From 8baabbaf49d73fb6327ba1aeb03e85600c6ab041 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Mon, 17 Aug 2026 18:28:58 +0200
Subject: [PATCH 01/68] Let an explicit function map override the JAL-target
 scan

On an ELF with no symbols and no DWARF, parse() carves functions from JAL
targets. Those carvings end at the next JAL target or, for the last one in a
region, at the end of the code section, so on a single-PROGBITS executable
they can run straight through interleaved rodata.

loadGhidraFunctionMap() appended its rows to the same vector and then purged
auto-named entries only where no map row shared the start address. Since both
the carvings ("sub_") and the names Ghidra exports by default ("FUN_") count
as auto-generated, a carving that shared a start with a map row survived the
purge and then won the "larger end" tie-break, so the imprecise bounds
replaced the ones the map had just supplied.

Collect the map rows into a local vector, drop every auto-named carving once
the map has parsed, and append the rows afterwards. Entries named from
symbols or DWARF are unaffected.

On a 3 MB Metrowerks-built PS2 executable with an 11,491-row map, 5,613
functions (48.8%) had been emitted with inflated bounds; the worst grew from
368 bytes to 0x51 KB and produced 22 MB of C++ decoding string data as
instructions. Output for that function is now 19 KB and total output drops
from 235 MB to 180 MB.
---
 ps2xRecomp/src/lib/elf_parser.cpp | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/ps2xRecomp/src/lib/elf_parser.cpp b/ps2xRecomp/src/lib/elf_parser.cpp
index 91e43ee32..865dd6aad 100644
--- a/ps2xRecomp/src/lib/elf_parser.cpp
+++ b/ps2xRecomp/src/lib/elf_parser.cpp
@@ -986,6 +986,7 @@ namespace ps2recomp
         int skippedNonExecutable = 0;
         int skippedInvalidRange = 0;
         std::unordered_set<uint32_t> mapStarts;
+        std::vector<Function> mapFunctions;
         while (std::getline(file, line))
         {
             if (line.empty())
@@ -1029,7 +1030,7 @@ namespace ps2recomp
                 func.isStub = false;
                 func.isSkipped = false;
 
-                m_extraFunctions.push_back(std::move(func));
+                mapFunctions.push_back(std::move(func));
                 mapStarts.insert(start);
                 count++;
             }
@@ -1062,14 +1063,27 @@ namespace ps2recomp
                 }
             }
 
+            // An explicit function map is authoritative over the internal JAL-target
+            // scan. Those carvings end at the next JAL target or, for the last one in
+            // a region, at the end of the code section - which on single-PROGBITS
+            // executables runs straight through interleaved rodata. Because both the
+            // carvings ("sub_") and typical map names ("FUN_") count as
+            // auto-generated, a carving sharing a start with a map row used to
+            // survive this purge and then win the "larger end" tie-break below,
+            // replacing precise bounds with runaway ones. Drop every auto-named
+            // carving instead, then append the map rows.
             m_extraFunctions.erase(
                 std::remove_if(m_extraFunctions.begin(), m_extraFunctions.end(),
                                [&](const Function &func)
                                {
-                                   return IsAutoGeneratedName(func.name) && !mapStarts.contains(func.start);
+                                   return IsAutoGeneratedName(func.name);
                                }),
                 m_extraFunctions.end());
 
+            m_extraFunctions.insert(m_extraFunctions.end(),
+                                    std::make_move_iterator(mapFunctions.begin()),
+                                    std::make_move_iterator(mapFunctions.end()));
+
             std::sort(m_extraFunctions.begin(), m_extraFunctions.end(),
                       [](const Function &a, const Function &b)
                       {

From 5c906ddf4be51e4082d36fbf8779643bc5273968 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Mon, 17 Aug 2026 18:28:59 +0200
Subject: [PATCH 02/68] Warn instead of aborting when no function covers the
 ELF entry point

Not every toolchain points e_entry at an instruction. Metrowerks CodeWarrior
for PS2 emits a crt0 data table there -- scratchpad addresses and size words --
with the first real instruction some way past it, so no function covers the
entry address and neither entryName nor getFunctionName() resolves.

The emitter threw in that case, which aborted the run after every per-function
source had already been written but before register_functions.cpp,
ps2_recompiled_functions.h and ps2_recompiled_stubs.h were generated, leaving
an output directory that looks complete and is not.

Skip the entry registration with a warning instead. Synthesizing a name would
emit a table reference to a definition that was never generated and fail at
link time, and the start address for such a binary has to come from
configuration regardless.
---
 ps2xRecomp/src/lib/function_table_emitter.cpp | 20 +++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/ps2xRecomp/src/lib/function_table_emitter.cpp b/ps2xRecomp/src/lib/function_table_emitter.cpp
index 27dc9b74c..84d3850ea 100644
--- a/ps2xRecomp/src/lib/function_table_emitter.cpp
+++ b/ps2xRecomp/src/lib/function_table_emitter.cpp
@@ -95,9 +95,25 @@ namespace ps2recomp
             }
             if (entryTarget.empty())
             {
-                throw std::runtime_error("No entry function name available for registration.");
+                // Not every toolchain points e_entry at code. Metrowerks CodeWarrior
+                // for PS2 emits a crt0 data table there, so no function covers the
+                // address and no name resolves. Registering a synthesized name would
+                // reference a definition that was never emitted, so skip the entry
+                // instead - the real start address comes from configuration - and
+                // keep emitting the rest of the table rather than aborting after the
+                // per-function sources were already written.
+                if (cg.m_reporter)
+                {
+                    std::ostringstream oss;
+                    oss << "No function covers the ELF entry point; skipping its table registration. "
+                        << "Set the entry explicitly if the runtime should start here.";
+                    cg.m_reporter->warning("function-table", oss.str());
+                }
+            }
+            else
+            {
+                addEntry(cg.m_bootstrapInfo.entry, entryTarget);
             }
-            addEntry(cg.m_bootstrapInfo.entry, entryTarget);
         }
 
         for (const auto &[address, name] : normalFunctions)

From 20848417af22664f6b391d31c2f744d001032588 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Mon, 17 Aug 2026 18:29:01 +0200
Subject: [PATCH 03/68] Compare all 64 bits in the relational branches

BEQ and BNE already compare the full GPR, but BLEZ, BGTZ, BLTZ and BGEZ (and
their likely/and-link variants) were emitted against the low word only. The
R5900 compares the whole 64-bit register, so any value whose upper half is
significant takes the wrong branch.

Compilers reach these opcodes through the dsll32/dsra32 sign-extension idiom,
which leaves a canonical value and hides the bug; code that keeps a genuine
64-bit quantity in the register does not.
---
 ps2xRecomp/src/lib/control_flow_emitter.cpp | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/ps2xRecomp/src/lib/control_flow_emitter.cpp b/ps2xRecomp/src/lib/control_flow_emitter.cpp
index 4bf8dc550..ce3020675 100644
--- a/ps2xRecomp/src/lib/control_flow_emitter.cpp
+++ b/ps2xRecomp/src/lib/control_flow_emitter.cpp
@@ -404,12 +404,16 @@ namespace ps2recomp
         case OPCODE_BNE:
         case OPCODE_BNEL:
             return fmt::format("GPR_U64(ctx, {}) != GPR_U64(ctx, {})", rsReg, rtReg);
+        // The R5900 compares the full 64-bit GPR for the relational branches, as it
+        // already does for BEQ/BNE above. Comparing only the low word takes the wrong
+        // branch whenever the upper half is significant, which happens with the
+        // dsll32/dsra32 sign-extension idiom compilers emit ahead of these opcodes.
         case OPCODE_BLEZ:
         case OPCODE_BLEZL:
-            return fmt::format("GPR_S32(ctx, {}) <= 0", rsReg);
+            return fmt::format("GPR_S64(ctx, {}) <= 0", rsReg);
         case OPCODE_BGTZ:
         case OPCODE_BGTZL:
-            return fmt::format("GPR_S32(ctx, {}) > 0", rsReg);
+            return fmt::format("GPR_S64(ctx, {}) > 0", rsReg);
         case OPCODE_REGIMM:
             switch (m_branchInst.rt)
             {
@@ -417,12 +421,12 @@ namespace ps2recomp
             case REGIMM_BLTZL:
             case REGIMM_BLTZAL:
             case REGIMM_BLTZALL:
-                return fmt::format("GPR_S32(ctx, {}) < 0", rsReg);
+                return fmt::format("GPR_S64(ctx, {}) < 0", rsReg);
             case REGIMM_BGEZ:
             case REGIMM_BGEZL:
             case REGIMM_BGEZAL:
             case REGIMM_BGEZALL:
-                return fmt::format("GPR_S32(ctx, {}) >= 0", rsReg);
+                return fmt::format("GPR_S64(ctx, {}) >= 0", rsReg);
             default:
                 return "false";
             }

From 0627c0d7427c8736ccd8391cd53f336ed7ab3556 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Mon, 17 Aug 2026 18:29:02 +0200
Subject: [PATCH 04/68] Resolve sibling component paths relative to the current
 directory

ps2xRecomp and ps2xAnalyzer reached ps2xRuntime through CMAKE_SOURCE_DIR,
which is the top-level source directory of whatever build is running. That
holds only when this repository is itself the top level; adding it to another
project with add_subdirectory() made both components look for
ps2xRuntime/cmake/ReleaseMode.cmake under the consuming project and fail at
configure time.

Use CMAKE_CURRENT_SOURCE_DIR-relative paths, as ps2xRecomp already does for
its ps2xRuntime include directory and ps2xRuntime does for its own cmake
include. Note that each component declares its own project(), so
PROJECT_SOURCE_DIR is not an alternative here.
---
 ps2xAnalyzer/CMakeLists.txt | 6 +++---
 ps2xRecomp/CMakeLists.txt   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ps2xAnalyzer/CMakeLists.txt b/ps2xAnalyzer/CMakeLists.txt
index 5933bca14..97d4cee26 100644
--- a/ps2xAnalyzer/CMakeLists.txt
+++ b/ps2xAnalyzer/CMakeLists.txt
@@ -27,8 +27,8 @@ add_library(ps2_analyzer_lib STATIC ${PS2ANALYZER_LIB_SOURCES})
 
 target_include_directories(ps2_analyzer_lib PUBLIC
     ${CMAKE_CURRENT_SOURCE_DIR}/include
-    ${CMAKE_SOURCE_DIR}/ps2xRecomp/include
-    ${CMAKE_SOURCE_DIR}/ps2xRuntime/include
+    ${CMAKE_CURRENT_SOURCE_DIR}/../ps2xRecomp/include
+    ${CMAKE_CURRENT_SOURCE_DIR}/../ps2xRuntime/include
 )
 
 target_link_libraries(ps2_analyzer_lib PUBLIC
@@ -50,7 +50,7 @@ install(TARGETS ps2_analyzer ps2_analyzer_lib
     ARCHIVE DESTINATION lib
 )
 
-include("${CMAKE_SOURCE_DIR}/ps2xRuntime/cmake/ReleaseMode.cmake")
+include("${CMAKE_CURRENT_SOURCE_DIR}/../ps2xRuntime/cmake/ReleaseMode.cmake")
 
 if(CMAKE_BUILD_TYPE STREQUAL "Release" OR CMAKE_BUILD_TYPE STREQUAL "RelWithDebInfo")
     EnableFastReleaseMode(ps2_analyzer_lib)
diff --git a/ps2xRecomp/CMakeLists.txt b/ps2xRecomp/CMakeLists.txt
index 857102a22..5ed0d0799 100644
--- a/ps2xRecomp/CMakeLists.txt
+++ b/ps2xRecomp/CMakeLists.txt
@@ -130,7 +130,7 @@ install(DIRECTORY include/
     DESTINATION include
 )
 
-include("${CMAKE_SOURCE_DIR}/ps2xRuntime/cmake/ReleaseMode.cmake")
+include("${CMAKE_CURRENT_SOURCE_DIR}/../ps2xRuntime/cmake/ReleaseMode.cmake")
 
 if(CMAKE_BUILD_TYPE STREQUAL "Release" OR CMAKE_BUILD_TYPE STREQUAL "RelWithDebInfo")
     EnableFastReleaseMode(ps2_recomp_lib)

From 75d5085a79fbebf45ff4e4070a1c15d60edc236e Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Mon, 17 Aug 2026 18:29:04 +0200
Subject: [PATCH 05/68] Don't promote a whole function because of an indirect
 call

When a computed jump cannot be resolved to a jump table, every instruction in
the function becomes an entry point, because the jump could land on any of
them. That fallback was also applied to JALR, which is not a jump but a call:
it transfers control to another function and returns to the instruction after
the delay slot. That return address is already queued as a resume target a few
lines above, so nothing else in the function needs to be reachable from
outside.

Indirect calls are ordinary code -- function pointers, virtual dispatch,
callbacks -- so the fallback fired constantly. On a 3 MB PS2 executable, 2,210
of the 2,422 unresolved sites were JALR, and 1,078 of the 1,282 affected
functions contained no unresolved jump at all.

Restrict the fallback to JR. Promoted entries drop from 189,876 to 1,688,
registered table entries from 156,783 to 75,386, the generated registration
file from 13 MB to 6 MB, and total output from 180 MB to 163 MB. Every
indirect call site in real code keeps its return-address resume entry (the
only sites that lose one are bogus functions carved out of rodata, where the
address is outside the function anyway).
---
 ps2xRecomp/src/lib/control_flow_analyzer.cpp |  9 ++++++++-
 ps2xTest/src/code_generator_tests.cpp        | 19 +++++++++++++++----
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/ps2xRecomp/src/lib/control_flow_analyzer.cpp b/ps2xRecomp/src/lib/control_flow_analyzer.cpp
index a099f5cf9..2b27ffc9f 100644
--- a/ps2xRecomp/src/lib/control_flow_analyzer.cpp
+++ b/ps2xRecomp/src/lib/control_flow_analyzer.cpp
@@ -385,7 +385,14 @@ namespace ps2recomp
                         }
                     }
                 }
-                if (!foundTable)
+                // Only an unresolved computed *jump* can land on an arbitrary
+                // instruction of this function and therefore force every address to
+                // become an entry point. JALR is a call: it transfers control to
+                // another function and comes back to the instruction after the delay
+                // slot, which is already queued as a resume target above. Treating a
+                // call like a jump here promotes the whole function for what is
+                // usually just a function pointer or virtual dispatch.
+                if (!foundTable && jrInst->function != SPECIAL_JALR)
                 {
                     needsIndirectFallback = true;
                 }
diff --git a/ps2xTest/src/code_generator_tests.cpp b/ps2xTest/src/code_generator_tests.cpp
index 2dd9c531f..d9128c644 100644
--- a/ps2xTest/src/code_generator_tests.cpp
+++ b/ps2xTest/src/code_generator_tests.cpp
@@ -529,7 +529,7 @@ void register_code_generator_tests()
                   "unresolved JR should not pretend it has a resolved local jump table");
     });
 
-    tc.Run("unresolved JALR marks internal labels as indirect fallback resume entries", [](TestCase &t) {
+    tc.Run("unresolved JALR resumes after the call without promoting the function", [](TestCase &t) {
         Function func;
         func.name = "unresolved_jalr_fallback";
         func.start = 0x3200;
@@ -548,10 +548,21 @@ void register_code_generator_tests()
         CodeGenerator gen({}, {});
         CodeGenerator::AnalysisResult analysis = gen.collectInternalBranchTargets(func, instructions);
 
-        t.IsTrue(analysis.indirectFallbackEntryPoints.contains(0x320Cu),
-                 "unresolved JALR should register internal labels as resumable entries for the owning function");
+        // JALR is a call: it returns past the delay slot, so 0x320C is the only
+        // address in this function that has to be reachable from outside.
+        t.IsTrue(analysis.resumeEntryPoints.contains(0x320Cu),
+                 "unresolved JALR should mark its return pc as resumable");
         t.IsTrue(analysis.entryPoints.contains(0x320Cu),
-                 "unresolved JALR fallback targets should still emit labels in the owner");
+                 "unresolved JALR resume pc should still emit a label in the owner");
+
+        // Both sets feed the same owner resume-target list, so the return pc is
+        // registered either way; what must not happen is the whole-function
+        // promotion reserved for jumps that could land anywhere.
+        t.IsFalse(analysis.indirectFallbackEntryPoints.contains(0x3210u),
+                  "an indirect call must not promote unrelated instructions to entry points");
+        t.IsFalse(analysis.indirectFallbackEntryPoints.contains(0x3200u),
+                  "an indirect call must not promote the function start to a fallback entry");
+
         t.IsFalse(analysis.jumpTableTargets.contains(0x3204u),
                   "unresolved JALR should not pretend it has a resolved local jump table");
     });

From becb2be5bd0dc3deebeec8454df21ea7d7062b45 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Mon, 17 Aug 2026 22:57:02 +0200
Subject: [PATCH 06/68] Let a thread resume at the instruction after a syscall

A syscall can hand control back to the scheduler before the instruction
after it runs. SetSyscall lets the guest install its own handler for a
syscall number; dispatchSyscallOverride then suspends the calling
thread and queues that handler as a GuestInvocation. When the
invocation finishes, EeScheduler resumes the parent thread at the
address the generated code stored just before calling handleSyscall --
the instruction right after the syscall.

The analyzer never marked that address as an entry point. It queues
resume entries for JAL and JALR only, so no generated function could be
re-entered there, EeScheduler's hasFunction() check failed, and the
thread was made dormant instead of resumed. The thread simply stops;
because the scheduler then drains normally and run() returns, it looks
like a clean shutdown rather than a fault, which makes it awkward to
recognise.

This is reachable during early boot on a real title. Dragon Quest VIII
hits it in crt0: the Metrowerks startup code installs a handler for
syscall 0x83 and immediately issues it, and execution ends there,
roughly ten functions into the binary.

Note the offset is +4, not the +8 used for JAL and JALR -- syscall has
no delay slot.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ps2xRecomp/src/lib/control_flow_analyzer.cpp | 17 ++++++++
 ps2xTest/src/code_generator_tests.cpp        | 45 ++++++++++++++++++++
 2 files changed, 62 insertions(+)

diff --git a/ps2xRecomp/src/lib/control_flow_analyzer.cpp b/ps2xRecomp/src/lib/control_flow_analyzer.cpp
index 2b27ffc9f..bf105e079 100644
--- a/ps2xRecomp/src/lib/control_flow_analyzer.cpp
+++ b/ps2xRecomp/src/lib/control_flow_analyzer.cpp
@@ -135,6 +135,23 @@ namespace ps2recomp
 
         for (const auto &inst : instructions)
         {
+            // A syscall can hand control back to the scheduler before the
+            // instruction after it runs: SetSyscall lets the guest install its
+            // own handler, and dispatchSyscallOverride then suspends the
+            // calling thread and queues that handler as a GuestInvocation. When
+            // the invocation completes, the scheduler resumes the parent thread
+            // at the address the generated code stored before calling
+            // handleSyscall -- i.e. right here. Without an entry point there,
+            // EeScheduler's hasFunction() check fails and the thread is made
+            // dormant instead of resumed.
+            //
+            // Note the offset is +4, not the +8 used for JAL/JALR: syscall has
+            // no delay slot.
+            if (inst.opcode == OPCODE_SPECIAL && inst.function == SPECIAL_SYSCALL)
+            {
+                queueResumeEntryTarget(inst.address + 4u);
+            }
+
             bool isStaticJump = (inst.opcode == OPCODE_J || inst.opcode == OPCODE_JAL);
             if (inst.isBranch && inst.opcode != OPCODE_J && inst.opcode != OPCODE_JAL)
             {
diff --git a/ps2xTest/src/code_generator_tests.cpp b/ps2xTest/src/code_generator_tests.cpp
index d9128c644..c8d496828 100644
--- a/ps2xTest/src/code_generator_tests.cpp
+++ b/ps2xTest/src/code_generator_tests.cpp
@@ -144,6 +144,17 @@ static Instruction makeJr(uint32_t address, uint8_t rs)
     return inst;
 }
 
+static Instruction makeSyscall(uint32_t address)
+{
+    Instruction inst{};
+    inst.address = address;
+    inst.opcode = OPCODE_SPECIAL;
+    inst.function = SPECIAL_SYSCALL;
+    inst.hasDelaySlot = false;
+    inst.raw = (OPCODE_SPECIAL << 26) | SPECIAL_SYSCALL;
+    return inst;
+}
+
 static void printGeneratedCode(const std::string& name, const std::string& code)
 {
 #ifdef PRINT_GENERATED_CODE
@@ -567,6 +578,40 @@ void register_code_generator_tests()
                   "unresolved JALR should not pretend it has a resolved local jump table");
     });
 
+    tc.Run("syscall marks the following instruction as a resume entry", [](TestCase &t) {
+        // Shape of a real SDK syscall wrapper:
+        //   addiu $v1, $zero, <num> ; syscall ; jr $ra ; <delay slot>
+        // SetSyscall lets a guest install its own handler for a syscall number,
+        // and the runtime then suspends the calling thread to run that handler
+        // as a separate invocation. The parent thread's saved pc is the address
+        // after the syscall, so the scheduler needs an entry point there to
+        // resume it -- otherwise the thread is made dormant and silently dies.
+        Function func;
+        func.name = "syscall_wrapper";
+        func.start = 0x4000;
+        func.end = 0x4010;
+        func.isRecompiled = true;
+        func.isStub = false;
+
+        std::vector<Instruction> instructions{
+            makeAddiu(0x4000, 3, 0, 0x83),
+            makeSyscall(0x4004),
+            makeJr(0x4008, 31),
+            makeNop(0x400C),
+        };
+
+        CodeGenerator gen({}, {});
+        CodeGenerator::AnalysisResult analysis = gen.collectInternalBranchTargets(func, instructions);
+
+        // +4, not +8: syscall has no delay slot.
+        t.IsTrue(analysis.resumeEntryPoints.contains(0x4008u),
+                 "syscall should mark the next instruction as resumable");
+        t.IsTrue(analysis.entryPoints.contains(0x4008u),
+                 "syscall resume pc should emit a label in the owner");
+        t.IsFalse(analysis.resumeEntryPoints.contains(0x400Cu),
+                  "syscall must not claim a delay slot it does not have");
+    });
+
     tc.Run("resume entry targets emit a top-level pc switch in the owner wrapper", [](TestCase &t) {
         Function func;
         func.name = "resume_owner";

From 6bf1feff8bd38892f1a464322f455fe016814c5c Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Mon, 17 Aug 2026 22:57:21 +0200
Subject: [PATCH 07/68] Return true after queueing a guest syscall override

dispatchSyscallOverride returns bool, and its caller uses that to
decide whether the built-in handler still needs to run. The success
path -- the one that actually queues the guest's handler as an
invocation -- fell off the end of the function without returning.

That is undefined behaviour, and the practical failure mode is bad:
whatever happened to be in the return register decided whether the
built-in syscall ran in addition to the guest's override, so a game
that overrides a syscall could get the effect applied twice, or not at
all, depending on the build.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp b/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp
index 3530e65bb..babcc0e80 100644
--- a/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp
@@ -440,6 +440,11 @@ namespace ps2_syscalls
             parent.r[2] = completed.r[2];
         };
         scheduler.invokeCurrent(std::move(invocation));
+        // The invocation is queued and the caller must not fall through to the
+        // built-in handler. Falling off the end of a non-void function here was
+        // undefined behaviour: whatever happened to be in the return register
+        // decided whether the built-in ran as well as the guest's override.
+        return true;
     }
 
     static bool tryResolveGuestSyscallMirrorAddr(uint32_t syscallIndex, uint32_t &guestAddr)

From 226bae250b285930da75accc7a7ee0045942d807 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Mon, 17 Aug 2026 22:57:21 +0200
Subject: [PATCH 08/68] Set the x86 SIMD baseline that the code already
 requires

ps2_runtime.h includes <smmintrin.h> unconditionally, and the
recompiler emits SSE4.1-only intrinsics (_mm_blendv_ps and friends) for
the COP2 and FPU select idioms. SSE4.1 is therefore a hard requirement
of the codebase, not a tuning option.

Nothing sets it for GCC or Clang. MSVC does not need it -- its
intrinsics are not gated behind a target feature -- and the only place
any x86 feature is named is /arch:AVX2 inside EnableFastReleaseMode,
which is MSVC-only and applies to Release and RelWithDebInfo only. GCC
and Clang default to the plain x86-64 baseline, which is SSE2, so on a
stock Linux or macOS toolchain the affected translation units fail with
"always_inline function ... requires target feature 'sse4.1'".

Adds EnableX86SimdBaseline and applies it to ps2_runtime in every
configuration rather than in EnableFastReleaseMode, since a Debug build
needs it just as much. PUBLIC, so recompiled game code linking against
ps2_runtime inherits it -- that code is where most of the SSE4.1
intrinsics actually are. Guarded on the target processor so ARM builds
are unaffected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ps2xRuntime/CMakeLists.txt          |  5 +++++
 ps2xRuntime/cmake/ReleaseMode.cmake | 20 ++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index e4dc1956d..aad5fb80b 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -552,6 +552,11 @@ if(PS2X_IS_VITA)
     endif()
 endif()
 
+# Every configuration, not just Release: SSE4.1 is required to compile, not an
+# optimisation. PUBLIC so recompiled game code linking against ps2_runtime
+# inherits it -- that code is where most of the SSE4.1 intrinsics actually are.
+EnableX86SimdBaseline(ps2_runtime)
+
 if(CMAKE_BUILD_TYPE STREQUAL "Release" OR CMAKE_BUILD_TYPE STREQUAL "RelWithDebInfo")
     EnableFastReleaseMode(ps2_runtime)
     EnableFastReleaseMode(ps2EntryRunner)
diff --git a/ps2xRuntime/cmake/ReleaseMode.cmake b/ps2xRuntime/cmake/ReleaseMode.cmake
index 92ef0d54d..0b97e9016 100644
--- a/ps2xRuntime/cmake/ReleaseMode.cmake
+++ b/ps2xRuntime/cmake/ReleaseMode.cmake
@@ -2,6 +2,26 @@ include(CheckIPOSupported)
 
 check_ipo_supported(RESULT IPO_SUPPORTED OUTPUT IPO_ERROR)
 
+# ps2_runtime.h unconditionally includes <smmintrin.h> and the recompiler emits
+# SSE4.1-only intrinsics (_mm_blendv_ps and friends) for the COP2/FPU select
+# idioms, so SSE4.1 is a hard requirement of the codebase rather than a tuning
+# knob. MSVC enables it implicitly (its intrinsics are not gated by a target
+# feature), but GCC and Clang default to the plain x86-64 baseline, which is
+# SSE2 -- so on any stock Linux or macOS toolchain those translation units fail
+# to compile with "always_inline function ... requires target feature 'sse4.1'".
+#
+# This must not live in EnableFastReleaseMode: that is only applied for Release
+# and RelWithDebInfo, whereas the requirement applies to every configuration.
+function(EnableX86SimdBaseline TargetName)
+    if(MSVC)
+        return()
+    endif()
+    if(NOT CMAKE_SYSTEM_PROCESSOR MATCHES "^(x86_64|AMD64|amd64|i[3-6]86|x86)$")
+        return()
+    endif()
+    target_compile_options(${TargetName} PUBLIC -msse4.1)
+endfunction()
+
 function(EnableFastReleaseMode TargetName)
     message("> Enabling optimization for: ${TargetName}")
     if(MSVC)

From 50dc8681cedc62852604b29a04134c4c3126aec1 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Mon, 17 Aug 2026 22:57:21 +0200
Subject: [PATCH 09/68] Make the DECI2 text log limit configurable

logDeci2Text stops after 256 lines and then silently drops everything
else. That is a sensible default against a game that spams kputs, but
it makes the runtime unusable as the candidate side of a boot-trace
diff: real captures run to many thousands of lines, and a silent
truncation partway through looks exactly like the guest stopping.

Adds PS2X_DECI2_LOG_LIMIT, with 0 meaning unlimited. Unset or
unparseable keeps the existing 256.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ps2xRuntime/src/lib/Kernel/Syscalls/Deci2.cpp | 36 +++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/ps2xRuntime/src/lib/Kernel/Syscalls/Deci2.cpp b/ps2xRuntime/src/lib/Kernel/Syscalls/Deci2.cpp
index 039da2fb0..5792b0552 100644
--- a/ps2xRuntime/src/lib/Kernel/Syscalls/Deci2.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Syscalls/Deci2.cpp
@@ -2,6 +2,8 @@
 #include "Common.h"
 #include "ps2_runtime.h"
 
+#include <cstdlib>
+
 namespace
 {
     struct Deci2Session
@@ -62,11 +64,41 @@ namespace
         return text;
     }
 
+    // Default cap on DECI2 text lines, so a game that spams kputs cannot drown
+    // the console. Override with PS2X_DECI2_LOG_LIMIT; 0 means unlimited, which
+    // is what you want when diffing a full boot trace against a reference
+    // capture from real hardware or an emulator -- those run to many thousands
+    // of lines and a silent truncation at 256 looks exactly like the guest
+    // stopping.
+    static uint32_t deci2TextLogLimit()
+    {
+        static const uint32_t limit = []() -> uint32_t
+        {
+            constexpr uint32_t kDefaultMaxDeci2TextLogs = 256u;
+            const char *env = std::getenv("PS2X_DECI2_LOG_LIMIT");
+            if (!env || *env == '\0')
+            {
+                return kDefaultMaxDeci2TextLogs;
+            }
+
+            char *parseEnd = nullptr;
+            const unsigned long parsed = std::strtoul(env, &parseEnd, 10);
+            if (parseEnd == env || *parseEnd != '\0' || parsed > 0xFFFFFFFFul)
+            {
+                return kDefaultMaxDeci2TextLogs;
+            }
+
+            return static_cast<uint32_t>(parsed);
+        }();
+
+        return limit;
+    }
+
     static void logDeci2Text(const char *prefix, const std::string &text)
     {
-        constexpr uint32_t kMaxDeci2TextLogs = 256u;
+        const uint32_t maxDeci2TextLogs = deci2TextLogLimit();
         const uint32_t logIndex = g_deci2LogCount.fetch_add(1u, std::memory_order_relaxed);
-        if (logIndex >= kMaxDeci2TextLogs)
+        if (maxDeci2TextLogs != 0u && logIndex >= maxDeci2TextLogs)
         {
             return;
         }

From 2ac2ce632082ff8b7683f0380361ddcbc410bdbc Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Tue, 18 Aug 2026 15:33:24 +0200
Subject: [PATCH 10/68] Start the main thread with COP0 Status.IE set

Guest code reads COP0 Status to decide whether interrupts are enabled,
and two different bits are involved:

  IE  (bit 0)   the architectural MIPS interrupt enable, set once by the
                kernel during boot and normally left set.
  EIE (bit 16)  the EE-specific enable that `ei` and `di` toggle.

We never execute the boot ROM, so nothing was setting either one, and
R5900Context started with Status at zero.

That is not cosmetic. libkernel's StartThread opens with
`mfc0 Status; xori 1; andi 1` and bails out with -1 when IE is clear --
its "you must call iStartThread from an interrupt handler" guard. With
Status at zero that guard fired every time, so every StartThread failed.
Dragon Quest VIII hits this during boot: it creates its CD streaming
thread, gets -1, prints "Can't start thread for streaming." and then
deadlocks with every thread blocked and none runnable. Nothing in the
runtime logs anything, because from its point of view the guest simply
asked a question and got an answer.

EIE matters for the matching reason: DIntr reports whether it was set so
the caller knows whether to pair it with an EIntr. Starting at zero makes
DIntr always answer "already disabled", so the re-enable never happens.

Two changes, both needed:

- R5900Context's constructor now sets Status to EIE | IE rather than 0.
  BEV is deliberately left clear -- that selects the boot exception
  vectors, which is the pre-handoff state, not this one.

- PS2Runtime's constructor no longer memsets m_cpuContext. R5900Context
  already zeroes itself before applying its reset values, so the memset
  only threw those values away. Threads created later were unaffected
  because EeScheduler::startThread assigns `R5900Context{}`, which is
  why this presented as "the main thread cannot start threads" rather
  than something more obviously global.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 ps2xRuntime/include/ps2_runtime.h   | 31 +++++++++++++++++++++++++----
 ps2xRuntime/src/lib/ps2_runtime.cpp | 10 +++++++++-
 2 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/ps2xRuntime/include/ps2_runtime.h b/ps2xRuntime/include/ps2_runtime.h
index a899408aa..961e78ea8 100644
--- a/ps2xRuntime/include/ps2_runtime.h
+++ b/ps2xRuntime/include/ps2_runtime.h
@@ -150,10 +150,33 @@ struct alignas(16) R5900Context
 
         // Reset COP0 registers
         cop0_random = 47; // Start at maximum value
-        // cop0_status = 0x400000; // BEV set, ERL clear, kernel mode
-        // 0x00400000 = BEV (Boot Exception Vectors).
-        // 0x00000000 = Normal mode (after BIOS handoff).
-        cop0_status = 0x00000000;
+        // Status as the EE kernel leaves it when it hands control to the game,
+        // which is the state recompiled code starts in -- we never execute the
+        // boot ROM that would otherwise set this up.
+        //
+        // Both interrupt-enable bits matter, and they are not the same bit:
+        //
+        //   IE  (bit 0)     the architectural MIPS interrupt enable. The kernel
+        //                   sets it once during boot and it normally stays set.
+        //   EIE (bit 16)    the EE-specific enable that the `ei` and `di`
+        //                   instructions toggle.
+        //
+        // Interrupts are only really on when both are set, and guest code reads
+        // them separately. libkernel's StartThread, for instance, opens with
+        // `mfc0 Status; xori 1; andi 1` and refuses to run when IE is clear --
+        // that is its "you must call iStartThread from an interrupt handler"
+        // guard. Leaving Status at zero made that guard fire forever, so every
+        // StartThread returned -1 and any game that creates a thread stalled
+        // with no diagnostic.
+        //
+        // EIE matters for the matching reason: DIntr reports whether it was set
+        // so the caller knows whether to pair it with an EIntr. Starting at zero
+        // makes DIntr always answer "already disabled" and the re-enable never
+        // happens.
+        //
+        // BEV (0x00400000) is deliberately not set: that selects the boot
+        // exception vectors, which is the pre-handoff state, not this one.
+        cop0_status = 0x00010001; // EIE | IE
         cop0_prid = 0x00002e20; // CPU ID for R5900
 
         in_delay_slot = false;
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index ddacb0c7d..e5d23d9b5 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -491,7 +491,15 @@ PS2Runtime::PS2Runtime()
     }
 #endif
 
-    std::memset(&m_cpuContext, 0, sizeof(m_cpuContext));
+    // Assign a default-constructed context rather than memset-ing this one.
+    // R5900Context's constructor already zeroes itself and then applies the
+    // architectural reset values on top -- COP0 Status, PRId, Random. A raw
+    // memset here silently threw those away, leaving Status at 0 for the main
+    // thread while every thread created later, which goes through
+    // `target->context = R5900Context{}` in EeScheduler::startThread, got the
+    // correct values. Guest code reads Status.IE to decide whether interrupts
+    // are enabled, so the main thread believed they were permanently off.
+    m_cpuContext = R5900Context{};
 
     // R0 is always zero in MIPS
     m_cpuContext.r[0] = _mm_set1_epi32(0);

From 2648de05c5a44ecb363f11e8fa673d38e4f4e410 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Tue, 18 Aug 2026 22:26:32 +0200
Subject: [PATCH 11/68] Drop the unreachable return in dispatchSyscallOverride

ran-j pointed out on ran-j/PS2Recomp#211 that invokeCurrent is
[[noreturn]] -- it throws EeDispatcherTransfer to unwind back to the
scheduler -- so control never reaches the end of the function and the
return I added was dead code. He closed the PR; this drops the change so
the branch matches upstream again.
---
 ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp b/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp
index babcc0e80..3530e65bb 100644
--- a/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp
@@ -440,11 +440,6 @@ namespace ps2_syscalls
             parent.r[2] = completed.r[2];
         };
         scheduler.invokeCurrent(std::move(invocation));
-        // The invocation is queued and the caller must not fall through to the
-        // built-in handler. Falling off the end of a non-void function here was
-        // undefined behaviour: whatever happened to be in the return register
-        // decided whether the built-in ran as well as the guest's override.
-        return true;
     }
 
     static bool tryResolveGuestSyscallMirrorAddr(uint32_t syscallIndex, uint32_t &guestAddr)

From 21671a2818808ea52bb9df008f6972f13aa49fad Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Wed, 19 Aug 2026 19:37:41 +0200
Subject: [PATCH 12/68] Decode a trailing branch's delay slot past the mapped
 function end

decodeFunction stops at function.end, so when the last instruction inside
the range is a branch its delay slot falls outside and the emitter
substitutes a NOP (makeSyntheticDelaySlot). A real instruction disappears
with no diagnostic.

For a jr $ra epilogue that instruction is the addiu $sp, $sp, N, so every
call to the function leaks stack. In DQ8 that was __umoddi3, called from
_strtol_r while parsing a text asset: after a few calls _strtol_r read its
own saved $ra from the wrong offset, got 0, and walked the main thread off
the end of crt0. The symptom looked like a scheduler hang.

286 functions in DQ8's map end on a branch, 165 of them where the next
mapped function starts more than one word later.
---
 ps2xRecomp/src/lib/ps2_recompiler.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/ps2xRecomp/src/lib/ps2_recompiler.cpp b/ps2xRecomp/src/lib/ps2_recompiler.cpp
index ab779a4f5..54fdfcf2c 100644
--- a/ps2xRecomp/src/lib/ps2_recompiler.cpp
+++ b/ps2xRecomp/src/lib/ps2_recompiler.cpp
@@ -1920,6 +1920,9 @@ namespace ps2recomp
 
         uint32_t start = function.start;
         uint32_t end = function.end;
+        // A branch at the mapped end still owns the next word as its delay
+        // slot; without this the emitter substitutes a NOP and loses it.
+        bool delaySlotExtended = false;
 
         for (uint32_t address = start; address < end; address += 4)
         {
@@ -1977,6 +1980,12 @@ namespace ps2recomp
                 }
 
                 instructions.push_back(inst);
+
+                if (!delaySlotExtended && inst.hasDelaySlot && address + 4u == end)
+                {
+                    delaySlotExtended = true;
+                    end += 4u;
+                }
             }
             catch (const std::exception &e)
             {

From 91ac659402c55aa2fe73db1129e0c6a67c87dcc1 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Wed, 19 Aug 2026 19:37:55 +0200
Subject: [PATCH 13/68] Run interrupt handlers on an invocation stack, not a
 recorded $sp

dispatchIrq seeded the handler invocation with handler.sp, which is
whatever $sp happened to be when the guest called AddIntcHandler. By the
time the handler fires that thread has long since moved on and is using
those addresses for something else, so the handler builds its frame on top
of live data.

In DQ8 the VBLANK_END handler landed inside the main thread's stack and
zeroed a saved $ra, and the thread returned to 0. The dispatcher already
does the right thing for an invocation whose $sp is 0 -- it hands out an
invocation stack -- so passing a recorded $sp was bypassing it. Same fix
for the GS VSync callback and the Alarm event, which shared the pattern.

That alone would have moved the corruption rather than removed it:
reserveAsyncCallbackStack carves invocation stacks downwards from the top
of RAM, and the EE kernel puts a game's initial stack there too (DQ8's main
thread runs at 0x01F40000..0x02000000). reserveGuestStackFromAsyncPool now
pulls the pool below any guest stack that reaches into it, called wherever
a thread's stack is recorded.
---
 ps2xRuntime/include/runtime/ee_scheduler.h |  1 +
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp | 28 +++++++++++++++++++---
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/ps2xRuntime/include/runtime/ee_scheduler.h b/ps2xRuntime/include/runtime/ee_scheduler.h
index fae8b8540..ad937be85 100644
--- a/ps2xRuntime/include/runtime/ee_scheduler.h
+++ b/ps2xRuntime/include/runtime/ee_scheduler.h
@@ -367,6 +367,7 @@ class EeScheduler
     void assertExecutor() const;
     [[nodiscard]] int allocateThreadId();
     GuestThread &acquireInvocationThread();
+    void reserveGuestStackFromAsyncPool(uint32_t guestStackBase);
     void enqueueReady(GuestThread &thread, bool front = false);
     void removeReady(GuestThread &thread);
     [[nodiscard]] GuestThread *selectReady();
diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index 3a6ec7d94..1a6b3d3e1 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -414,9 +414,26 @@ void EeScheduler::setupCurrentThread(uint32_t stack, uint32_t stackSize, uint32_
     target->stack = stack;
     target->stackSize = stackSize;
     target->gp = gp;
+    reserveGuestStackFromAsyncPool(stack);
     publishSnapshot();
 }
 
+// Invocation stacks are carved from the top of RAM, where the EE kernel also
+// puts a game's initial stack. Keep the pool below any guest stack.
+void EeScheduler::reserveGuestStackFromAsyncPool(uint32_t guestStackBase)
+{
+    if (guestStackBase == 0u)
+    {
+        return;
+    }
+    std::lock_guard<std::mutex> lock(m_runtime.m_asyncCallbackStackMutex);
+    if (guestStackBase > m_runtime.m_asyncCallbackStackFloor &&
+        guestStackBase < m_runtime.m_asyncCallbackStackTop)
+    {
+        m_runtime.m_asyncCallbackStackTop = guestStackBase;
+    }
+}
+
 int EeScheduler::createThread(const EeThreadCreateParams &params)
 {
     assertExecutor();
@@ -443,6 +460,7 @@ int EeScheduler::createThread(const EeThreadCreateParams &params)
     thread.currentPriority = params.priority;
     thread.status = EeThreadStatus::Dormant;
     m_threads.emplace(id, std::move(thread));
+    reserveGuestStackFromAsyncPool(params.stack);
     publishSnapshot();
     return id;
 }
@@ -1278,7 +1296,9 @@ void EeScheduler::dispatchIrq(bool dmac, uint32_t cause)
         SET_GPR_U32(&invocation.context, 4, cause);
         SET_GPR_U32(&invocation.context, 5, handler.argument);
         SET_GPR_U32(&invocation.context, 28, handler.gp);
-        SET_GPR_U32(&invocation.context, 29, handler.sp);
+        // Not handler.sp: that thread has moved on. $sp = 0 makes the
+        // dispatcher hand out an invocation stack, as the EE does.
+        SET_GPR_U32(&invocation.context, 29, 0u);
         SET_GPR_U32(&invocation.context, 31, 0u);
         queueInvocation(std::move(invocation));
     }
@@ -1888,7 +1908,8 @@ void EeScheduler::processEvent(const EeEvent &event)
             invocation.context.pc = m_gsVSyncCallback;
             SET_GPR_U32(&invocation.context, 4, static_cast<uint32_t>(m_vsyncTick));
             SET_GPR_U32(&invocation.context, 28, m_gsVSyncCallbackGp);
-            SET_GPR_U32(&invocation.context, 29, m_gsVSyncCallbackSp);
+            // See dispatchIrq.
+            SET_GPR_U32(&invocation.context, 29, 0u);
             SET_GPR_U32(&invocation.context, 31, 0u);
             queueInvocation(std::move(invocation));
         }
@@ -1918,7 +1939,8 @@ void EeScheduler::processEvent(const EeEvent &event)
         SET_GPR_U32(&invocation.context, 5, static_cast<uint32_t>(alarm.ticks));
         SET_GPR_U32(&invocation.context, 6, alarm.argument);
         SET_GPR_U32(&invocation.context, 28, alarm.gp);
-        SET_GPR_U32(&invocation.context, 29, alarm.sp);
+        // See dispatchIrq.
+        SET_GPR_U32(&invocation.context, 29, 0u);
         SET_GPR_U32(&invocation.context, 31, 0u);
         queueInvocation(std::move(invocation));
         break;

From 1d4c4dc18d980943620cd79fa0a71539db59eeb4 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Wed, 19 Aug 2026 19:38:09 +0200
Subject: [PATCH 14/68] Let a guest own its C heap, and dispatch overlaid code

Two related seams for games that do more than the runtime assumes.

Guest-owned heap. A game shipping its own allocator (newlib and MSL both
do) grows it through sbrk/EndOfHeap and hands out addresses the runtime
must not also be allocating from. setGuestHeapCeiling makes EndOfHeap
report the guest's ceiling rather than the runtime arena's limit, and
SetupHeap no longer calls configureGuestHeap when one is set -- the guest
is describing its own heap there, and honouring it dragged the runtime
arena back on top of the guest's first chunk. guestHeapHardLimit exposes
the top of the allocatable range, which guestHeapLimit cannot report before
the heap is configured, so a caller can split the range without hardcoding
the constant.

Found in DQ8: the runtime's 128-byte GIF packet from sceGsResetGraph landed
on the guest heap's top chunk header, dlmalloc read a zero size, and its
own guard (set_head(top, PREV_INUSE), "will force null return from malloc")
did exactly that.

Overlay dispatch. The generated function table is one dense array over one
address range, so it holds one function per guest address. Titles that
stream code into a fixed arena break that. FunctionRegionResolver lets a
host that translates each image separately say which table covers an
address right now; nothing about overlay formats or loading enters the
runtime.
---
 ps2xRuntime/include/ps2_runtime.h             | 30 +++++++
 .../src/lib/Kernel/Syscalls/System.cpp        | 18 +++-
 ps2xRuntime/src/lib/ps2_runtime.cpp           | 84 ++++++++++++++++---
 3 files changed, 119 insertions(+), 13 deletions(-)

diff --git a/ps2xRuntime/include/ps2_runtime.h b/ps2xRuntime/include/ps2_runtime.h
index 961e78ea8..15b106c98 100644
--- a/ps2xRuntime/include/ps2_runtime.h
+++ b/ps2xRuntime/include/ps2_runtime.h
@@ -345,6 +345,25 @@ class PS2Runtime
         SkipCallDebug = 3,
     };
 
+    // Overlaid guest code: one dense table per streamed-in image, so the same
+    // arena address can mean different code depending on which is resident.
+    // The host owns the images and answers "which table covers this address?".
+    struct FunctionRegion
+    {
+        uint32_t base = 0u;            // first guest address covered
+        uint32_t end = 0u;             // one past the last covered address
+        uint32_t slotCount = 0u;       // entries in `slots`
+        RecompiledFunction *slots = nullptr; // dense, indexed (addr - base) >> 2
+    };
+
+    // Return the region covering `address`, or nullptr. Called on the guest
+    // thread from dispatch, so it must be cheap and must not block.
+    using FunctionRegionResolver = FunctionRegion *(*)(uint32_t address, void *userData);
+
+    // Global rather than per-instance to match the generated table it extends.
+    // Passing nullptr removes the resolver.
+    static void setFunctionRegionResolver(FunctionRegionResolver resolver, void *userData);
+
     bool replaceFunction(uint32_t address, RecompiledFunction func);
     // TODO remove this later need to update all tests
     bool registerFunction(uint32_t address, RecompiledFunction func);
@@ -393,8 +412,18 @@ class PS2Runtime
     uint32_t guestRealloc(uint32_t guestAddr, uint32_t newSize, uint32_t alignment = 16u);
     void guestFree(uint32_t guestAddr);
     uint32_t guestHeapBase() const;
+
+    // Ceiling for a guest that grows its own heap through sbrk/EndOfHeap.
+    // Zero (default) makes EndOfHeap report guestHeapLimit(), as before.
+    void setGuestHeapCeiling(uint32_t ceiling);
+    uint32_t guestHeapCeiling() const;
+
     uint32_t guestHeapEnd() const;
     uint32_t guestHeapLimit() const;
+
+    // Highest address any heap may reach. Unlike guestHeapLimit() this is
+    // valid before the heap is configured, so a caller can split the range.
+    uint32_t guestHeapHardLimit() const;
     uint32_t reserveAsyncCallbackStack(uint32_t size, uint32_t alignment = 16u);
 
     void drainCompletedDmacHandlers(uint8_t *rdram);
@@ -515,6 +544,7 @@ class PS2Runtime
     uint32_t m_guestHeapBase = 0x00100000u;
     uint32_t m_guestHeapEnd = 0x00100000u;
     uint32_t m_guestHeapLimit = PS2_RAM_SIZE;
+    uint32_t m_guestHeapCeiling = 0u;
     uint32_t m_guestHeapSuggestedBase = 0x00100000u;
     bool m_guestHeapConfigured = false;
     uint32_t m_asyncCallbackStackFloor = 0x01F00000u;
diff --git a/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp b/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp
index 3530e65bb..094a4039e 100644
--- a/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Syscalls/System.cpp
@@ -578,6 +578,14 @@ namespace ps2_syscalls
 
         if (runtime)
         {
+            // A guest running its own allocator is describing *its* heap;
+            // moving the runtime arena there would collide with it.
+            if (runtime->guestHeapCeiling() != 0u)
+            {
+                setReturnU32(ctx, heapBase);
+                return;
+            }
+
             runtime->configureGuestHeap(heapBase, heapLimit);
 
             PS2_IF_AGRESSIVE_LOGS({
@@ -604,9 +612,13 @@ namespace ps2_syscalls
 
         static constexpr uint32_t kDefaultGuestHeapEnd = 0x01F00000u;
 
-        const uint32_t ret = runtime
-                                 ? runtime->guestHeapLimit()
-                                 : kDefaultGuestHeapEnd;
+        // A guest running its own allocator grows right up to this value.
+        uint32_t ret = kDefaultGuestHeapEnd;
+        if (runtime)
+        {
+            const uint32_t ceiling = runtime->guestHeapCeiling();
+            ret = (ceiling != 0u) ? ceiling : runtime->guestHeapLimit();
+        }
 
         setReturnU32(ctx, ret);
     }
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index e5d23d9b5..e107e4b18 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -1037,6 +1037,9 @@ void PS2Runtime::configureIoPathsFromElf(const std::string &elfPath)
 
 namespace
 {
+    std::atomic<PS2Runtime::FunctionRegionResolver> g_functionRegionResolver{nullptr};
+    std::atomic<void *> g_functionRegionResolverUserData{nullptr};
+
     bool generatedFunctionTableSlot(uint32_t address, uint32_t &slot)
     {
         if ((address & 3u) != 0u || g_ps2RecompiledFunctionTableSlotCount == 0u)
@@ -1053,21 +1056,67 @@ namespace
         slot = offset >> 2;
         return slot < g_ps2RecompiledFunctionTableSlotCount;
     }
+
+    // Generated table first, then the host's region resolver for overlaid
+    // code. Returns a pointer into the owning table so replaceFunction can
+    // patch overlay entries too.
+    PS2Runtime::RecompiledFunction *functionTableSlotPointer(uint32_t address)
+    {
+        uint32_t slot = 0u;
+        if (generatedFunctionTableSlot(address, slot))
+        {
+            return &g_ps2RecompiledFunctionTable[slot];
+        }
+
+        if ((address & 3u) != 0u)
+        {
+            return nullptr;
+        }
+
+        const PS2Runtime::FunctionRegionResolver resolver =
+            g_functionRegionResolver.load(std::memory_order_acquire);
+        if (!resolver)
+        {
+            return nullptr;
+        }
+
+        PS2Runtime::FunctionRegion *region =
+            resolver(address, g_functionRegionResolverUserData.load(std::memory_order_acquire));
+        if (!region || !region->slots || address < region->base || address >= region->end)
+        {
+            return nullptr;
+        }
+
+        const uint32_t regionSlot = (address - region->base) >> 2;
+        if (regionSlot >= region->slotCount)
+        {
+            return nullptr;
+        }
+
+        return &region->slots[regionSlot];
+    }
+}
+
+void PS2Runtime::setFunctionRegionResolver(FunctionRegionResolver resolver, void *userData)
+{
+    g_functionRegionResolverUserData.store(userData, std::memory_order_release);
+    g_functionRegionResolver.store(resolver, std::memory_order_release);
 }
 
 bool PS2Runtime::replaceFunction(uint32_t address, RecompiledFunction func)
 {
-    uint32_t slot = 0u;
-    if (!generatedFunctionTableSlot(address, slot))
+    RecompiledFunction *slot = functionTableSlotPointer(address);
+    if (!slot)
     {
         std::cerr << "[function-table] cannot replace guest PC 0x" << std::hex << address
                   << ": outside generated dense table [0x" << g_ps2RecompiledFunctionTableBase
                   << ", 0x" << g_ps2RecompiledFunctionTableEnd << ")"
+                  << " and not claimed by a function-region resolver"
                   << std::dec << std::endl;
         return false;
     }
 
-    g_ps2RecompiledFunctionTable[slot] = func;
+    *slot = func;
     return true;
 }
 
@@ -1078,8 +1127,8 @@ bool PS2Runtime::registerFunction(uint32_t address, RecompiledFunction func)
 
 bool PS2Runtime::hasFunction(uint32_t address) const
 {
-    uint32_t slot = 0u;
-    return generatedFunctionTableSlot(address, slot) && g_ps2RecompiledFunctionTable[slot] != nullptr;
+    const RecompiledFunction *slot = functionTableSlotPointer(address);
+    return slot != nullptr && *slot != nullptr;
 }
 
 const char *describeGuestBranchKind(PS2Runtime::GuestBranchKind kind)
@@ -1105,13 +1154,11 @@ PS2Runtime::RecompiledFunction PS2Runtime::lookupFunction(uint32_t address)
 {
     pushDispatchPc(address);
 
-    uint32_t slot = 0u;
-    if (generatedFunctionTableSlot(address, slot))
+    if (const RecompiledFunction *slot = functionTableSlotPointer(address))
     {
-        RecompiledFunction fn = g_ps2RecompiledFunctionTable[slot];
-        if (fn != nullptr)
+        if (*slot != nullptr)
         {
-            return fn;
+            return *slot;
         }
     }
 
@@ -1935,12 +1982,29 @@ uint32_t PS2Runtime::guestHeapEnd() const
     return m_guestHeapConfigured ? m_guestHeapEnd : m_guestHeapSuggestedBase;
 }
 
+void PS2Runtime::setGuestHeapCeiling(uint32_t ceiling)
+{
+    std::lock_guard<std::mutex> lock(m_guestHeapMutex);
+    m_guestHeapCeiling = ceiling;
+}
+
+uint32_t PS2Runtime::guestHeapCeiling() const
+{
+    std::lock_guard<std::mutex> lock(m_guestHeapMutex);
+    return m_guestHeapCeiling;
+}
+
 uint32_t PS2Runtime::guestHeapLimit() const
 {
     std::lock_guard<std::mutex> lock(m_guestHeapMutex);
     return m_guestHeapConfigured ? m_guestHeapLimit : m_guestHeapSuggestedBase;
 }
 
+uint32_t PS2Runtime::guestHeapHardLimit() const
+{
+    return std::min(kGuestHeapHardLimit, PS2_RAM_SIZE);
+}
+
 uint32_t PS2Runtime::reserveAsyncCallbackStack(uint32_t size, uint32_t alignment)
 {
     if (size == 0u)

From 76af5aa99d6e75263c1f170225ff2234874c3048 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Wed, 19 Aug 2026 21:12:52 +0200
Subject: [PATCH 15/68] Raise INTC VIF0/VIF1 when a VIFcode carries the i bit

The VIF interpreters decoded the bit and set VIFn_STAT.INT, but nothing
turned that into an interrupt, so a game that asks to be told when its
display list completes waits forever. The acknowledge side already worked:
a VIFn_FBRST write with STC clears the STAT bits.

PS2Memory latches the request (bit 0 VIF0, bit 1 VIF1) and
EeScheduler::processPendingEvents drains it into dispatchIrq, mirroring how
EE timer interrupts already travel from advanceEeTimers to the scheduler.

DQ8 sends one such VIFcode -- 0x80000000, a VIF NOP with the i bit -- then
blocks on a semaphore its INTC cause 5 handler signals. Without this the
game stops with the title artwork loaded and never draws. With it, it
renders.

Not emulated: hardware stalls VIF1 at the interrupt and resumes on the STC
write, while the interpreter runs on as it already did when it only set
STAT.INT. DQ8 puts the i bit on the last VIFcode of the packet so there is
nothing left to stall; a game that interrupts mid-packet would need it.
---
 ps2xRuntime/include/runtime/ps2_memory.h     |  5 +++++
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp   | 11 +++++++++++
 ps2xRuntime/src/lib/ps2_memory.cpp           |  5 +++++
 ps2xRuntime/src/lib/ps2_vif1_interpreter.cpp |  6 ++++++
 4 files changed, 27 insertions(+)

diff --git a/ps2xRuntime/include/runtime/ps2_memory.h b/ps2xRuntime/include/runtime/ps2_memory.h
index cea5b98a8..20d08ffc2 100644
--- a/ps2xRuntime/include/runtime/ps2_memory.h
+++ b/ps2xRuntime/include/runtime/ps2_memory.h
@@ -313,6 +313,10 @@ class PS2Memory
     [[nodiscard]] uint64_t cyclesUntilNextEeTimerInterrupt() const noexcept;
     void resetEeTimers() noexcept;
 
+    // A VIFcode carrying the i bit raises INTC VIF0/VIF1. Bit 0 is VIF0,
+    // bit 1 is VIF1; the scheduler drains this and dispatches the handlers.
+    uint32_t takePendingVifInterrupts() noexcept;
+
     using GifPacketCallback = std::function<void(const uint8_t *, uint32_t)>;
     void setGifPacketCallback(GifPacketCallback cb) { m_gifPacketCallback = std::move(cb); }
     void setGifArbiter(GifArbiter *arbiter) { m_gifArbiter = arbiter; }
@@ -374,6 +378,7 @@ class PS2Memory
     std::atomic<uint64_t> m_gifCopyCount{0};
     std::atomic<uint64_t> m_gsWriteCount{0};
     std::atomic<uint64_t> m_vifWriteCount{0};
+    std::atomic<uint32_t> m_pendingVifInterrupts{0};
     std::atomic<uint64_t> m_vu0CodeGeneration{0};
     std::atomic<uint64_t> m_vu1CodeGeneration{0};
     // I/O registers
diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index 1a6b3d3e1..790f80820 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -1765,6 +1765,17 @@ void EeScheduler::processPendingEvents()
             dispatchIrq(false, 9u + timer);
         }
     }
+    // INTC VIF0 (4) and VIF1 (5), raised by a VIFcode carrying the i bit.
+    const uint32_t vifInterrupts = m_runtime.memory().takePendingVifInterrupts();
+    if ((vifInterrupts & 0x1u) != 0u)
+    {
+        dispatchIrq(false, 4u);
+    }
+    if ((vifInterrupts & 0x2u) != 0u)
+    {
+        dispatchIrq(false, 5u);
+    }
+
     std::deque<EeEvent> pending;
     {
         std::lock_guard lock(m_eventMutex);
diff --git a/ps2xRuntime/src/lib/ps2_memory.cpp b/ps2xRuntime/src/lib/ps2_memory.cpp
index 7cb2ba463..454583fc0 100644
--- a/ps2xRuntime/src/lib/ps2_memory.cpp
+++ b/ps2xRuntime/src/lib/ps2_memory.cpp
@@ -404,6 +404,11 @@ void PS2Memory::resetEeTimers() noexcept
     m_eeTimers = {};
 }
 
+uint32_t PS2Memory::takePendingVifInterrupts() noexcept
+{
+    return m_pendingVifInterrupts.exchange(0u, std::memory_order_acq_rel);
+}
+
 uint32_t PS2Memory::advanceEeTimers(uint64_t eeCycles) noexcept
 {
     if (eeCycles == 0u)
diff --git a/ps2xRuntime/src/lib/ps2_vif1_interpreter.cpp b/ps2xRuntime/src/lib/ps2_vif1_interpreter.cpp
index 05fc764a8..fd95e43d1 100644
--- a/ps2xRuntime/src/lib/ps2_vif1_interpreter.cpp
+++ b/ps2xRuntime/src/lib/ps2_vif1_interpreter.cpp
@@ -77,7 +77,10 @@ void PS2Memory::processVIF0Data(const uint8_t *data, uint32_t sizeBytes)
         vif0_regs.code = cmd;
         vif0_regs.num = num;
         if (irq)
+        {
             vif0_regs.stat |= (1u << 11);
+            m_pendingVifInterrupts.fetch_or(0x1u, std::memory_order_relaxed);
+        }
 
         if (opcode == VIF_NOP)
         {
@@ -312,7 +315,10 @@ void PS2Memory::processVIF1Data(const uint8_t *data, uint32_t sizeBytes)
         vif1_regs.code = cmd;
         vif1_regs.num = num;
         if (irq)
+        {
             vif1_regs.stat |= (1u << 11); // INT
+            m_pendingVifInterrupts.fetch_or(0x2u, std::memory_order_relaxed);
+        }
 
         if (opcode == VIF_NOP)
         {

From 7ab0b7c71786d7d6fedc5cab282ffcd4d0fa047a Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Wed, 19 Aug 2026 21:12:52 +0200
Subject: [PATCH 16/68] Weave interlaced frames instead of line-doubling one
 field

SMODE2.FFMD selects what the frame buffer holds, not how the CRT scans it,
and PresentFromLocalMemory had it inverted. FFMD=0 buffers a whole frame
whose two fields are alternate rows, so weaving to a progressive host frame
is just reading every row; FFMD=1 buffers half the display height and each
field reads all of it, which is where line-doubling belongs. Applying the
FFMD=1 rule to an FFMD=0 game threw away half the vertical detail.

Also snaps the two PCRTC read circuits together when they cover the same
buffer one row apart. That configuration is a deliberate vertical flicker
filter and merging it faithfully costs half a row of blur; PCSX2 snaps by
default. This is the one deliberate departure from hardware here, and it is
isolated -- deleting it costs about 1.6 dB.

Measured on six DQ8 title-screen GS dumps: identical adjacent rows
224/447 -> 0/447, PSNR 28.97-29.12 dB -> 29.53-29.67 dB. The win holds under
both resample directions. The FFMD=1 branch has no test coverage -- every
dump is FFMD=0 -- and is reasoned from the spec rather than exercised.
---
 .../include/runtime/gs/gs_cpu_backend.h       |  3 +-
 ps2xRuntime/src/lib/gs/gs_cpu_backend.cpp     | 49 ++++++++-----------
 2 files changed, 22 insertions(+), 30 deletions(-)

diff --git a/ps2xRuntime/include/runtime/gs/gs_cpu_backend.h b/ps2xRuntime/include/runtime/gs/gs_cpu_backend.h
index 71e80324f..c428fed9a 100644
--- a/ps2xRuntime/include/runtime/gs/gs_cpu_backend.h
+++ b/ps2xRuntime/include/runtime/gs/gs_cpu_backend.h
@@ -56,7 +56,8 @@ class GSCpuBackend final : public GSRasterBackend
                              bool useLocalMemoryLayout,
                              bool frameBaseIsPages,
                              uint32_t sourceOriginX,
-                             uint32_t sourceOriginY) const;
+                             uint32_t sourceOriginY,
+                             bool doubleSourceRows = false) const;
 
     using WriteVramFunc = std::function<void(uint8_t *, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t)>;
     using ReadVramFunc = std::function<uint32_t(uint8_t *, uint32_t, uint32_t, uint32_t, uint32_t)>;
diff --git a/ps2xRuntime/src/lib/gs/gs_cpu_backend.cpp b/ps2xRuntime/src/lib/gs/gs_cpu_backend.cpp
index 9c39ae2e7..329f3da01 100644
--- a/ps2xRuntime/src/lib/gs/gs_cpu_backend.cpp
+++ b/ps2xRuntime/src/lib/gs/gs_cpu_backend.cpp
@@ -420,22 +420,6 @@ namespace
         return {(smode2 & 0x1ull) != 0ull, ((smode2 >> 1) & 0x1ull) != 0ull};
     }
 
-    void applyFieldPresentation(std::vector<uint8_t> &pixels, uint32_t width, uint32_t height, bool oddField)
-    {
-        if (pixels.empty() || width == 0u || height < 2u)
-            return;
-        const std::vector<uint8_t> source = pixels;
-        for (uint32_t y = 0; y < height; ++y)
-        {
-            uint32_t sourceY = ((y >> 1u) << 1u) + (oddField ? 1u : 0u);
-            if (sourceY >= height)
-                sourceY = height - 1u;
-            std::memcpy(pixels.data() + y * kHostFrameWidth * 4u,
-                        source.data() + sourceY * kHostFrameWidth * 4u,
-                        width * 4u);
-        }
-    }
-
     void normalizePresentationAlpha(std::vector<uint8_t> &pixels, uint32_t width, uint32_t height)
     {
         for (uint32_t y = 0; y < height; ++y)
@@ -1687,7 +1671,8 @@ bool GSCpuBackend::CopyFrameToHostRgba(const GSFrameReg &frame,
                                        bool useLocalMemoryLayout,
                                        bool frameBaseIsPages,
                                        uint32_t sourceOriginX,
-                                       uint32_t sourceOriginY) const
+                                       uint32_t sourceOriginY,
+                                       bool doubleSourceRows) const
 {
     if (!m_vram || m_vramSize == 0u)
         return false;
@@ -1705,7 +1690,7 @@ bool GSCpuBackend::CopyFrameToHostRgba(const GSFrameReg &frame,
         for (uint32_t x = 0; x < width; ++x)
         {
             const uint32_t sx = sourceOriginX + x;
-            const uint32_t sy = sourceOriginY + y;
+            const uint32_t sy = sourceOriginY + (doubleSourceRows ? (y >> 1u) : y);
             if (frame.psm == GS_PSM_CT32 || frame.psm == GS_PSM_CT24)
             {
                 uint32_t color = 0u;
@@ -1776,12 +1761,14 @@ PresentationFrame GSCpuBackend::PresentFromLocalMemory(const GSPresentationReque
     PresentationFrame result{};
     const GSPmodeState pmode = decodePmode(request.pmode);
     const GSSmode2State smode2 = decodeSMode2(request.smode2);
-    const bool fieldMode = smode2.interlaced && !smode2.frameMode;
-    const bool oddField = (request.vsyncTick & 1ull) != 0ull;
+    // SMODE2 FFMD=1 (FRAME) reads a half-height buffer whole once per field, so the
+    // woven host frame line-doubles it. FFMD=0 (FIELD) buffers a full frame whose
+    // two fields are alternate buffer rows: weaving is just reading every row.
+    const bool halfHeightSource = smode2.interlaced && smode2.frameMode;
     const GSFrameReg displayFrame1 = decodeDisplayFrame(request.dispfb1);
     const GSFrameReg displayFrame2 = decodeDisplayFrame(request.dispfb2);
-    const GSDisplayReadOrigin origin1 = decodeDisplayReadOrigin(request.dispfb1);
-    const GSDisplayReadOrigin origin2 = decodeDisplayReadOrigin(request.dispfb2);
+    GSDisplayReadOrigin origin1 = decodeDisplayReadOrigin(request.dispfb1);
+    GSDisplayReadOrigin origin2 = decodeDisplayReadOrigin(request.dispfb2);
     uint32_t width1 = 0u, height1 = 0u, width2 = 0u, height2 = 0u;
     decodeDisplaySize(request.display1, width1, height1);
     decodeDisplaySize(request.display2, width2, height2);
@@ -1790,6 +1777,14 @@ PresentationFrame GSCpuBackend::PresentFromLocalMemory(const GSPresentationReque
     if (!valid1 && !valid2)
         return result;
 
+    // Both circuits on one buffer a single row apart is a deliberate flicker filter;
+    // snapping them together drops the half-row blur, as PCSX2 does by default.
+    const uint32_t originGap = origin1.y > origin2.y ? origin1.y - origin2.y : origin2.y - origin1.y;
+    const bool sameReadSource = displayFrame1.fbp == displayFrame2.fbp && displayFrame1.fbw == displayFrame2.fbw &&
+                                displayFrame1.psm == displayFrame2.psm && origin1.x == origin2.x;
+    if (valid1 && valid2 && sameReadSource && originGap == 1u)
+        origin1.y = origin2.y = std::min(origin1.y, origin2.y);
+
     auto copySource = [&](const GSFrameReg &displayFrame,
                           const GSDisplayReadOrigin &origin,
                           uint32_t width,
@@ -1805,12 +1800,12 @@ PresentationFrame GSCpuBackend::PresentFromLocalMemory(const GSPresentationReque
         usedPreferred = false;
         if (allowPreferred && request.hasPreferredSource && request.preferredDestFbp == displayFrame.fbp &&
             (request.preferredSource.fbw != 0u || request.preferredSource.fbp != displayFrame.fbp) &&
-            CopyFrameToHostRgba(request.preferredSource, width, height, pixels, preserveAlpha, true, false, 0u, 0u))
+            CopyFrameToHostRgba(request.preferredSource, width, height, pixels, preserveAlpha, true, false, 0u, 0u, halfHeightSource))
         {
             selected = request.preferredSource;
             usedPreferred = true;
         }
-        if (pixels.empty() && !CopyFrameToHostRgba(displayFrame, width, height, pixels, preserveAlpha, true, true, origin.x, origin.y))
+        if (pixels.empty() && !CopyFrameToHostRgba(displayFrame, width, height, pixels, preserveAlpha, true, true, origin.x, origin.y, halfHeightSource))
             return false;
 
         if (!usedPreferred && displayFrame.fbp == 0u && countNonBlackPixels(pixels, width, height) == 0u)
@@ -1820,7 +1815,7 @@ PresentationFrame GSCpuBackend::PresentFromLocalMemory(const GSPresentationReque
                 if (candidate.fbp == selected.fbp && candidate.fbw == selected.fbw && candidate.psm == selected.psm)
                     continue;
                 std::vector<uint8_t> candidatePixels;
-                if (!CopyFrameToHostRgba(candidate, width, height, candidatePixels, preserveAlpha, true, true, 0u, 0u))
+                if (!CopyFrameToHostRgba(candidate, width, height, candidatePixels, preserveAlpha, true, true, 0u, 0u, halfHeightSource))
                     continue;
                 if (countNonBlackPixels(candidatePixels, width, height) == 0u)
                     continue;
@@ -1870,8 +1865,6 @@ PresentationFrame GSCpuBackend::PresentFromLocalMemory(const GSPresentationReque
                     dst[3] = pmode.amod ? dst[3] : src[3];
                 }
             normalizePresentationAlpha(result.pixels, result.width, result.height);
-            if (fieldMode)
-                applyFieldPresentation(result.pixels, result.width, result.height, oddField);
             result.displayFbp = displayFrame1.fbp;
             result.sourceFbp = selected1.fbp;
             return result;
@@ -1885,8 +1878,6 @@ PresentationFrame GSCpuBackend::PresentFromLocalMemory(const GSPresentationReque
     GSFrameReg selected = displayFrame;
     if (!copySource(displayFrame, origin, result.width, result.height, true, false, selected, result.pixels, result.usedPreferred))
         return {};
-    if (fieldMode)
-        applyFieldPresentation(result.pixels, result.width, result.height, oddField);
     normalizePresentationAlpha(result.pixels, result.width, result.height);
     result.displayFbp = displayFrame.fbp;
     result.sourceFbp = selected.fbp;

From 60a0d2df114a634b2083b989c36c2d35ee963138 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Wed, 19 Aug 2026 23:59:07 +0200
Subject: [PATCH 17/68] Latch pad input and snap presentation to integer scale

Two defects that both trace back to the frame rate, and one hazard beside
them.

Input. readState() sampled IsKeyDown() on the EE thread once per scePadRead,
which is a level read of raylib state refreshed once per presented frame. At
7 fps that is a 140 ms window and a press-and-release inside it was never
observed at all.

Edge detection alone does not fix this: PollInputEvents copies
current->previous and then calls glfwPollEvents, and GLFW's callback sets the
key to 1 on press and 0 on release, so a tap whose press and release land in
the same poll leaves both states at 0. Measured, 5 ms taps fired on 0 of 51
frames for IsKeyDown and IsKeyPressed alike. What survives is keyPressedQueue,
which the callback appends to regardless. ps2PadPollHost() therefore runs on
the render thread and publishes two atomics -- a held mask from IsKeyDown and
a latch drained from GetKeyPressed -- and readState() ORs them, consuming the
latch exactly once. Taps of 5/20/60 ms went from 0/15, 3/15, 6/15 seen to
15/15 in all three cases, one guest frame of button-down each.

Declared in a new ps2_pad_host.h rather than on PSPadBackend: ps2_pad.h is
reachable from ps2_runtime.h, so putting it there rebuilds the whole
recompiled corpus for an input change.

Presentation. The window is resizable and SetTextureFilter was never called,
so a non-integer nearest-neighbour scale duplicated some pixel columns and
dropped others -- at 700x500 only 510 of 512 source columns survived, and
1920x1080 gave runs of 2 and 3 pixels. One-pixel font stems came out uneven.
Upscales now snap to floor(fitScale) with point sampling, bilinear is used
only below 1.0 where integer scaling has nowhere to go, and the destination
origin is floored because odd centring offsets were an independent half-pixel
source. Verified over 15 window sizes: 8 of 12 upscales mangled before, 0
after, all 512 columns present with uniform run widths. The window now opens
at 2x when that fits in 90% of the monitor.

Also SetExitKey(KEY_NULL): Escape is bound to Circle, and raylib's default
exit key is Escape, so pressing Circle closed the game.
---
 ps2xRuntime/include/runtime/ps2_pad_host.h |  10 +
 ps2xRuntime/src/lib/ps2_pad.cpp            | 266 +++++++++++++++------
 ps2xRuntime/src/lib/ps2_runtime.cpp        |  47 +++-
 3 files changed, 244 insertions(+), 79 deletions(-)
 create mode 100644 ps2xRuntime/include/runtime/ps2_pad_host.h

diff --git a/ps2xRuntime/include/runtime/ps2_pad_host.h b/ps2xRuntime/include/runtime/ps2_pad_host.h
new file mode 100644
index 000000000..b7652de89
--- /dev/null
+++ b/ps2xRuntime/include/runtime/ps2_pad_host.h
@@ -0,0 +1,10 @@
+#ifndef PS2_PAD_HOST_H
+#define PS2_PAD_HOST_H
+
+// Render-thread half of the pad backend. Samples raylib input once per presented
+// frame and latches press edges so a tap between two guest polls still registers.
+// Declared here rather than on PSPadBackend so the recompiled corpus, which
+// includes ps2_pad.h through ps2_runtime.h, does not rebuild for input changes.
+void ps2PadPollHost();
+
+#endif
diff --git a/ps2xRuntime/src/lib/ps2_pad.cpp b/ps2xRuntime/src/lib/ps2_pad.cpp
index 8590f1424..e5a26e5ca 100644
--- a/ps2xRuntime/src/lib/ps2_pad.cpp
+++ b/ps2xRuntime/src/lib/ps2_pad.cpp
@@ -1,11 +1,20 @@
 #include "runtime/ps2_pad.h"
+#include "runtime/ps2_pad_host.h"
 #include "ps2_host_backend.h"
+#include <atomic>
+#include <chrono>
 #include <cstring>
 
 namespace
 {
     constexpr uint8_t kPadAnalogMarker = 0x73;
     constexpr uint8_t kPadStickCenter = 0x80;
+    constexpr uint32_t kPadStickNeutral = 0x80808080u;
+    constexpr int kGamepad = 0;
+
+    // Drop a latch the guest never came back for, so a tap during a long
+    // non-polling stretch (loading, cutscene) does not fire much later.
+    constexpr uint64_t kLatchTimeoutMs = 1000u;
 
     constexpr uint16_t PAD_LEFT = 0x0080u;
     constexpr uint16_t PAD_DOWN = 0x0040u;
@@ -23,6 +32,172 @@ namespace
     constexpr uint16_t PAD_L1 = 0x0400u;
     constexpr uint16_t PAD_R2 = 0x0200u;
     constexpr uint16_t PAD_L2 = 0x0100u;
+
+    // Published by the render thread in ps2PadPollHost(), consumed on the EE thread.
+    std::atomic<bool> g_hostPolled{false};
+    std::atomic<uint32_t> g_held{0u};              // active-high PAD_* mask
+    std::atomic<uint32_t> g_latched{0u};           // press edges not consumed yet
+    std::atomic<uint32_t> g_sticks{kPadStickNeutral}; // packed rx,ry,lx,ly
+    std::atomic<uint64_t> g_latchStampMs{0u};
+
+    struct KeyBinding
+    {
+        int key;
+        uint16_t mask;
+    };
+
+    constexpr KeyBinding kKeyBindings[] = {
+        {KEY_UP, PAD_UP}, {KEY_W, PAD_UP},
+        {KEY_DOWN, PAD_DOWN}, {KEY_S, PAD_DOWN},
+        {KEY_LEFT, PAD_LEFT}, {KEY_A, PAD_LEFT},
+        {KEY_RIGHT, PAD_RIGHT}, {KEY_D, PAD_RIGHT},
+        {KEY_X, PAD_CROSS}, {KEY_SPACE, PAD_CROSS},
+        {KEY_C, PAD_CIRCLE}, {KEY_ESCAPE, PAD_CIRCLE},
+        {KEY_Z, PAD_SQUARE}, {KEY_KP_0, PAD_SQUARE},
+        {KEY_V, PAD_TRIANGLE}, {KEY_KP_1, PAD_TRIANGLE},
+        {KEY_Q, PAD_L1},
+        {KEY_E, PAD_R1},
+        {KEY_LEFT_SHIFT, PAD_L2},
+        {KEY_RIGHT_SHIFT, PAD_R2},
+        {KEY_ENTER, PAD_START},
+        {KEY_TAB, PAD_SELECT},
+    };
+
+    struct PadBinding
+    {
+        int button;
+        uint16_t mask;
+    };
+
+    constexpr PadBinding kPadBindings[] = {
+        {GAMEPAD_BUTTON_LEFT_FACE_UP, PAD_UP},
+        {GAMEPAD_BUTTON_LEFT_FACE_DOWN, PAD_DOWN},
+        {GAMEPAD_BUTTON_LEFT_FACE_LEFT, PAD_LEFT},
+        {GAMEPAD_BUTTON_LEFT_FACE_RIGHT, PAD_RIGHT},
+        {GAMEPAD_BUTTON_RIGHT_FACE_DOWN, PAD_CROSS},
+        {GAMEPAD_BUTTON_RIGHT_FACE_RIGHT, PAD_CIRCLE},
+        {GAMEPAD_BUTTON_RIGHT_FACE_LEFT, PAD_SQUARE},
+        {GAMEPAD_BUTTON_RIGHT_FACE_UP, PAD_TRIANGLE},
+        {GAMEPAD_BUTTON_LEFT_TRIGGER_1, PAD_L1},
+        {GAMEPAD_BUTTON_RIGHT_TRIGGER_1, PAD_R1},
+        {GAMEPAD_BUTTON_LEFT_TRIGGER_2, PAD_L2},
+        {GAMEPAD_BUTTON_RIGHT_TRIGGER_2, PAD_R2},
+        {GAMEPAD_BUTTON_MIDDLE_RIGHT, PAD_START},
+        {GAMEPAD_BUTTON_MIDDLE_LEFT, PAD_SELECT},
+        {GAMEPAD_BUTTON_LEFT_THUMB, PAD_L3},
+        {GAMEPAD_BUTTON_RIGHT_THUMB, PAD_R3},
+    };
+
+    uint8_t axisToByte(float axis)
+    {
+        const float mapped = 128.0f + axis * 127.0f;
+        return static_cast<uint8_t>(mapped < 0.0f ? 0.0f : (mapped > 255.0f ? 255.0f : mapped));
+    }
+
+    uint64_t nowMs()
+    {
+        using namespace std::chrono;
+        return static_cast<uint64_t>(
+            duration_cast<milliseconds>(steady_clock::now().time_since_epoch()).count());
+    }
+
+    uint32_t keyMask(int key)
+    {
+        uint32_t mask = 0u;
+        for (const KeyBinding &binding : kKeyBindings)
+        {
+            if (binding.key == key)
+            {
+                mask |= binding.mask;
+            }
+        }
+        return mask;
+    }
+
+    // drainQueue must only be true on the render thread: GetKeyPressed() mutates
+    // raylib's queue, while every other call here is a plain read.
+    void sampleHost(bool drainQueue, uint32_t &held, uint32_t &pressed, uint32_t &sticks)
+    {
+        held = 0u;
+        pressed = 0u;
+        sticks = kPadStickNeutral;
+
+        if (IsGamepadAvailable(kGamepad))
+        {
+            for (const PadBinding &binding : kPadBindings)
+            {
+                if (IsGamepadButtonDown(kGamepad, binding.button))
+                {
+                    held |= binding.mask;
+                }
+                if (IsGamepadButtonPressed(kGamepad, binding.button))
+                {
+                    pressed |= binding.mask;
+                }
+            }
+
+            const uint8_t rx = axisToByte(GetGamepadAxisMovement(kGamepad, GAMEPAD_AXIS_RIGHT_X));
+            const uint8_t ry = axisToByte(GetGamepadAxisMovement(kGamepad, GAMEPAD_AXIS_RIGHT_Y));
+            const uint8_t lx = axisToByte(GetGamepadAxisMovement(kGamepad, GAMEPAD_AXIS_LEFT_X));
+            const uint8_t ly = axisToByte(GetGamepadAxisMovement(kGamepad, GAMEPAD_AXIS_LEFT_Y));
+            sticks = (static_cast<uint32_t>(rx) << 24) | (static_cast<uint32_t>(ry) << 16) |
+                     (static_cast<uint32_t>(lx) << 8) | static_cast<uint32_t>(ly);
+            return;
+        }
+
+        for (const KeyBinding &binding : kKeyBindings)
+        {
+            if (IsKeyDown(binding.key))
+            {
+                held |= binding.mask;
+            }
+        }
+
+        if (drainQueue)
+        {
+            // raylib queues every GLFW press, including one released again inside
+            // the same poll, which IsKeyPressed() would already have missed.
+            for (int key = GetKeyPressed(); key != 0; key = GetKeyPressed())
+            {
+                pressed |= keyMask(key);
+            }
+        }
+    }
+}
+
+void ps2PadPollHost()
+{
+    if (!IsWindowReady())
+    {
+        return;
+    }
+
+    uint32_t held = 0u;
+    uint32_t pressed = 0u;
+    uint32_t sticks = kPadStickNeutral;
+    sampleHost(true, held, pressed, sticks);
+
+    g_held.store(held);
+    g_sticks.store(sticks);
+
+    const uint64_t now = nowMs();
+    if (pressed != 0u)
+    {
+        if (g_latched.fetch_or(pressed) == 0u)
+        {
+            g_latchStampMs.store(now);
+        }
+    }
+    else
+    {
+        const uint32_t stale = g_latched.load();
+        if (stale != 0u && (now - g_latchStampMs.load()) > kLatchTimeoutMs)
+        {
+            g_latched.fetch_and(~stale);
+        }
+    }
+
+    g_hostPolled.store(true);
 }
 
 bool PSPadBackend::readState(int /*port*/, int /*slot*/, uint8_t *data, size_t size)
@@ -37,88 +212,27 @@ bool PSPadBackend::readState(int /*port*/, int /*slot*/, uint8_t *data, size_t s
     data[3] = 0xFF;
     data[4] = data[5] = data[6] = data[7] = kPadStickCenter;
 
-    uint16_t btns = 0xFFFFu;
-    constexpr int kGamepad = 0;
-    const bool useGamepad = IsGamepadAvailable(kGamepad);
-    auto clearBit = [&btns](uint16_t mask)
-    { btns &= ~mask; };
-
-    if (useGamepad)
+    uint32_t active = 0u;
+    uint32_t sticks = kPadStickNeutral;
+    if (g_hostPolled.load())
     {
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_LEFT_FACE_UP))
-            clearBit(PAD_UP);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_LEFT_FACE_DOWN))
-            clearBit(PAD_DOWN);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_LEFT_FACE_LEFT))
-            clearBit(PAD_LEFT);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_LEFT_FACE_RIGHT))
-            clearBit(PAD_RIGHT);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_RIGHT_FACE_DOWN))
-            clearBit(PAD_CROSS);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_RIGHT_FACE_RIGHT))
-            clearBit(PAD_CIRCLE);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_RIGHT_FACE_LEFT))
-            clearBit(PAD_SQUARE);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_RIGHT_FACE_UP))
-            clearBit(PAD_TRIANGLE);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_LEFT_TRIGGER_1))
-            clearBit(PAD_L1);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_RIGHT_TRIGGER_1))
-            clearBit(PAD_R1);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_LEFT_TRIGGER_2))
-            clearBit(PAD_L2);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_RIGHT_TRIGGER_2))
-            clearBit(PAD_R2);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_MIDDLE_RIGHT))
-            clearBit(PAD_START);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_MIDDLE_LEFT))
-            clearBit(PAD_SELECT);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_LEFT_THUMB))
-            clearBit(PAD_L3);
-        if (IsGamepadButtonDown(kGamepad, GAMEPAD_BUTTON_RIGHT_THUMB))
-            clearBit(PAD_R3);
-
-        float lx = GetGamepadAxisMovement(kGamepad, GAMEPAD_AXIS_LEFT_X);
-        float ly = GetGamepadAxisMovement(kGamepad, GAMEPAD_AXIS_LEFT_Y);
-        float rx = GetGamepadAxisMovement(kGamepad, GAMEPAD_AXIS_RIGHT_X);
-        float ry = GetGamepadAxisMovement(kGamepad, GAMEPAD_AXIS_RIGHT_Y);
-        data[6] = static_cast<uint8_t>(128 + lx * 127);
-        data[7] = static_cast<uint8_t>(128 + ly * 127);
-        data[4] = static_cast<uint8_t>(128 + rx * 127);
-        data[5] = static_cast<uint8_t>(128 + ry * 127);
+        // exchange() so each latched press is handed to the guest exactly once.
+        active = g_held.load() | g_latched.exchange(0u);
+        sticks = g_sticks.load();
     }
     else
     {
-        if (IsKeyDown(KEY_UP) || IsKeyDown(KEY_W))
-            clearBit(PAD_UP);
-        if (IsKeyDown(KEY_DOWN) || IsKeyDown(KEY_S))
-            clearBit(PAD_DOWN);
-        if (IsKeyDown(KEY_LEFT) || IsKeyDown(KEY_A))
-            clearBit(PAD_LEFT);
-        if (IsKeyDown(KEY_RIGHT) || IsKeyDown(KEY_D))
-            clearBit(PAD_RIGHT);
-        if (IsKeyDown(KEY_X) || IsKeyDown(KEY_SPACE))
-            clearBit(PAD_CROSS);
-        if (IsKeyDown(KEY_C) || IsKeyDown(KEY_ESCAPE))
-            clearBit(PAD_CIRCLE);
-        if (IsKeyDown(KEY_Z) || IsKeyDown(KEY_KP_0))
-            clearBit(PAD_SQUARE);
-        if (IsKeyDown(KEY_V) || IsKeyDown(KEY_KP_1))
-            clearBit(PAD_TRIANGLE);
-        if (IsKeyDown(KEY_Q))
-            clearBit(PAD_L1);
-        if (IsKeyDown(KEY_E))
-            clearBit(PAD_R1);
-        if (IsKeyDown(KEY_LEFT_SHIFT))
-            clearBit(PAD_L2);
-        if (IsKeyDown(KEY_RIGHT_SHIFT))
-            clearBit(PAD_R2);
-        if (IsKeyDown(KEY_ENTER))
-            clearBit(PAD_START);
-        if (IsKeyDown(KEY_TAB))
-            clearBit(PAD_SELECT);
+        // No host present loop (embedders that never call ps2PadPollHost).
+        uint32_t pressed = 0u;
+        sampleHost(false, active, pressed, sticks);
     }
 
+    data[4] = static_cast<uint8_t>(sticks >> 24);
+    data[5] = static_cast<uint8_t>(sticks >> 16);
+    data[6] = static_cast<uint8_t>(sticks >> 8);
+    data[7] = static_cast<uint8_t>(sticks);
+
+    const uint16_t btns = static_cast<uint16_t>(0xFFFFu & ~active);
     data[2] = static_cast<uint8_t>(btns & 0xFF);
     data[3] = static_cast<uint8_t>(btns >> 8);
     return true;
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index e107e4b18..345a30b51 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -5,6 +5,7 @@
 #include "game_overrides.h"
 #include "ps2_runtime_macros.h"
 #include "runtime/gs/gs_frontend.h"
+#include "runtime/ps2_pad_host.h"
 #include "runtime/ee_scheduler.h"
 #include "ThreadNaming.h"
 #include "Kernel/Stubs/Audio.h"
@@ -19,6 +20,7 @@
 #include <algorithm>
 #include <array>
 #include <cctype>
+#include <cmath>
 #include <cstring>
 #include <limits>
 #include <chrono>
@@ -673,6 +675,28 @@ bool PS2Runtime::syncCoreSubsystems()
     return true;
 }
 
+// Grow the default window to an exact 2x of the PS2 output when the monitor has
+// room, so it opens both larger and integer-scaled. Resizable either way.
+static void applyDefaultWindowScale()
+{
+    constexpr int kScale = 2;
+    const int monitor = GetCurrentMonitor();
+    const int monitorWidth = GetMonitorWidth(monitor);
+    const int monitorHeight = GetMonitorHeight(monitor);
+    const int width = HOST_WINDOW_WIDTH * kScale;
+    const int height = HOST_WINDOW_HEIGHT * kScale;
+    if (monitorWidth <= 0 || monitorHeight <= 0 ||
+        width * 10 > monitorWidth * 9 || height * 10 > monitorHeight * 9)
+    {
+        return;
+    }
+
+    const Vector2 origin = GetMonitorPosition(monitor);
+    SetWindowSize(width, height);
+    SetWindowPosition(static_cast<int>(origin.x) + (monitorWidth - width) / 2,
+                      static_cast<int>(origin.y) + (monitorHeight - height) / 2);
+}
+
 bool PS2Runtime::initialize(const char *title)
 {
     try
@@ -702,6 +726,9 @@ bool PS2Runtime::initialize(const char *title)
 #else
         SetConfigFlags(FLAG_WINDOW_RESIZABLE);
         InitWindow(HOST_WINDOW_WIDTH, HOST_WINDOW_HEIGHT, title);
+        // Escape is bound to Circle; without this raylib also closes on it.
+        SetExitKey(KEY_NULL);
+        applyDefaultWindowScale();
         InitAudioDevice();
         m_audioBackend.setAudioReady(IsAudioDeviceReady());
 #endif
@@ -2391,6 +2418,8 @@ void PS2Runtime::run()
     Image blank = GenImageColor(FB_WIDTH, FB_HEIGHT, BLANK);
     Texture2D frameTex = LoadTextureFromImage(blank);
     UnloadImage(blank);
+    int frameTexFilter = TEXTURE_FILTER_POINT;
+    SetTextureFilter(frameTex, frameTexFilter);
 
     std::atomic<bool> gameThreadFinished{false};
 
@@ -2459,13 +2488,24 @@ void PS2Runtime::run()
         const float srcHeight = static_cast<float>(std::max<uint32_t>(1u, presentHeight));
         const float screenWidth = static_cast<float>(GetScreenWidth());
         const float screenHeight = static_cast<float>(GetScreenHeight());
-        const float scale = std::min(screenWidth / srcWidth, screenHeight / srcHeight);
+        const float fitScale = std::min(screenWidth / srcWidth, screenHeight / srcHeight);
+        // Snap upscales to an integer multiple: a fractional nearest-neighbour scale
+        // duplicates some pixel columns and not others, which shreds 1px font stems.
+        const bool integerScale = fitScale >= 1.0f;
+        const float scale = integerScale ? std::floor(fitScale) : fitScale;
+        const int wantedFilter = integerScale ? TEXTURE_FILTER_POINT : TEXTURE_FILTER_BILINEAR;
+        if (wantedFilter != frameTexFilter)
+        {
+            SetTextureFilter(frameTex, wantedFilter);
+            frameTexFilter = wantedFilter;
+        }
         const float dstWidth = srcWidth * scale;
         const float dstHeight = srcHeight * scale;
         const Rectangle srcRect{0.0f, 0.0f, srcWidth, srcHeight};
+        // Whole-pixel origin, else centring can land the quad on a half pixel.
         const Rectangle dstRect{
-            (screenWidth - dstWidth) * 0.5f,
-            (screenHeight - dstHeight) * 0.5f,
+            std::floor((screenWidth - dstWidth) * 0.5f),
+            std::floor((screenHeight - dstHeight) * 0.5f),
             dstWidth,
             dstHeight};
         DrawTexturePro(frameTex, srcRect, dstRect, Vector2{0.0f, 0.0f}, 0.0f, WHITE);
@@ -2474,6 +2514,7 @@ void PS2Runtime::run()
             m_debugUiDrawCallback(*this, m_debugUiUserData);
         }
         EndDrawing();
+        ps2PadPollHost(); // EndDrawing() polled raylib input; latch edges for the EE thread
 
         if (WindowShouldClose())
         {

From de62c4c66867aef540d3e39506b8aefd70e6b54c Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Thu, 20 Aug 2026 00:41:43 +0200
Subject: [PATCH 18/68] Bound invocation nesting so a callback storm cannot
 exhaust the stack pool

Pending invocations are pushed onto the running thread between any two guest
function dispatches, including partway through one already in flight, so they
nest rather than run in sequence. DQ8's movie streaming queues SIF RPC
completion callbacks faster than they retire and reached depth 13 on one
thread, exhausting the invocation stack pool and throwing.

Past four deep the rest simply stay on m_pendingInvocations and are picked up
as the depth drops. Real nesting is at most a couple deep -- an interrupt
during a callback -- so this bounds the pathological case without changing
legitimate behaviour, and an unbounded depth cannot be supported anyway: the
pool is the fixed gap between the runtime arena and the guest's own stack.

Measured on DQ8: 16 stacks consumed then failure, all but two of them thread
12 at depths 0 through 13, all GuestInvocationKind::RpcCallback. With the
bound the game runs past the movie open into its sound settings screen.
---
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index 790f80820..3ecc929d1 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -252,7 +252,12 @@ void EeScheduler::run()
             continue;
         }
 
-        if (!m_pendingInvocations.empty())
+        // Invocations nest onto the running thread, so a callback storm stacks
+        // them faster than they retire -- DQ8's movie streaming reached depth 13
+        // and exhausted the stack pool. Past this the rest simply stay queued.
+        constexpr size_t kMaxInvocationDepth = 4u;
+        if (!m_pendingInvocations.empty() &&
+            running->invocations.size() < kMaxInvocationDepth)
         {
             GuestInvocation invocation = std::move(m_pendingInvocations.front());
             m_pendingInvocations.pop_front();

From 96c2ecf9aec1d082854d0fbc2b80b1dfad5d41fe Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Thu, 20 Aug 2026 17:12:17 +0200
Subject: [PATCH 19/68] Let a PSS movie finish: decoder availability, stream
 end, upload gate

Three defects that between them left DQ8's logo movie as a frozen frame that
never terminated. All are reachable by any game that plays a PSS movie.

1. A runtime built without FFmpeg deadlocks. The stub decoder's feed() returns
   false and the failure path sets decoderFailed = false, which is right for
   the FFmpeg build where false means "no sequence header yet, resync". With no
   decoder that is not recoverable, so sceMpegGetPicture parks on a frame that
   can never arrive. decoderFailed was declared, cleared in two places and read
   in five as the give-up signal, but never once set: the path was dead code.
   Both decoder variants now carry kAvailable and feedElementaryStream raises
   the flag. Both demux entry points include it in the completeExternalWait
   predicate, without which a thread already parked -- the usual case, since
   the first GetPicture precedes the first demux -- is never woken.

2. Nothing could report end of stream to a game that streams with plain
   sceCdRead. The two available signals are a program-end code in the PSS and
   currentCdStreamEofSeen, and the latter is only ever raised from sceCdStPause
   /StRead/StStart/StStop. DQ8 contains no sceCdSt* function at all and its
   .MVI files carry no program-end code -- they end in 0xFF sector padding --
   so the movie decoded all 270 pictures and then hung forever. sawSequenceEnd
   already tracked the video sequence-end code 00 00 01 B7 but was read only by
   a debug log; it now drives the wait predicate and the guest's own end flag.

   The flag itself is inner[0x00], reached through mpeg[0x40]. The game's
   sceMpegIsEnd equivalent is three instructions -- return **(mpeg+0x40) -- and
   the stub wrote every neighbouring field but that one.

3. mpeg[0x08] gates the caller's VRAM upload rather than counting pictures.
   DQ8 uploads its movie buffers only while it reads zero, so writing a running
   counter there stopped the movie updating after the very first frame. It now
   reports whether this call produced a picture.

Also stop sceMpegReset carrying streamEnded forward unless the sceCdSt*
producer is actually driving. appendPssBytes refuses new data while that flag
is set until cdStreamGeneration advances, and only notifyMpegCdStreamStart
advances it -- so for a plain-sceCdRead game the first ended stream wedged
every later movie.
---
 ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp | 49 +++++++++++++++++++++--
 1 file changed, 45 insertions(+), 4 deletions(-)

diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
index 44eaef4d9..4e2abd912 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
@@ -61,6 +61,8 @@ namespace ps2_stubs
         class MpegFfmpegDecoder
         {
         public:
+            static constexpr bool kAvailable = true;
+
             MpegFfmpegDecoder() = default;
 
             ~MpegFfmpegDecoder()
@@ -448,6 +450,8 @@ namespace ps2_stubs
         class MpegFfmpegDecoder
         {
         public:
+            static constexpr bool kAvailable = false;
+
             bool feed(const uint8_t *, size_t, std::deque<MpegDecodedFrame> &, int64_t = -1, int64_t = -1)
             {
                 static bool s_warnedNoFfmpeg = false;
@@ -1038,6 +1042,16 @@ namespace ps2_stubs
             }
 
             playback.sawInput = true;
+
+            // Without a video decoder no frame can ever arrive, so parking
+            // sceMpegGetPicture waiters would hang the movie forever. Mark the
+            // stream failed instead and let them return empty-handed.
+            if constexpr (!MpegFfmpegDecoder::kAvailable)
+            {
+                playback.decoderFailed = true;
+                return;
+            }
+
             updateMpegPictureTiming(playback, data, size);
             if (playback.waitingForVideoSequenceHeader)
             {
@@ -2090,6 +2104,7 @@ namespace ps2_stubs
         uint32_t traceIdx = 0u;
         bool eofChanged = false;
         bool backpressured = false;
+        bool decoderFailed = false;
         {
             std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
             MpegPlaybackState &playback = getPlaybackState(mpegAddr);
@@ -2101,6 +2116,7 @@ namespace ps2_stubs
                 recordCdStreamBytesDemuxedUnlocked(consumed, completedMpegIds, eofChanged);
             }
             decodedCount = playback.decodedFrames.size();
+            decoderFailed = playback.decoderFailed;
             traceIdx = g_mpeg_stub_state.demuxPssTraceCount++;
         }
 
@@ -2116,7 +2132,7 @@ namespace ps2_stubs
             return;
         }
         const bool currentStreamCompleted = std::find(completedMpegIds.begin(), completedMpegIds.end(), mpegAddr) != completedMpegIds.end();
-        if (decodedCount != decodedBefore || eofChanged || currentStreamCompleted)
+        if (decodedCount != decodedBefore || eofChanged || currentStreamCompleted || decoderFailed)
         {
             runtime->eeScheduler().completeExternalWait(kMpegPictureWaitType, mpegAddr, KE_OK);
         }
@@ -2173,6 +2189,7 @@ namespace ps2_stubs
         uint32_t traceIdx = 0u;
         bool eofChanged = false;
         bool backpressured = false;
+        bool decoderFailed = false;
         {
             std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
             MpegPlaybackState &playback = getPlaybackState(mpegAddr);
@@ -2192,6 +2209,7 @@ namespace ps2_stubs
                 recordCdStreamBytesDemuxedUnlocked(consumed, completedMpegIds, eofChanged);
             }
             decodedCount = playback.decodedFrames.size();
+            decoderFailed = playback.decoderFailed;
             traceIdx = g_mpeg_stub_state.demuxRingTraceCount++;
         }
 
@@ -2209,7 +2227,7 @@ namespace ps2_stubs
             return;
         }
         const bool currentStreamCompleted = std::find(completedMpegIds.begin(), completedMpegIds.end(), mpegAddr) != completedMpegIds.end();
-        if (decodedCount != decodedBefore || eofChanged || currentStreamCompleted)
+        if (decodedCount != decodedBefore || eofChanged || currentStreamCompleted || decoderFailed)
         {
             runtime->eeScheduler().completeExternalWait(kMpegPictureWaitType, mpegAddr, KE_OK);
         }
@@ -2288,13 +2306,18 @@ namespace ps2_stubs
         uint32_t height = kStubMovieHeight;
         uint32_t frameCount = 0u;
         bool haveFrame = false;
+        bool movieEnded = false;
         MpegDecodedFrame frame;
         {
             std::unique_lock<std::mutex> lock(g_mpeg_stub_mutex);
             MpegPlaybackState &playback = getPlaybackState(mpegAddr);
+            // sawSequenceEnd is the only end-of-video signal a game streaming
+            // with plain sceCdRead can raise: the CD-stream EOF path belongs to
+            // sceCdSt*, and a PSS need not carry a program-end code.
             if (playback.decodedFrames.empty() &&
                 !g_mpeg_stub_state.currentCdStreamEofSeen &&
                 !playback.streamEnded &&
+                !playback.sawSequenceEnd &&
                 !playback.decoderFailed)
             {
                 if (g_mpeg_stub_state.getPictureWaitTraceCount < 32u)
@@ -2387,17 +2410,30 @@ namespace ps2_stubs
                 height = playback.height;
                 frameCount = playback.picturesServed;
             }
+
+            // Not on the call that serves the final frame -- the caller would
+            // tear the movie down before uploading it.
+            movieEnded = !haveFrame && playback.decodedFrames.empty() &&
+                         (playback.sawSequenceEnd || playback.streamEnded ||
+                          playback.decoderFailed || g_mpeg_stub_state.currentCdStreamEofSeen);
         }
 
         mpegGuestWrite32(rdram, mpegAddr + 0x00u, width);
         mpegGuestWrite32(rdram, mpegAddr + 0x04u, height);
-        mpegGuestWrite32(rdram, mpegAddr + 0x08u, frameCount);
+        // +0x08 gates the caller's VRAM upload: DQ8 uploads its movie buffers
+        // only while this reads zero, so a running picture counter here stops
+        // the movie updating after the very first frame.
+        mpegGuestWrite32(rdram, mpegAddr + 0x08u, haveFrame ? 0u : 1u);
 
         if (uint8_t *base = getMemPtr(rdram, mpegAddr))
         {
             const uint32_t iVar1 = *reinterpret_cast<uint32_t *>(base + 0x40);
             if (uint8_t *inner = getMemPtr(rdram, iVar1))
             {
+                // inner[0x00] is the end-of-stream flag the game polls; its
+                // sceMpegIsEnd equivalent is just `return **(mpeg+0x40)`.
+                // Without this the movie plays out and never terminates.
+                *reinterpret_cast<uint32_t *>(inner + 0x00) = movieEnded ? 1u : 0u;
                 *reinterpret_cast<uint32_t *>(inner + 0xb0) = 1;
                 *reinterpret_cast<uint32_t *>(inner + 0xd8) = (getRegU32(ctx, 5) & 0x0FFFFFFFu) | 0x20000000u;
                 *reinterpret_cast<uint32_t *>(inner + 0xe4) = getRegU32(ctx, 6);
@@ -2507,7 +2543,12 @@ namespace ps2_stubs
             std::lock_guard<std::mutex> lock(g_mpeg_stub_mutex);
             MpegPlaybackState &playback = getPlaybackState(param_1);
             MpegPlaybackState resetState = makeFreshPlaybackStatePreservingConfig(playback);
-            if (playback.streamEnded || playback.decoderFailed)
+            // Only meaningful while sceCdSt* drives the stream: appendPssBytes
+            // clears a carried streamEnded when the generation advances, and
+            // only notifyMpegCdStreamStart advances it. Carrying it for a game
+            // that streams with plain sceCdRead wedges every later movie.
+            const bool cdStreamDriven = g_mpeg_stub_state.cdStreamBytesProduced != 0u;
+            if (cdStreamDriven && (playback.streamEnded || playback.decoderFailed))
             {
                 resetState.sawInput = true;
                 resetState.streamEnded = true;

From 910a1182c40fbce41f580fab0d14a7b9d93fa2ff Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Thu, 20 Aug 2026 17:12:35 +0200
Subject: [PATCH 20/68] Recycle EE invocation stacks when a thread record goes
 away

m_invocationStackTops keys a 16 KiB stack per (thread, depth) and is only ever
find()-ed and emplace()-d, never erased. reserveAsyncCallbackStack behind it is
a bump allocator that walks m_asyncCallbackStackTop downwards with no free
path. So every guest thread that ever takes one invocation holds its stacks
forever, and the pool -- 0x01F00000 to 0x01F40000, exactly 16 slots -- only
ever drains.

DQ8 starts a fresh thread per movie and deletes the old one, so it hit the wall
on the second: "EE invocation stack space exhausted" the moment TAKA_N.MVI
opened. Instrumenting the allocation showed 14 of 16 slots held by seven live
threads before the second movie was even a factor, thread 12 alone holding four
at depths 0 through 3.

releaseInvocationStacks returns a thread's stacks to a free list when its
record is erased, from both destruction paths, and invocationStackTop pops that
list before falling back to the pool. reset() returns them too: it clears
m_threads and restarts ids at kFirstThreadId, which would otherwise strand
every existing entry permanently.

Recycling at record-erase time is safe. deleteThread requires the thread to be
Dormant already, and exitCurrent throws EeDispatcherTransfer immediately
afterwards, so unwinding completes before another invocation can claim the
slot. terminateThread deliberately does not release -- it only makes the thread
dormant and the id can be restarted.

Measured on DQ8: delete thread 9 and delete thread 13 both recycle, thread 13
reuses the freed slots, and the allocation that threw on every prior attempt
succeeds. Exhaustion count zero across a full boot.
---
 ps2xRuntime/include/runtime/ee_scheduler.h |  4 +++
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp | 40 +++++++++++++++++++++-
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/ps2xRuntime/include/runtime/ee_scheduler.h b/ps2xRuntime/include/runtime/ee_scheduler.h
index ad937be85..cb0c1d7f2 100644
--- a/ps2xRuntime/include/runtime/ee_scheduler.h
+++ b/ps2xRuntime/include/runtime/ee_scheduler.h
@@ -315,6 +315,7 @@ class EeScheduler
     [[noreturn]] void invokeCurrentSequence(std::vector<GuestInvocation> invocations);
     [[nodiscard]] bool hasInvocation(GuestInvocationKind kind, uint64_t tag) const;
     [[nodiscard]] uint32_t invocationStackTop();
+    void releaseInvocationStacks(int threadId);
 
     int addIrqHandler(bool dmac,
                       uint32_t cause,
@@ -442,6 +443,9 @@ class EeScheduler
     uint32_t m_gsVSyncCallbackGp = 0;
     uint32_t m_gsVSyncCallbackSp = 0;
     std::unordered_map<uint64_t, uint32_t> m_invocationStackTops;
+    // Freed by releaseInvocationStacks() when a thread record goes away; the
+    // underlying pool only bumps down and cannot hand memory back itself.
+    std::vector<uint32_t> m_freeInvocationStacks;
     std::atomic<uint64_t> m_nextDeadlineCycle{0};
 
     mutable std::mutex m_snapshotMutex;
diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index 3ecc929d1..e496576a1 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -87,6 +87,13 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     m_executorThread = std::this_thread::get_id();
     m_rdram = rdram;
     m_readyQueues = {};
+    // Thread ids restart here, so keyed stacks would otherwise be stranded:
+    // the pool below cannot reclaim them either.
+    for (const auto &[key, top] : m_invocationStackTops)
+    {
+        m_freeInvocationStacks.push_back(top);
+    }
+    m_invocationStackTops.clear();
     m_threads.clear();
     m_semaphores.clear();
     m_eventFlags.clear();
@@ -491,6 +498,7 @@ int EeScheduler::deleteThread(int id, uint32_t &ownedStack)
     {
         ownedStack = it->second.stack;
     }
+    releaseInvocationStacks(id);
     m_threads.erase(it);
     publishSnapshot();
     return KE_OK;
@@ -539,6 +547,7 @@ int EeScheduler::startThread(int id, uint32_t arg, const R5900Context &caller, b
     m_currentThreadId = 0;
     if (deleteThreadRecord && id != kMainThreadId)
     {
+        releaseInvocationStacks(id);
         m_threads.erase(id);
     }
     if (ownedStack != 0u)
@@ -1191,7 +1200,16 @@ uint32_t EeScheduler::invocationStackTop()
         return existing->second;
     }
     constexpr uint32_t kInvocationStackSize = 0x4000u;
-    const uint32_t top = m_runtime.reserveAsyncCallbackStack(kInvocationStackSize, 16u);
+    uint32_t top = 0u;
+    if (!m_freeInvocationStacks.empty())
+    {
+        top = m_freeInvocationStacks.back();
+        m_freeInvocationStacks.pop_back();
+    }
+    else
+    {
+        top = m_runtime.reserveAsyncCallbackStack(kInvocationStackSize, 16u);
+    }
     if (top == 0u)
     {
         throw std::runtime_error("EE invocation stack space exhausted");
@@ -1200,6 +1218,26 @@ uint32_t EeScheduler::invocationStackTop()
     return top;
 }
 
+// Stacks are keyed per (thread, depth) and the pool only bumps down, so without
+// this every thread that ever took an invocation holds 16 KiB forever -- DQ8
+// starts one thread per movie and drained all 16 slots on the second one.
+void EeScheduler::releaseInvocationStacks(int threadId)
+{
+    const uint64_t prefix = static_cast<uint64_t>(static_cast<uint32_t>(threadId)) << 32u;
+    for (auto it = m_invocationStackTops.begin(); it != m_invocationStackTops.end();)
+    {
+        if ((it->first & 0xFFFFFFFF00000000ull) == prefix)
+        {
+            m_freeInvocationStacks.push_back(it->second);
+            it = m_invocationStackTops.erase(it);
+        }
+        else
+        {
+            ++it;
+        }
+    }
+}
+
 int EeScheduler::addIrqHandler(bool dmac,
                                uint32_t cause,
                                uint32_t handler,

From 266e367548b315fec164ad2c109618f665c9e854 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Sat, 22 Aug 2026 17:34:01 +0200
Subject: [PATCH 21/68] Make presentation pitch-explicit, and let a backend
 present natively

PresentationFrame assumed the software backend's fixed 640-wide staging
buffer: callers de-strided by that constant, so a backend returning tightly
packed rows -- or rows at any other width -- was misread as skewed.

Adds rowPitchBytes, and a GSPresentationMode distinguishing host pixels from a
backend that presented through its own swapchain and has no pixel payload to
copy. GS::copyLatchedHostPresentationFrame now uses the frame's own pitch and
refuses one narrower than its width rather than reading past the end.

Needed by a hardware backend, which presents at its own internal resolution:
a 4x render target hands back 2048x1792 rows, not 640-strided ones.
---
 ps2xRuntime/include/runtime/gs/gs_frontend.h |  1 +
 ps2xRuntime/include/runtime/gs/gs_types.h    | 37 +++++++++++++++++-
 ps2xRuntime/src/lib/gs/gs_cpu_backend.cpp    |  1 +
 ps2xRuntime/src/lib/gs/gs_frontend.cpp       | 40 +++++++++++++++-----
 4 files changed, 69 insertions(+), 10 deletions(-)

diff --git a/ps2xRuntime/include/runtime/gs/gs_frontend.h b/ps2xRuntime/include/runtime/gs/gs_frontend.h
index 4c3f6410a..b754133d5 100644
--- a/ps2xRuntime/include/runtime/gs/gs_frontend.h
+++ b/ps2xRuntime/include/runtime/gs/gs_frontend.h
@@ -225,6 +225,7 @@ class GS
     std::vector<uint8_t> m_hostPresentationFrame;
     uint32_t m_hostPresentationWidth = 0;
     uint32_t m_hostPresentationHeight = 0;
+    uint32_t m_hostPresentationRowPitchBytes = 0;
     uint32_t m_hostPresentationDisplayFbp = 0;
     uint32_t m_hostPresentationSourceFbp = 0;
     bool m_hostPresentationUsedPreferred = false;
diff --git a/ps2xRuntime/include/runtime/gs/gs_types.h b/ps2xRuntime/include/runtime/gs/gs_types.h
index 836a3ff49..0e0b79b1d 100644
--- a/ps2xRuntime/include/runtime/gs/gs_types.h
+++ b/ps2xRuntime/include/runtime/gs/gs_types.h
@@ -3,6 +3,7 @@
 #include <cstddef>
 #include <array>
 #include <cstdint>
+#include <limits>
 #include <vector>
 
 enum GSPrimType : uint8_t
@@ -290,18 +291,52 @@ struct GSPresentationRequest
     bool hasPreferredSource = false;
 };
 
+enum class GSPresentationMode : uint8_t
+{
+    // The backend returned host-readable RGBA8 pixels. rowPitchBytes describes
+    // their layout and may be wider than width * 4.
+    HostPixels,
+    // The backend presented through its own native swapchain. There is no host
+    // pixel payload to copy through the legacy presentation path.
+    BackendNative,
+};
+
 struct PresentationFrame
 {
     std::vector<uint8_t> pixels;
     uint32_t width = 0;
     uint32_t height = 0;
+    uint32_t rowPitchBytes = 0;
     uint32_t displayFbp = 0;
     uint32_t sourceFbp = 0;
     bool usedPreferred = false;
+    GSPresentationMode mode = GSPresentationMode::HostPixels;
+
+    bool HasHostPixels() const
+    {
+        if (mode != GSPresentationMode::HostPixels || width == 0u || height == 0u)
+            return false;
+
+        if (static_cast<size_t>(width) > std::numeric_limits<size_t>::max() / 4u)
+            return false;
+        const size_t packedRowBytes = static_cast<size_t>(width) * 4u;
+        const size_t sourceRowBytes = rowPitchBytes != 0u ? rowPitchBytes : packedRowBytes;
+        if (sourceRowBytes < packedRowBytes)
+            return false;
+
+        if (height > 1u &&
+            sourceRowBytes > (std::numeric_limits<size_t>::max() - packedRowBytes) /
+                                 static_cast<size_t>(height - 1u))
+            return false;
+        const size_t requiredBytes = sourceRowBytes * static_cast<size_t>(height - 1u) + packedRowBytes;
+        return pixels.size() >= requiredBytes;
+    }
 
     explicit operator bool() const
     {
-        return !pixels.empty() && width != 0u && height != 0u;
+        if (width == 0u || height == 0u)
+            return false;
+        return mode == GSPresentationMode::BackendNative || HasHostPixels();
     }
 };
 
diff --git a/ps2xRuntime/src/lib/gs/gs_cpu_backend.cpp b/ps2xRuntime/src/lib/gs/gs_cpu_backend.cpp
index 329f3da01..15ef50bcd 100644
--- a/ps2xRuntime/src/lib/gs/gs_cpu_backend.cpp
+++ b/ps2xRuntime/src/lib/gs/gs_cpu_backend.cpp
@@ -1759,6 +1759,7 @@ PresentationFrame GSCpuBackend::Present(const GSPresentationRequest &request)
 PresentationFrame GSCpuBackend::PresentFromLocalMemory(const GSPresentationRequest &request)
 {
     PresentationFrame result{};
+    result.rowPitchBytes = kHostFrameWidth * 4u;
     const GSPmodeState pmode = decodePmode(request.pmode);
     const GSSmode2State smode2 = decodeSMode2(request.smode2);
     // SMODE2 FFMD=1 (FRAME) reads a half-height buffer whole once per field, so the
diff --git a/ps2xRuntime/src/lib/gs/gs_frontend.cpp b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
index fd5a90d28..645199a4c 100644
--- a/ps2xRuntime/src/lib/gs/gs_frontend.cpp
+++ b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
@@ -8,12 +8,11 @@
 #include <cstdio>
 #include <cstring>
 #include <iostream>
+#include <limits>
 #include <sstream>
 
 namespace
 {
-    static constexpr uint32_t kHostFrameWidth = 640u;
-
     GSPrimReg decodePrimRegister(uint64_t value)
     {
         GSPrimReg prim{};
@@ -170,6 +169,7 @@ void GS::reset()
         m_hostPresentationFrame.clear();
         m_hostPresentationWidth = 0u;
         m_hostPresentationHeight = 0u;
+        m_hostPresentationRowPitchBytes = 0u;
         m_hostPresentationDisplayFbp = 0u;
         m_hostPresentationSourceFbp = 0u;
         m_hostPresentationUsedPreferred = false;
@@ -535,6 +535,7 @@ void GS::latchHostPresentationFrame()
             m_hostPresentationFrame.clear();
             m_hasHostPresentationFrame = false;
             m_hostPresentationWidth = m_hostPresentationHeight = 0u;
+            m_hostPresentationRowPitchBytes = 0u;
             return;
         }
         request = buildPresentationRequestUnlocked();
@@ -551,24 +552,32 @@ void GS::latchHostPresentationFrame()
         }
     }
 
-    const bool hasFrame = static_cast<bool>(frame);
+    const bool presented = static_cast<bool>(frame);
+    const bool hasHostFrame = presented && frame.mode == GSPresentationMode::HostPixels;
     const uint32_t displayFbp = frame.displayFbp;
     const uint32_t sourceFbp = frame.sourceFbp;
     const uint32_t width = frame.width;
     const uint32_t height = frame.height;
+    uint32_t rowPitchBytes = frame.rowPitchBytes;
+    if (rowPitchBytes == 0u && width <= std::numeric_limits<uint32_t>::max() / 4u)
+        rowPitchBytes = width * 4u;
     const bool usedPreferred = frame.usedPreferred;
     {
         std::lock_guard<std::mutex> presentationLock(m_presentationMutex);
-        m_hostPresentationFrame = std::move(frame.pixels);
-        m_hostPresentationWidth = width;
-        m_hostPresentationHeight = height;
+        if (hasHostFrame)
+            m_hostPresentationFrame = std::move(frame.pixels);
+        else
+            m_hostPresentationFrame.clear();
+        m_hostPresentationWidth = hasHostFrame ? width : 0u;
+        m_hostPresentationHeight = hasHostFrame ? height : 0u;
+        m_hostPresentationRowPitchBytes = hasHostFrame ? rowPitchBytes : 0u;
         m_hostPresentationDisplayFbp = displayFbp;
         m_hostPresentationSourceFbp = sourceFbp;
         m_hostPresentationUsedPreferred = usedPreferred;
-        m_hasHostPresentationFrame = hasFrame;
+        m_hasHostPresentationFrame = hasHostFrame;
     }
 
-    if (hasFrame)
+    if (presented)
     {
         std::lock_guard<std::recursive_mutex> lock(m_stateMutex);
         recordPresentDebugEventUnlocked(displayFbp, sourceFbp, width, height, usedPreferred);
@@ -610,7 +619,20 @@ bool GS::copyLatchedHostPresentationFrame(std::vector<uint8_t> &outPixels,
     outPixels.resize(packedRowBytes * static_cast<size_t>(outHeight));
     if (outWidth != 0u && outHeight != 0u)
     {
-        const size_t sourceRowBytes = static_cast<size_t>(kHostFrameWidth) * 4u;
+        const size_t sourceRowBytes = m_hostPresentationRowPitchBytes;
+        if (sourceRowBytes < packedRowBytes)
+        {
+            outPixels.clear();
+            outWidth = 0u;
+            outHeight = 0u;
+            if (outDisplayFbp)
+                *outDisplayFbp = 0u;
+            if (outSourceFbp)
+                *outSourceFbp = 0u;
+            if (outUsedPreferred)
+                *outUsedPreferred = false;
+            return false;
+        }
         for (uint32_t y = 0; y < outHeight; ++y)
         {
             const size_t srcOffset = static_cast<size_t>(y) * sourceRowBytes;

From 438d05edb3e988f102dd5dd86a2e3641fc173759 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Sat, 22 Aug 2026 21:56:21 +0200
Subject: [PATCH 22/68] Let a raster backend own the window and present itself

PresentationFrame already had a BackendNative mode; nothing could reach it,
because every frame went out through raylib. The runtime now takes an external
presenter: with one installed it opens no window, creates no framebuffer
texture, and does no drawing. It still latches each frame -- that is the call
that reaches the backend's Present() -- and then hands control to the presenter
to service its window.

Between frames it sleeps briefly instead of spinning. raylib's frame limiter
used to block in EndDrawing(); without a replacement the loop burns a core the
EE thread wants.

Audio moves out of the windowed branch. It has no window and an external
presenter does not replace it, so initialising it only in the raylib path left
the audio backend permanently not-ready.

ps2PadPublishHostState() lets a host that is not raylib feed the same latching
path, so press edges between two guest polls still register.
---
 ps2xRuntime/include/ps2_runtime.h          | 13 ++++
 ps2xRuntime/include/runtime/ps2_pad_host.h |  7 ++
 ps2xRuntime/src/lib/gs/gs_frontend.cpp     | 23 ++++++
 ps2xRuntime/src/lib/ps2_pad.cpp            | 35 +++++++++
 ps2xRuntime/src/lib/ps2_runtime.cpp        | 83 ++++++++++++++++++----
 5 files changed, 147 insertions(+), 14 deletions(-)

diff --git a/ps2xRuntime/include/ps2_runtime.h b/ps2xRuntime/include/ps2_runtime.h
index 15b106c98..44c10b4df 100644
--- a/ps2xRuntime/include/ps2_runtime.h
+++ b/ps2xRuntime/include/ps2_runtime.h
@@ -319,6 +319,17 @@ class PS2Runtime
                              DebugUiCallback shutdownCallback,
                              void *userData);
 
+    // A host that owns its own window and shows frames itself. When one is
+    // installed the runtime opens no window of its own and does no drawing:
+    // the raster backend has already presented by the time Present() returns,
+    // and this is called once per frame to service the window. Returning false
+    // asks the runtime to stop, the way a close button would.
+    //
+    // Set before initialize(), which is where the built-in window is created.
+    using FramePumpCallback = bool (*)(void *userData);
+    void setExternalPresenter(FramePumpCallback pump, void *userData);
+    [[nodiscard]] bool hasExternalPresenter() const { return m_framePump != nullptr; }
+
     using RecompiledFunction = void (*)(uint8_t *, R5900Context *, PS2Runtime *);
 
     enum class GuestBranchKind
@@ -553,6 +564,8 @@ class PS2Runtime
     std::atomic<uint32_t> m_missingFunctionPolicy{static_cast<uint32_t>(MissingFunctionPolicy::ContinueToTarget)};
     std::atomic<bool> m_missingFunctionReported{false};
     std::atomic<bool> m_stopRequested{false};
+    FramePumpCallback m_framePump = nullptr;
+    void *m_framePumpUserData = nullptr;
     DebugUiCallback m_debugUiInitCallback = nullptr;
     DebugUiCallback m_debugUiDrawCallback = nullptr;
     DebugUiCallback m_debugUiShutdownCallback = nullptr;
diff --git a/ps2xRuntime/include/runtime/ps2_pad_host.h b/ps2xRuntime/include/runtime/ps2_pad_host.h
index b7652de89..74ed9edbf 100644
--- a/ps2xRuntime/include/runtime/ps2_pad_host.h
+++ b/ps2xRuntime/include/runtime/ps2_pad_host.h
@@ -1,10 +1,17 @@
 #ifndef PS2_PAD_HOST_H
 #define PS2_PAD_HOST_H
 
+#include <cstdint>
+
 // Render-thread half of the pad backend. Samples raylib input once per presented
 // frame and latches press edges so a tap between two guest polls still registers.
 // Declared here rather than on PSPadBackend so the recompiled corpus, which
 // includes ps2_pad.h through ps2_runtime.h, does not rebuild for input changes.
 void ps2PadPollHost();
 
+// The same latching, driven by a host that is not raylib. A backend owning its
+// own window samples input itself and publishes it here, in the pad report's
+// button encoding, with `pressed` carrying edges seen since the last call.
+void ps2PadPublishHostState(uint32_t held, uint32_t pressed, uint32_t sticks);
+
 #endif
diff --git a/ps2xRuntime/src/lib/gs/gs_frontend.cpp b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
index 645199a4c..fc27b7be1 100644
--- a/ps2xRuntime/src/lib/gs/gs_frontend.cpp
+++ b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
@@ -4,6 +4,7 @@
 #include "runtime/ps2_memory.h"
 #include <atomic>
 #include <algorithm>
+#include <chrono>
 #include <cmath>
 #include <cstdio>
 #include <cstring>
@@ -660,8 +661,30 @@ bool GS::copyLatchedHostPresentationFrame(std::vector<uint8_t> &outPixels,
     return true;
 }
 
+// Debug accounting: total time decoding GIF packets, and how many arrived.
+// A backend can subtract its own time from this to see what packet decoding
+// costs on its own, which is the difference between "the renderer is slow" and
+// "the game is sending an enormous number of tiny packets".
+std::atomic<uint64_t> g_gsFrontendPacketNanos{0};
+std::atomic<uint64_t> g_gsFrontendPacketCount{0};
+
 void GS::processGIFPacket(const uint8_t *data, uint32_t sizeBytes)
 {
+    const auto packetStart = std::chrono::steady_clock::now();
+    struct PacketTimer
+    {
+        std::chrono::steady_clock::time_point start;
+        ~PacketTimer()
+        {
+            g_gsFrontendPacketNanos.fetch_add(
+                static_cast<uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(
+                                          std::chrono::steady_clock::now() - start)
+                                          .count()),
+                std::memory_order_relaxed);
+            g_gsFrontendPacketCount.fetch_add(1, std::memory_order_relaxed);
+        }
+    } packetTimer{packetStart};
+
     std::lock_guard<std::recursive_mutex> lock(m_stateMutex);
     if (!data || sizeBytes < 16 || !m_backend)
         return;
diff --git a/ps2xRuntime/src/lib/ps2_pad.cpp b/ps2xRuntime/src/lib/ps2_pad.cpp
index e5a26e5ca..db37b887e 100644
--- a/ps2xRuntime/src/lib/ps2_pad.cpp
+++ b/ps2xRuntime/src/lib/ps2_pad.cpp
@@ -165,6 +165,41 @@ namespace
     }
 }
 
+namespace
+{
+    // Shared tail of both host paths: publish held state and latch edges long
+    // enough that a tap between two guest polls is not lost.
+    void publishHostState(uint32_t held, uint32_t pressed, uint32_t sticks)
+    {
+        g_held.store(held);
+        g_sticks.store(sticks);
+
+        const uint64_t now = nowMs();
+        if (pressed != 0u)
+        {
+            if (g_latched.fetch_or(pressed) == 0u)
+            {
+                g_latchStampMs.store(now);
+            }
+        }
+        else
+        {
+            const uint32_t stale = g_latched.load();
+            if (stale != 0u && (now - g_latchStampMs.load()) > kLatchTimeoutMs)
+            {
+                g_latched.fetch_and(~stale);
+            }
+        }
+
+        g_hostPolled.store(true);
+    }
+}
+
+void ps2PadPublishHostState(uint32_t held, uint32_t pressed, uint32_t sticks)
+{
+    publishHostState(held, pressed, sticks);
+}
+
 void ps2PadPollHost()
 {
     if (!IsWindowReady())
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index 345a30b51..f50afc0cf 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -522,6 +522,12 @@ PS2Runtime::PS2Runtime()
     m_asyncCallbackStackTop = PS2_RAM_SIZE;
 }
 
+void PS2Runtime::setExternalPresenter(FramePumpCallback pump, void *userData)
+{
+    m_framePump = pump;
+    m_framePumpUserData = userData;
+}
+
 void PS2Runtime::setDebugUiCallbacks(DebugUiCallback initCallback,
                                      DebugUiCallback drawCallback,
                                      DebugUiCallback shutdownCallback,
@@ -721,18 +727,29 @@ bool PS2Runtime::initialize(const char *title)
             return false;
         }
 #endif
+        // An external presenter owns the window, so opening one here would put
+        // a second, empty window on screen and pay for its swap every frame.
+        if (!hasExternalPresenter())
+        {
 #if defined(PLATFORM_VITA)
-        InitWindow(HOST_WINDOW_WIDTH, HOST_WINDOW_HEIGHT, title); // raylib vita does not support audio
+            InitWindow(HOST_WINDOW_WIDTH, HOST_WINDOW_HEIGHT, title); // raylib vita does not support audio
 #else
-        SetConfigFlags(FLAG_WINDOW_RESIZABLE);
-        InitWindow(HOST_WINDOW_WIDTH, HOST_WINDOW_HEIGHT, title);
-        // Escape is bound to Circle; without this raylib also closes on it.
-        SetExitKey(KEY_NULL);
-        applyDefaultWindowScale();
+            SetConfigFlags(FLAG_WINDOW_RESIZABLE);
+            InitWindow(HOST_WINDOW_WIDTH, HOST_WINDOW_HEIGHT, title);
+            // Escape is bound to Circle; without this raylib also closes on it.
+            SetExitKey(KEY_NULL);
+            applyDefaultWindowScale();
+#endif
+            SetTargetFPS(60);
+        }
+#if !defined(PLATFORM_VITA)
+        // Audio is not presentation: it has no window and an external presenter
+        // does not replace it. Initialising it only in the built-in path left
+        // the audio backend permanently not-ready, which anything waiting on
+        // sound never recovers from.
         InitAudioDevice();
         m_audioBackend.setAudioReady(IsAudioDeviceReady());
 #endif
-        SetTargetFPS(60);
         if (m_debugUiInitCallback)
         {
             m_debugUiInitCallback(*this, m_debugUiUserData);
@@ -2414,12 +2431,17 @@ void PS2Runtime::run()
 
     RUNTIME_LOG("Starting execution at address 0x" << std::hex << m_cpuContext.pc << std::dec);
 
-    // A blank image to use as a framebuffer
-    Image blank = GenImageColor(FB_WIDTH, FB_HEIGHT, BLANK);
-    Texture2D frameTex = LoadTextureFromImage(blank);
-    UnloadImage(blank);
+    // A blank image to use as a framebuffer. Not needed when something else
+    // owns the window -- there is no GL context to create a texture in.
+    Texture2D frameTex{};
     int frameTexFilter = TEXTURE_FILTER_POINT;
-    SetTextureFilter(frameTex, frameTexFilter);
+    if (!hasExternalPresenter())
+    {
+        Image blank = GenImageColor(FB_WIDTH, FB_HEIGHT, BLANK);
+        frameTex = LoadTextureFromImage(blank);
+        UnloadImage(blank);
+        SetTextureFilter(frameTex, frameTexFilter);
+    }
 
     std::atomic<bool> gameThreadFinished{false};
 
@@ -2478,6 +2500,36 @@ void PS2Runtime::run()
                                                << std::endl);
             }
         });
+        // With an external presenter the backend draws to its own swapchain,
+        // so the frame still has to be latched -- that is what calls into the
+        // backend's Present() -- but nothing is uploaded or drawn here.
+        if (m_framePump)
+        {
+            static uint64_t s_lastNativeTick = std::numeric_limits<uint64_t>::max();
+            const uint64_t currentTick = eeScheduler().currentVSyncTick();
+            const bool newFrame = currentTick != s_lastNativeTick;
+            if (newFrame)
+            {
+                gs().latchHostPresentationFrame();
+                s_lastNativeTick = currentTick;
+            }
+            else
+            {
+                // Nothing new to show. Without this the loop spins a core flat
+                // out waiting for the guest, which is a core the EE thread
+                // wants; the raylib path got the same effect from its frame
+                // limiter blocking in EndDrawing().
+                std::this_thread::sleep_for(std::chrono::microseconds(250));
+            }
+            if (!m_framePump(m_framePumpUserData))
+            {
+                RUNTIME_LOG("[run] external presenter requested stop");
+                requestStop();
+                break;
+            }
+            continue;
+        }
+
         uint32_t presentWidth = FB_WIDTH;
         uint32_t presentHeight = DEFAULT_DISPLAY_HEIGHT;
         UploadFrame(frameTex, this, presentWidth, presentHeight);
@@ -2535,8 +2587,11 @@ void PS2Runtime::run()
         m_debugUiShutdownCallback(*this, m_debugUiUserData);
         m_debugUiInitialized = false;
     }
-    UnloadTexture(frameTex);
-    CloseWindow();
+    if (!hasExternalPresenter())
+    {
+        UnloadTexture(frameTex);
+        CloseWindow();
+    }
 
     RUNTIME_LOG("[run] exiting loop");
 }

From 3ae580597d6965ede4796e7d1952b0afcf1dcba8 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Sat, 22 Aug 2026 23:43:41 +0200
Subject: [PATCH 23/68] Stop the guest busy-waiting when MPEG demux is
 backpressured

mpegDemuxBackpressured() returns true once the decoder is 8 pictures ahead, and
the demux stubs then returned 0 consumed and nothing else. DQ8's producer loop
reads that as "not now" and asks again immediately, so the movie thread span:
670,171 calls to sceMpegDemuxPssRing per 30 presented frames -- about 22,300
per frame -- against 0.5 sceMpegGetPicture calls per frame of actual work.

That was the movie's frame time. Measured with the graphics side fully
accounted for: the GS backend was 6% of wall, GIF packet decode ~0%, and the
896 tile transfers per frame cost almost nothing.

Both demux entry points now rotate the ready queue before returning. This is
deliberately a yield and not a park: the comment on mpegDemuxBackpressured
warns that parking the producer can leave a consumer asleep with nobody to wake
it, which is real -- Code Veronica wakes its video thread before every demux
call. Rotating the queue lets the consumer run and comes back, so the spin
becomes a scheduling point without changing who wakes whom.

DQ8's attract movie goes from 0.8 fps to 9.1, and demux calls per frame from
~22,300 to ~1,025.

Still 1,025 spins per frame, so this is a large improvement rather than a cure.
The remaining fix is a real producer/consumer handshake -- park the producer on
space-available and wake it from sceMpegGetPicture -- which needs care for
exactly the reason the yield was chosen here.

Also adds timers on sceMpegGetPicture, writeDecodedFrameToGuest and the demux
entry points, and on the GIF frontend's packet and native-image-upload paths.
None of this was visible before; the demux call count is what identified the
bug, and it was only findable because the graphics side had already been
measured and eliminated.
---
 ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp | 49 +++++++++++++++++++++++
 ps2xRuntime/src/lib/gs/gs_frontend.cpp    | 18 ++++++++-
 ps2xRuntime/src/lib/ps2_runtime.cpp       | 12 +++++-
 3 files changed, 76 insertions(+), 3 deletions(-)

diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
index 4e2abd912..d145eb86e 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
@@ -16,11 +16,44 @@ extern "C"
 }
 #endif
 
+#include <atomic>
+#include <chrono>
 #include <deque>
 #include <memory>
 
 #include "Syscalls/Helpers/State.h"
 
+// Debug accounting for the movie path, read by whichever backend reports stats.
+// A movie frame arrives as ~900 tile transfers, but those turned out to cost
+// almost nothing; these say what the rest of the frame is doing.
+std::atomic<uint64_t> g_mpegGetPictureNanos{0};
+std::atomic<uint64_t> g_mpegGetPictureCount{0};
+std::atomic<uint64_t> g_mpegWriteFrameNanos{0};
+std::atomic<uint64_t> g_mpegWriteFrameCount{0};
+std::atomic<uint64_t> g_mpegDemuxNanos{0};
+std::atomic<uint64_t> g_mpegDemuxCount{0};
+
+namespace
+{
+    struct MpegScopedTimer
+    {
+        std::atomic<uint64_t> &sink;
+        std::atomic<uint64_t> &counter;
+        std::chrono::steady_clock::time_point start;
+        MpegScopedTimer(std::atomic<uint64_t> &nanos, std::atomic<uint64_t> &count)
+            : sink(nanos), counter(count), start(std::chrono::steady_clock::now()) {}
+        ~MpegScopedTimer()
+        {
+            sink.fetch_add(static_cast<uint64_t>(
+                               std::chrono::duration_cast<std::chrono::nanoseconds>(
+                                   std::chrono::steady_clock::now() - start)
+                                   .count()),
+                           std::memory_order_relaxed);
+            counter.fetch_add(1, std::memory_order_relaxed);
+        }
+    };
+}
+
 namespace ps2_stubs
 {
     namespace
@@ -1706,6 +1739,7 @@ namespace ps2_stubs
             {
                 return;
             }
+            MpegScopedTimer timer(g_mpegWriteFrameNanos, g_mpegWriteFrameCount);
 
             const uint32_t width = static_cast<uint32_t>(frame.width);
             const uint32_t height = static_cast<uint32_t>(frame.height);
@@ -2128,6 +2162,9 @@ namespace ps2_stubs
                     std::cerr << "[MPEG:DemuxPss:BACKPRESSURE] mpeg=0x" << std::hex << mpegAddr << std::dec << " decoded=" << decodedCount << std::endl;
                 });
             }
+            // Same reasoning as the ring variant: yield so the consumer can
+            // drain a picture, rather than letting the producer spin.
+            runtime->eeScheduler().rotateReadyQueue(0, false);
             setReturnS32(ctx, 0);
             return;
         }
@@ -2163,6 +2200,7 @@ namespace ps2_stubs
 
     void sceMpegDemuxPssRing(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
+        MpegScopedTimer timer(g_mpegDemuxNanos, g_mpegDemuxCount);
         static std::atomic<uint32_t> s_demuxRingEntryCount{0u};
         const uint32_t entryIdx = s_demuxRingEntryCount.fetch_add(1u, std::memory_order_relaxed);
         if (entryIdx < 4u)
@@ -2223,6 +2261,16 @@ namespace ps2_stubs
                               << " avail=" << availableBytes << std::endl;
                 });
             }
+            // Returning 0 consumed tells the producer "not now", and its loop
+            // asks again immediately -- DQ8 called this 22,000 times per
+            // presented frame, which is where the movie's frame time went.
+            //
+            // Yield rather than park. Parking is what the comment on
+            // mpegDemuxBackpressured warns against: the consumer may be asleep
+            // waiting for this very thread to wake it. Rotating the ready queue
+            // just lets the consumer run and comes back, so the spin becomes a
+            // scheduling point without changing who wakes whom.
+            runtime->eeScheduler().rotateReadyQueue(0, false);
             setReturnS32(ctx, 0);
             return;
         }
@@ -2300,6 +2348,7 @@ namespace ps2_stubs
 
     void sceMpegGetPicture(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
+        MpegScopedTimer timer(g_mpegGetPictureNanos, g_mpegGetPictureCount);
         const uint32_t mpegAddr = getRegU32(ctx, 4);
         const uint32_t imageAddr = getRegU32(ctx, 5);
         uint32_t width = kStubMovieWidth;
diff --git a/ps2xRuntime/src/lib/gs/gs_frontend.cpp b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
index fc27b7be1..6d99b04c9 100644
--- a/ps2xRuntime/src/lib/gs/gs_frontend.cpp
+++ b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
@@ -667,6 +667,11 @@ bool GS::copyLatchedHostPresentationFrame(std::vector<uint8_t> &outPixels,
 // "the game is sending an enormous number of tiny packets".
 std::atomic<uint64_t> g_gsFrontendPacketNanos{0};
 std::atomic<uint64_t> g_gsFrontendPacketCount{0};
+// The same for the native image-upload fast path, which bypasses
+// processGIFPacket entirely -- DQ8's movie tiles arrive this way, one DMA
+// chain per 16x16 tile, so without a separate counter they are invisible.
+std::atomic<uint64_t> g_gsUploadNativeNanos{0};
+std::atomic<uint64_t> g_gsUploadNativeCount{0};
 
 void GS::processGIFPacket(const uint8_t *data, uint32_t sizeBytes)
 {
@@ -828,8 +833,17 @@ void GS::uploadImageNative(uint64_t bitbltbuf,
                            const uint8_t *data,
                            uint32_t sizeBytes)
 {
-    std::lock_guard<std::recursive_mutex> lock(m_stateMutex);
-    uploadImageNativeUnlocked(bitbltbuf, trxpos, trxreg, trxdir, data, sizeBytes);
+    const auto start = std::chrono::steady_clock::now();
+    {
+        std::lock_guard<std::recursive_mutex> lock(m_stateMutex);
+        uploadImageNativeUnlocked(bitbltbuf, trxpos, trxreg, trxdir, data, sizeBytes);
+    }
+    g_gsUploadNativeNanos.fetch_add(
+        static_cast<uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(
+                                  std::chrono::steady_clock::now() - start)
+                                  .count()),
+        std::memory_order_relaxed);
+    g_gsUploadNativeCount.fetch_add(1, std::memory_order_relaxed);
 }
 
 void GS::uploadImageNativeUnlocked(uint64_t bitbltbuf,
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index f50afc0cf..670587616 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -2519,7 +2519,17 @@ void PS2Runtime::run()
                 // out waiting for the guest, which is a core the EE thread
                 // wants; the raylib path got the same effect from its frame
                 // limiter blocking in EndDrawing().
-                std::this_thread::sleep_for(std::chrono::microseconds(250));
+                //
+                // Tunable because how often this thread wakes changes the
+                // interleaving the EE thread sees, and the memory-card boot
+                // race is sensitive to exactly that
+                // (docs/notes/memory-card-boot-race.md).
+                static const int idleMicros = [] {
+                    const char *value = std::getenv("DQ8_PRESENT_IDLE_US");
+                    const int parsed = value ? std::atoi(value) : 0;
+                    return parsed > 0 ? parsed : 1000;
+                }();
+                std::this_thread::sleep_for(std::chrono::microseconds(idleMicros));
             }
             if (!m_framePump(m_framePumpUserData))
             {

From e3f7eb29b98eb5baf45fdca22ec877973bf63499 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Sun, 23 Aug 2026 00:36:29 +0200
Subject: [PATCH 24/68] Complete the demux yield protocol, and stop crashing on
 every movie

The previous commit called rotateReadyQueue from the demux stub and returned
normally. That clears the current thread and requests a reschedule, so the next
syscall reached bindMainContextForSyscall with no thread running and tripped
its assert -- the game aborted on every movie. transferIfRequested must follow,
which is what the RotateThreadReadyQueue syscall does, and the return value has
to be set before it because the transfer throws.

Verified: 0 aborts across a 700-second run that plays the attract movie
through, 582 pictures served.

Also tried and reverted: parking the producer on a space-available wait and
completing it from sceMpegGetPicture. That deadlocks -- 4 pictures served
instead of 658 -- which is exactly what the comment on mpegDemuxBackpressured
predicts. Both the attempt and its result are recorded in
docs/notes/movie-decode.md so it is not tried a third time.

Honest numbers: 0.8 fps before, 1.2-1.7 fps now, demux calls halved from 7.6M
to 3.4M over the run. That is an improvement, not a fix. Demux is now 6% of
wall and the backend 6%; the other ~88% is still unattributed, and the
principled next step -- buffering PSS bytes and decoding lazily so the producer
is never refused -- has not been attempted.
---
 ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp | 26 +++++++++++++++--------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
index d145eb86e..b7114b757 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
@@ -2162,10 +2162,10 @@ namespace ps2_stubs
                     std::cerr << "[MPEG:DemuxPss:BACKPRESSURE] mpeg=0x" << std::hex << mpegAddr << std::dec << " decoded=" << decodedCount << std::endl;
                 });
             }
-            // Same reasoning as the ring variant: yield so the consumer can
-            // drain a picture, rather than letting the producer spin.
-            runtime->eeScheduler().rotateReadyQueue(0, false);
+            // Same reasoning and the same order as the ring variant.
             setReturnS32(ctx, 0);
+            runtime->eeScheduler().rotateReadyQueue(0, false);
+            runtime->eeScheduler().transferIfRequested(false);
             return;
         }
         const bool currentStreamCompleted = std::find(completedMpegIds.begin(), completedMpegIds.end(), mpegAddr) != completedMpegIds.end();
@@ -2265,13 +2265,21 @@ namespace ps2_stubs
             // asks again immediately -- DQ8 called this 22,000 times per
             // presented frame, which is where the movie's frame time went.
             //
-            // Yield rather than park. Parking is what the comment on
-            // mpegDemuxBackpressured warns against: the consumer may be asleep
-            // waiting for this very thread to wake it. Rotating the ready queue
-            // just lets the consumer run and comes back, so the spin becomes a
-            // scheduling point without changing who wakes whom.
-            runtime->eeScheduler().rotateReadyQueue(0, false);
+            // Yield, do not park. Parking the producer on a space-available
+            // wait and waking it from sceMpegGetPicture was tried and
+            // deadlocks the movie: DQ8 served 4 pictures instead of 658. That
+            // is exactly what the comment on mpegDemuxBackpressured predicts,
+            // so it is recorded here rather than left to be rediscovered.
+            //
+            // The return value has to be set before the transfer, and the
+            // transfer is not optional: rotateReadyQueue clears the current
+            // thread and asks for a reschedule, so returning normally after it
+            // leaves the scheduler with no running thread and trips
+            // bindMainContextForSyscall's assert on the next syscall. Same
+            // order as the RotateThreadReadyQueue syscall.
             setReturnS32(ctx, 0);
+            runtime->eeScheduler().rotateReadyQueue(0, false);
+            runtime->eeScheduler().transferIfRequested(false);
             return;
         }
         const bool currentStreamCompleted = std::find(completedMpegIds.begin(), completedMpegIds.end(), mpegAddr) != completedMpegIds.end();

From 052915dfd77ff953b9196d15d4e96e8503483d97 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Sun, 23 Aug 2026 02:41:26 +0200
Subject: [PATCH 25/68] Stop paying for the movie's yields: lazy snapshot, lazy
 decode, cheap event pump

DQ8's movie producer thread is a spin loop, and correctly so -- it feeds audio
and waits for its CD ring, ~5,150 iterations per movie frame, which is about
what a real 294 MHz EE would manage. Our cost per iteration was the problem.

Three measured costs, each removed:

publishSnapshot() built and sorted three vectors of kernel state on every one
of ~40 scheduler operations, for state only the debug panel and an
aggressive-log tick ever read. 45% of EE thread time during a movie. It now
builds only when snapshot() has asked; the idle path publishes unconditionally
so a quiet scheduler still converges for a poller.

The MPEG stub refused demux bytes once 8 pictures were decoded ahead -- 134,563
refusals out of 134,569 calls per 30 frames -- and the guest's loop
(remaining -= consumed; bgtz remaining) cannot terminate on a zero count.
Demux now queues elementary stream and sceMpegGetPicture pulls decode from it,
so lookahead is bounded by buffered bytes rather than decoded pictures: ~25 KB
per frame on the wire against ~917 KB decoded. Refusals go to zero and demux
calls per frame from 4,551 to 13. flushDecoderIfEnded() has to wait for the
queue to drain, or a program-end code drains the decoder while the whole movie
is still buffered and every later packet fails with AVERROR_EOF.

processPendingEvents() ran after every guest dispatch and took three mutexes,
read the clock, walked m_deadlines and heap-allocated a deque to find nothing.
24% of EE thread time, now 6%.

Also: transferIfRequested() skips the unwind when the thread it would
reschedule is the one already executing, and counters for dispatches, transfers
and refusals so the remaining cost stays visible. DQ8_EE_DISPATCH_HISTOGRAM
names the guest addresses the executor re-enters most.

Logo movie 1.4 -> 3.3 fps. Still not smooth: 30,908 context transfers per movie
frame at ~10 us each, where 60 fps needs ~540 ns. That is the exception-based
transfer itself, and fixing it means fibers rather than throw/unwind.
---
 ps2xRuntime/include/runtime/ee_scheduler.h |  14 ++
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp | 188 +++++++++++++++++++--
 ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp  | 146 +++++++++++++++-
 3 files changed, 329 insertions(+), 19 deletions(-)

diff --git a/ps2xRuntime/include/runtime/ee_scheduler.h b/ps2xRuntime/include/runtime/ee_scheduler.h
index cb0c1d7f2..d6dce5e68 100644
--- a/ps2xRuntime/include/runtime/ee_scheduler.h
+++ b/ps2xRuntime/include/runtime/ee_scheduler.h
@@ -354,7 +354,11 @@ class EeScheduler
     void bindMainContextForSyscall(R5900Context &ctx, uint8_t *rdram);
 
     [[nodiscard]] EeKernelSnapshot snapshot() const;
+    // Cheap unless snapshot() has asked for a refresh since the last build.
     void publishSnapshot();
+    // Builds unconditionally; for the idle path, where no later scheduler
+    // operation is guaranteed to service a pending request.
+    void publishSnapshotNow();
 
 private:
     struct ScheduledEvent
@@ -372,6 +376,10 @@ class EeScheduler
     void enqueueReady(GuestThread &thread, bool front = false);
     void removeReady(GuestThread &thread);
     [[nodiscard]] GuestThread *selectReady();
+    // What selectReady() would return, without dequeuing it. 0 when nothing is ready.
+    [[nodiscard]] int peekReadyId() const;
+    // Whether the dispatch loop has work that a same-thread yield must not skip.
+    [[nodiscard]] bool mustReturnToDispatcher() const noexcept;
     void makeRunning(GuestThread &thread);
     void makeDormant(GuestThread &thread);
     void removeFromWaitObject(GuestThread &thread);
@@ -428,6 +436,9 @@ class EeScheduler
     std::atomic<bool> m_stopRequested{false};
     std::atomic<bool> m_checkpointPending{false};
     uint32_t m_debugPublishCountdown = 0u;
+    // The thread whose C++ stack the executor is standing in, or 0 outside a
+    // guest dispatch. A yield back onto this thread can skip the unwind.
+    int m_dispatchedThreadId = 0;
 
     mutable std::mutex m_eventMutex;
     std::condition_variable m_eventCv;
@@ -451,4 +462,7 @@ class EeScheduler
     mutable std::mutex m_snapshotMutex;
     EeKernelSnapshot m_snapshot;
     uint64_t m_snapshotSequence = 0;
+    // Set by snapshot(), cleared by publishSnapshot(). The snapshot is debug
+    // state, so it is only worth building when someone has asked for it.
+    mutable std::atomic<bool> m_snapshotWanted{false};
 };
diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index e496576a1..cbaf8966c 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -4,10 +4,39 @@
 #include "ps2_runtime_macros.h"
 
 #include <algorithm>
+#include <atomic>
 #include <cassert>
+#include <cstdio>
+#include <cstdlib>
 #include <cstring>
 #include <limits>
 #include <stdexcept>
+#include <unordered_map>
+#include <utility>
+#include <vector>
+
+// How many times the executor re-entered guest code. The EE clock advances
+// kGuestDispatchCycles per dispatch, so this is what paces the emulated frame.
+std::atomic<uint64_t> g_eeGuestDispatchCount{0};
+// Thrown EeDispatcherTransfers. Against g_eeGuestDispatchCount this says
+// whether the executor is re-entering guest code because a transfer asked it
+// to, or because the call chain has to be rebuilt after one.
+std::atomic<uint64_t> g_eeTransferThrowCount{0};
+
+namespace
+{
+    const uint64_t g_eeCycleScale = [] {
+        const char *value = std::getenv("DQ8_EE_CYCLE_SCALE");
+        const long long parsed = value ? std::atoll(value) : 0;
+        return parsed > 0 ? static_cast<uint64_t>(parsed) : 1ull;
+    }();
+
+    const uint64_t g_eeDispatchHistogramInterval = [] {
+        const char *value = std::getenv("DQ8_EE_DISPATCH_HISTOGRAM");
+        const long long parsed = value ? std::atoll(value) : 0;
+        return parsed > 0 ? static_cast<uint64_t>(parsed) : 0ull;
+    }();
+}
 
 namespace
 {
@@ -123,6 +152,7 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     m_stopRequested.store(false, std::memory_order_release);
     m_checkpointPending.store(false, std::memory_order_release);
     m_debugPublishCountdown = 0u;
+    m_dispatchedThreadId = 0;
     {
         std::lock_guard lock(m_eventMutex);
         m_events.clear();
@@ -156,7 +186,7 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     scheduleEvent(m_eeCycle + kVBlankPeriodCycles,
                   std::chrono::steady_clock::now() + kVBlankPeriod,
                   EeEvent{EeEventType::VBlankStart, 0, 0});
-    publishSnapshot();
+    publishSnapshotNow();
 }
 
 void EeScheduler::run()
@@ -177,7 +207,9 @@ void EeScheduler::run()
             GuestThread *next = selectReady();
             if (!next && m_pendingInvocations.empty())
             {
-                publishSnapshot();
+                // About to sleep: nothing after this would service a pending
+                // snapshot request until the guest runs again.
+                publishSnapshotNow();
                 waitForEvent();
                 continue;
             }
@@ -209,10 +241,13 @@ void EeScheduler::run()
             running->resumeCompletion = {};
             try
             {
+                m_dispatchedThreadId = running->id;
                 completion(running->activeContext());
+                m_dispatchedThreadId = 0;
             }
             catch (const EeDispatcherTransfer &)
             {
+                m_dispatchedThreadId = 0;
             }
             if (m_currentThreadId == 0)
             {
@@ -297,6 +332,32 @@ void EeScheduler::run()
         }
         PS2Runtime::RecompiledFunction function = m_runtime.lookupFunction(context.pc);
 
+        g_eeGuestDispatchCount.fetch_add(1u, std::memory_order_relaxed);
+        // DQ8_EE_DISPATCH_HISTOGRAM=N reports the guest addresses the executor
+        // re-enters most often, every N dispatches. A spinning guest loop shows
+        // up here as one address with a huge count.
+        if (g_eeDispatchHistogramInterval != 0u)
+        {
+            static std::unordered_map<uint32_t, uint64_t> s_histogram;
+            static uint64_t s_seen = 0u;
+            ++s_histogram[context.pc];
+            if (++s_seen >= g_eeDispatchHistogramInterval)
+            {
+                std::vector<std::pair<uint32_t, uint64_t>> top(s_histogram.begin(), s_histogram.end());
+                std::partial_sort(top.begin(), top.begin() + std::min<size_t>(8u, top.size()), top.end(),
+                                  [](const auto &l, const auto &r) { return l.second > r.second; });
+                std::fprintf(stderr, "[ee] dispatch histogram over %llu:",
+                             static_cast<unsigned long long>(s_seen));
+                for (size_t i = 0u; i < std::min<size_t>(8u, top.size()); ++i)
+                {
+                    std::fprintf(stderr, " 0x%08x=%llu", top[i].first,
+                                 static_cast<unsigned long long>(top[i].second));
+                }
+                std::fprintf(stderr, "\n");
+                s_histogram.clear();
+                s_seen = 0u;
+            }
+        }
         if (checkpointDue(kGuestDispatchCycles))
         {
             continue;
@@ -306,17 +367,21 @@ void EeScheduler::run()
         {
             m_insideInterrupt = !running->invocations.empty() && running->invocations.back().kind == GuestInvocationKind::Interrupt;
             m_guestExecuting.store(true, std::memory_order_release);
+            m_dispatchedThreadId = running->id;
             function(m_rdram, &context, &m_runtime);
+            m_dispatchedThreadId = 0;
             m_guestExecuting.store(false, std::memory_order_release);
             m_insideInterrupt = false;
         }
         catch (const EeDispatcherTransfer &)
         {
+            m_dispatchedThreadId = 0;
             m_guestExecuting.store(false, std::memory_order_release);
             m_insideInterrupt = false;
         }
         catch (...)
         {
+            m_dispatchedThreadId = 0;
             m_guestExecuting.store(false, std::memory_order_release);
             m_running.store(false, std::memory_order_release);
             publishSnapshot();
@@ -400,7 +465,13 @@ bool EeScheduler::checkpointDue(uint32_t cycles) noexcept
 
 void EeScheduler::accountCycles(uint32_t cycles) noexcept
 {
-    const uint64_t elapsed = std::max<uint64_t>(1u, cycles);
+    // DQ8_EE_CYCLE_SCALE multiplies the charge per guest safe point. The model
+    // charges per inter-function branch and ignores the instructions between,
+    // so it undercounts badly against a real 294 MHz EE; a spinning guest loop
+    // then gets far more iterations per emulated frame than hardware allows.
+    // Only raises the floor: a frame still cannot retire before its host
+    // deadline, so this can never run the game faster than real time.
+    const uint64_t elapsed = std::max<uint64_t>(1u, cycles) * g_eeCycleScale;
     m_eeCycle += elapsed;
     m_pendingEeTimerInterrupts |= m_runtime.memory().advanceEeTimers(elapsed);
     if (m_pendingEeTimerInterrupts != 0u)
@@ -555,6 +626,7 @@ int EeScheduler::startThread(int id, uint32_t arg, const R5900Context &caller, b
         m_runtime.guestFree(ownedStack);
     }
     publishSnapshot();
+    g_eeTransferThrowCount.fetch_add(1u, std::memory_order_relaxed);
     throw EeDispatcherTransfer{};
 }
 
@@ -841,9 +913,41 @@ void EeScheduler::transferIfRequested(bool interruptSafe)
         enqueueReady(*self, true);
         m_currentThreadId = 0;
     }
+
+    // A yield that lands back on the thread we are already executing does not
+    // need the C++ stack torn down and rebuilt. Unwinding EeDispatcherTransfer
+    // through the guest's frames was ~40% of EE time during a movie, because
+    // DQ8's movie producer yields thousands of times per frame and almost
+    // always ends up running again immediately.
+    if (m_dispatchedThreadId != 0 &&
+        m_pendingInvocations.empty() &&
+        peekReadyId() == m_dispatchedThreadId &&
+        !mustReturnToDispatcher())
+    {
+        // Charge what the dispatch loop would have charged, so the time slice
+        // and the EE timers still advance and this cannot spin forever.
+        accountCycles(kGuestDispatchCycles);
+        GuestThread *next = selectReady();
+        assert(next != nullptr && next->id == m_dispatchedThreadId);
+        if (next != nullptr && next->id == m_dispatchedThreadId)
+        {
+            next->status = EeThreadStatus::Running;
+            m_currentThreadId = next->id;
+            m_rescheduleRequested = false;
+            m_timeSliceExpired = false;
+            return;
+        }
+        // peekReadyId lied, so put it back and take the slow path.
+        if (next != nullptr)
+        {
+            enqueueReady(*next, true);
+        }
+    }
+
     m_rescheduleRequested = false;
     m_timeSliceExpired = false;
     publishSnapshot();
+    g_eeTransferThrowCount.fetch_add(1u, std::memory_order_relaxed);
     throw EeDispatcherTransfer{};
 }
 
@@ -1147,6 +1251,7 @@ void EeScheduler::queueInvocation(GuestInvocation invocation)
     invocation.sequence = ++m_invocationSequence;
     owner->invocations.push_back(std::move(invocation));
     publishSnapshot();
+    g_eeTransferThrowCount.fetch_add(1u, std::memory_order_relaxed);
     throw EeDispatcherTransfer{};
 }
 
@@ -1166,6 +1271,7 @@ void EeScheduler::queueInvocation(GuestInvocation invocation)
         owner->invocations.push_back(std::move(*it));
     }
     publishSnapshot();
+    g_eeTransferThrowCount.fetch_add(1u, std::memory_order_relaxed);
     throw EeDispatcherTransfer{};
 }
 
@@ -1538,11 +1644,28 @@ void EeScheduler::bindMainContextForSyscall(R5900Context &ctx, uint8_t *rdram)
 
 EeKernelSnapshot EeScheduler::snapshot() const
 {
+    // Ask the executor to refresh, then return what it published last. One
+    // scheduler operation of staleness is invisible to a debug panel, and the
+    // idle path publishes unconditionally so a quiet scheduler still converges.
+    m_snapshotWanted.store(true, std::memory_order_relaxed);
     std::lock_guard lock(m_snapshotMutex);
     return m_snapshot;
 }
 
 void EeScheduler::publishSnapshot()
+{
+    // Building this walks every thread, semaphore and event flag and sorts all
+    // three. Called from ~40 scheduler operations it was 45% of EE thread time
+    // during a movie, for state whose only readers are the debug panel and an
+    // aggressive-log tick.
+    if (!m_snapshotWanted.exchange(false, std::memory_order_relaxed))
+    {
+        return;
+    }
+    publishSnapshotNow();
+}
+
+void EeScheduler::publishSnapshotNow()
 {
     EeKernelSnapshot next{};
     next.sequence = ++m_snapshotSequence;
@@ -1684,6 +1807,34 @@ GuestThread *EeScheduler::selectReady()
     return nullptr;
 }
 
+int EeScheduler::peekReadyId() const
+{
+    for (const auto &queue : m_readyQueues)
+    {
+        if (!queue.empty())
+        {
+            return queue.front();
+        }
+    }
+    return 0;
+}
+
+bool EeScheduler::mustReturnToDispatcher() const noexcept
+{
+    // The same conditions checkpointDue() uses, minus its side effects.
+    if (m_checkpointPending.load(std::memory_order_acquire) ||
+        m_stopRequested.load(std::memory_order_acquire))
+    {
+        return true;
+    }
+    const uint64_t nextEventCycle = m_nextDeadlineCycle.load(std::memory_order_acquire);
+    if (nextEventCycle != 0u && m_eeCycle >= nextEventCycle)
+    {
+        return true;
+    }
+    return m_eeCycle >= m_sliceEndCycle;
+}
+
 void EeScheduler::makeRunning(GuestThread &item)
 {
     assert(m_currentThreadId == 0);
@@ -1743,6 +1894,7 @@ void EeScheduler::blockCurrent(EeWaitState wait)
     self->status = self->suspendCount == 0 ? EeThreadStatus::Waiting : EeThreadStatus::WaitingSuspended;
     m_currentThreadId = 0;
     publishSnapshot();
+    g_eeTransferThrowCount.fetch_add(1u, std::memory_order_relaxed);
     throw EeDispatcherTransfer{};
 }
 
@@ -1819,14 +1971,20 @@ void EeScheduler::processPendingEvents()
         dispatchIrq(false, 5u);
     }
 
-    std::deque<EeEvent> pending;
+    // A default-constructed deque still allocates, and this path is almost
+    // always empty, so only build one when there is something to take.
     {
-        std::lock_guard lock(m_eventMutex);
-        pending.swap(m_events);
-    }
-    for (const EeEvent &event : pending)
-    {
-        processEvent(event);
+        std::unique_lock lock(m_eventMutex);
+        if (!m_events.empty())
+        {
+            std::deque<EeEvent> pending;
+            pending.swap(m_events);
+            lock.unlock();
+            for (const EeEvent &event : pending)
+            {
+                processEvent(event);
+            }
+        }
     }
 
     {
@@ -1841,6 +1999,16 @@ void EeScheduler::processPendingEvents()
 
 void EeScheduler::processDueDeadlines()
 {
+    // Runs after every guest dispatch, so the common "nothing is due" case must
+    // not cost a mutex, a clock read and a walk of m_deadlines. m_nextDeadlineCycle
+    // is the minimum deadlineCycle, or 0 when there are none -- exactly the
+    // condition the loop below would fail on.
+    const uint64_t nextDeadline = m_nextDeadlineCycle.load(std::memory_order_acquire);
+    if (nextDeadline == 0u || m_eeCycle < nextDeadline)
+    {
+        return;
+    }
+
     for (;;)
     {
         std::vector<ScheduledEvent> due;
diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
index b7114b757..4cf554b36 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
@@ -32,6 +32,13 @@ std::atomic<uint64_t> g_mpegWriteFrameNanos{0};
 std::atomic<uint64_t> g_mpegWriteFrameCount{0};
 std::atomic<uint64_t> g_mpegDemuxNanos{0};
 std::atomic<uint64_t> g_mpegDemuxCount{0};
+// How many demux calls were refused, and which guest threads drive each side:
+// whether the producer and the consumer are the same thread decides whether
+// parking the producer is even possible.
+std::atomic<uint64_t> g_mpegDemuxRefusedCount{0};
+std::atomic<uint64_t> g_mpegPendingEsPeakBytes{0};
+std::atomic<uint32_t> g_mpegDemuxThreadId{0};
+std::atomic<uint32_t> g_mpegGetPictureThreadId{0};
 
 namespace
 {
@@ -521,6 +528,28 @@ namespace ps2_stubs
         constexpr size_t kMpegTimingScanLimit = 4096u;
         constexpr size_t kMaxDecodedPicturesAhead = 8u;
 
+        // Lookahead is held as compressed elementary stream, not as decoded
+        // pictures: a 512x448 frame costs ~917 KB decoded against ~25 KB on the
+        // wire, so the same memory buys ~36x more of it. Refusing a demux call
+        // is what makes the guest's producer loop spin, and every spin costs a
+        // guest RotateThreadReadyQueue, so the lookahead wants to be deep.
+        size_t mpegMaxPendingEsBytes()
+        {
+            static const size_t bytes = [] {
+                const char *value = std::getenv("DQ8_MPEG_ES_BUFFER_MB");
+                const long parsed = value ? std::atol(value) : 0;
+                return (parsed > 0 ? static_cast<size_t>(parsed) : 32u) * 1024u * 1024u;
+            }();
+            return bytes;
+        }
+
+        struct MpegPendingEs
+        {
+            std::vector<uint8_t> data;
+            int64_t pts90k = -1;
+            int64_t dts90k = -1;
+        };
+
         struct MpegPlaybackState
         {
             uint32_t picturesServed = 0u;
@@ -538,6 +567,11 @@ namespace ps2_stubs
             std::vector<uint8_t> pssBuffer;
             std::vector<uint32_t> pssGuestAddrs;
             std::deque<MpegDecodedFrame> decodedFrames;
+            // Demuxed but not yet decoded. Decode is pulled from here by
+            // sceMpegGetPicture rather than pushed by the demux call.
+            std::deque<MpegPendingEs> pendingEs;
+            size_t pendingEsBytes = 0u;
+            size_t pendingEsPeakBytes = 0u;
             std::unique_ptr<MpegFfmpegDecoder> decoder;
             uint8_t frameRateCode = 0u;
             uint8_t frameRateExtensionN = 0u;
@@ -583,6 +617,21 @@ namespace ps2_stubs
 
         std::mutex g_mpeg_stub_mutex;
         constexpr uint32_t kMpegPictureWaitType = 1u;
+
+        // A refused demux call only has to give the consumer thread a turn --
+        // it does not need one context transfer per refusal, and a transfer is
+        // a thrown EeDispatcherTransfer unwound through the guest's whole call
+        // stack. Yield on every Nth refusal instead; the spins in between are
+        // just a stub entry and a mutex.
+        size_t mpegDemuxYieldInterval()
+        {
+            static const size_t interval = [] {
+                const char *value = std::getenv("DQ8_MPEG_YIELD_EVERY");
+                const long parsed = value ? std::atol(value) : 0;
+                return parsed > 0 ? static_cast<size_t>(parsed) : 64u;
+            }();
+            return interval;
+        }
         MpegStubState g_mpeg_stub_state;
 
         // TODO this resolution should follow runtime resolution
@@ -1043,7 +1092,10 @@ namespace ps2_stubs
 
         void flushDecoderIfEnded(MpegPlaybackState &playback)
         {
-            if (playback.streamEnded && playback.decoder)
+            // Not while bytes are still queued. A program-end code arrives with
+            // the whole movie still buffered, and draining the decoder there
+            // makes every packet after it fail with AVERROR_EOF.
+            if (playback.streamEnded && playback.pendingEs.empty() && playback.decoder)
             {
                 playback.decoder->flush(playback.decodedFrames);
             }
@@ -1157,6 +1209,48 @@ namespace ps2_stubs
             flushDecoderIfEnded(playback);
         }
 
+        // Demux hands video payload here instead of straight to the decoder, so
+        // accepting the guest's bytes costs a memcpy rather than a decode.
+        void queueElementaryStream(MpegPlaybackState &playback, const uint8_t *data, size_t size,
+                                   int64_t pts90k, int64_t dts90k)
+        {
+            if (!data || size == 0u)
+            {
+                return;
+            }
+            playback.sawInput = true;
+            playback.pendingEs.push_back(
+                MpegPendingEs{std::vector<uint8_t>(data, data + size), pts90k, dts90k});
+            playback.pendingEsBytes += size;
+            playback.pendingEsPeakBytes = std::max(playback.pendingEsPeakBytes, playback.pendingEsBytes);
+            if (playback.pendingEsPeakBytes > g_mpegPendingEsPeakBytes.load(std::memory_order_relaxed))
+            {
+                g_mpegPendingEsPeakBytes.store(playback.pendingEsPeakBytes, std::memory_order_relaxed);
+            }
+        }
+
+        // Decode forward until there is something to show, or the buffer runs
+        // dry. One chunk is a single PES payload, so several are usually needed
+        // before the decoder emits a picture.
+        void decodePendingElementaryStream(MpegPlaybackState &playback, bool drainAll = false)
+        {
+            while (!playback.pendingEs.empty() &&
+                   (drainAll || playback.decodedFrames.empty()))
+            {
+                MpegPendingEs chunk = std::move(playback.pendingEs.front());
+                playback.pendingEs.pop_front();
+                playback.pendingEsBytes -= std::min(playback.pendingEsBytes, chunk.data.size());
+                feedElementaryStream(playback, chunk.data.data(), chunk.data.size(),
+                                     chunk.pts90k, chunk.dts90k);
+                if (playback.decoderFailed)
+                {
+                    break;
+                }
+            }
+            // The queue emptying is what makes a already-ended stream flushable.
+            flushDecoderIfEnded(playback);
+        }
+
         void erasePssPrefix(MpegPlaybackState &playback, size_t count)
         {
             std::vector<uint8_t> &buffer = playback.pssBuffer;
@@ -1378,7 +1472,7 @@ namespace ps2_stubs
                                 pes.pts90k,
                                 pes.dts90k);
                         }
-                        feedElementaryStream(
+                        queueElementaryStream(
                             playback,
                             buffer.data() + payloadStart,
                             packetEnd - payloadStart,
@@ -1419,6 +1513,9 @@ namespace ps2_stubs
         {
             std::vector<MpegStreamCallbackEvent> ignoredCallbacks;
             processPssBuffer(mpegAddr, playback, ignoredCallbacks, true);
+            // Everything still buffered has to reach the decoder before the
+            // stream can be called ended, or the tail of the movie is dropped.
+            decodePendingElementaryStream(playback, true);
             playback.streamEnded = true;
             playback.cdStreamGeneration = g_mpeg_stub_state.cdStreamGeneration;
             flushDecoderIfEnded(playback);
@@ -1456,8 +1553,13 @@ namespace ps2_stubs
             // lets the game's producer loop wake the consumer again. Backpressure
             // still propagates naturally to sceCdStRead because the ring does not
             // advance while this is true.
+            // Bounded by buffered bytes now, not by decoded pictures: decode is
+            // pulled by the consumer, so pictures no longer pile up ahead of it
+            // and the old limit would fire on a queue that is nearly always
+            // empty.
             return !g_mpeg_stub_state.currentCdStreamEofSeen &&
-                   playback.decodedFrames.size() >= kMaxDecodedPicturesAhead;
+                   (playback.pendingEsBytes >= mpegMaxPendingEsBytes() ||
+                    playback.decodedFrames.size() >= kMaxDecodedPicturesAhead);
         }
 
         void recordCdStreamBytesDemuxedUnlocked(
@@ -2148,6 +2250,10 @@ namespace ps2_stubs
             {
                 consumed = appendGuestBytes(mpegAddr, playback, rdram, dataAddr, byteCount, callbackEvents);
                 recordCdStreamBytesDemuxedUnlocked(consumed, completedMpegIds, eofChanged);
+                // Enough to wake a consumer parked in sceMpegGetPicture; it
+                // stops as soon as one picture exists, so the decode rate still
+                // follows consumption.
+                decodePendingElementaryStream(playback);
             }
             decodedCount = playback.decodedFrames.size();
             decoderFailed = playback.decoderFailed;
@@ -2156,6 +2262,7 @@ namespace ps2_stubs
 
         if (backpressured)
         {
+            const uint64_t refusals = g_mpegDemuxRefusedCount.fetch_add(1u, std::memory_order_relaxed);
             if (traceIdx < 32u)
             {
                 PS2_IF_AGRESSIVE_LOGS({
@@ -2164,8 +2271,11 @@ namespace ps2_stubs
             }
             // Same reasoning and the same order as the ring variant.
             setReturnS32(ctx, 0);
-            runtime->eeScheduler().rotateReadyQueue(0, false);
-            runtime->eeScheduler().transferIfRequested(false);
+            if ((refusals % mpegDemuxYieldInterval()) == 0u)
+            {
+                runtime->eeScheduler().rotateReadyQueue(0, false);
+                runtime->eeScheduler().transferIfRequested(false);
+            }
             return;
         }
         const bool currentStreamCompleted = std::find(completedMpegIds.begin(), completedMpegIds.end(), mpegAddr) != completedMpegIds.end();
@@ -2201,6 +2311,9 @@ namespace ps2_stubs
     void sceMpegDemuxPssRing(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         MpegScopedTimer timer(g_mpegDemuxNanos, g_mpegDemuxCount);
+        g_mpegDemuxThreadId.store(
+            static_cast<uint32_t>(runtime->eeScheduler().currentThreadId()),
+            std::memory_order_relaxed);
         static std::atomic<uint32_t> s_demuxRingEntryCount{0u};
         const uint32_t entryIdx = s_demuxRingEntryCount.fetch_add(1u, std::memory_order_relaxed);
         if (entryIdx < 4u)
@@ -2245,6 +2358,9 @@ namespace ps2_stubs
                     ringSize,
                     callbackEvents);
                 recordCdStreamBytesDemuxedUnlocked(consumed, completedMpegIds, eofChanged);
+                // Same reason as the non-ring variant: keep a parked
+                // sceMpegGetPicture wakeable without decoding ahead.
+                decodePendingElementaryStream(playback);
             }
             decodedCount = playback.decodedFrames.size();
             decoderFailed = playback.decoderFailed;
@@ -2253,6 +2369,7 @@ namespace ps2_stubs
 
         if (backpressured)
         {
+            const uint64_t refusals = g_mpegDemuxRefusedCount.fetch_add(1u, std::memory_order_relaxed);
             if (traceIdx < 32u)
             {
                 PS2_IF_AGRESSIVE_LOGS({
@@ -2278,8 +2395,11 @@ namespace ps2_stubs
             // bindMainContextForSyscall's assert on the next syscall. Same
             // order as the RotateThreadReadyQueue syscall.
             setReturnS32(ctx, 0);
-            runtime->eeScheduler().rotateReadyQueue(0, false);
-            runtime->eeScheduler().transferIfRequested(false);
+            if ((refusals % mpegDemuxYieldInterval()) == 0u)
+            {
+                runtime->eeScheduler().rotateReadyQueue(0, false);
+                runtime->eeScheduler().transferIfRequested(false);
+            }
             return;
         }
         const bool currentStreamCompleted = std::find(completedMpegIds.begin(), completedMpegIds.end(), mpegAddr) != completedMpegIds.end();
@@ -2357,6 +2477,9 @@ namespace ps2_stubs
     void sceMpegGetPicture(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         MpegScopedTimer timer(g_mpegGetPictureNanos, g_mpegGetPictureCount);
+        g_mpegGetPictureThreadId.store(
+            static_cast<uint32_t>(runtime->eeScheduler().currentThreadId()),
+            std::memory_order_relaxed);
         const uint32_t mpegAddr = getRegU32(ctx, 4);
         const uint32_t imageAddr = getRegU32(ctx, 5);
         uint32_t width = kStubMovieWidth;
@@ -2368,6 +2491,8 @@ namespace ps2_stubs
         {
             std::unique_lock<std::mutex> lock(g_mpeg_stub_mutex);
             MpegPlaybackState &playback = getPlaybackState(mpegAddr);
+            // The consumer drives decode: demux only buffers.
+            decodePendingElementaryStream(playback);
             // sawSequenceEnd is the only end-of-video signal a game streaming
             // with plain sceCdRead can raise: the CD-stream EOF path belongs to
             // sceCdSt*, and a PSS need not carry a program-end code.
@@ -2470,7 +2595,7 @@ namespace ps2_stubs
 
             // Not on the call that serves the final frame -- the caller would
             // tear the movie down before uploading it.
-            movieEnded = !haveFrame && playback.decodedFrames.empty() &&
+            movieEnded = !haveFrame && playback.decodedFrames.empty() && playback.pendingEs.empty() &&
                          (playback.sawSequenceEnd || playback.streamEnded ||
                           playback.decoderFailed || g_mpeg_stub_state.currentCdStreamEofSeen);
         }
@@ -2579,7 +2704,10 @@ namespace ps2_stubs
             ++g_mpeg_stub_state.isEndTraceCount;
         }
 
-        setReturnS32(ctx, (ended && playback.decodedFrames.empty() && presentationComplete) ? 1 : 0);
+        setReturnS32(ctx, (ended && playback.decodedFrames.empty() && playback.pendingEs.empty() &&
+                           presentationComplete)
+                              ? 1
+                              : 0);
     }
 
     void sceMpegIsRefBuffEmpty(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)

From 8b83b2bc28285939068e775855c0a4672959405d Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Sun, 23 Aug 2026 13:31:39 +0200
Subject: [PATCH 26/68] Run guest threads on their own stacks instead of
 unwinding them to switch

The EE scheduler transferred control by throwing EeDispatcherTransfer, which
destroyed the guest's whole C++ call chain and rebuilt it on the way back --
about 2.7 executor re-entries per transfer, ~10us each, where 60fps allows
~540ns. DQ8's movie thread needs ~31,000 transfers per movie frame, so the
movie ran at 1.4fps and _Unwind was 43% of EE thread time.

EeFiber gives each GuestThread its own stack. A yield now saves the
callee-saved registers and swaps the stack pointer: 22ns per round trip,
measured. Guest dispatches per movie frame fall 82,441 -> 353 and thrown
transfers per 30 frames 927,230 -> 2; the movie runs at 7.0fps.

transferIfRequested suspends, and so does blockCurrentResumable -- semaphore,
event flag and sleep waits, which only take a return value from makeReady() and
whose callers have nothing left to do. Waits carrying a completion still throw,
because the completion re-invokes its syscall on wake and would run twice
against a stack that is still there. blockCurrent stays [[noreturn]]: giving it
a return path makes the compiler emit ud2, and waitVSync/waitExternal take an
optional completion, so a flag on blockCurrent turns those into SIGILL.

x86-64 gets a hand-written switch, everything else falls back to ucontext
(correct, but a sigprocmask syscall: 461ns against 22ns). setjmp/longjmp across
stacks is faster still and deliberately unused -- _FORTIFY_SOURCE turns it into
an abort. The trampoline realigns the stack before calling, or the first
std::string inside a fiber faults on an aligned SSE spill. Stacks are mmapped
with a guard page so an overflow faults instead of corrupting its neighbour.

