Merge #9533's merge of main into feat/agc-msaa-d32s8-stencil-view

The conflict in core/libs/prx/libSceAgcDriver/CMakeLists.txt from #12862's split is resolved with tools/agc_test_split.py resolve, which moves this PR's test registrations into tests/cmake/.
2026-11-05 13:20:11 +00:00 · 2026-10-31 15:06:22 -07:00
commit a63bd1432f
@@ -6,6 +6,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti

 | Name | Kind | Source | Default | Description |
 |------|------|--------|---------|-------------|
+| `ANYPS5_GUEST_ENV_TEST_4C27` | string | `core/libs/tests/GuestEnvironment.cpp` |  | test variable that the guest environment test sets, copies and removes; not a product setting |
 | `ANYPS5_JOB_MANAGER_CASE` | string | `core/libs/tests/JobManagerReference.cpp` |  | selects the CPU fixture run by `tools/run_job_manager_reference.py` |
 | `ANYPS5_JOB_MANAGER_HOST` | presence | `core/libs/tests/JobManagerReference.cpp` |  | runs the reference adapter against the host fallback instead of the loaded guest module |
 | `ANYPS5_LOADEXEC_PARENT` | string | `core/libs/tests/GuestLoadExecHost.cpp` |  | variable the Windows entry stub reads; its wide name is built in `core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp` |
@@ -13,6 +14,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `ANYPS5_POSIX_SPAWN_ROLE` | string | `core/libs/tests/GuestPosixSpawn.cpp` |  | role of the test's own copy spawned as a `posix_spawn` child, which exits or sleeps on it and otherwise fails |
 | `ANYPS5_TEST_QUOTED_ARGV0` | presence | `core/libs/tests/GuestLoadExecHost.cpp` |  | makes the load-exec test's first argument one with quotes, a backslash and non-ASCII text |
 | `APS5_EBOOT` | string | `core/libs/prx/libSceSystemService/Export.cpp` |  | host path of the executable launched for /app0/eboot.bin; unset or empty means the running executable |
+| `APS5_LOAD_EXEC_STANDARD_ERROR` | string | `core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp` |  | marker that the standard-error load-exec test sets in its child process to choose a mode, `list` or `none`; not a product setting |
 | `APS5_SKIP_TIMING_TESTS` | string | `core/libs/tests/PreciseWait.cpp` |  | treats the timing tests' runner as preempted, so they skip without probing the clock; an empty value or one starting with 0 leaves the probe on |
 | `APS5_USBD_DEVICE` | string | `core/libs/tests/GuestUsbd.cpp` |  | selects the USB device a test drives, as vendor:product in hex |

@@ -527,6 +529,12 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 |------|------|--------|---------|-------------|
 | `ANYPS5_SYSTEM_FONTS` | string | `core/libs/prx/libSceFont/src/SystemFont.cpp` |  | directory holding the system fonts, defaulting to anyps5-fonts beside the executable |

+### libSceIme
+
+| Name | Kind | Source | Default | Description |
+|------|------|--------|---------|-------------|
+| `ANYPS5_PSN_DIALOGS` | string | `core/libs/prx/libSceIme/src/PsnDialogNotice.cpp` | silent | when a dialog that needs PlayStation Network opens (profile, friend list, store, invitations, Facebook link, authorized apps), `show` displays a host notice that the feature is not available; `silent`, unset or empty shows nothing, as before; any other value stops the title at its first such dialog with an error naming the variable |
+
 ### libSceNpEntitlementAccess

 | Name | Kind | Source | Default | Description |
@@ -557,6 +565,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | Name | Kind | Source | Default | Description |
 |------|------|--------|---------|-------------|
 | `APS5_SAVEDATA_TRACE` | presence | `core/libs/prx/libSceSaveData.native/Export.cpp` | 3 | logs every save-data operation instead of the first three at each logging site |
+| `ANYPS5_FREE_SPACE` | string | `core/libs/prx/libSceSaveData.native/Export.cpp` | fixed | `fixed` keeps the save sizes and room the title sees today; `host` refuses to create a save whose blocks the save's volume cannot hold (`SCE_SAVE_DATA_ERROR_NO_SPACE_FS`, with the missing blocks in `required_blocks`) and bounds a save's free blocks by the room its volume has; empty or any other value stops the game with an error naming the variable; on Windows an empty value is the same as unset, because `cmd` and PowerShell remove the variable |

 ### libSceSystemService

@@ -577,6 +586,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `ANYPS5_DISPLAY_INDEX` | integer | `core/libs/prx/libSceVideoOut/src/DisplayWindow.cpp` | 0 | SDL display index used for the initial window size and centered position; invalid or unavailable indices fail window creation; selection does not guarantee the window will not activate |
 | `ANYPS5_FULLSCREEN` | presence | `core/libs/prx/libSceVideoOut/src/DisplayWindow.cpp` |  | opens the display window fullscreen at the desktop resolution when set to a non-empty value other than 0; F11 still switches back |
 | `ANYPS5_INPUT_CONFIG` | string | `core/libs/prx/libSceVideoOut/src/InputMapping.cpp` |  | path of the input mapping file that binds host keys and mouse to guest pad actions |
+| `ANYPS5_PAD_PORT0_STATE` | string | `core/libs/prx/libSceVideoOut/include/Port0Presence.hpp` | default | `default` keeps port 0 connected and user 0 logged in as before; `controller` makes port 0 and user 0 follow the controller bound to slot 0, a change committed after 500 ms, and a withdrawn port 0 reads zeroed and disconnected; any other value, including an empty one, stops the game when video output starts with an error naming the variable |
 | `ANYPS5_REQUIRE_DISPLAY` | presence | `core/libs/prx/libSceVideoOut/tests/Flip.cpp` |  | makes video-out tests fail instead of skipping when no display or Vulkan device is available |
 | `APS5_NO_PAD_INPUT` | presence | `core/libs/prx/libSceVideoOut/src/PadInput.cpp` |  | ignores keyboard and mouse input so a measurement run is not advanced by a stray press |
 | `APS5_NO_WGI` | presence | `core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp` |  | turns off SDL's Windows.Gaming.Input joystick backend at default hint priority, on Windows hosts where it faults a few seconds into every run |
@@ -0,0 +1,5 @@
+# libSceAbstractTcs technical debt
+
+### Functional
+
+- [Older callable NIDs](../../../core/libs/prx/libSceAbstractTcs/Export.cpp): 40 unidentified exports have unverified names, signatures and behavior. These are throwing import-resolution placeholders; no functionality is implemented. No matching NIDs were found in the later module inventory.
@@ -105,7 +105,8 @@
 - [HTILE address of a depth array slice](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - `decodeDepth` adds the `DB_DEPTH_VIEW` slice offset to the Z and stencil addresses but not to `htileAddress`, so every slice of a layered depth target shares slice 0's HTILE address and a fill of slice 0's HTILE marks all slices cleared. Astro's Playroom fills the HTILE of each of its three shadow cascades 0x40000 apart (0x24000 bytes of tiles each) back to back before drawing, so the result is still right there; a title that clears one slice between draws to another would lose depth. The per-slice HTILE stride is not derived yet.
 - [sceAgcDriverGetHsOffchipParam](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver, NID `r28hEh6cNH0`) - declared as a throwing stub. The two `uint16_t` output pointers and integer return type follow [ps5-vulkan](https://github.com/blackbearreloaded/ps5-vulkan/blob/4bb0c8b1423698a7369efc22b829bf16a99e7128/native/tess_driver_import_stub.c#L10), which reads the pair before it binds a tessellation factor ring. The meaning of the two values, their initial state and how they relate to `sceAgcDriverSetHsOffchipParam`, which keeps nothing here, are unknown; the stub does not write caller memory. PPSA99011 imports it
 - [Vertex input and color target overlap](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (AGC driver) - direct draws exclude the descriptor prefix skipped by `firstVertex` or `firstInstance` from the alias check; indexed draws conservatively use index zero as the lower bound before adding `firstVertex`. Indirect draws still check the full descriptor extent. Reads of the active target's bytes remain unsupported; same-draw console ordering is not established.
- [PS4 (GCN) tiling](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureTiling.cpp) (libSceAgcDriver, PS4) - not checked on a console. Surfaces with `GuestTextureResource::gcnPitch` set use the GB_TILE_MODE and GB_MACROTILE_MODE tables of [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/video_core/amdgpu/tiling.cpp) and addrlib's `ComputeSurfaceAddrFromCoordMicroTiled` and `MacroTiled`: 8x8 micro tiles in thin, depth or display element order, macro tiles with pipe config P8_32x32_16x16 (P8_32x32_8x16 for the two PRT thin modes), bank width 1 and a 256-byte pipe interleave, depth micro tiles split into slices a whole surface apart with the bank rotated by (banks / 2 + 1) per slice, PRT pipe and bank taken from the coordinates inside the macro tile, and LINEAR_GENERAL rows of exactly the pitch. [TextureTiling.cpp](../../../core/libs/prx/libSceAgcDriver/tests/TextureTiling.cpp) compares it with a separate implementation of the addrlib formulas.
+- [PS4 (GCN) tiling](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureTiling.cpp) (libSceAgcDriver, PS4) - not checked on a console. Surfaces with `GuestTextureResource::gcnPitch` set use the GB_TILE_MODE and GB_MACROTILE_MODE tables of [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/video_core/amdgpu/tiling.cpp) and addrlib's `ComputeSurfaceAddrFromCoordMicroTiled` and `MacroTiled`: 8x8 micro tiles in thin, depth or display element order, macro tiles with pipe config P8_32x32_16x16 (P8_32x32_8x16 for the two PRT thin modes), bank width 1 and a 256-byte pipe interleave, depth micro tiles split into slices a whole surface apart with the bank rotated by (banks / 2 + 1) per slice, PRT pipe, and for GB_TILE_MODE 11 and 16 bank, taken from the coordinates inside the macro tile, and LINEAR_GENERAL rows of exactly the pitch. [TextureTiling.cpp](../../../core/libs/prx/libSceAgcDriver/tests/TextureTiling.cpp) compares it with a separate implementation of them.
+- [PS4 (GCN) 2D PRT tiling](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureTiling.cpp) (libSceAgcDriver, PS4) - not checked on a console. GB_TILE_MODE 6, 7, 12 and 17 take the bank from the coordinates inside the macro tile, as shadPS4 does; AMD's addrlib (Mesa 393bf0d1467c) and fpPS4 (04cefd43e6fd) use the whole coordinates for the bank of these 2D PRT modes and take it inside the macro tile only for modes 11 and 16, which fpPS4 documents as the ones that can alias virtual pages to one physical page.
 - [PS4 (GCN) thick and layered surfaces](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureTiling.cpp) (libSceAgcDriver, PS4) - 3D and thick modes (GB_TILE_MODE 15 and 19 to 26) throw, and so does a storage image or a depth plane of a layered surface with several mip levels. A sampled layered surface with several mip levels is stored level by level, which is not checked on a console; [GcnDetile.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/GcnDetile.cpp) runs the GPU detiler over every mode that does not throw. The bank of each layer of a tiled 2D array is rotated by (banks / 2 - 1) times the layer index outside the PRT modes, XORed in as AMD's address library and shadPS4 (`tiling.comp`, 0614ce324be0) do; fpPS4 (`ps4_tiling.pas`, 04cefd43e6fd) adds it to the bank instead. Not checked on a console.
 - [PS4 render targets and display buffers](../../../core/libs/prx/libSceAgcDriver/Execution/src/DisplayBuffer.cpp) (libSceAgcDriver, PS4) - a tiled PS4 display buffer is read as Display2DThin with rows padded to 128 elements, as shadPS4's `image_info.cpp` does. A PS4 render target spans its surface padded to whole macro tiles (1920x1080 at 32 bits is 1920x1088), the display buffer is its top-left corner, and a texture over that corner with the same pitch, tiling and texel size is a [GPU copy](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) of it. A PS4 `DB_Z_INFO` names a GB_TILE_MODE index; the depth image stays on the GPU and HTILE is kept, as for the PS5. shadPS4 (`image_info.cpp`, 0614ce324be0) rounds the width of a tiled display buffer up to a multiple of 128 itself, whereas `DisplayBufferSize` requires the pitch to be one already.
 - [PS4 pattern fill](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp) (libSceAgcDriver, PS4) - the PS4 build of the pattern-fill compute kernel seen in Limbo (CUSA01664), with user data s[4:7] a 32-bit UINT source, s[8:11] the 32-bit UINT destination and s[12:15] a control record of count and index mask, where thread i stores source[i & mask], runs as a GPU fill when the mask is 0, a single repeated dword; other masks run the kernel, since running Limbo's two-dword clears of a 64-bit target as fills made its gameplay advance more slowly per frame. The kernel is recognized by its code, not by an SDK symbol.
@@ -166,7 +167,7 @@
 - [Pipeline journal](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp) (libSceAgcDriver): resident graphics pipelines are bounded by count, not bytes: the store grows from 1024 to 4096 entries for a replay that does not fit and for evicted pipelines that keep coming back, and the last `APS5_PIPELINE_JOURNAL_ENTRIES` (4096) records are all replayed, so a pipeline the title never asks for again costs its memory until teardown. `agc_driver_recorder_tests --benchmark-pipeline-store-memory [count]` gives a floor with the triangle shaders: about 59 KiB host and no device memory per pipeline on an RTX 4090, 100 KiB host and 8 KiB device-local on a UHD 770; larger shaders cost more. The file is rewritten to three quarters of `APS5_PIPELINE_JOURNAL_MAX_MIB` when full. A compute pipeline is replayed over the layout `DescribeSetLayouts` derives, checked only under `APS5_VERIFY_SET_LAYOUTS=1`. The header's format number guards the recipe codec and the store key.
 - [Graphics pipeline libraries](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp) (libSceAgcDriver): a pipeline is fast-linked at the draw and relinked with `VK_PIPELINE_CREATE_LINK_TIME_OPTIMIZATION_BIT_EXT` on a background thread, and binds the optimized one from the next draw on. Draws recorded before that use the fast link, whose vertex stage keeps the outputs the fragment stage does not read: on RADV (Radeon 660M, Mesa 26.2.4) 346 of 483 Astro's Playroom vertex shaders paired with a fragment stage that reads none of them used more VGPRs (median 8 more, up to 2.5 times), and on an RTX 4090 13 of 15 PPSA36082 vertex shaders up to 68 instead of 38 (#2242). The optimized link compiles to the same code as a whole pipeline
 - [Fragment shader interlock pipelines](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp) (libSceAgcDriver): a pipeline whose fragment shader declares a fragment shader interlock capability is never built from graphics pipeline libraries, on every driver, so it is compiled whole at the draw with no fast link to bridge the compile. RADV's fast link ([mesa#16653](https://gitlab.freedesktop.org/mesa/mesa/-/work_items/16653), Mesa 26.2.5, RX 7900 GRE) jumps to the PS epilog without waiting for the shader's stores, and the epilog's `done` export ends the GFX11 primitive-ordered section, so the next overlapping wave reads the old value: `agc_driver_pixel_interlock` lost read-modify-writes in 108 of 120 loaded runs under `APS5_NO_PIPELINE_LTO=1`. On an RTX 4090 (NVIDIA 617.42, Windows) the fast link kept the ordering in 240 of 240 loaded runs; other drivers are not measured.
- [Prebuilt pipeline libraries](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver): each registered vertex or pixel shader in registration form gets its pre-rasterization or fragment-shader library built on one background thread, with a fixed state the draw may not use: triangle list, counter-clockwise front face, no depth clamp, depth bias or conservative rasterization, first provoking vertex, one sample. Libraries are kept until the device is torn down; on Astro's Playroom 1948 of them added 0.44 GB of peak memory on RADV.
+- [Prebuilt pipeline libraries](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver): each registered vertex or pixel shader in registration form gets its pre-rasterization or fragment-shader library built on the prebuild thread pool, with a fixed state the draw may not use: triangle list, counter-clockwise front face, no depth clamp, depth bias or conservative rasterization, first provoking vertex, one sample. Libraries are kept until the device is torn down; on Astro's Playroom 1948 of them added 0.44 GB of peak memory on RADV.
 - [`APS5_THREAD_PRIORITY=rt`](../../../core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp) (libSceAgcDriver) lowers the process's hard `RLIMIT_RTTIME` when it is above `APS5_THREAD_RTTIME_US` or rtkit's `RTTimeUSecMax`, because [rtkit](https://github.com/heftig/rtkit/blob/c295fa849f52b487be6433e69e08b46251950399/rtkit-daemon.c#L592-L637) (`verify_process_rttime`) reads the hard limit from `/proc/<pid>/limits` and refuses real-time scheduling when it is higher. An unprivileged process cannot raise the hard limit again, so it stays lowered for the process and its threads even when rtkit then refuses the request (burst limit, user or start-time checks) and the thread throws. rtkit's `MaxRealtimePriority` and `RTTimeUSecMax` are read first, so an unreachable rtkit or a priority above its maximum leaves the limit untouched. The lowered limit only matters for threads that later run under a real-time policy
 - On a device without VK_EXT_robustness2's `nullDescriptor`, such as MoltenVK, a null image descriptor in a typed heap is a [placeholder image](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PlaceholderImages.cpp) of that heap's type, 1×1 and cleared to zero, which every null descriptor of the heap shares. Reads give zeros, as `nullDescriptor` allows, but stores and atomics to it are kept, so a later read of a null storage image can return them, and a depth comparison compares against depth 0. A heap whose placeholder the device cannot create, for example 1D or 3D depth, 64-bit atomics without 64-bit image atomics, or multisampled storage without `shaderStorageImageMultisample`, throws when a null descriptor reaches it.
 - [Draw input snapshots](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver): `PrepareDrawBindings` caps read-only input buffer snapshots at 64 MiB (overridable via `APS5_DRAW_SNAPSHOT_MAX_MIB`). Larger inputs (streaming heaps, bindless pools) or draws exceeding the cumulative budget skip the per-draw snapshot and bind in place, avoiding multi-gigabyte CPU copy stalls (such as Ratchet & Clank: Rift Apart PPSA01474 stalling at frame ~380 copying 36 GB every 5 s). If the title rewrites those large ranges on the CPU before GPU completion, the in-place binding observes the modification, as verified by `drawSnapshotCapTests`.
@@ -245,6 +246,7 @@
 - [One-sample color targets beside a multisampled depth target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a one-sample color target drawn with a depth target of the rasterizer's sample count is taken to keep the coverage of sample 0 after the depth and stencil tests. That is the rule of [`VK_AMD_mixed_attachment_samples`](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/fragops.adoc#L2510-L2516), and it is not measured on hardware. The draw needs `VK_AMD_mixed_attachment_samples`, or `VK_NV_framebuffer_mixed_samples` with truncated coverage reduction, for its sample count and throws without them. With `PS_ITER_SAMPLE` the color is the output of sample 0's invocation. Overrasterization and color targets of different sample counts throw.
 - [DCC display buffers](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) are presented only when all keys of the console's DCC extent agree on uncompressed or a fast-clear code, padding keys included; other keys, and register-clear keys over a pending image, throw.
 - [Storage image write-back](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) stores the GPU results over a CPU-stamped range whose guest bytes equal the copy taken when the image's layers got their generation (images up to 1 MiB whose guest bytes were settled at that point, with no unit shadow, pending image results or recorded GPU store over them; other images keep the previous rule: the CPU's bytes win). A CPU store that rewrites the baseline value after the GPU changed it is not told apart from no store, and the GPU result wins there. The 1 MiB limit is a choice, not a console value. A range a queued draw commit still has to read is left pending whatever the stamps say ([`DrawPipeline::HeldReads`](../../../core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp)), so a title that recycles one allocation between an index buffer and a storage image sees the draw's own indices; the trade is a title that reads a surface as index data and means the image gets the pre-image bytes instead, since the reservation does not compare the command-stream positions of the draw and of the image's write. `APS5_NO_QUEUED_DRAW_READ_ORDER=1` restores the old behaviour, and the `[storage]` line counts the listings the hold turned away (`held for a queued draw read`) and the `[draw] pipelined` line the stores it held. The hold covers what the commit reads of guest memory: the index range, the vertex input ranges as their descriptor extents ([`QueuedDrawReadRanges`](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/WrittenBuffers.cpp), since the bytes a draw fetches depend on the highest index, which only the commit knows) and the source of a queued DMA copy. Every other commit-time read goes through the flush hook, so it sees the bytes the hold protects. Two commit-time reads are outside the hold: the texels a register or cmask clear materialization reads from the draw's own colour target (through the hook, so ordered, but the hold does not cover a render target), and a CPU read whose store the hold turned away, which sees the pre-image bytes. Nothing retries a refused store: the image reaches guest memory with the next flush of that range (the queue worker's idle store, a `WAIT_REG_MEM` poll over it, a later read or write of it). A kept 64 KiB unit that lies outside every (slice, level) window stores nothing: the tracking grid is flat over the guest range while 3D slices taper in depth with the mip level (`HasLayer`), so the higher depth slices' higher-level blocks belong to no window. The console's tracking of such units is not measured.
+- [Queue-idle storage write-back](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/QueueWorker.cpp) (libSceAgcDriver) - storage-image results that nothing flushes, waits for or overwrites reach guest memory only after every queue has been idle for 50 ms, where the console's GPU writes them to memory as it runs. The idle store goes 4 MiB at a time and stops as soon as queue 0 has queued work or another queue is running, leaving the rest for the next idle period. A title whose frame gaps pass 50 ms still starts an idle store between two frames, and its next frame waits for the piece in progress: a title's movies at about 25 fps (frame gaps up to 65 ms) show frames of up to about 100 ms there.
 - [16-bit float display buffers](../../../core/libs/prx/libSceAgcDriver/Execution/src/DisplayBuffer.cpp) (libSceAgcDriver, libSceVideoOut) - pixel formats `0xC001000622000000` and `0xC001000600000000` are taken as R16G16B16A16 and B16G16R16A16 float, eight bytes per texel, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/59183dbfa81ed7efdff6069177fed50de0552725/src/graphics/host_gpu/renderer/image/imageInfo.h) maps them and [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/VideoOut/VideoOutTypes.cs) names them (`Rgba16Float`, `Bgra16Float`); PPSA11386 registers 3840x2160 tiled buffers of the first. The tiled layout is assumed to be the 8-byte SW_64KB_R_X equation of `TextureSwizzleEquations.hpp` applied to full coordinates, as addrlib applies it, by analogy with the 32-bit scanout; `ColorTargetLayout` applies the equations to in-block coordinates, which for 8-byte texels differs in every odd 64-row block row (address bit 11 takes y bit 6) and for 16-byte texels also differs, so a float display buffer written through `WriteColorTarget` and presented from guest memory would show those rows misplaced. The values are assumed to be linear light and are encoded with the sRGB curve for the 8-bit output. Bits 32-39 of these formats are `0x06`, as in the 10-bit formats SharpProspero lists without sRGB transfer, while its sRGB formats have `0x00`, its 10-bit PQ formats `0x04` (with `0x07` in bits 40-47) and its float BT.2100 PQ formats `0x07`: they show only that these formats are not the sRGB ones. NaN and negative values give 0, values of 1 and above give 255, alpha is linear. Neither the layout nor the transfer is verified against console or title frames, and HDR output is not modelled. DCC metadata on a float buffer throws.
 - [BT.2100 PQ display buffers](../../../core/libs/prx/libSceAgcDriver/Execution/include/PqToSdr.hpp) (libSceAgcDriver, libSceVideoOut) - pixel formats `0x8100070422000000` and `0x8100070400000000` are taken as 10:10:10:2 texels with BT.2020 primaries and the SMPTE ST 2084 transfer, red or blue in the low bits, as [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/VideoOut/VideoOutTypes.cs) names them (`Rgb10A2Bt2100Pq`, `Bgr10A2Bt2100Pq`) and [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/59183dbfa81ed7efdff6069177fed50de0552725/src/graphics/host_gpu/renderer/image/imageInfo.h) maps the first; PPSA01317 registers display buffers of the first when its output reports HDR. With HDR output they are presented unchanged through an HDR10 swapchain (`VK_COLOR_SPACE_HDR10_ST2084_EXT`, 10-bit, with `VK_EXT_hdr_metadata`); otherwise they are converted to 8-bit sRGB: ST 2084 EOTF, BT.2020 to BT.709 primaries with negative components clipped, a luminance tone map and the sRGB encoding. The tone map is ours: min(203 nits, white level) is SDR white (the BT.2408 HDR reference white), luminance passes unchanged up to 0.75 of it and an extended Reinhard shoulder above reaches 1.0 at the white level, the peak sceSystemServiceGetHdrToneMapLuminance last reported to the title (or the current one when it never asked), since titles read it once. How a console shows such a buffer on an SDR display is unknown. Alpha is opaque.
 - [HDR output override](../../../core/libs/prx/libSceAgcDriver/Execution/src/HostHdr.cpp) - setting `APS5_FORCE_SDR` suppresses HDR availability reported to titles while retaining the detected display and surface capabilities. It selects the existing SDR presentation path; it does not add support for floating-point BT.2100 PQ buffers (`0xC001070722000000` and `0xC001070700000000`), whose presentation remains refused. The override does not change the host display settings.
@@ -7,7 +7,7 @@
 ### Unknown function info

