Sync with upstream seedds/nxnative (48 commits, to 2026-10-28)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -39,7 +39,7 @@ body:
     id: chain
     attributes:
       label: Shader chain version
-      description: "`grep DMSH_CHAIN dm/gfx/nvn/dmsh_chain.h`, or the `b-<version>` folder name under `<title ID>_build/shader/`."
+      description: "`grep DMSH_CHAIN dm/gfx/nvn/dmsh_chain.h` in the checkout used to build, or the `b-<version>` folder under the Mac app's `Contents/Resources/msl/` (`<title ID>_build/shader/cache/` for a Mac build, `shader/ios/` for iOS)."
       placeholder: 5cddc47253ab
     validations:
       required: true
@@ -77,6 +77,7 @@ body:
     attributes:
       label: Logs
       description: |
+        Run `python3 scripts/bug_report.py <title ID>` to collect the logs, versions and settings into one file to attach (it contains no game files). Or attach the logs yourself:
         Attach the whole log from the start of the run (drag the file here), not excerpts:
         - Mac app: `~/Library/Logs/nxnative/<title ID>.log` (the run before is `<title ID>.prev.log`)
         - Terminal (`--platform mac`): the host's output, e.g. the command followed by `2>&1 | tee run.log`

.github/workflows/tests.yml

@@ -58,7 +58,7 @@ jobs:
           make GAME="$GAME" -j3 t_perf_order
           ./t_perf_order --cpu 2>&1 | tee ../../../logs/t_perf_order.log
           make GAME="$GAME" -j3 perf-order-tsan 2>&1 | tee ../../../logs/t_perf_order-tsan.log
-          tests="t_dirty_slots t_dirty_race t_tex_layout t_pace t_fstep t_link_ticks t_cpu_tex t_hmap t_cover t_pso_skey t_refl t_rt_range_ro t_present_rescue t_gpuprof"
+          tests="t_capture t_dirty_slots t_dirty_race t_tex_layout t_pace t_fstep t_link_ticks t_cpu_tex t_hmap t_cover t_pso_skey t_refl t_rt_range_ro t_present_rescue t_gpuprof t_sparse_layout t_timestamp t_rt_depth_ro t_rt_range_shape t_ub t_pso_pending t_vk_desc"
           make GAME="$GAME" -j3 $tests 2>&1 | tee ../../../logs/gfx-build.log
           failed=0
           for t in $tests; do

CONTRIBUTING.md

@@ -4,7 +4,9 @@ Issues and pull requests are welcome. This page says how a change gets in; what
 
 ## Reporting a problem
 
-Open an issue with the bug report form. It asks for what a problem is traced with: the nxnative commit, the shader chain version, the game's title ID and version, the device and OS, how the game was built and run, environment overrides, and the whole log of the run. [README.md](README.md#play) says where the iPhone app's log is; a Mac app writes `~/Library/Logs/nxnative/<title ID>.log`.
+Open an issue with the bug report form. It asks for what a problem is traced with: the nxnative commit, the shader chain version, the game's title ID and version, the device and OS, how the game was built and run, environment overrides, and the whole log of the run. [Playing](docs/playing.md) says where the iPhone app's log is; a Mac app writes `~/Library/Logs/nxnative/<title ID>.log`.
+
+`python3 scripts/bug_report.py <title ID | path to the .app | NSP folder>` collects most of this into one zip to attach: `report.md` with the game, commit, chain version, device, settings and the list of files, plus the Mac app's logs, the NSP script's logs under `<title ID>_build/logs` and recent crash reports. Add `--ios-log log.txt` for an iPhone log. It reads only text logs and settings, never game files or keys; it writes your home folder as `~` and drops lines that look like key material. Look at the zip before you attach it.
 
