X16}] = 0x{value2:X16}");
+				Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} return-rip slot: [0x{num2:X16}] = 0x{value2:X16}");
 			}
 		}
 		if (destination[0] == 72 && destination[1] == 139 && destination[2] == 5)
@@ -314,7 +141,7 @@ public sealed partial class DirectExecutionBackend
 			ulong num4 = returnRip + 7 + (ulong)num3;
 			if (cpuContext.TryReadUInt64(num4, out var value3))
 			{
-				Log.Debug($"Import#{dispatchIndex} return-rip mov-slot: [0x{num4:X16}] = 0x{value3:X16}");
+				Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} return-rip mov-slot: [0x{num4:X16}] = 0x{value3:X16}");
 			}
 		}
 		for (int i = 0; i + 6 <= destination.Length; i++)
@@ -326,7 +153,7 @@ public sealed partial class DirectExecutionBackend
 				ulong num7 = num6 + 6 + (ulong)num5;
 				if (cpuContext.TryReadUInt64(num7, out var value4))
 				{
-					Log.Debug($"Import#{dispatchIndex} near-indirect @{num6:X16}: slot=0x{num7:X16} val=0x{value4:X16}");
+					Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} near-indirect @{num6:X16}: slot=0x{num7:X16} val=0x{value4:X16}");
 				}
 			}
 		}
@@ -341,7 +168,7 @@ public sealed partial class DirectExecutionBackend
 			int rel32 = BitConverter.ToInt32(destination.Slice(i + 1, 4));
 			ulong callRip = returnRip + (ulong)i;
 			ulong target = unchecked((ulong)((long)(callRip + 5) + rel32));
-			Log.Debug($"Import#{dispatchIndex} near-call @{callRip:X16}: target=0x{target:X16}");
+			Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} near-call @{callRip:X16}: target=0x{target:X16}");
 			for (int importIndex = 0; importIndex < _importEntries.Length; importIndex++)
 			{
 				if (_importEntries[importIndex].Address != target)
@@ -352,21 +179,21 @@ public sealed partial class DirectExecutionBackend
 				string nid = _importEntries[importIndex].Nid;
 				if (_moduleManager.TryGetExport(nid, out var export))
 				{
-					Log.Debug(
-						$"Import#{dispatchIndex} near-call import: index={importIndex} {export.LibraryName}:{export.Name} ({nid})");
+					Console.Error.WriteLine(
+						$"[LOADER][TRACE] Import#{dispatchIndex} near-call import: index={importIndex} {export.LibraryName}:{export.Name} ({nid})");
 				}
 				else
 				{
-					Log.Debug(
-						$"Import#{dispatchIndex} near-call import: index={importIndex} nid={nid}");
+					Console.Error.WriteLine(
+						$"[LOADER][TRACE] Import#{dispatchIndex} near-call import: index={importIndex} nid={nid}");
 				}
 				break;
 			}
 
 			if (cpuContext.Memory.TryRead(target, targetBytes))
 			{
-				Log.Debug(
-					$"Import#{dispatchIndex} near-call target bytes @0x{target:X16}: " +
+				Console.Error.WriteLine(
+					$"[LOADER][TRACE] Import#{dispatchIndex} near-call target bytes @0x{target:X16}: " +
 					BitConverter.ToString(targetBytes.ToArray()).Replace("-", " "));
 				if (targetBytes[0] == 0xFF && targetBytes[1] == 0x25)
 				{
@@ -374,8 +201,8 @@ public sealed partial class DirectExecutionBackend
 					ulong slot = unchecked((ulong)((long)(target + 6) + slotRel32));
 					if (cpuContext.TryReadUInt64(slot, out var slotTarget))
 					{
-						Log.Debug(
-							$"Import#{dispatchIndex} near-call PLT slot: [0x{slot:X16}] = 0x{slotTarget:X16}");
+						Console.Error.WriteLine(
+							$"[LOADER][TRACE] Import#{dispatchIndex} near-call PLT slot: [0x{slot:X16}] = 0x{slotTarget:X16}");
 						for (int importIndex = 0; importIndex < _importEntries.Length; importIndex++)
 						{
 							if (_importEntries[importIndex].Address != slotTarget)
@@ -386,13 +213,13 @@ public sealed partial class DirectExecutionBackend
 							string nid = _importEntries[importIndex].Nid;
 							if (_moduleManager.TryGetExport(nid, out var export))
 							{
-								Log.Debug(
-									$"Import#{dispatchIndex} near-call PLT import: index={importIndex} {export.LibraryName}:{export.Name} ({nid})");
+								Console.Error.WriteLine(
+									$"[LOADER][TRACE] Import#{dispatchIndex} near-call PLT import: index={importIndex} {export.LibraryName}:{export.Name} ({nid})");
 							}
 							else
 							{
-								Log.Debug(
-									$"Import#{dispatchIndex} near-call PLT import: index={importIndex} nid={nid}");
+								Console.Error.WriteLine(
+									$"[LOADER][TRACE] Import#{dispatchIndex} near-call PLT import: index={importIndex} nid={nid}");
 							}
 							break;
 						}
@@ -407,28 +234,6 @@ public sealed partial class DirectExecutionBackend
 		return value == 65534 || value == 4294967294u || value == 18446744073709551614uL;
 	}
 
-	private static ulong ParseOptionalHexAddress(string? value)
-	{
-		if (string.IsNullOrWhiteSpace(value))
-		{
-			return 0;
-		}
-
-		var text = value.Trim();
-		if (text.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
-		{
-			text = text[2..];
-		}
-
-		return ulong.TryParse(
-			text,
-			System.Globalization.NumberStyles.HexNumber,
-			System.Globalization.CultureInfo.InvariantCulture,
-			out var address)
-			? address
-			: 0;
-	}
-
 	private static bool IsPlausibleReturnAddress(ulong address)
 	{
 		return address >= 12884901888L && address < 17592186044416L && !IsUnresolvedSentinel(address);
@@ -471,29 +276,6 @@ public sealed partial class DirectExecutionBackend
 		return false;
 	}
 
-	// The committed readable run of host pages that contains address.
-	private unsafe static bool TryQueryReadableRange(ulong address, out ulong start, out ulong end)
-	{
-		start = 0;
-		end = 0;
-		if (address <= 65536 || address >= 140737488355328L ||
-			VirtualQuery((void*)address, out var info, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0)
-		{
-			return false;
-		}
-
-		var regionEnd = info.BaseAddress + info.RegionSize;
-		if (regionEnd < info.BaseAddress || address > regionEnd - 8 ||
-			info.State != 4096 || !IsReadableProtection(info.Protect))
-		{
-			return false;
-		}
-
-		start = info.BaseAddress;
-		end = regionEnd;
-		return true;
-	}
-
 	private unsafe static bool TryReadStackU64(ulong address, out ulong value)
 	{
 		value = 0uL;

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.FastPath.cs

@@ -1,286 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System;
-using System.Collections.Generic;
-using System.Runtime.InteropServices;
-using SharpEmu.HLE;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-/// <summary>
-/// Native fast-path stubs for the trivial per-thread imports that dominate the
-/// HLE call count. Each stub answers from <see cref="GuestFastPath"/>'s
-/// per-host-thread block and jumps to the normal import trampoline whenever it
-/// cannot, so the managed implementation stays the single source of truth for
-/// every case the stub does not handle.
-/// </summary>
-public sealed unsafe partial class DirectExecutionBackend
-{
-	internal enum GuestFastPathStub
-	{
-		None,
-		PthreadSelf,
-		PthreadGetspecific,
-		MemoryCopy,
-	}
-
-	// scePthreadSelf / pthread_self.
-	private const string PthreadSelfNid = "aI+OeCz8xrQ";
-	private const string PosixPthreadSelfNid = "EotR8a3ASf4";
-
-	// scePthreadGetspecific / pthread_getspecific.
-	private const string PthreadGetspecificNid = "eoht7mQOCmo";
-	private const string PosixPthreadGetspecificNid = "0-KXaS70xy4";
-
-	// memcpy / memmove.
-	private const string MemcpyNid = "Q3VBxCXhUHs";
-	private const string MemmoveNid = "+P6FRGH4LfA";
-
-	// Guest memory is identity-mapped and every fault the copy can take (write tracking, lazy
-	// commit) is resolved from the fault address alone, so the copy may run as guest-side code.
-	// SHARPEMU_HLE_FAST_MEMCPY=0 keeps it on the managed export.
-	private static readonly bool GuestMemoryCopyStubEnabled =
-		!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_HLE_FAST_MEMCPY"), "0", StringComparison.Ordinal);
-
-	private uint _fastPathBlockTlsIndex = uint.MaxValue;
-	private bool _guestFastPathEnabled;
-	private int _guestFastPathStubCount;
-
-	/// <summary>
-	/// Decides whether native fast-path stubs may be installed for this run and
-	/// arms <see cref="GuestFastPath"/> if so. Any diagnostic mode that must
-	/// observe every import call keeps the fast path off, because a stub answers
-	/// without ever reaching the managed gateway that does the tracing.
-	/// </summary>
-	private void ConfigureGuestFastPath()
-	{
-		_guestFastPathEnabled = false;
-		_guestFastPathStubCount = 0;
-
-		// Emission uses the macOS pthread gs-indexed key array. Windows and
-		// Linux keep the managed gateway until their TLS read is emitted too.
-		if (!OperatingSystem.IsMacOS() ||
-			RuntimeInformation.ProcessArchitecture != Architecture.X64)
-		{
-			return;
-		}
-
-		if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_HLE_FAST_PATH"), "0", StringComparison.Ordinal))
-		{
-			Console.Error.WriteLine("[LOADER][INFO] HLE native fast path disabled by SHARPEMU_HLE_FAST_PATH=0.");
-			return;
-		}
-
-		if (_logAllImports ||
-			!string.IsNullOrEmpty(_importFilter) ||
-			string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_PTHREADS"), "1", StringComparison.Ordinal))
-		{
-			Console.Error.WriteLine(
-				"[LOADER][INFO] HLE native fast path disabled: import/pthread tracing needs every call in the gateway.");
-			return;
-		}
-
-		if (_fastPathBlockTlsIndex == uint.MaxValue)
-		{
-			_fastPathBlockTlsIndex = TlsAlloc();
-			if (_fastPathBlockTlsIndex == uint.MaxValue)
-			{
-				return;
-			}
-		}
-
-		var tlsIndex = _fastPathBlockTlsIndex;
-		GuestFastPath.Enable(block => TlsSetValue(tlsIndex, block));
-		_guestFastPathEnabled = true;
-	}
-
-	private static GuestFastPathStub ClassifyGuestFastPathStub(string nid) => nid switch
-	{
-		PthreadSelfNid or PosixPthreadSelfNid => GuestFastPathStub.PthreadSelf,
-		PthreadGetspecificNid or PosixPthreadGetspecificNid => GuestFastPathStub.PthreadGetspecific,
-		MemcpyNid or MemmoveNid => GuestFastPathStub.MemoryCopy,
-		_ => GuestFastPathStub.None,
-	};
-
-	/// <summary>
-	/// Builds the native stub for <paramref name="nid"/>, falling back to
-	/// <paramref name="fallbackTrampoline"/> (the import's managed gateway
-	/// trampoline) for every case the stub declines.
-	/// </summary>
-	private unsafe bool TryCreateGuestFastPathStub(string nid, nint fallbackTrampoline, out nint address)
-	{
-		address = 0;
-		if (!_guestFastPathEnabled || fallbackTrampoline == 0)
-		{
-			return false;
-		}
-
-		var kind = ClassifyGuestFastPathStub(nid);
-		if (kind == GuestFastPathStub.None ||
-			// The write watch inspects every managed guest write, which a native copy never reaches.
-			(kind == GuestFastPathStub.MemoryCopy && (!GuestMemoryCopyStubEnabled || GuestWriteWatch.Armed)))
-		{
-			return false;
-		}
-
-		var code = EmitGuestFastPathStub(kind, _fastPathBlockTlsIndex, fallbackTrampoline);
-		const uint stubAllocationSize = 128u;
-		if (code.Count > stubAllocationSize)
-		{
-			return false;
-		}
-
-		void* memory = VirtualAlloc(null, stubAllocationSize, 12288u, 64u);
-		if (memory == null)
-		{
-			return false;
-		}
-
-		for (var i = 0; i < code.Count; i++)
-		{
-			((byte*)memory)[i] = code[i];
-		}
-
-		uint oldProtect = 0;
-		if (!VirtualProtect(memory, stubAllocationSize, 32u, &oldProtect))
-		{
-			VirtualFree(memory, 0u, 32768u);
-			return false;
-		}
-
-		FlushInstructionCache(GetCurrentProcess(), memory, (nuint)code.Count);
-		address = (nint)memory;
-		_importHandlerTrampolines.Add(address);
-		_guestFastPathStubCount++;
-		return true;
-	}
-
-	/// <summary>
-	/// Emits one fast-path stub. The stubs obey the SysV ABI the guest calls
-	/// them with: the answer goes in RAX, only RAX and the arithmetic flags are
-	/// clobbered (both caller-saved across a call), and on the slow path every
-	/// register - including the incoming RAX that carries the variadic vector
-	/// count - is restored before jumping to the trampoline.
-	/// </summary>
-	internal static List<byte> EmitGuestFastPathStub(
-		GuestFastPathStub kind,
-		uint blockTlsIndex,
-		nint fallbackTrampoline)
-	{
-		if (kind == GuestFastPathStub.MemoryCopy)
-		{
-			return EmitGuestMemoryCopyStub(fallbackTrampoline);
-		}
-
-		var code = new List<byte>(48);
-		var slowPathFixups = new List<int>();
-
-		void Emit(params byte[] bytes) => code.AddRange(bytes);
-
-		// Emits a short conditional branch to the slow path; 0x74 is JE, 0x73 is JAE.
-		void EmitBranchToSlowPath(byte opcode)
-		{
-			Emit(opcode, 0x00); // rel8, patched once the slow-path offset is known
-			slowPathFixups.Add(code.Count - 1);
-		}
-
-		void EmitJumpToSlowPath() => EmitBranchToSlowPath(0x74);
-
-		// push rax: the guest's incoming RAX/AL must survive a slow-path bail.
-		Emit(0x50);
-
-		// mov rax, gs:[blockTlsIndex * 8] - the macOS pthread key array is the
-		// gs-based thread specific data array, so a key read is a single load.
-		Emit(0x65, 0x48, 0x8B, 0x04, 0x25);
-		code.AddRange(BitConverter.GetBytes(checked(blockTlsIndex * 8u)));
-
-		// test rax, rax / je slow: no block published on this host thread.
-		Emit(0x48, 0x85, 0xC0);
-		EmitJumpToSlowPath();
-
-		switch (kind)
-		{
-			case GuestFastPathStub.PthreadSelf:
-				// cmp qword [rax + SelfHandleOffset], 0 / je slow: no guest
-				// thread bound here, and a host thread's pthread_self has to
-				// reach the managed export for its scheduler registration.
-				Emit(0x48, 0x83, 0x78, checked((byte)GuestFastPath.BlockSelfHandleOffset), 0x00);
-				EmitJumpToSlowPath();
-				// inc qword [rax + SelfHitsOffset]
-				Emit(0x48, 0xFF, 0x40, checked((byte)GuestFastPath.BlockSelfHitsOffset));
-				// mov rax, [rax + SelfHandleOffset]
-				Emit(0x48, 0x8B, 0x40, checked((byte)GuestFastPath.BlockSelfHandleOffset));
-				break;
-
-			case GuestFastPathStub.PthreadGetspecific:
-				// cmp qword [rax + TlsValuesOffset], 0 / je slow: this thread
-				// has no value table published.
-				Emit(0x48, 0x83, 0x78, checked((byte)GuestFastPath.BlockTlsValuesOffset), 0x00);
-				EmitJumpToSlowPath();
-				// cmp rdi, TlsSlotCount / jae slow. An out-of-range or
-				// sign-extended negative key is answered by the managed path,
-				// which truncates it to int and consults the key registry.
-				Emit(0x48, 0x81, 0xFF);
-				code.AddRange(BitConverter.GetBytes(GuestFastPath.TlsSlotCount));
-				EmitBranchToSlowPath(0x73);
-				// inc qword [rax + GetspecificHitsOffset]
-				Emit(0x48, 0xFF, 0x40, checked((byte)GuestFastPath.BlockGetspecificHitsOffset));
-				// mov rax, [rax + TlsValuesOffset] / mov rax, [rax + rdi*8]
-				Emit(0x48, 0x8B, 0x40, checked((byte)GuestFastPath.BlockTlsValuesOffset));
-				Emit(0x48, 0x8B, 0x04, 0xF8);
-				break;
-
-			default:
-				throw new ArgumentOutOfRangeException(nameof(kind), kind, "Unknown fast-path stub kind.");
-		}
-
-		// add rsp, 8 (drop the saved RAX - the result replaces it) / ret
-		Emit(0x48, 0x83, 0xC4, 0x08);
-		Emit(0xC3);
-
-		var slowPathOffset = code.Count;
-
-		// pop rax / jmp qword [rip+0] - the absolute target follows the
-		// instruction, so nothing else is clobbered on the way out.
-		Emit(0x58);
-		Emit(0xFF, 0x25, 0x00, 0x00, 0x00, 0x00);
-		code.AddRange(BitConverter.GetBytes((long)fallbackTrampoline));
-
-		foreach (var fixup in slowPathFixups)
-		{
-			var delta = slowPathOffset - (fixup + 1);
-			if (delta is < 0 or > 127)
-			{
-				throw new InvalidOperationException("Fast-path stub slow-path branch is out of rel8 range.");
-			}
-
-			code[fixup] = (byte)delta;
-		}
-
-		return code;
-	}
-
-	/// <summary>
-	/// memcpy/memmove(dst, src, n) as a forward <c>rep movsb</c>, returning dst. The libc
-	/// export copies with memmove semantics, so a destination that starts inside the source
-	/// (where a forward copy would read bytes it already overwrote) takes the managed path.
-	/// Only RAX, RCX, RSI, RDI and the flags change - all caller-saved - and the direction
-	/// flag is clear on entry per the SysV ABI.
-	/// </summary>
-	internal static List<byte> EmitGuestMemoryCopyStub(nint fallbackTrampoline)
-	{
-		var code = new List<byte>(40);
-		// mov rcx, rdi / sub rcx, rsi / cmp rcx, rdx / jb slow: dst - src < n (unsigned) is
-		// exactly a destination in (src, src + n) or equal to src with a non-empty copy.
-		code.AddRange([0x48, 0x89, 0xF9, 0x48, 0x29, 0xF1, 0x48, 0x39, 0xD1, 0x72, 0x00]);
-		var slowPathFixup = code.Count - 1;
-		// mov rax, rdi / mov rcx, rdx / rep movsb / ret
-		code.AddRange([0x48, 0x89, 0xF8, 0x48, 0x89, 0xD1, 0xF3, 0xA4, 0xC3]);
-		code[slowPathFixup] = checked((byte)(code.Count - (slowPathFixup + 1)));
-		// jmp qword [rip+0] with the absolute trampoline address after it.
-		code.AddRange([0xFF, 0x25, 0x00, 0x00, 0x00, 0x00]);
-		code.AddRange(BitConverter.GetBytes((long)fallbackTrampoline));
-		return code;
-	}
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.GuestSampler.cs

@@ -1,387 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System;
-using System.Collections.Concurrent;
-using System.Collections.Generic;
-using System.Diagnostics;
-using System.Linq;
-using System.Threading;
-using SharpEmu.HLE;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-/// <summary>
-/// Sampling profiler for guest code. Managed profilers only see the emulator's
-/// own frames — once a guest thread is running translated code it is opaque to
-/// them, so a title that burns its cores inside its own spin loops looks like
-/// unattributed native time. This walks the guest thread registry and samples
-/// each thread's host RIP, which lands directly on the guest instruction being
-/// executed.
-/// </summary>
-public sealed partial class DirectExecutionBackend
-{
-	private static readonly bool _profileGuestRip =
-		string.Equals(
-			Environment.GetEnvironmentVariable("SHARPEMU_PROFILE_GUEST_RIP"),
-			"1",
-			StringComparison.Ordinal);
-
-	private static readonly int _profileGuestRipIntervalMs =
-		int.TryParse(
-			Environment.GetEnvironmentVariable("SHARPEMU_PROFILE_GUEST_RIP_INTERVAL_MS"),
-			out var interval) && interval > 0
-			? interval
-			: 2;
-
-	private static readonly int _profileGuestRipReportSeconds =
-		int.TryParse(
-			Environment.GetEnvironmentVariable("SHARPEMU_PROFILE_GUEST_RIP_REPORT_S"),
-			out var report) && report > 0
-			? report
-			: 15;
-
-	private static readonly string? _profileGuestRipThreadFilter =
-		Environment.GetEnvironmentVariable("SHARPEMU_PROFILE_GUEST_RIP_THREAD");
-
-	private const ulong GuestImageBase = 0x0000_0008_0000_0000UL;
-	private const ulong GuestImageLimit = 0x0000_0009_0000_0000UL;
-
-	private int _guestRipSamplerStarted;
-	private readonly ConcurrentDictionary<ulong, long> _guestRipSamples = new();
-	private readonly ConcurrentDictionary<string, long> _guestRipThreadSamples = new();
-	private readonly ConcurrentDictionary<string, long> _guestWaitSamples = new();
-	private readonly ConcurrentDictionary<string, long> _guestThreadWaitSamples = new();
-	private readonly ConcurrentDictionary<string, long> _guestThreadWaitReasonSamples = new();
-	private long _guestRipTotalSamples;
-	private long _guestWaitTotalSamples;
-	private long _guestRipCaptureFailures;
-	private long _guestRipSamplerErrors;
-
-	private readonly record struct GuestRipSampleTarget(
-		string Name,
-		CpuContext Context,
-		int HostThreadId,
-		string? BlockReason);
-
-	/// <summary>
-	/// Names the HLE call a thread is parked in, using the guest RIP the import
-	/// dispatcher left on its context.
-	/// </summary>
-	private string ResolveWaitLabel(CpuContext context, string? blockReason)
-	{
-		var importIndex = context.ActiveImportIndex;
-		if ((uint)importIndex >= (uint)_importEntries.Length)
-		{
-			// Host code with no import in flight: the thread is parked by the
-			// emulator's own scheduler. The cooperative block records why, which
-			// is the part that actually identifies what the frame is waiting on.
-			return string.IsNullOrEmpty(blockReason)
-				? "<idle-or-scheduler>"
-				: $"blocked:{blockReason}";
-		}
-
-		var entry = _importEntries[importIndex];
-		return entry.Export?.Name ?? entry.Nid;
-	}
-
-	internal void ClearActiveImportIndex()
-	{
-		if (!_profileGuestRip)
-		{
-			return;
-		}
-
-		var context = ActiveCpuContext;
-		if (context is not null)
-		{
-			context.ActiveImportIndex = -1;
-		}
-	}
-
-	private void EnsureGuestRipSampler()
-	{
-		if (!_profileGuestRip ||
-			!OperatingSystem.IsWindows() ||
-			Interlocked.Exchange(ref _guestRipSamplerStarted, 1) != 0)
-		{
-			return;
-		}
-
-		var sampler = new Thread(GuestRipSampleLoop)
-		{
-			IsBackground = true,
-			Name = "SharpEmu guest RIP sampler",
-			// Sampling suspends guest threads briefly. Keep this diagnostic below
-			// the title workers so it observes them without becoming the bottleneck.
-			Priority = ThreadPriority.BelowNormal,
-		};
-		sampler.Start();
-		Console.Error.WriteLine(
-			$"[PERF][GUEST] RIP sampler started: interval={_profileGuestRipIntervalMs}ms " +
-			$"report={_profileGuestRipReportSeconds}s " +
-			$"thread={_profileGuestRipThreadFilter ?? "<all>"}");
-	}
-
-	private void GuestRipSampleLoop()
-	{
-		var clock = Stopwatch.StartNew();
-		var lastReportMs = 0L;
-		var lastReportSamples = 0L;
-
-		while (true)
-		{
-			try
-			{
-				var guestThreads = SnapshotGuestRipTargets();
-				if (!string.IsNullOrWhiteSpace(_profileGuestRipThreadFilter))
-				{
-					guestThreads = guestThreads
-						.Where(thread => thread.Name.Contains(
-							_profileGuestRipThreadFilter,
-							StringComparison.OrdinalIgnoreCase))
-						.ToArray();
-				}
-				var sampledHostThreads = new HashSet<int>();
-				foreach (var thread in guestThreads)
-				{
-					var hostThreadId = thread.HostThreadId;
-					if (hostThreadId == 0 || !sampledHostThreads.Add(hostThreadId))
-					{
-						continue;
-					}
-
-					if (!TryCaptureHostThreadContext(hostThreadId, out var snapshot) ||
-						!snapshot.IsValid)
-					{
-						Interlocked.Increment(ref _guestRipCaptureFailures);
-						continue;
-					}
-
-					_guestRipSamples.AddOrUpdate(snapshot.Rip, 1, static (_, value) => value + 1);
-					_guestRipThreadSamples.AddOrUpdate(
-						string.IsNullOrEmpty(thread.Name) ? "<unnamed>" : thread.Name,
-						1,
-						static (_, value) => value + 1);
-					Interlocked.Increment(ref _guestRipTotalSamples);
-
-					// A host RIP means the thread is inside the emulator rather
-					// than running translated code. DispatchImport parks the
-					// guest RIP on the import stub for the call being serviced,
-					// so the stub address names what the thread is waiting on —
-					// no hot-path bookkeeping needed to find out.
-					if (snapshot.Rip >= GuestImageBase && snapshot.Rip < GuestImageLimit)
-					{
-						continue;
-					}
-
-					var threadName = string.IsNullOrEmpty(thread.Name) ? "<unnamed>" : thread.Name;
-					var waitLabel = ResolveWaitLabel(thread.Context, thread.BlockReason);
-					_guestWaitSamples.AddOrUpdate(
-						waitLabel,
-						1,
-						static (_, value) => value + 1);
-					_guestThreadWaitSamples.AddOrUpdate(
-						threadName,
-						1,
-						static (_, value) => value + 1);
-					_guestThreadWaitReasonSamples.AddOrUpdate(
-						$"{threadName}\u001F{waitLabel}",
-						1,
-						static (_, value) => value + 1);
-					Interlocked.Increment(ref _guestWaitTotalSamples);
-				}
-
-				Thread.Sleep(_profileGuestRipIntervalMs);
-
-				var elapsedMs = clock.ElapsedMilliseconds;
-				if (elapsedMs - lastReportMs < _profileGuestRipReportSeconds * 1000L)
-				{
-					continue;
-				}
-
-				var samples = Interlocked.Read(ref _guestRipTotalSamples);
-				ReportGuestRipSamples(samples - lastReportSamples, (elapsedMs - lastReportMs) / 1000.0);
-				lastReportMs = elapsedMs;
-				lastReportSamples = samples;
-			}
-			catch (Exception exception)
-			{
-				// A title can tear down a thread or its context during a capture.
-				// The profiler must never silently die or affect guest execution.
-				if (Interlocked.Increment(ref _guestRipSamplerErrors) == 1)
-				{
-					Console.Error.WriteLine($"[PERF][GUEST] sampler recovery: {exception.GetType().Name}: {exception.Message}");
-				}
-			}
-		}
-	}
-
-	private GuestRipSampleTarget[] SnapshotGuestRipTargets()
-	{
-		using (LockGate("SnapshotGuestRipTargets"))
-		{
-			var targets = new GuestRipSampleTarget[_guestThreads.Count + _externalGuestThreads.Count];
-			var index = 0;
-			foreach (var thread in _guestThreads.Values)
-			{
-				targets[index++] = new GuestRipSampleTarget(
-					thread.Name,
-					thread.Context,
-					Volatile.Read(ref thread.HostThreadId),
-					thread.BlockReason);
-			}
-
-			foreach (var pair in _externalGuestThreads)
-			{
-				var thread = pair.Value;
-				targets[index++] = new GuestRipSampleTarget(
-					thread.Name,
-					thread.Context,
-					Volatile.Read(ref thread.HostThreadId),
-					null);
-			}
-
-			return targets;
-		}
-	}
-
-	private void ReportGuestRipSamples(long windowSamples, double windowSeconds)
-	{
-		if (windowSamples == 0)
-		{
-			return;
-		}
-
-		var byRip = new List<KeyValuePair<ulong, long>>(_guestRipSamples.Count + 16);
-		foreach (var pair in _guestRipSamples)
-		{
-			byRip.Add(pair);
-		}
-
-		// A tight spin lands on a handful of instructions; grouping by 4 KB page
-		// as well shows which routine those instructions belong to.
-		var byPage = new Dictionary<ulong, long>();
-		foreach (var pair in byRip)
-		{
-			var page = pair.Key & ~0xFFFUL;
-			byPage[page] = byPage.TryGetValue(page, out var existing)
-				? existing + pair.Value
-				: pair.Value;
-		}
-
-		var byThread = new List<KeyValuePair<string, long>>(_guestRipThreadSamples.Count + 16);
-		foreach (var pair in _guestRipThreadSamples)
-		{
-			byThread.Add(pair);
-		}
-
-		Console.Error.WriteLine(
-			$"[PERF][GUEST] window={windowSamples} in {windowSeconds:F1}s " +
-			$"capture_failures={Interlocked.Read(ref _guestRipCaptureFailures)}");
-
-		Console.Error.WriteLine(
-			"[PERF][GUEST] top_rip: " +
-			string.Join(
-				" | ",
-				byRip.OrderByDescending(pair => pair.Value)
-					.Take(12)
-					.Select(pair =>
-						$"0x{pair.Key:X}{DescribeGuestAddress(pair.Key)}={pair.Value * 100.0 / windowSamples:F1}%")));
-
-		Console.Error.WriteLine(
-			"[PERF][GUEST] top_page: " +
-			string.Join(
-				" | ",
-				byPage.OrderByDescending(pair => pair.Value)
-					.Take(8)
-					.Select(pair =>
-						$"0x{pair.Key:X}{DescribeGuestAddress(pair.Key)}={pair.Value * 100.0 / windowSamples:F1}%")));
-
-		var byWait = new List<KeyValuePair<string, long>>(_guestWaitSamples.Count + 16);
-		foreach (var pair in _guestWaitSamples)
-		{
-			byWait.Add(pair);
-		}
-
-		var waitTotal = Interlocked.Read(ref _guestWaitTotalSamples);
-		Console.Error.WriteLine(
-			$"[PERF][GUEST] waiting={waitTotal * 100.0 / windowSamples:F1}% of guest thread-time; top_wait: " +
-			string.Join(
-				" | ",
-				byWait.OrderByDescending(pair => pair.Value)
-					.Take(12)
-					.Select(pair => $"{pair.Key}={pair.Value * 100.0 / windowSamples:F1}%")));
-
-		Console.Error.WriteLine(
-			"[PERF][GUEST] thread_wait: " +
-			string.Join(
-				" | ",
-				_guestThreadWaitReasonSamples.OrderByDescending(pair => pair.Value)
-					.Take(16)
-					.Select(pair =>
-					{
-						var separator = pair.Key.IndexOf('\u001F');
-						var threadName = separator >= 0 ? pair.Key[..separator] : pair.Key;
-						var waitLabel = separator >= 0 ? pair.Key[(separator + 1)..] : "<unknown>";
-						return $"{threadName}->{waitLabel}={pair.Value * 100.0 / windowSamples:F1}%";
-					})));
-
-		// Per-thread spin/park split. The global wait share mixes the job pool in
-		// with a dozen dormant threads, which hides the number that matters:
-		// how much of a core each worker actually burns.
-		Console.Error.WriteLine(
-			"[PERF][GUEST] thread_split (running/parked): " +
-			string.Join(
-				" | ",
-				byThread.OrderByDescending(pair => pair.Value)
-					.Take(10)
-					.Select(pair =>
-					{
-						var parked = _guestThreadWaitSamples.TryGetValue(pair.Key, out var wait) ? wait : 0;
-						var running = pair.Value - parked;
-						return $"{pair.Key}={running * 100.0 / pair.Value:F0}%/{parked * 100.0 / pair.Value:F0}%";
-					})));
-
-		Console.Error.WriteLine(
-			"[PERF][GUEST] top_thread: " +
-			string.Join(
-				" | ",
-				byThread.OrderByDescending(pair => pair.Value)
-					.Take(10)
-					.Select(pair => $"{pair.Key}={pair.Value * 100.0 / windowSamples:F1}%")));
-
-		_guestRipSamples.Clear();
-		_guestRipThreadSamples.Clear();
-		_guestWaitSamples.Clear();
-		_guestThreadWaitSamples.Clear();
-		_guestThreadWaitReasonSamples.Clear();
-		Interlocked.Exchange(ref _guestWaitTotalSamples, 0);
-	}
-
-	/// <summary>
-	/// Tags a sampled address with the region it belongs to. Guest module code
-	/// lives above the image base; anything else is emulator or system code that
-	/// the managed profiler already covers.
-	/// </summary>
-	private string DescribeGuestAddress(ulong address)
-	{
-		
-		
-
-		if (address >= GuestImageBase && address < GuestImageLimit)
-		{
-			return $"(app+0x{address - GuestImageBase:X})";
-		}
-
-		for (var index = 0; index < _importEntries.Length; index++)
-		{
-			if (_importEntries[index].Address == (address & ~0xFUL))
-			{
-				return $"(stub:{_importEntries[index].Nid})";
-			}
-		}
-
-		return "(host)";
-	}
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.GuestSchedulerProfile.cs