 - [sceAmprAmmSetPageTablePoolOccupancyNotificationThreshold](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - throws as unimplemented. The `(int threshold)` signature follows [drakmor/ampr_emu](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/src/sceampr_exports.cpp#L336-L337), where the export passes the threshold to `sceKernelMapperSetPageTablePoolOccupancyNotificationThreshold(int)`; not measured on a console. The thresholds the kernel rejects, their error codes and how the notification is delivered are unknown, and no title is known to call it (Planet Zoo, PPSA18026, imports it).
- [AMPR command buffer null arguments](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - the result for a null command buffer is unknown for `sceAmprCommandBufferConstructor`, `sceAmprAprCommandBufferConstructor`, `sceAmprCommandBufferReset` and `sceAmprCommandBufferSetBuffer`; these return `SCE_KERNEL_ERROR_EINVAL` here, but the behavior has not been confirmed on a PS5.
+- [AMPR command buffer null arguments](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - the result for a null command buffer is unknown for `sceAmprCommandBufferConstructor`, `sceAmprAprCommandBufferConstructor`, `sceAmprCommandBufferReset`, `sceAmprCommandBufferSetBuffer` and `sceAmprCommandBufferGetSize`; the first four return `SCE_KERNEL_ERROR_EINVAL` here, and `sceAmprCommandBufferGetSize` chooses 0, but none of the null behaviour has been confirmed on a PS5.
 - [AMPR WriteAddressFromCounterPairOnCompletion](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - the pair of an even counter n is assumed to give counter n in the low 32 bits and n + 1 in the high 32 bits. Wait compare values, wait flush and counter index ranges follow the [ampr_emu](https://github.com/drakmor/ampr_emu) reimplementation; the flush is accepted and has no effect, as commands run in order
 - [AMPR command buffer offsets](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - recording with a current offset greater than the bound memory size throws before calculating remaining capacity or writing a command. This validates the emulator's own command-buffer encoding; the console's response to a corrupted opaque buffer object is unknown.
 - [AMPR command sizes](../../../core/libs/prx/libSceAmpr/Export.cpp) (libSceAmpr) - non-`Nop` commands use host encoding with an 8-byte header, exceeding console sizes. On overflow, the buffer expands up to a 32 MiB cap on the guest heap, relocating `base` and `size`; below this cap a full buffer avoids `EBUSY`, placing commands in host memory not allocated by the guest, and AMM submits resolve original pointers to expanded memory. Rebinding the same memory via `SetBuffer` frees prior expansions and resets that buffer's offset and commands to 0. Beyond the cap, appends return `EBUSY`. `Nop(n)` is n dwords and `NopWithData(n)` (n + 1) dwords with header `0x5452000F | payloadDwords << 8 | (type & 0xF) << 12`, and `ConstructNop` writes its word before payload and zeroes padding (FW 13.42, #10936); null `base` reports before count or range. `NopWithData` and `ConstructNop` stop at the record without trailing zeros. The at-start flag of `_04_00` writes is ignored; commands run in order.
@@ -6,10 +6,7 @@

 | Name | NID |
 | --- | --- |
-| `sceAppContentCheckBundleLicenseOnDisc` | `xZo2-418Wdo` |
 | `sceAppContentDownloadDataGetBlockSize` | `9ht66cHTj7g` |
-| `sceAppContentGetGameTrialsFlag` | `1saJukIkcKw` |
-| `sceAppContentGetPlayableStatus` | `y8meQn-Qy5c` |

 - [sceAppContentDownloadDataGetAvailableSpaceKb](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - a title whose `param.json` declares `downloadDataSize` 0 gets 0 KB and OK; the console's behaviour for a title without a download data area is unverified (it may return an error instead). KytyPS5 does not special-case it, and shadPS4 stubs 1048576 KB. One disassembled title (PPSA15246) calls it with the `/download0` mount point and a zeroed 64-bit output, ignores the return value and multiplies the output by 1024, so for that title an error that leaves the output untouched and an OK with 0 KB look the same
 - [sceAppContentDownloadDataFormat](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - empties the `/download0` directory, creating it if needed. Imported by PPSA01317. A null mount point returns `PARAMETER` and another mount point returns `NOT_MOUNTED` as in `sceAppContentTemporaryDataFormat` and `sceAppContentDownloadDataGetAvailableSpaceKb`; the console's error codes for both and its behaviour with files still open are unverified
@@ -23,5 +20,7 @@
 - [Additional content](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) is not installed or mounted: `sceAppContentAddcontMount` answers `NOT_FOUND` for every entitlement label and `sceAppContentAddcontUnmount` for every mount point, as no add-content mount is ever handed out; `sceAppContentGetAddcontInfo` answers `DRM_NO_ENTITLEMENT` for every label and `sceAppContentGetAddcontInfoList` reports 0 entries; `sceAppContentAddcontEnqueueDownload` answers `PARAMETER` for a null label and `NOT_FOUND` otherwise, since no download is ever queued; `sceAppContentAddcontDelete` answers `PARAMETER` for a null label and `NOT_FOUND` otherwise, since no additional content is ever installed. `sceAppContentGetAddcontDownloadProgress` answers `PARAMETER` for a null label or progress and `NOT_FOUND` otherwise, as [dlc_emu](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.cpp#L2328-L2341) does for a label that is not installed additional content, and never writes the progress. Its 16-byte layout (`DataSize`, then `DownloadedSize`, both 64-bit) follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/AppContent/AppContent.cs#L45-L54) and is unused here. The signatures of `sceAppContentAddcontEnqueueDownload` and `sceAppContentGetAddcontDownloadProgress` follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/AppContent/AppContent.cs#L140-L148), and the signature of `sceAppContentAddcontDelete` follows [dlc_emu](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.h#L91-L92); dlc_emu is not a console measurement and no console source gives the error codes, so the signatures and the error codes are unverified
 - [sceAppContentAddcontEnqueueDownloadByEntitlemetId, sceAppContentAddcontEnqueueDownloadSp, sceAppContentAddcontMountByEntitlemetId and sceAppContentAddcontShrink](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - unverified on a PS5. After the initialization guard they answer `PARAMETER` for a null argument and `NOT_FOUND` otherwise, without writing the mount point, as [dlc_emu](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.cpp#L2125-L2209) does for content it does not know; the prototypes are [dlc_emu's](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.h#L88-L99). dlc_emu rejects a padded label at every SDK while the label calls above check it only from SDK 0x01500000 or 0x03500000, so `Sp` and `Shrink` answer `PARAMETER` for one from SDK 0x03500000 and throw below it
 - [sceAppContentGetAddcontInfoByEntitlementId, sceAppContentGetAddcontInfoListByIroTag and sceAppContentGetPftFlag](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - unverified on a PS5. After the initialization guard they give [dlc_emu's](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.cpp#L2040-L2086) answers for content it does not know: `DRM_NO_ENTITLEMENT` without writing the info, 0 entries for any tag (a null `hitNum` beside a list returns 0, unlike `sceAppContentGetAddcontInfoList`), and a [PFT flag of 0](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.cpp#L2343-L2347), and `PARAMETER` for null arguments, with dlc_emu's [prototypes](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.h#L74-L131)
+- [sceAppContentCheckBundleLicenseOnDisc and sceAppContentGetPlayableStatus](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - unverified on a PS5. After the initialization guard both give [dlc_emu's](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.cpp#L2211-L2256) `NOT_FOUND` for content it does not know, without writing the playable status. Null arguments return `PARAMETER`, as does a padded label from SDK 0x03500000, as [dlc_emu](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.cpp#L1570-L1576) checks GetPlayableStatus and @akkadbakkad89 [read](https://github.com/boykopovar/AnyPS5/pull/13673#issuecomment-6545629239) CheckBundleLicenseOnDisc in firmware 4.03 (dlc_emu: 0x01500000). Prototypes from [dlc_emu](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.h#L100-L109).
+- [sceAppContentGetGameTrialsFlag](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - unverified on a PS5: after the initialization guard it writes a flag of 0, as [dlc_emu](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.cpp#L2211-L2256) does for content it does not know, and a null pointer returns `PARAMETER`. The prototype is [dlc_emu's](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.h#L100-L109).
 - [sceAppContentGetEntitlementKey](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - the service result without an entitlement is unverified: this model returns `DRM_NO_ENTITLEMENT` and leaves the 16-byte key unchanged. Initialization, null-pointer and SDK 0x01500000 label-padding checks match the reported [firmware 13.42 module probe](https://github.com/boykopovar/AnyPS5/pull/9638#issuecomment-6390573735), run in an emulator, not on hardware. That module forwards service labels 0, 7, 8 and 0xFFFFFFFF without checking them; this library ignores the service label. The system service's own validation and errors remain unknown.
 - [Temporary app-content storage](../../../core/libs/prx/libSceAppContent/Export.cpp) console behaviour and hardware return values are unverified, including behaviour with open files across unmount; host filesystem failures throw. Storage models one `/temp0` mount, preserving files on unmount while rejecting new path resolutions until remount, and leaving existing open host descriptors usable. `sceAppContentTemporaryDataMount` delegates to `sceAppContentTemporaryDataMount2` with option 1 (`TEMPORARY_DATA_OPTION_FORMAT`) to format on mount as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/app_content/app_content.cpp#L550-L553) does. Mount, format, space-query and unmount errors follow [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/sys/sys_path.pas); pointer ABI follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/AppContent/AppContent.cs).
@@ -2,7 +2,7 @@

 ### Silent stubs

- [libSceAudio3d](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - `sceAudio3dObjectSetAttributes` validates the port, the reserved object and the attribute array (an object id that was never reserved returns the invalid-object error, while shadPS4 returns success for it; neither is measured on a console), treating the reset-state attribute as valid with a null value and requiring a value for the others, but the identifiers and the value of each are not interpreted, so an object has no samples, no gain and no position: the ids of the `PCM`, `GAIN` and `POSITION` attributes and the `POSITION` layout are unknown (the aerolib NID list gives the names only, the Orbital IDA type database the signatures only and shadPS4's values are PS4). `sceAudio3dPortSetAttribute` accepts the late reverb level and the downmix spread attributes and ignores them, and `sceAudio3dPortFlush` drops the frames queued by `sceAudio3dPortAdvance` instead of mixing and submitting them to an output
+- [libSceAudio3d](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - `sceAudio3dObjectSetAttributes` makes the firmware 13.42 checks (the count and the array, then the port, attribute ids 1 to 11, the format and sample count of a `PCM` block, the reserved object, then a value for every id except `RESET_STATE`) but applies nothing, so an object has no samples, no gain and no position; the value checks AudioOut2 makes when it applies them are not modelled. `sceAudio3dPortSetAttribute` checks the late reverb level (0 to 1), the downmix spread radius (0.1 to 2) and the height-aware value as firmware 13.42's AudioOut2 (libSceAudioOut.sprx) does when Audio3d passes them on, and ignores them, and `sceAudio3dPortFlush` drops the frames queued by `sceAudio3dPortAdvance` instead of mixing and submitting them to an output

