Merge upstream/main (2026-10-24): OpenCE network version 38

OpenCE gametypes named in the server browser (network version 37), and
the host may leave the shield effects to each player (SHIELD EFFECTS'
PLAYERS' OWN, network version 38). The conflict: our Android listing
declarations stay beside upstream's p2p_set_game_listing with its new
kind.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
   - name: How to install
-    url: https://github.com/Cesarus85/ringfall-mjolnir-vr#install-on-meta-quest-3--3s
+    url: https://github.com/Cesarus85/mjolnir-vr#install-on-meta-quest-3--3s
     about: Step-by-step installation for the Quest 3 / 3S and the Steam Frame.

.github/workflows/build.yml

@@ -1,8 +1,8 @@
 name: Build
 
-# Debug and release builds of the native ports (Linux, Windows, Android) for
-# every pushed commit, uploaded as artifacts. tools/ci_build.py does each
-# build; see it for the options.
+# Debug and release builds of the native ports (Linux, Windows, Android) and
+# the web port for every pushed commit, uploaded as artifacts.
+# tools/ci_build.py does each build; see it for the options.
 #
 # Kept cheap:
 # - one job per platform builds both configurations, so its set-up (tools,
@@ -13,14 +13,21 @@ name: Build
 # - a newer push to the same branch cancels a run still going;
 # - pushes that only change documentation do not build;
 # - Windows, whose minutes cost twice Linux's, builds only Windows;
+# - Mjolnir VR builds only Android (the VR app): the Linux and
+#   Windows jobs are kept, off (if: false), so that upstream's changes to
+#   them still merge;
 # - artifacts are kept for three days.
 #
 # A successful build of main is also published as a GitHub release, the
 # newest marked latest, so that
 # https://github.com/<repository>/releases/latest/download/<file> always
-# gives the latest build; the last five are kept.
+# gives the latest build; the last five are kept. Its web build is then the
+# site on GitHub Pages (https://halocombatevolved.com/, port/web/README.md).
 on:
+  # (Mjolnir VR: main only; its branches are tried on the headsets
+  # from local builds)
   push:
+    branches: [main]
     paths-ignore:
       - "**.md"
   workflow_dispatch:
@@ -45,6 +52,8 @@ env:
 
 jobs:
   linux:
+    # (off: Mjolnir VR ships the Android app only)
+    if: ${{ false }}
     # Arch Linux has what the build needs as packages: clang 22 (for the
     # profile-guided optimisation in pgo/), and CMake, pkg-config and
     # wayland-scanner for the SDL 3 that the portable build brings. The build
@@ -90,7 +99,7 @@ jobs:
 
       - name: Test
         run: |
-          python -m pytest -q tools/test_linux_port.py tools/test_host_watch_hash.py tools/test_touch_menu.py tools/harness tools/test_profile.py
+          python -m pytest -q tools/test_linux_port.py tools/test_android_asm_convert.py tools/test_android_mirror_uploads.py tools/test_android_ce_texture_cache.py tools/test_host_watch_hash.py tools/test_touch_menu.py tools/harness tools/test_profile.py tools/stagekit/tests tools/test_net_compare.py
           python tools/test_light_storage.py
 
       - name: Compile cache
@@ -116,10 +125,15 @@ jobs:
       - name: Install the toolchain
         run: |
           mkdir -p "$RUNNER_TEMP/tools"
+          # (each download checked against the hash it had when it was pinned)
           curl -fsSL -o ninja.zip https://github.com/ninja-build/ninja/releases/download/v1.12.1/ninja-linux.zip
+          curl -fsSL -o ccache.tar.xz https://github.com/ccache/ccache/releases/download/v4.10.2/ccache-4.10.2-linux-x86_64.tar.xz
+          sha256sum -c - <<'EOF'
+          6f98805688d19672bd699fbbfa2c2cf0fc054ac3df1f0e6a47664d963d530255  ninja.zip
+          80cab87bd510eca796467aee8e663c398239e0df1c4800a0b5dff11dca0b4f18  ccache.tar.xz
+          EOF
           unzip -q ninja.zip -d "$RUNNER_TEMP/tools" && rm ninja.zip
-          curl -fsSL https://github.com/ccache/ccache/releases/download/v4.10.2/ccache-4.10.2-linux-x86_64.tar.xz \
-            | tar -xJ -C "$RUNNER_TEMP/tools" --strip-components=1 ccache-4.10.2-linux-x86_64/ccache
+          tar -xJf ccache.tar.xz -C "$RUNNER_TEMP/tools" --strip-components=1 ccache-4.10.2-linux-x86_64/ccache && rm ccache.tar.xz
           echo "$RUNNER_TEMP/tools" >> "$GITHUB_PATH"
 
       - uses: actions/checkout@v4
@@ -189,6 +203,8 @@ jobs:
           retention-days: 3
 
   windows:
+    # (off: Mjolnir VR ships the Android app only)
+    if: ${{ false }}
     # The runner image has LLVM, Python and Visual Studio's x86 libraries and
     # Windows SDK.
     runs-on: windows-2025
@@ -201,8 +217,11 @@ jobs:
         shell: pwsh
         run: |
           Invoke-WebRequest -OutFile ninja.zip https://github.com/ninja-build/ninja/releases/download/v1.12.1/ninja-win.zip
-          Expand-Archive ninja.zip -DestinationPath "$env:RUNNER_TEMP\tools"
           Invoke-WebRequest -OutFile ccache.zip https://github.com/ccache/ccache/releases/download/v4.10.2/ccache-4.10.2-windows-x86_64.zip
+          # (each download checked against the hash it had when it was pinned)
+          if ((Get-FileHash ninja.zip -Algorithm SHA256).Hash -ne "F550FEC705B6D6FF58F2DB3C374C2277A37691678D6ABA463ADCBB129108467A") { throw "ninja.zip: unexpected SHA-256" }
+          if ((Get-FileHash ccache.zip -Algorithm SHA256).Hash -ne "6252F081876A9A9F700FAE13A5AEC5D0D486B28261D7F1F72AC11C7AD9DF4DA9") { throw "ccache.zip: unexpected SHA-256" }
+          Expand-Archive ninja.zip -DestinationPath "$env:RUNNER_TEMP\tools"
           Expand-Archive ccache.zip -DestinationPath $env:RUNNER_TEMP
           Copy-Item "$env:RUNNER_TEMP\ccache-4.10.2-windows-x86_64\ccache.exe" "$env:RUNNER_TEMP\tools"
           Remove-Item ninja.zip, ccache.zip
@@ -259,13 +278,92 @@ jobs:
           path: dist/halo-windows-release-symbols
           retention-days: 3
 
+  web:
+    # (off: Mjolnir VR ships the Android app only)
+    if: ${{ false }}
+    # Emscripten (emsdk, the version below, cached) builds the web port's
+    # site (port/web/README.md); the tests check its graph, the page's
+    # importer and service worker, its sockets, that it starts in a
+    # headless Chromium (with no game data, as far as the menus' map), and
+    # that two browsers join a room through a local MQTT broker.
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    env:
+      EMSDK_VERSION: 6.0.10
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/cache@v4
+        with:
+          path: ~/emsdk
+          key: emsdk-${{ env.EMSDK_VERSION }}-${{ hashFiles('port/web/halo_sdl3.py') }}
+
+      - name: Install the toolchain
+        run: |
+          if [ ! -x ~/emsdk/upstream/emscripten/emcc ]; then
+            rm -rf ~/emsdk
+            git clone --depth 1 https://github.com/emscripten-core/emsdk.git ~/emsdk
+            ~/emsdk/emsdk install "$EMSDK_VERSION"
+          fi
+          ~/emsdk/emsdk activate "$EMSDK_VERSION"
+          sudo apt-get update -q
+          sudo apt-get install -y -q ninja-build ccache python3-pytest mosquitto
+
+      - uses: actions/cache@v4
+        with:
+          path: .ccache
+          key: ccache-web-${{ github.sha }}
+          restore-keys: ccache-web-
+
+      - name: Debug
+        run: |
+          source ~/emsdk/emsdk_env.sh
+          python3 tools/ci_build.py web debug
+
+      - name: Release
+        run: |
+          source ~/emsdk/emsdk_env.sh
+          python3 tools/ci_build.py web release
+
+      - name: Test
+        run: |
+          source ~/emsdk/emsdk_env.sh
+          node --test "port/web/tests/*.test.js"
+          python3 -m pytest -q tools/test_web_build.py
+
+      - name: Test in Chromium and Firefox
+        run: |
+          npm install --no-save --prefix "$RUNNER_TEMP/playwright" playwright@1.58
+          "$RUNNER_TEMP/playwright/node_modules/.bin/playwright" install --with-deps chromium firefox
+          NODE_PATH="$RUNNER_TEMP/playwright/node_modules" node port/web/tests/smoke.mjs dist/halo-web-release
+          NODE_PATH="$RUNNER_TEMP/playwright/node_modules" node port/web/tests/rooms.mjs dist/halo-web-release
+          # (the native builds' WebRTC, port/linux/src/p2p_webrtc.c, with both)
+          NODE_PATH="$RUNNER_TEMP/playwright/node_modules" node port/web/tests/webrtc_native.mjs chromium firefox
+
+      - name: Compile cache
+        run: ccache --show-stats
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: halo-web-debug
+          path: dist/halo-web-debug
+          include-hidden-files: true
+          retention-days: 3
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: halo-web-release
+          path: dist/halo-web-release
+          include-hidden-files: true
+          retention-days: 3
+
   release:
-    # The six builds (and the Windows builds' PDBs) as a release, tagged
+    # The eight builds (and the Windows builds' PDBs) as a release, tagged
     # build-<run number> and marked latest
     # (every file keeps its name from release to release, for the README's
     # latest/download links); then all but the newest five build-* releases
     # go, tags and all. Only for main, and only when every platform built.
-    needs: [linux, android, windows]
+    needs: [android]
     if: ${{ github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 15
@@ -281,7 +379,6 @@ jobs:
         with:
           sparse-checkout: |
             port/android
-            port/third_party/extract-xiso
             tools
 
       - uses: actions/download-artifact@v4
@@ -292,18 +389,26 @@ jobs:
       - name: Package
         run: |
           mkdir release
-          # (Ringfall: Mjolnir VR publishes its Android builds only, under
+          # (Mjolnir VR publishes its Android builds only, under
           # its own name: Updater.java looks for them; the desktop ports are
           # built to keep them building)
           for config in debug release; do
             (cd "artifacts/halo-android-$config" &&
-              zip -qr "$GITHUB_WORKSPACE/release/ringfall-mjolnir-vr-android-$config.zip" .)
+              zip -qr "$GITHUB_WORKSPACE/release/mjolnir-vr-android-$config.zip" .)
           done
           # the Steam Frame's installer (port/android/STEAM_FRAME.md): its
           # bundle with the release APK, and the desktop file that fetches it
           python3 tools/steam_frame_bundle.py artifacts/halo-android-release/app-release.apk release "$GH_REPO"
           # the APK itself, for sideloading on the Quest (SideQuest, adb)
-          cp artifacts/halo-android-release/app-release.apk release/RingfallMjolnirVR.apk
+          cp artifacts/halo-android-release/app-release.apk release/MjolnirVR.apk
+          # the same under the names before "Mjolnir VR" (Ringfall: Mjolnir
+          # VR, builds 302 to 313): their updaters (Updater.java, the Frame's
+          # launcher) and the links already shared ask for them
+          cp release/mjolnir-vr-android-debug.zip release/ringfall-mjolnir-vr-android-debug.zip
+          cp release/mjolnir-vr-android-release.zip release/ringfall-mjolnir-vr-android-release.zip
+          cp release/mjolnir-vr-steam-frame.zip release/ringfall-mjolnir-vr-steam-frame.zip
+          cp release/Install-Mjolnir-VR.desktop release/Install-Ringfall-Mjolnir-VR.desktop
+          cp release/MjolnirVR.apk release/RingfallMjolnirVR.apk
           ls -l release
 
       - name: Publish
@@ -318,15 +423,15 @@ jobs:
           readme="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
           {
             printf '%s\n\n' "$subject"
-            printf '**Ringfall: Mjolnir VR** is an unofficial VR mod for Halo: Combat Evolved. It needs a disc image of your own, purchased Xbox copy of the game; no game files are included.\n\n'
+            printf '**Mjolnir VR** is an unofficial VR mod for Halo: Combat Evolved. It needs a disc image of your own, purchased Xbox copy of the game; no game files are included.\n\n'
             printf '| Headset | Download | How to install |\n| --- | --- | --- |\n'
-            printf '| Meta Quest 3 / 3S | `RingfallMjolnirVR.apk` | [Install on Quest](%s#install-on-meta-quest-3--3s) |\n' "$readme"
-            printf '| Steam Frame | `Install-Ringfall-Mjolnir-VR.desktop` (open it in Desktop Mode) | [Install on Steam Frame](%s#install-on-steam-frame) |\n\n' "$readme"
-            printf 'The other files are for the built-in updater and the Steam Frame installer.\n\n'
+            printf '| Meta Quest 3 / 3S | `MjolnirVR.apk` | [Install on Quest](%s#install-on-meta-quest-3--3s) |\n' "$readme"
+            printf '| Steam Frame | `Install-Mjolnir-VR.desktop` (open it in Desktop Mode) | [Install on Steam Frame](%s#install-on-steam-frame) |\n\n' "$readme"
+            printf 'The other files are for the built-in updater and the Steam Frame installer (those named `ringfall-…` / `Ringfall…`: the same, for the builds before the name Mjolnir VR).\n\n'
             printf 'Commit: %s\nBuild: %s\n' "$COMMIT_URL" "$RUN_URL"
           } > notes.md
           gh release create "$tag" release/* --target "$GITHUB_SHA" --latest \
-            --title "Ringfall: Mjolnir VR, build $GITHUB_RUN_NUMBER (${GITHUB_SHA:0:7})" --notes-file notes.md
+            --title "Mjolnir VR, build $GITHUB_RUN_NUMBER (${GITHUB_SHA:0:7})" --notes-file notes.md
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
 
       # The Windows builds' executables and PDBs to Sentry, which turns the
@@ -367,12 +472,87 @@ jobs:
             gh release delete "$tag" --cleanup-tag --yes
           done
 
+  pages:
+    # (off: Mjolnir VR ships the Android app only)
+    if: ${{ false }}
+    # The release's web build to GitHub Pages, which serves it at
+    # https://halocombatevolved.com/ (port/web/README.md, "Hosting"). Only
+    # main, only once every platform built and the release is out (the site
+    # and the release are one build), and a deployment is never cancelled
+    # halfway. The repository's Pages source must be GitHub Actions.
+    needs: [release]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pages: write
+      id-token: write
+    concurrency:
+      group: pages
+      cancel-in-progress: false
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: halo-web-release
+          path: site
+
+      # The game's wasm, most of a build, from jsDelivr rather than GitHub
+      # Pages, which serves 100 GB a month: the wasm alone in a commit of the
+      # web-wasm branch (pushed over the last, so the repository keeps one),
+      # which jsDelivr serves by its hash (with CORS; GitHub's release
+      # downloads have none, so a page cannot fetch them), and version.json
+      # names that copy and its SHA-256. The site's service worker takes the
+      # wasm from there, checked, and from the site only when it cannot
+      # (port/web/site/sw.js). A failure here leaves the site serving it.
+      - name: The wasm on jsDelivr
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          sha256="$(sha256sum site/halo.wasm | cut -d' ' -f1)"
+          mkdir wasm
+          cp site/halo.wasm wasm/
+          cd wasm
+          git init -q -b web-wasm
+          git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
+            add halo.wasm
+          git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
+            commit -q -m "The web build's wasm (build $GITHUB_RUN_NUMBER, $GITHUB_SHA)"
+          git push -q --force "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:refs/heads/web-wasm
+          url="https://cdn.jsdelivr.net/gh/${GITHUB_REPOSITORY}@$(git rev-parse HEAD)/halo.wasm"
+          # (jsDelivr fetches it now, and it must be the same file: it serves
+          # files of at most 20 MB from GitHub)
+          curl -fsSL --retry 6 --retry-delay 10 --retry-all-errors -o served.wasm "$url"
+          echo "$sha256  served.wasm" | sha256sum -c -
+          cd ..
+          python3 - "$url" "$sha256" <<'EOF'
+          import json, sys
+          with open("site/version.json") as file:
+              stamp = json.load(file)
+          stamp["wasm"] = {"url": sys.argv[1], "sha256": sys.argv[2]}
+          with open("site/version.json", "w") as file:
+              json.dump(stamp, file, indent=1)
+          EOF
+          echo "the wasm from $url"
+
+      - uses: actions/configure-pages@v5
+
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+
+      - id: deploy
+        uses: actions/deploy-pages@v4
+
   notify:
     # A Discord embed for the run, to the DISCORD_WEBHOOK secret (nothing
     # without it): green when every platform built, red when one did not,
     # with each platform's result, this run's release (main only), and links
     # to the latest release's builds.
-    needs: [linux, android, windows, release]
+    needs: [android, release]
     if: ${{ !cancelled() }}
     runs-on: ubuntu-24.04
     timeout-minutes: 5
@@ -383,6 +563,9 @@ jobs:
           LINUX: ${{ needs.linux.result }}
           ANDROID: ${{ needs.android.result }}
           WINDOWS: ${{ needs.windows.result }}
+          WEB: ${{ needs.web.result }}
+          PAGES: ${{ needs.pages.result }}
+          SITE_URL: https://halocombatevolved.com/
           RELEASE_TAG: ${{ needs.release.outputs.tag }}
           SERVER: ${{ github.server_url }}
           REPOSITORY: ${{ github.repository }}
@@ -405,15 +588,18 @@ jobs:
               *) echo "➖ Skipped" ;;
             esac
           }
-          if [ "$LINUX" = success ] && [ "$ANDROID" = success ] && [ "$WINDOWS" = success ]; then
+          if [ "$ANDROID" = success ]; then
             title="Build succeeded"; color=5763719
           else
             title="Build failed"; color=15548997
           fi
           latest="$SERVER/$REPOSITORY/releases/latest"
-          downloads="[Quest]($latest/download/ringfall-mjolnir-vr-android-release.zip) · [Steam Frame]($latest/download/Install-Ringfall-Mjolnir-VR.desktop) ([all builds]($latest))"
+          downloads="[Quest]($latest/download/mjolnir-vr-android-release.zip) · [Steam Frame]($latest/download/Install-Mjolnir-VR.desktop) ([all builds]($latest))"
           if [ -n "$RELEASE_TAG" ]; then
             release="[$RELEASE_TAG]($SERVER/$REPOSITORY/releases/tag/$RELEASE_TAG)"
+            if [ "$PAGES" = success ]; then
+              release="$release, on [the site]($SITE_URL)"
+            fi
           else
             release="None (only a successful build of main makes one)"
           fi
@@ -423,6 +609,7 @@ jobs:
             --arg description "[\`${SHA:0:7}\`]($COMMIT_URL) $subject — $ACTOR ($BRANCH)" \
             --arg release "$release" --arg downloads "$downloads" \
             --arg linux "$(status "$LINUX")" --arg windows "$(status "$WINDOWS")" --arg android "$(status "$ANDROID")" \
+            --arg web "$(status "$WEB")" \
             --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
             '{embeds: [{
               title: $title, url: $url, color: $color, description: $description, timestamp: $timestamp,
@@ -430,6 +617,7 @@ jobs:
                 {name: "Linux", value: $linux, inline: true},
                 {name: "Windows", value: $windows, inline: true},
                 {name: "Android", value: $android, inline: true},
+                {name: "Web", value: $web, inline: true},
                 {name: "Release", value: $release},
                 {name: "Latest release builds", value: $downloads}
               ]

AGENTS.md

@@ -1,7 +1,7 @@
 # Notes for agents
 
 This repository ports the Halo: Combat Evolved decompilation (Xbox build
-01.01.14.2342, `cachebeta.exe`) to Linux, Windows and Android. The game's C
+01.01.14.2342, `cachebeta.exe`) to Linux, Windows, Android and the web. The game's C
 sources are the decompilation; the port adds a platform layer that
 implements the Xbox APIs the game calls, and features the Xbox game did not
 have (a new netcode, internet play, the PC version's menus, Custom Edition
@@ -15,17 +15,18 @@ end.
 | Path | Contents |
 | --- | --- |
 | `source/` | The game: 466 C files of the decompilation, compiled as they are with few changes (each marked, below) |
-| `port/linux/src/` | The platform layer the three ports share: Direct3D 8 on OpenGL (`d3d8_gl.c`), DirectSound and XInput on SDL3, files, threads, memory, sockets, settings (`port_config.c`), internet play (`p2p*.c`) |
-| `port/linux/game/` | The port's game-side code, compiled as the game's sources are: the distributed netcode (`network_*.c`), co-op, the menus (`menu_tags.c`, `menu_functions.c`), Custom Edition maps (`custom_edition_*.c`, `cache_file_formats.c`), the tag validator (`tag_validate.c`, `tag_schema_*.c`), touch, FOV and more |
+| `port/linux/src/` | The platform layer the three ports share: Direct3D 8 on OpenGL (`d3d8_gl.c`), DirectSound and XInput on SDL3, files, threads, memory, sockets, settings (`port_config.c`), the mods folder (`port_mods.c`), internet play (`p2p*.c`) |
+| `port/linux/game/` | The port's game-side code, compiled as the game's sources are: the distributed netcode (`network_*.c`), co-op, OpenCE's gametypes (`game_modes.c`, `infection.c`, `gun_game.c`), map sharing (`map_share*.c`), the menus (`menu_tags.c`, `menu_functions.c`), Custom Edition maps (`custom_edition_*.c`, `cache_file_formats.c`), the tag validator (`tag_validate.c`, `tag_schema_*.c`), mods (`mods.c`, `mod_*.c`), streamer mode's word filter (`text_filter*.c`), touch, FOV and more |
 | `port/linux/include/` | The port's headers: the limits (`halo_port_limits.h`, with `HALO_PORT_NETWORK_VERSION`), capacities (`halo_port_capacity.h`), the prefix header, `halo_linux_source_fixups.h` (port functions the game's sources call) |
 | `port/include/xdk/` | Stand-ins for the Xbox SDK's headers (declarations only) |
 | `port/windows/` | The Windows build's own files (`win32_*.c`, headers) |
 | `port/android/` | The Android app: the guest runtime, the host library (`host/`), the Java app (`app/`), host imports (`host_imports.list`) |
+| `port/web/` | The web build: its runtime (`src/`: entry, sockets inside the page, memory watch), the page and its service worker (`site/`), the SDL port, tests |
 | `port/assets/` | What the builds embed or ship: high-res HUD (`hud/`), fonts, titles, menus (`menus/`), icons, network brokers |
 | `port/third_party/` | Vendored libraries, each with a README naming its upstream, version and checksum |
 | `port/tools/` | Stand-alone tools (`cache_file_report.c`) |
-| `tools/` | Build scripts (`linux_build.py`, `windows_build.py`, `android_build.py`, `ci_build.py`), generators (`ce_menus.py`, `port_settings.py`, `hud_assets.py`, `title_assets.py`, `embed_assets.py`, `xdk_headers.py`) and tests |
-| `docs/` | Longer design notes (`custom_edition_caches.md`) |
+| `tools/` | Build scripts (`linux_build.py`, `windows_build.py`, `android_build.py`, `web_build.py`, `ci_build.py`, `web_serve.py`), generators (`ce_menus.py`, `port_settings.py`, `hud_assets.py`, `title_assets.py`, `embed_assets.py`, `xdk_headers.py`), tests, and `stagekit/` (scenarios staged and instrumented on the real engine, no retail assets) |
+| `docs/` | Longer design notes (`custom_edition_caches.md`, `mods.md`) |
 | `pgo/` | Profile-guided optimisation profiles |
 | `assets/` | Game data for local runs (gitignored: `maps/`, `custom_maps/`) |
 | `.github/workflows/` | CI: builds every platform on each push, publishes releases from `main` |
@@ -37,7 +38,8 @@ python configure.py            # debug build; add --release, --portable, --profi
 ninja linux                    # build/linux/halo
 ninja android                  # the Android guest image and native libraries
 ninja android_apk              # the APK (Gradle)
-ninja windows                  # on Windows only
+ninja web                      # build/web/site (Emscripten: port/web/README.md)
+ninja windows                  # on Windows, or on Linux after configure.py --windows-cross
 python tools/ci_build.py linux release   # what CI builds
 ```
 
@@ -55,14 +57,19 @@ python tools/ci_build.py linux release   # what CI builds
   and only the SDL functions `guest_sdl.c` bridges. Run `ninja android`
   after changing anything it compiles: `port/linux/src`, `port/linux/game`,
   `port/android`, `source/`, the build scripts.
+- Web: the game is `wasm32` (also ILP32), run on a Web Worker; calls must
+  match their callee's type exactly (the link fails on a mismatch), and
+  WebGL 2 is ES 3.0. Run `ninja web` after changing what it compiles (as
+  for Android, and `port/web`). Refer to [port/web/README.md](port/web/README.md).
 
 ### Defines
 
 | Define | Set by | Meaning |
 | --- | --- | --- |
 | `HALO_ANDROID` | Android | The app: its display, input, files and lifecycle |
-| `HALO_GLES` | Android | The OpenGL ES renderer |
+| `HALO_GLES` | Android, web | The OpenGL ES renderer |
 | `HALO_ARM64_GUEST` | Android | The guest's ABI (ILP32 AArch64) |
+| `HALO_WEB` | Web | The browser: its frames, storage, sockets and WebGL 2's limits (with `HALO_GLES`, not `HALO_ANDROID`) |
 | `HALO_WINDOWS` | Windows (`halo_windows_prefix.h`) | The Windows build |
 | `HALO_RELEASE` | `--release` | No assertions checked |
 | `HALO_PROFILE` | `--profile` | The profiling build; a normal build must be unchanged by it |
@@ -76,15 +83,25 @@ setting (`game.custom_edition`), checked at run time with
 