Also here: DQ8_PAD_SCRIPT replays input timed in guest vsync ticks so a script
lands in the same place whatever the frame rate; DQ8_GFX_SCREENSHOT_DIR writes
the presented frame as a PPM named after that same tick; DQ8_SKIP_MOVIES taps
START while a movie plays, which is the game's own skip -- reporting
end-of-stream from the MPEG stub instead leaves its streaming thread spinning
on a black screen.
---
 ps2xRuntime/include/runtime/ee_fiber.h     |  48 ++++
 ps2xRuntime/include/runtime/ee_scheduler.h |  33 ++-
 ps2xRuntime/include/runtime/ps2_pad_host.h |   8 +
 ps2xRuntime/src/lib/Kernel/EeFiber.cpp     | 274 +++++++++++++++++++++
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp | 213 ++++++++++------
 ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp  |   3 +
 ps2xRuntime/src/lib/gs/gs_frontend.cpp     |  88 +++++++
 ps2xRuntime/src/lib/ps2_pad.cpp            | 236 ++++++++++++++++--
 ps2xRuntime/src/lib/ps2_runtime.cpp        |   1 +
 ps2xTest/CMakeLists.txt                    |   1 +
 ps2xTest/src/ee_fiber_tests.cpp            | 147 +++++++++++
 ps2xTest/src/main.cpp                      |   2 +
 12 files changed, 959 insertions(+), 95 deletions(-)
 create mode 100644 ps2xRuntime/include/runtime/ee_fiber.h
 create mode 100644 ps2xRuntime/src/lib/Kernel/EeFiber.cpp
 create mode 100644 ps2xTest/src/ee_fiber_tests.cpp

diff --git a/ps2xRuntime/include/runtime/ee_fiber.h b/ps2xRuntime/include/runtime/ee_fiber.h
new file mode 100644
index 000000000..a29f2ac19
--- /dev/null
+++ b/ps2xRuntime/include/runtime/ee_fiber.h
@@ -0,0 +1,48 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+// A stack a guest thread can be suspended on and resumed into.
+//
+// The EE scheduler used to transfer control by throwing EeDispatcherTransfer,
+// which unwinds the guest's whole C++ call chain and then rebuilds it on the
+// way back. That cost ~10us per switch against the ~540ns a 60fps movie frame
+// can afford, because DQ8's movie thread yields ~31,000 times per frame.
+// Suspending the stack instead makes a switch a register save and a stack
+// pointer swap.
+//
+// x86-64 gets a hand-written switch; everything else falls back to ucontext,
+// which is correct but pays a sigprocmask syscall per switch. setjmp/longjmp
+// across stacks is deliberately not used: glibc's _FORTIFY_SOURCE turns it
+// into an abort ("longjmp causes uninitialized stack frame").
+class EeFiber
+{
+public:
+    using EntryFn = void (*)(void *user);
+
+    EeFiber() = default;
+    ~EeFiber();
+
+    EeFiber(const EeFiber &) = delete;
+    EeFiber &operator=(const EeFiber &) = delete;
+
+    // Allocates the stack and arms `entry`; entry must never return.
+    bool create(EntryFn entry, void *user, size_t stackBytes);
+    [[nodiscard]] bool valid() const noexcept { return m_stack != nullptr; }
+    void destroy();
+
+    // Called from the scheduler: run this fiber until it switches back.
+    void resume();
+    // Called from inside the fiber: hand control back to whoever resumed it.
+    void suspend();
+
+    [[nodiscard]] static bool usingFastSwitch() noexcept;
+
+private:
+    void *m_stack = nullptr;      // lowest address of the allocation
+    size_t m_stackBytes = 0u;
+    void *m_fiberSp = nullptr;    // suspended fiber stack pointer
+    void *m_returnSp = nullptr;   // stack pointer of whoever called resume()
+    void *m_platform = nullptr;   // ucontext pair on the fallback path
+};
diff --git a/ps2xRuntime/include/runtime/ee_scheduler.h b/ps2xRuntime/include/runtime/ee_scheduler.h
index d6dce5e68..fe3263c13 100644
--- a/ps2xRuntime/include/runtime/ee_scheduler.h
+++ b/ps2xRuntime/include/runtime/ee_scheduler.h
@@ -1,6 +1,9 @@
 #pragma once
 
 #include "ps2_runtime.h"
+#include "runtime/ee_fiber.h"
+
+#include <memory>
 
 #include <array>
 #include <atomic>
@@ -122,6 +125,11 @@ struct GuestThread
     EeWaitState wait{};
     std::function<void(R5900Context &)> resumeCompletion;
     std::vector<GuestInvocation> invocations;
+    // Host stack this thread's guest code runs on, created on first dispatch.
+    // While inGuestCall is set the stack is suspended part way through a guest
+    // call and must be resumed, not re-entered from the saved pc.
+    std::unique_ptr<EeFiber> fiber;
+    bool inGuestCall = false;
 
     [[nodiscard]] R5900Context &activeContext()
     {
@@ -375,15 +383,21 @@ class EeScheduler
     void reserveGuestStackFromAsyncPool(uint32_t guestStackBase);
     void enqueueReady(GuestThread &thread, bool front = false);
     void removeReady(GuestThread &thread);
+    // Runs one guest dispatch on `thread`'s fiber, creating it if needed, and
+    // returns when the fiber suspends or the call completes.
+    void enterGuest(GuestThread &thread);
+    // The fiber's body: run the pending dispatch, hand control back, repeat.
+    static void fiberEntry(void *user);
+    void runPendingGuestCall();
+
     [[nodiscard]] GuestThread *selectReady();
-    // What selectReady() would return, without dequeuing it. 0 when nothing is ready.
-    [[nodiscard]] int peekReadyId() const;
-    // Whether the dispatch loop has work that a same-thread yield must not skip.
-    [[nodiscard]] bool mustReturnToDispatcher() const noexcept;
     void makeRunning(GuestThread &thread);
     void makeDormant(GuestThread &thread);
     void removeFromWaitObject(GuestThread &thread);
     [[noreturn]] void blockCurrent(EeWaitState wait);
+    // Suspends the guest stack instead of unwinding it; see the definition for
+    // when that is allowed.
+    void blockCurrentResumable(EeWaitState wait);
     void makeReady(GuestThread &thread, int result, bool interruptSafe);
     void requestPreemptionIfHigher(const GuestThread &readyThread, bool interruptSafe);
     void applyPendingPreemption();
@@ -440,6 +454,17 @@ class EeScheduler
     // guest dispatch. A yield back onto this thread can skip the unwind.
     int m_dispatchedThreadId = 0;
 
+    // Guest code runs on a per-thread fiber so a yield can suspend the stack
+    // instead of unwinding it. Null while the executor is on its own stack.
+    EeFiber *m_activeFiber = nullptr;
+    // Handed to the fiber for the dispatch it is about to run.
+    PS2Runtime::RecompiledFunction m_pendingFunction = nullptr;
+    R5900Context *m_pendingContext = nullptr;
+    bool m_pendingInsideInterrupt = false;
+    // A non-transfer exception escaping guest code, rethrown by the executor
+    // once it is back on its own stack.
+    std::exception_ptr m_fiberException;
+
     mutable std::mutex m_eventMutex;
     std::condition_variable m_eventCv;
     std::deque<EeEvent> m_events;
diff --git a/ps2xRuntime/include/runtime/ps2_pad_host.h b/ps2xRuntime/include/runtime/ps2_pad_host.h
index 74ed9edbf..3cbd06994 100644
--- a/ps2xRuntime/include/runtime/ps2_pad_host.h
+++ b/ps2xRuntime/include/runtime/ps2_pad_host.h
@@ -14,4 +14,12 @@ void ps2PadPollHost();
 // button encoding, with `pressed` carrying edges seen since the last call.
 void ps2PadPublishHostState(uint32_t held, uint32_t pressed, uint32_t sticks);
 
+// Clock for DQ8_PAD_SCRIPT, in guest vsync ticks rather than host frames: the
+// game runs well under 60 fps, so a script timed in host frames would fire at
+// the wrong point in the game and replay differently on every run.
+void ps2PadSetGuestFrame(uint64_t frame);
+
+// The same clock, for anything that wants to name its output in script time.
+uint64_t ps2PadCurrentGuestFrame();
+
 #endif
diff --git a/ps2xRuntime/src/lib/Kernel/EeFiber.cpp b/ps2xRuntime/src/lib/Kernel/EeFiber.cpp
new file mode 100644
index 000000000..5338f4b3f
--- /dev/null
+++ b/ps2xRuntime/src/lib/Kernel/EeFiber.cpp
@@ -0,0 +1,274 @@
+#include "runtime/ee_fiber.h"
+
+#include <cstdlib>
+#include <cstring>
+#include <new>
+
+#if defined(__unix__) || defined(__APPLE__)
+#include <sys/mman.h>
+#define EE_FIBER_HAVE_MMAP 1
+#else
+#define EE_FIBER_HAVE_MMAP 0
+#endif
+
+namespace
+{
+    // Whole mapping including one guard page at the low end.
+    void *mmapStack(size_t bytes)
+    {
+#if EE_FIBER_HAVE_MMAP
+        void *base = mmap(nullptr, bytes, PROT_READ | PROT_WRITE,
+                          MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        if (base == MAP_FAILED)
+        {
+            return nullptr;
+        }
+        if (mprotect(base, 4096u, PROT_NONE) != 0)
+        {
+            munmap(base, bytes);
+            return nullptr;
+        }
+        return base;
+#else
+        return std::aligned_alloc(64u, bytes);
+#endif
+    }
+
+    void munmapStack(void *base, size_t bytes)
+    {
+#if EE_FIBER_HAVE_MMAP
+        if (base != nullptr)
+        {
+            munmap(base, bytes);
+        }
+#else
+        (void)bytes;
+        std::free(base);
+#endif
+    }
+} // namespace
+
+#if defined(__x86_64__) && (defined(__linux__) || defined(__unix__) || defined(__APPLE__))
+#define EE_FIBER_FAST_X86_64 1
+#else
+#define EE_FIBER_FAST_X86_64 0
+#include <ucontext.h>
+#endif
+
+namespace
+{
+#if EE_FIBER_FAST_X86_64
+    // void eeFiberSwitch(void **saveSp, void *targetSp)
+    //
+    // Saves the callee-saved registers and the FP control words on the current
+    // stack, records the resulting stack pointer through saveSp, switches to
+    // targetSp and restores the same set from there. The final `ret` lands on
+    // whatever return address that stack was suspended at -- for a fresh fiber,
+    // the trampoline create() planted.
+    extern "C" void eeFiberSwitch(void **saveSp, void *targetSp);
+    __asm__(
+        ".text\n"
+        ".globl eeFiberSwitch\n"
+        ".hidden eeFiberSwitch\n"
+        ".type eeFiberSwitch,@function\n"
+        ".align 16\n"
+        "eeFiberSwitch:\n"
+        "    pushq %rbp\n"
+        "    pushq %rbx\n"
+        "    pushq %r12\n"
+        "    pushq %r13\n"
+        "    pushq %r14\n"
+        "    pushq %r15\n"
+        "    subq  $8, %rsp\n"
+        "    stmxcsr (%rsp)\n"
+        "    fnstcw 4(%rsp)\n"
+        "    movq %rsp, (%rdi)\n"
+        "    movq %rsi, %rsp\n"
+        "    ldmxcsr (%rsp)\n"
+        "    fldcw 4(%rsp)\n"
+        "    addq $8, %rsp\n"
+        "    popq %r15\n"
+        "    popq %r14\n"
+        "    popq %r13\n"
+        "    popq %r12\n"
+        "    popq %rbx\n"
+        "    popq %rbp\n"
+        "    ret\n"
+        ".size eeFiberSwitch,.-eeFiberSwitch\n");
+
+    struct FiberBootstrap
+    {
+        EeFiber::EntryFn entry;
+        void *user;
+    };
+
+    // Reached by the first `ret` out of eeFiberSwitch. %rbx carries the
+    // bootstrap because create() planted it in the saved-register slot.
+    extern "C" void eeFiberTrampoline();
+    __asm__(
+        ".text\n"
+        ".globl eeFiberTrampoline\n"
+        ".hidden eeFiberTrampoline\n"
+        ".type eeFiberTrampoline,@function\n"
+        ".align 16\n"
+        "eeFiberTrampoline:\n"
+        // Entered by `ret`, so rsp%16 == 8 as at any function entry. SysV wants
+        // rsp%16 == 0 immediately before a call; without this the callee's
+        // 16-byte SSE spills fault.
+        "    subq $8, %rsp\n"
+        "    movq %rbx, %rdi\n"
+        "    call eeFiberEnter\n"
+        "    hlt\n" // eeFiberEnter never returns
+        ".size eeFiberTrampoline,.-eeFiberTrampoline\n");
+
+    extern "C" void eeFiberEnter(void *bootstrap)
+    {
+        auto *boot = static_cast<FiberBootstrap *>(bootstrap);
+        boot->entry(boot->user);
+        std::abort(); // entry must never return
+    }
+#else
+    struct FiberPlatform
+    {
+        ucontext_t fiber{};
+        ucontext_t caller{};
+        EeFiber::EntryFn entry = nullptr;
+        void *user = nullptr;
+    };
+
+    FiberPlatform *g_startingFiber = nullptr;
+
+    void fiberTrampoline()
+    {
+        FiberPlatform *self = g_startingFiber;
+        self->entry(self->user);
+        std::abort();
+    }
+#endif
+} // namespace
+
+bool EeFiber::usingFastSwitch() noexcept
+{
+    return EE_FIBER_FAST_X86_64 != 0;
+}
+
+EeFiber::~EeFiber()
+{
+    destroy();
+}
+
+void EeFiber::destroy()
+{
+#if !EE_FIBER_FAST_X86_64
+    delete static_cast<FiberPlatform *>(m_platform);
+#else
+    std::free(m_platform);
+#endif
+    m_platform = nullptr;
+    munmapStack(m_stack, m_stackBytes);
+    m_stack = nullptr;
+    m_stackBytes = 0u;
+    m_fiberSp = nullptr;
+    m_returnSp = nullptr;
+}
+
+bool EeFiber::create(EntryFn entry, void *user, size_t stackBytes)
+{
+    destroy();
+    if (entry == nullptr || stackBytes < 64u * 1024u)
+    {
+        return false;
+    }
+    // Guest call chains nest in C++ through dispatchGuestBranch, so a fiber
+    // stack can run deep. Map it with a PROT_NONE guard page at the low end:
+    // an overflow then faults on the guard instead of quietly writing into
+    // whatever the allocator put underneath.
+    const size_t pageSize = 4096u;
+    const size_t mapped = ((stackBytes + pageSize - 1u) / pageSize) * pageSize + pageSize;
+    void *base = mmapStack(mapped);
+    if (base == nullptr)
+    {
+        return false;
+    }
+    void *stack = static_cast<char *>(base) + pageSize;
+    m_stack = base;
+    m_stackBytes = mapped;
+    stackBytes = mapped - pageSize;
+
+#if EE_FIBER_FAST_X86_64
+    auto *boot = static_cast<FiberBootstrap *>(std::malloc(sizeof(FiberBootstrap)));
+    if (boot == nullptr)
+    {
+        destroy();
+        return false;
+    }
+    boot->entry = entry;
+    boot->user = user;
+    m_platform = boot;
+
+    // Build the frame eeFiberSwitch will pop: FP words, r15..rbx, rbp, then the
+    // return address it rets to. rbx carries the bootstrap into the trampoline.
+    auto *top = reinterpret_cast<uintptr_t *>(static_cast<char *>(stack) + stackBytes);
+    top = reinterpret_cast<uintptr_t *>(reinterpret_cast<uintptr_t>(top) & ~static_cast<uintptr_t>(15));
+    // SysV wants rsp % 16 == 8 on entry, i.e. the return-address slot 16-aligned.
+    *--top = 0u;                                              // alignment padding
+    *--top = reinterpret_cast<uintptr_t>(&eeFiberTrampoline); // ret target
+    *--top = 0u;                                              // rbp
+    *--top = reinterpret_cast<uintptr_t>(boot);               // rbx
+    *--top = 0u;                                              // r12
+    *--top = 0u;                                              // r13
+    *--top = 0u;                                              // r14
+    *--top = 0u;                                              // r15
+    // mxcsr (low 32) + x87 control word (next 16), matching the switch's layout.
+    uint32_t mxcsr = 0x1F80u;
+    uint16_t fcw = 0x037Fu;
+    __asm__ __volatile__("stmxcsr %0" : "=m"(mxcsr));
+    __asm__ __volatile__("fnstcw %0" : "=m"(fcw));
+    --top;
+    std::memcpy(top, &mxcsr, sizeof(mxcsr));
+    std::memcpy(reinterpret_cast<char *>(top) + 4, &fcw, sizeof(fcw));
+    m_fiberSp = top;
+#else
+    auto *platform = new (std::nothrow) FiberPlatform();
+    if (platform == nullptr)
+    {
+        destroy();
+        return false;
+    }
+    platform->entry = entry;
+    platform->user = user;
+    if (getcontext(&platform->fiber) != 0)
+    {
+        delete platform;
+        destroy();
+        return false;
+    }
+    platform->fiber.uc_stack.ss_sp = stack;
+    platform->fiber.uc_stack.ss_size = stackBytes;
+    platform->fiber.uc_link = nullptr;
+    makecontext(&platform->fiber, fiberTrampoline, 0);
+    m_platform = platform;
+#endif
+    return true;
+}
+
+void EeFiber::resume()
+{
+#if EE_FIBER_FAST_X86_64
+    eeFiberSwitch(&m_returnSp, m_fiberSp);
+#else
+    auto *platform = static_cast<FiberPlatform *>(m_platform);
+    g_startingFiber = platform;
+    swapcontext(&platform->caller, &platform->fiber);
+#endif
+}
+
+void EeFiber::suspend()
+{
+#if EE_FIBER_FAST_X86_64
+    eeFiberSwitch(&m_fiberSp, m_returnSp);
+#else
+    auto *platform = static_cast<FiberPlatform *>(m_platform);
+    swapcontext(&platform->fiber, &platform->caller);
+#endif
+}
diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index cbaf8966c..81f14208f 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -22,6 +22,8 @@ std::atomic<uint64_t> g_eeGuestDispatchCount{0};
 // whether the executor is re-entering guest code because a transfer asked it
 // to, or because the call chain has to be rebuilt after one.
 std::atomic<uint64_t> g_eeTransferThrowCount{0};
+// Transfers served by suspending the guest stack instead of unwinding it.
+std::atomic<uint64_t> g_eeTransferSuspendCount{0};
 
 namespace
 {
@@ -235,6 +237,34 @@ void EeScheduler::run()
 
         GuestThread *running = currentThread();
         assert(running != nullptr);
+
+        // Suspended part way through a guest call: its stack is still live, so
+        // resume it rather than dispatching the saved pc, which points into the
+        // middle of a function the fiber is already executing.
+        if (running->inGuestCall)
+        {
+            enterGuest(*running);
+            if (m_fiberException)
+            {
+                std::exception_ptr escaped;
+                escaped.swap(m_fiberException);
+                m_running.store(false, std::memory_order_release);
+                publishSnapshotNow();
+                std::rethrow_exception(escaped);
+            }
+            processPendingEvents();
+            if (m_rescheduleRequested && m_currentThreadId != 0)
+            {
+                GuestThread *preempted = currentThread();
+                assert(preempted != nullptr);
+                enqueueReady(*preempted, !m_timeSliceExpired);
+                m_currentThreadId = 0;
+                m_rescheduleRequested = false;
+                m_timeSliceExpired = false;
+            }
+            continue;
+        }
+
         if (running->resumeCompletion)
         {
             auto completion = std::move(running->resumeCompletion);
@@ -363,29 +393,19 @@ void EeScheduler::run()
             continue;
         }
 
-        try
-        {
-            m_insideInterrupt = !running->invocations.empty() && running->invocations.back().kind == GuestInvocationKind::Interrupt;
-            m_guestExecuting.store(true, std::memory_order_release);
-            m_dispatchedThreadId = running->id;
-            function(m_rdram, &context, &m_runtime);
-            m_dispatchedThreadId = 0;
-            m_guestExecuting.store(false, std::memory_order_release);
-            m_insideInterrupt = false;
-        }
-        catch (const EeDispatcherTransfer &)
-        {
-            m_dispatchedThreadId = 0;
-            m_guestExecuting.store(false, std::memory_order_release);
-            m_insideInterrupt = false;
-        }
-        catch (...)
+        m_pendingFunction = function;
+        m_pendingContext = &context;
+        m_pendingInsideInterrupt =
+            !running->invocations.empty() &&
+            running->invocations.back().kind == GuestInvocationKind::Interrupt;
+        enterGuest(*running);
+        if (m_fiberException)
         {
-            m_dispatchedThreadId = 0;
-            m_guestExecuting.store(false, std::memory_order_release);
+            std::exception_ptr escaped;
+            escaped.swap(m_fiberException);
             m_running.store(false, std::memory_order_release);
-            publishSnapshot();
-            throw;
+            publishSnapshotNow();
+            std::rethrow_exception(escaped);
         }
 
         processPendingEvents();
@@ -749,7 +769,7 @@ void EeScheduler::sleepCurrent()
         setReturnS32(&self->activeContext(), KE_OK);
         return;
     }
-    blockCurrent(EeWaitState{EeWaitReason::Sleep, std::monostate{}});
+    blockCurrentResumable(EeWaitState{EeWaitReason::Sleep, std::monostate{}});
 }
 
 int EeScheduler::wakeupThread(int id, bool interruptSafe)
@@ -914,39 +934,21 @@ void EeScheduler::transferIfRequested(bool interruptSafe)
         m_currentThreadId = 0;
     }
 
-    // A yield that lands back on the thread we are already executing does not
-    // need the C++ stack torn down and rebuilt. Unwinding EeDispatcherTransfer
-    // through the guest's frames was ~40% of EE time during a movie, because
-    // DQ8's movie producer yields thousands of times per frame and almost
-    // always ends up running again immediately.
-    if (m_dispatchedThreadId != 0 &&
-        m_pendingInvocations.empty() &&
-        peekReadyId() == m_dispatchedThreadId &&
-        !mustReturnToDispatcher())
-    {
-        // Charge what the dispatch loop would have charged, so the time slice
-        // and the EE timers still advance and this cannot spin forever.
-        accountCycles(kGuestDispatchCycles);
-        GuestThread *next = selectReady();
-        assert(next != nullptr && next->id == m_dispatchedThreadId);
-        if (next != nullptr && next->id == m_dispatchedThreadId)
-        {
-            next->status = EeThreadStatus::Running;
-            m_currentThreadId = next->id;
-            m_rescheduleRequested = false;
-            m_timeSliceExpired = false;
-            return;
-        }
-        // peekReadyId lied, so put it back and take the slow path.
-        if (next != nullptr)
-        {
-            enqueueReady(*next, true);
-        }
-    }
-
     m_rescheduleRequested = false;
     m_timeSliceExpired = false;
     publishSnapshot();
+
+    // The thread stays runnable, so its C++ stack is still wanted: suspend it
+    // rather than unwinding and rebuilding it. Only the executor's own stack
+    // has nowhere to suspend to (direct-syscall tests, embedders), and it still
+    // throws.
+    if (m_activeFiber != nullptr)
+    {
+        g_eeTransferSuspendCount.fetch_add(1u, std::memory_order_relaxed);
+        m_activeFiber->suspend();
+        return;
+    }
+
     g_eeTransferThrowCount.fetch_add(1u, std::memory_order_relaxed);
     throw EeDispatcherTransfer{};
 }
@@ -1063,7 +1065,7 @@ void EeScheduler::waitSemaphore(int id)
     GuestThread *self = currentThread();
     assert(self != nullptr);
     object->waiters.push_back(self->id);
-    blockCurrent(EeWaitState{EeWaitReason::Semaphore, EeSemaphoreWait{id}});
+    blockCurrentResumable(EeWaitState{EeWaitReason::Semaphore, EeSemaphoreWait{id}});
 }
 
 int EeScheduler::createEventFlag(uint32_t initialBits, uint32_t attr, uint32_t option)
@@ -1186,8 +1188,8 @@ void EeScheduler::waitEventFlag(int id, uint32_t bits, uint32_t mode, uint32_t r
         return;
     }
     flag->waiters.push_back(self->id);
-    blockCurrent(EeWaitState{EeWaitReason::EventFlag,
-                             EeEventFlagWait{id, bits, mode, resultAddress}});
+    blockCurrentResumable(EeWaitState{EeWaitReason::EventFlag,
+                                      EeEventFlagWait{id, bits, mode, resultAddress}});
 }
 
 int EeScheduler::setAlarm(uint16_t ticks,
@@ -1807,32 +1809,82 @@ GuestThread *EeScheduler::selectReady()
     return nullptr;
 }
 
-int EeScheduler::peekReadyId() const
+void EeScheduler::fiberEntry(void *user)
+{
+    auto *self = static_cast<EeScheduler *>(user);
+    for (;;)
+    {
+        self->runPendingGuestCall();
+        // The dispatch is over; hand the executor back its stack. Resumed when
+        // this thread is scheduled again with a new pending call.
+        self->m_activeFiber->suspend();
+    }
+}
+
+// Runs on the fiber's stack. Nothing may escape it: an exception unwinding past
+// the fiber entry has no frame to land on.
+void EeScheduler::runPendingGuestCall()
 {
-    for (const auto &queue : m_readyQueues)
+    PS2Runtime::RecompiledFunction function = m_pendingFunction;
+    R5900Context *context = m_pendingContext;
+    m_pendingFunction = nullptr;
+    m_pendingContext = nullptr;
+    try
     {
-        if (!queue.empty())
+        m_insideInterrupt = m_pendingInsideInterrupt;
+        m_guestExecuting.store(true, std::memory_order_release);
+        if (function != nullptr && context != nullptr)
         {
-            return queue.front();
+            function(m_rdram, context, &m_runtime);
         }
     }
-    return 0;
+    catch (const EeDispatcherTransfer &)
+    {
+        // A block, an invocation push or a thread exit. The stack is unwound,
+        // so the next dispatch starts from the thread's saved pc again.
+    }
+    catch (...)
+    {
+        m_fiberException = std::current_exception();
+    }
+    m_guestExecuting.store(false, std::memory_order_release);
+    m_insideInterrupt = false;
+    m_dispatchedThreadId = 0;
 }
 
-bool EeScheduler::mustReturnToDispatcher() const noexcept
+void EeScheduler::enterGuest(GuestThread &thread)
 {
-    // The same conditions checkpointDue() uses, minus its side effects.
-    if (m_checkpointPending.load(std::memory_order_acquire) ||
-        m_stopRequested.load(std::memory_order_acquire))
+    if (!thread.fiber)
     {
-        return true;
+        // Sized for deeply nested guest call chains; mapped lazily, so the
+        // resident cost is only the pages a thread actually touches.
+        static const size_t stackBytes = [] {
+            const char *value = std::getenv("DQ8_EE_FIBER_STACK_KB");
+            const long long parsed = value ? std::atoll(value) : 0;
+            const size_t kb = parsed > 0 ? static_cast<size_t>(parsed) : 8192u;
+            return kb * 1024u;
+        }();
+        thread.fiber = std::make_unique<EeFiber>();
+        if (!thread.fiber->create(&EeScheduler::fiberEntry, this, stackBytes))
+        {
+            thread.fiber.reset();
+            throw std::runtime_error("EE scheduler could not allocate a guest fiber stack");
+        }
     }
-    const uint64_t nextEventCycle = m_nextDeadlineCycle.load(std::memory_order_acquire);
-    if (nextEventCycle != 0u && m_eeCycle >= nextEventCycle)
+
+    assert(m_activeFiber == nullptr && "guest fibers must not nest");
+    EeFiber *previous = m_activeFiber;
+    m_activeFiber = thread.fiber.get();
+    m_dispatchedThreadId = thread.id;
+    thread.inGuestCall = true;
+    m_activeFiber->resume();
+    m_activeFiber = previous;
+    // Cleared by the fiber when a dispatch finishes; still set means it
+    // suspended part way through and its stack is waiting to be resumed.
+    if (m_dispatchedThreadId == 0)
     {
-        return true;
+        thread.inGuestCall = false;
     }
-    return m_eeCycle >= m_sliceEndCycle;
 }
 
 void EeScheduler::makeRunning(GuestThread &item)
@@ -1898,6 +1950,29 @@ void EeScheduler::blockCurrent(EeWaitState wait)
     throw EeDispatcherTransfer{};
 }
 
+// Blocks and comes back where it left off. Only for waits that carry no
+// completion -- a completion re-invokes its syscall on wake, which would run
+// twice if the stack were still there -- and whose caller has nothing left to
+// do afterwards, so returning here returns into the guest. blockCurrent()
+// stays [[noreturn]] for everyone else, including the [[noreturn]] waitVSync
+// and waitExternal, whose completions are optional.
+void EeScheduler::blockCurrentResumable(EeWaitState wait)
+{
+    assert(!wait.completion && "a resumable block must not carry a completion");
+    if (m_activeFiber == nullptr)
+    {
+        blockCurrent(std::move(wait));
+    }
+    GuestThread *self = currentThread();
+    assert(self != nullptr);
+    self->wait = std::move(wait);
+    self->status = self->suspendCount == 0 ? EeThreadStatus::Waiting : EeThreadStatus::WaitingSuspended;
+    m_currentThreadId = 0;
+    publishSnapshot();
+    g_eeTransferSuspendCount.fetch_add(1u, std::memory_order_relaxed);
+    m_activeFiber->suspend();
+}
+
 void EeScheduler::makeReady(GuestThread &item, int result, bool interruptSafe)
 {
     auto completion = std::move(item.wait.completion);
diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
index 4cf554b36..fef2e489c 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
@@ -550,6 +550,7 @@ namespace ps2_stubs
             int64_t dts90k = -1;
         };
 
+
         struct MpegPlaybackState
         {
             uint32_t picturesServed = 0u;
@@ -2491,6 +2492,7 @@ namespace ps2_stubs
         {
             std::unique_lock<std::mutex> lock(g_mpeg_stub_mutex);
             MpegPlaybackState &playback = getPlaybackState(mpegAddr);
+            {
             // The consumer drives decode: demux only buffers.
             decodePendingElementaryStream(playback);
             // sawSequenceEnd is the only end-of-video signal a game streaming
@@ -2598,6 +2600,7 @@ namespace ps2_stubs
             movieEnded = !haveFrame && playback.decodedFrames.empty() && playback.pendingEs.empty() &&
                          (playback.sawSequenceEnd || playback.streamEnded ||
                           playback.decoderFailed || g_mpeg_stub_state.currentCdStreamEofSeen);
+            }
         }
 
         mpegGuestWrite32(rdram, mpegAddr + 0x00u, width);
diff --git a/ps2xRuntime/src/lib/gs/gs_frontend.cpp b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
index 6d99b04c9..aa622f741 100644
--- a/ps2xRuntime/src/lib/gs/gs_frontend.cpp
+++ b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
@@ -2,15 +2,22 @@
 #include "runtime/gs/gs_cpu_backend.h"
 #include "ps2_log.h"
 #include "runtime/ps2_memory.h"
+
+// Weak on purpose: the offline gs-dump harness links this file without the pad
+// backend, and there a screenshot just falls back to counting latches.
+extern "C++" __attribute__((weak)) uint64_t ps2PadCurrentGuestFrame();
 #include <atomic>
 #include <algorithm>
 #include <chrono>
 #include <cmath>
 #include <cstdio>
+#include <cstdlib>
 #include <cstring>
+#include <fstream>
 #include <iostream>
 #include <limits>
 #include <sstream>
+#include <string>
 
 namespace
 {
@@ -525,6 +532,8 @@ GSPresentationRequest GS::buildPresentationRequestUnlocked() const
     return request;
 }
 
+static void maybeWriteScreenshot(GS &gs);
+
 void GS::latchHostPresentationFrame()
 {
     GSPresentationRequest request{};
@@ -578,6 +587,11 @@ void GS::latchHostPresentationFrame()
         m_hasHostPresentationFrame = hasHostFrame;
     }
 
+    if (hasHostFrame)
+    {
+        maybeWriteScreenshot(*this);
+    }
+
     if (presented)
     {
         std::lock_guard<std::recursive_mutex> lock(m_stateMutex);
@@ -585,6 +599,80 @@ void GS::latchHostPresentationFrame()
     }
 }
 
+// DQ8_GFX_SCREENSHOT_DIR + DQ8_GFX_SCREENSHOT_EVERY=N dump the presented frame
+// as a binary PPM every N frames. PPM keeps this dependency-free; convert with
+// `ffmpeg -i shot.ppm shot.png` when a viewer is wanted. A backend that presents
+// natively skips the CPU compose, so it disables that fast path while this is on.
+//
+// A free function on purpose: gs_frontend.h reaches the whole recompiled corpus
+// through ps2_runtime.h, so declaring this on GS would cost a full rebuild.
+static void maybeWriteScreenshot(GS &gs)
+{
+    struct Config
+    {
+        std::string directory;
+        uint64_t every = 0u;
+    };
+    static const Config config = [] {
+        Config parsed{};
+        const char *dir = std::getenv("DQ8_GFX_SCREENSHOT_DIR");
+        if (dir == nullptr || *dir == '\0')
+        {
+            return parsed;
+        }
+        parsed.directory = dir;
+        const char *every = std::getenv("DQ8_GFX_SCREENSHOT_EVERY");
+        const long long value = every ? std::atoll(every) : 0;
+        parsed.every = value > 0 ? static_cast<uint64_t>(value) : 60ull;
+        return parsed;
+    }();
+    if (config.every == 0u)
+    {
+        return;
+    }
+
+    // Named by guest vsync tick, the same clock DQ8_PAD_SCRIPT uses, so a
+    // screenshot tells you directly which frame to script an input at.
+    static uint64_t s_latches = 0u;
+    const uint64_t frame =
+        ps2PadCurrentGuestFrame != nullptr ? ps2PadCurrentGuestFrame() : s_latches++;
+    static uint64_t s_lastWritten = std::numeric_limits<uint64_t>::max();
+    if (s_lastWritten != std::numeric_limits<uint64_t>::max() &&
+        frame < s_lastWritten + config.every)
+    {
+        return;
+    }
+    s_lastWritten = frame;
+
+    std::vector<uint8_t> pixels;
+    uint32_t width = 0u;
+    uint32_t height = 0u;
+    if (!gs.copyLatchedHostPresentationFrame(pixels, width, height, nullptr, nullptr, nullptr) ||
+        width == 0u || height == 0u)
+    {
+        return;
+    }
+
+    char path[512];
+    std::snprintf(path, sizeof(path), "%s/frame_%06llu.ppm", config.directory.c_str(),
+                  static_cast<unsigned long long>(frame));
+    std::ofstream out(path, std::ios::binary);
+    if (!out)
+    {
+        return;
+    }
+    out << "P6\n" << width << " " << height << "\n255\n";
+    // copyLatchedHostPresentationFrame hands back tightly packed RGBA.
+    std::vector<uint8_t> rgb(static_cast<size_t>(width) * height * 3u);
+    for (size_t i = 0u, n = static_cast<size_t>(width) * height; i < n; ++i)
+    {
+        rgb[i * 3u + 0u] = pixels[i * 4u + 0u];
+        rgb[i * 3u + 1u] = pixels[i * 4u + 1u];
+        rgb[i * 3u + 2u] = pixels[i * 4u + 2u];
+    }
+    out.write(reinterpret_cast<const char *>(rgb.data()), static_cast<std::streamsize>(rgb.size()));
+}
+
 bool GS::copyLatchedHostPresentationFrame(std::vector<uint8_t> &outPixels,
                                           uint32_t &outWidth,
                                           uint32_t &outHeight,
diff --git a/ps2xRuntime/src/lib/ps2_pad.cpp b/ps2xRuntime/src/lib/ps2_pad.cpp
index db37b887e..d9a0a4e39 100644
--- a/ps2xRuntime/src/lib/ps2_pad.cpp
+++ b/ps2xRuntime/src/lib/ps2_pad.cpp
@@ -1,9 +1,21 @@
 #include "runtime/ps2_pad.h"
 #include "runtime/ps2_pad_host.h"
 #include "ps2_host_backend.h"
+#include <algorithm>
 #include <atomic>
+#include <cctype>
 #include <chrono>
+#include <cstdio>
+#include <cstdlib>
 #include <cstring>
+#include <fstream>
+#include <sstream>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+// Defined by the MPEG stub; advances once per picture the game asks for.
+extern std::atomic<uint64_t> g_mpegGetPictureCount;
 
 namespace
 {
@@ -167,10 +179,201 @@ namespace
 
 namespace
 {
+    // Scripted input. DQ8_PAD_SCRIPT is either a file path or the script text
+    // itself, entries separated by ';' or newlines:
+    //
+    //     <guest-frame> <BUTTON>[+<BUTTON>...] [hold-frames]
+    //
+    // Timed in guest vsync ticks so a script replays the same way whether the
+    // game is running at 3 fps or 60. Lines starting with '#' are comments.
+    struct PadScriptEvent
+    {
+        uint64_t frame = 0u;
+        uint64_t holdFrames = 4u;
+        uint32_t mask = 0u;
+        bool active = false;
+    };
+
+    std::atomic<uint64_t> g_guestFrame{0u};
+    std::vector<PadScriptEvent> g_padScript;
+    bool g_padScriptVerbose = false;
+
+    uint32_t padScriptButtonMask(const std::string &name)
+    {
+        static const std::unordered_map<std::string, uint32_t> kNames = {
+            {"UP", PAD_UP}, {"DOWN", PAD_DOWN}, {"LEFT", PAD_LEFT}, {"RIGHT", PAD_RIGHT},
+            {"CROSS", PAD_CROSS}, {"CIRCLE", PAD_CIRCLE}, {"SQUARE", PAD_SQUARE},
+            {"TRIANGLE", PAD_TRIANGLE}, {"START", PAD_START}, {"SELECT", PAD_SELECT},
+            {"L1", PAD_L1}, {"R1", PAD_R1}, {"L2", PAD_L2}, {"R2", PAD_R2},
+            {"L3", PAD_L3}, {"R3", PAD_R3},
+        };
+        std::string upper;
+        upper.reserve(name.size());
+        for (const char c : name)
+        {
+            upper.push_back(static_cast<char>(std::toupper(static_cast<unsigned char>(c))));
+        }
+        const auto it = kNames.find(upper);
+        return it == kNames.end() ? 0u : it->second;
+    }
+
+    void parsePadScript(const std::string &text)
+    {
+        std::string entry;
+        std::istringstream stream(text);
+        while (std::getline(stream, entry, '\n'))
+        {
+            std::string chunk;
+            std::istringstream entries(entry);
+            while (std::getline(entries, chunk, ';'))
+            {
+                const size_t hash = chunk.find('#');
+                if (hash != std::string::npos)
+                {
+                    chunk.erase(hash);
+                }
+                std::istringstream fields(chunk);
+                uint64_t frame = 0u;
+                std::string buttons;
+                if (!(fields >> frame >> buttons))
+                {
+                    continue;
+                }
+                PadScriptEvent event{};
+                event.frame = frame;
+                uint64_t hold = 0u;
+                if (fields >> hold && hold > 0u)
+                {
+                    event.holdFrames = hold;
+                }
+                size_t start = 0u;
+                while (start <= buttons.size())
+                {
+                    const size_t plus = buttons.find('+', start);
+                    const std::string name = buttons.substr(
+                        start, plus == std::string::npos ? std::string::npos : plus - start);
+                    const uint32_t mask = padScriptButtonMask(name);
+                    if (mask == 0u && !name.empty())
+                    {
+                        std::fprintf(stderr, "[pad] unknown button in DQ8_PAD_SCRIPT: '%s'\n",
+                                     name.c_str());
+                    }
+                    event.mask |= mask;
+                    if (plus == std::string::npos)
+                    {
+                        break;
+                    }
+                    start = plus + 1u;
+                }
+                if (event.mask != 0u)
+                {
+                    g_padScript.push_back(event);
+                }
+            }
+        }
+        std::sort(g_padScript.begin(), g_padScript.end(),
+                  [](const PadScriptEvent &l, const PadScriptEvent &r) { return l.frame < r.frame; });
+    }
+
+    void ensurePadScriptLoaded()
+    {
+        static const bool loaded = [] {
+            const char *value = std::getenv("DQ8_PAD_SCRIPT");
+            g_padScriptVerbose = std::getenv("DQ8_PAD_SCRIPT_VERBOSE") != nullptr;
+            if (value == nullptr || *value == '\0')
+            {
+                return true;
+            }
+            std::ifstream file(value);
+            if (file)
+            {
+                std::ostringstream contents;
+                contents << file.rdbuf();
+                parsePadScript(contents.str());
+            }
+            else
+            {
+                parsePadScript(value);
+            }
+            std::fprintf(stderr, "[pad] DQ8_PAD_SCRIPT: %zu events\n", g_padScript.size());
+            return true;
+        }();
+        (void)loaded;
+    }
+
+    // Merges scripted buttons into whatever the host sampled, so a human can
+    // still take over while a script is running.
+    void applyPadScript(uint32_t &held, uint32_t &pressed)
+    {
+        ensurePadScriptLoaded();
+        if (g_padScript.empty())
+        {
+            return;
+        }
+        const uint64_t frame = g_guestFrame.load(std::memory_order_relaxed);
+        for (PadScriptEvent &event : g_padScript)
+        {
+            const bool on = frame >= event.frame && frame < event.frame + event.holdFrames;
+            if (on)
+            {
+                held |= event.mask;
+                if (!event.active)
+                {
+                    pressed |= event.mask;
+                    event.active = true;
+                    if (g_padScriptVerbose)
+                    {
+                        std::fprintf(stderr, "[pad] frame %llu: press 0x%04x\n",
+                                     static_cast<unsigned long long>(frame), event.mask);
+                    }
+                }
+            }
+            else
+            {
+                event.active = false;
+            }
+        }
+    }
+
+    // DQ8_SKIP_MOVIES=1 taps START while a movie is running, which is the
+    // game's own skip. Faking end-of-stream inside the MPEG stub was tried
+    // instead and leaves the movie's streaming thread spinning forever on a
+    // black screen: the guest state machine never learns the movie is over.
+    // g_mpegGetPictureCount advancing is the signal that one is playing.
+    void applyMovieSkip(uint32_t &held, uint32_t &pressed)
+    {
+        static const bool enabled = [] {
+            const char *value = std::getenv("DQ8_SKIP_MOVIES");
+            return value != nullptr && *value != '\0' && *value != '0';
+        }();
+        if (!enabled)
+        {
+            return;
+        }
+        static uint64_t lastPictureCount = 0u;
+        static uint32_t sincePress = 0u;
+        const uint64_t pictures = g_mpegGetPictureCount.load(std::memory_order_relaxed);
+        if (pictures == lastPictureCount)
+        {
+            sincePress = 0u;
+            return;
+        }
+        lastPictureCount = pictures;
+        // An edge now and then, not a hold: the title screen that follows takes
+        // START too, and one held press would walk straight through it.
+        if ((sincePress++ % 12u) == 0u)
+        {
+            held |= PAD_START;
+            pressed |= PAD_START;
+        }
+    }
+
     // Shared tail of both host paths: publish held state and latch edges long
     // enough that a tap between two guest polls is not lost.
     void publishHostState(uint32_t held, uint32_t pressed, uint32_t sticks)
     {
+        applyPadScript(held, pressed);
+        applyMovieSkip(held, pressed);
         g_held.store(held);
         g_sticks.store(sticks);
 
@@ -200,6 +403,16 @@ void ps2PadPublishHostState(uint32_t held, uint32_t pressed, uint32_t sticks)
     publishHostState(held, pressed, sticks);
 }
 
+void ps2PadSetGuestFrame(uint64_t frame)
+{
+    g_guestFrame.store(frame, std::memory_order_relaxed);
+}
+
+uint64_t ps2PadCurrentGuestFrame()
+{
+    return g_guestFrame.load(std::memory_order_relaxed);
+}
+
 void ps2PadPollHost()
 {
     if (!IsWindowReady())
@@ -211,28 +424,7 @@ void ps2PadPollHost()
     uint32_t pressed = 0u;
     uint32_t sticks = kPadStickNeutral;
     sampleHost(true, held, pressed, sticks);
-
-    g_held.store(held);
-    g_sticks.store(sticks);
-
-    const uint64_t now = nowMs();
-    if (pressed != 0u)
-    {
-        if (g_latched.fetch_or(pressed) == 0u)
-        {
-            g_latchStampMs.store(now);
-        }
-    }
-    else
-    {
-        const uint32_t stale = g_latched.load();
-        if (stale != 0u && (now - g_latchStampMs.load()) > kLatchTimeoutMs)
-        {
-            g_latched.fetch_and(~stale);
-        }
-    }
-
-    g_hostPolled.store(true);
+    publishHostState(held, pressed, sticks);
 }
 
 bool PSPadBackend::readState(int /*port*/, int /*slot*/, uint8_t *data, size_t size)
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index 670587616..e2e3b2e0a 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -2503,6 +2503,7 @@ void PS2Runtime::run()
         // With an external presenter the backend draws to its own swapchain,
         // so the frame still has to be latched -- that is what calls into the
         // backend's Present() -- but nothing is uploaded or drawn here.
+        ps2PadSetGuestFrame(eeScheduler().currentVSyncTick());
         if (m_framePump)
         {
             static uint64_t s_lastNativeTick = std::numeric_limits<uint64_t>::max();
diff --git a/ps2xTest/CMakeLists.txt b/ps2xTest/CMakeLists.txt
index 39dbc65ef..aa9754b53 100644
--- a/ps2xTest/CMakeLists.txt
+++ b/ps2xTest/CMakeLists.txt
@@ -50,6 +50,7 @@ add_library(ps2_test_lib STATIC
     src/ps2_runtime_io_tests.cpp
     src/ps2_runtime_kernel_tests.cpp
     src/ps2_runtime_interrupt_tests.cpp
+    src/ee_fiber_tests.cpp
     src/ps2_memory_tests.cpp
     src/ps2_vu1_tests.cpp
     src/ps2_vu_tests.cpp
diff --git a/ps2xTest/src/ee_fiber_tests.cpp b/ps2xTest/src/ee_fiber_tests.cpp
new file mode 100644
index 000000000..568ee0a9e
--- /dev/null
+++ b/ps2xTest/src/ee_fiber_tests.cpp
@@ -0,0 +1,147 @@
+#include "MiniTest.h"
+#include "runtime/ee_fiber.h"
+
+#include <cmath>
+#include <string>
+#include <vector>
+
+// The scheduler suspends guest stacks on these instead of unwinding them, so
+// what matters is that a live C++ call chain -- locals, destructors, an
+// in-flight exception -- survives being parked and resumed.
+namespace
+{
+    struct Marker
+    {
+        int *counter;
+        explicit Marker(int *c) : counter(c) {}
+        ~Marker() { ++*counter; }
+    };
+
+    struct Ctx
+    {
+        EeFiber *fiber = nullptr;
+        long rounds = 0;
+        long observed = 0;
+        int destructed = 0;
+        bool caught = false;
+        bool deepOk = false;
+        double fp = 0.0;
+        std::string payload;
+    };
+
+    struct Boom
+    {
+    };
+
+    void deepFrames(Ctx *c, int depth)
+    {
+        Marker marker(&c->destructed);
+        std::string local = "frame-" + std::to_string(depth);
+        if (depth > 0)
+        {
+            deepFrames(c, depth - 1);
+            c->deepOk = c->deepOk && local == ("frame-" + std::to_string(depth));
+            return;
+        }
+        c->deepOk = true;
+        for (int i = 0; i < 4; ++i)
+        {
+            c->payload = "suspended-at-depth";
+            c->fiber->suspend();
+            c->deepOk = c->deepOk && c->payload == "suspended-at-depth";
+        }
+    }
+
+    void fiberBody(void *user)
+    {
+        auto *c = static_cast<Ctx *>(user);
+        for (long i = 0; i < c->rounds; ++i)
+        {
+            ++c->observed;
+            c->fiber->suspend();
+        }
+        deepFrames(c, 32);
+        c->fiber->suspend();
+        try
+        {
+            Marker marker(&c->destructed);
+            throw Boom{};
+        }
+        catch (const Boom &)
+        {
+            c->caught = true;
+        }
+        c->fiber->suspend();
+        c->fp = 0.0;
+        for (int i = 0; i < 8; ++i)
+        {
+            c->fp += std::sqrt(static_cast<double>(i + 1));
+            c->fiber->suspend();
+        }
+        for (;;)
+        {
+            c->fiber->suspend();
+        }
+    }
+} // namespace
+
+void register_ee_fiber_tests()
+{
+    MiniTest::Case("EeFiber", [](TestCase &tc)
+    {
+        tc.Run("a suspended fiber keeps its C++ stack alive", [](TestCase &t)
+        {
+            EeFiber fiber;
+            Ctx ctx;
+            ctx.fiber = &fiber;
+            ctx.rounds = 256;
+            t.IsTrue(fiber.create(fiberBody, &ctx, 1u << 20u), "create succeeds");
+            t.IsTrue(fiber.valid(), "valid after create");
+
+            for (long i = 0; i < ctx.rounds; ++i)
+                fiber.resume();
+            t.Equals(ctx.rounds, ctx.observed, "every round trip ran exactly once");
+
+            for (int i = 0; i < 5; ++i)
+                fiber.resume();
+            t.IsTrue(ctx.deepOk, "a 32-frame call chain survived being suspended");
+            t.IsTrue(ctx.payload == "suspended-at-depth", "locals intact across suspend");
+
+            const int beforeThrow = ctx.destructed;
+            fiber.resume();
+            t.IsTrue(ctx.caught, "an exception is caught inside the fiber");
+            t.IsTrue(ctx.destructed > beforeThrow, "unwinding ran destructors on the fiber stack");
+
+            for (int i = 0; i < 8; ++i)
+                fiber.resume();
+            double expected = 0.0;
+            for (int i = 0; i < 8; ++i)
+                expected += std::sqrt(static_cast<double>(i + 1));
+            t.IsTrue(std::fabs(ctx.fp - expected) < 1e-9, "FP state survives switching");
+        });
+
+        tc.Run("many fibers interleave without disturbing each other", [](TestCase &t)
+        {
+            constexpr int kCount = 32;
+            std::vector<EeFiber> fibers(kCount);
+            std::vector<Ctx> ctxs(kCount);
+            bool created = true;
+            for (int i = 0; i < kCount; ++i)
+            {
+                ctxs[i].fiber = &fibers[i];
+                ctxs[i].rounds = 40;
+                created = created && fibers[i].create(fiberBody, &ctxs[i], 256u * 1024u);
+            }
+            t.IsTrue(created, "all stacks allocated");
+
+            for (int round = 0; round < 40; ++round)
+                for (int i = 0; i < kCount; ++i)
+                    fibers[i].resume();
+
+            bool allRan = true;
+            for (int i = 0; i < kCount; ++i)
+                allRan = allRan && ctxs[i].observed == 40;
+            t.IsTrue(allRan, "each fiber advanced exactly its own count");
+        });
+    });
+}
diff --git a/ps2xTest/src/main.cpp b/ps2xTest/src/main.cpp
index 40a68b16b..528f81341 100644
--- a/ps2xTest/src/main.cpp
+++ b/ps2xTest/src/main.cpp
@@ -9,6 +9,7 @@ void register_pad_input_tests();
 void register_ps2_runtime_io_tests();
 void register_ps2_runtime_kernel_tests();
 void register_ps2_runtime_interrupt_tests();
+void register_ee_fiber_tests();
 void register_ps2_memory_tests();
 void register_ps2_vu1_tests();
 void register_ps2_vu_tests();
@@ -31,6 +32,7 @@ int main()
     register_ps2_runtime_io_tests();
     register_ps2_runtime_kernel_tests();
     register_ps2_runtime_interrupt_tests();
+    register_ee_fiber_tests();
     register_ps2_memory_tests();
     register_ps2_vu1_tests();
     register_ps2_vu_tests();

From 2e538a7fd41c29c72b2dd16c65f3fa4e8aed41a6 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Sun, 23 Aug 2026 14:54:59 +0200
Subject: [PATCH 27/68] Find the memory card, and stop the scheduler scanning
 128 queues a dispatch

DQ8 reported no memory card in either slot because isValidMcPortSlot() demanded
slot == 0 and DQ8 passes slot=1 to every libmc call -- `addiu $a1, $zero, 0x1`
at each of its sceMcGetInfo/GetDir/Delete call sites. Everything downstream
already models a console with no multitap (one card per port, and the mc root
path ignores the slot entirely), so the validator was the odd one out. GetInfo
now answers type=2 free=8192 format=1, the no-card prompt is gone, and the game
goes on to look for its /BASLUS-21207dq8 save directory.

DQ8_MC_TRACE=1 logs the card calls. RUNTIME_LOG is compile-time and sits in a
header the whole recompiled corpus includes, so turning it on to watch one stub
would cost a full rebuild.

Two scheduler costs, found by sampling the EE thread while a movie runs:
selectReady() walked all 128 priority deques on every dispatch (~7% of EE
thread time) and now consults a one-bit-per-priority mask maintained by
refreshReadyMask(); advanceEeTimers() did up to four 64-bit divisions per
enabled timer on every guest safe point, and below one EE second the
whole-seconds term is zero and a sub-tick accumulation needs no division at
all. Movie 6.5 -> 7.2 fps for the two together.

WriteRunCT32/WriteRunZ32 write a run of pixels with the traits and lookup table
inlined, instead of a cross-TU call per pixel; measured no change, because
PixelStorageTraits is only 11% of the profile even as its top leaf. Kept as
strictly less work.

DQ8_SKIP_MOVIES now only lifts the 30fps presentation pacing. Its previous
behaviour -- tapping START -- does nothing, because DQ8's attract movies are
not button-skippable: 314 injected presses through one movie changed nothing.
---
 ps2xRuntime/include/runtime/ee_scheduler.h    |  9 +++
 .../include/runtime/gs/ps2_gs_memory.h        | 12 ++++
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp    | 60 +++++++++++++------
 ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp     | 25 +++++++-
 .../src/lib/Kernel/Stubs/MemoryCard.cpp       | 37 +++++++++++-
 ps2xRuntime/src/lib/gs/ps2_gs_memory.cpp      | 35 +++++++++++
 ps2xRuntime/src/lib/ps2_memory.cpp            | 29 +++++++--
 ps2xRuntime/src/lib/ps2_pad.cpp               | 37 ------------
 8 files changed, 181 insertions(+), 63 deletions(-)

diff --git a/ps2xRuntime/include/runtime/ee_scheduler.h b/ps2xRuntime/include/runtime/ee_scheduler.h
index fe3263c13..9dcb9a5a1 100644
--- a/ps2xRuntime/include/runtime/ee_scheduler.h
+++ b/ps2xRuntime/include/runtime/ee_scheduler.h
@@ -391,6 +391,10 @@ class EeScheduler
     void runPendingGuestCall();
 
     [[nodiscard]] GuestThread *selectReady();
+    // Call after any change to m_readyQueues[priority].
+    void refreshReadyMask(int priority) noexcept;
+    // Highest-priority (lowest index) non-empty queue, or -1 when none.
+    [[nodiscard]] int firstReadyPriority() const noexcept;
     void makeRunning(GuestThread &thread);
     void makeDormant(GuestThread &thread);
     void removeFromWaitObject(GuestThread &thread);
@@ -418,6 +422,11 @@ class EeScheduler
     PS2Runtime &m_runtime;
     uint8_t *m_rdram = nullptr;
     std::array<std::deque<int>, kPriorityCount> m_readyQueues{};
+    // One bit per priority, set while that queue is non-empty. selectReady()
+    // used to scan all 128 deques on every dispatch, which was ~7% of EE thread
+    // time; with this it is a count-trailing-zeros. Kept in sync by
+    // refreshReadyMask(), which every mutation of m_readyQueues calls.
+    std::array<uint64_t, (kPriorityCount + 63) / 64> m_readyMask{};
     std::unordered_map<int, GuestThread> m_threads;
     std::unordered_map<int, EeSemaphore> m_semaphores;
     std::unordered_map<int, EeEventFlag> m_eventFlags;
diff --git a/ps2xRuntime/include/runtime/gs/ps2_gs_memory.h b/ps2xRuntime/include/runtime/gs/ps2_gs_memory.h
index 095e4e5cf..58ce8771b 100644
--- a/ps2xRuntime/include/runtime/gs/ps2_gs_memory.h
+++ b/ps2xRuntime/include/runtime/gs/ps2_gs_memory.h
@@ -541,6 +541,18 @@ namespace GSMem
 	void WriteCT32(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 value);
 	void WriteZ32(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 value);
 
+	// Writes `count` little-endian 32-bit pixels from `src`, starting at (x, y)
+	// and wrapping back to `dsax` when x reaches `rowEnd`. The per-pixel entry
+	// points above are out-of-line wrappers around a template whose lookup table
+	// is private to ps2_gs_memory.cpp, so a caller writing a run of pixels pays a
+	// cross-TU call each time and nothing inlines. A host-to-local transfer moves
+	// 256 pixels per 16x16 tile and DQ8's movies send ~900 tiles a frame, which
+	// made that the hottest thing in the runtime.
+	void WriteRunCT32(u8* data, u32 bp, u32 bw, u32 dsax, u32 rowEnd, u32 x, u32 y,
+	                  const u8* src, u32 count);
+	void WriteRunZ32(u8* data, u32 bp, u32 bw, u32 dsax, u32 rowEnd, u32 x, u32 y,
+	                 const u8* src, u32 count);
+
 	void WriteCT24(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 value);
 	void WriteZ24(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 value);
 
diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index 81f14208f..d482ff27e 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -118,6 +118,7 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     m_executorThread = std::this_thread::get_id();
     m_rdram = rdram;
     m_readyQueues = {};
+    m_readyMask = {};
     // Thread ids restart here, so keyed stacks would otherwise be stranded:
     // the pool below cannot reclaim them either.
     for (const auto &[key, top] : m_invocationStackTops)
@@ -185,6 +186,7 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     main.status = EeThreadStatus::Ready;
     m_threads.emplace(main.id, std::move(main));
     m_readyQueues[0].push_back(kMainThreadId);
+    refreshReadyMask(0);
     scheduleEvent(m_eeCycle + kVBlankPeriodCycles,
                   std::chrono::steady_clock::now() + kVBlankPeriod,
                   EeEvent{EeEventType::VBlankStart, 0, 0});
@@ -848,13 +850,10 @@ int EeScheduler::changePriority(int id, int priority, bool interruptSafe, int &o
         target->currentPriority = priority;
         if (target->status == EeThreadStatus::Running)
         {
-            for (int p = 0; p < target->currentPriority; ++p)
+            const int first = firstReadyPriority();
+            if (first >= 0 && first < target->currentPriority)
             {
-                if (!m_readyQueues[p].empty())
-                {
-                    m_rescheduleRequested = true;
-                    break;
-                }
+                m_rescheduleRequested = true;
             }
         }
     }
@@ -1764,6 +1763,33 @@ GuestThread &EeScheduler::acquireInvocationThread()
     return m_threads.emplace(dispatcher.id, std::move(dispatcher)).first->second;
 }
 
+void EeScheduler::refreshReadyMask(int priority) noexcept
+{
+    const size_t word = static_cast<size_t>(priority) / 64u;
+    const uint64_t bit = uint64_t{1} << (static_cast<size_t>(priority) % 64u);
+    if (m_readyQueues[static_cast<size_t>(priority)].empty())
+    {
+        m_readyMask[word] &= ~bit;
+    }
+    else
+    {
+        m_readyMask[word] |= bit;
+    }
+}
+
+int EeScheduler::firstReadyPriority() const noexcept
+{
+    for (size_t word = 0; word < m_readyMask.size(); ++word)
+    {
+        if (m_readyMask[word] != 0u)
+        {
+            return static_cast<int>(word * 64u +
+                                    static_cast<size_t>(__builtin_ctzll(m_readyMask[word])));
+        }
+    }
+    return -1;
+}
+
 void EeScheduler::enqueueReady(GuestThread &item, bool front)
 {
     assert(item.currentPriority >= 0 && item.currentPriority < kPriorityCount);
@@ -1777,6 +1803,7 @@ void EeScheduler::enqueueReady(GuestThread &item, bool front)
     {
         queue.push_back(item.id);
     }
+    refreshReadyMask(item.currentPriority);
 }
 
 void EeScheduler::removeReady(GuestThread &item)
@@ -1789,18 +1816,19 @@ void EeScheduler::removeReady(GuestThread &item)
     auto it = std::find(queue.begin(), queue.end(), item.id);
     assert(it != queue.end());
     queue.erase(it);
+    refreshReadyMask(item.currentPriority);
 }
 
 GuestThread *EeScheduler::selectReady()
 {
-    for (auto &queue : m_readyQueues)
+    const int priority = firstReadyPriority();
+    if (priority >= 0)
     {
-        if (queue.empty())
-        {
-            continue;
-        }
+        auto &queue = m_readyQueues[static_cast<size_t>(priority)];
+        assert(!queue.empty());
         const int id = queue.front();
         queue.pop_front();
+        refreshReadyMask(priority);
         GuestThread *selected = thread(id);
         assert(selected != nullptr);
         assert(selected->status == EeThreadStatus::Ready);
@@ -2399,14 +2427,8 @@ void EeScheduler::updateNextDeadline()
 bool EeScheduler::hasReadyAtOrAbovePriority(int priority) const
 {
     const int last = std::clamp(priority, 0, kPriorityCount - 1);
-    for (int p = 0; p <= last; ++p)
-    {
-        if (!m_readyQueues[static_cast<size_t>(p)].empty())
-        {
-            return true;
-        }
-    }
-    return false;
+    const int first = firstReadyPriority();
+    return first >= 0 && first <= last;
 }
 
 void EeScheduler::renewTimeSlice()
diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
index fef2e489c..573f960cf 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
@@ -619,6 +619,29 @@ namespace ps2_stubs
         std::mutex g_mpeg_stub_mutex;
         constexpr uint32_t kMpegPictureWaitType = 1u;
 
+        // DQ8_SKIP_MOVIES=1 serves pictures without waiting for their
+        // presentation tick, so a movie runs as fast as the guest will drive it
+        // rather than being held to 30fps. Everything else about playback is
+        // untouched: the frames are still decoded and written, and the movie
+        // still ends by itself.
+        //
+        // Two stronger skips were tried and are recorded because both looked
+        // right. Reporting end-of-stream from sceMpegGetPicture/sceMpegIsEnd
+        // leaves the streaming thread spinning on a black screen -- the guest
+        // state machine never learns the movie is over. Closing the caller's
+        // upload gate to drop the ~900 VRAM tiles a movie frame costs does cut
+        // them (54,000 transfers per 60 frames to 240) but the guest then DMAs
+        // a buffer nothing initialises, and the screen fills with garbage.
+        // DQ8's attract movies are not button-skippable either.
+        bool mpegSkipMovies()
+        {
+            static const bool skip = [] {
+                const char *value = std::getenv("DQ8_SKIP_MOVIES");
+                return value != nullptr && *value != '\0' && *value != '0';
+            }();
+            return skip;
+        }
+
         // A refused demux call only has to give the consumer thread a turn --
         // it does not need one context transfer per refusal, and a transfer is
         // a thrown EeDispatcherTransfer unwound through the guest's whole call
@@ -2548,7 +2571,7 @@ namespace ps2_stubs
                     playback.nextPictureTickQ32 = currentTickQ32;
                 }
 
-                if (currentTickQ32 < presentationTargetQ32)
+                if (currentTickQ32 < presentationTargetQ32 && !mpegSkipMovies())
                 {
                     const uint64_t eligibleTick = (presentationTargetQ32 + kPictureClockOne - 1u) >> 32u;
                     lock.unlock();
diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MemoryCard.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MemoryCard.cpp
index 564d87381..53db24614 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MemoryCard.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MemoryCard.cpp
@@ -107,9 +107,35 @@ namespace ps2_stubs
             cvMcKilobytes(kCvMcIconInfoBytes) +
             cvMcKilobytes(kCvMcIconFileBytes) + 11;
 
+        // DQ8_MC_TRACE=1 logs the card calls. RUNTIME_LOG is compile-time and
+        // lives in a header the whole recompiled corpus includes, so turning it
+        // on to look at one stub costs a full rebuild.
+        bool mcTraceEnabled()
+        {
+            static const bool on = [] {
+                const char *value = std::getenv("DQ8_MC_TRACE");
+                return value != nullptr && *value != '\0' && *value != '0';
+            }();
+            return on;
+        }
+
+#define MC_TRACE(...)                               \
+    do                                              \
+    {                                               \
+        if (mcTraceEnabled())                       \
+        {                                           \
+            std::fprintf(stderr, "[mc] " __VA_ARGS__); \
+        }                                           \
+    } while (0)
+
         bool isValidMcPortSlot(int32_t port, int32_t slot)
         {
-            return port >= 0 && port < static_cast<int32_t>(g_mcPorts.size()) && slot == 0;
+            // The slot argument selects a multitap sub-slot. This runtime models
+            // a console with no multitap -- one card per port, and getMcRootPath()
+            // ignores the slot entirely -- so any slot query for a port answers
+            // for that port's card. Rejecting everything but slot 0 made DQ8 see
+            // no card at all: it passes slot=1 to every libmc call.
+            return port >= 0 && port < static_cast<int32_t>(g_mcPorts.size()) && slot >= 0;
         }
 
         std::filesystem::path getMcRootPath(int32_t port)
@@ -844,6 +870,8 @@ namespace ps2_stubs
         }
         RUNTIME_LOG("[MC] GetDir port=" << port << " '" << rawPath
                                         << "' maxent=" << maxEntries << " -> result=" << result);
+        MC_TRACE("GetDir port=%d '%s' maxent=%d -> result=%d\n", port, rawPath.c_str(),
+                 maxEntries, result);
         setReturnS32(ctx, 0);
     }
 
@@ -908,6 +936,9 @@ namespace ps2_stubs
         RUNTIME_LOG("[MC] GetInfo port=" << port << " type=" << cardType
                                          << " free=" << freeBlocks << " format=" << format
                                          << " result=" << result);
+        MC_TRACE("GetInfo port=%d slot=%d -> type=%d free=%d format=%d result=%d "
+                 "(typePtr=%08x freePtr=%08x formatPtr=%08x)\n",
+                 port, slot, cardType, freeBlocks, format, result, typePtr, freePtr, formatPtr);
         setReturnS32(ctx, 0);
     }
 
@@ -933,6 +964,8 @@ namespace ps2_stubs
         }
         ensureMcRootExists(0);
         ensureMcRootExists(1);
+        MC_TRACE("Init -> 0, roots %s | %s\n", getMcRootPath(0).string().c_str(),
+                 getMcRootPath(1).string().c_str());
         setReturnS32(ctx, 0);
     }
 
@@ -1209,11 +1242,13 @@ namespace ps2_stubs
         // on it to tell idle polling apart from command completion.
         if (!hadPending)
         {
+            MC_TRACE("Sync -> idle (-1)\n");
             setReturnS32(ctx, -1);
             return;
         }
 
         RUNTIME_LOG("[MC] Sync cmd=" << cmd << " result=" << result);
+        MC_TRACE("Sync cmd=%d result=%d\n", cmd, result);
 
         if (cmdPtr != 0u)
         {
diff --git a/ps2xRuntime/src/lib/gs/ps2_gs_memory.cpp b/ps2xRuntime/src/lib/gs/ps2_gs_memory.cpp
index fecf9fd2c..281d3a006 100644
--- a/ps2xRuntime/src/lib/gs/ps2_gs_memory.cpp
+++ b/ps2xRuntime/src/lib/gs/ps2_gs_memory.cpp
@@ -225,6 +225,41 @@ namespace GSMem
         PixelStorageTraits<C32>::Write(PageTableC32, data, bp, bw, x, y, value);
     }
 
+    namespace
+    {
+        // Shared body for the 32-bit run writers. Defined here so the storage
+        // traits and their page table inline into the loop.
+        template <PixelStorageMode psm, typename TableT>
+        inline void WriteRun32(const TableT& table, u8* data, u32 bp, u32 bw, u32 dsax,
+                               u32 rowEnd, u32 x, u32 y, const u8* src, u32 count)
+        {
+            for (u32 i = 0; i < count; ++i)
+            {
+                u32 value = 0;
+                std::memcpy(&value, src, sizeof(value));
+                src += sizeof(value);
+                PixelStorageTraits<psm>::Write(table, data, bp, bw, x, y, value);
+                if (++x >= rowEnd)
+                {
+                    x = dsax;
+                    ++y;
+                }
+            }
+        }
+    }
+
+    void WriteRunCT32(u8* data, u32 bp, u32 bw, u32 dsax, u32 rowEnd, u32 x, u32 y,
+                      const u8* src, u32 count)
+    {
+        WriteRun32<C32>(PageTableC32, data, bp, bw, dsax, rowEnd, x, y, src, count);
+    }
+
+    void WriteRunZ32(u8* data, u32 bp, u32 bw, u32 dsax, u32 rowEnd, u32 x, u32 y,
+                     const u8* src, u32 count)
+    {
+        WriteRun32<Z32>(PageTableZ32, data, bp, bw, dsax, rowEnd, x, y, src, count);
+    }
+
     void WriteCT24(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 value)
     {
         PixelStorageTraits<C24>::Write(PageTableC32, data, bp, bw, x, y, value);
diff --git a/ps2xRuntime/src/lib/ps2_memory.cpp b/ps2xRuntime/src/lib/ps2_memory.cpp
index 454583fc0..53ea063b9 100644
--- a/ps2xRuntime/src/lib/ps2_memory.cpp
+++ b/ps2xRuntime/src/lib/ps2_memory.cpp
@@ -426,11 +426,30 @@ uint32_t PS2Memory::advanceEeTimers(uint64_t eeCycles) noexcept
         }
 
         const uint64_t clockHz = kEeTimerClockHz[timer.mode & kEeTimerModeClksMask];
-        const uint64_t wholeSeconds = eeCycles / kEeClockHz;
-        const uint64_t remainingCycles = eeCycles % kEeClockHz;
-        const uint64_t scaled = remainingCycles * clockHz + timer.clockRemainder;
-        const uint64_t ticks = wholeSeconds * clockHz + scaled / kEeClockHz;
-        timer.clockRemainder = scaled % kEeClockHz;
+        uint64_t ticks = 0u;
+        if (eeCycles < kEeClockHz)
+        {
+            // The hot case by far: this runs on every guest safe point with a
+            // handful of cycles, so the two 64-bit divisions the general form
+            // needs are pure overhead. Below one EE second wholeSeconds is
+            // zero, and a sub-tick accumulation needs no division at all.
+            const uint64_t scaled = eeCycles * clockHz + timer.clockRemainder;
+            if (scaled < kEeClockHz)
+            {
+                timer.clockRemainder = scaled;
+                continue;
+            }
+            ticks = scaled / kEeClockHz;
+            timer.clockRemainder = scaled % kEeClockHz;
+        }
+        else
+        {
+            const uint64_t wholeSeconds = eeCycles / kEeClockHz;
+            const uint64_t remainingCycles = eeCycles % kEeClockHz;
+            const uint64_t scaled = remainingCycles * clockHz + timer.clockRemainder;
+            ticks = wholeSeconds * clockHz + scaled / kEeClockHz;
+            timer.clockRemainder = scaled % kEeClockHz;
+        }
         if (ticks == 0u)
         {
             continue;
diff --git a/ps2xRuntime/src/lib/ps2_pad.cpp b/ps2xRuntime/src/lib/ps2_pad.cpp
index d9a0a4e39..7a1aa045e 100644
--- a/ps2xRuntime/src/lib/ps2_pad.cpp
+++ b/ps2xRuntime/src/lib/ps2_pad.cpp
@@ -14,9 +14,6 @@
 #include <unordered_map>
 #include <vector>
 
-// Defined by the MPEG stub; advances once per picture the game asks for.
-extern std::atomic<uint64_t> g_mpegGetPictureCount;
-
 namespace
 {
     constexpr uint8_t kPadAnalogMarker = 0x73;
@@ -335,45 +332,11 @@ namespace
         }
     }
 
-    // DQ8_SKIP_MOVIES=1 taps START while a movie is running, which is the
-    // game's own skip. Faking end-of-stream inside the MPEG stub was tried
-    // instead and leaves the movie's streaming thread spinning forever on a
-    // black screen: the guest state machine never learns the movie is over.
-    // g_mpegGetPictureCount advancing is the signal that one is playing.
-    void applyMovieSkip(uint32_t &held, uint32_t &pressed)
-    {
-        static const bool enabled = [] {
-            const char *value = std::getenv("DQ8_SKIP_MOVIES");
-            return value != nullptr && *value != '\0' && *value != '0';
-        }();
-        if (!enabled)
-        {
-            return;
-        }
-        static uint64_t lastPictureCount = 0u;
-        static uint32_t sincePress = 0u;
-        const uint64_t pictures = g_mpegGetPictureCount.load(std::memory_order_relaxed);
-        if (pictures == lastPictureCount)
-        {
-            sincePress = 0u;
-            return;
-        }
-        lastPictureCount = pictures;
-        // An edge now and then, not a hold: the title screen that follows takes
-        // START too, and one held press would walk straight through it.
-        if ((sincePress++ % 12u) == 0u)
-        {
-            held |= PAD_START;
-            pressed |= PAD_START;
-        }
-    }
-
     // Shared tail of both host paths: publish held state and latch edges long
     // enough that a tap between two guest polls is not lost.
     void publishHostState(uint32_t held, uint32_t pressed, uint32_t sticks)
     {
         applyPadScript(held, pressed);
-        applyMovieSkip(held, pressed);
         g_held.store(held);
         g_sticks.store(sticks);
 

From a4a6e216919d65fe23ded55e1059a2775fe8f889 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Mon, 24 Aug 2026 18:22:04 +0200
Subject: [PATCH 28/68] Add consecutive-x row readers next to the run writers

ReadRowCT32/Z32/P8 mirror WriteRunCT32/Z32 for the read direction: texture
expansion walks whole rows, and the per-pixel Read entry points recompute
page, block row and column from (x, y) with three integer divisions per
texel -- 229k times for one 512x448 expand. Along a row only the in-page
column and the page column move, so the row walk is increments and the
swizzle table lookup is the only per-pixel work left. The address mask keeps
Read()'s wrap guard for regions past 4 MiB.
---
 .../include/runtime/gs/ps2_gs_memory.h        |  9 +++
 ps2xRuntime/src/lib/gs/ps2_gs_memory.cpp      | 60 +++++++++++++++++++
 2 files changed, 69 insertions(+)

diff --git a/ps2xRuntime/include/runtime/gs/ps2_gs_memory.h b/ps2xRuntime/include/runtime/gs/ps2_gs_memory.h
index 58ce8771b..e4c5873b0 100644
--- a/ps2xRuntime/include/runtime/gs/ps2_gs_memory.h
+++ b/ps2xRuntime/include/runtime/gs/ps2_gs_memory.h
@@ -592,4 +592,13 @@ namespace GSMem
 	u32 ReadP4HH(u8* data, u32 bp, u32 bw, u32 x, u32 y);
 
 	u32 ReadNull(u8* data, u32 bp, u32 bw, u32 x, u32 y);
+
+	// Reads `count` consecutive-x pixels starting at (x, y) into dst, packed
+	// at the PSM's storage width. Texture expansion reads whole rows; the
+	// per-pixel entry points recompute page, block row and column from (x, y)
+	// with three integer divisions each, and a 512x448 expand paid that 229k
+	// times. Same values, same order, increments instead of divisions.
+	void ReadRowCT32(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 count, u8* dst);
+	void ReadRowZ32(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 count, u8* dst);
+	void ReadRowP8(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 count, u8* dst);
 }
\ No newline at end of file
diff --git a/ps2xRuntime/src/lib/gs/ps2_gs_memory.cpp b/ps2xRuntime/src/lib/gs/ps2_gs_memory.cpp
index 281d3a006..1bfe50ad0 100644
--- a/ps2xRuntime/src/lib/gs/ps2_gs_memory.cpp
+++ b/ps2xRuntime/src/lib/gs/ps2_gs_memory.cpp
@@ -393,6 +393,66 @@ namespace GSMem
     {
         return 0;
     }
+
+    namespace
+    {
+        // Body for the consecutive-x row readers. Along a row only the
+        // in-page column and the page column move, so the walk is increments;
+        // the swizzle table lookup is the only per-pixel work left. The
+        // address mask matches Read()'s wrap guard for regions past 4 MiB.
+        template <typename TableT, u32 PageW, u32 PageH, u32 BytesPerPixel>
+        inline void ReadRowImpl(const TableT& table, u8* data, u32 bp, u32 bw,
+                                u32 x, u32 y, u32 count, u8* dst)
+        {
+            constexpr u32 kBlocksPerPage = 32;
+            constexpr u32 kPixelsPerPage = PageW * PageH;
+            constexpr u32 kAddressMask = u32(MEMORY_SIZE) - BytesPerPixel;
+
+            const u32 basePage = bp / kBlocksPerPage;
+            const u32 block = bp % kBlocksPerPage;
+            const u32 pagesPerRow = (bw * 64u) / PageW;
+            const u32 pageRowBase = basePage + (y / PageH) * pagesPerRow;
+            const u32 yInPage = y % PageH;
+            const auto& row = table[block][yInPage];
+
+            u32 page = pageRowBase + x / PageW;
+            u32 xInPage = x % PageW;
+            while (count > 0)
+            {
+                const u32 segment = count < (PageW - xInPage) ? count : (PageW - xInPage);
+                const u32 pageAddress = page * kPixelsPerPage;
+                for (u32 i = 0; i < segment; ++i)
+                {
+                    const u32 byteAddress =
+                        ((pageAddress + row[xInPage + i]) * BytesPerPixel) & kAddressMask;
+                    std::memcpy(dst, data + byteAddress, BytesPerPixel);
+                    dst += BytesPerPixel;
+                }
+                xInPage += segment;
+                if (xInPage == PageW)
+                {
+                    xInPage = 0;
+                    ++page;
+                }
+                count -= segment;
+            }
+        }
+    }
+
+    void ReadRowCT32(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 count, u8* dst)
+    {
+        ReadRowImpl<C32PageLookupTable, 64, 32, 4>(PageTableC32, data, bp, bw, x, y, count, dst);
+    }
+
+    void ReadRowZ32(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 count, u8* dst)
+    {
+        ReadRowImpl<Z32PageLookupTableT, 64, 32, 4>(PageTableZ32, data, bp, bw, x, y, count, dst);
+    }
+
+    void ReadRowP8(u8* data, u32 bp, u32 bw, u32 x, u32 y, u32 count, u8* dst)
+    {
+        ReadRowImpl<P8PageLookupTable, 128, 64, 1>(PageTableP8, data, bp, bw, x, y, count, dst);
+    }
 }
 
 

From 20973e8e9d3f975c966d72cad802635212aa3243 Mon Sep 17 00:00:00 2001
From: Sinan KARAKAYA <karakaya.sinan@proton.me>
Date: Tue, 25 Aug 2026 00:01:53 +0200
Subject: [PATCH 29/68] Cut three fixed costs out of the event pump

The movie thread yields ~4M times a second and each yield pumped events
twice. Three per-pump costs, each visible in its profile:

- The tail of processPendingEvents took m_eventMutex to ask whether any
  event was still queued. m_pendingEventCount now answers without the
  mutex; postEvent counts under the same mutex it pushes under, and the
  pump zeroes the count when it drains.
- takePendingVifInterrupts was an atomic exchange per pump; a plain load
  answers first because the pending set is almost always empty.
- advanceEeTimers walked all four timers per safe point even when the game
  never armed one; a cued-any flag maintained on timer writes gates it.

Measured on DQ8's boot-to-title: movie phases 38.8 -> 39.5-46.6 fps, the
settings screens and title stay at the 60 fps vsync cap. The remaining
per-yield cost is the fiber round trip and the syscall dispatch path.
---
 ps2xRuntime/include/runtime/ee_scheduler.h |  6 ++++
 ps2xRuntime/include/runtime/ps2_memory.h   |  5 ++++
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp | 33 +++++++++++++++++-----
 ps2xRuntime/src/lib/ps2_memory.cpp         | 29 ++++++++++++++++++-
 4 files changed, 65 insertions(+), 8 deletions(-)

diff --git a/ps2xRuntime/include/runtime/ee_scheduler.h b/ps2xRuntime/include/runtime/ee_scheduler.h
index 9dcb9a5a1..4cc3029f1 100644
--- a/ps2xRuntime/include/runtime/ee_scheduler.h
+++ b/ps2xRuntime/include/runtime/ee_scheduler.h
@@ -477,6 +477,12 @@ class EeScheduler
     mutable std::mutex m_eventMutex;
     std::condition_variable m_eventCv;
     std::deque<EeEvent> m_events;
+    // Nonzero while m_events has anything in it. The post-dispatch pump's
+    // tail used to take m_eventMutex to ask m_events.empty(); at the movie
+    // thread's ~4M pumps a second that mutex pair was measurable, and the
+    // count answers the same question without it. postEvent increments under
+    // m_eventMutex, the pump zeroes it under the same mutex when it drains.
+    std::atomic<uint32_t> m_pendingEventCount{0};
     std::vector<ScheduledEvent> m_deadlines;
     std::deque<GuestInvocation> m_pendingInvocations;
     uint64_t m_eventSequence = 0;
diff --git a/ps2xRuntime/include/runtime/ps2_memory.h b/ps2xRuntime/include/runtime/ps2_memory.h
index 20d08ffc2..de2f8ed76 100644
--- a/ps2xRuntime/include/runtime/ps2_memory.h
+++ b/ps2xRuntime/include/runtime/ps2_memory.h
@@ -454,6 +454,11 @@ class PS2Memory
     };
 
     std::array<EeTimer, 4> m_eeTimers{};
+    // True while any timer has CUE set. advanceEeTimers runs on every guest
+    // safe point; without this it walks all four timers each time even when
+    // the game never armed one.
+    bool m_anyEeTimerCued = false;
+    void refreshEeTimersCued() noexcept;
     void queueCompletedDmacCause(uint32_t cause);
 };
 
diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index d482ff27e..5324b6a5e 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -24,6 +24,13 @@ std::atomic<uint64_t> g_eeGuestDispatchCount{0};
 std::atomic<uint64_t> g_eeTransferThrowCount{0};
 // Transfers served by suspending the guest stack instead of unwinding it.
 std::atomic<uint64_t> g_eeTransferSuspendCount{0};
+// Temporary diagnostics for the movie-speed work: how often the run loop goes
+// round, how many of those resume a suspended guest stack, and how often the
+// post-dispatch event pump runs. Read by the sdlgpu stats line.
+std::atomic<uint64_t> g_eeRunLoopIterations{0};
+std::atomic<uint64_t> g_eeRunLoopResumeCount{0};
+std::atomic<uint64_t> g_eeProcessPendingEventsCount{0};
+std::atomic<uint64_t> g_eeEnterGuestCount{0};
 
 namespace
 {
@@ -159,6 +166,7 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     {
         std::lock_guard lock(m_eventMutex);
         m_events.clear();
+        m_pendingEventCount.store(0u, std::memory_order_release);
         m_deadlines.clear();
         m_pendingInvocations.clear();
     }
@@ -200,6 +208,7 @@ void EeScheduler::run()
 
     while (!m_stopRequested.load(std::memory_order_acquire))
     {
+        g_eeRunLoopIterations.fetch_add(1u, std::memory_order_relaxed);
         processPendingEvents();
         if (m_stopRequested.load(std::memory_order_acquire))
         {
@@ -245,6 +254,7 @@ void EeScheduler::run()
         // middle of a function the fiber is already executing.
         if (running->inGuestCall)
         {
+            g_eeRunLoopResumeCount.fetch_add(1u, std::memory_order_relaxed);
             enterGuest(*running);
             if (m_fiberException)
             {
@@ -446,6 +456,7 @@ void EeScheduler::postEvent(EeEvent event)
     {
         std::lock_guard lock(m_eventMutex);
         m_events.push_back(event);
+        m_pendingEventCount.fetch_add(1u, std::memory_order_release);
         m_checkpointPending.store(true, std::memory_order_release);
     }
     m_eventCv.notify_one();
@@ -1901,6 +1912,7 @@ void EeScheduler::enterGuest(GuestThread &thread)
     }
 
     assert(m_activeFiber == nullptr && "guest fibers must not nest");
+    g_eeEnterGuestCount.fetch_add(1u, std::memory_order_relaxed);
     EeFiber *previous = m_activeFiber;
     m_activeFiber = thread.fiber.get();
     m_dispatchedThreadId = thread.id;
@@ -2053,6 +2065,7 @@ void EeScheduler::applyPendingPreemption()
 void EeScheduler::processPendingEvents()
 {
     assertExecutor();
+    g_eeProcessPendingEventsCount.fetch_add(1u, std::memory_order_relaxed);
     processDueDeadlines();
     const uint32_t timerInterrupts = m_pendingEeTimerInterrupts;
     m_pendingEeTimerInterrupts = 0u;
@@ -2082,6 +2095,9 @@ void EeScheduler::processPendingEvents()
         {
             std::deque<EeEvent> pending;
             pending.swap(m_events);
+            // Same mutex postEvent counts under, so a post that races this
+            // either lands in the deque being drained or after this store.
+            m_pendingEventCount.store(0u, std::memory_order_release);
             lock.unlock();
             for (const EeEvent &event : pending)
             {
@@ -2090,13 +2106,16 @@ void EeScheduler::processPendingEvents()
         }
     }
 
-    {
-        std::lock_guard lock(m_eventMutex);
-        const uint64_t nextEventCycle = m_nextDeadlineCycle.load(std::memory_order_acquire);
-        const bool cycleEventDue = nextEventCycle != 0u && m_eeCycle >= nextEventCycle;
-        const bool pendingWork = !m_events.empty() || cycleEventDue || m_stopRequested.load(std::memory_order_acquire);
-        m_checkpointPending.store(pendingWork, std::memory_order_release);
-    }
+    // The tail used to take m_eventMutex to ask m_events.empty(); the movie
+    // thread pumps twice per yield at ~4M yields a second and the mutex pair
+    // showed in its profile. The count plus the atomics answer the same
+    // question.
+    const uint64_t nextEventCycle = m_nextDeadlineCycle.load(std::memory_order_acquire);
+    const bool cycleEventDue = nextEventCycle != 0u && m_eeCycle >= nextEventCycle;
+    const bool pendingWork = m_pendingEventCount.load(std::memory_order_acquire) != 0u ||
+                             cycleEventDue ||
+                             m_stopRequested.load(std::memory_order_acquire);
+    m_checkpointPending.store(pendingWork, std::memory_order_release);
     applyPendingPreemption();
 }
 
diff --git a/ps2xRuntime/src/lib/ps2_memory.cpp b/ps2xRuntime/src/lib/ps2_memory.cpp
index 53ea063b9..5d1b62ed4 100644
--- a/ps2xRuntime/src/lib/ps2_memory.cpp
+++ b/ps2xRuntime/src/lib/ps2_memory.cpp
@@ -402,16 +402,38 @@ bool PS2Memory::initialize(size_t ramSize)
 void PS2Memory::resetEeTimers() noexcept
 {
     m_eeTimers = {};
+    m_anyEeTimerCued = false;
+}
+
+void PS2Memory::refreshEeTimersCued() noexcept
+{
+    // Write path only: advanceEeTimers is the hot side and just reads the
+    // flag.
+    m_anyEeTimerCued = false;
+    for (const EeTimer &timer : m_eeTimers)
+    {
+        if ((timer.mode & kEeTimerModeCue) != 0u)
+        {
+            m_anyEeTimerCued = true;
+            return;
+        }
+    }
 }
 
 uint32_t PS2Memory::takePendingVifInterrupts() noexcept
 {
+    // Runs after every guest dispatch. The exchange is a locked RMW; the
+    // pending set is almost always empty, so the plain load answers first.
+    if (m_pendingVifInterrupts.load(std::memory_order_acquire) == 0u)
+    {
+        return 0u;
+    }
     return m_pendingVifInterrupts.exchange(0u, std::memory_order_acq_rel);
 }
 
 uint32_t PS2Memory::advanceEeTimers(uint64_t eeCycles) noexcept
 {
-    if (eeCycles == 0u)
+    if (eeCycles == 0u || !m_anyEeTimerCued)
     {
         return 0u;
     }
@@ -500,6 +522,10 @@ uint32_t PS2Memory::advanceEeTimers(uint64_t eeCycles) noexcept
 
 uint64_t PS2Memory::cyclesUntilNextEeTimerInterrupt() const noexcept
 {
+    if (!m_anyEeTimerCued)
+    {
+        return std::numeric_limits<uint64_t>::max();
+    }
     uint64_t nearest = std::numeric_limits<uint64_t>::max();
     for (const EeTimer &timer : m_eeTimers)
     {
@@ -1147,6 +1173,7 @@ bool PS2Memory::writeIORegister(uint32_t address, uint32_t value)
             {
                 timer.clockRemainder = 0u;
             }
+            refreshEeTimersCued();
             break;
         }
         case kEeTimerCompareOffset:

From 684c3ce99c4f476cf7ab49255e1c6cdcab386894 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Wed, 9 Sep 2026 23:16:49 +0200
Subject: [PATCH 30/68] Add native ARM64 fibers and reduce EE scheduler
 overhead

---
 ps2xRuntime/include/runtime/ee_fiber.h     |   2 +-
 ps2xRuntime/include/runtime/ee_scheduler.h |   2 +
 ps2xRuntime/src/lib/Kernel/EeFiber.cpp     | 122 +++++++++++++++++++--
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp |  49 ++++-----
 ps2xRuntime/src/lib/ps2_runtime.cpp        |  25 +++++
 ps2xTest/src/ps2_runtime_kernel_tests.cpp  |  68 ++++++++++++
 6 files changed, 233 insertions(+), 35 deletions(-)

diff --git a/ps2xRuntime/include/runtime/ee_fiber.h b/ps2xRuntime/include/runtime/ee_fiber.h
index a29f2ac19..c802f84a4 100644
--- a/ps2xRuntime/include/runtime/ee_fiber.h
+++ b/ps2xRuntime/include/runtime/ee_fiber.h
@@ -12,7 +12,7 @@
 // Suspending the stack instead makes a switch a register save and a stack
 // pointer swap.
 //
-// x86-64 gets a hand-written switch; everything else falls back to ucontext,
+// x86-64 and ARM64 get native switches; other targets fall back to ucontext,
 // which is correct but pays a sigprocmask syscall per switch. setjmp/longjmp
 // across stacks is deliberately not used: glibc's _FORTIFY_SOURCE turns it
 // into an abort ("longjmp causes uninitialized stack frame").
diff --git a/ps2xRuntime/include/runtime/ee_scheduler.h b/ps2xRuntime/include/runtime/ee_scheduler.h
index 4cc3029f1..80a91140e 100644
--- a/ps2xRuntime/include/runtime/ee_scheduler.h
+++ b/ps2xRuntime/include/runtime/ee_scheduler.h
@@ -428,6 +428,8 @@ class EeScheduler
     // refreshReadyMask(), which every mutation of m_readyQueues calls.
     std::array<uint64_t, (kPriorityCount + 63) / 64> m_readyMask{};
     std::unordered_map<int, GuestThread> m_threads;
+    // EE thread IDs are bounded; map nodes remain stable across rehashes.
+    std::array<GuestThread *, kLastThreadId + 1> m_threadIndex{};
     std::unordered_map<int, EeSemaphore> m_semaphores;
     std::unordered_map<int, EeEventFlag> m_eventFlags;
     std::unordered_map<int, EeAlarm> m_alarms;
diff --git a/ps2xRuntime/src/lib/Kernel/EeFiber.cpp b/ps2xRuntime/src/lib/Kernel/EeFiber.cpp
index 5338f4b3f..a70d51cf8 100644
--- a/ps2xRuntime/src/lib/Kernel/EeFiber.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeFiber.cpp
@@ -6,6 +6,7 @@
 
 #if defined(__unix__) || defined(__APPLE__)
 #include <sys/mman.h>
+#include <unistd.h>
 #define EE_FIBER_HAVE_MMAP 1
 #else
 #define EE_FIBER_HAVE_MMAP 0
@@ -13,6 +14,15 @@
 
 namespace
 {
+    size_t stackPageSize()
+    {
+#if EE_FIBER_HAVE_MMAP
+        static const size_t size = static_cast<size_t>(sysconf(_SC_PAGESIZE));
+        return size;
+#else
+        return 4096u;
+#endif
+    }
     // Whole mapping including one guard page at the low end.
     void *mmapStack(size_t bytes)
     {
@@ -23,7 +33,7 @@ namespace
         {
             return nullptr;
         }
-        if (mprotect(base, 4096u, PROT_NONE) != 0)
+        if (mprotect(base, stackPageSize(), PROT_NONE) != 0)
         {
             munmap(base, bytes);
             return nullptr;
@@ -48,10 +58,23 @@ namespace
     }
 } // namespace
 
-#if defined(__x86_64__) && (defined(__linux__) || defined(__unix__) || defined(__APPLE__))
+#if defined(__x86_64__) && (defined(__linux__) || defined(__unix__) || defined(__APPLE__)) && !defined(EE_FIBER_FORCE_UCONTEXT)
 #define EE_FIBER_FAST_X86_64 1
 #else
 #define EE_FIBER_FAST_X86_64 0
+#endif
+
+#if defined(__aarch64__) && (defined(__linux__) || defined(__APPLE__)) && !defined(EE_FIBER_FORCE_UCONTEXT)
+#define EE_FIBER_FAST_ARM64 1
+#else
+#define EE_FIBER_FAST_ARM64 0
+#endif
+#define EE_FIBER_FAST (EE_FIBER_FAST_X86_64 || EE_FIBER_FAST_ARM64)
+
+#if !EE_FIBER_FAST
+#if defined(__APPLE__) && !defined(_XOPEN_SOURCE)
+#define _XOPEN_SOURCE 700
+#endif
 #include <ucontext.h>
 #endif
 
@@ -127,6 +150,79 @@ namespace
         boot->entry(boot->user);
         std::abort(); // entry must never return
     }
+#elif EE_FIBER_FAST_ARM64
+    struct FiberBootstrap
+    {
+        EeFiber::EntryFn entry;
+        void *user;
+    };
+
+    extern "C" void eeFiberSwitch(void **saveSp, void *targetSp);
+    extern "C" void eeFiberTrampoline();
+    extern "C" void eeFiberEnter(void *bootstrap)
+    {
+        auto *boot = static_cast<FiberBootstrap *>(bootstrap);
+        boot->entry(boot->user);
+        std::abort();
+    }
+
+#if defined(__APPLE__)
+#define EE_ASM_SYMBOL(name) "_" #name
+#else
+#define EE_ASM_SYMBOL(name) #name
+#endif
+    // AAPCS64: x19-x30, the low halves of v8-v15, and the FP environment.
+    // x18 is platform-reserved and must never be used as a scratch register.
+    __asm__(
+        ".text\n"
+        ".p2align 2\n"
+        ".globl " EE_ASM_SYMBOL(eeFiberSwitch) "\n"
+        EE_ASM_SYMBOL(eeFiberSwitch) ":\n"
+        "sub sp, sp, #176\n"
+        "stp x19, x20, [sp, #0]\n"
+        "stp x21, x22, [sp, #16]\n"
+        "stp x23, x24, [sp, #32]\n"
+        "stp x25, x26, [sp, #48]\n"
+        "stp x27, x28, [sp, #64]\n"
+        "stp x29, x30, [sp, #80]\n"
+        "stp d8, d9, [sp, #96]\n"
+        "stp d10, d11, [sp, #112]\n"
+        "stp d12, d13, [sp, #128]\n"
+        "stp d14, d15, [sp, #144]\n"
+        "mrs x9, fpcr\n"
+        "mrs x10, fpsr\n"
+        "stp x9, x10, [sp, #160]\n"
+        "mov x9, sp\n"
+        "str x9, [x0]\n"
+        "mov sp, x1\n"
+        "ldp x11, x12, [sp, #160]\n"
+        "cmp x9, x11\n"
+        "b.eq 1f\n"
+        "msr fpcr, x11\n"
+        "1:\n"
+        "cmp x10, x12\n"
+        "b.eq 2f\n"
+        "msr fpsr, x12\n"
+        "2:\n"
+        "ldp d8, d9, [sp, #96]\n"
+        "ldp d10, d11, [sp, #112]\n"
+        "ldp d12, d13, [sp, #128]\n"
+        "ldp d14, d15, [sp, #144]\n"
+        "ldp x19, x20, [sp, #0]\n"
+        "ldp x21, x22, [sp, #16]\n"
+        "ldp x23, x24, [sp, #32]\n"
+        "ldp x25, x26, [sp, #48]\n"
+        "ldp x27, x28, [sp, #64]\n"
+        "ldp x29, x30, [sp, #80]\n"
+        "add sp, sp, #176\n"
+        "ret\n"
+        ".p2align 2\n"
+        ".globl " EE_ASM_SYMBOL(eeFiberTrampoline) "\n"
+        EE_ASM_SYMBOL(eeFiberTrampoline) ":\n"
+        "mov x0, x19\n"
+        "bl " EE_ASM_SYMBOL(eeFiberEnter) "\n"
+        "brk #0\n");
+#undef EE_ASM_SYMBOL
 #else
     struct FiberPlatform
     {
@@ -149,7 +245,7 @@ namespace
 
 bool EeFiber::usingFastSwitch() noexcept
 {
-    return EE_FIBER_FAST_X86_64 != 0;
+    return EE_FIBER_FAST != 0;
 }
 
 EeFiber::~EeFiber()
@@ -159,7 +255,7 @@ EeFiber::~EeFiber()
 
 void EeFiber::destroy()
 {
-#if !EE_FIBER_FAST_X86_64
+#if !EE_FIBER_FAST
     delete static_cast<FiberPlatform *>(m_platform);
 #else
     std::free(m_platform);
@@ -183,7 +279,7 @@ bool EeFiber::create(EntryFn entry, void *user, size_t stackBytes)
     // stack can run deep. Map it with a PROT_NONE guard page at the low end:
     // an overflow then faults on the guard instead of quietly writing into
     // whatever the allocator put underneath.
-    const size_t pageSize = 4096u;
+    const size_t pageSize = stackPageSize();
     const size_t mapped = ((stackBytes + pageSize - 1u) / pageSize) * pageSize + pageSize;
     void *base = mmapStack(mapped);
     if (base == nullptr)
@@ -195,7 +291,7 @@ bool EeFiber::create(EntryFn entry, void *user, size_t stackBytes)
     m_stackBytes = mapped;
     stackBytes = mapped - pageSize;
 
-#if EE_FIBER_FAST_X86_64
+#if EE_FIBER_FAST
     auto *boot = static_cast<FiberBootstrap *>(std::malloc(sizeof(FiberBootstrap)));
     if (boot == nullptr)
     {
@@ -206,6 +302,7 @@ bool EeFiber::create(EntryFn entry, void *user, size_t stackBytes)
     boot->user = user;
     m_platform = boot;
 
+#if EE_FIBER_FAST_X86_64
     // Build the frame eeFiberSwitch will pop: FP words, r15..rbx, rbp, then the
     // return address it rets to. rbx carries the bootstrap into the trampoline.
     auto *top = reinterpret_cast<uintptr_t *>(static_cast<char *>(stack) + stackBytes);
@@ -228,6 +325,15 @@ bool EeFiber::create(EntryFn entry, void *user, size_t stackBytes)
     std::memcpy(top, &mxcsr, sizeof(mxcsr));
     std::memcpy(reinterpret_cast<char *>(top) + 4, &fcw, sizeof(fcw));
     m_fiberSp = top;
+#else
+    auto *top = reinterpret_cast<uint64_t *>(static_cast<char *>(stack) + stackBytes) - 22;
+    std::memset(top, 0, 176);
+    top[0] = reinterpret_cast<uintptr_t>(boot);                 // x19
+    top[11] = reinterpret_cast<uintptr_t>(&eeFiberTrampoline);  // x30
+    __asm__ __volatile__("mrs %0, fpcr" : "=r"(top[20]));
+    __asm__ __volatile__("mrs %0, fpsr" : "=r"(top[21]));
+    m_fiberSp = top;
+#endif
 #else
     auto *platform = new (std::nothrow) FiberPlatform();
     if (platform == nullptr)
@@ -254,7 +360,7 @@ bool EeFiber::create(EntryFn entry, void *user, size_t stackBytes)
 
 void EeFiber::resume()
 {
-#if EE_FIBER_FAST_X86_64
+#if EE_FIBER_FAST
     eeFiberSwitch(&m_returnSp, m_fiberSp);
 #else
     auto *platform = static_cast<FiberPlatform *>(m_platform);
@@ -265,7 +371,7 @@ void EeFiber::resume()
 
 void EeFiber::suspend()
 {
-#if EE_FIBER_FAST_X86_64
+#if EE_FIBER_FAST
     eeFiberSwitch(&m_fiberSp, m_returnSp);
 #else
     auto *platform = static_cast<FiberPlatform *>(m_platform);
diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index 5324b6a5e..ef0d3f3f8 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -134,6 +134,7 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     }
     m_invocationStackTops.clear();
     m_threads.clear();
+    m_threadIndex.fill(nullptr);
     m_semaphores.clear();
     m_eventFlags.clear();
     m_alarms.clear();
@@ -192,7 +193,7 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     main.initialPriority = 0;
     main.currentPriority = 0;
     main.status = EeThreadStatus::Ready;
-    m_threads.emplace(main.id, std::move(main));
+    m_threadIndex[kMainThreadId] = &m_threads.emplace(main.id, std::move(main)).first->second;
     m_readyQueues[0].push_back(kMainThreadId);
     refreshReadyMask(0);
     scheduleEvent(m_eeCycle + kVBlankPeriodCycles,
@@ -209,6 +210,7 @@ void EeScheduler::run()
     while (!m_stopRequested.load(std::memory_order_acquire))
     {
         g_eeRunLoopIterations.fetch_add(1u, std::memory_order_relaxed);
+        // Service events and preemption once between guest turns.
         processPendingEvents();
         if (m_stopRequested.load(std::memory_order_acquire))
         {
@@ -259,21 +261,11 @@ void EeScheduler::run()
             if (m_fiberException)
             {
                 std::exception_ptr escaped;
-                escaped.swap(m_fiberException);
+                std::swap(escaped, m_fiberException);
                 m_running.store(false, std::memory_order_release);
                 publishSnapshotNow();
                 std::rethrow_exception(escaped);
             }
-            processPendingEvents();
-            if (m_rescheduleRequested && m_currentThreadId != 0)
-            {
-                GuestThread *preempted = currentThread();
-                assert(preempted != nullptr);
-                enqueueReady(*preempted, !m_timeSliceExpired);
-                m_currentThreadId = 0;
-                m_rescheduleRequested = false;
-                m_timeSliceExpired = false;
-            }
             continue;
         }
 
@@ -414,22 +406,11 @@ void EeScheduler::run()
         if (m_fiberException)
         {
             std::exception_ptr escaped;
-            escaped.swap(m_fiberException);
+            std::swap(escaped, m_fiberException);
             m_running.store(false, std::memory_order_release);
             publishSnapshotNow();
             std::rethrow_exception(escaped);
         }
-
-        processPendingEvents();
-        if (m_rescheduleRequested && m_currentThreadId != 0)
-        {
-            GuestThread *preempted = currentThread();
-            assert(preempted != nullptr);
-            enqueueReady(*preempted, !m_timeSliceExpired);
-            m_currentThreadId = 0;
-            m_rescheduleRequested = false;
-            m_timeSliceExpired = false;
-        }
     }
 
     m_guestExecuting.store(false, std::memory_order_release);
@@ -575,7 +556,7 @@ int EeScheduler::createThread(const EeThreadCreateParams &params)
     thread.initialPriority = params.priority;
     thread.currentPriority = params.priority;
     thread.status = EeThreadStatus::Dormant;
-    m_threads.emplace(id, std::move(thread));
+    m_threadIndex[id] = &m_threads.emplace(id, std::move(thread)).first->second;
     reserveGuestStackFromAsyncPool(params.stack);
     publishSnapshot();
     return id;
@@ -603,6 +584,7 @@ int EeScheduler::deleteThread(int id, uint32_t &ownedStack)
         ownedStack = it->second.stack;
     }
     releaseInvocationStacks(id);
+    m_threadIndex[id] = nullptr;
     m_threads.erase(it);
     publishSnapshot();
     return KE_OK;
@@ -652,6 +634,8 @@ int EeScheduler::startThread(int id, uint32_t arg, const R5900Context &caller, b
     if (deleteThreadRecord && id != kMainThreadId)
     {
         releaseInvocationStacks(id);
+        if (static_cast<uint32_t>(id) <= kLastThreadId)
+            m_threadIndex[id] = nullptr;
         m_threads.erase(id);
     }
     if (ownedStack != 0u)
@@ -888,6 +872,13 @@ int EeScheduler::rotateReadyQueue(int priority, bool interruptSafe)
     GuestThread *self = currentThread();
     if (self && self->currentPriority == priority)
     {
+        // Rotating a singleton would immediately select this same thread.
+        // Guest checkpoints still service timers and newly posted events.
+        const int firstReady = firstReadyPriority();
+        if ((firstReady < 0 || firstReady > priority) && !m_rescheduleRequested)
+        {
+            return KE_OK;
+        }
         enqueueReady(*self);
         m_currentThreadId = 0;
         m_rescheduleRequested = true;
@@ -1572,12 +1563,16 @@ void EeScheduler::completeExternalWait(uint32_t type, uint64_t token, int result
 
 GuestThread *EeScheduler::thread(int id)
 {
+    if (static_cast<uint32_t>(id) <= kLastThreadId)
+        return m_threadIndex[id];
     auto it = m_threads.find(id);
     return it == m_threads.end() ? nullptr : &it->second;
 }
 
 const GuestThread *EeScheduler::thread(int id) const
 {
+    if (static_cast<uint32_t>(id) <= kLastThreadId)
+        return m_threadIndex[id];
     auto it = m_threads.find(id);
     return it == m_threads.end() ? nullptr : &it->second;
 }
@@ -1670,7 +1665,8 @@ void EeScheduler::publishSnapshot()
     // three. Called from ~40 scheduler operations it was 45% of EE thread time
     // during a movie, for state whose only readers are the debug panel and an
     // aggressive-log tick.
-    if (!m_snapshotWanted.exchange(false, std::memory_order_relaxed))
+    if (!m_snapshotWanted.load(std::memory_order_relaxed) ||
+        !m_snapshotWanted.exchange(false, std::memory_order_relaxed))
     {
         return;
     }
@@ -2089,6 +2085,7 @@ void EeScheduler::processPendingEvents()
 
     // A default-constructed deque still allocates, and this path is almost
     // always empty, so only build one when there is something to take.
+    if (m_pendingEventCount.load(std::memory_order_acquire) != 0u)
     {
         std::unique_lock lock(m_eventMutex);
         if (!m_events.empty())
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index e2e3b2e0a..e554e7412 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -44,6 +44,7 @@ static constexpr int FB_HEIGHT = 512;
 static constexpr int DEFAULT_DISPLAY_HEIGHT = 448;
 static constexpr uint32_t DEFAULT_FB_SIZE = FB_WIDTH * FB_HEIGHT * 4;
 static constexpr uint32_t DEFAULT_FB_ADDR = (PS2_RAM_SIZE - DEFAULT_FB_SIZE - 0x10000u);
+static std::atomic<uint64_t> s_syscallOverrideGeneration{1u};
 #if defined(PLATFORM_VITA)
 static constexpr int HOST_WINDOW_WIDTH = 960;
 static constexpr int HOST_WINDOW_HEIGHT = 544;
@@ -481,6 +482,8 @@ static void UploadFrame(Texture2D &tex, PS2Runtime *rt, uint32_t &outWidth, uint
 
 PS2Runtime::PS2Runtime()
 {
+    // A new instance may reuse the address of a cached, destroyed runtime.
+    s_syscallOverrideGeneration.fetch_add(1u, std::memory_order_release);
     m_iopHost = std::make_unique<PS2IopHostAdapter>(*this);
     m_iopSubsystem = std::make_unique<ps2x::iop::IopSubsystem>(*m_iopHost);
     m_eeScheduler = std::make_unique<EeScheduler>(*this);
@@ -2327,8 +2330,29 @@ void PS2Runtime::removeEeExitHandlers(int threadId)
 
 bool PS2Runtime::findEeSyscallOverride(uint32_t syscallNumber, uint32_t &handler) const
 {
+    struct CachedOverride
+    {
+        const PS2Runtime *owner = nullptr;
+        uint64_t generation = 0u;
+        uint32_t number = 0u;
+        uint32_t handler = 0u;
+        bool found = false;
+    };
+    // Polling loops repeatedly call the same syscall with no override.
+    // Cache misses still read the map under its lock; every mutation invalidates.
+    static thread_local CachedOverride cache;
+    const uint64_t generation = s_syscallOverrideGeneration.load(std::memory_order_acquire);
+    if (cache.owner == this && cache.generation == generation && cache.number == syscallNumber)
+    {
+        if (cache.found)
+            handler = cache.handler;
+        return cache.found;
+    }
     std::lock_guard lock(m_eeKernelStateMutex);
     const auto it = m_eeSyscallOverrides.find(syscallNumber);
+    cache = {this, generation, syscallNumber,
+             it == m_eeSyscallOverrides.end() ? 0u : it->second,
+             it != m_eeSyscallOverrides.end()};
     if (it == m_eeSyscallOverrides.end())
     {
         return false;
@@ -2353,6 +2377,7 @@ void PS2Runtime::setEeSyscallOverride(uint8_t *rdram, uint32_t syscallNumber, ui
     {
         m_eeSyscallOverrides[syscallNumber] = handler;
     }
+    s_syscallOverrideGeneration.fetch_add(1u, std::memory_order_release);
     if (!rdram || address < 0 || address + 4 > kMirrorLimit)
     {
         return;
diff --git a/ps2xTest/src/ps2_runtime_kernel_tests.cpp b/ps2xTest/src/ps2_runtime_kernel_tests.cpp
index 2542d486f..23a042884 100644
--- a/ps2xTest/src/ps2_runtime_kernel_tests.cpp
+++ b/ps2xTest/src/ps2_runtime_kernel_tests.cpp
@@ -9,6 +9,7 @@
 #include <atomic>
 #include <cstdint>
 #include <cstring>
+#include <optional>
 #include <sstream>
 #include <thread>
 #include <vector>
@@ -549,6 +550,28 @@ void register_ps2_runtime_kernel_tests()
 {
     MiniTest::Case("PS2RuntimeKernel", [](TestCase &tc)
     {
+        tc.Run("syscall lookup observes replacement, removal and runtime reuse", [](TestCase &t)
+        {
+            std::optional<PS2Runtime> runtime(std::in_place);
+            uint32_t handler = 0u;
+            constexpr uint32_t number = 0x2Bu;
+            t.IsTrue(!runtime->findEeSyscallOverride(number, handler), "no initial override");
+            runtime->setEeSyscallOverride(nullptr, number, 0x1000u);
+            t.IsTrue(runtime->findEeSyscallOverride(number, handler), "new override replaces cached miss");
+            t.Equals(handler, 0x1000u, "installed handler is visible");
+            std::thread writer([&] { runtime->setEeSyscallOverride(nullptr, number, 0x2000u); });
+            writer.join();
+            t.IsTrue(runtime->findEeSyscallOverride(number, handler), "cross-thread replacement is visible");
+            t.Equals(handler, 0x2000u, "replacement invalidates cached hit");
+            runtime->setEeSyscallOverride(nullptr, number, 0u);
+            t.IsTrue(!runtime->findEeSyscallOverride(number, handler), "removal invalidates cached hit");
+            runtime->setEeSyscallOverride(nullptr, number, 0x3000u);
+            runtime->findEeSyscallOverride(number, handler);
+            runtime.reset();
+            runtime.emplace();
+            t.IsTrue(!runtime->findEeSyscallOverride(number, handler), "reused runtime address has no old override");
+        });
+
         tc.Run("CreateThread and CreateSema decode the exact PS2SDK EE layouts", [](TestCase &t)
         {
             TestEnv env;
@@ -810,6 +833,51 @@ void register_ps2_runtime_kernel_tests()
             t.IsTrue(trace == expected, "explicit rotation should move the current head behind its FIFO peer");
         });
 
+        tc.Run("rotating a singleton does not run a lower-priority thread", [](TestCase &t)
+        {
+            for (const bool withLower : {false, true})
+            {
+                TestEnv env;
+                std::vector<int> trace;
+                gSchedulerTrace = &trace;
+                env.runtime.registerFunction(K_SCHED_MAIN, schedulerMainExit);
+                env.runtime.registerFunction(K_SCHED_A, schedulerRotateA);
+                env.runtime.registerFunction(K_SCHED_A_RESUME, schedulerRotateAResume);
+                env.runtime.registerFunction(K_SCHED_B, schedulerTraceB);
+                env.ctx.pc = K_SCHED_MAIN;
+                EeScheduler &ee = env.runtime.eeScheduler();
+                ee.reset(env.rdram.data(), env.ctx);
+                const int first = ee.createThread(EeThreadCreateParams{0, K_SCHED_A, 0x20000u, 0x800u, 0, 5, 0});
+                ee.startThread(first, 0, env.ctx, false);
+                if (withLower)
+                {
+                    const int lower = ee.createThread(EeThreadCreateParams{0, K_SCHED_B, 0x21000u, 0x800u, 0, 20, 0});
+                    ee.startThread(lower, 0, env.ctx, false);
+                }
+                ee.run();
+                t.IsTrue(trace == std::vector<int>({1, 10, 11}), "the rotating thread retains its priority");
+            }
+        });
+
+        tc.Run("thread lookup follows ID reuse and scheduler reset", [](TestCase &t)
+        {
+            TestEnv env;
+            EeScheduler &ee = env.runtime.eeScheduler();
+            ee.reset(env.rdram.data(), env.ctx);
+            for (int i = 0; i < 2 * EeScheduler::kLastThreadId; ++i)
+            {
+                const int id = ee.createThread(EeThreadCreateParams{0, K_SCHED_A, 0x20000u, 0x800u, 0, 5, 0});
+                t.IsTrue(ee.thread(id) != nullptr, "new and reused IDs resolve");
+                uint32_t ownedStack = 0u;
+                t.Equals(ee.deleteThread(id, ownedStack), KE_OK, "dormant thread deletes");
+                t.IsTrue(ee.thread(id) == nullptr, "deleted ID does not retain its old node");
+            }
+            const int last = ee.createThread(EeThreadCreateParams{0, K_SCHED_B, 0x21000u, 0x800u, 0, 5, 0});
+            ee.reset(env.rdram.data(), env.ctx);
+            t.IsTrue(ee.thread(last) == nullptr, "reset clears all indexed threads");
+            t.IsTrue(ee.thread(EeScheduler::kMainThreadId) != nullptr, "reset installs the main thread");
+        });
+
         tc.Run("starting a strictly higher-priority thread preempts immediately", [](TestCase &t)
         {
             TestEnv env;

From 8546498777c97aa87222c14c711d5b192d91962b Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 10 Sep 2026 15:24:01 +0200
Subject: [PATCH 31/68] Preserve memory-card operations across RPC
 initialization

Match MCMAN wildcard and basename-rename semantics, retain IOP service state during EE RPC initialization, and cover pending operations and open file handles with regression tests. Add an optional scheduler snapshot trace for diagnosing guest thread stalls.
---
 .../src/lib/Kernel/Stubs/MemoryCard.cpp       | 22 +++--
 ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp   |  5 +-
 ps2xRuntime/src/lib/ps2_runtime.cpp           | 18 ++++
 ps2xTest/src/ps2_runtime_io_tests.cpp         | 87 +++++++++++++++++++
 4 files changed, 122 insertions(+), 10 deletions(-)

diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MemoryCard.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MemoryCard.cpp
index 53db24614..9f6d76675 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MemoryCard.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MemoryCard.cpp
@@ -364,7 +364,12 @@ namespace ps2_stubs
                 }
                 else if (patternPos < pattern.size() && pattern[patternPos] == '*')
                 {
-                    starPos = patternPos++;
+                    while (patternPos < pattern.size() &&
+                           (pattern[patternPos] == '*' || pattern[patternPos] == '?'))
+                    {
+                        ++patternPos;
+                    }
+                    starPos = patternPos - 1u;
                     matchPos = valuePos;
                 }
                 else if (starPos != std::string::npos)
@@ -383,7 +388,9 @@ namespace ps2_stubs
                 ++patternPos;
             }
 
-            return patternPos == pattern.size();
+            // MCMAN accepts '?' at the end of a shorter filename, even if
+            // more pattern characters follow (mcman_checkdirpath in PS2SDK).
+            return patternPos == pattern.size() || pattern[patternPos] == '?';
         }
 
         void setMcCommandResultLocked(int32_t cmd, int32_t result)
@@ -1135,11 +1142,13 @@ namespace ps2_stubs
                 {
                     const std::filesystem::path oldHostPath =
                         guestMcPathToHostPath(port, normalizeGuestMcPathLocked(port, oldPath));
-                    const std::filesystem::path newHostPath =
-                        guestMcPathToHostPath(port, normalizeGuestMcPathLocked(port, newPath));
+                    // libmc renames an entry within its existing directory.
+                    const std::filesystem::path newHostPath = oldHostPath.parent_path() / newPath;
                     std::error_code ec;
-                    if (std::filesystem::exists(oldHostPath, ec) && !ec &&
-                        std::filesystem::exists(newHostPath.parent_path(), ec) && !ec)
+                    if (!newPath.empty() && newPath != "." && newPath != ".." &&
+                        newPath.find_first_of("/\\") == std::string::npos &&
+                        std::filesystem::exists(oldHostPath, ec) && !ec &&
+                        !std::filesystem::exists(newHostPath, ec) && !ec)
                     {
                         std::filesystem::rename(oldHostPath, newHostPath, ec);
                         result = ec ? kMcResultDeniedPermit : kMcResultSucceed;
@@ -1149,6 +1158,7 @@ namespace ps2_stubs
 
             setMcCommandResultLocked(kMcCmdRename, result);
         }
+        MC_TRACE("Rename port=%d '%s' -> '%s' result=%d\n", port, oldPath.c_str(), newPath.c_str(), result);
         setReturnS32(ctx, 0);
     }
 
diff --git a/ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp b/ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp
index f5dfcc5af..b7f642705 100644
--- a/ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp
@@ -219,10 +219,7 @@ namespace ps2_syscalls
     void SifInitRpc(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         std::lock_guard<std::mutex> lock(g_rpc_mutex);
-        if (runtime)
-        {
-            PS2IopTransport::reset(runtime);
-        }
+        // Initializing the EE RPC client must not reboot the IOP services.
         if (!g_rpc_initialized)
         {
             g_rpc_servers.clear();
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index e554e7412..320dc84a4 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -2491,9 +2491,27 @@ void PS2Runtime::run()
         }
         gameThreadFinished.store(true, std::memory_order_release); });
 
+    const char *kernelTraceEnv = std::getenv("PS2X_KERNEL_TRACE_MS");
+    const auto kernelTraceInterval = std::chrono::milliseconds(kernelTraceEnv ? std::max(0, std::atoi(kernelTraceEnv)) : 0);
+    auto nextKernelTrace = std::chrono::steady_clock::now() + kernelTraceInterval;
     uint64_t tick = 0;
     while (!isStopRequested() && !gameThreadFinished.load(std::memory_order_acquire))
     {
+        if (kernelTraceInterval.count() > 0 && std::chrono::steady_clock::now() >= nextKernelTrace)
+        {
+            const auto snapshot = m_eeScheduler->snapshot();
+            std::fprintf(stderr, "[ee-kernel] sequence=%llu cycle=%llu running=%d\n",
+                         static_cast<unsigned long long>(snapshot.sequence),
+                         static_cast<unsigned long long>(snapshot.eeCycle), snapshot.runningThreadId);
+            for (const auto &thread : snapshot.threads)
+                std::fprintf(stderr, "  thread=%d pc=%08x entry=%08x priority=%d state=%d wait=%d object=%d\n",
+                             thread.id, thread.pc, thread.entry, thread.currentPriority,
+                             static_cast<int>(thread.status), static_cast<int>(thread.waitReason), thread.waitId);
+            for (const auto &sema : snapshot.semaphores)
+                if (sema.waiters)
+                    std::fprintf(stderr, "  sema=%d count=%d waiters=%u\n", sema.id, sema.count, sema.waiters);
+            nextKernelTrace = std::chrono::steady_clock::now() + kernelTraceInterval;
+        }
         PS2_IF_AGRESSIVE_LOGS({
             tick++;
             if ((tick % 120) == 0)
diff --git a/ps2xTest/src/ps2_runtime_io_tests.cpp b/ps2xTest/src/ps2_runtime_io_tests.cpp
index 1e920515b..d349b3506 100644
--- a/ps2xTest/src/ps2_runtime_io_tests.cpp
+++ b/ps2xTest/src/ps2_runtime_io_tests.cpp
@@ -152,6 +152,38 @@ void register_ps2_runtime_io_tests()
 {
     MiniTest::Case("PS2RuntimeIO", [](TestCase &tc)
     {
+        tc.Run("SifInitRpc preserves pending card operations and open files", [](TestCase &t)
+        {
+            PS2Runtime runtime;
+            TestContext test;
+            clearContext(test.ctx);
+            ps2_stubs::sceMcInit(test.rdram.data(), &test.ctx, &runtime);
+            { std::ofstream out(test.paths.mcRoot / "save.dat"); out << "saved adventure"; }
+            writeGuestString(test.rdram.data(), GUEST_STRING_AREA_START, "/save.dat");
+            setRegU32(test.ctx, 4, 0u);
+            setRegU32(test.ctx, 5, 1u);
+            setRegU32(test.ctx, 6, GUEST_STRING_AREA_START);
+            setRegU32(test.ctx, 7, PS2_FIO_O_RDONLY);
+            ps2_stubs::sceMcOpen(test.rdram.data(), &test.ctx, &runtime);
+            clearContext(test.ctx);
+            ps2_syscalls::SifInitRpc(test.rdram.data(), &test.ctx, &runtime);
+            int32_t cmd = 0;
+            const int32_t fd = syncMc(test.rdram, &cmd);
+            t.Equals(cmd, 0x02, "RPC init preserves pending card-open completion");
+            t.IsTrue(fd > 0, "card file remains open");
+            ps2_syscalls::SifInitRpc(test.rdram.data(), &test.ctx, &runtime);
+            setRegU32(test.ctx, 4, static_cast<uint32_t>(fd));
+            setRegU32(test.ctx, 5, GUEST_BUFFER_AREA_START);
+            setRegU32(test.ctx, 6, 15u);
+            ps2_stubs::sceMcRead(test.rdram.data(), &test.ctx, &runtime);
+            t.Equals(syncMc(test.rdram), 15, "repeated RPC initialization does not close the card file");
+            t.Equals(std::string(reinterpret_cast<char *>(test.rdram.data() + GUEST_BUFFER_AREA_START), 15),
+                     std::string("saved adventure"), "save contents survive RPC init");
+            setRegU32(test.ctx, 4, static_cast<uint32_t>(fd));
+            ps2_stubs::sceMcClose(test.rdram.data(), &test.ctx, &runtime);
+            t.Equals(syncMc(test.rdram), 0, "close the test save");
+        });
+
         tc.Run("mc0 directory creation", [](TestCase &t)
         {
             TestContext test;
@@ -461,6 +493,61 @@ void register_ps2_runtime_io_tests()
                      "sceMcGetDir file entries should carry the closed-file attribute");
         });
 
+        tc.Run("sceMcGetDir uses MCMAN wildcard semantics", [](TestCase &t)
+        {
+            TestContext test;
+            for (const char *name : {"SAVE_0", "SAVE_12", "SAVE_123", "SAVED_0"})
+                std::filesystem::create_directories(test.paths.mcRoot / name);
+
+            auto count = [&](const char *pattern) {
+                writeGuestString(test.rdram.data(), GUEST_STRING_AREA_START, pattern);
+                clearContext(test.ctx);
+                setRegU32(test.ctx, 4, 0u);
+                setRegU32(test.ctx, 5, 1u);
+                setRegU32(test.ctx, 6, GUEST_STRING_AREA_START);
+                setRegU32(test.ctx, 8, 8u);
+                setRegU32(test.ctx, 9, GUEST_MC_TABLE_ADDR);
+                ps2_stubs::sceMcGetDir(test.rdram.data(), &test.ctx, nullptr);
+                return syncMc(test.rdram);
+            };
+            t.Equals(count("/SAVE???"), 3, "question marks accept shorter names but exclude longer ones");
+            t.Equals(count("/SAVE_0?tail"), 1, "MCMAN accepts a question mark reached at end of name");
+            t.Equals(count("/SAVE*?0"), 2, "questions after a star do not require an extra character");
+            t.Equals(count("/SAVE*12"), 1, "star backtracking must still match the literal suffix");
+            t.Equals(count("/SAVE_0x"), 0, "a missing literal is not a wildcard match");
+        });
+
+        tc.Run("sceMcRename keeps entries in their parent directory", [](TestCase &t)
+        {
+            TestContext test;
+            clearContext(test.ctx);
+            ps2_stubs::sceMcFormat(test.rdram.data(), &test.ctx, nullptr);
+            t.Equals(syncMc(test.rdram), 0, "format the isolated test card");
+            std::filesystem::create_directories(test.paths.mcRoot / "SAVEDATA");
+            const auto original = test.paths.mcRoot / "SAVEDATA" / "icon.sys";
+            const auto renamed = test.paths.mcRoot / "SAVEDATA" / "icon.err";
+            { std::ofstream out(original); out << "icon metadata"; }
+            auto rename = [&](const char *oldName, const char *newName) {
+                writeGuestString(test.rdram.data(), GUEST_STRING_AREA_START, oldName);
+                writeGuestString(test.rdram.data(), GUEST_STRING_AREA_START + 0x100, newName);
+                clearContext(test.ctx);
+                setRegU32(test.ctx, 4, 0u);
+                setRegU32(test.ctx, 5, 1u);
+                setRegU32(test.ctx, 6, GUEST_STRING_AREA_START);
+                setRegU32(test.ctx, 7, GUEST_STRING_AREA_START + 0x100);
+                ps2_stubs::sceMcRename(test.rdram.data(), &test.ctx, nullptr);
+                return syncMc(test.rdram);
+            };
+            t.Equals(rename("/SAVEDATA/icon.sys", "icon.err"), 0, "basename rename succeeds");
+            t.IsTrue(std::filesystem::exists(renamed), "renamed metadata stays beside the save");
+            t.IsTrue(!std::filesystem::exists(test.paths.mcRoot / "icon.err"), "rename must not move to card root");
+            t.Equals(rename("/SAVEDATA/icon.err", "icon.sys"), 0, "save completion restores metadata name");
+            t.IsTrue(rename("/SAVEDATA/icon.sys", "../escape") < 0, "new name cannot move an entry");
+            { std::ofstream out(renamed); out << "existing file"; }
+            t.IsTrue(rename("/SAVEDATA/icon.sys", "icon.err") < 0, "rename cannot overwrite another entry");
+            t.IsTrue(std::filesystem::exists(original), "failed rename preserves the original");
+        });
+
         tc.Run("sceMcGetInfo reports formatted and unformatted states", [](TestCase &t)
         {
             TestContext test;

From 75da1599090b4a1bc4e1c6574cc65ca191e88350 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Fri, 11 Sep 2026 14:39:48 +0200
Subject: [PATCH 32/68] Preserve VIF tag commands and complete long DMA chains

---
 ps2xRuntime/include/runtime/ee_scheduler.h    |   4 +
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp    |  22 +++-
 .../src/lib/Kernel/Stubs/Helpers/Support.h    |   7 +-
 ps2xRuntime/src/lib/ps2_memory.cpp            |  43 +++---
 ps2xRuntime/src/lib/ps2_runtime.cpp           |   4 +-
 ps2xRuntime/src/lib/ps2_vif1_interpreter.cpp  |  55 +++-----
 ps2xTest/src/ps2_memory_tests.cpp             | 123 +++++++++++++++++-
 ps2xTest/src/ps2_runtime_interrupt_tests.cpp  |  34 +++++
 8 files changed, 230 insertions(+), 62 deletions(-)

diff --git a/ps2xRuntime/include/runtime/ee_scheduler.h b/ps2xRuntime/include/runtime/ee_scheduler.h
index 80a91140e..2b08a528d 100644
--- a/ps2xRuntime/include/runtime/ee_scheduler.h
+++ b/ps2xRuntime/include/runtime/ee_scheduler.h
@@ -189,6 +189,8 @@ struct EeThreadSnapshot
 {
     int id = 0;
     uint32_t pc = 0;
+    uint32_t ra = 0;
+    uint32_t sp = 0;
     uint32_t entry = 0;
     uint32_t stack = 0;
     uint32_t stackSize = 0;
@@ -448,6 +450,8 @@ class EeScheduler
     int m_dmacTailOrder = 1000;
     uint32_t m_enabledIntcMask = 0xFFFFFFFFu;
     uint32_t m_enabledDmacMask = 0xFFFFFFFFu;
+    uint32_t m_pendingIntcMask = 0u;
+    uint32_t m_pendingDmacMask = 0u;
     int m_currentThreadId = 0;
     bool m_rescheduleRequested = false;
     bool m_timeSliceExpired = false;
diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index ef0d3f3f8..0c4d54d8a 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -153,6 +153,8 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     m_dmacTailOrder = 1000;
     m_enabledIntcMask = 0xFFFFFFFFu;
     m_enabledDmacMask = 0xFFFFFFFFu;
+    m_pendingIntcMask = 0u;
+    m_pendingDmacMask = 0u;
     m_currentThreadId = 0;
     m_rescheduleRequested = false;
     m_timeSliceExpired = false;
@@ -1374,6 +1376,9 @@ int EeScheduler::addIrqHandler(bool dmac,
                                   sp,
                                   true,
                                   append ? ++tail : --head});
+    const uint32_t pending = dmac ? m_pendingDmacMask : m_pendingIntcMask;
+    if (cause < 32u && (pending & (1u << cause)) != 0u)
+        dispatchIrq(dmac, cause);
     return id;
 }
 
@@ -1397,6 +1402,10 @@ int EeScheduler::setIrqHandlerEnabled(bool dmac, int id, bool enabled)
     if (it != handlers.end())
     {
         it->second.enabled = enabled;
+        const uint32_t cause = it->second.cause;
+        const uint32_t pending = dmac ? m_pendingDmacMask : m_pendingIntcMask;
+        if (enabled && cause < 32u && (pending & (1u << cause)) != 0u)
+            dispatchIrq(dmac, cause);
     }
     return KE_OK;
 }
@@ -1410,6 +1419,9 @@ int EeScheduler::setIrqCauseEnabled(bool dmac, uint32_t cause, bool enabled)
         if (enabled)
         {
             mask |= 1u << cause;
+            const uint32_t pending = dmac ? m_pendingDmacMask : m_pendingIntcMask;
+            if ((pending & (1u << cause)) != 0u)
+                dispatchIrq(dmac, cause);
         }
         else
         {
@@ -1422,6 +1434,10 @@ int EeScheduler::setIrqCauseEnabled(bool dmac, uint32_t cause, bool enabled)
 void EeScheduler::dispatchIrq(bool dmac, uint32_t cause)
 {
     assertExecutor();
+    // Device completion remains pending while its handler or mask is disabled.
+    uint32_t &pending = dmac ? m_pendingDmacMask : m_pendingIntcMask;
+    const uint32_t causeBit = cause < 32u ? (1u << cause) : 0u;
+    pending |= causeBit;
     const uint32_t mask = dmac ? m_enabledDmacMask : m_enabledIntcMask;
     if (cause < 32u && (mask & (1u << cause)) == 0u)
     {
@@ -1440,6 +1456,8 @@ void EeScheduler::dispatchIrq(bool dmac, uint32_t cause)
     }
     std::sort(matching.begin(), matching.end(), [](const EeIrqHandler &left, const EeIrqHandler &right)
               { return left.order < right.order; });
+    if (!matching.empty())
+        pending &= ~causeBit;
     for (const EeIrqHandler &handler : matching)
     {
         GuestInvocation invocation{};
@@ -1684,13 +1702,15 @@ void EeScheduler::publishSnapshotNow()
     next.threads.reserve(m_threads.size());
     for (const auto &[id, item] : m_threads)
     {
-        if (id < 0)
+        if (id < 0 && item.status == EeThreadStatus::Dormant)
         {
             continue;
         }
         EeThreadSnapshot snapshot{};
         snapshot.id = id;
         snapshot.pc = item.activeContext().pc;
+        snapshot.ra = getRegU32(&item.activeContext(), 31);
+        snapshot.sp = getRegU32(&item.activeContext(), 29);
         snapshot.entry = item.entry;
         snapshot.stack = item.stack;
         snapshot.stackSize = item.stackSize;
diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/Helpers/Support.h b/ps2xRuntime/src/lib/Kernel/Stubs/Helpers/Support.h
index a7fae20ca..583cc818d 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/Helpers/Support.h
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/Helpers/Support.h
@@ -1360,7 +1360,9 @@ namespace
         uint32_t madr = 0;
         uint32_t qwc = 0;
         uint32_t tadr = payloadPhys;
-        uint32_t chcr = 0x00000181u; // DIR=1, TIE=1, STR=1 (normal mode).
+        PS2Memory &mem = runtime->memory();
+        // The SDK changes MODE, DIR and STR while preserving TTE and TIE.
+        uint32_t chcr = (mem.readIORegister(channelBase) & ~0xCu) | 0x101u;
 
         if (preferNormalCount)
         {
@@ -1369,10 +1371,9 @@ namespace
         }
         else
         {
-            chcr = 0x00000185u; // MODE=1 chain, DIR=1, TIE=1, STR=1.
+            chcr |= 0x4u; // MODE=1 chain.
         }
 
-        PS2Memory &mem = runtime->memory();
         mem.writeIORegister(channelBase + 0x20u, qwc & 0xFFFFu);
         mem.writeIORegister(channelBase + 0x10u, madr);
         mem.writeIORegister(channelBase + 0x30u, tadr);
diff --git a/ps2xRuntime/src/lib/ps2_memory.cpp b/ps2xRuntime/src/lib/ps2_memory.cpp
index 5d1b62ed4..bf0c88455 100644
--- a/ps2xRuntime/src/lib/ps2_memory.cpp
+++ b/ps2xRuntime/src/lib/ps2_memory.cpp
@@ -2,6 +2,7 @@
 #include "runtime/ps2_address.h"
 #include "runtime/gs/gs_frontend.h"
 #include "ps2_log.h"
+#include <array>
 #include <atomic>
 #include <cstring>
 #include <limits>
@@ -1366,7 +1367,13 @@ bool PS2Memory::writeIORegister(uint32_t address, uint32_t value)
                     uint32_t asr1 = m_ioRegisters[channelBase + 0x50];
                     uint32_t asp = (chcr >> 4) & 0x3u;
                     const bool tieEnabled = (chcr & (1u << 7)) != 0u;
-                    const int kMaxChainTags = 4096;
+                    const bool transferVifTagData = (chcr & (1u << 6)) != 0u &&
+                        (channelBase == 0x10009000u || channelBase == 0x10008000u);
+                    // Brent's cycle check includes the return stack, so finite CALL
+                    // chains can reuse a subchain without an arbitrary tag limit.
+                    std::array<uint32_t, 4> cycleCheckpoint{tagAddr, asr0, asr1, asp};
+                    uint64_t cyclePower = 1u;
+                    uint64_t cycleDistance = 0u;
                     std::vector<uint8_t> chainBuf;
 
                     auto appendData = [&](uint32_t srcAddr, uint32_t qwCount)
@@ -1404,7 +1411,7 @@ bool PS2Memory::writeIORegister(uint32_t address, uint32_t value)
                         }
                     };
 
-                    auto appendCompactVif1TagData = [&](uint32_t localTagAddr, uint32_t qwCount)
+                    auto appendVifTagData = [&](uint32_t localTagAddr)
                     {
                         uint32_t tagPhys = 0u;
                         const bool tagScratch = isScratchpad(localTagAddr);
@@ -1415,15 +1422,13 @@ bool PS2Memory::writeIORegister(uint32_t address, uint32_t value)
                         if (tagPhys + 16u > localMax)
                             return;
 
-                        // VIF packet helpers embed 8 bytes of VIF stream in the DMAtag's upper half.
+                        // With TTE, every tag supplies two VIFcodes before its payload.
                         chainBuf.insert(chainBuf.end(), localBase + tagPhys + 8u, localBase + tagPhys + 16u);
-                        appendData(localTagAddr + 16u, qwCount);
                     };
 
-                    int tagsProcessed = 0;
                     uint32_t lastTagUpper = (chcr >> 16) & 0xFFFFu;
 
-                    while (tagsProcessed < kMaxChainTags)
+                    while (true)
                     {
                         const uint32_t currentTagAddr = tagAddr;
                         const bool tagInSPR = isScratchpad(tagAddr);
@@ -1458,7 +1463,6 @@ bool PS2Memory::writeIORegister(uint32_t address, uint32_t value)
                         const bool irq = ((tag >> 31) & 0x1ull) != 0ull;
                         uint32_t addr = static_cast<uint32_t>((tag >> 32) & 0x7FFFFFFF);
                         lastTagUpper = static_cast<uint32_t>((tag >> 16) & 0xFFFFu);
-                        ++tagsProcessed;
 
                         uint32_t dataAddr = 0;
                         bool hasPayload = (tagQwc > 0);
@@ -1528,23 +1532,30 @@ bool PS2Memory::writeIORegister(uint32_t address, uint32_t value)
                             break;
                         }
 
-                        const bool compactVifLocalTag =
-                            (channelBase == 0x10009000u || channelBase == 0x10008000u) &&
-                            (id == 1u || id == 2u || id == 5u || id == 6u || id == 7u);
-                        if (compactVifLocalTag)
-                            appendCompactVif1TagData(currentTagAddr, 0u);
+                        if (transferVifTagData)
+                            appendVifTagData(currentTagAddr);
 
                         if (hasPayload)
                         {
-                            if (compactVifLocalTag)
-                                appendData(currentTagAddr + 16u, tagQwc);
-                            else
-                                appendData(dataAddr, tagQwc);
+                            appendData(dataAddr, tagQwc);
                         }
                         if (irq && tieEnabled)
                             endChain = true;
                         if (endChain)
                             break;
+                        const std::array<uint32_t, 4> nextState{tagAddr, asr0, asr1, asp};
+                        if (nextState == cycleCheckpoint)
+                        {
+                            RUNTIME_ERROR("[DMA] cyclic source chain at 0x" << std::hex
+                                          << tagAddr << " on channel 0x" << channelBase << std::dec << '\n');
+                            break;
+                        }
+                        if (++cycleDistance == cyclePower)
+                        {
+                            cycleCheckpoint = nextState;
+                            cyclePower *= 2u;
+                            cycleDistance = 0u;
+                        }
                     }
 
                     m_ioRegisters[channelBase + 0x30] = tagAddr;
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index 320dc84a4..0b5deaffe 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -2504,8 +2504,8 @@ void PS2Runtime::run()
                          static_cast<unsigned long long>(snapshot.sequence),
                          static_cast<unsigned long long>(snapshot.eeCycle), snapshot.runningThreadId);
             for (const auto &thread : snapshot.threads)
-                std::fprintf(stderr, "  thread=%d pc=%08x entry=%08x priority=%d state=%d wait=%d object=%d\n",
-                             thread.id, thread.pc, thread.entry, thread.currentPriority,
+                std::fprintf(stderr, "  thread=%d pc=%08x ra=%08x sp=%08x entry=%08x priority=%d state=%d wait=%d object=%d\n",
+                             thread.id, thread.pc, thread.ra, thread.sp, thread.entry, thread.currentPriority,
                              static_cast<int>(thread.status), static_cast<int>(thread.waitReason), thread.waitId);
             for (const auto &sema : snapshot.semaphores)
                 if (sema.waiters)
diff --git a/ps2xRuntime/src/lib/ps2_vif1_interpreter.cpp b/ps2xRuntime/src/lib/ps2_vif1_interpreter.cpp
index fd95e43d1..555ba52b9 100644
--- a/ps2xRuntime/src/lib/ps2_vif1_interpreter.cpp
+++ b/ps2xRuntime/src/lib/ps2_vif1_interpreter.cpp
@@ -271,37 +271,6 @@ void PS2Memory::processVIF1Data(const uint8_t *data, uint32_t sizeBytes)
 
     while (pos + 4 <= sizeBytes)
     {
-        if (m_vif1PendingPath2ImageQwc != 0u)
-        {
-            const uint32_t availableQw = (sizeBytes - pos) / 16u;
-            if (availableQw == 0u)
-            {
-                break;
-            }
-
-            const uint32_t chunkQw = std::min<uint32_t>(m_vif1PendingPath2ImageQwc, availableQw);
-            std::vector<uint8_t> imagePacket(16u + static_cast<size_t>(chunkQw) * 16u, 0u);
-            const uint64_t imageTag =
-                static_cast<uint64_t>(chunkQw & 0x7FFFu) |
-                ((m_vif1PendingPath2ImageQwc == chunkQw) ? (1ull << 15) : 0ull) |
-                (static_cast<uint64_t>(kGifFmtImage) << 58);
-            std::memcpy(imagePacket.data(), &imageTag, sizeof(imageTag));
-            std::memcpy(imagePacket.data() + 16u, data + pos, static_cast<size_t>(chunkQw) * 16u);
-            submitGifPacket(GifPathId::Path2,
-                            imagePacket.data(),
-                            static_cast<uint32_t>(imagePacket.size()),
-                            true,
-                            m_vif1PendingPath2DirectHl);
-
-            pos += chunkQw * 16u;
-            m_vif1PendingPath2ImageQwc -= chunkQw;
-            if (m_vif1PendingPath2ImageQwc == 0u)
-            {
-                m_vif1PendingPath2DirectHl = false;
-            }
-            continue;
-        }
-
         uint32_t cmd;
         memcpy(&cmd, data + pos, 4);
         pos += 4;
@@ -477,12 +446,30 @@ void PS2Memory::processVIF1Data(const uint8_t *data, uint32_t sizeBytes)
             if (qwCount > 0)
             {
                 const bool directHl = (opcode == VIF_DIRECTHL);
-                submitGifPacket(GifPathId::Path2, data + pos, qwCount * 16, true, directHl);
+                uint32_t consumedQw = 0u;
+                if (m_vif1PendingPath2ImageQwc != 0u)
+                {
+                    // GIF image continuation consumes DIRECT payload, never VIFcodes.
+                    consumedQw = std::min(m_vif1PendingPath2ImageQwc, qwCount);
+                    std::vector<uint8_t> imagePacket(16u + consumedQw * 16u, 0u);
+                    const uint64_t imageTag = static_cast<uint64_t>(consumedQw) |
+                        ((consumedQw == m_vif1PendingPath2ImageQwc) ? (1ull << 15) : 0ull) |
+                        (static_cast<uint64_t>(kGifFmtImage) << 58);
+                    std::memcpy(imagePacket.data(), &imageTag, sizeof(imageTag));
+                    std::memcpy(imagePacket.data() + 16u, data + pos, consumedQw * 16u);
+                    submitGifPacket(GifPathId::Path2, imagePacket.data(),
+                                    static_cast<uint32_t>(imagePacket.size()), true, directHl);
+                    m_vif1PendingPath2ImageQwc -= consumedQw;
+                }
 
-                const uint32_t imageQw = gifImageQwcFromTag(data + pos, qwCount * 16u);
+                const uint32_t remainingQw = qwCount - consumedQw;
+                const uint8_t *remainingData = data + pos + consumedQw * 16u;
+                if (remainingQw != 0u)
+                    submitGifPacket(GifPathId::Path2, remainingData, remainingQw * 16u, true, directHl);
+                const uint32_t imageQw = gifImageQwcFromTag(remainingData, remainingQw * 16u);
                 if (imageQw != 0u)
                 {
-                    const uint32_t inlineImageQw = (qwCount > 0u) ? (qwCount - 1u) : 0u;
+                    const uint32_t inlineImageQw = remainingQw - 1u;
                     if (imageQw > inlineImageQw)
                     {
                         m_vif1PendingPath2ImageQwc = imageQw - inlineImageQw;
diff --git a/ps2xTest/src/ps2_memory_tests.cpp b/ps2xTest/src/ps2_memory_tests.cpp
index 7c3e8ea5d..3cbad9c6a 100644
--- a/ps2xTest/src/ps2_memory_tests.cpp
+++ b/ps2xTest/src/ps2_memory_tests.cpp
@@ -1367,6 +1367,110 @@ void register_ps2_memory_tests()
             t.Equals(mem.readIORegister(kVif1Ch + 0x20u), 0u, "VIF1 QWC should be cleared after drain");
         });
 
+        tc.Run("VIF1 TTE transfers reference tag commands before their payload", [](TestCase &t)
+        {
+            for (const uint8_t id : {0u, 3u, 4u}) // REFE, REF, REFS
+            {
+                PS2Memory mem;
+                t.IsTrue(mem.initialize(), "PS2Memory initialize should succeed");
+                constexpr uint32_t channel = 0x10009000u;
+                constexpr uint32_t tag = 0x25000u;
+                constexpr uint32_t source = 0x26000u;
+                writeDmaTag(mem.getRDRAM(), tag, makeDmaTag(1u, id, source));
+                mem.write32(tag + 12u, makeVifCmd(0xCAu, 2u, 0x20u)); // MPG with IRQ.
+                writeDmaTag(mem.getRDRAM(), tag + 16u, makeDmaTag(0u, 7u, 0u));
+                for (uint32_t i = 0; i < 16u; ++i)
+                    mem.getRDRAM()[source + i] = static_cast<uint8_t>(0x30u + i);
+                mem.writeIORegister(channel + 0x30u, tag);
+                mem.writeIORegister(channel, 0x145u); // DIR, CHAIN, TTE, STR.
+                mem.processPendingTransfers();
+                t.IsTrue(std::memcmp(mem.getVU1Code() + 0x100u,
+                                     mem.getRDRAM() + source, 16u) == 0,
+                         "MPG in a reference tag should upload the referenced code");
+                t.Equals(mem.takePendingVifInterrupts(), 2u,
+                         "the tag's VIF interrupt should be delivered");
+            }
+        });
+
+        tc.Run("VIF1 with TTE disabled ignores tag commands and reads payload", [](TestCase &t)
+        {
+            PS2Memory mem;
+            t.IsTrue(mem.initialize(), "PS2Memory initialize should succeed");
+            constexpr uint32_t channel = 0x10009000u;
+            constexpr uint32_t tag = 0x25000u;
+            writeDmaTag(mem.getRDRAM(), tag, makeDmaTag(1u, 7u, 0u));
+            mem.write32(tag + 12u, makeVifCmd(0x84u, 0u, 0x44u));
+            mem.write32(tag + 16u, makeVifCmd(0x07u, 0u, 0x1234u)); // MARK.
+            mem.writeIORegister(channel + 0x30u, tag);
+            mem.writeIORegister(channel, 0x105u);
+            mem.processPendingTransfers();
+            t.Equals(mem.vif1_regs.itops, 0u, "tag ITOP should not execute without TTE");
+            t.Equals(mem.vif1_regs.mark, 0x1234u, "payload MARK should still execute");
+            t.Equals(mem.takePendingVifInterrupts(), 0u, "tag IRQ should not execute without TTE");
+        });
+
+        tc.Run("sceDmaSend preserves TTE and does not force TIE", [](TestCase &t)
+        {
+            PS2Runtime runtime;
+            auto &mem = runtime.memory();
+            t.IsTrue(mem.initialize(), "PS2Memory initialize should succeed");
+            constexpr uint32_t channel = 0x10009000u;
+            constexpr uint32_t tag = 0x25000u;
+            writeDmaTag(mem.getRDRAM(), tag, makeDmaTag(0u, 3u, 0u, true));
+            writeDmaTag(mem.getRDRAM(), tag + 16u, makeDmaTag(0u, 7u, 0u));
+            mem.write32(tag + 28u, makeVifCmd(0x84u, 0u, 0x55u));
+            mem.writeIORegister(channel, 0x40u); // TTE on, TIE off.
+            R5900Context ctx{};
+            setRegU32(ctx, 4, channel);
+            setRegU32(ctx, 5, tag);
+            ps2_stubs::sceDmaSend(mem.getRDRAM(), &ctx, &runtime);
+            t.Equals(mem.readIORegister(channel) & 0xC0u, 0x40u,
+                     "sceDmaSend should preserve configured tag flags");
+            t.Equals(mem.vif1_regs.itops, 0x55u,
+                     "DMA tag IRQ should not end a chain when TIE is disabled");
+            t.Equals(mem.takePendingVifInterrupts(), 2u,
+                     "the final VIF command should request completion");
+        });
+
+        tc.Run("VIF1 long chain can reuse a subchain and reach its final interrupt", [](TestCase &t)
+        {
+            PS2Memory mem;
+            t.IsTrue(mem.initialize(), "PS2Memory initialize should succeed");
+            constexpr uint32_t channel = 0x10009000u;
+            constexpr uint32_t first = 0x30000u;
+            constexpr uint32_t subchain = 0x50000u;
+            constexpr uint32_t calls = 4097u;
+            for (uint32_t i = 0u; i < calls; ++i)
+                writeDmaTag(mem.getRDRAM(), first + i * 16u, makeDmaTag(0u, 5u, subchain));
+            writeDmaTag(mem.getRDRAM(), subchain, makeDmaTag(0u, 6u, 0u));
+            const uint32_t last = first + calls * 16u;
+            writeDmaTag(mem.getRDRAM(), last, makeDmaTag(0u, 7u, 0u));
+            mem.write32(last + 12u, makeVifCmd(0x84u, 0u, 0x66u));
+            mem.writeIORegister(channel + 0x30u, first);
+            mem.writeIORegister(channel, 0x145u);
+            mem.processPendingTransfers();
+            t.Equals(mem.vif1_regs.itops, 0x66u, "a finite chain beyond 4096 tags must reach END");
+            t.Equals(mem.takePendingVifInterrupts(), 2u, "the final completion must not be truncated");
+        });
+
+        tc.Run("VIF1 cyclic DMA chain terminates without exhausting an arbitrary tag budget", [](TestCase &t)
+        {
+            PS2Memory mem;
+            t.IsTrue(mem.initialize(), "PS2Memory initialize should succeed");
+            constexpr uint32_t channel = 0x10009000u;
+            constexpr uint32_t first = 0x30000u;
+            writeDmaTag(mem.getRDRAM(), first, makeDmaTag(0u, 2u, first + 16u));
+            writeDmaTag(mem.getRDRAM(), first + 16u, makeDmaTag(0u, 2u, first));
+            mem.write32(first + 12u, makeVifCmd(0x14u, 0u, 0u));
+            mem.write32(first + 28u, makeVifCmd(0x14u, 0u, 0u));
+            uint32_t calls = 0u;
+            mem.setVu1MscalCallback([&](uint32_t, uint32_t, uint32_t) { ++calls; });
+            mem.writeIORegister(channel + 0x30u, first);
+            mem.writeIORegister(channel, 0x145u);
+            mem.processPendingTransfers();
+            t.IsTrue(calls >= 2u && calls <= 8u, "a two-tag cycle should be detected within a few repetitions");
+        });
+
         tc.Run("VIF1 DMA chain preserves compact tag high bytes for DIRECT packets", [](TestCase &t)
         {
             PS2Memory mem;
@@ -1396,7 +1500,7 @@ void register_ps2_memory_tests()
             });
 
             t.IsTrue(mem.writeIORegister(kVif1Ch + 0x30u, kTag), "write VIF1 TADR should succeed");
-            t.IsTrue(mem.writeIORegister(kVif1Ch + 0x00u, 0x104u), "write VIF1 CHCR STR|CHAIN should succeed");
+            t.IsTrue(mem.writeIORegister(kVif1Ch + 0x00u, 0x145u), "write VIF1 CHCR STR|TTE|CHAIN|DIR should succeed");
 
             mem.processPendingTransfers();
 
@@ -1435,7 +1539,7 @@ void register_ps2_memory_tests()
             std::memcpy(rdram + kTag + 12u, &itopCmd, sizeof(itopCmd));
 
             t.IsTrue(mem.writeIORegister(kVif1Ch + 0x30u, kTag), "write VIF1 TADR should succeed");
-            t.IsTrue(mem.writeIORegister(kVif1Ch + 0x00u, 0x104u), "write VIF1 CHCR STR|CHAIN should succeed");
+            t.IsTrue(mem.writeIORegister(kVif1Ch + 0x00u, 0x145u), "write VIF1 CHCR STR|TTE|CHAIN|DIR should succeed");
 
             mem.processPendingTransfers();
 
@@ -1497,7 +1601,7 @@ void register_ps2_memory_tests()
             });
 
             t.IsTrue(mem.writeIORegister(kVif1Ch + 0x30u, kBaseAddr), "write VIF1 TADR should succeed");
-            t.IsTrue(mem.writeIORegister(kVif1Ch + 0x00u, 0x104u), "write VIF1 CHCR STR|CHAIN should succeed");
+            t.IsTrue(mem.writeIORegister(kVif1Ch + 0x00u, 0x145u), "write VIF1 CHCR STR|TTE|CHAIN|DIR should succeed");
 
             mem.processPendingTransfers();
 
@@ -1880,7 +1984,7 @@ void register_ps2_memory_tests()
             t.IsTrue(imageOk, "VIF1 DIRECT image should update GS VRAM through GIF path2");
         });
 
-        tc.Run("VIF1 DIRECT image tag can continue with raw image qwords", [](TestCase &t)
+        tc.Run("VIF1 split DIRECT image preserves intervening VIF commands", [](TestCase &t)
         {
             PS2Memory mem;
             t.IsTrue(mem.initialize(), "PS2Memory initialize should succeed");
@@ -1909,12 +2013,16 @@ void register_ps2_memory_tests()
             appendU32(packet, makeVifCmd(0x50u, 0u, 1u)); // DIRECT 1 QW payload: GIF IMAGE tag only.
             appendU64(packet, makeGifTag(1u, GIF_FMT_IMAGE, 0u, true));
             appendU64(packet, 0ull);
+            appendU32(packet, makeVifCmd(0x07u, 0u, 0x1234u)); // MARK between DIRECTs.
+            appendU32(packet, makeVifCmd(0x51u, 0u, 1u)); // Image bytes remain inside DIRECTHL.
             for (uint32_t i = 0; i < 16u; ++i)
             {
                 packet.push_back(static_cast<uint8_t>(0xA0u + i));
             }
 
-            mem.processVIF1Data(packet.data(), static_cast<uint32_t>(packet.size()));
+            appendU32(packet, makeVifCmd(0x84u, 0u, 0x44u)); // Completion after the image.
+            mem.processVIF1Data(packet.data(), 20u);
+            mem.processVIF1Data(packet.data() + 20u, static_cast<uint32_t>(packet.size()) - 20u);
 
             const uint8_t *vramOut = mem.getGSVRAM();
             bool imageOk = true;
@@ -1930,7 +2038,10 @@ void register_ps2_memory_tests()
                     }
                 }
             }
-            t.IsTrue(imageOk, "raw qwords after a DIRECT image tag should continue the PATH2 image upload");
+            t.IsTrue(imageOk, "a subsequent DIRECT should continue the PATH2 image upload");
+            t.Equals(mem.vif1_regs.mark, 0x1234u, "VIF commands between DIRECTs must still execute");
+            t.Equals(mem.vif1_regs.itops, 0x44u, "VIF commands after image bytes must execute");
+            t.Equals(mem.takePendingVifInterrupts(), 2u, "completion after the image must reach INTC");
         });
 
         tc.Run("unaligned accesses throw", [](TestCase &t)
diff --git a/ps2xTest/src/ps2_runtime_interrupt_tests.cpp b/ps2xTest/src/ps2_runtime_interrupt_tests.cpp
index ccf4b703a..dcbb51fd9 100644
--- a/ps2xTest/src/ps2_runtime_interrupt_tests.cpp
+++ b/ps2xTest/src/ps2_runtime_interrupt_tests.cpp
@@ -52,6 +52,7 @@ namespace
     constexpr uint32_t kIrqWaitPc = 0x00160200u;
     constexpr uint32_t kIrqResumePc = 0x00160210u;
     constexpr uint32_t kIntcHandlerPc = 0x00160220u;
+    constexpr uint32_t kLatchedIrqWaitPc = 0x00160230u;
     constexpr uint32_t kISemaWaitPc = 0x00160300u;
     constexpr uint32_t kISemaResumePc = 0x00160310u;
     constexpr uint32_t kISemaDriverPc = 0x00160320u;
@@ -184,6 +185,20 @@ namespace
         runtime->requestStop();
     }
 
+    void schedulerLatchedIrqWait(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        g_dispatchTrace.push_back(1);
+        EeScheduler &scheduler = runtime->eeScheduler();
+        scheduler.setIrqCauseEnabled(false, 5u, false);
+        scheduler.dispatchIrq(false, 5u);
+        scheduler.dispatchIrq(false, 5u);
+        scheduler.addIrqHandler(false, 5u, kIntcHandlerPc, true, 0xCAFEu, 0u, 0u);
+        scheduler.setIrqCauseEnabled(false, 5u, true);
+        scheduler.setIrqCauseEnabled(false, 5u, true);
+        ctx->pc = kIrqResumePc;
+        scheduler.waitVSync(scheduler.currentVSyncTick());
+    }
+
     void schedulerISemaHandler(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
     {
         g_dispatchTrace.push_back(3);
@@ -467,6 +482,25 @@ void register_ps2_runtime_interrupt_tests()
                      "the IRQ frame should receive its registered argument");
         });
 
+        tc.Run("masked VIF completion survives late handler registration", [](TestCase &t)
+        {
+            TestEnv env;
+            env.runtime.registerFunction(kLatchedIrqWaitPc, schedulerLatchedIrqWait);
+            env.runtime.registerFunction(kIrqResumePc, schedulerIrqResume);
+            env.runtime.registerFunction(kIntcHandlerPc, schedulerIntcHandler);
+            g_dispatchTrace.clear();
+            g_lastIntcArg.store(0u, std::memory_order_relaxed);
+            R5900Context mainContext{};
+            mainContext.pc = kLatchedIrqWaitPc;
+            env.runtime.eeScheduler().reset(env.rdram.data(), mainContext);
+            env.runtime.eeScheduler().run();
+
+            t.IsTrue(g_dispatchTrace == std::vector<int>({1, 2, 3}),
+                     "unmasking must deliver the latched cause exactly once before resuming");
+            t.Equals(g_lastIntcArg.load(std::memory_order_relaxed), 0xCAFEu,
+                     "completion reaches the handler installed after the transfer");
+        });
+
         tc.Run("iSignalSema defers selection until IRQ return", [](TestCase &t)
         {
             TestEnv env;

From 7bb6dbdeb22218183c2aebe22994aac678606528 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Fri, 11 Sep 2026 19:54:17 +0200
Subject: [PATCH 33/68] Use current VI targets for VU register jumps

---
 ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp |  5 ++--
 ps2xTest/src/ps2_vu1_tests.cpp           | 33 ++++++++++++++++++++----
 2 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp
index 94be78914..1d9c05c35 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp
@@ -284,7 +284,8 @@ void VU1Interpreter::execLower(uint32_t instr, uint8_t *vuData, uint32_t dataSiz
     case 0x24: // JR
     {
         uint8_t is = VIS(instr);
-        uint32_t target = ((uint32_t)(uint16_t)readBranchVi(is) * 8u) & pcMask;
+        // Register jumps do not use conditional branches' delayed VI operand.
+        uint32_t target = ((uint32_t)(uint16_t)m_state.vi[is] * 8u) & pcMask;
         m_state.branchPending = true;
         m_state.branchTarget = target;
         m_state.branchDelay = 1;
@@ -294,7 +295,7 @@ void VU1Interpreter::execLower(uint32_t instr, uint8_t *vuData, uint32_t dataSiz
     {
         uint8_t it = VIT(instr);
         uint8_t is = VIS(instr);
-        uint32_t target = ((uint32_t)(uint16_t)readBranchVi(is) * 8u) & pcMask;
+        uint32_t target = ((uint32_t)(uint16_t)m_state.vi[is] * 8u) & pcMask;
         if (it != 0)
             m_state.vi[it] = (int32_t)((m_state.pc + 16) / 8);
         m_state.branchPending = true;
diff --git a/ps2xTest/src/ps2_vu1_tests.cpp b/ps2xTest/src/ps2_vu1_tests.cpp
index 0754b69fc..81d72eefb 100644
--- a/ps2xTest/src/ps2_vu1_tests.cpp
+++ b/ps2xTest/src/ps2_vu1_tests.cpp
@@ -1053,13 +1053,13 @@ void register_ps2_vu1_tests()
                      "the flag-driven branch should arrive at its target");
         });
 
-        tc.Run("JR shares the one-instruction VI branch visibility rule", [](TestCase &t)
+        tc.Run("JR reads the latest VI value after an integer write", [](TestCase &t)
         {
             Vu1Fixture fx;
             t.IsTrue(fx.initialize(), "VU1 fixture should initialize");
 
             writeVuInstructionPair(
-                fx.code, 0u, makeVuIaddiu(1u, 0u, 2),
+                fx.code, 0u, makeVuIaddiu(1u, 0u, 4),
                 kVuUpperNop);
             writeVuInstructionPair(
                 fx.code, 8u, makeVuJr(1u),
@@ -1075,19 +1075,42 @@ void register_ps2_vu1_tests()
                 kVuUpperNop);
 
             VU1Interpreter vu1;
-            vu1.state().vi[1] = 4;
+            vu1.state().vi[1] = 3;
             vu1.execute(fx.code, PS2_VU1_CODE_SIZE,
                         fx.data, PS2_VU1_DATA_SIZE, fx.gs, &fx.mem,
                         0u, 0u, 0u, 4u);
 
-            t.Equals(vu1.state().vi[1], 2,
+            t.Equals(vu1.state().vi[1], 4,
                      "the pending IALU write should still commit normally");
             t.Equals(vu1.state().vi[2], 2,
                      "JR should execute exactly one delay-slot pair");
             t.Equals(vu1.state().vi[3], 0,
                      "JR should skip the sequential instruction after its delay slot");
             t.Equals(vu1.state().vi[4], 4,
-                     "JR immediately after a VI write should branch using the previous VI value");
+                     "JR must use the updated target, unlike a conditional branch");
+        });
+
+        tc.Run("JALR uses the latest target before writing its link register", [](TestCase &t)
+        {
+            for (uint8_t link : {uint8_t{15}, uint8_t{1}})
+            {
+                Vu1Fixture fx;
+                t.IsTrue(fx.initialize(), "VU1 fixture should initialize");
+                writeVuInstructionPair(fx.code, 0u, makeVuIaddiu(1u, 0u, 4), kVuUpperNop);
+                const uint32_t jalr = (0x25u << 25u) | (static_cast<uint32_t>(link) << 16u) | (1u << 11u);
+                writeVuInstructionPair(fx.code, 8u, jalr, kVuUpperNop);
+                writeVuInstructionPair(fx.code, 16u, makeVuIaddiu(2u, 0u, 2), kVuUpperNop);
+                writeVuInstructionPair(fx.code, 24u, makeVuIaddiu(3u, 0u, 3), kVuUpperNop);
+                writeVuInstructionPair(fx.code, 32u, makeVuIaddiu(4u, 0u, 4), kVuUpperNop);
+                VU1Interpreter vu1;
+                vu1.state().vi[1] = 3;
+                vu1.execute(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                            fx.gs, &fx.mem, 0u, 0u, 0u, 4u);
+                t.Equals(vu1.state().vi[link], 3, "JALR links to the instruction after its delay slot");
+                t.Equals(vu1.state().vi[2], 2, "JALR must execute its delay slot");
+                t.Equals(vu1.state().vi[3], 0, "JALR must not use the stale target or newly written link");
+                t.Equals(vu1.state().vi[4], 4, "JALR must reach the updated target");
+            }
         });
 
         tc.Run("MPG upload invalidates cached VU1 decode before MSCAL", [](TestCase &t)

From aed0458d92ed20b964a5ab05a62fe8641e7430bc Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Sat, 12 Sep 2026 11:47:33 +0200
Subject: [PATCH 34/68] Reduce redundant VU interpreter pipeline and decode
 work

---
 ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp | 60 ++++++++++++++++---------
 1 file changed, 40 insertions(+), 20 deletions(-)

diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
index bd75bba31..4ae41fca9 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
@@ -5,6 +5,7 @@
 #include "ps2_vu1_detail.h"
 
 #include <algorithm>
+#include <bit>
 #include <cfenv>
 #include <cmath>
 #include <cstdio>
@@ -932,7 +933,12 @@ void VU1Interpreter::startXgkick(uint32_t qwordAddress)
         return;
 
     const uint32_t sourceAddress = (qwordAddress * 16u) % m_activeVuDataSize;
-    m_xgkick = {};
+    // Every submitted byte is copied before use; clearing the packet buffer
+    // on each kick adds 64 KiB of unrelated writes.
+    m_xgkick.totalBytes = 0;
+    m_xgkick.copiedBytes = 0;
+    m_xgkick.currentTagEnd = 0;
+    m_xgkick.currentTagEop = false;
     m_xgkick.active = true;
     m_xgkick.sourceAddress = sourceAddress;
     m_xgkick.cycleCredit = 1u; // XGKICK's issue cycle counts toward PATH1.
@@ -1005,10 +1011,10 @@ uint64_t VU1Interpreter::calculatePairReadyCycle(const DecodedInstructionPair &d
                     ready = std::max(ready, m_vfReady[access.reg][component]);
             }
         }
-        for (uint32_t reg = 1; reg < m_viReady.size(); ++reg)
+        for (uint32_t reads = usage->viRead & 0xFFFEu; reads != 0u; reads &= reads - 1u)
         {
-            if ((usage->viRead & (1u << reg)) != 0u)
-                ready = std::max(ready, m_viReady[reg]);
+            const unsigned reg = std::countr_zero(reads);
+            ready = std::max(ready, m_viReady[reg]);
         }
         for (uint32_t component = 0; component < 4u; ++component)
         {
@@ -1063,10 +1069,10 @@ void VU1Interpreter::markPairWrites(const DecodedInstructionPair &decoded)
         }
     }
 
-    for (uint32_t reg = 1; reg < m_viReady.size(); ++reg)
+    for (uint32_t writes = decoded.lowerUsage.viWrite & 0xFFFEu; writes != 0u; writes &= writes - 1u)
     {
-        if ((decoded.lowerUsage.viWrite & (1u << reg)) != 0u)
-            m_viReady[reg] = m_cycle + (decoded.lowerUsage.viLatency != 0u ? decoded.lowerUsage.viLatency : decoded.lowerUsage.latency);
+        const unsigned reg = std::countr_zero(writes);
+        m_viReady[reg] = m_cycle + (decoded.lowerUsage.viLatency != 0u ? decoded.lowerUsage.viLatency : decoded.lowerUsage.latency);
     }
     for (uint32_t component = 0; component < 4u; ++component)
     {
@@ -1633,13 +1639,35 @@ void VU1Interpreter::run(uint8_t *vuCode, uint32_t codeSize,
     const bool useVuRounding = std::fesetround(FE_TOWARDZERO) == 0;
     const uint64_t budgetEnd = m_cycle + maxCycles;
     bool programEnded = false;
+    const bool trackedCode = memory != nullptr && codeSize <= kMaxDecodedPairs * 8u &&
+        vuCode == (m_unit == Unit::VU1 ? memory->getVU1Code() : memory->getVU0Code());
+    if (trackedCode && (!m_decodedCodeCacheValid || m_cachedVuCode != vuCode ||
+                        m_cachedMemory != memory || m_cachedCodeSize != codeSize))
+        rebuildDecodedCodeCache(vuCode, codeSize, memory,
+            m_unit == Unit::VU1 ? memory->getVU1CodeGeneration() : memory->getVU0CodeGeneration());
+    commitReadyPipelines();
     while (m_cycle < budgetEnd && !m_stopRequested)
     {
-        commitReadyPipelines();
+        // advanceOneCycle already committed this boundary, including stalls.
         if (m_state.pc + 8u > codeSize)
             break;
 
-        const DecodedInstructionPair decoded = getDecodedInstructionPairForPc(vuCode, codeSize, memory, m_state.pc);
+        DecodedInstructionPair uncached;
+        const DecodedInstructionPair *pair = nullptr;
+        if (trackedCode && (m_state.pc & 7u) == 0u)
+        {
+            const uint64_t generation = m_unit == Unit::VU1
+                ? memory->getVU1CodeGeneration() : memory->getVU0CodeGeneration();
+            if (generation != m_cachedCodeGeneration)
+                rebuildDecodedCodeCache(vuCode, codeSize, memory, generation);
+            pair = &m_decodedCodeCache[m_state.pc / 8u];
+        }
+        else
+        {
+            uncached = getDecodedInstructionPairForPc(vuCode, codeSize, memory, m_state.pc);
+            pair = &uncached;
+        }
+        const DecodedInstructionPair &decoded = *pair;
         if (decoded.upperUsage.reserved || decoded.lowerUsage.reserved)
         {
             reportReservedInstruction(decoded.upperUsage.reserved, decoded.upperUsage.reserved ? decoded.upper : decoded.lower);
@@ -1660,17 +1688,9 @@ void VU1Interpreter::run(uint8_t *vuCode, uint32_t codeSize,
         if (m_cycle >= budgetEnd)
             break;
 
-        uint8_t writtenVi = 0u;
-        int32_t oldVi = 0;
-        for (uint32_t reg = 1; reg < 16u; ++reg)
-        {
-            if ((decoded.lowerUsage.viWrite & (1u << reg)) != 0u)
-            {
-                writtenVi = static_cast<uint8_t>(reg);
-                oldVi = m_state.vi[reg];
-                break;
-            }
-        }
+        const uint32_t viWrites = decoded.lowerUsage.viWrite & 0xFFFEu;
+        const uint8_t writtenVi = viWrites != 0u ? static_cast<uint8_t>(std::countr_zero(viWrites)) : 0u;
+        const int32_t oldVi = writtenVi != 0u ? m_state.vi[writtenVi] : 0;
 
         const VfAccess upperWrite = decoded.upperUsage.vfWrite;
         const VfAccess lowerWrite = decoded.lowerUsage.vfWrite;

From 39473db02e4770cbd703d939ff569bea666639ed Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Sat, 12 Sep 2026 22:16:54 +0200
Subject: [PATCH 35/68] Add keyboard analog sticks and combine keyboard with
 gamepad input

---
 ps2xRuntime/src/lib/ps2_pad.cpp | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/ps2xRuntime/src/lib/ps2_pad.cpp b/ps2xRuntime/src/lib/ps2_pad.cpp
index 7a1aa045e..c8e77d18f 100644
--- a/ps2xRuntime/src/lib/ps2_pad.cpp
+++ b/ps2xRuntime/src/lib/ps2_pad.cpp
@@ -56,10 +56,10 @@ namespace
     };
 
     constexpr KeyBinding kKeyBindings[] = {
-        {KEY_UP, PAD_UP}, {KEY_W, PAD_UP},
-        {KEY_DOWN, PAD_DOWN}, {KEY_S, PAD_DOWN},
-        {KEY_LEFT, PAD_LEFT}, {KEY_A, PAD_LEFT},
-        {KEY_RIGHT, PAD_RIGHT}, {KEY_D, PAD_RIGHT},
+        {KEY_UP, PAD_UP},
+        {KEY_DOWN, PAD_DOWN},
+        {KEY_LEFT, PAD_LEFT},
+        {KEY_RIGHT, PAD_RIGHT},
         {KEY_X, PAD_CROSS}, {KEY_SPACE, PAD_CROSS},
         {KEY_C, PAD_CIRCLE}, {KEY_ESCAPE, PAD_CIRCLE},
         {KEY_Z, PAD_SQUARE}, {KEY_KP_0, PAD_SQUARE},
@@ -70,6 +70,8 @@ namespace
         {KEY_RIGHT_SHIFT, PAD_R2},
         {KEY_ENTER, PAD_START},
         {KEY_TAB, PAD_SELECT},
+        {KEY_R, PAD_L3},
+        {KEY_F, PAD_R3},
     };
 
     struct PadBinding
@@ -99,10 +101,19 @@ namespace
 
     uint8_t axisToByte(float axis)
     {
-        const float mapped = 128.0f + axis * 127.0f;
+        if (axis > -0.125f && axis < 0.125f)
+            return kPadStickCenter;
+        const float mapped = 128.0f + axis * (axis < 0.0f ? 128.0f : 127.0f);
         return static_cast<uint8_t>(mapped < 0.0f ? 0.0f : (mapped > 255.0f ? 255.0f : mapped));
     }
 
+    uint8_t keyboardAxis(int negative, int positive, uint8_t fallback)
+    {
+        const bool low = IsKeyDown(negative);
+        const bool high = IsKeyDown(positive);
+        return low || high ? (low == high ? kPadStickCenter : low ? 0u : 255u) : fallback;
+    }
+
     uint64_t nowMs()
     {
         using namespace std::chrono;
@@ -151,7 +162,6 @@ namespace
             const uint8_t ly = axisToByte(GetGamepadAxisMovement(kGamepad, GAMEPAD_AXIS_LEFT_Y));
             sticks = (static_cast<uint32_t>(rx) << 24) | (static_cast<uint32_t>(ry) << 16) |
                      (static_cast<uint32_t>(lx) << 8) | static_cast<uint32_t>(ly);
-            return;
         }
 
         for (const KeyBinding &binding : kKeyBindings)
@@ -162,6 +172,12 @@ namespace
             }
         }
 
+        const uint8_t rx = keyboardAxis(KEY_J, KEY_L, static_cast<uint8_t>(sticks >> 24u));
+        const uint8_t ry = keyboardAxis(KEY_I, KEY_K, static_cast<uint8_t>(sticks >> 16u));
+        const uint8_t lx = keyboardAxis(KEY_A, KEY_D, static_cast<uint8_t>(sticks >> 8u));
+        const uint8_t ly = keyboardAxis(KEY_W, KEY_S, static_cast<uint8_t>(sticks));
+        sticks = (uint32_t(rx) << 24u) | (uint32_t(ry) << 16u) | (uint32_t(lx) << 8u) | ly;
+
         if (drainQueue)
         {
             // raylib queues every GLFW press, including one released again inside

From d435fc58773628667656366405f5bb4c56546519 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Sun, 13 Sep 2026 10:48:38 +0200
Subject: [PATCH 36/68] Track active VU pipeline slots to avoid empty scans

---
 ps2xRuntime/include/runtime/ps2_vu1.h   |   5 +
 ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp | 240 ++++++++++++------------
 2 files changed, 122 insertions(+), 123 deletions(-)

diff --git a/ps2xRuntime/include/runtime/ps2_vu1.h b/ps2xRuntime/include/runtime/ps2_vu1.h
index 67c8184fd..414958d5e 100644
--- a/ps2xRuntime/include/runtime/ps2_vu1.h
+++ b/ps2xRuntime/include/runtime/ps2_vu1.h
@@ -216,6 +216,11 @@ class VU1Interpreter
     std::array<PendingVfWrite, kMaxPendingVfWrites> m_vfWritePipeline{};
     std::array<PendingViWrite, kMaxPendingViWrites> m_viWritePipeline{};
     std::array<PendingAccWrite, kMaxPendingAccWrites> m_accWritePipeline{};
+    uint32_t m_activeFlags = 0;
+    uint32_t m_activeStores = 0;
+    uint32_t m_activeVfWrites = 0;
+    uint32_t m_activeViWrites = 0;
+    uint32_t m_activeAccWrites = 0;
     XgkickPipeline m_xgkick{};
     std::array<std::array<uint64_t, 4>, 32> m_vfReady{};
     std::array<uint64_t, 16> m_viReady{};
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
index 4ae41fca9..fbb276566 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
@@ -21,6 +21,18 @@ namespace
     {
         return static_cast<uint8_t>(1u << (3u - component));
     }
+
+    template <typename Entry, size_t Size>
+    Entry *allocatePipelineEntry(std::array<Entry, Size> &entries, uint32_t &active)
+    {
+        static_assert(Size < 32u);
+        const uint32_t available = ~active & ((1u << Size) - 1u);
+        if (available == 0u)
+            return nullptr;
+        const unsigned index = std::countr_zero(available);
+        active |= 1u << index;
+        return &entries[index];
+    }
 }
 
 void VU1Interpreter::addVfRead(InstructionUsage &usage, uint8_t reg, uint8_t lanes)
@@ -74,6 +86,7 @@ void VU1Interpreter::resetScheduler()
     m_vfWritePipeline = {};
     m_viWritePipeline = {};
     m_accWritePipeline = {};
+    m_activeFlags = m_activeStores = m_activeVfWrites = m_activeViWrites = m_activeAccWrites = 0u;
     m_xgkick = {};
     m_vfReady = {};
     m_viReady = {};
@@ -515,15 +528,7 @@ void VU1Interpreter::updateFmacFlags(const uint8_t laneFlags[4], uint8_t dest,
         status |= flags;
     }
 
-    FlagPipelineEntry *entry = nullptr;
-    for (FlagPipelineEntry &candidate : m_flagPipeline)
-    {
-        if (!candidate.valid)
-        {
-            entry = &candidate;
-            break;
-        }
-    }
+    FlagPipelineEntry *entry = allocatePipelineEntry(m_flagPipeline, m_activeFlags);
     if (!entry)
     {
         reportReservedInstruction(true, 0xFFFFFFFFu);
@@ -559,24 +564,23 @@ void VU1Interpreter::applyFmacDestAcc(float *result, uint8_t dest)
 
 void VU1Interpreter::queueFsset(uint16_t immediate)
 {
-    for (FlagPipelineEntry &entry : m_flagPipeline)
+    for (uint32_t active = m_activeFlags; active != 0u; active &= active - 1u)
     {
-        if (entry.valid && entry.issueCycle == m_cycle)
+        auto &entry = m_flagPipeline[std::countr_zero(active)];
+        if (entry.issueCycle == m_cycle)
             entry.writesStatus = false;
     }
 
-    for (FlagPipelineEntry &entry : m_flagPipeline)
+    if (auto *slot = allocatePipelineEntry(m_flagPipeline, m_activeFlags))
     {
-        if (!entry.valid)
-        {
-            entry = {};
-            entry.valid = true;
-            entry.issueCycle = m_cycle;
-            entry.readyCycle = m_cycle + kFmacLatency;
-            entry.status = static_cast<uint32_t>(immediate) & 0xFC0u;
-            entry.writesSticky = true;
-            return;
-        }
+        auto &entry = *slot;
+        entry = {};
+        entry.valid = true;
+        entry.issueCycle = m_cycle;
+        entry.readyCycle = m_cycle + kFmacLatency;
+        entry.status = static_cast<uint32_t>(immediate) & 0xFC0u;
+        entry.writesSticky = true;
+        return;
     }
     reportReservedInstruction(false, 0xFFFFFFFEu);
 }
@@ -584,18 +588,16 @@ void VU1Interpreter::queueFsset(uint16_t immediate)
 void VU1Interpreter::queueClip(uint32_t clip)
 {
     m_workingClip = ((m_workingClip << 6) | (clip & 0x3Fu)) & 0xFFFFFFu;
-    for (FlagPipelineEntry &entry : m_flagPipeline)
+    if (auto *slot = allocatePipelineEntry(m_flagPipeline, m_activeFlags))
     {
-        if (!entry.valid)
-        {
-            entry = {};
-            entry.valid = true;
-            entry.issueCycle = m_cycle;
-            entry.readyCycle = m_cycle + kFmacLatency;
-            entry.clip = m_workingClip;
-            entry.writesClip = true;
-            return;
-        }
+        auto &entry = *slot;
+        entry = {};
+        entry.valid = true;
+        entry.issueCycle = m_cycle;
+        entry.readyCycle = m_cycle + kFmacLatency;
+        entry.clip = m_workingClip;
+        entry.writesClip = true;
+        return;
     }
     reportReservedInstruction(true, 0xFFFFFFFDu);
 }
@@ -603,23 +605,22 @@ void VU1Interpreter::queueClip(uint32_t clip)
 void VU1Interpreter::queueFcset(uint32_t clip)
 {
     m_workingClip = clip & 0xFFFFFFu;
-    for (FlagPipelineEntry &entry : m_flagPipeline)
+    for (uint32_t active = m_activeFlags; active != 0u; active &= active - 1u)
     {
-        if (entry.valid && entry.issueCycle == m_cycle)
+        auto &entry = m_flagPipeline[std::countr_zero(active)];
+        if (entry.issueCycle == m_cycle)
             entry.writesClip = false;
     }
-    for (FlagPipelineEntry &entry : m_flagPipeline)
+    if (auto *slot = allocatePipelineEntry(m_flagPipeline, m_activeFlags))
     {
-        if (!entry.valid)
-        {
-            entry = {};
-            entry.valid = true;
-            entry.issueCycle = m_cycle;
-            entry.readyCycle = m_cycle + kFmacLatency;
-            entry.clip = m_workingClip;
-            entry.writesClip = true;
-            return;
-        }
+        auto &entry = *slot;
+        entry = {};
+        entry.valid = true;
+        entry.issueCycle = m_cycle;
+        entry.readyCycle = m_cycle + kFmacLatency;
+        entry.clip = m_workingClip;
+        entry.writesClip = true;
+        return;
     }
     reportReservedInstruction(false, 0xFFFFFFFAu);
 }
@@ -655,17 +656,15 @@ void VU1Interpreter::queueP(float value, uint32_t latency)
 
 void VU1Interpreter::queueStore(uint32_t address, const uint32_t words[4], uint8_t laneMask)
 {
-    for (PendingStore &store : m_storePipeline)
+    if (auto *slot = allocatePipelineEntry(m_storePipeline, m_activeStores))
     {
-        if (!store.valid)
-        {
-            store.valid = true;
-            store.readyCycle = m_cycle + 1u;
-            store.address = address;
-            store.laneMask = laneMask;
-            std::copy(words, words + 4, store.words.begin());
-            return;
-        }
+        auto &store = *slot;
+        store.valid = true;
+        store.readyCycle = m_cycle + 1u;
+        store.address = address;
+        store.laneMask = laneMask;
+        std::copy(words, words + 4, store.words.begin());
+        return;
     }
     reportReservedInstruction(false, 0xFFFFFFFCu);
 }
@@ -675,24 +674,22 @@ void VU1Interpreter::queueVfWrite(uint8_t reg, uint8_t laneMask,
 {
     if (reg == 0u || laneMask == 0u)
         return;
-    for (PendingVfWrite &write : m_vfWritePipeline)
+    if (auto *slot = allocatePipelineEntry(m_vfWritePipeline, m_activeVfWrites))
     {
-        if (!write.valid)
+        auto &write = *slot;
+        write = {};
+        write.valid = true;
+        write.readyCycle = m_cycle + latency;
+        write.sequence = ++m_nextWriteSequence;
+        write.reg = reg;
+        write.laneMask = laneMask;
+        std::copy(value, value + 4, write.value.begin());
+        for (uint32_t component = 0; component < 4u; ++component)
         {
-            write = {};
-            write.valid = true;
-            write.readyCycle = m_cycle + latency;
-            write.sequence = ++m_nextWriteSequence;
-            write.reg = reg;
-            write.laneMask = laneMask;
-            std::copy(value, value + 4, write.value.begin());
-            for (uint32_t component = 0; component < 4u; ++component)
-            {
-                if ((laneMask & laneForComponent(component)) != 0u)
-                    m_vfLatestWrite[reg][component] = write.sequence;
-            }
-            return;
+            if ((laneMask & laneForComponent(component)) != 0u)
+                m_vfLatestWrite[reg][component] = write.sequence;
         }
+        return;
     }
     reportReservedInstruction(false, 0xFFFFFFF7u);
 }
@@ -701,19 +698,17 @@ void VU1Interpreter::queueViWrite(uint8_t reg, int32_t value, uint32_t latency)
 {
     if (reg == 0u)
         return;
-    for (PendingViWrite &write : m_viWritePipeline)
+    if (auto *slot = allocatePipelineEntry(m_viWritePipeline, m_activeViWrites))
     {
-        if (!write.valid)
-        {
-            write = {};
-            write.valid = true;
-            write.readyCycle = m_cycle + latency;
-            write.sequence = ++m_nextWriteSequence;
-            write.reg = reg;
-            write.value = value;
-            m_viLatestWrite[reg] = write.sequence;
-            return;
-        }
+        auto &write = *slot;
+        write = {};
+        write.valid = true;
+        write.readyCycle = m_cycle + latency;
+        write.sequence = ++m_nextWriteSequence;
+        write.reg = reg;
+        write.value = value;
+        m_viLatestWrite[reg] = write.sequence;
+        return;
     }
     reportReservedInstruction(false, 0xFFFFFFF6u);
 }
@@ -722,32 +717,33 @@ void VU1Interpreter::queueAccWrite(uint8_t laneMask, const float value[4], uint3
 {
     if (laneMask == 0u)
         return;
-    for (PendingAccWrite &write : m_accWritePipeline)
+    if (auto *slot = allocatePipelineEntry(m_accWritePipeline, m_activeAccWrites))
     {
-        if (!write.valid)
+        auto &write = *slot;
+        write = {};
+        write.valid = true;
+        write.readyCycle = m_cycle + latency;
+        write.sequence = ++m_nextWriteSequence;
+        write.laneMask = laneMask;
+        std::copy(value, value + 4, write.value.begin());
+        for (uint32_t component = 0; component < 4u; ++component)
         {
-            write = {};
-            write.valid = true;
-            write.readyCycle = m_cycle + latency;
-            write.sequence = ++m_nextWriteSequence;
-            write.laneMask = laneMask;
-            std::copy(value, value + 4, write.value.begin());
-            for (uint32_t component = 0; component < 4u; ++component)
-            {
-                if ((laneMask & laneForComponent(component)) != 0u)
-                    m_accLatestWrite[component] = write.sequence;
-            }
-            return;
+            if ((laneMask & laneForComponent(component)) != 0u)
+                m_accLatestWrite[component] = write.sequence;
         }
+        return;
     }
     reportReservedInstruction(true, 0xFFFFFFF5u);
 }
 
 void VU1Interpreter::commitReadyPipelines()
 {
-    for (FlagPipelineEntry &entry : m_flagPipeline)
+    // Ascending slot order matches the original array walk for simultaneous commits.
+    for (uint32_t active = m_activeFlags; active != 0u; active &= active - 1u)
     {
-        if (!entry.valid || entry.readyCycle > m_cycle)
+        const unsigned index = std::countr_zero(active);
+        auto &entry = m_flagPipeline[index];
+        if (entry.readyCycle > m_cycle)
             continue;
 
         if (entry.writesMac)
@@ -764,6 +760,7 @@ void VU1Interpreter::commitReadyPipelines()
         if (entry.writesClip)
             m_state.clip = entry.clip;
         entry = {};
+        m_activeFlags &= ~(1u << index);
     }
 
     if (m_fdiv.valid && m_fdiv.readyCycle <= m_cycle)
@@ -783,9 +780,11 @@ void VU1Interpreter::commitReadyPipelines()
         }
     }
 
-    for (PendingStore &store : m_storePipeline)
+    for (uint32_t active = m_activeStores; active != 0u; active &= active - 1u)
     {
-        if (!store.valid || store.readyCycle > m_cycle)
+        const unsigned index = std::countr_zero(active);
+        auto &store = m_storePipeline[index];
+        if (store.readyCycle > m_cycle)
             continue;
         if (m_activeVuData && store.address + 16u <= m_activeVuDataSize)
         {
@@ -799,11 +798,14 @@ void VU1Interpreter::commitReadyPipelines()
             std::memcpy(m_activeVuData + store.address, oldWords, sizeof(oldWords));
         }
         store = {};
+        m_activeStores &= ~(1u << index);
     }
 
-    for (PendingVfWrite &write : m_vfWritePipeline)
+    for (uint32_t active = m_activeVfWrites; active != 0u; active &= active - 1u)
     {
-        if (!write.valid || write.readyCycle > m_cycle)
+        const unsigned index = std::countr_zero(active);
+        auto &write = m_vfWritePipeline[index];
+        if (write.readyCycle > m_cycle)
             continue;
         for (uint32_t component = 0; component < 4u; ++component)
         {
@@ -814,20 +816,26 @@ void VU1Interpreter::commitReadyPipelines()
             }
         }
         write = {};
+        m_activeVfWrites &= ~(1u << index);
     }
 
-    for (PendingViWrite &write : m_viWritePipeline)
+    for (uint32_t active = m_activeViWrites; active != 0u; active &= active - 1u)
     {
-        if (!write.valid || write.readyCycle > m_cycle)
+        const unsigned index = std::countr_zero(active);
+        auto &write = m_viWritePipeline[index];
+        if (write.readyCycle > m_cycle)
             continue;
         if (m_viLatestWrite[write.reg] == write.sequence)
             m_state.vi[write.reg] = static_cast<int16_t>(write.value);
         write = {};
+        m_activeViWrites &= ~(1u << index);
     }
 
-    for (PendingAccWrite &write : m_accWritePipeline)
+    for (uint32_t active = m_activeAccWrites; active != 0u; active &= active - 1u)
     {
-        if (!write.valid || write.readyCycle > m_cycle)
+        const unsigned index = std::countr_zero(active);
+        auto &write = m_accWritePipeline[index];
+        if (write.readyCycle > m_cycle)
             continue;
         for (uint32_t component = 0; component < 4u; ++component)
         {
@@ -838,6 +846,7 @@ void VU1Interpreter::commitReadyPipelines()
             }
         }
         write = {};
+        m_activeAccWrites &= ~(1u << index);
     }
 }
 
@@ -968,22 +977,7 @@ bool VU1Interpreter::pipelinesPending() const
     for (const ScalarPipelineEntry &entry : m_efu)
         if (entry.valid)
             return true;
-    for (const FlagPipelineEntry &entry : m_flagPipeline)
-        if (entry.valid)
-            return true;
-    for (const PendingStore &store : m_storePipeline)
-        if (store.valid)
-            return true;
-    for (const PendingVfWrite &write : m_vfWritePipeline)
-        if (write.valid)
-            return true;
-    for (const PendingViWrite &write : m_viWritePipeline)
-        if (write.valid)
-            return true;
-    for (const PendingAccWrite &write : m_accWritePipeline)
-        if (write.valid)
-            return true;
-    return false;
+    return (m_activeFlags | m_activeStores | m_activeVfWrites | m_activeViWrites | m_activeAccWrites) != 0u;
 }
 
 void VU1Interpreter::flushPipelines()

From 8841a88bcbce3760e5f972c5d70645c26ec57ddc Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Sun, 13 Sep 2026 21:35:02 +0200
Subject: [PATCH 37/68] Reduce VU operand setup and expose helpers to the
 optimizer

---
 ps2xRuntime/CMakeLists.txt               | 8 ++++++++
 ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index aad5fb80b..2fbef83d6 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -394,6 +394,14 @@ add_library(ps2_runtime STATIC
     src/lib/games_database.cpp
 )
 
+# Keep the VU execution loop and its arithmetic helpers visible to the optimizer.
+set_target_properties(ps2_runtime PROPERTIES UNITY_BUILD ON UNITY_BUILD_MODE GROUP)
+set_source_files_properties(
+    src/lib/vu/ps2_vu1_core.cpp
+    src/lib/vu/ps2_vu1_upper.cpp
+    src/lib/vu/ps2_vu1_lower.cpp
+    PROPERTIES UNITY_GROUP vu1)
+
 if(PS2X_ENABLE_RUNTIME_LOGS)
     target_compile_definitions(ps2_runtime PUBLIC
         PS2_RUNTIME_LOGS=1
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
index 69742546f..d7cbf71f3 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
@@ -30,6 +30,14 @@ void VU1Interpreter::execUpper(uint32_t instr)
     uint8_t fd = FD(instr);
     uint8_t op = instr & 0x3F;
 
+    // Lower-pipeline work often pairs with an upper NOP; it has no operands.
+    if (op >= 0x3Cu)
+    {
+        const uint8_t special = (instr & 3u) | ((instr >> 4) & 0x7Cu);
+        if (special == 0x2Fu || special == 0x30u)
+            return;
+    }
+
     float *vd = m_state.vf[fd];
     float normalizedVs[4];
     float normalizedVt[4];

From 9387f24500079bf733bb776306b28495ccbb88ea Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Sun, 13 Sep 2026 21:47:16 +0200
Subject: [PATCH 38/68] Avoid unused VU operands and redundant normal-result
 flag calculations

---
 ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp  |  17 +++
 ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp | 158 +++++++++++------------
 ps2xTest/src/ps2_vu1_tests.cpp           |  36 ++++++
 3 files changed, 128 insertions(+), 83 deletions(-)

diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
index fbb276566..271cf9051 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
@@ -211,12 +211,29 @@ void VU1Interpreter::applyDestAcc(const float *result, uint8_t dest)
 void VU1Interpreter::normalizeFmacResult(float *result, uint8_t dest,
                                          uint8_t laneFlags[4])
 {
+    const uint32_t upper = m_currentUpperInstruction;
+    const uint32_t op = (upper & 0x3fu) < 0x3cu
+        ? upper & 0x3fu : (upper & 3u) | ((upper >> 4u) & 0x7cu);
+    const bool simpleArithmetic = op <= 7u || (op >= 0x18u && op <= 0x1cu) ||
+        op == 0x1eu || op == 0x20u || op == 0x22u || op == 0x24u ||
+        op == 0x26u || op == 0x28u || op == 0x2au || op == 0x2cu;
     for (uint32_t component = 0; component < 4u; ++component)
     {
         laneFlags[component] = 0u;
         if ((dest & laneForComponent(component)) == 0u)
             continue;
 
+        // A normal ADD/SUB/MUL result has only a sign flag. Keep exact checks
+        // at both range boundaries, including overflow rounded to FLT_MAX.
+        uint32_t bits;
+        std::memcpy(&bits, &result[component], sizeof(bits));
+        const uint32_t magnitude = bits & 0x7fffffffu;
+        if (simpleArithmetic && magnitude >= 0x00800000u && magnitude < 0x7f7fffffu)
+        {
+            laneFlags[component] = static_cast<uint8_t>((bits >> 30u) & 2u);
+            continue;
+        }
+
         long double exactResult = 0.0L;
         if (calculateFmacExactResult(component, exactResult))
         {
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
index d7cbf71f3..6da558158 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
@@ -39,20 +39,12 @@ void VU1Interpreter::execUpper(uint32_t instr)
     }
 
     float *vd = m_state.vf[fd];
-    float normalizedVs[4];
-    float normalizedVt[4];
-    float normalizedAcc[4];
-    for (uint32_t component = 0; component < 4u; ++component)
-    {
-        normalizedVs[component] = normalizeOperand(m_state.vf[fs][component]);
-        normalizedVt[component] = normalizeOperand(m_state.vf[ft][component]);
-        normalizedAcc[component] = normalizeOperand(m_state.acc[component]);
-    }
-    const float *vs = normalizedVs;
-    const float *vt = normalizedVt;
-    const float *acc = normalizedAcc;
-    const float q = normalizeOperand(m_state.q);
-    const float i = normalizeOperand(m_state.i);
+    // Normalize only operands used by this opcode, after dispatch selects it.
+    const auto vs = [this, fs](unsigned c) { return normalizeOperand(m_state.vf[fs][c]); };
+    const auto vt = [this, ft](unsigned c) { return normalizeOperand(m_state.vf[ft][c]); };
+    const auto acc = [this](unsigned c) { return normalizeOperand(m_state.acc[c]); };
+    const auto q = [this] { return normalizeOperand(m_state.q); };
+    const auto i = [this] { return normalizeOperand(m_state.i); };
     float result[4];
 
     // Upper opcode decoding (bits 5:0 of upper word)
@@ -63,9 +55,9 @@ void VU1Interpreter::execUpper(uint32_t instr)
     case 0x02:
     case 0x03: // ADDbc
     {
-        float bc = broadcast(vt, op & 3);
+        float bc = vt(op & 3);
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] + bc;
+            result[c] = vs(c) + bc;
         applyFmacDest(vd, result, dest);
         return;
     }
@@ -74,9 +66,9 @@ void VU1Interpreter::execUpper(uint32_t instr)
     case 0x06:
     case 0x07: // SUBbc
     {
-        float bc = broadcast(vt, op & 3);
+        float bc = vt(op & 3);
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] - bc;
+            result[c] = vs(c) - bc;
         applyFmacDest(vd, result, dest);
         return;
     }
@@ -85,9 +77,9 @@ void VU1Interpreter::execUpper(uint32_t instr)
     case 0x0A:
     case 0x0B: // MADDbc
     {
-        float bc = broadcast(vt, op & 3);
+        float bc = vt(op & 3);
         for (int c = 0; c < 4; c++)
-            result[c] = acc[c] + vs[c] * bc;
+            result[c] = acc(c) + vs(c) * bc;
         applyFmacDest(vd, result, dest);
         return;
     }
@@ -96,9 +88,9 @@ void VU1Interpreter::execUpper(uint32_t instr)
     case 0x0E:
     case 0x0F: // MSUBbc
     {
-        float bc = broadcast(vt, op & 3);
+        float bc = vt(op & 3);
         for (int c = 0; c < 4; c++)
-            result[c] = acc[c] - vs[c] * bc;
+            result[c] = acc(c) - vs(c) * bc;
         applyFmacDest(vd, result, dest);
         return;
     }
@@ -107,9 +99,9 @@ void VU1Interpreter::execUpper(uint32_t instr)
     case 0x12:
     case 0x13: // MAXbc
     {
-        float bc = broadcast(vt, op & 3);
+        float bc = vt(op & 3);
         for (int c = 0; c < 4; c++)
-            result[c] = (vs[c] > bc) ? vs[c] : bc;
+            result[c] = (vs(c) > bc) ? vs(c) : bc;
         applyDest(vd, result, dest);
         return;
     }
@@ -118,9 +110,9 @@ void VU1Interpreter::execUpper(uint32_t instr)
     case 0x16:
     case 0x17: // MINIbc
     {
-        float bc = broadcast(vt, op & 3);
+        float bc = vt(op & 3);
         for (int c = 0; c < 4; c++)
-            result[c] = (vs[c] < bc) ? vs[c] : bc;
+            result[c] = (vs(c) < bc) ? vs(c) : bc;
         applyDest(vd, result, dest);
         return;
     }
@@ -129,112 +121,112 @@ void VU1Interpreter::execUpper(uint32_t instr)
     case 0x1A:
     case 0x1B: // MULbc
     {
-        float bc = broadcast(vt, op & 3);
+        float bc = vt(op & 3);
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] * bc;
+            result[c] = vs(c) * bc;
         applyFmacDest(vd, result, dest);
         return;
     }
     case 0x1C: // MULq
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] * q;
+            result[c] = vs(c) * q();
         applyFmacDest(vd, result, dest);
         return;
     case 0x1D: // MAXi
         for (int c = 0; c < 4; c++)
-            result[c] = (vs[c] > i) ? vs[c] : i;
+            result[c] = (vs(c) > i()) ? vs(c) : i();
         applyDest(vd, result, dest);
         return;
     case 0x1E: // MULi
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] * i;
+            result[c] = vs(c) * i();
         applyFmacDest(vd, result, dest);
         return;
     case 0x1F: // MINIi
         for (int c = 0; c < 4; c++)
-            result[c] = (vs[c] < i) ? vs[c] : i;
+            result[c] = (vs(c) < i()) ? vs(c) : i();
         applyDest(vd, result, dest);
         return;
     case 0x20: // ADDq
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] + q;
+            result[c] = vs(c) + q();
         applyFmacDest(vd, result, dest);
         return;
     case 0x21: // MADDq
         for (int c = 0; c < 4; c++)
-            result[c] = acc[c] + vs[c] * q;
+            result[c] = acc(c) + vs(c) * q();
         applyFmacDest(vd, result, dest);
         return;
     case 0x22: // ADDi
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] + i;
+            result[c] = vs(c) + i();
         applyFmacDest(vd, result, dest);
         return;
     case 0x23: // MADDi
         for (int c = 0; c < 4; c++)
-            result[c] = acc[c] + vs[c] * i;
+            result[c] = acc(c) + vs(c) * i();
         applyFmacDest(vd, result, dest);
         return;
     case 0x24: // SUBq
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] - q;
+            result[c] = vs(c) - q();
         applyFmacDest(vd, result, dest);
         return;
     case 0x25: // MSUBq
         for (int c = 0; c < 4; c++)
-            result[c] = acc[c] - vs[c] * q;
+            result[c] = acc(c) - vs(c) * q();
         applyFmacDest(vd, result, dest);
         return;
     case 0x26: // SUBi
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] - i;
+            result[c] = vs(c) - i();
         applyFmacDest(vd, result, dest);
         return;
     case 0x27: // MSUBi
         for (int c = 0; c < 4; c++)
-            result[c] = acc[c] - vs[c] * i;
+            result[c] = acc(c) - vs(c) * i();
         applyFmacDest(vd, result, dest);
         return;
     case 0x28: // ADD
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] + vt[c];
+            result[c] = vs(c) + vt(c);
         applyFmacDest(vd, result, dest);
         return;
     case 0x29: // MADD
         for (int c = 0; c < 4; c++)
-            result[c] = acc[c] + vs[c] * vt[c];
+            result[c] = acc(c) + vs(c) * vt(c);
         applyFmacDest(vd, result, dest);
         return;
     case 0x2A: // MUL
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] * vt[c];
+            result[c] = vs(c) * vt(c);
         applyFmacDest(vd, result, dest);
         return;
     case 0x2B: // MAX
         for (int c = 0; c < 4; c++)
-            result[c] = (vs[c] > vt[c]) ? vs[c] : vt[c];
+            result[c] = (vs(c) > vt(c)) ? vs(c) : vt(c);
         applyDest(vd, result, dest);
         return;
     case 0x2C: // SUB
         for (int c = 0; c < 4; c++)
-            result[c] = vs[c] - vt[c];
+            result[c] = vs(c) - vt(c);
         applyFmacDest(vd, result, dest);
         return;
     case 0x2D: // MSUB
         for (int c = 0; c < 4; c++)
-            result[c] = acc[c] - vs[c] * vt[c];
+            result[c] = acc(c) - vs(c) * vt(c);
         applyFmacDest(vd, result, dest);
         return;
     case 0x2E: // OPMSUB
-        result[0] = acc[0] - vs[1] * vt[2];
-        result[1] = acc[1] - vs[2] * vt[0];
-        result[2] = acc[2] - vs[0] * vt[1];
+        result[0] = acc(0) - vs(1) * vt(2);
+        result[1] = acc(1) - vs(2) * vt(0);
+        result[2] = acc(2) - vs(0) * vt(1);
         result[3] = 0.0f;
         applyFmacDest(vd, result, dest);
         return;
     case 0x2F: // MINI
         for (int c = 0; c < 4; c++)
-            result[c] = (vs[c] < vt[c]) ? vs[c] : vt[c];
+            result[c] = (vs(c) < vt(c)) ? vs(c) : vt(c);
         applyDest(vd, result, dest);
         return;
 
@@ -257,9 +249,9 @@ void VU1Interpreter::execUpper(uint32_t instr)
         case 0x02:
         case 0x03: // ADDAbc
         {
-            float bc = broadcast(vt, specialOp & 3);
+            float bc = vt(specialOp & 3);
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] + bc;
+                result[c] = vs(c) + bc;
             applyFmacDestAcc(result, dest);
             return;
         }
@@ -268,9 +260,9 @@ void VU1Interpreter::execUpper(uint32_t instr)
         case 0x06:
         case 0x07: // SUBAbc
         {
-            float bc = broadcast(vt, specialOp & 3);
+            float bc = vt(specialOp & 3);
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] - bc;
+                result[c] = vs(c) - bc;
             applyFmacDestAcc(result, dest);
             return;
         }
@@ -279,9 +271,9 @@ void VU1Interpreter::execUpper(uint32_t instr)
         case 0x0A:
         case 0x0B: // MADDAbc
         {
-            float bc = broadcast(vt, specialOp & 3);
+            float bc = vt(specialOp & 3);
             for (int c = 0; c < 4; c++)
-                result[c] = acc[c] + vs[c] * bc;
+                result[c] = acc(c) + vs(c) * bc;
             applyFmacDestAcc(result, dest);
             return;
         }
@@ -290,9 +282,9 @@ void VU1Interpreter::execUpper(uint32_t instr)
         case 0x0E:
         case 0x0F: // MSUBAbc
         {
-            float bc = broadcast(vt, specialOp & 3);
+            float bc = vt(specialOp & 3);
             for (int c = 0; c < 4; c++)
-                result[c] = acc[c] - vs[c] * bc;
+                result[c] = acc(c) - vs(c) * bc;
             applyFmacDestAcc(result, dest);
             return;
         }
@@ -335,7 +327,7 @@ void VU1Interpreter::execUpper(uint32_t instr)
         case 0x14: // FTOI0
             for (int c = 0; c < 4; c++)
             {
-                int32_t iv = vuFloatToInt(vs[c], 1.0f);
+                int32_t iv = vuFloatToInt(vs(c), 1.0f);
                 std::memcpy(&result[c], &iv, 4);
             }
             applyDest(vtDest, result, dest);
@@ -343,7 +335,7 @@ void VU1Interpreter::execUpper(uint32_t instr)
         case 0x15: // FTOI4
             for (int c = 0; c < 4; c++)
             {
-                int32_t iv = vuFloatToInt(vs[c], 16.0f);
+                int32_t iv = vuFloatToInt(vs(c), 16.0f);
                 std::memcpy(&result[c], &iv, 4);
             }
             applyDest(vtDest, result, dest);
@@ -351,7 +343,7 @@ void VU1Interpreter::execUpper(uint32_t instr)
         case 0x16: // FTOI12
             for (int c = 0; c < 4; c++)
             {
-                int32_t iv = vuFloatToInt(vs[c], 4096.0f);
+                int32_t iv = vuFloatToInt(vs(c), 4096.0f);
                 std::memcpy(&result[c], &iv, 4);
             }
             applyDest(vtDest, result, dest);
@@ -359,7 +351,7 @@ void VU1Interpreter::execUpper(uint32_t instr)
         case 0x17: // FTOI15
             for (int c = 0; c < 4; c++)
             {
-                int32_t iv = vuFloatToInt(vs[c], 32768.0f);
+                int32_t iv = vuFloatToInt(vs(c), 32768.0f);
                 std::memcpy(&result[c], &iv, 4);
             }
             applyDest(vtDest, result, dest);
@@ -369,25 +361,25 @@ void VU1Interpreter::execUpper(uint32_t instr)
         case 0x1A:
         case 0x1B: // MULAbc
         {
-            float bc = broadcast(vt, specialOp & 3);
+            float bc = vt(specialOp & 3);
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] * bc;
+                result[c] = vs(c) * bc;
             applyFmacDestAcc(result, dest);
             return;
         }
         case 0x1C: // MULAq
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] * q;
+                result[c] = vs(c) * q();
             applyFmacDestAcc(result, dest);
             return;
         case 0x1D: // ABS
             for (int c = 0; c < 4; c++)
-                result[c] = std::fabs(vs[c]);
+                result[c] = std::fabs(vs(c));
             applyDest(vtDest, result, dest);
             return;
         case 0x1E: // MULAi
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] * i;
+                result[c] = vs(c) * i();
             applyFmacDestAcc(result, dest);
             return;
         case 0x1F: // CLIP
@@ -424,73 +416,73 @@ void VU1Interpreter::execUpper(uint32_t instr)
         }
         case 0x20: // ADDAq
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] + q;
+                result[c] = vs(c) + q();
             applyFmacDestAcc(result, dest);
             return;
         case 0x21: // MADDAq
             for (int c = 0; c < 4; c++)
-                result[c] = acc[c] + vs[c] * q;
+                result[c] = acc(c) + vs(c) * q();
             applyFmacDestAcc(result, dest);
             return;
         case 0x22: // ADDAi
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] + i;
+                result[c] = vs(c) + i();
             applyFmacDestAcc(result, dest);
             return;
         case 0x23: // MADDAi
             for (int c = 0; c < 4; c++)
-                result[c] = acc[c] + vs[c] * i;
+                result[c] = acc(c) + vs(c) * i();
             applyFmacDestAcc(result, dest);
             return;
         case 0x24: // SUBAq
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] - q;
+                result[c] = vs(c) - q();
             applyFmacDestAcc(result, dest);
             return;
         case 0x25: // MSUBAq
             for (int c = 0; c < 4; c++)
-                result[c] = acc[c] - vs[c] * q;
+                result[c] = acc(c) - vs(c) * q();
             applyFmacDestAcc(result, dest);
             return;
         case 0x26: // SUBAi
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] - i;
+                result[c] = vs(c) - i();
             applyFmacDestAcc(result, dest);
             return;
         case 0x27: // MSUBAi
             for (int c = 0; c < 4; c++)
-                result[c] = acc[c] - vs[c] * i;
+                result[c] = acc(c) - vs(c) * i();
             applyFmacDestAcc(result, dest);
             return;
         case 0x28: // ADDA
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] + vt[c];
+                result[c] = vs(c) + vt(c);
             applyFmacDestAcc(result, dest);
             return;
         case 0x29: // MADDA
             for (int c = 0; c < 4; c++)
-                result[c] = acc[c] + vs[c] * vt[c];
+                result[c] = acc(c) + vs(c) * vt(c);
             applyFmacDestAcc(result, dest);
             return;
         case 0x2A: // MULA
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] * vt[c];
+                result[c] = vs(c) * vt(c);
             applyFmacDestAcc(result, dest);
             return;
         case 0x2C: // SUBA
             for (int c = 0; c < 4; c++)
-                result[c] = vs[c] - vt[c];
+                result[c] = vs(c) - vt(c);
             applyFmacDestAcc(result, dest);
             return;
         case 0x2D: // MSUBA
             for (int c = 0; c < 4; c++)
-                result[c] = acc[c] - vs[c] * vt[c];
+                result[c] = acc(c) - vs(c) * vt(c);
             applyFmacDestAcc(result, dest);
             return;
         case 0x2E: // OPMULA
-            result[0] = vs[1] * vt[2];
-            result[1] = vs[2] * vt[0];
-            result[2] = vs[0] * vt[1];
+            result[0] = vs(1) * vt(2);
+            result[1] = vs(2) * vt(0);
+            result[2] = vs(0) * vt(1);
             result[3] = 0.0f;
             applyFmacDestAcc(result, dest);
             return;
diff --git a/ps2xTest/src/ps2_vu1_tests.cpp b/ps2xTest/src/ps2_vu1_tests.cpp
index 81d72eefb..d85fc25c9 100644
--- a/ps2xTest/src/ps2_vu1_tests.cpp
+++ b/ps2xTest/src/ps2_vu1_tests.cpp
@@ -1688,6 +1688,42 @@ void register_ps2_vu1_tests()
                      "underflow should flush to signed zero before writeback");
         });
 
+        tc.Run("FMAC normal results and finite overflow keep distinct flags", [](TestCase &t)
+        {
+            Vu1Fixture fx;
+            t.IsTrue(fx.initialize(), "VU1 fixture should initialize");
+            struct Case { uint8_t op; float left, right, result; uint32_t flags; };
+            const float maximum = std::numeric_limits<float>::max();
+            const float minimum = std::numeric_limits<float>::min();
+            const Case cases[] = {
+                {0x28u, 1.25f, 2.5f, 3.75f, 0u},
+                {0x2cu, 1.25f, 2.5f, -1.25f, 2u},
+                {0x2au, -1.25f, 2.5f, -3.125f, 2u},
+                {0x2au, minimum, 1.0f, minimum, 0u},
+                {0x2au, maximum, 1.0f, maximum, 0u},
+                {0x28u, maximum, maximum, maximum, 8u},
+                {0x2cu, -maximum, maximum, -maximum, 10u},
+                {0x2au, -minimum, 0.5f, -0.0f, 7u},
+            };
+            for (const auto &entry : cases)
+            {
+                writeVuInstructionPair(fx.code, 0u, 0u,
+                                       makeVuUpper(entry.op, 0x8u, 2u, 1u, 3u));
+                VU1Interpreter vu1;
+                vu1.state().vf[1][0] = entry.left;
+                vu1.state().vf[2][0] = entry.right;
+                vu1.execute(fx.code, PS2_VU1_CODE_SIZE,
+                            fx.data, PS2_VU1_DATA_SIZE, fx.gs, &fx.mem,
+                            0u, 0u, 0u, 5u);
+                t.Equals(vu1.state().vf[3][0], entry.result,
+                         "arithmetic must retain toward-zero saturation and signed underflow");
+                t.Equals(std::signbit(vu1.state().vf[3][0]), std::signbit(entry.result),
+                         "the sign of an underflowed result must survive");
+                t.Equals(vu1.state().status, entry.flags | (entry.flags << 6u),
+                         "normal finite values and overflow saturated to finite values differ");
+            }
+        });
+
         tc.Run("FMAC product contributes Z/S/U/O sticky flags", [](TestCase &t)
         {
             Vu1Fixture fx;

From 81d327bcdc1824c4983ae6670a942e25eb6c168c Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 00:50:50 +0200
Subject: [PATCH 39/68] Compile local VU blocks with cycle-correct interpreter
 fallback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Generate exact-word native specializations from user-owned microcode or execution profiles. Preserve cycle budgets, code invalidation, branch delays, floating-point flags and timed PATH1 reads; keep the interpreter selectable for differential checks.

