fix(tools): self-locate DB / cwd instead of the stale renamed path

zq.py and sylph-run.sh hard-coded '/home/fabi/RE - Project Sylpheed/...'
(the dashed dir was renamed 'RE Project Sylpheed'), so both were broken.
Resolve relative to the script directory now; zq.py honours $SYLPHEED_DB.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Cargo.lock

@@ -1056,6 +1056,33 @@ dependencies = [
  "strum",
 ]
 
+[[package]]
+name = "dynasm"
+version = "3.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f7d4c414c94bc830797115b8e5f434d58e7e80cb42ba88508c14bc6ea270625"
+dependencies = [
+ "bitflags 2.11.0",
+ "byteorder",
+ "lazy_static",
+ "proc-macro-error2",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "dynasmrt"
+version = "3.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "602f7458a3859195fb840e6e0cce5f4330dd9dfbfece0edaf31fe427af346f55"
+dependencies = [
+ "byteorder",
+ "dynasm",
+ "fnv",
+ "memmap2",
+]
+
 [[package]]
 name = "endian-type"
 version = "0.1.2"
@@ -2888,6 +2915,28 @@ dependencies = [
  "toml_edit",
 ]
 
+[[package]]
+name = "proc-macro-error-attr2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "proc-macro-error2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
+dependencies = [
+ "proc-macro-error-attr2",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -5047,6 +5096,7 @@ dependencies = [
  "xenia-debugger",
  "xenia-gpu",
  "xenia-hid",
+ "xenia-jit",
  "xenia-kernel",
  "xenia-memory",
  "xenia-types",
@@ -5117,6 +5167,17 @@ dependencies = [
  "xenia-types",
 ]
 
+[[package]]
+name = "xenia-jit"
+version = "0.1.0"
+dependencies = [
+ "dynasm",
+ "dynasmrt",
+ "tracing",
+ "xenia-cpu",
+ "xenia-memory",
+]
+
 [[package]]
 name = "xenia-kernel"
 version = "0.1.0"

Cargo.toml

@@ -4,6 +4,7 @@ members = [
     "crates/xenia-types",
     "crates/xenia-memory",
     "crates/xenia-cpu",
+    "crates/xenia-jit",
     "crates/xenia-xex",
     "crates/xenia-vfs",
     "crates/xenia-kernel",
@@ -26,6 +27,7 @@ license = "BSD-3-Clause"
 xenia-types = { path = "crates/xenia-types" }
 xenia-memory = { path = "crates/xenia-memory" }
 xenia-cpu = { path = "crates/xenia-cpu" }
+xenia-jit = { path = "crates/xenia-jit" }
 xenia-xex = { path = "crates/xenia-xex" }
 xenia-vfs = { path = "crates/xenia-vfs" }
 xenia-kernel = { path = "crates/xenia-kernel" }
@@ -37,6 +39,9 @@ xenia-analysis = { path = "crates/xenia-analysis" }
 xenia-ui = { path = "crates/xenia-ui" }
 
 # External dependencies
+# JIT (PPC->x64 block recompiler; runtime-gated by XENIA_JIT)
+dynasm = "3"
+dynasmrt = "3"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json", "registry"] }
 tracing-appender = "0.2"

crates/xenia-app/Cargo.toml

@@ -12,6 +12,7 @@ path = "src/main.rs"
 xenia-types = { workspace = true }
 xenia-memory = { workspace = true }
 xenia-cpu = { workspace = true }
+xenia-jit = { workspace = true }
 xenia-xex = { workspace = true }
 xenia-vfs = { workspace = true }
 xenia-kernel = { workspace = true }

crates/xenia-app/tests/golden/sylpheed_n200m.json

@@ -1,9 +1,9 @@
 {
-  "instructions": 200000239,
-  "imports": 575447,
+  "instructions": 200000203,
+  "imports": 575647,
   "unimpl": 0,
-  "draws": 3165,
-  "swaps": 895,
+  "draws": 3208,
+  "swaps": 910,
   "unique_render_targets": 2,
   "shader_blobs_live": 6,
   "texture_cache_entries": 1

