obSCEne documentation

Start here

• README - Documentation

Guide

• BUILDING - Building obSCEne
• features/README - obSCEne Features & Probing Modes
• features/eboot - Full-Screen BIG_APP Mode
• features/payload - Raw Socket Payload Mode
• features/pkg - Retail Package (PKG) Mode
• features/user-guide - obSCEne User Guide

Reference

• ARTIFACTS - Which file goes where
• BOOT - From "the loader has your file" to your first instruction
• CLIENT - Writing a client for the obSCEne protocol
• COMPATIBILITY - What each loader does with obSCEne
• DECK - Hardware day: capturing a real RDNA2 GPU corpus
• DESIGN - Design
• EMULATORS - The emulator toolkit
• GLOSSARY - Glossary
• GNM - The platform's GPU API: libSceGnmDriver, both axes
• GPU_SURFACE - The GPU ISA surface, and obSCEne's coverage of it
• HANDOVER-ORBISTOUN - Handover: what obSCEne measured, and a process it suggests
• HARDWARE-PROBE - On real hardware, obSCEne stops being a test suite
• HARDWARE - What a real PS5 answered
• INJECTOR - obscene-injector - Native PS5 Process Injector
• LOADING - Loading an obSCEne module: what a loader has to handle
• MILESTONES - Firsts
• MODULE-FORMAT - Making a module a real loader will run
• OUTPUT - The report format
• PLATFORM_LIBRARIES - Platform Libraries: The Prospero Retail SPRX Filesystem Layout & Privilege Model
• PROTOCOL - The obSCEne command protocol, version 1
• TOOLING - obscene-tool
• TRACER - The call/response tracer - design
• USER_GUIDE - obSCEne Operator Guide
• WORKFLOW - How the whole thing works
• backlog/001-where-it-stands - Where it stands
• backlog/002-relational-checks-beyond-the-seventeen - 11. Relational checks, beyond the seventeen that exist
• backlog/003-n-way-consensus-as-a-substitute-oracle - 12. N-way consensus as a substitute oracle
• backlog/004-the-vendor-dynamic-table-done - 0. The vendor dynamic table - done
• backlog/005-0b-reading-a-report-out-of-an-emulator - 0b. Reading a report out of an emulator - done
• backlog/006-0c-the-second-and-third-emulators-both - 0c. The second and third emulators - both now run, one still resolves nothing
• backlog/007-the-current-generation-s-graphics - 1. The current generation's graphics interface - censused, and now called
• backlog/008-struct-taking-functions-are-absent-from - 2. Struct-taking functions are absent from every behavioural check
• backlog/009-verifying-the-nid-mapping-done-and-far - 3. Verifying the NID mapping - done, and far better than hoped
• backlog/010-libraries-never-listed-at-all - 4. Libraries never listed at all
• backlog/011-4b-setjmp-longjmp - 4b. setjmp / longjmp
• backlog/012-the-positive-to-negative-ratio-is-still - 5. The positive-to-negative ratio is still wrong
• backlog/013-build-speed-over-the-mount - 6. Build speed over the mount
• backlog/014-6b-pretty-does-not-render-the - 6b. pretty does not render the responsiveness records
• backlog/015-6c-the-thread-churn-crash-is-measured - 6c. The thread-churn crash is measured but not characterised
• backlog/016-6d-condition-variables-and-barriers-the - 6d. Condition variables and barriers - the non-blocking half is checked
• backlog/017-the-census-cannot-detect-a-lying - 7. The census cannot detect a lying platform - now it says so, in the report
• backlog/018-coverage-312-names-are-still-presence - 8. Coverage: 312 names are still presence-only
• backlog/019-not-under-version-control - 9. Not under version control
• backlog/020-the-gap-the-emulators-measured - 10. The gap the emulators measured
• backlog/021-getting-the-report-off-the-machine - 13. Getting the report off the machine
• backlog/022-measurements-orbistoun-is-blocked-on - 14. Measurements orbistoun is blocked on
• backlog/023-error-encoding-and-sync-bounds-probes - 15. Two probes for the heaviest blocked premises: POSIX error encoding, and sync bounds
• backlog/024-the-futex-timeout-and-what-a-run-still-owes - 16. The futex timeout, and what the two threading probes still owe
• backlog/_preamble - Backlog
• decisions/D001-two-builds-from-one-source-tree - D001 - Two builds from one source tree
• decisions/D002-announce-before-attempting - D002 - Announce before attempting
• decisions/D003-one-machine-readable-format-colour - D003 - One machine-readable format; colour lives in a script
• decisions/D004-four-statuses-not-three - D004 - Four statuses, not three
• decisions/D005-freestanding-c-clang-only-no-vendor-sdk - D005 - Freestanding C, clang only, no vendor SDK
• decisions/D006-output-through-the-platform-s-own-write - D006 - Output through the platform's own write, to descriptor 1
• decisions/D007-check-from-the-failure-side-where - D007 - Check from the failure side where layouts are unknown
• decisions/D008-nothing-is-invented-uncertain - D008 - Nothing is invented; uncertain signatures are omitted
• decisions/D009-the-section-order-is-one-explicit-list - D009 - The section order is one explicit list
• decisions/D010-dependencies-are-capability-bits-not - D010 - Dependencies are capability bits, not check names
• decisions/D011-the-synthetic-error-code-is-0xdeadbeef - D011 - The synthetic error code is 0xDEADBEEF, returned unmodified
• decisions/D012-the-build-directory-is-overridable-and - D012 - The build directory is overridable, and has to be
• decisions/D013-the-entry-point-returns-rather-than - D013 - The entry point returns rather than exiting
• decisions/D014-presence-and-behaviour-are-separate - D014 - Presence and behaviour are separate questions, measured separately
• decisions/D015-a-census-of-absences-needs-a-control-in - D015 - A census of absences needs a control in both directions
• decisions/D016-the-census-lists-are-fenced-off-from - D016 - The census lists are fenced off from clang-format
• decisions/D017-the-c-runtime-is-a-first-class-section - D017 - The C runtime is a first-class section, and it is where positive checks live
• decisions/D018-prefer-documentation-over-binary - D018 - Prefer documentation over binary extraction when sourcing names
• decisions/D019-the-diff-is-the-point-the-report-format - D019 - The diff is the point; the report format is downstream of it
• decisions/D020-the-tooling-has-tests-and-they-run - D020 - The tooling has tests, and they run against real reports
• decisions/D021-symbols-carry-which-console-generation - D021 - Symbols carry which console generation they belong to
• decisions/D022-symbol-encoding-is-a-build-option-and - D022 - Symbol encoding is a build option, and the suffix is never committed
• decisions/D023-the-suffix-is-committed-and-labelled - D023 - The suffix is committed and labelled
• decisions/D024-the-nid-chain-is-pinned-by-a-published - D024 - The NID chain is pinned by a published test vector, not by prose
• decisions/D025-unknown-format-constants-are-measured - D025 - Unknown format constants are measured from a loader, not read from a parser
• decisions/D026-the-tooling-is-rust-in-one-binary - D026 - The tooling is Rust, in one binary
• decisions/D027-the-vendor-dynamic-segment-is-built-on - D027 - The vendor dynamic segment is built on every module build, not behind a flag
• decisions/D028-the-tag-derivation-is-a-command-that - D028 - The tag derivation is a command that runs on every build, not a paragraph
• decisions/D029-three-loadable-segments-because-a - D029 - Three loadable segments, because a fourth is refused
• decisions/D030-the-string-table-is-the-first-entry-in - D030 - The string table is the first entry in the dynamic table, and everything that names something comes last
• decisions/D031-the-module-is-built-with-hidden - D031 - The module is built with hidden visibility and symbolic binding
• decisions/D032-the-report-tries-more-than-one-way-out - D032 - The report tries more than one way out, and says which one it used
• decisions/D033-which-library-each-import-comes-from-is - D033 - Which library each import comes from is published by the host build
• decisions/D034-a-finished-module-has-no-section-headers - D034 - A finished module has no section headers
• decisions/D035-the-entry-point-ends-the-process-it - D035 - The entry point ends the process. It does not return
• decisions/D036-dt-sce-jmprel-and-dt-sce-pltrelsz-were - D036 - DT_SCE_JMPREL and DT_SCE_PLTRELSZ were swapped, and the derivation could not have caught it
• decisions/D037-puts-is-an-output-channel-tried-before - D037 - puts is an output channel, tried before write
• decisions/D038-libraries-and-modules-declare-version-1 - D038 - Libraries and modules declare version 1, and they pack it differently
• decisions/D039-imported-symbols-are-rewritten-to-stt - D039 - Imported symbols are rewritten to STT_FUNC, and this is what makes a report come out
• decisions/D040-checks-can-be-excluded-at-build-time - D040 - Checks can be excluded at build time, and the default list is empty
• decisions/D041-the-report-is-drawn-as-well-as-written - D041 - The report is drawn as well as written