 ## Never game files or keys
 

dm/games/0100152000022000/README.md

@@ -64,6 +64,7 @@ The game builds Mii heads from the console's MiiModel system data, starting at b
 
 - **Audio layout detection after incomplete startup lists (resolved):** [Incomplete startup lists must not select the command layout](../../../docs/reference/audio.md#incomplete-startup-lists-must-not-select-the-command-layout).
 - **Rumble on a DualShock 4-style controller (resolved, Mac):** a GameSir Cyclone takes the [DualShock 4 effects report](../../../docs/reference/services.md#dualshock-4-rumble-through-its-effects-report). The game holds its low band at 0.1–0.4 all race long, which rotating motors play as constant rumble; `DM_RUMBLE_MIN=0.45` leaves crashes and drifts ([low levels on rotating motors](../../../docs/reference/services.md#controller-haptic-engines-without-advanced-players), open).
+- **Fullscreen slowdown to 15 frames a second on an M4's ProMotion screen (#348, closed into #347):** the display link skipped refreshes at frame latency 1; latency 2 in fullscreen is the workaround: [Frame latency 2 for the display link in fullscreen](../../../docs/reference/frame-rate.md#frame-latency-2-for-the-display-link-in-fullscreen). Measured on TotK; not yet checked on this game.
 - **Save-write failure isolation (resolved; host regression):** the separate device and account saves make this game a relevant two-save case. Failure state, recovery and commit synchronization now belong to each backing transaction: [Save-write failures stay with their backing transaction](../../../docs/reference/services.md#save-write-failures-stay-with-their-backing-transaction).
 
 General host changes first needed here; each applies to every game:

dm/games/010020D01AD24000/README.md

@@ -4,6 +4,8 @@ Update 1.0.10 (v655360), SDK 20.5.7, on NVN (46 BNSH shaders). Modules `main` an
 
 On the Mac: the opening rooms at 60 fps with movement, jumping and audio; item pickup and pause menus work. One repeat run recovered from an AudioUnit startup timeout through the existing audio restart path.
 
+**Regression recording checked (2026-10-28):** a full `regress.py check --record` against `337186cf3ce7` passed on an Apple M4 Pro, macOS 27.2 / Xcode 27.1, and wrote the [last green record](validated.tsv). Both 100-second runs reached the opening room at 60 fps, all 46 shaders and their MSL stayed unchanged, screenshots matched within tolerance, and neither run logged a `[RED]` line. Both used `DM_PRESENT_LINK=0` to control the window-occlusion effect described below. One game covers the harness's recording path; this change does not alter the host or shader chain.
+
 ## What it needs
 
 | Setting | Where | Why |

dm/games/010020D01AD24000/validated.tsv

@@ -0,0 +1,3 @@
+# The chain this game was last green on in scripts/regress.py check / baseline --record (one row per mode, the latest of each). Written by the harness, committed with the pull request.
+# mode <TAB> chain=<DMSH_CHAIN> commit=<short SHA>[+dirty] date=<UTC day> machine=<model> macos=<version>. No game data.
+full	chain=a78f966a7b38 commit=337186cf3c+dirty date=2026-10-28 machine=Mac16,7 macos=27.2

dm/games/01002B00111A2000/patches.py

@@ -92,3 +92,6 @@ def frame_step(ctx):
     fs_put(0x166dc60, [B(0x166dc60, start)], 'KIDS frame task: the frame-rate object\'s steps × its fps × vsyncs per update / 60 (state page target fps; 0 = as the game sets them)')
 
 FRAME_STEP = {'c3cf52bf2b05d7310884971b50bcccb8': frame_step}
+
+# Whether a general rule could replace these patches (dm/tools/docs_patches.py lists it in docs/agents/game-patches.md)
+GENERALIZE = "No: the stubs hook the game's own KIDS frame task and frame-rate block; only the host's frame-step state page is shared. Fire Emblem: Three Houses and Taiko Risshiden V DX run on KTGL too, with other frame code"