@@ -1,309 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Collections.Concurrent;
-using System.Diagnostics;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-public sealed unsafe partial class DirectExecutionBackend
-{
-    private sealed class GuestSchedulerThreadStats
-    {
-        public string Name = string.Empty;
-        public long ReadyTimestamp;
-        public long BlockTimestamp;
-        public long ScheduledTimestamp;
-        public long RunTimestamp;
-        public long ReadyCount;
-        public long ClaimCount;
-        public long ScheduleCount;
-        public long RunCount;
-        public long BlockCount;
-        public long ResumeCount;
-        public long ReadyTicks;
-        public long BlockTicks;
-        public long ScheduleTicks;
-        public long RunTicks;
-        public long MaxReadyTicks;
-        public long MaxBlockTicks;
-        public long MaxScheduleTicks;
-        public long MaxRunTicks;
-        public string? LastBlockReason;
-        public int Completed;
-    }
-
-    private static readonly bool _profileGuestScheduler =
-        string.Equals(
-            Environment.GetEnvironmentVariable("SHARPEMU_PROFILE_GUEST_SCHEDULER"),
-            "1",
-            StringComparison.Ordinal) ||
-        string.Equals(
-            Environment.GetEnvironmentVariable("SHARPEMU_PROFILE_PERFORMANCE"),
-            "1",
-            StringComparison.Ordinal);
-
-    private readonly ConcurrentDictionary<ulong, GuestSchedulerThreadStats> _guestSchedulerStats = new();
-    private readonly GuestThreadFlowProfile _guestThreadFlowProfile = new();
-    private readonly object _guestTraceOutputGate = new();
-    private long _guestSchedulerProfileWindowStart = Stopwatch.GetTimestamp();
-    private long _guestSchedulerProfileNextReport =
-        Stopwatch.GetTimestamp() + (Stopwatch.Frequency * 5L);
-    private int _guestSchedulerProfileReporting;
-
-    private void StartGuestFlowTraces()
-    {
-        lock (_guestTraceOutputGate)
-        {
-            _guestThreadFlowProfile.StartSession();
-            SharpEmu.Libs.Diagnostics.SemaphoreSignalProfile.StartSession();
-            SharpEmu.Libs.Diagnostics.MutexHandoffProfile.StartSession();
-            SharpEmu.Libs.VideoOut.SubmissionFlowProfile.StartSession();
-        }
-    }
-
-    private void WriteGuestFlowTraces(TextWriter? output = null)
-    {
-        output ??= Console.Error;
-        lock (_guestTraceOutputGate)
-        {
-            var signals = SharpEmu.Libs.Diagnostics.SemaphoreSignalProfile.Close();
-            var mutexes = SharpEmu.Libs.Diagnostics.MutexHandoffProfile.Close();
-            SharpEmu.Libs.VideoOut.SubmissionFlowProfile.WriteTrace(output);
-            try
-            {
-                _guestThreadFlowProfile.WriteTrace(output);
-                SharpEmu.Libs.Diagnostics.SemaphoreSignalProfile.WriteTrace(output, signals);
-                SharpEmu.Libs.Diagnostics.MutexHandoffProfile.WriteTrace(output, mutexes);
-            }
-            catch (Exception exception) when (exception is IOException or ObjectDisposedException)
-            {
-                // A closed trace output must not prevent native session cleanup.
-            }
-        }
-    }
-
-    private void RecordGuestThreadFlow(GuestThreadState thread, GuestThreadFlowProfile.EventKind kind, string? reason = null)
-    {
-        if (!GuestThreadFlowProfile.Enabled) return;
-        _guestThreadFlowProfile.Record(new GuestThreadFlowProfile.TraceEvent(
-            Stopwatch.GetTimestamp(), Environment.CurrentManagedThreadId, thread.ThreadHandle,
-            thread.Name, kind, reason, thread.BlockWakeKey, Volatile.Read(ref thread.LastImportNid),
-            Volatile.Read(ref thread.LastImportRdi), Volatile.Read(ref thread.LastImportRsi), thread.BlockDeadlineTimestamp));
-    }
-
-    private GuestSchedulerThreadStats GetGuestSchedulerStats(GuestThreadState thread)
-    {
-        var stats = _guestSchedulerStats.GetOrAdd(
-            thread.ThreadHandle,
-            static _ => new GuestSchedulerThreadStats());
-        stats.Name = thread.Name;
-        return stats;
-    }
-
-    private void ProfileGuestThreadReady(GuestThreadState thread)
-    {
-        RecordGuestThreadFlow(thread, GuestThreadFlowProfile.EventKind.Ready);
-        if (!_profileGuestScheduler)
-        {
-            return;
-        }
-
-        var stats = GetGuestSchedulerStats(thread);
-        var now = Stopwatch.GetTimestamp();
-        Volatile.Write(ref stats.ReadyTimestamp, now);
-        Interlocked.Increment(ref stats.ReadyCount);
-        var blockTimestamp = Interlocked.Exchange(ref stats.BlockTimestamp, 0);
-        if (blockTimestamp != 0 && now >= blockTimestamp)
-        {
-            var ticks = now - blockTimestamp;
-            Interlocked.Increment(ref stats.ResumeCount);
-            Interlocked.Add(ref stats.BlockTicks, ticks);
-            UpdateGuestSchedulerMaximum(ref stats.MaxBlockTicks, ticks);
-        }
-    }
-
-    private void ProfileGuestThreadClaimed(GuestThreadState thread)
-    {
-        RecordGuestThreadFlow(thread, GuestThreadFlowProfile.EventKind.Claimed);
-        if (!_profileGuestScheduler)
-        {
-            return;
-        }
-
-        var now = Stopwatch.GetTimestamp();
-        var stats = GetGuestSchedulerStats(thread);
-        var readyTimestamp = Interlocked.Exchange(ref stats.ReadyTimestamp, 0);
-        Interlocked.Increment(ref stats.ClaimCount);
-        if (readyTimestamp != 0 && now >= readyTimestamp)
-        {
-            var ticks = now - readyTimestamp;
-            Interlocked.Add(ref stats.ReadyTicks, ticks);
-            UpdateGuestSchedulerMaximum(ref stats.MaxReadyTicks, ticks);
-        }
-    }
-
-    private void ProfileGuestThreadScheduled(GuestThreadState thread)
-    {
-        RecordGuestThreadFlow(thread, GuestThreadFlowProfile.EventKind.Scheduled);
-        if (!_profileGuestScheduler)
-        {
-            return;
-        }
-
-        var stats = GetGuestSchedulerStats(thread);
-        Volatile.Write(ref stats.ScheduledTimestamp, Stopwatch.GetTimestamp());
-        Interlocked.Increment(ref stats.ScheduleCount);
-    }
-
-    private void ProfileGuestThreadRunStarted(GuestThreadState thread)
-    {
-        RecordGuestThreadFlow(thread, GuestThreadFlowProfile.EventKind.RunStarted);
-        if (!_profileGuestScheduler)
-        {
-            return;
-        }
-
-        var now = Stopwatch.GetTimestamp();
-        var stats = GetGuestSchedulerStats(thread);
-        var scheduledTimestamp = Interlocked.Exchange(ref stats.ScheduledTimestamp, 0);
-        Volatile.Write(ref stats.RunTimestamp, now);
-        Interlocked.Increment(ref stats.RunCount);
-        if (scheduledTimestamp != 0 && now >= scheduledTimestamp)
-        {
-            var ticks = now - scheduledTimestamp;
-            Interlocked.Add(ref stats.ScheduleTicks, ticks);
-            UpdateGuestSchedulerMaximum(ref stats.MaxScheduleTicks, ticks);
-        }
-    }
-
-    private void ProfileGuestThreadRunStopped(GuestThreadState thread)
-    {
-        if (!_profileGuestScheduler)
-        {
-            return;
-        }
-
-        var now = Stopwatch.GetTimestamp();
-        var stats = GetGuestSchedulerStats(thread);
-        var runTimestamp = Interlocked.Exchange(ref stats.RunTimestamp, 0);
-        if (runTimestamp != 0 && now >= runTimestamp)
-        {
-            var ticks = now - runTimestamp;
-            Interlocked.Add(ref stats.RunTicks, ticks);
-            UpdateGuestSchedulerMaximum(ref stats.MaxRunTicks, ticks);
-        }
-
-        if (thread.State == GuestThreadRunState.Blocked)
-        {
-            Interlocked.Increment(ref stats.BlockCount);
-            Volatile.Write(ref stats.BlockTimestamp, now);
-            Volatile.Write(ref stats.LastBlockReason, thread.BlockReason);
-        }
-        else if (thread.State is GuestThreadRunState.Exited or GuestThreadRunState.Faulted)
-        {
-            Volatile.Write(ref stats.Completed, 1);
-        }
-
-        TryReportGuestSchedulerProfile(now);
-    }
-
-    private void TryReportGuestSchedulerProfile(long now)
-    {
-        var deadline = Volatile.Read(ref _guestSchedulerProfileNextReport);
-        if (now < deadline ||
-            Interlocked.CompareExchange(ref _guestSchedulerProfileReporting, 1, 0) != 0)
-        {
-            return;
-        }
-
-        try
-        {
-            Volatile.Write(
-                ref _guestSchedulerProfileNextReport,
-                now + (Stopwatch.Frequency * 5L));
-            var windowStart = Interlocked.Exchange(ref _guestSchedulerProfileWindowStart, now);
-            var seconds = Math.Max(
-                (now - windowStart) / (double)Stopwatch.Frequency,
-                double.Epsilon);
-
-            var rows = new List<(long Rank, string Text)>();
-            foreach (var pair in _guestSchedulerStats)
-            {
-                var stats = pair.Value;
-                var readyCount = Interlocked.Exchange(ref stats.ReadyCount, 0);
-                var claimCount = Interlocked.Exchange(ref stats.ClaimCount, 0);
-                var scheduleCount = Interlocked.Exchange(ref stats.ScheduleCount, 0);
-                var runCount = Interlocked.Exchange(ref stats.RunCount, 0);
-                var blockCount = Interlocked.Exchange(ref stats.BlockCount, 0);
-                var resumeCount = Interlocked.Exchange(ref stats.ResumeCount, 0);
-                var readyTicks = Interlocked.Exchange(ref stats.ReadyTicks, 0);
-                var blockTicks = Interlocked.Exchange(ref stats.BlockTicks, 0);
-                var scheduleTicks = Interlocked.Exchange(ref stats.ScheduleTicks, 0);
-                var runTicks = Interlocked.Exchange(ref stats.RunTicks, 0);
-                var maxReadyTicks = Interlocked.Exchange(ref stats.MaxReadyTicks, 0);
-                var maxBlockTicks = Interlocked.Exchange(ref stats.MaxBlockTicks, 0);
-                var maxScheduleTicks = Interlocked.Exchange(ref stats.MaxScheduleTicks, 0);
-                var maxRunTicks = Interlocked.Exchange(ref stats.MaxRunTicks, 0);
-                if (readyCount == 0 && claimCount == 0 && scheduleCount == 0 && runCount == 0)
-                {
-                    continue;
-                }
-
-                rows.Add((Math.Max(blockTicks, Math.Max(readyTicks, runTicks)),
-                    $"name='{stats.Name}' handle=0x{pair.Key:X16} " +
-                    $"ready={readyCount} claimed={claimCount} scheduled={scheduleCount} " +
-                    $"runs={runCount} blocked={blockCount} resumed={resumeCount} " +
-                    $"blocked_ms={GuestSchedulerMilliseconds(blockTicks):F2} " +
-                    $"blocked_avg_ms={(resumeCount == 0 ? 0.0 : GuestSchedulerMilliseconds(blockTicks) / resumeCount):F3} " +
-                    $"blocked_max_ms={GuestSchedulerMilliseconds(maxBlockTicks):F3} " +
-                    $"ready_ms={GuestSchedulerMilliseconds(readyTicks):F2} " +
-                    $"ready_avg_ms={(claimCount == 0 ? 0.0 : GuestSchedulerMilliseconds(readyTicks) / claimCount):F3} " +
-                    $"ready_max_ms={GuestSchedulerMilliseconds(maxReadyTicks):F3} " +
-                    $"dispatch_ms={GuestSchedulerMilliseconds(scheduleTicks):F2} " +
-                    $"dispatch_avg_ms={(runCount == 0 ? 0.0 : GuestSchedulerMilliseconds(scheduleTicks) / runCount):F3} " +
-                    $"dispatch_max_ms={GuestSchedulerMilliseconds(maxScheduleTicks):F3} " +
-                    $"run_ms={GuestSchedulerMilliseconds(runTicks):F2} " +
-                    $"run_avg_ms={(runCount == 0 ? 0.0 : GuestSchedulerMilliseconds(runTicks) / runCount):F3} " +
-                    $"run_max_ms={GuestSchedulerMilliseconds(maxRunTicks):F3} " +
-                    $"last_block={Volatile.Read(ref stats.LastBlockReason) ?? "none"}"));
-
-                if (Volatile.Read(ref stats.Completed) != 0)
-                {
-                    _guestSchedulerStats.TryRemove(pair.Key, out _);
-                }
-            }
-
-            Console.Error.WriteLine(
-                $"[PERF][GUEST_SCHED] window={seconds:F1}s active_threads={rows.Count}");
-            foreach (var row in rows
-                .OrderByDescending(static item => item.Rank)
-                .Take(32))
-            {
-                Console.Error.WriteLine($"[PERF][GUEST_SCHED] {row.Text}");
-            }
-        }
-        finally
-        {
-            Volatile.Write(ref _guestSchedulerProfileReporting, 0);
-        }
-    }
-
-    private static double GuestSchedulerMilliseconds(long ticks) =>
-        ticks * 1000.0 / Stopwatch.Frequency;
-
-    private static void UpdateGuestSchedulerMaximum(ref long target, long candidate)
-    {
-        var current = Volatile.Read(ref target);
-        while (candidate > current)
-        {
-            var observed = Interlocked.CompareExchange(ref target, candidate, current);
-            if (observed == current)
-            {
-                return;
-            }
-
-            current = observed;
-        }
-    }
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.IllegalInstruction.cs

@@ -1,362 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Buffers.Binary;
-using System.Threading;
-using Iced.Intel;
-using SharpEmu.Core.Cpu.Emulation;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-// Software fallback for the BMI1/BMI2/ABM general-purpose-register instructions.
-//
-// Guest code runs natively, so the guest and host share the same virtual address space and the
-// same registers (the OS delivers them in the CONTEXT record on a fault). When the host CPU lacks
-// one of these extensions it raises #UD instead of executing the opcode; without this the title
-// simply aborts. Here we decode the faulting instruction, evaluate it against the trapped register
-// and memory state, write the result back into the CONTEXT, step RIP past the instruction and ask
-// the OS to continue. Only the register-only BMI/ABM forms are handled; anything else returns false
-// and falls through to the existing diagnostics unchanged, so this can never mis-handle an opcode it
-// does not fully model.
-public sealed partial class DirectExecutionBackend
-{
-    // Windows x64 CONTEXT.EFlags lives just past the segment selectors. The GPR offsets it shares
-    // with the rest of the backend are the CTX_* constants declared in DirectExecutionBackend.cs.
-    private const int CTX_EFLAGS = 68;
-
-    // STATUS_ILLEGAL_INSTRUCTION (#UD surfaced by the Windows vectored handler).
-    private const uint StatusIllegalInstruction = 0xC000001Du;
-
-    private const int MaxInstructionBytes = 15;
-
-    // Instruction-window sizes tried in turn so a fault near a page boundary still decodes.
-    private static readonly int[] DecodeWindowSizes = { MaxInstructionBytes, 11, 8, 4, 2 };
-
-    private static int _bmiSoftwareFallbackAnnounced;
-    private static long _bmiInstructionsEmulated;
-
-    private unsafe bool TryRecoverIllegalInstruction(void* contextRecord, ulong rip)
-    {
-        if (!TryReadFaultingInstruction(rip, out var instruction))
-        {
-            return false;
-        }
-
-        if (instruction.Op0Kind != OpKind.Register ||
-            !TryGetGprSlot(instruction.Op0Register, out var destOffset, out var size))
-        {
-            return false;
-        }
-
-        if (!TryEvaluate(contextRecord, in instruction, size, out var result, out var flagsChanged, out var eflags))
-        {
-            return false;
-        }
-
-        WriteCtxU64(contextRecord, destOffset, result);
-        if (flagsChanged)
-        {
-            WriteCtxU32(contextRecord, CTX_EFLAGS, eflags);
-        }
-
-        WriteCtxU64(contextRecord, CTX_RIP, rip + (ulong)instruction.Length);
-
-        Interlocked.Increment(ref _bmiInstructionsEmulated);
-        if (Interlocked.Exchange(ref _bmiSoftwareFallbackAnnounced, 1) == 0)
-        {
-            Console.Error.WriteLine(
-                "[LOADER][INFO] Host lacks a BMI/ABM extension used by the guest; " +
-                "emulating those instructions in software.");
-        }
-
-        return true;
-    }
-
-    private unsafe bool TryEvaluate(
-        void* contextRecord,
-        in Instruction instruction,
-        GprOperandSize size,
-        out ulong result,
-        out bool flagsChanged,
-        out uint eflags)
-    {
-        result = 0;
-        flagsChanged = false;
-        eflags = ReadCtxU32(contextRecord, CTX_EFLAGS);
-
-        switch (instruction.Mnemonic)
-        {
-            case Mnemonic.Andn:
-                if (!TryReadOperand(contextRecord, in instruction, 1, size, out var andnSrc1) ||
-                    !TryReadOperand(contextRecord, in instruction, 2, size, out var andnSrc2))
-                {
-                    return false;
-                }
-
-                result = BmiInstructionEmulator.Andn(andnSrc1, andnSrc2, size, ref eflags);
-                flagsChanged = true;
-                return true;
-
-            case Mnemonic.Blsi:
-            case Mnemonic.Blsmsk:
-            case Mnemonic.Blsr:
-                if (!TryReadOperand(contextRecord, in instruction, 1, size, out var blsSrc))
-                {
-                    return false;
-                }
-
-                result = instruction.Mnemonic switch
-                {
-                    Mnemonic.Blsi => BmiInstructionEmulator.Blsi(blsSrc, size, ref eflags),
-                    Mnemonic.Blsmsk => BmiInstructionEmulator.Blsmsk(blsSrc, size, ref eflags),
-                    _ => BmiInstructionEmulator.Blsr(blsSrc, size, ref eflags),
-                };
-                flagsChanged = true;
-                return true;
-
-            case Mnemonic.Bextr:
-                if (!TryReadOperand(contextRecord, in instruction, 1, size, out var bextrSrc) ||
-                    !TryReadOperand(contextRecord, in instruction, 2, size, out var bextrControl))
-                {
-                    return false;
-                }
-
-                result = BmiInstructionEmulator.Bextr(bextrSrc, bextrControl, size, ref eflags);
-                flagsChanged = true;
-                return true;
-
-            case Mnemonic.Bzhi:
-                if (!TryReadOperand(contextRecord, in instruction, 1, size, out var bzhiSrc) ||
-                    !TryReadOperand(contextRecord, in instruction, 2, size, out var bzhiIndex))
-                {
-                    return false;
-                }
-
-                result = BmiInstructionEmulator.Bzhi(bzhiSrc, bzhiIndex, size, ref eflags);
-                flagsChanged = true;
-                return true;
-
-            case Mnemonic.Tzcnt:
-            case Mnemonic.Lzcnt:
-                if (!TryReadOperand(contextRecord, in instruction, 1, size, out var cntSrc))
-                {
-                    return false;
-                }
-
-                result = instruction.Mnemonic == Mnemonic.Tzcnt
-                    ? BmiInstructionEmulator.Tzcnt(cntSrc, size, ref eflags)
-                    : BmiInstructionEmulator.Lzcnt(cntSrc, size, ref eflags);
-                flagsChanged = true;
-                return true;
-
-            case Mnemonic.Rorx:
-                if (instruction.Op2Kind != OpKind.Immediate8 ||
-                    !TryReadOperand(contextRecord, in instruction, 1, size, out var rorxSrc))
-                {
-                    return false;
-                }
-
-                result = BmiInstructionEmulator.Rorx(rorxSrc, instruction.Immediate8, size);
-                return true;
-
-            case Mnemonic.Sarx:
-            case Mnemonic.Shlx:
-            case Mnemonic.Shrx:
-                if (!TryReadOperand(contextRecord, in instruction, 1, size, out var shiftSrc) ||
-                    !TryReadOperand(contextRecord, in instruction, 2, size, out var shiftCount))
-                {
-                    return false;
-                }
-
-                result = instruction.Mnemonic switch
-                {
-                    Mnemonic.Sarx => BmiInstructionEmulator.Sarx(shiftSrc, (int)shiftCount, size),
-                    Mnemonic.Shlx => BmiInstructionEmulator.Shlx(shiftSrc, (int)shiftCount, size),
-                    _ => BmiInstructionEmulator.Shrx(shiftSrc, (int)shiftCount, size),
-                };
-                return true;
-
-            case Mnemonic.Pdep:
-            case Mnemonic.Pext:
-                if (!TryReadOperand(contextRecord, in instruction, 1, size, out var packSrc) ||
-                    !TryReadOperand(contextRecord, in instruction, 2, size, out var packMask))
-                {
-                    return false;
-                }
-
-                result = instruction.Mnemonic == Mnemonic.Pdep
-                    ? BmiInstructionEmulator.Pdep(packSrc, packMask, size)
-                    : BmiInstructionEmulator.Pext(packSrc, packMask, size);
-                return true;
-
-            default:
-                return false;
-        }
-    }
-
-    private unsafe bool TryReadFaultingInstruction(ulong rip, out Instruction instruction)
-    {
-        // Try the full instruction window first, then shrink so a fault near the end of a mapped
-        // page (where fewer than 15 bytes are readable) still decodes.
-        foreach (var attempt in DecodeWindowSizes)
-        {
-            var buffer = new byte[attempt];
-            if (!TryReadExecutableBytes(rip, buffer))
-            {
-                continue;
-            }
-
-            var decoder = Decoder.Create(64, new ByteArrayCodeReader(buffer));
-            decoder.IP = rip;
-            decoder.Decode(out instruction);
-            if (instruction.Code != Code.INVALID && instruction.Length > 0 && instruction.Length <= attempt)
-            {
-                return true;
-            }
-        }
-
-        instruction = default;
-        return false;
-    }
-
-    private unsafe bool TryReadOperand(
-        void* contextRecord,
-        in Instruction instruction,
-        int operandIndex,
-        GprOperandSize size,
-        out ulong value)
-    {
-        value = 0;
-        switch (instruction.GetOpKind(operandIndex))
-        {
-            case OpKind.Register:
-                if (!TryGetGprSlot(instruction.GetOpRegister(operandIndex), out var offset, out _))
-                {
-                    return false;
-                }
-
-                var raw = ReadCtxU64(contextRecord, offset);
-                value = size == GprOperandSize.Bits64 ? raw : raw & 0xFFFF_FFFFUL;
-                return true;
-
-            case OpKind.Memory:
-                if (!TryComputeMemoryAddress(contextRecord, in instruction, out var address))
-                {
-                    return false;
-                }
-
-                var byteCount = size == GprOperandSize.Bits64 ? 8 : 4;
-                var buffer = new byte[byteCount];
-                if (!TryReadHostBytes(address, buffer))
-                {
-                    return false;
-                }
-
-                value = byteCount == 8
-                    ? BinaryPrimitives.ReadUInt64LittleEndian(buffer)
-                    : BinaryPrimitives.ReadUInt32LittleEndian(buffer);
-                return true;
-
-            default:
-                return false;
-        }
-    }
-
-    private unsafe bool TryComputeMemoryAddress(void* contextRecord, in Instruction instruction, out ulong address)
-    {
-        address = 0;
-
-        // FS/GS-relative operands need the guest segment base, which is not modelled here.
-        if (instruction.SegmentPrefix != Register.None)
-        {
-            return false;
-        }
-
-        if (instruction.IsIPRelativeMemoryOperand)
-        {
-            address = instruction.IPRelativeMemoryAddress;
-            return true;
-        }
-
-        var effective = instruction.MemoryDisplacement64;
-        if (instruction.MemoryBase != Register.None)
-        {
-            if (!TryGetGpr64Offset(instruction.MemoryBase, out var baseOffset))
-            {
-                return false;
-            }
-
-            effective += ReadCtxU64(contextRecord, baseOffset);
-        }
-
-        if (instruction.MemoryIndex != Register.None)
-        {
-            if (!TryGetGpr64Offset(instruction.MemoryIndex, out var indexOffset))
-            {
-                return false;
-            }
-
-            effective += ReadCtxU64(contextRecord, indexOffset) * (ulong)instruction.MemoryIndexScale;
-        }
-
-        address = effective;
-        return true;
-    }
-
-    // Maps a 32- or 64-bit GPR to its CONTEXT offset and reports the operand width it implies.
-    private static bool TryGetGprSlot(Register register, out int offset, out GprOperandSize size)
-    {
-        switch (register)
-        {
-            case Register.EAX: offset = CTX_RAX; size = GprOperandSize.Bits32; return true;
-            case Register.ECX: offset = CTX_RCX; size = GprOperandSize.Bits32; return true;
-            case Register.EDX: offset = CTX_RDX; size = GprOperandSize.Bits32; return true;
-            case Register.EBX: offset = CTX_RBX; size = GprOperandSize.Bits32; return true;
-            case Register.ESP: offset = CTX_RSP; size = GprOperandSize.Bits32; return true;
-            case Register.EBP: offset = CTX_RBP; size = GprOperandSize.Bits32; return true;
-            case Register.ESI: offset = CTX_RSI; size = GprOperandSize.Bits32; return true;
-            case Register.EDI: offset = CTX_RDI; size = GprOperandSize.Bits32; return true;
-            case Register.R8D: offset = CTX_R8; size = GprOperandSize.Bits32; return true;
-            case Register.R9D: offset = CTX_R9; size = GprOperandSize.Bits32; return true;
-            case Register.R10D: offset = CTX_R10; size = GprOperandSize.Bits32; return true;
-            case Register.R11D: offset = CTX_R11; size = GprOperandSize.Bits32; return true;
-            case Register.R12D: offset = CTX_R12; size = GprOperandSize.Bits32; return true;
-            case Register.R13D: offset = CTX_R13; size = GprOperandSize.Bits32; return true;
-            case Register.R14D: offset = CTX_R14; size = GprOperandSize.Bits32; return true;
-            case Register.R15D: offset = CTX_R15; size = GprOperandSize.Bits32; return true;
-            default:
-                if (TryGetGpr64Offset(register, out offset))
-                {
-                    size = GprOperandSize.Bits64;
-                    return true;
-                }
-
-                size = GprOperandSize.Bits32;
-                return false;
-        }
-    }
-
-    private static bool TryGetGpr64Offset(Register register, out int offset)
-    {
-        switch (register)
-        {
-            case Register.RAX: offset = CTX_RAX; return true;
-            case Register.RCX: offset = CTX_RCX; return true;
-            case Register.RDX: offset = CTX_RDX; return true;
-            case Register.RBX: offset = CTX_RBX; return true;
-            case Register.RSP: offset = CTX_RSP; return true;
-            case Register.RBP: offset = CTX_RBP; return true;
-            case Register.RSI: offset = CTX_RSI; return true;
-            case Register.RDI: offset = CTX_RDI; return true;
-            case Register.R8: offset = CTX_R8; return true;
-            case Register.R9: offset = CTX_R9; return true;
-            case Register.R10: offset = CTX_R10; return true;
-            case Register.R11: offset = CTX_R11; return true;
-            case Register.R12: offset = CTX_R12; return true;
-            case Register.R13: offset = CTX_R13; return true;
-            case Register.R14: offset = CTX_R14; return true;
-            case Register.R15: offset = CTX_R15; return true;
-            default: offset = 0; return false;
-        }
-    }
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.MachExceptions.cs

