Merge nx2 into nx2-experimental

Resolved by area:
- audio feature_support.h: nx2's native revision handling.
- fiber.cpp: ours, which also drops the unused rewind stack.
- host_memory.cpp: ours granule bitmap and HintCold, plus nx2's
  fallocate hole punching per whole dirty granule on Linux.
- texture_cache.h: nx2's old-age eviction pass, then our Collect().
- kepler_compute.cpp: shared upscale slots, then Fortune's Weave's,
  then the Kirby Air Riders scan.
- nx2_gsv.h: ours, plus nx2's GetBufferMaxResolution and graphics
  device ids (1-based).
- nvhost_ctrl_gpu.cpp: engine support flag bits 40-44.
- lower_to_maxwell.h: ours as the base, with nx2's seven lowering
  commits applied one at a time. Second texture descriptor buffers
  are read bindless in TEX, TLD.SCR (level zero) and SUST; FSEL
  keeps its operand modifiers; TXD takes any channel mask.

lower_to_maxwell.h lowers 837 Fortune's Weave and 1183 Mario Kart
World shader dumps with the same rejects as nx2 and ours (12 and 0).

Assisted-by: Claude Sonnet 5.5 (conflict analysis and drafting)

63 files changed, 4226 insertions, 217 deletions

diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
index 20aa57f7aa..2a4e092f75 100644
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -42,8 +42,9 @@ jobs:
     runs-on: ${{ matrix.runner }}
     env:
       CCACHE_DIR: ${{ github.workspace }}/.ccache
-      CCACHE_MAXSIZE: 1500M
+      CCACHE_MAXSIZE: 3000M
       SCCACHE_DIR: ${{ github.workspace }}/.sccache
+      SCCACHE_CACHE_SIZE: 3G
     strategy:
       fail-fast: false
       matrix:
@@ -72,7 +73,7 @@ jobs:
 
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Linux dependencies
         if: startsWith(matrix.platform, 'linux')
@@ -87,7 +88,9 @@ jobs:
             libswscale-dev pkg-config zlib1g-dev libva-dev libvdpau-dev \
             spirv-tools spirv-headers libusb-1.0-0-dev \
             libboost-dev libboost-fiber-dev libboost-context-dev \
-            libopus-dev libasound2-dev ccache
+            libopus-dev libasound2-dev ccache \
+            libxcb-cursor0 libxcb-icccm4 libxcb-image0 \
+            libxcb-keysyms1 libxcb-randr0 libxcb-render-util0 libxcb-shape0 libxcb-xinerama0 libxcb-xkb1
 
       # The packages docs/Deps.md lists for macOS, plus ccache.
       - name: Install macOS dependencies
@@ -196,6 +199,7 @@ jobs:
         with:
           msystem: UCRT64
           update: true
+          cache: true
           install: >-
             git make autoconf libtool automake-wrapper patch jq pactoys ninja
           pacboy: >-
@@ -207,7 +211,7 @@ jobs:
             lerc:p graphite2:p libwebp:p libtiff:p brotli:p ccache:p
 
       - name: Cache CPM downloads
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: .cache/cpm
           key: cpm-${{ runner.os }}-${{ hashFiles('cpmfile.json', 'CMakeLists.txt', 'src/**/CMakeLists.txt') }}
@@ -217,7 +221,7 @@ jobs:
       # The sha in the key makes every run save a fresh cache (actions/cache never saves over an
       # exact hit), and restore-keys seeds it from the newest one of the same platform.
       - name: Cache compiler objects
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             .ccache
@@ -369,9 +373,6 @@ jobs:
           set -euo pipefail
           test -x build/release/bin/eglantine
           test -x build/release/bin/eden-cli
-          # Libraries Qt's xcb platform plugin needs, so linuxdeploy can resolve and bundle them.
-          sudo apt-get install -y --no-install-recommends libxcb-cursor0 libxcb-icccm4 libxcb-image0 \
-            libxcb-keysyms1 libxcb-randr0 libxcb-render-util0 libxcb-shape0 libxcb-xinerama0 libxcb-xkb1
           tools="$RUNNER_TEMP/linuxdeploy"
           mkdir -p "$tools"
           arch=$(uname -m)   # aarch64 or x86_64
@@ -496,12 +497,19 @@ jobs:
           codesign --verify --deep --strict "$app"
           ditto -c -k --keepParent "$app" "eglantine-${GITHUB_SHA}-${{ matrix.platform }}.zip"
           ls -la "eglantine-${GITHUB_SHA}-${{ matrix.platform }}.zip"
+          # Also ship a .dmg (drag eglantine.app onto Applications).
+          dmgdir=$(mktemp -d)
+          ditto "$app" "$dmgdir/eglantine.app"
+          ln -s /Applications "$dmgdir/Applications"
+          hdiutil create -volname "Eglantine" -srcfolder "$dmgdir" -ov -format UDZO \
+            "eglantine-${GITHUB_SHA}-${{ matrix.platform }}.dmg"
+          ls -la "eglantine-${GITHUB_SHA}-${{ matrix.platform }}.dmg"
 
       # The artifact is the bin folder itself: GitHub zips artifacts on download, and uploading a
       # zip gave a zip inside a zip. The release job zips it once for the release.
       - name: Upload Windows binary
         if: matrix.platform == 'windows-x86_64'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: eglantine-${{ matrix.platform }}-${{ github.sha }}
           path: build/release/bin/
@@ -510,7 +518,7 @@ jobs:
 
       - name: Upload MinGW binary
         if: matrix.mingw
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: eglantine-${{ matrix.platform }}-${{ github.sha }}
           path: build/release/bin/
@@ -520,7 +528,7 @@ jobs:
       # Both Linux files go in one artifact: the tar.gz and the AppImage.
       - name: Upload Linux binary
         if: startsWith(matrix.platform, 'linux')
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: eglantine-${{ matrix.platform }}-${{ github.sha }}
           path: |
@@ -533,10 +541,12 @@ jobs:
       # Zipped with ditto beforehand: the bundle's framework symlinks don't survive artifact zipping.
       - name: Upload macOS app
         if: startsWith(matrix.platform, 'macos')
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: eglantine-${{ matrix.platform }}-${{ github.sha }}
-          path: eglantine-${{ github.sha }}-${{ matrix.platform }}.zip
+          path: |
+            eglantine-${{ github.sha }}-${{ matrix.platform }}.zip
+            eglantine-${{ github.sha }}-${{ matrix.platform }}.dmg
           if-no-files-found: error
           compression-level: 0
           retention-days: 7
@@ -553,7 +563,7 @@ jobs:
       contents: write
     steps:
       - name: Download binaries
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           pattern: eglantine-*-${{ github.sha }}
           path: artifacts
@@ -570,6 +580,7 @@ jobs:
               cp "$artifact"/*.AppImage "$artifact"/*.tar.gz dist/
             elif compgen -G "$artifact*.zip" > /dev/null; then
               cp "$artifact"/*.zip dist/
+              cp "$artifact"/*.dmg dist/ 2>/dev/null || true
             else
               (cd "$artifact" && zip -qr "${GITHUB_WORKSPACE}/dist/${name}.zip" .)
             fi
diff --git a/CMakeLists.txt b/CMakeLists.txt
index ba44aa9d47..04d0f17d74 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -463,6 +463,9 @@ if (lz4_ADDED)
 endif()
 
 # zstd
+# Always bundled: NUP archives are only byte-identical across platforms when every build
+# compresses with the same zstd version.
+set(zstd_FORCE_BUNDLED ON)
 AddJsonPackage(zstd)
 
 if (zstd_ADDED)
diff --git a/src/audio_core/audio_render_manager.cpp b/src/audio_core/audio_render_manager.cpp
index 8083b92287..4034de1ec3 100644
--- a/src/audio_core/audio_render_manager.cpp
+++ b/src/audio_core/audio_render_manager.cpp
@@ -33,8 +33,8 @@ SystemManager& Manager::GetSystemManager() {
 Result Manager::GetWorkBufferSize(const AudioRendererParameterInternal& params,
                                   u64& out_count) const {
     if (!CheckValidRevision(params.revision)) {
-        LOG_ERROR(Service_Audio, "Audio renderer revision {:#x} ({}) is newer than {}",
-                  params.revision, GetRevisionNum(params.revision), MaxAcceptedRevision);
+        LOG_ERROR(Service_Audio, "Audio renderer revision {:#x} ({}) is not supported",
+                  params.revision, GetRevisionNum(params.revision));
         return Service::Audio::ResultInvalidRevision;
     }
 
diff --git a/src/audio_core/common/feature_support.h b/src/audio_core/common/feature_support.h
index 1a6bfef527..d6571c0661 100644
--- a/src/audio_core/common/feature_support.h
+++ b/src/audio_core/common/feature_support.h
@@ -17,8 +17,16 @@
 
 namespace AudioCore {
 constexpr u32 CurrentRevision = 15;
-/// Newest revision accepted: Switch 2 SDKs ask for 16 ("REv@"), run with revision 15's features.
-constexpr u32 MaxAcceptedRevision = 16;
+constexpr u32 NativeCurrentRevision = 16;
+
+constexpr bool IsNativeRevision(u32 revision) {
+    return (revision & 0xffffff) == Common::MakeMagic('R', 'E', 'v', '\0');
+}
+
+constexpr u32 EncodeRevision(u32 revision, bool native) {
+    return Common::MakeMagic('R', 'E', native ? 'v' : 'V',
+                             static_cast<char>('0' + revision));
+}
 
 enum class SupportTags {
     CommandProcessingTimeEstimatorVersion4,
@@ -59,12 +67,15 @@ enum class SupportTags {
 };
 
 constexpr u32 GetRevisionNum(u32 user_revision) {
-    if (user_revision >= 0x100) {
-        user_revision -= Common::MakeMagic('R', 'E', 'V', '0');
-        user_revision >>= 24;
+    if (user_revision < 0x100) {
+        return user_revision;
     }
-
-    return user_revision;
+    if (!IsNativeRevision(user_revision) &&
+        (user_revision & 0xffffff) != Common::MakeMagic('R', 'E', 'V', '\0')) {
+        return ~u32{0};
+    }
+    const u32 encoded = user_revision >> 24;
+    return encoded >= '0' ? encoded - '0' : ~u32{0};
 };
 
 constexpr bool CheckFeatureSupported(SupportTags tag, u32 user_revision) {
@@ -110,11 +121,12 @@ constexpr bool CheckFeatureSupported(SupportTags tag, u32 user_revision) {
         return false;
     }
     user_revision = GetRevisionNum(user_revision);
-    return (*feature).second <= user_revision;
+    return user_revision != ~u32{0} && (*feature).second <= user_revision;
 }
 
 constexpr bool CheckValidRevision(u32 user_revision) {
-    return GetRevisionNum(user_revision) <= MaxAcceptedRevision;
+    return GetRevisionNum(user_revision) <=
+           (IsNativeRevision(user_revision) ? NativeCurrentRevision : CurrentRevision);
 };
 
 } // namespace AudioCore
diff --git a/src/audio_core/renderer/behavior/behavior_info.cpp b/src/audio_core/renderer/behavior/behavior_info.cpp
index 63b80c503a..983cfd5b85 100644
--- a/src/audio_core/renderer/behavior/behavior_info.cpp
+++ b/src/audio_core/renderer/behavior/behavior_info.cpp
@@ -16,8 +16,7 @@ u32 BehaviorInfo::GetProcessRevisionNum() const {
 }
 
 u32 BehaviorInfo::GetProcessRevision() const {
-    return Common::MakeMagic('R', 'E', 'V',
-                             static_cast<char>(static_cast<u8>('0') + process_revision));
+    return EncodeRevision(process_revision, native_platform);
 }
 
 u32 BehaviorInfo::GetUserRevisionNum() const {
@@ -25,11 +24,12 @@ u32 BehaviorInfo::GetUserRevisionNum() const {
 }
 
 u32 BehaviorInfo::GetUserRevision() const {
-    return Common::MakeMagic('R', 'E', 'V',
-                             static_cast<char>(static_cast<u8>('0') + user_revision));
+    return EncodeRevision(user_revision, native_platform);
 }
 
 void BehaviorInfo::SetUserLibRevision(const u32 user_revision_) {
+    native_platform = IsNativeRevision(user_revision_);
+    process_revision = native_platform ? NativeCurrentRevision : CurrentRevision;
     user_revision = GetRevisionNum(user_revision_);
 }
 
diff --git a/src/audio_core/renderer/behavior/behavior_info.h b/src/audio_core/renderer/behavior/behavior_info.h
index 757f163c5a..318d4e1ff4 100644
--- a/src/audio_core/renderer/behavior/behavior_info.h
+++ b/src/audio_core/renderer/behavior/behavior_info.h
@@ -400,6 +400,7 @@ public:
     u32 process_revision;
     /// User version
     u32 user_revision{};
+    bool native_platform{};
     /// Behaviour flags
     Flags flags{};
     /// Errors generated and reported during Update
diff --git a/src/audio_core/renderer/behavior/info_updater.cpp b/src/audio_core/renderer/behavior/info_updater.cpp
index ca3eaece94..a8fbcf9730 100644
--- a/src/audio_core/renderer/behavior/info_updater.cpp
+++ b/src/audio_core/renderer/behavior/info_updater.cpp
@@ -122,12 +122,21 @@ Result InfoUpdater::UpdateVoices(VoiceContext& voice_context,
                 u8 flush_wave_buffer_count;
                 u16 reserved2;
                 VoiceInfo::Flags flags;
+                u8 reserved_after_flags;
                 SrcQuality src_quality;
+                u8 crossfade_curve;
                 u32 external_ctx;
                 u32 external_ctx_size;
                 u32 reserved3[2];
             };
+            static_assert(sizeof(VoiceInParameterV2) == 0x188);
+            static_assert(offsetof(VoiceInParameterV2, crossfade_curve) == 0x177);
             const auto* vin = reinterpret_cast<const VoiceInParameterV2*>(input + i * in_stride);
+            if (behaviour.GetUserRevisionNum() >= 16 && vin->in_use && vin->crossfade_curve != 0) {
+                LOG_ERROR(Service_Audio, "Unsupported voice biquad crossfade curve {}",
+                          vin->crossfade_curve);
+                return Service::Audio::ResultInvalidUpdateInfo;
+            }
             local_in.id = vin->id;
             local_in.node_id = vin->node_id;
             local_in.is_new = vin->is_new;
diff --git a/src/common/host_memory.cpp b/src/common/host_memory.cpp
index b724bed1bd..2ef1982cbc 100644
--- a/src/common/host_memory.cpp
+++ b/src/common/host_memory.cpp
@@ -51,6 +51,7 @@
 