• decisions/D042-the-display-owns-the-main-video-output - D042 - The display owns the main video output, and the video checks yield to it
• decisions/D043-the-platform-is-enumerated-not-only - D043 - The platform is enumerated, not only asked about
• decisions/D044-every-check-records-where-its - D044 - Every check records where its expectation came from
• decisions/D045-checks-are-chosen-from-what-emulators - D045 - Checks are chosen from what emulators have actually got wrong
• decisions/D046-an-intermittent-failure-is-only-a - D046 - An intermittent failure is only a finding once it has been counted
• decisions/D047-a-function-is-asked-whether-it-reads - D047 - A function is asked whether it reads its arguments, separately from whether it is right
• decisions/D048-the-screen-pages-through-every-check - D048 - The screen pages through every check, and cycles rather than waiting for input
• decisions/D049-obscene-tool-crack-recovers-names-from - D049 - obscene-tool crack recovers names from NIDs by guessing, and says what a miss is worth
• decisions/D050-the-orchestration-is-scripts-in-the - D050 - The orchestration is scripts in the repository, not steps somebody remembers
• decisions/D051-thirty-census-names-promoted-to - D051 - Thirty census names promoted to behavioural checks, all of them settled by a document
• decisions/D052-div-and-ldiv-were-checked-then - D052 - div and ldiv were checked, then withdrawn to the census
• decisions/D053-the-census-had-been-carrying-a-fragment - D053 - The census had been carrying a fragment of a symbol name, and now it cannot
• decisions/D054-the-emulators-live-in-emulators-source - D054 - The emulators live in <emulators>, source and all, outside this repository
• decisions/D055-the-nid-implementation-now-has-an - D055 - The NID implementation now has an independent 42,010-name confirmation
• decisions/D056-a-value-check-whose-every-expected - D056 - A value check whose every expected answer is zero cannot tell a stub from a success
• decisions/D057-libsceposix-is-checked-and-it-is-the - D057 - libScePosix is checked, and it is the best provenance available without a console
• decisions/D058-a-check-that-calls-a-second-library - D058 - A check that calls a second library must test that symbol's address itself
• decisions/D059-a-third-kind-of-record-measurements - D059 - A third kind of record: measurements, which assert nothing
• decisions/D060-which-clock-counts-what-is-established - D060 - Which clock counts what is established by experiment, not assumed
• decisions/D061-three-loaders-not-one-and-the-second - D061 - Three loaders, not one, and the second and third each found something the first could not
• decisions/D062-the-console-generation-is-a-build - D062 - The console generation is a build option, because the loaders disagree and all of them are right
• decisions/D063-the-nid-implementation-agrees-with-an - D063 - The NID implementation agrees with an independent one on 78,372 pairs out of 78,372
• decisions/D064-a-correction-to-d063-fpps4-s-table-is - D064 - A correction to D063: fpPS4's table is derived from ps4libdoc, not independent of it
• decisions/D065-the-gate-could-not-fail-and-that-is-why - D065 - The gate could not fail, and that is why everything else survived
• decisions/D066-the-rule-from-d058-is-enforced-by-a - D066 - The rule from D058 is enforced by a script now, because writing it down did nothing
• decisions/D067-the-headline-number-is-a-frontier-not-a - D067 - The headline number is a frontier, not a sum
• decisions/D068-018-relational-properties-instead-of - D068 - 018-relational: properties instead of values, aimed where no document reaches
• decisions/D069-volatile-facts-are-generated-static - D069 - Volatile facts are generated; static facts are written. The distinction is the whole fix
• decisions/D070-documentation-that-names-a-command-is - D070 - Documentation that names a command is checked against the commands that exist
• decisions/D071-the-orchestration-scripts-are-sh - D071 - The orchestration scripts are sh. PowerShell was solving one environment variable
• decisions/D072-obscene-tool-consensus-agreement - D072 - obscene-tool consensus: agreement between implementations, used where hardware is not available
• decisions/D073-five-more-relations-and-the-one-with - D073 - Five more relations, and the one with the worst failure mode
• decisions/D074-derived-is-a-fifth-provenance-because - D074 - derived is a fifth provenance, because the FreeBSD upgrade was not the one the backlog described
• decisions/D075-the-current-generation-s-graphics - D075 - The current generation's graphics interface is censused, and its first run is the best evidence yet that presence means little
• decisions/D076-condition-variables-and-barriers-the - D076 - Condition variables and barriers: the operations that cannot block were available all along
• decisions/D077-the-wakeup-path-is-testable-and-the - D077 - The wakeup path is testable, and the timeout was never the thing that was needed
• decisions/D078-the-census-now-states-its-own-limit-in - D078 - The census now states its own limit, in the report, where a coverage figure gets quoted
• decisions/D079-scripts-repeat-sh-an-intermittent-fault - D079 - scripts/repeat.sh: an intermittent fault needs a denominator
• decisions/D080-kyty-cannot-emit-a-report-and-the - D080 - Kyty cannot emit a report, and the reason is structural rather than a missing flag
• decisions/D081-130-layout-the-instrument-half-bytes - D081 - 130-layout: the instrument half. Bytes recorded, nothing interpreted
• decisions/D082-two-more-libkernel-checks-and-one-of - D082 - Two more libkernel checks, and one of them found a real fault
• decisions/D083-why-craziiemu-resolves-nothing-two-bugs - D083 - Why craziiEmu resolves nothing: two bugs, one fixed, and the earlier guess was wrong
• decisions/D084-obscene-may-consult-other-projects - D084 - obSCEne may consult other projects. orbistoun may not. The asymmetry is load-bearing
• decisions/D085-before-believing-a-setting-works-set-it - D085 - Before believing a setting works, set it to something that must visibly break
• decisions/D086-guest-output-may-arrive-on-stderr-and - D086 - Guest output may arrive on stderr, and reading only stdout would have looked like silence
• decisions/D087-000-boot-stack-alignment-offered-by-the - D087 - 000-boot/stack-alignment, offered by the orbistoun side and worth taking
• decisions/D088-140-oracle-asking-the-platform-what-it - D088 - 140-oracle: asking the platform what it knows, and recording what it returns
• decisions/D089-150-memory-map-the-map-walked-with-the - D089 - 150-memory-map: the map walked, with the walk's own hypothesis checked as it goes
• decisions/D090-the-compatibility-table-is-generated - D090 - The compatibility table is generated from reports, because a hand-written one would be stale by tomorrow
• decisions/D091-fpps4-builds-on-a-stable-compiler-and - D091 - fpPS4 builds on a stable compiler, and reads our module perfectly
• decisions/D092-screenshots-of-each-loader-captured-on - D092 - Screenshots of each loader, captured on the summary screen
• decisions/D093-what-the-current-generation-emulators - D093 - What the current-generation emulators implement that obSCEne does not touch
• decisions/D094-emulators-are-built-from-source-running - D094 - Emulators are built from source. Running a binary that does not match the source read is a method error
• decisions/D095-loaders-that-share-a-codebase-count - D095 - Loaders that share a codebase count once. The compatibility table records lineage
• decisions/D096-the-blind-prober-calls-what-it-cannot - D096 - The blind prober calls what it cannot describe, and that is not a breach of D008
• decisions/D097-blame-for-a-loader-failure-is-not - D097 - Blame for a loader failure is not assigned without a control build
• decisions/D098-the-missing-program-headers-come-from - D098 - The missing program headers come from link/module.ld, not from the link mode or the packaging. Two hypotheses were tested and both were wrong
• decisions/D099-two-loadable-segments-not-three-a-third - D099 - Two loadable segments, not three. A third was silently not mapped, and that was the crash
• decisions/D100-dt-sce-needed-module-is-not-enough-a - D100 - DT_SCE_NEEDED_MODULE is not enough. A loader keys its implementations on the ordinary DT_NEEDED filename, and obSCEne emits none
• decisions/D101-obscene-runs-on-a-second-loader-dt - D101 - obSCEne runs on a second loader. DT_NEEDED was the whole of what was missing
• decisions/D102-the-command-protocol-is-specified - D102 - The command protocol is specified before it is implemented, and the captured exchanges are part of the contract
• decisions/D103-the-hash-is-confirmed-against-a-second - D103 - The hash is confirmed against a second, independent corpus - 281 of 281. And obSCEne will not discover a symbol it has never heard of, ever