@@ -1,51 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System;
-using System.Runtime.InteropServices;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-// On macOS the runtime receives EXC_BAD_ACCESS on each of its threads through a Mach exception
-// port before the kernel raises SIGSEGV or SIGBUS. It calls any fault in the page holding RSP, or
-// the page below it, a stack overflow and aborts, assuming RSP is on a stack it owns. Guest code
-// runs on guest stacks, and those pages fault whenever GPU or image write tracking has protected
-// them, so a thread running guest code must leave its access faults to the signal handler. The
-// handler resolves guest faults and chains every other one to the runtime's own signal handler,
-// the same path the runtime uses on Linux.
-public sealed unsafe partial class DirectExecutionBackend
-{
-	private const uint ExceptionMaskBadAccess = 1u << 1;
-	private const int ExceptionDefault = 1;
-	private const int ThreadStateNone = 13;
-
-	[ThreadStatic]
-	private static bool _guestFaultsUseSignals;
-
-	private static int _machExceptionPortWarning;
-
-	[DllImport("libSystem.dylib", EntryPoint = "mach_thread_self")]
-	private static extern uint MachThreadSelf();
-
-	[DllImport("libSystem.dylib", EntryPoint = "thread_set_exception_ports")]
-	private static extern int ThreadSetExceptionPorts(uint thread, uint exceptionMask, uint newPort, int behavior, int newFlavor);
-
-	[DllImport("libSystem.dylib", EntryPoint = "mach_port_deallocate")]
-	private static extern int MachPortDeallocate(uint task, uint name);
-
-	private static readonly uint _machTaskSelf = OperatingSystem.IsMacOS()
-		? (uint)Marshal.ReadInt32(NativeLibrary.GetExport(NativeLibrary.Load("libSystem.dylib"), "mach_task_self_"))
-		: 0;
-
-	private static void RouteGuestAccessFaultsToSignals()
-	{
-		if (_guestFaultsUseSignals || !OperatingSystem.IsMacOS())
-			return;
-		_guestFaultsUseSignals = true;
-		var thread = MachThreadSelf();
-		var result = ThreadSetExceptionPorts(thread, ExceptionMaskBadAccess, 0, ExceptionDefault, ThreadStateNone);
-		_ = MachPortDeallocate(_machTaskSelf, thread);
-		if (result != 0 && System.Threading.Interlocked.Exchange(ref _machExceptionPortWarning, 1) == 0)
-			Console.Error.WriteLine($"[LOADER][WARN] Cannot hand guest access faults to the signal handler: thread_set_exception_ports={result}.");
-	}
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.NativeWorker.cs

@@ -1,886 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System;
-using System.Collections.Generic;
-using System.Runtime.InteropServices;
-using System.Threading;
-using SharpEmu.HLE;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-public sealed partial class DirectExecutionBackend
-{
-	// Guest entry stubs must not run above CLR-managed frames on a CLR-created thread:
-	// the suspension/stack-walk machinery then has to traverse a frame chain that is
-	// interleaved with guest stubs carrying no CLR unwind info, and any window in which
-	// the thread-mode bookkeeping disagrees with the actual stack (import dispatch, VEH
-	// redirection) fail-fasts the runtime — the audio_output_thread ~7th-cycle
-	// "attempted to call a UnmanagedCallersOnly method from managed code" crash.
-	//
-	// Guest execution therefore runs on dedicated raw OS threads whose run loop is
-	// emitted native code. While guest code executes there is not a single managed
-	// frame on the thread and it sits in preemptive mode, so the GC ignores it
-	// entirely. The only managed activity on the thread is the reverse-P/Invoke import
-	// dispatch and the per-run prologue/epilogue, which the CLR supports on foreign
-	// threads (lazy attach, preemptive between calls). The managed orchestrator
-	// (RunGuestThread / the main execution thread) parks in a preemptive wait for the
-	// duration of the run, so its own frame chain is never walked across guest frames.
-	private static readonly bool NativeGuestWorkersDisabled =
-		string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_NATIVE_GUEST_WORKERS"), "1", StringComparison.Ordinal);
-
-	// Cap concurrent native-worker Runs. Astro's tbb_thead burst overlaps many
-	// UnmanagedCallersOnly prologues; a large prewarm + unbounded concurrency
-	// FailFasts (0xC0000409) mid-storm with no VEH breadcrumb. Pool size and
-	// in-flight Runs are separate knobs.
-	private static readonly int NativeWorkerMaxConcurrent = ReadNativeWorkerMaxConcurrent();
-
-	private static int ReadNativeWorkerMaxConcurrent()
-	{
-		if (int.TryParse(
-			    Environment.GetEnvironmentVariable("SHARPEMU_NATIVE_WORKER_MAX_CONCURRENT"),
-			    out var parsed) &&
-		    parsed > 0)
-		{
-			return Math.Clamp(parsed, 1, 64);
-		}
-
-		return 2;
-	}
-
-	private readonly object _nativeWorkerGate = new();
-	private readonly List<NativeGuestExecutor> _allNativeWorkers = new();
-	private readonly Stack<NativeGuestExecutor> _idleNativeWorkers = new();
-	private readonly SemaphoreSlim _nativeWorkerRunLimiter = new(NativeWorkerMaxConcurrent);
-	private bool _nativeWorkersDisposed;
-	private int _nativeWorkerCreationFailedLogged;
-
-	private const uint StackSizeParamIsAReservation = 0x00010000u;
-
-	[DllImport("kernel32.dll", SetLastError = true)]
-	private static extern nint CreateThread(
-		nint lpThreadAttributes,
-		nuint dwStackSize,
-		nint lpStartAddress,
-		nint lpParameter,
-		uint dwCreationFlags,
-		out uint lpThreadId);
-
-	[DllImport("kernel32.dll", SetLastError = true)]
-	private static extern uint WaitForSingleObject(nint hHandle, uint dwMilliseconds);
-
-	[DllImport("kernel32.dll", SetLastError = true)]
-	private static extern bool TerminateThread(nint hThread, uint dwExitCode);
-
-	// Runs an emitted guest entry stub. Preferred path is a pooled native worker
-	// thread; falls back to the historical inline calli (guest frames above this
-	// thread's managed frames) when workers are disabled or unavailable.
-	//
-	// Callers set the Active* thread-statics before emitting the stub and read the
-	// yield/forced-exit flags right after this returns, so the worker outcome is
-	// copied back into this thread's statics before returning.
-	private unsafe ulong RunGuestEntryStub(void* entryStub, ulong hostRspSlot, bool requireNativeWorker = false)
-	{
-		// Limit in-flight native Runs before renting so the idle pool is not
-		// drained by threads blocked on the concurrency gate.
-		_nativeWorkerRunLimiter.Wait();
-		NativeGuestExecutor? worker = null;
-		try
-		{
-			// Astro can spawn a burst of tbb_thead while workers are still in
-			// TerminateThread+respawn. Wait for a native worker — never fall back
-			// to managed inline (FailFast) and never throw (uncaught throw mid-
-			// storm was a silent process die).
-			var maxAttempts = requireNativeWorker ? 500 : 48;
-			for (var attempt = 0; attempt < maxAttempts; attempt++)
-			{
-				worker = RentNativeGuestExecutor();
-				if (worker is not null)
-				{
-					break;
-				}
-
-				if (!requireNativeWorker)
-				{
-					break;
-				}
-
-				Thread.Sleep(attempt < 32 ? 1 : 4);
-			}
-
-			if (worker is null)
-			{
-				if (requireNativeWorker)
-				{
-					var n = Interlocked.Increment(ref _tbbNativeWorkerRefuseCount);
-					if (n <= 8 || n % 32 == 0)
-					{
-						Console.Error.WriteLine(
-							$"[LOADER][ERROR] tbb_native_worker unavailable #{n} after {maxAttempts} attempts; " +
-							"skipping run (no managed inline, no throw)");
-						Console.Error.Flush();
-					}
-
-					_activeGuestThreadYieldRequested = true;
-					_activeGuestThreadYieldReason = "tbb_native_worker_unavailable";
-					_activeForcedGuestExit = true;
-					return 0x80020012UL;
-				}
-
-				TlsSetValue(_hostRspSlotTlsIndex, (nint)hostRspSlot);
-				return CallNativeEntry(entryStub);
-			}
-
-			try
-			{
-				var state = _activeGuestThreadState;
-				if (LogThreadMode && state is { Name: "tbb_thead" })
-				{
-					var n = Interlocked.Increment(ref _tbbNativeRunEnterCount);
-					if (n <= 12 || n % 64 == 0)
-					{
-						Console.Error.WriteLine(
-							$"[LOADER][INFO] tbb_run_enter #{n} native_tid_pending handle=0x{state.ThreadHandle:X16} " +
-							$"max_concurrent={NativeWorkerMaxConcurrent}");
-						Console.Error.Flush();
-					}
-				}
-
-				var nativeReturn = worker.Run(
-					_activeCpuContext!,
-					state,
-					GuestThreadExecution.CurrentGuestThreadHandle,
-					_activeEntryReturnSentinelRip,
-					_activeGuestReturnSlotAddress,
-					(nint)hostRspSlot,
-					(nint)entryStub,
-					state?.AffinityMask ?? 0,
-					out var yieldRequested,
-					out var yieldReason,
-					out var forcedExit);
-				_activeGuestThreadYieldRequested = yieldRequested;
-				_activeGuestThreadYieldReason = yieldReason;
-				_activeForcedGuestExit = forcedExit;
-				return nativeReturn;
-			}
-			finally
-			{
-				ReturnNativeGuestExecutor(worker);
-			}
-		}
-		finally
-		{
-			_nativeWorkerRunLimiter.Release();
-		}
-	}
-
-	private static int _tbbNativeRunEnterCount;
-	private static int _tbbNativeWorkerRefuseCount;
-	internal static int _tbbWorkerPrologueFaultCount;
-
-	private void PrewarmNativeGuestWorkers(int count)
-	{
-		if (!OperatingSystem.IsWindows() || NativeGuestWorkersDisabled || count <= 0)
-		{
-			return;
-		}
-
-		var warmed = new List<NativeGuestExecutor>(count);
-		for (var i = 0; i < count; i++)
-		{
-			var worker = NativeGuestExecutor.TryCreate(this);
-			if (worker is null)
-			{
-				break;
-			}
-
-			warmed.Add(worker);
-		}
-
-		lock (_nativeWorkerGate)
-		{
-			if (_nativeWorkersDisposed)
-			{
-				foreach (var worker in warmed)
-				{
-					worker.Dispose();
-				}
-				return;
-			}
-
-			foreach (var worker in warmed)
-			{
-				_allNativeWorkers.Add(worker);
-				_idleNativeWorkers.Push(worker);
-			}
-		}
-
-		Console.Error.WriteLine(
-			$"[LOADER][INFO] Native guest workers prewarmed: {warmed.Count}/{count} " +
-			$"max_concurrent={NativeWorkerMaxConcurrent}");
-		Console.Error.Flush();
-	}
-
-	private NativeGuestExecutor? RentNativeGuestExecutor()
-	{
-		// NativeGuestExecutor emits a Win32 wait loop and creates it with
-		// kernel32!CreateThread. POSIX hosts use the established inline entry
-		// path until the worker loop has a pthread/eventfd implementation.
-		if (!OperatingSystem.IsWindows() || NativeGuestWorkersDisabled)
-		{
-			return null;
-		}
-		lock (_nativeWorkerGate)
-		{
-			if (_nativeWorkersDisposed)
-			{
-				return null;
-			}
-			if (_idleNativeWorkers.Count > 0)
-			{
-				return _idleNativeWorkers.Pop();
-			}
-		}
-		var worker = NativeGuestExecutor.TryCreate(this);
-		if (worker is null)
-		{
-			if (Interlocked.Exchange(ref _nativeWorkerCreationFailedLogged, 1) == 0)
-			{
-				Console.Error.WriteLine(
-					"[LOADER][WARN] Failed to create a native guest worker thread; falling back to inline guest execution.");
-			}
-			return null;
-		}
-		lock (_nativeWorkerGate)
-		{
-			if (_nativeWorkersDisposed)
-			{
-				worker.Dispose();
-				return null;
-			}
-			_allNativeWorkers.Add(worker);
-		}
-		return worker;
-	}
-
-	private void ReturnNativeGuestExecutor(NativeGuestExecutor worker)
-	{
-		lock (_nativeWorkerGate)
-		{
-			if (!_nativeWorkersDisposed)
-			{
-				_idleNativeWorkers.Push(worker);
-				return;
-			}
-		}
-		worker.Dispose();
-	}
-
-	private void DisposeNativeGuestExecutors()
-	{
-		NativeGuestExecutor[] workers;
-		lock (_nativeWorkerGate)
-		{
-			if (_nativeWorkersDisposed)
-			{
-				return;
-			}
-			_nativeWorkersDisposed = true;
-			workers = _allNativeWorkers.ToArray();
-			_allNativeWorkers.Clear();
-			_idleNativeWorkers.Clear();
-		}
-		foreach (var worker in workers)
-		{
-			worker.Dispose();
-		}
-	}
-
-	// A pooled raw OS thread that executes guest entry stubs. The run loop is emitted
-	// native code (no CLR unwind info required — nothing ever unwinds through it):
-	//
-	//   loop: WaitForSingleObject(work);
-	//         if (*stopFlag) { SetEvent(done); ExitThread(0); }
-	//         rax = RunPrologue(self);      // managed: binds per-run ambient, returns stub
-	//         if (rax != 0) rax = rax();    // guest entry stub — zero managed frames below
-	//         RunEpilogue(self, rax);       // managed: captures outcome, restores ambient
-	//         SetEvent(done); goto loop;
-	//
-	// Workers carry no per-guest identity of their own: the prologue rebinds guest TLS,
-	// the host-RSP slot, the Active* thread-statics and the GuestThreadExecution ambient
-	// on every run, so a worker can be reused for any guest thread.
-	private sealed unsafe class NativeGuestExecutor : IDisposable
-	{
-		private const uint LoopStubSize = 512u;
-		private const uint WorkerStackReservation = 4u * 1024u * 1024u;
-
-		private static nint _waitForSingleObjectAddress;
-		private static nint _setEventAddress;
-		private static nint _exitThreadAddress;
-
-		private readonly DirectExecutionBackend _backend;
-		// Windows uses AutoResetEvent (its SafeWaitHandle is a real kernel
-		// event the emitted loop can wait on); POSIX uses worker-event
-		// semaphores shared the same way via PosixHostStubs.
-		private readonly AutoResetEvent? _workAvailable;
-		private readonly AutoResetEvent? _workCompleted;
-		private nint _workSemaphore;
-		private nint _doneSemaphore;
-
-		// RunPrologue/RunEpilogue compile to the host ABI (SysV on POSIX); the
-		// emitted loop calls them with Win64 registers, so POSIX routes the
-		// calls through register-shuffling thunks (shared by all workers).
-		private static nint _posixPrologueThunk;
-		private static nint _posixEpilogueThunk;
-		private static readonly object PosixThunkGate = new();
-		private GCHandle _selfHandle;
-		private void* _controlBlock;
-		private void* _loopStub;
-		private nint _threadHandle;
-		private uint _nativeThreadId;
-
-		// Single in-flight run; publication is ordered by the work/done event pair.
-		private CpuContext? _runContext;
-		private GuestThreadState? _runState;
-		private ulong _runGuestThreadHandle;
-		private ulong _runSentinelRip;
-		private ulong _runReturnSlotAddress;
-		private nint _runHostRspSlot;
-		private nint _runEntryStub;
-		private ulong _runAffinityMask;
-		private ulong _runNativeResult;
-		private bool _runYieldRequested;
-		private string? _runYieldReason;
-		private bool _runForcedExit;
-		private bool _runPrologueFailed;
-
-		// Prologue -> epilogue carry, only touched on the worker thread.
-		private DirectExecutionBackend? _prevBackend;
-		private CpuContext? _prevContext;
-		private ulong _prevSentinel;
-		private ulong _prevReturnSlot;
-		private bool _prevForcedExit;
-		private bool _prevYieldRequested;
-		private string? _prevYieldReason;
-		private GuestThreadState? _prevState;
-		private ulong _prevGuestThreadHandle;
-		private nint _prevHostRspSlot;
-		private int _prevHostThreadId;
-		private bool _entered;
-
-		private NativeGuestExecutor(DirectExecutionBackend backend)
-		{
-			_backend = backend;
-			if (OperatingSystem.IsWindows())
-			{
-				_workAvailable = new AutoResetEvent(false);
-				_workCompleted = new AutoResetEvent(false);
-			}
-		}
-
-		public static NativeGuestExecutor? TryCreate(DirectExecutionBackend backend)
-		{
-			if (!EnsureKernel32Exports())
-			{
-				return null;
-			}
-			var executor = new NativeGuestExecutor(backend);
-			if (!executor.Initialize())
-			{
-				executor.Dispose();
-				return null;
-			}
-			return executor;
-		}
-
-		private static bool EnsureKernel32Exports()
-		{
-			if (_exitThreadAddress != 0)
-			{
-				return _waitForSingleObjectAddress != 0 && _setEventAddress != 0;
-			}
-			nint kernel32 = GetModuleHandle("kernel32.dll");
-			if (kernel32 == 0)
-			{
-				return false;
-			}
-			_waitForSingleObjectAddress = GetProcAddress(kernel32, "WaitForSingleObject");
-			_setEventAddress = GetProcAddress(kernel32, "SetEvent");
-			_exitThreadAddress = GetProcAddress(kernel32, "ExitThread");
-			return _waitForSingleObjectAddress != 0 && _setEventAddress != 0 && _exitThreadAddress != 0;
-		}
-
-		private bool Initialize()
-		{
-			_selfHandle = GCHandle.Alloc(this);
-			_controlBlock = VirtualAlloc(null, 4096u, 12288u, 4u);
-			if (_controlBlock == null)
-			{
-				return false;
-			}
-			_loopStub = VirtualAlloc(null, LoopStubSize, 12288u, 64u);
-			if (_loopStub == null)
-			{
-				return false;
-			}
-
-			var prologuePtr = (nint)(delegate* unmanaged<nint, nint>)&RunPrologue;
-			var epiloguePtr = (nint)(delegate* unmanaged<nint, ulong, void>)&RunEpilogue;
-			var executorHandle = GCHandle.ToIntPtr(_selfHandle);
-			nint workHandle;
-			nint doneHandle;
-			if (OperatingSystem.IsWindows())
-			{
-				workHandle = _workAvailable!.SafeWaitHandle.DangerousGetHandle();
-				doneHandle = _workCompleted!.SafeWaitHandle.DangerousGetHandle();
-			}
-			else
-			{
-				lock (PosixThunkGate)
-				{
-					if (_posixPrologueThunk == 0)
-					{
-						_posixPrologueThunk = PosixHostStubs.CreateWin64ToSysVThunk(prologuePtr);
-						_posixEpilogueThunk = PosixHostStubs.CreateWin64ToSysVThunk(epiloguePtr);
-					}
-				}
-				prologuePtr = _posixPrologueThunk;
-				epiloguePtr = _posixEpilogueThunk;
-				_workSemaphore = PosixHostStubs.CreateWorkerEvent();
-				_doneSemaphore = PosixHostStubs.CreateWorkerEvent();
-				if (_workSemaphore == 0 || _doneSemaphore == 0)
-				{
-					return false;
-				}
-				workHandle = _workSemaphore;
-				doneHandle = _doneSemaphore;
-			}
-
-			byte* code = (byte*)_loopStub;
-			int offset = 0;
-			void Emit(byte value) => code[offset++] = value;
-			void EmitMovRcxImm64(ulong value)
-			{
-				Emit(0x48); Emit(0xB9);
-				*(ulong*)(code + offset) = value;
-				offset += sizeof(ulong);
-			}
-			void EmitMovRaxImm64(ulong value)
-			{
-				Emit(0x48); Emit(0xB8);
-				*(ulong*)(code + offset) = value;
-				offset += sizeof(ulong);
-			}
-			void EmitCallRax()
-			{
-				Emit(0xFF); Emit(0xD0);
-			}
-			void EmitSetDoneEvent()
-			{
-				EmitMovRcxImm64((ulong)doneHandle);
-				EmitMovRaxImm64((ulong)_setEventAddress);
-				EmitCallRax();
-			}
-
-			// Thread entry leaves RSP ≡ 8 (mod 16); after this every call below happens
-			// at RSP ≡ 0 with shadow space available.
-			Emit(0x48); Emit(0x83); Emit(0xEC); Emit(0x28); // sub rsp, 0x28
-			int loopStart = offset;
-			EmitMovRcxImm64((ulong)workHandle);
-			Emit(0xBA);                                     // mov edx, INFINITE
-			*(uint*)(code + offset) = 0xFFFFFFFFu;
-			offset += sizeof(uint);
-			EmitMovRaxImm64((ulong)_waitForSingleObjectAddress);
-			EmitCallRax();
-			EmitMovRaxImm64((ulong)_controlBlock);
-			Emit(0x83); Emit(0x38); Emit(0x00);             // cmp dword [rax], 0
-			Emit(0x0F); Emit(0x85);                         // jne stop
-			int stopJump = offset;
-			offset += sizeof(int);
-			EmitMovRcxImm64((ulong)executorHandle);
-			EmitMovRaxImm64((ulong)prologuePtr);
-			EmitCallRax();                                  // rax = entry stub, or 0 on failure
-			Emit(0x48); Emit(0x85); Emit(0xC0);             // test rax, rax
-			Emit(0x0F); Emit(0x84);                         // je skipEntry
-			int skipJump = offset;
-			offset += sizeof(int);
-			EmitCallRax();                                  // guest entry stub -> rax
-			int skipEntryOffset = offset;
-			Emit(0x48); Emit(0x89); Emit(0xC2);             // mov rdx, rax
-			EmitMovRcxImm64((ulong)executorHandle);
-			EmitMovRaxImm64((ulong)epiloguePtr);
-			EmitCallRax();
-			EmitSetDoneEvent();
-			Emit(0xE9);                                     // jmp loop
-			*(int*)(code + offset) = loopStart - (offset + sizeof(int));
-			offset += sizeof(int);
-			int stopOffset = offset;
-			// Signal done so a Run() racing teardown cannot park forever; a stopped
-			// worker is never re-rented, so the stale signal is unobservable.
-			EmitSetDoneEvent();
-			Emit(0x31); Emit(0xC9);                         // xor ecx, ecx
-			EmitMovRaxImm64((ulong)_exitThreadAddress);
-			EmitCallRax();
-			Emit(0xCC);                                     // int3 (ExitThread never returns)
-			*(int*)(code + stopJump) = stopOffset - (stopJump + sizeof(int));
-			*(int*)(code + skipJump) = skipEntryOffset - (skipJump + sizeof(int));
-
-			uint oldProtect = 0;
-			if (!VirtualProtect(_loopStub, LoopStubSize, 32u, &oldProtect))
-			{
-				return false;
-			}
-			FlushInstructionCache(GetCurrentProcess(), _loopStub, LoopStubSize);
-			return StartWorkerThread();
-		}
-
-		private bool RestartWorkerThread()
-		{
-			if (_loopStub == null || _controlBlock == null)
-			{
-				return false;
-			}
-
-			*(int*)_controlBlock = 0;
-			return StartWorkerThread();
-		}
-
-		private bool StartWorkerThread()
-		{
-			_threadHandle = CreateThread(
-				0,
-				WorkerStackReservation,
-				(nint)_loopStub,
-				0,
-				StackSizeParamIsAReservation,
-				out _nativeThreadId);
-			if (_threadHandle == 0)
-			{
-				return false;
-			}
-			if (LogThreadMode)
-			{
-				TraceThreadMode($"worker_created native_tid={_nativeThreadId} loop=0x{(ulong)_loopStub:X16}");
-			}
-			return true;
-		}
-
-		public ulong Run(
-			CpuContext context,
-			GuestThreadState? state,
-			ulong guestThreadHandle,
-			ulong sentinelRip,
-			ulong returnSlotAddress,
-			nint hostRspSlot,
-			nint entryStub,
-			ulong affinityMask,
-			out bool yieldRequested,
-			out string? yieldReason,
-			out bool forcedExit)
-		{
-			_runContext = context;
-			_runState = state;
-			_runGuestThreadHandle = guestThreadHandle;
-			_runSentinelRip = sentinelRip;
-			_runReturnSlotAddress = returnSlotAddress;
-			_runHostRspSlot = hostRspSlot;
-			_runEntryStub = entryStub;
-			_runAffinityMask = affinityMask;
-			_runPrologueFailed = true;
-			_runYieldRequested = false;
-			_runYieldReason = null;
-			_runForcedExit = false;
-			SignalWorkAvailable();
-			WaitWorkCompleted();
-
-			// Normal path: RunEpilogue/ExitRun clears _entered before SetEvent(done).
-			// TBB abort stub SetEvent's without ExitRun — _entered stays true.
-			if (_entered)
-			{
-				var waitRc = WaitForSingleObject(_threadHandle, 500u);
-				Console.Error.WriteLine(
-					$"[LOADER][WARN] Native guest worker tid={_nativeThreadId} aborted during run; " +
-					$"wait_rc=0x{waitRc:X8} respawning");
-				Console.Error.Flush();
-				if (_runState is { } abortedState)
-				{
-					_ = GuestThreadExecution.NotifyGuestThreadAbandoned(
-						abortedState.ThreadHandle,
-						"tbb_worker_abort");
-					Volatile.Write(ref abortedState.HostThreadId, _prevHostThreadId);
-				}
-				_entered = false;
-				if (_threadHandle != 0)
-				{
-					// Abort stub parks (no ExitThread). Force-kill the parked OS
-					// thread so we can recreate the loop without process teardown.
-					if (waitRc != 0u)
-					{
-						_ = TerminateThread(_threadHandle, unchecked((uint)(-1)));
-						_ = WaitForSingleObject(_threadHandle, 1000u);
-					}
-					CloseHandle(_threadHandle);
-					_threadHandle = 0;
-					_nativeThreadId = 0;
-				}
-				if (!RestartWorkerThread())
-				{
-					_runPrologueFailed = true;
-				}
-				else
-				{
-					_runPrologueFailed = false;
-					_runForcedExit = true;
-					_runNativeResult = 0;
-				}
-			}
-
-			_runContext = null;
-			_runState = null;
-			yieldRequested = _runYieldRequested;
-			yieldReason = _runYieldReason;
-			forcedExit = _runForcedExit;
-			if (_runPrologueFailed)
-			{
-				// Never throw out of the native-worker rent path: an uncaught
-				// exception mid-TBB storm kills the process with no FailFast
-				// breadcrumb.
-				var n = Interlocked.Increment(ref _tbbWorkerPrologueFaultCount);
-				if (n <= 8 || n % 32 == 0)
-				{
-					Console.Error.WriteLine(
-						$"[LOADER][ERROR] tbb_worker prologue fault #{n}; soft-fail run " +
-						$"(tid={_nativeThreadId})");
-					Console.Error.Flush();
-				}
-
-				yieldRequested = true;
-				yieldReason = "tbb_worker_prologue_fault";
-				forcedExit = true;
-				return 0x80020012UL;
-			}
-			return _runNativeResult;
-		}
-
-		private void SignalWorkAvailable()
-		{
-			if (_workAvailable is not null)
-			{
-				_workAvailable.Set();
-				return;
-			}
-
-			_ = PosixHostStubs.SignalWorkerEvent(_workSemaphore);
-		}
-
-		private void WaitWorkCompleted()
-		{
-			if (_workCompleted is not null)
-			{
-				_workCompleted.WaitOne();
-				return;
-			}
-
-			_ = PosixHostStubs.WaitWorkerEvent(_doneSemaphore, -1);
-		}
-
-		[UnmanagedCallersOnly]
-		private static nint RunPrologue(nint executorHandle)
-		{
-			try
-			{
-				var executor = (NativeGuestExecutor)GCHandle.FromIntPtr(executorHandle).Target!;
-				return executor.EnterRun();
-			}
-			catch (Exception ex)
-			{
-				try
-				{
-					Console.Error.WriteLine(
-						$"[LOADER][ERROR] Native guest worker prologue failed: {ex.GetType().Name}: {ex.Message}");
-				}
-				catch
-				{
-				}
-				return 0;
-			}
-		}
-
-		[UnmanagedCallersOnly]
-		private static void RunEpilogue(nint executorHandle, ulong nativeResult)
-		{
-			try
-			{
-				var executor = (NativeGuestExecutor)GCHandle.FromIntPtr(executorHandle).Target!;
-				executor.ExitRun(nativeResult);
-			}
-			catch (Exception ex)
-			{
-				try
-				{
-					Console.Error.WriteLine(
-						$"[LOADER][ERROR] Native guest worker epilogue failed: {ex.GetType().Name}: {ex.Message}");
-				}
-				catch
-				{
-				}
-			}
-		}
-
-		private nint EnterRun()
-		{
-			var backend = _backend;
-			_prevBackend = _activeExecutionBackend;
-			_prevContext = _activeCpuContext;
-			_prevSentinel = _activeEntryReturnSentinelRip;
-			_prevReturnSlot = _activeGuestReturnSlotAddress;
-			_prevForcedExit = _activeForcedGuestExit;
-			_prevYieldRequested = _activeGuestThreadYieldRequested;
-			_prevYieldReason = _activeGuestThreadYieldReason;
-			_prevState = _activeGuestThreadState;
-			_prevHostRspSlot = TlsGetValue(backend._hostRspSlotTlsIndex);
-			_prevGuestThreadHandle = GuestThreadExecution.EnterGuestThread(_runGuestThreadHandle);
-			_entered = true;
-			_activeExecutionBackend = backend;
-			_activeCpuContext = _runContext;
-			_activeEntryReturnSentinelRip = _runSentinelRip;
-			_activeGuestReturnSlotAddress = _runReturnSlotAddress;
-			_activeForcedGuestExit = false;
-			_activeGuestThreadYieldRequested = false;
-			_activeGuestThreadYieldReason = null;
-			_activeGuestThreadState = _runState;
-			backend.BindTlsBase(_runContext!);
-			RouteGuestAccessFaultsToSignals();
-			TlsSetValue(backend._hostRspSlotTlsIndex, _runHostRspSlot);
-			if (backend._workerDoneEventTlsIndex != uint.MaxValue)
-			{
-				nint doneHandle = OperatingSystem.IsWindows()
-					? _workCompleted!.SafeWaitHandle.DangerousGetHandle()
-					: _doneSemaphore;
-				TlsSetValue(backend._workerDoneEventTlsIndex, doneHandle);
-			}
-			if (backend._tbbAbortEligibleTlsIndex != uint.MaxValue)
-			{
-				nint eligible = _runState is { Name: "tbb_thead" } ? 1 : 0;
-				TlsSetValue(backend._tbbAbortEligibleTlsIndex, eligible);
-			}
-			if (_runState is { } state)
-			{
-				_prevHostThreadId = Volatile.Read(ref state.HostThreadId);
-				Volatile.Write(ref state.HostThreadId, unchecked((int)GetCurrentThreadId()));
-			}
-			if (_runAffinityMask != 0)
-			{
-				backend.ApplyGuestThreadAffinity(_runAffinityMask);
-			}
-			_runPrologueFailed = false;
-			if (LogThreadMode)
-			{
-				TraceThreadMode(
-					$"worker_enter guest=0x{_runGuestThreadHandle:X16} stub=0x{(ulong)_runEntryStub:X16}");
-			}
-			return _runEntryStub;
-		}
-
-		private void ExitRun(ulong nativeResult)
-		{
-			_runNativeResult = nativeResult;
-			_runYieldRequested = _activeGuestThreadYieldRequested;
-			_runYieldReason = _activeGuestThreadYieldReason;
-			_runForcedExit = _activeForcedGuestExit;
-			if (!_entered)
-			{
-				return;
-			}
-			_entered = false;
-			if (_runState is { } state)
-			{
-				Volatile.Write(ref state.HostThreadId, _prevHostThreadId);
-			}
-			TlsSetValue(_backend._hostRspSlotTlsIndex, _prevHostRspSlot);
-			if (_backend._workerDoneEventTlsIndex != uint.MaxValue)
-			{
-				TlsSetValue(_backend._workerDoneEventTlsIndex, 0);
-			}
-			if (_backend._tbbAbortEligibleTlsIndex != uint.MaxValue)
-			{
-				TlsSetValue(_backend._tbbAbortEligibleTlsIndex, 0);
-			}
-			GuestThreadExecution.RestoreGuestThread(_prevGuestThreadHandle);
-			_activeExecutionBackend = _prevBackend;
-			_activeCpuContext = _prevContext;
-			_activeEntryReturnSentinelRip = _prevSentinel;
-			_activeGuestReturnSlotAddress = _prevReturnSlot;
-			_activeForcedGuestExit = _prevForcedExit;
-			_activeGuestThreadYieldRequested = _prevYieldRequested;
-			_activeGuestThreadYieldReason = _prevYieldReason;
-			_activeGuestThreadState = _prevState;
-			_prevBackend = null;
-			_prevContext = null;
-			_prevState = null;
-			_prevYieldReason = null;
-			if (LogThreadMode)
-			{
-				TraceThreadMode(
-					$"worker_exit guest=0x{_runGuestThreadHandle:X16} result=0x{nativeResult:X16} yield={_runYieldRequested}");
-			}
-		}
-
-		public void Dispose()
-		{
-			if (_controlBlock != null)
-			{
-				*(int*)_controlBlock = 1;
-			}
-			try
-			{
-				SignalWorkAvailable();
-			}
-			catch (ObjectDisposedException)
-			{
-			}
-			var exited = _threadHandle == 0;
-			if (_threadHandle != 0)
-			{
-				exited = WaitForSingleObject(_threadHandle, 1000u) == 0u;
-				CloseHandle(_threadHandle);
-				_threadHandle = 0;
-			}
-			if (!exited)
-			{
-				// The worker is still parked in guest code (teardown should have unwound
-				// it first). Leak the stub, control block, events and GC handle rather
-				// than have the thread execute freed memory.
-				Console.Error.WriteLine(
-					$"[LOADER][WARN] Native guest worker tid={_nativeThreadId} did not stop; leaking its run loop.");
-				return;
-			}
-			if (_loopStub != null)
-			{
-				VirtualFree(_loopStub, 0u, 32768u);
-				_loopStub = null;
-			}
-			if (_controlBlock != null)
-			{
-				VirtualFree(_controlBlock, 0u, 32768u);
-				_controlBlock = null;
-			}
-			if (_selfHandle.IsAllocated)
-			{
-				_selfHandle.Free();
-			}
-			_workAvailable?.Dispose();
-			_workCompleted?.Dispose();
-			if (_workSemaphore != 0)
-			{
-				PosixHostStubs.DestroyWorkerEvent(_workSemaphore);
-				_workSemaphore = 0;
-			}
-			if (_doneSemaphore != 0)
-			{
-				PosixHostStubs.DestroyWorkerEvent(_doneSemaphore);
-				_doneSemaphore = 0;
-			}
-		}
-	}
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.PosixSignalStack.cs