Use cycle buckets for fixed-latency writes and eliminate redundant one-cycle retirement work. The 46 VU tests and 12 local replays pass, including 36,954 resumed boundaries and code changes during GIF callbacks. Heavy captured programs take roughly 40–47% less time than the saved handoff interpreter. Live field performance remains below playable speed.
---
 ps2xRuntime/CMakeLists.txt               |  22 +
 ps2xRuntime/include/runtime/ps2_vu1.h    |  30 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp  | 639 +++++++++++++++--------
 ps2xRuntime/src/lib/vu/ps2_vu1_detail.h  |  40 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp |   5 +
 ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp |   5 +
 ps2xTest/src/ps2_vu1_tests.cpp           | 132 +++++
 tools/compile_vu_blocks.py               |  51 ++
 8 files changed, 679 insertions(+), 245 deletions(-)
 create mode 100644 tools/compile_vu_blocks.py

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index 2fbef83d6..a900daf2a 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -402,6 +402,28 @@ set_source_files_properties(
     src/lib/vu/ps2_vu1_lower.cpp
     PROPERTIES UNITY_GROUP vu1)
 
+set(PS2X_VU_AOT_IMAGES "" CACHE STRING "Local VU code images or block profiles to compile; never distributed")
+option(PS2X_VU_AOT_DEBUG_INFO "Include expanded VU AOT debug scopes (slow to compile)" OFF)
+if(PS2X_VU_AOT_IMAGES)
+    find_package(Python3 COMPONENTS Interpreter REQUIRED)
+    set(PS2X_VU_AOT_INCLUDE "${CMAKE_CURRENT_BINARY_DIR}/generated/vu_aot_blocks.inc")
+    add_custom_command(
+        OUTPUT "${PS2X_VU_AOT_INCLUDE}"
+        COMMAND "${Python3_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_blocks.py"
+                --output "${PS2X_VU_AOT_INCLUDE}" ${PS2X_VU_AOT_IMAGES}
+        DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_blocks.py" ${PS2X_VU_AOT_IMAGES}
+        VERBATIM)
+    add_custom_target(ps2_vu_aot DEPENDS "${PS2X_VU_AOT_INCLUDE}")
+    add_dependencies(ps2_runtime ps2_vu_aot)
+    target_compile_definitions(ps2_runtime PRIVATE PS2X_VU_AOT_INCLUDE="${PS2X_VU_AOT_INCLUDE}")
+    # Thousands of specialized inline scopes otherwise dominate compile time.
+    if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU" AND NOT PS2X_VU_AOT_DEBUG_INFO)
+        set_source_files_properties(
+            "${CMAKE_CURRENT_BINARY_DIR}/CMakeFiles/ps2_runtime.dir/Unity/unity_vu1_cxx.cxx"
+            PROPERTIES COMPILE_OPTIONS "-g0")
+    endif()
+endif()
+
 if(PS2X_ENABLE_RUNTIME_LOGS)
     target_compile_definitions(ps2_runtime PUBLIC
         PS2_RUNTIME_LOGS=1
diff --git a/ps2xRuntime/include/runtime/ps2_vu1.h b/ps2xRuntime/include/runtime/ps2_vu1.h
index 414958d5e..a7c089cd2 100644
--- a/ps2xRuntime/include/runtime/ps2_vu1.h
+++ b/ps2xRuntime/include/runtime/ps2_vu1.h
@@ -62,6 +62,10 @@ class VU1Interpreter
     VU1State &state() { return m_state; }
     const VU1State &state() const { return m_state; }
 
+    void setCompiledExecutionEnabled(bool enabled) { m_useCompiledExecution = enabled; }
+    uint64_t compiledPairsExecuted() const { return m_compiledPairsExecuted; }
+    uint64_t interpretedPairsExecuted() const { return m_interpretedPairsExecuted; }
+
 private:
     enum Pipeline : uint8_t
     {
@@ -200,6 +204,12 @@ class VU1Interpreter
     static constexpr uint32_t kMaxPendingAccWrites = 8u;
     static constexpr uint32_t kMaxDecodedPairs = 0x4000u / 8u;
 
+    using CompiledBlock = bool (*)(VU1Interpreter &, uint64_t);
+    std::array<CompiledBlock, kMaxDecodedPairs> m_compiledCodeCache{};
+    bool m_useCompiledExecution = true;
+    uint64_t m_compiledPairsExecuted = 0;
+    uint64_t m_interpretedPairsExecuted = 0;
+
     Unit m_unit;
     VU1State m_state;
     std::array<DecodedInstructionPair, kMaxDecodedPairs> m_decodedCodeCache{};
@@ -249,17 +259,25 @@ class VU1Interpreter
              uint8_t *vuData, uint32_t dataSize,
              GS &gs, PS2Memory *memory, uint32_t maxCycles);
 
-    InstructionUsage decodeUpperUsage(uint32_t upper) const;
-    InstructionUsage decodeLowerUsage(uint32_t lower) const;
-    static void addVfRead(InstructionUsage &usage, uint8_t reg, uint8_t lanes);
-    static void addVfWrite(InstructionUsage &usage, uint8_t reg, uint8_t lanes);
-    static uint8_t vfReadLanes(const InstructionUsage &usage, uint8_t reg);
+    static constexpr InstructionUsage decodeUpperUsage(uint32_t upper);
+    static constexpr InstructionUsage decodeLowerUsage(uint32_t lower, Unit unit);
+    static constexpr void addVfRead(InstructionUsage &usage, uint8_t reg, uint8_t lanes);
+    static constexpr void addVfWrite(InstructionUsage &usage, uint8_t reg, uint8_t lanes);
+    static constexpr uint8_t vfReadLanes(const InstructionUsage &usage, uint8_t reg);
+    static constexpr DecodedInstructionPair decodeInstructionWords(uint32_t lower, uint32_t upper, Unit unit);
     DecodedInstructionPair decodeInstructionPair(const uint8_t *vuCode, uint32_t pc) const;
     DecodedInstructionPair getDecodedInstructionPairForPc(const uint8_t *vuCode, uint32_t codeSize, PS2Memory *memory, uint32_t pc);
     void rebuildDecodedCodeCache(const uint8_t *vuCode, uint32_t codeSize, const PS2Memory *memory, uint64_t generation);
+    static CompiledBlock findCompiledBlock(const uint8_t *code, uint32_t size, Unit unit);
+    template <Unit unit, uint64_t... words>
+    static bool runCompiledBlock(VU1Interpreter &vu, uint64_t budgetEnd);
+    template <bool compiled>
+    bool runDecodedPair(const DecodedInstructionPair &decoded, uint64_t budgetEnd, uint32_t codeSize);
 
     void execUpper(uint32_t instr);
     void execLower(uint32_t instr, uint8_t *vuData, uint32_t dataSize, GS &gs, PS2Memory *memory, uint32_t upperInstr);
+    void execUpperInline(uint32_t instr);
+    void execLowerInline(uint32_t instr, uint8_t *vuData, uint32_t dataSize, GS &gs, PS2Memory *memory, uint32_t upperInstr);
 
     void applyDest(float *dst, const float *result, uint8_t dest);
     void applyDestAcc(const float *result, uint8_t dest);
@@ -289,7 +307,9 @@ class VU1Interpreter
     void progressXgkick();
     void finishXgkick();
     uint64_t calculatePairReadyCycle(const DecodedInstructionPair &decoded) const;
+    uint64_t calculatePairReadyCycleInline(const DecodedInstructionPair &decoded) const;
     void markPairWrites(const DecodedInstructionPair &decoded);
+    void markPairWritesInline(const DecodedInstructionPair &decoded);
     bool pipelinesPending() const;
 
     float normalizeOperand(float value) const;
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
index 271cf9051..f6f66a9c3 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
@@ -12,11 +12,35 @@
 #include <cstdlib>
 #include <cstring>
 #include <filesystem>
+#include <fstream>
 #include <limits>
+#include <mutex>
+#include <set>
 #include <ps2_log.h>
 
 namespace
 {
+    void recordUncompiledBlock(const char *path, unsigned unit, const uint8_t *code)
+    {
+        static std::mutex mutex;
+        const std::lock_guard lock(mutex);
+        static std::ofstream output(path);
+        static std::set<std::pair<unsigned, std::array<uint64_t, 4>>> recorded;
+        if (!output)
+            return;
+        if (recorded.empty())
+            output << "VU-BLOCKS 1\n";
+        std::array<uint64_t, 4> words;
+        std::memcpy(words.data(), code, sizeof(words));
+        if (!recorded.emplace(unit, words).second)
+            return;
+        output << std::dec << unit;
+        for (const auto word : words)
+            output << ' ' << std::hex << word;
+        output << '\n';
+        output.flush();
+    }
+
     constexpr uint8_t laneForComponent(uint32_t component)
     {
         return static_cast<uint8_t>(1u << (3u - component));
@@ -33,9 +57,29 @@ namespace
         active |= 1u << index;
         return &entries[index];
     }
+
+    template <size_t Size>
+    uint32_t pipelineCycleMask(uint64_t cycle)
+    {
+        static_assert(Size >= 8u && (Size & (Size - 1u)) == 0u);
+        return 3u << (2u * (cycle & (Size / 2u - 1u)));
+    }
+
+    template <typename Entry, size_t Size>
+    Entry *allocateScheduledEntry(std::array<Entry, Size> &entries,
+                                  uint32_t &active, uint64_t readyCycle)
+    {
+        // A pair issues at most two writes for any of these result cycles.
+        const uint32_t available = ~active & pipelineCycleMask<Size>(readyCycle);
+        if (available == 0u)
+            return nullptr;
+        const unsigned index = std::countr_zero(available);
+        active |= 1u << index;
+        return &entries[index];
+    }
 }
 
-void VU1Interpreter::addVfRead(InstructionUsage &usage, uint8_t reg, uint8_t lanes)
+constexpr void VU1Interpreter::addVfRead(InstructionUsage &usage, uint8_t reg, uint8_t lanes)
 {
     if (lanes == 0u)
         return;
@@ -51,7 +95,7 @@ void VU1Interpreter::addVfRead(InstructionUsage &usage, uint8_t reg, uint8_t lan
         usage.vfRead[usage.vfReadCount++] = {reg, lanes};
 }
 
-void VU1Interpreter::addVfWrite(InstructionUsage &usage, uint8_t reg, uint8_t lanes)
+constexpr void VU1Interpreter::addVfWrite(InstructionUsage &usage, uint8_t reg, uint8_t lanes)
 {
     if (reg == 0u || lanes == 0u)
         return;
@@ -61,7 +105,7 @@ void VU1Interpreter::addVfWrite(InstructionUsage &usage, uint8_t reg, uint8_t la
         usage.vfWrite.lanes |= lanes;
 }
 
-uint8_t VU1Interpreter::vfReadLanes(const InstructionUsage &usage, uint8_t reg)
+constexpr uint8_t VU1Interpreter::vfReadLanes(const InstructionUsage &usage, uint8_t reg)
 {
     for (uint32_t index = 0; index < usage.vfReadCount; ++index)
     {
@@ -74,6 +118,8 @@ uint8_t VU1Interpreter::vfReadLanes(const InstructionUsage &usage, uint8_t reg)
 VU1Interpreter::VU1Interpreter(Unit unit)
     : m_unit(unit)
 {
+    const char *execution = std::getenv("PS2_VU_EXECUTION");
+    m_useCompiledExecution = execution == nullptr || std::strcmp(execution, "interpreter") != 0;
     reset();
 }
 
@@ -191,7 +237,7 @@ void VU1Interpreter::recordViWriteForBranch(uint8_t reg, int32_t oldValue)
     m_viBranchBackupValid = true;
 }
 
-void VU1Interpreter::applyDest(float *dst, const float *result, uint8_t dest)
+PS2_VU_FORCE_INLINE void VU1Interpreter::applyDest(float *dst, const float *result, uint8_t dest)
 {
     if (dest & 0x8u)
         dst[0] = result[0];
@@ -203,12 +249,12 @@ void VU1Interpreter::applyDest(float *dst, const float *result, uint8_t dest)
         dst[3] = result[3];
 }
 
-void VU1Interpreter::applyDestAcc(const float *result, uint8_t dest)
+PS2_VU_FORCE_INLINE void VU1Interpreter::applyDestAcc(const float *result, uint8_t dest)
 {
     applyDest(m_state.acc, result, dest);
 }
 
-void VU1Interpreter::normalizeFmacResult(float *result, uint8_t dest,
+PS2_VU_FORCE_INLINE void VU1Interpreter::normalizeFmacResult(float *result, uint8_t dest,
                                          uint8_t laneFlags[4])
 {
     const uint32_t upper = m_currentUpperInstruction;
@@ -247,7 +293,7 @@ void VU1Interpreter::normalizeFmacResult(float *result, uint8_t dest,
     }
 }
 
-bool VU1Interpreter::calculateFmacExactResult(uint32_t component,
+PS2_VU_FORCE_INLINE bool VU1Interpreter::calculateFmacExactResult(uint32_t component,
                                                long double &result) const
 {
     const uint32_t upper = m_currentUpperInstruction;
@@ -430,7 +476,7 @@ bool VU1Interpreter::calculateFmacExactResult(uint32_t component,
     return true;
 }
 
-uint8_t VU1Interpreter::normalizeFmacExactResult(float &value,
+PS2_VU_FORCE_INLINE uint8_t VU1Interpreter::normalizeFmacExactResult(float &value,
                                                   long double exactResult) const
 {
     const bool negative = std::signbit(exactResult);
@@ -460,7 +506,7 @@ uint8_t VU1Interpreter::normalizeFmacExactResult(float &value,
     return flags;
 }
 
-uint32_t VU1Interpreter::calculateFmacProductSticky(uint8_t dest) const
+PS2_VU_FORCE_INLINE uint32_t VU1Interpreter::calculateFmacProductSticky(uint8_t dest) const
 {
     uint32_t extraSticky = 0u;
     const uint32_t upper = m_currentUpperInstruction;
@@ -509,6 +555,14 @@ uint32_t VU1Interpreter::calculateFmacProductSticky(uint8_t dest) const
         }
 
         float product = left * right;
+        uint32_t productBits;
+        std::memcpy(&productBits, &product, sizeof(productBits));
+        const uint32_t magnitude = productBits & 0x7fffffffu;
+        if (magnitude >= 0x00800000u && magnitude < 0x7f7fffffu)
+        {
+            extraSticky |= (productBits >> 30u) & 2u;
+            continue;
+        }
         const long double exactProduct = static_cast<long double>(left) * static_cast<long double>(right);
         const uint8_t productFlags = normalizeFmacExactResult(product, exactProduct);
         // Product-sum instructions report Z/S/U/O from the add/subtract result
@@ -519,7 +573,7 @@ uint32_t VU1Interpreter::calculateFmacProductSticky(uint8_t dest) const
     return extraSticky;
 }
 
-void VU1Interpreter::updateFmacFlags(const uint8_t laneFlags[4], uint8_t dest,
+PS2_VU_FORCE_INLINE void VU1Interpreter::updateFmacFlags(const uint8_t laneFlags[4], uint8_t dest,
                                      uint32_t extraSticky)
 {
     if (dest == 0u)
@@ -545,7 +599,7 @@ void VU1Interpreter::updateFmacFlags(const uint8_t laneFlags[4], uint8_t dest,
         status |= flags;
     }
 
-    FlagPipelineEntry *entry = allocatePipelineEntry(m_flagPipeline, m_activeFlags);
+    FlagPipelineEntry *entry = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency);
     if (!entry)
     {
         reportReservedInstruction(true, 0xFFFFFFFFu);
@@ -563,7 +617,7 @@ void VU1Interpreter::updateFmacFlags(const uint8_t laneFlags[4], uint8_t dest,
     entry->writesStatus = true;
 }
 
-void VU1Interpreter::applyFmacDest(float *dst, float *result, uint8_t dest)
+PS2_VU_FORCE_INLINE void VU1Interpreter::applyFmacDest(float *dst, float *result, uint8_t dest)
 {
     uint8_t laneFlags[4]{};
     normalizeFmacResult(result, dest, laneFlags);
@@ -571,7 +625,7 @@ void VU1Interpreter::applyFmacDest(float *dst, float *result, uint8_t dest)
     applyDest(dst, result, dest);
 }
 
-void VU1Interpreter::applyFmacDestAcc(float *result, uint8_t dest)
+PS2_VU_FORCE_INLINE void VU1Interpreter::applyFmacDestAcc(float *result, uint8_t dest)
 {
     uint8_t laneFlags[4]{};
     normalizeFmacResult(result, dest, laneFlags);
@@ -588,7 +642,7 @@ void VU1Interpreter::queueFsset(uint16_t immediate)
             entry.writesStatus = false;
     }
 
-    if (auto *slot = allocatePipelineEntry(m_flagPipeline, m_activeFlags))
+    if (auto *slot = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency))
     {
         auto &entry = *slot;
         entry = {};
@@ -605,7 +659,7 @@ void VU1Interpreter::queueFsset(uint16_t immediate)
 void VU1Interpreter::queueClip(uint32_t clip)
 {
     m_workingClip = ((m_workingClip << 6) | (clip & 0x3Fu)) & 0xFFFFFFu;
-    if (auto *slot = allocatePipelineEntry(m_flagPipeline, m_activeFlags))
+    if (auto *slot = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency))
     {
         auto &entry = *slot;
         entry = {};
@@ -628,7 +682,7 @@ void VU1Interpreter::queueFcset(uint32_t clip)
         if (entry.issueCycle == m_cycle)
             entry.writesClip = false;
     }
-    if (auto *slot = allocatePipelineEntry(m_flagPipeline, m_activeFlags))
+    if (auto *slot = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency))
     {
         auto &entry = *slot;
         entry = {};
@@ -671,27 +725,24 @@ void VU1Interpreter::queueP(float value, uint32_t latency)
     reportReservedInstruction(false, 0xFFFFFFF9u);
 }
 
-void VU1Interpreter::queueStore(uint32_t address, const uint32_t words[4], uint8_t laneMask)
+PS2_VU_FORCE_INLINE void VU1Interpreter::queueStore(uint32_t address, const uint32_t words[4], uint8_t laneMask)
 {
-    if (auto *slot = allocatePipelineEntry(m_storePipeline, m_activeStores))
-    {
-        auto &store = *slot;
-        store.valid = true;
-        store.readyCycle = m_cycle + 1u;
-        store.address = address;
-        store.laneMask = laneMask;
-        std::copy(words, words + 4, store.words.begin());
+    // Every pair advances one cycle before returning or progressing PATH1.
+    // No observer runs between a store and that mandatory one-cycle retirement.
+    if (!m_activeVuData || address + 16ull > m_activeVuDataSize)
         return;
-    }
-    reportReservedInstruction(false, 0xFFFFFFFCu);
+    for (uint32_t component = 0; component < 4u; ++component)
+        if ((laneMask & laneForComponent(component)) != 0u)
+            std::memcpy(m_activeVuData + address + component * 4u,
+                        words + component, sizeof(uint32_t));
 }
 
-void VU1Interpreter::queueVfWrite(uint8_t reg, uint8_t laneMask,
+PS2_VU_FORCE_INLINE void VU1Interpreter::queueVfWrite(uint8_t reg, uint8_t laneMask,
                                   const float value[4], uint32_t latency)
 {
     if (reg == 0u || laneMask == 0u)
         return;
-    if (auto *slot = allocatePipelineEntry(m_vfWritePipeline, m_activeVfWrites))
+    if (auto *slot = allocateScheduledEntry(m_vfWritePipeline, m_activeVfWrites, m_cycle + latency))
     {
         auto &write = *slot;
         write = {};
@@ -711,11 +762,11 @@ void VU1Interpreter::queueVfWrite(uint8_t reg, uint8_t laneMask,
     reportReservedInstruction(false, 0xFFFFFFF7u);
 }
 
-void VU1Interpreter::queueViWrite(uint8_t reg, int32_t value, uint32_t latency)
+PS2_VU_FORCE_INLINE void VU1Interpreter::queueViWrite(uint8_t reg, int32_t value, uint32_t latency)
 {
     if (reg == 0u)
         return;
-    if (auto *slot = allocatePipelineEntry(m_viWritePipeline, m_activeViWrites))
+    if (auto *slot = allocateScheduledEntry(m_viWritePipeline, m_activeViWrites, m_cycle + latency))
     {
         auto &write = *slot;
         write = {};
@@ -730,7 +781,7 @@ void VU1Interpreter::queueViWrite(uint8_t reg, int32_t value, uint32_t latency)
     reportReservedInstruction(false, 0xFFFFFFF6u);
 }
 
-void VU1Interpreter::queueAccWrite(uint8_t laneMask, const float value[4], uint32_t latency)
+PS2_VU_FORCE_INLINE void VU1Interpreter::queueAccWrite(uint8_t laneMask, const float value[4], uint32_t latency)
 {
     if (laneMask == 0u)
         return;
@@ -755,8 +806,9 @@ void VU1Interpreter::queueAccWrite(uint8_t laneMask, const float value[4], uint3
 
 void VU1Interpreter::commitReadyPipelines()
 {
-    // Ascending slot order matches the original array walk for simultaneous commits.
-    for (uint32_t active = m_activeFlags; active != 0u; active &= active - 1u)
+    // The two slots in each bucket preserve issue order for simultaneous flags.
+    for (uint32_t active = m_activeFlags & pipelineCycleMask<kMaxFlagEntries>(m_cycle);
+         active != 0u; active &= active - 1u)
     {
         const unsigned index = std::countr_zero(active);
         auto &entry = m_flagPipeline[index];
@@ -776,7 +828,6 @@ void VU1Interpreter::commitReadyPipelines()
         }
         if (entry.writesClip)
             m_state.clip = entry.clip;
-        entry = {};
         m_activeFlags &= ~(1u << index);
     }
 
@@ -814,11 +865,11 @@ void VU1Interpreter::commitReadyPipelines()
             }
             std::memcpy(m_activeVuData + store.address, oldWords, sizeof(oldWords));
         }
-        store = {};
         m_activeStores &= ~(1u << index);
     }
 
-    for (uint32_t active = m_activeVfWrites; active != 0u; active &= active - 1u)
+    for (uint32_t active = m_activeVfWrites & pipelineCycleMask<kMaxPendingVfWrites>(m_cycle);
+         active != 0u; active &= active - 1u)
     {
         const unsigned index = std::countr_zero(active);
         auto &write = m_vfWritePipeline[index];
@@ -832,11 +883,11 @@ void VU1Interpreter::commitReadyPipelines()
                 m_state.vf[write.reg][component] = write.value[component];
             }
         }
-        write = {};
         m_activeVfWrites &= ~(1u << index);
     }
 
-    for (uint32_t active = m_activeViWrites; active != 0u; active &= active - 1u)
+    for (uint32_t active = m_activeViWrites & pipelineCycleMask<kMaxPendingViWrites>(m_cycle);
+         active != 0u; active &= active - 1u)
     {
         const unsigned index = std::countr_zero(active);
         auto &write = m_viWritePipeline[index];
@@ -844,7 +895,6 @@ void VU1Interpreter::commitReadyPipelines()
             continue;
         if (m_viLatestWrite[write.reg] == write.sequence)
             m_state.vi[write.reg] = static_cast<int16_t>(write.value);
-        write = {};
         m_activeViWrites &= ~(1u << index);
     }
 
@@ -862,7 +912,6 @@ void VU1Interpreter::commitReadyPipelines()
                 m_state.acc[component] = write.value[component];
             }
         }
-        write = {};
         m_activeAccWrites &= ~(1u << index);
     }
 }
@@ -884,11 +933,12 @@ void VU1Interpreter::progressXgkick()
         }
 
         const uint32_t qwordOffset = m_xgkick.copiedBytes;
-        for (uint32_t i = 0; i < 16u; ++i)
-        {
-            const uint32_t source = (m_xgkick.sourceAddress + m_xgkick.copiedBytes + i) % m_activeVuDataSize;
-            m_xgkick.packet[m_xgkick.copiedBytes + i] = m_activeVuData[source];
-        }
+        const uint32_t source = (m_xgkick.sourceAddress + qwordOffset) % m_activeVuDataSize;
+        const uint32_t firstBytes = std::min(16u, m_activeVuDataSize - source);
+        std::memcpy(m_xgkick.packet.data() + qwordOffset, m_activeVuData + source, firstBytes);
+        if (firstBytes < 16u)
+            std::memcpy(m_xgkick.packet.data() + qwordOffset + firstBytes,
+                        m_activeVuData, 16u - firstBytes);
         m_xgkick.copiedBytes += 16u;
 
         if (m_xgkick.currentTagEnd == 0u)
@@ -971,14 +1021,15 @@ void VU1Interpreter::startXgkick(uint32_t qwordAddress)
     m_xgkick.issueCycle = m_cycle;
 }
 
-void VU1Interpreter::advanceOneCycle()
+PS2_VU_FORCE_INLINE void VU1Interpreter::advanceOneCycle()
 {
     ++m_cycle;
     m_state.cycles = m_cycle;
     // LSU commits become visible at the cycle boundary before PATH1 consumes
     // its next qword from VU memory.
     commitReadyPipelines();
-    progressXgkick();
+    if (m_xgkick.active)
+        progressXgkick();
 }
 
 void VU1Interpreter::advanceTo(uint64_t targetCycle)
@@ -1004,6 +1055,11 @@ void VU1Interpreter::flushPipelines()
 }
 
 uint64_t VU1Interpreter::calculatePairReadyCycle(const DecodedInstructionPair &decoded) const
+{
+    return calculatePairReadyCycleInline(decoded);
+}
+
+PS2_VU_FORCE_INLINE uint64_t VU1Interpreter::calculatePairReadyCycleInline(const DecodedInstructionPair &decoded) const
 {
     uint64_t ready = m_cycle;
     const InstructionUsage *usages[2] = {
@@ -1052,6 +1108,11 @@ uint64_t VU1Interpreter::calculatePairReadyCycle(const DecodedInstructionPair &d
 }
 
 void VU1Interpreter::markPairWrites(const DecodedInstructionPair &decoded)
+{
+    markPairWritesInline(decoded);
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::markPairWritesInline(const DecodedInstructionPair &decoded)
 {
     const VfAccess lowerWrite = decoded.lowerUsage.vfWrite;
     if (lowerWrite.reg != 0u &&
@@ -1092,7 +1153,7 @@ void VU1Interpreter::markPairWrites(const DecodedInstructionPair &decoded)
     }
 }
 
-VU1Interpreter::InstructionUsage VU1Interpreter::decodeUpperUsage(uint32_t upper) const
+constexpr VU1Interpreter::InstructionUsage VU1Interpreter::decodeUpperUsage(uint32_t upper)
 {
     InstructionUsage usage;
     usage.pipeline = PipelineFmac;
@@ -1173,7 +1234,7 @@ VU1Interpreter::InstructionUsage VU1Interpreter::decodeUpperUsage(uint32_t upper
     return usage;
 }
 
-VU1Interpreter::InstructionUsage VU1Interpreter::decodeLowerUsage(uint32_t lower) const
+constexpr VU1Interpreter::InstructionUsage VU1Interpreter::decodeLowerUsage(uint32_t lower, Unit unit)
 {
     InstructionUsage usage;
     if (lower == 0u || lower == 0x8000033Cu)
@@ -1421,7 +1482,7 @@ VU1Interpreter::InstructionUsage VU1Interpreter::decodeLowerUsage(uint32_t lower
         addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
         break;
     case 0x64:
-        if (m_unit == Unit::VU0)
+        if (unit == Unit::VU0)
         {
             usage.reserved = true;
             break;
@@ -1437,7 +1498,7 @@ VU1Interpreter::InstructionUsage VU1Interpreter::decodeLowerUsage(uint32_t lower
         writeVi(viT);
         break;
     case 0x6C:
-        if (m_unit == Unit::VU0)
+        if (unit == Unit::VU0)
         {
             usage.reserved = true;
             break;
@@ -1459,7 +1520,7 @@ VU1Interpreter::InstructionUsage VU1Interpreter::decodeLowerUsage(uint32_t lower
     case 0x7A:
     case 0x7C:
     case 0x7D:
-        if (m_unit == Unit::VU0)
+        if (unit == Unit::VU0)
         {
             usage.reserved = true;
             break;
@@ -1509,7 +1570,7 @@ VU1Interpreter::InstructionUsage VU1Interpreter::decodeLowerUsage(uint32_t lower
             addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
         break;
     case 0x7B:
-        if (m_unit == Unit::VU0)
+        if (unit == Unit::VU0)
         {
             usage.reserved = true;
             break;
@@ -1524,11 +1585,12 @@ VU1Interpreter::InstructionUsage VU1Interpreter::decodeLowerUsage(uint32_t lower
     return usage;
 }
 
-VU1Interpreter::DecodedInstructionPair VU1Interpreter::decodeInstructionPair(const uint8_t *vuCode, uint32_t pc) const
+constexpr VU1Interpreter::DecodedInstructionPair VU1Interpreter::decodeInstructionWords(
+    uint32_t lower, uint32_t upper, Unit unit)
 {
     DecodedInstructionPair decoded;
-    std::memcpy(&decoded.lower, vuCode + pc, sizeof(decoded.lower));
-    std::memcpy(&decoded.upper, vuCode + pc + sizeof(decoded.lower), sizeof(decoded.upper));
+    decoded.lower = lower;
+    decoded.upper = upper;
     decoded.iBit = (decoded.upper & 0x80000000u) != 0u;
     decoded.eBit = (decoded.upper & 0x40000000u) != 0u;
     decoded.mBit = (decoded.upper & 0x20000000u) != 0u;
@@ -1536,7 +1598,7 @@ VU1Interpreter::DecodedInstructionPair VU1Interpreter::decodeInstructionPair(con
     decoded.tBit = (decoded.upper & 0x08000000u) != 0u;
     decoded.upperUsage = decodeUpperUsage(decoded.upper);
     if (!decoded.iBit)
-        decoded.lowerUsage = decodeLowerUsage(decoded.lower);
+        decoded.lowerUsage = decodeLowerUsage(decoded.lower, unit);
 
     const uint8_t upperWriteReg = decoded.upperUsage.vfWrite.reg;
     if (upperWriteReg != 0u && (vfReadLanes(decoded.lowerUsage, upperWriteReg) != 0u || decoded.lowerUsage.vfWrite.reg == upperWriteReg))
@@ -1548,12 +1610,23 @@ VU1Interpreter::DecodedInstructionPair VU1Interpreter::decodeInstructionPair(con
     return decoded;
 }
 
+VU1Interpreter::DecodedInstructionPair VU1Interpreter::decodeInstructionPair(const uint8_t *vuCode, uint32_t pc) const
+{
+    uint32_t lower, upper;
+    std::memcpy(&lower, vuCode + pc, sizeof(lower));
+    std::memcpy(&upper, vuCode + pc + sizeof(lower), sizeof(upper));
+    return decodeInstructionWords(lower, upper, m_unit);
+}
+
 void VU1Interpreter::rebuildDecodedCodeCache(const uint8_t *vuCode, uint32_t codeSize,
                                              const PS2Memory *memory, uint64_t generation)
 {
     const uint32_t pairCount = std::min<uint32_t>(codeSize / 8u, kMaxDecodedPairs);
     for (uint32_t i = 0; i < pairCount; ++i)
+    {
         m_decodedCodeCache[i] = decodeInstructionPair(vuCode, i * 8u);
+        m_compiledCodeCache[i] = findCompiledBlock(vuCode + i * 8u, codeSize - i * 8u, m_unit);
+    }
 
     m_cachedVuCode = vuCode;
     m_cachedMemory = memory;
@@ -1637,10 +1710,276 @@ void VU1Interpreter::resume(uint8_t *vuCode, uint32_t codeSize,
     run(vuCode, codeSize, vuData, dataSize, gs, memory, maxCycles);
 }
 
+template <bool compiled>
+PS2_VU_FORCE_INLINE bool VU1Interpreter::runDecodedPair(const DecodedInstructionPair &decoded, uint64_t budgetEnd, uint32_t codeSize)
+{
+    bool programEnded = false;
+    if (decoded.upperUsage.reserved || decoded.lowerUsage.reserved)
+    {
+        reportReservedInstruction(decoded.upperUsage.reserved, decoded.upperUsage.reserved ? decoded.upper : decoded.lower);
+        return false;
+    }
+
+    const auto readiness = [&]() PS2_VU_INLINE_LAMBDA {
+        if constexpr (compiled) return calculatePairReadyCycleInline(decoded);
+        else return calculatePairReadyCycle(decoded);
+    };
+    const auto upper = [&]() PS2_VU_INLINE_LAMBDA {
+        if constexpr (compiled) execUpperInline(decoded.upper);
+        else execUpper(decoded.upper);
+    };
+    const auto lower = [&]() PS2_VU_INLINE_LAMBDA {
+        if constexpr (compiled)
+            execLowerInline(decoded.lower, m_activeVuData, m_activeVuDataSize, *m_activeGs, m_activeMemory, decoded.upper);
+        else
+            execLower(decoded.lower, m_activeVuData, m_activeVuDataSize, *m_activeGs, m_activeMemory, decoded.upper);
+    };
+    uint64_t readyCycle = readiness();
+    while (readyCycle > m_cycle)
+    {
+        if (readyCycle >= budgetEnd)
+        {
+            advanceTo(budgetEnd);
+            break;
+        }
+        advanceTo(readyCycle);
+        readyCycle = readiness();
+    }
+    if (m_cycle >= budgetEnd)
+        return false;
+
+    if constexpr (compiled) ++m_compiledPairsExecuted;
+    else ++m_interpretedPairsExecuted;
+
+    const uint32_t viWrites = decoded.lowerUsage.viWrite & 0xFFFEu;
+    const uint8_t writtenVi = viWrites != 0u ? static_cast<uint8_t>(std::countr_zero(viWrites)) : 0u;
+    const int32_t oldVi = writtenVi != 0u ? m_state.vi[writtenVi] : 0;
+
+    const VfAccess upperWrite = decoded.upperUsage.vfWrite;
+    const VfAccess lowerWrite = decoded.lowerUsage.vfWrite;
+    const bool hasUpperWrite = upperWrite.reg != 0u;
+    const bool hasLowerWrite = lowerWrite.reg != 0u && decoded.suppressedLowerVf != lowerWrite.reg;
+    const bool hasDistinctLowerWrite = hasLowerWrite && (!hasUpperWrite || lowerWrite.reg != upperWrite.reg);
+    float oldUpperVf[4]{};
+    float newUpperVf[4]{};
+    float oldLowerVf[4]{};
+    float newLowerVf[4]{};
+    float oldAcc[4]{};
+    float newAcc[4]{};
+    if (hasUpperWrite)
+        std::memcpy(oldUpperVf, m_state.vf[upperWrite.reg], sizeof(oldUpperVf));
+    if (hasDistinctLowerWrite)
+        std::memcpy(oldLowerVf, m_state.vf[lowerWrite.reg], sizeof(oldLowerVf));
+    if (!compiled && decoded.upperUsage.accWrite != 0u)
+        std::memcpy(oldAcc, m_state.acc, sizeof(oldAcc));
+
+    if (decoded.iBit)
+    {
+        upper();
+        float immediate = 0.0f;
+        std::memcpy(&immediate, &decoded.lower, sizeof(immediate));
+        m_state.i = normalizeOperand(immediate);
+    }
+    else if (decoded.upperVfShadowReg != 0u)
+    {
+        float oldVf[4]{};
+        float upperVf[4]{};
+        std::memcpy(oldVf,
+                    m_state.vf[decoded.upperVfShadowReg],
+                    sizeof(oldVf));
+        upper();
+        std::memcpy(upperVf,
+                    m_state.vf[decoded.upperVfShadowReg],
+                    sizeof(upperVf));
+        std::memcpy(m_state.vf[decoded.upperVfShadowReg],
+                    oldVf,
+                    sizeof(oldVf));
+        lower();
+        std::memcpy(m_state.vf[decoded.upperVfShadowReg],
+                    upperVf,
+                    sizeof(upperVf));
+    }
+    else
+    {
+        upper();
+        lower();
+    }
+
+    m_viBranchBackupValid = false;
+
+    if (hasUpperWrite)
+    {
+        std::memcpy(newUpperVf, m_state.vf[upperWrite.reg], sizeof(newUpperVf));
+        std::memcpy(m_state.vf[upperWrite.reg], oldUpperVf, sizeof(oldUpperVf));
+        const uint32_t latency =
+            decoded.upperUsage.vfLatency != 0u
+                ? decoded.upperUsage.vfLatency
+                : decoded.upperUsage.latency;
+        queueVfWrite(upperWrite.reg, upperWrite.lanes, newUpperVf, latency);
+    }
+    if (hasDistinctLowerWrite)
+    {
+        std::memcpy(newLowerVf, m_state.vf[lowerWrite.reg], sizeof(newLowerVf));
+        std::memcpy(m_state.vf[lowerWrite.reg], oldLowerVf, sizeof(oldLowerVf));
+        const uint32_t latency = decoded.lowerUsage.vfLatency != 0u
+                                     ? decoded.lowerUsage.vfLatency
+                                     : decoded.lowerUsage.latency;
+        queueVfWrite(lowerWrite.reg, lowerWrite.lanes, newLowerVf, latency);
+    }
+    if (!compiled && decoded.upperUsage.accWrite != 0u)
+    {
+        std::memcpy(newAcc, m_state.acc, sizeof(newAcc));
+        std::memcpy(m_state.acc, oldAcc, sizeof(oldAcc));
+        // ACC is forwarded to the next upper instruction. Its arithmetic
+        // flags still use the normal four-cycle FMAC timeline.
+        queueAccWrite(decoded.upperUsage.accWrite, newAcc,
+                      kAccForwardLatency);
+    }
+    if (writtenVi != 0u)
+    {
+        const int32_t newVi = m_state.vi[writtenVi];
+        const uint32_t latency =
+            decoded.lowerUsage.viLatency != 0u
+                ? decoded.lowerUsage.viLatency
+                : decoded.lowerUsage.latency;
+        if (compiled && latency == 1u)
+        {
+            m_state.vi[writtenVi] = static_cast<int16_t>(newVi);
+            m_viLatestWrite[writtenVi] = ++m_nextWriteSequence;
+        }
+        else
+        {
+            m_state.vi[writtenVi] = oldVi;
+            queueViWrite(writtenVi, newVi, latency);
+        }
+    }
+
+    // ACC and one-cycle VI results are visible before the next pair or callback.
+    // Lower operations never read ACC; VI supersession still cancels older loads.
+    static_assert(kAccForwardLatency == 1u);
+
+    if constexpr (compiled) markPairWritesInline(decoded);
+    else markPairWrites(decoded);
+    if (writtenVi != 0u && decoded.lowerUsage.delaysNextBranchRead)
+        recordViWriteForBranch(writtenVi, oldVi);
+
+    m_state.vf[0][0] = 0.0f;
+    m_state.vf[0][1] = 0.0f;
+    m_state.vf[0][2] = 0.0f;
+    m_state.vf[0][3] = 1.0f;
+    m_state.vi[0] = 0;
+
+    uint32_t nextPc = m_state.pc + 8u;
+    if (nextPc >= codeSize)
+        nextPc = 0u;
+    m_state.pc = nextPc;
+
+    if (m_state.branchPending)
+    {
+        if (m_state.branchDelay == 0u)
+        {
+            m_state.pc = m_state.branchTarget & microAddressMask();
+            m_state.branchPending = false;
+        }
+        else
+        {
+            --m_state.branchDelay;
+        }
+    }
+
+    const bool dHalt = decoded.dBit && m_state.dBitEnabled;
+    const bool tHalt = decoded.tBit && m_state.tBitEnabled;
+    const bool haltBit = dHalt || tHalt;
+    const bool haltBranch = haltBit && decoded.lowerUsage.pipeline == PipelineBranch;
+
+    if (m_state.haltAfterDelaySlot)
+    {
+        m_state.stoppedByD = m_pendingHaltD;
+        m_state.stoppedByT = m_pendingHaltT;
+        programEnded = true;
+    }
+    else if (m_state.ebit)
+        programEnded = true;
+    else if (haltBit && !haltBranch)
+    {
+        m_state.stoppedByD = dHalt;
+        m_state.stoppedByT = tHalt;
+        programEnded = true;
+    }
+    else if (decoded.eBit)
+        m_state.ebit = true;
+    else if (haltBranch)
+    {
+        m_state.haltAfterDelaySlot = true;
+        m_pendingHaltD = dHalt;
+        m_pendingHaltT = tHalt;
+    }
+
+    advanceOneCycle();
+    return programEnded;
+}
+
+template <VU1Interpreter::Unit unit, uint64_t... words>
+bool VU1Interpreter::runCompiledBlock(VU1Interpreter &vu, uint64_t budgetEnd)
+{
+    const uint32_t startPC = vu.m_state.pc;
+    uint32_t nextPC = startPC;
+    bool active = true;
+    bool ended = false;
+    const auto step = [&]<uint64_t word>() PS2_VU_INLINE_LAMBDA {
+        if (!active)
+            return;
+        // A callback can replace code, and any pair may exhaust the cycle budget.
+        const uint64_t generation = unit == Unit::VU1
+            ? vu.m_activeMemory->getVU1CodeGeneration() : vu.m_activeMemory->getVU0CodeGeneration();
+        if (vu.m_state.pc != nextPC || vu.m_cycle >= budgetEnd || vu.m_stopRequested ||
+            generation != vu.m_cachedCodeGeneration)
+        {
+            active = false;
+            return;
+        }
+        static constexpr auto decoded = decodeInstructionWords(static_cast<uint32_t>(word),
+                                                        static_cast<uint32_t>(word >> 32u), unit);
+        ended = vu.runDecodedPair<true>(decoded, budgetEnd, vu.m_cachedCodeSize);
+        active = !ended;
+        nextPC += 8u;
+    };
+    (step.template operator()<words>(), ...);
+    return ended;
+}
+
+VU1Interpreter::CompiledBlock VU1Interpreter::findCompiledBlock(
+    const uint8_t *code, uint32_t size, Unit unit)
+{
+#ifdef PS2X_VU_AOT_INCLUDE
+    struct Entry {
+        Unit unit;
+        std::array<uint64_t, 4> words;
+        CompiledBlock run;
+    };
+    static const Entry entries[] = {
+#include PS2X_VU_AOT_INCLUDE
+    };
+    if (size < 32u)
+        return nullptr;
+    uint64_t first;
+    std::memcpy(&first, code, sizeof(first));
+    const auto *entry = std::lower_bound(std::begin(entries), std::end(entries), first,
+        [](const Entry &entry, uint64_t word) { return entry.words[0] < word; });
+    for (; entry != std::end(entries) && entry->words[0] == first; ++entry)
+        if (entry->unit == unit && std::memcmp(code, entry->words.data(), 32u) == 0)
+            return entry->run;
+#endif
+    return nullptr;
+}
+
 void VU1Interpreter::run(uint8_t *vuCode, uint32_t codeSize,
                          uint8_t *vuData, uint32_t dataSize,
                          GS &gs, PS2Memory *memory, uint32_t maxCycles)
 {
+    static const bool profileExecution = std::getenv("PS2_VU_PROFILE_EXECUTION") != nullptr;
+    static const char *blockProfile = std::getenv("PS2_VU_AOT_PROFILE");
+    const uint64_t pairsBefore = m_compiledPairsExecuted + m_interpretedPairsExecuted;
     m_activeVuData = vuData;
     m_activeVuDataSize = dataSize;
     m_activeGs = &gs;
@@ -1679,178 +2018,17 @@ void VU1Interpreter::run(uint8_t *vuCode, uint32_t codeSize,
             pair = &uncached;
         }
         const DecodedInstructionPair &decoded = *pair;
-        if (decoded.upperUsage.reserved || decoded.lowerUsage.reserved)
-        {
-            reportReservedInstruction(decoded.upperUsage.reserved, decoded.upperUsage.reserved ? decoded.upper : decoded.lower);
-            break;
-        }
-
-        uint64_t readyCycle = calculatePairReadyCycle(decoded);
-        while (readyCycle > m_cycle)
-        {
-            if (readyCycle >= budgetEnd)
-            {
-                advanceTo(budgetEnd);
-                break;
-            }
-            advanceTo(readyCycle);
-            readyCycle = calculatePairReadyCycle(decoded);
-        }
-        if (m_cycle >= budgetEnd)
-            break;
-
-        const uint32_t viWrites = decoded.lowerUsage.viWrite & 0xFFFEu;
-        const uint8_t writtenVi = viWrites != 0u ? static_cast<uint8_t>(std::countr_zero(viWrites)) : 0u;
-        const int32_t oldVi = writtenVi != 0u ? m_state.vi[writtenVi] : 0;
-
-        const VfAccess upperWrite = decoded.upperUsage.vfWrite;
-        const VfAccess lowerWrite = decoded.lowerUsage.vfWrite;
-        const bool hasUpperWrite = upperWrite.reg != 0u;
-        const bool hasLowerWrite = lowerWrite.reg != 0u && decoded.suppressedLowerVf != lowerWrite.reg;
-        const bool hasDistinctLowerWrite = hasLowerWrite && (!hasUpperWrite || lowerWrite.reg != upperWrite.reg);
-        float oldUpperVf[4]{};
-        float newUpperVf[4]{};
-        float oldLowerVf[4]{};
-        float newLowerVf[4]{};
-        float oldAcc[4]{};
-        float newAcc[4]{};
-        if (hasUpperWrite)
-            std::memcpy(oldUpperVf, m_state.vf[upperWrite.reg], sizeof(oldUpperVf));
-        if (hasDistinctLowerWrite)
-            std::memcpy(oldLowerVf, m_state.vf[lowerWrite.reg], sizeof(oldLowerVf));
-        if (decoded.upperUsage.accWrite != 0u)
-            std::memcpy(oldAcc, m_state.acc, sizeof(oldAcc));
-
-        if (decoded.iBit)
-        {
-            execUpper(decoded.upper);
-            float immediate = 0.0f;
-            std::memcpy(&immediate, &decoded.lower, sizeof(immediate));
-            m_state.i = normalizeOperand(immediate);
-        }
-        else if (decoded.upperVfShadowReg != 0u)
-        {
-            float oldVf[4]{};
-            float upperVf[4]{};
-            std::memcpy(oldVf,
-                        m_state.vf[decoded.upperVfShadowReg],
-                        sizeof(oldVf));
-            execUpper(decoded.upper);
-            std::memcpy(upperVf,
-                        m_state.vf[decoded.upperVfShadowReg],
-                        sizeof(upperVf));
-            std::memcpy(m_state.vf[decoded.upperVfShadowReg],
-                        oldVf,
-                        sizeof(oldVf));
-            execLower(decoded.lower, vuData, dataSize, gs, memory, decoded.upper);
-            std::memcpy(m_state.vf[decoded.upperVfShadowReg],
-                        upperVf,
-                        sizeof(upperVf));
-        }
+        const auto compiled = trackedCode && (m_state.pc & 7u) == 0u && m_useCompiledExecution
+            ? m_compiledCodeCache[m_state.pc / 8u] : nullptr;
+        if (compiled)
+            programEnded = compiled(*this, budgetEnd);
         else
         {
-            execUpper(decoded.upper);
-            execLower(decoded.lower, vuData, dataSize, gs, memory, decoded.upper);
-        }
-
-        m_viBranchBackupValid = false;
-
-        if (hasUpperWrite)
-        {
-            std::memcpy(newUpperVf, m_state.vf[upperWrite.reg], sizeof(newUpperVf));
-            std::memcpy(m_state.vf[upperWrite.reg], oldUpperVf, sizeof(oldUpperVf));
-            const uint32_t latency =
-                decoded.upperUsage.vfLatency != 0u
-                    ? decoded.upperUsage.vfLatency
-                    : decoded.upperUsage.latency;
-            queueVfWrite(upperWrite.reg, upperWrite.lanes, newUpperVf, latency);
-        }
-        if (hasDistinctLowerWrite)
-        {
-            std::memcpy(newLowerVf, m_state.vf[lowerWrite.reg], sizeof(newLowerVf));
-            std::memcpy(m_state.vf[lowerWrite.reg], oldLowerVf, sizeof(oldLowerVf));
-            const uint32_t latency = decoded.lowerUsage.vfLatency != 0u
-                                         ? decoded.lowerUsage.vfLatency
-                                         : decoded.lowerUsage.latency;
-            queueVfWrite(lowerWrite.reg, lowerWrite.lanes, newLowerVf, latency);
-        }
-        if (decoded.upperUsage.accWrite != 0u)
-        {
-            std::memcpy(newAcc, m_state.acc, sizeof(newAcc));
-            std::memcpy(m_state.acc, oldAcc, sizeof(oldAcc));
-            // ACC is forwarded to the next upper instruction. Its arithmetic
-            // flags still use the normal four-cycle FMAC timeline.
-            queueAccWrite(decoded.upperUsage.accWrite, newAcc,
-                          kAccForwardLatency);
-        }
-        if (writtenVi != 0u)
-        {
-            const int32_t newVi = m_state.vi[writtenVi];
-            m_state.vi[writtenVi] = oldVi;
-            const uint32_t latency =
-                decoded.lowerUsage.viLatency != 0u
-                    ? decoded.lowerUsage.viLatency
-                    : decoded.lowerUsage.latency;
-            queueViWrite(writtenVi, newVi, latency);
-        }
-
-        markPairWrites(decoded);
-        if (writtenVi != 0u && decoded.lowerUsage.delaysNextBranchRead)
-            recordViWriteForBranch(writtenVi, oldVi);
-
-        m_state.vf[0][0] = 0.0f;
-        m_state.vf[0][1] = 0.0f;
-        m_state.vf[0][2] = 0.0f;
-        m_state.vf[0][3] = 1.0f;
-        m_state.vi[0] = 0;
-
-        uint32_t nextPc = m_state.pc + 8u;
-        if (nextPc >= codeSize)
-            nextPc = 0u;
-        m_state.pc = nextPc;
-
-        if (m_state.branchPending)
-        {
-            if (m_state.branchDelay == 0u)
-            {
-                m_state.pc = m_state.branchTarget & microAddressMask();
-                m_state.branchPending = false;
-            }
-            else
-            {
-                --m_state.branchDelay;
-            }
-        }
-
-        const bool dHalt = decoded.dBit && m_state.dBitEnabled;
-        const bool tHalt = decoded.tBit && m_state.tBitEnabled;
-        const bool haltBit = dHalt || tHalt;
-        const bool haltBranch = haltBit && decoded.lowerUsage.pipeline == PipelineBranch;
-
-        if (m_state.haltAfterDelaySlot)
-        {
-            m_state.stoppedByD = m_pendingHaltD;
-            m_state.stoppedByT = m_pendingHaltT;
-            programEnded = true;
+            if (blockProfile && m_state.pc + 32ull <= codeSize)
+                recordUncompiledBlock(blockProfile, m_unit == Unit::VU1 ? 1u : 0u,
+                                      vuCode + m_state.pc);
+            programEnded = runDecodedPair<false>(decoded, budgetEnd, codeSize);
         }
-        else if (m_state.ebit)
-            programEnded = true;
-        else if (haltBit && !haltBranch)
-        {
-            m_state.stoppedByD = dHalt;
-            m_state.stoppedByT = tHalt;
-            programEnded = true;
-        }
-        else if (decoded.eBit)
-            m_state.ebit = true;
-        else if (haltBranch)
-        {
-            m_state.haltAfterDelaySlot = true;
-            m_pendingHaltD = dHalt;
-            m_pendingHaltT = tHalt;
-        }
-
-        advanceOneCycle();
         if (programEnded)
             break;
     }
@@ -1866,4 +2044,11 @@ void VU1Interpreter::run(uint8_t *vuCode, uint32_t codeSize,
     m_state.cycles = m_cycle;
     if (useVuRounding && previousRoundingMode != -1)
         std::fesetround(previousRoundingMode);
+    const uint64_t pairsAfter = m_compiledPairsExecuted + m_interpretedPairsExecuted;
+    if (profileExecution && (pairsBefore >> 24u) != (pairsAfter >> 24u))
+        std::fprintf(stderr, "[VU%u execution] native=%llu fallback=%llu (%.1f%% native)\n",
+                     m_unit == Unit::VU1 ? 1u : 0u,
+                     static_cast<unsigned long long>(m_compiledPairsExecuted),
+                     static_cast<unsigned long long>(m_interpretedPairsExecuted),
+                     100.0 * m_compiledPairsExecuted / pairsAfter);
 }
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_detail.h b/ps2xRuntime/src/lib/vu/ps2_vu1_detail.h
index ed0ee7145..ecb38818c 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_detail.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_detail.h
@@ -3,22 +3,36 @@
 
 #include <cstdint>
 
+#if defined(_MSC_VER)
+#define PS2_VU_FORCE_INLINE __forceinline
+#elif defined(__GNUC__) || defined(__clang__)
+#define PS2_VU_FORCE_INLINE inline __attribute__((always_inline))
+#else
+#define PS2_VU_FORCE_INLINE inline
+#endif
+
+#if defined(__GNUC__) || defined(__clang__)
+#define PS2_VU_INLINE_LAMBDA __attribute__((always_inline))
+#else
+#define PS2_VU_INLINE_LAMBDA
+#endif
+
 // Instruction field extraction helpers
-static inline uint8_t DEST(uint32_t i) { return (uint8_t)((i >> 21) & 0xF); }
-static inline uint8_t FT(uint32_t i) { return (uint8_t)((i >> 16) & 0x1F); }
-static inline uint8_t FS(uint32_t i) { return (uint8_t)((i >> 11) & 0x1F); }
-static inline uint8_t FD(uint32_t i) { return (uint8_t)((i >> 6) & 0x1F); }
-static inline uint8_t BC(uint32_t i) { return (uint8_t)(i & 0x3); }
+static constexpr uint8_t DEST(uint32_t i) { return (uint8_t)((i >> 21) & 0xF); }
+static constexpr uint8_t FT(uint32_t i) { return (uint8_t)((i >> 16) & 0x1F); }
+static constexpr uint8_t FS(uint32_t i) { return (uint8_t)((i >> 11) & 0x1F); }
+static constexpr uint8_t FD(uint32_t i) { return (uint8_t)((i >> 6) & 0x1F); }
+static constexpr uint8_t BC(uint32_t i) { return (uint8_t)(i & 0x3); }
 
 // Lower instruction field helpers
-static inline uint8_t LIT(uint32_t i) { return (uint8_t)((i >> 16) & 0x1F); }
-static inline uint8_t LIS(uint32_t i) { return (uint8_t)((i >> 11) & 0x1F); }
-static inline uint8_t LID(uint32_t i) { return (uint8_t)((i >> 6) & 0x1F); }
-static inline uint8_t VIT(uint32_t i) { return (uint8_t)((i >> 16) & 0xF); }
-static inline uint8_t VIS(uint32_t i) { return (uint8_t)((i >> 11) & 0xF); }
-static inline uint8_t VID(uint32_t i) { return (uint8_t)((i >> 6) & 0xF); }
-static inline int16_t IMM11(uint32_t i) { return (int16_t)(int32_t)((int32_t)(i << 21) >> 21); }
-static inline int16_t IMM15(uint32_t i)
+static constexpr uint8_t LIT(uint32_t i) { return (uint8_t)((i >> 16) & 0x1F); }
+static constexpr uint8_t LIS(uint32_t i) { return (uint8_t)((i >> 11) & 0x1F); }
+static constexpr uint8_t LID(uint32_t i) { return (uint8_t)((i >> 6) & 0x1F); }
+static constexpr uint8_t VIT(uint32_t i) { return (uint8_t)((i >> 16) & 0xF); }
+static constexpr uint8_t VIS(uint32_t i) { return (uint8_t)((i >> 11) & 0xF); }
+static constexpr uint8_t VID(uint32_t i) { return (uint8_t)((i >> 6) & 0xF); }
+static constexpr int16_t IMM11(uint32_t i) { return (int16_t)(int32_t)((int32_t)(i << 21) >> 21); }
+static constexpr int16_t IMM15(uint32_t i)
 {
     uint32_t lo11 = i & 0x7FF;
     uint32_t hi4 = (i >> 21) & 0xF;
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp
index 1d9c05c35..4e990aa65 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp
@@ -70,6 +70,11 @@ namespace
 // Lower instructions
 // ============================================================================
 void VU1Interpreter::execLower(uint32_t instr, uint8_t *vuData, uint32_t dataSize, GS &gs, PS2Memory *memory, uint32_t upperInstr)
+{
+    execLowerInline(instr, vuData, dataSize, gs, memory, upperInstr);
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::execLowerInline(uint32_t instr, uint8_t *vuData, uint32_t dataSize, GS &gs, PS2Memory *memory, uint32_t upperInstr)
 {
     (void)upperInstr;
     if (instr == 0x00000000 || instr == 0x8000033C) // NOP
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
index 6da558158..776119dfb 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
@@ -22,6 +22,11 @@ namespace
 // Upper instructions (FMAC pipeline)
 // ============================================================================
 void VU1Interpreter::execUpper(uint32_t instr)
+{
+    execUpperInline(instr);
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::execUpperInline(uint32_t instr)
 {
     m_currentUpperInstruction = instr;
     uint8_t dest = DEST(instr);
diff --git a/ps2xTest/src/ps2_vu1_tests.cpp b/ps2xTest/src/ps2_vu1_tests.cpp
index d85fc25c9..4bffe9773 100644
--- a/ps2xTest/src/ps2_vu1_tests.cpp
+++ b/ps2xTest/src/ps2_vu1_tests.cpp
@@ -608,6 +608,84 @@ void register_ps2_vu1_tests()
                      "ACC forwarding must not introduce a four-cycle dependency stall");
         });
 
+        tc.Run("two VF writes per cycle retire across queue wraps and one-cycle resumes", [](TestCase &t)
+        {
+            Vu1Fixture fx;
+            t.IsTrue(fx.initialize(), "VU1 fixture should initialize");
+            VU1Interpreter vu;
+            for (uint32_t i = 0; i < 32u; ++i)
+            {
+                const float values[4] = {float(i + 1u), float(i + 2u), float(i + 3u), float(i + 4u)};
+                std::memcpy(fx.data + i * 16u, values, sizeof(values));
+                writeVuInstructionPair(fx.code, i * 8u,
+                    makeVuLq(0xFu, 16u + i % 8u, 0u, i),
+                    makeVuUpper(0x28u, 0xFu, 0u, 1u + i / 8u, 8u + i % 8u));
+            }
+            for (uint32_t i = 32u; i < 36u; ++i)
+                writeVuInstructionPair(fx.code, i * 8u, 0u, kVuUpperNop);
+            for (uint32_t reg = 1u; reg <= 4u; ++reg)
+                for (float &component : vu.state().vf[reg])
+                    component = float(reg * 10u);
+
+            for (uint32_t cycle = 1u; cycle <= 35u; ++cycle)
+            {
+                if (cycle == 1u)
+                    vu.execute(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                               fx.gs, &fx.mem, 0u, 0u, 0u, 1u);
+                else
+                    vu.resume(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                              fx.gs, &fx.mem, 0u, 0u, 1u);
+                for (uint32_t reg = 0u; reg < 8u; ++reg)
+                {
+                    int32_t last = -1;
+                    for (uint32_t issued = reg; issued < 32u; issued += 8u)
+                        if (issued + 4u <= cycle) last = issued;
+                    const float upper = last < 0 ? 0.0f : float((last / 8 + 1) * 10);
+                    const float lower = last < 0 ? 0.0f : float(last + 1);
+                    t.Equals(vu.state().vf[8u + reg][0], upper, "upper write must retire at its exact cycle");
+                    t.Equals(vu.state().vf[16u + reg][0], lower, "lower write must retire at its exact cycle");
+                }
+            }
+        });
+
+        tc.Run("ILW and IALU can retire together after repeated queue wraps", [](TestCase &t)
+        {
+            Vu1Fixture fx;
+            t.IsTrue(fx.initialize(), "VU1 fixture should initialize");
+            for (uint32_t group = 0; group < 8u; ++group)
+            {
+                const uint32_t base = group * 6u;
+                for (uint32_t i = 0; i < 3u; ++i)
+                {
+                    const uint32_t value = group * 10u + i + 1u;
+                    std::memcpy(fx.data + (base + i) * 16u, &value, sizeof(value));
+                    writeVuInstructionPair(fx.code, (base + i) * 8u,
+                        makeVuIlw(0x8u, i + 1u, 0u, base + i), kVuUpperNop);
+                    writeVuInstructionPair(fx.code, (base + i + 3u) * 8u,
+                        makeVuIaddiu(i + 4u, 0u, value + 100u), kVuUpperNop);
+                }
+            }
+            VU1Interpreter vu;
+            for (uint32_t cycle = 1u; cycle <= 48u; ++cycle)
+            {
+                if (cycle == 1u)
+                    vu.execute(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                               fx.gs, &fx.mem, 0u, 0u, 0u, 1u);
+                else
+                    vu.resume(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                              fx.gs, &fx.mem, 0u, 0u, 1u);
+                for (uint32_t i = 0; i < 3u; ++i)
+                {
+                    int32_t expected = 0;
+                    for (uint32_t group = 0; group < 8u; ++group)
+                        if (group * 6u + i + 4u <= cycle) expected = group * 10u + i + 1u;
+                    t.Equals(vu.state().vi[i + 1u], expected, "delayed ILW must commit on the shared cycle");
+                    t.Equals(vu.state().vi[i + 4u], expected ? expected + 100 : 0,
+                             "one-cycle IALU must commit alongside ILW");
+                }
+            }
+        });
+
         tc.Run("ILW result becomes visible after four cycles before IALU consumes it", [](TestCase &t)
         {
             Vu1Fixture fx;
@@ -1225,6 +1303,31 @@ void register_ps2_vu1_tests()
             }
         });
 
+        tc.Run("XGKICK wraps within a qword for an external unaligned data size", [](TestCase &t)
+        {
+            Vu1Fixture fx;
+            t.IsTrue(fx.initialize(), "VU1 fixture should initialize");
+            std::vector<uint8_t> data(31u, 0u);
+            uint8_t expected[16]{};
+            const uint64_t tag = makeGifTag(0u, GIF_FMT_PACKED, 1u, true);
+            std::memcpy(expected, &tag, sizeof(tag));
+            expected[15] = 0x5au;
+            for (uint32_t i = 0; i < 16u; ++i)
+                data[(16u + i) % data.size()] = expected[i];
+            std::vector<uint8_t> captured;
+            fx.mem.setGifPacketCallback([&](const uint8_t *packet, uint32_t size) {
+                captured.assign(packet, packet + size);
+            });
+            writeVuInstructionPair(fx.code, 0u, makeVuLowerSpecial(0x6Cu, 1u), kVuUpperNop);
+            VU1Interpreter vu;
+            vu.state().vi[1] = 1;
+            vu.execute(fx.code, PS2_VU1_CODE_SIZE, data.data(), data.size(),
+                       fx.gs, &fx.mem, 0u, 0u, 0u, 1u);
+            t.IsTrue(captured.size() == sizeof(expected) &&
+                         std::memcmp(captured.data(), expected, sizeof(expected)) == 0,
+                     "the final byte of the qword must wrap to the data buffer start");
+        });
+
         tc.Run("XGKICK observes stores committed before a future PATH1 qword", [](TestCase &t)
         {
             PS2Memory mem;
@@ -1749,6 +1852,35 @@ void register_ps2_vu1_tests()
                      "the underflowing product should set sticky Z and U");
         });
 
+        tc.Run("FMAC product sticky flags retain sign and range boundaries", [](TestCase &t)
+        {
+            Vu1Fixture fx;
+            t.IsTrue(fx.initialize(), "VU1 fixture should initialize");
+            writeVuInstructionPair(fx.code, 0u, 0u, makeVuUpper(0x29u, 0x8u, 2u, 1u, 3u));
+            struct Input { float left, right, acc; uint32_t status; };
+            const float minimum = std::numeric_limits<float>::min();
+            const float maximum = std::numeric_limits<float>::max();
+            const Input inputs[] = {
+                {2.0f, 3.0f, 1.0f, 0u},
+                {-2.0f, 3.0f, 10.0f, 0x80u},
+                {0.0f, 3.0f, 1.0f, 0x40u},
+                {-0.0f, 3.0f, 1.0f, 0xc0u},
+                {minimum, 0.5f, 1.0f, 0x140u},
+                {maximum, 2.0f, -maximum, 0x200u},
+            };
+            for (const auto &input : inputs)
+            {
+                VU1Interpreter vu1;
+                vu1.state().vf[1][0] = input.left;
+                vu1.state().vf[2][0] = input.right;
+                vu1.state().acc[0] = input.acc;
+                vu1.execute(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                            fx.gs, &fx.mem, 0u, 0u, 0u, 5u);
+                t.Equals(vu1.state().status, input.status,
+                         "a normal accumulated result must retain exceptional product conditions");
+            }
+        });
+
         tc.Run("reserved opcodes stop before executing or corrupting state", [](TestCase &t)
         {
             Vu1Fixture fx;
diff --git a/tools/compile_vu_blocks.py b/tools/compile_vu_blocks.py
new file mode 100644
index 000000000..afe53cc63
--- /dev/null
+++ b/tools/compile_vu_blocks.py
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Emit native C++ VU block instantiations from user-supplied microcode images."""
+
+import argparse
+import struct
+from pathlib import Path
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("images", type=Path, nargs="+")
+    args = parser.parse_args()
+    blocks = set()
+    for path in args.images:
+        data = path.read_bytes()
+        if data.startswith(b"VU-BLOCKS 1\n"):
+            for line in data.decode("ascii").splitlines()[1:]:
+                fields = line.split()
+                if len(fields) != 5:
+                    parser.error(f"{path}: invalid block profile record")
+                try:
+                    unit = int(fields[0])
+                    block = tuple(int(word, 16) for word in fields[1:])
+                except ValueError:
+                    parser.error(f"{path}: invalid numeric block profile record")
+                if unit not in (0, 1) or any(word < 0 or word >= 1 << 64 for word in block):
+                    parser.error(f"{path}: invalid unit or instruction bits")
+                blocks.add((block, unit))
+            continue
+        if len(data) not in (4096, 16384):
+            parser.error(f"{path}: expected a 4 KiB VU0 or 16 KiB VU1 code image")
+        unit = 0 if len(data) == 4096 else 1
+        words = [word for (word,) in struct.iter_unpack("<Q", data)]
+        for index in range(len(words) - 3):
+            block = tuple(words[index:index + 4])
+            if any(block):
+                blocks.add((block, unit))
+    if not blocks:
+        parser.error("no nonempty microcode blocks")
+    lines = ["// Generated from local microcode; do not distribute game data."]
+    for block, unit in sorted(blocks):
+        values = ", ".join(f"0x{word:016x}ull" for word in block)
+        lines.append(f"{{Unit::VU{unit}, {{{values}}}, &runCompiledBlock<Unit::VU{unit}, {values}>}},")
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    args.output.write_text("\n".join(lines) + "\n")
+    print(f"Compiled VU input: {len(args.images)} images, {len(blocks)} distinct four-pair blocks")
+
+
+if __name__ == "__main__":
+    main()

From 7c88922d0abf55c51a8fa28c784dceeb9d19b781 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 01:44:18 +0200
Subject: [PATCH 40/68] Match screen clipping to VU sticky zero and sign flags

---
 ps2xRuntime/src/lib/Kernel/Stubs/VU.cpp | 48 +++++++++++++-----
 ps2xTest/src/ps2_vu_tests.cpp           | 65 ++++++++++++++++++++-----
 2 files changed, 91 insertions(+), 22 deletions(-)

diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/VU.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/VU.cpp
index b7840d447..e405c41d5 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/VU.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/VU.cpp
@@ -168,22 +168,44 @@ namespace ps2_stubs
             out[3] = fullFtoi4 ? static_cast<int32_t>(t[3] * 16.0f) : static_cast<int32_t>(t[3]);
         }
 
-        // Guard-band proxy for the COP2 sticky clip flags: nonzero => the
-        // vertex is offscreen. Not the hardware per-plane flag layout.
-        constexpr float kScreenClipGuard = 4096.0f;
         int32_t screenClipCode(const float (&v)[4])
         {
+            // The SDK returns sticky Z/S from (x,y,w)-0 and 4096-(x,y).
+            // Inspecting bits also preserves VU signed-zero/denormal behavior.
             int32_t code = 0;
-            if (v[0] > kScreenClipGuard)
-                code |= 0x1;
-            if (v[0] < -kScreenClipGuard)
-                code |= 0x2;
-            if (v[1] > kScreenClipGuard)
-                code |= 0x4;
-            if (v[1] < -kScreenClipGuard)
-                code |= 0x8;
+            for (unsigned lane : {0u, 1u, 3u})
+            {
+                uint32_t bits;
+                std::memcpy(&bits, &v[lane], sizeof(bits));
+                const uint32_t magnitude = bits & 0x7fffffffu;
+                if (magnitude < 0x00800000u)
+                    code |= 0x40;
+                if (bits & 0x80000000u)
+                    code |= 0x80;
+                else if (lane != 3u)
+                {
+                    if (magnitude == 0x45800000u)
+                        code |= 0x40;
+                    else if (magnitude > 0x45800000u)
+                        code |= 0x80;
+                }
+            }
             return code;
         }
+
+        void traceScreenClip(const R5900Context *ctx, const float (&v)[4], int32_t code)
+        {
+            static const bool enabled = std::getenv("PS2_VU_TRACE_SCREEN_CLIP") != nullptr;
+            if (!enabled)
+                return;
+            static uint64_t calls = 0, rejected = 0;
+            ++calls;
+            rejected += code != 0;
+            if (calls <= 16 || (calls & (calls - 1)) == 0)
+                std::fprintf(stderr, "[vu-screen-clip] calls=%llu rejected=%llu ra=%08x v=(%g,%g,%g,%g) flags=%02x\n",
+                             static_cast<unsigned long long>(calls), static_cast<unsigned long long>(rejected),
+                             getRegU32(ctx, 31), v[0], v[1], v[2], v[3], code);
+        }
     }
 
     void sceVpu0Reset(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -340,6 +362,7 @@ namespace ps2_stubs
         if (readVuVec4f(rdram, vAddr, v))
         {
             code = screenClipCode(v);
+            traceScreenClip(ctx, v, code);
         }
         setReturnS32(ctx, code);
     }
@@ -354,14 +377,17 @@ namespace ps2_stubs
         if (readVuVec4f(rdram, v0Addr, v0))
         {
             code |= screenClipCode(v0);
+            traceScreenClip(ctx, v0, screenClipCode(v0));
         }
         if (readVuVec4f(rdram, v1Addr, v1))
         {
             code |= screenClipCode(v1);
+            traceScreenClip(ctx, v1, screenClipCode(v1));
         }
         if (readVuVec4f(rdram, v2Addr, v2))
         {
             code |= screenClipCode(v2);
+            traceScreenClip(ctx, v2, screenClipCode(v2));
         }
         setReturnS32(ctx, code);
     }
diff --git a/ps2xTest/src/ps2_vu_tests.cpp b/ps2xTest/src/ps2_vu_tests.cpp
index b96befe65..613c47a62 100644
--- a/ps2xTest/src/ps2_vu_tests.cpp
+++ b/ps2xTest/src/ps2_vu_tests.cpp
@@ -2,8 +2,11 @@
 #include "ps2_runtime.h"
 #include "ps2_runtime_macros.h"
 #include "runtime/ps2_memory.h"
+#include "runtime/ps2_vu1.h"
+#include "runtime/gs/gs_frontend.h"
 #include "Kernel/Stubs/VU.h"
 
+#include <bit>
 #include <cmath>
 #include <cstdint>
 #include <cstring>
@@ -864,7 +867,7 @@ void register_ps2_vu_tests()
         tc.Run("ClipScreen_inside_zero", [](TestCase &t)
         {
             VuEnv env;
-            writeVec4(env, kA, 100.0f, 100.0f, 0.0f, 0.0f);
+            writeVec4(env, kA, 100.0f, 100.0f, 0.0f, 1.0f);
             SET_GPR_U32(&env.ctx, 4, kA);
             ps2_stubs::sceVu0ClipScreen(env.rdram.data(), &env.ctx, &env.runtime);
             t.Equals(getRegU32(&env.ctx, 2), 0u, "ClipScreen should return 0 for an in-bounds vertex");
@@ -873,28 +876,23 @@ void register_ps2_vu_tests()
         tc.Run("ClipScreen_offscreen_nonzero", [](TestCase &t)
         {
             VuEnv env;
-            writeVec4(env, kA, 5000.0f, 100.0f, 0.0f, 0.0f);
+            writeVec4(env, kA, 5000.0f, 100.0f, 0.0f, 1.0f);
             SET_GPR_U32(&env.ctx, 4, kA);
             ps2_stubs::sceVu0ClipScreen(env.rdram.data(), &env.ctx, &env.runtime);
-            t.IsTrue(getRegU32(&env.ctx, 2) != 0u, "ClipScreen should return nonzero when x exceeds the guard band");
+            t.Equals(getRegU32(&env.ctx, 2), 0x80u, "ClipScreen should return sticky sign when x exceeds 4096");
         });
 
         tc.Run("ClipScreen_negx_nonzero", [](TestCase &t)
         {
-            // Pins the negative-x guard-band clause (v[0] < -kScreenClipGuard => 0x2),
-            // the mirror of ClipScreen_offscreen_nonzero's +x clause. Without this
-            // case, deleting the negative-x clause leaves the suite green.
             VuEnv env;
-            writeVec4(env, kA, -5000.0f, 100.0f, 0.0f, 0.0f);
+            writeVec4(env, kA, -1.0f, 100.0f, 0.0f, 1.0f);
             SET_GPR_U32(&env.ctx, 4, kA);
             ps2_stubs::sceVu0ClipScreen(env.rdram.data(), &env.ctx, &env.runtime);
-            t.IsTrue(getRegU32(&env.ctx, 2) != 0u, "ClipScreen should return nonzero when x is below the negative guard band");
+            t.Equals(getRegU32(&env.ctx, 2), 0x80u, "ClipScreen should reject every negative x");
         });
 
         tc.Run("ClipScreen3_ors_three", [](TestCase &t)
         {
-            // Both offscreen vertices trip the y-guard clauses (not x) so this
-            // test does not overlap ClipScreen_offscreen_nonzero's x-guard mutation.
             VuEnv env;
             writeVec4(env, kA, 0.0f, 5000.0f, 0.0f, 0.0f);
             writeVec4(env, kB, 0.0f, 0.0f, 0.0f, 0.0f);
@@ -903,7 +901,52 @@ void register_ps2_vu_tests()
             SET_GPR_U32(&env.ctx, 5, kB);
             SET_GPR_U32(&env.ctx, 6, kC);
             ps2_stubs::sceVu0ClipScreen3(env.rdram.data(), &env.ctx, &env.runtime);
-            t.Equals(getRegU32(&env.ctx, 2), 0xCu, "ClipScreen3 should OR the guard-band codes across all 3 vertices");
+            t.Equals(getRegU32(&env.ctx, 2), 0xC0u, "ClipScreen3 should accumulate sticky zero and sign across all 3 vertices");
+        });
+
+        tc.Run("ClipScreen_matches_VU_sticky_subtraction_flags", [](TestCase &t)
+        {
+            VuEnv env;
+            auto vu = std::make_unique<VU1Interpreter>(VU1Interpreter::Unit::VU0);
+            auto gs = std::make_unique<GS>();
+            uint32_t code[16]{};
+            uint8_t data[16]{};
+            for (unsigned pair = 0; pair < 8; ++pair)
+                code[pair * 2 + 1] = 0x800002ffu; // I-bit NOP ignores the lower word.
+            const auto sub = [](unsigned mask, unsigned fs, unsigned ft) {
+                return 0x8000002cu | (mask << 21) | (ft << 16) | (fs << 11) | (4u << 6);
+            };
+            code[1] = sub(0xdu, 1u, 2u); // x, y, w minus zero
+            code[3] = sub(0xcu, 3u, 1u); // 4096 minus x, y
+            code[13] |= 0x40000000u;
+            const uint32_t values[] = {
+                0u, 0x80000000u, 1u, 0x80000001u, 0x007fffffu, 0x807fffffu,
+                0x00800000u, 0x80800000u, 0x3f800000u, 0xbf800000u,
+                0x457fffffu, 0x45800000u, 0x45800001u, 0xc5800000u,
+                0x7f7fffffu, 0xff7fffffu, 0x7f800000u, 0xff800000u,
+                0x7fc00001u, 0xffc00001u
+            };
+            for (unsigned lane = 0; lane < 4; ++lane)
+            {
+                for (uint32_t bits : values)
+                {
+                    float v[4] = {100.0f, 200.0f, 300.0f, 1.0f};
+                    v[lane] = std::bit_cast<float>(bits);
+                    writeVec4(env, kA, v[0], v[1], v[2], v[3]);
+                    SET_GPR_U32(&env.ctx, 4, kA);
+                    ps2_stubs::sceVu0ClipScreen(env.rdram.data(), &env.ctx, &env.runtime);
+                    vu->reset();
+                    std::memcpy(vu->state().vf[1], v, sizeof(v));
+                    vu->state().vf[3][0] = vu->state().vf[3][1] = 4096.0f;
+                    vu->execute(reinterpret_cast<uint8_t *>(code), sizeof(code),
+                                data, sizeof(data), *gs, nullptr, 0, 0, 0, 64);
+                    t.Equals(getRegU32(&env.ctx, 2), vu->state().status & 0xc0u,
+                             "screen clipping lane " + std::to_string(lane) +
+                             " bits " + std::to_string(bits) + " HLE " +
+                             std::to_string(getRegU32(&env.ctx, 2)) + " VU " +
+                             std::to_string(vu->state().status & 0xc0u));
+                }
+            }
         });
 
         tc.Run("ClipAll_all_out_returns_1", [](TestCase &t)

From eb6cf14b2bbbca47e1feb6e4b200bad1b49f4e33 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 01:44:19 +0200
Subject: [PATCH 41/68] Compile reusable VU pairs and capture program entry
 states

---
 ps2xRuntime/CMakeLists.txt              |  9 ++-
 ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp | 80 ++++++++++++++++++++++++-
 tools/compile_vu_blocks.py              | 29 +++++----
 3 files changed, 102 insertions(+), 16 deletions(-)

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index a900daf2a..05973cf00 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -403,15 +403,18 @@ set_source_files_properties(
     PROPERTIES UNITY_GROUP vu1)
 
 set(PS2X_VU_AOT_IMAGES "" CACHE STRING "Local VU code images or block profiles to compile; never distributed")
+set(PS2X_VU_AOT_PAIR_IMAGES "" CACHE STRING "Additional local VU inputs to compile as reusable individual pairs")
 option(PS2X_VU_AOT_DEBUG_INFO "Include expanded VU AOT debug scopes (slow to compile)" OFF)
-if(PS2X_VU_AOT_IMAGES)
+if(PS2X_VU_AOT_IMAGES OR PS2X_VU_AOT_PAIR_IMAGES)
     find_package(Python3 COMPONENTS Interpreter REQUIRED)
     set(PS2X_VU_AOT_INCLUDE "${CMAKE_CURRENT_BINARY_DIR}/generated/vu_aot_blocks.inc")
     add_custom_command(
         OUTPUT "${PS2X_VU_AOT_INCLUDE}"
         COMMAND "${Python3_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_blocks.py"
-                --output "${PS2X_VU_AOT_INCLUDE}" ${PS2X_VU_AOT_IMAGES}
-        DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_blocks.py" ${PS2X_VU_AOT_IMAGES}
+                --output "${PS2X_VU_AOT_INCLUDE}" --pair-images ${PS2X_VU_AOT_PAIR_IMAGES}
+                -- ${PS2X_VU_AOT_IMAGES}
+        DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_blocks.py"
+                ${PS2X_VU_AOT_IMAGES} ${PS2X_VU_AOT_PAIR_IMAGES}
         VERBATIM)
     add_custom_target(ps2_vu_aot DEPENDS "${PS2X_VU_AOT_INCLUDE}")
     add_dependencies(ps2_runtime ps2_vu_aot)
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
index f6f66a9c3..6c20fd04f 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
@@ -14,12 +14,65 @@
 #include <filesystem>
 #include <fstream>
 #include <limits>
+#include <map>
 #include <mutex>
 #include <set>
+#include <tuple>
 #include <ps2_log.h>
 
 namespace
 {
+    void captureProgramStart(const char *directory, unsigned unit,
+                             const uint8_t *code, uint32_t codeSize, uint64_t generation,
+                             const uint8_t *data, uint32_t dataSize, const VU1State &state)
+    {
+        static std::mutex mutex;
+        const std::lock_guard lock(mutex);
+        static unsigned captured = 0;
+        if (captured >= 256u)
+            return;
+        struct CodeHash {
+            const uint8_t *code = nullptr;
+            uint64_t generation = 0;
+            uint64_t hash = 0;
+        };
+        static std::array<CodeHash, 2> hashes;
+        auto &cached = hashes[unit];
+        if (cached.code != code || cached.generation != generation) {
+            cached = {code, generation, 14695981039346656037ull};
+            for (uint32_t i = 0; i < codeSize; ++i)
+                cached.hash = (cached.hash ^ code[i]) * 1099511628211ull;
+        }
+        static std::map<std::tuple<unsigned, uint32_t, uint64_t>, uint64_t> calls;
+        const uint64_t call = ++calls[{unit, state.pc, cached.hash}];
+        if ((call & (call - 1u)) != 0u)
+            return;
+        std::error_code error;
+        std::filesystem::create_directories(directory, error);
+        if (error) {
+            std::fprintf(stderr, "VU capture directory: %s\n", error.message().c_str());
+            captured = 256u;
+            return;
+        }
+        const std::string stem = std::string(directory) + "/vu" + std::to_string(unit) +
+            "-pc" + std::to_string(state.pc) + "-call" + std::to_string(call) +
+            "-code" + std::to_string(cached.hash);
+        VU1State initial = state;
+        initial.cycles = 0u;
+        const auto write = [&](const char *suffix, const void *bytes, size_t size) {
+            std::ofstream output(stem + suffix, std::ios::binary);
+            output.write(static_cast<const char *>(bytes), static_cast<std::streamsize>(size));
+            return static_cast<bool>(output);
+        };
+        if (!write(".code", code, codeSize) || !write(".data", data, dataSize) ||
+            !write(".state", &initial, sizeof(initial))) {
+            std::fprintf(stderr, "Unable to write VU capture %s\n", stem.c_str());
+            captured = 256u;
+            return;
+        }
+        ++captured;
+    }
+
     void recordUncompiledBlock(const char *path, unsigned unit, const uint8_t *code)
     {
         static std::mutex mutex;
@@ -1695,6 +1748,14 @@ void VU1Interpreter::execute(uint8_t *vuCode, uint32_t codeSize,
     m_state.vf[0][1] = 0.0f;
     m_state.vf[0][2] = 0.0f;
     m_state.vf[0][3] = 1.0f;
+    static const char *captureDirectory = std::getenv("PS2_VU_CAPTURE_DIR");
+    if (captureDirectory && *captureDirectory && memory) {
+        // execute() has an empty pipeline; resumed states need a fuller snapshot.
+        const uint64_t generation = m_unit == Unit::VU1
+            ? memory->getVU1CodeGeneration() : memory->getVU0CodeGeneration();
+        captureProgramStart(captureDirectory, m_unit == Unit::VU1 ? 1u : 0u,
+                            vuCode, codeSize, generation, vuData, dataSize, m_state);
+    }
     run(vuCode, codeSize, vuData, dataSize, gs, memory, maxCycles);
 }
 
@@ -1956,19 +2017,32 @@ VU1Interpreter::CompiledBlock VU1Interpreter::findCompiledBlock(
         Unit unit;
         std::array<uint64_t, 4> words;
         CompiledBlock run;
+        uint32_t bytes;
     };
     static const Entry entries[] = {
 #include PS2X_VU_AOT_INCLUDE
     };
-    if (size < 32u)
+    if (size < 8u)
         return nullptr;
+    static const bool pairsOnly = [] {
+        const char *mode = std::getenv("PS2_VU_EXECUTION");
+        return mode && std::strcmp(mode, "pairs") == 0;
+    }();
     uint64_t first;
     std::memcpy(&first, code, sizeof(first));
     const auto *entry = std::lower_bound(std::begin(entries), std::end(entries), first,
         [](const Entry &entry, uint64_t word) { return entry.words[0] < word; });
-    for (; entry != std::end(entries) && entry->words[0] == first; ++entry)
-        if (entry->unit == unit && std::memcmp(code, entry->words.data(), 32u) == 0)
+    CompiledBlock pair = nullptr;
+    for (; entry != std::end(entries) && entry->words[0] == first; ++entry) {
+        if (entry->unit != unit)
+            continue;
+        if (entry->bytes == 8u)
+            pair = entry->run;
+        else if (!pairsOnly && size >= entry->bytes &&
+                 std::memcmp(code, entry->words.data(), entry->bytes) == 0)
             return entry->run;
+    }
+    return pair;
 #endif
     return nullptr;
 }
diff --git a/tools/compile_vu_blocks.py b/tools/compile_vu_blocks.py
index afe53cc63..b31d2122f 100644
--- a/tools/compile_vu_blocks.py
+++ b/tools/compile_vu_blocks.py
@@ -6,13 +6,9 @@
 from pathlib import Path
 
 
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--output", type=Path, required=True)
-    parser.add_argument("images", type=Path, nargs="+")
-    args = parser.parse_args()
+def read_blocks(paths, parser):
     blocks = set()
-    for path in args.images:
+    for path in paths:
         data = path.read_bytes()
         if data.startswith(b"VU-BLOCKS 1\n"):
             for line in data.decode("ascii").splitlines()[1:]:
@@ -36,15 +32,28 @@ def main():
             block = tuple(words[index:index + 4])
             if any(block):
                 blocks.add((block, unit))
-    if not blocks:
+    return blocks
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--pair-images", type=Path, nargs="*", default=[],
+                        help="Compile individual pairs from these images or profiles")
+    parser.add_argument("images", type=Path, nargs="*")
+    args = parser.parse_args()
+    blocks = read_blocks(args.images, parser)
+    pair_blocks = blocks | read_blocks(args.pair_images, parser)
+    pairs = {((word,), unit) for block, unit in pair_blocks for word in block}
+    if not pairs:
         parser.error("no nonempty microcode blocks")
     lines = ["// Generated from local microcode; do not distribute game data."]
-    for block, unit in sorted(blocks):
+    for block, unit in sorted(blocks | pairs):
         values = ", ".join(f"0x{word:016x}ull" for word in block)
-        lines.append(f"{{Unit::VU{unit}, {{{values}}}, &runCompiledBlock<Unit::VU{unit}, {values}>}},")
+        lines.append(f"{{Unit::VU{unit}, {{{values}}}, &runCompiledBlock<Unit::VU{unit}, {values}>, {len(block) * 8}u}},")
     args.output.parent.mkdir(parents=True, exist_ok=True)
     args.output.write_text("\n".join(lines) + "\n")
-    print(f"Compiled VU input: {len(args.images)} images, {len(blocks)} distinct four-pair blocks")
+    print(f"Compiled VU input: {len(blocks)} four-pair blocks, {len(pairs)} individual pairs")
 
 
 if __name__ == "__main__":

From 6e3cfd253d8f4b43bcb066a5c3454c91dfbdc551 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 03:03:36 +0200
Subject: [PATCH 42/68] Reuse unchanged VU code and vectorize pipeline
 retirement

Invalidate every overlapping four-pair block when microcode changes. Capture drained continuations for replay coverage and keep cache, capture and retirement code outside the large native-block unity unit.

Validated with six runtime suites, 788108 raw-oracle boundaries over 268 captures, preserved scalar signatures and an overlapping-invalidation negative control. Re-upload-heavy replay improves; warm timings are nearly unchanged. Playable field FPS is not yet achieved.
---
 ps2xRuntime/CMakeLists.txt                  |   3 +
 ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp    |  31 ++++
 ps2xRuntime/src/lib/vu/ps2_vu1_capture.cpp  |  83 +++++++++
 ps2xRuntime/src/lib/vu/ps2_vu1_capture.h    |  10 ++
 ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp     | 190 +-------------------
 ps2xRuntime/src/lib/vu/ps2_vu1_pipeline.cpp | 142 +++++++++++++++
 6 files changed, 278 insertions(+), 181 deletions(-)
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_capture.cpp
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_capture.h
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_pipeline.cpp

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index 05973cf00..cf4916030 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -391,6 +391,9 @@ add_library(ps2_runtime STATIC
     src/lib/vu/ps2_vu1_core.cpp
     src/lib/vu/ps2_vu1_upper.cpp
     src/lib/vu/ps2_vu1_lower.cpp
+    src/lib/vu/ps2_vu1_pipeline.cpp
+    src/lib/vu/ps2_vu1_capture.cpp
+    src/lib/vu/ps2_vu1_cache.cpp
     src/lib/games_database.cpp
 )
 
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp
new file mode 100644
index 000000000..7e5107ab5
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp
@@ -0,0 +1,31 @@
+#include "runtime/ps2_vu1.h"
+
+#include <algorithm>
+#include <cstring>
+
+void VU1Interpreter::rebuildDecodedCodeCache(const uint8_t *vuCode, uint32_t codeSize,
+                                           const PS2Memory *memory, uint64_t generation)
+{
+    const bool reusable = m_decodedCodeCacheValid && m_cachedVuCode == vuCode &&
+        m_cachedMemory == memory && m_cachedCodeSize == codeSize;
+    const uint32_t pairCount = std::min<uint32_t>(codeSize / 8u, kMaxDecodedPairs);
+    uint32_t changedWindow = 0u;
+    for (uint32_t i = pairCount; i-- > 0u;)
+    {
+        uint32_t words[2];
+        std::memcpy(words, vuCode + i * 8u, sizeof(words));
+        const auto &old = m_decodedCodeCache[i];
+        const bool changed = !reusable || old.lower != words[0] || old.upper != words[1];
+        // Native blocks span at most four pairs; a later edit invalidates earlier starts.
+        changedWindow = ((changedWindow << 1u) | static_cast<uint32_t>(changed)) & 0xFu;
+        if (changed)
+            m_decodedCodeCache[i] = decodeInstructionPair(vuCode, i * 8u);
+        if (changedWindow != 0u)
+            m_compiledCodeCache[i] = findCompiledBlock(vuCode + i * 8u, codeSize - i * 8u, m_unit);
+    }
+    m_cachedVuCode = vuCode;
+    m_cachedMemory = memory;
+    m_cachedCodeSize = codeSize;
+    m_cachedCodeGeneration = generation;
+    m_decodedCodeCacheValid = true;
+}
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_capture.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_capture.cpp
new file mode 100644
index 000000000..aff4bc99d
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_capture.cpp
@@ -0,0 +1,83 @@
+#include "ps2_vu1_capture.h"
+#include "runtime/ps2_vu1.h"
+
+#include <array>
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <map>
+#include <mutex>
+#include <string>
+#include <tuple>
+
+namespace ps2_vu_detail {
+void captureProgramStart(const char *directory, unsigned unit,
+                         const uint8_t *code, uint32_t codeSize, uint64_t generation,
+                         const uint8_t *data, uint32_t dataSize, const VU1State &state)
+{
+    static const char *trigger = std::getenv("PS2_VU_CAPTURE_TRIGGER");
+    static const char *pcFilter = std::getenv("PS2_VU_CAPTURE_PC");
+    if (pcFilter && state.pc != std::strtoul(pcFilter, nullptr, 0))
+        return;
+    static std::mutex mutex;
+    const std::lock_guard lock(mutex);
+    if (trigger && *trigger) {
+        static bool triggered = false;
+        static auto nextCheck = std::chrono::steady_clock::time_point::min();
+        if (!triggered) {
+            const auto now = std::chrono::steady_clock::now();
+            if (now < nextCheck) return;
+            nextCheck = now + std::chrono::milliseconds(250);
+            std::error_code error;
+            triggered = std::filesystem::exists(trigger, error);
+            if (!triggered) return;
+        }
+    }
+    static unsigned captured = 0;
+    if (captured >= 256u)
+        return;
+    struct CodeHash {
+        const uint8_t *code = nullptr;
+        uint64_t generation = 0;
+        uint64_t hash = 0;
+    };
+    static std::array<CodeHash, 2> hashes;
+    auto &cached = hashes[unit];
+    if (cached.code != code || cached.generation != generation) {
+        cached = {code, generation, 14695981039346656037ull};
+        for (uint32_t i = 0; i < codeSize; ++i)
+            cached.hash = (cached.hash ^ code[i]) * 1099511628211ull;
+    }
+    static std::map<std::tuple<unsigned, uint32_t, uint64_t>, uint64_t> calls;
+    const uint64_t call = ++calls[{unit, state.pc, cached.hash}];
+    if ((call & (call - 1u)) != 0u)
+        return;
+    std::error_code error;
+    std::filesystem::create_directories(directory, error);
+    if (error) {
+        std::fprintf(stderr, "VU capture directory: %s\n", error.message().c_str());
+        captured = 256u;
+        return;
+    }
+    const std::string stem = std::string(directory) + "/vu" + std::to_string(unit) +
+        "-pc" + std::to_string(state.pc) + "-call" + std::to_string(call) +
+        "-code" + std::to_string(cached.hash);
+    VU1State initial = state;
+    initial.cycles = 0u;
+    const auto write = [&](const char *suffix, const void *bytes, size_t size) {
+        std::ofstream output(stem + suffix, std::ios::binary);
+        output.write(static_cast<const char *>(bytes), static_cast<std::streamsize>(size));
+        return static_cast<bool>(output);
+    };
+    if (!write(".code", code, codeSize) || !write(".data", data, dataSize) ||
+        !write(".state", &initial, sizeof(initial))) {
+        std::fprintf(stderr, "Unable to write VU capture %s\n", stem.c_str());
+        captured = 256u;
+        return;
+    }
+    ++captured;
+}
+
+}
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_capture.h b/ps2xRuntime/src/lib/vu/ps2_vu1_capture.h
new file mode 100644
index 000000000..d8cc6557c
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_capture.h
@@ -0,0 +1,10 @@
+#pragma once
+
+#include <cstdint>
+struct VU1State;
+
+namespace ps2_vu_detail {
+void captureProgramStart(const char *directory, unsigned unit,
+                         const uint8_t *code, uint32_t codeSize, uint64_t generation,
+                         const uint8_t *data, uint32_t dataSize, const VU1State &state);
+}
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
index 6c20fd04f..6cd262a5d 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
@@ -3,6 +3,7 @@
 #include "runtime/gs/gs_frontend.h"
 #include "runtime/ps2_memory.h"
 #include "ps2_vu1_detail.h"
+#include "ps2_vu1_capture.h"
 
 #include <algorithm>
 #include <bit>
@@ -22,57 +23,6 @@
 
 namespace
 {
-    void captureProgramStart(const char *directory, unsigned unit,
-                             const uint8_t *code, uint32_t codeSize, uint64_t generation,
-                             const uint8_t *data, uint32_t dataSize, const VU1State &state)
-    {
-        static std::mutex mutex;
-        const std::lock_guard lock(mutex);
-        static unsigned captured = 0;
-        if (captured >= 256u)
-            return;
-        struct CodeHash {
-            const uint8_t *code = nullptr;
-            uint64_t generation = 0;
-            uint64_t hash = 0;
-        };
-        static std::array<CodeHash, 2> hashes;
-        auto &cached = hashes[unit];
-        if (cached.code != code || cached.generation != generation) {
-            cached = {code, generation, 14695981039346656037ull};
-            for (uint32_t i = 0; i < codeSize; ++i)
-                cached.hash = (cached.hash ^ code[i]) * 1099511628211ull;
-        }
-        static std::map<std::tuple<unsigned, uint32_t, uint64_t>, uint64_t> calls;
-        const uint64_t call = ++calls[{unit, state.pc, cached.hash}];
-        if ((call & (call - 1u)) != 0u)
-            return;
-        std::error_code error;
-        std::filesystem::create_directories(directory, error);
-        if (error) {
-            std::fprintf(stderr, "VU capture directory: %s\n", error.message().c_str());
-            captured = 256u;
-            return;
-        }
-        const std::string stem = std::string(directory) + "/vu" + std::to_string(unit) +
-            "-pc" + std::to_string(state.pc) + "-call" + std::to_string(call) +
-            "-code" + std::to_string(cached.hash);
-        VU1State initial = state;
-        initial.cycles = 0u;
-        const auto write = [&](const char *suffix, const void *bytes, size_t size) {
-            std::ofstream output(stem + suffix, std::ios::binary);
-            output.write(static_cast<const char *>(bytes), static_cast<std::streamsize>(size));
-            return static_cast<bool>(output);
-        };
-        if (!write(".code", code, codeSize) || !write(".data", data, dataSize) ||
-            !write(".state", &initial, sizeof(initial))) {
-            std::fprintf(stderr, "Unable to write VU capture %s\n", stem.c_str());
-            captured = 256u;
-            return;
-        }
-        ++captured;
-    }
-
     void recordUncompiledBlock(const char *path, unsigned unit, const uint8_t *code)
     {
         static std::mutex mutex;
@@ -857,118 +807,6 @@ PS2_VU_FORCE_INLINE void VU1Interpreter::queueAccWrite(uint8_t laneMask, const f
     reportReservedInstruction(true, 0xFFFFFFF5u);
 }
 
-void VU1Interpreter::commitReadyPipelines()
-{
-    // The two slots in each bucket preserve issue order for simultaneous flags.
-    for (uint32_t active = m_activeFlags & pipelineCycleMask<kMaxFlagEntries>(m_cycle);
-         active != 0u; active &= active - 1u)
-    {
-        const unsigned index = std::countr_zero(active);
-        auto &entry = m_flagPipeline[index];
-        if (entry.readyCycle > m_cycle)
-            continue;
-
-        if (entry.writesMac)
-            m_state.mac = entry.mac;
-        if (entry.writesStatus)
-        {
-            const uint32_t current = entry.status & 0xFu;
-            m_state.status = (m_state.status & 0xFF0u) | current | ((current | entry.extraSticky) << 6);
-        }
-        if (entry.writesSticky)
-        {
-            m_state.status = (m_state.status & 0x03Fu) | (entry.status & 0xFC0u);
-        }
-        if (entry.writesClip)
-            m_state.clip = entry.clip;
-        m_activeFlags &= ~(1u << index);
-    }
-
-    if (m_fdiv.valid && m_fdiv.readyCycle <= m_cycle)
-    {
-        m_state.q = m_fdiv.value;
-        const uint32_t currentDi = m_fdiv.statusDi & 0x30u;
-        m_state.status = (m_state.status & 0xFCFu) | currentDi | (currentDi << 6);
-        m_fdiv = {};
-    }
-
-    for (ScalarPipelineEntry &entry : m_efu)
-    {
-        if (entry.valid && entry.readyCycle <= m_cycle)
-        {
-            m_state.p = entry.value;
-            entry = {};
-        }
-    }
-
-    for (uint32_t active = m_activeStores; active != 0u; active &= active - 1u)
-    {
-        const unsigned index = std::countr_zero(active);
-        auto &store = m_storePipeline[index];
-        if (store.readyCycle > m_cycle)
-            continue;
-        if (m_activeVuData && store.address + 16u <= m_activeVuDataSize)
-        {
-            uint32_t oldWords[4]{};
-            std::memcpy(oldWords, m_activeVuData + store.address, sizeof(oldWords));
-            for (uint32_t component = 0; component < 4u; ++component)
-            {
-                if ((store.laneMask & laneForComponent(component)) != 0u)
-                    oldWords[component] = store.words[component];
-            }
-            std::memcpy(m_activeVuData + store.address, oldWords, sizeof(oldWords));
-        }
-        m_activeStores &= ~(1u << index);
-    }
-
-    for (uint32_t active = m_activeVfWrites & pipelineCycleMask<kMaxPendingVfWrites>(m_cycle);
-         active != 0u; active &= active - 1u)
-    {
-        const unsigned index = std::countr_zero(active);
-        auto &write = m_vfWritePipeline[index];
-        if (write.readyCycle > m_cycle)
-            continue;
-        for (uint32_t component = 0; component < 4u; ++component)
-        {
-            if ((write.laneMask & laneForComponent(component)) != 0u &&
-                m_vfLatestWrite[write.reg][component] == write.sequence)
-            {
-                m_state.vf[write.reg][component] = write.value[component];
-            }
-        }
-        m_activeVfWrites &= ~(1u << index);
-    }
-
-    for (uint32_t active = m_activeViWrites & pipelineCycleMask<kMaxPendingViWrites>(m_cycle);
-         active != 0u; active &= active - 1u)
-    {
-        const unsigned index = std::countr_zero(active);
-        auto &write = m_viWritePipeline[index];
-        if (write.readyCycle > m_cycle)
-            continue;
-        if (m_viLatestWrite[write.reg] == write.sequence)
-            m_state.vi[write.reg] = static_cast<int16_t>(write.value);
-        m_activeViWrites &= ~(1u << index);
-    }
-
-    for (uint32_t active = m_activeAccWrites; active != 0u; active &= active - 1u)
-    {
-        const unsigned index = std::countr_zero(active);
-        auto &write = m_accWritePipeline[index];
-        if (write.readyCycle > m_cycle)
-            continue;
-        for (uint32_t component = 0; component < 4u; ++component)
-        {
-            if ((write.laneMask & laneForComponent(component)) != 0u &&
-                m_accLatestWrite[component] == write.sequence)
-            {
-                m_state.acc[component] = write.value[component];
-            }
-        }
-        m_activeAccWrites &= ~(1u << index);
-    }
-}
-
 void VU1Interpreter::progressXgkick()
 {
     if (!m_xgkick.active || !m_activeVuData || m_activeVuDataSize == 0u)
@@ -1671,23 +1509,6 @@ VU1Interpreter::DecodedInstructionPair VU1Interpreter::decodeInstructionPair(con
     return decodeInstructionWords(lower, upper, m_unit);
 }
 
-void VU1Interpreter::rebuildDecodedCodeCache(const uint8_t *vuCode, uint32_t codeSize,
-                                             const PS2Memory *memory, uint64_t generation)
-{
-    const uint32_t pairCount = std::min<uint32_t>(codeSize / 8u, kMaxDecodedPairs);
-    for (uint32_t i = 0; i < pairCount; ++i)
-    {
-        m_decodedCodeCache[i] = decodeInstructionPair(vuCode, i * 8u);
-        m_compiledCodeCache[i] = findCompiledBlock(vuCode + i * 8u, codeSize - i * 8u, m_unit);
-    }
-
-    m_cachedVuCode = vuCode;
-    m_cachedMemory = memory;
-    m_cachedCodeSize = codeSize;
-    m_cachedCodeGeneration = generation;
-    m_decodedCodeCacheValid = true;
-}
-
 VU1Interpreter::DecodedInstructionPair VU1Interpreter::getDecodedInstructionPairForPc(
     const uint8_t *vuCode, uint32_t codeSize, PS2Memory *memory, uint32_t pc)
 {
@@ -1753,7 +1574,7 @@ void VU1Interpreter::execute(uint8_t *vuCode, uint32_t codeSize,
         // execute() has an empty pipeline; resumed states need a fuller snapshot.
         const uint64_t generation = m_unit == Unit::VU1
             ? memory->getVU1CodeGeneration() : memory->getVU0CodeGeneration();
-        captureProgramStart(captureDirectory, m_unit == Unit::VU1 ? 1u : 0u,
+        ps2_vu_detail::captureProgramStart(captureDirectory, m_unit == Unit::VU1 ? 1u : 0u,
                             vuCode, codeSize, generation, vuData, dataSize, m_state);
     }
     run(vuCode, codeSize, vuData, dataSize, gs, memory, maxCycles);
@@ -1768,6 +1589,13 @@ void VU1Interpreter::resume(uint8_t *vuCode, uint32_t codeSize,
     m_state.itop = itop;
     m_state.stoppedByD = false;
     m_state.stoppedByT = false;
+    static const char *captureDirectory = std::getenv("PS2_VU_CAPTURE_DIR");
+    // A drained continuation has no hidden writes or branch forwarding to serialize.
+    if (captureDirectory && *captureDirectory && memory && !pipelinesPending() &&
+        !m_viBranchBackupValid && !m_state.branchPending && !m_stopRequested)
+        ps2_vu_detail::captureProgramStart(captureDirectory, m_unit == Unit::VU1 ? 1u : 0u,
+            vuCode, codeSize, m_unit == Unit::VU1 ? memory->getVU1CodeGeneration() : memory->getVU0CodeGeneration(),
+            vuData, dataSize, m_state);
     run(vuCode, codeSize, vuData, dataSize, gs, memory, maxCycles);
 }
 
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_pipeline.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_pipeline.cpp
new file mode 100644
index 000000000..edd439167
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_pipeline.cpp
@@ -0,0 +1,142 @@
+#include "runtime/ps2_vu1.h"
+
+#include <bit>
+#include <cstring>
+#if defined(__aarch64__)
+#include <arm_neon.h>
+#endif
+
+namespace {
+constexpr uint8_t laneForComponent(uint32_t component) {
+    return static_cast<uint8_t>(1u << (3u - component));
+}
+template <size_t Size>
+uint32_t pipelineCycleMask(uint64_t cycle) {
+    static_assert(Size >= 8u && (Size & (Size - 1u)) == 0u);
+    return 3u << (2u * (cycle & (Size / 2u - 1u)));
+}
+}
+
+void VU1Interpreter::commitReadyPipelines()
+{
+    // The two slots in each bucket preserve issue order for simultaneous flags.
+    for (uint32_t active = m_activeFlags & pipelineCycleMask<kMaxFlagEntries>(m_cycle);
+         active != 0u; active &= active - 1u)
+    {
+        const unsigned index = std::countr_zero(active);
+        auto &entry = m_flagPipeline[index];
+        if (entry.readyCycle > m_cycle)
+            continue;
+
+        if (entry.writesMac)
+            m_state.mac = entry.mac;
+        if (entry.writesStatus)
+        {
+            const uint32_t current = entry.status & 0xFu;
+            m_state.status = (m_state.status & 0xFF0u) | current | ((current | entry.extraSticky) << 6);
+        }
+        if (entry.writesSticky)
+        {
+            m_state.status = (m_state.status & 0x03Fu) | (entry.status & 0xFC0u);
+        }
+        if (entry.writesClip)
+            m_state.clip = entry.clip;
+        m_activeFlags &= ~(1u << index);
+    }
+
+    if (m_fdiv.valid && m_fdiv.readyCycle <= m_cycle)
+    {
+        m_state.q = m_fdiv.value;
+        const uint32_t currentDi = m_fdiv.statusDi & 0x30u;
+        m_state.status = (m_state.status & 0xFCFu) | currentDi | (currentDi << 6);
+        m_fdiv = {};
+    }
+
+    for (ScalarPipelineEntry &entry : m_efu)
+    {
+        if (entry.valid && entry.readyCycle <= m_cycle)
+        {
+            m_state.p = entry.value;
+            entry = {};
+        }
+    }
+
+    for (uint32_t active = m_activeStores; active != 0u; active &= active - 1u)
+    {
+        const unsigned index = std::countr_zero(active);
+        auto &store = m_storePipeline[index];
+        if (store.readyCycle > m_cycle)
+            continue;
+        if (m_activeVuData && store.address + 16u <= m_activeVuDataSize)
+        {
+            uint32_t oldWords[4]{};
+            std::memcpy(oldWords, m_activeVuData + store.address, sizeof(oldWords));
+            for (uint32_t component = 0; component < 4u; ++component)
+            {
+                if ((store.laneMask & laneForComponent(component)) != 0u)
+                    oldWords[component] = store.words[component];
+            }
+            std::memcpy(m_activeVuData + store.address, oldWords, sizeof(oldWords));
+        }
+        m_activeStores &= ~(1u << index);
+    }
+
+    for (uint32_t active = m_activeVfWrites & pipelineCycleMask<kMaxPendingVfWrites>(m_cycle);
+         active != 0u; active &= active - 1u)
+    {
+        const unsigned index = std::countr_zero(active);
+        auto &write = m_vfWritePipeline[index];
+        if (write.readyCycle > m_cycle)
+            continue;
+#if defined(__aarch64__)
+        const auto sequence = vdupq_n_u64(write.sequence);
+        const auto *latest = m_vfLatestWrite[write.reg].data();
+        const auto matches = vcombine_u32(vmovn_u64(vceqq_u64(vld1q_u64(latest), sequence)),
+                                         vmovn_u64(vceqq_u64(vld1q_u64(latest + 2), sequence)));
+        const uint32x4_t laneBits = {8u, 4u, 2u, 1u};
+        const auto lanes = vtstq_u32(vdupq_n_u32(write.laneMask), laneBits);
+        const auto mask = vandq_u32(matches, lanes);
+        vst1q_f32(m_state.vf[write.reg], vbslq_f32(mask, vld1q_f32(write.value.data()),
+                                                vld1q_f32(m_state.vf[write.reg])));
+#else
+        for (uint32_t component = 0; component < 4u; ++component)
+        {
+            if ((write.laneMask & laneForComponent(component)) != 0u &&
+                m_vfLatestWrite[write.reg][component] == write.sequence)
+            {
+                m_state.vf[write.reg][component] = write.value[component];
+            }
+        }
+#endif
+        m_activeVfWrites &= ~(1u << index);
+    }
+
+    for (uint32_t active = m_activeViWrites & pipelineCycleMask<kMaxPendingViWrites>(m_cycle);
+         active != 0u; active &= active - 1u)
+    {
+        const unsigned index = std::countr_zero(active);
+        auto &write = m_viWritePipeline[index];
+        if (write.readyCycle > m_cycle)
+            continue;
+        if (m_viLatestWrite[write.reg] == write.sequence)
+            m_state.vi[write.reg] = static_cast<int16_t>(write.value);
+        m_activeViWrites &= ~(1u << index);
+    }
+
+    for (uint32_t active = m_activeAccWrites; active != 0u; active &= active - 1u)
+    {
+        const unsigned index = std::countr_zero(active);
+        auto &write = m_accWritePipeline[index];
+        if (write.readyCycle > m_cycle)
+            continue;
+        for (uint32_t component = 0; component < 4u; ++component)
+        {
+            if ((write.laneMask & laneForComponent(component)) != 0u &&
+                m_accLatestWrite[component] == write.sequence)
+            {
+                m_state.acc[component] = write.value[component];
+            }
+        }
+        m_activeAccWrites &= ~(1u << index);
+    }
+}

From f1e71ef6bcd669b00ed7de940934e153ef6dc0d7 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 09:46:07 +0200
Subject: [PATCH 43/68] Read the R5900 SQRT source from the ft field

SQRT.S uses bits20:16, unlike ABS/MOV/NEG. Wrong source selection made a native DQ8 offscreen visibility check accept distant effects and emit wrapped additive fans.

The new codegen regression fails before the fix and all57 tests pass afterward. A harness of old and regenerated guest functions corrects five rejected-point cases while preserving four accepted boundary/control cases. The rebuilt SDL GPU close-up has normal lighting.
---
 ps2xRecomp/src/lib/fpu_translator.cpp |  3 ++-
 ps2xTest/src/code_generator_tests.cpp | 23 +++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/ps2xRecomp/src/lib/fpu_translator.cpp b/ps2xRecomp/src/lib/fpu_translator.cpp
index 944cee796..9bf49d49f 100644
--- a/ps2xRecomp/src/lib/fpu_translator.cpp
+++ b/ps2xRecomp/src/lib/fpu_translator.cpp
@@ -58,7 +58,8 @@ namespace ps2recomp
                                    "else ctx->f[{}] = ctx->f[{}] / ctx->f[{}];",
                                    ft, fd, fs, fd, fs, ft);
             case COP1_S_SQRT:
-                return fmt::format("ctx->f[{}] = FPU_SQRT_S(ctx->f[{}]);", fd, fs);
+                // R5900 SQRT.S uses ft, unlike ABS.S/MOV.S/NEG.S.
+                return fmt::format("ctx->f[{}] = FPU_SQRT_S(ctx->f[{}]);", fd, ft);
             case COP1_S_ABS:
                 return fmt::format("ctx->f[{}] = FPU_ABS_S(ctx->f[{}]);", fd, fs);
             case COP1_S_MOV:
diff --git a/ps2xTest/src/code_generator_tests.cpp b/ps2xTest/src/code_generator_tests.cpp
index c8d496828..ae256b64a 100644
--- a/ps2xTest/src/code_generator_tests.cpp
+++ b/ps2xTest/src/code_generator_tests.cpp
@@ -2,6 +2,7 @@
 #include "ps2recomp/code_generator.h"
 #include "ps2recomp/instructions.h"
 #include "ps2recomp/ps2_recompiler.h"
+#include "ps2recomp/r5900_decoder.h"
 #include "ps2recomp/types.h"
 #include <filesystem>
 #include <fstream>
@@ -168,6 +169,28 @@ void register_code_generator_tests()
 {
     MiniTest::Case("CodeGenerator", [](TestCase &tc)
                    {
+    tc.Run("R5900 SQRT.S reads ft while other unary operations read fs", [](TestCase &t) {
+        CodeGenerator gen({}, {});
+        R5900Decoder decoder;
+        for (unsigned source = 0; source < 32; ++source) {
+            for (unsigned destination = 0; destination < 32; ++destination) {
+                const uint32_t raw = (OPCODE_COP1 << 26) | (COP1_S << 21) |
+                                     (source << 16) | (destination << 6) | COP1_S_SQRT;
+                const auto inst = decoder.decodeInstruction(0x1000, raw);
+                const auto generated = gen.translateInstruction(inst);
+                const std::string expected = "ctx->f[" + std::to_string(destination) +
+                    "] = FPU_SQRT_S(ctx->f[" + std::to_string(source) + "]);";
+                t.IsTrue(generated.find(expected) != std::string::npos,
+                         "SQRT.S operand comes from instruction bits 20:16");
+            }
+        }
+        const uint32_t rawAbs = (OPCODE_COP1 << 26) | (COP1_S << 21) |
+                                (7u << 11) | (3u << 6) | COP1_S_ABS;
+        const auto absolute = gen.translateInstruction(decoder.decodeInstruction(0x1000, rawAbs));
+        t.IsTrue(absolute.find("ctx->f[3] = FPU_ABS_S(ctx->f[7]);") != std::string::npos,
+                 "ABS.S keeps its different fs operand encoding");
+    });
+
     tc.Run("SYSCALL publishes its continuation before entering the runtime", [](TestCase &t) {
         Function func;
         func.name = "syscall_resume";

From 221b064f76f0444fc9bca0d1dd058e26215d7d95 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 10:19:17 +0200
Subject: [PATCH 44/68] fix(runtime): observe the published VSync tick
 atomically

---
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index 0c4d54d8a..19e609472 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -1493,7 +1493,9 @@ void EeScheduler::setVSyncFlag(uint32_t flagAddress, uint32_t tickAddress)
 
 uint64_t EeScheduler::currentVSyncTick() const noexcept
 {
-    return m_vsyncTick;
+    // The host presenter also observes this clock. m_vsyncTick belongs to the
+    // executor; VBlankStart publishes the same value through the GS atomic.
+    return m_runtime.memory().gs().vsyncTick.load(std::memory_order_acquire);
 }
 
 uint32_t EeScheduler::setGsVSyncCallback(uint32_t callback, uint32_t gp, uint32_t sp)

From 4b69ccf04e69b7cfd0c4ab4843878a6feff7ed53 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 10:19:27 +0200
Subject: [PATCH 45/68] feat(runtime): add an optional filtered guest return
 observer

---
 ps2xRuntime/src/lib/ps2_runtime.cpp          | 23 +++++++++
 ps2xTest/src/ps2_runtime_interrupt_tests.cpp | 54 ++++++++++++++++++++
 2 files changed, 77 insertions(+)

diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index 0b5deaffe..0e91ed7a1 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -34,6 +34,21 @@ namespace ps2_stubs
     void resetSifState();
 }
 
+// Optional executor-thread diagnostic. Configure before starting guest execution;
+// keeping this declaration source-local avoids rebuilding the generated corpus.
+using Ps2GuestReturnObserver = void (*)(uint8_t *, const R5900Context *, PS2Runtime *);
+static uint32_t s_observedReturnSource = 0u;
+static uint32_t s_observedReturnTarget = 0u;
+static Ps2GuestReturnObserver s_guestReturnObserver = nullptr;
+
+void ps2SetGuestReturnObserver(uint32_t sourcePc, uint32_t targetPc,
+                              Ps2GuestReturnObserver observer) noexcept
+{
+    s_observedReturnSource = sourcePc;
+    s_observedReturnTarget = targetPc;
+    s_guestReturnObserver = observer;
+}
+
 #define ELF_MAGIC 0x464C457F // "\x7FELF" in little endian
 #define ET_EXEC 2            // Executable file
 #define EM_MIPS 8            // MIPS architecture
@@ -1414,6 +1429,14 @@ bool PS2Runtime::dispatchGuestBranch(uint8_t *rdram,
     ctx->pc = targetPc;
     const bool isCall = (kind == GuestBranchKind::DirectCall || kind == GuestBranchKind::IndirectCall);
 
+    if (sourcePc == s_observedReturnSource && targetPc == s_observedReturnTarget &&
+        kind == GuestBranchKind::Return && s_guestReturnObserver != nullptr)
+    {
+        // The generated JR has executed, including its delay slot. Observe it
+        // before a safe-point yield can transfer control to the continuation.
+        s_guestReturnObserver(rdram, ctx, this);
+    }
+
     // Every inter-function transfer is also a deterministic EE safe point.
     // Backward edges inside generated functions use eeCheckpointDue(), while
     // this charge bounds straight-line call chains that have no local loop.
diff --git a/ps2xTest/src/ps2_runtime_interrupt_tests.cpp b/ps2xTest/src/ps2_runtime_interrupt_tests.cpp
index dcbb51fd9..04964c87f 100644
--- a/ps2xTest/src/ps2_runtime_interrupt_tests.cpp
+++ b/ps2xTest/src/ps2_runtime_interrupt_tests.cpp
@@ -13,6 +13,10 @@
 
 using namespace ps2_syscalls;
 
+void ps2SetGuestReturnObserver(
+    uint32_t sourcePc, uint32_t targetPc,
+    void (*observer)(uint8_t *, const R5900Context *, PS2Runtime *)) noexcept;
+
 namespace
 {
     constexpr int KE_OK = 0;
@@ -46,6 +50,19 @@ namespace
     };
 
     std::atomic<uint32_t> g_lastIntcArg{0u};
+    uint32_t g_observedReturns = 0u;
+    uint32_t g_observedContinuations = 0u;
+
+    void observeGuestReturn(uint8_t *, const R5900Context *, PS2Runtime *)
+    {
+        ++g_observedReturns;
+    }
+
+    void observedContinuation(uint8_t *, R5900Context *, PS2Runtime *)
+    {
+        ++g_observedContinuations;
+    }
+
     constexpr uint32_t kIdleVSyncWaitPc = 0x00160000u;
     constexpr uint32_t kVSyncWaitPc = 0x00160100u;
     constexpr uint32_t kVSyncResumePc = 0x00160110u;
@@ -315,6 +332,43 @@ void register_ps2_runtime_interrupt_tests()
 {
     MiniTest::Case("PS2RuntimeInterrupt", [](TestCase &tc)
     {
+        tc.Run("filtered return observer counts a yielding return once", [](TestCase &t)
+        {
+            TestEnv env;
+            env.runtime.memory().initialize();
+            constexpr uint32_t source = 0x180000u;
+            constexpr uint32_t target = 0x180100u;
+            env.runtime.registerFunction(target, observedContinuation);
+            env.runtime.registerFunction(target + 4u, observedContinuation);
+            R5900Context ctx{};
+            g_observedReturns = g_observedContinuations = 0u;
+            ps2SetGuestReturnObserver(source, target, observeGuestReturn);
+            const auto branch = [&](uint32_t from, uint32_t to, PS2Runtime::GuestBranchKind kind)
+            {
+                return env.runtime.dispatchGuestBranch(env.rdram.data(), &ctx, to, from, 0u, kind, "test");
+            };
+
+            branch(source + 4u, target, PS2Runtime::GuestBranchKind::Return);
+            branch(source, target + 4u, PS2Runtime::GuestBranchKind::Return);
+            branch(source, target, PS2Runtime::GuestBranchKind::DirectJump);
+            t.Equals(g_observedReturns, 0u, "source, target and return kind must all match");
+            branch(source, target, PS2Runtime::GuestBranchKind::Return);
+            t.Equals(g_observedReturns, 1u, "matching return must be observed");
+
+            env.runtime.eeScheduler().postEvent(EeEvent{EeEventType::ExternalWake, 1u, 0u});
+            t.IsFalse(branch(source, target, PS2Runtime::GuestBranchKind::Return),
+                      "pending checkpoint should yield to the continuation");
+            t.Equals(ctx.pc, target, "yield must preserve the return destination");
+            t.Equals(g_observedReturns, 2u, "return must be counted before the checkpoint yields");
+            env.runtime.lookupFunction(target)(env.rdram.data(), &ctx, &env.runtime);
+            t.Equals(g_observedContinuations, 1u, "continuation should execute once");
+            t.Equals(g_observedReturns, 2u, "resuming the continuation must not count the return again");
+
+            ps2SetGuestReturnObserver(0u, 0u, nullptr);
+            branch(source, target, PS2Runtime::GuestBranchKind::Return);
+            t.Equals(g_observedReturns, 2u, "disabled observer must not run");
+        });
+
         tc.Run("negative interrupt-safe EE syscall ids dispatch", [](TestCase &t)
         {
             TestEnv env;

From d97b7cc5cd62ff751c9aac1a56b9c3578759bde3 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 10:37:04 +0200
Subject: [PATCH 46/68] Revert "feat(runtime): add an optional filtered guest
 return observer"

This reverts commit 4b69ccf04e69b7cfd0c4ab4843878a6feff7ed53.
---
 ps2xRuntime/src/lib/ps2_runtime.cpp          | 23 ---------
 ps2xTest/src/ps2_runtime_interrupt_tests.cpp | 54 --------------------
 2 files changed, 77 deletions(-)

diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index 0e91ed7a1..0b5deaffe 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -34,21 +34,6 @@ namespace ps2_stubs
     void resetSifState();
 }
 
-// Optional executor-thread diagnostic. Configure before starting guest execution;
-// keeping this declaration source-local avoids rebuilding the generated corpus.
-using Ps2GuestReturnObserver = void (*)(uint8_t *, const R5900Context *, PS2Runtime *);
-static uint32_t s_observedReturnSource = 0u;
-static uint32_t s_observedReturnTarget = 0u;
-static Ps2GuestReturnObserver s_guestReturnObserver = nullptr;
-
-void ps2SetGuestReturnObserver(uint32_t sourcePc, uint32_t targetPc,
-                              Ps2GuestReturnObserver observer) noexcept
-{
-    s_observedReturnSource = sourcePc;
-    s_observedReturnTarget = targetPc;
-    s_guestReturnObserver = observer;
-}
-
 #define ELF_MAGIC 0x464C457F // "\x7FELF" in little endian
 #define ET_EXEC 2            // Executable file
 #define EM_MIPS 8            // MIPS architecture
@@ -1429,14 +1414,6 @@ bool PS2Runtime::dispatchGuestBranch(uint8_t *rdram,
     ctx->pc = targetPc;
     const bool isCall = (kind == GuestBranchKind::DirectCall || kind == GuestBranchKind::IndirectCall);
 
-    if (sourcePc == s_observedReturnSource && targetPc == s_observedReturnTarget &&
-        kind == GuestBranchKind::Return && s_guestReturnObserver != nullptr)
-    {
-        // The generated JR has executed, including its delay slot. Observe it
-        // before a safe-point yield can transfer control to the continuation.
-        s_guestReturnObserver(rdram, ctx, this);
-    }
-
     // Every inter-function transfer is also a deterministic EE safe point.
     // Backward edges inside generated functions use eeCheckpointDue(), while
     // this charge bounds straight-line call chains that have no local loop.
diff --git a/ps2xTest/src/ps2_runtime_interrupt_tests.cpp b/ps2xTest/src/ps2_runtime_interrupt_tests.cpp
index 04964c87f..dcbb51fd9 100644
--- a/ps2xTest/src/ps2_runtime_interrupt_tests.cpp
+++ b/ps2xTest/src/ps2_runtime_interrupt_tests.cpp
@@ -13,10 +13,6 @@
 
 using namespace ps2_syscalls;
 
-void ps2SetGuestReturnObserver(
-    uint32_t sourcePc, uint32_t targetPc,
-    void (*observer)(uint8_t *, const R5900Context *, PS2Runtime *)) noexcept;
-
 namespace
 {
     constexpr int KE_OK = 0;
@@ -50,19 +46,6 @@ namespace
     };
 
     std::atomic<uint32_t> g_lastIntcArg{0u};
-    uint32_t g_observedReturns = 0u;
-    uint32_t g_observedContinuations = 0u;
-
-    void observeGuestReturn(uint8_t *, const R5900Context *, PS2Runtime *)
-    {
-        ++g_observedReturns;
-    }
-
-    void observedContinuation(uint8_t *, R5900Context *, PS2Runtime *)
-    {
-        ++g_observedContinuations;
-    }
-
     constexpr uint32_t kIdleVSyncWaitPc = 0x00160000u;
     constexpr uint32_t kVSyncWaitPc = 0x00160100u;
     constexpr uint32_t kVSyncResumePc = 0x00160110u;
@@ -332,43 +315,6 @@ void register_ps2_runtime_interrupt_tests()
 {
     MiniTest::Case("PS2RuntimeInterrupt", [](TestCase &tc)
     {
-        tc.Run("filtered return observer counts a yielding return once", [](TestCase &t)
-        {
-            TestEnv env;
-            env.runtime.memory().initialize();
-            constexpr uint32_t source = 0x180000u;
-            constexpr uint32_t target = 0x180100u;
-            env.runtime.registerFunction(target, observedContinuation);
-            env.runtime.registerFunction(target + 4u, observedContinuation);
-            R5900Context ctx{};
-            g_observedReturns = g_observedContinuations = 0u;
-            ps2SetGuestReturnObserver(source, target, observeGuestReturn);
-            const auto branch = [&](uint32_t from, uint32_t to, PS2Runtime::GuestBranchKind kind)
-            {
-                return env.runtime.dispatchGuestBranch(env.rdram.data(), &ctx, to, from, 0u, kind, "test");
-            };
-
-            branch(source + 4u, target, PS2Runtime::GuestBranchKind::Return);
-            branch(source, target + 4u, PS2Runtime::GuestBranchKind::Return);
-            branch(source, target, PS2Runtime::GuestBranchKind::DirectJump);
-            t.Equals(g_observedReturns, 0u, "source, target and return kind must all match");
-            branch(source, target, PS2Runtime::GuestBranchKind::Return);
-            t.Equals(g_observedReturns, 1u, "matching return must be observed");
-
-            env.runtime.eeScheduler().postEvent(EeEvent{EeEventType::ExternalWake, 1u, 0u});
-            t.IsFalse(branch(source, target, PS2Runtime::GuestBranchKind::Return),
-                      "pending checkpoint should yield to the continuation");
-            t.Equals(ctx.pc, target, "yield must preserve the return destination");
-            t.Equals(g_observedReturns, 2u, "return must be counted before the checkpoint yields");
-            env.runtime.lookupFunction(target)(env.rdram.data(), &ctx, &env.runtime);
-            t.Equals(g_observedContinuations, 1u, "continuation should execute once");
-            t.Equals(g_observedReturns, 2u, "resuming the continuation must not count the return again");
-
-            ps2SetGuestReturnObserver(0u, 0u, nullptr);
-            branch(source, target, PS2Runtime::GuestBranchKind::Return);
-            t.Equals(g_observedReturns, 2u, "disabled observer must not run");
-        });
-
         tc.Run("negative interrupt-safe EE syscall ids dispatch", [](TestCase &t)
         {
             TestEnv env;

From b24ccbf77ef6e74dde713078ff923ec81a5e8fda Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 11:08:32 +0200
Subject: [PATCH 47/68] Specialize VU dependencies and vector arithmetic in
 parallel build units

Expose constant upper and lower register usage independently so native blocks fold readiness loops. Use guarded ARM64 fused vector product-sum arithmetic while retaining the scalar interpreter oracle and exact exceptional fallback. Emit deterministic external instantiations across private compilation units to shorten native rebuilds.

Verified 49 VU tests, 268 captured signatures and 788108 resumed raw-byte boundaries, plus 4112 perturbed field states. Paired heavy replays save 27-35 percent with readiness specialization beyond the SIMD stage. Seven integrated runtime suites and the generator coverage test pass. Guest cycles, callbacks and code invalidation are unchanged.
---
 ps2xRuntime/CMakeLists.txt                 |   26 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp    | 1519 +------------------
 ps2xRuntime/src/lib/vu/ps2_vu1_detail.h    |   26 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl    | 1539 ++++++++++++++++++++
 ps2xRuntime/src/lib/vu/ps2_vu1_fmac.h      |   30 +
 ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h |   78 +
 ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp   |  791 +---------
 ps2xRuntime/src/lib/vu/ps2_vu1_lower.inl   |  795 ++++++++++
 ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp   |  507 +------
 ps2xRuntime/src/lib/vu/ps2_vu1_upper.inl   |  547 +++++++
 ps2xTest/src/ps2_vu1_tests.cpp             |  204 +++
 tools/compile_vu_blocks.py                 |   17 +-
 tools/tests/test_compile_vu_blocks.py      |   56 +
 13 files changed, 3306 insertions(+), 2829 deletions(-)
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_fmac.h
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_lower.inl
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_upper.inl
 create mode 100644 tools/tests/test_compile_vu_blocks.py

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index cf4916030..b658486d3 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -408,24 +408,42 @@ set_source_files_properties(
 set(PS2X_VU_AOT_IMAGES "" CACHE STRING "Local VU code images or block profiles to compile; never distributed")
 set(PS2X_VU_AOT_PAIR_IMAGES "" CACHE STRING "Additional local VU inputs to compile as reusable individual pairs")
 option(PS2X_VU_AOT_DEBUG_INFO "Include expanded VU AOT debug scopes (slow to compile)" OFF)
+set(PS2X_VU_AOT_SHARDS "8" CACHE STRING "Number of independent VU AOT compilation units")
 if(PS2X_VU_AOT_IMAGES OR PS2X_VU_AOT_PAIR_IMAGES)
     find_package(Python3 COMPONENTS Interpreter REQUIRED)
+    if(NOT PS2X_VU_AOT_SHARDS MATCHES "^[1-9][0-9]*$")
+        message(FATAL_ERROR "PS2X_VU_AOT_SHARDS must be a positive integer")
+    endif()
     set(PS2X_VU_AOT_INCLUDE "${CMAKE_CURRENT_BINARY_DIR}/generated/vu_aot_blocks.inc")
+    set(PS2X_VU_AOT_EXTERN_INCLUDE "${CMAKE_CURRENT_BINARY_DIR}/generated/vu_aot_blocks_extern.inc")
+    set(PS2X_VU_AOT_SOURCES)
+    math(EXPR PS2X_VU_AOT_LAST_SHARD "${PS2X_VU_AOT_SHARDS} - 1")
+    foreach(SHARD RANGE ${PS2X_VU_AOT_LAST_SHARD})
+        list(APPEND PS2X_VU_AOT_SOURCES "${CMAKE_CURRENT_BINARY_DIR}/generated/vu_aot_blocks_${SHARD}.cpp")
+    endforeach()
     add_custom_command(
-        OUTPUT "${PS2X_VU_AOT_INCLUDE}"
+        OUTPUT "${PS2X_VU_AOT_INCLUDE}" "${PS2X_VU_AOT_EXTERN_INCLUDE}" ${PS2X_VU_AOT_SOURCES}
         COMMAND "${Python3_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_blocks.py"
-                --output "${PS2X_VU_AOT_INCLUDE}" --pair-images ${PS2X_VU_AOT_PAIR_IMAGES}
+                --output "${PS2X_VU_AOT_INCLUDE}" --shards ${PS2X_VU_AOT_SHARDS}
+                --pair-images ${PS2X_VU_AOT_PAIR_IMAGES}
                 -- ${PS2X_VU_AOT_IMAGES}
         DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_blocks.py"
                 ${PS2X_VU_AOT_IMAGES} ${PS2X_VU_AOT_PAIR_IMAGES}
         VERBATIM)
-    add_custom_target(ps2_vu_aot DEPENDS "${PS2X_VU_AOT_INCLUDE}")
+    add_custom_target(ps2_vu_aot DEPENDS "${PS2X_VU_AOT_INCLUDE}" "${PS2X_VU_AOT_EXTERN_INCLUDE}" ${PS2X_VU_AOT_SOURCES})
     add_dependencies(ps2_runtime ps2_vu_aot)
-    target_compile_definitions(ps2_runtime PRIVATE PS2X_VU_AOT_INCLUDE="${PS2X_VU_AOT_INCLUDE}")
+    target_sources(ps2_runtime PRIVATE ${PS2X_VU_AOT_SOURCES})
+    target_compile_definitions(ps2_runtime PRIVATE
+        PS2X_VU_AOT_INCLUDE="${PS2X_VU_AOT_INCLUDE}"
+        PS2X_VU_AOT_EXTERN_INCLUDE="${PS2X_VU_AOT_EXTERN_INCLUDE}")
+    set_source_files_properties(${PS2X_VU_AOT_SOURCES} PROPERTIES
+        SKIP_UNITY_BUILD_INCLUSION ON
+        INCLUDE_DIRECTORIES "${CMAKE_CURRENT_SOURCE_DIR}/src/lib/vu")
     # Thousands of specialized inline scopes otherwise dominate compile time.
     if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU" AND NOT PS2X_VU_AOT_DEBUG_INFO)
         set_source_files_properties(
             "${CMAKE_CURRENT_BINARY_DIR}/CMakeFiles/ps2_runtime.dir/Unity/unity_vu1_cxx.cxx"
+            ${PS2X_VU_AOT_SOURCES}
             PROPERTIES COMPILE_OPTIONS "-g0")
     endif()
 endif()
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
index 6cd262a5d..abc50edbb 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
@@ -1,3 +1,4 @@
+#include "ps2_vu1_exec.inl"
 #include "runtime/ps2_vu1.h"
 #include "runtime/gs/ps2_gif_arbiter.h"
 #include "runtime/gs/gs_frontend.h"
@@ -44,78 +45,6 @@ namespace
         output.flush();
     }
 
-    constexpr uint8_t laneForComponent(uint32_t component)
-    {
-        return static_cast<uint8_t>(1u << (3u - component));
-    }
-
-    template <typename Entry, size_t Size>
-    Entry *allocatePipelineEntry(std::array<Entry, Size> &entries, uint32_t &active)
-    {
-        static_assert(Size < 32u);
-        const uint32_t available = ~active & ((1u << Size) - 1u);
-        if (available == 0u)
-            return nullptr;
-        const unsigned index = std::countr_zero(available);
-        active |= 1u << index;
-        return &entries[index];
-    }
-
-    template <size_t Size>
-    uint32_t pipelineCycleMask(uint64_t cycle)
-    {
-        static_assert(Size >= 8u && (Size & (Size - 1u)) == 0u);
-        return 3u << (2u * (cycle & (Size / 2u - 1u)));
-    }
-
-    template <typename Entry, size_t Size>
-    Entry *allocateScheduledEntry(std::array<Entry, Size> &entries,
-                                  uint32_t &active, uint64_t readyCycle)
-    {
-        // A pair issues at most two writes for any of these result cycles.
-        const uint32_t available = ~active & pipelineCycleMask<Size>(readyCycle);
-        if (available == 0u)
-            return nullptr;
-        const unsigned index = std::countr_zero(available);
-        active |= 1u << index;
-        return &entries[index];
-    }
-}
-
-constexpr void VU1Interpreter::addVfRead(InstructionUsage &usage, uint8_t reg, uint8_t lanes)
-{
-    if (lanes == 0u)
-        return;
-    for (uint32_t index = 0; index < usage.vfReadCount; ++index)
-    {
-        if (usage.vfRead[index].reg == reg)
-        {
-            usage.vfRead[index].lanes |= lanes;
-            return;
-        }
-    }
-    if (usage.vfReadCount < usage.vfRead.size())
-        usage.vfRead[usage.vfReadCount++] = {reg, lanes};
-}
-
-constexpr void VU1Interpreter::addVfWrite(InstructionUsage &usage, uint8_t reg, uint8_t lanes)
-{
-    if (reg == 0u || lanes == 0u)
-        return;
-    if (usage.vfWrite.reg == 0u)
-        usage.vfWrite = {reg, lanes};
-    else if (usage.vfWrite.reg == reg)
-        usage.vfWrite.lanes |= lanes;
-}
-
-constexpr uint8_t VU1Interpreter::vfReadLanes(const InstructionUsage &usage, uint8_t reg)
-{
-    for (uint32_t index = 0; index < usage.vfReadCount; ++index)
-    {
-        if (usage.vfRead[index].reg == reg)
-            return usage.vfRead[index].lanes;
-    }
-    return 0u;
 }
 
 VU1Interpreter::VU1Interpreter(Unit unit)
@@ -164,649 +93,6 @@ void VU1Interpreter::reset()
     resetScheduler();
 }
 
-float VU1Interpreter::broadcast(const float *vf, uint8_t bc)
-{
-    return normalizeOperand(vf[bc & 3u]);
-}
-
-float VU1Interpreter::normalizeOperand(float value) const
-{
-    uint32_t bits = 0;
-    std::memcpy(&bits, &value, sizeof(bits));
-    const uint32_t exponent = (bits >> 23) & 0xFFu;
-    if (exponent == 0u)
-    {
-        bits &= 0x80000000u;
-    }
-    else if (exponent == 0xFFu)
-    {
-        bits = (bits & 0x80000000u) | 0x7F7FFFFFu;
-    }
-    std::memcpy(&value, &bits, sizeof(value));
-    return value;
-}
-
-float VU1Interpreter::normalizeResult(float value, uint32_t &laneFlags) const
-{
-    uint32_t bits = 0;
-    std::memcpy(&bits, &value, sizeof(bits));
-    const uint32_t sign = bits & 0x80000000u;
-    const uint32_t magnitude = bits & 0x7FFFFFFFu;
-    const uint32_t exponent = (bits >> 23) & 0xFFu;
-
-    laneFlags = sign != 0u ? 0x2u : 0u;
-    if (magnitude == 0u)
-    {
-        laneFlags |= 0x1u;
-    }
-    else if (exponent == 0u)
-    {
-        laneFlags |= 0x5u;
-        bits = sign;
-    }
-    else if (exponent == 0xFFu)
-    {
-        laneFlags |= 0x8u;
-        bits = sign | 0x7F7FFFFFu;
-    }
-
-    std::memcpy(&value, &bits, sizeof(value));
-    return value;
-}
-
-uint32_t VU1Interpreter::microAddressMask() const
-{
-    return m_unit == Unit::VU1 ? 0x3FFFu : 0x0FFFu;
-}
-
-int32_t VU1Interpreter::readBranchVi(uint8_t reg) const
-{
-    if (reg == 0u)
-        return 0;
-    if (m_viBranchBackupValid &&
-        m_viBranchBackupReg == reg)
-    {
-        return m_viBranchBackupValue;
-    }
-    return m_state.vi[reg];
-}
-
-void VU1Interpreter::recordViWriteForBranch(uint8_t reg, int32_t oldValue)
-{
-    if (reg == 0u)
-        return;
-    m_viBranchBackupValue = oldValue;
-    m_viBranchBackupReg = reg;
-    m_viBranchBackupValid = true;
-}
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::applyDest(float *dst, const float *result, uint8_t dest)
-{
-    if (dest & 0x8u)
-        dst[0] = result[0];
-    if (dest & 0x4u)
-        dst[1] = result[1];
-    if (dest & 0x2u)
-        dst[2] = result[2];
-    if (dest & 0x1u)
-        dst[3] = result[3];
-}
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::applyDestAcc(const float *result, uint8_t dest)
-{
-    applyDest(m_state.acc, result, dest);
-}
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::normalizeFmacResult(float *result, uint8_t dest,
-                                         uint8_t laneFlags[4])
-{
-    const uint32_t upper = m_currentUpperInstruction;
-    const uint32_t op = (upper & 0x3fu) < 0x3cu
-        ? upper & 0x3fu : (upper & 3u) | ((upper >> 4u) & 0x7cu);
-    const bool simpleArithmetic = op <= 7u || (op >= 0x18u && op <= 0x1cu) ||
-        op == 0x1eu || op == 0x20u || op == 0x22u || op == 0x24u ||
-        op == 0x26u || op == 0x28u || op == 0x2au || op == 0x2cu;
-    for (uint32_t component = 0; component < 4u; ++component)
-    {
-        laneFlags[component] = 0u;
-        if ((dest & laneForComponent(component)) == 0u)
-            continue;
-
-        // A normal ADD/SUB/MUL result has only a sign flag. Keep exact checks
-        // at both range boundaries, including overflow rounded to FLT_MAX.
-        uint32_t bits;
-        std::memcpy(&bits, &result[component], sizeof(bits));
-        const uint32_t magnitude = bits & 0x7fffffffu;
-        if (simpleArithmetic && magnitude >= 0x00800000u && magnitude < 0x7f7fffffu)
-        {
-            laneFlags[component] = static_cast<uint8_t>((bits >> 30u) & 2u);
-            continue;
-        }
-
-        long double exactResult = 0.0L;
-        if (calculateFmacExactResult(component, exactResult))
-        {
-            laneFlags[component] = normalizeFmacExactResult(result[component], exactResult);
-            continue;
-        }
-
-        uint32_t flags = 0u;
-        result[component] = normalizeResult(result[component], flags);
-        laneFlags[component] = static_cast<uint8_t>(flags);
-    }
-}
-
-PS2_VU_FORCE_INLINE bool VU1Interpreter::calculateFmacExactResult(uint32_t component,
-                                               long double &result) const
-{
-    const uint32_t upper = m_currentUpperInstruction;
-    const uint8_t op = static_cast<uint8_t>(upper & 0x3Fu);
-    const uint8_t special = op >= 0x3Cu
-                                ? static_cast<uint8_t>((upper & 3u) | ((upper >> 4) & 0x7Cu))
-                                : 0xFFu;
-    const uint8_t fs = FS(upper);
-    const uint8_t ft = FT(upper);
-
-    const auto operand = [this](float value)
-    {
-        return static_cast<long double>(normalizeOperand(value));
-    };
-    const auto vs = [&](uint32_t lane)
-    {
-        return operand(m_state.vf[fs][lane]);
-    };
-    const auto vt = [&](uint32_t lane)
-    {
-        return operand(m_state.vf[ft][lane]);
-    };
-    const auto acc = [&](uint32_t lane)
-    {
-        return operand(m_state.acc[lane]);
-    };
-
-    const long double q = operand(m_state.q);
-    const long double i = operand(m_state.i);
-
-    if (op < 0x3Cu)
-    {
-        if (op <= 0x03u)
-            result = vs(component) + vt(op & 3u);
-        else if (op <= 0x07u)
-            result = vs(component) - vt(op & 3u);
-        else if (op <= 0x0Bu)
-            result = acc(component) + vs(component) * vt(op & 3u);
-        else if (op <= 0x0Fu)
-            result = acc(component) - vs(component) * vt(op & 3u);
-        else if (op >= 0x18u && op <= 0x1Bu)
-            result = vs(component) * vt(op & 3u);
-        else
-        {
-            switch (op)
-            {
-            case 0x1Cu:
-                result = vs(component) * q;
-                break;
-            case 0x1Eu:
-                result = vs(component) * i;
-                break;
-            case 0x20u:
-                result = vs(component) + q;
-                break;
-            case 0x21u:
-                result = acc(component) + vs(component) * q;
-                break;
-            case 0x22u:
-                result = vs(component) + i;
-                break;
-            case 0x23u:
-                result = acc(component) + vs(component) * i;
-                break;
-            case 0x24u:
-                result = vs(component) - q;
-                break;
-            case 0x25u:
-                result = acc(component) - vs(component) * q;
-                break;
-            case 0x26u:
-                result = vs(component) - i;
-                break;
-            case 0x27u:
-                result = acc(component) - vs(component) * i;
-                break;
-            case 0x28u:
-                result = vs(component) + vt(component);
-                break;
-            case 0x29u:
-                result = acc(component) + vs(component) * vt(component);
-                break;
-            case 0x2Au:
-                result = vs(component) * vt(component);
-                break;
-            case 0x2Cu:
-                result = vs(component) - vt(component);
-                break;
-            case 0x2Du:
-                result = acc(component) - vs(component) * vt(component);
-                break;
-            case 0x2Eu:
-            {
-                static constexpr uint8_t left[4] = {1u, 2u, 0u, 3u};
-                static constexpr uint8_t right[4] = {2u, 0u, 1u, 3u};
-                result = component == 3u
-                             ? 0.0L
-                             : acc(component) - vs(left[component]) * vt(right[component]);
-                break;
-            }
-            default:
-                return false;
-            }
-        }
-        return true;
-    }
-
-    if (special <= 0x03u)
-        result = vs(component) + vt(special & 3u);
-    else if (special <= 0x07u)
-        result = vs(component) - vt(special & 3u);
-    else if (special <= 0x0Bu)
-        result = acc(component) + vs(component) * vt(special & 3u);
-    else if (special <= 0x0Fu)
-        result = acc(component) - vs(component) * vt(special & 3u);
-    else if (special >= 0x18u && special <= 0x1Bu)
-        result = vs(component) * vt(special & 3u);
-    else
-    {
-        switch (special)
-        {
-        case 0x1Cu:
-            result = vs(component) * q;
-            break;
-        case 0x1Eu:
-            result = vs(component) * i;
-            break;
-        case 0x20u:
-            result = vs(component) + q;
-            break;
-        case 0x21u:
-            result = acc(component) + vs(component) * q;
-            break;
-        case 0x22u:
-            result = vs(component) + i;
-            break;
-        case 0x23u:
-            result = acc(component) + vs(component) * i;
-            break;
-        case 0x24u:
-            result = vs(component) - q;
-            break;
-        case 0x25u:
-            result = acc(component) - vs(component) * q;
-            break;
-        case 0x26u:
-            result = vs(component) - i;
-            break;
-        case 0x27u:
-            result = acc(component) - vs(component) * i;
-            break;
-        case 0x28u:
-            result = vs(component) + vt(component);
-            break;
-        case 0x29u:
-            result = acc(component) + vs(component) * vt(component);
-            break;
-        case 0x2Au:
-            result = vs(component) * vt(component);
-            break;
-        case 0x2Cu:
-            result = vs(component) - vt(component);
-            break;
-        case 0x2Du:
-            result = acc(component) - vs(component) * vt(component);
-            break;
-        case 0x2Eu:
-        {
-            static constexpr uint8_t left[4] = {1u, 2u, 0u, 3u};
-            static constexpr uint8_t right[4] = {2u, 0u, 1u, 3u};
-            result = component == 3u
-                         ? 0.0L
-                         : vs(left[component]) * vt(right[component]);
-            break;
-        }
-        default:
-            return false;
-        }
-    }
-    return true;
-}
-
-PS2_VU_FORCE_INLINE uint8_t VU1Interpreter::normalizeFmacExactResult(float &value,
-                                                  long double exactResult) const
-{
-    const bool negative = std::signbit(exactResult);
-    const long double magnitude = std::fabs(exactResult);
-    const long double maximum = static_cast<long double>(std::numeric_limits<float>::max());
-    const long double minimum = static_cast<long double>(std::numeric_limits<float>::min());
-    uint8_t flags = negative ? 0x2u : 0u;
-
-    uint32_t bits = negative ? 0x80000000u : 0u;
-    if (magnitude == 0.0L)
-    {
-        flags |= 0x1u;
-        std::memcpy(&value, &bits, sizeof(value));
-    }
-    else if (magnitude > maximum)
-    {
-        flags |= 0x8u;
-        bits |= 0x7F7FFFFFu;
-        std::memcpy(&value, &bits, sizeof(value));
-    }
-    else if (magnitude < minimum)
-    {
-        flags |= 0x5u;
-        std::memcpy(&value, &bits, sizeof(value));
-    }
-
-    return flags;
-}
-
-PS2_VU_FORCE_INLINE uint32_t VU1Interpreter::calculateFmacProductSticky(uint8_t dest) const
-{
-    uint32_t extraSticky = 0u;
-    const uint32_t upper = m_currentUpperInstruction;
-    const uint8_t op = static_cast<uint8_t>(upper & 0x3Fu);
-    const uint8_t special = op >= 0x3Cu ? static_cast<uint8_t>((upper & 3u) | ((upper >> 4) & 0x7Cu)) : 0xFFu;
-    const bool productSum =
-        (op >= 0x08u && op <= 0x0Fu) ||
-        op == 0x21u || op == 0x23u || op == 0x25u || op == 0x27u ||
-        op == 0x29u || op == 0x2Du || op == 0x2Eu ||
-        (special >= 0x08u && special <= 0x0Fu) ||
-        special == 0x21u || special == 0x23u || special == 0x25u ||
-        special == 0x27u || special == 0x29u || special == 0x2Du;
-    if (!productSum)
-        return 0u;
-
-    const uint8_t fs = FS(upper);
-    const uint8_t ft = FT(upper);
-    for (uint32_t component = 0; component < 4u; ++component)
-    {
-        if ((dest & laneForComponent(component)) == 0u)
-            continue;
-        static constexpr uint8_t crossLeft[4] = {1u, 2u, 0u, 3u};
-        static constexpr uint8_t crossRight[4] = {2u, 0u, 1u, 3u};
-        const uint8_t leftComponent = op == 0x2Eu ? crossLeft[component] : static_cast<uint8_t>(component);
-        const float left = normalizeOperand(m_state.vf[fs][leftComponent]);
-        float right = 0.0f;
-        if ((op >= 0x08u && op <= 0x0Fu) || (special >= 0x08u && special <= 0x0Fu))
-        {
-            right = normalizeOperand(m_state.vf[ft][(op >= 0x08u && op <= 0x0Fu ? op : special) & 3u]);
-        }
-        else if (op == 0x21u || op == 0x25u || special == 0x21u || special == 0x25u)
-        {
-            right = normalizeOperand(m_state.q);
-        }
-        else if (op == 0x23u || op == 0x27u || special == 0x23u || special == 0x27u)
-        {
-            right = normalizeOperand(m_state.i);
-        }
-        else if (op == 0x2Eu)
-        {
-            right = normalizeOperand(m_state.vf[ft][crossRight[component]]);
-        }
-        else
-        {
-            right = normalizeOperand(m_state.vf[ft][component]);
-        }
-
-        float product = left * right;
-        uint32_t productBits;
-        std::memcpy(&productBits, &product, sizeof(productBits));
-        const uint32_t magnitude = productBits & 0x7fffffffu;
-        if (magnitude >= 0x00800000u && magnitude < 0x7f7fffffu)
-        {
-            extraSticky |= (productBits >> 30u) & 2u;
-            continue;
-        }
-        const long double exactProduct = static_cast<long double>(left) * static_cast<long double>(right);
-        const uint8_t productFlags = normalizeFmacExactResult(product, exactProduct);
-        // Product-sum instructions report Z/S/U/O from the add/subtract result
-        // as current flags, while every product condition accumulates into the
-        // corresponding sticky flag.
-        extraSticky |= productFlags & 0xFu;
-    }
-    return extraSticky;
-}
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::updateFmacFlags(const uint8_t laneFlags[4], uint8_t dest,
-                                     uint32_t extraSticky)
-{
-    if (dest == 0u)
-        return;
-
-    uint32_t mac = 0u;
-    uint32_t status = 0u;
-    for (uint32_t component = 0; component < 4u; ++component)
-    {
-        const uint8_t lane = laneForComponent(component);
-        if ((dest & lane) == 0u)
-            continue;
-
-        const uint32_t flags = laneFlags[component];
-        if ((flags & 0x1u) != 0u)
-            mac |= lane;
-        if ((flags & 0x2u) != 0u)
-            mac |= static_cast<uint32_t>(lane) << 4;
-        if ((flags & 0x4u) != 0u)
-            mac |= static_cast<uint32_t>(lane) << 8;
-        if ((flags & 0x8u) != 0u)
-            mac |= static_cast<uint32_t>(lane) << 12;
-        status |= flags;
-    }
-
-    FlagPipelineEntry *entry = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency);
-    if (!entry)
-    {
-        reportReservedInstruction(true, 0xFFFFFFFFu);
-        return;
-    }
-
-    *entry = {};
-    entry->valid = true;
-    entry->issueCycle = m_cycle;
-    entry->readyCycle = m_cycle + kFmacLatency;
-    entry->mac = mac;
-    entry->status = status;
-    entry->extraSticky = extraSticky;
-    entry->writesMac = true;
-    entry->writesStatus = true;
-}
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::applyFmacDest(float *dst, float *result, uint8_t dest)
-{
-    uint8_t laneFlags[4]{};
-    normalizeFmacResult(result, dest, laneFlags);
-    updateFmacFlags(laneFlags, dest, calculateFmacProductSticky(dest));
-    applyDest(dst, result, dest);
-}
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::applyFmacDestAcc(float *result, uint8_t dest)
-{
-    uint8_t laneFlags[4]{};
-    normalizeFmacResult(result, dest, laneFlags);
-    updateFmacFlags(laneFlags, dest, calculateFmacProductSticky(dest));
-    applyDestAcc(result, dest);
-}
-
-void VU1Interpreter::queueFsset(uint16_t immediate)
-{
-    for (uint32_t active = m_activeFlags; active != 0u; active &= active - 1u)
-    {
-        auto &entry = m_flagPipeline[std::countr_zero(active)];
-        if (entry.issueCycle == m_cycle)
-            entry.writesStatus = false;
-    }
-
-    if (auto *slot = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency))
-    {
-        auto &entry = *slot;
-        entry = {};
-        entry.valid = true;
-        entry.issueCycle = m_cycle;
-        entry.readyCycle = m_cycle + kFmacLatency;
-        entry.status = static_cast<uint32_t>(immediate) & 0xFC0u;
-        entry.writesSticky = true;
-        return;
-    }
-    reportReservedInstruction(false, 0xFFFFFFFEu);
-}
-
-void VU1Interpreter::queueClip(uint32_t clip)
-{
-    m_workingClip = ((m_workingClip << 6) | (clip & 0x3Fu)) & 0xFFFFFFu;
-    if (auto *slot = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency))
-    {
-        auto &entry = *slot;
-        entry = {};
-        entry.valid = true;
-        entry.issueCycle = m_cycle;
-        entry.readyCycle = m_cycle + kFmacLatency;
-        entry.clip = m_workingClip;
-        entry.writesClip = true;
-        return;
-    }
-    reportReservedInstruction(true, 0xFFFFFFFDu);
-}
-
-void VU1Interpreter::queueFcset(uint32_t clip)
-{
-    m_workingClip = clip & 0xFFFFFFu;
-    for (uint32_t active = m_activeFlags; active != 0u; active &= active - 1u)
-    {
-        auto &entry = m_flagPipeline[std::countr_zero(active)];
-        if (entry.issueCycle == m_cycle)
-            entry.writesClip = false;
-    }
-    if (auto *slot = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency))
-    {
-        auto &entry = *slot;
-        entry = {};
-        entry.valid = true;
-        entry.issueCycle = m_cycle;
-        entry.readyCycle = m_cycle + kFmacLatency;
-        entry.clip = m_workingClip;
-        entry.writesClip = true;
-        return;
-    }
-    reportReservedInstruction(false, 0xFFFFFFFAu);
-}
-
-void VU1Interpreter::queueQ(float value, uint32_t latency, uint32_t statusDi)
-{
-    uint32_t ignoredFlags = 0u;
-    value = normalizeResult(value, ignoredFlags);
-    m_fdiv.valid = true;
-    m_fdiv.readyCycle = m_cycle + latency;
-    m_fdiv.value = value;
-    m_fdiv.statusDi = statusDi & 0x30u;
-}
-
-void VU1Interpreter::queueP(float value, uint32_t latency)
-{
-    uint32_t ignoredFlags = 0u;
-    value = normalizeResult(value, ignoredFlags);
-    for (ScalarPipelineEntry &entry : m_efu)
-    {
-        if (!entry.valid)
-        {
-            entry.valid = true;
-            entry.readyCycle = m_cycle + latency;
-            entry.value = value;
-            // EFU throughput is one cycle shorter than result visibility.
-            m_efuResourceReady = m_cycle + (latency > 0u ? latency - 1u : 0u);
-            return;
-        }
-    }
-    reportReservedInstruction(false, 0xFFFFFFF9u);
-}
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::queueStore(uint32_t address, const uint32_t words[4], uint8_t laneMask)
-{
-    // Every pair advances one cycle before returning or progressing PATH1.
-    // No observer runs between a store and that mandatory one-cycle retirement.
-    if (!m_activeVuData || address + 16ull > m_activeVuDataSize)
-        return;
-    for (uint32_t component = 0; component < 4u; ++component)
-        if ((laneMask & laneForComponent(component)) != 0u)
-            std::memcpy(m_activeVuData + address + component * 4u,
-                        words + component, sizeof(uint32_t));
-}
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::queueVfWrite(uint8_t reg, uint8_t laneMask,
-                                  const float value[4], uint32_t latency)
-{
-    if (reg == 0u || laneMask == 0u)
-        return;
-    if (auto *slot = allocateScheduledEntry(m_vfWritePipeline, m_activeVfWrites, m_cycle + latency))
-    {
-        auto &write = *slot;
-        write = {};
-        write.valid = true;
-        write.readyCycle = m_cycle + latency;
-        write.sequence = ++m_nextWriteSequence;
-        write.reg = reg;
-        write.laneMask = laneMask;
-        std::copy(value, value + 4, write.value.begin());
-        for (uint32_t component = 0; component < 4u; ++component)
-        {
-            if ((laneMask & laneForComponent(component)) != 0u)
-                m_vfLatestWrite[reg][component] = write.sequence;
-        }
-        return;
-    }
-    reportReservedInstruction(false, 0xFFFFFFF7u);
-}
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::queueViWrite(uint8_t reg, int32_t value, uint32_t latency)
-{
-    if (reg == 0u)
-        return;
-    if (auto *slot = allocateScheduledEntry(m_viWritePipeline, m_activeViWrites, m_cycle + latency))
-    {
-        auto &write = *slot;
-        write = {};
-        write.valid = true;
-        write.readyCycle = m_cycle + latency;
-        write.sequence = ++m_nextWriteSequence;
-        write.reg = reg;
-        write.value = value;
-        m_viLatestWrite[reg] = write.sequence;
-        return;
-    }
-    reportReservedInstruction(false, 0xFFFFFFF6u);
-}
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::queueAccWrite(uint8_t laneMask, const float value[4], uint32_t latency)
-{
-    if (laneMask == 0u)
-        return;
-    if (auto *slot = allocatePipelineEntry(m_accWritePipeline, m_activeAccWrites))
-    {
-        auto &write = *slot;
-        write = {};
-        write.valid = true;
-        write.readyCycle = m_cycle + latency;
-        write.sequence = ++m_nextWriteSequence;
-        write.laneMask = laneMask;
-        std::copy(value, value + 4, write.value.begin());
-        for (uint32_t component = 0; component < 4u; ++component)
-        {
-            if ((laneMask & laneForComponent(component)) != 0u)
-                m_accLatestWrite[component] = write.sequence;
-        }
-        return;
-    }
-    reportReservedInstruction(true, 0xFFFFFFF5u);
-}
-
 void VU1Interpreter::progressXgkick()
 {
     if (!m_xgkick.active || !m_activeVuData || m_activeVuDataSize == 0u)
@@ -912,23 +198,6 @@ void VU1Interpreter::startXgkick(uint32_t qwordAddress)
     m_xgkick.issueCycle = m_cycle;
 }
 
-PS2_VU_FORCE_INLINE void VU1Interpreter::advanceOneCycle()
-{
-    ++m_cycle;
-    m_state.cycles = m_cycle;
-    // LSU commits become visible at the cycle boundary before PATH1 consumes
-    // its next qword from VU memory.
-    commitReadyPipelines();
-    if (m_xgkick.active)
-        progressXgkick();
-}
-
-void VU1Interpreter::advanceTo(uint64_t targetCycle)
-{
-    while (m_cycle < targetCycle)
-        advanceOneCycle();
-}
-
 bool VU1Interpreter::pipelinesPending() const
 {
     if (m_fdiv.valid || m_xgkick.active)
@@ -950,557 +219,11 @@ uint64_t VU1Interpreter::calculatePairReadyCycle(const DecodedInstructionPair &d
     return calculatePairReadyCycleInline(decoded);
 }
 
-PS2_VU_FORCE_INLINE uint64_t VU1Interpreter::calculatePairReadyCycleInline(const DecodedInstructionPair &decoded) const
-{
-    uint64_t ready = m_cycle;
-    const InstructionUsage *usages[2] = {
-        &decoded.upperUsage,
-        &decoded.lowerUsage};
-    for (const InstructionUsage *usage : usages)
-    {
-        if (!usage)
-            continue;
-        for (uint32_t index = 0; index < usage->vfReadCount; ++index)
-        {
-            const VfAccess &access = usage->vfRead[index];
-            for (uint32_t component = 0; component < 4u; ++component)
-            {
-                if ((access.lanes & laneForComponent(component)) != 0u)
-                    ready = std::max(ready, m_vfReady[access.reg][component]);
-            }
-        }
-        for (uint32_t reads = usage->viRead & 0xFFFEu; reads != 0u; reads &= reads - 1u)
-        {
-            const unsigned reg = std::countr_zero(reads);
-            ready = std::max(ready, m_viReady[reg]);
-        }
-        for (uint32_t component = 0; component < 4u; ++component)
-        {
-            if ((usage->accRead & laneForComponent(component)) != 0u)
-                ready = std::max(ready, m_accReady[component]);
-        }
-    }
-
-    if (decoded.lowerUsage.pipeline == PipelineFdiv && m_fdiv.valid)
-        ready = std::max(ready, m_fdiv.readyCycle);
-    if (decoded.lowerUsage.pipeline == PipelineEfu)
-        ready = std::max(ready, m_efuResourceReady);
-    if (decoded.lowerUsage.waitQ && m_fdiv.valid)
-        ready = std::max(ready, m_fdiv.readyCycle);
-    if (decoded.lowerUsage.waitP)
-    {
-        for (const ScalarPipelineEntry &entry : m_efu)
-            if (entry.valid)
-                ready = std::max(ready, entry.readyCycle);
-    }
-    if (decoded.lowerUsage.pipeline == PipelineXgkick && m_xgkick.active)
-        ready = std::max(ready, m_cycle + 1u);
-    return ready;
-}
-
 void VU1Interpreter::markPairWrites(const DecodedInstructionPair &decoded)
 {
     markPairWritesInline(decoded);
 }
 
-PS2_VU_FORCE_INLINE void VU1Interpreter::markPairWritesInline(const DecodedInstructionPair &decoded)
-{
-    const VfAccess lowerWrite = decoded.lowerUsage.vfWrite;
-    if (lowerWrite.reg != 0u &&
-        decoded.suppressedLowerVf != lowerWrite.reg)
-    {
-        const uint32_t latency = decoded.lowerUsage.vfLatency != 0u
-                                     ? decoded.lowerUsage.vfLatency
-                                     : decoded.lowerUsage.latency;
-        for (uint32_t component = 0; component < 4u; ++component)
-        {
-            if ((lowerWrite.lanes & laneForComponent(component)) != 0u)
-                m_vfReady[lowerWrite.reg][component] = m_cycle + latency;
-        }
-    }
-
-    const VfAccess upperWrite = decoded.upperUsage.vfWrite;
-    if (upperWrite.reg != 0u)
-    {
-        const uint32_t latency = decoded.upperUsage.vfLatency != 0u
-                                     ? decoded.upperUsage.vfLatency
-                                     : decoded.upperUsage.latency;
-        for (uint32_t component = 0; component < 4u; ++component)
-        {
-            if ((upperWrite.lanes & laneForComponent(component)) != 0u)
-                m_vfReady[upperWrite.reg][component] = m_cycle + latency;
-        }
-    }
-
-    for (uint32_t writes = decoded.lowerUsage.viWrite & 0xFFFEu; writes != 0u; writes &= writes - 1u)
-    {
-        const unsigned reg = std::countr_zero(writes);
-        m_viReady[reg] = m_cycle + (decoded.lowerUsage.viLatency != 0u ? decoded.lowerUsage.viLatency : decoded.lowerUsage.latency);
-    }
-    for (uint32_t component = 0; component < 4u; ++component)
-    {
-        if ((decoded.upperUsage.accWrite & laneForComponent(component)) != 0u)
-            m_accReady[component] = m_cycle + kAccForwardLatency;
-    }
-}
-
-constexpr VU1Interpreter::InstructionUsage VU1Interpreter::decodeUpperUsage(uint32_t upper)
-{
-    InstructionUsage usage;
-    usage.pipeline = PipelineFmac;
-    usage.latency = kFmacLatency;
-
-    const uint8_t op = static_cast<uint8_t>(upper & 0x3Fu);
-    const uint8_t dest = DEST(upper);
-    const uint8_t fs = FS(upper);
-    const uint8_t ft = FT(upper);
-    const uint8_t fd = FD(upper);
-
-    if (op <= 0x2Fu)
-    {
-        addVfRead(usage, fs, dest);
-        addVfWrite(usage, fd, dest);
-        if (op <= 0x1Bu)
-            addVfRead(usage, ft, laneForComponent(op & 3u));
-        else if (op >= 0x28u)
-            addVfRead(usage, ft, op == 0x2Eu ? 0xEu : dest);
-        if (op == 0x08u || op == 0x09u || op == 0x0Au || op == 0x0Bu ||
-            op == 0x0Cu || op == 0x0Du || op == 0x0Eu || op == 0x0Fu ||
-            op == 0x21u || op == 0x23u || op == 0x25u || op == 0x27u ||
-            op == 0x29u || op == 0x2Du || op == 0x2Eu)
-        {
-            usage.accRead = dest;
-        }
-        return usage;
-    }
-
-    if (op >= 0x3Cu)
-    {
-        const uint8_t special = static_cast<uint8_t>((upper & 3u) | ((upper >> 4) & 0x7Cu));
-        const bool writesAcc =
-            special <= 0x0Fu ||
-            (special >= 0x18u && special <= 0x1Cu) ||
-            special == 0x1Eu ||
-            (special >= 0x20u && special <= 0x2Au) ||
-            (special >= 0x2Cu && special <= 0x2Eu);
-        if (writesAcc)
-        {
-            addVfRead(usage, fs, dest);
-            if (special <= 0x1Bu)
-                addVfRead(usage, ft, laneForComponent(special & 3u));
-            else if ((special >= 0x28u && special <= 0x2Eu))
-                addVfRead(usage, ft, special == 0x2Eu ? 0xEu : dest);
-            usage.accWrite = dest;
-            if ((special >= 0x08u && special <= 0x0Fu) ||
-                special == 0x21u || special == 0x23u || special == 0x25u ||
-                special == 0x27u || special == 0x29u || special == 0x2Du)
-            {
-                usage.accRead = dest;
-            }
-        }
-        else if (special >= 0x10u && special <= 0x17u)
-        {
-            addVfRead(usage, fs, dest);
-            addVfWrite(usage, ft, dest);
-        }
-        else if (special == 0x1Du)
-        {
-            addVfRead(usage, fs, dest);
-            addVfWrite(usage, ft, dest);
-        }
-        else if (special == 0x1Fu)
-        {
-            addVfRead(usage, fs, 0xEu);
-            addVfRead(usage, ft, 0x1u);
-            usage.writesClip = true;
-        }
-        else if (special != 0x2Fu && special != 0x30u)
-        {
-            usage.reserved = true;
-        }
-        return usage;
-    }
-
-    usage.reserved = true;
-    return usage;
-}
-
-constexpr VU1Interpreter::InstructionUsage VU1Interpreter::decodeLowerUsage(uint32_t lower, Unit unit)
-{
-    InstructionUsage usage;
-    if (lower == 0u || lower == 0x8000033Cu)
-        return usage;
-
-    const uint8_t opHi = static_cast<uint8_t>((lower >> 25) & 0x7Fu);
-    const uint8_t vfT = FT(lower);
-    const uint8_t vfS = FS(lower);
-    const uint8_t viT = VIT(lower);
-    const uint8_t viS = VIS(lower);
-    const uint8_t viD = VID(lower);
-    const uint8_t dest = DEST(lower);
-    auto readVi = [&](uint8_t reg)
-    {
-        if (reg != 0u)
-            usage.viRead |= static_cast<uint16_t>(1u << reg);
-    };
-    auto writeVi = [&](uint8_t reg)
-    {
-        if (reg != 0u)
-            usage.viWrite |= static_cast<uint16_t>(1u << reg);
-    };
-
-    switch (opHi)
-    {
-    case 0x00:
-        usage.pipeline = PipelineLsu;
-        usage.latency = 4u;
-        readVi(viS);
-        addVfWrite(usage, vfT, dest);
-        return usage;
-    case 0x01:
-        usage.pipeline = PipelineLsu;
-        usage.latency = 1u;
-        readVi(viT);
-        addVfRead(usage, vfS, dest);
-        return usage;
-    case 0x04:
-        usage.pipeline = PipelineLsu;
-        usage.latency = 4u;
-        readVi(viS);
-        writeVi(viT);
-        return usage;
-    case 0x05:
-        usage.pipeline = PipelineLsu;
-        usage.latency = 1u;
-        readVi(viS);
-        readVi(viT);
-        return usage;
-    case 0x08:
-    case 0x09:
-        usage.pipeline = PipelineIalu;
-        usage.latency = 1u;
-        usage.delaysNextBranchRead = true;
-        readVi(viS);
-        writeVi(viT);
-        return usage;
-    case 0x10:
-    case 0x12:
-    case 0x13:
-        usage.pipeline = PipelineIalu;
-        usage.latency = 1u;
-        usage.readsClip = true;
-        writeVi(1u);
-        return usage;
-    case 0x11:
-        usage.pipeline = PipelineFmac;
-        usage.latency = kFmacLatency;
-        usage.writesClip = true;
-        return usage;
-    case 0x14:
-    case 0x16:
-    case 0x17:
-        usage.pipeline = PipelineIalu;
-        usage.latency = 1u;
-        writeVi(viT);
-        return usage;
-    case 0x15:
-        usage.pipeline = PipelineFmac;
-        usage.latency = kFmacLatency;
-        return usage;
-    case 0x18:
-    case 0x1A:
-    case 0x1B:
-        usage.pipeline = PipelineIalu;
-        usage.latency = 1u;
-        readVi(viS);
-        writeVi(viT);
-        return usage;
-    case 0x1C:
-        usage.pipeline = PipelineIalu;
-        usage.latency = 1u;
-        usage.readsClip = true;
-        writeVi(viT);
-        return usage;
-    case 0x20:
-        usage.pipeline = PipelineBranch;
-        return usage;
-    case 0x21:
-        usage.pipeline = PipelineBranch;
-        usage.latency = 1u;
-        writeVi(viT);
-        return usage;
-    case 0x24:
-        usage.pipeline = PipelineBranch;
-        readVi(viS);
-        return usage;
-    case 0x25:
-        usage.pipeline = PipelineBranch;
-        usage.latency = 1u;
-        readVi(viS);
-        writeVi(viT);
-        return usage;
-    case 0x28:
-    case 0x29:
-        usage.pipeline = PipelineBranch;
-        readVi(viS);
-        readVi(viT);
-        return usage;
-    case 0x2C:
-    case 0x2D:
-    case 0x2E:
-    case 0x2F:
-        usage.pipeline = PipelineBranch;
-        readVi(viS);
-        return usage;
-    case 0x40:
-        break;
-    default:
-        usage.reserved = true;
-        return usage;
-    }
-
-    const uint8_t direct = static_cast<uint8_t>(lower & 0x3Fu);
-    if (direct == 0x30u || direct == 0x31u || direct == 0x34u || direct == 0x35u)
-    {
-        usage.pipeline = PipelineIalu;
-        usage.latency = 1u;
-        usage.delaysNextBranchRead = true;
-        readVi(viS);
-        readVi(viT);
-        writeVi(viD);
-        return usage;
-    }
-    if (direct == 0x32u)
-    {
-        usage.pipeline = PipelineIalu;
-        usage.latency = 1u;
-        usage.delaysNextBranchRead = true;
-        readVi(viS);
-        writeVi(viT);
-        return usage;
-    }
-    if (direct < 0x3Cu)
-    {
-        usage.reserved = true;
-        return usage;
-    }
-
-    const uint8_t special = static_cast<uint8_t>((lower & 3u) | ((lower >> 4) & 0x7Cu));
-    switch (special)
-    {
-    case 0x30:
-    case 0x31:
-        usage.pipeline = PipelineFmac;
-        usage.latency = 4u;
-        addVfRead(usage, vfS, special == 0x31u ? 0xFu : dest);
-        addVfWrite(usage, vfT, dest);
-        break;
-    case 0x34:
-    case 0x36:
-        usage.pipeline = PipelineLsu;
-        usage.latency = 4u;
-        usage.viLatency = 1u;
-        usage.delaysNextBranchRead = true;
-        readVi(viS);
-        writeVi(viS);
-        addVfWrite(usage, vfT, dest);
-        break;
-    case 0x35:
-    case 0x37:
-        usage.pipeline = PipelineLsu;
-        usage.latency = 1u;
-        usage.delaysNextBranchRead = true;
-        readVi(viT);
-        writeVi(viT);
-        addVfRead(usage, vfS, dest);
-        break;
-    case 0x38:
-        usage.pipeline = PipelineFdiv;
-        usage.latency = 7u;
-        addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
-        addVfRead(usage, vfT, laneForComponent((lower >> 23) & 3u));
-        break;
-    case 0x39:
-        usage.pipeline = PipelineFdiv;
-        usage.latency = 7u;
-        addVfRead(usage, vfT, laneForComponent((lower >> 23) & 3u));
-        break;
-    case 0x3A:
-        usage.pipeline = PipelineFdiv;
-        usage.latency = 13u;
-        addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
-        addVfRead(usage, vfT, laneForComponent((lower >> 23) & 3u));
-        break;
-    case 0x3B:
-        usage.pipeline = PipelineFdiv;
-        usage.waitQ = true;
-        break;
-    case 0x3C:
-        usage.pipeline = PipelineIalu;
-        usage.latency = 1u;
-        usage.delaysNextBranchRead = true;
-        addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
-        writeVi(viT);
-        break;
-    case 0x3D:
-        usage.pipeline = PipelineFmac;
-        usage.latency = 4u;
-        readVi(viS);
-        addVfWrite(usage, vfT, dest);
-        break;
-    case 0x3E:
-        usage.pipeline = PipelineLsu;
-        usage.latency = 4u;
-        readVi(viS);
-        writeVi(viT);
-        break;
-    case 0x3F:
-        usage.pipeline = PipelineLsu;
-        usage.latency = 1u;
-        readVi(viS);
-        readVi(viT);
-        break;
-    case 0x40:
-    case 0x41:
-        usage.pipeline = PipelineFmac;
-        usage.latency = 4u;
-        addVfWrite(usage, vfT, dest);
-        break;
-    case 0x42:
-    case 0x43:
-        usage.pipeline = PipelineIalu;
-        usage.latency = 1u;
-        addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
-        break;
-    case 0x64:
-        if (unit == Unit::VU0)
-        {
-            usage.reserved = true;
-            break;
-        }
-        usage.pipeline = PipelineFmac;
-        usage.latency = 4u;
-        addVfWrite(usage, vfT, dest);
-        break;
-    case 0x68:
-    case 0x69:
-        usage.pipeline = PipelineIalu;
-        usage.latency = 1u;
-        writeVi(viT);
-        break;
-    case 0x6C:
-        if (unit == Unit::VU0)
-        {
-            usage.reserved = true;
-            break;
-        }
-        usage.pipeline = PipelineXgkick;
-        usage.latency = 2u;
-        readVi(viS);
-        break;
-    case 0x70:
-    case 0x71:
-    case 0x72:
-    case 0x73:
-    case 0x74:
-    case 0x75:
-    case 0x76:
-    case 0x77:
-    case 0x78:
-    case 0x79:
-    case 0x7A:
-    case 0x7C:
-    case 0x7D:
-        if (unit == Unit::VU0)
-        {
-            usage.reserved = true;
-            break;
-        }
-        usage.pipeline = PipelineEfu;
-        switch (special)
-        {
-        case 0x70:
-            usage.latency = 11u;
-            break;
-        case 0x71:
-        case 0x72:
-        case 0x77:
-            usage.latency = 18u;
-            break;
-        case 0x73:
-            usage.latency = 24u;
-            break;
-        case 0x74:
-        case 0x75:
-        case 0x7C:
-            usage.latency = 54u;
-            break;
-        case 0x76:
-        case 0x78:
-        case 0x7A:
-            usage.latency = 12u;
-            break;
-        case 0x79:
-            usage.latency = 29u;
-            break;
-        case 0x7D:
-            usage.latency = 44u;
-            break;
-        default:
-            break;
-        }
-        if (special >= 0x70u && special <= 0x73u)
-            addVfRead(usage, vfS, 0xEu);
-        else if (special == 0x74u)
-            addVfRead(usage, vfS, 0xCu);
-        else if (special == 0x75u)
-            addVfRead(usage, vfS, 0xAu);
-        else if (special == 0x76u)
-            addVfRead(usage, vfS, 0xFu);
-        else
-            addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
-        break;
-    case 0x7B:
-        if (unit == Unit::VU0)
-        {
-            usage.reserved = true;
-            break;
-        }
-        usage.pipeline = PipelineEfu;
-        usage.waitP = true;
-        break;
-    default:
-        usage.reserved = true;
-        break;
-    }
-    return usage;
-}
-
-constexpr VU1Interpreter::DecodedInstructionPair VU1Interpreter::decodeInstructionWords(
-    uint32_t lower, uint32_t upper, Unit unit)
-{
-    DecodedInstructionPair decoded;
-    decoded.lower = lower;
-    decoded.upper = upper;
-    decoded.iBit = (decoded.upper & 0x80000000u) != 0u;
-    decoded.eBit = (decoded.upper & 0x40000000u) != 0u;
-    decoded.mBit = (decoded.upper & 0x20000000u) != 0u;
-    decoded.dBit = (decoded.upper & 0x10000000u) != 0u;
-    decoded.tBit = (decoded.upper & 0x08000000u) != 0u;
-    decoded.upperUsage = decodeUpperUsage(decoded.upper);
-    if (!decoded.iBit)
-        decoded.lowerUsage = decodeLowerUsage(decoded.lower, unit);
-
-    const uint8_t upperWriteReg = decoded.upperUsage.vfWrite.reg;
-    if (upperWriteReg != 0u && (vfReadLanes(decoded.lowerUsage, upperWriteReg) != 0u || decoded.lowerUsage.vfWrite.reg == upperWriteReg))
-    {
-        decoded.upperVfShadowReg = upperWriteReg;
-        if (decoded.lowerUsage.vfWrite.reg == upperWriteReg)
-            decoded.suppressedLowerVf = upperWriteReg;
-    }
-    return decoded;
-}
-
 VU1Interpreter::DecodedInstructionPair VU1Interpreter::decodeInstructionPair(const uint8_t *vuCode, uint32_t pc) const
 {
     uint32_t lower, upper;
@@ -1599,243 +322,9 @@ void VU1Interpreter::resume(uint8_t *vuCode, uint32_t codeSize,
     run(vuCode, codeSize, vuData, dataSize, gs, memory, maxCycles);
 }
 