 ```sh
 python -m pytest -q tools/harness tools/test_touch_menu.py   # the engine's functions in a fake world
+python -m pytest -q tools/stagekit/tests                    # scenarios on the real engine, no retail assets (Linux)
 python -m pytest -q tools/test_linux_port.py                # the build, the maps' checks (needs assets/maps)
+python -m pytest -q tools/test_mods.py                      # mods played over a map (needs assets/maps)
+python -m pytest -q tools/test_bots.py                      # the bots in local games (needs assets/maps)
 python -m pytest -q tools/test_cache_file_formats.py tools/test_bmp_files.py tools/test_profile.py
 python tools/test_touch_layout.py                           # the Android touch layout (JDK 17+)
 python tools/test_light_storage.py
 python tools/test_death_timing.py
+python -m pytest -q tools/test_web_build.py                 # the web build's graph, sockets, menus
+node --test "port/web/tests/*.test.js"                      # the web page's importer and service worker
+node port/web/tests/webrtc_native.mjs chromium firefox      # the native builds' WebRTC with browsers (Playwright)
+python -m pytest -q tools/test_net_compare.py               # net_compare.py's judging of logs, its copies and their processes
+python tools/net_compare.py --a build/linux/halo --b <other build> --data <game data> --swap
+                                                            # two builds in one network game, in step (retail maps: local only)
 ```
 
 `tools/harness/README.md` explains how to add an asset-free test: the code
-under test is taken from the sources, not copied.
+under test is taken from the sources, not copied. `tools/stagekit/README.md`
+explains how to add a scenario: the real engine, with no retail assets.
 
 Running the game without a person at it:
 
@@ -128,6 +145,11 @@ read `xbox/include`. To add a name, follow `port/include/xdk/README.md`.
   do not play together.
 - Only the host decides; clients predict their own players. Read
   `port/linux/NETCODE.md` before changing the netcode.
+- Internet play is the same code in every build, the web's too: a browser's
+  tunnel is a WebRTC data channel (`port/web/src/web_p2p.c`), which the
+  native builds take on their tunnel's socket (`p2p_webrtc.c`, `posix_dtls.c`).
+  Check a change with both (`port/web/tests/webrtc_native.mjs`, and with the
+  maps `port/web/tests/internet.mjs`).
 - Anything another machine sends is untrusted: check sizes, indices and
   rates, as the existing handlers do. `debug.network_corrupt` tests this.
 
@@ -174,10 +196,18 @@ otherwise.
 
 ### Third-party code and licences
 
-The repository is CC0. Vendored code goes in `port/third_party/<name>`,
-copied unchanged, with a README naming the upstream, the version or commit,
-the checksum and what uses it. GPL code (OpenSauce, Reclaimer) may be read
-as documentation of file formats, never copied.
+The repository is `AGPL-3.0-or-later` (`LICENSE`); the commits before the
+change, and the releases built from them, stay CC0 (`LICENSES/CC0-1.0.txt`).
+The README's "Licence" section says what each part is under. Vendored code
+goes in `port/third_party/<name>`, copied unchanged, with a README naming
+the upstream, the version or commit, the licence, the checksum and what uses
+it. Its licence must let it be combined with the AGPL 3.0: MIT, BSD (without
+an advertising clause), ISC, zlib, Apache 2.0, MPL 2.0, LGPL or GPL 3.0 or
+later, public domain. GPL-2.0-only code and the 4-clause BSD licence cannot
+be. Code taken from another project, GPL 3.0 code included, keeps its
+notices and its licence, and says where it came from.
+The decompilation's upstream, punpckhdq/halo, is AGPL 3.0 from 17 October
+2026; bnunu/halo-1 is CC0.
 
 ### Commits and pull requests
 
@@ -194,16 +224,20 @@ as documentation of file formats, never copied.
 | Document | About |
 | --- | --- |
 | [README.md](README.md) | Downloads, game data, building, build options, profiling builds |
-| [port/linux/README.md](port/linux/README.md) | The Linux build, controls, menus, every setting, updates, frame rate, field of view, system link, internet play, voice chat, the server browser, security, map checks, how the port operates, the game source changes |
-| [port/linux/NETCODE.md](port/linux/NETCODE.md) | The distributed netcode, network versions, joining a game in progress, transport, testing |
+| [port/linux/README.md](port/linux/README.md) | The Linux build, controls, menus, every setting, updates, frame rate, field of view, system link, internet play, voice chat, the server browser, map sharing, security, map checks, how the port operates, the game source changes |
+| [port/linux/NETCODE.md](port/linux/NETCODE.md) | The distributed netcode, network versions, joining a game in progress, map sharing, transport, testing |
 | [port/windows/README.md](port/windows/README.md) | The Windows build, its headers, inline functions, crash reports |
 | [port/android/README.md](port/android/README.md) | The Android build, the guest and host, touch controls, Android settings, finding problems |
+| [port/web/README.md](port/web/README.md) | The web build, the page, the game data in the browser, limits, how it operates, hosting on GitHub Pages |
 | [port/include/xdk/README.md](port/include/xdk/README.md) | How the SDK declarations were written and are checked |
 | [docs/custom_edition_caches.md](docs/custom_edition_caches.md) | Loading and converting Custom Edition maps, and the evidence for each layout |
+| [docs/mods.md](docs/mods.md) | Mods: folders of Halo PC tag files whose sounds, bitmaps, text and models play over a map's on one machine |
+| [port/assets/text_filter/README.md](port/assets/text_filter/README.md) | Streamer mode's words: Surge AI's list, the review, the allowed words |
 | [port/assets/menus/README.md](port/assets/menus/README.md) | The menu files' format and how to write them again |
 | [port/assets/menus/NON_HANDDRAWN.md](port/assets/menus/NON_HANDDRAWN.md) | Menu pictures that are not redraws |
 | [port/assets/menus/UNWIRED.md](port/assets/menus/UNWIRED.md) | Menu functions that do nothing yet |
 | [port/assets/fonts/README.md](port/assets/fonts/README.md) | The fonts and their licences |
 | [tools/harness/README.md](tools/harness/README.md) | Asset-free regression tests |
+| [tools/stagekit/README.md](tools/stagekit/README.md) | Scenarios staged and instrumented on the real engine, no retail assets |
 | `port/third_party/*/README.md` | Each vendored library |
 | [AUTHORS.md](AUTHORS.md) | Art credits |

AUTHORS.md

@@ -4,6 +4,14 @@
 
 - **The game's icon** (the Android app's launcher icon, `halo.exe`'s icon
   and the desktop windows' icon): by ORION (`port/assets/icon`).
+- **The controller's A, B, X and Y buttons** (the menus' button icons and
+  the HUD messages'): redraws by saulob (`port/assets/buttons`).
+- **The high-res HUD** (its meters, icons, scopes and messages, and the
+  weapons' reticles): redraws by MrBruh (`port/assets/hud`), based on
+  reference photos by Aerocatia. The sniper rifle's zoom labels (2x, 10x)
+  are set in Overpass (`port/assets/fonts`).
+- **The menus' mouse cursor** (the blue arrow the menus show for the
+  mouse): by pugzysixtyfour (`port/assets/cursor`).
 
 ## Third-party art
 
@@ -12,3 +20,6 @@
   [Lucide](https://lucide.dev) 1.53.0, copyright (c) 2026 Lucide Icons and
   Contributors, under the ISC licence
   (`port/assets/icons/lucide/LICENSE`).
+- **The Mods menu's warning icons** (a mod out of its requested order, and
+  a mod that cannot be played): `triangle-alert` and `circle-x` from
+  [Lucide](https://lucide.dev) 1.53.0, under the same licence.

LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

README.md

@@ -1,22 +1,25 @@
 <p align="center">
-  <img src="port/android/steam_frame_grid/library.png" width="640" alt="Ringfall: Mjolnir VR">
+  <img src="port/android/steam_frame_grid/library.png" width="640" alt="Mjolnir VR">
 </p>
 
-# Ringfall: Mjolnir VR
+# Mjolnir VR
 
 **A VR mod for Halo: Combat Evolved** (the original Xbox game) on the
 **Meta Quest 3 / 3S** and the **Steam Frame**. Play the campaign and
 multiplayer in full 6DoF virtual reality, with your hands in the game.
 
-Ringfall: Mjolnir VR runs on your headset by itself, without a PC. It
+Mjolnir VR runs on your headset by itself, without a PC. It
 brings no game files: it uses a disc image of **your own, purchased copy**
 of the game.
 
-> **Unofficial fan project.** Ringfall: Mjolnir VR is a free,
+> **Unofficial fan project.** Mjolnir VR is a free,
 > non-commercial fan project. It is not affiliated with, endorsed,
 > sponsored or approved by Microsoft, Xbox Game Studios, Halo Studios or
 > Bungie. See [Legal](#legal).
 
+Until build 313 it was called *Ringfall: Mjolnir VR*. Installed builds
+update to the new name by themselves, and the old links lead here.
+
 ## Contents
 
 - [What you get](#what-you-get)
@@ -68,7 +71,8 @@ of the game.
 - A **Meta Quest 3 / 3S** or a **Steam Frame**.
 - A **disc image** (`.iso` or `.xiso`) of **Halo: Combat Evolved for the
   original Xbox**, made from **a disc you own**. Any region and version
-  works.
+  works. The game plays in the disc's language; on the European disc in
+  Spanish and Italian it takes your headset's language (else the first).
 
 This project does not include, link to or help find game files. Please
 do not ask for or share disc images in issues or discussions; such posts
@@ -85,14 +89,14 @@ that it updates itself.
 2. **Install [SideQuest](https://sidequestvr.com/setup-howto)** (the
    "Advanced Installer") on your computer and connect the Quest with a
    USB cable. In the headset, allow USB debugging for this computer.
-3. **Download `RingfallMjolnirVR.apk`** from the
+3. **Download `MjolnirVR.apk`** from the
    [latest release](../../releases/latest) and drag it onto the SideQuest
    window. It installs the game.
 4. **Copy your disc image** to the Quest's `Download` folder: in
    SideQuest, open the file manager (the folder icon), go to `Download`
    and drag the `.iso` file in.
 5. **In the headset**, open your *Library*, choose *Unknown Sources* and
-   start **Ringfall: Mjolnir VR**. Select **Choose disc image** and pick
+   start **Mjolnir VR**. Select **Choose disc image** and pick
    your file in `Download`. The game copies what it needs (about 1.8 GB,
    a minute or two) and starts.
 
@@ -107,17 +111,18 @@ No computer and no keyboard needed.
    *Switch to Desktop*.
 2. **Put your disc image** in the `Downloads` folder (for example from a
    USB stick or memory card with the file manager, Dolphin).
-3. **Download `Install-Ringfall-Mjolnir-VR.desktop`** from the
+3. **Download `Install-Mjolnir-VR.desktop`** from the
    [latest release](../../releases/latest) with the web browser.
 4. **Open it**: in Dolphin, open `Downloads` and double-click the file.
    If you are asked whether to run it, choose to continue.
 5. **Answer the dialogs.** The installer finds your disc image, copies
-   what the game needs, adds **Ringfall: Mjolnir VR** to your Steam
+   what the game needs, adds **Mjolnir VR** to your Steam
    library and offers to switch back to Gaming Mode.
-6. Start **Ringfall: Mjolnir VR** from your library (under *Non-Steam*).
+6. Start **Mjolnir VR** from your library (under *Non-Steam*).
 
-To update, open the same file in Desktop Mode again; your settings,
-saves and game data stay. More about the Steam Frame:
+The game updates itself: when a new version is out, it is downloaded
+while you play and used from the next start on. Your settings, saves and
+game data stay. More about the Steam Frame:
 [port/android/STEAM_FRAME.md](port/android/STEAM_FRAME.md).
 
 ## Playing
@@ -127,6 +132,9 @@ saves and game data stay. More about the Steam Frame:
   *Quit the game* is on its last page.
 - In the menus, point with a controller and pull the trigger to click.
 - The controller layout is on the VR options' *Controller buttons* page.
+- **Voice chat** in network games: hold the grip of the hand without the
+  weapon to talk (not while it holds the weapon or the Warthog's wheel).
+  The *BUTTONS* page can put push to talk on another button.
 
 ## Problems and questions
 
@@ -150,7 +158,7 @@ telemetry.
 
 ## Credits
 
-Ringfall: Mjolnir VR stands on the work of others:
+Mjolnir VR stands on the work of others:
 
 - **[OpenCE](https://github.com/OpenCommunityEdition/OpenCE)** (Open
   Community Edition): the port of the decompiled game to Linux, Windows
@@ -165,8 +173,9 @@ Ringfall: Mjolnir VR stands on the work of others:
 - **[HaloCE-VR](https://github.com/astromaddie/HaloCE-VR)** by astromaddie
   (CC0): the Steam Frame work, whose findings (such as quieting Mesa's
   trace markers) are used here.
-- **[extract-xiso](https://github.com/XboxDev/extract-xiso)**: the disc
-  image readers follow its format handling.
+- **[xboxdevwiki](https://xboxdevwiki.net/XDVDFS)**: its description of
+  the Xbox's disc file system, which the disc image readers are written
+  from.
 - The libraries and fonts in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
 
 Thank you all.
@@ -180,7 +189,7 @@ port it is built on.
 
 ## Legal
 
-Ringfall: Mjolnir VR is an unofficial, free, non-commercial fan project.
+Mjolnir VR is an unofficial, free, non-commercial fan project.
 It is not affiliated with, endorsed, sponsored or approved by Microsoft
 Corporation, Xbox Game Studios, Halo Studios or Bungie. Halo, Halo: Combat
 Evolved and Xbox are trademarks of Microsoft Corporation; they are named
@@ -193,6 +202,26 @@ distributed. You need your own, legally purchased copy of the game. If
 you enjoy this mod, please support the creators of the original by buying
 their games.
 
-This project's own code is released under [CC0 1.0](LICENSE.md), as the
-decompilation it builds on. Third-party code and fonts keep their own
-licenses: see [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+### Licence
+
+Mjolnir VR is free software: you can give it to others and change
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, version 3 of the License or (at your option)
+any later version (`AGPL-3.0-or-later`), as OpenCE, which it builds on, is.
+It comes with no warranty. The full text is in [LICENSE](LICENSE).
+
+- **From build 312 on.** The AGPL applies from the commit that took in
+  OpenCE's change of licence (19 October 2026), and to each release built
+  from it or a later one. Earlier releases, and the source at every earlier
+  commit, were released under [CC0 1.0](LICENSES/CC0-1.0.txt) and stay
+  that way.
+- **Hosts and servers.** If you change the game and let other persons play
+  with your version over a network (for example, as the host of an
+  internet game), the AGPL asks you to offer them the source of your
+  version. The game as released has its source here, and each release's
+  source is its tag (`build-<n>`).
+- **Third-party code and fonts** keep their own licences: see
+  [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+- **Halo is not covered.** The licence covers the work of this project's
+  and OpenCE's authors. It gives no rights in Halo, its maps or anything
+  else that Microsoft owns.

THIRD_PARTY_NOTICES.md

@@ -1,14 +1,16 @@
 # Third-party notices
 
-Ringfall: Mjolnir VR's own code is released under [CC0 1.0](LICENSE.md).
-It includes or builds on the following, under their own licenses; each
-license's full text is in the file named.
+Mjolnir VR is released under the GNU Affero General Public
+License, version 3 or later ([LICENSE](LICENSE)); releases before build 312
+were released under [CC0 1.0](LICENSES/CC0-1.0.txt). It includes or builds
+on the following, under their own licenses; each license's full text is in
+the file named.
 
 ## Code
 
 | Component | Used for | License | Text |
 | --- | --- | --- | --- |
-| [OpenCE](https://github.com/OpenCommunityEdition/OpenCE) and the decompilation ([bnunu/halo-1](https://github.com/bnunu/halo-1), [punpckhdq/halo](https://github.com/punpckhdq/halo)) | the game's code, the port | CC0 1.0 | [LICENSE.md](LICENSE.md) |
+| [OpenCE](https://github.com/OpenCommunityEdition/OpenCE) and the decompilation ([bnunu/halo-1](https://github.com/bnunu/halo-1), [punpckhdq/halo](https://github.com/punpckhdq/halo)) | the game's code, the port | AGPL 3.0 or later (OpenCE from 19 October 2026, punpckhdq/halo from 17 October 2026; CC0 1.0 before); bnunu/halo-1: CC0 1.0 | [LICENSE](LICENSE), [LICENSES/CC0-1.0.txt](LICENSES/CC0-1.0.txt) |
 | [HaloCE-Quest-VR](https://github.com/moistman42069/HaloCE-Quest-VR) | the arm IK, forearm twist and finger poses (`port/linux/game/vr_arms.c`) | CC0 1.0 | (its repository) |
 | [HaloCE-VR](https://github.com/astromaddie/HaloCE-VR) | Steam Frame findings | CC0 1.0 | (its repository) |
 | [SDL 3](https://libsdl.org) | windows, input, sound | zlib | (in SDL's source, `LICENSE.txt`) |
@@ -22,11 +24,11 @@ license's full text is in the file named.
 | [tomlc17](https://github.com/cktan/tomlc17) | reading `config.toml` | MIT | [port/third_party/tomlc17/LICENSE](port/third_party/tomlc17/LICENSE) |
 | [stb](https://github.com/nothings/stb) | drawing the game's text sharply (stb_truetype) | MIT or public domain | [port/third_party/stb/LICENSE](port/third_party/stb/LICENSE) |
 | [SMAA](https://www.iryoku.com/smaa/) | anti-aliasing (flat screens; off in VR) | MIT | [port/third_party/smaa/LICENSE](port/third_party/smaa/LICENSE) |
-| [extract-xiso](https://github.com/XboxDev/extract-xiso) | reading disc images (followed by `XisoExtractor.java`, `steam_frame_xiso.py`, `xiso.c`) | BSD-style (in@fishtank.com) | [port/third_party/extract-xiso/LICENSE.TXT](port/third_party/extract-xiso/LICENSE.TXT) |
 
-The disc image readers include this acknowledgement, as extract-xiso's
-license asks: *This product includes software developed by in
-<in@fishtank.com>.*
+The disc image readers (`XisoExtractor.java`, `steam_frame_xiso.py`,
+`xiso.c`) are written from a description of the Xbox's disc file system
+([xboxdevwiki's XDVDFS page](https://xboxdevwiki.net/XDVDFS)), not from
+extract-xiso, which earlier releases followed.
 
 ## Fonts
 

configure.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 
 # root build script: writes build.ninja for the native ports (Linux, Windows,
-# Android)
+# Android) and the web port
 
 import argparse
 import io
@@ -13,8 +13,14 @@ from types import SimpleNamespace
 from tools import ninja_syntax
 from tools.android_build import android_configure_inputs, generate_android_build
 from tools.linux_build import check_profile_options, generate_linux_build, linux_configure_inputs
+from tools.web_build import generate_web_build, web_configure_inputs
 from tools.windows_build import generate_windows_build, windows_configure_inputs
 
+
+def is_windows() -> bool:
+    return os.name == "nt"
+
+
 # arguments
 parser = argparse.ArgumentParser()
 parser.add_argument(
@@ -31,7 +37,7 @@ parser.add_argument(
 parser.add_argument(
     "--release",
     action="store_true",
-    help="release builds (Linux, Windows, Android): assertions are not checked",
+    help="release builds (Linux, Windows, Android, web): assertions are not checked",
 )
 parser.add_argument(
     "--profile",
@@ -83,6 +89,43 @@ parser.add_argument(
     type=str,
     help="clang with the arm64_32 target for the Android guest (default: clang)",
 )
+parser.add_argument(
+    "--web-emcc",
+    type=str,
+    help="Emscripten's emcc for `ninja web` (default: emcc on the PATH, then EMSDK's or ~/emsdk's)",
+)
+
+# no need to spam those extra flags when running on Windows
+if not is_windows():
+    parser.add_argument(
+        "--windows-cross",
+        action="store_true",
+        help="generate the Windows build (`ninja windows`) on Linux, cross-compiling "
+        "with clang against an MSVC toolchain (--windows-vctools-dir and --windows-sdk-dir), "
+        "and make it the default target",
+    )
+    parser.add_argument(
+        "--windows-cc",
+        metavar="BINARY",
+        help="compiler for the Windows cross build, `ninja windows` (default: clang). "
+             "Only clang is supported for now.",
+    )
+    parser.add_argument(
+        "--windows-vctools-dir",
+        metavar="DIR",
+        type=Path,
+        help="the Visual C++ tools of the MSVC toolchain a --windows-cross build compiles "
+        "and links against: the versioned folder under VC/Tools/MSVC, the one with `include` "
+        "and `lib` (default: VCToolsInstallDir)",
+    )
+    parser.add_argument(
+        "--windows-sdk-dir",
+        metavar="DIR",
+        type=Path,
+        help="the Windows SDK a --windows-cross build compiles and links against: the "
+        "folder with `Include` and `Lib`, each with a versioned folder (default: WindowsSdkDir)",
+    )
+
 args = parser.parse_args()
 try:
     check_profile_options(args.profile, args.pgo)
@@ -102,11 +145,13 @@ sln = SimpleNamespace(
     port_pgo_profile=args.pgo_profile,
     android_ndk=args.android_ndk,
     android_guest_cc=args.android_guest_cc,
+    web_emcc=args.web_emcc,
 )
-
-
-def is_windows() -> bool:
-    return os.name == "nt"
+if not is_windows():
+    sln.windows_cc = args.windows_cc
+    sln.windows_cross = args.windows_cross
+    sln.windows_vctools_dir = args.windows_vctools_dir
+    sln.windows_sdk_dir = args.windows_sdk_dir
 
 
 # build.ninja
@@ -127,6 +172,7 @@ n.newline()
 generate_linux_build(n, sln)
 generate_android_build(n, sln)
 generate_windows_build(n, sln)
+generate_web_build(n, sln)
 
 n.comment("Reconfigure on change")
 n.rule(
@@ -144,13 +190,14 @@ n.build(
         *linux_configure_inputs(),
         *android_configure_inputs(),
         *windows_configure_inputs(),
+        *web_configure_inputs(),
     ],
 )
 n.newline()
 
 # the build for this computer, where it could be generated (the Windows
 # build is left out when SDL cannot be fetched, for instance)
-default = "windows" if is_windows() else "linux"
+default = "windows" if is_windows() or sln.windows_cross else "linux"
 if f"\nbuild {default}: " in out.getvalue():
     n.comment("Default rule: the build for this computer")
     n.default(default)

docs/OPENCE_README.md

@@ -1,14 +1,14 @@
 > This is the README of [OpenCE](https://github.com/OpenCommunityEdition/OpenCE),
-> the port Ringfall: Mjolnir VR is built on, kept for its build and
+> the port Mjolnir VR is built on, kept for its build and
 > development notes. Its download links are OpenCE's. For the VR mod, see
 > the [main README](../README.md).
 
-# Halo: Combat Evolved for Linux, Windows and Android
+# Halo: Combat Evolved for Linux, Windows, Android and the web
 
 [![Join our Discord](https://invidget.switchblade.xyz/9gqcHyr5km)](https://discord.gg/9gqcHyr5km)
 
 This project is a port of the Halo: Combat Evolved decompilation to Linux,
-Windows and Android. The decompilation is of the Xbox build 2342
+Windows, Android and web browsers. The decompilation is of the Xbox build 2342
 (`cachebeta.exe`, SHA-256
 `4cc87b45f721270392a96f1674ed2b5cd4a7bb4355faeab4531d1cf1884d9520`).
 
@@ -27,6 +27,7 @@ builds of the latest release:
 | Linux | [halo-linux-release.zip](https://github.com/OpenCommunityEdition/OpenCE/releases/latest/download/halo-linux-release.zip) | [halo-linux-debug.zip](https://github.com/OpenCommunityEdition/OpenCE/releases/latest/download/halo-linux-debug.zip) |
 | Windows | [halo-windows-release.zip](https://github.com/OpenCommunityEdition/OpenCE/releases/latest/download/halo-windows-release.zip) | [halo-windows-debug.zip](https://github.com/OpenCommunityEdition/OpenCE/releases/latest/download/halo-windows-debug.zip) |
 | Android | [halo-android-release.zip](https://github.com/OpenCommunityEdition/OpenCE/releases/latest/download/halo-android-release.zip) | [halo-android-debug.zip](https://github.com/OpenCommunityEdition/OpenCE/releases/latest/download/halo-android-debug.zip) |
+| Web | [halocombatevolved.com](https://halocombatevolved.com/) (or [halo-web-release.zip](https://github.com/OpenCommunityEdition/OpenCE/releases/latest/download/halo-web-release.zip) for your own server) | [halo-web-debug.zip](https://github.com/OpenCommunityEdition/OpenCE/releases/latest/download/halo-web-debug.zip) |
 
 Use the release build to play. The debug build stops at the first failed
 assertion and writes it to the log. Use the debug build to find and report
@@ -34,17 +35,22 @@ problems.
 
 The game updates itself. At start-up it looks for a newer release, and asks
 if you want to install it. Refer to "Updates" in
-[port/linux/README.md](../port/linux/README.md#updates).
+[port/linux/README.md](port/linux/README.md#updates). The web site offers
+each new build when it is out.
 
-Each build of the `main` branch that passes on all three platforms is a new
-release. The [Releases](https://github.com/OpenCommunityEdition/OpenCE/releases)
+Each build of the `main` branch that passes on all four platforms is a new
+release, and the web site then plays it. The [Releases](https://github.com/OpenCommunityEdition/OpenCE/releases)
 page keeps the last five releases. If the latest build has a problem, get
 an older build from that page.
 
+### Arch-based Linux Distributions
+
+The above Linux binary release is available on the [AUR](https://aur.archlinux.org/packages/opence-bin).
+
 ## Game data
 
-The port does not include the game data. It needs an Xbox disc image
-(`.xiso` or `.iso`) made from your own copy of Halo: Combat Evolved. All versions of the game
+The port does not include the game data. Download an Xbox disc image
+(`.xiso` or `.iso`) of Halo: Combat Evolved. All versions of the game
 operate. The maps of the European (PAL) version were made for a slower
 console. The port changes them to play as the North American (NTSC) maps do,
 so players of the two versions can play together.
@@ -55,7 +61,19 @@ so players of the two versions can play together.
 
 On Linux and Windows, the game puts `maps/` next to the executable. On
 Android, copy the disc image to the phone first. The app puts `maps/` in its
-data folder. Refer to [port/android/README.md](../port/android/README.md).
+data folder. Refer to [port/android/README.md](port/android/README.md). On
+the web, the page copies `maps/` out of the disc image into the browser's
+storage for the site; nothing is uploaded. Refer to
+[port/web/README.md](port/web/README.md).
+
+## Mods
+
+Mods are folders of Halo PC tag files, as the Halo Editing Kit and Invader
+write them, in `mods/` next to `maps/`: texture, sound, text and model packs
+that play over the maps' on your machine only, in any game. Each has a
+`mod.toml`. Every mod in the folder is on; the main menu's Mods turns them
+off and on and sets the order they load in.
+Refer to [docs/mods.md](docs/mods.md).
 
 ## Platforms
 
@@ -63,9 +81,10 @@ Each platform has its own instructions:
 
 | Platform | Instructions |
 | --- | --- |
-| Linux (32-bit x86 executable, OpenGL 4.5, SDL3) | [port/linux/README.md](../port/linux/README.md) |
-| Windows (32-bit x86 executable, OpenGL 4.5, SDL3) | [port/windows/README.md](../port/windows/README.md) |
-| Android (arm64 app, OpenGL ES 3, SDL3) | [port/android/README.md](../port/android/README.md) |
+| Linux (32-bit x86 executable, OpenGL 4.5, SDL3) | [port/linux/README.md](port/linux/README.md) |
+| Windows (32-bit x86 executable, OpenGL 4.5, SDL3) | [port/windows/README.md](port/windows/README.md) |
+| Android (arm64 app, OpenGL ES 3, SDL3) | [port/android/README.md](port/android/README.md) |
+| Web (WebAssembly, WebGL 2, SDL3; desktop Chrome, Edge and Firefox) | [port/web/README.md](port/web/README.md) |
 
 The Linux README also gives the controls, the settings and the multiplayer
 functions. These are almost the same on all platforms.
@@ -75,17 +94,22 @@ functions. These are almost the same on all platforms.
 The game can play system link games on a local network and on the internet:
 
 - A system link game can have up to 128 players on up to 128 machines.
-- Linux, Windows and Android machines can play in the same game.
-- An invite link lets a machine join a game on the internet. No server of
+- Linux, Windows and Android machines and browsers can play in the same
+  game. On a local network, the native builds play system link; browsers
+  play each other in rooms, over WebRTC
+  ([port/web/README.md](port/web/README.md)).
+- An invite link, or the server browser, lets a machine join a game on the
+  internet, browsers too: a native build takes a browser's WebRTC
+  ([port/linux/README.md](port/linux/README.md), "Browsers"). No server of
   this project is necessary.
 - The netcode is new. Each machine moves its own player at once,
   and the host makes the decisions for the game. Refer to
-  [port/linux/NETCODE.md](../port/linux/NETCODE.md).
+  [port/linux/NETCODE.md](port/linux/NETCODE.md).
 
 ## Build the game
 
 You do not need the Xbox SDK. The port supplies the SDK declarations that
-the game uses. Refer to [port/include/xdk](../port/include/xdk/README.md).
+the game uses. Refer to [port/include/xdk](port/include/xdk/README.md).
 
 To build the game:
 
@@ -100,6 +124,7 @@ To build the game:
 | `ninja linux` | `build/linux/halo` |
 | `ninja windows` (on Windows) | `build/windows/halo.exe` and `SDL3.dll` |
 | `ninja android_apk` | `port/android/app/build/outputs/apk/debug/app-debug.apk` |
+| `ninja web` | `build/web/site/`, the web site (`python tools/web_serve.py` serves it) |
 
 If you enter `ninja` without a target, ninja builds the game for the
 computer that you use.
@@ -115,11 +140,12 @@ Give these options to `configure.py`:
 | --- | --- |
 | (none) | A debug build. A failed assertion stops the game. |
 | `--release` | A release build. The game does not examine assertions, as in the retail game. |
-| `--portable` | The Linux and Windows builds operate on all x86-64 processors. The Linux build also operates on older distributions and on SteamOS: refer to "Portable build" in [port/linux/README.md](../port/linux/README.md#portable-build). Use this option for builds that you give to other persons. |
+| `--portable` | The Linux and Windows builds operate on all x86-64 processors. The Linux build also operates on older distributions and on SteamOS: refer to "Portable build" in [port/linux/README.md](port/linux/README.md#portable-build). Use this option for builds that you give to other persons. |
 | `--lto=thin`, `--lto=off` | Less link-time optimization. The link is faster. |
 | `--pgo=off` | No profile-guided optimization. |
 | `--pgo=train` | Records a new optimization profile. Refer to "Optimization profiles". |
 | `--profile` | A profiling build. It records CPU times. Refer to "Profiling builds". |
+| `--web-emcc PATH` | The Emscripten `emcc` for `ninja web` (else the one on the PATH, or `~/emsdk`'s). |
 
 Without `--portable`, the Linux and Windows builds use all the instructions
 of the processor that builds them (`-march=native`). Such a build does not
@@ -174,10 +200,41 @@ file.
 `debug.profile_memory` sets the memory of a recording in MB (default 256,
 from 4 to 1024). A recording has no length limit:
 the game writes a part each time the memory is full. Refer to "Settings" in
-[port/linux/README.md](../port/linux/README.md).
+[port/linux/README.md](port/linux/README.md).
 
 On Android, the files are in `/sdcard/Android/data/com.halo.decomp/files/profiles/`.
 Enter `adb pull` to copy the recording parts to a computer.
 
 A profiling build plays with normal builds. It does not use
 `--pgo=train`.
+
+## Licence
+
+OpenCE is free software: you can give it to others and change it under the
+terms of the GNU Affero General Public License as published by the Free
+Software Foundation, version 3 of the License or (at your option) any later
+version (`AGPL-3.0-or-later`). It comes with no warranty. The full text is in
+[LICENSE](LICENSE).
+
+- **From the change.** The AGPL applies from the commit that made the change,
+  and to each release built from that commit or a later one. Earlier
+  releases, and the source at every earlier commit, were released under
+  [CC0 1.0](LICENSES/CC0-1.0.txt) and stay that way.
+- **What OpenCE builds on.** The decompilation of
+  [punpckhdq/halo](https://github.com/punpckhdq/halo) is under the AGPL 3.0
+  from 17 October 2026, and under CC0 1.0 before that date.
+  [bnunu/halo-1](https://github.com/bnunu/halo-1) is under CC0 1.0.
+- **Contributions** are under `AGPL-3.0-or-later`. A change taken from a
+  project under GPL 3.0 keeps that licence and its notices; the GPL 3.0 and
+  the AGPL 3.0 let the two be combined (section 13 of each).
+- **Hosts and servers.** If you change the game and let other persons play
+  with your version over a network (for example, as the host of an internet
+  game, or on a web site), the AGPL asks you to offer them the source of
+  your version (section 13). The game as released has its source here, and
+  each release's source is its tag (`build-<n>`).
+- **Third-party code, fonts and art** keep their own licences, which are
+  next to them (`port/third_party`, `port/assets/fonts`,
+  `port/assets/icons`, `port/assets/text_filter`). The release downloads and
+  the web site's `licenses.txt` carry their notices.
+- **Halo is not covered.** The licence covers the work of OpenCE's authors.
+  It gives no rights in Halo, its maps or anything else that Microsoft owns.

docs/custom_edition_caches.md

@@ -33,6 +33,27 @@ network games, and is never taken for one of the campaign's levels (saved
 games, progress, the next level). The game engine keeps 63 characters of a
 level name, so a map whose file name is longer than 51 is not listed.
 
+Maps keep their names. A network game's level name is the map's own
+(`custom_maps\hugeass`), and its game record's map version is the first 32
+bits of the map's hash (`port/linux/game/map_share_files.c`), so a client
+plays its file of that name and version, whatever else it has of the name
+(`custom_edition_map_find_version`); a player without it downloads it
+(`port/linux/NETCODE.md`, "Map sharing"). A download beside another version
+of its name is named `hugeass_0e2b3ee4.map`, the first 8 hexadecimal digits
+of its hash after `_`, and the menus show it as "Hugeass (2)". A level name
+without the hash (a saved last map, a test's) finds the one map of that
+name in `custom_maps`, and one with it (an earlier build's, which named
+every map so) the map given its name back. Maps in a Custom Edition
+install's folder are found and shared as `custom_maps`' are.
+
+A map needs only the resource maps that hold its tags: its tag index says
+which (`cache_file_resource_maps_needed`, `cache_file_formats.c`: a tag
+whose entry's word at 0x18 is set is held whole by `bitmaps.map` for a
+bitmap, `sounds.map` for a sound, `loc.map` for a font, string list or HUD
+message text). A map without such tags of a kind plays without that
+resource map; one that lacks a resource map it needs is refused, saying
+which.
+
 ### In the menus
 
 The map lists (New Game's, and the Map screen of Create Game's INTERNET and
@@ -76,7 +97,7 @@ than the damaged disc error precaching a missing map gives
 the map cannot run there (Custom Edition maps turned off, the file not a
 Custom Edition cache, or `bitmaps.map`, `sounds.map` and `loc.map` missing),
 when its copy of a Custom Edition map is another version than the host's
-(the host sends its file's header checksum as the game record's map
+(the host sends its map's hash's first 32 bits as the game record's map
 version, which the Xbox left 0: `cache_files_map_version`; a host that sends
 0 is not checked), and when the host names a Custom Edition map as other
 versions of this port do (`levels\test\<name>\<name>`) and the file is in
@@ -171,9 +192,11 @@ Loading, step by step (`custom_edition_cache_load`):
    its lightmaps and their materials: every block within the BSP and aligned,
    every material's uncompressed environment vertices (56 bytes) and
    lightmap vertices (20 bytes) within the BSP and of the size their counts
-   give, lightmap vertices exactly when the lightmap has a bitmap, and every
-   normal, binormal, tangent and incident radiosity within ±1.005 (the game's
-   vertex compressor asserts on anything further out).
+   give, at most 64000 of each (the game's limit, to which the validator
+   cuts a material's counts), lightmap vertices exactly when the lightmap
+   has a bitmap, and every normal, binormal, tangent and incident radiosity
+   within ±1.005 (the game's vertex compressor asserts on anything further
+   out).
 5. The header checksum is computed as OpenSauce computes it, before anything
    changes the tag data; a mismatch is reported, not refused.
 6. The tags held by resource maps are read into the tag cache after the tag
@@ -364,9 +387,11 @@ every tag as it checks an Xbox map's (`tag_validate_custom_edition_tags`,
 called by `custom_edition_cache_tags_load`): every block and data within
 the loaded tags and overlapping no other's, counts cut to the game's
 capacities, indices, enums and tag references corrected, runtime values
-reset, then the graph checks (collision BSPs, node trees, scripts' syntax).
-A map whose pointers cannot be trusted is refused; what can be corrected is,
-and logged. What differs from an Xbox map:
+reset, then the graph checks (collision BSPs, node trees, scripts' syntax),
+and a tag name that lies in any tag's block or data is emptied (what the
+game writes there could take away its end). A map whose pointers cannot be
+trusted is refused; what can be corrected is, and logged. What differs
+from an Xbox map:
 
 - the tag header has no vertex or index buffers, and the tag cache is the
   Custom Edition one (23 MB);
@@ -438,8 +463,14 @@ a campaign level at the difficulty chosen; the Map screen's (LAN) listed its
 difficulties, set up co-op in Server Setup and showed it in the lobby as
 co-op. With `debug.network_test`, two machines on loopback played
 `custom_maps\a30` as network co-op and `custom_maps\hugeass` as slayer; a
-joining machine without the map, without the resource maps, or with a maps
-folder missing the host's Xbox map was shown each error and left the game.
+joining machine with a maps folder missing the host's Xbox map was shown the
+error and left the game. A joining machine without `hugeass` (or without
+`sounds.map` and `loc.map` too) downloaded them and played (map sharing,
+`port/linux/NETCODE.md`): in the lobby, into a game in progress, from the
+host and another player at once with a second machine downloading beside it
+(on loopback, and through internet play's tunnels with a local broker), each
+file the same as the host's; with `network.map_download` off, or a host with
+`network.map_share` off, it was shown the error and left.
 
 ### Not tested
 
@@ -462,9 +493,9 @@ folder missing the host's Xbox map was shown each error and left the game.
   but their model parts have its 0x68-byte layout and their shader types its
   numbering, which makes them a check on what the conversion produces.
 
-OpenSauce and Reclaimer are GPL-3.0 and this repository is CC0: no code from
-either was copied. They were read as documentation of the file formats, and
-every layout used was then checked against the sample maps.
+No code from OpenSauce or Reclaimer (both GPL-3.0) was copied: they were
+read as documentation of the file formats, and every layout used was then