 #endif // ^^^ POSIX ^^^
 
+#include <cstdlib>
 #include <mutex>
 #include <random>
 
@@ -518,6 +519,14 @@ public:
         , virtual_size{virtual_size_}
     {}
 
+#ifdef __linux__
+    bool PunchHole(size_t offset, size_t length) {
+        return fd >= 0 &&
+               fallocate(fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, static_cast<off_t>(offset),
+                         static_cast<off_t>(length)) == 0;
+    }
+#endif
+
     bool Init() {
         long page_size = sysconf(_SC_PAGESIZE);
         ASSERT_MSG(page_size == 0x1000, "page size {:#x} is incompatible with 4K paging", page_size);
@@ -827,6 +836,13 @@ void HostMemory::ClearBackingRegion(size_t physical_offset, size_t length, u32 f
     // Fresh backing memory is zero and the host gives it no RAM until it's touched: clear only
     // the granules that may hold data (title 1's heap made the host commit every page of it).
     // A granule cleared in full is zero again.
+#ifdef __linux__
+    // Handing a whole granule back to the kernel frees its RAM; a memset would commit it.
+    static const bool punch = [] {
+        const char* value = std::getenv("EDEN_PUNCH_HOLE");
+        return value == nullptr || value[0] != '0';
+    }();
+#endif
     const size_t end = physical_offset + length;
     for (size_t offset = physical_offset; offset < end;) {
         const size_t index = offset >> GranuleShift;
@@ -834,8 +850,15 @@ void HostMemory::ClearBackingRegion(size_t physical_offset, size_t length, u32 f
         const size_t granule_end = granule_begin + (size_t{1} << GranuleShift);
         const size_t clear_end = (std::min)(granule_end, end);
         if ((granules[index].load(std::memory_order_acquire) & GranuleDirty) != 0) {
-            std::memset(backing_base + offset, 0, clear_end - offset);
-            if (offset == granule_begin && clear_end == granule_end) {
+            const bool whole = offset == granule_begin && clear_end == granule_end;
+            bool cleared = false;
+#ifdef __linux__
+            cleared = whole && punch && impl && impl->PunchHole(granule_begin, granule_end - granule_begin);
+#endif
+            if (!cleared) {
+                std::memset(backing_base + offset, 0, clear_end - offset);
+            }
+            if (whole) {
                 granules[index].fetch_and(static_cast<u8>(~GranuleDirty), std::memory_order_release);
             }
         }
diff --git a/src/core/CMakeLists.txt b/src/core/CMakeLists.txt
index a9f4c2db7f..eeb3202d12 100644
--- a/src/core/CMakeLists.txt
+++ b/src/core/CMakeLists.txt
@@ -134,6 +134,8 @@ add_library(core STATIC
     file_sys/registered_cache.h
     file_sys/nup_container.cpp
     file_sys/nup_container.h
+    file_sys/nup_writer.cpp
+    file_sys/nup_writer.h
     file_sys/romfs.cpp
     file_sys/romfs.h
     file_sys/romfs_factory.cpp
diff --git a/src/core/file_sys/nup_writer.cpp b/src/core/file_sys/nup_writer.cpp
new file mode 100644
index 0000000000..8c7728ed01
--- /dev/null
+++ b/src/core/file_sys/nup_writer.cpp
@@ -0,0 +1,1459 @@
+// SPDX-FileCopyrightText: Copyright 2026 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#include "core/file_sys/nup_writer.h"
+
+#include <algorithm>
+#include <array>
+#include <cctype>
+#include <charconv>
+#include <cstring>
+#include <limits>
+#include <map>
+#include <memory>
+#include <optional>
+#include <span>
+#include <stdexcept>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+
+#include <nlohmann/json.hpp>
+#include <openssl/evp.h>
+#include <zstd.h>
+
+#include "common/fs/file.h"
+#include "common/fs/path_util.h"
+#include "core/file_sys/control_metadata.h"
+#include "core/file_sys/vfs/vfs_real.h"
+#include "core/loader/deconstructed_rom_directory.h"
+
+namespace FileSys::Nup {
+namespace {
+
+using Json = nlohmann::json;
+namespace fs = std::filesystem;
+
+constexpr std::array<u8, 4> Magic{'N', 'U', 'P', 0x01};
+constexpr std::array<u8, 4> TocMagic{'T', 'O', 'C', 0x01};
+constexpr u64 SuperblockSize = 0x80;
+constexpr u64 TocHeaderSize = 0x30;
+constexpr u64 PackageRecordSize = 0x40;
+constexpr u64 DirRecordSize = 0x18;
+constexpr u64 FileRecordSize = 0x50;
+constexpr u64 ExtentAlignment = 16;
+constexpr u32 NoDir = 0xFFFFFFFF;
+
+constexpr u8 KindBase = 0;
+constexpr u8 KindUpdate = 1;
+constexpr u8 KindAddon = 2;
+constexpr u8 FlagStandaloneUpdate = 0x01;
+constexpr u8 CodecRaw = 0;
+constexpr u8 CodecZstd = 1;
+
+constexpr u16 TlvNpdm = 0x0001;
+constexpr u16 TlvNacp = 0x0002;
+constexpr u16 TlvIcon = 0x0003;
+constexpr u16 TlvDisplayVersion = 0x0004;
+constexpr u16 TlvTitleName = 0x0005;
+constexpr u16 TlvPublisher = 0x0006;
+constexpr u16 TlvSourceDump = 0x0008;
+
+constexpr int JournalVersion = 1;
+constexpr u64 ProgressStep = 64ULL * 1024 * 1024;
+constexpr size_t MaxChunkFiles = 4096;
+constexpr size_t ReadBufferSize = 4 * 1024 * 1024;
+
+class PackError : public std::runtime_error {
+public:
+    PackError(PackResult result_, const std::string& message)
+        : std::runtime_error(message), result{result_} {}
+    PackResult result;
+};
+
+u64 AlignUp(u64 value, u64 alignment) {
+    return (value + alignment - 1) / alignment * alignment;
+}
+
+std::string ToUtf8(const fs::path& path) {
+    const auto u8 = path.generic_u8string();
+    return {u8.begin(), u8.end()};
+}
+
+fs::path FromUtf8(const std::string& value) {
+    return fs::path{std::u8string{value.begin(), value.end()}};
+}
+
+std::string Lower(std::string value) {
+    std::ranges::transform(value, value.begin(),
+                           [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
+    return value;
+}
+
+fs::path WithSuffix(fs::path path, std::string_view suffix) {
+    path += suffix;
+    return path;
+}
+
+bool IsFile(const fs::path& path) {
+    std::error_code ec;
+    return fs::is_regular_file(path, ec);
+}
+
+fs::path FindDirectory(const fs::path& parent, std::string_view name) {
+    std::error_code ec;
+    if (parent.empty() || !fs::is_directory(parent, ec)) {
+        return {};
+    }
+    const auto wanted = Lower(std::string{name});
+    for (const auto& entry : fs::directory_iterator(parent, ec)) {
+        if (entry.is_directory(ec) && Lower(ToUtf8(entry.path().filename())) == wanted) {
+            return entry.path();
+        }
+    }
+    return {};
+}
+
+std::optional<u64> ParseDecimal(const std::string& name) {
+    u64 value{};
+    const auto* end = name.data() + name.size();
+    const auto [ptr, ec] = std::from_chars(name.data(), end, value);
+    if (name.empty() || ec != std::errc{} || ptr != end) {
+        return std::nullopt;
+    }
+    return value;
+}
+
+// The exefs folder a dump boots from: the newest updates/<version>, else base, else the root.
+// Each must hold main, main.npdm and a romfs folder next to it or under base.
+bool HasBootableExeFS(const fs::path& root) {
+    const auto bootable = [](const fs::path& exefs) {
+        return !exefs.empty() && IsFile(exefs / "main") && IsFile(exefs / "main.npdm");
+    };
+    fs::path exefs;
+    std::optional<u64> best_version;
+    if (const auto updates = FindDirectory(root, "updates"); !updates.empty()) {
+        std::error_code ec;
+        for (const auto& entry : fs::directory_iterator(updates, ec)) {
+            const auto version = ParseDecimal(ToUtf8(entry.path().filename()));
+            const auto candidate = FindDirectory(entry.path(), "exefs");
+            if (version && bootable(candidate) && (!best_version || *version > *best_version)) {
+                best_version = version;
+                exefs = candidate;
+            }
+        }
+    }
+    const auto base = FindDirectory(root, "base");
+    if (exefs.empty()) {
+        exefs = FindDirectory(base, "exefs");
+    }
+    if (exefs.empty()) {
+        exefs = FindDirectory(root, "exefs");
+    }
+    if (!bootable(exefs)) {
+        return false;
+    }
+    return !FindDirectory(exefs.parent_path(), "romfs").empty() ||
+           !FindDirectory(base, "romfs").empty();
+}
+
+std::optional<u64> ParseTitleId(const std::string& name) {
+    u64 value{};
+    const auto* end = name.data() + name.size();
+    const auto [ptr, ec] = std::from_chars(name.data(), end, value, 16);
+    if (name.size() != 16 || ec != std::errc{} || ptr != end) {
+        return std::nullopt;
+    }
+    return value;
+}
+
+std::string ToHex(std::span<const u8> data) {
+    static constexpr char digits[] = "0123456789abcdef";
+    std::string out;
+    out.reserve(data.size() * 2);
+    for (const u8 byte : data) {
+        out += digits[byte >> 4];
+        out += digits[byte & 0xF];
+    }
+    return out;
+}
+
+std::vector<u8> FromHex(const std::string& hex) {
+    if (hex.size() % 2 != 0) {
+        throw PackError(PackResult::IoError, "malformed journal");
+    }
+    std::vector<u8> out(hex.size() / 2);
+    for (size_t i = 0; i < out.size(); ++i) {
+        const auto [ptr, ec] = std::from_chars(hex.data() + i * 2, hex.data() + i * 2 + 2, out[i], 16);
+        if (ec != std::errc{} || ptr != hex.data() + i * 2 + 2) {
+            throw PackError(PackResult::IoError, "malformed journal");
+        }
+    }
+    return out;
+}
+
+std::vector<u8> ReadWholeFile(const fs::path& path) {
+    Common::FS::IOFile in{path, Common::FS::FileAccessMode::Read};
+    if (!in.IsOpen()) {
+        return {};
+    }
+    std::vector<u8> data(in.GetSize());
+    if (in.ReadSpan(std::span{data}) != data.size()) {
+        return {};
+    }
+    return data;
+}
+
+// Same as pack.py: the program ID at ACI0 + 0x10, whatever the NPDM header revision.
+std::optional<u64> NpdmProgramId(std::span<const u8> npdm) {
+    static constexpr std::array<u8, 4> aci0{'A', 'C', 'I', '0'};
+    const auto it = std::search(npdm.begin(), npdm.end(), aci0.begin(), aci0.end());
+    const auto offset = static_cast<size_t>(it - npdm.begin());
+    if (it == npdm.end() || offset + 0x18 > npdm.size()) {
+        return std::nullopt;
+    }
+    u64 id = 0;
+    for (size_t i = 0; i < 8; ++i) {
+        id |= static_cast<u64>(npdm[offset + 0x10 + i]) << (8 * i);
+    }
+    return id;
+}
+
+void PutLE(std::vector<u8>& buffer, size_t offset, u64 value, size_t bytes) {
+    for (size_t i = 0; i < bytes; ++i) {
+        buffer[offset + i] = static_cast<u8>(value >> (8 * i));
+    }
+}
+
+void PutBytes(std::vector<u8>& buffer, size_t offset, std::span<const u8> bytes) {
+    std::memcpy(buffer.data() + offset, bytes.data(), bytes.size());
+}
+
+using Digest = std::array<u8, 32>;
+
+class Sha256 {
+public:
+    Sha256() : ctx{EVP_MD_CTX_new()} {
+        if (!ctx) {
+            throw PackError(PackResult::IoError, "cannot initialise SHA-256");
+        }
+        Reset();
+    }
+    ~Sha256() {
+        EVP_MD_CTX_free(ctx);
+    }
+    Sha256(const Sha256&) = delete;
+    Sha256& operator=(const Sha256&) = delete;
+
+    void Reset() {
+        if (EVP_DigestInit_ex(ctx, EVP_sha256(), nullptr) != 1) {
+            throw PackError(PackResult::IoError, "cannot initialise SHA-256");
+        }
+    }
+
+    void Update(const void* data, size_t size) {
+        EVP_DigestUpdate(ctx, data, size);
+    }
+
+    Digest Final() {
+        Digest digest{};
+        unsigned int length{};
+        EVP_DigestFinal_ex(ctx, digest.data(), &length);
+        return digest;
+    }
+
+private:
+    EVP_MD_CTX* ctx;
+};
+
+class ZstdContext {
+public:
+    // Archives must be byte-identical across platforms, so compression is always
+    // single-threaded (zstd's multithreaded frames differ) and every frame parameter is set
+    // explicitly instead of relying on library defaults.
+    explicit ZstdContext(int level) : cctx{ZSTD_createCCtx()} {
+        if (!cctx || ZSTD_isError(ZSTD_CCtx_setParameter(cctx, ZSTD_c_compressionLevel, level)) ||
+            ZSTD_isError(ZSTD_CCtx_setParameter(cctx, ZSTD_c_nbWorkers, 0)) ||
+            ZSTD_isError(ZSTD_CCtx_setParameter(cctx, ZSTD_c_contentSizeFlag, 1)) ||
+            ZSTD_isError(ZSTD_CCtx_setParameter(cctx, ZSTD_c_checksumFlag, 0)) ||
+            ZSTD_isError(ZSTD_CCtx_setParameter(cctx, ZSTD_c_dictIDFlag, 0))) {
+            throw PackError(PackResult::IoError, "cannot initialise zstd");
+        }
+    }
+    ~ZstdContext() {
+        ZSTD_freeCCtx(cctx);
+    }
+    ZstdContext(const ZstdContext&) = delete;
+    ZstdContext& operator=(const ZstdContext&) = delete;
+
+    // The pledged size makes zstd record the content size in the frame header, which the
+    // format requires.
+    void Begin(u64 size) {
+        if (ZSTD_isError(ZSTD_CCtx_reset(cctx, ZSTD_reset_session_only)) ||
+            ZSTD_isError(ZSTD_CCtx_setPledgedSrcSize(cctx, size))) {
+            throw PackError(PackResult::IoError, "cannot start zstd frame");
+        }
+    }
+
+    ZSTD_CCtx* get() const {
+        return cctx;
+    }
+
+private:
+    ZSTD_CCtx* cctx;
+};
+
+// One package and the metadata it is written with. The plan is everything that must survive a
+// low-storage run deleting its sources, so it is what the journal stores.
+struct PlanPackage {
+    u8 kind{};
+    u8 flags{};
+    u64 title_id{};
+    u32 version{};
+    std::vector<u8> meta;
+};
+
+struct PlanEntry {
+    u32 package{};
+    std::string path;   // inside the package tree, e.g. "romfs/Data/file.bin"
+    std::string source; // relative to the dump root
+    bool directory{};
+};
+
+struct Plan {
+    std::vector<PlanPackage> packages;
+    std::vector<PlanEntry> entries;
+};
+
+struct Extent {
+    u64 size{};
+    Digest sha256{};
+    u64 offset{};
+    u64 stored_size{};
+    u8 codec{};
+};
+
+struct Layout {
+    struct Dir {
+        std::string name;
+        u32 first_child{};
+        u32 child_count{};
+    };
+    struct File {
+        std::string name;
+        size_t entry{};
+    };
+    struct Package {
+        u32 root_dir{};
+        u32 exefs_dir = NoDir;
+        u32 romfs_dir = NoDir;
+    };
+    std::vector<Dir> dirs;
+    std::vector<File> files;
+    std::vector<u64> children; // FileTag | file index, or dir index
+    std::vector<Package> packages;
+    std::string pool;
+    std::unordered_map<std::string, u32> pool_index;
+    u64 toc_size{};
+    u64 blob_offset{};
+
+    static constexpr u64 FileTag = 1ULL << 32;
+
+    u32 Intern(const std::string& name) {
+        const auto [it, inserted] = pool_index.try_emplace(name, static_cast<u32>(pool.size()));
+        if (inserted) {
+            pool += name;
+        }
+        return it->second;
+    }
+};
+
+// Children sorted by the bytes of their names: std::string compares as unsigned char.
+struct TreeDir {
+    struct Child {
+        std::unique_ptr<TreeDir> dir;
+        size_t file_entry{};
+    };
+    std::string name;
+    std::map<std::string, Child> children;
+
+    TreeDir* Descend(const std::string& component) {
+        auto& child = children[component];
+        if (!child.dir) {
+            child.dir = std::make_unique<TreeDir>();
+            child.dir->name = component;
+        }
+        return child.dir.get();
+    }
+};
+
+// Lays out nodes as pack.py does: directories in pre-order, each directory's child slots
+// contiguous, its files numbered in slot order before its subdirectories are visited.
+u32 AssignDir(TreeDir& dir, Layout& layout) {
+    const auto id = static_cast<u32>(layout.dirs.size());
+    layout.dirs.push_back({dir.name, static_cast<u32>(layout.children.size()),
+                           static_cast<u32>(dir.children.size())});
+    const size_t slot_base = layout.children.size();
+    layout.children.resize(slot_base + dir.children.size());
+    size_t slot = slot_base;
+    for (auto& [name, child] : dir.children) {
+        if (!child.dir) {
+            layout.children[slot] = Layout::FileTag | layout.files.size();
+            layout.files.push_back({name, child.file_entry});
+        }
+        ++slot;
+    }
+    slot = slot_base;
+    for (auto& [name, child] : dir.children) {
+        if (child.dir) {
+            layout.children[slot] = AssignDir(*child.dir, layout);
+        }
+        ++slot;
+    }
+    return id;
+}
+
+Layout BuildLayout(const Plan& plan) {
+    std::vector<TreeDir> roots(plan.packages.size());
+    for (size_t i = 0; i < plan.entries.size(); ++i) {
+        const auto& entry = plan.entries[i];
+        TreeDir* dir = &roots.at(entry.package);
+        size_t start = 0;
+        while (true) {
+            const auto slash = entry.path.find('/', start);
+            const auto component = entry.path.substr(start, slash - start);
+            if (slash == std::string::npos) {
+                if (entry.directory) {
+                    dir->Descend(component);
+                } else {
+                    auto& child = dir->children[component];
+                    if (child.dir) {
+                        throw PackError(PackResult::InvalidSource,
+                                        "a file and a folder share the name " + entry.path);
+                    }
+                    child.file_entry = i;
+                }
+                break;
+            }
+            dir = dir->Descend(component);
+            start = slash + 1;
+        }
+    }
+
+    Layout layout;
+    for (auto& root : roots) {
+        Layout::Package package;
+        package.root_dir = AssignDir(root, layout);
+        const auto& root_dir = layout.dirs[package.root_dir];
+        for (u32 slot = root_dir.first_child; slot < root_dir.first_child + root_dir.child_count;
+             ++slot) {
+            const u64 child = layout.children[slot];
+            if (child & Layout::FileTag) {
+                continue;
+            }
+            const auto id = static_cast<u32>(child);
+            if (layout.dirs[id].name == "exefs") {
+                package.exefs_dir = id;
+            } else if (layout.dirs[id].name == "romfs") {
+                package.romfs_dir = id;
+            }
+        }
+        layout.packages.push_back(package);
+    }
+
+    if (layout.dirs.size() + layout.files.size() >= NoDir) {
+        throw PackError(PackResult::InvalidSource, "the dump has too many files");
+    }
+    for (const auto& dir : layout.dirs) {
+        layout.Intern(dir.name);
+    }
+    for (const auto& file : layout.files) {
+        layout.Intern(file.name);
+    }
+    if (layout.pool.size() > std::numeric_limits<u32>::max()) {
+        throw PackError(PackResult::InvalidSource, "the dump's file names are too long");
+    }
+
+    const u64 unpadded = TocHeaderSize + plan.packages.size() * PackageRecordSize +
+                         layout.dirs.size() * DirRecordSize + layout.files.size() * FileRecordSize +
+                         layout.children.size() * sizeof(u32) + layout.pool.size();
+    layout.toc_size = AlignUp(unpadded, ExtentAlignment);
+    layout.blob_offset = AlignUp(SuperblockSize + layout.toc_size, ExtentAlignment);
+    return layout;
+}
+
+std::vector<u8> SerializeTlvs(std::vector<std::pair<u16, std::vector<u8>>> records) {
+    std::ranges::stable_sort(records, {}, &std::pair<u16, std::vector<u8>>::first);
+    std::vector<u8> out;
+    for (const auto& [type, payload] : records) {
+        const size_t at = out.size();
+        out.resize(at + 8 + payload.size());
+        PutLE(out, at, type, 2);
+        PutLE(out, at + 4, payload.size(), 4);
+        PutBytes(out, at + 8, payload);
+    }
+    return out;
+}
+
+std::vector<u8> StringBytes(const std::string& value) {
+    return {value.begin(), value.end()};
+}
+
+// The dump's own loader supplies control data and the display version, the same way a loose
+// dump reports them when it boots (control.nacp beside it, else the RomFS's version tag).
+std::unique_ptr<Loader::AppLoader_DeconstructedRomDirectory> OpenLoader(
+    RealVfsFilesystem& vfs, const fs::path& package_dir) {
+    const auto exefs = FindDirectory(package_dir, "exefs");
+    if (exefs.empty() || !IsFile(exefs / "main")) {
+        return nullptr;
+    }
+    auto main = vfs.OpenFile(Common::FS::PathToUTF8String(exefs / "main"), OpenMode::Read);
+    if (!main) {
+        return nullptr;
+    }
+    return std::make_unique<Loader::AppLoader_DeconstructedRomDirectory>(std::move(main));
+}
+
+class Discovery {
+public:
+    Discovery(const fs::path& dump_root_, std::vector<fs::path> excluded_)
+        : dump_root{dump_root_}, excluded{std::move(excluded_)} {}
+
+    Plan Run() {
+        const auto base = FindDirectory(dump_root, "base");
+        const auto updates = FindDirectory(dump_root, "updates");
+        const auto dlc = FindDirectory(dump_root, "dlc");
+
+        std::optional<u64> base_title_id;
+        if (!base.empty() && HasContent(base)) {
+            base_title_id = AddPackage(KindBase, base, 0, {});
+        } else if (updates.empty() && HasContent(dump_root)) {
+            base_title_id = AddPackage(KindBase, dump_root, 0, {"base", "updates", "dlc"});
+        }
+
+        std::vector<std::pair<u64, fs::path>> versions;
+        std::error_code ec;
+        if (!updates.empty()) {
+            for (const auto& entry : fs::directory_iterator(updates, ec)) {
+                const auto version = ParseDecimal(ToUtf8(entry.path().filename()));
+                if (version && entry.is_directory(ec) && HasContent(entry.path())) {
+                    if (*version > std::numeric_limits<u32>::max()) {
+                        throw PackError(PackResult::InvalidSource,
+                                        "update version out of range: " + ToUtf8(entry.path()));
+                    }
+                    versions.emplace_back(*version, entry.path());
+                }
+            }
+        }
+        std::ranges::sort(versions);
+        const u8 update_flags = base_title_id ? 0 : FlagStandaloneUpdate;
+        for (const auto& [version, path] : versions) {
+            AddPackage(KindUpdate, path, static_cast<u32>(version), {}, update_flags,
+                       base_title_id.value_or(0));
+        }
+
+        if (!dlc.empty()) {
+            std::vector<std::pair<std::string, fs::path>> addons;
+            for (const auto& title : fs::directory_iterator(dlc, ec)) {
+                const auto title_name = ToUtf8(title.path().filename());
+                if (!ParseTitleId(title_name) || !title.is_directory(ec)) {
+                    continue;
+                }
+                for (const auto& content : fs::directory_iterator(title.path(), ec)) {
+                    if (content.is_directory(ec) && HasContent(content.path())) {
+                        addons.emplace_back(title_name + "/" + ToUtf8(content.path().filename()),
+                                            content.path());
+                    }
+                }
+            }
+            std::ranges::sort(addons);
+            for (const auto& [name, path] : addons) {
+                AddPackage(KindAddon, path, 0, {}, 0, *ParseTitleId(name.substr(0, 16)));
+            }
+        }
+
+        if (plan.packages.empty()) {
+            throw PackError(PackResult::InvalidSource, "no packages found in the dump");
+        }
+        AddApplicationMetadata();
+        for (size_t i = 0; i < plan.packages.size(); ++i) {
+            auto& tlvs = package_tlvs[i];
+            tlvs.emplace_back(TlvSourceDump, StringBytes(ToUtf8(dump_root.filename())));
+            plan.packages[i].meta = SerializeTlvs(std::move(tlvs));
+        }
+        return std::move(plan);
+    }
+
+private:
+    static bool HasContent(const fs::path& dir) {
+        return !FindDirectory(dir, "exefs").empty() || !FindDirectory(dir, "romfs").empty();
+    }
+
+    // Returns the package's title ID: the NPDM program ID, else the folder's or base's.
+    u64 AddPackage(u8 kind, const fs::path& dir, u32 version,
+                   const std::vector<std::string>& skip, u8 flags = 0, u64 fallback_id = 0) {
+        const auto index = static_cast<u32>(plan.packages.size());
+        PlanPackage package{kind, flags, fallback_id, version, {}};
+        auto& tlvs = package_tlvs.emplace_back();
+
+        const auto exefs = FindDirectory(dir, "exefs");
+        const auto romfs = FindDirectory(dir, "romfs");
+        fs::path npdm_path = exefs.empty() ? fs::path{} : exefs / "main.npdm";
+        if (!IsFile(npdm_path)) {
+            npdm_path = dir / "main.npdm";
+        }
+        if (IsFile(npdm_path)) {
+            auto npdm = ReadWholeFile(npdm_path);
+            if (const auto id = NpdmProgramId(npdm); kind != KindAddon && id && *id != 0) {
+                package.title_id = *id;
+            }
+            tlvs.emplace_back(TlvNpdm, std::move(npdm));
+        }
+
+        if (kind != KindAddon) {
+            if (auto loader = OpenLoader(vfs, dir)) {
+                std::string display_version;
+                if (loader->ReadDisplayVersion(display_version) == Loader::ResultStatus::Success &&
+                    !display_version.empty()) {
+                    tlvs.emplace_back(TlvDisplayVersion, StringBytes(display_version));
+                }
+                loaders.emplace_back(index, std::move(loader));
+            }
+        }
+        plan.packages.push_back(std::move(package));
+
+        if (!exefs.empty()) {
+            CollectTree(index, exefs, "exefs");
+        }
+        if (!romfs.empty()) {
+            CollectTree(index, romfs, "romfs");
+        }
+        std::error_code ec;
+        for (const auto& entry : fs::directory_iterator(dir, ec)) {
+            const auto name = ToUtf8(entry.path().filename());
+            const auto lower = Lower(name);
+            if (entry.path() == exefs || entry.path() == romfs ||
+                std::ranges::find(skip, lower) != skip.end()) {
+                continue;
+            }
+            if (entry.is_directory(ec)) {
+                CollectTree(index, entry.path(), "data/" + name);
+            } else {
+                AddFile(index, entry, "data/" + name);
+            }
+        }
+        return plan.packages.back().title_id;
+    }
+
+    // Names, icon and control data belong to the base package, or the first one without a base.
+    // Our dumps rarely carry a control folder; when one does, the base's own wins, then updates.
+    void AddApplicationMetadata() {
+        const auto app = static_cast<u32>(std::distance(
+            plan.packages.begin(), std::ranges::find(plan.packages, KindBase, &PlanPackage::kind)));
+        const u32 target = app < plan.packages.size() ? app : 0;
+        std::ranges::stable_sort(loaders, [target](const auto& a, const auto& b) {
+            return (a.first == target) > (b.first == target);
+        });
+
+        auto& tlvs = package_tlvs[target];
+        bool have_control = false;
+        bool have_icon = false;
+        for (const auto& [index, loader] : loaders) {
+            NACP control;
+            if (!have_control &&
+                loader->ReadControlData(control) == Loader::ResultStatus::Success) {
+                have_control = true;
+                tlvs.emplace_back(TlvNacp, control.GetRawBytes());
+                if (const auto name = control.GetApplicationName(); !name.empty()) {
+                    tlvs.emplace_back(TlvTitleName, StringBytes(name));
+                }
+                if (const auto publisher = control.GetDeveloperName(); !publisher.empty()) {
+                    tlvs.emplace_back(TlvPublisher, StringBytes(publisher));
+                }
+            }
+            std::vector<u8> icon;
+            if (!have_icon && loader->ReadIcon(icon) == Loader::ResultStatus::Success &&
+                !icon.empty()) {
+                have_icon = true;
+                tlvs.emplace_back(TlvIcon, std::move(icon));
+            }
+        }
+    }
+
+    bool IsExcluded(const fs::path& path) const {
+        const auto normal = fs::absolute(path).lexically_normal();
+        return std::ranges::find(excluded, normal) != excluded.end();
+    }
+
+    void AddFile(u32 package, const fs::directory_entry& entry, const std::string& path) {
+        std::error_code ec;
+        if (entry.is_symlink(ec)) {
+            throw PackError(PackResult::InvalidSource,
+                            "symlinks are not supported: " + ToUtf8(entry.path()));
+        }
+        if (!entry.is_regular_file(ec)) {
+            throw PackError(PackResult::InvalidSource,
+                            "unsupported file type: " + ToUtf8(entry.path()));
+        }
+        // Dump-tool listings are excluded by the spec.
+        if (entry.path().filename() == ".listing" || IsExcluded(entry.path())) {
+            return;
+        }
+        plan.entries.push_back({package, path, Relative(entry.path()), false});
+    }
+
+    void CollectTree(u32 package, const fs::path& root, const std::string& prefix) {
+        plan.entries.push_back({package, prefix, Relative(root), true});
+        for (auto it = fs::recursive_directory_iterator(root);
+             it != fs::recursive_directory_iterator(); ++it) {
+            const auto& entry = *it;
+            const auto path = prefix + "/" + ToUtf8(fs::relative(entry.path(), root));
+            if (!entry.is_symlink() && entry.is_directory()) {
+                plan.entries.push_back({package, path, Relative(entry.path()), true});
+            } else {
+                AddFile(package, entry, path);
+            }
+        }
+    }
+
+    std::string Relative(const fs::path& path) const {
+        return ToUtf8(fs::relative(path, dump_root));
+    }
+
+    fs::path dump_root;
+    std::vector<fs::path> excluded;
+    RealVfsFilesystem vfs;
+    Plan plan;
+    std::vector<std::vector<std::pair<u16, std::vector<u8>>>> package_tlvs;
+    std::vector<std::pair<u32, std::unique_ptr<Loader::AppLoader_DeconstructedRomDirectory>>>
+        loaders;
+};
+
+Json PlanToJson(const Plan& plan) {
+    Json packages = Json::array();
+    for (const auto& package : plan.packages) {
+        packages.push_back(Json{{"kind", package.kind},
+                                {"flags", package.flags},
+                                {"title_id", package.title_id},
+                                {"version", package.version},
+                                {"meta", ToHex(package.meta)}});
+    }
+    Json entries = Json::array();
+    for (const auto& entry : plan.entries) {
+        entries.push_back(Json{{"package", entry.package},
+                               {"path", entry.path},
+                               {"source", entry.source},
+                               {"directory", entry.directory}});
+    }
+    return Json{{"format", "nup-journal"},
+                {"version", JournalVersion},
+                {"packages", packages},
+                {"entries", entries}};
+}
+
+Plan PlanFromJson(const Json& json) {
+    if (json.at("format") != "nup-journal" || json.at("version") != JournalVersion) {
+        throw PackError(PackResult::IoError, "unsupported journal");
+    }
+    Plan plan;
+    for (const auto& package : json.at("packages")) {
+        plan.packages.push_back({package.at("kind").get<u8>(), package.at("flags").get<u8>(),
+                                 package.at("title_id").get<u64>(),
+                                 package.at("version").get<u32>(),
+                                 FromHex(package.at("meta").get<std::string>())});
+    }
+    for (const auto& entry : json.at("entries")) {
+        plan.entries.push_back({entry.at("package").get<u32>(), entry.at("path").get<std::string>(),
+                                entry.at("source").get<std::string>(),
+                                entry.at("directory").get<bool>()});
+    }
+    return plan;
+}
+
+void RemoveFile(const fs::path& path) {
+    std::error_code ec;
+    fs::remove(path, ec);
+}
+
+bool IsEmptyDirectory(const fs::path& path) {
+    std::error_code ec;
+    return fs::is_directory(path, ec) && fs::is_empty(path, ec) && !ec;
+}
+
+void RemoveEmptyTree(const fs::path& root) {
+    std::error_code ec;
+    std::vector<fs::path> directories;
+    for (auto it = fs::recursive_directory_iterator(root, ec);
+         !ec && it != fs::recursive_directory_iterator(); it.increment(ec)) {
+        if (it->is_directory(ec)) {
+            directories.push_back(it->path());
+        }
+    }
+    for (auto it = directories.rbegin(); it != directories.rend(); ++it) {
+        if (IsEmptyDirectory(*it)) {
+            fs::remove(*it, ec);
+        }
+    }
+    if (IsEmptyDirectory(root)) {
+        fs::remove(root, ec);
+    }
+}
+
+void RemoveEmptyParents(fs::path path, const fs::path& dump_root) {
+    while (!path.empty() && path.has_relative_path()) {
+        std::error_code ec;
+        if (fs::equivalent(path, dump_root, ec) || ec || !IsEmptyDirectory(path)) {
+            break;
+        }
+        fs::remove(path, ec);
+        path = path.parent_path();
+    }
+}
+
+class Packer {
+public:
+    Packer(const fs::path& dump_root_, const fs::path& archive_, const PackOptions& options_,
+           const std::function<void(const PackProgress&)>& progress_,
+           const std::atomic_bool* cancel_)
+        : dump_root{dump_root_}, archive{archive_}, part{WithSuffix(archive_, ".part")},
+          journal{WithSuffix(archive_, ".journal")}, options{options_}, progress_cb{progress_},
+          cancel{cancel_} {}
+
+    PackResult Run() {
+        std::error_code ec;
+        if (fs::exists(archive, ec)) {
+            throw PackError(PackResult::IoError, "archive already exists: " + ToUtf8(archive));
+        }
+        // A journal without a complete plan line was cut short before anything was deleted.
+        const bool resume =
+            options.delete_sources && HasResumableJournal(archive) && LoadJournal();
+        if (resume) {
+            OpenForResume();
+        } else {
+            if (!IsLooseDump(dump_root)) {
+                throw PackError(PackResult::InvalidSource,
+                                "expected exefs/main, exefs/main.npdm and a romfs folder");
+            }
+            std::vector<fs::path> excluded;
+            for (const auto& path : {archive, part, journal}) {
+                excluded.push_back(fs::absolute(path).lexically_normal());
+            }
+            plan = Discovery{dump_root, std::move(excluded)}.Run();
+            layout = BuildLayout(plan);
+            OpenNew();
+        }
+        extents.resize(layout.files.size());
+        done.resize(layout.files.size());
+        for (const auto& [index, extent] : journaled) {
+            extents[index] = extent;
+            done[index] = true;
+            Remember(extent);
+        }
+        CountTotals();
+        Report();
+
+        for (size_t i = 0; i < layout.files.size(); ++i) {
+            if (done[i]) {
+                continue;
+            }
+            PackFile(i);
+            if (options.delete_sources &&
+                (chunk_bytes >= options.chunk_bytes || chunk.size() >= MaxChunkFiles)) {
+                Checkpoint();
+            }
+        }
+        if (options.delete_sources) {
+            Checkpoint();
+        }
+
+        Finish();
+        out.Close();
+        fs::rename(part, archive, ec);
+        if (ec) {
+            throw PackError(PackResult::IoError, "cannot rename archive: " + ec.message());
+        }
+
+        if (options.delete_sources) {
+            RemoveFile(journal);
+            RemoveSourceFolders();
+        }
+        return PackResult::Success;
+    }
+
+    void Abort() {
+        out.Close();
+        if (!options.delete_sources) {
+            RemoveFile(part);
+        }
+    }
+
+private:
+    void OpenNew() {
+        RemoveFile(journal);
+        out.Open(part, Common::FS::FileAccessMode::Write);
+        if (!out.IsOpen()) {
+            throw PackError(PackResult::IoError, "cannot create " + ToUtf8(part));
+        }
+        WriteZeros(layout.blob_offset);
+        cursor = layout.blob_offset;
+        if (options.delete_sources) {
+            AppendJournal(PlanToJson(plan).dump() + '\n');
+        }
+    }
+
+    bool LoadJournal() {
+        const auto contents =
+            Common::FS::ReadStringFromFile(journal, Common::FS::FileType::BinaryFile);
+        size_t start = 0;
+        bool have_plan = false;
+        while (start < contents.size()) {
+            const auto line_end = contents.find('\n', start);
+            if (line_end == std::string::npos) {
+                break;
+            }
+            const auto line = std::string_view{contents}.substr(start, line_end - start);
+            start = line_end + 1;
+            Json json;
+            try {
+                json = Json::parse(line);
+            } catch (const Json::exception&) {
+                // Only the tail can be torn: the journal is synced before sources are deleted.
+                break;
+            }
+            if (!have_plan) {
+                plan = PlanFromJson(json);
+                layout = BuildLayout(plan);
+                resume_end = layout.blob_offset;
+                have_plan = true;
+                continue;
+            }
+            const auto index = json.at("file").get<size_t>();
+            const auto sha = FromHex(json.at("sha256").get<std::string>());
+            if (index >= layout.files.size() || sha.size() != 32) {
+                throw PackError(PackResult::IoError, "malformed journal");
+            }
+            Extent extent{json.at("size").get<u64>(), {}, json.at("offset").get<u64>(),
+                          json.at("stored_size").get<u64>(), json.at("codec").get<u8>()};
+            std::ranges::copy(sha, extent.sha256.begin());
+            resume_end = std::max(resume_end, extent.offset + extent.stored_size);
+            journaled.emplace_back(index, extent);
+        }
+        return have_plan;
+    }
+
+    void OpenForResume() {
+        const u64 end = resume_end;
+        out.Open(part, Common::FS::FileAccessMode::ReadWrite);
+        if (!out.IsOpen()) {
+            throw PackError(PackResult::IoError, "cannot open " + ToUtf8(part));
+        }
+        if (out.GetSize() < end) {
+            throw PackError(PackResult::IoError, "partial archive is shorter than its journal; "
+                                                 "delete " +
+                                                     ToUtf8(part) + " and " + ToUtf8(journal) +
+                                                     " to start over");
+        }
+        if (!out.SetSize(end) || !out.Seek(static_cast<s64>(end))) {
+            throw PackError(PackResult::IoError, "cannot truncate " + ToUtf8(part));
+        }
+        cursor = end;
+
+        // Journaled before an interruption, but the delete never happened.
+        for (const auto& [index, extent] : journaled) {
+            RemoveFile(SourceOf(index));
+        }
+    }
+
+    fs::path SourceOf(size_t file_index) const {
+        return dump_root / FromUtf8(plan.entries[layout.files[file_index].entry].source);
+    }
+
+    void CountTotals() {
+        for (size_t i = 0; i < layout.files.size(); ++i) {
+            ++progress.files_total;
+            if (done[i]) {
+                progress.bytes_total += extents[i].size;
+                progress.bytes_done += extents[i].size;
+                ++progress.files_done;
+            } else {
+                std::error_code ec;
+                const auto size = fs::file_size(SourceOf(i), ec);
+                if (ec) {
+                    throw PackError(PackResult::InvalidSource,
+                                    "missing source file: " + ToUtf8(SourceOf(i)));
+                }
+                progress.bytes_total += size;
+            }
+        }
+    }
+
+    void Remember(const Extent& extent) {
+        if (extent.size == 0) {
+            return;
+        }
+        sizes_seen.insert(extent.size);
+        by_hash.try_emplace(extent.sha256, extent);
+    }
+
+    bool Cancelled() const {
+        return cancel && cancel->load();
+    }
+
+    void WriteZeros(u64 count) {
+        static constexpr std::array<u8, 4096> zeros{};
+        while (count > 0) {
+            const auto n = static_cast<size_t>(std::min<u64>(count, zeros.size()));
+            Write(zeros.data(), n);
+            count -= n;
+        }
+    }
+
+    void Write(const u8* data, size_t size) {
+        if (out.WriteSpan(std::span<const u8>{data, size}) != size) {
+            throw PackError(PackResult::IoError, "write failed, the disk may be full");
+        }
+    }
+
+    void AddProgress(u64 bytes) {
+        progress.bytes_done += bytes;
+        if (progress.bytes_done - last_report >= ProgressStep) {
+            Report();
+        }
+    }
+
+    // Reads the whole source through `sink`, checking that it still has the expected size. A file
+    // read more than once (hashed for dedup, or compressed and then stored raw) counts once.
+    template <typename Sink>
+    void ReadSource(Common::FS::IOFile& in, u64 size, Sink&& sink) {
+        if (!in.Seek(0)) {
+            throw PackError(PackResult::IoError, "cannot seek source");
+        }
+        buffer.resize(ReadBufferSize);
+        u64 total = 0;
+        while (true) {
+            if (Cancelled()) {
+                throw PackError(PackResult::Cancelled, "cancelled");
+            }
+            const auto read = in.ReadSpan(std::span{buffer});
+            if (read == 0) {
+                break;
+            }
+            total += read;
+            if (total > size) {
+                break;
+            }
+            if (total > file_counted) {
+                AddProgress(total - file_counted);
+                file_counted = total;
+            }
+            if (!sink(buffer.data(), read)) {
+                return;
+            }
+        }
+        if (total != size) {
+            throw PackError(PackResult::IoError, "a source file changed while packing");
+        }
+    }
+
+    Digest HashSource(Common::FS::IOFile& in, u64 size) {
+        hash.Reset();
+        ReadSource(in, size, [this](const u8* data, size_t n) {
+            hash.Update(data, n);
+            return true;
+        });
+        return hash.Final();
+    }
+
+    ZstdContext& Compressor() {
+        if (!compressor) {
+            compressor = std::make_unique<ZstdContext>(options.zstd_level);
+        }
+        return *compressor;
+    }
+
+    // Streams one zstd frame into the archive. Gives up (returns false) as soon as the output is
+    // no smaller than the input.
+    bool WriteCompressed(Common::FS::IOFile& in, u64 size, u64& stored) {
+        auto& zstd = Compressor();
+        zstd.Begin(size);
+        out_buffer.resize(ZSTD_CStreamOutSize());
+        stored = 0;
+        bool fits = true;
+        const auto drain = [&](ZSTD_inBuffer& input, ZSTD_EndDirective mode) {
+            while (true) {
+                ZSTD_outBuffer output{out_buffer.data(), out_buffer.size(), 0};
+                const size_t remaining = ZSTD_compressStream2(zstd.get(), &output, &input, mode);
+                if (ZSTD_isError(remaining)) {
+                    throw PackError(PackResult::IoError,
+                                    std::string{"zstd: "} + ZSTD_getErrorName(remaining));
+                }
+                stored += output.pos;
+                if (stored >= size) {
+                    return false;
+                }
+                Write(out_buffer.data(), output.pos);
+                const bool finished = mode == ZSTD_e_end ? remaining == 0
+                                                         : input.pos == input.size;
+                if (finished) {
+                    return true;
+                }
+            }
+        };
+        hash.Reset();
+        ReadSource(in, size, [&](const u8* data, size_t n) {
+            hash.Update(data, n);
+            ZSTD_inBuffer input{data, n, 0};
+            fits = drain(input, ZSTD_e_continue);
+            return fits;
+        });
+        if (!fits) {
+            return false;
+        }
+        ZSTD_inBuffer empty{nullptr, 0, 0};
+        return drain(empty, ZSTD_e_end);
+    }
+
+    void PackFile(size_t index) {
+        const auto source = SourceOf(index);
+        Common::FS::IOFile in{source, Common::FS::FileAccessMode::Read};
+        if (!in.IsOpen()) {
+            throw PackError(PackResult::IoError, "cannot read " + ToUtf8(source));
+        }
+        Extent extent;
+        extent.size = in.GetSize();
+        file_counted = 0;
+
+        std::optional<Digest> known_hash;
+        if (extent.size == 0) {
+            known_hash = HashSource(in, 0);
+        } else if (sizes_seen.contains(extent.size)) {
+            // Only a file whose size matches an earlier extent can be a duplicate; hash it before
+            // writing anything so the shared extent costs no output.
+            known_hash = HashSource(in, extent.size);
+            if (const auto it = by_hash.find(*known_hash);
+                it != by_hash.end() && it->second.size == extent.size) {
+                extent = it->second;
+                Complete(index, extent);
+                return;
+            }
+        }
+
+        if (extent.size == 0) {
+            extent.sha256 = *known_hash;
+            Complete(index, extent);
+            return;
+        }
+
+        const u64 start = AlignUp(cursor, ExtentAlignment);
+        Seek(cursor);
+        WriteZeros(start - cursor);
+        extent.offset = start;
+
+        bool compressed = false;
+        if (extent.size <= options.raw_threshold && options.zstd_level > 0) {
+            u64 stored = 0;
+            compressed = WriteCompressed(in, extent.size, stored);
+            if (compressed) {
+                extent.codec = CodecZstd;
+                extent.stored_size = stored;
+                extent.sha256 = hash.Final();
+            }
+        }
+        if (!compressed) {
+            Seek(start);
+            hash.Reset();
+            ReadSource(in, extent.size, [this](const u8* data, size_t n) {
+                hash.Update(data, n);
+                Write(data, n);
+                return true;
+            });
+            extent.codec = CodecRaw;
+            extent.stored_size = extent.size;
+            extent.sha256 = hash.Final();
+        }
+        cursor = start + extent.stored_size;
+        Remember(extent);
+        Complete(index, extent);
+    }
+
+    void Seek(u64 offset) {
+        if (!out.Seek(static_cast<s64>(offset))) {
+            throw PackError(PackResult::IoError, "cannot seek " + ToUtf8(part));
+        }
+    }
+
+    void Complete(size_t index, const Extent& extent) {
+        extents[index] = extent;
+        done[index] = true;
+        if (options.delete_sources) {
+            chunk.push_back(index);
+            chunk_bytes += extent.size;
+        }
+        ++progress.files_done;
+        Report();
+    }
+
+    void AppendJournal(const std::string& lines) {
+        Common::FS::IOFile log{journal, Common::FS::FileAccessMode::Append};
+        if (!log.IsOpen() || log.WriteString(lines) != lines.size() || !log.Commit()) {
+            throw PackError(PackResult::IoError, "cannot write " + ToUtf8(journal));
+        }
+    }
+
+    // Archive data first, then the journal, then the deletes, so an interruption loses nothing.
+    void Checkpoint() {
+        if (chunk.empty()) {
+            return;
+        }
+        if (!out.Commit()) {
+            throw PackError(PackResult::IoError, "cannot sync " + ToUtf8(part));
+        }
+        std::string lines;
+        for (const auto index : chunk) {
+            const auto& extent = extents[index];
+            lines += Json{{"file", index},
+                          {"size", extent.size},
+                          {"sha256", ToHex(extent.sha256)},
+                          {"offset", extent.offset},
+                          {"stored_size", extent.stored_size},
+                          {"codec", extent.codec}}
+                         .dump();
+            lines += '\n';
+        }
+        AppendJournal(lines);
+        for (const auto index : chunk) {
+            RemoveFile(SourceOf(index));
+        }
+        chunk.clear();
+        chunk_bytes = 0;
+    }
+
+    void Finish() {
+        // Meta blocks follow the last extent, as pack.py writes them.
+        Seek(cursor);
+        std::vector<std::pair<u64, u32>> meta;
+        for (const auto& package : plan.packages) {
+            if (package.meta.size() > std::numeric_limits<u32>::max()) {
+                throw PackError(PackResult::IoError, "package metadata is too large");
+            }
+            meta.emplace_back(package.meta.empty() ? 0 : cursor,
+                              static_cast<u32>(package.meta.size()));
+            Write(package.meta.data(), package.meta.size());
+            cursor += package.meta.size();
+        }
+        const u64 file_size = cursor;
+
+        const auto toc = BuildToc(meta);
+        std::array<u8, 32> toc_hash{};
+        unsigned int hash_length{};
+        EVP_Digest(toc.data(), toc.size(), toc_hash.data(), &hash_length, EVP_sha256(), nullptr);
+
+        // UUID: SHA-256 over title_id (u64), version (u32) and kind (u8) of each package.
+        Sha256 uuid_hash;
+        for (const auto& package : plan.packages) {
+            std::vector<u8> identity(13);
+            PutLE(identity, 0, package.title_id, 8);
+            PutLE(identity, 8, package.version, 4);
+            identity[12] = package.kind;
+            uuid_hash.Update(identity.data(), identity.size());
+        }
+        const auto uuid = uuid_hash.Final();
+
+        std::vector<u8> super(SuperblockSize);
+        PutBytes(super, 0x00, Magic);
+        PutLE(super, 0x04, SuperblockSize, 2);
+        PutLE(super, 0x06, 1, 2);
+        PutLE(super, 0x08, SuperblockSize, 8);
+        PutLE(super, 0x10, toc.size(), 8);
+        PutBytes(super, 0x18, toc_hash);
+        PutLE(super, 0x38, layout.blob_offset, 8);
+        PutLE(super, 0x40, file_size, 8);
+        PutLE(super, 0x48, plan.packages.size(), 4);
+        PutBytes(super, 0x50, std::span{uuid}.first(16));
+
+        Seek(0);
+        Write(super.data(), super.size());
+        Write(toc.data(), toc.size());
+        if (!out.SetSize(file_size) || !out.Commit()) {
+            throw PackError(PackResult::IoError, "cannot finish " + ToUtf8(part));
+        }
+    }
+
+    // Every field is written little-endian at its documented offset. The package record is
+    // 0x40 bytes with 20 reserved bytes at 0x2C, as NupContainer reads it.
+    std::vector<u8> BuildToc(const std::vector<std::pair<u64, u32>>& meta) const {
+        std::vector<u8> toc(layout.toc_size);
+        const u64 dir_count = layout.dirs.size();
+        PutBytes(toc, 0x00, TocMagic);
+        PutLE(toc, 0x04, plan.packages.size(), 4);
+        PutLE(toc, 0x08, dir_count, 8);
+        PutLE(toc, 0x10, layout.files.size(), 8);
+
+        size_t pos = TocHeaderSize;
+        for (size_t i = 0; i < plan.packages.size(); ++i) {
+            const auto& package = plan.packages[i];
+            const auto& record = layout.packages[i];
+            PutLE(toc, pos + 0x00, package.title_id, 8);
+            PutLE(toc, pos + 0x08, record.root_dir, 4);
+            PutLE(toc, pos + 0x0C, record.exefs_dir, 4);
+            PutLE(toc, pos + 0x10, record.romfs_dir, 4);
+            PutLE(toc, pos + 0x14, package.version, 4);
+            toc[pos + 0x18] = package.kind;
+            toc[pos + 0x19] = package.flags;
+            PutLE(toc, pos + 0x20, meta[i].first, 8);
+            PutLE(toc, pos + 0x28, meta[i].second, 4);
+            pos += PackageRecordSize;
+        }
+        for (const auto& dir : layout.dirs) {
+            PutLE(toc, pos + 0x00, layout.pool_index.at(dir.name), 4);
+            PutLE(toc, pos + 0x04, dir.name.size(), 4);
+            PutLE(toc, pos + 0x08, dir.first_child, 4);
+            PutLE(toc, pos + 0x0C, dir.child_count, 4);
+            pos += DirRecordSize;
+        }
+        for (size_t i = 0; i < layout.files.size(); ++i) {
+            const auto& file = layout.files[i];
+            const auto& extent = extents[i];
+            PutLE(toc, pos + 0x00, layout.pool_index.at(file.name), 4);
+            PutLE(toc, pos + 0x04, file.name.size(), 4);
+            PutLE(toc, pos + 0x08, extent.size, 8);
+            // Empty files have no extent: offset, size and codec are all zero.
+            if (extent.size != 0) {
+                PutLE(toc, pos + 0x10, extent.offset, 8);
+                PutLE(toc, pos + 0x18, extent.stored_size, 8);
+                toc[pos + 0x40] = extent.codec;
+            }
+            PutBytes(toc, pos + 0x20, extent.sha256);
+            pos += FileRecordSize;
+        }
+        for (const u64 child : layout.children) {
+            const u64 id = (child & Layout::FileTag) ? dir_count + static_cast<u32>(child) : child;
+            PutLE(toc, pos, id, 4);
+            pos += sizeof(u32);
+        }
+        PutLE(toc, 0x18, pos, 8);
+        PutLE(toc, 0x20, layout.pool.size(), 8);
+        std::memcpy(toc.data() + pos, layout.pool.data(), layout.pool.size());
+        return toc;
+    }
+
+    void RemoveSourceFolders() {
+        for (const auto& entry : plan.entries) {
+            const auto depth = std::ranges::count(entry.path, '/');
+            const bool top = entry.directory &&
+                             (depth == 0 || (depth == 1 && entry.path.starts_with("data/")));
+            if (top) {
+                const auto source = dump_root / FromUtf8(entry.source);
+                RemoveEmptyTree(source);
+                RemoveEmptyParents(source.parent_path(), dump_root);
+            }
+        }
+    }
+
+    void Report() {
+        last_report = progress.bytes_done;
+        if (progress_cb) {
+            progress_cb(progress);
+        }
+    }
+
+    fs::path dump_root;
+    fs::path archive;
+    fs::path part;
+    fs::path journal;
+    PackOptions options;
+    std::function<void(const PackProgress&)> progress_cb;
+    const std::atomic_bool* cancel;
+
+    Plan plan;
+    Layout layout;
+    std::vector<Extent> extents;
+    std::vector<bool> done;
+    std::vector<std::pair<size_t, Extent>> journaled;
+
+    struct DigestHash {
+        size_t operator()(const Digest& digest) const {
+            size_t value;
+            std::memcpy(&value, digest.data(), sizeof(value));
+            return value;
+        }
+    };
+    std::unordered_map<Digest, Extent, DigestHash> by_hash;
+    std::unordered_set<u64> sizes_seen;
+
+    Common::FS::IOFile out;
+    u64 cursor = 0;
+    u64 resume_end = 0;
+    std::vector<size_t> chunk;
+    u64 chunk_bytes = 0;
+    std::vector<u8> buffer;
+    std::vector<u8> out_buffer;
+    Sha256 hash;
+    std::unique_ptr<ZstdContext> compressor;
+    PackProgress progress{};
+    u64 last_report = 0;
+    u64 file_counted = 0;
+};
+
+} // namespace
+
+bool IsLooseDump(const fs::path& dir) {
+    return HasBootableExeFS(dir);
+}
+
+std::optional<fs::path> DumpRootFromMain(const fs::path& main) {
+    // The Qt game list stores the exefs folder rather than exefs/main.
+    std::error_code ec;
+    const auto exefs = fs::is_directory(main, ec) ? main : main.parent_path();
+    if (Lower(ToUtf8(exefs.filename())) != "exefs") {
+        return std::nullopt;
+    }
+    auto root = exefs.parent_path();
+    const auto name = Lower(ToUtf8(root.filename()));
+    if (name == "base") {
+        root = root.parent_path();
+    } else if (ParseDecimal(name) && Lower(ToUtf8(root.parent_path().filename())) == "updates") {
+        root = root.parent_path().parent_path();
+    }
+    if (!IsLooseDump(root)) {
+        return std::nullopt;
+    }
+    return root;
+}
+
+fs::path DefaultArchivePath(const fs::path& dump_root) {
+    auto root = dump_root;
+    if (!root.has_filename()) {
+        root = root.parent_path();
+    }
+    return root.parent_path() / (root.filename().u8string() + u8".nup");
+}
+
+bool HasResumableJournal(const fs::path& archive) {
+    std::error_code ec;
+    return fs::exists(WithSuffix(archive, ".part"), ec) &&
+           fs::exists(WithSuffix(archive, ".journal"), ec);
+}
+
+PackResult PackDump(const fs::path& dump_root, const fs::path& archive, const PackOptions& options,
+                    const std::function<void(const PackProgress&)>& progress,
+                    const std::atomic_bool* cancel, std::string* error_out) {
+    Packer packer{dump_root, archive, options, progress, cancel};
+    try {
+        return packer.Run();
+    } catch (const PackError& e) {
+        packer.Abort();
+        if (error_out) {
+            *error_out = e.what();
+        }
+        return e.result;
+    } catch (const std::exception& e) {
+        packer.Abort();
+        if (error_out) {
+            *error_out = e.what();
+        }
+        return PackResult::IoError;
+    }
+}
+
+} // namespace FileSys::Nup
diff --git a/src/core/file_sys/nup_writer.h b/src/core/file_sys/nup_writer.h
new file mode 100644
index 0000000000..231387b156
--- /dev/null
+++ b/src/core/file_sys/nup_writer.h
@@ -0,0 +1,60 @@
+// SPDX-FileCopyrightText: Copyright 2026 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#pragma once
+
+#include <atomic>
+#include <filesystem>
+#include <functional>
+#include <optional>
+#include <string>
+
+#include "common/common_types.h"
+
+// Packs a loose dump into a NUP container. Every package is kept: base/, each
+// updates/<version>/ and each dlc/<titleid>/<n>/.
+namespace FileSys::Nup {
+
+struct PackProgress {
+    u64 bytes_done{};
+    u64 bytes_total{};
+    u64 files_done{};
+    u64 files_total{};
+};
+
+enum class PackResult { Success, Cancelled, InvalidSource, IoError };
+
+// NupContainer keeps a zstd file in memory only while it fits its 512 MiB decompression cache;
+// a larger one is decompressed again in full on every read, which makes big compressed RomFS
+// files unusable. Files above this size are therefore stored raw, with headroom below the cap so
+// that one file does not evict everything else from the cache.
+constexpr u64 DefaultRawThreshold = 256ULL * 1024 * 1024;
+
+struct PackOptions {
+    // Low-storage mode: delete each source file once its extent is synced and journaled.
+    bool delete_sources = false;
+    u64 chunk_bytes = 256ULL * 1024 * 1024;
+    int zstd_level = 3;
+    // Files larger than this are always stored raw.
+    u64 raw_threshold = DefaultRawThreshold;
+};
+
+// A loose dump holds exefs/main and main.npdm, directly or under base/ or updates/<version>/,
+// and a romfs folder. Folder names are matched case-insensitively.
+bool IsLooseDump(const std::filesystem::path& dir);
+// The dump folder a game list entry's exefs/main (or exefs folder) belongs to, if it is a loose
+// dump.
+std::optional<std::filesystem::path> DumpRootFromMain(const std::filesystem::path& main);
+std::filesystem::path DefaultArchivePath(const std::filesystem::path& dump_root);
+
+// Writes <archive>.part and renames it when done; an existing archive is never overwritten. A
+// cancelled or failed low-storage run keeps its .part and .journal, and calling this again with
+// the same arguments resumes it.
+PackResult PackDump(const std::filesystem::path& dump_root, const std::filesystem::path& archive,
+                    const PackOptions& options = {},
+                    const std::function<void(const PackProgress&)>& progress = {},
+                    const std::atomic_bool* cancel = nullptr, std::string* error_out = nullptr);
+
+bool HasResumableJournal(const std::filesystem::path& archive);
+
+} // namespace FileSys::Nup
diff --git a/src/core/hle/service/am/frontend/applet_software_keyboard.cpp b/src/core/hle/service/am/frontend/applet_software_keyboard.cpp
index db42781e18..061394bff8 100644
--- a/src/core/hle/service/am/frontend/applet_software_keyboard.cpp
+++ b/src/core/hle/service/am/frontend/applet_software_keyboard.cpp
@@ -222,6 +222,14 @@ void SoftwareKeyboard::InitializeForeground() {
                     sizeof(SwkbdConfigNew));
         swkbd_config_common.use_utf8 = true;
         break;
+    case SwkbdAppletVersion::Version1441810: {
+        // Fire Emblem: Fortune's Weave asks for UTF-8 and keeps the reply up to the first NUL, so the
+        // Switch 1 layout's use_utf8 (a byte of the native initial_string_offset) left one letter.
+        const bool decoded =
+            DecodeNativeSwkbdConfig(swkbd_config_data, swkbd_config_common, swkbd_config_new);
+        ASSERT(decoded);
+        break;
+    }
     default:
         UNIMPLEMENTED_MSG("Unknown SwkbdConfig revision={} with size={}", swkbd_applet_version,
                           swkbd_config_data.size());
diff --git a/src/core/hle/service/am/frontend/applet_software_keyboard_types.h b/src/core/hle/service/am/frontend/applet_software_keyboard_types.h
index f263a704cd..8ff8391aa1 100644
--- a/src/core/hle/service/am/frontend/applet_software_keyboard_types.h
+++ b/src/core/hle/service/am/frontend/applet_software_keyboard_types.h
@@ -7,6 +7,9 @@
 #pragma once
 
 #include <array>
+#include <cstddef>
+#include <cstring>
+#include <span>
 
 #include "common/bit_field.h"
 #include "common/common_funcs.h"
@@ -31,6 +34,7 @@ enum class SwkbdAppletVersion : u32_le {
     Version393227 = 0x6000B, // 6.0.0 - 7.0.1
     Version524301 = 0x8000D, // 8.0.0+
     Version1310736 = 0x140010, // Switch 2 (Pokemon Pokopia): 0x530-byte config, UTF-8 text
+    Version1441810 = 0x160012, // Switch 2 (Fire Emblem: Fortune's Weave): native 0x530-byte config
 };
 
 enum class SwkbdType : u32 {
@@ -184,8 +188,64 @@ struct SwkbdConfigNew {
 };
 static_assert(sizeof(SwkbdConfigNew) == 0x4C8 - sizeof(SwkbdConfigCommon),
               "SwkbdConfigNew has incorrect size.");
+
+// SwkbdAppletVersion 0x160012: the text prefix of the common part keeps its layout, the flags,
+// lengths, string offsets and dictionary fields move (checked against
+// nn::swkbd::keyboardConfig2kbdConfig in Fire Emblem: Fortune's Weave's sdk).
+struct SwkbdConfigNative {
+    std::array<u8, 0x3AA> common_prefix{};
+    bool use_utf8{};
+    bool use_blur_background{};
+    u32 max_text_length{};
+    u32 min_text_length{};
+    SwkbdPasswordMode password_mode{};
+    SwkbdTextDrawType text_draw_type{};
+    u32 initial_string_offset{};
+    u32 initial_string_length{};
+    u32 user_dictionary_offset{};
+    u32 user_dictionary_entries{};
+    std::array<u64, 24> customized_dictionary_set_entries{};
+    u8 total_customized_dictionary_set_entries{};
+    bool use_text_check{};
+    bool disable_cancel_button{};
+    u8 trigger{};
+    std::array<u32, 8> text_grouping{};
+    INSERT_PADDING_BYTES(0x80);
+};
+static_assert(sizeof(SwkbdConfigNative) == 0x530);
+static_assert(offsetof(SwkbdConfigNative, use_text_check) == 0x48D);
+static_assert(offsetof(SwkbdConfigNative, text_grouping) == 0x490);
 #pragma pack(pop)
 
+inline bool DecodeNativeSwkbdConfig(std::span<const u8> data, SwkbdConfigCommon& common,
+                                    SwkbdConfigNew& config) {
+    if (data.size() != sizeof(SwkbdConfigNative)) {
+        return false;
+    }
+    SwkbdConfigNative native{};
+    std::memcpy(&native, data.data(), sizeof(native));
+    common = {};
+    config = {};
+    std::memcpy(static_cast<void*>(&common), native.common_prefix.data(), native.common_prefix.size());
+    common.enable_return_button = native.common_prefix[0x1B] != 0;
+    common.use_utf8 = native.use_utf8;
+    common.use_blur_background = native.use_blur_background;
+    common.max_text_length = native.max_text_length;
+    common.min_text_length = native.min_text_length;
+    common.password_mode = native.password_mode;
+    common.text_draw_type = native.text_draw_type;
+    common.initial_string_offset = native.initial_string_offset;
+    common.initial_string_length = native.initial_string_length;
+    common.user_dictionary_offset = native.user_dictionary_offset;
+    common.user_dictionary_entries = native.user_dictionary_entries;
+    common.use_text_check = native.use_text_check;
+    config.text_grouping = native.text_grouping;
+    config.customized_dictionary_set_entries = native.customized_dictionary_set_entries;
+    config.total_customized_dictionary_set_entries = native.total_customized_dictionary_set_entries;
+    config.disable_cancel_button = native.disable_cancel_button;
+    return true;
+}
+
 struct SwkbdTextCheck {
     SwkbdTextCheckResult text_check_result{};
     std::array<char16_t, STRING_BUFFER_SIZE / 2> text_check_message{};
diff --git a/src/core/hle/service/nvdrv/core/container.cpp b/src/core/hle/service/nvdrv/core/container.cpp
index 9edce03f64..22db243e3f 100644
--- a/src/core/hle/service/nvdrv/core/container.cpp
+++ b/src/core/hle/service/nvdrv/core/container.cpp
@@ -11,6 +11,7 @@
 #include "core/hle/service/nvdrv/core/heap_mapper.h"
 #include "core/hle/service/nvdrv/core/nvmap.h"
 #include "core/hle/service/nvdrv/core/syncpoint_manager.h"
+#include "core/hle/service/nvdrv/devices/nx2_stub_device.h"
 #include "core/memory.h"
 #include "video_core/host1x/host1x.h"
 
