[HID] file-pad: implement GetKeystroke -- menus do not read GetState

The pad looked correct and did nothing. Its own log showed A arriving, the emulator sat on "PRESS (A) BUTTON", and the title never advanced. Cause: 360 front-ends poll XamInputGetKeystrokeEx, not XamInputGetState. This title imports both, and its menus use the keystroke path; the driver returned X_ERROR_EMPTY there, so every scripted press went into the void while GetState faithfully reported a button nobody asked about. Implement it edge-triggered, one event per call: KEYUPs for everything released first, then KEYDOWNs, matching the SDL driver's ordering (so a thumb transition clears before it sets). Deliberately NO auto-repeat -- scripted input wants exactly one event per press, and repeat is precisely what makes menu steps overshoot. Bits without a virtual key (guide, unused) are swallowed rather than re-offered forever. Verified on the real game: title -> main menu -> EXTRAS driven entirely from the pad file, with `[file-pad] keystroke vk=5800 down/up` in the log for each press.
[HID] file-pad: nanosecond change detection, and log every state change
2026-08-13 20:27:38 +00:00 · 2026-08-13 20:14:29 +00:00 · 2026-08-13 20:12:02 +00:00 · 2026-08-13 05:58:02 +00:00 · 2026-07-27 20:35:20 +02:00 · 2026-07-27 20:35:20 +02:00
30 changed files with 1671 additions and 20 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -94,6 +94,7 @@ node_modules/.bin/
 /build/
 /build-arm64/
 /build-x64/
+/build-cross/

 # ==============================================================================
 # Local-only paths
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -82,6 +82,23 @@ file(MAKE_DIRECTORY "${PROJECT_SOURCE_DIR}/scratch")
 # Python for shader compilation scripts
 find_package(Python3 REQUIRED COMPONENTS Interpreter)

+# Generate build-tree version.h via xenia-build.py's generate_version_h()
+# (normally invoked by `xb premake`/`xb build`; CMake-direct flows need it too).
+execute_process(
+  COMMAND ${Python3_EXECUTABLE} -c
+    "import importlib.util,sys; \
+     spec=importlib.util.spec_from_file_location('xb',r'${PROJECT_SOURCE_DIR}/xenia-build.py'); \
+     m=importlib.util.module_from_spec(spec); spec.loader.exec_module(m); \
+     m.generate_version_h(r'${CMAKE_BINARY_DIR}')"
+  WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
+  RESULT_VARIABLE _xenia_version_rc
+)
+if(NOT _xenia_version_rc EQUAL 0)
+  message(WARNING "version.h generation failed (rc=${_xenia_version_rc}); writing stub.")
+  file(WRITE "${CMAKE_BINARY_DIR}/version.h"
+    "#ifndef GENERATED_VERSION_H_\n#define GENERATED_VERSION_H_\n#define XE_BUILD_BRANCH \"unknown\"\n#define XE_BUILD_COMMIT \"unknown\"\n#define XE_BUILD_COMMIT_SHORT \"unknown\"\n#define XE_BUILD_DATE __DATE__\n#endif\n")
+endif()
+
 # Include helpers
 include(cmake/XeniaHelpers.cmake)

@@ -146,8 +163,14 @@ if(MSVC)

  # --- Per-configuration MSVC flags ---
  # Checked
-  string(APPEND CMAKE_C_FLAGS_CHECKED " /RTCsu /fsanitize=address")
-  string(APPEND CMAKE_CXX_FLAGS_CHECKED " /RTCsu /fsanitize=address")
+  if(CMAKE_CXX_COMPILER_FRONTEND_VARIANT STREQUAL "MSVC"
+     AND NOT CMAKE_CXX_COMPILER_ID STREQUAL "Clang")
+    string(APPEND CMAKE_C_FLAGS_CHECKED " /RTCsu /fsanitize=address")
+    string(APPEND CMAKE_CXX_FLAGS_CHECKED " /RTCsu /fsanitize=address")
+  else()
+    string(APPEND CMAKE_C_FLAGS_CHECKED " /fsanitize=address")
+    string(APPEND CMAKE_CXX_FLAGS_CHECKED " /fsanitize=address")
+  endif()
  string(APPEND CMAKE_EXE_LINKER_FLAGS_CHECKED " /INCREMENTAL:NO")
  add_compile_definitions($<$<CONFIG:Checked>:DEBUG>)