@@ -1,140 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System;
-using System.Runtime.InteropServices;
-using Iced.Intel;
-using SharpEmu.HLE;
-using static Iced.Intel.AssemblerRegisters;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-// Guest faults are delivered on the guest stack. The runtime only knows the thread's own stack,
-// so managed code that runs on the guest stack can make a garbage collection misread the frames
-// of that thread. Windows swaps the stack bounds in the TEB while guest code runs; POSIX cannot,
-// so the signal handler moves to the host stack below the frames that entered guest code first.
-public sealed unsafe partial class DirectExecutionBackend
-{
-	// Host stack below the saved host RSP that is still treated as the host frames in use.
-	private const ulong HostStackSearchBytes = 0x100_0000;
-	private const int SignalStackGap = 0x1000;
-
-	// [0] the host RSP TLS slot (uint.MaxValue while unknown), [8] the Win64 TlsGetValue stub.
-	private static nint _signalStackCells;
-
-	private static unsafe nint CreatePosixSignalTrampoline()
-	{
-		_signalStackCells = (nint)NativeMemory.AllocZeroed(16);
-		*(uint*)_signalStackCells = uint.MaxValue;
-
-		var a = new Assembler(64);
-		var direct = a.CreateLabel();
-		var call = a.CreateLabel();
-		var done = a.CreateLabel();
-		a.push(rbx);
-		a.push(r12);
-		a.push(r13);
-		a.push(r14);
-		a.push(r15);
-		a.mov(r12d, edi);
-		a.mov(r13, rsi);
-		a.mov(r14, rdx);
-		a.mov(rbx, rsp);
-
-		// The saved host RSP of this thread, when it entered guest code.
-		a.mov(rax, (ulong)_signalStackCells);
-		a.mov(ecx, __dword_ptr[rax]);
-		a.cmp(ecx, -1);
-		a.je(direct);
-		a.mov(rax, __qword_ptr[rax + 8]);
-		a.test(rax, rax);
-		a.je(direct);
-		a.sub(rsp, 48);
-		a.call(rax);
-		a.add(rsp, 48);
-		a.test(rax, rax);
-		a.je(direct);
-		a.mov(r15, __qword_ptr[rax]);
-		a.test(r15, r15);
-		a.je(direct);
-
-		// Already on the host stack below the saved RSP: an import or host code faulted.
-		a.cmp(rbx, r15);
-		a.jae(call);
-		a.mov(rax, r15);
-		a.sub(rax, rbx);
-		a.cmp(rax, (int)HostStackSearchBytes);
-		a.jb(direct);
-
-		a.Label(ref call);
-		a.lea(rsp, __[r15 - SignalStackGap]);
-		a.and(rsp, -16);
-		a.Label(ref direct);
-		a.mov(edi, r12d);
-		a.mov(rsi, r13);
-		a.mov(rdx, r14);
-		a.mov(rax, (ulong)(nint)(delegate* unmanaged<int, nint, nint, void>)&HandlePosixSignal);
-		a.call(rax);
-		a.Label(ref done);
-		a.mov(rsp, rbx);
-		a.pop(r15);
-		a.pop(r14);
-		a.pop(r13);
-		a.pop(r12);
-		a.pop(rbx);
-		a.ret();
-
-		var page = (byte*)HostMemory.Alloc(null, 4096, HostMemory.MEM_COMMIT | HostMemory.MEM_RESERVE, HostMemory.PAGE_EXECUTE_READWRITE);
-		if (page == null)
-		{
-			throw new OutOfMemoryException("Failed to allocate the POSIX signal trampoline page");
-		}
-
-		var writer = new SpanCodeWriter(new Span<byte>(page, 4096));
-		a.Assemble(writer, (ulong)page);
-		if (!HostMemory.Protect(page, 4096, HostMemory.PAGE_EXECUTE_READ, out _))
-		{
-			throw new InvalidOperationException("Failed to protect the POSIX signal trampoline page");
-		}
-
-		return (nint)page;
-	}
-
-	private unsafe void PublishSignalStackState()
-	{
-		if (_signalStackCells == 0)
-		{
-			return;
-		}
-
-		*(nint*)(_signalStackCells + 8) = _tlsGetValueAddress;
-		*(uint*)_signalStackCells = _hostRspSlotTlsIndex;
-	}
-
-	private sealed unsafe class SpanCodeWriter : CodeWriter
-	{
-		private readonly byte* _start;
-		private readonly int _length;
-		private int _offset;
-
-		public SpanCodeWriter(Span<byte> destination)
-		{
-			fixed (byte* start = destination)
-			{
-				_start = start;
-			}
-
-			_length = destination.Length;
-		}
-
-		public override void WriteByte(byte value)
-		{
-			if (_offset >= _length)
-			{
-				throw new InvalidOperationException("The POSIX signal trampoline does not fit its page.");
-			}
-
-			_start[_offset++] = value;
-		}
-	}
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.PosixSignals.cs