dm/games/01002B30028F6000/README.md

@@ -23,6 +23,7 @@ No `pad_layout`: the virtual gamepad starts in the 2D layout (the default).
 - **Current:** 26 (20 pixel, 6 vertex) in MonoGame effects (MGFX version 8): the 13 XNB files in `Content/Effects` and SpriteBatch's built-in effect in `main`, read by `shader_split.py` (`mgfx_effect`). No other file and no GLSLC output holds shaders. Every binding decodes, with Mario's binding layout.
 - The XNB files are platform `S`, uncompressed, read by `EffectReader`; each holds one MGFX effect. In `main`, four bytes `MGFX` count only when version 8 and a control section follow.
 - 10 of the 13 effects have no vertex shader: SpriteBatch binds its own and the effect's pass only replaces the pixel shader. Vertex and pixel shaders therefore combine across effects, and they are paired as single-stage programs.
+- **Resolved (PR #275 review):** all 26 shaders produce byte-identical Mac and iOS metallibs with target selection and with the preceding dual-target builder. Sources, reflection (apart from the chain version), `c1_full.tsv` and `cb_extent.tsv` agree too. Repeated builds of either target and returning to iOS after Mac restore all 26 shaders without new Metal compiles; dual-target builds and iOS cache reuse after them preserve the same outputs.
 
 ## Input
 
@@ -37,6 +38,7 @@ No `pad_layout`: the virtual gamepad starts in the 2D layout (the default).
 General host changes first needed here; each applies to every game:
 
 - **MonoGame effects** (MGFX) in XNB files and in `main` (`mgfx_effect` in `shader_split.py`): [MGFX effects in MonoGame XNB files](../../../docs/reference/shaders.md#mgfx-effects-in-monogame-xnb-files).
+- **Resolved:** iOS-only shader cache hits must also restore Mac analysis files: [Target selection keeps the shader analysis files in the cache](../../../docs/reference/shaders.md#target-selection-keeps-the-shader-analysis-files-in-the-cache).
 
 ## Open
 

dm/games/0100317013770000/README.md

@@ -7,6 +7,7 @@ Update 1.6.2225577 (v393216) over the base game, SDK 13.3.5, Ubisoft's Snowdrop
 - The NPDM declares 16 MB of system resource. `nninitStartup` (`main+0x4d1300`) sets a 10 MB heap; the engine takes its memory through address regions and commits pages on demand.
 - **Resolved: startup reservation failure.** [Separate virtual ranges in Snowdrop's page allocator](../../../docs/reference/memory.md#separate-virtual-ranges-in-snowdrops-page-allocator). The constructor (`main+0x1642b8`) originally gives each pool 4 GB, alongside a 1.1875 MB metadata region. `patches.py` reserves 3 GB with 2 GB for large allocations, 512 MB for 512 KB pages and 512 MB for 64 KB pages. Both uses of the combined size change together (`+0x1642fc`, `+0x164308`); `+0x1642c8` initializes the slab-size fields, and `+0x164300` / `+0x16430c` override the large range. SDK build `43211771ed39e7fcef03d88e27091831` also needs its node area cut to 62 MB (`+0x37c140`, `+0x37c1dc`) and large regions aligned to 32 MB (`+0x37c33c`). With the node cut alone, the 3 GB reservation still fails.
 - **Resolved: large allocations crossed the class boundary.** The large allocator's initialization (`main+0x168310`) separately takes a maximum 64 KB page count in `w5`, stored at object `+8`. `patches.py` changes it from 65536 to 32768 (`+0x164338`) to match the 2 GB range. The initial outer-boundary cut alone left this child allocator at its original 4 GB capacity: while loading the first campaign it returned a 12 MB compressed-file buffer exactly at the 512 KB pool's base. `free` routed that pointer to slab handling and interpreted compressed payload as its owner (`main+0x1668dc`). The corrected rewrite loads and reloads the opening campaign. The fixed 1 MB large-allocation metadata reserve (`+0x168308`) still holds more nodes than the reduced capacity needs.
+- **Resolved: UI contexts without address space (GitHub issue #483).** Shaking the overalls bush in “An \"Overall\" Nice Day”, or loading a save from the first planet, wrote to `0x78` at `main+0x2c534a8` (`lr=main+0x2c53484`): the 136-byte entry array of a UI node context (`Moria::Services::UI::Shared::Nodes::Context`, built at `main+0x2c4a228`) had no base. Each context reserves 576 KB and 256 KB of address space and never checks the reservation. Measured with a 64 GB alias region (`DM_ALIAS_SIZE=0x1000000000`, `DM_REGIONS`) in the opening quest: the node area (62 MB), a 1.06 GB pool of 4,194,304 272-byte slots (`main+0x94364`), Snowdrop's 3 GB, a 152.6 MB pool of 16-byte entries (`main+0x14dbd4`) and 147 contexts (119.5 MB) end at +4.515 GB, past the profile's 4.375 GB; 150 contexts after the overalls. On the profile's layout the regions reach +4.375 GB, only 110 of the 147 contexts got their 576 KB range, and the overalls bush crashes as in the issue. The 1.06 GB pool had nothing committed: only the memory system's startup (`main+0x94260`) and its teardown (`main+0x94214`) name it or the default-pool slot it fills. `patches.py` gives it 65,536 slots (17 MB, `+0x94354`), which leaves about 1 GB for the contexts and later regions. The same route then picks up the overalls without a crash.
 - **Current measurements; later capacity open.** In the reloaded opening quest, 64 KB pages held 291.9 MB active / 296.3 MB of bump space, 512 KB pages held 156 MB / 213.5 MB, and large allocations held 1007.4 MB within a 1280 MB managed span (2048 MB capacity). The shortage flag was zero. The slab allocators (`main+0x164aa8`, `+0x1649a8`) set the game's shortage flag (`+0x169f20`) at their derived ends and retain their original 4 GB reserve fallback. Later worlds and sustained battle play still need capacity testing.
 