@@ -291,9 +314,14 @@ else()
  )
  add_compile_options($<$<CONFIG:Release>:-O3>)
  # Link-time optimization (use lld and llvm-ar/ranlib to avoid system
-  # linker/archiver LTO plugin version mismatch with clang's bitcode)
-  add_compile_options($<$<CONFIG:Release>:-flto=thin>)
-  add_link_options($<$<CONFIG:Release>:-flto=thin>)
+  # linker/archiver LTO plugin version mismatch with clang's bitcode).
+  # Guarded so memory-constrained hosts can build Release without the
+  # ThinLTO link-time memory spike: pass -DXENIA_ENABLE_LTO=OFF.
+  option(XENIA_ENABLE_LTO "Enable ThinLTO for Release builds" ON)
+  if(XENIA_ENABLE_LTO)
+    add_compile_options($<$<CONFIG:Release>:-flto=thin>)
+    add_link_options($<$<CONFIG:Release>:-flto=thin>)
+  endif()
  add_link_options($<$<CONFIG:Release>:-fuse-ld=lld>)
  find_program(LLVM_AR NAMES llvm-ar)
  find_program(LLVM_RANLIB NAMES llvm-ranlib)
--- a/CMakePresets.json
+++ b/CMakePresets.json
@@ -39,6 +39,22 @@
      "cacheVariables": {
        "CMAKE_SYSTEM_PROCESSOR": "ARM64"
      }
+    },
+    {
+      "name": "cross-win-clangcl",
+      "displayName": "Cross (Linux→Win MSVC) clang-cl + xwin",
+      "generator": "Ninja Multi-Config",
+      "binaryDir": "${sourceDir}/build-cross",
+      "toolchainFile": "${sourceDir}/cmake/toolchains/linux-to-win-msvc.cmake",
+      "condition": {
+        "type": "notEquals",
+        "lhs": "${hostSystemName}",
+        "rhs": "Windows"
+      },
+      "cacheVariables": {
+        "XWIN_DIR":  "$env{HOME}/.xwin/splat",
+        "FXC_PATH":  "$env{HOME}/.local/share/xenia-cross/fxc/fxc.exe"
+      }
    }
  ],
  "buildPresets": [
@@ -89,6 +105,9 @@
      "name": "vs-arm64-checked",
      "configurePreset": "vs-arm64",
      "configuration": "Checked"
-    }
+    },
+    { "name": "cross-debug",   "configurePreset": "cross-win-clangcl", "configuration": "Debug" },
+    { "name": "cross-release", "configurePreset": "cross-win-clangcl", "configuration": "Release" },
+    { "name": "cross-checked", "configurePreset": "cross-win-clangcl", "configuration": "Checked" }
  ]
 }
--- a/cmake/XeniaHelpers.cmake
+++ b/cmake/XeniaHelpers.cmake
@@ -192,6 +192,12 @@ function(xe_shader_rules_dxbc target shader_dir)
  set(_valid_stages vs hs ds gs ps cs)
  set(_commands)
  set(_bytecode_dir "${shader_dir}/bytecode/d3d12_5_1")
+  # Propagate FXC_PATH from the configure-time env so ninja-spawned python
+  # subprocesses can find fxc.exe (CMake `set(ENV{...})` doesn't reach build).
+  set(_env_prefix "")
+  if(DEFINED ENV{FXC_PATH})
+    set(_env_prefix ${CMAKE_COMMAND} -E env "FXC_PATH=$ENV{FXC_PATH}")
+  endif()
  list(APPEND _commands COMMAND ${CMAKE_COMMAND} -E make_directory "${_bytecode_dir}")
  foreach(src ${_sources})
    get_filename_component(_name ${src} NAME)
@@ -206,7 +212,7 @@ function(xe_shader_rules_dxbc target shader_dir)
    if(NOT _stage IN_LIST _valid_stages)
      continue()
    endif()
-    list(APPEND _commands COMMAND ${Python3_EXECUTABLE} "${_script}" "${src}" "${_bytecode_dir}/${_id}.h")
+    list(APPEND _commands COMMAND ${_env_prefix} ${Python3_EXECUTABLE} "${_script}" "${src}" "${_bytecode_dir}/${_id}.h")
  endforeach()
  add_custom_command(
    OUTPUT "${_stamp}"
--- a/cmake/toolchains/linux-to-win-msvc.cmake
+++ b/cmake/toolchains/linux-to-win-msvc.cmake
@@ -0,0 +1,119 @@
+# cmake/toolchains/linux-to-win-msvc.cmake
+# Linux host -> Windows MSVC-ABI cross toolchain using clang-cl + lld-link
+# + xwin-supplied Win10 SDK/CRT. Driven by Ninja Multi-Config.
+
+set(CMAKE_SYSTEM_NAME      Windows)
+set(CMAKE_SYSTEM_PROCESSOR x86_64)
+
+if(NOT DEFINED XWIN_DIR)
+  if(DEFINED ENV{XWIN_DIR})
+    set(XWIN_DIR "$ENV{XWIN_DIR}")
+  else()
+    set(XWIN_DIR "$ENV{HOME}/.xwin/splat")
+  endif()
+endif()
+set(XWIN_DIR "${XWIN_DIR}" CACHE PATH "xwin splat root (contains crt/ and sdk/)")
+
+if(NOT EXISTS "${XWIN_DIR}/crt/include")
+  message(FATAL_ERROR "XWIN_DIR=${XWIN_DIR} missing crt/include - run xwin splat.")
+endif()
+
+set(CMAKE_C_COMPILER   clang-cl)
+set(CMAKE_CXX_COMPILER clang-cl)
+set(CMAKE_LINKER       lld-link)
+set(CMAKE_RC_COMPILER  llvm-rc)
+set(CMAKE_AR           llvm-lib)
+set(CMAKE_MT           llvm-mt)
+
+set(CMAKE_C_COMPILER_TARGET   x86_64-pc-windows-msvc)
+set(CMAKE_CXX_COMPILER_TARGET x86_64-pc-windows-msvc)
+
+set(CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY)
+
+# Force /MD (release CRT) for every config. xenia's CMakeLists.txt does a
+# `string(REPLACE "/MDd" "/MD" ...)` on CMAKE_CXX_FLAGS_DEBUG, but with
+# clang-cl, the runtime selection comes from CMAKE_MSVC_RUNTIME_LIBRARY
+# (which expands to -MDd in dash form), so the substitution misses.
+# Pinning the policy here avoids the need for non-redistributable debug
+# CRT DLLs (MSVCP140D.dll etc) at runtime, which xwin doesn't ship.
+cmake_policy(SET CMP0091 NEW)
+set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreadedDLL")
+
+# xwin's default splat is a flat layout (crt/include, sdk/include/{ucrt,um,shared,...}),
+# which clang-cl's /winsysroot does NOT understand. Use explicit -imsvc + -libpath:
+# instead. Re-running `xwin splat --use-winsysroot-style` would also work but
+# requires re-downloading ~600 MB.
+# Use SHELL: prefix so CMake doesn't deduplicate repeated -imsvc tokens.
+add_compile_options(
+  "SHELL:-imsvc \"${XWIN_DIR}/crt/include\""
+  "SHELL:-imsvc \"${XWIN_DIR}/sdk/include/ucrt\""
+  "SHELL:-imsvc \"${XWIN_DIR}/sdk/include/um\""
+  "SHELL:-imsvc \"${XWIN_DIR}/sdk/include/shared\""
+  "SHELL:-imsvc \"${XWIN_DIR}/sdk/include/winrt\""
+)
+add_link_options(
+  "/libpath:${XWIN_DIR}/crt/lib/x86_64"
+  "/libpath:${XWIN_DIR}/sdk/lib/ucrt/x86_64"
+  "/libpath:${XWIN_DIR}/sdk/lib/um/x86_64"
+)
+# xwin pulls the latest MSVC STL which now hard-asserts Clang >= 19. Our host
+# has Clang 18, which works fine in practice — opt out of the version check.
+# (See yvals_core.h STL1000 in $XWIN_DIR/crt/include.)
+add_compile_definitions(_ALLOW_COMPILER_AND_STL_VERSION_MISMATCH)
+# llvm-rc needs SDK headers explicitly + the resource file's own dir so the
+# RC's relative ICON path (../../../assets/icon/icon.ico) resolves.
+get_filename_component(_toolchain_dir "${CMAKE_CURRENT_LIST_FILE}" DIRECTORY)
+get_filename_component(_xenia_root "${_toolchain_dir}/../.." ABSOLUTE)
+set(CMAKE_RC_FLAGS_INIT
+    "/I \"${XWIN_DIR}/sdk/include/um\" /I \"${XWIN_DIR}/sdk/include/shared\" /I \"${_xenia_root}/src/xenia/app\"")
+
+# Quiet MSVC-STL false positives and xenia-specific warnings that clang-cl
+# emits but cl.exe doesn't (treated as errors under /WX).
+add_compile_options(
+  -Wno-microsoft-include
+  -Wno-unused-command-line-argument
+  -Wno-ignored-pragma-intrinsic
+  -Wno-nonportable-include-path
+  -Wno-pragma-pack
+  -Wno-tautological-pointer-compare
+  -Wno-microsoft-cast
+  -Wno-deprecated-declarations
+  # These are silenced for native Linux Clang in CMakeLists.txt's else() branch,
+  # but the if(MSVC) branch fires under clang-cl and skips them — so re-add.
+  -Wno-switch
+  -Wno-attributes
+  -Wno-deprecated-register
+  -Wno-deprecated-volatile
+  -Wno-deprecated-enum-enum-conversion
+  # cl.exe accepts __pragma(optimize("s",on)); clang-cl only knows the empty
+  # argument form. xenia gates XE_MSVC_OPTIMIZE_SMALL on _MSC_VER so the
+  # rejected pragma still emits from the clang-cl path. Treat as no-op.
+  -Wno-ignored-pragmas
+  # xenia decorates several `virtual` methods with XE_FORCEINLINE; clang-cl
+  # then complains that the inline body isn't visible in includer TUs
+  # (definitions live in command_processor.cc). cl.exe accepts this silently.
+  -Wno-undefined-inline
+  -Wno-sizeof-pointer-memaccess
+  # `'ZM'` (PE magic, stored little-endian as "MZ" in the binary) — cl.exe
+  # accepts the multi-char constant silently; clang-cl errors under /WX.
+  -Wno-multichar
+)
+# _mm_cvtsi64x_si128 is an MSVC-only alias for the standard _mm_cvtsi64_si128.
+# Used (gated on XE_PLATFORM_WIN32) in xenia/gpu/draw_util.cc.
+add_compile_definitions(_mm_cvtsi64x_si128=_mm_cvtsi64_si128)
+
+# Plumb FXC for tools/build/compile_shader_dxbc.py (wine fxc auto-prepend).
+# Use real Win10 SDK fxc.exe 10.x (supports SM 5_1, produces vkd3d-proton-
+# acceptable DXBC).
+if(DEFINED ENV{FXC_PATH})
+  set(ENV_FXC "$ENV{FXC_PATH}")
+else()
+  set(ENV_FXC "$ENV{HOME}/.local/share/xenia-cross/fxc/fxc.exe")
+endif()
+set(ENV{FXC_PATH} "${ENV_FXC}")
+
+set(CMAKE_FIND_ROOT_PATH "${XWIN_DIR}")
+set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
+set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
+set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
+set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)
--- a/cmake/toolchains/xwin-case-symlinks.py
+++ b/cmake/toolchains/xwin-case-symlinks.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+"""Scan xenia source for #include <...> directives and ensure case-aliases
+exist in xwin's flat SDK/CRT include dirs. Idempotent — safe to re-run."""
+from __future__ import annotations
+import os, re, sys
+from pathlib import Path
+
+INCLUDE_RE = re.compile(r'^\s*#\s*include\s*<([A-Za-z][A-Za-z0-9_/.\-]*\.h)>',
+                        re.MULTILINE)
+SOURCE_ROOTS = ["src", "third_party/SDL2/src", "third_party/SDL2/include",
+                "third_party/discord-rpc/src", "third_party/fmt",
+                "third_party/imgui"]
+SOURCE_EXTS = {".h", ".hpp", ".inc", ".c", ".cc", ".cpp", ".cxx"}
+
+def collect_includes(repo_root: Path) -> set[str]:
+    seen: set[str] = set()
+    for root in SOURCE_ROOTS:
+        base = repo_root / root
+        if not base.exists(): continue
+        for path in base.rglob("*"):
+            if path.suffix.lower() not in SOURCE_EXTS: continue
+            try: txt = path.read_text(encoding="utf-8", errors="ignore")
+            except OSError: continue
+            for m in INCLUDE_RE.finditer(txt):
+                seen.add(m.group(1))
+    return seen
+
+def fix_dir(target_dir: Path, want: set[str]) -> int:
+    if not target_dir.is_dir(): return 0
+    idx = {e.name.lower(): e.name for e in target_dir.iterdir()}
+    created = 0
+    for name in want:
+        if "/" in name: continue
+        actual = idx.get(name.lower())
+        if actual is None or actual == name: continue
+        link = target_dir / name
+        if link.exists() or link.is_symlink(): continue
+        try:
+            link.symlink_to(actual)
+            created += 1
+        except OSError: pass
+    return created
+
+if __name__ == "__main__":
+    if len(sys.argv) != 3:
+        sys.exit("usage: xwin-case-symlinks.py <xenia-canary-root> <xwin-splat-dir>")
+    repo = Path(sys.argv[1]).resolve()
+    xwin = Path(sys.argv[2]).resolve()
+    want = collect_includes(repo)
+    total = 0
+    for d in (xwin/"crt/include", xwin/"sdk/include/ucrt",
+              xwin/"sdk/include/um", xwin/"sdk/include/shared",
+              xwin/"sdk/include/winrt"):
+        total += fix_dir(d, want)
+    print(f"Created {total} case-symlinks across {len(want)} unique includes.")
--- a/docs/CROSS_BUILD_SETUP.md
+++ b/docs/CROSS_BUILD_SETUP.md
@@ -0,0 +1,100 @@
+# Building and Running Xenia Canary Windows Debug from Linux
+
+## What we built and why
+
+A Windows-MSVC debug `xenia_canary.exe` cross-compiled on Linux, runnable under Wine. This serves as the audit oracle for the xenia-rs Rust port: the Linux-native canary build stalls before the front-end UI, so all audit comparisons (memory entries audit_044–audit_059) need the Wine-targeted debug binary as the ground-truth reference engine.
+
+## Phase 1 — Host setup (run in your terminal)
+
+    sudo apt install -y clang-18 lld-18 llvm-18      # clang-cl driver mode + lld-link + binutils
+    sudo ln -s /usr/bin/clang-18 /usr/bin/clang-cl   # activates MSVC-compatible driver mode
+    xwin --accept-license --arch x86_64 splat --include-debug-libs --output ~/.xwin/splat
+                                                      # ~807 MB Win10 SDK + MSVC CRT sysroot
+    curl ... linkid=2361406 -o ~/winsdk.iso          # Win10 SDK ISO for real fxc.exe (SM 5_1)
+    winetricks -q vkd3d                              # vkd3d-proton d3d12core.dll (5.96 MB)
+    winetricks -q dxvk                               # DXVK dxgi.dll (2.95 MB)
+
+Ubuntu's clang-18 / lld-18 apt packages ship binutils suffixed (llvm-lib-18, lld-link-18, etc.); the toolchain expects unsuffixed names on PATH. Create 4 symlinks in `~/.local/bin/` (no sudo needed since it was already on PATH).
+
+## Phase 2 — In-tree edits
+
+### 8 build-fix patches (compile-time only; zero runtime semantics changes)
+
+| § | File | What changed |
+|---|---|---|
+| 7.1 | `src/xenia/base/mapped_memory_win.cc:30` | `constexpr` → `const` for `kFileHandleInvalid` (clang-cl rejects `reinterpret_cast` in constant expressions) |
+| 7.2 | `src/xenia/app/main_resources.rc:3` | `..\\..\\..\\assets\\icon\\icon.ico` → forward slashes (llvm-rc backslash literalism) |
+| 7.3 | `third_party/snappy/snappy-stubs-public.h` | Already in place via the `fabi/sylpheed-crossbuild` snappy fork submodule |
+| 7.4 | `third_party/zlib-ng/zconf-ng.h:113` | `#if 1` → `#if !defined(_WIN32)` for `Z_HAVE_UNISTD_H` (header was pre-generated on Linux) |
+| 7.5 | `third_party/CMakeLists.txt:335` | Extended `if(NOT MSVC)` → `if(NOT MSVC OR CMAKE_CXX_COMPILER_ID STREQUAL "Clang")` for zlib-ng AVX flags |
+| 7.6a | `CMakeLists.txt` | Wrapped `/RTCsu` appends in `CMAKE_CXX_COMPILER_FRONTEND_VARIANT STREQUAL "MSVC" AND NOT … "Clang"` |
+| 7.6b | `CMakeLists.txt:85-101` | Inserted `execute_process` block invoking `xenia-build.py:generate_version_h()` so CMake-direct flow produces `version.h` |
+| 7.7 | `cmake/XeniaHelpers.cmake` | Added `_env_prefix` to wrap per-shader commands in `cmake -E env FXC_PATH=…` (`cmake set(ENV{…})` doesn't survive ninja's subprocess spawn) |
+| 7.8 | `tools/build/compile_shader_dxbc.py:74` | Added `_wineify()` helper translating unix paths via `winepath -w` before fxc sees them (fxc parses `/home/…` as a `/h` switch) |
+
+### 3 new cross-compile config files
+
+| File | Purpose |
+|---|---|
+| `cmake/toolchains/linux-to-win-msvc.cmake` | clang-cl + lld-link + xwin sysroot driver. Forces `MultiThreadedDLL` runtime (no debug-CRT DLLs needed), feeds `-imsvc` flags via `SHELL:` prefix, suppresses 15+ clang-cl-specific warnings, defines `_mm_cvtsi64x_si128` alias, opts out of MSVC STL's Clang≥19 assertion, plumbs `FXC_PATH` |
+| `cmake/toolchains/xwin-case-symlinks.py` | Scans xenia includes for mixed-case Windows headers and creates the missing case-aliases in xwin's flat splat (5 needed: `ObjBase.h`, `Psapi.h`, etc.) |
+| `CMakePresets.json` | Added `cross-win-clangcl` configure preset + `cross-debug` / `cross-release` / `cross-checked` build presets, gated on `${hostSystemName}` ≠ Windows |
+
+## Phase 3 — Configure + build
+
+    python3 cmake/toolchains/xwin-case-symlinks.py "$PWD" "$HOME/.xwin/splat"
+    # Created 5 case-symlinks across 556 unique includes
+
+    cmake --preset cross-win-clangcl
+    # Generates build-cross/ with build-Debug.ninja + auto-generated version.h
+
+    cmake --build build-cross --preset cross-debug --target xenia-app -j6
+    # 936 ninja targets. -j6 not -j12 because host RAM is tight (~3.4 GiB free at start)
+    # Wall time ~25 min total
+
+Final output: `xenia_canary.exe` (27 MB PE32+ GUI x86-64) + `xenia_canary.pdb` (116 MB CodeView).
+
+## Phase 4 — Running the game
+
+    cd "/home/fabi/RE Project Sylpheed/xenia-canary/build-cross/bin/Windows/Debug"
+    WINEDEBUG=-all wine ./xenia_canary.exe --mute=true \
+        "/home/fabi/RE Project Sylpheed/Project Sylpheed - Arc of Deception (USA, Europe) (En,Ja).iso"
+
+Kill after the boot phase completes (the audit workflow only needs ~30 s of trajectory):
+
+    sleep 30
+    wineserver -k
+
+### Expected boot signals in `xenia.log`
+
+| Signal | Value | Meaning |
+|---|---|---|
+| Total log lines | 1091 | Healthy boot (≥1000 = passes) |
+| `^x>` fatals | 0 | No `xe::FatalError()` triggered |
+| `^!>` errors | 28 | Non-fatal (occasional pipeline misses — normal) |
+| `^w>` warnings | 28 | Normal startup |
+| `i> Setup: Initializing chain` | Memory → Exports → Processor → Audio → Graphics → HID → VFS → Kernel | All eight subsystems came up |
+| `i> Setup: Starting graphics_system + Starting audio_system` | present | Threads spawned cleanly |
+| DXGI adapter | NVIDIA GeForce GTX 1070 Ti | vkd3d-proton + DXVK loaded |
+| `K> XThread::Execute thid N count` | 29 | Guest threads spawned (game is past `XexLoadImage`) |
+| `Skipping draw - pipeline not ready: VS … PS …` repeating | yes | D3D12 backend is async-compiling pipelines — expected on cold boot |
+| `F>` channel | 321 lines | VFS is mounting and walking the disc image |
+| `K>` channel | 29 lines | Kernel dispatching XThread creation |
+
+## Audit-workflow integration
+
+The cross-build is now the sole canary oracle. The Linux-native `xenia-canary/build/bin/Linux/Debug/xenia_canary` is deprecated for audits.
+
+All canary launches must include `--mute=true` (project policy 2026-05-12). XAudio2 still initializes — same code paths, silent output. Do not substitute `--apu=nop`; that switches backend entirely.
+
+Point logs at `audit-runs` with `--log_file=`:
+
+    LOG="$XENIA_RS_ROOT/xenia-rs/audit-runs/audit_NN/canary.log" \
+    WINEDEBUG=-all wine xenia_canary.exe \
+        --mute=true --log_file="$LOG" \
+        --audit_NN_my_probe=true \
+        "$ISO_PATH"
+
+Add new audit instrumentation as cvars in `cpu_flags.h` / `gpu_flags.h` / `kernel_flags.h`, guard with `if (cvars::audit_NN_my_probe)`, emit `XELOGI("AUDIT-NN-EVENT …")`. Rebuild incrementally — only the touched TU recompiles, ≤60 s.
+
+The build is observation-only: cvars + `XELOG*()` + `#if`-gated diagnostic blocks are permitted; changing control flow, return values, struct layouts, or timing is forbidden, since that would invalidate every downstream audit comparison.
--- a/src/xenia/app/emulator_window.cc
+++ b/src/xenia/app/emulator_window.cc
@@ -1067,6 +1067,11 @@ void EmulatorWindow::OnKeyDown(ui::KeyEvent& e) {
    case ui::VirtualKey::kF12: {
      TakeScreenshot();
    } break;
+    case ui::VirtualKey::kF10: {
+      // RE: snapshot the next frame's draws (world-space vertex positions) to
+      // xenia_ship_capture.log for capital-ship placement correlation.
+      xe::gpu::RequestShipCaptureFrame();
+    } break;

    case ui::VirtualKey::kEscape: {
      // Allow users to escape fullscreen (but not enter it).
@@ -1134,10 +1139,20 @@ void EmulatorWindow::OnMouseUp(const ui::MouseEvent& e) {
 void EmulatorWindow::TakeScreenshot() {
  xe::ui::RawImage image;

+  // Null-check the presenter BEFORE dereferencing it. The original condition
+  // called CaptureGuestOutput() on the pointer and only tested it for null
+  // afterwards, so pressing the screenshot key before/without a live presenter
+  // dereferenced a null pointer and crashed.
+  auto* presenter = GetGraphicsSystemPresenter();
+  if (presenter == nullptr) {
+    XELOGE("No graphics presenter available for screenshot");
+    return;
+  }
+
  imgui_drawer_->EnableNotifications(false);

-  if (!GetGraphicsSystemPresenter()->CaptureGuestOutput(image) ||
-      GetGraphicsSystemPresenter() == nullptr) {
+  if (!presenter->CaptureGuestOutput(image)) {
+    imgui_drawer_->EnableNotifications(true);
    XELOGE("Failed to capture guest output for screenshot");
    return;
  }
--- a/src/xenia/app/main_resources.rc
+++ b/src/xenia/app/main_resources.rc
@@ -1,3 +1,3 @@
 //{{NO_DEPENDENCIES}}