@@ -1,521 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System;
-using System.Runtime.InteropServices;
-using System.Threading;
-using SharpEmu.HLE;
-using SharpEmu.HLE.GpuMemory;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-public sealed unsafe partial class DirectExecutionBackend
-{
-	// POSIX bridge for the Windows vectored-exception-handler logic. A
-	// sigaction(SIGSEGV/SIGBUS/SIGILL) handler rebuilds the EXCEPTION_POINTERS
-	// view the shared handlers expect (Win64 CONTEXT register offsets) from
-	// the signal's mcontext, runs the same recovery chain the VEH path uses
-	// (unresolved-import trap sentinels, demand-paging of lazily-committed
-	// guest pages, fault diagnostics), and writes register changes back into
-	// the mcontext so sigreturn resumes the repaired guest. Unrecovered
-	// faults are forwarded to the previously installed handler so the .NET
-	// runtime keeps turning its own faults into managed exceptions.
-
-	private const int PosixSigIll = 4;
-	private const int PosixSigTrap = 5;
-	private const int PosixSigAbort = 6;
-	private const int PosixSigFpe = 8;
-	private const int PosixSigSegv = 11;
-	private static readonly int PosixSigBus = OperatingSystem.IsMacOS() ? 10 : 7;
-
-	// struct sigaction: the handler pointer leads on both platforms; Darwin
-	// packs { handler(8), mask(4), flags(4) }, Linux glibc/musl packs
-	// { handler(8), mask(128), flags(4), restorer(8) }.
-	private static readonly int PosixSigactionSize = OperatingSystem.IsMacOS() ? 16 : 152;
-	private static readonly int PosixSigactionFlagsOffset = OperatingSystem.IsMacOS() ? 12 : 136;
-
-	private static readonly int PosixSaSigInfo = OperatingSystem.IsMacOS() ? 0x0040 : 0x0004;
-	private static readonly int PosixSaNoDefer = OperatingSystem.IsMacOS() ? 0x0010 : 0x40000000;
-
-	// siginfo_t.si_addr: Darwin { signo, errno, code, pid, uid, status, addr },
-	// Linux { signo, errno, code, pad32, addr }.
-	private static readonly int PosixSigInfoAddressOffset = OperatingSystem.IsMacOS() ? 24 : 16;
-
-	// Darwin ucontext_t stores a pointer to __darwin_mcontext64 at +48; the
-	// general registers live in its __ss thread state after the 16-byte
-	// exception state. Linux glibc embeds mcontext_t inline at +40 with the
-	// registers in gregs[23]. Rosetta 2 delivers the regular x86-64 layout
-	// to translated processes.
-	private const int DarwinUcontextMcontextOffset = 48;
-	private const int DarwinUserContextMachineContextSizeOffset = 40;
-	// Darwin stores vector registers at the same offset in both signal frame formats.
-	// The system headers i386/_mcontext.h and mach/i386/_structs.h define this offset.
-	private const int DarwinMachineContextVectorRegistersOffset = 352;
-	private const int DarwinMcontextErrOffset = 4;
-	private const int DarwinMcontextFaultAddressOffset = 8;
-	private const int LinuxUcontextGregsOffset = 40;
-	private const int LinuxGregsErrOffset = 19 * 8;
-
-	// The kernel's x86-64 sigcontext places the FXSAVE-image pointer right
-	// after the general registers it hands to the handler: err(152)
-	// trapno(160) oldmask(168) cr2(176) fpstate(184), all relative to
-	// GetPosixRegisterBase. glibc and musl both overlay this kernel layout
-	// verbatim (glibc's mcontext_t.fpregs is the same slot), so the offset
-	// is libc-independent. Inside the FXSAVE image the XMM registers start
-	// at +160 (32-byte header + 8 legacy x87/MMX slots x 16 bytes) - the
-	// same relative position they occupy in the Win64 CONTEXT's FltSave
-	// area (Win64ContextXmm0Offset = 256 + 160).
-	private const int LinuxGregsFpstateOffset = 184;
-	private const int FxsaveXmmOffset = 160;
-	private const int XmmBlockSize = 16 * 16;
-
-	// Byte offsets of the general registers relative to GetPosixRegisterBase,
-	// ordered to match the contiguous Win64 CONTEXT block CTX_RAX..CTX_RIP
-	// (rax, rcx, rdx, rbx, rsp, rbp, rsi, rdi, r8..r15, rip). Verified
-	// against the x86-64 platform headers.
-	private static readonly int[] PosixRegisterOffsets = OperatingSystem.IsMacOS()
-		? new[] { 16, 32, 40, 24, 72, 64, 56, 48, 80, 88, 96, 104, 112, 120, 128, 136, 144 }
-		: new[] { 104, 112, 96, 88, 120, 80, 72, 64, 0, 8, 16, 24, 32, 40, 48, 56, 128 };
-
-	private static DirectExecutionBackend? _posixSignalBackend;
-	private static bool _posixSignalHandlersInstalled;
-	private static nint _posixSignalTrampoline;
-	private static bool _posixRawRecoveryEnabled;
-	private static bool _posixSignalWarmup;
-	private static readonly nint[] _posixPreviousActions = new nint[32];
-	private static int _posixSignalTraceCount;
-	private static long _perfSignalCount;
-	private static readonly bool _perfSignalCounter =
-		string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_PERF_MEM"), "1", StringComparison.Ordinal);
-
-	[ThreadStatic]
-	private static int _posixSignalHandlerDepth;
-
-	// True when the signal context contains the current vector register values.
-	// Copy changes back to these registers before the guest continues.
-	[ThreadStatic]
-	private static bool _posixXmmContextBridged;
-
-	private void SetupPosixExceptionHandler()
-	{
-		if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_POSIX_SIGNALS"), "1", StringComparison.Ordinal))
-		{
-			Console.Error.WriteLine("[LOADER][WARN] POSIX signal exception bridge disabled by SHARPEMU_DISABLE_POSIX_SIGNALS=1; guest faults will not be recovered.");
-			return;
-		}
-
-		_posixSignalBackend = this;
-		if (_posixSignalHandlersInstalled)
-		{
-			PublishSignalStackState();
-			return;
-		}
-
-		_posixRawRecoveryEnabled = !string.Equals(
-			Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_RAW_HANDLER"), "1", StringComparison.Ordinal);
-		if (!_posixRawRecoveryEnabled)
-		{
-			Console.Error.WriteLine("[LOADER][INFO] Raw sentinel recovery disabled by SHARPEMU_DISABLE_RAW_HANDLER=1");
-		}
-
-		WarmUpPosixSignalPath();
-		SharpEmu.HLE.GuestImageWriteTracker.WarmUp();
-
-		_posixSignalTrampoline = CreatePosixSignalTrampoline();
-		PublishSignalStackState();
-		if (!InstallPosixSignalHandler(PosixSigSegv) ||
-			!InstallPosixSignalHandler(PosixSigBus) ||
-			!InstallPosixSignalHandler(PosixSigIll) ||
-			!InstallPosixSignalHandler(PosixSigTrap) ||
-			!InstallPosixSignalHandler(PosixSigAbort) ||
-			!InstallPosixSignalHandler(PosixSigFpe))
-		{
-			throw new InvalidOperationException("Failed to install POSIX fault signal handlers");
-		}
-
-		_posixSignalHandlersInstalled = true;
-		Console.Error.WriteLine("[LOADER][INFO] POSIX signal exception bridge installed (SIGSEGV/SIGBUS/SIGILL/SIGFPE)");
-	}
-
-	/// <summary>
-	/// Runs the signal-recovery path once with fabricated inputs before the
-	/// handlers are installed. The first entry into the handler must not
-	/// require JIT compilation (a fault can interrupt arbitrary runtime
-	/// states), and under Rosetta 2 the signal trampoline cannot enter x86
-	/// code that has never been executed (and therefore never translated): a
-	/// cold handler is silently never invoked and the faulting instruction
-	/// retries forever.
-	/// </summary>
-	private void WarmUpPosixSignalPath()
-	{
-		byte* testUserContext = stackalloc byte[512];
-		new Span<byte>(testUserContext, 512).Clear();
-		byte* testMachineContext = stackalloc byte[1024];
-		new Span<byte>(testMachineContext, 1024).Clear();
-		if (OperatingSystem.IsMacOS())
-		{
-			*(byte**)(testUserContext + DarwinUcontextMcontextOffset) = testMachineContext;
-			*(ulong*)(testUserContext + DarwinUserContextMachineContextSizeOffset) = 1024;
-			// Load the Mach memory functions before the first signal uses them.
-			byte readProbe = 0;
-			_ = TryReadMacOsMemory((ulong)testMachineContext, &readProbe, 1);
-		}
-
-		_posixSignalWarmup = true;
-		try
-		{
-			((delegate* unmanaged<int, nint, nint, void>)&HandlePosixSignal)(PosixSigSegv, 0, (nint)testUserContext);
-
-			// Warm the branches the fabricated fault above skips without
-			// spamming diagnostics: the benign-exception path through
-			// VectoredHandler, the lazy-commit probe (fault address 0 bails
-			// out immediately), and the chain helper (signal 0 has no saved
-			// action and sigaction(0, ...) fails with EINVAL).
-			EXCEPTION_RECORD record = default;
-			record.ExceptionCode = DBG_PRINTEXCEPTION_C;
-			byte* contextRecord = stackalloc byte[Win64ContextSize];
-			new Span<byte>(contextRecord, Win64ContextSize).Clear();
-			EXCEPTION_POINTERS pointers;
-			pointers.ExceptionRecord = &record;
-			pointers.ContextRecord = contextRecord;
-			_ = VectoredHandler(&pointers);
-
-			record.ExceptionCode = 3221225477u;
-			record.NumberParameters = 2;
-			// 0x70000 is never guest-owned, so this walks the vmem region
-			// scan and the PRT range check, then bails out silently.
-			record.ExceptionInformation[1] = 0x70000;
-			_ = TryHandleLazyCommittedPage(&record, 0, 0);
-			ChainPreviousPosixAction(0, 0, 0);
-		}
-		finally
-		{
-			_posixSignalWarmup = false;
-		}
-	}
-
-	private static bool InstallPosixSignalHandler(int signal)
-	{
-		byte* action = stackalloc byte[PosixSigactionSize];
-		new Span<byte>(action, PosixSigactionSize).Clear();
-		*(nint*)action = _posixSignalTrampoline;
-		// No SA_ONSTACK: the runtime's alternate stacks are far too small for
-		// the recovery/diagnostic path (JIT compilation of cold handler code
-		// can run inside the signal frame). Guest faults deliver onto the 2MB
-		// guest stack, host faults onto the regular thread stack — the same
-		// stacks Windows dispatches exceptions on.
-		*(int*)(action + PosixSigactionFlagsOffset) = PosixSaSigInfo | PosixSaNoDefer;
-
-		var previous = (byte*)NativeMemory.AllocZeroed((nuint)PosixSigactionSize);
-		if (sigaction(signal, action, previous) != 0)
-		{
-			NativeMemory.Free(previous);
-			Console.Error.WriteLine($"[LOADER][ERROR] sigaction({signal}) failed: errno={Marshal.GetLastPInvokeError()}");
-			return false;
-		}
-
-		_posixPreviousActions[signal] = (nint)previous;
-		return true;
-	}
-
-	[UnmanagedCallersOnly]
-	private static void HandlePosixSignal(int signal, nint siginfo, nint ucontext)
-	{
-		if (_posixSignalHandlerDepth > 0)
-		{
-			// A fault inside our own fault handler (diagnostics touched an
-			// unmapped address): restore the default action and return so the
-			// re-executed instruction terminates the process.
-			RestoreDefaultPosixAction(signal);
-			return;
-		}
-
-		_posixSignalHandlerDepth++;
-		if (_perfSignalCounter)
-		{
-			var n = Interlocked.Increment(ref _perfSignalCount);
-			if (n % 100000 == 0)
-			{
-				Console.Error.WriteLine($"[PERF][MEM] posix_faults={n}");
-			}
-		}
-		try
-		{
-			// Guest-image write tracking runs first: it only needs the fault
-			// address (safe for host and guest threads alike) and must resume
-			// the faulting write immediately after restoring write access.
-			if (signal != PosixSigIll &&
-				signal != PosixSigFpe &&
-				siginfo != 0 &&
-				SharpEmu.HLE.GuestImageWriteTracker.TryHandleWriteFault(
-					*(ulong*)((byte*)siginfo + PosixSigInfoAddressOffset)))
-			{
-				return;
-			}
-
-			// GPU-tracked pages fault on every first CPU access after the GPU or an upload used them,
-			// thousands of times a second in a frame. Resolving them needs only the address and the
-			// access kind, so they skip the Win64 context conversion and the other handlers.
-			if (PosixGpuFaultFastPath && !_posixSignalWarmup &&
-				(signal == PosixSigSegv || signal == PosixSigBus) &&
-				siginfo != 0 &&
-				TryResolvePosixGpuFault(siginfo, ucontext))
-			{
-				return;
-			}
-
-			if (TryHandlePosixFault(signal, siginfo, ucontext))
-			{
-				return;
-			}
-		}
-		catch
-		{
-			// A managed exception must never unwind out of a signal frame.
-		}
-		finally
-		{
-			_posixSignalHandlerDepth--;
-		}
-
-		ChainPreviousPosixAction(signal, siginfo, ucontext);
-	}
-
-	private static readonly bool PosixGpuFaultFastPath =
-		Environment.GetEnvironmentVariable("SHARPEMU_POSIX_GPU_FAULT_FAST_PATH") != "0";
-
-	private static bool TryResolvePosixGpuFault(nint siginfo, nint ucontext)
-	{
-		byte* registers = GetPosixRegisterBase(ucontext);
-		if (registers == null)
-		{
-			return false;
-		}
-
-		ulong faultAddress = GetPosixFaultAddress(siginfo, registers);
-		ulong rip = *(ulong*)(registers + PosixRegisterOffsets[16]);
-		var kind = GetPosixAccessType(registers, faultAddress, rip) switch
-		{
-			0 => FaultKind.Read,
-			1 => FaultKind.Write,
-			_ => FaultKind.Unknown,
-		};
-		return kind != FaultKind.Unknown && GuestGpuMemoryHook.TryResolveFault(kind, faultAddress);
-	}
-
-	private static bool TryHandlePosixFault(int signal, nint siginfo, nint ucontext)
-	{
-		byte* registers = GetPosixRegisterBase(ucontext);
-		if (registers == null)
-		{
-			return false;
-		}
-
-		byte* contextRecord = stackalloc byte[Win64ContextSize];
-		new Span<byte>(contextRecord, Win64ContextSize).Clear();
-		int[] offsets = PosixRegisterOffsets;
-		for (int i = 0; i < offsets.Length; i++)
-		{
-			WriteCtxU64(contextRecord, CTX_RAX + i * 8, *(ulong*)(registers + offsets[i]));
-		}
-
-		// Copy the vector registers that instruction recovery can change.
-		// Keep all other floating-point state unchanged.
-		byte* vectorRegisters = GetSignalVectorRegisterAddress(ucontext, registers);
-		if (vectorRegisters != null)
-		{
-			Buffer.MemoryCopy(
-				vectorRegisters,
-				contextRecord + Win64ContextXmm0Offset,
-				XmmBlockSize,
-				XmmBlockSize);
-		}
-		_posixXmmContextBridged = vectorRegisters != null;
-
-		EXCEPTION_RECORD record = default;
-		record.ExceptionAddress = (void*)ReadCtxU64(contextRecord, CTX_RIP);
-		if (signal == PosixSigIll)
-		{
-			record.ExceptionCode = 3221225501u;
-		}
-		else if (signal == PosixSigTrap)
-		{
-			record.ExceptionCode = 2147483651u;
-		}
-		else if (signal == PosixSigAbort)
-		{
-			record.ExceptionCode = 1073741845u;
-		}
-		else if (signal == PosixSigFpe)
-		{
-			// STATUS_INTEGER_DIVIDE_BY_ZERO: #DE from div/idiv (zero divisor or quotient overflow).
-			record.ExceptionCode = 3221225620u;
-		}
-		else
-		{
-			ulong faultAddress = GetPosixFaultAddress(siginfo, registers);
-			record.ExceptionCode = 3221225477u;
-			record.NumberParameters = 2;
-			record.ExceptionInformation[0] = GetPosixAccessType(registers, faultAddress, ReadCtxU64(contextRecord, CTX_RIP));
-			record.ExceptionInformation[1] = faultAddress;
-		}
-
-		EXCEPTION_POINTERS pointers;
-		pointers.ExceptionRecord = &record;
-		pointers.ContextRecord = contextRecord;
-
-		int traceIndex = _posixSignalWarmup ? 0 : Interlocked.Increment(ref _posixSignalTraceCount);
-		bool traceSignal = traceIndex > 0 && (traceIndex <= 16 || traceIndex % 1024 == 0 ||
-			string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_POSIX_SIGNALS"), "1", StringComparison.Ordinal));
-		if (traceSignal)
-		{
-			Console.Error.WriteLine(
-				$"[LOADER][TRACE] posix-signal#{traceIndex}: sig={signal} rip=0x{ReadCtxU64(contextRecord, CTX_RIP):X16} " +
-				$"fault=0x{record.ExceptionInformation[1]:X16} access={record.ExceptionInformation[0]} rsp=0x{ReadCtxU64(contextRecord, CTX_RSP):X16}");
-			Console.Error.Flush();
-		}
-
-		// Sentinel recovery runs first: on Windows both vectored handlers see
-		// every fault anyway, and recovering here avoids dumping the full
-		// VectoredHandler diagnostics for each recoverable trap.
-		int disposition = 0;
-		if (_posixRawRecoveryEnabled)
-		{
-			disposition = TryRecoverUnresolvedSentinel(&pointers);
-		}
-		if (disposition != -1 && !_posixSignalWarmup && _posixSignalBackend is { } backend)
-		{
-			disposition = backend.VectoredHandler(&pointers);
-		}
-		if (traceSignal)
-		{
-			Console.Error.WriteLine(
-				$"[LOADER][TRACE] posix-signal#{traceIndex}: recovered={disposition == -1} new_rip=0x{ReadCtxU64(contextRecord, CTX_RIP):X16}");
-			Console.Error.Flush();
-		}
-		if (disposition != -1 && !_posixSignalWarmup)
-		{
-			return false;
-		}
-
-		for (int i = 0; i < offsets.Length; i++)
-		{
-			*(ulong*)(registers + offsets[i]) = ReadCtxU64(contextRecord, CTX_RAX + i * 8);
-		}
-		if (vectorRegisters != null)
-		{
-			Buffer.MemoryCopy(
-				contextRecord + Win64ContextXmm0Offset,
-				vectorRegisters,
-				XmmBlockSize,
-				XmmBlockSize);
-		}
-		return true;
-	}
-
-	private static byte* GetSignalVectorRegisterAddress(nint userContextAddress, byte* machineContext)
-	{
-		if (OperatingSystem.IsMacOS())
-		{
-			var machineContextSize = *(ulong*)((byte*)userContextAddress + DarwinUserContextMachineContextSizeOffset);
-			return machineContextSize >= DarwinMachineContextVectorRegistersOffset + XmmBlockSize
-				? machineContext + DarwinMachineContextVectorRegistersOffset
-				: null;
-		}
-
-		if (OperatingSystem.IsLinux())
-		{
-			byte* floatingPointState = *(byte**)(machineContext + LinuxGregsFpstateOffset);
-			return floatingPointState != null ? floatingPointState + FxsaveXmmOffset : null;
-		}
-
-		return null;
-	}
-
-	private static byte* GetPosixRegisterBase(nint ucontext)
-	{
-		if (ucontext == 0)
-		{
-			return null;
-		}
-
-		if (OperatingSystem.IsMacOS())
-		{
-			return *(byte**)((byte*)ucontext + DarwinUcontextMcontextOffset);
-		}
-
-		return (byte*)ucontext + LinuxUcontextGregsOffset;
-	}
-
-	private static ulong GetPosixFaultAddress(nint siginfo, byte* registers)
-	{
-		ulong address = siginfo != 0 ? *(ulong*)((byte*)siginfo + PosixSigInfoAddressOffset) : 0;
-		if (address == 0 && OperatingSystem.IsMacOS())
-		{
-			address = *(ulong*)(registers + DarwinMcontextFaultAddressOffset);
-		}
-
-		return address;
-	}
-
-	private static ulong GetPosixAccessType(byte* registers, ulong faultAddress, ulong rip)
-	{
-		// x86 page-fault error code: bit 1 = write access, bit 4 = instruction
-		// fetch. Fall back to comparing the fault address against RIP when
-		// the error code is not populated (e.g. under Rosetta 2 translation).
-		ulong error = OperatingSystem.IsMacOS()
-			? *(uint*)(registers + DarwinMcontextErrOffset)
-			: *(ulong*)(registers + LinuxGregsErrOffset);
-		if ((error & 0x10) != 0)
-		{
-			return 8;
-		}
-		if ((error & 0x2) != 0)
-		{
-			return 1;
-		}
-
-		return faultAddress != 0 && faultAddress == rip ? 8u : 0u;
-	}
-
-	private static void RestoreDefaultPosixAction(int signal)
-	{
-		byte* action = stackalloc byte[PosixSigactionSize];
-		new Span<byte>(action, PosixSigactionSize).Clear();
-		_ = sigaction(signal, action, null);
-	}
-
-	private static void ChainPreviousPosixAction(int signal, nint siginfo, nint ucontext)
-	{
-		byte* previous = (uint)signal < (uint)_posixPreviousActions.Length
-			? (byte*)_posixPreviousActions[signal]
-			: null;
-		nint handler = previous != null ? *(nint*)previous : 0;
-		if (handler == 0)
-		{
-			// SIG_DFL (or nothing saved): reinstate the default action and
-			// return, so re-executing the faulting instruction terminates the
-			// process with the original fault context intact.
-			RestoreDefaultPosixAction(signal);
-			return;
-		}
-		if (handler == 1)
-		{
-			// SIG_IGN
-			return;
-		}
-
-		int flags = *(int*)(previous + PosixSigactionFlagsOffset);
-		if ((flags & PosixSaSigInfo) != 0)
-		{
-			((delegate* unmanaged<int, nint, nint, void>)handler)(signal, siginfo, ucontext);
-		}
-		else
-		{
-			((delegate* unmanaged<int, void>)handler)(signal);
-		}
-	}
-
-	[DllImport("libc", SetLastError = true)]
-	private static extern int sigaction(int signum, void* act, void* oldact);
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.ShaCompat.cs

@@ -1,107 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Buffers.Binary;
-using System.Threading;
-using Iced.Intel;
-using SharpEmu.Core.Cpu.Emulation;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-// The PS5 CPU has the SHA extensions and titles use them without a CPUID check.
-// Rosetta 2 does not translate them, so they raise #UD on Apple Silicon hosts.
-public sealed partial class DirectExecutionBackend
-{
-    private static int _shaSoftwareFallbackAnnounced;
-    private static long _shaInstructionsEmulated;
-
-    private unsafe bool TryRecoverShaInstruction(void* contextRecord, ulong rip)
-    {
-        if (!OperatingSystem.IsWindows() && !_posixXmmContextBridged ||
-            !TryReadFaultingInstruction(rip, out var instruction))
-        {
-            return false;
-        }
-
-        switch (instruction.Mnemonic)
-        {
-            case Mnemonic.Sha1rnds4:
-            case Mnemonic.Sha1nexte:
-            case Mnemonic.Sha1msg1:
-            case Mnemonic.Sha1msg2:
-            case Mnemonic.Sha256rnds2:
-            case Mnemonic.Sha256msg1:
-            case Mnemonic.Sha256msg2:
-                break;
-            default:
-                return false;
-        }
-
-        if (instruction.GetOpKind(0) != OpKind.Register ||
-            !TryGetXmmOffset(instruction.GetOpRegister(0), out var destOffset) ||
-            !TryReadXmmOperand(contextRecord, in instruction, 1, out var source2))
-        {
-            return false;
-        }
-
-        var source1 = ReadCtxXmm(contextRecord, destOffset);
-        var result = instruction.Mnemonic switch
-        {
-            Mnemonic.Sha1rnds4 => ShaInstructionEmulator.Sha1Rnds4(source1, source2, instruction.Immediate8),
-            Mnemonic.Sha1nexte => ShaInstructionEmulator.Sha1Nexte(source1, source2),
-            Mnemonic.Sha1msg1 => ShaInstructionEmulator.Sha1Msg1(source1, source2),
-            Mnemonic.Sha1msg2 => ShaInstructionEmulator.Sha1Msg2(source1, source2),
-            Mnemonic.Sha256rnds2 => ShaInstructionEmulator.Sha256Rnds2(
-                source1, source2, ReadCtxXmm(contextRecord, Win64ContextXmm0Offset)),
-            Mnemonic.Sha256msg1 => ShaInstructionEmulator.Sha256Msg1(source1, source2),
-            _ => ShaInstructionEmulator.Sha256Msg2(source1, source2),
-        };
-
-        WriteCtxU64(contextRecord, destOffset, (ulong)result);
-        WriteCtxU64(contextRecord, destOffset + 8, (ulong)(result >> 64));
-        WriteCtxU64(contextRecord, CTX_RIP, rip + (ulong)instruction.Length);
-
-        Interlocked.Increment(ref _shaInstructionsEmulated);
-        if (Interlocked.Exchange(ref _shaSoftwareFallbackAnnounced, 1) == 0)
-        {
-            Console.Error.WriteLine(
-                "[LOADER][INFO] Host lacks the SHA extensions used by the guest; " +
-                "emulating those instructions in software.");
-        }
-
-        return true;
-    }
-
-    private unsafe bool TryReadXmmOperand(void* contextRecord, in Instruction instruction, int operandIndex, out UInt128 value)
-    {
-        value = 0;
-        switch (instruction.GetOpKind(operandIndex))
-        {
-            case OpKind.Register:
-                if (!TryGetXmmOffset(instruction.GetOpRegister(operandIndex), out var offset))
-                {
-                    return false;
-                }
-
-                value = ReadCtxXmm(contextRecord, offset);
-                return true;
-
-            case OpKind.Memory:
-                var buffer = new byte[16];
-                if (!TryComputeMemoryAddress(contextRecord, in instruction, out var address) ||
-                    !TryReadHostBytes(address, buffer))
-                {
-                    return false;
-                }
-
-                value = BinaryPrimitives.ReadUInt128LittleEndian(buffer);
-                return true;
-
-            default:
-                return false;
-        }
-    }
-
-    private static unsafe UInt128 ReadCtxXmm(void* contextRecord, int offset) =>
-        new(ReadCtxU64(contextRecord, offset + 8), ReadCtxU64(contextRecord, offset));
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.StackBounds.cs

@@ -1,206 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Runtime.InteropServices;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-public sealed partial class DirectExecutionBackend
-{
-    private const int HostStackStateBytes = 3 * sizeof(ulong);
-
-    internal static unsafe bool TryGetGuestStackBounds(ulong stackPointer, out ulong bottom, out ulong top)
-    {
-        if (OperatingSystem.IsWindows() &&
-            QueryVirtualMemoryInformation(-1, (void*)stackPointer, 0, out var allocation,
-                (nuint)sizeof(StackMemoryRegionInformation), null) != 0 &&
-            ((allocation.Flags & 1) == 0 || allocation.CommitSize == allocation.RegionSize) &&
-            allocation.RegionSize != 0 && allocation.RegionSize <= ulong.MaxValue - allocation.AllocationBase &&
-            stackPointer >= allocation.AllocationBase && stackPointer - allocation.AllocationBase < allocation.RegionSize)
-        {
-            bottom = allocation.AllocationBase;
-            top = bottom + allocation.RegionSize;
-            return true;
-        }
-
-        bottom = top = 0;
-        var queried = VirtualQuery((void*)stackPointer, out var region, (nuint)sizeof(MEMORY_BASIC_INFORMATION64));
-        if (queried == 0 ||
-            region.State != 0x1000 || region.RegionSize == 0 || region.RegionSize > ulong.MaxValue - region.BaseAddress)
-        {
-            return false;
-        }
-
-        bottom = region.BaseAddress;
-        top = region.BaseAddress + region.RegionSize;
-        return stackPointer >= bottom && stackPointer < top;
-    }
-
-    private static unsafe void EmitStackBound(byte* code, ref int offset, byte register, uint field, bool store)
-    {
-        EmitByte(code, ref offset, 0x65);
-        EmitByte(code, ref offset, (byte)(0x48 | (register >= 8 ? 4 : 0)));
-        EmitByte(code, ref offset, store ? (byte)0x89 : (byte)0x8B);
-        EmitByte(code, ref offset, (byte)(0x04 | ((register & 7) << 3)));
-        EmitByte(code, ref offset, 0x25);
-        EmitUInt32(code, ref offset, field);
-    }
-
-    // Fiber switches replace the guest stack without passing through a guest-entry stub, so the
-    // context-transfer stub keeps the Windows TEB bounds in sync from the target state in R11
-    // (stack top at +160, bottom at +168). Only Windows keeps stack bounds at gs:[8]/gs:[16]: on
-    // macOS gs addresses the pthread TSD, where those slots hold errno's address and another key.
-    // Writing a fiber's bounds there nulled errno, and the next failed libc call on the thread
-    // crashed reading it (Demon's Souls, about 10 s into boot).
-    private static unsafe void EmitFiberStackBounds(byte* code, ref int offset)
-    {
-        if (!OperatingSystem.IsWindows()) return;
-        ReadOnlySpan<byte> loadTop = [0x4D, 0x8B, 0x93, 160, 0, 0, 0];     // mov r10, [r11+160]
-        foreach (var value in loadTop) EmitByte(code, ref offset, value);
-        EmitStackBound(code, ref offset, 10, 8, store: true);
-        ReadOnlySpan<byte> loadBottom = [0x4D, 0x8B, 0x93, 168, 0, 0, 0];  // mov r10, [r11+168]
-        foreach (var value in loadBottom) EmitByte(code, ref offset, value);
-        EmitStackBound(code, ref offset, 10, 16, store: true);
-    }
-
-    // Test hook: the bytes the fiber stack-bounds sync emits on this host.
-    internal static unsafe byte[] EmitFiberStackBoundsForTest()
-    {
-        var buffer = new byte[64];
-        var offset = 0;
-        fixed (byte* code = buffer)
-        {
-            EmitFiberStackBounds(code, ref offset);
-        }
-
-        return buffer[..offset];
-    }
-
-    // R10 points to the entry state. R11 is scratch; RAX remains unchanged.
-    private static unsafe void EmitHostStackBounds(byte* code, ref int offset, bool save)
-    {
-        if (!OperatingSystem.IsWindows()) return;
-        for (byte field = 8; field <= 16; field += 8)
-        {
-            if (save) EmitStackBound(code, ref offset, 11, field, store: false);
-            EmitByte(code, ref offset, 0x4D);
-            EmitByte(code, ref offset, save ? (byte)0x89 : (byte)0x8B);
-            EmitByte(code, ref offset, 0x5A);
-            EmitByte(code, ref offset, field);
-            if (!save) EmitStackBound(code, ref offset, 11, field, store: true);
-        }
-    }
-
-    private static unsafe void EmitGuestStackBounds(byte* code, ref int offset, ulong stackPointer)
-    {
-        if (!OperatingSystem.IsWindows()) return;
-        if (!TryGetGuestStackBounds(stackPointer, out var bottom, out var top))
-        {
-            throw new InvalidOperationException("Guest stack has no committed host mapping.");
-        }
-
-        EmitHostStackBounds(code, ref offset, save: true);
-        for (uint field = 8; field <= 16; field += 8)
-        {
-            EmitByte(code, ref offset, 0x49);
-            EmitByte(code, ref offset, 0xBB);
-            *(ulong*)(code + offset) = field == 8 ? top : bottom;
-            offset += sizeof(ulong);
-            EmitStackBound(code, ref offset, 11, field, store: true);
-        }
-    }
-
-    private static unsafe void EmitSavedStackBounds(byte* code, ref int offset, bool restore)
-    {
-        if (!OperatingSystem.IsWindows()) return;
-        EmitStackBound(code, ref offset, 14, 8, restore);
-        EmitStackBound(code, ref offset, 15, 16, restore);
-    }
-
-    private unsafe void EmitExceptionHostStackBounds(byte* code, ref int offset)
-    {
-        EmitSavedStackBounds(code, ref offset, restore: false);
-        ReadOnlySpan<byte> reserve = [0x48, 0x83, 0xEC, 0x28, 0xB9];
-        foreach (var value in reserve) EmitByte(code, ref offset, value);
-        EmitUInt32(code, ref offset, _hostRspSlotTlsIndex);
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
-        *(nint*)(code + offset) = _tlsGetValueAddress;
-        offset += sizeof(nint);
-        ReadOnlySpan<byte> lookup = [0xFF, 0xD0, 0x48, 0x83, 0xC4, 0x28, 0x48, 0x85, 0xC0, 0x0F, 0x84];
-        foreach (var value in lookup) EmitByte(code, ref offset, value);
-        var missingState = offset;
-        EmitUInt32(code, ref offset, 0);
-        // The state is zeroed at allocation; bounds the entry stub has not saved yet stay untouched.
-        ReadOnlySpan<byte> unsaved = [0x48, 0x83, 0x78, 0x08, 0x00, 0x0F, 0x84];
-        foreach (var value in unsaved) EmitByte(code, ref offset, value);
-        var missingBounds = offset;
-        EmitUInt32(code, ref offset, 0);
-        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xC2);
-        // A host fault already has live bounds. Do not replace a grown limit with an old one.
-        ReadOnlySpan<byte> sameStack = [0x4C, 0x3B, 0x70, 0x08, 0x0F, 0x85];
-        foreach (var value in sameStack) EmitByte(code, ref offset, value);
-        var guestStack = offset;
-        EmitUInt32(code, ref offset, 0);
-        EmitHostStackBounds(code, ref offset, save: true);
-        EmitByte(code, ref offset, 0xE9);
-        var hostStack = offset;
-        EmitUInt32(code, ref offset, 0);
-        *(int*)(code + guestStack) = offset - guestStack - sizeof(int);
-        EmitHostStackBounds(code, ref offset, save: false);
-        *(int*)(code + hostStack) = offset - hostStack - sizeof(int);
-        *(int*)(code + missingState) = offset - missingState - sizeof(int);
-        *(int*)(code + missingBounds) = offset - missingBounds - sizeof(int);
-    }
-
-    [UnmanagedCallersOnly]
-    private static unsafe int SelectExceptionStackBounds(void* exceptionInfo, int disposition, ulong* bounds)
-    {
-        if (disposition != -1) return disposition;
-        var context = ((EXCEPTION_POINTERS*)exceptionInfo)->ContextRecord;
-        if (context == null) return 0;
-        var stackPointer = ReadCtxU64(context, 152);
-        if (stackPointer >= bounds[1] && stackPointer < bounds[0]) return disposition;
-
-        GetCurrentThreadStackLimits(out var nativeBottom, out var nativeTop);
-        if (stackPointer >= nativeBottom && stackPointer < nativeTop)
-        {
-            bounds[0] = nativeTop;
-            bounds[1] = nativeBottom;
-            return disposition;
-        }
-
-        if (!TryGetGuestStackBounds(stackPointer, out var bottom, out var top)) return 0;
-        bounds[0] = top;
-        bounds[1] = bottom;
-        return disposition;
-    }
-
-    private static unsafe void EmitExceptionStackSelection(byte* code, ref int offset)
-    {
-        // The caller reserves 72 bytes: ABI home space and two stack bounds.
-        ReadOnlySpan<byte> arguments = [0x4C, 0x89, 0x74, 0x24, 0x28, 0x4C, 0x89, 0x7C, 0x24, 0x30,
-            0x89, 0xC2, 0x4C, 0x89, 0xE9, 0x4C, 0x8D, 0x44, 0x24, 0x28, 0x48, 0xB8];
-        foreach (var value in arguments) EmitByte(code, ref offset, value);
-        *(nint*)(code + offset) = (nint)(delegate* unmanaged<void*, int, ulong*, int>)&SelectExceptionStackBounds;
-        offset += sizeof(nint);
-        ReadOnlySpan<byte> result = [0xFF, 0xD0, 0x4C, 0x8B, 0x74, 0x24, 0x28, 0x4C, 0x8B, 0x7C, 0x24, 0x30];
-        foreach (var value in result) EmitByte(code, ref offset, value);
-    }
-
-    [DllImport("kernel32.dll", ExactSpelling = true)]
-    private static extern void GetCurrentThreadStackLimits(out ulong lowLimit, out ulong highLimit);
-
-    [StructLayout(LayoutKind.Sequential)]
-    private struct StackMemoryRegionInformation
-    {
-        public ulong AllocationBase;
-        public uint AllocationProtect;
-        public uint Flags;
-        public ulong RegionSize;
-        public ulong CommitSize;
-    }
-
-    [DllImport("api-ms-win-core-memory-l1-1-4.dll", ExactSpelling = true)]
-    private static extern unsafe int QueryVirtualMemoryInformation(nint process, void* address, int informationClass,
-        out StackMemoryRegionInformation information, nuint informationSize, nuint* returnSize);
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.StallDiagnostics.cs