• decisions/D104-the-report-is-written-to-a-file-as-well - D104 - The report is written to a file as well, not instead. And the backend is chosen by which file is compiled
• decisions/D105-166-960-names-and-1-130-742-unnamed - D105 - 166,960 names and 1,130,742 unnamed identifiers, from eleven sources across 23 firmware versions
• decisions/D106-the-driver-and-the-one-thing-that-lives - D106 - The driver, and the one thing that lives only at this end
• decisions/D107-the-console-socket-backend-is - D107 - The console socket backend is implemented, and proven inside shadPS4 with no hardware
• decisions/D108-a-report-and-a-corpus-are-different - D108 - A report and a corpus are different artifacts, and only the corpus carries origin
• decisions/D109-the-gpu-is-probed-by-executing-shaders - D109 - The GPU is probed by executing shaders and reading the result bits, not by calling an API
• decisions/D110-generation-detection-exists-and-gates - D110 - Generation detection exists and gates nothing. obs_detected_generation() has no callers
• decisions/D111-one-source-both-generations-the-display - D111 - One source, both generations: the display takes whichever video-out pair resolved
• decisions/D112-gpu-device-selection-prefers-real - D112 - GPU device selection prefers real silicon, and the device type is recorded as gradable provenance
• decisions/D113-the-unary-kernel-set-is-widened-to-the - D113 - The unary kernel set is widened to the rest of the transcendentals, and the input vector to the edges they strain
• decisions/D114-the-blind-prober-covered-1-of-the - D114 - The blind prober covered 1% of the census, and pointing it at the rest immediately called a variable
• decisions/D115-a-gpu-protocol-verb-dispatches-a - D115 - A gpu protocol verb dispatches a compiled-in kernel over the socket - the interactive oracle, with no rebuild
• decisions/D116-a-reference-oracle-so-a-gpu-diff-says - D116 - A reference oracle, so a GPU diff says which instructions are approximate rather than merely that two runs differ
• decisions/D117-a-gpu-isa-surface-census-so-probe-every - D117 - A GPU ISA surface census, so "probe every GPU op" has a statement of what every GPU op is
• decisions/D118-closing-the-three-glsl-reachable-gaps - D118 - Closing the three GLSL-reachable gaps the census named, and finding a denormal difference by doing it
• decisions/D119-integer-bit-breadth-a-second-gpu - D119 - Integer/bit breadth: a second GPU surface the float census did not map, and the kernels for its first four operations
• decisions/D120-controlled-isa-pinning-the-fast-sfu - D120 - Controlled-ISA: pinning the fast SFU path against the correctly-rounded one, through the precision the SPIR-V asks for
• decisions/D121-console-generation-is-observed-never - D121 - Console generation is observed, never asserted from presence
• decisions/D122-protocol-completion-the-blob-run-reset - D122 - Protocol completion: the blob/run/reset verbs, with the escape hatch off unless a build asks for it
• decisions/D123-a-golden-gpu-corpus-and-a-regression - D123 - A golden GPU corpus and a regression check, so a change to a kernel's output is caught even where the reference stays silent
• decisions/D124-more-execution-breadth-bitfield-ops-an - D124 - More execution breadth: bitfield ops, an FTZ probe, and a bit-pattern input vector for the kernels that work on bits
• decisions/D125-a-gate-is-not-trusted-until-it-has-been - D125 - A gate is not trusted until it has been shown to reject something
• decisions/D126-the-command-socket-and-why-the-console - D126 - The command socket, and why the console backend is deliberately empty
• decisions/D127-obscene-s-display-targets-the-previous - D127 - obSCEne's display targets the previous generation's video-out interface. That is why it draws nothing on a current-generation loader
• decisions/D128-30-610-names-mined-from-seven-emulators - D128 - 30,610 names mined from seven emulators. The hash reproduces 30,137 of them, and every exception is the source's naming, not the hash
• decisions/D129-call-and-read-are-implemented-proven - D129 - call and read are implemented, proven live over a socket
• decisions/D130-the-census-is-5-909-symbols-growing-it - D130 - The census is 5,909 symbols. Growing it turned "present" from a weak signal into a measurement of the loader
• decisions/D131-gpu-kernels-are-authored-in-bulk-from-a - D131 - GPU kernels are authored in bulk from a generated list, and the GPU capability is gated
• decisions/D132-a-serving-build-listens-first-and-runs - D132 - A serving build listens first and runs the suite on demand. The report streams over the socket. A named Deck target exists
• decisions/D133-a-consumer-s-strict-decoder-found-a - D133 - A consumer's strict decoder found a defective fixture the checker had passed. Both are fixed
• decisions/D134-multi-operand-kernels-sweep-the-operand - D134 - Multi-operand kernels sweep the operand cross-product, in a new record that leaves the unary one untouched
• decisions/D135-the-non-platform-corpus-is-the-console - D135 - The non-platform corpus is the console's own software, and it is a different target rather than a worthless one
• decisions/D136-352-libraries-and-35-518-imports-load - D136 - 352 libraries and 35,518 imports load and run. The ceiling was far higher than assumed
• decisions/D137-the-gpu-corpus-diff-so-a-hardware-run - D137 - The GPU corpus diff, so a hardware run ends in a gap list rather than a pile of records
• decisions/D138-a-symbol-can-be-imported-with-no-name - D138 - A symbol can be imported with no name at all. The identifier is the import; the name only ever existed to compute it
• decisions/D139-a-platform-hud-replaces-the-static - D139 - A platform HUD replaces the static tagline: every system fact, value or unknown
• decisions/D140-a-resolved-address-proves-nothing-on-a - D140 - A resolved address proves nothing on a loader that stubs what it cannot resolve. The display learned this the hard way
• decisions/D141-two-loose-ends-closed-the-generation - D141 - Two loose ends closed: the generation had two inferences, and the generated censuses had no gate
• decisions/D142-seventeen-decisions-were-sharing - D142 - Seventeen decisions were sharing thirteen numbers, and nothing was checking. The log now gates its own numbering
• decisions/D143-the-corpus-records-what-it-was-mined - D143 - The corpus records what it was mined from, so the half of census drift nothing was watching becomes visible
• decisions/D144-a-timeout-is-not-a-hang-and-two - D144 - A timeout is not a hang, and two timeouts are. The sweep now measures the difference instead of asking an operator to assert it
• decisions/D145-an-exclusion-entry-with-no-names-a - D145 - An exclusion entry with no / names a whole section, because a loader can fail a layer rather than a check
• decisions/D146-pack-unpack-conversions-and-the-per - D146 - Pack/unpack conversions, and the per-kernel input scheme they needed
• decisions/D147-the-three-letters-in-the-middle-of-the - D147 - The three letters in the middle of the name are marked wherever the project renders it
• decisions/D148-gpustats-the-diff-as-a-distance-so-the - D148 - gpustats: the diff as a distance, so the approximation is a number, not a yes/no
• decisions/D149-a-censused-library-is-not-a-load-time - D149 - A censused library is not a load-time dependency, and saying it is stops obSCEne loading on current shadPS4 at all
• decisions/D150-the-hardware-day-made-turnkey-one - D150 - The hardware day made turnkey: one analysis command and a runbook, so a Deck corpus needs no new thinking
• decisions/D151-the-blind-prober-does-not-belong-on-the - D151 - The blind prober does not belong on the host build, and the harness did not scale to the corpus. Both were found by running it
• decisions/D152-the-gnm-command-building-api-probe-the - D152 - The Gnm command-building API probe: the console GPU's own calls, the other GPU axis - and a correction to having dismissed it
• decisions/D153-scoping-the-gnm-execution-axis-the-gcn - D153 - Scoping the Gnm execution axis: the GCN shader is not the blocker; the input struct layouts are
• decisions/D154-three-threading-contract-probes-added - D154 - Three threading contract probes, added at the sibling project's request
• decisions/D155-one-source-as-many-binaries-as-the - D155 - One source, as many binaries as the targets need. Single-binary was never the goal and is not a constraint to design around
• decisions/D156-the-compatibility-table-ignored-the - D156 - The compatibility table ignored the census control that was in every report, and presented a void count beside a measured one
• decisions/D157-the-runtime-census-exists-and-its-first - D157 - The runtime census exists, and its first run settled what the address census could not
