The Ghost Engine is the operational paradigm that defines Pisces Moon OS. It runs on Core 0. Always. You cannot stop it by using the device — because it does not run on the core the device uses. It wardrives while you play a game. It logs BLE beacons while you use the AI terminal. It maintains GPS fix while you browse files. The wardrive count increments while you do anything else. The operator never has to initiate it, manage it, or think about it. It just runs.
No previous ESP32-S3 project implemented this architecture. Every previous project was single-function firmware — the device did one thing because the entire processor was dedicated to that one thing. The Ghost Engine is the first implementation of persistent Core 0 background intelligence collection on this hardware class. The device is always collecting. The operator is never interrupted. That is the use case that makes Pisces Moon OS different from every other ESP32-S3 OS that exists.
"The Ghost Engine never stops. The SPI Bus Treaty is why."
The SPI Bus Treaty is the contribution this project produced that belongs to the field. It is not a bug fix. It is the first named architectural standard for shared-bus arbitration on the ESP32-S3 hardware class — a formal behavioral protocol that governs how all OS components and third-party developers must interact with the SPI bus when running concurrent multi-subsystem workloads. It did not exist before this project. It now belongs to the public technical literature.
The Treaty is what makes persistent dual-core background tasking possible on this hardware. Without it, concurrent SD card and LoRa radio operation under sustained load causes non-deterministic fatal exceptions. With it, Core 0 runs the Ghost Engine continuously — wardriving, BLE scanning, GPS logging — while Core 1 serves the operator without interruption. The device is always collecting. The operator never knows it.
The historical lineage: Unix filesystem locking conventions (1970s), the Apollo AGC priority scheduling protocol (1969), Nintendo's N64 RSP time budget (1996). In each case the solution to competing subsystems sharing a hardware resource was not a patch — it was a protocol. A named standard. The SPI Bus Treaty is that standard for the ESP32-S3.
"Any developer who builds concurrent multi-subsystem software on this hardware and encounters this problem now has a reference. They did not have one before."
Pisces Moon OS is a dual-core operating system for the LilyGO T-Deck Plus — a $50 device with a color screen, a physical QWERTY keyboard, a touchscreen, a trackball, WiFi, Bluetooth LE, LoRa long-range radio, GPS, I2S audio, and MicroSD storage. It ships 47 applications across 7 categories, runs a continuous passive wardriving engine on Core 0 while the user operates any application on Core 1, and provides a hardware-secured Ghost Partition with sub-millisecond data destruction.
"The forge didn't need VC funding to build the Saturn V. It just needed focus and the right raw materials."
Every previous ESP32-S3 project was single-function firmware. Pisces Moon OS is the first platform where you launch applications, switch between them, and the device's identity is not defined by what is currently running.
Enterprise field intelligence hardware costs $500–$2,000 per unit. Pisces Moon OS on a $50 T-Deck Plus exceeds the capabilities of commercial alternatives at a fraction of the cost. The sunk hardware cost is already paid.
AI inference runs on-device via the Gemini API with user-supplied tokens — no data leaving the hardware in offline mode. LoRa mesh radio operates without cell towers or internet infrastructure. The Ghost Partition protects sensitive data without cloud key management.
MicroSD and LoRa radio share the ESP32-S3's SPI bus. Simultaneous operation under sustained load causes non-deterministic Guru Meditation crashes. No documented solution existed for this hardware platform.
A named architectural standard. Four rules: hit and run (open, write, close, release immediately), no extended holds, radio traffic management via shared boolean flag, metadata-only destructive operations. Every component in the OS obeys them. Every third-party ELF module developer is required to obey them. The Treaty is a platform contract, not an implementation detail — and the first documented instance of this solution class on the ESP32-S3.
Running wardriving, AI client, BLE scanner, GPS, LoRa, and 60fps UI simultaneously exhausts 320KB internal SRAM. Crashes appeared as different bugs in different subsystems.
Single compiler flag -DCONFIG_SPIRAM_USE_MALLOC=1 transparently routes large heap allocations to 8MB PSRAM. First application in a general-purpose OS context for this hardware.
Core 0 Ghost Engine and Core 1 UI concurrent SD card access corrupts SdFat data structures. Only manifests at high WiFi network density — invisible in lab, near-certain in downtown Los Angeles.
Mutex created before either core starts. Every SD operation acquires, executes, releases. Radio state flag prevents simultaneous AI client and wardriving scanner operation. Zero crashes post-implementation in field testing.
150+ simultaneous BLE advertising devices cause callback stack overflow. GPS timeouts, display corruption, and random reboots were all the same root cause — impossible to reproduce in a lab.
All three fixes required simultaneously. Validated in downtown Los Angeles: sustained operation, no crashes, GPS fix maintained throughout.
AES encryption — the standard solution for the Ghost Partition — holds the SPI bus long enough to crash the device via the same mechanism as Problem 1.
Deleting OS index files renders all Ghost Partition data permanently unreachable in milliseconds, within SPI Bus Treaty budget. Threat model documented honestly: complete against casual inspection, meaningful delay against laboratory forensics.
LilyGO manufactured two production batches with different GPS modules at different baud rates. Undocumented. Silent failure — no error output. No fix in any community forum.
Attempts initialization at each supported rate, latches to first valid NMEA output. First documented solution to this hardware variation problem.
Dual-core architecture: Core 1 (UI + applications) / Core 0 (Ghost Engine wardriving). 47 applications across: Security Tools, AI Terminal, Communications, Games, Utilities, CYBER Tools, Field Reference. ELF module runtime for SD card app deployment without reflashing.
T-Deck Plus hardware: $96 · MicroSD: $8 · Cloud AI (Claude Sonnet): $40 · Total: $144
Enterprise equivalent: Ruggedized edge device with GPS and LoRa: $500–$2,000. Security licensing and MDM overhead: thousands per seat per year. Engineering team to solve the same problems: tens of thousands in payroll. The gap is the argument.