@@ -130,6 +131,7 @@ void Container::CloseSession(SessionId session_id) {
         session.has_preallocated_area = false;
     }
     session.is_active = false;
+    Devices::Nx2GpuMemoryRegistry::Get().ForgetDeviceRanges(session.asid.id);
     smmu.UnregisterProcess(impl->sessions[session_id.id].asid);
     impl->id_pool.emplace_front(session_id.id);
 }
diff --git a/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.cpp b/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.cpp
index 86b5ed0677..40313a10fb 100644
--- a/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.cpp
+++ b/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.cpp
@@ -5,6 +5,7 @@
 // SPDX-FileCopyrightText: 2021 Skyline Team and Contributors
 // SPDX-License-Identifier: GPL-3.0-or-later
 
+#include <cstdlib>
 #include <cstring>
 #include <utility>
 
@@ -35,6 +36,13 @@ nvhost_as_gpu::nvhost_as_gpu(Core::System& system_, Module& module_, NvCore::Con
 
 nvhost_as_gpu::~nvhost_as_gpu() {
     Nx2GpuMemoryRegistry::Get().RemoveListener(this);
+    // Leave shared ranges to the process's other address spaces; like this address space's own
+    // ranges, one nobody else maps stays allocated.
+    for (const auto& [key, range] : nx2_device_ranges) {
+        if (range.shared) {
+            Nx2GpuMemoryRegistry::Get().ReleaseDeviceRange(range.asid, key.first, key.second);
+        }
+    }
 }
 
 NvResult nvhost_as_gpu::Ioctl1(DeviceFD fd, Ioctl command, std::span<const u8> input,
@@ -134,25 +142,37 @@ void nvhost_as_gpu::Nx2Map(u64 gpu_address, u64 cpu_address, u64 size) {
     }
     // The same CPU range is often mapped twice (at its own address and in a sparse region), so
     // reuse its SMMU mapping.
-    DAddr device_address{};
-    bool heap = false;
+    Nx2DeviceRange range{};
     if (const auto it = nx2_device_ranges.find({cpu_address, size}); it != nx2_device_ranges.end()) {
-        device_address = it->second.address;
-        heap = it->second.heap;
+        range = it->second;
     } else if (session->has_preallocated_area && session->mapper->IsInBounds(cpu_address, size)) {
-        device_address = session->mapper->Map(cpu_address, size);
-        heap = true;
+        range = {session->mapper->Map(cpu_address, size), true};
     } else {
-        auto& smmu = system.Host1x().MemoryManager();
-        device_address = smmu.Allocate(Common::AlignUp(size, 0x20000));
-        if (device_address == 0) {
+        const auto allocate = [&]() -> u64 {
+            auto& smmu = system.Host1x().MemoryManager();
+            const DAddr address = smmu.Allocate(Common::AlignUp(size, 0x20000));
+            if (address != 0) {
+                smmu.Map(address, cpu_address, size, session->asid, true);
+            }
+            return address;
+        };
+        // EDEN_NX2_PRIVATE_DEVICE_RANGES=1 (A/B aid): a range per address space.
+        static const bool private_ranges = std::getenv("EDEN_NX2_PRIVATE_DEVICE_RANGES") != nullptr;
+        if (private_ranges) {
+            range = {allocate(), false};
+        } else {
+            range = {Nx2GpuMemoryRegistry::Get().AcquireDeviceRange(session->asid.id, cpu_address,
+                                                                    size, allocate),
+                     false, true, session->asid.id};
+        }
+        if (range.address == 0) {
             LOG_CRITICAL(Service_NVDRV, "Switch 2 GPU memory {:#x}+{:#x}: out of SMMU space",
                          cpu_address, size);
             return;
         }
-        smmu.Map(device_address, cpu_address, size, session->asid, true);
     }
-    nx2_device_ranges[{cpu_address, size}] = {device_address, heap};
+    const DAddr device_address = range.address;
+    nx2_device_ranges[{cpu_address, size}] = range;
     Nx2GpuMemoryRegistry::Get().RecordDeviceRange(cpu_address, size, device_address);
     // On the GPU thread, like unmaps: a GMMU map takes the texture cache lock, and the callers hold
     // nx2:gpu locks that the GPU thread takes under that lock (sparse blocks backed on write).
@@ -181,6 +201,10 @@ void nvhost_as_gpu::Nx2Release(u64 cpu_address, u64 size) {
     }
     const Nx2DeviceRange range = it->second;
     nx2_device_ranges.erase(it);
+    if (range.shared &&
+        !Nx2GpuMemoryRegistry::Get().ReleaseDeviceRange(range.asid, cpu_address, size)) {
+        return; // another address space of the process still maps it
+    }
     auto* session = container.GetSession(nx2_session);
     auto* const mapper = range.heap && session != nullptr ? session->mapper.get() : nullptr;
     auto& smmu = system.Host1x().MemoryManager();
diff --git a/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.h b/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.h
index 39b63ea369..37b6d0d4c4 100644
--- a/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.h
+++ b/src/core/hle/service/nvdrv/devices/nvhost_as_gpu.h
@@ -238,6 +238,8 @@ private:
     struct Nx2DeviceRange {
         DAddr address;
         bool heap; ///< Mapped through the session's heap mapper (else an SMMU allocation)
+        bool shared{}; ///< A reference to the process's range in Nx2GpuMemoryRegistry
+        size_t asid{};
     };
     std::map<std::pair<u64, u64>, Nx2DeviceRange> nx2_device_ranges;
     void Nx2Release(u64 cpu_address, u64 size);
diff --git a/src/core/hle/service/nvdrv/devices/nvhost_ctrl_gpu.cpp b/src/core/hle/service/nvdrv/devices/nvhost_ctrl_gpu.cpp
index 69c0313228..93d51cd538 100644
--- a/src/core/hle/service/nvdrv/devices/nvhost_ctrl_gpu.cpp
+++ b/src/core/hle/service/nvdrv/devices/nvhost_ctrl_gpu.cpp
@@ -113,12 +113,22 @@ NvResult nvhost_ctrl_gpu::Ioctl3(DeviceFD fd, Ioctl command, std::span<const u8>
         case 0x6:
             return WrapFixedInlOut(this, &nvhost_ctrl_gpu::GetTPCMasks3, input, output,
                                    inline_output);
-        case 0x13:
-            LOG_DEBUG(Service_NVDRV, "(STUBBED) called.");
-
-            // TODO (jarrodnorwell)
-
-            return NvResult::NotImplemented;
+        case 0x13: {
+            // NVGPU_GPU_IOCTL_VSMS_MAPPING: an 8-byte argument struct plus a buffer of
+            // {gpc_index, tpc_index} byte pairs, one per virtual SM. The SDK treats a pair left at
+            // its 0xc0c0 sentinel as failure, so fill every pair: one GPC, two SMs per TPC.
+            if (command.raw != 0xc0084713 || input.size() != 8 || output.size() != 8 ||
+                inline_output.size() < 2) {
+                return NvResult::BadParameter;
+            }
+            std::memcpy(output.data(), input.data(), output.size());
+            for (size_t i = 0; i + 1 < inline_output.size(); i += 2) {
+                inline_output[i] = 0;                         // gpc_index
+                inline_output[i + 1] = static_cast<u8>(i / 4); // tpc_index
+            }
+            LOG_DEBUG(Service_NVDRV, "VSMS mapping for {} SMs", inline_output.size() / 2);
+            return NvResult::Success;
+        }
         default:
             break;
         }
@@ -218,9 +228,10 @@ void ApplyNx2Characteristics(GC& gc) {
     if (remap) {
         gc.flags |= 1ULL << 35;
     }
-    // Engine support bits 40-44 (2D, 3D, compute, inline-to-memory, ZBC). NvRm's newer device
-    // path lists a class family in the device info only when its bit is set; without them a
-    // device opened that way has no compute class and Fire Emblem's CUDA driver reports no device.
+    // Engine support bits 40-44 (2D, 3D, compute, inline-to-memory, ZBC). The SDK filters its class
+    // enumeration by them, and NvRm's newer device path lists a class family in the device info
+    // only when its bit is set; without them Fire Emblem: Fortune's Weave aborts at boot and a
+    // device opened that way has no compute class (Fire Emblem's CUDA driver reports no device).
     gc.flags |= 0x1FULL << 40;
 
     // The Switch 2 layout keeps nine s16 interface versions at 0x70..0x80 (like nvgpu's
diff --git a/src/core/hle/service/nvdrv/devices/nx2_stub_device.h b/src/core/hle/service/nvdrv/devices/nx2_stub_device.h
index 869e17caf6..8dee9ccfb7 100644
--- a/src/core/hle/service/nvdrv/devices/nx2_stub_device.h
+++ b/src/core/hle/service/nvdrv/devices/nx2_stub_device.h
@@ -5,6 +5,7 @@
 
 #include <algorithm>
 #include <atomic>
+#include <compare>
 #include <functional>
 #include <map>
 #include <mutex>
@@ -166,12 +167,50 @@ public:
         {
             std::scoped_lock lk{device_mutex};
             device_ranges.clear();
+            shared_ranges.clear();
         }
         std::scoped_lock lk{mutex};
         mappings.clear();
         sparse_regions.clear();
     }
 
+    // Device (SMMU) range of a mapping outside the heap, shared by every address space of one
+    // process: the caches key memory by device address, so a range per address space made separate
+    // copies of the same memory, and presentation could read one the game never drew into. The
+    // first address space to map the range allocates it with `allocate` (0: out of space); every
+    // call takes a reference.
+    u64 AcquireDeviceRange(size_t asid, u64 cpu_address, u64 size,
+                           const std::function<u64()>& allocate) {
+        std::scoped_lock lk{device_mutex};
+        const SharedRangeKey key{asid, cpu_address, size};
+        if (const auto it = shared_ranges.find(key); it != shared_ranges.end()) {
+            ++it->second.references;
+            return it->second.device_address;
+        }
+        const u64 device_address = allocate();
+        if (device_address != 0) {
+            shared_ranges.emplace(key, SharedRange{device_address, 1});
+        }
+        return device_address;
+    }
+
+    // Drops a reference. True for the last one: the caller frees the range.
+    bool ReleaseDeviceRange(size_t asid, u64 cpu_address, u64 size) {
+        std::scoped_lock lk{device_mutex};
+        const auto it = shared_ranges.find(SharedRangeKey{asid, cpu_address, size});
+        if (it == shared_ranges.end() || --it->second.references != 0) {
+            return false;
+        }
+        shared_ranges.erase(it);
+        return true;
+    }
+
+    // The process's session closed and its ASID can be reused: stop sharing its ranges.
+    void ForgetDeviceRanges(size_t asid) {
+        std::scoped_lock lk{device_mutex};
+        std::erase_if(shared_ranges, [asid](const auto& entry) { return entry.first.asid == asid; });
+    }
+
     // Device (SMMU) address of a CPU range an address space mapped; used to present images.
     void RecordDeviceRange(u64 cpu_address, u64 size, u64 device_address) {
         std::scoped_lock lk{device_mutex};
@@ -197,6 +236,18 @@ private:
     std::mutex device_mutex;
     std::map<u64, std::pair<u64, u64>> device_ranges; // cpu start -> (size, device address)
 
+    struct SharedRangeKey {
+        size_t asid;
+        u64 cpu_address;
+        u64 size;
+        auto operator<=>(const SharedRangeKey&) const = default;
+    };
+    struct SharedRange {
+        u64 device_address;
+        u32 references;
+    };
+    std::map<SharedRangeKey, SharedRange> shared_ranges;
+
     struct Mapping {
         u64 gpu_address;
         u64 cpu_address;
diff --git a/src/core/hle/service/nvnflinger/pixel_format.h b/src/core/hle/service/nvnflinger/pixel_format.h
index b6e8b5f8a0..a38c8be777 100644
--- a/src/core/hle/service/nvnflinger/pixel_format.h
+++ b/src/core/hle/service/nvnflinger/pixel_format.h
@@ -19,6 +19,7 @@ enum class PixelFormat : u32 {
     Bgra8888 = 5,
     Rgba5551 = 6,
     Rgba4444 = 7,
+    Rgba1010102 = 43,
 };
 
 } // namespace Service::android
diff --git a/src/core/hle/service/nx2_gsv.h b/src/core/hle/service/nx2_gsv.h
index f4e026a6db..37c797fa3f 100644
--- a/src/core/hle/service/nx2_gsv.h
+++ b/src/core/hle/service/nx2_gsv.h
@@ -21,6 +21,7 @@
 #include <optional>
 #include <memory>
 #include <mutex>
+#include <utility>
 #include <vector>
 
 #include "common/alignment.h"
@@ -45,13 +46,17 @@
 #include "core/hle/kernel/k_resource_limit.h"
 #include "core/hle/kernel/k_server_session.h"
 #include "core/hle/kernel/k_event.h"
+#include "core/hle/kernel/k_hardware_timer.h"
 #include "core/hle/kernel/k_readable_event.h"
 #include "core/hle/kernel/k_session.h"
+#include "core/hle/kernel/k_thread.h"
 #include "core/hle/kernel/k_transfer_memory.h"
+#include "core/hle/kernel/svc_results.h"
 #include "core/memory.h"
 #include "video_core/host1x/host1x.h"
 #include "video_core/host1x/nx2_video_decoder.h"
 #include "video_core/nx2.h"
+#include "video_core/textures/decoders.h"
 #include "core/hle/service/hle_ipc.h"
 #include "core/hle/service/ipc_helpers.h"
 #include "core/hle/service/kernel_helpers.h"
@@ -392,34 +397,6 @@ private:
         rb.Push(ResultSuccess);
     }
 
-    // nn::gpu::sdk::CreateGraphicsDevice(name, e.g. "NvRmGpu" in six words): the reply's first
-    // byte is the device id, the first free of 8 slots. The auto stub's reply left the request's
-    // name bytes there, so Fire Emblem's CUDA driver got device 0x47.
-    void CreateGraphicsDevice(HLERequestContext& ctx) {
-        u32 id = 0;
-        while (id < m_graphics_devices.size() && m_graphics_devices[id]) {
-            ++id;
-        }
-        if (id == m_graphics_devices.size()) {
-            LOG_ERROR(Service, "nx2:gpu TIPC 41: no free graphics device slot");
-            IPC::ResponseBuilder rb{ctx, 2};
-            rb.Push(ResultUnknown);
-            return;
-        }
-        m_graphics_devices[id] = true;
-        LOG_INFO(Service, "nx2:gpu TIPC 41 graphics device {}", id);
-        TipcReplyWords(ctx, {id});
-    }
-
-    void DestroyGraphicsDevice(HLERequestContext& ctx) {
-        const u32 id = ctx.CommandBuffer()[2];
-        LOG_INFO(Service, "nx2:gpu TIPC 42 graphics device {}", id);
-        if (id < m_graphics_devices.size()) {
-            m_graphics_devices[id] = false;
-        }
-        TipcReplyWords(ctx, {});
-    }
-
     void GetCount33(HLERequestContext& ctx) {
         LOG_WARNING(Service, "(STUBBED) nx2:gpu TIPC 33 [2]={:#x}, returning 1", ctx.CommandBuffer()[2]);
         TipcReplyWords(ctx, {1});
@@ -450,9 +427,39 @@ private:
                              static_cast<u32>(second), static_cast<u32>(second >> 32)});
     }
 
+    // An empty partition is min = ~0, max = 0 (min > max). Fire Emblem: Fortune's Weave's SDK
+    // reads (0, 0) as a one-byte partition at address 0 and aborts in nn::gpu::sdk.
     void GetGsvPartition(HLERequestContext& ctx) {
         LOG_WARNING(Service, "(STUBBED) nx2:gpu TIPC 202 [2]={:#x}, empty", ctx.CommandBuffer()[2]);
-        TipcReplyWords(ctx, {0, 0, 0, 0});
+        TipcReplyWords(ctx, {~0U, ~0U, 0, 0});
+    }
+
+    // Fire Emblem: Fortune's Weave: 41(name u64, flags u64, debug label u64) returns a device id
+    // that later NvRm calls name; 0 is not a valid id. Only flags 0 has been seen.
+    void CreateGraphicsDevice(HLERequestContext& ctx) {
+        const auto* b = ctx.CommandBuffer();
+        const u64 name = u64{b[2]} | (u64{b[3]} << 32);
+        const u64 flags = u64{b[4]} | (u64{b[5]} << 32);
+        u32 id = 0;
+        for (u32 candidate = 1; candidate < m_devices.size(); ++candidate) {
+            if (!m_devices[candidate]) {
+                m_devices[candidate] = true;
+                id = candidate;
+                break;
+            }
+        }
+        LOG_INFO(Service, "nx2:gpu 41 create graphics device name={:#x} flags={:#x} -> id {}", name,
+                 flags, id);
+        IPC::ResponseBuilder rb{ctx, 3};
+        rb.Push(id != 0 ? ResultSuccess : Kernel::ResultOutOfResource);
+        rb.Push(id);
+    }
+
+    void DestroyGraphicsDevice(HLERequestContext& ctx) {
+        const u32 id = ctx.CommandBuffer()[2] & 0xff;
+        const bool existed = id < m_devices.size() && std::exchange(m_devices[id], false);
+        IPC::ResponseBuilder rb{ctx, 2};
+        rb.Push(existed ? ResultSuccess : Kernel::ResultNotFound);
     }
 
     void OpenSubSession(HLERequestContext& ctx) {
@@ -1367,9 +1374,9 @@ private:
 
     KernelHelpers::ServiceContext m_context;
     std::array<Kernel::KEvent*, NumIds> m_events{};
-    std::array<bool, 8> m_graphics_devices{}; ///< Ids handed out by CreateGraphicsDevice
     std::map<u32, GpuMemory> m_memory;
     u32 m_next_memory_handle{1};
+    std::array<bool, 64> m_devices{}; // gpu 41 graphics device ids (0 unused)
 
     // Every 30 s: the backing of sparse blocks and GPU-only regions is marked cold. The game
     // writes it once (texture uploads by 2D blits: title 1 fills 2-4 GB of texture pools) and it
@@ -1428,6 +1435,10 @@ struct Nx2NativeObjects {
         u64 offset{}; // into its memory (images of a decoder pool share one)
         bool window_pool{};
         bool decoder{}; // a video decoder output image (gsv 911)
+        // A decoder image the client reads on the GPU (gsv 428/426): written block-linear.
+        bool gpu_read{};
+        u32 gpu_maps{};     // outstanding 426 maps
+        bool mapped_here{}; // 426 added its GPU mapping (no other mapping covered it)
     };
     std::mutex mutex;
     std::map<u32, Memory> memories;
@@ -1619,6 +1630,7 @@ public:
             {104, &INx2Vi2Session::QueryDisplayHdrStatus, "QueryDisplayHdrStatus"},
             {105, &INx2Vi2Session::QueryDisplayHdrPaperWhite, "QueryDisplayHdrPaperWhite"},
             {212, &INx2Vi2Session::GetLayerBufferBits, "GetLayerBufferBits"},
+            {106, &INx2Vi2Session::GetBufferMaxResolution, "GetBufferMaxResolution"},
             {228, &INx2Vi2Session::CancelClientBuffer, "CancelClientBuffer"},
             {229, &INx2Vi2Session::PresentClientBuffer, "PresentClientBuffer"},
             // Firmware commands without a known meaning: zeroed replies.
@@ -1626,7 +1638,6 @@ public:
             {51, &INx2Vi2Session::StubReplyZeroed, "Unknown51"},
             {101, &INx2Vi2Session::StubReplyZeroed, "Unknown101"},
             {102, &INx2Vi2Session::StubReplyZeroed, "Unknown102"},
-            {106, &INx2Vi2Session::StubReplyZeroed, "Unknown106"},
             {107, &INx2Vi2Session::StubReplyZeroed, "Unknown107"},
             {108, &INx2Vi2Session::StubReplyZeroed, "Unknown108"},
             {111, &INx2Vi2Session::StubReplyZeroed, "Unknown111"},
@@ -1728,7 +1739,7 @@ private:
         const auto waited = std::chrono::steady_clock::now();
         Composite(w[5], ~w[22], w[24], w[7]);
         const auto composited = std::chrono::steady_clock::now();
-        PaceToVblank();
+        PaceToVblank(w[12]);
         const auto paced = std::chrono::steady_clock::now();
         // Where each frame's time goes on the present thread, averaged per 600 presents: the
         // game is blocked here while Eden's GPU thread catches up (fence) and composites.
@@ -1784,18 +1795,39 @@ private:
     // present faster than that. Every slot is reported free here: hold each present until the
     // next vblank instead (title 4 ran at up to 160 fps, its timing and audio with it).
     std::chrono::steady_clock::time_point m_next_vblank{};
+    u32 m_swap_word{};
 
-    void PaceToVblank() {
+    // timing: present word 12, (swap interval << 16) | refresh rate. Fire Emblem: Fortune's Weave
+    // sends 0x1003c during its boot logos and 0x2003c (two vblanks per frame, 30 fps) after; paced
+    // at every vblank it ran at double speed. EDEN_NX2_SWAP_INTERVAL=<n> forces the interval.
+    void PaceToVblank(u32 timing) {
         if (!Settings::values.use_speed_limit.GetValue() || Settings::SpeedLimit() == 0) {
             return;
         }
-        const auto interval = std::chrono::nanoseconds{100'000'000'000LL / 60 / Settings::SpeedLimit()};
+        static const u32 forced_interval = [] {
+            const char* value = std::getenv("EDEN_NX2_SWAP_INTERVAL");
+            return value ? static_cast<u32>(std::strtoul(value, nullptr, 10)) : 0U;
+        }();
+        const u32 swap_interval =
+            forced_interval != 0 ? forced_interval : std::clamp<u32>(timing >> 16, 1, 4);
+        const u32 refresh_rate = (timing & 0xffff) >= 30 && (timing & 0xffff) <= 240 ? timing & 0xffff : 60;
+        if (timing != std::exchange(m_swap_word, timing)) {
+            LOG_INFO(Service, "nx2:vi2 present #{} swap interval {} at {} Hz (word 12 = {:#x})",
+                     m_presents, swap_interval, refresh_rate, timing);
+        }
+        const auto interval = std::chrono::nanoseconds{
+            100'000'000'000LL * swap_interval / refresh_rate / Settings::SpeedLimit()};
         const auto now = std::chrono::steady_clock::now();
         if (now > m_next_vblank + interval) {
-            // Running slower than 60 fps: show at once and don't bank the lost time.
+            // Running slower than the swap interval: show at once and don't bank the lost time.
             m_next_vblank = now;
         } else if (now < m_next_vblank) {
-            std::this_thread::sleep_until(m_next_vblank);
+            // Sleep this service thread in the guest kernel. It runs on guest core 3, and a host
+            // sleep held that core for the whole wait: game threads scheduled there ran only
+            // between presents (Fortune's Weave's loader read one RomFS block per frame).
+            const auto wait = std::chrono::duration_cast<std::chrono::nanoseconds>(m_next_vblank - now);
+            static_cast<void>(Kernel::GetCurrentThread(kernel).Sleep(
+                kernel, kernel.HardwareTimer().GetTick() + wait.count() + 2));
         }
         m_next_vblank += interval;
     }
@@ -1853,6 +1885,7 @@ private:
     void Composite(u32 image_id, u32 fence_id, u32 fence_value, u32 shown_size) {
         u64 address{};
         Nx2ImageLayout layout{};
+        u32 image_format{};
         {
             std::scoped_lock lk{m_objects->mutex};
             const auto image = m_objects->images.find(image_id);
@@ -1865,6 +1898,7 @@ private:
             }
             address = memory->second.address;
             layout = Nx2CalculateImageLayout(image->second.preference.data());
+            image_format = image->second.preference[6];
         }
         const auto device = Nvidia::Devices::Nx2GpuMemoryRegistry::Get().DeviceAddressOf(address);
         if (!device) {
@@ -1924,7 +1958,9 @@ private:
             .width = layout.width,
             .height = layout.height,
             .stride = static_cast<u32>(layout.pitch / 4),
-            .pixel_format = android::PixelFormat::Rgba8888,
+            // Preference word 6: 1 = RGBA8, 4 = RGB10A2.
+            .pixel_format = image_format == 4 ? android::PixelFormat::Rgba1010102
+                                              : android::PixelFormat::Rgba8888,
             .transform_flags = android::BufferTransformFlags::Unset,
             .crop_rect = {0, 0, static_cast<int>(crop_width), static_cast<int>(crop_height)},
             .blending = Tegra::BlendMode::Opaque,
@@ -2062,6 +2098,29 @@ private:
         TipcReplyWords(ctx, {1});
     }
 
+    // The highest buffer resolution mode of the "default" display. Fire Emblem: Fortune's Weave picks
+    // its output from it: 1 -> 1280x720, 2 -> 1920x1080, 4 and 8 -> 2560x1440; 0 (the auto stub's
+    // reply), 3 and 5 fall back to 720p. Docked reports 4, handheld 2 (the screen is 1080p);
+    // EDEN_VI2_MAX_RESOLUTION_MODE=<n> overrides.
+    void GetBufferMaxResolution(HLERequestContext& ctx) {
+        const auto* packet = ctx.CommandBuffer();
+        const u64 name = u64{packet[2]} | (u64{packet[3]} << 32);
+        constexpr u64 DefaultDisplay = 0x00746c7561666564ULL; // "default"
+        Result result = Kernel::ResultInvalidCombination;
+        u64 mode{};
+        if (packet[0] == 0x7a && packet[1] == 2) {
+            result = Result{ErrorModule::VI, 7};
+            if (name == DefaultDisplay) {
+                static const char* forced = std::getenv("EDEN_VI2_MAX_RESOLUTION_MODE");
+                mode = forced ? std::strtoull(forced, nullptr, 0) : Settings::IsDockedMode() ? 4 : 2;
+                result = ResultSuccess;
+            }
+        }
+        IPC::ResponseBuilder rb{ctx, 4};
+        rb.Push(result.raw);
+        rb.Push(mode);
+    }
+
     // Must be < 8; nn::vi::detail::LayerHistory creates 7 timestamp recorders per layer.
     void GetTimestampRecorderCount(HLERequestContext& ctx) {
         LOG_WARNING(Service, "(STUBBED) nx2:vi2 TIPC 5, returning 7");
@@ -2621,6 +2680,7 @@ private:
                                    const Decoded& frame, std::vector<u8>& bytes) {
         u64 address{};
         Nx2DecoderImageLayout layout{};
+        bool block_linear{};
         {
             std::scoped_lock lk{m_objects->mutex};
             const auto image = m_objects->images.find(image_id);
@@ -2628,6 +2688,8 @@ private:
                 return {m_width, m_height};
             }
             layout = Nx2CalculateDecoderImageLayout(image->second.preference.data());
+            block_linear = image->second.gpu_read &&
+                           layout.format != Tegra::Host1x::Nx2PictureFormat::Nv12;
             const auto memory = m_objects->memories.find(image->second.memory);
             if (memory != m_objects->memories.end() && memory->second.address != 0) {
                 address = memory->second.address + image->second.offset;
@@ -2641,10 +2703,25 @@ private:
         const u32 width = std::min(frame.picture->width, layout.width);
         const u32 height = std::min(frame.picture->height, layout.height);
         bytes.resize(layout.size);
+        auto& memory = system.ApplicationMemory();
+        if (block_linear) {
+            // Read on the GPU: RGBA (the blit's format 0xd5) in the native block-linear layout,
+            // 16-GOB blocks, as our Eden tree writes these images.
+            decoder->Render(*frame.picture, Tegra::Host1x::Nx2PictureFormat::Rgba8, width, height,
+                            layout.pitch, 0, bytes);
+            m_tiled.resize(layout.size);
+            Tegra::Texture::SwizzleTexture(m_tiled, bytes, 4, static_cast<u32>(layout.pitch / 4),
+                                           layout.height, 1, 4, 0, 1, true);
+            memory.WriteBlock(address, m_tiled.data(), m_tiled.size());
+            if (const auto device =
+                    Nvidia::Devices::Nx2GpuMemoryRegistry::Get().DeviceAddressOf(address)) {
+                system.GPU().InvalidateRegion(*device, m_tiled.size());
+            }
+            return {width, height};
+        }
         decoder->Render(*frame.picture, layout.format, width, height, layout.pitch,
                         layout.chroma_offset, bytes);
         DumpFrame(bytes, layout, width, height);
-        auto& memory = system.ApplicationMemory();
         memory.WriteBlock(address, bytes.data(), layout.pitch * height);
         if (layout.format == Tegra::Host1x::Nx2PictureFormat::Nv12) {
             memory.WriteBlock(address + layout.chroma_offset, bytes.data() + layout.chroma_offset,
@@ -2690,6 +2767,7 @@ private:
     u64 m_submitted{};
     u32 m_syncpoint{NoSyncpoint}; ///< Counts finished frames (allocated at the first register)
     u32 m_sync_base{};            ///< Its value before the first frame
+    std::vector<u8> m_tiled;      ///< Decode thread: block-linear copy of a frame (WriteImage)
 
     // Shared with the decode thread.
     std::mutex m_mutex;
@@ -2733,6 +2811,7 @@ public:
             {429, &INx2GraphicsSystemSession::CreateNativeImage, "CreateNativeImage"},
             {430, &INx2GraphicsSystemSession::DestroyNativeImage, "DestroyNativeImage"},
             {426, &INx2GraphicsSystemSession::QueryNativeImage, "MapNativeImage"},
+            {427, &INx2GraphicsSystemSession::UnmapNativeImage, "UnmapNativeImage"},
             {428, &INx2GraphicsSystemSession::QueryNativeImage, "QueryNativeImage"},
             {435, &INx2GraphicsSystemSession::CalculateNativeImageSize, "CalculateNativeImageSize"},
             {1402, &INx2GraphicsSystemSession::OpenNvsrvSession, "OpenNvsrvSession (guessed)"},
@@ -3133,8 +3212,19 @@ private:
 
     void DestroyNativeMemory(HLERequestContext& ctx) {
         const u32 id = ctx.CommandBuffer()[2];
-        std::scoped_lock lk{m_objects->mutex};
-        m_objects->memories.erase(id);
+        std::vector<std::optional<std::pair<u64, u64>>> unmaps;
+        {
+            std::scoped_lock lk{m_objects->mutex};
+            for (auto& [image_id, image] : m_objects->images) {
+                if (image.memory == id && image.mapped_here) {
+                    unmaps.push_back(TakeDecoderMapping(image));
+                }
+            }
+            m_objects->memories.erase(id);
+        }
+        for (const auto& range : unmaps) {
+            DropDecoderMapping(range);
+        }
         LOG_DEBUG(Service, "nx2:gsv 112 DestroyNativeMemory id {}", id);
         TipcReplyWords(ctx, {});
     }
@@ -3211,6 +3301,9 @@ private:
     // the 429 preference words (0x10, 0x14), a guess.
     void QueryNativeImage(HLERequestContext& ctx) {
         const u32 handle = ctx.CommandBuffer()[2];
+        if (QueryDecoderImage(ctx, handle)) {
+            return;
+        }
         std::array<u32, 16> preference{};
         u64 image_offset = 0;
         u64 memory_address = 0;
@@ -3255,6 +3348,108 @@ private:
         }
     }
 
+    // 428/426 for a decoder output image (Fire Emblem: Fortune's Weave's movie player blits each
+    // one, block-linear RGBA, format 0xd5, block height 16 GOBs, into a texture of its own). The
+    // reply follows our Eden tree, where the movies play: words 3-4 the GPU address, 5-6 the last
+    // byte's address, then the descriptor {1, 0, dimensions, .., 0x01000001, 1, offset, size}
+    // (offset 0 once mapped). 426 maps the image at its own address for the GPU: decoder pool
+    // memory is process memory (114) that no GPU mapping covers, and the blit read zeros.
+    bool QueryDecoderImage(HLERequestContext& ctx, u32 handle) {
+        const bool map = ctx.GetCommand() == 426;
+        u64 address{};
+        u64 size{};
+        u64 offset{};
+        u32 dimensions{};
+        bool register_mapping = false;
+        {
+            std::scoped_lock lk{m_objects->mutex};
+            const auto image = m_objects->images.find(handle);
+            if (image == m_objects->images.end() || !image->second.decoder) {
+                return false;
+            }
+            const auto memory = m_objects->memories.find(image->second.memory);
+            if (memory == m_objects->memories.end() || memory->second.address == 0) {
+                return false;
+            }
+            image->second.gpu_read = true;
+            offset = image->second.offset;
+            size = image->second.size;
+            dimensions = image->second.preference[2];
+            if (map) {
+                address = memory->second.address + offset;
+                register_mapping = image->second.gpu_maps++ == 0 &&
+                                   !Nvidia::Devices::Nx2GpuMemoryRegistry::Get().DeviceAddressOf(address);
+                image->second.mapped_here |= register_mapping;
+            }
+        }
+        if (register_mapping) {
+            Nvidia::Devices::Nx2GpuMemoryRegistry::Get().Register(address, size);
+        }
+        LOG_INFO(Service, "nx2:gsv {} decoder image {} at {:#x}+{:#x}{}", ctx.GetCommand(), handle,
+                 address, size, register_mapping ? ", mapped for the GPU" : "");
+        std::array<u32, 37> words{};
+        if (map) {
+            const u64 last = address + size - 1;
+            words[0] = static_cast<u32>(address);
+            words[1] = static_cast<u32>(address >> 32);
+            words[2] = static_cast<u32>(last);
+            words[3] = static_cast<u32>(last >> 32);
+        }
+        u32* const desc = words.data() + 4;
+        desc[0] = 1;
+        desc[2] = dimensions;
+        desc[8] = 0x01000001;
+        desc[9] = 1;
+        desc[10] = map ? 0 : static_cast<u32>(offset);
+        desc[11] = static_cast<u32>(size);
+        IPC::ResponseBuilder rb{ctx, static_cast<u32>(2 + words.size())};
+        rb.PushRaw<u32>(ResultSuccess.raw);
+        for (const u32 w : words) {
+            rb.Push<u32>(w);
+        }
+        return true;
+    }
+
+    // 427(u32 handle, u32 address space, u64 address, u64 last address): undoes a 426. The last
+    // unmap of a decoder image drops the GPU mapping 426 made.
+    void UnmapNativeImage(HLERequestContext& ctx) {
+        const auto* w = ctx.CommandBuffer();
+        const u32 handle = w[2];
+        std::optional<std::pair<u64, u64>> unmap;
+        {
+            std::scoped_lock lk{m_objects->mutex};
+            if (const auto image = m_objects->images.find(handle);
+                image != m_objects->images.end() && image->second.gpu_maps != 0 &&
+                --image->second.gpu_maps == 0) {
+                unmap = TakeDecoderMapping(image->second);
+            }
+        }
+        LOG_DEBUG(Service, "nx2:gsv 427 image {} [{:#x}, {:#x}]", handle, Pair(w, 4), Pair(w, 6));
+        DropDecoderMapping(unmap);
+        TipcReplyWords(ctx, {});
+    }
+
+    // The range 426 mapped for an image, if it did; called with m_objects->mutex held.
+    std::optional<std::pair<u64, u64>> TakeDecoderMapping(Nx2NativeObjects::Image& image) {
+        image.gpu_maps = 0;
+        if (!std::exchange(image.mapped_here, false)) {
+            return std::nullopt;
+        }
+        const auto memory = m_objects->memories.find(image.memory);
+        if (memory == m_objects->memories.end() || memory->second.address == 0) {
+            return std::nullopt;
+        }
+        return std::pair{memory->second.address + image.offset, image.size};
+    }
+
+    static void DropDecoderMapping(const std::optional<std::pair<u64, u64>>& range) {
+        if (range) {
+            auto& registry = Nvidia::Devices::Nx2GpuMemoryRegistry::Get();
+            registry.Unmap(range->first, range->second);
+            registry.ReleaseBacking(range->first, range->second);
+        }
+    }
+
     // 911(preference[16], u32 count, u32 memory id) (nn::codec::InitializeDecoderImagePool):
     // result, the id of the first of `count` decoder output images; the client names image i of
     // the pool id + i. They share the pool's memory, one image size apart.
@@ -3313,8 +3508,15 @@ private:
 
     void DestroyNativeImage(HLERequestContext& ctx) {
         const u32 id = ctx.CommandBuffer()[2];
-        std::scoped_lock lk{m_objects->mutex};
-        m_objects->images.erase(id);
+        std::optional<std::pair<u64, u64>> unmap;
+        {
+            std::scoped_lock lk{m_objects->mutex};
+            if (const auto image = m_objects->images.find(id); image != m_objects->images.end()) {
+                unmap = TakeDecoderMapping(image->second);
+                m_objects->images.erase(image);
+            }
+        }
+        DropDecoderMapping(unmap);
         TipcReplyWords(ctx, {});
     }
 