crates/xenia-cpu/src/block_cache.rs

@@ -63,7 +63,7 @@ const GUEST_PAGE_MASK: u32 = !(GUEST_PAGE_SIZE - 1);
 /// One cached basic block. Owned by [`BlockCache`]; a `&DecodedBlock`
 /// is handed to the interpreter via [`BlockCache::lookup_or_build`] and
 /// stays valid until the next `lookup_or_build` on the same slot.
-#[derive(Debug)]
+#[derive(Debug, Clone)]
 pub struct DecodedBlock {
     /// Guest PC at which this block starts. Used as the slot tag.
     pub start_pc: u32,
@@ -185,6 +185,18 @@ impl BlockCache {
     }
 }
 
+/// Decode a standalone `DecodedBlock` at `start_pc` against `mem`, computing
+/// its `page_version` from memory (the same `(start_pc, page_version)` key the
+/// `BlockCache` uses). Unlike [`BlockCache::lookup_or_build`] this does not
+/// touch any cache — it is used by the JIT region compiler to decode the
+/// straight-line/same-page successor blocks it stitches into one compiled
+/// region. `build_block` stops at the 4 KiB page boundary, so the returned
+/// block is fully contained in the page whose version this records.
+pub fn decode_block(start_pc: u32, mem: &dyn MemoryAccess) -> DecodedBlock {
+    let page_version = mem.page_version(start_pc);
+    build_block(start_pc, mem, page_version)
+}
+
 /// Walk forward from `pc`, decoding instructions and collecting them
 /// into a `DecodedBlock`. The walk stops on the first of:
 ///   - a [`PpcOpcode::terminates_block`] true (the terminator IS

crates/xenia-cpu/src/interpreter.rs

@@ -213,6 +213,22 @@ pub fn step_block(
     result
 }
 
+/// Execute exactly one already-decoded instruction — the JIT's interpreter
+/// fallback (`xenia-jit`). Identical to the body of [`step`]/`step_block`
+/// EXCEPT it does **not** bump `cycle_count`/`timebase`: the JIT owns the
+/// per-instruction counter increments so that a mix of native and
+/// fallback opcodes retires exactly one tick each, in order, byte-identical
+/// to the interpreter. `execute` itself advances `ctx.pc` (each arm does
+/// `ctx.pc += 4` or sets a branch target), same as the interpreter path.
+#[inline]
+pub fn interpret_one(
+    ctx: &mut PpcContext,
+    mem: &dyn MemoryAccess,
+    instr: &DecodedInstr,
+) -> StepResult {
+    execute(ctx, mem, instr)
+}
+
 /// Execute a decoded instruction, updating context and memory.
 fn execute(ctx: &mut PpcContext, mem: &dyn MemoryAccess, instr: &DecodedInstr) -> StepResult {
     match instr.opcode {

crates/xenia-cpu/src/scheduler.rs

@@ -586,6 +586,23 @@ impl Scheduler {
         }
     }
 
+    /// True if HW slot `hw_id` currently has at least one Ready/ServicingIrq
+    /// thread (from the cached `non_empty_runnable` bitmap — O(1), no scan).
+    /// Used by the free-running parallel executor so an idle-slot worker can
+    /// park instead of spinning through a full `worker_prologue`.
+    #[inline]
+    pub fn slot_runnable(&self, hw_id: u8) -> bool {
+        (self.non_empty_runnable & (1 << hw_id)) != 0
+    }
+
+    /// True if ANY HW slot has a runnable thread (O(1)). Lets the free-running
+    /// coordinator distinguish "all slots idle → advance time / check deadlock"
+    /// from "work in flight".
+    #[inline]
+    pub fn any_runnable(&self) -> bool {
+        self.non_empty_runnable != 0
+    }
+
     // ----- Compat accessors (preserve the pre-Axis-1 hw_threads[i].ctx pattern) -----
 
     /// Read-only context of the currently-running thread on `hw_id`.