@@ -1,182 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Diagnostics;
-using System.ComponentModel;
-using System.Runtime.InteropServices;
-using Microsoft.Win32.SafeHandles;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-public sealed unsafe partial class DirectExecutionBackend
-{
-    private SafeWaitHandle? _mainExecutionThreadHandle;
-    // One immutable code page serves all diagnostic samples for the process lifetime.
-    private static readonly Lazy<ThreadContextCaptureCode> ThreadCaptureCode = new(() => new());
-
-    private sealed class ThreadContextCaptureCode : SafeHandle
-    {
-        public override bool IsInvalid => handle == 0;
-
-        public ThreadContextCaptureCode() : base(0, ownsHandle: true)
-        {
-            var kernelModule = GetModuleHandle("kernel32.dll");
-            var suspendAddress = GetProcAddress(kernelModule, "SuspendThread");
-            var contextAddress = GetProcAddress(kernelModule, "GetThreadContext");
-            var resumeAddress = GetProcAddress(kernelModule, "ResumeThread");
-            if (suspendAddress == 0 || contextAddress == 0 || resumeAddress == 0) return;
-            var instructions = BuildThreadContextCaptureCode(suspendAddress, contextAddress, resumeAddress);
-            SetHandle((nint)VirtualAlloc(null, (nuint)instructions.Length, 0x3000, 0x04));
-            if (IsInvalid) return;
-            instructions.CopyTo(new Span<byte>((void*)handle, instructions.Length));
-            uint previousProtection = 0;
-            if (!VirtualProtect((void*)handle, (nuint)instructions.Length, 0x20, &previousProtection))
-            {
-                Dispose();
-                return;
-            }
-            FlushInstructionCache(GetCurrentProcess(), (void*)handle, (nuint)instructions.Length);
-        }
-
-        protected override bool ReleaseHandle() => VirtualFree((void*)handle, 0, 0x8000);
-    }
-
-    private static SafeWaitHandle? OpenThreadForContext(uint threadId)
-    {
-        if (!OperatingSystem.IsWindows() || RuntimeInformation.ProcessArchitecture != Architecture.X64 || threadId == 0)
-            return null;
-
-        const uint queryLimitedInformation = 0x0800;
-        var threadHandle = OpenThread(ThreadGetContext | ThreadSuspendResume | queryLimitedInformation, false, threadId);
-        return threadHandle == 0 ? null : new SafeWaitHandle(threadHandle, ownsHandle: true);
-    }
-
-    private static bool TryCaptureHostThreadContext(int threadId, out HostThreadContextSnapshot snapshot)
-    {
-        using var threadHandle = OpenThreadForContext(unchecked((uint)threadId));
-        return TryCaptureThreadContext(threadHandle, out snapshot);
-    }
-
-    private static bool TryCaptureThreadContext(SafeWaitHandle? threadHandle, out HostThreadContextSnapshot snapshot)
-    {
-        snapshot = default;
-        if (threadHandle is null || !OperatingSystem.IsWindows() || RuntimeInformation.ProcessArchitecture != Architecture.X64)
-            return false;
-
-        var handleReferenced = false;
-        try
-        {
-            threadHandle.DangerousAddRef(ref handleReferenced);
-            var nativeHandle = threadHandle.DangerousGetHandle();
-            var threadId = GetThreadId(nativeHandle);
-            if (threadId == 0 || threadId == GetCurrentThreadId()) return false;
-
-            var captureCode = ThreadCaptureCode.Value;
-            if (captureCode.IsInvalid || captureCode.IsClosed) return false;
-
-            byte* contextStorage = stackalloc byte[Win64ContextSize + 15];
-            var contextRecord = (void*)(((nuint)contextStorage + 15) & ~(nuint)15);
-            new Span<byte>(contextRecord, Win64ContextSize).Clear();
-            WriteCtxU32(contextRecord, Win64ContextFlagsOffset, ContextAmd64ControlInteger);
-
-            // One native transition keeps managed work outside the suspended interval.
-            var captured = ((delegate* unmanaged<nint, void*, int>)captureCode.DangerousGetHandle())(nativeHandle, contextRecord);
-            if (captured == 0) return false;
-            snapshot = DecodeHostThreadContext(threadId, contextRecord);
-            return true;
-        }
-        catch (ObjectDisposedException)
-        {
-            return false;
-        }
-        finally
-        {
-            if (handleReferenced) threadHandle!.DangerousRelease();
-        }
-    }
-
-    private static HostThreadContextSnapshot DecodeHostThreadContext(uint threadId, void* contextRecord) => new(
-        threadId,
-        ReadCtxU64(contextRecord, 248), ReadCtxU64(contextRecord, 152), ReadCtxU64(contextRecord, 160),
-        ReadCtxU64(contextRecord, 120), ReadCtxU64(contextRecord, 144), ReadCtxU64(contextRecord, 128),
-        ReadCtxU64(contextRecord, 136), ReadCtxU64(contextRecord, 168), ReadCtxU64(contextRecord, 176),
-        ReadCtxU64(contextRecord, 184), ReadCtxU64(contextRecord, 192), ReadCtxU64(contextRecord, 200),
-        ReadCtxU64(contextRecord, 208), ReadCtxU64(contextRecord, 216), ReadCtxU64(contextRecord, 224),
-        ReadCtxU64(contextRecord, 232), ReadCtxU64(contextRecord, 240));
-
-    internal static byte[] BuildThreadContextCaptureCode(nint suspendAddress, nint contextAddress, nint resumeAddress)
-    {
-        var instructions = new List<byte>();
-        void CallAddress(nint address)
-        {
-            instructions.AddRange([0x48, 0xB8]);
-            instructions.AddRange(BitConverter.GetBytes((long)address));
-            instructions.AddRange([0xFF, 0xD0]);
-        }
-
-        // Preserve nonvolatile registers and reserve aligned argument space.
-        instructions.AddRange([0x53, 0x56, 0x57, 0x48, 0x83, 0xEC, 0x20,
-            0x48, 0x89, 0xCB, 0x48, 0x89, 0xD6, 0x31, 0xFF]);
-        CallAddress(suspendAddress);
-        instructions.AddRange([0x83, 0xF8, 0xFF, 0x74, 0]);
-        var failedSuspendJump = instructions.Count - 1;
-        instructions.AddRange([0x48, 0x89, 0xD9, 0x48, 0x89, 0xF2]);
-        CallAddress(contextAddress);
-        instructions.AddRange([0x89, 0xC7, 0x48, 0x89, 0xD9]);
-        CallAddress(resumeAddress);
-        instructions.AddRange([0x83, 0xF8, 0xFF, 0x75, 0x02, 0x31, 0xFF]);
-        var returnOffset = instructions.Count;
-        instructions.AddRange([0x89, 0xF8, 0x48, 0x83, 0xC4, 0x20, 0x5F, 0x5E, 0x5B, 0xC3]);
-        instructions[failedSuspendJump] = checked((byte)(returnOffset - failedSuspendJump - 1));
-        return instructions.ToArray();
-    }
-
-    private void LogMainThreadStallContext()
-    {
-        if (!TryCaptureThreadContext(Volatile.Read(ref _mainExecutionThreadHandle), out var context)) return;
-
-        Console.Error.WriteLine($"[LOADER][ERROR] Live hardware context (main thread {context.ThreadId}):");
-        Console.Error.WriteLine($"[LOADER][ERROR]   RIP=0x{context.Rip:X16} RSP=0x{context.Rsp:X16} RBP=0x{context.Rbp:X16}");
-        Console.Error.WriteLine($"[LOADER][ERROR]   RAX=0x{context.Rax:X16} RBX=0x{context.Rbx:X16} RCX=0x{context.Rcx:X16} RDX=0x{context.Rdx:X16}");
-        Console.Error.WriteLine($"[LOADER][ERROR]   RSI=0x{context.Rsi:X16} RDI=0x{context.Rdi:X16} R8=0x{context.R8:X16} R9=0x{context.R9:X16}");
-        Console.Error.WriteLine($"[LOADER][ERROR]   R10=0x{context.R10:X16} R11=0x{context.R11:X16} R12=0x{context.R12:X16} R13=0x{context.R13:X16} R14=0x{context.R14:X16} R15=0x{context.R15:X16}");
-
-        var modules = Array.Empty<(ulong Start, ulong Size, string Name)>();
-        try
-        {
-            using var process = Process.GetCurrentProcess();
-            modules = process.Modules.Cast<ProcessModule>().Select(module =>
-                (Start: unchecked((ulong)module.BaseAddress), Size: (ulong)module.ModuleMemorySize, Name: module.ModuleName)).ToArray();
-        }
-        catch (Win32Exception) { }
-        catch (InvalidOperationException) { }
-        string DescribeAddress(ulong address)
-        {
-            foreach (var module in modules)
-                if (address >= module.Start && address - module.Start < module.Size)
-                    return $"{module.Name}+0x{address - module.Start:X}";
-            return $"0x{address:X16}";
-        }
-
-        Console.Error.WriteLine($"[LOADER][ERROR]   RIP location: {DescribeAddress(context.Rip)}");
-        // The thread has resumed. These bytes are best-effort observations, not an atomic snapshot.
-        var instructionBytes = new byte[48];
-        if (context.Rip >= 32 && TryReadHostBytes(context.Rip - 32, instructionBytes))
-            Console.Error.WriteLine($"[LOADER][ERROR]   Live bytes @[RIP-32..RIP+16]: {Convert.ToHexString(instructionBytes)}");
-        var currentInstruction = new byte[16];
-        if (TryReadHostBytes(context.Rip, currentInstruction))
-            Console.Error.WriteLine($"[LOADER][ERROR]   Live bytes @RIP: {Convert.ToHexString(currentInstruction)}");
-
-        Console.Error.WriteLine("[LOADER][ERROR]   Live stack pointer candidates:");
-        for (var offset = 0; offset < 256; offset += sizeof(ulong))
-        {
-            var address = context.Rsp + (ulong)offset;
-            if (address < context.Rsp || !TryReadDiagnosticHostQword(address, out var value)) break;
-            if (value != 0)
-                Console.Error.WriteLine($"[LOADER][ERROR]     [rsp+0x{offset:X2}] = 0x{value:X16} ({DescribeAddress(value)})");
-        }
-    }
-
-    [DllImport("kernel32.dll")]
-    private static extern uint GetThreadId(nint threadHandle);
-}

src/SharpEmu.Core/Cpu/Native/GuestThreadFlowProfile.cs

@@ -1,100 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Diagnostics;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-internal sealed class GuestThreadFlowProfile(int capacity = 131072)
-{
-    internal static readonly bool Enabled =
-        (Environment.GetEnvironmentVariable("SHARPEMU_PROFILE_PERFORMANCE") == "1" ||
-         Environment.GetEnvironmentVariable("SHARPEMU_PROFILE_GUEST_SCHEDULER") == "1") &&
-        Environment.GetEnvironmentVariable("SHARPEMU_PROFILE_PERFORMANCE_FRAME_TRACE") == "1";
-
-    internal enum EventKind
-    {
-        Blocked, Ready, Claimed, Scheduled, RunStarted, RunStopped, CallbackResumed,
-        ExecutorReleased, ClaimDeferred
-    }
-
-    internal readonly record struct TraceEvent(long Timestamp, int HostThreadId, ulong GuestThreadHandle,
-        string Name, EventKind Kind, string? Reason, string? WakeKey, string? ImportNid,
-        ulong Argument0, ulong Argument1, long DeadlineTimestamp);
-
-    internal readonly record struct Snapshot(TraceEvent[] Events, long TotalEvents);
-
-    private readonly int _capacity = capacity > 0 ? capacity : throw new ArgumentOutOfRangeException(nameof(capacity));
-    private readonly object _gate = new();
-    private readonly object _writeGate = new();
-    private TraceEvent[]? _events;
-    private long _eventCount;
-    private bool _closed;
-
-    internal void StartSession()
-    {
-        lock (_writeGate)
-        {
-            lock (_gate)
-            {
-                _events = null;
-                _eventCount = 0;
-                _closed = false;
-            }
-        }
-    }
-
-    internal void Record(in TraceEvent traceEvent)
-    {
-        lock (_gate)
-        {
-            if (_closed) return;
-            _events ??= new TraceEvent[_capacity];
-            _events[(int)(_eventCount % _capacity)] = traceEvent;
-            _eventCount++;
-        }
-    }
-
-    internal Snapshot Close()
-    {
-        lock (_gate)
-        {
-            _closed = true;
-            var retained = (int)Math.Min(_eventCount, _capacity);
-            var records = new TraceEvent[retained];
-            var first = _eventCount - retained;
-            for (var index = 0; index < retained; index++)
-                records[index] = _events![(int)((first + index) % _capacity)];
-            var snapshot = new Snapshot(records, _eventCount);
-            _events = null;
-            _eventCount = 0;
-            return snapshot;
-        }
-    }
-
-    internal void WriteTrace(TextWriter output)
-    {
-        // A concurrent shutdown caller must wait for the first writer to finish.
-        lock (_writeGate)
-        {
-            WriteRetainedEvents(output);
-        }
-    }
-
-    private void WriteRetainedEvents(TextWriter output)
-    {
-        var snapshot = Close();
-        if (snapshot.TotalEvents == 0) return;
-        output.WriteLine($"[PERF][GUEST_FLOW_TRACE] frequency={Stopwatch.Frequency} retained={snapshot.Events.Length} overwritten={snapshot.TotalEvents - snapshot.Events.Length}");
-        for (var index = 0; index < snapshot.Events.Length; index++)
-        {
-            var item = snapshot.Events[index];
-            output.WriteLine($"[PERF][GUEST_FLOW] sequence={snapshot.TotalEvents - snapshot.Events.Length + index} timestamp={item.Timestamp} thread={item.HostThreadId} guest=0x{item.GuestThreadHandle:X} name='{Quote(item.Name)}' event={item.Kind} reason='{Quote(item.Reason)}' wake='{Quote(item.WakeKey)}' nid='{Quote(item.ImportNid)}' arg0=0x{item.Argument0:X} arg1=0x{item.Argument1:X} deadline={item.DeadlineTimestamp}");
-        }
-        output.Flush();
-    }
-
-    // Guest names must not split one trace event across multiple output lines.
-    private static string Quote(string? value) => (value ?? "none")
-        .Replace("\\", "\\\\").Replace("'", "\\'").Replace("\r", "\\r").Replace("\n", "\\n");
-}

src/SharpEmu.Core/Cpu/Native/JitStubs.cs

@@ -252,7 +252,7 @@ public static unsafe class JitStubs
         var pattern = TlsAccessPattern;
         var end = start + length - pattern.Length;
 
-        for (var ptr = start; ptr <= end; ptr++)
+        for (var ptr = start; ptr < end; ptr++)
         {
             if (MatchesPattern(ptr, pattern))
             {

src/SharpEmu.Core/Cpu/Native/NullHostFaultHandling.cs

@@ -1,49 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using SharpEmu.HLE.Host;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-/// <summary>
-/// Placeholder for hosts whose fault bridge is installed directly by the
-/// execution backend. POSIX uses its sigaction bridge and never calls these
-/// Windows-shaped registration methods.
-/// </summary>
-internal sealed class NullHostFaultHandling : IHostFaultHandling
-{
-    public static NullHostFaultHandling Instance { get; } = new();
-
-    private NullHostFaultHandling()
-    {
-    }
-
-    public nint CreateHandlerThunk(nint managedCallback, uint hostRspSwitchTlsSlot, nint tlsGetValueAddress)
-    {
-        _ = managedCallback;
-        _ = hostRspSwitchTlsSlot;
-        _ = tlsGetValueAddress;
-        return 0;
-    }
-
-    public void FreeThunk(nint thunk)
-    {
-        _ = thunk;
-    }
-
-    public nint AddFirstChanceHandler(nint thunk)
-    {
-        _ = thunk;
-        return 0;
-    }
-
-    public void RemoveHandler(nint handle)
-    {
-        _ = handle;
-    }
-
-    public void SetUnhandledFilter(nint thunk)
-    {
-        _ = thunk;
-    }
-}

src/SharpEmu.Core/Cpu/Native/PosixHostStubs.cs

@@ -1,425 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Runtime.InteropServices;
-using SharpEmu.HLE;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-/// <summary>
-/// POSIX replacements for the kernel32 helpers the native backend embeds in
-/// emitted x86-64 code. Every stub exposed here follows the Win64 calling
-/// convention the emitted call sites were written for (first argument in
-/// ECX, result in RAX, Win64 non-volatile registers preserved), so the
-/// emission code stays identical across platforms.
-/// </summary>
-internal static unsafe class PosixHostStubs
-{
-    private static readonly object Gate = new();
-    private static bool _initialized;
-    private static nint _tlsGetValueStub;
-    private static nint _queryPerformanceCounterStub;
-    private static nint _switchToThreadStub;
-    private static nint _sleepStub;
-
-    public static nint TlsGetValueStubAddress
-    {
-        get { EnsureInitialized(); return _tlsGetValueStub; }
-    }
-
-    public static nint QueryPerformanceCounterStubAddress
-    {
-        get { EnsureInitialized(); return _queryPerformanceCounterStub; }
-    }
-
-    public static nint SwitchToThreadStubAddress
-    {
-        get { EnsureInitialized(); return _switchToThreadStub; }
-    }
-
-    public static nint SleepStubAddress
-    {
-        get { EnsureInitialized(); return _sleepStub; }
-    }
-
-    public static nint CreateWorkerEvent()
-    {
-        if (OperatingSystem.IsMacOS())
-        {
-            return dispatch_semaphore_create(0);
-        }
-
-        var semaphore = Marshal.AllocHGlobal(64);
-        if (sem_init(semaphore, 0, 0) != 0)
-        {
-            Marshal.FreeHGlobal(semaphore);
-            return 0;
-        }
-
-        return semaphore;
-    }
-
-    public static bool SignalWorkerEvent(nint handle)
-    {
-        if (OperatingSystem.IsMacOS())
-        {
-            _ = dispatch_semaphore_signal(handle);
-            return true;
-        }
-
-        return sem_post(handle) == 0;
-    }
-
-    public static bool WaitWorkerEvent(nint handle, int timeoutMilliseconds)
-    {
-        if (OperatingSystem.IsMacOS())
-        {
-            if (timeoutMilliseconds < 0)
-            {
-                return dispatch_semaphore_wait(handle, ulong.MaxValue) == 0;
-            }
-
-            var deadline = dispatch_time(0, timeoutMilliseconds * 1_000_000L);
-            return dispatch_semaphore_wait(handle, deadline) == 0;
-        }
-
-        if (timeoutMilliseconds < 0)
-        {
-            while (sem_wait(handle) != 0)
-            {
-            }
-
-            return true;
-        }
-
-        var deadlineTicks = Environment.TickCount64 + timeoutMilliseconds;
-        while (sem_trywait(handle) != 0)
-        {
-            if (Environment.TickCount64 >= deadlineTicks)
-            {
-                return false;
-            }
-
-            Thread.Sleep(1);
-        }
-
-        return true;
-    }
-
-    public static void DestroyWorkerEvent(nint handle)
-    {
-        if (handle == 0)
-        {
-            return;
-        }
-
-        if (OperatingSystem.IsMacOS())
-        {
-            dispatch_release(handle);
-            return;
-        }
-
-        _ = sem_destroy(handle);
-        Marshal.FreeHGlobal(handle);
-    }
-
-    /// <summary>Allocates a pthread TLS key, mirroring kernel32!TlsAlloc.</summary>
-    public static uint TlsAlloc()
-    {
-        if (OperatingSystem.IsMacOS())
-        {
-            nuint key;
-            return pthread_key_create_mac(&key, 0) == 0 ? (uint)key : uint.MaxValue;
-        }
-
-        uint key32;
-        return pthread_key_create_linux(&key32, 0) == 0 ? key32 : uint.MaxValue;
-    }
-
-    public static bool TlsFree(uint key)
-    {
-        return OperatingSystem.IsMacOS()
-            ? pthread_key_delete_mac((nuint)key) == 0
-            : pthread_key_delete_linux(key) == 0;
-    }
-
-    public static bool TlsSetValue(uint key, nint value)
-    {
-        return OperatingSystem.IsMacOS()
-            ? pthread_setspecific_mac((nuint)key, value) == 0
-            : pthread_setspecific_linux(key, value) == 0;
-    }
-
-    public static nint TlsGetValue(uint key)
-    {
-        return OperatingSystem.IsMacOS()
-            ? pthread_getspecific_mac((nuint)key)
-            : pthread_getspecific_linux(key);
-    }
-
-    /// <summary>Stable numeric id of the calling thread (kernel32!GetCurrentThreadId).</summary>
-    public static uint GetCurrentThreadId()
-    {
-        if (OperatingSystem.IsMacOS())
-        {
-            ulong tid;
-            return pthread_threadid_np(0, &tid) == 0 ? unchecked((uint)tid) : 0u;
-        }
-
-        return unchecked((uint)gettid());
-    }
-
-    /// <summary>
-    /// Wraps a managed callback (compiled for the SysV ABI on POSIX .NET) in a
-    /// thunk that accepts up to four integer arguments in the Win64 ABI the
-    /// emitted x86-64 call sites use. Win64 passes args in rcx/rdx/r8/r9 and
-    /// treats rdi/rsi as non-volatile; SysV expects rdi/rsi/rdx/rcx and
-    /// clobbers them, so the thunk saves rdi/rsi, shuffles the registers, keeps
-    /// the stack 16-byte aligned for the call, and forwards the rax result.
-    /// </summary>
-    public static nint CreateWin64ToSysVThunk(nint sysvTarget)
-    {
-        var page = (byte*)HostMemory.Alloc(
-            null,
-            4096,
-            HostMemory.MEM_COMMIT | HostMemory.MEM_RESERVE,
-            HostMemory.PAGE_EXECUTE_READWRITE);
-        if (page == null)
-        {
-            throw new OutOfMemoryException("Failed to allocate Win64->SysV thunk page");
-        }
-
-        var offset = 0;
-        Emit(page, ref offset, 0x57);                   // push rdi
-        Emit(page, ref offset, 0x56);                   // push rsi
-        Emit(page, ref offset, 0x48, 0x89, 0xCF);       // mov rdi, rcx
-        Emit(page, ref offset, 0x48, 0x89, 0xD6);       // mov rsi, rdx
-        Emit(page, ref offset, 0x4C, 0x89, 0xC2);       // mov rdx, r8
-        Emit(page, ref offset, 0x4C, 0x89, 0xC9);       // mov rcx, r9
-        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08); // sub rsp, 8 (realign to 16)
-        EmitMovRaxImm64(page, ref offset, sysvTarget);  // mov rax, target
-        Emit(page, ref offset, 0xFF, 0xD0);             // call rax
-        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08); // add rsp, 8
-        Emit(page, ref offset, 0x5E);                   // pop rsi
-        Emit(page, ref offset, 0x5F);                   // pop rdi
-        Emit(page, ref offset, 0xC3);                   // ret
-
-        if (!HostMemory.Protect(page, 4096, HostMemory.PAGE_EXECUTE_READ, out _))
-        {
-            throw new InvalidOperationException("Failed to protect Win64->SysV thunk page");
-        }
-
-        HostMemory.FlushInstructionCache(page, (nuint)offset);
-        return (nint)page;
-    }
-
-    private static void EnsureInitialized()
-    {
-        if (_initialized)
-        {
-            return;
-        }
-
-        lock (Gate)
-        {
-            if (_initialized)
-            {
-                return;
-            }
-
-            BuildStubs();
-            _initialized = true;
-        }
-    }
-
-    private static void BuildStubs()
-    {
-        var page = (byte*)HostMemory.Alloc(
-            null,
-            4096,
-            HostMemory.MEM_COMMIT | HostMemory.MEM_RESERVE,
-            HostMemory.PAGE_EXECUTE_READWRITE);
-        if (page == null)
-        {
-            throw new OutOfMemoryException("Failed to allocate POSIX host helper stub page");
-        }
-
-        var offset = 0;
-        _tlsGetValueStub = EmitTlsGetValue(page, ref offset);
-        _queryPerformanceCounterStub = EmitQueryPerformanceCounter(page, ref offset);
-        _switchToThreadStub = EmitSwitchToThread(page, ref offset);
-        _sleepStub = EmitSleep(page, ref offset);
-
-        if (!HostMemory.Protect(page, 4096, HostMemory.PAGE_EXECUTE_READ, out _))
-        {
-            throw new InvalidOperationException("Failed to protect POSIX host helper stub page");
-        }
-
-        HostMemory.FlushInstructionCache(page, (nuint)offset);
-    }
-
-    private static nint EmitTlsGetValue(byte* page, ref int offset)
-    {
-        var start = (nint)(page + offset);
-        if (OperatingSystem.IsMacOS())
-        {
-            // On macOS x86-64 pthread keys index the gs-based thread specific
-            // data array directly, so TlsGetValue(index in ecx) collapses to a
-            // single load that clobbers nothing but RAX.
-            Emit(page, ref offset, 0x89, 0xC8);                                     // mov eax, ecx
-            Emit(page, ref offset, 0x65, 0x48, 0x8B, 0x04, 0xC5, 0, 0, 0, 0);       // mov rax, gs:[rax*8]
-            Emit(page, ref offset, 0xC3);                                           // ret
-            return start;
-        }
-
-        // Linux: call pthread_getspecific, preserving the registers that are
-        // volatile in SysV but non-volatile in Win64 (rsi, rdi).
-        var pthreadGetSpecific = NativeLibrary.GetExport(NativeLibrary.Load("libpthread.so.0"), "pthread_getspecific");
-        Emit(page, ref offset, 0x56);                                               // push rsi
-        Emit(page, ref offset, 0x57);                                               // push rdi
-        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                             // sub rsp, 8
-        Emit(page, ref offset, 0x89, 0xCF);                                         // mov edi, ecx
-        EmitMovRaxImm64(page, ref offset, pthreadGetSpecific);                      // mov rax, imm64
-        Emit(page, ref offset, 0xFF, 0xD0);                                         // call rax
-        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08);                             // add rsp, 8
-        Emit(page, ref offset, 0x5F);                                               // pop rdi
-        Emit(page, ref offset, 0x5E);                                               // pop rsi
-        Emit(page, ref offset, 0xC3);                                               // ret
-        return start;
-    }
-
-    private static nint EmitQueryPerformanceCounter(byte* page, ref int offset)
-    {
-        // BOOL QueryPerformanceCounter(LARGE_INTEGER* out in rcx): the emitted
-        // consumers only need a monotonically increasing counter, which rdtsc
-        // provides without leaving Win64-safe registers.
-        var start = (nint)(page + offset);
-        Emit(page, ref offset, 0x0F, 0x31);                                         // rdtsc
-        Emit(page, ref offset, 0x48, 0xC1, 0xE2, 0x20);                             // shl rdx, 32
-        Emit(page, ref offset, 0x48, 0x09, 0xD0);                                   // or rax, rdx
-        Emit(page, ref offset, 0x48, 0x89, 0x01);                                   // mov [rcx], rax
-        Emit(page, ref offset, 0xB8, 0x01, 0x00, 0x00, 0x00);                       // mov eax, 1
-        Emit(page, ref offset, 0xC3);                                               // ret
-        return start;
-    }
-
-    private static nint EmitSwitchToThread(byte* page, ref int offset)
-    {
-        var schedYield = ResolveLibcExport("sched_yield");
-        var start = (nint)(page + offset);
-        Emit(page, ref offset, 0x56);                                               // push rsi
-        Emit(page, ref offset, 0x57);                                               // push rdi
-        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                             // sub rsp, 8
-        EmitMovRaxImm64(page, ref offset, schedYield);                              // mov rax, imm64
-        Emit(page, ref offset, 0xFF, 0xD0);                                         // call rax
-        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08);                             // add rsp, 8
-        Emit(page, ref offset, 0x5F);                                               // pop rdi
-        Emit(page, ref offset, 0x5E);                                               // pop rsi
-        Emit(page, ref offset, 0xB8, 0x01, 0x00, 0x00, 0x00);                       // mov eax, 1
-        Emit(page, ref offset, 0xC3);                                               // ret
-        return start;
-    }
-
-    private static nint EmitSleep(byte* page, ref int offset)
-    {
-        // void Sleep(DWORD milliseconds in ecx) -> usleep(microseconds in edi).
-        var usleep = ResolveLibcExport("usleep");
-        var start = (nint)(page + offset);
-        Emit(page, ref offset, 0x56);                                               // push rsi
-        Emit(page, ref offset, 0x57);                                               // push rdi
-        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                             // sub rsp, 8
-        Emit(page, ref offset, 0x89, 0xCF);                                         // mov edi, ecx
-        Emit(page, ref offset, 0x81, 0xFF, 0xFF, 0x0F, 0x00, 0x00);                 // cmp edi, 0xFFF
-        Emit(page, ref offset, 0x76, 0x05);                                         // jbe +5
-        Emit(page, ref offset, 0xBF, 0xFF, 0x0F, 0x00, 0x00);                       // mov edi, 0xFFF (cap at ~4s)
-        Emit(page, ref offset, 0x69, 0xFF, 0xE8, 0x03, 0x00, 0x00);                 // imul edi, edi, 1000
-        EmitMovRaxImm64(page, ref offset, usleep);                                  // mov rax, imm64
-        Emit(page, ref offset, 0xFF, 0xD0);                                         // call rax
-        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08);                             // add rsp, 8
-        Emit(page, ref offset, 0x5F);                                               // pop rdi
-        Emit(page, ref offset, 0x5E);                                               // pop rsi
-        Emit(page, ref offset, 0xC3);                                               // ret
-        return start;
-    }
-
-    private static nint ResolveLibcExport(string name)
-    {
-        var libc = NativeLibrary.Load(OperatingSystem.IsMacOS() ? "libSystem.dylib" : "libc.so.6");
-        return NativeLibrary.GetExport(libc, name);
-    }
-
-    private static void Emit(byte* page, ref int offset, params byte[] bytes)
-    {
-        foreach (var value in bytes)
-        {
-            page[offset++] = value;
-        }
-    }
-
-    private static void EmitMovRaxImm64(byte* page, ref int offset, nint value)
-    {
-        Emit(page, ref offset, 0x48, 0xB8);
-        *(long*)(page + offset) = value;
-        offset += sizeof(long);
-    }
-
-    [DllImport("libc", EntryPoint = "pthread_key_create", SetLastError = true)]
-    private static extern int pthread_key_create_mac(nuint* key, nint destructor);
-
-    [DllImport("libpthread.so.0", EntryPoint = "pthread_key_create", SetLastError = true)]
-    private static extern int pthread_key_create_linux(uint* key, nint destructor);
-
-    [DllImport("libc", EntryPoint = "pthread_key_delete")]
-    private static extern int pthread_key_delete_mac(nuint key);
-
-    [DllImport("libpthread.so.0", EntryPoint = "pthread_key_delete")]
-    private static extern int pthread_key_delete_linux(uint key);
-
-    [DllImport("libc", EntryPoint = "pthread_setspecific")]
-    private static extern int pthread_setspecific_mac(nuint key, nint value);
-
-    [DllImport("libpthread.so.0", EntryPoint = "pthread_setspecific")]
-    private static extern int pthread_setspecific_linux(uint key, nint value);
-
-    [DllImport("libc", EntryPoint = "pthread_getspecific")]
-    private static extern nint pthread_getspecific_mac(nuint key);
-
-    [DllImport("libpthread.so.0", EntryPoint = "pthread_getspecific")]
-    private static extern nint pthread_getspecific_linux(uint key);
-
-    [DllImport("libc")]
-    private static extern int pthread_threadid_np(nint thread, ulong* threadId);
-
-    [DllImport("libc")]
-    private static extern int gettid();
-
-    [DllImport("libc")]
-    private static extern nint dispatch_semaphore_create(long value);
-
-    [DllImport("libc")]
-    private static extern nint dispatch_semaphore_signal(nint semaphore);
-
-    [DllImport("libc")]
-    private static extern nint dispatch_semaphore_wait(nint semaphore, ulong timeout);
-
-    [DllImport("libc")]
-    private static extern ulong dispatch_time(ulong when, long deltaNanoseconds);
-
-    [DllImport("libc")]
-    private static extern void dispatch_release(nint handle);
-
-    [DllImport("libc")]
-    private static extern int sem_init(nint semaphore, int shared, uint value);
-
-    [DllImport("libc")]
-    private static extern int sem_post(nint semaphore);
-
-    [DllImport("libc")]
-    private static extern int sem_wait(nint semaphore);
-
-    [DllImport("libc")]
-    private static extern int sem_trywait(nint semaphore);
-
-    [DllImport("libc")]
-    private static extern int sem_destroy(nint semaphore);
-}