-MAINICON               ICON                    "..\\..\\..\\assets\\icon\\icon.ico"
+MAINICON               ICON                    "../../../assets/icon/icon.ico"
--- a/src/xenia/app/xenia_main.cc
+++ b/src/xenia/app/xenia_main.cc
@@ -64,6 +64,12 @@
 #include "xenia/hid/winkey/winkey_hid.h"
 #include "xenia/hid/xinput/xinput_hid.h"
 #endif  // XE_PLATFORM_WIN32
+// RE aid: a controller driven by a text file instead of a kernel input device.
+// A uinput pad created inside a container registers with the HOST's input stack
+// (input devices are not namespaced), so scripted input leaks to the desktop.
+// This one is visible only to whoever can read the file. Header-only on purpose:
+// it adds no build target.
+#include "xenia/hid/file/file_input_driver.h"

 #if XE_PLATFORM_WIN32
 #define APU_OPTIONS "[any, nop, sdl, xaudio2]"
@@ -72,7 +78,7 @@
 #elif XE_PLATFORM_LINUX
 #define APU_OPTIONS "[any, alsa, nop, sdl]"
 #define GPU_OPTIONS "[any, vulkan, null]"
-#define HID_OPTIONS "[any, nop, sdl]"
+#define HID_OPTIONS "[any, file, nop, sdl]"
 #else
 #define APU_OPTIONS "[any, nop, sdl]"
 #define GPU_OPTIONS "[any, vulkan, null]"
@@ -82,6 +88,11 @@
 DEFINE_string(apu, "any", "Audio system. Use: " APU_OPTIONS, "APU");
 DEFINE_string(gpu, "any", "Graphics system. Use: " GPU_OPTIONS, "GPU");
 DEFINE_string(hid, "any", "Input system. Use: " HID_OPTIONS, "HID");
+DEFINE_string(pad_file, "/tmp/xenia_pad.txt",
+              "Controller state file read by `--hid=file`: key=value pairs such "
+              "as `press=A,START lt=0 rt=255 lx=0 ly=0`. Absent keys are "
+              "neutral, a missing file means no input.",
+              "HID");

 DEFINE_path(
    storage_root, "",
@@ -446,6 +457,10 @@ std::vector<std::unique_ptr<hid::InputDriver>> EmulatorApp::CreateInputDrivers(
  if (cvars::hid.compare("nop") == 0) {
    drivers.emplace_back(
        xe::hid::nop::Create(window, EmulatorWindow::kZOrderHidInput));
+  } else if (cvars::hid.compare("file") == 0) {
+    // Explicit, never part of "any": this pad must be asked for.
+    drivers.emplace_back(
+        xe::hid::filepad::Create(window, EmulatorWindow::kZOrderHidInput));
  } else {
    Factory<hid::InputDriver, ui::Window*, size_t> factory;
 #if XE_PLATFORM_WIN32
--- a/src/xenia/apu/alsa/alsa_audio_driver.cc
+++ b/src/xenia/apu/alsa/alsa_audio_driver.cc
@@ -336,8 +336,30 @@ void ALSAAudioDriver::WorkerThread() {
    size_t current_write = write_index_.load(std::memory_order_acquire);

    if (current_read == current_write) {
-      // No data available, sleep and try again
-      std::this_thread::sleep_for(std::chrono::milliseconds(5));
+      // No guest audio available. During long guest stalls (e.g. a mission
+      // "Preparing for Sortie" load) the game stops submitting frames; if we
+      // merely sleep, ALSA drains its small buffer, XRUNs, and playback never
+      // recovers (the game's audio is silent for the rest of the session).
+      // Keep the PCM alive by topping it up with silence whenever the queued
+      // audio runs low, so real audio resumes seamlessly once the stall ends.
+      snd_pcm_sframes_t avail = snd_pcm_avail_update(pcm_handle_);
+      if (avail < 0) {
+        if (!RecoverFromUnderrun(avail)) {
+          running_ = false;
+        }
+        continue;
+      }
+      snd_pcm_uframes_t queued =
+          (buffer_size_ > (snd_pcm_uframes_t)avail) ? buffer_size_ - avail : 0;
+      if (queued < period_size_ * 2) {
+        snd_pcm_sframes_t w =
+            snd_pcm_writei(pcm_handle_, silence.get(), period_size_);
+        if (w < 0) {
+          RecoverFromUnderrun(w);
+        }
+      } else {
+        std::this_thread::sleep_for(std::chrono::milliseconds(2));
+      }
      continue;
    }

--- a/src/xenia/base/mapped_memory_win.cc
+++ b/src/xenia/base/mapped_memory_win.cc
@@ -26,8 +26,9 @@ namespace xe {
 class Win32MappedMemory : public MappedMemory {
 public:
  // CreateFile returns INVALID_HANDLE_VALUE in case of failure.
-  // chrispy: made inline const to get around clang error
-  static inline constexpr HANDLE kFileHandleInvalid = INVALID_HANDLE_VALUE;
+  // INVALID_HANDLE_VALUE expands to a reinterpret_cast which MSVC accepts
+  // in constexpr as an extension; clang-cl rejects it per C++ standard.
+  static inline const HANDLE kFileHandleInvalid = INVALID_HANDLE_VALUE;
  // CreateFileMapping returns nullptr in case of failure.
  static constexpr HANDLE kMappingHandleInvalid = nullptr;

--- a/src/xenia/cpu/backend/x64/x64_emitter.cc
+++ b/src/xenia/cpu/backend/x64/x64_emitter.cc
@@ -41,6 +41,30 @@

 DEFINE_bool(debugprint_trap_log, false,
            "Log debugprint traps to the active debugger", "CPU");
+DEFINE_uint32(audit_jit_prolog_pc, 0,
+              "Guest function entry PC at which to emit one XELOGKERNEL line "
+              "per JIT-compiled entry. When non-zero, the x64 emitter inserts "
+              "a CallNative to AuditLogJitPrologArgs at the start of the JIT "
+              "body of the matching guest function. Dumps r3..r10, LR, and 64 "
+              "bytes at host(r3). Zero (default) disables the probe. Audit-059 "
+              "round 7+ JIT-prolog probe — generic PC-configurable variant.",
+              "Auditing");
+DEFINE_uint32(audit_jit_prolog_mem_dump, 0,
+              "Audit-059 round 14 — paired memory-dump VA. When non-zero "
+              "AND audit_jit_prolog_pc fires, dereference the guest VA 3 "
+              "levels deep and emit one XELOGKERNEL line: addr -> val "
+              "(singleton instance), val -> vtable, vtable -> vtable[0] / "
+              "vtable[24]. Reads the singleton at [0x828E1F08], its vtable, "
+              "and its vtable[0] (first virtual method = bctrl target at "
+              "sub_822F1AA8+0x90). Zero (default) disables.",
+              "Auditing");
+DEFINE_uint32(audit_jit_prolog_r3_bytes, 0x40,
+              "Audit-052 — number of bytes to dump from host(r3) on every "
+              "audit_jit_prolog_pc fire (capped at 256, 16-byte aligned). "
+              "Default 64 (existing behaviour). Set to 80 to capture the "
+              "audit-051 stack-local struct at sub_82452DC0's r31+96 "
+              "(probe sub_8245B000 entry where r3 IS the struct ptr).",
+              "Auditing");
 DEFINE_bool(ignore_undefined_externs, true,
            "Don't exit when an undefined extern is called.", "CPU");
 DEFINE_bool(emit_source_annotations, false,
@@ -270,6 +294,17 @@ bool X64Emitter::Emit(HIRBuilder* builder, EmitFunctionInfo& func_info) {
  count on no other code modifying it. mov(GetMembaseReg(),
      qword[GetContextReg() + offsetof(ppc::PPCContext, virtual_membase)]);
  */
+  // Audit-059: PC-configurable JIT-prolog probe. Runtime-gated on the cvar
+  // audit_jit_prolog_pc (uint32; 0 disables). When non-zero and the current
+  // guest function's entry PC matches, emit a single CallNative to
+  // AuditLogJitPrologArgs that dumps r3..r10, LR, and 64 bytes at host(r3).
+  // Emits *before* any body instruction runs, so r3..r10 / LR in PPCContext
+  // still reflect the caller's args (no LOAD/STORE_CONTEXT has executed yet).
+  if (cvars::audit_jit_prolog_pc != 0u &&
+      current_guest_function_ == cvars::audit_jit_prolog_pc) {
+    extern uint64_t AuditLogJitPrologArgs(void* raw_context, uint64_t arg0);
+    CallNative(AuditLogJitPrologArgs, 0);
+  }
  // Body.
  auto block = builder->first_block();
  synchronize_stack_on_next_instruction_ = false;
@@ -438,6 +473,82 @@ uint64_t TrapDebugBreak(void* raw_context, uint64_t address) {
  return 0;
 }

+// Audit-059 JIT-prolog probe: dump r3..r10, LR, and 64 bytes at host(r3)
+// when the guest hits the JIT-compiled entry of the function whose entry PC
+// matches cvars::audit_jit_prolog_pc. Generic PC-configurable variant of the
+// round-7 sub_824F7800 hook. The hook logs the current guest PC so multiple
+// instrumentation campaigns can share log output.
+uint64_t AuditLogJitPrologArgs(void* raw_context, uint64_t /*unused*/) {
+  auto* ctx = reinterpret_cast<ppc::PPCContext_s*>(raw_context);
+  uint32_t pc = static_cast<uint32_t>(cvars::audit_jit_prolog_pc);
+  uint32_t r3 = static_cast<uint32_t>(ctx->r[3]);
+  uint32_t r4 = static_cast<uint32_t>(ctx->r[4]);
+  uint32_t r5 = static_cast<uint32_t>(ctx->r[5]);
+  uint32_t r6 = static_cast<uint32_t>(ctx->r[6]);
+  uint32_t r7 = static_cast<uint32_t>(ctx->r[7]);
+  uint32_t r8 = static_cast<uint32_t>(ctx->r[8]);
+  uint32_t r9 = static_cast<uint32_t>(ctx->r[9]);
+  uint32_t r10 = static_cast<uint32_t>(ctx->r[10]);
+  uint32_t lr = static_cast<uint32_t>(ctx->lr);
+
+  uint32_t tid = ctx->thread_state ? ctx->thread_state->thread_id() : 0u;
+
+  XELOGKERNEL(
+      "AUDIT-HLC JitProlog pc={:08X} tid={:08X} r3={:08X} r4={:08X} r5={:08X} "
+      "r6={:08X} r7={:08X} r8={:08X} r9={:08X} r10={:08X} lr={:08X}",
+      pc, tid, r3, r4, r5, r6, r7, r8, r9, r10, lr);
+
+  // Dump N bytes at host(r3) if r3 looks like a plausible guest VA.
+  // N comes from cvar `audit_jit_prolog_r3_bytes` (default 64 = existing
+  // behaviour). Round up to a 16-byte multiple; cap at 256.
+  uint32_t r3_dump_bytes = static_cast<uint32_t>(cvars::audit_jit_prolog_r3_bytes);
+  if (r3_dump_bytes > 256) r3_dump_bytes = 256;
+  r3_dump_bytes = (r3_dump_bytes + 15) & ~15u;
+  if (r3 >= 0x10000 && r3 < 0xE0000000) {
+    uint8_t* host = ctx->TranslateVirtual(r3);
+    if (host) {
+      for (uint32_t off = 0; off < r3_dump_bytes; off += 16) {
+        uint32_t d0 = xe::load_and_swap<uint32_t>(host + off + 0);
+        uint32_t d1 = xe::load_and_swap<uint32_t>(host + off + 4);
+        uint32_t d2 = xe::load_and_swap<uint32_t>(host + off + 8);
+        uint32_t d3 = xe::load_and_swap<uint32_t>(host + off + 12);
+        XELOGKERNEL(
+            "AUDIT-HLC JitProlog pc={:08X} r3+{:02X}: {:08X} {:08X} {:08X} "
+            "{:08X}",
+            pc, off, d0, d1, d2, d3);
+      }
+    } else {
+      XELOGKERNEL("AUDIT-HLC JitProlog pc={:08X} r3 translate failed", pc);
+    }
+  } else {
+    XELOGKERNEL("AUDIT-HLC JitProlog pc={:08X} r3 out of VA range, skipping dump",
+                pc);
+  }
+
+  // Audit-059 round 14 — paired 3-level dereference. When
+  // `audit_jit_prolog_mem_dump` is set, read the singleton at that VA,
+  // its vtable, vtable[0] (first virtual method = bctrl target), and
+  // vtable[24] (slot 6 = silph chain method per round 9).
+  uint32_t mem_addr = static_cast<uint32_t>(cvars::audit_jit_prolog_mem_dump);
+  if (mem_addr != 0u && mem_addr >= 0x10000 && mem_addr < 0xE0000000) {
+    auto load_be32 = [&](uint32_t va) -> uint32_t {
+      if (va < 0x10000 || va >= 0xE0000000) return 0u;
+      uint8_t* h = ctx->TranslateVirtual(va);
+      if (!h) return 0u;
+      return xe::load_and_swap<uint32_t>(h);
+    };
+    uint32_t val = load_be32(mem_addr);
+    uint32_t vtable = val != 0u ? load_be32(val) : 0u;
+    uint32_t m0 = vtable != 0u ? load_be32(vtable) : 0u;
+    uint32_t m6 = vtable != 0u ? load_be32(vtable + 24u) : 0u;
+    XELOGKERNEL(
+        "AUDIT-MEM-READ addr={:08X} val={:08X} vtable={:08X} vtable[0]={:08X} "
+        "vtable[24]={:08X} pc={:08X} tid={:08X}",
+        mem_addr, val, vtable, m0, m6, pc, tid);
+  }
+  return 0;
+}
+
 void X64Emitter::Trap(uint16_t trap_type) {
  switch (trap_type) {
    case 20:
--- a/src/xenia/gpu/command_processor.cc
+++ b/src/xenia/gpu/command_processor.cc
@@ -9,6 +9,9 @@

 #include "xenia/gpu/command_processor.h"