crates/xenia-jit/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "xenia-jit"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+xenia-cpu = { workspace = true }
+xenia-memory = { workspace = true }
+dynasm = { workspace = true }
+dynasmrt = { workspace = true }
+tracing = { workspace = true }

crates/xenia-kernel/src/state.rs

@@ -648,6 +648,15 @@ impl KernelState {
         }
     }
 
+    /// The registered import-thunk address band `(lo, hi)`, set once at load
+    /// and never mutated during execution. Exposed so the parallel-mode
+    /// unlocked superblock driver can cache it and run its chain-break check
+    /// without touching `KernelState` (which is behind the kernel mutex).
+    #[inline]
+    pub fn thunk_addr_band(&self) -> Option<(u32, u32)> {
+        self.thunk_addr_band
+    }
+
     /// Resolve a `(module, ordinal)` to its registered thunk address.
     pub fn resolve_thunk(&self, module: ModuleId, ordinal: u16) -> Option<u32> {
         self.thunks_by_ordinal.get(&(module, ordinal)).copied()

crates/xenia-kernel/src/xam.rs

@@ -125,6 +125,29 @@ fn gamepad_key(state: &xenia_hid::GamepadState) -> u128 {
     u128::from_be_bytes(bytes)
 }
 
+/// Whether user 0 has a default always-connected, idle (no-buttons) virtual
+/// controller. **Default ON** — matches canary, whose default input drivers
+/// (xinput / winkey) present a connected pad, so a title screen advances to its
+/// "Press A" input-poll state instead of stalling forever on
+/// DEVICE_NOT_CONNECTED (a console always exposes controller slots; a real
+/// gamepad under `--ui` supplies actual button state, otherwise the pad is idle).
+/// Set `XENIA_NO_PAD=1` to present NO controller (reproduces the raw headless
+/// no-HID trajectory).
+fn virtual_pad_enabled() -> bool {
+    use std::sync::OnceLock;
+    static V: OnceLock<bool> = OnceLock::new();
+    *V.get_or_init(|| {
+        !std::env::var("XENIA_NO_PAD")
+            .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+            .unwrap_or(false)
+    })
+}
+
+/// True iff user 0 has a controller: a real host gamepad, or the default pad.
+fn user_connected(state: &KernelState, user: u32) -> bool {
+    state.ui.as_ref().is_some_and(|ui| ui.is_connected(user)) || (user == 0 && virtual_pad_enabled())
+}
+
 fn xam_input_get_capabilities(
     ctx: &mut PpcContext,
     mem: &GuestMemory,
@@ -133,8 +156,7 @@ fn xam_input_get_capabilities(
     // r3 = user_index, r4 = flags, r5 = out X_INPUT_CAPABILITIES*
     let user = ctx.gpr[3] as u32;
     let out_ptr = ctx.gpr[5] as u32;
-    let connected = state.ui.as_ref().is_some_and(|ui| ui.is_connected(user));
-    if !connected {
+    if !user_connected(state, user) {
         ctx.gpr[3] = xenia_hid::errors::DEVICE_NOT_CONNECTED as u64;
         return;
     }
@@ -146,15 +168,16 @@ fn xam_input_get_state(ctx: &mut PpcContext, mem: &GuestMemory, state: &mut Kern
     // r3 = user_index, r4 = flags, r5 = out X_INPUT_STATE*
     let user = ctx.gpr[3] as u32;
     let out_ptr = ctx.gpr[5] as u32;
-    let Some(ui) = state.ui.as_ref() else {
-        ctx.gpr[3] = xenia_hid::errors::DEVICE_NOT_CONNECTED as u64;
-        return;
-    };
-    if !ui.is_connected(user) {
+    if !user_connected(state, user) {
         ctx.gpr[3] = xenia_hid::errors::DEVICE_NOT_CONNECTED as u64;
         return;
     }
-    let gamepad = ui.snapshot_gamepad();
+    // Real host gamepad if present, else the idle virtual pad (XENIA_VIRTUAL_PAD).
+    let gamepad = state
+        .ui
+        .as_ref()
+        .map(|ui| ui.snapshot_gamepad())
+        .unwrap_or_default();
     let key = gamepad_key(&gamepad);
     if key != state.last_input_bytes {
         state.input_packet_number = state.input_packet_number.wrapping_add(1);

crates/xenia-memory/src/heap.rs

@@ -155,6 +155,15 @@ impl GuestMemory {
             .load(std::sync::atomic::Ordering::Relaxed)
     }
 