 ### Functional

@@ -10,18 +10,18 @@

 ### Unknown function info

- [sceAudio3dPortOpen](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - buffer modes 0 and 1 (also selected by the 0x10 and 0x18 parameter sizes, whose missing fields take the 512 objects and depth 2 that shadPS4 and prosper both fill in before the checks) and 3 beds depend on an SDK version check in the module ([prosper](https://github.com/mattias800/prosper)) and throw. A repeated `sceAudio3dInitialize` (`NOT_READY` in shadPS4, 0 in prosper) and `sceAudio3dPortAdvance` on a full queue (`NOT_READY` in shadPS4, unhandled in KytyPS5) throw too
+- [sceAudio3dInitialize](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - a repeated call throws (`NOT_READY` in shadPS4, 0 in prosper). In firmware 13.42 a PS5 process gets 0 when `sceAudioOut2Initialize` returns 0 again and `NOT_READY` when it returns 0x80268004, and this project's `sceAudioOut2Initialize` does not model a repeated initialization. A PS4 process gets `NOT_READY` for a repeated call before `reserved` is checked, as in the firmware
 - [sceAudio3dPortGetAttributesSupported](../../../core/libs/prx/libSceAudio3d/Export.cpp): the native export validates the port before the count pointer, writes the total count without reading its incoming value, and writes the complete list when an array is supplied. These checks are matched. The list itself remains the host's three port attributes: the native list derives from AudioOut2 device capability masks, SDK version and platform mode, which the host does not yet model.
- [sceAudio3dObjectReserve](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - object ids, the `max_objects` limit and the checks of `sceAudio3dObjectReserve` and `sceAudio3dObjectUnreserve` follow [shadPS4](https://github.com/shadps4-emu/shadPS4) (PS4), the only reference with a body: ids count up from 1 per port, skipping 0, 0xFFFFFFFF and ids in use, and a failed reserve writes 0xFFFFFFFF
- [sceAudio3dPortOpenEx](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature: shadPS4, SharpProspero, Orbital's IDA type database and prosper do not declare it
- [sceAudio3dPortCreate](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - opens with a 0x10 parameter block, as [shadPS4](https://github.com/shadps4-emu/shadPS4) (PS4) does, so it always selects buffer mode 0 and throws once its arguments pass, like `sceAudio3dPortOpen` with that block. A null port id or a non-zero reserved argument returns `INVALID_PARAMETER` before the initialization check, which follows shadPS4, the only reference with a body; it is unmeasured on a PS5
- [sceAudio3dPortDestroy](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - throws: what it does is unknown. The signature (a port id) comes from the [Orbital](https://github.com/AlexAltea/orbital) IDA type database and [SharpProspero](https://github.com/SvenGDK/SharpProspero); shadPS4 only logs and returns 0, and no other reference has a body
- [sceAudio3dPortGetStatus](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - throws: the status layout and what it reports are unknown. The signature (a port id and a status pointer) comes from [SharpProspero](https://github.com/SvenGDK/SharpProspero); shadPS4 only logs and returns 0, and no other reference has a body
- [sceAudio3dReportRegisterHandler](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature: shadPS4 declares it without arguments and only logs and returns 0; SharpProspero, Orbital's IDA type database and prosper do not declare it
- [sceAudio3dReportUnregisterHandler](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature: shadPS4 declares it without arguments and only logs and returns 0; SharpProspero, Orbital's IDA type database and prosper do not declare it
+- [sceAudio3dObjectReserve](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - object ids and the `max_objects` limit follow [shadPS4](https://github.com/shadps4-emu/shadPS4) (PS4), the only reference with a body: ids count up from 1 per port, skipping 0, 0xFFFFFFFF and ids in use. In firmware 13.42 AudioOut2 hands out the ids. The checks follow firmware 13.42: the port first, leaving the id untouched, then the pointer, and a failed reserve then writes 0xFFFFFFFF
+- [sceAudio3dReportRegisterHandler](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - the 20 call reports reach the type 0 handlers after the call's own lock is released, while firmware 13.42 calls them under its report lock, where a handler that registers or unregisters a handler never returns. Here a report already under way on another thread can still call a handler after `sceAudio3dReportUnregisterHandler` returned, which the console's lock prevents
+- [sceAudio3dPortDestroy](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - closes port 0 through `sceAudio3dPortClose`. Firmware 13.42 passes the port's AudioOut2 context number, not the port id, to `sceAudio3dPortClose`, which accepts only 0, so the console closes the port only when that number is 0. The number comes from the audio service and cannot be read from the module; this project's port is context 0
+- [sceAudio3dPortOpen](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - a failed open leaves the open port's settings alone, while firmware 13.42 stores a parameter block of a known size before it checks the user, the values or the open port, so on the console a failed open while a port is open changes the granularity and buffer mode that `sceAudio3dAudioOutOpen`, `sceAudio3dPortAdvance` and `sceAudio3dPortPush` check afterwards
+- [sceAudio3dPortOpen, sceAudio3dPortPush, sceAudio3dBedWrite2 and sceAudio3dAudioOutOpen in a PS4 process](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - firmware 13.42 stores `sceKernelIsPs4Process` at `sceAudio3dInitialize` and takes a PS4 branch in these calls. Its answers are followed where this project can give them: buffer mode 0 to 2 and 2 or 3 beds are valid, route 1 is rejected on a 2-bed port, and type 3 with `param` bit 17 is 0x80260007. Buffer modes 0 and 1 and 3 beds throw (not modelled), and so do formats 6 and 7, which the firmware rewrites to 2 and 5 for a PS4 SDK up to 0x3FFFFFF while `sceKernelGetPs4CompiledSdkVersion` throws here. For a PS4 SDK of 0x11000000 or later the firmware also advances the AudioOut2 context after a successful open and after a push that leaves the queue empty, unless `sceAudio3dPortOpenEx` was called; neither advance happens here. Routes 1 and 2 play on both outputs
+- [sceAudio3dBedWrite2](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - 24 channels return `INVALID_PARAMETER`, while firmware 13.42 also accepts 24 (besides 2, 6 and 8) and passes the bed to AudioOut2, whose handling of it is unknown
 - [sceAudio3dCreateSpeakerArray](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - the speaker-array calls return the AudioOut2 result unchanged: the console translates AudioOut2 speaker-array errors into Audio3d codes, but this project's AudioOut2 speaker-array calls throw instead of returning error codes, so there is nothing to translate yet
 - [Audio3d bed downmix coefficients](../../../core/libs/prx/libSceAudio3d/Mixer.hpp) (libSceAudio3d) - the centre and the surrounds fold into stereo with a 0.7071 gain and the LFE channel is dropped, which follows [shadPS4](https://github.com/shadps4-emu/shadPS4) (PS4): its `DOWNMIX_CENTER` and `DOWNMIX_SURROUND` are 0.7071 and its `DOWNMIX_LFE` is 0, so the `if constexpr` that adds the LFE is compiled out. [prosper](https://github.com/mattias800/prosper) disagrees on the LFE only: it folds it into both sides with a 0.5 gain, in its AudioOut2 main bed path, which is not an Audio3d path. KytyPS5 has no Audio3d mixing at all. The absolute level is unmeasured: fpPS4 scales the front by 1 + 3/sqrt(2) instead of 1
 - [Audio3d bed channel order](../../../core/libs/prx/libSceAudio3d/Mixer.hpp) (libSceAudio3d) - the buffer is read as L, R, C, LFE, Ls, Rs, Lrs, Rrs, the standard order, which three references agree on: [shadPS4](https://github.com/shadps4-emu/shadPS4) reads the front, centre, LFE and surround samples at those indices, [prosper](https://github.com/mattias800/prosper) documents FL, FR, FC, LFE and then surround pairs, and fpPS4 names them `_FL=0 _FR=1 _FC=2 _LF=3 _SL=4 _SR=5 _BL=6 _BR=7`. fpPS4's `STD` layout swaps the side and back pairs, which this library does not model
- [sceAudio3dAudioOutOutput](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - the return is the number of frames per channel in the queued block, which follows [KytyPS5](https://github.com/KytyPS5/KytyPS5) and [prosper](https://github.com/mattias800/prosper), whose `sceAudioOutOutput` returns the grain, and this project's own `sceAudioOutOutput`, which returns the port's `samplesNum` (the buffer length in frames). [shadPS4](https://github.com/shadps4-emu/shadPS4) returns the total samples instead (`len * channels`) and fpPS4 returns 0; no console measurement settles it
+- [sceAudio3dAudioOutOutput](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - returns 0 as firmware 13.42 does (it hands the block to AudioOut2 and returns its result), but queues the block itself, returns `NOT_READY` when `queue_depth` blocks are pending and accepts only handles opened through `sceAudio3dAudioOutOpen`, while the console accepts any AudioOut handle and leaves the queue to AudioOut2
+- [sceAudio3dAudioOutClose](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - closes only handles opened through `sceAudio3dAudioOutOpen` and returns `INVALID_PORT` for any other, while firmware 13.42 asks libSceAudioOut for the handle's AudioOut2 port and closes every handle that lookup accepts. `sceAudio3dPortClose` leaves these handles open as firmware 13.42 does, but drops their pending blocks, and `sceAudio3dAudioOutOutput` on them returns `INVALID_PORT`, while the console hands the block to AudioOut2, whose result once the port's context is destroyed is unknown
 - [sceAudio3dPortAdvance buffer mode](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - a mode other than 2 returns `NOT_SUPPORTED` (0x80EA0008), the value [shadPS4](https://github.com/shadps4-emu/shadPS4) uses for it and the one [prosper](https://github.com/mattias800/prosper) reads from the PS5 module's own error table, where 0x80EA0008 is what the per-port calls return for a buffer mode they do not support. shadPS4 and prosper refuse only mode 0 in `sceAudio3dPortAdvance` and modes 0 and 1 in `sceAudio3dPortPush`, while [KytyPS5](https://github.com/KytyPS5/KytyPS5) requires mode 2 at `sceAudio3dPortOpen` and halts otherwise, so this library refuses every other mode at the open and the check here is unreachable. 0x80EA0005 is `OUT_OF_MEMORY`, not `NOT_SUPPORTED`
 - [sceAudio3dPortAdvance on a full queue](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - a full queue returns `NOT_READY` (0x80EA0007) instead of throwing, which follows [shadPS4](https://github.com/shadps4-emu/shadPS4), the only reference with a body: it returns `ORBIS_AUDIO3D_ERROR_NOT_READY` when the mixed queue is at the port's depth. [KytyPS5](https://github.com/KytyPS5/KytyPS5) halts instead and prosper has no queue at all
@@ -79,7 +79,7 @@
 - [sceAudioOut2SetSystemDebugState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) (libSceAudioOut) - records the debug state id in the trace and returns 0, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libAudio2.cpp) does; the host has no system mix to apply it to. Id `0x20` with a 4-byte param throws. Not measured on a console
 - [sceAudioOut2GetSpeakerArrayCoefficients](../../../core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp) (libSceAudioOut) - validates the handle and the coefficient count like the ambisonics call, then writes the front pair at full gain and silence for every other speaker, ignoring the position, spread, height awareness and downmix spread radius: [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libAudio2.cpp) and [prosper](https://github.com/mattias800/prosper/blob/main/prosper/src/hle/audio/hle_audio.cpp) both return that pair. The console's VBAP gains over the array's directions are not measured
 - [sceAudioOutSetMixLevelPadSpk](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - no source applies the level (shadPS4 only stores it); it is assumed to be a linear gain on the port's own output, and the -9 dB default (11626) is applied to every pad speaker port, including those of titles that never call the function
- [sceAudioOutGetLastOutputTime](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - signature and behaviour taken from the [shadPS4](https://github.com/shadps4-emu/shadPS4) and [fpPS4](https://github.com/red-prig/fpPS4) reimplementations of the PS4 library, not confirmed on a PS5 title: the time is the process time at which `sceAudioOutOutput` or `sceAudioOutOutputs` accepted the port's last block, not the time the block reached the device
+- [sceAudioOutGetLastOutputTime](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - signature and behaviour taken from the [shadPS4](https://github.com/shadps4-emu/shadPS4) and [fpPS4](https://github.com/red-prig/fpPS4) reimplementations of the PS4 library, not confirmed on a PS5 title: the time is the process time at which `sceAudioOutOutput` or `sceAudioOutOutputs` accepted the port's last block, not the time the block reached the device. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0614ce324be092791b758d79f93d9f1ca5b10a81/src/core/libraries/audio/audioout.cpp#L183-L187) (PS4) stamps it after its output thread hands the block on and [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/src/audio/ps4_libsceaudioout.pas#L695-L804) (PS4) after its blocking device write; AnyPS5 once it has queued the block to a host device or paced a port without one, which can be earlier than both; KytyPS5 (PS5) has no such function
 - [sceAudioOutGetSystemState](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - the 32-byte layout (`float loudness`, 4 reserved bytes, 3 reserved 64-bit words) follows shadPS4's `OrbisAudioOutSystemState` and SharpProspero's `SceAudioOutSystemState` (`Size = 32`); it is not confirmed on a console. Loudness is reported as a constant 0.0f, although SharpProspero documents it in LKFS, so the value is unconfirmed. shadPS4 returns NOT_INIT before `sceAudioOutInit`; that check is not modelled. Imported by PPSA30528, which fails to load without it
 - [sceAudioOutSysOpen, sceAudioOutSysConfigureOutput, sceAudioOutSysClose](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - imported by PPSA99051 and PPSA99997, which fail to load without them; the signatures follow [EVO-PLAYER-PS5](https://github.com/sainsaji/EVO-PLAYER-PS5/blob/da0c0451333bab82e79fffd2de4718e917f9dcb0/projects/evoplayer/core/src/audio/evo_pt.cpp#L24-L29), whose audio code both titles share, and are not confirmed on a console. `sceAudioOutSysOpen(user, mode)` opens a port only for mode 5, the TrueHD MAT route: [the same project's carrier table](https://github.com/sainsaji/EVO-PLAYER-PS5/blob/da0c0451333bab82e79fffd2de4718e917f9dcb0/projects/evoplayer/core/src/audio/iec61937.cpp#L125-L140), read from sceAudioOutExOpen's own tables in firmware 12.70, describes it as a 768 kHz port of 1024 S16 8-channel frames whose 16-byte frames are consumed at 192 kHz; every other mode throws. Audio reaches the host through SDL as PCM and the host has no HDMI bitstream output, so like an Ex port a Sys port has no host device: `sceAudioOutOutput` paces it at its own rate and drops the MAT bursts. `sceAudioOutSysConfigureOutput(type, flags, mode, target, option)` accepts only the observed `(1, 0, 5, 1, 0)` HDMI MAT switch and changes nothing; other arguments throw. `sceAudioOutSysClose` closes a Sys port and throws for any other handle. The restore path EVO-PLAYER-PS5 takes after a Sys port calls `sceAudioOutExConfigureOutput(0, 0, 0xFF, 0xFF, 0)`, so no Sys reset combination is known
 - [sceAudioOut2PortCreate](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp) (libSceAudioOut) - MAIN (type 0) format validation follows PS5 firmware 13.60 measurements: bits 8-11 accept 1, 2, 8 or 12, bits 0-6 accept 0 or 1, bit 7 requires 8 channels, and bits 12-31 do not affect validation. The sample types are still read as float and int16; bit 7's layout, the PCM effect of bits 12-31 and the port `flags` are unverified. Other port types retain unverified format validation, including 6 channels and rejection of bits 12-31. One title (PPSA03355, in its libfmod plugin) disassembled for this entry has three call sites (0xe5faf, 0xe64a3, 0xe6a3b): type 0 with format 0x800 at 48000 Hz and flags 0; type 0x100 with format 0x100 at 48000 Hz and flags 0, after which it compares the result with 0x80268002; and a third that was not read. The first format is within the MAIN ranges above; for type 0x100 the validation is unverified, and what the type means is not shown.
@@ -174,6 +174,8 @@

 ### Functional

+- [AudioOut2 main output](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp) (libSceAudioOut) - a context's main host device is opened once at sceAudioOut2ContextCreate and is not reopened when SDL reports it stopped, so its audio stays silent for the rest of the context's life; only the controller sound card of a context is probed again. The console's behaviour when its output disappears is not measured
+- [Host output reopen](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - the console's behaviour when a port's output disappears is not measured. Here a port whose host device SDL reports as stopped reopens its default output or controller sound card before its next output, a host policy with no console counterpart. When that reopen fails, the port runs as a virtual port for the rest of its life and is not retried
 - [sceAudioOut2ContextPush](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp) (libSceAudioOut) - a blocking Push waits for room before it queues its grain and again after, so it returns once fewer grains than the queue depth wait to be played (each wait ends after at most 200 ms, so on a queue that never drains a blocking Push returns after up to 400 ms). Inferred from PPSA02530, whose sound engine pushes one grain per call from a feeder thread and wakes its renderer after each push: while Push returned as soon as the grain was queued, the renderer found the queue full and slept until the next rendered frame. When the console's blocking Push returns is unmeasured. Both waits release the context lock, so destroying a context while a push is waiting on it is not supported.
 - [sceAudioOutMasteringInit, sceAudioOutMasteringTerm and sceAudioOutMasteringSetParam](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - non-zero flags, a null pointer and a params id other than 1 throw; a repeated Init, a Term without Init and a SetParam or GetState before Init are unknown. There is no mastering stage, so Init and Term keep no state and SetParam reads only the id. The signatures and the default params id 1 follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/AudioOut.cs#L312-L344), not a console measurement. SharpProspero documents flag bit 0 as `SwapEqCompressor`, and shadPS4's PS4 stub [rejects any non-zero Init flags](https://github.com/shadps4-emu/shadPS4/blob/8d50471b7dc141dd700b51276b8edd1f293bce26/src/core/libraries/audio/audioout.cpp#L956-L962) with 0x80260201
 - [sceAudioOutMasteringGetState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - the states id 1 and the meter offsets 32, 128, 240, 272 and 304 in a 336-byte struct follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Audio/AudioOutMastering.cs#L97-L110), not a console measurement. With no mastering stage it zeroes the compressor input RMS and gain, and the limiter input, output and gain peaks, and leaves the other bytes, including the descriptors the AudioOut2 call writes, untouched; zero is not known to be what the console reports for an idle chain. A null pointer and a states id other than 1 throw; the console error codes are unknown
@@ -42,3 +42,5 @@ Candidate names marked **aerolib** occur in the [repository-pinned table](https:
 | `Unknown` | `85axuUkg9eE` | unresolved | `0x480` | 23 |
 | `Unknown` | `fJnnIc5sHOU` | unresolved | `0x2f0` | 18 |
 | `Unknown` | `tBOVSvi9EjY` | unresolved | `0x530` | 17 |
+
+- [Older callable NIDs](../../../core/libs/prx/libSceBgft/Export.cpp): 2 unidentified exports have unverified names, signatures and behavior. These are throwing import-resolution placeholders; no functionality is implemented. No matching NIDs were found in the later module inventory.
@@ -3,3 +3,5 @@
 ### Unknown function info

 - [sceCustomMusicCoreBgmClose, sceCustomMusicCoreBgmOpen, sceCustomMusicCoreBgmOpen2, sceCustomMusicCoreBgmOutput, sceCustomMusicCoreBgmSetAudioVolume, sceCustomMusicCoreBgmStart, sceCustomMusicCoreBgmStop, sceCustomMusicCoreGetBgmAuthorityStatus, sceCustomMusicCoreGetHdcpStatus, sceCustomMusicCoreGetSystemAudioVolume, sceCustomMusicCorePostEvent, sceCustomMusicCoreSendEvent, sceCustomMusicCoreSendMulticastEvent, sceCustomMusicCoreSendSpMessage, sceCustomMusicCoreSetSystemAudioVolume, sceCustomMusicCoreStartOperation, sceCustomMusicCoreStartOperation2 and sceCustomMusicCoreStopOperation](../../../core/libs/prx/libSceCustomMusicCore/Export.cpp) (libSceCustomMusicCore) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCustomMusicCore.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+
+- [Older callable NIDs](../../../core/libs/prx/libSceCustomMusicCore/Export.cpp): 11 unidentified exports have unverified names, signatures and behavior. These are throwing import-resolution placeholders; no functionality is implemented. No matching NIDs were found in the later module inventory.
@@ -0,0 +1,5 @@
+# libSceCustomMusicPlayReady4 technical debt
+
+### Functional
+
+- [Callable exports](../../../core/libs/prx/libSceCustomMusicPlayReady4/Export.cpp): 82 unidentified exports have unverified names, signatures and behavior. These are throwing import-resolution placeholders; no playback functionality is implemented. No matching NIDs were found in the later module inventory. Data exports require separate layout and ownership analysis.
@@ -7,3 +7,4 @@
 - [sceDataTransferRequestAuthPS5, sceDataTransferRequestCalcTransferSizePS4, sceDataTransferRequestCalcTransferSizePS5, sceDataTransferRequestEndFgTransfer, sceDataTransferRequestEndFgTransferPS5, sceDataTransferRequestGetDeviceInfoPS4, sceDataTransferRequestGetPS4Info](../../../core/libs/prx/libSceDataTransfer/Export.cpp) have unknown signatures and behaviour. The parameterless `int` declarations are import-resolution placeholders, not confirmed ABI signatures, and throw through `NotImplemented_nid_no_patch`. Only the names and NIDs are established by the [13.60 export inventory](https://github.com/xdCloudy/PS5-13.60-Function-Stub-Library/blob/bfec40deb4c47a17d7603ee2bc79aa6862c0c56b/data/firmware-13.60/libscedatatransfer-ca1b6655ff.jsonl).
 - [sceDataTransferRequestGetPS5Info, sceDataTransferRequestLaunchPS5, sceDataTransferRequestPrepareFgTransferPS5, sceDataTransferRequestRebootAuthPS5, sceDataTransferRequestSearchPS5, sceDataTransferRequestStartFgTransferPS5, sceDataTransferRequestTransferTimePS5](../../../core/libs/prx/libSceDataTransfer/Export.cpp) have unknown signatures and behaviour. The parameterless `int` declarations are import-resolution placeholders, not confirmed ABI signatures, and throw through `NotImplemented_nid_no_patch`. Only the names and NIDs are established by the [13.60 export inventory](https://github.com/xdCloudy/PS5-13.60-Function-Stub-Library/blob/bfec40deb4c47a17d7603ee2bc79aa6862c0c56b/data/firmware-13.60/libscedatatransfer-ca1b6655ff.jsonl).
 - [sceDataTransferAbortFgTransfer, sceDataTransferAbortRequest, sceDataTransferAbortSearchPS4, sceDataTransferCheckBgTransferRunning, sceDataTransferGetFgTransferProgress, sceDataTransferGetPrepareFgTransferProgress, sceDataTransferInitialize, sceDataTransferRequestGetAppInfoPS4, sceDataTransferRequestGetSavedataInfoPS4, sceDataTransferRequestGetUsersPS4, sceDataTransferRequestLaunchPS4, sceDataTransferRequestPrepareFgTransfer, sceDataTransferRequestRebootAuthPS4, sceDataTransferRequestSearchPS4, sceDataTransferRequestStartFgTransfer, sceDataTransferRequestTransferTimePS4, sceDataTransferTargetAbortBindSavedata, sceDataTransferTargetAbortDeactivate, sceDataTransferTargetAbortEth0, sceDataTransferTargetAbortGetDeviceInfo, sceDataTransferTargetAbortGetDeviceInfoApplication, sceDataTransferTargetAbortGetTitles, sceDataTransferTargetAbortGetUsers, sceDataTransferTargetAbortLaunch, sceDataTransferTargetAbortPrepareTransfer, sceDataTransferTargetAbortPwrReq, sceDataTransferTargetAbortReboot, sceDataTransferTargetAbortSendSsoNew2Old, sceDataTransferTargetAbortSendSsoOld2New, sceDataTransferTargetAbortTransfer, sceDataTransferTargetAbortTransferSpeed, sceDataTransferTargetEventIsAuthReady, sceDataTransferTargetEventIsIPv6Ready, sceDataTransferTargetEventIsPwrReqReady, sceDataTransferTargetGetFailedUsers, sceDataTransferTargetGetRebootData, sceDataTransferTargetGetTransferProgress, sceDataTransferTargetRequestAbortSearch, sceDataTransferTargetRequestActivate, sceDataTransferTargetRequestAuth, sceDataTransferTargetRequestBindSavedata, sceDataTransferTargetRequestComplete, sceDataTransferTargetRequestCreateRebootData, sceDataTransferTargetRequestDeactivate, sceDataTransferTargetRequestEndTransfer, sceDataTransferTargetRequestGetDeviceInfo, sceDataTransferTargetRequestGetDeviceInfoApplication, sceDataTransferTargetRequestGetTitles, sceDataTransferTargetRequestGetUsers, sceDataTransferTargetRequestLaunch, sceDataTransferTargetRequestPrepareTransfer, sceDataTransferTargetRequestPrepareTransferProgress, sceDataTransferTargetRequestPwrReq, sceDataTransferTargetRequestReboot, sceDataTransferTargetRequestSearch, sceDataTransferTargetRequestSendSsoNew2Old, sceDataTransferTargetRequestSendSsoOld2New, sceDataTransferTargetRequestStartTransfer, sceDataTransferTargetRequestTransferSpeed and sceDataTransferTerminate](../../../core/libs/prx/libSceDataTransfer/Export.cpp) (libSceDataTransfer) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceDataTransfer.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceDataTransferEventIsAuthReady and sceDataTransferEventIsPwrReqReady](../../../core/libs/prx/libSceDataTransfer/Export.cpp) have unknown signatures and behaviour. The parameterless `int` declarations are import-resolution placeholders, not confirmed ABI signatures, and throw through `NotImplemented_nid_no_patch`. Only the names and NIDs are established (NID database entries; the names hash to `YxCpG1l-iMA` and `p+EwF-lg9Lc`).
@@ -2,6 +2,8 @@

 ### Unknown function info

+- [Depth export `unL9sWu4IIw`](../../../core/libs/prx/libSceDepth/Export.cpp) is a function record with qualifier `G#A` in older and later version-labelled modules. In both, dynamic metadata maps library ID 6 and module ID 0 to `libSceDepth`. The older module-parameter words are `0x08540001` and `0x03200004`; the later words are `0x13590001` and `0x13600007`. Both have the same 39 function NIDs, whose sorted-LF SHA-256 is `a56e046304aaf76b3193f5b4fc0a57c4660bff9b05255e51149891461c23becc`, using the [static ELF membership procedure](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298). Version labels are not authenticated retail provenance, and the digest identifies the NID set, not the binary or ABI. The export name, signature and behavior are unverified; this declaration throws.
+
 - [_sceDepthCalcHeteroAdjustParam, _sceDepthHeadCandidateTrackerGetInformation, _sceDepthHeadCandidateTrackerSetInformation, _sceDepthSetCameraFactoryCalibrationData, _sceDepthSetHeteroAdjustParam, _sceDepthSetHeteroMode](../../../core/libs/prx/libSceDepth/Export.cpp) (libSceDepth) - signatures and behavior are unverified; these parameterless declarations only resolve imports and throw through `NotImplemented_nid_no_patch`.

 - [libSceDepth pending exports](../../../core/libs/prx/libSceDepth/Export.cpp) - 32 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceDepth.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
@@ -1,5 +1,10 @@
 # libSceDepth2 technical debt

+### Additional callable exports
+
+- [Depth2 export `tLM3AwtzaHs`](../../../core/libs/prx/libSceDepth2/Export.cpp) is a function record with qualifier `L#A` in older and later version-labelled modules. In both, dynamic metadata maps library ID 11 and module ID 0 to `libSceDepth2`. The older module-parameter words are `0x08540001` and `0x03200004`; the later words are `0x13590001` and `0x13600007`. Both have the same 11 function NIDs, whose sorted-LF SHA-256 is `72ab095808199bf39edf98a41b28470660ca1db537e1cfb7be251b4e9d405a98`, using the [static ELF membership procedure](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298). Version labels are not authenticated retail provenance, and the digest identifies the NID set, not the binary or ABI. The export name, signature and behavior are unverified; this declaration throws.
+
+
 ### Unknown function info

 - [libSceDepth2 pending exports](../../../core/libs/prx/libSceDepth2/Export.cpp) - 10 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceDepth2.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
@@ -0,0 +1,5 @@
+# libSceGifParser technical debt
+
+### Callable exports
+
+- [Callable exports](../../../core/libs/prx/libSceGifParser/Export.cpp) - Seven 3.20 callable NIDs are import-resolution declarations only. One NID also appears in the 13.60-labelled inventory; other NIDs differ across versions. Their signatures and behavior are unverified; parameterless `int` declarations are placeholders, not verified ABI contracts. Every entry throws through `NotImplemented_nid_no_patch`. No runtime functionality is implemented. Data exports require separate layout and ownership analysis.
@@ -46,6 +46,7 @@
 - [sceHmd2InternalSetVibrationMode](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - unknown signature
 - [sceHmd2InternalGetVr2dData](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - unknown signature
 - [sceHmd2InternalImageCloseBySlot](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - unknown signature
+- [sceHmd2Unknown_CBkVZi9WhVo_nid_no_patch](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - NID `CBkVZi9WhVo` of the `libSceHmd2ReprojectionMotionVector` sub-library, listed as a function export in the [13.60 inventory](https://github.com/xdCloudy/PS5-13.60-Function-Stub-Library/blob/990ca8e56aa1d294857af66ade24d552d18d5945/data/firmware-13.60/libscehmd2reprojectionmotionvector-a3712ce199.jsonl) with no name or signature. It throws through `NotImplemented_nid_no_patch` and exists only so a title that imports it, such as [My First Gran Turismo](https://github.com/boykopovar/AnyPS5/discussions/13466), can load. Before `sceHmd2Initialize` the console [answered](https://github.com/boykopovar/AnyPS5/pull/7798#issuecomment-6262489180) 0 with every argument null but `0x8a720009` with every argument pointing at zeroed memory, so its checks are not known

 ### Functional

@@ -4,8 +4,21 @@

 - [ICU export availability](../../../core/libs/prx/libSceIcu/Unescape.cpp) across firmware versions remains unproven. The [PS5 3.20 inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceIcu.c) includes the implemented escape, invariant-character and version helpers. [BunnyFl’s firmware 13.42 report](https://github.com/boykopovar/AnyPS5/pull/10961#issuecomment-6400071863) records `u_getVersion` returning `78.1.0.0` under an emulator, but neither escape function is in the checked native `system_ex/common_ex/lib/libSceIcu.sprx` export table. Only 104 of the 661 inventory NIDs appear among that module’s 299 exports. The exports for compatibility with older firmware are retained; availability and routing across firmware versions remain unproven.