-template <bool compiled>
-PS2_VU_FORCE_INLINE bool VU1Interpreter::runDecodedPair(const DecodedInstructionPair &decoded, uint64_t budgetEnd, uint32_t codeSize)
-{
-    bool programEnded = false;
-    if (decoded.upperUsage.reserved || decoded.lowerUsage.reserved)
-    {
-        reportReservedInstruction(decoded.upperUsage.reserved, decoded.upperUsage.reserved ? decoded.upper : decoded.lower);
-        return false;
-    }
-
-    const auto readiness = [&]() PS2_VU_INLINE_LAMBDA {
-        if constexpr (compiled) return calculatePairReadyCycleInline(decoded);
-        else return calculatePairReadyCycle(decoded);
-    };
-    const auto upper = [&]() PS2_VU_INLINE_LAMBDA {
-        if constexpr (compiled) execUpperInline(decoded.upper);
-        else execUpper(decoded.upper);
-    };
-    const auto lower = [&]() PS2_VU_INLINE_LAMBDA {
-        if constexpr (compiled)
-            execLowerInline(decoded.lower, m_activeVuData, m_activeVuDataSize, *m_activeGs, m_activeMemory, decoded.upper);
-        else
-            execLower(decoded.lower, m_activeVuData, m_activeVuDataSize, *m_activeGs, m_activeMemory, decoded.upper);
-    };
-    uint64_t readyCycle = readiness();
-    while (readyCycle > m_cycle)
-    {
-        if (readyCycle >= budgetEnd)
-        {
-            advanceTo(budgetEnd);
-            break;
-        }
-        advanceTo(readyCycle);
-        readyCycle = readiness();
-    }
-    if (m_cycle >= budgetEnd)
-        return false;
-
-    if constexpr (compiled) ++m_compiledPairsExecuted;
-    else ++m_interpretedPairsExecuted;
-
-    const uint32_t viWrites = decoded.lowerUsage.viWrite & 0xFFFEu;
-    const uint8_t writtenVi = viWrites != 0u ? static_cast<uint8_t>(std::countr_zero(viWrites)) : 0u;
-    const int32_t oldVi = writtenVi != 0u ? m_state.vi[writtenVi] : 0;
-
-    const VfAccess upperWrite = decoded.upperUsage.vfWrite;
-    const VfAccess lowerWrite = decoded.lowerUsage.vfWrite;
-    const bool hasUpperWrite = upperWrite.reg != 0u;
-    const bool hasLowerWrite = lowerWrite.reg != 0u && decoded.suppressedLowerVf != lowerWrite.reg;
-    const bool hasDistinctLowerWrite = hasLowerWrite && (!hasUpperWrite || lowerWrite.reg != upperWrite.reg);
-    float oldUpperVf[4]{};
-    float newUpperVf[4]{};
-    float oldLowerVf[4]{};
-    float newLowerVf[4]{};
-    float oldAcc[4]{};
-    float newAcc[4]{};
-    if (hasUpperWrite)
-        std::memcpy(oldUpperVf, m_state.vf[upperWrite.reg], sizeof(oldUpperVf));
-    if (hasDistinctLowerWrite)
-        std::memcpy(oldLowerVf, m_state.vf[lowerWrite.reg], sizeof(oldLowerVf));
-    if (!compiled && decoded.upperUsage.accWrite != 0u)
-        std::memcpy(oldAcc, m_state.acc, sizeof(oldAcc));
-
-    if (decoded.iBit)
-    {
-        upper();
-        float immediate = 0.0f;
-        std::memcpy(&immediate, &decoded.lower, sizeof(immediate));
-        m_state.i = normalizeOperand(immediate);
-    }
-    else if (decoded.upperVfShadowReg != 0u)
-    {
-        float oldVf[4]{};
-        float upperVf[4]{};
-        std::memcpy(oldVf,
-                    m_state.vf[decoded.upperVfShadowReg],
-                    sizeof(oldVf));
-        upper();
-        std::memcpy(upperVf,
-                    m_state.vf[decoded.upperVfShadowReg],
-                    sizeof(upperVf));
-        std::memcpy(m_state.vf[decoded.upperVfShadowReg],
-                    oldVf,
-                    sizeof(oldVf));
-        lower();
-        std::memcpy(m_state.vf[decoded.upperVfShadowReg],
-                    upperVf,
-                    sizeof(upperVf));
-    }
-    else
-    {
-        upper();
-        lower();
-    }
-
-    m_viBranchBackupValid = false;
-
-    if (hasUpperWrite)
-    {
-        std::memcpy(newUpperVf, m_state.vf[upperWrite.reg], sizeof(newUpperVf));
-        std::memcpy(m_state.vf[upperWrite.reg], oldUpperVf, sizeof(oldUpperVf));
-        const uint32_t latency =
-            decoded.upperUsage.vfLatency != 0u
-                ? decoded.upperUsage.vfLatency
-                : decoded.upperUsage.latency;
-        queueVfWrite(upperWrite.reg, upperWrite.lanes, newUpperVf, latency);
-    }
-    if (hasDistinctLowerWrite)
-    {
-        std::memcpy(newLowerVf, m_state.vf[lowerWrite.reg], sizeof(newLowerVf));
-        std::memcpy(m_state.vf[lowerWrite.reg], oldLowerVf, sizeof(oldLowerVf));
-        const uint32_t latency = decoded.lowerUsage.vfLatency != 0u
-                                     ? decoded.lowerUsage.vfLatency
-                                     : decoded.lowerUsage.latency;
-        queueVfWrite(lowerWrite.reg, lowerWrite.lanes, newLowerVf, latency);
-    }
-    if (!compiled && decoded.upperUsage.accWrite != 0u)
-    {
-        std::memcpy(newAcc, m_state.acc, sizeof(newAcc));
-        std::memcpy(m_state.acc, oldAcc, sizeof(oldAcc));
-        // ACC is forwarded to the next upper instruction. Its arithmetic
-        // flags still use the normal four-cycle FMAC timeline.
-        queueAccWrite(decoded.upperUsage.accWrite, newAcc,
-                      kAccForwardLatency);
-    }
-    if (writtenVi != 0u)
-    {
-        const int32_t newVi = m_state.vi[writtenVi];
-        const uint32_t latency =
-            decoded.lowerUsage.viLatency != 0u
-                ? decoded.lowerUsage.viLatency
-                : decoded.lowerUsage.latency;
-        if (compiled && latency == 1u)
-        {
-            m_state.vi[writtenVi] = static_cast<int16_t>(newVi);
-            m_viLatestWrite[writtenVi] = ++m_nextWriteSequence;
-        }
-        else
-        {
-            m_state.vi[writtenVi] = oldVi;
-            queueViWrite(writtenVi, newVi, latency);
-        }
-    }
-
-    // ACC and one-cycle VI results are visible before the next pair or callback.
-    // Lower operations never read ACC; VI supersession still cancels older loads.
-    static_assert(kAccForwardLatency == 1u);
-
-    if constexpr (compiled) markPairWritesInline(decoded);
-    else markPairWrites(decoded);
-    if (writtenVi != 0u && decoded.lowerUsage.delaysNextBranchRead)
-        recordViWriteForBranch(writtenVi, oldVi);
-
-    m_state.vf[0][0] = 0.0f;
-    m_state.vf[0][1] = 0.0f;
-    m_state.vf[0][2] = 0.0f;
-    m_state.vf[0][3] = 1.0f;
-    m_state.vi[0] = 0;
-
-    uint32_t nextPc = m_state.pc + 8u;
-    if (nextPc >= codeSize)
-        nextPc = 0u;
-    m_state.pc = nextPc;
-
-    if (m_state.branchPending)
-    {
-        if (m_state.branchDelay == 0u)
-        {
-            m_state.pc = m_state.branchTarget & microAddressMask();
-            m_state.branchPending = false;
-        }
-        else
-        {
-            --m_state.branchDelay;
-        }
-    }
-
-    const bool dHalt = decoded.dBit && m_state.dBitEnabled;
-    const bool tHalt = decoded.tBit && m_state.tBitEnabled;
-    const bool haltBit = dHalt || tHalt;
-    const bool haltBranch = haltBit && decoded.lowerUsage.pipeline == PipelineBranch;
-
-    if (m_state.haltAfterDelaySlot)
-    {
-        m_state.stoppedByD = m_pendingHaltD;
-        m_state.stoppedByT = m_pendingHaltT;
-        programEnded = true;
-    }
-    else if (m_state.ebit)
-        programEnded = true;
-    else if (haltBit && !haltBranch)
-    {
-        m_state.stoppedByD = dHalt;
-        m_state.stoppedByT = tHalt;
-        programEnded = true;
-    }
-    else if (decoded.eBit)
-        m_state.ebit = true;
-    else if (haltBranch)
-    {
-        m_state.haltAfterDelaySlot = true;
-        m_pendingHaltD = dHalt;
-        m_pendingHaltT = tHalt;
-    }
-
-    advanceOneCycle();
-    return programEnded;
-}
-
-template <VU1Interpreter::Unit unit, uint64_t... words>
-bool VU1Interpreter::runCompiledBlock(VU1Interpreter &vu, uint64_t budgetEnd)
-{
-    const uint32_t startPC = vu.m_state.pc;
-    uint32_t nextPC = startPC;
-    bool active = true;
-    bool ended = false;
-    const auto step = [&]<uint64_t word>() PS2_VU_INLINE_LAMBDA {
-        if (!active)
-            return;
-        // A callback can replace code, and any pair may exhaust the cycle budget.
-        const uint64_t generation = unit == Unit::VU1
-            ? vu.m_activeMemory->getVU1CodeGeneration() : vu.m_activeMemory->getVU0CodeGeneration();
-        if (vu.m_state.pc != nextPC || vu.m_cycle >= budgetEnd || vu.m_stopRequested ||
-            generation != vu.m_cachedCodeGeneration)
-        {
-            active = false;
-            return;
-        }
-        static constexpr auto decoded = decodeInstructionWords(static_cast<uint32_t>(word),
-                                                        static_cast<uint32_t>(word >> 32u), unit);
-        ended = vu.runDecodedPair<true>(decoded, budgetEnd, vu.m_cachedCodeSize);
-        active = !ended;
-        nextPC += 8u;
-    };
-    (step.template operator()<words>(), ...);
-    return ended;
-}
+#ifdef PS2X_VU_AOT_EXTERN_INCLUDE
+#include PS2X_VU_AOT_EXTERN_INCLUDE
+#endif
 
 VU1Interpreter::CompiledBlock VU1Interpreter::findCompiledBlock(
     const uint8_t *code, uint32_t size, Unit unit)
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_detail.h b/ps2xRuntime/src/lib/vu/ps2_vu1_detail.h
index ecb38818c..373db3b71 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_detail.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_detail.h
@@ -18,21 +18,21 @@
 #endif
 
 // Instruction field extraction helpers
-static constexpr uint8_t DEST(uint32_t i) { return (uint8_t)((i >> 21) & 0xF); }
-static constexpr uint8_t FT(uint32_t i) { return (uint8_t)((i >> 16) & 0x1F); }
-static constexpr uint8_t FS(uint32_t i) { return (uint8_t)((i >> 11) & 0x1F); }
-static constexpr uint8_t FD(uint32_t i) { return (uint8_t)((i >> 6) & 0x1F); }
-static constexpr uint8_t BC(uint32_t i) { return (uint8_t)(i & 0x3); }
+inline constexpr uint8_t DEST(uint32_t i) { return (uint8_t)((i >> 21) & 0xF); }
+inline constexpr uint8_t FT(uint32_t i) { return (uint8_t)((i >> 16) & 0x1F); }
+inline constexpr uint8_t FS(uint32_t i) { return (uint8_t)((i >> 11) & 0x1F); }
+inline constexpr uint8_t FD(uint32_t i) { return (uint8_t)((i >> 6) & 0x1F); }
+inline constexpr uint8_t BC(uint32_t i) { return (uint8_t)(i & 0x3); }
 
 // Lower instruction field helpers
-static constexpr uint8_t LIT(uint32_t i) { return (uint8_t)((i >> 16) & 0x1F); }
-static constexpr uint8_t LIS(uint32_t i) { return (uint8_t)((i >> 11) & 0x1F); }
-static constexpr uint8_t LID(uint32_t i) { return (uint8_t)((i >> 6) & 0x1F); }
-static constexpr uint8_t VIT(uint32_t i) { return (uint8_t)((i >> 16) & 0xF); }
-static constexpr uint8_t VIS(uint32_t i) { return (uint8_t)((i >> 11) & 0xF); }
-static constexpr uint8_t VID(uint32_t i) { return (uint8_t)((i >> 6) & 0xF); }
-static constexpr int16_t IMM11(uint32_t i) { return (int16_t)(int32_t)((int32_t)(i << 21) >> 21); }
-static constexpr int16_t IMM15(uint32_t i)
+inline constexpr uint8_t LIT(uint32_t i) { return (uint8_t)((i >> 16) & 0x1F); }
+inline constexpr uint8_t LIS(uint32_t i) { return (uint8_t)((i >> 11) & 0x1F); }
+inline constexpr uint8_t LID(uint32_t i) { return (uint8_t)((i >> 6) & 0x1F); }
+inline constexpr uint8_t VIT(uint32_t i) { return (uint8_t)((i >> 16) & 0xF); }
+inline constexpr uint8_t VIS(uint32_t i) { return (uint8_t)((i >> 11) & 0xF); }
+inline constexpr uint8_t VID(uint32_t i) { return (uint8_t)((i >> 6) & 0xF); }
+inline constexpr int16_t IMM11(uint32_t i) { return (int16_t)(int32_t)((int32_t)(i << 21) >> 21); }
+inline constexpr int16_t IMM15(uint32_t i)
 {
     uint32_t lo11 = i & 0x7FF;
     uint32_t hi4 = (i >> 21) & 0xF;
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl
new file mode 100644
index 000000000..7e5c6f696
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl
@@ -0,0 +1,1539 @@
+#ifndef PS2_VU1_EXEC_INL
+#define PS2_VU1_EXEC_INL
+
+#include "runtime/ps2_vu1.h"
+#include "runtime/gs/ps2_gif_arbiter.h"
+#include "runtime/gs/gs_frontend.h"
+#include "runtime/ps2_memory.h"
+#include "ps2_vu1_detail.h"
+#include <algorithm>
+#include <bit>
+#include <cmath>
+#include <cstring>
+#include <limits>
+#include <ps2_log.h>
+
+namespace ps2_vu_detail {
+    inline constexpr uint8_t laneForComponent(uint32_t component)
+    {
+        return static_cast<uint8_t>(1u << (3u - component));
+    }
+
+    template <typename Entry, size_t Size>
+    Entry *allocatePipelineEntry(std::array<Entry, Size> &entries, uint32_t &active)
+    {
+        static_assert(Size < 32u);
+        const uint32_t available = ~active & ((1u << Size) - 1u);
+        if (available == 0u)
+            return nullptr;
+        const unsigned index = std::countr_zero(available);
+        active |= 1u << index;
+        return &entries[index];
+    }
+
+    template <size_t Size>
+    uint32_t pipelineCycleMask(uint64_t cycle)
+    {
+        static_assert(Size >= 8u && (Size & (Size - 1u)) == 0u);
+        return 3u << (2u * (cycle & (Size / 2u - 1u)));
+    }
+
+    template <typename Entry, size_t Size>
+    Entry *allocateScheduledEntry(std::array<Entry, Size> &entries,
+                                  uint32_t &active, uint64_t readyCycle)
+    {
+        // A pair issues at most two writes for any of these result cycles.
+        const uint32_t available = ~active & pipelineCycleMask<Size>(readyCycle);
+        if (available == 0u)
+            return nullptr;
+        const unsigned index = std::countr_zero(available);
+        active |= 1u << index;
+        return &entries[index];
+    }
+}
+using ps2_vu_detail::laneForComponent;
+using ps2_vu_detail::allocatePipelineEntry;
+using ps2_vu_detail::allocateScheduledEntry;
+
+constexpr void VU1Interpreter::addVfRead(InstructionUsage &usage, uint8_t reg, uint8_t lanes)
+{
+    if (lanes == 0u)
+        return;
+    for (uint32_t index = 0; index < usage.vfReadCount; ++index)
+    {
+        if (usage.vfRead[index].reg == reg)
+        {
+            usage.vfRead[index].lanes |= lanes;
+            return;
+        }
+    }
+    if (usage.vfReadCount < usage.vfRead.size())
+        usage.vfRead[usage.vfReadCount++] = {reg, lanes};
+}
+
+constexpr void VU1Interpreter::addVfWrite(InstructionUsage &usage, uint8_t reg, uint8_t lanes)
+{
+    if (reg == 0u || lanes == 0u)
+        return;
+    if (usage.vfWrite.reg == 0u)
+        usage.vfWrite = {reg, lanes};
+    else if (usage.vfWrite.reg == reg)
+        usage.vfWrite.lanes |= lanes;
+}
+
+constexpr uint8_t VU1Interpreter::vfReadLanes(const InstructionUsage &usage, uint8_t reg)
+{
+    for (uint32_t index = 0; index < usage.vfReadCount; ++index)
+    {
+        if (usage.vfRead[index].reg == reg)
+            return usage.vfRead[index].lanes;
+    }
+    return 0u;
+}
+
+inline float VU1Interpreter::broadcast(const float *vf, uint8_t bc)
+{
+    return normalizeOperand(vf[bc & 3u]);
+}
+
+inline float VU1Interpreter::normalizeOperand(float value) const
+{
+    uint32_t bits = 0;
+    std::memcpy(&bits, &value, sizeof(bits));
+    const uint32_t exponent = (bits >> 23) & 0xFFu;
+    if (exponent == 0u)
+    {
+        bits &= 0x80000000u;
+    }
+    else if (exponent == 0xFFu)
+    {
+        bits = (bits & 0x80000000u) | 0x7F7FFFFFu;
+    }
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+inline float VU1Interpreter::normalizeResult(float value, uint32_t &laneFlags) const
+{
+    uint32_t bits = 0;
+    std::memcpy(&bits, &value, sizeof(bits));
+    const uint32_t sign = bits & 0x80000000u;
+    const uint32_t magnitude = bits & 0x7FFFFFFFu;
+    const uint32_t exponent = (bits >> 23) & 0xFFu;
+
+    laneFlags = sign != 0u ? 0x2u : 0u;
+    if (magnitude == 0u)
+    {
+        laneFlags |= 0x1u;
+    }
+    else if (exponent == 0u)
+    {
+        laneFlags |= 0x5u;
+        bits = sign;
+    }
+    else if (exponent == 0xFFu)
+    {
+        laneFlags |= 0x8u;
+        bits = sign | 0x7F7FFFFFu;
+    }
+
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+inline uint32_t VU1Interpreter::microAddressMask() const
+{
+    return m_unit == Unit::VU1 ? 0x3FFFu : 0x0FFFu;
+}
+
+inline int32_t VU1Interpreter::readBranchVi(uint8_t reg) const
+{
+    if (reg == 0u)
+        return 0;
+    if (m_viBranchBackupValid &&
+        m_viBranchBackupReg == reg)
+    {
+        return m_viBranchBackupValue;
+    }
+    return m_state.vi[reg];
+}
+
+inline void VU1Interpreter::recordViWriteForBranch(uint8_t reg, int32_t oldValue)
+{
+    if (reg == 0u)
+        return;
+    m_viBranchBackupValue = oldValue;
+    m_viBranchBackupReg = reg;
+    m_viBranchBackupValid = true;
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::applyDest(float *dst, const float *result, uint8_t dest)
+{
+    if (dest & 0x8u)
+        dst[0] = result[0];
+    if (dest & 0x4u)
+        dst[1] = result[1];
+    if (dest & 0x2u)
+        dst[2] = result[2];
+    if (dest & 0x1u)
+        dst[3] = result[3];
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::applyDestAcc(const float *result, uint8_t dest)
+{
+    applyDest(m_state.acc, result, dest);
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::normalizeFmacResult(float *result, uint8_t dest,
+                                         uint8_t laneFlags[4])
+{
+    const uint32_t upper = m_currentUpperInstruction;
+    const uint32_t op = (upper & 0x3fu) < 0x3cu
+        ? upper & 0x3fu : (upper & 3u) | ((upper >> 4u) & 0x7cu);
+    const bool simpleArithmetic = op <= 7u || (op >= 0x18u && op <= 0x1cu) ||
+        op == 0x1eu || op == 0x20u || op == 0x22u || op == 0x24u ||
+        op == 0x26u || op == 0x28u || op == 0x2au || op == 0x2cu;
+    for (uint32_t component = 0; component < 4u; ++component)
+    {
+        laneFlags[component] = 0u;
+        if ((dest & laneForComponent(component)) == 0u)
+            continue;
+
+        // A normal ADD/SUB/MUL result has only a sign flag. Keep exact checks
+        // at both range boundaries, including overflow rounded to FLT_MAX.
+        uint32_t bits;
+        std::memcpy(&bits, &result[component], sizeof(bits));
+        const uint32_t magnitude = bits & 0x7fffffffu;
+        if (simpleArithmetic && magnitude >= 0x00800000u && magnitude < 0x7f7fffffu)
+        {
+            laneFlags[component] = static_cast<uint8_t>((bits >> 30u) & 2u);
+            continue;
+        }
+
+        long double exactResult = 0.0L;
+        if (calculateFmacExactResult(component, exactResult))
+        {
+            laneFlags[component] = normalizeFmacExactResult(result[component], exactResult);
+            continue;
+        }
+
+        uint32_t flags = 0u;
+        result[component] = normalizeResult(result[component], flags);
+        laneFlags[component] = static_cast<uint8_t>(flags);
+    }
+}
+
+PS2_VU_FORCE_INLINE bool VU1Interpreter::calculateFmacExactResult(uint32_t component,
+                                               long double &result) const
+{
+    const uint32_t upper = m_currentUpperInstruction;
+    const uint8_t op = static_cast<uint8_t>(upper & 0x3Fu);
+    const uint8_t special = op >= 0x3Cu
+                                ? static_cast<uint8_t>((upper & 3u) | ((upper >> 4) & 0x7Cu))
+                                : 0xFFu;
+    const uint8_t fs = FS(upper);
+    const uint8_t ft = FT(upper);
+
+    const auto operand = [this](float value)
+    {
+        return static_cast<long double>(normalizeOperand(value));
+    };
+    const auto vs = [&](uint32_t lane)
+    {
+        return operand(m_state.vf[fs][lane]);
+    };
+    const auto vt = [&](uint32_t lane)
+    {
+        return operand(m_state.vf[ft][lane]);
+    };
+    const auto acc = [&](uint32_t lane)
+    {
+        return operand(m_state.acc[lane]);
+    };
+
+    const long double q = operand(m_state.q);
+    const long double i = operand(m_state.i);
+
+    if (op < 0x3Cu)
+    {
+        if (op <= 0x03u)
+            result = vs(component) + vt(op & 3u);
+        else if (op <= 0x07u)
+            result = vs(component) - vt(op & 3u);
+        else if (op <= 0x0Bu)
+            result = acc(component) + vs(component) * vt(op & 3u);
+        else if (op <= 0x0Fu)
+            result = acc(component) - vs(component) * vt(op & 3u);
+        else if (op >= 0x18u && op <= 0x1Bu)
+            result = vs(component) * vt(op & 3u);
+        else
+        {
+            switch (op)
+            {
+            case 0x1Cu:
+                result = vs(component) * q;
+                break;
+            case 0x1Eu:
+                result = vs(component) * i;
+                break;
+            case 0x20u:
+                result = vs(component) + q;
+                break;
+            case 0x21u:
+                result = acc(component) + vs(component) * q;
+                break;
+            case 0x22u:
+                result = vs(component) + i;
+                break;
+            case 0x23u:
+                result = acc(component) + vs(component) * i;
+                break;
+            case 0x24u:
+                result = vs(component) - q;
+                break;
+            case 0x25u:
+                result = acc(component) - vs(component) * q;
+                break;
+            case 0x26u:
+                result = vs(component) - i;
+                break;
+            case 0x27u:
+                result = acc(component) - vs(component) * i;
+                break;
+            case 0x28u:
+                result = vs(component) + vt(component);
+                break;
+            case 0x29u:
+                result = acc(component) + vs(component) * vt(component);
+                break;
+            case 0x2Au:
+                result = vs(component) * vt(component);
+                break;
+            case 0x2Cu:
+                result = vs(component) - vt(component);
+                break;
+            case 0x2Du:
+                result = acc(component) - vs(component) * vt(component);
+                break;
+            case 0x2Eu:
+            {
+                static constexpr uint8_t left[4] = {1u, 2u, 0u, 3u};
+                static constexpr uint8_t right[4] = {2u, 0u, 1u, 3u};
+                result = component == 3u
+                             ? 0.0L
+                             : acc(component) - vs(left[component]) * vt(right[component]);
+                break;
+            }
+            default:
+                return false;
+            }
+        }
+        return true;
+    }
+
+    if (special <= 0x03u)
+        result = vs(component) + vt(special & 3u);
+    else if (special <= 0x07u)
+        result = vs(component) - vt(special & 3u);
+    else if (special <= 0x0Bu)
+        result = acc(component) + vs(component) * vt(special & 3u);
+    else if (special <= 0x0Fu)
+        result = acc(component) - vs(component) * vt(special & 3u);
+    else if (special >= 0x18u && special <= 0x1Bu)
+        result = vs(component) * vt(special & 3u);
+    else
+    {
+        switch (special)
+        {
+        case 0x1Cu:
+            result = vs(component) * q;
+            break;
+        case 0x1Eu:
+            result = vs(component) * i;
+            break;
+        case 0x20u:
+            result = vs(component) + q;
+            break;
+        case 0x21u:
+            result = acc(component) + vs(component) * q;
+            break;
+        case 0x22u:
+            result = vs(component) + i;
+            break;
+        case 0x23u:
+            result = acc(component) + vs(component) * i;
+            break;
+        case 0x24u:
+            result = vs(component) - q;
+            break;
+        case 0x25u:
+            result = acc(component) - vs(component) * q;
+            break;
+        case 0x26u:
+            result = vs(component) - i;
+            break;
+        case 0x27u:
+            result = acc(component) - vs(component) * i;
+            break;
+        case 0x28u:
+            result = vs(component) + vt(component);
+            break;
+        case 0x29u:
+            result = acc(component) + vs(component) * vt(component);
+            break;
+        case 0x2Au:
+            result = vs(component) * vt(component);
+            break;
+        case 0x2Cu:
+            result = vs(component) - vt(component);
+            break;
+        case 0x2Du:
+            result = acc(component) - vs(component) * vt(component);
+            break;
+        case 0x2Eu:
+        {
+            static constexpr uint8_t left[4] = {1u, 2u, 0u, 3u};
+            static constexpr uint8_t right[4] = {2u, 0u, 1u, 3u};
+            result = component == 3u
+                         ? 0.0L
+                         : vs(left[component]) * vt(right[component]);
+            break;
+        }
+        default:
+            return false;
+        }
+    }
+    return true;
+}
+
+PS2_VU_FORCE_INLINE uint8_t VU1Interpreter::normalizeFmacExactResult(float &value,
+                                                  long double exactResult) const
+{
+    const bool negative = std::signbit(exactResult);
+    const long double magnitude = std::fabs(exactResult);
+    const long double maximum = static_cast<long double>(std::numeric_limits<float>::max());
+    const long double minimum = static_cast<long double>(std::numeric_limits<float>::min());
+    uint8_t flags = negative ? 0x2u : 0u;
+
+    uint32_t bits = negative ? 0x80000000u : 0u;
+    if (magnitude == 0.0L)
+    {
+        flags |= 0x1u;
+        std::memcpy(&value, &bits, sizeof(value));
+    }
+    else if (magnitude > maximum)
+    {
+        flags |= 0x8u;
+        bits |= 0x7F7FFFFFu;
+        std::memcpy(&value, &bits, sizeof(value));
+    }
+    else if (magnitude < minimum)
+    {
+        flags |= 0x5u;
+        std::memcpy(&value, &bits, sizeof(value));
+    }
+
+    return flags;
+}
+
+PS2_VU_FORCE_INLINE uint32_t VU1Interpreter::calculateFmacProductSticky(uint8_t dest) const
+{
+    uint32_t extraSticky = 0u;
+    const uint32_t upper = m_currentUpperInstruction;
+    const uint8_t op = static_cast<uint8_t>(upper & 0x3Fu);
+    const uint8_t special = op >= 0x3Cu ? static_cast<uint8_t>((upper & 3u) | ((upper >> 4) & 0x7Cu)) : 0xFFu;
+    const bool productSum =
+        (op >= 0x08u && op <= 0x0Fu) ||
+        op == 0x21u || op == 0x23u || op == 0x25u || op == 0x27u ||
+        op == 0x29u || op == 0x2Du || op == 0x2Eu ||
+        (special >= 0x08u && special <= 0x0Fu) ||
+        special == 0x21u || special == 0x23u || special == 0x25u ||
+        special == 0x27u || special == 0x29u || special == 0x2Du;
+    if (!productSum)
+        return 0u;
+
+    const uint8_t fs = FS(upper);
+    const uint8_t ft = FT(upper);
+    for (uint32_t component = 0; component < 4u; ++component)
+    {
+        if ((dest & laneForComponent(component)) == 0u)
+            continue;
+        static constexpr uint8_t crossLeft[4] = {1u, 2u, 0u, 3u};
+        static constexpr uint8_t crossRight[4] = {2u, 0u, 1u, 3u};
+        const uint8_t leftComponent = op == 0x2Eu ? crossLeft[component] : static_cast<uint8_t>(component);
+        const float left = normalizeOperand(m_state.vf[fs][leftComponent]);
+        float right = 0.0f;
+        if ((op >= 0x08u && op <= 0x0Fu) || (special >= 0x08u && special <= 0x0Fu))
+        {
+            right = normalizeOperand(m_state.vf[ft][(op >= 0x08u && op <= 0x0Fu ? op : special) & 3u]);
+        }
+        else if (op == 0x21u || op == 0x25u || special == 0x21u || special == 0x25u)
+        {
+            right = normalizeOperand(m_state.q);
+        }
+        else if (op == 0x23u || op == 0x27u || special == 0x23u || special == 0x27u)
+        {
+            right = normalizeOperand(m_state.i);
+        }
+        else if (op == 0x2Eu)
+        {
+            right = normalizeOperand(m_state.vf[ft][crossRight[component]]);
+        }
+        else
+        {
+            right = normalizeOperand(m_state.vf[ft][component]);
+        }
+
+        float product = left * right;
+        uint32_t productBits;
+        std::memcpy(&productBits, &product, sizeof(productBits));
+        const uint32_t magnitude = productBits & 0x7fffffffu;
+        if (magnitude >= 0x00800000u && magnitude < 0x7f7fffffu)
+        {
+            extraSticky |= (productBits >> 30u) & 2u;
+            continue;
+        }
+        const long double exactProduct = static_cast<long double>(left) * static_cast<long double>(right);
+        const uint8_t productFlags = normalizeFmacExactResult(product, exactProduct);
+        // Product-sum instructions report Z/S/U/O from the add/subtract result
+        // as current flags, while every product condition accumulates into the
+        // corresponding sticky flag.
+        extraSticky |= productFlags & 0xFu;
+    }
+    return extraSticky;
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::updateFmacFlags(const uint8_t laneFlags[4], uint8_t dest,
+                                     uint32_t extraSticky)
+{
+    if (dest == 0u)
+        return;
+
+    uint32_t mac = 0u;
+    uint32_t status = 0u;
+    for (uint32_t component = 0; component < 4u; ++component)
+    {
+        const uint8_t lane = laneForComponent(component);
+        if ((dest & lane) == 0u)
+            continue;
+
+        const uint32_t flags = laneFlags[component];
+        if ((flags & 0x1u) != 0u)
+            mac |= lane;
+        if ((flags & 0x2u) != 0u)
+            mac |= static_cast<uint32_t>(lane) << 4;
+        if ((flags & 0x4u) != 0u)
+            mac |= static_cast<uint32_t>(lane) << 8;
+        if ((flags & 0x8u) != 0u)
+            mac |= static_cast<uint32_t>(lane) << 12;
+        status |= flags;
+    }
+
+    FlagPipelineEntry *entry = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency);
+    if (!entry)
+    {
+        reportReservedInstruction(true, 0xFFFFFFFFu);
+        return;
+    }
+
+    *entry = {};
+    entry->valid = true;
+    entry->issueCycle = m_cycle;
+    entry->readyCycle = m_cycle + kFmacLatency;
+    entry->mac = mac;
+    entry->status = status;
+    entry->extraSticky = extraSticky;
+    entry->writesMac = true;
+    entry->writesStatus = true;
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::applyFmacDest(float *dst, float *result, uint8_t dest)
+{
+    uint8_t laneFlags[4]{};
+    normalizeFmacResult(result, dest, laneFlags);
+    updateFmacFlags(laneFlags, dest, calculateFmacProductSticky(dest));
+    applyDest(dst, result, dest);
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::applyFmacDestAcc(float *result, uint8_t dest)
+{
+    uint8_t laneFlags[4]{};
+    normalizeFmacResult(result, dest, laneFlags);
+    updateFmacFlags(laneFlags, dest, calculateFmacProductSticky(dest));
+    applyDestAcc(result, dest);
+}
+
+inline void VU1Interpreter::queueFsset(uint16_t immediate)
+{
+    for (uint32_t active = m_activeFlags; active != 0u; active &= active - 1u)
+    {
+        auto &entry = m_flagPipeline[std::countr_zero(active)];
+        if (entry.issueCycle == m_cycle)
+            entry.writesStatus = false;
+    }
+
+    if (auto *slot = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency))
+    {
+        auto &entry = *slot;
+        entry = {};
+        entry.valid = true;
+        entry.issueCycle = m_cycle;
+        entry.readyCycle = m_cycle + kFmacLatency;
+        entry.status = static_cast<uint32_t>(immediate) & 0xFC0u;
+        entry.writesSticky = true;
+        return;
+    }
+    reportReservedInstruction(false, 0xFFFFFFFEu);
+}
+
+inline void VU1Interpreter::queueClip(uint32_t clip)
+{
+    m_workingClip = ((m_workingClip << 6) | (clip & 0x3Fu)) & 0xFFFFFFu;
+    if (auto *slot = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency))
+    {
+        auto &entry = *slot;
+        entry = {};
+        entry.valid = true;
+        entry.issueCycle = m_cycle;
+        entry.readyCycle = m_cycle + kFmacLatency;
+        entry.clip = m_workingClip;
+        entry.writesClip = true;
+        return;
+    }
+    reportReservedInstruction(true, 0xFFFFFFFDu);
+}
+
+inline void VU1Interpreter::queueFcset(uint32_t clip)
+{
+    m_workingClip = clip & 0xFFFFFFu;
+    for (uint32_t active = m_activeFlags; active != 0u; active &= active - 1u)
+    {
+        auto &entry = m_flagPipeline[std::countr_zero(active)];
+        if (entry.issueCycle == m_cycle)
+            entry.writesClip = false;
+    }
+    if (auto *slot = allocateScheduledEntry(m_flagPipeline, m_activeFlags, m_cycle + kFmacLatency))
+    {
+        auto &entry = *slot;
+        entry = {};
+        entry.valid = true;
+        entry.issueCycle = m_cycle;
+        entry.readyCycle = m_cycle + kFmacLatency;
+        entry.clip = m_workingClip;
+        entry.writesClip = true;
+        return;
+    }
+    reportReservedInstruction(false, 0xFFFFFFFAu);
+}
+
+inline void VU1Interpreter::queueQ(float value, uint32_t latency, uint32_t statusDi)
+{
+    uint32_t ignoredFlags = 0u;
+    value = normalizeResult(value, ignoredFlags);
+    m_fdiv.valid = true;
+    m_fdiv.readyCycle = m_cycle + latency;
+    m_fdiv.value = value;
+    m_fdiv.statusDi = statusDi & 0x30u;
+}
+
+inline void VU1Interpreter::queueP(float value, uint32_t latency)
+{
+    uint32_t ignoredFlags = 0u;
+    value = normalizeResult(value, ignoredFlags);
+    for (ScalarPipelineEntry &entry : m_efu)
+    {
+        if (!entry.valid)
+        {
+            entry.valid = true;
+            entry.readyCycle = m_cycle + latency;
+            entry.value = value;
+            // EFU throughput is one cycle shorter than result visibility.
+            m_efuResourceReady = m_cycle + (latency > 0u ? latency - 1u : 0u);
+            return;
+        }
+    }
+    reportReservedInstruction(false, 0xFFFFFFF9u);
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::queueStore(uint32_t address, const uint32_t words[4], uint8_t laneMask)
+{
+    // Every pair advances one cycle before returning or progressing PATH1.
+    // No observer runs between a store and that mandatory one-cycle retirement.
+    if (!m_activeVuData || address + 16ull > m_activeVuDataSize)
+        return;
+    for (uint32_t component = 0; component < 4u; ++component)
+        if ((laneMask & laneForComponent(component)) != 0u)
+            std::memcpy(m_activeVuData + address + component * 4u,
+                        words + component, sizeof(uint32_t));
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::queueVfWrite(uint8_t reg, uint8_t laneMask,
+                                  const float value[4], uint32_t latency)
+{
+    if (reg == 0u || laneMask == 0u)
+        return;
+    if (auto *slot = allocateScheduledEntry(m_vfWritePipeline, m_activeVfWrites, m_cycle + latency))
+    {
+        auto &write = *slot;
+        write = {};
+        write.valid = true;
+        write.readyCycle = m_cycle + latency;
+        write.sequence = ++m_nextWriteSequence;
+        write.reg = reg;
+        write.laneMask = laneMask;
+        std::copy(value, value + 4, write.value.begin());
+        for (uint32_t component = 0; component < 4u; ++component)
+        {
+            if ((laneMask & laneForComponent(component)) != 0u)
+                m_vfLatestWrite[reg][component] = write.sequence;
+        }
+        return;
+    }
+    reportReservedInstruction(false, 0xFFFFFFF7u);
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::queueViWrite(uint8_t reg, int32_t value, uint32_t latency)
+{
+    if (reg == 0u)
+        return;
+    if (auto *slot = allocateScheduledEntry(m_viWritePipeline, m_activeViWrites, m_cycle + latency))
+    {
+        auto &write = *slot;
+        write = {};
+        write.valid = true;
+        write.readyCycle = m_cycle + latency;
+        write.sequence = ++m_nextWriteSequence;
+        write.reg = reg;
+        write.value = value;
+        m_viLatestWrite[reg] = write.sequence;
+        return;
+    }
+    reportReservedInstruction(false, 0xFFFFFFF6u);
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::queueAccWrite(uint8_t laneMask, const float value[4], uint32_t latency)
+{
+    if (laneMask == 0u)
+        return;
+    if (auto *slot = allocatePipelineEntry(m_accWritePipeline, m_activeAccWrites))
+    {
+        auto &write = *slot;
+        write = {};
+        write.valid = true;
+        write.readyCycle = m_cycle + latency;
+        write.sequence = ++m_nextWriteSequence;
+        write.laneMask = laneMask;
+        std::copy(value, value + 4, write.value.begin());
+        for (uint32_t component = 0; component < 4u; ++component)
+        {
+            if ((laneMask & laneForComponent(component)) != 0u)
+                m_accLatestWrite[component] = write.sequence;
+        }
+        return;
+    }
+    reportReservedInstruction(true, 0xFFFFFFF5u);
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::advanceOneCycle()
+{
+    ++m_cycle;
+    m_state.cycles = m_cycle;
+    // LSU commits become visible at the cycle boundary before PATH1 consumes
+    // its next qword from VU memory.
+    commitReadyPipelines();
+    if (m_xgkick.active)
+        progressXgkick();
+}
+
+inline void VU1Interpreter::advanceTo(uint64_t targetCycle)
+{
+    while (m_cycle < targetCycle)
+        advanceOneCycle();
+}
+
+PS2_VU_FORCE_INLINE uint64_t VU1Interpreter::calculatePairReadyCycleInline(const DecodedInstructionPair &decoded) const
+{
+    uint64_t ready = m_cycle;
+    const auto checkUsage = [&](const InstructionUsage &usage) PS2_VU_INLINE_LAMBDA
+    {
+        for (uint32_t index = 0; index < usage.vfReadCount; ++index)
+        {
+            const VfAccess &access = usage.vfRead[index];
+            for (uint32_t component = 0; component < 4u; ++component)
+            {
+                if ((access.lanes & laneForComponent(component)) != 0u)
+                    ready = std::max(ready, m_vfReady[access.reg][component]);
+            }
+        }
+        for (uint32_t reads = usage.viRead & 0xFFFEu; reads != 0u; reads &= reads - 1u)
+        {
+            const unsigned reg = std::countr_zero(reads);
+            ready = std::max(ready, m_viReady[reg]);
+        }
+        for (uint32_t component = 0; component < 4u; ++component)
+        {
+            if ((usage.accRead & laneForComponent(component)) != 0u)
+                ready = std::max(ready, m_accReady[component]);
+        }
+    };
+    // Separate calls keep each constexpr usage visible in native blocks.
+    checkUsage(decoded.upperUsage);
+    checkUsage(decoded.lowerUsage);
+
+    if (decoded.lowerUsage.pipeline == PipelineFdiv && m_fdiv.valid)
+        ready = std::max(ready, m_fdiv.readyCycle);
+    if (decoded.lowerUsage.pipeline == PipelineEfu)
+        ready = std::max(ready, m_efuResourceReady);
+    if (decoded.lowerUsage.waitQ && m_fdiv.valid)
+        ready = std::max(ready, m_fdiv.readyCycle);
+    if (decoded.lowerUsage.waitP)
+    {
+        for (const ScalarPipelineEntry &entry : m_efu)
+            if (entry.valid)
+                ready = std::max(ready, entry.readyCycle);
+    }
+    if (decoded.lowerUsage.pipeline == PipelineXgkick && m_xgkick.active)
+        ready = std::max(ready, m_cycle + 1u);
+    return ready;
+}
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::markPairWritesInline(const DecodedInstructionPair &decoded)
+{
+    const VfAccess lowerWrite = decoded.lowerUsage.vfWrite;
+    if (lowerWrite.reg != 0u &&
+        decoded.suppressedLowerVf != lowerWrite.reg)
+    {
+        const uint32_t latency = decoded.lowerUsage.vfLatency != 0u
+                                     ? decoded.lowerUsage.vfLatency
+                                     : decoded.lowerUsage.latency;
+        for (uint32_t component = 0; component < 4u; ++component)
+        {
+            if ((lowerWrite.lanes & laneForComponent(component)) != 0u)
+                m_vfReady[lowerWrite.reg][component] = m_cycle + latency;
+        }
+    }
+
+    const VfAccess upperWrite = decoded.upperUsage.vfWrite;
+    if (upperWrite.reg != 0u)
+    {
+        const uint32_t latency = decoded.upperUsage.vfLatency != 0u
+                                     ? decoded.upperUsage.vfLatency
+                                     : decoded.upperUsage.latency;
+        for (uint32_t component = 0; component < 4u; ++component)
+        {
+            if ((upperWrite.lanes & laneForComponent(component)) != 0u)
+                m_vfReady[upperWrite.reg][component] = m_cycle + latency;
+        }
+    }
+
+    for (uint32_t writes = decoded.lowerUsage.viWrite & 0xFFFEu; writes != 0u; writes &= writes - 1u)
+    {
+        const unsigned reg = std::countr_zero(writes);
+        m_viReady[reg] = m_cycle + (decoded.lowerUsage.viLatency != 0u ? decoded.lowerUsage.viLatency : decoded.lowerUsage.latency);
+    }
+    for (uint32_t component = 0; component < 4u; ++component)
+    {
+        if ((decoded.upperUsage.accWrite & laneForComponent(component)) != 0u)
+            m_accReady[component] = m_cycle + kAccForwardLatency;
+    }
+}
+
+constexpr VU1Interpreter::InstructionUsage VU1Interpreter::decodeUpperUsage(uint32_t upper)
+{
+    InstructionUsage usage;
+    usage.pipeline = PipelineFmac;
+    usage.latency = kFmacLatency;
+
+    const uint8_t op = static_cast<uint8_t>(upper & 0x3Fu);
+    const uint8_t dest = DEST(upper);
+    const uint8_t fs = FS(upper);
+    const uint8_t ft = FT(upper);
+    const uint8_t fd = FD(upper);
+
+    if (op <= 0x2Fu)
+    {
+        addVfRead(usage, fs, dest);
+        addVfWrite(usage, fd, dest);
+        if (op <= 0x1Bu)
+            addVfRead(usage, ft, laneForComponent(op & 3u));
+        else if (op >= 0x28u)
+            addVfRead(usage, ft, op == 0x2Eu ? 0xEu : dest);
+        if (op == 0x08u || op == 0x09u || op == 0x0Au || op == 0x0Bu ||
+            op == 0x0Cu || op == 0x0Du || op == 0x0Eu || op == 0x0Fu ||
+            op == 0x21u || op == 0x23u || op == 0x25u || op == 0x27u ||
+            op == 0x29u || op == 0x2Du || op == 0x2Eu)
+        {
+            usage.accRead = dest;
+        }
+        return usage;
+    }
+
+    if (op >= 0x3Cu)
+    {
+        const uint8_t special = static_cast<uint8_t>((upper & 3u) | ((upper >> 4) & 0x7Cu));
+        const bool writesAcc =
+            special <= 0x0Fu ||
+            (special >= 0x18u && special <= 0x1Cu) ||
+            special == 0x1Eu ||
+            (special >= 0x20u && special <= 0x2Au) ||
+            (special >= 0x2Cu && special <= 0x2Eu);
+        if (writesAcc)
+        {
+            addVfRead(usage, fs, dest);
+            if (special <= 0x1Bu)
+                addVfRead(usage, ft, laneForComponent(special & 3u));
+            else if ((special >= 0x28u && special <= 0x2Eu))
+                addVfRead(usage, ft, special == 0x2Eu ? 0xEu : dest);
+            usage.accWrite = dest;
+            if ((special >= 0x08u && special <= 0x0Fu) ||
+                special == 0x21u || special == 0x23u || special == 0x25u ||
+                special == 0x27u || special == 0x29u || special == 0x2Du)
+            {
+                usage.accRead = dest;
+            }
+        }
+        else if (special >= 0x10u && special <= 0x17u)
+        {
+            addVfRead(usage, fs, dest);
+            addVfWrite(usage, ft, dest);
+        }
+        else if (special == 0x1Du)
+        {
+            addVfRead(usage, fs, dest);
+            addVfWrite(usage, ft, dest);
+        }
+        else if (special == 0x1Fu)
+        {
+            addVfRead(usage, fs, 0xEu);
+            addVfRead(usage, ft, 0x1u);
+            usage.writesClip = true;
+        }
+        else if (special != 0x2Fu && special != 0x30u)
+        {
+            usage.reserved = true;
+        }
+        return usage;
+    }
+
+    usage.reserved = true;
+    return usage;
+}
+
+constexpr VU1Interpreter::InstructionUsage VU1Interpreter::decodeLowerUsage(uint32_t lower, Unit unit)
+{
+    InstructionUsage usage;
+    if (lower == 0u || lower == 0x8000033Cu)
+        return usage;
+
+    const uint8_t opHi = static_cast<uint8_t>((lower >> 25) & 0x7Fu);
+    const uint8_t vfT = FT(lower);
+    const uint8_t vfS = FS(lower);
+    const uint8_t viT = VIT(lower);
+    const uint8_t viS = VIS(lower);
+    const uint8_t viD = VID(lower);
+    const uint8_t dest = DEST(lower);
+    auto readVi = [&](uint8_t reg)
+    {
+        if (reg != 0u)
+            usage.viRead |= static_cast<uint16_t>(1u << reg);
+    };
+    auto writeVi = [&](uint8_t reg)
+    {
+        if (reg != 0u)
+            usage.viWrite |= static_cast<uint16_t>(1u << reg);
+    };
+
+    switch (opHi)
+    {
+    case 0x00:
+        usage.pipeline = PipelineLsu;
+        usage.latency = 4u;
+        readVi(viS);
+        addVfWrite(usage, vfT, dest);
+        return usage;
+    case 0x01:
+        usage.pipeline = PipelineLsu;
+        usage.latency = 1u;
+        readVi(viT);
+        addVfRead(usage, vfS, dest);
+        return usage;
+    case 0x04:
+        usage.pipeline = PipelineLsu;
+        usage.latency = 4u;
+        readVi(viS);
+        writeVi(viT);
+        return usage;
+    case 0x05:
+        usage.pipeline = PipelineLsu;
+        usage.latency = 1u;
+        readVi(viS);
+        readVi(viT);
+        return usage;
+    case 0x08:
+    case 0x09:
+        usage.pipeline = PipelineIalu;
+        usage.latency = 1u;
+        usage.delaysNextBranchRead = true;
+        readVi(viS);
+        writeVi(viT);
+        return usage;
+    case 0x10:
+    case 0x12:
+    case 0x13:
+        usage.pipeline = PipelineIalu;
+        usage.latency = 1u;
+        usage.readsClip = true;
+        writeVi(1u);
+        return usage;
+    case 0x11:
+        usage.pipeline = PipelineFmac;
+        usage.latency = kFmacLatency;
+        usage.writesClip = true;
+        return usage;
+    case 0x14:
+    case 0x16:
+    case 0x17:
+        usage.pipeline = PipelineIalu;
+        usage.latency = 1u;
+        writeVi(viT);
+        return usage;
+    case 0x15:
+        usage.pipeline = PipelineFmac;
+        usage.latency = kFmacLatency;
+        return usage;
+    case 0x18:
+    case 0x1A:
+    case 0x1B:
+        usage.pipeline = PipelineIalu;
+        usage.latency = 1u;
+        readVi(viS);
+        writeVi(viT);
+        return usage;
+    case 0x1C:
+        usage.pipeline = PipelineIalu;
+        usage.latency = 1u;
+        usage.readsClip = true;
+        writeVi(viT);
+        return usage;
+    case 0x20:
+        usage.pipeline = PipelineBranch;
+        return usage;
+    case 0x21:
+        usage.pipeline = PipelineBranch;
+        usage.latency = 1u;
+        writeVi(viT);
+        return usage;
+    case 0x24:
+        usage.pipeline = PipelineBranch;
+        readVi(viS);
+        return usage;
+    case 0x25:
+        usage.pipeline = PipelineBranch;
+        usage.latency = 1u;
+        readVi(viS);
+        writeVi(viT);
+        return usage;
+    case 0x28:
+    case 0x29:
+        usage.pipeline = PipelineBranch;
+        readVi(viS);
+        readVi(viT);
+        return usage;
+    case 0x2C:
+    case 0x2D:
+    case 0x2E:
+    case 0x2F:
+        usage.pipeline = PipelineBranch;
+        readVi(viS);
+        return usage;
+    case 0x40:
+        break;
+    default:
+        usage.reserved = true;
+        return usage;
+    }
+
+    const uint8_t direct = static_cast<uint8_t>(lower & 0x3Fu);
+    if (direct == 0x30u || direct == 0x31u || direct == 0x34u || direct == 0x35u)
+    {
+        usage.pipeline = PipelineIalu;
+        usage.latency = 1u;
+        usage.delaysNextBranchRead = true;
+        readVi(viS);
+        readVi(viT);
+        writeVi(viD);
+        return usage;
+    }
+    if (direct == 0x32u)
+    {
+        usage.pipeline = PipelineIalu;
+        usage.latency = 1u;
+        usage.delaysNextBranchRead = true;
+        readVi(viS);
+        writeVi(viT);
+        return usage;
+    }
+    if (direct < 0x3Cu)
+    {
+        usage.reserved = true;
+        return usage;
+    }
+
+    const uint8_t special = static_cast<uint8_t>((lower & 3u) | ((lower >> 4) & 0x7Cu));
+    switch (special)
+    {
+    case 0x30:
+    case 0x31:
+        usage.pipeline = PipelineFmac;
+        usage.latency = 4u;
+        addVfRead(usage, vfS, special == 0x31u ? 0xFu : dest);
+        addVfWrite(usage, vfT, dest);
+        break;
+    case 0x34:
+    case 0x36:
+        usage.pipeline = PipelineLsu;
+        usage.latency = 4u;
+        usage.viLatency = 1u;
+        usage.delaysNextBranchRead = true;
+        readVi(viS);
+        writeVi(viS);
+        addVfWrite(usage, vfT, dest);
+        break;
+    case 0x35:
+    case 0x37:
+        usage.pipeline = PipelineLsu;
+        usage.latency = 1u;
+        usage.delaysNextBranchRead = true;
+        readVi(viT);
+        writeVi(viT);
+        addVfRead(usage, vfS, dest);
+        break;
+    case 0x38:
+        usage.pipeline = PipelineFdiv;
+        usage.latency = 7u;
+        addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
+        addVfRead(usage, vfT, laneForComponent((lower >> 23) & 3u));
+        break;
+    case 0x39:
+        usage.pipeline = PipelineFdiv;
+        usage.latency = 7u;
+        addVfRead(usage, vfT, laneForComponent((lower >> 23) & 3u));
+        break;
+    case 0x3A:
+        usage.pipeline = PipelineFdiv;
+        usage.latency = 13u;
+        addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
+        addVfRead(usage, vfT, laneForComponent((lower >> 23) & 3u));
+        break;
+    case 0x3B:
+        usage.pipeline = PipelineFdiv;
+        usage.waitQ = true;
+        break;
+    case 0x3C:
+        usage.pipeline = PipelineIalu;
+        usage.latency = 1u;
+        usage.delaysNextBranchRead = true;
+        addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
+        writeVi(viT);
+        break;
+    case 0x3D:
+        usage.pipeline = PipelineFmac;
+        usage.latency = 4u;
+        readVi(viS);
+        addVfWrite(usage, vfT, dest);
+        break;
+    case 0x3E:
+        usage.pipeline = PipelineLsu;
+        usage.latency = 4u;
+        readVi(viS);
+        writeVi(viT);
+        break;
+    case 0x3F:
+        usage.pipeline = PipelineLsu;
+        usage.latency = 1u;
+        readVi(viS);
+        readVi(viT);
+        break;
+    case 0x40:
+    case 0x41:
+        usage.pipeline = PipelineFmac;
+        usage.latency = 4u;
+        addVfWrite(usage, vfT, dest);
+        break;
+    case 0x42:
+    case 0x43:
+        usage.pipeline = PipelineIalu;
+        usage.latency = 1u;
+        addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
+        break;
+    case 0x64:
+        if (unit == Unit::VU0)
+        {
+            usage.reserved = true;
+            break;
+        }
+        usage.pipeline = PipelineFmac;
+        usage.latency = 4u;
+        addVfWrite(usage, vfT, dest);
+        break;
+    case 0x68:
+    case 0x69:
+        usage.pipeline = PipelineIalu;
+        usage.latency = 1u;
+        writeVi(viT);
+        break;
+    case 0x6C:
+        if (unit == Unit::VU0)
+        {
+            usage.reserved = true;
+            break;
+        }
+        usage.pipeline = PipelineXgkick;
+        usage.latency = 2u;
+        readVi(viS);
+        break;
+    case 0x70:
+    case 0x71:
+    case 0x72:
+    case 0x73:
+    case 0x74:
+    case 0x75:
+    case 0x76:
+    case 0x77:
+    case 0x78:
+    case 0x79:
+    case 0x7A:
+    case 0x7C:
+    case 0x7D:
+        if (unit == Unit::VU0)
+        {
+            usage.reserved = true;
+            break;
+        }
+        usage.pipeline = PipelineEfu;
+        switch (special)
+        {
+        case 0x70:
+            usage.latency = 11u;
+            break;
+        case 0x71:
+        case 0x72:
+        case 0x77:
+            usage.latency = 18u;
+            break;
+        case 0x73:
+            usage.latency = 24u;
+            break;
+        case 0x74:
+        case 0x75:
+        case 0x7C:
+            usage.latency = 54u;
+            break;
+        case 0x76:
+        case 0x78:
+        case 0x7A:
+            usage.latency = 12u;
+            break;
+        case 0x79:
+            usage.latency = 29u;
+            break;
+        case 0x7D:
+            usage.latency = 44u;
+            break;
+        default:
+            break;
+        }
+        if (special >= 0x70u && special <= 0x73u)
+            addVfRead(usage, vfS, 0xEu);
+        else if (special == 0x74u)
+            addVfRead(usage, vfS, 0xCu);
+        else if (special == 0x75u)
+            addVfRead(usage, vfS, 0xAu);
+        else if (special == 0x76u)
+            addVfRead(usage, vfS, 0xFu);
+        else
+            addVfRead(usage, vfS, laneForComponent((lower >> 21) & 3u));
+        break;
+    case 0x7B:
+        if (unit == Unit::VU0)
+        {
+            usage.reserved = true;
+            break;
+        }
+        usage.pipeline = PipelineEfu;
+        usage.waitP = true;
+        break;
+    default:
+        usage.reserved = true;
+        break;
+    }
+    return usage;
+}
+
+constexpr VU1Interpreter::DecodedInstructionPair VU1Interpreter::decodeInstructionWords(
+    uint32_t lower, uint32_t upper, Unit unit)
+{
+    DecodedInstructionPair decoded;
+    decoded.lower = lower;
+    decoded.upper = upper;
+    decoded.iBit = (decoded.upper & 0x80000000u) != 0u;
+    decoded.eBit = (decoded.upper & 0x40000000u) != 0u;
+    decoded.mBit = (decoded.upper & 0x20000000u) != 0u;
+    decoded.dBit = (decoded.upper & 0x10000000u) != 0u;
+    decoded.tBit = (decoded.upper & 0x08000000u) != 0u;
+    decoded.upperUsage = decodeUpperUsage(decoded.upper);
+    if (!decoded.iBit)
+        decoded.lowerUsage = decodeLowerUsage(decoded.lower, unit);
+
+    const uint8_t upperWriteReg = decoded.upperUsage.vfWrite.reg;
+    if (upperWriteReg != 0u && (vfReadLanes(decoded.lowerUsage, upperWriteReg) != 0u || decoded.lowerUsage.vfWrite.reg == upperWriteReg))
+    {
+        decoded.upperVfShadowReg = upperWriteReg;
+        if (decoded.lowerUsage.vfWrite.reg == upperWriteReg)
+            decoded.suppressedLowerVf = upperWriteReg;
+    }
+    return decoded;
+}
+
+template <bool compiled>
+PS2_VU_FORCE_INLINE bool VU1Interpreter::runDecodedPair(const DecodedInstructionPair &decoded, uint64_t budgetEnd, uint32_t codeSize)
+{
+    bool programEnded = false;
+    if (decoded.upperUsage.reserved || decoded.lowerUsage.reserved)
+    {
+        reportReservedInstruction(decoded.upperUsage.reserved, decoded.upperUsage.reserved ? decoded.upper : decoded.lower);
+        return false;
+    }
+
+    const auto readiness = [&]() PS2_VU_INLINE_LAMBDA {
+        if constexpr (compiled) return calculatePairReadyCycleInline(decoded);
+        else return calculatePairReadyCycle(decoded);
+    };
+    const auto upper = [&]() PS2_VU_INLINE_LAMBDA {
+        if constexpr (compiled) execUpperInline(decoded.upper);
+        else execUpper(decoded.upper);
+    };
+    const auto lower = [&]() PS2_VU_INLINE_LAMBDA {
+        if constexpr (compiled)
+            execLowerInline(decoded.lower, m_activeVuData, m_activeVuDataSize, *m_activeGs, m_activeMemory, decoded.upper);
+        else
+            execLower(decoded.lower, m_activeVuData, m_activeVuDataSize, *m_activeGs, m_activeMemory, decoded.upper);
+    };
+    uint64_t readyCycle = readiness();
+    while (readyCycle > m_cycle)
+    {
+        if (readyCycle >= budgetEnd)
+        {
+            advanceTo(budgetEnd);
+            break;
+        }
+        advanceTo(readyCycle);
+        readyCycle = readiness();
+    }
+    if (m_cycle >= budgetEnd)
+        return false;
+
+    if constexpr (compiled) ++m_compiledPairsExecuted;
+    else ++m_interpretedPairsExecuted;
+
+    const uint32_t viWrites = decoded.lowerUsage.viWrite & 0xFFFEu;
+    const uint8_t writtenVi = viWrites != 0u ? static_cast<uint8_t>(std::countr_zero(viWrites)) : 0u;
+    const int32_t oldVi = writtenVi != 0u ? m_state.vi[writtenVi] : 0;
+
+    const VfAccess upperWrite = decoded.upperUsage.vfWrite;
+    const VfAccess lowerWrite = decoded.lowerUsage.vfWrite;
+    const bool hasUpperWrite = upperWrite.reg != 0u;
+    const bool hasLowerWrite = lowerWrite.reg != 0u && decoded.suppressedLowerVf != lowerWrite.reg;
+    const bool hasDistinctLowerWrite = hasLowerWrite && (!hasUpperWrite || lowerWrite.reg != upperWrite.reg);
+    float oldUpperVf[4]{};
+    float newUpperVf[4]{};
+    float oldLowerVf[4]{};
+    float newLowerVf[4]{};
+    float oldAcc[4]{};
+    float newAcc[4]{};
+    if (hasUpperWrite)
+        std::memcpy(oldUpperVf, m_state.vf[upperWrite.reg], sizeof(oldUpperVf));
+    if (hasDistinctLowerWrite)
+        std::memcpy(oldLowerVf, m_state.vf[lowerWrite.reg], sizeof(oldLowerVf));
+    if (!compiled && decoded.upperUsage.accWrite != 0u)
+        std::memcpy(oldAcc, m_state.acc, sizeof(oldAcc));
+
+    if (decoded.iBit)
+    {
+        upper();
+        float immediate = 0.0f;
+        std::memcpy(&immediate, &decoded.lower, sizeof(immediate));
+        m_state.i = normalizeOperand(immediate);
+    }
+    else if (decoded.upperVfShadowReg != 0u)
+    {
+        float oldVf[4]{};
+        float upperVf[4]{};
+        std::memcpy(oldVf,
+                    m_state.vf[decoded.upperVfShadowReg],
+                    sizeof(oldVf));
+        upper();
+        std::memcpy(upperVf,
+                    m_state.vf[decoded.upperVfShadowReg],
+                    sizeof(upperVf));
+        std::memcpy(m_state.vf[decoded.upperVfShadowReg],
+                    oldVf,
+                    sizeof(oldVf));
+        lower();
+        std::memcpy(m_state.vf[decoded.upperVfShadowReg],
+                    upperVf,
+                    sizeof(upperVf));
+    }
+    else
+    {
+        upper();
+        lower();
+    }
+
+    m_viBranchBackupValid = false;
+
+    if (hasUpperWrite)
+    {
+        std::memcpy(newUpperVf, m_state.vf[upperWrite.reg], sizeof(newUpperVf));
+        std::memcpy(m_state.vf[upperWrite.reg], oldUpperVf, sizeof(oldUpperVf));
+        const uint32_t latency =
+            decoded.upperUsage.vfLatency != 0u
+                ? decoded.upperUsage.vfLatency
+                : decoded.upperUsage.latency;
+        queueVfWrite(upperWrite.reg, upperWrite.lanes, newUpperVf, latency);
+    }
+    if (hasDistinctLowerWrite)
+    {
+        std::memcpy(newLowerVf, m_state.vf[lowerWrite.reg], sizeof(newLowerVf));
+        std::memcpy(m_state.vf[lowerWrite.reg], oldLowerVf, sizeof(oldLowerVf));
+        const uint32_t latency = decoded.lowerUsage.vfLatency != 0u
+                                     ? decoded.lowerUsage.vfLatency
+                                     : decoded.lowerUsage.latency;
+        queueVfWrite(lowerWrite.reg, lowerWrite.lanes, newLowerVf, latency);
+    }
+    if (!compiled && decoded.upperUsage.accWrite != 0u)
+    {
+        std::memcpy(newAcc, m_state.acc, sizeof(newAcc));
+        std::memcpy(m_state.acc, oldAcc, sizeof(oldAcc));
+        // ACC is forwarded to the next upper instruction. Its arithmetic
+        // flags still use the normal four-cycle FMAC timeline.
+        queueAccWrite(decoded.upperUsage.accWrite, newAcc,
+                      kAccForwardLatency);
+    }
+    if (writtenVi != 0u)
+    {
+        const int32_t newVi = m_state.vi[writtenVi];
+        const uint32_t latency =
+            decoded.lowerUsage.viLatency != 0u
+                ? decoded.lowerUsage.viLatency
+                : decoded.lowerUsage.latency;
+        if (compiled && latency == 1u)
+        {
+            m_state.vi[writtenVi] = static_cast<int16_t>(newVi);
+            m_viLatestWrite[writtenVi] = ++m_nextWriteSequence;
+        }
+        else
+        {
+            m_state.vi[writtenVi] = oldVi;
+            queueViWrite(writtenVi, newVi, latency);
+        }
+    }
+
+    // ACC and one-cycle VI results are visible before the next pair or callback.
+    // Lower operations never read ACC; VI supersession still cancels older loads.
+    static_assert(kAccForwardLatency == 1u);
+
+    if constexpr (compiled) markPairWritesInline(decoded);
+    else markPairWrites(decoded);
+    if (writtenVi != 0u && decoded.lowerUsage.delaysNextBranchRead)
+        recordViWriteForBranch(writtenVi, oldVi);
+
+    m_state.vf[0][0] = 0.0f;
+    m_state.vf[0][1] = 0.0f;
+    m_state.vf[0][2] = 0.0f;
+    m_state.vf[0][3] = 1.0f;
+    m_state.vi[0] = 0;
+
+    uint32_t nextPc = m_state.pc + 8u;
+    if (nextPc >= codeSize)
+        nextPc = 0u;
+    m_state.pc = nextPc;
+
+    if (m_state.branchPending)
+    {
+        if (m_state.branchDelay == 0u)
+        {
+            m_state.pc = m_state.branchTarget & microAddressMask();
+            m_state.branchPending = false;
+        }
+        else
+        {
+            --m_state.branchDelay;
+        }
+    }
+
+    const bool dHalt = decoded.dBit && m_state.dBitEnabled;
+    const bool tHalt = decoded.tBit && m_state.tBitEnabled;
+    const bool haltBit = dHalt || tHalt;
+    const bool haltBranch = haltBit && decoded.lowerUsage.pipeline == PipelineBranch;
+
+    if (m_state.haltAfterDelaySlot)
+    {
+        m_state.stoppedByD = m_pendingHaltD;
+        m_state.stoppedByT = m_pendingHaltT;
+        programEnded = true;
+    }
+    else if (m_state.ebit)
+        programEnded = true;
+    else if (haltBit && !haltBranch)
+    {
+        m_state.stoppedByD = dHalt;
+        m_state.stoppedByT = tHalt;
+        programEnded = true;
+    }
+    else if (decoded.eBit)
+        m_state.ebit = true;
+    else if (haltBranch)
+    {
+        m_state.haltAfterDelaySlot = true;
+        m_pendingHaltD = dHalt;
+        m_pendingHaltT = tHalt;
+    }
+
+    advanceOneCycle();
+    return programEnded;
+}
+
+template <VU1Interpreter::Unit unit, uint64_t... words>
+bool VU1Interpreter::runCompiledBlock(VU1Interpreter &vu, uint64_t budgetEnd)
+{
+    const uint32_t startPC = vu.m_state.pc;
+    uint32_t nextPC = startPC;
+    bool active = true;
+    bool ended = false;
+    const auto step = [&]<uint64_t word>() PS2_VU_INLINE_LAMBDA {
+        if (!active)
+            return;
+        // A callback can replace code, and any pair may exhaust the cycle budget.
+        const uint64_t generation = unit == Unit::VU1
+            ? vu.m_activeMemory->getVU1CodeGeneration() : vu.m_activeMemory->getVU0CodeGeneration();
+        if (vu.m_state.pc != nextPC || vu.m_cycle >= budgetEnd || vu.m_stopRequested ||
+            generation != vu.m_cachedCodeGeneration)
+        {
+            active = false;
+            return;
+        }
+        static constexpr auto decoded = decodeInstructionWords(static_cast<uint32_t>(word),
+                                                        static_cast<uint32_t>(word >> 32u), unit);
+        ended = vu.runDecodedPair<true>(decoded, budgetEnd, vu.m_cachedCodeSize);
+        active = !ended;
+        nextPC += 8u;
+    };
+    (step.template operator()<words>(), ...);
+    return ended;
+}
+
+#include "ps2_vu1_upper.inl"
+#include "ps2_vu1_lower.inl"
+
+#endif
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_fmac.h b/ps2xRuntime/src/lib/vu/ps2_vu1_fmac.h
new file mode 100644
index 000000000..c5a518f35
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_fmac.h
@@ -0,0 +1,30 @@
+#ifndef PS2_VU1_FMAC_H
+#define PS2_VU1_FMAC_H
+
+#include "ps2_vu1_detail.h"
+
+#include <bit>
+#include <cstdint>
+
+namespace ps2_vu_detail {
+
+PS2_VU_FORCE_INLINE bool normalProductSumFlags(float result, float left, float right)
+{
+    const uint32_t resultExponent = (std::bit_cast<uint32_t>(result) >> 23u) & 0xFFu;
+    if (resultExponent < 2u || resultExponent > 253u)
+        return false;
+
+    const uint32_t leftExponent = (std::bit_cast<uint32_t>(left) >> 23u) & 0xFFu;
+    const uint32_t rightExponent = (std::bit_cast<uint32_t>(right) >> 23u) & 0xFFu;
+    if (leftExponent == 0u || rightExponent == 0u)
+        return true;
+
+    // Inputs are normalized. Keep the product finite and its rounding error
+    // below one eighth of the result, leaving room at both normal boundaries.
+    const uint32_t productBound = leftExponent + rightExponent;
+    return productBound <= 379u && productBound <= resultExponent + 146u;
+}
+
+}
+
+#endif
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h b/ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h
new file mode 100644
index 000000000..b655228ef
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h
@@ -0,0 +1,78 @@
+#ifndef PS2_VU1_FMAC_NEON_H
+#define PS2_VU1_FMAC_NEON_H
+
+#include "ps2_vu1_detail.h"
+
+#if defined(__aarch64__)
+#include <arm_neon.h>
+#include <cstring>
+
+namespace ps2_vu_detail {
+
+PS2_VU_FORCE_INLINE float32x4_t normalizeFmacOperands(float32x4_t value)
+{
+    const auto bits = vreinterpretq_u32_f32(value);
+    const auto sign = vandq_u32(bits, vdupq_n_u32(0x80000000u));
+    const auto exponent = vandq_u32(bits, vdupq_n_u32(0x7f800000u));
+    const auto zero = vceqq_u32(exponent, vdupq_n_u32(0u));
+    const auto special = vceqq_u32(exponent, vdupq_n_u32(0x7f800000u));
+    const auto finite = vbslq_u32(special, vorrq_u32(sign, vdupq_n_u32(0x7f7fffffu)), bits);
+    return vreinterpretq_f32_u32(vbslq_u32(zero, sign, finite));
+}
+
+template <bool subtract>
+PS2_VU_FORCE_INLINE bool tryProductSumVector(
+    const float *leftInput, const float *rightInput, const float *accInput,
+    uint8_t destination, float *result, uint8_t laneFlags[4], uint32_t &extraSticky)
+{
+    const auto left = normalizeFmacOperands(vld1q_f32(leftInput));
+    const auto right = normalizeFmacOperands(vld1q_f32(rightInput));
+    const auto acc = normalizeFmacOperands(vld1q_f32(accInput));
+    const auto value = subtract ? vfmsq_f32(acc, left, right) : vfmaq_f32(acc, left, right);
+    const auto valueBits = vreinterpretq_u32_f32(value);
+    const auto leftBits = vreinterpretq_u32_f32(left);
+    const auto rightBits = vreinterpretq_u32_f32(right);
+    const auto exponentMask = vdupq_n_u32(0xffu);
+    const auto resultExponent = vandq_u32(vshrq_n_u32(valueBits, 23), exponentMask);
+    const auto leftExponent = vandq_u32(vshrq_n_u32(leftBits, 23), exponentMask);
+    const auto rightExponent = vandq_u32(vshrq_n_u32(rightBits, 23), exponentMask);
+    const auto productBound = vaddq_u32(leftExponent, rightExponent);
+    const auto zeroProduct = vorrq_u32(vceqq_u32(leftExponent, vdupq_n_u32(0u)),
+                                      vceqq_u32(rightExponent, vdupq_n_u32(0u)));
+    const auto productSafe = vandq_u32(vcleq_u32(productBound, vdupq_n_u32(379u)),
+        vcleq_u32(productBound, vaddq_u32(resultExponent, vdupq_n_u32(146u))));
+    const auto resultSafe = vandq_u32(vcgeq_u32(resultExponent, vdupq_n_u32(2u)),
+                                     vcleq_u32(resultExponent, vdupq_n_u32(253u)));
+    const auto zeroResult = vceqq_u32(vandq_u32(valueBits, vdupq_n_u32(0x7fffffffu)), vdupq_n_u32(0u));
+    const uint32x4_t laneBits = {8u, 4u, 2u, 1u};
+    const auto active = vtstq_u32(vdupq_n_u32(destination), laneBits);
+    const auto safe = vorrq_u32(vandq_u32(resultSafe, vorrq_u32(zeroProduct, productSafe)),
+                                vandq_u32(zeroResult, zeroProduct));
+    if (vminvq_u32(vorrq_u32(safe, vmvnq_u32(active))) == 0u)
+        return false;
+
+    // The accepted exponent bound excludes product overflow. A tiny product
+    // is exact zero only when one normalized multiplicand is zero.
+    const auto product = vmulq_f32(left, right);
+    const auto productMagnitude = vandq_u32(vreinterpretq_u32_f32(product), vdupq_n_u32(0x7fffffffu));
+    const auto tiny = vcltq_u32(productMagnitude, vdupq_n_u32(0x00800000u));
+    const auto sign = vshlq_n_u32(vshrq_n_u32(veorq_u32(leftBits, rightBits), 31), 1);
+    const auto zero = vandq_u32(tiny, vdupq_n_u32(1u));
+    const auto underflow = vandq_u32(vbicq_u32(tiny, zeroProduct), vdupq_n_u32(4u));
+    const auto sticky = vandq_u32(vorrq_u32(sign, vorrq_u32(zero, underflow)), active);
+    const auto foldedSticky = vorr_u32(vget_low_u32(sticky), vget_high_u32(sticky));
+    extraSticky = vget_lane_u32(foldedSticky, 0) | vget_lane_u32(foldedSticky, 1);
+
+    const auto current = vandq_u32(vorrq_u32(vshlq_n_u32(vshrq_n_u32(valueBits, 31), 1),
+        vandq_u32(zeroResult, vdupq_n_u32(1u))), active);
+    const auto packed = vmovn_u16(vcombine_u16(vmovn_u32(current), vdup_n_u16(0u)));
+    const uint32_t flags = vget_lane_u32(vreinterpret_u32_u8(packed), 0);
+    std::memcpy(laneFlags, &flags, sizeof(flags));
+    vst1q_f32(result, value);
+    return true;
+}
+
+}
+#endif
+
+#endif
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp
index 4e990aa65..b09c681e3 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_lower.cpp
@@ -1,795 +1,6 @@
-#include "runtime/ps2_vu1.h"
-#include "runtime/gs/ps2_gif_arbiter.h"
-#include "runtime/gs/gs_frontend.h"
-#include "runtime/ps2_memory.h"
-#include "ps2_vu1_detail.h"
+#include "ps2_vu1_exec.inl"
 
-#include <cmath>
-#include <cstring>
-#include <limits>
-
-namespace
-{
-    float vuEatan(float value)
-    {
-        constexpr float coefficients[] = {
-            0.999999344348907f,
-            -0.333298563957214f,
-            0.199465364217758f,
-            -0.13085337519646f,
-            0.096420042216778f,
-            -0.055909886956215f,
-            0.021861229091883f,
-            -0.004054057877511f};
-        constexpr float quarterPi = 0.785398185253143f;
-
-        const float squared = value * value;
-        float polynomial = coefficients[7];
-        for (int index = 6; index >= 0; --index)
-            polynomial = coefficients[index] + squared * polynomial;
-        return quarterPi + value * polynomial;
-    }
-
-    float vuEsin(float value)
-    {
-        constexpr float coefficients[] = {
-            1.0f,
-            -0.166666567325592f,
-            0.008333025500178f,
-            -0.000198074136279f,
-            0.000002601886990f};
-
-        const float squared = value * value;
-        float polynomial = coefficients[4];
-        for (int index = 3; index >= 0; --index)
-            polynomial = coefficients[index] + squared * polynomial;
-        return value * polynomial;
-    }
-
-    float vuEexp(float value)
-    {
-        constexpr float coefficients[] = {
-            0.249998688697815f,
-            0.031257584691048f,
-            0.002591371303424f,
-            0.000171562001924f,
-            0.000005430199963f,
-            0.000000690600018f};
-
-        float polynomial = coefficients[5];
-        for (int index = 4; index >= 0; --index)
-            polynomial = coefficients[index] + value * polynomial;
-        polynomial = 1.0f + value * polynomial;
-        polynomial *= polynomial;
-        polynomial *= polynomial;
-        return polynomial != 0.0f ? 1.0f / polynomial : std::numeric_limits<float>::max();
-    }
-}
-
-// ============================================================================
-// Lower instructions
-// ============================================================================
 void VU1Interpreter::execLower(uint32_t instr, uint8_t *vuData, uint32_t dataSize, GS &gs, PS2Memory *memory, uint32_t upperInstr)
 {
     execLowerInline(instr, vuData, dataSize, gs, memory, upperInstr);
 }
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::execLowerInline(uint32_t instr, uint8_t *vuData, uint32_t dataSize, GS &gs, PS2Memory *memory, uint32_t upperInstr)
-{
-    (void)upperInstr;
-    if (instr == 0x00000000 || instr == 0x8000033C) // NOP
-        return;
-
-    uint8_t opHi = (instr >> 25) & 0x7F;
-    const uint32_t pcMask = microAddressMask();
-
-    // The lower instruction encoding uses bits 31:25 for the primary opcode
-    switch (opHi)
-    {
-    case 0x00: // LQ (Load Quadword from VU data memory)
-    {
-        uint8_t it = FT(instr);  // VF destination
-        uint8_t is = VIS(instr); // VI base
-        uint8_t dest = (instr >> 21) & 0xF;
-        int16_t imm = IMM11(instr);
-        uint32_t addr = ((uint32_t)(int32_t)(m_state.vi[is] + imm)) * 16u;
-        addr &= (dataSize - 1);
-        if (addr + 16 <= dataSize)
-        {
-            float tmp[4];
-            std::memcpy(tmp, vuData + addr, 16);
-            applyDest(m_state.vf[it], tmp, dest);
-        }
-        return;
-    }
-    case 0x01: // SQ (Store Quadword to VU data memory)
-    {
-        uint8_t is = FS(instr);  // VF source
-        uint8_t it = VIT(instr); // VI base
-        uint8_t dest = (instr >> 21) & 0xF;
-        int16_t imm = IMM11(instr);
-        uint32_t addr = ((uint32_t)(int32_t)(m_state.vi[it] + imm)) * 16u;
-        addr &= (dataSize - 1);
-        if (addr + 16 <= dataSize)
-        {
-            uint32_t words[4]{};
-            std::memcpy(words, m_state.vf[is], sizeof(words));
-            queueStore(addr, words, dest);
-        }
-        return;
-    }
-    case 0x04: // ILW (Integer Load Word from VU data memory)
-    {
-        uint8_t it = VIT(instr); // VI destination
-        uint8_t is = VIS(instr); // VI base
-        uint8_t dest = (instr >> 21) & 0xF;
-        int16_t imm = IMM11(instr);
-        uint32_t addr = ((uint32_t)(int32_t)(m_state.vi[is] + imm)) * 16u;
-        addr &= (dataSize - 1);
-        if (addr + 16 <= dataSize)
-        {
-            int comp = 0;
-            if (dest & 0x8)
-                comp = 0;
-            else if (dest & 0x4)
-                comp = 1;
-            else if (dest & 0x2)
-                comp = 2;
-            else
-                comp = 3;
-            uint32_t v;
-            std::memcpy(&v, vuData + addr + comp * 4, 4);
-            if (it != 0)
-                m_state.vi[it] = (int32_t)(int16_t)(v & 0xFFFF);
-        }
-        return;
-    }
-    case 0x05: // ISW (Integer Store Word to VU data memory)
-    {
-        uint8_t it = VIT(instr); // VI source
-        uint8_t is = VIS(instr); // VI base
-        uint8_t dest = (instr >> 21) & 0xF;
-        int16_t imm = IMM11(instr);
-        uint32_t addr = ((uint32_t)(int32_t)(m_state.vi[is] + imm)) * 16u;
-        addr &= (dataSize - 1);
-        if (addr + 16 <= dataSize)
-        {
-            const uint32_t val = static_cast<uint32_t>(static_cast<uint16_t>(m_state.vi[it] & 0xFFFF));
-            const uint32_t words[4] = {val, val, val, val};
-            queueStore(addr, words, dest);
-        }
-        return;
-    }
-    case 0x08: // IADDIU
-    {
-        uint8_t it = VIT(instr);
-        uint8_t is = VIS(instr);
-        int16_t imm = (int16_t)(instr & 0x7FF) | ((instr >> 10) & 0x7800);
-        if (it != 0)
-            m_state.vi[it] = (int16_t)(m_state.vi[is] + imm);
-        return;
-    }
-    case 0x09: // ISUBIU
-    {
-        uint8_t it = VIT(instr);
-        uint8_t is = VIS(instr);
-        int16_t imm = (int16_t)(instr & 0x7FF) | ((instr >> 10) & 0x7800);
-        if (it != 0)
-            m_state.vi[it] = (int16_t)(m_state.vi[is] - imm);
-        return;
-    }
-    case 0x10: // FCEQ
-    {
-        uint32_t imm24 = instr & 0xFFFFFF;
-        if (1 != 0)
-            m_state.vi[1] = ((m_state.clip & 0xFFFFFF) == imm24) ? 1 : 0;
-        return;
-    }
-    case 0x11: // FCSET
-    {
-        queueFcset(instr & 0xFFFFFFu);
-        return;
-    }
-    case 0x12: // FCAND
-    {
-        uint32_t imm24 = instr & 0xFFFFFF;
-        if (1 != 0)
-            m_state.vi[1] = ((m_state.clip & imm24) != 0) ? 1 : 0;
-        return;
-    }
-    case 0x13: // FCOR
-    {
-        uint32_t imm24 = instr & 0xFFFFFF;
-        if (1 != 0)
-            m_state.vi[1] = ((m_state.clip | imm24) == 0xFFFFFF) ? 1 : 0;
-        return;
-    }
-    case 0x14: // FSEQ
-    {
-        const uint8_t it = VIT(instr);
-        const uint16_t imm12 = static_cast<uint16_t>((((instr >> 21) & 0x1u) << 11) | (instr & 0x7FFu));
-        if (it != 0)
-            m_state.vi[it] = ((m_state.status & 0xFFFu) == imm12) ? 1 : 0;
-        return;
-    }
-    case 0x15: // FSSET
-    {
-        const uint16_t imm12 = static_cast<uint16_t>((((instr >> 21) & 0x1u) << 11) | (instr & 0x7FFu));
-        queueFsset(imm12);
-        return;
-    }
-    case 0x16: // FSAND
-    {
-        const uint8_t it = VIT(instr);
-        const uint16_t imm12 = static_cast<uint16_t>((((instr >> 21) & 0x1u) << 11) | (instr & 0x7FFu));
-        if (it != 0)
-            m_state.vi[it] = static_cast<int32_t>((m_state.status & 0xFFFu) & imm12);
-        return;
-    }
-    case 0x17: // FSOR
-    {
-        const uint8_t it = VIT(instr);
-        const uint16_t imm12 = static_cast<uint16_t>((((instr >> 21) & 0x1u) << 11) | (instr & 0x7FFu));
-        if (it != 0)
-            m_state.vi[it] = static_cast<int32_t>((m_state.status & 0xFFFu) | imm12);
-        return;
-    }
-    case 0x18: // FMEQ
-    {
-        uint8_t it = VIT(instr);
-        uint8_t is = VIS(instr);
-        if (it != 0)
-            m_state.vi[it] = ((m_state.mac & 0xFFFF) == (uint32_t)(uint16_t)m_state.vi[is]) ? 1 : 0;
-        return;
-    }
-    case 0x1A: // FMAND
-    {
-        uint8_t it = VIT(instr);
-        uint8_t is = VIS(instr);
-        if (it != 0)
-            m_state.vi[it] = (int32_t)(m_state.mac & (uint32_t)(uint16_t)m_state.vi[is]);
-        return;
-    }
-    case 0x1B: // FMOR
-    {
-        uint8_t it = VIT(instr);
-        uint8_t is = VIS(instr);
-        if (it != 0)
-            m_state.vi[it] = (int32_t)(m_state.mac | (uint32_t)(uint16_t)m_state.vi[is]);
-        return;
-    }
-    case 0x1C: // FCGET
-    {
-        const uint8_t it = VIT(instr);
-        if (it != 0)
-            m_state.vi[it] = static_cast<int32_t>(m_state.clip & 0x0FFFu);
-        return;
-    }
-    case 0x20: // B (unconditional branch)
-    {
-        int16_t imm = IMM11(instr);
-        uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
-        m_state.branchPending = true;
-        m_state.branchTarget = target;
-        m_state.branchDelay = 1;
-        return;
-    }
-    case 0x21: // BAL (Branch and link)
-    {
-        uint8_t it = VIT(instr);
-        int16_t imm = IMM11(instr);
-        uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
-        if (it != 0)
-            m_state.vi[it] = (int32_t)((m_state.pc + 16) / 8);
-        m_state.branchPending = true;
-        m_state.branchTarget = target;
-        m_state.branchDelay = 1;
-        return;
-    }
-    case 0x24: // JR
-    {
-        uint8_t is = VIS(instr);
-        // Register jumps do not use conditional branches' delayed VI operand.
-        uint32_t target = ((uint32_t)(uint16_t)m_state.vi[is] * 8u) & pcMask;
-        m_state.branchPending = true;
-        m_state.branchTarget = target;
-        m_state.branchDelay = 1;
-        return;
-    }
-    case 0x25: // JALR
-    {
-        uint8_t it = VIT(instr);
-        uint8_t is = VIS(instr);
-        uint32_t target = ((uint32_t)(uint16_t)m_state.vi[is] * 8u) & pcMask;
-        if (it != 0)
-            m_state.vi[it] = (int32_t)((m_state.pc + 16) / 8);
-        m_state.branchPending = true;
-        m_state.branchTarget = target;
-        m_state.branchDelay = 1;
-        return;
-    }
-    case 0x28: // IBEQ
-    {
-        uint8_t it = VIT(instr);
-        uint8_t is = VIS(instr);
-        int16_t imm = IMM11(instr);
-        if ((int16_t)readBranchVi(is) == (int16_t)readBranchVi(it))
-        {
-            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
-            m_state.branchPending = true;
-            m_state.branchTarget = target;
-            m_state.branchDelay = 1;
-        }
-        return;
-    }
-    case 0x29: // IBNE
-    {
-        uint8_t it = VIT(instr);
-        uint8_t is = VIS(instr);
-        int16_t imm = IMM11(instr);
-        if ((int16_t)readBranchVi(is) != (int16_t)readBranchVi(it))
-        {
-            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
-            m_state.branchPending = true;
-            m_state.branchTarget = target;
-            m_state.branchDelay = 1;
-        }
-        return;
-    }
-    case 0x2C: // IBLTZ
-    {
-        uint8_t is = VIS(instr);
-        int16_t imm = IMM11(instr);
-        if ((int16_t)readBranchVi(is) < 0)
-        {
-            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
-            m_state.branchPending = true;
-            m_state.branchTarget = target;
-            m_state.branchDelay = 1;
-        }
-        return;
-    }
-    case 0x2D: // IBGTZ
-    {
-        uint8_t is = VIS(instr);
-        int16_t imm = IMM11(instr);
-        if ((int16_t)readBranchVi(is) > 0)
-        {
-            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
-            m_state.branchPending = true;
-            m_state.branchTarget = target;
-            m_state.branchDelay = 1;
-        }
-        return;
-    }
-    case 0x2E: // IBLEZ
-    {
-        uint8_t is = VIS(instr);
-        int16_t imm = IMM11(instr);
-        if ((int16_t)readBranchVi(is) <= 0)
-        {
-            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
-            m_state.branchPending = true;
-            m_state.branchTarget = target;
-            m_state.branchDelay = 1;
-        }
-        return;
-    }
-    case 0x2F: // IBGEZ
-    {
-        uint8_t is = VIS(instr);
-        int16_t imm = IMM11(instr);
-        if ((int16_t)readBranchVi(is) >= 0)
-        {
-            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
-            m_state.branchPending = true;
-            m_state.branchTarget = target;
-            m_state.branchDelay = 1;
-        }
-        return;
-    }
-
-    case 0x40: // Lower1 / lower special. Bit31 set; low 6 bits select integer or special op.
-    {
-        const uint8_t funct = instr & 0x3Fu;
-        const uint8_t vfT = FT(instr);
-        const uint8_t vfS = FS(instr);
-        const uint8_t viT = VIT(instr);
-        const uint8_t viS = VIS(instr);
-        const uint8_t viD = VID(instr);
-        const uint8_t dest = (instr >> 21) & 0xF;
-
-        switch (funct)
-        {
-        case 0x30: // IADD
-            if (viD != 0)
-                m_state.vi[viD] = (int16_t)(m_state.vi[viS] + m_state.vi[viT]);
-            return;
-        case 0x31: // ISUB
-            if (viD != 0)
-                m_state.vi[viD] = (int16_t)(m_state.vi[viS] - m_state.vi[viT]);
-            return;
-        case 0x32: // IADDI
-        {
-            int16_t imm5 = (int16_t)((int32_t)((instr >> 6) & 0x1F) << 27 >> 27);
-            if (viT != 0)
-                m_state.vi[viT] = (int16_t)(m_state.vi[viS] + imm5);
-            return;
-        }
-        case 0x34: // IAND
-            if (viD != 0)
-                m_state.vi[viD] = m_state.vi[viS] & m_state.vi[viT];
-            return;
-        case 0x35: // IOR
-            if (viD != 0)
-                m_state.vi[viD] = m_state.vi[viS] | m_state.vi[viT];
-            return;
-
-        case 0x3C:
-        case 0x3D:
-        case 0x3E:
-        case 0x3F: // Lower1 special. Dobie decodes this as (instr & 3) | ((instr >> 4) & 0x7C).
-        {
-            const uint8_t funct2 = (uint8_t)((instr & 0x3u) | ((instr >> 4) & 0x7Cu));
-            switch (funct2)
-            {
-            case 0x30: // MOVE
-            {
-                float tmp[4];
-                std::memcpy(tmp, m_state.vf[vfS], 16);
-                applyDest(m_state.vf[vfT], tmp, dest);
-                return;
-            }
-            case 0x31: // MR32 (rotate right by 32 bits = shift xyzw -> yzwx)
-            {
-                float tmp[4] = {m_state.vf[vfS][1], m_state.vf[vfS][2], m_state.vf[vfS][3], m_state.vf[vfS][0]};
-                applyDest(m_state.vf[vfT], tmp, dest);
-                return;
-            }
-            case 0x34: // LQI (Load Quadword, post-increment)
-            {
-                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viS]) * 16u;
-                addr &= (dataSize - 1);
-                if (addr + 16 <= dataSize)
-                {
-                    float tmp[4];
-                    std::memcpy(tmp, vuData + addr, 16);
-                    applyDest(m_state.vf[vfT], tmp, dest);
-                }
-                if (viS != 0)
-                    m_state.vi[viS] = (int16_t)(m_state.vi[viS] + 1);
-                return;
-            }
-            case 0x35: // SQI (Store Quadword, post-increment)
-            {
-                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viT]) * 16u;
-                addr &= (dataSize - 1);
-                if (addr + 16 <= dataSize)
-                {
-                    uint32_t words[4]{};
-                    std::memcpy(words, m_state.vf[vfS], sizeof(words));
-                    queueStore(addr, words, dest);
-                }
-                if (viT != 0)
-                    m_state.vi[viT] = (int16_t)(m_state.vi[viT] + 1);
-                return;
-            }
-            case 0x36: // LQD (Load Quadword, pre-decrement)
-            {
-                if (viS != 0)
-                    m_state.vi[viS] = (int16_t)(m_state.vi[viS] - 1);
-                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viS]) * 16u;
-                addr &= (dataSize - 1);
-                if (addr + 16 <= dataSize)
-                {
-                    float tmp[4];
-                    std::memcpy(tmp, vuData + addr, 16);
-                    applyDest(m_state.vf[vfT], tmp, dest);
-                }
-                return;
-            }
-            case 0x37: // SQD (Store Quadword, pre-decrement)
-            {
-                if (viT != 0)
-                    m_state.vi[viT] = (int16_t)(m_state.vi[viT] - 1);
-                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viT]) * 16u;
-                addr &= (dataSize - 1);
-                if (addr + 16 <= dataSize)
-                {
-                    uint32_t words[4]{};
-                    std::memcpy(words, m_state.vf[vfS], sizeof(words));
-                    queueStore(addr, words, dest);
-                }
-                return;
-            }
-            case 0x38: // DIV
-            {
-                int fsf = (instr >> 21) & 0x3;
-                int ftf = (instr >> 23) & 0x3;
-                const float num = normalizeOperand(m_state.vf[vfS][fsf]);
-                const float den = normalizeOperand(m_state.vf[vfT][ftf]);
-                uint32_t statusDi = 0u;
-                float result = 0.0f;
-                if (den == 0.0f)
-                {
-                    statusDi = num == 0.0f ? 0x10u : 0x20u;
-                    result = std::signbit(num) != std::signbit(den)
-                                 ? -std::numeric_limits<float>::max()
-                                 : std::numeric_limits<float>::max();
-                }
-                else
-                {
-                    result = num / den;
-                }
-                uint32_t ignoredFlags = 0u;
-                result = normalizeResult(result, ignoredFlags);
-                queueQ(result, 7u, statusDi);
-                return;
-            }
-            case 0x39: // SQRT
-            {
-                int ftf = (instr >> 23) & 0x3;
-                const float val = normalizeOperand(m_state.vf[vfT][ftf]);
-                queueQ(std::sqrt(std::fabs(val)), 7u,
-                       val < 0.0f ? 0x10u : 0u);
-                return;
-            }
-            case 0x3A: // RSQRT
-            {
-                int fsf = (instr >> 21) & 0x3;
-                int ftf = (instr >> 23) & 0x3;
-                const float num = normalizeOperand(m_state.vf[vfS][fsf]);
-                const float radicand = normalizeOperand(m_state.vf[vfT][ftf]);
-                const float den = std::sqrt(std::fabs(radicand));
-                uint32_t statusDi = radicand < 0.0f ? 0x10u : 0u;
-                float result = 0.0f;
-                if (den != 0.0f)
-                    result = num / den;
-                else
-                {
-                    statusDi = num == 0.0f ? 0x10u : 0x20u;
-                    result = std::signbit(num)
-                                 ? -std::numeric_limits<float>::max()
-                                 : std::numeric_limits<float>::max();
-                }
-                uint32_t ignoredFlags = 0u;
-                result = normalizeResult(result, ignoredFlags);
-                queueQ(result, 13u, statusDi);
-                return;
-            }
-            case 0x3B: // WAITQ
-                return;
-            case 0x3C: // MTIR (Move To Integer Register)
-            {
-                // MTIR encodes a two-bit fsf component selector in bits
-                // 22:21. It is not a four-bit destination mask.
-                const uint32_t comp = (instr >> 21) & 0x3u;
-                uint32_t fval;
-                std::memcpy(&fval, &m_state.vf[vfS][comp], 4);
-                if (viT != 0)
-                    m_state.vi[viT] = (int32_t)(int16_t)(fval & 0xFFFF);
-                return;
-            }
-            case 0x3D: // MFIR (Move From Integer Register)
-            {
-                float result[4];
-                int32_t val = (int32_t)(int16_t)(m_state.vi[viS] & 0xFFFF);
-                std::memcpy(&result[0], &val, 4);
-                result[1] = result[0];
-                result[2] = result[0];
-                result[3] = result[0];
-                applyDest(m_state.vf[vfT], result, dest);
-                return;
-            }
-            case 0x3E: // ILWR - integer load word from address in VI[is]
-            {
-                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viS]) * 16u;
-                addr &= (dataSize - 1);
-                if (addr + 16 <= dataSize)
-                {
-                    int comp = 0;
-                    if (dest & 0x8)
-                        comp = 0;
-                    else if (dest & 0x4)
-                        comp = 1;
-                    else if (dest & 0x2)
-                        comp = 2;
-                    else
-                        comp = 3;
-                    uint32_t v;
-                    std::memcpy(&v, vuData + addr + comp * 4, 4);
-                    if (viT != 0)
-                        m_state.vi[viT] = (int32_t)(int16_t)(v & 0xFFFF);
-                }
-                return;
-            }
-            case 0x3F: // ISWR - integer store word to address in VI[is]
-            {
-                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viS]) * 16u;
-                addr &= (dataSize - 1);
-                if (addr + 16 <= dataSize)
-                {
-                    const uint32_t val =
-                        static_cast<uint32_t>(static_cast<uint16_t>(m_state.vi[viT] & 0xFFFF));
-                    const uint32_t words[4] = {val, val, val, val};
-                    queueStore(addr, words, dest);
-                }
-                return;
-            }
-            case 0x40: // RNEXT
-            {
-                const uint32_t x = (m_state.r >> 4) & 1u;
-                const uint32_t y = (m_state.r >> 22) & 1u;
-                m_state.r = ((m_state.r << 1) ^ x ^ y) & 0x007FFFFFu;
-                m_state.r |= 0x3F800000u;
-                float value = 0.0f;
-                std::memcpy(&value, &m_state.r, sizeof(value));
-                const float result[4] = {value, value, value, value};
-                applyDest(m_state.vf[vfT], result, dest);
-                return;
-            }
-            case 0x41: // RGET
-            {
-                float value = 0.0f;
-                std::memcpy(&value, &m_state.r, sizeof(value));
-                const float result[4] = {value, value, value, value};
-                applyDest(m_state.vf[vfT], result, dest);
-                return;
-            }
-            case 0x42: // RINIT
-            {
-                const uint32_t component = (instr >> 21) & 3u;
-                uint32_t bits = 0u;
-                std::memcpy(&bits, &m_state.vf[vfS][component], sizeof(bits));
-                m_state.r = 0x3F800000u | (bits & 0x007FFFFFu);
-                return;
-            }
-            case 0x43: // RXOR
-            {
-                const uint32_t component = (instr >> 21) & 3u;
-                uint32_t bits = 0u;
-                std::memcpy(&bits, &m_state.vf[vfS][component], sizeof(bits));
-                m_state.r = 0x3F800000u | ((m_state.r ^ bits) & 0x007FFFFFu);
-                return;
-            }
-            case 0x64: // MFP (Move From P register)
-            {
-                float result[4] = {m_state.p, m_state.p, m_state.p, m_state.p};
-                applyDest(m_state.vf[vfT], result, dest);
-                return;
-            }
-            case 0x68: // XTOP - move current VIF1 TOP into VI register
-            {
-                if (viT != 0)
-                    m_state.vi[viT] = (int32_t)(m_state.top & 0x3FFu);
-                return;
-            }
-            case 0x69: // XITOP - move current VIF1 ITOP into VI register
-            {
-                if (viT != 0)
-                    m_state.vi[viT] = (int32_t)(m_state.itop & 0x3FFu);
-                return;
-            }
-            case 0x6C: // XGKICK - send GIF packet from VU1 data memory
-                startXgkick(static_cast<uint32_t>(static_cast<uint16_t>(m_state.vi[viS])));
-                return;
-            case 0x70: // ESADD
-            {
-                const float x = normalizeOperand(m_state.vf[vfS][0]);
-                const float y = normalizeOperand(m_state.vf[vfS][1]);
-                const float z = normalizeOperand(m_state.vf[vfS][2]);
-                queueP(x * x + y * y + z * z, 11u);
-                return;
-            }
-            case 0x71: // ERSADD
-            {
-                const float x = normalizeOperand(m_state.vf[vfS][0]);
-                const float y = normalizeOperand(m_state.vf[vfS][1]);
-                const float z = normalizeOperand(m_state.vf[vfS][2]);
-                const float sum = x * x + y * y + z * z;
-                queueP(sum != 0.0f ? 1.0f / sum : sum, 18u);
-                return;
-            }
-            case 0x72: // ELENG
-            {
-                const float x = normalizeOperand(m_state.vf[vfS][0]);
-                const float y = normalizeOperand(m_state.vf[vfS][1]);
-                const float z = normalizeOperand(m_state.vf[vfS][2]);
-                queueP(std::sqrt(x * x + y * y + z * z), 18u);
-                return;
-            }
-            case 0x73: // ERLENG
-            {
-                const float x = normalizeOperand(m_state.vf[vfS][0]);
-                const float y = normalizeOperand(m_state.vf[vfS][1]);
-                const float z = normalizeOperand(m_state.vf[vfS][2]);
-                const float len = std::sqrt(x * x + y * y + z * z);
-                queueP(len != 0.0f ? 1.0f / len : len, 24u);
-                return;
-            }
-            case 0x74: // EATANxy
-            {
-                const float x = normalizeOperand(m_state.vf[vfS][0]);
-                const float y = normalizeOperand(m_state.vf[vfS][1]);
-                queueP(x != 0.0f ? vuEatan(y / x) : 0.0f, 54u);
-                return;
-            }
-            case 0x75: // EATANxz
-            {
-                const float x = normalizeOperand(m_state.vf[vfS][0]);
-                const float z = normalizeOperand(m_state.vf[vfS][2]);
-                queueP(x != 0.0f ? vuEatan(z / x) : 0.0f, 54u);
-                return;
-            }
-            case 0x76: // ESUM
-            {
-                float sum = 0.0f;
-                for (uint32_t component = 0; component < 4u; ++component)
-                    sum += normalizeOperand(m_state.vf[vfS][component]);
-                queueP(sum, 12u);
-                return;
-            }
-            case 0x77: // ERSQRT
-            {
-                const uint32_t component = (instr >> 21) & 3u;
-                const float value = normalizeOperand(m_state.vf[vfS][component]);
-                float result = value;
-                if (result >= 0.0f)
-                {
-                    result = std::sqrt(result);
-                    if (result != 0.0f)
-                        result = 1.0f / result;
-                }
-                queueP(result, 18u);
-                return;
-            }
-            case 0x78: // ESQRT
-            {
-                const uint32_t component = (instr >> 21) & 3u;
-                const float value = normalizeOperand(m_state.vf[vfS][component]);
-                queueP(value >= 0.0f ? std::sqrt(value) : value, 12u);
-                return;
-            }
-            case 0x79: // ESIN
-            {
-                const uint32_t component = (instr >> 21) & 3u;
-                const float value = normalizeOperand(m_state.vf[vfS][component]);
-                queueP(vuEsin(value), 29u);
-                return;
-            }
-            case 0x7A: // ERCPR
-            {
-                const uint32_t component = (instr >> 21) & 3u;
-                const float value = normalizeOperand(m_state.vf[vfS][component]);
-                queueP(value != 0.0f ? 1.0f / value : value, 12u);
-                return;
-            }
-            case 0x7B: // WAITP
-                return;
-            case 0x7C: // EATAN
-            {
-                const uint32_t component = (instr >> 21) & 3u;
-                queueP(vuEatan(normalizeOperand(m_state.vf[vfS][component])), 54u);
-                return;
-            }
-            case 0x7D: // EEXP
-            {
-                const uint32_t component = (instr >> 21) & 3u;
-                queueP(vuEexp(normalizeOperand(m_state.vf[vfS][component])), 44u);
-                return;
-            }
-            default:
-                reportReservedInstruction(false, instr);
-                return;
-            }
-        }
-        default:
-            reportReservedInstruction(false, instr);
-            return;
-        }
-    }
-    default:
-        reportReservedInstruction(false, instr);
-        break;
-    }
-}
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_lower.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_lower.inl
new file mode 100644
index 000000000..b0317b5d4
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_lower.inl
@@ -0,0 +1,795 @@
+#include "runtime/ps2_vu1.h"
+#include "runtime/gs/ps2_gif_arbiter.h"
+#include "runtime/gs/gs_frontend.h"
+#include "runtime/ps2_memory.h"
+#include "ps2_vu1_detail.h"
+
+#include <cmath>
+#include <cstring>
+#include <limits>
+
+namespace ps2_vu_detail
+{
+    inline float vuEatan(float value)
+    {
+        constexpr float coefficients[] = {
+            0.999999344348907f,
+            -0.333298563957214f,
+            0.199465364217758f,
+            -0.13085337519646f,
+            0.096420042216778f,
+            -0.055909886956215f,
+            0.021861229091883f,
+            -0.004054057877511f};
+        constexpr float quarterPi = 0.785398185253143f;
+
+        const float squared = value * value;
+        float polynomial = coefficients[7];
+        for (int index = 6; index >= 0; --index)
+            polynomial = coefficients[index] + squared * polynomial;
+        return quarterPi + value * polynomial;
+    }
+
+    inline float vuEsin(float value)
+    {
+        constexpr float coefficients[] = {
+            1.0f,
+            -0.166666567325592f,
+            0.008333025500178f,
+            -0.000198074136279f,
+            0.000002601886990f};
+
+        const float squared = value * value;
+        float polynomial = coefficients[4];
+        for (int index = 3; index >= 0; --index)
+            polynomial = coefficients[index] + squared * polynomial;
+        return value * polynomial;
+    }
+
+    inline float vuEexp(float value)
+    {
+        constexpr float coefficients[] = {
+            0.249998688697815f,
+            0.031257584691048f,
+            0.002591371303424f,
+            0.000171562001924f,
+            0.000005430199963f,
+            0.000000690600018f};
+
+        float polynomial = coefficients[5];
+        for (int index = 4; index >= 0; --index)
+            polynomial = coefficients[index] + value * polynomial;
+        polynomial = 1.0f + value * polynomial;
+        polynomial *= polynomial;
+        polynomial *= polynomial;
+        return polynomial != 0.0f ? 1.0f / polynomial : std::numeric_limits<float>::max();
+    }
+}
+
+using ps2_vu_detail::vuEatan;
+using ps2_vu_detail::vuEsin;
+using ps2_vu_detail::vuEexp;
+
+// ============================================================================
+// Lower instructions
+// ============================================================================
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::execLowerInline(uint32_t instr, uint8_t *vuData, uint32_t dataSize, GS &gs, PS2Memory *memory, uint32_t upperInstr)
+{
+    (void)upperInstr;
+    if (instr == 0x00000000 || instr == 0x8000033C) // NOP
+        return;
+
+    uint8_t opHi = (instr >> 25) & 0x7F;
+    const uint32_t pcMask = microAddressMask();
+
+    // The lower instruction encoding uses bits 31:25 for the primary opcode
+    switch (opHi)
+    {
+    case 0x00: // LQ (Load Quadword from VU data memory)
+    {
+        uint8_t it = FT(instr);  // VF destination
+        uint8_t is = VIS(instr); // VI base
+        uint8_t dest = (instr >> 21) & 0xF;
+        int16_t imm = IMM11(instr);
+        uint32_t addr = ((uint32_t)(int32_t)(m_state.vi[is] + imm)) * 16u;
+        addr &= (dataSize - 1);
+        if (addr + 16 <= dataSize)
+        {
+            float tmp[4];
+            std::memcpy(tmp, vuData + addr, 16);
+            applyDest(m_state.vf[it], tmp, dest);
+        }
+        return;
+    }
+    case 0x01: // SQ (Store Quadword to VU data memory)
+    {
+        uint8_t is = FS(instr);  // VF source
+        uint8_t it = VIT(instr); // VI base
+        uint8_t dest = (instr >> 21) & 0xF;
+        int16_t imm = IMM11(instr);
+        uint32_t addr = ((uint32_t)(int32_t)(m_state.vi[it] + imm)) * 16u;
+        addr &= (dataSize - 1);
+        if (addr + 16 <= dataSize)
+        {
+            uint32_t words[4]{};
+            std::memcpy(words, m_state.vf[is], sizeof(words));
+            queueStore(addr, words, dest);
+        }
+        return;
+    }
+    case 0x04: // ILW (Integer Load Word from VU data memory)
+    {
+        uint8_t it = VIT(instr); // VI destination
+        uint8_t is = VIS(instr); // VI base
+        uint8_t dest = (instr >> 21) & 0xF;
+        int16_t imm = IMM11(instr);
+        uint32_t addr = ((uint32_t)(int32_t)(m_state.vi[is] + imm)) * 16u;
+        addr &= (dataSize - 1);
+        if (addr + 16 <= dataSize)
+        {
+            int comp = 0;
+            if (dest & 0x8)
+                comp = 0;
+            else if (dest & 0x4)
+                comp = 1;
+            else if (dest & 0x2)
+                comp = 2;
+            else
+                comp = 3;
+            uint32_t v;
+            std::memcpy(&v, vuData + addr + comp * 4, 4);
+            if (it != 0)
+                m_state.vi[it] = (int32_t)(int16_t)(v & 0xFFFF);
+        }
+        return;
+    }
+    case 0x05: // ISW (Integer Store Word to VU data memory)
+    {
+        uint8_t it = VIT(instr); // VI source
+        uint8_t is = VIS(instr); // VI base
+        uint8_t dest = (instr >> 21) & 0xF;
+        int16_t imm = IMM11(instr);
+        uint32_t addr = ((uint32_t)(int32_t)(m_state.vi[is] + imm)) * 16u;
+        addr &= (dataSize - 1);
+        if (addr + 16 <= dataSize)
+        {
+            const uint32_t val = static_cast<uint32_t>(static_cast<uint16_t>(m_state.vi[it] & 0xFFFF));
+            const uint32_t words[4] = {val, val, val, val};
+            queueStore(addr, words, dest);
+        }
+        return;
+    }
+    case 0x08: // IADDIU
+    {
+        uint8_t it = VIT(instr);
+        uint8_t is = VIS(instr);
+        int16_t imm = (int16_t)(instr & 0x7FF) | ((instr >> 10) & 0x7800);
+        if (it != 0)
+            m_state.vi[it] = (int16_t)(m_state.vi[is] + imm);
+        return;
+    }
+    case 0x09: // ISUBIU
+    {
+        uint8_t it = VIT(instr);
+        uint8_t is = VIS(instr);
+        int16_t imm = (int16_t)(instr & 0x7FF) | ((instr >> 10) & 0x7800);
+        if (it != 0)
+            m_state.vi[it] = (int16_t)(m_state.vi[is] - imm);
+        return;
+    }
+    case 0x10: // FCEQ
+    {
+        uint32_t imm24 = instr & 0xFFFFFF;
+        if (1 != 0)
+            m_state.vi[1] = ((m_state.clip & 0xFFFFFF) == imm24) ? 1 : 0;
+        return;
+    }
+    case 0x11: // FCSET
+    {
+        queueFcset(instr & 0xFFFFFFu);
+        return;
+    }
+    case 0x12: // FCAND
+    {
+        uint32_t imm24 = instr & 0xFFFFFF;
+        if (1 != 0)
+            m_state.vi[1] = ((m_state.clip & imm24) != 0) ? 1 : 0;
+        return;
+    }
+    case 0x13: // FCOR
+    {
+        uint32_t imm24 = instr & 0xFFFFFF;
+        if (1 != 0)
+            m_state.vi[1] = ((m_state.clip | imm24) == 0xFFFFFF) ? 1 : 0;
+        return;
+    }
+    case 0x14: // FSEQ
+    {
+        const uint8_t it = VIT(instr);
+        const uint16_t imm12 = static_cast<uint16_t>((((instr >> 21) & 0x1u) << 11) | (instr & 0x7FFu));
+        if (it != 0)
+            m_state.vi[it] = ((m_state.status & 0xFFFu) == imm12) ? 1 : 0;
+        return;
+    }
+    case 0x15: // FSSET
+    {
+        const uint16_t imm12 = static_cast<uint16_t>((((instr >> 21) & 0x1u) << 11) | (instr & 0x7FFu));
+        queueFsset(imm12);
+        return;
+    }
+    case 0x16: // FSAND
+    {
+        const uint8_t it = VIT(instr);
+        const uint16_t imm12 = static_cast<uint16_t>((((instr >> 21) & 0x1u) << 11) | (instr & 0x7FFu));
+        if (it != 0)
+            m_state.vi[it] = static_cast<int32_t>((m_state.status & 0xFFFu) & imm12);
+        return;
+    }
+    case 0x17: // FSOR
+    {
+        const uint8_t it = VIT(instr);
+        const uint16_t imm12 = static_cast<uint16_t>((((instr >> 21) & 0x1u) << 11) | (instr & 0x7FFu));
+        if (it != 0)
+            m_state.vi[it] = static_cast<int32_t>((m_state.status & 0xFFFu) | imm12);
+        return;
+    }
+    case 0x18: // FMEQ
+    {
+        uint8_t it = VIT(instr);
+        uint8_t is = VIS(instr);
+        if (it != 0)
+            m_state.vi[it] = ((m_state.mac & 0xFFFF) == (uint32_t)(uint16_t)m_state.vi[is]) ? 1 : 0;
+        return;
+    }
+    case 0x1A: // FMAND
+    {
+        uint8_t it = VIT(instr);
+        uint8_t is = VIS(instr);
+        if (it != 0)
+            m_state.vi[it] = (int32_t)(m_state.mac & (uint32_t)(uint16_t)m_state.vi[is]);
+        return;
+    }
+    case 0x1B: // FMOR
+    {
+        uint8_t it = VIT(instr);
+        uint8_t is = VIS(instr);
+        if (it != 0)
+            m_state.vi[it] = (int32_t)(m_state.mac | (uint32_t)(uint16_t)m_state.vi[is]);
+        return;
+    }
+    case 0x1C: // FCGET
+    {
+        const uint8_t it = VIT(instr);
+        if (it != 0)
+            m_state.vi[it] = static_cast<int32_t>(m_state.clip & 0x0FFFu);
+        return;
+    }
+    case 0x20: // B (unconditional branch)
+    {
+        int16_t imm = IMM11(instr);
+        uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
+        m_state.branchPending = true;
+        m_state.branchTarget = target;
+        m_state.branchDelay = 1;
+        return;
+    }
+    case 0x21: // BAL (Branch and link)
+    {
+        uint8_t it = VIT(instr);
+        int16_t imm = IMM11(instr);
+        uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
+        if (it != 0)
+            m_state.vi[it] = (int32_t)((m_state.pc + 16) / 8);
+        m_state.branchPending = true;
+        m_state.branchTarget = target;
+        m_state.branchDelay = 1;
+        return;
+    }
+    case 0x24: // JR
+    {
+        uint8_t is = VIS(instr);
+        // Register jumps do not use conditional branches' delayed VI operand.
+        uint32_t target = ((uint32_t)(uint16_t)m_state.vi[is] * 8u) & pcMask;
+        m_state.branchPending = true;
+        m_state.branchTarget = target;
+        m_state.branchDelay = 1;
+        return;
+    }
+    case 0x25: // JALR
+    {
+        uint8_t it = VIT(instr);
+        uint8_t is = VIS(instr);
+        uint32_t target = ((uint32_t)(uint16_t)m_state.vi[is] * 8u) & pcMask;
+        if (it != 0)
+            m_state.vi[it] = (int32_t)((m_state.pc + 16) / 8);
+        m_state.branchPending = true;
+        m_state.branchTarget = target;
+        m_state.branchDelay = 1;
+        return;
+    }
+    case 0x28: // IBEQ
+    {
+        uint8_t it = VIT(instr);
+        uint8_t is = VIS(instr);
+        int16_t imm = IMM11(instr);
+        if ((int16_t)readBranchVi(is) == (int16_t)readBranchVi(it))
+        {
+            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
+            m_state.branchPending = true;
+            m_state.branchTarget = target;
+            m_state.branchDelay = 1;
+        }
+        return;
+    }
+    case 0x29: // IBNE
+    {
+        uint8_t it = VIT(instr);
+        uint8_t is = VIS(instr);
+        int16_t imm = IMM11(instr);
+        if ((int16_t)readBranchVi(is) != (int16_t)readBranchVi(it))
+        {
+            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
+            m_state.branchPending = true;
+            m_state.branchTarget = target;
+            m_state.branchDelay = 1;
+        }
+        return;
+    }
+    case 0x2C: // IBLTZ
+    {
+        uint8_t is = VIS(instr);
+        int16_t imm = IMM11(instr);
+        if ((int16_t)readBranchVi(is) < 0)
+        {
+            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
+            m_state.branchPending = true;
+            m_state.branchTarget = target;
+            m_state.branchDelay = 1;
+        }
+        return;
+    }
+    case 0x2D: // IBGTZ
+    {
+        uint8_t is = VIS(instr);
+        int16_t imm = IMM11(instr);
+        if ((int16_t)readBranchVi(is) > 0)
+        {
+            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
+            m_state.branchPending = true;
+            m_state.branchTarget = target;
+            m_state.branchDelay = 1;
+        }
+        return;
+    }
+    case 0x2E: // IBLEZ
+    {
+        uint8_t is = VIS(instr);
+        int16_t imm = IMM11(instr);
+        if ((int16_t)readBranchVi(is) <= 0)
+        {
+            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
+            m_state.branchPending = true;
+            m_state.branchTarget = target;
+            m_state.branchDelay = 1;
+        }
+        return;
+    }
+    case 0x2F: // IBGEZ
+    {
+        uint8_t is = VIS(instr);
+        int16_t imm = IMM11(instr);
+        if ((int16_t)readBranchVi(is) >= 0)
+        {
+            uint32_t target = (m_state.pc + 8 + imm * 8) & pcMask;
+            m_state.branchPending = true;
+            m_state.branchTarget = target;
+            m_state.branchDelay = 1;
+        }
+        return;
+    }
+
+    case 0x40: // Lower1 / lower special. Bit31 set; low 6 bits select integer or special op.
+    {
+        const uint8_t funct = instr & 0x3Fu;
+        const uint8_t vfT = FT(instr);
+        const uint8_t vfS = FS(instr);
+        const uint8_t viT = VIT(instr);
+        const uint8_t viS = VIS(instr);
+        const uint8_t viD = VID(instr);
+        const uint8_t dest = (instr >> 21) & 0xF;
+
+        switch (funct)
+        {
+        case 0x30: // IADD
+            if (viD != 0)
+                m_state.vi[viD] = (int16_t)(m_state.vi[viS] + m_state.vi[viT]);
+            return;
+        case 0x31: // ISUB
+            if (viD != 0)
+                m_state.vi[viD] = (int16_t)(m_state.vi[viS] - m_state.vi[viT]);
+            return;
+        case 0x32: // IADDI
+        {
+            int16_t imm5 = (int16_t)((int32_t)((instr >> 6) & 0x1F) << 27 >> 27);
+            if (viT != 0)
+                m_state.vi[viT] = (int16_t)(m_state.vi[viS] + imm5);
+            return;
+        }
+        case 0x34: // IAND
+            if (viD != 0)
+                m_state.vi[viD] = m_state.vi[viS] & m_state.vi[viT];
+            return;
+        case 0x35: // IOR
+            if (viD != 0)
+                m_state.vi[viD] = m_state.vi[viS] | m_state.vi[viT];
+            return;
+
+        case 0x3C:
+        case 0x3D:
+        case 0x3E:
+        case 0x3F: // Lower1 special. Dobie decodes this as (instr & 3) | ((instr >> 4) & 0x7C).
+        {
+            const uint8_t funct2 = (uint8_t)((instr & 0x3u) | ((instr >> 4) & 0x7Cu));
+            switch (funct2)
+            {
+            case 0x30: // MOVE
+            {
+                float tmp[4];
+                std::memcpy(tmp, m_state.vf[vfS], 16);
+                applyDest(m_state.vf[vfT], tmp, dest);
+                return;
+            }
+            case 0x31: // MR32 (rotate right by 32 bits = shift xyzw -> yzwx)
+            {
+                float tmp[4] = {m_state.vf[vfS][1], m_state.vf[vfS][2], m_state.vf[vfS][3], m_state.vf[vfS][0]};
+                applyDest(m_state.vf[vfT], tmp, dest);
+                return;
+            }
+            case 0x34: // LQI (Load Quadword, post-increment)
+            {
+                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viS]) * 16u;
+                addr &= (dataSize - 1);
+                if (addr + 16 <= dataSize)
+                {
+                    float tmp[4];
+                    std::memcpy(tmp, vuData + addr, 16);
+                    applyDest(m_state.vf[vfT], tmp, dest);
+                }
+                if (viS != 0)
+                    m_state.vi[viS] = (int16_t)(m_state.vi[viS] + 1);
+                return;
+            }
+            case 0x35: // SQI (Store Quadword, post-increment)
+            {
+                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viT]) * 16u;
+                addr &= (dataSize - 1);
+                if (addr + 16 <= dataSize)
+                {
+                    uint32_t words[4]{};
+                    std::memcpy(words, m_state.vf[vfS], sizeof(words));
+                    queueStore(addr, words, dest);
+                }
+                if (viT != 0)
+                    m_state.vi[viT] = (int16_t)(m_state.vi[viT] + 1);
+                return;
+            }
+            case 0x36: // LQD (Load Quadword, pre-decrement)
+            {
+                if (viS != 0)
+                    m_state.vi[viS] = (int16_t)(m_state.vi[viS] - 1);
+                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viS]) * 16u;
+                addr &= (dataSize - 1);
+                if (addr + 16 <= dataSize)
+                {
+                    float tmp[4];
+                    std::memcpy(tmp, vuData + addr, 16);
+                    applyDest(m_state.vf[vfT], tmp, dest);
+                }
+                return;
+            }
+            case 0x37: // SQD (Store Quadword, pre-decrement)
+            {
+                if (viT != 0)
+                    m_state.vi[viT] = (int16_t)(m_state.vi[viT] - 1);
+                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viT]) * 16u;
+                addr &= (dataSize - 1);
+                if (addr + 16 <= dataSize)
+                {
+                    uint32_t words[4]{};
+                    std::memcpy(words, m_state.vf[vfS], sizeof(words));
+                    queueStore(addr, words, dest);
+                }
+                return;
+            }
+            case 0x38: // DIV
+            {
+                int fsf = (instr >> 21) & 0x3;
+                int ftf = (instr >> 23) & 0x3;
+                const float num = normalizeOperand(m_state.vf[vfS][fsf]);
+                const float den = normalizeOperand(m_state.vf[vfT][ftf]);
+                uint32_t statusDi = 0u;
+                float result = 0.0f;
+                if (den == 0.0f)
+                {
+                    statusDi = num == 0.0f ? 0x10u : 0x20u;
+                    result = std::signbit(num) != std::signbit(den)
+                                 ? -std::numeric_limits<float>::max()
+                                 : std::numeric_limits<float>::max();
+                }
+                else
+                {
+                    result = num / den;
+                }
+                uint32_t ignoredFlags = 0u;
+                result = normalizeResult(result, ignoredFlags);
+                queueQ(result, 7u, statusDi);
+                return;
+            }
+            case 0x39: // SQRT
+            {
+                int ftf = (instr >> 23) & 0x3;
+                const float val = normalizeOperand(m_state.vf[vfT][ftf]);
+                queueQ(std::sqrt(std::fabs(val)), 7u,
+                       val < 0.0f ? 0x10u : 0u);
+                return;
+            }
+            case 0x3A: // RSQRT
+            {
+                int fsf = (instr >> 21) & 0x3;
+                int ftf = (instr >> 23) & 0x3;
+                const float num = normalizeOperand(m_state.vf[vfS][fsf]);
+                const float radicand = normalizeOperand(m_state.vf[vfT][ftf]);
+                const float den = std::sqrt(std::fabs(radicand));
+                uint32_t statusDi = radicand < 0.0f ? 0x10u : 0u;
+                float result = 0.0f;
+                if (den != 0.0f)
+                    result = num / den;
+                else
+                {
+                    statusDi = num == 0.0f ? 0x10u : 0x20u;
+                    result = std::signbit(num)
+                                 ? -std::numeric_limits<float>::max()
+                                 : std::numeric_limits<float>::max();
+                }
+                uint32_t ignoredFlags = 0u;
+                result = normalizeResult(result, ignoredFlags);
+                queueQ(result, 13u, statusDi);
+                return;
+            }
+            case 0x3B: // WAITQ
+                return;
+            case 0x3C: // MTIR (Move To Integer Register)
+            {
+                // MTIR encodes a two-bit fsf component selector in bits
+                // 22:21. It is not a four-bit destination mask.
+                const uint32_t comp = (instr >> 21) & 0x3u;
+                uint32_t fval;
+                std::memcpy(&fval, &m_state.vf[vfS][comp], 4);
+                if (viT != 0)
+                    m_state.vi[viT] = (int32_t)(int16_t)(fval & 0xFFFF);
+                return;
+            }
+            case 0x3D: // MFIR (Move From Integer Register)
+            {
+                float result[4];
+                int32_t val = (int32_t)(int16_t)(m_state.vi[viS] & 0xFFFF);
+                std::memcpy(&result[0], &val, 4);
+                result[1] = result[0];
+                result[2] = result[0];
+                result[3] = result[0];
+                applyDest(m_state.vf[vfT], result, dest);
+                return;
+            }
+            case 0x3E: // ILWR - integer load word from address in VI[is]
+            {
+                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viS]) * 16u;
+                addr &= (dataSize - 1);
+                if (addr + 16 <= dataSize)
+                {
+                    int comp = 0;
+                    if (dest & 0x8)
+                        comp = 0;
+                    else if (dest & 0x4)
+                        comp = 1;
+                    else if (dest & 0x2)
+                        comp = 2;
+                    else
+                        comp = 3;
+                    uint32_t v;
+                    std::memcpy(&v, vuData + addr + comp * 4, 4);
+                    if (viT != 0)
+                        m_state.vi[viT] = (int32_t)(int16_t)(v & 0xFFFF);
+                }
+                return;
+            }
+            case 0x3F: // ISWR - integer store word to address in VI[is]
+            {
+                uint32_t addr = ((uint32_t)(uint16_t)m_state.vi[viS]) * 16u;
+                addr &= (dataSize - 1);
+                if (addr + 16 <= dataSize)
+                {
+                    const uint32_t val =
+                        static_cast<uint32_t>(static_cast<uint16_t>(m_state.vi[viT] & 0xFFFF));
+                    const uint32_t words[4] = {val, val, val, val};
+                    queueStore(addr, words, dest);
+                }
+                return;
+            }
+            case 0x40: // RNEXT
+            {
+                const uint32_t x = (m_state.r >> 4) & 1u;
+                const uint32_t y = (m_state.r >> 22) & 1u;
+                m_state.r = ((m_state.r << 1) ^ x ^ y) & 0x007FFFFFu;
+                m_state.r |= 0x3F800000u;
+                float value = 0.0f;
+                std::memcpy(&value, &m_state.r, sizeof(value));
+                const float result[4] = {value, value, value, value};
+                applyDest(m_state.vf[vfT], result, dest);
+                return;
+            }
+            case 0x41: // RGET
+            {
+                float value = 0.0f;
+                std::memcpy(&value, &m_state.r, sizeof(value));
+                const float result[4] = {value, value, value, value};
+                applyDest(m_state.vf[vfT], result, dest);
+                return;
+            }
+            case 0x42: // RINIT
+            {
+                const uint32_t component = (instr >> 21) & 3u;
+                uint32_t bits = 0u;
+                std::memcpy(&bits, &m_state.vf[vfS][component], sizeof(bits));
+                m_state.r = 0x3F800000u | (bits & 0x007FFFFFu);
+                return;
+            }
+            case 0x43: // RXOR
+            {
+                const uint32_t component = (instr >> 21) & 3u;
+                uint32_t bits = 0u;
+                std::memcpy(&bits, &m_state.vf[vfS][component], sizeof(bits));
+                m_state.r = 0x3F800000u | ((m_state.r ^ bits) & 0x007FFFFFu);
+                return;
+            }
+            case 0x64: // MFP (Move From P register)
+            {
+                float result[4] = {m_state.p, m_state.p, m_state.p, m_state.p};
+                applyDest(m_state.vf[vfT], result, dest);
+                return;
+            }
+            case 0x68: // XTOP - move current VIF1 TOP into VI register
+            {
+                if (viT != 0)
+                    m_state.vi[viT] = (int32_t)(m_state.top & 0x3FFu);
+                return;
+            }
+            case 0x69: // XITOP - move current VIF1 ITOP into VI register
+            {
+                if (viT != 0)
+                    m_state.vi[viT] = (int32_t)(m_state.itop & 0x3FFu);
+                return;
+            }
+            case 0x6C: // XGKICK - send GIF packet from VU1 data memory
+                startXgkick(static_cast<uint32_t>(static_cast<uint16_t>(m_state.vi[viS])));
+                return;
+            case 0x70: // ESADD
+            {
+                const float x = normalizeOperand(m_state.vf[vfS][0]);
+                const float y = normalizeOperand(m_state.vf[vfS][1]);
+                const float z = normalizeOperand(m_state.vf[vfS][2]);
+                queueP(x * x + y * y + z * z, 11u);
+                return;
+            }
+            case 0x71: // ERSADD
+            {
+                const float x = normalizeOperand(m_state.vf[vfS][0]);
+                const float y = normalizeOperand(m_state.vf[vfS][1]);
+                const float z = normalizeOperand(m_state.vf[vfS][2]);
+                const float sum = x * x + y * y + z * z;
+                queueP(sum != 0.0f ? 1.0f / sum : sum, 18u);
+                return;
+            }
+            case 0x72: // ELENG
+            {
+                const float x = normalizeOperand(m_state.vf[vfS][0]);
+                const float y = normalizeOperand(m_state.vf[vfS][1]);
+                const float z = normalizeOperand(m_state.vf[vfS][2]);
+                queueP(std::sqrt(x * x + y * y + z * z), 18u);
+                return;
+            }
+            case 0x73: // ERLENG
+            {
+                const float x = normalizeOperand(m_state.vf[vfS][0]);
+                const float y = normalizeOperand(m_state.vf[vfS][1]);
+                const float z = normalizeOperand(m_state.vf[vfS][2]);
+                const float len = std::sqrt(x * x + y * y + z * z);
+                queueP(len != 0.0f ? 1.0f / len : len, 24u);
+                return;
+            }
+            case 0x74: // EATANxy
+            {
+                const float x = normalizeOperand(m_state.vf[vfS][0]);
+                const float y = normalizeOperand(m_state.vf[vfS][1]);
+                queueP(x != 0.0f ? vuEatan(y / x) : 0.0f, 54u);
+                return;
+            }
+            case 0x75: // EATANxz
+            {
+                const float x = normalizeOperand(m_state.vf[vfS][0]);
+                const float z = normalizeOperand(m_state.vf[vfS][2]);
+                queueP(x != 0.0f ? vuEatan(z / x) : 0.0f, 54u);
+                return;
+            }
+            case 0x76: // ESUM
+            {
+                float sum = 0.0f;
+                for (uint32_t component = 0; component < 4u; ++component)
+                    sum += normalizeOperand(m_state.vf[vfS][component]);
+                queueP(sum, 12u);
+                return;
+            }
+            case 0x77: // ERSQRT
+            {
+                const uint32_t component = (instr >> 21) & 3u;
+                const float value = normalizeOperand(m_state.vf[vfS][component]);
+                float result = value;
+                if (result >= 0.0f)
+                {
+                    result = std::sqrt(result);
+                    if (result != 0.0f)
+                        result = 1.0f / result;
+                }
+                queueP(result, 18u);
+                return;
+            }
+            case 0x78: // ESQRT
+            {
+                const uint32_t component = (instr >> 21) & 3u;
+                const float value = normalizeOperand(m_state.vf[vfS][component]);
+                queueP(value >= 0.0f ? std::sqrt(value) : value, 12u);
+                return;
+            }
+            case 0x79: // ESIN
+            {
+                const uint32_t component = (instr >> 21) & 3u;
+                const float value = normalizeOperand(m_state.vf[vfS][component]);
+                queueP(vuEsin(value), 29u);
+                return;
+            }
+            case 0x7A: // ERCPR
+            {
+                const uint32_t component = (instr >> 21) & 3u;
+                const float value = normalizeOperand(m_state.vf[vfS][component]);
+                queueP(value != 0.0f ? 1.0f / value : value, 12u);
+                return;
+            }
+            case 0x7B: // WAITP
+                return;
+            case 0x7C: // EATAN
+            {
+                const uint32_t component = (instr >> 21) & 3u;
+                queueP(vuEatan(normalizeOperand(m_state.vf[vfS][component])), 54u);
+                return;
+            }
+            case 0x7D: // EEXP
+            {
+                const uint32_t component = (instr >> 21) & 3u;
+                queueP(vuEexp(normalizeOperand(m_state.vf[vfS][component])), 44u);
+                return;
+            }
+            default:
+                reportReservedInstruction(false, instr);
+                return;
+            }
+        }
+        default:
+            reportReservedInstruction(false, instr);
+            return;
+        }
+    }
+    default:
+        reportReservedInstruction(false, instr);
+        break;
+    }
+}
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
index 776119dfb..9317d256c 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.cpp
@@ -1,511 +1,6 @@
-#include "runtime/ps2_vu1.h"
-#include "ps2_vu1_detail.h"
+#include "ps2_vu1_exec.inl"
 
-#include <cmath>
-#include <cstring>
-#include <limits>
-
-namespace
-{
-    int32_t vuFloatToInt(float value, float scale)
-    {
-        const double scaled = static_cast<double>(value) * static_cast<double>(scale);
-        if (scaled >= static_cast<double>(std::numeric_limits<int32_t>::max()))
-            return std::numeric_limits<int32_t>::max();
-        if (scaled <= static_cast<double>(std::numeric_limits<int32_t>::min()))
-            return std::numeric_limits<int32_t>::min();
-        return static_cast<int32_t>(scaled);
-    }
-}
-
-// ============================================================================
-// Upper instructions (FMAC pipeline)
-// ============================================================================
 void VU1Interpreter::execUpper(uint32_t instr)
 {
     execUpperInline(instr);
 }
-
-PS2_VU_FORCE_INLINE void VU1Interpreter::execUpperInline(uint32_t instr)
-{
-    m_currentUpperInstruction = instr;
-    uint8_t dest = DEST(instr);
-    uint8_t ft = FT(instr);
-    uint8_t fs = FS(instr);
-    uint8_t fd = FD(instr);
-    uint8_t op = instr & 0x3F;
-
-    // Lower-pipeline work often pairs with an upper NOP; it has no operands.
-    if (op >= 0x3Cu)
-    {
-        const uint8_t special = (instr & 3u) | ((instr >> 4) & 0x7Cu);
-        if (special == 0x2Fu || special == 0x30u)
-            return;
-    }
-
-    float *vd = m_state.vf[fd];
-    // Normalize only operands used by this opcode, after dispatch selects it.
-    const auto vs = [this, fs](unsigned c) { return normalizeOperand(m_state.vf[fs][c]); };
-    const auto vt = [this, ft](unsigned c) { return normalizeOperand(m_state.vf[ft][c]); };
-    const auto acc = [this](unsigned c) { return normalizeOperand(m_state.acc[c]); };
-    const auto q = [this] { return normalizeOperand(m_state.q); };
-    const auto i = [this] { return normalizeOperand(m_state.i); };
-    float result[4];
-
-    // Upper opcode decoding (bits 5:0 of upper word)
-    switch (op)
-    {
-    case 0x00:
-    case 0x01:
-    case 0x02:
-    case 0x03: // ADDbc
-    {
-        float bc = vt(op & 3);
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) + bc;
-        applyFmacDest(vd, result, dest);
-        return;
-    }
-    case 0x04:
-    case 0x05:
-    case 0x06:
-    case 0x07: // SUBbc
-    {
-        float bc = vt(op & 3);
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) - bc;
-        applyFmacDest(vd, result, dest);
-        return;
-    }
-    case 0x08:
-    case 0x09:
-    case 0x0A:
-    case 0x0B: // MADDbc
-    {
-        float bc = vt(op & 3);
-        for (int c = 0; c < 4; c++)
-            result[c] = acc(c) + vs(c) * bc;
-        applyFmacDest(vd, result, dest);
-        return;
-    }
-    case 0x0C:
-    case 0x0D:
-    case 0x0E:
-    case 0x0F: // MSUBbc
-    {
-        float bc = vt(op & 3);
-        for (int c = 0; c < 4; c++)
-            result[c] = acc(c) - vs(c) * bc;
-        applyFmacDest(vd, result, dest);
-        return;
-    }
-    case 0x10:
-    case 0x11:
-    case 0x12:
-    case 0x13: // MAXbc
-    {
-        float bc = vt(op & 3);
-        for (int c = 0; c < 4; c++)
-            result[c] = (vs(c) > bc) ? vs(c) : bc;
-        applyDest(vd, result, dest);
-        return;
-    }
-    case 0x14:
-    case 0x15:
-    case 0x16:
-    case 0x17: // MINIbc
-    {
-        float bc = vt(op & 3);
-        for (int c = 0; c < 4; c++)
-            result[c] = (vs(c) < bc) ? vs(c) : bc;
-        applyDest(vd, result, dest);
-        return;
-    }
-    case 0x18:
-    case 0x19:
-    case 0x1A:
-    case 0x1B: // MULbc
-    {
-        float bc = vt(op & 3);
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) * bc;
-        applyFmacDest(vd, result, dest);
-        return;
-    }
-    case 0x1C: // MULq
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) * q();
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x1D: // MAXi
-        for (int c = 0; c < 4; c++)
-            result[c] = (vs(c) > i()) ? vs(c) : i();
-        applyDest(vd, result, dest);
-        return;
-    case 0x1E: // MULi
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) * i();
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x1F: // MINIi
-        for (int c = 0; c < 4; c++)
-            result[c] = (vs(c) < i()) ? vs(c) : i();
-        applyDest(vd, result, dest);
-        return;
-    case 0x20: // ADDq
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) + q();
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x21: // MADDq
-        for (int c = 0; c < 4; c++)
-            result[c] = acc(c) + vs(c) * q();
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x22: // ADDi
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) + i();
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x23: // MADDi
-        for (int c = 0; c < 4; c++)
-            result[c] = acc(c) + vs(c) * i();
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x24: // SUBq
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) - q();
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x25: // MSUBq
-        for (int c = 0; c < 4; c++)
-            result[c] = acc(c) - vs(c) * q();
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x26: // SUBi
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) - i();
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x27: // MSUBi
-        for (int c = 0; c < 4; c++)
-            result[c] = acc(c) - vs(c) * i();
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x28: // ADD
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) + vt(c);
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x29: // MADD
-        for (int c = 0; c < 4; c++)
-            result[c] = acc(c) + vs(c) * vt(c);
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x2A: // MUL
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) * vt(c);
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x2B: // MAX
-        for (int c = 0; c < 4; c++)
-            result[c] = (vs(c) > vt(c)) ? vs(c) : vt(c);
-        applyDest(vd, result, dest);
-        return;
-    case 0x2C: // SUB
-        for (int c = 0; c < 4; c++)
-            result[c] = vs(c) - vt(c);
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x2D: // MSUB
-        for (int c = 0; c < 4; c++)
-            result[c] = acc(c) - vs(c) * vt(c);
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x2E: // OPMSUB
-        result[0] = acc(0) - vs(1) * vt(2);
-        result[1] = acc(1) - vs(2) * vt(0);
-        result[2] = acc(2) - vs(0) * vt(1);
-        result[3] = 0.0f;
-        applyFmacDest(vd, result, dest);
-        return;
-    case 0x2F: // MINI
-        for (int c = 0; c < 4; c++)
-            result[c] = (vs(c) < vt(c)) ? vs(c) : vt(c);
-        applyDest(vd, result, dest);
-        return;
-
-    // Upper special group (low op 0x3C..0x3F).
-    // Like lower1 special, the real selector is not just bits 5:0.  Dobie decodes:
-    //   op = (instr & 0x3) | ((instr >> 4) & 0x7C)
-    // Several instructions in this group also use FT as the destination, not FD.
-    case 0x3C:
-    case 0x3D:
-    case 0x3E:
-    case 0x3F:
-    {
-        const uint8_t specialOp = static_cast<uint8_t>((instr & 0x3u) | ((instr >> 4) & 0x7Cu));
-        float *vtDest = m_state.vf[ft];
-
-        switch (specialOp)
-        {
-        case 0x00:
-        case 0x01:
-        case 0x02:
-        case 0x03: // ADDAbc
-        {
-            float bc = vt(specialOp & 3);
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) + bc;
-            applyFmacDestAcc(result, dest);
-            return;
-        }
-        case 0x04:
-        case 0x05:
-        case 0x06:
-        case 0x07: // SUBAbc
-        {
-            float bc = vt(specialOp & 3);
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) - bc;
-            applyFmacDestAcc(result, dest);
-            return;
-        }
-        case 0x08:
-        case 0x09:
-        case 0x0A:
-        case 0x0B: // MADDAbc
-        {
-            float bc = vt(specialOp & 3);
-            for (int c = 0; c < 4; c++)
-                result[c] = acc(c) + vs(c) * bc;
-            applyFmacDestAcc(result, dest);
-            return;
-        }
-        case 0x0C:
-        case 0x0D:
-        case 0x0E:
-        case 0x0F: // MSUBAbc
-        {
-            float bc = vt(specialOp & 3);
-            for (int c = 0; c < 4; c++)
-                result[c] = acc(c) - vs(c) * bc;
-            applyFmacDestAcc(result, dest);
-            return;
-        }
-        case 0x10: // ITOF0
-            for (int c = 0; c < 4; c++)
-            {
-                int32_t iv;
-                std::memcpy(&iv, &m_state.vf[fs][c], 4);
-                result[c] = static_cast<float>(iv);
-            }
-            applyDest(vtDest, result, dest);
-            return;
-        case 0x11: // ITOF4
-            for (int c = 0; c < 4; c++)
-            {
-                int32_t iv;
-                std::memcpy(&iv, &m_state.vf[fs][c], 4);
-                result[c] = static_cast<float>(iv) / 16.0f;
-            }
-            applyDest(vtDest, result, dest);
-            return;
-        case 0x12: // ITOF12
-            for (int c = 0; c < 4; c++)
-            {
-                int32_t iv;
-                std::memcpy(&iv, &m_state.vf[fs][c], 4);
-                result[c] = static_cast<float>(iv) / 4096.0f;
-            }
-            applyDest(vtDest, result, dest);
-            return;
-        case 0x13: // ITOF15
-            for (int c = 0; c < 4; c++)
-            {
-                int32_t iv;
-                std::memcpy(&iv, &m_state.vf[fs][c], 4);
-                result[c] = static_cast<float>(iv) / 32768.0f;
-            }
-            applyDest(vtDest, result, dest);
-            return;
-        case 0x14: // FTOI0
-            for (int c = 0; c < 4; c++)
-            {
-                int32_t iv = vuFloatToInt(vs(c), 1.0f);
-                std::memcpy(&result[c], &iv, 4);
-            }
-            applyDest(vtDest, result, dest);
-            return;
-        case 0x15: // FTOI4
-            for (int c = 0; c < 4; c++)
-            {
-                int32_t iv = vuFloatToInt(vs(c), 16.0f);
-                std::memcpy(&result[c], &iv, 4);
-            }
-            applyDest(vtDest, result, dest);
-            return;
-        case 0x16: // FTOI12
-            for (int c = 0; c < 4; c++)
-            {
-                int32_t iv = vuFloatToInt(vs(c), 4096.0f);
-                std::memcpy(&result[c], &iv, 4);
-            }
-            applyDest(vtDest, result, dest);
-            return;
-        case 0x17: // FTOI15
-            for (int c = 0; c < 4; c++)
-            {
-                int32_t iv = vuFloatToInt(vs(c), 32768.0f);
-                std::memcpy(&result[c], &iv, 4);
-            }
-            applyDest(vtDest, result, dest);
-            return;
-        case 0x18:
-        case 0x19:
-        case 0x1A:
-        case 0x1B: // MULAbc
-        {
-            float bc = vt(specialOp & 3);
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) * bc;
-            applyFmacDestAcc(result, dest);
-            return;
-        }
-        case 0x1C: // MULAq
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) * q();
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x1D: // ABS
-            for (int c = 0; c < 4; c++)
-                result[c] = std::fabs(vs(c));
-            applyDest(vtDest, result, dest);
-            return;
-        case 0x1E: // MULAi
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) * i();
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x1F: // CLIP
-        {
-            uint32_t wBits = 0u;
-            std::memcpy(&wBits, &m_state.vf[ft][3], sizeof(wBits));
-            const int32_t limit = (wBits & 0x7F800000u) != 0u ? static_cast<int32_t>(wBits & 0x7FFFFFFFu) : 0x007FFFFF;
-
-            const auto exceedsClipPlane = [limit](float value, uint32_t signMask)
-            {
-                uint32_t bits = 0u;
-                std::memcpy(&bits, &value, sizeof(bits));
-                bits ^= signMask;
-                int32_t orderedBits = 0;
-                std::memcpy(&orderedBits, &bits, sizeof(orderedBits));
-                return orderedBits > limit;
-            };
-
-            uint32_t flags = 0u;
-            if (exceedsClipPlane(m_state.vf[fs][0], 0x00000000u))
-                flags |= 0x01u;
-            if (exceedsClipPlane(m_state.vf[fs][0], 0x80000000u))
-                flags |= 0x02u;
-            if (exceedsClipPlane(m_state.vf[fs][1], 0x00000000u))
-                flags |= 0x04u;
-            if (exceedsClipPlane(m_state.vf[fs][1], 0x80000000u))
-                flags |= 0x08u;
-            if (exceedsClipPlane(m_state.vf[fs][2], 0x00000000u))
-                flags |= 0x10u;
-            if (exceedsClipPlane(m_state.vf[fs][2], 0x80000000u))
-                flags |= 0x20u;
-            queueClip(flags);
-            return;
-        }
-        case 0x20: // ADDAq
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) + q();
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x21: // MADDAq
-            for (int c = 0; c < 4; c++)
-                result[c] = acc(c) + vs(c) * q();
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x22: // ADDAi
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) + i();
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x23: // MADDAi
-            for (int c = 0; c < 4; c++)
-                result[c] = acc(c) + vs(c) * i();
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x24: // SUBAq
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) - q();
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x25: // MSUBAq
-            for (int c = 0; c < 4; c++)
-                result[c] = acc(c) - vs(c) * q();
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x26: // SUBAi
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) - i();
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x27: // MSUBAi
-            for (int c = 0; c < 4; c++)
-                result[c] = acc(c) - vs(c) * i();
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x28: // ADDA
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) + vt(c);
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x29: // MADDA
-            for (int c = 0; c < 4; c++)
-                result[c] = acc(c) + vs(c) * vt(c);
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x2A: // MULA
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) * vt(c);
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x2C: // SUBA
-            for (int c = 0; c < 4; c++)
-                result[c] = vs(c) - vt(c);
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x2D: // MSUBA
-            for (int c = 0; c < 4; c++)
-                result[c] = acc(c) - vs(c) * vt(c);
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x2E: // OPMULA
-            result[0] = vs(1) * vt(2);
-            result[1] = vs(2) * vt(0);
-            result[2] = vs(0) * vt(1);
-            result[3] = 0.0f;
-            applyFmacDestAcc(result, dest);
-            return;
-        case 0x2F:
-        case 0x30: // NOP
-            return;
-        default:
-            reportReservedInstruction(true, instr);
-            return;
-        }
-    }
-
-    case 0x30:
-    case 0x31:
-    case 0x32:
-    case 0x33:
-    default:
-        reportReservedInstruction(true, instr);
-        return;
-    }
-}
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.inl
new file mode 100644
index 000000000..1d91288a2
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.inl
@@ -0,0 +1,547 @@
+#include "runtime/ps2_vu1.h"
+#include "ps2_vu1_detail.h"
+#include "ps2_vu1_fmac_neon.h"
+
+#include <cmath>
+#include <cstring>
+#include <limits>
+
+namespace ps2_vu_detail
+{
+    inline int32_t vuFloatToInt(float value, float scale)
+    {
+        const double scaled = static_cast<double>(value) * static_cast<double>(scale);
+        if (scaled >= static_cast<double>(std::numeric_limits<int32_t>::max()))
+            return std::numeric_limits<int32_t>::max();
+        if (scaled <= static_cast<double>(std::numeric_limits<int32_t>::min()))
+            return std::numeric_limits<int32_t>::min();
+        return static_cast<int32_t>(scaled);
+    }
+}
+
+using ps2_vu_detail::vuFloatToInt;
+
+// ============================================================================
+// Upper instructions (FMAC pipeline)
+// ============================================================================
+
+PS2_VU_FORCE_INLINE void VU1Interpreter::execUpperInline(uint32_t instr)
+{
+    m_currentUpperInstruction = instr;
+    uint8_t dest = DEST(instr);
+    uint8_t ft = FT(instr);
+    uint8_t fs = FS(instr);
+    uint8_t fd = FD(instr);
+    uint8_t op = instr & 0x3F;
+
+    // Lower-pipeline work often pairs with an upper NOP; it has no operands.
+    if (op >= 0x3Cu)
+    {
+        const uint8_t special = (instr & 3u) | ((instr >> 4) & 0x7Cu);
+        if (special == 0x2Fu || special == 0x30u)
+            return;
+    }
+
+    float *vd = m_state.vf[fd];
+    float result[4];
+#if defined(__aarch64__)
+    const uint8_t arithmeticOp = op < 0x3cu ? op : (instr & 3u) | ((instr >> 4u) & 0x7cu);
+    const bool productSum = (arithmeticOp >= 8u && arithmeticOp <= 0xfu) ||
+        arithmeticOp == 0x21u || arithmeticOp == 0x23u || arithmeticOp == 0x25u ||
+        arithmeticOp == 0x27u || arithmeticOp == 0x29u || arithmeticOp == 0x2du;
+    // Keep the scalar execution mode independent for differential replays.
+    if (m_useCompiledExecution && productSum)
+    {
+        float rightBroadcast[4];
+        const float *right = m_state.vf[ft];
+        if (arithmeticOp <= 0xfu || arithmeticOp == 0x21u || arithmeticOp == 0x25u ||
+            arithmeticOp == 0x23u || arithmeticOp == 0x27u)
+        {
+            const float scalar = arithmeticOp <= 0xfu ? m_state.vf[ft][arithmeticOp & 3u] :
+                (arithmeticOp == 0x21u || arithmeticOp == 0x25u ? m_state.q : m_state.i);
+            for (auto &lane : rightBroadcast)
+                lane = scalar;
+            right = rightBroadcast;
+        }
+        uint8_t laneFlags[4];
+        uint32_t extraSticky;
+        const bool subtract = (arithmeticOp >= 0xcu && arithmeticOp <= 0xfu) ||
+            arithmeticOp == 0x25u || arithmeticOp == 0x27u || arithmeticOp == 0x2du;
+        const bool fast = subtract
+            ? ps2_vu_detail::tryProductSumVector<true>(m_state.vf[fs], right, m_state.acc, dest, result, laneFlags, extraSticky)
+            : ps2_vu_detail::tryProductSumVector<false>(m_state.vf[fs], right, m_state.acc, dest, result, laneFlags, extraSticky);
+        if (fast)
+        {
+            updateFmacFlags(laneFlags, dest, extraSticky);
+            if (op >= 0x3cu)
+                applyDestAcc(result, dest);
+            else
+                applyDest(vd, result, dest);
+            return;
+        }
+    }
+#endif
+    // Normalize only operands used by this opcode, after dispatch selects it.
+    const auto vs = [this, fs](unsigned c) { return normalizeOperand(m_state.vf[fs][c]); };
+    const auto vt = [this, ft](unsigned c) { return normalizeOperand(m_state.vf[ft][c]); };
+    const auto acc = [this](unsigned c) { return normalizeOperand(m_state.acc[c]); };
+    const auto q = [this] { return normalizeOperand(m_state.q); };
+    const auto i = [this] { return normalizeOperand(m_state.i); };
+
+    // Upper opcode decoding (bits 5:0 of upper word)
+    switch (op)
+    {
+    case 0x00:
+    case 0x01:
+    case 0x02:
+    case 0x03: // ADDbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) + bc;
+        applyFmacDest(vd, result, dest);
+        return;
+    }
+    case 0x04:
+    case 0x05:
+    case 0x06:
+    case 0x07: // SUBbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) - bc;
+        applyFmacDest(vd, result, dest);
+        return;
+    }
+    case 0x08:
+    case 0x09:
+    case 0x0A:
+    case 0x0B: // MADDbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) + vs(c) * bc;
+        applyFmacDest(vd, result, dest);
+        return;
+    }
+    case 0x0C:
+    case 0x0D:
+    case 0x0E:
+    case 0x0F: // MSUBbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) - vs(c) * bc;
+        applyFmacDest(vd, result, dest);
+        return;
+    }
+    case 0x10:
+    case 0x11:
+    case 0x12:
+    case 0x13: // MAXbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) > bc) ? vs(c) : bc;
+        applyDest(vd, result, dest);
+        return;
+    }
+    case 0x14:
+    case 0x15:
+    case 0x16:
+    case 0x17: // MINIbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) < bc) ? vs(c) : bc;
+        applyDest(vd, result, dest);
+        return;
+    }
+    case 0x18:
+    case 0x19:
+    case 0x1A:
+    case 0x1B: // MULbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) * bc;
+        applyFmacDest(vd, result, dest);
+        return;
+    }
+    case 0x1C: // MULq
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) * q();
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x1D: // MAXi
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) > i()) ? vs(c) : i();
+        applyDest(vd, result, dest);
+        return;
+    case 0x1E: // MULi
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) * i();
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x1F: // MINIi
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) < i()) ? vs(c) : i();
+        applyDest(vd, result, dest);
+        return;
+    case 0x20: // ADDq
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) + q();
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x21: // MADDq
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) + vs(c) * q();
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x22: // ADDi
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) + i();
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x23: // MADDi
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) + vs(c) * i();
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x24: // SUBq
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) - q();
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x25: // MSUBq
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) - vs(c) * q();
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x26: // SUBi
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) - i();
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x27: // MSUBi
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) - vs(c) * i();
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x28: // ADD
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) + vt(c);
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x29: // MADD
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) + vs(c) * vt(c);
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x2A: // MUL
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) * vt(c);
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x2B: // MAX
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) > vt(c)) ? vs(c) : vt(c);
+        applyDest(vd, result, dest);
+        return;
+    case 0x2C: // SUB
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) - vt(c);
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x2D: // MSUB
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) - vs(c) * vt(c);
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x2E: // OPMSUB
+        result[0] = acc(0) - vs(1) * vt(2);
+        result[1] = acc(1) - vs(2) * vt(0);
+        result[2] = acc(2) - vs(0) * vt(1);
+        result[3] = 0.0f;
+        applyFmacDest(vd, result, dest);
+        return;
+    case 0x2F: // MINI
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) < vt(c)) ? vs(c) : vt(c);
+        applyDest(vd, result, dest);
+        return;
+
+    // Upper special group (low op 0x3C..0x3F).
+    // Like lower1 special, the real selector is not just bits 5:0.  Dobie decodes:
+    //   op = (instr & 0x3) | ((instr >> 4) & 0x7C)
+    // Several instructions in this group also use FT as the destination, not FD.
+    case 0x3C:
+    case 0x3D:
+    case 0x3E:
+    case 0x3F:
+    {
+        const uint8_t specialOp = static_cast<uint8_t>((instr & 0x3u) | ((instr >> 4) & 0x7Cu));
+        float *vtDest = m_state.vf[ft];
+
+        switch (specialOp)
+        {
+        case 0x00:
+        case 0x01:
+        case 0x02:
+        case 0x03: // ADDAbc
+        {
+            float bc = vt(specialOp & 3);
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) + bc;
+            applyFmacDestAcc(result, dest);
+            return;
+        }
+        case 0x04:
+        case 0x05:
+        case 0x06:
+        case 0x07: // SUBAbc
+        {
+            float bc = vt(specialOp & 3);
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) - bc;
+            applyFmacDestAcc(result, dest);
+            return;
+        }
+        case 0x08:
+        case 0x09:
+        case 0x0A:
+        case 0x0B: // MADDAbc
+        {
+            float bc = vt(specialOp & 3);
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) + vs(c) * bc;
+            applyFmacDestAcc(result, dest);
+            return;
+        }
+        case 0x0C:
+        case 0x0D:
+        case 0x0E:
+        case 0x0F: // MSUBAbc
+        {
+            float bc = vt(specialOp & 3);
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) - vs(c) * bc;
+            applyFmacDestAcc(result, dest);
+            return;
+        }
+        case 0x10: // ITOF0
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv;
+                std::memcpy(&iv, &m_state.vf[fs][c], 4);
+                result[c] = static_cast<float>(iv);
+            }
+            applyDest(vtDest, result, dest);
+            return;
+        case 0x11: // ITOF4
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv;
+                std::memcpy(&iv, &m_state.vf[fs][c], 4);
+                result[c] = static_cast<float>(iv) / 16.0f;
+            }
+            applyDest(vtDest, result, dest);
+            return;
+        case 0x12: // ITOF12
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv;
+                std::memcpy(&iv, &m_state.vf[fs][c], 4);
+                result[c] = static_cast<float>(iv) / 4096.0f;
+            }
+            applyDest(vtDest, result, dest);
+            return;
+        case 0x13: // ITOF15
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv;
+                std::memcpy(&iv, &m_state.vf[fs][c], 4);
+                result[c] = static_cast<float>(iv) / 32768.0f;
+            }
+            applyDest(vtDest, result, dest);
+            return;
+        case 0x14: // FTOI0
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv = vuFloatToInt(vs(c), 1.0f);
+                std::memcpy(&result[c], &iv, 4);
+            }
+            applyDest(vtDest, result, dest);
+            return;
+        case 0x15: // FTOI4
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv = vuFloatToInt(vs(c), 16.0f);
+                std::memcpy(&result[c], &iv, 4);
+            }
+            applyDest(vtDest, result, dest);
+            return;
+        case 0x16: // FTOI12
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv = vuFloatToInt(vs(c), 4096.0f);
+                std::memcpy(&result[c], &iv, 4);
+            }
+            applyDest(vtDest, result, dest);
+            return;
+        case 0x17: // FTOI15
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv = vuFloatToInt(vs(c), 32768.0f);
+                std::memcpy(&result[c], &iv, 4);
+            }
+            applyDest(vtDest, result, dest);
+            return;
+        case 0x18:
+        case 0x19:
+        case 0x1A:
+        case 0x1B: // MULAbc
+        {
+            float bc = vt(specialOp & 3);
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) * bc;
+            applyFmacDestAcc(result, dest);
+            return;
+        }
+        case 0x1C: // MULAq
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) * q();
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x1D: // ABS
+            for (int c = 0; c < 4; c++)
+                result[c] = std::fabs(vs(c));
+            applyDest(vtDest, result, dest);
+            return;
+        case 0x1E: // MULAi
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) * i();
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x1F: // CLIP
+        {
+            uint32_t wBits = 0u;
+            std::memcpy(&wBits, &m_state.vf[ft][3], sizeof(wBits));
+            const int32_t limit = (wBits & 0x7F800000u) != 0u ? static_cast<int32_t>(wBits & 0x7FFFFFFFu) : 0x007FFFFF;
+
+            const auto exceedsClipPlane = [limit](float value, uint32_t signMask)
+            {
+                uint32_t bits = 0u;
+                std::memcpy(&bits, &value, sizeof(bits));
+                bits ^= signMask;
+                int32_t orderedBits = 0;
+                std::memcpy(&orderedBits, &bits, sizeof(orderedBits));
+                return orderedBits > limit;
+            };
+
+            uint32_t flags = 0u;
+            if (exceedsClipPlane(m_state.vf[fs][0], 0x00000000u))
+                flags |= 0x01u;
+            if (exceedsClipPlane(m_state.vf[fs][0], 0x80000000u))
+                flags |= 0x02u;
+            if (exceedsClipPlane(m_state.vf[fs][1], 0x00000000u))
+                flags |= 0x04u;
+            if (exceedsClipPlane(m_state.vf[fs][1], 0x80000000u))
+                flags |= 0x08u;
+            if (exceedsClipPlane(m_state.vf[fs][2], 0x00000000u))
+                flags |= 0x10u;
+            if (exceedsClipPlane(m_state.vf[fs][2], 0x80000000u))
+                flags |= 0x20u;
+            queueClip(flags);
+            return;
+        }
+        case 0x20: // ADDAq
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) + q();
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x21: // MADDAq
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) + vs(c) * q();
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x22: // ADDAi
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) + i();
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x23: // MADDAi
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) + vs(c) * i();
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x24: // SUBAq
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) - q();
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x25: // MSUBAq
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) - vs(c) * q();
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x26: // SUBAi
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) - i();
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x27: // MSUBAi
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) - vs(c) * i();
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x28: // ADDA
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) + vt(c);
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x29: // MADDA
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) + vs(c) * vt(c);
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x2A: // MULA
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) * vt(c);
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x2C: // SUBA
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) - vt(c);
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x2D: // MSUBA
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) - vs(c) * vt(c);
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x2E: // OPMULA
+            result[0] = vs(1) * vt(2);
+            result[1] = vs(2) * vt(0);
+            result[2] = vs(0) * vt(1);
+            result[3] = 0.0f;
+            applyFmacDestAcc(result, dest);
+            return;
+        case 0x2F:
+        case 0x30: // NOP
+            return;
+        default:
+            reportReservedInstruction(true, instr);
+            return;
+        }
+    }
+
+    case 0x30:
+    case 0x31:
+    case 0x32:
+    case 0x33:
+    default:
+        reportReservedInstruction(true, instr);
+        return;
+    }
+}
diff --git a/ps2xTest/src/ps2_vu1_tests.cpp b/ps2xTest/src/ps2_vu1_tests.cpp
index 4bffe9773..1a6b23e09 100644
--- a/ps2xTest/src/ps2_vu1_tests.cpp
+++ b/ps2xTest/src/ps2_vu1_tests.cpp
@@ -4,7 +4,10 @@
 #include "runtime/gs/ps2_gs_psmct32.h"
 #include "runtime/ps2_memory.h"
 #include "runtime/ps2_vu1.h"
+#include "../../ps2xRuntime/src/lib/vu/ps2_vu1_fmac.h"
+#include "../../ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h"
 
+#include <cfenv>
 #include <cmath>
 #include <cstdint>
 #include <cstring>
@@ -1881,6 +1884,207 @@ void register_ps2_vu1_tests()
             }
         });
 
+        tc.Run("FMAC product-sum fast flags require a certified normal result", [](TestCase &t)
+        {
+            const float minimum = std::numeric_limits<float>::min();
+            const float maximum = std::numeric_limits<float>::max();
+            t.IsTrue(ps2_vu_detail::normalProductSumFlags(7.0f, 2.0f, 3.0f),
+                     "ordinary matrix arithmetic should use the fast flags");
+            t.IsTrue(!ps2_vu_detail::normalProductSumFlags(minimum, minimum, 0.5f),
+                     "the minimum normal exponent requires exact underflow checks");
+            t.IsTrue(!ps2_vu_detail::normalProductSumFlags(maximum, maximum, 1.0f),
+                     "the maximum exponent requires exact overflow checks");
+            t.IsTrue(!ps2_vu_detail::normalProductSumFlags(maximum / 2.0f, maximum, 2.0f),
+                     "a clamped product followed by cancellation is not certified");
+            t.IsTrue(!ps2_vu_detail::normalProductSumFlags(0x1p-22f, 1.0f, 1.0f),
+                     "near cancellation must keep exact checks");
+            t.IsTrue(ps2_vu_detail::normalProductSumFlags(0x1p106f, 0x1p63f, 0x1p62f),
+                     "product exponent sum 379 and result exponent plus 146 are included");
+            t.IsTrue(!ps2_vu_detail::normalProductSumFlags(0x1p107f, 0x1p63f, 0x1p63f),
+                     "product exponent sum 380 retains the exact fallback");
+            t.IsTrue(!ps2_vu_detail::normalProductSumFlags(0x1p105f, 0x1p63f, 0x1p62f),
+                     "product exponent sum at result exponent plus 147 is excluded");
+            t.IsTrue(ps2_vu_detail::normalProductSumFlags(7.0f, 0.0f, maximum) &&
+                     ps2_vu_detail::normalProductSumFlags(-7.0f, maximum, -0.0f),
+                     "both signed-zero multiplicands leave a normal accumulator unchanged");
+        });
+
+        tc.Run("FMAC product-sum fast flags match exact fused and separate arithmetic", [](TestCase &t)
+        {
+            struct RestoreRounding {
+                int mode = std::fegetround();
+                ~RestoreRounding() { std::fesetround(mode); }
+            } rounding;
+            std::fesetround(FE_TOWARDZERO);
+            uint64_t randomState = 0x8467410553247782ull;
+            const auto random = [&]() {
+                randomState ^= randomState << 13u;
+                randomState ^= randomState >> 7u;
+                randomState ^= randomState << 17u;
+                return static_cast<uint32_t>(randomState);
+            };
+            const auto normalized = [](uint32_t bits) {
+                const uint32_t exponent = bits & 0x7f800000u;
+                if (exponent == 0u)
+                    bits &= 0x80000000u;
+                else if (exponent == 0x7f800000u)
+                    bits = (bits & 0x80000000u) | 0x7f7fffffu;
+                return std::bit_cast<float>(bits);
+            };
+            uint32_t accepted = 0u;
+            bool matches = true;
+            const auto check = [&](float left, float right, float acc) {
+                volatile float product = left * right;
+                const float results[] = {product + acc, std::fma(left, right, acc)};
+                const long double exact = static_cast<long double>(left) * right + acc;
+                for (const float result : results)
+                {
+                    if (!ps2_vu_detail::normalProductSumFlags(result, left, right))
+                        continue;
+                    ++accepted;
+                    matches &= std::signbit(exact) == std::signbit(result) &&
+                        std::fabs(exact) >= std::numeric_limits<float>::min() &&
+                        std::fabs(exact) <= std::numeric_limits<float>::max();
+                }
+            };
+            for (uint32_t iteration = 0u; iteration < 100000u; ++iteration)
+            {
+                const float left = normalized(random()), right = normalized(random());
+                check(left, right, normalized(random()));
+                const uint32_t oppositeProduct = std::bit_cast<uint32_t>(left * right) ^ 0x80000000u;
+                for (const int32_t offset : {-2, -1, 0, 1, 2})
+                    check(left, right, normalized(oppositeProduct + offset));
+            }
+            t.IsTrue(matches, "every accepted result must have exact normal/sign flags");
+            t.IsTrue(accepted > 100000u, "the randomized test must exercise the certified path");
+        });
+
+#if defined(__aarch64__)
+        tc.Run("SIMD product-sum values and flags match independent scalar arithmetic", [](TestCase &t)
+        {
+            struct RestoreRounding {
+                int mode = std::fegetround();
+                ~RestoreRounding() { std::fesetround(mode); }
+            } rounding;
+            std::fesetround(FE_TOWARDZERO);
+            uint64_t randomState = 0x8754617084462351ull;
+            const auto random = [&]() {
+                randomState ^= randomState << 13u;
+                randomState ^= randomState >> 7u;
+                randomState ^= randomState << 17u;
+                return static_cast<uint32_t>(randomState);
+            };
+            const auto normalized = [](uint32_t bits) {
+                const uint32_t exponent = bits & 0x7f800000u;
+                if (exponent == 0u)
+                    bits &= 0x80000000u;
+                else if (exponent == 0x7f800000u)
+                    bits = (bits & 0x80000000u) | 0x7f7fffffu;
+                return std::bit_cast<float>(bits);
+            };
+            const auto flags = [](long double exact) {
+                const auto magnitude = std::fabs(exact);
+                return (std::signbit(exact) ? 2u : 0u) |
+                    (magnitude == 0.0L ? 1u : magnitude < std::numeric_limits<float>::min() ? 5u :
+                     magnitude > std::numeric_limits<float>::max() ? 8u : 0u);
+            };
+            uint32_t accepted = 0u;
+            bool matches = true;
+            const auto check = [&]<bool subtract>(const float left[4], const float right[4],
+                                                  const float acc[4], uint8_t destination) {
+                float result[4] = {123.0f, 123.0f, 123.0f, 123.0f};
+                uint8_t laneFlags[4] = {0xff, 0xff, 0xff, 0xff};
+                uint32_t sticky = 0xfeedbeef;
+                if (!ps2_vu_detail::tryProductSumVector<subtract>(left, right, acc, destination, result, laneFlags, sticky))
+                {
+                    for (unsigned lane = 0u; lane < 4u; ++lane)
+                        matches &= result[lane] == 123.0f && laneFlags[lane] == 0xff && sticky == 0xfeedbeef;
+                    return;
+                }
+                ++accepted;
+                uint32_t expectedSticky = 0u;
+                for (unsigned lane = 0u; lane < 4u; ++lane)
+                {
+                    const float l = normalized(std::bit_cast<uint32_t>(left[lane]));
+                    const float r = normalized(std::bit_cast<uint32_t>(right[lane]));
+                    const float a = normalized(std::bit_cast<uint32_t>(acc[lane]));
+                    const float expected = std::fma(subtract ? -l : l, r, a);
+                    const long double product = static_cast<long double>(l) * r;
+                    const long double exact = subtract ? static_cast<long double>(a) - product : static_cast<long double>(a) + product;
+                    const bool active = (destination & (8u >> lane)) != 0u;
+                    matches &= std::bit_cast<uint32_t>(result[lane]) == std::bit_cast<uint32_t>(expected) &&
+                        laneFlags[lane] == (active ? flags(exact) : 0u);
+                    if (active)
+                        expectedSticky |= flags(product);
+                }
+                matches &= sticky == expectedSticky;
+            };
+            const auto checkBoth = [&](const float left[4], const float right[4], const float acc[4], uint8_t mask) {
+                check.template operator()<false>(left, right, acc, mask);
+                check.template operator()<true>(left, right, acc, mask);
+            };
+            struct GuardBoundary { float left, right, acc; bool accepted; };
+            const GuardBoundary boundaries[] = {
+                {0x1p63f, 0x1p62f, -(0x1p125f - 0x1p106f), true},
+                {0x1p63f, 0x1p62f, -(0x1p125f - 0x1p105f), false},
+                {0x1p63f, 0x1p63f, -0x1p125f, false},
+                {0.0f, std::numeric_limits<float>::max(), 7.0f, true},
+                {-0.0f, std::numeric_limits<float>::max(), -7.0f, true},
+            };
+            for (const auto &boundary : boundaries)
+            {
+                float left[4], right[4], acc[4];
+                std::fill_n(left, 4u, boundary.left);
+                std::fill_n(right, 4u, boundary.right);
+                std::fill_n(acc, 4u, boundary.acc);
+                uint32_t previous = accepted;
+                check.template operator()<false>(left, right, acc, 0xfu);
+                matches &= accepted == previous + boundary.accepted;
+                std::fill_n(acc, 4u, -boundary.acc);
+                previous = accepted;
+                check.template operator()<true>(left, right, acc, 0xfu);
+                matches &= accepted == previous + boundary.accepted;
+            }
+            for (unsigned signs = 0u; signs < 8u; ++signs)
+                for (uint8_t mask = 0u; mask < 16u; ++mask)
+                {
+                    float left[4], right[4], acc[4];
+                    for (unsigned lane = 0u; lane < 4u; ++lane)
+                    {
+                        left[lane] = std::bit_cast<float>((signs & 1u) << 31u);
+                        right[lane] = std::bit_cast<float>((signs & 2u) << 30u);
+                        acc[lane] = std::bit_cast<float>((signs & 4u) << 29u);
+                    }
+                    checkBoth(left, right, acc, mask);
+                }
+            for (uint32_t iteration = 0u; iteration < 100000u; ++iteration)
+            {
+                float left[4], right[4], acc[4];
+                for (unsigned lane = 0u; lane < 4u; ++lane)
+                {
+                    uint32_t l = random(), r = random(), a = random();
+                    if (iteration % 3u == 0u)
+                    {
+                        l = (l & 0x807fffffu) | ((115u + l % 24u) << 23u);
+                        r = (r & 0x807fffffu) | ((115u + r % 24u) << 23u);
+                        a = (a & 0x807fffffu) | ((115u + a % 24u) << 23u);
+                    }
+                    left[lane] = std::bit_cast<float>(l);
+                    right[lane] = std::bit_cast<float>(r);
+                    acc[lane] = std::bit_cast<float>(a);
+                    if (iteration % 3u == 2u)
+                    {
+                        const float product = normalized(l) * normalized(r);
+                        acc[lane] = normalized((std::bit_cast<uint32_t>(product) ^ 0x80000000u) + iteration % 5u - 2u);
+                    }
+                }
+                checkBoth(left, right, acc, static_cast<uint8_t>(random() & 15u));
+            }
+            t.IsTrue(matches, "accepted vectors must match exact flags and scalar fused values; fallback must leave outputs unchanged");
+            t.IsTrue(accepted > 100000u, "the test must exercise the vector path across destination masks");
+        });
+#endif
+
         tc.Run("reserved opcodes stop before executing or corrupting state", [](TestCase &t)
         {
             Vu1Fixture fx;
diff --git a/tools/compile_vu_blocks.py b/tools/compile_vu_blocks.py
index b31d2122f..abfa77204 100644
--- a/tools/compile_vu_blocks.py
+++ b/tools/compile_vu_blocks.py
@@ -38,21 +38,36 @@ def read_blocks(paths, parser):
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--output", type=Path, required=True)
+    parser.add_argument("--shards", type=int, default=0,
+                        help="Emit this many independent native instantiation sources")
     parser.add_argument("--pair-images", type=Path, nargs="*", default=[],
                         help="Compile individual pairs from these images or profiles")
     parser.add_argument("images", type=Path, nargs="*")
     args = parser.parse_args()
+    if args.shards < 0:
+        parser.error("--shards must be nonnegative")
     blocks = read_blocks(args.images, parser)
     pair_blocks = blocks | read_blocks(args.pair_images, parser)
     pairs = {((word,), unit) for block, unit in pair_blocks for word in block}
     if not pairs:
         parser.error("no nonempty microcode blocks")
     lines = ["// Generated from local microcode; do not distribute game data."]
-    for block, unit in sorted(blocks | pairs):
+    externs = [lines[0]]
+    shards = [[lines[0], '#include "ps2_vu1_exec.inl"'] for _ in range(args.shards)]
+    for index, (block, unit) in enumerate(sorted(blocks | pairs)):
         values = ", ".join(f"0x{word:016x}ull" for word in block)
         lines.append(f"{{Unit::VU{unit}, {{{values}}}, &runCompiledBlock<Unit::VU{unit}, {values}>, {len(block) * 8}u}},")
+        if args.shards:
+            instance = (f"bool VU1Interpreter::runCompiledBlock<VU1Interpreter::Unit::VU{unit}, {values}>"
+                        "(VU1Interpreter &, uint64_t);")
+            externs.append(f"extern template {instance}")
+            shards[index % args.shards].append(f"template {instance}")
     args.output.parent.mkdir(parents=True, exist_ok=True)
     args.output.write_text("\n".join(lines) + "\n")
+    if args.shards:
+        args.output.with_name(f"{args.output.stem}_extern.inc").write_text("\n".join(externs) + "\n")
+        for index, source in enumerate(shards):
+            args.output.with_name(f"{args.output.stem}_{index}.cpp").write_text("\n".join(source) + "\n")
     print(f"Compiled VU input: {len(blocks)} four-pair blocks, {len(pairs)} individual pairs")
 
 
diff --git a/tools/tests/test_compile_vu_blocks.py b/tools/tests/test_compile_vu_blocks.py
new file mode 100644
index 000000000..7e81ab5e1
--- /dev/null
+++ b/tools/tests/test_compile_vu_blocks.py
@@ -0,0 +1,56 @@
+"""Check that separate native compilation units preserve registry coverage."""
+
+import re
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+
+class CompileVuBlocksTests(unittest.TestCase):
+    def test_shards_preserve_registry_and_instantiate_every_entry_once(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            first, second = root / "first.profile", root / "second.profile"
+            first.write_text("VU-BLOCKS 1\n1 1 2 3 4\n0 1 1 1 1\n")
+            second.write_text("VU-BLOCKS 1\n1 1 2 3 4\n1 5 6 7 8\n")
+            script = Path(__file__).resolve().parents[1] / "compile_vu_blocks.py"
+
+            def generate(name, shards, inputs):
+                output = root / name / "blocks.inc"
+                subprocess.run([sys.executable, str(script), "--output", str(output),
+                                "--shards", str(shards), "--", *map(str, inputs)],
+                               check=True, capture_output=True, text=True)
+                return output
+
+            original = generate("original", 0, [first, second])
+            registry = original.read_text()
+            expected = {(unit, words) for unit, words in re.findall(
+                r"&runCompiledBlock<Unit::VU([01]), ([^>]+)>", registry)}
+            self.assertEqual(len(expected), 12)  # Three blocks and nine unit-specific pairs.
+            for count in (1, 3, 8):
+                output = generate(f"shards-{count}", count, [second, first, second])
+                self.assertEqual(output.read_text(), registry)
+                sources = sorted(output.parent.glob("blocks_*.cpp"))
+                self.assertEqual(len(sources), count)
+                instances = []
+                for source in sources:
+                    text = source.read_text()
+                    self.assertIn('#include "ps2_vu1_exec.inl"', text)
+                    instances += re.findall(
+                        r"template bool VU1Interpreter::runCompiledBlock<VU1Interpreter::Unit::VU([01]), ([^>]+)>", text)
+                self.assertEqual(len(instances), len(expected))
+                self.assertEqual(set(instances), expected)
+                externs = re.findall(
+                    r"extern template bool VU1Interpreter::runCompiledBlock<VU1Interpreter::Unit::VU([01]), ([^>]+)>",
+                    (output.parent / "blocks_extern.inc").read_text())
+                self.assertEqual(len(externs), len(expected))
+                self.assertEqual(set(externs), expected)
+                repeated = generate(f"repeat-{count}", count, [first, second])
+                for source in output.parent.iterdir():
+                    self.assertEqual(source.read_bytes(), (repeated.parent / source.name).read_bytes())
+
+
+if __name__ == "__main__":
+    unittest.main()

From 5c108381a85caca4c2b62364823f4ec7eca2ad46 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 12:18:08 +0200
Subject: [PATCH 48/68] Run raster work through an ordered bounded GS worker

---
 ps2xRuntime/CMakeLists.txt                    |   1 +
 .../include/runtime/gs/gs_threaded_backend.h  |  36 +++
 .../src/lib/gs/gs_threaded_backend.cpp        | 247 ++++++++++++++++++
 ps2xRuntime/src/lib/ps2_runtime.cpp           |  28 +-
 ps2xTest/src/ps2_runtime_kernel_tests.cpp     |  80 ++++++
 5 files changed, 390 insertions(+), 2 deletions(-)
 create mode 100644 ps2xRuntime/include/runtime/gs/gs_threaded_backend.h
 create mode 100644 ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index b658486d3..63636cfde 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -383,6 +383,7 @@ add_library(ps2_runtime STATIC
     src/lib/gs/ps2_gs_memory.cpp
     src/lib/gs/gs_frontend.cpp
     src/lib/gs/gs_cpu_backend.cpp
+    src/lib/gs/gs_threaded_backend.cpp
     src/lib/ps2_iop_host.cpp
     src/lib/ps2_memory.cpp
     src/lib/ps2_pad.cpp
diff --git a/ps2xRuntime/include/runtime/gs/gs_threaded_backend.h b/ps2xRuntime/include/runtime/gs/gs_threaded_backend.h
new file mode 100644
index 000000000..6ea2370b1
--- /dev/null
+++ b/ps2xRuntime/include/runtime/gs/gs_threaded_backend.h
@@ -0,0 +1,36 @@
+#pragma once
+
+#include "runtime/gs/gs_backend.h"
+
+#include <cstddef>
+#include <memory>
+
+// Owns submitted data until the worker consumes it. Observations and GS
+// completion barriers drain the ordered queue; presentation stays on its caller.
+class GSThreadedBackend final : public GSRasterBackend
+{
+public:
+    explicit GSThreadedBackend(std::unique_ptr<GSRasterBackend> backend,
+                               size_t queueBytes = 4u * 1024u * 1024u);
+    ~GSThreadedBackend() override;
+
+    void Initialize(uint8_t *vram, uint32_t size) override;
+    void Reset() override;
+    void Submit(const GSPrimitiveBatch &batch) override;
+    void BeginTransfer(const GSTransferCommand &command) override;
+    void UploadImage(const uint8_t *data, uint32_t size) override;
+    void Flush() override;
+    void TextureFlush() override;
+    void Sync(GSSyncReason reason) override;
+    PresentationFrame Present(const GSPresentationRequest &request) override;
+    bool ClearFramebuffer(const GSContext &context, uint32_t rgba) override;
+    uint32_t ConsumeLocalToHostBytes(uint8_t *dst, uint32_t size) override;
+    uint32_t ReadVram(uint32_t psm, uint32_t base, uint32_t bw, uint32_t x, uint32_t y) const override;
+    void WriteVram(uint32_t psm, uint32_t base, uint32_t bw, uint32_t x, uint32_t y, uint32_t value) override;
+    void SnapshotVram(std::vector<uint8_t> &out) const override;
+    GSTransferSnapshot GetTransferSnapshot() const override;
+
+private:
+    struct Impl;
+    std::unique_ptr<Impl> m_impl;
+};
diff --git a/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp b/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp
new file mode 100644
index 000000000..9707de2a4
--- /dev/null
+++ b/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp
@@ -0,0 +1,247 @@
+#include "runtime/gs/gs_threaded_backend.h"
+
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <cfenv>
+#include <condition_variable>
+#include <exception>
+#include <mutex>
+#include <stdexcept>
+#include <thread>
+#include <variant>
+#if defined(__APPLE__) || defined(__linux__)
+#include <pthread.h>
+#endif
+
+struct GSThreadedBackend::Impl
+{
+    enum class Op { Submit, Transfer, Upload, Flush, TextureFlush, Write };
+    using Pixel = std::array<uint32_t, 6>;
+    struct Command
+    {
+        Op op;
+        std::variant<std::monostate, GSPrimitiveBatch, GSTransferCommand,
+                     std::vector<uint8_t>, Pixel> data;
+        int rounding = std::fegetround();
+        size_t bytes() const
+        {
+            return sizeof(Command) + (op == Op::Upload ? std::get<std::vector<uint8_t>>(data).size() : 0u);
+        }
+    };
+
+    explicit Impl(std::unique_ptr<GSRasterBackend> target, size_t queueBytes)
+        : backend(std::move(target)), capacity(std::max(queueBytes, sizeof(Command)))
+    {
+        if (!backend)
+            throw std::invalid_argument("GS worker requires a backend");
+        worker = std::thread([this] { run(); });
+    }
+
+    ~Impl()
+    {
+        {
+            std::lock_guard lock(mutex);
+            stopping = true;
+        }
+        work.notify_one();
+        worker.join();
+    }
+
+    void enqueue(Command command, bool flush = false)
+    {
+        // A presenter may also submit. Holding this lock across a drain keeps
+        // newer commands behind the synchronous operation, not merely its fence.
+        std::lock_guard submitLock(submission);
+        const size_t size = command.bytes();
+        std::unique_lock lock(mutex);
+        if (outstandingBytes != 0u && size > capacity - std::min(capacity, outstandingBytes))
+        {
+            urgent = true;
+            work.notify_one();
+            progress.wait(lock, [&] {
+                return error || outstandingBytes == 0u ||
+                       size <= capacity - std::min(capacity, outstandingBytes);
+            });
+        }
+        rethrow();
+        pending.push_back(std::move(command));
+        outstandingBytes += size;
+        urgent = urgent || flush;
+        if (pending.size() == 1u || pending.size() == 64u || urgent)
+            work.notify_one();
+    }
+
+    template <class F>
+    auto observe(F &&fn)
+    {
+        std::lock_guard submitLock(submission);
+        {
+            std::unique_lock lock(mutex);
+            urgent = true;
+            work.notify_one();
+            progress.wait(lock, [&] { return outstandingBytes == 0u || error; });
+            rethrow();
+        }
+        return fn(*backend);
+    }
+
+    void rethrow() const
+    {
+        if (error)
+            std::rethrow_exception(error);
+    }
+
+    void execute(const Command &command)
+    {
+        // XGKICK submits while the VU has selected rounding toward zero.
+        if (rounding != command.rounding)
+        {
+            std::fesetround(command.rounding);
+            rounding = command.rounding;
+        }
+        switch (command.op)
+        {
+        case Op::Submit: backend->Submit(std::get<GSPrimitiveBatch>(command.data)); break;
+        case Op::Transfer: backend->BeginTransfer(std::get<GSTransferCommand>(command.data)); break;
+        case Op::Upload:
+        {
+            const auto &bytes = std::get<std::vector<uint8_t>>(command.data);
+            backend->UploadImage(bytes.data(), static_cast<uint32_t>(bytes.size()));
+            break;
+        }
+        case Op::Flush: backend->Flush(); break;
+        case Op::TextureFlush: backend->TextureFlush(); break;
+        case Op::Write:
+        {
+            const auto &p = std::get<Pixel>(command.data);
+            backend->WriteVram(p[0], p[1], p[2], p[3], p[4], p[5]);
+            break;
+        }
+        }
+    }
+
+    void run()
+    {
+        rounding = std::fegetround();
+#if defined(__APPLE__)
+        pthread_setname_np("GSWorker");
+#elif defined(__linux__)
+        pthread_setname_np(pthread_self(), "GSWorker");
+#endif
+        std::vector<Command> batch;
+        for (;;)
+        {
+            size_t bytes = 0u;
+            {
+                std::unique_lock lock(mutex);
+                work.wait(lock, [&] { return stopping || !pending.empty(); });
+                if (pending.empty() && stopping)
+                    return;
+                // Batch small primitives without stranding a short final packet.
+                work.wait_for(lock, std::chrono::milliseconds(1), [&] {
+                    return stopping || urgent || pending.size() >= 64u;
+                });
+                batch.swap(pending);
+                urgent = false;
+            }
+            try
+            {
+                for (const auto &command : batch)
+                {
+                    execute(command);
+                    bytes += command.bytes();
+                }
+            }
+            catch (...)
+            {
+                std::lock_guard lock(mutex);
+                error = std::current_exception();
+                pending.clear();
+                outstandingBytes = 0u;
+                progress.notify_all();
+                return;
+            }
+            batch.clear();
+            {
+                std::lock_guard lock(mutex);
+                outstandingBytes -= bytes;
+            }
+            progress.notify_all();
+        }
+    }
+
+    std::unique_ptr<GSRasterBackend> backend;
+    const size_t capacity;
+    std::mutex submission, mutex;
+    std::condition_variable work, progress;
+    std::vector<Command> pending;
+    size_t outstandingBytes = 0u;
+    bool urgent = false, stopping = false;
+    std::exception_ptr error;
+    int rounding = FE_TONEAREST;
+    std::thread worker;
+};
+
+GSThreadedBackend::GSThreadedBackend(std::unique_ptr<GSRasterBackend> backend, size_t queueBytes)
+    : m_impl(std::make_unique<Impl>(std::move(backend), queueBytes)) {}
+GSThreadedBackend::~GSThreadedBackend() = default;
+
+void GSThreadedBackend::Initialize(uint8_t *vram, uint32_t size)
+{
+    m_impl->observe([&](auto &b) { b.Initialize(vram, size); });
+}
+void GSThreadedBackend::Reset() { m_impl->observe([](auto &b) { b.Reset(); }); }
+void GSThreadedBackend::Submit(const GSPrimitiveBatch &batch)
+{
+    m_impl->enqueue({Impl::Op::Submit, batch});
+}
+void GSThreadedBackend::BeginTransfer(const GSTransferCommand &command)
+{
+    m_impl->enqueue({Impl::Op::Transfer, command});
+}
+void GSThreadedBackend::UploadImage(const uint8_t *data, uint32_t size)
+{
+    std::vector<uint8_t> bytes;
+    if (size != 0u)
+    {
+        if (!data)
+            throw std::invalid_argument("GS upload data is null");
+        bytes.assign(data, data + size);
+    }
+    m_impl->enqueue({Impl::Op::Upload, std::move(bytes)});
+}
+void GSThreadedBackend::Flush() { m_impl->enqueue({Impl::Op::Flush, {}}, true); }
+void GSThreadedBackend::TextureFlush() { m_impl->enqueue({Impl::Op::TextureFlush, {}}); }
+void GSThreadedBackend::Sync(GSSyncReason reason)
+{
+    m_impl->observe([&](auto &b) { b.Sync(reason); });
+}
+PresentationFrame GSThreadedBackend::Present(const GSPresentationRequest &request)
+{
+    return m_impl->observe([&](auto &b) { return b.Present(request); });
+}
+bool GSThreadedBackend::ClearFramebuffer(const GSContext &context, uint32_t rgba)
+{
+    return m_impl->observe([&](auto &b) { return b.ClearFramebuffer(context, rgba); });
+}
+uint32_t GSThreadedBackend::ConsumeLocalToHostBytes(uint8_t *dst, uint32_t size)
+{
+    return m_impl->observe([&](auto &b) { return b.ConsumeLocalToHostBytes(dst, size); });
+}
+uint32_t GSThreadedBackend::ReadVram(uint32_t psm, uint32_t base, uint32_t bw, uint32_t x, uint32_t y) const
+{
+    return m_impl->observe([&](auto &b) { return b.ReadVram(psm, base, bw, x, y); });
+}
+void GSThreadedBackend::WriteVram(uint32_t psm, uint32_t base, uint32_t bw, uint32_t x, uint32_t y, uint32_t value)
+{
+    m_impl->enqueue({Impl::Op::Write, Impl::Pixel{psm, base, bw, x, y, value}});
+}
+void GSThreadedBackend::SnapshotVram(std::vector<uint8_t> &out) const
+{
+    m_impl->observe([&](auto &b) { b.SnapshotVram(out); });
+}
+GSTransferSnapshot GSThreadedBackend::GetTransferSnapshot() const
+{
+    return m_impl->observe([](auto &b) { return b.GetTransferSnapshot(); });
+}
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index 0b5deaffe..738b1ad32 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -90,6 +90,28 @@ struct ProgramHeader
 
 namespace
 {
+    template <class Present>
+    bool presentHostFrame(PS2Runtime &runtime, Present &&present)
+    {
+        try
+        {
+            present();
+            return true;
+        }
+        catch (const std::exception &error)
+        {
+            std::fprintf(stderr, "Error during host presentation: %s\n", error.what());
+        }
+        catch (...)
+        {
+            std::fprintf(stderr, "Error during host presentation: unknown exception\n");
+        }
+        // Return to run()'s normal cleanup so its joinable guest thread cannot
+        // be destroyed by exception unwinding, including delayed GS failures.
+        runtime.requestStop();
+        return false;
+    }
+
     constexpr uint32_t kGuestHeapDefaultBase = 0x00100000u;
     constexpr uint32_t kGuestHeapDefaultAlignment = 16u;
     constexpr uint32_t kGuestHeapSafetyPad = 0x1000u;
@@ -2554,7 +2576,8 @@ void PS2Runtime::run()
             const bool newFrame = currentTick != s_lastNativeTick;
             if (newFrame)
             {
-                gs().latchHostPresentationFrame();
+                if (!presentHostFrame(*this, [&] { gs().latchHostPresentationFrame(); }))
+                    break;
                 s_lastNativeTick = currentTick;
             }
             else
@@ -2586,7 +2609,8 @@ void PS2Runtime::run()
 
         uint32_t presentWidth = FB_WIDTH;
         uint32_t presentHeight = DEFAULT_DISPLAY_HEIGHT;
-        UploadFrame(frameTex, this, presentWidth, presentHeight);
+        if (!presentHostFrame(*this, [&] { UploadFrame(frameTex, this, presentWidth, presentHeight); }))
+            break;
 
