Helper: files.prefs_get/prefs_set (148/149) reach files_prefs.c, the same
file the console page's /api/files/prefs uses; files.handoff_put/take
(150/151) keep one Show on TV / Show on PC slot per direction in helper
memory, gone after two minutes, emptied by a take (files_handoff.c, host
self-test). The page gets /api/files/handoff/take {for:"console"} and
/api/files/handoff/put {to:"pc"}; /api/jobs adds "uploading", the roots
of up to 8 running uploads, for the Files badge.
Engine: GET /api/ps5/files/prefs, POST .../prefs/set, .../handoff/put,
.../handoff/take. An older helper answers unknown method, reported as
{"supported":false} so the PC app hides the features.
console files: shared favourites and Show on TV / Show on PC
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RxCGb8Asp1A1AQYiv1kbgS
APP_DB_QUERY answered at most 256 rows, and fewer when its 64 KiB reply
filled, with nothing saying the list was cut. A title installed by a
homebrew installer (no /user/appmeta folder) that sorted past that point
disappeared from the installed list.
Payload: app.db.query takes an optional {"offset","limit"} window and
answers offset/next/more/truncated; a full buffer now ends the page with
more=true instead of closing the list. An empty request is page one, so
older engines keep working.
Engine: appdb_query follows the pages (at most 32) and marks the list
truncated when it could not finish (or an older helper returned a full
256). The installed list reads app.db once per request, adds registered
titles whose app folder exists, reports incomplete, and a truncated list
never proves a title absent for install verification.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RxCGb8Asp1A1AQYiv1kbgS
Pausing a routed send now ends both consoles' halves, so its journal is free
to resume from any device with any helper. The driving engine keeps a shared
record of each send on the receiving console (/data/ps5upload/c2c/<tx>.json)
with a 45 s lease refreshed every 15 s; another device lists those sends
(GET /api/transfer/ps5-to-ps5/remote), takes one over or watches a direct one
(POST /api/transfer/ps5-to-ps5 with adopt: take | watch, same tx_id), and the
engine that had it stops driving without ending anything ("taken over by").
Helper: a new caps bit, CAP_SHARED_JOBS (4). job.status / job.cancel answer
any paired device for uploads and downloads (operations and local copies stay
owner-only), and a JobOpen moves a parked upload of another device to the
opener; an attached one is still refused. SPEC §18.5-18.6.
Test connection in Send to another console runs the console's net.reach probe
from the sending console to the dial target (plus the relay legs, and an
optional real 4 KiB direct send). Tasks shows "Sends from other devices" with
Watch / Take over / Resume here.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K3cPwhp3UrzayBfyy9PDcN
Files gets "Decompress to .exfat…" on a .ffpfsc again. The first build (pulled
before 7.0.23) inflated the blocks in the helper with vendored zlib, and the helper
died with SIGBUS within minutes of loading it; once the console froze. This one has
no decoder: the helper mounts the container read-only the way ShadowMount+ mounts a
.ffpfsc (LVD image type 9, read-only single-save flags, 4096-byte sectors, pfs with
mkeymode=AC), so the kernel decodes it, and copies the file inside to <name>.part,
then renames it in the same folder. The kernel lists that file rounded up to whole
64 KiB blocks; only the inode's real length is copied.
The checks from the first build stay: the container's block table is read before the
kernel sees it, a destination that exists and a drive without room for the image plus
1 GiB are refused, the size and exFAT boot sector are checked before the rename, and
Stop removes the .part and the mount. One unpack runs at a time. The mount is not in
the mount table the helper sees, so it is recorded on the /mnt tmpfs (owner pid, LVD
unit, .part) and a helper that starts after one died mid-copy releases it; a record of
a live instance is left alone.
Measured on the FW 13.60 Phat: a 315 MB image (127 MB container) in 3.5 s and a 4.5 GB
one (3.0 GB container) in 65 s, both byte-identical to the source; Stop, a takeover
mid-copy and a stale record all left no mount, LVD unit or .part behind.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K3cPwhp3UrzayBfyy9PDcN
- Receiver writes sce_sys/param.json and param.sfo as .ava-hold and puts them in
place when the job finishes: ShadowMount+ registered a folder whose eboot.bin
was still arriving, failed twice and skipped the title for good (repro on
13.60).
- AVA1 SkipProgress (0x30): a sender reading past data the receiver holds (a
resumed solid .rar/.7z) keeps the job alive; the console ended it as stalled
after 900 s on every retry.
- RAR5 unknown-size entries no longer wrap the unpacked total.
- Upload queue: stalled rows offer Restart transfer, stopped/interrupted rows
offer Resume, "Retry failed uploads" actually runs them and is translated as
an action.