• decisions/D158-two-relational-checks-had-never-run - D158 - Two relational checks had never run anywhere, and the report said so in words that read as a platform limitation
• decisions/D159-the-two-new-threading-relations-spin - D159 - The two new threading relations spin for their child rather than joining it
• decisions/D160-the-flag-sweep-measurable-without-a - D160 - The flag sweep: measurable without a console, and the dump answered the wrong call
• decisions/D161-bulk-sweep-sh-resumes-because-the-round - D161 - bulk-sweep.sh resumes, because the round budget is the binding constraint and not the size of the surface
• decisions/D162-a-round-that-produced-nothing-is - D162 - A round that produced nothing is retried once
• decisions/D163-correction-the-blind-prober-walks-the - D163 - Correction: the blind prober walks the corpus, not the curated census
• decisions/D164-the-blind-prober-s-classifier-keeps - D164 - The blind prober's classifier keeps privileging 0x8002, and the facility table stays out of the probe
• decisions/D165-the-command-socket-takes-a-session - D165 - The command socket takes a session secret, generated per startup and displayed
• decisions/D166-a-test-asserted-the-opposite-of-what - D166 - A test asserted the opposite of what sceKernelClearEventFlag does, and the stub agreed
• decisions/D167-the-blind-prober-against-a-current - D167 - The blind prober against a current-generation loader: the two emulators are opposites, and twelve functions hand the guest a host address
• decisions/D168-a-comment-inside-a-table-row-s-braces - D168 - A comment inside a table row's braces made a check invisible to every gate, and nothing failed
• decisions/D169-the-provenance-ladder-gains-a-rung - D169 - The provenance ladder gains a rung: implementations
• decisions/D170-anchored-prose-a-document-may-state-one - D170 - Anchored prose: a document may state one checkable fact about the source beside the passage that depends on it
• decisions/D171-fpps4-writes-a-pointer-sized-semaphore - D171 - fpPS4 writes a pointer-sized semaphore handle through an int *, and the check that found it described the wrong thing
• decisions/D172-the-exclusion-list-moved-from-build - D172 - The exclusion list moved from build time to run time, so one ELF runs on every loader
• decisions/D173-the-module-now-carries-a-dt-init - D173 - The module now carries a DT_INIT, because a loader may call one and ours pointed at the ELF header
• decisions/D174-the-screen-said-nothing-about-what-it - D174 - The screen said nothing about what it was doing, and the first fix for that made the probe worse
• decisions/D175-e-type-was-0xfe18-the-shared-library - D175 - e_type was 0xFE18 - the shared-library type - and the constants were named backwards
• decisions/D176-a-loader-can-be-patched-to-let-the - D176 - A loader can be patched to let the probe run, and doing so measures the patch
• decisions/D177-the-mutex-type-constants-are-one-based - D177 - The mutex type constants are one-based and are not the POSIX values
• decisions/D178-the-shell-s-process-id-is-not-the - D178 - The shell's process id is not the loader, and the runner had already learnt that once
• decisions/D179-four-shapes-two-axes-and-the-filename - D179 - Four shapes, two axes, and the filename now says which
• decisions/D180-the-loading-mechanism-is-coverage - D180 - The loading mechanism is coverage surface, so each one is an artifact
• decisions/D181-runtime-resume-can-lose-twenty-thousand - D181 - Runtime resume can lose twenty thousand measurements and still report success
• decisions/D182-the-container-format-is-derived-the-way - D182 - The container format is derived the way NIDs already are: binaries outside, provenance-headed data inside
• decisions/D183-a-shell-exists-on-the-real-target-after - D183 - A shell exists on the real target after all, and the protocol survives it for a better reason
• decisions/D184-hardware-is-registered-and-its - D184 - Hardware is registered, and its capabilities are measured on every use rather than stored
• decisions/D185-mkself-works-and-the-loader-that - D185 - mkself works, and the loader that rejected it first is why
• decisions/D186-the-module-version-is-per-library-and - D186 - The module version is per library, and declaring one value for all of them was why nothing appeared on screen
• decisions/D187-the-display-accepted-it-and-a-frame - D187 - "The display accepted it" and "a frame reached the screen" are different facts, and the report only carried the first
• decisions/D188-retail-titles-render-and-a-cpu-drawn - D188 - Retail titles render and a CPU-drawn framebuffer does not, and the difference is who wrote the pixels
• decisions/D189-the-half-of-hardware-rs-that-talked-to - D189 - The half of hardware.rs that talked to a console now lives in a shared crate, and this project depends on it by path
• decisions/D190-the-tool-fetches-the-report-off-the - D190 - The tool fetches the report off the console itself, rather than telling somebody to go and get it
• decisions/D191-a-check-must-fail-to-return-on-two - D191 - A check must fail to return on two consecutive runs before it is skipped
• decisions/D192-a-project-that-reads-the-others-is-not - D192 - A project that reads the others is not another vote, and prosper says so in its own comments
• decisions/D193-obscene-writes-a-dynamic-table-no - D193 - obSCEne writes a dynamic table no retail current-generation module uses, and six real dumps say so
• decisions/D194-grep-q-reading-a-windows-program - D194 - grep -q reading a Windows program deadlocks the harness, and it hid as a timeout bug for hours
• decisions/D195-prosper-is-the-sixth-loader-the-only - D195 - prosper is the sixth loader, the only headless one, and the first to have ground truth to check us against
• decisions/D196-fpps4-does-not-crash-on-an - D196 - fpPS4 does not crash on an unimplemented import - it sleeps forever, and that is one line
• decisions/D197-a-consensus-across-generations-is-not-a - D197 - A consensus across generations is not a consensus, and mixing them destroyed the signal
• decisions/D198-verify-sh-takes-fifty-minutes-none-of - D198 - verify.sh takes fifty minutes, none of it work, and D012's rule had one more place to apply
• decisions/D199-five-scripts-were-still-driving-a-build - D199 - Five scripts were still driving a build environment that had been deleted that morning
• decisions/D200-the-file-formats-moved-to-selfish-and - D200 - The file formats moved to selfish, and this repository now depends on them
• decisions/D201-the-migration-found-four-things-wrong - D201 - The migration found four things wrong, and three of them were wrong here
• decisions/D202-a-mined-corpus-name-that-a-section - D202 - A mined-corpus name that a section wants to call is declared in the section, not in platform.h
• decisions/D203-105-record-not-170-record-the-section - D203 - 105-record, not 170-record: the section numbers carry the layering and the report contract enforces it
• decisions/D204-the-layout-verdict-counted-non-zero - D204 - The layout verdict counted non-zero bytes while its dump counted changed bytes
• decisions/D205-first-contact-with-a-console-and-the - D205 - First contact with a console, and the answer arrived in ninety seconds: elfldr does not resolve our imports
• decisions/D206-the-console-runs-our-payload-the - D206 - The console runs our payload - the blocker was 16 KB pages, and the loader blocks direct syscalls and passes a bootstrap
• decisions/D207-the-backtrace-echo-readout-is-defeated - D207 - The backtrace-echo readout is defeated by log caching, and the signal ladder is the trustworthy channel
• decisions/D208-the-payload-abi-is-fully-mapped-and-the - D208 - The payload ABI is fully mapped, and the frontier is precise: word 0 is not a working resolver in the sandbox
• decisions/D209-obscene-runs-on-a-real-ps5-and-produces - D209 - obSCEne runs on a real PS5 and produces a report with hardware provenance - the first in the project's history
• decisions/D210-video-is-reachable-from-the-payload-but - D210 - Video is reachable from the payload, but the display is owned by the system
• decisions/D211-a-general-payload-crt0-resolves-obscene - D211 - A general payload crt0 resolves obSCEne's imports on-device - proven on hardware, and the artifact that moves into selfish
• decisions/D212-obscene-is-built-by-selfish-deployed-by - D212 - obSCEne is built by selfish, deployed by prosperous, and runs on the console - the toolchain is real
• decisions/D213-the-payload-path-split-along-selfish-s - D213 - The payload path split along selfish's charter: format knowledge in selfish, runtime in obSCEne - and multi-library resolution works
• decisions/D214-rendering-is-blocked-by-process-context - D214 - Rendering is blocked by process context, not by the toolchain - the injected process has no display to own