+### Older dispatch exports
+
+- [Older dispatch exports](../../../core/libs/prx/libSceIcu/Export.cpp) - Four 3.20 callable NIDs are declared as throwing placeholders. Their signatures and behavior are unverified. The four selector wrappers have identical instruction bytes in the 3.20 and later version-labelled modules, and corresponding consumer switch cases call them. Their NIDs and internal layouts differ; no forwarding or binary compatibility is claimed. Later image version metadata does not authenticate a retail firmware release.
+
+| 3.20 NID | Later candidate NID | Selector |
+| --- | --- | --- |
+| `BufsAiaX0+s` | `3lVihhFbXus` | 0 |
+| `xdF5zg0V5Oc` | `HFkUTLyJkZ0` | 1 |
+| `Con4H1SB3nw` | `jXOj7dZh7RQ` | 2 |
+| `lME28PLmu54` | `bxjI++g9NkE` | 3 |
+
 ### Functional

+- [Older callable exports](../../../core/libs/prx/libSceIcu/LegacyExports.cpp) - 2347 3.20 callable NIDs have unidentified names and are declared as throwing placeholders. Their signatures and behavior are unverified; no ICU functionality is implemented. These NIDs do not appear in the later version-labelled module inventory; no cross-version identity or compatibility is claimed.
+
 - [UTF-8 macro helpers](../../../core/libs/prx/libSceIcu/Utf8.cpp) have no console ABI or behavior verification. Their names and NIDs are in the [PS5 3.20 inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceIcu.c); behavior follows ICU 78.1 [utf_impl.cpp](https://github.com/unicode-org/icu/blob/049e0d6a420629ac7db77256987d083a563287b5/icu4c/source/common/utf_impl.cpp). These are macro bodies, not complete UTF-8 operations: append encodes ASCII with two bytes, and null-error-pointer failures write the legacy length-dependent error characters. Null index pointers, negative positions, reversed bounds, overflowing index or capacity arithmetic, and null buffers when accessed throw instead of reproducing undefined behavior. Negative forward lengths denote NUL-terminated input. Cross-firmware export availability and native behavior outside the macros' preconditions remain unverified.

 - [Space classification](../../../core/libs/prx/libSceIcu/Space.cpp) is unverified on a console. `u_isspace`, `u_isblank`, `u_isWhitespace`, `u_isJavaSpaceChar` and `u_isUWhiteSpace` follow ICU 78.1 [uchar.cpp](https://github.com/unicode-org/icu/blob/049e0d6a420629ac7db77256987d083a563287b5/icu4c/source/common/uchar.cpp#L196-L244) over fixed Zs, Zl, Zp and White_Space sets instead of ICU's property data; the sets are unchanged from ICU 65.1 to 78.1. Firmware 13.42 exports `u_isUWhiteSpace` but not the other four ([#11013](https://github.com/boykopovar/AnyPS5/pull/11013#issuecomment-6401310351)), which are kept from the 3.20 inventory for older firmware (see ICU export availability). Closes when: compared with the console.
@@ -24,5 +37,7 @@

 ### Known export names; ABI prototypes unverified

- The 96 `sceIcuUnknown_*_nid_no_patch` and named `*_nid_postfix` stubs in [Export.cpp](../../../core/libs/prx/libSceIcu/Export.cpp) are present in the PS5 3.20 export inventory from [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs). Their prototypes and behavior are unverified. Each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`; these declarations make no ABI or behavior claim.
- The 74 named stubs declared in [Identified.hpp](../../../core/libs/prx/libSceIcu/Identified.hpp) carry the ICU C API names whose `tools/nid_names.py` hash equals the inventory NID; the names were taken from the identifiers of the ICU 78.1 `common`, `i18n` and `io` sources. A name match does not show that the console function has ICU's prototype or behavior. Most of them read Unicode property, case-folding or resource data that no host library provides.
+- The 93 `sceIcuUnknown_*_nid_no_patch` and named `*_nid_postfix` stubs in [Export.cpp](../../../core/libs/prx/libSceIcu/Export.cpp) are present in the PS5 3.20 export inventory from [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs). Their prototypes and behavior are unverified. Each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`; these declarations make no ABI or behavior claim.
+- The 73 named stubs declared in [Identified.hpp](../../../core/libs/prx/libSceIcu/Identified.hpp) carry the ICU C API names whose `tools/nid_names.py` hash equals the inventory NID; the names were taken from the identifiers of the ICU 78.1 `common`, `i18n` and `io` sources. A name match does not show that the console function has ICU's prototype or behavior. Most of them read Unicode property, case-folding or resource data that no host library provides.
+
+- [Resource type classification](../../../core/libs/prx/libSceIcu/Resource.cpp) has no console ABI or behavior verification. `res_getPublicType` (NID `WPrktCwd+iw` in the PS5 3.20 inventory above) takes an unsigned 32-bit resource and returns a signed 32-bit public type, following ICU 65.1 and [ICU 78.1](https://github.com/unicode-org/icu/blob/049e0d6a420629ac7db77256987d083a563287b5/icu4c/source/common/uresdata.cpp). Both use the same mapping of the high four bits; the low 28 bits do not affect the result. Cross-firmware export availability and native behavior remain unverified. Closes when: compared with the console.
@@ -2,6 +2,7 @@

 ### Silent stubs

+- [sceInvitationDialogOpen](../../../core/libs/prx/libSceInvitationDialog/Export.cpp) (libSceInvitationDialog) - with `ANYPS5_PSN_DIALOGS=show`, a successful open shows AnyPS5's notice that the feature needs PlayStation Network; the console's own display without PlayStation Network is not measured, and the notice wording is AnyPS5's.
 - [sceInvitationDialogOpen, sceInvitationDialogGetResult](../../../core/libs/prx/libSceInvitationDialog/Export.cpp) (libSceInvitationDialog, PS4) - no dialog is shown and no invitation is sent: `Open` moves the dialog straight to `FINISHED`, and `GetResult` returns 0 with `errorCode` 0, `result` `USER_CANCELED` (1), the `callbackArg` of the last `Open` and a recipient count of 0, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/2cdefaa1298c6e4ece6c74bd84e90f3906282d51/src/core/libraries/invitation_dialog/invitation_dialog.cpp) reports when its window is dismissed and as [libSceNpProfileDialog](libSceNpProfileDialog.md) does. Not measured on a console.

 ### Unknown function info
@@ -6,6 +6,8 @@

 ### Functional

+- [Older callable NIDs](../../../core/libs/prx/libSceJsc/LegacyExports.cpp): 198 unidentified exports have unverified names, signatures and behavior. These are throwing import-resolution placeholders; no JavaScriptCore behavior is implemented. No matching NIDs were found in the later module inventory.
+
 - [JSString conversion](../../../core/libs/prx/libSceJsc/Export.cpp): console behavior is unverified. UTF-16 storage, null/empty distinction and partial UTF-8 output follow pinned WebKit [OpaqueJSString.cpp](https://github.com/WebKit/WebKit/blob/f274ef4c03ebace644c46f8ec55746b391acdcc8/Source/JavaScriptCore/API/OpaqueJSString.cpp) and [UTF8Conversion.cpp](https://github.com/WebKit/WebKit/blob/f274ef4c03ebace644c46f8ec55746b391acdcc8/Source/WTF/wtf/unicode/UTF8Conversion.cpp). Malformed UTF-8 creates a null string, distinct from an empty string; output stops before an unpaired UTF-16 surrogate. The PS5 11.x [OpaqueJSString.h](https://github.com/neonmodder123/PS5-WebKit-11.x/blob/80f77e94c63ee7202eec3d4b5b1a021dd89011ba/Source/JavaScriptCore/API/OpaqueJSString.h#L49-L52) keeps the low 32 bits of a UTF-16 length of 2^32 or more, which throws here as in pinned WebKit.

 ### Known export names; ABI prototypes unverified
@@ -0,0 +1,5 @@
+# libSceJxrParser technical debt
+
+### Callable exports
+
+- [Callable exports](../../../core/libs/prx/libSceJxrParser/Export.cpp) - Seven 3.20 callable NIDs are import-resolution declarations only. One NID also appears in the 13.60-labelled inventory; other NIDs differ across versions. Their signatures and behavior are unverified; parameterless `int` declarations are placeholders, not verified ABI contracts. Every entry throws through `NotImplemented_nid_no_patch`. No runtime functionality is implemented. Data exports require separate layout and ownership analysis.
@@ -6,6 +6,7 @@

 ### Unknown function info

+- [Keyboard export `l76jptHfizM`](../../../core/libs/prx/libSceKeyboard/Export.cpp) is recorded as a function with qualifier `E#A` in older and later version-labelled modules. In both, dynamic metadata maps library ID 4 and module ID 0 to `libSceKeyboard`. The older module-parameter words are `0x08540001` and `0x03200004`; the later words are `0x13590001` and `0x13600007`. The 17 older function NIDs under that qualifier have sorted-LF SHA-256 `42ee4240ba6e95c22083ea1ce753b81bdc8852b5f241675f4eecbd9bcca83ad9` using the [static ELF membership procedure](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298). Version labels are not authenticated retail provenance; this digest identifies the NID set, not the binary or ABI. The export name, signature and behavior are unverified; this declaration throws.
 - [sceDbgKeyboardGetHandle](../../../core/libs/prx/libSceKeyboard/Export.cpp) (logical `libSceDbgKeyboard`, NID `vob3PZretTg`) - signature and behavior are unknown. This parameterless `int` declaration is an import placeholder, not a verified ABI prototype; every call throws through `NotImplemented_nid_no_patch`. The binding is in the [13.60 inventory](https://github.com/xdCloudy/PS5-13.60-Function-Stub-Library/blob/bfec40deb4c47a17d7603ee2bc79aa6862c0c56b/data/firmware-13.60/libscedbgkeyboard-a009193dfc.jsonl).

 - [sceDbgKeyboardClose, sceDbgKeyboardGetKey2Char, sceDbgKeyboardInit, sceDbgKeyboardOpen, sceDbgKeyboardRead, sceDbgKeyboardReadState](../../../core/libs/prx/libSceKeyboard/Export.cpp) (libSceKeyboard) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceKeyboard.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
@@ -12,11 +12,14 @@
 - [EVP_PKEY_up_ref, EC_KEY_up_ref and RSA_up_ref](../../../core/libs/prx/libSceLibreSsl3/src/Key.cpp) - console layouts and retain/release interoperability are unverified. The 32-byte EVP, 64-byte EC and 152-byte RSA layouts, with counters at offsets 4, 48 and 104, follow [LibreSSL 4.0.0](https://github.com/libressl/openbsd/tree/ce488b78e0bd994780569df718596b9776ff681a/src/lib/libcrypto) `evp/evp_local.h`, `evp/p_lib.c`, `ec/ec_local.h`, `ec/ec_key.c`, `rsa/rsa_local.h` and `rsa/rsa_lib.c`; the RSA layout has no `engine` field, unlike libSceLibreSsl's `LibreSslRsa`. Atomic retains replace its internal mutex; future releases must synchronize with the same counters. With no key constructors/destructors in this module, tests use caller-owned objects without validating allocator or destruction compatibility. Null keys and signed-counter overflow, undefined upstream, throw without mutation. Closes when: console layouts and lifetime interoperability are measured.

 - [Parent export forwarding](../../../core/libs/prx/libSceLibreSsl3/ParentExports.cpp) exposes 395 parent-library exports on Windows through IAT tail jumps without changing their ABI. Non-Windows hosts use their existing dependency lookup. Static COFF inspection verifies names, parent imports and tail jumps; Windows loading and runtime behavior remain unverified. Parent functions retain their existing implementation limitations.
+- [EVP_MD_CTX_md](../../../core/libs/prx/libSceLibreSsl3/src/DigestContext.cpp) (libSceLibreSsl3) - nothing is checked on the console. As in [LibreSSL 4.0.0](https://github.com/libressl/openbsd/blob/ce488b78e0bd994780569df718596b9776ff681a/src/lib/libcrypto/evp/evp_digest.c) `evp_digest.c`, a null context returns null and any other returns its first field, `digest`. That field is first in 4.0.0's `evp_local.h` and in the [2.5.4 layout](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/evp/evp.h) of the contexts the forwarded libSceLibreSsl exports handle; the layouts differ after it, so the context and digest are declared opaque. Closes when: compared with the console.
+- [EVP_CIPHER_key_length and EVP_CIPHER_iv_length](../../../core/libs/prx/libSceLibreSsl3/src/Cipher.cpp) (libSceLibreSsl3) - nothing is checked on the console. They return `key_len` and `iv_len` from the 80-byte `EVP_CIPHER` of [LibreSSL 4.0.0](https://github.com/libressl/openbsd/tree/ce488b78e0bd994780569df718596b9776ff681a/src/lib/libcrypto/evp) `evp_local.h` and `evp_cipher.c`. The fields are at offsets 8 and 12, as in the [2.5.4 layout](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/evp/evp.h) of the ciphers the forwarded libSceLibreSsl exports handle. A null cipher, which LibreSSL dereferences, throws. Closes when: compared with the console.
+- [X509_VERIFY_PARAM_set_flags](../../../core/libs/prx/libSceLibreSsl3/src/X509VerifyParam.cpp) (libSceLibreSsl3) - nothing is checked on the console. It ORs the flags into `flags` and returns 1, as both [LibreSSL 2.5.4](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/x509/x509_vpm.c) and [4.0.0](https://github.com/libressl/openbsd/blob/ce488b78e0bd994780569df718596b9776ff681a/src/lib/libcrypto/x509/x509_vpm.c) `x509_vpm.c` do. They differ when `EXPLICIT_POLICY`, `INHIBIT_ANY` or `INHIBIT_MAP` is set while `POLICY_CHECK` is neither set nor requested: 2.5.4 also adds `POLICY_CHECK` and 4.0.0 does not. The console's choice is unknown, so that case throws through `NotImplemented_nid_no_patch` and leaves the parameters unchanged. It writes libSceLibreSsl's 2.5.4 `LibreSslX509VerifyParam`, whose `flags` is at offset 24 as in 4.0.0. Null parameters throw. Closes when: the console's policy behaviour is measured.
 - [sk_new, sk_push and sk_free](../../../core/libs/prx/libSceLibreSsl3/src/Stack.cpp) (libSceLibreSsl3) - follow [LibreSSL 4.0.0](https://github.com/libressl/openbsd/blob/ce488b78e0bd994780569df718596b9776ff681a/src/lib/libcrypto/stack/stack.c) `stack.c` with libSceLibreSsl's 32-byte `_STACK` layout, which `stack_local.h` keeps there. Stacks and element arrays come from the guest heap, so the forwarded `sk_pop_free` can release them. Nothing is checked on the console. Where LibreSSL faults or overflows, they throw: `sk_push` on a null stack, on a negative element count, on a null element array it does not regrow, or when the element array cannot double without overflowing `int`

 ### Additional callable export inventory

- [Additional exports](../../../core/libs/prx/libSceLibreSsl3/AdditionalExports.cpp) declare 180 callable exports: 54 named and 126 known only by NID. Every entry throws. Parameterless `int` declarations are unknown-signature placeholders, not verified ABI contracts. Names/NIDs match the 13.60 export table. No functional implementation or title unblock is claimed.
+- [Additional exports](../../../core/libs/prx/libSceLibreSsl3/AdditionalExports.cpp) declare 176 callable exports: 50 named and 126 known only by NID. Every entry throws. Parameterless `int` declarations are unknown-signature placeholders, not verified ABI contracts. Names/NIDs match the 13.60 export table. No functional implementation or title unblock is claimed.

 | Name | NID |
 | --- | --- |
@@ -42,7 +45,6 @@
 | `unknown` | `44M+SEbpNdQ` |
 | `unknown` | `4Q3bvOy4LY8` |
 | `unknown` | `4pEl-5DmrrM` |
-| `EVP_CIPHER_iv_length` | `4ryyfC3TknU` |
 | `SSL_set_accept_state` | `5BoCLZK9mGk` |
 | `unknown` | `5DhOJmgra8E` |
 | `unknown` | `5NBoRJYLH0U` |
@@ -55,7 +57,6 @@
 | `unknown` | `8kct4CSWwOA` |
 | `tls_configure` | `8pwP-7j5UZI` |
 | `X509_STORE_CTX_get0_param` | `8wroYNJAQpo` |
-| `X509_VERIFY_PARAM_set_flags` | `9E9Gr4FLIE4` |
 | `unknown` | `A-Hs-8mau+8` |
 | `unknown` | `A0lZtFjhcTw` |
 | `unknown` | `A65b+ZhOt9k` |
@@ -76,7 +77,6 @@
 | `unknown` | `GFEaREp1UFw` |
 | `EVP_PKEY_get0_EC_KEY` | `GY2X+VHs568` |
 | `unknown` | `GjO5Ap3E-t4` |
-| `EVP_MD_CTX_md` | `H1dRCduUy+o` |
 | `unknown` | `HE-vihq-KKw` |
 | `EVP_PKEY_verify` | `HEuvmk+aHs4` |
 | `unknown` | `IOutZPRNNPo` |
@@ -166,7 +166,6 @@
 | `EVP_PKEY_derive_set_peer` | `ovH4WphWIQQ` |
 | `unknown` | `pW329hq95Hc` |
 | `unknown` | `pdxCm9+CCc4` |
-| `EVP_CIPHER_key_length` | `qAG7o03bkkM` |
 | `unknown` | `qGsc6uT6p1E` |
 | `EVP_PKEY_verify_init` | `qseLIVbdvMQ` |
 | `unknown` | `rJZ-aiNIYCA` |
@@ -1,5 +1,10 @@
 # libSceM4aacEnc technical debt

+### Additional callable exports
+
+- [M4aac encoder export `dyjd6gEaAXw`](../../../core/libs/prx/libSceM4aacEnc/Export.cpp) is a function record with qualifier `D#A` in older and later version-labelled modules. Both map library ID 3 and module ID 0 to `libSceM4aacEnc`. Older module words: `0x08540001`, `0x03200004`; later: `0x13590001`, `0x13600007`. Both contain 18 function NIDs; sorted-LF SHA-256: `b60081c1301a28b192a54d084092ac13164556129b70ee7aa92407ff24256115`, using the [static ELF membership procedure](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298). Labels do not authenticate retail provenance; the digest identifies the NID set only. Independent verification requires a matching image. The name, signature and behavior are unverified; this declaration throws.
+
+
 ### Unknown function info

 - [libSceM4aacEnc](../../../core/libs/prx/libSceM4aacEnc/Export.cpp) (libSceM4aacEnc, sysmodule id `0x000000bc`) has no encoder, so all seventeen exports throw. PPSA03332 imports them and fails to load (`libSceM4aacEnc.prx: cannot open shared object file`) when the library is absent. The names are from the aerolib NID list: `sceM4aacEncClearContext`, `sceM4aacEncClearContextEx`, `sceM4aacEncCreateEncoder`, `sceM4aacEncCreateEncoderEx`, `sceM4aacEncDeleteEncoder`, `sceM4aacEncDeleteEncoderEx`, `sceM4aacEncEncode`, `sceM4aacEncEncodeEx`, `sceM4aacEncEncodeWithPriority`, `sceM4aacEncEncodeWithPriorityEx`, `sceM4aacEncFlush`, `sceM4aacEncFlushEx`, `sceM4aacEncFlushWithPriority`, `sceM4aacEncFlushWithPriorityEx`, `sceM4aacEncGetContext`, `sceM4aacEncInitialize` and `sceM4aacEncTerminate`
@@ -31,7 +31,7 @@