+#include <fstream>
+#include <unordered_set>
+
 #include "third_party/fmt/include/fmt/format.h"
 #include "xenia/base/byte_stream.h"
 #include "xenia/base/clock.h"
@@ -18,6 +21,8 @@
 #include "xenia/gpu/gpu_flags.h"
 #include "xenia/gpu/graphics_system.h"
 #include "xenia/gpu/packet_disassembler.h"
+#include "xenia/gpu/registers.h"
+#include "xenia/gpu/shader.h"
 #include "xenia/gpu/sampler_info.h"
 #include "xenia/gpu/texture_info.h"
 #include "xenia/gpu/xenos_zpd_report.h"
@@ -77,6 +82,14 @@ DEFINE_string(

 UPDATE_from_string(readback_resolve, 2025, 12, 4, 21, "fast");

+DEFINE_bool(
+    log_draws, false,
+    "Reverse-engineering aid: write each distinct draw's primitive type, index "
+    "buffer, and per-stream vertex declaration (stream base/stride + per-element "
+    "format/offset) to xenia_re_draws.log in the working directory. For decoding "
+    "game mesh formats against GPU ground truth.",
+    "GPU");
+
 DEFINE_bool(
    readback_memexport, false,
    "Read data written by memory export in shaders on the CPU. "
@@ -88,6 +101,373 @@ DEFINE_bool(
 namespace xe {
 namespace gpu {

+namespace {
+// Short readable name for a guest vertex element format (RE logging only).
+const char* ReVertexFormatName(xenos::VertexFormat f) {
+  switch (f) {
+    case xenos::VertexFormat::k_32_FLOAT:          return "f32";
+    case xenos::VertexFormat::k_32_32_FLOAT:       return "f32x2";
+    case xenos::VertexFormat::k_32_32_32_FLOAT:    return "f32x3";
+    case xenos::VertexFormat::k_32_32_32_32_FLOAT: return "f32x4";
+    case xenos::VertexFormat::k_16_16_FLOAT:       return "f16x2";
+    case xenos::VertexFormat::k_16_16_16_16_FLOAT: return "f16x4";
+    case xenos::VertexFormat::k_16_16:             return "s16x2";
+    case xenos::VertexFormat::k_16_16_16_16:       return "s16x4";
+    case xenos::VertexFormat::k_8_8_8_8:           return "8888";
+    case xenos::VertexFormat::k_2_10_10_10:        return "2_10_10_10";
+    case xenos::VertexFormat::k_10_11_11:          return "10_11_11";
+    case xenos::VertexFormat::k_11_11_10:          return "11_11_10";
+    case xenos::VertexFormat::k_32:                return "u32";
+    case xenos::VertexFormat::k_32_32:             return "u32x2";
+    case xenos::VertexFormat::k_32_32_32_32:       return "u32x4";
+    default:                                       return "?";
+  }
+}
+}  // namespace
+
+// ── Ship-placement capture (RE) ─────────────────────────────────────────────
+// A hotkey (F10 in the emulator window) requests a one-shot snapshot: the next
+// batch of draws is dumped to xenia_ship_capture_NN.log (NN = press number —
+// several angles can be captured in one run without overwriting) with each
+// draw's guest vertex-buffer address, vertex/index counts, up to 64 LOCAL
+// vertex positions, and the first 48 VS float constants (c0..c2 = the WVP rows
+// that place the part). De-duped by (buffer address, c0..c2 transform) — NOT by
+// address alone — so the SAME part buffer drawn several times (two engine
+// nacelles, every ship of a fleet) yields one record per distinct placement.
+namespace {
+constexpr int kShipCaptureBudget = 8000;  // draws to scan per request
+std::atomic<uint32_t> g_ship_capture_gen{0};
+std::atomic<int> g_ship_capture_remaining{0};
+}  // namespace
+
+void RequestShipCaptureFrame() {
+  uint32_t gen = g_ship_capture_gen.fetch_add(1, std::memory_order_relaxed) + 1;
+  g_ship_capture_remaining.store(kShipCaptureBudget, std::memory_order_relaxed);
+  XELOGI("[SHIP-CAP] capture armed → xenia_ship_capture_{:02d}.log", gen);
+}
+
+void CommandProcessor::CaptureShipDrawForRE(
+    uint32_t vgt_draw_initiator_value,
+    const IndexBufferInfo* index_buffer_info) {
+  if (g_ship_capture_remaining.load(std::memory_order_relaxed) <= 0) {
+    return;
+  }
+  static std::mutex cap_mutex;
+  static std::ofstream cap_out;
+  static std::unordered_set<uint64_t> cap_seen;  // by (vbase, WVP transform)
+  static uint32_t cap_gen = 0;
+  std::lock_guard<std::mutex> lock(cap_mutex);
+  if (g_ship_capture_remaining.load(std::memory_order_relaxed) <= 0) {
+    return;
+  }
+  // A new request (fresh generation) opens its own numbered snapshot file and
+  // clears the de-dup set, so each F10 press yields an independent capture.
+  uint32_t gen = g_ship_capture_gen.load(std::memory_order_relaxed);
+  if (gen != cap_gen || !cap_out.is_open()) {
+    if (cap_out.is_open()) {
+      cap_out.close();
+    }
+    auto name = fmt::format("xenia_ship_capture_{:02d}.log", gen);
+    cap_out.open(name, std::ios::out | std::ios::trunc);
+    cap_seen.clear();
+    cap_gen = gen;
+    XELOGI("[SHIP-CAP] writing {}", name);
+  }
+  g_ship_capture_remaining.fetch_sub(1, std::memory_order_relaxed);
+  if (!cap_out.is_open()) {
+    return;
+  }
+
+  reg::VGT_DRAW_INITIATOR init;
+  init.value = vgt_draw_initiator_value;
+  Shader* vs = active_vertex_shader_;
+  if (!vs || !vs->is_ucode_analyzed() || vs->vertex_bindings().empty()) {
+    return;
+  }
+  const auto& binding = vs->vertex_bindings()[0];
+  xenos::xe_gpu_vertex_fetch_t fetch =
+      register_file_->GetVertexFetch(binding.fetch_constant);
+  int32_t pos_off_bytes = -1;
+  for (const auto& attr : binding.attributes) {
+    if (attr.fetch_instr.attributes.data_format ==
+        xenos::VertexFormat::k_32_32_32_FLOAT) {
+      pos_off_bytes = attr.fetch_instr.attributes.offset * 4;
+      break;
+    }
+  }
+  uint32_t stride = binding.stride_words * 4;
+  uint32_t vbase = uint32_t(fetch.address) << 2;
+  uint32_t buf_bytes = uint32_t(fetch.size) * 4;
+  if (pos_off_bytes < 0 || stride == 0 || vbase == 0) {
+    return;  // no float-position stream (UI/effects) — skip
+  }
+  // One record per distinct (buffer, placement): hash the c0..c2 WVP rows so
+  // repeated draws of the SAME buffer at DIFFERENT transforms (multi-instance
+  // parts, fleet ships) each get their own record.
+  auto vsc0 = register_file_->Get<reg::SQ_VS_CONST>();
+  uint64_t th = 1469598103934665603ull;  // FNV-1a over the 12 c0..c2 floats
+  for (uint32_t i = 0; i < 12; ++i) {
+    uint32_t idx = vsc0.base + (i / 4);
+    if (idx >= 256) {
+      break;
+    }
+    uint32_t r = XE_GPU_REG_SHADER_CONSTANT_000_X + 4 * idx + (i % 4);
+    uint32_t bits = register_file_->values[r];
+    th = (th ^ bits) * 1099511628211ull;
+  }
+  // Mix the index range into the key as well (added 2026-08-13). The engine
+  // issues SEVERAL draws over one vertex buffer, each with its own index
+  // sub-range (the first Stage_02 capture showed a 119-vertex hull LOD drawn
+  // with 21 indices) — keying on (vbase, transform) alone kept only the first
+  // batch, which reads like a mysteriously short draw. With the range in the key
+  // every batch is recorded, so the block's full index extent is observable.
+  uint64_t ib_key = 0;
+  if (index_buffer_info) {
+    ib_key = (uint64_t(index_buffer_info->guest_base) << 20) ^
+             uint64_t(index_buffer_info->count);
+  }
+  uint64_t key = (uint64_t(vbase) << 32) ^ (th & 0xFFFFFFFFull) ^ (th >> 32) ^
+                 (ib_key * 1099511628211ull);
+  if (!cap_seen.insert(key).second) {
+    return;
+  }
+  if (cap_seen.size() > 8192) {
+    return;
+  }
+  uint32_t vcount = buf_bytes / stride;
+  cap_out << fmt::format(
+      "DRAW vbase=0x{:08X} stride={} vcount={} indices={} prim={} vs=0x{:016X}\n",
+      vbase, stride, vcount, uint32_t(init.num_indices),
+      uint32_t(init.prim_type), vs->ucode_data_hash());
+  // The guest's INDEX buffer for this draw. Our offline mesh decoder only
+  // *assumes* the index buffer sits immediately before the vertex buffer; this
+  // line is the ground truth for that assumption (ib base vs vbase), and the
+  // decoded min/max index says how much of the vertex pool the draw really
+  // covers — which is what the `indices=` field alone cannot answer.
+  if (index_buffer_info) {
+    const auto& ib = *index_buffer_info;
+    bool i32 = ib.format == xenos::IndexFormat::kInt32;
+    uint32_t icount = ib.count;
+    cap_out << fmt::format(
+        "  ib base=0x{:08X} count={} fmt={} endian={} len={} delta_vb={}",
+        ib.guest_base, icount, i32 ? "u32" : "u16", uint32_t(ib.endianness),
+        ib.length, int64_t(vbase) - int64_t(ib.guest_base));
+    const uint8_t* ip = memory_->TranslatePhysical<const uint8_t*>(ib.guest_base);
+    if (ip && icount) {
+      uint32_t scan = icount < 65536 ? icount : 65536;
+      uint32_t imin = 0xFFFFFFFFu, imax = 0;
+      auto rd = [&](uint32_t k) -> uint32_t {
+        // Guest index data is big-endian in memory (the endianness field says
+        // how the GPU swaps it); read it that way and record the field so the
+        // offline side can compensate if a draw ever differs.
+        const uint8_t* q = ip + (i32 ? k * 4 : k * 2);
+        return i32 ? (uint32_t(q[0]) << 24) | (uint32_t(q[1]) << 16) |
+                         (uint32_t(q[2]) << 8) | uint32_t(q[3])
+                   : (uint32_t(q[0]) << 8) | uint32_t(q[1]);
+      };
+      for (uint32_t k = 0; k < scan; ++k) {
+        uint32_t v = rd(k);
+        if (v < imin) imin = v;
+        if (v > imax) imax = v;
+      }
+      cap_out << fmt::format(" min={} max={} idx:", imin, imax);
+      uint32_t nd = icount < 24 ? icount : 24;
+      for (uint32_t k = 0; k < nd; ++k) {
+        cap_out << fmt::format(" {}", rd(k));
+      }
+    }
+    cap_out << "\n";
+  } else {
+    cap_out << "  ib auto\n";
+  }
+  uint32_t n = vcount < 64 ? vcount : 64;
+  cap_out << "  pos:";
+  auto be_f32 = [](const uint8_t* q) {
+    uint32_t w = (uint32_t(q[0]) << 24) | (uint32_t(q[1]) << 16) |
+                 (uint32_t(q[2]) << 8) | uint32_t(q[3]);
+    float f;
+    std::memcpy(&f, &w, 4);
+    return f;
+  };
+  for (uint32_t v = 0; v < n; ++v) {
+    uint32_t a = vbase + v * stride + uint32_t(pos_off_bytes);
+    const uint8_t* p = memory_->TranslatePhysical<const uint8_t*>(a);
+    if (!p) {
+      break;
+    }
+    cap_out << fmt::format(" ({:.4f},{:.4f},{:.4f})", be_f32(p), be_f32(p + 4),
+                           be_f32(p + 8));
+  }
+  cap_out << "\n";
+
+  // Vertex-shader float constants: the buffer holds LOCAL positions, so the
+  // per-part world (or world-view-projection) matrix that places the part lives
+  // here as a run of float4 constants. Diffing two parts' constants isolates the
+  // matrix (the camera VP block is shared). Dump the first 48 vec4 from the VS
+  // constant base as host-float (the register file stores them host-endian).
+  auto vsc = register_file_->Get<reg::SQ_VS_CONST>();
+  uint32_t cbase = vsc.base;  // starting float4 index
+  cap_out << fmt::format("  vsconst base={}:", cbase);
+  for (uint32_t i = 0; i < 48; ++i) {
+    uint32_t idx = cbase + i;
+    if (idx >= 256) {
+      break;
+    }
+    uint32_t r = XE_GPU_REG_SHADER_CONSTANT_000_X + 4 * idx;
+    float cx = register_file_->Get<float>(r);
+    float cy = register_file_->Get<float>(r + 1);
+    float cz = register_file_->Get<float>(r + 2);
+    float cw = register_file_->Get<float>(r + 3);
+    cap_out << fmt::format(" c{}=({:.4f},{:.4f},{:.4f},{:.4f})", i, cx, cy, cz,
+                           cw);
+  }
+  cap_out << "\n";
+  cap_out.flush();
+}
+
+void CommandProcessor::LogDrawForRE(uint32_t vgt_draw_initiator_value,
+                                    const IndexBufferInfo* index_buffer_info) {
+  // One-shot ship-placement capture runs independently of the log_draws cvar.
+  CaptureShipDrawForRE(vgt_draw_initiator_value, index_buffer_info);
+  if (!cvars::log_draws) {
+    return;
+  }
+  static std::mutex re_mutex;
+  static std::ofstream re_out;
+  static std::unordered_set<uint64_t> re_seen;
+  std::lock_guard<std::mutex> lock(re_mutex);
+  if (!re_out.is_open()) {
+    re_out.open("xenia_re_draws.log", std::ios::out | std::ios::trunc);
+    XELOGI("[RE-DRAW] logging distinct draws to xenia_re_draws.log");
+  }
+  if (!re_out.is_open()) {
+    return;
+  }
+
+  reg::VGT_DRAW_INITIATOR init;
+  init.value = vgt_draw_initiator_value;
+  Shader* vs = active_vertex_shader_;
+
+  // De-dup by the VERTEX-DECLARATION FINGERPRINT (shader + primitive type +
+  // per-stream element formats/offsets), NOT by buffer address. Animated UI
+  // that redraws the same mesh format into fresh buffers every frame therefore
+  // collapses to a single record, keeping the logging near-free — while every
+  // distinct mesh format (the player plane, each weapon) is still captured once.
+  uint64_t sig = 1469598103934665603ull;  // FNV-ish seed
+  auto mix = [&sig](uint64_t v) { sig = (sig ^ v) * 1099511628211ull; };
+  mix(uint64_t(init.prim_type));
+  if (vs) {
+    mix(vs->ucode_data_hash());
+  }
+  bool analyzed = vs && vs->is_ucode_analyzed();
+  if (analyzed) {
+    for (const auto& binding : vs->vertex_bindings()) {
+      mix(binding.fetch_constant);
+      mix(binding.stride_words);
+      for (const auto& attr : binding.attributes) {
+        mix(uint64_t(attr.fetch_instr.attributes.data_format));
+        mix(uint64_t(uint32_t(attr.fetch_instr.attributes.offset)));
+      }
+    }
+  } else {
+    mix(uint64_t(init.num_indices));
+  }
+  if (!re_seen.insert(sig).second) {
+    return;
+  }
+  // Safety cap on distinct formats, so a pathological title can't grow the log
+  // (and the working set) without bound.
+  if (re_seen.size() > 4096) {
+    return;
+  }
+
+  re_out << fmt::format("DRAW prim={} indices={} src={} ",
+                        uint32_t(init.prim_type), uint32_t(init.num_indices),
+                        uint32_t(init.source_select));
+  if (index_buffer_info) {
+    re_out << fmt::format(
+        "index[base=0x{:08X} count={} fmt={} endian={} len={}] ",
+        index_buffer_info->guest_base, index_buffer_info->count,
+        index_buffer_info->format == xenos::IndexFormat::kInt16 ? "u16" : "u32",
+        uint32_t(index_buffer_info->endianness), index_buffer_info->length);
+  } else {
+    re_out << "index[auto] ";
+  }
+  if (vs) {
+    re_out << fmt::format("vs=0x{:016X}", vs->ucode_data_hash());
+  }
+  re_out << "\n";
+
+  if (analyzed) {
+    for (const auto& binding : vs->vertex_bindings()) {
+      xenos::xe_gpu_vertex_fetch_t fetch =
+          register_file_->GetVertexFetch(binding.fetch_constant);
+      re_out << fmt::format(
+          "  stream fc={} base=0x{:08X} stride_words={} size_words={} "
+          "endian={} type={}\n",
+          binding.fetch_constant, uint32_t(fetch.address) << 2,
+          binding.stride_words, uint32_t(fetch.size), uint32_t(fetch.endian),
+          uint32_t(fetch.type));
+      for (const auto& attr : binding.attributes) {
+        const auto& a = attr.fetch_instr.attributes;
+        re_out << fmt::format(
+            "    attr fmt={}({}) offset_words={} stride_words={} signed={} "
+            "int={} exp_adjust={}\n",
+            uint32_t(a.data_format), ReVertexFormatName(a.data_format), a.offset,
+            a.stride, a.is_signed ? 1 : 0, a.is_integer ? 1 : 0, a.exp_adjust);
+      }
+    }
+
+    // Dump the first few vertex POSITIONS from guest memory. The f32 position
+    // bytes are identical between the guest buffer and the on-disc .xpr (only
+    // f16 pairs are rearranged on load), so these values can be searched for in
+    // the file to locate a mesh whose in-file offset is otherwise unknown
+    // (e.g. multi-XBG7 body meshes). See docs/re/structures/xbg7-mesh.md.
+    if (!vs->vertex_bindings().empty()) {
+      const auto& binding = vs->vertex_bindings()[0];
+      xenos::xe_gpu_vertex_fetch_t fetch =
+          register_file_->GetVertexFetch(binding.fetch_constant);
+      // Position = the first f32×3 attribute (offset is in dwords).
+      int32_t pos_off_bytes = -1;
+      for (const auto& attr : binding.attributes) {
+        if (attr.fetch_instr.attributes.data_format ==
+            xenos::VertexFormat::k_32_32_32_FLOAT) {
+          pos_off_bytes = attr.fetch_instr.attributes.offset * 4;
+          break;
+        }
+      }
+      uint32_t stride = binding.stride_words * 4;
+      uint32_t vbase = uint32_t(fetch.address) << 2;
+      uint32_t buf_bytes = uint32_t(fetch.size) * 4;
+      if (pos_off_bytes >= 0 && stride > 0) {
+        uint32_t max_v = buf_bytes / stride;
+        uint32_t n = max_v < 8 ? max_v : 8;
+        re_out << "  positions:";
+        for (uint32_t v = 0; v < n; ++v) {
+          uint32_t a = vbase + v * stride + uint32_t(pos_off_bytes);
+          const uint8_t* p = memory_->TranslatePhysical<const uint8_t*>(a);
+          if (!p) {
+            break;
+          }
+          auto be_f32 = [](const uint8_t* q) {
+            uint32_t w = (uint32_t(q[0]) << 24) | (uint32_t(q[1]) << 16) |
+                         (uint32_t(q[2]) << 8) | uint32_t(q[3]);
+            float f;
+            std::memcpy(&f, &w, 4);
+            return f;
+          };
+          re_out << fmt::format(" ({:.4f},{:.4f},{:.4f})", be_f32(p),
+                                be_f32(p + 4), be_f32(p + 8));
+        }
+        re_out << "\n";
+      }
+    }
+  } else {
+    re_out << "  (vertex shader not analyzed yet)\n";
+  }
+  re_out.flush();
+}
+
 // This should be written completely differently with support for different
 // types.
 void SaveGPUSetting(GPUSetting setting, uint64_t value) {
--- a/src/xenia/gpu/command_processor.h
+++ b/src/xenia/gpu/command_processor.h
@@ -35,6 +35,10 @@ class ByteStream;