• decisions/D215-selfish-is-made-the-explicit-required - D215 - selfish is made the explicit, required build path - in the Makefile, in CI, and through a wired make pkg
• decisions/D216-obscene-s-end-of-the-real-way-is-built - D216 - obSCEne's end of "the real way" is built and waiting on one selfish command - install and launch via prosperous, into a foreground context
• decisions/D217-import-libraries-are-numbered-from-zero - D217 - Import libraries are numbered from zero, needed modules from one
• decisions/D218-min-defines-and-what-the-importless - D218 - MIN_DEFINES, and what the importless control turned out not to prove
• decisions/D219-the-process-parameters-carry-three - D219 - The process parameters carry three structures, and the libc one is not optional
• decisions/D220-the-bundled-modules-are-built-here - D220 - The bundled modules are built here, never copied
• decisions/D221-kind-replacing-fixed-and-the-library-id - D221 - --kind, replacing --fixed, and the library id base that goes with it
• decisions/D222-what-a-bundled-library-must-carry-found - D222 - What a bundled library must carry, found one refusal at a time
• decisions/D223-the-title-id-lives-in-the-content-id - D223 - The title id lives in the content id, and a fresh one routes around a stuck title
• decisions/D224-the-bundled-stubs-must-not-be-named - D224 - The bundled stubs must not be named after a library, and the guard was checking the wrong list
• decisions/D225-the-report-goes-to-the-system-log-first - D225 - The report goes to the system log first, because a title has no descriptor
• decisions/D226-an-eboot-may-not-require-more-libraries - D226 - An eboot may not require more libraries than a title can load
• decisions/D227-the-harness-needs-two-libraries-the - D227 - The harness needs two libraries; the other 350 are measurements
• decisions/D228-the-eboot-does-not-link-the-census-and - D228 - The eboot does not link the census, and the census says so
• decisions/D229-the-census-resolves-at-run-time-so-an - D229 - The census resolves at run time, so an unloadable library is a finding
• decisions/D230-the-generation-probe-asked-by-linking - D230 - The generation probe asked by linking, and could have killed what it was probing
• decisions/D231-eboot-kind-so-the-same-eboot-can-be-put - D231 - EBOOT_KIND, so the same eboot can be put through an emulator first
• decisions/D232-the-run-time-census-needs-a-control - D232 - The run-time census needs a control, because "no" has two meanings
• decisions/D233-the-system-log-is-a-second-destination - D233 - The system log is a second destination, not a candidate channel
• decisions/D235-not-present-on-this-platform-was-a - D235 - "Not present on this platform" was a claim the harness could not support
• decisions/D236-what-a-sweep-proved-crashes-belongs-in - D236 - What a sweep proved crashes belongs in the repository, not in a build directory
• decisions/D237-the-report-s-file-mode-is-set-for-the - D237 - The report's file mode is set for the reader, and the reader is never the writer
• decisions/D238-download0-exists-only-while-the-title - D238 - /download0 exists only while the title does
• decisions/D239-a-run-time-module-load-does-not-repair - D239 - A run-time module load does not repair an import the loader left unresolved
• decisions/D240-import-records-because-the-census - D240 - import records, because the census cannot see this program's own imports
• decisions/D241-an-identity-word-that-decodes-cleanly - D241 - An identity word that decodes cleanly is not a well-formed identity word
• decisions/D242-sce-process-param-was-almost-entirely - D242 - sce_process_param was almost entirely empty, and one field's comment was evidence-free
• decisions/D243-a-fact-held-only-in-a-generated-file-is - D243 - A fact held only in a generated file is held nowhere
• decisions/D244-declaring-a-real-sdk-version-stops - D244 - Declaring a real SDK version stops sceKernelDlsym answering
• decisions/D245-the-section-written-to-explain-d235 - D245 - The section written to explain D235 committed D235
• decisions/D246-a-placeholder-in-a-symbol-field-is-not - D246 - A placeholder in a symbol field is not a symbol
• decisions/D247-an-unbound-import-is-unbound-in-the-plt - D247 - An unbound import is unbound in the PLT too, so the gating is right
• decisions/D248-every-import-was-weak-and-a-loader-took - D248 - Every import was weak, and a loader took that at its word
• decisions/D249-the-display-path-threw-away-every-code - D249 - The display path threw away every code it was given
• decisions/D250-the-display-held-the-output-while - D250 - The display held the output while answering that it did not
• decisions/D251-a-sweep-inside-the-probe-instead-of-a - D251 - A sweep inside the probe, instead of a rebuild per guess
• decisions/D252-two-codes-from-one-call-are-worth-more - D252 - Two codes from one call are worth more than one code from two runs
• decisions/D253-the-framebuffer-alignment-which-was-the - D253 - The framebuffer alignment, which was the answer all along
• decisions/D254-double-buffering-prevents-screen - D254 - Double-buffering prevents screen tearing during report rendering
• decisions/D255-gen-in-compatibility-mode-is-ps4-mode - D255 - GEN in compatibility mode is ps4_mode, not unknown or gen4
• decisions/D256-bounded-flip-wait-ensures-display-flip - D256 - Bounded flip wait ensures display flip takes effect
• decisions/D257-frame-count-advancement-confirms - D257 - Frame count advancement confirms presentation
• decisions/D258-display-hud-integration-preserves - D258 - Display HUD integration preserves headless execution
• decisions/D259-the-d-pad-pages-the-results-the-auto - D259 - The D-pad pages the results; the auto-cycle is the floor, not the mechanism
• decisions/D260-per-file-objects-so-a-build-recompiles - D260 - Per-file objects, so a build recompiles only what changed
• decisions/D261-firmware-is-the-console-s-not-the - D261 - Firmware is the console's, not the compatibility environment's
• decisions/D262-a-build-with-no-status-bar-does-not - D262 - A build with no status bar does not gather what would fill one
• decisions/D263-the-gen-field-names-the-mode-when-it - D263 - The GEN field names the mode when it cannot name the console; the PS4-compat version is its own field
• decisions/D264-export-vaddrs-are-confirmed-by - D264 - Export vaddrs are confirmed by behaviour, not read from firmware
• decisions/D265-obscene-tool-vaddrs-exports-resolved-to - D265 - obscene-tool vaddrs: exports resolved to names, in the tool not a script
• decisions/D266-three-checks-staged-for-the-next - D266 - Three checks staged for the next hardware run: the layout of a memory type, whether a short size bounds a write, and more export candidates
• decisions/D267-the-package-must-stage-sce-module-and-a - D267 - The package must stage sce_module/, and a rewrite dropped it
• decisions/D268-on-console-libkernel-export-table - D268 - On-console libkernel export table enumeration replaces offline sprx dumps
• decisions/D269-one-verb-per-hardware-task-the-report - D269 - One verb per hardware task; the report comes off the system log, in the tool
• decisions/D270-real-hardware-is-a-pointer-from-the - D270 - Real hardware is a pointer from the compatibility table, not a column in it
• decisions/D271-the-report-screen-wraps-into-two - D271 - The report screen wraps into two columns before it overruns the totals
• decisions/D272-a-gpu-field-for-the-driver-disk-wired - D272 - A GPU field for the driver, DISK wired through statfs; TEMP stays honestly unknown
• decisions/D273-the-payload-round-trip-is-a-verb-too - D273 - The payload round-trip is a verb too: ./bin/obscene payload
• decisions/D274-the-tsc-frequency-signature-is-a-band - D274 - The TSC-frequency signature is a band, not an equality; four more export candidates
• decisions/D275-a-measured-run-context-axis-and-the - D275 - a measured run-context axis, and the loaded-module link-map that feeds it
• decisions/D276-payload-mode-is-the-ps4-backward - D276 - payload mode is the ps4 backward-compatibility context
• decisions/D277-enumerate-modules-by-base-vaddr-the-way - D277 - enumerate modules by base+vaddr, the way past a payload's three shut doors
• decisions/D278-obscene-injector-decoupled-freestanding - D278 - obscene-injector: decoupled freestanding ELF injection via session kernel R/W
• decisions/D279-canonical-release-artifact-naming - D279 - canonical release artifact naming scheme across CI workflows and frontend
• decisions/D280-porthole-scaffolded-and-the-encoder - D280 - Porthole scaffolded, and the encoder reachability made a section (106-encoder)
• decisions/D281-projects-live-under-src-and-the-encoder - D281 - Projects live under src/, and the encoder section finished its wiring