 - [NGS2 custom parameter positions](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) - other custom module families have not received the PitchShift validation audit. PitchShift decodes the low five position bits within its parameter family: 0x20 aliases position zero, matching 13.60 dispatch and host-adapted reference execution. An absent or mismatched module returns `0x804A835A` before later linked parameters execute. Checks cover two module positions, invalid positions, list termination and active processing through an aliased parameter. These are host-adapted library checks, not console execution.
 - [NGS2 reverb channel conversion](../../../core/libs/prx/libSceNgs2.native/src/Reverb.cpp) (libSceNgs2.native) - a reverb voice whose `num_input_channels` differs from `num_output_channels` (PPSA03747 sets up 2 inputs and 8 outputs) mixes its ports in the input layout and folds that to mono with the input count's gains, as an equal-count voice does, and runs the comb and allpass stages per output channel. The PS4 library's handling of the dry signal in this case is not checked: here it reaches the output layout through the PS4 default rows, not the PS5 port map, so a stereo input keeps its dry signal on the front left and right and the other outputs carry only the reverb
- [NGS2 port matrix](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) (libSceNgs2.native) - gaps: 3-channel sources, and 5- and 7-channel sources into stereo, keep PS4-only rows; maps into 3, 4, 5 or 7 channels throw though PS5 renders them (also a mastering voice into another count; a 3-, 5- or 7-channel one passes unchanged where PS5 folds or drops channels). 1, 2, 6 and 8 channels use the default map measured on the PS5 firmware 3.20 and 4.03 module run on a PC, not a console; the PS4 library keeps the PS4 11.00 rows for 6 and 8 channels, and its mastering output, unmeasured on PS4, maps only equal counts and stereo into 6 or 8; reverb conversion and Pan keep the PS4 rows. A port into more than 8 channels without a matrix throws, which is unreachable: the 13.42 module rejects a custom submixer voice with over 8 inputs or outputs (`0x804A8052`). A matrix with too few levels mixes only its whole rows
+- [NGS2 port matrix](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) (libSceNgs2.native) - gaps: a mastering voice into a buffer of another count throws when either count is 3, 4, 5 or 7, though PS5 firmware 3.20 and 4.03 render them; the PS4 library has no rows into 3, 4, 5 or 7 and throws, its mastering output is unmeasured, and its reverb conversion and Pan keep the PS4 rows; a port into more than 8 channels without a matrix throws, which is unreachable (`0x804A8052` for a custom submixer voice with over 8 channels, 13.42 module). Not run on PS5: non-sampler sources into 4 or 7 channels and from 1, 2, 6 or 8 channels into 3, 4, 5 or 7, an active reverb (I3DL2), custom submixers with modules and custom mastering 0x4003; they use the sampler rows here. The PS5 rows were measured on that module run on a PC, not a console. A matrix with too few levels mixes only its whole rows
 - [NGS2 custom submixer rack](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, rack 0x4002) - UserFx2 process flags and setup/process/cleanup order follow only [KytyPS5](https://github.com/KytyPS5/KytyPS5), not a console measurement; layouts follow [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_custom.h`. A module control handler, unequal input and output channels, setup flags and default rack options throw. Module state is a separate buffer, not the `state_offset` slice of voice state; `sceNgs2VoiceGetState` throws for this rack. UserFx2 runs only on grains with input samples, so an effect tail stops with the input. Setup changes from custom process callbacks throw before later modules can use the changed layout; inconsistent input-mixing layouts after callbacks also throw. Console reentry behavior is unknown
 - [NGS2 custom UserFx](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native) - the 48-byte process context, process flags, callback error handling and null-handler behavior retain the existing submixer callback model and are not console-verified. Non-null module options throw because their console error is unknown. UserFx on custom sampler rack 0x4001 throws: its parameter indexing and routing are not implemented. Module id 0x19, the 40-byte voice parameter (handler and three user-data words), parameter id `0x40001900 | index`, and lack of option and module state follow [fma-rc's PS5 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943), including parameter dispatch at 0x25ec4.
 - [NGS2 custom Delay](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, 0x1d) - processing and defaults remain unverified on PS5. The [agreed compatibility path](https://github.com/boykopovar/AnyPS5/pull/9337#issuecomment-6351205140) preserves main's PCM pass-through for Void Terrarium (PPSA03061) until any Delay parameter is set; every `0x40001dxx` parameter throws. Only one-buffer custom submixers with no module state and a 20-byte option are accepted. Option type 0/1, taps 1..8, length 1..20000 and reserved 0 follow [fma-rc's 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943). Other shapes and values throw because their console errors are unknown. This preserves host behavior, not console-equivalent Delay processing
@@ -2,6 +2,7 @@

 ### Silent stubs

+- [sceNpAuthAuthorizedAppDialogOpen](../../../core/libs/prx/libSceNpAuthAuthorizedAppDialog/Export.cpp) (libSceNpAuthAuthorizedAppDialog) - with `ANYPS5_PSN_DIALOGS=show`, a successful open shows AnyPS5's notice that the feature needs PlayStation Network; the console's own display without PlayStation Network is not measured, and the notice wording is AnyPS5's.
 - [libSceNpAuthAuthorizedAppDialog](../../../core/libs/prx/libSceNpAuthAuthorizedAppDialog/Export.cpp) - the authorized-app dialog runs the common-dialog state machine but shows nothing and reports the user as having cancelled, as there is no PSN sign-in to authorize an app against. Parameter fields at offsets 64 and 72 feed a 136-byte application record and a text value of at most 1024 bytes; their service-side meaning remains incomplete.

 ### Unknown function info
@@ -2,6 +2,7 @@

 ### Silent stubs

+- [sceNpCommerceDialogOpen, sceNpCommerceDialogOpen2](../../../core/libs/prx/libSceNpCommerce/Export.cpp) (libSceNpCommerce) - with `ANYPS5_PSN_DIALOGS=show`, a successful open shows AnyPS5's notice that the feature needs PlayStation Network; the console's own display without PlayStation Network is not measured, and the notice wording is AnyPS5's.
 - [libSceNpCommerce](../../../core/libs/prx/libSceNpCommerce/Export.cpp) - the PS Store icon show/hide calls and `sceNpCommerceSetPsStoreIconLayout` do nothing

 ### Unknown function info
@@ -35,6 +35,7 @@ Pending import declarations are matched to names in the local libSceNpCommon.spr

 - [Online ID and NpId utilities](../../../core/libs/prx/libSceNpCommon/Export.cpp) (libSceNpCommon) - `sceNpCmpOnlineId`, `sceNpCmpNpIdInOrder`, `sceNpGetPlatformType` and `sceNpIntIsValidOnlineId` are not measured on a console; their signatures, checks and results follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_common.cpp), including the platform tags read from `opt[4..7]` and the 3 to 16 character online ID rule.
 - [Mutex, condition and thread wrappers](../../../core/libs/prx/libSceNpCommon/Export.cpp) (libSceNpCommon) - the `sceNpMutex*`, `sceNpLwMutex*`, `sceNpCond*` and `sceNpJoinThread` wrappers forward to the libkernel `scePthread*` calls as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_common.cpp) and are not measured on a console. Only `EBUSY` from try-lock and `ETIMEDOUT` from a timed wait are mapped to NP errors; every other kernel error is returned unchanged. The `flags` argument of `sceNpCondInit` is ignored.
+- [sceNpGetSystemClockUsec](../../../core/libs/prx/libSceNpCommon/Export.cpp) (libSceNpCommon) - a null destination returns the invalid-argument error `0x80550003` as a host-safety fallback; shadPS4 writes through the pointer without checking it, and the console behaviour is not measured.
 - [sceNpGetSdkVersion](../../../core/libs/prx/libSceNpCommon/Export.cpp) (libSceNpCommon) - writes the libkernel system software version as `major.minor` into an 8-byte buffer without checking it, as shadPS4 does; that version is the fixed `1.00`, not the SDK version a title was built with.
 - [The exports in Runtime.cpp](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) and [Strings.cpp](../../../core/libs/prx/libSceNpCommon/Strings.cpp) follow `libSceNpCommon.sprx` from firmware 13.60, read from disassembly and not measured on a console.
 - [The sce::np::Object new and delete operators](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) (libSceNpCommon) - do not check that the size plus their 16-byte header fits, and free through the allocator stored in that header, ignoring the allocator passed to the delete forms, as `libSceNpCommon.sprx` of firmware 13.60 does, read from disassembly, not measured on a console. The extended forms keep the address of the `SceNpAllocatorEx` itself, whose first member is the allocator.
@@ -2,6 +2,7 @@

 ### Silent stubs

+- [sce::Np::CppWebApi title-imported parameter bookkeeping](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - the `SessionManager::V1` `GameSessionsApi` `ParameterTo*` constructors, destructors, `initialize` and `terminate`, the `RequestGameSession*`/`Patch*RequestBody`/`RequestMatch*`/`Added*`/`Removed*`/`RequestPlayer*`/`RequestTeam*`/`RequestMember*`/`RequestResults*` setters, and the Common `IntrusivePtr`/`Vector`/`Transaction` constructors, destructors and bookkeeping calls over the new families succeed without keeping state or contacting the network. The values are never read because a request is never started. Behaviour beyond the signatures has no source.
 - [sce::Np::CppWebApi::Common](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - the `finish` overrides of `DownStreamTransaction<...>` (2 instantiations) and `Vector<IntrusivePtr<Leaderboards::V1::User>>::pushBack` return success without doing work; a failed request never produces a transaction to finish. `Transaction<...>::setOnFinishedCallback` and `TransactionBase<...>::setResponseInformationOption` (5 instantiations each, the `UserProfile::V1`, `ProfanityFilter::V2` and `CommunicationRestrictionStatus::V3` responses) return success without storing the callback or the option: `start` fails, so neither is ever used. The constructors and destructors of the same five `Transaction<...>` instantiations succeed without keeping state
 - [sce::Np::CppWebApi::Leaderboards::V1](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - request-body bookkeeping succeeds without storing state: `GetRankingRequestBody::set{StartSerialRank,Group,Limit,Users,Offset}`, `RecordScoreRequestBody::set{Comment,SmallData,NeedsTmpRank,ComparedDateTime,PcId}` and `User::{setAccountId,setPcId}`. `BoardsApi::ParameterToGetBoardDefinition`, `RecordApi::ParameterToRecordLargeData`, `RecordApi::ParameterToRecordScore`, `ViewApi::ParameterToGetLargeDataByObjectId` and `ViewApi::ParameterToGetRanking` keep only whether they are initialized, as the SessionManager::V1 parameters do: `initialize` and `terminate` return the codes of the module bundled with PPSA21564, 0x80553512 for an empty `RecordScoreRequestBody` included. They store none of the arguments, and `setxPsnAtomicOperation` and `setgetRankingRequestBody` store nothing either
 - [sce::Np::CppWebApi::SessionManager::V1](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - `RequestPlayerSession::set{MaxSpectators,InvitableUserType,JoinableUserType,ExclusiveLeaderPrivileges}` and `RequestPlayerSessionPlayer::setPushContexts` succeed without storing state. The `PlayerSessionsApi` parameters `ParameterToCreatePlayerSessions`, `ParameterToGetPlayerSessionInvitations`, `ParameterToJoinPlayerSessionAsPlayer` and `ParameterToLeavePlayerSession` keep only whether they are initialized, as the TitleCloudStorage ones do: `initialize`, `terminate` and `setinvitationInvalidFilter` return the codes of the module bundled with PPSA21564, plus 0x80553512 when the request body of `ParameterToCreatePlayerSessions` or `ParameterToJoinPlayerSessionAsPlayer` is empty. They store none of the strings or bodies, and `setfields` stores nothing either: only a request would read them
@@ -20,3 +21,8 @@
 - [libSceNpCppWebApi](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - unimplemented stubs have their parameter lists, const qualifiers and return types aligned with the demangled symbols confirmed by NID matching in [#8143](https://github.com/boykopovar/AnyPS5/issues/8143). They cover response-body accessors, iterators, and uninstantiated transactions in Leaderboards::V1, SessionManager::V1, InGameCatalog::V5, TitleCloudStorage::V1, and Common templates: each mangled name gives the method and parameter types, but the runtime layout of response objects and errors are unverified on console, so each call continues to throw NotImplemented_nid_no_patch. No call site is recorded for them
 - [sce::Np::CppWebApi::SessionManager2V1 and sce::Np::CppWebApi::InGameCatalog2V5](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - 198 further exports imported by PPSA20397, named from aerolib. API calls, factories and transaction `start`/`getResponse*` fail `SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN`; parameter bookkeeping succeeds without state; `IntrusivePtr`/`Vector` helpers follow the layouts above, with `Vector::empty`/`size`/`operator[]` reading host-created bodies and throwing on title-provided ones. Response accessors, iterators, `Vector::begin`/`end`/`copyFrom` and transaction `operator=` throw: a failed request produces no response object. As `start` never succeeds here, `TransactionBase::finish` and `abort` return 0x80553508 and `getId` returns 0, which is what the module bundled with PPSA21564 returns while the two words its `Transaction` constructor zeroes are still unset
 - [sce::Np::CppWebApi::UserProfile::V1, sce::Np::CppWebApi::CommunicationRestrictionStatus::V3 and the remaining sce::Np::CppWebApi::Common instantiations](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - 87 further exports imported by PPSA20397, plus the previously-throwing `ContainerApi::ParameterToGetContainer` lifecycle and `getContainer`. API verbs and transaction `start`/`getResponse` fail `SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN`; parameter and model bookkeeping (`initialize`, `terminate`, `set*`, constructors, destructors) succeeds without state. `BasicProfile`/`BasicPresence`/`PersonalDetail` response accessors, `*IsSet` queries, `Get*Response` getters, vector `begin`/`end`, iterator dereference/compare and transaction `abort`/`getId`/`operator=` throw: no response object exists offline and the model layouts are unverified
+
+- [sce::Np::CppWebApi title-imported exports](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - exports imported by the `sce_module` copies shipped with PPSA20397 and PPSA03530 that main did not declare. NIDs and signatures come only from the titles' import tables; const and return types are inferred from the demangled name. Layouts and offline behaviour follow the landed same-template implementations sourced from the module bundled with PPSA21564. Response-body accessors, `IsSet` queries, `Vector` begin/end, `Iterator` dereference/compare and transaction `operator=` throw: a failed request produces no response object and the layouts are unverified. `SessionManager::V1` `GameSessionsApi`, `Matches::V1`, `Matchmaking::V1`, `UserProfile::V1`, `TitleCloudStorage::V1` and `InGameCatalog::V5` accessors have no other source, so behaviour is only what the signatures admit.
+
+
+
@@ -2,6 +2,7 @@

 ### Silent stubs

+- [sceNpFriendListDialogOpenA](../../../core/libs/prx/libSceNpFriendListDialog/Export.cpp) (libSceNpFriendListDialog) - with `ANYPS5_PSN_DIALOGS=show`, a successful open shows AnyPS5's notice that the feature needs PlayStation Network; the console's own display without PlayStation Network is not measured, and the notice wording is AnyPS5's.
 - [libSceNpFriendListDialog](../../../core/libs/prx/libSceNpFriendListDialog/Export.cpp) - the friend list dialog (`sceNpFriendListDialogOpenA` and `sceNpFriendListDialogGetResultA`) runs the common-dialog state machine but shows nothing and reports the user as having cancelled, as there is no PSN friend list. The signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); the result layout beyond the leading `int32_t` result code is not known, so nothing else is written.

 ### Unknown function info
@@ -1,5 +1,7 @@
 # libSceNpManager technical debt

+- [Older callable NIDs](../../../core/libs/prx/libSceNpManager/Export.cpp): 7 unidentified exports have unverified names, signatures and behavior. These are throwing import-resolution placeholders; no functionality is implemented. No matching NIDs were found in the later module inventory. Six use the primary logical-library qualifier and one uses ForSys; qualified guest resolution is unverified.
+
 ### Silent stubs

 - [sceNpUnregisterPlusEventCallback](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - returns 0 whether or not a callback was registered, as `sceNpUnregisterPremiumEventCallback` does: `sceNpRegisterPlusEventCallback` keeps no callback, and a signed-out user gets no plus events
@@ -1,5 +1,10 @@
 # libSceNpPartner001 technical debt

+### Additional callable exports
+
+- [NpPartner001 export `pQfYTZHznMc`](../../../core/libs/prx/libSceNpPartner001/Export.cpp) is a function record with qualifier `M#A` in older and later version-labelled modules. Both map library ID 12 and module ID 0 to `libSceNpPartner001`. Older module words: `0x08540001`, `0x03200004`; later: `0x13590001`, `0x13600007`. The older module contains five function NIDs; sorted-LF SHA-256: `76ff771e3e2d8c523d0ffe0132db03b6e36fa58176d3bc6a433eb04ad76aa5ab`, using the [static ELF membership procedure](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298). Labels do not authenticate retail provenance; the digest identifies the NID set only. Independent verification requires a matching image. The name, signature and behavior are unverified; this declaration throws.
+
+
 ### Functional

 - [sceNpEAAccessInitialize, sceNpEAAccessTerminate](../../../core/libs/prx/libSceNpPartner001/Export.cpp) (libSceNpPartner001) - initialization marks the library initialized without contacting the server and termination clears it, as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/np/np_partner.cpp); whether the console fails initialization while signed out is unknown. Termination without initialization throws where shadPS4 returns the PS4 error `0x819D0001`, whose PS5 value is unverified, and a second initialization throws where shadPS4 returns 0 without checking. PPSA23566 imports both, not confirmed on its start-up path
@@ -2,6 +2,7 @@

 ### Silent stubs

+- [sceNpProfileDialogOpen, sceNpProfileDialogOpenA](../../../core/libs/prx/libSceNpProfileDialog/Export.cpp) (libSceNpProfileDialog) - with `ANYPS5_PSN_DIALOGS=show`, a successful open shows AnyPS5's notice that the feature needs PlayStation Network; the console's own display for this call without PlayStation Network is not measured, and the notice wording is AnyPS5's.
 - [sceNpProfileDialogOpen, sceNpProfileDialogOpenA, sceNpProfileDialogGetResult](../../../core/libs/prx/libSceNpProfileDialog/Export.cpp) (libSceNpProfileDialog) - no profile is shown: `Open` and `OpenA` move the dialog straight to `FINISHED`, and `GetResult` reports `result` 0, `userAction` `USER_CANCELED` (1) and the caller's `userData`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c2814041e546bf75c12756dbec9da911c721ce1c/src/core/libraries/np/np_profile_dialog/np_profile_dialog.cpp#L21-L180) does when its window is dismissed. Not measured on a console.

 ### Unknown function info
@@ -2,4 +2,5 @@

 ### Silent stubs

+- [sceNpSnsFacebookDialogOpen](../../../core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp) (libSceNpSnsFacebookDialog) - with `ANYPS5_PSN_DIALOGS=show`, a successful open shows AnyPS5's notice that the feature needs PlayStation Network; the console's own display without PlayStation Network is not measured, and the notice wording is AnyPS5's.
 - [libSceNpSnsFacebookDialog](../../../core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp) - the Facebook dialog runs the common-dialog state machine but shows nothing and reports the user as having cancelled, as there is no Facebook account link. The signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); the result layout beyond the leading `int32_t` result code is not known, so nothing else is written.
@@ -3,3 +3,5 @@
 ### Unknown function info

 - [sceNpTcsIntDownloadData, sceNpTcsIntUploadDataToNewSlotAbort and sceNpTcsIntUploadDataToNewSlotBegin](../../../core/libs/prx/libSceNpTcs/Export.cpp) (libSceNpTcs) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpTcs.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+
+- [Older callable NIDs](../../../core/libs/prx/libSceNpTcs/Export.cpp): 8 unidentified exports have unverified names, signatures and behavior. These are throwing import-resolution placeholders; no functionality is implemented. No matching NIDs were found in the later module inventory.
@@ -43,3 +43,5 @@
 | `sceNpTrophy2SystemRemoveUserDataWithServerData` | `w2Uq3rRtT9I` |
 | `sceNpTrophy2SystemUnregisterTitleSyncedCallback` | `Gqf-wNaD-mM` |
 | `sceNpTrophy2SystemUnregisterTitleUpdateCallback` | `-LSu4NCj2p4` |
+
+- [Older callable NIDs](../../../core/libs/prx/libSceNpTrophy2/Export.cpp): 5 unidentified exports have unverified names, signatures and behavior. These are throwing import-resolution placeholders; no functionality is implemented. No matching NIDs were found in the later module inventory.
@@ -59,22 +59,19 @@
 | `sceNpWebApiClearUnusedConnection` | `f-pgaNSd1zc` |
 | `sceNpWebApiGetConnectionStats` | `UJ8H+7kVQUE` |
 | `sceNpWebApiGetErrorCode` | `2qSZ0DgwTsc` |
-| `sceNpWebApiInitializeForPresence` | `FkuwsD64zoQ` |
 | `sceNpWebApiIntCreateCtxIndExtdPushEventFilter` | `c1pKoztonB8` |
-| `sceNpWebApiIntCreateRequest` | `N2Jbx4tIaQ4` |
 | `sceNpWebApiIntCreateServicePushEventFilter` | `TZSep4xB4EY` |
-| `sceNpWebApiIntInitialize` | `8Vjplhyyc44` |
 | `sceNpWebApiIntRegisterServicePushEventCallback` | `VjVukb2EWPc` |
 | `sceNpWebApiIntRegisterServicePushEventCallbackA` | `sfq23ZVHVEw` |
 | `sceNpWebApiRegisterExtdPushEventCallback` | `vrM02A5Gy1M` |
-| `sceNpWebApiRegisterNotificationCallback` | `HVgWmGIOKdk` |
 | `sceNpWebApiSendMultipartRequest` | `KCItz6QkeGs` |
 | `sceNpWebApiSendMultipartRequest2` | `DsPOTEvSe7M` |
 | `sceNpWebApiSetMaxConnection` | `gRiilVCvfAI` |
-| `sceNpWebApiUnregisterNotificationCallback` | `wjYEvo4xbcA` |
-| `sceNpWebApiVshInitialize` | `uRsskUhAfnM` |