 namespace gpu {

+// Arm a one-shot ship-placement capture (see CommandProcessor::CaptureShipDrawForRE).
+// Called from the UI thread (F10 hotkey); thread-safe. Defined in command_processor.cc.
+void RequestShipCaptureFrame();
+
 enum class GPUSetting { ClearMemoryPageState, ReadbackMemexport };

 enum class ReadbackResolveMode {
@@ -446,6 +450,21 @@ class CommandProcessor {
  }
  virtual bool IssueCopy() { return false; }

+  // Reverse-engineering aid (cvar `log_draws`): dump the guest's exact
+  // primitive type + index buffer + per-stream vertex declaration for each
+  // distinct draw to a dedicated file, for decoding game mesh formats.
+  // No-op unless the cvar is enabled. Defined in command_processor.cc.
+  void LogDrawForRE(uint32_t vgt_draw_initiator_value,
+                    const IndexBufferInfo* index_buffer_info);
+
+  // Ship-placement capture (RE): a one-shot snapshot armed by RequestShipCaptureFrame()
+  // (F10 hotkey). Dumps each draw's guest vertex-buffer address, vertex/index
+  // counts, and up to 64 WORLD-space positions to xenia_ship_capture.log, so a
+  // correlator can recover each capital-ship part's exact placement. Defined in
+  // command_processor.cc.
+  void CaptureShipDrawForRE(uint32_t vgt_draw_initiator_value,
+                            const IndexBufferInfo* index_buffer_info);
+
  // "Actual" is for the command processor thread, to be read by the
  // implementations.
  SwapPostEffect GetActualSwapPostEffect() const {
--- a/src/xenia/gpu/graphics_system.cc
+++ b/src/xenia/gpu/graphics_system.cc
@@ -13,6 +13,8 @@
 #include "xenia/base/clock.h"
 #include "xenia/base/logging.h"
 #include "xenia/base/math.h"
+#include "xenia/base/memory.h"
+#include "xenia/base/string_util.h"
 #include "xenia/base/profiling.h"
 #include "xenia/base/threading.h"
 #include "xenia/config.h"
@@ -36,6 +38,32 @@ DEFINE_bool(
    "runtime spikes and freezes when playing the game not for the first time.",
    "GPU");

+// Audit memory-watch: poll-based value-change logger for arbitrary guest VAs.
+// Reads the configured guest virtual address(es) once per vblank (per frame)
+// from inside GraphicsSystem::MarkVblank() and emits one XELOGKERNEL
+// "AUDIT-MEM-WATCH" line whenever the read value changes vs the previous
+// frame. Greppable on the same log stream as AUDIT-HLC / AUDIT-MEM-READ.
+// Default empty => disabled => zero overhead. Mechanism is poll/value-change
+// (NOT a write-trap), so it captures WHEN a value changes (vblank index +
+// emulator instruction count) but NOT the writer guest-PC. To find the writer
+// PC, pair this with audit_jit_prolog_pc on the suspected writer function.
+DEFINE_string(
+    audit_mem_watch_addr, "",
+    "Audit memory-watch — comma-separated list of guest virtual addresses "
+    "(hex, e.g. \"0x40d09a40\" or \"0x40d09a40,0x40929c00\") to poll once per "
+    "vblank. On every value change vs the previous frame, emit one "
+    "XELOGKERNEL AUDIT-MEM-WATCH line (watched VA, old value, new value, "
+    "vblank index, instruction count). Empty (default) disables the watch. "
+    "Poll-based value-change log: tells you WHEN a value changes, not the "
+    "writer PC.",
+    "Auditing");
+DEFINE_uint32(
+    audit_mem_watch_size, 4,
+    "Audit memory-watch — number of bytes to read at each watched VA (1, 2, "
+    "4, or 8). Read big-endian (guest byte order) and compared as a 64-bit "
+    "value. Default 4.",
+    "Auditing");
+
 namespace xe {
 namespace gpu {

@@ -333,12 +361,117 @@ void GraphicsSystem::DispatchInterruptCallback(uint32_t source, uint32_t cpu) {
                                        interrupt_callback_data_, source, cpu);
 }

+// Audit memory-watch poll. Called once per vblank from MarkVblank(). Parses
+// the comma-separated VA list from cvars::audit_mem_watch_addr exactly once
+// (cached), then reads each VA (big-endian, audit_mem_watch_size bytes) and
+// logs an AUDIT-MEM-WATCH line on every value change vs the previous frame.
+// Poll/value-change mechanism: captures WHEN, not the writer PC. Zero work
+// when the cvar is empty.
+static void AuditMemWatchPoll(Memory* memory, uint64_t vblank_index) {
+  struct WatchEntry {
+    uint32_t va;
+    uint64_t last_value;
+    bool have_last;
+  };
+  static std::vector<WatchEntry> entries;
+  static std::string parsed_spec;
+  static bool parse_failed = false;
+
+  const std::string& spec = cvars::audit_mem_watch_addr;
+  if (spec.empty()) {
+    return;
+  }
+  // (Re)parse only when the cvar string changes (set once at startup).
+  if (spec != parsed_spec) {
+    parsed_spec = spec;
+    entries.clear();
+    parse_failed = false;
+    size_t start = 0;
+    while (start <= spec.size()) {
+      size_t comma = spec.find(',', start);
+      std::string tok = spec.substr(
+          start, comma == std::string::npos ? std::string::npos : comma - start);
+      // Trim whitespace.
+      while (!tok.empty() && (tok.front() == ' ' || tok.front() == '\t'))
+        tok.erase(tok.begin());
+      while (!tok.empty() && (tok.back() == ' ' || tok.back() == '\t'))
+        tok.pop_back();
+      if (!tok.empty()) {
+        uint32_t va = 0;
+        try {
+          va = static_cast<uint32_t>(std::stoul(tok, nullptr, 16));
+        } catch (...) {
+          XELOGKERNEL("AUDIT-MEM-WATCH bad VA token '{}' in '{}'", tok, spec);
+          parse_failed = true;
+          va = 0;
+        }
+        if (va != 0) {
+          entries.push_back({va, 0, false});
+        }
+      }
+      if (comma == std::string::npos) break;
+      start = comma + 1;
+    }
+    XELOGKERNEL("AUDIT-MEM-WATCH armed: {} address(es), size={} bytes",
+                entries.size(),
+                static_cast<uint32_t>(cvars::audit_mem_watch_size));
+  }
+  if (entries.empty()) {
+    return;
+  }
+  (void)parse_failed;
+
+  uint32_t size = static_cast<uint32_t>(cvars::audit_mem_watch_size);
+  for (auto& e : entries) {
+    if (e.va < 0x10000 || e.va >= 0xE0000000) {
+      continue;
+    }
+    uint8_t* host = memory->TranslateVirtual(e.va);
+    if (!host) {
+      continue;
+    }
+    uint64_t value = 0;
+    switch (size) {
+      case 1:
+        value = *host;
+        break;
+      case 2:
+        value = xe::load_and_swap<uint16_t>(host);
+        break;
+      case 8:
+        value = xe::load_and_swap<uint64_t>(host);
+        break;
+      case 4:
+      default:
+        value = xe::load_and_swap<uint32_t>(host);
+        break;
+    }
+    if (!e.have_last) {
+      e.have_last = true;
+      e.last_value = value;
+      XELOGKERNEL(
+          "AUDIT-MEM-WATCH va={:08X} init={:016X} vblank={} (first read)",
+          e.va, value, vblank_index);
+      continue;
+    }
+    if (value != e.last_value) {
+      XELOGKERNEL(
+          "AUDIT-MEM-WATCH va={:08X} old={:016X} new={:016X} vblank={}",
+          e.va, e.last_value, value, vblank_index);
+      e.last_value = value;
+    }
+  }
+}
+
 void GraphicsSystem::MarkVblank() {
  SCOPE_profile_cpu_f("gpu");

  // Increment vblank counter (so the game sees us making progress).
  command_processor_->increment_counter();