• decisions/D282-dlsym-gets-its-positive-a-known-symbol - D282 - dlsym gets its positive: a known symbol through a valid handle
• decisions/D283-flexible-configured-the-probe-orbistoun - D283 - flexible-configured: the probe orbistoun's allocator work was blocked on
• decisions/D284-obs-read-header-is-bounded-by-the - D284 - obs_read_header is bounded by the caller's buffer, not by a constant
• decisions/D285-the-measured-value-is-reported-on-every - D285 - the measured value is reported on every row, not only on a difference
• decisions/D286-container-structure-a-raw-measured - D286 - container-structure: a raw measured dump of a real gen-5 container
• decisions/D287-the-native-title-carries-its-eboot-and - D287 - the native title carries its eboot and is a ./bin/obscene verb
• decisions/D288-the-title-identity-has-one-home - D288 - the title identity has one home: data/identity.toml
• decisions/D289-the-eboot-container-generation-follows - D289 - the eboot container generation follows EBOOT_GEN
• decisions/D290-the-ctype-table-accessors-get-a-library - D290 - the ctype table accessors get a library assignment
• decisions/D291-native-deploy-uploads-the-title-dir - D291 - native deploy uploads the title dir to a scan root via prosperous
• decisions/D292-the-native-title-gets-its-own-id - D292 - the native title gets its own id, distinct from the package
• decisions/D293-ps5-native-titles-use-the-4f153d1d-eboot - D293 - a real ps5 native title uses the 4F 15 3D 1D eboot, so native defaults to it
• decisions/D294-sceshellui-restart-recovers-from-vsh-ui-softlocks - D294 - SceShellUI restart recovers from VSH UI softlocks
• decisions/D295-dynamic-module-resolution-for-non-essential-libraries - D295 - Dynamic module resolution for non-essential libraries
• decisions/D296-four-tier-privilege-model-and-module-categorization - D296 - Four-tier privilege model and module categorization
• decisions/D297-external-sdk-dictionary-and-targeted-sdk-builds - D297 - External SDK Version Dictionary and Targeted SDK Builds in SELFish and obSCEne
• decisions/D298-pt-sce-procparam-and-module-param-contracts - D298 - PT_SCE_PROCPARAM and PT_SCE_MODULE_PARAM Contracts on PS5 Native
• decisions/D299-reproducible-procparam-audit-in-048-selfaudit - D299 - Reproducible Process Parameter Audit in 048-selfaudit
• decisions/D300-porthole-encoder-self-resolution - D300 - Porthole encoder self-resolution: loading VENC sysmodule and export table traversal
• decisions/D301-application-category-privilege-tiers-and-display-arbitration - D301 - Application Category, Privilege Tiers, and Display Arbitration on PS5 Native
• decisions/D302-the-conformance-matrix-and-its-naming - D302 - The conformance matrix - one capture per launch shape, named for the shape
• decisions/D303-a-scalar-out-parameter-is-poisoned-not-zeroed - D303 - a scalar out-parameter is poisoned, not zeroed
• decisions/D314-the-decision-gate-checks-the-log-it-has - D314 - the decision gate checks the log this repository actually has
• decisions/D315-a-document-beside-a-makefile-means-that-makefile - D315 - a document beside a Makefile means that Makefile
• decisions/D316-porthole-input-injection-and-ghostpad-vdi - D316 - Porthole input injection via Ghostpad Virtual Device Interface (VDI)
• decisions/D317-porthole-video-pipeline-reusing-oops-sdk - D317 - Porthole video pipeline reusing oops-sdk display and direct memory
• decisions/D320-the-orbistoun-backlog-is-generated-and-tiered - D320 - the orbistoun backlog is generated and tiered by what blocks it
• decisions/D321-poll-not-wait-and-resolve-by-name-for-the-blocked-premises - D321 - the encoding and bounds probes poll rather than wait, and resolve by name
• decisions/D322-the-futex-is-called-rather-than-censused-and-every-wait-runs-on-a-thread-nobody-joins - D322 - the futex is called rather than censused, and every wait runs on a thread nobody joins
• decisions/D323-the-eboot-resolves-its-output-by-name-and-never-calls-a-raw-import - D323 - the eboot resolves its output by name, and never calls a raw import
• decisions/D324-a-title-entry-is-not-a-payload-args-so-the-dlsym-gadget-is-validated-before-use - D324 - a title entry is not a payload_args, so the dlsym gadget is validated before use
• decisions/D325-a-fault-guard-catches-a-crashing-check-so-the-suite-continues - D325 - a fault guard catches a crashing check, so the suite continues
• decisions/D326-the-guard-carries-its-own-setjmp-and-imports-its-signal-primitives-so-a-native-title-is-guarded - D326 - the guard carries its own setjmp and imports its signal primitives, so a native title is guarded
• decisions/D327-the-payload-zeroes-its-own-bss-because-elfldr-does-not - D327 - the payload zeroes its own .bss, because elfldr does not
• decisions/D328-a-pending-status-and-behavioural-peripheral-probes - D328 - a pending status, and peripheral probes that wait for their input rather than failing
• decisions/D329-a-network-section-for-porthole-and-a-resolution-record - D329 - a network section for Porthole, and a record for "I could not look"
• decisions/D330-audio-format-selector-mouse-in-payload-and-posix-sockets - D330 - Audio format selectors, mouse stubs in unsigned payloads, and POSIX sockets for Porthole
• decisions/D331-the-getsize-family-is-measured-against-its-own-builder - D331 - The *GetSize family is measured against its own builder, not against a borrowed number
• decisions/D332-hardware-agc-requests-and-sandbox-posix-probing - D332 - Hardware AGC Requests, Clean-Room Container Generation, and Sandbox POSIX Probing
• decisions/_preamble - Decision log
• examples/README - Example runs
• examples/protocol/README - Captured exchanges
• milestones/001-the-suite-ran-to-completion-on-a-real - 2026-08-30 - the suite ran to completion on a real console
• milestones/002-the-probe-told-our-defect-apart-from - 2026-08-30 - the probe told our defect apart from the platform's
• milestones/003-obscene-drew-its-own-report-on-the - 2026-08-30 - obSCEne drew its own report on the console's display
• milestones/004-what-made-the-last-two-possible - What made the last two possible
• milestones/005-not-yet - Not yet
• milestones/_preamble - Firsts
• worklog/001-scaffolded-written-and-building - 2026-08-19 - Scaffolded, written, and building
• worklog/002-symbol-census-30-imports-to-277 - 2026-08-19 - Symbol census: 30 imports to 277
• worklog/003-the-c-runtime-and-395-imports - 2026-08-19 - The C runtime, and 395 imports
• worklog/004-depth-27-positive-checks-across-libc - 2026-08-19 - Depth: 27 positive checks across libc and maths
• worklog/005-the-diff-loop-which-is-what-the-format - 2026-08-19 - The diff loop, which is what the format was for
• worklog/006-first-contact-with-a-real-emulator - 2026-08-19 - First contact with a real emulator
• worklog/007-vendor-segment-automated-two-loader - Vendor segment automated; two loader gates down, one named
• worklog/008-the-module-runs - The module runs
• worklog/009-kyty-further-than-before-and-stuck - Kyty: further than before, and stuck somewhere specific
• worklog/010-two-swapped-integers - Two swapped integers
• worklog/011-the-complete-sweep - The complete sweep
• worklog/012-it-draws-its-own-report - It draws its own report
• worklog/013-enumeration-and-knowing-what-an - Enumeration, and knowing what an expectation is worth
• worklog/014-checks-chosen-from-an-emulator-s-own - Checks chosen from an emulator's own release notes
• worklog/015-writing-down-what-was-only-in-someone-s - Writing down what was only in someone's head
• worklog/016-a-cracker-and-the-words-that-kept - A cracker, and the words that kept getting confused
• worklog/017-the-orchestration-got-written-down - The orchestration got written down
• worklog/018-the-settled-half-of-the-c-library - The settled half of the C library, promoted from counting to checking
• worklog/019-the-emulator-toolkit-and-what-the-first - The emulator toolkit, and what the first run through it found
• worklog/020-libsceposix-and-a-check-that-killed-the - libScePosix, and a check that killed the process on the host
• worklog/021-measuring-instead-of-only-judging - Measuring instead of only judging
• worklog/022-three-loaders-instead-of-one - Three loaders instead of one
• worklog/023-acting-on-an-external-review - Acting on an external review
• worklog/024-through-the-ranked-backlog - Through the ranked backlog
• worklog/025-the-command-protocol-and-output-that - The command protocol, and output that survives the run
• worklog/026-the-driver-and-output-that-survives-the - The driver, and output that survives the run - completed
• worklog/027-the-console-socket-proven-in-shadps4-no - The console socket, proven in shadPS4 - no Steam Deck needed
• worklog/028-network-handover-for-orbistoun - Network handover for orbistoun
• worklog/029-gpu-compute-probe-vulkan-backend-one - GPU compute probe - Vulkan backend, one kernel end to end