 - [sceNpWebApiAbortHandle, sceNpWebApiAddHttpRequestHeader, sceNpWebApiCheckTimeout, sceNpWebApiCreateMultipartRequest, sceNpWebApiSendRequest2, sceNpWebApiSetHandleTimeout, sceNpWebApiSetMultipartContentType, sceNpWebApiSetRequestTimeout](../../../core/libs/prx/libSceNpWebApi/Export.cpp) - the timeout unit is unverified: [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/1d8004a22f/src/core/libraries/np/np_web_api/np_web_api_internal.cpp) logs both timeouts as ms but adds them to microsecond process time, as done here from a request's first send. Not checked on a console; prototypes are [Orbital](https://github.com/AlexAltea/orbital/blob/b321fcdbd7/tools/ida/db_types.json#L1665-L1696)'s, checks shadPS4's. Headers, multipart types and handle timeouts go unused, as nothing is sent. `sceNpWebApiCheckTimeout` aborts expired requests at most once per 1000 µs, then a send returns `NOT_SIGNED_IN`, not `ABORTED`. Multipart parts throw, so no multipart send succeeds.
 - [sceNpWebApiCreateServicePushEventFilter](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - a filter for a PSN service needs the signed-in user, and no user is signed in to PSN, so a valid call returns `SIGNED_IN_USER_NOT_FOUND` after the context and handle checks, as shadPS4 does with its network disabled. `sceNpWebApiDeleteServicePushEventFilter` therefore never finds a filter.
+- [sceNpWebApiInitializeForPresence, sceNpWebApiVshInitialize and sceNpWebApiIntInitialize](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi) - create a library context like `sceNpWebApiInitialize`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0614ce324be092791b758d79f93d9f1ca5b10a81/src/core/libraries/np/np_web_api/np_web_api.cpp#L380-L647) does on the PS4: the 32-byte internal argument structure and its `structSize` check (`INVALID_ARGUMENT`) follow its [declaration](https://github.com/shadps4-emu/shadPS4/blob/0614ce324be092791b758d79f93d9f1ca5b10a81/src/core/libraries/np/np_web_api/np_web_api.h#L100-L106). The context type shadPS4 records and the internal name are not kept, because nothing reads them, as with `libSceNpWebApi2`. Not measured on a console
+- [sceNpWebApiRegisterNotificationCallback and sceNpWebApiUnregisterNotificationCallback](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi) - check a null callback, then the library and user context, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0614ce324be092791b758d79f93d9f1ca5b10a81/src/core/libraries/np/np_web_api/np_web_api_internal.cpp#L305-L346) does, and return 0. The callback is not kept, because no NP notification can arrive offline, so it would never be called. Not measured on a console
+- [sceNpWebApiIntCreateRequest](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi) - creates a request like `sceNpWebApiCreateRequest`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0614ce324be092791b758d79f93d9f1ca5b10a81/src/core/libraries/np/np_web_api/np_web_api.cpp#L411-L432) does: a null group or path, or a method past PATCH, returns `INVALID_ARGUMENT` whatever the SDK version, then a content length without a type returns `INVALID_CONTENT_PARAMETER`. Its internal arguments are three pointers that shadPS4 accepts only when all are null, so a set field throws after the user context check. Not measured on a console
 - [sceNpWebApiCreateContext, sceNpWebApiDeleteContext, sceNpWebApiCreateRequest, sceNpWebApiDeleteRequest, sceNpWebApiAbortRequest, sceNpWebApiSendRequest](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - the online id is not looked up: as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/np/np_web_api/np_web_api_internal.cpp), a user context belongs to the initial user, so a library context holds at most one. With no user signed in to PSN, `sceNpWebApiSendRequest` returns `NOT_SIGNED_IN` unless the request is aborted. Id layouts and the delete, abort and not-found results match an offline PS4 Pro probe on firmware 10.71 (#9797); other checks follow shadPS4. Method 99 after DELETE gives `INVALID_ARGUMENT` (0x80552902) from a probe built at SDK 0x05050001; the 2.50 threshold is shadPS4's, not measured. `sceNpWebApiTerminate` also deletes user contexts and requests; shadPS4 stops after the first user context.
 - [sceNpWebApiRegisterPushEventCallback, sceNpWebApiUnregisterPushEventCallback, sceNpWebApiRegisterServicePushEventCallback, sceNpWebApiUnregisterServicePushEventCallback](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - registered callbacks are never called, since no push event arrives. A null function is rejected from SDK 1.00 and the filter must exist in the library context from SDK 2.50, as in shadPS4; this is not checked on a console. No service filter can be created, so from SDK 2.50 a service callback returns `SERVICE_PUSH_EVENT_FILTER_NOT_FOUND`. Callback ids come from the counter of handles and filters.
@@ -1,5 +1,9 @@
 # libSceOpusDec technical debt

+### Additional callable exports
+
+- [sceOpusDecGetAjmContext](../../../core/libs/prx/libSceOpusDec/Export.cpp) hashes to `OyDFNZOLrp0`; the public 3.20 catalogue does not list it. Two version-labelled images contain function records `OyDFNZOLrp0#D#A` and `OyDFNZOLrp0#E#A`, respectively. Dynamic metadata maps those library IDs and module ID 0 to `libSceOpusDec`. Older module words: `0x08540001`, `0x03200004`; later: `0x13590001`, `0x13600007`. Their 15 and 30 function NIDs have sorted-LF SHA-256 values `f4a21bfa5759129658496cfc706b1aa43d45e5c38f04838e964b09dc97e37cbf` and `323309a804d747d76ac694770153c20644f7d30b210ca7eaaf6c15f949e05837`, using the [static ELF membership procedure](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298). Labels do not authenticate retail provenance; the digests identify NID sets only. Independent verification requires matching images. The signature and behavior are unverified; this declaration throws.
+
 ### Unknown function info

 - [sceOpusDecCancel, sceOpusDecCreate and sceOpusDecCtl](../../../core/libs/prx/libSceOpusDec/Export.cpp) (libSceOpusDec) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceOpusDec.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
@@ -34,8 +34,9 @@
 - [scePadUnknown_n3kSX62fgNo](../../../core/libs/prx/libScePad/Export.cpp) (libScePad, NID `n3kSX62fgNo`) - the name is unknown, and the 0 returned after `scePadInit` is inferred, not measured. In the OS 10.01 system module the function takes no arguments, returns `0x80920005` before `scePadInit`, and otherwise sends a per-process value of 1 to ShellCore over Mbus, returning `0x809200ff` if that call fails and 0 if it succeeds, with or without an open handle. The #3177 probe measured `0x809200ff` in a process that is not a game; a game process is assumed to get 0. The ShellCore setting it changes is unknown and not modelled
 - [scePadSetAngularVelocityDeadbandState](../../../core/libs/prx/libScePad/src/PadState.cpp) (libScePad) - with the deadband on, each angular velocity axis whose magnitude is below 0.017453292 rad/s (1 degree per second) reads as 0, before the orientation is integrated; it starts off. Threshold, per-axis test and default follow [duaLib](https://github.com/WujekFoliarz/duaLib/blob/03bad1bea2a36561b520846776f2a07ced6773e0/src/source/duaLib.cpp#L44), which reimplements the PC `libScePad.dll`; the console's threshold is not measured, and the deadband is kept per port slot. One title (PPSA04354) disassembled for this entry calls it once (0xead26b), only when a change bit of its own is set, with a 32-bit value read through a pointer and 0 or 1 taken from the 0x4 bit of a flags value, and ignores the result. The call does not show the threshold or the default.
 - [PadQueueLegacyAudioHaptics, PadClearLegacyAudioHaptics](../../../core/libs/prx/libScePad/src/PadState.cpp) (libScePad) - PadQueueLegacyAudioHaptics and PadClearLegacyAudioHaptics route legacy audio haptics only to port 0; multi-port queueing is not modelled
- [scePadGetControllerInformation](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - scePadGetControllerInformation always reports connectedCount = 1 and connected = true; behaviour across multiple open controller handles is not measured on hardware
+- [scePadGetControllerInformation](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - scePadGetControllerInformation reports connectedCount = 1 and connected = true on every port, except that port 0 reports its connection state under ANYPS5_PAD_PORT0_STATE=controller; behaviour across multiple open controller handles is not measured on hardware
 - [scePadGetExtControllerInformation](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - on a standard-port handle it returns `NOT_PERMITTED` (0x80920101) and leaves the buffer as it is. Halo CE Universal (PPSA99500) [measured](https://github.com/thelinkin3000/halo-ce-universal/blob/377459f9655971a2f59c09e192c5220042121e6f/port/ps5/probe/results/pad-probe-run2.txt#L2-L29) that answer on firmware 13.59 for two connected DualSenses opened by the title, in three runs, with its [probe](https://github.com/thelinkin3000/halo-ce-universal/blob/377459f9655971a2f59c09e192c5220042121e6f/port/ps5/probe/pad/main.c#L263-L268) zeroing the buffer first. The probe logged only bytes 28 to 47, which stayed zero, so whether the console writes any of the buffer is not known. The special port (type 2) still answers 0 with 0x2c zeroed bytes, which is not measured, and so are the order of the handle and null checks and the answer on a console that grants the permission.
+- [scePadReadState and scePadRead for port 0 while it is withdrawn](../../../core/libs/prx/libScePad/src/PadState.cpp) (libScePad) - under ANYPS5_PAD_PORT0_STATE=controller a port 0 without a controller reads zeroed data (buttons, sticks, triggers and touch zero, orientation identity) with connected false, and scePadRead returns one entry. The shape follows [shadPS4's pad.cpp](https://github.com/shadps4-emu/shadPS4/blob/1d8004a22feb0d5cc58828bac066018e80b6d73f/src/core/libraries/pad/pad.cpp#L369-L374) at commit 1d8004a22feb0d5cc58828bac066018e80b6d73f. What the console returns for a removed controller (zeroed, neutral or an error code) and the connected_count it reports are not measured.
 - [scePadOpen and scePadOpenExt](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the special port (type 2) opens a handle per user (`PAD_SPECIAL_HANDLE` + slot, 16 slots for the console's 16 accounts, a 17th user gets the unknown-user code 0x809b0081) that every pad call accepts: reads give the rest record (sticks 0x80, orientation w 1, acceleration y 1, `connected` false), information is zeroed, extended information has device class -1, setters succeed without effect. Not measured: the console's own handle values (fresh per open), a PS5, and the calls the PS4 Pro survey (firmware 10.71, no special controller) did not cover; it measured open, `ALREADY_OPENED`, `scePadGetHandle`, both reads, both informations, the five setters above, close, and that two logged-in users get independent handles. `scePadOpenExt` returns `DEVICE_NOT_CONNECTED` (0x80920007) for special ports, unmeasured; PPSA01317 skips a user on any negative result. `scePadOpenExt` throws for other port types
 - [scePadOpen, scePadGetHandle, scePadRead and scePadReadState for the remote control port](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - whether a console without a media remote opens the system user's remote control port (type 16), returns `DEVICE_NOT_CONNECTED` or fills other fields is not measured. The host has no remote, so the port opens its own handle (`PAD_REMOTE_HANDLE`) that reads one zeroed entry with no buttons and `connected` false; the other pad calls reject it with `INVALID_HANDLE`. SDL's PS5 video driver maps this port's buttons to keys, so a remote that read the DualSense turned Cross into Return (Raptor PPSA94002).
 - [scePadOpen](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - port types 3 and 4 throw: a payload process on a PS5 (firmware 13.60) let them past the type check, but it cannot open a port for its own logged-in user (0x809b0081), so what they open is unknown. The argument checks it did reach are followed: types 1, 5, 6, 255 and -1, and 16 for a user other than the system user, fail with `INVALID_ARG` before the user is looked at, user -1 with 0x809b0001 on types 0, 2, 3 and 4 and on index 1, and index 1 of a logged-in user with 0x809b0003; whether index 1 of types 3 and 4 fails the same way was not measured; the payload never tried type 16 with the system user (255), which opens the remote control port as below. Of 21 calls in ten titles checked, all pass index 0 and no param; 15 pass type 0, three type 2 (PPSA01494, PPSA30839, PPSA31162) and three a type from a register or field (PPSA18194, PPSA25286)
@@ -2,4 +2,7 @@

 ### Unknown function info

- [sceBufferAlloc, sceBufferDup, sceBufferFree, sceBufferInit, sceBufferRealloc, scePlayReadyApiInitializeInitParams, scePlayReadyApiIsStarted, scePlayReadyApiStart, scePlayReadyApiStop, scePlayReadyApiVersion, scePlayReadyApiVersionString, scePlayReadyBufferFree, scePlayReadyBufferInit, scePlayReadyBufferMalloc, scePlayReadyBufferRealloc, scePlayReadyContentGetProperty, scePlayReadyContentSetProperty, scePlayReadyDomainCertEnumFini, scePlayReadyDomainCertEnumInit, scePlayReadyDomainCertEnumNext, scePlayReadyDomainCertFind, scePlayReadyDomainJoinGenerateChallenge, scePlayReadyDomainJoinProcessResponse, scePlayReadyDomainLeaveGenerateChallenge, scePlayReadyDomainLeaveProcessResponse, scePlayReadyEnvelopeClose, scePlayReadyEnvelopeGetSize, scePlayReadyEnvelopeInitializeRead, scePlayReadyEnvelopeOpen, scePlayReadyEnvelopeRead, scePlayReadyEnvelopeSeek, scePlayReadyFinalize, scePlayReadyFreeDecryptContext, scePlayReadyInitialize, scePlayReadyInitializeInitParams, scePlayReadyLicenseAcqGenerateAck, scePlayReadyLicenseAcqGenerateChallenge, scePlayReadyLicenseAcqGetAdditionalResponseData, scePlayReadyLicenseAcqProcessAckResponse, scePlayReadyLicenseAcqProcessResponse, scePlayReadyMemAlloc, scePlayReadyMemFree, scePlayReadyMemRealloc, scePlayReadyNewDecryptContext, scePlayReadyReaderBind, scePlayReadyReaderCommit, scePlayReadyReaderDecrypt, scePlayReadyReset and scePlayReadyStoreCleanup](../../../core/libs/prx/libScePlayReady/Export.cpp) (libScePlayReady) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libScePlayReady.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceBufferAlloc, sceBufferDup, sceBufferFree, sceBufferRealloc, scePlayReadyApiIsStarted, scePlayReadyApiStart, scePlayReadyApiStop, scePlayReadyBufferFree, scePlayReadyBufferMalloc, scePlayReadyBufferRealloc, scePlayReadyContentGetProperty, scePlayReadyContentSetProperty, scePlayReadyDomainCertEnumFini, scePlayReadyDomainCertEnumInit and scePlayReadyDomainCertEnumNext](../../../core/libs/prx/libScePlayReady/Export.cpp) (libScePlayReady) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libScePlayReady.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [scePlayReadyDomainCertFind, scePlayReadyDomainJoinGenerateChallenge, scePlayReadyDomainJoinProcessResponse, scePlayReadyDomainLeaveGenerateChallenge, scePlayReadyDomainLeaveProcessResponse, scePlayReadyEnvelopeClose, scePlayReadyEnvelopeGetSize, scePlayReadyEnvelopeInitializeRead, scePlayReadyEnvelopeOpen, scePlayReadyEnvelopeRead, scePlayReadyEnvelopeSeek, scePlayReadyFinalize, scePlayReadyFreeDecryptContext, scePlayReadyInitialize and scePlayReadyLicenseAcqGenerateAck](../../../core/libs/prx/libScePlayReady/Export.cpp) (libScePlayReady) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libScePlayReady.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [scePlayReadyLicenseAcqGenerateChallenge, scePlayReadyLicenseAcqGetAdditionalResponseData, scePlayReadyLicenseAcqProcessAckResponse, scePlayReadyLicenseAcqProcessResponse, scePlayReadyMemAlloc, scePlayReadyMemFree, scePlayReadyMemRealloc, scePlayReadyNewDecryptContext, scePlayReadyReaderBind, scePlayReadyReaderCommit, scePlayReadyReaderDecrypt, scePlayReadyReset and scePlayReadyStoreCleanup](../../../core/libs/prx/libScePlayReady/Export.cpp) (libScePlayReady) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libScePlayReady.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceBufferInit, scePlayReadyBufferInit, scePlayReadyApiInitializeInitParams, scePlayReadyInitializeInitParams, scePlayReadyApiVersion and scePlayReadyApiVersionString](../../../core/libs/prx/libScePlayReady/Export.cpp) (libScePlayReady) - prototypes and behaviour follow firmware 13.42's libScePlayReady.sprx, read from disassembly and run natively, not measured on a console. The buffer calls clear 0x18 bytes and the init-params calls clear 0x138 bytes and then write 0x50524459 and 1 as the first two 32-bit words; what the fields mean is unknown, so the calls take `void*`. The version string is one static 32-byte buffer that every call rewrites, as in the firmware, so a string returned earlier changes and concurrent calls race
@@ -0,0 +1,5 @@
+# libScePngParser technical debt
+
+### Callable exports
+
+- [Callable exports](../../../core/libs/prx/libScePngParser/Export.cpp) - Seven 3.20 callable NIDs are import-resolution declarations only. One NID also appears in the 13.60-labelled inventory; other NIDs differ across versions. Their signatures and behavior are unverified; parameterless `int` declarations are placeholders, not verified ABI contracts. Every entry throws through `NotImplemented_nid_no_patch`. No runtime functionality is implemented. Data exports require separate layout and ownership analysis.
@@ -1,5 +1,10 @@
 # libSceRemoteplay technical debt

+### Additional callable exports
+
+- [Remoteplay export `HV7jZe1frbM`](../../../core/libs/prx/libSceRemoteplay/Export.cpp) is a function record with qualifier `D#A` in older and later version-labelled modules; both map library ID 3 and module ID 0 to `libSceRemoteplay`. Older module words: `0x08540001`, `0x03200004`; later: `0x13590001`, `0x13600007`. The older module contains 44 function NIDs; sorted-LF SHA-256: `dbfa653ec4819a116d5271c2db9a177acb6dfefc0915322b10ef21611fbe0844`, using the [static ELF membership procedure](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298). Version labels do not authenticate retail provenance; the digest identifies the NID set only. Independent verification requires a matching image. The name, signature and behavior are unverified; this declaration throws.
+
+
 ### Silent stubs

 - [sceRemoteplayGetConnectionStatus](../../../core/libs/prx/libSceRemoteplay/Export.cpp) (libSceRemoteplay) - reports `REMOTEPLAY_CONNECTION_STATUS_DISCONNECT` (0) for any user ID: on the console the value comes from the session service, and the wrapper retries once through another internal query when that answers `0x80020003`; this tree has no session, so the value and the retry path are unmodelled
@@ -31,6 +31,10 @@
 - [sceSaveDataMount3](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - an unterminated or empty directory name, `.`, `..`, or a name containing `/`, `\` or `:` returns `SAVE_DATA_ERROR_PARAMETER`, which the [SDK 12.000 reference](https://github.com/peterpuppy/bm/blob/3f9d1ba6b896a53080460c903f5c15af8affb80d/features/ps5/document/output/psn_12/System/Save_Data/SaveData-Reference/sce-save-data-mount3.md#L196-L204) lists for an invalid parameter, and leaves the result as it was, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/569ec04d1a77127c601eed522ad5bba187173f9d/src/libs/libSaveData.cpp#L652-L658) does. The [SDK](https://github.com/peterpuppy/bm/blob/3f9d1ba6b896a53080460c903f5c15af8affb80d/features/ps5/document/output/psn_12/System/Save_Data/SaveData-Reference/sce-save-data-dir-name.md#L32-L36) lets an application use only letters, digits, `-`, `.` and `@` in a name, and KytyPS5 also accepts `_` ([`valid_path_component`](https://github.com/KytyPS5/KytyPS5/blob/569ec04d1a77127c601eed522ad5bba187173f9d/src/libs/libSaveData.cpp#L276-L287)); which other names the console's mount rejects is not checked on hardware
 - [sceSaveDataBackup](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - an unterminated directory name returns `SAVE_DATA_ERROR_PARAMETER` to prevent unbounded copy; which other directory names the console's backup rejects is unverified on hardware.
 - [sceSaveDataBackup, sceSaveDataConvert, sceSaveDataDelete, sceSaveDataDirNameSearch, sceSaveDataDirNameSearchPs4, sceSaveDataGetEventResult, sceSaveDataGetMountInfo, sceSaveDataGetParam, sceSaveDataLoadIcon, sceSaveDataMount, sceSaveDataMount3, sceSaveDataSaveIcon, sceSaveDataSetParam, sceSaveDataUmount2](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - null pointer arguments return `SAVE_DATA_ERROR_PARAMETER` instead of throwing C++ exceptions, an implementation assumption matching guest error expectations not checked on hardware; unmounted targets return `SAVE_DATA_ERROR_NOT_MOUNTED`, and parameter type or buffer size violations return `SAVE_DATA_ERROR_PARAMETER` after slot lookup
+- [sceSaveDataUmount2](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - a mount point that is not mounted returns `SAVE_DATA_ERROR_NOT_MOUNTED` (0x809F0004), which no console run has checked. KytyPS5's `sceSaveDataUmount2` (PS5, `src/libs/libSaveData.cpp`, commit 5e837a9beac82c031868eaad9348d6a48245fb99) returns `SAVE_DATA_ERROR_NOT_FOUND` (0x809F0008) there. For the PS4 `sceSaveDataUmount`, which none of the local titles import, shadPS4 (PS4, `src/core/libraries/save_data/savedata.cpp`, commit 0614ce324be092791b758d79f93d9f1ca5b10a81) returns `SAVE_DATA_ERROR_NOT_FOUND` and fpPS4 (PS4, `sys/sys_path.pas`, commit 04cefd43e6fddd1ab033e7980cd356d14c964905) `SAVE_DATA_ERROR_NOT_MOUNTED`. Forty of the 53 local titles import `sceSaveDataUmount2`.