 ## Files and shaders
@@ -42,4 +43,5 @@ The NSP script produced `MarioRabbidsSparksOfHope.ipa` (9.8 GB) on 2026-10-27, c
 ## Open
 
 - Play into a battle, check later rendering and measure memory over sustained play; the initial exploration test does not establish whole-game compatibility.
+- Docked mode: coins are reported with wrong colours (GitHub issue #483; correct in handheld). Not investigated.
 - iOS testing is performed by the user.

dm/games/0100317013770000/patches.py

@@ -15,6 +15,16 @@
 # by +0x122ff0, which overwrites x1 with the size in x0 and never reads x2.
 # Per-pool high-water validation remains open until gameplay passes; the slab
 # allocators keep the game's shortage reporting and original reserve fallback.
+# The memory system's startup (+0x94260) also builds a pool of 4,194,304 272-byte
+# slots (+0x94364 -> +0x123484), 1.06 GB of address space, which no code in this
+# build allocates from: only that startup and its teardown (+0x94214) name the
+# pool or the default-pool slot it fills (0x7dd1260), and the opening quest,
+# with the overalls found, commits none of it. With it, the regions reach the end of the
+# 4.375 GB alias region in the opening quest; each UI node context
+# (Moria::Services::UI::Shared::Nodes::Context, +0x2c4a228) reserves 576 KB and
+# 256 KB more, unchecked, and the first entry pushed onto a context without its
+# range writes to NULL + 0x78 (+0x2c534a8; shaking the overalls bush, GitHub
+# issue #483). 65,536 slots keep the pool as built, in 17 MB.
 CUTS = {
     '5b76a43b231e0640521ac66203f7c178': [
         (0x1642c8, '2800c0d2', '0800a4d2', 'Snowdrop allocator: initialize the three range-size fields to 512 MB (mov x8,#0x20000000); the large range is overridden to 2 GB below'),
@@ -23,5 +33,9 @@
         (0x164308, '6000c0d2', '0000b8d2', 'Snowdrop allocator: reserve 3 GB instead of 12 GB (mov x0,#0xc0000000)'),
         (0x16430c, 'e2031faa', '615600f9', 'Snowdrop allocator: override the large range-size field to 2 GB (str x1,[x19,#0xa8]); AllocateAddressRegion wrapper never reads x2'),
         (0x164338, '2500a052', '05009052', 'Snowdrop large allocator: maximum 64 KB page count 65536 -> 32768, matching its 2 GB range (mov w5,#0x8000)'),
+        (0x94354, '0108a052', '2100a052', 'Unused 272-byte slot pool: 4,194,304 -> 65,536 slots, 1.06 GB -> 17 MB of address space (mov w1,#0x10000)'),
     ],
 }
+
+# Whether a general rule could replace these patches (dm/tools/docs_patches.py lists it in docs/agents/game-patches.md)
+GENERALIZE = "Partly: Mario + Rabbids Kingdom Battle and Sparks of Hope cut the same Snowdrop three-pool allocator; one function-matched rule could serve both only if their code matches (not checked). The unused 272-byte slot pool is Sparks of Hope's alone (Kingdom Battle's main and subsdk0 have no such init). The cause, an iPhone's address space, cannot be fixed in the host"