• worklog/030-call-and-read-implemented - call and read implemented
• worklog/031-gpu-kernels-bulk-authored - GPU kernels, bulk-authored
• worklog/032-serving-robustness-report-streaming - Serving robustness, report streaming, Deck target
• worklog/033-multi-operand-gpu-kernels - Multi-operand GPU kernels
• worklog/034-gpu-set-widened-deck-device-selection - GPU set widened, Deck device selection
• worklog/035-gpu-corpus-diff-gpudiff - GPU corpus diff (gpudiff)
• worklog/036-the-gpu-protocol-verb - The gpu protocol verb
• worklog/037-platform-hud - Platform HUD
• worklog/038-one-source-both-generations-with - One source, both generations, with pictures
• worklog/039-hud-generation-field-both-resolve-is - HUD generation field: both resolve is now unknown, not a claim
• worklog/040-the-hud-readout-is-now-in-the-report - The HUD readout is now in the report, not only on screen (sysinfo records)
• worklog/041-numbering-junk-names-and-what-fpps4-is - Numbering, junk names, and what fpPS4 is actually doing
• worklog/042-sysinfo-generation-both-is-a-value-now - sysinfo|generation: both is a value now, and the report value-sets are declared open
• worklog/043-the-name-and-what-building-shadps4-from - The name, and what building shadPS4 from source actually found
• worklog/044-threading-contract-probes-at-the - Threading contract probes, at the sibling project's request
• worklog/045-consensus-run-and-a-stale-ranking - Consensus run, and a stale ranking
• worklog/046-documentation-audit-first-pass - Documentation audit, first pass
• worklog/047-files-named-for-an-audience-renamed-for - Files named for an audience, renamed for their content
• worklog/048-repo-survey-litter-and-a-log-nobody-can - Repo survey: litter, and a log nobody can read
• worklog/049-one-tooling-language-the-first-checker - One tooling language: the first checker moved to Rust
• worklog/050-the-bridge-and-a-contract-change-that - The bridge, and a contract change that went out unannounced
• worklog/051-three-checkers-in-rust-and-every-one - Three checkers in Rust, and every one was miscounting
• worklog/052-every-checker-is-rust-now - Every checker is Rust now
• worklog/053-ten-of-seventeen-every-gate-verify-sh - Ten of seventeen: every gate verify.sh runs is Rust
• worklog/054-mining-in-rust-and-four-faults-the-diff - Mining in Rust, and four faults the diff exposed
• worklog/055-the-surface-generator-had-stopped - The surface generator had stopped working, and nothing was watching
• worklog/056-no-python-left - No Python left
• worklog/057-documentation-audit-after-the-port - Documentation audit after the port
• worklog/058-consensus-outliers-and-the-runtime - Consensus outliers, and the runtime census
• worklog/059-the-relational-section-grew-and-two-of - 2026-08-24 - the relational section grew, and two of it had never run
• worklog/060-the-blind-prober-was-refused-at-the - 2026-08-24 - the blind prober was refused at the door, twice
• worklog/061-the-most-called-function-in-the-corpus - 2026-08-24 - the most-called function in the corpus, and we were asking it the wrong question
• worklog/062-the-sweep-reached-95-and-threw-it-away - 2026-08-24 - the sweep reached 95% and threw it away over one bad run
• worklog/063-the-prober-reached-the-end-of-the-list - 2026-08-24 - the prober reached the end of the list
• worklog/064-a-session-secret-because-a-console - 2026-08-24 - a session secret, because a console cannot be bound narrowly
• worklog/065-the-two-emulators-are-opposites-and-1 - 2026-08-25 - the two emulators are opposites, and §1 stopped being presence-only
• worklog/066-a-rung-a-gate-for-prose-and-the - 2026-08-25 - a rung, a gate for prose, and the concurrent-build fix
• worklog/067-fpps4-and-the-handle-that-did-not-fit - 2026-08-25 - fpPS4, and the handle that did not fit
• worklog/068-every-loader-retested-and-orbistoun-in - 2026-08-25 - every loader retested, and orbistoun in the table for the first time
• worklog/069-kyty-patched-to-see-how-far-it-would-go - Kyty, patched to see how far it would go
• worklog/070-real-hardware-and-the-tooling-it-turned - Real hardware, and the tooling it turned out to need
• worklog/071-the-transport-left-and-took-a - The transport left, and took a duplicated guard with it
• worklog/072-the-tool-now-collects-its-own-report - The tool now collects its own report
• worklog/073-the-dynamic-table-convention-and-a - 2026-08-26 - the dynamic-table convention, and a deadlock wearing a timeout's clothes
• worklog/074-prosper-as-the-sixth-loader-and-the - 2026-08-26 - prosper as the sixth loader, and the sweep made to fit on a desk
• worklog/075-fpps4-theirs-and-one-line - 2026-08-26 - fpPS4: theirs, and one line
• worklog/076-the-substitute-oracle-and-mistaking-my - 2026-08-26 - the substitute oracle, and mistaking my own comparison for a finding
• worklog/077-recording-the-encoder-the-console - Recording: the encoder the console already drives
• worklog/078-the-supervisor-exists-and-one-of-two - The supervisor exists, and one of two open items closes
• worklog/079-hardening-the-probe-for-hardware-the - 2026-08-27 - hardening the probe for hardware: the extent blind spot was half-closed
• worklog/080-first-payload-execution-on-a-real-ps5 - 2026-08-27 - first payload execution on a real PS5, and the loader contract, by signal
• worklog/081-cont-the-payload-abi-fully-mapped-by - 2026-08-27 (cont.) - the payload ABI, fully mapped by signal, and the real frontier
• worklog/082-obscene-runs-on-real-ps5-hardware-first - 2026-08-27 - obSCEne runs on real PS5 hardware, first report captured
• worklog/083-the-package-was-never-the-wall-the - The package was never the wall - the install context is (fw12, measured on hardware)
• worklog/084-the-package-installs-and-launches-and - The package installs and launches, and the eboot shut the console down
• worklog/085-a-console-answered-the-process - A console answered the process-parameter experiment, and named the field
• worklog/086-obscene-loads-and-executes-on-a-real - obSCEne loads and executes on a real console
• worklog/087-obscene-boots-healthy-on-a-real-console - obSCEne boots healthy on a real console
• worklog/088-forty-five-dead-scripts-and-why-they - Forty-five dead scripts, and why they were not tests
• worklog/089-the-full-probe-takes-the-console-down - The full probe takes the console down
• worklog/090-why-the-full-probe-took-the-console - Why the full probe took the console down, and the guard that was missing
• worklog/091-the-emulators-earned-their-keep-while - The emulators earned their keep while the console was down
• worklog/092-separating-our-defect-from-the-platform - 2026-08-30 - separating our defect from the platform's
• worklog/093-later-the-answer-was-in-a-field-nobody - 2026-08-30 (later) - the answer was in a field nobody chose
• worklog/094-exports-vaddrs-confirmed-by-behaviour - 2026-08-30 - 139-exports: vaddrs confirmed by behaviour, so the firmware file leaves the chain
• worklog/095-obscene-tool-vaddrs-export-vaddrs - 2026-08-31 - obscene-tool vaddrs: export vaddrs resolved to names
• worklog/096-later-three-checks-staged-for-the-next - 2026-08-31 (later) - three checks staged for the next hardware run
• worklog/097-later-still-the-hardware-run-139 - 2026-08-31 (later still) - the hardware run: 139-exports lands, and the payload/eboot split becomes concrete
• worklog/098-on-console-enumeration-139-exports - 2026-08-31 (on-console enumeration) - 139-exports enumerates the full defined export table from memory
• worklog/099-script-canonicalization-one-bin-obscene - 2026-08-31 (script canonicalization) - one bin/obscene verb per hardware task; report folded into the tool
• worklog/100-compatibility-hardware-the-compat-table - 2026-08-31 (compatibility ↔︎ hardware) - the compat table now points to the hardware results
• worklog/101-report-screen-the-summary-wraps-into - 2026-08-31 (report screen) - the summary wraps into two columns past ~30 sections
• worklog/102-hud-fields-gpu-field-added-disk-wired - 2026-08-31 (HUD fields) - GPU field added, DISK wired via statfs, TEMP left honestly unknown
• worklog/103-payload-verb-canonized-the-payload - 2026-08-31 (payload verb) - canonized the payload round-trip as ./bin/obscene payload
• worklog/104-tsc-frequency-band-more-export - 2026-08-31 - TSC-frequency band + more export candidates (D274)
• worklog/105-payload-runs-the-full-payload-executes - 2026-08-31 (payload runs) - the full payload executes on 12.40; the verb captures both channels
• worklog/106-context-axis-link-map-a-third - 2026-08-31 (context axis + link-map) - a third provenance axis, and where module introspection dies in payload mode
• worklog/107-obscene-injector-freestanding-native - 2026-08-31 (obscene-injector) - freestanding native process injector (Plan v2, D278)
• worklog/108-artifact-naming-standardized-release - 2026-08-31 (artifact naming) - standardized release asset names across CI workflows and frontend (D279)