+  // Audit memory-watch (poll-based; no-op unless audit_mem_watch_addr set).
+  AuditMemWatchPoll(memory_, command_processor_->counter());
+
  // TODO(benvanik): we shouldn't need to do the dispatch here, but there's
  //     something wrong and the CP will block waiting for code that
  //     needs to be run in the interrupt.
--- a/src/xenia/gpu/pm4_command_processor_implement.h
+++ b/src/xenia/gpu/pm4_command_processor_implement.h
@@ -1152,6 +1152,11 @@ bool COMMAND_PROCESSOR::ExecutePacketType3Draw(
               uint32_t(vgt_draw_initiator.prim_type),
               uint32_t(vgt_draw_initiator.source_select));
      }
+      // Reverse-engineering aid (no-op unless the `log_draws` cvar is set):
+      // record the guest's primitive type + index buffer + vertex declaration.
+      // Placed after IssueDraw so the vertex shader has been analyzed.
+      COMMAND_PROCESSOR::LogDrawForRE(
+          vgt_draw_initiator.value, is_indexed ? &index_buffer_info : nullptr);
    }
  }

--- a/src/xenia/hid/file/file_input_driver.h
+++ b/src/xenia/hid/file/file_input_driver.h
@@ -0,0 +1,341 @@
+/**
+ ******************************************************************************
+ * Xenia : Xbox 360 Emulator Research Project                                 *
+ ******************************************************************************
+ * RE aid: a controller whose state comes from a FILE, not from a device.
+ ******************************************************************************
+ */
+
+#ifndef XENIA_HID_FILE_FILE_INPUT_DRIVER_H_
+#define XENIA_HID_FILE_FILE_INPUT_DRIVER_H_
+
+// Why this exists
+// ---------------
+// The scripted-input tool used for reverse engineering created its pad through
+// `/dev/uinput`. Input devices are NOT namespaced by the kernel, so a uinput
+// device created inside a container is registered with the HOST's input stack:
+// every trigger hold and button press is delivered to whatever on the host reads
+// gamepads, not only to the emulator. That is a real leak, and it was noticed the
+// hard way.
+//
+// This driver takes the kernel out of the loop entirely. The pad state lives in
+// an ordinary text file that only this container can see, and `GetState` reads it
+// (re-parsing only when the file changes). Nothing is registered with the host,
+// no X server is involved either, and — a bonus for RE — the analogue values are
+// exact rather than whatever a virtual stick quantises to.
+//
+// File format: one or more whitespace/newline separated `key=value` pairs.
+//
+//     press=A,START        buttons by name (see kButtonNames), comma separated
+//     buttons=0x1010       or the raw XINPUT mask, if you prefer
+//     lt=0 rt=255          triggers, 0..255
+//     lx=0 ly=0            left thumb,  -32768..32767
+//     rx=0 ry=0            right thumb, -32768..32767
+//
+// Anything absent is neutral, so `press=A` alone is a valid file. An empty or
+// missing file means "no input" — which is also the safe default if the file is
+// deleted mid-run.
+//
+// Path: `--pad_file=<path>`, default `/tmp/xenia_pad.txt`. Only user 0 is
+// connected; other slots report no device, as a single-pad console would.
+
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <memory>
+#include <string>
+#include <sys/stat.h>
+
+#include "xenia/base/cvar.h"
+#include "xenia/base/logging.h"
+#include "xenia/hid/input_driver.h"
+#include "xenia/ui/virtual_key.h"
+
+DECLARE_string(pad_file);
+
+namespace xe {
+namespace hid {
+namespace filepad {
+
+struct NamedButton {
+  const char* name;
+  uint16_t mask;
+};
+
+static constexpr NamedButton kButtonNames[] = {
+    {"UP", X_INPUT_GAMEPAD_DPAD_UP},
+    {"DOWN", X_INPUT_GAMEPAD_DPAD_DOWN},
+    {"LEFT", X_INPUT_GAMEPAD_DPAD_LEFT},
+    {"RIGHT", X_INPUT_GAMEPAD_DPAD_RIGHT},
+    {"START", X_INPUT_GAMEPAD_START},
+    {"BACK", X_INPUT_GAMEPAD_BACK},
+    {"LS", X_INPUT_GAMEPAD_LEFT_THUMB},
+    {"RS", X_INPUT_GAMEPAD_RIGHT_THUMB},
+    {"LB", X_INPUT_GAMEPAD_LEFT_SHOULDER},
+    {"RB", X_INPUT_GAMEPAD_RIGHT_SHOULDER},
+    {"A", X_INPUT_GAMEPAD_A},
+    {"B", X_INPUT_GAMEPAD_B},
+    {"X", X_INPUT_GAMEPAD_X},
+    {"Y", X_INPUT_GAMEPAD_Y},
+};
+
+class FileInputDriver final : public InputDriver {
+ public:
+  FileInputDriver(xe::ui::Window* window, size_t window_z_order)
+      : InputDriver(window, window_z_order) {}
+  ~FileInputDriver() override = default;
+
+  X_STATUS Setup() override {
+    XELOGI("[file-pad] reading controller state from {}", cvars::pad_file);
+    return X_STATUS_SUCCESS;
+  }
+
+  X_RESULT GetCapabilities(uint32_t user_index, uint32_t flags,
+                           X_INPUT_CAPABILITIES* out_caps) override {
+    if (user_index != 0) {
+      return X_ERROR_DEVICE_NOT_CONNECTED;
+    }
+    std::memset(out_caps, 0, sizeof(*out_caps));
+    out_caps->type = 0x01;      // XINPUT_DEVTYPE_GAMEPAD
+    out_caps->sub_type = 0x01;  // XINPUT_DEVSUBTYPE_GAMEPAD
+    out_caps->flags = 0;
+    out_caps->gamepad.buttons = 0xFFFF;
+    out_caps->gamepad.left_trigger = 0xFF;
+    out_caps->gamepad.right_trigger = 0xFF;
+    out_caps->gamepad.thumb_lx = static_cast<int16_t>(0xFFFFu);
+    out_caps->gamepad.thumb_ly = static_cast<int16_t>(0xFFFFu);
+    out_caps->gamepad.thumb_rx = static_cast<int16_t>(0xFFFFu);
+    out_caps->gamepad.thumb_ry = static_cast<int16_t>(0xFFFFu);
+    return X_ERROR_SUCCESS;
+  }
+
+  X_RESULT GetState(uint32_t user_index, X_INPUT_STATE* out_state) override {
+    if (user_index != 0) {
+      return X_ERROR_DEVICE_NOT_CONNECTED;
+    }
+    Refresh();
+    std::memset(out_state, 0, sizeof(*out_state));
+    out_state->packet_number = packet_;
+    out_state->gamepad.buttons = buttons_;
+    out_state->gamepad.left_trigger = lt_;
+    out_state->gamepad.right_trigger = rt_;
+    out_state->gamepad.thumb_lx = lx_;
+    out_state->gamepad.thumb_ly = ly_;
+    out_state->gamepad.thumb_rx = rx_;
+    out_state->gamepad.thumb_ry = ry_;
+    return X_ERROR_SUCCESS;
+  }
+
+  X_RESULT SetState(uint32_t user_index, X_INPUT_VIBRATION* vibration) override {
+    return user_index == 0 ? X_ERROR_SUCCESS : X_ERROR_DEVICE_NOT_CONNECTED;
+  }
+
+  // Menus do NOT read the pad through GetState. "PRESS (A) BUTTON" and most
+  // 360 front-ends poll XamInputGetKeystrokeEx, so a driver that only answers
+  // GetState looks completely dead on a title screen while its own log happily
+  // shows the button arriving. Returning X_ERROR_EMPTY here is what made the
+  // first scripted run press A into the void.
+  //
+  // One event per call, edge triggered: KEYUPs for everything released, then
+  // KEYDOWNs for everything pressed, exactly as the SDL driver orders them.
+  // Deliberately NO auto-repeat — scripted input wants precisely one event per
+  // press, and repeat is what makes menu steps overshoot.
+  X_RESULT GetKeystroke(uint32_t user_index, uint32_t flags,
+                        X_INPUT_KEYSTROKE* out_keystroke) override {
+    const bool user_any = user_index == 0xFF || user_index == 0xFFFFFFFFu;
+    if (!user_any && user_index != 0) {
+      return X_ERROR_DEVICE_NOT_CONNECTED;
+    }
+    if (!out_keystroke) {
+      return X_ERROR_BAD_ARGUMENTS;
+    }
+    Refresh();
+
+    // Bit index in X_INPUT_GAMEPAD::buttons -> virtual key. Order matters: it is
+    // the order multiple simultaneous changes are reported in.
+    static constexpr uint16_t kVk[16] = {
+        uint16_t(ui::VirtualKey::kXInputPadDpadUp),
+        uint16_t(ui::VirtualKey::kXInputPadDpadDown),
+        uint16_t(ui::VirtualKey::kXInputPadDpadLeft),
+        uint16_t(ui::VirtualKey::kXInputPadDpadRight),
+        uint16_t(ui::VirtualKey::kXInputPadStart),
+        uint16_t(ui::VirtualKey::kXInputPadBack),
+        uint16_t(ui::VirtualKey::kXInputPadLThumbPress),
+        uint16_t(ui::VirtualKey::kXInputPadRThumbPress),
+        uint16_t(ui::VirtualKey::kXInputPadLShoulder),
+        uint16_t(ui::VirtualKey::kXInputPadRShoulder),
+        0, /* guide  */
+        0, /* unused */
+        uint16_t(ui::VirtualKey::kXInputPadA),
+        uint16_t(ui::VirtualKey::kXInputPadB),
+        uint16_t(ui::VirtualKey::kXInputPadX),
+        uint16_t(ui::VirtualKey::kXInputPadY),
+    };
+
+    const uint16_t changed = static_cast<uint16_t>(buttons_ ^ reported_);
+    if (!changed) {
+      return X_ERROR_EMPTY;
+    }
+    for (int pass = 0; pass < 2; ++pass) {
+      const bool clear_pass = pass == 0;
+      for (uint8_t i = 0; i < 16; ++i) {
+        const uint16_t bit = static_cast<uint16_t>(1u << i);
+        if (!(changed & bit) || kVk[i] == 0) {
+          continue;
+        }
+        const bool pressed = (buttons_ & bit) != 0;
+        if (clear_pass == pressed) {
+          continue;
+        }
+        reported_ = static_cast<uint16_t>(pressed ? (reported_ | bit)
+                                                  : (reported_ & ~bit));
+        out_keystroke->virtual_key = kVk[i];
+        out_keystroke->unicode = 0;
+        out_keystroke->flags =
+            pressed ? X_INPUT_KEYSTROKE_KEYDOWN : X_INPUT_KEYSTROKE_KEYUP;
+        out_keystroke->user_index = 0;
+        out_keystroke->hid_code = 0;
+        XELOGI("[file-pad] keystroke vk={:04X} {}", kVk[i],
+               pressed ? "down" : "up");
+        return X_ERROR_SUCCESS;
+      }
+    }
+    // Only bits without a virtual key changed (guide/unused): swallow them so
+    // the caller is not asked again forever.
+    reported_ = buttons_;
+    return X_ERROR_EMPTY;
+  }
+
+  InputType GetInputType() const override { return InputType::Controller; }
+
+ private:
+  // Re-parse only when the file actually changed: `GetState` is polled every
+  // frame and a stat is far cheaper than a read+parse.
+  //
+  // The change test uses **nanosecond** mtime, not `st_mtime`. Whole-second
+  // granularity plus size looked sufficient and is not: a script that steps a
+  // menu writes several same-length states per second (`press=A` then `press=B`,
+  // both 8 bytes), and every one of those after the first would be silently
+  // dropped. That failure is invisible — the emulator just does not react — so
+  // it is worth the extra field.
+  void Refresh() {
+    struct stat st;
+    if (::stat(cvars::pad_file.c_str(), &st) != 0) {
+      if (present_) {
+        present_ = false;
+        Neutral();
+        ++packet_;
+        XELOGI("[file-pad] {} gone -> neutral", cvars::pad_file);
+      }
+      return;
+    }
+    if (present_ && st.st_mtim.tv_sec == mtime_sec_ &&
+        st.st_mtim.tv_nsec == mtime_nsec_ && st.st_size == size_) {
+      return;
+    }
+    present_ = true;
+    mtime_sec_ = st.st_mtim.tv_sec;
+    mtime_nsec_ = st.st_mtim.tv_nsec;
+    size_ = st.st_size;
+    std::FILE* f = std::fopen(cvars::pad_file.c_str(), "rb");
+    if (!f) {
+      Neutral();
+      return;
+    }
+    char buf[512] = {0};
+    size_t n = std::fread(buf, 1, sizeof(buf) - 1, f);
+    std::fclose(f);
+    buf[n] = '\0';
+    Parse(buf);
+    ++packet_;
+    // One line per change (not per frame): with no display to watch, this log is
+    // the only proof that a scripted press was actually picked up.
+    XELOGI("[file-pad] #{} buttons={:04X} lt={} rt={} lx={} ly={} rx={} ry={}",
+           packet_, buttons_, lt_, rt_, lx_, ly_, rx_, ry_);
+  }
+
+  void Neutral() {
+    buttons_ = 0;
+    lt_ = rt_ = 0;
+    lx_ = ly_ = rx_ = ry_ = 0;
+  }
+
+  void Parse(const char* text) {
+    Neutral();
+    std::string s(text);
+    size_t pos = 0;
+    while (pos < s.size()) {
+      size_t end = s.find_first_of(" \t\r\n", pos);
+      if (end == std::string::npos) {
+        end = s.size();
+      }
+      std::string tok = s.substr(pos, end - pos);
+      pos = end + 1;
+      size_t eq = tok.find('=');
+      if (eq == std::string::npos) {
+        continue;
+      }
+      std::string key = tok.substr(0, eq), val = tok.substr(eq + 1);
+      if (key == "press") {
+        size_t p = 0;
+        while (p < val.size()) {
+          size_t c = val.find(',', p);
+          if (c == std::string::npos) {
+            c = val.size();
+          }
+          std::string name = val.substr(p, c - p);
+          p = c + 1;
+          for (const auto& b : kButtonNames) {
+            if (name == b.name) {
+              buttons_ |= b.mask;
+              break;
+            }
+          }
+        }
+      } else if (key == "buttons") {
+        buttons_ |= static_cast<uint16_t>(std::strtoul(val.c_str(), nullptr, 0));
+      } else if (key == "lt") {
+        lt_ = Clamp8(std::strtol(val.c_str(), nullptr, 0));
+      } else if (key == "rt") {
+        rt_ = Clamp8(std::strtol(val.c_str(), nullptr, 0));
+      } else if (key == "lx") {
+        lx_ = Clamp16(std::strtol(val.c_str(), nullptr, 0));
+      } else if (key == "ly") {
+        ly_ = Clamp16(std::strtol(val.c_str(), nullptr, 0));
+      } else if (key == "rx") {
+        rx_ = Clamp16(std::strtol(val.c_str(), nullptr, 0));
+      } else if (key == "ry") {
+        ry_ = Clamp16(std::strtol(val.c_str(), nullptr, 0));
+      }
+    }
+  }
+
+  static uint8_t Clamp8(long v) {
+    return static_cast<uint8_t>(v < 0 ? 0 : (v > 255 ? 255 : v));
+  }
+  static int16_t Clamp16(long v) {
+    return static_cast<int16_t>(v < -32768 ? -32768 : (v > 32767 ? 32767 : v));
+  }
+
+  uint16_t buttons_ = 0;
+  uint8_t lt_ = 0, rt_ = 0;
+  int16_t lx_ = 0, ly_ = 0, rx_ = 0, ry_ = 0;
+  uint32_t packet_ = 1;
+  // Buttons already reported through GetKeystroke; the edge detector's memory.
+  uint16_t reported_ = 0;
+  bool present_ = false;
+  time_t mtime_sec_ = 0;
+  long mtime_nsec_ = -1;
+  off_t size_ = -1;
+};
+
+inline std::unique_ptr<InputDriver> Create(xe::ui::Window* window,
+                                           size_t window_z_order) {
+  return std::make_unique<FileInputDriver>(window, window_z_order);
+}
+
+}  // namespace filepad
+}  // namespace hid
+}  // namespace xe
+
+#endif  // XENIA_HID_FILE_FILE_INPUT_DRIVER_H_
--- a/src/xenia/kernel/kernel_flags.cc
+++ b/src/xenia/kernel/kernel_flags.cc
@@ -14,3 +14,12 @@ DEFINE_bool(headless, false,
            "UI");
 DEFINE_bool(log_high_frequency_kernel_calls, false,
            "Log kernel calls with the kHighFrequency tag.", "Logging");
+DEFINE_bool(audit_handle_lifecycle, false,
+            "Emit XELOGKERNEL on Event/Semaphore/Wait lifecycle "
+            "(create/set/wait/complete). Audit oracle probe — off by default.",
+            "Auditing");
+DEFINE_uint32(audit_track_event_handle, 0,
+              "If non-zero and AUDIT-HLC enabled, log underlying X_KEVENT "
+              "guest VA whenever NtCreateEvent returns this handle. "
+              "Audit round-24 oracle probe.",
+              "Auditing");
--- a/src/xenia/kernel/kernel_flags.h
+++ b/src/xenia/kernel/kernel_flags.h
@@ -13,5 +13,7 @@