+checked against the sample maps.
 
 ### Documented facts (source, checked against the sample maps)
 
@@ -537,10 +568,10 @@ every layout used was then checked against the sample maps.
 - **What the validator corrects is lost.** A community map's data that the
   validator corrects (an index past its block, an enum past its values) is
   what the game then runs; Halo PC read past such data unchecked.
-- **Ogg Vorbis sounds** are decoded when the map loads (stb_vorbis, public
-  domain) and encoded again as Xbox ADPCM in memory
-  (`port/linux/game/custom_edition_sounds.c`); one that cannot be decoded is
-  silenced, and still logs when played.
+- **Ogg Vorbis sounds** are decoded when the map loads (stb_vorbis, with
+  added bounds checks: `port/third_party/stb_vorbis`) and encoded again as
+  Xbox ADPCM in memory (`port/linux/game/custom_edition_sounds.c`); one that
+  cannot be decoded is silenced, and still logs when played.
 - **Models of 44 nodes or more** are drawn a part's nodes at a time, given
   local nodes when they have none; one whose part's vertices name more
   nodes than a part holds is refused.

docs/mods.md

@@ -0,0 +1,329 @@
+# Mods
+
+A mod is a folder of Halo PC tag files that the game plays over a map's own
+tags on your machine, as a resource pack does: sounds (a high-res audio
+pack), bitmaps (a texture pack, a HUD redraw), text (a translation) and
+models (higher-detail weapons, vehicles and scenery). Only the machine that
+has a mod plays it. Nothing of a mod is sent to another machine, and a mod
+changes nothing that the machines of a network game must agree on, so you
+can play with mods in any game, with players who have other mods or none. (A host's mod sounds of other lengths change how long
+the host's scripts and AI wait for dialogue to end; the host decides those
+for every machine, so they still agree.)
+
+The game's code is `port/linux/game/mods.c` (with `mod_sounds.c`,
+`mod_bitmaps.c`, `mod_strings.c` and `mod_models.c`, one for each kind of
+tag) and `port/linux/src/port_mods.c` (the mods folder and its files).
+
+## A mod's folder
+
+The mods are in the `mods` folder of the data root (the folder with
+`maps/`; on Android the app's data folder, on the web the browser's storage
+for the site). Each mod is a folder in it, with a `mod.toml` and a `tags`
+folder:
+
+```
+mods/
+  hd_audio/
+    mod.toml
+    tags/
+      sound/sfx/weapons/assault rifle/fire.sound
+      sound/dialog/...
+  german/
+    mod.toml
+    tags/
+      ui/hud/hud_item_messages.unicode_string_list
+```
+
+The files in `tags` have the paths of the tags they replace: a tag's name,
+then its group's extension, as the Halo Editing Kit and Invader keep them.
+`tags/sound/sfx/weapons/assault rifle/fire.sound` replaces the sound tag
+`sound\sfx\weapons\assault rifle\fire` of every map that has one. Names are
+not case-sensitive. The game only looks up the names of the map's tags among
+a mod's files: a mod cannot add tags, and no tag name of a map makes a path
+outside the mod.
+
+`mod.toml` says what the mod is. Every key is optional:
+
+```toml
+name = "High-res audio"       # what the Mods menu shows (else the folder's name)
+id = "hd_audio"               # what other mods name it by (else the folder's name)
+version = "1.0"
+authors = ["Someone", "Someone else"]   # or one string
+description = "The game's sounds at 44 kHz"
+maps = ["a10", "bloodgulch"]  # the maps it is for, by their files' names (else every map)
+load_after = ["hd_textures"]  # mods it plays over: they load before it
+load_before = ["fixes"]       # mods that play over it: they load after it
+incompatible = ["other_audio"]  # mods it cannot be played with
+format = 1                    # the mods' format it is made for
+```
+
+`load_after`, `load_before` and `incompatible` name other mods by their `id`
+or their folder's name, not case-sensitive. A mod they name that is not in
+the mods folder is passed over. `maps = []` is every map.
+
+A folder without `mod.toml` is not a mod. A mod made for a later `format`
+than the build's, or whose `maps` names no map, is not played. The game
+logs anything else wrong in `mod.toml` (an unknown key, a value of the
+wrong type) and uses the rest; a `mod.toml` that is not TOML at all is
+logged, and the mod played without what it says.
+
+The game's log is its output: the terminal on Linux, `halo.log` beside
+`halo.exe` on Windows, logcat on Android, and the page's log on the web.
+
+Limits: 256 mods, folder names of 63 bytes at most, 262144 files in all, 24
+folders deep under `tags`, and 64 maps in a mod's `maps`.
+
+## The load order
+
+Every mod in the mods folder is on until you turn it off. The mods load in
+an order, and where two mods have a file for the same tag, the one loaded
+later plays.
+
+- The default order is the folders' names in alphabetical order (not
+  case-sensitive), except that the mods a mod must load after (those it
+  asks to load after, and those that ask to load before it) are taken to
+  just before it. Mods that ask in a ring (a after b, b after a) load
+  alphabetically, and the game's log says so.
+- The main menu's **Mods** (in the PC version's menus, `display.menus =
+  "pc"`, the default) is laid out as the game lobby is: the mods on the
+  left as a resource pack list has them, the one at the top playing over
+  all those below it (the load order upside down: the mod loaded last is at
+  the top), and the chosen mod's details in the frame on the right (its
+  name, what is wrong with it, whether it is on, its priority, 1 the top,
+  and its version, authors, folder, maps and description). Choosing a mod
+  (A, or a click on the chosen one: the first click chooses it) turns it on
+  or off (ON, OFF); left and right, or **Move up** and **Move down**, move
+  the chosen mod (up: over one more mod). **OK** keeps the order and plays
+  it at once (on a map that is loaded, too); **Cancel** leaves it as it was.
+- A warning sign beside a mod means it is on the wrong side of a mod it
+  asks to load before or after (both on): a mod that loads after another is
+  above it in the menu. A red cross means a mod that is on says it cannot be
+  played with this one, or that it cannot be played at all (made for a later
+  build, or its `maps` names none): it stays off. The details say which.
+
+The menu keeps the order, and the mods turned off, in `mods/load_order.toml`,
+by the mods' folders' names:
+
+```toml
+order = ["german", "hd_audio", "hd_textures"]
+disabled = ["hd_textures"]
+```
+
+A mod added to the folder later is put where the default order puts it,
+after the mod before it there (but on the side it asks for of the mods it
+names), and is on. A mod gone from the folder is left out. When the file
+cannot be written, the game says so in its log and keeps the order until it
+quits.
+
+### Mods that cannot be played together
+
+When a mod that is on names another that is on as `incompatible`, the game
+asks as it starts, before the window opens:
+
+- **Play anyway** plays them all (closing the box does too);
+- **Turn off ...** turns off the mods named as incompatible (if mod A says
+  it cannot be played with mod B, B is turned off), and keeps that in
+  `load_order.toml`;
+- **Quit** closes the game.
+
+The Mods menu turns them on again. On the web, **Quit** starts the page
+again. A run nobody watches (`debug.hidden_window`, `debug.null_renderer`,
+`debug.exit_after` or `debug.network_test`) is not asked: it plays them all,
+and the game's log says which conflict.
+
+At the console:
+
+| Command | What it does |
+| --- | --- |
+| `mods_list` | Lists the mods in the mods folder in their load order, and which are on, then how many of the map's string lists, bitmaps, sounds and models the mods play. |
+| `mods_reload` | Finds the mods again and reads their files again: a changed file is read again (one that now fails a check leaves what was played before), a new one is played, and the map's tag comes back for a file that is gone. If a sound changed, all sounds stop. It does nothing while `mods_enable false`. |
+| `mods_enable false` | Plays the map's own tags until `mods_enable true` or the next map. |
+
+These commands work in any game, a client's too: they change nothing of the
+game.
+
+### Getting a mod onto each platform
+
+- **Linux, Windows**: put the mod's folder in `mods/` next to `maps/`.
+- **Android**: put it in `mods/` in the app's data folder,
+  `/sdcard/Android/data/com.halo.decomp/files/mods`, for example with
+  `adb push hd_audio /sdcard/Android/data/com.halo.decomp/files/mods/`.
+- **Web**: on the page, **Mods**, **Add a mod folder…** copies a mod's
+  `mod.toml` and `tags` folder into the browser's storage for the site.
+  **Remove** deletes it again.
+
+## What a mod can replace
+
+The game plays these groups from a mod. It does not read the files of any
+other group (a `.weapon`, `.vehicle`, `.model_collision_geometry` or
+`.scenario`, for example): they would change what the machines of a network
+game must agree on.
+
+| Group | Extension | What it is |
+| --- | --- | --- |
+| Sound | `.sound` | Sounds, music and dialogue |
+| Bitmap | `.bitmap` | Textures, sprites, the HUD's pictures |
+| Unicode string list | `.unicode_string_list` | The text the game shows |
+| String list | `.string_list` | Other text |
+| Model | `.gbxmodel` (Halo PC's), `.model` (the Xbox's) | What objects look like: weapons, first-person weapons and arms, vehicles, scenery, characters |
+
+A file must be a Halo PC tag file of its group, as the Halo Editing Kit's
+tools and Invader write them (a model also as `invader-extract` writes an
+Xbox map's: `.model`). The game checks every count, size and offset
+in it against the file, and every value against what the game reads, before
+it uses the file. A file that fails a check is left out (the map's tag
+plays), and `debug.txt` and the console say why.
+
+### Sounds
+
+- The samples can be 16-bit PCM, Xbox ADPCM or Ogg Vorbis, mono or stereo,
+  at 22 or 44 kHz. The game converts them to the Xbox ADPCM that it plays,
+  as it does for Custom Edition maps: mono at 22 kHz, stereo at its own rate.
+- Empty values are filled in as a map's build fills them in: the defaults
+  of the sound's class, the playback rates and the bend.
+- A sound must have permutations: a file with an empty pitch range (some
+  Halo PC translations have them) is left out.
+- A permutation must fit in a block of the sound cache (one sound's samples:
+  `MAXIMUM_SOUND_DATA_SIZE`).
+
+### Bitmaps
+
+- A bitmap's types and formats are those the game draws: 2D, 3D and cube
+  maps; A8, Y8, AY8, A8Y8, R5G6B5, A1R5G5B5, A4R4G4B4, X8R8G8B8, A8R8G8B8,
+  DXT1, DXT3, DXT5 and P8 bump. Sides are 4096 at most (512 for a 3D
+  bitmap). A bitmap that is not a power of two on each side is drawn
+  linear, as a Custom Edition map's is: it must be an uncompressed 2D
+  bitmap.
+- One bitmap's pixels may take a quarter of the texture cache: 64 MB on
+  Linux and Windows, 5.5 MB on Android and the web (a 2048 x 2048 DXT5 with
+  its mipmaps fits on all of them).
+- A bitmap replaces the map's bitmap of its name, and the map's other tags
+  use it as the map's: it must have at least as many bitmaps, of the same
+  types, and as many sequences, each with at least as many sprites. It can
+  be larger: a redraw at twice the size is drawn at the map's size, sharper.
+- The HUD draws a bitmap at its own size. So for each HUD element that draws
+  a mod's bitmap, the game scales the element by the map's size of what it
+  draws (its sprite, or with no sprites its bitmap) to the mod's, when that
+  is the same ratio for all of them. A bitmap the HUD draws that is not the
+  map's redrawn so (Halo PC's HUD bitmaps lay their sprites out to other
+  sizes) is left out. The HUD's digits can be the map's size or twice it.
+- The menus draw a bitmap in their widgets' bounds, whatever its size.
+- Halo PC keeps the channels of a model shader's multipurpose maps and of
+  the HUD's meters in another order than the Xbox. The game finds those
+  bitmaps among the mod's and draws them in the Xbox's order, as it does for
+  Custom Edition maps (`custom_edition_bitmaps.c`).
+- The pixels are read from the file when the texture cache loads them, not
+  kept in memory.
+
+### Text
+
+- A list keeps the map's number of strings: a mod's strings past it are
+  left out, and the map's own strings stay where the mod's list is shorter.
+- The game uses many strings as the format of what it prints
+  (`%s was killed by %s`). A mod's string replaces the map's only if it has
+  the same conversions in the same order (`%s`, `%d`, ...); otherwise the
+  map's string stays. A translation keeps the conversions of the original.
+- Unicode strings are UTF-16, as the tool writes them.
+- The main menu is the port's own (the PC version's menus, `port/assets/menus`),
+  whose text is in tags named `pc\...`. A mod's `ui\shell` lists change the
+  Xbox's menus (`display.menus = "xbox"`) and the text shown while playing
+  (HUD messages, the multiplayer messages, the pause menu).
+
+### Models
+
+A model is more than what is drawn: its nodes (its skeleton) are what its
+animations move, its markers are where projectiles leave a weapon, where a
+unit sits and where things attach, and its regions and permutations are what
+damage and an object's variant choose among. The machines of a network game
+agree on those, so a mod's model must have the map's:
+
+- the same nodes: their names, hierarchy and default positions;
+- the same markers: their names, regions, permutations, nodes, positions
+  and rotations (on the model's permutations, as the Halo Editing Kit keeps
+  them, or on the model, as a map does);
+- the same regions and permutations: their names and flags.
+
+Positions and rotations may differ from the map's by 0.001 at most (a model
+exported again is not always bit for bit the map's). Only what is drawn is
+the mod's: the geometries, their parts and vertices, which geometry each
+permutation draws at each detail level, the detail levels' cutoffs, the
+base map's scale, and which shaders each part is drawn with. A detail level
+the map draws must draw one of the mod's geometries, and one the map draws
+nothing at stays so. Every shader must be one the map has (a mod cannot add
+tags); a mod's bitmaps can redraw them.
+
+The model is checked against each map's own model of its name as that map
+loads. On a map whose model of that name has other nodes, markers or
+regions (a custom map's own assault rifle, say), or lacks a shader the mod
+names, the mod's model is left out and the map's drawn; the mod's other
+files still play there. `maps` in `mod.toml` keeps a mod to the maps it is
+made for.
+
+- Where a mod has both, its `.gbxmodel` plays; otherwise the file of the mod
+  loaded later, whichever its format.
+- What the tool works out as it builds a map is worked out as it does: a
+  part's strip is its triangles block, its centroid's nodes are its most
+  weighted, its links of 0 to the parts drawn before and after it are none,
+  a base map scale of 0 is 1, and a model whose tag asks for it has the
+  normals of its vertices that share a position blended. The vertices are
+  compressed as the game draws them.
+- A part's links to the parts drawn before and after it (for transparency)
+  must not go round.
+- A model of 44 nodes or more (the renderer skins 43 at once; only Custom
+  Edition maps' have so many) is drawn a part's own nodes at a time, as a
+  Custom Edition map's is: a part's vertices may name 22 nodes at most.
+- The collision geometry, the animations and the object's tag are the map's:
+  a larger weapon still hits and is hit where the map's does, and an object
+  is still left undrawn by the map's bounds of it (a much larger model may
+  vanish at the screen's edges).
+- Every model made from a file is kept until the map changes, a file edited
+  and read again by `mods_reload` too, and counts against the mods' memory.
+
+### Shaders
+
+A model's parts can be drawn with a shader of every group Halo PC has but
+one: `shader_transparent_chicago_extended`, which Gearbox added for Halo PC.
+The Xbox game does not have it, so do not use it: use a
+`shader_transparent_chicago` shader instead. (A Custom Edition map's
+chicago extended shaders become chicago shaders as the map loads, keeping
+only their four-stage maps: see
+[custom_edition_caches.md](custom_edition_caches.md).) As for every
+shader, it must be one the map has.
+
+## Making a mod
+
+1. Get the tags you want to change as tag files. `invader-extract` extracts
+   them from a map, and the Halo Editing Kit's tags are Halo PC's own.
+2. Change them with the Halo Editing Kit or Invader (`invader-bitmap`,
+   `invader-sound` and `invader-model` build bitmaps, sounds and models from
+   images, audio files and JMS files). Keep each tag's name.
+3. Put them in `tags/` of a folder in `mods/`, with a `mod.toml`.
+4. Load a map (a new mod is on). `mods_reload` at the console reads the
+   files again as you change them, without loading the map again.
+
+`debug.txt` has a line for every file the game leaves out, and why, and a
+summary of what each kind of tag plays from the mods:
+
+```
+mods: 9 string lists from their files (9 new), 0 given back, 0 left out
+mods: 66 HUD placements scaled to draw larger bitmaps at the map's size
+mods: 354 bitmaps from their files (354 new), 0 given back, 6 left out
+mods: 313 sounds from their files (313 new), 0 given back, 2 left out
+mods: 4 models from their files (4 new), 0 given back, 1 left out
+```
+
+## How it operates
+
+- When a map's tags load, at `mods_reload` and at the Mods menu's **OK**,
+  the game lists the files of the mods that are on, once, in a table of
+  their tag paths. Each of the map's sound, bitmap, string list and model
+  tags is looked up in it.
+- A tag replaced by a mod takes the file's values in place, so everything
+  that holds the tag keeps it, and the map's own values come back when the
+  file goes. A sound playing or a texture in the cache is never changed
+  under the game: before a reload changes anything, the sounds stop and the
+  caches let go of what they hold.
+- The mods' tags keep at most 512 MB in memory (192 MB on Android and the
+  web): their files, their sounds' samples, their bitmaps' tags and their
+  models' geometry.
+- A Custom Edition map takes mods as an Xbox map does.

port/android/README.md

@@ -1,6 +1,7 @@
 # Android
 
-The app of Ringfall: Mjolnir VR (application id `io.github.cesarus85.ringfall`;
+The app of Mjolnir VR (application id `io.github.cesarus85.ringfall`, from
+the name before, "Ringfall: Mjolnir VR", kept so that installed apps update;
 its Java classes keep the decompilation's package, `com.halo.decomp`).
 `ninja android` builds the game for 64-bit ARM Android (arm64-v8a).
 `ninja android_apk` makes an app from it:
@@ -98,6 +99,7 @@ To install the data from a computer:
 | Item | Location in `/sdcard/Android/data/io.github.cesarus85.ringfall/files` |
 | --- | --- |
 | Saved games (`z:\` and `u:\`) | `save` |
+| Mods (`docs/mods.md`) | `mods`: `adb push <mod folder> /sdcard/Android/data/com.halo.decomp/files/mods/`; the main menu's Mods orders them and turns them off |
 | Log | `debug.txt` |
 | Settings | `config.toml` |
 
@@ -160,7 +162,7 @@ controller for player 1. With the default buttons of the profile:
 | Crouch, Zoom | left and right stick clicks |
 | Light, Gren. type | white, black |
 | Pause, Back | start, back |
-| Up, Down, Left, Right | D-pad |
+| Up, Down, Left, Right | D-pad (in a network game, Up opens the text chat's keyboard) |
 
 The names on the buttons follow the profile's "Button layout" (Settings >
 Gamepads): with "Swap triggers", the right trigger's button says "Grenade".
@@ -228,8 +230,10 @@ These settings are only for Android:
 | `input.touch_aim_assist` | `true` (the default): the touch controls' swipe aiming gets the aim assist of a controller (the aim slows over a target and follows a moving one). `false`: none, as with a mouse; the bullets' own autoaim stays. |
 | `input.touch_controls` | The touch controls in a game. `"auto"` (the default): shown on a touchscreen while no controller is connected. `"on"`: also shown with a controller. `"off"`: never shown. A device without a touchscreen never shows them. The menus take taps in any case. |
 | `display.screen_width` | The number of columns of the 480-line picture. `0` (the default): the shape of the display (1068 on a 20:9 phone). `640`: the 4:3 shape of the Xbox. |
+| `display.shader_cache` | `true` (the default): the linked shader programs are kept in `shader_cache` in the data folder (their binaries, the driver that made them and their sources), and each map's list of the programs it drew with; as a map loads, the programs on its list are made ready, so that its first frames do not wait for the driver to compile them. A driver update compiles them again from the kept sources. `false`: each program is compiled the first time it is drawn. The folder may be deleted at any time. |
+| `display.shader_worker` | `true` (the default): the shader programs are made on a thread of their own, whose GL context shares the game's (loaded from the shader cache, or compiled), and drawn with once there (`debug.shader_warm_up`: `"worker"`, `"load"` on the game's thread as a map loads, or `"off"`); a draw whose program is not made yet is left out for the frames it takes, and the frame does not wait. As a map loads, its own programs and then every map's (`shader_cache/all.txt`) are asked for. `false`: each is made on the game's thread when first drawn with. |
 | `debug.sample_seconds` | Refer to "Find problems". |
-| `debug.memory_watch` | `true` (the default): the app notices the game's writes to textures and vertices by page protection. `false`: it compares page contents once a frame instead, which is slower. Refer to "Limits". |
+| `debug.memory_watch` | `true` (the default): the app notices the game's writes to cached textures by page protection. `false`: it compares page contents once a frame instead, which is slower. Geometry uses the streaming path in either mode. Refer to "Limits". |
 
 ## Internet play
 
@@ -386,7 +390,9 @@ The guest is the game, the platform layer and a small runtime:
    AArch64 target of clang. The options `-U__APPLE__` and
    `-fno-define-target-os-macros` hide the Darwin environment.
 2. `tools/android_asm_convert.py` changes the Mach-O assembly to ELF
-   assembly.
+   assembly. It renames symbols, but keeps string literals (`.ascii`,
+   `.asciz`) byte for byte: they hold tables as well as text
+   (`tools/test_android_asm_convert.py`).
 3. The AArch64 assembler makes the objects.
 4. `ld.lld` links the objects with `guest/guest.ld` to a static image,
    `build/android/halo_guest.elf`, at a fixed address above the Xbox memory
@@ -407,7 +413,7 @@ and supplies the thread pointer and TLS.
 
 - Reserves the address space of the guest below 4 GB: the Xbox memory at
   `0x80000000`, the image, and pools for the memory of the guest
-  (`host/host_memory.c`).
+  (`host/host_memory.c`). Refer to "The fixed addresses".
 - Loads the image and fills its import table (`host/host_loader.c`).
 - Starts the `main` of the game and each guest thread on a stack in guest
   memory, because ILP32 code keeps stack addresses in 32-bit registers
@@ -415,8 +421,9 @@ and supplies the thread pointer and TLS.
 - Gives the audio callback of SDL to a thread with a guest stack
   (`host/host_sdl.c`).
 - Does the calls of the guest: system calls (`host/host_syscall.c`), SDL
-  (`host/host_sdl.c`), OpenGL ES (`host/host_gl.c`), and the file and socket
-  functions of `port/linux/src/posix_*.c`.
+  (`host/host_sdl.c`), OpenGL ES (`host/host_gl.c`), and the file, socket,
+  UPnP and DTLS functions of `port/linux/src/posix_*.c` (DTLS with Mbed TLS,
+  for internet play with browsers: `posix_dtls.c`).
 
 The guest calls the host through stubs (`tools/android_imports.py`). The
 two ABIs use the same registers for 32-bit integers, floats and pointers.
@@ -424,6 +431,49 @@ two ABIs use the same registers for 32-bit integers, floats and pointers.
 `port/linux/src/gl.h`. `tools/android_posix_stubs.py` makes the stubs of the
 `posix_*` functions, which copy the `errno` of the host.
 
+### The fixed addresses
+
+The guest needs the Xbox memory at `0x80000000` to `0x88000000` and the
+image above it, to `0x8c000000`. The cache files contain pointers to these
+addresses. The Java runtime of Android (ART) also reserves its spaces below
+4 GB. On some devices, for example handhelds with a large Java heap (the
+AYN Thor, the Retroid Pocket), ART's large object space covers
+`0x80000000`. ART fills that space from its bottom, so the part at
+`0x80000000` is usually empty.
+
+Thus:
+
+1. The game operates in a process of its own (`:game`), with a fresh Java
+   heap. The launcher, the import of a disc image and an earlier game do
+   not leave objects there.
+2. At the start of that process, `HaloApplication` loads `libmain.so`. Its
+   `JNI_OnLoad` reserves the fixed addresses before the Java side
+   allocates large objects.
+3. If ART's large object space is in the way, the host takes back only the
+   part that covers the fixed addresses, and only if no page of it is in
+   use (`/proc/self/pagemap`, or `mincore` and the swap of that part if
+   the device refuses `pagemap`). The host never takes the other spaces of
+   ART.
+
+If the addresses are not available, the game shows a message, and writes
+the mappings below 4 GB to `memory_map.txt` in the data folder and to the
+log.
+
+To test the reclaim on any device, set a system property before you start
+the game. The app then puts a stand-in for ART's large object space over
+the fixed addresses:
+
+- `adb shell setprop debug.halo.art_overlap idle`: the stand-in is empty
+  at `0x80000000`. The log shows `reclaimed idle ART range`, and the game
+  starts.
+- `adb shell setprop debug.halo.art_overlap busy`: a page at `0x80100000`
+  is in use. The game shows the message and writes `memory_map.txt`.
+- Add `-nopagemap` to either value (`idle-nopagemap`) to test as on a
+  device that refuses `/proc/self/pagemap`. Add `-swapped`
+  (`idle-nopagemap-swapped`) to also move the objects of the stand-in to
+  swap; with `busy`, the page in the fixed addresses too.
+- `adb shell setprop debug.halo.art_overlap ""`: normal operation.
+
 ### OpenGL ES
 
 The renderer (`port/linux/src/d3d8_gl.c`) uses OpenGL ES 3.0, and some
@@ -493,6 +543,23 @@ assembly of the port is necessary:
 - The symbol aliases in `guest/libc/src_include/features.h`. The Darwin
   target does not accept alias attributes.
 
+## Geometry uploads
+
+Android streams vertex and index data from the current CPU bytes instead
+of reusing the persistent geometry mirror or its cached index extents.
+This is automatic; no console command or configuration change is needed.
+Affected players reported that bypassing the cache resolved stretched or
+missing geometry, with some also reporting better performance. The exact
+cache failure mechanism remains unconfirmed.
+
+The Android-only guard in `mirror_range` uses the existing streaming
+fallback. Streamed upload methods, frame fences, shaders, texture caching
+and CPU write tracking are unchanged. Desktop and web retain their cache.
+Xbox and Custom Edition maps keep their existing loaders and resource
+paths. `tools/test_android_mirror_uploads.py` checks the bypass with large
+and reused ranges, frame-counter rollover and desktop/web cache controls;
+it does not substitute for device gameplay validation.
+
 ## Find problems
 
 - Enter `adb logcat -s halo` to see the log of the port and the errors of
@@ -512,8 +579,8 @@ assembly of the port is necessary:
 
 - Bink video is not available. The game skips the movies.
 - The device must let the app reserve the fixed guest addresses, from
-  `0x80000000` to approximately `0x89000000`. If the addresses are not
-  available, the app shows a message.
+  `0x80000000` to `0x8c000000`. If ART uses them, the app shows a message
+  (refer to "The fixed addresses").
 - Touch operates the menus and skips cinematics. In the game, the touch
   controls appear when no controller is connected; their size follows the
   height of the screen (larger on a tablet than on a phone), never smaller
@@ -522,8 +589,11 @@ assembly of the port is necessary:
   operate. The Xbox memory uses 4 KB pages.
 - The x86 Android emulator runs the app through its ARM translation. The
   translation cannot deliver the page faults that the renderer uses to
-  notice changed textures and vertices. On the emulator the app compares
+  notice changed textures. On the emulator the app compares
   page contents once a frame instead ("write tracking: page hashes" in the
-  log). This is slower, and a write shows one frame later, so moving
-  geometry can glitch briefly. `debug.memory_watch = false` does the same
-  on a device.
+  log). This is slower, and texture changes may appear one frame later.
+  `debug.memory_watch = false` does the same on a device. The translation
+  also has no scalar conversion from floating
+  point to an integer in a SIMD register (`fcvtzs s0, s1`, an illegal
+  instruction there), so `tools/android_asm_convert.py` writes each as the
+  vector form, which leaves the register and the exception flags the same.

port/android/STEAM_FRAME.md

@@ -10,28 +10,33 @@ On the Frame, in Desktop Mode (Steam menu > Power > Switch to Desktop):
 1. Put your own disc image of Halo: Combat Evolved for the original Xbox (`.iso` or
    `.xiso`, any version) in Downloads (or Documents, the Desktop, a memory
    card).
-2. Download `Install-Ringfall-Mjolnir-VR.desktop` from the latest release and open it
+2. Download `Install-Mjolnir-VR.desktop` from the latest release and open it
    (double-click; confirm running it).
 3. Answer the dialogs: the installer finds the disc image (or asks for it),
-   copies the game data out of it, adds "Ringfall: Mjolnir VR" to the Steam library
+   copies the game data out of it, adds "Mjolnir VR" to the Steam library
    and switches back to Gaming Mode. Start it from the library there.
 
-Opening the same file again updates the game (settings, saves and game data
-stay).
+The game updates itself: while it runs, its launcher looks for a newer
+release, fetches it and puts it in place as the next start begins
+(`steam_frame_launch.sh`; `update.auto = false` in `config.toml` stops it;
+`launcher.log` says what it did). Opening the same file again updates it
+too (settings, saves and game data stay).
 
 The desktop file (`steam_frame_installer.desktop`) downloads the latest
-release's `ringfall-mjolnir-vr-steam-frame.zip` (`tools/steam_frame_bundle.py`, made by
+release's `mjolnir-vr-steam-frame.zip` (`tools/steam_frame_bundle.py`, made by
 the release job of `.github/workflows/build.yml`) and runs its
 `install.sh` (`steam_frame_install.sh`), with zenity dialogs:
 - `~/Documents/RingfallMjolnirVR`: the launcher (`ringfall-mjolnir-vr.sh`)
   and the release APK (`RingfallMjolnirVR.apk`); the folder of the builds
   before the name, `~/Documents/HaloCE`, renamed to it, and their "Halo VR"
-  shortcut replaced;
+  shortcut replaced. (These keep the name of builds 302 to 313, "Ringfall:
+  Mjolnir VR": the Steam shortcut of an installed game starts the launcher
+  there, and the launcher's update looks for them in the bundle.);
 - the maps folder out of the disc image (`steam_frame_xiso.py`, the app's
   `XisoExtractor.java` in Python), unless `maps/ui.map` is there;
 - the Steam shortcut, unless it is there: added by Steam itself
   (`steam://addnonsteamgame`, as SteamOS's "Add to Steam" does) from
-  `Ringfall Mjolnir VR.desktop` beside the game, then the library pictures
+  `Mjolnir VR.desktop` beside the game, then the library pictures
   under the id Steam gave it. Steam is not closed: on the Frame, Desktop
   Mode runs inside Gaming Mode's session, and closing Steam ends it (and the
   installer with it). An old "Halo VR" shortcut is left for the player to
@@ -80,7 +85,7 @@ dialogs, for testing over adb; it leaves Steam and its shortcuts alone.
 
 ## Starting it on the Frame
 
-A button in the Steam library ("Ringfall: Mjolnir VR", a non-Steam game)
+A button in the Steam library ("Mjolnir VR", a non-Steam game)
 runs `~/Documents/RingfallMjolnirVR/ringfall-mjolnir-vr.sh` (`port/android/steam_frame_launch.sh`),
 which starts the game as Steam starts an Android title of its own:
 `lepton waitforexitandrun -- ~/Documents/RingfallMjolnirVR/RingfallMjolnirVR.apk`, in a container

port/android/VR_ROADMAP.md

@@ -1,6 +1,6 @@
 # VR roadmap
 
-What Ringfall: Mjolnir VR (Quest 3, Steam Frame) has, and what comes next, in the
+What Mjolnir VR (Quest 3, Steam Frame) has, and what comes next, in the
 agreed order. Updated with every step: a step is **done** once the user has
 tried it in the headset and it is merged into `main`; **built** means in a
 branch, not yet tried in the headset.
@@ -17,14 +17,18 @@ named where code is taken over.
 | Area | What |
 | --- | --- |
 | Headsets | Quest 3; Steam Frame (Lepton): its controllers' layout, a Steam library tile that installs, starts, updates and quits the game, data kept in `~/Documents/RingfallMjolnirVR` |
-| Rendering | Both eyes in one pass (multiview) on the Quest; one by one on SteamVR, where multiview's eyes did not fuse; lens flares at their depth in stereo; HUD, menus, scope, crosshair and names as layers of their own |
-| Aiming | The weapon in the hand, its shots from the muzzle, laser and crosshair options |
+| Rendering | The eyes drawn one by one (both at once, multiview, only with `debug.multiview`: its eyes did not always fuse, see the open points); lens flares at their depth in stereo; HUD, menus, scope, crosshair and names as layers of their own |
+| Aiming | The weapon in the hand, its shots from the muzzle, laser and crosshair options; each weapon held so that its model's hand lands on the real one, as the free hand's (it learns where each weapon's animations hold the hand; the pistol's had been 15 cm before the real hand, the assault rifle's 8 cm aside), the scope's disc moved with it; `vr.weapon_hand_*` to adjust (2026-10-17) |
 | Body | Physical crouch (`vr.crouch_limit`) beside the crouch button, leaning (`vr.lean_limit`), melee by swinging, grenades thrown with the left hand, two-handed weapons |
 | Vehicles | The Warthog's wheel turned with the hands, right trigger throttle, left brake; first-person seats; turrets with handles |
+| Scores | The menu button held shows the scores on the Quest (a press pauses, as it is let go); the Steam Frame's View button as before; the text chat's lines where the desktop has them (2026-10-18) |
 | Comfort | Snap or smooth turning, a comfort vignette in vehicles, VR options in the main and pause menus (Y), a page of every controller button |
 | Menus | The PC version's menus in VR (`vr.menus`), clicked with a laser; text typed on the on-screen keyboard |
-| Multiplayer | Up to date with OpenCE (network version 25, 2026-10-10): cross-play, its server browser, co-op campaign, password lobbies; join codes and the VR online list |
-| Bots | Bots in multiplayer: on foot (paths, items, objectives), in vehicles and at turrets; they make room for a joining person |
+| Multiplayer | Up to date with OpenCE (network version 32, 2026-10-20; HDR kept off in VR): cross-play, its server browser, co-op campaign, password lobbies; join codes and the VR online list |
+| Bots | Bots in multiplayer (`host_bots.c`; OpenCE's own, `bots.c`, are local split screen games' and off in VR): on foot (paths, items, objectives), in vehicles and at turrets; they make room for a joining person, on the LAN too (2026-10-18); they climb ladders (Damnation's) and take paths as near their goal as a search reaches, as OpenCE's do: on Damnation 0 searches of 1747 failed, 1078 of 1605 before (2026-10-20). Later: OpenCE's bots' aiming (lead, bursts, taps for the pistol and sniper rifle, field of view), learnt obstacles and map fixes into ours |
+| Voice chat | Push to talk on any button (`vr.button_talk`, BUTTONS page; the free hand's grip by default, sending nothing while it reaches for the foregrip or the wheel), open mic, off (2026-10-13) |
+| Builds | The Android build's assembly conversion (`tools/android_asm_convert.py`) keeps string data as it is: strings and tables starting with "_" or holding \" lost a "_" (Opus's pulse cache among them: the Steam Frame's crashes in online games while talking), 2026-10-13 |
+| Languages | The European disc in Spanish and Italian (a maps folder for each, `maps_es` and `maps_it`, none called `maps`) imported on the Quest and the Steam Frame: the headset's language's, its language the game's and the menus' (`maps/language.txt`, unless `game.language` is set), 2026-10-17; not yet tried with that disc |
 | Controls | Left-handed mode (`vr.handedness`): the weapon in the left hand, the arms and grips mirrored, sticks and buttons mirrored on both controllers (`vr.mirror_controls`), the assault rifle's counter read the right way round (2026-10-06) |
 | Graphics | Presets low / medium / high / max (`vr.graphics`), refresh rate and resolution in the VR options, all kept over a restart (2026-10-06) |
 | Arms and hands | Both arms by IK from shoulders that follow the torso, the elbow led by the hand's roll; fingers from trigger, grip and touch; `vr.body` arms / hands / off, `vr.fingers` (2026-10-06) |
@@ -39,8 +43,10 @@ named where code is taken over.
 | 3b | The whole body: torso from head and hands, legs and feet following in the room; full / arms only / hands only | **done** (in `main` 2026-10-10; Quest 3 good): `vr.body` "full" ("Full body" in the VR options; "arms" still the default), legs walking the way the player moves, feet on the ground. Also in: voice chat's push to talk on the free hand's grip. Steam Frame: its cost still to measure |
 | 3c | Weapons held physically, holsters at shoulder and hip (the buttons stay) | |
 | 3d | Other VR players shown with their heads, hands and bodies (today their bodies move as flat players' do: only their aim and throws come from their hands) | |
-| 4 | Later: disc image import in the launcher, sprint by arm swing (offline) | import **done** (in `main` 2026-10-06): the app's import (tried on the Quest 3: all 24 maps; on the Frame kept in `~/Documents/RingfallMjolnirVR`), a Steam Frame installer from Desktop Mode (`STEAM_FRAME.md`; tried on the Frame: the old folder renamed, the shortcut added by Steam), a release signing key (CI and local builds the same). Sprint by arm swing still open |
+| 4 | Later: disc image import in the launcher; moving by swinging the arms (in place of the stick, never faster than it: online too), and a sprint by swinging them harder (faster than the game allows: offline only) | import **done** (in `main` 2026-10-06): the app's import (tried on the Quest 3: all 24 maps; on the Frame kept in `~/Documents/RingfallMjolnirVR`), a Steam Frame installer from Desktop Mode (`STEAM_FRAME.md`; tried on the Frame: the old folder renamed, the shortcut added by Steam), a release signing key (CI and local builds the same). Arm swinging and its offline sprint still open |