         BeginDrawing();
         ClearBackground(BLACK);
diff --git a/ps2xTest/src/ps2_runtime_kernel_tests.cpp b/ps2xTest/src/ps2_runtime_kernel_tests.cpp
index 23a042884..857ec77b3 100644
--- a/ps2xTest/src/ps2_runtime_kernel_tests.cpp
+++ b/ps2xTest/src/ps2_runtime_kernel_tests.cpp
@@ -4,13 +4,16 @@
 #include "ps2_syscalls.h"
 #include "ps2_stubs.h"
 #include "runtime/ee_scheduler.h"
+#include "runtime/gs/gs_frontend.h"
 
 #include <array>
 #include <atomic>
+#include <chrono>
 #include <cstdint>
 #include <cstring>
 #include <optional>
 #include <sstream>
+#include <stdexcept>
 #include <thread>
 #include <vector>
 
@@ -18,6 +21,61 @@ using namespace ps2_syscalls;
 
 namespace
 {
+    std::atomic<bool> s_presentationGuestEntered{false}, s_presentationGuestExited{false};
+
+    void presentationFailureGuest(uint8_t *, R5900Context *ctx, PS2Runtime *runtime)
+    {
+        s_presentationGuestEntered.store(true, std::memory_order_release);
+        while (!runtime->isStopRequested())
+            std::this_thread::yield();
+        s_presentationGuestExited.store(true, std::memory_order_release);
+        ctx->pc = 0u;
+    }
+
+    class PresentationFailureBackend final : public GSRasterBackend
+    {
+    public:
+        explicit PresentationFailureBackend(bool failAtSync) : m_failAtSync(failAtSync) {}
+        void Initialize(uint8_t *, uint32_t) override {}
+        void Reset() override {}
+        void Submit(const GSPrimitiveBatch &) override {}
+        void BeginTransfer(const GSTransferCommand &) override {}
+        void UploadImage(const uint8_t *, uint32_t) override {}
+        void Flush() override {}
+        void TextureFlush() override {}
+        void Sync(GSSyncReason reason) override
+        {
+            if (m_failAtSync && reason == GSSyncReason::Presentation)
+            {
+                waitForGuest();
+                throw std::runtime_error("injected delayed GS failure");
+            }
+        }
+        PresentationFrame Present(const GSPresentationRequest &) override
+        {
+            waitForGuest();
+            throw 42; // Exercise the non-std::exception cleanup path too.
+        }
+        bool ClearFramebuffer(const GSContext &, uint32_t) override { return false; }
+        uint32_t ConsumeLocalToHostBytes(uint8_t *, uint32_t) override { return 0u; }
+        uint32_t ReadVram(uint32_t, uint32_t, uint32_t, uint32_t, uint32_t) const override { return 0u; }
+        void WriteVram(uint32_t, uint32_t, uint32_t, uint32_t, uint32_t, uint32_t) override {}
+        void SnapshotVram(std::vector<uint8_t> &out) const override { out.clear(); }
+        GSTransferSnapshot GetTransferSnapshot() const override { return {}; }
+    private:
+        static void waitForGuest()
+        {
+            const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+            while (!s_presentationGuestEntered.load(std::memory_order_acquire))
+            {
+                if (std::chrono::steady_clock::now() >= deadline)
+                    throw std::runtime_error("presentation test guest did not start");
+                std::this_thread::yield();
+            }
+        }
+        bool m_failAtSync;
+    };
+
     constexpr uint32_t K_PARAM_ADDR = 0x1000u;
     constexpr uint32_t K_STATUS_ADDR = 0x1400u;
 
@@ -550,6 +608,28 @@ void register_ps2_runtime_kernel_tests()
 {
     MiniTest::Case("PS2RuntimeKernel", [](TestCase &tc)
     {
+        tc.Run("Host presentation failures stop and join the actual guest thread", [](TestCase &t)
+        {
+            for (const bool failAtSync : {true, false})
+            {
+                auto runtime = std::make_unique<PS2Runtime>();
+                t.IsTrue(runtime->memory().initialize(), "test memory initializes without a window");
+                runtime->gs().init(runtime->memory().getGSVRAM(), PS2_GS_VRAM_SIZE, &runtime->memory().gs());
+                runtime->gs().setRasterBackend(std::make_unique<PresentationFailureBackend>(failAtSync));
+                runtime->setExternalPresenter([](void *) { return true; }, nullptr);
+                constexpr uint32_t entry = 0x27000u;
+                runtime->registerFunction(entry, presentationFailureGuest);
+                runtime->cpu().pc = entry;
+                s_presentationGuestEntered.store(false, std::memory_order_relaxed);
+                s_presentationGuestExited.store(false, std::memory_order_relaxed);
+                runtime->run();
+                t.IsTrue(runtime->isStopRequested(), "presentation failure requests stop");
+                t.IsTrue(s_presentationGuestEntered.load(std::memory_order_acquire), "guest was running when presentation failed");
+                t.IsTrue(s_presentationGuestExited.load(std::memory_order_acquire), "run returned only after the guest exited");
+                runtime->replaceFunction(entry, nullptr);
+            }
+        });
+
         tc.Run("syscall lookup observes replacement, removal and runtime reuse", [](TestCase &t)
         {
             std::optional<PS2Runtime> runtime(std::in_place);

From 3506d0286fd55a9bc5ceaa2600acb1116682558e Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 13:53:29 +0200
Subject: [PATCH 49/68] Bound VBlank host debt while preserving guest event
 timing

---
 ps2xRuntime/include/runtime/ee_scheduler.h |   1 +
 ps2xRuntime/src/lib/Kernel/EeHostPacing.h  |  48 +++++
 ps2xRuntime/src/lib/Kernel/EeScheduler.cpp |  59 +++++-
 ps2xTest/src/ps2_ee_pacing_tests.cpp       | 235 +++++++++++++++++++++
 4 files changed, 334 insertions(+), 9 deletions(-)
 create mode 100644 ps2xRuntime/src/lib/Kernel/EeHostPacing.h
 create mode 100644 ps2xTest/src/ps2_ee_pacing_tests.cpp

diff --git a/ps2xRuntime/include/runtime/ee_scheduler.h b/ps2xRuntime/include/runtime/ee_scheduler.h
index 2b08a528d..9bb137a49 100644
--- a/ps2xRuntime/include/runtime/ee_scheduler.h
+++ b/ps2xRuntime/include/runtime/ee_scheduler.h
@@ -371,6 +371,7 @@ class EeScheduler
     void publishSnapshotNow();
 
 private:
+    friend struct EeSchedulerPacingTestAccess;
     struct ScheduledEvent
     {
         uint64_t deadlineCycle = 0;
diff --git a/ps2xRuntime/src/lib/Kernel/EeHostPacing.h b/ps2xRuntime/src/lib/Kernel/EeHostPacing.h
new file mode 100644
index 000000000..7b988fff4
--- /dev/null
+++ b/ps2xRuntime/src/lib/Kernel/EeHostPacing.h
@@ -0,0 +1,48 @@
+#pragma once
+
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+
+namespace ee_host_pacing {
+using Clock = std::chrono::steady_clock;
+
+struct VBlankBoundary {
+    Clock::time_point host;
+    Clock::duration lateness;
+    bool rebased;
+};
+
+inline VBlankBoundary vblankBoundary(Clock::time_point scheduled, Clock::time_point now,
+                                     Clock::duration fieldPeriod) {
+    const auto lateness = now > scheduled ? now - scheduled : Clock::duration::zero();
+    const bool rebased = lateness > fieldPeriod;
+    // Keep one field of catch-up credit: a slow two-field game frame should
+    // not incur a fresh host wait between both already-earned guest VBlanks.
+    return {rebased ? now - fieldPeriod : scheduled, lateness, rebased};
+}
+
+// Internal deterministic-clock seam. Production keeps this null; tests install
+// hooks only on their executor thread, without changing scheduler object layout.
+struct ClockHooks {
+    void *context;
+    Clock::time_point (*now)(void *);
+    void (*waitUntil)(void *, Clock::time_point);
+};
+inline thread_local const ClockHooks *clockHooks = nullptr;
+
+inline Clock::time_point now() {
+    return clockHooks ? clockHooks->now(clockHooks->context) : Clock::now();
+}
+
+template <typename Predicate>
+bool waitUntil(std::condition_variable &cv, std::unique_lock<std::mutex> &lock,
+               Clock::time_point deadline, Predicate predicate) {
+    if (!clockHooks)
+        return cv.wait_until(lock, deadline, predicate);
+    if (predicate())
+        return true;
+    clockHooks->waitUntil(clockHooks->context, deadline);
+    return predicate();
+}
+}
diff --git a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
index 19e609472..5b51bf67d 100644
--- a/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
+++ b/ps2xRuntime/src/lib/Kernel/EeScheduler.cpp
@@ -1,4 +1,5 @@
 #include "runtime/ee_scheduler.h"
+#include "EeHostPacing.h"
 
 #include "ps2_log.h"
 #include "ps2_runtime_macros.h"
@@ -92,6 +93,40 @@ namespace
     constexpr uint64_t kVBlankDurationCycles = microsecondsToEeCycles(500u);
     constexpr uint64_t kAlarmTickCycles = microsecondsToEeCycles(kAlarmTickMicroseconds);
 
+    struct VBlankPacingTrace
+    {
+        std::chrono::steady_clock::time_point window{};
+        uint64_t starts = 0, rebases = 0, maxLatenessUs = 0, lines = 0;
+    };
+    thread_local VBlankPacingTrace g_vblankPacingTrace;
+    const bool g_traceVBlankPacing = std::getenv("DQ8_VBLANK_PACING_TRACE") != nullptr;
+
+    void traceVBlankPacing(uint64_t tick, uint64_t cycle,
+                          std::chrono::steady_clock::time_point now,
+                          const ee_host_pacing::VBlankBoundary &boundary)
+    {
+        if (!g_traceVBlankPacing || g_vblankPacingTrace.lines >= 600u)
+            return;
+        auto &trace = g_vblankPacingTrace;
+        ++trace.starts;
+        trace.rebases += boundary.rebased;
+        const auto latenessUs = std::chrono::duration_cast<std::chrono::microseconds>(boundary.lateness).count();
+        trace.maxLatenessUs = std::max(trace.maxLatenessUs, static_cast<uint64_t>(latenessUs));
+        if (trace.lines != 0u && now - trace.window < std::chrono::seconds(2))
+            return;
+        const auto hostUs = std::chrono::duration_cast<std::chrono::microseconds>(now.time_since_epoch()).count();
+        const auto nextHostUs = std::chrono::duration_cast<std::chrono::microseconds>(
+            (boundary.host + kVBlankPeriod).time_since_epoch()).count();
+        std::fprintf(stderr, "[VBlank pacing] tick=%llu cycle=%llu host_us=%lld starts=%llu rebases=%llu max_late_us=%llu next_host_us=%lld\n",
+                     static_cast<unsigned long long>(tick), static_cast<unsigned long long>(cycle),
+                     static_cast<long long>(hostUs), static_cast<unsigned long long>(trace.starts),
+                     static_cast<unsigned long long>(trace.rebases), static_cast<unsigned long long>(trace.maxLatenessUs),
+                     static_cast<long long>(nextHostUs));
+        trace.window = now;
+        trace.starts = trace.rebases = trace.maxLatenessUs = 0;
+        ++trace.lines;
+    }
+
     template <typename Map>
     int allocatePositiveId(int &nextId, const Map &objects)
     {
@@ -176,6 +211,7 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     m_eventSequence = 0;
     m_invocationSequence = 0;
     m_vsyncTick = 0;
+    g_vblankPacingTrace = {};
     m_vsyncFlagAddress = 0;
     m_vsyncTickAddress = 0;
     m_gsVSyncCallback = 0;
@@ -199,7 +235,7 @@ void EeScheduler::reset(uint8_t *rdram, const R5900Context &mainContext)
     m_readyQueues[0].push_back(kMainThreadId);
     refreshReadyMask(0);
     scheduleEvent(m_eeCycle + kVBlankPeriodCycles,
-                  std::chrono::steady_clock::now() + kVBlankPeriod,
+                  ee_host_pacing::now() + kVBlankPeriod,
                   EeEvent{EeEventType::VBlankStart, 0, 0});
     publishSnapshotNow();
 }
@@ -1214,7 +1250,7 @@ int EeScheduler::setAlarm(uint16_t ticks,
     m_alarms.emplace(id, EeAlarm{id, ticks, handler, argument, gp, sp});
     const uint64_t tickCount = ticks == 0u ? 1u : static_cast<uint64_t>(ticks);
     scheduleEvent(m_eeCycle + tickCount * kAlarmTickCycles,
-                  std::chrono::steady_clock::now() + std::chrono::microseconds(tickCount * kAlarmTickMicroseconds),
+                  ee_host_pacing::now() + std::chrono::microseconds(tickCount * kAlarmTickMicroseconds),
                   EeEvent{EeEventType::Alarm, static_cast<uint32_t>(id), 0});
     return id;
 }
@@ -2156,7 +2192,7 @@ void EeScheduler::processDueDeadlines()
         std::chrono::steady_clock::time_point pacingDeadline{};
         {
             std::unique_lock lock(m_eventMutex);
-            const auto now = std::chrono::steady_clock::now();
+            const auto now = ee_host_pacing::now();
             for (const ScheduledEvent &item : m_deadlines)
             {
                 if (item.deadlineCycle <= m_eeCycle &&
@@ -2175,7 +2211,7 @@ void EeScheduler::processDueDeadlines()
 
             if (now < pacingDeadline)
             {
-                m_eventCv.wait_until(lock, pacingDeadline, [this]()
+                ee_host_pacing::waitUntil(m_eventCv, lock, pacingDeadline, [this]()
                                      { return !m_events.empty() ||
                                               m_stopRequested.load(std::memory_order_acquire); });
                 if (!m_events.empty() || m_stopRequested.load(std::memory_order_acquire))
@@ -2185,7 +2221,7 @@ void EeScheduler::processDueDeadlines()
                 }
             }
 
-            const auto pacedNow = std::chrono::steady_clock::now();
+            const auto pacedNow = ee_host_pacing::now();
             auto firstFuture = std::partition(m_deadlines.begin(), m_deadlines.end(),
                                               [this, pacedNow](const ScheduledEvent &item)
                                               { return item.deadlineCycle <= m_eeCycle &&
@@ -2222,11 +2258,16 @@ void EeScheduler::processDueDeadlines()
         {
             if (scheduled.event.type == EeEventType::VBlankStart)
             {
+                // Preserve the guest event stream while bounding old host debt.
+                // Both children belong to this same host VBlank boundary.
+                const auto now = ee_host_pacing::now();
+                const auto boundary = ee_host_pacing::vblankBoundary(scheduled.hostDeadline, now, kVBlankPeriod);
+                traceVBlankPacing(m_vsyncTick + 1u, scheduled.deadlineCycle, now, boundary);
                 scheduleEvent(scheduled.deadlineCycle + kVBlankDurationCycles,
-                              scheduled.hostDeadline + kVBlankDuration,
+                              boundary.host + kVBlankDuration,
                               EeEvent{EeEventType::VBlankEnd, 0, m_vsyncTick + 1u});
                 scheduleEvent(scheduled.deadlineCycle + kVBlankPeriodCycles,
-                              scheduled.hostDeadline + kVBlankPeriod,
+                              boundary.host + kVBlankPeriod,
                               EeEvent{EeEventType::VBlankStart, 0, 0});
             }
             processEvent(scheduled.event);
@@ -2405,7 +2446,7 @@ void EeScheduler::waitForEvent()
     }
     if (hasTimerDeadline)
     {
-        const auto timerHostDeadline = std::chrono::steady_clock::now() + eeCyclesToHostDuration(timerCycles);
+        const auto timerHostDeadline = ee_host_pacing::now() + eeCyclesToHostDuration(timerCycles);
         if (timerHostDeadline < hostDeadline)
         {
             deadlineCycle = m_eeCycle + timerCycles;
@@ -2413,7 +2454,7 @@ void EeScheduler::waitForEvent()
         }
     }
 
-    const bool signaled = m_eventCv.wait_until(lock, hostDeadline, [this]()
+    const bool signaled = ee_host_pacing::waitUntil(m_eventCv, lock, hostDeadline, [this]()
                                                { return !m_events.empty() ||
                                                         m_stopRequested.load(std::memory_order_acquire); });
     if (!signaled)
diff --git a/ps2xTest/src/ps2_ee_pacing_tests.cpp b/ps2xTest/src/ps2_ee_pacing_tests.cpp
new file mode 100644
index 000000000..9f1c1b110
--- /dev/null
+++ b/ps2xTest/src/ps2_ee_pacing_tests.cpp
@@ -0,0 +1,235 @@
+#include "MiniTest.h"
+#include "runtime/ee_scheduler.h"
+#include "EeHostPacing.h"
+
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <cstring>
+#include <memory>
+#include <tuple>
+#include <vector>
+
+using Clock = ee_host_pacing::Clock;
+using namespace std::chrono_literals;
+
+struct EeSchedulerPacingTestAccess {
+    struct Deadline {
+        uint64_t cycle, sequence;
+        Clock::time_point host;
+        EeEventType type;
+        uint32_t id;
+    };
+    static void cycle(EeScheduler &scheduler, uint64_t value) { scheduler.m_eeCycle = value; }
+    static uint64_t cycle(const EeScheduler &scheduler) { return scheduler.m_eeCycle; }
+    static void pump(EeScheduler &scheduler) { scheduler.processDueDeadlines(); }
+    static void wait(EeScheduler &scheduler) { scheduler.waitForEvent(); }
+    static void clear(EeScheduler &scheduler) {
+        scheduler.m_deadlines.clear();
+        scheduler.m_eventSequence = 0;
+        scheduler.m_pendingInvocations.clear();
+        scheduler.m_invocationSequence = 0;
+        scheduler.updateNextDeadline();
+    }
+    static void add(EeScheduler &scheduler, uint64_t cycle, Clock::time_point host, EeEventType type, uint32_t id = 0) {
+        scheduler.scheduleEvent(cycle, host, {type, id, 0});
+    }
+    static std::vector<Deadline> deadlines(const EeScheduler &scheduler) {
+        std::vector<Deadline> result;
+        for (const auto &item : scheduler.m_deadlines)
+            result.push_back({item.deadlineCycle, item.sequence, item.hostDeadline, item.event.type, item.event.id});
+        std::sort(result.begin(), result.end(), [](const auto &a, const auto &b) { return a.cycle < b.cycle; });
+        return result;
+    }
+    static void alarm(EeScheduler &scheduler, int id, uint32_t handler) {
+        EeAlarm alarm{};
+        alarm.id = id;
+        alarm.handler = handler;
+        scheduler.m_alarms.emplace(id, alarm);
+    }
+    static std::vector<uint32_t> invoked(const EeScheduler &scheduler) {
+        std::vector<uint32_t> result;
+        for (const auto &item : scheduler.m_pendingInvocations) result.push_back(item.context.pc);
+        return result;
+    }
+};
+
+namespace {
+constexpr auto period = 16667us;
+constexpr auto duration = 500us;
+constexpr uint64_t cycles(uint64_t microseconds) {
+    return (microseconds * EeScheduler::kEeClockHz + 999999u) / 1000000u;
+}
+constexpr uint64_t periodCycles = cycles(16667), durationCycles = cycles(500);
+constexpr uint32_t startHandler = 0x1000, endHandler = 0x1100, alarmHandler = 0x1200;
+void handler(uint8_t *, R5900Context *, PS2Runtime *) {}
+
+struct FakeClock {
+    Clock::time_point time{100s};
+    std::vector<Clock::time_point> waits;
+    ee_host_pacing::ClockHooks hooks{this,
+        [](void *context) { return static_cast<FakeClock *>(context)->time; },
+        [](void *context, Clock::time_point deadline) {
+            auto &self = *static_cast<FakeClock *>(context);
+            self.waits.push_back(deadline);
+            self.time = std::max(self.time, deadline);
+        }};
+    FakeClock() { ee_host_pacing::clockHooks = &hooks; }
+    ~FakeClock() { ee_host_pacing::clockHooks = nullptr; }
+};
+
+struct Fixture {
+    FakeClock clock;
+    std::unique_ptr<PS2Runtime> runtime = std::make_unique<PS2Runtime>();
+    EeScheduler &scheduler = runtime->eeScheduler();
+    R5900Context context{};
+    bool initialize() {
+        if (!runtime->memory().initialize()) return false;
+        runtime->registerFunction(startHandler, handler);
+        runtime->registerFunction(endHandler, handler);
+        runtime->registerFunction(alarmHandler, handler);
+        scheduler.reset(runtime->memory().getRDRAM(), context);
+        scheduler.addIrqHandler(false, 2, startHandler, true, 0, 0, 0);
+        scheduler.addIrqHandler(false, 3, endHandler, true, 0, 0, 0);
+        return true;
+    }
+};
+}
+
+int main() {
+    MiniTest::Case("EeHostPacing", [](TestCase &tc) {
+        tc.Run("on-time fields retain every deadline and event", [](TestCase &t) {
+            Fixture fixture;
+            t.IsTrue(fixture.initialize(), "fixture initializes");
+            const auto epoch = fixture.clock.time;
+            for (uint64_t field = 1; field <= 120; ++field) {
+                EeSchedulerPacingTestAccess::cycle(fixture.scheduler, field * periodCycles);
+                EeSchedulerPacingTestAccess::pump(fixture.scheduler);
+                const auto deadlines = EeSchedulerPacingTestAccess::deadlines(fixture.scheduler);
+                t.Equals(fixture.scheduler.currentVSyncTick(), field, "exactly one tick per start");
+                t.IsTrue(fixture.clock.time == epoch + field * period, "steady host cadence retains reset epoch");
+                t.Equals(EeSchedulerPacingTestAccess::cycle(fixture.scheduler), field * periodCycles, "pacing does not alter guest cycles");
+                t.Equals(deadlines.size(), size_t{2}, "only one end and one start remain");
+                t.Equals(deadlines[0].cycle, field * periodCycles + durationCycles, "end guest deadline unchanged");
+                t.Equals(deadlines[1].cycle, (field + 1) * periodCycles, "next-start guest deadline unchanged");
+                t.Equals(deadlines[0].sequence, field * 2u, "end sequence unchanged");
+                t.Equals(deadlines[1].sequence, field * 2u + 1u, "start sequence unchanged");
+                t.IsTrue(deadlines[0].host == epoch + field * period + duration, "end uses same start boundary");
+                t.IsTrue(deadlines[1].host == epoch + (field + 1) * period, "next start uses same start boundary");
+            }
+            auto invoked = EeSchedulerPacingTestAccess::invoked(fixture.scheduler);
+            t.Equals(invoked.size(), size_t{239}, "no start or completed end was lost");
+            for (size_t i = 0; i < invoked.size(); ++i)
+                t.Equals(invoked[i], i % 2 == 0 ? startHandler : endHandler, "start/end order retained");
+        });
+        tc.Run("jitter tolerates exactly one field and rebases beyond it", [](TestCase &t) {
+            for (const auto late : {0us, 500us, period, period + 1us, 10s + 0us}) {
+                Fixture fixture;
+                t.IsTrue(fixture.initialize(), "fixture initializes");
+                const auto scheduled = fixture.clock.time + period;
+                fixture.clock.time = scheduled + late;
+                EeSchedulerPacingTestAccess::cycle(fixture.scheduler, periodCycles);
+                EeSchedulerPacingTestAccess::pump(fixture.scheduler);
+                const auto deadlines = EeSchedulerPacingTestAccess::deadlines(fixture.scheduler);
+                const auto boundary = late > period ? fixture.clock.time - period : scheduled;
+                t.IsTrue(deadlines[0].host == boundary + duration, "matching end follows selected host boundary");
+                t.IsTrue(deadlines[1].host == boundary + period, "next start follows selected host boundary");
+                t.Equals(deadlines[0].cycle, periodCycles + durationCycles, "jitter never shifts end guest cycle");
+                t.Equals(deadlines[1].cycle, periodCycles * 2, "jitter never shifts start guest cycle");
+            }
+        });
+        tc.Run("long stall cannot cause sustained accelerated recovery", [](TestCase &t) {
+            Fixture fixture;
+            t.IsTrue(fixture.initialize(), "fixture initializes");
+            fixture.clock.time += 10s;
+            const auto recovery = fixture.clock.time;
+            for (uint64_t field = 1; field <= 180; ++field) {
+                EeSchedulerPacingTestAccess::cycle(fixture.scheduler, field * periodCycles);
+                EeSchedulerPacingTestAccess::pump(fixture.scheduler);
+                t.Equals(fixture.scheduler.currentVSyncTick(), field, "all overdue guest starts still occur");
+                const auto elapsedFields = field > 1u ? field - 2u : 0u;
+                t.IsTrue(fixture.clock.time == recovery + elapsedFields * period,
+                         "at most one catch-up field precedes unchanged field spacing");
+            }
+            const double elapsed = std::chrono::duration<double>(fixture.clock.time - recovery).count();
+            t.IsTrue(178.0 / elapsed <= 60.0, "after one catch-up field recovery stays at the guest rate");
+        });
+        tc.Run("already-due end start and alarms retain batch ordering", [](TestCase &t) {
+            for (unsigned variant = 0; variant < 4; ++variant) {
+                Fixture fixture;
+                t.IsTrue(fixture.initialize(), "fixture initializes");
+                const auto epoch = fixture.clock.time;
+                EeSchedulerPacingTestAccess::clear(fixture.scheduler);
+                // A previous end, the current start and alarms are all due when
+                // the guest returns after a stall. Keep their original batch order.
+                struct Input { uint64_t cycle; EeEventType type; uint32_t id; };
+                std::array<Input, 5> input{{
+                    {periodCycles - durationCycles, EeEventType::VBlankEnd, 0},
+                    {periodCycles - 1, EeEventType::Alarm, 1},
+                    {periodCycles, EeEventType::VBlankStart, 0},
+                    {periodCycles, EeEventType::Alarm, 2},
+                    {periodCycles + (variant & 1 ? durationCycles + 1 : 1), EeEventType::Alarm, 3}}};
+                if (variant & 2) std::reverse(input.begin(), input.end());
+                for (const auto &item : input) {
+                    if (item.type == EeEventType::Alarm)
+                        EeSchedulerPacingTestAccess::alarm(fixture.scheduler, item.id, alarmHandler + item.id * 0x10);
+                    EeSchedulerPacingTestAccess::add(fixture.scheduler, item.cycle, epoch + period, item.type, item.id);
+                }
+                fixture.clock.time += 10s;
+                const auto recovery = fixture.clock.time;
+                const auto guestCycle = periodCycles + (variant & 1 ? durationCycles + 1 : 1);
+                EeSchedulerPacingTestAccess::cycle(fixture.scheduler, guestCycle);
+                EeSchedulerPacingTestAccess::pump(fixture.scheduler);
+                auto expected = std::vector<uint32_t>{endHandler, alarmHandler + 0x10, startHandler,
+                                                       alarmHandler + 0x20, alarmHandler + 0x30};
+                if (variant & 1) expected.push_back(endHandler);
+                t.IsTrue(EeSchedulerPacingTestAccess::invoked(fixture.scheduler) == expected, "mixed due batch and subsequently scheduled end preserve order");
+                t.Equals(EeSchedulerPacingTestAccess::cycle(fixture.scheduler), guestCycle, "all event processing preserves guest cycle");
+                t.Equals(fixture.scheduler.currentVSyncTick(), uint64_t{1}, "mixed events produce one start tick");
+                const auto remaining = EeSchedulerPacingTestAccess::deadlines(fixture.scheduler);
+                t.IsTrue(remaining.back().host == recovery, "only one catch-up start remains after mixed overdue events");
+                t.Equals(remaining.back().cycle, periodCycles * 2, "next-start guest deadline stays original");
+                t.Equals(remaining.back().sequence, uint64_t{7}, "existing event sequence ids are not rewritten");
+            }
+        });
+        tc.Run("new alarms keep call-relative host time across pacing rebase", [](TestCase &t) {
+            Fixture fixture;
+            t.IsTrue(fixture.initialize(), "fixture initializes");
+            fixture.clock.time += 10s;
+            EeSchedulerPacingTestAccess::cycle(fixture.scheduler, periodCycles);
+            EeSchedulerPacingTestAccess::pump(fixture.scheduler);
+            const auto callTime = fixture.clock.time;
+            const int alarm = fixture.scheduler.setAlarm(1, alarmHandler, 0, 0, 0);
+            t.IsTrue(alarm > 0, "alarm is installed");
+            const auto beforeWait = EeSchedulerPacingTestAccess::deadlines(fixture.scheduler);
+            t.IsTrue(beforeWait[0].host == callTime + 64us, "alarm host deadline is not rebased with VBlank");
+            t.Equals(beforeWait[0].cycle, periodCycles + cycles(64), "alarm guest deadline is unchanged");
+            EeSchedulerPacingTestAccess::wait(fixture.scheduler);
+            t.IsTrue(fixture.clock.time == callTime + 64us, "idle scheduler waits only until alarm");
+            t.Equals(EeSchedulerPacingTestAccess::cycle(fixture.scheduler), periodCycles + cycles(64), "idle wait advances exact guest alarm cycles");
+            EeSchedulerPacingTestAccess::pump(fixture.scheduler);
+            const auto invoked = EeSchedulerPacingTestAccess::invoked(fixture.scheduler);
+            t.IsTrue(invoked == std::vector<uint32_t>{startHandler, alarmHandler}, "alarm expires before corresponding VBlank end");
+            const auto afterWait = EeSchedulerPacingTestAccess::deadlines(fixture.scheduler);
+            t.IsTrue(afterWait[0].host == callTime - period + duration, "alarm did not move VBlank end");
+            t.IsTrue(afterWait[1].host == callTime, "alarm did not move next VBlank start");
+        });
+        tc.Run("slow two-field renders retain bounded catch-up without an added host wait", [](TestCase &t) {
+            Fixture fixture;
+            t.IsTrue(fixture.initialize(), "fixture initializes");
+            for (uint64_t render = 0; render < 30u; ++render) {
+                fixture.clock.time += 120ms;
+                const auto ready = fixture.clock.time;
+                for (uint64_t field = 1; field <= 2u; ++field) {
+                    EeSchedulerPacingTestAccess::cycle(fixture.scheduler, (render * 2u + field) * periodCycles);
+                    EeSchedulerPacingTestAccess::pump(fixture.scheduler);
+                    t.IsTrue(fixture.clock.time == ready, "slow render owes no additional full-field host wait");
+                }
+                const auto pending = EeSchedulerPacingTestAccess::deadlines(fixture.scheduler);
+                t.IsTrue(pending.back().host == ready + period,
+                         "catch-up debt stays bounded after every slow render");
+            }
+        });
+    });
+    return MiniTest::Run();
+}

From fde5e92c86b0a4771e53b58a60ecf070e945d6ce Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 14 Sep 2026 14:51:31 +0200
Subject: [PATCH 50/68] Queue immutable presentation snapshots without blocking
 GS submission

---
 ps2xRuntime/include/runtime/gs/gs_backend.h   | 18 ++++
 .../include/runtime/gs/gs_threaded_backend.h  |  5 ++
 ps2xRuntime/src/lib/gs/gs_frontend.cpp        | 21 +++--
 .../src/lib/gs/gs_threaded_backend.cpp        | 87 ++++++++++++++++++-
 4 files changed, 122 insertions(+), 9 deletions(-)

diff --git a/ps2xRuntime/include/runtime/gs/gs_backend.h b/ps2xRuntime/include/runtime/gs/gs_backend.h
index 9419cc23a..2b41fd51b 100644
--- a/ps2xRuntime/include/runtime/gs/gs_backend.h
+++ b/ps2xRuntime/include/runtime/gs/gs_backend.h
@@ -3,8 +3,16 @@
 #include "runtime/gs/gs_types.h"
 
 #include <cstdint>
+#include <memory>
 #include <vector>
 
+struct GSPreparedPresentation
+{
+    virtual ~GSPreparedPresentation() = default;
+    uint64_t sourceVsyncTick = 0u;
+};
+using GSPresentationTicket = std::shared_ptr<const GSPreparedPresentation>;
+
 class GSRasterBackend
 {
 public:
@@ -30,4 +38,14 @@ class GSRasterBackend
     virtual void WriteVram(uint32_t psm, uint32_t base, uint32_t bw, uint32_t x, uint32_t y, uint32_t value) = 0;
     virtual void SnapshotVram(std::vector<uint8_t> &out) const = 0;
     virtual GSTransferSnapshot GetTransferSnapshot() const = 0;
+
+    // Display has one consumer on the window thread; concurrent repeats are
+    // unsupported. The owner outlives calls, but tickets may outlive the owner.
+    virtual bool SupportsPreparedPresentation() const { return false; }
+    // Only queued preparation may run under the frontend's state lock.
+    virtual bool QueuesPreparedPresentation() const { return false; }
+    virtual GSPresentationTicket PreparePresentation(const GSPresentationRequest &) { return {}; }
+    virtual PresentationFrame DisplayPreparedPresentation(const GSPresentationTicket &) { return {}; }
+    // Shutdown must wake a producer blocked waiting for a free snapshot slot.
+    virtual void CancelPreparedPresentations() noexcept {}
 };
diff --git a/ps2xRuntime/include/runtime/gs/gs_threaded_backend.h b/ps2xRuntime/include/runtime/gs/gs_threaded_backend.h
index 6ea2370b1..ccfadf68d 100644
--- a/ps2xRuntime/include/runtime/gs/gs_threaded_backend.h
+++ b/ps2xRuntime/include/runtime/gs/gs_threaded_backend.h
@@ -23,6 +23,11 @@ class GSThreadedBackend final : public GSRasterBackend
     void TextureFlush() override;
     void Sync(GSSyncReason reason) override;
     PresentationFrame Present(const GSPresentationRequest &request) override;
+    bool SupportsPreparedPresentation() const override;
+    bool QueuesPreparedPresentation() const override { return SupportsPreparedPresentation(); }
+    GSPresentationTicket PreparePresentation(const GSPresentationRequest &request) override;
+    PresentationFrame DisplayPreparedPresentation(const GSPresentationTicket &ticket) override;
+    void CancelPreparedPresentations() noexcept override;
     bool ClearFramebuffer(const GSContext &context, uint32_t rgba) override;
     uint32_t ConsumeLocalToHostBytes(uint8_t *dst, uint32_t size) override;
     uint32_t ReadVram(uint32_t psm, uint32_t base, uint32_t bw, uint32_t x, uint32_t y) const override;
diff --git a/ps2xRuntime/src/lib/gs/gs_frontend.cpp b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
index aa622f741..75508b6cf 100644
--- a/ps2xRuntime/src/lib/gs/gs_frontend.cpp
+++ b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
@@ -132,6 +132,7 @@ void GS::init(uint8_t *vram, uint32_t vramSize, GSRegisters *privRegs)
 void GS::reset()
 {
     std::lock_guard<std::recursive_mutex> lock(m_stateMutex);
+    std::lock_guard<std::mutex> backendLock(m_backendLifetimeMutex);
     std::memset(m_ctx, 0, sizeof(m_ctx));
     m_prim = {};
     m_primRegister = {};
@@ -537,6 +538,8 @@ static void maybeWriteScreenshot(GS &gs);
 void GS::latchHostPresentationFrame()
 {
     GSPresentationRequest request{};
+    GSPresentationTicket ticket;
+    std::unique_lock<std::mutex> backendLock(m_backendLifetimeMutex, std::defer_lock);
     {
         std::lock_guard<std::recursive_mutex> lock(m_stateMutex);
         if (!m_backend || !m_privRegs)
@@ -548,18 +551,20 @@ void GS::latchHostPresentationFrame()
             m_hostPresentationRowPitchBytes = 0u;
             return;
         }
+        backendLock.lock();
         request = buildPresentationRequestUnlocked();
+        if (m_backend->QueuesPreparedPresentation())
+            ticket = m_backend->PreparePresentation(request);
     }
 
     PresentationFrame frame{};
+    if (ticket)
+        frame = m_backend->DisplayPreparedPresentation(ticket);
+    else
     {
-        std::lock_guard<std::mutex> backendLock(m_backendLifetimeMutex);
-        if (m_backend)
-        {
-            m_backend->Flush();
-            m_backend->Sync(GSSyncReason::Presentation);
-            frame = m_backend->Present(request);
-        }
+        m_backend->Flush();
+        m_backend->Sync(GSSyncReason::Presentation);
+        frame = m_backend->Present(request);
     }
 
     const bool presented = static_cast<bool>(frame);
@@ -586,6 +591,8 @@ void GS::latchHostPresentationFrame()
         m_hostPresentationUsedPreferred = usedPreferred;
         m_hasHostPresentationFrame = hasHostFrame;
     }
+    ticket.reset();
+    backendLock.unlock();
 
     if (hasHostFrame)
     {
diff --git a/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp b/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp
index 9707de2a4..25aa6a3a2 100644
--- a/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp
+++ b/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp
@@ -16,13 +16,41 @@
 
 struct GSThreadedBackend::Impl
 {
-    enum class Op { Submit, Transfer, Upload, Flush, TextureFlush, Write };
+    struct PresentationResult
+    {
+        std::mutex mutex;
+        std::condition_variable ready;
+        bool completed = false;
+        GSPresentationTicket frame;
+        std::exception_ptr error;
+        void fail(std::exception_ptr failure)
+        {
+            std::lock_guard lock(mutex);
+            if (completed) return;
+            error = failure;
+            completed = true;
+            ready.notify_all();
+        }
+    };
+    struct PresentationTicket final : GSPreparedPresentation
+    {
+        std::shared_ptr<const int> owner;
+        std::shared_ptr<PresentationResult> result;
+        PresentationTicket(std::shared_ptr<const int> owner, std::shared_ptr<PresentationResult> result)
+            : owner(std::move(owner)), result(std::move(result)) {}
+    };
+    struct Prepare
+    {
+        GSPresentationRequest request;
+        std::shared_ptr<PresentationResult> result;
+    };
+    enum class Op { Submit, Transfer, Upload, Flush, TextureFlush, Write, Prepare };
     using Pixel = std::array<uint32_t, 6>;
     struct Command
     {
         Op op;
         std::variant<std::monostate, GSPrimitiveBatch, GSTransferCommand,
-                     std::vector<uint8_t>, Pixel> data;
+                     std::vector<uint8_t>, Pixel, Prepare> data;
         int rounding = std::fegetround();
         size_t bytes() const
         {
@@ -40,6 +68,7 @@ struct GSThreadedBackend::Impl
 
     ~Impl()
     {
+        backend->CancelPreparedPresentations();
         {
             std::lock_guard lock(mutex);
             stopping = true;
@@ -118,6 +147,20 @@ struct GSThreadedBackend::Impl
             backend->WriteVram(p[0], p[1], p[2], p[3], p[4], p[5]);
             break;
         }
+        case Op::Prepare:
+        {
+            const auto &prepare = std::get<Prepare>(command.data);
+            backend->Flush();
+            backend->Sync(GSSyncReason::Presentation);
+            auto frame = backend->PreparePresentation(prepare.request);
+            if (!frame)
+                throw std::runtime_error("GS presentation preparation returned no ticket");
+            std::lock_guard lock(prepare.result->mutex);
+            prepare.result->frame = std::move(frame);
+            prepare.result->completed = true;
+            prepare.result->ready.notify_all();
+            break;
+        }
         }
     }
 
@@ -157,6 +200,12 @@ struct GSThreadedBackend::Impl
             {
                 std::lock_guard lock(mutex);
                 error = std::current_exception();
+                for (const auto &command : batch)
+                    if (command.op == Op::Prepare)
+                        std::get<Prepare>(command.data).result->fail(error);
+                for (const auto &command : pending)
+                    if (command.op == Op::Prepare)
+                        std::get<Prepare>(command.data).result->fail(error);
                 pending.clear();
                 outstandingBytes = 0u;
                 progress.notify_all();
@@ -172,6 +221,7 @@ struct GSThreadedBackend::Impl
     }
 
     std::unique_ptr<GSRasterBackend> backend;
+    const std::shared_ptr<const int> identity = std::make_shared<const int>(0);
     const size_t capacity;
     std::mutex submission, mutex;
     std::condition_variable work, progress;
@@ -219,8 +269,41 @@ void GSThreadedBackend::Sync(GSSyncReason reason)
 }
 PresentationFrame GSThreadedBackend::Present(const GSPresentationRequest &request)
 {
+    if (SupportsPreparedPresentation())
+        return DisplayPreparedPresentation(PreparePresentation(request));
     return m_impl->observe([&](auto &b) { return b.Present(request); });
 }
+bool GSThreadedBackend::SupportsPreparedPresentation() const
+{
+    return m_impl->backend->SupportsPreparedPresentation();
+}
+GSPresentationTicket GSThreadedBackend::PreparePresentation(const GSPresentationRequest &request)
+{
+    if (!SupportsPreparedPresentation()) return {};
+    auto result = std::make_shared<Impl::PresentationResult>();
+    auto ticket = std::make_shared<Impl::PresentationTicket>(m_impl->identity, result);
+    ticket->sourceVsyncTick = request.vsyncTick;
+    m_impl->enqueue({Impl::Op::Prepare, Impl::Prepare{request, std::move(result)}}, true);
+    return ticket;
+}
+PresentationFrame GSThreadedBackend::DisplayPreparedPresentation(const GSPresentationTicket &ticket)
+{
+    const auto *prepared = dynamic_cast<const Impl::PresentationTicket *>(ticket.get());
+    if (!prepared || prepared->owner != m_impl->identity)
+        throw std::invalid_argument("GS presentation ticket belongs to another backend");
+    GSPresentationTicket frame;
+    {
+        std::unique_lock lock(prepared->result->mutex);
+        prepared->result->ready.wait(lock, [&] { return prepared->result->completed; });
+        if (prepared->result->error) std::rethrow_exception(prepared->result->error);
+        frame = prepared->result->frame;
+    }
+    return m_impl->backend->DisplayPreparedPresentation(frame);
+}
+void GSThreadedBackend::CancelPreparedPresentations() noexcept
+{
+    m_impl->backend->CancelPreparedPresentations();
+}
 bool GSThreadedBackend::ClearFramebuffer(const GSContext &context, uint32_t rgba)
 {
     return m_impl->observe([&](auto &b) { return b.ClearFramebuffer(context, rgba); });

From 221a0b619ff5357b503b0279a791e8f115af2954 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 21 Sep 2026 21:31:37 +0200
Subject: [PATCH 51/68] Compile bounded VU regions with static hazards and
 retained register values

---
 ps2xRuntime/CMakeLists.txt                    |   11 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp      |    5 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp       |   15 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl       |   13 +
 ps2xRuntime/src/lib/vu/ps2_vu1_region.h       |  110 ++
 .../src/lib/vu/ps2_vu1_region_exec.inl        |  276 +++++
 ps2xRuntime/src/lib/vu/ps2_vu1_region_lower.h |  135 +++
 ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h  |  184 +++
 .../src/lib/vu/ps2_vu1_region_retirement.h    |   38 +
 .../src/lib/vu/ps2_vu1_region_values.h        |   78 ++
 ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h | 1002 +++++++++++++++++
 ps2xTest/CMakeLists.txt                       |    1 +
 ps2xTest/data/vu_static_regions.vublocks      |   12 +
 ps2xTest/src/main.cpp                         |    2 +
 ps2xTest/src/ps2_vu1_tests.cpp                |  367 ++++++
 ps2xTest/src/ps2_vu1_upper_engine_tests.cpp   |  179 +++
 tools/compile_vu_blocks.py                    |    7 +-
 tools/tests/test_compile_vu_blocks.py         |   34 +-
 18 files changed, 2458 insertions(+), 11 deletions(-)
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_region.h
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_region_exec.inl
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_region_lower.h
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_region_retirement.h
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_region_values.h
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h
 create mode 100644 ps2xTest/data/vu_static_regions.vublocks
 create mode 100644 ps2xTest/src/ps2_vu1_upper_engine_tests.cpp

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index 63636cfde..0a99211b5 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -409,12 +409,21 @@ set_source_files_properties(
 set(PS2X_VU_AOT_IMAGES "" CACHE STRING "Local VU code images or block profiles to compile; never distributed")
 set(PS2X_VU_AOT_PAIR_IMAGES "" CACHE STRING "Additional local VU inputs to compile as reusable individual pairs")
 option(PS2X_VU_AOT_DEBUG_INFO "Include expanded VU AOT debug scopes (slow to compile)" OFF)
-set(PS2X_VU_AOT_SHARDS "8" CACHE STRING "Number of independent VU AOT compilation units")
+set(PS2X_VU_AOT_SHARDS "32" CACHE STRING "Number of independent VU AOT compilation units")
+set(PS2X_VU_AOT_COMPILE_JOBS "2" CACHE STRING "Maximum concurrent runtime compilations with VU AOT (Ninja)")
 if(PS2X_VU_AOT_IMAGES OR PS2X_VU_AOT_PAIR_IMAGES)
     find_package(Python3 COMPONENTS Interpreter REQUIRED)
     if(NOT PS2X_VU_AOT_SHARDS MATCHES "^[1-9][0-9]*$")
         message(FATAL_ERROR "PS2X_VU_AOT_SHARDS must be a positive integer")
     endif()
+    if(NOT PS2X_VU_AOT_COMPILE_JOBS MATCHES "^[1-9][0-9]*$")
+        message(FATAL_ERROR "PS2X_VU_AOT_COMPILE_JOBS must be a positive integer")
+    endif()
+    # Static data-flow specializations otherwise exhaust memory in parallel builds.
+    if(CMAKE_GENERATOR MATCHES "Ninja")
+        set_property(GLOBAL APPEND PROPERTY JOB_POOLS ps2_vu_aot_compile=${PS2X_VU_AOT_COMPILE_JOBS})
+        set_property(TARGET ps2_runtime PROPERTY JOB_POOL_COMPILE ps2_vu_aot_compile)
+    endif()
     set(PS2X_VU_AOT_INCLUDE "${CMAKE_CURRENT_BINARY_DIR}/generated/vu_aot_blocks.inc")
     set(PS2X_VU_AOT_EXTERN_INCLUDE "${CMAKE_CURRENT_BINARY_DIR}/generated/vu_aot_blocks_extern.inc")
     set(PS2X_VU_AOT_SOURCES)
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp
index 7e5107ab5..eab556d0e 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp
@@ -16,8 +16,9 @@ void VU1Interpreter::rebuildDecodedCodeCache(const uint8_t *vuCode, uint32_t cod
         std::memcpy(words, vuCode + i * 8u, sizeof(words));
         const auto &old = m_decodedCodeCache[i];
         const bool changed = !reusable || old.lower != words[0] || old.upper != words[1];
-        // Native blocks span at most four pairs; a later edit invalidates earlier starts.
-        changedWindow = ((changedWindow << 1u) | static_cast<uint32_t>(changed)) & 0xFu;
+        // A later edit must invalidate every native region that can contain it.
+        // The registry supports regions of up to sixteen pairs without code wrap.
+        changedWindow = ((changedWindow << 1u) | static_cast<uint32_t>(changed)) & 0xffffu;
         if (changed)
             m_decodedCodeCache[i] = decodeInstructionPair(vuCode, i * 8u);
         if (changedWindow != 0u)
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
index abc50edbb..f66f502a3 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
@@ -332,7 +332,7 @@ VU1Interpreter::CompiledBlock VU1Interpreter::findCompiledBlock(
 #ifdef PS2X_VU_AOT_INCLUDE
     struct Entry {
         Unit unit;
-        std::array<uint64_t, 4> words;
+        std::array<uint64_t, 16> words;
         CompiledBlock run;
         uint32_t bytes;
     };
@@ -350,16 +350,21 @@ VU1Interpreter::CompiledBlock VU1Interpreter::findCompiledBlock(
     const auto *entry = std::lower_bound(std::begin(entries), std::end(entries), first,
         [](const Entry &entry, uint64_t word) { return entry.words[0] < word; });
     CompiledBlock pair = nullptr;
+    CompiledBlock block = nullptr;
+    uint32_t longest = 0u;
     for (; entry != std::end(entries) && entry->words[0] == first; ++entry) {
         if (entry->unit != unit)
             continue;
         if (entry->bytes == 8u)
             pair = entry->run;
-        else if (!pairsOnly && size >= entry->bytes &&
+        else if (!pairsOnly && entry->bytes > longest && size >= entry->bytes &&
                  std::memcmp(code, entry->words.data(), entry->bytes) == 0)
-            return entry->run;
+        {
+            block = entry->run;
+            longest = entry->bytes;
+        }
     }
-    return pair;
+    return block ? block : pair;
 #endif
     return nullptr;
 }
@@ -436,6 +441,8 @@ void VU1Interpreter::run(uint8_t *vuCode, uint32_t codeSize,
     if (useVuRounding && previousRoundingMode != -1)
         std::fesetround(previousRoundingMode);
     const uint64_t pairsAfter = m_compiledPairsExecuted + m_interpretedPairsExecuted;
+    if (ps2_vu_detail::profileRegions)
+        ps2_vu_detail::regionCounters.total[m_unit == Unit::VU1 ? 1u : 0u] += pairsAfter - pairsBefore;
     if (profileExecution && (pairsBefore >> 24u) != (pairsAfter >> 24u))
         std::fprintf(stderr, "[VU%u execution] native=%llu fallback=%llu (%.1f%% native)\n",
                      m_unit == Unit::VU1 ? 1u : 0u,
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl
index 7e5c6f696..93015110c 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl
@@ -6,6 +6,11 @@
 #include "runtime/gs/gs_frontend.h"
 #include "runtime/ps2_memory.h"
 #include "ps2_vu1_detail.h"
+#include "ps2_vu1_region.h"
+#include "ps2_vu1_region_plan.h"
+#include "ps2_vu1_region_lower.h"
+#include "ps2_vu1_region_values.h"
+#include "ps2_vu1_upper_engine.h"
 #include <algorithm>
 #include <bit>
 #include <cmath>
@@ -1507,6 +1512,14 @@ PS2_VU_FORCE_INLINE bool VU1Interpreter::runDecodedPair(const DecodedInstruction
 template <VU1Interpreter::Unit unit, uint64_t... words>
 bool VU1Interpreter::runCompiledBlock(VU1Interpreter &vu, uint64_t budgetEnd)
 {
+    static constexpr std::array decodedRegion = {
+        decodeInstructionWords(static_cast<uint32_t>(words), static_cast<uint32_t>(words >> 32u), unit)...};
+#include "ps2_vu1_region_exec.inl"
+    if constexpr (sizeof...(words) > 4u)
+    {
+        static constexpr std::array rawWords = {words...};
+        return runCompiledBlock<unit, rawWords[0], rawWords[1], rawWords[2], rawWords[3]>(vu, budgetEnd);
+    }
     const uint32_t startPC = vu.m_state.pc;
     uint32_t nextPC = startPC;
     bool active = true;
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region.h b/ps2xRuntime/src/lib/vu/ps2_vu1_region.h
new file mode 100644
index 000000000..a6f08d19f
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region.h
@@ -0,0 +1,110 @@
+#ifndef PS2_VU1_REGION_H
+#define PS2_VU1_REGION_H
+
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include "ps2_vu1_region_retirement.h"
+
+namespace ps2_vu_detail {
+
+struct RegionCounters {
+    uint64_t total[2]{};
+    uint64_t candidate[2]{};
+    uint64_t accepted[2]{};
+    uint64_t acceptedByLength[17][2]{};
+    ~RegionCounters()
+    {
+        if (!std::getenv("PS2_VU_PROFILE_REGIONS"))
+            return;
+        for (unsigned unit = 0; unit < 2; ++unit)
+        {
+            std::fprintf(stderr, "VU%u regions: total=%llu candidate=%llu accepted=%llu pairs\n",
+                unit, static_cast<unsigned long long>(total[unit]),
+                static_cast<unsigned long long>(candidate[unit]),
+                static_cast<unsigned long long>(accepted[unit]));
+            for (unsigned length = 4u; length <= 16u; length += 4u)
+                if (acceptedByLength[length][unit] != 0u)
+                    std::fprintf(stderr, "VU%u region%u=%llu pairs\n", unit, length,
+                        static_cast<unsigned long long>(acceptedByLength[length][unit]));
+        }
+    }
+};
+inline thread_local RegionCounters regionCounters;
+inline const bool profileRegions = std::getenv("PS2_VU_PROFILE_REGIONS") != nullptr;
+
+constexpr bool regionBudgetFits(uint64_t start, uint64_t budgetEnd, unsigned cycles)
+{
+    // The last issue can retain results for four further cycles. Leave clock
+    // wrap to the ordinary executor instead of wrapping deferred timestamps.
+    return start <= UINT64_MAX - cycles - 4u &&
+        budgetEnd >= start && budgetEnd - start >= cycles;
+}
+
+template <typename State, typename Flags, typename VfWrites, typename ViWrites,
+          typename VfSequences, typename ViSequences>
+#if defined(__GNUC__) || defined(__clang__)
+__attribute__((noinline))
+#endif
+void retireRegionInputs(State &state, uint64_t start, Flags &flags, VfWrites &vfWrites,
+                        ViWrites &viWrites, const VfSequences &vfSequences,
+                        const ViSequences &viSequences, uint32_t &activeFlags,
+                        uint32_t &activeVf, uint32_t &activeVi,
+                        const std::array<std::array<uint8_t, 4>, 32> &firstWrite,
+                        const std::array<uint8_t, 16> &firstViWrite)
+{
+    // No instruction in this region observes flags. Retain their chronological
+    // sticky accumulation while moving retirement before the arithmetic.
+    for (unsigned offset = 1u; offset <= 4u; ++offset)
+    {
+        const uint64_t cycle = start + offset;
+        for (uint32_t active = activeFlags & (3u << (2u * (cycle & 3u)));
+             active != 0u; active &= active - 1u)
+        {
+            const unsigned index = std::countr_zero(active);
+            const auto &entry = flags[index];
+            if (entry.readyCycle > cycle)
+                continue;
+            if (entry.writesMac)
+                state.mac = entry.mac;
+            if (entry.writesStatus)
+            {
+                const uint32_t current = entry.status & 0xfu;
+                state.status = (state.status & 0xff0u) | current | ((current | entry.extraSticky) << 6u);
+            }
+            if (entry.writesSticky)
+                state.status = (state.status & 0x3fu) | (entry.status & 0xfc0u);
+            if (entry.writesClip)
+                state.clip = entry.clip;
+            activeFlags &= ~(1u << index);
+        }
+    }
+    for (uint32_t active = activeVf; active != 0u; active &= active - 1u)
+    {
+        const unsigned index = std::countr_zero(active);
+        const auto &write = vfWrites[index];
+        if (write.readyCycle > start + 4u)
+            continue;
+        // A later issue can cancel a pending lane before it becomes visible.
+        const uint32_t offset = write.readyCycle > start ? write.readyCycle - start : 0u;
+        retireRegionVector(state.vf[write.reg], write.value.data(), vfSequences[write.reg].data(),
+                           write.sequence, write.laneMask, firstWrite[write.reg].data(), offset);
+        activeVf &= ~(1u << index);
+    }
+    for (uint32_t active = activeVi; active != 0u; active &= active - 1u)
+    {
+        const unsigned index = std::countr_zero(active);
+        const auto &write = viWrites[index];
+        if (write.readyCycle > start + 4u)
+            continue;
+        if (viSequences[write.reg] == write.sequence &&
+            write.readyCycle <= start + firstViWrite[write.reg])
+            state.vi[write.reg] = static_cast<int16_t>(write.value);
+        activeVi &= ~(1u << index);
+    }
+}
+
+}
+#endif
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region_exec.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_region_exec.inl
new file mode 100644
index 000000000..f70677282
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region_exec.inl
@@ -0,0 +1,276 @@
+    static constexpr auto plan = ps2_vu_detail::planRegion(decodedRegion);
+    if constexpr (plan.eligible)
+    {
+        const auto tryRegion = [&]() PS2_VU_INLINE_LAMBDA {
+            const uint64_t start = vu.m_cycle;
+            if (!ps2_vu_detail::regionBudgetFits(start, budgetEnd, plan.cycles) ||
+                vu.m_state.pc + sizeof...(words) * 8u > vu.m_cachedCodeSize || vu.m_stopRequested ||
+                vu.m_state.branchPending || vu.m_state.ebit || vu.m_state.haltAfterDelaySlot ||
+                vu.m_xgkick.active || vu.m_fdiv.valid || vu.m_activeStores || vu.m_activeAccWrites ||
+                !vu.m_activeVuData || vu.m_activeVuDataSize < 16u)
+                return false;
+            const uint64_t generation = unit == Unit::VU1
+                ? vu.m_activeMemory->getVU1CodeGeneration() : vu.m_activeMemory->getVU0CodeGeneration();
+            if (generation != vu.m_cachedCodeGeneration)
+                return false;
+            for (const auto &entry : vu.m_efu)
+                if (entry.valid)
+                    return false;
+            for (uint32_t active = vu.m_activeFlags; active != 0u; active &= active - 1u)
+                if (vu.m_flagPipeline[std::countr_zero(active)].readyCycle > start + 3u)
+                    return false;
+            const bool ready = [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                return ((vu.calculatePairReadyCycleInline(decodedRegion[indices]) <= start + plan.issue[indices]) && ...);
+            }(std::make_index_sequence<sizeof...(words)>{});
+            if (!ready)
+                return false;
+
+            ps2_vu_detail::retireRegionInputs(vu.m_state, start, vu.m_flagPipeline,
+                vu.m_vfWritePipeline, vu.m_viWritePipeline, vu.m_vfLatestWrite,
+                vu.m_viLatestWrite, vu.m_activeFlags, vu.m_activeVfWrites, vu.m_activeViWrites,
+                plan.firstVfWrite, plan.firstViWrite);
+            static constexpr auto entryReads = [] {
+                struct Reads {
+                    std::array<uint8_t, 33> vf{};
+                    std::array<bool, 16> vi{};
+                } reads;
+                const auto vf = [&](uint16_t source, unsigned lane) {
+                    if (source < 33u)
+                        reads.vf[source] |= static_cast<uint8_t>(1u << lane);
+                };
+                const auto vi = [&](uint16_t source) {
+                    if (source < 16u)
+                        reads.vi[source] = true;
+                };
+                for (const auto &source : plan.sources)
+                {
+                    for (unsigned lane = 0; lane < 4u; ++lane)
+                    {
+                        vf(source.fs[lane], lane);
+                        vf(source.ft[lane], lane);
+                        vf(source.acc[lane], lane);
+                        vf(source.lowerFs[lane], lane);
+                        vf(source.lowerFt[lane], lane);
+                    }
+                    vi(source.viOld);
+                    vi(source.viS);
+                    vi(source.viT);
+                }
+                for (unsigned reg = 0; reg < 32u; ++reg)
+                    for (unsigned lane = 0; lane < 4u; ++lane)
+                        if (plan.vfVisible[reg][lane] != reg)
+                            vf(plan.vfVisible[reg][lane], lane);
+                for (unsigned reg = 0; reg < 16u; ++reg)
+                    if (plan.viVisible[reg] != reg)
+                        vi(plan.viVisible[reg]);
+                for (unsigned lane = 0; lane < 4u; ++lane)
+                    if (plan.accVisible[lane] != 32u)
+                        vf(plan.accVisible[lane], lane);
+                return reads;
+            }();
+            std::array<std::array<float, 4>, 33> entryVf;
+            std::array<int32_t, 16> entryVi;
+            // Snapshot every referenced entry operand before byte stores can alias state.
+            [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                (([&]() PS2_VU_INLINE_LAMBDA {
+                    constexpr unsigned reg = indices / 4u, lane = indices % 4u;
+                    if constexpr ((entryReads.vf[reg] & (1u << lane)) != 0u)
+                    {
+                        if constexpr (reg < 32u)
+                            entryVf[reg][lane] = vu.m_state.vf[reg][lane];
+                        else
+                            entryVf[reg][lane] = vu.m_state.acc[lane];
+                    }
+                }()), ...);
+            }(std::make_index_sequence<132u>{});
+            [&]<size_t... regs>(std::index_sequence<regs...>) PS2_VU_INLINE_LAMBDA {
+                (([&]() PS2_VU_INLINE_LAMBDA {
+                    if constexpr (entryReads.vi[regs])
+                        entryVi[regs] = vu.m_state.vi[regs];
+                }()), ...);
+            }(std::make_index_sequence<16u>{});
+            const float entryI = vu.m_state.i, entryQ = vu.m_state.q;
+            std::array<std::array<float, 4>, sizeof...(words) * 2u> values{};
+            std::array<int32_t, sizeof...(words)> integers{};
+            std::array<ps2_vu_detail::RegionFlag, sizeof...(words)> flags{};
+            uint32_t workingClip = vu.m_workingClip;
+            const auto readVf = [&]<uint16_t source, unsigned lane>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (source == ps2_vu_detail::regionConstantZero)
+                    return lane == 3u ? 1.0f : 0.0f;
+                else if constexpr (source < 32u)
+                {
+                    static_assert((entryReads.vf[source] & (1u << lane)) != 0u);
+                    return entryVf[source][lane];
+                }
+                else if constexpr (source == 32u)
+                {
+                    static_assert((entryReads.vf[32u] & (1u << lane)) != 0u);
+                    return entryVf[32u][lane];
+                }
+                else
+                    return values[source - 33u][lane];
+            };
+            const auto readVi = [&]<uint16_t source>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (source == ps2_vu_detail::regionConstantZero)
+                    return int32_t{0};
+                else if constexpr (source < 16u)
+                {
+                    static_assert(entryReads.vi[source]);
+                    return entryVi[source];
+                }
+                else
+                    return integers[source - 16u];
+            };
+            const auto readI = [&]<uint16_t source>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (source == 0u)
+                    return entryI;
+                else
+                    return ps2_vu_detail::upper::normalizeOperand(
+                        std::bit_cast<float>(decodedRegion[source - 1u].lower));
+            };
+            const auto issue = [&]<size_t index>() PS2_VU_INLINE_LAMBDA {
+                static constexpr auto source = plan.sources[index];
+                float fs[4], ft[4], acc[4], lowerFs[4];
+                [&]<size_t... lanes>(std::index_sequence<lanes...>) PS2_VU_INLINE_LAMBDA {
+                    ((fs[lanes] = readVf.template operator()<source.fs[lanes], lanes>(),
+                      ft[lanes] = readVf.template operator()<source.ft[lanes], lanes>(),
+                      acc[lanes] = readVf.template operator()<source.acc[lanes], lanes>(),
+                      lowerFs[lanes] = readVf.template operator()<source.lowerFs[lanes], lanes>(),
+                      values[index * 2u + 1u][lanes] = readVf.template operator()<source.lowerFt[lanes], lanes>()), ...);
+                }(std::make_index_sequence<4u>{});
+                ps2_vu_detail::RegionUpperInputs input{fs, ft, acc,
+                    readI.template operator()<source.scalarI>(), entryQ};
+                ps2_vu_detail::RegionUpperSink sink{values[index * 2u].data(), flags[index], workingClip};
+                ps2_vu_detail::upper::computeUpper(decodedRegion[index].upper, input, sink);
+                integers[index] = readVi.template operator()<source.viOld>();
+                ps2_vu_detail::RegionLowerInputs lowerInput{lowerFs,
+                    readVi.template operator()<source.viS>(), readVi.template operator()<source.viT>()};
+                ps2_vu_detail::RegionLowerSink lowerSink{values[index * 2u + 1u].data(), integers[index]};
+                if constexpr (!decodedRegion[index].iBit)
+                    ps2_vu_detail::computeRegionLower(decodedRegion[index].lower, lowerInput, lowerSink,
+                                                    vu.m_activeVuData, vu.m_activeVuDataSize);
+            };
+            [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                (issue.template operator()<indices>(), ...);
+            }(std::make_index_sequence<sizeof...(words)>{});
+
+            const uint64_t sequenceBase = vu.m_nextWriteSequence;
+            const uint64_t end = start + plan.cycles;
+            constexpr unsigned last = sizeof...(words) - 1u;
+            const int32_t branchOld = readVi.template operator()<plan.sources[last].viOld>();
+            const auto publishVf = [&]<size_t reg, size_t lane>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (plan.vfVisible[reg][lane] != reg)
+                    vu.m_state.vf[reg][lane] = readVf.template operator()<plan.vfVisible[reg][lane], lane>();
+                if constexpr (plan.vfLatest[reg][lane] != 0u)
+                {
+                    vu.m_vfReady[reg][lane] = start + plan.vfReady[reg][lane];
+                    vu.m_vfLatestWrite[reg][lane] = sequenceBase + plan.vfLatest[reg][lane];
+                }
+            };
+            [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                (publishVf.template operator()<indices / 4u, indices % 4u>(), ...);
+            }(std::make_index_sequence<128u>{});
+            [&]<size_t... regs>(std::index_sequence<regs...>) PS2_VU_INLINE_LAMBDA {
+                (([&]() PS2_VU_INLINE_LAMBDA {
+                    if constexpr (plan.viVisible[regs] != regs)
+                        vu.m_state.vi[regs] = readVi.template operator()<plan.viVisible[regs]>();
+                    if constexpr (plan.viLatest[regs] != 0u)
+                    {
+                        vu.m_viReady[regs] = start + plan.viReady[regs];
+                        vu.m_viLatestWrite[regs] = sequenceBase + plan.viLatest[regs];
+                    }
+                }()), ...);
+            }(std::make_index_sequence<16u>{});
+            [&]<size_t... lanes>(std::index_sequence<lanes...>) PS2_VU_INLINE_LAMBDA {
+                (([&]() PS2_VU_INLINE_LAMBDA {
+                    if constexpr (plan.accVisible[lanes] != 32u)
+                        vu.m_state.acc[lanes] = readVf.template operator()<plan.accVisible[lanes], lanes>();
+                    if constexpr (plan.accReady[lanes] != 0u)
+                        vu.m_accReady[lanes] = start + plan.accReady[lanes];
+                }()), ...);
+            }(std::make_index_sequence<4u>{});
+            const auto pendingVf = [&]<ps2_vu_detail::RegionWrite write>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (write.mask != 0u && write.ready > plan.cycles)
+                {
+                    auto *entry = allocateScheduledEntry(vu.m_vfWritePipeline, vu.m_activeVfWrites, start + write.ready);
+                    *entry = {};
+                    entry->valid = true;
+                    entry->readyCycle = start + write.ready;
+                    entry->sequence = sequenceBase + write.sequence;
+                    entry->reg = write.reg;
+                    entry->laneMask = write.mask;
+                    entry->value = values[write.value - 33u];
+                }
+            };
+            const auto publishTail = [&]<size_t index>() PS2_VU_INLINE_LAMBDA {
+                pendingVf.template operator()<plan.upper[index]>();
+                pendingVf.template operator()<plan.lower[index]>();
+                static constexpr auto viWrite = plan.vi[index];
+                if constexpr (viWrite.mask != 0u && viWrite.ready > plan.cycles)
+                {
+                    auto *entry = allocateScheduledEntry(vu.m_viWritePipeline, vu.m_activeViWrites, start + viWrite.ready);
+                    *entry = {};
+                    entry->valid = true;
+                    entry->readyCycle = start + viWrite.ready;
+                    entry->sequence = sequenceBase + viWrite.sequence;
+                    entry->reg = viWrite.reg;
+                    entry->value = integers[index];
+                }
+                const auto &flag = flags[index];
+                if (flag.fmac || flag.clip)
+                {
+                    if constexpr (plan.issue[index] + 4u <= plan.cycles)
+                    {
+                        if (flag.fmac)
+                        {
+                            vu.m_state.mac = flag.mac;
+                            const uint32_t current = flag.status & 15u;
+                            vu.m_state.status = (vu.m_state.status & 0xff0u) | current | ((current | flag.extraSticky) << 6u);
+                        }
+                        if (flag.clip)
+                            vu.m_state.clip = flag.clipValue;
+                    }
+                    else
+                    {
+                        auto *entry = allocateScheduledEntry(vu.m_flagPipeline, vu.m_activeFlags, start + plan.issue[index] + 4u);
+                        *entry = {};
+                        entry->valid = true;
+                        entry->issueCycle = start + plan.issue[index];
+                        entry->readyCycle = entry->issueCycle + 4u;
+                        entry->mac = flag.mac;
+                        entry->status = flag.status;
+                        entry->extraSticky = flag.extraSticky;
+                        entry->clip = flag.clipValue;
+                        entry->writesMac = entry->writesStatus = flag.fmac;
+                        entry->writesClip = flag.clip;
+                    }
+                }
+            };
+            [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                (publishTail.template operator()<indices>(), ...);
+            }(std::make_index_sequence<sizeof...(words)>{});
+            vu.m_viBranchBackupValid = false;
+            if constexpr (plan.vi[last].mask != 0u && decodedRegion[last].lowerUsage.delaysNextBranchRead)
+                vu.recordViWriteForBranch(plan.vi[last].reg, branchOld);
+            vu.m_nextWriteSequence = sequenceBase + plan.sequences;
+            vu.m_workingClip = workingClip;
+            if constexpr (plan.scalarI != 0u)
+                vu.m_state.i = readI.template operator()<plan.scalarI>();
+            vu.m_currentUpperInstruction = decodedRegion[last].upper;
+            vu.m_cycle = vu.m_state.cycles = end;
+            vu.m_state.pc += sizeof...(words) * 8u;
+            if (vu.m_state.pc == vu.m_cachedCodeSize)
+                vu.m_state.pc = 0u;
+            vu.m_compiledPairsExecuted += sizeof...(words);
+            return true;
+        };
+        if (tryRegion())
+        {
+            if (ps2_vu_detail::profileRegions)
+            {
+                ps2_vu_detail::regionCounters.accepted[unit == Unit::VU1 ? 1u : 0u] += sizeof...(words);
+                ps2_vu_detail::regionCounters.acceptedByLength[sizeof...(words)][unit == Unit::VU1 ? 1u : 0u] += sizeof...(words);
+            }
+            return false;
+        }
+    }
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region_lower.h b/ps2xRuntime/src/lib/vu/ps2_vu1_region_lower.h
new file mode 100644
index 000000000..49c0d401d
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region_lower.h
@@ -0,0 +1,135 @@
+#ifndef PS2_VU1_REGION_LOWER_H
+#define PS2_VU1_REGION_LOWER_H
+
+#include "ps2_vu1_detail.h"
+#include <bit>
+#include <cstdint>
+#include <cstring>
+
+namespace ps2_vu_detail {
+
+template <class Inputs, class Sink>
+PS2_VU_FORCE_INLINE void computeRegionLower(uint32_t instr, const Inputs &input, Sink &sink,
+                               uint8_t *data, uint32_t dataSize)
+{
+    if (instr == 0u || instr == 0x8000033cu)
+        return;
+    const uint32_t opcode = instr >> 25u, dest = (instr >> 21u) & 15u;
+    const uint32_t fs = (instr >> 11u) & 31u, ft = (instr >> 16u) & 31u;
+    const uint32_t is = fs & 15u, it = ft & 15u, id = (instr >> 6u) & 15u;
+    const int32_t viS = input.viS(), viT = input.viT();
+    const int32_t immediate = static_cast<int32_t>(instr << 21u) >> 21u;
+    const auto address = [&](int32_t qword) PS2_VU_INLINE_LAMBDA { return static_cast<uint32_t>(qword) * 16u & (dataSize - 1u); };
+    const auto loadVector = [&](uint32_t addr) PS2_VU_INLINE_LAMBDA {
+        if (addr + 16ull <= dataSize)
+        {
+            float value[4];
+            std::memcpy(value, data + addr, sizeof(value));
+            sink.vf(ft, dest, value);
+        }
+    };
+    const auto storeVector = [&](uint32_t addr) PS2_VU_INLINE_LAMBDA {
+        if (addr + 16ull <= dataSize)
+            for (unsigned lane = 0; lane < 4; ++lane)
+                if ((dest & (8u >> lane)) != 0u)
+                {
+                    const float value = input.fs(lane);
+                    std::memcpy(data + addr + lane * 4u, &value, sizeof(value));
+                }
+    };
+    const auto loadInteger = [&](uint32_t addr) PS2_VU_INLINE_LAMBDA {
+        if (addr + 16ull <= dataSize)
+        {
+            const unsigned lane = (dest & 8u) != 0u ? 0u : (dest & 4u) != 0u ? 1u : (dest & 2u) != 0u ? 2u : 3u;
+            uint32_t value;
+            std::memcpy(&value, data + addr + lane * 4u, sizeof(value));
+            sink.vi(it, static_cast<int16_t>(value));
+        }
+    };
+    const auto storeInteger = [&](uint32_t addr) PS2_VU_INLINE_LAMBDA {
+        if (addr + 16ull <= dataSize)
+        {
+            const uint32_t value = static_cast<uint16_t>(viT);
+            for (unsigned lane = 0; lane < 4; ++lane)
+                if ((dest & (8u >> lane)) != 0u)
+                    std::memcpy(data + addr + lane * 4u, &value, sizeof(value));
+        }
+    };
+    switch (opcode)
+    {
+    case 0u: loadVector(address(viS + immediate)); return;
+    case 1u: storeVector(address(viT + immediate)); return;
+    case 4u: loadInteger(address(viS + immediate)); return;
+    case 5u: storeInteger(address(viS + immediate)); return;
+    case 8u:
+    case 9u:
+    {
+        const int32_t value = static_cast<int16_t>(instr & 0x7ffu) | ((instr >> 10u) & 0x7800u);
+        sink.vi(it, static_cast<int16_t>(opcode == 8u ? viS + value : viS - value));
+        return;
+    }
+    }
+    const uint32_t direct = instr & 63u;
+    switch (direct)
+    {
+    case 0x30u: sink.vi(id, static_cast<int16_t>(viS + viT)); return;
+    case 0x31u: sink.vi(id, static_cast<int16_t>(viS - viT)); return;
+    case 0x32u:
+    {
+        const int32_t value = static_cast<int32_t>(instr << 21u) >> 27u;
+        sink.vi(it, static_cast<int16_t>(viS + value));
+        return;
+    }
+    case 0x34u: sink.vi(id, viS & viT); return;
+    case 0x35u: sink.vi(id, viS | viT); return;
+    }
+    switch ((instr & 3u) | ((instr >> 4u) & 0x7cu))
+    {
+    case 0x30u:
+    case 0x31u:
+    {
+        const unsigned rotate = ((instr & 3u) == 1u) ? 1u : 0u;
+        const float value[4] = {input.fs(rotate), input.fs((1u + rotate) & 3u),
+                                input.fs((2u + rotate) & 3u), input.fs((3u + rotate) & 3u)};
+        sink.vf(ft, dest, value);
+        return;
+    }
+    case 0x34u:
+        loadVector(address(static_cast<uint16_t>(viS)));
+        sink.vi(is, static_cast<int16_t>(viS + 1));
+        return;
+    case 0x35u:
+        storeVector(address(static_cast<uint16_t>(viT)));
+        sink.vi(it, static_cast<int16_t>(viT + 1));
+        return;
+    case 0x36u:
+    {
+        const int16_t value = is != 0u ? static_cast<int16_t>(viS - 1) : viS;
+        sink.vi(is, value);
+        loadVector(address(static_cast<uint16_t>(value)));
+        return;
+    }
+    case 0x37u:
+    {
+        const int16_t value = it != 0u ? static_cast<int16_t>(viT - 1) : viT;
+        sink.vi(it, value);
+        storeVector(address(static_cast<uint16_t>(value)));
+        return;
+    }
+    case 0x3cu:
+        sink.vi(it, static_cast<int16_t>(std::bit_cast<uint32_t>(input.fs((instr >> 21u) & 3u))));
+        return;
+    case 0x3du:
+    {
+        const float bits = std::bit_cast<float>(static_cast<int32_t>(static_cast<int16_t>(viS)));
+        const float value[4] = {bits, bits, bits, bits};
+        sink.vf(ft, dest, value);
+        return;
+    }
+    case 0x3eu: loadInteger(address(static_cast<uint16_t>(viS))); return;
+    case 0x3fu: storeInteger(address(static_cast<uint16_t>(viS))); return;
+    }
+}
+
+}
+#endif
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h b/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h
new file mode 100644
index 000000000..68cb08166
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h
@@ -0,0 +1,184 @@
+#ifndef PS2_VU1_REGION_PLAN_H
+#define PS2_VU1_REGION_PLAN_H
+
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+
+namespace ps2_vu_detail {
+
+inline constexpr uint16_t regionConstantZero = 0xffffu;
+
+struct RegionSources {
+    std::array<uint16_t, 4> fs{}, ft{}, acc{}, lowerFs{}, lowerFt{};
+    uint16_t viS{}, viT{}, viOld{}, scalarI{};
+};
+
+struct RegionWrite {
+    uint16_t value{}, issue{}, ready{}, sequence{};
+    uint8_t reg{}, mask{};
+};
+
+template <size_t N>
+struct RegionPlan {
+    bool eligible = N >= 4u && N <= 16u;
+    uint16_t cycles{}, sequences{}, scalarI{};
+    std::array<uint16_t, N> issue{};
+    std::array<RegionSources, N> sources{};
+    std::array<RegionWrite, N> upper{}, lower{}, vi{};
+    std::array<std::array<uint16_t, 4>, 32> vfVisible{}, vfReady{}, vfLatest{};
+    std::array<uint16_t, 16> viVisible{}, viReady{}, viLatest{};
+    std::array<uint16_t, 4> accVisible{}, accReady{};
+    std::array<std::array<uint8_t, 4>, 32> firstVfWrite{};
+    std::array<uint8_t, 16> firstViWrite{};
+};
+
+constexpr bool regionLowerSupported(uint32_t lower)
+{
+    const uint32_t opcode = lower >> 25u, direct = lower & 0x3fu;
+    const uint32_t special = (lower & 3u) | ((lower >> 4u) & 0x7cu);
+    return lower == 0u || lower == 0x8000033cu || opcode == 0u || opcode == 1u ||
+        opcode == 4u || opcode == 5u || opcode == 8u || opcode == 9u ||
+        (opcode == 0x40u && (direct == 0x30u || direct == 0x31u || direct == 0x32u ||
+            direct == 0x34u || direct == 0x35u ||
+            (direct >= 0x3cu && ((special >= 0x30u && special <= 0x31u) ||
+                               (special >= 0x34u && special <= 0x37u) ||
+                               (special >= 0x3cu && special <= 0x3fu)))));
+}
+
+template <typename Decoded, size_t N>
+constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded)
+{
+    RegionPlan<N> plan;
+    auto vfPending = plan.vfVisible;
+    auto viPending = plan.viVisible;
+    auto accPending = plan.accVisible;
+    for (unsigned reg = 0; reg < 32; ++reg)
+    {
+        plan.vfVisible[reg].fill(reg);
+        vfPending[reg].fill(reg);
+        plan.firstVfWrite[reg].fill(255u);
+    }
+    for (unsigned reg = 0; reg < 16; ++reg)
+        plan.viVisible[reg] = viPending[reg] = reg;
+    plan.accVisible.fill(32u);
+    accPending.fill(32u);
+    plan.firstViWrite.fill(255u);
+    const auto retire = [&](uint16_t cycle) {
+        for (unsigned reg = 1; reg < 32; ++reg)
+            for (unsigned lane = 0; lane < 4; ++lane)
+                if (plan.vfReady[reg][lane] <= cycle)
+                    plan.vfVisible[reg][lane] = vfPending[reg][lane];
+        for (unsigned reg = 1; reg < 16; ++reg)
+            if (plan.viReady[reg] <= cycle)
+                plan.viVisible[reg] = viPending[reg];
+        for (unsigned lane = 0; lane < 4; ++lane)
+            if (plan.accReady[lane] <= cycle)
+                plan.accVisible[lane] = accPending[lane];
+    };
+    for (unsigned index = 0; index < N; ++index)
+    {
+        const auto &pair = decoded[index];
+        if (pair.eBit || pair.mBit || pair.dBit || pair.tBit || pair.upperUsage.reserved ||
+            (!pair.iBit && (pair.lowerUsage.reserved || !regionLowerSupported(pair.lower))))
+            plan.eligible = false;
+        const uint32_t upperOp = pair.upper & 63u;
+        const uint32_t upperSpecial = (pair.upper & 3u) | ((pair.upper >> 4u) & 0x7cu);
+        const bool upperWritesZero = ((pair.upper >> 21u) & 15u) != 0u &&
+            (upperOp < 0x3cu ? ((pair.upper >> 6u) & 31u) == 0u :
+                (((upperSpecial >= 0x10u && upperSpecial <= 0x17u) || upperSpecial == 0x1du) &&
+                 ((pair.upper >> 16u) & 31u) == 0u));
+        const uint32_t lowerOp = pair.lower >> 25u;
+        const uint32_t lowerSpecial = (pair.lower & 3u) | ((pair.lower >> 4u) & 0x7cu);
+        const bool lowerReadsZero = ((pair.lower >> 11u) & 31u) == 0u &&
+            (lowerOp == 1u || (lowerOp == 0x40u && (pair.lower & 63u) >= 0x3cu &&
+                (lowerSpecial == 0x30u || lowerSpecial == 0x31u || lowerSpecial == 0x35u ||
+                 lowerSpecial == 0x37u || lowerSpecial == 0x3cu)));
+        // The scalar oracle exposes a transient upper VF0 write to lower reads.
+        if (!pair.iBit && upperWritesZero && lowerReadsZero)
+            plan.eligible = false;
+        uint16_t cycle = plan.cycles;
+        for (const auto *usage : {&pair.upperUsage, &pair.lowerUsage})
+        {
+            for (unsigned readIndex = 0; readIndex < usage->vfReadCount; ++readIndex)
+            {
+                const auto &read = usage->vfRead[readIndex];
+                for (unsigned lane = 0; lane < 4; ++lane)
+                    if ((read.lanes & (8u >> lane)) != 0u)
+                        cycle = std::max(cycle, plan.vfReady[read.reg][lane]);
+            }
+            for (unsigned reg = 1; reg < 16; ++reg)
+                if ((usage->viRead & (1u << reg)) != 0u)
+                    cycle = std::max(cycle, plan.viReady[reg]);
+            for (unsigned lane = 0; lane < 4; ++lane)
+                if ((usage->accRead & (8u >> lane)) != 0u)
+                    cycle = std::max(cycle, plan.accReady[lane]);
+        }
+        plan.issue[index] = cycle;
+        retire(cycle);
+        auto &source = plan.sources[index];
+        source.fs = plan.vfVisible[(pair.upper >> 11u) & 31u];
+        source.ft = plan.vfVisible[(pair.upper >> 16u) & 31u];
+        source.acc = plan.accVisible;
+        source.scalarI = plan.scalarI;
+        source.lowerFs = plan.vfVisible[(pair.lower >> 11u) & 31u];
+        source.lowerFt = plan.vfVisible[(pair.lower >> 16u) & 31u];
+        source.viS = plan.viVisible[(pair.lower >> 11u) & 15u];
+        source.viT = plan.viVisible[(pair.lower >> 16u) & 15u];
+        const auto writeVf = [&](const auto &usage, RegionWrite &write, uint16_t value) {
+            const auto &access = usage.vfWrite;
+            if (access.reg == 0u || access.lanes == 0u)
+                return;
+            write = {value, cycle, static_cast<uint16_t>(cycle + (usage.vfLatency != 0u ? usage.vfLatency : usage.latency)),
+                     static_cast<uint16_t>(++plan.sequences), access.reg, access.lanes};
+            for (unsigned lane = 0; lane < 4; ++lane)
+                if ((access.lanes & (8u >> lane)) != 0u)
+                {
+                    vfPending[access.reg][lane] = value;
+                    plan.vfReady[access.reg][lane] = write.ready;
+                    plan.vfLatest[access.reg][lane] = write.sequence;
+                    plan.firstVfWrite[access.reg][lane] = std::min(plan.firstVfWrite[access.reg][lane], static_cast<uint8_t>(cycle));
+                }
+        };
+        writeVf(pair.upperUsage, plan.upper[index], 33u + index * 2u);
+        if (pair.lowerUsage.vfWrite.reg != pair.suppressedLowerVf)
+            writeVf(pair.lowerUsage, plan.lower[index], 34u + index * 2u);
+        const uint16_t viWrites = pair.lowerUsage.viWrite & 0xfffeu;
+        if (viWrites != 0u)
+        {
+            const uint8_t reg = std::countr_zero(viWrites);
+            source.viOld = plan.viVisible[reg];
+            const auto &usage = pair.lowerUsage;
+            const uint16_t ready = cycle + (usage.viLatency != 0u ? usage.viLatency : usage.latency);
+            plan.vi[index] = {static_cast<uint16_t>(16u + index), cycle, ready,
+                             static_cast<uint16_t>(++plan.sequences), reg, 1u};
+            viPending[reg] = 16u + index;
+            plan.viReady[reg] = ready;
+            plan.viLatest[reg] = plan.vi[index].sequence;
+            plan.firstViWrite[reg] = std::min(plan.firstViWrite[reg], static_cast<uint8_t>(cycle));
+        }
+        for (unsigned lane = 0; lane < 4; ++lane)
+            if ((pair.upperUsage.accWrite & (8u >> lane)) != 0u)
+            {
+                accPending[lane] = 33u + index * 2u;
+                plan.accReady[lane] = cycle + 1u;
+            }
+        plan.cycles = cycle + 1u;
+        if (pair.iBit)
+            plan.scalarI = index + 1u;
+        plan.vfVisible[0].fill(regionConstantZero);
+        plan.viVisible[0] = regionConstantZero;
+    }
+    retire(plan.cycles);
+    for (auto &lanes : plan.firstVfWrite)
+        for (auto &offset : lanes)
+            offset = std::min(offset, static_cast<uint8_t>(plan.cycles));
+    for (auto &offset : plan.firstViWrite)
+        offset = std::min(offset, static_cast<uint8_t>(plan.cycles));
+    return plan;
+}
+
+}
+#endif
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region_retirement.h b/ps2xRuntime/src/lib/vu/ps2_vu1_region_retirement.h
new file mode 100644
index 000000000..060632f22
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region_retirement.h
@@ -0,0 +1,38 @@
+#ifndef PS2_VU1_REGION_RETIREMENT_H
+#define PS2_VU1_REGION_RETIREMENT_H
+
+#include <cstdint>
+#include <cstring>
+#if defined(__aarch64__)
+#include <arm_neon.h>
+#endif
+
+namespace ps2_vu_detail {
+
+inline void retireRegionVector(float *destination, const float *value,
+                               const uint64_t *latest, uint64_t sequence,
+                               uint8_t laneMask, const uint8_t *firstWrite,
+                               uint32_t readyOffset)
+{
+#if defined(__aarch64__)
+    const auto expected = vdupq_n_u64(sequence);
+    const auto matches = vcombine_u32(vmovn_u64(vceqq_u64(vld1q_u64(latest), expected)),
+                                     vmovn_u64(vceqq_u64(vld1q_u64(latest + 2), expected)));
+    uint32_t offsets;
+    std::memcpy(&offsets, firstWrite, sizeof(offsets));
+    const auto expanded = vmovl_u16(vget_low_u16(vmovl_u8(vcreate_u8(offsets))));
+    const auto visible = vcgeq_u32(expanded, vdupq_n_u32(readyOffset));
+    const uint32x4_t laneBits = {8u, 4u, 2u, 1u};
+    const auto lanes = vtstq_u32(vdupq_n_u32(laneMask), laneBits);
+    const auto mask = vandq_u32(vandq_u32(matches, visible), lanes);
+    vst1q_f32(destination, vbslq_f32(mask, vld1q_f32(value), vld1q_f32(destination)));
+#else
+    for (unsigned lane = 0; lane < 4; ++lane)
+        if ((laneMask & (8u >> lane)) != 0u && latest[lane] == sequence &&
+            readyOffset <= firstWrite[lane])
+            destination[lane] = value[lane];
+#endif
+}
+
+}
+#endif
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region_values.h b/ps2xRuntime/src/lib/vu/ps2_vu1_region_values.h
new file mode 100644
index 000000000..bd9468e12
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region_values.h
@@ -0,0 +1,78 @@
+#ifndef PS2_VU1_REGION_VALUES_H
+#define PS2_VU1_REGION_VALUES_H
+
+#include "ps2_vu1_detail.h"
+#include <cstdint>
+#include <cstdlib>
+
+namespace ps2_vu_detail {
+
+struct RegionFlag {
+    uint32_t mac{}, status{}, extraSticky{}, clipValue{};
+    bool fmac{}, clip{};
+};
+
+struct RegionUpperInputs {
+    const float *left, *right, *accumulator;
+    float scalarI, scalarQ;
+    float fs(unsigned lane) const { return left[lane]; }
+    float ft(unsigned lane) const { return right[lane]; }
+    float acc(unsigned lane) const { return accumulator[lane]; }
+    float i() const { return scalarI; }
+    float q() const { return scalarQ; }
+    bool compiledFastPath() const { return true; }
+};
+
+struct RegionUpperSink {
+    float *result;
+    RegionFlag &flags;
+    uint32_t &workingClip;
+    void vf(unsigned, unsigned mask, const float *value)
+    {
+        for (unsigned lane = 0; lane < 4; ++lane)
+            if ((mask & (8u >> lane)) != 0u)
+                result[lane] = value[lane];
+    }
+    void acc(unsigned mask, const float *value) { vf(0u, mask, value); }
+    void fmac(uint32_t mac, uint32_t status, uint32_t sticky)
+    {
+        flags.mac = mac;
+        flags.status = status;
+        flags.extraSticky = sticky;
+        flags.fmac = true;
+    }
+    void clip(uint32_t sixBits)
+    {
+        workingClip = ((workingClip << 6u) | (sixBits & 63u)) & 0xffffffu;
+        flags.clipValue = workingClip;
+        flags.clip = true;
+    }
+    void reserved(uint32_t) { std::abort(); }
+};
+
+struct RegionLowerInputs {
+    const float *left;
+    int32_t source, target;
+    float fs(unsigned lane) const { return left[lane]; }
+    int32_t viS() const { return source; }
+    int32_t viT() const { return target; }
+};
+
+struct RegionLowerSink {
+    float *result;
+    int32_t &integer;
+    PS2_VU_FORCE_INLINE void vf(unsigned, unsigned mask, const float *value)
+    {
+        for (unsigned lane = 0; lane < 4; ++lane)
+            if ((mask & (8u >> lane)) != 0u)
+                result[lane] = value[lane];
+    }
+    void vi(unsigned reg, int32_t value)
+    {
+        if (reg != 0u)
+            integer = static_cast<int16_t>(value);
+    }
+};
+
+}
+#endif
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h b/ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h
new file mode 100644
index 000000000..f32259169
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h
@@ -0,0 +1,1002 @@
+#ifndef PS2_VU1_UPPER_ENGINE_H
+#define PS2_VU1_UPPER_ENGINE_H
+
+#include "ps2_vu1_detail.h"
+#include "ps2_vu1_fmac_neon.h"
+#include <cmath>
+#include <cstring>
+#include <limits>
+
+namespace ps2_vu_detail::upper {
+
+// Inputs provide raw FS/FT/ACC lanes, I/Q and the compiled SIMD preference.
+// Sink receives VF/ACC values, packed FMAC flags, CLIP bits or a reserved opcode.
+// The caller supplies VU rounding; this engine never accesses pipeline state.
+
+inline constexpr uint8_t laneForComponent(uint32_t component)
+{
+    return static_cast<uint8_t>(8u >> component);
+}
+
+PS2_VU_FORCE_INLINE int32_t floatToInt(float value, float scale)
+{
+    const double scaled = static_cast<double>(value) * static_cast<double>(scale);
+    if (scaled >= static_cast<double>(std::numeric_limits<int32_t>::max()))
+        return std::numeric_limits<int32_t>::max();
+    if (scaled <= static_cast<double>(std::numeric_limits<int32_t>::min()))
+        return std::numeric_limits<int32_t>::min();
+    return static_cast<int32_t>(scaled);
+}
+
+PS2_VU_FORCE_INLINE float normalizeOperand(float value)
+{
+    uint32_t bits = 0;
+    std::memcpy(&bits, &value, sizeof(bits));
+    const uint32_t exponent = (bits >> 23) & 0xFFu;
+    if (exponent == 0u)
+    {
+        bits &= 0x80000000u;
+    }
+    else if (exponent == 0xFFu)
+    {
+        bits = (bits & 0x80000000u) | 0x7F7FFFFFu;
+    }
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+PS2_VU_FORCE_INLINE float normalizeResult(float value, uint32_t &laneFlags)
+{
+    uint32_t bits = 0;
+    std::memcpy(&bits, &value, sizeof(bits));
+    const uint32_t sign = bits & 0x80000000u;
+    const uint32_t magnitude = bits & 0x7FFFFFFFu;
+    const uint32_t exponent = (bits >> 23) & 0xFFu;
+
+    laneFlags = sign != 0u ? 0x2u : 0u;
+    if (magnitude == 0u)
+    {
+        laneFlags |= 0x1u;
+    }
+    else if (exponent == 0u)
+    {
+        laneFlags |= 0x5u;
+        bits = sign;
+    }
+    else if (exponent == 0xFFu)
+    {
+        laneFlags |= 0x8u;
+        bits = sign | 0x7F7FFFFFu;
+    }
+
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+PS2_VU_FORCE_INLINE uint8_t normalizeFmacExactResult(float &value, long double exactResult)
+{
+    const bool negative = std::signbit(exactResult);
+    const long double magnitude = std::fabs(exactResult);
+    const long double maximum = static_cast<long double>(std::numeric_limits<float>::max());
+    const long double minimum = static_cast<long double>(std::numeric_limits<float>::min());
+    uint8_t flags = negative ? 0x2u : 0u;
+
+    uint32_t bits = negative ? 0x80000000u : 0u;
+    if (magnitude == 0.0L)
+    {
+        flags |= 0x1u;
+        std::memcpy(&value, &bits, sizeof(value));
+    }
+    else if (magnitude > maximum)
+    {
+        flags |= 0x8u;
+        bits |= 0x7F7FFFFFu;
+        std::memcpy(&value, &bits, sizeof(value));
+    }
+    else if (magnitude < minimum)
+    {
+        flags |= 0x5u;
+        std::memcpy(&value, &bits, sizeof(value));
+    }
+
+    return flags;
+}
+
+template <class Inputs>
+PS2_VU_FORCE_INLINE bool calculateFmacExactResult(uint32_t instr, const Inputs &in, uint32_t component, long double &result)
+{
+    const uint32_t upper = instr;
+    const uint8_t op = static_cast<uint8_t>(upper & 0x3Fu);
+    const uint8_t special = op >= 0x3Cu
+                                ? static_cast<uint8_t>((upper & 3u) | ((upper >> 4) & 0x7Cu))
+                                : 0xFFu;
+
+    const auto operand = [&](float value) PS2_VU_INLINE_LAMBDA
+    {
+        return static_cast<long double>(normalizeOperand(value));
+    };
+    const auto vs = [&](uint32_t lane) PS2_VU_INLINE_LAMBDA
+    {
+        return operand(in.fs(lane));
+    };
+    const auto vt = [&](uint32_t lane) PS2_VU_INLINE_LAMBDA
+    {
+        return operand(in.ft(lane));
+    };
+    const auto acc = [&](uint32_t lane) PS2_VU_INLINE_LAMBDA
+    {
+        return operand(in.acc(lane));
+    };
+
+    const long double q = operand(in.q());
+    const long double i = operand(in.i());
+
+    if (op < 0x3Cu)
+    {
+        if (op <= 0x03u)
+            result = vs(component) + vt(op & 3u);
+        else if (op <= 0x07u)
+            result = vs(component) - vt(op & 3u);
+        else if (op <= 0x0Bu)
+            result = acc(component) + vs(component) * vt(op & 3u);
+        else if (op <= 0x0Fu)
+            result = acc(component) - vs(component) * vt(op & 3u);
+        else if (op >= 0x18u && op <= 0x1Bu)
+            result = vs(component) * vt(op & 3u);
+        else
+        {
+            switch (op)
+            {
+            case 0x1Cu:
+                result = vs(component) * q;
+                break;
+            case 0x1Eu:
+                result = vs(component) * i;
+                break;
+            case 0x20u:
+                result = vs(component) + q;
+                break;
+            case 0x21u:
+                result = acc(component) + vs(component) * q;
+                break;
+            case 0x22u:
+                result = vs(component) + i;
+                break;
+            case 0x23u:
+                result = acc(component) + vs(component) * i;
+                break;
+            case 0x24u:
+                result = vs(component) - q;
+                break;
+            case 0x25u:
+                result = acc(component) - vs(component) * q;
+                break;
+            case 0x26u:
+                result = vs(component) - i;
+                break;
+            case 0x27u:
+                result = acc(component) - vs(component) * i;
+                break;
+            case 0x28u:
+                result = vs(component) + vt(component);
+                break;
+            case 0x29u:
+                result = acc(component) + vs(component) * vt(component);
+                break;
+            case 0x2Au:
+                result = vs(component) * vt(component);
+                break;
+            case 0x2Cu:
+                result = vs(component) - vt(component);
+                break;
+            case 0x2Du:
+                result = acc(component) - vs(component) * vt(component);
+                break;
+            case 0x2Eu:
+            {
+                static constexpr uint8_t left[4] = {1u, 2u, 0u, 3u};
+                static constexpr uint8_t right[4] = {2u, 0u, 1u, 3u};
+                result = component == 3u
+                             ? 0.0L
+                             : acc(component) - vs(left[component]) * vt(right[component]);
+                break;
+            }
+            default:
+                return false;
+            }
+        }
+        return true;
+    }
+
+    if (special <= 0x03u)
+        result = vs(component) + vt(special & 3u);
+    else if (special <= 0x07u)
+        result = vs(component) - vt(special & 3u);
+    else if (special <= 0x0Bu)
+        result = acc(component) + vs(component) * vt(special & 3u);
+    else if (special <= 0x0Fu)
+        result = acc(component) - vs(component) * vt(special & 3u);
+    else if (special >= 0x18u && special <= 0x1Bu)
+        result = vs(component) * vt(special & 3u);
+    else
+    {
+        switch (special)
+        {
+        case 0x1Cu:
+            result = vs(component) * q;
+            break;
+        case 0x1Eu:
+            result = vs(component) * i;
+            break;
+        case 0x20u:
+            result = vs(component) + q;
+            break;
+        case 0x21u:
+            result = acc(component) + vs(component) * q;
+            break;
+        case 0x22u:
+            result = vs(component) + i;
+            break;
+        case 0x23u:
+            result = acc(component) + vs(component) * i;
+            break;
+        case 0x24u:
+            result = vs(component) - q;
+            break;
+        case 0x25u:
+            result = acc(component) - vs(component) * q;
+            break;
+        case 0x26u:
+            result = vs(component) - i;
+            break;
+        case 0x27u:
+            result = acc(component) - vs(component) * i;
+            break;
+        case 0x28u:
+            result = vs(component) + vt(component);
+            break;
+        case 0x29u:
+            result = acc(component) + vs(component) * vt(component);
+            break;
+        case 0x2Au:
+            result = vs(component) * vt(component);
+            break;
+        case 0x2Cu:
+            result = vs(component) - vt(component);
+            break;
+        case 0x2Du:
+            result = acc(component) - vs(component) * vt(component);
+            break;
+        case 0x2Eu:
+        {
+            static constexpr uint8_t left[4] = {1u, 2u, 0u, 3u};
+            static constexpr uint8_t right[4] = {2u, 0u, 1u, 3u};
+            result = component == 3u
+                         ? 0.0L
+                         : vs(left[component]) * vt(right[component]);
+            break;
+        }
+        default:
+            return false;
+        }
+    }
+    return true;
+}
+
+template <class Inputs>
+PS2_VU_FORCE_INLINE void normalizeFmacResult(uint32_t instr, const Inputs &in, float *result, uint8_t dest, uint8_t laneFlags[4])
+{
+    const uint32_t upper = instr;
+    const uint32_t op = (upper & 0x3fu) < 0x3cu
+        ? upper & 0x3fu : (upper & 3u) | ((upper >> 4u) & 0x7cu);
+    const bool simpleArithmetic = op <= 7u || (op >= 0x18u && op <= 0x1cu) ||
+        op == 0x1eu || op == 0x20u || op == 0x22u || op == 0x24u ||
+        op == 0x26u || op == 0x28u || op == 0x2au || op == 0x2cu;
+    for (uint32_t component = 0; component < 4u; ++component)
+    {
+        laneFlags[component] = 0u;
+        if ((dest & laneForComponent(component)) == 0u)
+            continue;
+
+        // A normal ADD/SUB/MUL result has only a sign flag. Keep exact checks
+        // at both range boundaries, including overflow rounded to FLT_MAX.
+        uint32_t bits;
+        std::memcpy(&bits, &result[component], sizeof(bits));
+        const uint32_t magnitude = bits & 0x7fffffffu;
+        if (simpleArithmetic && magnitude >= 0x00800000u && magnitude < 0x7f7fffffu)
+        {
+            laneFlags[component] = static_cast<uint8_t>((bits >> 30u) & 2u);
+            continue;
+        }
+
+        long double exactResult = 0.0L;
+        if (calculateFmacExactResult(instr, in, component, exactResult))
+        {
+            laneFlags[component] = normalizeFmacExactResult(result[component], exactResult);
+            continue;
+        }
+
+        uint32_t flags = 0u;
+        result[component] = normalizeResult(result[component], flags);
+        laneFlags[component] = static_cast<uint8_t>(flags);
+    }
+}
+
+template <class Inputs>
+PS2_VU_FORCE_INLINE uint32_t calculateFmacProductSticky(uint32_t instr, const Inputs &in, uint8_t dest)
+{
+    uint32_t extraSticky = 0u;
+    const uint32_t upper = instr;
+    const uint8_t op = static_cast<uint8_t>(upper & 0x3Fu);
+    const uint8_t special = op >= 0x3Cu ? static_cast<uint8_t>((upper & 3u) | ((upper >> 4) & 0x7Cu)) : 0xFFu;
+    const bool productSum =
+        (op >= 0x08u && op <= 0x0Fu) ||
+        op == 0x21u || op == 0x23u || op == 0x25u || op == 0x27u ||
+        op == 0x29u || op == 0x2Du || op == 0x2Eu ||
+        (special >= 0x08u && special <= 0x0Fu) ||
+        special == 0x21u || special == 0x23u || special == 0x25u ||
+        special == 0x27u || special == 0x29u || special == 0x2Du;
+    if (!productSum)
+        return 0u;
+
+    for (uint32_t component = 0; component < 4u; ++component)
+    {
+        if ((dest & laneForComponent(component)) == 0u)
+            continue;
+        static constexpr uint8_t crossLeft[4] = {1u, 2u, 0u, 3u};
+        static constexpr uint8_t crossRight[4] = {2u, 0u, 1u, 3u};
+        const uint8_t leftComponent = op == 0x2Eu ? crossLeft[component] : static_cast<uint8_t>(component);
+        const float left = normalizeOperand(in.fs(leftComponent));
+        float right = 0.0f;
+        if ((op >= 0x08u && op <= 0x0Fu) || (special >= 0x08u && special <= 0x0Fu))
+        {
+            right = normalizeOperand(in.ft((op >= 0x08u && op <= 0x0Fu ? op : special) & 3u));
+        }
+        else if (op == 0x21u || op == 0x25u || special == 0x21u || special == 0x25u)
+        {
+            right = normalizeOperand(in.q());
+        }
+        else if (op == 0x23u || op == 0x27u || special == 0x23u || special == 0x27u)
+        {
+            right = normalizeOperand(in.i());
+        }
+        else if (op == 0x2Eu)
+        {
+            right = normalizeOperand(in.ft(crossRight[component]));
+        }
+        else
+        {
+            right = normalizeOperand(in.ft(component));
+        }
+
+        float product = left * right;
+        uint32_t productBits;
+        std::memcpy(&productBits, &product, sizeof(productBits));
+        const uint32_t magnitude = productBits & 0x7fffffffu;
+        if (magnitude >= 0x00800000u && magnitude < 0x7f7fffffu)
+        {
+            extraSticky |= (productBits >> 30u) & 2u;
+            continue;
+        }
+        const long double exactProduct = static_cast<long double>(left) * static_cast<long double>(right);
+        const uint8_t productFlags = normalizeFmacExactResult(product, exactProduct);
+        // Product-sum instructions report Z/S/U/O from the add/subtract result
+        // as current flags, while every product condition accumulates into the
+        // corresponding sticky flag.
+        extraSticky |= productFlags & 0xFu;
+    }
+    return extraSticky;
+}
+
+template <class Sink>
+PS2_VU_FORCE_INLINE void publishFmacFlags(Sink &sink, const uint8_t laneFlags[4], uint8_t dest, uint32_t extraSticky)
+{
+    if (dest == 0u)
+        return;
+
+    uint32_t mac = 0u;
+    uint32_t status = 0u;
+    for (uint32_t component = 0; component < 4u; ++component)
+    {
+        const uint8_t lane = laneForComponent(component);
+        if ((dest & lane) == 0u)
+            continue;
+
+        const uint32_t flags = laneFlags[component];
+        if ((flags & 0x1u) != 0u)
+            mac |= lane;
+        if ((flags & 0x2u) != 0u)
+            mac |= static_cast<uint32_t>(lane) << 4;
+        if ((flags & 0x4u) != 0u)
+            mac |= static_cast<uint32_t>(lane) << 8;
+        if ((flags & 0x8u) != 0u)
+            mac |= static_cast<uint32_t>(lane) << 12;
+        status |= flags;
+    }
+
+    sink.fmac(mac, status, extraSticky);
+}
+
+// Inputs expose raw operands. Compute flags before publishing values so
+// destination aliases cannot change operands used by exact checks.
+template <class Inputs, class Sink>
+PS2_VU_FORCE_INLINE void computeUpper(uint32_t instr, const Inputs &in, Sink &sink)
+{
+    uint8_t dest = DEST(instr);
+    uint8_t ft = FT(instr);
+    uint8_t fd = FD(instr);
+    uint8_t op = instr & 0x3F;
+
+    // Lower-pipeline work often pairs with an upper NOP; it has no operands.
+    if (op >= 0x3Cu)
+    {
+        const uint8_t special = (instr & 3u) | ((instr >> 4) & 0x7Cu);
+        if (special == 0x2Fu || special == 0x30u)
+            return;
+    }
+
+    float result[4];
+#if defined(__aarch64__)
+    const uint8_t arithmeticOp = op < 0x3cu ? op : (instr & 3u) | ((instr >> 4u) & 0x7cu);
+    const bool productSum = (arithmeticOp >= 8u && arithmeticOp <= 0xfu) ||
+        arithmeticOp == 0x21u || arithmeticOp == 0x23u || arithmeticOp == 0x25u ||
+        arithmeticOp == 0x27u || arithmeticOp == 0x29u || arithmeticOp == 0x2du;
+    // Keep the scalar execution mode independent for differential replays.
+    if (in.compiledFastPath() && productSum)
+    {
+        float leftInput[4], rightInput[4], accInput[4];
+        for (unsigned lane = 0; lane < 4u; ++lane)
+        {
+            leftInput[lane] = in.fs(lane);
+            rightInput[lane] = in.ft(lane);
+            accInput[lane] = in.acc(lane);
+        }
+        float rightBroadcast[4];
+        const float *right = rightInput;
+        if (arithmeticOp <= 0xfu || arithmeticOp == 0x21u || arithmeticOp == 0x25u ||
+            arithmeticOp == 0x23u || arithmeticOp == 0x27u)
+        {
+            const float scalar = arithmeticOp <= 0xfu ? in.ft(arithmeticOp & 3u) :
+                (arithmeticOp == 0x21u || arithmeticOp == 0x25u ? in.q() : in.i());
+            for (auto &lane : rightBroadcast)
+                lane = scalar;
+            right = rightBroadcast;
+        }
+        uint8_t laneFlags[4];
+        uint32_t extraSticky;
+        const bool subtract = (arithmeticOp >= 0xcu && arithmeticOp <= 0xfu) ||
+            arithmeticOp == 0x25u || arithmeticOp == 0x27u || arithmeticOp == 0x2du;
+        const bool fast = subtract
+            ? ps2_vu_detail::tryProductSumVector<true>(leftInput, right, accInput, dest, result, laneFlags, extraSticky)
+            : ps2_vu_detail::tryProductSumVector<false>(leftInput, right, accInput, dest, result, laneFlags, extraSticky);
+        if (fast)
+        {
+            publishFmacFlags(sink, laneFlags, dest, extraSticky);
+            if (op >= 0x3cu)
+                sink.acc(dest, result);
+            else
+                sink.vf(fd, dest, result);
+            return;
+        }
+    }
+#endif
+    // Normalize only operands used by this opcode, after dispatch selects it.
+    const auto vs = [&](unsigned c) PS2_VU_INLINE_LAMBDA { return normalizeOperand(in.fs(c)); };
+    const auto vt = [&](unsigned c) PS2_VU_INLINE_LAMBDA { return normalizeOperand(in.ft(c)); };
+    const auto acc = [&](unsigned c) PS2_VU_INLINE_LAMBDA { return normalizeOperand(in.acc(c)); };
+    const auto q = [&]() PS2_VU_INLINE_LAMBDA { return normalizeOperand(in.q()); };
+    const auto i = [&]() PS2_VU_INLINE_LAMBDA { return normalizeOperand(in.i()); };
+
+    const auto publishFmac = [&](float *values, uint8_t mask) PS2_VU_INLINE_LAMBDA {
+        uint8_t laneFlags[4]{};
+        normalizeFmacResult(instr, in, values, mask, laneFlags);
+        const uint32_t extraSticky = calculateFmacProductSticky(instr, in, mask);
+        publishFmacFlags(sink, laneFlags, mask, extraSticky);
+    };
+
+    // Upper opcode decoding (bits 5:0 of upper word)
+    switch (op)
+    {
+    case 0x00:
+    case 0x01:
+    case 0x02:
+    case 0x03: // ADDbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) + bc;
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    }
+    case 0x04:
+    case 0x05:
+    case 0x06:
+    case 0x07: // SUBbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) - bc;
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    }
+    case 0x08:
+    case 0x09:
+    case 0x0A:
+    case 0x0B: // MADDbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) + vs(c) * bc;
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    }
+    case 0x0C:
+    case 0x0D:
+    case 0x0E:
+    case 0x0F: // MSUBbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) - vs(c) * bc;
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    }
+    case 0x10:
+    case 0x11:
+    case 0x12:
+    case 0x13: // MAXbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) > bc) ? vs(c) : bc;
+        sink.vf(fd, dest, result);
+        return;
+    }
+    case 0x14:
+    case 0x15:
+    case 0x16:
+    case 0x17: // MINIbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) < bc) ? vs(c) : bc;
+        sink.vf(fd, dest, result);
+        return;
+    }
+    case 0x18:
+    case 0x19:
+    case 0x1A:
+    case 0x1B: // MULbc
+    {
+        float bc = vt(op & 3);
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) * bc;
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    }
+    case 0x1C: // MULq
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) * q();
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x1D: // MAXi
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) > i()) ? vs(c) : i();
+        sink.vf(fd, dest, result);
+        return;
+    case 0x1E: // MULi
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) * i();
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x1F: // MINIi
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) < i()) ? vs(c) : i();
+        sink.vf(fd, dest, result);
+        return;
+    case 0x20: // ADDq
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) + q();
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x21: // MADDq
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) + vs(c) * q();
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x22: // ADDi
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) + i();
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x23: // MADDi
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) + vs(c) * i();
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x24: // SUBq
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) - q();
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x25: // MSUBq
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) - vs(c) * q();
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x26: // SUBi
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) - i();
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x27: // MSUBi
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) - vs(c) * i();
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x28: // ADD
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) + vt(c);
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x29: // MADD
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) + vs(c) * vt(c);
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x2A: // MUL
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) * vt(c);
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x2B: // MAX
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) > vt(c)) ? vs(c) : vt(c);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x2C: // SUB
+        for (int c = 0; c < 4; c++)
+            result[c] = vs(c) - vt(c);
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x2D: // MSUB
+        for (int c = 0; c < 4; c++)
+            result[c] = acc(c) - vs(c) * vt(c);
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x2E: // OPMSUB
+        result[0] = acc(0) - vs(1) * vt(2);
+        result[1] = acc(1) - vs(2) * vt(0);
+        result[2] = acc(2) - vs(0) * vt(1);
+        result[3] = 0.0f;
+        publishFmac(result, dest);
+        sink.vf(fd, dest, result);
+        return;
+    case 0x2F: // MINI
+        for (int c = 0; c < 4; c++)
+            result[c] = (vs(c) < vt(c)) ? vs(c) : vt(c);
+        sink.vf(fd, dest, result);
+        return;
+
+    // Upper special group (low op 0x3C..0x3F).
+    // Like lower1 special, the real selector is not just bits 5:0.  Dobie decodes:
+    //   op = (instr & 0x3) | ((instr >> 4) & 0x7C)
+    // Several instructions in this group also use FT as the destination, not FD.
+    case 0x3C:
+    case 0x3D:
+    case 0x3E:
+    case 0x3F:
+    {
+        const uint8_t specialOp = static_cast<uint8_t>((instr & 0x3u) | ((instr >> 4) & 0x7Cu));
+
+        switch (specialOp)
+        {
+        case 0x00:
+        case 0x01:
+        case 0x02:
+        case 0x03: // ADDAbc
+        {
+            float bc = vt(specialOp & 3);
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) + bc;
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        }
+        case 0x04:
+        case 0x05:
+        case 0x06:
+        case 0x07: // SUBAbc
+        {
+            float bc = vt(specialOp & 3);
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) - bc;
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        }
+        case 0x08:
+        case 0x09:
+        case 0x0A:
+        case 0x0B: // MADDAbc
+        {
+            float bc = vt(specialOp & 3);
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) + vs(c) * bc;
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        }
+        case 0x0C:
+        case 0x0D:
+        case 0x0E:
+        case 0x0F: // MSUBAbc
+        {
+            float bc = vt(specialOp & 3);
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) - vs(c) * bc;
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        }
+        case 0x10: // ITOF0
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv;
+                const float raw = in.fs(c);
+                std::memcpy(&iv, &raw, 4);
+                result[c] = static_cast<float>(iv);
+            }
+            sink.vf(ft, dest, result);
+            return;
+        case 0x11: // ITOF4
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv;
+                const float raw = in.fs(c);
+                std::memcpy(&iv, &raw, 4);
+                result[c] = static_cast<float>(iv) / 16.0f;
+            }
+            sink.vf(ft, dest, result);
+            return;
+        case 0x12: // ITOF12
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv;
+                const float raw = in.fs(c);
+                std::memcpy(&iv, &raw, 4);
+                result[c] = static_cast<float>(iv) / 4096.0f;
+            }
+            sink.vf(ft, dest, result);
+            return;
+        case 0x13: // ITOF15
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv;
+                const float raw = in.fs(c);
+                std::memcpy(&iv, &raw, 4);
+                result[c] = static_cast<float>(iv) / 32768.0f;
+            }
+            sink.vf(ft, dest, result);
+            return;
+        case 0x14: // FTOI0
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv = floatToInt(vs(c), 1.0f);
+                std::memcpy(&result[c], &iv, 4);
+            }
+            sink.vf(ft, dest, result);
+            return;
+        case 0x15: // FTOI4
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv = floatToInt(vs(c), 16.0f);
+                std::memcpy(&result[c], &iv, 4);
+            }
+            sink.vf(ft, dest, result);
+            return;
+        case 0x16: // FTOI12
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv = floatToInt(vs(c), 4096.0f);
+                std::memcpy(&result[c], &iv, 4);
+            }
+            sink.vf(ft, dest, result);
+            return;
+        case 0x17: // FTOI15
+            for (int c = 0; c < 4; c++)
+            {
+                int32_t iv = floatToInt(vs(c), 32768.0f);
+                std::memcpy(&result[c], &iv, 4);
+            }
+            sink.vf(ft, dest, result);
+            return;
+        case 0x18:
+        case 0x19:
+        case 0x1A:
+        case 0x1B: // MULAbc
+        {
+            float bc = vt(specialOp & 3);
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) * bc;
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        }
+        case 0x1C: // MULAq
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) * q();
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x1D: // ABS
+            for (int c = 0; c < 4; c++)
+                result[c] = std::fabs(vs(c));
+            sink.vf(ft, dest, result);
+            return;
+        case 0x1E: // MULAi
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) * i();
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x1F: // CLIP
+        {
+            uint32_t wBits = 0u;
+            const float rawW = in.ft(3u);
+            std::memcpy(&wBits, &rawW, sizeof(wBits));
+            const int32_t limit = (wBits & 0x7F800000u) != 0u ? static_cast<int32_t>(wBits & 0x7FFFFFFFu) : 0x007FFFFF;
+
+            const auto exceedsClipPlane = [limit](float value, uint32_t signMask) PS2_VU_INLINE_LAMBDA
+            {
+                uint32_t bits = 0u;
+                std::memcpy(&bits, &value, sizeof(bits));
+                bits ^= signMask;
+                int32_t orderedBits = 0;
+                std::memcpy(&orderedBits, &bits, sizeof(orderedBits));
+                return orderedBits > limit;
+            };
+
+            uint32_t flags = 0u;
+            if (exceedsClipPlane(in.fs(0), 0x00000000u))
+                flags |= 0x01u;
+            if (exceedsClipPlane(in.fs(0), 0x80000000u))
+                flags |= 0x02u;
+            if (exceedsClipPlane(in.fs(1), 0x00000000u))
+                flags |= 0x04u;
+            if (exceedsClipPlane(in.fs(1), 0x80000000u))
+                flags |= 0x08u;
+            if (exceedsClipPlane(in.fs(2), 0x00000000u))
+                flags |= 0x10u;
+            if (exceedsClipPlane(in.fs(2), 0x80000000u))
+                flags |= 0x20u;
+            sink.clip(flags);
+            return;
+        }
+        case 0x20: // ADDAq
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) + q();
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x21: // MADDAq
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) + vs(c) * q();
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x22: // ADDAi
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) + i();
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x23: // MADDAi
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) + vs(c) * i();
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x24: // SUBAq
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) - q();
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x25: // MSUBAq
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) - vs(c) * q();
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x26: // SUBAi
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) - i();
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x27: // MSUBAi
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) - vs(c) * i();
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x28: // ADDA
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) + vt(c);
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x29: // MADDA
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) + vs(c) * vt(c);
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x2A: // MULA
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) * vt(c);
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x2C: // SUBA
+            for (int c = 0; c < 4; c++)
+                result[c] = vs(c) - vt(c);
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x2D: // MSUBA
+            for (int c = 0; c < 4; c++)
+                result[c] = acc(c) - vs(c) * vt(c);
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x2E: // OPMULA
+            result[0] = vs(1) * vt(2);
+            result[1] = vs(2) * vt(0);
+            result[2] = vs(0) * vt(1);
+            result[3] = 0.0f;
+            publishFmac(result, dest);
+            sink.acc(dest, result);
+            return;
+        case 0x2F:
+        case 0x30: // NOP
+            return;
+        default:
+            sink.reserved(instr);
+            return;
+        }
+    }
+
+    case 0x30:
+    case 0x31:
+    case 0x32:
+    case 0x33:
+    default:
+        sink.reserved(instr);
+        return;
+    }
+}
+
+} // namespace ps2_vu_detail::upper
+#endif
diff --git a/ps2xTest/CMakeLists.txt b/ps2xTest/CMakeLists.txt
index aa9754b53..bd2580b5a 100644
--- a/ps2xTest/CMakeLists.txt
+++ b/ps2xTest/CMakeLists.txt
@@ -53,6 +53,7 @@ add_library(ps2_test_lib STATIC
     src/ee_fiber_tests.cpp
     src/ps2_memory_tests.cpp
     src/ps2_vu1_tests.cpp
+    src/ps2_vu1_upper_engine_tests.cpp
     src/ps2_vu_tests.cpp
     src/ps2_gs_tests.cpp
     src/ps2_iop_tests.cpp
diff --git a/ps2xTest/data/vu_static_regions.vublocks b/ps2xTest/data/vu_static_regions.vublocks
new file mode 100644
index 000000000..b975dde6f
--- /dev/null
+++ b/ps2xTest/data/vu_static_regions.vublocks
@@ -0,0 +1,12 @@
+VU-BLOCKS 2
+1 000002ff8000033c 01e520688000033c 000002ff8000033c 000002ff8000033c
+1 000002ff8000033c 000002ff8000033c 000002ff8000033c 01e520688000033c
+1 000002ff8000033c 000002ff8000033c 000002ff8000033c 01e309a88000033c
+1 000002ff10010007 000002ff01e60001 01e5226803e01002 000002ff10010801
+1 01e312be8000033c 01e521a98000033c 01e839ff8000033c 01e741ff8000033c
+1 01e312be10010007 01e521a903e01001 010312288088137c 010521a801ec0001 01e622698000033c 01e742a88000033c 01e839ff09030001 01e952e810010801
+1 81e008e240e00000 01e0111e8000033c 81e0095effc12345 81e011a280000001 01e009e28000033c 800002ff3f000000 01e0121e8000033c 81e00a5e7f800000
+1 000002ff10010001 000002ff10010002 000002ff10010003 000002ff10010004
+1 000002ff10010001 000002ff10010002 000002ff10010003 000002ff10010004 000002ff10010005 000002ff10010006 000002ff10010007 000002ff10010008
+1 000002ff10010001 000002ff10010002 000002ff10010003 000002ff10010004 000002ff10010005 000002ff10010006 000002ff10010007 000002ff10010008 000002ff10010009 000002ff1001000a 000002ff1001000b 000002ff1001000c
+1 000002ff10010001 000002ff10010002 000002ff10010003 000002ff10010004 000002ff10010005 000002ff10010006 000002ff10010007 000002ff10010008 000002ff10010009 000002ff1001000a 000002ff1001000b 000002ff1001000c 000002ff1001000d 000002ff1001000e 000002ff1001000f 000002ff10010010
diff --git a/ps2xTest/src/main.cpp b/ps2xTest/src/main.cpp
index 528f81341..98edd8389 100644
--- a/ps2xTest/src/main.cpp
+++ b/ps2xTest/src/main.cpp
@@ -12,6 +12,7 @@ void register_ps2_runtime_interrupt_tests();
 void register_ee_fiber_tests();
 void register_ps2_memory_tests();
 void register_ps2_vu1_tests();
+void register_ps2_vu1_upper_engine_tests();
 void register_ps2_vu_tests();
 void register_ps2_gs_tests();
 void register_ps2_iop_tests();
@@ -35,6 +36,7 @@ int main()
     register_ee_fiber_tests();
     register_ps2_memory_tests();
     register_ps2_vu1_tests();
+    register_ps2_vu1_upper_engine_tests();
     register_ps2_vu_tests();
     register_ps2_gs_tests();
     register_ps2_iop_tests();
diff --git a/ps2xTest/src/ps2_vu1_tests.cpp b/ps2xTest/src/ps2_vu1_tests.cpp
index 1a6b23e09..5854ed3ae 100644
--- a/ps2xTest/src/ps2_vu1_tests.cpp
+++ b/ps2xTest/src/ps2_vu1_tests.cpp
@@ -6,6 +6,7 @@
 #include "runtime/ps2_vu1.h"
 #include "../../ps2xRuntime/src/lib/vu/ps2_vu1_fmac.h"
 #include "../../ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h"
+#include "../../ps2xRuntime/src/lib/vu/ps2_vu1_region.h"
 
 #include <cfenv>
 #include <cmath>
@@ -220,6 +221,314 @@ void register_ps2_vu1_tests()
 {
     MiniTest::Case("PS2VU1", [](TestCase &tc)
     {
+        tc.Run("static region timestamps reject wrap and retire at the clock limit", [](TestCase &t)
+        {
+            constexpr uint64_t limit = UINT64_MAX;
+            t.IsTrue(ps2_vu_detail::regionBudgetFits(limit - 8u, limit, 4u),
+                     "the highest safe four-cycle region must fit");
+            t.IsTrue(!ps2_vu_detail::regionBudgetFits(limit - 7u, limit, 4u),
+                     "pending timestamps near wrap must force ordinary execution");
+            t.IsTrue(!ps2_vu_detail::regionBudgetFits(10u, 13u, 4u) &&
+                     !ps2_vu_detail::regionBudgetFits(limit - 8u, 3u, 4u),
+                     "short and wrapped deadlines must reject without mutation");
+            struct Flag {
+                uint64_t readyCycle{};
+                uint32_t mac{}, status{}, extraSticky{}, clip{};
+                bool writesMac{}, writesStatus{}, writesSticky{}, writesClip{};
+            };
+            struct VectorWrite {
+                uint64_t readyCycle{}, sequence{};
+                unsigned reg{};
+                uint8_t laneMask{};
+                std::array<float, 4> value{};
+            };
+            struct IntegerWrite {
+                uint64_t readyCycle{}, sequence{};
+                unsigned reg{};
+                int32_t value{};
+            };
+            VU1State state{};
+            std::array<Flag, 8> flags{};
+            std::array<VectorWrite, 1> vectors{};
+            std::array<IntegerWrite, 1> integers{};
+            std::array<std::array<uint64_t, 4>, 32> vfSequences{};
+            std::array<uint64_t, 16> viSequences{};
+            std::array<std::array<uint8_t, 4>, 32> firstWrite{};
+            std::array<uint8_t, 16> firstViWrite{};
+            constexpr uint64_t start = limit - 8u;
+            uint32_t activeFlags = 0u, activeVf = 1u, activeVi = 1u;
+            for (unsigned offset = 1u; offset <= 4u; ++offset)
+            {
+                const unsigned slot = 2u * ((start + offset) & 3u);
+                flags[slot] = {start + offset, offset, offset, 0u, offset,
+                               true, true, false, true};
+                activeFlags |= 1u << slot;
+            }
+            vectors[0] = {start + 3u, 9u, 1u, 12u, {3.0f, 7.0f, 0.0f, 0.0f}};
+            vfSequences[1] = {9u, 9u, 0u, 0u};
+            firstWrite[1] = {2u, 3u, 4u, 4u};
+            integers[0] = {start + 4u, 10u, 1u, 0x8000};
+            viSequences[1] = 10u;
+            firstViWrite[1] = 4u;
+            ps2_vu_detail::retireRegionInputs(state, start, flags, vectors, integers,
+                vfSequences, viSequences, activeFlags, activeVf, activeVi, firstWrite, firstViWrite);
+            t.Equals(activeFlags | activeVf | activeVi, 0u,
+                     "all four incoming timestamp slots must retire once");
+            t.Equals(state.mac, 4u, "chronological MAC retirement must retain the last event");
+            t.Equals(state.clip, 4u, "chronological CLIP retirement must retain the last event");
+            t.Equals(state.status, 0x1c4u, "all retired flag sticky bits must accumulate");
+            t.Equals(state.vf[1][0], 0.0f, "a write before incoming readiness must cancel its lane");
+            t.Equals(state.vf[1][1], 7.0f, "an equal-cycle write must retain incoming visibility");
+            t.Equals(state.vi[1], -32768, "equal-cycle VI visibility must sign-truncate");
+        });
+        tc.Run("static regions preserve pending writes and exact budget boundaries", [](TestCase &t)
+        {
+            for (unsigned scenario = 0; scenario < 3; ++scenario)
+                for (unsigned budget : {3u, 4u, 5u})
+                {
+                    Vu1Fixture fx;
+                    t.IsTrue(fx.initialize(), "VU1 fixture should initialize");
+                    writeVuInstructionPair(fx.code, 0u, 0x8000033cu, makeVuUpper(0x28u, 0xfu, 3u, 2u, 1u));
+                    for (unsigned pair = 1; pair <= 4; ++pair)
+                        writeVuInstructionPair(fx.code, pair * 8u, 0x8000033cu, kVuUpperNop);
+                    const uint32_t upper = scenario == 2u
+                        ? makeVuUpper(0x28u, 0xfu, 3u, 1u, 6u)
+                        : makeVuUpper(0x28u, 0xfu, 5u, 4u, 1u);
+                    writeVuInstructionPair(fx.code, scenario == 0u ? 16u : 32u, 0x8000033cu, upper);
+                    VU1Interpreter native, oracle;
+                    oracle.setCompiledExecutionEnabled(false);
+                    for (unsigned reg = 0; reg < 7; ++reg)
+                        for (unsigned lane = 0; lane < 4; ++lane)
+                            native.state().vf[reg][lane] = reg == 1u ? 11.0f : static_cast<float>(reg);
+                    oracle.state() = native.state();
+                    for (auto *vu : {&native, &oracle})
+                        vu->execute(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                                    fx.gs, &fx.mem, 0u, 0u, 0u, 1u);
+                    const uint64_t accepted = ps2_vu_detail::regionCounters.accepted[1];
+                    native.resume(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                                  fx.gs, &fx.mem, 0u, 0u, budget);
+                    oracle.resume(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                                  fx.gs, &fx.mem, 0u, 0u, budget);
+                    t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                             "native region must publish the same visible state at the requested budget");
+                    if (std::getenv("PS2_VU_REQUIRE_REGIONS"))
+                        t.Equals(ps2_vu_detail::regionCounters.accepted[1] - accepted,
+                                 budget >= 4u ? uint64_t{4u} : uint64_t{0u},
+                                 "the native fixture must force the region path only when the complete budget fits");
+                    for (unsigned tail = 0; tail < 5; ++tail)
+                    {
+                        native.resume(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                                      fx.gs, &fx.mem, 0u, 0u, 1u);
+                        oracle.resume(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                                      fx.gs, &fx.mem, 0u, 0u, 1u);
+                        t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                 "every outgoing pending-write boundary must remain identical");
+                    }
+                }
+        });
+        tc.Run("static regions preserve LSU forwarding and following branch backups", [](TestCase &t)
+        {
+            for (unsigned budget : {3u, 4u, 5u})
+            {
+                Vu1Fixture nativeMemory, oracleMemory;
+                t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "VU1 fixtures should initialize");
+                for (auto *fx : {&nativeMemory, &oracleMemory})
+                {
+                    writeVuInstructionPair(fx->code, 0u, makeVuIlw(8u, 1u, 0u, 0), kVuUpperNop);
+                    writeVuInstructionPair(fx->code, 8u, makeVuIaddiu(1u, 0u, 7), kVuUpperNop);
+                    writeVuInstructionPair(fx->code, 16u, makeVuLq(15u, 6u, 0u, 1), kVuUpperNop);
+                    writeVuInstructionPair(fx->code, 24u, makeVuSq(15u, 2u, 0u, 2), makeVuUpper(0x28u, 15u, 5u, 4u, 9u));
+                    writeVuInstructionPair(fx->code, 32u, makeVuIaddiu(1u, 1u, 1), kVuUpperNop);
+                    writeVuInstructionPair(fx->code, 40u, makeVuIbne(1u, 2u, 2), kVuUpperNop);
+                    const uint32_t loadedVi = 5u;
+                    std::memcpy(fx->data, &loadedVi, sizeof(loadedVi));
+                    const float loadedVf[4] = {13.0f, 17.0f, 19.0f, 23.0f};
+                    writeVuQword(fx->data, 1u, loadedVf);
+                }
+                VU1Interpreter native, oracle;
+                oracle.setCompiledExecutionEnabled(false);
+                for (unsigned reg = 1; reg < 10; ++reg)
+                    for (unsigned lane = 0; lane < 4; ++lane)
+                        native.state().vf[reg][lane] = static_cast<float>(reg * 4u + lane);
+                native.state().vi[1] = 11;
+                native.state().vi[2] = 7;
+                oracle.state() = native.state();
+                native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                               nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, 1u);
+                oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                               oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, 1u);
+                const uint64_t accepted = ps2_vu_detail::regionCounters.accepted[1];
+                for (unsigned step = 0; step < 7; ++step)
+                {
+                    const unsigned cycles = step == 0u ? budget : 1u;
+                    native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                  nativeMemory.gs, &nativeMemory.mem, 0u, 0u, cycles);
+                    oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                  oracleMemory.gs, &oracleMemory.mem, 0u, 0u, cycles);
+                    t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                             "LSU and branch state must match at every resumed boundary");
+                    t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                             "region stores must preserve data memory ordering");
+                    if (step == 0u && std::getenv("PS2_VU_REQUIRE_REGIONS"))
+                        t.Equals(ps2_vu_detail::regionCounters.accepted[1] - accepted,
+                                 budget >= 4u ? uint64_t{4u} : uint64_t{0u}, "LSU fixture must force the fast path");
+                }
+            }
+        });
+        tc.Run("static regions preserve accumulator and flag history", [](TestCase &t)
+        {
+            for (unsigned budget : {3u, 4u, 5u})
+            {
+                Vu1Fixture fx;
+                t.IsTrue(fx.initialize(), "VU1 fixture should initialize");
+                writeVuInstructionPair(fx.code, 0u, makeVuFlagImmediate(0x15u, 0u, 0xac0u), kVuUpperNop);
+                writeVuInstructionPair(fx.code, 8u, (0x11u << 25u) | 0x123456u, kVuUpperNop);
+                writeVuInstructionPair(fx.code, 16u, 0x8000033cu, makeVuUpperSpecial(0x2au, 15u, 3u, 2u));
+                writeVuInstructionPair(fx.code, 24u, 0x8000033cu, makeVuUpper(0x29u, 15u, 5u, 4u, 6u));
+                writeVuInstructionPair(fx.code, 32u, 0x8000033cu, makeVuUpperSpecial(0x1fu, 15u, 8u, 7u));
+                writeVuInstructionPair(fx.code, 40u, 0x8000033cu, makeVuUpperSpecial(0x1fu, 15u, 7u, 8u));
+                VU1Interpreter native, oracle;
+                oracle.setCompiledExecutionEnabled(false);
+                for (unsigned reg = 1; reg < 9; ++reg)
+                    for (unsigned lane = 0; lane < 4; ++lane)
+                        native.state().vf[reg][lane] = static_cast<float>(reg * (lane + 1u));
+                native.state().vf[7][0] = -40.0f;
+                native.state().vf[8][2] = 80.0f;
+                native.state().status = 0x30u;
+                oracle.state() = native.state();
+                for (auto *vu : {&native, &oracle})
+                    vu->execute(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                                fx.gs, &fx.mem, 0u, 0u, 0u, 2u);
+                const uint64_t accepted = ps2_vu_detail::regionCounters.accepted[1];
+                for (unsigned step = 0; step < 7; ++step)
+                {
+                    for (auto *vu : {&native, &oracle})
+                        vu->resume(fx.code, PS2_VU1_CODE_SIZE, fx.data, PS2_VU1_DATA_SIZE,
+                                   fx.gs, &fx.mem, 0u, 0u, step == 0u ? budget : 1u);
+                    t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                             "ACC forwarding and chronological MAC/STATUS/CLIP must match");
+                    if (step == 0u && std::getenv("PS2_VU_REQUIRE_REGIONS"))
+                        t.Equals(ps2_vu_detail::regionCounters.accepted[1] - accepted,
+                                 budget >= 4u ? uint64_t{4u} : uint64_t{0u}, "flag fixture must force the fast path");
+                }
+            }
+        });
+        tc.Run("static SSA regions retain stalled dependencies and deferred tails", [](TestCase &t)
+        {
+            for (unsigned budget : {12u, 13u, 14u})
+            {
+                Vu1Fixture nativeMemory, oracleMemory;
+                t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "VU1 fixtures should initialize");
+                for (auto *fx : {&nativeMemory, &oracleMemory})
+                {
+                    writeVuInstructionPair(fx->code, 0u, makeVuFlagImmediate(0x15u, 0u, 0xac0u), kVuUpperNop);
+                    writeVuInstructionPair(fx->code, 8u, (0x11u << 25u) | 0x123456u, kVuUpperNop);
+                    writeVuInstructionPair(fx->code, 16u, makeVuIaddiu(1u, 0u, 7), makeVuUpperSpecial(0x2au, 15u, 3u, 2u));
+                    writeVuInstructionPair(fx->code, 24u, makeVuSq(15u, 2u, 0u, 1), makeVuUpper(0x29u, 15u, 5u, 4u, 6u));
+                    writeVuInstructionPair(fx->code, 32u, makeVuLowerSpecial(0x34u, 2u, 8u, 0u, 4u), makeVuUpper(0x28u, 8u, 3u, 2u, 8u));
+                    writeVuInstructionPair(fx->code, 40u, makeVuLq(15u, 12u, 0u, 1), makeVuUpper(0x28u, 8u, 5u, 4u, 6u));
+                    writeVuInstructionPair(fx->code, 48u, 0x8000033cu, makeVuUpper(0x29u, 15u, 6u, 4u, 9u));
+                    writeVuInstructionPair(fx->code, 56u, 0x8000033cu, makeVuUpper(0x28u, 15u, 7u, 8u, 10u));
+                    writeVuInstructionPair(fx->code, 64u, makeVuIlw(8u, 3u, 0u, 1), makeVuUpperSpecial(0x1fu, 15u, 8u, 7u));
+                    writeVuInstructionPair(fx->code, 72u, makeVuIaddiu(1u, 1u, 1), makeVuUpper(0x28u, 15u, 9u, 10u, 11u));
+                    writeVuInstructionPair(fx->code, 80u, makeVuIbne(1u, 4u, 2), kVuUpperNop);
+                }
+                VU1Interpreter native, oracle;
+                oracle.setCompiledExecutionEnabled(false);
+                for (unsigned reg = 1; reg < 14; ++reg)
+                    for (unsigned lane = 0; lane < 4; ++lane)
+                        native.state().vf[reg][lane] = static_cast<float>(reg * (lane + 1u));
+                native.state().vi[1] = 11;
+                native.state().vi[2] = 1;
+                native.state().vi[4] = 7;
+                oracle.state() = native.state();
+                native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                               nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, 2u);
+                oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                               oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, 2u);
+                const uint64_t accepted = ps2_vu_detail::regionCounters.accepted[1];
+                for (unsigned step = 0; step < 10; ++step)
+                {
+                    const unsigned cycles = step == 0u ? budget : 1u;
+                    native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                  nativeMemory.gs, &nativeMemory.mem, 0u, 0u, cycles);
+                    oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                  oracleMemory.gs, &oracleMemory.mem, 0u, 0u, cycles);
+                    t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                             "SSA forwarding, stalls, canceled lanes and pending flags must survive each boundary");
+                    t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                             "SSA store/load ordering must match the raw interpreter");
+                    if (step == 0u && std::getenv("PS2_VU_REQUIRE_REGIONS"))
+                        t.Equals(ps2_vu_detail::regionCounters.accepted[1] - accepted,
+                                 budget >= 13u ? uint64_t{8u} : uint64_t{4u},
+                                 "the whole region must run when it fits; a shorter budget uses the shared four-pair entry");
+                }
+            }
+        });
+        tc.Run("static SSA LOI retains old I operands and publishes normalized immediates", [](TestCase &t)
+        {
+            for (unsigned phase = 0u; phase < 8u; ++phase)
+                for (unsigned budget : {1u, 3u, 4u, 7u, 8u, 9u})
+                {
+                    Vu1Fixture nativeMemory, oracleMemory;
+                    t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "VU1 fixtures should initialize");
+                    const uint32_t upper[] = {
+                        makeVuUpper(0x22u, 15u, 0u, 1u, 3u) | 0x80000000u,
+                        makeVuUpper(0x1eu, 15u, 0u, 2u, 4u),
+                        makeVuUpper(0x1eu, 15u, 0u, 1u, 5u) | 0x80000000u,
+                        makeVuUpper(0x22u, 15u, 0u, 2u, 6u) | 0x80000000u,
+                        makeVuUpper(0x22u, 15u, 0u, 1u, 7u),
+                        kVuUpperNop | 0x80000000u,
+                        makeVuUpper(0x1eu, 15u, 0u, 2u, 8u),
+                        makeVuUpper(0x1eu, 15u, 0u, 1u, 9u) | 0x80000000u};
+                    const uint32_t lower[] = {0x40e00000u, 0x8000033cu, 0xffc12345u,
+                        0x80000001u, 0x8000033cu, 0x3f000000u, 0x8000033cu, 0x7f800000u};
+                    for (auto *fx : {&nativeMemory, &oracleMemory})
+                    {
+                        for (unsigned index = 0u; index < phase + 18u; ++index)
+                            writeVuInstructionPair(fx->code, index * 8u, 0x8000033cu, kVuUpperNop);
+                        for (unsigned index = 0u; index < 8u; ++index)
+                            writeVuInstructionPair(fx->code, (phase + index) * 8u, lower[index], upper[index]);
+                    }
+                    VU1Interpreter native, oracle;
+                    native.setCompiledExecutionEnabled(false);
+                    oracle.setCompiledExecutionEnabled(false);
+                    native.state().i = 3.5f;
+                    for (unsigned lane = 0u; lane < 4u; ++lane)
+                    {
+                        native.state().vf[1][lane] = static_cast<float>(lane + 1u);
+                        native.state().vf[2][lane] = -static_cast<float>(lane + 2u);
+                    }
+                    oracle.state() = native.state();
+                    if (phase != 0u)
+                    {
+                        native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                            nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, phase);
+                        oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                            oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, phase);
+                    }
+                    native.setCompiledExecutionEnabled(true);
+                    const uint64_t accepted = ps2_vu_detail::regionCounters.accepted[1];
+                    for (unsigned step = 0u; step < 9u; ++step)
+                    {
+                        if (step != 0u)
+                            native.setCompiledExecutionEnabled(false);
+                        const unsigned cycles = step == 0u ? budget : 1u;
+                        native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                            nativeMemory.gs, &nativeMemory.mem, 0u, 0u, cycles);
+                        oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                            oracleMemory.gs, &oracleMemory.mem, 0u, 0u, cycles);
+                        t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                            "old I operands, normalization and delayed flags must match at every boundary");
+                        t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                            "LOI bits must not execute as a lower instruction");
+                        if (step == 0u && std::getenv("PS2_VU_REQUIRE_REGIONS"))
+                            t.Equals(ps2_vu_detail::regionCounters.accepted[1] - accepted,
+                                budget >= 8u ? uint64_t{8u} : (budget >= 4u ? uint64_t{4u} : uint64_t{0u}),
+                                "LOI fixture must force the longest fitting native SSA region");
+                    }
+                }
+        });
         tc.Run("upper ADD applies the destination mask", [](TestCase &t)
         {
             Vu1Fixture fx;
@@ -1225,6 +1534,64 @@ void register_ps2_vu1_tests()
             t.Equals(vu1.state().vi[1], 2, "second MSCAL should see the MPG-updated instruction");
         });
 
+        tc.Run("late code edits invalidate every overlapping native region", [](TestCase &t)
+        {
+            for (unsigned length : {4u, 8u, 12u, 16u})
+                for (unsigned offset = 0u; offset < length; ++offset)
+                    for (bool atCodeEnd : {false, true})
+                    {
+                        Vu1Fixture nativeMemory, oracleMemory;
+                        t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "VU1 fixtures should initialize");
+                        const uint32_t start = atCodeEnd ? PS2_VU1_CODE_SIZE - length * 8u : 0u;
+                        for (auto *fx : {&nativeMemory, &oracleMemory})
+                        {
+                            for (unsigned pc = 0u; pc < PS2_VU1_CODE_SIZE; pc += 8u)
+                                writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                            for (unsigned index = 0u; index < length; ++index)
+                                fx->mem.write64(PS2_VU1_CODE_BASE + start + index * 8u,
+                                    packVuInstructionPair(makeVuIaddiu(1u, 0u, index + 1u), kVuUpperNop));
+                        }
+                        VU1Interpreter native, oracle;
+                        oracle.setCompiledExecutionEnabled(false);
+                        const auto accepted = [&] { return ps2_vu_detail::regionCounters.acceptedByLength[length][1]; };
+                        const uint64_t warm = accepted();
+                        native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                            nativeMemory.gs, &nativeMemory.mem, start, 0u, 0u, length);
+                        oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                            oracleMemory.gs, &oracleMemory.mem, start, 0u, 0u, length);
+                        if (std::getenv("PS2_VU_REQUIRE_REGIONS"))
+                            t.Equals(accepted() - warm, uint64_t{length}, "the complete original region must be cached and executed");
+                        for (bool restore : {false, true})
+                        {
+                            const uint32_t lower = restore ? makeVuIaddiu(1u, 0u, offset + 1u) : makeVuIaddiu(2u, 0u, 777u);
+                            for (auto *fx : {&nativeMemory, &oracleMemory})
+                                fx->mem.write64(PS2_VU1_CODE_BASE + start + offset * 8u,
+                                    packVuInstructionPair(lower, kVuUpperNop));
+                            native.state().pc = oracle.state().pc = start;
+                            const uint64_t before = accepted();
+                            native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                nativeMemory.gs, &nativeMemory.mem, 0u, 0u, length);
+                            oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                oracleMemory.gs, &oracleMemory.mem, 0u, 0u, length);
+                            t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                "late edits and restored long regions must match raw interpretation across resume");
+                            t.Equals(native.state().vi[2], 777, "the replacement instruction must execute");
+                            if (std::getenv("PS2_VU_REQUIRE_REGIONS"))
+                                t.Equals(accepted() - before, restore ? uint64_t{length} : uint64_t{0},
+                                    "a late edit must replace a cached long match; restoration must select it again");
+                        }
+                        native.setCompiledExecutionEnabled(false);
+                        for (unsigned tail = 0u; tail < 8u; ++tail)
+                        {
+                            native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 1u);
+                            oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 1u);
+                            t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                "replacement state must survive one-cycle raw continuation");
+                        }
+                    }
+        });
         tc.Run("direct VU1 code writes invalidate cached decode", [](TestCase &t)
         {
             Vu1Fixture fx;
diff --git a/ps2xTest/src/ps2_vu1_upper_engine_tests.cpp b/ps2xTest/src/ps2_vu1_upper_engine_tests.cpp
new file mode 100644
index 000000000..eebd69dcd
--- /dev/null
+++ b/ps2xTest/src/ps2_vu1_upper_engine_tests.cpp
@@ -0,0 +1,179 @@
+#include "MiniTest.h"
+#include "runtime/gs/gs_frontend.h"
+#include "runtime/ps2_memory.h"
+#include "runtime/ps2_vu1.h"
+#include "../../ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h"
+
+#include <array>
+#include <cfenv>
+#include <cstdio>
+#include <cstring>
+#include <limits>
+
+namespace {
+
+struct EngineInputs {
+    const VU1State &state;
+    unsigned source, target;
+    bool fast;
+    float fs(unsigned lane) const { return state.vf[source][lane]; }
+    float ft(unsigned lane) const { return state.vf[target][lane]; }
+    float acc(unsigned lane) const { return state.acc[lane]; }
+    float i() const { return state.i; }
+    float q() const { return state.q; }
+    bool compiledFastPath() const { return fast; }
+};
+
+struct EngineSink {
+    VU1State &state;
+    unsigned fmacCalls = 0u, clipCalls = 0u, vfCalls = 0u, accCalls = 0u, reservedCalls = 0u;
+    static void write(float *out, uint8_t mask, const float *values) {
+        for (unsigned lane = 0; lane < 4u; ++lane)
+            if (mask & (8u >> lane)) out[lane] = values[lane];
+    }
+    void vf(uint8_t reg, uint8_t mask, const float *values) {
+        ++vfCalls;
+        write(state.vf[reg], mask, values);
+    }
+    void acc(uint8_t mask, const float *values) {
+        ++accCalls;
+        write(state.acc, mask, values);
+    }
+    void fmac(uint32_t mac, uint32_t status, uint32_t extraSticky) {
+        ++fmacCalls;
+        state.mac = mac;
+        state.status = (state.status & 0xff0u) | (status & 15u) |
+                       (((status & 15u) | extraSticky) << 6u);
+    }
+    void clip(uint32_t sixBits) {
+        ++clipCalls;
+        state.clip = ((state.clip << 6u) | (sixBits & 63u)) & 0xffffffu;
+    }
+    void reserved(uint32_t) { ++reservedCalls; }
+};
+
+float rawFloat(uint32_t bits) {
+    float value;
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
+VU1State initialState(unsigned seed) {
+    constexpr uint32_t values[] = {
+        0u, 0x80000000u, 1u, 0x807fffffu, 0x00800000u, 0x80800001u,
+        0x3f800000u, 0xbf800000u, 0x3f000000u, 0xbf7fffffu,
+        0x7f7fffffu, 0xff7fffffu, 0x7f800000u, 0xff800000u,
+        0x7fc12345u, 0xffc12345u, 0x4f000000u, 0xcf000000u,
+        0x00800001u, 0x3eaaaaabu, 0x7f000000u, 0x00400000u
+    };
+    VU1State state{};
+    for (unsigned reg = 1u; reg < 32u; ++reg)
+        for (unsigned lane = 0; lane < 4u; ++lane)
+            state.vf[reg][lane] = rawFloat(values[(seed * 5u + reg * 3u + lane * 7u) % std::size(values)]);
+    state.vf[0][3] = 1.0f;
+    for (unsigned lane = 0; lane < 4u; ++lane)
+        state.acc[lane] = rawFloat(values[(seed * 7u + lane * 3u) % std::size(values)]);
+    state.i = rawFloat(values[(seed * 3u + 6u) % std::size(values)]);
+    state.q = rawFloat(values[(seed * 5u + 7u) % std::size(values)]);
+    if (seed == 6u) {
+        const float left[] = {1.0f, -1.0f, std::numeric_limits<float>::min(), -std::numeric_limits<float>::min()};
+        const float right[] = {1.0f, -1.0f, 2.0f, -2.0f};
+        std::memcpy(state.vf[1], left, sizeof(left));
+        std::memcpy(state.vf[2], right, sizeof(right));
+        for (unsigned lane = 0; lane < 4u; ++lane)
+            state.acc[lane] = -(left[lane] * right[lane]);
+    }
+    state.mac = 0x1357u;
+    state.status = 0xa50u;
+    state.clip = 0x36c9a5u;
+    return state;
+}
+
+bool equalOutputs(const VU1State &a, const VU1State &b) {
+    return std::memcmp(a.vf, b.vf, sizeof(a.vf)) == 0 &&
+           std::memcmp(a.acc, b.acc, sizeof(a.acc)) == 0 &&
+           a.mac == b.mac && a.status == b.status && a.clip == b.clip;
+}
+
+} // namespace
+
+void register_ps2_vu1_upper_engine_tests() {
+    MiniTest::Case("PS2VU1UpperEngine", [](TestCase &tc) {
+        tc.Run("private arithmetic matches raw scalar execution for all upper opcodes", [](TestCase &t) {
+            PS2Memory memory;
+            t.IsTrue(memory.initialize(), "memory initializes");
+            GS gs;
+            gs.init(memory.getGSVRAM(), static_cast<uint32_t>(PS2_GS_VRAM_SIZE), &memory.gs());
+            constexpr uint32_t nop = 0x2ffu;
+            std::array<uint32_t, 8> code{0u, nop, 0u, nop, 0u, nop, 0u, nop};
+            const int oldRounding = std::fegetround();
+            struct RestoreRounding { int mode; ~RestoreRounding() { std::fesetround(mode); } } restore{oldRounding};
+            std::fesetround(FE_TOWARDZERO);
+            unsigned comparisons = 0u;
+            for (unsigned special = 0; special < 2u; ++special) {
+                for (unsigned op = 0; op < (special ? 0x31u : 0x30u); ++op) {
+                    if (special && op == 0x2bu) continue;
+                    for (unsigned mask = 0; mask < 16u; ++mask) {
+                        for (unsigned seed = 0; seed < 8u; ++seed) {
+                            for (unsigned alias = 0; alias < 4u; ++alias) {
+                                const unsigned fs = 1u;
+                                const unsigned ft = special && alias == 1u ? 1u : special && alias == 3u ? 0u : 2u;
+                                const unsigned fd = alias == 0u ? 3u : alias == 1u ? fs : alias == 2u ? ft : 0u;
+                                const uint32_t instr = (mask << 21u) | (ft << 16u) | (fs << 11u) |
+                                    (special ? ((op & 0x7cu) << 4u) | (op & 3u) | 0x3cu : (fd << 6u) | op);
+                                code[1] = instr;
+                                const VU1State initial = initialState(seed);
+                                VU1Interpreter oracle;
+                                oracle.setCompiledExecutionEnabled(false);
+                                oracle.state() = initial;
+                                oracle.execute(reinterpret_cast<uint8_t *>(code.data()), sizeof(code),
+                                    memory.getVU1Data(), PS2_VU1_DATA_SIZE, gs, &memory, 0u, 0u, 0u, 4u);
+                                for (bool fast : {false, true}) {
+                                    VU1State output = initial;
+                                    EngineInputs inputs{output, fs, ft, fast};
+                                    EngineSink sink{output};
+                                    ps2_vu_detail::upper::computeUpper(instr, inputs, sink);
+                                    output.vf[0][0] = output.vf[0][1] = output.vf[0][2] = 0.0f;
+                                    output.vf[0][3] = 1.0f;
+                                    if (sink.reservedCalls || !equalOutputs(output, oracle.state())) {
+                                        char message[180];
+                                        std::snprintf(message, sizeof(message),
+                                            "opcode=%08x seed=%u alias=%u fast=%u mac=%x/%x status=%x/%x clip=%x/%x",
+                                            instr, seed, alias, fast, output.mac, oracle.state().mac,
+                                            output.status, oracle.state().status, output.clip, oracle.state().clip);
+                                        t.Fail(message);
+                                        return;
+                                    }
+                                    if (mask == 0u && sink.fmacCalls != 0u) {
+                                        t.Fail("an empty destination must not publish FMAC flags");
+                                        return;
+                                    }
+                                    ++comparisons;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            t.Equals(comparisons, 98304u, "all opcode/mask/operand/alias/fast-path cases ran");
+        });
+        tc.Run("NOP has no operand reads or publication", [](TestCase &t) {
+            struct Inputs {
+                mutable unsigned reads = 0u;
+                float fs(unsigned) const { ++reads; return 0.0f; }
+                float ft(unsigned) const { ++reads; return 0.0f; }
+                float acc(unsigned) const { ++reads; return 0.0f; }
+                float i() const { ++reads; return 0.0f; }
+                float q() const { ++reads; return 0.0f; }
+                bool compiledFastPath() const { ++reads; return true; }
+            } inputs;
+            VU1State state{};
+            EngineSink sink{state};
+            ps2_vu_detail::upper::computeUpper(0x2ffu, inputs, sink);
+            ps2_vu_detail::upper::computeUpper(0x33cu, inputs, sink);
+            t.Equals(inputs.reads, 0u, "both NOP encodings leave operands unread");
+            t.Equals(sink.vfCalls + sink.accCalls + sink.fmacCalls + sink.clipCalls + sink.reservedCalls,
+                     0u, "NOP does not publish a result");
+        });
+    });
+}
diff --git a/tools/compile_vu_blocks.py b/tools/compile_vu_blocks.py
index abfa77204..5c74fbbf2 100644
--- a/tools/compile_vu_blocks.py
+++ b/tools/compile_vu_blocks.py
@@ -10,10 +10,11 @@ def read_blocks(paths, parser):
     blocks = set()
     for path in paths:
         data = path.read_bytes()
-        if data.startswith(b"VU-BLOCKS 1\n"):
+        if data.startswith((b"VU-BLOCKS 1\n", b"VU-BLOCKS 2\n")):
+            extended = data.startswith(b"VU-BLOCKS 2\n")
             for line in data.decode("ascii").splitlines()[1:]:
                 fields = line.split()
-                if len(fields) != 5:
+                if len(fields) not in ((5, 9, 13, 17) if extended else (5,)):
                     parser.error(f"{path}: invalid block profile record")
                 try:
                     unit = int(fields[0])
@@ -68,7 +69,7 @@ def main():
         args.output.with_name(f"{args.output.stem}_extern.inc").write_text("\n".join(externs) + "\n")
         for index, source in enumerate(shards):
             args.output.with_name(f"{args.output.stem}_{index}.cpp").write_text("\n".join(source) + "\n")
-    print(f"Compiled VU input: {len(blocks)} four-pair blocks, {len(pairs)} individual pairs")
+    print(f"Compiled VU input: {len(blocks)} native blocks, {len(pairs)} individual pairs")
 
 
 if __name__ == "__main__":
diff --git a/tools/tests/test_compile_vu_blocks.py b/tools/tests/test_compile_vu_blocks.py
index 7e81ab5e1..00c1f73a8 100644
--- a/tools/tests/test_compile_vu_blocks.py
+++ b/tools/tests/test_compile_vu_blocks.py
@@ -29,7 +29,7 @@ def generate(name, shards, inputs):
             expected = {(unit, words) for unit, words in re.findall(
                 r"&runCompiledBlock<Unit::VU([01]), ([^>]+)>", registry)}
             self.assertEqual(len(expected), 12)  # Three blocks and nine unit-specific pairs.
-            for count in (1, 3, 8):
+            for count in (1, 3, 8, 32):
                 output = generate(f"shards-{count}", count, [second, first, second])
                 self.assertEqual(output.read_text(), registry)
                 sources = sorted(output.parent.glob("blocks_*.cpp"))
@@ -51,6 +51,38 @@ def generate(name, shards, inputs):
                 for source in output.parent.iterdir():
                     self.assertEqual(source.read_bytes(), (repeated.parent / source.name).read_bytes())
 
+    def test_extended_profiles_preserve_lengths_and_unit(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            profile, output = root / "regions.profile", root / "blocks.inc"
+            records = [f"{unit} " + " ".join(f"{word:x}" for word in range(1, length + 1))
+                       for unit in (0, 1) for length in (4, 8, 12, 16)]
+            profile.write_text("VU-BLOCKS 2\n" + "\n".join(records) + "\n")
+            script = Path(__file__).resolve().parents[1] / "compile_vu_blocks.py"
+            subprocess.run([sys.executable, str(script), "--output", str(output),
+                            "--shards", "32", "--", str(profile)],
+                           check=True, capture_output=True, text=True)
+            entries = re.findall(r"&runCompiledBlock<Unit::VU([01]), ([^>]+)>, (\d+)u", output.read_text())
+            self.assertEqual(len(entries), 40)  # Eight regions plus sixteen pairs per unit.
+            for unit in ("0", "1"):
+                self.assertEqual(sorted(int(size) for entry_unit, _, size in entries if entry_unit == unit),
+                                 [8] * 16 + [32, 64, 96, 128])
+            for _, words, size in entries:
+                self.assertEqual(len(words.split(", ")) * 8, int(size))
+
+    def test_profile_length_and_word_bounds_are_rejected(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            profile, output = root / "invalid.profile", root / "blocks.inc"
+            script = Path(__file__).resolve().parents[1] / "compile_vu_blocks.py"
+            for header, words in [(1, "1 2 3 4 5 6 7 8"), (2, "1 2 3 4 5"),
+                                  (2, "1 2 3 10000000000000000"), (2, "1 2 3 -1")]:
+                profile.write_text(f"VU-BLOCKS {header}\n1 {words}\n")
+                result = subprocess.run([sys.executable, str(script), "--output", str(output),
+                                         "--", str(profile)], capture_output=True, text=True)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertIn("invalid", result.stderr)
+
 
 if __name__ == "__main__":
     unittest.main()

From e68d340b4d6cc80ceab0c6fd3b36078b97caf6b7 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 21 Sep 2026 23:23:29 +0200
Subject: [PATCH 52/68] Compile VU branch and flag regions with retained
 bounded loops

---
 ps2xRuntime/CMakeLists.txt                    |   6 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl       |  11 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_fmac_flags.h   |  48 +
 ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h    |  51 +
 ps2xRuntime/src/lib/vu/ps2_vu1_loop_exec.inl  | 343 +++++++
 ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h    | 156 +++
 ps2xRuntime/src/lib/vu/ps2_vu1_region.h       |   4 +-
 .../src/lib/vu/ps2_vu1_region_exec.inl        |  60 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_region_lower.h |   4 +
 ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h  |  40 +-
 .../src/lib/vu/ps2_vu1_region_values.h        |   2 +
 ps2xRuntime/src/lib/vu/ps2_vu1_upper.inl      |  33 +
 ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h |  57 +-
 ps2xTest/data/vu_branch_flags.vublocks        |   5 +
 ps2xTest/data/vu_branch_tails.vublocks        |  17 +
 ps2xTest/data/vu_counted_loop.vublocks        |   5 +
 ps2xTest/data/vu_early_counter_loop.vublocks  |   2 +
 ps2xTest/data/vu_natural_loop.vublocks        |  13 +
 ps2xTest/data/vu_natural_uncounted.vublocks   |   5 +
 ps2xTest/data/vu_static_regions.vublocks      |   1 +
 ps2xTest/src/ps2_vu1_tests.cpp                | 930 ++++++++++++++++++
 ps2xTest/src/ps2_vu1_upper_engine_tests.cpp   | 156 +++
 tools/compile_vu_blocks.py                    |  38 +-
 tools/tests/test_compile_vu_blocks.py         |  89 +-
 24 files changed, 2040 insertions(+), 36 deletions(-)
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_fmac_flags.h
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_loop_exec.inl
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h
 create mode 100644 ps2xTest/data/vu_branch_flags.vublocks
 create mode 100644 ps2xTest/data/vu_branch_tails.vublocks
 create mode 100644 ps2xTest/data/vu_counted_loop.vublocks
 create mode 100644 ps2xTest/data/vu_early_counter_loop.vublocks
 create mode 100644 ps2xTest/data/vu_natural_loop.vublocks
 create mode 100644 ps2xTest/data/vu_natural_uncounted.vublocks

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index 0a99211b5..6ab002c04 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -408,10 +408,11 @@ set_source_files_properties(
 
 set(PS2X_VU_AOT_IMAGES "" CACHE STRING "Local VU code images or block profiles to compile; never distributed")
 set(PS2X_VU_AOT_PAIR_IMAGES "" CACHE STRING "Additional local VU inputs to compile as reusable individual pairs")
+set(PS2X_VU_AOT_LOOP_IMAGES "" CACHE STRING "Local VU code images to scan for bounded conditional loops")
 option(PS2X_VU_AOT_DEBUG_INFO "Include expanded VU AOT debug scopes (slow to compile)" OFF)
 set(PS2X_VU_AOT_SHARDS "32" CACHE STRING "Number of independent VU AOT compilation units")
 set(PS2X_VU_AOT_COMPILE_JOBS "2" CACHE STRING "Maximum concurrent runtime compilations with VU AOT (Ninja)")
-if(PS2X_VU_AOT_IMAGES OR PS2X_VU_AOT_PAIR_IMAGES)
+if(PS2X_VU_AOT_IMAGES OR PS2X_VU_AOT_PAIR_IMAGES OR PS2X_VU_AOT_LOOP_IMAGES)
     find_package(Python3 COMPONENTS Interpreter REQUIRED)
     if(NOT PS2X_VU_AOT_SHARDS MATCHES "^[1-9][0-9]*$")
         message(FATAL_ERROR "PS2X_VU_AOT_SHARDS must be a positive integer")
@@ -436,9 +437,10 @@ if(PS2X_VU_AOT_IMAGES OR PS2X_VU_AOT_PAIR_IMAGES)
         COMMAND "${Python3_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_blocks.py"
                 --output "${PS2X_VU_AOT_INCLUDE}" --shards ${PS2X_VU_AOT_SHARDS}
                 --pair-images ${PS2X_VU_AOT_PAIR_IMAGES}
+                --loop-images ${PS2X_VU_AOT_LOOP_IMAGES}
                 -- ${PS2X_VU_AOT_IMAGES}
         DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_blocks.py"
-                ${PS2X_VU_AOT_IMAGES} ${PS2X_VU_AOT_PAIR_IMAGES}
+                ${PS2X_VU_AOT_IMAGES} ${PS2X_VU_AOT_PAIR_IMAGES} ${PS2X_VU_AOT_LOOP_IMAGES}
         VERBATIM)
     add_custom_target(ps2_vu_aot DEPENDS "${PS2X_VU_AOT_INCLUDE}" "${PS2X_VU_AOT_EXTERN_INCLUDE}" ${PS2X_VU_AOT_SOURCES})
     add_dependencies(ps2_runtime ps2_vu_aot)
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl
index 93015110c..22986bccb 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_exec.inl
@@ -6,8 +6,10 @@
 #include "runtime/gs/gs_frontend.h"
 #include "runtime/ps2_memory.h"
 #include "ps2_vu1_detail.h"
+#include "ps2_vu1_fmac_flags.h"
 #include "ps2_vu1_region.h"
 #include "ps2_vu1_region_plan.h"
+#include "ps2_vu1_loop_plan.h"
 #include "ps2_vu1_region_lower.h"
 #include "ps2_vu1_region_values.h"
 #include "ps2_vu1_upper_engine.h"
@@ -516,7 +518,13 @@ PS2_VU_FORCE_INLINE void VU1Interpreter::updateFmacFlags(const uint8_t laneFlags
 
     uint32_t mac = 0u;
     uint32_t status = 0u;
-    for (uint32_t component = 0; component < 4u; ++component)
+    if (m_useCompiledExecution)
+    {
+        const auto packed = ps2_vu_detail::packFmacFlags(laneFlags, dest);
+        mac = packed.mac;
+        status = packed.status;
+    }
+    else for (uint32_t component = 0; component < 4u; ++component)
     {
         const uint8_t lane = laneForComponent(component);
         if ((dest & lane) == 0u)
@@ -1514,6 +1522,7 @@ bool VU1Interpreter::runCompiledBlock(VU1Interpreter &vu, uint64_t budgetEnd)
 {
     static constexpr std::array decodedRegion = {
         decodeInstructionWords(static_cast<uint32_t>(words), static_cast<uint32_t>(words >> 32u), unit)...};
+#include "ps2_vu1_loop_exec.inl"
 #include "ps2_vu1_region_exec.inl"
     if constexpr (sizeof...(words) > 4u)
     {
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_fmac_flags.h b/ps2xRuntime/src/lib/vu/ps2_vu1_fmac_flags.h
new file mode 100644
index 000000000..a917ffe13
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_fmac_flags.h
@@ -0,0 +1,48 @@
+#ifndef PS2_VU1_FMAC_FLAGS_H
+#define PS2_VU1_FMAC_FLAGS_H
+
+#include "ps2_vu1_detail.h"
+#include <bit>
+#include <cstdint>
+#include <cstring>
+
+namespace ps2_vu_detail {
+
+struct FmacFlagBits {
+    uint32_t mac;
+    uint32_t status;
+};
+
+PS2_VU_FORCE_INLINE FmacFlagBits packFmacFlags(const uint8_t laneFlags[4], uint8_t destination)
+{
+    const uint32_t lanes = destination & 15u;
+    if (std::has_single_bit(lanes))
+    {
+        const uint32_t flags = laneFlags[3u - std::countr_zero(lanes)];
+        const uint32_t spread = (flags & 1u) | ((flags & 2u) << 3u) |
+                                ((flags & 4u) << 6u) | ((flags & 8u) << 9u);
+        return {spread * lanes, flags};
+    }
+    uint32_t bytes;
+    std::memcpy(&bytes, laneFlags, sizeof(bytes));
+    if constexpr (std::endian::native == std::endian::big)
+        bytes = (bytes >> 24u) | ((bytes >> 8u) & 0xff00u) |
+                ((bytes << 8u) & 0xff0000u) | (bytes << 24u);
+    const uint32_t active = ((destination & 8u) ? 0x000000ffu : 0u) |
+                            ((destination & 4u) ? 0x0000ff00u : 0u) |
+                            ((destination & 2u) ? 0x00ff0000u : 0u) |
+                            ((destination & 1u) ? 0xff000000u : 0u);
+    bytes &= active;
+    uint32_t mac = ((bytes & 0x0000000fu) << 12u) | (bytes & 0x00000f00u) |
+                   ((bytes & 0x000f0000u) >> 12u) | ((bytes >> 24u) & 0x0fu);
+    // Transpose four lane nibbles into the four architectural flag groups.
+    uint32_t swap = (mac ^ (mac >> 3u)) & 0x0a0au;
+    mac ^= swap ^ (swap << 3u);
+    swap = (mac ^ (mac >> 6u)) & 0x00ccu;
+    mac ^= swap ^ (swap << 6u);
+    const uint32_t folded = bytes | (bytes >> 16u);
+    return {mac, (folded | (folded >> 8u)) & 0xffu};
+}
+
+}
+#endif
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h b/ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h
index b655228ef..d6d3eefa7 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h
@@ -20,6 +20,57 @@ PS2_VU_FORCE_INLINE float32x4_t normalizeFmacOperands(float32x4_t value)
     return vreinterpretq_f32_u32(vbslq_u32(zero, sign, finite));
 }
 