+    /// Raw address of the MMIO access counter, as `*const u64`. The JIT's native
+    /// block-chaining epilogue reads it with a plain aligned load to detect a
+    /// mid-block MMIO touch inline (equivalent to a `Relaxed` load on x86-64 —
+    /// `AtomicU64` has the same layout as `u64`). Single-thread use only.
+    #[inline]
+    pub fn mmio_access_count_ptr(&self) -> *const u64 {
+        self.mmio_access_count.as_ptr() as *const u64
+    }
+
     #[inline]
     fn bump_mmio_access(&self) {
         self.mmio_access_count

native-gate.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# native-gate.sh — functional correctness gate for the iterate-4E canary-model
+# native-threads rework (host-thread-per-guest-thread, non-deterministic).
+#
+# Byte-identical goldens cannot gate a multi-threaded run (OS interleaving is
+# nondeterministic), so this script is the REPLACEMENT oracle. It runs three
+# checks and exits 0 iff all pass:
+#
+#   1. LOCKSTEP GOLDEN (flag-off): the deterministic default path stays
+#      byte-identical on sylpheed_n200m.json. This is the safety net that
+#      proves the native-mode work did not disturb the reference path.
+#   2. NATIVE RENDER MILESTONE: native mode (XENIA_NATIVE_THREADS=1) boots far
+#      enough to render — draws>0 && swaps>0 in the run digest — proving the
+#      executor runs guest CPU + drives the GPU end-to-end without hanging.
+#   3. NATIVE DEADLOCK STRESS: parallel_stress_short under XENIA_NATIVE_THREADS=1
+#      with --halt-on-deadlock; N back-to-back short runs with no panic/hang,
+#      surfacing lost-wakeups / lock-order inversions the single run misses.
+#
+# Usage:  [SYLPHEED_ISO=...] native-gate.sh [milestone_n] [milestone_timeout_s]
+#   milestone_n         default 200000000 (renders; matches the golden anchor)
+#   milestone_timeout_s default 120
+#
+# The binary must be built first (the caller owns the build so the OOM guardrail
+# CARGO_BUILD_JOBS=4 / free-check stays explicit):
+#   CARGO_BUILD_JOBS=4 cargo build --release
+set -u
+cd "$(dirname "$0")" || exit 2
+BIN=./target/release/xenia-rs
+ISO_CHECK=sylpheed.iso
+MN="${1:-200000000}"
+MTO="${2:-120}"
+DIGEST=/tmp/native-gate-digest.json
+LOG=/tmp/native-gate
+mkdir -p "$LOG"
+fails=0
+hr(){ printf '=%.0s' {1..64}; echo; }
+
+[ -x "$BIN" ] || { echo "FAIL: build first: CARGO_BUILD_JOBS=4 cargo build --release"; exit 3; }
+
+# ---------------------------------------------------------------- 1) golden
+hr; echo "[1/3] LOCKSTEP GOLDEN — flag-off byte-identity (sylpheed_n200m)"; hr
+cargo test --release -p xenia-app --test sylpheed_oracles -- \
+  --ignored --nocapture sylpheed_n200m >"$LOG/golden.log" 2>&1
+rc=$?
+if [ $rc -eq 0 ]; then echo "  PASS  (golden byte-identical)"; else
+  echo "  FAIL  rc=$rc — see $LOG/golden.log"; tail -20 "$LOG/golden.log"; fails=$((fails+1)); fi
+
+# ------------------------------------------------------- 2) native milestone
+hr; echo "[2/3] NATIVE RENDER MILESTONE — XENIA_NATIVE_THREADS=1, -n $MN"; hr
+rm -f "$DIGEST"
+XENIA_NATIVE_THREADS=1 timeout "$MTO" "$BIN" check "$ISO_CHECK" \
+  -n "$MN" --gpu-inline --out "$DIGEST" >"$LOG/milestone.log" 2>&1
+rc=$?
+pkill -x xenia-rs 2>/dev/null
+if [ $rc -ne 0 ]; then
+  echo "  FAIL  emulator rc=$rc (timeout=$MTO s) — see $LOG/milestone.log"
+  tail -20 "$LOG/milestone.log"; fails=$((fails+1))
+elif [ ! -f "$DIGEST" ]; then
+  echo "  FAIL  no digest written — see $LOG/milestone.log"; fails=$((fails+1))
+else
+  read -r draws swaps instrs < <(python3 - "$DIGEST" <<'PY'
+import json,sys
+d=json.load(open(sys.argv[1]))
+print(d.get("draws",0), d.get("swaps",0), d.get("instructions",0))
+PY
+)
+  echo "  digest: instructions=$instrs draws=$draws swaps=$swaps"
+  if [ "${draws:-0}" -gt 0 ] && [ "${swaps:-0}" -gt 0 ]; then
+    echo "  PASS  (native mode renders)"
+  else
+    echo "  FAIL  (native mode did not render: draws=$draws swaps=$swaps)"; fails=$((fails+1)); fi
+fi
+
+# ---------------------------------------------------------- 3) native stress
+hr; echo "[3/3] NATIVE DEADLOCK STRESS — parallel_stress_short (native)"; hr
+XENIA_NATIVE_THREADS=1 cargo test --release -p xenia-app --test parallel_stress -- \
+  --nocapture parallel_stress_short >"$LOG/stress.log" 2>&1
+rc=$?
+if [ $rc -eq 0 ]; then
+  grep -o "runs=[0-9]* ok=[0-9]* failed=[0-9]*" "$LOG/stress.log" | tail -1
+  echo "  PASS  (no deadlock/panic)"
+else
+  echo "  FAIL  rc=$rc — see $LOG/stress.log"; tail -20 "$LOG/stress.log"; fails=$((fails+1)); fi
+
+hr
+if [ "$fails" -eq 0 ]; then echo "NATIVE GATE: PASS (3/3)"; exit 0
+else echo "NATIVE GATE: FAIL ($fails/3 checks failed)"; exit 1; fi