diff --git a/src/core/launch_params.cpp b/src/core/launch_params.cpp
index 25fdd45fdb..6c436d0346 100644
--- a/src/core/launch_params.cpp
+++ b/src/core/launch_params.cpp
@@ -39,6 +39,7 @@ LaunchParams ParseLaunchParams(Core::System& system, int argc, char *argv[], wch
         {"null-render", no_argument, 0, 'n'},
         {"singlecore", no_argument, 0, 's'},
         {"filter", no_argument, 0, 'x'},
+        {"pack-nup", required_argument, 0, 'N'},
         {0, 0, 0, 0},
         // clang-format on
     };
@@ -62,6 +63,9 @@ LaunchParams ParseLaunchParams(Core::System& system, int argc, char *argv[], wch
             case 'g':
                 p.filepath = std::string(optarg);
                 break;
+            case 'N':
+                p.pack_nup_source = std::string(optarg);
+                break;
             case 'i': {
                 p.input_profile = std::string(optarg);
                 break;
@@ -196,7 +200,9 @@ void ApplyLaunchParams(LaunchParams const& lp) noexcept {
             "-p, --program         Pass following string as arguments to executable\n"
             "-u, --user            Select a specific user profile from 0 to 7\n"
             "-d, --debug           Run the GDB stub on a port from 1 to 65535\n"
-            "-v, --version         Output version information and exit\n",
+            "-v, --version         Output version information and exit\n"
+            "--pack-nup <dump> [<out.nup>]"
+            " Pack a loose dump with all its updates and DLC into a NUP file and exit\n",
             lp.argv0
         );
     }
diff --git a/src/core/launch_params.h b/src/core/launch_params.h
index 4da30fc1c2..8d503770d8 100644
--- a/src/core/launch_params.h
+++ b/src/core/launch_params.h
@@ -23,6 +23,8 @@ struct LaunchParams {
     std::optional<int> selected_user{};
     std::optional<u16> override_gdb_port{};
     std::optional<std::string> log_filter{};
+    // --pack-nup <dump> [<out.nup>]: packs a loose dump instead of booting a game (eden-cli).
+    std::optional<std::string> pack_nup_source{};
     u16 port = Network::DefaultRoomPort;
     bool use_multiplayer = false;
     bool fullscreen = false;
diff --git a/src/shader_recompiler/frontend/ampere/lower_to_maxwell.h b/src/shader_recompiler/frontend/ampere/lower_to_maxwell.h
index 4ce374ce61..024ed27ea3 100644
--- a/src/shader_recompiler/frontend/ampere/lower_to_maxwell.h
+++ b/src/shader_recompiler/frontend/ampere/lower_to_maxwell.h
@@ -61,7 +61,7 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
     for (const auto& instruction : code) {
         const u32 op = instruction.Bits(0, 12);
         uses_uniform_bank |= op == 0x3c4 || op == 0x2bd || op == 0x896 || op == 0xf60 || op == 0xc11 || op == 0xd08 || op == 0xc0c || op == 0x986 || op == 0x9a8 || op == 0xc12 || op == 0xc17 || op == 0xe24 || op == 0xc24 || op == 0xd00 || op == 0xd09 || op == 0x9c3 || op == 0xc45 || op == 0x2a4 || op == 0x891 || op == 0x890 || op == 0x290 || op == 0x28c || op == 0x88c || op == 0x287 || op == 0x887 || op == 0x958 || op == 0xab9 || op == 0xabb || op == 0x899 || op == 0xc20 || op == 0xe21 || op == 0xe23 || op == 0xc02 ||
-                             op == 0x886 || op == 0x3c2 || op == 0xc82 || op == 0x882 || op == 0x292 || op == 0x892 || op == 0x291 || op == 0x981 || op == 0xc13 || op == 0xc10 || op == 0xc23 || op == 0x526 || op == 0x2be || op == 0x8a4 || op == 0xd05 || (op == 0x984 && instruction.Bits(91, 1)) || op == 0x89c || op == 0x883 || op == 0x2a5 || op == 0xd06 || op == 0xf63 || op == 0xf69 || op == 0xc0b || op == 0x8a5 || op == 0x299 || op == 0xc09 || (op == 0x81c && instruction.Bits(67, 1));
+                             op == 0x886 || op == 0x3c2 || op == 0xc82 || op == 0x882 || op == 0x292 || op == 0x892 || op == 0x291 || op == 0x981 || op == 0xc13 || op == 0xc10 || op == 0xc23 || op == 0x526 || op == 0x2be || op == 0x8a4 || op == 0xd05 || (op == 0x984 && instruction.Bits(91, 1)) || op == 0x89c || op == 0x883 || op == 0x2a5 || op == 0xd06 || op == 0xf63 || op == 0xf69 || op == 0xc0b || op == 0x8a5 || op == 0x299 || op == 0xc09 || (op == 0x81c && instruction.Bits(67, 1)) || op == 0xc0a;
     }
     const auto address_of = [](u32 index) { return 0x50U + index * 8 + ((index + 1) / 3) * 8; };
     const auto fail = [&](u32 index, std::string_view reason) {
@@ -97,8 +97,13 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                     active_link = call_links[call];
                 }
             }
-            // RET has no destination GPR; bits 16..23 are reserved, not a write to R0.
-            if (active_link && opcode != 0x950 && insn.Bits(16, 8) == *active_link)
+            // RET, BRA, NOP and ISETP/FSETP (predicate outputs) have no destination GPR; bits 16..23
+            // are not a write to R0. IMAD.WIDE writes a register pair.
+            const bool no_destination = opcode == 0x950 || opcode == 0x947 || opcode == 0x918 ||
+                                        (opcode & 0x1ff) == 0x00c || (opcode & 0x1ff) == 0x00b;
+            const bool pair = opcode == 0x225 || opcode == 0x625 || opcode == 0x825;
+            if (active_link && !no_destination &&
+                (insn.Bits(16, 8) == *active_link || (pair && insn.Bits(16, 8) + 1 == *active_link)))
                 return fail(index, "native callee overwrites link register");
         }
         // Scratch values and emulated uniform state occupy reserved high GPRs.
@@ -171,6 +176,13 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
         };
         std::string_view operand_error;
         const auto emit = [&](u64 word) { result.instructions.push_back(word); };
+        // Bound Maxwell texture instructions share one descriptor constant buffer per program.
+        const auto bind_texture_buffer = [&](u32 binding) {
+            if (result.required_texture_buffer != ~0U && result.required_texture_buffer != binding)
+                return false;
+            result.required_texture_buffer = binding;
+            return true;
+        };
         // P(guard slot) while a uniform guard is swapped in; P6 for lowerings that use it as
         // scratch (R2UR, MATCH, HFMA2.RELU), which save and restore it with the defaults below.
         const u32 guard_mask = guard_slot < 7 ? 1U << guard_slot : 0U;
@@ -474,6 +486,20 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                 emit(base(0x5c98000000000000ULL) | (u64{15} << 39) | (u64{insn.Bits(64, 8)} << 20));
                 break;
             }
+            if (insn.Bits(24, 8) == 255 && insn.words[1] == 255 && (insn.words[2] & ~0x07800affU) == 0x000e0400 &&
+                (!rewritten_uniform || insn.Bits(87, 3) == 7)) {
+                // IMAD.X RZ, RZ, c, Pn: the high word of a 64-bit add (bit 75 inverts c).
+                u32 c = insn.Bits(64, 8);
+                mov_imm(250, 1);
+                emit(0x5ca0000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{255} << 20) |
+                     (u64{insn.Bits(87, 3)} << 39) | (u64{insn.Bits(90, 1)} << 42));
+                if (insn.Bits(75, 1)) {
+                    emit(0x0400000000000000ULL | predicate | 251 | (u64{c} << 8) | (u64{0xffffffffU} << 20) | (u64{2} << 53));
+                    c = 251;
+                }
+                emit(base(0x5c10000000000000ULL) | (u64{c} << 8) | (u64{250} << 20));
+                break;
+            }
             if ((insn.words[2] & ~0x2ffU) != 0x078e0000 || (insn.words[1] & ~0xffU))
                 return fail(index, "native integer register multiply mode");
             multiply_low(insn.Bits(24, 8), insn.Bits(32, 8), insn.Bits(64, 8), false);
@@ -504,38 +530,87 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
             emit(0x5c10000000070000ULL | d_low | (u64{250} << 8) | (u64{255} << 20));
             break;
         }
-        case 0x825: { // IMAD.WIDE.U32 Rd:Rd+1 = Ra * immediate + Rc:Rc+1 (pointer arithmetic)
-            const u32 a = insn.Bits(24, 8), b = insn.words[1], c = insn.Bits(64, 8);
-            const u32 d = static_cast<u32>(dest), c_high = c == 255 ? 255U : c + 1;
-            if ((insn.words[2] & ~0xffU) != 0x078e0000 || (d & 1) || d >= 246 || a >= 246 ||
-                (c != 255 && ((c & 1) || c >= 246)))
-                return fail(index, "native wide multiply mode");
-            // As UIMAD.WIDE.U32: the high word in R253, the low word in R250, then the 64-bit add.
-            xmad(250, a, b, 255, false, false, 0, true);
-            xmad(251, a, b, 250, true, false, 2, true);
-            xmad(250, a, b, 251, false, true, 1, true);
-            xmad(252, a, b, 251, true, true, 2, true);
+        case 0x226: { // IDP.2A.LO.U16.U8: a.lo16 * b.byte0 + a.hi16 * b.byte1 + c
+            if ((insn.words[2] & ~0xffU) != 0x1000 || (insn.words[1] & ~0xffU))
+                return fail(index, "native packed dot-product mode");
+            const u32 a = insn.Bits(24, 8), b = insn.Bits(32, 8), c = insn.Bits(64, 8);
+            for (u32 component = 0; component < 2; ++component) {
+                emit(0x3828000000000000ULL | predicate | (250 + component) | (u64{b} << 8) | (u64{component * 8} << 20));
+                emit(0x0400000000000000ULL | predicate | (250 + component) | (u64{250 + component} << 8) | (u64{0xff} << 20));
+            }
+            xmad(252, a, 250, c, false, false, 0, false);
+            xmad(static_cast<u32>(dest), a, 251, 252, true, false, 0, false);
+            break;
+        }
+        case 0x225: case 0x227: case 0x625: case 0x825: case 0x827: case 0xa27: {
+            // IMAD.HI Rd / IMAD.WIDE Rd:Rd+1 = a * b + c:c+1 (.U32 or signed, bit 73), with an optional
+            // carry-out (bits 81-83). b is a register, an immediate (0x8xx) or a cbuf (0xa27); 0x625 takes
+            // b from bits 64-71 and adds a cbuf pair.
+            const bool wide = opcode == 0x225 || opcode == 0x625 || opcode == 0x825;
+            const bool immediate = opcode == 0x825 || opcode == 0x827, signed_product = insn.Bits(73, 1);
+            const u32 c = opcode == 0x625 ? 255U : insn.Bits(64, 8), carry_output = insn.Bits(81, 3);
+            if ((insn.words[2] & ~0x000e02ffU) != 0x07800000 ||
+                ((opcode == 0x225 || opcode == 0x227) && (insn.words[1] & ~0xffU)) ||
+                ((opcode == 0xa27 || opcode == 0x625) && (!valid_cbuf() || insn.Bits(62, 2))) ||
+                (opcode == 0x625 && insn.Bits(38, 16) > 0xfff8) || (c != 255 && (c & 1)) ||
+                (wide && (dest == 255 || (dest & 1))) || (signed_product && carry_output != 7))
+                return fail(index, "native high multiply mode");
+            const u32 a = insn.Bits(24, 8);
+            const u32 b = immediate ? insn.words[1] : opcode == 0xa27 ? 254U : insn.Bits(opcode == 0x625 ? 64 : 32, 8);
+            if (opcode == 0xa27) emit(0x4c98000000000000ULL | predicate | 254 | (u64{15} << 39) | cbuf());
+            if (signed_product) {
+                // The signed high word is the unsigned one minus (a < 0 ? b : 0) + (b < 0 ? a : 0),
+                // which R253 holds (R252 is free until the multiplication).
+                const u32 b_register = immediate ? 254U : b;
+                if (immediate) mov_imm(254, b);
+                emit(0x3828000000000000ULL | predicate | 253 | (u64{a} << 8) | (u64{31} << 20) | (u64{1} << 48));
+                emit(0x5c40000000000000ULL | predicate | 253 | (u64{253} << 8) | (u64{b_register} << 20) | (u64{7} << 48));
+                emit(0x3828000000000000ULL | predicate | 252 | (u64{b_register} << 8) | (u64{31} << 20) | (u64{1} << 48));
+                emit(0x5c40000000000000ULL | predicate | 252 | (u64{252} << 8) | (u64{a} << 20) | (u64{7} << 48));
+                emit(0x5c10000000000000ULL | predicate | 253 | (u64{253} << 8) | (u64{252} << 20));
+            }
+            // Base-2^16 long multiplication. Each intermediate sum fits U32.
+            xmad(250, a, b, 255, false, false, 0, immediate);
+            xmad(251, a, b, 250, true, false, 2, immediate);
+            xmad(250, a, b, 251, false, true, 1, immediate);
+            xmad(252, a, b, 251, true, true, 2, immediate);
             emit(0x3828000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{16} << 20));
+            if (signed_product)
+                emit(0x5c10000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{253} << 20) | (u64{1} << 48));
+            if (!wide && c == 255 && carry_output == 7) {
+                emit(base(0x5c10000000000000ULL) | (u64{250} << 8) | (u64{252} << 20));
+                break;
+            }
+            // High word in R253 and low word in R250 (as UIMAD.WIDE.U32), then c:c+1 is added.
             emit(0x5c10000000000000ULL | predicate | 253 | (u64{250} << 8) | (u64{252} << 20));
-            xmad(250, a, b, 255, false, false, 0, true);
-            xmad(251, a, b, 255, true, false, 0, true);
-            xmad(251, a, b, 251, false, true, 0, true);
+            xmad(250, a, b, 255, false, false, 0, immediate);
+            xmad(251, a, b, 255, true, false, 0, immediate);
+            xmad(251, a, b, 251, false, true, 0, immediate);
             emit(0x5c18000000000000ULL | predicate | 250 | (u64{251} << 8) | (u64{250} << 20) | (u64{16} << 39));
-            emit(0x5c10000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{c} << 20) | (u64{1} << 47));
-            emit(0x5c10000000000000ULL | predicate | (d + 1) | (u64{253} << 8) | (u64{c_high} << 20) | (u64{1} << 43));
-            emit(0x5c10000000000000ULL | predicate | d | (u64{250} << 8) | (u64{255} << 20));
-            break;
-        }
-        case 0x827: { // IMAD.HI.U32, captured zero addend
-            if (insn.words[2] != 0x078e00ff) return fail(index, "native high multiply mode");
-            const u32 a = insn.Bits(24, 8), b = insn.words[1];
-            // Base-2^16 long multiplication. Each intermediate sum fits U32.
-            xmad(250, a, b, 255, false, false, 0, true);
-            xmad(251, a, b, 250, true, false, 2, true);
-            xmad(250, a, b, 251, false, true, 1, true);
-            xmad(252, a, b, 251, true, true, 2, true);
-            emit(0x3828000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{16} << 20));
-            emit(base(0x5c10000000000000ULL) | (u64{250} << 8) | (u64{252} << 20));
+            u32 c_low = c, c_high = c == 255 ? 255U : c + 1;
+            if (opcode == 0x625) {
+                emit(0x4c98000000000000ULL | predicate | 252 | (u64{15} << 39) | cbuf());
+                emit(0x4c98000000000000ULL | predicate | 254 | (u64{15} << 39) | (cbuf() + (u64{1} << 20)));
+                c_low = 252;
+                c_high = 254;
+            }
+            const u32 high = wide ? static_cast<u32>(dest) + 1 : static_cast<u32>(dest);
+            emit(0x5c10000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{c_low} << 20) | (u64{1} << 47));
+            if (carry_output == 7) {
+                emit(0x5c10000000000000ULL | predicate | high | (u64{253} << 8) | (u64{c_high} << 20) | (u64{1} << 43));
+                if (wide) emit(base(0x5c10000000000000ULL) | (u64{250} << 8) | (u64{255} << 20));
+                break;
+            }
+            // Maxwell IADD has no .X with .CC: R251 takes the low carry, R254 counts the high word's.
+            emit(0x5c10000000000000ULL | predicate | 251 | (u64{255} << 8) | (u64{255} << 20) | (u64{1} << 43));
+            emit(0x5c10000000000000ULL | predicate | 253 | (u64{253} << 8) | (u64{c_high} << 20) | (u64{1} << 47));
+            emit(0x5c10000000000000ULL | predicate | 254 | (u64{255} << 8) | (u64{255} << 20) | (u64{1} << 43));
+            emit(0x5c10000000000000ULL | predicate | 253 | (u64{253} << 8) | (u64{251} << 20) | (u64{1} << 47));
+            emit(0x5c10000000000000ULL | predicate | 254 | (u64{254} << 8) | (u64{255} << 20) | (u64{1} << 43));
+            emit(0x5c98000000000000ULL | predicate | high | (u64{253} << 20) | (u64{15} << 39));
+            if (wide) emit(base(0x5c98000000000000ULL) | (u64{250} << 20) | (u64{15} << 39));
+            emit(0x5b60000000000000ULL | predicate | 7 | (u64{carry_output} << 3) | (u64{254} << 8) |
+                 (u64{255} << 20) | (u64{7} << 39) | (u64{5} << 49));
             break;
         }
         case 0xa24: { // IMAD, constant-buffer multiplier
@@ -577,6 +652,21 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
         }
         case 0x824: { // Captured low-word IMAD forms; bit 75 negates the addend.
             const bool negate_c = insn.Bits(75, 1) != 0;
+            if (insn.words[1] == 1 && (insn.words[2] & ~(0x07800800U | 0xffU)) == 0x000e0600U) {
+                // IMAD.X Rd, Ra, 1, Rc, Pn: Ra + Rc plus the carry predicate in bits 87-90 (~Rc with bit 75).
+                u32 c = insn.Bits(64, 8);
+                mov_imm(252, 1);
+                emit(0x5ca0000000000000ULL | predicate | 252 | (u64{252} << 8) | (u64{255} << 20) |
+                     (u64{insn.Bits(87, 3)} << 39) | (u64{insn.Bits(90, 1)} << 42));
+                if (negate_c) {
+                    emit(0x0400000000000000ULL | predicate | 251 | (u64{c} << 8) | (u64{0xffffffffU} << 20) | (u64{2} << 53));
+                    c = 251;
+                }
+                emit(0x5c10000000000000ULL | predicate | 250 | (u64{insn.Bits(24, 8)} << 8) |
+                     (u64{c} << 20));
+                emit(base(0x5c10000000000000ULL) | (u64{250} << 8) | (u64{252} << 20));
+                break;
+            }
             if (insn.words[1] == 1 && (insn.words[2] & 0xfffff700U) == 0x078e0200) {
                 emit(base(0x5c10000000000000ULL) | (u64{insn.Bits(24, 8)} << 8) |
                      (u64{insn.Bits(64, 8)} << 20) | (u64{negate_c} << 48));
@@ -802,34 +892,36 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                  (u64{insn.Bits(64, 8)} << 20) | (u64{maxwell} << 28));
             break;
         }
-        case 0xb6c: { // TXD 2D or ARRAY_2D, four channels; the two destination pairs anywhere.
+        case 0xb6c: { // TXD 2D or ARRAY_2D, any channels; the two destination pairs anywhere.
             const u32 binding = insn.Bits(54, 5), offset = insn.Bits(40, 14);
             const u32 coordinates = insn.Bits(24, 8), derivatives = insn.Bits(32, 8);
             // Ampere dimensions: 1 = 2D, 5 = ARRAY_2D; Maxwell TXD's are 2 and 3. The coordinates
             // (x, y[, layer]) and the four gradients sit in the same registers for both.
             const u32 dimension = insn.Bits(61, 3);
             const u32 high = insn.Bits(64, 8); // destination of the third and fourth channels
+            const u32 mask = insn.Bits(72, 4), channels = static_cast<u32>(std::popcount(mask));
             // Bit 90 is forwarded below (Maxwell's NODEP); Splatoon Raiders sets it.
-            if ((insn.words[2] & ~(0xffU | (1U << 26))) != 0x001e0f00 || insn.Bits(59, 2) ||
+            if ((insn.words[2] & ~(0xfffU | (1U << 26))) != 0x001e0000 || mask == 0 || insn.Bits(59, 2) ||
                 (dimension != 1 && dimension != 5) || binding >= 18 || offset > 0x1fff ||
-                (dest & 1) || dest >= 248 || (high & 1) || (high >= 248 && high != 255) ||
+                (channels > 1 && (dest & 1)) || dest >= 248 ||
+                (channels > 2 ? high != 255 && ((high & 1) || high >= 248) : high != 255) ||
                 coordinates >= 248 || derivatives >= 247)
                 return fail(index, "native gradient texture mode");
             if (result.required_texture_buffer != ~0U && result.required_texture_buffer != binding)
                 return fail(index, "native texture descriptor buffer conflict");
             result.required_texture_buffer = binding;
-            // Maxwell writes four consecutive registers: when the second pair is elsewhere (Splatoon
+            // Maxwell writes consecutive registers: when the second pair is elsewhere (Splatoon
             // Raiders: R12/R18, R18/R44), write them to scratch and move each pair into place.
-            const bool consecutive = high == dest + 2;
+            const bool consecutive = channels <= 2 || high == dest + 2;
             const u64 target = consecutive ? dest : 248;
             emit(0xde00000000000000ULL | predicate | target | (u64{coordinates} << 8) |
-                 (u64{derivatives} << 20) | (u64{dimension == 5 ? 3U : 2U} << 28) | (u64{15} << 31) |
+                 (u64{derivatives} << 20) | (u64{dimension == 5 ? 3U : 2U} << 28) | (u64{mask} << 31) |
                  (u64{offset} << 36) | (u64{insn.Bits(90, 1)} << 49) | (u64{7} << 51));
             if (!consecutive) {
-                for (u32 i = 0; i < 2; ++i) {
-                    emit(0x5c98000000000000ULL | predicate | (dest + i) | (u64{15} << 39) | (u64{248 + i} << 20));
-                    if (high != 255)
-                        emit(0x5c98000000000000ULL | predicate | (high + i) | (u64{15} << 39) | (u64{250 + i} << 20));
+                for (u32 i = 0; i < channels; ++i) {
+                    if (i >= 2 && high == 255) break;
+                    emit(0x5c98000000000000ULL | predicate | (i < 2 ? dest + i : high + i - 2) |
+                         (u64{15} << 39) | (u64{248 + i} << 20));
                 }
             }
             break;
@@ -1022,14 +1114,20 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
             const u32 binding = insn.Bits(54, 5), offset = insn.Bits(40, 14);
             const u32 data = insn.Bits(32, 8), coordinate = insn.Bits(24, 8);
             const u32 dimension = insn.Bits(61, 3);
-            if (insn.words[2] != 0x00100f00 || dimension < 3 || dimension > 5 ||
+            const bool strong = insn.words[2] == 0x0010af00; // .STRONG.GPU: fenced on both sides
+            if ((insn.words[2] != 0x00100f00 && !strong) || dimension < 3 || dimension > 5 ||
                 binding >= 18 || offset > 0x1fff || insn.Bits(59, 2) || data > 252 || coordinate > (dimension >= 4 ? 252U : 253U))
                 return fail(index, "native formatted surface store mode");
-            if (result.required_texture_buffer != ~0U && result.required_texture_buffer != binding)
-                return fail(index, "native surface descriptor buffer conflict");
-            result.required_texture_buffer = binding;
+            // A second descriptor buffer: SUST.B with the handle, loaded from that buffer, in R250.
+            const bool bindless = !bind_texture_buffer(binding);
+            if (bindless) {
+                emit(0x4c98000000070000ULL | 250 | (u64{15} << 39) | (u64{offset} << 20) | (u64{binding} << 34));
+            }
+            if (strong) emit(0xef98000000000000ULL | predicate | (u64{1} << 8)); // MEMBAR.GL
             emit(0xeb20000000000000ULL | predicate | data | (u64{coordinate} << 8) |
-                (u64{15} << 20) | (u64{dimension} << 33) | (u64{offset} << 36) | (u64{1} << 51));
+                (u64{15} << 20) | (u64{dimension} << 33) |
+                (bindless ? u64{250} << 39 : (u64{offset} << 36) | (u64{1} << 51)));
+            if (strong) emit(0xef98000000000000ULL | predicate | (u64{1} << 8));
             break;
         }
         case 0x59f: { // SURED.D.2D.ADD.STRONG.GPU.IGN U32, direct descriptor (title 1's race compute).
@@ -1052,21 +1150,27 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
             emit(base(0x3828000000000000ULL) | (u64{insn.words[1]} << 8) |
                 (u64{1} << 39) | (u64{1} << 40));
             break;
-        case 0x219: case 0xc19: { // U32 register (or uniform, 0xc19) shifts with a zero word outside the selected result.
+        case 0x219: case 0xa19: case 0xc19: { // U32 register (or cbuf, 0xa19, or uniform, 0xc19) shifts with a zero word outside the selected result.
             const u32 low = insn.Bits(24, 8), high = insn.Bits(64, 8);
-            const u32 shift = opcode == 0xc19 ? uniform_register(insn.Bits(32, 8)) : insn.Bits(32, 8);
+            const bool constant = opcode == 0xa19;
+            // A constant shift amount is loaded into R251 once the form is known.
+            const u32 shift = opcode == 0xc19 ? uniform_register(insn.Bits(32, 8)) : constant ? 251U : insn.Bits(32, 8);
+            const bool shift_operand = constant ? valid_cbuf() && !insn.Bits(62, 2) : insn.words[1] <= 255;
+            const auto load_shift = [&] { if (constant) materialize(2, 0, 251, false, false); };
             const bool right = insn.Bits(76, 1) != 0, high_result = insn.Bits(80, 1) != 0;
             // SHF.R.U32 of the low word with a zero high word: a plain logical right shift.
             if (right && !high_result && high == 255 && insn.Bits(73, 2) == 3 && shift != ~0U &&
-                insn.words[1] <= 255 &&
+                shift_operand &&
                 (insn.words[2] & ~(0x000118ffU | (opcode == 0xc19 ? 0x08000000U : 0U))) == 0x00000600U) {
+                load_shift();
                 emit(base(0x5c28000000000000ULL) | (u64{low} << 8) | (u64{shift} << 20));
                 break;
             }
-            if (insn.words[1] > 255 || insn.Bits(73, 2) != 3 || shift == ~0U ||
+            if (!shift_operand || insn.Bits(73, 2) != 3 || shift == ~0U ||
                 (insn.words[2] & ~(0x000118ffU | (opcode == 0xc19 ? 0x08000000U : 0U))) != 0x00000600U ||
                 (right ? (!high_result || low != 255) : (high_result || high != 255)))
                 return fail(index, "native register shift mode");
+            load_shift();
             emit(base(right ? 0x5cf8000000000000ULL : 0x5bf8000000000000ULL) |
                 (u64{right ? high : 255U} << 8) | (u64{shift} << 20) |
                 (u64{right ? 255U : low} << 39) | (u64{insn.Bits(75, 1)} << 50));
@@ -1105,8 +1209,8 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
             if (insn.words[1] || insn.words[2]) return fail(index, "native error barrier mode");
             emit(0xef98000000000000ULL | predicate | (u64{1} << 8));
             break;
-        case 0xb1d: // BAR.SYNC 0, full workgroup.
-            if (insn.words[1] || insn.words[2] || native_predicate != 7)
+        case 0xb1d: // BAR.SYNC 0 (bit 80: .DEFER_BLOCKING), full workgroup.
+            if (insn.words[1] || (insn.words[2] & ~0x10000U) || native_predicate != 7)
                 return fail(index, "native workgroup barrier mode");
             emit(0xf0a8000000000000ULL | predicate | (u64{1} << 43) |
                 (u64{1} << 44) | (u64{1} << 39) | (u64{7} << 39));
@@ -1376,10 +1480,17 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                 // The uniform base sits where a register source would (bits 32-37).
                 const u32 uniform_address =
                     insn.Bits(38, 2) ? ~0U : uniform_register(insn.Bits(32, 6));
-                if ((insn.words[2] & ~(0x04000000U | 0x3fU | 0xe00U | 0x2000U)) != 0x081e8100 ||
+                // desc[URn][Ra.64]: the uniform pair is a memory (cache policy) descriptor and
+                // Ra the whole address.
+                const bool descriptor_address = (insn.words[2] & ~(0x3fU | 0xe00U)) == 0x0c1e1100;
+                if ((!descriptor_address &&
+                     (insn.words[2] & ~(0x04000000U | 0x3fU | 0xe00U | 0x2000U)) != 0x081e8100) ||
                     uniform_address == ~0U || (uniform_address & 1))
                     return fail(index, "native global load uniform addressing mode");
-                if (address == 255) {
+                if (descriptor_address) {
+                    if ((address & 1) || address >= 246)
+                        return fail(index, "native global load register address pair");
+                } else if (address == 255) {
                     address = uniform_address;
                 } else {
                     if (insn.Bits(90, 1) && ((address & 1) || address >= 246))
@@ -1412,10 +1523,16 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
             bool extended = insn.Bits(72, 1) != 0;
             if (opcode == 0x986) {
                 const u32 uniform_address = uniform_register(insn.Bits(64, 6));
-                if ((insn.words[2] & ~(0x04000000U | 0x3fU | 0xe00U)) != 0x0810a100 ||
+                // desc[URn][Ra.64]: the uniform pair is a memory (cache policy) descriptor and
+                // Ra the whole address.
+                const bool descriptor_address = (insn.words[2] & ~(0x3fU | 0xe00U)) == 0x0c101100;
+                if ((!descriptor_address && (insn.words[2] & ~(0x04000000U | 0x3fU | 0xe00U)) != 0x0810a100) ||
                     uniform_address == ~0U || (uniform_address & 1) || !extended)
                     return fail(index, "native global store uniform addressing mode");
-                if (address == 255) address = uniform_address;
+                if (descriptor_address) {
+                    if ((address & 1) || address >= 246)
+                        return fail(index, "native global store register address pair");
+                } else if (address == 255) address = uniform_address;
                 else {
                     if (insn.Bits(90, 1) && ((address & 1) || address >= 254))
                         return fail(index, "native global store register address pair");
@@ -1438,13 +1555,29 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                 return fail(index, "native fragment discard mode");
             emit(0xe33000000000000fULL | predicate);
             break;
+        case 0x311: { // F2I.FTZ.U64.TRUNC, register source, destination pair
+            if (insn.words[2] != 0x0021d800 || (insn.words[1] & ~0xffU) || insn.Bits(24, 8) ||
+                (dest & 1) || dest >= 246)
+                return fail(index, "native unsigned 64-bit float conversion mode");
+            emit(base(0x5cb0000000000000ULL) | (u64{3} << 8) | (u64{2} << 10) |
+                 (u64{insn.Bits(32, 8)} << 20) | (u64{3} << 39) | (u64{1} << 44));
+            break;
+        }
+        case 0x312: { // I2F.F32.(U|S)64, register pair source; sign (74) and rounding (78-79) as Maxwell's
+            if ((insn.words[2] & ~0xc400U) != 0x00301000 || (insn.words[1] & ~0xffU) || insn.Bits(24, 8) ||
+                (insn.Bits(32, 8) & 1) || insn.Bits(32, 8) >= 254)
+                return fail(index, "native 64-bit integer-to-float mode");
+            emit(base(0x5cb8000000000000ULL) | (u64{2} << 8) | (u64{3} << 10) | (u64{insn.Bits(74, 1)} << 13) |
+                 (u64{insn.Bits(32, 8)} << 20) | (u64{insn.Bits(78, 2)} << 39));
+            break;
+        }
         case 0x305: case 0xb05: case 0xd05: { // F2I NTZ, register/constant-buffer/uniform source
             const u32 mode = insn.words[2] & ~(opcode == 0xd05 ? 0x08000000U : 0U);
             const bool half = opcode == 0x305 && mode == 0x0010f000;
             const bool small = mode == 0x00212800;
             const bool floor = (mode & ~0x10100U) == 0x00207000;
             const bool nearest = (mode & ~0x10100U) == 0x00203000;
-            if ((!half && !small && !floor && !nearest && (mode & ~0x100U) != 0x0021f000) ||
+            if ((!half && !small && !floor && !nearest && (mode & ~0x10100U) != 0x0020f000) ||
                 (opcode != 0xb05 && (insn.words[1] & 0xffffff00U)) ||
                 (opcode == 0xd05 && uniform_register(insn.Bits(32, 8)) == ~0U)) {
                 return fail(index, "native float-to-integer conversion mode");
@@ -1548,9 +1681,27 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                 return fail(index, "native texel fetch mode or descriptor binding");
             }
             const u32 binding = insn.Bits(54, 5);
-            if (result.required_texture_buffer != ~0U && result.required_texture_buffer != binding)
-                return fail(index, "native texture descriptor buffer conflict");
-            result.required_texture_buffer = binding;
+            if (!bind_texture_buffer(binding)) {
+                if (level || offsets)
+                    return fail(index, "native texture descriptor buffer conflict");
+                // A second descriptor buffer: TLD.B (LZ) with the coordinates in R250.. (array
+                // index or Z after Ra) and the handle, loaded from that buffer, in R253.
+                const auto copy = [&](u32 target, u32 source) {
+                    emit(0x5c98000000000000ULL | predicate | target | (u64{15} << 39) | (u64{source} << 20));
+                };
+                copy(250, source_a);
+                if (array || volume) copy(251, source_a + 1);
+                if (dimension != 0) copy(array || volume ? 252 : 251, source_b);
+                emit(0x4c98000000070000ULL | 253 | (u64{15} << 39) | (u64{insn.Bits(40, 14)} << 20) |
+                     (u64{binding} << 34));
+                emit(0xdd00000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{253} << 20) |
+                     (u64{array ? 3U : volume ? 4U : dimension == 0 ? 0U : 2U} << 28) | (u64{mask} << 31) |
+                     (u64{insn.Bits(90, 1)} << 49) | (u64{7} << 51));
+                const u32 components = static_cast<u32>(std::popcount(mask));
+                for (u32 i = 0; i < components; ++i)
+                    copy(i < 2 || !split ? static_cast<u32>(dest) + i : second_dest + (i - 2), 250 + i);
+                break;
+            }
             if (array && level) {
                 // TLDS has no array form with a level: TLD takes (layer, x, y) from Ra and the level
                 // from Rb (layer, x in Ra, Ra+1; y, level in Rb, Rb+1 here). Results come out packed,
@@ -1712,12 +1863,11 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
         case 0xb60: case 0xf60: case 0x361: { // TEX; 0xf60: handle in a uniform register; 0x361: TEX.B
             // Bindless forms become Maxwell TEX.B, the handle first among the meta registers (the
             // texture pass tracks it back to its constant buffer words). 0x361 lists the handle
-            // right after the coordinates, then the LOD (see general_tex); forms with offsets,
-            // whose place next to the handle is unverified, are not taken.
+            // right after the coordinates, then the LOD and the offsets (see general_tex).
             const bool bindless = opcode != 0xb60;
             const u32 handle = opcode == 0xf60 ? uniform_register(insn.Bits(40, 6)) : 255;
             if (bindless && ((opcode == 0xf60 && (handle == ~0U || handle >= 246 || insn.Bits(46, 13))) ||
-                             (opcode == 0x361 && (insn.Bits(40, 19) || insn.Bits(87, 3) > 3 || insn.Bits(76, 1)))))
+                             (opcode == 0x361 && (insn.Bits(40, 19) || insn.Bits(87, 3) > 3))))
                 return fail(index, "native bindless texture mode");
             const u32 mask = insn.Bits(72, 4);
             const u32 second_dest = insn.Bits(64, 8);
@@ -1733,7 +1883,7 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                     insn.Bits(59, 1) || insn.Bits(40, 14) > 0x1fff || insn.Bits(54, 5) != 2 ||
                     (source_a & 1) || (source_b & 1) || source_a >= 248 || source_b >= 248 || dest >= 248)
                     return fail(index, "native array depth comparison sample mode");
-                result.required_texture_buffer = 2;
+                if (!bind_texture_buffer(2)) return fail(index, "native texture descriptor buffer conflict");
                 for (u32 i = 0; i < 3; ++i) {
                     const u32 source = i < 2 ? source_a + i : source_b;
                     emit(0x5c98000000000000ULL | predicate | (250 + i) |
@@ -1767,7 +1917,9 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                 const u32 handle_slot = opcode == 0x361 ? 1 : 0;
                 const u32 count = coordinates + handle_slot + (has_lod ? 1 : 0) + (offsets ? 1 : 0) +
                                   (depth_compare ? 1 : 0);
-                const u32 in_a = count <= 4 ? (count + 1) / 2 : opcode == 0x361 ? coordinates : 4;
+                // Unpacked 0x361 (bit 60 clear): Ra holds the coordinates, Rb the handle and the rest.
+                const u32 in_a = opcode == 0x361 && !insn.Bits(60, 1) ? coordinates
+                               : count <= 4 ? (count + 1) / 2 : opcode == 0x361 ? coordinates : 4;
                 const auto value = [&](u32 i) -> u32 {
                     if (i < in_a) return source_a == 255 ? 255U : source_a + i;
                     return source_b == 255 ? 255U : source_b + (i - in_a);
@@ -1777,12 +1929,11 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                     return false;
                 const u32 texture_handle = opcode == 0x361 ? value(coordinates) : handle;
                 if (bindless && texture_handle >= 246) return false;
-                if (!bindless) {
-                    const u32 binding = insn.Bits(54, 5);
-                    if (result.required_texture_buffer != ~0U && result.required_texture_buffer != binding)
-                        return false;
-                    result.required_texture_buffer = binding;
-                }
+                // A second descriptor buffer is read bindless: TEX.B takes the handle, loaded from
+                // that buffer, as its first meta register.
+                const u32 binding = insn.Bits(54, 5);
+                const bool second_buffer = !bindless && !bind_texture_buffer(binding);
+                const bool tex_b = bindless || second_buffer;
                 const auto copy = [&](u32 target, u32 source) {
                     emit(0x5c98000000000000ULL | predicate | target | (u64{15} << 39) | (u64{source} << 20));
                 };
@@ -1791,10 +1942,13 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                 u32 meta = 246;
                 u32 next = coordinates + handle_slot;
                 if (bindless) copy(meta++, texture_handle);
+                else if (second_buffer)
+                    emit(0x4c98000000070000ULL | meta++ | (u64{15} << 39) | (u64{insn.Bits(40, 14)} << 20) |
+                         (u64{binding} << 34));
                 if (has_lod) copy(meta++, value(next++));
                 if (offsets) copy(meta++, value(next++));
                 if (depth_compare) copy(meta++, value(next++));
-                if (bindless) {
+                if (tex_b) {
                     // Maxwell TEX.B: AOFFI at 36 and the LOD mode at 37 instead of 54 and 55.
                     emit(0xde80000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{246} << 20) |
                          (u64{maxwell_type[dimension]} << 28) | (u64{mask} << 31) | (u64{offsets} << 36) |
@@ -1850,11 +2004,11 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                 dest == 255 || (mask & (mask - 1) && ((dest & 1) || dest >= 254)) ||
                 (split && mask == 15 && ((second_dest & 1) || second_dest >= 254)) ||
                 (depth_compare && (dimension != 1 || split || mask != 1 || (source_a & 1) || source_a >= 249)) ||
-                (dimension == 5 && ((source_a & 1) || source_a >= 249))) {
+                (dimension == 5 && ((source_a & 1) || source_a >= 249)) || bindless ||
+                !bind_texture_buffer(2)) {
                 if (!general_tex()) return fail(index, "native texture mode or descriptor binding");
                 break;
             }
-            result.required_texture_buffer = 2;
             emit((0xd800000000000000ULL & ~(u64{insn.Bits(79, 1)} << 59)) | predicate | dest | (u64{insn.Bits(24, 8)} << 8) |
                  (u64{insn.Bits(32, 8)} << 20) | (u64{insn.Bits(64, 8)} << 28) |
                  (u64{insn.Bits(40, 14)} << 36) | (u64{insn.Bits(90, 1)} << 49) |
@@ -2010,12 +2164,22 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
             break;
         }
         case 0x209: case 0x809: case 0xa09: case 0xc09: { // FMNMX, including a uniform source
-            if (insn.Bits(74, 6) || insn.Bits(81, 6) || (opcode != 0xc09 && insn.Bits(91, 1)))
+            if (insn.Bits(74, 6) || insn.Bits(82, 5) || (opcode != 0xc09 && insn.Bits(91, 1)))
                 return fail(index, "native floating min/max mode");
             const u32 a = operand(0), b = operand(1);
+            // .NAN (bit 81): an unordered pair gives the canonical NaN. R252 = ~0 when both are numbers.
+            const bool propagate_nan = insn.Bits(81, 1);
+            if (propagate_nan)
+                emit(0x5800000000000000ULL | predicate | 252 | (u64{a} << 8) | (u64{b} << 20) | (u64{7} << 39) | (u64{7} << 48));
             emit(base(0x5c60000000000000ULL) | (u64{a} << 8) | (u64{b} << 20) |
                  (u64{insn.Bits(87, 3)} << 39) | (u64{insn.Bits(90, 1)} << 42) |
                  (u64{insn.Bits(80, 1)} << 44));
+            if (propagate_nan) {
+                emit(base(0x5c40000000000000ULL) | (dest << 8) | (u64{252} << 20) | (u64{7} << 48));
+                emit(0x0400000000000000ULL | predicate | 252 | (u64{252} << 8) | (u64{0xffffffffU} << 20) | (u64{2} << 53));
+                emit(0x0400000000000000ULL | predicate | 252 | (u64{252} << 8) | (u64{0x7fffffffU} << 20));
+                emit(base(0x5c40000000000000ULL) | (dest << 8) | (u64{252} << 20) | (u64{1} << 41) | (u64{7} << 48));
+            }
             break;
         }
         case 0x308: case 0xb08: case 0xd08: { // MUFU (register, constant or uniform register source)
@@ -2139,13 +2303,15 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
         }
         case 0x207: case 0x807: case 0xa07:
         case 0x208: case 0x808: case 0xa08: { // Bitwise SEL / FSEL
-            const u32 a = operand(0, false), b = operand(1, false);
+            // FSEL applies the floating operand modifiers (negate/absolute) before selecting.
+            const bool floating = (opcode & 0x1ff) == 0x008;