+| 5 | Later: multiview again (both eyes in one pass, half the drawing's CPU cost): find why its eyes do not fuse in big online games on the Quest 3 (and now and then on the Steam Frame), then turn it back on | open: off by default since 2026-10-16 (`debug.multiview`); findings in the open points |
 | R | Release as **Ringfall: Mjolnir VR** (no "Halo" in the product's name): app name, id `io.github.cesarus85.ringfall`, icon and library pictures (`tools/ringfall_art.py`), Frame folder and installer, release assets, README; the repository renamed | **done** (in `main` 2026-10-06; Quest 3 and Steam Frame good) |
+| R2 | Renamed **Mjolnir VR** ("Ringfall" is another game's name): app and Steam names, logo (`tools/mjolnir_art.py`), release assets (also under the old names for the updaters of builds 302 to 313), updaters, README; the repository renamed `Cesarus85/mjolnir-vr` (GitHub forwards the old links). Kept: the app id, the signing key's alias, the Frame's `~/Documents/RingfallMjolnirVR` and the names inside its bundle (installed games and their shortcuts) | in `feature/rename-mjolnir-vr` (2026-10-21) |
 
 ## Step 2, first part (done)
 
@@ -116,7 +122,8 @@ restart. The controller buttons page shows the layout as set.
 | --- | --- |
 | `vr.handedness` | `"right"` (default), `"left"` |
 | `vr.mirror_controls` | `true` (default): sticks and buttons mirrored when left-handed; `false`: as right-handed (triggers and grips still follow the hands) |
-| `vr.graphics` | `"low"`, `"medium"`, `"high"` (default), `"max"` |
+| `vr.graphics` | `"auto"` (default, branch `fix/vr-frame-hitches`), `"low"`, `"medium"`, `"high"`, `"max"` |
+| `vr.foveation` | `"off"` (default), `"low"`, `"medium"` (the Quest only; branch `fix/vr-frame-hitches`) |
 | `vr.refresh_rate` | Hz, as offered (Quest 3: 72, 80, 90, 120) |
 | `vr.resolution_scale` | 0.7 to 1.2, on restart |
 
@@ -149,11 +156,15 @@ COMFORT (turning, the vignettes), BUTTONS (the actions' buttons,
 
 Buttons remapped (BUTTONS page; `vr.c` `controls_remapped`):
 - Jump, the flashlight (held: switch grenades), action/reload, switch
-  weapon, crouch, zoom and melee each go on one of seven buttons: A, B,
-  X, Y, the move stick's click, the turning stick's, the weapon hand's
-  grip. Moving an action to a button swaps it with the action there, so
-  none is ever left without one.
-- The triggers, the free hand's grip, the menu button, the Steam Frame's
+  weapon, crouch, zoom, melee and push to talk each go on one of eight
+  buttons: A, B, X, Y, the move stick's click, the turning stick's, the
+  weapon hand's grip, the free hand's grip. Moving an action to a button
+  swaps it with the action there, so none is ever left without one.
+- The free hand's grip as a button (`free_grip_down`): pressed once held
+  0.15 s at the foregrip's threshold, and not at all while it holds the
+  weapon's foregrip or the Warthog's wheel (taken in that time, the press
+  is theirs until the grip opens).
+- The triggers, the menu button, the Steam Frame's
   bumpers, D-pad and View button keep theirs; the menus keep the buttons
   as they are.
 - Applied after the left-handed mirroring, on the gamepad's sides: the
@@ -398,16 +409,165 @@ To try in the headset (Quest 3 and Steam Frame), with `vr.body = "full"`
     "Open mic" talks without the grip; "Off" sends nothing (others still
     heard).
 
+## Frame hitches and GPU time (built: branch `fix/vr-frame-hitches`)
+
+Measured on the Quest 3 (2026-10-12; 90 Hz, multiview, graphics "high",
+full body, a 15-bot game on Blood Gulch): the game's CPU work 5-6 ms a
+frame; the app's GPU time 5.5-6.4 ms (`xr: metrics`), the same with
+foveation off, low, medium and high: **the GPU is not the bottleneck**.
+The doubled pictures come from single long frames: shader programs compiled
+in a frame (29 new ones in a 794 ms frame 22 s into a match, single ones
+18-64 ms), draws of 254 ms (the first frame in a map) and 74 ms with
+nothing compiled (most likely the driver making a program's variants at
+its first draw), and the menus' PNG pictures (7 in 108 ms).
+
+What the branch has:
+
+| Part | What |
+| --- | --- |
+| Long frames | `VR: long frame N ms: input, ticks, camera, draw, present; shaders compiled or linked, programs from the cache; textures uploaded, menu pictures, render targets; draw calls N ms, the slowest N ms (vertex program, program key); N draws left out waiting for their programs`. The 5 s report counts the draws left out |
+| GPU time | XR_META_performance_metrics on with `vr.log_performance`: `xr: metrics (mean/most) app/gpu_frametime=... compositor/dropped_frame_count=...` |
+| Foveation | `vr.foveation` "off" (default) / "low" / "medium" on the MORE page (GL_QCOM_texture_foveated, the eyes only, lens centres); "high" taken out (it drew a grey rectangle below the player). Kept for later, no gain measured |
+| Shader cache | `display.shader_cache`: programs kept in `shader_cache/` (binary, driver, sources); each map's list (`maps/<map>.txt`) and every map's (`all.txt`) |
+| Worker | `display.shader_worker` (default true): programs made on a thread with a GL context sharing the game's (`gl worker: running`), from the cache's binary or compiled; a draw whose program is not made yet is left out for those frames, the frame never waits. As a map loads, its programs and then every map's are asked for |
+| Warm-up | `debug.shader_warm_up`: "worker" (default: each program drawn with once on the worker into a small target of the eyes' kinds), "load" (the map's programs drawn with on the game's thread as it loads), "off" |
+| Menus | The PC menus' pictures decoded on a thread of their own, drawn transparent for the frames that takes |
+
+Second Quest test (latest build): the worker works, no long frame after the
+map's first frames (245 ms and 72 ms there, each one draw of 67-75 ms with
+vertex program 4). But doubled pictures in spells of seconds with the GPU
+at 9-13 ms a frame (GPU% 0.91-0.94, 4-37 stale frames a second), 5-7 ms in
+between: "high" is too much for 90 Hz in heavy scenes, "medium" holds.
+Hence:
+
+| Part | What |
+| --- | --- |
+| Graphics "auto" | `vr.graphics = "auto"`, the new default (Graphics row: Auto): "high" while the GPU keeps up. Past 4/5 of the frame (8.9 ms at 90 Hz) for a quarter second it leaves out the next steps (shield glow, shadows, reflections, specular light, lens flares, bump maps, the rest of "low"), as many as their learnt costs say; brings one back once GPU time + its cost stays under 7/10 of the frame for 3 s (longer if it had to go again within 10 s). Logs `VR graphics auto: shadows left out (step 2): the GPU 10.2 ms a frame of 11.1`, `... saved 1.9 ms`, `... back`. On the Steam Frame (no GPU time from SteamVR) "auto" is "high" |
+| Measuring | `debug.vr_graphics_measure = true`: each effect left out in turn (1.5 s on, 1.5 s off), `VR graphics measure: shadows 2.10 ms (...)` and means each round |
+
+What the effects cost, from the code (to be measured with the option above):
+object shadows are drawn once a frame with multiview (the scene is drawn
+once), twice one eye at a time; each shadow-casting object (every bot, its
+weapon, vehicles) renders its map, blurs it and projects it onto the level
+beneath: a pass of fill on both eyes per object. Reflections and specular
+light are passes over the level's geometry. The shield's glow
+(`display.shield_glow`, off by default) is a dynamic light per flaring unit
+(at most 8), each lighting the level's surfaces in its reach once more, not
+a pass per object; upstream's shield colour on the arms only changes a
+colour. The whole body adds the player's own model and its shadow.
+
+Not done, and why:
+- Drawing the eyes straight into the swapchain: moot now (GPU not the
+  bottleneck); it needs GL_EXT_sRGB_write_control, the vignette as a pass
+  of its own and array swapchains acquired mid-frame.
+- Decoding all menu pictures ahead: 165 pictures, about 350 MB decoded with
+  their mipmaps.
+- Later: XR_KHR_visibility_mask.
+
+### Headset test, graphics "auto" (Quest 3)
+
+1. VR options, MORE: Graphics **Auto** (a `config.toml` written before
+   still says "high"), Foveation Off; `vr.log_performance = true`.
+2. Log at start: `xr: performance metrics on (... the app's GPU time read)`,
+   `VR: graphics auto`.
+3. 15-bot match on Blood Gulch, a few minutes, also into the busy middle:
+   - `VR graphics auto: ... left out (step N): the GPU X ms` within a
+     quarter to half a second of a heavy spell, `... saved Y ms`, and
+     `... back` a few seconds after it.
+   - VrApi: `Stale=` 0 nearly every second (at most a few in the second a
+     spell begins), no `ASW=1` spells; App GPU under about 9 ms.
+   - Look for effects that pop: shadows going and coming back. If they
+     change more than every ten seconds or so, note the log lines.
+4. Costs: a second match with `debug.vr_graphics_measure = true` (Graphics
+   setting ignored meanwhile; stand somewhere busy, a few minutes):
+   `VR graphics measure: means (ms of GPU a frame): shadows ...;
+   reflections ...`. The steps' order should follow the largest costs.
+5. The first frames of a map (245/72 ms, vertex program 4): try
+   `debug.shader_warm_up = "load"` once and compare those lines.
+
+### Headset test, shader worker (Quest 3)
+
+Before: `adb logcat -G 16M` (again after any reboot); in `config.toml`
+`vr.log_performance = true`, 90 Hz, graphics "high", multiview, full body;
+Foveation Off (VR options, MORE: the config may still say "medium"). After
+each test: `adb logcat -d -s halo VrApi > test.txt`. The shader cache from
+the earlier tests stays.
+
+1. Start: `gl worker: running (ES 3, surfaceless, programs warmed up)` and
+   `shader cache: ... N programs kept (... N listed) ...; programs made on
+   the worker, warmed up there`. As the menus load: `shader cache:
+   levels_ui_ui: N programs listed; N asked of the worker ...; N of other
+   maps to ask for`.
+2. Bot match on Blood Gulch: as it loads, `... bloodgulch: N listed; ...
+   N there already` (made while in the menus). In play no `VR: long frame`
+   with shaders compiled; at most a few `draws left out` (objects appearing
+   a frame or two late), and VrApi `Stale=0` most seconds, no `ASW=1`.
+   Any long frame left: its `draw calls ... the slowest N ms (vertex program
+   N, program K)` says whether a draw (a driver variant) is the cause.
+3. A map not played yet (Damnation): as it loads, `N programs listed` is 0
+   but `N there already` should not matter: its programs mostly come from
+   every map's list (made in the menus). New ones are compiled on the worker
+   (`draws left out` for a moment, no long frame).
+4. If draws of 70-250 ms remain with nothing compiled: `debug.shader_warm_up
+   = "load"` (the log: `shader cache: N programs drawn with once as the map
+   loaded, in N ms`), then compare; and `"off"` for the baseline.
+5. Menus: open new screens; pictures may appear a frame late, no long
+   frames with `menu pictures`.
+6. If anything breaks (missing objects for good, a crash):
+   `display.shader_worker = false` brings the game's-thread compiling back.
+
+Steam Frame: the worker also runs there if its EGL shares contexts (the log
+says `gl worker: running` or why not); no foveation. A short bot game to
+see that nothing is missing or slower.
+
 ## Open points outside the order
 
+- Multiview's doubled pictures (2026-10-16): on the developer's Quest 3,
+  doubled and shifted pictures from the start of big online games (26-35
+  players) as the head turned, nauseating; none in a local game with 48
+  bots; none online either with the eyes drawn one by one. Not the frame
+  rate: one by one, online at 72 Hz, the compositor repeated as many
+  frames (about 4 a second) and nothing was seen. Not the facing jumps
+  (respawns only) nor the camera (it moves every frame). Before: the
+  Steam Frame's (2026-10-05), each eye alone sharp. So the eyes are drawn
+  one by one by default now (`debug.multiview` for both at once). To do:
+  find what the shared pass draws wrongly online, e.g. by saving both
+  eyes' pictures in a big online game and comparing what is doubled
+  (sprites and effects projected by the game itself, `mv_depth`; programs
+  made on the shader worker; the sky rows), then turn it back on: it
+  halves the drawing's CPU cost.
+- Big online games (2026-10-16): doubled pictures on a 32-player server,
+  none in a local game with 48 bots. Not the GPU (60–80 %): the ticks cost
+  3.3–4.6 ms as a client there (1.3–1.9 ms with bots or 16 players), so
+  47–70 of 150 frames with a tick missed 90 Hz's 11.1 ms (the doubling
+  itself was multiview's, above). In `main` 2026-10-16 (Quest 3 good):
+  `vr.refresh_rate_auto`
+  (VR options MORE, "Lower it when frames are late", on by default) steps
+  the rate down a step (90, 80, 72 Hz) while more than one frame in 32
+  comes late, and back up once they would keep up; "VR: refresh rate" in
+  the log. First try: 90 to 80 Hz a few seconds into a 30-player game, no
+  doubled picture seen; 2-5 stale frames a second left at 80, hence one
+  in 32 (was 16). Later:
+  why a client's ticks cost that much per remote player.
+
+- Doubled pictures when turning on the developer's Quest 3 (2026-10-12):
+  with every build tried, back to 2026-10-06's, at 90 and at 72 Hz, even
+  in seconds the compositor reported no stale frame. That Quest runs
+  Horizon OS from the Public Test Channel (PTC; its build 2026-10-08),
+  the likeliest cause. Released with `vr.graphics` "medium" as the
+  default (smooth there). To do: try this and later builds with "high" on
+  a Quest 3 outside PTC (the developer's wife's), and set the default
+  back to "high" or "auto" if it holds.
+  Resolved 2026-10-16: multiview (above), not the Horizon OS PTC.
+
 - Multiview on the Steam Frame: why the eyes do not fuse there (suspected
   Mesa zink/Turnip); tools in branch `frame/doubled-images` (86335828),
   not merged.
 - Transparent geometry groups: the Xbox's 384 a window overflowed in
   games of 30 and more players (the last submitted, glass, water,
-  particles, contrails, vanished). Raised to 2048 (320 KB) on
-  `feature/vr-comfort`, to check in a large game (step 2, second part,
-  test 6); upstream still has 384.
+  particles, contrails, vanished). Raised to 2048 (320 KB), in `main`;
+  still to check in a game of 30 and more players; upstream raised them
+  to 2048 too (2026-10-12).
 
 ## Headset tests (2026-10-06, all three in `main`)
 

port/android/app/src/main/AndroidManifest.xml

@@ -29,6 +29,7 @@
          predictive back (the default once an app targets Android 16) the
          system would take them and the game would never see them -->
     <application
+        android:name=".HaloApplication"
         android:label="@string/app_name"
         android:icon="@mipmap/ic_launcher"
         android:allowBackup="false"
@@ -75,7 +76,10 @@
              (without them Horizon OS shows it as a flat panel, and the OpenXR
              session never gets focus); phones ignore them. The launcher,
              a flat panel on a headset, starts it once the game data is
-             there. -->
+             there. (port: upstream runs it in a process of its own,
+             ":game", for handhelds whose Java heap covers the Xbox window;
+             not here: on the Steam Frame Lepton waits for the app's process
+             to end, and the headsets have no such overlap) -->
         <activity
             android:name=".HaloActivity"
             android:exported="true"

port/android/app/src/main/java/com/halo/decomp/HaloApplication.java

@@ -0,0 +1,33 @@
+package com.halo.decomp;
+
+import android.app.Application;
+
+/**
+ * The game (HaloActivity) runs in a process of its own, ":game", so that
+ * its Java runtime starts fresh for it: nothing the launcher, the disc
+ * image import or an earlier game did is left in its heap.
+ *
+ * There the native library is loaded first thing, and reserves the fixed
+ * addresses the game needs at 0x80000000 (port/android/host/host_main.c,
+ * JNI_OnLoad) before the Java side has allocated anything large: on some
+ * devices, handhelds with a large Java heap especially, ART's large object
+ * space covers those addresses, and only an idle part of it can be taken
+ * back (port/android/host/host_memory.c).
+ */
+public class HaloApplication extends Application {
+    @Override
+    public void onCreate() {
+        super.onCreate();
+        String process = Application.getProcessName();
+        if (process == null || !process.endsWith(":game"))
+            return;
+        try {
+            // in SDLActivity's order (HaloActivity.getLibraries); it
+            // finds them loaded
+            System.loadLibrary("SDL3");
+            System.loadLibrary("main");
+        } catch (UnsatisfiedLinkError e) {
+            // SDLActivity reports it
+        }
+    }
+}

port/android/app/src/main/java/com/halo/decomp/LauncherActivity.java

@@ -35,7 +35,7 @@ import java.nio.channels.FileChannel;
  */
 public class LauncherActivity extends Activity {
     private static final int PICK_IMAGE = 1;
-    private static final String SHARED_DATA_ROOT = "/home/steamos/Documents/RingfallMjolnirVR";
+    static final String SHARED_DATA_ROOT = "/home/steamos/Documents/RingfallMjolnirVR";
 
     private File dataRoot;
     private TextView status;
@@ -147,7 +147,7 @@ public class LauncherActivity extends Activity {
         layout.setBackgroundColor(Color.rgb(12, 16, 20));
 
         TextView title = new TextView(this);
-        title.setText("Ringfall: Mjolnir VR needs game data");
+        title.setText("Mjolnir VR needs game data");
         title.setTextColor(Color.WHITE);
         title.setTextSize(TypedValue.COMPLEX_UNIT_SP, 24);
         title.setGravity(Gravity.CENTER);

port/android/app/src/main/java/com/halo/decomp/Updater.java

@@ -36,7 +36,8 @@ import java.util.zip.ZipInputStream;
  * the latest release when it starts, on a thread of its own, and if it is
  * newer asks the player whether to update:
  *
- * - Yes: the release's app (halo-android-release.zip or -debug.zip) is
+ * - Yes: the release's app (mjolnir-vr-android-release.zip or
+ *   -debug.zip) is
  *   downloaded and handed to Android's package installer, which replaces the
  *   game (closing it) and offers to open the new version.
  * - No: nothing, until the next start.
@@ -45,12 +46,15 @@ import java.util.zip.ZipInputStream;
  *
  * Every build of main is signed with the same key (the workflow's), which an
  * app must keep for Android to install a new version over it.
+ *
+ * Not on the Steam Frame: Lepton installs the APK in the game's folder there
+ * at every start, so its launcher updates that (steam_frame_launch.sh).
  */
 final class Updater {
     /* the VR port's own releases: the original's, made without VR, must
        never replace it (they share the package name) */
-    private static final String APP_NAME = "Ringfall: Mjolnir VR";
-    private static final String REPOSITORY = "Cesarus85/ringfall-mjolnir-vr";
+    private static final String APP_NAME = "Mjolnir VR";
+    private static final String REPOSITORY = "Cesarus85/mjolnir-vr";
     private static final String USER_AGENT = "halo-ce-universal-updater";
     private static final int TIMEOUT_MILLISECONDS = 20000;
     /** the most a download (a release's zip, about 35 MB) or the app in it may be */
@@ -63,7 +67,8 @@ final class Updater {
     static void start(Activity activity) {
         File config = configFile(activity);
 
-        if (BuildConfig.HALO_BUILD_NUMBER <= 0 || config == null || !autoUpdate(config))
+        if (BuildConfig.HALO_BUILD_NUMBER <= 0 || config == null || !autoUpdate(config) ||
+                new File(LauncherActivity.SHARED_DATA_ROOT).isDirectory())
             return;
         new Thread(() -> {
             int latest = latestRelease();
@@ -235,7 +240,7 @@ final class Updater {
     /* ---------- updating */
 
     private static void update(Activity activity, int latest) {
-        String asset = "ringfall-mjolnir-vr-android-" + (BuildConfig.DEBUG ? "debug" : "release") + ".zip";
+        String asset = "mjolnir-vr-android-" + (BuildConfig.DEBUG ? "debug" : "release") + ".zip";
         File directory = new File(activity.getCacheDir(), UpdateProvider.DIRECTORY);
         LinearLayout layout = new LinearLayout(activity);
         TextView status = new TextView(activity);

port/android/app/src/main/java/com/halo/decomp/XisoExtractor.java

@@ -4,94 +4,101 @@ import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
-import java.nio.ByteOrder;
 import java.nio.channels.FileChannel;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.BitSet;
 import java.util.List;
+import java.util.Locale;
 
 /**
- * Copies the maps folder out of an Xbox disc image (an "xiso", or a whole
- * disc's ".iso"), as the desktop games do (port/linux/src/xiso.c, which this
- * follows).
+ * Copies the maps folder out of the player's Xbox disc image of Halo, for
+ * LauncherActivity, as the desktop games do (port/linux/src/xiso.c; the web
+ * page's is port/web/site/xiso-worker.js). The image is a document the
+ * player picked, read through its FileChannel at absolute positions.
  *
- * The image's file system is XDVDFS, read as extract-xiso does
- * (https://github.com/XboxDev/extract-xiso, extract-xiso.c, whose format
- * handling this follows; its license is below and in
- * port/third_party/extract-xiso/LICENSE.TXT): 2048-byte sectors; a volume
- * descriptor at 0x10000 that starts and ends with "MICROSOFT*XBOX*MEDIA" and
- * gives the root directory's sector and size; and directories whose entries
- * form a binary tree (each entry: left and right subtree offsets in 4-byte
- * units, the start sector, the size, attributes, the name's length and the
- * name, 4-byte aligned). Images made from a whole disc put the game partition
- * further in, at one of the offsets below.
+ * Written from a description of the Xbox's disc file system, XDVDFS
+ * (xboxdevwiki's XDVDFS page, https://xboxdevwiki.net/XDVDFS, and the format
+ * facts OpenCE's readers rely on). What this class relies on:
  *
- * The files are written to maps.partial first and moved into maps once they
- * all are, so an interrupted extraction never leaves maps/ui.map behind.
+ * - Sectors are 2048 bytes and integers little-endian. Sector numbers count
+ *   from the start of the game partition: an image of the partition alone
+ *   has it at 0, an image of a whole disc further in (0x0FD90000, 0x02080000
+ *   or 0x18300000 for XGD2, XGD3 and XGD1 discs). They are tried in that
+ *   order.
+ * - The volume descriptor is the partition's sector 32 (at 0x10000). It
+ *   holds "MICROSOFT*XBOX*MEDIA" at its start and again at 0x7EC, and the
+ *   root directory table's start sector (u32 at 0x14) and size in bytes (u32
+ *   at 0x18).
+ * - A directory table is a binary tree of entries whose root is the entry at
+ *   offset 0. An entry is a left and a right subtree link (u16 each, in
+ *   4-byte units from the table's start, 0 for none), the start sector and
+ *   the size of the file or of the subdirectory's table (u32 each), the
+ *   attributes (u8, 0x10 for a directory), the name's length (u8) and the
+ *   name. Unused bytes of a table are 0xFF, so a left link of 0xFFFF is
+ *   padding, not an entry.
+ * - A file is one contiguous run of bytes from the start of its sector.
  *
- * Some parts of this code are copyright in@fishtank.com. This product
- * includes software developed by in <in@fishtank.com>.
+ * The image is the player's file and nothing read from it is trusted. Only
+ * the root's table and the maps folder's are read, each whole and at most
+ * 4 MB; the walk of a table visits each offset once, goes at most 64 links
+ * deep and looks at most 4096 entries; and a file is written only under a
+ * plain name that no file before it had (ignoring case).
  *
- * Copyright (c) 2003 in <in@fishtank.com>
- * All rights reserved.
+ * The loading screen's picture, which the retail disc has no file of, is
+ * taken out of the root's default.xbe (read whole, at most 64 MB) and
+ * written beside the maps as the loading.tga the game reads, when the maps
+ * folder has none (loadingPicture, as xiso.c's xiso_write_loading_picture);
+ * without it the light sweeps over black, as the game's own does.
  *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *
- *    This product includes software developed by in <in@fishtank.com>.
- *
- * 4. Neither the name of "in" nor the email address "in@fishtank.com"
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED `AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
- * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
- * AUTHOR OR ANY CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
- * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
- * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * The app starts the game once maps/ui.map exists, and makes the maps folder
+ * itself, so the copy is written to maps.partial (emptied first of what an
+ * earlier attempt left) and its files moved into maps once all are
+ * complete, ui.map last.
  */
 final class XisoExtractor {
     private static final int SECTOR_SIZE = 2048;
-    private static final long VOLUME_DESCRIPTOR_OFFSET = 0x10000;
-    private static final int ENTRY_HEADER_SIZE = 14;
+    private static final int DESCRIPTOR_OFFSET = 0x10000;
+    private static final byte[] MAGIC = "MICROSOFT*XBOX*MEDIA".getBytes(StandardCharsets.ISO_8859_1);
+    private static final int SECOND_MAGIC_OFFSET = 0x7EC;
+    private static final int ENTRY_FIXED_SIZE = 14;
     private static final int ATTRIBUTE_DIRECTORY = 0x10;
-    /* directory tables are a few sectors; anything much larger is not one */
-    private static final long MAXIMUM_DIRECTORY_SIZE = 4 << 20;
-    private static final int MAXIMUM_FILES = 256;
-    private static final int COPY_BUFFER_SIZE = 1 << 20;
-    private static final byte[] VOLUME_MAGIC = "MICROSOFT*XBOX*MEDIA".getBytes(StandardCharsets.US_ASCII);
-
-    /* where the game partition starts: a plain image, and whole-disc images
-    (extract-xiso's GLOBAL, XGD3 and XGD1 offsets) */
-    private static final long[] PARTITION_OFFSETS = { 0, 0x0FD90000L, 0x02080000L, 0x18300000L };
+    private static final int PADDING_LINK = 0xFFFF;
+    /** where the game partition may start, in the order they are tried */
+    private static final long[] PARTITION_STARTS = {
+        0x00000000L, // an image of the game partition alone
+        0x0FD90000L, // a whole XGD2 disc
+        0x02080000L, // a whole XGD3 disc
+        0x18300000L, // a whole XGD1 disc (the original Xbox's)
+    };
+    /** directory tables are a few sectors; anything much larger is not one */
+    private static final int MAXIMUM_TABLE_SIZE = 4 * 1024 * 1024;
+    private static final int MAXIMUM_DEPTH = 64;
+    private static final int MAXIMUM_VISITS = 4096;
+    private static final int MAXIMUM_ENTRIES = 256;
+    private static final int COPY_CHUNK = 1024 * 1024;
+    private static final String PARTIAL_DIRECTORY = "maps.partial";
+    /** the loading screen's picture (source/interface/progress_bar.c), out of default.xbe; the executable is a few MB */
+    private static final int LOADING_WIDTH = 320;
+    private static final int LOADING_HEIGHT = 240;
+    private static final int TGA_HEADER_SIZE = 18;
+    private static final long MAXIMUM_XBE_SIZE = 64 * 1024 * 1024;
+    private static final String LOADING_PICTURE = "loading.tga";
 
+    /** Told as the copy goes: the file being copied, and the bytes copied of all the files'. */
     interface Progress {
         void report(String file, long done, long total);
     }
 
-    /** a reason the player can act on */
+    /** A reason the player can act on: its message is shown as it is. */
     static final class ExtractException extends IOException {
         ExtractException(String message) {
             super(message);
         }
     }
 
+    /** a file or folder found in a directory table */
     private static final class Entry {
         final String name;
         final long sector;
@@ -104,187 +111,414 @@ final class XisoExtractor {
         }
     }
 
-    private final FileChannel image;
-    private long partition;
-
-    private XisoExtractor(FileChannel image) {
-        this.image = image;
+    private XisoExtractor() {
     }
 
-    /** copies the image's maps folder to destination/maps */
+    /** Copies the image's maps folder to destination/maps. */
     static void extractMaps(FileChannel image, File destination, Progress progress) throws IOException {
-        new XisoExtractor(image).extract(destination, progress);
-    }
+        long imageSize = image.size();
+        long partition = -1;
+        long rootSector = 0, rootSize = 0;
+        ByteBuffer descriptor = ByteBuffer.allocate(SECTOR_SIZE);
 
-    private void readAt(long offset, ByteBuffer buffer) throws IOException {
-        while (buffer.hasRemaining()) {
-            int count = image.read(buffer, offset);
-
-            if (count <= 0)
-                throw new ExtractException("Could not read the disc image (is it complete?).");
-            offset += count;
-        }
-        buffer.flip();
-    }
-
-    private static boolean magicAt(ByteBuffer buffer, int offset) {
-        for (int index = 0; index < VOLUME_MAGIC.length; index++) {
-            if (buffer.get(offset + index) != VOLUME_MAGIC[index])
-                return false;
-        }
-        return true;
-    }
-
-    /** whether a name is one to write in the maps folder: no path, no "." or
-     * "..", and only printable ASCII that every file system takes as a plain
-     * name (a disc's maps folder holds .map files and loading.tga) */
-    static boolean isPlainName(String name) {
-        if (name.isEmpty() || name.equals(".") || name.equals(".."))
-            return false;
-        for (int index = 0; index < name.length(); index++) {
-            char c = name.charAt(index);
-            if (c < 0x20 || c > 0x7E || "/\\:*?\"<>|".indexOf(c) >= 0)
-                return false;
-        }
-        return true;
-    }
-
-    /** the partition's volume descriptor: the root directory's sector and size */
-    private long[] findVolume() throws IOException {
-        for (long offset : PARTITION_OFFSETS) {
-            ByteBuffer descriptor = ByteBuffer.allocate(SECTOR_SIZE).order(ByteOrder.LITTLE_ENDIAN);
-
-            try {
-                readAt(offset + VOLUME_DESCRIPTOR_OFFSET, descriptor);
-            } catch (IOException e) {
+        for (long start : PARTITION_STARTS) {
+            if (start + DESCRIPTOR_OFFSET + SECTOR_SIZE > imageSize)
                 continue;
-            }
-            if (!magicAt(descriptor, 0) || !magicAt(descriptor, 0x7EC))
+            descriptor.clear();
+            if (!readFully(image, descriptor, start + DESCRIPTOR_OFFSET))
                 continue;
-            partition = offset;
-            return new long[] {
-                descriptor.getInt(20) & 0xFFFFFFFFL, descriptor.getInt(24) & 0xFFFFFFFFL,
-            };
+            byte[] bytes = descriptor.array();
+            if (!hasMagic(bytes, 0) || !hasMagic(bytes, SECOND_MAGIC_OFFSET))
+                continue;
+            partition = start;
+            rootSector = u32(bytes, 0x14);
+            rootSize = u32(bytes, 0x18);
+            break;
         }
-        throw new ExtractException("This is not an Xbox disc image.");
-    }
+        if (partition < 0)
+            throw new ExtractException("This is not an Xbox disc image.");
 
-    /** a directory's table, read whole */
-    private ByteBuffer readDirectory(long sector, long size, String what) throws IOException {
-        if (size <= 0 || size > MAXIMUM_DIRECTORY_SIZE)
-            throw new ExtractException(what);
-        ByteBuffer table = ByteBuffer.allocate((int) size).order(ByteOrder.LITTLE_ENDIAN);
-        readAt(partition + sector * SECTOR_SIZE, table);
-        return table;
-    }
-
-    /**
-     * collects the entries of the subtree at offset (4-byte units), files or
-     * directories as asked
-     */
-    private static void walk(ByteBuffer table, long offset, int depth, boolean directories, List<Entry> out,
-        int[] visited) {
-        offset *= 4;
-        /* a malformed table must not loop or run off its end */
-        if (depth > 64 || ++visited[0] > 4096 || offset + ENTRY_HEADER_SIZE > table.limit())
-            return;
-        int at = (int) offset;
-        int left = table.getShort(at) & 0xFFFF;
-        int right = table.getShort(at + 2) & 0xFFFF;
-        /* 0xFFFF: padding, an empty directory */
-        if (left == 0xFFFF)
-            return;
-        int nameLength = table.get(at + 13) & 0xFF;
-        if (left != 0)
-            walk(table, left, depth + 1, directories, out, visited);
-        boolean isDirectory = (table.get(at + 12) & ATTRIBUTE_DIRECTORY) != 0;
-        if (at + ENTRY_HEADER_SIZE + nameLength <= table.limit() && nameLength > 0 && isDirectory == directories
-            && out.size() < MAXIMUM_FILES) {
-            byte[] bytes = new byte[nameLength];
-            for (int index = 0; index < nameLength; index++)
-                bytes[index] = table.get(at + ENTRY_HEADER_SIZE + index);
-            String name = new String(bytes, StandardCharsets.ISO_8859_1);
-            /* (as extract-xiso refuses them: no name may leave the folder, and
-            none but a plain file name is written) */
-            if (isPlainName(name))
-                out.add(new Entry(name, table.getInt(at + 4) & 0xFFFFFFFFL, table.getInt(at + 8) & 0xFFFFFFFFL));
-        }
-        if (right != 0)
-            walk(table, right, depth + 1, directories, out, visited);
-    }
-
-    private void extract(File destination, Progress progress) throws IOException {
-        long[] root = findVolume();
-
-        /* the root's maps folder */
-        ByteBuffer table = readDirectory(root[0], root[1], "The disc image's file system is damaged.");
-        List<Entry> directories = new ArrayList<>();
-        walk(table, 0, 0, true, directories, new int[1]);
+        // the root's maps folder
+        byte[] root = readTable(image, partition, rootSector, rootSize, "The disc image's file system is damaged.");
         Entry maps = null;
+        Entry xbe = null;
+        for (Entry entry : walkTable(root, false)) {
+            if (entry.name.equalsIgnoreCase("default.xbe"))
+                xbe = entry;
+        }
+        List<Entry> directories = walkTable(root, true);
         for (Entry entry : directories) {
-            if (entry.name.equalsIgnoreCase("maps"))
+            if (entry.name.equalsIgnoreCase("maps")) {
                 maps = entry;
+                break;
+            }
+        }
+        // (Mjolnir VR: a European disc in two languages, Spanish and Italian,
+        // has no maps folder but one for each, maps_es and maps_it: the
+        // device's language's is taken, else English's, else the first, and
+        // its language written to maps/language.txt, which the game asks the
+        // Xbox for while game.language is unset: port/linux/src/xbox_xapi.c)
+        String language = null;
+        if (maps == null) {
+            String wanted = Locale.getDefault().getLanguage();
+            Entry english = null, first = null;
+
+            for (Entry entry : walkTable(root, true)) {
+                String code = mapsLanguage(entry.name);
+
+                if (code == null)
+                    continue;
+                if (code.equals(wanted) && maps == null)
+                    maps = entry;
+                if (code.equals("en") && english == null)
+                    english = entry;
+                if (first == null)
+                    first = entry;
+            }
+            if (maps == null)
+                maps = english != null ? english : first;
+            if (maps != null)
+                language = mapsLanguage(maps.name);
         }
         if (maps == null)
             throw new ExtractException("The disc image has no maps folder: it is not a Halo disc.");
 
-        /* its files */
-        table = readDirectory(maps.sector, maps.size, "The disc image's maps folder is damaged.");
-        List<Entry> files = new ArrayList<>();
-        walk(table, 0, 0, false, files, new int[1]);
-        long total = 0;
-        boolean hasUi = false;
+        // its files
+        byte[] table = readTable(image, partition, maps.sector, maps.size, "The disc image's maps folder is damaged.");
+        List<Entry> files = walkTable(table, false);
+        Entry userInterface = null;
+        boolean hasLoading = false;
         for (Entry file : files) {
-            total += file.size;
-            hasUi |= file.name.equalsIgnoreCase("ui.map");
+            if (file.name.equalsIgnoreCase("ui.map"))
+                userInterface = file;
+            hasLoading |= file.name.equalsIgnoreCase(LOADING_PICTURE);
         }
-        if (!hasUi)
+        if (userInterface == null)
             throw new ExtractException("The disc image's maps folder has no ui.map: it is not a Halo disc.");
-
-        File partial = new File(destination, "maps.partial");
-        File finished = new File(destination, "maps");
-        if (!partial.isDirectory() && !partial.mkdirs())
-            throw new ExtractException("Could not create " + partial + ".");
-        ByteBuffer buffer = ByteBuffer.allocateDirect(COPY_BUFFER_SIZE);
-        long done = 0;
+        // (an image that ends before a file does is refused before anything
+        // is written; an empty file's sector need not be anywhere)
+        long total = 0;
         for (Entry file : files) {
-            File path = new File(partial, file.name);
-            long offset = partition + file.sector * SECTOR_SIZE;
-            long remaining = file.size;
+            if (file.size > 0 && partition + file.sector * SECTOR_SIZE + file.size > imageSize)
+                throw new ExtractException(readFailure(file));
+            total += file.size;
+        }
 
-            try (FileOutputStream out = new FileOutputStream(path)) {
-                FileChannel output = out.getChannel();
+        // the copy, to maps.partial
+        File partial = new File(destination, PARTIAL_DIRECTORY);
+        if (partial.isDirectory()) {
+            File[] leftovers = partial.listFiles();
+            if (leftovers != null) {
+                for (File leftover : leftovers)
+                    leftover.delete();
+            }
+        } else {
+            partial.delete();
+            partial.mkdirs();
+        }
+        if (!partial.isDirectory())
+            throw new ExtractException("Could not create " + partial.getPath() + ".");
+        ByteBuffer buffer = ByteBuffer.allocate(COPY_CHUNK);
+        long done = 0;
+        for (Entry file : files)
+            done = copyFile(image, partition, file, new File(partial, file.name), buffer, done, total, progress);
+        if (!hasLoading && writeLoadingPicture(image, imageSize, partition, xbe, new File(partial, LOADING_PICTURE)))
+            files.add(new Entry(LOADING_PICTURE, 0, 0));
 
-                while (remaining > 0) {
-                    buffer.clear();
-                    buffer.limit((int) Math.min(remaining, COPY_BUFFER_SIZE));