• worklog/109-ps5-mode-runbook-documented-end-to-end - 2026-08-31 (ps5_mode runbook) - documented end-to-end steps to enter native PS5 mode
• worklog/110-porthole-scaffold-the-encoder - 2026-09-01 - Porthole scaffold + the encoder-reachability section (D280)
• worklog/111-repo-cleanup-sweep-phase-1-structure - 2026-09-01 - repo cleanup sweep, phase 1 (structure + litter)
• worklog/112-freestanding-headers-removed-sys-types - 2026-09-01 (freestanding headers) - removed <sys/types.h> from injector headers and defined freestanding types
• worklog/113-injector-prototype-warning-cleanup - 2026-09-01 (injector prototype & warning cleanup) - added injector_start prototype and cleaned unused consts
• worklog/114-cleanup-sweep-finished-projects-under - 2026-09-01 - cleanup sweep finished: projects under src/, encoder wired, docs consistent (D281)
• worklog/115-injector-syscall-trampoline-target - 2026-09-01 (injector syscall trampoline & target resolver) - eliminated PPRBUG-22859 direct-syscall traps (D283)
• worklog/116-memory-allocator-online-walls-added - 2026-09-01 (memory allocator & online walls) - added probes for VirtualQuery, AllocateMainDirectMemory, and NpCppWebApi (D284)
• worklog/117-injector-syscall-trap-target-resolution - 2026-09-01 (injector syscall trap & target resolution fix) - direct syscall elimination & PPSA title prioritization (D285)
• worklog/118-hardware-injector-capture-2-analysis - 2026-09-01 (hardware injector capture #2 analysis & jaildir sandbox resolution) (D286)
• worklog/119-hardware-injector-capture-3-analysis - 2026-09-01 (hardware injector capture #3 analysis: exit via SYS_exit & socket log deduplication) (D287)
• worklog/120-foreground-retail-game-process-title-id - 2026-09-01 (foreground retail game process & Title ID resolution) (D288)
• worklog/121-hardware-injector-capture-5-analysis - 2026-09-01 (hardware injector capture #5 analysis: retail target verified & ucred synchronization for ptrace) (D289)
• worklog/122-hardware-injector-capture-6-analysis - 2026-09-01 (hardware injector capture #6 analysis: errno diagnostics, thread ucred synchronization & root uid elevation) (D290)
• worklog/123-hardware-injector-capture-7-analysis - 2026-09-01 (hardware injector capture #7 analysis: thread ucred confirmed, system daemon false positive diagnosed & direct syscall errno) (D291)
• worklog/124-injector-exhaustive-diagnostic-logging - 2026-09-01 (injector exhaustive diagnostic logging instrumentation) (D292)
• worklog/125-target-detection-diagnosis-eboot-bin - 2026-09-01 (target detection diagnosis: eboot.bin POSIX root uid 0 & empty comm filtering) (D293)
• worklog/126-hardware-injector-capture-8-analysis - 2026-09-01 (hardware injector capture #8 analysis: EPERM resolution, multi-thread ucred sync & P_SUGID clearing) (D294)
• worklog/127-hardware-injector-capture-8-analysis-cr - 2026-09-01 (hardware injector capture #8 analysis: cr_sceCaps offset correction 0x60 & readback verification) (D295)
• worklog/128-hardware-injector-capture-9-analysis - 2026-09-01 (hardware injector capture #9 analysis: EPERM eradicated, P_TRACED 0x800 clearing for EALREADY 37) (D296)
• worklog/129-hardware-injector-capture-10-analysis - 2026-09-01 (hardware injector capture #10 analysis: credential decoupling & p_flag2 P2_NOTRACE/P2_PTRACEREQ clearing) (D297)
• worklog/130-ps5-fw-12-40-ptrace-kernel-patch - 2026-09-01 (PS5 FW 12.40 ptrace kernel patch implementation: 0xD83088 AppContext gate) (D298)
• worklog/131-ps5-parent-reparenting-sceshellcore - 2026-09-01 (PS5 Parent Reparenting & SceShellCore Inspection Diagnostics) (D299)
• worklog/132-ps5-kernel-titleid-proc-field-offsets - 2026-09-01 (PS5 Kernel TitleID & Proc Field Offsets Discovery: 0x470) (D300)
• worklog/133-injector-webkit-self-targeting - 2026-09-01 (Injector WebKit Self-Targeting Elimination & Robust Target Resolution) (D301)
• worklog/134-target-identification-attachment - 2026-09-01 (Target Identification & Attachment Succeeded: PPSA02664 Injected, Hijacking Fix) (D302)
• worklog/135-orphaned-process-diagnostics-p-ppwait - 2026-09-01 (Orphaned Process Diagnostics: P_PPWAIT and Init Reparenting Recovery) (D303)
• worklog/136-daemon-disqualification-requiring-eboot - 2026-09-01 (Daemon Disqualification: Requiring eboot.bin & Filtering .self) (D304)
• worklog/137-pt-detach-timing-signal-5-elimination - 2026-09-01 (PT_DETACH Timing & Signal 5 Elimination: Post-Detach Credential Drop) (D305)
• worklog/138-payload-output-channel-activation - 2026-09-01 (Payload Output Channel Activation: libkernel Base & Symbol Resolution) (D306)
• worklog/139-remote-syscall-gadget-non-spinning-exit - 2026-09-01 (Remote Syscall Gadget & Non-Spinning Exit Path) (D307)
• worklog/140-multi-threaded-lwp-stepping-dynamic - 2026-09-01 (Multi-Threaded LWP Stepping & Dynamic Kernel NID Syscall Resolution) (D308)
• worklog/141-fatal-signal-in-scekerneldebugouttext - 2026-09-01 (Fatal Signal in sceKernelDebugOutText & Safe Write Remediation) (D309)
• worklog/142-stack-frame-return-alignment-direct-sys - 2026-09-01 (Stack Frame Return Alignment & Direct SYS_klog Output) (D310)
• worklog/143-retail-process-output-via-direct-sys - 2026-09-01 (Retail Process Output via Direct SYS_klog Channel) (D311)
• worklog/144-dedicated-stack-allocation-seamless - 2026-09-01 (Dedicated Stack Allocation & Seamless Register Restore Trampoline) (D312)
• worklog/145-skipping-retail-unsafe-scekernelwrite - 2026-09-01 (Skipping Retail-Unsafe sceKernelWrite in Loader Relocations) (D313)
• worklog/146-mutexattr-round-trip-now-reports-per - 2026-09-01 - mutexattr-round-trip now reports per-type read-back
• worklog/147-dlsym-gains-a-positive-check-sysmodule - 2026-09-01 - dlsym gains a positive check; sysmodule positive left out (no citable id)
• worklog/148-flexible-configured-probe-added - 2026-09-01 - flexible-configured probe added (unblocks orbistoun's allocator work)
• worklog/149-native-process-injection-retail - 2026-09-01 (native process injection & retail container probe) - obSCEne runs live inside retail title
• worklog/150-ps5-native-title-gen5-and-native-deploy - 2026-09-02 (ps5 native title) gen-5 eboot, a two-id identity, and native --deploy to a scan root
• worklog/151-sdk-versioning-procparam-and-native-execution - 2026-09-02 (ps5 native execution) targeted SDK dictionary, procparam inspection, and PRX module contract
• worklog/152-porthole-m1-encoder-self-resolution - 2026-09-03 (Porthole M1) Encoder sysmodule load and sceVencCore* entry-point self-resolution
• worklog/153-the-conformance-matrix - 2026-09-03 - The conformance matrix, and why the filename is the metadata
• worklog/154-poisoning-a-scalar-out-parameter - 2026-09-03 - poisoning a scalar out-parameter, and a list of what orbistoun cannot decide
• worklog/155-the-orbistoun-backlog-is-the-whole-list-now - 2026-09-03 - the orbistoun backlog is the whole list now
• worklog/156-porthole-m5-input-injection-and-dual-socket-server - 2026-09-03 - Porthole M4/M5: Controller input injection (Ghostpad VDI) and dual-socket network server
• worklog/157-porthole-video-pipeline-reusing-oops-sdk - 2026-09-03 - Porthole Video Pipeline: Integrating and Reusing oops-sdk
• worklog/158-error-encoding-and-sync-bounds-probes - 2026-09-07 - Two probes for the heaviest premises orbistoun is blocked on
• worklog/159-the-futex-and-the-stack-attributes-are-called - 2026-09-07 - The futex and the stack attributes stop being census entries
• worklog/160-the-title-runs-and-a-fault-guard-keeps-it-running - 2026-09-08 - The title stops crashing at boot, and a fault guard keeps it running
• worklog/161-the-eboot-leg-completes-and-the-sweep-stops-hanging - 2026-09-08 - The eboot leg completes, and the sweep stops hanging
• worklog/162-the-payload-leg-completes-and-all-three-shapes-run - 2026-09-08 - The payload leg completes, and all three shapes run end to end
• worklog/163-pending-probes-for-what-the-sdk-needs-from-hardware - 2026-09-08 - Pending probes for what oops-sdk needs from hardware
• worklog/164-a-network-section-and-the-resolution-record - 2026-09-08 - A network section for Porthole, and a record for "I could not look"
• worklog/165-audio-channels-settled-mouse-payload-stub-and-posix-net - 2026-09-08 - Audio channels settled, mouse payload stub, and POSIX net
• worklog/166-libSceAgc-command-buffer-structure-and-crash-elimination - 2026-09-10 - libSceAgc command buffer structure and crash elimination
• worklog/167-agc-pipeline-probes-and-section-160-pruning - 2026-09-14 - AGC pipeline probes, section 160 pruning, and BigApp budget resolution
• worklog/168-fulfilling-20260914-cross-project-requests - 2026-09-14 - Fulfilling cross-project requests: AGC invariants, synthetic container, and POSIX resolution
• worklog/_preamble - Work log

Project memory

• BACKLOG - Backlog
• DECISIONS - Decision log
• WORKLOG - Work log