+            const u32 a = operand(0, floating), b = operand(1, floating);
             emit(base(0x5ca0000000000000ULL) | (u64{a} << 8) | (u64{b} << 20) |
                 (u64{insn.Bits(87, 3)} << 39) | (u64{insn.Bits(90, 1)} << 42));
             break;
         }
-        case 0x20a: case 0x80a: case 0xa0a: { // FSET.BF, combined with Pc (bits 87-90) by bits 74-75
-            if (insn.Bits(64, 8) || insn.Bits(74, 2) == 3 || insn.Bits(81, 6) || insn.Bits(91, 1))
+        case 0x20a: case 0x80a: case 0xa0a: case 0xc0a: { // FSET.BF, combined with Pc (bits 87-90) by bits 74-75 (0xc0a: uniform b)
+            if (insn.Bits(64, 8) || insn.Bits(74, 2) == 3 || insn.Bits(81, 6) || (opcode != 0xc0a && insn.Bits(91, 1)))
                 return fail(index, "native floating comparison output mode");
             const u32 a = operand(0), b = operand(1);
             emit(base(0x5800000000000000ULL) | (u64{a} << 8) | (u64{b} << 20) |
@@ -2255,15 +2421,19 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
         }
         case 0x217: case 0x817: case 0xa17: case 0xc17: { // IMNMX register, immediate, cbuf or uniform operand.
             if ((insn.words[2] & ~(0x04000200U | (opcode == 0xc17 ? 0x08000000U : 0U))) != 0x03800000 ||
-                (opcode != 0xa17 && insn.words[1] > (opcode == 0x817 ? 0x7ffffU : 255U)) ||
+                (opcode == 0x817 && insn.words[1] > 0x7ffffU && insn.words[1] < 0xfff80000U) ||
+                (opcode != 0xa17 && opcode != 0x817 && insn.words[1] > 255U) ||
                 (opcode == 0xa17 && (!valid_cbuf() || insn.Bits(62, 2))))
                 return fail(index, "native integer min/max mode");
+            // An immediate is a signed 20-bit value: 19 bits at 20, the sign in bit 56.
             const u32 source = opcode == 0xc17   ? uniform_register(insn.words[1])
                                : opcode == 0xa17 ? operand(1, false)
+                               : opcode == 0x817 ? insn.words[1] & 0x7ffffU
                                                  : insn.words[1];
             if (source == ~0U) return fail(index, "native uniform min/max operand");
             emit(base(opcode == 0x817 ? 0x3820000000000000ULL : 0x5c20000000000000ULL) |
                  (u64{insn.Bits(24, 8)} << 8) | (u64{source} << 20) |
+                 (u64{opcode == 0x817 ? insn.words[1] >> 31 : 0U} << 56) |
                  (u64{insn.Bits(87, 4)} << 39) | (u64{insn.Bits(73, 1)} << 48));
             break;
         }
@@ -2293,6 +2463,20 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
             break;
         }
         case 0xa11: { // LEA with constant base and carry predicate.
+            if ((insn.words[2] & ~(0x07800000U | 0x0000f800U)) == 0x000f06ffU && !insn.Bits(62, 2) &&
+                insn.Bits(75, 5) != 0) {
+                // LEA.HI.X.SX32, no high source: (sign-extended Ra << shift) >> 32, plus the
+                // constant high word and the carry predicate (bits 87-90).
+                const u32 b = operand(1, false);
+                emit(0x3828000000000000ULL | predicate | 250 | (u64{insn.Bits(24, 8)} << 8) |
+                     (u64{32 - insn.Bits(75, 5)} << 20) | (u64{1} << 48));
+                mov_imm(252, 1);
+                emit(0x5ca0000000000000ULL | predicate | 252 | (u64{252} << 8) | (u64{255} << 20) |
+                     (u64{insn.Bits(87, 3)} << 39) | (u64{insn.Bits(90, 1)} << 42));
+                emit(0x5c10000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{b} << 20));
+                emit(base(0x5c10000000000000ULL) | (u64{250} << 8) | (u64{252} << 20));
+                break;
+            }
             if (insn.Bits(72, 1) || insn.Bits(74, 1) || insn.Bits(80, 1) ||
                 insn.Bits(81, 3) == 7 || insn.Bits(62, 2))
                 return fail(index, "native constant LEA carry mode");
@@ -2303,23 +2487,39 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                 (dest << 8) | (u64{b} << 20) | (u64{7} << 39) | (u64{1} << 49));
             break;
         }
-        case 0x211: case 0x811: case 0xc11: { // LEA low word (0xc11: uniform Rb), no carry result
+        case 0x211: case 0x811: case 0xc11: { // LEA low word (0xc11: uniform Rb)
             if (insn.Bits(80, 1)) {
-                // LEA.HI Rd, Ra, Rb (or an immediate, 0x811), RZ, s: Rb + high word of (Ra << s);
-                // bit 73 sign-extends Ra.
-                if (insn.Bits(72, 1) || insn.Bits(74, 1) || insn.Bits(81, 3) != 7 ||
-                    insn.Bits(64, 8) != 255 || (opcode == 0x211 && insn.Bits(62, 2)))
+                // LEA.HI Rd, Ra, Rb (or an immediate, 0x811), Rc, s: Rb + high word of (Rc:Ra << s);
+                // bit 73 sign-extends Ra (Rc is RZ) and .X (bit 74) adds the carry predicate in bits 87-90.
+                const bool extended = insn.Bits(74, 1) != 0;
+                const u32 high = insn.Bits(64, 8);
+                if (insn.Bits(72, 1) || insn.Bits(81, 3) != 7 ||
+                    (high != 255 && insn.Bits(73, 1)) || (opcode == 0x211 && insn.Bits(62, 2)) ||
+                    (opcode == 0xc11 && (insn.words[1] & ~0x3fU)))
                     return fail(index, "native high effective address mode");
-                u32 b = insn.Bits(32, 8);
+                u32 b = opcode == 0xc11 ? uniform_register(insn.Bits(32, 8)) : insn.Bits(32, 8);
+                if (b == ~0U) return fail(index, "native uniform LEA register");
                 if (opcode == 0x811) {
                     b = insn.words[1] ? 251U : 255U;
                     if (b == 251) mov_imm(251, insn.words[1]);
                 }
                 const u64 shift = (u64{32 - insn.Bits(75, 5)} << 20) | (u64{insn.Bits(73, 1)} << 48);
-                if (b == 255) {
-                    emit(base(0x3828000000000000ULL) | (u64{insn.Bits(24, 8)} << 8) | shift);
+                // The high word is a right shift of Ra, or with Rc a left funnel shift (SHF.L).
+                const auto high_word = [&](u64 target) {
+                    if (high == 255) emit(target | 0x3828000000000000ULL | (u64{insn.Bits(24, 8)} << 8) | shift);
+                    else emit(target | 0x36f8000000000000ULL | (u64{insn.Bits(24, 8)} << 8) | (u64{high} << 39) |
+                              (u64{insn.Bits(75, 5)} << 20));
+                };
+                if (b == 255 && !extended) {
+                    high_word(base(0));
                 } else {
-                    emit(0x3828000000000000ULL | predicate | 250 | (u64{insn.Bits(24, 8)} << 8) | shift);
+                    high_word(predicate | 250);
+                    if (extended) {
+                        mov_imm(252, 1);
+                        emit(0x5ca0000000000000ULL | predicate | 252 | (u64{252} << 8) | (u64{255} << 20) |
+                             (u64{insn.Bits(87, 3)} << 39) | (u64{insn.Bits(90, 1)} << 42));
+                        emit(0x5c10000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{252} << 20));
+                    }
                     emit(base(0x5c10000000000000ULL) | (u64{250} << 8) | (u64{b} << 20));
                 }
                 break;
@@ -2327,12 +2527,13 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
             // A carry out (bits 81-83) is the low half of a 64-bit address; IADD3.X adds it next.
             const u32 carry_out = insn.Bits(81, 3);
             if (insn.Bits(72, 1) || insn.Bits(74, 1) || insn.Bits(80, 1) ||
-                (carry_out != 7 && (opcode != 0x211 || insn.Bits(63, 1) || (rewritten_uniform && carry_out > 1))) ||
-                (opcode == 0x211 && insn.Bits(62, 1)) ||
-                (opcode == 0xc11 && (insn.Bits(62, 2) || uniform_register(insn.Bits(32, 8)) == ~0U)))
+                (carry_out != 7 && ((opcode != 0x811 && insn.Bits(63, 1)) ||
+                                    (rewritten_uniform && (opcode != 0x211 || carry_out > 1)))) ||
+                (opcode == 0x211 && insn.Bits(62, 1)) || (opcode == 0xc11 && (insn.words[1] & ~0x8000003fU)))
                 return fail(index, "native LEA carry/high mode");
             // 0x211 bit 63 negates Rb (LEA Rd, Ra, -Rb, s), as Maxwell ISCADD's bit 48.
             u32 b = opcode == 0xc11 ? uniform_register(insn.Bits(32, 8)) : insn.Bits(32, 8);
+            if (b == ~0U) return fail(index, "native uniform LEA register");
             if (opcode == 0x811) { mov_imm(251, insn.words[1]); b = 251; }
             if (carry_out != 7) {
                 // The sum in R250, carry = sum < Rb (unsigned), as IADD3's carry out; a uniform
@@ -2352,7 +2553,7 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
             }
             emit(base(0x5c18000000000000ULL) | (u64{insn.Bits(24, 8)} << 8) |
                  (u64{b} << 20) | (u64{insn.Bits(75, 5)} << 39) |
-                 (u64{opcode == 0x211 ? insn.Bits(63, 1) : 0U} << 48));
+                 (u64{opcode != 0x811 ? insn.Bits(63, 1) : 0U} << 48));
             break;
         }
         case 0x210: case 0x810: case 0xa10: case 0xc10: { // IADD3 with zero third source and no carry outputs
@@ -2360,7 +2561,7 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
             // a carry-in predicate (bits 87-89, negate 90). Uniform forms keep UPn in R239 bit 6-n.
             if ((opcode == 0x210 || opcode == 0x810) && insn.Bits(64, 8) == 255 && !insn.Bits(73, 1) &&
                 !insn.Bits(75, 2) && insn.Bits(84, 3) == 7 && insn.Bits(77, 4) == 15 && !insn.Bits(72, 1) &&
-                (insn.Bits(81, 3) != 7 || insn.Bits(74, 1))) {
+                (insn.Bits(81, 3) != 7 || insn.Bits(74, 1)) && (opcode == 0x810 || !insn.Bits(63, 1))) {
                 const bool carry_in = insn.Bits(74, 1) != 0;
                 const u32 carry_out = insn.Bits(81, 3);
                 const u32 a = insn.Bits(24, 8);
@@ -2403,9 +2604,65 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                 emit(base(0x5c10000000000000ULL) | (u64{250} << 8) | (u64{251} << 20));
                 break;
             }
-            if (opcode == 0xa10 && insn.Bits(81, 3) != 7) {
+            // Three sources, negations or two carries: the sum builds up in R253 (.CC) with the carry
+            // count in R254 (.X). Pu/Pv (bits 81/84) are set when the count reaches 1/2, and IADD3.X
+            // adds both carry-ins (bits 87, 77). A negated source is ~x, plus 1 unless extended.
+            const bool extended = insn.Bits(74, 1) != 0;
+            const bool negate_a = insn.Bits(72, 1), negate_b = opcode != 0x810 && insn.Bits(63, 1), negate_c = insn.Bits(75, 1);
+            if ((extended || insn.Bits(81, 6) != 0x3f) &&
+                (insn.Bits(64, 8) != 255 || insn.Bits(84, 3) != 7 || negate_a || negate_b || negate_c ||
+                 (extended && insn.Bits(77, 4) != 15))) {
+                const u32 first_output = insn.Bits(81, 3), second_output = insn.Bits(84, 3);
+                if (rewritten_uniform || guarded_uniform || insn.Bits(73, 1) || insn.Bits(76, 1) ||
+                    (first_output != 7 && first_output == second_output) ||
+                    (!extended && (insn.Bits(77, 4) != 15 || insn.Bits(87, 4) != 15)) ||
+                    (opcode == 0x210 && (insn.words[1] & ~0x800000ffU)) || (opcode == 0xa10 && insn.Bits(62, 1)) ||
+                    (opcode == 0xc10 && (insn.words[1] & ~0x8000003fU)))
+                    return fail(index, "native three-input carry mode");
+                u32 a = insn.Bits(24, 8), b = operand(1, false), c = insn.Bits(64, 8);
+                const auto invert = [&](u32& source, u32 target) {
+                    emit(0x0400000000000000ULL | predicate | target | (u64{source} << 8) | (u64{0xffffffffU} << 20) | (u64{2} << 53));
+                    source = target;
+                };
+                if (negate_a) invert(a, 250);
+                if (negate_b) invert(b, 251);
+                if (negate_c) invert(c, 252);
+                const auto accumulate = [&](u32 source) {
+                    emit(0x5c10000000000000ULL | predicate | 253 | (u64{253} << 8) | (u64{source} << 20) | (u64{1} << 47));
+                    emit(0x5c10000000000000ULL | predicate | 254 | (u64{254} << 8) | (u64{255} << 20) | (u64{1} << 43));
+                };
+                emit(0x5c10000000000000ULL | predicate | 253 | (u64{a} << 8) | (u64{b} << 20) | (u64{1} << 47));
+                emit(0x5c10000000000000ULL | predicate | 254 | (u64{255} << 8) | (u64{255} << 20) | (u64{1} << 43));
+                accumulate(c);
+                if (extended) {
+                    for (const u32 carry : {insn.Bits(87, 4), insn.Bits(77, 4)}) {
+                        if (carry == 15) continue;
+                        mov_imm(250, 1);
+                        if (carry != 7)
+                            emit(0x5ca0000000000000ULL | predicate | 250 | (u64{250} << 8) | (u64{255} << 20) |
+                                 (u64{carry & 7} << 39) | (u64{carry >> 3} << 42));
+                        accumulate(250);
+                    }
+                } else if (const u32 ones = u32{negate_a} + u32{negate_b} + u32{negate_c}) {
+                    mov_imm(250, ones);
+                    accumulate(250);
+                }
+                if (dest != 255) emit(base(0x5c98000000000000ULL) | (u64{253} << 20) | (u64{15} << 39));
+                // An output that is also the guard predicate is written last.
+                const bool guard_first = (native_predicate & 7) != 7 && first_output == (native_predicate & 7);
+                for (const u32 output : {guard_first ? 1U : 0U, guard_first ? 0U : 1U}) {
+                    const u32 target = output ? second_output : first_output;
+                    if (target == 7) continue;
+                    mov_imm(250, output + 1);
+                    emit(0x5b60000000000000ULL | predicate | 7 | (u64{target} << 3) | (u64{254} << 8) |
+                         (u64{250} << 20) | (u64{7} << 39) | (u64{6} << 49));
+                }
+                break;
+            }
+            if ((opcode == 0xa10 || opcode == 0xc10) && insn.Bits(81, 3) != 7) { // cbuf or uniform b
                 if (insn.Bits(64, 8) != 255 || insn.Bits(73, 4) || insn.Bits(84, 7) != 0x7f ||
-                    insn.Bits(77, 4) != 15 || insn.Bits(63, 1) || insn.Bits(72, 1))
+                    insn.Bits(77, 4) != 15 || insn.Bits(63, 1) || insn.Bits(72, 1) ||
+                    (opcode == 0xc10 && (insn.words[1] & ~0x3fU)))
                     return fail(index, "native constant add carry mode");
                 const u32 b = operand(1, false);
                 emit(base(0x5c10000000000000ULL) | (u64{insn.Bits(24, 8)} << 8) | (u64{b} << 20));
@@ -2413,8 +2670,9 @@ inline LoweredProgram LowerToMaxwellWith(std::span<const Instruction> code, u32
                     (dest << 8) | (u64{b} << 20) | (u64{7} << 39) | (u64{1} << 49));
                 break;
             }
-            if (opcode == 0xa10 && insn.Bits(74, 1)) {
-                if ((insn.words[2] & ~0x07800000U) != 0x007fe4ffU)
+            if ((opcode == 0xa10 || opcode == 0xc10) && insn.Bits(74, 1)) { // IADD3.X Ra + cbuf or UR + carry predicate
+                if ((insn.words[2] & ~(0x07800000U | (opcode == 0xc10 ? 0x08000000U : 0U))) != 0x007fe4ffU ||
+                    (opcode == 0xc10 && (insn.words[1] & ~0x3fU)))
                     return fail(index, "native extended constant add mode");
                 const u32 a = insn.Bits(24, 8), b = operand(1, false);
                 mov_imm(250, 1);
diff --git a/src/shader_recompiler/ir_opt/position_pass.cpp b/src/shader_recompiler/ir_opt/position_pass.cpp
index 4890346944..600a596bf3 100644
--- a/src/shader_recompiler/ir_opt/position_pass.cpp
+++ b/src/shader_recompiler/ir_opt/position_pass.cpp
@@ -83,6 +83,37 @@ void BlitConstantsPass(Environment& env, IR::Program& program) {
     if (env.ShaderStage() != Stage::VertexB && env.ShaderStage() != Stage::Fragment) {
         return;
     }
+    // Bank 24 is root table 0, which games may load themselves (3D methods 0x504/0x508; the buffer
+    // cache binds it as bank 17): Fire Emblem: Fortune's Weave keeps its material push constants
+    // there. A shader reading bank 17 outside the blit block reads such a table and keeps its reads,
+    // as does one reading only words the blit block leaves zero (an unbound bank reads zero anyway;
+    // the game's enemy health gauges read only 0x40 of their table).
+    const auto in_blit_block = [](u32 offset) {
+        return offset < 0x20 || (offset >= 0x30 && offset < 0x4c) || (offset >= 0x50 && offset < 0x60);
+    };
+    const auto is_nonzero_word = [](u32 offset) {
+        return offset < 0x20 || offset == 0x38 || offset == 0x3c || offset == 0x58 || offset == 0x5c;
+    };
+    bool reads_nonzero_word{};
+    for (IR::Block* const block : program.post_order_blocks) {
+        for (IR::Inst& inst : block->Instructions()) {
+            const IR::Opcode opcode{inst.GetOpcode()};
+            if ((opcode != IR::Opcode::GetCbufU32 && opcode != IR::Opcode::GetCbufF32 &&
+                 opcode != IR::Opcode::GetCbufU32x2) ||
+                !inst.Arg(0).IsImmediate() || inst.Arg(0).U32() != 17 || !inst.Arg(1).IsImmediate()) {
+                continue;
+            }
+            const u32 offset{inst.Arg(1).U32()};
+            const bool pair{opcode == IR::Opcode::GetCbufU32x2};
+            if (!in_blit_block(offset) || (pair && !in_blit_block(offset + 4))) {
+                return;
+            }
+            reads_nonzero_word |= is_nonzero_word(offset) || (pair && is_nonzero_word(offset + 4));
+        }
+    }
+    if (!reads_nonzero_word) {
+        return;
+    }
     bool used{};
     for (IR::Block* const block : program.post_order_blocks) {
         for (IR::Inst& inst : block->Instructions()) {
diff --git a/src/tests/CMakeLists.txt b/src/tests/CMakeLists.txt
index dd6f5d97b5..a9be2ec7a8 100644
--- a/src/tests/CMakeLists.txt
+++ b/src/tests/CMakeLists.txt
@@ -17,8 +17,10 @@ add_executable(tests
     common/undefined_fix.cpp
     common/unique_function.cpp
     core/core_timing.cpp
+    core/nup_writer.cpp
     core/internal_network/network.cpp
     video_core/memory_tracker.cpp
+    video_core/vertex_repack.cpp
     video_core/ampere_returns.cpp
     input_common/calibration_configuration_job.cpp
 )
diff --git a/src/tests/core/nup_writer.cpp b/src/tests/core/nup_writer.cpp
new file mode 100644
index 0000000000..ce1a0717ed
--- /dev/null
+++ b/src/tests/core/nup_writer.cpp
@@ -0,0 +1,392 @@
+// SPDX-FileCopyrightText: Copyright 2026 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#include <catch2/catch_test_macros.hpp>
+
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <map>
+#include <string>
+#include <vector>
+
+#include <fmt/format.h>
+#include <openssl/evp.h>
+
+#include "core/file_sys/nup_container.h"
+#include "core/file_sys/nup_writer.h"
+#include "core/file_sys/vfs/vfs_real.h"
+
+namespace {
+
+namespace fs = std::filesystem;
+using FileSys::NupContainer;
+
+struct TempDir {
+    fs::path path = fs::temp_directory_path() /
+                    ("nup-test-" +
+                     std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    TempDir() {
+        fs::create_directories(path);
+    }
+    ~TempDir() {
+        std::error_code ec;
+        fs::remove_all(path, ec);
+    }
+};
+
+void Put(const fs::path& p, std::string_view value) {
+    fs::create_directories(p.parent_path());
+    std::ofstream(p, std::ios::binary) << value;
+}
+
+std::string ReadAll(const fs::path& p) {
+    std::ifstream in(p, std::ios::binary);
+    return {std::istreambuf_iterator<char>(in), {}};
+}
+
+std::string Read(const FileSys::VirtualFile& f) {
+    std::string out(f->GetSize(), '\0');
+    f->Read(reinterpret_cast<u8*>(out.data()), out.size(), 0);
+    return out;
+}
+
+// Enough of an NPDM for the packer: the program ID at ACI0 + 0x10.
+std::string Npdm(u64 program_id) {
+    std::string npdm(0x100, '\0');
+    npdm.replace(0x80, 4, "ACI0");
+    for (int i = 0; i < 8; ++i) {
+        npdm[0x90 + i] = static_cast<char>(program_id >> (8 * i));
+    }
+    return npdm;
+}
+
+std::array<u8, 32> Sha256(std::string_view data) {
+    std::array<u8, 32> out{};
+    unsigned int length{};
+    EVP_Digest(data.data(), data.size(), out.data(), &length, EVP_sha256(), nullptr);
+    return out;
+}
+
+u64 Le(const std::string& buf, size_t at, size_t bytes) {
+    u64 value = 0;
+    for (size_t i = 0; i < bytes; ++i) {
+        value |= static_cast<u64>(static_cast<u8>(buf[at + i])) << (8 * i);
+    }
+    return value;
+}
+
+struct RawFile {
+    std::string name;
+    u64 size;
+    std::array<u8, 32> sha256;
+    u64 extent_offset;
+    u64 extent_size;
+    u8 codec;
+};
+
+// Reads the file records straight from the TOC, which NupContainer does not expose.
+std::vector<RawFile> RawFiles(const std::string& nup) {
+    const u64 toc = Le(nup, 0x08, 8);
+    const u64 packages = Le(nup, toc + 0x04, 4);
+    const u64 dirs = Le(nup, toc + 0x08, 8);
+    const u64 files = Le(nup, toc + 0x10, 8);
+    const u64 pool = toc + Le(nup, toc + 0x18, 8);
+    std::vector<RawFile> out;
+    u64 pos = toc + 0x30 + packages * 0x40 + dirs * 0x18;
+    for (u64 i = 0; i < files; ++i, pos += 0x50) {
+        RawFile file{nup.substr(pool + Le(nup, pos, 4), Le(nup, pos + 4, 4)),
+                     Le(nup, pos + 0x08, 8),
+                     {},
+                     Le(nup, pos + 0x10, 8),
+                     Le(nup, pos + 0x18, 8),
+                     static_cast<u8>(nup[pos + 0x40])};
+        std::copy_n(nup.begin() + static_cast<std::ptrdiff_t>(pos + 0x20), 32,
+                    file.sha256.begin());
+        out.push_back(file);
+    }
+    return out;
+}
+
+// Every file under `dir` with its contents, keyed by its path relative to `dir`.
+std::map<std::string, std::string> SourceTree(const fs::path& dir) {
+    std::map<std::string, std::string> out;
+    for (const auto& entry : fs::recursive_directory_iterator(dir)) {
+        if (entry.is_regular_file() && entry.path().filename() != ".listing") {
+            out[fs::relative(entry.path(), dir).generic_string()] = ReadAll(entry.path());
+        }
+    }
+    return out;
+}
+
+void PackedTree(const FileSys::VirtualDir& dir, const std::string& prefix,
+                std::map<std::string, std::string>& out) {
+    if (dir == nullptr) {
+        return;
+    }
+    for (const auto& file : dir->GetFiles()) {
+        out[prefix + file->GetName()] = Read(file);
+    }
+    for (const auto& sub : dir->GetSubdirectories()) {
+        PackedTree(sub, prefix + sub->GetName() + "/", out);
+    }
+}
+
+std::map<std::string, std::string> PackedTree(const FileSys::VirtualDir& dir) {
+    std::map<std::string, std::string> out;
+    PackedTree(dir, "", out);
+    return out;
+}
+
+constexpr u64 TitleId = 0x0400ABCD00010000ULL;
+
+void MakeDump(const fs::path& root) {
+    Put(root / "Base/ExeFS/main", "base main");
+    Put(root / "Base/ExeFS/main.npdm", Npdm(TitleId));
+    Put(root / "Base/RomFS/shared.bin", std::string(5000, 's'));
+    Put(root / "Base/RomFS/copy/shared.bin", std::string(5000, 's'));
+    Put(root / "Base/RomFS/empty", "");
+    Put(root / "Base/RomFS/.listing", "listing");
+    Put(root / "Base/RomFS/System/Resource/ResourceSizeTable.Product.100.rsizetable", "rst");
+    Put(root / "Base/RomFS/big.bin", std::string(64 * 1024, 'b'));
+    Put(root / "Base/RomFS/random.bin", [] {
+        std::string data(3000, '\0');
+        u32 x = 12345;
+        for (auto& c : data) {
+            x = x * 1664525 + 1013904223;
+            c = static_cast<char>(x >> 24);
+        }
+        return data;
+    }());
+    Put(root / "updates/65536/exefs/main", "update main");
+    Put(root / "updates/65536/exefs/main.npdm", Npdm(TitleId));
+    Put(root / "updates/65536/romfs/shared.bin", std::string(5000, 's'));
+    Put(root / "updates/65536/romfs/System/Resource/ResourceSizeTable.Product.110.rsizetable",
+        "rst");
+    Put(root / "updates/65536/romfs/Zeta/a", "a");
+    Put(root / "updates/65536/romfs/alpha", "alpha");
+    Put(root / "updates/131072/exefs/main", "update 2 main");
+    Put(root / "updates/131072/exefs/main.npdm", Npdm(TitleId));
+    Put(root / "dlc/0400ABCD00011001/0/romfs/addon.bin", "addon data");
+}
+
+} // namespace
+
+TEST_CASE("NUP packs base, updates and add-ons and reads back through NupContainer", "[nup]") {
+    TempDir t;
+    const auto root = t.path / "Game";
+    MakeDump(root);
+    const auto archive = t.path / "Game.nup";
+    FileSys::Nup::PackOptions options{.raw_threshold = 16 * 1024};
+    std::string error;
+    REQUIRE(FileSys::Nup::PackDump(root, archive, options, {}, nullptr, &error) ==
+            FileSys::Nup::PackResult::Success);
+    INFO(error);
+    REQUIRE_FALSE(fs::exists(archive.string() + ".part"));
+
+    FileSys::RealVfsFilesystem real;
+    NupContainer nup{real.OpenFile(archive.string(), FileSys::OpenMode::Read)};
+    REQUIRE(nup.GetStatus() == Loader::ResultStatus::Success);
+    REQUIRE(nup.VerifyIntegrity({}) == Loader::ResultStatus::Success);
+
+    const auto& packages = nup.GetPackages();
+    REQUIRE(packages.size() == 4);
+    REQUIRE(packages[0].kind == NupContainer::PackageKind::Base);
+    REQUIRE(packages[0].title_id == TitleId);
+    REQUIRE(packages[0].version == 0);
+    REQUIRE(packages[0].npdm.size() == 0x100);
+    REQUIRE(packages[1].kind == NupContainer::PackageKind::Update);
+    REQUIRE(packages[1].version == 65536);
+    REQUIRE(packages[1].title_id == TitleId);
+    REQUIRE_FALSE(packages[1].standalone_update);
+    REQUIRE(packages[2].kind == NupContainer::PackageKind::Update);
+    REQUIRE(packages[2].version == 131072);
+    REQUIRE(packages[2].romfs_dir == 0xFFFFFFFF);
+    REQUIRE(packages[3].kind == NupContainer::PackageKind::Addon);
+    REQUIRE(packages[3].title_id == 0x0400ABCD00011001ULL);
+    REQUIRE(packages[3].exefs_dir == 0xFFFFFFFF);
+    REQUIRE(nup.FindBestUpdatePackage() == 2);
+
+    REQUIRE(PackedTree(nup.GetExeFSDir(0)) == SourceTree(root / "Base/ExeFS"));
+    REQUIRE(PackedTree(nup.GetRomFSDir(0)) == SourceTree(root / "Base/RomFS"));
+    REQUIRE(PackedTree(nup.GetExeFSDir(1)) == SourceTree(root / "updates/65536/exefs"));
+    REQUIRE(PackedTree(nup.GetRomFSDir(1)) == SourceTree(root / "updates/65536/romfs"));
+    REQUIRE(PackedTree(nup.GetExeFSDir(2)) == SourceTree(root / "updates/131072/exefs"));
+    REQUIRE(PackedTree(nup.GetRomFSDir(3)) == SourceTree(root / "dlc/0400ABCD00011001/0/romfs"));
+    REQUIRE_FALSE(nup.GetRomFSDir(0)->GetFile(".listing"));
+
+    const auto bytes = ReadAll(archive);
+    const auto files = RawFiles(bytes);
+    std::map<std::string, std::vector<RawFile>> by_name;
+    for (const auto& file : files) {
+        by_name[file.name].push_back(file);
+        if (file.size != 0) {
+            REQUIRE(file.extent_offset % 16 == 0);
+        }
+    }
+    const auto shared = by_name.at("shared.bin");
+    REQUIRE(shared.size() == 3);
+    for (const auto& file : shared) {
+        REQUIRE(file.sha256 == Sha256(std::string(5000, 's')));
+        REQUIRE(file.codec == 1);
+        REQUIRE(file.extent_offset == shared[0].extent_offset);
+        REQUIRE(file.extent_size == shared[0].extent_size);
+    }
+    const auto& empty = by_name.at("empty").at(0);
+    REQUIRE(empty.size == 0);
+    REQUIRE(empty.extent_offset == 0);
+    REQUIRE(empty.extent_size == 0);
+    REQUIRE(empty.codec == 0);
+    REQUIRE(empty.sha256 == Sha256(""));
+    // Highly compressible, but above the raw threshold.
+    const auto& big = by_name.at("big.bin").at(0);
+    REQUIRE(big.codec == 0);
+    REQUIRE(big.extent_size == 64 * 1024);
+    REQUIRE(big.sha256 == Sha256(std::string(64 * 1024, 'b')));
+    // Incompressible, so stored raw.
+    const auto& random = by_name.at("random.bin").at(0);
+    REQUIRE(random.codec == 0);
+    REQUIRE(random.extent_size == 3000);
+    REQUIRE_FALSE(by_name.contains(".listing"));
+}
+
+TEST_CASE("NUP marks updates standalone when the dump has no base", "[nup]") {
+    TempDir t;
+    const auto root = t.path / "Game";
+    Put(root / "updates/65536/exefs/main", "main");
+    Put(root / "updates/65536/exefs/main.npdm", Npdm(TitleId));
+    Put(root / "updates/65536/romfs/file", "rom");
+    const auto archive = t.path / "Game.nup";
+    REQUIRE(FileSys::Nup::PackDump(root, archive) == FileSys::Nup::PackResult::Success);
+
+    FileSys::RealVfsFilesystem real;
+    NupContainer nup{real.OpenFile(archive.string(), FileSys::OpenMode::Read)};
+    REQUIRE(nup.GetStatus() == Loader::ResultStatus::Success);
+    REQUIRE(nup.GetPackages().size() == 1);
+    REQUIRE(nup.GetPackages()[0].kind == NupContainer::PackageKind::Update);
+    REQUIRE(nup.GetPackages()[0].standalone_update);
+    REQUIRE(nup.GetPackages()[0].title_id == TitleId);
+    REQUIRE(Read(nup.GetRomFSDir(0)->GetFile("file")) == "rom");
+}
+
+TEST_CASE("NUP packs a bare exefs/romfs dump as one base", "[nup]") {
+    TempDir t;
+    const auto root = t.path / "Game";
+    Put(root / "ExeFS/main", "main");
+    Put(root / "ExeFS/main.npdm", Npdm(TitleId));
+    Put(root / "RomFS/file", "rom");
+    Put(root / "notes.txt", "extra");
+    const auto archive = t.path / "Game.nup";
+    REQUIRE(FileSys::Nup::PackDump(root, archive) == FileSys::Nup::PackResult::Success);
+
+    FileSys::RealVfsFilesystem real;
+    NupContainer nup{real.OpenFile(archive.string(), FileSys::OpenMode::Read)};
+    REQUIRE(nup.GetStatus() == Loader::ResultStatus::Success);
+    REQUIRE(nup.GetPackages().size() == 1);
+    REQUIRE(nup.GetPackages()[0].kind == NupContainer::PackageKind::Base);
+    REQUIRE_FALSE(nup.GetPackages()[0].standalone_update);
+    REQUIRE(Read(nup.GetExeFSDir(0)->GetFile("main")) == "main");
+    REQUIRE(Read(nup.GetRomFSDir(0)->GetFile("file")) == "rom");
+    const auto files = RawFiles(ReadAll(archive));
+    REQUIRE(std::ranges::count(files, std::string{"notes.txt"}, &RawFile::name) == 1);
+}
+
+TEST_CASE("NUP low storage resumes and deletes the packed sources", "[nup]") {
+    TempDir t;
+    const auto root = t.path / "Game";
+    MakeDump(root);
+    const auto copy = t.path / "copy" / "Game";
+    fs::create_directories(copy);
+    fs::copy(root, copy, fs::copy_options::recursive);
+    const auto archive = t.path / "Game.nup";
+
+    std::atomic_bool cancel = false;
+    bool cancelled = false;
+    FileSys::Nup::PackOptions options{.delete_sources = true, .chunk_bytes = 1};
+    auto result = FileSys::Nup::PackDump(
+        root, archive, options,
+        [&](const auto& p) {
+            if (p.files_done >= 4 && !cancelled) {
+                cancel = true;
+                cancelled = true;
+            }
+        },
+        &cancel);
+    REQUIRE(result == FileSys::Nup::PackResult::Cancelled);
+    REQUIRE(FileSys::Nup::HasResumableJournal(archive));
+    REQUIRE_FALSE(fs::exists(root / "Base/ExeFS/main"));
+    REQUIRE_FALSE(fs::exists(root / "Base/ExeFS/main.npdm"));
+
+    cancel = false;
+    std::string error;
+    REQUIRE(FileSys::Nup::PackDump(root, archive, options, {}, &cancel, &error) ==
+            FileSys::Nup::PackResult::Success);
+    INFO(error);
+    REQUIRE_FALSE(fs::exists(archive.string() + ".journal"));
+    REQUIRE_FALSE(fs::exists(archive.string() + ".part"));
+    REQUIRE_FALSE(fs::exists(root / "Base/ExeFS"));
+    REQUIRE_FALSE(fs::exists(root / "updates"));
+    REQUIRE_FALSE(fs::exists(root / "dlc"));
+    // The listing is not packed, so it is left behind with the folders holding it.
+    REQUIRE(ReadAll(root / "Base/RomFS/.listing") == "listing");
+    REQUIRE_FALSE(fs::exists(root / "Base/RomFS/shared.bin"));
+
+    FileSys::RealVfsFilesystem real;
+    NupContainer nup{real.OpenFile(archive.string(), FileSys::OpenMode::Read)};
+    REQUIRE(nup.GetStatus() == Loader::ResultStatus::Success);
+    REQUIRE(nup.VerifyIntegrity({}) == Loader::ResultStatus::Success);
+    REQUIRE(nup.GetPackages().size() == 4);
+    const auto npdm = Npdm(TitleId);
+    REQUIRE(nup.GetPackages()[0].npdm == std::vector<u8>(npdm.begin(), npdm.end()));
+    REQUIRE(PackedTree(nup.GetRomFSDir(0)) == SourceTree(copy / "Base/RomFS"));
+    REQUIRE(PackedTree(nup.GetRomFSDir(1)) == SourceTree(copy / "updates/65536/romfs"));
+
+    // The resumed archive matches one packed in a single pass.
+    const auto again = t.path / "again.nup";
+    REQUIRE(FileSys::Nup::PackDump(copy, again) == FileSys::Nup::PackResult::Success);
+    REQUIRE(ReadAll(archive) == ReadAll(again));
+}
+
+TEST_CASE("NUP rejects overwrite and a dump without NPDM", "[nup]") {
+    TempDir t;
+    const auto root = t.path / "Game";
+    Put(root / "exefs/main", "main");
+    Put(root / "romfs/a", "rom");
+    const auto archive = t.path / "out.nup";
+    Put(archive, "existing");
+    REQUIRE(FileSys::Nup::PackDump(root, archive) == FileSys::Nup::PackResult::IoError);
+    REQUIRE(ReadAll(archive) == "existing");
+    fs::remove(archive);
+    REQUIRE(FileSys::Nup::PackDump(root, archive) == FileSys::Nup::PackResult::InvalidSource);
+    REQUIRE_FALSE(fs::exists(archive.string() + ".part"));
+}
+
+// Archives are meant to be byte-identical on every platform. A change to this hash means
+// packing a dump no longer reproduces archives made by earlier builds (for example after a zstd
+// update), so make it deliberately.
+TEST_CASE("NUP output is reproducible", "[nup]") {
+    TempDir t;
+    const auto root = t.path / "Game";
+    MakeDump(root);
+    // Large and compressible, so it covers what used to be zstd's multithreaded path.
+    Put(root / "Base/RomFS/large.bin", [] {
+        std::string data(20 * 1024 * 1024, '\0');
+        u32 x = 1;
+        for (auto& c : data) {
+            x = x * 1664525 + 1013904223;
+            c = static_cast<char>('a' + (x >> 28));
+        }
+        return data;
+    }());
+    const auto archive = t.path / "Game.nup";
+    REQUIRE(FileSys::Nup::PackDump(root, archive) == FileSys::Nup::PackResult::Success);
+
+    std::string hex;
+    for (const u8 b : Sha256(ReadAll(archive))) {
+        hex += fmt::format("{:02x}", b);
+    }
+    REQUIRE(hex == "df8446903ab2c39a51af0304935eb4aa5d8ead105440976ceae7ab97133f6143");
+}
diff --git a/src/tests/video_core/ampere_returns.cpp b/src/tests/video_core/ampere_returns.cpp
index 56b8b374da..163758e07e 100644
--- a/src/tests/video_core/ampere_returns.cpp
+++ b/src/tests/video_core/ampere_returns.cpp
@@ -48,4 +48,31 @@ TEST_CASE("Ampere callees still reject writes to the link", "[video_core][ampere
     REQUIRE(lowered.error == "native callee overwrites link register");
     REQUIRE(lowered.error_offset == 0x30);
 }
+
+TEST_CASE("Ampere callees can compare into predicates with an R0 link", "[video_core][ampere]") {
+    // ISETP's zero destination field is not a write to R0.
+    const std::array<Instruction, 5> code{{
+        {{0x00007802, 0x20, 0x00000f00, 0}},
+        {{0x00007944, 0x10, 0x03c00000, 0}},
+        {{0x0000794d, 0, 0x03800000, 0}},
+        {{0x0100720c, 0x00000002, 0x03f06070, 0}},
+        {{0x00007950, 0xffffffb0, 0x03c3ffff, 0}},
+    }};
+    REQUIRE(static_cast<bool>(LowerToMaxwell(code)));
+}
+
+TEST_CASE("Ampere callees reject a wide multiply over the link", "[video_core][ampere]") {
+    // IMAD.WIDE.U32 R54:R55 writes the R55 link.
+    const std::array<Instruction, 5> code{{
+        {{0x00377802, 0x20, 0x00000f00, 0}},
+        {{0x00007944, 0x10, 0x03c00000, 0}},
+        {{0x0000794d, 0, 0x03800000, 0}},
+        {{0x01367225, 0x00000002, 0x078e00ff, 0}},
+        {{0x37007950, 0xffffffb0, 0x03c3ffff, 0}},
+    }};
+    const auto lowered = LowerToMaxwell(code);
+    REQUIRE(!static_cast<bool>(lowered));
+    REQUIRE(lowered.error == "native callee overwrites link register");
+    REQUIRE(lowered.error_offset == 0x30);
+}
 } // namespace
diff --git a/src/tests/video_core/vertex_repack.cpp b/src/tests/video_core/vertex_repack.cpp
new file mode 100644
index 0000000000..6409be3ca4
--- /dev/null
+++ b/src/tests/video_core/vertex_repack.cpp
@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#include <catch2/catch_test_macros.hpp>
+#include "video_core/renderer_vulkan/vertex_repack.h"
+
+namespace {
+using Regs = Tegra::Engines::Maxwell3D::Regs;
+using Size = Regs::VertexAttribute::Size;
+
+Regs MakeLayout() {
+    Regs regs{};
+    for (auto& attr : regs.vertex_attrib_format) {
+        attr.constant.Assign(1);
+    }
+    regs.vertex_streams[0].stride.Assign(69);
+    auto& position = regs.vertex_attrib_format[0];
+    position.constant.Assign(0);
+    position.size.Assign(Size::Size_R32_G32_B32);
+    auto& packed = regs.vertex_attrib_format[1];
+    packed.constant.Assign(0);
+    packed.offset.Assign(65);
+    packed.size.Assign(Size::Size_A2_B10_G10_R10);
+    return regs;
+}
+}
+
+TEST_CASE("Vertex repacking preserves aligned fields and relocates packed tail", "[vertex_repack]") {
+    const auto regs = MakeLayout();
+    const auto mask = Vulkan::VertexRepackMask(regs);
+    REQUIRE(mask == 1);
+    REQUIRE(Vulkan::RepackedVertexOffset(mask, 0, 0) == 0);
+    REQUIRE(Vulkan::RepackedVertexOffset(mask, 0, 64) == 64);
+    REQUIRE(Vulkan::RepackedVertexOffset(mask, 0, 65) == 68);
+    REQUIRE(Vulkan::RepackedVertexStride(mask, 0, 69) == 72);
+    REQUIRE(Vulkan::RepackedVertexStride(mask, 1, 16) == 16);
+}
+
+TEST_CASE("Vertex repacking excludes overlapping and oversized attributes", "[vertex_repack]") {
+    auto regs = MakeLayout();
+    auto& attr = regs.vertex_attrib_format[2];
+    attr.constant.Assign(0);
+    attr.offset.Assign(64);
+    attr.size.Assign(Size::Size_R32);
+    REQUIRE(Vulkan::VertexRepackMask(regs) == 0);
+    attr.offset.Assign(68);
+    REQUIRE(Vulkan::VertexRepackMask(regs) == 0);
+    attr.constant.Assign(1);
+    REQUIRE(Vulkan::VertexRepackMask(regs) == 1);
+}
+
+TEST_CASE("Vertex repacking ignores constant invalid formats", "[vertex_repack]") {
+    auto regs = MakeLayout();
+    REQUIRE(Vulkan::VertexRepackMask(regs) == 1);
+    regs.vertex_attrib_format[2].constant.Assign(0);
+    REQUIRE(Vulkan::VertexRepackMask(regs) == 0);
+}
+
+TEST_CASE("Vertex repacking selects bindings independently", "[vertex_repack]") {
+    auto regs = MakeLayout();
+    regs.vertex_streams[31].stride.Assign(69);
+    auto& attr = regs.vertex_attrib_format[2];
+    attr = regs.vertex_attrib_format[1];
+    attr.buffer.Assign(31);
+    REQUIRE(Vulkan::VertexRepackMask(regs) == 0x80000001U);
+    regs.vertex_streams[0].stride.Assign(72);
+    REQUIRE(Vulkan::VertexRepackMask(regs) == 0x80000000U);
+    REQUIRE(Vulkan::RepackedVertexOffset(0x80000000U, 0, 65) == 65);
+}
+
+TEST_CASE("Vertex repacking requires the captured tail and stride", "[vertex_repack]") {
+    auto regs = MakeLayout();
+    regs.vertex_streams[0].stride.Assign(68);
+    REQUIRE(Vulkan::VertexRepackMask(regs) == 0);
+    regs.vertex_streams[0].stride.Assign(69);
+    regs.vertex_attrib_format[1].offset.Assign(64);
+    REQUIRE(Vulkan::VertexRepackMask(regs) == 0);
+}
+
+TEST_CASE("Static vertex repacking requires explicit experimental opt-in", "[vertex_repack]") {
+    REQUIRE(Vulkan::VertexRepackInputSupported(true, false));
+    REQUIRE_FALSE(Vulkan::VertexRepackInputSupported(false, false));
+    REQUIRE(Vulkan::VertexRepackInputSupported(false, true));
+}
+
+TEST_CASE("Vertex repack planning keeps descriptor offsets aligned", "[vertex_repack]") {
+    for (const u32 alignment : {4U, 16U, 64U, 256U, 4096U}) {
+        for (const u32 offset : {0U, 1U, 3U, 255U, 4099U}) {
+            const auto plan = Vulkan::MakeVertexRepackParameters(offset, 70, alignment, 1U << 20, 65535);
+            REQUIRE(plan.has_value());
+            REQUIRE(plan->source_base % alignment == 0);
+            REQUIRE(plan->source_base + plan->source_bias == offset);
+            REQUIRE(plan->vertices == 2);
+            REQUIRE(plan->output_size == 144);
+            REQUIRE(plan->source_range >= plan->source_bias + 70);
+            REQUIRE(plan->source_range % 4 == 0);
+            REQUIRE(plan->dispatch_groups == 1);
+        }
+    }
+}
+
+TEST_CASE("Vertex repack planning rejects overflow and device-limit violations", "[vertex_repack]") {
+    REQUIRE_FALSE(Vulkan::MakeVertexRepackParameters(0, 0, 256, 1U << 20, 65535));
+    REQUIRE_FALSE(Vulkan::MakeVertexRepackParameters(0, 69, 0, 1U << 20, 65535));
+    REQUIRE_FALSE(Vulkan::MakeVertexRepackParameters(0, 69, 256, 71, 65535));
+    REQUIRE_FALSE(Vulkan::MakeVertexRepackParameters(255, 69, 256, 323, 65535));
+    REQUIRE_FALSE(Vulkan::MakeVertexRepackParameters(0, 69, 256, 1U << 20, 0));
+    REQUIRE_FALSE(Vulkan::MakeVertexRepackParameters(0, 0xffffffffU, 256, ~u64{0}, 0xffffffffU));
+    const auto one = Vulkan::MakeVertexRepackParameters(0, 69, 256, 72, 1);
+    REQUIRE(one.has_value());
+    REQUIRE(one->source_range == 72);
+}
diff --git a/src/video_core/buffer_cache/buffer_cache.h b/src/video_core/buffer_cache/buffer_cache.h
index a030b563d4..53bbae7610 100644
--- a/src/video_core/buffer_cache/buffer_cache.h
+++ b/src/video_core/buffer_cache/buffer_cache.h
@@ -390,6 +390,10 @@ template <class P>
 void BufferCache<P>::BindGraphicsUniformBuffer(size_t stage, u32 index, GPUVAddr gpu_addr,
                                                u32 size) {
     const std::optional<DAddr> device_addr = gpu_memory->GpuToCpuAddress(gpu_addr);
+    if (!device_addr) {
+        channel_state->uniform_buffers[stage][index] = NULL_BINDING;
+        return;
+    }
     const Binding binding{
         .device_addr = *device_addr,
         .size = size,
@@ -400,7 +404,11 @@ void BufferCache<P>::BindGraphicsUniformBuffer(size_t stage, u32 index, GPUVAddr
 