-                    readAt(offset, buffer);
-                    int count = buffer.remaining();
-                    while (buffer.hasRemaining())
-                        output.write(buffer);
-                    offset += count;
-                    remaining -= count;
-                    done += count;
-                    progress.report(file.name, done, total);
-                }
-            } catch (ExtractException e) {
-                throw new ExtractException("Could not read " + file.name + " from the disc image (is it complete?).");
+        // then into maps, ui.map (the app's sign that the data is there) last
+        File mapsFolder = new File(destination, "maps");
+        if (!mapsFolder.isDirectory() && !mapsFolder.mkdirs() && !mapsFolder.isDirectory())
+            throw new ExtractException("Could not create " + mapsFolder.getPath() + ".");
+        // (the language of a language's maps folder: before ui.map is there)
+        File languageFile = new File(mapsFolder, "language.txt");
+        languageFile.delete();
+        if (language != null) {
+            try (FileOutputStream out = new FileOutputStream(languageFile)) {
+                out.write((language + "\n").getBytes(StandardCharsets.US_ASCII));
             } catch (IOException e) {
-                throw new ExtractException("Could not write " + path + " (is the storage full?).");
+                throw new ExtractException("Could not write " + languageFile.getPath() + " (is the storage full?).");
             }
         }
-
-        /* (the maps folder may be there, empty: the app makes it for adb) */
-        if (!finished.isDirectory() && !finished.mkdirs())
-            throw new ExtractException("Could not create " + finished + ".");
-        for (Entry file : files) {
-            File from = new File(partial, file.name);
-            File to = new File(finished, file.name);
-
-            to.delete();
-            if (!from.renameTo(to))
-                throw new ExtractException("Could not move " + file.name + " into " + finished + ".");
+        List<Entry> order = new ArrayList<>(files);
+        order.remove(userInterface);
+        order.add(userInterface);
+        for (Entry file : order) {
+            File target = new File(mapsFolder, file.name);
+            target.delete();
+            if (!new File(partial, file.name).renameTo(target))
+                throw new ExtractException("Could not move " + file.name + " into " + mapsFolder.getPath() + ".");
         }
         partial.delete();
     }
+
+    /** a language's maps folder's language ("maps_it": "it"), else null */
+    static String mapsLanguage(String name) {
+        if (name.length() != 7 || !name.regionMatches(true, 0, "maps_", 0, 5))
+            return null;
+        String code = name.substring(5).toLowerCase(Locale.ROOT);
+        return Character.isLetter(code.charAt(0)) && Character.isLetter(code.charAt(1)) ? code : null;
+    }
+
+    /** No path, no . or .., and only printable ASCII that every file system takes as a plain name. */
+    static boolean isPlainName(String name) {
+        if (name == null || name.isEmpty() || name.equals(".") || name.equals(".."))
+            return false;
+        for (int index = 0; index < name.length(); index++) {
+            char character = name.charAt(index);
+
+            if (character < 0x20 || character > 0x7E || "/\\:*?\"<>|".indexOf(character) >= 0)
+                return false;
+        }
+        return true;
+    }
+
+    /* ---------- the image */
+
+    private static long u16(byte[] bytes, int offset) {
+        return (bytes[offset] & 0xFF) | (bytes[offset + 1] & 0xFF) << 8;
+    }
+
+    private static long u32(byte[] bytes, int offset) {
+        return u16(bytes, offset) | u16(bytes, offset + 2) << 16;
+    }
+
+    private static boolean hasMagic(byte[] bytes, int offset) {
+        for (int index = 0; index < MAGIC.length; index++) {
+            if (bytes[offset + index] != MAGIC[index])
+                return false;
+        }
+        return true;
+    }
+
+    /** Fills buffer from the image at position; false if the image ends first. */
+    private static boolean readFully(FileChannel image, ByteBuffer buffer, long position) throws IOException {
+        while (buffer.hasRemaining()) {
+            int count = image.read(buffer, position);
+
+            if (count <= 0)
+                return false;
+            position += count;
+        }
+        return true;
+    }
+
+    private static byte[] readTable(FileChannel image, long partition, long sector, long size, String damaged)
+            throws IOException {
+        if (size == 0 || size > MAXIMUM_TABLE_SIZE)
+            throw new ExtractException(damaged);
+        ByteBuffer table = ByteBuffer.allocate((int) size);
+        if (!readFully(image, table, partition + sector * SECTOR_SIZE))
+            throw new ExtractException("Could not read the disc image (is it complete?).");
+        return table.array();
+    }
+
+    /* ---------- directory tables */
+
+    private static final class Walk {
+        final byte[] table;
+        final boolean directories;
+        final BitSet visited = new BitSet();
+        final List<Entry> entries = new ArrayList<>();
+        int visits;
+        boolean stopped;
+
+        Walk(byte[] table, boolean directories) {
+            this.table = table;
+            this.directories = directories;
+        }
+    }
+
+    /** The folders (or the files) of a table with plain names, in the tree's order. */
+    private static List<Entry> walkTable(byte[] table, boolean directories) {
+        Walk walk = new Walk(table, directories);
+
+        walkEntry(walk, 0, 0);
+        return walk.entries;
+    }
+
+    /**
+     * The subtree whose root entry is at offset: its left subtree, the
+     * entry, its right subtree. A link to padding, past the table or back to
+     * an entry already visited ends that branch.
+     */
+    private static void walkEntry(Walk walk, int offset, int depth) {
+        byte[] table = walk.table;
+
+        if (walk.stopped || depth > MAXIMUM_DEPTH)
+            return;
+        if (offset >= table.length || table.length - offset < ENTRY_FIXED_SIZE)
+            return;
+        int left = (int) u16(table, offset);
+        int right = (int) u16(table, offset + 2);
+        if (left == PADDING_LINK || walk.visited.get(offset / 4))
+            return;
+        walk.visited.set(offset / 4);
+        if (walk.visits >= MAXIMUM_VISITS) {
+            walk.stopped = true;
+            return;
+        }
+        walk.visits++;
+
+        if (left != 0)
+            walkEntry(walk, left * 4, depth + 1);
+        int nameLength = table[offset + 13] & 0xFF;
+        if (nameLength != 0 && nameLength <= table.length - offset - ENTRY_FIXED_SIZE)
+            collect(walk, offset, nameLength);
+        if (right != 0)
+            walkEntry(walk, right * 4, depth + 1);
+    }
+
+    private static void collect(Walk walk, int offset, int nameLength) {
+        byte[] table = walk.table;
+        boolean directory = (table[offset + 12] & ATTRIBUTE_DIRECTORY) != 0;
+
+        if (directory != walk.directories || walk.entries.size() >= MAXIMUM_ENTRIES)
+            return;
+        String name = new String(table, offset + ENTRY_FIXED_SIZE, nameLength, StandardCharsets.ISO_8859_1);
+        if (!isPlainName(name))
+            return;
+        // (the destination's file system may ignore case)
+        for (Entry entry : walk.entries) {
+            if (entry.name.equalsIgnoreCase(name))
+                return;
+        }
+        walk.entries.add(new Entry(name, u32(table, offset + 4), u32(table, offset + 8)));
+    }
+
+    /* ---------- the loading screen's picture */
+
+    /**
+     * The loading screen's picture out of a default.xbe, as the TGA the game
+     * reads (uncompressed, 24 bits, rows from the bottom), or null. The
+     * executable holds it, 320 by 240, as runs of 4-bit greys (a byte each:
+     * the grey's high four bits in its low nibble, the run's length in its
+     * high one) after the width and height as u32s: found by those two
+     * numbers followed by runs that fill the picture exactly (a run of none,
+     * or one past the picture's end, is not it).
+     */
+    static byte[] loadingPicture(byte[] xbe) {
+        int pixels = LOADING_WIDTH * LOADING_HEIGHT;
+        byte[] greys = new byte[pixels];
+        boolean found = false;
+
+        for (int at = 0; at + 8 <= xbe.length && !found; at++) {
+            if (u32(xbe, at) != LOADING_WIDTH || u32(xbe, at + 4) != LOADING_HEIGHT)
+                continue;
+            int pixel = 0;
+            for (int next = at + 8; next < xbe.length && pixel < pixels; next++) {
+                int run = (xbe[next] & 0xFF) >> 4;
+
+                if (run == 0 || run > pixels - pixel)
+                    break;
+                Arrays.fill(greys, pixel, pixel + run, (byte) ((xbe[next] & 0x0F) << 4));
+                pixel += run;
+            }
+            found = pixel == pixels;
+        }
+        if (!found)
+            return null;
+        byte[] tga = new byte[TGA_HEADER_SIZE + pixels * 3];
+        tga[2] = 2;
+        tga[12] = (byte) (LOADING_WIDTH & 0xFF);
+        tga[13] = (byte) (LOADING_WIDTH >> 8);
+        tga[14] = (byte) (LOADING_HEIGHT & 0xFF);
+        tga[15] = (byte) (LOADING_HEIGHT >> 8);
+        tga[16] = 24;
+        for (int y = 0; y < LOADING_HEIGHT; y++) {
+            int row = (LOADING_HEIGHT - 1 - y) * LOADING_WIDTH;
+            for (int x = 0; x < LOADING_WIDTH; x++) {
+                int out = TGA_HEADER_SIZE + (y * LOADING_WIDTH + x) * 3;
+
+                tga[out] = tga[out + 1] = tga[out + 2] = greys[row + x];
+            }
+        }
+        return tga;
+    }
+
+    /**
+     * Writes default.xbe's picture to output, if it has one; whether it did.
+     * One that cannot be written whole is removed (the loading screen would
+     * read past one cut short).
+     */
+    private static boolean writeLoadingPicture(FileChannel image, long imageSize, long partition, Entry xbe,
+            File output) {
+        if (xbe == null || xbe.size <= 0 || xbe.size > MAXIMUM_XBE_SIZE
+                || partition + xbe.sector * SECTOR_SIZE + xbe.size > imageSize)
+            return false;
+        try {
+            ByteBuffer bytes = ByteBuffer.allocate((int) xbe.size);
+            if (!readFully(image, bytes, partition + xbe.sector * SECTOR_SIZE))
+                return false;
+            byte[] tga = loadingPicture(bytes.array());
+            if (tga == null)
+                return false;
+            try (FileOutputStream stream = new FileOutputStream(output)) {
+                stream.write(tga);
+            }
+            return true;
+        } catch (IOException | OutOfMemoryError exception) {
+            output.delete();
+            return false;
+        }
+    }
+
+    /* ---------- the copy */
+
+    private static String readFailure(Entry file) {
+        return "Could not read " + file.name + " from the disc image (is it complete?).";
+    }
+
+    /** Copies one file of the image to output; returns the bytes copied of all the files so far. */
+    private static long copyFile(FileChannel image, long partition, Entry file, File output, ByteBuffer buffer,
+            long done, long total, Progress progress) throws IOException {
+        String writeFailure = "Could not write " + output.getPath() + " (is the storage full?).";
+        long position = partition + file.sector * SECTOR_SIZE;
+        long remaining = file.size;
+        FileOutputStream stream = null;
+
+        try {
+            stream = new FileOutputStream(output);
+            FileChannel channel = stream.getChannel();
+            while (remaining > 0) {
+                int count = (int) Math.min(remaining, COPY_CHUNK);
+                boolean read;
+
+                buffer.clear();
+                buffer.limit(count);
+                try {
+                    read = readFully(image, buffer, position);
+                } catch (IOException exception) {
+                    read = false;
+                }
+                if (!read)
+                    throw new ExtractException(readFailure(file));
+                buffer.flip();
+                while (buffer.hasRemaining()) {
+                    if (channel.write(buffer) <= 0)
+                        throw new ExtractException(writeFailure);
+                }
+                position += count;
+                remaining -= count;
+                done += count;
+                if (progress != null)
+                    progress.report(file.name, done, total);
+            }
+            FileOutputStream closing = stream;
+            stream = null;
+            closing.close();
+        } catch (ExtractException exception) {
+            throw exception;
+        } catch (IOException exception) {
+            throw new ExtractException(writeFailure);
+        } finally {
+            if (stream != null) {
+                try {
+                    stream.close();
+                } catch (IOException ignored) {
+                    // (the copy failed already)
+                }
+            }
+        }
+        return done;
+    }
 }

port/android/app/src/main/res/values/strings.xml

@@ -1,4 +1,4 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
-    <string name="app_name">Ringfall: Mjolnir VR</string>
+    <string name="app_name">Mjolnir VR</string>
 </resources>

port/android/guest/runtime/guest_host.h

@@ -75,6 +75,10 @@ void host_sdl_scancode_name(int scancode, char *buffer, unsigned int size);
 int host_sdl_scancode_from_name(const char *name);
 int host_sdl_show_toast(const char *message, int duration, int gravity, int x, int y);
 int host_sdl_show_simple_message_box(unsigned int flags, const char *title, const char *message);
+/* SDL_ShowMessageBox of up to three buttons (SDL_MessageBoxData has not the
+guest's layout): the index of the one chosen, else -1 */
+int host_sdl_show_message_box(unsigned int flags, const char *title, const char *message, int default_index,
+	const char *button0, const char *button1, const char *button2);
 int host_sdl_get_gamepads(unsigned int *ids, int capacity);
 unsigned int host_sdl_open_gamepad(unsigned int id);
 unsigned int host_sdl_gamepad_from_id(unsigned int id);
@@ -116,6 +120,23 @@ void host_gl_wait_frame(unsigned int slot);
 reads a snapshot once its frame is finished */
 void host_gl_counters_snapshot(unsigned int buffer, unsigned int size, unsigned int slot);
 int host_gl_counters_read(unsigned int slot, void *out, unsigned int size);
+/* the shader programs' worker (port/android/host/host_gl_worker.c), for
+port/linux/src/xgpu_program_cache.c: started on the game's thread with its
+context current (1: running); a program asked for (its binary tried first,
+else its sources compiled; urgent: a draw waits for it), a job's number or
+0; hurried along; polled (1 done: *program, its kept binary's size, the
+time it took; 0 not yet; -1 failed); its kept binary copied out; the job
+forgotten; how many jobs are not done; and a warm-up draw with a program on
+the calling thread's context */
+int host_gl_worker_start(int warm_up);
+unsigned int host_gl_program_request(int urgent, const char *vertex_source, const char *fragment_source,
+	unsigned int binary_format, const void *binary, unsigned int binary_size, int keep_binary);
+void host_gl_program_hurry(unsigned int id);
+int host_gl_program_poll(unsigned int id, unsigned int *program, unsigned int *binary_size, unsigned int *microseconds);
+unsigned int host_gl_program_binary(unsigned int id, void *buffer, unsigned int size, unsigned int *format);
+void host_gl_program_release(unsigned int id);
+unsigned int host_gl_worker_waiting(void);
+void host_gl_program_warm_up(unsigned int program, int multiview);
 
 /* ---------- OpenXR (port/android/host/host_xr.c; the structures are in
 halo_xr_abi.h) */
@@ -148,6 +169,9 @@ it lets none be chosen), and the one it runs at (0: unknown); and asking
 for the highest offered at or below wanted (0: the highest) */
 int host_xr_refresh_rates(float *rates, int maximum, float *current);
 void host_xr_set_refresh_rate(float wanted);
+/* the app's GPU time of a recent frame (ms; 0: the runtime does not tell
+it), for vr.graphics "auto" */
+float host_xr_gpu_time(void);
 
 /* ---------- Android */
 

port/android/guest/runtime/guest_sdl.c

@@ -95,6 +95,31 @@ bool SDL_ShowSimpleMessageBox(SDL_MessageBoxFlags flags, const char *title, cons
 	return host_sdl_show_simple_message_box((unsigned int)flags, title, message) != 0;
 }
 
+/* (up to three buttons, their ids those of the guest's) */
+bool SDL_ShowMessageBox(const SDL_MessageBoxData *data, int *buttonid)
+{
+	const char *labels[3] = { NULL, NULL, NULL };
+	int default_index = -1;
+	int index;
+	int chosen;
+
+	if (!data || data->numbuttons < 1 || data->numbuttons > 3)
+		return false;
+	for (index = 0; index < data->numbuttons; index++)
+	{
+		labels[index] = data->buttons[index].text;
+		if (data->buttons[index].flags & SDL_MESSAGEBOX_BUTTON_RETURNKEY_DEFAULT)
+			default_index = index;
+	}
+	chosen = host_sdl_show_message_box((unsigned int)data->flags, data->title, data->message, default_index,
+		labels[0], labels[1], labels[2]);
+	if (chosen < 0 || chosen >= data->numbuttons)
+		return false;
+	if (buttonid)
+		*buttonid = data->buttons[chosen].buttonID;
+	return true;
+}
+
 void SDL_Delay(Uint32 milliseconds)
 {
 	struct timespec duration;

port/android/host/host.h

@@ -12,6 +12,7 @@ port/android/include/halo_android_abi.h for the guest contract.
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdint.h>
+#include <stdio.h>
 
 #include "halo_android_abi.h"
 
@@ -35,8 +36,17 @@ Xbox window and the image's range at start-up, and hands out pages for
 everything else (the guest's malloc arenas, thread stacks, anonymous
 mappings) from pools of address space it reserves below 4 GB on demand. */
 
-/* reserves the fixed ranges; returns 0 on success */
+/* reserves the fixed ranges (the Xbox window and the image's) as early as
+the process allows: from JNI_OnLoad, before the Java side of the game's
+process allocates much (host_main.c); a failure is reported again by
+host_memory_initialize */
+void host_memory_reserve_early(void);
+/* takes the fixed ranges for the image; returns 0 on success */
 int host_memory_initialize(uint32_t image_base, uint32_t image_size);
+/* 1 if the fixed ranges could not be reserved (something else holds them) */
+int host_memory_fixed_unavailable(void);
+/* lists the mappings below 4 GB in logcat and, if file is not NULL, in it */
+void host_memory_report_low_mappings(FILE *file);
 /* Makes the write tracking compare page contents instead of catching page
 faults (host_watch_hash.h), for when the app cannot receive its own
 SIGSEGV (ARM translation). Call before the guest starts. */
@@ -97,6 +107,16 @@ void *host_resolve_import(const char *name);
 
 void *host_gl_resolve(const char *name);
 int host_gl_quiet_trace_markers(void);
+/* the shader programs' worker (host_gl_worker.c; the guest's imports) */
+int host_gl_worker_start(int warm_up);
+uint32_t host_gl_program_request(int urgent, const char *vertex_source, const char *fragment_source,
+	uint32_t binary_format, const void *binary, uint32_t binary_size, int keep_binary);
+void host_gl_program_hurry(uint32_t id);
+int host_gl_program_poll(uint32_t id, uint32_t *program, uint32_t *binary_size, uint32_t *microseconds);
+uint32_t host_gl_program_binary(uint32_t id, void *buffer, uint32_t size, uint32_t *format);
+void host_gl_program_release(uint32_t id);
+uint32_t host_gl_worker_waiting(void);
+void host_gl_program_warm_up(uint32_t program, int multiview);
 
 /* ---------- VR (host_xr.c) */
 

port/android/host/host_gl_worker.c

@@ -0,0 +1,671 @@
+/*
+HOST_GL_WORKER.C
+
+The shader programs' worker (port/linux/src/xgpu_program_cache.c): a thread
+with a GL context of its own, sharing the game's objects, that makes the
+programs the game asks for while the game goes on drawing. The drivers
+compile a program the first time it is drawn with, 10 to 70 ms each on the
+Quest's, and the frame waited for it: in VR a frame shown late, the picture
+doubled as the head turns.
+
+- host_gl_worker_start, on the game's thread with its context current:
+  makes a context that shares the game's (surfaceless, or on a 1x1
+  pbuffer) and the thread that keeps it current.
+- host_gl_program_request: a program of these sources, from their binary
+  where one is given and the driver takes it, else compiled and linked
+  (its binary kept for the cache's file). The sources and the binary are
+  copied: the caller's may go at once. Urgent requests (a draw waits for
+  them) go before the others (a map's programs made ready as it loads).
+- On the worker each program is linked, its samplers set to their units
+  (as d3d8_gl.c sets them), drawn with once into a small target of its own
+  (a degenerate triangle: the driver makes the variants it makes at a
+  first draw now, not in the game's frame; "warm up"), and a fence put
+  after it all.
+- host_gl_program_poll, on the game's thread: done once the fence has
+  passed (GL's rule for an object made in one context and used in another:
+  the work finished before the other binds it); then the program is the
+  game's (a program name is the same in both contexts).
+
+host_gl_program_warm_up draws once with a program on the calling thread's
+context instead (debug.shader_warm_up "load": on the game's, as a map
+loads), for comparing the two.
+*/
+
+#include "host.h"
+
+#include <EGL/egl.h>
+#include <EGL/eglext.h>
+#include <GLES3/gl32.h>
+#include <GLES2/gl2ext.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+
+#define JOB_BUCKETS 1024
+/* the warm-up's target, each way */
+#define WARM_UP_SIZE 16
+
+enum
+{
+	JOB_QUEUED,
+	JOB_WORKING,
+	JOB_DONE,
+	JOB_FAILED,
+};
+
+struct job
+{
+	struct job *next_in_bucket;
+	struct job *next_in_queue;
+	uint32_t id;
+	int urgent;
+	char *sources[2];
+	void *binary;
+	uint32_t binary_size;
+	uint32_t binary_format;
+	int keep_binary;
+	int state;
+	/* the results */
+	GLuint program;
+	GLsync sync;
+	int from_binary;
+	void *kept_binary;
+	uint32_t kept_size;
+	uint32_t kept_format;
+	uint32_t microseconds;
+};
+
+/* a context's warm-up target: the eyes' kinds, one layer and two
+(multiview), RGBA8 with a depth and stencil buffer */
+struct warm_up_targets
+{
+	int made;
+	/* each kind's framebuffer complete */
+	int complete[2];
+	GLuint framebuffers[2];
+	GLuint textures[4];
+	GLuint vertex_array;
+	GLuint counters;
+};
+
+static struct
+{
+	int started;
+	int running;
+	int warm_up;
+	EGLDisplay display;
+	EGLContext context;
+	EGLSurface surface;
+	pthread_t thread;
+	pthread_mutex_t lock;
+	pthread_cond_t wake;
+	pthread_cond_t ready;
+	struct job *buckets[JOB_BUCKETS];
+	struct job *urgent_first, *urgent_last;
+	struct job *later_first, *later_last;
+	uint32_t next_id;
+	uint32_t waiting;
+	int failures_logged;
+	PFNGLFRAMEBUFFERTEXTUREMULTIVIEWOVRPROC framebuffer_texture_multiview;
+	struct warm_up_targets targets[2];
+} worker;
+
+static uint64_t now_us(void)
+{
+	struct timespec now;
+
+	clock_gettime(CLOCK_MONOTONIC, &now);
+	return (uint64_t)now.tv_sec * 1000000u + (uint64_t)now.tv_nsec / 1000u;
+}
+
+/* ---------- the warm-up draw */
+
+static int targets_make(struct warm_up_targets *targets)
+{
+	GLint major = 0, minor = 0;
+	int kind;
+
+	if (targets->made)
+		return targets->made > 0;
+	targets->made = -1;
+	glGenTextures(4, targets->textures);
+	glGenFramebuffers(2, targets->framebuffers);
+	for (kind = 0; kind < 2; kind++)
+	{
+		GLenum target = kind ? GL_TEXTURE_2D_ARRAY : GL_TEXTURE_2D;
+
+		glBindTexture(target, targets->textures[kind * 2]);
+		if (kind)
+			glTexStorage3D(target, 1, GL_RGBA8, WARM_UP_SIZE, WARM_UP_SIZE, 2);
+		else
+			glTexStorage2D(target, 1, GL_RGBA8, WARM_UP_SIZE, WARM_UP_SIZE);
+		glBindTexture(target, targets->textures[kind * 2 + 1]);
+		if (kind)
+			glTexStorage3D(target, 1, GL_DEPTH24_STENCIL8, WARM_UP_SIZE, WARM_UP_SIZE, 2);
+		else
+			glTexStorage2D(target, 1, GL_DEPTH24_STENCIL8, WARM_UP_SIZE, WARM_UP_SIZE);
+		glBindTexture(target, 0);
+		glBindFramebuffer(GL_FRAMEBUFFER, targets->framebuffers[kind]);
+		if (kind)
+		{
+			if (!worker.framebuffer_texture_multiview)
+				continue;
+			worker.framebuffer_texture_multiview(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, targets->textures[2], 0, 0, 2);
+			worker.framebuffer_texture_multiview(GL_FRAMEBUFFER, GL_DEPTH_STENCIL_ATTACHMENT, targets->textures[3], 0,
+				0, 2);
+		}
+		else
+		{
+			glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, targets->textures[0], 0);
+			glFramebufferTexture2D(GL_FRAMEBUFFER, GL_DEPTH_STENCIL_ATTACHMENT, GL_TEXTURE_2D, targets->textures[1], 0);
+		}
+		targets->complete[kind] = glCheckFramebufferStatus(GL_FRAMEBUFFER) == GL_FRAMEBUFFER_COMPLETE;
+		if (!targets->complete[kind])
+			host_logf(HOST_LOG_WARN, "gl worker: the %s warm-up target is incomplete; no warm-up there",
+				kind ? "multiview" : "plain");
+	}
+	glBindFramebuffer(GL_FRAMEBUFFER, 0);
+	glGenVertexArrays(1, &targets->vertex_array);
+	/* (the visibility tests' programs count samples into binding 0) */
+	glGetIntegerv(GL_MAJOR_VERSION, &major);
+	glGetIntegerv(GL_MINOR_VERSION, &minor);
+	if (major > 3 || (major == 3 && minor >= 1))
+	{
+		glGenBuffers(1, &targets->counters);
+		glBindBuffer(GL_ATOMIC_COUNTER_BUFFER, targets->counters);
+		glBufferData(GL_ATOMIC_COUNTER_BUFFER, 64, NULL, GL_DYNAMIC_DRAW);
+		glBindBuffer(GL_ATOMIC_COUNTER_BUFFER, 0);
+	}
+	targets->made = 1;
+	return 1;
+}
+
+/* one degenerate triangle with the program into the target of its kind,
+depth tested and blended as most of the game's draws are; the GL state it
+changes is left changed (the worker's context has no other use, and the
+game's sets it again: d3d8_host_state_changed) */
+static void warm_up_draw(struct warm_up_targets *targets, GLuint program, int multiview)
+{
+	if (!targets_make(targets) || !targets->complete[multiview ? 1 : 0])
+		return;
+	glBindFramebuffer(GL_FRAMEBUFFER, targets->framebuffers[multiview ? 1 : 0]);
+	glViewport(0, 0, WARM_UP_SIZE, WARM_UP_SIZE);
+	glDisable(GL_SCISSOR_TEST);
+	glDisable(GL_STENCIL_TEST);
+	glDisable(GL_CULL_FACE);
+	glEnable(GL_DEPTH_TEST);
+	glDepthFunc(GL_LEQUAL);
+	glDepthMask(GL_TRUE);
+	glColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+	glEnable(GL_BLEND);
+	glBlendFunc(GL_SRC_ALPHA, GL_ONE_MINUS_SRC_ALPHA);
+	glBindVertexArray(targets->vertex_array);
+	if (targets->counters)
+		glBindBufferBase(GL_ATOMIC_COUNTER_BUFFER, 0, targets->counters);
+	glUseProgram(program);
+	glDrawArrays(GL_TRIANGLES, 0, 3);
+	glUseProgram(0);
+	glBindVertexArray(0);
+	glBindFramebuffer(GL_FRAMEBUFFER, 0);
+}
+
+void host_gl_program_warm_up(uint32_t program, int multiview)
+{
+	if (!worker.running || !program)
+		return;
+	warm_up_draw(&worker.targets[0], program, multiview);
+}
+
+/* ---------- the worker's jobs */
+
+static struct job *job_find(uint32_t id)
+{
+	struct job *job;
+
+	for (job = worker.buckets[id % JOB_BUCKETS]; job; job = job->next_in_bucket)
+	{
+		if (job->id == id)
+			return job;
+	}
+	return NULL;
+}
+
+static void queue_append(struct job *job)
+{
+	struct job **first = job->urgent ? &worker.urgent_first : &worker.later_first;
+	struct job **last = job->urgent ? &worker.urgent_last : &worker.later_last;
+
+	job->next_in_queue = NULL;
+	if (*last)
+		(*last)->next_in_queue = job;
+	else
+		*first = job;
+	*last = job;
+}
+
+static struct job *queue_take(void)
+{
+	struct job *job = worker.urgent_first;
+
+	if (job)
+	{
+		worker.urgent_first = job->next_in_queue;
+		if (!worker.urgent_first)
+			worker.urgent_last = NULL;
+		return job;
+	}
+	job = worker.later_first;
+	if (job)
+	{
+		worker.later_first = job->next_in_queue;
+		if (!worker.later_first)
+			worker.later_last = NULL;
+	}
+	return job;
+}
+
+static GLuint shader_compile(GLenum type, const char *source)
+{
+	GLuint shader = glCreateShader(type);
+	GLint status = 0;
+
+	glShaderSource(shader, 1, &source, NULL);
+	glCompileShader(shader);
+	glGetShaderiv(shader, GL_COMPILE_STATUS, &status);
+	if (!status)
+	{
+		char log[1024];
+
+		log[0] = 0;
+		glGetShaderInfoLog(shader, sizeof(log), NULL, log);
+		if (worker.failures_logged++ < 4)
+			host_logf(HOST_LOG_WARN, "gl worker: a %s shader does not compile: %s",
+				type == GL_VERTEX_SHADER ? "vertex" : "pixel", log);
+		glDeleteShader(shader);
+		return 0;
+	}
+	return shader;
+}
+
+/* the job's program (outside the lock: only the worker touches a job
+being worked on) */
+static void job_work(struct job *job)
+{
+	uint64_t start = now_us();
+	GLuint program = 0;
+	GLint status = 0;
+
+	if (job->binary && job->binary_size)
+	{
+		program = glCreateProgram();
+		glProgramBinary(program, (GLenum)job->binary_format, job->binary, (GLsizei)job->binary_size);
+		glGetProgramiv(program, GL_LINK_STATUS, &status);
+		if (status)
+			job->from_binary = 1;
+		else
+		{
+			glDeleteProgram(program);
+			program = 0;
+			while (glGetError() != GL_NO_ERROR)
+			{
+			}
+		}
+	}
+	if (!program && job->sources[0] && job->sources[1])
+	{
+		GLuint vertex = shader_compile(GL_VERTEX_SHADER, job->sources[0]);
+		GLuint fragment = vertex ? shader_compile(GL_FRAGMENT_SHADER, job->sources[1]) : 0;
+
+		if (vertex && fragment)
+		{
+			program = glCreateProgram();
+			glProgramParameteri(program, GL_PROGRAM_BINARY_RETRIEVABLE_HINT, GL_TRUE);
+			glAttachShader(program, vertex);
+			glAttachShader(program, fragment);
+			glLinkProgram(program);
+			glGetProgramiv(program, GL_LINK_STATUS, &status);
+			if (!status)
+			{
+				char log[1024];
+
+				log[0] = 0;
+				glGetProgramInfoLog(program, sizeof(log), NULL, log);
+				if (worker.failures_logged++ < 4)
+					host_logf(HOST_LOG_WARN, "gl worker: a program does not link: %s", log);
+				glDeleteProgram(program);
+				program = 0;
+			}
+		}
+		/* (attached, they go with the program) */
+		if (vertex)
+			glDeleteShader(vertex);
+		if (fragment)
+			glDeleteShader(fragment);
+		if (program && job->keep_binary)
+		{
+			GLint length = 0;
+			GLsizei written = 0;
+			GLenum format = 0;
+
+			glGetProgramiv(program, GL_PROGRAM_BINARY_LENGTH, &length);
+			if (length > 0 && (job->kept_binary = malloc((size_t)length)) != NULL)
+			{
+				glGetProgramBinary(program, length, &written, &format, job->kept_binary);
+				if (written > 0 && written <= length)
+				{
+					job->kept_size = (uint32_t)written;
+					job->kept_format = (uint32_t)format;
+				}
+				else
+				{
+					free(job->kept_binary);
+					job->kept_binary = NULL;
+				}
+			}
+		}
+	}
+	if (program)
+	{
+		int unit;
+
+		/* the samplers' units, as d3d8_gl.c's program_get sets them (a
+		first draw with two kinds of sampler on one unit draws nothing) */
+		glUseProgram(program);
+		for (unit = 0; unit < 4; unit++)
+		{
+			char name[8];
+
+			snprintf(name, sizeof(name), "tex%d", unit);
+			glUniform1i(glGetUniformLocation(program, name), unit);
+		}
+		glUseProgram(0);
+		if (worker.warm_up)
+			warm_up_draw(&worker.targets[1], program,
+				job->sources[0] && strstr(job->sources[0], "GL_OVR_multiview") != NULL);
+		job->sync = glFenceSync(GL_SYNC_GPU_COMMANDS_COMPLETE, 0);
+	}
+	glFlush();
+	job->program = program;
+	job->microseconds = (uint32_t)(now_us() - start);
+}
+
+static void *worker_main(void *unused)
+{
+	(void)unused;
+	if (!eglMakeCurrent(worker.display, worker.surface, worker.surface, worker.context))
+	{
+		host_logf(HOST_LOG_ERROR, "gl worker: its context cannot be made current (0x%x)", eglGetError());
+		pthread_mutex_lock(&worker.lock);
+		worker.started = -1;
+		pthread_cond_broadcast(&worker.ready);
+		pthread_mutex_unlock(&worker.lock);
+		return NULL;
+	}
+	pthread_mutex_lock(&worker.lock);
+	worker.started = 1;
+	pthread_cond_broadcast(&worker.ready);
+	for (;;)
+	{
+		struct job *job;
+
+		while ((job = queue_take()) == NULL)
+			pthread_cond_wait(&worker.wake, &worker.lock);
+		job->state = JOB_WORKING;
+		pthread_mutex_unlock(&worker.lock);
+		job_work(job);
+		pthread_mutex_lock(&worker.lock);
+		free(job->binary);
+		job->binary = NULL;
+		free(job->sources[0]);
+		free(job->sources[1]);
+		job->sources[0] = job->sources[1] = NULL;
+		job->state = job->program ? JOB_DONE : JOB_FAILED;
+		worker.waiting--;
+	}
+	return NULL;
+}
+
+/* ---------- the game's */
+
+int host_gl_worker_start(int warm_up)
+{
+	EGLDisplay display = eglGetCurrentDisplay();
+	EGLContext shared = eglGetCurrentContext();
+	EGLint config_id = 0, count = 0, version = 3;
+	EGLint config_attributes[] = { EGL_CONFIG_ID, 0, EGL_NONE };
+	EGLint context_attributes[] = { EGL_CONTEXT_CLIENT_VERSION, 3, EGL_NONE };
+	EGLConfig config;
+	const char *extensions;
+	int started;
+
+	if (worker.running)
+		return 1;
+	if (worker.started)
+		return 0;
+	worker.warm_up = warm_up;
+	if (display == EGL_NO_DISPLAY || shared == EGL_NO_CONTEXT)
+	{
+		host_logf(HOST_LOG_WARN, "gl worker: no current context to share");
+		worker.started = -1;
+		return 0;
+	}
+	eglQueryContext(display, shared, EGL_CONFIG_ID, &config_id);
+	eglQueryContext(display, shared, EGL_CONTEXT_CLIENT_VERSION, &version);
+	config_attributes[1] = config_id;
+	if (!eglChooseConfig(display, config_attributes, &config, 1, &count) || count != 1)
+	{
+		host_logf(HOST_LOG_WARN, "gl worker: the game's context's configuration is not found");
+		worker.started = -1;
+		return 0;
+	}
+	context_attributes[1] = version;
+	extensions = eglQueryString(display, EGL_EXTENSIONS);
+	worker.surface = EGL_NO_SURFACE;
+	if (!extensions || !strstr(extensions, "EGL_KHR_surfaceless_context"))
+	{
+		/* (a 1x1 pbuffer to be current on, of a configuration that has one) */
+		EGLint pbuffer_config[] = { EGL_RENDERABLE_TYPE, EGL_OPENGL_ES3_BIT_KHR, EGL_SURFACE_TYPE, EGL_PBUFFER_BIT,
+			EGL_NONE };
+		EGLint pbuffer_size[] = { EGL_WIDTH, 1, EGL_HEIGHT, 1, EGL_NONE };
+
+		if (!eglChooseConfig(display, pbuffer_config, &config, 1, &count) || count != 1 ||
+			(worker.surface = eglCreatePbufferSurface(display, config, pbuffer_size)) == EGL_NO_SURFACE)
+		{
+			host_logf(HOST_LOG_WARN, "gl worker: neither surfaceless contexts nor a pbuffer");
+			worker.started = -1;
+			return 0;
+		}
+	}
+	worker.context = eglCreateContext(display, config, shared, context_attributes);
+	if (worker.context == EGL_NO_CONTEXT)
+	{
+		host_logf(HOST_LOG_WARN, "gl worker: no context sharing the game's (0x%x)", eglGetError());
+		worker.started = -1;
+		return 0;
+	}
+	worker.display = display;
+	worker.next_id = 1;
+	worker.framebuffer_texture_multiview = (PFNGLFRAMEBUFFERTEXTUREMULTIVIEWOVRPROC)eglGetProcAddress(
+		"glFramebufferTextureMultiviewOVR");
+	pthread_mutex_init(&worker.lock, NULL);
+	pthread_cond_init(&worker.wake, NULL);
+	pthread_cond_init(&worker.ready, NULL);
+	if (pthread_create(&worker.thread, NULL, worker_main, NULL) != 0)
+	{
+		eglDestroyContext(display, worker.context);
+		worker.started = -1;
+		return 0;
+	}
+	pthread_mutex_lock(&worker.lock);
+	while (!worker.started)
+		pthread_cond_wait(&worker.ready, &worker.lock);
+	started = worker.started > 0;
+	pthread_mutex_unlock(&worker.lock);
+	worker.running = started;
+	/* (Mesa's trace markers, for the new context's too: host_gl.c) */
+	if (started)
+		host_gl_quiet_trace_markers();
+	host_logf(HOST_LOG_INFO, "gl worker: %s (ES %d, %s%s)", started ? "running" : "failed", (int)version,
+		worker.surface == EGL_NO_SURFACE ? "surfaceless" : "on a pbuffer", warm_up ? ", programs warmed up" : "");
+	return started;
+}
+
+uint32_t host_gl_program_request(int urgent, const char *vertex_source, const char *fragment_source,
+	uint32_t binary_format, const void *binary, uint32_t binary_size, int keep_binary)
+{
+	struct job *job;
+	uint32_t id;
+
+	if (!worker.running)
+		return 0;
+	job = calloc(1, sizeof(*job));
+	if (!job)
+		return 0;
+	job->urgent = urgent != 0;
+	job->keep_binary = keep_binary != 0;
+	job->sources[0] = vertex_source ? strdup(vertex_source) : NULL;
+	job->sources[1] = fragment_source ? strdup(fragment_source) : NULL;
+	if (binary && binary_size && (job->binary = malloc(binary_size)) != NULL)
+	{
+		memcpy(job->binary, binary, binary_size);
+		job->binary_size = binary_size;
+		job->binary_format = binary_format;
+	}
+	pthread_mutex_lock(&worker.lock);
+	id = job->id = worker.next_id++;
+	if (!worker.next_id)
+		worker.next_id = 1;
+	job->state = JOB_QUEUED;
+	job->next_in_bucket = worker.buckets[id % JOB_BUCKETS];
+	worker.buckets[id % JOB_BUCKETS] = job;
+	queue_append(job);
+	worker.waiting++;
+	pthread_cond_signal(&worker.wake);
+	pthread_mutex_unlock(&worker.lock);
+	return id;
+}
+
+/* a queued job a draw now waits for: before the others */
+void host_gl_program_hurry(uint32_t id)
+{
+	struct job *job, **link;
+
+	if (!worker.running)
+		return;
+	pthread_mutex_lock(&worker.lock);
+	job = job_find(id);
+	if (job && job->state == JOB_QUEUED && !job->urgent)
+	{
+		for (link = &worker.later_first; *link; link = &(*link)->next_in_queue)
+		{
+			if (*link == job)
+			{
+				struct job *previous = NULL, *walk;
+
+				*link = job->next_in_queue;
+				/* (the last of the later queue found again) */
+				for (walk = worker.later_first; walk; walk = walk->next_in_queue)
+					previous = walk;
+				worker.later_last = previous;
+				job->urgent = 1;
+				queue_append(job);
+				break;
+			}
+		}
+	}
+	pthread_mutex_unlock(&worker.lock);
+}
+
+int host_gl_program_poll(uint32_t id, uint32_t *program, uint32_t *binary_size, uint32_t *microseconds)
+{
+	struct job *job;
+	int result = 0;
+
+	if (!worker.running)
+		return -1;
+	pthread_mutex_lock(&worker.lock);
+	job = job_find(id);
+	if (!job || job->state == JOB_FAILED)
+		result = -1;
+	else if (job->state == JOB_DONE)
+	{
+		/* (the fence passed: everything the worker did with the program is
+		done, and this context may use it) */
+		if (job->sync)
+		{
+			GLenum waited = glClientWaitSync(job->sync, 0, 0);
+
+			if (waited == GL_ALREADY_SIGNALED || waited == GL_CONDITION_SATISFIED || waited == GL_WAIT_FAILED)
+			{
+				glDeleteSync(job->sync);
+				job->sync = NULL;
+			}
+		}
+		if (!job->sync)
+		{
+			*program = job->program;
+			*binary_size = job->kept_size;
+			*microseconds = job->microseconds;
+			result = 1;
+		}
+	}
+	pthread_mutex_unlock(&worker.lock);
+	return result;
+}
+
+uint32_t host_gl_program_binary(uint32_t id, void *buffer, uint32_t size, uint32_t *format)
+{
+	struct job *job;
+	uint32_t copied = 0;
+
+	if (!worker.running)
+		return 0;
+	pthread_mutex_lock(&worker.lock);
+	job = job_find(id);
+	if (job && job->state == JOB_DONE && job->kept_binary && size >= job->kept_size)
+	{
+		memcpy(buffer, job->kept_binary, job->kept_size);
+		*format = job->kept_format;
+		copied = job->kept_size;
+	}
+	pthread_mutex_unlock(&worker.lock);
+	return copied;
+}
+
+/* forgets a job (its program stays: the game's); a job still queued or
+being worked on is let go when it is done */
+void host_gl_program_release(uint32_t id)
+{
+	struct job *job, **link;
+
+	if (!worker.running)
+		return;
+	pthread_mutex_lock(&worker.lock);
+	for (link = &worker.buckets[id % JOB_BUCKETS]; (job = *link) != NULL; link = &job->next_in_bucket)
+	{
+		if (job->id != id)
+			continue;