+enum class SimpleArithmetic { Add, Subtract, Multiply };
+
+template <SimpleArithmetic operation>
+PS2_VU_FORCE_INLINE bool trySimpleArithmeticVector(
+    const float *leftInput, const float *rightInput, uint8_t destination,
+    float *result, uint8_t laneFlags[4])
+{
+    const auto left = normalizeFmacOperands(vld1q_f32(leftInput));
+    const auto right = normalizeFmacOperands(vld1q_f32(rightInput));
+    float32x4_t value;
+    if constexpr (operation == SimpleArithmetic::Add)
+        value = vaddq_f32(left, right);
+    else if constexpr (operation == SimpleArithmetic::Subtract)
+        value = vsubq_f32(left, right);
+    else
+        value = vmulq_f32(left, right);
+    const auto bits = vreinterpretq_u32_f32(value);
+    const auto magnitudeMask = vdupq_n_u32(0x7fffffffu);
+    const auto magnitude = vandq_u32(bits, magnitudeMask);
+    const auto leftBits = vreinterpretq_u32_f32(left);
+    const auto rightBits = vreinterpretq_u32_f32(right);
+    const auto leftZero = vceqq_u32(vandq_u32(leftBits, magnitudeMask), vdupq_n_u32(0u));
+    const auto rightZero = vceqq_u32(vandq_u32(rightBits, magnitudeMask), vdupq_n_u32(0u));
+    uint32x4_t exactZero;
+    if constexpr (operation == SimpleArithmetic::Multiply)
+        exactZero = vorrq_u32(leftZero, rightZero);
+    else
+    {
+        const auto opposing = operation == SimpleArithmetic::Add
+            ? veorq_u32(rightBits, vdupq_n_u32(0x80000000u)) : rightBits;
+        exactZero = vorrq_u32(vandq_u32(leftZero, rightZero), vceqq_u32(leftBits, opposing));
+    }
+    const auto zero = vceqq_u32(magnitude, vdupq_n_u32(0u));
+    const auto normal = vandq_u32(vcgtq_u32(magnitude, vdupq_n_u32(0x00800000u)),
+                                  vcltq_u32(magnitude, vdupq_n_u32(0x7f7fffffu)));
+    const uint32x4_t laneBits = {8u, 4u, 2u, 1u};
+    const auto active = vtstq_u32(vdupq_n_u32(destination), laneBits);
+    // Boundary results retain the scalar exact-result checks, including
+    // tiny exact results rounded to zero/MIN_NORMAL and overflow to FLT_MAX.
+    const auto safe = vorrq_u32(normal, vandq_u32(zero, exactZero));
+    if (vminvq_u32(vorrq_u32(safe, vmvnq_u32(active))) == 0u)
+        return false;
+    const auto flags = vandq_u32(vorrq_u32(vshlq_n_u32(vshrq_n_u32(bits, 31), 1),
+                                          vandq_u32(zero, vdupq_n_u32(1u))), active);
+    const auto packed = vmovn_u16(vcombine_u16(vmovn_u32(flags), vdup_n_u16(0u)));
+    const uint32_t bytes = vget_lane_u32(vreinterpret_u32_u8(packed), 0);
+    std::memcpy(laneFlags, &bytes, sizeof(bytes));
+    vst1q_f32(result, value);
+    return true;
+}
+
 template <bool subtract>
 PS2_VU_FORCE_INLINE bool tryProductSumVector(
     const float *leftInput, const float *rightInput, const float *accInput,
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_loop_exec.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_loop_exec.inl
new file mode 100644
index 000000000..0fa5d4c03
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_loop_exec.inl
@@ -0,0 +1,343 @@
+{
+    static constexpr auto loop = ps2_vu_detail::planCountedLoop(decodedRegion);
+    static constexpr auto plan = loop.body;
+    if constexpr (loop.eligible)
+    {
+        const auto tryLoop = [&]() PS2_VU_INLINE_LAMBDA {
+            uint64_t start = vu.m_cycle;
+            const uint32_t startPC = vu.m_state.pc;
+            uint64_t sequenceBase = vu.m_nextWriteSequence;
+            uint64_t iterations = 0u;
+            bool branchTaken = false, everBranched = false;
+            if (ps2_vu_detail::disableCountedLoops || !ps2_vu_detail::regionBudgetFits(start, budgetEnd, plan.cycles) ||
+                vu.m_state.pc + sizeof...(words) * 8u > vu.m_cachedCodeSize || vu.m_stopRequested ||
+                vu.m_state.branchPending || vu.m_state.ebit || vu.m_state.haltAfterDelaySlot ||
+                vu.m_xgkick.active || vu.m_fdiv.valid || vu.m_activeStores || vu.m_activeAccWrites ||
+                !vu.m_activeVuData || vu.m_activeVuDataSize < 16u)
+                return false;
+            const uint64_t generation = unit == Unit::VU1
+                ? vu.m_activeMemory->getVU1CodeGeneration() : vu.m_activeMemory->getVU0CodeGeneration();
+            if (generation != vu.m_cachedCodeGeneration)
+                return false;
+            for (const auto &entry : vu.m_efu)
+                if (entry.valid)
+                    return false;
+            for (uint32_t active = vu.m_activeFlags; active != 0u; active &= active - 1u)
+                if (vu.m_flagPipeline[std::countr_zero(active)].readyCycle > start + 3u)
+                    return false;
+            const bool ready = [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                return ((vu.calculatePairReadyCycleInline(decodedRegion[indices]) <= start + plan.issue[indices]) && ...);
+            }(std::make_index_sequence<sizeof...(words)>{});
+            if (!ready)
+                return false;
+
+            ps2_vu_detail::retireRegionInputs(vu.m_state, start, vu.m_flagPipeline,
+                vu.m_vfWritePipeline, vu.m_viWritePipeline, vu.m_vfLatestWrite,
+                vu.m_viLatestWrite, vu.m_activeFlags, vu.m_activeVfWrites, vu.m_activeViWrites,
+                plan.firstVfWrite, plan.firstViWrite);
+            static constexpr auto entryReads = [] {
+                struct Reads {
+                    std::array<uint8_t, 33> vf{};
+                    std::array<bool, 16> vi{};
+                } reads;
+                const auto vf = [&](uint16_t source, unsigned lane) {
+                    if (source < 33u)
+                        reads.vf[source] |= static_cast<uint8_t>(1u << lane);
+                };
+                const auto vi = [&](uint16_t source) {
+                    if (source < 16u)
+                        reads.vi[source] = true;
+                };
+                for (const auto &source : plan.sources)
+                {
+                    for (unsigned lane = 0; lane < 4u; ++lane)
+                    {
+                        vf(source.fs[lane], lane);
+                        vf(source.ft[lane], lane);
+                        vf(source.acc[lane], lane);
+                        vf(source.lowerFs[lane], lane);
+                        vf(source.lowerFt[lane], lane);
+                    }
+                    vi(source.viOld);
+                    vi(source.viS);
+                    vi(source.viT);
+                }
+                for (unsigned reg = 0; reg < 32u; ++reg)
+                    for (unsigned lane = 0; lane < 4u; ++lane)
+                        if ((plan.vfVisible[reg][lane] != reg || plan.vfLatest[reg][lane] != 0u))
+                            vf(plan.vfVisible[reg][lane], lane);
+                for (unsigned reg = 0; reg < 16u; ++reg)
+                    if ((plan.viVisible[reg] != reg || plan.viLatest[reg] != 0u))
+                        vi(plan.viVisible[reg]);
+                for (unsigned lane = 0; lane < 4u; ++lane)
+                    if (plan.accVisible[lane] != 32u)
+                        vf(plan.accVisible[lane], lane);
+                return reads;
+            }();
+            std::array<std::array<float, 4>, 33> entryVf;
+            std::array<int32_t, 16> entryVi;
+            // Snapshot every referenced entry operand before byte stores can alias state.
+            [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                (([&]() PS2_VU_INLINE_LAMBDA {
+                    constexpr unsigned reg = indices / 4u, lane = indices % 4u;
+                    if constexpr ((entryReads.vf[reg] & (1u << lane)) != 0u)
+                    {
+                        if constexpr (reg < 32u)
+                            entryVf[reg][lane] = vu.m_state.vf[reg][lane];
+                        else
+                            entryVf[reg][lane] = vu.m_state.acc[lane];
+                    }
+                }()), ...);
+            }(std::make_index_sequence<132u>{});
+            [&]<size_t... regs>(std::index_sequence<regs...>) PS2_VU_INLINE_LAMBDA {
+                (([&]() PS2_VU_INLINE_LAMBDA {
+                    if constexpr (entryReads.vi[regs])
+                        entryVi[regs] = vu.m_state.vi[regs];
+                }()), ...);
+            }(std::make_index_sequence<16u>{});
+            float entryI = vu.m_state.i;
+            const float entryQ = vu.m_state.q;
+            std::array<std::array<float, 4>, sizeof...(words) * 2u> values{};
+            std::array<int32_t, sizeof...(words)> integers{};
+            std::array<ps2_vu_detail::RegionFlag, sizeof...(words)> flags{};
+            uint32_t workingClip = vu.m_workingClip;
+            uint32_t workingMac = vu.m_state.mac, workingStatus = vu.m_state.status;
+            uint32_t visibleClip = vu.m_state.clip;
+            auto *const loopData = vu.m_activeVuData;
+            const uint32_t loopDataSize = vu.m_activeVuDataSize;
+            const auto readVf = [&]<uint16_t source, unsigned lane>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (source == ps2_vu_detail::regionConstantZero)
+                    return lane == 3u ? 1.0f : 0.0f;
+                else if constexpr (source < 32u)
+                {
+                    static_assert((entryReads.vf[source] & (1u << lane)) != 0u);
+                    return entryVf[source][lane];
+                }
+                else if constexpr (source == 32u)
+                {
+                    static_assert((entryReads.vf[32u] & (1u << lane)) != 0u);
+                    return entryVf[32u][lane];
+                }
+                else
+                    return values[source - 33u][lane];
+            };
+            const auto readVi = [&]<uint16_t source>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (source == ps2_vu_detail::regionConstantZero)
+                    return int32_t{0};
+                else if constexpr (source < 16u)
+                {
+                    static_assert(entryReads.vi[source]);
+                    return entryVi[source];
+                }
+                else
+                    return integers[source - 16u];
+            };
+            const auto readI = [&]<uint16_t source>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (source == 0u)
+                    return entryI;
+                else
+                    return ps2_vu_detail::upper::normalizeOperand(
+                        std::bit_cast<float>(decodedRegion[source - 1u].lower));
+            };
+            const auto issue = [&]<size_t index>() PS2_VU_INLINE_LAMBDA {
+                static constexpr auto source = plan.sources[index];
+                float fs[4], ft[4], acc[4], lowerFs[4];
+                [&]<size_t... lanes>(std::index_sequence<lanes...>) PS2_VU_INLINE_LAMBDA {
+                    ((fs[lanes] = readVf.template operator()<source.fs[lanes], lanes>(),
+                      ft[lanes] = readVf.template operator()<source.ft[lanes], lanes>(),
+                      acc[lanes] = readVf.template operator()<source.acc[lanes], lanes>(),
+                      lowerFs[lanes] = readVf.template operator()<source.lowerFs[lanes], lanes>(),
+                      values[index * 2u + 1u][lanes] = readVf.template operator()<source.lowerFt[lanes], lanes>()), ...);
+                }(std::make_index_sequence<4u>{});
+                ps2_vu_detail::RegionUpperInputs input{fs, ft, acc,
+                    readI.template operator()<source.scalarI>(), entryQ};
+                flags[index] = {};
+                ps2_vu_detail::RegionUpperSink sink{values[index * 2u].data(), flags[index], workingClip};
+                ps2_vu_detail::upper::computeUpper(decodedRegion[index].upper, input, sink);
+                integers[index] = readVi.template operator()<source.viOld>();
+                ps2_vu_detail::RegionLowerInputs lowerInput{lowerFs,
+                    readVi.template operator()<source.viS>(), readVi.template operator()<source.viT>()};
+                ps2_vu_detail::RegionLowerSink lowerSink{values[index * 2u + 1u].data(), integers[index]};
+                if constexpr (index == sizeof...(words) - 2u)
+                {
+                    const bool equal = static_cast<int16_t>(readVi.template operator()<loop.branchS>()) ==
+                                       static_cast<int16_t>(readVi.template operator()<loop.branchT>());
+                    branchTaken = (decodedRegion[index].lower >> 25u) == 0x28u ? equal : !equal;
+                }
+                else if constexpr (!decodedRegion[index].iBit)
+                    ps2_vu_detail::computeRegionLower(decodedRegion[index].lower, lowerInput, lowerSink,
+                                                    loopData, loopDataSize);
+            };
+            for (;;)
+            {
+            [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                (issue.template operator()<indices>(), ...);
+            }(std::make_index_sequence<sizeof...(words)>{});
+
+            ++iterations;
+            everBranched |= branchTaken;
+            const uint64_t end = start + plan.cycles;
+            const uint64_t currentGeneration = unit == Unit::VU1
+                ? vu.m_activeMemory->getVU1CodeGeneration() : vu.m_activeMemory->getVU0CodeGeneration();
+            if (branchTaken && ps2_vu_detail::regionBudgetFits(end, budgetEnd, plan.cycles) &&
+                !vu.m_stopRequested && currentGeneration == vu.m_cachedCodeGeneration)
+            {
+                // Prior-iteration flags retire before this iteration can publish any new ones.
+                for (const auto &flag : flags)
+                {
+                    if (flag.fmac)
+                    {
+                        workingMac = flag.mac;
+                        const uint32_t current = flag.status & 15u;
+                        workingStatus = (workingStatus & 0xff0u) | current | ((current | flag.extraSticky) << 6u);
+                    }
+                    if (flag.clip)
+                        visibleClip = flag.clipValue;
+                }
+                [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                    (([&]() PS2_VU_INLINE_LAMBDA {
+                        constexpr unsigned reg = indices / 4u, lane = indices % 4u;
+                        if constexpr ((entryReads.vf[reg] & (1u << lane)) != 0u)
+                        {
+                            if constexpr (reg < 32u)
+                                entryVf[reg][lane] = readVf.template operator()<loop.vfNext[reg][lane], lane>();
+                            else
+                                entryVf[reg][lane] = readVf.template operator()<plan.accVisible[lane], lane>();
+                        }
+                    }()), ...);
+                }(std::make_index_sequence<132u>{});
+                [&]<size_t... regs>(std::index_sequence<regs...>) PS2_VU_INLINE_LAMBDA {
+                    (([&]() PS2_VU_INLINE_LAMBDA {
+                        if constexpr (entryReads.vi[regs])
+                            entryVi[regs] = readVi.template operator()<loop.viNext[regs]>();
+                    }()), ...);
+                }(std::make_index_sequence<16u>{});
+                if constexpr (plan.scalarI != 0u)
+                    entryI = readI.template operator()<plan.scalarI>();
+                sequenceBase += plan.sequences;
+                start = end;
+                continue;
+            }
+            vu.m_state.mac = workingMac;
+            vu.m_state.status = workingStatus;
+            vu.m_state.clip = visibleClip;
+            constexpr unsigned last = sizeof...(words) - 1u;
+            const int32_t branchOld = readVi.template operator()<plan.sources[last].viOld>();
+            const auto publishVf = [&]<size_t reg, size_t lane>() PS2_VU_INLINE_LAMBDA {
+                if constexpr ((plan.vfVisible[reg][lane] != reg || plan.vfLatest[reg][lane] != 0u))
+                    vu.m_state.vf[reg][lane] = readVf.template operator()<plan.vfVisible[reg][lane], lane>();
+                if constexpr (plan.vfLatest[reg][lane] != 0u)
+                {
+                    vu.m_vfReady[reg][lane] = start + plan.vfReady[reg][lane];
+                    vu.m_vfLatestWrite[reg][lane] = sequenceBase + plan.vfLatest[reg][lane];
+                }
+            };
+            [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                (publishVf.template operator()<indices / 4u, indices % 4u>(), ...);
+            }(std::make_index_sequence<128u>{});
+            [&]<size_t... regs>(std::index_sequence<regs...>) PS2_VU_INLINE_LAMBDA {
+                (([&]() PS2_VU_INLINE_LAMBDA {
+                    if constexpr ((plan.viVisible[regs] != regs || plan.viLatest[regs] != 0u))
+                        vu.m_state.vi[regs] = readVi.template operator()<plan.viVisible[regs]>();
+                    if constexpr (plan.viLatest[regs] != 0u)
+                    {
+                        vu.m_viReady[regs] = start + plan.viReady[regs];
+                        vu.m_viLatestWrite[regs] = sequenceBase + plan.viLatest[regs];
+                    }
+                }()), ...);
+            }(std::make_index_sequence<16u>{});
+            [&]<size_t... lanes>(std::index_sequence<lanes...>) PS2_VU_INLINE_LAMBDA {
+                (([&]() PS2_VU_INLINE_LAMBDA {
+                    if constexpr (plan.accVisible[lanes] != 32u)
+                        vu.m_state.acc[lanes] = readVf.template operator()<plan.accVisible[lanes], lanes>();
+                    if constexpr (plan.accReady[lanes] != 0u)
+                        vu.m_accReady[lanes] = start + plan.accReady[lanes];
+                }()), ...);
+            }(std::make_index_sequence<4u>{});
+            const auto pendingVf = [&]<ps2_vu_detail::RegionWrite write>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (write.mask != 0u && write.ready > plan.cycles)
+                {
+                    auto *entry = allocateScheduledEntry(vu.m_vfWritePipeline, vu.m_activeVfWrites, start + write.ready);
+                    *entry = {};
+                    entry->valid = true;
+                    entry->readyCycle = start + write.ready;
+                    entry->sequence = sequenceBase + write.sequence;
+                    entry->reg = write.reg;
+                    entry->laneMask = write.mask;
+                    entry->value = values[write.value - 33u];
+                }
+            };
+            const auto publishTail = [&]<size_t index>() PS2_VU_INLINE_LAMBDA {
+                pendingVf.template operator()<plan.upper[index]>();
+                pendingVf.template operator()<plan.lower[index]>();
+                static constexpr auto viWrite = plan.vi[index];
+                if constexpr (viWrite.mask != 0u && viWrite.ready > plan.cycles)
+                {
+                    auto *entry = allocateScheduledEntry(vu.m_viWritePipeline, vu.m_activeViWrites, start + viWrite.ready);
+                    *entry = {};
+                    entry->valid = true;
+                    entry->readyCycle = start + viWrite.ready;
+                    entry->sequence = sequenceBase + viWrite.sequence;
+                    entry->reg = viWrite.reg;
+                    entry->value = integers[index];
+                }
+                const auto &flag = flags[index];
+                if (flag.fmac || flag.clip)
+                {
+                    if constexpr (plan.issue[index] + 4u <= plan.cycles)
+                    {
+                        if (flag.fmac)
+                        {
+                            vu.m_state.mac = flag.mac;
+                            const uint32_t current = flag.status & 15u;
+                            vu.m_state.status = (vu.m_state.status & 0xff0u) | current | ((current | flag.extraSticky) << 6u);
+                        }
+                        if (flag.clip)
+                            vu.m_state.clip = flag.clipValue;
+                    }
+                    else
+                    {
+                        auto *entry = allocateScheduledEntry(vu.m_flagPipeline, vu.m_activeFlags, start + plan.issue[index] + 4u);
+                        *entry = {};
+                        entry->valid = true;
+                        entry->issueCycle = start + plan.issue[index];
+                        entry->readyCycle = entry->issueCycle + 4u;
+                        entry->mac = flag.mac;
+                        entry->status = flag.status;
+                        entry->extraSticky = flag.extraSticky;
+                        entry->clip = flag.clipValue;
+                        entry->writesMac = entry->writesStatus = flag.fmac;
+                        entry->writesClip = flag.clip;
+                    }
+                }
+            };
+            [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                (publishTail.template operator()<indices>(), ...);
+            }(std::make_index_sequence<sizeof...(words)>{});
+            vu.m_viBranchBackupValid = false;
+            if constexpr (plan.vi[last].mask != 0u && decodedRegion[last].lowerUsage.delaysNextBranchRead)
+                vu.recordViWriteForBranch(plan.vi[last].reg, branchOld);
+            vu.m_nextWriteSequence = sequenceBase + plan.sequences;
+            vu.m_workingClip = workingClip;
+            if constexpr (plan.scalarI != 0u)
+                vu.m_state.i = readI.template operator()<plan.scalarI>();
+            vu.m_currentUpperInstruction = decodedRegion[last].upper;
+            vu.m_cycle = vu.m_state.cycles = end;
+            if (everBranched)
+            {
+                vu.m_state.branchTarget = startPC;
+                vu.m_state.branchDelay = 0u;
+            }
+            vu.m_state.pc = branchTaken ? startPC : startPC + sizeof...(words) * 8u;
+            if (vu.m_state.pc == vu.m_cachedCodeSize)
+                vu.m_state.pc = 0u;
+            vu.m_compiledPairsExecuted += sizeof...(words) * iterations;
+            if (ps2_vu_detail::profileCountedLoops)
+                ps2_vu_detail::countedLoopPairs += sizeof...(words) * iterations;
+            return true;
+            }
+        };
+        if (tryLoop())
+            return false;
+    }
+}
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h b/ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h
new file mode 100644
index 000000000..a2c00f2d0
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h
@@ -0,0 +1,156 @@
+#ifndef PS2_VU1_LOOP_PLAN_H
+#define PS2_VU1_LOOP_PLAN_H
+
+#include "ps2_vu1_region_plan.h"
+#include <cstdlib>
+
+namespace ps2_vu_detail {
+
+inline const bool disableCountedLoops = std::getenv("PS2_VU_DISABLE_COUNTED_LOOPS") != nullptr;
+inline const bool profileCountedLoops = std::getenv("PS2_VU_PROFILE_COUNTED_LOOPS") != nullptr;
+inline thread_local uint64_t countedLoopPairs = 0u;
+
+constexpr bool loopLowerSupported(uint32_t lower)
+{
+    const uint32_t opcode = lower >> 25u, direct = lower & 0x3fu;
+    const uint32_t special = (lower & 3u) | ((lower >> 4u) & 0x7cu);
+    // Loop-carried flag reads need their own timeline before becoming eligible.
+    return lower == 0u || lower == 0x8000033cu || opcode == 0u || opcode == 1u ||
+        opcode == 4u || opcode == 5u || opcode == 8u || opcode == 9u ||
+        (opcode == 0x40u && (direct == 0x30u || direct == 0x31u || direct == 0x32u ||
+            direct == 0x34u || direct == 0x35u ||
+            (direct >= 0x3cu && ((special >= 0x30u && special <= 0x31u) ||
+                               (special >= 0x34u && special <= 0x37u) ||
+                               (special >= 0x3cu && special <= 0x3fu)))));
+}
+
+template <size_t N>
+struct CountedLoopPlan {
+    bool eligible = false;
+    RegionPlan<N> body{};
+    std::array<std::array<uint16_t, 4>, 32> vfNext{};
+    std::array<uint16_t, 16> viNext{};
+    uint16_t branchS{}, branchT{};
+};
+
+template <typename Decoded, size_t N>
+constexpr CountedLoopPlan<N> planCountedLoop(const std::array<Decoded, N> &decoded)
+{
+    CountedLoopPlan<N> loop;
+    if constexpr (N < 4u || N > 16u)
+        return loop;
+    else
+    {
+        constexpr unsigned branchIndex = N - 2u;
+        const uint32_t branch = decoded[branchIndex].lower;
+        const int32_t offset = static_cast<int32_t>(branch << 21u) >> 21u;
+        const uint32_t opcode = branch >> 25u;
+        if (decoded[branchIndex].iBit || (opcode != 0x28u && opcode != 0x29u) ||
+            offset != -static_cast<int32_t>(N - 1u))
+            return loop;
+        const unsigned branchS = (branch >> 11u) & 15u, branchT = (branch >> 16u) & 15u;
+        auto straight = decoded;
+        straight[branchIndex].lower = 0u;
+        straight[branchIndex].lowerUsage = {};
+        const auto supported = planRegion(straight);
+        if (!supported.eligible)
+            return loop;
+        for (unsigned index = 0; index < N; ++index)
+        {
+            if (decoded[index].eBit || decoded[index].mBit ||
+                decoded[index].dBit || decoded[index].tBit)
+                return loop;
+            if (!decoded[index].iBit && index != branchIndex &&
+                !loopLowerSupported(decoded[index].lower))
+                return loop;
+        }
+        loop.body = planRegion(decoded);
+        const auto &plan = loop.body;
+        if (plan.cycles < 4u)
+            return loop;
+        // A pending entry value and the visible entry value share one local phi.
+        // Keep that representation only when the previous iteration's final write
+        // retires before the next write can cancel it. Otherwise the visible old
+        // value must survive independently of the canceled pending value.
+        for (unsigned reg = 0; reg < 32u; ++reg)
+            for (unsigned lane = 0; lane < 4u; ++lane)
+                if (plan.vfReady[reg][lane] > plan.cycles &&
+                    plan.firstVfWrite[reg][lane] < plan.vfReady[reg][lane] - plan.cycles)
+                    return loop;
+        for (unsigned reg = 0; reg < 16u; ++reg)
+            if (plan.viReady[reg] > plan.cycles &&
+                plan.firstViWrite[reg] < plan.viReady[reg] - plan.cycles)
+                return loop;
+        loop.vfNext = plan.vfVisible;
+        loop.viNext = plan.viVisible;
+        for (unsigned index = 0; index < N; ++index)
+        {
+            for (const auto *write : {&plan.upper[index], &plan.lower[index]})
+                if (write->mask != 0u)
+                    for (unsigned lane = 0; lane < 4; ++lane)
+                        if ((write->mask & (8u >> lane)) != 0u &&
+                            write->sequence == plan.vfLatest[write->reg][lane])
+                            loop.vfNext[write->reg][lane] = write->value;
+            const auto &write = plan.vi[index];
+            if (write.mask != 0u && write.sequence == plan.viLatest[write.reg])
+                loop.viNext[write.reg] = write.value;
+        }
+        loop.branchS = plan.sources[branchIndex].viS;
+        loop.branchT = plan.sources[branchIndex].viT;
+        const auto &previous = plan.vi[branchIndex - 1u];
+        if (previous.mask != 0u && decoded[branchIndex - 1u].lowerUsage.delaysNextBranchRead)
+        {
+            if (previous.reg == branchS)
+                loop.branchS = plan.sources[branchIndex - 1u].viOld;
+            if (previous.reg == branchT)
+                loop.branchT = plan.sources[branchIndex - 1u].viOld;
+        }
+        // Entry versions may still be pending, but every use must follow their ready cycle.
+        const auto vfReady = [&](uint16_t source, unsigned lane, unsigned issue) {
+            return source >= 32u || plan.vfReady[source][lane] <= plan.cycles + issue;
+        };
+        const auto viReady = [&](uint16_t source, unsigned issue) {
+            return source >= 16u || plan.viReady[source] <= plan.cycles + issue;
+        };
+        for (unsigned index = 0; index < N; ++index)
+        {
+            const auto &pair = decoded[index];
+            const auto &source = plan.sources[index];
+            for (unsigned lower = 0; lower < 2u; ++lower)
+            {
+                const auto &usage = lower ? pair.lowerUsage : pair.upperUsage;
+                const uint32_t instruction = lower ? pair.lower : pair.upper;
+                const auto &fs = lower ? source.lowerFs : source.fs;
+                const auto &ft = lower ? source.lowerFt : source.ft;
+                for (unsigned readIndex = 0; readIndex < usage.vfReadCount; ++readIndex)
+                {
+                    const auto &read = usage.vfRead[readIndex];
+                    const auto &versions = read.reg == ((instruction >> 11u) & 31u) ? fs : ft;
+                    for (unsigned lane = 0; lane < 4u; ++lane)
+                        if ((read.lanes & (8u >> lane)) != 0u &&
+                            !vfReady(versions[lane], lane, plan.issue[index]))
+                            return loop;
+                }
+            }
+            if (index == branchIndex)
+            {
+                if (!viReady(loop.branchS, plan.issue[index]) || !viReady(loop.branchT, plan.issue[index]))
+                    return loop;
+            }
+            else
+            {
+                const auto reads = pair.lowerUsage.viRead;
+                if (((reads & (1u << ((pair.lower >> 11u) & 15u))) != 0u &&
+                     !viReady(source.viS, plan.issue[index])) ||
+                    ((reads & (1u << ((pair.lower >> 16u) & 15u))) != 0u &&
+                     !viReady(source.viT, plan.issue[index])))
+                    return loop;
+            }
+        }
+        loop.eligible = true;
+        return loop;
+    }
+}
+
+}
+#endif
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region.h b/ps2xRuntime/src/lib/vu/ps2_vu1_region.h
index a6f08d19f..c27e8cc0b 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_region.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region.h
@@ -25,7 +25,7 @@ struct RegionCounters {
                 unit, static_cast<unsigned long long>(total[unit]),
                 static_cast<unsigned long long>(candidate[unit]),
                 static_cast<unsigned long long>(accepted[unit]));
-            for (unsigned length = 4u; length <= 16u; length += 4u)
+            for (unsigned length = 4u; length <= 16u; ++length)
                 if (acceptedByLength[length][unit] != 0u)
                     std::fprintf(stderr, "VU%u region%u=%llu pairs\n", unit, length,
                         static_cast<unsigned long long>(acceptedByLength[length][unit]));
@@ -34,6 +34,8 @@ struct RegionCounters {
 };
 inline thread_local RegionCounters regionCounters;
 inline const bool profileRegions = std::getenv("PS2_VU_PROFILE_REGIONS") != nullptr;
+inline const bool disableTerminalBranches = std::getenv("PS2_VU_DISABLE_BRANCH_TAILS") != nullptr;
+inline thread_local uint64_t terminalBranchPairs = 0u;
 
 constexpr bool regionBudgetFits(uint64_t start, uint64_t budgetEnd, unsigned cycles)
 {
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region_exec.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_region_exec.inl
index f70677282..8087fe46b 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_region_exec.inl
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region_exec.inl
@@ -1,7 +1,11 @@
     static constexpr auto plan = ps2_vu_detail::planRegion(decodedRegion);
+    static constexpr uint8_t terminalBranch = ps2_vu_detail::regionTerminalBranch(decodedRegion);
     if constexpr (plan.eligible)
     {
         const auto tryRegion = [&]() PS2_VU_INLINE_LAMBDA {
+            if constexpr (terminalBranch != 0u)
+                if (ps2_vu_detail::disableTerminalBranches)
+                    return false;
             const uint64_t start = vu.m_cycle;
             if (!ps2_vu_detail::regionBudgetFits(start, budgetEnd, plan.cycles) ||
                 vu.m_state.pc + sizeof...(words) * 8u > vu.m_cachedCodeSize || vu.m_stopRequested ||
@@ -25,6 +29,24 @@
             if (!ready)
                 return false;
 
+            std::array<uint32_t, 4> incomingClip{};
+            if constexpr (plan.readsClip)
+            {
+                incomingClip[0] = vu.m_state.clip;
+                // Incoming CLIP/FCSET entries retire before newly issued CLIP results.
+                for (unsigned offset = 1u; offset < 4u; ++offset)
+                {
+                    incomingClip[offset] = incomingClip[offset - 1u];
+                    const uint64_t cycle = start + offset;
+                    for (uint32_t active = vu.m_activeFlags & (3u << (2u * (cycle & 3u)));
+                         active != 0u; active &= active - 1u)
+                    {
+                        const auto &entry = vu.m_flagPipeline[std::countr_zero(active)];
+                        if (entry.readyCycle <= cycle && entry.writesClip)
+                            incomingClip[offset] = entry.clip;
+                    }
+                }
+            }
             ps2_vu_detail::retireRegionInputs(vu.m_state, start, vu.m_flagPipeline,
                 vu.m_vfWritePipeline, vu.m_viWritePipeline, vu.m_vfLatestWrite,
                 vu.m_viLatestWrite, vu.m_activeFlags, vu.m_activeVfWrites, vu.m_activeViWrites,
@@ -94,6 +116,7 @@
             std::array<int32_t, sizeof...(words)> integers{};
             std::array<ps2_vu_detail::RegionFlag, sizeof...(words)> flags{};
             uint32_t workingClip = vu.m_workingClip;
+            bool branchTaken = false;
             const auto readVf = [&]<uint16_t source, unsigned lane>() PS2_VU_INLINE_LAMBDA {
                 if constexpr (source == ps2_vu_detail::regionConstantZero)
                     return lane == 3u ? 1.0f : 0.0f;
@@ -128,6 +151,14 @@
                     return ps2_vu_detail::upper::normalizeOperand(
                         std::bit_cast<float>(decodedRegion[source - 1u].lower));
             };
+            const auto readClip = [&]<size_t index>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (!decodedRegion[index].lowerUsage.readsClip)
+                    return uint32_t{0};
+                else if constexpr (plan.sources[index].clip != 0u)
+                    return flags[plan.sources[index].clip - 1u].clipValue;
+                else
+                    return incomingClip[std::min<unsigned>(plan.issue[index], 3u)];
+            };
             const auto issue = [&]<size_t index>() PS2_VU_INLINE_LAMBDA {
                 static constexpr auto source = plan.sources[index];
                 float fs[4], ft[4], acc[4], lowerFs[4];
@@ -144,9 +175,15 @@
                 ps2_vu_detail::upper::computeUpper(decodedRegion[index].upper, input, sink);
                 integers[index] = readVi.template operator()<source.viOld>();
                 ps2_vu_detail::RegionLowerInputs lowerInput{lowerFs,
-                    readVi.template operator()<source.viS>(), readVi.template operator()<source.viT>()};
+                    readVi.template operator()<source.viS>(), readVi.template operator()<source.viT>(),
+                    readClip.template operator()<index>()};
                 ps2_vu_detail::RegionLowerSink lowerSink{values[index * 2u + 1u].data(), integers[index]};
-                if constexpr (!decodedRegion[index].iBit)
+                if constexpr (terminalBranch != 0u && index + 2u == sizeof...(words))
+                {
+                    const bool equal = static_cast<int16_t>(lowerInput.viS()) == static_cast<int16_t>(lowerInput.viT());
+                    branchTaken = terminalBranch == 0x28u ? equal : !equal;
+                }
+                else if constexpr (!decodedRegion[index].iBit)
                     ps2_vu_detail::computeRegionLower(decodedRegion[index].lower, lowerInput, lowerSink,
                                                     vu.m_activeVuData, vu.m_activeVuDataSize);
             };
@@ -258,9 +295,20 @@
                 vu.m_state.i = readI.template operator()<plan.scalarI>();
             vu.m_currentUpperInstruction = decodedRegion[last].upper;
             vu.m_cycle = vu.m_state.cycles = end;
-            vu.m_state.pc += sizeof...(words) * 8u;
-            if (vu.m_state.pc == vu.m_cachedCodeSize)
-                vu.m_state.pc = 0u;
+            if (branchTaken)
+            {
+                constexpr uint32_t instruction = decodedRegion[sizeof...(words) - 2u].lower;
+                constexpr int32_t displacement = (static_cast<int32_t>(instruction << 21u) >> 21u) * 8;
+                vu.m_state.branchTarget = (vu.m_state.pc + (sizeof...(words) - 1u) * 8u + displacement) & vu.microAddressMask();
+                vu.m_state.branchDelay = 0u;
+                vu.m_state.pc = vu.m_state.branchTarget;
+            }
+            else
+            {
+                vu.m_state.pc += sizeof...(words) * 8u;
+                if (vu.m_state.pc == vu.m_cachedCodeSize)
+                    vu.m_state.pc = 0u;
+            }
             vu.m_compiledPairsExecuted += sizeof...(words);
             return true;
         };
@@ -270,6 +318,8 @@
             {
                 ps2_vu_detail::regionCounters.accepted[unit == Unit::VU1 ? 1u : 0u] += sizeof...(words);
                 ps2_vu_detail::regionCounters.acceptedByLength[sizeof...(words)][unit == Unit::VU1 ? 1u : 0u] += sizeof...(words);
+                if constexpr (terminalBranch != 0u)
+                    ps2_vu_detail::terminalBranchPairs += sizeof...(words);
             }
             return false;
         }
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region_lower.h b/ps2xRuntime/src/lib/vu/ps2_vu1_region_lower.h
index 49c0d401d..fd16c352e 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_region_lower.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region_lower.h
@@ -61,6 +61,10 @@ PS2_VU_FORCE_INLINE void computeRegionLower(uint32_t instr, const Inputs &input,
     case 1u: storeVector(address(viT + immediate)); return;
     case 4u: loadInteger(address(viS + immediate)); return;
     case 5u: storeInteger(address(viS + immediate)); return;
+    case 0x10u: sink.vi(1u, (input.clip() & 0xffffffu) == (instr & 0xffffffu)); return;
+    case 0x12u: sink.vi(1u, (input.clip() & (instr & 0xffffffu)) != 0u); return;
+    case 0x13u: sink.vi(1u, (input.clip() | (instr & 0xffffffu)) == 0xffffffu); return;
+    case 0x1cu: sink.vi(it, input.clip() & 0xfffu); return;
     case 8u:
     case 9u:
     {
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h b/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h
index 68cb08166..f496e9751 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h
@@ -13,7 +13,7 @@ inline constexpr uint16_t regionConstantZero = 0xffffu;
 
 struct RegionSources {
     std::array<uint16_t, 4> fs{}, ft{}, acc{}, lowerFs{}, lowerFt{};
-    uint16_t viS{}, viT{}, viOld{}, scalarI{};
+    uint16_t viS{}, viT{}, viOld{}, scalarI{}, clip{};
 };
 
 struct RegionWrite {
@@ -24,6 +24,7 @@ struct RegionWrite {
 template <size_t N>
 struct RegionPlan {
     bool eligible = N >= 4u && N <= 16u;
+    bool readsClip = false;
     uint16_t cycles{}, sequences{}, scalarI{};
     std::array<uint16_t, N> issue{};
     std::array<RegionSources, N> sources{};
@@ -41,6 +42,7 @@ constexpr bool regionLowerSupported(uint32_t lower)
     const uint32_t special = (lower & 3u) | ((lower >> 4u) & 0x7cu);
     return lower == 0u || lower == 0x8000033cu || opcode == 0u || opcode == 1u ||
         opcode == 4u || opcode == 5u || opcode == 8u || opcode == 9u ||
+        opcode == 0x10u || opcode == 0x12u || opcode == 0x13u || opcode == 0x1cu ||
         (opcode == 0x40u && (direct == 0x30u || direct == 0x31u || direct == 0x32u ||
             direct == 0x34u || direct == 0x35u ||
             (direct >= 0x3cu && ((special >= 0x30u && special <= 0x31u) ||
@@ -48,6 +50,19 @@ constexpr bool regionLowerSupported(uint32_t lower)
                                (special >= 0x3cu && special <= 0x3fu)))));
 }
 
+template <typename Decoded, size_t N>
+constexpr uint8_t regionTerminalBranch(const std::array<Decoded, N> &decoded)
+{
+    if constexpr (N >= 2u)
+    {
+        const auto &branch = decoded[N - 2u];
+        const uint32_t opcode = branch.lower >> 25u;
+        if (!branch.iBit && (opcode == 0x28u || opcode == 0x29u))
+            return static_cast<uint8_t>(opcode);
+    }
+    return 0u;
+}
+
 template <typename Decoded, size_t N>
 constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded)
 {
@@ -81,8 +96,11 @@ constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded)
     for (unsigned index = 0; index < N; ++index)
     {
         const auto &pair = decoded[index];
+        const uint32_t branchOpcode = pair.lower >> 25u;
+        const bool terminalBranch = !pair.iBit && index + 2u == N &&
+            (branchOpcode == 0x28u || branchOpcode == 0x29u);
         if (pair.eBit || pair.mBit || pair.dBit || pair.tBit || pair.upperUsage.reserved ||
-            (!pair.iBit && (pair.lowerUsage.reserved || !regionLowerSupported(pair.lower))))
+            (!pair.iBit && (pair.lowerUsage.reserved || (!terminalBranch && !regionLowerSupported(pair.lower)))))
             plan.eligible = false;
         const uint32_t upperOp = pair.upper & 63u;
         const uint32_t upperSpecial = (pair.upper & 3u) | ((pair.upper >> 4u) & 0x7cu);
@@ -123,10 +141,28 @@ constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded)
         source.ft = plan.vfVisible[(pair.upper >> 16u) & 31u];
         source.acc = plan.accVisible;
         source.scalarI = plan.scalarI;
+        if (pair.lowerUsage.readsClip)
+        {
+            plan.readsClip = true;
+            for (unsigned previous = 0; previous < index; ++previous)
+                if (decoded[previous].upperUsage.writesClip && plan.issue[previous] + 4u <= cycle)
+                    source.clip = previous + 1u;
+        }
         source.lowerFs = plan.vfVisible[(pair.lower >> 11u) & 31u];
         source.lowerFt = plan.vfVisible[(pair.lower >> 16u) & 31u];
         source.viS = plan.viVisible[(pair.lower >> 11u) & 15u];
         source.viT = plan.viVisible[(pair.lower >> 16u) & 15u];
+        if (terminalBranch && index != 0u && decoded[index - 1u].lowerUsage.delaysNextBranchRead)
+        {
+            const auto &previous = plan.vi[index - 1u];
+            if (previous.mask != 0u)
+            {
+                if (previous.reg == ((pair.lower >> 11u) & 15u))
+                    source.viS = plan.sources[index - 1u].viOld;
+                if (previous.reg == ((pair.lower >> 16u) & 15u))
+                    source.viT = plan.sources[index - 1u].viOld;
+            }
+        }
         const auto writeVf = [&](const auto &usage, RegionWrite &write, uint16_t value) {
             const auto &access = usage.vfWrite;
             if (access.reg == 0u || access.lanes == 0u)
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region_values.h b/ps2xRuntime/src/lib/vu/ps2_vu1_region_values.h
index bd9468e12..be6d241cc 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_region_values.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region_values.h
@@ -53,9 +53,11 @@ struct RegionUpperSink {
 struct RegionLowerInputs {
     const float *left;
     int32_t source, target;
+    uint32_t clipValue{};
     float fs(unsigned lane) const { return left[lane]; }
     int32_t viS() const { return source; }
     int32_t viT() const { return target; }
+    uint32_t clip() const { return clipValue; }
 };
 
 struct RegionLowerSink {
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.inl
index 1d91288a2..8a824834f 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_upper.inl
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_upper.inl
@@ -46,6 +46,39 @@ PS2_VU_FORCE_INLINE void VU1Interpreter::execUpperInline(uint32_t instr)
     float result[4];
 #if defined(__aarch64__)
     const uint8_t arithmeticOp = op < 0x3cu ? op : (instr & 3u) | ((instr >> 4u) & 0x7cu);
+    const bool simpleAdd = arithmeticOp <= 3u || arithmeticOp == 0x20u || arithmeticOp == 0x22u || arithmeticOp == 0x28u;
+    const bool simpleSub = (arithmeticOp >= 4u && arithmeticOp <= 7u) || arithmeticOp == 0x24u || arithmeticOp == 0x26u || arithmeticOp == 0x2cu;
+    const bool simpleMul = (arithmeticOp >= 0x18u && arithmeticOp <= 0x1cu) || arithmeticOp == 0x1eu || arithmeticOp == 0x2au;
+    if (m_useCompiledExecution && (simpleAdd || simpleSub || simpleMul))
+    {
+        float rightBroadcast[4];
+        const float *right = m_state.vf[ft];
+        if (arithmeticOp <= 7u || (arithmeticOp >= 0x18u && arithmeticOp <= 0x1bu) ||
+            arithmeticOp == 0x1cu || arithmeticOp == 0x20u || arithmeticOp == 0x24u ||
+            arithmeticOp == 0x1eu || arithmeticOp == 0x22u || arithmeticOp == 0x26u)
+        {
+            const float scalar = arithmeticOp <= 7u || (arithmeticOp >= 0x18u && arithmeticOp <= 0x1bu)
+                ? m_state.vf[ft][arithmeticOp & 3u]
+                : arithmeticOp == 0x1cu || arithmeticOp == 0x20u || arithmeticOp == 0x24u
+                    ? m_state.q : m_state.i;
+            for (auto &lane : rightBroadcast) lane = scalar;
+            right = rightBroadcast;
+        }
+        uint8_t laneFlags[4];
+        using Arithmetic = ps2_vu_detail::SimpleArithmetic;
+        const bool fast = simpleAdd ? ps2_vu_detail::trySimpleArithmeticVector<Arithmetic::Add>(m_state.vf[fs], right, dest, result, laneFlags)
+            : simpleSub ? ps2_vu_detail::trySimpleArithmeticVector<Arithmetic::Subtract>(m_state.vf[fs], right, dest, result, laneFlags)
+                        : ps2_vu_detail::trySimpleArithmeticVector<Arithmetic::Multiply>(m_state.vf[fs], right, dest, result, laneFlags);
+        if (fast)
+        {
+            updateFmacFlags(laneFlags, dest, 0u);
+            if (op >= 0x3cu)
+                applyDestAcc(result, dest);
+            else
+                applyDest(vd, result, dest);
+            return;
+        }
+    }
     const bool productSum = (arithmeticOp >= 8u && arithmeticOp <= 0xfu) ||
         arithmeticOp == 0x21u || arithmeticOp == 0x23u || arithmeticOp == 0x25u ||
         arithmeticOp == 0x27u || arithmeticOp == 0x29u || arithmeticOp == 0x2du;
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h b/ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h
index f32259169..f48dc0dfd 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_upper_engine.h
@@ -2,6 +2,7 @@
 #define PS2_VU1_UPPER_ENGINE_H
 
 #include "ps2_vu1_detail.h"
+#include "ps2_vu1_fmac_flags.h"
 #include "ps2_vu1_fmac_neon.h"
 #include <cmath>
 #include <cstring>
@@ -394,27 +395,8 @@ PS2_VU_FORCE_INLINE void publishFmacFlags(Sink &sink, const uint8_t laneFlags[4]
     if (dest == 0u)
         return;
 
-    uint32_t mac = 0u;
-    uint32_t status = 0u;
-    for (uint32_t component = 0; component < 4u; ++component)
-    {
-        const uint8_t lane = laneForComponent(component);
-        if ((dest & lane) == 0u)
-            continue;
-
-        const uint32_t flags = laneFlags[component];
-        if ((flags & 0x1u) != 0u)
-            mac |= lane;
-        if ((flags & 0x2u) != 0u)
-            mac |= static_cast<uint32_t>(lane) << 4;
-        if ((flags & 0x4u) != 0u)
-            mac |= static_cast<uint32_t>(lane) << 8;
-        if ((flags & 0x8u) != 0u)
-            mac |= static_cast<uint32_t>(lane) << 12;
-        status |= flags;
-    }
-
-    sink.fmac(mac, status, extraSticky);
+    const auto packed = ps2_vu_detail::packFmacFlags(laneFlags, dest);
+    sink.fmac(packed.mac, packed.status, extraSticky);
 }
 
 // Inputs expose raw operands. Compute flags before publishing values so
@@ -438,6 +420,39 @@ PS2_VU_FORCE_INLINE void computeUpper(uint32_t instr, const Inputs &in, Sink &si
     float result[4];
 #if defined(__aarch64__)
     const uint8_t arithmeticOp = op < 0x3cu ? op : (instr & 3u) | ((instr >> 4u) & 0x7cu);
+    const bool simpleAdd = arithmeticOp <= 3u || arithmeticOp == 0x20u || arithmeticOp == 0x22u || arithmeticOp == 0x28u;
+    const bool simpleSub = (arithmeticOp >= 4u && arithmeticOp <= 7u) || arithmeticOp == 0x24u || arithmeticOp == 0x26u || arithmeticOp == 0x2cu;
+    const bool simpleMul = (arithmeticOp >= 0x18u && arithmeticOp <= 0x1cu) || arithmeticOp == 0x1eu || arithmeticOp == 0x2au;
+    if (in.compiledFastPath() && (simpleAdd || simpleSub || simpleMul))
+    {
+        float left[4], right[4];
+        for (unsigned lane = 0u; lane < 4u; ++lane)
+        {
+            left[lane] = in.fs(lane);
+            if (arithmeticOp <= 7u || (arithmeticOp >= 0x18u && arithmeticOp <= 0x1bu))
+                right[lane] = in.ft(arithmeticOp & 3u);
+            else if (arithmeticOp == 0x1cu || arithmeticOp == 0x20u || arithmeticOp == 0x24u)
+                right[lane] = in.q();
+            else if (arithmeticOp == 0x1eu || arithmeticOp == 0x22u || arithmeticOp == 0x26u)
+                right[lane] = in.i();
+            else
+                right[lane] = in.ft(lane);
+        }
+        uint8_t laneFlags[4];
+        using Arithmetic = ps2_vu_detail::SimpleArithmetic;
+        const bool fast = simpleAdd ? ps2_vu_detail::trySimpleArithmeticVector<Arithmetic::Add>(left, right, dest, result, laneFlags)
+            : simpleSub ? ps2_vu_detail::trySimpleArithmeticVector<Arithmetic::Subtract>(left, right, dest, result, laneFlags)
+                        : ps2_vu_detail::trySimpleArithmeticVector<Arithmetic::Multiply>(left, right, dest, result, laneFlags);
+        if (fast)
+        {
+            publishFmacFlags(sink, laneFlags, dest, 0u);
+            if (op >= 0x3cu)
+                sink.acc(dest, result);
+            else
+                sink.vf(fd, dest, result);
+            return;
+        }
+    }
     const bool productSum = (arithmeticOp >= 8u && arithmeticOp <= 0xfu) ||
         arithmeticOp == 0x21u || arithmeticOp == 0x23u || arithmeticOp == 0x25u ||
         arithmeticOp == 0x27u || arithmeticOp == 0x29u || arithmeticOp == 0x2du;
diff --git a/ps2xTest/data/vu_branch_flags.vublocks b/ps2xTest/data/vu_branch_flags.vublocks
new file mode 100644
index 000000000..29ebe9aec
--- /dev/null
+++ b/ps2xTest/data/vu_branch_flags.vublocks
@@ -0,0 +1,5 @@
+VU-BLOCKS 2
+0 01e209ff38020000 000002ff24000001 000002ff50030802 01e419ff0b010000
+0 01e209ff38020000 000002ff24000001 000002ff52030802 01e419ff0b010000
+1 01e209ff38020000 000002ff24000001 000002ff50030802 01e419ff0b010000
+1 01e209ff38020000 000002ff24000001 000002ff52030802 01e419ff0b010000
diff --git a/ps2xTest/data/vu_branch_tails.vublocks b/ps2xTest/data/vu_branch_tails.vublocks
new file mode 100644
index 000000000..8243929c0
--- /dev/null
+++ b/ps2xTest/data/vu_branch_tails.vublocks
@@ -0,0 +1,17 @@
+VU-BLOCKS 2
+0 019184a809080003 007184e910040009 0191952a50042803 01d5b1ff8186937d
+0 019184a809080003 007184e910040009 0191952a50042ff9 01d5b1ff8186937d
+0 019184a809080003 007184e910050009 0191952a50042803 01d5b1ff8186937d
+0 019184a809080003 007184e910050009 0191952a50042ff9 01d5b1ff8186937d
+0 019184a809080003 007184e910040009 0191952a52042803 01d5b1ff8186937d
+0 019184a809080003 007184e910040009 0191952a52042ff9 01d5b1ff8186937d
+0 019184a809080003 007184e910050009 0191952a52042803 01d5b1ff8186937d
+0 019184a809080003 007184e910050009 0191952a52042ff9 01d5b1ff8186937d
+1 019184a809080003 007184e910040009 0191952a50042803 01d5b1ff8186937d
+1 019184a809080003 007184e910040009 0191952a50042ff9 01d5b1ff8186937d
+1 019184a809080003 007184e910050009 0191952a50042803 01d5b1ff8186937d
+1 019184a809080003 007184e910050009 0191952a50042ff9 01d5b1ff8186937d
+1 019184a809080003 007184e910040009 0191952a52042803 01d5b1ff8186937d
+1 019184a809080003 007184e910040009 0191952a52042ff9 01d5b1ff8186937d
+1 019184a809080003 007184e910050009 0191952a52042803 01d5b1ff8186937d
+1 019184a809080003 007184e910050009 0191952a52042ff9 01d5b1ff8186937d
diff --git a/ps2xTest/data/vu_counted_loop.vublocks b/ps2xTest/data/vu_counted_loop.vublocks
new file mode 100644
index 000000000..3ab5da857
--- /dev/null
+++ b/ps2xTest/data/vu_counted_loop.vublocks
@@ -0,0 +1,5 @@
+VU-BLOCKS 3
+1 01d5af2b01db5003 01d0d52a01d95804 01d1c56a01976004 0192b4ea818c9b7d 01dad93f81cbe37d 01d8c93f520a6ffa 0196b93f81caa37d
+1 01d5af2b01db5003 01d0d52a01d95804 01d1c56a01976004 0192b4ea818c9b7d 01dad93f81cbe37d 01d8c93f520a5ffa 0196b93f81caa37d
+1 011185288000033c 000002ff8000033c 000002ff8000033c 011185288000033c 000002ff8000033c 000002ff520a6ffa 01118528810acb7d
+1 000002ff090e0002 000002ff8000033c 000002ff090e0002 000002ff8000033c 000002ff090e0002 000002ff520a6ffa 000002ff810acb7d
diff --git a/ps2xTest/data/vu_early_counter_loop.vublocks b/ps2xTest/data/vu_early_counter_loop.vublocks
new file mode 100644
index 000000000..bee78057b
--- /dev/null
+++ b/ps2xTest/data/vu_early_counter_loop.vublocks
@@ -0,0 +1,2 @@
+VU-BLOCKS 3
+1 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 01c0b1bf520b67f8 01d790bc03ebcff9
diff --git a/ps2xTest/data/vu_natural_loop.vublocks b/ps2xTest/data/vu_natural_loop.vublocks
new file mode 100644
index 000000000..412f6268a
--- /dev/null
+++ b/ps2xTest/data/vu_natural_loop.vublocks
@@ -0,0 +1,13 @@
+VU-BLOCKS 3
+0 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f2240400000 0180e75e8000033c 01c0b1bf500b67f5 01d790bc03ebcff9
+0 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f227fffffff 0180e75e8000033c 01c0b1bf500b67f5 01d790bc03ebcff9
+0 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f2280000001 0180e75e8000033c 01c0b1bf500b67f5 01d790bc03ebcff9
+0 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f2240400000 0180e75e8000033c 01c0b1bf520b67f5 01d790bc03ebcff9
+0 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f227fffffff 0180e75e8000033c 01c0b1bf520b67f5 01d790bc03ebcff9
+0 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f2280000001 0180e75e8000033c 01c0b1bf520b67f5 01d790bc03ebcff9
+1 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f2240400000 0180e75e8000033c 01c0b1bf500b67f5 01d790bc03ebcff9
+1 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f227fffffff 0180e75e8000033c 01c0b1bf500b67f5 01d790bc03ebcff9
+1 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f2280000001 0180e75e8000033c 01c0b1bf500b67f5 01d790bc03ebcff9
+1 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f2240400000 0180e75e8000033c 01c0b1bf520b67f5 01d790bc03ebcff9
+1 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f227fffffff 0180e75e8000033c 01c0b1bf520b67f5 01d790bc03ebcff9
+1 01d798bd81da537c 01d7a0be8000033c 01d7ae4b8000033c 01e0c5d08000033c 01fa79bc8039b33c 01fa80bd100b5805 01fa8e0a8000033c 81e086de40000000 81808f2280000001 0180e75e8000033c 01c0b1bf520b67f5 01d790bc03ebcff9
diff --git a/ps2xTest/data/vu_natural_uncounted.vublocks b/ps2xTest/data/vu_natural_uncounted.vublocks
new file mode 100644
index 000000000..1513a11db
--- /dev/null
+++ b/ps2xTest/data/vu_natural_uncounted.vublocks
@@ -0,0 +1,5 @@
+VU-BLOCKS 3
+0 81e0106240000000 81e010de40400000 000002ff500007fd 000002ff8000033c
+1 81e0106240000000 81e010de40400000 000002ff500007fd 000002ff8000033c
+0 000002ff24000001 000002ff8000033c 000002ff52000ffd 000002ff8000033c
+1 000002ff24000001 000002ff8000033c 000002ff52000ffd 000002ff8000033c
diff --git a/ps2xTest/data/vu_static_regions.vublocks b/ps2xTest/data/vu_static_regions.vublocks
index b975dde6f..4c8136112 100644
--- a/ps2xTest/data/vu_static_regions.vublocks
+++ b/ps2xTest/data/vu_static_regions.vublocks
@@ -10,3 +10,4 @@ VU-BLOCKS 2
 1 000002ff10010001 000002ff10010002 000002ff10010003 000002ff10010004 000002ff10010005 000002ff10010006 000002ff10010007 000002ff10010008
 1 000002ff10010001 000002ff10010002 000002ff10010003 000002ff10010004 000002ff10010005 000002ff10010006 000002ff10010007 000002ff10010008 000002ff10010009 000002ff1001000a 000002ff1001000b 000002ff1001000c
 1 000002ff10010001 000002ff10010002 000002ff10010003 000002ff10010004 000002ff10010005 000002ff10010006 000002ff10010007 000002ff10010008 000002ff10010009 000002ff1001000a 000002ff1001000b 000002ff1001000c 000002ff1001000d 000002ff1001000e 000002ff1001000f 000002ff10010010
+1 01e209ff38020000 01e419ff38030000 000002ff38040000 000002ff38050000 01e111ff38060000 000002ff38070000 000002ff24100000 01e321ff0b010000 000002ff26feffff 000002ff0b010001 01e309ff20ffffff 000002ff38080000
diff --git a/ps2xTest/src/ps2_vu1_tests.cpp b/ps2xTest/src/ps2_vu1_tests.cpp
index 5854ed3ae..99a46b7f7 100644
--- a/ps2xTest/src/ps2_vu1_tests.cpp
+++ b/ps2xTest/src/ps2_vu1_tests.cpp
@@ -7,6 +7,7 @@
 #include "../../ps2xRuntime/src/lib/vu/ps2_vu1_fmac.h"
 #include "../../ps2xRuntime/src/lib/vu/ps2_vu1_fmac_neon.h"
 #include "../../ps2xRuntime/src/lib/vu/ps2_vu1_region.h"
+#include "../../ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h"
 
 #include <cfenv>
 #include <cmath>
@@ -206,6 +207,46 @@ namespace
         mem.processVIF1Data(packet.data(), static_cast<uint32_t>(packet.size()));
     }
 
+    void writeCountedLoopCode(Vu1Fixture &fx, uint32_t base = 0u)
+    {
+        writeVuInstructionPair(fx.code, base + 0u, makeVuLq(14u, 27u, 10u, 3),
+            makeVuUpper(0x2bu, 14u, 21u, 21u, 28u));
+        writeVuInstructionPair(fx.code, base + 8u, makeVuLq(14u, 25u, 11u, 4),
+            makeVuUpper(0x2au, 14u, 16u, 26u, 20u));
+        writeVuInstructionPair(fx.code, base + 16u, makeVuLq(12u, 23u, 12u, 4),
+            makeVuUpper(0x2au, 14u, 17u, 24u, 21u));
+        writeVuInstructionPair(fx.code, base + 24u, makeVuLowerSpecial(0x35u, 19u, 12u, 0u, 12u),
+            makeVuUpper(0x2au, 12u, 18u, 22u, 19u));
+        writeVuInstructionPair(fx.code, base + 32u, makeVuLowerSpecial(0x35u, 28u, 11u, 0u, 14u),
+            makeVuUpperSpecial(0x13u, 14u, 26u, 27u));
+        writeVuInstructionPair(fx.code, base + 40u, makeVuIbne(13u, 10u, -6),
+            makeVuUpperSpecial(0x13u, 14u, 24u, 25u));
+        writeVuInstructionPair(fx.code, base + 48u, makeVuLowerSpecial(0x35u, 20u, 10u, 0u, 14u),
+            makeVuUpperSpecial(0x13u, 12u, 22u, 23u));
+    }
+
+    void writeEarlyCounterLoopCode(Vu1Fixture &fx)
+    {
+        writeVuInstructionPair(fx.code, 0u, makeVuLowerSpecial(0x34u, 10u, 26u, 0u, 14u),
+            makeVuUpperSpecial(0x09u, 14u, 23u, 19u));
+        writeVuInstructionPair(fx.code, 8u, 0x8000033cu,
+            makeVuUpperSpecial(0x0au, 14u, 23u, 20u));
+        writeVuInstructionPair(fx.code, 16u, 0x8000033cu,
+            makeVuUpper(0x0bu, 14u, 23u, 21u, 25u));
+        writeVuInstructionPair(fx.code, 24u, 0x8000033cu,
+            makeVuUpper(0x10u, 15u, 0u, 24u, 23u));
+        writeVuInstructionPair(fx.code, 32u, makeVuLowerSpecial(0x30u, 22u, 25u, 0u, 1u),
+            makeVuUpperSpecial(0x18u, 15u, 26u, 15u));
+        writeVuInstructionPair(fx.code, 40u, makeVuIaddiu(11u, 11u, 5),
+            makeVuUpperSpecial(0x09u, 15u, 26u, 16u));
+        writeVuInstructionPair(fx.code, 48u, 0x8000033cu,
+            makeVuUpper(0x0au, 15u, 26u, 17u, 24u));
+        writeVuInstructionPair(fx.code, 56u, makeVuIbne(12u, 11u, -8),
+            makeVuUpperSpecial(0x1bu, 14u, 0u, 22u));
+        writeVuInstructionPair(fx.code, 64u, makeVuSq(15u, 25u, 11u, -7),
+            makeVuUpperSpecial(0x08u, 14u, 23u, 18u));
+    }
+
     void writeVuQword(uint8_t *data, uint32_t qwordIndex, const float values[4])
     {
         std::memcpy(data + qwordIndex * 16u, values, sizeof(float) * 4u);
@@ -215,12 +256,413 @@ namespace
     {
         std::memcpy(values, data + qwordIndex * 16u, sizeof(float) * 4u);
     }
+
+    void writeTerminalBranchFixture(uint8_t *code, uint32_t start, uint8_t opcode,
+                                    uint8_t previousVi, int16_t displacement)
+    {
+        writeVuInstructionPair(code, start, makeVuIlw(8u, 8u, 0u, 3),
+            makeVuUpper(0x28u, 12u, 17u, 16u, 18u));
+        writeVuInstructionPair(code, start + 8u, makeVuIaddiu(previousVi, 0u, 9),
+            makeVuUpper(0x29u, 3u, 17u, 16u, 19u));
+        writeVuInstructionPair(code, start + 16u,
+            (uint32_t{opcode} << 25u) | (4u << 16u) | (5u << 11u) | (uint32_t(displacement) & 0x7ffu),
+            makeVuUpper(0x2au, 12u, 17u, 18u, 20u));
+        writeVuInstructionPair(code, start + 24u, makeVuLowerSpecial(0x35u, 18u, 6u, 0u, 12u),
+            makeVuUpperSpecial(0x1fu, 14u, 21u, 22u));
+    }
 }
 
 void register_ps2_vu1_tests()
 {
     MiniTest::Case("PS2VU1", [](TestCase &tc)
     {
+        tc.Run("terminal conditional regions preserve branch bypass and delayed tails", [](TestCase &t)
+        {
+            for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
+            {
+                Vu1Fixture candidateMemory, oracleMemory;
+                t.IsTrue(candidateMemory.initialize() && oracleMemory.initialize(), "branch fixtures must initialize");
+                const uint32_t codeSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_SIZE : PS2_VU0_CODE_SIZE;
+                const uint32_t dataSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_DATA_SIZE : PS2_VU0_DATA_SIZE;
+                if (unit == VU1Interpreter::Unit::VU0)
+                    for (auto *fx : {&candidateMemory, &oracleMemory})
+                    {
+                        fx->code = fx->mem.getVU0Code();
+                        fx->data = fx->mem.getVU0Data();
+                    }
+                for (uint8_t opcode : {0x28u, 0x29u})
+                    for (uint8_t previousVi : {4u, 5u})
+                        for (int16_t displacement : {3, -7})
+                            for (uint32_t start : {64u, codeSize - 32u})
+                                for (bool equal : {false, true})
+                                    for (bool incomingWrite : {false, true})
+                                        for (uint32_t budget : {0u, 1u, 2u, 4u, 5u, 6u, 7u, 9u})
+                                        {
+                                            for (auto *fx : {&candidateMemory, &oracleMemory})
+                                            {
+                                                for (uint32_t pc = 0; pc < codeSize; pc += 8u)
+                                                    writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                                                writeTerminalBranchFixture(fx->code, start, opcode, previousVi, displacement);
+                                                const uint32_t target = (start + 24u + displacement * 8u) & (codeSize - 1u);
+                                                for (uint32_t next : {(start + 32u) & (codeSize - 1u), target})
+                                                    writeVuInstructionPair(fx->code, next, makeVuIbne(6u, 7u, 2), kVuUpperNop);
+                                                if (incomingWrite)
+                                                    writeVuInstructionPair(fx->code, start - 8u,
+                                                        makeVuIlw(8u, previousVi, 0u, 3), kVuUpperNop);
+                                                for (uint32_t byte = 0; byte < dataSize; ++byte)
+                                                    fx->data[byte] = static_cast<uint8_t>(byte * 29u + 11u);
+                                            }
+                                            VU1Interpreter candidate(unit), oracle(unit);
+                                            oracle.setCompiledExecutionEnabled(false);
+                                            uint32_t random = 0x753bc411u;
+                                            for (unsigned reg = 1; reg < 32u; ++reg)
+                                                for (unsigned lane = 0; lane < 4u; ++lane)
+                                                {
+                                                    random = random * 1664525u + 1013904223u;
+                                                    std::memcpy(&candidate.state().vf[reg][lane], &random, sizeof(random));
+                                                }
+                                            for (unsigned lane = 0; lane < 4u; ++lane)
+                                                candidate.state().acc[lane] = candidate.state().vf[23u][lane];
+                                            candidate.state().vi[5] = 3;
+                                            candidate.state().vi[4] = equal ? 3 : 9;
+                                            candidate.state().vi[6] = candidate.state().vi[7] = -32768;
+                                            candidate.state().branchTarget = 0x1a8u;
+                                            candidate.state().branchDelay = 7u;
+                                            oracle.state() = candidate.state();
+                                            const auto execute = [&](VU1Interpreter &vu, Vu1Fixture &fx, uint32_t pc, uint32_t cycles) {
+                                                vu.execute(fx.code, codeSize, fx.data, dataSize, fx.gs, &fx.mem, pc, 0u, 0u, cycles);
+                                            };
+                                            const auto resume = [&](VU1Interpreter &vu, Vu1Fixture &fx, uint32_t cycles) {
+                                                vu.resume(fx.code, codeSize, fx.data, dataSize, fx.gs, &fx.mem, 0u, 0u, cycles);
+                                            };
+                                            const uint64_t before = ps2_vu_detail::terminalBranchPairs;
+                                            if (incomingWrite)
+                                            {
+                                                candidate.setCompiledExecutionEnabled(false);
+                                                execute(candidate, candidateMemory, start - 8u, 1u);
+                                                execute(oracle, oracleMemory, start - 8u, 1u);
+                                                candidate.setCompiledExecutionEnabled(true);
+                                                resume(candidate, candidateMemory, budget);
+                                                resume(oracle, oracleMemory, budget);
+                                            }
+                                            else
+                                            {
+                                                execute(candidate, candidateMemory, start, budget);
+                                                execute(oracle, oracleMemory, start, budget);
+                                            }
+                                            if (std::getenv("PS2_VU_REQUIRE_BRANCH_TAILS"))
+                                                t.Equals(ps2_vu_detail::terminalBranchPairs - before, budget >= 6u ? uint64_t{4} : uint64_t{0},
+                                                    "only a complete six-cycle terminal region should execute the forced path");
+                                            const auto compare = [&] {
+                                                t.IsTrue(std::memcmp(&candidate.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                                    "taken/untaken PC, branch backup, flags and masked registers must match raw execution");
+                                                t.IsTrue(std::memcmp(candidateMemory.data, oracleMemory.data, dataSize) == 0,
+                                                    "the delay-slot store must execute exactly once and preserve all other bytes");
+                                            };
+                                            compare();
+                                            for (unsigned tail = 0; tail < 8u; ++tail)
+                                            {
+                                                resume(candidate, candidateMemory, 1u);
+                                                resume(oracle, oracleMemory, 1u);
+                                                compare();
+                                            }
+                                        }
+            }
+        });
+
+        tc.Run("terminal branches consume delayed CLIP checks without integer bypass", [](TestCase &t)
+        {
+            for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
+                for (unsigned phase = 0; phase < 8u; ++phase)
+                    for (uint32_t firstClip : {0u, 1u})
+                        for (uint32_t opcode : {0x28u, 0x29u})
+                            for (uint32_t budget : {1u, 2u, 3u, 4u, 5u, 7u})
+                            {
+                                Vu1Fixture candidateMemory, oracleMemory;
+                                t.IsTrue(candidateMemory.initialize() && oracleMemory.initialize(), "flag branch fixtures initialize");
+                                const uint32_t codeSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_SIZE : PS2_VU0_CODE_SIZE;
+                                const uint32_t dataSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_DATA_SIZE : PS2_VU0_DATA_SIZE;
+                                const uint32_t start = (phase + 3u) * 8u;
+                                for (auto *fx : {&candidateMemory, &oracleMemory})
+                                {
+                                    if (unit == VU1Interpreter::Unit::VU0)
+                                    {
+                                        fx->code = fx->mem.getVU0Code();
+                                        fx->data = fx->mem.getVU0Data();
+                                    }
+                                    for (uint32_t pc = 0; pc < codeSize; pc += 8u)
+                                        writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                                    writeVuInstructionPair(fx->code, phase * 8u, 0x22000000u | firstClip, kVuUpperNop);
+                                    writeVuInstructionPair(fx->code, (phase + 1u) * 8u, 0x22222222u, kVuUpperNop);
+                                    writeVuInstructionPair(fx->code, (phase + 2u) * 8u, 0x22555555u, kVuUpperNop);
+                                    writeVuInstructionPair(fx->code, start, 0x38020000u, makeVuUpperSpecial(0x1fu, 15u, 2u, 1u));
+                                    writeVuInstructionPair(fx->code, start + 8u, 0x24000001u, kVuUpperNop);
+                                    writeVuInstructionPair(fx->code, start + 16u, (opcode << 25u) | 0x00030802u, kVuUpperNop);
+                                    writeVuInstructionPair(fx->code, start + 24u, 0x0b010000u, makeVuUpperSpecial(0x1fu, 15u, 4u, 3u));
+                                    for (uint32_t byte = 0; byte < dataSize; ++byte)
+                                        fx->data[byte] = static_cast<uint8_t>(byte * 13u + 7u);
+                                }
+                                VU1Interpreter candidate(unit), oracle(unit);
+                                for (uint32_t reg = 1; reg <= 4u; ++reg)
+                                    for (uint32_t lane = 0; lane < 4u; ++lane)
+                                        candidate.state().vf[reg][lane] = static_cast<float>(static_cast<int>(reg + lane) - 4);
+                                candidate.state().clip = 0xabcdefu;
+                                candidate.state().vi[1] = firstClip ^ 1u;
+                                candidate.state().vi[3] = 1;
+                                oracle.state() = candidate.state();
+                                candidate.setCompiledExecutionEnabled(false);
+                                oracle.setCompiledExecutionEnabled(false);
+                                candidate.execute(candidateMemory.code, codeSize, candidateMemory.data, dataSize,
+                                    candidateMemory.gs, &candidateMemory.mem, 0u, 0u, 0u, phase + 3u);
+                                oracle.execute(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
+                                    oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, phase + 3u);
+                                candidate.setCompiledExecutionEnabled(true);
+                                const uint64_t before = ps2_vu_detail::terminalBranchPairs;
+                                for (unsigned step = 0; step < 9u; ++step)
+                                {
+                                    if (step != 0u) candidate.setCompiledExecutionEnabled(false);
+                                    const uint32_t cycles = step == 0u ? budget : 1u;
+                                    candidate.resume(candidateMemory.code, codeSize, candidateMemory.data, dataSize,
+                                        candidateMemory.gs, &candidateMemory.mem, 0u, 0u, cycles);
+                                    oracle.resume(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
+                                        oracleMemory.gs, &oracleMemory.mem, 0u, 0u, cycles);
+                                    t.IsTrue(std::memcmp(&candidate.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                        "the immediately preceding CLIP result must feed branch selection and every raw flag tail");
+                                    t.IsTrue(std::memcmp(candidateMemory.data, oracleMemory.data, dataSize) == 0,
+                                        "the branch delay-slot store must use the new flag-check value");
+                                    if (step == 0u && std::getenv("PS2_VU_REQUIRE_BRANCH_TAILS"))
+                                        t.Equals(ps2_vu_detail::terminalBranchPairs - before, budget >= 4u ? uint64_t{4} : uint64_t{0},
+                                            "both CLIP reads and the terminal branch must execute in one native region");
+                                    if (step == 0u && budget == 4u)
+                                    {
+                                        const bool taken = opcode == 0x28u ? firstClip == 1u : firstClip != 1u;
+                                        t.Equals(candidate.state().pc, start + (taken ? 40u : 32u), "the branch uses the newly visible CLIP predicate");
+                                        t.Equals(candidate.state().vi[2], int32_t{0xdef}, "the earlier FCGET still sees the entry CLIP value");
+                                    }
+                                }
+                            }
+        });
+
+        tc.Run("terminal branch and delay-slot code edits invalidate cached selection", [](TestCase &t)
+        {
+            for (uint32_t offset : {16u, 24u})
+            {
+                Vu1Fixture candidateMemory, oracleMemory;
+                t.IsTrue(candidateMemory.initialize() && oracleMemory.initialize(), "branch edit fixtures must initialize");
+                for (auto *fx : {&candidateMemory, &oracleMemory})
+                {
+                    for (uint32_t pc = 0; pc < PS2_VU1_CODE_SIZE; pc += 8u)
+                        writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                    writeTerminalBranchFixture(fx->code, 64u, 0x29u, 5u, 3);
+                }
+                VU1Interpreter candidate, oracle;
+                oracle.setCompiledExecutionEnabled(false);
+                candidate.state().vi[4] = candidate.state().vi[5] = 3;
+                oracle.state() = candidate.state();
+                const uint64_t before = ps2_vu_detail::terminalBranchPairs;
+                candidate.execute(candidateMemory.code, PS2_VU1_CODE_SIZE, candidateMemory.data, PS2_VU1_DATA_SIZE,
+                    candidateMemory.gs, &candidateMemory.mem, 64u, 0u, 0u, 6u);
+                oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                    oracleMemory.gs, &oracleMemory.mem, 64u, 0u, 0u, 6u);
+                if (std::getenv("PS2_VU_REQUIRE_BRANCH_TAILS"))
+                    t.Equals(ps2_vu_detail::terminalBranchPairs - before, uint64_t{4}, "the original branch region must be cached");
+                for (auto *fx : {&candidateMemory, &oracleMemory})
+                    writeTrackedVuInstructionPair(*fx, 64u + offset, makeVuIaddiu(15u, 0u, 777), kVuUpperNop);
+                candidate.state().pc = oracle.state().pc = 64u;
+                const uint64_t edited = ps2_vu_detail::terminalBranchPairs;
+                for (unsigned step = 0; step < 10u; ++step)
+                {
+                    const uint32_t budget = step == 0u ? 6u : 1u;
+                    candidate.resume(candidateMemory.code, PS2_VU1_CODE_SIZE, candidateMemory.data, PS2_VU1_DATA_SIZE,
+                        candidateMemory.gs, &candidateMemory.mem, 0u, 0u, budget);
+                    oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                        oracleMemory.gs, &oracleMemory.mem, 0u, 0u, budget);
+                    t.IsTrue(std::memcmp(&candidate.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                        "edited branch or delay slot must match raw execution and all resumed tails");
+                    t.IsTrue(std::memcmp(candidateMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                        "editing the delay-slot store must remove its effect");
+                }
+                t.Equals(candidate.state().vi[15], 777, "the replacement instruction must execute");
+                t.Equals(ps2_vu_detail::terminalBranchPairs - edited, uint64_t{0}, "an edited terminal region must fall back");
+            }
+        });
+
+        tc.Run("natural loops keep flag-reading bodies on the exact fallback", [](TestCase &t)
+        {
+            for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
+                for (unsigned budget : {4u, 8u, 19u})
+                {
+                    Vu1Fixture nativeMemory, oracleMemory;
+                    t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "flag loop fixtures initialize");
+                    const uint32_t codeSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_SIZE : PS2_VU0_CODE_SIZE;
+                    const uint32_t dataSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_DATA_SIZE : PS2_VU0_DATA_SIZE;
+                    for (auto *fx : {&nativeMemory, &oracleMemory})
+                    {
+                        if (unit == VU1Interpreter::Unit::VU0)
+                        {
+                            fx->code = fx->mem.getVU0Code();
+                            fx->data = fx->mem.getVU0Data();
+                        }
+                        writeVuInstructionPair(fx->code, 0u, 0x24000001u, kVuUpperNop);
+                        writeVuInstructionPair(fx->code, 8u, 0x8000033cu, kVuUpperNop);
+                        writeVuInstructionPair(fx->code, 16u, makeVuIbne(1u, 0u, -3), kVuUpperNop);
+                        writeVuInstructionPair(fx->code, 24u, 0x8000033cu, kVuUpperNop);
+                    }
+                    VU1Interpreter native(unit), oracle(unit);
+                    oracle.setCompiledExecutionEnabled(false);
+                    native.state().clip = 1u;
+                    oracle.state() = native.state();
+                    const uint64_t before = ps2_vu_detail::countedLoopPairs;
+                    native.execute(nativeMemory.code, codeSize, nativeMemory.data, dataSize,
+                        nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, budget);
+                    oracle.execute(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
+                        oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, budget);
+                    t.Equals(ps2_vu_detail::countedLoopPairs - before, uint64_t{0},
+                        "broader bounded-region support must not enable unsupported loop flag timelines");
+                    for (unsigned tail = 0; tail < 8u; ++tail)
+                    {
+                        t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                            "FCAND and its immediate backedge must preserve the visible CLIP version");
+                        native.resume(nativeMemory.code, codeSize, nativeMemory.data, dataSize,
+                            nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 1u);
+                        oracle.resume(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
+                            oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 1u);
+                    }
+                }
+        });
+
+        tc.Run("natural loops without counters yield at every exact budget", [](TestCase &t)
+        {
+            for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
+                for (unsigned budget = 0; budget <= 25u; ++budget)
+                {
+                    Vu1Fixture nativeMemory, oracleMemory;
+                    t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "uncounted loop fixtures initialize");
+                    const uint32_t codeSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_SIZE : PS2_VU0_CODE_SIZE;
+                    const uint32_t dataSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_DATA_SIZE : PS2_VU0_DATA_SIZE;
+                    for (auto *fx : {&nativeMemory, &oracleMemory})
+                    {
+                        if (unit == VU1Interpreter::Unit::VU0)
+                        {
+                            fx->code = fx->mem.getVU0Code();
+                            fx->data = fx->mem.getVU0Data();
+                        }
+                        writeVuInstructionPair(fx->code, 0u, 0x40000000u,
+                            makeVuUpper(0x22u, 15u, 0u, 2u, 1u) | 0x80000000u);
+                        writeVuInstructionPair(fx->code, 8u, 0x40400000u,
+                            makeVuUpper(0x1eu, 15u, 0u, 2u, 3u) | 0x80000000u);
+                        writeVuInstructionPair(fx->code, 16u, (0x28u << 25u) | (-3 & 0x7ff), kVuUpperNop);
+                        writeVuInstructionPair(fx->code, 24u, 0x8000033cu, kVuUpperNop);
+                    }
+                    VU1Interpreter native(unit), oracle(unit);
+                    oracle.setCompiledExecutionEnabled(false);
+                    native.state().i = 5.0f;
+                    for (unsigned lane = 0; lane < 4u; ++lane)
+                        native.state().vf[2][lane] = static_cast<float>(lane + 1u);
+                    oracle.state() = native.state();
+                    const uint64_t before = ps2_vu_detail::countedLoopPairs;
+                    native.execute(nativeMemory.code, codeSize, nativeMemory.data, dataSize,
+                        nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, budget);
+                    oracle.execute(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
+                        oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, budget);
+                    if (std::getenv("PS2_VU_REQUIRE_NATURAL_LOOPS"))
+                        t.Equals(ps2_vu_detail::countedLoopPairs - before, uint64_t{budget / 4u * 4u},
+                            "an always-taken loop needs no counter to honor its exact budget");
+                    for (unsigned tail = 0; tail < 8u; ++tail)
+                    {
+                        t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                            "bounded infinite backedges retain I and pending pipeline tails");
+                        native.resume(nativeMemory.code, codeSize, nativeMemory.data, dataSize,
+                            nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 1u);
+                        oracle.resume(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
+                            oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 1u);
+                    }
+                }
+        });
+
+        tc.Run("natural loops carry old and new I across stalled iterations", [](TestCase &t)
+        {
+            for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
+                for (unsigned opcode : {0x28u, 0x29u})
+                    for (uint32_t immediate : {0x40400000u, 0x7fffffffu, 0x80000001u})
+                        for (unsigned phase : {0u, 1u, 2u, 3u})
+                            for (unsigned trips : {1u, 2u, 7u})
+                                for (unsigned budget : {0u, 1u, 8u, 12u, 14u, 15u, 16u, 29u, 30u, 31u, 45u, 46u, 120u})
+                                {
+                                    Vu1Fixture nativeMemory, oracleMemory;
+                                    t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "natural loop fixtures initialize");
+                                    const uint32_t codeSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_SIZE : PS2_VU0_CODE_SIZE;
+                                    const uint32_t dataSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_DATA_SIZE : PS2_VU0_DATA_SIZE;
+                                    const uint32_t start = phase * 8u;
+                                    for (auto *fx : {&nativeMemory, &oracleMemory})
+                                    {
+                                        if (unit == VU1Interpreter::Unit::VU0)
+                                        {
+                                            fx->code = fx->mem.getVU0Code();
+                                            fx->data = fx->mem.getVU0Data();
+                                        }
+                                        for (unsigned pc = 0; pc < codeSize; pc += 8u)
+                                            writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                                        writeEarlyCounterLoopCode(*fx);
+                                        std::memmove(fx->code + start, fx->code, 56u);
+                                        for (unsigned pc = 0; pc < start; pc += 8u)
+                                            writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                                        writeVuInstructionPair(fx->code, start + 56u, 0x40000000u,
+                                            makeVuUpper(0x1eu, 15u, 0u, 16u, 27u) | 0x80000000u);
+                                        writeVuInstructionPair(fx->code, start + 64u, immediate,
+                                            makeVuUpper(0x22u, 12u, 0u, 17u, 28u) | 0x80000000u);
+                                        writeVuInstructionPair(fx->code, start + 72u, 0x8000033cu,
+                                            makeVuUpper(0x1eu, 12u, 0u, 28u, 29u));
+                                        writeVuInstructionPair(fx->code, start + 80u,
+                                            (opcode << 25u) | (11u << 16u) | (12u << 11u) | (-11 & 0x7ff),
+                                            makeVuUpperSpecial(0x1bu, 14u, 0u, 22u));
+                                        writeVuInstructionPair(fx->code, start + 88u, makeVuSq(15u, 25u, 11u, -7),
+                                            makeVuUpperSpecial(0x08u, 14u, 23u, 18u));
+                                        for (unsigned byte = 0; byte < dataSize; ++byte)
+                                            fx->data[byte] = static_cast<uint8_t>(byte * 23u + 5u);
+                                    }
+                                    VU1Interpreter native(unit), oracle(unit);
+                                    oracle.setCompiledExecutionEnabled(false);
+                                    uint32_t random = 0x783bd519u;
+                                    for (unsigned reg = 1; reg < 32u; ++reg)
+                                        for (unsigned lane = 0; lane < 4u; ++lane)
+                                        {
+                                            random = random * 1664525u + 1013904223u;
+                                            native.state().vf[reg][lane] = std::bit_cast<float>(random);
+                                        }
+                                    native.state().i = 5.0f;
+                                    native.state().vi[10] = 11;
+                                    native.state().vi[11] = 32766;
+                                    const unsigned expectedTrips = opcode == 0x29u ? trips : trips == 1u ? 1u : 2u;
+                                    native.state().vi[12] = static_cast<int16_t>(32766 +
+                                        (opcode == 0x29u ? 5u * trips : trips == 1u ? 10u : 5u));
+                                    native.state().branchTarget = 0x1238u;
+                                    native.state().status = 0xa50u;
+                                    native.state().clip = 0xa5a5a5u;
+                                    oracle.state() = native.state();
+                                    const uint64_t before = ps2_vu_detail::countedLoopPairs;
+                                    native.execute(nativeMemory.code, codeSize, nativeMemory.data, dataSize,
+                                        nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, phase + budget);
+                                    oracle.execute(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
+                                        oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, phase + budget);
+                                    if (std::getenv("PS2_VU_REQUIRE_NATURAL_LOOPS"))
+                                        t.Equals(ps2_vu_detail::countedLoopPairs - before,
+                                            uint64_t{12u} * std::min(expectedTrips, budget / 15u),
+                                            "complete stalled iterations must enter the retained natural-loop path");
+                                    for (unsigned tail = 0; tail < 9u; ++tail)
+                                    {
+                                        t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                            "LOI old-I arithmetic, loop-carried I, branches and all delayed flags must match raw state");
+                                        t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, dataSize) == 0,
+                                            "loop-carried I must retain exact stored result bits");
+                                        native.resume(nativeMemory.code, codeSize, nativeMemory.data, dataSize,
+                                            nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 1u);
+                                        oracle.resume(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
+                                            oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 1u);
+                                    }
+                                }
+        });
+
         tc.Run("static region timestamps reject wrap and retire at the clock limit", [](TestCase &t)
         {
             constexpr uint64_t limit = UINT64_MAX;
@@ -465,6 +907,79 @@ void register_ps2_vu1_tests()
                 }
             }
         });
+        tc.Run("static clip readers observe incoming and local delayed flag versions", [](TestCase &t)
+        {
+            for (unsigned phase = 0; phase < 8u; ++phase)
+                for (unsigned budget : {1u, 3u, 4u, 7u, 11u, 12u, 13u})
+                {
+                    Vu1Fixture nativeMemory, oracleMemory;
+                    t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "clip fixtures initialize");
+                    const uint32_t upper[12] = {
+                        makeVuUpperSpecial(0x1fu, 15u, 2u, 1u),
+                        makeVuUpperSpecial(0x1fu, 15u, 4u, 3u), kVuUpperNop, kVuUpperNop,
+                        makeVuUpperSpecial(0x1fu, 15u, 1u, 2u), kVuUpperNop, kVuUpperNop,
+                        makeVuUpperSpecial(0x1fu, 15u, 3u, 4u), kVuUpperNop, kVuUpperNop,
+                        makeVuUpperSpecial(0x1fu, 15u, 3u, 1u), kVuUpperNop};
+                    const uint32_t lower[12] = {
+                        0x38020000u, 0x38030000u, 0x38040000u, 0x38050000u,
+                        0x38060000u, 0x38070000u, 0x24100000u, 0x0b010000u,
+                        0x26feffffu, 0x0b010001u, 0x20ffffffu, 0x38080000u};
+                    for (auto *fx : {&nativeMemory, &oracleMemory})
+                    {
+                        for (unsigned index = 0; index < phase + 24u; ++index)
+                            writeVuInstructionPair(fx->code, index * 8u, 0x8000033cu, kVuUpperNop);
+                        writeVuInstructionPair(fx->code, phase * 8u, 0x22123456u, kVuUpperNop);
+                        writeVuInstructionPair(fx->code, (phase + 1u) * 8u,
+                            makeVuFlagImmediate(0x15u, 0u, 0xac0u), makeVuUpperSpecial(0x1fu, 15u, 4u, 1u));
+                        writeVuInstructionPair(fx->code, (phase + 2u) * 8u,
+                            0x22654321u, makeVuUpperSpecial(0x1fu, 15u, 2u, 3u));
+                        for (unsigned index = 0; index < 12u; ++index)
+                            writeVuInstructionPair(fx->code, (phase + 3u + index) * 8u, lower[index], upper[index]);
+                        for (unsigned index = 0; index < 8u; ++index)
+                            writeVuInstructionPair(fx->code, (phase + 15u + index) * 8u,
+                                0x0b000000u | ((index < 7u ? index + 2u : 1u) << 16u) | (index + 2u), kVuUpperNop);
+                    }
+                    VU1Interpreter native, oracle;
+                    oracle.setCompiledExecutionEnabled(false);
+                    for (unsigned reg = 1; reg < 5u; ++reg)
+                        for (unsigned lane = 0; lane < 4u; ++lane)
+                            native.state().vf[reg][lane] = static_cast<float>(
+                                (static_cast<int>(reg * 3u + lane + phase) % 9) - 4);
+                    native.state().vf[2][3] = 1.0f;
+                    native.state().vf[4][3] = 2.0f;
+                    native.state().clip = 0xabcdefu;
+                    native.state().status = 0x135u;
+                    oracle.state() = native.state();
+                    native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                        nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, phase + 3u);
+                    oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                        oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, phase + 3u);
+                    const uint64_t accepted = ps2_vu_detail::regionCounters.accepted[1];
+                    for (unsigned step = 0; step < 9u; ++step)
+                    {
+                        const unsigned cycles = step == 0u ? budget : 1u;
+                        if (step != 0u) native.setCompiledExecutionEnabled(false);
+                        native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                            nativeMemory.gs, &nativeMemory.mem, 0u, 0u, cycles);
+                        oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                            oracleMemory.gs, &oracleMemory.mem, 0u, 0u, cycles);
+                        t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                            "CLIP/FCSET issue history and every visible delayed flag version match");
+                        t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                            "flag-dependent stores match at every raw continuation");
+                        if (step == 0u && std::getenv("PS2_VU_REQUIRE_REGIONS"))
+                            t.Equals(ps2_vu_detail::regionCounters.accepted[1] - accepted,
+                                budget >= 12u ? uint64_t{12} : budget >= 4u ? uint64_t{4} : uint64_t{0},
+                                "clip readers genuinely take the complete region or bounded first-four fallback");
+                        if (step == 0u && budget >= 12u)
+                        {
+                            t.Equals(native.state().vi[2], int32_t{0xdef}, "first reader sees entry CLIP");
+                            t.Equals(native.state().vi[3], int32_t{0x456}, "second reader sees first pending FCSET");
+                            t.Equals(native.state().vi[5], int32_t{0x321}, "fourth reader sees final pending FCSET");
+                        }
+                    }
+                }
+        });
         tc.Run("static SSA LOI retains old I operands and publishes normalized immediates", [](TestCase &t)
         {
             for (unsigned phase = 0u; phase < 8u; ++phase)
@@ -529,6 +1044,421 @@ void register_ps2_vu1_tests()
                     }
                 }
         });
+        tc.Run("counted loops retain register versions and exact delayed exits", [](TestCase &t)
+        {
+            for (unsigned trips : {1u, 2u, 9u})
+                for (int initial : {13, 32766})
+                    for (bool alias : {false, true})
+                        for (unsigned budget : {0u, 1u, 6u, 7u, 8u, 13u, 14u, 15u, 20u, 21u, 22u, 70u, 71u})
+                        {
+                            Vu1Fixture nativeMemory, oracleMemory;
+                            t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "loop fixtures initialize");
+                            for (auto *fx : {&nativeMemory, &oracleMemory})
+                            {
+                                for (unsigned pc = 0; pc < 0x400u; pc += 8u)
+                                    writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                                writeCountedLoopCode(*fx);
+                                for (unsigned offset = 0; offset < PS2_VU1_DATA_SIZE; offset += 4u)
+                                {
+                                    const uint32_t value = 0x8010203u ^ (offset * 0x10203u);
+                                    std::memcpy(fx->data + offset, &value, sizeof(value));
+                                }
+                            }
+                            VU1Interpreter native, oracle;
+                            oracle.setCompiledExecutionEnabled(false);
+                            for (unsigned reg = 1; reg < 32u; ++reg)
+                                for (unsigned lane = 0; lane < 4u; ++lane)
+                                    native.state().vf[reg][lane] = static_cast<float>(reg * (lane + 1u)) * 0.03125f;
+                            native.state().vi[10] = static_cast<int16_t>(initial);
+                            native.state().vi[11] = static_cast<int16_t>(initial + (alias ? 0 : 7));
+                            native.state().vi[12] = static_cast<int16_t>(initial + (alias ? 0 : 15));
+                            native.state().vi[13] = static_cast<int16_t>(initial + trips - 1u);
+                            native.state().status = 0xa50u;
+                            native.state().clip = 0xabcdeu;
+                            oracle.state() = native.state();
+                            const uint64_t accepted = ps2_vu_detail::countedLoopPairs;
+                            native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                           nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, budget);
+                            oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                           oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, budget);
+                            if (std::getenv("PS2_VU_REQUIRE_COUNTED_LOOPS"))
+                                t.Equals(ps2_vu_detail::countedLoopPairs - accepted,
+                                    static_cast<uint64_t>(7u * std::min(trips, budget / 7u)),
+                                    "complete iterations execute in the retained loop path");
+                            for (unsigned step = 0; step < 10u; ++step)
+                            {
+                                const bool stateEqual = std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0;
+                                const bool dataEqual = std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0;
+                                if (!stateEqual || !dataEqual)
+                                    std::fprintf(stderr, "loop mismatch trips=%u initial=%d alias=%u budget=%u step=%u pc=%u/%u cycle=%llu/%llu\n",
+                                        trips, initial, alias, budget, step, native.state().pc, oracle.state().pc,
+                                        static_cast<unsigned long long>(native.state().cycles),
+                                        static_cast<unsigned long long>(oracle.state().cycles));
+                                t.IsTrue(stateEqual, "visible and pending loop results match raw execution at each boundary");
+                                t.IsTrue(dataEqual, "loop loads and delay-slot stores retain alias ordering");
+                                native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                              nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 1u);
+                                oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                              oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 1u);
+                            }
+                        }
+        });
+        tc.Run("counted loops reenter through pending tails with raw operand bits", [](TestCase &t)
+        {
+            uint32_t random = 0x61e04abdu;
+            const auto next = [&]() {
+                random ^= random << 13u;
+                random ^= random >> 17u;
+                random ^= random << 5u;
+                return random;
+            };
+            for (unsigned trial = 0u; trial < 128u; ++trial)
+            {
+                Vu1Fixture nativeMemory, oracleMemory;
+                t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "reentry fixtures initialize");
+                for (auto *fx : {&nativeMemory, &oracleMemory})
+                    writeCountedLoopCode(*fx);
+                for (unsigned offset = 0u; offset < PS2_VU1_DATA_SIZE; offset += 4u)
+                {
+                    const uint32_t value = next();
+                    std::memcpy(nativeMemory.data + offset, &value, sizeof(value));
+                    std::memcpy(oracleMemory.data + offset, &value, sizeof(value));
+                }
+                VU1Interpreter native, oracle;
+                oracle.setCompiledExecutionEnabled(false);
+                for (unsigned reg = 1u; reg < 32u; ++reg)
+                    for (unsigned lane = 0u; lane < 4u; ++lane)
+                        native.state().vf[reg][lane] = std::bit_cast<float>(next());
+                for (unsigned lane = 0u; lane < 4u; ++lane)
+                    native.state().acc[lane] = std::bit_cast<float>(next());
+                const int16_t initial = static_cast<int16_t>(next());
+                native.state().vi[10] = initial;
+                native.state().vi[11] = static_cast<int16_t>(next());
+                native.state().vi[12] = static_cast<int16_t>(next());
+                native.state().vi[13] = static_cast<int16_t>(initial + 24);
+                native.state().status = next() & 0xfffu;
+                native.state().mac = next() & 0xffffu;
+                native.state().clip = next() & 0xffffffu;
+                oracle.state() = native.state();
+                unsigned step = 0u;
+                for (unsigned budget : {7u, 7u, 14u, 1u, 6u, 21u, 2u, 5u, 7u, 7u, 70u, 7u})
+                {
+                    const uint64_t accepted = ps2_vu_detail::countedLoopPairs;
+                    if (step == 0u)
+                    {
+                        native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                       nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, budget);
+                        oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                       oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, budget);
+                    }
+                    else
+                    {
+                        native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                      nativeMemory.gs, &nativeMemory.mem, 0u, 0u, budget);
+                        oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                      oracleMemory.gs, &oracleMemory.mem, 0u, 0u, budget);
+                    }
+                    t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                             "retained loop reentry preserves all visible state and the +1/+2/+3 tails");
+                    t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                             "raw bit patterns preserve exact load/store and masked-lane results");
+                    if (step < 3u && std::getenv("PS2_VU_REQUIRE_COUNTED_LOOPS"))
+                        t.Equals(ps2_vu_detail::countedLoopPairs - accepted, static_cast<uint64_t>(budget),
+                                 "each initial bounded resume reenters the retained loop with pending VF writes");
+                    ++step;
+                }
+            }
+        });
+        tc.Run("counted-loop branches use the preceding VI write backup", [](TestCase &t)
+        {
+            for (int initial : {13, 32767})
+                for (int distance : {0, 1})
+                    for (unsigned budget : {6u, 7u, 14u, 21u})
+                    {
+                        Vu1Fixture nativeMemory, oracleMemory;
+                        t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "branch fixtures initialize");
+                        for (auto *fx : {&nativeMemory, &oracleMemory})
+                        {
+                            writeCountedLoopCode(*fx);
+                            writeVuInstructionPair(fx->code, 40u, makeVuIbne(11u, 10u, -6),
+                                makeVuUpperSpecial(0x13u, 14u, 24u, 25u));
+                        }
+                        VU1Interpreter native, oracle;
+                        oracle.setCompiledExecutionEnabled(false);
+                        native.state().vi[10] = static_cast<int16_t>(initial);
+                        native.state().vi[11] = static_cast<int16_t>(initial + distance);
+                        native.state().vi[12] = 30;
+                        oracle.state() = native.state();
+                        const uint64_t accepted = ps2_vu_detail::countedLoopPairs;
+                        native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                       nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, budget);
+                        oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                       oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, budget);
+                        if (std::getenv("PS2_VU_REQUIRE_COUNTED_LOOPS"))
+                            t.Equals(ps2_vu_detail::countedLoopPairs - accepted,
+                                static_cast<uint64_t>(7u * (distance == 0 ? std::min(1u, budget / 7u) : budget / 7u)),
+                                "the branch-backup fixture enters the retained loop");
+                        for (unsigned step = 0; step < 10u; ++step)
+                        {
+                            t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                     "IBNE compares the old VI value before SQI and its delay slot");
+                            t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                                     "branch backup does not reorder stores");
+                            native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                          nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 1u);
+                            oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                          oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 1u);
+                        }
+                    }
+        });
+        tc.Run("counted loops yield to code replacement between budgets", [](TestCase &t)
+        {
+            for (uint32_t patchPC : {0u, 32u, 40u, 48u})
+            {
+                Vu1Fixture nativeMemory, oracleMemory;
+                t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "invalidation fixtures initialize");
+                for (auto *fx : {&nativeMemory, &oracleMemory})
+                    writeCountedLoopCode(*fx);
+                VU1Interpreter native, oracle;
+                oracle.setCompiledExecutionEnabled(false);
+                native.state().vi[10] = 13;
+                native.state().vi[11] = 20;
+                native.state().vi[12] = 30;
+                native.state().vi[13] = 100;
+                oracle.state() = native.state();
+                for (unsigned step = 0; step < 2u; ++step)
+                {
+                    const uint64_t accepted = ps2_vu_detail::countedLoopPairs;
+                    if (step == 0u)
+                    {
+                        native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                       nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, 21u);
+                        oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                       oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, 21u);
+                    }
+                    else
+                    {
+                        for (auto *fx : {&nativeMemory, &oracleMemory})
+                            writeTrackedVuInstructionPair(*fx, patchPC, makeVuIaddiu(15u, 0u, 123), kVuUpperNop);
+                        native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                      nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 7u);
+                        oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                      oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 7u);
+                    }
+                    t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                             "code generation invalidates the old loop before another iteration");
+                    t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                             "invalidation preserves pending stores and VF tails");
+                    if (std::getenv("PS2_VU_REQUIRE_COUNTED_LOOPS"))
+                        t.Equals(ps2_vu_detail::countedLoopPairs - accepted, step == 0u ? uint64_t{21u} : uint64_t{0u},
+                                 "only the original code image uses the compiled loop");
+                }
+                t.Equals(native.state().vi[15], 123, "replacement instruction executes");
+            }
+        });
+        tc.Run("counted loops fall back while XGKICK can replace code", [](TestCase &t)
+        {
+            Vu1Fixture nativeMemory, oracleMemory;
+            t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "XGKICK fixtures initialize");
+            std::vector<std::vector<uint8_t>> nativePackets, oraclePackets;
+            const auto setup = [&](Vu1Fixture &fx, std::vector<std::vector<uint8_t>> &packets) {
+                writeVuInstructionPair(fx.code, 0u, makeVuLowerSpecial(0x6cu, 14u), kVuUpperNop);
+                writeCountedLoopCode(fx, 8u);
+                const uint64_t tag = makeGifTag(4u, GIF_FMT_IMAGE, 0u, true);
+                std::memcpy(fx.data + 800u * 16u, &tag, sizeof(tag));
+                fx.mem.setGifPacketCallback([&fx, &packets](const uint8_t *data, uint32_t size) {
+                    packets.emplace_back(data, data + size);
+                    writeTrackedVuInstructionPair(fx, 16u, makeVuIaddiu(15u, 0u, 321), kVuUpperNop);
+                });
+            };
+            setup(nativeMemory, nativePackets);
+            setup(oracleMemory, oraclePackets);
+            VU1Interpreter native, oracle;
+            oracle.setCompiledExecutionEnabled(false);
+            native.state().vi[10] = 13;
+            native.state().vi[11] = 20;
+            native.state().vi[12] = 30;
+            native.state().vi[13] = 100;
+            native.state().vi[14] = 800;
+            oracle.state() = native.state();
+            const uint64_t accepted = ps2_vu_detail::countedLoopPairs;
+            native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                           nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, 1u);
+            oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                           oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, 1u);
+            for (unsigned step = 0; step < 4u; ++step)
+            {
+                native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                              nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 7u);
+                oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                              oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 7u);
+                t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                         "live PATH1 progress retains exact callback and code-change boundaries");
+                t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                         "PATH1 fallback preserves loop store ordering");
+                t.IsTrue(nativePackets == oraclePackets, "PATH1 captures exact bytes at the original cycles");
+                t.Equals(ps2_vu_detail::countedLoopPairs - accepted, uint64_t{0u},
+                         "live XGKICK and then the changed code reject the compiled loop");
+            }
+            t.Equals(nativePackets.size(), size_t{1u}, "XGKICK callback actually ran");
+            t.Equals(native.state().vi[15], 321, "callback replacement executed");
+        });
+        tc.Run("counted loops reject cyclic cancellation before visibility", [](TestCase &t)
+        {
+            for (bool integer : {false, true})
+                for (unsigned budget : {7u, 14u, 21u, 22u, 23u, 24u})
+                {
+                    Vu1Fixture nativeMemory, oracleMemory;
+                    t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "cancellation fixtures initialize");
+                    for (auto *fx : {&nativeMemory, &oracleMemory})
+                    {
+                        for (unsigned index = 0; index < 16u; ++index)
+                            writeVuInstructionPair(fx->code, index * 8u, 0x8000033cu, kVuUpperNop);
+                        if (integer)
+                        {
+                            for (unsigned index : {0u, 2u, 4u})
+                                writeVuInstructionPair(fx->code, index * 8u, makeVuIlw(8u, 14u, 0u, 2), kVuUpperNop);
+                        }
+                        else
+                        {
+                            for (unsigned index : {0u, 3u, 6u})
+                                writeVuInstructionPair(fx->code, index * 8u, 0x8000033cu,
+                                    makeVuUpper(0x28u, 8u, 17u, 16u, 20u));
+                        }
+                        writeVuInstructionPair(fx->code, 40u, makeVuIbne(13u, 10u, -6), kVuUpperNop);
+                        writeVuInstructionPair(fx->code, 48u, makeVuLowerSpecial(0x35u, 25u, 10u, 0u, 8u),
+                            integer ? kVuUpperNop : makeVuUpper(0x28u, 8u, 17u, 16u, 20u));
+                        const uint32_t value = 567u;
+                        std::memcpy(fx->data + 32u, &value, sizeof(value));
+                    }
+                    VU1Interpreter native, oracle;
+                    oracle.setCompiledExecutionEnabled(false);
+                    native.state().vi[10] = 20;
+                    native.state().vi[13] = 22;
+                    native.state().vi[14] = 123;
+                    native.state().vf[16][0] = 1.0f;
+                    native.state().vf[17][0] = 2.0f;
+                    native.state().vf[20][0] = 7.0f;
+                    oracle.state() = native.state();
+                    const uint64_t accepted = ps2_vu_detail::countedLoopPairs;
+                    native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                   nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, budget);
+                    oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                   oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, budget);
+                    t.Equals(ps2_vu_detail::countedLoopPairs - accepted, uint64_t{0u},
+                             "a next-iteration write that cancels an incoming tail rejects loop retention");
+                    for (unsigned step = 0; step < 6u; ++step)
+                    {
+                        t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                 "canceled tail values must not become architecturally visible");
+                        native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                      nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 1u);
+                        oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                      oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 1u);
+                    }
+                }
+        });
+        tc.Run("early counter loops retain ACC and exact masked flag tails", [](TestCase &t)
+        {
+            uint32_t random = 0x7293bd41u;
+            const auto next = [&]() {
+                random ^= random << 13u;
+                random ^= random >> 17u;
+                random ^= random << 5u;
+                return random;
+            };
+            for (int initial : {13, 32760})
+                for (unsigned trips : {1u, 2u, 7u})
+                    for (unsigned budget : {0u, 1u, 8u, 9u, 10u, 17u, 18u, 19u, 26u, 27u, 28u, 63u, 64u})
+                    {
+                        Vu1Fixture nativeMemory, oracleMemory;
+                        t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "early counter fixtures initialize");
+                        for (auto *fx : {&nativeMemory, &oracleMemory})
+                        {
+                            for (unsigned pc = 0u; pc < 0x400u; pc += 8u)
+                                writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                            writeEarlyCounterLoopCode(*fx);
+                            writeVuInstructionPair(fx->code, 72u, makeVuIbne(11u, 12u, 2), kVuUpperNop);
+                        }
+                        for (unsigned offset = 0u; offset < PS2_VU1_DATA_SIZE; offset += 4u)
+                        {
+                            const uint32_t value = next();
+                            std::memcpy(nativeMemory.data + offset, &value, sizeof(value));
+                            std::memcpy(oracleMemory.data + offset, &value, sizeof(value));
+                        }
+                        VU1Interpreter native, oracle;
+                        oracle.setCompiledExecutionEnabled(false);
+                        for (unsigned reg = 1u; reg < 32u; ++reg)
+                            for (unsigned lane = 0u; lane < 4u; ++lane)
+                                native.state().vf[reg][lane] = std::bit_cast<float>(next());
+                        for (unsigned lane = 0u; lane < 4u; ++lane)
+                            native.state().acc[lane] = std::bit_cast<float>(next());
+                        native.state().vi[10] = static_cast<int16_t>(initial - 2);
+                        native.state().vi[11] = static_cast<int16_t>(initial);
+                        native.state().vi[12] = static_cast<int16_t>(initial + 5 * trips);
+                        native.state().mac = next() & 0xffffu;
+                        native.state().status = next() & 0xfffu;
+                        oracle.state() = native.state();
+                        const uint64_t accepted = ps2_vu_detail::countedLoopPairs;
+                        native.execute(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                       nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, budget);
+                        oracle.execute(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                       oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, budget);
+                        if (std::getenv("PS2_VU_REQUIRE_COUNTED_LOOPS"))
+                            t.Equals(ps2_vu_detail::countedLoopPairs - accepted,
+                                     static_cast<uint64_t>(9u * std::min(trips, budget / 9u)),
+                                     "whole nine-pair iterations use retained ACC and early-counter execution");
+                        for (unsigned step = 0u; step < 10u; ++step)
+                        {
+                            t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                     "ACC, masked VF results and FMAC flags match at every delayed boundary");
+                            t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                                     "SQ uses the updated signed counter after LQI and masked MOVE");
+                            native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                          nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 1u);
+                            oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                          oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 1u);
+                        }
+                    }
+        });
+        tc.Run("early counter loops reenter and invalidate every late pair", [](TestCase &t)
+        {
+            for (unsigned patchPC : {32u, 40u, 48u, 56u, 64u})
+            {
+                Vu1Fixture nativeMemory, oracleMemory;
+                t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "early counter reentry fixtures initialize");
+                for (auto *fx : {&nativeMemory, &oracleMemory})
+                    writeEarlyCounterLoopCode(*fx);
+                VU1Interpreter native, oracle;
+                oracle.setCompiledExecutionEnabled(false);
+                native.state().vi[10] = 22;
+                native.state().vi[11] = 24;
+                native.state().vi[12] = 200;
+                for (unsigned reg = 1u; reg < 32u; ++reg)
+                    for (unsigned lane = 0u; lane < 4u; ++lane)
+                        native.state().vf[reg][lane] = static_cast<float>(reg + lane) * 0.125f;
+                oracle.state() = native.state();
+                for (unsigned step = 0u; step < 4u; ++step)
+                {
+                    const uint64_t accepted = ps2_vu_detail::countedLoopPairs;
+                    if (step == 3u)
+                        for (auto *fx : {&nativeMemory, &oracleMemory})
+                            writeTrackedVuInstructionPair(*fx, patchPC, makeVuIaddiu(15u, 0u, 123), kVuUpperNop);
+                    native.resume(nativeMemory.code, PS2_VU1_CODE_SIZE, nativeMemory.data, PS2_VU1_DATA_SIZE,
+                                  nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 9u);
+                    oracle.resume(oracleMemory.code, PS2_VU1_CODE_SIZE, oracleMemory.data, PS2_VU1_DATA_SIZE,
+                                  oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 9u);
+                    t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                             "resumed ACC/flag/VF tails and late counter-loop edits match raw execution");
+                    t.IsTrue(std::memcmp(nativeMemory.data, oracleMemory.data, PS2_VU1_DATA_SIZE) == 0,
+                             "late-pair invalidation retains exact load/store order");
+                    if (std::getenv("PS2_VU_REQUIRE_COUNTED_LOOPS"))
+                        t.Equals(ps2_vu_detail::countedLoopPairs - accepted, step < 3u ? uint64_t{9u} : uint64_t{0u},
+                                 "nine-pair reentry is active until any late instruction changes");
+                }
+                t.Equals(native.state().vi[15], 123, "late replacement executes");
+            }
+        });
         tc.Run("upper ADD applies the destination mask", [](TestCase &t)
         {
             Vu1Fixture fx;
diff --git a/ps2xTest/src/ps2_vu1_upper_engine_tests.cpp b/ps2xTest/src/ps2_vu1_upper_engine_tests.cpp
index eebd69dcd..b77263d9e 100644
--- a/ps2xTest/src/ps2_vu1_upper_engine_tests.cpp
+++ b/ps2xTest/src/ps2_vu1_upper_engine_tests.cpp
@@ -99,6 +99,151 @@ bool equalOutputs(const VU1State &a, const VU1State &b) {
 
 void register_ps2_vu1_upper_engine_tests() {
     MiniTest::Case("PS2VU1UpperEngine", [](TestCase &tc) {
+        tc.Run("packed FMAC flags preserve every lane condition, mask and sticky input", [](TestCase &t) {
+            const auto reference = [](const uint8_t flags[4], unsigned mask) {
+                std::array<uint32_t, 2> result{};
+                for (unsigned lane = 0; lane < 4u; ++lane) {
+                    const unsigned laneBit = 8u >> lane;
+                    if ((mask & laneBit) == 0u) continue;
+                    for (unsigned flag = 0; flag < 4u; ++flag)
+                        if (flags[lane] & (1u << flag)) result[0] |= laneBit << (flag * 4u);
+                    result[1] |= flags[lane];
+                }
+                return result;
+            };
+            unsigned comparisons = 0;
+            for (unsigned bits = 0; bits < 65536u; ++bits) {
+                const uint8_t flags[]{uint8_t(bits & 15u), uint8_t((bits >> 4u) & 15u),
+                                      uint8_t((bits >> 8u) & 15u), uint8_t(bits >> 12u)};
+                for (unsigned mask = 0; mask < 16u; ++mask) {
+                    const auto expected = reference(flags, mask);
+                    const auto actual = ps2_vu_detail::packFmacFlags(flags, mask);
+                    if (actual.mac != expected[0] || actual.status != expected[1]) {
+                        t.Fail("packed flags differ from independent lane/condition reference");
+                        return;
+                    }
+                    ++comparisons;
+                }
+            }
+            uint32_t random = 0xd174386fu;
+            for (unsigned seed = 0; seed < 262144u; ++seed) {
+                random ^= random << 13u; random ^= random >> 17u; random ^= random << 5u;
+                uint8_t flags[4];
+                std::memcpy(flags, &random, sizeof(flags));
+                const unsigned mask = seed & 15u;
+                const auto expected = reference(flags, mask);
+                const auto actual = ps2_vu_detail::packFmacFlags(flags, mask);
+                if (actual.mac != expected[0] || actual.status != expected[1]) {
+                    t.Fail("masked lanes or high status bits differ");
+                    return;
+                }
+                ++comparisons;
+            }
+            struct Sink {
+                unsigned calls = 0;
+                uint32_t mac = 0x1357u, status = 0xa50u, extra = 0xabcdefu;
+                void fmac(uint32_t m, uint32_t s, uint32_t e) { ++calls; mac = m; status = s; extra = e; }
+            };
+            const uint8_t flags[]{1u, 2u, 4u, 8u};
+            for (unsigned mask = 0; mask < 16u; ++mask)
+                for (unsigned sticky = 0; sticky < 16u; ++sticky) {
+                    Sink sink;
+                    ps2_vu_detail::upper::publishFmacFlags(sink, flags, mask, sticky);
+                    const auto expected = reference(flags, mask);
+                    if (mask == 0u) {
+                        t.Equals(sink.calls, 0u, "empty mask preserves pending flags");
+                        t.Equals(sink.extra, 0xabcdefu, "empty mask does not publish sticky conditions");
+                    } else {
+                        t.Equals(sink.calls, 1u, "exactly one flag publication");
+                        t.Equals(sink.mac, expected[0], "architectural lane order");
+                        t.Equals(sink.status, expected[1], "current flags remain separate from sticky input");
+                        t.Equals(sink.extra, sticky, "product underflow and overflow sticky inputs pass through");
+                    }
+                }
+            t.Equals(comparisons, 1310720u, "all independent flag cases executed");
+        });
+#if defined(__aarch64__)
+        tc.Run("simple SIMD forces safe results and rejects exact-result boundaries", [](TestCase &t) {
+            const int oldRounding = std::fegetround();
+            struct Restore { int mode; ~Restore() { std::fesetround(mode); } } restore{oldRounding};
+            std::fesetround(FE_TOWARDZERO);
+            using Arithmetic = ps2_vu_detail::SimpleArithmetic;
+            const auto check = [&]<Arithmetic operation>(float left, float right, bool expected) {
+                float l[4]{left, left, left, left}, r[4]{right, right, right, right};
+                float output[4]{123, 123, 123, 123};
+                uint8_t flags[4]{0xff, 0xff, 0xff, 0xff};
+                const bool accepted = ps2_vu_detail::trySimpleArithmeticVector<operation>(l, r, 15u, output, flags);
+                t.Equals(accepted, expected, "fixture forces the intended vector or exact fallback path");
+                if (!expected) {
+                    t.Equals(output[0], 123.0f, "rejected vector path leaves output unpublished");
+                    t.Equals(flags[0], uint8_t{0xff}, "rejected vector path leaves flags unpublished");
+                }
+            };
+            check.template operator()<Arithmetic::Add>(1.0f, 2.0f, true);
+            check.template operator()<Arithmetic::Add>(1.0f, -1.0f, true);
+            check.template operator()<Arithmetic::Subtract>(1.0f, 1.0f, true);
+            check.template operator()<Arithmetic::Multiply>(-0.0f, 2.0f, true);
+            check.template operator()<Arithmetic::Multiply>(rawFloat(0x7f800000u), 0.5f, true);
+            check.template operator()<Arithmetic::Multiply>(rawFloat(0x00800000u), 0.5f, false);
+            check.template operator()<Arithmetic::Multiply>(rawFloat(0x00800000u), rawFloat(0x00800000u), false);
+            check.template operator()<Arithmetic::Multiply>(rawFloat(0x7f7fffffu), 2.0f, false);
+            check.template operator()<Arithmetic::Subtract>(rawFloat(0x00800001u), rawFloat(0x00800000u), false);
+            for (int rounding : {FE_TONEAREST, FE_TOWARDZERO, FE_UPWARD, FE_DOWNWARD}) {
+                std::fesetround(rounding);
+                check.template operator()<Arithmetic::Multiply>(rawFloat(0x00800000u), rawFloat(0x3f7fffffu), false);
+                check.template operator()<Arithmetic::Multiply>(rawFloat(0x80800000u), rawFloat(0x3f7fffffu), false);
+            }
+        });
+        tc.Run("accepted simple SIMD lanes match scalar arithmetic over varied bits and masks", [](TestCase &t) {
+            const int oldRounding = std::fegetround();
+            struct Restore { int mode; ~Restore() { std::fesetround(mode); } } restore{oldRounding};
+            uint32_t random = 0x9328716bu;
+            const auto bits = [&] { random ^= random << 13u; random ^= random >> 17u; random ^= random << 5u; return random; };
+            unsigned acceptedCount = 0u, rejectedCount = 0u;
+            for (int rounding : {FE_TONEAREST, FE_TOWARDZERO, FE_UPWARD, FE_DOWNWARD}) {
+                std::fesetround(rounding);
+                for (unsigned operation = 0u; operation < 3u; ++operation)
+                    for (unsigned mask = 1u; mask < 16u; ++mask)
+                        for (unsigned seed = 0u; seed < 512u; ++seed) {
+                            VU1State initial{};
+                            for (unsigned lane = 0u; lane < 4u; ++lane) {
+                                initial.vf[1][lane] = rawFloat(bits());
+                                initial.vf[2][lane] = rawFloat(bits());
+                                if (seed % 8u == 0u) initial.vf[2][lane] = -initial.vf[1][lane];
+                                if (seed % 8u == 1u) initial.vf[2][lane] = lane & 1u ? -0.0f : 0.0f;
+                            }
+                            const uint32_t op = operation == 0u ? 0x28u : operation == 1u ? 0x2cu : 0x2au;
+                            const uint32_t instruction = (mask << 21u) | (2u << 16u) | (1u << 11u) | (3u << 6u) | op;
+                            auto oracle = initial;
+                            EngineInputs inputs{oracle, 1u, 2u, false};
+                            EngineSink sink{oracle};
+                            ps2_vu_detail::upper::computeUpper(instruction, inputs, sink);
+                            float result[4];
+                            uint8_t flags[4];
+                            using Arithmetic = ps2_vu_detail::SimpleArithmetic;
+                            const bool accepted = operation == 0u
+                                ? ps2_vu_detail::trySimpleArithmeticVector<Arithmetic::Add>(initial.vf[1], initial.vf[2], mask, result, flags)
+                                : operation == 1u
+                                ? ps2_vu_detail::trySimpleArithmeticVector<Arithmetic::Subtract>(initial.vf[1], initial.vf[2], mask, result, flags)
+                                : ps2_vu_detail::trySimpleArithmeticVector<Arithmetic::Multiply>(initial.vf[1], initial.vf[2], mask, result, flags);
+                            if (!accepted) { ++rejectedCount; continue; }
+                            ++acceptedCount;
+                            auto actual = initial;
+                            EngineSink actualSink{actual};
+                            ps2_vu_detail::upper::publishFmacFlags(actualSink, flags, mask, 0u);
+                            actualSink.vf(3u, mask, result);
+                            if (!equalOutputs(actual, oracle)) {
+                                char message[128];
+                                std::snprintf(message, sizeof(message), "accepted SIMD mismatch operation=%u mask=%u seed=%u rounding=%d", operation, mask, seed, rounding);
+                                t.Fail(message);
+                                return;
+                            }
+                        }
+            }
+            t.IsTrue(acceptedCount > 10000u && rejectedCount > 1000u, "property set exercises both paths extensively");
+            std::printf("Simple SIMD property: accepted=%u rejected=%u\n", acceptedCount, rejectedCount);
+        });
+#endif
         tc.Run("private arithmetic matches raw scalar execution for all upper opcodes", [](TestCase &t) {
             PS2Memory memory;
             t.IsTrue(memory.initialize(), "memory initializes");
@@ -128,6 +273,17 @@ void register_ps2_vu1_upper_engine_tests() {
                                 oracle.state() = initial;
                                 oracle.execute(reinterpret_cast<uint8_t *>(code.data()), sizeof(code),
                                     memory.getVU1Data(), PS2_VU1_DATA_SIZE, gs, &memory, 0u, 0u, 0u, 4u);
+                                VU1Interpreter ordinarySimd;
+                                ordinarySimd.setCompiledExecutionEnabled(true);
+                                ordinarySimd.state() = initial;
+                                ordinarySimd.execute(reinterpret_cast<uint8_t *>(code.data()), sizeof(code),
+                                    memory.getVU1Data(), PS2_VU1_DATA_SIZE, gs, &memory, 0u, 0u, 0u, 4u);
+                                if (std::memcmp(&ordinarySimd.state(), &oracle.state(), sizeof(VU1State)) != 0) {
+                                    char message[120];
+                                    std::snprintf(message, sizeof(message), "ordinary SIMD opcode=%08x seed=%u alias=%u", instr, seed, alias);
+                                    t.Fail(message);
+                                    return;
+                                }
                                 for (bool fast : {false, true}) {
                                     VU1State output = initial;
                                     EngineInputs inputs{output, fs, ft, fast};
diff --git a/tools/compile_vu_blocks.py b/tools/compile_vu_blocks.py
index 5c74fbbf2..37c9b94e2 100644
--- a/tools/compile_vu_blocks.py
+++ b/tools/compile_vu_blocks.py
@@ -10,11 +10,12 @@ def read_blocks(paths, parser):
     blocks = set()
     for path in paths:
         data = path.read_bytes()
-        if data.startswith((b"VU-BLOCKS 1\n", b"VU-BLOCKS 2\n")):
+        if data.startswith((b"VU-BLOCKS 1\n", b"VU-BLOCKS 2\n", b"VU-BLOCKS 3\n")):
             extended = data.startswith(b"VU-BLOCKS 2\n")
+            loops = data.startswith(b"VU-BLOCKS 3\n")
             for line in data.decode("ascii").splitlines()[1:]:
                 fields = line.split()
-                if len(fields) not in ((5, 9, 13, 17) if extended else (5,)):
+                if len(fields) not in (range(5, 18) if loops else (5, 9, 13, 17) if extended else (5,)):
                     parser.error(f"{path}: invalid block profile record")
                 try:
                     unit = int(fields[0])
@@ -36,6 +37,35 @@ def read_blocks(paths, parser):
     return blocks
 
 
+def read_counted_loops(paths, parser):
+    """Find bounded straight conditional backedges, including their delay slot.
+
+    Native planning applies the complete opcode, dependency and pipeline guards.
+    This pass only recognizes the reusable control-flow shape in local images.
+    """
+    blocks = set()
+    for path in paths:
+        data = path.read_bytes()
+        if len(data) not in (4096, 16384):
+            parser.error(f"{path}: expected a 4 KiB VU0 or 16 KiB VU1 code image")
+        unit = 0 if len(data) == 4096 else 1
+        words = [word for (word,) in struct.iter_unpack("<Q", data)]
+        for index in range(len(words) - 1):
+            branch = words[index] & 0xffffffff
+            if words[index] >> 63 or branch >> 25 not in (0x28, 0x29):
+                continue
+            offset = (branch & 0x7ff) - (0x800 if branch & 0x400 else 0)
+            head = index + 1 + offset
+            if head < 0 or not 4 <= index + 2 - head <= 16:
+                continue
+            if any(not word >> 63 and ((word & 0xffffffff) >> 25) in
+                   (0x20, 0x21, 0x24, 0x25, 0x28, 0x29, 0x2c, 0x2d, 0x2e, 0x2f)
+                   for word in words[head:index] + words[index+1:index+2]):
+                continue
+            blocks.add((tuple(words[head:index + 2]), unit))
+    return blocks
+
+
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--output", type=Path, required=True)
@@ -43,11 +73,13 @@ def main():
                         help="Emit this many independent native instantiation sources")
     parser.add_argument("--pair-images", type=Path, nargs="*", default=[],
                         help="Compile individual pairs from these images or profiles")
+    parser.add_argument("--loop-images", type=Path, nargs="*", default=[],
+                        help="Compile guarded straight loops from these local code images")
     parser.add_argument("images", type=Path, nargs="*")
     args = parser.parse_args()
     if args.shards < 0:
         parser.error("--shards must be nonnegative")
-    blocks = read_blocks(args.images, parser)
+    blocks = read_blocks(args.images, parser) | read_counted_loops(args.loop_images, parser)
     pair_blocks = blocks | read_blocks(args.pair_images, parser)
     pairs = {((word,), unit) for block, unit in pair_blocks for word in block}
     if not pairs:
diff --git a/tools/tests/test_compile_vu_blocks.py b/tools/tests/test_compile_vu_blocks.py
index 00c1f73a8..e2ac7f608 100644
--- a/tools/tests/test_compile_vu_blocks.py
+++ b/tools/tests/test_compile_vu_blocks.py
@@ -1,6 +1,7 @@
 """Check that separate native compilation units preserve registry coverage."""
 
 import re
+import struct
 import subprocess
 import sys
 import tempfile
@@ -9,6 +10,90 @@
 
 
 class CompileVuBlocksTests(unittest.TestCase):
+    def test_straight_backedges_do_not_require_a_particular_counter(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            script = Path(__file__).resolve().parents[1] / "compile_vu_blocks.py"
+            words = [0x000002ff8000033c] * 9
+            words[5] = (0x000002ff << 32) | (8 << 25) | (2 << 16) | (2 << 11) | 5
+            words[7] = (0x000002ff << 32) | (0x29 << 25) | (2 << 16) | (3 << 11) | (-8 & 0x7ff)
+            words[8] = (0x000002ff << 32) | (1 << 25) | (15 << 21) | (2 << 16) | (4 << 11) | (-7 & 0x7ff)
+            for mode in ("valid", "absent", "duplicate", "different-source"):
+                variant = words.copy()
+                if mode == "absent":
+                    variant[5] = 0x000002ff8000033c
+                elif mode == "duplicate":
+                    variant[4] = variant[5]
+                elif mode == "different-source":
+                    variant[5] ^= 1 << 11
+                data = bytearray(16384)
+                struct.pack_into("<9Q", data, 0, *variant)
+                image, output = root / "code.bin", root / "out.inc"
+                image.write_bytes(data)
+                result = subprocess.run([sys.executable, str(script), "--output", str(output),
+                                         "--loop-images", str(image)], capture_output=True, text=True)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                entries = re.findall(r"&runCompiledBlock<Unit::VU1, ([^>]+)>", output.read_text())
+                self.assertEqual(sum(entry.count("ull") == 9 for entry in entries), 1)
+
+    def test_counted_loop_discovery_matches_explicit_profiles_for_both_units(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            script = Path(__file__).resolve().parents[1] / "compile_vu_blocks.py"
+            for pairs in (4, 7, 16):
+                words = [0x000002ff8000033c] * pairs  # Authored NOP pairs.
+                words[-2] = (0x000002ff << 32) | (0x29 << 25) | (2 << 16) | (3 << 11) | ((1 - pairs) & 0x7ff)
+                words[-1] = (0x000002ff << 32) | 0x8000037d | (8 << 21) | (2 << 16) | (4 << 11)
+                for unit, size in ((0, 4096), (1, 16384)):
+                    image, profile = root / "code.bin", root / "loops.profile"
+                    data = bytearray(size)
+                    struct.pack_into("<" + "Q" * pairs, data, 24, *words)
+                    image.write_bytes(data)
+                    profile.write_text("VU-BLOCKS 3\n" + str(unit) + " " + " ".join(f"{word:016x}" for word in words) + "\n")
+                    outputs = []
+                    for name, inputs in (("image", ["--loop-images", str(image)]), ("profile", [str(profile)])):
+                        output = root / f"{name}.inc"
+                        subprocess.run([sys.executable, str(script), "--output", str(output), *inputs],
+                                       check=True, capture_output=True, text=True)
+                        outputs.append(output.read_text())
+                    self.assertEqual(outputs[0], outputs[1])
+
+    def test_straight_loop_discovery_rejects_invalid_edges_and_delay_branches(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            script = Path(__file__).resolve().parents[1] / "compile_vu_blocks.py"
+            branch = (0x000002ff << 32) | (0x29 << 25) | (2 << 16) | (3 << 11) | (-6 & 0x7ff)
+            delay = (0x000002ff << 32) | 0x8000037d | (8 << 21) | (2 << 16) | (4 << 11)
+            for bad_branch, bad_delay in (
+                (branch | (1 << 63), delay),  # LOI cannot encode a branch.
+                ((branch & ~0x7ff) | (1 & 0x7ff), delay),  # Forward edge.
+                ((branch & ~0x7ff) | (-16 & 0x7ff), delay),  # Head before this image.
+                (branch, (0x000002ff << 32) | (0x28 << 25) | 1),
+            ):
+                data = bytearray(16384)
+                struct.pack_into("<QQ", data, 40, bad_branch, bad_delay)
+                image = root / "code.bin"
+                image.write_bytes(data)
+                result = subprocess.run([sys.executable, str(script), "--output", str(root / "out.inc"),
+                                         "--loop-images", str(image)], capture_output=True, text=True)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertIn("no nonempty microcode blocks", result.stderr)
+
+    def test_straight_loop_discovery_handles_loi_and_equal_operands(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            script = Path(__file__).resolve().parents[1] / "compile_vu_blocks.py"
+            words = [0x81e0106240000000, 0x81e010de40400000,
+                     0x000002ff500007fd, 0x000002ff8000033c]
+            data = bytearray(16384)
+            struct.pack_into("<4Q", data, 0, *words)
+            image, output = root / "code.bin", root / "out.inc"
+            image.write_bytes(data)
+            subprocess.run([sys.executable, str(script), "--output", str(output),
+                            "--loop-images", str(image)], check=True, capture_output=True, text=True)
+            entries = re.findall(r"&runCompiledBlock<Unit::VU1, ([^>]+)>", output.read_text())
+            self.assertEqual(sum(entry.count("ull") == 4 for entry in entries), 1)
+
     def test_shards_preserve_registry_and_instantiate_every_entry_once(self):
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
@@ -76,7 +161,9 @@ def test_profile_length_and_word_bounds_are_rejected(self):
             profile, output = root / "invalid.profile", root / "blocks.inc"
             script = Path(__file__).resolve().parents[1] / "compile_vu_blocks.py"
             for header, words in [(1, "1 2 3 4 5 6 7 8"), (2, "1 2 3 4 5"),
-                                  (2, "1 2 3 10000000000000000"), (2, "1 2 3 -1")]:
+                                  (2, "1 2 3 10000000000000000"), (2, "1 2 3 -1"),
+                                  (3, "1 2 3"), (3, " ".join(["1"] * 17)),
+                                  (3, "1 2 3 10000000000000000"), (3, "1 2 3 -1")]:
                 profile.write_text(f"VU-BLOCKS {header}\n1 {words}\n")
                 result = subprocess.run([sys.executable, str(script), "--output", str(output),
                                          "--", str(profile)], capture_output=True, text=True)

From 2442640a230ae46db4d503387b291d828518e60e Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 21 Sep 2026 23:50:13 +0200
Subject: [PATCH 53/68] Retain DIV and CLIP timelines across compiled VU loops

---
 ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp     |   4 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp      |   2 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_loop_exec.inl | 126 ++++++-
 ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h   |  17 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h |  29 +-
 ps2xTest/data/vu_clip_loop.vublocks          |   9 +
 ps2xTest/data/vu_div_clip_loop.vublocks      |   5 +
 ps2xTest/data/vu_div_loop.vublocks           |   9 +
 ps2xTest/src/ps2_vu1_tests.cpp               | 357 ++++++++++++++++++-
 tools/compile_vu_blocks.py                   |   4 +-
 tools/tests/test_compile_vu_blocks.py        |   4 +-
 11 files changed, 542 insertions(+), 24 deletions(-)
 create mode 100644 ps2xTest/data/vu_clip_loop.vublocks
 create mode 100644 ps2xTest/data/vu_div_clip_loop.vublocks
 create mode 100644 ps2xTest/data/vu_div_loop.vublocks

diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp
index eab556d0e..9bf9b7209 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_cache.cpp
@@ -17,8 +17,8 @@ void VU1Interpreter::rebuildDecodedCodeCache(const uint8_t *vuCode, uint32_t cod
         const auto &old = m_decodedCodeCache[i];
         const bool changed = !reusable || old.lower != words[0] || old.upper != words[1];
         // A later edit must invalidate every native region that can contain it.
-        // The registry supports regions of up to sixteen pairs without code wrap.
-        changedWindow = ((changedWindow << 1u) | static_cast<uint32_t>(changed)) & 0xffffu;
+        // The registry supports regions of up to thirty-two pairs without code wrap.
+        changedWindow = (changedWindow << 1u) | static_cast<uint32_t>(changed);
         if (changed)
             m_decodedCodeCache[i] = decodeInstructionPair(vuCode, i * 8u);
         if (changedWindow != 0u)
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
index f66f502a3..aaa219e61 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
@@ -332,7 +332,7 @@ VU1Interpreter::CompiledBlock VU1Interpreter::findCompiledBlock(
 #ifdef PS2X_VU_AOT_INCLUDE
     struct Entry {
         Unit unit;
-        std::array<uint64_t, 16> words;
+        std::array<uint64_t, 32> words;
         CompiledBlock run;
         uint32_t bytes;
     };
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_loop_exec.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_loop_exec.inl
index 0fa5d4c03..a589bfc94 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_loop_exec.inl
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_loop_exec.inl
@@ -1,6 +1,7 @@
 {
     static constexpr auto loop = ps2_vu_detail::planCountedLoop(decodedRegion);
     static constexpr auto plan = loop.body;
+    static constexpr bool hasDiv = plan.pendingQ != 0u;
     if constexpr (loop.eligible)
     {
         const auto tryLoop = [&]() PS2_VU_INLINE_LAMBDA {
@@ -12,7 +13,7 @@
             if (ps2_vu_detail::disableCountedLoops || !ps2_vu_detail::regionBudgetFits(start, budgetEnd, plan.cycles) ||
                 vu.m_state.pc + sizeof...(words) * 8u > vu.m_cachedCodeSize || vu.m_stopRequested ||
                 vu.m_state.branchPending || vu.m_state.ebit || vu.m_state.haltAfterDelaySlot ||
-                vu.m_xgkick.active || vu.m_fdiv.valid || vu.m_activeStores || vu.m_activeAccWrites ||
+                vu.m_xgkick.active || (!hasDiv && vu.m_fdiv.valid) || vu.m_activeStores || vu.m_activeAccWrites ||
                 !vu.m_activeVuData || vu.m_activeVuDataSize < 16u)
                 return false;
             const uint64_t generation = unit == Unit::VU1
@@ -23,7 +24,8 @@
                 if (entry.valid)
                     return false;
             for (uint32_t active = vu.m_activeFlags; active != 0u; active &= active - 1u)
-                if (vu.m_flagPipeline[std::countr_zero(active)].readyCycle > start + 3u)
+                if (vu.m_flagPipeline[std::countr_zero(active)].readyCycle > start + 3u ||
+                    (hasDiv && vu.m_fdiv.valid && vu.m_flagPipeline[std::countr_zero(active)].writesSticky))
                     return false;
             const bool ready = [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
                 return ((vu.calculatePairReadyCycleInline(decodedRegion[indices]) <= start + plan.issue[indices]) && ...);
@@ -31,6 +33,23 @@
             if (!ready)
                 return false;
 
+            std::array<uint32_t, 4> incomingClip{};
+            if constexpr (plan.readsClip)
+            {
+                incomingClip[0] = vu.m_state.clip;
+                for (unsigned offset = 1u; offset < 4u; ++offset)
+                {
+                    incomingClip[offset] = incomingClip[offset - 1u];
+                    const uint64_t cycle = start + offset;
+                    for (uint32_t active = vu.m_activeFlags & (3u << (2u * (cycle & 3u)));
+                         active != 0u; active &= active - 1u)
+                    {
+                        const auto &entry = vu.m_flagPipeline[std::countr_zero(active)];
+                        if (entry.readyCycle <= cycle && entry.writesClip)
+                            incomingClip[offset] = entry.clip;
+                    }
+                }
+            }
             ps2_vu_detail::retireRegionInputs(vu.m_state, start, vu.m_flagPipeline,
                 vu.m_vfWritePipeline, vu.m_viWritePipeline, vu.m_vfLatestWrite,
                 vu.m_viLatestWrite, vu.m_activeFlags, vu.m_activeVfWrites, vu.m_activeViWrites,
@@ -96,7 +115,13 @@
                 }()), ...);
             }(std::make_index_sequence<16u>{});
             float entryI = vu.m_state.i;
-            const float entryQ = vu.m_state.q;
+            float entryQ = vu.m_state.q;
+            float entryPendingQ = vu.m_fdiv.value;
+            uint64_t entryPendingReady = vu.m_fdiv.readyCycle;
+            uint32_t entryPendingDi = vu.m_fdiv.statusDi;
+            bool entryPending = vu.m_fdiv.valid;
+            struct DivValue { float value{}; uint32_t statusDi{}; };
+            std::array<DivValue, sizeof...(words)> divisions{};
             std::array<std::array<float, 4>, sizeof...(words) * 2u> values{};
             std::array<int32_t, sizeof...(words)> integers{};
             std::array<ps2_vu_detail::RegionFlag, sizeof...(words)> flags{};
@@ -139,6 +164,22 @@
                     return ps2_vu_detail::upper::normalizeOperand(
                         std::bit_cast<float>(decodedRegion[source - 1u].lower));
             };
+            const auto readQ = [&]<uint16_t source, uint16_t offset>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (source != 0u)
+                    return divisions[source - 1u].value;
+                else if constexpr (hasDiv)
+                    return entryPending && entryPendingReady <= start + offset ? entryPendingQ : entryQ;
+                else
+                    return entryQ;
+            };
+            const auto readClip = [&]<size_t index>() PS2_VU_INLINE_LAMBDA {
+                if constexpr (!decodedRegion[index].lowerUsage.readsClip)
+                    return uint32_t{0};
+                else if constexpr (plan.sources[index].clip != 0u)
+                    return flags[plan.sources[index].clip - 1u].clipValue;
+                else
+                    return incomingClip[std::min<unsigned>(plan.issue[index], 3u)];
+            };
             const auto issue = [&]<size_t index>() PS2_VU_INLINE_LAMBDA {
                 static constexpr auto source = plan.sources[index];
                 float fs[4], ft[4], acc[4], lowerFs[4];
@@ -150,13 +191,15 @@
                       values[index * 2u + 1u][lanes] = readVf.template operator()<source.lowerFt[lanes], lanes>()), ...);
                 }(std::make_index_sequence<4u>{});
                 ps2_vu_detail::RegionUpperInputs input{fs, ft, acc,
-                    readI.template operator()<source.scalarI>(), entryQ};
+                    readI.template operator()<source.scalarI>(),
+                    readQ.template operator()<source.scalarQ, plan.issue[index]>()};
                 flags[index] = {};
                 ps2_vu_detail::RegionUpperSink sink{values[index * 2u].data(), flags[index], workingClip};
                 ps2_vu_detail::upper::computeUpper(decodedRegion[index].upper, input, sink);
                 integers[index] = readVi.template operator()<source.viOld>();
                 ps2_vu_detail::RegionLowerInputs lowerInput{lowerFs,
-                    readVi.template operator()<source.viS>(), readVi.template operator()<source.viT>()};
+                    readVi.template operator()<source.viS>(), readVi.template operator()<source.viT>(),
+                    readClip.template operator()<index>()};
                 ps2_vu_detail::RegionLowerSink lowerSink{values[index * 2u + 1u].data(), integers[index]};
                 if constexpr (index == sizeof...(words) - 2u)
                 {
@@ -164,10 +207,46 @@
                                        static_cast<int16_t>(readVi.template operator()<loop.branchT>());
                     branchTaken = (decodedRegion[index].lower >> 25u) == 0x28u ? equal : !equal;
                 }
+                else if constexpr (plan.qReady[index] != 0u)
+                {
+                    constexpr uint32_t instruction = decodedRegion[index].lower;
+                    const float num = vu.normalizeOperand(lowerFs[(instruction >> 21u) & 3u]);
+                    const float den = vu.normalizeOperand(values[index * 2u + 1u][(instruction >> 23u) & 3u]);
+                    auto &division = divisions[index];
+                    division.statusDi = 0u;
+                    if (den == 0.0f)
+                    {
+                        division.statusDi = num == 0.0f ? 0x10u : 0x20u;
+                        division.value = std::signbit(num) != std::signbit(den)
+                            ? -std::numeric_limits<float>::max() : std::numeric_limits<float>::max();
+                    }
+                    else
+                        division.value = num / den;
+                    uint32_t ignoredFlags = 0u;
+                    division.value = vu.normalizeResult(division.value, ignoredFlags);
+                }
                 else if constexpr (!decodedRegion[index].iBit)
                     ps2_vu_detail::computeRegionLower(decodedRegion[index].lower, lowerInput, lowerSink,
                                                     loopData, loopDataSize);
             };
+            const auto retireDivStatus = [&]<bool includePending>() PS2_VU_INLINE_LAMBDA {
+                const auto apply = [&](uint32_t statusDi) PS2_VU_INLINE_LAMBDA {
+                    const uint32_t current = statusDi & 0x30u;
+                    workingStatus = (workingStatus & 0xfcfu) | current | (current << 6u);
+                };
+                if constexpr (hasDiv)
+                {
+                    if (entryPending && entryPendingReady <= start + plan.cycles)
+                        apply(entryPendingDi);
+                    [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
+                        (([&]() PS2_VU_INLINE_LAMBDA {
+                            if constexpr (plan.qReady[indices] != 0u &&
+                                (includePending || plan.qReady[indices] <= plan.cycles))
+                                apply(divisions[indices].statusDi);
+                        }()), ...);
+                    }(std::make_index_sequence<sizeof...(words)>{});
+                }
+            };
             for (;;)
             {
             [&]<size_t... indices>(std::index_sequence<indices...>) PS2_VU_INLINE_LAMBDA {
@@ -182,6 +261,20 @@
             if (branchTaken && ps2_vu_detail::regionBudgetFits(end, budgetEnd, plan.cycles) &&
                 !vu.m_stopRequested && currentGeneration == vu.m_cachedCodeGeneration)
             {
+                retireDivStatus.template operator()<true>();
+                if constexpr (plan.readsClip)
+                {
+                    // The last three CLIP results can cross the loop backedge.
+                    const uint32_t entryClip = incomingClip[3];
+                    for (unsigned offset = 0u; offset < 4u; ++offset)
+                    {
+                        uint32_t clip = entryClip;
+                        for (unsigned index = 0u; index < sizeof...(words); ++index)
+                            if (flags[index].clip && plan.issue[index] + 4u <= plan.cycles + offset)
+                                clip = flags[index].clipValue;
+                        incomingClip[offset] = clip;
+                    }
+                }
                 // Prior-iteration flags retire before this iteration can publish any new ones.
                 for (const auto &flag : flags)
                 {
@@ -214,10 +307,33 @@
                 }(std::make_index_sequence<16u>{});
                 if constexpr (plan.scalarI != 0u)
                     entryI = readI.template operator()<plan.scalarI>();
+                if constexpr (hasDiv)
+                {
+                    entryQ = readQ.template operator()<plan.scalarQ, plan.cycles>();
+                    constexpr unsigned lastDiv = plan.pendingQ - 1u;
+                    entryPending = plan.qReady[lastDiv] > plan.cycles;
+                    entryPendingQ = divisions[lastDiv].value;
+                    entryPendingDi = divisions[lastDiv].statusDi;
+                    entryPendingReady = start + plan.qReady[lastDiv];
+                }
                 sequenceBase += plan.sequences;
                 start = end;
                 continue;
             }
+            retireDivStatus.template operator()<false>();
+            if constexpr (hasDiv)
+            {
+                vu.m_state.q = readQ.template operator()<plan.scalarQ, plan.cycles>();
+                vu.m_fdiv = {};
+                constexpr unsigned lastDiv = plan.pendingQ - 1u;
+                if constexpr (plan.qReady[lastDiv] > plan.cycles)
+                {
+                    vu.m_fdiv.valid = true;
+                    vu.m_fdiv.readyCycle = start + plan.qReady[lastDiv];
+                    vu.m_fdiv.value = divisions[lastDiv].value;
+                    vu.m_fdiv.statusDi = divisions[lastDiv].statusDi;
+                }
+            }
             vu.m_state.mac = workingMac;
             vu.m_state.status = workingStatus;
             vu.m_state.clip = visibleClip;
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h b/ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h
index a2c00f2d0..7a0784ed6 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_loop_plan.h
@@ -14,9 +14,10 @@ constexpr bool loopLowerSupported(uint32_t lower)
 {
     const uint32_t opcode = lower >> 25u, direct = lower & 0x3fu;
     const uint32_t special = (lower & 3u) | ((lower >> 4u) & 0x7cu);
-    // Loop-carried flag reads need their own timeline before becoming eligible.
+    // Keep unsupported flag writers and internal branches on the exact fallback.
     return lower == 0u || lower == 0x8000033cu || opcode == 0u || opcode == 1u ||
         opcode == 4u || opcode == 5u || opcode == 8u || opcode == 9u ||
+        opcode == 0x10u || opcode == 0x12u || opcode == 0x13u || opcode == 0x1cu ||
         (opcode == 0x40u && (direct == 0x30u || direct == 0x31u || direct == 0x32u ||
             direct == 0x34u || direct == 0x35u ||
             (direct >= 0x3cu && ((special >= 0x30u && special <= 0x31u) ||
@@ -31,13 +32,14 @@ struct CountedLoopPlan {
     std::array<std::array<uint16_t, 4>, 32> vfNext{};
     std::array<uint16_t, 16> viNext{};
     uint16_t branchS{}, branchT{};
+    uint16_t firstDiv = N;
 };
 
 template <typename Decoded, size_t N>
 constexpr CountedLoopPlan<N> planCountedLoop(const std::array<Decoded, N> &decoded)
 {
     CountedLoopPlan<N> loop;
-    if constexpr (N < 4u || N > 16u)
+    if constexpr (N < 4u || N > 32u)
         return loop;
     else
     {
@@ -52,7 +54,7 @@ constexpr CountedLoopPlan<N> planCountedLoop(const std::array<Decoded, N> &decod
         auto straight = decoded;
         straight[branchIndex].lower = 0u;
         straight[branchIndex].lowerUsage = {};
-        const auto supported = planRegion(straight);
+        const auto supported = planRegion(straight, true);
         if (!supported.eligible)
             return loop;
         for (unsigned index = 0; index < N; ++index)
@@ -61,13 +63,18 @@ constexpr CountedLoopPlan<N> planCountedLoop(const std::array<Decoded, N> &decod
                 decoded[index].dBit || decoded[index].tBit)
                 return loop;
             if (!decoded[index].iBit && index != branchIndex &&
-                !loopLowerSupported(decoded[index].lower))
+                !loopLowerSupported(decoded[index].lower) && !regionDiv(decoded[index].lower))
                 return loop;
+            if (!decoded[index].iBit && regionDiv(decoded[index].lower))
+                loop.firstDiv = std::min(loop.firstDiv, static_cast<uint16_t>(index));
         }
-        loop.body = planRegion(decoded);
+        loop.body = planRegion(decoded, true);
         const auto &plan = loop.body;
         if (plan.cycles < 4u)
             return loop;
+        if (plan.pendingQ != 0u && plan.qReady[plan.pendingQ - 1u] >
+            plan.cycles + plan.issue[loop.firstDiv])
+            return loop;
         // A pending entry value and the visible entry value share one local phi.
         // Keep that representation only when the previous iteration's final write
         // retires before the next write can cancel it. Otherwise the visible old
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h b/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h
index f496e9751..7dfc98bc7 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_region_plan.h
@@ -13,7 +13,7 @@ inline constexpr uint16_t regionConstantZero = 0xffffu;
 
 struct RegionSources {
     std::array<uint16_t, 4> fs{}, ft{}, acc{}, lowerFs{}, lowerFt{};
-    uint16_t viS{}, viT{}, viOld{}, scalarI{}, clip{};
+    uint16_t viS{}, viT{}, viOld{}, scalarI{}, scalarQ{}, clip{};
 };
 
 struct RegionWrite {
@@ -26,6 +26,8 @@ struct RegionPlan {
     bool eligible = N >= 4u && N <= 16u;
     bool readsClip = false;
     uint16_t cycles{}, sequences{}, scalarI{};
+    uint16_t scalarQ{}, pendingQ{};
+    std::array<uint16_t, N> qReady{};
     std::array<uint16_t, N> issue{};
     std::array<RegionSources, N> sources{};
     std::array<RegionWrite, N> upper{}, lower{}, vi{};
@@ -50,6 +52,12 @@ constexpr bool regionLowerSupported(uint32_t lower)
                                (special >= 0x3cu && special <= 0x3fu)))));
 }
 
+constexpr bool regionDiv(uint32_t lower)
+{
+    return (lower >> 25u) == 0x40u && (lower & 63u) >= 0x3cu &&
+        ((lower & 3u) | ((lower >> 4u) & 0x7cu)) == 0x38u;
+}
+
 template <typename Decoded, size_t N>
 constexpr uint8_t regionTerminalBranch(const std::array<Decoded, N> &decoded)
 {
@@ -64,9 +72,10 @@ constexpr uint8_t regionTerminalBranch(const std::array<Decoded, N> &decoded)
 }
 
 template <typename Decoded, size_t N>
-constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded)
+constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded, bool allowDiv = false)
 {
     RegionPlan<N> plan;
+    plan.eligible = N >= 4u && N <= (allowDiv ? 32u : 16u);
     auto vfPending = plan.vfVisible;
     auto viPending = plan.viVisible;
     auto accPending = plan.accVisible;
@@ -82,6 +91,8 @@ constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded)
     accPending.fill(32u);
     plan.firstViWrite.fill(255u);
     const auto retire = [&](uint16_t cycle) {
+        if (plan.pendingQ != 0u && plan.qReady[plan.pendingQ - 1u] <= cycle)
+            plan.scalarQ = plan.pendingQ;
         for (unsigned reg = 1; reg < 32; ++reg)
             for (unsigned lane = 0; lane < 4; ++lane)
                 if (plan.vfReady[reg][lane] <= cycle)
@@ -96,11 +107,12 @@ constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded)
     for (unsigned index = 0; index < N; ++index)
     {
         const auto &pair = decoded[index];
+        const bool div = !pair.iBit && regionDiv(pair.lower);
         const uint32_t branchOpcode = pair.lower >> 25u;
         const bool terminalBranch = !pair.iBit && index + 2u == N &&
             (branchOpcode == 0x28u || branchOpcode == 0x29u);
         if (pair.eBit || pair.mBit || pair.dBit || pair.tBit || pair.upperUsage.reserved ||
-            (!pair.iBit && (pair.lowerUsage.reserved || (!terminalBranch && !regionLowerSupported(pair.lower)))))
+            (!pair.iBit && (pair.lowerUsage.reserved || (!terminalBranch && !regionLowerSupported(pair.lower) && !(allowDiv && div)))))
             plan.eligible = false;
         const uint32_t upperOp = pair.upper & 63u;
         const uint32_t upperSpecial = (pair.upper & 3u) | ((pair.upper >> 4u) & 0x7cu);
@@ -115,9 +127,12 @@ constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded)
                 (lowerSpecial == 0x30u || lowerSpecial == 0x31u || lowerSpecial == 0x35u ||
                  lowerSpecial == 0x37u || lowerSpecial == 0x3cu)));
         // The scalar oracle exposes a transient upper VF0 write to lower reads.
-        if (!pair.iBit && upperWritesZero && lowerReadsZero)
+        if (!pair.iBit && upperWritesZero && (lowerReadsZero ||
+            (div && (((pair.lower >> 11u) & 31u) == 0u || ((pair.lower >> 16u) & 31u) == 0u))))
             plan.eligible = false;
         uint16_t cycle = plan.cycles;
+        if (allowDiv && div && plan.pendingQ != 0u)
+            cycle = std::max(cycle, plan.qReady[plan.pendingQ - 1u]);
         for (const auto *usage : {&pair.upperUsage, &pair.lowerUsage})
         {
             for (unsigned readIndex = 0; readIndex < usage->vfReadCount; ++readIndex)
@@ -141,6 +156,7 @@ constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded)
         source.ft = plan.vfVisible[(pair.upper >> 16u) & 31u];
         source.acc = plan.accVisible;
         source.scalarI = plan.scalarI;
+        source.scalarQ = plan.scalarQ;
         if (pair.lowerUsage.readsClip)
         {
             plan.readsClip = true;
@@ -204,6 +220,11 @@ constexpr RegionPlan<N> planRegion(const std::array<Decoded, N> &decoded)
         plan.cycles = cycle + 1u;
         if (pair.iBit)
             plan.scalarI = index + 1u;
+        if (allowDiv && div)
+        {
+            plan.pendingQ = index + 1u;
+            plan.qReady[index] = cycle + 7u;
+        }
         plan.vfVisible[0].fill(regionConstantZero);
         plan.viVisible[0] = regionConstantZero;
     }
diff --git a/ps2xTest/data/vu_clip_loop.vublocks b/ps2xTest/data/vu_clip_loop.vublocks
new file mode 100644
index 000000000..f2bf453ae
--- /dev/null
+++ b/ps2xTest/data/vu_clip_loop.vublocks
@@ -0,0 +1,9 @@
+VU-BLOCKS 3
+0 01ea09ff38020000 01ea11ff38030000 01ea19ff38040000 01ea21ff38050000 01ea29ff38060000 01ea31ff38070000 01ea39ff500007f9 01ea41ff38090000
+0 01ea09ff24000001 01ea11ff24000008 01ea19ff24000040 01ea21ff24000200 01ea29ff24001000 01ea31ff24008000 01ea39ff500007f9 01ea41ff24200000
+0 01ea09ff26fffffe 01ea11ff26fffff7 01ea19ff26ffffbf 01ea21ff26fffdff 01ea29ff26ffefff 01ea31ff26ff7fff 01ea39ff500007f9 01ea41ff26dfffff
+0 01ea09ff20000000 01ea11ff20123456 01ea19ff202468ac 01ea21ff20369d02 01ea29ff2048d158 01ea31ff205b05ae 01ea39ff500007f9 01ea41ff207f6e5a
+1 01ea09ff38020000 01ea11ff38030000 01ea19ff38040000 01ea21ff38050000 01ea29ff38060000 01ea31ff38070000 01ea39ff500007f9 01ea41ff38090000
+1 01ea09ff24000001 01ea11ff24000008 01ea19ff24000040 01ea21ff24000200 01ea29ff24001000 01ea31ff24008000 01ea39ff500007f9 01ea41ff24200000
+1 01ea09ff26fffffe 01ea11ff26fffff7 01ea19ff26ffffbf 01ea21ff26fffdff 01ea29ff26ffefff 01ea31ff26ff7fff 01ea39ff500007f9 01ea41ff26dfffff
+1 01ea09ff20000000 01ea11ff20123456 01ea19ff202468ac 01ea21ff20369d02 01ea29ff2048d158 01ea31ff205b05ae 01ea39ff500007f9 01ea41ff207f6e5a
diff --git a/ps2xTest/data/vu_div_clip_loop.vublocks b/ps2xTest/data/vu_div_clip_loop.vublocks
new file mode 100644
index 000000000..9955c945b
--- /dev/null
+++ b/ps2xTest/data/vu_div_clip_loop.vublocks
@@ -0,0 +1,5 @@
+VU-BLOCKS 3
+0 01e0196024aaaaaa 000002ff8000033c 01e0199c38080000 000002ff38090000 000002ff10063001 000002ff8000033c 000002ff8000033c 000002ff8000033c 010b52a88000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff800c53bc 01e019e48000033c 01c419ff8000033c 000002ff520737f0 01c429ff03e63800
+0 01e0196024aaaaaa 000002ff8000033c 01e0199c38080000 000002ff38090000 000002ff10063001 000002ff8000033c 000002ff8000033c 000002ff8000033c 010b52a88000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff800c53bc 01e019e4800e6bbc 01c419ff8000033c 000002ff520737f0 01c429ff03e63800
+1 01e0196024aaaaaa 000002ff8000033c 01e0199c38080000 000002ff38090000 000002ff10063001 000002ff8000033c 000002ff8000033c 000002ff8000033c 010b52a88000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff800c53bc 01e019e48000033c 01c419ff8000033c 000002ff520737f0 01c429ff03e63800
+1 01e0196024aaaaaa 000002ff8000033c 01e0199c38080000 000002ff38090000 000002ff10063001 000002ff8000033c 000002ff8000033c 000002ff8000033c 010b52a88000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff800c53bc 01e019e4800e6bbc 01c419ff8000033c 000002ff520737f0 01c429ff03e63800
diff --git a/ps2xTest/data/vu_div_loop.vublocks b/ps2xTest/data/vu_div_loop.vublocks
new file mode 100644
index 000000000..2f109f498
--- /dev/null
+++ b/ps2xTest/data/vu_div_loop.vublocks
@@ -0,0 +1,9 @@
+VU-BLOCKS 3
+0 01e019608000033c 000002ff8000033c 01e0199c8000033c 000002ff8000033c 000002ff10010801 000002ff8000033c 000002ff8000033c 000002ff8000033c 010b52a88000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff800c53bc 01e019e48000033c 000002ff8000033c 000002ff52020ff0 01e31a2803e13800
+0 01e019608000033c 000002ff8000033c 01e0199c800c53bc 000002ff8000033c 000002ff10010801 000002ff8000033c 000002ff8000033c 000002ff8000033c 010b52a88000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff800c53bc 01e019e48000033c 000002ff8000033c 000002ff52020ff0 01e31a2803e13800
+0 01e019608000033c 000002ff8000033c 01e0199c8000033c 000002ff8000033c 000002ff10010801 000002ff8000033c 000002ff8000033c 000002ff8000033c 010b52a88000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff800c53bc 01e019e4800e6bbc 000002ff8000033c 000002ff52020ff0 01e31a2803e13800
+0 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff500007e1 000002ff8000033c
+1 01e019608000033c 000002ff8000033c 01e0199c8000033c 000002ff8000033c 000002ff10010801 000002ff8000033c 000002ff8000033c 000002ff8000033c 010b52a88000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff800c53bc 01e019e48000033c 000002ff8000033c 000002ff52020ff0 01e31a2803e13800
+1 01e019608000033c 000002ff8000033c 01e0199c800c53bc 000002ff8000033c 000002ff10010801 000002ff8000033c 000002ff8000033c 000002ff8000033c 010b52a88000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff800c53bc 01e019e48000033c 000002ff8000033c 000002ff52020ff0 01e31a2803e13800
+1 01e019608000033c 000002ff8000033c 01e0199c8000033c 000002ff8000033c 000002ff10010801 000002ff8000033c 000002ff8000033c 000002ff8000033c 010b52a88000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff800c53bc 01e019e4800e6bbc 000002ff8000033c 000002ff52020ff0 01e31a2803e13800
+1 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff8000033c 000002ff500007e1 000002ff8000033c
diff --git a/ps2xTest/src/ps2_vu1_tests.cpp b/ps2xTest/src/ps2_vu1_tests.cpp
index 99a46b7f7..217b464cd 100644
--- a/ps2xTest/src/ps2_vu1_tests.cpp
+++ b/ps2xTest/src/ps2_vu1_tests.cpp
@@ -247,6 +247,46 @@ namespace
             makeVuUpperSpecial(0x08u, 14u, 23u, 18u));
     }
 
+    void writeDivLoopCode(uint8_t *code, uint32_t base, unsigned mode)
+    {
+        for (unsigned index = 0; index < 17u; ++index)
+            writeVuInstructionPair(code, base + index * 8u, 0x8000033cu, kVuUpperNop);
+        writeVuInstructionPair(code, base, 0x8000033cu, makeVuUpper(0x20u, 15u, 0u, 3u, 5u));
+        writeVuInstructionPair(code, base + 16u, mode == 1u ? makeVuDiv(10u, 12u, 0u, 0u) : 0x8000033cu,
+            makeVuUpper(0x1cu, 15u, 0u, 3u, 6u));
+        writeVuInstructionPair(code, base + 32u, makeVuIaddiu(1u, 1u, 1), kVuUpperNop);
+        writeVuInstructionPair(code, base + 64u, 0x8000033cu, makeVuUpper(0x28u, 8u, 11u, 10u, 10u));
+        writeVuInstructionPair(code, base + 96u, makeVuDiv(10u, 12u, 0u, 0u), kVuUpperNop);
+        writeVuInstructionPair(code, base + 104u, mode == 2u ? makeVuDiv(13u, 14u, 0u, 0u) : 0x8000033cu,
+            makeVuUpper(0x24u, 15u, 0u, 3u, 7u));
+        writeVuInstructionPair(code, base + 120u, makeVuIbne(1u, 2u, -16), kVuUpperNop);
+        writeVuInstructionPair(code, base + 128u, makeVuSq(15u, 7u, 1u, 0),
+            makeVuUpper(0x28u, 15u, 3u, 3u, 8u));
+    }
+
+    void writeDivClipLoopCode(uint8_t *code, uint32_t base, unsigned mode)
+    {
+        writeDivLoopCode(code, base, mode);
+        writeVuInstructionPair(code, base, (0x12u << 25u) | 0xaaaaaau,
+            makeVuUpper(0x20u, 15u, 0u, 3u, 5u));
+        writeVuInstructionPair(code, base + 16u, (0x1cu << 25u) | (8u << 16u),
+            makeVuUpper(0x1cu, 15u, 0u, 3u, 6u));
+        writeVuInstructionPair(code, base + 24u, (0x1cu << 25u) | (9u << 16u), kVuUpperNop);
+        writeVuInstructionPair(code, base + 32u, makeVuIaddiu(6u, 6u, 1), kVuUpperNop);
+        writeVuInstructionPair(code, base + 112u, 0x8000033cu,
+            makeVuUpperSpecial(0x1fu, 14u, 4u, 3u));
+        writeVuInstructionPair(code, base + 120u, makeVuIbne(6u, 7u, -16), kVuUpperNop);
+        writeVuInstructionPair(code, base + 128u, makeVuSq(15u, 7u, 6u, 0),
+            makeVuUpperSpecial(0x1fu, 14u, 4u, 5u));
+    }
+
+    void writeLongLoopCode(uint8_t *code, uint32_t base)
+    {
+        for (unsigned index = 0; index < 32u; ++index)
+            writeVuInstructionPair(code, base + index * 8u, 0x8000033cu, kVuUpperNop);
+        writeVuInstructionPair(code, base + 240u, (0x28u << 25u) | (-31 & 0x7ff), kVuUpperNop);
+    }
+
     void writeVuQword(uint8_t *data, uint32_t qwordIndex, const float values[4])
     {
         std::memcpy(data + qwordIndex * 16u, values, sizeof(float) * 4u);
@@ -276,6 +316,248 @@ void register_ps2_vu1_tests()
 {
     MiniTest::Case("PS2VU1", [](TestCase &tc)
     {
+        tc.Run("retained loops carry independent Q and CLIP timelines through DIV stalls", [](TestCase &t)
+        {
+            for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
+                for (unsigned mode : {0u, 2u})
+                    for (unsigned phase = 0; phase < 8u; ++phase)
+                        for (unsigned trips : {1u, 3u})
+                            for (uint32_t divisor : {0x00000000u, 0x80000000u, 0x40000000u, 0x00800000u})
+                                for (unsigned budget : {0u, 1u, 2u, 3u, 4u, 16u, 17u, 18u, 19u, 20u, 21u, 23u, 24u, 25u, 35u, 36u, 48u, 54u, 72u})
+                                {
+                                    Vu1Fixture a, b;
+                                    t.IsTrue(a.initialize() && b.initialize(), "joint Q/CLIP fixtures initialize");
+                                    const unsigned codeSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_SIZE : PS2_VU0_CODE_SIZE;
+                                    const unsigned dataSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_DATA_SIZE : PS2_VU0_DATA_SIZE;
+                                    const unsigned base = phase * 8u;
+                                    for (auto *fx : {&a, &b})
+                                    {
+                                        if (unit == VU1Interpreter::Unit::VU0)
+                                        {
+                                            fx->code = fx->mem.getVU0Code();
+                                            fx->data = fx->mem.getVU0Data();
+                                        }
+                                        for (unsigned pc = 0; pc < codeSize; pc += 8u)
+                                            writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                                        writeDivClipLoopCode(fx->code, base, mode);
+                                        if (phase)
+                                            writeVuInstructionPair(fx->code, base - 8u, makeVuDiv(13u, 14u, 0u, 0u),
+                                                makeVuUpperSpecial(0x1fu, 14u, 4u, 3u));
+                                    }
+                                    VU1Interpreter native(unit), oracle(unit);
+                                    oracle.setCompiledExecutionEnabled(false);
+                                    native.state().q = -3.0f;
+                                    native.state().status = 0xa50u;
+                                    native.state().clip = 0xabcdefu;
+                                    native.state().vi[7] = trips;
+                                    for (unsigned lane = 0; lane < 4u; ++lane)
+                                        native.state().vf[3][lane] = static_cast<float>(static_cast<int>(lane) - 2);
+                                    native.state().vf[4][3] = 0.5f;
+                                    native.state().vf[10][0] = 4.0f;
+                                    native.state().vf[11][0] = -1.0f;
+                                    native.state().vf[12][0] = std::bit_cast<float>(divisor);
+                                    native.state().vf[13][0] = 0.0f;
+                                    native.state().vf[14][0] = 0.0f;
+                                    oracle.state() = native.state();
+                                    const unsigned duration = mode == 2u ? 24u : 18u;
+                                    const uint64_t before = ps2_vu_detail::countedLoopPairs;
+                                    native.execute(a.code, codeSize, a.data, dataSize, a.gs, &a.mem, 0u, 0u, 0u, phase + budget);
+                                    oracle.execute(b.code, codeSize, b.data, dataSize, b.gs, &b.mem, 0u, 0u, 0u, phase + budget);
+                                    if (std::getenv("PS2_VU_REQUIRE_DIV_LOOPS"))
+                                        t.Equals(ps2_vu_detail::countedLoopPairs - before,
+                                            uint64_t{17} * std::min(trips, budget / duration),
+                                            "complete joint Q/CLIP iterations must enter the retained path");
+                                    for (unsigned step = 0; step < 3u; ++step)
+                                    {
+                                        t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                            "pending Q and CLIP have separate visibility at every compiled return");
+                                        t.IsTrue(std::memcmp(a.data, b.data, dataSize) == 0,
+                                            "joint timeline stores retain the exact Q arithmetic result");
+                                        native.resume(a.code, codeSize, a.data, dataSize, a.gs, &a.mem, 0u, 0u, duration);
+                                        oracle.resume(b.code, codeSize, b.data, dataSize, b.gs, &b.mem, 0u, 0u, duration);
+                                    }
+                                    native.setCompiledExecutionEnabled(false);
+                                    for (unsigned tail = 0; tail < 10u; ++tail)
+                                    {
+                                        t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                            "raw tails expose every delayed Q, D/I and CLIP result after reentry");
+                                        t.IsTrue(std::memcmp(a.data, b.data, dataSize) == 0,
+                                            "raw tails preserve joint timeline store ordering");
+                                        native.resume(a.code, codeSize, a.data, dataSize, a.gs, &a.mem, 0u, 0u, 1u);
+                                        oracle.resume(b.code, codeSize, b.data, dataSize, b.gs, &b.mem, 0u, 0u, 1u);
+                                    }
+                                }
+        });
+
+        tc.Run("DIV loops retain visible and pending Q at every budget and raw tail", [](TestCase &t)
+        {
+            const uint32_t raw[][4] = {
+                {0x40800000u, 0x3f800000u, 0x40000000u, 0x00000000u},
+                {0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u},
+                {0x80000000u, 0x80000000u, 0x80000000u, 0x00000000u},
+                {0x7fffffffu, 0x00000001u, 0x00800000u, 0x7f800000u},
+                {0x80800000u, 0x00000000u, 0x7f7fffffu, 0x3f800000u}};
+            for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
+                for (unsigned mode : {0u, 1u, 2u})
+                    for (unsigned wrapped : {0u, 1u})
+                        for (unsigned incoming : {0u, 1u, 2u, 3u})
+                            for (const auto &bits : raw)
+                                for (unsigned budget : {0u, 1u, 12u, 16u, 17u, 18u, 19u, 22u, 23u, 24u, 33u, 34u, 35u, 46u, 51u, 69u})
+                                {
+                                    Vu1Fixture a, b;
+                                    t.IsTrue(a.initialize() && b.initialize(), "DIV fixtures initialize");
+                                    const unsigned codeSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_SIZE : PS2_VU0_CODE_SIZE;
+                                    const unsigned dataSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_DATA_SIZE : PS2_VU0_DATA_SIZE;
+                                    const unsigned base = wrapped ? codeSize - 136u : 56u;
+                                    const unsigned prefixPairs = incoming == 3u ? 7u : 3u;
+                                    const unsigned prefix = base - prefixPairs * 8u;
+                                    for (auto *fx : {&a, &b})
+                                    {
+                                        if (unit == VU1Interpreter::Unit::VU0)
+                                        {
+                                            fx->code = fx->mem.getVU0Code();
+                                            fx->data = fx->mem.getVU0Data();
+                                        }
+                                        for (unsigned pc = 0; pc < codeSize; pc += 8u)
+                                            writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                                        writeDivLoopCode(fx->code, base, mode);
+                                        if (incoming)
+                                            writeVuInstructionPair(fx->code, prefix + (incoming == 3u ? 8u : 0u), makeVuDiv(13u, 14u, 0u, 0u), kVuUpperNop);
+                                        if (incoming == 2u)
+                                            writeVuInstructionPair(fx->code, prefix + 8u, makeVuFlagImmediate(0x15u, 0u, 0x840u), kVuUpperNop);
+                                        if (incoming == 3u)
+                                            writeVuInstructionPair(fx->code, base - 8u, makeVuFlagImmediate(0x15u, 0u, 0x040u), kVuUpperNop);
+                                    }
+                                    VU1Interpreter native(unit), oracle(unit);
+                                    oracle.setCompiledExecutionEnabled(false);
+                                    native.state().q = 5.0f;
+                                    native.state().status = 0xa50u;
+                                    native.state().vi[2] = 3;
+                                    for (unsigned lane = 0; lane < 4u; ++lane)
+                                        native.state().vf[3][lane] = static_cast<float>(lane + 1u);
+                                    native.state().vf[10][0] = std::bit_cast<float>(bits[0]);
+                                    native.state().vf[11][0] = std::bit_cast<float>(bits[1]);
+                                    native.state().vf[12][0] = std::bit_cast<float>(bits[2]);
+                                    native.state().vf[13][0] = std::bit_cast<float>(bits[3]);
+                                    native.state().vf[14][0] = 0.0f;
+                                    oracle.state() = native.state();
+                                    const uint64_t before = ps2_vu_detail::countedLoopPairs;
+                                    native.execute(a.code, codeSize, a.data, dataSize, a.gs, &a.mem, prefix, 0u, 0u, budget + prefixPairs);
+                                    oracle.execute(b.code, codeSize, b.data, dataSize, b.gs, &b.mem, prefix, 0u, 0u, budget + prefixPairs);
+                                    if (std::getenv("PS2_VU_REQUIRE_DIV_LOOPS") && incoming == 0u && budget >= (mode == 2u ? 24u : 18u))
+                                        t.IsTrue(ps2_vu_detail::countedLoopPairs > before, "complete DIV iterations enter the retained path");
+                                    native.setCompiledExecutionEnabled(false);
+                                    for (unsigned tail = 0; tail < 10u; ++tail)
+                                    {
+                                        const bool equal = std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0;
+                                        if (!equal)
+                                            std::fprintf(stderr, "DIV mismatch mode=%u wrap=%u incoming=%u budget=%u tail=%u pc=%u/%u cycles=%llu/%llu Q=%08x/%08x status=%x/%x\n", mode, wrapped, incoming, budget, tail, native.state().pc, oracle.state().pc, (unsigned long long)native.state().cycles, (unsigned long long)oracle.state().cycles, std::bit_cast<uint32_t>(native.state().q), std::bit_cast<uint32_t>(oracle.state().q), native.state().status, oracle.state().status);
+                                        t.IsTrue(equal, "DIV Q, D/I, FMAC flags, registers and branch state match the independent raw tail");
+                                        t.IsTrue(std::memcmp(a.data, b.data, dataSize) == 0, "DIV delay-slot stores match raw execution");
+                                        native.resume(a.code, codeSize, a.data, dataSize, a.gs, &a.mem, 0u, 0u, 1u);
+                                        oracle.resume(b.code, codeSize, b.data, dataSize, b.gs, &b.mem, 0u, 0u, 1u);
+                                    }
+                                }
+        });
+
+        tc.Run("DIV loops reenter through pending Q and end controls", [](TestCase &t)
+        {
+            for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
+                for (unsigned mode : {0u, 1u, 2u})
+                    for (unsigned stop : {0u, 1u})
+                    {
+                        Vu1Fixture a, b;
+                        t.IsTrue(a.initialize() && b.initialize(), "DIV reentry fixtures initialize");
+                        const unsigned codeSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_SIZE : PS2_VU0_CODE_SIZE;
+                        const unsigned dataSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_DATA_SIZE : PS2_VU0_DATA_SIZE;
+                        const uint32_t codeBase = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_BASE : PS2_VU0_CODE_BASE;
+                        for (auto *fx : {&a, &b})
+                        {
+                            if (unit == VU1Interpreter::Unit::VU0)
+                            {
+                                fx->code = fx->mem.getVU0Code();
+                                fx->data = fx->mem.getVU0Data();
+                            }
+                            writeDivLoopCode(fx->code, 0u, mode);
+                        }
+                        VU1Interpreter native(unit), oracle(unit);
+                        oracle.setCompiledExecutionEnabled(false);
+                        native.state().q = 5.0f;
+                        native.state().vi[2] = 20;
+                        native.state().status = 0x430u;
+                        native.state().vf[10][0] = 4.0f;
+                        native.state().vf[11][0] = 1.0f;
+                        native.state().vf[12][0] = 2.0f;
+                        native.state().vf[13][0] = 0.0f;
+                        native.state().vf[14][0] = 0.0f;
+                        for (unsigned lane = 0; lane < 4u; ++lane)
+                            native.state().vf[3][lane] = static_cast<float>(lane + 1u);
+                        oracle.state() = native.state();
+                        for (unsigned step = 0; step < 5u; ++step)
+                        {
+                            if (step == 3u && stop)
+                                for (auto *fx : {&a, &b})
+                                    fx->mem.write64(codeBase + 104u,
+                                        packVuInstructionPair(0x8000033cu, kVuUpperNop | 0x40000000u));
+                            const uint64_t before = ps2_vu_detail::countedLoopPairs;
+                            const unsigned budget = mode == 2u ? 24u : 18u;
+                            native.resume(a.code, codeSize, a.data, dataSize, a.gs, &a.mem, 0u, 0u, budget);
+                            oracle.resume(b.code, codeSize, b.data, dataSize, b.gs, &b.mem, 0u, 0u, budget);
+                            t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                "pending Q/D-I survive compiled reentry and a late E-bit replacement");
+                            t.IsTrue(std::memcmp(a.data, b.data, dataSize) == 0,
+                                "reentered division loops preserve delay-slot stores");
+                            if (std::getenv("PS2_VU_REQUIRE_DIV_LOOPS"))
+                                t.Equals(ps2_vu_detail::countedLoopPairs - before,
+                                    stop && step >= 3u ? uint64_t{0} : uint64_t{17},
+                                    "each complete valid loop resumes while changed end controls use fallback");
+                        }
+                    }
+        });
+
+        tc.Run("thirty-two-pair loops invalidate and restore every late code offset", [](TestCase &t)
+        {
+            for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
+                for (unsigned offset = 16u; offset < 32u; ++offset)
+                {
+                    Vu1Fixture a, b;
+                    t.IsTrue(a.initialize() && b.initialize(), "long loop fixtures initialize");
+                    const unsigned codeSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_SIZE : PS2_VU0_CODE_SIZE;
+                    const unsigned dataSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_DATA_SIZE : PS2_VU0_DATA_SIZE;
+                    const uint32_t codeBase = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_BASE : PS2_VU0_CODE_BASE;
+                    for (auto *fx : {&a, &b})
+                    {
+                        if (unit == VU1Interpreter::Unit::VU0)
+                        {
+                            fx->code = fx->mem.getVU0Code();
+                            fx->data = fx->mem.getVU0Data();
+                        }
+                        writeLongLoopCode(fx->code, 0u);
+                    }
+                    uint64_t original;
+                    std::memcpy(&original, a.code + offset * 8u, sizeof(original));
+                    VU1Interpreter native(unit), oracle(unit);
+                    oracle.setCompiledExecutionEnabled(false);
+                    for (unsigned step = 0u; step < 3u; ++step)
+                    {
+                        if (step)
+                            for (auto *fx : {&a, &b})
+                                fx->mem.write64(codeBase + offset * 8u, step == 2u ? original :
+                                    packVuInstructionPair(makeVuIaddiu(15u, 0u, 123), kVuUpperNop));
+                        native.reset();
+                        oracle.reset();
+                        const uint64_t before = ps2_vu_detail::countedLoopPairs;
+                        native.execute(a.code, codeSize, a.data, dataSize, a.gs, &a.mem, 0u, 0u, 0u, 32u);
+                        oracle.execute(b.code, codeSize, b.data, dataSize, b.gs, &b.mem, 0u, 0u, 0u, 32u);
+                        t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                            "every late edit and restore changes cached dispatch before it executes");
+                        if (std::getenv("PS2_VU_REQUIRE_DIV_LOOPS"))
+                            t.Equals(ps2_vu_detail::countedLoopPairs - before, step == 1u ? uint64_t{0} : uint64_t{32},
+                                "the 32-pair specialization runs only for its complete byte identity");
+                    }
+                }
+        });
+
         tc.Run("terminal conditional regions preserve branch bypass and delayed tails", [](TestCase &t)
         {
             for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
@@ -487,7 +769,7 @@ void register_ps2_vu1_tests()
             }
         });
 
-        tc.Run("natural loops keep flag-reading bodies on the exact fallback", [](TestCase &t)
+        tc.Run("natural loops retain unchanged CLIP flag reads", [](TestCase &t)
         {
             for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
                 for (unsigned budget : {4u, 8u, 19u})
@@ -517,8 +799,9 @@ void register_ps2_vu1_tests()
                         nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, budget);
                     oracle.execute(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
                         oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, budget);
-                    t.Equals(ps2_vu_detail::countedLoopPairs - before, uint64_t{0},
-                        "broader bounded-region support must not enable unsupported loop flag timelines");
+                    if (std::getenv("PS2_VU_REQUIRE_COUNTED_LOOPS"))
+                        t.Equals(ps2_vu_detail::countedLoopPairs - before, uint64_t{4u * (budget / 4u)},
+                            "complete iterations must retain the CLIP predicate");
                     for (unsigned tail = 0; tail < 8u; ++tail)
                     {
                         t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
@@ -531,6 +814,74 @@ void register_ps2_vu1_tests()
                 }
         });
 
+        tc.Run("natural loops carry every delayed CLIP version across backedges", [](TestCase &t)
+        {
+            for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
+                for (unsigned phase = 0u; phase < 8u; ++phase)
+                    for (unsigned variant = 0u; variant < 4u; ++variant)
+                        for (unsigned budget = 0u; budget <= 34u; ++budget)
+                        {
+                            Vu1Fixture nativeMemory, oracleMemory;
+                            t.IsTrue(nativeMemory.initialize() && oracleMemory.initialize(), "CLIP loop fixtures initialize");
+                            const uint32_t codeSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_CODE_SIZE : PS2_VU0_CODE_SIZE;
+                            const uint32_t dataSize = unit == VU1Interpreter::Unit::VU1 ? PS2_VU1_DATA_SIZE : PS2_VU0_DATA_SIZE;
+                            const uint32_t start = (phase + 3u) * 8u;
+                            for (auto *fx : {&nativeMemory, &oracleMemory})
+                            {
+                                if (unit == VU1Interpreter::Unit::VU0)
+                                {
+                                    fx->code = fx->mem.getVU0Code();
+                                    fx->data = fx->mem.getVU0Data();
+                                }
+                                for (unsigned pc = 0u; pc < codeSize; pc += 8u)
+                                    writeVuInstructionPair(fx->code, pc, 0x8000033cu, kVuUpperNop);
+                                for (unsigned index = 0u; index < 3u; ++index)
+                                    writeVuInstructionPair(fx->code, (phase + index) * 8u,
+                                        0x22000000u | ((0x246813u * (index + 1u)) & 0xffffffu), kVuUpperNop);
+                                for (unsigned index = 0u; index < 8u; ++index)
+                                {
+                                    const uint32_t read = variant == 0u ? 0x38000000u | ((index + 2u) << 16u) :
+                                        variant == 1u ? 0x24000000u | (1u << (index * 3u)) :
+                                        variant == 2u ? 0x26000000u | (0xffffffu ^ (1u << (index * 3u))) :
+                                                        0x20000000u | (0x123456u * index);
+                                    const uint32_t lower = index == 6u ? 0x500007f9u : read;
+                                    writeVuInstructionPair(fx->code, start + index * 8u, lower,
+                                        makeVuUpperSpecial(0x1fu, 15u, 10u, static_cast<uint8_t>(index + 1u)));
+                                }
+                            }
+                            VU1Interpreter native(unit), oracle(unit);
+                            for (unsigned reg = 1u; reg <= 10u; ++reg)
+                                for (unsigned lane = 0u; lane < 4u; ++lane)
+                                    native.state().vf[reg][lane] = static_cast<float>(static_cast<int>((reg + 2u * lane) % 7u) - 3);
+                            native.state().vf[10][3] = 1.0f;
+                            native.state().clip = 0xabcdefu;
+                            oracle.state() = native.state();
+                            native.setCompiledExecutionEnabled(false);
+                            oracle.setCompiledExecutionEnabled(false);
+                            native.execute(nativeMemory.code, codeSize, nativeMemory.data, dataSize,
+                                nativeMemory.gs, &nativeMemory.mem, 0u, 0u, 0u, phase + 3u);
+                            oracle.execute(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
+                                oracleMemory.gs, &oracleMemory.mem, 0u, 0u, 0u, phase + 3u);
+                            native.setCompiledExecutionEnabled(true);
+                            const uint64_t before = ps2_vu_detail::countedLoopPairs;
+                            for (unsigned step = 0u; step < 10u; ++step)
+                            {
+                                const unsigned cycles = step == 0u ? budget : 1u;
+                                if (step != 0u)
+                                    native.setCompiledExecutionEnabled(false);
+                                native.resume(nativeMemory.code, codeSize, nativeMemory.data, dataSize,
+                                    nativeMemory.gs, &nativeMemory.mem, 0u, 0u, cycles);
+                                oracle.resume(oracleMemory.code, codeSize, oracleMemory.data, dataSize,
+                                    oracleMemory.gs, &oracleMemory.mem, 0u, 0u, cycles);
+                                t.IsTrue(std::memcmp(&native.state(), &oracle.state(), sizeof(VU1State)) == 0,
+                                    "each flag read and raw tail must see the CLIP version ready at its issue cycle");
+                                if (step == 0u && std::getenv("PS2_VU_REQUIRE_COUNTED_LOOPS"))
+                                    t.Equals(ps2_vu_detail::countedLoopPairs - before, uint64_t{8u * (budget / 8u)},
+                                        "whole CLIP loop iterations must execute the retained path");
+                            }
+                        }
+        });
+
         tc.Run("natural loops without counters yield at every exact budget", [](TestCase &t)
         {
             for (auto unit : {VU1Interpreter::Unit::VU0, VU1Interpreter::Unit::VU1})
diff --git a/tools/compile_vu_blocks.py b/tools/compile_vu_blocks.py
index 37c9b94e2..fd545f935 100644
--- a/tools/compile_vu_blocks.py
+++ b/tools/compile_vu_blocks.py
@@ -15,7 +15,7 @@ def read_blocks(paths, parser):
             loops = data.startswith(b"VU-BLOCKS 3\n")
             for line in data.decode("ascii").splitlines()[1:]:
                 fields = line.split()
-                if len(fields) not in (range(5, 18) if loops else (5, 9, 13, 17) if extended else (5,)):
+                if len(fields) not in (range(5, 34) if loops else (5, 9, 13, 17) if extended else (5,)):
                     parser.error(f"{path}: invalid block profile record")
                 try:
                     unit = int(fields[0])
@@ -56,7 +56,7 @@ def read_counted_loops(paths, parser):
                 continue
             offset = (branch & 0x7ff) - (0x800 if branch & 0x400 else 0)
             head = index + 1 + offset
-            if head < 0 or not 4 <= index + 2 - head <= 16:
+            if head < 0 or not 4 <= index + 2 - head <= 32:
                 continue
             if any(not word >> 63 and ((word & 0xffffffff) >> 25) in
                    (0x20, 0x21, 0x24, 0x25, 0x28, 0x29, 0x2c, 0x2d, 0x2e, 0x2f)
diff --git a/tools/tests/test_compile_vu_blocks.py b/tools/tests/test_compile_vu_blocks.py
index e2ac7f608..21ad25619 100644
--- a/tools/tests/test_compile_vu_blocks.py
+++ b/tools/tests/test_compile_vu_blocks.py
@@ -40,7 +40,7 @@ def test_counted_loop_discovery_matches_explicit_profiles_for_both_units(self):
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
             script = Path(__file__).resolve().parents[1] / "compile_vu_blocks.py"
-            for pairs in (4, 7, 16):
+            for pairs in (4, 7, 16, 17, 31, 32):
                 words = [0x000002ff8000033c] * pairs  # Authored NOP pairs.
                 words[-2] = (0x000002ff << 32) | (0x29 << 25) | (2 << 16) | (3 << 11) | ((1 - pairs) & 0x7ff)
                 words[-1] = (0x000002ff << 32) | 0x8000037d | (8 << 21) | (2 << 16) | (4 << 11)
@@ -162,7 +162,7 @@ def test_profile_length_and_word_bounds_are_rejected(self):
             script = Path(__file__).resolve().parents[1] / "compile_vu_blocks.py"
             for header, words in [(1, "1 2 3 4 5 6 7 8"), (2, "1 2 3 4 5"),
                                   (2, "1 2 3 10000000000000000"), (2, "1 2 3 -1"),
-                                  (3, "1 2 3"), (3, " ".join(["1"] * 17)),
+                                  (3, "1 2 3"), (3, " ".join(["1"] * 33)),
                                   (3, "1 2 3 10000000000000000"), (3, "1 2 3 -1")]:
                 profile.write_text(f"VU-BLOCKS {header}\n1 {words}\n")
                 result = subprocess.run([sys.executable, str(script), "--output", str(output),

From 0ccd87309ec5fbec0cbf0c883cd898f47f4158da Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Wed, 23 Sep 2026 10:05:38 +0200
Subject: [PATCH 54/68] Document authored VU fixture provenance

---
 ps2xTest/data/README.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 ps2xTest/data/README.md

diff --git a/ps2xTest/data/README.md b/ps2xTest/data/README.md
new file mode 100644
index 000000000..b547eb9d8
--- /dev/null
+++ b/ps2xTest/data/README.md
@@ -0,0 +1,21 @@
+# VU test fixtures
+
+The `vu_*.vublocks` files contain authored instruction sequences for static VU
+compilation tests. They are synthetic programs, not captured game microcode.
+They follow this repository's [license](../../LICENSE).
+
+The corresponding [runtime tests](../src/ps2_vu1_tests.cpp) construct the same
+programs with instruction-encoding helpers and check registers, pipeline timing,
+branches, memory writes, and execution-budget boundaries. Named builders include
+`writeCountedLoopCode`, `writeEarlyCounterLoopCode`, `writeDivLoopCode`,
+`writeDivClipLoopCode`, `writeLongLoopCode`, and `writeTerminalBranchFixture`;
+the other cases construct their sequences within the tests.
+
+[`compile_vu_blocks.py`](../../tools/compile_vu_blocks.py) consumes these profiles
+to generate native instantiations and a dispatch registry. Its
+[tests](../../tools/tests/test_compile_vu_blocks.py) also create synthetic input
+profiles and code images. The profile format contains instruction records only,
+so provenance is documented here rather than inside the fixture files.
+
+Runtime captures, game code images, snapshots, and native sources generated from
+game inputs remain local build artifacts. Do not add them to this directory.

From f16758da724c4e93c4c9ec81db441d5acca80cad Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:32:50 +0200
Subject: [PATCH 55/68] Run a game's own IRX modules on an emulated IOP

Sound drivers are the part of the IOP that high-level services reproduce
worst. Their RPC protocol is simple enough, but the sound itself comes
from how the driver programs the SPU2: envelopes, reverb, streaming
through AutoDMA, timers that pace the sequencer. Rewriting that for every
game would never end, so this runs the original modules instead.

NativeIop loads IRX files onto a small emulated IOP: an R3000A
interpreter, a high-level kernel with the calls sound drivers make
(threads, semaphores, event flags, mailboxes, alarms, hardware timers,
interrupts, the heap, SIF RPC and DMA, a little sysclib), and both SPU2
cores with their voices, reverb and 2 MiB of sound memory.

IOP time advances only with the SPU2's output, 768 cycles per 48 kHz
sample, and whoever pulls samples drives it. Work done to answer an RPC,
and interrupt, alarm and timer handlers, runs without moving the clock;
charging it to the clock made heavy RPC traffic run the drivers' timers
ahead of the audio, and music played fast.