 template <class P>
 void BufferCache<P>::DisableGraphicsUniformBuffer(size_t stage, u32 index) {
-    channel_state->uniform_buffers[stage][index] = NULL_BINDING;
+    auto& current = channel_state->uniform_buffers[stage][index];
+    if (current.device_addr == 0 && current.size == 0 && !current.buffer_id) [[likely]] {
+        return;
+    }
+    current = NULL_BINDING;
 }
 
 template <class P>
@@ -1005,6 +1013,26 @@ void BufferCache<P>::BindHostGraphicsUniformBuffers(size_t stage) {
 template <class P>
 void BufferCache<P>::BindHostGraphicsUniformBuffer(size_t stage, u32 index, u32 binding_index, bool needs_bind) {
     ++channel_state->uniform_cache_shots[0];
+    // Bank 24 (root table 0, NVN2's push constants) is read from bank 17, which such games do not
+    // bind: stream the table's current words as that buffer.
+    if (index == 17 && maxwell3d->root_tables.loaded && channel_state->uniform_buffers[stage][index].size == 0) {
+        const auto& words = maxwell3d->root_tables.tables[0];
+        const u32 size = (*channel_state->uniform_buffer_sizes)[stage][index];
+        const u32 copied = (std::min)(size, static_cast<u32>(sizeof(words)));
+        if constexpr (IS_OPENGL) {
+            std::array<u8, sizeof(words)> data{};
+            std::memcpy(data.data(), words.data(), copied);
+            runtime.BindFastUniformBuffer(stage, binding_index, copied);
+            runtime.PushFastUniformBuffer(stage, binding_index, std::span<const u8>(data.data(), copied));
+        } else {
+            const std::span<u8> span = runtime.BindMappedUniformBuffer(stage, binding_index, size);
+            std::memset(span.data(), 0, span.size());
+            std::memcpy(span.data(), words.data(), copied);
+        }
+        channel_state->fast_bound_uniform_buffers[stage] |= 1u << binding_index;
+        channel_state->uniform_buffer_binding_sizes[stage][binding_index] = size;
+        return;
+    }
     const Binding& binding = channel_state->uniform_buffers[stage][index];
     const DAddr device_addr = binding.device_addr;
     const u32 size = (std::min)(binding.size, (*channel_state->uniform_buffer_sizes)[stage][index]);
@@ -1505,6 +1533,9 @@ void BufferCache<P>::UpdateDrawIndirect() {
 
 template <class P>
 void BufferCache<P>::UpdateUniformBuffers(size_t stage) {
+    if (channel_state->enabled_uniform_buffer_masks[stage] == 0) [[likely]] {
+        return;
+    }
     ForEachEnabledBit(channel_state->enabled_uniform_buffer_masks[stage], [&](u32 index) {
         Binding& binding = channel_state->uniform_buffers[stage][index];
         if (binding.buffer_id) {
@@ -1522,6 +1553,9 @@ void BufferCache<P>::UpdateUniformBuffers(size_t stage) {
 
 template <class P>
 void BufferCache<P>::UpdateStorageBuffers(size_t stage) {
+    if (channel_state->enabled_storage_buffers[stage] == 0) [[likely]] {
+        return;
+    }
     ForEachEnabledBit(channel_state->enabled_storage_buffers[stage], [&](u32 index) {
         // Resolve buffer
         Binding& binding = channel_state->storage_buffers[stage][index];
@@ -1534,6 +1568,9 @@ void BufferCache<P>::UpdateStorageBuffers(size_t stage) {
 
 template <class P>
 void BufferCache<P>::UpdateTextureBuffers(size_t stage) {
+    if (channel_state->enabled_texture_buffers[stage] == 0) [[likely]] {
+        return;
+    }
     ForEachEnabledBit(channel_state->enabled_texture_buffers[stage], [&](u32 index) {
         Binding& binding = channel_state->texture_buffers[stage][index];
         binding.buffer_id = FindBuffer(binding.device_addr, binding.size, false);
@@ -1628,10 +1665,10 @@ void BufferCache<P>::MarkWrittenBuffer(BufferId buffer_id, DAddr device_addr, u3
 
 template <class P>
 BufferId BufferCache<P>::FindBuffer(DAddr device_addr, u32 size, bool sparse_compatible) {
-    if (device_addr == 0) {
+    const u64 page = device_addr >> CACHING_PAGEBITS;
+    if (device_addr == 0 || page >= page_table.size()) {
         return NULL_BUFFER_ID;
     }
-    const u64 page = device_addr >> CACHING_PAGEBITS;
     const BufferId buffer_id = page_table[page];
     if (buffer_id) {
         Buffer& buffer = slot_buffers[buffer_id];
diff --git a/src/video_core/engines/kepler_compute.cpp b/src/video_core/engines/kepler_compute.cpp
index 0377250fc1..4732167369 100644
--- a/src/video_core/engines/kepler_compute.cpp
+++ b/src/video_core/engines/kepler_compute.cpp
@@ -6,6 +6,7 @@
 
 #include <algorithm>
 #include <atomic>
+#include <bit>
 #include <bitset>
 #include <cstdlib>
 #include <fstream>
@@ -557,6 +558,7 @@ bool KeplerCompute::DispatchNativeCompute(const NativeQmdScheduler::Descriptor&
             // The console runs this on tensor cores; stand in with a plain upscale of its input.
             return UpscaleInsteadOfNativeProgram();
         }
+        RememberDlssMotionVectors();
         return false;
     }
     return true;
@@ -588,12 +590,38 @@ void KeplerCompute::DescribeNativeResources(const NativeQmdScheduler::Descriptor
 
 std::atomic<u32> g_nx2_trace_draws_after_upscale{};
 
+// Fire Emblem: Fortune's Weave's first DLSS pass (rejected, before the network) has the input colour
+// at cbuf0+0x278, its motion vectors (R16G16 float, the input's size) at +0x290 and this frame's
+// camera jitter (x, y; input pixels, Halton bases 2 and 3 less 0.5) at +0x1b0.
+void KeplerCompute::RememberDlssMotionVectors() {
+    const auto& cbuf = launch_description.const_buffer_config[0];
+    if (cbuf.size.Value() < 0x294) return;
+    const GPUVAddr cbuf_address = (GPUVAddr{cbuf.address_high} << 32) | cbuf.address_low;
+    const auto image = [&](u32 offset) -> std::optional<Texture::TICEntry> {
+        const u32 tic_index = memory_manager.Read<u32>(cbuf_address + offset) & 0xfffff;
+        if (tic_index > regs.tic.limit) return std::nullopt;
+        return GetTICEntry(tic_index);
+    };
+    const auto color = image(0x278), motion = image(0x290);
+    if (!color || !motion || color->format != Texture::TextureFormat::B10G11R11 ||
+        motion->format != Texture::TextureFormat::R16G16 || motion->Address() == 0 ||
+        motion->Width() != color->Width() || motion->Height() != color->Height() ||
+        !motion->IsBlockLinear())
+        return;
+    dlss_motion_vectors = *motion;
+    dlss_motion_color = color->Address();
+    dlss_jitter = {std::bit_cast<f32>(memory_manager.Read<u32>(cbuf_address + 0x1b0)),
+                   std::bit_cast<f32>(memory_manager.Read<u32>(cbuf_address + 0x1b4))};
+}
+
 // Title 4's upscaler reads the tonemapped frame through the texture handle at cbuf0+0x90 and
 // writes the output resolution image through the surface handle at cbuf0+0xa0 (from its
-// TLD/SUST operands); Kirby Air Riders' reads a 2048x1152 image at cbuf0+0x80 and writes a
-// 2560x1440 one at +0x90. Blit one to the other with bilinear filtering when both are plain 2D
-// images of the same format and the output is larger: title 4's slots first, else the first two
-// handles in cbuf0+0x80..0x11c that form such a pair.
+// TLD/SUST operands). Kirby Air Riders' reads a 2048x1152 image at cbuf0+0x80 and writes a
+// 2560x1440 one at +0x90; Fire Emblem: Fortune's Weave's DLSS network ends with a pass that reads
+// the input colour through cbuf0+0x328 and writes the DLSS output through cbuf0+0x348 (B10G11R11;
+// 720p to 1440p docked). Blit one to the other with bilinear filtering when both are plain 2D
+// images of the same format and the output is larger: title 4's slots first, then Fortune's
+// Weave's, else the first two handles in cbuf0+0x80..0x11c that form such a pair.
 bool KeplerCompute::UpscaleInsteadOfNativeProgram() {
     const auto& cbuf = launch_description.const_buffer_config[0];
     const GPUVAddr cbuf_address = (GPUVAddr{cbuf.address_high} << 32) | cbuf.address_low;
@@ -609,6 +637,12 @@ bool KeplerCompute::UpscaleInsteadOfNativeProgram() {
                to->IsBlockLinear();
     };
     std::optional<Texture::TICEntry> input = image(0x90), output = image(0xa0);
+    bool fortunes_weave = false;
+    if (!upscale_pair(input, output)) {
+        input = image(0x328);
+        output = image(0x348);
+        fortunes_weave = upscale_pair(input, output);
+    }
     if (!upscale_pair(input, output)) {
         input.reset();
         output.reset();
@@ -723,7 +757,24 @@ bool KeplerCompute::UpscaleInsteadOfNativeProgram() {
             source.format = static_cast<RTFormat>(std::strtoul(value, nullptr, 16));
         }
     }
-    const bool done = rasterizer->AccelerateSurfaceCopy(source, surface(*output), config);
+    // Fortune's Weave: a temporal upscale along its motion vectors that undoes this frame's camera
+    // jitter (both from the frame's first DLSS pass) and accumulates the frames as DLSS would.
+    // EDEN_NX2_TEMPORAL_UPSCALE=0 blits instead.
+    const auto upscale_temporally = [&] {
+        static const bool enabled = [] {
+            const char* value = std::getenv("EDEN_NX2_TEMPORAL_UPSCALE");
+            return value == nullptr || std::string_view{value} != "0";
+        }();
+        if (!fortunes_weave || !enabled || !dlss_motion_vectors ||
+            dlss_motion_color != input->Address())
+            return false;
+        Fermi2D::Surface motion = surface(*dlss_motion_vectors);
+        motion.format = RTFormat::R16G16_FLOAT;
+        return rasterizer->AccelerateTemporalUpscale(source, surface(*output), motion, dlss_jitter,
+                                                     {1.0f, 1.0f});
+    };
+    const bool done = upscale_temporally() ||
+                      rasterizer->AccelerateSurfaceCopy(source, surface(*output), config);
     if (static u32 checked{}; checked++ == sample_at) {
         const u64 size = u64{output->Width()} * output->Height() * 4;
         if (const auto device = memory_manager.GpuToCpuAddress(output->Address())) {
diff --git a/src/video_core/engines/kepler_compute.h b/src/video_core/engines/kepler_compute.h
index b525636dde..b5aee3706a 100644
--- a/src/video_core/engines/kepler_compute.h
+++ b/src/video_core/engines/kepler_compute.h
@@ -266,7 +266,15 @@ private:
     bool DispatchNativeCompute(const NativeQmdScheduler::Descriptor& descriptor);
     void ProcessNativeReportSemaphore(u32 argument);
     void DescribeNativeResources(const NativeQmdScheduler::Descriptor& qmd);
+    void RememberDlssMotionVectors();
     bool UpscaleInsteadOfNativeProgram();
+
+    /// Motion vectors of Fire Emblem: Fortune's Weave's DLSS evaluation, from its first pass (run
+    /// earlier in the frame than the network pass the stand-in replaces), with the input colour
+    /// image and camera jitter they go with.
+    std::optional<Texture::TICEntry> dlss_motion_vectors;
+    GPUVAddr dlss_motion_color{};
+    std::array<f32, 2> dlss_jitter{};
     bool ProcessNativeMethod(Core::System& system, u32 method, u32 argument, bool is_last_call);
     NativeQmdScheduler native_qmd;
     std::array<u32, 0xc00>* native_data_ram{};
diff --git a/src/video_core/engines/maxwell_3d.cpp b/src/video_core/engines/maxwell_3d.cpp
index b344514bc6..9731f54584 100644
--- a/src/video_core/engines/maxwell_3d.cpp
+++ b/src/video_core/engines/maxwell_3d.cpp
@@ -164,6 +164,8 @@ bool Maxwell3D::IsMethodExecutable(u32 method) {
     case MAXWELL3D_REG_INDEX(vertex_array_instance_first):
     case MAXWELL3D_REG_INDEX(vertex_array_instance_subsequent):
     case MAXWELL3D_REG_INDEX(draw_texture.src_y0):
+    case RootTables::SelectMethod:
+    case RootTables::LoadMethod:
     case MAXWELL3D_REG_INDEX(wait_for_idle):
     case MAXWELL3D_REG_INDEX(shadow_ram_control):
     case MAXWELL3D_REG_INDEX(load_mme.instruction_ptr):
@@ -352,6 +354,17 @@ void Maxwell3D::ProcessMethodCall(u32 method, u32 argument, u32 nonshadow_argume
         LOG_DEBUG(HW_GPU, "Native GPU surface clear: value={:#x}", argument);
     }
     switch (method) {
+    case RootTables::SelectMethod:
+        root_tables.selected = argument & 7;
+        root_tables.offset = (argument >> 8) & 0xff;
+        return;
+    case RootTables::LoadMethod:
+        if (root_tables.offset < 256 && root_tables.offset % 4 == 0) {
+            root_tables.tables[root_tables.selected][root_tables.offset / 4] = argument;
+            root_tables.loaded = true;
+        }
+        root_tables.offset += 4;
+        return;
     case MAXWELL3D_REG_INDEX(wait_for_idle):
         return rasterizer->WaitForIdle();
     case MAXWELL3D_REG_INDEX(shadow_ram_control):
@@ -829,6 +842,8 @@ bool FrontHandledOutsideDrawManager(u32 method) {
         return true;
     }
     switch (method) {
+    case Maxwell3D::RootTables::SelectMethod:
+    case Maxwell3D::RootTables::LoadMethod:
     case MAXWELL3D_REG_INDEX(wait_for_idle):
     case MAXWELL3D_REG_INDEX(shadow_ram_control):
     case MAXWELL3D_REG_INDEX(load_mme.instruction_ptr):
diff --git a/src/video_core/engines/maxwell_3d.h b/src/video_core/engines/maxwell_3d.h
index 246274c897..af0e37978e 100644
--- a/src/video_core/engines/maxwell_3d.h
+++ b/src/video_core/engines/maxwell_3d.h
@@ -3179,6 +3179,18 @@ public:
     std::array<u32, 0xc00>& GetNativeDataRam() { return native_data_ram; }
     std::span<u32> GetNativeMacroPositions() { return native_macro_context ? std::span<u32>{native_macro_context->positions} : std::span<u32>{macro_positions}; }
 
+    /// Root tables: eight 256-byte tables written inline (method 0x504 selects a table, bits 0-2,
+    /// and a byte offset, bits 8-15; each 0x508 writes the next word) that shaders read as constant
+    /// banks 24-31. NVN2 keeps push constants in bank 24, which the Ampere lowering reads as bank 17.
+    struct RootTables {
+        static constexpr u32 SelectMethod = 0x504 / 4;
+        static constexpr u32 LoadMethod = 0x508 / 4;
+        std::array<std::array<u32, 64>, 8> tables{};
+        u32 selected{};
+        u32 offset{};
+        bool loaded{};
+    } root_tables;
+
 
     /// Write the value to the register identified by method.
     void CallMethod(Core::System& system, u32 method, u32 method_argument, bool is_last_call) override;
diff --git a/src/video_core/host_shaders/CMakeLists.txt b/src/video_core/host_shaders/CMakeLists.txt
index 35b350c2cd..9ff7563ff7 100644
--- a/src/video_core/host_shaders/CMakeLists.txt
+++ b/src/video_core/host_shaders/CMakeLists.txt
@@ -14,6 +14,7 @@ set(GLSL_INCLUDES
 )
 
 set(SHADER_FILES
+    ${CMAKE_CURRENT_SOURCE_DIR}/vulkan_vertex_repack.comp
     ${CMAKE_CURRENT_SOURCE_DIR}/astc_decoder.comp
     ${CMAKE_CURRENT_SOURCE_DIR}/bc_encoder.comp
     ${CMAKE_CURRENT_SOURCE_DIR}/blit_color_float.frag
@@ -71,6 +72,7 @@ set(SHADER_FILES
     ${CMAKE_CURRENT_SOURCE_DIR}/smaa_blending_weight_calculation.frag
     ${CMAKE_CURRENT_SOURCE_DIR}/smaa_neighborhood_blending.vert
     ${CMAKE_CURRENT_SOURCE_DIR}/smaa_neighborhood_blending.frag
+    ${CMAKE_CURRENT_SOURCE_DIR}/temporal_upscale.frag
     ${CMAKE_CURRENT_SOURCE_DIR}/vulkan_blit_depth_stencil.frag
     ${CMAKE_CURRENT_SOURCE_DIR}/vulkan_color_clear.frag
     ${CMAKE_CURRENT_SOURCE_DIR}/vulkan_color_clear.vert
diff --git a/src/video_core/host_shaders/temporal_upscale.frag b/src/video_core/host_shaders/temporal_upscale.frag
new file mode 100644
index 0000000000..0e76df2b43
--- /dev/null
+++ b/src/video_core/host_shaders/temporal_upscale.frag
@@ -0,0 +1,132 @@
+// SPDX-FileCopyrightText: Copyright 2026 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// Stands in for a game's DLSS evaluation (the tensor-core network cannot run here): a temporal
+// upscale. Each frame's input samples are placed where the camera jitter put them and weighted by
+// their distance to the output pixel; they accumulate with the previous output, reprojected along
+// the game's motion vectors (bicubic) and clipped to the current 3x3 neighbourhood.
+
+#version 450
+
+layout(binding = 0) uniform sampler2D input_color;
+layout(binding = 1) uniform sampler2D motion_vectors;
+layout(binding = 2) uniform sampler2D history;
+
+layout(push_constant) uniform PushConstants {
+    // The vertex stage's texture scale and offset come first.
+    layout(offset = 16) vec2 jitter;  // this frame's sample offset, in input pixels
+    vec2 motion_scale;                // motion vector -> UV offset to the previous frame
+    float current_weight;             // largest weight of this frame; 1 ignores the history
+};
+
+layout(location = 0) in vec2 texcoord;  // 0 to 1 across the output
+layout(location = 0) out vec4 color;
+
+// The blit helper's samplers take unnormalized (texel) coordinates.
+
+// Blending in a range-compressed space keeps bright pixels from dominating the average.
+vec3 Compress(vec3 c) {
+    return c / (1.0 + max(max(c.r, c.g), c.b));
+}
+
+vec3 Expand(vec3 c) {
+    c = clamp(c, vec3(0.0), vec3(1.0 - 1.0 / 65504.0));
+    return c / (1.0 - max(max(c.r, c.g), c.b));
+}
+
+vec3 RgbToYCoCg(vec3 c) {
+    return vec3(dot(c, vec3(0.25, 0.5, 0.25)), dot(c, vec3(0.5, 0.0, -0.5)),
+                dot(c, vec3(-0.25, 0.5, -0.25)));
+}
+
+vec3 YCoCgToRgb(vec3 c) {
+    return vec3(c.x + c.y - c.z, c.x + c.z, c.x - c.y - c.z);
+}
+
+// Moves value towards the box centre until it lies inside the box.
+vec3 ClipToBox(vec3 value, vec3 low, vec3 high) {
+    const vec3 center = 0.5 * (low + high);
+    const vec3 extent = 0.5 * (high - low) + 1.0 / 65504.0;
+    const vec3 offset = value - center;
+    const vec3 units = abs(offset / extent);
+    const float largest = max(units.x, max(units.y, units.z));
+    return largest > 1.0 ? center + offset / largest : value;
+}
+
+// Catmull-Rom filtered history from five bilinear fetches: repeated bilinear reprojection would
+// blur the accumulated image a little more every frame.
+vec3 SampleHistory(vec2 position) {
+    const vec2 texel1 = floor(position - 0.5) + 0.5;
+    const vec2 f = position - texel1;
+    const vec2 w0 = f * (-0.5 + f * (1.0 - 0.5 * f));
+    const vec2 w1 = 1.0 + f * f * (-2.5 + 1.5 * f);
+    const vec2 w2 = f * (0.5 + f * (2.0 - 1.5 * f));
+    const vec2 w3 = f * f * (-0.5 + 0.5 * f);
+    const vec2 w12 = w1 + w2;
+    const vec2 texel0 = texel1 - 1.0;
+    const vec2 texel3 = texel1 + 2.0;
+    const vec2 texel12 = texel1 + w2 / w12;
+    vec3 sum = texture(history, vec2(texel12.x, texel0.y)).rgb * (w12.x * w0.y);
+    sum += texture(history, vec2(texel0.x, texel12.y)).rgb * (w0.x * w12.y);
+    sum += texture(history, texel12).rgb * (w12.x * w12.y);
+    sum += texture(history, vec2(texel3.x, texel12.y)).rgb * (w3.x * w12.y);
+    sum += texture(history, vec2(texel12.x, texel3.y)).rgb * (w12.x * w3.y);
+    const float weight = w12.x * w0.y + w0.x * w12.y + w12.x * w12.y + w3.x * w12.y + w12.x * w3.y;
+    return max(sum / weight, vec3(0.0));
+}
+
+void main() {
+    const ivec2 input_size = textureSize(input_color, 0);
+    const ivec2 motion_size = textureSize(motion_vectors, 0);
+    // The output pixel's centre in input pixels. Input texel k sampled the scene at k + 0.5 - jitter
+    // (the sign measured against consecutive frames).
+    const vec2 target = texcoord * vec2(input_size);
+    const ivec2 nearest = ivec2(floor(target + jitter));
+
+    vec3 filtered = vec3(0.0);
+    float total_weight = 0.0;
+    float nearest_weight = 0.0;
+    vec3 sum = vec3(0.0);
+    vec3 squares = vec3(0.0);
+    vec2 motion = vec2(0.0);
+    float longest = -1.0;
+    for (int y = -1; y <= 1; ++y) {
+        for (int x = -1; x <= 1; ++x) {
+            const ivec2 texel = clamp(nearest + ivec2(x, y), ivec2(0), input_size - 1);
+            const vec3 sample_color = RgbToYCoCg(Compress(texelFetch(input_color, texel, 0).rgb));
+            // A Blackman-Harris-like window over the sample's distance to the output pixel.
+            const vec2 distance = vec2(texel) + 0.5 - jitter - target;
+            const float weight = exp(-2.29 * dot(distance, distance));
+            filtered += sample_color * weight;
+            total_weight += weight;
+            nearest_weight = max(nearest_weight, weight);
+            sum += sample_color;
+            squares += sample_color * sample_color;
+            // The longest motion around the pixel, so that an edge follows the object in front.
+            const vec2 candidate =
+                texelFetch(motion_vectors, clamp(texel, ivec2(0), motion_size - 1), 0).rg;
+            const float length_squared = dot(candidate, candidate);
+            if (length_squared > longest) {
+                longest = length_squared;
+                motion = candidate;
+            }
+        }
+    }
+    const vec3 current = filtered / total_weight;
+    const vec3 mean = sum / 9.0;
+    const vec3 deviation = sqrt(max(squares / 9.0 - mean * mean, vec3(0.0)));
+    const vec3 low = mean - deviation;
+    const vec3 high = mean + deviation;
+
+    const vec2 previous = texcoord + motion * motion_scale;
+    // A frame whose samples land close to this pixel counts more; one whose samples land between
+    // pixels mostly keeps the history (from other jitter positions) there.
+    float weight = current_weight * nearest_weight;
+    if (current_weight >= 1.0 || any(lessThan(previous, vec2(0.0))) ||
+        any(greaterThan(previous, vec2(1.0)))) {
+        weight = 1.0;
+    }
+    const vec2 history_position = previous * vec2(textureSize(history, 0));
+    const vec3 past = ClipToBox(RgbToYCoCg(Compress(SampleHistory(history_position))), low, high);
+    color = vec4(Expand(YCoCgToRgb(mix(past, current, weight))), 1.0);
+}
diff --git a/src/video_core/host_shaders/vulkan_vertex_repack.comp b/src/video_core/host_shaders/vulkan_vertex_repack.comp
new file mode 100644
index 0000000000..de9c649d93
--- /dev/null
+++ b/src/video_core/host_shaders/vulkan_vertex_repack.comp
@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#version 450
+layout(local_size_x = 128) in;
+layout(std430, set = 0, binding = 0) readonly buffer Source { uint source_words[]; };
+layout(std430, set = 0, binding = 1) writeonly buffer Destination { uint dest_words[]; };
+layout(push_constant) uniform Parameters { uint source_bias; uint source_size; uint total_words; };
+
+// Diagnostic conversion of the captured 69-byte layout: insert three bytes before offset 65.
+void main() {
+    uint word = gl_GlobalInvocationID.x;
+    if (word >= total_words) return;
+    uint vertex = word / 18;
+    uint offset = (word % 18) * 4;
+    uint value = 0;
+    for (uint i = 0; i < 4; ++i) {
+        uint dest_byte = offset + i;
+        if (dest_byte >= 65 && dest_byte < 68) continue;
+        uint src_byte = vertex * 69 + dest_byte - (dest_byte >= 68 ? 3 : 0);
+        if (src_byte >= source_size) continue;
+        uint address = source_bias + src_byte;
+        uint byte_value = (source_words[address / 4] >> ((address % 4) * 8)) & 255;
+        value |= byte_value << (i * 8);
+    }
+    dest_words[word] = value;
+}
diff --git a/src/video_core/rasterizer_interface.h b/src/video_core/rasterizer_interface.h
index b527c0e2a9..8486d44ac9 100644
--- a/src/video_core/rasterizer_interface.h
+++ b/src/video_core/rasterizer_interface.h
@@ -6,6 +6,7 @@
 
 #pragma once
 
+#include <array>
 #include <functional>
 #include <optional>
 #include <span>
@@ -162,6 +163,16 @@ public:
         return false;
     }
 
+    /// Stand-in for a DLSS evaluation: temporal upscale of src into dst along motion_vectors
+    /// (jitter in src pixels; motion_scale turns a motion vector into a UV offset to the previous
+    /// frame). False when unsupported; the caller then falls back to AccelerateSurfaceCopy.
+    [[nodiscard]] virtual bool AccelerateTemporalUpscale(
+        const Tegra::Engines::Fermi2D::Surface& src, const Tegra::Engines::Fermi2D::Surface& dst,
+        const Tegra::Engines::Fermi2D::Surface& motion_vectors, std::array<f32, 2> jitter,
+        std::array<f32, 2> motion_scale) {
+        return false;
+    }
+
     [[nodiscard]] virtual Tegra::Engines::AccelerateDMAInterface& AccessAccelerateDMA() = 0;
 
     virtual void AccelerateInlineToMemory(GPUVAddr address, size_t copy_size,
diff --git a/src/video_core/renderer_opengl/present/layer.cpp b/src/video_core/renderer_opengl/present/layer.cpp
index 9e4a0f854a..2656892f4a 100644
--- a/src/video_core/renderer_opengl/present/layer.cpp
+++ b/src/video_core/renderer_opengl/present/layer.cpp
@@ -183,6 +183,11 @@ void Layer::ConfigureFramebufferTexture(const Tegra::FramebufferConfig& framebuf
         framebuffer_texture.gl_format = GL_RGBA;
         framebuffer_texture.gl_type = GL_UNSIGNED_INT_8_8_8_8_REV;
         break;
+    case Service::android::PixelFormat::Rgba1010102:
+        internal_format = GL_RGB10_A2;
+        framebuffer_texture.gl_format = GL_RGBA;
+        framebuffer_texture.gl_type = GL_UNSIGNED_INT_2_10_10_10_REV;
+        break;
     case Service::android::PixelFormat::Rgb565:
         internal_format = GL_RGB565;
         framebuffer_texture.gl_format = GL_RGB;
diff --git a/src/video_core/renderer_vulkan/blit_image.cpp b/src/video_core/renderer_vulkan/blit_image.cpp
index ddd52e9426..edd151b563 100644
--- a/src/video_core/renderer_vulkan/blit_image.cpp
+++ b/src/video_core/renderer_vulkan/blit_image.cpp
@@ -33,6 +33,7 @@
 #include "video_core/host_shaders/convert_non_msaa_to_msaa_depth_stencil_frag_spv.h"
 #include "video_core/host_shaders/convert_s8d24_to_abgr8_frag_spv.h"
 #include "video_core/host_shaders/full_screen_triangle_vert_spv.h"
+#include "video_core/host_shaders/temporal_upscale_frag_spv.h"
 #include "video_core/host_shaders/vulkan_blit_depth_stencil_frag_spv.h"
 #include "video_core/host_shaders/vulkan_color_clear_frag_spv.h"
 #include "video_core/host_shaders/vulkan_color_clear_vert_spv.h"
@@ -91,6 +92,15 @@ struct PushConstants {
     std::array<float, 2> tex_offset;
 };
 
+// The vertex stage's PushConstants first, then those of temporal_upscale.frag.
+struct TemporalUpscalePushConstants {
+    PushConstants vertex;
+    std::array<float, 2> jitter;
+    std::array<float, 2> motion_scale;
+    float current_weight;
+    float padding;
+};
+
 struct MSAACopyPushConstants {
     std::array<s32, 2> dst_offset;
     std::array<s32, 2> src_offset;
@@ -109,6 +119,11 @@ constexpr std::array TWO_TEXTURES_DESCRIPTOR_SET_LAYOUT_BINDINGS{
     TEXTURE_DESCRIPTOR_SET_LAYOUT_BINDING<0>,
     TEXTURE_DESCRIPTOR_SET_LAYOUT_BINDING<1>,
 };
+constexpr std::array THREE_TEXTURES_DESCRIPTOR_SET_LAYOUT_BINDINGS{
+    TEXTURE_DESCRIPTOR_SET_LAYOUT_BINDING<0>,
+    TEXTURE_DESCRIPTOR_SET_LAYOUT_BINDING<1>,
+    TEXTURE_DESCRIPTOR_SET_LAYOUT_BINDING<2>,
+};
 constexpr VkDescriptorSetLayoutCreateInfo ONE_TEXTURE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO{
     .sType = VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO,
     .pNext = nullptr,
@@ -133,6 +148,13 @@ constexpr VkDescriptorSetLayoutCreateInfo TWO_TEXTURES_DESCRIPTOR_SET_LAYOUT_CRE
     .bindingCount = static_cast<u32>(TWO_TEXTURES_DESCRIPTOR_SET_LAYOUT_BINDINGS.size()),
     .pBindings = TWO_TEXTURES_DESCRIPTOR_SET_LAYOUT_BINDINGS.data(),
 };
+constexpr VkDescriptorSetLayoutCreateInfo THREE_TEXTURES_DESCRIPTOR_SET_LAYOUT_CREATE_INFO{
+    .sType = VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO,
+    .pNext = nullptr,
+    .flags = 0,
+    .bindingCount = static_cast<u32>(THREE_TEXTURES_DESCRIPTOR_SET_LAYOUT_BINDINGS.size()),
+    .pBindings = THREE_TEXTURES_DESCRIPTOR_SET_LAYOUT_BINDINGS.data(),
+};
 template <VkShaderStageFlags stageFlags, size_t size>
 inline constexpr VkPushConstantRange PUSH_CONSTANT_RANGE{
     .stageFlags = stageFlags,
@@ -357,6 +379,32 @@ void UpdateOneTextureDescriptorSet(const Device& device, VkDescriptorSet descrip
     device.GetLogical().UpdateDescriptorSets(write_descriptor_set, nullptr);
 }
 