+		if (job->state == JOB_QUEUED || job->state == JOB_WORKING)
+			break;
+		*link = job->next_in_bucket;
+		if (job->sync)
+			glDeleteSync(job->sync);
+		free(job->kept_binary);
+		free(job);
+		break;
+	}
+	pthread_mutex_unlock(&worker.lock);
+}
+
+uint32_t host_gl_worker_waiting(void)
+{
+	uint32_t waiting;
+
+	if (!worker.running)
+		return 0;
+	pthread_mutex_lock(&worker.lock);
+	waiting = worker.waiting;
+	pthread_mutex_unlock(&worker.lock);
+	return waiting;
+}

port/android/host/host_main.c

@@ -65,7 +65,7 @@ void host_fatal(const char *format, ...)
 	vsnprintf(message, sizeof(message), format, arguments);
 	va_end(arguments);
 	__android_log_write(ANDROID_LOG_FATAL, "halo", message);
-	SDL_ShowSimpleMessageBox(SDL_MESSAGEBOX_ERROR, "Ringfall: Mjolnir VR", message, NULL);
+	SDL_ShowSimpleMessageBox(SDL_MESSAGEBOX_ERROR, "Mjolnir VR", message, NULL);
 	_exit(1);
 }
 
@@ -403,7 +403,21 @@ static void *game_main(void *unused)
 	if (!image)
 		host_fatal("cannot read the game image from the APK: %s", SDL_GetError());
 	if (host_load_image(image, image_size) != 0)
-		host_fatal("cannot load the game image; see logcat (tag \"halo\") for details");
+	{
+		FILE *report;
+
+		if (!host_memory_fixed_unavailable())
+			host_fatal("cannot load the game image; see logcat (tag \"halo\") for details");
+
+		snprintf(path, sizeof(path), "%s/memory_map.txt", data_root);
+		report = fopen(path, "w");
+		host_memory_report_low_mappings(report);
+		if (report)
+			fclose(report);
+		host_fatal("The game cannot start: the memory it needs at 0x80000000 is taken by Android's "
+			"Java runtime on this device.\n\nRestarting the device may help. Please report it with "
+			"memory_map.txt from\n%s\n(or adb logcat -s halo).", data_root);
+	}
 	SDL_free(image);
 
 	/* after the image, whose loading reserves the guest's fixed address
@@ -430,6 +444,9 @@ static void *game_main(void *unused)
 		if (deferred >= 0.0)
 			setenv("HALO_XR_DEFERRED", deferred != 0.0 ? "1" : "0", 1);
 	}
+	/* (vr.log_performance: the compositor's counters too, host_xr.c) */
+	if (config_boolean_or(path, "vr.log_performance", 0))
+		setenv("HALO_XR_LOG_PERFORMANCE", "1", 1);
 	{
 		int eye_width, eye_height;
 
@@ -507,11 +524,23 @@ static void *game_main(void *unused)
 	host_run_guest_main(boot);
 }
 
+/* Called when HaloApplication loads this library at the start of the
+game's own process (":game"), before its Java side has allocated anything
+large: ART's large object space, which on some devices covers the Xbox
+window, is then idle there and can be reclaimed (host_memory.c). */
+JNIEXPORT jint JNICALL JNI_OnLoad(JavaVM *vm, void *reserved)
+{
+	(void)vm;
+	(void)reserved;
+	host_memory_reserve_early();
+	return JNI_VERSION_1_6;
+}
+
 int main(int argc, char *argv[])
 {
 	(void)argc;
 	(void)argv;
-	host_logf(HOST_LOG_INFO, "Ringfall: Mjolnir VR starting");
+	host_logf(HOST_LOG_INFO, "Mjolnir VR starting");
 	host_install_signal_handlers();
 	if (host_native_thread_create(game_main, NULL, MAIN_STACK_SIZE) != 0)
 		host_fatal("cannot start the game thread");

port/android/host/host_memory.c

@@ -26,12 +26,16 @@ instead (host_watch_hash.c).
 #include "host_watch_hash.h"
 
 #include <errno.h>
+#include <fcntl.h>
 #include <pthread.h>
 #include <signal.h>
+#include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
+#include <sys/prctl.h>
+#include <sys/system_properties.h>
 #include <ucontext.h>
 #include <unistd.h>
 
@@ -104,58 +108,264 @@ static uint64_t find_gap(uint64_t size, uint64_t minimum)
 	return result;
 }
 
-/* ART reserves its spaces (notably the free-list large object space) at
-addresses chosen at zygote start; on some devices (for example the Retroid
-Pocket Flip2, kernel 4.19) that reservation covers the fixed Xbox memory
-window. That space commits pages lazily from its bottom, and the Java side
-of this app hardly allocates large objects, so the slice over the window is
-normally idle address space: unmap exactly the intersection (never more)
-and let the caller retry. Only that space, and only a slice with no page in
-use (present or swapped out, from /proc/self/pagemap): ART's other spaces
-(its heap, bitmaps and card tables) are live, and unmapping them would
-corrupt it where failing to start is at least clear. */
+/* ART reserves its spaces at addresses chosen at zygote start, and on some
+devices one of them covers the fixed Xbox memory window. ART's heap
+(dalvik.vm.heapsize) decides how much of the low 4 GB its spaces take: on
+handhelds with a large heap (the Retroid Pocket Flip2, the AYN Thor) the
+free-list large object space usually lands right above the boot image, over
+0x80000000.
+
+That space commits pages lazily from its bottom, and the game's process
+(HaloActivity runs in a process of its own, ":game", and reserves the
+window from JNI_OnLoad before its Java side has done anything:
+host_memory_reserve_early) hardly allocates large objects, so the slice
+over the window is normally idle address space: unmap exactly the
+intersection (never more) and let the caller retry. Only that space, and
+only a slice with no page in use (present or swapped out): ART's other
+spaces (its heap, bitmaps and card tables) are live, and unmapping them
+would corrupt it where failing to start is at least clear. */
 #define ART_LARGE_OBJECT_SPACE "[anon:dalvik-free list large object space]"
 
-/* whether no page from..to (page aligned) is present or swapped out; 0 if
-it cannot tell */
-static int range_unused(uint64_t from, uint64_t to)
+/* what range_usage found */
+enum
 {
-	FILE *pagemap = fopen("/proc/self/pagemap", "rb");
+	RANGE_UNUSED,
+	RANGE_IN_USE,
+	RANGE_UNKNOWN
+};
+
+/* why the fixed ranges could not be had: each reason also goes to the
+log, and the report (host_memory_report_low_mappings) starts with them, so
+memory_map.txt alone tells which case it was */
+static char findings[2048];
+
+static void finding(int priority, const char *format, ...)
+{
+	char line[512];
+	size_t used = strlen(findings);
+	va_list arguments;
+
+	va_start(arguments, format);
+	vsnprintf(line, sizeof(line), format, arguments);
+	va_end(arguments);
+	host_logf(priority, "%s", line);
+	if (used + strlen(line) + 2 < sizeof(findings))
+		snprintf(findings + used, sizeof(findings) - used, "%s\n", line);
+}
+
+struct range_usage
+{
+	uint64_t pages_in_use;
+	uint64_t lowest_in_use, highest_in_use;
+	const char *method;
+};
+
+static void note_in_use(struct range_usage *usage, uint64_t address)
+{
+	if (!usage->pages_in_use++)
+		usage->lowest_in_use = address;
+	usage->highest_in_use = address;
+}
+
+/* debug.halo.art_overlap's -nopagemap (simulate_art_overlap) */
+static int simulated_no_pagemap;
+
+/* from /proc/self/pagemap: bit 63 present, bit 62 swapped out */
+static int range_usage_pagemap(uint64_t from, uint64_t to, struct range_usage *usage)
+{
+	int descriptor = simulated_no_pagemap ? -1 : open("/proc/self/pagemap", O_RDONLY | O_CLOEXEC);
 	uint64_t entries[512];
 	uint64_t page = from / PAGE;
-	int unused = 1;
 
-	if (!pagemap)
-		return 0;
-	if (fseeko(pagemap, (off_t)(page * sizeof(uint64_t)), SEEK_SET) != 0)
-		unused = 0;
-	while (unused && page < to / PAGE)
+	if (simulated_no_pagemap)
+		errno = EACCES;
+	if (descriptor < 0)
+	{
+		finding(HOST_LOG_WARN, "cannot read /proc/self/pagemap (%s)", strerror(errno));
+		return RANGE_UNKNOWN;
+	}
+	usage->method = "pagemap";
+	while (page < to / PAGE)
 	{
 		size_t wanted = (size_t)(to / PAGE - page);
-		size_t count;
-		size_t index;
+		ssize_t bytes;
+		size_t count, index;
 
 		if (wanted > sizeof(entries) / sizeof(entries[0]))
 			wanted = sizeof(entries) / sizeof(entries[0]);
-		count = fread(entries, sizeof(entries[0]), wanted, pagemap);
-		if (count != wanted)
+		bytes = pread(descriptor, entries, wanted * sizeof(entries[0]), (off_t)(page * sizeof(entries[0])));
+		if (bytes <= 0 || bytes % sizeof(entries[0]))
 		{
-			unused = 0;
-			break;
+			finding(HOST_LOG_WARN, "cannot read /proc/self/pagemap at %08llx (%s)",
+				(unsigned long long)(page * PAGE), bytes < 0 ? strerror(errno) : "short read");
+			close(descriptor);
+			return RANGE_UNKNOWN;
 		}
-		/* (bit 63 present, bit 62 swapped) */
+		count = (size_t)bytes / sizeof(entries[0]);
 		for (index = 0; index < count; index++)
 		{
 			if (entries[index] & (3ULL << 62))
-			{
-				unused = 0;
-				break;
-			}
+				note_in_use(usage, (page + index) * PAGE);
 		}
 		page += count;
 	}
-	fclose(pagemap);
-	return unused;
+	close(descriptor);
+	return usage->pages_in_use ? RANGE_IN_USE : RANGE_UNUSED;
+}
+
+/* the Swap: line of the /proc/self/smaps entry starting at start, in kB; -1
+if it cannot be read (or no entry starts there); with end, the entry must
+also end there. dont_dump, if not NULL, tells whether its VmFlags have dd
+(MADV_DONTDUMP). */
+static long mapping_swap_kb_ending(uint64_t start, uint64_t end, int *dont_dump)
+{
+	FILE *smaps = fopen("/proc/self/smaps", "r");
+	char line[512];
+	int inside = 0;
+	long result = -1;
+
+	if (dont_dump)
+		*dont_dump = 0;
+	if (!smaps)
+		return -1;
+	while (fgets(line, sizeof(line), smaps))
+	{
+		unsigned long long lo, hi;
+		long kb;
+
+		if (sscanf(line, "%llx-%llx ", &lo, &hi) == 2 && strchr(line, '-') < strchr(line, ' '))
+		{
+			if (inside)
+				break;
+			inside = lo == start && (!end || hi == end);
+			continue;
+		}
+		if (!inside)
+			continue;
+		if (sscanf(line, "Swap: %ld kB", &kb) == 1)
+			result = kb;
+		else if (dont_dump && !strncmp(line, "VmFlags:", 8))
+			*dont_dump = strstr(line, " dd") != NULL;
+	}
+	fclose(smaps);
+	return result;
+}
+
+static long mapping_swap_kb(uint64_t start)
+{
+	return mapping_swap_kb_ending(start, 0, NULL);
+}
+
+/* whether any of from..to (in the mapping starting at mapping_start) is
+swapped out, when that mapping has swap somewhere: smaps counts swap per
+mapping, so the range is made a mapping of its own for a moment
+(MADV_DONTDUMP splits it off and changes nothing about its pages: neither
+ART nor the game ever dumps core), read, and merged back (MADV_DODUMP). Not
+for a mapping already marked so (the restore would then change it). -1 if
+that cannot be done */
+static long range_swap_kb(uint64_t mapping_start, uint64_t from, uint64_t to)
+{
+	int dont_dump;
+	long kb;
+
+	if (mapping_swap_kb_ending(mapping_start, 0, &dont_dump) < 0)
+	{
+		finding(HOST_LOG_WARN, "cannot read the smaps entry of ART's large object space at %08llx",
+			(unsigned long long)mapping_start);
+		return -1;
+	}
+	if (dont_dump)
+	{
+		finding(HOST_LOG_WARN, "ART's large object space at %08llx is marked not to be dumped; "
+			"the swap of %08llx-%08llx cannot be read on its own", (unsigned long long)mapping_start,
+			(unsigned long long)from, (unsigned long long)to);
+		return -1;
+	}
+	if (madvise((void *)from, (size_t)(to - from), MADV_DONTDUMP) != 0)
+	{
+		finding(HOST_LOG_WARN, "cannot split %08llx-%08llx off ART's large object space (%s)",
+			(unsigned long long)from, (unsigned long long)to, strerror(errno));
+		return -1;
+	}
+	kb = mapping_swap_kb_ending(from, to, NULL);
+	madvise((void *)from, (size_t)(to - from), MADV_DODUMP);
+	if (kb < 0)
+		finding(HOST_LOG_WARN, "no smaps entry for %08llx-%08llx once split off", (unsigned long long)from,
+			(unsigned long long)to);
+	return kb;
+}
+
+/* without pagemap (some kernels or policies refuse it): mincore() tells
+which pages are resident, and smaps whether any of the range is swapped
+out, which mincore cannot see */
+static int range_usage_mincore(uint64_t mapping_start, uint64_t from, uint64_t to, struct range_usage *usage)
+{
+	unsigned char residency[4096];
+	uint64_t address = from;
+	long swapped = mapping_swap_kb(mapping_start);
+
+	usage->method = "mincore";
+	if (swapped < 0)
+	{
+		finding(HOST_LOG_WARN, "cannot read the smaps entry of ART's large object space at %08llx",
+			(unsigned long long)mapping_start);
+		return RANGE_UNKNOWN;
+	}
+	if (swapped > 0)
+	{
+		/* (swap somewhere in the space: only the range's own matters) */
+		long range_swapped = range_swap_kb(mapping_start, from, to);
+
+		if (range_swapped < 0)
+			return RANGE_UNKNOWN;
+		if (range_swapped > 0)
+		{
+			/* (objects there, swapped out: which pages smaps does not say) */
+			usage->method = "the range's swap in smaps";
+			usage->pages_in_use = (uint64_t)range_swapped * 1024 / PAGE;
+			usage->lowest_in_use = from;
+			usage->highest_in_use = to - PAGE;
+			return RANGE_IN_USE;
+		}
+		finding(HOST_LOG_INFO, "ART's large object space at %08llx: %ld kB of it swapped out, none of %08llx-%08llx",
+			(unsigned long long)mapping_start, swapped, (unsigned long long)from, (unsigned long long)to);
+	}
+	while (address < to)
+	{
+		uint64_t length = to - address;
+		size_t index;
+
+		if (length > sizeof(residency) * PAGE)
+			length = sizeof(residency) * PAGE;
+		if (mincore((void *)address, length, residency) != 0)
+		{
+			finding(HOST_LOG_WARN, "mincore at %08llx failed (%s)", (unsigned long long)address, strerror(errno));
+			return RANGE_UNKNOWN;
+		}
+		for (index = 0; index < length / PAGE; index++)
+		{
+			if (residency[index] & 1)
+				note_in_use(usage, address + index * PAGE);
+		}
+		address += length;
+	}
+	return usage->pages_in_use ? RANGE_IN_USE : RANGE_UNUSED;
+}
+
+/* whether any page from..to (page aligned) of the mapping starting at
+mapping_start holds data */
+static int range_usage(uint64_t mapping_start, uint64_t from, uint64_t to, struct range_usage *usage)
+{
+	int result;
+
+	memset(usage, 0, sizeof(*usage));
+	result = range_usage_pagemap(from, to, usage);
+	if (result == RANGE_UNKNOWN)
+	{
+		memset(usage, 0, sizeof(*usage));
+		result = range_usage_mincore(mapping_start, from, to, usage);
+	}
+	return result;
 }
 
 static int reclaim_art_overlap(uint64_t address, uint64_t size)
@@ -170,6 +380,7 @@ static int reclaim_art_overlap(uint64_t address, uint64_t size)
 	{
 		unsigned long long lo, hi;
 		uint64_t from, to;
+		struct range_usage usage;
 		char *name;
 		int name_offset = 0;
 
@@ -183,21 +394,31 @@ static int reclaim_art_overlap(uint64_t address, uint64_t size)
 		to = hi < address + size ? hi : address + size;
 		if (strcmp(name, ART_LARGE_OBJECT_SPACE))
 		{
-			host_logf(HOST_LOG_ERROR, "a fixed guest range is overlapped by %08llx-%08llx (%s), which is not ART's large object space; left alone",
+			finding(HOST_LOG_ERROR, "a fixed guest range is overlapped by %08llx-%08llx (%s), which is not ART's large object space; left alone",
 				lo, hi, name[0] ? name : "unnamed");
 			continue;
 		}
-		if (!range_unused(from, to))
+		switch (range_usage(lo, from, to, &usage))
 		{
-			host_logf(HOST_LOG_ERROR, "ART's large object space over %08llx-%08llx is in use (or its pages cannot be read); left alone",
-				(unsigned long long)from, (unsigned long long)to);
+		case RANGE_IN_USE:
+			finding(HOST_LOG_ERROR,
+				"ART's large object space %08llx-%08llx holds objects over %08llx-%08llx "
+				"(%llu pages in use, %08llx-%08llx, by %s); left alone",
+				lo, hi, (unsigned long long)from, (unsigned long long)to,
+				(unsigned long long)usage.pages_in_use, (unsigned long long)usage.lowest_in_use,
+				(unsigned long long)usage.highest_in_use + PAGE, usage.method);
+			continue;
+		case RANGE_UNKNOWN:
+			finding(HOST_LOG_ERROR,
+				"ART's large object space %08llx-%08llx covers %08llx-%08llx, and whether that part is in use "
+				"cannot be told; left alone", lo, hi, (unsigned long long)from, (unsigned long long)to);
 			continue;
 		}
 		if (munmap((void *)from, to - from) == 0)
 		{
 			host_logf(HOST_LOG_INFO,
-				"reclaimed idle ART range %08llx-%08llx (%s)",
-				(unsigned long long)from, (unsigned long long)to, name);
+				"reclaimed idle ART range %08llx-%08llx of %08llx-%08llx (%s, checked by %s)",
+				(unsigned long long)from, (unsigned long long)to, lo, hi, name, usage.method);
 			reclaimed = 1;
 		}
 	}
@@ -217,8 +438,10 @@ static int reserve(uint64_t address, uint64_t size, int reclaim_art)
 		return 0;
 	if (result != MAP_FAILED)
 	{
+		/* (a kernel older than 4.17 takes MAP_FIXED_NOREPLACE as a hint,
+		and maps elsewhere when something is in the way) */
 		munmap(result, size);
-		return -1;
+		errno = EEXIST;
 	}
 	if (reclaim_art && errno == EEXIST)
 	{
@@ -236,11 +459,47 @@ static int reserve(uint64_t address, uint64_t size, int reclaim_art)
 		if (result == (void *)address)
 			return 0;
 		if (result != MAP_FAILED)
+		{
 			munmap(result, size);
+			errno = EEXIST;
+		}
 	}
 	return -1;
 }
 
+/* the mappings below 4 GB, for a report of why the fixed ranges could not
+be had (logcat, and memory_map.txt in the data folder: host_main.c) */
+void host_memory_report_low_mappings(FILE *file)
+{
+	FILE *maps = fopen("/proc/self/maps", "r");
+	char line[512];
+	char model[PROP_VALUE_MAX] = "", heap[PROP_VALUE_MAX] = "", release[PROP_VALUE_MAX] = "";
+
+	__system_property_get("ro.product.model", model);
+	__system_property_get("dalvik.vm.heapsize", heap);
+	__system_property_get("ro.build.version.release", release);
+	if (file)
+	{
+		fprintf(file, "device: %s, Android %s, Java heap %s\n", model[0] ? model : "unknown",
+			release[0] ? release : "unknown", heap[0] ? heap : "unknown");
+		fprintf(file, "why:\n%s\nmappings below 4 GB:\n", findings[0] ? findings : "(no reason recorded)\n");
+	}
+	if (!maps)
+		return;
+	while (fgets(line, sizeof(line), maps))
+	{
+		unsigned long long lo, hi;
+
+		if (sscanf(line, "%llx-%llx", &lo, &hi) != 2 || lo >= LOW_LIMIT)
+			continue;
+		line[strcspn(line, "\n")] = '\0';
+		host_logf(HOST_LOG_INFO, "low mapping: %s", line);
+		if (file)
+			fprintf(file, "%s\n", line);
+	}
+	fclose(maps);
+}
+
 static struct pool *pool_new(void)
 {
 	/* above the image first: ART allocates its own low-4 GB memory from
@@ -277,24 +536,122 @@ static struct pool *pool_new(void)
 	return NULL;
 }
 
+/* The fixed ranges: the Xbox window and, right above it, room for the guest
+image (HALO_GUEST_IMAGE_RESERVE), reserved as early as the process allows
+(host_memory_reserve_early, from JNI_OnLoad) or else when the image loads. */
+static int fixed_reserved;
+static int fixed_error;
+
+/* when: the attempt, as the report names it (the reasons below it are
+those of that attempt) */
+static int reserve_fixed(const char *when)
+{
+	size_t used = strlen(findings);
+
+	if (fixed_reserved)
+		return 0;
+	snprintf(findings + used, sizeof(findings) - used, "%s:\n", when);
+	if (reserve(HALO_GUEST_WINDOW_BASE, HALO_GUEST_WINDOW_SIZE, 1) != 0)
+	{
+		fixed_error = errno;
+		finding(HOST_LOG_ERROR, "cannot reserve the Xbox memory window at %08llx (%s)",
+			(unsigned long long)HALO_GUEST_WINDOW_BASE, strerror(errno));
+		return -1;
+	}
+	if (reserve(HALO_GUEST_IMAGE_BASE, HALO_GUEST_IMAGE_RESERVE, 1) != 0)
+	{
+		fixed_error = errno;
+		finding(HOST_LOG_ERROR, "cannot reserve the guest image range at %08llx (%s)",
+			(unsigned long long)HALO_GUEST_IMAGE_BASE, strerror(errno));
+		munmap((void *)(uintptr_t)HALO_GUEST_WINDOW_BASE, HALO_GUEST_WINDOW_SIZE);
+		return -1;
+	}
+	fixed_reserved = 1;
+	return 0;
+}
+
+int host_memory_fixed_unavailable(void)
+{
+	return !fixed_reserved && fixed_error != 0;
+}
+
+/* For testing the reclaim on any device: with the system property
+debug.halo.art_overlap set (adb shell setprop debug.halo.art_overlap idle,
+or busy), a mapping named as ART's large object space is put over the fixed
+ranges first, idle, or with a page in use inside the window, the way ART's
+is on the devices that need the reclaim. Players never set it.
+
+Either may be followed by -nopagemap, for devices that refuse
+/proc/self/pagemap (the check then falls back to mincore and smaps), and
+by -swapped, which pushes the stand-in's objects (its bottom pages, and the
+window's page if busy) out to swap, as they can be on those devices. */
+#ifndef MADV_PAGEOUT
+#define MADV_PAGEOUT 21
+#endif
+#define PR_SET_VMA_ 0x53564d41
+#define PR_SET_VMA_ANON_NAME_ 0
+#define SIMULATED_SPACE_BASE 0x7c000000ULL
+#define SIMULATED_SPACE_SIZE 0x14000000ULL
+
+static void simulate_art_overlap(void)
+{
+	char value[PROP_VALUE_MAX] = "";
+	char *window_page = (char *)(uintptr_t)HALO_GUEST_WINDOW_BASE + 0x100000;
+	int busy;
+	void *space;
+
+	if (__system_property_get("debug.halo.art_overlap", value) <= 0 || (strncmp(value, "idle", 4) && strncmp(value, "busy", 4)))
+		return;
+	busy = !strncmp(value, "busy", 4);
+	space = mmap((void *)SIMULATED_SPACE_BASE, SIMULATED_SPACE_SIZE, PROT_READ | PROT_WRITE,
+		MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE | MAP_FIXED_NOREPLACE, -1, 0);
+	if (space != (void *)SIMULATED_SPACE_BASE)
+	{
+		host_logf(HOST_LOG_WARN, "debug.halo.art_overlap: %08llx-%08llx is not free",
+			SIMULATED_SPACE_BASE, SIMULATED_SPACE_BASE + SIMULATED_SPACE_SIZE);
+		if (space != MAP_FAILED)
+			munmap(space, SIMULATED_SPACE_SIZE);
+		return;
+	}
+	prctl(PR_SET_VMA_, PR_SET_VMA_ANON_NAME_, space, SIMULATED_SPACE_SIZE, "dalvik-free list large object space");
+	/* objects at its bottom, as ART allocates them */
+	memset(space, 0x5a, 4 * PAGE);
+	if (busy)
+		memset(window_page, 0x5a, PAGE);
+	if (strstr(value, "-swapped"))
+	{
+		if (madvise(space, 4 * PAGE, MADV_PAGEOUT) != 0 || (busy && madvise(window_page, PAGE, MADV_PAGEOUT) != 0))
+			host_logf(HOST_LOG_WARN, "debug.halo.art_overlap: cannot page out the stand-in (%s)", strerror(errno));
+	}
+	simulated_no_pagemap = strstr(value, "-nopagemap") != NULL;
+	host_logf(HOST_LOG_WARN, "debug.halo.art_overlap=%s: a stand-in for ART's large object space at %08llx-%08llx "
+		"(%ld kB of it swapped out)", value, SIMULATED_SPACE_BASE, SIMULATED_SPACE_BASE + SIMULATED_SPACE_SIZE,
+		mapping_swap_kb(SIMULATED_SPACE_BASE));
+}
+
+void host_memory_reserve_early(void)
+{
+	simulate_art_overlap();
+	if (reserve_fixed("at start-up (JNI_OnLoad)") == 0)
+		host_logf(HOST_LOG_INFO, "reserved the Xbox memory window and the image range at start-up");
+}
+
 int host_memory_initialize(uint32_t base, uint32_t size)
 {
+	if (base != HALO_GUEST_IMAGE_BASE || size > HALO_GUEST_IMAGE_RESERVE)
+	{
+		host_logf(HOST_LOG_ERROR, "the guest image (%08x, %u bytes) does not fit its range", base, size);
+		return -1;
+	}
+	if (reserve_fixed("when the image loaded") != 0)
+	{
+		errno = fixed_error;
+		return -1;
+	}
 	window_base = HALO_GUEST_WINDOW_BASE;
 	window_end = window_base + HALO_GUEST_WINDOW_SIZE;
-	if (reserve(window_base, HALO_GUEST_WINDOW_SIZE, 1) != 0)
-	{
-		host_logf(HOST_LOG_ERROR, "cannot reserve the Xbox memory window at %08llx (%s)",
-			(unsigned long long)window_base, strerror(errno));
-		return -1;
-	}
 	image_base = base;
 	image_end = base + round_up(size);
-	if (reserve(image_base, image_end - image_base, 1) != 0)
-	{
-		host_logf(HOST_LOG_ERROR, "cannot reserve the guest image range at %08llx (%s)",
-			(unsigned long long)image_base, strerror(errno));
-		return -1;
-	}
 	return 0;
 }
 
@@ -477,6 +834,10 @@ long host_guest_mprotect(uint64_t address, uint64_t size, int protection)
 
 #define WATCH_PAGE_COUNT (HALO_GUEST_WINDOW_SIZE / PAGE)
 
+/* (each page: 0 not watched, 1 watched and read-only, 2 made writable by a
+watched write. A fault on a page at 2 is a write another thread made as
+this one was making the page writable, and is made again; one on a page at
+0, freed memory or none of the watch's, is a crash) */
 static uint8_t page_protected[WATCH_PAGE_COUNT];
 static uint32_t page_generation[WATCH_PAGE_COUNT];
 static volatile uint32_t current_generation = 1;
@@ -510,7 +871,7 @@ static uint64_t watch_page(uint64_t address)
 static void mark_written(uint64_t page)
 {
 	page_generation[page] = __sync_add_and_fetch(&current_generation, 1);
-	page_protected[page] = 0;
+	page_protected[page] = 2;
 	mprotect((void *)(HALO_GUEST_WINDOW_BASE + page * PAGE), PAGE, PROT_READ | PROT_WRITE);
 }
 
@@ -577,11 +938,13 @@ static void segv_handler(int signal_number, siginfo_t *information, void *contex
 	{
 		uint64_t page = watch_page(address);
 
-		if (page_protected[page])
+		if (page_protected[page] == 1)
 		{
 			mark_written(page);
 			return;
 		}
+		if (page_protected[page] == 2)
+			return;
 	}
 	report_crash(signal_number, information, context);
 	chain(&previous_segv, signal_number, information, context);
@@ -644,7 +1007,7 @@ void host_memory_watch_protect(uint32_t address, uint32_t size)
 	}
 	for (page = first; page <= last; page++)
 	{
-		if (!page_protected[page])
+		if (page_protected[page] != 1)
 		{
 			page_protected[page] = 1;
 			mprotect((void *)(HALO_GUEST_WINDOW_BASE + page * PAGE), PAGE, PROT_READ);
@@ -699,7 +1062,7 @@ void host_memory_watch_prepare_write(uint32_t address, uint32_t size)
 		last = WATCH_PAGE_COUNT - 1;
 	for (page = first; page <= last; page++)
 	{
-		if (page_protected[page])
+		if (page_protected[page] == 1)
 			mark_written(page);
 	}
 }

port/android/host/host_sdl.c

@@ -514,3 +514,35 @@ int host_sdl_show_simple_message_box(uint32_t flags, const char *title, const ch
 {
 	return SDL_ShowSimpleMessageBox((SDL_MessageBoxFlags)flags, title, message, NULL) ? 1 : 0;
 }
+
+/* ---------- a question for the player (the mods at startup: port_mods.c) */
+
+int host_sdl_show_message_box(uint32_t flags, const char *title, const char *message, int default_index,
+	const char *button0, const char *button1, const char *button2)
+{
+	const char *labels[3] = { button0, button1, button2 };
+	SDL_MessageBoxButtonData buttons[3];
+	SDL_MessageBoxData question;
+	int count = 0;
+	int answer = -1;
+	int index;
+
+	for (index = 0; index < 3; index++)
+	{
+		if (!labels[index])
+			continue;
+		buttons[count].flags = index == default_index ?
+			SDL_MESSAGEBOX_BUTTON_RETURNKEY_DEFAULT | SDL_MESSAGEBOX_BUTTON_ESCAPEKEY_DEFAULT : 0;
+		buttons[count].buttonID = index;
+		buttons[count].text = labels[index];
+		count++;
+	}
+	question.flags = (SDL_MessageBoxFlags)flags;
+	question.window = NULL;
+	question.title = title;
+	question.message = message;
+	question.numbuttons = count;
+	question.buttons = buttons;
+	question.colorScheme = NULL;
+	return SDL_ShowMessageBox(&question, &answer) ? answer : -1;
+}

port/android/host/host_watch_hash.c

@@ -6,6 +6,45 @@ Write tracking by page contents (host_watch_hash.h).
 
 #include "host_watch_hash.h"
 
+#ifdef __wasm_simd128__
+/*
+FNV-style mixing in sixteen independent 32-bit lanes, four vectors of four
+(WebAssembly's SIMD: the web build, web_memory_watch.c), so that no lane
+waits for another and the multiplies are the vector unit's own; its 64-bit
+multiplies are scalar, which made the hashing of every watched page each
+frame a quarter of the web build's frame, twice what this takes. A change of
+one word changes its lane's state for good (xor and an odd multiply are both
+invertible), and the fold keeps every lane's bits, so a single-word write
+always shows. Changes of several words could cancel each other, which is
+unlikely for game data. (host_watch_hash.h)
+*/
+typedef uint32_t watch_hash_lanes __attribute__((vector_size(16), aligned(4), may_alias));
+
+uint64_t watch_hash_page(const uint8_t *page)
+{
+	const watch_hash_lanes *words = (const watch_hash_lanes *)page;
+	const watch_hash_lanes prime = { 0x01000193u, 0x01000193u, 0x01000193u, 0x01000193u };
+	watch_hash_lanes lane0 = { 0x811c9dc5u, 0x9e3779b9u, 0x85ebca6bu, 0xc2b2ae35u };
+	watch_hash_lanes lane1 = { 0x27d4eb2fu, 0x165667b1u, 0xd3a2646cu, 0xfd7046c5u };
+	watch_hash_lanes lane2 = { 0xb55a4f09u, 0x7feb352du, 0x846ca68bu, 0x2c1b3c6du };
+	watch_hash_lanes lane3 = { 0x297a2d39u, 0xe6546b64u, 0xcc9e2d51u, 0x1b873593u };
+	watch_hash_lanes folded;
+	uint32_t index;
+
+	for (index = 0; index < WATCH_HASH_PAGE_SIZE / sizeof(watch_hash_lanes); index += 4)
+	{
+		lane0 = (lane0 ^ words[index + 0]) * prime;
+		lane1 = (lane1 ^ words[index + 1]) * prime;
+		lane2 = (lane2 ^ words[index + 2]) * prime;
+		lane3 = (lane3 ^ words[index + 3]) * prime;
+	}
+	/* (each vector's lanes turned before they are combined, so that the same
+	change in two of them does not cancel) */
+	folded = lane0 ^ ((lane1 << 8) | (lane1 >> 24)) ^ ((lane2 << 16) | (lane2 >> 16)) ^ ((lane3 << 24) | (lane3 >> 8));
+	return ((uint64_t)(folded[0] ^ ((folded[2] << 13) | (folded[2] >> 19))) << 32) |
+		(folded[1] ^ ((folded[3] << 13) | (folded[3] >> 19)));
+}
+#else
 /*
 FNV-style mixing in four independent lanes, so that the multiplies of
 one lane do not wait for another's. A change of one word changes its
@@ -30,6 +69,7 @@ uint64_t watch_hash_page(const uint8_t *page)
 	return lane0 ^ ((lane1 << 16) | (lane1 >> 48)) ^ ((lane2 << 32) | (lane2 >> 32)) ^
 		((lane3 << 48) | (lane3 >> 16));
 }
+#endif
 
 /* clamps last to the watched memory; 0 when nothing is left of the range */
 static int clamp(const struct watch_hash *watch, uint32_t first, uint32_t *last)
@@ -59,9 +99,19 @@ void watch_hash_protect(struct watch_hash *watch, uint32_t first, uint32_t last)
 		watch->watched[page] = 1;
 		watch->hash[page] = watch_hash_page(page_memory(watch, page));
 		watch->hashed_frame[page] = watch->frame;
+		if (watch->unchanged)
+			watch->unchanged[page] = 0;
 	}
 }
 
+/* a stable page hashed recently enough: not hashed again yet
+(host_watch_hash.h) */
+static int stable_for_now(const struct watch_hash *watch, uint32_t page)
+{
+	return watch->unchanged && watch->unchanged[page] >= WATCH_HASH_STABLE_CHECKS &&
+		watch->frame - watch->hashed_frame[page] < WATCH_HASH_STABLE_FRAMES;
+}
+
 uint32_t watch_hash_generation(struct watch_hash *watch, uint32_t first, uint32_t last)
 {
 	uint32_t page, newest = 0;
@@ -70,7 +120,7 @@ uint32_t watch_hash_generation(struct watch_hash *watch, uint32_t first, uint32_
 		return 0;
 	for (page = first; page <= last; page++)
 	{
-		if (watch->watched[page] && watch->hashed_frame[page] != watch->frame)
+		if (watch->watched[page] && watch->hashed_frame[page] != watch->frame && !stable_for_now(watch, page))
 		{
 			uint64_t hash = watch_hash_page(page_memory(watch, page));
 
@@ -79,6 +129,12 @@ uint32_t watch_hash_generation(struct watch_hash *watch, uint32_t first, uint32_
 			{
 				watch->hash[page] = hash;
 				watch->generation[page] = __sync_add_and_fetch(watch->current_generation, 1);
+				if (watch->unchanged)
+					watch->unchanged[page] = 0;
+			}
+			else if (watch->unchanged && watch->unchanged[page] < WATCH_HASH_STABLE_CHECKS)
+			{
+				watch->unchanged[page]++;
 			}
 		}
 		if (watch->generation[page] > newest)
@@ -100,6 +156,16 @@ void watch_hash_forget(struct watch_hash *watch, uint32_t first, uint32_t last)
 	}
 }
 
+void watch_hash_prepare_write(struct watch_hash *watch, uint32_t first, uint32_t last)
+{
+	uint32_t page;
+
+	if (!watch->unchanged || !clamp(watch, first, &last))
+		return;
+	for (page = first; page <= last; page++)
+		watch->unchanged[page] = 0;
+}
+
 /*
 The serial changes each frame, so a cache that skips generation queries
 while the serial stays the same (xbox_textures.c's recent_textures) asks

port/android/host/host_watch_hash.h

@@ -9,6 +9,15 @@ host_memory.c would stop the game at its first write to a cached page.
 A watched page's hash is kept. Asking for its generation hashes it again,
 at most once a frame (watch_hash_begin_frame), and a different hash counts
 as a write. A write is therefore seen in the next frame, not at once.
+
+Hashing every page drawn from each frame is a large part of the frame on
+the web (port/web/src/web_memory_watch.c), where most of them never change
+once loaded. With the optional unchanged counts, a page whose hash stayed the
+same WATCH_HASH_STABLE_CHECKS times in a row is hashed only every
+WATCH_HASH_STABLE_FRAMES frames, until a write into it is announced
+(watch_hash_prepare_write: the file layer's reads, the Direct3D locks) or
+its hash changes. A write that is not announced into such a page is seen up
+to that many frames late.
 */
 
 #ifndef HOST_WATCH_HASH_H
@@ -17,6 +26,8 @@ as a write. A write is therefore seen in the next frame, not at once.
 #include <stdint.h>
 
 #define WATCH_HASH_PAGE_SIZE 0x1000u
+#define WATCH_HASH_STABLE_CHECKS 30u
+#define WATCH_HASH_STABLE_FRAMES 60u
 
 struct watch_hash
 {
@@ -31,6 +42,9 @@ struct watch_hash
 	uint32_t *generation;
 	volatile uint32_t *current_generation;
 	uint32_t frame;
+	/* NULL, or page_count entries: the checks in a row that found the page
+	unchanged (up to WATCH_HASH_STABLE_CHECKS) */
+	uint8_t *unchanged;
 };
 
 /* a hash of one page (WATCH_HASH_PAGE_SIZE bytes, 8-byte aligned) that
@@ -43,14 +57,17 @@ ignored. */
 void watch_hash_protect(struct watch_hash *watch, uint32_t first, uint32_t last);
 
 /* The newest generation among pages first to last (inclusive), after hashing
-again the watched ones not yet hashed this frame; a page whose hash
-changed gets a new generation. 0 if the range is outside the watched
-memory. */
+again the watched ones not yet hashed this frame (a stable one may wait,
+above); a page whose hash changed gets a new generation. 0 if the range is
+outside the watched memory. */
 uint32_t watch_hash_generation(struct watch_hash *watch, uint32_t first, uint32_t last);
 
 /* The pages were remapped: treat them as written and unwatched. */
 void watch_hash_forget(struct watch_hash *watch, uint32_t first, uint32_t last);
 
+/* The pages are about to be written: hash them every frame again. */
+void watch_hash_prepare_write(struct watch_hash *watch, uint32_t first, uint32_t last);
+
 /* A new frame: pages may be hashed again, and the serial changes. */
 void watch_hash_begin_frame(struct watch_hash *watch);
 

port/android/host/host_xr.c

@@ -47,6 +47,11 @@ picture; the copy flips them to GL's bottom-up images.
 #include <openxr/openxr_platform.h>
 
 #define MAXIMUM_SWAPCHAIN_IMAGES 8
+/* XR_META_performance_metrics' counters kept (the Quest 3 has some twenty:
+the app's, the compositor's, the device's and each core's) */
+#define MAXIMUM_METRICS 48
+/* sampled every this many frames */
+#define METRICS_EVERY 3
 
 struct xr_swapchain
 {
@@ -129,10 +134,24 @@ static struct
 	/* (XR_META_performance_metrics: the compositor's counts, in the log,
 	for telling frames shown late from the game's own pace) */
 	int has_metrics;
+	/* the counters and the copies' times logged (vr.log_performance) */
+	int log_metrics;
+	/* the app's GPU time of its last frame, ms (app/gpu_frametime: its
+	counter's index, -1 none), read each frame for vr.graphics "auto" */
+	int gpu_metric;
+	float gpu_milliseconds;
 	PFN_xrQueryPerformanceMetricsCounterMETA query_metric;
-	XrPath metric_paths[16];
+	XrPath metric_paths[MAXIMUM_METRICS];
 	uint32_t metric_count;
 	struct timespec metrics_logged;
+	/* each counter sampled every few frames since the last line: sum, most
+	and samples (the app's GPU time and the compositor's dropped frames
+	vary from frame to frame) */
+	double metric_sums[MAXIMUM_METRICS];
+	double metric_most[MAXIMUM_METRICS];
+	int metric_samples[MAXIMUM_METRICS];
+	int metric_units[MAXIMUM_METRICS];
+	int metric_frame;
 	/* (SteamVR: the frames' thread kept on the fast cores, xr_fast_cores) */
 	int steamvr;
 	int cores_pinned;
@@ -1225,14 +1244,19 @@ int host_xr_probe(float resolution_scale, int *eye_width, int *eye_height)
 	xr.has_refresh_rate = has_extension(extensions, extension_count, XR_FB_DISPLAY_REFRESH_RATE_EXTENSION_NAME);
 	if (xr.has_refresh_rate)
 		enabled[enabled_count++] = XR_FB_DISPLAY_REFRESH_RATE_EXTENSION_NAME;
+	/* (with vr.log_performance: host_main.c) */
+	/* (the app's GPU time for vr.graphics "auto"; all the counters logged
+with vr.log_performance: host_main.c) */
 	xr.has_metrics = has_extension(extensions, extension_count, XR_META_PERFORMANCE_METRICS_EXTENSION_NAME);
+	xr.log_metrics = getenv("HALO_XR_LOG_PERFORMANCE") != NULL;
+	xr.gpu_metric = -1;
 	if (xr.has_metrics)
 		enabled[enabled_count++] = XR_META_PERFORMANCE_METRICS_EXTENSION_NAME;
 
 	android.applicationVM = machine;
 	android.applicationActivity = activity;
 	instance.next = &android;
-	strcpy(instance.applicationInfo.applicationName, "Ringfall Mjolnir VR");
+	strcpy(instance.applicationInfo.applicationName, "Mjolnir VR");
 	instance.applicationInfo.applicationVersion = 1;
 	strcpy(instance.applicationInfo.engineName, "halo-ce-universal");
 	instance.applicationInfo.engineVersion = 1;
@@ -1390,12 +1414,39 @@ int host_xr_initialize(struct halo_xr_info *info, float wanted_refresh_rate)
 		xrGetInstanceProcAddr(xr.instance, "xrSetPerformanceMetricsStateMETA", (PFN_xrVoidFunction *)&set_state);
 		xrGetInstanceProcAddr(xr.instance, "xrQueryPerformanceMetricsCounterMETA",
 			(PFN_xrVoidFunction *)&xr.query_metric);
+		uint32_t available = 0;
+		XrPath *paths = NULL;
+
 		state.enabled = XR_TRUE;
+		/* (asked how many first: the Quest 3 has more than 16, and a smaller
+		array failed the call, so the metrics were off) */
 		xr.has_metrics = enumerate && set_state && xr.query_metric &&
-			XR_SUCCEEDED(enumerate(xr.instance, 16, &xr.metric_count, xr.metric_paths)) &&
+			XR_SUCCEEDED(enumerate(xr.instance, 0, &available, NULL)) && available > 0 &&
+			(paths = calloc(available, sizeof(*paths))) != NULL &&
+			XR_SUCCEEDED(enumerate(xr.instance, available, &available, paths)) &&
 			XR_SUCCEEDED(set_state(xr.session, &state));
-		host_logf(HOST_LOG_INFO, "xr: performance metrics %s (%u counters)", xr.has_metrics ? "on" : "off",
-			xr.has_metrics ? xr.metric_count : 0);
+		xr.metric_count = 0;
+		if (xr.has_metrics)
+		{
+			uint32_t counter;
+
+			xr.metric_count = available < MAXIMUM_METRICS ? available : MAXIMUM_METRICS;
+			memcpy(xr.metric_paths, paths, xr.metric_count * sizeof(*paths));
+			for (counter = 0; counter < xr.metric_count; counter++)
+			{
+				char name[XR_MAX_PATH_LENGTH];
+				uint32_t length = 0;
+
+				if (XR_SUCCEEDED(xrPathToString(xr.instance, xr.metric_paths[counter], sizeof(name), &length, name)) &&
+					!strcmp(name, "/perfmetrics_meta/app/gpu_frametime"))
+				{
+					xr.gpu_metric = (int)counter;
+				}
+			}
+		}
+		free(paths);
+		host_logf(HOST_LOG_INFO, "xr: performance metrics %s (%u counters of %u; the app's GPU time %s)",
+			xr.has_metrics ? "on" : "off", xr.metric_count, available, xr.gpu_metric >= 0 ? "read" : "not offered");
 	}
 
 	if (xr.has_performance_settings)
@@ -1601,10 +1652,10 @@ static int copy_layer_region(int layer, uint32_t texture, int clear_alpha, float
 int host_xr_copy_layer_region(int layer, uint32_t texture, int clear_alpha, float left, float top, float right,
 	float bottom)
 {
-	double start = xr.has_metrics ? seconds_now() : 0.0;
+	double start = xr.log_metrics ? seconds_now() : 0.0;
 	int copied = copy_layer_region(layer, texture, clear_alpha, left, top, right, bottom);
 
-	if (xr.has_metrics && layer >= 0 && layer < HALO_XR_LAYER_COUNT)
+	if (xr.log_metrics && layer >= 0 && layer < HALO_XR_LAYER_COUNT)
 		xr.copy_seconds[layer] += seconds_now() - start;
 	return copied;
 }
@@ -1625,7 +1676,7 @@ static int copy_layer_region(int layer, uint32_t texture, int clear_alpha, float
 		return xr.deferred ? 2 : 1;
 	wait.timeout = XR_INFINITE_DURATION;
 	{
-		double start = xr.has_metrics ? seconds_now() : 0.0;
+		double start = xr.log_metrics ? seconds_now() : 0.0;
 
 		if (!xr_ok(xrAcquireSwapchainImage(swapchain->handle, &acquire, &swapchain->acquired_index),
 			"xrAcquireSwapchainImage"))
@@ -1634,7 +1685,7 @@ static int copy_layer_region(int layer, uint32_t texture, int clear_alpha, float
 		}
 		if (!xr_ok(xrWaitSwapchainImage(swapchain->handle, &wait), "xrWaitSwapchainImage"))
 			return 0;
-		if (xr.has_metrics)
+		if (xr.log_metrics)
 			xr.acquire_seconds += seconds_now() - start;