 DECLARE_bool(headless);
 DECLARE_bool(log_high_frequency_kernel_calls);
+DECLARE_bool(audit_handle_lifecycle);
+DECLARE_uint32(audit_track_event_handle);

 #endif  // XENIA_KERNEL_KERNEL_FLAGS_H_
--- a/src/xenia/kernel/kernel_state.cc
+++ b/src/xenia/kernel/kernel_state.cc
@@ -15,6 +15,7 @@
 #include "xenia/base/logging.h"
 #include "xenia/emulator.h"
 #include "xenia/hid/input_system.h"
+#include "xenia/kernel/kernel_flags.h"
 #include "xenia/kernel/user_module.h"
 #include "xenia/kernel/util/shim_utils.h"
 #include "xenia/kernel/xboxkrnl/xboxkrnl_memory.h"
@@ -1070,6 +1071,14 @@ void KernelState::CompleteOverlappedEx(uint32_t overlapped_ptr, X_RESULT result,
    auto ev = object_table()->LookupObject<XEvent>(event_handle);
    assert_not_null(ev);
    if (ev) {
+      if (cvars::audit_handle_lifecycle) {
+        uint32_t lr =
+            static_cast<uint32_t>(cpu::ThreadState::Get()->context()->lr);
+        XELOGKERNEL(
+            "AUDIT-HLC CompleteOverlappedEx_signal_event handle={:08X} "
+            "kevent_va={:08X} lr={:08X}",
+            uint32_t(event_handle), ev->guest_object(), lr);
+      }
      ev->Set(0, false);
    }
  }
@@ -1372,6 +1381,47 @@ void KernelState::EmulateCPInterruptDPC(uint32_t interrupt_callback,
    return;
  }

+  if (cvars::audit_handle_lifecycle) {
+    XELOGKERNEL(
+        "AUDIT-HLC EmulateCPInterruptDPC callback={:08X} data={:08X} source={} "
+        "cpu={}",
+        interrupt_callback, interrupt_callback_data, source, cpu);
+
+    // AUDIT-2BF round 14 — one-shot singleton + vtable dump. Resolves
+    // the silph init chain bctrl target at PC 0x822F1B4C (vtable[0] of
+    // ANON_Class_2D56F86D at [0x828E1F08]). Dereferences 3 deep:
+    // [0x828E1F08] (singleton) → vtable → vtable[0] (=first virtual
+    // method, the bctrl target) and vtable[24] (=slot 6, canary's silph
+    // chain target sub_821B55D8). Done once per process via atomic
+    // flag. Defensive null-checks at each level.
+    static std::atomic<bool> g_audit_singleton_dumped{false};
+    bool expected = false;
+    if (g_audit_singleton_dumped.compare_exchange_strong(expected, true)) {
+      const uint32_t addr = 0x828E1F08;
+      uint32_t val = 0, vtable = 0, m0 = 0, m6 = 0;
+      auto* host_addr = memory()->TranslateVirtual<uint32_t*>(addr);
+      if (host_addr) {
+        val = xe::load_and_swap<uint32_t>(host_addr);
+      }
+      if (val) {
+        auto* host_val = memory()->TranslateVirtual<uint32_t*>(val);
+        if (host_val) {
+          vtable = xe::load_and_swap<uint32_t>(host_val);
+        }
+      }
+      if (vtable) {
+        auto* host_vt0 = memory()->TranslateVirtual<uint32_t*>(vtable);
+        auto* host_vt6 = memory()->TranslateVirtual<uint32_t*>(vtable + 24);
+        if (host_vt0) m0 = xe::load_and_swap<uint32_t>(host_vt0);
+        if (host_vt6) m6 = xe::load_and_swap<uint32_t>(host_vt6);
+      }
+      XELOGKERNEL(
+          "AUDIT-HLC singleton[0x828E1F08]={:08X} vtable={:08X} "
+          "vtable[0]={:08X} vtable[24]={:08X}",
+          val, vtable, m0, m6);
+    }
+  }
+
  auto thread = kernel::XThread::GetCurrentThread();
  assert_not_null(thread);

--- a/src/xenia/kernel/xboxkrnl/xboxkrnl_io.cc
+++ b/src/xenia/kernel/xboxkrnl/xboxkrnl_io.cc
@@ -8,7 +8,9 @@
 */

 #include "xenia/base/logging.h"
+#include "xenia/cpu/thread_state.h"
 #include "xenia/kernel/info/file.h"
+#include "xenia/kernel/kernel_flags.h"
 #include "xenia/kernel/kernel_state.h"
 #include "xenia/kernel/util/shim_utils.h"
 #include "xenia/kernel/xboxkrnl/xboxkrnl_private.h"
@@ -208,6 +210,13 @@ dword_result_t NtReadFile_entry(dword_t file_handle, dword_t event_handle,
  }

  if (ev && signal_event) {
+    if (cvars::audit_handle_lifecycle) {
+      uint32_t lr = static_cast<uint32_t>(cpu::ThreadState::Get()->context()->lr);
+      XELOGKERNEL(
+          "AUDIT-HLC NtReadFile_signal_event handle={:08X} kevent_va={:08X} "
+          "lr={:08X}",
+          uint32_t(event_handle), ev->guest_object(), lr);
+    }
    ev->Set(0, false);
  }

@@ -294,6 +303,13 @@ dword_result_t NtReadFileScatter_entry(
  }

  if (ev && signal_event) {
+    if (cvars::audit_handle_lifecycle) {
+      uint32_t lr = static_cast<uint32_t>(cpu::ThreadState::Get()->context()->lr);
+      XELOGKERNEL(
+          "AUDIT-HLC NtReadFileScatter_signal_event handle={:08X} "
+          "kevent_va={:08X} lr={:08X}",
+          uint32_t(event_handle), ev->guest_object(), lr);
+    }
    ev->Set(0, false);
  }

@@ -381,6 +397,13 @@ dword_result_t NtWriteFile_entry(dword_t file_handle, dword_t event_handle,
  }

  if (ev && signal_event) {
+    if (cvars::audit_handle_lifecycle) {
+      uint32_t lr = static_cast<uint32_t>(cpu::ThreadState::Get()->context()->lr);
+      XELOGKERNEL(
+          "AUDIT-HLC NtWriteFile_signal_event handle={:08X} kevent_va={:08X} "
+          "lr={:08X}",
+          uint32_t(event_handle), ev->guest_object(), lr);
+    }
    ev->Set(0, false);
  }

--- a/src/xenia/kernel/xboxkrnl/xboxkrnl_ob.cc
+++ b/src/xenia/kernel/xboxkrnl/xboxkrnl_ob.cc
@@ -10,6 +10,8 @@
 #include "xenia/kernel/xboxkrnl/xboxkrnl_ob.h"
 #include "xenia/base/logging.h"
 #include "xenia/cpu/processor.h"
+#include "xenia/cpu/thread_state.h"
+#include "xenia/kernel/kernel_flags.h"
 #include "xenia/kernel/kernel_state.h"
 #include "xenia/kernel/xboxkrnl/xboxkrnl_private.h"
 #include "xenia/kernel/xboxkrnl/xboxkrnl_threading.h"
@@ -398,6 +400,14 @@ dword_result_t NtDuplicateObject_entry(dword_t handle, lpdword_t new_handle_ptr,
  X_STATUS result =
      kernel_state()->object_table()->DuplicateHandle(handle, &new_handle);

+  if (cvars::audit_handle_lifecycle) {
+    uint32_t lr = static_cast<uint32_t>(cpu::ThreadState::Get()->context()->lr);
+    XELOGKERNEL(
+        "AUDIT-HLC NtDuplicateObject src={:08X} dst={:08X} options={:08X} "
+        "lr={:08X}",
+        uint32_t(handle), uint32_t(new_handle), uint32_t(options), lr);
+  }
+
  if (new_handle_ptr) {
    *new_handle_ptr = new_handle;
  }
--- a/src/xenia/kernel/xboxkrnl/xboxkrnl_threading.cc
+++ b/src/xenia/kernel/xboxkrnl/xboxkrnl_threading.cc
@@ -8,10 +8,12 @@
 */

 #include "xenia/kernel/xboxkrnl/xboxkrnl_threading.h"
+#include <atomic>
 #include "xenia/base/atomic.h"
 #include "xenia/base/clock.h"
 #include "xenia/base/platform.h"
 #include "xenia/cpu/processor.h"
+#include "xenia/kernel/kernel_flags.h"
 #include "xenia/kernel/util/shim_utils.h"
 #include "xenia/kernel/xboxkrnl/xboxkrnl_private.h"
 #include "xenia/kernel/xsemaphore.h"
@@ -22,6 +24,9 @@ namespace xe {
 namespace kernel {
 namespace xboxkrnl {

+// AUDIT-HLC: one-shot guard for silph::WorkerCtx context dump (round5).
+static std::atomic<bool> g_audit_silph_ctx_dumped{false};
+
 // r13 + 0x100: pointer to thread local state
 // Thread local state:
 //   0x058: kernel time
@@ -192,6 +197,30 @@ dword_result_t ExCreateThread_entry(lpdword_t handle_ptr, dword_t stack_size,
                                    lpvoid_t start_address,
                                    lpvoid_t start_context,
                                    dword_t creation_flags) {
+  if (cvars::audit_handle_lifecycle) {
+    auto* ctx = cpu::ThreadState::Get()->context();
+    uint32_t lr = static_cast<uint32_t>(ctx->lr);
+    // Walk one PPC stack frame up from the shim's frame to recover the GUEST
+    // caller's LR (lr_enter is just the kernel-internal shim's return
+    // address; we want the function that called *it*). Same convention as
+    // the NtWaitForSingleObjectEx probe above.
+    uint32_t guest_lr = 0;
+    uint32_t sp = static_cast<uint32_t>(ctx->r[1]);
+    uint32_t back1 = xe::load_and_swap<uint32_t>(ctx->TranslateVirtual(sp));
+    if (back1) {
+      uint32_t back2 =
+          xe::load_and_swap<uint32_t>(ctx->TranslateVirtual(back1));
+      if (back2) {
+        guest_lr =
+            xe::load_and_swap<uint32_t>(ctx->TranslateVirtual(back2 - 8));
+      }
+    }
+    XELOGKERNEL(
+        "AUDIT-HLC ExCreateThread entry={:08X} start_ctx={:08X} xapi={:08X} "
+        "flags={:08X} lr={:08X} guest_lr={:08X}",
+        uint32_t(start_address), uint32_t(start_context),
+        uint32_t(xapi_thread_startup), uint32_t(creation_flags), lr, guest_lr);
+  }
  return ExCreateThread(handle_ptr, stack_size, thread_id_ptr,
                        xapi_thread_startup, start_address, start_context,
                        creation_flags);
@@ -582,6 +611,48 @@ uint32_t xeKeSetEvent(X_KEVENT* event_ptr, uint32_t increment, uint32_t wait) {