+void UpdateThreeTexturesDescriptorSet(const Device& device, VkDescriptorSet descriptor_set,
+                                      VkSampler sampler, std::array<VkImageView, 3> image_views) {
+    std::array<VkDescriptorImageInfo, 3> image_infos{};
+    std::array<VkWriteDescriptorSet, 3> write_descriptor_sets{};
+    for (u32 binding = 0; binding < 3; ++binding) {
+        image_infos[binding] = VkDescriptorImageInfo{
+            .sampler = sampler,
+            .imageView = image_views[binding],
+            .imageLayout = VK_IMAGE_LAYOUT_GENERAL,
+        };
+        write_descriptor_sets[binding] = VkWriteDescriptorSet{
+            .sType = VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET,
+            .pNext = nullptr,
+            .dstSet = descriptor_set,
+            .dstBinding = binding,
+            .dstArrayElement = 0,
+            .descriptorCount = 1,
+            .descriptorType = VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER,
+            .pImageInfo = &image_infos[binding],
+            .pBufferInfo = nullptr,
+            .pTexelBufferView = nullptr,
+        };
+    }
+    device.GetLogical().UpdateDescriptorSets(write_descriptor_sets, nullptr);
+}
+
 void UpdateTwoTexturesDescriptorSet(const Device& device, VkDescriptorSet descriptor_set,
                                     VkSampler sampler, VkImageView image_view_0,
                                     VkImageView image_view_1) {
@@ -590,10 +638,14 @@ BlitImageHelper::BlitImageHelper(const Device& device_, Scheduler& scheduler_,
           ONE_TEXTURE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO)),
       two_textures_set_layout(device.GetLogical().CreateDescriptorSetLayout(
           TWO_TEXTURES_DESCRIPTOR_SET_LAYOUT_CREATE_INFO)),
+      three_textures_set_layout(device.GetLogical().CreateDescriptorSetLayout(
+          THREE_TEXTURES_DESCRIPTOR_SET_LAYOUT_CREATE_INFO)),
       one_texture_descriptor_allocator{
           descriptor_pool.Allocator(device_, scheduler_, *one_texture_set_layout, TEXTURE_DESCRIPTOR_BANK_INFO<1>)},
       two_textures_descriptor_allocator{
           descriptor_pool.Allocator(device_, scheduler_, *two_textures_set_layout, TEXTURE_DESCRIPTOR_BANK_INFO<2>)},
+      three_textures_descriptor_allocator{
+          descriptor_pool.Allocator(device_, scheduler_, *three_textures_set_layout, TEXTURE_DESCRIPTOR_BANK_INFO<3>)},
       one_texture_pipeline_layout(device.GetLogical().CreatePipelineLayout(PipelineLayoutCreateInfo(
           one_texture_set_layout.address(),
           PUSH_CONSTANT_RANGE<VK_SHADER_STAGE_VERTEX_BIT, sizeof(PushConstants)>))),
@@ -601,6 +653,11 @@ BlitImageHelper::BlitImageHelper(const Device& device_, Scheduler& scheduler_,
           device.GetLogical().CreatePipelineLayout(PipelineLayoutCreateInfo(
               two_textures_set_layout.address(),
               PUSH_CONSTANT_RANGE<VK_SHADER_STAGE_VERTEX_BIT, sizeof(PushConstants)>))),
+      temporal_upscale_pipeline_layout(
+          device.GetLogical().CreatePipelineLayout(PipelineLayoutCreateInfo(
+              three_textures_set_layout.address(),
+              PUSH_CONSTANT_RANGE<VK_SHADER_STAGE_VERTEX_BIT | VK_SHADER_STAGE_FRAGMENT_BIT,
+                                  sizeof(TemporalUpscalePushConstants)>))),
       clear_color_pipeline_layout(device.GetLogical().CreatePipelineLayout(PipelineLayoutCreateInfo(
           nullptr, PUSH_CONSTANT_RANGE<VK_SHADER_STAGE_FRAGMENT_BIT, sizeof(float) * 4>))),
       msaa_copy_pipeline_layout(device.GetLogical().CreatePipelineLayout(PipelineLayoutCreateInfo(
@@ -612,6 +669,7 @@ BlitImageHelper::BlitImageHelper(const Device& device_, Scheduler& scheduler_,
               PUSH_CONSTANT_RANGE<VK_SHADER_STAGE_FRAGMENT_BIT, sizeof(MSAACopyPushConstants)>))),
       full_screen_vert(BuildShader(device, FULL_SCREEN_TRIANGLE_VERT_SPV)),
       blit_color_to_color_frag(BuildShader(device, BLIT_COLOR_FLOAT_FRAG_SPV)),
+      temporal_upscale_frag(BuildShader(device, TEMPORAL_UPSCALE_FRAG_SPV)),
       blit_color_msaa_frag(BuildShader(device, BLIT_COLOR_MSAA_FRAG_SPV)),
       blit_depth_stencil_frag(device.IsExtShaderStencilExportSupported()
                              ? BuildShader(device, VULKAN_BLIT_DEPTH_STENCIL_FRAG_SPV)
@@ -702,6 +760,42 @@ void BlitImageHelper::BlitColor(const Framebuffer* dst_framebuffer, VkImageView
     });
 }
 
+void BlitImageHelper::TemporalUpscale(const Framebuffer* dst_framebuffer,
+                                      const ImageView& input_color, const ImageView& motion_vectors,
+                                      VkImageView history, const Region2D& dst_region,
+                                      std::array<f32, 2> jitter, std::array<f32, 2> motion_scale,
+                                      f32 current_weight) {
+    const VkPipelineLayout layout = *temporal_upscale_pipeline_layout;
+    const VkPipeline pipeline = FindOrEmplaceTemporalUpscalePipeline(dst_framebuffer->RenderPass());
+    const VkSampler sampler = *linear_sampler;
+    const std::array<VkImageView, 3> views{input_color.Handle(Shader::TextureType::Color2D),
+                                           motion_vectors.Handle(Shader::TextureType::Color2D),
+                                           history};
+    const TemporalUpscalePushConstants push_constants{
+        .vertex = {.tex_scale = {1.0f, 1.0f}, .tex_offset = {0.0f, 0.0f}},
+        .jitter = jitter,
+        .motion_scale = motion_scale,
+        .current_weight = current_weight,
+        .padding = 0.0f,
+    };
+    RecordShaderReadBarrier(scheduler, input_color);
+    RecordShaderReadBarrier(scheduler, motion_vectors);
+    scheduler.RequestRenderpass(dst_framebuffer);
+    scheduler.Record([this, dst_region, pipeline, layout, sampler, views,
+                      push_constants](vk::CommandBuffer cmdbuf) {
+        const VkDescriptorSet descriptor_set = three_textures_descriptor_allocator.Commit();
+        UpdateThreeTexturesDescriptorSet(device, descriptor_set, sampler, views);
+        cmdbuf.BindPipeline(VK_PIPELINE_BIND_POINT_GRAPHICS, pipeline);
+        cmdbuf.BindDescriptorSets(VK_PIPELINE_BIND_POINT_GRAPHICS, layout, 0, descriptor_set,
+                                  nullptr);
+        BindBlitState(cmdbuf, dst_region);
+        cmdbuf.PushConstants(layout, VK_SHADER_STAGE_VERTEX_BIT | VK_SHADER_STAGE_FRAGMENT_BIT,
+                             push_constants);
+        cmdbuf.Draw(3, 1, 0, 0);
+    });
+    scheduler.InvalidateState();
+}
+
 void BlitImageHelper::BlitImpl(const Framebuffer* dst_framebuffer,
                                const ImageView& src_image_view, const Region2D& dst_region,
                                const Region2D& src_region, VkPipeline pipeline, VkSampler sampler,
@@ -1285,6 +1379,59 @@ VkPipeline BlitImageHelper::FindOrEmplaceColorPipeline(const BlitImagePipelineKe
     return *blit_color_pipelines.back();
 }
 
+VkPipeline BlitImageHelper::FindOrEmplaceTemporalUpscalePipeline(VkRenderPass renderpass) {
+    const auto it = std::ranges::find(temporal_upscale_keys, renderpass);
+    if (it != temporal_upscale_keys.end()) {
+        return *temporal_upscale_pipelines[std::distance(temporal_upscale_keys.begin(), it)];
+    }
+    temporal_upscale_keys.push_back(renderpass);
+    const std::array stages = MakeStages(*full_screen_vert, *temporal_upscale_frag);
+    const VkPipelineColorBlendAttachmentState blend_attachment{
+        .blendEnable = VK_FALSE,
+        .srcColorBlendFactor = VK_BLEND_FACTOR_ZERO,
+        .dstColorBlendFactor = VK_BLEND_FACTOR_ZERO,
+        .colorBlendOp = VK_BLEND_OP_ADD,
+        .srcAlphaBlendFactor = VK_BLEND_FACTOR_ZERO,
+        .dstAlphaBlendFactor = VK_BLEND_FACTOR_ZERO,
+        .alphaBlendOp = VK_BLEND_OP_ADD,
+        .colorWriteMask = VK_COLOR_COMPONENT_R_BIT | VK_COLOR_COMPONENT_G_BIT |
+                          VK_COLOR_COMPONENT_B_BIT | VK_COLOR_COMPONENT_A_BIT,
+    };
+    const VkPipelineColorBlendStateCreateInfo color_blend_create_info{
+        .sType = VK_STRUCTURE_TYPE_PIPELINE_COLOR_BLEND_STATE_CREATE_INFO,
+        .pNext = nullptr,
+        .flags = 0,
+        .logicOpEnable = VK_FALSE,
+        .logicOp = VK_LOGIC_OP_CLEAR,
+        .attachmentCount = 1,
+        .pAttachments = &blend_attachment,
+        .blendConstants = {0.0f, 0.0f, 0.0f, 0.0f},
+    };
+    const VkPipelineInputAssemblyStateCreateInfo input_assembly_ci = GetPipelineInputAssemblyStateCreateInfo(device);
+    temporal_upscale_pipelines.push_back(device.GetLogical().CreateGraphicsPipeline({
+        .sType = VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_CREATE_INFO,
+        .pNext = nullptr,
+        .flags = 0,
+        .stageCount = static_cast<u32>(stages.size()),
+        .pStages = stages.data(),
+        .pVertexInputState = &PIPELINE_VERTEX_INPUT_STATE_CREATE_INFO,
+        .pInputAssemblyState = &input_assembly_ci,
+        .pTessellationState = nullptr,
+        .pViewportState = &PIPELINE_VIEWPORT_STATE_CREATE_INFO,
+        .pRasterizationState = &PIPELINE_RASTERIZATION_STATE_CREATE_INFO,
+        .pMultisampleState = &PIPELINE_MULTISAMPLE_STATE_CREATE_INFO,
+        .pDepthStencilState = nullptr,
+        .pColorBlendState = &color_blend_create_info,
+        .pDynamicState = &PIPELINE_DYNAMIC_STATE_CREATE_INFO,
+        .layout = *temporal_upscale_pipeline_layout,
+        .renderPass = renderpass,
+        .subpass = 0,
+        .basePipelineHandle = VK_NULL_HANDLE,
+        .basePipelineIndex = 0,
+    }, device.StaticPipelineCache()));
+    return *temporal_upscale_pipelines.back();
+}
+
 VkPipeline BlitImageHelper::FindOrEmplaceDepthStencilPipeline(const BlitImagePipelineKey& key) {
     const auto it = std::ranges::find(blit_depth_stencil_keys, key);
     if (it != blit_depth_stencil_keys.end()) {
diff --git a/src/video_core/renderer_vulkan/blit_image.h b/src/video_core/renderer_vulkan/blit_image.h
index 62e6743a23..303beeea5c 100644
--- a/src/video_core/renderer_vulkan/blit_image.h
+++ b/src/video_core/renderer_vulkan/blit_image.h
@@ -82,6 +82,13 @@ public:
                    VkImage src_image, VkSampler src_sampler, const Region2D& dst_region,
                    const Region2D& src_region, const Extent3D& src_size);
 
+    /// Temporal upscale (temporal_upscale.frag) into dst_framebuffer: the jittered input colour,
+    /// accumulated with the history image reprojected along the motion vectors.
+    void TemporalUpscale(const Framebuffer* dst_framebuffer, const ImageView& input_color,
+                         const ImageView& motion_vectors, VkImageView history,
+                         const Region2D& dst_region, std::array<f32, 2> jitter,
+                         std::array<f32, 2> motion_scale, f32 current_weight);
+
     void BlitColorMSAA(const Framebuffer* dst_framebuffer, const ImageView& src_image_view,
                        const Region2D& dst_region, const Region2D& src_region);
 
@@ -170,6 +177,8 @@ private:
 
     [[nodiscard]] VkPipeline FindOrEmplaceColorPipeline(const BlitImagePipelineKey& key);
 
+    [[nodiscard]] VkPipeline FindOrEmplaceTemporalUpscalePipeline(VkRenderPass renderpass);
+
     [[nodiscard]] VkPipeline FindOrEmplaceDepthStencilPipeline(const BlitImagePipelineKey& key);
 
     [[nodiscard]] VkPipeline FindOrEmplaceClearColorPipeline(const BlitImagePipelineKey& key);
@@ -207,15 +216,19 @@ private:
 
     vk::DescriptorSetLayout one_texture_set_layout;
     vk::DescriptorSetLayout two_textures_set_layout;
+    vk::DescriptorSetLayout three_textures_set_layout;
     DescriptorAllocator one_texture_descriptor_allocator;
     DescriptorAllocator two_textures_descriptor_allocator;
+    DescriptorAllocator three_textures_descriptor_allocator;
     vk::PipelineLayout one_texture_pipeline_layout;
     vk::PipelineLayout two_textures_pipeline_layout;
+    vk::PipelineLayout temporal_upscale_pipeline_layout;
     vk::PipelineLayout clear_color_pipeline_layout;
     vk::PipelineLayout msaa_copy_pipeline_layout;
     vk::PipelineLayout msaa_copy_depth_stencil_pipeline_layout;
     vk::ShaderModule full_screen_vert;
     vk::ShaderModule blit_color_to_color_frag;
+    vk::ShaderModule temporal_upscale_frag;
     vk::ShaderModule blit_color_msaa_frag;
     vk::ShaderModule blit_depth_stencil_frag;
     vk::ShaderModule blit_depth_frag;
@@ -246,6 +259,8 @@ private:
 
     std::vector<BlitImagePipelineKey> blit_color_keys;
     std::vector<vk::Pipeline> blit_color_pipelines;
+    std::vector<VkRenderPass> temporal_upscale_keys;
+    std::vector<vk::Pipeline> temporal_upscale_pipelines;
     std::vector<BlitImagePipelineKey> blit_depth_stencil_keys;
     std::vector<vk::Pipeline> blit_depth_stencil_pipelines;
     std::vector<BlitImagePipelineKey> clear_color_keys;
diff --git a/src/video_core/renderer_vulkan/fixed_pipeline_state.cpp b/src/video_core/renderer_vulkan/fixed_pipeline_state.cpp
index 9dac98c830..d1f78c0034 100644
--- a/src/video_core/renderer_vulkan/fixed_pipeline_state.cpp
+++ b/src/video_core/renderer_vulkan/fixed_pipeline_state.cpp
@@ -14,6 +14,7 @@
 #include "common/settings.h"
 #include "video_core/engines/maxwell_3d.h"
 #include "video_core/renderer_vulkan/fixed_pipeline_state.h"
+#include "video_core/renderer_vulkan/vertex_repack.h"
 #include "video_core/renderer_vulkan/vk_state_tracker.h"
 
 namespace Vulkan {
@@ -268,6 +269,18 @@ void FixedPipelineState::Refresh(Tegra::Engines::Maxwell3D& maxwell3d, DynamicFe
     if (xfb_enabled) {
         RefreshXfbState(xfb_state, regs);
     }
+    if (!dynamic_vertex_input && ExperimentalStaticVertexRepackEnabled()) {
+        const u32 repack_mask = VertexRepackMask(regs);
+        // Refresh from guest values even when only the stride changed: offsets must not accumulate.
+        for (size_t index = 0; index < attributes.size(); ++index) {
+            const auto& input = regs.vertex_attrib_format[index];
+            attributes[index].offset.Assign(RepackedVertexOffset(repack_mask, input.buffer, input.offset));
+        }
+        for (u32 binding = 0; binding < vertex_strides.size(); ++binding) {
+            vertex_strides[binding] = static_cast<u16>(RepackedVertexStride(
+                repack_mask, binding, regs.vertex_streams[binding].stride));
+        }
+    }
 }
 
 void FixedPipelineState::BlendingAttachment::Refresh(const Maxwell& regs, size_t index) {
diff --git a/src/video_core/renderer_vulkan/present/layer.cpp b/src/video_core/renderer_vulkan/present/layer.cpp
index fa24c02f6d..5652090bd7 100644
--- a/src/video_core/renderer_vulkan/present/layer.cpp
+++ b/src/video_core/renderer_vulkan/present/layer.cpp
@@ -52,6 +52,8 @@ VkFormat GetFormat(const Tegra::FramebufferConfig& framebuffer) {
         return VK_FORMAT_R5G6B5_UNORM_PACK16;
     case Service::android::PixelFormat::Bgra8888:
         return VK_FORMAT_B8G8R8A8_UNORM;
+    case Service::android::PixelFormat::Rgba1010102:
+        return VK_FORMAT_A2B10G10R10_UNORM_PACK32;
     default:
         UNIMPLEMENTED_MSG("Unknown framebuffer pixel format: {}",
                           static_cast<u32>(framebuffer.pixel_format));
diff --git a/src/video_core/renderer_vulkan/vertex_repack.h b/src/video_core/renderer_vulkan/vertex_repack.h
new file mode 100644
index 0000000000..b0849c25c7
--- /dev/null
+++ b/src/video_core/renderer_vulkan/vertex_repack.h
@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#pragma once
+
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+#include <optional>
+#include "video_core/engines/maxwell_3d.h"
+
+namespace Vulkan {
+
+constexpr bool VertexRepackInputSupported(bool dynamic_input, bool experimental_static) {
+    return dynamic_input || experimental_static;
+}
+
+inline bool ExperimentalStaticVertexRepackEnabled() {
+    static const bool enabled = [] {
+        const char* value = std::getenv("EGLANTINE_EXPERIMENTAL_STATIC_VERTEX_REPACK");
+        return value && std::strcmp(value, "1") == 0;
+    }();
+    return enabled;
+}
+
+struct VertexRepackParameters {
+    u32 vertices;
+    u32 output_size;
+    u32 source_base;
+    u32 source_bias;
+    u32 source_range;
+    u32 dispatch_groups;
+};
+
+inline std::optional<VertexRepackParameters> MakeVertexRepackParameters(
+    u32 offset, u32 size, u64 alignment, u64 max_storage_range, u32 max_dispatch_groups) {
+    if (size == 0 || alignment == 0) {
+        return std::nullopt;
+    }
+    const u64 vertices = (u64{size} + 68) / 69;
+    const u64 output_size = vertices * 72;
+    const u64 base = u64{offset} / alignment * alignment;
+    const u64 bias = offset - base;
+    const u64 range = (bias + size + 3) / 4 * 4;
+    const u64 groups = (vertices * 18 + 127) / 128;
+    if (output_size > std::numeric_limits<u32>::max() ||
+        range > std::numeric_limits<u32>::max() || output_size > max_storage_range ||
+        range > max_storage_range || groups > max_dispatch_groups) {
+        return std::nullopt;
+    }
+    return VertexRepackParameters{static_cast<u32>(vertices), static_cast<u32>(output_size),
+                                 static_cast<u32>(base), static_cast<u32>(bias),
+                                 static_cast<u32>(range), static_cast<u32>(groups)};
+}
+
+inline bool VertexRepackEnabled() {
+    static const bool enabled = [] {
+        const char* value = std::getenv("EGLANTINE_TEST_VERTEX_REPACK");
+        return !value || std::strcmp(value, "0") != 0;
+    }();
+    return enabled;
+}
+
+inline u32 VertexRepackMask(const Tegra::Engines::Maxwell3D::Regs& regs) {
+    using Attribute = Tegra::Engines::Maxwell3D::Regs::VertexAttribute;
+    if (!VertexRepackEnabled()) {
+        return 0;
+    }
+    u32 candidates = 0;
+    u32 excluded = 0;
+    for (const auto& attribute : regs.vertex_attrib_format) {
+        const u32 binding = attribute.buffer;
+        if (attribute.constant || regs.vertex_streams[binding].stride != 69) {
+            continue;
+        }
+        if (attribute.size == Attribute::Size::Invalid) {
+            excluded |= 1U << binding;
+            continue;
+        }
+        const u32 offset = attribute.offset;
+        const u32 size = attribute.SizeInBytes();
+        if (offset == 65 && size == 4) {
+            candidates |= 1U << binding;
+        }
+        if (offset + size > 69 || (offset < 65 && offset + size > 65)) {
+            excluded |= 1U << binding;
+        }
+    }
+    return candidates & ~excluded;
+}
+
+inline u32 RepackedVertexOffset(u32 mask, u32 binding, u32 offset) {
+    return offset + ((mask & (1U << binding)) && offset >= 65 ? 3U : 0U);
+}
+
+inline u32 RepackedVertexStride(u32 mask, u32 binding, u32 stride) {
+    return mask & (1U << binding) ? 72U : stride;
+}
+
+} // namespace Vulkan
diff --git a/src/video_core/renderer_vulkan/vk_buffer_cache.cpp b/src/video_core/renderer_vulkan/vk_buffer_cache.cpp
index 493de2cc20..fe0ab3a28e 100644
--- a/src/video_core/renderer_vulkan/vk_buffer_cache.cpp
+++ b/src/video_core/renderer_vulkan/vk_buffer_cache.cpp
@@ -7,11 +7,13 @@
 #include <algorithm>
 #include <array>
 #include <cstring>
+#include <cstdlib>
 #include <span>
 #include <vector>
 
 #include "video_core/buffer_cache/buffer_cache_base.h"
 #include "video_core/renderer_vulkan/vk_buffer_cache.h"
+#include "video_core/renderer_vulkan/vertex_repack.h"
 
 #include "video_core/renderer_vulkan/maxwell_to_vk.h"
 #include "video_core/renderer_vulkan/vk_scheduler.h"
@@ -359,6 +361,14 @@ BufferCacheRuntime::BufferCacheRuntime(const Device& device_, MemoryAllocator& m
                       compute_pass_descriptor_queue),
       multi_range_buffers(device_) {
     const VkDriverIdKHR driver_id = device.GetDriverID();
+    const bool enable_vertex_repack = VertexRepackEnabled();
+    LOG_INFO(Render_Vulkan, "69-byte vertex layout repacking {} ({})",
+             enable_vertex_repack ? "enabled" : "disabled",
+             "portable Vulkan layout fallback");
+    if (enable_vertex_repack) {
+        vertex_repack_pass = std::make_unique<VertexRepackPass>(
+            device, scheduler, descriptor_pool, staging_pool, compute_pass_descriptor_queue);
+    }
     limit_dynamic_storage_buffers = driver_id == VK_DRIVER_ID_QUALCOMM_PROPRIETARY ||
                                     driver_id == VK_DRIVER_ID_ARM_PROPRIETARY;
     if (limit_dynamic_storage_buffers) {
@@ -374,6 +384,19 @@ BufferCacheRuntime::BufferCacheRuntime(const Device& device_, MemoryAllocator& m
                                                                      scheduler_, staging_pool_);
 }
 
+u32 BufferCacheRuntime::SetVertexRepackLayout(const Tegra::Engines::Maxwell3D::Regs& regs,
+                                            bool dynamic_input) {
+    const u32 old_mask = vertex_repack_mask;
+    const bool input_supported = VertexRepackInputSupported(
+        dynamic_input, ExperimentalStaticVertexRepackEnabled());
+    vertex_repack_mask = vertex_repack_pass && input_supported ? VertexRepackMask(regs) : 0;
+    if (vertex_repack_mask != old_mask) {
+        LOG_DEBUG(Render_Vulkan, "Vertex repack selection: mask={:#x}, dynamic_input={}",
+                  vertex_repack_mask, dynamic_input);
+    }
+    return old_mask | vertex_repack_mask;
+}
+
 StagingBufferRef BufferCacheRuntime::UploadStagingBuffer(size_t size) {
     return staging_pool.Request(size, MemoryUsage::Upload);
 }
@@ -629,6 +652,16 @@ void BufferCacheRuntime::BindVertexBuffer(u32 index, VkBuffer buffer, u32 offset
     if (index >= device.GetMaxVertexInputBindings()) {
         return;
     }
+    if (buffer != VK_NULL_HANDLE && size != 0 && IsVertexRepacked(index)) {
+        const auto repacked = vertex_repack_pass->Assemble(buffer, offset, size);
+        if (!repacked) {
+            return;
+        }
+        buffer = repacked->first;
+        offset = static_cast<u32>(repacked->second);
+        size = static_cast<u32>((u64{size} + 68) / 69 * 72);
+        stride = 72;
+    }
     if (device.IsExtExtendedDynamicStateSupported()) {
         scheduler.Record([index, buffer, offset, size, stride](vk::CommandBuffer cmdbuf) {
             const VkDeviceSize vk_offset = buffer != VK_NULL_HANDLE ? offset : 0;
@@ -661,6 +694,24 @@ void BufferCacheRuntime::BindVertexBuffers(VideoCommon::HostBindings<Buffer>& bi
             }
         }
         buffer_handles[i] = handle;
+        const u32 binding = bindings.min_index + i;
+        if (handle != VK_NULL_HANDLE && IsVertexRepacked(binding) && bindings.strides[i] == 69 &&
+            bindings.sizes[i] > 0) {
+            const auto repacked = vertex_repack_pass->Assemble(
+                handle, static_cast<u32>(bindings.offsets[i]), static_cast<u32>(bindings.sizes[i]));
+            if (!repacked) {
+                continue;
+            }
+            buffer_handles[i] = repacked->first;
+            bindings.offsets[i] = repacked->second;
+            bindings.sizes[i] = (bindings.sizes[i] + 68) / 69 * 72;
+            bindings.strides[i] = 72;
+            static bool reported = false;
+            if (!reported) {
+                LOG_WARNING(Render_Vulkan, "Experimental GPU vertex repacking active: 69 -> 72 bytes");
+                reported = true;
+            }
+        }
     }
     const u32 device_max = device.GetMaxVertexInputBindings();
     const u32 min_binding = (std::min)(bindings.min_index, device_max);
diff --git a/src/video_core/renderer_vulkan/vk_buffer_cache.h b/src/video_core/renderer_vulkan/vk_buffer_cache.h
index fff1f8164d..ff854445b5 100644
--- a/src/video_core/renderer_vulkan/vk_buffer_cache.h
+++ b/src/video_core/renderer_vulkan/vk_buffer_cache.h
@@ -110,6 +110,12 @@ public:
 
     void TickFrame(Common::SlotVector<Buffer>& slot_buffers) noexcept;
 
+    u32 SetVertexRepackLayout(const Tegra::Engines::Maxwell3D::Regs& regs, bool dynamic_input);
+
+    bool IsVertexRepacked(u32 binding) const {
+        return (vertex_repack_mask & (1U << binding)) != 0;
+    }
+
     u64 CurrentTick();
 
     bool IsFree(u64 tick);
@@ -259,6 +265,8 @@ private:
     vk::Buffer null_buffer;
 
     std::unique_ptr<Uint8Pass> uint8_pass;
+    std::unique_ptr<VertexRepackPass> vertex_repack_pass;
+    u32 vertex_repack_mask{};
     QuadIndexedPass quad_index_pass;
 
     MultiRangeBufferCache multi_range_buffers;
diff --git a/src/video_core/renderer_vulkan/vk_compute_pass.cpp b/src/video_core/renderer_vulkan/vk_compute_pass.cpp
index 8cd8abb599..cb8dcde42f 100644
--- a/src/video_core/renderer_vulkan/vk_compute_pass.cpp
+++ b/src/video_core/renderer_vulkan/vk_compute_pass.cpp
@@ -26,8 +26,10 @@
 #include "video_core/host_shaders/resolve_conditional_render_comp_spv.h"
 #include "video_core/host_shaders/vulkan_quad_indexed_comp_spv.h"
 #include "video_core/host_shaders/vulkan_uint8_comp_spv.h"
+#include "video_core/host_shaders/vulkan_vertex_repack_comp_spv.h"
 #include "video_core/host_shaders/block_linear_unswizzle_3d_bcn_comp_spv.h"
 #include "video_core/renderer_vulkan/vk_compute_pass.h"
+#include "video_core/renderer_vulkan/vertex_repack.h"
 #include "video_core/surface.h"
 #include "video_core/renderer_vulkan/vk_descriptor_pool.h"
 #include "video_core/renderer_vulkan/vk_scheduler.h"
@@ -324,6 +326,62 @@ ComputePass::ComputePass(const Device& device_, Scheduler& scheduler, Descriptor
 
 ComputePass::~ComputePass() = default;
 
+VertexRepackPass::VertexRepackPass(const Device& device_, Scheduler& scheduler_,
+                                 DescriptorPool& descriptor_pool, StagingBufferPool& staging_pool_,
+                                 ComputePassDescriptorQueue& descriptor_queue_)
+    : ComputePass(device_, scheduler_, descriptor_pool, INPUT_OUTPUT_DESCRIPTOR_SET_BINDINGS,
+                  INPUT_OUTPUT_DESCRIPTOR_UPDATE_TEMPLATE, INPUT_OUTPUT_BANK_INFO,
+                  COMPUTE_PUSH_CONSTANT_RANGE<12>, VULKAN_VERTEX_REPACK_COMP_SPV),
+      scheduler{scheduler_}, staging_pool{staging_pool_}, descriptor_queue{descriptor_queue_} {}
+
+std::optional<std::pair<VkBuffer, VkDeviceSize>> VertexRepackPass::Assemble(VkBuffer source,
+                                                                           u32 offset, u32 size) {
+    const auto parameters = MakeVertexRepackParameters(
+        offset, size, device.GetStorageBufferAlignment(), device.GetMaxStorageBufferRange(),
+        device.GetMaxComputeWorkGroupCount()[0]);
+    if (!parameters) {
+        LOG_ERROR(Render_Vulkan, "Vertex repack exceeds device limits: offset={}, size={}", offset, size);
+        return std::nullopt;
+    }
+    const u32 num_vertices = parameters->vertices;
+    const u32 output_size = parameters->output_size;
+    const auto dest = staging_pool.Request(output_size, MemoryUsage::DeviceLocal);
+    const u32 base_offset = parameters->source_base;
+    const u32 bias = parameters->source_bias;
+    descriptor_queue.Acquire(scheduler, 2);
+    descriptor_queue.AddBuffer(source, base_offset, parameters->source_range);
+    descriptor_queue.AddBuffer(dest.buffer, dest.offset, output_size);
+    const void* data = descriptor_queue.UpdateData();
+    scheduler.RequestOutsideRenderPassOperationContext();
+    LOG_DEBUG(Render_Vulkan, "Vertex repack queued: source_size={}, output_size={}, groups={}",
+              size, output_size, parameters->dispatch_groups);
+    scheduler.Record([this, data, bias, size, num_vertices,
+                      groups = parameters->dispatch_groups](vk::CommandBuffer cmdbuf) {
+        const VkMemoryBarrier read_barrier{
+            .sType = VK_STRUCTURE_TYPE_MEMORY_BARRIER,
+            .srcAccessMask = VK_ACCESS_MEMORY_WRITE_BIT,
+            .dstAccessMask = VK_ACCESS_SHADER_READ_BIT,
+        };
+        cmdbuf.PipelineBarrier(VK_PIPELINE_STAGE_ALL_COMMANDS_BIT,
+                              VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, 0, read_barrier);
+        const auto set = descriptor_allocator.Commit();
+        device.GetLogical().UpdateDescriptorSet(set, *descriptor_template, data);
+        cmdbuf.BindPipeline(VK_PIPELINE_BIND_POINT_COMPUTE, *pipeline);
+        cmdbuf.BindDescriptorSets(VK_PIPELINE_BIND_POINT_COMPUTE, *layout, 0, set, {});
+        const std::array<u32, 3> constants{bias, size, num_vertices * 18};
+        cmdbuf.PushConstants(*layout, VK_SHADER_STAGE_COMPUTE_BIT, 0, sizeof(constants), constants.data());
+        cmdbuf.Dispatch(groups, 1, 1);
+        const VkMemoryBarrier write_barrier{
+            .sType = VK_STRUCTURE_TYPE_MEMORY_BARRIER,
+            .srcAccessMask = VK_ACCESS_SHADER_WRITE_BIT,
+            .dstAccessMask = VK_ACCESS_VERTEX_ATTRIBUTE_READ_BIT,
+        };
+        cmdbuf.PipelineBarrier(VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT,
+                              VK_PIPELINE_STAGE_VERTEX_INPUT_BIT, 0, write_barrier);
+    });
+    return std::pair<VkBuffer, VkDeviceSize>{dest.buffer, dest.offset};
+}
+
 Uint8Pass::Uint8Pass(const Device& device_, Scheduler& scheduler_, DescriptorPool& descriptor_pool,
                      StagingBufferPool& staging_buffer_pool_,
                      ComputePassDescriptorQueue& compute_pass_descriptor_queue_)
@@ -743,11 +801,11 @@ void ASTCDecoderPass::AssembleInto(const VideoCommon::ImageInfo& info, u32 skip,
         cmdbuf.PipelineBarrier(VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT,
                        vk::PIPELINE_STAGE_GRAPHICS_COMPUTE, 0, image_barrier);
     });
-    // Each decode ends with the GPU thread waiting for the host GPU to go idle. Measured here
-    // (count and time per 5 s); EDEN_NX2_ASTC_FLUSH=1 submits without waiting instead.
+    // Each decode ends with a submit to the host GPU. Measured here
+    // (count and time per 5 s); EDEN_NX2_ASTC_FLUSH=0 waits for the host GPU to go idle instead.
     static const bool flush_only = [] {
         const char* value = std::getenv("EDEN_NX2_ASTC_FLUSH");
-        return value != nullptr && value[0] == '1';
+        return value == nullptr || value[0] != '0';
     }();
     if (!target.wait) {
         return;
diff --git a/src/video_core/renderer_vulkan/vk_compute_pass.h b/src/video_core/renderer_vulkan/vk_compute_pass.h
index 9f2e8e9f1c..27fffbbbb7 100644
--- a/src/video_core/renderer_vulkan/vk_compute_pass.h
+++ b/src/video_core/renderer_vulkan/vk_compute_pass.h
@@ -56,6 +56,20 @@ private:
     vk::ShaderModule module;
 };
 
+class VertexRepackPass final : public ComputePass {
+public:
+    VertexRepackPass(const Device& device, Scheduler& scheduler, DescriptorPool& descriptor_pool,
+                     StagingBufferPool& staging_pool, ComputePassDescriptorQueue& descriptor_queue);
+    /// Returns nothing when the range exceeds the device limits; the binding is then left as is.
+    std::optional<std::pair<VkBuffer, VkDeviceSize>> Assemble(VkBuffer source, u32 offset,
+                                                              u32 size);
+
+private:
+    Scheduler& scheduler;
+    StagingBufferPool& staging_pool;
+    ComputePassDescriptorQueue& descriptor_queue;
+};
+
 class Uint8Pass final : public ComputePass {
 public:
     explicit Uint8Pass(const Device& device_, Scheduler& scheduler_,
diff --git a/src/video_core/renderer_vulkan/vk_rasterizer.cpp b/src/video_core/renderer_vulkan/vk_rasterizer.cpp
index 2f638026c9..d3dbba6163 100644
--- a/src/video_core/renderer_vulkan/vk_rasterizer.cpp
+++ b/src/video_core/renderer_vulkan/vk_rasterizer.cpp
@@ -299,6 +299,18 @@ void RasterizerVulkan::PrepareDraw(bool is_indexed, Func&& draw_func) {
     std::scoped_lock lock{buffer_cache.mutex, texture_cache.mutex};
     // update engine as channel may be different.
     pipeline->SetEngine(maxwell3d, gpu_memory);
+    const u32 repack_dirty = buffer_cache_runtime.SetVertexRepackLayout(
+        maxwell3d->regs, pipeline->HasDynamicVertexInput());
+    if (repack_dirty) {
+        auto& flags = maxwell3d->dirty.flags;
+        flags[VideoCommon::Dirty::VertexBuffers] = true;
+        flags[Dirty::VertexInput] = true;
+        for (u32 binding = 0; binding < 32; ++binding) {
+            if (repack_dirty & (1U << binding)) {
+                flags[VideoCommon::Dirty::VertexBuffer0 + binding] = true;
+            }
+        }
+    }
     if (Profile::Scope scope{Profile::Zone::Configure}; !pipeline->Configure(is_indexed)) {
         report_failure("configure failed");
         return;
@@ -1263,6 +1275,14 @@ bool RasterizerVulkan::AccelerateSurfaceCopy(const Tegra::Engines::Fermi2D::Surf
     return texture_cache.BlitImage(dst, src, copy_config);
 }
 
+bool RasterizerVulkan::AccelerateTemporalUpscale(
+    const Tegra::Engines::Fermi2D::Surface& src, const Tegra::Engines::Fermi2D::Surface& dst,
+    const Tegra::Engines::Fermi2D::Surface& motion_vectors, std::array<f32, 2> jitter,
+    std::array<f32, 2> motion_scale) {
+    std::scoped_lock lock{texture_cache.mutex};
+    return texture_cache.TemporalUpscale(dst, src, motion_vectors, jitter, motion_scale);
+}
+
 Tegra::Engines::AccelerateDMAInterface& RasterizerVulkan::AccessAccelerateDMA() {
     return accelerate_dma;
 }
@@ -2293,7 +2313,8 @@ void RasterizerVulkan::UpdateVertexInput(Tegra::Engines::Maxwell3D::Regs& regs)
             .location = index,
             .binding = binding,
             .format = MaxwellToVK::VertexFormat(device, attribute.type, attribute.size),
-            .offset = attribute.offset,
+            .offset = attribute.offset +
+                      (buffer_cache_runtime.IsVertexRepacked(binding) && attribute.offset >= 65 ? 3 : 0),
         });
     }
 
@@ -2304,7 +2325,7 @@ void RasterizerVulkan::UpdateVertexInput(Tegra::Engines::Maxwell3D::Regs& regs)
             .sType = VK_STRUCTURE_TYPE_VERTEX_INPUT_BINDING_DESCRIPTION_2_EXT,
             .pNext = nullptr,
             .binding = binding,
-            .stride = input_binding.stride,
+            .stride = buffer_cache_runtime.IsVertexRepacked(binding) ? 72U : input_binding.stride.Value(),
             .inputRate = is_instanced ? VK_VERTEX_INPUT_RATE_INSTANCE : VK_VERTEX_INPUT_RATE_VERTEX,
             .divisor = is_instanced ? input_binding.frequency : 1,
         });
diff --git a/src/video_core/renderer_vulkan/vk_rasterizer.h b/src/video_core/renderer_vulkan/vk_rasterizer.h
index e8989dcdfc..fc282fbe8d 100644
--- a/src/video_core/renderer_vulkan/vk_rasterizer.h
+++ b/src/video_core/renderer_vulkan/vk_rasterizer.h
@@ -128,6 +128,11 @@ public:
     bool AccelerateSurfaceCopy(const Tegra::Engines::Fermi2D::Surface& src,
                                const Tegra::Engines::Fermi2D::Surface& dst,
                                const Tegra::Engines::Fermi2D::Config& copy_config) override;
+    bool AccelerateTemporalUpscale(const Tegra::Engines::Fermi2D::Surface& src,
+                                   const Tegra::Engines::Fermi2D::Surface& dst,
+                                   const Tegra::Engines::Fermi2D::Surface& motion_vectors,
+                                   std::array<f32, 2> jitter,
+                                   std::array<f32, 2> motion_scale) override;
     Tegra::Engines::AccelerateDMAInterface& AccessAccelerateDMA() override;
     void AccelerateInlineToMemory(GPUVAddr address, size_t copy_size,
                                   std::span<const u8> memory) override;
diff --git a/src/video_core/renderer_vulkan/vk_texture_cache.cpp b/src/video_core/renderer_vulkan/vk_texture_cache.cpp
index cb0453c178..30981fe413 100644
--- a/src/video_core/renderer_vulkan/vk_texture_cache.cpp
+++ b/src/video_core/renderer_vulkan/vk_texture_cache.cpp
@@ -1535,6 +1535,154 @@ void TextureCacheRuntime::ReinterpretImage(Image& dst, Image& src,
     });
 }
 