src/SharpEmu.Core/Cpu/Native/StubManager.cs

@@ -194,11 +194,11 @@ public sealed unsafe class StubManager : IDisposable
         _stubAddresses.Clear();
     }
 
-    private static void* VirtualAlloc(void* lpAddress, nuint dwSize, AllocationType flAllocationType, MemoryProtection flProtect) =>
-        HostMemory.Alloc(lpAddress, dwSize, (uint)flAllocationType, (uint)flProtect);
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern void* VirtualAlloc(void* lpAddress, nuint dwSize, AllocationType flAllocationType, MemoryProtection flProtect);
 
-    private static bool VirtualFree(void* lpAddress, nuint dwSize, FreeType dwFreeType) =>
-        HostMemory.Free(lpAddress, dwSize, (uint)dwFreeType);
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern bool VirtualFree(void* lpAddress, nuint dwSize, FreeType dwFreeType);
 
     [Flags]
     private enum AllocationType : uint

src/SharpEmu.Core/Cpu/Native/Windows/Win64ContextOffsets.cs

@@ -1,33 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-namespace SharpEmu.Core.Cpu.Native.Windows;
-
-/// <summary>
-/// Byte offsets into the Win64 CONTEXT record delivered to vectored exception
-/// handlers. The handlers read/write guest registers directly at these offsets
-/// (no managed CONTEXT struct exists); a future POSIX backend gets a sibling
-/// class for its mcontext layout.
-/// </summary>
-internal static class Win64ContextOffsets
-{
-    public const int Size = 0x4D0;
-    public const int Mxcsr = 52;
-    public const int Rax = 120;
-    public const int Rcx = 128;
-    public const int Rdx = 136;
-    public const int Rbx = 144;
-    public const int Rsp = 152;
-    public const int Rbp = 160;
-    public const int Rsi = 168;
-    public const int Rdi = 176;
-    public const int R8 = 184;
-    public const int R9 = 192;
-    public const int R10 = 200;
-    public const int R11 = 208;
-    public const int R12 = 216;
-    public const int R13 = 224;
-    public const int R14 = 232;
-    public const int R15 = 240;
-    public const int Rip = 248;
-}

src/SharpEmu.Core/Cpu/Native/Windows/WindowsFaultCodes.cs

@@ -1,26 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-namespace SharpEmu.Core.Cpu.Native.Windows;
-
-/// <summary>
-/// Windows NTSTATUS exception codes and EXCEPTION_RECORD access-type values the
-/// fault handlers filter on. Values are the same numbers the handlers previously
-/// compared as bare literals; only the spelling changed.
-/// </summary>
-internal static class WindowsFaultCodes
-{
-    public const uint AccessViolation = 0xC0000005u;         // 3221225477
-    public const uint Breakpoint = 0x80000003u;              // 2147483651
-    public const uint IllegalInstruction = 0xC000001Du;      // 3221225501
-    public const uint FastFail = 0xC0000409u;                // 3221226505
-    public const uint StackOverflow = 0xC00000FDu;
-    public const uint ClrManagedException = 0xE0434352u;
-    public const uint DebugOutputAnsi = 0x40010006u;
-    public const uint DebugOutputUnicode = 0x4001000Au;
-
-    // EXCEPTION_RECORD.ExceptionInformation[0] for access violations.
-    public const ulong AccessRead = 0;
-    public const ulong AccessWrite = 1;
-    public const ulong AccessExecute = 8;
-}

src/SharpEmu.Core/Cpu/Native/Windows/WindowsFaultHandling.cs

@@ -1,345 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Runtime.InteropServices;
-using SharpEmu.HLE.Host;
-
-namespace SharpEmu.Core.Cpu.Native.Windows;
-
-/// <summary>
-/// Vectored-exception-handler installation and the handler pre-filter thunk.
-/// The thunk is inherently Windows-shaped (TEB stack-limit reads via gs:,
-/// NTSTATUS pre-filtering, Win64 calling convention) and moved here whole from
-/// DirectExecutionBackend; a POSIX backend supplies a sibling built around
-/// sigaction/sigaltstack instead.
-/// </summary>
-internal sealed unsafe partial class WindowsFaultHandling : IHostFaultHandling
-{
-    private readonly IHostMemory _memory;
-
-    public WindowsFaultHandling(IHostMemory memory)
-    {
-        _memory = memory;
-    }
-
-    public nint CreateHandlerThunk(nint managedCallback, uint hostRspSwitchTlsSlot, nint tlsGetValueAddress)
-    {
-        const uint stubSize = 1024u;
-        void* ptr = (void*)_memory.Allocate(0, stubSize, HostPageProtection.ReadWriteExecute);
-        if (ptr == null)
-        {
-            return 0;
-        }
-
-        byte* code = (byte*)ptr;
-        int offset = 0;
-        // Native pre-filter: these exception codes are raised while the thread can be in
-        // cooperative GC mode (a C# throw is RaiseException(0xE0434352) on the throwing
-        // thread; FailFast/stack-overflow arrive mid-runtime-failure). Entering the managed
-        // handler then trips the CLR's reverse-P/Invoke check and kills the process with
-        // "Invalid Program: attempted to call a UnmanagedCallersOnly method from managed
-        // code" — this is why no managed throw (even one with a catch handler) ever
-        // survived inside the emulator. Continue the handler search without touching
-        // managed code; the CLR's own VEH handles its exceptions. MSVC C++ exceptions
-        // (Vulkan drivers, host CRT) are excluded too: the managed handler only ever
-        // returned CONTINUE_SEARCH for them.
-        //
-        // FastFail (0xC0000409) is logged from this native path only: managed VEH never
-        // sees it (tLT18–21 silent exits after TBB AV recovery).
-        ReadOnlySpan<uint> nonManagedExceptionCodes =
-            [WindowsFaultCodes.ClrManagedException, 0xE06D7363u, WindowsFaultCodes.FastFail, WindowsFaultCodes.StackOverflow,
-             WindowsFaultCodes.DebugOutputAnsi, WindowsFaultCodes.DebugOutputUnicode];
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x01); // mov rax, [rcx] (ExceptionRecord*)
-        EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x00);                                   // mov eax, [rax] (ExceptionCode)
-        var passJumpOffsets = stackalloc int[nonManagedExceptionCodes.Length];
-        int fastFailJumpSlot = -1;
-        for (int i = 0; i < nonManagedExceptionCodes.Length; i++)
-        {
-            EmitByte(code, ref offset, 0x3D);                                                                 // cmp eax, imm32
-            EmitUInt32(code, ref offset, nonManagedExceptionCodes[i]);
-            EmitByte(code, ref offset, 0x74);                                                                 // je pass
-            passJumpOffsets[i] = offset;
-            EmitByte(code, ref offset, 0x00);
-            if (nonManagedExceptionCodes[i] == WindowsFaultCodes.FastFail)
-            {
-                fastFailJumpSlot = i;
-            }
-        }
-        EmitByte(code, ref offset, 0xE9); // jmp mainBody rel32 (FastFail breadcrumb sits between)
-        var mainBodyJumpSlot = offset;
-        EmitUInt32(code, ref offset, 0u);
-
-        int passOffset = offset;
-        EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0);                                   // pass: xor eax, eax (EXCEPTION_CONTINUE_SEARCH)
-        EmitByte(code, ref offset, 0xC3);                                                                     // ret
-
-        // FastFail: native stderr breadcrumb with Context.Rip (no managed entry), then CONTINUE_SEARCH.
-        // Keep in sync with DirectExecutionBackend.CreateExceptionHandlerTrampoline.
-        int fastFailPassOffset = offset;
-        var fastFailLogInstalled = false;
-        if (fastFailJumpSlot >= 0 &&
-            NativeLibrary.TryLoad("kernel32.dll", out var kernel32) &&
-            NativeLibrary.TryGetExport(kernel32, "GetStdHandle", out var getStdHandle) &&
-            NativeLibrary.TryGetExport(kernel32, "WriteFile", out var writeFile))
-        {
-            ReadOnlySpan<byte> msg =
-                "[LOADER][FATAL] VEH_PASS FastFail 0xC0000409 (native; no managed VEH) rip=0x"u8;
-            ReadOnlySpan<byte> hexDigits = "0123456789ABCDEF"u8;
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x41);
-            EmitByte(code, ref offset, 0x08); // mov rax, [rcx+8]
-            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x90);
-            EmitUInt32(code, ref offset, 0xF8u); // mov r10, [rax+0xF8]
-            EmitByte(code, ref offset, 0x50); // push rax
-            EmitByte(code, ref offset, 0x51); // push rcx
-            EmitByte(code, ref offset, 0x52); // push rdx
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x50); // push r8
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x51); // push r9
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x52); // push r10
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
-            EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x40); // sub rsp, 0x40
-            EmitByte(code, ref offset, 0xB9); EmitUInt32(code, ref offset, unchecked((uint)-12));
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
-            *(nint*)(code + offset) = getStdHandle;
-            offset += sizeof(nint);
-            EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89);
-            EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x28); // mov [rsp+0x28], rax
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xC1);
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
-            var msgAbsSlot = offset;
-            *(nint*)(code + offset) = 0;
-            offset += sizeof(nint);
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xC2);
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xB8);
-            EmitUInt32(code, ref offset, (uint)msg.Length);
-            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8D);
-            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x20);
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
-            EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x20); EmitUInt32(code, ref offset, 0);
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
-            EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x38); EmitUInt32(code, ref offset, 0);
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
-            *(nint*)(code + offset) = writeFile;
-            offset += sizeof(nint);
-            EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
-
-            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8B);
-            EmitByte(code, ref offset, 0x54); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x40); // mov r10, [rsp+0x40]
-            EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xB8);
-            var hexDigitsAbsSlot = offset;
-            *(nint*)(code + offset) = 0;
-            offset += sizeof(nint);
-            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8D);
-            EmitByte(code, ref offset, 0x5C); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x30); // lea r11, [rsp+0x30]
-            EmitByte(code, ref offset, 0xB9); EmitUInt32(code, ref offset, 16u);
-            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xD0);
-            int hexLoopOffset = offset;
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC1); EmitByte(code, ref offset, 0xC0);
-            EmitByte(code, ref offset, 0x04);
-            EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xC2);
-            EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xE2); EmitByte(code, ref offset, 0x0F);
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0xB6);
-            EmitByte(code, ref offset, 0x14); EmitByte(code, ref offset, 0x10);
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x88); EmitByte(code, ref offset, 0x13);
-            EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xC3);
-            EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xC9);
-            EmitByte(code, ref offset, 0x75);
-            EmitByte(code, ref offset, unchecked((byte)(hexLoopOffset - (offset + 1)))); // jnz rel8
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xC6); EmitByte(code, ref offset, 0x03);
-            EmitByte(code, ref offset, 0x0A);
-
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B);
-            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x28);
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8D);
-            EmitByte(code, ref offset, 0x54); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x30);
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xB8);
-            EmitUInt32(code, ref offset, 17u);
-            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8D);
-            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x20);
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
-            EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x20); EmitUInt32(code, ref offset, 0);
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
-            EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
-            EmitByte(code, ref offset, 0x38); EmitUInt32(code, ref offset, 0);
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
-            *(nint*)(code + offset) = writeFile;
-            offset += sizeof(nint);
-            EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
-
-            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
-            EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x40);
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5A);
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x59);
-            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x58);
-            EmitByte(code, ref offset, 0x5A);
-            EmitByte(code, ref offset, 0x59);
-            EmitByte(code, ref offset, 0x58);
-            EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0);
-            EmitByte(code, ref offset, 0xC3);
-
-            var msgOffset = offset;
-            for (int i = 0; i < msg.Length; i++)
-            {
-                EmitByte(code, ref offset, msg[i]);
-            }
-
-            var hexDigitsOffset = offset;
-            for (int i = 0; i < hexDigits.Length; i++)
-            {
-                EmitByte(code, ref offset, hexDigits[i]);
-            }
-
-            *(nint*)(code + msgAbsSlot) = (nint)ptr + msgOffset;
-            *(nint*)(code + hexDigitsAbsSlot) = (nint)ptr + hexDigitsOffset;
-            code[passJumpOffsets[fastFailJumpSlot]] =
-                checked((byte)(fastFailPassOffset - (passJumpOffsets[fastFailJumpSlot] + 1)));
-            fastFailLogInstalled = true;
-        }
-
-        int mainBodyOffset = offset;
-        *(int*)(code + mainBodyJumpSlot) = mainBodyOffset - (mainBodyJumpSlot + sizeof(int));
-
-        for (int i = 0; i < nonManagedExceptionCodes.Length; i++)
-        {
-            if (i == fastFailJumpSlot && fastFailLogInstalled)
-            {
-                continue;
-            }
-
-            code[passJumpOffsets[i]] = checked((byte)(passOffset - (passJumpOffsets[i] + 1)));
-        }
-        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x54); // push r12
-        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x55); // push r13
-        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE4); // mov r12, rsp
-        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xCD); // mov r13, rcx
-        EmitByte(code, ref offset, 0x65); EmitByte(code, ref offset, 0x48); // mov rax, gs:[8]
-        EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x04); EmitByte(code, ref offset, 0x25);
-        EmitUInt32(code, ref offset, 8u);
-        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x39); EmitByte(code, ref offset, 0xC4); // cmp r12, rax
-        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x83); // jae guestStack
-        int aboveStackJump = offset;
-        EmitUInt32(code, ref offset, 0u);
-        EmitByte(code, ref offset, 0x65); EmitByte(code, ref offset, 0x48); // mov rax, gs:[0x10]
-        EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x04); EmitByte(code, ref offset, 0x25);
-        EmitUInt32(code, ref offset, 0x10u);
-        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x39); EmitByte(code, ref offset, 0xC4); // cmp r12, rax
-        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x82); // jb guestStack
-        int belowStackJump = offset;
-        EmitUInt32(code, ref offset, 0u);
-
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
-        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE9); // mov rcx, r13
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
-        *(nint*)(code + offset) = managedCallback;
-        offset += sizeof(nint);
-        EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
-        EmitByte(code, ref offset, 0xE9);
-        int hostRestoreJump = offset;
-        EmitUInt32(code, ref offset, 0u);
-
-        int guestStackOffset = offset;
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
-        EmitByte(code, ref offset, 0xB9);
-        EmitUInt32(code, ref offset, hostRspSwitchTlsSlot);
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
-        *(nint*)(code + offset) = tlsGetValueAddress;
-        offset += sizeof(nint);
-        EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x85); EmitByte(code, ref offset, 0xC0); // test rax, rax
-        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
-        int missingTlsJump = offset;
-        EmitUInt32(code, ref offset, 0u);
-        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x18); // mov r11, [rax]
-        EmitByte(code, ref offset, 0x4D); EmitByte(code, ref offset, 0x85); EmitByte(code, ref offset, 0xDB); // test r11, r11
-        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
-        int missingHostStackJump = offset;
-        EmitUInt32(code, ref offset, 0u);
-        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xDC); // mov rsp, r11
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
-        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE9); // mov rcx, r13
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
-        *(nint*)(code + offset) = managedCallback;
-        offset += sizeof(nint);
-        EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
-        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
-        EmitByte(code, ref offset, 0xE9);
-        int guestRestoreJump = offset;
-        EmitUInt32(code, ref offset, 0u);
-
-        int passThroughOffset = offset;
-        EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0); // xor eax, eax
-        int restoreOffset = offset;
-        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE4); // mov rsp, r12
-        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5D);
-        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5C);
-        EmitByte(code, ref offset, 0xC3);
-
-        *(int*)(code + aboveStackJump) = guestStackOffset - (aboveStackJump + sizeof(int));
-        *(int*)(code + belowStackJump) = guestStackOffset - (belowStackJump + sizeof(int));
-        *(int*)(code + hostRestoreJump) = restoreOffset - (hostRestoreJump + sizeof(int));
-        *(int*)(code + missingTlsJump) = passThroughOffset - (missingTlsJump + sizeof(int));
-        *(int*)(code + missingHostStackJump) = passThroughOffset - (missingHostStackJump + sizeof(int));
-        *(int*)(code + guestRestoreJump) = restoreOffset - (guestRestoreJump + sizeof(int));
-
-        if (!_memory.Protect((ulong)ptr, stubSize, HostPageProtection.ReadExecute, out _))
-        {
-            Console.Error.WriteLine($"[LOADER][ERROR] VirtualProtect failed for exception handler trampoline at 0x{(nint)ptr:X16}");
-            _ = _memory.Free((ulong)ptr);
-            return 0;
-        }
-        _memory.FlushInstructionCache((ulong)ptr, (ulong)offset);
-        return (nint)ptr;
-    }
-
-    public void FreeThunk(nint thunk)
-    {
-        _ = _memory.Free((ulong)thunk);
-    }
-
-    public nint AddFirstChanceHandler(nint thunk)
-    {
-        return (nint)AddVectoredExceptionHandler(1u, thunk);
-    }
-
-    public void RemoveHandler(nint handle)
-    {
-        _ = RemoveVectoredExceptionHandler((void*)handle);
-    }
-
-    public void SetUnhandledFilter(nint thunk)
-    {
-        _ = SetUnhandledExceptionFilter(thunk);
-    }
-
-    private static void EmitByte(byte* code, ref int offset, byte value)
-    {
-        code[offset++] = value;
-    }
-
-    private static void EmitUInt32(byte* code, ref int offset, uint value)
-    {
-        *(uint*)(code + offset) = value;
-        offset += sizeof(uint);
-    }
-
-    [LibraryImport("kernel32.dll")]
-    private static partial void* AddVectoredExceptionHandler(uint first, IntPtr handler);
-
-    [LibraryImport("kernel32.dll")]
-    private static partial uint RemoveVectoredExceptionHandler(void* handle);
-
-    [LibraryImport("kernel32.dll")]
-    private static partial IntPtr SetUnhandledExceptionFilter(IntPtr lpTopLevelExceptionFilter);
-}

src/SharpEmu.Core/Cpu/TrackedCpuMemory.cs

@@ -5,7 +5,7 @@ using SharpEmu.HLE;
 
 namespace SharpEmu.Core.Cpu;
 
-public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemoryAllocator, ICpuMemoryWrapper
+public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemoryAllocator
 {
     private readonly ICpuMemory _inner;
 
@@ -18,8 +18,6 @@ public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemo
 
     public ICpuMemory Inner => _inner;
 
-    public string DescribeReadRange(ulong address, ulong size) => _inner.DescribeReadRange(address, size);
-
     public bool TryRead(ulong virtualAddress, Span<byte> destination)
     {
         var result = _inner.TryRead(virtualAddress, destination);
@@ -42,20 +40,6 @@ public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemo
         return result;
     }
 