sylph-run.sh

@@ -19,7 +19,9 @@
 # resumes (tid25 start_entry 0x82506588 / tid26 0x825065b8). Full per-run log kept under
 # /tmp/sylph-run/.
 set -u
-cd "/home/fabi/RE - Project Sylpheed/xenia-rs" || exit 2
+# cd to this script's own dir (was a hard-coded '/home/fabi/RE - Project Sylpheed/
+# xenia-rs' that went stale when the tree was renamed 'RE Project Sylpheed').
+cd "$(dirname "$(readlink -f "$0")")" || exit 2
 RUNS="${1:-6}"; N="${2:-3000000000}"; TO="${3:-180}"; XGREP="${4:-}"
 OUT=/tmp/sylph-run; mkdir -p "$OUT"
 BIN=./target/release/xenia-rs

zq.py

@@ -14,9 +14,13 @@ Usage:
   zq.py grep <substr>              # instructions whose operands LIKE %substr%
   zq.py find <word_hex>            # instructions whose raw word == value (e.g. a ptr)
 """
-import duckdb, sys
+import duckdb, sys, os
 
-DB = '/home/fabi/RE - Project Sylpheed/xenia-rs/sylpheed.db'
+# Resolve the DB next to this script so the tool survives the tree being renamed
+# (the old hard-coded '/home/fabi/RE - Project Sylpheed/...' path went stale when
+# the dir became 'RE Project Sylpheed'). Override with $SYLPHEED_DB.
+DB = os.environ.get('SYLPHEED_DB',
+                    os.path.join(os.path.dirname(os.path.abspath(__file__)), 'sylpheed.db'))
 c = duckdb.connect(DB, read_only=True)
 H = lambda x: '0x%08x' % x