+bool TextureCacheRuntime::TemporalUpscale(Framebuffer* dst_framebuffer, ImageView& dst,
+                                          ImageView& input_color, ImageView& motion_vectors,
+                                          std::array<f32, 2> jitter,
+                                          std::array<f32, 2> motion_scale) {
+    if (dst.Samples() != VK_SAMPLE_COUNT_1_BIT || ImageAspectMask(dst.format) != VK_IMAGE_ASPECT_COLOR_BIT) {
+        return false;
+    }
+    const VkFormat format =
+        MaxwellToVK::SurfaceFormat(device, FormatType::Optimal, false, dst.format).format;
+    const VkExtent2D extent{dst.size.width, dst.size.height};
+    const VkImage output = dst.ImageHandle();
+    bool reset = false;
+    if (!temporal_history.image || temporal_history.format != format ||
+        temporal_history.extent.width != extent.width ||
+        temporal_history.extent.height != extent.height) {
+        if (temporal_history.image) {
+            scheduler.Finish(); // the old history may still be sampled
+        }
+        temporal_history.image = memory_allocator.CreateImage(VkImageCreateInfo{
+            .sType = VK_STRUCTURE_TYPE_IMAGE_CREATE_INFO,
+            .pNext = nullptr,
+            .flags = 0,
+            .imageType = VK_IMAGE_TYPE_2D,
+            .format = format,
+            .extent = {extent.width, extent.height, 1},
+            .mipLevels = 1,
+            .arrayLayers = 1,
+            .samples = VK_SAMPLE_COUNT_1_BIT,
+            .tiling = VK_IMAGE_TILING_OPTIMAL,
+            .usage = VK_IMAGE_USAGE_SAMPLED_BIT | VK_IMAGE_USAGE_TRANSFER_DST_BIT,
+            .sharingMode = VK_SHARING_MODE_EXCLUSIVE,
+            .queueFamilyIndexCount = 0,
+            .pQueueFamilyIndices = nullptr,
+            .initialLayout = VK_IMAGE_LAYOUT_UNDEFINED,
+        });
+        temporal_history.view = device.GetLogical().CreateImageView(VkImageViewCreateInfo{
+            .sType = VK_STRUCTURE_TYPE_IMAGE_VIEW_CREATE_INFO,
+            .pNext = nullptr,
+            .flags = 0,
+            .image = *temporal_history.image,
+            .viewType = VK_IMAGE_VIEW_TYPE_2D,
+            .format = format,
+            .components{},
+            .subresourceRange{
+                .aspectMask = VK_IMAGE_ASPECT_COLOR_BIT,
+                .baseMipLevel = 0,
+                .levelCount = 1,
+                .baseArrayLayer = 0,
+                .layerCount = 1,
+            },
+        });
+        temporal_history.format = format;
+        temporal_history.extent = extent;
+        reset = true;
+        LOG_INFO(Render_Vulkan, "Temporal upscale into {}x{} (format {})", extent.width, extent.height,
+                 static_cast<u32>(format));
+    }
+
+    // The history holds this pass's previous result, copied right after drawing it: the game may
+    // draw into its DLSS output afterwards (post-processing), which must not feed back. The history
+    // stays in the GENERAL layout, which the blit helper's descriptors use.
+    const VkImage history = *temporal_history.image;
+    const VkImageSubresourceLayers output_layers{
+        .aspectMask = VK_IMAGE_ASPECT_COLOR_BIT,
+        .mipLevel = static_cast<u32>(dst.range.base.level),
+        .baseArrayLayer = static_cast<u32>(dst.range.base.layer),
+        .layerCount = 1,
+    };
+    static constexpr VkImageSubresourceLayers history_layers{
+        .aspectMask = VK_IMAGE_ASPECT_COLOR_BIT,
+        .mipLevel = 0,
+        .baseArrayLayer = 0,
+        .layerCount = 1,
+    };
+    const auto barrier = [](VkImage image, VkAccessFlags src_access, VkAccessFlags dst_access,
+                            VkImageLayout old_layout, const VkImageSubresourceLayers& layers) {
+        return VkImageMemoryBarrier{
+            .sType = VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER,
+            .pNext = nullptr,
+            .srcAccessMask = src_access,
+            .dstAccessMask = dst_access,
+            .oldLayout = old_layout,
+            .newLayout = VK_IMAGE_LAYOUT_GENERAL,
+            .srcQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED,
+            .dstQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED,
+            .image = image,
+            .subresourceRange{
+                .aspectMask = VK_IMAGE_ASPECT_COLOR_BIT,
+                .baseMipLevel = layers.mipLevel,
+                .levelCount = 1,
+                .baseArrayLayer = layers.baseArrayLayer,
+                .layerCount = 1,
+            },
+        };
+    };
+    if (reset) {
+        // A new history image has no contents yet; the first frame does not read it.
+        scheduler.RequestOutsideRenderPassOperationContext();
+        scheduler.Record([history, barrier](vk::CommandBuffer cmdbuf) {
+            cmdbuf.PipelineBarrier(VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT, VK_PIPELINE_STAGE_FRAGMENT_SHADER_BIT,
+                                   0, barrier(history, 0, VK_ACCESS_SHADER_READ_BIT,
+                                              VK_IMAGE_LAYOUT_UNDEFINED, history_layers));
+        });
+    }
+    const Region2D dst_region{
+        .start = {0, 0},
+        .end = {static_cast<s32>(extent.width), static_cast<s32>(extent.height)},
+    };
+    // Each frame weighs at most 0.1 against the history (scaled by how close its samples land to
+    // the pixel; the neighbourhood clip limits what older samples contribute).
+    constexpr f32 current_weight = 0.1f;
+    blit_image_helper.TemporalUpscale(dst_framebuffer, input_color, motion_vectors,
+                                      *temporal_history.view, dst_region, jitter, motion_scale,
+                                      reset ? 1.0f : current_weight);
+    scheduler.RequestOutsideRenderPassOperationContext();
+    scheduler.Record([output, history, extent, output_layers, barrier](vk::CommandBuffer cmdbuf) {
+        constexpr VkAccessFlags written = VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT;
+        const std::array before{
+            barrier(output, written, VK_ACCESS_TRANSFER_READ_BIT, VK_IMAGE_LAYOUT_GENERAL,
+                    output_layers),
+            barrier(history, VK_ACCESS_SHADER_READ_BIT, VK_ACCESS_TRANSFER_WRITE_BIT,
+                    VK_IMAGE_LAYOUT_GENERAL, history_layers),
+        };
+        cmdbuf.PipelineBarrier(VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT |
+                                   VK_PIPELINE_STAGE_FRAGMENT_SHADER_BIT,
+                               VK_PIPELINE_STAGE_TRANSFER_BIT, 0, {}, {}, before);
+        const VkImageCopy copy{
+            .srcSubresource = output_layers,
+            .srcOffset = {0, 0, 0},
+            .dstSubresource = history_layers,
+            .dstOffset = {0, 0, 0},
+            .extent = {extent.width, extent.height, 1},
+        };
+        cmdbuf.CopyImage(output, VK_IMAGE_LAYOUT_GENERAL, history, VK_IMAGE_LAYOUT_GENERAL, copy);
+        const std::array after{
+            barrier(output, VK_ACCESS_TRANSFER_READ_BIT,
+                    VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT |
+                        VK_ACCESS_TRANSFER_READ_BIT,
+                    VK_IMAGE_LAYOUT_GENERAL, output_layers),
+            barrier(history, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT,
+                    VK_IMAGE_LAYOUT_GENERAL, history_layers),
+        };
+        cmdbuf.PipelineBarrier(VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, 0,
+                               {}, {}, after);
+    });
+    return true;
+}
+
 void TextureCacheRuntime::BlitImage(Framebuffer* dst_framebuffer, ImageView& dst, ImageView& src,
                                     const Region2D& dst_region, const Region2D& src_region,
                                     Tegra::Engines::Fermi2D::Filter filter,
@@ -4232,7 +4380,7 @@ void TextureCacheRuntime::TranscodeAstcToBcn(
             .aspect_mask = VK_IMAGE_ASPECT_COLOR_BIT,
             .initialized = false,
             .level_view = [&pending](s32 level) { return *pending.views[level]; },
-            .wait = false,
+            .wait = true,
         },
         map, swizzles);
 
diff --git a/src/video_core/renderer_vulkan/vk_texture_cache.h b/src/video_core/renderer_vulkan/vk_texture_cache.h
index d5f8756486..564b2cbf9e 100644
--- a/src/video_core/renderer_vulkan/vk_texture_cache.h
+++ b/src/video_core/renderer_vulkan/vk_texture_cache.h
@@ -99,6 +99,12 @@ public:
                    Tegra::Engines::Fermi2D::Filter filter,
                    Tegra::Engines::Fermi2D::Operation operation);
 
+    /// Stands in for a DLSS evaluation: temporal upscale of input_color into dst, accumulated with
+    /// a copy of dst's previous contents (the last output). False when dst cannot take it.
+    bool TemporalUpscale(Framebuffer* dst_framebuffer, ImageView& dst, ImageView& input_color,
+                         ImageView& motion_vectors, std::array<f32, 2> jitter,
+                         std::array<f32, 2> motion_scale);
+
     void CopyImage(Image& dst, Image& src, std::span<const VideoCommon::ImageCopy> copies);
 
     void CopyImageMSAA(Image& dst, Image& src, std::span<const VideoCommon::ImageCopy> copies);
@@ -181,6 +187,15 @@ public:
     StagingBufferPool& staging_buffer_pool;
     BlitImageHelper& blit_image_helper;
     RenderPassCache& render_pass_cache;
+
+    /// TemporalUpscale's history: its previous result, copied right after drawing it.
+    struct TemporalHistory {
+        vk::Image image;
+        vk::ImageView view;
+        VkFormat format{};
+        VkExtent2D extent{};
+    } temporal_history;
+
     std::optional<ASTCDecoderPass> astc_decoder_pass;
     std::optional<BcEncoderPass> bc_encoder_pass;
 
diff --git a/src/video_core/renderer_vulkan/vk_update_descriptor.cpp b/src/video_core/renderer_vulkan/vk_update_descriptor.cpp
index 742a8d9969..29f3ee71a1 100644
--- a/src/video_core/renderer_vulkan/vk_update_descriptor.cpp
+++ b/src/video_core/renderer_vulkan/vk_update_descriptor.cpp
@@ -20,10 +20,10 @@ UpdateDescriptorQueue::UpdateDescriptorQueue(const Device& device_, size_t frame
                                              bool supports_descriptor_buffer_)
     : device{device_}, frame_payload_size{frame_payload_size_},
       supports_descriptor_buffer{supports_descriptor_buffer_},
-      payload(frame_payload_size_ * FRAMES_IN_FLIGHT)
+      payload(std::make_unique_for_overwrite<DescriptorUpdateEntry[]>(frame_payload_size_ * FRAMES_IN_FLIGHT))
 {
-    payload_start = payload.data();
-    payload_cursor = payload.data();
+    payload_start = payload.get();
+    payload_cursor = payload.get();
 }
 
 UpdateDescriptorQueue::~UpdateDescriptorQueue() = default;
@@ -32,7 +32,7 @@ void UpdateDescriptorQueue::TickFrame() {
     if (++frame_index >= FRAMES_IN_FLIGHT) {
         frame_index = 0;
     }
-    payload_start = payload.data() + frame_index * frame_payload_size;
+    payload_start = payload.get() + frame_index * frame_payload_size;
     payload_cursor = payload_start;
 }
 
diff --git a/src/video_core/renderer_vulkan/vk_update_descriptor.h b/src/video_core/renderer_vulkan/vk_update_descriptor.h
index 9f30e65dbd..4d393376b4 100644
--- a/src/video_core/renderer_vulkan/vk_update_descriptor.h
+++ b/src/video_core/renderer_vulkan/vk_update_descriptor.h
@@ -6,6 +6,7 @@
 
 #pragma once
 
+#include <memory>
 #include <variant>
 #include <vector>
 #include "video_core/vulkan_common/vulkan_wrapper.h"
@@ -122,7 +123,7 @@ private:
     DescriptorUpdateEntry* payload_cursor = nullptr;
     DescriptorUpdateEntry* payload_start = nullptr;
     const DescriptorUpdateEntry* upload_start = nullptr;
-    std::vector<DescriptorUpdateEntry> payload;
+    std::unique_ptr<DescriptorUpdateEntry[]> payload;
 };
 
 // TODO: should these be separate classes instead?
diff --git a/src/video_core/surface.cpp b/src/video_core/surface.cpp
index 66b9577cb5..ef4859ea3e 100644
--- a/src/video_core/surface.cpp
+++ b/src/video_core/surface.cpp
@@ -214,6 +214,8 @@ PixelFormat PixelFormatFromGPUPixelFormat(Service::android::PixelFormat format)
         return PixelFormat::R5G6B5_UNORM;
     case Service::android::PixelFormat::Bgra8888:
         return PixelFormat::B8G8R8A8_UNORM;
+    case Service::android::PixelFormat::Rgba1010102:
+        return PixelFormat::A2B10G10R10_UNORM;
     default:
         UNIMPLEMENTED_MSG("Unimplemented format={}", format);
         return PixelFormat::A8B8G8R8_UNORM;
diff --git a/src/video_core/texture_cache/texture_cache.h b/src/video_core/texture_cache/texture_cache.h
index 45bc35dee6..3f3ae9cafd 100644
--- a/src/video_core/texture_cache/texture_cache.h
+++ b/src/video_core/texture_cache/texture_cache.h
@@ -125,6 +125,7 @@ template <class P>
 void TextureCache<P>::RunGarbageCollector() {
     bool high_priority_mode = false;
     bool aggressive_mode = false;
+    bool evict_old_costly = false;
     u64 ticks_to_destroy = 0;
     size_t num_iterations = 0;
     const auto Configure = [&](bool allow_aggressive) {
@@ -139,7 +140,8 @@ void TextureCache<P>::RunGarbageCollector() {
         ticks_to_destroy = (std::max)(ticks_to_destroy, min_age);
         num_iterations = aggressive_mode ? 40 : (high_priority_mode ? 20 : 10);
     };
-    const auto Cleanup = [this, &num_iterations, &high_priority_mode, &aggressive_mode](ImageId image_id) {
+    const auto Cleanup = [this, &num_iterations, &high_priority_mode, &aggressive_mode,
+                          &evict_old_costly](ImageId image_id) {
         if (num_iterations == 0) {
             return true;
         }
@@ -149,7 +151,8 @@ void TextureCache<P>::RunGarbageCollector() {
             return false;
         }
         const bool must_download = IsDownloadable(image) && False(image.flags & ImageFlagBits::BadOverlap);
-        if ((!aggressive_mode && True(image.flags & ImageFlagBits::CostlyLoad)) || (!high_priority_mode && must_download)) {
+        if ((!aggressive_mode && !evict_old_costly && True(image.flags & ImageFlagBits::CostlyLoad)) ||
+            (!high_priority_mode && must_download)) {
             return false;
         }
         if (must_download) {
@@ -227,6 +230,15 @@ void TextureCache<P>::RunGarbageCollector() {
         }
     };
     Configure(false);
+    static const u64 old_age = [] {
+        const char* value = std::getenv("EDEN_NX2_TC_OLD_AGE");
+        return value != nullptr ? std::strtoull(value, nullptr, 10) : 1800ULL;
+    }();
+    if (high_priority_mode && old_age != 0 && frame_tick > old_age) {
+        evict_old_costly = true;
+        lru_cache.ForEachItemBelow(frame_tick - old_age, Cleanup);
+        evict_old_costly = false;
+    }
     Collect();
     if (total_used_memory >= critical_memory) {
         Configure(true);
@@ -1082,6 +1094,73 @@ bool TextureCache<P>::BlitImage(const Tegra::Engines::Fermi2D::Surface& dst,
 }
 
 template <class P>
+bool TextureCache<P>::TemporalUpscale(const Tegra::Engines::Fermi2D::Surface& dst,
+                                      const Tegra::Engines::Fermi2D::Surface& src,
+                                      const Tegra::Engines::Fermi2D::Surface& motion_vectors,
+                                      std::array<f32, 2> jitter, std::array<f32, 2> motion_scale) {
+    if constexpr (FRAMEBUFFER_BLITS) {
+        return false;
+    } else {
+        const Tegra::Engines::Fermi2D::Config copy{
+            .operation = Tegra::Engines::Fermi2D::Operation::SrcCopy,
+            .filter = Tegra::Engines::Fermi2D::Filter::Bilinear,
+            .must_accelerate = true,
+            .dst_x0 = 0,
+            .dst_y0 = 0,
+            .dst_x1 = static_cast<s32>(dst.width),
+            .dst_y1 = static_cast<s32>(dst.height),
+            .src_x0 = 0,
+            .src_y0 = 0,
+            .src_x1 = static_cast<s32>(src.width),
+            .src_y1 = static_cast<s32>(src.height),
+        };
+        const auto result = GetBlitImages(dst, src, copy);
+        if (!result) {
+            return false;
+        }
+        const ImageInfo motion_info(motion_vectors);
+        has_deleted_images = false;
+        const ImageId motion_id =
+            FindOrInsertImage(motion_info, motion_vectors.Address(), RelaxedOptions{});
+        if (has_deleted_images || !motion_id) {
+            return false; // the colour and output ids may be stale; the caller blits instead
+        }
+        const ImageId dst_id = result->dst_id;
+        const ImageId src_id = result->src_id;
+        PrepareImage(src_id, false, false);
+        PrepareImage(motion_id, false, false);
+        PrepareImage(dst_id, true, false);
+        for (const ImageId id : {src_id, motion_id, dst_id}) {
+            if (True(slot_images[id].flags & ImageFlagBits::Rescaled) ||
+                slot_images[id].info.num_samples != 1) {
+                return false;
+            }
+        }
+        const auto view = [&](ImageId id, const Tegra::Engines::Fermi2D::Surface& surface,
+                              PixelFormat format) -> std::optional<std::pair<FramebufferId, ImageViewId>> {
+            const std::optional base = slot_images[id].TryFindBase(surface.Address());
+            if (!base) {
+                return std::nullopt;
+            }
+            const SubresourceRange range{.base = *base, .extent = {1, 1}};
+            return RenderTargetFromImage(id, ImageViewInfo(ImageViewType::e2D, format, range));
+        };
+        const auto src_view = view(src_id, src, result->src_format);
+        const auto motion_view = view(motion_id, motion_vectors, motion_info.format);
+        const auto dst_view = view(dst_id, dst, result->dst_format);
+        if (!src_view || !motion_view || !dst_view) {
+            return false;
+        }
+        // After the views: creating them may reallocate the framebuffer slots.
+        Framebuffer* const dst_framebuffer = &slot_framebuffers[dst_view->first];
+        return runtime.TemporalUpscale(dst_framebuffer, slot_image_views[dst_view->second],
+                                       slot_image_views[src_view->second],
+                                       slot_image_views[motion_view->second], jitter,
+                                       motion_scale);
+    }
+}
+
+template <class P>
 std::pair<typename P::ImageView*, bool> TextureCache<P>::TryFindFramebufferImageView(
     const Tegra::FramebufferConfig& config, DAddr cpu_addr) {
     // TODO: Properly implement this
diff --git a/src/video_core/texture_cache/texture_cache_base.h b/src/video_core/texture_cache/texture_cache_base.h
index 24ebaf0689..09deb8da02 100644
--- a/src/video_core/texture_cache/texture_cache_base.h
+++ b/src/video_core/texture_cache/texture_cache_base.h
@@ -283,6 +283,13 @@ public:
                    const Tegra::Engines::Fermi2D::Surface& src,
                    const Tegra::Engines::Fermi2D::Config& copy);
 
+    /// Stand-in for a DLSS evaluation: temporal upscale of src into dst (see the runtime's
+    /// TemporalUpscale). False when the images cannot take it; the caller then blits.
+    bool TemporalUpscale(const Tegra::Engines::Fermi2D::Surface& dst,
+                         const Tegra::Engines::Fermi2D::Surface& src,
+                         const Tegra::Engines::Fermi2D::Surface& motion_vectors,
+                         std::array<f32, 2> jitter, std::array<f32, 2> motion_scale);
+
     /// Try to find a cached image view in the given CPU address
     [[nodiscard]] std::pair<ImageView*, bool> TryFindFramebufferImageView(
         const Tegra::FramebufferConfig& config, DAddr cpu_addr);
diff --git a/src/yuzu/configuration/configure_graphics.cpp b/src/yuzu/configuration/configure_graphics.cpp
index e4a140fff5..074b6f405b 100644
--- a/src/yuzu/configuration/configure_graphics.cpp
+++ b/src/yuzu/configuration/configure_graphics.cpp
@@ -218,6 +218,7 @@ void ConfigureGraphics::Setup(const ConfigurationShared::Builder& builder) {
 
     std::map<u32, QWidget*> hold_graphics;
     std::vector<QWidget*> hold_api;
+    QCheckBox* frame_gen_checkbox = nullptr;
 
     for (const auto setting : Settings::values.linkage.by_category[Settings::Category::Renderer]) {
 #ifndef HAS_RESHADE
@@ -225,9 +226,6 @@ void ConfigureGraphics::Setup(const ConfigurationShared::Builder& builder) {
             continue;
         }
 #endif
-        if (setting->Id() == Settings::values.frame_gen.Id()) {
-            continue;
-        }
 
         ConfigurationShared::Widget* widget = [&]() {
             if (setting->Id() == Settings::values.fsr_sharpening_slider.Id()) {
@@ -325,6 +323,9 @@ void ConfigureGraphics::Setup(const ConfigurationShared::Builder& builder) {
 
             hold_graphics.emplace(setting->Id(), widget);
 #endif
+        } else if (setting->Id() == Settings::values.frame_gen.Id()) {
+            frame_gen_checkbox = widget->checkbox;
+            hold_graphics.emplace(setting->Id(), widget);
         } else {
             hold_graphics.emplace(setting->Id(), widget);
         }
@@ -334,6 +335,21 @@ void ConfigureGraphics::Setup(const ConfigurationShared::Builder& builder) {
         graphics_layout.addWidget(widget);
     }
 
+    // Hide rather than disable, a disabled widget would read as using the global value
+    if (frame_gen_checkbox != nullptr) {
+        for (const u32 id : {Settings::values.frame_gen_type.Id(),
+                             Settings::values.frame_gen_multiplier.Id(),
+                             Settings::values.frame_gen_target_rate.Id(),
+                             Settings::values.frame_gen_flow_scale_auto.Id(),
+                             Settings::values.frame_gen_flow_scale.Id(),
+                             Settings::values.frame_gen_queue_target.Id()}) {
+            if (const auto it = hold_graphics.find(id); it != hold_graphics.end()) {
+                it->second->setVisible(frame_gen_checkbox->isChecked());
+                connect(frame_gen_checkbox, &QCheckBox::toggled, it->second, &QWidget::setVisible);
+            }
+        }
+    }
+
     for (auto widget : hold_api) {
         api_grid_layout->addWidget(widget);
     }
diff --git a/src/yuzu/configuration/shared_widget.cpp b/src/yuzu/configuration/shared_widget.cpp
index 0e829e9100..4971c0cfa7 100644
--- a/src/yuzu/configuration/shared_widget.cpp
+++ b/src/yuzu/configuration/shared_widget.cpp
@@ -515,7 +515,13 @@ void Widget::SetupComponent(const QString& label, std::function<void()>& load_fu
     layout->setContentsMargins(0, 0, 0, 0);
 
     if (other_setting == nullptr) {
-        other_setting = setting.PairedSetting();
+        // A paired setting without the Paired specialization gets a widget of its own, and
+        // several settings can share it, so they must not each save their own checkbox to it
+        auto* const paired_setting = setting.PairedSetting();
+        if (paired_setting != nullptr &&
+            paired_setting->Specialization() == Settings::Specialization::Paired) {
+            other_setting = paired_setting;
+        }
     }
 
     const bool require_checkbox = other_setting != nullptr && other_setting->TypeId() == "bool";
diff --git a/src/yuzu/game/game_list.cpp b/src/yuzu/game/game_list.cpp
index cd7fc19de4..8e3eb7bc52 100644
--- a/src/yuzu/game/game_list.cpp
+++ b/src/yuzu/game/game_list.cpp
@@ -24,6 +24,7 @@
 
 #include "common/common_types.h"
 #include "core/core.h"
+#include "core/file_sys/nup_writer.h"
 #include "core/file_sys/patch_manager.h"
 #include "core/file_sys/registered_cache.h"
 #include "qt_common/config/uisettings.h"
@@ -99,6 +100,10 @@ GameList::GameList(FileSys::VirtualFilesystem vfs_, FileSys::ManualContentProvid
     ResetViewMode();
 }
 
+void GameList::SetNupConversionRunning(bool running) {
+    nup_conversion_running = running;
+}
+
 GameList::~GameList() {
     UnloadController();
 }
@@ -477,6 +482,11 @@ void GameList::AddGamePopup(QMenu& context_menu, u64 program_id, const std::stri
     QAction* dump_romfs_sdmc = dump_romfs_menu->addAction(tr("Dump RomFS to SDMC"));
     QAction* verify_integrity = context_menu.addAction(tr("Verify Integrity"));
     QAction* copy_tid = context_menu.addAction(tr("Copy Title ID to Clipboard"));
+    QAction* convert_nup = nullptr;
+    if (FileSys::Nup::DumpRootFromMain(path)) {
+        convert_nup = context_menu.addAction(tr("Convert to NUP..."));
+        convert_nup->setEnabled(!nup_conversion_running);
+    }
 #if !defined(__APPLE__)
     QMenu* shortcut_menu = context_menu.addMenu(tr("Create Shortcut"));
     QAction* create_desktop_shortcut = shortcut_menu->addAction(tr("Add to Desktop"));
@@ -557,6 +567,10 @@ void GameList::AddGamePopup(QMenu& context_menu, u64 program_id, const std::stri
             [this, path]() { emit VerifyIntegrityRequested(path); });
     connect(copy_tid, &QAction::triggered, this,
             [this, program_id]() { emit CopyTIDRequested(program_id); });
+    if (convert_nup) {
+        connect(convert_nup, &QAction::triggered, this,
+                [this, path]() { emit ConvertToNupRequested(path); });
+    }
 #if !defined(__APPLE__)
     connect(create_desktop_shortcut, &QAction::triggered, this, [this, program_id, path]() {
         emit CreateShortcut(program_id, path, QtCommon::Game::ShortcutTarget::Desktop);
diff --git a/src/yuzu/game/game_list.h b/src/yuzu/game/game_list.h
index 1540dd9cf0..67713691fd 100644
--- a/src/yuzu/game/game_list.h
+++ b/src/yuzu/game/game_list.h
@@ -88,6 +88,7 @@ public:
     void ResetViewMode();
 
 public slots:
+    void SetNupConversionRunning(bool running);
     void RefreshGameDirectory();
     void RefreshExternalContent();
     void UpdateIconSizes();
@@ -106,6 +107,7 @@ signals:
     void SetPlayTimeRequested(u64 program_id);
     void DumpRomFSRequested(u64 program_id, const std::string& game_path, DumpRomFSTarget target);
     void VerifyIntegrityRequested(const std::string& game_path);
+    void ConvertToNupRequested(const std::string& game_path);
     void CopyTIDRequested(u64 program_id);
     void CreateShortcut(u64 program_id, const std::string& game_path,
                         const QtCommon::Game::ShortcutTarget target);
@@ -165,6 +167,7 @@ private:
     Core::System& system;
 
     bool m_isTreeMode = true;
+    bool nup_conversion_running{};
     QAbstractItemView* m_currentView = nullptr;
 };
 
diff --git a/src/yuzu/main_window.cpp b/src/yuzu/main_window.cpp
index ab6d243046..2b600946bc 100644
--- a/src/yuzu/main_window.cpp
+++ b/src/yuzu/main_window.cpp
@@ -149,6 +149,7 @@ static FileSys::VirtualFile VfsDirectoryCreateFileWrapper(const FileSys::Virtual
 
 #include "core/file_sys/card_image.h"
 #include "core/file_sys/common_funcs.h"
+#include "core/file_sys/nup_writer.h"
 #include "core/file_sys/romfs.h"
 #include "core/file_sys/savedata_factory.h"
 
@@ -554,6 +555,10 @@ MainWindow::MainWindow(bool has_broken_vulkan)
 }
 
 MainWindow::~MainWindow() {
+    if (nup_cancel) {
+        nup_cancel->store(true);
+    }
+    nup_watcher.waitForFinished();
 #ifdef __APPLE__
     AllowOSSleep();
 #endif
@@ -1458,6 +1463,8 @@ void MainWindow::ConnectWidgetEvents() {
     connect(game_list, &GameList::DumpRomFSRequested, this, &MainWindow::OnGameListDumpRomFS);
     connect(game_list, &GameList::VerifyIntegrityRequested, this,
             &MainWindow::OnGameListVerifyIntegrity);
+    connect(game_list, &GameList::ConvertToNupRequested, this,
+            &MainWindow::OnGameListConvertToNup);
     connect(game_list, &GameList::CopyTIDRequested, this, &MainWindow::OnGameListCopyTID);
     connect(game_list, &GameList::CreateShortcut, this, &MainWindow::OnGameListCreateShortcut);
     connect(game_list, &GameList::AddDirectory, this, &MainWindow::OnGameListAddDirectory);
@@ -1907,6 +1914,12 @@ bool MainWindow::SelectAndSetCurrentUser(
 
 void MainWindow::BootGame(const QString& filename, Service::AM::FrontendAppletParameters params,
                           StartGameType type) {
+    if (nup_running && filename.toStdString() == nup_source_path) {
+        QMessageBox::information(this, tr("Conversion in Progress"),
+                                 tr("This game cannot be started while its dump is being "
+                                    "converted."));
+        return;
+    }
     LOG_INFO(Frontend, "Eglantine starting...");
 
     if (params.program_id == 0 ||
@@ -3967,6 +3980,151 @@ void MainWindow::OnGameListRefresh() {
     SetFirmwareVersion();
 }
 
+void MainWindow::OnGameListConvertToNup(const std::string& game_path) {
+    if (nup_running)
+        return;
+
+    const auto root = FileSys::Nup::DumpRootFromMain(game_path);
+    if (!root)
+        return;
+    const QString convert_title = tr("Convert to NUP");
+    const auto archive = FileSys::Nup::DefaultArchivePath(*root);
+    if (std::filesystem::exists(archive)) {
+        QMessageBox::information(this, convert_title,
+                                 tr("The target archive already exists:\n%1")
+                                     .arg(QString::fromStdString(Common::FS::PathToUTF8String(archive))));
+        return;
+    }
+
+    const bool resume = FileSys::Nup::HasResumableJournal(archive);
+    bool delete_sources = resume;
+    if (resume) {
+        if (QMessageBox::question(this, tr("Resume Conversion"),
+                                  tr("Resume the interrupted conversion?"),
+                                  QMessageBox::Yes | QMessageBox::No) != QMessageBox::Yes)
+            return;
+    } else {
+        QMessageBox prompt(QMessageBox::Question, convert_title,
+                           tr("Source folder:\n%1\n\nTarget archive:\n%2")
+                               .arg(QString::fromStdString(Common::FS::PathToUTF8String(*root)),
+                                    QString::fromStdString(Common::FS::PathToUTF8String(archive))),
+                           QMessageBox::Yes | QMessageBox::No, this);
+        // QMessageBox takes ownership of its check box.
+        auto* low_storage = new QCheckBox(tr("Low storage: delete the original files as they "
+                                             "are packed (cannot be undone)"));
+        prompt.setCheckBox(low_storage);
+        u64 needed{};
+        {
+            std::error_code ec;
+            for (std::filesystem::recursive_directory_iterator it(*root, ec), end;
+                 !ec && it != end; it.increment(ec)) {
+                if (it->is_regular_file(ec))
+                    needed += it->file_size(ec);
+            }
+        }
+        std::error_code space_error;
+        const auto space = std::filesystem::space(archive.parent_path(), space_error);
+        const auto to_mb = [](u64 bytes) { return bytes / (1024 * 1024); };
+        const QString space_info = tr("\n\nApproximate space needed: %1 MB\nFree space on target "
+                                      "volume: %2 MB")
+                                       .arg(to_mb(needed))
+                                       .arg(space_error ? 0 : to_mb(space.available));
+        prompt.setInformativeText(space_info);
+        if (!space_error && space.available < needed) {
+            prompt.setText(prompt.text() + tr("\n\nWarning: free space is less than the "
+                                              "estimated space needed."));
+        }
+        if (prompt.exec() != QMessageBox::Yes)
+            return;
+        delete_sources = low_storage->isChecked();
+    }
+
+    nup_running = true;
+    nup_source_path = game_path;
+    game_list->SetNupConversionRunning(true);
+    nup_cancel = std::make_shared<std::atomic_bool>(false);
+    nup_progress =
+        new QProgressDialog(tr("Preparing conversion..."), tr("Cancel"), 0, 1000, this);
+    nup_progress->setWindowTitle(tr("Converting to NUP"));
+    nup_progress->setMinimumDuration(0);
+    nup_progress->setAutoClose(false);
+    nup_progress->setAutoReset(false);
+    connect(nup_progress, &QProgressDialog::canceled, this,
+            [cancel = nup_cancel] { cancel->store(true); });
+    nup_progress->show();
+
+    const auto cancel = nup_cancel;
+    auto last_update = std::make_shared<std::chrono::steady_clock::time_point>();
+    nup_watcher.setFuture(QtConcurrent::run([this, root = *root, archive, delete_sources,
+                                                  cancel, last_update] {
+        std::string error;
+        const auto on_progress = [this, last_update](
+                                     const FileSys::Nup::PackProgress& progress) {
+                const auto now = std::chrono::steady_clock::now();
+                if (now - *last_update < std::chrono::milliseconds(200))
+                    return;
+                *last_update = now;
+                QMetaObject::invokeMethod(
+                    this,
+                    [this, progress] {
+                        if (!nup_progress)
+                            return;
+                        const auto percent = progress.bytes_total == 0
+                                                 ? 0
+                                                 : static_cast<int>(progress.bytes_done * 1000 /
+                                                                    progress.bytes_total);
+                        nup_progress->setValue(percent);
+                        nup_progress->setLabelText(
+                            tr("%1 / %2 MB\n%3 / %4 files")
+                                .arg(progress.bytes_done / (1024 * 1024))
+                                .arg(progress.bytes_total / (1024 * 1024))
+                                .arg(progress.files_done)
+                                .arg(progress.files_total));
+                    },
+                    Qt::QueuedConnection);
+        };
+        const auto result = FileSys::Nup::PackDump(
+            root, archive, {.delete_sources = delete_sources}, on_progress, cancel.get(), &error);
+        QMetaObject::invokeMethod(
+            this,
+            [this, result, delete_sources, error] {
+                nup_running = false;
+                nup_source_path.clear();
+                game_list->SetNupConversionRunning(false);
+                if (nup_progress) {
+                    nup_progress->close();
+                    nup_progress->deleteLater();
+                    nup_progress = nullptr;
+                }
+                nup_cancel.reset();
+                switch (result) {
+                case FileSys::Nup::PackResult::Success:
+                    QMessageBox::information(
+                        this, tr("Conversion Complete"),
+                        delete_sources ? tr("The NUP was created and the loose folder was "
+                                            "removed.")
+                                       : tr("The NUP was created. You can delete the loose "
+                                            "folder if you no longer need it."));
+                    OnGameListRefresh();
+                    break;
+                case FileSys::Nup::PackResult::Cancelled:
+                    if (delete_sources)
+                        QMessageBox::information(this, tr("Conversion Cancelled"),
+                                                 tr("The conversion can be resumed by choosing "
+                                                    "Convert to NUP again."));
+                    break;
+                case FileSys::Nup::PackResult::InvalidSource:
+                case FileSys::Nup::PackResult::IoError:
+                    QMessageBox::critical(this, tr("Conversion Failed"),
+                                          QString::fromStdString(error));
+                    break;
+                }
+            },
+            Qt::QueuedConnection);
+        return result;
+    }));
+}
+
 void MainWindow::LaunchFirmwareApplet(u64 raw_program_id,
                                       std::optional<Service::NFP::CabinetMode> cabinet_mode) {
     auto const program_id = Service::AM::AppletProgramId(raw_program_id);
diff --git a/src/yuzu/main_window.h b/src/yuzu/main_window.h
index 5181b3fc68..766e4d7345 100644
--- a/src/yuzu/main_window.h
+++ b/src/yuzu/main_window.h
@@ -12,6 +12,7 @@
 #include <filesystem>
 #include <QMainWindow>
 #include <QMessageBox>
+#include <QFutureWatcher>
 #include <QPushButton>
 #include <QTimer>
 #include <QTranslator>
@@ -19,6 +20,7 @@
 
 #include "common/common_types.h"
 #include "common/settings_enums.h"
+#include "core/file_sys/nup_writer.h"
 #include "frontend_common/content_manager.h"
 #include "input_common/drivers/tas_input.h"
 #include "qt_common/config/qt_config.h"
@@ -352,6 +354,7 @@ private slots:
     void OnGameListSetPlayTime(u64 program_id);
     void OnGameListDumpRomFS(u64 program_id, const std::string& game_path, DumpRomFSTarget target);
     void OnGameListVerifyIntegrity(const std::string& game_path);
+    void OnGameListConvertToNup(const std::string& game_path);
     void OnGameListCopyTID(u64 program_id);
     void OnGameListCreateShortcut(u64 program_id, const std::string& game_path,
                                   const QtCommon::Game::ShortcutTarget target);
@@ -571,6 +574,11 @@ private:
 
     // Install progress dialog
     QProgressDialog* install_progress = nullptr;
+    QProgressDialog* nup_progress = nullptr;
+    QFutureWatcher<FileSys::Nup::PackResult> nup_watcher;
+    std::shared_ptr<std::atomic_bool> nup_cancel;
+    bool nup_running{};
+    std::string nup_source_path;
 
     // Last game booted, used for multi-process apps
     QString last_filename_booted;
diff --git a/src/yuzu_cmd/yuzu.cpp b/src/yuzu_cmd/yuzu.cpp
index 4d71a29993..bc4002d8af 100644
--- a/src/yuzu_cmd/yuzu.cpp
+++ b/src/yuzu_cmd/yuzu.cpp
@@ -12,7 +12,9 @@
 #include <cstdlib>
 #include <chrono>
 #include <cstdio>
+#include <csignal>
 #include <cstring>
+#include <filesystem>
 #include <iostream>
 #include <memory>
 #include <mutex>
@@ -36,6 +38,7 @@
 #include "core/core_timing.h"
 #include "core/cpu_manager.h"
 #include "core/crypto/key_manager.h"
+#include "core/file_sys/nup_writer.h"
 #include "core/file_sys/registered_cache.h"
 #include "core/file_sys/vfs/vfs_real.h"
 #include "core/hle/service/am/applet_manager.h"
@@ -248,6 +251,49 @@ struct SdlState {
     std::unique_ptr<EmuWindow_SDL3> emu_window;
 };
 
+static std::atomic_bool pack_nup_cancel{false};
+
+// eden-cli --pack-nup <dump> [<out.nup>]; the output defaults to <dump>.nup next to the dump.
+static bool PackNup(const std::string& source, const std::string& output) {
+    const auto to_path = [](const std::string& utf8) {
+        return std::filesystem::path{std::u8string{utf8.begin(), utf8.end()}};
+    };
+    const auto dump_root = to_path(source);
+    const auto archive =
+        output.empty() ? FileSys::Nup::DefaultArchivePath(dump_root) : to_path(output);
+    std::signal(SIGINT, [](int) { pack_nup_cancel = true; });
+
+    const auto start = std::chrono::steady_clock::now();
+    auto last_report = start;
+    std::string error;
+    const auto result = FileSys::Nup::PackDump(
+        dump_root, archive, {},
+        [&](const FileSys::Nup::PackProgress& p) {
+            const auto now = std::chrono::steady_clock::now();
+            if (now - last_report < std::chrono::seconds(1) && p.files_done != p.files_total) {
+                return;
+            }
+            last_report = now;
+            fmt::print(stderr, "\r{} / {} MiB, {} / {} files", p.bytes_done >> 20,
+                       p.bytes_total >> 20, p.files_done, p.files_total);
+        },
+        &pack_nup_cancel, &error);
+    const auto seconds =
+        std::chrono::duration<double>(std::chrono::steady_clock::now() - start).count();
+    fmt::print(stderr, "\n");
+    switch (result) {
+    case FileSys::Nup::PackResult::Success:
+        fmt::print(stderr, "Wrote {} in {:.1f} s\n", archive.string(), seconds);
+        return true;
+    case FileSys::Nup::PackResult::Cancelled:
+        fmt::print(stderr, "Cancelled\n");
+        return false;
+    default:
+        fmt::print(stderr, "Packing failed: {}\n", error);
+        return false;
+    }
+}
+
 extern "C" SDL_AppResult SDL_AppInit(void **appstate, int argc, char **argv) {
 #ifdef _WIN32
     SetUnhandledExceptionFilter(WriteCrashDump);
@@ -298,6 +344,10 @@ extern "C" SDL_AppResult SDL_AppInit(void **appstate, int argc, char **argv) {
 
     Core::ApplyLaunchParams(lp);
 
+    if (lp.pack_nup_source) {
+        return PackNup(*lp.pack_nup_source, lp.filepath) ? SDL_APP_SUCCESS : SDL_APP_FAILURE;
+    }
+
     if (lp.filepath.empty()) {
         LOG_CRITICAL(Frontend, "Failed to load ROM: No ROM specified");
         return SDL_APP_FAILURE;