-    public bool TryCompare(
-        ulong virtualAddress,
-        ReadOnlySpan<byte> expected,
-        out bool equal) =>
-        _inner.TryCompare(virtualAddress, expected, out equal);
-
-    public bool TryCopy(ulong destinationAddress, ulong sourceAddress, ulong length) =>
-        _inner.TryCopy(destinationAddress, sourceAddress, length);
-
-    public bool CanRead(ulong address, ulong size) => _inner.CanRead(address, size);
-
-    public bool TryScanCString(ulong address, byte needle, bool findLast, ulong maxLength, out ulong match) =>
-        _inner.TryScanCString(address, needle, findLast, maxLength, out match);
-
     public bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address)
     {
         if (_inner is IGuestMemoryAllocator allocator)
@@ -66,9 +50,4 @@ public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemo
         address = 0;
         return false;
     }
-
-    public bool TryFreeGuestMemory(ulong address)
-    {
-        return _inner is IGuestMemoryAllocator allocator && allocator.TryFreeGuestMemory(address);
-    }
 }

src/SharpEmu.Core/Diagnostics/WindowsCrashCapture.DebuggerBreaks.cs

@@ -1,122 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Reflection.PortableExecutable;
-using System.Text;
-using Microsoft.Win32.SafeHandles;
-
-namespace SharpEmu.Core.Diagnostics;
-
-public static partial class WindowsCrashCapture
-{
-    internal sealed class DebuggerBreakTracker
-    {
-        private readonly Dictionary<uint, nint> _threadStarts = new();
-        private nint _libraryBase;
-        private nint _breakThreadEntry;
-        private nint _breakpointAddress;
-
-        internal void Observe(DebugEvent debugEvent)
-        {
-            switch (debugEvent.Kind)
-            {
-                case CreateProcessEvent:
-                    _threadStarts[debugEvent.ThreadId] = debugEvent.ProcessThreadStartAddress;
-                    break;
-                case CreateThreadEvent:
-                    _threadStarts[debugEvent.ThreadId] = debugEvent.ThreadStartAddress;
-                    break;
-                case ExitThreadEvent:
-                    _threadStarts.Remove(debugEvent.ThreadId);
-                    break;
-                case LoadLibraryEvent:
-                    if (TryReadDebuggerExports(debugEvent.FileHandle, out var threadOffset, out var breakpointOffset))
-                    {
-                        _libraryBase = debugEvent.LoadedLibraryBase;
-                        _breakThreadEntry = checked(_libraryBase + threadOffset);
-                        _breakpointAddress = checked(_libraryBase + breakpointOffset);
-                    }
-                    break;
-                case UnloadLibraryEvent when debugEvent.UnloadedLibraryBase == _libraryBase:
-                    _libraryBase = _breakThreadEntry = _breakpointAddress = 0;
-                    break;
-            }
-        }
-
-        internal bool IsDebuggerBreak(DebugEvent debugEvent) =>
-            debugEvent.Kind == ExceptionEvent && debugEvent.FirstChance != 0 &&
-            debugEvent.Exception.Code == BreakpointException && _libraryBase != 0 &&
-            debugEvent.Exception.Address == _breakpointAddress &&
-            _threadStarts.TryGetValue(debugEvent.ThreadId, out var startAddress) && startAddress == _breakThreadEntry;
-    }
-
-    private static unsafe bool TryReadDebuggerExports(nint fileHandle, out int threadOffset, out int breakpointOffset)
-    {
-        threadOffset = breakpointOffset = 0;
-        if (fileHandle == 0 || fileHandle == -1)
-            return false;
-        const int pathCapacity = 512;
-        var pathBuffer = stackalloc char[pathCapacity];
-        var pathLength = GetFinalPathNameByHandle(fileHandle, pathBuffer, pathCapacity, 0);
-        if (pathLength == 0 || pathLength >= pathCapacity)
-            return false;
-        var path = new string(pathBuffer, 0, (int)pathLength);
-        var systemLibrary = @"\\?\" + Path.Combine(Environment.SystemDirectory, "ntdll.dll");
-        if (!string.Equals(path, systemLibrary, StringComparison.OrdinalIgnoreCase))
-            return false;
-
-        try
-        {
-            // Read the file supplied by the debug event, then use the target's load address.
-            using var handle = new SafeFileHandle(fileHandle, ownsHandle: false);
-            using var stream = new FileStream(handle, FileAccess.Read);
-            using var image = new PEReader(stream);
-            if (image.PEHeaders.PEHeader is not { Magic: PEMagic.PE32Plus } header)
-                return false;
-            var directory = header.ExportTableDirectory;
-            if (directory.Size < 40)
-                return false;
-            var exports = image.GetSectionData(directory.RelativeVirtualAddress).GetReader(0, 40);
-            exports.Offset = 20;
-            var functionCount = exports.ReadInt32();
-            var nameCount = exports.ReadInt32();
-            var functionsAddress = exports.ReadInt32();
-            var namesAddress = exports.ReadInt32();
-            var ordinalsAddress = exports.ReadInt32();
-            var functions = image.GetSectionData(functionsAddress).GetReader(0, checked(functionCount * 4));
-            var names = image.GetSectionData(namesAddress).GetReader(0, checked(nameCount * 4));
-            var ordinals = image.GetSectionData(ordinalsAddress).GetReader(0, checked(nameCount * 2));
-            for (var nameIndex = 0; nameIndex < nameCount; nameIndex++)
-            {
-                var nameBlock = image.GetSectionData(names.ReadInt32());
-                var nameBytes = nameBlock.GetContent(0, Math.Min(nameBlock.Length, "DbgUiRemoteBreakin".Length + 1)).AsSpan();
-                var terminator = nameBytes.IndexOf((byte)0);
-                var ordinal = ordinals.ReadUInt16();
-                if (ordinal >= functionCount)
-                    return false;
-                if (terminator < 0)
-                    continue;
-                var name = Encoding.ASCII.GetString(nameBytes[..terminator]);
-                if (name is not ("DbgUiRemoteBreakin" or "DbgBreakPoint"))
-                    continue;
-                functions.Offset = ordinal * 4;
-                var functionOffset = functions.ReadInt32();
-                // A forwarded export is not executable code in this image.
-                if (functionOffset <= 0 || functionOffset >= header.SizeOfImage ||
-                    (functionOffset >= directory.RelativeVirtualAddress &&
-                     functionOffset - directory.RelativeVirtualAddress < directory.Size))
-                    return false;
-                if (name == "DbgUiRemoteBreakin")
-                    threadOffset = functionOffset;
-                else
-                    breakpointOffset = functionOffset;
-            }
-            return threadOffset != 0 && breakpointOffset != 0;
-        }
-        catch (Exception exception) when (exception is IOException or BadImageFormatException or ArgumentException or OverflowException)
-        {
-            threadOffset = breakpointOffset = 0;
-            return false;
-        }
-    }
-}

src/SharpEmu.Core/Diagnostics/WindowsCrashCapture.Native.cs

@@ -1,161 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Runtime.InteropServices;
-using Microsoft.Win32.SafeHandles;
-
-namespace SharpEmu.Core.Diagnostics;
-
-public static partial class WindowsCrashCapture
-{
-    private const uint ExceptionEvent = 1;
-    private const uint CreateThreadEvent = 2;
-    private const uint CreateProcessEvent = 3;
-    private const uint ExitThreadEvent = 4;
-    private const uint ExitProcessEvent = 5;
-    private const uint LoadLibraryEvent = 6;
-    private const uint UnloadLibraryEvent = 7;
-    private const uint BreakpointException = 0x80000003;
-    private const uint DebugContinue = 0x00010002;
-    private const uint DebugExceptionNotHandled = 0x80010001;
-    private const uint ProcessReadAccess = 0x0450;
-    private const uint ThreadContextAccess = 0x0008;
-    private const uint DumpFullMemory = 0x00000002;
-    private const uint DumpHandleData = 0x00000004;
-    private const uint DumpUnloadedModules = 0x00000020;
-    private const uint DumpMemoryInformation = 0x00000800;
-    private const uint DumpThreadInformation = 0x00001000;
-    private const uint DumpIgnoreInaccessibleMemory = 0x00020000;
-    private const uint FullDumpFlags = DumpFullMemory | DumpHandleData | DumpUnloadedModules |
-        DumpMemoryInformation | DumpThreadInformation | DumpIgnoreInaccessibleMemory;
-    private const uint AllX64ContextFlags = 0x0010001F;
-
-    private static unsafe void WriteDump(uint processId, DebugEvent debugEvent, string dumpPath)
-    {
-        using var process = OpenProcess(ProcessReadAccess, false, processId);
-        if (process.IsInvalid)
-            throw NativeFailure("Open the crashed process");
-        using var thread = OpenThread(ThreadContextAccess, false, debugEvent.ThreadId);
-        if (thread.IsInvalid)
-            throw NativeFailure("Open the faulting thread");
-        var context = (ThreadContext*)NativeMemory.AlignedAlloc((nuint)sizeof(ThreadContext), 16);
-        if (context == null)
-            throw new OutOfMemoryException();
-        try
-        {
-            NativeMemory.Clear(context, (nuint)sizeof(ThreadContext));
-            context->Flags = AllX64ContextFlags;
-            if (!GetThreadContext(thread, context))
-                throw NativeFailure("Read the faulting thread context");
-
-            // The exception pointers refer to this helper, not to the crashed process.
-            var record = debugEvent.Exception;
-            record.NestedRecord = 0;
-            var pointers = new ExceptionPointers { Record = &record, Context = context };
-            var exception = new DumpExceptionInformation
-            {
-                ThreadId = debugEvent.ThreadId,
-                Pointers = &pointers,
-                ClientPointers = 0,
-            };
-            using var output = new FileStream(dumpPath, FileMode.CreateNew, FileAccess.Write, FileShare.Read);
-            if (!MiniDumpWriteDump(process, processId, output.SafeFileHandle, FullDumpFlags, &exception, 0, 0))
-                throw NativeFailure("Write the crash dump");
-            output.Flush(flushToDisk: true);
-        }
-        finally
-        {
-            NativeMemory.AlignedFree(context);
-        }
-    }
-
-    [StructLayout(LayoutKind.Explicit, Size = 176)]
-    internal struct DebugEvent
-    {
-        [FieldOffset(0)] public uint Kind;
-        [FieldOffset(4)] public uint ProcessId;
-        [FieldOffset(8)] public uint ThreadId;
-        [FieldOffset(16)] public ExceptionRecord Exception;
-        [FieldOffset(168)] public uint FirstChance;
-        [FieldOffset(16)] public nint FileHandle;
-        [FieldOffset(16)] public uint ExitCode;
-        [FieldOffset(24)] public nint LoadedLibraryBase;
-        [FieldOffset(16)] public nint UnloadedLibraryBase;
-        [FieldOffset(32)] public nint ThreadStartAddress;
-        [FieldOffset(64)] public nint ProcessThreadStartAddress;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    internal unsafe struct ExceptionRecord
-    {
-        public uint Code;
-        public uint Flags;
-        public nint NestedRecord;
-        public nint Address;
-        public uint ParameterCount;
-        public fixed ulong Parameters[15];
-    }
-
-    [StructLayout(LayoutKind.Explicit, Size = 1232)]
-    internal struct ThreadContext
-    {
-        [FieldOffset(48)] public uint Flags;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    private unsafe struct ExceptionPointers
-    {
-        public ExceptionRecord* Record;
-        public ThreadContext* Context;
-    }
-
-    [StructLayout(LayoutKind.Sequential, Pack = 4)]
-    internal unsafe struct DumpExceptionInformation
-    {
-        public uint ThreadId;
-        public void* Pointers;
-        public int ClientPointers;
-    }
-
-    [LibraryImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static partial bool DebugActiveProcess(uint processId);
-
-    [LibraryImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static partial bool DebugActiveProcessStop(uint processId);
-
-    [LibraryImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static partial bool DebugSetProcessKillOnExit([MarshalAs(UnmanagedType.Bool)] bool killOnExit);
-
-    [LibraryImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static partial bool WaitForDebugEventEx(out DebugEvent debugEvent, uint milliseconds);
-
-    [LibraryImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static partial bool ContinueDebugEvent(uint processId, uint threadId, uint status);
-
-    [LibraryImport("kernel32.dll", SetLastError = true)]
-    private static partial SafeProcessHandle OpenProcess(uint access, [MarshalAs(UnmanagedType.Bool)] bool inherit, uint processId);
-
-    [LibraryImport("kernel32.dll", SetLastError = true)]
-    private static partial SafeWaitHandle OpenThread(uint access, [MarshalAs(UnmanagedType.Bool)] bool inherit, uint threadId);
-
-    [LibraryImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static unsafe partial bool GetThreadContext(SafeWaitHandle thread, ThreadContext* context);
-
-    [LibraryImport("kernel32.dll")]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static partial bool CloseHandle(nint handle);
-
-    [LibraryImport("kernel32.dll", EntryPoint = "GetFinalPathNameByHandleW", SetLastError = true)]
-    private static unsafe partial uint GetFinalPathNameByHandle(nint file, char* path, uint length, uint flags);
-
-    [LibraryImport("dbghelp.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static unsafe partial bool MiniDumpWriteDump(SafeProcessHandle process, uint processId,
-        SafeFileHandle file, uint dumpType, DumpExceptionInformation* exception, nint userStream, nint callback);
-}

src/SharpEmu.Core/Diagnostics/WindowsCrashCapture.cs

@@ -1,182 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.ComponentModel;
-using System.Diagnostics;
-using System.Globalization;
-using System.Reflection;
-using System.Runtime.InteropServices;
-using Microsoft.Win32.SafeHandles;
-
-namespace SharpEmu.Core.Diagnostics;
-
-public static partial class WindowsCrashCapture
-{
-    public const string HelperArgument = "--sharpemu-crash-helper";
-    private const string CaptureVariable = "SHARPEMU_CRASH_CAPTURE";
-
-    public static void StartIfEnabled(string? logFilePath)
-    {
-        if (!string.Equals(Environment.GetEnvironmentVariable(CaptureVariable), "1", StringComparison.Ordinal))
-            return;
-
-        if (!OperatingSystem.IsWindows() || RuntimeInformation.ProcessArchitecture != Architecture.X64)
-        {
-            Console.Error.WriteLine("[CRASH][WARN] Crash capture requires a Windows x64 process.");
-            return;
-        }
-
-        try
-        {
-            var logPath = string.IsNullOrWhiteSpace(logFilePath)
-                ? Path.Combine(AppContext.BaseDirectory, "user", "logs", $"run-{DateTime.UtcNow:yyyyMMdd-HHmmss}.log")
-                : Path.GetFullPath(logFilePath);
-            var dumpPath = Path.ChangeExtension(logPath, $"crash-{Environment.ProcessId}.dmp");
-            Directory.CreateDirectory(Path.GetDirectoryName(dumpPath)!);
-            var readyEventName = $"Local\\SharpEmu-Crash-{Guid.NewGuid():N}";
-            using var readyEvent = new EventWaitHandle(false, EventResetMode.ManualReset, readyEventName);
-            var executable = Environment.ProcessPath ?? throw new InvalidOperationException("The executable path is not available.");
-            var startInfo = new ProcessStartInfo(executable) { UseShellExecute = false, CreateNoWindow = true };
-            if (string.Equals(Path.GetFileNameWithoutExtension(executable), "dotnet", StringComparison.OrdinalIgnoreCase))
-                startInfo.ArgumentList.Add(Assembly.GetEntryAssembly()!.Location);
-            startInfo.ArgumentList.Add(HelperArgument);
-            startInfo.ArgumentList.Add(Environment.ProcessId.ToString(CultureInfo.InvariantCulture));
-            startInfo.ArgumentList.Add(readyEventName);
-            startInfo.ArgumentList.Add(dumpPath);
-            startInfo.Environment.Remove(CaptureVariable);
-
-            // The helper stays attached until this process exits, including runtime teardown.
-            using var helper = Process.Start(startInfo) ?? throw new InvalidOperationException("The crash helper did not start.");
-            using var exited = new ProcessExitWaitHandle(helper);
-            WaitForHelper(readyEvent, exited);
-            Console.Error.WriteLine($"[CRASH][INFO] Crash capture ready. Dump: {dumpPath}");
-            Console.Error.WriteLine($"[CRASH][INFO] Capture report: {dumpPath}.capture.log");
-            Console.Error.WriteLine($"[CRASH][INFO] Runtime: {RuntimeInformation.FrameworkDescription}. Debugging can change timing.");
-        }
-        catch (Exception exception)
-        {
-            Console.Error.WriteLine($"[CRASH][ERROR] Crash capture is not active: {exception.Message}");
-        }
-    }
-
-    internal static void WaitForHelper(WaitHandle ready, WaitHandle exited)
-    {
-        if (WaitHandle.WaitAny([ready, exited]) != 0)
-            throw new InvalidOperationException("The crash helper exited before capture was ready. Check the capture report.");
-    }
-
-    private sealed class ProcessExitWaitHandle : WaitHandle
-    {
-        public ProcessExitWaitHandle(Process process) =>
-            SafeWaitHandle = new SafeWaitHandle(process.Handle, ownsHandle: false);
-    }
-
-    public static int RunHelper(string[] arguments)
-    {
-        if (!OperatingSystem.IsWindows() || RuntimeInformation.ProcessArchitecture != Architecture.X64 ||
-            arguments.Length != 4 || arguments[0] != HelperArgument ||
-            !uint.TryParse(arguments[1], NumberStyles.None, CultureInfo.InvariantCulture, out var processId) || processId == 0)
-            return 1;
-
-        var attached = false;
-        StreamWriter? report = null;
-        try
-        {
-            report = new StreamWriter(arguments[3] + ".capture.log", append: true) { AutoFlush = true };
-            report.WriteLine($"Capture helper started. Process: {processId}. Dump: {arguments[3]}");
-            report.WriteLine($"Runtime: {RuntimeInformation.FrameworkDescription}. OS: {Environment.OSVersion}.");
-            using var readyEvent = EventWaitHandle.OpenExisting(arguments[2]);
-            if (!DebugActiveProcess(processId))
-                throw NativeFailure("Attach to the game process");
-            attached = true;
-            if (!DebugSetProcessKillOnExit(false))
-                throw NativeFailure("Keep the game alive if the helper exits");
-            return ProcessDebugEvents(processId, arguments[3], readyEvent, report);
-        }
-        catch (Exception exception)
-        {
-            report?.WriteLine($"Capture failed: {exception.Message}");
-            Console.Error.WriteLine($"[CRASH][ERROR] Capture failed: {exception.Message}");
-            return 1;
-        }
-        finally
-        {
-            if (attached)
-                _ = DebugActiveProcessStop(processId);
-            report?.Dispose();
-        }
-    }
-
-    private static int ProcessDebugEvents(uint processId, string dumpPath, EventWaitHandle readyEvent, TextWriter report)
-    {
-        var initialBreakpoint = true;
-        var captured = false;
-        var debuggerBreaks = new DebuggerBreakTracker();
-        while (true)
-        {
-            if (!WaitForDebugEventEx(out var debugEvent, uint.MaxValue))
-                throw NativeFailure("Wait for a debug event");
-
-            var continuation = DebugContinue;
-            var ready = false;
-            try
-            {
-                try
-                {
-                    debuggerBreaks.Observe(debugEvent);
-                }
-                finally
-                {
-                    if (debugEvent.Kind is CreateProcessEvent or LoadLibraryEvent && debugEvent.FileHandle != 0)
-                        _ = CloseHandle(debugEvent.FileHandle);
-                }
-                if (debugEvent.Kind == ExceptionEvent)
-                {
-                    continuation = DebugExceptionNotHandled;
-                    if (initialBreakpoint && debugEvent.FirstChance != 0 && debugEvent.Exception.Code == BreakpointException)
-                    {
-                        initialBreakpoint = false;
-                        continuation = DebugContinue;
-                        ready = true;
-                    }
-                    else if (debuggerBreaks.IsDebuggerBreak(debugEvent))
-                    {
-                        continuation = DebugContinue;
-                        report.WriteLine($"Debugger break continued. Thread: {debugEvent.ThreadId}.");
-                    }
-                    else if (debugEvent.FirstChance == 0 && !captured)
-                    {
-                        captured = true;
-                        report.WriteLine($"Unhandled exception: 0x{debugEvent.Exception.Code:X8}. " +
-                            $"Address: 0x{debugEvent.Exception.Address:X16}. Thread: {debugEvent.ThreadId}.");
-                        WriteDump(processId, debugEvent, dumpPath);
-                        report.WriteLine("Dump complete.");
-                    }
-                }
-            }
-            finally
-            {
-                // Even a failed dump must leave the original exception unhandled.
-                if (!ContinueDebugEvent(debugEvent.ProcessId, debugEvent.ThreadId, continuation))
-                    throw NativeFailure("Continue a debug event");
-            }
-
-            if (ready)
-            {
-                report.WriteLine("Capture ready. Application exceptions remain unhandled by the helper.");
-                readyEvent.Set();
-            }
-            if (debugEvent.Kind == ExitProcessEvent)
-            {
-                report.WriteLine($"Process exited: 0x{debugEvent.ExitCode:X8}. Dump captured: {captured}.");
-                return 0;
-            }
-        }
-    }
-
-    private static Win32Exception NativeFailure(string operation)
-    {
-        var error = Marshal.GetLastPInvokeError();
-        return new Win32Exception(error, $"{operation} failed (Windows error {error}).");
-    }
-}

src/SharpEmu.Core/Loader/ParamLoader.cs

@@ -45,13 +45,7 @@ public static class Ps5ParamJsonReader
 
         try
         {
-            ReadOnlyMemory<byte> json = data;
-            if (json.Span.StartsWith("\uFEFF"u8))
-            {
-                json = json[3..];
-            }
-
-            using var doc = JsonDocument.Parse(json);
+            using var doc = JsonDocument.Parse(data);
             return TryReadPs5Param(doc.RootElement);
         }
         catch (JsonException)
@@ -62,15 +56,12 @@ public static class Ps5ParamJsonReader
 
     private static (string? Title, string? TitleId, string? Version) TryReadPs5Param(JsonElement root)
     {
-        if (root.ValueKind != JsonValueKind.Object)
-            return (null, null, null);
-
-        var titleId = GetString(root, "titleId");
+        string? titleId = root.TryGetProperty("titleId", out var eTid) ? eTid.GetString() : null;
 
         string? ver =
-            GetString(root, "contentVersion")
-            ?? GetString(root, "masterVersion")
-            ?? GetString(root, "targetContentVersion");
+            (root.TryGetProperty("contentVersion", out var cv) ? cv.GetString() : null)
+            ?? (root.TryGetProperty("masterVersion", out var mv) ? mv.GetString() : null)
+            ?? (root.TryGetProperty("targetContentVersion", out var tv) ? tv.GetString() : null);
 
         string? title = ExtractTitleName(root);
 
@@ -79,49 +70,34 @@ public static class Ps5ParamJsonReader
 
     private static string? ExtractTitleName(JsonElement root)
     {
-        if ((!root.TryGetProperty("localizedParameters", out var lp) || lp.ValueKind != JsonValueKind.Object) &&
-            root.TryGetProperty("disc", out var disc) && disc.ValueKind == JsonValueKind.Object)
+        if (!root.TryGetProperty("localizedParameters", out var lp))
         {
-            disc.TryGetProperty("localizedParameters", out lp);
+            if (root.TryGetProperty("disc", out var disc) && disc.ValueKind == JsonValueKind.Object)
+            {
+                disc.TryGetProperty("localizedParameters", out lp);
+            }
         }
 
         if (lp.ValueKind != JsonValueKind.Object)
             return null;
 
-        var defLang = GetString(lp, "defaultLanguage");
+        string? defLang = lp.TryGetProperty("defaultLanguage", out var dl) ? dl.GetString() : null;
 
         if (!string.IsNullOrEmpty(defLang))
         {
             if (lp.TryGetProperty(defLang, out var langObj) && langObj.ValueKind == JsonValueKind.Object)
             {
-                var title = GetString(langObj, "titleName");
-                if (!string.IsNullOrWhiteSpace(title))
-                    return title;
+                if (langObj.TryGetProperty("titleName", out var tn))
+                    return tn.GetString();
             }
         }
 
         if (lp.TryGetProperty("en-US", out var en) && en.ValueKind == JsonValueKind.Object)
         {
-            var title = GetString(en, "titleName");
-            if (!string.IsNullOrWhiteSpace(title))
-                return title;
-        }
-
-        foreach (var property in lp.EnumerateObject())
-        {
-            if (property.Value.ValueKind == JsonValueKind.Object)
-            {
-                var title = GetString(property.Value, "titleName");
-                if (!string.IsNullOrWhiteSpace(title))
-                    return title;
-            }
+            if (en.TryGetProperty("titleName", out var tn2))
+                return tn2.GetString();
         }
 
         return null;
     }
-
-    private static string? GetString(JsonElement parent, string propertyName) =>
-        parent.TryGetProperty(propertyName, out var value) && value.ValueKind == JsonValueKind.String
-            ? value.GetString()
-            : null;
 }

src/SharpEmu.Core/Loader/ProgramHeader.cs

@@ -48,8 +48,6 @@ public enum ProgramHeaderType : uint
 
     Tls = 7,
 
-    GnuEhFrame = 0x6474E550,
-
     SceRela = 0x60000000,
 
     SceProcParam = 0x61000001,

src/SharpEmu.Core/Loader/RosettaVectorStorePatch.cs

@@ -1,66 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Runtime.InteropServices;
-using Iced.Intel;
-
-namespace SharpEmu.Core.Loader;
-
-// Use two 128-bit stores to let Rosetta report a memory fault.
-// Keep the source register, general registers, and flags unchanged.
-internal static class RosettaVectorStorePatch
-{
-    internal static bool IsRequired { get; } = IsRosettaProcess();
-
-    private static unsafe bool IsRosettaProcess()
-    {
-        if (!OperatingSystem.IsMacOS() || RuntimeInformation.ProcessArchitecture != Architecture.X64)
-        {
-            return false;
-        }
-
-        int translationStatus = 0;
-        nuint valueByteCount = sizeof(int);
-        return ReadSystemControlValue("sysctl.proc_translated", &translationStatus, &valueByteCount, null, 0) == 0 && translationStatus == 1;
-    }
-
-    [DllImport("libSystem.B.dylib", EntryPoint = "sysctlbyname")]
-    private static extern unsafe int ReadSystemControlValue(string controlName, void* valueBuffer, nuint* valueByteCount, void* newValueBuffer, nuint newValueByteCount);
-
-    internal static bool RequiresStoreSplit(in Instruction instruction) =>
-        instruction.Code is Code.VEX_Vmovups_ymmm256_ymm or Code.VEX_Vmovupd_ymmm256_ymm or Code.VEX_Vmovdqu_ymmm256_ymm &&
-        instruction.Op0Kind == OpKind.Memory && instruction.Op1Register is >= Register.YMM0 and <= Register.YMM15;
-
-    internal static IList<Instruction> SplitVectorStores(IList<Instruction> instructions)
-    {
-        var splitInstructions = new List<Instruction>(instructions.Count * 2);
-        foreach (var instruction in instructions)
-        {
-            if (!RequiresStoreSplit(instruction))
-            {
-                splitInstructions.Add(instruction);
-                continue;
-            }
-
-            var lowerStore = instruction;
-            lowerStore.Code = Code.VEX_Vmovups_xmmm128_xmm;
-            lowerStore.Op1Register = Register.XMM0 + (instruction.Op1Register - Register.YMM0);
-            splitInstructions.Add(lowerStore);
-
-            var upperStore = instruction;
-            upperStore.Code = Code.VEX_Vextractf128_xmmm128_ymm_imm8;
-            upperStore.Op2Kind = OpKind.Immediate8;
-            upperStore.Immediate8 = 1;
-            upperStore.MemoryDisplacement64 = unchecked(instruction.MemoryDisplacement64 + 16);
-            // Use the address size for the displacement size that Iced requires.
-            upperStore.MemoryDisplSize = instruction.MemoryBase is >= Register.EAX and <= Register.R15D ||
-                                        instruction.MemoryIndex is >= Register.EAX and <= Register.R15D ? 4 : 8;
-            // Give the added instruction a separate address for the block encoder.
-            // Keep branch targets at the first store.
-            upperStore.IP = instruction.IP + 1;
-            splitInstructions.Add(upperStore);
-        }
-
-        return splitInstructions;
-    }
-}

src/SharpEmu.Core/Loader/SelfImage.cs

@@ -24,11 +24,7 @@ public sealed class SelfImage
         ulong procParamAddress = 0,
         string? title = null,
         string? titleId = null,
-        string? version = null,
-        uint tlsModuleId = 0,
-        ulong tlsMemorySize = 0,
-        ulong tlsStaticOffset = 0,
-        IReadOnlyList<string>? importedModuleNames = null)
+        string? version = null)
     {
         ArgumentNullException.ThrowIfNull(programHeaders);
         ArgumentNullException.ThrowIfNull(mappedRegions);
@@ -48,10 +44,6 @@ public sealed class SelfImage
         Title = title;
         TitleId = titleId;
         Version = version;
-        TlsModuleId = tlsModuleId;
-        TlsMemorySize = tlsMemorySize;
-        TlsStaticOffset = tlsStaticOffset;
-        ImportedModuleNames = importedModuleNames ?? Array.Empty<string>();
     }
 
     public bool IsSelf { get; }
@@ -83,13 +75,4 @@ public sealed class SelfImage
     public string? TitleId { get; }
 
     public string? Version { get; }
-
-    public uint TlsModuleId { get; }
-
-    public ulong TlsMemorySize { get; }
-
-    /// <summary>Variant II distance from the thread pointer to this module's static TLS base.</summary>
-    public ulong TlsStaticOffset { get; }
-
-    public IReadOnlyList<string> ImportedModuleNames { get; }
 }