Once a native module registers an RPC server, IopSubsystem hands requests
for that SID to it before any high-level service. A module that binds
back to an EE server can ask the host whether that server exists yet.
---
 ps2xIOP/CMakeLists.txt                   |    6 +
 ps2xIOP/include/ps2x/iop/iop_host.h      |    7 +
 ps2xIOP/include/ps2x/iop/iop_subsystem.h |    4 +
 ps2xIOP/include/ps2x/iop/native_iop.h    |   53 ++
 ps2xIOP/src/iop_subsystem.cpp            |   21 +-
 ps2xIOP/src/lle/bus.h                    |   70 ++
 ps2xIOP/src/lle/cpu.cpp                  |  247 ++++++
 ps2xIOP/src/lle/cpu.h                    |   51 ++
 ps2xIOP/src/lle/iop.cpp                  |  569 ++++++++++++
 ps2xIOP/src/lle/iop.h                    |  228 +++++
 ps2xIOP/src/lle/irx.cpp                  |  193 +++++
 ps2xIOP/src/lle/irx.h                    |   42 +
 ps2xIOP/src/lle/kernel.cpp               | 1013 ++++++++++++++++++++++
 ps2xIOP/src/lle/kernel_handlers.inc      |   84 ++
 ps2xIOP/src/lle/spu2.cpp                 |  692 +++++++++++++++
 ps2xIOP/src/lle/spu2.h                   |  122 +++
 ps2xIOP/src/native_iop.cpp               |  207 +++++
 17 files changed, 3608 insertions(+), 1 deletion(-)
 create mode 100644 ps2xIOP/include/ps2x/iop/native_iop.h
 create mode 100644 ps2xIOP/src/lle/bus.h
 create mode 100644 ps2xIOP/src/lle/cpu.cpp
 create mode 100644 ps2xIOP/src/lle/cpu.h
 create mode 100644 ps2xIOP/src/lle/iop.cpp
 create mode 100644 ps2xIOP/src/lle/iop.h
 create mode 100644 ps2xIOP/src/lle/irx.cpp
 create mode 100644 ps2xIOP/src/lle/irx.h
 create mode 100644 ps2xIOP/src/lle/kernel.cpp
 create mode 100644 ps2xIOP/src/lle/kernel_handlers.inc
 create mode 100644 ps2xIOP/src/lle/spu2.cpp
 create mode 100644 ps2xIOP/src/lle/spu2.h
 create mode 100644 ps2xIOP/src/native_iop.cpp

diff --git a/ps2xIOP/CMakeLists.txt b/ps2xIOP/CMakeLists.txt
index e17b4724d..d289937c3 100644
--- a/ps2xIOP/CMakeLists.txt
+++ b/ps2xIOP/CMakeLists.txt
@@ -16,6 +16,12 @@ add_library(ps2_iop STATIC
     src/modules/clfile.cpp
     src/modules/sound_update_stub.cpp
     src/modules/sdrdrv.cpp
+    src/native_iop.cpp
+    src/lle/cpu.cpp
+    src/lle/irx.cpp
+    src/lle/iop.cpp
+    src/lle/kernel.cpp
+    src/lle/spu2.cpp
 )
 
 target_compile_features(ps2_iop PUBLIC cxx_std_20)
diff --git a/ps2xIOP/include/ps2x/iop/iop_host.h b/ps2xIOP/include/ps2x/iop/iop_host.h
index 1c872effa..dceafa3bb 100644
--- a/ps2xIOP/include/ps2x/iop/iop_host.h
+++ b/ps2xIOP/include/ps2x/iop/iop_host.h
@@ -82,6 +82,13 @@ namespace ps2x::iop
         virtual int32_t memoryCard(const MemoryCardRequest &request) = 0;
 
         virtual bool hasGuestFunction(uint32_t address) const = 0;
+        // Whether the EE has registered an RPC server under this id, which is
+        // what an IOP module binding to it waits for.
+        virtual bool hasGuestRpcServer(uint32_t sid) const
+        {
+            (void)sid;
+            return false;
+        }
         virtual bool invokeGuestFunction(uint64_t callToken,
                                          uint32_t address,
                                          uint32_t a0,
diff --git a/ps2xIOP/include/ps2x/iop/iop_subsystem.h b/ps2xIOP/include/ps2x/iop/iop_subsystem.h
index 0d086a0e9..c8dd03f54 100644
--- a/ps2xIOP/include/ps2x/iop/iop_subsystem.h
+++ b/ps2xIOP/include/ps2x/iop/iop_subsystem.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include "ps2x/iop/iop_host.h"
+#include "ps2x/iop/native_iop.h"
 #include "ps2x/iop/iop_types.h"
 
 #include <filesystem>
@@ -33,6 +34,9 @@ namespace ps2x::iop
 
         [[nodiscard]] DebugSnapshot debugSnapshot() const;
 
+        // Original IRX modules running on an emulated IOP; see NativeIop.
+        [[nodiscard]] NativeIop &native();
+
     private:
         class Impl;
         std::unique_ptr<Impl> m_impl;
diff --git a/ps2xIOP/include/ps2x/iop/native_iop.h b/ps2xIOP/include/ps2x/iop/native_iop.h
new file mode 100644
index 000000000..7cf6d9226
--- /dev/null
+++ b/ps2xIOP/include/ps2x/iop/native_iop.h
@@ -0,0 +1,53 @@
+#pragma once
+
+#include "ps2x/iop/iop_host.h"
+
+#include <cstdint>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace ps2x::iop
+{
+    // Runs a game's own IRX modules, sound drivers mostly, on an emulated IOP
+    // with an SPU2. The audio callback calls render() while the EE thread loads
+    // modules and makes calls, so every entry point takes the same lock.
+    class NativeIop
+    {
+    public:
+        explicit NativeIop(IopHost &host);
+        ~NativeIop();
+
+        NativeIop(const NativeIop &) = delete;
+        NativeIop &operator=(const NativeIop &) = delete;
+
+        // Module file names (for example "LIBSD.IRX") that run natively.
+        // Once any are set, IOP memory handed to the EE is this IOP's.
+        void setModules(std::vector<std::string> names);
+        bool enabled() const;
+        bool claims(std::string_view guestPath) const;
+        // Load a claimed module; arguments are NUL-separated as sceSifLoadModule passes them.
+        int32_t load(std::string_view guestPath, std::string_view arguments);
+
+        // A server a native module registered, with its record and receive buffer.
+        bool server(uint32_t sid, uint32_t &record, uint32_t &buffer) const;
+        // Blocking SIF RPC. The reply is written to receiveAddress in EE memory.
+        bool call(uint32_t sid, uint32_t function, uint32_t sendAddress, uint32_t sendSize,
+                  uint32_t receiveAddress, uint32_t receiveSize);
+
+        // IOP memory as the EE sees it through SIF DMA and the IOP heap calls.
+        bool write(uint32_t address, const void *data, uint32_t size);
+        bool read(uint32_t address, void *data, uint32_t size);
+        uint32_t allocate(uint32_t size);
+        void release(uint32_t address);
+
+        // Fill interleaved 48 kHz stereo frames, running the IOP in step.
+        void render(int16_t *frames, uint32_t count);
+        bool active() const;
+
+    private:
+        class Impl;
+        std::unique_ptr<Impl> m_impl;
+    };
+}
diff --git a/ps2xIOP/src/iop_subsystem.cpp b/ps2xIOP/src/iop_subsystem.cpp
index d848f8de7..f07ba8356 100644
--- a/ps2xIOP/src/iop_subsystem.cpp
+++ b/ps2xIOP/src/iop_subsystem.cpp
@@ -68,7 +68,8 @@ namespace ps2x::iop
     {
     public:
         explicit Impl(IopHost &hostRef)
-            : host(hostRef), pluginCatalog(hostRef), coreServices(detail::createCoreServices(hostRef)), profiles(detail::createBuiltinProfiles())
+            : host(hostRef), pluginCatalog(hostRef), coreServices(detail::createCoreServices(hostRef)), profiles(detail::createBuiltinProfiles()),
+              native(hostRef)
         {
             rebuildRoutes();
         }
@@ -118,6 +119,7 @@ namespace ps2x::iop
         std::string activeProvider;
         std::string lastError;
         bool routesValid = true;
+        NativeIop native;
     };
 
     IopSubsystem::IopSubsystem(IopHost &host)
@@ -279,6 +281,18 @@ namespace ps2x::iop
 
     RpcResult IopSubsystem::handleRpc(const RpcRequest &request)
     {
+        // A server registered by a native module replaces any high-level one.
+        uint32_t record = 0, buffer = 0;
+        if (m_impl->native.server(request.sid, record, buffer))
+        {
+            RpcResult result;
+            result.handled = m_impl->native.call(request.sid, request.function, request.send.address,
+                                                 request.send.size, request.receive.address,
+                                                 request.receive.size);
+            result.resultAddress = request.receive.address;
+            result.serverDispatchPolicy = ServerDispatchPolicy::Suppress;
+            return result;
+        }
         const auto it = m_impl->routes.find(request.sid);
         if (it == m_impl->routes.end() || !it->second)
         {
@@ -305,6 +319,11 @@ namespace ps2x::iop
         }
     }
 
+    NativeIop &IopSubsystem::native()
+    {
+        return m_impl->native;
+    }
+
     DebugSnapshot IopSubsystem::debugSnapshot() const
     {
         DebugSnapshot snapshot;
diff --git a/ps2xIOP/src/lle/bus.h b/ps2xIOP/src/lle/bus.h
new file mode 100644
index 000000000..7072536b8
--- /dev/null
+++ b/ps2xIOP/src/lle/bus.h
@@ -0,0 +1,70 @@
+#pragma once
+
+#include <cstdint>
+#include <cstring>
+#include <vector>
+
+namespace ps2x::iop::lle
+{
+    // Hardware registers behind 0x1F801000 and the SPU2 window.
+    class IoDevice
+    {
+    public:
+        virtual ~IoDevice() = default;
+        virtual uint32_t ioRead(uint32_t physical, unsigned bytes) = 0;
+        virtual void ioWrite(uint32_t physical, uint32_t value, unsigned bytes) = 0;
+    };
+
+    // The IOP's physical address space: 2 MiB of RAM (mirrored through the
+    // first 8 MiB), the 1 KiB scratchpad and memory-mapped hardware.
+    class Bus
+    {
+    public:
+        static constexpr uint32_t kRamBytes = 2u << 20;
+
+        explicit Bus(IoDevice &io) : m_io(io), m_ram(kRamBytes, 0u), m_scratchpad(1024u, 0u) {}
+
+        uint8_t *ram() { return m_ram.data(); }
+        const uint8_t *ram() const { return m_ram.data(); }
+
+        uint32_t fetch(uint32_t address) { return read32(address); }
+
+        uint8_t read8(uint32_t address) { return static_cast<uint8_t>(read<1>(address)); }
+        uint16_t read16(uint32_t address) { return static_cast<uint16_t>(read<2>(address)); }
+        uint32_t read32(uint32_t address) { return read<4>(address); }
+        void write8(uint32_t address, uint8_t value) { write<1>(address, value); }
+        void write16(uint32_t address, uint16_t value) { write<2>(address, value); }
+        void write32(uint32_t address, uint32_t value) { write<4>(address, value); }
+
+    private:
+        template <unsigned Bytes>
+        uint32_t read(uint32_t address)
+        {
+            const uint32_t physical = address & 0x1FFFFFFFu;
+            uint32_t value = 0;
+            if (physical < 0x00800000u)
+                std::memcpy(&value, &m_ram[physical & (kRamBytes - Bytes)], Bytes);
+            else if ((physical & ~0x3FFu) == 0x1F800000u)
+                std::memcpy(&value, &m_scratchpad[physical & (0x400u - Bytes)], Bytes);
+            else
+                value = m_io.ioRead(physical, Bytes);
+            return value;
+        }
+
+        template <unsigned Bytes>
+        void write(uint32_t address, uint32_t value)
+        {
+            const uint32_t physical = address & 0x1FFFFFFFu;
+            if (physical < 0x00800000u)
+                std::memcpy(&m_ram[physical & (kRamBytes - Bytes)], &value, Bytes);
+            else if ((physical & ~0x3FFu) == 0x1F800000u)
+                std::memcpy(&m_scratchpad[physical & (0x400u - Bytes)], &value, Bytes);
+            else
+                m_io.ioWrite(physical, value, Bytes);
+        }
+
+        IoDevice &m_io;
+        std::vector<uint8_t> m_ram;
+        std::vector<uint8_t> m_scratchpad;
+    };
+}
diff --git a/ps2xIOP/src/lle/cpu.cpp b/ps2xIOP/src/lle/cpu.cpp
new file mode 100644
index 000000000..75350a939
--- /dev/null
+++ b/ps2xIOP/src/lle/cpu.cpp
@@ -0,0 +1,247 @@
+#include "cpu.h"
+#include "bus.h"
+
+namespace ps2x::iop::lle
+{
+    namespace
+    {
+        inline int32_t signExtend16(uint32_t value) { return static_cast<int16_t>(value & 0xFFFFu); }
+    }
+
+    StopReason Cpu::run(CpuContext &c, uint64_t &cycles, uint64_t budget)
+    {
+        uint32_t *const r = c.gpr;
+        while (cycles < budget)
+        {
+            const uint32_t pc = c.pc;
+            const uint32_t op = m_bus.fetch(pc);
+            ++cycles;
+
+            // Leaving a delay slot takes the branch; otherwise fall through.
+            uint32_t next = pc + 4u;
+            if (c.branchPending)
+            {
+                next = c.branchTarget;
+                c.branchPending = false;
+            }
+
+            // A load issued by the previous instruction lands after this one
+            // reads its operands.
+            const uint8_t delayedRegister = c.loadRegister;
+            const uint32_t delayedValue = c.loadValue;
+            c.loadRegister = 0;
+
+            const uint32_t rs = (op >> 21) & 31u;
+            const uint32_t rt = (op >> 16) & 31u;
+            const uint32_t rd = (op >> 11) & 31u;
+            const uint32_t imm = op & 0xFFFFu;
+            const int32_t simm = signExtend16(op);
+            uint32_t writeRegister = 0;
+            uint32_t writeValue = 0;
+            const auto set = [&](uint32_t reg, uint32_t value) {
+                writeRegister = reg;
+                writeValue = value;
+            };
+            const auto branch = [&](bool taken, uint32_t target) {
+                if (taken)
+                {
+                    c.branchPending = true;
+                    c.branchTarget = target;
+                }
+            };
+            const auto load = [&](uint32_t reg, uint32_t value) {
+                if (reg != 0u)
+                {
+                    c.loadRegister = static_cast<uint8_t>(reg);
+                    c.loadValue = value;
+                }
+            };
+            const uint32_t address = r[rs] + static_cast<uint32_t>(simm);
+
+            switch (op >> 26)
+            {
+            case 0x00:
+                switch (op & 63u)
+                {
+                case 0x00: set(rd, r[rt] << ((op >> 6) & 31u)); break;                       // SLL
+                case 0x02: set(rd, r[rt] >> ((op >> 6) & 31u)); break;                       // SRL
+                case 0x03: set(rd, static_cast<uint32_t>(static_cast<int32_t>(r[rt]) >> ((op >> 6) & 31u))); break; // SRA
+                case 0x04: set(rd, r[rt] << (r[rs] & 31u)); break;                           // SLLV
+                case 0x06: set(rd, r[rt] >> (r[rs] & 31u)); break;                           // SRLV
+                case 0x07: set(rd, static_cast<uint32_t>(static_cast<int32_t>(r[rt]) >> (r[rs] & 31u))); break; // SRAV
+                case 0x08: branch(true, r[rs]); break;                                       // JR
+                case 0x09:                                                                   // JALR
+                    set(rd, pc + 8u);
+                    branch(true, r[rs]);
+                    break;
+                case 0x0C:                                                                   // SYSCALL
+                    m_syscallCode = (op >> 6) & 0xFFFFFu;
+                    c.pc = next;
+                    if (delayedRegister != 0u)
+                        r[delayedRegister] = delayedValue;
+                    return StopReason::Syscall;
+                case 0x0D: break;                                                            // BREAK
+                case 0x10: set(rd, c.hi); break;                                             // MFHI
+                case 0x11: c.hi = r[rs]; break;                                              // MTHI
+                case 0x12: set(rd, c.lo); break;                                             // MFLO
+                case 0x13: c.lo = r[rs]; break;                                              // MTLO
+                case 0x18:                                                                   // MULT
+                {
+                    const int64_t product = static_cast<int64_t>(static_cast<int32_t>(r[rs])) *
+                                            static_cast<int32_t>(r[rt]);
+                    c.lo = static_cast<uint32_t>(product);
+                    c.hi = static_cast<uint32_t>(static_cast<uint64_t>(product) >> 32);
+                    break;
+                }
+                case 0x19:                                                                   // MULTU
+                {
+                    const uint64_t product = static_cast<uint64_t>(r[rs]) * r[rt];
+                    c.lo = static_cast<uint32_t>(product);
+                    c.hi = static_cast<uint32_t>(product >> 32);
+                    break;
+                }
+                case 0x1A:                                                                   // DIV
+                {
+                    const int32_t n = static_cast<int32_t>(r[rs]), d = static_cast<int32_t>(r[rt]);
+                    if (d == 0)
+                    {
+                        c.lo = n >= 0 ? 0xFFFFFFFFu : 1u;
+                        c.hi = static_cast<uint32_t>(n);
+                    }
+                    else if (n == INT32_MIN && d == -1)
+                    {
+                        c.lo = static_cast<uint32_t>(INT32_MIN);
+                        c.hi = 0;
+                    }
+                    else
+                    {
+                        c.lo = static_cast<uint32_t>(n / d);
+                        c.hi = static_cast<uint32_t>(n % d);
+                    }
+                    break;
+                }
+                case 0x1B:                                                                   // DIVU
+                    if (r[rt] == 0u)
+                    {
+                        c.lo = 0xFFFFFFFFu;
+                        c.hi = r[rs];
+                    }
+                    else
+                    {
+                        c.lo = r[rs] / r[rt];
+                        c.hi = r[rs] % r[rt];
+                    }
+                    break;
+                // Overflow traps are never relied on by IOP drivers; wrap like ADDU.
+                case 0x20: case 0x21: set(rd, r[rs] + r[rt]); break;                         // ADD, ADDU
+                case 0x22: case 0x23: set(rd, r[rs] - r[rt]); break;                         // SUB, SUBU
+                case 0x24: set(rd, r[rs] & r[rt]); break;                                    // AND
+                case 0x25: set(rd, r[rs] | r[rt]); break;                                    // OR
+                case 0x26: set(rd, r[rs] ^ r[rt]); break;                                    // XOR
+                case 0x27: set(rd, ~(r[rs] | r[rt])); break;                                 // NOR
+                case 0x2A: set(rd, static_cast<int32_t>(r[rs]) < static_cast<int32_t>(r[rt]) ? 1u : 0u); break; // SLT
+                case 0x2B: set(rd, r[rs] < r[rt] ? 1u : 0u); break;                          // SLTU
+                default:
+                    m_faultPc = pc;
+                    return StopReason::Fault;
+                }
+                break;
+            case 0x01:                                                                       // REGIMM
+            {
+                const bool less = static_cast<int32_t>(r[rs]) < 0;
+                const uint32_t target = pc + 4u + (static_cast<uint32_t>(simm) << 2);
+                const bool link = (rt & 0x1Eu) == 0x10u;
+                if (link)
+                    set(31, pc + 8u);
+                branch((rt & 1u) ? !less : less, target);                                    // BLTZ, BGEZ(AL)
+                break;
+            }
+            case 0x02: branch(true, (pc & 0xF0000000u) | ((op & 0x03FFFFFFu) << 2)); break;  // J
+            case 0x03:                                                                       // JAL
+                set(31, pc + 8u);
+                branch(true, (pc & 0xF0000000u) | ((op & 0x03FFFFFFu) << 2));
+                break;
+            case 0x04: branch(r[rs] == r[rt], pc + 4u + (static_cast<uint32_t>(simm) << 2)); break;  // BEQ
+            case 0x05: branch(r[rs] != r[rt], pc + 4u + (static_cast<uint32_t>(simm) << 2)); break;  // BNE
+            case 0x06: branch(static_cast<int32_t>(r[rs]) <= 0, pc + 4u + (static_cast<uint32_t>(simm) << 2)); break; // BLEZ
+            case 0x07: branch(static_cast<int32_t>(r[rs]) > 0, pc + 4u + (static_cast<uint32_t>(simm) << 2)); break;  // BGTZ
+            case 0x08: case 0x09: set(rt, r[rs] + static_cast<uint32_t>(simm)); break;       // ADDI, ADDIU
+            case 0x0A: set(rt, static_cast<int32_t>(r[rs]) < simm ? 1u : 0u); break;         // SLTI
+            case 0x0B: set(rt, r[rs] < static_cast<uint32_t>(simm) ? 1u : 0u); break;        // SLTIU
+            case 0x0C: set(rt, r[rs] & imm); break;                                          // ANDI
+            case 0x0D: set(rt, r[rs] | imm); break;                                          // ORI
+            case 0x0E: set(rt, r[rs] ^ imm); break;                                          // XORI
+            case 0x0F: set(rt, imm << 16); break;                                            // LUI
+            case 0x10:                                                                       // COP0
+                if (rs == 0x00u)
+                    load(rt, rd == 12u ? m_status : 0u);                                     // MFC0
+                else if (rs == 0x04u && rd == 12u)
+                    m_status = r[rt];                                                        // MTC0 SR
+                else if (rs == 0x10u && (op & 63u) == 0x10u)
+                    m_status = (m_status & ~0xFu) | ((m_status >> 2) & 0xFu);                // RFE
+                break;
+            case 0x20: load(rt, static_cast<uint32_t>(static_cast<int8_t>(m_bus.read8(address)))); break;   // LB
+            case 0x21: load(rt, static_cast<uint32_t>(static_cast<int16_t>(m_bus.read16(address)))); break; // LH
+            case 0x22:                                                                       // LWL
+            {
+                const uint32_t word = m_bus.read32(address & ~3u);
+                const uint32_t shift = (address & 3u) * 8u;
+                const uint32_t current = delayedRegister == rt ? delayedValue : r[rt];
+                const uint32_t mask = shift == 24u ? 0u : 0x00FFFFFFu >> shift;
+                load(rt, (current & mask) | (word << (24u - shift)));
+                break;
+            }
+            case 0x23: load(rt, m_bus.read32(address)); break;                               // LW
+            case 0x24: load(rt, m_bus.read8(address)); break;                                // LBU
+            case 0x25: load(rt, m_bus.read16(address)); break;                               // LHU
+            case 0x26:                                                                       // LWR
+            {
+                const uint32_t word = m_bus.read32(address & ~3u);
+                const uint32_t shift = (address & 3u) * 8u;
+                const uint32_t current = delayedRegister == rt ? delayedValue : r[rt];
+                const uint32_t mask = shift == 0u ? 0u : 0xFFFFFF00u << (24u - shift);
+                load(rt, (current & mask) | (word >> shift));
+                break;
+            }
+            case 0x28: m_bus.write8(address, static_cast<uint8_t>(r[rt])); break;            // SB
+            case 0x29: m_bus.write16(address, static_cast<uint16_t>(r[rt])); break;          // SH
+            case 0x2A:                                                                       // SWL
+            {
+                const uint32_t aligned = address & ~3u;
+                const uint32_t shift = (address & 3u) * 8u;
+                const uint32_t word = m_bus.read32(aligned);
+                const uint32_t mask = shift == 24u ? 0u : 0xFFFFFF00u << shift;
+                m_bus.write32(aligned, (word & mask) | (r[rt] >> (24u - shift)));
+                break;
+            }
+            case 0x2B: m_bus.write32(address, r[rt]); break;                                 // SW
+            case 0x2E:                                                                       // SWR
+            {
+                const uint32_t aligned = address & ~3u;
+                const uint32_t shift = (address & 3u) * 8u;
+                const uint32_t word = m_bus.read32(aligned);
+                const uint32_t mask = shift == 0u ? 0u : 0x00FFFFFFu >> (24u - shift);
+                m_bus.write32(aligned, (word & mask) | (r[rt] << shift));
+                break;
+            }
+            case 0x2F: case 0x33: break;                                                     // CACHE, PREF
+            default:
+                m_faultPc = pc;
+                return StopReason::Fault;
+            }
+
+            // An ALU result written in a load delay slot wins over the load.
+            if (delayedRegister != 0u)
+                r[delayedRegister] = delayedValue;
+            if (writeRegister != 0u)
+            {
+                r[writeRegister] = writeValue;
+                if (c.loadRegister == writeRegister)
+                    c.loadRegister = 0;
+            }
+            r[0] = 0;
+            c.pc = next;
+        }
+        return StopReason::Budget;
+    }
+}
diff --git a/ps2xIOP/src/lle/cpu.h b/ps2xIOP/src/lle/cpu.h
new file mode 100644
index 000000000..189890cc7
--- /dev/null
+++ b/ps2xIOP/src/lle/cpu.h
@@ -0,0 +1,51 @@
+#pragma once
+
+#include <cstdint>
+
+namespace ps2x::iop::lle
+{
+    class Bus;
+
+    // One R3000A register context. Every IOP thread and the interrupt
+    // context own one; the scheduler swaps them in and out of the core.
+    struct CpuContext
+    {
+        uint32_t gpr[32]{};
+        uint32_t hi = 0;
+        uint32_t lo = 0;
+        uint32_t pc = 0;
+        uint32_t branchTarget = 0;
+        bool branchPending = false;
+        // R3000A loads land one instruction late.
+        uint8_t loadRegister = 0;
+        uint32_t loadValue = 0;
+    };
+
+    enum class StopReason : uint8_t
+    {
+        Budget,  // cycle budget used up
+        Syscall, // a SYSCALL trapped; the code is in syscallCode()
+        Fault,   // an instruction the IOP sound modules never use
+    };
+
+    class Cpu
+    {
+    public:
+        explicit Cpu(Bus &bus) noexcept : m_bus(bus) {}
+
+        // Run until the budget is spent or a trap needs the kernel. Returns
+        // with pc already past the trapping instruction.
+        StopReason run(CpuContext &context, uint64_t &cycles, uint64_t budget);
+
+        uint32_t syscallCode() const noexcept { return m_syscallCode; }
+        uint32_t faultPc() const noexcept { return m_faultPc; }
+        uint32_t cop0Status() const noexcept { return m_status; }
+        void setCop0Status(uint32_t status) noexcept { m_status = status; }
+
+    private:
+        Bus &m_bus;
+        uint32_t m_syscallCode = 0;
+        uint32_t m_faultPc = 0;
+        uint32_t m_status = 0;
+    };
+}
diff --git a/ps2xIOP/src/lle/iop.cpp b/ps2xIOP/src/lle/iop.cpp
new file mode 100644
index 000000000..b02d849c6
--- /dev/null
+++ b/ps2xIOP/src/lle/iop.cpp
@@ -0,0 +1,569 @@
+#include "iop.h"
+
+#include <algorithm>
+#include <cstring>
+
+namespace ps2x::iop::lle
+{
+    namespace
+    {
+        constexpr uint32_t kTrapBase = 0x1000u;       // return traps, one word each
+        constexpr uint32_t kCtypeBase = 0x1100u;      // sysclib's character class table
+        constexpr uint32_t kInterruptStack = 0x8000u; // top of the interrupt context stack
+        constexpr uint32_t kHeapBase = 0x10000u;
+        constexpr uint32_t kSpuDmaLines[2] = {36u, 40u}; // INUM_DMA_4, INUM_DMA_7
+        constexpr uint32_t kSpuLine = 9u;
+
+        uint32_t syscallWord(uint32_t code) { return 0x0000000Cu | (code << 6); }
+    }
+
+    Iop::Iop(EeLink &ee) : m_ee(ee), m_bus(*this), m_cpu(m_bus), m_spu2(*this)
+    {
+        installKernel();
+        uint8_t *ram = m_bus.ram();
+        // Threads and handlers return here; the trap tells the kernel they are done.
+        m_returnTrap = kTrapBase;
+        const uint32_t returnWord = syscallWord(handlerFor("", 1));
+        std::memcpy(ram + kTrapBase, &returnWord, 4);
+        m_rpcTrap = kTrapBase + 8u;
+        const uint32_t rpcWord = syscallWord(handlerFor("", 2));
+        std::memcpy(ram + m_rpcTrap, &rpcWord, 4);
+        // The ctype table sysclib hands out: bit 2 digit, 1 lower, 0 upper, 3 space, 6 hex.
+        m_ctypeTable = kCtypeBase;
+        for (uint32_t ch = 0; ch < 256u; ++ch)
+        {
+            uint8_t flags = 0;
+            if (ch >= '0' && ch <= '9') flags |= 0x04u;
+            if (ch >= 'a' && ch <= 'z') flags |= 0x02u;
+            if (ch >= 'A' && ch <= 'Z') flags |= 0x01u;
+            if (ch == ' ' || (ch >= 9u && ch <= 13u)) flags |= 0x08u;
+            if ((ch >= 'a' && ch <= 'f') || (ch >= 'A' && ch <= 'F')) flags |= 0x40u;
+            ram[kCtypeBase + 1u + ch] = flags;
+        }
+        m_allocations[0] = kHeapBase; // everything below the heap is the kernel's
+    }
+
+    Iop::~Iop() = default;
+
+    std::string Iop::readString(uint32_t address, size_t limit)
+    {
+        std::string text;
+        for (size_t index = 0; index < limit; ++index)
+        {
+            const uint8_t ch = m_bus.read8(address + static_cast<uint32_t>(index));
+            if (ch == 0u)
+                break;
+            text.push_back(static_cast<char>(ch));
+        }
+        return text;
+    }
+
+    uint32_t Iop::arg(CpuContext &c, unsigned index)
+    {
+        return index < 4u ? c.gpr[4 + index] : m_bus.read32(c.gpr[29] + 16u + (index - 4u) * 4u);
+    }
+
+    uint32_t Iop::allocate(uint32_t size)
+    {
+        size = (size + 255u) & ~255u;
+        uint32_t cursor = kHeapBase;
+        for (const auto &[address, length] : m_allocations)
+        {
+            if (address >= cursor && address - cursor >= size)
+                break;
+            cursor = std::max(cursor, (address + length + 255u) & ~255u);
+        }
+        if (cursor + size > Bus::kRamBytes)
+            return 0;
+        m_allocations[cursor] = size;
+        return cursor;
+    }
+
+    void Iop::release(uint32_t address)
+    {
+        if (address >= kHeapBase)
+            m_allocations.erase(address);
+    }
+
+    void Iop::writeMemory(uint32_t address, const void *data, uint32_t size)
+    {
+        address &= Bus::kRamBytes - 1u;
+        size = std::min(size, Bus::kRamBytes - address);
+        std::memcpy(m_bus.ram() + address, data, size);
+    }
+
+    void Iop::readMemory(uint32_t address, void *data, uint32_t size)
+    {
+        address &= Bus::kRamBytes - 1u;
+        size = std::min(size, Bus::kRamBytes - address);
+        std::memcpy(data, m_bus.ram() + address, size);
+    }
+
+    // ------------------------------------------------------------------ hardware
+
+    uint32_t Iop::ioRead(uint32_t physical, unsigned bytes)
+    {
+        if (physical >= 0x1F900000u && physical < 0x1F900800u)
+        {
+            uint32_t value = m_spu2.read(physical & 0x7FFu);
+            if (bytes == 4u)
+                value |= static_cast<uint32_t>(m_spu2.read((physical + 2u) & 0x7FFu)) << 16;
+            return value;
+        }
+        int channel = 0;
+        if (uint32_t *reg = dmaRegister(physical, channel))
+            return *reg >> ((physical & 3u) * 8u);
+        return 0;
+    }
+
+    uint32_t *Iop::dmaRegister(uint32_t physical, int &channel)
+    {
+        for (channel = 0; channel < 2; ++channel)
+        {
+            const uint32_t base = channel == 0 ? 0x1F8010C0u : 0x1F801500u;
+            if (physical >= base && physical < base + 12u)
+            {
+                DmaChannel &dma = m_dma[channel];
+                const uint32_t offset = physical - base;
+                return offset < 4u ? &dma.madr : offset < 8u ? &dma.bcr : &dma.chcr;
+            }
+        }
+        return nullptr;
+    }
+
+    void Iop::ioWrite(uint32_t physical, uint32_t value, unsigned bytes)
+    {
+        if (physical >= 0x1F900000u && physical < 0x1F900800u)
+        {
+            m_spu2.write(physical & 0x7FFu, static_cast<uint16_t>(value));
+            if (bytes == 4u)
+                m_spu2.write((physical + 2u) & 0x7FFu, static_cast<uint16_t>(value >> 16));
+            return;
+        }
+        // libsd writes the block count and size as separate halfwords.
+        int channel = 0;
+        if (uint32_t *reg = dmaRegister(physical, channel))
+        {
+            const uint32_t shift = (physical & 3u) * 8u;
+            const uint32_t mask = (bytes >= 4u ? 0xFFFFFFFFu : (1u << (bytes * 8u)) - 1u) << shift;
+            *reg = (*reg & ~mask) | ((value << shift) & mask);
+            DmaChannel &dma = m_dma[channel];
+            dma.madr &= 0x00FFFFFFu;
+            if (reg == &dma.chcr && (mask & value << shift & 0x01000000u) != 0u)
+                dmaTransfer(channel);
+        }
+    }
+
+    void Iop::dmaTransfer(int channel)
+    {
+        DmaChannel &dma = m_dma[channel];
+        const uint32_t blockWords = dma.bcr & 0xFFFFu;
+        const uint32_t blocks = std::max<uint32_t>(dma.bcr >> 16, 1u);
+        const uint32_t bytes = blockWords * blocks * 4u;
+        m_spu2.dmaStarted(channel);
+        if ((dma.chcr & 1u) != 0u && m_spu2.autoDmaEnabled(channel))
+        {
+            // AutoDMA: the SPU2 pulls 1 KiB at a time as it plays.
+            dma.remaining = bytes;
+            return;
+        }
+        const uint32_t address = dma.madr & (Bus::kRamBytes - 1u);
+        const uint32_t length = std::min(bytes, Bus::kRamBytes - address);
+        auto *words = reinterpret_cast<uint16_t *>(m_bus.ram() + address);
+        if ((dma.chcr & 1u) != 0u)
+            m_spu2.dmaWrite(channel, words, length / 2u);
+        else
+            m_spu2.dmaRead(channel, words, length / 2u);
+        dma.madr = (dma.madr + length) & 0x00FFFFFFu;
+        dma.chcr &= ~0x01000000u;
+        raiseInterrupt(kSpuDmaLines[channel]);
+    }
+
+    bool Iop::fetchAutoDma(int core, uint16_t *block)
+    {
+        DmaChannel &dma = m_dma[core];
+        if ((dma.chcr & 0x01000000u) == 0u || dma.remaining < 1024u)
+            return false;
+        readMemory(dma.madr, block, 1024u);
+        dma.madr = (dma.madr + 1024u) & 0x00FFFFFFu;
+        dma.remaining -= 1024u;
+        if (dma.remaining < 1024u)
+        {
+            dma.chcr &= ~0x01000000u;
+            raiseInterrupt(kSpuDmaLines[core]);
+        }
+        return true;
+    }
+
+    void Iop::raiseSpuInterrupt() { raiseInterrupt(kSpuLine); }
+
+    void Iop::raiseInterrupt(uint32_t line)
+    {
+        if (std::find(m_pendingInterrupts.begin(), m_pendingInterrupts.end(), line) == m_pendingInterrupts.end())
+            m_pendingInterrupts.push_back(line);
+    }
+
+    // ------------------------------------------------------------------ execution
+
+    void Iop::call(uint32_t function, std::initializer_list<uint32_t> arguments, uint32_t *result, uint32_t gp)
+    {
+        CpuContext context{};
+        context.pc = function;
+        unsigned index = 4;
+        for (const uint32_t value : arguments)
+            context.gpr[index++] = value;
+        context.gpr[28] = gp;
+        context.gpr[29] = kInterruptStack - 16u;
+        context.gpr[31] = m_returnTrap;
+        const bool nested = m_inInterrupt;
+        m_inInterrupt = true;
+        // Handlers run between samples, off the clock like RPC work.
+        uint64_t spent = 0;
+        const uint64_t limit = 4'000'000u;
+        for (;;)
+        {
+            const StopReason reason = m_cpu.run(context, spent, limit);
+            if (reason != StopReason::Syscall)
+            {
+                m_ee.log("[iop] handler at " + std::to_string(function) + " did not return");
+                break;
+            }
+            const uint32_t code = m_cpu.syscallCode();
+            if (code < m_handlers.size() && m_handlers[code] == &Iop::functionReturn)
+                break;
+            context.pc = context.gpr[31];
+            if (code < m_handlers.size())
+                (this->*m_handlers[code])(context);
+        }
+        m_inInterrupt = nested;
+        if (result)
+            *result = context.gpr[2];
+    }
+
+    void Iop::serviceInterrupts()
+    {
+        if (m_intrSuspend > 0)
+            return;
+        while (!m_pendingInterrupts.empty())
+        {
+            const uint32_t line = m_pendingInterrupts.front();
+            m_pendingInterrupts.erase(m_pendingInterrupts.begin());
+            const auto found = m_interrupts.find(line);
+            if (found == m_interrupts.end() || !found->second.enabled || found->second.handler == 0u)
+                continue;
+            uint32_t result = 0;
+            call(found->second.handler, {found->second.argument}, &result, found->second.gp);
+            // A handler returning zero leaves its line disabled.
+            if (result == 0u)
+                found->second.enabled = false;
+            reschedule();
+        }
+    }
+
+    void Iop::serviceEvents()
+    {
+        // Threads sleeping in DelayThread.
+        for (auto &[id, thread] : m_threads)
+            if (thread.wait == Wait::Delay && thread.wakeCycle <= m_cycle)
+                makeReady(thread, 0u);
+
+        // Alarms: the handler returns the next interval, or zero to stop.
+        for (auto it = m_alarms.begin(); it != m_alarms.end();)
+        {
+            if (it->second.cycle > m_cycle)
+            {
+                ++it;
+                continue;
+            }
+            const Alarm alarm = it->second;
+            it = m_alarms.erase(it);
+            uint32_t next = 0;
+            call(alarm.handler, {alarm.argument}, &next, alarm.gp);
+            if (next != 0u)
+                m_alarms.emplace(alarm.handler, Alarm{m_cycle + next, alarm.handler, alarm.argument, alarm.gp});
+            reschedule();
+        }
+
+        // Hardware timers: the handler returns the next compare value, or zero to stop.
+        for (auto &timer : m_timers)
+        {
+            if (!timer.running || timer.handler == 0u || timer.next > m_cycle)
+                continue;
+            uint32_t compare = 0;
+            call(timer.handler, {timer.argument}, &compare, timer.gp);
+            if (compare == 0u)
+                timer.running = false;
+            else
+            {
+                timer.compare = compare;
+                timer.next = m_cycle + static_cast<uint64_t>(compare) * timer.prescale;
+            }
+            reschedule();
+        }
+    }
+
+    Iop::Thread *Iop::pickThread()
+    {
+        Thread *best = nullptr;
+        for (auto &[id, thread] : m_threads)
+        {
+            if (thread.dormant || thread.wait != Wait::None)
+                continue;
+            if (!best || thread.priority < best->priority ||
+                (thread.priority == best->priority && thread.readySequence < best->readySequence))
+                best = &thread;
+        }
+        return best;
+    }
+
+    void Iop::makeReady(Thread &thread, uint32_t result)
+    {
+        thread.wait = Wait::None;
+        thread.context.gpr[2] = result;
+        thread.readySequence = ++m_readySequence;
+        reschedule();
+    }
+
+    void Iop::block(Wait wait, int32_t id)
+    {
+        Thread *thread = current();
+        if (!thread || m_inInterrupt)
+        {
+            m_ee.log("[iop] blocking call outside a thread");
+            return;
+        }
+        thread->wait = wait;
+        thread->waitId = id;
+        reschedule();
+    }
+
+    bool Iop::runThreads(uint64_t budget, bool advanceClock)
+    {
+        // Only the sample clock moves time. Work done off it, answering an
+        // RPC the moment it arrives, would otherwise run the timers fast.
+        uint64_t offClock = 0;
+        uint64_t &clock = advanceClock ? m_cycle : offClock;
+        bool ran = false;
+        const uint64_t end = clock + budget;
+        while (clock < end)
+        {
+            serviceInterrupts();
+            Thread *thread = m_intrSuspend > 0 && current() && current()->wait == Wait::None ? current() : pickThread();
+            if (!thread)
+                break;
+            m_current = thread->id;
+            m_reschedule = false;
+            ran = true;
+            while (!m_reschedule && clock < end)
+            {
+                const StopReason reason = m_cpu.run(thread->context, clock, end);
+                if (reason == StopReason::Budget)
+                    break;
+                if (reason == StopReason::Fault)
+                {
+                    m_ee.log("[iop] thread " + std::to_string(thread->id) + " stopped on an unsupported instruction");
+                    thread->dormant = true;
+                    reschedule();
+                    break;
+                }
+                const uint32_t code = m_cpu.syscallCode();
+                thread->context.pc = thread->context.gpr[31];
+                if (code < m_handlers.size())
+                    (this->*m_handlers[code])(thread->context);
+                if (thread->dormant || thread->wait != Wait::None)
+                    break;
+            }
+            deliverRequests();
+        }
+        m_current = 0;
+        return ran;
+    }
+
+    void Iop::settle()
+    {
+        deliverRequests();
+        // Enough for any command handler; threads spinning on hardware stop here.
+        runThreads(2'000'000u, false);
+    }
+
+    void Iop::step(int16_t &left, int16_t &right)
+    {
+        const uint64_t target = (m_cycle / kCyclesPerSample + 1u) * kCyclesPerSample;
+        serviceEvents();
+        deliverRequests();
+        runThreads(target > m_cycle ? target - m_cycle : 0u);
+        m_cycle = std::max(m_cycle, target);
+        m_spu2.tick(left, right);
+        serviceInterrupts();
+    }
+
+    // ------------------------------------------------------------------ RPC
+
+    bool Iop::hasServer(uint32_t sid) const { return m_servers.count(sid) != 0u; }
+
+    bool Iop::server(uint32_t sid, uint32_t &record, uint32_t &buffer) const
+    {
+        const auto found = m_servers.find(sid);
+        if (found == m_servers.end())
+            return false;
+        record = found->second.record;
+        buffer = found->second.buffer;
+        return true;
+    }
+
+    void Iop::submit(std::shared_ptr<Request> request) { m_requests.push_back(std::move(request)); }
+
+    void Iop::deliverRequests()
+    {
+        for (auto it = m_requests.begin(); it != m_requests.end();)
+        {
+            const auto server = m_servers.find((*it)->sid);
+            if (server == m_servers.end())
+            {
+                (*it)->done = true; // nobody serves it; the EE side falls back
+                it = m_requests.erase(it);
+                continue;
+            }
+            const auto owner = m_threads.find(server->second.thread);
+            if (owner == m_threads.end() || owner->second.wait != Wait::Rpc || m_active.count(owner->first) != 0u)
+            {
+                ++it;
+                continue;
+            }
+            Thread &thread = owner->second;
+            const Request &request = **it;
+            if (server->second.buffer != 0u && !request.send.empty())
+                writeMemory(server->second.buffer, request.send.data(), static_cast<uint32_t>(request.send.size()));
+            // Call the server function on top of the loop's own frame.
+            m_saved[thread.id] = thread.context;
+            CpuContext &c = thread.context;
+            c.pc = server->second.function;
+            c.gpr[4] = request.function;
+            c.gpr[5] = server->second.buffer;
+            c.gpr[6] = static_cast<uint32_t>(request.send.size());
+            c.gpr[29] -= 64u;
+            c.gpr[31] = m_rpcTrap;
+            c.branchPending = false;
+            c.loadRegister = 0;
+            m_active[thread.id] = *it;
+            makeReady(thread, 0u);
+            it = m_requests.erase(it);
+        }
+    }
+
+    void Iop::finishRequest(Thread &thread, uint32_t resultAddress)
+    {
+        const auto active = m_active.find(thread.id);
+        if (active == m_active.end())
+            return;
+        Request &request = *active->second;
+        if (request.receiveSize != 0u && request.receiveAddress != 0u && resultAddress != 0u)
+        {
+            std::vector<uint8_t> reply(request.receiveSize);
+            readMemory(resultAddress, reply.data(), request.receiveSize);
+            m_ee.writeEe(request.receiveAddress, reply.data(), request.receiveSize);
+        }
+        request.done = true;
+        m_active.erase(active);
+        thread.context = m_saved[thread.id];
+        thread.wait = Wait::Rpc;
+        reschedule();
+    }
+
+    // ------------------------------------------------------------------ modules
+
+    void Iop::linkImports(const std::vector<IrxImport> &imports)
+    {
+        for (const IrxImport &import : imports)
+        {
+            uint32_t word = 0;
+            const auto exported = m_exports.find(import.library);
+            if (exported != m_exports.end() && import.ordinal < exported->second.size() &&
+                exported->second[import.ordinal] != 0u)
+                word = 0x08000000u | ((exported->second[import.ordinal] >> 2) & 0x03FFFFFFu); // j target
+            else
+                word = syscallWord(handlerFor(import.library, import.ordinal));
+            m_bus.write32(import.stubAddress, word);
+        }
+    }
+
+    int32_t Iop::loadModule(const std::vector<uint8_t> &file, const std::string &path,
+                            const std::vector<std::string> &arguments)
+    {
+        IrxImage irx;
+        std::string error;
+        if (!parseIrx(file, irx, error))
+        {
+            m_ee.log("[iop] " + path + ": " + error);
+            return -1;
+        }
+        const uint32_t size = static_cast<uint32_t>(irx.image.size()) + irx.bssSize;
+        const uint32_t base = allocate(size);
+        std::vector<IrxImport> imports;
+        if (base == 0u || !relocateIrx(irx, m_bus.ram(), Bus::kRamBytes, base, imports, error))
+        {
+            m_ee.log("[iop] " + path + ": " + (base == 0u ? std::string("out of IOP memory") : error));
+            release(base);
+            return -1;
+        }
+        linkImports(imports);
+
+        // argv: the path followed by the arguments, as C strings.
+        std::vector<std::string> argv{path};
+        argv.insert(argv.end(), arguments.begin(), arguments.end());
+        uint32_t bytes = static_cast<uint32_t>(argv.size() + 1u) * 4u;
+        for (const auto &text : argv)
+            bytes += static_cast<uint32_t>(text.size()) + 1u;
+        const uint32_t block = allocate(bytes);
+        uint32_t strings = block + static_cast<uint32_t>(argv.size() + 1u) * 4u;
+        for (size_t index = 0; index < argv.size(); ++index)
+        {
+            m_bus.write32(block + static_cast<uint32_t>(index) * 4u, strings);
+            writeMemory(strings, argv[index].c_str(), static_cast<uint32_t>(argv[index].size()) + 1u);
+            strings += static_cast<uint32_t>(argv[index].size()) + 1u;
+        }
+        m_bus.write32(block + static_cast<uint32_t>(argv.size()) * 4u, 0u);
+
+        // The start function runs in a thread of its own, like MODLOAD's.
+        Thread loader;
+        loader.id = m_nextId++;
+        loader.priority = loader.initialPriority = 8;
+        loader.stackSize = 0x2000u;
+        loader.stackBase = allocate(loader.stackSize);
+        loader.gp = base + irx.gp;
+        loader.dormant = false;
+        loader.context.pc = base + irx.entry;
+        loader.context.gpr[4] = static_cast<uint32_t>(argv.size());
+        loader.context.gpr[5] = block;
+        loader.context.gpr[28] = loader.gp;
+        loader.context.gpr[29] = loader.stackBase + loader.stackSize - 16u;
+        loader.context.gpr[31] = m_returnTrap;
+        loader.readySequence = ++m_readySequence;
+        const int32_t loaderId = loader.id;
+        m_threads[loaderId] = loader;
+        m_loaderResult = 0xFFFFFFFFu;
+        m_loaderThread = loaderId;
+        for (int round = 0; round < 64 && m_threads.count(loaderId) && !m_threads.at(loaderId).dormant; ++round)
+            runThreads(2'000'000u);
+        const uint32_t result = m_loaderResult;
+        m_loaderThread = 0;
+        if (m_threads.count(loaderId))
+        {
+            release(m_threads.at(loaderId).stackBase);
+            m_threads.erase(loaderId);
+        }
+        release(block);
+
+        Module module{m_nextId++, irx.name, base, size};
+        if ((result & 3u) == 1u)
+        {
+            // NO_RESIDENT_END: the module is done and leaves nothing behind.
+            release(base);
+            m_ee.log("[iop] " + irx.name + " did not stay resident");
+            return module.id;
+        }
+        m_modules.push_back(module);
+        m_ee.log("[iop] started " + irx.name + " at " + std::to_string(base));
+        return module.id;
+    }
+}
diff --git a/ps2xIOP/src/lle/iop.h b/ps2xIOP/src/lle/iop.h
new file mode 100644
index 000000000..e5806885a
--- /dev/null
+++ b/ps2xIOP/src/lle/iop.h
@@ -0,0 +1,228 @@
+#pragma once
+
+#include "bus.h"
+#include "cpu.h"
+#include "irx.h"
+#include "spu2.h"
+
+#include <array>
+#include <cstdint>
+#include <deque>
+#include <functional>
+#include <map>
+#include <memory>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+namespace ps2x::iop::lle
+{
+    // What the emulated IOP needs from the EE side.
+    class EeLink
+    {
+    public:
+        virtual ~EeLink() = default;
+        virtual bool readEe(uint32_t address, void *destination, uint32_t size) = 0;
+        virtual bool writeEe(uint32_t address, const void *source, uint32_t size) = 0;
+        // An RPC server the EE has registered, for IOP modules that bind back.
+        virtual bool eeServer(uint32_t sid) = 0;
+        virtual void log(const std::string &message) = 0;
+    };
+
+    // An IOP running original IRX modules on an R3000A interpreter with a
+    // small high-level kernel underneath. Time is counted in IOP cycles
+    // (36.864 MHz) and advances as the SPU2 produces 48 kHz samples.
+    class Iop final : public IoDevice, public Spu2Host
+    {
+    public:
+        static constexpr uint64_t kClock = 36'864'000u;
+        static constexpr uint32_t kCyclesPerSample = 768u;
+
+        explicit Iop(EeLink &ee);
+        ~Iop() override;
+
+        // Load and start an IRX. Returns a positive module id, or a negative error.
+        int32_t loadModule(const std::vector<uint8_t> &file, const std::string &path,
+                           const std::vector<std::string> &arguments);
+
+        // EE-side SIF RPC into a server registered by an IOP module.
+        bool hasServer(uint32_t sid) const;
+        bool server(uint32_t sid, uint32_t &record, uint32_t &buffer) const;
+        struct Request
+        {
+            uint32_t sid = 0;
+            uint32_t function = 0;
+            std::vector<uint8_t> send;
+            uint32_t receiveAddress = 0; // EE address the reply goes to
+            uint32_t receiveSize = 0;
+            bool done = false;
+        };
+        // Queue a request; the server thread handles it as the IOP runs.
+        void submit(std::shared_ptr<Request> request);
+
+        // EE DMA into IOP memory (sceSifSetDma with an IOP destination).
+        void writeMemory(uint32_t address, const void *data, uint32_t size);
+        void readMemory(uint32_t address, void *data, uint32_t size);
+        uint32_t allocate(uint32_t size);
+        void release(uint32_t address);
+
+        // Run until every ready thread has blocked, without advancing time.
+        void settle();
+        // Advance time by one output sample and produce it.
+        void step(int16_t &left, int16_t &right);
+
+        // IoDevice
+        uint32_t ioRead(uint32_t physical, unsigned bytes) override;
+        void ioWrite(uint32_t physical, uint32_t value, unsigned bytes) override;
+        // Spu2Host
+        bool fetchAutoDma(int core, uint16_t *block) override;
+        void raiseSpuInterrupt() override;
+
+    private:
+        enum class Wait : uint8_t
+        {
+            None,
+            Sleep,
+            Delay,
+            Semaphore,
+            EventFlag,
+            Mailbox,
+            Rpc,
+        };
+
+        struct Thread
+        {
+            int32_t id = 0;
+            uint32_t entry = 0, stackBase = 0, stackSize = 0, gp = 0, attr = 0, option = 0;
+            int32_t priority = 0, initialPriority = 0;
+            CpuContext context;
+            bool dormant = true;
+            Wait wait = Wait::None;
+            int32_t waitId = 0;
+            uint32_t waitBits = 0, waitMode = 0, waitResult = 0;
+            uint64_t wakeCycle = 0;
+            int32_t wakeupCount = 0;
+            uint64_t readySequence = 0;
+        };
+
+        struct Semaphore
+        {
+            int32_t count = 0, maximum = 0;
+            uint32_t attr = 0, option = 0;
+        };
+
+        struct EventFlag
+        {
+            uint32_t bits = 0, attr = 0, option = 0;
+        };
+
+        struct Mailbox
+        {
+            uint32_t attr = 0, option = 0;
+            std::deque<uint32_t> messages;
+        };
+
+        struct Alarm
+        {
+            uint64_t cycle = 0;
+            uint32_t handler = 0, argument = 0, gp = 0;
+        };
+
+        struct HardTimer
+        {
+            bool allocated = false, running = false;
+            uint32_t source = 0, prescale = 1, compare = 0, handler = 0, argument = 0, gp = 0;
+            uint64_t start = 0, next = 0;
+        };
+
+        struct Interrupt
+        {
+            uint32_t handler = 0, argument = 0, mode = 0, gp = 0;
+            bool enabled = false;
+        };
+
+        struct Server
+        {
+            uint32_t sid = 0, function = 0, buffer = 0, queue = 0, record = 0;
+            int32_t thread = 0;
+        };
+
+        struct DmaChannel
+        {
+            uint32_t madr = 0, bcr = 0, chcr = 0;
+            uint32_t remaining = 0; // bytes left for AutoDMA
+        };
+
+        struct Module
+        {
+            int32_t id = 0;
+            std::string name;
+            uint32_t base = 0, size = 0;
+        };
+
+        using Handler = void (Iop::*)(CpuContext &);
+
+        // Kernel
+        void installKernel();
+        uint32_t handlerFor(const std::string &library, uint16_t ordinal);
+        void linkImports(const std::vector<IrxImport> &imports);
+        void call(uint32_t function, std::initializer_list<uint32_t> arguments, uint32_t *result, uint32_t gp);
+        bool runThreads(uint64_t budget, bool advanceClock = true);
+        Thread *current() { return m_current ? &m_threads.at(m_current) : nullptr; }
+        void makeReady(Thread &thread, uint32_t result);
+        void block(Wait wait, int32_t id);
+        void reschedule() { m_reschedule = true; }
+        Thread *pickThread();
+        void deliverRequests();
+        void finishRequest(Thread &thread, uint32_t resultAddress);
+        void raiseInterrupt(uint32_t line);
+        void serviceEvents();
+        void serviceInterrupts();
+        void dmaTransfer(int channel);
+        uint32_t *dmaRegister(uint32_t physical, int &channel);
+        uint32_t arg(CpuContext &c, unsigned index);
+        void ret(CpuContext &c, uint32_t value) { c.gpr[2] = value; }
+        std::string readString(uint32_t address, size_t limit = 256);
+
+#define PS2X_IOP_HANDLER(name) void name(CpuContext &c);
+#include "kernel_handlers.inc"
+#undef PS2X_IOP_HANDLER
+
+        EeLink &m_ee;
+        Bus m_bus;
+        Cpu m_cpu;
+        Spu2 m_spu2;
+        uint64_t m_cycle = 0;
+
+        std::vector<Handler> m_handlers;
+        std::unordered_map<std::string, std::vector<uint32_t>> m_exports;
+        std::map<int32_t, Thread> m_threads;
+        std::map<int32_t, Semaphore> m_semaphores;
+        std::map<int32_t, EventFlag> m_eventFlags;
+        std::map<int32_t, Mailbox> m_mailboxes;
+        std::multimap<uint32_t, Alarm> m_alarms; // keyed by handler
+        std::array<HardTimer, 6> m_timers{};
+        std::map<uint32_t, Interrupt> m_interrupts;
+        std::vector<uint32_t> m_pendingInterrupts;
+        std::map<uint32_t, Server> m_servers;
+        std::map<uint32_t, int32_t> m_queues; // RPC queue record -> owning thread
+        std::deque<std::shared_ptr<Request>> m_requests;
+        std::map<int32_t, std::shared_ptr<Request>> m_active; // by server thread
+        std::map<int32_t, CpuContext> m_saved;                 // server loop frames under a call
+        std::array<DmaChannel, 2> m_dma{};                    // channels 4 and 7
+        std::vector<Module> m_modules;
+        std::map<uint32_t, uint32_t> m_allocations; // address -> size
+        int32_t m_nextId = 1;
+        int32_t m_current = 0;
+        uint64_t m_readySequence = 0;
+        bool m_reschedule = false;
+        bool m_inInterrupt = false;
+        int32_t m_intrSuspend = 0;
+        uint32_t m_ctypeTable = 0;
+        uint32_t m_returnTrap = 0;
+        uint32_t m_rpcTrap = 0;
+        int32_t m_loaderThread = 0;
+        uint32_t m_loaderResult = 0;
+        uint32_t m_sifDmaId = 0;
+    };
+}
diff --git a/ps2xIOP/src/lle/irx.cpp b/ps2xIOP/src/lle/irx.cpp
new file mode 100644
index 000000000..c51da9afc
--- /dev/null
+++ b/ps2xIOP/src/lle/irx.cpp
@@ -0,0 +1,193 @@
+#include "irx.h"
+
+#include <cstring>
+
+namespace ps2x::iop::lle
+{
+    namespace
+    {
+        constexpr uint16_t kIrxType = 0xFF80u;
+        constexpr uint32_t kIopModSegment = 0x70000080u;
+        constexpr uint32_t kLoadSegment = 1u;
+        constexpr uint32_t kRelocationSection = 9u;
+        constexpr uint32_t kImportMagic = 0x41E00000u;
+
+        template <class T>
+        bool readAt(const std::vector<uint8_t> &data, size_t offset, T &value)
+        {
+            if (offset > data.size() || data.size() - offset < sizeof(T))
+                return false;
+            std::memcpy(&value, data.data() + offset, sizeof(T));
+            return true;
+        }
+
+        uint32_t load32(const uint8_t *ram, uint32_t offset)
+        {
+            uint32_t value;
+            std::memcpy(&value, ram + offset, sizeof(value));
+            return value;
+        }
+
+        void store32(uint8_t *ram, uint32_t offset, uint32_t value)
+        {
+            std::memcpy(ram + offset, &value, sizeof(value));
+        }
+    }
+
+    bool parseIrx(const std::vector<uint8_t> &file, IrxImage &out, std::string &error)
+    {
+        uint16_t type = 0, phentsize = 0, phnum = 0, shentsize = 0, shnum = 0;
+        uint32_t phoff = 0, shoff = 0;
+        if (file.size() < 0x34u || std::memcmp(file.data(), "\x7F" "ELF", 4) != 0 ||
+            !readAt(file, 0x10, type) || type != kIrxType || !readAt(file, 0x1C, phoff) ||
+            !readAt(file, 0x20, shoff) || !readAt(file, 0x2A, phentsize) || !readAt(file, 0x2C, phnum) ||
+            !readAt(file, 0x2E, shentsize) || !readAt(file, 0x30, shnum))
+        {
+            error = "not an IRX module";
+            return false;
+        }
+
+        uint32_t loadOffset = 0, loadFileSize = 0, loadMemorySize = 0;
+        bool haveModule = false, haveLoad = false;
+        for (uint32_t index = 0; index < phnum; ++index)
+        {
+            const size_t header = phoff + static_cast<size_t>(index) * phentsize;
+            uint32_t segmentType = 0, offset = 0, fileSize = 0, memorySize = 0;
+            if (!readAt(file, header, segmentType) || !readAt(file, header + 4, offset) ||
+                !readAt(file, header + 16, fileSize) || !readAt(file, header + 20, memorySize))
+                break;
+            if (segmentType == kIopModSegment)
+            {
+                uint32_t fields[6];
+                for (uint32_t field = 0; field < 6u; ++field)
+                    if (!readAt(file, offset + field * 4u, fields[field]))
+                        break;
+                readAt(file, offset + 24u, out.version);
+                out.entry = fields[1];
+                out.gp = fields[2];
+                out.textSize = fields[3];
+                out.dataSize = fields[4];
+                out.bssSize = fields[5];
+                for (size_t at = offset + 26u; at < file.size() && at < offset + fileSize && file[at] != 0u; ++at)
+                    out.name.push_back(static_cast<char>(file[at]));
+                haveModule = true;
+            }
+            else if (segmentType == kLoadSegment)
+            {
+                loadOffset = offset;
+                loadFileSize = fileSize;
+                loadMemorySize = memorySize;
+                haveLoad = true;
+            }
+        }
+        if (!haveModule || !haveLoad || loadOffset > file.size() || file.size() - loadOffset < loadFileSize ||
+            loadMemorySize < loadFileSize)
+        {
+            error = "IRX is missing its .iopmod or load segment";
+            return false;
+        }
+        out.image.assign(file.begin() + loadOffset, file.begin() + loadOffset + loadFileSize);
+        out.bssSize = loadMemorySize - loadFileSize;
+
+        for (uint32_t index = 0; index < shnum; ++index)
+        {
+            const size_t header = shoff + static_cast<size_t>(index) * shentsize;
+            uint32_t sectionType = 0, offset = 0, size = 0;
+            if (!readAt(file, header + 4, sectionType) || !readAt(file, header + 16, offset) ||
+                !readAt(file, header + 20, size))
+                break;
+            if (sectionType != kRelocationSection)
+                continue;
+            for (uint32_t entry = 0; entry + 8u <= size; entry += 8u)
+            {
+                uint32_t target = 0, info = 0;
+                if (!readAt(file, offset + entry, target) || !readAt(file, offset + entry + 4u, info))
+                {
+                    error = "truncated relocation table";
+                    return false;
+                }
+                out.relocations.push_back({target, static_cast<uint8_t>(info & 0xFFu)});
+            }
+        }
+        return true;
+    }
+
+    bool relocateIrx(const IrxImage &irx, uint8_t *ram, uint32_t ramSize, uint32_t base,
+                     std::vector<IrxImport> &imports, std::string &error)
+    {
+        const uint32_t total = static_cast<uint32_t>(irx.image.size()) + irx.bssSize;
+        if (base >= ramSize || ramSize - base < total)
+        {
+            error = "IRX does not fit in IOP memory";
+            return false;
+        }
+        uint8_t *image = ram + base;
+        std::memcpy(image, irx.image.data(), irx.image.size());
+        std::memset(image + irx.image.size(), 0, irx.bssSize);
+
+        // HI16 entries wait for the LO16 that completes their address.
+        std::vector<uint32_t> pendingHigh;
+        for (const auto &relocation : irx.relocations)
+        {
+            if (relocation.offset + 4u > irx.image.size())
+            {
+                error = "relocation outside the module";
+                return false;
+            }
+            const uint32_t word = load32(image, relocation.offset);
+            switch (relocation.type)
+            {
+            case 2: // R_MIPS_32
+                store32(image, relocation.offset, word + base);
+                break;
+            case 4: // R_MIPS_26
+            {
+                const uint32_t target = ((word & 0x03FFFFFFu) << 2) + base;
+                store32(image, relocation.offset, (word & 0xFC000000u) | ((target >> 2) & 0x03FFFFFFu));
+                break;
+            }
+            case 5: // R_MIPS_HI16
+                pendingHigh.push_back(relocation.offset);
+                break;
+            case 6: // R_MIPS_LO16
+            {
+                const int32_t low = static_cast<int16_t>(word & 0xFFFFu);
+                for (const uint32_t highOffset : pendingHigh)
+                {
+                    const uint32_t high = load32(image, highOffset);
+                    const uint32_t value = ((high & 0xFFFFu) << 16) + static_cast<uint32_t>(low) + base;
+                    const uint32_t adjusted = ((value >> 16) + ((value & 0x8000u) ? 1u : 0u)) & 0xFFFFu;
+                    store32(image, highOffset, (high & 0xFFFF0000u) | adjusted);
+                }
+                pendingHigh.clear();
+                store32(image, relocation.offset, (word & 0xFFFF0000u) | ((static_cast<uint32_t>(low) + base) & 0xFFFFu));
+                break;
+            }
+            case 7: // R_MIPS_GPREL16: gp moves with the module
+                break;
+            default:
+                error = "unsupported relocation type " + std::to_string(relocation.type);
+                return false;
+            }
+        }
+
+        for (uint32_t offset = 0; offset + 20u <= irx.textSize && offset + 20u <= irx.image.size(); offset += 4u)
+        {
+            if (load32(image, offset) != kImportMagic)
+                continue;
+            std::string library;
+            for (uint32_t index = 0; index < 8u && image[offset + 12u + index] != 0u; ++index)
+                library.push_back(static_cast<char>(image[offset + 12u + index]));
+            uint32_t stub = offset + 20u;
+            for (; stub + 8u <= irx.textSize; stub += 8u)
+            {
+                const uint32_t jump = load32(image, stub), slot = load32(image, stub + 4u);
+                if (jump != 0x03E00008u || (slot & 0xFFFF0000u) != 0x24000000u)
+                    break;
+                imports.push_back({library, static_cast<uint16_t>(slot & 0xFFFFu), base + stub});
+            }
+            offset = stub - 4u;
+        }
+        return true;
+    }
+}
diff --git a/ps2xIOP/src/lle/irx.h b/ps2xIOP/src/lle/irx.h
new file mode 100644
index 000000000..050b7e6d4
--- /dev/null
+++ b/ps2xIOP/src/lle/irx.h
@@ -0,0 +1,42 @@
+#pragma once
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace ps2x::iop::lle
+{
+    // One stub from an IRX import table: `jr $ra; addiu $zero, $zero, ordinal`.
+    struct IrxImport
+    {
+        std::string library;
+        uint16_t ordinal = 0;
+        uint32_t stubAddress = 0; // after relocation
+    };
+
+    struct IrxImage
+    {
+        std::string name;
+        uint16_t version = 0;
+        uint32_t entry = 0;     // relative to the load address
+        uint32_t gp = 0;        // relative to the load address
+        uint32_t textSize = 0;
+        uint32_t dataSize = 0;
+        uint32_t bssSize = 0;
+        std::vector<uint8_t> image; // text and data, not yet relocated
+        struct Relocation
+        {
+            uint32_t offset;
+            uint8_t type;
+        };
+        std::vector<Relocation> relocations;
+    };
+
+    // Parse an IRX (an ELF of type 0xFF80 with an .iopmod section).
+    bool parseIrx(const std::vector<uint8_t> &file, IrxImage &out, std::string &error);
+
+    // Copy the image to memory at base, apply relocations and zero BSS.
+    // Returns the import stubs found in the relocated text.
+    bool relocateIrx(const IrxImage &irx, uint8_t *ram, uint32_t ramSize, uint32_t base,
+                     std::vector<IrxImport> &imports, std::string &error);
+}
diff --git a/ps2xIOP/src/lle/kernel.cpp b/ps2xIOP/src/lle/kernel.cpp
new file mode 100644
index 000000000..4bc649568
--- /dev/null
+++ b/ps2xIOP/src/lle/kernel.cpp
@@ -0,0 +1,1013 @@
+#include "iop.h"
+
+#include <algorithm>
+#include <cstdio>
+#include <cstring>
+
+namespace ps2x::iop::lle
+{
+    namespace
+    {
+        // About 100 us, a SIF command to the EE and its answer.
+        constexpr uint64_t kSifRoundTrip = Iop::kClock / 10'000u;
+
+        struct Binding
+        {
+            const char *library;
+            uint16_t ordinal;
+            const char *handler;
+        };
+
+        // Library ordinals as the IOP kernel exports them.
+        constexpr Binding kBindings[] = {
+            {"sysmem", 4, "allocSysMemory"}, {"sysmem", 5, "freeSysMemory"},
+            {"sysmem", 7, "queryMaxFreeMemSize"}, {"sysmem", 8, "queryTotalFreeMemSize"},
+            {"sysmem", 14, "kprintf"},
+            {"loadcore", 4, "noop"}, {"loadcore", 5, "noop"},
+            {"loadcore", 6, "registerLibraryEntries"}, {"loadcore", 7, "releaseLibraryEntries"},
+            {"intrman", 4, "registerIntrHandler"}, {"intrman", 5, "releaseIntrHandler"},
+            {"intrman", 6, "enableIntr"}, {"intrman", 7, "disableIntr"},
+            {"intrman", 17, "cpuSuspendIntr"}, {"intrman", 18, "cpuResumeIntr"},
+            {"intrman", 23, "queryIntrContext"},
+            {"stdio", 4, "kprintf"},
+            {"sysclib", 8, "lookCtypeTable"}, {"sysclib", 11, "memcmpHandler"},
+            {"sysclib", 12, "memcpyHandler"}, {"sysclib", 13, "memmoveHandler"},
+            {"sysclib", 14, "memsetHandler"}, {"sysclib", 17, "bzeroHandler"},
+            {"sysclib", 22, "strcmpHandler"}, {"sysclib", 23, "strcpyHandler"},
+            {"sysclib", 27, "strlenHandler"}, {"sysclib", 29, "strncmpHandler"},
+            {"sysclib", 30, "strncpyHandler"}, {"sysclib", 36, "strtolHandler"},
+            {"thbase", 4, "createThread"}, {"thbase", 5, "deleteThread"}, {"thbase", 6, "startThread"},
+            {"thbase", 8, "exitThread"}, {"thbase", 10, "terminateThread"}, {"thbase", 11, "terminateThread"},
+            {"thbase", 14, "changeThreadPriority"}, {"thbase", 15, "changeThreadPriority"},
+            {"thbase", 16, "rotateThreadReadyQueue"}, {"thbase", 17, "rotateThreadReadyQueue"},
+            {"thbase", 20, "getThreadId"}, {"thbase", 22, "referThreadStatus"},
+            {"thbase", 23, "referThreadStatus"}, {"thbase", 24, "sleepThread"},
+            {"thbase", 25, "wakeupThread"}, {"thbase", 26, "wakeupThread"},
+            {"thbase", 27, "cancelWakeupThread"}, {"thbase", 28, "cancelWakeupThread"},
+            {"thbase", 33, "delayThread"}, {"thbase", 34, "getSystemTime"},
+            {"thbase", 35, "setAlarm"}, {"thbase", 36, "setAlarm"},
+            {"thbase", 37, "cancelAlarm"}, {"thbase", 38, "cancelAlarm"},
+            {"thbase", 39, "usecToSysClock"}, {"thbase", 40, "sysClockToUsec"},
+            {"thsemap", 4, "createSema"}, {"thsemap", 5, "deleteSema"}, {"thsemap", 6, "signalSema"},
+            {"thsemap", 7, "signalSema"}, {"thsemap", 8, "waitSema"}, {"thsemap", 9, "pollSema"},
+            {"thsemap", 10, "pollSema"}, {"thsemap", 11, "referSemaStatus"}, {"thsemap", 12, "referSemaStatus"},
+            {"thevent", 4, "createEventFlag"}, {"thevent", 5, "deleteEventFlag"},
+            {"thevent", 6, "setEventFlag"}, {"thevent", 7, "setEventFlag"},
+            {"thevent", 8, "clearEventFlag"}, {"thevent", 9, "clearEventFlag"},
+            {"thevent", 10, "waitEventFlag"}, {"thevent", 11, "pollEventFlag"},
+            {"thmsgbx", 4, "createMbx"}, {"thmsgbx", 5, "deleteMbx"}, {"thmsgbx", 6, "sendMbx"},
+            {"thmsgbx", 7, "sendMbx"}, {"thmsgbx", 8, "receiveMbx"}, {"thmsgbx", 9, "pollMbx"},
+            {"sifman", 5, "noop"}, {"sifman", 7, "sifSetDma"}, {"sifman", 8, "sifDmaStat"},
+            {"sifman", 29, "sifCheckInit"},
+            {"sifcmd", 4, "noop"}, {"sifcmd", 14, "noop"}, {"sifcmd", 15, "sifBindRpc"},
+            {"sifcmd", 16, "sifCallRpc"}, {"sifcmd", 17, "sifRegisterRpc"}, {"sifcmd", 19, "sifSetRpcQueue"},
+            {"sifcmd", 22, "sifRpcLoop"}, {"sifcmd", 23, "sifGetOtherData"}, {"sifcmd", 24, "sifRemoveRpc"},
+            {"sifcmd", 25, "noop"},
+            {"timrman", 4, "allocHardTimer"}, {"timrman", 6, "freeHardTimer"},
+            {"timrman", 10, "getTimerCounter"}, {"timrman", 20, "setTimerHandler"},
+            {"timrman", 22, "setupHardTimer"}, {"timrman", 23, "startHardTimer"},
+            {"timrman", 24, "stopHardTimer"},
+        };
+
+        struct Named
+        {
+            const char *name;
+            void (Iop::*handler)(CpuContext &);
+        };
+    }
+
+    void Iop::installKernel()
+    {
+#define PS2X_IOP_HANDLER(name) m_handlers.push_back(&Iop::name);
+#include "kernel_handlers.inc"
+#undef PS2X_IOP_HANDLER
+    }
+
+    uint32_t Iop::handlerFor(const std::string &library, uint16_t ordinal)
+    {
+        static const std::vector<std::string> names = {
+#define PS2X_IOP_HANDLER(name) #name,
+#include "kernel_handlers.inc"
+#undef PS2X_IOP_HANDLER
+        };
+        const auto index = [&](const char *name) {
+            return static_cast<uint32_t>(std::find(names.begin(), names.end(), name) - names.begin());
+        };
+        if (library.empty())
+            return index(ordinal == 1u ? "functionReturn" : "rpcReturn");
+        for (const Binding &binding : kBindings)
+            if (library == binding.library && ordinal == binding.ordinal)
+                return index(binding.handler);
+        m_ee.log("[iop] no kernel service for " + library + " #" + std::to_string(ordinal));
+        return index("unknownImport");
+    }
+
+    void Iop::unknownImport(CpuContext &c) { ret(c, 0); }
+    void Iop::noop(CpuContext &c) { ret(c, 0); }
+
+    void Iop::functionReturn(CpuContext &c)
+    {
+        // A thread's entry function returned: that is ExitThread.
+        Thread *thread = current();
+        if (!thread)
+            return;
+        if (thread->id == m_loaderThread)
+            m_loaderResult = c.gpr[2];
+        thread->dormant = true;
+        reschedule();
+    }
+
+    void Iop::rpcReturn(CpuContext &c)
+    {
+        if (Thread *thread = current())
+            finishRequest(*thread, c.gpr[2]);
+    }
+
+    // ---------------------------------------------------------------- sysmem, loadcore, stdio
+
+    void Iop::allocSysMemory(CpuContext &c) { ret(c, allocate(arg(c, 1))); }
+
+    void Iop::freeSysMemory(CpuContext &c)
+    {
+        release(arg(c, 0));
+        ret(c, 0);
+    }
+
+    void Iop::queryMaxFreeMemSize(CpuContext &c)
+    {
+        uint32_t largest = 0, cursor = 0;
+        for (const auto &[address, length] : m_allocations)
+        {
+            largest = std::max(largest, address > cursor ? address - cursor : 0u);
+            cursor = std::max(cursor, address + length);
+        }
+        ret(c, std::max(largest, Bus::kRamBytes - cursor));
+    }
+
+    void Iop::queryTotalFreeMemSize(CpuContext &c)
+    {
+        uint32_t used = 0;
+        for (const auto &[address, length] : m_allocations)
+            used += length;
+        ret(c, Bus::kRamBytes - used);
+    }
+
+    void Iop::kprintf(CpuContext &c)
+    {
+        // Only the format string; enough to follow what the drivers report.
+        std::string text = readString(arg(c, 0));
+        while (!text.empty() && (text.back() == '\n' || text.back() == '\r'))
+            text.pop_back();
+        if (!text.empty())
+            m_ee.log("[iop] " + text);
+        ret(c, 0);
+    }
+
+    void Iop::registerLibraryEntries(CpuContext &c)
+    {
+        const uint32_t table = arg(c, 0);
+        std::string name;
+        for (uint32_t index = 0; index < 8u; ++index)
+        {
+            const uint8_t ch = m_bus.read8(table + 12u + index);
+            if (ch == 0u)
+                break;
+            name.push_back(static_cast<char>(ch));
+        }
+        std::vector<uint32_t> functions;
+        for (uint32_t entry = table + 20u; entry < table + 20u + 1024u; entry += 4u)
+        {
+            const uint32_t address = m_bus.read32(entry);
+            if (address == 0u)
+                break;
+            functions.push_back(address);
+        }
+        m_exports[name] = std::move(functions);
+        ret(c, 0);
+    }
+
+    void Iop::releaseLibraryEntries(CpuContext &c) { ret(c, 0); }
+
+    // ---------------------------------------------------------------- intrman
+
+    void Iop::registerIntrHandler(CpuContext &c)
+    {
+        Interrupt &line = m_interrupts[arg(c, 0)];
+        line.mode = arg(c, 1);
+        line.handler = arg(c, 2);
+        line.argument = arg(c, 3);
+        line.gp = c.gpr[28];
+        ret(c, 0);
+    }
+
+    void Iop::releaseIntrHandler(CpuContext &c)
+    {
+        m_interrupts.erase(arg(c, 0));
+        ret(c, 0);
+    }
+
+    void Iop::enableIntr(CpuContext &c)
+    {
+        m_interrupts[arg(c, 0) & 0xFFu].enabled = true;
+        ret(c, 0);
+    }
+
+    void Iop::disableIntr(CpuContext &c)
+    {
+        auto &line = m_interrupts[arg(c, 0) & 0xFFu];
+        if (arg(c, 1) != 0u)
+            m_bus.write32(arg(c, 1), line.enabled ? arg(c, 0) : 0u);
+        line.enabled = false;
+        ret(c, 0);
+    }
+
+    void Iop::cpuSuspendIntr(CpuContext &c)
+    {
+        if (arg(c, 0) != 0u)
+            m_bus.write32(arg(c, 0), m_intrSuspend > 0 ? 0u : 1u);
+        ++m_intrSuspend;
+        ret(c, m_intrSuspend > 1 ? static_cast<uint32_t>(-102) : 0u); // KE_CPUDI when already off
+    }
+
+    void Iop::cpuResumeIntr(CpuContext &c)
+    {
+        if (arg(c, 0) != 0u && m_intrSuspend > 0)
+            m_intrSuspend = 0;
+        else if (m_intrSuspend > 0)
+            --m_intrSuspend;
+        ret(c, 0);
+    }
+
+    void Iop::queryIntrContext(CpuContext &c) { ret(c, m_inInterrupt ? 1u : 0u); }
+
+    // ---------------------------------------------------------------- sysclib
+
+    void Iop::lookCtypeTable(CpuContext &c)
+    {
+        // Returns the class of one character, as the table lookup would.
+        ret(c, m_bus.read8(m_ctypeTable + 1u + (arg(c, 0) & 0xFFu)));
+    }
+
+    void Iop::memcpyHandler(CpuContext &c)
+    {
+        const uint32_t destination = arg(c, 0), source = arg(c, 1), size = arg(c, 2);
+        for (uint32_t index = 0; index < size; ++index)
+            m_bus.write8(destination + index, m_bus.read8(source + index));
+        ret(c, destination);
+    }
+
+    void Iop::memmoveHandler(CpuContext &c)
+    {
+        const uint32_t destination = arg(c, 0), source = arg(c, 1), size = arg(c, 2);
+        std::vector<uint8_t> copy(size);
+        for (uint32_t index = 0; index < size; ++index)
+            copy[index] = m_bus.read8(source + index);
+        for (uint32_t index = 0; index < size; ++index)
+            m_bus.write8(destination + index, copy[index]);
+        ret(c, destination);
+    }
+
+    void Iop::memsetHandler(CpuContext &c)
+    {
+        const uint32_t destination = arg(c, 0), size = arg(c, 2);
+        for (uint32_t index = 0; index < size; ++index)
+            m_bus.write8(destination + index, static_cast<uint8_t>(arg(c, 1)));
+        ret(c, destination);
+    }
+
+    void Iop::memcmpHandler(CpuContext &c)
+    {
+        int32_t result = 0;
+        for (uint32_t index = 0; index < arg(c, 2) && result == 0; ++index)
+            result = static_cast<int32_t>(m_bus.read8(arg(c, 0) + index)) - m_bus.read8(arg(c, 1) + index);
+        ret(c, static_cast<uint32_t>(result));
+    }
+
+    void Iop::bzeroHandler(CpuContext &c)
+    {
+        for (uint32_t index = 0; index < arg(c, 1); ++index)
+            m_bus.write8(arg(c, 0) + index, 0u);
+        ret(c, 0);
+    }
+
+    void Iop::strlenHandler(CpuContext &c) { ret(c, static_cast<uint32_t>(readString(arg(c, 0), 65536).size())); }
+
+    void Iop::strcmpHandler(CpuContext &c)
+    {
+        ret(c, static_cast<uint32_t>(readString(arg(c, 0), 65536).compare(readString(arg(c, 1), 65536))));
+    }
+
+    void Iop::strncmpHandler(CpuContext &c)
+    {
+        const uint32_t count = arg(c, 2);
+        const std::string a = readString(arg(c, 0), count), b = readString(arg(c, 1), count);
+        ret(c, static_cast<uint32_t>(a.compare(b)));
+    }
+
+    void Iop::strcpyHandler(CpuContext &c)
+    {
+        const std::string text = readString(arg(c, 1), 65536);
+        writeMemory(arg(c, 0), text.c_str(), static_cast<uint32_t>(text.size()) + 1u);
+        ret(c, arg(c, 0));
+    }
+
+    void Iop::strncpyHandler(CpuContext &c)
+    {
+        const uint32_t count = arg(c, 2);
+        std::string text = readString(arg(c, 1), count);
+        text.resize(count, '\0');
+        writeMemory(arg(c, 0), text.data(), count);
+        ret(c, arg(c, 0));
+    }
+
+    void Iop::strtolHandler(CpuContext &c)
+    {
+        const uint32_t start = arg(c, 0);
+        const std::string text = readString(start, 64);
+        char *end = nullptr;
+        const long value = std::strtol(text.c_str(), &end, static_cast<int>(arg(c, 2)));
+        if (arg(c, 1) != 0u)
+            m_bus.write32(arg(c, 1), start + static_cast<uint32_t>(end - text.c_str()));
+        ret(c, static_cast<uint32_t>(value));
+    }
+
+    // ---------------------------------------------------------------- threads
+
+    void Iop::createThread(CpuContext &c)
+    {
+        const uint32_t param = arg(c, 0);
+        Thread thread;
+        thread.id = m_nextId++;
+        thread.attr = m_bus.read32(param);
+        thread.option = m_bus.read32(param + 4u);
+        thread.entry = m_bus.read32(param + 8u);
+        thread.stackSize = (m_bus.read32(param + 12u) + 15u) & ~15u;
+        thread.priority = thread.initialPriority = static_cast<int32_t>(m_bus.read32(param + 16u));
+        thread.stackBase = allocate(thread.stackSize);
+        thread.gp = c.gpr[28];
+        if (thread.stackBase == 0u)
+        {
+            ret(c, static_cast<uint32_t>(-400)); // KE_NO_MEMORY
+            return;
+        }
+        m_threads[thread.id] = thread;
+        ret(c, static_cast<uint32_t>(thread.id));
+    }
+
+    void Iop::deleteThread(CpuContext &c)
+    {
+        const auto found = m_threads.find(static_cast<int32_t>(arg(c, 0)));
+        if (found == m_threads.end() || !found->second.dormant)
+        {
+            ret(c, static_cast<uint32_t>(-407));
+            return;
+        }
+        release(found->second.stackBase);
+        m_threads.erase(found);
+        ret(c, 0);
+    }
+
+    void Iop::startThread(CpuContext &c)
+    {
+        const auto found = m_threads.find(static_cast<int32_t>(arg(c, 0)));
+        if (found == m_threads.end())
+        {
+            ret(c, static_cast<uint32_t>(-407));
+            return;
+        }
+        Thread &thread = found->second;
+        thread.context = {};
+        thread.context.pc = thread.entry;
+        thread.context.gpr[4] = arg(c, 1);
+        thread.context.gpr[28] = thread.gp;
+        thread.context.gpr[29] = thread.stackBase + thread.stackSize - 16u;
+        thread.context.gpr[31] = m_returnTrap;
+        thread.priority = thread.initialPriority;
+        thread.dormant = false;
+        thread.wakeupCount = 0;
+        makeReady(thread, 0u);
+        ret(c, 0);
+    }
+
+    void Iop::exitThread(CpuContext &c)
+    {
+        (void)c;
+        if (Thread *thread = current())
+        {
+            thread->dormant = true;
+            reschedule();
+        }
+    }
+
+    void Iop::terminateThread(CpuContext &c)
+    {
+        const auto found = m_threads.find(static_cast<int32_t>(arg(c, 0)));
+        if (found != m_threads.end())
+        {
+            found->second.dormant = true;
+            found->second.wait = Wait::None;
+            m_active.erase(found->first);
+        }
+        ret(c, 0);
+    }
+
+    void Iop::changeThreadPriority(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 0));
+        const auto found = m_threads.find(id == 0 ? m_current : id);
+        if (found != m_threads.end())
+        {
+            const int32_t priority = static_cast<int32_t>(arg(c, 1));
+            found->second.priority = priority == 0 ? found->second.initialPriority : priority;
+            reschedule();
+        }
+        ret(c, 0);
+    }
+
+    void Iop::rotateThreadReadyQueue(CpuContext &c)
+    {
+        if (Thread *thread = current())
+            thread->readySequence = ++m_readySequence;
+        reschedule();
+        ret(c, 0);
+    }
+
+    void Iop::getThreadId(CpuContext &c) { ret(c, static_cast<uint32_t>(m_current)); }
+
+    void Iop::referThreadStatus(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 0));
+        const auto found = m_threads.find(id == 0 ? m_current : id);
+        const uint32_t info = arg(c, 1);
+        if (found == m_threads.end() || info == 0u)
+        {
+            ret(c, static_cast<uint32_t>(-407));
+            return;
+        }
+        const Thread &thread = found->second;
+        // struct _iop_thread_status: attr, option, status, entry, stack, stackSize,
+        // gpReg, initPriority, currentPriority, waitType, waitId, wakeupCount, ...
+        const uint32_t status = thread.dormant ? 0x10u : thread.wait != Wait::None ? 0x04u
+                                                : thread.id == m_current ? 0x01u : 0x02u;
+        const uint32_t fields[12] = {thread.attr, thread.option, status, thread.entry, thread.stackBase,
+                                     thread.stackSize, thread.gp, static_cast<uint32_t>(thread.initialPriority),
+                                     static_cast<uint32_t>(thread.priority), 0u, static_cast<uint32_t>(thread.waitId),
+                                     static_cast<uint32_t>(thread.wakeupCount)};
+        for (uint32_t index = 0; index < 12u; ++index)
+            m_bus.write32(info + index * 4u, fields[index]);
+        ret(c, 0);
+    }
+
+    void Iop::sleepThread(CpuContext &c)
+    {
+        Thread *thread = current();
+        if (thread && thread->wakeupCount > 0)
+        {
+            --thread->wakeupCount;
+            ret(c, 0);
+            return;
+        }
+        ret(c, 0);
+        block(Wait::Sleep, 0);
+    }
+
+    void Iop::wakeupThread(CpuContext &c)
+    {
+        const auto found = m_threads.find(static_cast<int32_t>(arg(c, 0)));
+        if (found == m_threads.end())
+        {
+            ret(c, static_cast<uint32_t>(-407));
+            return;
+        }
+        if (found->second.wait == Wait::Sleep)
+            makeReady(found->second, 0u);
+        else
+            ++found->second.wakeupCount;
+        ret(c, 0);
+    }
+
+    void Iop::cancelWakeupThread(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 0));
+        const auto found = m_threads.find(id == 0 ? m_current : id);
+        int32_t count = 0;
+        if (found != m_threads.end())
+        {
+            count = found->second.wakeupCount;
+            found->second.wakeupCount = 0;
+        }
+        ret(c, static_cast<uint32_t>(count));
+    }
+
+    void Iop::delayThread(CpuContext &c)
+    {
+        Thread *thread = current();
+        if (!thread)
+            return;
+        thread->wakeCycle = m_cycle + static_cast<uint64_t>(arg(c, 0)) * kClock / 1'000'000u;
+        ret(c, 0);
+        block(Wait::Delay, 0);
+    }
+
+    void Iop::getSystemTime(CpuContext &c)
+    {
+        m_bus.write32(arg(c, 0), static_cast<uint32_t>(m_cycle));
+        m_bus.write32(arg(c, 0) + 4u, static_cast<uint32_t>(m_cycle >> 32));
+        ret(c, 0);
+    }
+
+    void Iop::setAlarm(CpuContext &c)
+    {
+        // The clock argument points at an iop_sys_clock_t.
+        const uint64_t clock = m_bus.read32(arg(c, 0)) | (static_cast<uint64_t>(m_bus.read32(arg(c, 0) + 4u)) << 32);
+        m_alarms.emplace(arg(c, 1), Alarm{m_cycle + clock, arg(c, 1), arg(c, 2), c.gpr[28]});
+        ret(c, 0);
+    }
+
+    void Iop::cancelAlarm(CpuContext &c)
+    {
+        const auto range = m_alarms.equal_range(arg(c, 0));
+        for (auto it = range.first; it != range.second;)
+            it = it->second.argument == arg(c, 1) ? m_alarms.erase(it) : std::next(it);
+        ret(c, 0);
+    }
+
+    void Iop::usecToSysClock(CpuContext &c)
+    {
+        const uint64_t clock = static_cast<uint64_t>(arg(c, 0)) * kClock / 1'000'000u;
+        m_bus.write32(arg(c, 1), static_cast<uint32_t>(clock));
+        m_bus.write32(arg(c, 1) + 4u, static_cast<uint32_t>(clock >> 32));
+        ret(c, 0);
+    }
+
+    void Iop::sysClockToUsec(CpuContext &c)
+    {
+        const uint64_t clock = m_bus.read32(arg(c, 0)) | (static_cast<uint64_t>(m_bus.read32(arg(c, 0) + 4u)) << 32);
+        const uint64_t usec = clock * 1'000'000u / kClock;
+        m_bus.write32(arg(c, 1), static_cast<uint32_t>(usec / 1'000'000u));
+        m_bus.write32(arg(c, 2), static_cast<uint32_t>(usec % 1'000'000u));
+        ret(c, 0);
+    }
+
+    // ---------------------------------------------------------------- semaphores
+
+    void Iop::createSema(CpuContext &c)
+    {
+        const uint32_t param = arg(c, 0);
+        Semaphore semaphore;
+        semaphore.attr = m_bus.read32(param);
+        semaphore.option = m_bus.read32(param + 4u);
+        semaphore.count = static_cast<int32_t>(m_bus.read32(param + 8u));
+        semaphore.maximum = static_cast<int32_t>(m_bus.read32(param + 12u));
+        const int32_t id = m_nextId++;
+        m_semaphores[id] = semaphore;
+        ret(c, static_cast<uint32_t>(id));
+    }
+
+    void Iop::deleteSema(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 0));
+        for (auto &[threadId, thread] : m_threads)
+            if (thread.wait == Wait::Semaphore && thread.waitId == id)
+                makeReady(thread, static_cast<uint32_t>(-425)); // KE_WAIT_DELETE
+        m_semaphores.erase(id);
+        ret(c, 0);
+    }
+
+    void Iop::signalSema(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 0));
+        const auto found = m_semaphores.find(id);
+        if (found == m_semaphores.end())
+        {
+            ret(c, static_cast<uint32_t>(-408));
+            return;
+        }
+        // Wake the longest-waiting thread, or count the signal.
+        Thread *waiter = nullptr;
+        for (auto &[threadId, thread] : m_threads)
+            if (thread.wait == Wait::Semaphore && thread.waitId == id &&
+                (!waiter || thread.readySequence < waiter->readySequence))
+                waiter = &thread;
+        if (waiter)
+            makeReady(*waiter, 0u);
+        else if (found->second.count < found->second.maximum || found->second.maximum == 0)
+            ++found->second.count;
+        ret(c, 0);
+    }
+
+    void Iop::waitSema(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 0));
+        const auto found = m_semaphores.find(id);
+        if (found == m_semaphores.end())
+        {
+            ret(c, static_cast<uint32_t>(-408));
+            return;
+        }
+        if (found->second.count > 0)
+        {
+            --found->second.count;
+            ret(c, 0);
+            return;
+        }
+        if (Thread *thread = current())
+            thread->readySequence = ++m_readySequence;
+        ret(c, 0);
+        block(Wait::Semaphore, id);
+    }
+
+    void Iop::pollSema(CpuContext &c)
+    {
+        const auto found = m_semaphores.find(static_cast<int32_t>(arg(c, 0)));
+        if (found == m_semaphores.end() || found->second.count <= 0)
+        {
+            ret(c, static_cast<uint32_t>(-419)); // KE_SEMA_ZERO
+            return;
+        }
+        --found->second.count;
+        ret(c, 0);
+    }
+
+    void Iop::referSemaStatus(CpuContext &c)
+    {
+        const auto found = m_semaphores.find(static_cast<int32_t>(arg(c, 0)));
+        if (found == m_semaphores.end())
+        {
+            ret(c, static_cast<uint32_t>(-408));
+            return;
+        }
+        int32_t waiting = 0;
+        for (const auto &[threadId, thread] : m_threads)
+            waiting += thread.wait == Wait::Semaphore && thread.waitId == found->first ? 1 : 0;
+        const uint32_t info = arg(c, 1);
+        const uint32_t fields[6] = {found->second.attr, found->second.option, 0u,
+                                    static_cast<uint32_t>(found->second.maximum),
+                                    static_cast<uint32_t>(found->second.count), static_cast<uint32_t>(waiting)};
+        for (uint32_t index = 0; index < 6u; ++index)
+            m_bus.write32(info + index * 4u, fields[index]);
+        ret(c, 0);
+    }
+
+    // ---------------------------------------------------------------- event flags
+
+    void Iop::createEventFlag(CpuContext &c)
+    {
+        const uint32_t param = arg(c, 0);
+        EventFlag flag;
+        flag.attr = m_bus.read32(param);
+        flag.option = m_bus.read32(param + 4u);
+        flag.bits = m_bus.read32(param + 8u);
+        const int32_t id = m_nextId++;
+        m_eventFlags[id] = flag;
+        ret(c, static_cast<uint32_t>(id));
+    }
+
+    void Iop::deleteEventFlag(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 0));
+        for (auto &[threadId, thread] : m_threads)
+            if (thread.wait == Wait::EventFlag && thread.waitId == id)
+                makeReady(thread, static_cast<uint32_t>(-425));
+        m_eventFlags.erase(id);
+        ret(c, 0);
+    }
+
+    void Iop::setEventFlag(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 0));
+        const auto found = m_eventFlags.find(id);
+        if (found == m_eventFlags.end())
+        {
+            ret(c, static_cast<uint32_t>(-409));
+            return;
+        }
+        EventFlag &flag = found->second;
+        flag.bits |= arg(c, 1);
+        for (auto &[threadId, thread] : m_threads)
+        {
+            if (thread.wait != Wait::EventFlag || thread.waitId != id)
+                continue;
+            // Mode bit 0: OR (any bit) instead of AND; 0x10 clear all, 0x20 clear pattern.
+            const bool satisfied = (thread.waitMode & 1u) ? (flag.bits & thread.waitBits) != 0u
+                                                          : (flag.bits & thread.waitBits) == thread.waitBits;
+            if (!satisfied)
+                continue;
+            if (thread.waitResult != 0u)
+                m_bus.write32(thread.waitResult, flag.bits);
+            if (thread.waitMode & 0x10u)
+                flag.bits = 0;
+            else if (thread.waitMode & 0x20u)
+                flag.bits &= ~thread.waitBits;
+            makeReady(thread, 0u);
+        }
+        ret(c, 0);
+    }
+
+    void Iop::clearEventFlag(CpuContext &c)
+    {
+        const auto found = m_eventFlags.find(static_cast<int32_t>(arg(c, 0)));
+        if (found != m_eventFlags.end())
+            found->second.bits &= arg(c, 1);
+        ret(c, 0);
+    }
+
+    void Iop::waitEventFlag(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 0));
+        const auto found = m_eventFlags.find(id);
+        if (found == m_eventFlags.end())
+        {
+            ret(c, static_cast<uint32_t>(-409));
+            return;
+        }
+        EventFlag &flag = found->second;
+        const uint32_t bits = arg(c, 1), mode = arg(c, 2), result = arg(c, 3);
+        const bool satisfied = (mode & 1u) ? (flag.bits & bits) != 0u : (flag.bits & bits) == bits;
+        if (satisfied)
+        {
+            if (result != 0u)
+                m_bus.write32(result, flag.bits);
+            if (mode & 0x10u)
+                flag.bits = 0;
+            else if (mode & 0x20u)
+                flag.bits &= ~bits;
+            ret(c, 0);
+            return;
+        }
+        if (Thread *thread = current())
+        {
+            thread->waitBits = bits;
+            thread->waitMode = mode;
+            thread->waitResult = result;
+        }
+        ret(c, 0);
+        block(Wait::EventFlag, id);
+    }
+
+    void Iop::pollEventFlag(CpuContext &c)
+    {
+        const auto found = m_eventFlags.find(static_cast<int32_t>(arg(c, 0)));
+        if (found == m_eventFlags.end())
+        {
+            ret(c, static_cast<uint32_t>(-409));
+            return;
+        }
+        EventFlag &flag = found->second;
+        const uint32_t bits = arg(c, 1), mode = arg(c, 2), result = arg(c, 3);
+        const bool satisfied = (mode & 1u) ? (flag.bits & bits) != 0u : (flag.bits & bits) == bits;
+        if (!satisfied)
+        {
+            ret(c, static_cast<uint32_t>(-421)); // KE_EVF_COND
+            return;
+        }
+        if (result != 0u)
+            m_bus.write32(result, flag.bits);
+        if (mode & 0x10u)
+            flag.bits = 0;
+        else if (mode & 0x20u)
+            flag.bits &= ~bits;
+        ret(c, 0);
+    }
+
+    // ---------------------------------------------------------------- message boxes
+
+    void Iop::createMbx(CpuContext &c)
+    {
+        Mailbox mailbox;
+        mailbox.attr = m_bus.read32(arg(c, 0));
+        mailbox.option = m_bus.read32(arg(c, 0) + 4u);
+        const int32_t id = m_nextId++;
+        m_mailboxes[id] = mailbox;
+        ret(c, static_cast<uint32_t>(id));
+    }
+
+    void Iop::deleteMbx(CpuContext &c)
+    {
+        m_mailboxes.erase(static_cast<int32_t>(arg(c, 0)));
+        ret(c, 0);
+    }
+
+    void Iop::sendMbx(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 0));
+        const auto found = m_mailboxes.find(id);
+        if (found == m_mailboxes.end())
+        {
+            ret(c, static_cast<uint32_t>(-410));
+            return;
+        }
+        for (auto &[threadId, thread] : m_threads)
+            if (thread.wait == Wait::Mailbox && thread.waitId == id)
+            {
+                m_bus.write32(thread.waitResult, arg(c, 1));
+                makeReady(thread, 0u);
+                ret(c, 0);
+                return;
+            }
+        found->second.messages.push_back(arg(c, 1));
+        ret(c, 0);
+    }
+
+    void Iop::receiveMbx(CpuContext &c)
+    {
+        const int32_t id = static_cast<int32_t>(arg(c, 1));
+        const auto found = m_mailboxes.find(id);
+        if (found == m_mailboxes.end())
+        {
+            ret(c, static_cast<uint32_t>(-410));
+            return;
+        }
+        if (!found->second.messages.empty())
+        {
+            m_bus.write32(arg(c, 0), found->second.messages.front());
+            found->second.messages.pop_front();
+            ret(c, 0);
+            return;
+        }
+        if (Thread *thread = current())
+            thread->waitResult = arg(c, 0);
+        ret(c, 0);
+        block(Wait::Mailbox, id);
+    }
+
+    void Iop::pollMbx(CpuContext &c)
+    {
+        const auto found = m_mailboxes.find(static_cast<int32_t>(arg(c, 1)));
+        if (found == m_mailboxes.end() || found->second.messages.empty())
+        {
+            ret(c, static_cast<uint32_t>(-424)); // KE_MBOX_NOMSG
+            return;
+        }
+        m_bus.write32(arg(c, 0), found->second.messages.front());
+        found->second.messages.pop_front();
+        ret(c, 0);
+    }
+
+    // ---------------------------------------------------------------- SIF
+
+    void Iop::sifSetDma(CpuContext &c)
+    {
+        // Each descriptor: IOP source, EE destination, size, attributes.
+        const uint32_t list = arg(c, 0), count = arg(c, 1);
+        for (uint32_t index = 0; index < count; ++index)
+        {
+            const uint32_t entry = list + index * 16u;
+            const uint32_t source = m_bus.read32(entry), destination = m_bus.read32(entry + 4u);
+            const uint32_t size = m_bus.read32(entry + 8u);
+            std::vector<uint8_t> data(size);
+            readMemory(source, data.data(), size);
+            m_ee.writeEe(destination, data.data(), size);
+        }
+        ret(c, ++m_sifDmaId);
+    }
+
+    void Iop::sifDmaStat(CpuContext &c) { ret(c, static_cast<uint32_t>(-1)); } // always complete
+
+    void Iop::sifCheckInit(CpuContext &c) { ret(c, 1u); }
+
+    void Iop::sifRegisterRpc(CpuContext &c)
+    {
+        Server server;
+        server.record = arg(c, 0);
+        server.sid = arg(c, 1);
+        server.function = arg(c, 2);
+        server.buffer = arg(c, 3);
+        server.queue = arg(c, 6);
+        for (const auto &[queue, owner] : m_queues)
+            if (queue == server.queue)
+                server.thread = owner;
+        m_servers[server.sid] = server;
+        m_ee.log("[iop] RPC server " + std::to_string(server.sid) + " registered");
+        ret(c, 0);
+    }
+
+    void Iop::sifSetRpcQueue(CpuContext &c)
+    {
+        m_queues[arg(c, 0)] = static_cast<int32_t>(arg(c, 1));
+        ret(c, 0);
+    }
+
+    void Iop::sifRpcLoop(CpuContext &c)
+    {
+        // The loop never returns; requests are delivered to the waiting thread.
+        (void)c;
+        block(Wait::Rpc, static_cast<int32_t>(arg(c, 0)));
+    }
+
+    void Iop::sifRemoveRpc(CpuContext &c)
+    {
+        for (auto it = m_servers.begin(); it != m_servers.end();)
+            it = it->second.record == arg(c, 0) ? m_servers.erase(it) : std::next(it);
+        ret(c, 0);
+    }
+
+    void Iop::sifGetOtherData(CpuContext &c)
+    {
+        // (record, EE source, IOP destination, size, mode)
+        const uint32_t source = arg(c, 1), destination = arg(c, 2), size = arg(c, 3);
+        std::vector<uint8_t> data(size);
+        m_ee.readEe(source, data.data(), size);
+        writeMemory(destination, data.data(), size);
+        ret(c, 0);
+    }
+
+    void Iop::sifBindRpc(CpuContext &c)
+    {
+        // Callers poll the server field until the EE has registered the id,
+        // some in a busy loop, so the call has to wait like the real round
+        // trip does or it starves every lower priority thread.
+        const uint32_t client = arg(c, 0);
+        for (uint32_t offset = 0; offset < 0x28u; offset += 4u)
+            m_bus.write32(client + offset, 0u);
+        // Only tested against zero here; it names EE memory the IOP never reads.
+        if (m_ee.eeServer(arg(c, 1)))
+            m_bus.write32(client + 0x24u, 1u);
+        ret(c, 0);
+        if (Thread *thread = current())
+        {
+            thread->wakeCycle = m_cycle + kSifRoundTrip;
+            block(Wait::Delay, 0);
+        }
+    }
+
+    void Iop::sifCallRpc(CpuContext &c) { ret(c, static_cast<uint32_t>(-1)); }
+
+    // ---------------------------------------------------------------- hardware timers
+
+    void Iop::allocHardTimer(CpuContext &c)
+    {
+        // Timers 4 and 5 are the 32-bit ones drivers ask for; hand out any free one.
+        for (uint32_t index = 0; index < m_timers.size(); ++index)
+            if (!m_timers[index].allocated)
+            {
+                m_timers[index] = {};
+                m_timers[index].allocated = true;
+                ret(c, index + 1u);
+                return;
+            }
+        ret(c, static_cast<uint32_t>(-150));
+    }
+
+    void Iop::freeHardTimer(CpuContext &c)
+    {
+        const uint32_t index = arg(c, 0) - 1u;
+        if (index < m_timers.size())
+            m_timers[index] = {};
+        ret(c, 0);
+    }
+
+    void Iop::setTimerHandler(CpuContext &c)
+    {
+        const uint32_t index = arg(c, 0) - 1u;
+        if (index < m_timers.size())
+        {
+            m_timers[index].compare = arg(c, 1);
+            m_timers[index].handler = arg(c, 2);
+            m_timers[index].argument = arg(c, 3);
+            m_timers[index].gp = c.gpr[28];
+        }
+        ret(c, 0);
+    }
+
+    void Iop::setupHardTimer(CpuContext &c)
+    {
+        // (timer, source, mode, prescale): only the system clock source is used by drivers.
+        const uint32_t index = arg(c, 0) - 1u;
+        if (index < m_timers.size())
+        {
+            m_timers[index].source = arg(c, 1);
+            m_timers[index].prescale = std::max<uint32_t>(arg(c, 3), 1u);
+        }
+        ret(c, 0);
+    }
+
+    void Iop::startHardTimer(CpuContext &c)
+    {
+        const uint32_t index = arg(c, 0) - 1u;
+        if (index < m_timers.size())
+        {
+            HardTimer &timer = m_timers[index];
+            timer.running = true;
+            timer.start = m_cycle;
+            timer.next = m_cycle + static_cast<uint64_t>(std::max<uint32_t>(timer.compare, 1u)) * timer.prescale;
+        }
+        ret(c, 0);
+    }
+
+    void Iop::stopHardTimer(CpuContext &c)
+    {
+        const uint32_t index = arg(c, 0) - 1u;
+        if (index < m_timers.size())
+            m_timers[index].running = false;
+        ret(c, 0);
+    }
+
+    void Iop::getTimerCounter(CpuContext &c)
+    {
+        const uint32_t index = arg(c, 0) - 1u;
+        ret(c, index < m_timers.size() ? static_cast<uint32_t>((m_cycle - m_timers[index].start) /
+                                                               std::max<uint32_t>(m_timers[index].prescale, 1u))
+                                       : 0u);
+    }
+}
diff --git a/ps2xIOP/src/lle/kernel_handlers.inc b/ps2xIOP/src/lle/kernel_handlers.inc
new file mode 100644
index 000000000..ac90ed265
--- /dev/null
+++ b/ps2xIOP/src/lle/kernel_handlers.inc
@@ -0,0 +1,84 @@
+// Kernel services the emulated IOP provides at a high level. Each entry is a
+// member of Iop; kernel.cpp maps library ordinals onto them.
+PS2X_IOP_HANDLER(unknownImport)
+PS2X_IOP_HANDLER(functionReturn)
+PS2X_IOP_HANDLER(rpcReturn)
+PS2X_IOP_HANDLER(noop)
+PS2X_IOP_HANDLER(allocSysMemory)
+PS2X_IOP_HANDLER(freeSysMemory)
+PS2X_IOP_HANDLER(queryMaxFreeMemSize)
+PS2X_IOP_HANDLER(queryTotalFreeMemSize)
+PS2X_IOP_HANDLER(kprintf)
+PS2X_IOP_HANDLER(registerLibraryEntries)
+PS2X_IOP_HANDLER(releaseLibraryEntries)
+PS2X_IOP_HANDLER(registerIntrHandler)
+PS2X_IOP_HANDLER(releaseIntrHandler)
+PS2X_IOP_HANDLER(enableIntr)
+PS2X_IOP_HANDLER(disableIntr)
+PS2X_IOP_HANDLER(cpuSuspendIntr)
+PS2X_IOP_HANDLER(cpuResumeIntr)
+PS2X_IOP_HANDLER(queryIntrContext)
+PS2X_IOP_HANDLER(lookCtypeTable)
+PS2X_IOP_HANDLER(memcpyHandler)
+PS2X_IOP_HANDLER(memmoveHandler)
+PS2X_IOP_HANDLER(memsetHandler)
+PS2X_IOP_HANDLER(memcmpHandler)
+PS2X_IOP_HANDLER(bzeroHandler)
+PS2X_IOP_HANDLER(strlenHandler)
+PS2X_IOP_HANDLER(strcmpHandler)
+PS2X_IOP_HANDLER(strncmpHandler)
+PS2X_IOP_HANDLER(strcpyHandler)
+PS2X_IOP_HANDLER(strncpyHandler)
+PS2X_IOP_HANDLER(strtolHandler)
+PS2X_IOP_HANDLER(createThread)
+PS2X_IOP_HANDLER(deleteThread)
+PS2X_IOP_HANDLER(startThread)
+PS2X_IOP_HANDLER(exitThread)
+PS2X_IOP_HANDLER(terminateThread)
+PS2X_IOP_HANDLER(changeThreadPriority)
+PS2X_IOP_HANDLER(rotateThreadReadyQueue)
+PS2X_IOP_HANDLER(getThreadId)
+PS2X_IOP_HANDLER(referThreadStatus)
+PS2X_IOP_HANDLER(sleepThread)
+PS2X_IOP_HANDLER(wakeupThread)
+PS2X_IOP_HANDLER(cancelWakeupThread)
+PS2X_IOP_HANDLER(delayThread)
+PS2X_IOP_HANDLER(getSystemTime)
+PS2X_IOP_HANDLER(setAlarm)
+PS2X_IOP_HANDLER(cancelAlarm)
+PS2X_IOP_HANDLER(usecToSysClock)
+PS2X_IOP_HANDLER(sysClockToUsec)
+PS2X_IOP_HANDLER(createSema)
+PS2X_IOP_HANDLER(deleteSema)
+PS2X_IOP_HANDLER(signalSema)
+PS2X_IOP_HANDLER(waitSema)
+PS2X_IOP_HANDLER(pollSema)
+PS2X_IOP_HANDLER(referSemaStatus)
+PS2X_IOP_HANDLER(createEventFlag)
+PS2X_IOP_HANDLER(deleteEventFlag)
+PS2X_IOP_HANDLER(setEventFlag)
+PS2X_IOP_HANDLER(clearEventFlag)
+PS2X_IOP_HANDLER(waitEventFlag)
+PS2X_IOP_HANDLER(pollEventFlag)
+PS2X_IOP_HANDLER(createMbx)
+PS2X_IOP_HANDLER(deleteMbx)
+PS2X_IOP_HANDLER(sendMbx)
+PS2X_IOP_HANDLER(receiveMbx)
+PS2X_IOP_HANDLER(pollMbx)
+PS2X_IOP_HANDLER(sifSetDma)
+PS2X_IOP_HANDLER(sifDmaStat)
+PS2X_IOP_HANDLER(sifCheckInit)
+PS2X_IOP_HANDLER(sifRegisterRpc)
+PS2X_IOP_HANDLER(sifSetRpcQueue)
+PS2X_IOP_HANDLER(sifRpcLoop)
+PS2X_IOP_HANDLER(sifRemoveRpc)
+PS2X_IOP_HANDLER(sifGetOtherData)
+PS2X_IOP_HANDLER(sifBindRpc)
+PS2X_IOP_HANDLER(sifCallRpc)
+PS2X_IOP_HANDLER(allocHardTimer)
+PS2X_IOP_HANDLER(freeHardTimer)
+PS2X_IOP_HANDLER(setTimerHandler)
+PS2X_IOP_HANDLER(setupHardTimer)
+PS2X_IOP_HANDLER(startHardTimer)
+PS2X_IOP_HANDLER(stopHardTimer)
+PS2X_IOP_HANDLER(getTimerCounter)
diff --git a/ps2xIOP/src/lle/spu2.cpp b/ps2xIOP/src/lle/spu2.cpp
new file mode 100644
index 000000000..d2853cb1b
--- /dev/null
+++ b/ps2xIOP/src/lle/spu2.cpp
@@ -0,0 +1,692 @@
+#include "spu2.h"
+
+#include <algorithm>
+#include <cstring>
+
+namespace ps2x::iop::lle
+{
+    namespace
+    {
+        constexpr uint32_t kAddressMask = Spu2::kRamWords - 1u;
+        constexpr int32_t kFilters[16][2] = {
+            {0, 0}, {60, 0}, {115, -52}, {98, -55}, {122, -60},
+        };
+
+        inline int32_t clamp16(int32_t value) { return std::clamp(value, -0x8000, 0x7FFF); }
+        inline int32_t scale(int32_t value, int32_t volume) { return (value * volume) >> 15; }
+
+        // Core register offsets, relative to the core's 0x400 byte window.
+        enum : uint32_t
+        {
+            kPitchModL = 0x180, kPitchModH = 0x182, kNoiseL = 0x184, kNoiseH = 0x186,
+            kDryLL = 0x188, kDryLH = 0x18A, kWetLL = 0x18C, kWetLH = 0x18E,
+            kDryRL = 0x190, kDryRH = 0x192, kWetRL = 0x194, kWetRH = 0x196,
+            kMmix = 0x198, kAttr = 0x19A, kIrqAH = 0x19C, kIrqAL = 0x19E,
+            kKeyOnL = 0x1A0, kKeyOnH = 0x1A2, kKeyOffL = 0x1A4, kKeyOffH = 0x1A6,
+            kTsaH = 0x1A8, kTsaL = 0x1AA, kData = 0x1AC, kAdmas = 0x1B0,
+            kVoiceAddresses = 0x1C0, kEsaH = 0x2E0, kEsaL = 0x2E2,
+            kReverbAddresses = 0x2E4, kEea = 0x33C, kEndxL = 0x340, kEndxH = 0x342, kStatx = 0x344,
+        };
+        // Per-core volume block: 0x760 for core 0, 0x788 for core 1. AVOL is
+        // the external input (core 0's output, on core 1), BVOL the core's
+        // own sound data input fed by AutoDMA.
+        enum : uint32_t
+        {
+            kMvolL = 0x00, kMvolR = 0x02, kEvolL = 0x04, kEvolR = 0x06, kAvolL = 0x08, kAvolR = 0x0A,
+            kBvolL = 0x0C, kBvolR = 0x0E, kMvolXL = 0x10, kMvolXR = 0x12, kReverbCoefficients = 0x14,
+        };
+        constexpr uint32_t kIrqInfo = 0x7C2;
+
+        // Reverb register indices into Core::reverb: addresses then coefficients.
+        enum
+        {
+            kApf1Size, kApf2Size, kLSameDst, kRSameDst, kLComb1, kRComb1, kLComb2, kRComb2,
+            kLSameSrc, kRSameSrc, kLDiffDst, kRDiffDst, kLComb3, kRComb3, kLComb4, kRComb4,
+            kLDiffSrc, kRDiffSrc, kLApf1, kRApf1, kLApf2, kRApf2,
+            kIir, kComb1, kComb2, kComb3, kComb4, kWall, kApf1, kApf2, kInL, kInR,
+        };
+    }
+
+    void Spu2::Volume::set(uint16_t value)
+    {
+        reg = value;
+        if ((value & 0x8000u) == 0u)
+        {
+            // Fixed volume: a signed 15-bit value, doubled.
+            level = static_cast<int16_t>(static_cast<uint16_t>(value << 1));
+            counter = 0;
+        }
+    }
+
+    void Spu2::Volume::update()
+    {
+        if ((reg & 0x8000u) == 0u)
+            return;
+        // Sweep: bit 14 exponential, bit 13 decrease, bits 6-0 rate.
+        const bool exponential = (reg & 0x4000u) != 0u;
+        const bool decrease = (reg & 0x2000u) != 0u;
+        const int32_t rate = reg & 0x7F;
+        const int32_t shift = rate >> 2;
+        int32_t step = decrease ? -8 + (rate & 3) : 7 - (rate & 3);
+        const int32_t cycles = 1 << std::max(0, shift - 11);
+        step <<= std::max(0, 11 - shift);
+        int32_t magnitude = std::abs(level);
+        if (exponential && decrease)
+            step = (step * magnitude) >> 15;
+        if (++counter < cycles * (exponential && !decrease && magnitude > 0x6000 ? 4 : 1))
+            return;
+        counter = 0;
+        magnitude = std::clamp(magnitude + step, 0, 0x7FFF);
+        level = (reg & 0x1000u) != 0u ? -magnitude : magnitude;
+    }
+
+    Spu2::Spu2(Spu2Host &host) : m_host(host), m_ram(kRamWords, 0u)
+    {
+        reset();
+    }
+
+    void Spu2::reset()
+    {
+        std::fill(m_ram.begin(), m_ram.end(), 0u);
+        m_regs.fill(0u);
+        m_cores = {};
+        m_irqInfo = 0;
+        m_outputPos = 0;
+    }
+
+    void Spu2::checkIrq(uint32_t address)
+    {
+        for (int core = 0; core < 2; ++core)
+        {
+            Core &c = m_cores[core];
+            if ((c.attr & 0x40u) != 0u && c.irqAddress == (address & kAddressMask) &&
+                (m_irqInfo & (4u << core)) == 0u)
+            {
+                m_irqInfo |= static_cast<uint16_t>(4u << core);
+                m_host.raiseSpuInterrupt();
+            }
+        }
+    }
+
+    void Spu2::keyOn(int core, uint32_t mask)
+    {
+        Core &c = m_cores[core];
+        c.endx &= ~mask;
+        for (int index = 0; index < 24; ++index)
+        {
+            if ((mask & (1u << index)) == 0u)
+                continue;
+            Voice &v = c.voices[index];
+            v.nextAddress = v.startAddress;
+            v.loopAddressSet = false;
+            v.counter = 0;
+            v.sampleIndex = 28;
+            v.history[0] = v.history[1] = 0;
+            v.window = {};
+            v.blockFlags = 0;
+            v.envelope = {0, 0, 1};
+        }
+    }
+
+    void Spu2::keyOff(int core, uint32_t mask)
+    {
+        for (int index = 0; index < 24; ++index)
+        {
+            Voice &v = m_cores[core].voices[index];
+            if ((mask & (1u << index)) != 0u && v.envelope.phase != 0u)
+            {
+                v.envelope.phase = 4;
+                v.envelope.counter = 0;
+            }
+        }
+    }
+
+    void Spu2::decodeBlock(int core, Voice &v)
+    {
+        const uint32_t base = v.nextAddress & kAddressMask & ~7u;
+        for (uint32_t offset = 0; offset < 8u; ++offset)
+            checkIrq(base + offset);
+        const uint16_t header = m_ram[base];
+        v.blockFlags = static_cast<uint8_t>(header >> 8);
+        if ((v.blockFlags & 4u) != 0u && !v.loopAddressSet)
+            v.loopAddress = base;
+        int32_t shift = header & 0xF;
+        if (shift > 12)
+            shift = 9;
+        const int32_t *filter = kFilters[(header >> 4) & 0xF];
+        for (uint32_t index = 0; index < 28u; ++index)
+        {
+            const uint16_t word = m_ram[(base + 1u + index / 4u) & kAddressMask];
+            const int32_t nibble = static_cast<int16_t>(static_cast<uint16_t>(((word >> ((index & 3u) * 4u)) & 0xFu) << 12));
+            const int32_t sample = clamp16((nibble >> shift) +
+                                           ((v.history[0] * filter[0] + v.history[1] * filter[1] + 32) >> 6));
+            v.history[1] = v.history[0];
+            v.history[0] = sample;
+            v.decoded[index] = static_cast<int16_t>(sample);
+        }
+        (void)core;
+    }
+
+    int32_t Spu2::voiceSample(int core, int index)
+    {
+        Core &c = m_cores[core];
+        Voice &v = c.voices[index];
+
+        int32_t pitch = v.pitch;
+        if (index > 0 && (c.pitchMod & (1u << index)) != 0u)
+            pitch = std::clamp((pitch * (0x8000 + c.voices[index - 1].output)) >> 15, 0, 0x3FFF);
+        v.counter += static_cast<uint32_t>(std::min(pitch, 0x3FFF));
+        while (v.counter >= 0x1000u)
+        {
+            v.counter -= 0x1000u;
+            if (v.sampleIndex >= 28u)
+            {
+                if (v.sampleIndex != 29u)
+                    decodeBlock(core, v);
+                v.sampleIndex = 0;
+            }
+            v.window[0] = v.window[1];
+            v.window[1] = v.window[2];
+            v.window[2] = v.window[3];
+            v.window[3] = v.decoded[v.sampleIndex++];
+            if (v.sampleIndex == 28u)
+            {
+                // The block's flags apply once its last sample has been read.
+                if ((v.blockFlags & 1u) != 0u)
+                {
+                    c.endx |= 1u << index;
+                    v.nextAddress = v.loopAddress;
+                    if ((v.blockFlags & 2u) == 0u)
+                    {
+                        v.envelope.phase = 0;
+                        v.envelope.level = 0;
+                    }
+                }
+                else
+                    v.nextAddress = (v.nextAddress + 8u) & kAddressMask;
+            }
+        }
+
+        // Four-point Catmull-Rom between the last two samples.
+        const int32_t t = static_cast<int32_t>(v.counter);
+        const int32_t p0 = v.window[0], p1 = v.window[1], p2 = v.window[2], p3 = v.window[3];
+        const int64_t a = -p0 + 3 * p1 - 3 * p2 + p3;
+        const int64_t b = 2 * p0 - 5 * p1 + 4 * p2 - p3;
+        const int64_t d = -p0 + p2;
+        const int64_t value = ((((a * t >> 12) + b) * t >> 12) + d) * t >> 13;
+        return clamp16(static_cast<int32_t>(value) + p1);
+    }
+
+    void Spu2::stepEnvelope(Voice &v)
+    {
+        Envelope &e = v.envelope;
+        int32_t rate = 0;
+        bool decrease = false, exponential = false;
+        switch (e.phase)
+        {
+        case 1:
+            rate = (v.adsr1 >> 8) & 0x7F;
+            exponential = (v.adsr1 & 0x8000u) != 0u;
+            break;
+        case 2:
+            rate = ((v.adsr1 >> 4) & 0xF) << 2;
+            decrease = exponential = true;
+            break;
+        case 3:
+            rate = (v.adsr2 >> 6) & 0x7F;
+            decrease = (v.adsr2 & 0x4000u) != 0u;
+            exponential = (v.adsr2 & 0x8000u) != 0u;
+            break;
+        case 4:
+            rate = (v.adsr2 & 0x1F) << 2;
+            decrease = true;
+            exponential = (v.adsr2 & 0x20u) != 0u;
+            break;
+        default:
+            return;
+        }
+        const int32_t shift = rate >> 2;
+        int32_t step = decrease ? -8 + (rate & 3) : 7 - (rate & 3);
+        int32_t cycles = 1 << std::max(0, shift - 11);
+        step <<= std::max(0, 11 - shift);
+        if (exponential && !decrease && e.level > 0x6000)
+            cycles *= 4;
+        if (exponential && decrease)
+            step = (step * e.level) >> 15;
+        if (++e.counter >= cycles)
+        {
+            e.counter = 0;
+            e.level = std::clamp(e.level + step, 0, 0x7FFF);
+        }
+        switch (e.phase)
+        {
+        case 1:
+            if (e.level >= 0x7FFF)
+                e.phase = 2;
+            break;
+        case 2:
+            if (e.level <= ((v.adsr1 & 0xF) + 1) * 0x800)
+                e.phase = 3;
+            break;
+        case 4:
+            if (e.level == 0)
+                e.phase = 0;
+            break;
+        default:
+            break;
+        }
+    }
+
+    void Spu2::stepNoise(Core &c)
+    {
+        // The PS1-style noise generator, clocked by ATTR bits 8-13.
+        const uint32_t clock = (c.attr >> 8) & 0x3Fu;
+        const uint32_t shift = clock >> 2;
+        const uint32_t step = 4u + (clock & 3u);
+        c.noiseCounter += step << (15u - std::min(shift, 15u));
+        while (c.noiseCounter >= 0x20000u)
+        {
+            c.noiseCounter -= 0x20000u;
+            const uint32_t bits = static_cast<uint32_t>(c.noiseLevel);
+            const uint32_t feedback = ((bits >> 15) ^ (bits >> 12) ^ (bits >> 11) ^ (bits >> 10) ^ 1u) & 1u;
+            c.noiseLevel = static_cast<int16_t>(static_cast<uint16_t>((bits << 1) | feedback));
+        }
+    }
+
+    void Spu2::readInput(int core)
+    {
+        Core &c = m_cores[core];
+        const uint32_t base = 0x2000u + (static_cast<uint32_t>(core) << 10);
+        checkIrq(base + c.inputPos);
+        checkIrq(base + 0x200u + c.inputPos);
+        if ((c.admas & (1u << core)) == 0u)
+        {
+            c.inputL = c.inputR = 0;
+            return;
+        }
+        if (!c.inputPrimed)
+        {
+            // Once AutoDMA is on, the first transfer fills both halves before
+            // anything plays; until it starts the input stays silent.
+            uint16_t block[512];
+            for (uint32_t half = 0; half < 2u; ++half)
+            {
+                if (!m_host.fetchAutoDma(core, block))
+                    break;
+                std::memcpy(&m_ram[base + half * 0x100u], block, 0x200u);
+                std::memcpy(&m_ram[base + 0x200u + half * 0x100u], block + 256, 0x200u);
+                c.inputPrimed = true;
+            }
+            if (!c.inputPrimed)
+            {
+                c.inputL = c.inputR = 0;
+                return;
+            }
+            c.inputPos = 0;
+        }
+        c.inputL = static_cast<int16_t>(m_ram[base + c.inputPos]);
+        c.inputR = static_cast<int16_t>(m_ram[base + 0x200u + c.inputPos]);
+        c.inputPos = (c.inputPos + 1u) & 0x1FFu;
+        if ((c.inputPos & 0xFFu) == 0u)
+        {
+            // The half just finished playing takes the next block.
+            const uint32_t half = c.inputPos == 0u ? 0x100u : 0u;
+            uint16_t block[512];
+            if (m_host.fetchAutoDma(core, block))
+            {
+                std::memcpy(&m_ram[base + half], block, 0x200u);
+                std::memcpy(&m_ram[base + 0x200u + half], block + 256, 0x200u);
+            }
+        }
+    }
+
+    void Spu2::mixReverb(int core, int32_t inL, int32_t inR, int32_t &outL, int32_t &outR)
+    {
+        Core &c = m_cores[core];
+        // The reverb runs at half rate on the average of each pair of inputs.
+        c.reverbPhase = !c.reverbPhase;
+        if (c.reverbPhase || (c.attr & 0x80u) == 0u || c.effectEnd <= c.effectStart)
+        {
+            outL = c.reverbOutL;
+            outR = c.reverbOutR;
+            if ((c.attr & 0x80u) == 0u)
+                outL = outR = 0;
+            return;
+        }
+        const uint32_t size = c.effectEnd - c.effectStart + 1u;
+        const auto address = [&](uint32_t offset) {
+            return c.effectStart + (c.reverbPos + offset) % size;
+        };
+        const auto readAt = [&](uint32_t offset) {
+            return static_cast<int32_t>(static_cast<int16_t>(m_ram[address(offset) & kAddressMask]));
+        };
+        const auto writeAt = [&](uint32_t offset, int32_t value) {
+            m_ram[address(offset) & kAddressMask] = static_cast<uint16_t>(clamp16(value));
+        };
+        const auto reg = [&](int index) { return c.reverbAddress[index]; };
+        const auto coef = [&](int index) { return static_cast<int32_t>(c.reverbCoefficient[index - kIir]); };
+
+        const int32_t lin = scale(inL, coef(kInL));
+        const int32_t rin = scale(inR, coef(kInR));
+        const int32_t iir = coef(kIir), wall = coef(kWall);
+        const auto reflect = [&](int dst, int src, int32_t input) {
+            const int32_t previous = readAt(reg(dst) - 1u);
+            writeAt(reg(dst), scale(input + scale(readAt(reg(src)), wall) - previous, iir) + previous);
+        };
+        reflect(kLSameDst, kLSameSrc, lin);
+        reflect(kRSameDst, kRSameSrc, rin);
+        reflect(kLDiffDst, kRDiffSrc, lin);
+        reflect(kRDiffDst, kLDiffSrc, rin);
+
+        int32_t l = scale(readAt(reg(kLComb1)), coef(kComb1)) + scale(readAt(reg(kLComb2)), coef(kComb2)) +
+                    scale(readAt(reg(kLComb3)), coef(kComb3)) + scale(readAt(reg(kLComb4)), coef(kComb4));
+        int32_t r = scale(readAt(reg(kRComb1)), coef(kComb1)) + scale(readAt(reg(kRComb2)), coef(kComb2)) +
+                    scale(readAt(reg(kRComb3)), coef(kComb3)) + scale(readAt(reg(kRComb4)), coef(kComb4));
+        const auto allPass = [&](int32_t value, int dst, int size, int coefficient) {
+            const int32_t delayed = readAt(reg(dst) - reg(size));
+            value = clamp16(value - scale(delayed, coef(coefficient)));
+            writeAt(reg(dst), value);
+            return clamp16(scale(value, coef(coefficient)) + delayed);
+        };
+        l = allPass(clamp16(l), kLApf1, kApf1Size, kApf1);
+        r = allPass(clamp16(r), kRApf1, kApf1Size, kApf1);
+        l = allPass(l, kLApf2, kApf2Size, kApf2);
+        r = allPass(r, kRApf2, kApf2Size, kApf2);
+        c.reverbOutL = outL = l;
+        c.reverbOutR = outR = r;
+        c.reverbPos = (c.reverbPos + 1u) % size;
+    }
+
+    void Spu2::tick(int16_t &left, int16_t &right)
+    {
+        int32_t external[2] = {0, 0};
+        int32_t out[2] = {0, 0};
+        for (int core = 0; core < 2; ++core)
+        {
+            Core &c = m_cores[core];
+            stepNoise(c);
+            int32_t dry[2] = {0, 0}, wet[2] = {0, 0};
+            for (int index = 0; index < 24; ++index)
+            {
+                Voice &v = c.voices[index];
+                v.left.update();
+                v.right.update();
+                if (v.envelope.phase == 0u)
+                {
+                    v.output = 0;
+                    continue;
+                }
+                int32_t sample = (c.noise & (1u << index)) != 0u ? c.noiseLevel : voiceSample(core, index);
+                stepEnvelope(v);
+                sample = scale(sample, v.envelope.level);
+                v.output = sample;
+                const int32_t l = scale(sample, v.left.level);
+                const int32_t r = scale(sample, v.right.level);
+                const uint32_t bit = 1u << index;
+                if ((c.dryL & bit) != 0u) dry[0] += l;
+                if ((c.dryR & bit) != 0u) dry[1] += r;
+                if ((c.wetL & bit) != 0u) wet[0] += l;
+                if ((c.wetR & bit) != 0u) wet[1] += r;
+            }
+            dry[0] = clamp16(dry[0]);
+            dry[1] = clamp16(dry[1]);
+            wet[0] = clamp16(wet[0]);
+            wet[1] = clamp16(wet[1]);
+
+            readInput(core);
+            const uint32_t volumes = 0x760u + static_cast<uint32_t>(core) * 0x28u;
+            const auto vol = [&](uint32_t offset) { return static_cast<int32_t>(static_cast<int16_t>(raw(volumes + offset))); };
+            const int32_t input[2] = {scale(c.inputL, vol(kBvolL)), scale(c.inputR, vol(kBvolR))};
+            const int32_t ext[2] = {core == 1 ? scale(external[0], vol(kAvolL)) : 0,
+                                    core == 1 ? scale(external[1], vol(kAvolR)) : 0};
+
+            // MMIX gates, from bit 11 down: voice dry L/R, voice wet L/R,
+            // input dry L/R, input wet L/R, external dry L/R, external wet L/R.
+            const uint16_t gates = core == 0 ? c.mmix & 0xFF0u : c.mmix;
+            const auto gate = [&](uint32_t bit, int32_t value) { return (gates & bit) != 0u ? value : 0; };
+            int32_t mixL = gate(0x800u, dry[0]) + gate(0x080u, input[0]) + gate(0x008u, ext[0]);
+            int32_t mixR = gate(0x400u, dry[1]) + gate(0x040u, input[1]) + gate(0x004u, ext[1]);
+            const int32_t sendL = clamp16(gate(0x200u, wet[0]) + gate(0x020u, input[0]) + gate(0x002u, ext[0]));
+            const int32_t sendR = clamp16(gate(0x100u, wet[1]) + gate(0x010u, input[1]) + gate(0x001u, ext[1]));
+            int32_t reverbL = 0, reverbR = 0;
+            mixReverb(core, sendL, sendR, reverbL, reverbR);
+            mixL += scale(reverbL, vol(kEvolL));
+            mixR += scale(reverbR, vol(kEvolR));
+
+            c.masterL.update();
+            c.masterR.update();
+            out[0] = clamp16(scale(clamp16(mixL), c.masterL.level));
+            out[1] = clamp16(scale(clamp16(mixR), c.masterR.level));
+            if (core == 0)
+            {
+                external[0] = out[0];
+                external[1] = out[1];
+                // Core 0's output area, which core 1 and captures read back.
+                m_ram[0x800u + m_outputPos] = static_cast<uint16_t>(out[0]);
+                m_ram[0xA00u + m_outputPos] = static_cast<uint16_t>(out[1]);
+            }
+        }
+        m_outputPos = (m_outputPos + 1u) & 0x1FFu;
+        left = static_cast<int16_t>(out[0]);
+        right = static_cast<int16_t>(out[1]);
+    }
+
+    void Spu2::dmaWrite(int core, const uint16_t *data, uint32_t words)
+    {
+        Core &c = m_cores[core];
+        for (uint32_t index = 0; index < words; ++index)
+        {
+            checkIrq(c.transferAddress);
+            m_ram[c.transferAddress] = data[index];
+            c.transferAddress = (c.transferAddress + 1u) & kAddressMask;
+        }
+        // Bit 7 reports a finished transfer; LIBSD's DMA handler waits for it.
+        c.statx |= 0x80u;
+    }
+
+    void Spu2::dmaRead(int core, uint16_t *data, uint32_t words)
+    {
+        Core &c = m_cores[core];
+        for (uint32_t index = 0; index < words; ++index)
+        {
+            checkIrq(c.transferAddress);
+            data[index] = m_ram[c.transferAddress];
+            c.transferAddress = (c.transferAddress + 1u) & kAddressMask;
+        }
+        c.statx |= 0x80u;
+    }
+
+    bool Spu2::autoDmaEnabled(int core) const
+    {
+        return (m_cores[core].admas & (1u << core)) != 0u;
+    }
+
+    void Spu2::dmaStarted(int core)
+    {
+        // Drivers restart the DMA for each half of their buffer while AutoDMA
+        // keeps playing, so a restart must not touch the input position.
+        Core &c = m_cores[core];
+        c.statx &= ~0x80u;
+        if (autoDmaEnabled(core))
+            c.statx |= 0x80u;
+    }
+
+    uint16_t Spu2::readCore(int core, uint32_t offset)
+    {
+        Core &c = m_cores[core];
+        if (offset < 0x180u)
+        {
+            const Voice &v = c.voices[offset >> 4];
+            switch (offset & 0xFu)
+            {
+            case 0xA: return static_cast<uint16_t>(v.envelope.level);
+            case 0xC: return static_cast<uint16_t>(v.left.level);
+            case 0xE: return static_cast<uint16_t>(v.right.level);
+            default: break;
+            }
+        }
+        else if (offset >= kVoiceAddresses && offset < kVoiceAddresses + 24u * 0xCu)
+        {
+            const uint32_t relative = offset - kVoiceAddresses;
+            const Voice &v = c.voices[relative / 0xCu];
+            if (relative % 0xCu == 8u)
+                return static_cast<uint16_t>(v.nextAddress >> 16);
+            if (relative % 0xCu == 10u)
+                return static_cast<uint16_t>(v.nextAddress);
+        }
+        switch (offset)
+        {
+        case kEndxL: return static_cast<uint16_t>(c.endx);
+        case kEndxH: return static_cast<uint16_t>(c.endx >> 16);
+        case kStatx: return c.statx;
+        case kAdmas: return c.admas;
+        case kTsaH: return static_cast<uint16_t>(c.transferAddress >> 16);
+        case kTsaL: return static_cast<uint16_t>(c.transferAddress);
+        case kAttr: return c.attr;
+        default: break;
+        }
+        return raw(static_cast<uint32_t>(core) * 0x400u + offset);
+    }
+
+    uint16_t Spu2::read(uint32_t offset)
+    {
+        offset &= 0x7FEu;
+        if (offset == kIrqInfo)
+            return m_irqInfo;
+        if (offset >= 0x760u && offset < 0x7B0u)
+        {
+            const int core = offset >= 0x788u ? 1 : 0;
+            const uint32_t relative = offset - 0x760u - static_cast<uint32_t>(core) * 0x28u;
+            if (relative == kMvolXL)
+                return static_cast<uint16_t>(m_cores[core].masterL.level);
+            if (relative == kMvolXR)
+                return static_cast<uint16_t>(m_cores[core].masterR.level);
+            return raw(offset);
+        }
+        if (offset < 0x760u)
+            return readCore(offset >= 0x400u ? 1 : 0, offset & 0x3FFu);
+        return raw(offset);
+    }
+
+    void Spu2::writeCore(int core, uint32_t offset, uint16_t value)
+    {
+        Core &c = m_cores[core];
+        const auto high = [](uint32_t &target, uint16_t v) { target = (target & 0xFFFFu) | ((v & 0xFu) << 16); };
+        const auto low = [](uint32_t &target, uint16_t v) { target = (target & 0xF0000u) | v; };
+        const auto maskLow = [](uint32_t &target, uint16_t v) { target = (target & 0xFF0000u) | v; };
+        const auto maskHigh = [](uint32_t &target, uint16_t v) { target = (target & 0xFFFFu) | ((v & 0xFFu) << 16); };
+        if (offset < 0x180u)
+        {
+            Voice &v = c.voices[offset >> 4];
+            switch (offset & 0xFu)
+            {
+            case 0x0: v.left.set(value); break;
+            case 0x2: v.right.set(value); break;
+            case 0x4: v.pitch = value; break;
+            case 0x6: v.adsr1 = value; break;
+            case 0x8: v.adsr2 = value; break;
+            default: break;
+            }
+            return;
+        }
+        if (offset >= kVoiceAddresses && offset < kVoiceAddresses + 24u * 0xCu)
+        {
+            const uint32_t relative = offset - kVoiceAddresses;
+            Voice &v = c.voices[relative / 0xCu];
+            switch (relative % 0xCu)
+            {
+            case 0: high(v.startAddress, value); break;
+            case 2: low(v.startAddress, value); break;
+            case 4: high(v.loopAddress, value); v.loopAddressSet = true; break;
+            case 6: low(v.loopAddress, value); v.loopAddressSet = true; break;
+            case 8: high(v.nextAddress, value); break;
+            case 10: low(v.nextAddress, value); break;
+            default: break;
+            }
+            return;
+        }
+        if (offset >= kReverbAddresses && offset < kEea)
+        {
+            // Twenty-bit offsets into the effect area, high word first.
+            uint32_t &address = c.reverbAddress[(offset - kReverbAddresses) >> 2];
+            if ((offset & 2u) == 0u)
+                high(address, value);
+            else
+                low(address, value);
+            return;
+        }
+        switch (offset)
+        {
+        case kPitchModL: maskLow(c.pitchMod, value); break;
+        case kPitchModH: maskHigh(c.pitchMod, value); break;
+        case kNoiseL: maskLow(c.noise, value); break;
+        case kNoiseH: maskHigh(c.noise, value); break;
+        case kDryLL: maskLow(c.dryL, value); break;
+        case kDryLH: maskHigh(c.dryL, value); break;
+        case kWetLL: maskLow(c.wetL, value); break;
+        case kWetLH: maskHigh(c.wetL, value); break;
+        case kDryRL: maskLow(c.dryR, value); break;
+        case kDryRH: maskHigh(c.dryR, value); break;
+        case kWetRL: maskLow(c.wetR, value); break;
+        case kWetRH: maskHigh(c.wetR, value); break;
+        case kMmix: c.mmix = value; break;
+        case kAttr:
+        {
+            const bool irqWasEnabled = (c.attr & 0x40u) != 0u;
+            c.attr = value;
+            // Clearing IRQ enable acknowledges the core's pending interrupt.
+            if (irqWasEnabled && (value & 0x40u) == 0u)
+                m_irqInfo &= static_cast<uint16_t>(~(4u << core));
+            if ((value & 0x30u) == 0u)
+                c.statx &= ~0x80u;
+            break;
+        }
+        case kIrqAH: high(c.irqAddress, value); break;
+        case kIrqAL: low(c.irqAddress, value); break;
+        case kKeyOnL: keyOn(core, value); break;
+        case kKeyOnH: keyOn(core, static_cast<uint32_t>(value & 0xFFu) << 16); break;
+        case kKeyOffL: keyOff(core, value); break;
+        case kKeyOffH: keyOff(core, static_cast<uint32_t>(value & 0xFFu) << 16); break;
+        case kTsaH: high(c.transferAddress, value); break;
+        case kTsaL: low(c.transferAddress, value); break;
+        case kData:
+            checkIrq(c.transferAddress);
+            m_ram[c.transferAddress] = value;
+            c.transferAddress = (c.transferAddress + 1u) & kAddressMask;
+            break;
+        case kAdmas:
+            c.admas = value;
+            if ((value & 3u) == 0u)
+                c.inputPrimed = false;
+            break;
+        case kEsaH: high(c.effectStart, value); c.reverbPos = 0; break;
+        case kEsaL: low(c.effectStart, value); c.reverbPos = 0; break;
+        case kEea: c.effectEnd = (static_cast<uint32_t>(value & 0xFu) << 16) | 0xFFFFu; break;
+        case kEndxL: case kEndxH: break;
+        default: break;
+        }
+    }
+
+    void Spu2::write(uint32_t offset, uint16_t value)
+    {
+        offset &= 0x7FEu;
+        raw(offset) = value;
+        if (offset == kIrqInfo)
+            return;
+        if (offset >= 0x760u && offset < 0x7B0u)
+        {
+            const int core = offset >= 0x788u ? 1 : 0;
+            const uint32_t relative = offset - 0x760u - static_cast<uint32_t>(core) * 0x28u;
+            Core &c = m_cores[core];
+            if (relative == kMvolL)
+                c.masterL.set(value);
+            else if (relative == kMvolR)
+                c.masterR.set(value);
+            else if (relative >= kReverbCoefficients && relative < kReverbCoefficients + 20u)
+                c.reverbCoefficient[(relative - kReverbCoefficients) / 2u] = static_cast<int16_t>(value);
+            return;
+        }
+        if (offset < 0x760u)
+            writeCore(offset >= 0x400u ? 1 : 0, offset & 0x3FFu, value);
+    }
+}
diff --git a/ps2xIOP/src/lle/spu2.h b/ps2xIOP/src/lle/spu2.h
new file mode 100644
index 000000000..075673d48
--- /dev/null
+++ b/ps2xIOP/src/lle/spu2.h
@@ -0,0 +1,122 @@
+#pragma once
+
+#include <array>
+#include <cstdint>
+#include <vector>
+
+namespace ps2x::iop::lle
+{
+    // What the SPU2 needs from the IOP around it.
+    class Spu2Host
+    {
+    public:
+        virtual ~Spu2Host() = default;
+        // AutoDMA wants its next 1 KiB block (512 bytes left, 512 bytes right).
+        // Returns false while the core's DMA channel has nothing queued.
+        virtual bool fetchAutoDma(int core, uint16_t *block) = 0;
+        // The SPU2 interrupt line went up.
+        virtual void raiseSpuInterrupt() = 0;
+    };
+
+    // The two SPU2 cores, their 48 voices and 2 MiB of sound memory, mixed
+    // one 48 kHz sample at a time.
+    class Spu2
+    {
+    public:
+        static constexpr uint32_t kRamWords = 1u << 20;
+
+        explicit Spu2(Spu2Host &host);
+
+        void reset();
+        uint16_t read(uint32_t offset);
+        void write(uint32_t offset, uint16_t value);
+
+        // Produce one output sample pair.
+        void tick(int16_t &left, int16_t &right);
+
+        // DMA transfers between IOP memory and sound memory at the core's TSA.
+        void dmaWrite(int core, const uint16_t *data, uint32_t words);
+        void dmaRead(int core, uint16_t *data, uint32_t words);
+        bool autoDmaEnabled(int core) const;
+        // A DMA channel was started or stopped for this core.
+        void dmaStarted(int core);
+
+        uint16_t *ram() { return m_ram.data(); }
+
+    private:
+        struct Envelope
+        {
+            int32_t level = 0;
+            int32_t counter = 0;
+            uint8_t phase = 0; // 0 off, 1 attack, 2 decay, 3 sustain, 4 release
+        };
+
+        struct Volume
+        {
+            uint16_t reg = 0;
+            int32_t level = 0; // current value, -0x8000..0x7FFF
+            int32_t counter = 0;
+            void set(uint16_t value);
+            void update();
+        };
+
+        struct Voice
+        {
+            Volume left, right;
+            uint16_t pitch = 0;
+            uint16_t adsr1 = 0, adsr2 = 0;
+            Envelope envelope;
+            uint32_t startAddress = 0;
+            uint32_t loopAddress = 0;
+            uint32_t nextAddress = 0; // address of the block being played
+            bool loopAddressSet = false;
+            uint32_t counter = 0;     // 12-bit fraction plus sample index
+            std::array<int16_t, 28> decoded{};
+            int32_t history[2]{};
+            std::array<int16_t, 4> window{}; // last four samples for interpolation
+            uint8_t sampleIndex = 28;         // 28 forces a block decode
+            uint8_t blockFlags = 0;
+            int32_t output = 0;               // post-envelope sample, for modulation
+        };
+
+        struct Core
+        {
+            std::array<Voice, 24> voices;
+            uint32_t pitchMod = 0, noise = 0, dryL = 0, dryR = 0, wetL = 0, wetR = 0;
+            uint16_t mmix = 0, attr = 0, admas = 0, statx = 0x80;
+            uint32_t irqAddress = 0, transferAddress = 0, endx = 0;
+            uint32_t effectStart = 0, effectEnd = 0;
+            Volume masterL, masterR;
+            int16_t effectL = 0, effectR = 0, inputL = 0, inputR = 0, externalL = 0, externalR = 0;
+            uint32_t inputPos = 0;
+            bool inputPrimed = false;
+            int32_t noiseLevel = 0;
+            uint32_t noiseCounter = 0;
+            std::array<uint32_t, 22> reverbAddress{};
+            std::array<int16_t, 10> reverbCoefficient{};
+            uint32_t reverbPos = 0;
+            int32_t reverbOutL = 0, reverbOutR = 0;
+            bool reverbPhase = false;
+        };
+
+        uint16_t &raw(uint32_t offset) { return m_regs[(offset >> 1) & 0x3FFu]; }
+        void writeCore(int core, uint32_t offset, uint16_t value);
+        uint16_t readCore(int core, uint32_t offset);
+        void keyOn(int core, uint32_t mask);
+        void keyOff(int core, uint32_t mask);
+        void checkIrq(uint32_t address);
+        void decodeBlock(int core, Voice &voice);
+        int32_t voiceSample(int core, int index);
+        void stepEnvelope(Voice &voice);
+        void stepNoise(Core &core);
+        void readInput(int core);
+        void mixReverb(int core, int32_t inL, int32_t inR, int32_t &outL, int32_t &outR);
+
+        Spu2Host &m_host;
+        std::vector<uint16_t> m_ram;
+        std::array<uint16_t, 0x400> m_regs{};
+        std::array<Core, 2> m_cores{};
+        uint16_t m_irqInfo = 0;
+        uint32_t m_outputPos = 0;
+    };
+}
diff --git a/ps2xIOP/src/native_iop.cpp b/ps2xIOP/src/native_iop.cpp
new file mode 100644
index 000000000..6325ee020
--- /dev/null
+++ b/ps2xIOP/src/native_iop.cpp
@@ -0,0 +1,207 @@
+#include "ps2x/iop/native_iop.h"
+
+#include "lle/iop.h"
+
+#include <algorithm>
+#include <cctype>
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+
+namespace ps2x::iop
+{
+    namespace
+    {
+        std::string moduleName(std::string_view guestPath)
+        {
+            const size_t slash = guestPath.find_last_of("\\/:");
+            std::string_view name = slash == std::string_view::npos ? guestPath : guestPath.substr(slash + 1);
+            name = name.substr(0, name.find(';'));
+            std::string upper(name);
+            for (char &ch : upper)
+                ch = static_cast<char>(std::toupper(static_cast<unsigned char>(ch)));
+            return upper;
+        }
+    }
+
+    class NativeIop::Impl final : public lle::EeLink
+    {
+    public:
+        explicit Impl(IopHost &hostRef) : host(hostRef), iop(*this) {}
+
+        bool readEe(uint32_t address, void *destination, uint32_t size) override
+        {
+            return host.readGuest(address, destination, size);
+        }
+        bool writeEe(uint32_t address, const void *source, uint32_t size) override
+        {
+            return host.writeGuest(address, source, size);
+        }
+        bool eeServer(uint32_t sid) override { return host.hasGuestRpcServer(sid); }
+        void log(const std::string &message) override { host.log(LogLevel::Info, message); }
+
+        // Advance the IOP without an audio device, discarding the samples.
+        void stepSilently(uint32_t frames)
+        {
+            int16_t left, right;
+            for (uint32_t index = 0; index < frames; ++index)
+                iop.step(left, right);
+        }
+
+        bool audioRunning() const
+        {
+            return rendered && std::chrono::steady_clock::now() - lastRender < std::chrono::milliseconds(250);
+        }
+
+        IopHost &host;
+        lle::Iop iop;
+        mutable std::mutex mutex;
+        std::condition_variable progressed;
+        std::vector<std::string> modules;
+        std::chrono::steady_clock::time_point lastRender{};
+        bool rendered = false;
+        bool loaded = false;
+    };
+
+    NativeIop::NativeIop(IopHost &host) : m_impl(std::make_unique<Impl>(host)) {}
+    NativeIop::~NativeIop() = default;
+
+    void NativeIop::setModules(std::vector<std::string> names)
+    {
+        std::lock_guard lock(m_impl->mutex);
+        m_impl->modules.clear();
+        for (const auto &name : names)
+            m_impl->modules.push_back(moduleName(name));
+    }
+
+    bool NativeIop::enabled() const
+    {
+        std::lock_guard lock(m_impl->mutex);
+        return !m_impl->modules.empty();
+    }
+
+    bool NativeIop::claims(std::string_view guestPath) const
+    {
+        std::lock_guard lock(m_impl->mutex);
+        const std::string name = moduleName(guestPath);
+        return std::find(m_impl->modules.begin(), m_impl->modules.end(), name) != m_impl->modules.end();
+    }
+
+    int32_t NativeIop::load(std::string_view guestPath, std::string_view arguments)
+    {
+        IopHost &host = m_impl->host;
+        const uint64_t handle = host.openHostFile(host.translateGuestPath(guestPath));
+        uint64_t size = 0;
+        if (handle == 0u || !host.hostFileSize(handle, size) || size == 0u || size > (4u << 20))
+        {
+            if (handle != 0u)
+                host.closeHostFile(handle);
+            host.log(LogLevel::Warning, "[iop] cannot read " + std::string(guestPath));
+            return -1;
+        }
+        std::vector<uint8_t> file(static_cast<size_t>(size));
+        size_t got = 0;
+        const bool read = host.readHostFile(handle, 0u, file.data(), file.size(), got);
+        host.closeHostFile(handle);
+        if (!read || got != file.size())
+            return -1;
+
+        std::vector<std::string> argv;
+        for (size_t start = 0; start < arguments.size();)
+        {
+            const size_t end = std::min(arguments.find('\0', start), arguments.size());
+            if (end > start)
+                argv.emplace_back(arguments.substr(start, end - start));
+            start = end + 1;
+        }
+
+        std::lock_guard lock(m_impl->mutex);
+        const int32_t id = m_impl->iop.loadModule(file, std::string(guestPath), argv);
+        if (id > 0)
+            m_impl->loaded = true;
+        m_impl->iop.settle();
+        return id;
+    }
+
+    bool NativeIop::server(uint32_t sid, uint32_t &record, uint32_t &buffer) const
+    {
+        std::lock_guard lock(m_impl->mutex);
+        return m_impl->iop.server(sid, record, buffer);
+    }
+
+    bool NativeIop::call(uint32_t sid, uint32_t function, uint32_t sendAddress, uint32_t sendSize,
+                         uint32_t receiveAddress, uint32_t receiveSize)
+    {
+        auto request = std::make_shared<lle::Iop::Request>();
+        request->sid = sid;
+        request->function = function;
+        request->send.resize(sendSize);
+        if (sendSize != 0u && !m_impl->host.readGuest(sendAddress, request->send.data(), sendSize))
+            return false;
+        request->receiveAddress = receiveAddress;
+        request->receiveSize = receiveSize;
+
+        std::unique_lock lock(m_impl->mutex);
+        if (!m_impl->iop.hasServer(sid))
+            return false;
+        m_impl->iop.submit(request);
+        m_impl->iop.settle();
+        // Most commands finish at once; the rest wait for IOP time to pass.
+        const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+        while (!request->done && std::chrono::steady_clock::now() < deadline)
+        {
+            if (m_impl->audioRunning())
+                m_impl->progressed.wait_for(lock, std::chrono::milliseconds(20));
+            else
+                m_impl->stepSilently(480u);
+            m_impl->iop.settle();
+        }
+        if (!request->done)
+            m_impl->host.log(LogLevel::Warning, "[iop] RPC to " + std::to_string(sid) + " timed out");
+        return request->done;
+    }
+
+    bool NativeIop::write(uint32_t address, const void *data, uint32_t size)
+    {
+        std::lock_guard lock(m_impl->mutex);
+        m_impl->iop.writeMemory(address, data, size);
+        return true;
+    }
+
+    bool NativeIop::read(uint32_t address, void *data, uint32_t size)
+    {
+        std::lock_guard lock(m_impl->mutex);
+        m_impl->iop.readMemory(address, data, size);
+        return true;
+    }
+
+    uint32_t NativeIop::allocate(uint32_t size)
+    {
+        std::lock_guard lock(m_impl->mutex);
+        return m_impl->iop.allocate(size);
+    }
+
+    void NativeIop::release(uint32_t address)
+    {
+        std::lock_guard lock(m_impl->mutex);
+        m_impl->iop.release(address);
+    }
+
+    void NativeIop::render(int16_t *frames, uint32_t count)
+    {
+        {
+            std::lock_guard lock(m_impl->mutex);
+            for (uint32_t index = 0; index < count; ++index)
+                m_impl->iop.step(frames[index * 2u], frames[index * 2u + 1u]);
+            m_impl->rendered = true;
+            m_impl->lastRender = std::chrono::steady_clock::now();
+        }
+        m_impl->progressed.notify_all();
+    }
+
+    bool NativeIop::active() const
+    {
+        std::lock_guard lock(m_impl->mutex);
+        return m_impl->loaded;
+    }
+}

From 2d03b8c447de4e40fb0bb22dc934fad73a4f47ae Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:32:50 +0200
Subject: [PATCH 56/68] Hook native IOP modules into the runtime

A runtime names the modules it wants run natively with
ps2_native_iop::setModules(). From then on:

- sceSifLoadModule of one of them also loads it on the emulated IOP. The
  high-level tracker still hands out the module id the game sees.
- IOP heap allocation and EE-to-IOP sceSifSetDma go to the emulated IOP's
  memory, which is where the modules look for what the game sends them.
- The first module to load opens a 48 kHz stereo stream whose callback
  runs the IOP. Volume 0 keeps it running silently, because games wait on
  their sound drivers whether anyone listens or not.

SDRDRV's callback thread binds to an RPC server on the EE. Answering that
bind at once left the thread spinning on a server that did not exist yet
and starved the rest of the driver, so the bind now waits until the EE has
really registered the server.

PS2X_AUDIO_DUMP=path keeps a raw copy of everything played, to compare
against a reference offline.
---
 ps2xRuntime/CMakeLists.txt                   |  1 +
 ps2xRuntime/include/runtime/ps2_native_iop.h | 23 ++++++
 ps2xRuntime/src/lib/Kernel/Stubs/SIF.cpp     | 59 +++++++++++---
 ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp  | 15 ++++
 ps2xRuntime/src/lib/ps2_iop_host.cpp         | 17 ++++
 ps2xRuntime/src/lib/ps2_iop_host.h           |  1 +
 ps2xRuntime/src/lib/ps2_iop_transport.h      |  5 ++
 ps2xRuntime/src/lib/ps2_native_iop.cpp       | 86 ++++++++++++++++++++
 ps2xRuntime/src/lib/ps2_runtime.cpp          |  3 +
 9 files changed, 200 insertions(+), 10 deletions(-)
 create mode 100644 ps2xRuntime/include/runtime/ps2_native_iop.h
 create mode 100644 ps2xRuntime/src/lib/ps2_native_iop.cpp

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index 6ab002c04..6c968db45 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -386,6 +386,7 @@ add_library(ps2_runtime STATIC
     src/lib/gs/gs_threaded_backend.cpp
     src/lib/ps2_iop_host.cpp
     src/lib/ps2_memory.cpp
+    src/lib/ps2_native_iop.cpp
     src/lib/ps2_pad.cpp
     src/lib/ps2_runtime.cpp
     src/lib/ps2_vif1_interpreter.cpp
diff --git a/ps2xRuntime/include/runtime/ps2_native_iop.h b/ps2xRuntime/include/runtime/ps2_native_iop.h
new file mode 100644
index 000000000..4fcc207ce
--- /dev/null
+++ b/ps2xRuntime/include/runtime/ps2_native_iop.h
@@ -0,0 +1,23 @@
+#pragma once
+
+#include <string>
+#include <vector>
+
+class PS2Runtime;
+
+// Modules named here load onto an emulated IOP with an SPU2 instead of being
+// stubbed: the game's RPCs run their real code, and what the SPU2 mixes plays
+// on the host audio device.
+namespace ps2_native_iop
+{
+    // File names as the game loads them, for example "LIBSD.IRX". Call this
+    // before the game starts.
+    void setModules(PS2Runtime &runtime, std::vector<std::string> names);
+    // 0 mutes the output. The IOP keeps running in step with the device either
+    // way, since games wait on their sound driver.
+    void setVolume(float volume);
+
+    // Called by the runtime; the stream starts with the first native module.
+    void startAudio(PS2Runtime &runtime);
+    void stopAudio();
+}
diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/SIF.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/SIF.cpp
index 6a07fe278..68d984c4c 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/SIF.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/SIF.cpp
@@ -54,6 +54,13 @@ namespace ps2_stubs
         };
         static_assert(sizeof(Ps2SifDmaTransfer) == 16u, "Unexpected SIF DMA descriptor size");
 
+        // Once a game runs IOP modules natively, IOP memory is that IOP's.
+        ps2x::iop::NativeIop *nativeIop(PS2Runtime *runtime)
+        {
+            ps2x::iop::NativeIop *native = PS2IopTransport::native(runtime);
+            return native && native->enabled() ? native : nullptr;
+        }
+
         std::mutex g_sifDmaTransferMutex;
         uint32_t g_nextSifDmaTransferId = 1u;
         std::mutex g_sifCmdStateMutex;
@@ -448,19 +455,19 @@ namespace ps2_stubs
     void sceSifAllocIopHeap(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         (void)rdram;
-        (void)runtime;
 
         const uint32_t reqSize = getRegU32(ctx, 4);
-        setReturnU32(ctx, allocateSifHeapBlock(reqSize));
+        ps2x::iop::NativeIop *native = nativeIop(runtime);
+        setReturnU32(ctx, native ? native->allocate(reqSize) : allocateSifHeapBlock(reqSize));
     }
 
     void sceSifAllocSysMemory(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         (void)rdram;
-        (void)runtime;
 
         const uint32_t size = getRegU32(ctx, 5);
-        setReturnU32(ctx, allocateSifHeapBlock(size));
+        ps2x::iop::NativeIop *native = nativeIop(runtime);
+        setReturnU32(ctx, native ? native->allocate(size) : allocateSifHeapBlock(size));
     }
 
     void sceSifBindRpc(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -503,19 +510,20 @@ namespace ps2_stubs
     void sceSifFreeIopHeap(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
         (void)rdram;
-        (void)runtime;
 
         const uint32_t addr = getRegU32(ctx, 4);
+        if (ps2x::iop::NativeIop *native = nativeIop(runtime))
+        {
+            native->release(addr);
+            setReturnS32(ctx, 0);
+            return;
+        }
         setReturnS32(ctx, freeSifHeapBlock(addr) ? 0 : -1);
     }
 
     void sceSifFreeSysMemory(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
     {
-        (void)rdram;
-        (void)runtime;
-
-        const uint32_t addr = getRegU32(ctx, 4);
-        setReturnS32(ctx, freeSifHeapBlock(addr) ? 0 : -1);
+        sceSifFreeIopHeap(rdram, ctx, runtime);
     }
 
     void sceSifGetDataTable(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -779,6 +787,37 @@ namespace ps2_stubs
         const uint32_t dmatAddr = getRegU32(ctx, 4);
         const uint32_t count = getRegU32(ctx, 5);
 
+        // With native modules, EE-to-IOP transfers land in that IOP's memory.
+        if (ps2x::iop::NativeIop *native = nativeIop(runtime); native && dmatAddr != 0u && count <= 32u)
+        {
+            for (uint32_t i = 0; i < count; ++i)
+            {
+                Ps2SifDmaTransfer xfer{};
+                const uint8_t *entry = getConstMemPtr(rdram, dmatAddr + i * static_cast<uint32_t>(sizeof(xfer)));
+                if (!entry)
+                {
+                    break;
+                }
+                std::memcpy(&xfer, entry, sizeof(xfer));
+                if (xfer.size <= 0)
+                {
+                    continue;
+                }
+                const uint32_t size = static_cast<uint32_t>(xfer.size);
+                // The source has to be one contiguous stretch of EE memory.
+                const uint8_t *first = getConstMemPtr(rdram, xfer.src);
+                const uint8_t *last = getConstMemPtr(rdram, xfer.src + size - 1u);
+                if (!first || !last || static_cast<uint32_t>(last - first) != size - 1u)
+                {
+                    continue;
+                }
+                native->write(xfer.dest, first, size);
+            }
+            ps2_syscalls::dispatchDmacHandlersForCause(rdram, runtime, 5u);
+            setReturnS32(ctx, static_cast<int32_t>(allocateSifDmaTransferId()));
+            return;
+        }
+
         const uint32_t listAddr = getRegU32(ctx, 4);
         PS2_IF_AGRESSIVE_LOGS({
             std::cerr << "[sceSifSetDma:CALL] pc=0x" << std::hex << ctx->pc
diff --git a/ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp b/ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp
index b7f642705..414251689 100644
--- a/ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Syscalls/RPC.cpp
@@ -1,6 +1,7 @@
 #include "Common.h"
 #include "RPC.h"
 #include "../../ps2_iop_transport.h"
+#include "runtime/ps2_native_iop.h"
 
 namespace ps2_syscalls
 {
@@ -194,6 +195,20 @@ namespace ps2_syscalls
             setReturnS32(ctx, -1);
             return;
         }
+        // A module the game runs natively also loads onto the emulated IOP.
+        // The tracker below still hands out the id the game sees.
+        if (ps2x::iop::NativeIop *native = PS2IopTransport::native(runtime); native && native->claims(modulePath))
+        {
+            const uint32_t argLength = std::min<uint32_t>(getRegU32(ctx, 5), 512u);
+            std::string arguments(argLength, '\0');
+            for (uint32_t i = 0; i < argLength; ++i)
+            {
+                if (const uint8_t *byte = getConstMemPtr(rdram, getRegU32(ctx, 6) + i))
+                    arguments[i] = static_cast<char>(*byte);
+            }
+            if (native->load(modulePath, arguments) > 0)
+                ps2_native_iop::startAudio(*runtime);
+        }
 
         const int32_t moduleId = trackSifModuleLoad(modulePath);
         if (moduleId <= 0)
diff --git a/ps2xRuntime/src/lib/ps2_iop_host.cpp b/ps2xRuntime/src/lib/ps2_iop_host.cpp
index 8709ed1d7..d9ee52bf6 100644
--- a/ps2xRuntime/src/lib/ps2_iop_host.cpp
+++ b/ps2xRuntime/src/lib/ps2_iop_host.cpp
@@ -472,6 +472,23 @@ bool PS2IopHostAdapter::hasGuestFunction(uint32_t address) const
     return m_runtime.hasFunction(address);
 }
 
+bool PS2IopHostAdapter::hasGuestRpcServer(uint32_t sid) const
+{
+    uint32_t record = 0u;
+    {
+        std::lock_guard<std::mutex> lock(g_rpc_mutex);
+        const auto found = g_rpc_servers.find(sid);
+        if (found == g_rpc_servers.end())
+        {
+            return false;
+        }
+        record = found->second.sd_ptr;
+    }
+    // Binding from the EE side leaves a placeholder with no function.
+    t_SifRpcServerData server{};
+    return record != 0u && readGuest(record, &server, sizeof(server)) && server.func != 0u;
+}
+
 bool PS2IopHostAdapter::invokeGuestFunction(uint64_t callToken,
                                             uint32_t address,
                                             uint32_t a0,
diff --git a/ps2xRuntime/src/lib/ps2_iop_host.h b/ps2xRuntime/src/lib/ps2_iop_host.h
index 48c5b2264..7e529c256 100644
--- a/ps2xRuntime/src/lib/ps2_iop_host.h
+++ b/ps2xRuntime/src/lib/ps2_iop_host.h
@@ -71,6 +71,7 @@ class PS2IopHostAdapter final : public ps2x::iop::IopHost
     int32_t memoryCard(const ps2x::iop::MemoryCardRequest &request) override;
 
     bool hasGuestFunction(uint32_t address) const override;
+    bool hasGuestRpcServer(uint32_t sid) const override;
     bool invokeGuestFunction(uint64_t callToken,
                              uint32_t address,
                              uint32_t a0,
diff --git a/ps2xRuntime/src/lib/ps2_iop_transport.h b/ps2xRuntime/src/lib/ps2_iop_transport.h
index 988d6b290..6f47b84ad 100644
--- a/ps2xRuntime/src/lib/ps2_iop_transport.h
+++ b/ps2xRuntime/src/lib/ps2_iop_transport.h
@@ -37,6 +37,11 @@ class PS2IopTransport
                    : ps2x::iop::RpcResult{};
     }
 
+    [[nodiscard]] static ps2x::iop::NativeIop *native(PS2Runtime *runtime)
+    {
+        return runtime && runtime->m_iopSubsystem ? &runtime->m_iopSubsystem->native() : nullptr;
+    }
+
     static void notifyTransfer(
         PS2Runtime *runtime,
         uint8_t *rdram,
diff --git a/ps2xRuntime/src/lib/ps2_native_iop.cpp b/ps2xRuntime/src/lib/ps2_native_iop.cpp
new file mode 100644
index 000000000..41b01d5f9
--- /dev/null
+++ b/ps2xRuntime/src/lib/ps2_native_iop.cpp
@@ -0,0 +1,86 @@
+#include "runtime/ps2_native_iop.h"
+
+#include "ps2_iop_transport.h"
+#include "raylib.h"
+
+#include <atomic>
+#include <cstdio>
+#include <cstdlib>
+#include <iostream>
+
+namespace ps2_native_iop
+{
+    namespace
+    {
+        // raylib's stream callback carries no user pointer.
+        std::atomic<ps2x::iop::NativeIop *> g_source{nullptr};
+        AudioStream g_stream{};
+        bool g_streaming = false;
+        float g_volume = 1.0f;
+
+        void fill(void *buffer, unsigned int frames)
+        {
+            if (ps2x::iop::NativeIop *source = g_source.load(std::memory_order_acquire))
+                source->render(static_cast<int16_t *>(buffer), frames);
+            // PS2X_AUDIO_DUMP=file keeps a copy of everything played, as raw
+            // 48 kHz stereo s16, to compare against a reference offline.
+            static FILE *dump = [] {
+                const char *path = std::getenv("PS2X_AUDIO_DUMP");
+                return path && *path ? std::fopen(path, "wb") : nullptr;
+            }();
+            if (dump)
+                std::fwrite(buffer, 4u, frames, dump);
+        }
+    }
+
+    void setModules(PS2Runtime &runtime, std::vector<std::string> names)
+    {
+        if (ps2x::iop::NativeIop *native = PS2IopTransport::native(&runtime))
+            native->setModules(std::move(names));
+    }
+
+    void setVolume(float volume)
+    {
+        g_volume = volume;
+#if !defined(PLATFORM_VITA)
+        if (g_streaming)
+            SetAudioStreamVolume(g_stream, g_volume);
+#endif
+    }
+
+    void startAudio(PS2Runtime &runtime)
+    {
+#if !defined(PLATFORM_VITA)
+        ps2x::iop::NativeIop *native = PS2IopTransport::native(&runtime);
+        if (g_streaming || !native || !IsAudioDeviceReady())
+            return;
+        // 1024 frames is about 21 ms, and the IOP renders a buffer in well under that.
+        SetAudioStreamBufferSizeDefault(1024);
+        g_stream = LoadAudioStream(48000u, 16u, 2u);
+        if (!IsAudioStreamValid(g_stream))
+        {
+            std::cerr << "[iop] could not open an audio stream; the native IOP runs silently" << std::endl;
+            return;
+        }
+        g_source.store(native, std::memory_order_release);
+        SetAudioStreamCallback(g_stream, &fill);
+        SetAudioStreamVolume(g_stream, g_volume);
+        PlayAudioStream(g_stream);
+        g_streaming = true;
+#else
+        (void)runtime;
+#endif
+    }
+
+    void stopAudio()
+    {
+#if !defined(PLATFORM_VITA)
+        if (!g_streaming)
+            return;
+        // Unloading takes the mixer lock, so no callback is running after it.
+        UnloadAudioStream(g_stream);
+        g_source.store(nullptr, std::memory_order_release);
+        g_streaming = false;
+#endif
+    }
+}
diff --git a/ps2xRuntime/src/lib/ps2_runtime.cpp b/ps2xRuntime/src/lib/ps2_runtime.cpp
index 738b1ad32..b951e3c7d 100644
--- a/ps2xRuntime/src/lib/ps2_runtime.cpp
+++ b/ps2xRuntime/src/lib/ps2_runtime.cpp
@@ -14,6 +14,7 @@
 #include "ps2_host_backend.h"
 #include "ps2_iop_host.h"
 #include "ps2x/iop/iop_subsystem.h"
+#include "runtime/ps2_native_iop.h"
 
 #include <iostream>
 #include <fstream>
@@ -575,6 +576,8 @@ PS2Runtime::~PS2Runtime()
     try
     {
         requestStop();
+        // The audio callback renders from the IOP subsystem.
+        ps2_native_iop::stopAudio();
         m_iopSubsystem.reset();
         m_iopHost.reset();
 #if defined(PLATFORM_VITA)

From f6903fb7c836702f4336dc84852dd8e77f1c7492 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:32:51 +0200
Subject: [PATCH 57/68] Keep movie audio in stream order and just ahead of
 playback

Two things made DQ8's movie audio sound chopped once its sound driver
actually ran.

The demux callbacks were queued on the EE scheduler and ran after
sceMpegDemuxPss() had returned. By then the caller had released the ring
space they point at, and a batch of queued invocations runs last to
first, so the audio came out shuffled. libmpeg calls them inside the
demux call, in stream order, and the stub now does too, with the return
value set first since the callbacks run before the caller resumes.

The demux also ran as far ahead as the picture queue allowed, far more
audio than DQ8 keeps: it holds a quarter second and drops what does not
fit. With an audio track, the demux now stays 150 ms of audio ahead of
what has played, measured in real time rather than in pictures, which
fall behind whenever decoding does.

With both, every chunk the game streams to the IOP during a movie matches
the movie's audio track byte for byte.
---
 ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp | 74 ++++++++++++++++++-----
 1 file changed, 59 insertions(+), 15 deletions(-)

diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
index 573f960cf..35bc9e9f1 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
@@ -527,6 +527,9 @@ namespace ps2_stubs
         constexpr uint64_t kDefaultPictureIntervalQ32 = 2ull * kPictureClockOne;
         constexpr size_t kMpegTimingScanLimit = 4096u;
         constexpr size_t kMaxDecodedPicturesAhead = 8u;
+        // Games size their audio buffers for a demux the IPU pulls along in
+        // real time. DQ8 holds a quarter second and drops what does not fit.
+        constexpr int64_t kMaxAudioLead90k = 90000 * 3 / 20;
 
         // Lookahead is held as compressed elementary stream, not as decoded
         // pictures: a 512x448 frame costs ~917 KB decoded against ~25 KB on the
@@ -584,6 +587,11 @@ namespace ps2_stubs
             uint64_t presentationEndTickQ32 = std::numeric_limits<uint64_t>::max();
             int64_t firstPresentedPts90k = -1;
             uint64_t ptsPresentationBaseTickQ32 = 0u;
+            // How far audio has been handed to the game, against how much of it
+            // has played; see mpegDemuxBackpressured.
+            int64_t firstAudioPts90k = -1;
+            int64_t lastAudioPts90k = -1;
+            std::chrono::steady_clock::time_point firstAudioTime{};
         };
 
         struct MpegStreamCallbackEvent
@@ -1508,6 +1516,15 @@ namespace ps2_stubs
                 {
                     const MpegPesHeader pes = parsePesHeader(buffer.data(), packetEnd);
                     const size_t payloadStart = pes.payloadOffset;
+                    if (pes.pts90k >= 0)
+                    {
+                        if (playback.firstAudioPts90k < 0)
+                        {
+                            playback.firstAudioPts90k = pes.pts90k;
+                            playback.firstAudioTime = std::chrono::steady_clock::now();
+                        }
+                        playback.lastAudioPts90k = pes.pts90k;
+                    }
                     if (payloadStart < packetEnd && payloadStart < playback.pssGuestAddrs.size())
                     {
                         queueStreamCallbackEvent(
@@ -1581,8 +1598,19 @@ namespace ps2_stubs
             // pulled by the consumer, so pictures no longer pile up ahead of it
             // and the old limit would fire on a queue that is nearly always
             // empty.
+            // Audio goes to the game as it is demuxed, so stay a short lead ahead
+            // of what has played, by real time rather than by the pictures,
+            // which fall behind whenever decoding does.
+            bool audioAhead = false;
+            if (playback.firstAudioPts90k >= 0)
+            {
+                const auto elapsed = std::chrono::steady_clock::now() - playback.firstAudioTime;
+                const int64_t played = playback.firstAudioPts90k +
+                    std::chrono::duration_cast<std::chrono::microseconds>(elapsed).count() * 9 / 100;
+                audioAhead = mpegPtsDelta90k(played, playback.lastAudioPts90k) > kMaxAudioLead90k;
+            }
             return !g_mpeg_stub_state.currentCdStreamEofSeen &&
-                   (playback.pendingEsBytes >= mpegMaxPendingEsBytes() ||
+                   (audioAhead || playback.pendingEsBytes >= mpegMaxPendingEsBytes() ||
                     playback.decodedFrames.size() >= kMaxDecodedPicturesAhead);
         }
 
@@ -1752,26 +1780,28 @@ namespace ps2_stubs
             return true;
         }
 
-        void dispatchGuestStreamCallback(uint8_t *rdram,
-                                         R5900Context *callerCtx,
-                                         PS2Runtime *runtime,
-                                         const MpegStreamCallbackEvent &event,
-                                         const MpegRegisteredCallback &callback)
+        bool makeGuestStreamCallback(uint8_t *rdram,
+                                     R5900Context *callerCtx,
+                                     PS2Runtime *runtime,
+                                     const MpegStreamCallbackEvent &event,
+                                     const MpegRegisteredCallback &callback,
+                                     uint32_t stackTop,
+                                     GuestInvocation &invocation)
         {
             if (!rdram || !callerCtx || !runtime || callback.func == 0u || !runtime->hasFunction(callback.func))
             {
-                return;
+                return false;
             }
 
             const uint32_t cbDataAddr = runtime->guestMalloc(kMpegCallbackDataSize, 16u);
             if (cbDataAddr == 0u)
             {
-                return;
+                return false;
             }
             if (!writeMpegCallbackData(rdram, cbDataAddr, event))
             {
                 runtime->guestFree(cbDataAddr);
-                return;
+                return false;
             }
 
             R5900Context callbackCtx = *callerCtx;
@@ -1779,20 +1809,22 @@ namespace ps2_stubs
             SET_GPR_U32(&callbackCtx, 5, cbDataAddr);
             SET_GPR_U32(&callbackCtx, 6, callback.data);
             SET_GPR_U32(&callbackCtx, 7, 0u);
-            SET_GPR_U32(&callbackCtx, 29, 0u);
+            SET_GPR_U32(&callbackCtx, 29, stackTop);
             SET_GPR_U32(&callbackCtx, 31, 0u);
             callbackCtx.pc = callback.func;
 
-            GuestInvocation invocation{};
             invocation.kind = GuestInvocationKind::RpcCallback;
             invocation.context = callbackCtx;
             invocation.onComplete = [runtime, cbDataAddr](const R5900Context &, R5900Context &)
             {
                 runtime->guestFree(cbDataAddr);
             };
-            runtime->eeScheduler().queueInvocation(std::move(invocation));
+            return true;
         }
 
+        // libmpeg calls these inside the demux call, in stream order, while the
+        // ring still holds their data. Queued, they ran after it was released,
+        // and last to first, which shuffled movie audio.
         void dispatchStreamCallbacks(uint8_t *rdram,
                                      R5900Context *ctx,
                                      PS2Runtime *runtime,
@@ -1803,13 +1835,24 @@ namespace ps2_stubs
                 return;
             }
 
+            // One after another, so they can share one stack.
+            const uint32_t stackTop = runtime->eeScheduler().invocationStackTop();
+            std::vector<GuestInvocation> invocations;
             for (const MpegStreamCallbackEvent &event : events)
             {
                 for (const MpegRegisteredCallback &callback : event.callbacks)
                 {
-                    dispatchGuestStreamCallback(rdram, ctx, runtime, event, callback);
+                    GuestInvocation invocation{};
+                    if (makeGuestStreamCallback(rdram, ctx, runtime, event, callback, stackTop, invocation))
+                    {
+                        invocations.push_back(std::move(invocation));
+                    }
                 }
             }
+            if (!invocations.empty())
+            {
+                runtime->eeScheduler().invokeCurrentSequence(std::move(invocations));
+            }
         }
 
         void dispatchStreamCallbacksUnlocked(uint8_t *rdram,
@@ -2328,8 +2371,9 @@ namespace ps2_stubs
             });
         }
 
-        dispatchStreamCallbacksUnlocked(rdram, ctx, runtime, callbackEvents);
+        // The callbacks run before the caller resumes, so set its result first.
         setReturnS32(ctx, static_cast<int32_t>(consumed));
+        dispatchStreamCallbacksUnlocked(rdram, ctx, runtime, callbackEvents);
     }
 
     void sceMpegDemuxPssRing(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)
@@ -2453,8 +2497,8 @@ namespace ps2_stubs
             });
         }
 
-        dispatchStreamCallbacksUnlocked(rdram, ctx, runtime, callbackEvents);
         setReturnS32(ctx, static_cast<int32_t>(consumed));
+        dispatchStreamCallbacksUnlocked(rdram, ctx, runtime, callbackEvents);
     }
 
     void sceMpegDispCenterOffX(uint8_t *rdram, R5900Context *ctx, PS2Runtime *runtime)

From 5ccf82f965beea29e94a63ba6edec0aff100e459 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:32:51 +0200
Subject: [PATCH 58/68] Test the SPU2 input path and the IOP DMA registers

Each case pins something that was wrong at one point while getting DQ8's
drivers to play: AutoDMA blocks out of order across the DMA restarts a
driver makes for every half it refills, a stopped and restarted stream
not starting over, BVOL and AVOL swapped (a core's own input follows
BVOL), and LIBSD's halfword writes to BCR.
---
 ps2xTest/CMakeLists.txt               |   1 +
 ps2xTest/src/main.cpp                 |   2 +
 ps2xTest/src/ps2_native_iop_tests.cpp | 188 ++++++++++++++++++++++++++
 3 files changed, 191 insertions(+)
 create mode 100644 ps2xTest/src/ps2_native_iop_tests.cpp

diff --git a/ps2xTest/CMakeLists.txt b/ps2xTest/CMakeLists.txt
index bd2580b5a..effa5e871 100644
--- a/ps2xTest/CMakeLists.txt
+++ b/ps2xTest/CMakeLists.txt
@@ -57,6 +57,7 @@ add_library(ps2_test_lib STATIC
     src/ps2_vu_tests.cpp
     src/ps2_gs_tests.cpp
     src/ps2_iop_tests.cpp
+    src/ps2_native_iop_tests.cpp
     src/ps2_sif_rpc_tests.cpp
     src/ps2_sif_dma_tests.cpp
     src/ps2_recompiler_tests.cpp
diff --git a/ps2xTest/src/main.cpp b/ps2xTest/src/main.cpp
index 98edd8389..3296c9f83 100644
--- a/ps2xTest/src/main.cpp
+++ b/ps2xTest/src/main.cpp
@@ -16,6 +16,7 @@ void register_ps2_vu1_upper_engine_tests();
 void register_ps2_vu_tests();
 void register_ps2_gs_tests();
 void register_ps2_iop_tests();
+void register_ps2_native_iop_tests();
 void register_ps2_sif_rpc_tests();
 void register_ps2_sif_dma_tests();
 void register_ps2_recompiler_tests();
@@ -40,6 +41,7 @@ int main()
     register_ps2_vu_tests();
     register_ps2_gs_tests();
     register_ps2_iop_tests();
+    register_ps2_native_iop_tests();
     register_ps2_sif_rpc_tests();
     register_ps2_sif_dma_tests();
     register_ps2_recompiler_tests();
diff --git a/ps2xTest/src/ps2_native_iop_tests.cpp b/ps2xTest/src/ps2_native_iop_tests.cpp
new file mode 100644
index 000000000..521aed195
--- /dev/null
+++ b/ps2xTest/src/ps2_native_iop_tests.cpp
@@ -0,0 +1,188 @@
+#include "MiniTest.h"
+#include "../../ps2xIOP/src/lle/iop.h"
+#include "../../ps2xIOP/src/lle/spu2.h"
+
+#include <array>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <deque>
+#include <string>
+#include <vector>
+
+using ps2x::iop::lle::Iop;
+using ps2x::iop::lle::Spu2;
+
+namespace
+{
+    // Hands the SPU2 queued AutoDMA blocks, each one value for 256 left and
+    // 256 right samples, so the output says which block is playing.
+    struct BlockSource final : ps2x::iop::lle::Spu2Host
+    {
+        std::deque<std::array<uint16_t, 512>> blocks;
+
+        void queue(int16_t left)
+        {
+            std::array<uint16_t, 512> block;
+            std::fill(block.begin(), block.begin() + 256, static_cast<uint16_t>(left));
+            std::fill(block.begin() + 256, block.end(), static_cast<uint16_t>(-left));
+            blocks.push_back(block);
+        }
+
+        bool fetchAutoDma(int, uint16_t *block) override
+        {
+            if (blocks.empty())
+                return false;
+            std::memcpy(block, blocks.front().data(), 1024u);
+            blocks.pop_front();
+            return true;
+        }
+
+        void raiseSpuInterrupt() override {}
+    };
+
+    struct NoEe final : ps2x::iop::lle::EeLink
+    {
+        bool readEe(uint32_t, void *, uint32_t) override { return false; }
+        bool writeEe(uint32_t, const void *, uint32_t) override { return false; }
+        bool eeServer(uint32_t) override { return false; }
+        void log(const std::string &) override {}
+    };
+
+    // SPU2 register offsets: core 0's window, then the per-core volumes.
+    constexpr uint32_t kCore1 = 0x400u;
+    constexpr uint32_t kMmix = 0x198u;
+    constexpr uint32_t kAdmas = 0x1B0u;
+    constexpr uint32_t kTsaH = 0x1A8u;
+    constexpr uint32_t kTsaL = 0x1AAu;
+    constexpr uint32_t kVolumes[2] = {0x760u, 0x788u};
+    constexpr uint32_t kMvol = 0x00u;
+    constexpr uint32_t kAvol = 0x08u;
+    constexpr uint32_t kBvol = 0x0Cu;
+
+    void setVolume(Spu2 &spu, int core, uint32_t which, uint16_t value)
+    {
+        spu.write(kVolumes[core] + which, value);
+        spu.write(kVolumes[core] + which + 2u, value);
+    }
+
+    // Core 0's AutoDMA input straight to the output, through core 1's
+    // external input, at close to unity gain throughout.
+    void routeCore0Input(Spu2 &spu, uint16_t inputVolume, uint16_t externalVolume)
+    {
+        spu.write(kMmix, 0x0C0u);          // input dry L/R
+        spu.write(kCore1 + kMmix, 0x00Cu); // external dry L/R
+        setVolume(spu, 0, kMvol, 0x3FFFu);
+        setVolume(spu, 1, kMvol, 0x3FFFu);
+        setVolume(spu, 1, kAvol, 0x7FFFu);
+        setVolume(spu, 0, kBvol, inputVolume);
+        setVolume(spu, 0, kAvol, externalVolume);
+    }
+
+    // Plays count samples and reports whether all of them carry value, give
+    // or take the rounding of four volume stages.
+    bool plays(Spu2 &spu, uint32_t count, int32_t value)
+    {
+        for (uint32_t index = 0u; index < count; ++index)
+        {
+            int16_t left = 0, right = 0;
+            spu.tick(left, right);
+            if (std::abs(left - value) > 8 || std::abs(right + value) > 8)
+                return false;
+        }
+        return true;
+    }
+}
+
+void register_ps2_native_iop_tests()
+{
+    MiniTest::Case("PS2NativeIop", [](TestCase &tc)
+    {
+        tc.Run("AutoDMA input plays its blocks in order across DMA restarts", [](TestCase &t)
+        {
+            BlockSource source;
+            Spu2 spu(source);
+            routeCore0Input(spu, 0x7FFFu, 0u);
+            for (int16_t block = 1; block <= 6; ++block)
+                source.queue(static_cast<int16_t>(block * 3000));
+            spu.write(kAdmas, 1u);
+            t.IsTrue(plays(spu, 256u, 3000), "the first block plays once both halves are primed");
+            t.IsTrue(plays(spu, 44u, 6000), "then the second block");
+            // Drivers restart the channel for every half they refill.
+            spu.dmaStarted(0);
+            t.IsTrue(plays(spu, 212u, 6000), "a DMA restart does not move the input position");
+            t.IsTrue(plays(spu, 256u, 9000), "and the third block follows");
+        });
+
+        tc.Run("AutoDMA starts over from a fresh stream after it was stopped", [](TestCase &t)
+        {
+            BlockSource source;
+            Spu2 spu(source);
+            routeCore0Input(spu, 0x7FFFu, 0u);
+            for (int16_t block = 1; block <= 4; ++block)
+                source.queue(static_cast<int16_t>(block * 3000));
+            spu.write(kAdmas, 1u);
+            t.IsTrue(plays(spu, 256u, 3000) && plays(spu, 44u, 6000), "the first stream is playing");
+            spu.write(kAdmas, 0u);
+            t.IsTrue(plays(spu, 64u, 0), "a stopped core has no input");
+            source.blocks.clear();
+            source.queue(-20000);
+            source.queue(-24000);
+            spu.write(kAdmas, 1u);
+            t.IsTrue(plays(spu, 256u, -20000), "the new stream plays from its first block");
+            t.IsTrue(plays(spu, 256u, -24000), "and its second");
+        });
+
+        tc.Run("BVOL scales a core's own input and AVOL does not", [](TestCase &t)
+        {
+            for (bool input : {false, true})
+            {
+                BlockSource source;
+                Spu2 spu(source);
+                routeCore0Input(spu, input ? 0x7FFFu : 0u, input ? 0u : 0x7FFFu);
+                source.queue(12000);
+                source.queue(12000);
+                spu.write(kAdmas, 1u);
+                t.IsTrue(plays(spu, 256u, input ? 12000 : 0),
+                         input ? "BVOL lets the input through" : "AVOL alone leaves the input silent");
+            }
+        });
+
+        tc.Run("DMA registers take the halfword writes LIBSD makes", [](TestCase &t)
+        {
+            NoEe ee;
+            Iop iop(ee);
+            for (uint32_t base : {0x1F8010C0u, 0x1F801500u})
+            {
+                iop.ioWrite(base + 4u, 0x0010u, 2u);
+                iop.ioWrite(base + 6u, 0x0004u, 2u);
+                t.Equals(iop.ioRead(base + 4u, 4u), 0x00040010u, "block size and count combine in BCR");
+                t.Equals(iop.ioRead(base + 6u, 2u), 0x0004u, "and read back by halves");
+            }
+        });
+
+        tc.Run("a manual DMA moves data into sound memory and back", [](TestCase &t)
+        {
+            NoEe ee;
+            Iop iop(ee);
+            std::vector<uint8_t> sent(64u), received(64u, 0u);
+            for (size_t index = 0; index < sent.size(); ++index)
+                sent[index] = static_cast<uint8_t>(index * 7u + 3u);
+            iop.writeMemory(0x20000u, sent.data(), 64u);
+            const auto transfer = [&](uint32_t address, uint32_t chcr)
+            {
+                iop.ioWrite(0x1F900000u + kTsaH, 0u, 2u);
+                iop.ioWrite(0x1F900000u + kTsaL, 0x3000u, 2u);
+                iop.ioWrite(0x1F8010C0u, address, 4u);
+                iop.ioWrite(0x1F8010C4u, 16u, 2u);
+                iop.ioWrite(0x1F8010C6u, 1u, 2u);
+                iop.ioWrite(0x1F8010C8u, chcr, 4u);
+            };
+            transfer(0x20000u, 0x01000201u);
+            transfer(0x30000u, 0x01000200u);
+            iop.readMemory(0x30000u, received.data(), 64u);
+            t.IsTrue(received == sent, "64 bytes written at TSA come back unchanged");
+            t.Equals(iop.ioRead(0x1F8010C8u, 4u) & 0x01000000u, 0u, "the channel is idle again");
+        });
+    });
+}

From 8220b4afcf090dac6dbc2e695716a3c45088eb91 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:32:51 +0200
Subject: [PATCH 59/68] Document native IRX modules in the IOP readme

---
 ps2xIOP/README.md | 71 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 68 insertions(+), 3 deletions(-)

diff --git a/ps2xIOP/README.md b/ps2xIOP/README.md
index 4538f5091..f45377c1b 100644
--- a/ps2xIOP/README.md
+++ b/ps2xIOP/README.md
@@ -4,9 +4,11 @@
 `ps2xRuntime`. It implements the behavior that games expect from IOP services
 exposed through SIF RPC and DMA.
 
-This subsystem does not emulate the IOP's R3000A CPU and does not load or
-execute IRX binaries. Its scope is the RPC/DMA behavior needed by recompiled
-games.
+The services below do not emulate the IOP's R3000A CPU and do not load or
+execute IRX binaries. Their scope is the RPC/DMA behavior needed by recompiled
+games. A runtime can additionally run a game's own modules on a small emulated
+IOP, which is how sound drivers are handled; see
+[Native IRX modules](#native-irx-modules).
 
 > [!IMPORTANT]
 > `ps2_iop`/`ps2x::iop` is a C++20 static library linked into the runtime.
@@ -121,6 +123,69 @@ services, and every active service receives each SIF transfer notification.
 Implementations must filter the relevant SID/function or transfer
 kind/phase/address range themselves.
 