dm/games/0100346017304000/patches.py

@@ -31,3 +31,6 @@
     {'name': limiter, 'size': 172, 'fingerprints': ['8fda590c2f6df29ae21230a600452979e26c0972dcb738cec24130239aef1346'],
      'cuts': [(104, '087c149be9e301b2291191f2087dc99b14fd45d3', '087c149b890780520809c99a9f060071f403889a', limiter + ' (as v0 main+0x43e1a8)')]},
 ]}
+
+# Whether a general rule could replace these patches (dm/tools/docs_patches.py lists it in docs/agents/game-patches.md)
+GENERALIZE = "Already function-matched over its two builds (MATCH_CUTS). The limiter is KTGL's frame end; other KTGL games' frame ends are not checked for the same code"

dm/games/010038B015560000/patches.py

@@ -13,3 +13,6 @@
     (0x12558, '36fc1814', 'fdffff17', 'job pool wake: b SignalEvent → b 0x1254c (ldr x0,[x0]; b SignalEvent)'),
   ],
 }
+
+# Whether a general rule could replace these patches (dm/tools/docs_patches.py lists it in docs/agents/game-patches.md)
+GENERALIZE = "No: a lost wake-up in the game's own job pool, not a host or SDK difference"

dm/games/01004AB00A260000/patches.py

@@ -12,3 +12,6 @@
     (0x667904, '08ed46bd', '083548bd', 'frame update step: ldr s8,[x8,#0x6ec] (1/30) → ldr s8,[x8,#0x834] (1/60), passed to main+0x6a337c'),
   ],
 }
+
+# Whether a general rule could replace these patches (dm/tools/docs_patches.py lists it in docs/agents/game-patches.md)
+GENERALIZE = "No: the game's own limiter constant and fixed step"

dm/games/01005270232F2000/patches.py

@@ -14,3 +14,6 @@
     (0x12e40, '90310294', '1f2003d5', 'nninitStartup: bl 0x9f480 (FMallocBinned3 constructor, 37 GB of address space) → nop; the host allocator is in the object already (hle_uemalloc.c)'),
   ],
 }
+
+# Whether a general rule could replace these patches (dm/tools/docs_patches.py lists it in docs/agents/game-patches.md)
+GENERALIZE = 'Yes, as one rule for the six Unreal games here (OCTOPATH TRAVELER 0 and II, FINAL FANTASY RESONANCE, SHIN MEGAMI TENSEI V: Vengeance, DRAGON QUEST VII Reimagined, Pikmin 4): find GCreateMalloc and the FMallocBinned3 constructor by function fingerprint per engine version, and the frame cvars by their registered names at run time, so a new build needs no row in hle_uemalloc.c or hle_fpslock.c'

dm/games/010055D009F78000/patches.py

@@ -33,3 +33,6 @@
     (0x50f8f4, '08514bbd', '1f2003d5', 'render thread wait timeout: ldr s8,[x8,#0xb50] → nop (moved up)'),
   ],
 }
+
+# Whether a general rule could replace these patches (dm/tools/docs_patches.py lists it in docs/agents/game-patches.md)
+GENERALIZE = "Partly: the interval tables, the flag and the render-wait timeout are the game's own. The frame-limiter wait (YieldThread until the tick passes) could become a general rewriter rule beside the spin-wait rewrite: a loop of yields and tick reads slept out to its deadline"