- Payload Manager tab: Update for payloads stored from the Catalog, keeping the
boot-list place; repository installs are left to Payload Manager.
- Files: drag folders (and, without drag-out, files) onto a folder or the
breadcrumb to move them.
- README links the compose file from the feature list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EU1Z2mdhAxBrH1yb48pxik
New helper method net.ports (147, frame 265/266): binds each TCP and UDP
port and closes it at once (never connects, so no loader sees a silent
client), then binds 127.0.0.1 and the LAN address to tell network,
console-only and outgoing sockets apart. The socket sysctls
(net.inet.*.pcblist, kern.file) answer ENOENT on FW 13.60. A full pass
takes ~890 ms on the Phat. The engine names well-known ports and the
Payloads screen lists them, with Open only for web UIs and unknown ports.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EU1Z2mdhAxBrH1yb48pxik
This reverts commit 1f27c1a560.
Every helper build that linked the vendored zlib died within minutes on a
FW 13.60 Phat with SIGBUS in a system library touching helper code at
zlib's inflateEnd (logged by the new fault detail: addr=0x200161159,
rip=0x88007fe60), most often right after an app kill. One such build was
running when the console went down during a game launch and did not come
back. The same helper without zlib ran through repeated launches and kills.
The decompress op goes back out until it can run without linking zlib into
the helper.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EU1Z2mdhAxBrH1yb48pxik
Files gets "Decompress to .exfat…" on a .ffpfsc. The helper writes the image
the container holds beside it, under the image's own name, and keeps the
source; nothing crosses the network, where the round trip through a computer
was 191 GB of Wi-Fi for a 56 GB container in the report.
The helper (new job op FFPFSC_UNPACK, id 10 in the AVA1 schema) reads the
single-file PFS the way the engine's reader does, inflates each 64 KiB block
with vendored zlib 1.3.1 (inflate side only, third_party/zlib), and writes
<name>.part. It refuses a drive without room for the image plus 1 GiB and a
destination that exists, checks the size and, for an .exfat, the boot
sector, then renames within the folder. Progress and Stop go through the
op-status/op-cancel routes; the engine route is POST /api/ps5/fs/unpack. The
Files screen shows a progress line with Stop and a task. Strings in all 21
locales.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EU1Z2mdhAxBrH1yb48pxik
A plain unmount first; FW 13.60's shell keeps /mnt/usbN open, so the app offers
"Eject anyway", which syncs and force-unmounts. Verified on the Phat: /mnt/usb0
gone and stayed gone, helper unaffected.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EU1Z2mdhAxBrH1yb48pxik
The unattended helper restore pushed the helper as soon as :9021 answered, which on a
cold boot is before kstuff loads (FW 11.40 report: crash 3/3). It now waits 90 s after
the loader first appears. SPEC.md: fs.write/fs.mkdir ignore mode (both are 0777).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EU1Z2mdhAxBrH1yb48pxik
For shortcuts and loaders that, once set up, only clutter the home
screen. ⋯ → "Hide from home screen" on a Games card; a "Hidden" badge
marks it, "N hidden from the home screen" at the top filters to them,
and ⋯ → "Show on home screen" puts it back.
How: every user's icon table in app.db (tbl_iconinfo_<user>) has a
`visible` flag; the system hides some of its own apps with it. The
helper (app.icon_set, app.hidden_list) flips only that flag: nothing is
deleted, the title stays installed and playable. Guards: title ids only,
system apps (NPXS) refused, tables found by shape (titleId + visible),
app.db backed up once to /data/ps5upload/app.db.before-hide before the
first change, BEGIN IMMEDIATE (fails before any change if the system
holds the lock), and rolled back unless at least one and at most one
row per table changed. The hidden list is read live from app.db, so it
cannot drift from the console, and leaves out the system's own hidden
apps. The home screen redraws when an app is next opened and closed;
the console shows a notification saying so.
Verified on the Phat (FW 13.60): WebKit Autoloader hidden, listed, shown
again; a system app and an unknown id refused; the backup written.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub1mez9eaVtTF8pMEFXvA9
The sender called any wait for the console's credit "console memory"
unless the console reported its disk or workers as the limit. When the
console reports its queue ran dry, it is idle, waiting for data: the
credit is slow in transit (here a Windows Internet Connection Sharing
bridge on a CPU busy converting), so the cause is the network.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub1mez9eaVtTF8pMEFXvA9
When the router hands the PS5 a new address, the saved one stops
answering and the app said the helper was not running. Now, while the
active console is down, the desktop and Android apps scan the network
(at most every five minutes) and ask the engine about each PS5 running
our helper: POST /api/ava1/same-console {old, new} connects to the new
address expecting the key pinned for the old one and answers same,
different or unknown. Only "same" shows a banner: "Your PS5 now answers
at X", with Switch (re-points the console, keeping its name and history)
and Dismiss. Another PS5 is never offered; the check pins nothing.