 	}
 
@@ -1755,7 +1806,7 @@ static int copy_layer_region(int layer, uint32_t texture, int clear_alpha, float
 /* deferred: the images the frame's copies kept, released before it ends */
 static void release_held(void)
 {
-	double start = xr.has_metrics ? seconds_now() : 0.0;
+	double start = xr.log_metrics ? seconds_now() : 0.0;
 	int layer;
 
 	for (layer = 0; layer < HALO_XR_LAYER_COUNT; layer++)
@@ -1768,7 +1819,7 @@ static void release_held(void)
 		swapchain->held = 0;
 		xr_ok(xrReleaseSwapchainImage(swapchain->handle, &release), "xrReleaseSwapchainImage");
 	}
-	if (xr.has_metrics)
+	if (xr.log_metrics)
 		xr.release_seconds += seconds_now() - start;
 }
 
@@ -1974,38 +2025,88 @@ int host_xr_end_frame(const struct halo_xr_submit *submit)
 		if (!getenv("HALO_XR_ANY_CORE"))
 			xr_fast_cores();
 	}
-	/* (every five seconds, the compositor's counters, and the core the
-	frames' thread is on) */
-	if (xr.has_metrics)
+	/* (the app's GPU time, each frame) */
+	if (xr.has_metrics && xr.gpu_metric >= 0)
+	{
+		XrPerformanceMetricsCounterMETA value = { XR_TYPE_PERFORMANCE_METRICS_COUNTER_META };
+
+		if (XR_SUCCEEDED(xr.query_metric(xr.session, xr.metric_paths[xr.gpu_metric], &value)) &&
+			(value.counterFlags & XR_PERFORMANCE_METRICS_COUNTER_ANY_VALUE_VALID_BIT_META))
+		{
+			xr.gpu_milliseconds = (value.counterFlags & XR_PERFORMANCE_METRICS_COUNTER_FLOAT_VALUE_VALID_BIT_META) ?
+				value.floatValue : (float)value.uintValue;
+		}
+	}
+	/* (the compositor's counters sampled every few frames; every five
+	seconds their means and most, and the core the frames' thread is on) */
+	if (xr.has_metrics && xr.log_metrics)
 	{
 		struct timespec now;
 
-		clock_gettime(CLOCK_MONOTONIC, &now);
-		if (now.tv_sec - xr.metrics_logged.tv_sec >= 5)
+		if (++xr.metric_frame >= METRICS_EVERY)
 		{
-			char line[768] = "";
 			uint32_t counter;
 
-			xr.metrics_logged = now;
-			for (counter = 0; counter < xr.metric_count && counter < 16; counter++)
+			xr.metric_frame = 0;
+			for (counter = 0; counter < xr.metric_count; counter++)
 			{
 				XrPerformanceMetricsCounterMETA value = { XR_TYPE_PERFORMANCE_METRICS_COUNTER_META };
-				char name[XR_MAX_PATH_LENGTH];
-				uint32_t length = 0;
-				char item[96];
+				double number;
 
 				if (!XR_SUCCEEDED(xr.query_metric(xr.session, xr.metric_paths[counter], &value)) ||
-					!XR_SUCCEEDED(xrPathToString(xr.instance, xr.metric_paths[counter], sizeof(name), &length, name)))
+					!(value.counterFlags & XR_PERFORMANCE_METRICS_COUNTER_ANY_VALUE_VALID_BIT_META))
 				{
 					continue;
 				}
-				snprintf(item, sizeof(item), " %s=%g", strrchr(name, '/') ? strrchr(name, '/') + 1 : name,
-					(value.counterFlags & XR_PERFORMANCE_METRICS_COUNTER_FLOAT_VALUE_VALID_BIT_META) ?
-						(double)value.floatValue : (double)value.uintValue);
+				number = (value.counterFlags & XR_PERFORMANCE_METRICS_COUNTER_FLOAT_VALUE_VALID_BIT_META) ?
+					(double)value.floatValue : (double)value.uintValue;
+				xr.metric_sums[counter] += number;
+				if (!xr.metric_samples[counter] || number > xr.metric_most[counter])
+					xr.metric_most[counter] = number;
+				xr.metric_samples[counter]++;
+				xr.metric_units[counter] = (int)value.counterUnit;
+			}
+		}
+		clock_gettime(CLOCK_MONOTONIC, &now);
+		if (now.tv_sec - xr.metrics_logged.tv_sec >= 5)
+		{
+			char line[1024] = "";
+			uint32_t counter;
+
+			xr.metrics_logged = now;
+			for (counter = 0; counter < xr.metric_count; counter++)
+			{
+				char name[XR_MAX_PATH_LENGTH];
+				const char *shown = name;
+				uint32_t length = 0;
+				char item[112];
+
+				if (!xr.metric_samples[counter] ||
+					!XR_SUCCEEDED(xrPathToString(xr.instance, xr.metric_paths[counter], sizeof(name), &length, name)))
+				{
+					xr.metric_samples[counter] = 0;
+					continue;
+				}
+				/* ("/perfmetrics_meta/app/gpu_frametime": "app/gpu_frametime") */
+				if (strrchr(name, '/'))
+				{
+					const char *last = strrchr(name, '/');
+
+					shown = last;
+					while (shown > name && shown[-1] != '/')
+						shown--;
+					if (shown == name)
+						shown = last + 1;
+				}
+				snprintf(item, sizeof(item), " %s=%.3g/%.3g%s", shown, xr.metric_sums[counter] / xr.metric_samples[counter],
+					xr.metric_most[counter], xr.metric_units[counter] == XR_PERFORMANCE_METRICS_COUNTER_UNIT_MILLISECONDS_META ?
+					"ms" : xr.metric_units[counter] == XR_PERFORMANCE_METRICS_COUNTER_UNIT_PERCENTAGE_META ? "%" : "");
 				if (strlen(line) + strlen(item) < sizeof(line))
 					strcat(line, item);
+				xr.metric_sums[counter] = 0.0;
+				xr.metric_samples[counter] = 0;
 			}
-			host_logf(HOST_LOG_INFO, "xr: metrics%s, on core %d", line, sched_getcpu());
+			host_logf(HOST_LOG_INFO, "xr: metrics (mean/most)%s, on core %d", line, sched_getcpu());
 			if (xr.timed_frames)
 			{
 				double frames = (double)xr.timed_frames;
@@ -2035,10 +2136,10 @@ int host_xr_end_frame(const struct halo_xr_submit *submit)
 	end.layerCount = layer_count;
 	end.layers = layers;
 	{
-		double start = xr.has_metrics ? seconds_now() : 0.0;
+		double start = xr.log_metrics ? seconds_now() : 0.0;
 		int ended = xr_ok(xrEndFrame(xr.session, &end), "xrEndFrame");
 
-		if (xr.has_metrics)
+		if (xr.log_metrics)
 		{
 			xr.end_seconds += seconds_now() - start;
 			xr.timed_frames++;
@@ -2047,6 +2148,13 @@ int host_xr_end_frame(const struct halo_xr_submit *submit)
 	}
 }
 
+/* the app's GPU time of a recent frame (ms), 0 where the runtime does not
+tell it (XR_META_performance_metrics: the Quest's) */
+float host_xr_gpu_time(void)
+{
+	return xr.gpu_metric >= 0 ? xr.gpu_milliseconds : 0.0f;
+}
+
 void host_xr_set_vignette(float strength)
 {
 	xr.vignette = strength < 0.0f ? 0.0f : strength > 1.0f ? 1.0f : strength;
@@ -2167,7 +2275,7 @@ void host_xr_test(void)
 	SDL_GL_SetAttribute(SDL_GL_CONTEXT_PROFILE_MASK, SDL_GL_CONTEXT_PROFILE_ES);
 	SDL_GL_SetAttribute(SDL_GL_CONTEXT_MAJOR_VERSION, 3);
 	SDL_GL_SetAttribute(SDL_GL_CONTEXT_MINOR_VERSION, 2);
-	window = SDL_CreateWindow("Ringfall: Mjolnir VR", 640, 480, SDL_WINDOW_OPENGL | SDL_WINDOW_FULLSCREEN);
+	window = SDL_CreateWindow("Mjolnir VR", 640, 480, SDL_WINDOW_OPENGL | SDL_WINDOW_FULLSCREEN);
 	context = window ? SDL_GL_CreateContext(window) : NULL;
 	if (!context || !SDL_GL_MakeCurrent(window, context))
 		host_fatal("VR test: no OpenGL ES context: %s", SDL_GetError());

port/android/host_imports.list

@@ -32,6 +32,7 @@ host_sdl_set_clipboard_text
 host_sdl_get_clipboard_text
 host_sdl_show_toast
 host_sdl_show_simple_message_box
+host_sdl_show_message_box
 host_sdl_get_gamepads
 host_sdl_open_gamepad
 host_sdl_gamepad_from_id
@@ -58,6 +59,14 @@ host_gl_fence_frame
 host_gl_wait_frame
 host_gl_counters_snapshot
 host_gl_counters_read
+host_gl_worker_start
+host_gl_program_request
+host_gl_program_hurry
+host_gl_program_poll
+host_gl_program_binary
+host_gl_program_release
+host_gl_worker_waiting
+host_gl_program_warm_up
 host_xr_initialize
 host_xr_begin_frame
 host_xr_copy_layer
@@ -68,6 +77,7 @@ host_xr_set_vignette
 host_xr_copy_layer_array
 host_xr_refresh_rates
 host_xr_set_refresh_rate
+host_xr_gpu_time
 host_android_path
 host_gesture_insets
 host_touch_read

port/android/include/halo_android_abi.h

@@ -29,6 +29,8 @@ This header is included by both halves.
 /* the guest image is linked to run here, just above the Xbox window: ART
 keeps its heaps low in the address space and fills it upwards */
 #define HALO_GUEST_IMAGE_BASE 0x88000000u
+/* the room the host reserves for the image there (port/android/host/host_memory.c) */
+#define HALO_GUEST_IMAGE_RESERVE 0x04000000u
 
 /* the Xbox contiguous memory window (port/linux/src/platform.h) */
 #define HALO_GUEST_WINDOW_BASE 0x80000000u

port/android/steam_frame_install.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
-# Ringfall: Mjolnir VR's installer for the Steam Frame, run in its Desktop
-# Mode from the bundle the release's "Install Ringfall: Mjolnir VR" desktop
+# Mjolnir VR's installer for the Steam Frame, run in its Desktop
+# Mode from the bundle the release's "Install Mjolnir VR" desktop
 # file downloads (steam_frame_installer.desktop; the bundle: this script,
 # RingfallMjolnirVR.apk, ringfall-mjolnir-vr.sh = steam_frame_launch.sh,
 # steam_frame_xiso.py and the library pictures in grid/). Everything is
@@ -19,28 +19,31 @@
 #   Steam Frame Desktop Mode runs inside Gaming Mode's session, which ends
 #   with Steam. The shortcut of the builds before the name ("Halo VR") is
 #   left for the player to remove (Steam would write it back).
-# RINGFALL_UNATTENDED=1 answers every question with its default and prints
-# instead of showing dialogs (RINGFALL_IMAGE: the disc image to use), for
+# MJOLNIR_UNATTENDED=1 answers every question with its default and prints
+# instead of showing dialogs (MJOLNIR_IMAGE: the disc image to use), for
 # testing over adb; it never closes Steam.
 
 BUNDLE="$(cd "$(dirname "$0")" && pwd)"
 GAME_DIR="$HOME/Documents/RingfallMjolnirVR"
 STEAM_DIR="$HOME/.local/share/Steam"
 LEPTON="$STEAM_DIR/steamapps/common/Lepton/lepton"
-TITLE="Ringfall: Mjolnir VR"
-NAME="Ringfall: Mjolnir VR"
+TITLE="Mjolnir VR"
+NAME="Mjolnir VR"
 APK_NAME="RingfallMjolnirVR.apk"
 LAUNCHER="ringfall-mjolnir-vr.sh"
 EXE="\"$GAME_DIR/$LAUNCHER\""
 # (the desktop file Steam adds the game from)
-NAME_FILE="Ringfall Mjolnir VR"
+NAME_FILE="Mjolnir VR"
 # the builds before the name: their folder and Steam shortcut
 OLD_DIR="$HOME/Documents/HaloCE"
 OLD_NAME="Halo VR"
+# the name of builds 302 to 313, which their shortcut keeps (Steam writes
+# its shortcuts back from memory: the player renames it)
+FORMER_NAME="Ringfall: Mjolnir VR"
 
 # what the installer did, for looking into problems: written to /tmp while
 # it runs, then kept beside the game as install.log
-LOG="/tmp/ringfall-mjolnir-vr-install.log"
+LOG="/tmp/mjolnir-vr-install.log"
 : > "$LOG"
 log() { echo "$(date '+%F %T') $*" >> "$LOG"; }
 keep_log() { [ -d "$GAME_DIR" ] && cp -f "$LOG" "$GAME_DIR/install.log" 2>/dev/null; }
@@ -59,7 +62,7 @@ steam_running()
     pgrep -f 'ubuntu12_32/steam( |$)' >/dev/null || pgrep -x steam >/dev/null
 }
 
-unattended() { [ "${RINGFALL_UNATTENDED:-0}" = 1 ] || ! command -v zenity >/dev/null; }
+unattended() { [ "${MJOLNIR_UNATTENDED:-0}" = 1 ] || ! command -v zenity >/dev/null; }
 
 info()
 {
@@ -185,7 +188,7 @@ PYTHON
 # must run), from a desktop file beside the game; then its pictures
 add_shortcut()
 {
-    local desktop="$GAME_DIR/$NAME_FILE.desktop" url file id
+    local desktop="$GAME_DIR/$NAME_FILE.desktop" url
     printf '[Desktop Entry]\nType=Application\nName=%s\nExec=%s\nPath=%s\nIcon=steam\nTerminal=false\n' \
         "$NAME" "$GAME_DIR/$LAUNCHER" "$GAME_DIR" > "$desktop" && chmod 755 "$desktop" || return 1
     url="steam://addnonsteamgame/$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$desktop")"
@@ -195,6 +198,16 @@ add_shortcut()
     steam "$url" >/dev/null 2>&1 &
     for _ in $(seq 30); do have_shortcut && break; sleep 1; done
     have_shortcut || return 1
+    add_pictures
+    return 0
+}
+
+# the library pictures of the game's shortcut, for every Steam user who has
+# it (again on an update: the builds before the name "Mjolnir VR" had
+# Ringfall's)
+add_pictures()
+{
+    local file id
     while read -r file; do
         id="$(shortcut_id "$file" "$EXE")" || continue
         log "shortcut $id in $file"
@@ -204,7 +217,6 @@ add_shortcut()
         cp "$BUNDLE/grid/library_hero.png" "$(dirname "$file")/grid/${id}_hero.png"
         cp "$BUNDLE/grid/library_logo.png" "$(dirname "$file")/grid/${id}_logo.png"
     done < <(shortcut_files)
-    return 0
 }
 
 # --- the game
@@ -237,11 +249,15 @@ cp "$BUNDLE/$LAUNCHER" "$GAME_DIR/$LAUNCHER.tmp" && chmod 755 "$GAME_DIR/$LAUNCH
 cp "$BUNDLE/$APK_NAME" "$GAME_DIR/$APK_NAME.tmp" && chmod 666 "$GAME_DIR/$APK_NAME.tmp" &&
     mv -f "$GAME_DIR/$APK_NAME.tmp" "$GAME_DIR/$APK_NAME" && touch "$GAME_DIR/$APK_NAME" ||
     fail "Could not write $GAME_DIR/$APK_NAME (is the storage full?)."
+# (the build's number: the launcher updates from it, steam_frame_launch.sh;
+# an update fetched for an older build is dropped)
+cp "$BUNDLE/build.txt" "$GAME_DIR/build.txt" 2>/dev/null || rm -f "$GAME_DIR/build.txt"
+rm -rf "$GAME_DIR/update"
 
 # --- the game data
 
 if [ ! -f "$GAME_DIR/maps/ui.map" ]; then
-    image="${RINGFALL_IMAGE:-}"
+    image="${MJOLNIR_IMAGE:-}"
     if [ -z "$image" ]; then
         mapfile -t images < <(find_images)
         for candidate in "${images[@]}"; do
@@ -267,6 +283,7 @@ fi
 
 if have_shortcut; then
     log "the Steam shortcut is there"
+    add_pictures
 elif unattended; then
     echo "info: the Steam shortcut is missing (not added unattended)"
 elif ! steam_running; then
@@ -282,6 +299,9 @@ fi
 if have_shortcut_to "$OLD_DIR/halo-vr.sh"; then
     info "The library still shows the old \"$OLD_NAME\" from before the game's new name. It no longer starts: remove it in Steam (its gear or Manage > Remove non-Steam game)."
 fi
+if have_shortcut_to "$FORMER_NAME"; then
+    info "The library shows the game by its former name, \"$FORMER_NAME\". To call it $NAME there: its gear > Properties, then its name at the top."
+fi
 if ask "$NAME is installed.${image_note:-}\n\nSwitch to Gaming Mode now? Start $NAME from your library there (its pictures may show once Steam starts again)." yes; then
     steamos-session-select gamescope >/dev/null 2>&1 ||
         info "Switch to Gaming Mode yourself (the \"Return to Gaming Mode\" icon or the power menu)."

port/android/steam_frame_installer.desktop

@@ -1,14 +1,14 @@
 [Desktop Entry]
-# Ringfall: Mjolnir VR's installer for the Steam Frame
+# Mjolnir VR's installer for the Steam Frame
 # (port/android/STEAM_FRAME.md): a release asset,
-# "Install-Ringfall-Mjolnir-VR.desktop", opened in Desktop Mode. It downloads
+# "Install-Mjolnir-VR.desktop", opened in Desktop Mode. It downloads
 # the latest release's bundle (tools/steam_frame_bundle.py, which fills in
 # the repository) and runs its installer, steam_frame_install.sh.
 # (no "$", "\" or "%" in Exec: the desktop entry format would need them
 # escaped)
 Type=Application
-Name=Install Ringfall: Mjolnir VR
-Comment=Installs Ringfall: Mjolnir VR for the Steam Frame, or updates it
+Name=Install Mjolnir VR
+Comment=Installs Mjolnir VR for the Steam Frame, or updates it
 Icon=steam
 Terminal=false
-Exec=bash -c "if curl -fL --retry 3 -o /tmp/ringfall-mjolnir-vr-steam-frame.zip https://github.com/@REPOSITORY@/releases/latest/download/ringfall-mjolnir-vr-steam-frame.zip && rm -rf /tmp/ringfall-mjolnir-vr-install && python3 -m zipfile -e /tmp/ringfall-mjolnir-vr-steam-frame.zip /tmp/ringfall-mjolnir-vr-install; then exec bash /tmp/ringfall-mjolnir-vr-install/install.sh; else zenity --error --width=460 --title='Ringfall: Mjolnir VR' --text='Ringfall: Mjolnir VR could not be downloaded. Is the Steam Frame online?'; fi"
+Exec=bash -c "if curl -fL --retry 3 -o /tmp/mjolnir-vr-steam-frame.zip https://github.com/@REPOSITORY@/releases/latest/download/mjolnir-vr-steam-frame.zip && rm -rf /tmp/mjolnir-vr-install && python3 -m zipfile -e /tmp/mjolnir-vr-steam-frame.zip /tmp/mjolnir-vr-install; then exec bash /tmp/mjolnir-vr-install/install.sh; else zenity --error --width=460 --title='Mjolnir VR' --text='Mjolnir VR could not be downloaded. Is the Steam Frame online?'; fi"

port/android/steam_frame_launch.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Ringfall: Mjolnir VR on the Steam Frame: Lepton runs the APK in a container of its own,
+# Mjolnir VR on the Steam Frame: Lepton runs the APK in a container of its own,
 # and installs it anew whenever the APK is newer than the installed one
 # (port/android/STEAM_FRAME.md). The game's data: ~/Documents/RingfallMjolnirVR.
 # (a container of its own, not the shortcut's id: with that, SteamVR's
@@ -70,6 +70,75 @@ run()
     child=0
 }
 
+# Updates (update.auto in config.toml; the game's own updater, the Quest's,
+# does nothing here: Lepton installs the APK in this folder each start).
+# While the game runs, the latest release is looked for; a newer one's
+# bundle is fetched into update/, checked, and put in place as the next
+# start begins, before Lepton runs the APK (it installs the newer one).
+# A build that knows no number of its own (build.txt: a local one) never
+# looks. Nothing changes without the internet, or when anything fails.
+REPOSITORY="@REPOSITORY@"
+UPDATE="$DATA/update"
+BUILD_FILE="$DATA/build.txt"
+SELF="$DATA/ringfall-mjolnir-vr.sh"
+
+update_apply()
+{
+    local new="$UPDATE/bundle" build
+    [ -f "$UPDATE/ready" ] || { rm -rf "$UPDATE"; return 0; }
+    build=$(cat "$new/build.txt" 2>/dev/null)
+    # (the launcher renamed over this one: bash goes on reading its own copy)
+    if cp "$new/ringfall-mjolnir-vr.sh" "$SELF.tmp" && chmod 755 "$SELF.tmp" &&
+        cp "$new/RingfallMjolnirVR.apk" "$APK.tmp" && chmod 666 "$APK.tmp" &&
+        mv -f "$SELF.tmp" "$SELF" && mv -f "$APK.tmp" "$APK" && touch "$APK" &&
+        cp "$new/build.txt" "$BUILD_FILE"
+    then
+        log "update: build $build put in place"
+    else
+        log "update: build $build could not be put in place"
+        rm -f "$SELF.tmp" "$APK.tmp"
+    fi
+    rm -rf "$UPDATE"
+}
+
+update_wanted()
+{
+    # (update.auto = false in config.toml's [update]: never)
+    ! awk '/^\[/ { section = $0 } section == "[update]" && /^[ \t]*auto[ \t]*=/ { print $3 }' \
+        "$DATA/config.toml" 2>/dev/null | grep -q false
+}
+
+update_check()
+{
+    local installed latest
+    installed=$(cat "$BUILD_FILE" 2>/dev/null)
+    [[ "$installed" =~ ^[0-9]+$ ]] && (( installed > 0 )) || return 0
+    update_wanted || return 0
+    latest=$(curl -fsSL --max-time 20 -H "Accept: application/vnd.github+json" \
+        "https://api.github.com/repos/$REPOSITORY/releases/latest" |
+        python3 -I -c 'import json, sys; print(json.load(sys.stdin)["tag_name"].rpartition("-")[2])' 2>/dev/null)
+    [[ "$latest" =~ ^[0-9]+$ ]] && (( latest > installed )) || return 0
+    log "update: build $latest found (this is $installed), fetching it"
+    rm -rf "$UPDATE" && mkdir -p "$UPDATE" || return 0
+    if curl -fsSL --retry 2 --max-time 900 -o "$UPDATE/bundle.zip" \
+            "https://github.com/$REPOSITORY/releases/download/build-$latest/mjolnir-vr-steam-frame.zip" &&
+        python3 -I -m zipfile -e "$UPDATE/bundle.zip" "$UPDATE/bundle" &&
+        [ "$(cat "$UPDATE/bundle/build.txt" 2>/dev/null)" = "$latest" ] &&
+        [ -s "$UPDATE/bundle/RingfallMjolnirVR.apk" ] && [ -s "$UPDATE/bundle/ringfall-mjolnir-vr.sh" ]
+    then
+        rm -f "$UPDATE/bundle.zip"
+        touch "$UPDATE/ready"
+        log "update: build $latest fetched, put in place at the next start"
+    else
+        log "update: build $latest could not be fetched"
+        rm -rf "$UPDATE"
+    fi
+}
+
+update_apply
+update_check </dev/null >/dev/null 2>&1 &
+updater=$!
+
 # (a new APK is only installed on its first start, not started; and a start
 # right after a game that was ended hard can fail in SteamVR, which then
 # needs a moment: again, up to three times, while it ends within 30 s)
@@ -83,4 +152,7 @@ for attempt in 1 2 3; do
     sleep 5
 done
 rm -f "$QUIT"
+# (a fetch still under way is given up: the next start looks again)
+pkill -P "$updater" 2>/dev/null
+kill "$updater" 2>/dev/null
 log "end"

port/android/steam_frame_xiso.py

@@ -1,66 +1,50 @@
 #!/usr/bin/env python3
 """
-Copies the maps folder out of an Xbox disc image (an "xiso", or a whole
-disc's ".iso") on the Steam Frame's SteamOS side, for its installer
-(steam_frame_install.sh). It reads the image as the app's own import does
+Copies the maps folder out of the player's Xbox disc image of Halo (an
+"xiso", or a whole disc's ".iso") on the Steam Frame's SteamOS side, for
+its installer (steam_frame_install.sh), as the app's own import does
 (app/src/main/java/com/halo/decomp/XisoExtractor.java, which this follows;
 the desktop games' is port/linux/src/xiso.c).
 
     steam_frame_xiso.py <image> <destination>
 
-writes <destination>/maps (through maps.partial, so an interrupted copy
-never leaves maps/ui.map behind) and prints its progress for zenity
---progress: a percentage on a line of its own, and "# <text>" lines. On
-failure it prints "error: <reason the player can act on>" to stderr and
-exits 1.
+writes <destination>/maps (through maps.partial, ui.map moved in last, so
+an interrupted copy never leaves maps/ui.map behind) and prints its
+progress for zenity --progress: a percentage on a line of its own, and
+"# <text>" lines. On failure it prints "error: <reason the player can act
+on>" to stderr and exits 1.
 
-The image's file system is XDVDFS, read as extract-xiso does
-(https://github.com/XboxDev/extract-xiso, extract-xiso.c, whose format
-handling this follows; its license is below and in
-port/third_party/extract-xiso/LICENSE.TXT): 2048-byte sectors; a volume
-descriptor at 0x10000 that starts and ends with "MICROSOFT*XBOX*MEDIA" and
-gives the root directory's sector and size; and directories whose entries
-form a binary tree (each entry: left and right subtree offsets in 4-byte
-units, the start sector, the size, attributes, the name's length and the
-name). Images made from a whole disc put the game partition further in, at
-one of the offsets below.
+Written from a description of the Xbox's disc file system, XDVDFS
+(xboxdevwiki's XDVDFS page, https://xboxdevwiki.net/XDVDFS), as
+XisoExtractor.java is:
 
-Some parts of this code are copyright in@fishtank.com. This product
-includes software developed by in <in@fishtank.com>.
+- Sectors are 2048 bytes and integers little-endian. Sector numbers count
+  from the start of the game partition: an image of the partition alone has
+  it at 0, an image of a whole disc further in (PARTITION_STARTS, tried in
+  that order).
+- The volume descriptor is the partition's sector 32 (at 0x10000). It holds
+  "MICROSOFT*XBOX*MEDIA" at its start and again at 0x7EC, and the root
+  directory table's start sector (u32 at 0x14) and size in bytes (u32 at
+  0x18).
+- A directory table is a binary tree of entries whose root is the entry at
+  offset 0. An entry is a left and a right subtree link (u16 each, in 4-byte
+  units from the table's start, 0 for none), the start sector and the size
+  of the file or of the subdirectory's table (u32 each), the attributes (u8,
+  0x10 for a directory), the name's length (u8) and the name. Unused bytes
+  are 0xFF, so a left link of 0xFFFF is padding, not an entry.
+- A file is one contiguous run of bytes from the start of its sector.
 
-Copyright (c) 2003 in <in@fishtank.com>
-All rights reserved.
+The image is the player's file and nothing read from it is trusted: only
+the root's table and the maps folder's are read, each whole and at most
+4 MB; a table's walk visits each offset once, goes at most 64 links deep
+and looks at most 4096 entries; and a file is written only under a plain
+name that no file before it had (ignoring case).
 
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-
-3. All advertising materials mentioning features or use of this software
-   must display the following acknowledgement:
-
-   This product includes software developed by in <in@fishtank.com>.
-
-4. Neither the name of "in" nor the email address "in@fishtank.com"
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED `AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES
-INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
-FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
-AUTHOR OR ANY CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
-OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
-WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
-OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
-ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+A European disc in two languages (Spanish and Italian) has no maps folder
+but one for each, maps_es and maps_it: the one for the language asked for
+(MJOLNIR_LANGUAGE, else the system's) is taken, else English's, else the
+first, and its language written to maps/language.txt, which the game takes
+as the Xbox's language while game.language is unset.
 """
 
 import os
@@ -68,117 +52,170 @@ import struct
 import sys
 
 SECTOR_SIZE = 2048
-VOLUME_DESCRIPTOR_OFFSET = 0x10000
-ENTRY_HEADER_SIZE = 14
+DESCRIPTOR_OFFSET = 0x10000
+MAGIC = b"MICROSOFT*XBOX*MEDIA"
+SECOND_MAGIC_OFFSET = 0x7EC
+ENTRY_FIXED_SIZE = 14
 ATTRIBUTE_DIRECTORY = 0x10
+PADDING_LINK = 0xFFFF
+# where the game partition may start: an image of the partition alone, a
+# whole XGD2, XGD3 and XGD1 (the original Xbox's) disc
+PARTITION_STARTS = (0x00000000, 0x0FD90000, 0x02080000, 0x18300000)
 # directory tables are a few sectors; anything much larger is not one
-MAXIMUM_DIRECTORY_SIZE = 4 << 20
-MAXIMUM_FILES = 256
-COPY_BUFFER_SIZE = 1 << 20
-VOLUME_MAGIC = b"MICROSOFT*XBOX*MEDIA"
-# where the game partition starts: a plain image, and whole-disc images
-# (extract-xiso's GLOBAL, XGD3 and XGD1 offsets)
-PARTITION_OFFSETS = (0, 0x0FD90000, 0x02080000, 0x18300000)
+MAXIMUM_TABLE_SIZE = 4 << 20
+MAXIMUM_DEPTH = 64
+MAXIMUM_VISITS = 4096
+MAXIMUM_ENTRIES = 256
+COPY_CHUNK = 1 << 20
+PARTIAL_DIRECTORY = "maps.partial"
 
 
 class ExtractError(Exception):
     """a reason the player can act on"""
 
 
-def read_at(image, offset, size):
-    image.seek(offset)
+def read_exactly(image, position, size):
+    """size bytes of the image from position; None if it ends first"""
+    image.seek(position)
     data = image.read(size)
-    if len(data) != size:
-        raise ExtractError("Could not read the disc image (is it complete?).")
-    return data
+    return data if len(data) == size else None
 
 
-def find_volume(image):
-    """the game partition's offset, and the root directory's sector and size"""
-    for offset in PARTITION_OFFSETS:
-        try:
-            descriptor = read_at(image, offset + VOLUME_DESCRIPTOR_OFFSET, SECTOR_SIZE)
-        except ExtractError:
+def find_partition(image, image_size):
+    """the game partition's start, and the root table's sector and size"""
+    for start in PARTITION_STARTS:
+        if start + DESCRIPTOR_OFFSET + SECTOR_SIZE > image_size:
             continue
-        if descriptor[:20] != VOLUME_MAGIC or descriptor[0x7EC:0x7EC + 20] != VOLUME_MAGIC:
+        descriptor = read_exactly(image, start + DESCRIPTOR_OFFSET, SECTOR_SIZE)
+        if (descriptor is None or descriptor[:len(MAGIC)] != MAGIC or
+                descriptor[SECOND_MAGIC_OFFSET:SECOND_MAGIC_OFFSET + len(MAGIC)] != MAGIC):
             continue
-        sector, size = struct.unpack_from("<II", descriptor, 20)
-        return offset, sector, size
+        sector, size = struct.unpack_from("<II", descriptor, 0x14)
+        return start, sector, size
     raise ExtractError("This is not an Xbox disc image.")
 
 
-def read_directory(image, partition, sector, size, what):
-    if size <= 0 or size > MAXIMUM_DIRECTORY_SIZE:
-        raise ExtractError(what)
-    return read_at(image, partition + sector * SECTOR_SIZE, size)
+def read_table(image, partition, sector, size, damaged):
+    if size == 0 or size > MAXIMUM_TABLE_SIZE:
+        raise ExtractError(damaged)
+    table = read_exactly(image, partition + sector * SECTOR_SIZE, size)
+    if table is None:
+        raise ExtractError("Could not read the disc image (is it complete?).")
+    return table
 
 
-def walk(table, offset, depth, directories, out, visited):
-    """collects the entries (name, sector, size) of the subtree at offset
-    (4-byte units), files or directories as asked"""
-    at = offset * 4
-    # a malformed table must not loop or run off its end
-    visited[0] += 1
-    if depth > 64 or visited[0] > 4096 or at + ENTRY_HEADER_SIZE > len(table):
-        return
-    left, right, sector, size, attributes, name_length = struct.unpack_from("<HHIIBB", table, at)
-    # 0xFFFF: padding, an empty directory
-    if left == 0xFFFF:
-        return
-    if left:
-        walk(table, left, depth + 1, directories, out, visited)
-    is_directory = bool(attributes & ATTRIBUTE_DIRECTORY)
-    if (at + ENTRY_HEADER_SIZE + name_length <= len(table) and name_length > 0
-            and is_directory == directories and len(out) < MAXIMUM_FILES):
-        name = table[at + ENTRY_HEADER_SIZE:at + ENTRY_HEADER_SIZE + name_length].decode("latin-1")
-        # (as extract-xiso refuses them: no name may leave the folder)
-        if name not in (".", "..") and "/" not in name and "\\" not in name:
-            out.append((name, sector, size))
-    if right:
-        walk(table, right, depth + 1, directories, out, visited)
+def is_plain_name(name):
+    """no path, no . or .., and only printable ASCII that every file system
+    takes as a plain name"""
+    if not name or name in (".", ".."):
+        return False
+    return all(0x20 <= ord(character) <= 0x7E and character not in '/\\:*?"<>|' for character in name)
+
+
+def walk_table(table, directories):
+    """the folders (or the files) of a table with plain names, as (name,
+    sector, size), in the tree's order: each entry's left subtree, the entry,
+    its right subtree; a link to padding, past the table or back to an entry
+    already visited ends that branch"""
+    entries, visited = [], set()
+    visits = [0]
+
+    def walk(offset, depth):
+        if depth > MAXIMUM_DEPTH or visits[0] >= MAXIMUM_VISITS:
+            return
+        if offset >= len(table) or len(table) - offset < ENTRY_FIXED_SIZE:
+            return
+        left, right = struct.unpack_from("<HH", table, offset)
+        if left == PADDING_LINK or offset // 4 in visited:
+            return
+        visited.add(offset // 4)
+        visits[0] += 1
+        if left:
+            walk(left * 4, depth + 1)
+        name_length = table[offset + 13]
+        if name_length and name_length <= len(table) - offset - ENTRY_FIXED_SIZE:
+            is_directory = bool(table[offset + 12] & ATTRIBUTE_DIRECTORY)
+            name = table[offset + ENTRY_FIXED_SIZE:offset + ENTRY_FIXED_SIZE + name_length].decode("latin-1")
+            # (the destination's file system may ignore case)
+            if (is_directory == directories and len(entries) < MAXIMUM_ENTRIES and is_plain_name(name) and
+                    all(entry[0].lower() != name.lower() for entry in entries)):
+                sector, size = struct.unpack_from("<II", table, offset + 4)
+                entries.append((name, sector, size))
+        if right:
+            walk(right * 4, depth + 1)
+
+    walk(0, 0)
+    return entries
+
+
+def maps_language(name):
+    """a language's maps folder's language ("maps_it": "it"), else None"""
+    if len(name) == 7 and name[:5].lower() == "maps_" and name[5:].isalpha():
+        return name[5:].lower()
+    return None
+
+
+def choose_maps(folders):
+    """the maps folder, and its language (None for a plain "maps")"""
+    for folder in folders:
+        if folder[0].lower() == "maps":
+            return folder, None
+    languages = [(maps_language(folder[0]), folder) for folder in folders if maps_language(folder[0])]
+    wanted = (os.environ.get("MJOLNIR_LANGUAGE") or os.environ.get("LC_ALL") or
+        os.environ.get("LC_MESSAGES") or os.environ.get("LANG") or "")[:2].lower()
+    for preferred in (wanted, "en"):
+        for language, folder in languages:
+            if language == preferred:
+                return folder, language
+    if languages:
+        return languages[0][1], languages[0][0]
+    raise ExtractError("The disc image has no maps folder: it is not a Halo disc.")
 
 
 def extract(image_path, destination):
     with open(image_path, "rb") as image:
-        partition, root_sector, root_size = find_volume(image)
+        image_size = os.fstat(image.fileno()).st_size
+        partition, root_sector, root_size = find_partition(image, image_size)
 
         # the root's maps folder
-        table = read_directory(image, partition, root_sector, root_size,
-            "The disc image's file system is damaged.")
-        directories = []
-        walk(table, 0, 0, True, directories, [0])
-        maps = [entry for entry in directories if entry[0].lower() == "maps"]
-        if not maps:
-            raise ExtractError("The disc image has no maps folder: it is not a Halo disc.")
+        root = read_table(image, partition, root_sector, root_size, "The disc image's file system is damaged.")
+        (_, maps_sector, maps_size), language = choose_maps(walk_table(root, True))
 
         # its files
-        table = read_directory(image, partition, maps[-1][1], maps[-1][2],
-            "The disc image's maps folder is damaged.")
-        files = []
-        walk(table, 0, 0, False, files, [0])
-        if not any(name.lower() == "ui.map" for name, _, _ in files):
+        table = read_table(image, partition, maps_sector, maps_size, "The disc image's maps folder is damaged.")
+        files = walk_table(table, False)
+        user_interface = next((file for file in files if file[0].lower() == "ui.map"), None)
+        if user_interface is None:
             raise ExtractError("The disc image's maps folder has no ui.map: it is not a Halo disc.")
+        # (an image that ends before a file does is refused before anything
+        # is written; an empty file's sector need not be anywhere)
+        for name, sector, size in files:
+            if size and partition + sector * SECTOR_SIZE + size > image_size:
+                raise ExtractError("Could not read %s from the disc image (is it complete?)." % name)
         total = sum(size for _, _, size in files) or 1
 
-        partial = os.path.join(destination, "maps.partial")
-        finished = os.path.join(destination, "maps")
+        # the copy, to maps.partial (emptied of what an earlier attempt left)
+        partial = os.path.join(destination, PARTIAL_DIRECTORY)
         try:
             os.makedirs(partial, exist_ok=True)
+            for leftover in os.listdir(partial):
+                os.remove(os.path.join(partial, leftover))
         except OSError:
             raise ExtractError("Could not create %s." % partial)
-        done = 0
-        shown = -1
+        done, shown = 0, -1
         for name, sector, size in files:
             path = os.path.join(partial, name)
-            offset = partition + sector * SECTOR_SIZE
-            remaining = size
+            position, remaining = partition + sector * SECTOR_SIZE, size
             print("# Copying maps/%s" % name, flush=True)
             try:
                 with open(path, "wb") as out:
                     while remaining > 0:
-                        count = min(remaining, COPY_BUFFER_SIZE)
-                        out.write(read_at(image, offset, count))
-                        offset += count
+                        count = min(remaining, COPY_CHUNK)
+                        data = read_exactly(image, position, count)
+                        if data is None:
+                            raise ExtractError("Could not read %s from the disc image (is it complete?)." % name)
+                        out.write(data)
+                        position += count
                         remaining -= count
                         done += count
                         # (zenity closes at 100: that is left to the caller)
@@ -186,15 +223,22 @@ def extract(image_path, destination):
                         if percent != shown:
                             print(percent, flush=True)
                             shown = percent
-            except ExtractError:
-                raise ExtractError("Could not read %s from the disc image (is it complete?)." % name)
             except OSError:
                 raise ExtractError("Could not write %s (is the storage full?)." % path)
 
-    # (the maps folder may be there, empty)
+    # then into maps (which may be there, empty), the language before and
+    # ui.map (the sign that the data is there) last
+    finished = os.path.join(destination, "maps")
     try:
         os.makedirs(finished, exist_ok=True)
-        for name, _, _ in files:
+        language_file = os.path.join(finished, "language.txt")
+        if os.path.exists(language_file):
+            os.remove(language_file)
+        if language:
+            with open(language_file, "w") as out:
+                out.write(language + "\n")
+        order = [file for file in files if file is not user_interface] + [user_interface]
+        for name, _, _ in order:
             os.replace(os.path.join(partial, name), os.path.join(finished, name))
         os.rmdir(partial)
     except OSError as error:

port/android/tests/host_watch_hash_test.c

@@ -32,6 +32,7 @@ struct fixture
 	uint64_t hash[PAGES];
 	uint32_t hashed_frame[PAGES];
 	uint32_t generation[PAGES];
+	uint8_t unchanged[PAGES];
 	volatile uint32_t current;
 	struct watch_hash watch;
 };
@@ -197,6 +198,59 @@ static void test_ranges_are_clamped(void)
 	teardown(&f);
 }
 
+/* a page unchanged for long: hashed every few frames, or at once again
+after a write is announced */
+static void test_stable_page_is_hashed_less_often(void)
+{
+	struct fixture f;
+	uint32_t before, check, frame;
+
+	setup(&f);
+	f.watch.unchanged = f.unchanged;
+	watch_hash_protect(&f.watch, 1, 1);
+	for (check = 0; check < WATCH_HASH_STABLE_CHECKS; check++)
+	{
+		watch_hash_begin_frame(&f.watch);
+		watch_hash_generation(&f.watch, 1, 1);
+	}
+	CHECK(f.unchanged[1] == WATCH_HASH_STABLE_CHECKS);
+	before = watch_hash_generation(&f.watch, 1, 1);
+	*byte_of(&f, 1, 40) ^= 1;
+	watch_hash_begin_frame(&f.watch);
+	CHECK(watch_hash_generation(&f.watch, 1, 1) == before);
+	/* seen within WATCH_HASH_STABLE_FRAMES frames all the same */
+	for (frame = 2; frame < WATCH_HASH_STABLE_FRAMES; frame++)
+	{
+		watch_hash_begin_frame(&f.watch);
+		watch_hash_generation(&f.watch, 1, 1);
+	}
+	watch_hash_begin_frame(&f.watch);
+	CHECK(watch_hash_generation(&f.watch, 1, 1) > before);
+	CHECK(f.unchanged[1] == 0);
+	teardown(&f);
+}
+
+static void test_announced_write_is_seen_next_frame(void)
+{
+	struct fixture f;
+	uint32_t before, check;
+
+	setup(&f);
+	f.watch.unchanged = f.unchanged;
+	watch_hash_protect(&f.watch, 2, 2);
+	for (check = 0; check < WATCH_HASH_STABLE_CHECKS; check++)
+	{
+		watch_hash_begin_frame(&f.watch);
+		watch_hash_generation(&f.watch, 2, 2);
+	}
+	before = watch_hash_generation(&f.watch, 2, 2);
+	watch_hash_prepare_write(&f.watch, 2, 2);
+	*byte_of(&f, 2, 4000) ^= 1;
+	watch_hash_begin_frame(&f.watch);
+	CHECK(watch_hash_generation(&f.watch, 2, 2) > before);
+	teardown(&f);
+}
+
 int main(void)
 {
 	test_unchanged_page_keeps_generation();
@@ -208,6 +262,8 @@ int main(void)
 	test_range_returns_newest();
 	test_begin_frame_changes_serial();
 	test_ranges_are_clamped();
+	test_stable_page_is_hashed_less_often();
+	test_announced_write_is_seen_next_frame();
 	if (failures)
 		printf("%d failures\n", failures);
 	else

port/android/tests/mirror_upload_test.c

@@ -0,0 +1,223 @@
+/* Real mirror decisions with a delayed, renaming GPU. No API failures. */
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef int BOOL;
+typedef unsigned GLuint, GLenum;
+#define TRUE 1
+#define FALSE 0
+#ifndef TEST_DESKTOP
+#define HALO_GLES 1
+#endif
+#define STREAM_BUFFER_RING 3
+#define GL_COPY_WRITE_BUFFER 1
+#define GL_DYNAMIC_DRAW 2
+#define SEGMENT_SIZE 0x400000u
+#define PLATFORM_CONTIGUOUS_SIZE (2 * SEGMENT_SIZE)