 - [sceSaveDataSyncSaveDataMemory](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - validates library initialization and parameters; since in-memory saves flush synchronously on write, sync confirms existence and readiness of the memory blob
 - [sceSaveDataGetMountedSaveDataCount](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - signature and behavior are unverified; the function throws. [SharpEmu](https://github.com/sharpemu/sharpemu/blob/b1ec2866575bf72ffcef92cd639c580bf5bf0c61/src/SharpEmu.Libs/SaveData/SaveDataExports.cs) and [RPS5E](https://github.com/keklick1337/rps5e/blob/d540c46f5d83efac3a0df9b2edc14cf12fe9f2be/crates/ps5hle/src/savedata.rs) write the count through a second argument and return a status; their console accuracy is unverified.
+- [sceSaveDataMount3](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - the console's `NO_SPACE_FS` code, the rounding of `required_blocks` and whether it checks the volume when a save is created are not measured; with `ANYPS5_FREE_SPACE=host` a save larger than the room of its volume fails with `0x809F000A` and sets `required_blocks` to the missing blocks rounded up to 64 KiB, as shadPS4 does at [savedata.cpp L468-L481](https://github.com/shadps4-emu/shadPS4/blob/1d8004a22feb0d5cc58828bac066018e80b6d73f/src/core/libraries/save_data/savedata.cpp#L468-L481), which rounds down and checks the full size
+- [sceSaveDataGetMountInfo, sceSaveDataDirNameSearch](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - whether the console bounds a save's free blocks by the room of the disk is not measured; with `ANYPS5_FREE_SPACE=host` they are the smaller of the save's own free blocks and the 64 KiB blocks its volume still has, and a full volume reports none
+- [sceSaveDataMount3, sceSaveDataGetMountInfo](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - the 64 KiB block that the room and free-block figures use is not measured on a console; [shadPS4 L50-L52](https://github.com/shadps4-emu/shadPS4/blob/1d8004a22feb0d5cc58828bac066018e80b6d73f/src/core/libraries/save_data/savedata.cpp#L50-L52) uses 32 KiB blocks and 96 to 32768 blocks, so the bytes that host mode requires for a save, and its free-block counts, would differ by a factor of two if the console uses 32 KiB
@@ -8,3 +8,7 @@

 - [Primitive touch events](../../../core/libs/prx/libSceSystemGesture/Export.cpp): pad handles are not validated against native controller information. Begin, active and end states are confirmed, but cancellation state 4, motion thresholds and SDK-dependent duplicate-report handling remain unimplemented. Timing, coordinate conversion and update flags still use the host approximation. Recognizer allocation and native descriptor layouts remain incomplete.
 - [sceSystemGestureDebugGetVersion](../../../core/libs/prx/libSceSystemGesture/Export.cpp) (libSceSystemGesture) - its name and NID are in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSystemGesture.c), but no credible prototype was found. It is declared without parameters solely to resolve known imports; this is not an ABI claim
+
+### Additional callable exports
+
+- [sceSystemGestureSetTouchAreaInformation](../../../core/libs/prx/libSceSystemGesture/Export.cpp) hashes to `dWKhDgKLsHY`; the public 3.20 catalogue does not list it. The `libSceSystemGesture.sprx` module in each image labelled 3.20 and 13.60 contains `dWKhDgKLsHY#D#A` as a function record. Dynamic metadata maps library ID 3 and module ID 0 to `libSceSystemGesture`. The 3.20-labelled module words are `0x08540001`, `0x03200004`; the 13.60-labelled module words are `0x13590001`, `0x13600007`. Both contain 24 unique function NIDs; sorted-LF SHA-256: `acad8b5f908d6431db3c2d2a5dcffbd79eca1e1f8a02127e8671d82da0fca38d`, using the [static ELF membership procedure](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298). Labels do not authenticate retail provenance; the digest identifies the NID set only. Independent verification requires a matching image. The signature and behavior are unverified; this declaration throws.
@@ -106,6 +106,8 @@
 - [sceCoredumpSequenceHandlerGetCoredumpStatusByAppId](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - unknown signature
 - [sceCoredumpSequenceHandlerCancelCoredump](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - unknown signature

+- [sceShellCoreUtilGetFreeSizeOfUserPartition, sceShellCoreUtilGetFreeSizeOfAvContentsTmp](../../../core/libs/prx/libSceSystemService/PendingExports.cpp) (libSceSystemService) - the units of the sizes and what the user partition's free and total sizes measure are not measured; shadPS4 stubs both as returning OK without writing an output ([systemservice.cpp L832-L840](https://github.com/shadps4-emu/shadPS4/blob/1d8004a22feb0d5cc58828bac066018e80b6d73f/src/core/libraries/system/systemservice.cpp#L832-L840)), so no value is known and both throw through `NotImplemented_nid_no_patch`
+
 ### Functional

 - [sceSystemServiceLoadExec](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - besides `"exit"`, it starts the title's own `/app0/eboot.bin` or another executable under `/app0` that the relinker converted with `--executable`, which is looked up beside the running one (`/app0/picker/picker.bin` as `picker.picker.bin` with the running executable's extension). The main executable is the one `APS5_EBOOT` names, which the first call sets to its own path. After the guest shutdown the old process ends without running guest exit handlers or host destructors; as during `exit`, a guest thread that calls a library the shutdown has stopped waits for the end instead of unwinding. `"exit"` ends the process after the host shutdown without running the title's `atexit` and `__cxa_atexit` handlers, since the console's shell closes the title instead; a line the title writes just before through its own thread, such as a forwarded standard error line, may not be printed. [VLC for PS5](https://github.com/ZiZc3/VLC/blob/86bb7d474a303f62bb3c2fc12f728db4846085b8/src/platform_ps5.c#L565-L571) (PPSA85300) relaunches itself with no arguments; RetroArch (PPSA99169) starts its frontend picker with `{"", NULL}`, and the picker starts `eboot.bin` with `{"--ps5-mode=retroarch", NULL}` or `/app0/es-de/es-de.bin` ([picker.cpp](https://github.com/mihawk-99/PS5_RetroArch/blob/bead80725cc11e3c5c65bd9424b0a4494ae36d45/frontends/picker/picker.cpp#L444-L446)), so the list holds only arguments. A list with a first entry becomes the whole guest `argv`, with no program name in front ([LoadExec.cpp](../../../core/libs/prx/libSceSystemService/LoadExec.cpp)): a [PS5 RetroArch console transcript](https://github.com/mihawk-99/PS5_RetroArch/blob/bead80725cc11e3c5c65bd9424b0a4494ae36d45/evidence/loadexec-second-image/relaunch-test.jsonl) records a restart with one argument entering with `argc=1`, `argv[0]="--ps5-relaunch=1"`, and a launch from the home screen with `argc=1`, `argv[0]=""` ([relaunch_ps5.cpp](https://github.com/mihawk-99/PS5_RetroArch/blob/bead80725cc11e3c5c65bd9424b0a4494ae36d45/src/relaunch_ps5.cpp#L161-L164)). For such a list Linux replaces the process with `fexecve`, and macOS with `posix_spawn` and `POSIX_SPAWN_SETEXEC`: the PID and the standard streams stay, the other descriptors are closed and the working directory becomes the executable's. Windows starts a suspended process that inherits only the standard streams and a handle of the old process, and its entry stub waits for the old process to end before it loads the title's libraries, so a shell or script that started the title sees it end. A null list or one without a first entry keeps the earlier launch: the new executable gets only its own path as its command line (`CreateProcessW` on Windows, `execv` on Linux and macOS), so its `argv[0]` is the host path, and the old process ends without waiting for it. What the console passes for such a list is not known, nor are its argument limits and error codes. Paths outside `/app0` and unconverted executables throw
@@ -1,5 +1,10 @@
 # libSceSystemTts technical debt

+### Additional callable exports
+
+- [SystemTts export `aIz2UUh6oi0`](../../../core/libs/prx/libSceSystemTts/Export.cpp) is a function record with qualifier `L#A` in older and later version-labelled modules. In both, dynamic metadata maps library ID 11 and module ID 0 to `libSceSystemTts`. Older module words are `0x08540001` and `0x03200004`; later words are `0x13590001` and `0x13600007`. The older image has seven function NIDs with sorted-LF SHA-256 `64564168e4e9e9ac73985b56e5de18ae073f1698cbdfca177c2add4b22f9323f`, using the [static ELF membership procedure](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298). Version labels do not authenticate retail provenance, and the digest identifies the NID set only. The export name, signature and behavior are unverified; this declaration throws.
+
+
 ### Unknown function info

 - [sceSystemTtsConvertText, sceSystemTtsPauseResume, sceSystemTtsRepeat, sceSystemTtsWait](../../../core/libs/prx/libSceSystemTts/Export.cpp) have unknown signatures and behaviour. The parameterless `int` declarations are import-resolution placeholders, not confirmed ABI signatures, and throw through `NotImplemented_nid_no_patch`. Only the names and NIDs are established by the [13.60 export inventory](https://github.com/xdCloudy/PS5-13.60-Function-Stub-Library/blob/bfec40deb4c47a17d7603ee2bc79aa6862c0c56b/data/firmware-13.60/libscesystemtts-8f4923bcd1.jsonl).
@@ -45,7 +45,10 @@

 ### Unknown function info

+- [sceUserServiceGetLoginUserIdList and sceUserServiceGetEvent for user 0](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - under ANYPS5_PAD_PORT0_STATE=controller user 0 logs out when its controller is removed and logs in when it returns, after a hold of 500 ms that AnyPS5 chooses. Whether the console logs the initial user out on controller removal, how long it takes and which event it sends are not measured. The default mode keeps user 0 logged in as before.
 - [sceUserServiceGetNpAccountId](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - the account id for a logged-in user with no linked PSN account is assumed to be 0 with success; libSceNpManager's `sceNpGetAccountIdA` answers the same question with `SCE_NP_ERROR_SIGNED_OUT`. Console measurement on PS4 Pro firmware 10.71 confirms a user that is not logged in returns `0x80960105` (`USER_SERVICE_ERROR_UNKNOWN_USER`) and leaves the output untouched, differing from `sceUserServiceGetUserName`.
+- [Older settings exports](../../../core/libs/prx/libSceUserService/LegacyExports.cpp) - Forty callable NIDs are declared as throwing placeholders for older software. Their signatures and behavior are unverified; parameterless `int` declarations are placeholders, not verified ABI contracts. The corresponding NIDs are absent from the later version-labelled inventory. Representative later settings functions use a related dispatch pattern, which does not establish compatibility for these settings. No functionality is implemented.
+
 - [sceUserServiceInitialize and sceUserServiceInitialize2](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - event delivery has no background service thread, so the confirmed priority and Initialize2 CPU affinity mask do not affect host scheduling. Of 23 `sceUserServiceInitialize` calls in ten titles checked, 17 pass no param, four pass priority 700 (Borderlands 4 PPSA01494, Crimson Desert PPSA25286, MXGP 26 PPSA30839, Super Meat Boy 3D PPSA31162), one passes 767 (Ghost of Tsushima PPSA02225) and one in Metal Gear Solid 4's `mgs4.elf` passes a param from a register. None calls `sceUserServiceInitialize2`.
 - [sceUserServiceGetUserColor](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - the profile colour corresponds to user index (0: blue, 1: red, 2: green, 3: pink); colours 1, 2 and 3 are assumed, not measured
 - [sceUserServiceGetUserName](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - `0x80960105`, which a PS5 (firmware 13.60) returns for a user id it does not know, has no known name; it is `USER_SERVICE_ERROR_UNKNOWN_USER` here. On the console a registered user who is not logged in still gets their name; here up to 4 users ("Player", "Player2", "Player3", "Player4") are supported; user names "Player2", "Player3" and "Player4" are assumed, not measured
@@ -1,5 +1,10 @@
 # libSceVideoNativeExtEssential technical debt

+### Additional callable exports
+
+- [Native video export `iwAQhvb9BvY`](../../../core/libs/prx/libSceVideoNativeExtEssential/Export.cpp) is a function record with qualifier `K#A` in older and later version-labelled modules. Both map library ID 10 and module ID 0 to `libSceVideoNativeExtEssential`. Older module words: `0x08540001`, `0x03200004`; later: `0x13590001`, `0x13600007`. Both contain six function NIDs; sorted-LF SHA-256: `2c1bdced348433c9cb792b70a0f043d932e6f822157250d5256bb46c8867bd86`, using the [static ELF membership procedure](https://github.com/boykopovar/AnyPS5/pull/12367#issuecomment-6470603298). Labels do not authenticate retail provenance; the digest identifies the NID set only. Independent verification requires a matching image. The export name, signature and behavior are unverified; this declaration throws.
+
+
 ### Unknown function info

 - [sceVideoNativeExtEssential_CreateDecInstance, sceVideoNativeExtEssential_DestroyDecInstance, sceVideoNativeExtEssential_Finalize, sceVideoNativeExtEssential_Initialize and sceVideoNativeExtEssential_IsInit](../../../core/libs/prx/libSceVideoNativeExtEssential/Export.cpp) (libSceVideoNativeExtEssential) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVideoNativeExtEssential.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
@@ -47,6 +47,8 @@

 - The following pending declarations have unverified signatures and behavior; they are parameterless import-resolution declarations and throw through `NotImplemented_nid_no_patch`: [`sceDbgVideoOutAddOutputModeVr60Privilege`](../../../core/libs/prx/libSceVideoOut/Unimplemented.cpp).

+- [ANYPS5_PAD_PORT0_STATE](../../../core/libs/prx/libSceVideoOut/include/Port0Presence.hpp) (libSceVideoOut) - the 500 ms hold before a controller's removal or return changes port 0, and the rule that keyboard and mouse input reaches port 0 only while a controller is bound there, are AnyPS5 choices that keep a flapping cable from flapping the title. The console's own reaction (how long it takes to report a removed pad, whether it pauses on connected false, and whether it logs the initial user out) is not measured.
+
 ### Additional callable exports

 - The [revision-pinned identity inventory](https://gist.github.com/kyon-eth/ea0a096e6231dbe7b98b5a308e2ac91e/00f8422a1ae71e32816d72ae579c2f2d097f63a0) records module, logical library, symbol type and NIDs for [InventoryExports.cpp](../../../core/libs/prx/libSceVideoOut/InventoryExports.cpp); it is a metadata summary rather than independent verification. Some NIDs belong to multiple logical libraries within the module.
@@ -237,3 +239,7 @@
 | `Unknown` | `yGMBA0AKcgQ` |
 | `Unknown` | `yoK0AjkkBkI` |
 | `Unknown` | `ys239q8VgXY` |
+
+- [sceVideoOutSetConfigurationMode](../../../core/libs/prx/libSceVideoOut/InventoryExports.cpp): the name hashes to NID `N1+j0RymMUQ`, a function export in both older and later version-labelled images. Its signature and behavior are unverified; this import-resolution declaration throws.
+
+- [Older callable NIDs](../../../core/libs/prx/libSceVideoOut/InventoryExports.cpp): 7 unidentified exports have unverified names, signatures and behavior. These are throwing import-resolution placeholders; no functionality is implemented. No matching NIDs were found in the later module inventory. Six use the primary library qualifier and one uses the nosubmission qualifier; qualified guest import resolution is unverified.
@@ -2,8 +2,17 @@

 ### Silent stubs

+- [sceWebBrowserDialogOpen, sceWebBrowserDialogOpenForPredeterminedContent](../../../core/libs/prx/libSceWebBrowserDialog/Export.cpp) (libSceWebBrowserDialog) - with `ANYPS5_PSN_DIALOGS=show`, a successful open shows AnyPS5's generic notice that the system feature is not available; no PlayStation Network link is claimed, since no source ties this dialog to it, and the console's own display is not measured.
 - [libSceWebBrowserDialog](../../../core/libs/prx/libSceWebBrowserDialog/Export.cpp) - `sceWebBrowserDialogOpen` and `sceWebBrowserDialogOpenForPredeterminedContent` run the common-dialog state machine without displaying an interactive browser, and `sceWebBrowserDialogGetResult` reports that the user cancelled. Minecraft Bedrock (PPSA17221) imports `sceWebBrowserDialogOpenForPredeterminedContent` (#5744). The 424-byte allow-list parameter and its twenty optional address pointers are validated, but address filtering is not modelled without an interactive browser. Main open-parameter validation remains incomplete.
 - [sceWebBrowserDialogSetCookie, sceWebBrowserDialogResetCookie](../../../core/libs/prx/libSceWebBrowserDialog/Export.cpp) (libSceWebBrowserDialog) - there is no browser cookie store. Both calls check their parameters in the same order and with the same codes as the PS5 13.60 module, then return 0 without storing or clearing anything. On the console they then forward the request to the browser service. While an opened dialog has not been updated to finished, closed or terminated, they return `0x80B80006` (the console's open-dialog flag).
 ### Unknown function info

 - [sceWebBrowserDialogGetEvent, sceWebBrowserDialogNavigate, sceWebBrowserDialogSetZoom](../../../core/libs/prx/libSceWebBrowserDialog/Export.cpp) (libSceWebBrowserDialog) - their names and NIDs are in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceWebBrowserDialog.c); the no-parameter prototypes follow [shadPS4 `webbrowserdialog.cpp`](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/web_browser_dialog/webbrowserdialog.cpp#L23-L85) and are not measured on a console. They are declared without parameters solely to resolve known imports; this is not an ABI claim, and every call throws.
+
+### Additional callable exports
+
+- [Additional callable export](../../../core/libs/prx/libSceWebBrowserDialog/Export.cpp): `8r4EJ3FiX4w#H#A` is a function record in `libSceWebBrowserDialog.sprx` from images labelled 3.20 and 13.60. The dynamic metadata maps library ID 7 to `libSceWebBrowserDialogLimited` and module ID 0 to `libSceWebBrowserDialog`. The labels do not authenticate retail firmware provenance. The name, parameter list, return type and behavior are unverified; this import-resolution placeholder throws through `NotImplemented_nid_no_patch`.
+
+| Name | NID |
+| --- | --- |
+| `Unknown` | `8r4EJ3FiX4w` |
@@ -2,6 +2,7 @@