+## Native IRX modules
+
+Some drivers are easier to run than to rewrite. A sound driver is the usual
+case: its RPC protocol is the only part the EE sees, but what the game hears
+comes from years of tuning in how it drives the SPU2. `NativeIop`
+([`native_iop.h`](include/ps2x/iop/native_iop.h)) loads a game's own IRX files
+onto an emulated IOP and lets their RPC servers answer the game directly.
+
+The emulator under [`src/lle/`](src/lle) is only as large as sound drivers
+need:
+
+| File | Contents |
+| --- | --- |
+| `cpu.*` | R3000A interpreter, with load delay slots and no caches or MMU |
+| `irx.*` | IRX parsing, relocation and import stub discovery |
+| `kernel.cpp` | High-level kernel: threads, semaphores, event flags, mailboxes, alarms, hardware timers, interrupts, the IOP heap, SIF DMA and RPC, and the sysclib calls the drivers use |
+| `spu2.*` | Both SPU2 cores: 48 ADPCM voices with ADSR, noise, pitch modulation, reverb, AutoDMA input and 2 MiB of sound memory |
+| `iop.*` | The pieces together: memory map, DMA channels 4 and 7, interrupts and the clock |
+
+An import the kernel does not provide returns zero, and an instruction the CPU
+does not implement stops its thread with a log message. Both mean a driver
+needs more than has been written so far.
+
+### Timing
+
+IOP time is counted at 36.864 MHz and advances only as the SPU2 produces
+samples, 768 cycles for each 48 kHz stereo pair. The host audio callback calls
+`render()`, so the IOP runs in step with the audio device rather than with the
+EE. Work that answers an RPC runs without moving the clock, until every thread
+is waiting again, and so do interrupt, alarm and timer handlers. Charging that
+work to the clock let heavy RPC traffic push the drivers' timers ahead of the
+audio, and music played fast.
+
+With no audio device, or while it is paused, an RPC that waits on IOP time
+steps the IOP itself and discards the samples. A call that still cannot finish
+gives up after two seconds and logs a warning.
+
+### Hooking it up
+
+The runtime names the modules to run natively before the game starts. The
+native path then takes over in three places:
+
+- `sceSifLoadModule` of a named module also loads it on the emulated IOP. The
+  high-level module tracker still hands out the id the game sees.
+- `IopSubsystem::handleRpc` gives an RPC to a server a native module
+  registered before any high-level service with the same SID.
+- IOP heap allocation and EE-to-IOP `sceSifSetDma` use the emulated IOP's
+  memory, since native modules read what the game sends them from there.
+
+IOP modules that bind back to an EE server, like SDRDRV's callback thread,
+wait until the EE has registered it (`IopHost::hasGuestRpcServer`). Answering
+the bind early left the thread spinning and starved the rest of the driver.
+
+On the runtime side, [`ps2_native_iop.h`](../ps2xRuntime/include/runtime/ps2_native_iop.h)
+takes the module list, opens a 48 kHz stereo stream once the first module
+loads, and sets the volume. Volume zero keeps the stream running: games wait
+on their sound drivers, so the IOP has to keep going even when nothing is
+heard. `PS2X_AUDIO_DUMP=path` keeps a raw copy of everything played
+(48 kHz, stereo, signed 16-bit) for comparing against a reference offline.
+
+The SPU2 input path and the DMA registers have tests in
+[`ps2_native_iop_tests.cpp`](../ps2xTest/src/ps2_native_iop_tests.cpp).
+
 ## Linking the static library 
 
 ```cmake

From 97d1214423038ca05bdc74d5993f19c3ac9a6d9f Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:32:52 +0200
Subject: [PATCH 60/68] Compile whole VU1 microprograms ahead of time

The block compiler covers regions of up to 16 pairs and some short
loops; everything between them runs on the interpreter a pair at a
time. In DQ8's field that per-pair work was most of what VU1 cost, and
VU1 was most of what the game thread cost.

This compiles programs whole, from the MSCAL entry to the E bit, out of
microcode recorded while the game runs (PS2_VU_PROGRAM_PROFILE). A
routine is the code reachable from one entry through branches; calls
and register jumps end it and their targets become routines of their
own. Routines are found at run time by PC and checked word for word
against VU memory, so microcode that changed falls back to the
interpreter.

Pairs still issue in order under the interpreter's stall rules. What
changes is where the work is done:

- Each pair's registers, latencies and hazards are decoded at compile
  time, and reads that can no longer stall, given the pairs before them
  in the block, are dropped from the readiness check.
- Results are written at issue and only their ready cycles are kept.
  MAC, status and clip results wait in a small queue that is folded when
  something reads them rather than every cycle.
- The clock, the flag queue and the kick state are locals, so they stay
  in registers. Whatever is still in flight when a routine returns goes
  back into the interpreter's pipelines, and a later pair or flush sees
  what it would have seen.
- On AArch64 the common FMAC cases use NEON, with range checks that send
  anything unusual to the interpreter's arithmetic. MAX, MINI, ITOF,
  FTOI, ABS and CLIP have small forms of their own everywhere: inlining
  the interpreter's whole upper switch into every pair made a routine
  take minutes to compile.

A routine only starts with at least 4096 cycles of budget. It hands back
at a block boundary when the budget would run out, or at a pair it
cannot compile.

On 768 programs captured in the field, the routines leave the same
state, VU memory and GIF packets as the interpreter at every budget the
replay checks, and run about 9 times faster on an M1 Pro (5 times on the
portable path). Compiling all of DQ8's recorded routines takes under ten
seconds. In the opening field this took the game from about 15 to about
22 completed frames per second, after which the renderer was the limit.
---
 ps2xRuntime/CMakeLists.txt                 |   41 +
 ps2xRuntime/include/runtime/ps2_vu1.h      |    8 +
 ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp    |   16 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_program.cpp |  427 ++++++
 ps2xRuntime/src/lib/vu/ps2_vu1_program.h   | 1458 ++++++++++++++++++++
 tools/compile_vu_programs.py               |  440 ++++++
 6 files changed, 2389 insertions(+), 1 deletion(-)
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_program.cpp
 create mode 100644 ps2xRuntime/src/lib/vu/ps2_vu1_program.h
 create mode 100644 tools/compile_vu_programs.py

diff --git a/ps2xRuntime/CMakeLists.txt b/ps2xRuntime/CMakeLists.txt
index 6ab002c04..9e87eb01e 100644
--- a/ps2xRuntime/CMakeLists.txt
+++ b/ps2xRuntime/CMakeLists.txt
@@ -395,6 +395,7 @@ add_library(ps2_runtime STATIC
     src/lib/vu/ps2_vu1_pipeline.cpp
     src/lib/vu/ps2_vu1_capture.cpp
     src/lib/vu/ps2_vu1_cache.cpp
+    src/lib/vu/ps2_vu1_program.cpp
     src/lib/games_database.cpp
 )
 
@@ -460,6 +461,46 @@ if(PS2X_VU_AOT_IMAGES OR PS2X_VU_AOT_PAIR_IMAGES OR PS2X_VU_AOT_LOOP_IMAGES)
     endif()
 endif()
 
+# Whole VU1 routines, compiled from PS2_VU_PROGRAM_PROFILE recordings.
+set(PS2X_VU_PROGRAM_PROFILES "" CACHE STRING "Local VU1 program profile directories to compile; never distributed")
+set(PS2X_VU_PROGRAM_SHARDS "8" CACHE STRING "Number of compilation units for compiled VU1 routines")
+if(PS2X_VU_PROGRAM_PROFILES)
+    find_package(Python3 COMPONENTS Interpreter REQUIRED)
+    if(NOT PS2X_VU_PROGRAM_SHARDS MATCHES "^[1-9][0-9]*$")
+        message(FATAL_ERROR "PS2X_VU_PROGRAM_SHARDS must be a positive integer")
+    endif()
+    set(PS2X_VU_PROGRAM_INCLUDE "${CMAKE_CURRENT_BINARY_DIR}/generated/vu_programs.inc")
+    set(PS2X_VU_PROGRAM_EXTERN_INCLUDE "${CMAKE_CURRENT_BINARY_DIR}/generated/vu_programs_extern.inc")
+    set(PS2X_VU_PROGRAM_SOURCES)
+    math(EXPR PS2X_VU_PROGRAM_LAST_SHARD "${PS2X_VU_PROGRAM_SHARDS} - 1")
+    foreach(SHARD RANGE ${PS2X_VU_PROGRAM_LAST_SHARD})
+        list(APPEND PS2X_VU_PROGRAM_SOURCES "${CMAKE_CURRENT_BINARY_DIR}/generated/vu_programs_${SHARD}.cpp")
+    endforeach()
+    set(PS2X_VU_PROGRAM_LISTS)
+    foreach(PROFILE ${PS2X_VU_PROGRAM_PROFILES})
+        list(APPEND PS2X_VU_PROGRAM_LISTS "${PROFILE}/entries.txt")
+    endforeach()
+    add_custom_command(
+        OUTPUT "${PS2X_VU_PROGRAM_INCLUDE}" "${PS2X_VU_PROGRAM_EXTERN_INCLUDE}" ${PS2X_VU_PROGRAM_SOURCES}
+        COMMAND "${Python3_EXECUTABLE}" "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_programs.py"
+                --output "${PS2X_VU_PROGRAM_INCLUDE}" --shards ${PS2X_VU_PROGRAM_SHARDS}
+                ${PS2X_VU_PROGRAM_PROFILES}
+        DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/../tools/compile_vu_programs.py" ${PS2X_VU_PROGRAM_LISTS}
+        VERBATIM)
+    add_custom_target(ps2_vu_programs DEPENDS "${PS2X_VU_PROGRAM_INCLUDE}"
+                      "${PS2X_VU_PROGRAM_EXTERN_INCLUDE}" ${PS2X_VU_PROGRAM_SOURCES})
+    add_dependencies(ps2_runtime ps2_vu_programs)
+    target_sources(ps2_runtime PRIVATE ${PS2X_VU_PROGRAM_SOURCES})
+    set_source_files_properties(src/lib/vu/ps2_vu1_program.cpp PROPERTIES COMPILE_DEFINITIONS
+        "PS2X_VU_PROGRAM_INCLUDE=\"${PS2X_VU_PROGRAM_INCLUDE}\";PS2X_VU_PROGRAM_EXTERN_INCLUDE=\"${PS2X_VU_PROGRAM_EXTERN_INCLUDE}\"")
+    set_source_files_properties(${PS2X_VU_PROGRAM_SOURCES} PROPERTIES
+        SKIP_UNITY_BUILD_INCLUSION ON
+        INCLUDE_DIRECTORIES "${CMAKE_CURRENT_SOURCE_DIR}/src/lib/vu")
+    if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+        set_source_files_properties(${PS2X_VU_PROGRAM_SOURCES} PROPERTIES COMPILE_OPTIONS "-g0")
+    endif()
+endif()
+
 if(PS2X_ENABLE_RUNTIME_LOGS)
     target_compile_definitions(ps2_runtime PUBLIC
         PS2_RUNTIME_LOGS=1
diff --git a/ps2xRuntime/include/runtime/ps2_vu1.h b/ps2xRuntime/include/runtime/ps2_vu1.h
index a7c089cd2..b32db25ea 100644
--- a/ps2xRuntime/include/runtime/ps2_vu1.h
+++ b/ps2xRuntime/include/runtime/ps2_vu1.h
@@ -7,6 +7,11 @@
 class GS;
 class PS2Memory;
 
+namespace ps2_vu_program
+{
+    struct Access;
+}
+
 struct VU1State
 {
     float vf[32][4];
@@ -67,6 +72,9 @@ class VU1Interpreter
     uint64_t interpretedPairsExecuted() const { return m_interpretedPairsExecuted; }
 
 private:
+    // Whole-program compiled code reads and publishes interpreter state.
+    friend struct ps2_vu_program::Access;
+
     enum Pipeline : uint8_t
     {
         PipelineNone = 0,
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
index aaa219e61..5f1f9baa7 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_core.cpp
@@ -1,4 +1,5 @@
 #include "ps2_vu1_exec.inl"
+#include "ps2_vu1_program.h"
 #include "runtime/ps2_vu1.h"
 #include "runtime/gs/ps2_gif_arbiter.h"
 #include "runtime/gs/gs_frontend.h"
@@ -91,6 +92,9 @@ void VU1Interpreter::reset()
     m_state.r = 0x3F800000u;
     m_cycle = 0;
     resetScheduler();
+    // VU0 resets for every micro call; VU1 only at startup, and in tests.
+    if (m_unit == Unit::VU1)
+        ps2_vu_program::forgetRoutines();
 }
 
 void VU1Interpreter::progressXgkick()
@@ -392,7 +396,17 @@ void VU1Interpreter::run(uint8_t *vuCode, uint32_t codeSize,
         rebuildDecodedCodeCache(vuCode, codeSize, memory,
             m_unit == Unit::VU1 ? memory->getVU1CodeGeneration() : memory->getVU0CodeGeneration());
     commitReadyPipelines();
-    while (m_cycle < budgetEnd && !m_stopRequested)
+    // A drained VU1 at the entry of a compiled program runs it whole.
+    if (trackedCode && m_unit == Unit::VU1 && m_useCompiledExecution &&
+        budgetEnd - m_cycle >= ps2_vu_program::kMinimumBudget && ps2_vu_program::Access::drained(*this))
+    {
+        const uint64_t generation = memory->getVU1CodeGeneration();
+        if (const auto routine = ps2_vu_program::find(vuCode, codeSize, m_state.pc, generation))
+            programEnded = ps2_vu_program::run(*this, vuCode, codeSize, budgetEnd, routine);
+        else
+            ps2_vu_program::recordMissing(vuCode, codeSize, m_state.pc);
+    }
+    while (!programEnded && m_cycle < budgetEnd && !m_stopRequested)
     {
         // advanceOneCycle already committed this boundary, including stalls.
         if (m_state.pc + 8u > codeSize)
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_program.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_program.cpp
new file mode 100644
index 000000000..59d3cea17
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_program.cpp
@@ -0,0 +1,427 @@
+#include "ps2_vu1_program.h"
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <mutex>
+#include <set>
+#include <string>
+#include <utility>
+
+#ifdef PS2X_VU_PROGRAM_EXTERN_INCLUDE
+#include PS2X_VU_PROGRAM_EXTERN_INCLUDE
+#endif
+
+namespace ps2_vu_program
+{
+namespace
+{
+// Sorted by entry PC; the last element only terminates the table.
+const Entry kEntries[] = {
+#ifdef PS2X_VU_PROGRAM_INCLUDE
+#include PS2X_VU_PROGRAM_INCLUDE
+#endif
+    {0xFFFFFFFFu, 0u, nullptr, nullptr, nullptr},
+};
+
+bool matches(const Entry &entry, const uint8_t *code, uint32_t codeSize)
+{
+    for (uint32_t index = 0; index < entry.footprintPairs; ++index)
+    {
+        const uint32_t offset = static_cast<uint32_t>(entry.footprint[index]) * 8u;
+        uint64_t word;
+        if (offset + 8u > codeSize)
+            return false;
+        std::memcpy(&word, code + offset, sizeof(word));
+        if (word != entry.words[index])
+            return false;
+    }
+    return true;
+}
+
+struct CacheSlot
+{
+    const uint8_t *code = nullptr;
+    uint64_t generation = 0u;
+    uint64_t epoch = 0u;
+    Routine run = nullptr;
+    bool valid = false;
+};
+
+std::atomic<uint64_t> g_epoch{0u};
+}
+
+void forgetRoutines()
+{
+    g_epoch.fetch_add(1u, std::memory_order_relaxed);
+}
+
+Routine find(const uint8_t *code, uint32_t codeSize, uint32_t pc, uint64_t generation)
+{
+    // Microcode changes far less often than routines are entered, so each
+    // answer stands until the code generation moves on.
+    thread_local std::array<CacheSlot, 2048> cache{};
+    CacheSlot &slot = cache[(pc / 8u) & 2047u];
+    const uint64_t epoch = g_epoch.load(std::memory_order_relaxed);
+    if (slot.valid && slot.code == code && slot.generation == generation && slot.epoch == epoch)
+        return slot.run;
+
+    Routine routine = nullptr;
+    const Entry *const begin = std::begin(kEntries);
+    const Entry *const end = std::end(kEntries) - 1;
+    const Entry *entry = std::lower_bound(begin, end, pc,
+                                          [](const Entry &candidate, uint32_t value) { return candidate.pc < value; });
+    for (; entry != end && entry->pc == pc; ++entry)
+    {
+        if (matches(*entry, code, codeSize))
+        {
+            routine = entry->run;
+            break;
+        }
+    }
+    slot = {code, generation, epoch, routine, true};
+    return routine;
+}
+
+void recordMissing(const uint8_t *code, uint32_t codeSize, uint32_t pc)
+{
+    static const char *directory = std::getenv("PS2_VU_PROGRAM_PROFILE");
+    if (!directory || !*directory)
+        return;
+    static std::mutex mutex;
+    const std::lock_guard lock(mutex);
+    static std::set<std::pair<uint64_t, uint32_t>> recorded;
+    uint64_t hash = 14695981039346656037ull;
+    for (uint32_t i = 0; i < codeSize; ++i)
+        hash = (hash ^ code[i]) * 1099511628211ull;
+    if (!recorded.emplace(hash, pc).second)
+        return;
+    char name[20];
+    std::snprintf(name, sizeof(name), "%016llx", static_cast<unsigned long long>(hash));
+    const std::filesystem::path root(directory);
+    const std::filesystem::path image = root / (std::string("vu1-") + name + ".code");
+    std::error_code error;
+    std::filesystem::create_directories(root, error);
+    if (!std::filesystem::exists(image, error))
+        std::ofstream(image, std::ios::binary).write(reinterpret_cast<const char *>(code), codeSize);
+    std::ofstream(root / "entries.txt", std::ios::app) << name << ' ' << std::hex << pc << '\n';
+}
+
+void Access::pendVf(VU1Interpreter &vu, uint8_t reg, uint8_t lanes, uint64_t ready)
+{
+    auto *slot = ps2_vu_detail::allocateScheduledEntry(vu.m_vfWritePipeline, vu.m_activeVfWrites, ready);
+    if (!slot)
+        return;
+    *slot = {};
+    slot->valid = true;
+    slot->readyCycle = ready;
+    slot->sequence = ++vu.m_nextWriteSequence;
+    slot->reg = reg;
+    slot->laneMask = lanes;
+    std::memcpy(slot->value.data(), vu.m_state.vf[reg], sizeof(slot->value));
+    for (uint32_t component = 0; component < 4u; ++component)
+        if ((lanes & lane(component)) != 0u)
+        {
+            vu.m_vfLatestWrite[reg][component] = slot->sequence;
+            vu.m_vfReady[reg][component] = ready;
+        }
+}
+
+void Access::pendVi(VU1Interpreter &vu, uint8_t reg, uint64_t ready)
+{
+    auto *slot = ps2_vu_detail::allocateScheduledEntry(vu.m_viWritePipeline, vu.m_activeViWrites, ready);
+    if (!slot)
+        return;
+    *slot = {};
+    slot->valid = true;
+    slot->readyCycle = ready;
+    slot->sequence = ++vu.m_nextWriteSequence;
+    slot->reg = reg;
+    slot->value = vu.m_state.vi[reg];
+    vu.m_viLatestWrite[reg] = slot->sequence;
+    vu.m_viReady[reg] = ready;
+}
+
+void Access::pendFlags(VU1Interpreter &vu, uint64_t issue, uint32_t mac, uint32_t status,
+                       uint32_t sticky, uint32_t clip, uint8_t writes)
+{
+    const uint64_t ready = issue + VU1Interpreter::kFmacLatency;
+    auto *slot = ps2_vu_detail::allocateScheduledEntry(vu.m_flagPipeline, vu.m_activeFlags, ready);
+    if (!slot)
+        return;
+    *slot = {};
+    slot->valid = true;
+    slot->issueCycle = issue;
+    slot->readyCycle = ready;
+    slot->mac = mac;
+    slot->status = status;
+    slot->extraSticky = sticky;
+    slot->clip = clip;
+    slot->writesMac = (writes & 1u) != 0u;
+    slot->writesStatus = (writes & 2u) != 0u;
+    slot->writesSticky = (writes & 4u) != 0u;
+    slot->writesClip = (writes & 8u) != 0u;
+}
+
+void Access::finish(VU1Interpreter &vu, uint64_t cycle, uint32_t workingClip, uint8_t backupReg,
+                    int32_t backupValue, uint64_t pairs)
+{
+    vu.m_cycle = cycle;
+    vu.m_state.cycles = cycle;
+    vu.m_workingClip = workingClip;
+    vu.m_viBranchBackupValid = backupReg != 0u;
+    vu.m_viBranchBackupReg = backupReg;
+    vu.m_viBranchBackupValue = backupValue;
+    vu.m_compiledPairsExecuted += pairs;
+}
+
+Run::Run(VU1Interpreter &vu)
+    : m_vu(vu), m_state(Access::state(vu)), m_data(Access::data(vu)),
+      m_base(Access::cycle(vu)), m_generation(Access::codeGeneration(vu))
+{
+    // Drained on entry, so every ready cycle is now.
+    m_backupValue = Access::branchBackup(vu, m_backupReg);
+    m_workingClip = Access::workingClip(vu);
+}
+
+void Run::exactUpper(uint32_t upper)
+{
+    const uint32_t fs = (upper >> 11u) & 31u, ft = (upper >> 16u) & 31u;
+    const UpperInputs inputs{m_state.vf[fs], m_state.vf[ft], m_state.acc, m_state.i, m_state.q};
+    m_upper = {};
+    ps2_vu_detail::upper::computeUpper(upper, inputs, m_upper);
+}
+
+bool Run::progressKick(uint32_t cycle, uint32_t nextPc)
+{
+    // A GIF callback sees the PC and clock the interpreter would show here.
+    m_state.pc = nextPc;
+    m_state.cycles = m_base + cycle;
+    Access::progressXgkick(m_vu);
+    if (Access::xgkickActive(m_vu))
+        return true;
+    if (Access::codeGeneration(m_vu) != m_generation)
+        m_stale = true;
+    return false;
+}
+
+Run::Clock Run::stall(uint32_t cycle, uint32_t target, uint32_t pc, bool untilIdle)
+{
+    bool kicking = true;
+    while (cycle < target || (untilIdle && kicking))
+    {
+        ++cycle;
+        if (kicking)
+            kicking = progressKick(cycle, pc);
+    }
+    return {cycle, kicking};
+}
+
+Run::PendingFlags *Run::commitFlags(PendingFlags *head, PendingFlags *tail, uint32_t upTo)
+{
+    // Results queue in issue order, so the due ones come first and only the
+    // last few cycles' can still be waiting.
+    PendingFlags *end = tail;
+    while (end != head && end[-1].issue + 4u > upTo)
+        --end;
+    if (end == head)
+        return head;
+
+    // Usually every one is an FMAC result: the last sets MAC and the current
+    // status bits, and all of them add to the sticky bits. That loop vectorizes.
+    uint32_t conditions = 0u, other = 0u;
+    for (const PendingFlags *entry = head; entry != end; ++entry)
+    {
+        conditions |= entry->value | entry->sticky;
+        other |= entry->writes ^ 3u;
+    }
+    if (other == 0u)
+    {
+        const uint32_t now = statusOf(end[-1].value);
+        m_state.mac = end[-1].value;
+        m_state.status = (m_state.status & 0xFF0u) | now | ((now | statusOf(conditions)) << 6u);
+        return end;
+    }
+
+    // MAC and CLIP keep the last result; the sticky bits collect every FMAC
+    // result until an FSSET, so status is folded once per run of those.
+    uint32_t mac = m_state.mac, status = m_state.status, clip = m_state.clip;
+    uint32_t current = 0u;
+    conditions = 0u;
+    bool pending = false;
+    const auto fold = [&] {
+        const uint32_t now = statusOf(current);
+        status = (status & 0xFF0u) | now | ((now | statusOf(conditions)) << 6u);
+        conditions = 0u;
+        pending = false;
+    };
+    for (; head != end; ++head)
+    {
+        const PendingFlags &entry = *head;
+        if ((entry.writes & 1u) != 0u)
+            mac = entry.value;
+        if ((entry.writes & 2u) != 0u)
+        {
+            current = entry.value;
+            conditions |= entry.value | entry.sticky;
+            pending = true;
+        }
+        if ((entry.writes & 4u) != 0u)
+        {
+            if (pending)
+                fold();
+            status = (status & 0x03Fu) | (entry.value & 0xFC0u);
+            --m_fssetQueued;
+        }
+        if ((entry.writes & 8u) != 0u)
+            clip = entry.value;
+    }
+    if (pending)
+        fold();
+    m_state.mac = mac;
+    m_state.status = status;
+    m_state.clip = clip;
+    return head;
+}
+
+Run::FlagRange Run::makeRoom(PendingFlags *head, PendingFlags *tail, uint32_t cycle)
+{
+    // Only results from the last four cycles can still be pending.
+    head = commitFlags(head, tail, cycle);
+    const std::ptrdiff_t pending = tail - head;
+    std::memmove(m_flags.data(), head, static_cast<size_t>(pending) * sizeof(PendingFlags));
+    return {m_flags.data(), m_flags.data() + pending};
+}
+
+void Run::cancelSameCycle(PendingFlags *head, PendingFlags *tail, uint32_t cycle, uint32_t writes)
+{
+    // A later FSSET or FCSET in the same pair overrides that pair's result.
+    for (; head != tail; ++head)
+        if (head->issue == cycle)
+            head->writes &= ~writes;
+}
+
+Run::PendingFlags *Run::commitQ(PendingFlags *head, PendingFlags *tail, uint32_t cycle)
+{
+    // Q and its D/I bits land after any flag result due in the same cycle.
+    // FMAC results touch other status bits, so only an FSSET, which rewrites
+    // the sticky D and I bits, has to be committed first.
+    auto &fdiv = Access::fdiv(m_vu);
+    if (!fdiv.valid || relative(fdiv.readyCycle) > cycle)
+        return head;
+    if (m_fssetQueued != 0u)
+        head = commitFlags(head, tail, relative(fdiv.readyCycle));
+    m_state.q = fdiv.value;
+    const uint32_t currentDi = fdiv.statusDi & 0x30u;
+    m_state.status = (m_state.status & 0xFCFu) | currentDi | (currentDi << 6u);
+    fdiv = {};
+    return head;
+}
+
+void Run::commitP(uint32_t cycle)
+{
+    // Oldest first. A slot freed early takes the next result, so after three
+    // EFU operations in a row slot order is no longer issue order.
+    auto &efu = Access::efu(m_vu);
+    const bool swap = efu[0].valid && efu[1].valid && efu[1].readyCycle < efu[0].readyCycle;
+    for (auto *entry : {&efu[swap ? 1 : 0], &efu[swap ? 0 : 1]})
+        if (entry->valid && relative(entry->readyCycle) <= cycle)
+        {
+            m_state.p = entry->value;
+            *entry = {};
+        }
+}
+
+void Run::handBack()
+{
+    m_flagHead = commitQ(m_flagHead, m_flagTail, m_cycle);
+    commitP(m_cycle);
+    m_flagHead = commitFlags(m_flagHead, m_flagTail, m_cycle);
+    for (const PendingFlags *pending = m_flagHead; pending != m_flagTail; ++pending)
+    {
+        // Back into the interpreter's form: status bits and product conditions folded.
+        const PendingFlags &entry = *pending;
+        const bool fmac = (entry.writes & 3u) != 0u;
+        const uint32_t status = fmac ? statusOf(entry.value) : (entry.writes & 4u) != 0u ? entry.value : 0u;
+        Access::pendFlags(m_vu, m_base + entry.issue, fmac ? entry.value : 0u, status,
+                          fmac ? statusOf(entry.sticky) : 0u, (entry.writes & 8u) != 0u ? entry.value : 0u,
+                          static_cast<uint8_t>(entry.writes));
+    }
+    for (uint8_t reg = 1u; reg < 32u; ++reg)
+    {
+        // Lanes written by one pair share a result cycle and an entry.
+        uint8_t done = 0u;
+        for (uint32_t component = 0; component < 4u; ++component)
+        {
+            const uint32_t ready = m_vfReady[reg][component];
+            if (ready <= m_cycle || (done & lane(component)) != 0u)
+                continue;
+            uint8_t lanes = 0u;
+            for (uint32_t other = component; other < 4u; ++other)
+                if (m_vfReady[reg][other] == ready)
+                    lanes |= lane(other);
+            done |= lanes;
+            Access::pendVf(m_vu, reg, lanes, m_base + ready);
+        }
+    }
+    for (uint8_t reg = 1u; reg < 16u; ++reg)
+        if (m_viReady[reg] > m_cycle)
+            Access::pendVi(m_vu, reg, m_base + m_viReady[reg]);
+    Access::finish(m_vu, m_base + m_cycle, m_workingClip, static_cast<uint8_t>(m_backupReg), m_backupValue,
+                   m_pairs);
+}
+
+uint32_t Run::leave(uint32_t pc)
+{
+    m_state.pc = pc;
+    handBack();
+    m_finished = true;
+    return pc;
+}
+
+uint32_t Run::leaveStale()
+{
+    // A branch or E bit issued by the last pair still takes effect after its delay slot.
+    m_state.pc = m_stalePc;
+    m_state.branchPending = m_staleBranch;
+    if (m_staleBranch)
+        m_state.branchTarget = m_staleTarget;
+    m_state.branchDelay = 0u;
+    m_state.ebit = m_staleEnding;
+    handBack();
+    m_finished = true;
+    return m_stalePc;
+}
+
+uint32_t Run::end(uint32_t pc)
+{
+    m_state.pc = pc;
+    handBack();
+    m_finished = m_ended = true;
+    return pc;
+}
+
+bool run(VU1Interpreter &vu, const uint8_t *code, uint32_t codeSize, uint64_t budgetEnd, Routine routine)
+{
+    Run program(vu);
+    for (;;)
+    {
+        const uint32_t pc = routine(program, budgetEnd);
+        if (program.finished())
+            return program.ended();
+        routine = find(code, codeSize, pc, program.generation());
+        if (!routine)
+        {
+            recordMissing(code, codeSize, pc);
+            program.leave(pc);
+            return false;
+        }
+    }
+}
+}
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_program.h b/ps2xRuntime/src/lib/vu/ps2_vu1_program.h
new file mode 100644
index 000000000..45c5266d9
--- /dev/null
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_program.h
@@ -0,0 +1,1458 @@
+#ifndef PS2_VU1_PROGRAM_H
+#define PS2_VU1_PROGRAM_H
+
+// VU1 programs compiled whole, MSCAL entry to E bit: pairs issue in order under
+// the interpreter's stall rules, results land at issue, and whatever is still
+// in flight on return goes back into the interpreter's pipelines.
+
+#include "ps2_vu1_exec.inl"
+
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cmath>
+#include <cstdint>
+#include <cstring>
+#include <limits>
+#include <utility>
+
+// NEON fast paths. Defining PS2X_VU_PROGRAM_PORTABLE runs the path other
+// hosts take, so it can be tested on an ARM machine.
+#if defined(__aarch64__) && !defined(PS2X_VU_PROGRAM_PORTABLE)
+#define PS2_VU_PROGRAM_NEON 1
+#include <arm_neon.h>
+#else
+#define PS2_VU_PROGRAM_NEON 0
+#endif
+
+namespace ps2_vu_program
+{
+using Unit = VU1Interpreter::Unit;
+class Run;
+
+// A routine is the code reachable from one entry without following calls or
+// register jumps. It returns the PC to continue at; the driver finds the
+// routine for that PC or hands the rest back to the interpreter.
+using Routine = uint32_t (*)(Run &, uint64_t budgetEnd);
+
+struct Entry
+{
+    uint32_t pc;
+    uint32_t footprintPairs;
+    const uint16_t *footprint; // pair indices the routine was built from
+    const uint64_t *words;     // their instruction words, in the same order
+    Routine run;
+};
+
+// Programs are entered only when the budget clearly outlasts them, so a
+// cycle budget does not end one part-way in ordinary use.
+inline constexpr uint64_t kMinimumBudget = 4096u;
+
+Routine find(const uint8_t *code, uint32_t codeSize, uint32_t pc, uint64_t generation);
+
+// find() remembers its answers by code address and generation, which a new
+// interpreter or memory can repeat; a VU1 reset starts the answers over.
+void forgetRoutines();
+
+// With PS2_VU_PROGRAM_PROFILE set, save the microcode image and entry of a
+// routine that has no compiled version, for compile_vu_programs.py.
+void recordMissing(const uint8_t *code, uint32_t codeSize, uint32_t pc);
+
+// Run from the current PC, starting with First. Returns true when the E-bit
+// delay slot issued, false when the interpreter has to continue.
+bool run(VU1Interpreter &vu, const uint8_t *code, uint32_t codeSize, uint64_t budgetEnd, Routine first);
+
+struct Access
+{
+    using Decoded = VU1Interpreter::DecodedInstructionPair;
+    using Usage = VU1Interpreter::InstructionUsage;
+    using ScalarEntry = VU1Interpreter::ScalarPipelineEntry;
+    static constexpr uint8_t kFdiv = VU1Interpreter::PipelineFdiv;
+    static constexpr uint8_t kEfu = VU1Interpreter::PipelineEfu;
+    static constexpr uint8_t kXgkick = VU1Interpreter::PipelineXgkick;
+    static constexpr uint8_t kBranch = VU1Interpreter::PipelineBranch;
+
+    static constexpr Decoded decode(uint32_t lower, uint32_t upper)
+    {
+        return VU1Interpreter::decodeInstructionWords(lower, upper, Unit::VU1);
+    }
+
+    static VU1State &state(VU1Interpreter &vu) { return vu.m_state; }
+    static uint64_t cycle(const VU1Interpreter &vu) { return vu.m_cycle; }
+    static void setCycle(VU1Interpreter &vu, uint64_t cycle) { vu.m_cycle = cycle; }
+    static uint8_t *data(VU1Interpreter &vu) { return vu.m_activeVuData; }
+    static bool xgkickActive(const VU1Interpreter &vu) { return vu.m_xgkick.active; }
+    static void startXgkick(VU1Interpreter &vu, uint32_t address) { vu.startXgkick(address); }
+    static void progressXgkick(VU1Interpreter &vu) { vu.progressXgkick(); }
+    static ScalarEntry &fdiv(VU1Interpreter &vu) { return vu.m_fdiv; }
+    static std::array<ScalarEntry, 2> &efu(VU1Interpreter &vu) { return vu.m_efu; }
+    static uint64_t efuResourceReady(const VU1Interpreter &vu) { return vu.m_efuResourceReady; }
+    static void queueQ(VU1Interpreter &vu, float value, uint32_t latency, uint32_t statusDi)
+    {
+        vu.queueQ(value, latency, statusDi);
+    }
+    static void queueP(VU1Interpreter &vu, float value, uint32_t latency) { vu.queueP(value, latency); }
+    static uint64_t codeGeneration(const VU1Interpreter &vu)
+    {
+        return vu.m_activeMemory ? vu.m_activeMemory->getVU1CodeGeneration() : 0u;
+    }
+    static uint32_t workingClip(const VU1Interpreter &vu) { return vu.m_workingClip; }
+
+    // Nothing issued earlier can still change state or stall a pair.
+    static bool drained(const VU1Interpreter &vu)
+    {
+        return vu.m_unit == Unit::VU1 && vu.m_useCompiledExecution && !vu.pipelinesPending() &&
+               !vu.m_state.branchPending && !vu.m_state.ebit && !vu.m_state.haltAfterDelaySlot &&
+               !vu.m_stopRequested && !vu.m_pendingHaltD && !vu.m_pendingHaltT &&
+               !vu.m_state.dBitEnabled && !vu.m_state.tBitEnabled && vu.m_activeVuData &&
+               vu.m_activeVuDataSize == 16384u && vu.m_activeMemory;
+    }
+
+    static int32_t branchBackup(const VU1Interpreter &vu, uint32_t &reg)
+    {
+        reg = vu.m_viBranchBackupValid ? vu.m_viBranchBackupReg : 0u;
+        return vu.m_viBranchBackupValue;
+    }
+
+    static void pendVf(VU1Interpreter &vu, uint8_t reg, uint8_t lanes, uint64_t ready);
+    static void pendVi(VU1Interpreter &vu, uint8_t reg, uint64_t ready);
+    static void pendFlags(VU1Interpreter &vu, uint64_t issue, uint32_t mac, uint32_t status,
+                          uint32_t sticky, uint32_t clip, uint8_t writes);
+    static void finish(VU1Interpreter &vu, uint64_t cycle, uint32_t workingClip, uint8_t backupReg,
+                       int32_t backupValue, uint64_t pairs);
+};
+
+inline constexpr uint8_t lane(uint32_t component) { return static_cast<uint8_t>(8u >> component); }
+
+// A block's pairs, which run straight through from pc. Generated code names
+// a pair by its block and position, so each pair can see the ones before it.
+template <size_t N>
+struct Block
+{
+    uint32_t pc;
+    uint64_t words[N]; // lower | upper << 32
+};
+
+// No compiled pair writes a VF or VI register with a longer latency.
+inline constexpr uint32_t kMaxWriteLatency = 4u;
+
+constexpr uint32_t vfWriteLatency(const Access::Usage &usage)
+{
+    return usage.vfLatency != 0u ? usage.vfLatency : usage.latency;
+}
+
+constexpr uint32_t viWriteLatency(const Access::Usage &usage)
+{
+    return usage.viLatency != 0u ? usage.viLatency : usage.latency;
+}
+
+// The VI register a pair writes, if any; pairs write at most one.
+constexpr uint8_t viWritten(const Access::Usage &usage)
+{
+    const uint16_t writes = usage.viWrite & 0xFFFEu;
+    return writes != 0u ? static_cast<uint8_t>(std::countr_zero(writes)) : 0u;
+}
+
+// Reads of pair Index that cannot stall: last written in the block at least its
+// latency ago, or unwritten and past any write pending on entry. Bits 0-1 are
+// upper VF reads, 2-3 lower VF reads, and 4 + n VI register n.
+template <const auto &Code, uint32_t Index>
+constexpr uint32_t settledReads()
+{
+    const auto decodeAt = [](uint32_t index) {
+        const uint64_t word = Code.words[index];
+        return Access::decode(static_cast<uint32_t>(word), static_cast<uint32_t>(word >> 32u));
+    };
+    const uint32_t window = std::min(Index, kMaxWriteLatency - 1u);
+    const auto vfLaneSettled = [&](uint8_t reg, uint8_t laneBit) {
+        for (uint32_t back = 1u; back <= window; ++back)
+        {
+            const auto earlier = decodeAt(Index - back);
+            const auto &upper = earlier.upperUsage, &lower = earlier.lowerUsage;
+            // A lower write to the register the upper half also writes is dropped.
+            if (upper.vfWrite.reg == reg && (upper.vfWrite.lanes & laneBit) != 0u)
+                return back >= vfWriteLatency(upper);
+            if (lower.vfWrite.reg == reg && lower.vfWrite.reg != upper.vfWrite.reg &&
+                (lower.vfWrite.lanes & laneBit) != 0u)
+                return back >= vfWriteLatency(lower);
+        }
+        return Index >= kMaxWriteLatency - 1u;
+    };
+    const auto vfSettled = [&](uint8_t reg, uint8_t lanes) {
+        for (uint32_t component = 0u; component < 4u; ++component)
+            if ((lanes & lane(component)) != 0u && !vfLaneSettled(reg, lane(component)))
+                return false;
+        return true;
+    };
+    const auto viSettled = [&](uint8_t reg) {
+        for (uint32_t back = 1u; back <= window; ++back)
+        {
+            const auto earlier = decodeAt(Index - back);
+            if (viWritten(earlier.lowerUsage) == reg)
+                return back >= viWriteLatency(earlier.lowerUsage);
+        }
+        return Index >= kMaxWriteLatency - 1u;
+    };
+
+    const auto current = decodeAt(Index);
+    uint32_t settled = 0u;
+    for (uint32_t read = 0u; read < 2u; ++read)
+    {
+        if (read < current.upperUsage.vfReadCount &&
+            vfSettled(current.upperUsage.vfRead[read].reg, current.upperUsage.vfRead[read].lanes))
+            settled |= 1u << read;
+        if (read < current.lowerUsage.vfReadCount &&
+            vfSettled(current.lowerUsage.vfRead[read].reg, current.lowerUsage.vfRead[read].lanes))
+            settled |= 4u << read;
+    }
+    for (uint8_t reg = 1u; reg < 16u; ++reg)
+        if (viSettled(reg))
+            settled |= 16u << reg;
+    return settled;
+}
+
+struct UpperInputs
+{
+    const float *left, *right, *accumulator;
+    float scalarI, scalarQ;
+    float fs(unsigned component) const { return left[component]; }
+    float ft(unsigned component) const { return right[component]; }
+    float acc(unsigned component) const { return accumulator[component]; }
+    float i() const { return scalarI; }
+    float q() const { return scalarQ; }
+    bool compiledFastPath() const { return true; }
+};
+
+struct UpperSink
+{
+    float value[4];
+    uint32_t mac = 0u, status = 0u, sticky = 0u, clipBits = 0u;
+    bool hasFmac = false, hasClip = false;
+    PS2_VU_FORCE_INLINE void vf(unsigned, unsigned mask, const float *result)
+    {
+        for (unsigned component = 0; component < 4u; ++component)
+            if ((mask & lane(component)) != 0u)
+                value[component] = result[component];
+    }
+    PS2_VU_FORCE_INLINE void acc(unsigned mask, const float *result) { vf(0u, mask, result); }
+    PS2_VU_FORCE_INLINE void fmac(uint32_t macFlags, uint32_t statusFlags, uint32_t extraSticky)
+    {
+        mac = macFlags;
+        status = statusFlags;
+        sticky = extraSticky;
+        hasFmac = true;
+    }
+    PS2_VU_FORCE_INLINE void clip(uint32_t sixBits)
+    {
+        clipBits = sixBits;
+        hasClip = true;
+    }
+    void reserved(uint32_t) {}
+};
+
+// The opcode as computeUpper classifies it: the special form for 0x3C-0x3F.
+constexpr uint32_t upperCode(uint32_t upper)
+{
+    const uint32_t op = upper & 0x3Fu;
+    return op < 0x3Cu ? op : (upper & 3u) | ((upper >> 4u) & 0x7Cu);
+}
+
+constexpr bool upperIsNop(uint32_t upper)
+{
+    return (upper & 0x3Fu) >= 0x3Cu && (upperCode(upper) == 0x2Fu || upperCode(upper) == 0x30u);
+}
+
+constexpr bool upperReadsQ(uint32_t upper)
+{
+    const uint32_t code = upperCode(upper);
+    return code == 0x1Cu || code == 0x20u || code == 0x21u || code == 0x24u || code == 0x25u;
+}
+
+// MAX, MINI, ITOF, FTOI, ABS and CLIP publish no FMAC flags; their code is small.
+constexpr bool upperPublishesFlags(uint32_t upper)
+{
+    const uint32_t code = upperCode(upper);
+    if ((code >= 0x10u && code <= 0x17u) || code == 0x1Du || code == 0x1Fu)
+        return false;
+    if ((upper & 0x3Fu) < 0x3Cu)
+        return code != 0x2Bu && code != 0x2Fu;
+    return code != 0x2Fu && code != 0x30u;
+}
+
+// Queued FMAC conditions stay in the MAC register's layout, one bit per lane
+// in each of the Z, S, U and O groups; status bits are folded out on commit.
+constexpr uint32_t statusOf(uint32_t mac)
+{
+    return ((mac & 0x000Fu) != 0u ? 1u : 0u) | ((mac & 0x00F0u) != 0u ? 2u : 0u) |
+           ((mac & 0x0F00u) != 0u ? 4u : 0u) | ((mac & 0xF000u) != 0u ? 8u : 0u);
+}
+
+constexpr uint32_t spreadStatus(uint32_t status)
+{
+    return (status & 1u) | ((status & 2u) << 3u) | ((status & 4u) << 6u) | ((status & 8u) << 9u);
+}
+
+#if PS2_VU_PROGRAM_NEON
+namespace fast
+{
+// Lane conditions in the MAC register's layout, limited to the Dest lanes.
+template <uint8_t Dest>
+PS2_VU_FORCE_INLINE uint32_t layout(uint32x4_t zero, uint32x4_t sign, uint32x4_t underflow)
+{
+    const uint32x4_t zeroBits = {(Dest & 8u) ? 0x8u : 0u, (Dest & 4u) ? 0x4u : 0u, (Dest & 2u) ? 0x2u : 0u,
+                                 (Dest & 1u) ? 0x1u : 0u};
+    const uint32x4_t bits = vorrq_u32(vandq_u32(zero, zeroBits), vandq_u32(sign, vshlq_n_u32(zeroBits, 4)));
+    return vaddvq_u32(vorrq_u32(bits, vandq_u32(underflow, vshlq_n_u32(zeroBits, 8))));
+}
+
+// All ones in the lanes outside Dest, which no range check may reject.
+template <uint8_t Dest>
+PS2_VU_FORCE_INLINE uint32x4_t inactive()
+{
+    return uint32x4_t{(Dest & 8u) ? 0u : ~0u, (Dest & 4u) ? 0u : ~0u, (Dest & 2u) ? 0u : ~0u,
+                      (Dest & 1u) ? 0u : ~0u};
+}
+
+PS2_VU_FORCE_INLINE uint32x4_t negative(uint32x4_t bits)
+{
+    return vcltzq_s32(vreinterpretq_s32_u32(bits));
+}
+
+// Denormal operands read as zero of the same sign. Infinity and NaN patterns
+// stay as they are: every result they reach fails the range checks, so the
+// exact path, which clamps them, handles those lanes.
+PS2_VU_FORCE_INLINE float32x4_t flushDenormals(float32x4_t value)
+{
+    const uint32x4_t tiny = vcaltq_f32(value, vdupq_n_f32(std::numeric_limits<float>::min()));
+    return vreinterpretq_f32_u32(vbicq_u32(vreinterpretq_u32_f32(value), vshrq_n_u32(tiny, 1)));
+}
+}
+#endif
+
+class Run
+{
+public:
+    explicit Run(VU1Interpreter &vu);
+    Run(const Run &) = delete;
+    Run &operator=(const Run &) = delete;
+
+    bool finished() const { return m_finished; }
+    bool ended() const { return m_ended; }
+    uint64_t generation() const { return m_generation; }
+
+    // Stop before the pair at pc and let the interpreter continue.
+    uint32_t leave(uint32_t pc);
+
+private:
+    friend class Frame;
+
+    struct PendingFlags
+    {
+        uint32_t issue;
+        uint32_t writes; // 1 MAC, 2 status, 4 sticky (FSSET), 8 CLIP
+        uint32_t value;  // the MAC flags, FSSET's sticky bits or the CLIP flags
+        uint32_t sticky; // an FMAC's product conditions, laid out like MAC
+    };
+    // Results queue in a flat buffer. Each block reserves room for two per
+    // pair on entry, and compile_vu_programs.py keeps blocks short enough
+    // for that to fit next to the few results not yet due.
+    static constexpr uint32_t kFlagSlots = 512u;
+    static constexpr uint32_t kMaxBlockPairs = 128u;
+    static_assert(kFlagSlots >= 2u * kMaxBlockPairs + 16u);
+
+    struct Clock
+    {
+        uint32_t cycle;
+        bool kicking;
+    };
+
+    struct FlagRange
+    {
+        PendingFlags *head, *tail;
+    };
+
+    uint32_t relative(uint64_t absolute) const
+    {
+        return absolute > m_base ? static_cast<uint32_t>(absolute - m_base) : 0u;
+    }
+
+    // Rare paths. The Frame passes what they need and takes back what they change.
+    // exactUpper is the interpreter's full arithmetic, only needed for results
+    // near the range limits; it leaves its result in m_upper.
+    void exactUpper(uint32_t upper);
+    Clock stall(uint32_t cycle, uint32_t target, uint32_t pc, bool untilIdle);
+    bool progressKick(uint32_t cycle, uint32_t nextPc);
+    PendingFlags *commitFlags(PendingFlags *head, PendingFlags *tail, uint32_t upTo);
+    FlagRange makeRoom(PendingFlags *head, PendingFlags *tail, uint32_t cycle);
+    void cancelSameCycle(PendingFlags *head, PendingFlags *tail, uint32_t cycle, uint32_t writes);
+    PendingFlags *commitQ(PendingFlags *head, PendingFlags *tail, uint32_t cycle);
+    void commitP(uint32_t cycle);
+    void handBack();
+    uint32_t leaveStale();
+    uint32_t end(uint32_t pc);
+
+    VU1Interpreter &m_vu;
+    VU1State &m_state;
+    uint8_t *m_data;
+    uint64_t m_base;
+    uint64_t m_generation;
+    std::array<std::array<uint32_t, 4>, 32> m_vfReady{};
+    std::array<uint32_t, 16> m_viReady{};
+    // Not cleared: a run starts every MSCAL and only ever reads what it queued.
+    std::array<PendingFlags, kFlagSlots> m_flags;
+    UpperSink m_upper;
+    // FSSET results in the queue. Only those have to land in order with Q.
+    uint32_t m_fssetQueued = 0u;
+    // The Frame's state as of the last routine return.
+    uint64_t m_pairs = 0u;
+    uint32_t m_cycle = 0u;
+    PendingFlags *m_flagHead = m_flags.data();
+    PendingFlags *m_flagTail = m_flags.data();
+    uint32_t m_workingClip = 0u;
+    int32_t m_backupValue = 0;
+    uint32_t m_backupReg = 0u;
+    bool m_kickActive = false;
+    bool m_stale = false;
+    bool m_finished = false;
+    bool m_ended = false;
+    // Where to resume if a GIF callback rewrote microcode after a pair.
+    uint32_t m_stalePc = 0u;
+    uint32_t m_staleTarget = 0u;
+    bool m_staleBranch = false;
+    bool m_staleEnding = false;
+};
+
+class Frame
+{
+public:
+    PS2_VU_FORCE_INLINE Frame(Run &run, uint64_t budgetEnd)
+        : m_run(run), m_state(run.m_state), m_data(run.m_data), m_base(run.m_base),
+          m_limit(budgetEnd > run.m_base ? budgetEnd - run.m_base : 0u), m_pairs(run.m_pairs),
+          m_cycle(run.m_cycle), m_flagHead(run.m_flagHead), m_flagTail(run.m_flagTail),
+          m_workingClip(run.m_workingClip), m_backupValue(run.m_backupValue), m_backupReg(run.m_backupReg),
+          m_kickActive(run.m_kickActive)
+    {
+    }
+
+    // A block runs without cycle checks only while it cannot reach the budget.
+    // Counts a block's pairs up front, which is close enough for statistics
+    // and keeps a counter update out of every pair.
+    template <uint32_t Margin, uint32_t Pairs>
+    PS2_VU_FORCE_INLINE bool fits()
+    {
+        static_assert(Pairs <= Run::kMaxBlockPairs, "compile_vu_programs.py should have split this block");
+        if (m_cycle + static_cast<uint64_t>(Margin) >= m_limit)
+            return false;
+        // An upper instruction and FSSET or FCSET queue at most two results a pair.
+        if (m_flagTail + 2u * Pairs > m_run.m_flags.data() + Run::kFlagSlots) [[unlikely]]
+        {
+            const Run::FlagRange range = m_run.makeRoom(m_flagHead, m_flagTail, m_cycle);
+            m_flagHead = range.head;
+            m_flagTail = range.tail;
+        }
+        m_pairs += Pairs;
+        return true;
+    }
+
+    PS2_VU_FORCE_INLINE bool taken() const { return m_taken; }
+    PS2_VU_FORCE_INLINE uint32_t jumpTarget() const { return m_jumpTarget; }
+
+    // Issue pair Index of a block. NextPc is where the interpreter's PC would
+    // stand after it; it only matters if a GIF callback rewrites microcode, in
+    // which case this returns false and the routine must return leaveStale().
+    template <const auto &Code, uint32_t Index>
+    PS2_VU_FORCE_INLINE bool pair(uint32_t nextPc)
+    {
+        constexpr uint64_t word = Code.words[Index];
+        return issue<(Code.pc + Index * 8u) & 0x3FFFu, static_cast<uint32_t>(word), static_cast<uint32_t>(word >> 32u),
+                     settledReads<Code, Index>()>(nextPc);
+    }
+
+    // Return to the driver, which continues with the routine at pc.
+    PS2_VU_FORCE_INLINE uint32_t exit(uint32_t pc)
+    {
+        save();
+        return pc;
+    }
+
+    // Stop before the pair at pc and let the interpreter continue.
+    PS2_VU_FORCE_INLINE uint32_t leave(uint32_t pc)
+    {
+        save();
+        return m_run.leave(pc);
+    }
+
+    PS2_VU_FORCE_INLINE uint32_t leaveStale()
+    {
+        save();
+        return m_run.leaveStale();
+    }
+
+    // The E-bit delay slot has issued; the interpreter flushes what remains.
+    PS2_VU_FORCE_INLINE uint32_t end(uint32_t pc)
+    {
+        save();
+        return m_run.end(pc);
+    }
+
+private:
+    PS2_VU_FORCE_INLINE void save()
+    {
+        m_run.m_pairs = m_pairs;
+        m_run.m_cycle = m_cycle;
+        m_run.m_flagHead = m_flagHead;
+        m_run.m_flagTail = m_flagTail;
+        m_run.m_workingClip = m_workingClip;
+        m_run.m_backupValue = m_backupValue;
+        m_run.m_backupReg = m_backupReg;
+        m_run.m_kickActive = m_kickActive;
+    }
+
+    // Lane helpers take the mask as a template argument and unfold without
+    // loops; routines inline thousands of them and loops cost compile time.
+    template <uint8_t Mask>
+    static PS2_VU_FORCE_INLINE uint32_t readyOf(const uint32_t *lanes, uint32_t ready)
+    {
+#if PS2_VU_PROGRAM_NEON
+        if constexpr (Mask == 0xFu)
+            return std::max(ready, vmaxvq_u32(vld1q_u32(lanes)));
+#endif
+        if constexpr ((Mask & 8u) != 0u)
+            ready = std::max(ready, lanes[0]);
+        if constexpr ((Mask & 4u) != 0u)
+            ready = std::max(ready, lanes[1]);
+        if constexpr ((Mask & 2u) != 0u)
+            ready = std::max(ready, lanes[2]);
+        if constexpr ((Mask & 1u) != 0u)
+            ready = std::max(ready, lanes[3]);
+        return ready;
+    }
+
+    template <uint8_t Mask, class T>
+    static PS2_VU_FORCE_INLINE void applyLanes(T *target, const T *value)
+    {
+        if constexpr ((Mask & 8u) != 0u)
+            target[0] = value[0];
+        if constexpr ((Mask & 4u) != 0u)
+            target[1] = value[1];
+        if constexpr ((Mask & 2u) != 0u)
+            target[2] = value[2];
+        if constexpr ((Mask & 1u) != 0u)
+            target[3] = value[3];
+    }
+
+    template <uint8_t Mask>
+    static PS2_VU_FORCE_INLINE void setReady(uint32_t *lanes, uint32_t ready)
+    {
+        const uint32_t value[4] = {ready, ready, ready, ready};
+        applyLanes<Mask>(lanes, value);
+    }
+
+    PS2_VU_FORCE_INLINE uint32_t relative(uint64_t absolute) const
+    {
+        return absolute > m_base ? static_cast<uint32_t>(absolute - m_base) : 0u;
+    }
+
+    template <uint32_t Pc, uint32_t Lower, uint32_t Upper, uint32_t Settled>
+    PS2_VU_FORCE_INLINE bool issue(uint32_t nextPc);
+
+    // The latest cycle an operand of the pair becomes ready, ignoring the
+    // clock and the reads settledReads found cannot stall.
+    template <uint32_t Lower, uint32_t Upper, uint32_t Settled>
+    PS2_VU_FORCE_INLINE uint32_t pairReady() const;
+
+    template <uint32_t Pc, uint32_t Lower, uint32_t Upper>
+    PS2_VU_FORCE_INLINE bool stale(uint32_t nextPc);
+
+    template <uint32_t Upper>
+    PS2_VU_FORCE_INLINE void upper(float *value);
+
+#if PS2_VU_PROGRAM_NEON
+    template <uint32_t Upper>
+    PS2_VU_FORCE_INLINE bool fastUpper(float *value);
+#endif
+
+    template <uint32_t Upper>
+    PS2_VU_FORCE_INLINE uint32_t plainUpper(float *value);
+
+    template <uint32_t Pc, uint32_t Lower>
+    PS2_VU_FORCE_INLINE void lower(float *vfResult, int32_t &viResult);
+
+    // Room was reserved when the block was entered.
+    PS2_VU_FORCE_INLINE void pushFlags(uint32_t writes, uint32_t value, uint32_t sticky)
+    {
+        *m_flagTail++ = {m_cycle, writes, value, sticky};
+    }
+
+    PS2_VU_FORCE_INLINE void flagsAt()
+    {
+        if (m_flagHead != m_flagTail && m_flagHead->issue + 4u <= m_cycle)
+            m_flagHead = m_run.commitFlags(m_flagHead, m_flagTail, m_cycle);
+    }
+
+    PS2_VU_FORCE_INLINE void cancelSameCycle(uint32_t writes)
+    {
+        m_run.cancelSameCycle(m_flagHead, m_flagTail, m_cycle, writes);
+    }
+
+    PS2_VU_FORCE_INLINE bool qDue() const
+    {
+        const auto &fdiv = Access::fdiv(m_run.m_vu);
+        return fdiv.valid && relative(fdiv.readyCycle) <= m_cycle;
+    }
+
+    PS2_VU_FORCE_INLINE void commitQ() { m_flagHead = m_run.commitQ(m_flagHead, m_flagTail, m_cycle); }
+    PS2_VU_FORCE_INLINE void commitP() { m_run.commitP(m_cycle); }
+    PS2_VU_FORCE_INLINE void syncClock() { Access::setCycle(m_run.m_vu, m_base + m_cycle); }
+
+    PS2_VU_FORCE_INLINE int32_t branchVi(uint8_t reg) const
+    {
+        if (reg == 0u)
+            return 0;
+        return m_backupReg == reg ? m_backupValue : m_state.vi[reg];
+    }
+
+    Run &m_run;
+    VU1State &m_state;
+    uint8_t *m_data;
+    uint64_t m_base;
+    uint64_t m_limit;
+    uint64_t m_pairs;
+    uint32_t m_cycle;
+    Run::PendingFlags *m_flagHead;
+    Run::PendingFlags *m_flagTail;
+    uint32_t m_workingClip;
+    uint32_t m_jumpTarget = 0u;
+    int32_t m_backupValue;
+    uint32_t m_backupReg;
+    bool m_taken = false;
+    bool m_kickActive;
+};
+
+template <uint32_t Lower, uint32_t Upper, uint32_t Settled>
+PS2_VU_FORCE_INLINE uint32_t Frame::pairReady() const
+{
+    static constexpr Access::Decoded d = Access::decode(Lower, Upper);
+    const auto &vfReady = m_run.m_vfReady;
+    uint32_t ready = 0u;
+    if constexpr (d.upperUsage.vfReadCount > 0u && d.upperUsage.vfRead[0].reg != 0u && (Settled & 1u) == 0u)
+        ready = readyOf<d.upperUsage.vfRead[0].lanes>(vfReady[d.upperUsage.vfRead[0].reg].data(), ready);
+    if constexpr (d.upperUsage.vfReadCount > 1u && d.upperUsage.vfRead[1].reg != 0u && (Settled & 2u) == 0u)
+        ready = readyOf<d.upperUsage.vfRead[1].lanes>(vfReady[d.upperUsage.vfRead[1].reg].data(), ready);
+    if constexpr (d.lowerUsage.vfReadCount > 0u && d.lowerUsage.vfRead[0].reg != 0u && (Settled & 4u) == 0u)
+        ready = readyOf<d.lowerUsage.vfRead[0].lanes>(vfReady[d.lowerUsage.vfRead[0].reg].data(), ready);
+    if constexpr (d.lowerUsage.vfReadCount > 1u && d.lowerUsage.vfRead[1].reg != 0u && (Settled & 8u) == 0u)
+        ready = readyOf<d.lowerUsage.vfRead[1].lanes>(vfReady[d.lowerUsage.vfRead[1].reg].data(), ready);
+    constexpr uint16_t viReads = (d.upperUsage.viRead | d.lowerUsage.viRead) & 0xFFFEu & ~(Settled >> 4u);
+    [&]<size_t... Reg>(std::index_sequence<Reg...>) PS2_VU_INLINE_LAMBDA {
+        ((((viReads >> Reg) & 1u) != 0u ? (ready = std::max(ready, m_run.m_viReady[Reg])) : 0u), ...);
+    }(std::make_index_sequence<16>{});
+    constexpr auto lower = d.lowerUsage;
+    if constexpr (lower.pipeline == Access::kFdiv || lower.waitQ)
+    {
+        const auto &fdiv = Access::fdiv(m_run.m_vu);
+        if (fdiv.valid)
+            ready = std::max(ready, relative(fdiv.readyCycle));
+    }
+    if constexpr (lower.waitP)
+    {
+        const std::array<Access::ScalarEntry, 2> &efu = Access::efu(m_run.m_vu);
+        if (efu[0].valid)
+            ready = std::max(ready, relative(efu[0].readyCycle));
+        if (efu[1].valid)
+            ready = std::max(ready, relative(efu[1].readyCycle));
+    }
+    else if constexpr (lower.pipeline == Access::kEfu)
+        ready = std::max(ready, relative(Access::efuResourceReady(m_run.m_vu)));
+    return ready;
+}
+
+template <uint32_t Pc, uint32_t Lower, uint32_t Upper, uint32_t Settled>
+PS2_VU_FORCE_INLINE bool Frame::issue(uint32_t nextPc)
+{
+    static constexpr Access::Decoded decoded = Access::decode(Lower, Upper);
+    static_assert(!decoded.upperUsage.reserved && !decoded.lowerUsage.reserved,
+                  "reserved instruction in a compiled VU program");
+    static_assert(vfWriteLatency(decoded.upperUsage) <= kMaxWriteLatency &&
+                      (decoded.lowerUsage.vfWrite.reg == 0u || vfWriteLatency(decoded.lowerUsage) <= kMaxWriteLatency) &&
+                      (viWritten(decoded.lowerUsage) == 0u || viWriteLatency(decoded.lowerUsage) <= kMaxWriteLatency),
+                  "settledReads assumes no register write takes longer than kMaxWriteLatency");
+    constexpr bool immediate = (Upper & 0x80000000u) != 0u;
+    constexpr bool kick = !immediate && decoded.lowerUsage.pipeline == Access::kXgkick;
+
+    // While PATH1 is busy every stalled cycle feeds it; XGKICK waits for it.
+    // Only the last step depends on the clock, which keeps its chain short.
+    const uint32_t ready = pairReady<Lower, Upper, Settled>();
+    const bool kicking = m_kickActive;
+    if (kicking) [[unlikely]]
+    {
+        const Run::Clock clock = m_run.stall(m_cycle, ready, Pc, kick);
+        m_cycle = clock.cycle;
+        m_kickActive = clock.kicking;
+    }
+    else
+        m_cycle = std::max(m_cycle, ready);
+
+    // Both halves read the state from before the pair; results land after.
+    constexpr uint8_t upperReg = decoded.upperUsage.vfWrite.reg;
+    constexpr uint8_t upperLanes = decoded.upperUsage.vfWrite.lanes;
+    constexpr uint8_t accLanes = decoded.upperUsage.accWrite;
+    float upperValue[4];
+    if constexpr (!upperIsNop(Upper))
+    {
+        if constexpr (upperReadsQ(Upper))
+            if (qDue())
+                commitQ();
+        upper<Upper>(upperValue);
+    }
+
+    float lowerValue[4];
+    int32_t viValue = 0;
+    constexpr uint16_t viWrites = decoded.lowerUsage.viWrite & 0xFFFEu;
+    constexpr uint8_t viReg = viWrites != 0u ? static_cast<uint8_t>(std::countr_zero(viWrites)) : 0u;
+    constexpr uint8_t lowerReg = decoded.lowerUsage.vfWrite.reg;
+    constexpr uint8_t lowerLanes = decoded.lowerUsage.vfWrite.lanes;
+    if constexpr (immediate)
+    {
+        float value;
+        constexpr uint32_t bits = Lower;
+        std::memcpy(&value, &bits, sizeof(value));
+        m_state.i = ps2_vu_detail::upper::normalizeOperand(value);
+    }
+    else
+        lower<Pc, Lower>(lowerValue, viValue);
+
+    if constexpr (lowerReg != 0u && lowerReg != upperReg)
+    {
+        constexpr uint32_t latency = decoded.lowerUsage.vfLatency != 0u ? decoded.lowerUsage.vfLatency
+                                                                        : decoded.lowerUsage.latency;
+        applyLanes<lowerLanes>(m_state.vf[lowerReg], lowerValue);
+        setReady<lowerLanes>(m_run.m_vfReady[lowerReg].data(), m_cycle + latency);
+    }
+    if constexpr (upperReg != 0u)
+    {
+        constexpr uint32_t latency = decoded.upperUsage.vfLatency != 0u ? decoded.upperUsage.vfLatency
+                                                                        : decoded.upperUsage.latency;
+        applyLanes<upperLanes>(m_state.vf[upperReg], upperValue);
+        setReady<upperLanes>(m_run.m_vfReady[upperReg].data(), m_cycle + latency);
+    }
+    if constexpr (accLanes != 0u)
+        applyLanes<accLanes>(m_state.acc, upperValue);
+    if constexpr (viReg != 0u)
+    {
+        constexpr uint32_t latency = decoded.lowerUsage.viLatency != 0u ? decoded.lowerUsage.viLatency
+                                                                        : decoded.lowerUsage.latency;
+        const int32_t old = m_state.vi[viReg];
+        m_state.vi[viReg] = static_cast<int16_t>(viValue);
+        m_run.m_viReady[viReg] = m_cycle + latency;
+        // A conditional branch right after reads the value from before this write.
+        if constexpr (decoded.lowerUsage.delaysNextBranchRead)
+        {
+            m_backupReg = viReg;
+            m_backupValue = old;
+        }
+        else
+            m_backupReg = 0u;
+    }
+    else
+        m_backupReg = 0u;
+
+    ++m_cycle;
+    if (kicking || m_kickActive) [[unlikely]]
+    {
+        if (m_kickActive)
+            m_kickActive = m_run.progressKick(m_cycle, nextPc);
+        if (m_run.m_stale)
+            return stale<Pc, Lower, Upper>(nextPc);
+    }
+    return true;
+}
+
+template <uint32_t Pc, uint32_t Lower, uint32_t Upper>
+PS2_VU_FORCE_INLINE bool Frame::stale(uint32_t nextPc)
+{
+    // Resume exactly where the interpreter would fetch the next pair.
+    static constexpr Access::Decoded decoded = Access::decode(Lower, Upper);
+    constexpr bool immediate = (Upper & 0x80000000u) != 0u;
+    constexpr uint32_t op = Lower >> 25u;
+    constexpr bool branch = !immediate && decoded.lowerUsage.pipeline == Access::kBranch;
+    constexpr int32_t imm11 = static_cast<int32_t>(Lower << 21u) >> 21;
+    m_run.m_stalePc = nextPc;
+    m_run.m_staleBranch = branch && m_taken;
+    m_run.m_staleTarget = (op == 0x24u || op == 0x25u) ? m_jumpTarget
+                                                       : ((Pc + 8u + static_cast<uint32_t>(imm11 * 8)) & 0x3FFFu);
+    m_run.m_staleEnding = (Upper & 0x40000000u) != 0u;
+    return false;
+}
+
+template <uint32_t Upper>
+PS2_VU_FORCE_INLINE void Frame::upper(float *value)
+{
+    if constexpr (!upperPublishesFlags(Upper))
+    {
+        const uint32_t clip = plainUpper<Upper>(value);
+        if constexpr ((Upper & 0x3Fu) >= 0x3Cu && upperCode(Upper) == 0x1Fu)
+        {
+            m_workingClip = ((m_workingClip << 6u) | (clip & 0x3Fu)) & 0xFFFFFFu;
+            pushFlags(8u, m_workingClip, 0u);
+        }
+    }
+    else
+    {
+#if PS2_VU_PROGRAM_NEON
+        if (fastUpper<Upper>(value))
+            return;
+#endif
+        m_run.exactUpper(Upper);
+        const UpperSink &exact = m_run.m_upper;
+        std::memcpy(value, exact.value, sizeof(exact.value));
+        if (exact.hasFmac)
+            pushFlags(3u, exact.mac, spreadStatus(exact.sticky));
+    }
+}
+
+#if PS2_VU_PROGRAM_NEON
+// The upper instructions without FMAC flags, with computeUpper's operands and
+// comparisons. Returns CLIP's six bits.
+template <uint32_t Upper>
+PS2_VU_FORCE_INLINE uint32_t Frame::plainUpper(float *value)
+{
+    constexpr uint32_t code = upperCode(Upper);
+    constexpr bool special = (Upper & 0x3Fu) >= 0x3Cu;
+    constexpr uint8_t fs = static_cast<uint8_t>((Upper >> 11u) & 31u);
+    constexpr uint8_t ft = static_cast<uint8_t>((Upper >> 16u) & 31u);
+    using ps2_vu_detail::normalizeFmacOperands;
+    if constexpr (special && code >= 0x10u && code <= 0x13u) // ITOF0, ITOF4, ITOF12, ITOF15
+    {
+        // Scaling by a power of two is exact, so one rounding matches the interpreter's two.
+        const int32x4_t raw = vreinterpretq_s32_f32(vld1q_f32(m_state.vf[fs]));
+        if constexpr (code == 0x10u)
+            vst1q_f32(value, vcvtq_f32_s32(raw));
+        else
+            vst1q_f32(value, vcvtq_n_f32_s32(raw, code == 0x11u ? 4 : code == 0x12u ? 12 : 15));
+    }
+    else if constexpr (special && code >= 0x14u && code <= 0x17u) // FTOI0, FTOI4, FTOI12, FTOI15
+    {
+        // Truncates and saturates like the interpreter's double conversion.
+        const float32x4_t source = normalizeFmacOperands(vld1q_f32(m_state.vf[fs]));
+        int32x4_t result;
+        if constexpr (code == 0x14u)
+            result = vcvtq_s32_f32(source);
+        else
+            result = vcvtq_n_s32_f32(source, code == 0x15u ? 4 : code == 0x16u ? 12 : 15);
+        vst1q_f32(value, vreinterpretq_f32_s32(result));
+    }
+    else if constexpr (special && code == 0x1Du) // ABS
+        vst1q_f32(value, vabsq_f32(normalizeFmacOperands(vld1q_f32(m_state.vf[fs]))));
+    else if constexpr (special && code == 0x1Fu) // CLIP, on the raw bit patterns
+    {
+        uint32_t w;
+        std::memcpy(&w, &m_state.vf[ft][3], sizeof(w));
+        const int32_t limit = (w & 0x7F800000u) != 0u ? static_cast<int32_t>(w & 0x7FFFFFFFu) : 0x007FFFFF;
+        const int32x4_t bits = vreinterpretq_s32_f32(vld1q_f32(m_state.vf[fs]));
+        const int32x4_t bound = vdupq_n_s32(limit);
+        const uint32x4_t above = vcgtq_s32(bits, bound);
+        const uint32x4_t below = vcgtq_s32(veorq_s32(bits, vdupq_n_s32(std::numeric_limits<int32_t>::min())), bound);
+        const uint32x4_t aboveBits = {0x01u, 0x04u, 0x10u, 0u};
+        const uint32x4_t belowBits = {0x02u, 0x08u, 0x20u, 0u};
+        return vaddvq_u32(vorrq_u32(vandq_u32(above, aboveBits), vandq_u32(below, belowBits)));
+    }
+    else // MAX and MINI with a broadcast, I or a whole vector
+    {
+        static_assert(!special, "unexpected upper instruction without FMAC flags");
+        const float32x4_t left = normalizeFmacOperands(vld1q_f32(m_state.vf[fs]));
+        float32x4_t right;
+        if constexpr (code <= 0x17u)
+            right = vld1q_dup_f32(&m_state.vf[ft][code & 3u]);
+        else if constexpr (code == 0x1Du || code == 0x1Fu)
+            right = vdupq_n_f32(m_state.i);
+        else
+            right = vld1q_f32(m_state.vf[ft]);
+        right = normalizeFmacOperands(right);
+        constexpr bool max = code <= 0x13u || code == 0x1Du || code == 0x2Bu;
+        const uint32x4_t pick = max ? vcgtq_f32(left, right) : vcltq_f32(left, right);
+        vst1q_f32(value, vbslq_f32(pick, left, right));
+    }
+    return 0u;
+}
+#else
+// The same instructions lane by lane, in computeUpper's arithmetic. Inlining
+// computeUpper itself cost more compile time than the rest of a routine.
+template <uint32_t Upper>
+PS2_VU_FORCE_INLINE uint32_t Frame::plainUpper(float *value)
+{
+    using ps2_vu_detail::upper::normalizeOperand;
+    constexpr uint32_t code = upperCode(Upper);
+    constexpr bool special = (Upper & 0x3Fu) >= 0x3Cu;
+    constexpr uint8_t fs = static_cast<uint8_t>((Upper >> 11u) & 31u);
+    constexpr uint8_t ft = static_cast<uint8_t>((Upper >> 16u) & 31u);
+    const float *source = m_state.vf[fs];
+    if constexpr (special && code >= 0x10u && code <= 0x17u) // ITOF and FTOI
+    {
+        constexpr float scale = (code & 3u) == 0u ? 1.0f : (code & 3u) == 1u ? 16.0f : (code & 3u) == 2u ? 4096.0f : 32768.0f;
+        for (uint32_t lane = 0u; lane < 4u; ++lane)
+        {
+            int32_t bits;
+            if constexpr (code <= 0x13u)
+            {
+                std::memcpy(&bits, &source[lane], sizeof(bits));
+                value[lane] = static_cast<float>(bits) / scale;
+            }
+            else
+            {
+                bits = ps2_vu_detail::upper::floatToInt(normalizeOperand(source[lane]), scale);
+                std::memcpy(&value[lane], &bits, sizeof(bits));
+            }
+        }
+    }
+    else if constexpr (special && code == 0x1Du) // ABS
+    {
+        for (uint32_t lane = 0u; lane < 4u; ++lane)
+            value[lane] = std::fabs(normalizeOperand(source[lane]));
+    }
+    else if constexpr (special && code == 0x1Fu) // CLIP, on the raw bit patterns
+    {
+        uint32_t w;
+        std::memcpy(&w, &m_state.vf[ft][3], sizeof(w));
+        const int32_t limit = (w & 0x7F800000u) != 0u ? static_cast<int32_t>(w & 0x7FFFFFFFu) : 0x007FFFFF;
+        uint32_t flags = 0u;
+        for (uint32_t lane = 0u; lane < 3u; ++lane)
+        {
+            int32_t bits;
+            std::memcpy(&bits, &source[lane], sizeof(bits));
+            if (bits > limit)
+                flags |= 1u << (lane * 2u);
+            if ((bits ^ std::numeric_limits<int32_t>::min()) > limit)
+                flags |= 2u << (lane * 2u);
+        }
+        return flags;
+    }
+    else // MAX and MINI with a broadcast, I or a whole vector
+    {
+        static_assert(!special, "unexpected upper instruction without FMAC flags");
+        constexpr bool max = code <= 0x13u || code == 0x1Du || code == 0x2Bu;
+        for (uint32_t lane = 0u; lane < 4u; ++lane)
+        {
+            const float left = normalizeOperand(source[lane]);
+            float right;
+            if constexpr (code <= 0x17u)
+                right = normalizeOperand(m_state.vf[ft][code & 3u]);
+            else if constexpr (code == 0x1Du || code == 0x1Fu)
+                right = normalizeOperand(m_state.i);
+            else
+                right = normalizeOperand(m_state.vf[ft][lane]);
+            value[lane] = max ? (left > right ? left : right) : (left < right ? left : right);
+        }
+    }
+    return 0u;
+}
+#endif
+
+#if PS2_VU_PROGRAM_NEON
+// computeUpper's vector cases with the same range checks, but with the flags
+// built straight into the MAC layout. Results the checks do not clear take
+// the exact path.
+template <uint32_t Upper>
+PS2_VU_FORCE_INLINE bool Frame::fastUpper(float *value)
+{
+    constexpr uint32_t code = upperCode(Upper);
+    constexpr uint8_t dest = static_cast<uint8_t>((Upper >> 21u) & 15u);
+    constexpr uint8_t fs = static_cast<uint8_t>((Upper >> 11u) & 31u);
+    constexpr uint8_t ft = static_cast<uint8_t>((Upper >> 16u) & 31u);
+    // OPMULA and OPMSUB take the cross-product lanes fs.yzx and ft.zxy. Their w
+    // result is a constant zero, which the exact path handles.
+    constexpr bool cross = code == 0x2Eu && (dest & 1u) == 0u;
+    constexpr bool accumulate = (Upper & 0x3Fu) >= 0x3Cu;
+    constexpr bool simpleAdd = code <= 3u || code == 0x20u || code == 0x22u || code == 0x28u;
+    constexpr bool simpleSub = (code >= 4u && code <= 7u) || code == 0x24u || code == 0x26u || code == 0x2Cu;
+    constexpr bool simpleMul = (code >= 0x18u && code <= 0x1Cu) || code == 0x1Eu || code == 0x2Au || (cross && accumulate);
+    constexpr bool productSum = (code >= 8u && code <= 0xFu) || code == 0x21u || code == 0x23u ||
+                                code == 0x25u || code == 0x27u || code == 0x29u || code == 0x2Du || (cross && !accumulate);
+    if constexpr (!simpleAdd && !simpleSub && !simpleMul && !productSum)
+        return false;
+    else
+    {
+        using fast::flushDenormals;
+        const uint32x4_t magnitudeMask = vdupq_n_u32(0x7FFFFFFFu);
+        float32x4_t left = flushDenormals(vld1q_f32(m_state.vf[fs]));
+        float32x4_t right;
+        if constexpr (code <= 0xFu || (code >= 0x18u && code <= 0x1Bu))
+            right = vld1q_dup_f32(&m_state.vf[ft][code & 3u]);
+        else if constexpr (code == 0x1Cu || code == 0x20u || code == 0x21u || code == 0x24u || code == 0x25u)
+            right = vdupq_n_f32(m_state.q);
+        else if constexpr (code == 0x1Eu || code == 0x22u || code == 0x23u || code == 0x26u || code == 0x27u)
+            right = vdupq_n_f32(m_state.i);
+        else
+            right = vld1q_f32(m_state.vf[ft]);
+        right = flushDenormals(right);
+        if constexpr (cross)
+        {
+            // fs.yzxw and ft.zxyw; GCC only has __builtin_shufflevector from 12 on.
+            left = vcopyq_laneq_f32(vcopyq_laneq_f32(vextq_f32(left, left, 1), 2, left, 0), 3, left, 3);
+            right = vcopyq_laneq_f32(vcopyq_laneq_f32(vextq_f32(right, right, 3), 0, right, 2), 3, right, 3);
+        }
+        const uint32x4_t leftBits = vreinterpretq_u32_f32(left);
+        const uint32x4_t rightBits = vreinterpretq_u32_f32(right);
+
+        if constexpr (!productSum)
+        {
+            float32x4_t result;
+            if constexpr (simpleAdd)
+                result = vaddq_f32(left, right);
+            else if constexpr (simpleSub)
+                result = vsubq_f32(left, right);
+            else
+                result = vmulq_f32(left, right);
+            const uint32x4_t bits = vreinterpretq_u32_f32(result);
+            const uint32x4_t magnitude = vandq_u32(bits, magnitudeMask);
+            const uint32x4_t leftZero = vceqzq_u32(vandq_u32(leftBits, magnitudeMask));
+            const uint32x4_t rightZero = vceqzq_u32(vandq_u32(rightBits, magnitudeMask));
+            uint32x4_t exactZero;
+            if constexpr (simpleMul)
+                exactZero = vorrq_u32(leftZero, rightZero);
+            else
+            {
+                const uint32x4_t opposing = simpleAdd ? veorq_u32(rightBits, vdupq_n_u32(0x80000000u)) : rightBits;
+                exactZero = vorrq_u32(vandq_u32(leftZero, rightZero), vceqq_u32(leftBits, opposing));
+            }
+            const uint32x4_t zero = vceqzq_u32(magnitude);
+            const uint32x4_t normal = vandq_u32(vcgtq_u32(magnitude, vdupq_n_u32(0x00800000u)),
+                                                vcltq_u32(magnitude, vdupq_n_u32(0x7F7FFFFFu)));
+            // Boundary results keep the exact checks: tiny results rounded to
+            // zero or MIN_NORMAL, and overflow to FLT_MAX.
+            const uint32x4_t safe = vorrq_u32(normal, vandq_u32(zero, exactZero));
+            if (vminvq_u32(vorrq_u32(safe, fast::inactive<dest>())) == 0u)
+                return false;
+            vst1q_f32(value, result);
+            if constexpr (dest != 0u)
+                pushFlags(3u, fast::layout<dest>(zero, fast::negative(bits), vdupq_n_u32(0u)), 0u);
+            return true;
+        }
+        else
+        {
+            constexpr bool subtract =
+                (code >= 0xCu && code <= 0xFu) || code == 0x25u || code == 0x27u || code == 0x2Du || cross;
+            // Only FMAC results reach ACC, and those are already in range.
+            const float32x4_t acc = vld1q_f32(m_state.acc);
+            const float32x4_t result = subtract ? vfmsq_f32(acc, left, right) : vfmaq_f32(acc, left, right);
+            const uint32x4_t bits = vreinterpretq_u32_f32(result);
+            const uint32x4_t exponentMask = vdupq_n_u32(0xFFu);
+            const uint32x4_t resultExponent = vandq_u32(vshrq_n_u32(bits, 23), exponentMask);
+            const uint32x4_t leftExponent = vandq_u32(vshrq_n_u32(leftBits, 23), exponentMask);
+            const uint32x4_t rightExponent = vandq_u32(vshrq_n_u32(rightBits, 23), exponentMask);
+            const uint32x4_t productBound = vaddq_u32(leftExponent, rightExponent);
+            const uint32x4_t zeroProduct = vorrq_u32(vceqzq_u32(leftExponent), vceqzq_u32(rightExponent));
+            const uint32x4_t productSafe = vandq_u32(vcleq_u32(productBound, vdupq_n_u32(379u)),
+                                                     vcleq_u32(productBound, vaddq_u32(resultExponent, vdupq_n_u32(146u))));
+            const uint32x4_t resultSafe = vandq_u32(vcgeq_u32(resultExponent, vdupq_n_u32(2u)),
+                                                    vcleq_u32(resultExponent, vdupq_n_u32(253u)));
+            const uint32x4_t zero = vceqzq_u32(vandq_u32(bits, magnitudeMask));
+            const uint32x4_t safe = vorrq_u32(vandq_u32(resultSafe, vorrq_u32(zeroProduct, productSafe)),
+                                              vandq_u32(zero, zeroProduct));
+            if (vminvq_u32(vorrq_u32(safe, fast::inactive<dest>())) == 0u)
+                return false;
+            vst1q_f32(value, result);
+            if constexpr (dest != 0u)
+            {
+                // The accepted exponent bound excludes product overflow. A tiny
+                // product is exact zero only when one multiplicand is zero.
+                const uint32x4_t product = vreinterpretq_u32_f32(vabsq_f32(vmulq_f32(left, right)));
+                const uint32x4_t tiny = vcltq_u32(product, vdupq_n_u32(0x00800000u));
+                const uint32_t conditions = fast::layout<dest>(tiny, fast::negative(veorq_u32(leftBits, rightBits)),
+                                                               vbicq_u32(tiny, zeroProduct));
+                pushFlags(3u, fast::layout<dest>(zero, fast::negative(bits), vdupq_n_u32(0u)), conditions);
+            }
+            return true;
+        }
+    }
+}
+#endif
+
+template <uint32_t Pc, uint32_t Lower>
+PS2_VU_FORCE_INLINE void Frame::lower(float *vfResult, int32_t &viResult)
+{
+    constexpr uint32_t opcode = Lower >> 25u;
+    constexpr uint8_t dest = static_cast<uint8_t>((Lower >> 21u) & 15u);
+    constexpr uint8_t vfT = static_cast<uint8_t>((Lower >> 16u) & 31u);
+    constexpr uint8_t vfS = static_cast<uint8_t>((Lower >> 11u) & 31u);
+    constexpr uint8_t viT = vfT & 15u;
+    constexpr uint8_t viS = vfS & 15u;
+    constexpr int32_t imm11 = static_cast<int32_t>(Lower << 21u) >> 21;
+    constexpr uint32_t pcMask = 0x3FFFu;
+    constexpr uint32_t relativeTarget = (Pc + 8u + static_cast<uint32_t>(imm11 * 8)) & pcMask;
+    const auto address = [](int32_t qword) PS2_VU_INLINE_LAMBDA {
+        return (static_cast<uint32_t>(qword) * 16u) & 0x3FF0u;
+    };
+    const auto store = [&](uint32_t addr, const uint32_t *words) PS2_VU_INLINE_LAMBDA {
+        uint32_t lanes[4];
+        std::memcpy(lanes, m_data + addr, sizeof(lanes));
+        applyLanes<dest>(lanes, words);
+        std::memcpy(m_data + addr, lanes, sizeof(lanes));
+    };
+    const auto storeVector = [&](uint32_t addr) PS2_VU_INLINE_LAMBDA {
+        uint32_t words[4];
+        std::memcpy(words, m_state.vf[vfS], sizeof(words));
+        store(addr, words);
+    };
+    constexpr uint32_t integerLane = (dest & 8u) ? 0u : (dest & 4u) ? 1u : (dest & 2u) ? 2u : 3u;
+    const auto broadcast = [&](float value) PS2_VU_INLINE_LAMBDA {
+        vfResult[0] = vfResult[1] = vfResult[2] = vfResult[3] = value;
+    };
+
+    if constexpr (Lower == 0u || Lower == 0x8000033Cu)
+        return;
+    else if constexpr (opcode == 0x00u) // LQ
+        std::memcpy(vfResult, m_data + address(m_state.vi[viS] + imm11), 16u);
+    else if constexpr (opcode == 0x01u) // SQ
+        storeVector(address(m_state.vi[viT] + imm11));
+    else if constexpr (opcode == 0x04u) // ILW
+    {
+        uint32_t value;
+        std::memcpy(&value, m_data + address(m_state.vi[viS] + imm11) + integerLane * 4u, 4u);
+        viResult = static_cast<int16_t>(value & 0xFFFFu);
+    }
+    else if constexpr (opcode == 0x05u) // ISW
+    {
+        const uint32_t value = static_cast<uint16_t>(m_state.vi[viT] & 0xFFFF);
+        const uint32_t words[4] = {value, value, value, value};
+        store(address(m_state.vi[viS] + imm11), words);
+    }
+    else if constexpr (opcode == 0x08u || opcode == 0x09u) // IADDIU, ISUBIU
+    {
+        constexpr int32_t imm15 = static_cast<int16_t>((Lower & 0x7FFu) | ((Lower >> 10u) & 0x7800u));
+        viResult = static_cast<int16_t>(opcode == 0x08u ? m_state.vi[viS] + imm15 : m_state.vi[viS] - imm15);
+    }
+    else if constexpr (opcode == 0x10u) // FCEQ
+    {
+        flagsAt();
+        viResult = (m_state.clip & 0xFFFFFFu) == (Lower & 0xFFFFFFu) ? 1 : 0;
+    }
+    else if constexpr (opcode == 0x11u) // FCSET
+    {
+        m_workingClip = Lower & 0xFFFFFFu;
+        cancelSameCycle(8u);
+        pushFlags(8u, m_workingClip, 0u);
+    }
+    else if constexpr (opcode == 0x12u) // FCAND
+    {
+        flagsAt();
+        viResult = (m_state.clip & Lower & 0xFFFFFFu) != 0u ? 1 : 0;
+    }
+    else if constexpr (opcode == 0x13u) // FCOR
+    {
+        flagsAt();
+        viResult = ((m_state.clip | Lower) & 0xFFFFFFu) == 0xFFFFFFu ? 1 : 0;
+    }
+    else if constexpr (opcode >= 0x14u && opcode <= 0x17u) // FSEQ, FSSET, FSAND, FSOR
+    {
+        constexpr uint32_t imm12 = (((Lower >> 21u) & 1u) << 11u) | (Lower & 0x7FFu);
+        if constexpr (opcode == 0x15u)
+        {
+            cancelSameCycle(2u);
+            pushFlags(4u, imm12 & 0xFC0u, 0u);
+            ++m_run.m_fssetQueued;
+        }
+        else
+        {
+            if (qDue())
+                commitQ();
+            flagsAt();
+            const uint32_t status = m_state.status & 0xFFFu;
+            if constexpr (opcode == 0x14u)
+                viResult = status == imm12 ? 1 : 0;
+            else if constexpr (opcode == 0x16u)
+                viResult = static_cast<int32_t>(status & imm12);
+            else
+                viResult = static_cast<int32_t>(status | imm12);
+        }
+    }
+    else if constexpr (opcode == 0x18u || opcode == 0x1Au || opcode == 0x1Bu) // FMEQ, FMAND, FMOR
+    {
+        flagsAt();
+        const uint32_t mask = static_cast<uint16_t>(m_state.vi[viS]);
+        if constexpr (opcode == 0x18u)
+            viResult = (m_state.mac & 0xFFFFu) == mask ? 1 : 0;
+        else if constexpr (opcode == 0x1Au)
+            viResult = static_cast<int32_t>(m_state.mac & mask);
+        else
+            viResult = static_cast<int32_t>(m_state.mac | mask);
+    }
+    else if constexpr (opcode == 0x1Cu) // FCGET
+    {
+        flagsAt();
+        viResult = static_cast<int32_t>(m_state.clip & 0x0FFFu);
+    }
+    else if constexpr (opcode == 0x20u || opcode == 0x21u) // B, BAL
+    {
+        // The interpreter leaves the last taken target in the state; so do we.
+        m_taken = true;
+        m_state.branchTarget = relativeTarget;
+        if constexpr (opcode == 0x21u)
+            viResult = static_cast<int32_t>((Pc + 16u) / 8u);
+    }
+    else if constexpr (opcode == 0x24u || opcode == 0x25u) // JR, JALR
+    {
+        // Register jumps do not use the delayed operand of conditional branches.
+        m_taken = true;
+        m_jumpTarget = (static_cast<uint32_t>(static_cast<uint16_t>(m_state.vi[viS])) * 8u) & pcMask;
+        m_state.branchTarget = m_jumpTarget;
+        if constexpr (opcode == 0x25u)
+            viResult = static_cast<int32_t>((Pc + 16u) / 8u);
+    }
+    else if constexpr (opcode == 0x28u || opcode == 0x29u || (opcode >= 0x2Cu && opcode <= 0x2Fu))
+    {
+        const int16_t s = static_cast<int16_t>(branchVi(viS));
+        if constexpr (opcode == 0x28u) // IBEQ
+            m_taken = s == static_cast<int16_t>(branchVi(viT));
+        else if constexpr (opcode == 0x29u) // IBNE
+            m_taken = s != static_cast<int16_t>(branchVi(viT));
+        else if constexpr (opcode == 0x2Cu) // IBLTZ
+            m_taken = s < 0;
+        else if constexpr (opcode == 0x2Du) // IBGTZ
+            m_taken = s > 0;
+        else if constexpr (opcode == 0x2Eu) // IBLEZ
+            m_taken = s <= 0;
+        else // IBGEZ
+            m_taken = s >= 0;
+        if (m_taken)
+            m_state.branchTarget = relativeTarget;
+    }
+    else if constexpr (opcode == 0x40u)
+    {
+        constexpr uint32_t direct = Lower & 0x3Fu;
+        constexpr uint32_t special = (Lower & 3u) | ((Lower >> 4u) & 0x7Cu);
+        using ps2_vu_detail::upper::normalizeOperand;
+        if constexpr (direct == 0x30u) // IADD
+            viResult = static_cast<int16_t>(m_state.vi[viS] + m_state.vi[viT]);
+        else if constexpr (direct == 0x31u) // ISUB
+            viResult = static_cast<int16_t>(m_state.vi[viS] - m_state.vi[viT]);
+        else if constexpr (direct == 0x32u) // IADDI
+        {
+            constexpr int32_t imm5 = static_cast<int32_t>(((Lower >> 6u) & 0x1Fu) << 27u) >> 27;
+            viResult = static_cast<int16_t>(m_state.vi[viS] + imm5);
+        }
+        else if constexpr (direct == 0x34u) // IAND
+            viResult = m_state.vi[viS] & m_state.vi[viT];
+        else if constexpr (direct == 0x35u) // IOR
+            viResult = m_state.vi[viS] | m_state.vi[viT];
+        else if constexpr (special == 0x30u) // MOVE
+            std::memcpy(vfResult, m_state.vf[vfS], 16u);
+        else if constexpr (special == 0x31u) // MR32
+        {
+            const float *source = m_state.vf[vfS];
+            vfResult[0] = source[1];
+            vfResult[1] = source[2];
+            vfResult[2] = source[3];
+            vfResult[3] = source[0];
+        }
+        else if constexpr (special == 0x34u) // LQI
+        {
+            std::memcpy(vfResult, m_data + address(static_cast<uint16_t>(m_state.vi[viS])), 16u);
+            viResult = static_cast<int16_t>(m_state.vi[viS] + 1);
+        }
+        else if constexpr (special == 0x35u) // SQI
+        {
+            storeVector(address(static_cast<uint16_t>(m_state.vi[viT])));
+            viResult = static_cast<int16_t>(m_state.vi[viT] + 1);
+        }
+        else if constexpr (special == 0x36u) // LQD
+        {
+            const int32_t value = viS != 0u ? static_cast<int16_t>(m_state.vi[viS] - 1) : 0;
+            viResult = value;
+            std::memcpy(vfResult, m_data + address(static_cast<uint16_t>(value)), 16u);
+        }
+        else if constexpr (special == 0x37u) // SQD
+        {
+            const int32_t value = viT != 0u ? static_cast<int16_t>(m_state.vi[viT] - 1) : 0;
+            viResult = value;
+            storeVector(address(static_cast<uint16_t>(value)));
+        }
+        else if constexpr (special == 0x38u || special == 0x39u || special == 0x3Au) // DIV, SQRT, RSQRT
+        {
+            constexpr uint32_t fsf = (Lower >> 21u) & 3u, ftf = (Lower >> 23u) & 3u;
+            if (qDue())
+                commitQ();
+            syncClock();
+            if constexpr (special == 0x38u)
+            {
+                const float num = normalizeOperand(m_state.vf[vfS][fsf]);
+                const float den = normalizeOperand(m_state.vf[vfT][ftf]);
+                uint32_t statusDi = 0u;
+                float result;
+                if (den == 0.0f)
+                {
+                    statusDi = num == 0.0f ? 0x10u : 0x20u;
+                    result = std::signbit(num) != std::signbit(den) ? -std::numeric_limits<float>::max()
+                                                                    : std::numeric_limits<float>::max();
+                }
+                else
+                    result = num / den;
+                uint32_t ignored = 0u;
+                result = ps2_vu_detail::upper::normalizeResult(result, ignored);
+                Access::queueQ(m_run.m_vu, result, 7u, statusDi);
+            }
+            else if constexpr (special == 0x39u)
+            {
+                const float value = normalizeOperand(m_state.vf[vfT][ftf]);
+                Access::queueQ(m_run.m_vu, std::sqrt(std::fabs(value)), 7u, value < 0.0f ? 0x10u : 0u);
+            }
+            else
+            {
+                const float num = normalizeOperand(m_state.vf[vfS][fsf]);
+                const float radicand = normalizeOperand(m_state.vf[vfT][ftf]);
+                const float den = std::sqrt(std::fabs(radicand));
+                uint32_t statusDi = radicand < 0.0f ? 0x10u : 0u;
+                float result;
+                if (den != 0.0f)
+                    result = num / den;
+                else
+                {
+                    statusDi = num == 0.0f ? 0x10u : 0x20u;
+                    result = std::signbit(num) ? -std::numeric_limits<float>::max()
+                                               : std::numeric_limits<float>::max();
+                }
+                uint32_t ignored = 0u;
+                result = ps2_vu_detail::upper::normalizeResult(result, ignored);
+                Access::queueQ(m_run.m_vu, result, 13u, statusDi);
+            }
+        }
+        else if constexpr (special == 0x3Bu || special == 0x7Bu) // WAITQ, WAITP
+        {
+        }
+        else if constexpr (special == 0x3Cu) // MTIR
+        {
+            uint32_t bits;
+            std::memcpy(&bits, &m_state.vf[vfS][(Lower >> 21u) & 3u], 4u);
+            viResult = static_cast<int16_t>(bits & 0xFFFFu);
+        }
+        else if constexpr (special == 0x3Du) // MFIR
+        {
+            const int32_t value = static_cast<int16_t>(m_state.vi[viS] & 0xFFFF);
+            float bits;
+            std::memcpy(&bits, &value, 4u);
+            broadcast(bits);
+        }
+        else if constexpr (special == 0x3Eu) // ILWR
+        {
+            uint32_t value;
+            std::memcpy(&value, m_data + address(static_cast<uint16_t>(m_state.vi[viS])) + integerLane * 4u, 4u);
+            viResult = static_cast<int16_t>(value & 0xFFFFu);
+        }
+        else if constexpr (special == 0x3Fu) // ISWR
+        {
+            const uint32_t value = static_cast<uint16_t>(m_state.vi[viT] & 0xFFFF);
+            const uint32_t words[4] = {value, value, value, value};
+            store(address(static_cast<uint16_t>(m_state.vi[viS])), words);
+        }
+        else if constexpr (special == 0x64u) // MFP
+        {
+            commitP();
+            broadcast(m_state.p);
+        }
+        else if constexpr (special == 0x68u) // XTOP
+            viResult = static_cast<int32_t>(m_state.top & 0x3FFu);
+        else if constexpr (special == 0x69u) // XITOP
+            viResult = static_cast<int32_t>(m_state.itop & 0x3FFu);
+        else if constexpr (special == 0x6Cu) // XGKICK
+        {
+            syncClock();
+            Access::startXgkick(m_run.m_vu, static_cast<uint16_t>(m_state.vi[viS]));
+            m_kickActive = Access::xgkickActive(m_run.m_vu);
+        }
+        else if constexpr (special >= 0x70u && special <= 0x7Du) // EFU
+        {
+            const float *source = m_state.vf[vfS];
+            const float x = normalizeOperand(source[0]), y = normalizeOperand(source[1]);
+            const float z = normalizeOperand(source[2]);
+            const float component = normalizeOperand(source[(Lower >> 21u) & 3u]);
+            float result = 0.0f;
+            uint32_t latency = 0u;
+            if constexpr (special == 0x70u) // ESADD
+            {
+                result = x * x + y * y + z * z;
+                latency = 11u;
+            }
+            else if constexpr (special == 0x71u) // ERSADD
+            {
+                const float sum = x * x + y * y + z * z;
+                result = sum != 0.0f ? 1.0f / sum : sum;
+                latency = 18u;
+            }
+            else if constexpr (special == 0x72u) // ELENG
+            {
+                result = std::sqrt(x * x + y * y + z * z);
+                latency = 18u;
+            }
+            else if constexpr (special == 0x73u) // ERLENG
+            {
+                const float length = std::sqrt(x * x + y * y + z * z);
+                result = length != 0.0f ? 1.0f / length : length;
+                latency = 24u;
+            }
+            else if constexpr (special == 0x74u) // EATANxy
+            {
+                result = x != 0.0f ? ps2_vu_detail::vuEatan(y / x) : 0.0f;
+                latency = 54u;
+            }
+            else if constexpr (special == 0x75u) // EATANxz
+            {
+                result = x != 0.0f ? ps2_vu_detail::vuEatan(z / x) : 0.0f;
+                latency = 54u;
+            }
+            else if constexpr (special == 0x76u) // ESUM
+            {
+                // Summed from 0.0f like the interpreter, which matters when every lane is -0.
+                result = 0.0f + x + y + z + normalizeOperand(source[3]);
+                latency = 12u;
+            }
+            else if constexpr (special == 0x77u) // ERSQRT
+            {
+                result = component;
+                if (result >= 0.0f)
+                {
+                    result = std::sqrt(result);
+                    if (result != 0.0f)
+                        result = 1.0f / result;
+                }
+                latency = 18u;
+            }
+            else if constexpr (special == 0x78u) // ESQRT
+            {
+                result = component >= 0.0f ? std::sqrt(component) : component;
+                latency = 12u;
+            }
+            else if constexpr (special == 0x79u) // ESIN
+            {
+                result = ps2_vu_detail::vuEsin(component);
+                latency = 29u;
+            }
+            else if constexpr (special == 0x7Au) // ERCPR
+            {
+                result = component != 0.0f ? 1.0f / component : component;
+                latency = 12u;
+            }
+            else if constexpr (special == 0x7Cu) // EATAN
+            {
+                result = ps2_vu_detail::vuEatan(component);
+                latency = 54u;
+            }
+            else if constexpr (special == 0x7Du) // EEXP
+            {
+                result = ps2_vu_detail::vuEexp(component);
+                latency = 44u;
+            }
+            else
+                static_assert(special == 0x70u, "unsupported EFU instruction in a compiled VU program");
+            commitP();
+            syncClock();
+            Access::queueP(m_run.m_vu, result, latency);
+        }
+        else
+            static_assert(special == 0x30u, "unsupported lower instruction in a compiled VU program");
+    }
+    else
+        static_assert(opcode == 0x00u, "unsupported lower instruction in a compiled VU program");
+}
+
+}
+#endif
diff --git a/tools/compile_vu_programs.py b/tools/compile_vu_programs.py
new file mode 100644
index 000000000..e50d704df
--- /dev/null
+++ b/tools/compile_vu_programs.py
@@ -0,0 +1,440 @@
+#!/usr/bin/env python3
+"""Compile VU1 microprogram routines to C++ from locally recorded microcode.
+
+Inputs are directories written by a run with PS2_VU_PROGRAM_PROFILE set: 16 KiB
+VU1 code images named vu1-<hash>.code and an entries.txt of "<hash> <pc>"
+lines. A routine is the code reachable from one entry through branches; calls
+and register jumps end it, and their targets become routines of their own.
+The output is generated from game microcode and must stay local.
+"""
+
+import argparse
+import struct
+from pathlib import Path
+
+CODE_SIZE = 16384
+PAIRS = CODE_SIZE // 8
+# Run::kMaxBlockPairs: each block reserves flag queue room for its pairs.
+MAX_BLOCK_PAIRS = 128
+BRANCHES = {0x20, 0x21, 0x24, 0x25, 0x28, 0x29, 0x2C, 0x2D, 0x2E, 0x2F}
+CONDITIONAL = {0x28, 0x29, 0x2C, 0x2D, 0x2E, 0x2F}
+CALLS = {0x21, 0x25}
+REGISTER_JUMPS = {0x24, 0x25}
+LOWER_OPS = {0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15,
+             0x16, 0x17, 0x18, 0x1A, 0x1B, 0x1C} | BRANCHES
+LOWER_DIRECT = {0x30, 0x31, 0x32, 0x34, 0x35}
+LOWER_SPECIAL = {0x30, 0x31, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3D,
+                 0x3E, 0x3F, 0x64, 0x68, 0x69, 0x6C} | set(range(0x70, 0x7E))
+FDIV_SPECIAL = {0x38, 0x39, 0x3A, 0x3B}
+EFU_SPECIAL = set(range(0x70, 0x7E))
+
+
+def upper_supported(upper):
+    op = upper & 0x3F
+    if op <= 0x2F:
+        return True
+    if op < 0x3C:
+        return False
+    special = (upper & 3) | ((upper >> 4) & 0x7C)
+    return special <= 0x2A or special in (0x2C, 0x2D, 0x2E, 0x2F, 0x30)
+
+
+def lower_special(lower):
+    return (lower & 3) | ((lower >> 4) & 0x7C)
+
+
+def lower_supported(lower):
+    if lower in (0, 0x8000033C):
+        return True
+    op = lower >> 25
+    if op in LOWER_OPS:
+        return True
+    if op != 0x40:
+        return False
+    direct = lower & 0x3F
+    if direct in LOWER_DIRECT:
+        return True
+    return direct >= 0x3C and lower_special(lower) in LOWER_SPECIAL
+
+
+class Pair:
+    __slots__ = ("lower", "upper")
+
+    def __init__(self, lower, upper):
+        self.lower = lower
+        self.upper = upper
+
+    @property
+    def immediate(self):
+        return bool(self.upper & 0x80000000)
+
+    @property
+    def ebit(self):
+        return bool(self.upper & 0x40000000)
+
+    @property
+    def op(self):
+        return None if self.immediate else self.lower >> 25
+
+    @property
+    def branch(self):
+        return self.op in BRANCHES
+
+    @property
+    def supported(self):
+        return upper_supported(self.upper) and (self.immediate or lower_supported(self.lower))
+
+    @property
+    def word(self):
+        return self.lower | (self.upper << 32)
+
+    def branch_target(self, index):
+        offset = self.lower & 0x7FF
+        if offset & 0x400:
+            offset -= 0x800
+        return (index + 1 + offset) & (PAIRS - 1)
+
+    def stall_bound(self):
+        """Cycles the pair can take, stalls included, ignoring PATH1 waits."""
+        bound = 5
+        if self.immediate or self.lower >> 25 != 0x40 or (self.lower & 0x3F) < 0x3C:
+            return bound
+        special = lower_special(self.lower)
+        if special in FDIV_SPECIAL:
+            bound += 13
+        if special in EFU_SPECIAL:
+            bound += 54
+        if special == 0x6C:
+            bound += 8192
+        return bound
+
+
+def load_images(directories, parser):
+    images = {}
+    entries = []
+    for directory in directories:
+        listing = directory / "entries.txt"
+        if not listing.is_file():
+            parser.error(f"{directory}: no entries.txt; record with PS2_VU_PROGRAM_PROFILE")
+        for number, line in enumerate(listing.read_text().splitlines(), 1):
+            fields = line.split()
+            if not fields:
+                continue
+            try:
+                name, pc = fields[0], int(fields[1], 16)
+            except (IndexError, ValueError):
+                parser.error(f"{listing}:{number}: expected '<hash> <pc>'")
+            if name not in images:
+                data = (directory / f"vu1-{name}.code").read_bytes()
+                if len(data) != CODE_SIZE:
+                    parser.error(f"{directory}/vu1-{name}.code: expected a 16 KiB VU1 code image")
+                images[name] = [Pair(*struct.unpack_from("<II", data, i)) for i in range(0, CODE_SIZE, 8)]
+            if pc % 8 or pc >= CODE_SIZE:
+                parser.error(f"{listing}:{number}: invalid entry {pc:#x}")
+            entries.append((name, pc // 8))
+    return images, entries
+
+
+def constant_target(pairs, block_start, jump_index):
+    """Resolve a register jump set by IADDIU from VI0 earlier in its block."""
+    reg = (pairs[jump_index].lower >> 11) & 15
+    if reg == 0:
+        return 0
+    for index in range(jump_index - 1, block_start - 1, -1):
+        pair = pairs[index]
+        if pair.immediate:
+            continue
+        lower = pair.lower
+        op = lower >> 25
+        writes = None
+        if op in (0x04, 0x08, 0x09):
+            writes = (lower >> 16) & 15
+        elif op in (0x14, 0x16, 0x17, 0x18, 0x1A, 0x1B, 0x1C):
+            writes = (lower >> 16) & 15
+        elif op in (0x10, 0x12, 0x13):
+            writes = 1
+        elif op == 0x40:
+            direct = lower & 0x3F
+            if direct in (0x30, 0x31, 0x34, 0x35):
+                writes = (lower >> 6) & 15
+            elif direct == 0x32:
+                writes = (lower >> 16) & 15
+            elif direct >= 0x3C:
+                special = lower_special(lower)
+                if special in (0x34, 0x36):
+                    writes = (lower >> 11) & 15
+                elif special in (0x35, 0x37, 0x3C, 0x3E, 0x68, 0x69):
+                    writes = (lower >> 16) & 15
+        if writes != reg:
+            continue
+        if op == 0x08 and (lower >> 11) & 15 == 0:
+            return ((lower & 0x7FF) | ((lower >> 10) & 0x7800)) & (PAIRS - 1)
+        return None
+    return None
+
+
+class Routine:
+    def __init__(self, pairs, entry):
+        self.pairs = pairs
+        self.entry = entry
+        self.blocks = {}   # start -> (pair indices, terminator)
+        self.calls = set() # further routine entries this one can reach
+        self.build()
+
+    def terminates(self, index):
+        """Why the straight line from index cannot simply continue, if at all."""
+        pair = self.pairs[index]
+        if not pair.supported or index + 1 >= PAIRS:
+            return ("leave",)
+        if pair.branch or pair.ebit:
+            delay = self.pairs[index + 1]
+            if not delay.supported or delay.branch or delay.ebit or index + 2 > PAIRS:
+                return ("leave",)
+        return None
+
+    def build(self):
+        leaders = {self.entry}
+        work = [self.entry]
+        visited = set()
+        while work:
+            index = work.pop()
+            while index not in visited:
+                visited.add(index)
+                if self.terminates(index):
+                    break
+                pair = self.pairs[index]
+                if pair.branch:
+                    op = pair.op
+                    targets = []
+                    if op in (0x20,) + tuple(CONDITIONAL):
+                        targets.append(pair.branch_target(index))
+                    if op in CONDITIONAL:
+                        targets.append(index + 2)
+                    if not pair.ebit:
+                        for target in targets:
+                            if target not in leaders:
+                                leaders.add(target)
+                                work.append(target)
+                    break
+                if pair.ebit:
+                    break
+                index += 1
+                if index >= PAIRS:
+                    break
+        pending = sorted(leaders)
+        while pending:
+            start = pending.pop()
+            if start in self.blocks:
+                continue
+            self.blocks[start] = body, terminator = self.walk(start, leaders)
+            # A long straight run was cut; the rest becomes a block of its own.
+            if terminator[0] == "fall" and terminator[1] not in leaders:
+                leaders.add(terminator[1])
+                pending.append(terminator[1])
+
+    def walk(self, start, leaders):
+        body = []
+        index = start
+        while True:
+            # Room for a branch and its delay slot must remain.
+            if len(body) >= MAX_BLOCK_PAIRS - 1:
+                return body, ("fall", index)
+            reason = self.terminates(index)
+            if reason:
+                return body, ("leave", index)
+            pair = self.pairs[index]
+            if pair.branch:
+                body += [index, index + 1]
+                op = pair.op
+                after = index + 2
+                if op in REGISTER_JUMPS:
+                    target = constant_target(self.pairs, start, index)
+                    if op in CALLS:
+                        self.calls.add(after)
+                    if target is not None:
+                        self.calls.add(target)
+                    kind = "call" if op in CALLS else "jump"
+                    return body, (kind, target, pair.ebit)
+                target = pair.branch_target(index)
+                if op == 0x21:
+                    self.calls.update((target, after))
+                    return body, ("call", target, pair.ebit)
+                if pair.ebit:
+                    return body, ("end-branch", target, op in CONDITIONAL, after)
+                if op == 0x20:
+                    return body, ("goto", target)
+                return body, ("cond", target, after)
+            if pair.ebit:
+                body += [index, index + 1]
+                return body, ("end", index + 2)
+            body.append(index)
+            index += 1
+            if index in leaders:
+                return body, ("fall", index)
+
+    def footprint(self):
+        indices = set()
+        for body, terminator in self.blocks.values():
+            indices.update(body)
+            if terminator[0] == "leave":
+                indices.add(terminator[1])
+        return sorted(indices)
+
+    def key(self):
+        return (self.entry, tuple((i, self.pairs[i].word) for i in self.footprint()))
+
+
+def fnv(values):
+    value = 14695981039346656037
+    for item in values:
+        for byte in struct.pack("<Q", item):
+            value = ((value ^ byte) * 1099511628211) & (2**64 - 1)
+    return value
+
+
+def pc(index):
+    return f"0x{(index * 8) & (CODE_SIZE - 1):04X}u"
+
+
+def emit_routine(routine, name):
+    pairs = routine.pairs
+    targets = set()
+    for _, terminator in routine.blocks.values():
+        if terminator[0] in ("fall", "goto"):
+            targets.add(terminator[1])
+        elif terminator[0] == "cond":
+            targets.update(terminator[1:])
+    # Pairs are named by block and position, which lets each one see the pairs
+    # issued before it in the block.
+    tables = []
+    lines = [f"uint32_t {name}(Run &run, uint64_t budgetEnd)", "{", "    Frame p(run, budgetEnd);"]
+    # The entry block comes first; every other block is reached by goto.
+    for start, (body, terminator) in sorted(routine.blocks.items(), key=lambda item: item[0] != routine.entry):
+        table = f"{name}_{start:04x}"
+        if body:
+            words = ", ".join(f"0x{pairs[i].word:016x}ull" for i in body)
+            tables.append(f"constexpr Block<{len(body)}> {table}{{{pc(start)}, {{{words}}}}};")
+
+        def emit_pair(index, next_pc, checked=True):
+            call = f"p.pair<{table}, {index - start}>({next_pc})"
+            # A GIF callback that rewrote microcode sends the rest to the interpreter.
+            return f"    if (!{call}) return p.leaveStale();" if checked else f"    {call};"
+
+        margin = sum(pairs[i].stall_bound() for i in body) + 1
+        if start in targets:
+            lines.append(f"b_{start:04x}:")
+        lines.append(f"    if (!p.fits<{margin}u, {len(body)}u>()) return p.leave({pc(start)});")
+        kind = terminator[0]
+        tail = [] if kind in ("fall", "leave") else body[-2:]
+        for index in body[:len(body) - len(tail)]:
+            lines.append(emit_pair(index, pc(index + 1)))
+        if kind == "leave":
+            lines.append(f"    return p.leave({pc(terminator[1])});")
+            continue
+        if kind == "fall":
+            lines.append(f"    goto b_{terminator[1]:04x};")
+            continue
+
+        first, delay = tail
+        if kind == "end":
+            # Once the delay slot has issued the program is over either way.
+            lines.append(emit_pair(first, pc(delay)))
+            lines.append(emit_pair(delay, pc(terminator[1]), checked=False))
+            lines.append(f"    return p.end({pc(terminator[1])});")
+            continue
+
+        # A branch and its delay slot. The E bit on the branch ends the program
+        # once the delay slot has issued.
+        if kind in ("call", "jump"):
+            target = pc(terminator[1]) if terminator[1] is not None else "p.jumpTarget()"
+            ending = terminator[2]
+        else:
+            target = pc(terminator[1])
+            ending = kind == "end-branch"
+        conditional = kind == "cond" or (kind == "end-branch" and terminator[2])
+        after = f"(p.taken() ? {target} : {pc(delay + 1)})" if conditional else target
+        lines.append(emit_pair(first, pc(delay)))
+        lines.append(emit_pair(delay, after, checked=not ending))
+        if ending:
+            lines.append(f"    return p.end({after});")
+        elif kind in ("call", "jump"):
+            lines.append(f"    return p.exit({after});")
+        elif kind == "goto":
+            lines.append(f"    goto b_{terminator[1]:04x};")
+        else:
+            lines.append(f"    if (p.taken()) goto b_{terminator[1]:04x};")
+            lines.append(f"    goto b_{terminator[2]:04x};")
+    lines.append("}")
+    return tables + lines
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--output", type=Path, required=True,
+                        help="registry include; declarations and shards are written beside it")
+    parser.add_argument("--shards", type=int, default=4)
+    parser.add_argument("profiles", type=Path, nargs="*")
+    args = parser.parse_args()
+    if args.shards < 1:
+        parser.error("--shards must be positive")
+
+    images, entries = load_images(args.profiles, parser)
+    routines = {}
+    for name, entry in entries:
+        pairs = images[name]
+        work, seen = [entry], set()
+        while work:
+            start = work.pop()
+            if start in seen or start >= PAIRS:
+                continue
+            seen.add(start)
+            routine = Routine(pairs, start)
+            routines.setdefault(routine.key(), routine)
+            work.extend(routine.calls)
+
+    output = args.output
+    output.parent.mkdir(parents=True, exist_ok=True)
+    header = "// Generated from local VU1 microcode; do not distribute game data.\n"
+    ordered = sorted(routines.items(), key=lambda item: (item[0][0], fnv(w for _, w in item[0][1])))
+    names = [f"r_{fnv(w for _, w in key[1]):016x}_{i}" for i, (key, _) in enumerate(ordered)]
+
+    registry = [header]
+    externs = [header, "namespace ps2_vu_program::generated\n{\n"]
+    shards = [[header, '#include "ps2_vu1_program.h"\n\n', "namespace ps2_vu_program::generated\n{\n"]
+              for _ in range(args.shards)]
+    # Compile time follows pair count, so fill the lightest shard first,
+    # biggest routines first.
+    load = [0] * args.shards
+    assigned = {}
+    for (key, routine), name in sorted(zip(ordered, names), key=lambda item: (-len(item[0][1].footprint()), item[1])):
+        lightest = load.index(min(load))
+        assigned[name] = lightest
+        load[lightest] += len(routine.footprint())
+    for (key, routine), name in zip(ordered, names):
+        footprint = routine.footprint()
+        externs.append(f"extern const uint16_t {name}_pairs[];\n")
+        externs.append(f"extern const uint64_t {name}_words[];\n")
+        externs.append(f"uint32_t {name}(Run &, uint64_t);\n")
+        registry.append(f"{{{pc(routine.entry)}, {len(footprint)}u, generated::{name}_pairs, "
+                        f"generated::{name}_words, &generated::{name}}},\n")
+        shard = shards[assigned[name]]
+        shard.append(f"extern const uint16_t {name}_pairs[] = {{"
+                     + ", ".join(str(i) for i in footprint) + "};\n")
+        shard.append(f"extern const uint64_t {name}_words[] = {{"
+                     + ", ".join(f"0x{routine.pairs[i].word:016x}ull" for i in footprint) + "};\n")
+        shard.append("\n".join(emit_routine(routine, name)) + "\n\n")
+    externs.append("}\n")
+    for shard in shards:
+        shard.append("}\n")
+
+    output.write_text("".join(registry))
+    output.with_name(output.stem + "_extern.inc").write_text("".join(externs))
+    for index, shard in enumerate(shards):
+        output.with_name(f"{output.stem}_{index}.cpp").write_text("".join(shard))
+    pair_total = sum(len(r.footprint()) for r in routines.values())
+    print(f"compile_vu_programs: {len(routines)} routines, {pair_total} pairs from "
+          f"{len(entries)} entries in {len(images)} images")
+
+
+if __name__ == "__main__":
+    main()

From 1e19e66e78e86b50ebacc1268d49da21471994de Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:32:52 +0200
Subject: [PATCH 61/68] Test compiled VU1 programs against the interpreter

Game microcode cannot go into the repository, so vu_programs.py writes
synthetic programs in the layout a recording has. A few are written out
to reach particular paths (blocks split for length, an E bit on a
branch, a program handed back part-way) and the rest come from a seeded
generator mixing what the compiler accepts inside counted loops, forward
branches, calls and register jumps.

ps2_vu1_program_tests.cpp runs each of them compiled and interpreted,
whole, and then stopped by budgets the program outlasts and resumed in
uneven slices, comparing state, VU memory and GIF packets each time.
PS2_VU_PROGRAM_FIXTURES names the programs; without it the test has
nothing to run. PS2_VU_REQUIRE_PROGRAMS makes a missing routine a
failure.

Writing it turned up two bugs, fixed in the compiler itself: P could
take an older EFU result after three EFU operations in a row, and a
routine lookup could be answered from a cache entry left by another
interpreter whose code happened to sit at the same address.

test_compile_vu_programs.py covers how the generator cuts code into
routines and blocks.
---
 ps2xTest/CMakeLists.txt                 |   1 +
 ps2xTest/data/README.md                 |  10 +
 ps2xTest/data/vu_programs.py            | 423 ++++++++++++++++++++++++
 ps2xTest/src/main.cpp                   |   2 +
 ps2xTest/src/ps2_vu1_program_tests.cpp  | 330 ++++++++++++++++++
 tools/tests/test_compile_vu_programs.py | 119 +++++++
 6 files changed, 885 insertions(+)
 create mode 100644 ps2xTest/data/vu_programs.py
 create mode 100644 ps2xTest/src/ps2_vu1_program_tests.cpp
 create mode 100644 tools/tests/test_compile_vu_programs.py

diff --git a/ps2xTest/CMakeLists.txt b/ps2xTest/CMakeLists.txt
index bd2580b5a..20ed2ac30 100644
--- a/ps2xTest/CMakeLists.txt
+++ b/ps2xTest/CMakeLists.txt
@@ -54,6 +54,7 @@ add_library(ps2_test_lib STATIC
     src/ps2_memory_tests.cpp
     src/ps2_vu1_tests.cpp
     src/ps2_vu1_upper_engine_tests.cpp
+    src/ps2_vu1_program_tests.cpp
     src/ps2_vu_tests.cpp
     src/ps2_gs_tests.cpp
     src/ps2_iop_tests.cpp
diff --git a/ps2xTest/data/README.md b/ps2xTest/data/README.md
index b547eb9d8..7284ebc17 100644
--- a/ps2xTest/data/README.md
+++ b/ps2xTest/data/README.md
@@ -17,5 +17,15 @@ to generate native instantiations and a dispatch registry. Its
 profiles and code images. The profile format contains instruction records only,
 so provenance is documented here rather than inside the fixture files.
 
+[`vu_programs.py`](vu_programs.py) writes synthetic VU1 programs in the layout
+a `PS2_VU_PROGRAM_PROFILE` recording has, for the whole-program compiler. A few
+are written out by hand to reach particular paths; the rest come from a seeded
+generator, so every run writes the same programs. Build the runtime with
+`PS2X_VU_PROGRAM_PROFILES` pointing at the output and set
+`PS2_VU_PROGRAM_FIXTURES` to the same directory to run them through
+[`ps2_vu1_program_tests.cpp`](../src/ps2_vu1_program_tests.cpp), which compares
+each program compiled and interpreted at several cycle budgets.
+`PS2_VU_REQUIRE_PROGRAMS=1` makes a program without a compiled routine fail.
+
 Runtime captures, game code images, snapshots, and native sources generated from
 game inputs remain local build artifacts. Do not add them to this directory.
diff --git a/ps2xTest/data/vu_programs.py b/ps2xTest/data/vu_programs.py
new file mode 100644
index 000000000..97b592051
--- /dev/null
+++ b/ps2xTest/data/vu_programs.py
@@ -0,0 +1,423 @@
+#!/usr/bin/env python3
+"""Write synthetic VU1 programs as a program profile, to test compiled routines.
+
+usage: vu_programs.py DIRECTORY
+
+DIRECTORY gets the layout a run with PS2_VU_PROGRAM_PROFILE records: 16 KiB
+vu1-<hash>.code images and an entries.txt. Build the runtime with
+PS2X_VU_PROGRAM_PROFILES=DIRECTORY to compile the programs, then run the VU
+tests with PS2_VU_PROGRAM_FIXTURES=DIRECTORY: ps2_vu1_program_tests.cpp runs
+every entry both compiled and interpreted and compares the two.
+
+A few programs are written out to reach particular paths: blocks split for
+length, an E bit on a branch, a program the compiler hands back part-way. The
+rest come from a seeded generator that mixes the instructions the compiler
+accepts inside counted loops, forward branches, calls and register jumps.
+They rely on what the test sets up: VI registers start at zero, data memory
+holds floats, and qword 0x3F0 holds a GIF packet for XGKICK.
+"""
+
+import random
+import struct
+import sys
+from pathlib import Path
+
+CODE_SIZE = 16384
+PAIRS = CODE_SIZE // 8
+LOWER_NOP = 0x8000033C
+UPPER_NOP = 0x000002FF
+E_BIT = 1 << 30
+I_BIT = 1 << 31
+XYZ = 0b1110
+
+# Registers with fixed jobs, so that loops end and addresses stay in range.
+# Generated integer code writes only VI2-VI7, and FCAND and friends VI1.
+SCRATCH = (2, 3, 4, 5, 6, 7)
+COUNTERS = (8, 9)  # loop counters, by nesting depth
+POINTER = 10       # LQI/SQI/LQD/SQD base, reset before each loop
+KICK = 11          # XGKICK address
+BASE = 12          # LQ/SQ/ILW/ISW base
+TARGET = 13        # JALR target
+FIXED = 14         # set once by a hand-written program
+LINK = 15
+
+KICK_QWORD = 0x3F0  # the test's GIF packet
+BASE_QWORD = 0x40
+POINTER_QWORD = 0x100
+
+# Upper opcodes 0x00-0x2F: ADD, SUB, MADD, MSUB, MAX, MINI and MUL in their
+# broadcast, Q and I forms, then the three-register ones. OPMSUB is left to
+# outer_product(), which pairs it with OPMULA.
+VECTOR_OPS = [op for op in range(0x30) if op != 0x2E]
+# Special upper opcodes that write ACC: the A forms of the above.
+ACC_OPS = [*range(0x10), *range(0x18, 0x1D), 0x1E, *range(0x20, 0x2B), 0x2C, 0x2D]
+# EFU operations on a vector, with the fields each one reads, and on one field.
+EFU_VECTOR = ((0x70, XYZ), (0x71, XYZ), (0x72, XYZ), (0x73, XYZ), (0x74, 0b1100), (0x75, 0b1010), (0x76, 0b1111))
+EFU_SCALAR = (0x78, 0x79, 0x7A, 0x7C, 0x7D)
+
+FLOATS = (0.0, -0.0, 1.0, -1.0, 0.5, -2.5, 3.0, 1000.0, 1e-30, 1e30, 3.4e38, -3.4e38)
+# Bit patterns without a PS2 float meaning: infinities, NaN, a denormal.
+RAW_FLOATS = (0x7F800000, 0xFF800000, 0x7FC00000, 0x00000001, 0x7FFFFFFF)
+
+
+def upper(op, dest, ft, fs, fd):
+    return (dest << 21) | (ft << 16) | (fs << 11) | (fd << 6) | op
+
+
+def upper_special(op, dest, ft, fs):
+    return (dest << 21) | (ft << 16) | (fs << 11) | ((op & 0x7C) << 4) | (op & 3) | 0x3C
+
+
+def lower_special(op, is_=0, it=0, dest=0):
+    return (0x40 << 25) | (dest << 21) | (it << 16) | (is_ << 11) | ((op & 0x7C) << 4) | (op & 3) | 0x3C
+
+
+def lower_direct(funct, is_, it, id_):
+    return (0x40 << 25) | (it << 16) | (is_ << 11) | (id_ << 6) | funct
+
+
+def immediate15(op, it, is_, value):
+    """IADDIU and ISUBIU, whose 15-bit immediate is split around the dest field."""
+    return (op << 25) | (((value >> 11) & 15) << 21) | (it << 16) | (is_ << 11) | (value & 0x7FF)
+
+
+def memory(op, dest, t, s, offset):
+    return (op << 25) | (dest << 21) | (t << 16) | (s << 11) | (offset & 0x7FF)
+
+
+def branch(op, it=0, is_=0, offset=0):
+    return (op << 25) | (it << 16) | (is_ << 11) | (offset & 0x7FF)
+
+
+def flag_immediate(op, it, value):
+    return (op << 25) | (((value >> 11) & 1) << 21) | (it << 16) | (value & 0x7FF)
+
+
+def flag_register(op, it, is_=0):
+    return (op << 25) | (it << 16) | (is_ << 11)
+
+
+class Program:
+    """Pairs laid out from an entry. Branch offsets are patched in once the
+    target is known."""
+
+    def __init__(self, entry):
+        self.entry = entry
+        self.pairs = []
+
+    @property
+    def next(self):
+        return self.entry + len(self.pairs)
+
+    def add(self, lower=LOWER_NOP, upper_word=UPPER_NOP):
+        self.pairs.append([lower, upper_word])
+        return self.next - 1
+
+    def patch_branch(self, index, target):
+        pair = self.pairs[index - self.entry]
+        pair[0] = (pair[0] & ~0x7FF) | ((target - index - 1) & 0x7FF)
+
+    def patch_immediate(self, index, value):
+        pair = self.pairs[index - self.entry]
+        pair[0] = immediate15(pair[0] >> 25, (pair[0] >> 16) & 15, (pair[0] >> 11) & 15, value)
+
+
+class Subroutine:
+    def __init__(self):
+        self.calls = []  # BAL pairs to point at it
+        self.loads = []  # IADDIU pairs that load its address for JALR
+
+
+class Generator:
+    def __init__(self, seed):
+        self.random = random.Random(seed)
+
+    def vf(self):
+        return self.random.randrange(32)
+
+    def written_vf(self):
+        return self.random.randrange(1, 32)
+
+    def vi(self):
+        return self.random.choice((0, 1) + SCRATCH)
+
+    def dest(self):
+        return self.random.choice((15, 15, 15, 14, 12, 8, 4, 2, 1, 3, 7, 11, 13))
+
+    def lane(self):
+        return self.random.randrange(4)
+
+    def float_bits(self):
+        if self.random.random() < 0.15:
+            return self.random.choice(RAW_FLOATS)
+        value = self.random.choice(FLOATS) if self.random.random() < 0.4 else self.random.uniform(-200.0, 200.0)
+        return struct.unpack("<I", struct.pack("<f", value))[0]
+
+    def upper(self):
+        """A random upper instruction and the VF register it writes, if any."""
+        kind = self.random.choices(("nop", "vector", "acc", "convert", "abs", "clip"), (12, 50, 16, 8, 3, 6))[0]
+        dest = self.dest()
+        if kind == "vector":
+            fd = self.written_vf()
+            return upper(self.random.choice(VECTOR_OPS), dest, self.vf(), self.vf(), fd), fd
+        if kind == "acc":
+            return upper_special(self.random.choice(ACC_OPS), dest, self.vf(), self.vf()), None
+        if kind in ("convert", "abs"):
+            ft = self.written_vf()
+            op = self.random.randrange(0x10, 0x18) if kind == "convert" else 0x1D
+            return upper_special(op, dest, ft, self.vf()), ft
+        if kind == "clip":
+            return upper_special(0x1F, XYZ, self.vf(), self.vf()), None
+        return UPPER_NOP, None
+
+    def lower(self, avoid=None):
+        """A random lower instruction that neither branches nor writes VF avoid."""
+        while True:
+            word, writes = self.any_lower()
+            if writes is None or writes != avoid:
+                return word
+
+    def any_lower(self):
+        r = self.random
+        kind = r.choices(
+            ("nop", "integer", "load", "store", "stream", "integer memory", "move", "transfer",
+             "fdiv", "waitq", "efu", "waitp", "mfp", "status", "mac", "clip", "xtop", "kick"),
+            (14, 14, 7, 5, 5, 4, 5, 4, 4, 1, 4, 1, 2, 3, 3, 3, 1, 1))[0]
+        dest = self.dest()
+        if kind == "integer":
+            target = r.choice(SCRATCH)
+            form = r.randrange(4)
+            if form == 0:
+                return lower_direct(r.choice((0x30, 0x31, 0x34, 0x35)), self.vi(), self.vi(), target), None
+            if form == 1:
+                return lower_direct(0x32, self.vi(), target, r.randrange(32)), None  # IADDI
+            return immediate15(r.choice((0x08, 0x09)), target, self.vi(), r.randrange(2048)), None
+        if kind == "load":
+            ft = self.written_vf()
+            return memory(0x00, dest, ft, BASE, r.randrange(64)), ft
+        if kind == "store":
+            return memory(0x01, dest, BASE, self.vf(), r.randrange(64)), None
+        if kind == "stream":
+            op = r.choice((0x34, 0x35, 0x36, 0x37))  # LQI, SQI, LQD, SQD
+            if op in (0x34, 0x36):
+                ft = self.written_vf()
+                return lower_special(op, POINTER, ft, dest), ft
+            return lower_special(op, self.vf(), POINTER, dest), None
+        if kind == "integer memory":
+            one = 8 >> self.lane()
+            form = r.randrange(4)
+            if form == 0:
+                return memory(0x04, one, r.choice(SCRATCH), BASE, r.randrange(64)), None  # ILW
+            if form == 1:
+                return memory(0x05, dest, self.vi(), BASE, r.randrange(64)), None     # ISW
+            if form == 2:
+                return lower_special(0x3E, BASE, r.choice(SCRATCH), one), None       # ILWR
+            return lower_special(0x3F, BASE, self.vi(), dest), None                  # ISWR
+        if kind == "move":
+            ft = self.written_vf()
+            return lower_special(r.choice((0x30, 0x31)), self.vf(), ft, dest), ft  # MOVE, MR32
+        if kind == "transfer":
+            if r.random() < 0.5:
+                return lower_special(0x3C, self.vf(), r.choice(SCRATCH), self.lane()), None  # MTIR
+            ft = self.written_vf()
+            return lower_special(0x3D, self.vi(), ft, dest), ft  # MFIR
+        if kind == "fdiv":
+            op = r.choice((0x38, 0x39, 0x3A))  # DIV, SQRT, RSQRT
+            fields = (self.lane() << 2) | (self.lane() if op != 0x39 else 0)
+            return lower_special(op, self.vf() if op != 0x39 else 0, self.vf(), fields), None
+        if kind == "waitq":
+            return lower_special(0x3B), None
+        if kind == "efu":
+            if r.random() < 0.5:
+                op, fields = r.choice(EFU_VECTOR)
+                return lower_special(op, self.vf(), 0, fields), None
+            return lower_special(r.choice(EFU_SCALAR), self.vf(), 0, self.lane()), None
+        if kind == "waitp":
+            return lower_special(0x7B), None
+        if kind == "mfp":
+            ft = self.written_vf()
+            return lower_special(0x64, 0, ft, dest), ft
+        if kind == "status":
+            op = r.choice((0x14, 0x15, 0x16, 0x17))  # FSEQ, FSSET, FSAND, FSOR
+            return flag_immediate(op, r.choice(SCRATCH) if op != 0x15 else 0, r.randrange(4096)), None
+        if kind == "mac":
+            return flag_register(r.choice((0x18, 0x1A, 0x1B)), r.choice(SCRATCH), self.vi()), None
+        if kind == "clip":
+            if r.random() < 0.25:
+                return flag_register(0x1C, r.choice(SCRATCH)), None  # FCGET
+            return (r.choice((0x10, 0x11, 0x12, 0x13)) << 25) | r.randrange(1 << 24), None
+        if kind == "xtop":
+            return lower_special(r.choice((0x68, 0x69)), 0, r.choice(SCRATCH)), None
+        if kind == "kick":
+            return lower_special(0x6C, KICK), None
+        return LOWER_NOP, None
+
+    def pair(self, program):
+        word, writes = self.upper()
+        if self.random.random() < 0.06:
+            return program.add(self.float_bits(), word | I_BIT)
+        return program.add(self.lower(writes), word)
+
+    def outer_product(self, program):
+        fs, ft, fd = self.vf(), self.vf(), self.written_vf()
+        program.add(self.lower(), upper_special(0x2E, XYZ, ft, fs))
+        program.add(self.lower(fd), upper(0x2E, XYZ, fs, ft, fd))
+
+    def straight(self, program, count):
+        for _ in range(count):
+            if self.random.random() < 0.04:
+                self.outer_product(program)
+            else:
+                self.pair(program)
+
+    def body(self, program, items, depth, subroutines=()):
+        for _ in range(items):
+            roll = self.random.random()
+            if roll < 0.08 and depth < len(COUNTERS):
+                self.loop(program, depth, subroutines)
+            elif roll < 0.16:
+                self.skip(program, depth, subroutines)
+            elif roll < 0.20 and subroutines:
+                self.call(program, self.random.choice(subroutines))
+            else:
+                self.straight(program, self.random.randint(1, 4))
+
+    def loop(self, program, depth, subroutines):
+        counter = COUNTERS[depth]
+        program.add(immediate15(0x08, counter, 0, self.random.randint(1, 8 if depth == 0 else 4)), self.upper()[0])
+        program.add(immediate15(0x08, POINTER, 0, POINTER_QWORD), self.upper()[0])
+        head = program.next
+        self.body(program, self.random.randint(3, 12), depth + 1, subroutines)
+        program.add(immediate15(0x09, counter, counter, 1), self.upper()[0])
+        # Sometimes the branch reads the counter straight after the decrement.
+        if self.random.random() < 0.5:
+            self.pair(program)
+        at = program.add(branch(0x29, 0, counter), self.upper()[0])  # IBNE
+        program.patch_branch(at, head)
+        self.pair(program)
+
+    def skip(self, program, depth, subroutines):
+        op = self.random.choice((0x20, 0x28, 0x29, 0x2C, 0x2D, 0x2E, 0x2F))
+        at = program.add(branch(op, self.vi(), self.vi()), self.upper()[0])
+        self.pair(program)
+        self.body(program, self.random.randint(1, 4), depth, subroutines)
+        program.patch_branch(at, program.next)
+
+    def call(self, program, subroutine):
+        if self.random.random() < 0.5:
+            subroutine.calls.append(program.add(branch(0x21, LINK), self.upper()[0]))  # BAL
+        else:
+            subroutine.loads.append(program.add(immediate15(0x08, TARGET, 0, 0), self.upper()[0]))
+            self.straight(program, self.random.randint(0, 2))
+            program.add(branch(0x25, LINK, TARGET), self.upper()[0])  # JALR
+        self.pair(program)
+
+    def end(self, program):
+        word, writes = self.upper()
+        program.add(self.lower(writes), word | E_BIT)
+        self.pair(program)
+
+    def start(self, entry):
+        """A program that has set up the registers generated code addresses through."""
+        program = Program(entry)
+        program.add(immediate15(0x08, KICK, 0, KICK_QWORD), self.upper()[0])
+        program.add(immediate15(0x08, BASE, 0, BASE_QWORD), self.upper()[0])
+        program.add(immediate15(0x08, POINTER, 0, POINTER_QWORD), self.upper()[0])
+        return program
+
+    def program(self, entry):
+        program = self.start(entry)
+        subroutines = [Subroutine() for _ in range(self.random.randint(0, 2))]
+        self.body(program, self.random.randint(12, 40), 0, subroutines)
+        self.end(program)
+        for subroutine in subroutines:
+            start = program.next
+            self.body(program, self.random.randint(2, 6), len(COUNTERS))
+            program.add(branch(0x24, 0, LINK), self.upper()[0])  # JR
+            self.pair(program)
+            for at in subroutine.calls:
+                program.patch_branch(at, start)
+            for at in subroutine.loads:
+                program.patch_immediate(at, start)
+        return program
+
+
+def long_straight(generator):
+    """Past the compiler's block size, so the run is cut into several blocks."""
+    program = generator.start(0)
+    generator.straight(program, 300)
+    generator.end(program)
+    return program
+
+
+def branch_with_e_bit(generator, taken):
+    """The E bit on a conditional branch ends the program after the delay slot."""
+    program = generator.start(40)
+    generator.straight(program, 8)
+    program.add(immediate15(0x08, FIXED, 0, 1 if taken else 0))
+    generator.straight(program, 3)
+    at = program.add(branch(0x29, 0, FIXED), UPPER_NOP | E_BIT)  # IBNE
+    generator.pair(program)
+    generator.straight(program, 4)
+    program.patch_branch(at, program.next)
+    generator.end(program)
+    return program
+
+
+def handed_back(generator):
+    """RINIT is not compiled, so the program returns to the interpreter there."""
+    program = generator.start(100)
+    program.add(immediate15(0x08, 8, 0, 5))
+    head = program.next
+    generator.straight(program, 12)
+    program.add(lower_special(0x42, 1, 0, 0), UPPER_NOP)  # RINIT R, VF1x
+    generator.straight(program, 12)
+    program.add(immediate15(0x09, 8, 8, 1))
+    at = program.add(branch(0x29, 0, 8))
+    program.patch_branch(at, head)
+    generator.pair(program)
+    generator.end(program)
+    return program
+
+
+def image(programs):
+    words = [(LOWER_NOP, UPPER_NOP)] * PAIRS
+    for program in programs:
+        if program.entry + len(program.pairs) > PAIRS:
+            raise ValueError(f"program at {program.entry * 8:#x} runs past the end of VU1 code memory")
+        for index, pair in enumerate(program.pairs, program.entry):
+            words[index] = tuple(pair)
+    return b"".join(struct.pack("<II", lower, upper_word) for lower, upper_word in words)
+
+
+def fnv(data):
+    value = 14695981039346656037
+    for byte in data:
+        value = ((value ^ byte) * 1099511628211) & (2**64 - 1)
+    return value
+
+
+def main():
+    if len(sys.argv) != 2:
+        sys.exit(__doc__)
+    output = Path(sys.argv[1])
+    output.mkdir(parents=True, exist_ok=True)
+    images = [[long_straight(Generator(1))],
+              [branch_with_e_bit(Generator(2), True), handed_back(Generator(3))],
+              [branch_with_e_bit(Generator(4), False)]]
+    # Two generated programs per image, at entries the layout leaves free.
+    for seed in range(100, 124, 2):
+        first = Generator(seed).program(0)
+        second = Generator(seed + 1).program(first.next + 16)
+        images.append([first, second])
+    lines = []
+    for programs in images:
+        code = image(programs)
+        name = f"{fnv(code):016x}"
+        (output / f"vu1-{name}.code").write_bytes(code)
+        lines += [f"{name} {program.entry * 8:x}" for program in programs]
+    (output / "entries.txt").write_text("\n".join(lines) + "\n")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ps2xTest/src/main.cpp b/ps2xTest/src/main.cpp
index 98edd8389..1dc1e2b9c 100644
--- a/ps2xTest/src/main.cpp
+++ b/ps2xTest/src/main.cpp
@@ -13,6 +13,7 @@ void register_ee_fiber_tests();
 void register_ps2_memory_tests();
 void register_ps2_vu1_tests();
 void register_ps2_vu1_upper_engine_tests();
+void register_ps2_vu1_program_tests();
 void register_ps2_vu_tests();
 void register_ps2_gs_tests();
 void register_ps2_iop_tests();
@@ -37,6 +38,7 @@ int main()
     register_ps2_memory_tests();
     register_ps2_vu1_tests();
     register_ps2_vu1_upper_engine_tests();
+    register_ps2_vu1_program_tests();
     register_ps2_vu_tests();
     register_ps2_gs_tests();
     register_ps2_iop_tests();
diff --git a/ps2xTest/src/ps2_vu1_program_tests.cpp b/ps2xTest/src/ps2_vu1_program_tests.cpp
new file mode 100644
index 000000000..b93b9a6f3
--- /dev/null
+++ b/ps2xTest/src/ps2_vu1_program_tests.cpp
@@ -0,0 +1,330 @@
+#include "MiniTest.h"
+#include "runtime/gs/gs_frontend.h"
+#include "runtime/gs/gs_types.h"
+#include "runtime/ps2_memory.h"
+#include "runtime/ps2_vu1.h"
+#include "../../ps2xRuntime/src/lib/vu/ps2_vu1_program.h"
+
+#include <algorithm>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <fstream>
+#include <sstream>
+#include <string>
+#include <tuple>
+#include <vector>
+
+// Compiled VU1 routines against the interpreter, on the vu_programs.py programs
+// the runtime was built with, named by PS2_VU_PROGRAM_FIXTURES. With
+// PS2_VU_REQUIRE_PROGRAMS, an entry without a routine fails.
+
+namespace
+{
+    constexpr uint32_t kWideBudget = 65536u;
+    constexpr uint32_t kKickQword = 0x3F0u;
+
+    struct ProgramEntry
+    {
+        std::string name;
+        uint32_t pc = 0u;
+        std::vector<uint8_t> code;
+    };
+
+    std::vector<ProgramEntry> loadEntries(std::string &error)
+    {
+        std::vector<ProgramEntry> entries;
+        const char *list = std::getenv("PS2_VU_PROGRAM_FIXTURES");
+        std::stringstream directories(list ? list : "");
+        std::string directory;
+        while (std::getline(directories, directory, ';'))
+        {
+            if (directory.empty())
+                continue;
+            std::ifstream listing(directory + "/entries.txt");
+            if (!listing)
+            {
+                error = "cannot read " + directory + "/entries.txt";
+                return {};
+            }
+            ProgramEntry entry;
+            while (listing >> entry.name >> std::hex >> entry.pc)
+            {
+                std::ifstream image(directory + "/vu1-" + entry.name + ".code", std::ios::binary);
+                entry.code.assign(PS2_VU1_CODE_SIZE, 0u);
+                if (!image.read(reinterpret_cast<char *>(entry.code.data()), PS2_VU1_CODE_SIZE))
+                {
+                    error = "cannot read the code image " + entry.name;
+                    return {};
+                }
+                entries.push_back(entry);
+            }
+        }
+        return entries;
+    }
+
+    // Ordinary values, with zeros, a host denormal and a huge value mixed in.
+    float pattern(uint32_t n)
+    {
+        switch (n % 16u)
+        {
+        case 3u:
+            return 0.0f;
+        case 7u:
+            return -0.0f;
+        case 10u:
+            return 1e-39f;
+        case 13u:
+            return 3.0e38f;
+        default:
+            return (static_cast<float>(n % 29u) - 14.0f) * 0.625f + static_cast<float>(n / 16u);
+        }
+    }
+
+    VU1State initialState()
+    {
+        VU1State state{};
+        for (uint32_t reg = 1u; reg < 32u; ++reg)
+            for (uint32_t lane = 0u; lane < 4u; ++lane)
+                state.vf[reg][lane] = pattern(reg * 4u + lane);
+        state.vf[0][3] = 1.0f;
+        // Only FMAC results reach ACC, so it never holds a denormal, an
+        // infinity or a NaN, and the compiled product sums rely on that.
+        const float acc[4] = {-7.25f, 0.0f, 3.0e38f, -0.0f};
+        std::memcpy(state.acc, acc, sizeof(acc));
+        state.q = 1.5f;
+        state.p = 0.75f;
+        state.i = 2.0f;
+        state.r = 0x3F812345u;
+        return state;
+    }
+
+    // Floats everywhere but the GIF packet the programs kick.
+    std::vector<uint8_t> initialData()
+    {
+        std::vector<uint8_t> data(PS2_VU1_DATA_SIZE, 0u);
+        for (uint32_t qword = 0u; qword < kKickQword; ++qword)
+            for (uint32_t lane = 0u; lane < 4u; ++lane)
+            {
+                const float value = pattern(1000u + qword * 4u + lane);
+                std::memcpy(&data[qword * 16u + lane * 4u], &value, sizeof(value));
+            }
+        const uint64_t tag = 2u | (1ull << 15) | (static_cast<uint64_t>(GIF_FMT_IMAGE) << 58);
+        std::memcpy(&data[kKickQword * 16u], &tag, sizeof(tag));
+        for (uint32_t byte = 0u; byte < 32u; ++byte)
+            data[(kKickQword + 1u) * 16u + byte] = static_cast<uint8_t>(0xA0u + byte);
+        return data;
+    }
+
+    struct Side
+    {
+        PS2Memory mem;
+        GS gs;
+        VU1Interpreter vu;
+        std::vector<std::vector<uint8_t>> packets;
+
+        bool initialize(const std::vector<uint8_t> &code, bool compiled)
+        {
+            if (!mem.initialize())
+                return false;
+            gs.init(mem.getGSVRAM(), static_cast<uint32_t>(PS2_GS_VRAM_SIZE), &mem.gs());
+            std::memcpy(mem.getVU1Code(), code.data(), PS2_VU1_CODE_SIZE);
+            mem.markVU1CodeModified();
+            mem.setGifPacketCallback([this](const uint8_t *data, uint32_t size)
+                                     { packets.emplace_back(data, data + size); });
+            vu.setCompiledExecutionEnabled(compiled);
+            return true;
+        }
+
+        void reset(const VU1State &initial, const std::vector<uint8_t> &data)
+        {
+            vu.reset();
+            vu.state() = initial;
+            std::memcpy(mem.getVU1Data(), data.data(), PS2_VU1_DATA_SIZE);
+            packets.clear();
+        }
+
+        void start(uint32_t pc, uint32_t cycles)
+        {
+            vu.execute(mem.getVU1Code(), PS2_VU1_CODE_SIZE, mem.getVU1Data(), PS2_VU1_DATA_SIZE, gs, &mem,
+                       pc, 0u, 0u, cycles);
+        }
+
+        void resume(uint32_t cycles)
+        {
+            vu.resume(mem.getVU1Code(), PS2_VU1_CODE_SIZE, mem.getVU1Data(), PS2_VU1_DATA_SIZE, gs, &mem,
+                      0u, 0u, cycles);
+        }
+
+        uint64_t cycles() const { return vu.state().cycles; }
+    };
+
+    bool same(Side &native, Side &oracle)
+    {
+        return std::memcmp(&native.vu.state(), &oracle.vu.state(), sizeof(VU1State)) == 0 &&
+               std::memcmp(native.mem.getVU1Data(), oracle.mem.getVU1Data(), PS2_VU1_DATA_SIZE) == 0 &&
+               native.packets == oracle.packets;
+    }
+
+    std::string describe(const ProgramEntry &entry, uint64_t budget, const Side &oracle)
+    {
+        std::ostringstream text;
+        text << entry.name << " entry 0x" << std::hex << entry.pc << std::dec << ", budget " << budget
+             << ", cycle " << oracle.cycles();
+        return text.str();
+    }
+
+    // What differs, compiled first, so that a failure says where to look.
+    std::string difference(Side &native, Side &oracle)
+    {
+        const VU1State &a = native.vu.state(), &b = oracle.vu.state();
+        std::ostringstream text;
+        const auto differs = [](const void *x, const void *y, size_t size) { return std::memcmp(x, y, size) != 0; };
+        const auto both = [&](const char *name, uint64_t x, uint64_t y) {
+            if (x != y)
+                text << ' ' << name << " 0x" << std::hex << x << "/0x" << y << std::dec;
+        };
+        both("pc", a.pc, b.pc);
+        both("cycles", a.cycles, b.cycles);
+        both("mac", a.mac, b.mac);
+        both("status", a.status, b.status);
+        both("clip", a.clip, b.clip);
+        both("ebit", a.ebit, b.ebit);
+        both("branch", a.branchPending, b.branchPending);
+        both("target", a.branchTarget, b.branchTarget);
+        both("delay", a.branchDelay, b.branchDelay);
+        bool shown = false;
+        for (uint32_t reg = 0u; reg < 32u; ++reg)
+            if (differs(a.vf[reg], b.vf[reg], sizeof(a.vf[reg])))
+            {
+                text << " vf" << reg;
+                // The first one in full, as bit patterns.
+                for (const VU1State *state : {shown ? nullptr : &a, shown ? nullptr : &b})
+                    if (state)
+                    {
+                        uint32_t bits[4];
+                        std::memcpy(bits, state->vf[reg], sizeof(bits));
+                        text << (state == &a ? " (" : " / ") << std::hex << bits[0] << ' ' << bits[1] << ' '
+                             << bits[2] << ' ' << bits[3] << std::dec << (state == &a ? "" : ")");
+                    }
+                shown = true;
+            }
+        for (uint32_t reg = 0u; reg < 16u; ++reg)
+            both(("vi" + std::to_string(reg)).c_str(), static_cast<uint32_t>(a.vi[reg]), static_cast<uint32_t>(b.vi[reg]));
+        if (differs(a.acc, b.acc, sizeof(a.acc)))
+            text << " acc";
+        for (const auto &[name, x, y] : {std::tuple{"q", &a.q, &b.q}, {"p", &a.p, &b.p}, {"i", &a.i, &b.i}})
+            if (differs(x, y, sizeof(float)))
+                text << ' ' << name;
+        for (uint32_t qword = 0u; qword < PS2_VU1_DATA_SIZE / 16u; ++qword)
+            if (differs(native.mem.getVU1Data() + qword * 16u, oracle.mem.getVU1Data() + qword * 16u, 16u))
+            {
+                text << " data qword 0x" << std::hex << qword << std::dec;
+                break;
+            }
+        both("packets", native.packets.size(), oracle.packets.size());
+        return text.str();
+    }
+
+    // Record a failure like IsTrue, and say whether to go on: after the first
+    // difference the rest of an entry only repeats it.
+    bool check(TestCase &t, bool condition, const std::string &message)
+    {
+        t.IsTrue(condition, message);
+        return condition;
+    }
+
+    bool matches(TestCase &t, Side &native, Side &oracle, const std::string &message)
+    {
+        if (same(native, oracle))
+            return true;
+        t.Fail(message + " (compiled/interpreted:" + difference(native, oracle) + ")");
+        return false;
+    }
+
+    void checkEntry(TestCase &t, const ProgramEntry &entry, bool require)
+    {
+        Side native, oracle;
+        if (!native.initialize(entry.code, true) || !oracle.initialize(entry.code, false))
+        {
+            t.Fail("VU1 fixtures should initialize");
+            return;
+        }
+        if (require)
+            t.IsTrue(ps2_vu_program::find(native.mem.getVU1Code(), PS2_VU1_CODE_SIZE, entry.pc,
+                                          native.mem.getVU1CodeGeneration()) != nullptr,
+                     describe(entry, 0u, oracle) + ": the entry has a compiled routine");
+        const VU1State initial = initialState();
+        const std::vector<uint8_t> data = initialData();
+
+        // One uninterrupted run gives the cycle the program ends on.
+        oracle.reset(initial, data);
+        native.reset(initial, data);
+        oracle.start(entry.pc, kWideBudget);
+        native.start(entry.pc, kWideBudget);
+        const uint64_t end = oracle.cycles();
+        if (!check(t, end < kWideBudget, describe(entry, kWideBudget, oracle) + ": the program ends") ||
+            !matches(t, native, oracle, describe(entry, kWideBudget, oracle) + ": uninterrupted run"))
+            return;
+        if (require)
+            t.IsTrue(native.vu.compiledPairsExecuted() != 0u, describe(entry, kWideBudget, oracle) + ": ran compiled");
+        const VU1State finalState = oracle.vu.state();
+        const std::vector<uint8_t> finalData(oracle.mem.getVU1Data(), oracle.mem.getVU1Data() + PS2_VU1_DATA_SIZE);
+        const auto finalPackets = oracle.packets;
+
+        // A budget the program outlasts stops it at a block boundary and the
+        // interpreter takes over; then the rest in uneven slices.
+        std::vector<uint64_t> budgets;
+        if (end > ps2_vu_program::kMinimumBudget)
+        {
+            const uint64_t span = end - ps2_vu_program::kMinimumBudget;
+            budgets = {ps2_vu_program::kMinimumBudget, ps2_vu_program::kMinimumBudget + span / 3u,
+                       ps2_vu_program::kMinimumBudget + span * 2u / 3u, end - 1u};
+            budgets.erase(std::unique(budgets.begin(), budgets.end()), budgets.end());
+        }
+        for (const uint64_t budget : budgets)
+        {
+            oracle.reset(initial, data);
+            native.reset(initial, data);
+            oracle.start(entry.pc, static_cast<uint32_t>(budget));
+            native.start(entry.pc, static_cast<uint32_t>(budget));
+            if (!matches(t, native, oracle, describe(entry, budget, oracle) + ": stopped by the budget"))
+                return;
+            for (uint32_t slice : {1u, 2u, 3u, 5u, 8u, 13u, kWideBudget})
+            {
+                while (oracle.cycles() < end)
+                {
+                    const uint32_t cycles = static_cast<uint32_t>(std::min<uint64_t>(slice, end - oracle.cycles()));
+                    oracle.resume(cycles);
+                    native.resume(cycles);
+                    if (!matches(t, native, oracle, describe(entry, budget, oracle) + ": resumed"))
+                        return;
+                    if (slice != kWideBudget)
+                        break;
+                }
+            }
+            t.IsTrue(std::memcmp(&oracle.vu.state(), &finalState, sizeof(VU1State)) == 0 &&
+                         std::memcmp(oracle.mem.getVU1Data(), finalData.data(), PS2_VU1_DATA_SIZE) == 0 &&
+                         oracle.packets == finalPackets,
+                     describe(entry, budget, oracle) + ": sliced run ends like the uninterrupted one");
+        }
+    }
+}
+
+void register_ps2_vu1_program_tests()
+{
+    MiniTest::Case("PS2VU1Programs", [](TestCase &tc)
+    {
+        tc.Run("compiled routines match the interpreter on authored programs", [](TestCase &t)
+        {
+            std::string error;
+            const auto entries = loadEntries(error);
+            t.IsTrue(error.empty(), error);
+            const bool require = std::getenv("PS2_VU_REQUIRE_PROGRAMS") != nullptr;
+            if (require)
+                t.IsTrue(!entries.empty(), "PS2_VU_PROGRAM_FIXTURES names the compiled programs");
+            for (const auto &entry : entries)
+                checkEntry(t, entry, require);
+        });
+    });
+}
diff --git a/tools/tests/test_compile_vu_programs.py b/tools/tests/test_compile_vu_programs.py
new file mode 100644
index 000000000..ffa22d68f
--- /dev/null
+++ b/tools/tests/test_compile_vu_programs.py
@@ -0,0 +1,119 @@
+"""Check how compile_vu_programs.py cuts VU1 microcode into routines and blocks."""
+
+import importlib.util
+import re
+import struct
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = ROOT / "tools" / "compile_vu_programs.py"
+FIXTURES = ROOT / "ps2xTest" / "data" / "vu_programs.py"
+
+spec = importlib.util.spec_from_file_location("vu_programs", FIXTURES)
+vu = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(vu)
+
+
+def profile(directory, pairs, entries):
+    """Write one code image holding pairs from index 0, with the given entry indices."""
+    words = [(vu.LOWER_NOP, vu.UPPER_NOP)] * vu.PAIRS
+    for index, pair in enumerate(pairs):
+        words[index] = pair
+    (directory / "vu1-test.code").write_bytes(b"".join(struct.pack("<II", *pair) for pair in words))
+    (directory / "entries.txt").write_text("".join(f"test {index * 8:x}\n" for index in entries))
+
+
+def compile_profile(directory, shards=1):
+    output = directory / "out" / "vu_programs.inc"
+    result = subprocess.run([sys.executable, str(SCRIPT), "--output", str(output), "--shards", str(shards),
+                             str(directory)], capture_output=True, text=True)
+    return result, output
+
+
+def registered_pcs(output):
+    return {int(pc, 16) for pc in re.findall(r"^\{0x([0-9A-F]+)u,", output.read_text(), re.M)}
+
+
+def routines(output):
+    text = "".join(path.read_text() for path in sorted(output.parent.glob("vu_programs_*.cpp")))
+    return text, [int(pairs) for pairs in re.findall(r"p\.fits<\d+u, (\d+)u>", text)]
+
+
+class CompileVuProgramsTests(unittest.TestCase):
+    def test_fixture_programs_all_get_routines_and_the_output_is_stable(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            subprocess.run([sys.executable, str(FIXTURES), str(root / "fixtures")], check=True)
+            outputs = []
+            for name in ("a", "b"):
+                output = root / name / "vu_programs.inc"
+                subprocess.run([sys.executable, str(SCRIPT), "--output", str(output), "--shards", "3",
+                                str(root / "fixtures")], check=True, capture_output=True, text=True)
+                outputs.append([path.read_text() for path in sorted(output.parent.iterdir())])
+            self.assertEqual(outputs[0], outputs[1])
+            entries = {int(line.split()[1], 16)
+                       for line in (root / "fixtures" / "entries.txt").read_text().splitlines()}
+            self.assertLessEqual(entries, registered_pcs(root / "a" / "vu_programs.inc"))
+
+    def test_long_straight_runs_are_cut_into_blocks_that_fit_the_flag_queue(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            pairs = [(vu.immediate15(0x08, 2, 2, 1), vu.UPPER_NOP)] * 300
+            pairs += [(vu.LOWER_NOP, vu.UPPER_NOP | vu.E_BIT), (vu.LOWER_NOP, vu.UPPER_NOP)]
+            profile(root, pairs, [0])
+            result, output = compile_profile(root)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            text, blocks = routines(output)
+            self.assertEqual(sum(blocks), len(pairs))
+            self.assertEqual(max(blocks), 127)
+            self.assertIn("goto b_007f;", text)
+
+    def test_calls_and_constant_register_jumps_start_routines_of_their_own(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            nop = (vu.LOWER_NOP, vu.UPPER_NOP)
+            pairs = [nop] * 24
+            pairs[0] = (vu.branch(0x21, vu.LINK, 0, 10 - 1), vu.UPPER_NOP)  # BAL to 10
+            pairs[2] = (vu.immediate15(0x08, vu.TARGET, 0, 20), vu.UPPER_NOP)
+            pairs[3] = (vu.branch(0x25, vu.LINK, vu.TARGET), vu.UPPER_NOP)  # JALR to 20
+            pairs[5] = (vu.LOWER_NOP, vu.UPPER_NOP | vu.E_BIT)
+            pairs[10] = (vu.branch(0x24, 0, vu.LINK), vu.UPPER_NOP)  # JR
+            pairs[20] = (vu.branch(0x24, 0, vu.LINK), vu.UPPER_NOP)
+            profile(root, pairs, [0])
+            result, output = compile_profile(root)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            # The entry, both callees, and the two places the calls return to.
+            self.assertEqual(registered_pcs(output), {0, 10 * 8, 2 * 8, 20 * 8, 5 * 8})
+            text, _ = routines(output)
+            self.assertEqual(text.count("return p.exit(p.jumpTarget());"), 2)
+
+    def test_an_unsupported_pair_hands_the_program_back_where_it_stands(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            nop = (vu.LOWER_NOP, vu.UPPER_NOP)
+            rinit = (vu.lower_special(0x42, 1), vu.UPPER_NOP)
+            pairs = [nop, nop, nop, rinit, nop, (vu.LOWER_NOP, vu.UPPER_NOP | vu.E_BIT), nop]
+            profile(root, pairs, [0])
+            result, output = compile_profile(root)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            text, blocks = routines(output)
+            self.assertEqual(blocks, [3])
+            self.assertIn("return p.leave(0x0018u);", text)
+
+    def test_entries_must_be_pair_aligned_and_inside_code_memory(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            profile(root, [(vu.LOWER_NOP, vu.UPPER_NOP | vu.E_BIT)], [0])
+            for line in ("test 4\n", "test 4000\n", "test\n"):
+                (root / "entries.txt").write_text(line)
+                result, _ = compile_profile(root)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertRegex(result.stderr, "invalid entry|expected '<hash> <pc>'")
+
+
+if __name__ == "__main__":
+    unittest.main()

From 5e8d2ace6e19b9151dee52c0f0501109d67f57b8 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:32:52 +0200
Subject: [PATCH 62/68] Hand GS queue space back while a batch drains

The worker gave back a batch's queue space only once all of it had run.
A batch can hold most of a frame, so the producer stopped for the whole
batch and the worker then sat idle waiting for the next one. Giving back
space every 64 KiB keeps both of them busy.
---
 ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp b/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp
index 25aa6a3a2..e5ba622f4 100644
--- a/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp
+++ b/ps2xRuntime/src/lib/gs/gs_threaded_backend.cpp
@@ -194,6 +194,18 @@ struct GSThreadedBackend::Impl
                 {
                     execute(command);
                     bytes += command.bytes();
+                    // A batch can hold most of a frame. Returning its space as
+                    // it drains keeps the producer going instead of stopping
+                    // it for the whole batch and then leaving this thread idle.
+                    if (bytes >= kReleaseBytes)
+                    {
+                        {
+                            std::lock_guard lock(mutex);
+                            outstandingBytes -= bytes;
+                        }
+                        bytes = 0u;
+                        progress.notify_all();
+                    }
                 }
             }
             catch (...)
@@ -220,6 +232,8 @@ struct GSThreadedBackend::Impl
         }
     }
 
+    static constexpr size_t kReleaseBytes = 64u * 1024u;
+
     std::unique_ptr<GSRasterBackend> backend;
     const std::shared_ptr<const int> identity = std::make_shared<const int>(0);
     const size_t capacity;

From 817a8fade66d8bc3443922caeda10cbf6587c769 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:32:52 +0200
Subject: [PATCH 63/68] Time GIF packets only when a backend reports them

processGIFPacket read the clock twice per packet for a total that only a
backend's stats report reads. A busy scene sends over ten thousand
packets a frame, so that cost a couple of percent of the game thread. A
backend that reports the numbers now sets g_gsFrontendTiming.
---
 ps2xRuntime/src/lib/gs/gs_frontend.cpp | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/ps2xRuntime/src/lib/gs/gs_frontend.cpp b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
index 75508b6cf..6c7de3b43 100644
--- a/ps2xRuntime/src/lib/gs/gs_frontend.cpp
+++ b/ps2xRuntime/src/lib/gs/gs_frontend.cpp
@@ -762,6 +762,9 @@ bool GS::copyLatchedHostPresentationFrame(std::vector<uint8_t> &outPixels,
 // "the game is sending an enormous number of tiny packets".
 std::atomic<uint64_t> g_gsFrontendPacketNanos{0};
 std::atomic<uint64_t> g_gsFrontendPacketCount{0};
+// Off unless a backend reports the numbers: the field sends over ten thousand
+// packets a frame, and two clock reads each add up.
+std::atomic<bool> g_gsFrontendTiming{false};
 // The same for the native image-upload fast path, which bypasses
 // processGIFPacket entirely -- DQ8's movie tiles arrive this way, one DMA
 // chain per 16x16 tile, so without a separate counter they are invisible.
@@ -770,12 +773,15 @@ std::atomic<uint64_t> g_gsUploadNativeCount{0};
 
 void GS::processGIFPacket(const uint8_t *data, uint32_t sizeBytes)
 {
-    const auto packetStart = std::chrono::steady_clock::now();
     struct PacketTimer
     {
-        std::chrono::steady_clock::time_point start;
+        bool timed = g_gsFrontendTiming.load(std::memory_order_relaxed);
+        std::chrono::steady_clock::time_point start =
+            timed ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
         ~PacketTimer()
         {
+            if (!timed)
+                return;
             g_gsFrontendPacketNanos.fetch_add(
                 static_cast<uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(
                                           std::chrono::steady_clock::now() - start)
@@ -783,7 +789,7 @@ void GS::processGIFPacket(const uint8_t *data, uint32_t sizeBytes)
                 std::memory_order_relaxed);
             g_gsFrontendPacketCount.fetch_add(1, std::memory_order_relaxed);
         }
-    } packetTimer{packetStart};
+    } packetTimer;
 
     std::lock_guard<std::recursive_mutex> lock(m_stateMutex);
     if (!data || sizeBytes < 16 || !m_backend)

From 95af21baaaccae9be032997500dfd64571ffc9f3 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 11:32:52 +0200
Subject: [PATCH 64/68] Document compiled VU1 programs in the runtime readme

---
 ps2xRuntime/Readme.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/ps2xRuntime/Readme.md b/ps2xRuntime/Readme.md
index 4ae035fef..3b51d607f 100644
--- a/ps2xRuntime/Readme.md
+++ b/ps2xRuntime/Readme.md
@@ -47,6 +47,31 @@ The runtime handles PS2's memory addressing, including:
 ## Vector Unit Support
 PS2-specific 128-bit MMI instructions and VU0 macro mode instructions are supported via SSE/AVX intrinsics.
 
+### Compiled VU1 programs
+
+VU1 microprograms normally run on the interpreter. A build can instead compile
+the programs a game actually runs into C++ ahead of time, whole, from the entry
+point to the E bit: every pair still issues in order with the interpreter's
+stall rules, but the per-pair bookkeeping is decided at compile time and the
+hot state stays in registers. Anything the compiled code cannot express, or
+microcode that changed since it was recorded, falls back to the interpreter.
+
+The input is recorded, not guessed, because the microcode is game data:
+
+1. Run the game with `PS2_VU_PROGRAM_PROFILE=some/directory`. Each entry point
+   reached without a compiled routine is saved there as a 16 KiB code image
+   plus a line in `entries.txt`. Recording keeps adding to the directory.
+2. Configure with `-DPS2X_VU_PROGRAM_PROFILES=dir1;dir2` and rebuild. The
+   build runs `tools/compile_vu_programs.py` over the recordings and compiles
+   the result in `PS2X_VU_PROGRAM_SHARDS` units (8 by default).
+
+Recordings and the generated sources contain game code; keep them local.
+
+On AArch64 the arithmetic has NEON fast paths with exact fallbacks. Defining
+`PS2X_VU_PROGRAM_PORTABLE` builds the path other hosts use, so it can be tested
+on an ARM machine. `ps2xTest/data/vu_programs.py` writes synthetic programs for
+the differential test in `ps2xTest/src/ps2_vu1_program_tests.cpp`.
+
 ## Instruction Patching
 You can patch specific instructions in the recompiled code to fix game issues or implement custom behavior.
 

From 54164502104977477c7873cad9b9ea5d46c70766 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 15:22:31 +0200
Subject: [PATCH 65/68] Queue movie callbacks when the demux runs outside guest
 code

Running the callbacks inside the demux call puts them on the calling
guest thread's stack. The MPEG tests call the demux from the host, with
no guest call in progress, so there is no such stack and the scheduler
threw. Those callers get the callbacks queued, as before.
---
 ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
index 35bc9e9f1..eec8ffa08 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
@@ -1835,8 +1835,12 @@ namespace ps2_stubs
                 return;
             }
 
-            // One after another, so they can share one stack.
-            const uint32_t stackTop = runtime->eeScheduler().invocationStackTop();
+            // One after another, so they can share one stack. A caller outside
+            // guest code (a test) gets them queued instead.
+            EeScheduler &scheduler = runtime->eeScheduler();
+            const GuestThread *thread = scheduler.currentThread();
+            const bool inGuest = thread && thread->inGuestCall;
+            const uint32_t stackTop = inGuest ? scheduler.invocationStackTop() : 0u;
             std::vector<GuestInvocation> invocations;
             for (const MpegStreamCallbackEvent &event : events)
             {
@@ -1849,9 +1853,20 @@ namespace ps2_stubs
                     }
                 }
             }
-            if (!invocations.empty())
+            if (invocations.empty())
             {
-                runtime->eeScheduler().invokeCurrentSequence(std::move(invocations));
+                return;
+            }
+            if (inGuest)
+            {
+                scheduler.invokeCurrentSequence(std::move(invocations));
+            }
+            else
+            {
+                for (GuestInvocation &invocation : invocations)
+                {
+                    scheduler.queueInvocation(std::move(invocation));
+                }
             }
         }
 

From e10dc7fc488c22016ebe0325730183e522e60f21 Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Thu, 24 Sep 2026 15:22:32 +0200
Subject: [PATCH 66/68] Add an SSE2 fast path for compiled VU1 arithmetic

x86 hosts ran compiled routines on the plain C++ path, a little over
half as fast as NEON on the field captures. The SSE2 version takes the
same steps with the same range checks. SSE2 only has signed integer
compares, which is fine as nothing compared reaches 2^31, and movemask
gives the lanes in the opposite order to the MAC flags, hence the table.

Product sums have to round like the interpreter's acc + fs * ft, which
GCC and Clang fuse into one multiply-add when the target has one. So
the fast path fuses on AArch64 and with FMA enabled, and multiplies
then adds otherwise.

PS2X_VU_PROGRAM_SSE builds this path on AArch64 through sse2neon. Run
that way, all 768 field captures and the synthetic programs match the
interpreter, at 8 to 9 times its speed (NEON: 9, plain: 5). Reversing
the lane table or rounding product sums the other way makes both fail.
On x86-64 it has only been compiled here, with and without -mfma;
DQ8's Linux x86-64 CI job runs the synthetic programs.
---
 ps2xRuntime/Readme.md                    |  10 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_program.h | 167 +++++++++++++++++++++--
 2 files changed, 165 insertions(+), 12 deletions(-)

diff --git a/ps2xRuntime/Readme.md b/ps2xRuntime/Readme.md
index 3b51d607f..c9fd95e77 100644
--- a/ps2xRuntime/Readme.md
+++ b/ps2xRuntime/Readme.md
@@ -67,10 +67,12 @@ The input is recorded, not guessed, because the microcode is game data:
 
 Recordings and the generated sources contain game code; keep them local.
 
-On AArch64 the arithmetic has NEON fast paths with exact fallbacks. Defining
-`PS2X_VU_PROGRAM_PORTABLE` builds the path other hosts use, so it can be tested
-on an ARM machine. `ps2xTest/data/vu_programs.py` writes synthetic programs for
-the differential test in `ps2xTest/src/ps2_vu1_program_tests.cpp`.
+The FMAC arithmetic has fast paths with exact fallbacks, NEON on AArch64 and
+SSE2 on x86. Other hosts get a plain C++ path. All three can be tested on an ARM
+machine: `PS2X_VU_PROGRAM_SSE` builds the SSE2 one through sse2neon, and
+`PS2X_VU_PROGRAM_PORTABLE` the plain one. `ps2xTest/data/vu_programs.py` writes
+synthetic programs for the differential test in
+`ps2xTest/src/ps2_vu1_program_tests.cpp`.
 
 ## Instruction Patching
 You can patch specific instructions in the recompiled code to fix game issues or implement custom behavior.
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_program.h b/ps2xRuntime/src/lib/vu/ps2_vu1_program.h
index 45c5266d9..ab4b8e61a 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_program.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_program.h
@@ -16,13 +16,27 @@
 #include <limits>
 #include <utility>
 
-// NEON fast paths. Defining PS2X_VU_PROGRAM_PORTABLE runs the path other
-// hosts take, so it can be tested on an ARM machine.
-#if defined(__aarch64__) && !defined(PS2X_VU_PROGRAM_PORTABLE)
+// FMAC fast paths: NEON on AArch64, SSE2 on x86. So that all three can be tested
+// on an ARM machine, PS2X_VU_PROGRAM_SSE runs the SSE2 one there through
+// sse2neon, and PS2X_VU_PROGRAM_PORTABLE runs neither.
+#if defined(PS2X_VU_PROGRAM_PORTABLE)
+#define PS2_VU_PROGRAM_NEON 0
+#define PS2_VU_PROGRAM_SSE 0
+#elif defined(__aarch64__) && !defined(PS2X_VU_PROGRAM_SSE)
 #define PS2_VU_PROGRAM_NEON 1
+#define PS2_VU_PROGRAM_SSE 0
 #include <arm_neon.h>
+#elif defined(__aarch64__) || defined(__SSE2__) || defined(_M_X64)
+#define PS2_VU_PROGRAM_NEON 0
+#define PS2_VU_PROGRAM_SSE 1
+#if defined(__aarch64__)
+#include "sse2neon.h"
+#else
+#include <immintrin.h>
+#endif
 #else
 #define PS2_VU_PROGRAM_NEON 0
+#define PS2_VU_PROGRAM_SSE 0
 #endif
 
 namespace ps2_vu_program
@@ -327,6 +341,50 @@ PS2_VU_FORCE_INLINE float32x4_t flushDenormals(float32x4_t value)
     return vreinterpretq_f32_u32(vbicq_u32(vreinterpretq_u32_f32(value), vshrq_n_u32(tiny, 1)));
 }
 }
+#elif PS2_VU_PROGRAM_SSE
+namespace fast
+{
+// Movemask puts lane x in bit 0 and the MAC register in bit 3.
+inline constexpr uint8_t kReversed[16] = {0, 8, 4, 12, 2, 10, 6, 14, 1, 9, 5, 13, 3, 11, 7, 15};
+
+template <uint8_t Dest>
+inline constexpr int kLanes = kReversed[Dest];
+
+PS2_VU_FORCE_INLINE int mask(__m128i lanes)
+{
+    return _mm_movemask_ps(_mm_castsi128_ps(lanes));
+}
+
+// Lane masks in the MAC register's layout, limited to the Dest lanes.
+template <uint8_t Dest>
+PS2_VU_FORCE_INLINE uint32_t layout(int zero, int sign, int underflow)
+{
+    return (kReversed[zero] | kReversed[sign] << 4u | kReversed[underflow] << 8u) & (Dest * 0x111u);
+}
+
+// As the NEON version: infinity and NaN stay, and fail the range checks.
+PS2_VU_FORCE_INLINE __m128 flushDenormals(__m128 value)
+{
+    const __m128 magnitude = _mm_castsi128_ps(_mm_set1_epi32(0x7FFFFFFF));
+    const __m128 tiny = _mm_cmplt_ps(_mm_and_ps(value, magnitude), _mm_set1_ps(std::numeric_limits<float>::min()));
+    return _mm_andnot_ps(_mm_and_ps(tiny, magnitude), value);
+}
+
+// Rounds like the interpreter's acc + fs * ft, which GCC and Clang fuse by
+// default wherever FMA is available. AArch64 only gets here in tests.
+template <bool Subtract>
+PS2_VU_FORCE_INLINE __m128 productSum(__m128 acc, __m128 left, __m128 right)
+{
+#if defined(__aarch64__)
+    return Subtract ? vfmsq_f32(acc, left, right) : vfmaq_f32(acc, left, right);
+#elif defined(__FMA__)
+    return Subtract ? _mm_fnmadd_ps(left, right, acc) : _mm_fmadd_ps(left, right, acc);
+#else
+    const __m128 product = _mm_mul_ps(left, right);
+    return Subtract ? _mm_sub_ps(acc, product) : _mm_add_ps(acc, product);
+#endif
+}
+}
 #endif
 
 class Run
@@ -567,7 +625,7 @@ class Frame
     template <uint32_t Upper>
     PS2_VU_FORCE_INLINE void upper(float *value);
 
-#if PS2_VU_PROGRAM_NEON
+#if PS2_VU_PROGRAM_NEON || PS2_VU_PROGRAM_SSE
     template <uint32_t Upper>
     PS2_VU_FORCE_INLINE bool fastUpper(float *value);
 #endif
@@ -799,7 +857,7 @@ PS2_VU_FORCE_INLINE void Frame::upper(float *value)
     }
     else
     {
-#if PS2_VU_PROGRAM_NEON
+#if PS2_VU_PROGRAM_NEON || PS2_VU_PROGRAM_SSE
         if (fastUpper<Upper>(value))
             return;
 #endif
@@ -948,7 +1006,7 @@ PS2_VU_FORCE_INLINE uint32_t Frame::plainUpper(float *value)
 }
 #endif
 
-#if PS2_VU_PROGRAM_NEON
+#if PS2_VU_PROGRAM_NEON || PS2_VU_PROGRAM_SSE
 // computeUpper's vector cases with the same range checks, but with the flags
 // built straight into the MAC layout. Results the checks do not clear take
 // the exact path.
@@ -968,8 +1026,10 @@ PS2_VU_FORCE_INLINE bool Frame::fastUpper(float *value)
     constexpr bool simpleMul = (code >= 0x18u && code <= 0x1Cu) || code == 0x1Eu || code == 0x2Au || (cross && accumulate);
     constexpr bool productSum = (code >= 8u && code <= 0xFu) || code == 0x21u || code == 0x23u ||
                                 code == 0x25u || code == 0x27u || code == 0x29u || code == 0x2Du || (cross && !accumulate);
+    constexpr bool subtract = (code >= 0xCu && code <= 0xFu) || code == 0x25u || code == 0x27u || code == 0x2Du || cross;
     if constexpr (!simpleAdd && !simpleSub && !simpleMul && !productSum)
         return false;
+#if PS2_VU_PROGRAM_NEON
     else
     {
         using fast::flushDenormals;
@@ -1030,8 +1090,6 @@ PS2_VU_FORCE_INLINE bool Frame::fastUpper(float *value)
         }
         else
         {
-            constexpr bool subtract =
-                (code >= 0xCu && code <= 0xFu) || code == 0x25u || code == 0x27u || code == 0x2Du || cross;
             // Only FMAC results reach ACC, and those are already in range.
             const float32x4_t acc = vld1q_f32(m_state.acc);
             const float32x4_t result = subtract ? vfmsq_f32(acc, left, right) : vfmaq_f32(acc, left, right);
@@ -1065,6 +1123,99 @@ PS2_VU_FORCE_INLINE bool Frame::fastUpper(float *value)
             return true;
         }
     }
+#else
+    else
+    {
+        // The same steps. Every integer compare here is on values below 2^31,
+        // which SSE2's signed compares handle.
+        using fast::flushDenormals;
+        const __m128i magnitudeMask = _mm_set1_epi32(0x7FFFFFFF);
+        const __m128i none = _mm_setzero_si128();
+        __m128 left = flushDenormals(_mm_loadu_ps(m_state.vf[fs]));
+        __m128 right;
+        if constexpr (code <= 0xFu || (code >= 0x18u && code <= 0x1Bu))
+            right = _mm_set1_ps(m_state.vf[ft][code & 3u]);
+        else if constexpr (code == 0x1Cu || code == 0x20u || code == 0x21u || code == 0x24u || code == 0x25u)
+            right = _mm_set1_ps(m_state.q);
+        else if constexpr (code == 0x1Eu || code == 0x22u || code == 0x23u || code == 0x26u || code == 0x27u)
+            right = _mm_set1_ps(m_state.i);
+        else
+            right = _mm_loadu_ps(m_state.vf[ft]);
+        right = flushDenormals(right);
+        if constexpr (cross)
+        {
+            left = _mm_shuffle_ps(left, left, _MM_SHUFFLE(3, 0, 2, 1));
+            right = _mm_shuffle_ps(right, right, _MM_SHUFFLE(3, 1, 0, 2));
+        }
+        const __m128i leftBits = _mm_castps_si128(left);
+        const __m128i rightBits = _mm_castps_si128(right);
+
+        if constexpr (!productSum)
+        {
+            __m128 result;
+            if constexpr (simpleAdd)
+                result = _mm_add_ps(left, right);
+            else if constexpr (simpleSub)
+                result = _mm_sub_ps(left, right);
+            else
+                result = _mm_mul_ps(left, right);
+            const __m128i magnitude = _mm_and_si128(_mm_castps_si128(result), magnitudeMask);
+            const __m128i leftZero = _mm_cmpeq_epi32(_mm_and_si128(leftBits, magnitudeMask), none);
+            const __m128i rightZero = _mm_cmpeq_epi32(_mm_and_si128(rightBits, magnitudeMask), none);
+            __m128i exactZero;
+            if constexpr (simpleMul)
+                exactZero = _mm_or_si128(leftZero, rightZero);
+            else
+            {
+                const __m128i opposing =
+                    simpleAdd ? _mm_xor_si128(rightBits, _mm_set1_epi32(std::numeric_limits<int32_t>::min())) : rightBits;
+                exactZero = _mm_or_si128(_mm_and_si128(leftZero, rightZero), _mm_cmpeq_epi32(leftBits, opposing));
+            }
+            const __m128i zero = _mm_cmpeq_epi32(magnitude, none);
+            const __m128i normal = _mm_and_si128(_mm_cmpgt_epi32(magnitude, _mm_set1_epi32(0x00800000)),
+                                                 _mm_cmplt_epi32(magnitude, _mm_set1_epi32(0x7F7FFFFF)));
+            const __m128i safe = _mm_or_si128(normal, _mm_and_si128(zero, exactZero));
+            if ((fast::mask(safe) & fast::kLanes<dest>) != fast::kLanes<dest>)
+                return false;
+            _mm_storeu_ps(value, result);
+            if constexpr (dest != 0u)
+                pushFlags(3u, fast::layout<dest>(fast::mask(zero), _mm_movemask_ps(result), 0), 0u);
+            return true;
+        }
+        else
+        {
+            const __m128 result = fast::productSum<subtract>(_mm_loadu_ps(m_state.acc), left, right);
+            const __m128i bits = _mm_castps_si128(result);
+            const __m128i exponentMask = _mm_set1_epi32(0xFF);
+            const __m128i resultExponent = _mm_and_si128(_mm_srli_epi32(bits, 23), exponentMask);
+            const __m128i leftExponent = _mm_and_si128(_mm_srli_epi32(leftBits, 23), exponentMask);
+            const __m128i rightExponent = _mm_and_si128(_mm_srli_epi32(rightBits, 23), exponentMask);
+            const __m128i productBound = _mm_add_epi32(leftExponent, rightExponent);
+            const __m128i zeroProduct =
+                _mm_or_si128(_mm_cmpeq_epi32(leftExponent, none), _mm_cmpeq_epi32(rightExponent, none));
+            // A nonzero product that may be infinite, or round by too much next to the result.
+            const __m128i risky = _mm_andnot_si128(
+                zeroProduct, _mm_or_si128(_mm_cmpgt_epi32(productBound, _mm_set1_epi32(379)),
+                                          _mm_cmpgt_epi32(productBound, _mm_add_epi32(resultExponent, _mm_set1_epi32(146)))));
+            const __m128i resultSafe = _mm_and_si128(_mm_cmpgt_epi32(resultExponent, _mm_set1_epi32(1)),
+                                                     _mm_cmplt_epi32(resultExponent, _mm_set1_epi32(254)));
+            const __m128i zero = _mm_cmpeq_epi32(_mm_and_si128(bits, magnitudeMask), none);
+            const __m128i safe = _mm_or_si128(_mm_andnot_si128(risky, resultSafe), _mm_and_si128(zero, zeroProduct));
+            if ((fast::mask(safe) & fast::kLanes<dest>) != fast::kLanes<dest>)
+                return false;
+            _mm_storeu_ps(value, result);
+            if constexpr (dest != 0u)
+            {
+                const __m128i product = _mm_and_si128(_mm_castps_si128(_mm_mul_ps(left, right)), magnitudeMask);
+                const __m128i tiny = _mm_cmplt_epi32(product, _mm_set1_epi32(0x00800000));
+                const uint32_t conditions = fast::layout<dest>(fast::mask(tiny), _mm_movemask_ps(_mm_xor_ps(left, right)),
+                                                               fast::mask(_mm_andnot_si128(zeroProduct, tiny)));
+                pushFlags(3u, fast::layout<dest>(fast::mask(zero), _mm_movemask_ps(result), 0), conditions);
+            }
+            return true;
+        }
+    }
+#endif
 }
 #endif
 

From ef8eca6ce77c750c003fc9a4659eca98e618de3c Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 28 Sep 2026 11:38:29 +0200
Subject: [PATCH 67/68] Record register jump targets during a VU program
 recording

A compiled routine ends at a register jump, and run() only looks the
target up, and records it if it is missing, once the routine before it
exists. A first recording is made with nothing compiled, so every program
runs on the interpreter and those targets never showed up. DQ8's main
field program starts at 0x960 and jumps on to 0x970-0x990, so a build
from one recording compiled the start and ran the rest on the
interpreter: 97% of VU1 work, about 6 FPS in the field. It took a second
recording, made with the first routines built, to find the targets.

While a profile is recorded, the interpreter now saves where JR and JALR
land, once per target and microcode generation since recordMissing hashes
the whole image. One pass along the field route compiles to the same 52
routines several passes produced before, and the field holds 30 FPS with
all of VU1 compiled.

setProfileDirectory lets the new test record into a directory of its own.
---
 ps2xRuntime/Readme.md                      |  4 +-
 ps2xRuntime/src/lib/vu/ps2_vu1_lower.inl   | 12 ++++++
 ps2xRuntime/src/lib/vu/ps2_vu1_program.cpp | 45 +++++++++++++++++++++-
 ps2xRuntime/src/lib/vu/ps2_vu1_program.h   |  4 ++
 ps2xTest/src/ps2_vu1_program_tests.cpp     | 42 ++++++++++++++++++++
 5 files changed, 104 insertions(+), 3 deletions(-)

diff --git a/ps2xRuntime/Readme.md b/ps2xRuntime/Readme.md
index c9fd95e77..1e9a365e7 100644
--- a/ps2xRuntime/Readme.md
+++ b/ps2xRuntime/Readme.md
@@ -60,7 +60,9 @@ The input is recorded, not guessed, because the microcode is game data:
 
 1. Run the game with `PS2_VU_PROGRAM_PROFILE=some/directory`. Each entry point
    reached without a compiled routine is saved there as a 16 KiB code image
-   plus a line in `entries.txt`. Recording keeps adding to the directory.
+   plus a line in `entries.txt`, and so is every place a register jump lands,
+   so one run covers the code it went through. Recording keeps adding to the
+   directory.
 2. Configure with `-DPS2X_VU_PROGRAM_PROFILES=dir1;dir2` and rebuild. The
    build runs `tools/compile_vu_programs.py` over the recordings and compiles
    the result in `PS2X_VU_PROGRAM_SHARDS` units (8 by default).
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_lower.inl b/ps2xRuntime/src/lib/vu/ps2_vu1_lower.inl
index b0317b5d4..c50cb56a0 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_lower.inl
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_lower.inl
@@ -8,6 +8,14 @@
 #include <cstring>
 #include <limits>
 
+namespace ps2_vu_program
+{
+// While a program profile is recorded, saves where a register jump lands.
+// Compiled routines only look targets up once the code before them runs
+// compiled, so a first recording would otherwise never see them.
+void noteJump(PS2Memory *memory, uint32_t target);
+}
+
 namespace ps2_vu_detail
 {
     inline float vuEatan(float value)
@@ -291,6 +299,8 @@ PS2_VU_FORCE_INLINE void VU1Interpreter::execLowerInline(uint32_t instr, uint8_t
         uint8_t is = VIS(instr);
         // Register jumps do not use conditional branches' delayed VI operand.
         uint32_t target = ((uint32_t)(uint16_t)m_state.vi[is] * 8u) & pcMask;
+        if (m_unit == Unit::VU1)
+            ps2_vu_program::noteJump(memory, target);
         m_state.branchPending = true;
         m_state.branchTarget = target;
         m_state.branchDelay = 1;
@@ -301,6 +311,8 @@ PS2_VU_FORCE_INLINE void VU1Interpreter::execLowerInline(uint32_t instr, uint8_t
         uint8_t it = VIT(instr);
         uint8_t is = VIS(instr);
         uint32_t target = ((uint32_t)(uint16_t)m_state.vi[is] * 8u) & pcMask;
+        if (m_unit == Unit::VU1)
+            ps2_vu_program::noteJump(memory, target);
         if (it != 0)
             m_state.vi[it] = (int32_t)((m_state.pc + 16) / 8);
         m_state.branchPending = true;
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_program.cpp b/ps2xRuntime/src/lib/vu/ps2_vu1_program.cpp
index 59d3cea17..36ea65a03 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_program.cpp
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_program.cpp
@@ -3,6 +3,7 @@
 #include <algorithm>
 #include <array>
 #include <atomic>
+#include <bitset>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
@@ -89,10 +90,27 @@ Routine find(const uint8_t *code, uint32_t codeSize, uint32_t pc, uint64_t gener
     return routine;
 }
 
+namespace
+{
+std::string &profileDirectory()
+{
+    static std::string directory = [] {
+        const char *value = std::getenv("PS2_VU_PROGRAM_PROFILE");
+        return std::string(value ? value : "");
+    }();
+    return directory;
+}
+}
+
+void setProfileDirectory(std::string directory)
+{
+    profileDirectory() = std::move(directory);
+}
+
 void recordMissing(const uint8_t *code, uint32_t codeSize, uint32_t pc)
 {
-    static const char *directory = std::getenv("PS2_VU_PROGRAM_PROFILE");
-    if (!directory || !*directory)
+    const std::string &directory = profileDirectory();
+    if (directory.empty())
         return;
     static std::mutex mutex;
     const std::lock_guard lock(mutex);
@@ -113,6 +131,29 @@ void recordMissing(const uint8_t *code, uint32_t codeSize, uint32_t pc)
     std::ofstream(root / "entries.txt", std::ios::app) << name << ' ' << std::hex << pc << '\n';
 }
 
+void noteJump(PS2Memory *memory, uint32_t target)
+{
+    if (!memory || profileDirectory().empty())
+        return;
+    // Once per target and microcode generation, as recordMissing hashes the
+    // whole image.
+    thread_local uint64_t seenGeneration = ~0ull;
+    thread_local std::bitset<PS2_VU1_CODE_SIZE / 8u> seen;
+    const uint64_t generation = memory->getVU1CodeGeneration();
+    if (generation != seenGeneration)
+    {
+        seen.reset();
+        seenGeneration = generation;
+    }
+    const uint32_t pair = (target / 8u) % seen.size();
+    if (seen.test(pair))
+        return;
+    seen.set(pair);
+    const uint8_t *code = memory->getVU1Code();
+    if (!find(code, PS2_VU1_CODE_SIZE, target, generation))
+        recordMissing(code, PS2_VU1_CODE_SIZE, target);
+}
+
 void Access::pendVf(VU1Interpreter &vu, uint8_t reg, uint8_t lanes, uint64_t ready)
 {
     auto *slot = ps2_vu_detail::allocateScheduledEntry(vu.m_vfWritePipeline, vu.m_activeVfWrites, ready);
diff --git a/ps2xRuntime/src/lib/vu/ps2_vu1_program.h b/ps2xRuntime/src/lib/vu/ps2_vu1_program.h
index ab4b8e61a..94c45bd87 100644
--- a/ps2xRuntime/src/lib/vu/ps2_vu1_program.h
+++ b/ps2xRuntime/src/lib/vu/ps2_vu1_program.h
@@ -14,6 +14,7 @@
 #include <cstdint>
 #include <cstring>
 #include <limits>
+#include <string>
 #include <utility>
 
 // FMAC fast paths: NEON on AArch64, SSE2 on x86. So that all three can be tested
@@ -72,6 +73,9 @@ void forgetRoutines();
 // routine that has no compiled version, for compile_vu_programs.py.
 void recordMissing(const uint8_t *code, uint32_t codeSize, uint32_t pc);
 
+// Replaces the directory PS2_VU_PROGRAM_PROFILE named; empty stops recording.
+void setProfileDirectory(std::string directory);
+
 // Run from the current PC, starting with First. Returns true when the E-bit
 // delay slot issued, false when the interpreter has to continue.
 bool run(VU1Interpreter &vu, const uint8_t *code, uint32_t codeSize, uint64_t budgetEnd, Routine first);
diff --git a/ps2xTest/src/ps2_vu1_program_tests.cpp b/ps2xTest/src/ps2_vu1_program_tests.cpp
index b93b9a6f3..10b1ade8e 100644
--- a/ps2xTest/src/ps2_vu1_program_tests.cpp
+++ b/ps2xTest/src/ps2_vu1_program_tests.cpp
@@ -9,6 +9,7 @@
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
+#include <filesystem>
 #include <fstream>
 #include <sstream>
 #include <string>
@@ -326,5 +327,46 @@ void register_ps2_vu1_program_tests()
             for (const auto &entry : entries)
                 checkEntry(t, entry, require);
         });
+
+        tc.Run("a recording notes where register jumps land", [](TestCase &t)
+        {
+            // The target comes from VU memory, so only running the code finds it.
+            constexpr uint32_t kLowerNop = 0x8000033Cu;
+            constexpr uint32_t kUpperNop = 0x000002FFu;
+            constexpr uint32_t kEBit = 0x40000000u;
+            std::vector<uint8_t> code(PS2_VU1_CODE_SIZE, 0u);
+            const auto pair = [&code](uint32_t pc, uint32_t lower, uint32_t upper)
+            {
+                std::memcpy(&code[pc], &lower, sizeof(lower));
+                std::memcpy(&code[pc + 4u], &upper, sizeof(upper));
+            };
+            for (uint32_t pc = 0u; pc < 0x210u; pc += 8u)
+                pair(pc, kLowerNop, kUpperNop);
+            pair(0x000u, 0x09010010u, kUpperNop); // ILW.x vi1, 0x10(vi0)
+            pair(0x028u, 0x48000800u, kUpperNop); // JR vi1
+            pair(0x200u, kLowerNop, kUpperNop | kEBit);
+            std::vector<uint8_t> data = initialData();
+            const uint32_t target = 0x200u / 8u;
+            std::memcpy(&data[0x10u * 16u], &target, sizeof(target));
+
+            const std::filesystem::path directory =
+                std::filesystem::temp_directory_path() / "ps2x-vu-jump-recording";
+            std::filesystem::remove_all(directory);
+            ps2_vu_program::setProfileDirectory(directory.string());
+            Side side;
+            t.IsTrue(side.initialize(code, true), "memory initializes");
+            side.reset(initialState(), data);
+            side.start(0u, kWideBudget);
+            ps2_vu_program::setProfileDirectory({});
+
+            std::ifstream entries(directory / "entries.txt");
+            std::string hash;
+            std::string pc;
+            bool recorded = false;
+            while (entries >> hash >> pc)
+                recorded = recorded || pc == "200";
+            t.IsTrue(recorded, "the jump target 0x200 is saved as an entry");
+            std::filesystem::remove_all(directory);
+        });
     });
 }

From dc4bbd8aac3e28b198d71a9888293161f8c8c48d Mon Sep 17 00:00:00 2001
From: Sinan Karakaya <91690021+Sinan-Karakaya@users.noreply.github.com>
Date: Mon, 28 Sep 2026 22:43:39 +0200
Subject: [PATCH 68/68] Reset a new MPEG decoder the way sceMpegCreate does

libmpeg's sceMpegCreate finishes by calling sceMpegReset, which clears
the end-of-stream word the game polls through sceMpegIsEnd. The stub
stopped short of that, so a decoder created in memory that an earlier
user had left non-zero could read as ended before its first picture.

Dragon Quest VIII creates the decoder for the movie after its first
fight in heap memory that gameplay has already used. Its decode thread
checks the end word before asking for a picture, finds it set, resets
and exits without decoding anything, and the player waits for the two
pictures it needs before starting. The screen stays black.

The new test fills the work buffer with 0xFF before sceMpegCreate and
fails without the reset.
---
 ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp    |  5 +++++
 ps2xTest/src/ps2_runtime_expansion_tests.cpp | 22 ++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
index eec8ffa08..77b3ff15e 100644
--- a/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
+++ b/ps2xRuntime/src/lib/Kernel/Stubs/MPEG.cpp
@@ -2291,6 +2291,11 @@ namespace ps2_stubs
             setDynamicRet = *reinterpret_cast<uint32_t *>(p);
         mpegGuestWrite32(rdram, puVar4 + 12, setDynamicRet);
 
+        // The real sceMpegCreate ends with sceMpegReset, which clears the end flag
+        // the game polls. Without it a decoder made in reused memory can read as
+        // ended before its first picture.
+        sceMpegReset(rdram, ctx, runtime);
+
         setReturnU32(ctx, setDynamicRet);
     }
 
diff --git a/ps2xTest/src/ps2_runtime_expansion_tests.cpp b/ps2xTest/src/ps2_runtime_expansion_tests.cpp
index ad7df4660..d7bc9f3ac 100644
--- a/ps2xTest/src/ps2_runtime_expansion_tests.cpp
+++ b/ps2xTest/src/ps2_runtime_expansion_tests.cpp
@@ -522,6 +522,28 @@ void register_ps2_runtime_expansion_tests()
                      "sceMpegInit should reset MPEG callback bookkeeping between runs");
         });
 
+        tc.Run("sceMpegCreate starts a decoder that has not ended, even in reused memory", [](TestCase &t)
+        {
+            std::vector<uint8_t> rdram(PS2_RAM_SIZE, 0u);
+            ps2_stubs::resetMpegStubState();
+            constexpr uint32_t kMpegAddr = 0x00123000u;
+            constexpr uint32_t kMpegWorkAddr = 0x00130000u;
+            constexpr uint32_t kMpegWorkSize = 0x2000u;
+            // A game's heap hands back memory with whatever an earlier user left in it.
+            std::memset(rdram.data() + kMpegWorkAddr, 0xFF, kMpegWorkSize);
+
+            R5900Context createCtx{};
+            setRegU32(createCtx, 4, kMpegAddr);
+            setRegU32(createCtx, 5, kMpegWorkAddr);
+            setRegU32(createCtx, 6, kMpegWorkSize);
+            ps2_stubs::sceMpegCreate(rdram.data(), &createCtx, nullptr);
+
+            const uint32_t inner = Ps2FastRead32(rdram.data(), kMpegAddr + 0x40u);
+            t.Equals(inner, kMpegWorkAddr, "sceMpegCreate should build its decoder in the work buffer");
+            t.Equals(Ps2FastRead32(rdram.data(), inner), 0u,
+                     "a new decoder's end flag should read zero whatever the buffer held");
+        });
+
         tc.Run("sceMpegDemuxPssRing dispatches registered video and audio stream callbacks", [](TestCase &t)
         {
             PS2Runtime runtime;