 dword_result_t KeSetEvent_entry(pointer_t<X_KEVENT> event_ptr,
                                dword_t increment, dword_t wait) {
+  if (cvars::audit_handle_lifecycle) {
+    uint32_t lr = static_cast<uint32_t>(cpu::ThreadState::Get()->context()->lr);
+    XELOGKERNEL("AUDIT-HLC KeSetEvent guest_ptr={:08X} lr={:08X}",
+                uint32_t(event_ptr.guest_address()), lr);
+    // AUDIT-HLC round5: one-shot hexdump of the silph::WorkerCtx context when
+    // KeSetEvent first fires into the silph UI PKEVENT cluster
+    // (0xBCE25214/24/34/44 in current builds; widened a bit for allocator
+    // drift). Used by iterate 2.BF context-replication.
+    uint32_t ev_addr = uint32_t(event_ptr.guest_address());
+    if (ev_addr >= 0xBCE25200 && ev_addr < 0xBCE25300) {
+      if (!g_audit_silph_ctx_dumped.exchange(true)) {
+        // Events live at ctx+0x54, +0x64, +0x74, +0x84 (16-byte stride).
+        // Compute ctx_base assuming the canonical layout (lowest event at
+        // ctx+0x54 → ctx_base = 0xBCE251C0 when ev_addr == 0xBCE25214).
+        uint32_t event_offset_in_ctx = ev_addr - 0xBCE251C0;
+        uint32_t ctx_base = ev_addr - event_offset_in_ctx;
+        auto* ctx = cpu::ThreadState::Get()->context();
+        uint8_t* host = ctx->TranslateVirtual(ctx_base);
+        XELOGKERNEL(
+            "AUDIT-HLC silph_ctx_dump ctx_base={:08X} (event {:08X} at +{:02X})",
+            ctx_base, ev_addr, event_offset_in_ctx);
+        for (uint32_t off = 0; off < 0x300; off += 16) {
+          uint32_t d0 = xe::load_and_swap<uint32_t>(host + off + 0);
+          uint32_t d1 = xe::load_and_swap<uint32_t>(host + off + 4);
+          uint32_t d2 = xe::load_and_swap<uint32_t>(host + off + 8);
+          uint32_t d3 = xe::load_and_swap<uint32_t>(host + off + 12);
+          XELOGKERNEL("AUDIT-HLC DUMP {:08X}: {:08X} {:08X} {:08X} {:08X}",
+                      ctx_base + off, d0, d1, d2, d3);
+        }
+        XELOGKERNEL("AUDIT-HLC silph_ctx event-slots:");
+        for (uint32_t i = 0; i < 8; ++i) {
+          uint32_t ev_off = 0x54 + i * 0x10;
+          uint32_t hdr = xe::load_and_swap<uint32_t>(host + ev_off + 0);
+          uint32_t state = xe::load_and_swap<uint32_t>(host + ev_off + 4);
+          XELOGKERNEL(
+              "AUDIT-HLC   slot[{}] off=+{:02X} addr={:08X} hdr={:08X} "
+              "state={:08X}",
+              i, ev_off, ctx_base + ev_off, hdr, state);
+        }
+      }
+    }
+  }
  return xeKeSetEvent(event_ptr, increment, wait);
 }
 DECLARE_XBOXKRNL_EXPORT2(KeSetEvent, kThreading, kImplemented, kHighFrequency);
@@ -639,6 +710,29 @@ dword_result_t NtCreateEvent_entry(
  if (handle_ptr) {
    *handle_ptr = ev->handle();
  }
+  if (cvars::audit_handle_lifecycle) {
+    uint32_t lr = static_cast<uint32_t>(cpu::ThreadState::Get()->context()->lr);
+    uint32_t out_handle = handle_ptr ? uint32_t(*handle_ptr) : 0u;
+    XELOGKERNEL(
+        "AUDIT-HLC NtCreateEvent handle={:08X} type={} initial_state={} "
+        "lr={:08X}",
+        out_handle, uint32_t(event_type), uint32_t(initial_state), lr);
+    // Round-24: also log the underlying X_KEVENT guest VA for every
+    // NtCreateEvent so KeSetEvent probes can be cross-referenced by ptr.
+    XELOGKERNEL(
+        "AUDIT-HLC NtCreateEvent_inner handle={:08X} kevent_va={:08X} "
+        "lr={:08X}",
+        out_handle, ev->guest_object(), lr);
+    // When caller pinned a target handle, additionally emit the legacy
+    // _target line so older round-24 grep recipes still match.
+    if (cvars::audit_track_event_handle != 0 &&
+        out_handle == cvars::audit_track_event_handle) {
+      XELOGKERNEL(
+          "AUDIT-HLC NtCreateEvent_target handle={:08X} object_va={:08X} "
+          "lr={:08X}",
+          out_handle, ev->guest_object(), lr);
+    }
+  }
  return X_STATUS_SUCCESS;
 }
 DECLARE_XBOXKRNL_EXPORT1(NtCreateEvent, kThreading, kImplemented);
@@ -664,6 +758,26 @@ uint32_t xeNtSetEvent(uint32_t handle, xe::be<uint32_t>* previous_state_ptr) {
 }

 dword_result_t NtSetEvent_entry(dword_t handle, lpdword_t previous_state_ptr) {
+  if (cvars::audit_handle_lifecycle) {
+    auto* ctx = cpu::ThreadState::Get()->context();
+    uint32_t lr = static_cast<uint32_t>(ctx->lr);
+    // Round-24: walk PPC back-chain for caller's guest LR (same idiom as
+    // NtWaitForSingleObjectEx probe).
+    uint32_t guest_lr = 0;
+    uint32_t sp = static_cast<uint32_t>(ctx->r[1]);
+    uint32_t back1 = xe::load_and_swap<uint32_t>(ctx->TranslateVirtual(sp));
+    if (back1) {
+      uint32_t back2 =
+          xe::load_and_swap<uint32_t>(ctx->TranslateVirtual(back1));
+      if (back2) {
+        guest_lr = xe::load_and_swap<uint32_t>(
+            ctx->TranslateVirtual(back2 - 8));
+      }
+    }
+    XELOGKERNEL(
+        "AUDIT-HLC NtSetEvent handle={:08X} lr={:08X} guest_lr={:08X}",
+        uint32_t(handle), lr, guest_lr);
+  }
  return xeNtSetEvent(handle, previous_state_ptr);
 }
 DECLARE_XBOXKRNL_EXPORT2(NtSetEvent, kThreading, kImplemented, kHighFrequency);
@@ -1038,9 +1152,43 @@ dword_result_t NtWaitForSingleObjectEx_entry(dword_t object_handle,
                                             dword_t wait_mode,
                                             dword_t alertable,
                                             lpqword_t timeout_ptr) {
+  uint32_t lr_enter = 0;
+  uint32_t guest_lr = 0;
+  if (cvars::audit_handle_lifecycle) {
+    auto* ctx = cpu::ThreadState::Get()->context();
+    lr_enter = static_cast<uint32_t>(ctx->lr);
+    // Walk one PPC stack frame up from the wait wrapper's frame to recover
+    // the GUEST caller's LR (lr_enter is just the kernel-internal wait
+    // wrapper's return address; we want the function that called *it*).
+    // Xbox 360 PPC convention: prologue stores caller's LR at [old_sp - 8]
+    // *before* bumping r1 to the new frame, so from any frame, the LR saved
+    // by that frame's prologue lives at (back_chain - 8). See xenia-rs
+    // walk_guest_back_chain in crates/xenia-kernel/src/state.rs.
+    uint32_t sp = static_cast<uint32_t>(ctx->r[1]);
+    uint32_t back1 = xe::load_and_swap<uint32_t>(ctx->TranslateVirtual(sp));
+    if (back1) {
+      uint32_t back2 =
+          xe::load_and_swap<uint32_t>(ctx->TranslateVirtual(back1));
+      if (back2) {
+        guest_lr = xe::load_and_swap<uint32_t>(
+            ctx->TranslateVirtual(back2 - 8));
+      }
+    }
+    XELOGKERNEL(
+        "AUDIT-HLC NtWaitForSingleObjectEx handle={:08X} alertable={} "
+        "lr={:08X} guest_lr={:08X}",
+        uint32_t(object_handle), uint32_t(alertable), lr_enter, guest_lr);
+  }
  uint64_t timeout = timeout_ptr ? static_cast<uint64_t>(*timeout_ptr) : 0u;
-  return NtWaitForSingleObjectEx(object_handle, wait_mode, alertable,
-                                 timeout_ptr ? &timeout : nullptr);
+  uint32_t result = NtWaitForSingleObjectEx(object_handle, wait_mode, alertable,
+                                            timeout_ptr ? &timeout : nullptr);
+  if (cvars::audit_handle_lifecycle) {
+    XELOGKERNEL(
+        "AUDIT-HLC NtWaitForSingleObjectEx_done handle={:08X} result={:08X} "
+        "lr={:08X} guest_lr={:08X}",
+        uint32_t(object_handle), result, lr_enter, guest_lr);
+  }
+  return result;
 }
 DECLARE_XBOXKRNL_EXPORT3(NtWaitForSingleObjectEx, kThreading, kImplemented,
                         kBlocking, kHighFrequency);
--- a/src/xenia/kernel/xconfig.cc
+++ b/src/xenia/kernel/xconfig.cc
@@ -9,6 +9,7 @@

 #include "xenia/kernel/xconfig.h"

+#include "xenia/base/cvar.h"
 #include "xenia/base/logging.h"

 #include "xenia/base/filesystem.h"
@@ -19,6 +20,17 @@

 #include <ranges>

+// Speaker configuration reported to the guest (XCONFIG_USER_AUDIO_FLAGS).
+// Default = 0 (Digital Stereo): the Linux/ALSA APU driver's 5.1 (6-channel)
+// path yields silence in some titles (e.g. Project Sylpheed missions), while
+// stereo output works, so stereo is the safe default. Set to 0x00010001 for
+// Dolby Digital + Pro Logic surround.
+DEFINE_uint32(guest_audio_flags, 0,
+              "Speaker config reported to the guest (XCONFIG_USER_AUDIO_FLAGS): "
+              "0 = Digital Stereo (safe on Linux/ALSA), 0x00010001 = Dolby "
+              "Digital + Pro Logic surround.",
+              "APU");
+
 namespace xe {
 namespace kernel {

@@ -94,7 +106,7 @@ void XConfig::SetDefaults() {
  xconfig_data_.user.language = static_cast<uint32_t>(XLanguage::kEnglish);
  xconfig_data_.user.country =
      static_cast<uint8_t>(XOnlineCountry::kUnitedStates);
-  xconfig_data_.user.audio_flags = DolbyDigital | DolbyProLogic;
+  xconfig_data_.user.audio_flags = cvars::guest_audio_flags;
  xconfig_data_.user.av_pack_hdmi_sz = XHDTVResolution.at(1).to_host();
  xconfig_data_.user.av_pack_component_sz = XHDTVResolution.at(1).to_host();
  xconfig_data_.user.av_pack_vga_sz = XVGAResolution.at(3).to_host();
--- a/src/xenia/kernel/xevent.cc
+++ b/src/xenia/kernel/xevent.cc
@@ -11,6 +11,8 @@

 #include "xenia/base/byte_stream.h"
 #include "xenia/base/logging.h"
+#include "xenia/cpu/thread_state.h"
+#include "xenia/kernel/kernel_flags.h"

 namespace xe {
 namespace kernel {
@@ -58,6 +60,13 @@ void XEvent::InitializeNative(void* native_ptr, X_DISPATCH_HEADER* header) {
 }

 int32_t XEvent::Set(uint32_t priority_increment, bool wait) {
+  if (cvars::audit_handle_lifecycle) {
+    auto* ts = cpu::ThreadState::Get();
+    uint32_t lr = ts ? static_cast<uint32_t>(ts->context()->lr) : 0u;
+    XELOGKERNEL(
+        "AUDIT-HLC XEvent::Set handle={:08X} kevent_va={:08X} prio={} lr={:08X}",
+        handle(), guest_object(), priority_increment, lr);
+  }
  set_priority_increment(priority_increment);
  event_->Set();
  return 1;
--- a/src/xenia/kernel/xthread.cc
+++ b/src/xenia/kernel/xthread.cc
@@ -21,6 +21,7 @@
 #include "xenia/base/threading.h"
 #include "xenia/cpu/processor.h"
 #include "xenia/emulator.h"
+#include "xenia/kernel/kernel_flags.h"
 #include "xenia/kernel/kernel_state.h"
 #include "xenia/kernel/user_module.h"
 #include "xenia/kernel/xboxkrnl/xboxkrnl_threading.h"
@@ -544,6 +545,13 @@ X_STATUS XThread::Terminate(int exit_code) {
 void XThread::Execute() {
  XELOGKERNEL("XThread::Execute thid {} (handle={:08X}, '{}', native={:08X})",
              thread_id_, handle(), thread_name_, thread_->system_id());
+  if (cvars::audit_handle_lifecycle) {
+    XELOGKERNEL(
+        "AUDIT-HLC XThread::Execute tid={} start_address={:08X} "
+        "start_context={:08X} xapi={:08X}",
+        thread_id_, creation_params_.start_address,
+        creation_params_.start_context, creation_params_.xapi_thread_startup);
+  }
  // Let the kernel know we are starting.
  kernel_state()->OnThreadExecute(this);

--- a/third_party/CMakeLists.txt
+++ b/third_party/CMakeLists.txt
@@ -332,7 +332,7 @@ else()
    X86_AVX512VNNI
    WITH_GZFILEOP
  )
-  if(NOT MSVC)
+  if(NOT MSVC OR CMAKE_CXX_COMPILER_ID STREQUAL "Clang")
    # GCC/Clang have native __builtin_ctz/__builtin_ctzll (MSVC gets these
    # from fallback_builtins.h). Defining these enables optimized compare256
    # and longest_match codepaths.
--- a/third_party/snappy
+++ b/third_party/snappy
--- a/tools/build/compile_shader_dxbc.py
+++ b/tools/build/compile_shader_dxbc.py
@@ -73,6 +73,16 @@ def main():

    # Start with base command — use wine on non-Windows platforms.
    if sys.platform != "win32":
+        def _wineify(p):
+            try:
+                out = subprocess.check_output(["winepath", "-w", p],
+                                              stderr=subprocess.DEVNULL)
+                return out.decode("utf-8", "replace").strip()
+            except (OSError, subprocess.CalledProcessError):
+                return p
+        input_path = _wineify(input_path)
+        output_path = _wineify(output_path)
+        src_dir = _wineify(src_dir)
        compiler_args = ["wine", fxc]
    else:
        compiler_args = [fxc]