 ### Silent stubs

+- [sceKernelCreateSema](../../../core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp) (libkernel) - attributes 0x100 to 0x102 are accepted and ignored: a payload process on a PS5 (firmware 13.60) accepted them and created a working semaphore, but their effect is unknown ([measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L10-L23)).
 - [SO_TIMESTAMP, SO_BINTIME](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - the arrival time in their control messages is `CLOCK_REALTIME` read when the host hands the datagram over, not when it reached the socket. Otherwise `recvmsg` on a UDP socket returns them as a payload process on PS5 firmware 13.60 got them: one 32-byte `SCM_BINTIME` (IPv4 only) then one `SCM_TIMESTAMP` at `SOL_SOCKET`, and a control buffer too small for them gets as many bytes as fit, its length, and `MSG_CTRUNC`. That partial copy is the console's: FreeBSD 11.4's `kern_recvit` copies whole messages only. Not measured, after 11.4: an empty buffer gets nothing and `MSG_CTRUNC`, no buffer gets nothing, and a TCP or Unix socket gets no message
 - [sceKernelGetSocPowerConsumption](../../../core/libs/prx/libkernel/System/src/ThermalSensors.cpp) (libkernel) - returns `EINVAL` and writes nothing, as `sceKernelGetSocSensorTemperature` does when the host has no sensor: the host's package power is not read (Linux RAPL `energy_uj` is readable by root only, and Windows has no general source). The prototype is not documented. PS5LM Plus (PPSA99581) passes a zeroed 128-byte buffer and, on success, reads its first 32-bit word as milliwatts, accepting 1000 to 350000; on failure it shows 0 W. On PS5 firmware 13.60 a payload process gets 0 and 112 bytes (28 32-bit words) written, the first one about 4700 when idle, and a null buffer faults; the unit is not known
 - [scePthreadMutexattrSetprotocol, scePthreadMutexattrGetprotocol, scePthreadMutexattrSetprioceiling, scePthreadMutexattrGetprioceiling](../../../core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp) (libkernel) - `scePthreadMutexattrSetprotocol` accepts 0 to 2 as a PS5 (firmware 13.60) does and returns `EINVAL` otherwise, but the protocol is not applied: priority inheritance and protection are not modelled. On the console a null or uninitialized mutex attribute returns `EINVAL` from the SCE attribute calls, `scePthreadMutexInit` takes an uninitialized attribute as the default one, and a destroyed mutex returns `EINVAL` from `scePthreadMutexDestroy`; a null mutex pointer crashed the payload and still throws
@@ -79,7 +80,7 @@
 - [Protecting a host thread's stack](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - on Windows `sceKernelIsStack` reports a host thread's whole stack reservation, which Windows commits on demand from the top down behind a guard page. A protect over that range changes only the pages above the guard; the guard page and the reserved pages below it are left as they are, so the stack still grows and an overflow still raises a stack overflow. A protect that starts at the bottom of the reservation and stops short of the guard page, as HotSpot makes its stack guard zones, is committed and protected. Windows moves the guard page down by committing the pages below it as read/write guard pages, whether they were reserved or committed, so those pages come in read/write as the stack grows to within one guard region of them (three pages on GitHub's runners). A protection other than read/write on them, `PROT_NONE` included, does not hold once the stack is that close, where on the console every page of the reported range takes the protection. Holding it would mean removing the thread's guard page and keeping the stack limit in its TEB by hand. On Linux the reported range of the main thread is mostly unmapped; the unmapped pages from the bottom of a protect up to the top of the stack are mapped read/write in place, then the protect is applied, so the stack never has to grow down to the protected pages, which Linux refuses within its stack guard gap (1 MiB by default) above a readable mapping. The pages below a protect stay unmapped and out of the stack's reach, where on the console the stack goes on below them
 - [Foreign guest module image protection on Windows](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - `sceKernelMprotect` on Windows allows protection mutations on mapped PE images containing a `.elf0` section (as relinked guest modules produce, such as NVIDIA Real-time Denoisers `libNRD.prx` bundled in Dying Light 2: Stay Human PPSA02262), registering their sections into `GuestAllocations`. Host libraries and system DLLs (such as `libkernel.prx` and `kernel32.dll`) without a `.elf0` section continue to be rejected
 - [_umtx_op](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - the mutex, condition variable, read-write lock, legacy lock and `SEM2` operations throw, and so does a misaligned object. Implemented as FreeBSD 11's [kern_umtx.c](https://github.com/freebsd/freebsd-src/blob/stable/11/sys/kern/kern_umtx.c): `UMTX_OP_WAIT`, `UMTX_OP_WAKE`, `UMTX_OP_WAIT_UINT`, `UMTX_OP_WAIT_UINT_PRIVATE`, `UMTX_OP_WAKE_PRIVATE`, `UMTX_OP_NWAKE_PRIVATE`, `UMTX_OP_SEM_WAIT` and `UMTX_OP_SEM_WAKE` (the last two built under `COMPAT_FREEBSD9`/`10`). Operations 0 and 1 fail with `EOPNOTSUPP`, as measured on a PS5 (firmware 12.70). The `SEM2` operations, 23 and 24, were measured on the console and returned `0` for a count of 0 where FreeBSD would time out, so they stay unimplemented.
- [sceKernelCreateSema, sceKernelPollSema, sceKernelSignalSema, sceKernelDeleteSema](../../../core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp) (libkernel) - a poll, a signal or a second delete of a deleted semaphore reads freed memory here, where the console returns `0x80020003` (ESRCH) ([measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L17-L19)). A null output pointer to `sceKernelCreateSema` (a fault on PS5 firmware 13.60) and attributes 0x100 to 0x102 (accepted there, effect unknown) throw. Other attributes above 2 and negative maximum and signal counts return `EINVAL` here, as there. `EINVAL` for an initial count above the maximum or negative, a maximum of 0, a null name, a poll of 0 or above the maximum and a signal of 0 is [measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L10-L23).
+- [sceKernelCreateSema, sceKernelPollSema, sceKernelSignalSema, sceKernelDeleteSema](../../../core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp) (libkernel) - a poll, a signal or a second delete of a deleted semaphore reads freed memory here, where the console returns `0x80020003` (ESRCH) ([measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L17-L19)). A null output pointer to `sceKernelCreateSema` (a fault on PS5 firmware 13.60) throws. Other attributes above 2 and negative maximum and signal counts return `EINVAL` here, as there. `EINVAL` for an initial count above the maximum or negative, a maximum of 0, a null name, a poll of 0 or above the maximum and a signal of 0 is [measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L10-L23).
 - [sceKernelSyncOnAddressWait, sceKernelSyncOnAddressWait8/16/32/64 and sceKernelSyncOnAddressWake](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - follow a payload process on a PS5 (firmware 13.60), not a title. Only a null address is checked for `EFAULT`: any other unreadable address is read and faults the host, where the console returned `EFAULT` for address 0x10. The time left that a woken wait writes back is taken from the host clock, so it can differ from the console's by the cost of the call
 - [scePthreadRwlockDestroy, pthread_rwlock_destroy](../../../core/libs/prx/libkernel/Pthread/src/Rwlock.cpp) (libkernel) - measured on a PS5 (firmware 13.60): destroying a rwlock returns 0 whether it is free or held for reading or writing, and leaves 1 in the handle; every call on that handle then returns `EINVAL` until it is initialized again, and a zero handle is initialized on first use by the `scePthreadRwlock` calls as by the POSIX ones. A rwlock destroyed while held is not freed, so its memory leaks. Destroying a rwlock while another thread is acquiring it is not guarded
 - [scePthreadCondWait / scePthreadCondTimedwait](../../../core/libs/prx/libkernel/Pthread/src/Cond.cpp) (libkernel) - the mutex's owner is checked before waiting, as in FreeBSD libthr's [`cond_wait_common`](https://github.com/freebsd/freebsd-src/blob/main/lib/libthr/thread/thr_cond.c#L1992-L2029). Measured in a payload process on a PS5 (firmware 13.60): `EPERM` (`0x80020001`) for an unowned mutex of every type, the adaptive initializer (slot 1), an uninitialized slot and a mutex owned by another thread, `EINVAL` for the destroyed mutex (slot 2), and a recursive mutex is released completely and relocked to its depth. `scePthreadCondDestroy` stores 1, which every condition call refuses with `EINVAL`, and leaves an uninitialized slot alone. Cancellation restores the mutex and depth before cleanup and a canceled waiter forwards a wake, per POSIX; its ordering is not measured
@@ -151,7 +152,7 @@
 - [sceKernelGetTscFrequency](../../../core/libs/prx/libkernel/Time/Time.cpp) (libkernel) pins its thread to the CPU it runs on for the 20 ms measurement, so that both TSC reads come from one counter. If the pin can't be set (`sched_getcpu` or `pthread_getaffinity_np` fails on Linux, `SetThreadAffinityMask` fails on Windows), the measurement runs unpinned. On a host whose CPU TSCs differ, the result can then be wrong as before. Neither call is known to fail for the calling thread's own CPU, which is always in its allowed set. macOS never pins.
 - [Guest TLS on macOS](../../../core/libs/prx/libkernel/Pthread/src/GuestTlsMacOs.cpp) (libkernel) - every guest image has its own TLS block and thread pointer, instead of one thread pointer per thread as on the console, and the word at 0x28 of the thread pointer, which FreeBSD code reads as the stack guard, is 0. macOS cannot set the `%fs` base, so the relinker ([MacOsImage.cpp](../../../core/relinker/elfpatcher/src/macos/MacOsImage.cpp)) turns each `%fs` access into a stub that reads the thread pointer from the pthread key of the image's TLS descriptor and calls `Aps5GuestTlsAllocate` on a thread's first access; the image initializer registers the descriptor with `Aps5GuestTlsRegister`. The thread pointer follows the block and points at itself, as on FreeBSD. `Aps5GuestTlsGetAddr` stands in for `__tls_get_addr`, with the descriptor as the module ID. The key's destructor frees a thread's block.
 - [Guest thread scheduling](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - the policies and priorities that `sched_get_priority_max`, `sched_get_priority_min`, `pthread_setschedparam` and `scePthreadSetschedparam` accept, and those a created thread takes, follow a PS5 (firmware 13.60), but they are only recorded and reported: they are not applied to host threads, so a title's priority order has no effect on host scheduling
- [sched_getparam, sched_getscheduler, sched_setparam](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - the own pid (`getpid()`) throws from any thread but the one `pthread_main_np` reports, and on macOS also from the guest's main thread, which runs on a second host thread. In a payload process on a PS5 (firmware 12.70), `sched_getparam(getpid())` from another thread read the priority of the thread that ran the payload's main, which may not be the process's first thread; FreeBSD's [`p1003_1b.c`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/p1003_1b.c#L110-L289) selects the first thread. `sched_setparam` throws for a policy other than `SCHED_FIFO` or `SCHED_RR`; `EPERM` outside 256-767 was measured only on `SCHED_FIFO`. Unwritable or unreadable parameter stores return `EFAULT` per FreeBSD. `sched_setscheduler` stays unimplemented
+- [sched_getparam, sched_getscheduler, sched_setparam](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - the own pid (`getpid()`) throws from another thread before the main thread's first `scePthreadSelf` and after it exits (FreeBSD then selects a surviving thread; unmeasured), and on macOS from any thread, as the guest main runs on a second host thread. In a payload process on a PS5 (firmware 12.70), `sched_getparam(getpid())` from another thread read the priority of the thread that ran the payload's main, which may not be the process's first thread; FreeBSD's [`p1003_1b.c`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/p1003_1b.c#L110-L289) selects the first thread. `sched_setparam` throws for a policy other than `SCHED_FIFO` or `SCHED_RR`; `EPERM` outside 256-767 was measured only on `SCHED_FIFO`. Unwritable or unreadable parameter stores return `EFAULT` per FreeBSD. `sched_setscheduler` stays unimplemented
 - [sceKernelUuidCreate, sceKernelCreateUuidV4](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) return EFAULT (0x8002000e) for an unwritable destination buffer as a host-safety fallback; console behaviour for unwritable memory has not been measured.
 - [Linux runtime module initialization](../../../core/libs/prx/libkernel/Module/src/DynamicLoader.cpp) (libkernel) - modules in explicit runtime directories can be mapped for bindings before an explicit guest load runs their entry and init array once with the caller arguments. Finalizers run only after initialization completed. Console dependency-start and finalization ordering are unmeasured. Windows and macOS use their existing lifecycle paths.

@@ -338,7 +339,7 @@
 - [app0.zar files and directories](../../../core/libs/prx/libkernel/File/src/ArchivedFile.cpp) (libkernel) - archive directory snapshots refresh on rewind; ordering and seek cookies are host packaging behavior, not console-measured behavior. Disk entries shadow archive names under the archive component comparison. Virtual directory descriptors reject data I/O, mapping, locks, filesystem queries and metadata mutation before touching their null-device backing; ordinary host directories retain native operations. Archived files remain read-only, with duplicate descriptors sharing their cursor. `lstat`, access and other ordinary path operations on archive-only entries remain unsupported. Validation uses synthetic archives on Windows and WSL, without PS5 or title runs.
 - [sceKernelLoadStartModule](../../../core/libs/prx/libkernel/Module/src/Module.cpp) (libkernel) loads a system library named by its console path, `/system/common/lib/<name>.sprx` or the sandboxed `/<sandbox word>/common/lib/<name>.sprx` that `sceKernelGetFsSandboxRandomWord` names, from the host `libs/<name>.prx`, as libSceSysmodule loads modules by ID; a host library has no `module_start`, so `res` is 0. Other system directories, such as `/system/priv/lib`, are not mapped. The OpenOrbis piglet sample loads `libScePigletv2VSH.sprx` and `libScePrecompiledShaders.sprx` this way
 - [param.sfo](../../../core/libs/prx/libkernel/AppMetadata/src/ParamSfoParser.cpp) (libkernel) is read when `param.json` is absent, for `TITLE`, `TITLE_ID`, `DOWNLOAD_DATA_SIZE`, `USER_DEFINED_PARAM_1` to `_4` and `ATTRIBUTE`, and mounts `/data` and `/download0` like `param.json`; the localized `TITLE_00` to `TITLE_30` are not selected by the console language.
- [sysctl MIBs for kern.smp.maxcpus, kern.stackprot, kern.sched.name and kern.timecounter.hardware](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - on a PS5 (firmware 12.70), a payload process resolves these names to {1, 2147482816, 2147482814}, {1, 2147483151}, {1, 2147483182, 2147483181} and {1, 2147482838, 2147482834}; `sysctl` returns -1 with `ENOENT` for reads and size queries by those exact MIBs, leaving the buffer and length unchanged, including when either or both output pointers are null. Writes were not measured and throw. `sysctlnametomib` still throws for these four names; #7541 implements the mappings for nine of the other names.
+- [sysctl MIBs for kern.smp.maxcpus, kern.stackprot, kern.sched.name and kern.timecounter.hardware](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - on a PS5 (firmware 12.70), a payload process resolves these names to {1, 2147482816, 2147482814}, {1, 2147483151}, {1, 2147483182, 2147483181} and {1, 2147482838, 2147482834}; `sysctl` returns -1 with `ENOENT` for reads and size queries by those exact MIBs, leaving the buffer and length unchanged, including when either or both output pointers are null. Writes were not measured and throw. `sysctlnametomib` has no mapping for these four names and returns -1 with `ENOENT`; #7541 implements the mappings for nine of the other names.
 - [sceKernelGetProcessAbiType](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) throws: no measured value, prototype or documented consumer of the process ABI type was found, and PS5_MihawkOS (`mihawk-99/PS5_MihawkOS`, PPSA99170) is the only title known to import it. Returning a guessed constant would let a title branch on a value the console never answered with, so the declaration only resolves the import until the console value is measured
 - [flock on a directory descriptor](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) on Windows is seen only by this process. Windows `LockFileEx` rejects a directory handle, so the lock is kept in a table of this process keyed by the directory's volume serial number and file index; between descriptors of this process it conflicts, converts in place, is shared by `dup` and is released on the last close, as FreeBSD 11.4 does for any vnode locked with [`sys_flock`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_descrip.c#L2889-L2929). Waiters are not served in arrival order: an unlock or downgrade may wake a request that waits behind an earlier conflicting one, which FreeBSD's `lf_setlock` serves first. Another host process neither sees it nor is seen. Linux and macOS use the host `flock`. Not measured on a console
 - [poll on macOS and urgent data](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - XNU's `poll` never reports `POLLPRI` for out-of-band data. On macOS it is taken from `SIOCATMARK`, which reports a pending urgent byte without consuming it, and a wait that asks for it uses the sliced path a kqueue wait uses, so it wakes on the next 1 ms slice; `POLLRDBAND` is set with it, as FreeBSD 11.4's `sopoll_generic` does. The other paths that ask the host for urgent readiness still miss it on macOS: guest `select` and `pselect` through `GuestSockets::Poll`, and libSceNet's `PollSockets`. `recv(MSG_OOB | MSG_PEEK)` is not the probe because it consumes the byte on macOS 27.0.1, and `kevent` with `NOTE_OOB` does not fire there. Every other flag and error comes from `poll`; every other host is unchanged. The guest `send` and `recv` refuse `MSG_OOB`, so urgent data can only come from an outside peer; the console's stop once the normal stream passes the mark was not reproduced
@@ -2,5 +2,11 @@

 ### Unknown function info

- [412 exports (60 without a known name, bound by NID)](../../../core/libs/prx/libwebrtc/Export.cpp) (libwebrtc) - every function export of `libwebrtc.sprx` from the firmware 13.60 export table, names from aerolib.csv only where `tools/nid_names.py` `compute_nid` reproduces the NID. Signatures, parameter layouts and behaviour are unknown; every export throws through `NotImplemented_nid_no_patch`
+- [409 exports (60 without a known name, bound by NID)](../../../core/libs/prx/libwebrtc/Export.cpp) (libwebrtc) - every function export of `libwebrtc.sprx` from the firmware 13.60 export table that the next section does not implement, names from aerolib.csv only where `tools/nid_names.py` `compute_nid` reproduces the NID. Signatures, parameter layouts and behaviour are unknown; every export throws through `NotImplemented_nid_no_patch`
 - [31 data exports](../../../core/libs/prx/libwebrtc/Export.cpp) (libwebrtc) - the module also exports 31 data objects (+qcl2IzxTzg, -ix-knPYqWA, 00mefEErs+Y, 5FM0YOa3NWc, 67nsSkXmJ7E, 7I2xDnqfDV4, 8Dzy4JayJSU, CVCDyAzGrhI, HpbtuVdvO-w, PGIpx6NnFLE, Q+xnDp4KI-s, QXDv9OpZNvM, aOOjLmup+u4, g5USRJNh3bU, hvpHGXjlpbk, iU6+qODNSjU, jpkYoOv34AM, lHLJlq3NEqE, lQJvoyxHov4, nUaORqH85DQ, o6LS+08kOUs, oh8srl3AcNE, oslHzys1vV0, sp5NqvqDdHw, t66Gw3OIpSo, tr8vseK8-ro, uSis0q+bv6k, uTz5pEKL+hM, uxkudCJIYJA, whHm70jlRXw, yW0sV3sCdPA); they are not defined, so imports of them stay unresolved until their layout is known
+
+### Public source implementations
+
+- [Source revision](../../../core/libs/prx/libwebrtc/Export.cpp) (libwebrtc) - the module's exact WebRTC revision is not identified. Its `rtc::` names and `InterleavedView` resampler overloads place it between M127 ([branch-heads/6533](https://webrtc.googlesource.com/src/+/e0b28a6a81a989c1f5c89e30fcd247870047390d)) and M134 ([branch-heads/6998](https://webrtc.googlesource.com/src/+/8d78f5de6c27b2c793039989ea381f1428fb0100)), so the exports below follow code that is the same at both. Nothing is checked on the console. Closes when: the revision is identified and the exports are compared with the console.
+- [absl::numbers_internal::FastIntToBuffer(int, char*)](../../../core/libs/prx/libwebrtc/Export.cpp) (libwebrtc) - follows the abseil both branches pin, [65ef38d368](https://chromium.googlesource.com/chromium/src/third_party/+/65ef38d36813d1ad9d4cbf8a18b32ac3691f418b/abseil-cpp/absl/strings/numbers.cc) and [d212a71416](https://chromium.googlesource.com/chromium/src/third_party/+/d212a71416ad7c6ceca04d6d27dfdd84fd00c04c/abseil-cpp/absl/strings/numbers.cc): the decimal text and a NUL, returning a pointer to the NUL. For magnitudes from 10 to 99999999 its 8-byte store also zeroes the bytes after the digits up to 8 from the first digit. A null buffer, which abseil writes through, throws. Closes when: compared with the console.
+- [rtc::ExpFilter::Reset and Apply](../../../core/libs/prx/libwebrtc/src/ExpFilter.cpp) (libwebrtc) - adapted from [exp_filter.cc](https://webrtc.googlesource.com/src/+/8d78f5de6c27b2c793039989ea381f1428fb0100/rtc_base/numerics/exp_filter.cc), with its WebRTC copyright notice and BSD licence at the top of the file, on the 12-byte `alpha_`, `filtered_` and `max_` layout of `exp_filter.h`. -1 marks both an unset output and no maximum, so an output that lands on exactly -1 restarts the filter on the next sample, as upstream does. The last bit of a result can differ if the console build fuses the multiply-adds. A null filter throws. Closes when: compared with the console.
@@ -37,7 +37,7 @@
 - [Pixel interpolators past `SPI_PS_IN_CONTROL.NUM_INTERP`](../../../core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp) (shader recompiler) - when the IR reads an attribute at or past the guest interpolator count, the missing `SPI_PS_INPUT_CNTL` slots are filled as DEFAULT (`OFFSET` 0x20, constant 0/1) before info collection, and SPIR-V emission of `GetInterpolationParameter` for a missing binding returns the same defaults instead of throwing, matching Mesa's treatment of a PS input with no VS output. Component and mode bounds still throw. A retail title prepares a pixel shader with `NUM_INTERP` 0 while it still issues `v_interp` on attribute 0 (`undefined attribute` after the collector fill alone). Console behaviour for that pairing is not measured.
 - [Windows cache housekeeping](../../../core/shader/recompiler/ShaderDiskCache.cpp): eviction of old versions and temporary files is skipped for `\\?\` and `\\.\` cache roots because the supported WinLibs directory iterator can enumerate the process working directory for long prefixed paths. The active version's `last-used` stamp update still runs; it fails for long `\\.\` aliases with the supported toolchain. Ordinary Windows directory enumeration remains subject to MAX_PATH.

- [f64 compares](../../../core/shader/recompiler/Translation/src/CompareInstructions.cpp) flush denormal inputs to signed zero when bit 0 of the `FLOAT_MODE` f16/f64 denormal field is clear (modes 0 and 2); modes 1 and 3 and an unknown mode keep them. This follows the RDNA2 ISA section 6.4 and LLVM's sign-preserving AMDGPU denormal modes. The gfx1036 audit in [#981](https://github.com/boykopovar/AnyPS5/issues/981#issuecomment-6070046381) reports mode-sensitive `VopcCompareF64` results. Class compares still inspect the original bits. The full four-mode matrix has not been newly measured on AMD hardware or the PS5's gfx1013.
+- [f64 compares](../../../core/shader/recompiler/Translation/src/CompareInstructions.cpp) - the PS5's gfx1013 is not measured, and no compare shows a flushed zero's sign. Denormal inputs flush to a zero of the same sign when bit 0 of the `FLOAT_MODE` f16/f64 denormal field is clear: modes 0 and 2 flush them, 1 and 3 keep them, per RDNA2 ISA section 6.4 and LLVM's sign-preserving AMDGPU denormal modes; shaders without a known float mode keep the previous lowering. Measured on RDNA2 (gfx1036, AMD Radeon Graphics, AMD Windows driver 31.0.22044.1 through HIP) over 484 `VopcCompareF64` edge-set operand pairs with every `v_cmp_X_f64` predicate (X = f, lt, eq, le, gt, lg, ge, o, u, nge, nlg, ngt, nle, neq, nlt, tru), in VOPC form, at IEEE=0 and IEEE=1 with each f16/f64 denormal mode 0 to 3, f16 round to nearest even, DX10_CLAMP=1, f32 denormals flushed and FP16_OVFL=0: modes 0 and 2 flush, 1 and 3 keep, the IEEE bit changes neither, and class compares select from the original bits.
 - [Shader disk cache source version](../../../core/shader/recompiler/ShaderCacheVersion.cmake) - the version that names `shader_cache/<version>` and stamps `pipelines.journal` hashes every file under `core/shader/recompiler` (line endings normalized), `HostThreadLocal.hpp`, the SPIR-V and glslang submodule commits, and the compiler, build type and flags. Any edit there changes it and empties the cache, including edits that cannot change a translation (logging, the disk cache's own I/O, the recompiler's tests), and so does a rebuild with another compiler or flags. Driver sources outside the recompiler are not hashed: their recompiler calls are only checked against `shaderCacheReviewedNames`, so a driver change that alters a `RecompileRequest` field's meaning without changing its value keeps a stale cache.
 - [Shader cache directories on SMB shares](../../../core/shader/recompiler/ShaderCacheDirectory.hpp) - on Windows `WriteFileAtomically` replaces an entry with a POSIX-semantics rename (`FileRenameInfoEx`), so readers and mappings of the old entry keep working. Through an SMB share that rename, like a POSIX-semantics delete, fails with `ERROR_INVALID_PARAMETER` (a NAS and `\\localhost\C$` over NTFS, #10833), and the plain rename it falls back to is refused while the entry is open or mapped, also by this process's cache. The write then returns false: the shader cache keeps the old entry and the pipeline cache logs `cannot write`. Renaming the old entry aside first would update it but leave a moment, or after a crash a state, with no entry; replacement stays atomic instead. The disk cache tests skip only those replacements where `PosixReplaceUnsupported` reports the error, and leave their directory behind when a POSIX delete returns it.
 - [Unlinked calls](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) - the `s_swappc_b64` a table call's compare chain falls back to, when its target matches no linked copy, records the `UnlinkedCall` fault with the target and the program counter and stops the invocation, or continues after the call in programs whose faults do not stop invocations (see `bdaStopsInvocations`). The driver lists those calls in the request (`linkedCallFallbacks`), and it reports the fault like a BDA fault, naming the target: a dispatch that checks its faults when it completes throws, one whose check runs in a deferred write-back logs it and continues. The hardware would jump to the target, which is not modelled. Any other `s_swappc_b64` whose target is not resolved still throws when the shader is compiled.