Tested against the C server (same at a new address, another console, no
pin, nothing answering) and against the real consoles: the Pro's key
pinned under a made-up old address matches the Pro and not the Phat.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub1mez9eaVtTF8pMEFXvA9
job.cancel stopped a job on the console without telling the session it
was attached to: the session stayed up, so the sender waited for a
JobDone that never came. The console now tells that session first
(JobDone with ERR_CANCELLED for a job it receives, JobCancel for one it
sends).
The engine's sender also bounds the wait: a receiver that says nothing
about the job for 10 minutes on a live session (no Status, no other
frame) gets JobCancel{ERR_STALLED} and the job fails. The wait for the
map is bounded the same way and honours the cancel flag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- A JobCancel reaches a job only when it is parked or attached to the
session the cancel came on, so a late cancel from an old direct send
no longer stops the upload the relay re-attached. The sending
console's watcher only hangs up when its job was replaced.
- c2c.send replaces only an earlier send the same device started;
any other job under that id is left alone (ERR_BUSY, before dialling).
- A live ticket decides even for a paired key: the session is the
ticket's restricted one, owned by the ticket's owner.
- A session's terms (restricted/outbound/r_job/r_owner/r_root) are
written in the locked section that publishes it.
- FileRetry is de-duplicated per file and capped at the manifest size.
- c2c.send checks the read policy before stat; a dial that succeeds
with some lanes failing no longer leaves a stale reason; a stale
comment and an unused include are gone.
SPEC.md §11 and §18 say the same.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
clear-slot, users/list, remoteplay/devices, tmdb/fetch, bps inspect/apply, pkg install cancel,
appinfo/set, time/state get/set, pkg/parse and the fan-curve routes lost their last caller with
today's client clean-up; their handlers, types and the core code only they used go too, as does
the search-index module only tests used.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub1mez9eaVtTF8pMEFXvA9
Engine: drop the unused /api/fakelibs/manifest, /api/collection/summary and
/api/ps5/content-db/backup routes, the payload FTP client (core ftp.rs, FTP_START/STATUS)
and NOTIF_SEND, and pub items only their own tests called. The DPI reason strings now come
from the payload_lifecycle constants everywhere.
Shims: the legacy helper replace flow (engine legacy_helper/legacy_guard, the helper/state
and helper/replace routes, the status-error fold), the client's helper_old banner/state and
the payload's legacy takeover and retired-folder removal are gone. An old helper that does
not speak AVA1 now reads as no helper, and the normal send-the-helper flow replaces it. The
6.0 console folder cleanup now starts from a successful status probe.
Payload: remove the FTP server and its self-tests, notif.send, ftp.start/ftp.status
(ids 119, 120, 123 retired in the schema), the unused ShellUI sensor/install RPCs,
runtime_reconcile_mounts, register_services_init, hw_temps_get_text and
mgmt_call_fs_mkdir. MGMT_METHODS.md describes the current method table.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub1mez9eaVtTF8pMEFXvA9
Deletes tests/install-fallback-hw.mjs, the mobile audit probe and its allowlist,
scripts/requirements.txt, tests/lab/verify-pending.sh, bench/baselines/ and client/icons/
(nothing references them; the bundle icons live in client/src-tauri/icons). audit-scripts
lists fpkg-diff.py as a manual research tool and no longer counts a script naming itself as
a reference. SPEC.md no longer says zip/7z/RAR sources fall back to FTX2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub1mez9eaVtTF8pMEFXvA9
The sending console now dials the receiving one and pushes the job itself.
The receiving console hands out a one-job ticket (c2c.allow) for the sender's
key, and the sender shows it in its handshake (c2c.send). The receiver takes it
as an ordinary upload into the ticket's one root. Each side holds the other to
that one job: no calls, no other job, no other root.
The engine tries the direct route first and falls back to its relay when the
consoles can't connect, a helper is older, or the direct send stops. The job on
the receiving console is the engine's own under the same id, so either route
resumes what the other left. The queue row shows the route ("Straight between
the consoles", Beta) or "Through this computer" and why.
Verified on two PS5s (FW 13.60): 842 MB / 401 files direct in about 11 s, both
directions; a cancel then resume; checksums identical. Spec: SPEC.md §18.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ub1mez9eaVtTF8pMEFXvA9