+static unsigned char cpu[PLATFORM_CONTIGUOUS_SIZE];
+#define PLATFORM_CONTIGUOUS_BASE ((unsigned long)cpu)
+#define CHECK(x) do { if (!(x)) { fprintf(stderr, "line %d: %s\n", __LINE__, #x); exit(1); } } while (0)
+static struct { unsigned long frame, buffer_ring; } device;
+static struct { unsigned long mirrored_bytes; } stats;
+static unsigned long generations[PLATFORM_CONTIGUOUS_SIZE / 4096], serial;
+static unsigned mapped, subdata, overlaps, draws, mismatches, uploads;
+static unsigned watch_reads, protections;
+
+/* A subdata update may rename storage immediately and queue preservation
+of the old store plus its changed bytes. A later unsynchronized write to
+the new store can then be overwritten, even at a disjoint offset. */
+static unsigned char *stores[2];
+static GLuint bound, next_buffer;
+struct command
+{
+    struct command *next;
+    unsigned char *source, *destination, *expected;
+    unsigned long offset, size, sequence;
+};
+static struct command *head, *tail;
+static unsigned long submitted, fences[STREAM_BUFFER_RING];
+
+static void enqueue(unsigned char *source, unsigned char *destination,
+    unsigned char *expected, unsigned long offset, unsigned long size)
+{
+    struct command *command = calloc(1, sizeof(*command));
+    CHECK(command);
+    command->source = source;
+    command->destination = destination;
+    command->expected = expected;
+    command->offset = offset;
+    command->size = size;
+    command->sequence = ++submitted;
+    if (tail) tail->next = command;
+    else head = command;
+    tail = command;
+}
+
+static void complete(unsigned long sequence)
+{
+    while (head && head->sequence <= sequence)
+    {
+        struct command *command = head;
+        if (command->expected)
+        {
+            draws++;
+            if (memcmp(command->source + command->offset, command->expected, command->size)) mismatches++;
+            free(command->expected);
+        }
+        else
+        {
+            memcpy(command->destination + command->offset, command->source, command->size);
+            free(command->source);
+        }
+        head = command->next;
+        free(command);
+    }
+    if (!head) tail = NULL;
+}
+
+static void host_gl_fence_frame(unsigned slot) { fences[slot] = submitted; }
+static void host_gl_wait_frame(unsigned slot) { complete(fences[slot]); }
+
+static void next_frame(void)
+{
+    /* The actual fence/rotation/wait statements from Present. */
+#include "rotation.inc"
+    device.frame++;
+}
+
+static unsigned long memory_watch_generation(unsigned long address, unsigned long size)
+{
+    unsigned long page = (address - PLATFORM_CONTIGUOUS_BASE) / 4096;
+    unsigned long last = (address - PLATFORM_CONTIGUOUS_BASE + size - 1) / 4096, newest = 0;
+    watch_reads++;
+    for (; page <= last; page++) if (generations[page] > newest) newest = generations[page];
+    return newest;
+}
+static void memory_watch_protect(unsigned long address, unsigned long size) { (void)address; (void)size; protections++; }
+static void write_pages(unsigned first, unsigned count, unsigned char value)
+{
+    unsigned page;
+    for (page = first; page < first + count; page++) generations[page] = ++serial;
+    memset(cpu + first * 4096, value, count * 4096);
+}
+static void glGenBuffers(int count, GLuint *buffer) { CHECK(count == 1 && next_buffer < 2); *buffer = ++next_buffer; }
+static void glBindBuffer(GLenum target, GLuint buffer) { CHECK(target == GL_COPY_WRITE_BUFFER && buffer && buffer <= 2); bound = buffer - 1; }
+static void glBufferData(GLenum target, unsigned long size, const void *data, GLenum usage)
+{
+    CHECK(target == GL_COPY_WRITE_BUFFER && size == SEGMENT_SIZE && !data && usage == GL_DYNAMIC_DRAW);
+    stores[bound] = calloc(1, size);
+    CHECK(stores[bound]);
+}
+static void buffer_upload(GLenum target, unsigned long offset, unsigned long size, const void *data)
+{
+    unsigned char *old = stores[bound], *copy = malloc(size);
+    CHECK(target == GL_COPY_WRITE_BUFFER && offset + size <= SEGMENT_SIZE && copy);
+    stores[bound] = calloc(1, SEGMENT_SIZE);
+    CHECK(stores[bound]);
+    memcpy(copy, data, size);
+    enqueue(old, stores[bound], NULL, 0, SEGMENT_SIZE);
+    enqueue(copy, stores[bound], NULL, offset, size);
+    subdata++;
+    uploads++;
+}
+static void host_gl_buffer_write(GLenum target, unsigned offset, unsigned size, const void *data)
+{
+    struct command *command;
+    CHECK(target == GL_COPY_WRITE_BUFFER && offset + size <= SEGMENT_SIZE);
+    for (command = head; command; command = command->next)
+    {
+        if (command->destination == stores[bound] && offset < command->offset + command->size &&
+            command->offset < offset + size) overlaps++;
+        if (command->expected && command->source == stores[bound] && offset < command->offset + command->size &&
+            command->offset < offset + size) overlaps++;
+    }
+    memcpy(stores[bound] + offset, data, size);
+    mapped++;
+    uploads++;
+}
+
+#include "mirror.inc"
+
+static int draw_pages(unsigned first, unsigned count)
+{
+    GLuint buffer;
+    unsigned long offset;
+    unsigned char *expected;
+    if (!mirror_range(PLATFORM_CONTIGUOUS_BASE + first * 4096, count * 4096, &buffer, &offset, NULL)) return 0;
+    expected = malloc(count * 4096);
+    CHECK(expected);
+    memcpy(expected, cpu + first * 4096, count * 4096);
+    enqueue(stores[buffer - 1], NULL, expected, offset, count * 4096);
+    return 1;
+}
+
+int main(int argc, char **argv)
+{
+    unsigned index, old_uploads;
+    int rollover = argc > 1 && !strcmp(argv[1], "rollover");
+    device.frame = rollover ? ~0UL - 1 : 100;
+#ifdef HALO_ANDROID
+    /* First-use and reused ranges must always go to the caller's existing
+    streaming path, without creating GPU storage or consulting tracking. */
+    for (index = 0; index < 1200; index++)
+    {
+        GLuint buffer = 99;
+        unsigned long offset = 77, generation = 55;
+        write_pages(0, 300, (unsigned char)index);
+        CHECK(!mirror_range(PLATFORM_CONTIGUOUS_BASE, 300 * 4096, &buffer, &offset, &generation));
+        CHECK(buffer == 99 && offset == 77 && generation == 55);
+        CHECK(!draw_pages(0, 1));
+        CHECK(!draw_pages(1023, 2));
+        CHECK(!draw_pages(1024, 1));
+        next_frame();
+    }
+    CHECK(!next_buffer && !uploads && !watch_reads && !protections && !stats.mirrored_bytes);
+    fprintf(stderr, "bypassed=4800 allocations=0 uploads=0 watch_reads=0 protections=0\n");
+    return 0;
+#endif
+    write_pages(0, 1, 1);
+    CHECK(draw_pages(0, 1));
+    CHECK(watch_reads && protections);
+    next_frame();
+    /* An ordinary reused allocation: some previously mirrored pages and
+    some first-time pages. 300 pages also crosses the 256-page refresh chunk. */
+    write_pages(0, 300, 2);
+    CHECK(draw_pages(0, 300));
+    CHECK(draw_pages(0, 1));
+    next_frame();
+    write_pages(300, 1, 3);
+    CHECK(draw_pages(300, 1));
+    next_frame();
+    write_pages(301, 1, 4);
+    CHECK(draw_pages(301, 1));
+    /* A different segment has no pending preservation copy. */
+    write_pages(1024, 1, 5);
+    CHECK(draw_pages(1024, 1));
+    CHECK(!draw_pages(1023, 2)); /* segment boundary streams instead */
+    for (index = 0; index < STREAM_BUFFER_RING; index++) next_frame();
+    index = mapped;
+    write_pages(302, 1, 6);
+    CHECK(draw_pages(302, 1));
+#if defined(HALO_ANDROID) || defined(TEST_DESKTOP)
+    CHECK(mapped == 0); /* every persistent-cache upload is ordered */
+#else
+    CHECK(mapped == index + 1); /* fast path returns after the fence */
+#endif
+    complete(submitted);
+    old_uploads = uploads;
+    /* CPU generations are unchanged: any GPU damage is retained. */
+    for (index = 0; index < 1200; index++)
+    {
+        CHECK(draw_pages(256, 1));
+        next_frame();
+    }
+    complete(submitted);
+    CHECK(uploads == old_uploads);
+    fprintf(stderr, "mapped=%u subdata=%u overlaps=%u bad_draws=%u draws=%u repair_uploads=%u\n",
+        mapped, subdata, overlaps, mismatches, draws, uploads - old_uploads);
+    for (index = 0; index < 2; index++) free(stores[index]);
+    CHECK(overlaps == 0 && mismatches == 0);
+    return 0;
+}

port/assets/buttons/buttons.json

@@ -0,0 +1,526 @@
+{
+ "assets": [
+  {
+   "name": "a_butn__0",
+   "tag": "ui\\shell\\bitmaps\\a_butn",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 1140253829,
+   "svg": "a_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ],
+   "letter": [
+    -0.006,
+    0.0
+   ]
+  },
+  {
+   "name": "b_butn__0",
+   "tag": "ui\\shell\\bitmaps\\b_butn",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 2900806204,
+   "svg": "b_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ],
+   "letter": [
+    0.001,
+    0.002
+   ]
+  },
+  {
+   "name": "x_butn__0",
+   "tag": "ui\\shell\\bitmaps\\x_butn",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 2247463469,
+   "svg": "x_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ],
+   "letter": [
+    -0.002,
+    -0.008
+   ]
+  },
+  {
+   "name": "y_butn__0",
+   "tag": "ui\\shell\\bitmaps\\y_butn",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 783963872,
+   "svg": "y_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ],
+   "letter": [
+    -0.009,
+    0.028
+   ]
+  },
+  {
+   "name": "a_butn_sm__0",
+   "tag": "ui\\shell\\bitmaps\\a_butn_sm",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "a8r8g8b8",
+   "scale": 8,
+   "crc": 2356213272,
+   "svg": "a_butn.svg",
+   "place": [
+    0.7702,
+    -0.222,
+    -0.272
+   ],
+   "letter": [
+    0.014,
+    0.071
+   ]
+  },
+  {
+   "name": "b_butn_sm__0",
+   "tag": "ui\\shell\\bitmaps\\b_butn_sm",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "a8r8g8b8",
+   "scale": 8,
+   "crc": 3999851658,
+   "svg": "b_butn.svg",
+   "place": [
+    0.7677,
+    -0.14,
+    -0.225
+   ],
+   "letter": [
+    -0.054,
+    0.062
+   ]
+  },
+  {
+   "name": "hud_msg_icons_sm__0",
+   "tag": "ui\\hud\\bitmaps\\hud_msg_icons_sm",
+   "bitmap": 0,
+   "width": 128,
+   "height": 128,
+   "format": "a8y8",
+   "scale": 8,
+   "crc": 2908635490,
+   "sprites": [
+    {
+     "sequence": 0,
+     "cell": [
+      68,
+      21,
+      84,
+      41
+     ],
+     "svg": "a_butn.svg",
+     "place": [
+      0.7063,
+      1.04,
+      1.026
+     ],
+     "letter": [
+      0.119,
+      0.079
+     ]
+    },
+    {
+     "sequence": 1,
+     "cell": [
+      103,
+      0,
+      119,
+      20
+     ],
+     "svg": "b_butn.svg",
+     "place": [
+      0.681,
+      1.667,
+      1.601
+     ],
+     "letter": [
+      0.474,
+      0.082
+     ]
+    },
+    {
+     "sequence": 2,
+     "cell": [
+      71,
+      0,
+      87,
+      20
+     ],
+     "svg": "x_butn.svg",
+     "place": [
+      0.6987,
+      1.023,
+      1.294
+     ],
+     "letter": [
+      0.235,
+      1.718
+     ]
+    },
+    {
+     "sequence": 3,
+     "cell": [
+      87,
+      0,
+      103,
+      20
+     ],
+     "svg": "y_butn.svg",
+     "place": [
+      0.6992,
+      1.071,
+      1.29
+     ],
+     "letter": [
+      -0.306,
+      1.601
+     ]
+    }
+   ]
+  },
+  {
+   "name": "black_butn__0",
+   "tag": "ui\\shell\\bitmaps\\black_butn",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "svg": "black_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ]
+  },
+  {
+   "name": "white_butn__0",
+   "tag": "ui\\shell\\bitmaps\\white_butn",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "svg": "white_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ]
+  },
+  {
+   "name": "classic_a__0",
+   "tag": "ui\\hud\\buttons\\classic_a",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "svg": "a_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ],
+   "classic": "#40eb40",
+   "letter": [
+    0.1685,
+    0.1119
+   ]
+  },
+  {
+   "name": "classic_b__0",
+   "tag": "ui\\hud\\buttons\\classic_b",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "svg": "b_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ],
+   "classic": "#fa5946",
+   "letter": [
+    0.696,
+    0.1204
+   ]
+  },
+  {
+   "name": "classic_x__0",
+   "tag": "ui\\hud\\buttons\\classic_x",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "svg": "x_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ],
+   "classic": "#3998fa",
+   "letter": [
+    0.3363,
+    2.4589
+   ]
+  },
+  {
+   "name": "classic_y__0",
+   "tag": "ui\\hud\\buttons\\classic_y",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "svg": "y_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ],
+   "classic": "#f9e928",
+   "letter": [
+    -0.4376,
+    2.2898
+   ]
+  },
+  {
+   "name": "classic_black__0",
+   "tag": "ui\\hud\\buttons\\classic_black",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "svg": "black_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ],
+   "classic": "#000000"
+  },
+  {
+   "name": "classic_white__0",
+   "tag": "ui\\hud\\buttons\\classic_white",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "svg": "white_butn.svg",
+   "place": [
+    1,
+    0,
+    0
+   ],
+   "classic": "#ffffff"
+  },
+  {
+   "name": "gem_a__0",
+   "tag": "ui\\hud\\buttons\\gem_a",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/a_gem.png"
+  },
+  {
+   "name": "gem_b__0",
+   "tag": "ui\\hud\\buttons\\gem_b",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/b_gem.png"
+  },
+  {
+   "name": "gem_x__0",
+   "tag": "ui\\hud\\buttons\\gem_x",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/x_gem.png"
+  },
+  {
+   "name": "gem_y__0",
+   "tag": "ui\\hud\\buttons\\gem_y",
+   "bitmap": 0,
+   "width": 32,
+   "height": 32,
+   "format": "dxt3",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/y_gem.png"
+  },
+  {
+   "name": "trigger_left__0",
+   "tag": "ui\\hud\\buttons\\trigger_left",
+   "bitmap": 0,
+   "width": 64,
+   "height": 64,
+   "format": "a8r8g8b8",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/trigger_left.png",
+   "control_cell": [
+    50,
+    35
+   ]
+  },
+  {
+   "name": "trigger_right__0",
+   "tag": "ui\\hud\\buttons\\trigger_right",
+   "bitmap": 0,
+   "width": 64,
+   "height": 64,
+   "format": "a8r8g8b8",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/trigger_right.png",
+   "control_cell": [
+    50,
+    35
+   ]
+  },
+  {
+   "name": "thumbstick_left__0",
+   "tag": "ui\\hud\\buttons\\thumbstick_left",
+   "bitmap": 0,
+   "width": 64,
+   "height": 64,
+   "format": "a8r8g8b8",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/thumbstick_left.png",
+   "control_cell": [
+    36,
+    40
+   ]
+  },
+  {
+   "name": "thumbstick_right__0",
+   "tag": "ui\\hud\\buttons\\thumbstick_right",
+   "bitmap": 0,
+   "width": 64,
+   "height": 64,
+   "format": "a8r8g8b8",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/thumbstick_right.png",
+   "control_cell": [
+    36,
+    40
+   ]
+  },
+  {
+   "name": "thumbstick-halfway_left__0",
+   "tag": "ui\\hud\\buttons\\thumbstick-halfway_left",
+   "bitmap": 0,
+   "width": 64,
+   "height": 64,
+   "format": "a8r8g8b8",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/thumbstick-halfway_left.png",
+   "control_cell": [
+    36,
+    40
+   ]
+  },
+  {
+   "name": "thumbstick-halfway_right__0",
+   "tag": "ui\\hud\\buttons\\thumbstick-halfway_right",
+   "bitmap": 0,
+   "width": 64,
+   "height": 64,
+   "format": "a8r8g8b8",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/thumbstick-halfway_right.png",
+   "control_cell": [
+    36,
+    40
+   ]
+  },
+  {
+   "name": "thumbstick-full_left__0",
+   "tag": "ui\\hud\\buttons\\thumbstick-full_left",
+   "bitmap": 0,
+   "width": 64,
+   "height": 64,
+   "format": "a8r8g8b8",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/thumbstick-full_left.png",
+   "control_cell": [
+    36,
+    40
+   ]
+  },
+  {
+   "name": "thumbstick-full_right__0",
+   "tag": "ui\\hud\\buttons\\thumbstick-full_right",
+   "bitmap": 0,
+   "width": 64,
+   "height": 64,
+   "format": "a8r8g8b8",
+   "scale": 8,
+   "crc": 0,
+   "source_png": "source/thumbstick-full_right.png",
+   "control_cell": [
+    36,
+    40
+   ]
+  }
+ ]
+}

port/assets/buttons/svg/a_butn.svg

@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
+<!-- The A button of the menus' button keys (ui\shell\bitmaps\a_butn), redrawn: drawn
+in the 32x32 bitmap's texels, where its art is (tools/button_assets.py). A tilted
+green oval, dark at the top and bright at the bottom, with a pale rim, and its
+letter in white, upright from its baseline and slanted. -->
+<defs>
+<!-- (along the oval's long axis, top to bottom) -->
+<linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="-12.932" x2="0" y2="12.932">
+<stop offset="0" stop-color="#08370f"/>
+<stop offset="0.5" stop-color="#056a1c"/>
+<stop offset="1" stop-color="#0a9924"/>
+</linearGradient>
+<linearGradient id="rim" gradientUnits="userSpaceOnUse" x1="0" y1="-12.932" x2="0" y2="12.932">
+<stop offset="0" stop-color="#ffffff" stop-opacity="0.74"/>
+<stop offset="1" stop-color="#ffffff" stop-opacity="0.73"/>
+</linearGradient>
+</defs>
+<g transform="translate(10.341 12.879) rotate(-26.459)">
+<ellipse id="oval" rx="8.659" ry="12.932" fill="url(#body)"/>
+<ellipse rx="8.082" ry="12.355" fill="none" stroke="url(#rim)" stroke-width="1.154"/>
+</g>
+<path id="letter" transform="matrix(1 0 -0.185 1 9.644 16.929)" fill="#ffffff"
+d="M-1.508,-11.229 L0.746,-11.229 L-3.038,0.000 L-5.292,0.000 Z M5.292,0.000 L3.038,0.000 L-0.746,-11.229 L1.508,-11.229 Z M-2.739,-4.232 L2.739,-4.232 L3.285,-2.613 L-3.285,-2.613 Z"/>
+</svg>

port/assets/buttons/svg/b_butn.svg

@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
+<!-- The B button of the menus' button keys (ui\shell\bitmaps\b_butn), redrawn: drawn
+in the 32x32 bitmap's texels, where its art is (tools/button_assets.py). A tilted
+red oval, dark at the top and bright at the bottom, with a pale rim, and its
+letter in white, upright from its baseline and slanted. -->
+<defs>
+<!-- (along the oval's long axis, top to bottom) -->
+<linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="-13.053" x2="0" y2="13.053">
+<stop offset="0" stop-color="#660f13"/>
+<stop offset="0.5" stop-color="#b50000"/>
+<stop offset="1" stop-color="#ff0200"/>
+</linearGradient>
+<linearGradient id="rim" gradientUnits="userSpaceOnUse" x1="0" y1="-13.053" x2="0" y2="13.053">
+<stop offset="0" stop-color="#ffffff" stop-opacity="0.72"/>
+<stop offset="1" stop-color="#ffffff" stop-opacity="0.79"/>
+</linearGradient>
+</defs>
+<g transform="translate(10.193 12.921) rotate(-27.868)">
+<ellipse id="oval" rx="9.041" ry="13.053" fill="url(#body)"/>
+<ellipse rx="8.452" ry="12.464" fill="none" stroke="url(#rim)" stroke-width="1.178"/>
+</g>
+<path id="letter" transform="matrix(1 0 -0.185 1 3.807 16.894)" fill="#ffffff"
+d="M0.000,-11.283 L5.649,-11.283 A3.265,3.265 0 0 1 8.914,-8.018 A3.265,3.265 0 0 1 5.649,-4.753 L0.000,-4.753 Z M0.000,-6.538 L6.095,-6.538 A3.238,3.238 0 0 1 9.333,-3.300 L9.333,-3.238 A3.238,3.238 0 0 1 6.095,0.000 L0.000,0.000 Z M2.188,-9.498 L2.188,-6.538 L5.246,-6.538 A1.480,1.480 0 0 0 6.726,-8.018 A1.480,1.480 0 0 0 5.246,-9.498 Z M2.188,-4.753 L2.188,-1.785 L6.095,-1.785 A1.050,1.050 0 0 0 7.145,-2.835 L7.145,-3.704 A1.050,1.050 0 0 0 6.095,-4.753 Z"/>
+</svg>

port/assets/buttons/svg/black_butn.svg

@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
+
+<!-- Original Xbox black button, derived from the OpenCE button redraw. -->
+<defs>
+
+<linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="-12.932" x2="0" y2="12.932">
+<stop offset="0" stop-color="#050505"/>
+<stop offset="0.5" stop-color="#202020"/>
+<stop offset="1" stop-color="#454545"/>
+</linearGradient>
+<linearGradient id="rim" gradientUnits="userSpaceOnUse" x1="0" y1="-12.932" x2="0" y2="12.932">
+<stop offset="0" stop-color="#ffffff" stop-opacity="0.74"/>
+<stop offset="1" stop-color="#ffffff" stop-opacity="0.73"/>
+</linearGradient>
+</defs>
+<g transform="translate(10.341 12.879) rotate(-26.459)">
+<ellipse id="oval" rx="8.659" ry="12.932" fill="url(#body)"/>
+<ellipse rx="8.082" ry="12.355" fill="none" stroke="url(#rim)" stroke-width="1.154"/>
+</g>
+
+</svg>

port/assets/buttons/svg/white_butn.svg

@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
+
+<!-- Original Xbox white button, derived from the OpenCE button redraw. -->
+<defs>
+
+<linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="-12.932" x2="0" y2="12.932">
+<stop offset="0" stop-color="#999999"/>
+<stop offset="0.5" stop-color="#dddddd"/>
+<stop offset="1" stop-color="#ffffff"/>
+</linearGradient>
+<linearGradient id="rim" gradientUnits="userSpaceOnUse" x1="0" y1="-12.932" x2="0" y2="12.932">
+<stop offset="0" stop-color="#ffffff" stop-opacity="0.74"/>
+<stop offset="1" stop-color="#ffffff" stop-opacity="0.73"/>
+</linearGradient>
+</defs>
+<g transform="translate(10.341 12.879) rotate(-26.459)">
+<ellipse id="oval" rx="8.659" ry="12.932" fill="url(#body)"/>
+<ellipse rx="8.082" ry="12.355" fill="none" stroke="url(#rim)" stroke-width="1.154"/>
+</g>
+
+</svg>

port/assets/buttons/svg/x_butn.svg

@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
+<!-- The X button of the menus' button keys (ui\shell\bitmaps\x_butn), redrawn: drawn
+in the 32x32 bitmap's texels, where its art is (tools/button_assets.py). A tilted
+blue oval, dark at the top and bright at the bottom, with a pale rim, and its
+letter in white, upright from its baseline and slanted. -->
+<defs>
+<!-- (along the oval's long axis, top to bottom) -->
+<linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="-12.932" x2="0" y2="12.932">
+<stop offset="0" stop-color="#0d1c3d"/>
+<stop offset="0.5" stop-color="#08266c"/>
+<stop offset="1" stop-color="#05349d"/>
+</linearGradient>
+<linearGradient id="rim" gradientUnits="userSpaceOnUse" x1="0" y1="-12.932" x2="0" y2="12.932">
+<stop offset="0" stop-color="#ffffff" stop-opacity="0.75"/>
+<stop offset="1" stop-color="#ffffff" stop-opacity="0.74"/>
+</linearGradient>
+</defs>
+<g transform="translate(10.341 12.879) rotate(-26.459)">
+<ellipse id="oval" rx="8.659" ry="12.932" fill="url(#body)"/>
+<ellipse rx="8.082" ry="12.355" fill="none" stroke="url(#rim)" stroke-width="1.154"/>
+</g>
+<path id="letter" transform="matrix(1 0 -0.185 1 8.621 16.043)" fill="#ffffff"
+d="M-4.981,-10.970 L-2.302,-10.970 L5.237,0.000 L2.558,0.000 Z M2.302,-10.970 L4.981,-10.970 L-2.558,0.000 L-5.237,0.000 Z"/>
+</svg>

port/assets/buttons/svg/y_butn.svg

@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
+<!-- The Y button of the menus' button keys (ui\shell\bitmaps\y_butn), redrawn: drawn
+in the 32x32 bitmap's texels, where its art is (tools/button_assets.py). A tilted
+yellow oval, dark at the top and bright at the bottom, with a pale rim, and its
+letter in white, upright from its baseline and slanted,
+casting a dark shadow down and to the right. -->
+<defs>
+<!-- (along the oval's long axis, top to bottom) -->
+<linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="-12.932" x2="0" y2="12.932">
+<stop offset="0" stop-color="#504505"/>
+<stop offset="0.5" stop-color="#bb7c03"/>
+<stop offset="1" stop-color="#ffbc00"/>
+</linearGradient>
+<linearGradient id="rim" gradientUnits="userSpaceOnUse" x1="0" y1="-12.932" x2="0" y2="12.932">
+<stop offset="0" stop-color="#ffffff" stop-opacity="0.71"/>
+<stop offset="1" stop-color="#ffffff" stop-opacity="0.63"/>
+</linearGradient>
+</defs>
+<g transform="translate(10.341 12.879) rotate(-26.459)">
+<ellipse id="oval" rx="8.659" ry="12.932" fill="url(#body)"/>
+<ellipse rx="8.082" ry="12.355" fill="none" stroke="url(#rim)" stroke-width="1.154"/>
+</g>
+<path id="shadow" transform="matrix(1 0 -0.185 1 10.387 16.978)" fill="#3c1e00" fill-opacity="0.60"
+d="M-5.184,-11.167 L-2.927,-11.167 L1.047,-4.308 L-1.047,-4.308 Z M2.927,-11.167 L5.184,-11.167 L1.047,-4.308 L-1.047,-4.308 Z M-1.047,-4.908 L1.047,-4.908 L1.047,0.000 L-1.047,0.000 Z"/>
+<path id="letter" transform="matrix(1 0 -0.185 1 8.887 15.778)" fill="#ffffff"
+d="M-5.184,-11.167 L-2.927,-11.167 L1.047,-4.308 L-1.047,-4.308 Z M2.927,-11.167 L5.184,-11.167 L1.047,-4.308 L-1.047,-4.308 Z M-1.047,-4.908 L1.047,-4.908 L1.047,0.000 L-1.047,0.000 Z"/>
+</svg>

port/assets/hud/ce_layout.json

@@ -0,0 +1,317 @@
+{
+ "assets": [
+  {
+   "name": "ce_hud_unit_meters",
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_unit_meters",
+   "bitmap": 0,
+   "scale": 4,
+   "format": "a8r8g8b8",
+   "ce_only": true,
+   "cells": [
+    {
+     "source": "hud_unit_meters__0",
+     "from": [
+      20,
+      288,
+      958,
+      505
+     ],
+     "to": [
+      23.0,
+      136.0,
+      257.5,
+      190.25
+     ],
+     "alignment": {
+      "anchor": "top_right",
+      "xbox_sprite": [
+       122,
+       34
+      ],
+      "ce_sprite": [
+       262,
+       132
+      ],
+      "pixels_per_xbox_texel": 8,
+      "ce_resolution": 2
+     }
+    },
+    {
+     "source": "hud_unit_meters__0",
+     "from": [
+      1141,
+      16,
+      1904,
+      129
+     ],
+     "to": [
+      271.0,
+      2.0,
+      366.0,
+      16.0
+     ]
+    },
+    {
+     "source": "hud_unit_meters__0",
+     "from": [
+      714,
+      527,
+      1403,
+      625
+     ],
+     "to": [
+      84.5,
+      199.75,
+      256.75,
+      224.25
+     ],
+     "alignment": {
+      "anchor": "top_right",
+      "xbox_sprite": [
+       176,
+       65
+      ],
+      "ce_sprite": [
+       258,
+       198
+      ],
+      "pixels_per_xbox_texel": 8,
+      "ce_resolution": 2
+     }
+    },
+    {
+     "source": "hud_unit_meters__0",
+     "from": [
+      68,
+      527,
+      684,
+      577
+     ],
+     "to": [
+      389.0,
+      1.0,
+      466.0,
+      7.0
+     ]
+    },
+    {
+     "source": "hud_unit_meters__0",
+     "from": [
+      132,
+      648,
+      923,
+      688
+     ],
+     "to": [
+      33.0,
+      251.0,
+      237.0,
+      262.0
+     ]
+    },
+    {
+     "source": "hud_unit_meters__0",
+     "from": [
+      1085,
+      400,
+      1803,
+      416
+     ],
+     "to": [
+      271.0,
+      67.0,
+      364.0,
+      71.0
+     ]
+    },
+    {
+     "source": "hud_unit_meters__0",
+     "from": [
+      5,
+      95,
+      799,
+      193
+     ],
+     "to": [
+      15.0,
+      84.0,
+      169.0,
+      103.0
+     ]
+    },
+    {
+     "source": "hud_unit_meters__0",
+     "from": [
+      981,
+      279,
+      1670,
+      377
+     ],
+     "to": [
+      14.0,
+      3.0,
+      153.0,
+      22.0
+     ]
+    }
+   ],
+   "width": 512,
+   "height": 512,
+   "size": 262144,
+   "crc": 3491893663,
+   "coverage": true,
+   "point_threshold": true
+  },
+  {
+   "name": "ce_hud_ammo_meters",
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_meters",
+   "bitmap": 0,
+   "scale": 4,
+   "format": "a8r8g8b8",
+   "ce_only": true,
+   "cells": [
+    {
+     "source": "hud_ammo_meters__0",
+     "from": [
+      0,
+      504,
+      830,
+      616
+     ],
+     "to": [
+      2.0,
+      122.0,
+      208.0,
+      151.0
+     ]
+    },
+    {
+     "source": "hud_ammo_meters__0",
+     "from": [
+      7,
+      11,
+      898,
+      208
+     ],
+     "to": [
+      1.0,
+      2.0,
+      225.0,
+      51.0
+     ]
+    },
+    {
+     "source": "hud_ammo_meters__0",
+     "from": [
+      1048,
+      224,
+      1903,
+      352
+     ],
+     "to": [
+      268.0,
+      54.0,
+      469.0,
+      86.0
+     ]
+    },
+    {
+     "source": "hud_ammo_meters__0",
+     "from": [
+      848,
+      504,
+      1672,
+      592
+     ],
+     "to": [
+      211.0,
+      122.0,
+      417.0,
+      145.0
+     ]
+    },
+    {
+     "source": "hud_ammo_meters__0",
+     "from": [
+      872,
+      368,
+      1740,
+      488
+     ],
+     "to": [
+      216.0,
+      89.0,
+      434.0,
+      120.0
+     ]
+    },
+    {
+     "source": "hud_ammo_meters__0",
+     "from": [
+      4,
+      368,
+      855,
+      484
+     ],
+     "to": [
+      2.0,
+      89.0,
+      214.0,
+      119.0
+     ]
+    },
+    {
+     "source": "hud_ammo_meters__0",
+     "from": [
+      920,
+      8,
+      1756,
+      168
+     ],
+     "to": [
+      245.0,
+      2.0,
+      431.0,
+      41.0
+     ]
+    },
+    {
+     "source": "hud_ammo_meters__0",
+     "from": [
+      14,
+      224,
+      887,
+      352
+     ],
+     "to": [
+      2.0,
+      54.0,
+      219.0,
+      87.0
+     ]
+    },
+    {
+     "source": "hud_ammo_meters__0",
+     "from": [
+      18,
+      632,
+      835,
+      664
+     ],
+     "to": [
+      2.0,
+      153.0,
+      187.0,
+      162.0
+     ]
+    }
+   ],
+   "width": 512,
+   "height": 512,
+   "size": 1048576,
+   "crc": 1316117604,
+   "coverage": true,
+   "point_threshold": true
+  }
+ ]
+}

port/assets/hud/ce_stock.json

@@ -0,0 +1,82 @@
+{
+ "resource_sha256": "317658e0ebd4aa189bac68e994fe0b515928f44d17b62ba676d8850aa329dd3d",
+ "bitmaps": [
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds", "bitmap": 0, "width": 128, "height": 32, "size": 16384, "crc": 2336761448},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds", "bitmap": 1, "width": 128, "height": 32, "size": 16384, "crc": 1382921092},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds", "bitmap": 2, "width": 128, "height": 32, "size": 16384, "crc": 2368424546},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds", "bitmap": 3, "width": 128, "height": 128, "size": 65536, "crc": 2101251412},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds", "bitmap": 4, "width": 64, "height": 64, "size": 16384, "crc": 1083921210},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines", "bitmap": 0, "width": 128, "height": 32, "size": 4096, "crc": 2685300349},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines", "bitmap": 1, "width": 128, "height": 8, "size": 1024, "crc": 2768572645},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines", "bitmap": 2, "width": 128, "height": 32, "size": 4096, "crc": 4194268279},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines", "bitmap": 3, "width": 128, "height": 32, "size": 4096, "crc": 1151077783},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons", "bitmap": 0, "width": 32, "height": 16, "size": 2048, "crc": 3757329756},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons", "bitmap": 1, "width": 64, "height": 16, "size": 4096, "crc": 1699380589},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons", "bitmap": 2, "width": 32, "height": 16, "size": 2048, "crc": 1250297732},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons", "bitmap": 3, "width": 32, "height": 16, "size": 2048, "crc": 1096370127},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons", "bitmap": 4, "width": 32, "height": 16, "size": 2048, "crc": 1461299380},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_msg_icons", "bitmap": 0, "width": 128, "height": 128, "size": 65536, "crc": 634647465},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_msg_icons", "bitmap": 1, "width": 128, "height": 128, "size": 65536, "crc": 2663295025},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_msg_icons", "bitmap": 2, "width": 128, "height": 128, "size": 65536, "crc": 4013307535},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_msg_icons", "bitmap": 3, "width": 128, "height": 128, "size": 65536, "crc": 1215291247},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_msg_icons", "bitmap": 4, "width": 128, "height": 128, "size": 65536, "crc": 4173016642},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_waypoints", "bitmap": 0, "width": 128, "height": 128, "size": 65536, "crc": 1547299393},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 0, "width": 128, "height": 128, "size": 65536, "crc": 2514937598},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 1, "width": 64, "height": 64, "size": 16384, "crc": 1934334840},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 2, "width": 64, "height": 64, "size": 16384, "crc": 2036152485},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 3, "width": 64, "height": 64, "size": 16384, "crc": 1222075981},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 4, "width": 64, "height": 64, "size": 16384, "crc": 3524091297},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 5, "width": 64, "height": 64, "size": 16384, "crc": 1478490245},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 6, "width": 64, "height": 64, "size": 16384, "crc": 2425719365},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 7, "width": 64, "height": 64, "size": 16384, "crc": 2841977525},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 8, "width": 64, "height": 64, "size": 16384, "crc": 1789610607},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 9, "width": 64, "height": 64, "size": 16384, "crc": 10769595},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 10, "width": 64, "height": 64, "size": 16384, "crc": 112721360},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 11, "width": 64, "height": 64, "size": 16384, "crc": 1500905970},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 12, "width": 64, "height": 64, "size": 16384, "crc": 2831607766},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 13, "width": 64, "height": 64, "size": 16384, "crc": 3213345147},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticle_warnings", "bitmap": 0, "width": 128, "height": 128, "size": 65536, "crc": 598528602},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_damage_arrows", "bitmap": 0, "width": 256, "height": 256, "size": 262144, "crc": 4014689458},
+  {"tag": "ui\\hud\\bitmaps\\hud_sweeper", "bitmap": 0, "width": 64, "height": 64, "size": 4096, "crc": 1530348706},
+  {"tag": "ui\\hud\\bitmaps\\hud_sweeper_mask", "bitmap": 0, "width": 64, "height": 64, "size": 4096, "crc": 3264958306},
+  {"tag": "ui\\hud\\bitmaps\\hud_multiplayer", "bitmap": 0, "width": 64, "height": 32, "size": 2048, "crc": 279669690},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_counter_numbers", "bitmap": 0, "width": 128, "height": 128, "size": 65536, "crc": 22576901},
+  {"tag": "ui\\hud\\bitmaps\\hud_sensor_blip", "bitmap": 0, "width": 32, "height": 32, "size": 1024, "crc": 2905414509},
+  {"tag": "ui\\hud\\bitmaps\\hud_sensor_blip_custom", "bitmap": 0, "width": 32, "height": 32, "size": 512, "crc": 2318551224},
+  {"tag": "ui\\hud\\bitmaps\\hud_msg_icons_sm", "bitmap": 0, "width": 128, "height": 128, "size": 65536, "crc": 2829841605},
+  {"tag": "ui\\hud\\bitmaps\\hud_msg_icons_sm", "bitmap": 1, "width": 128, "height": 128, "size": 65536, "crc": 2261388858},
+  {"tag": "ui\\hud\\bitmaps\\hud_health_base", "bitmap": 0, "width": 128, "height": 32, "size": 8192, "crc": 2334111445},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_alphas", "bitmap": 0, "width": 512, "height": 512, "size": 1048576, "crc": 2672369332},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_meters", "bitmap": 0, "width": 512, "height": 512, "size": 1048576, "crc": 1316117604},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\hud_reticles_scope", "bitmap": 0, "width": 64, "height": 64, "size": 16384, "crc": 3359213591},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2", "bitmap": 0, "width": 64, "height": 256, "size": 65536, "crc": 2440566533},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2", "bitmap": 1, "width": 64, "height": 256, "size": 65536, "crc": 1451459225},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2", "bitmap": 2, "width": 128, "height": 8, "size": 4096, "crc": 2199832653},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2", "bitmap": 3, "width": 128, "height": 8, "size": 4096, "crc": 1036536086},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2", "bitmap": 4, "width": 8, "height": 128, "size": 4096, "crc": 3263269116},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm", "bitmap": 0, "width": 32, "height": 128, "size": 16384, "crc": 703763697},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm", "bitmap": 1, "width": 32, "height": 128, "size": 16384, "crc": 183991369},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm", "bitmap": 2, "width": 128, "height": 4, "size": 2048, "crc": 2030486740},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm", "bitmap": 3, "width": 128, "height": 4, "size": 2048, "crc": 1345205876},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm", "bitmap": 4, "width": 4, "height": 64, "size": 1024, "crc": 1676080439},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\caption", "bitmap": 0, "width": 128, "height": 128, "size": 65536, "crc": 120126724},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_mask2", "bitmap": 0, "width": 512, "height": 256, "size": 524288, "crc": 2575239539},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_mask_sm", "bitmap": 0, "width": 256, "height": 256, "size": 262144, "crc": 2593381205},
+  {"tag": "ui\\hud\\bitmaps\\pistol\\pistol_scope_mask", "bitmap": 0, "width": 256, "height": 256, "size": 262144, "crc": 1764629049},
+  {"tag": "ui\\hud\\bitmaps\\pistol\\pistol_scope_mask split", "bitmap": 0, "width": 256, "height": 256, "size": 262144, "crc": 343664195},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 0, "width": 256, "height": 64, "size": 65536, "crc": 3748199011},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 1, "width": 128, "height": 32, "size": 16384, "crc": 550837563},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 2, "width": 256, "height": 32, "size": 32768, "crc": 2456043857},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 3, "width": 256, "height": 32, "size": 32768, "crc": 1948057961},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 4, "width": 256, "height": 16, "size": 16384, "crc": 2860676839},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 5, "width": 128, "height": 8, "size": 4096, "crc": 3272812517},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 6, "width": 128, "height": 128, "size": 65536, "crc": 1984211349},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 7, "width": 64, "height": 64, "size": 16384, "crc": 1269964274},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 8, "width": 256, "height": 64, "size": 65536, "crc": 526077822},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 9, "width": 256, "height": 64, "size": 65536, "crc": 2003746041},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 10, "width": 256, "height": 64, "size": 65536, "crc": 3746007716},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 11, "width": 128, "height": 32, "size": 16384, "crc": 3375336138},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 12, "width": 256, "height": 64, "size": 65536, "crc": 4225542721},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_meters", "bitmap": 0, "width": 512, "height": 512, "size": 262144, "crc": 3491893663}
+ ]
+}

port/assets/hud/custom_edition.json

@@ -0,0 +1,68 @@
+{
+ "note": "High-res HUD textures whose bitmap has the same layout in Halo Custom Edition (the same sprites, the same size or twice it), compared against the stock bitmaps.map and bloodgulch.map; hud_hires.c draws them for a Custom Edition map's stock bitmap of that name as well.",
+ "assets": [
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines", "bitmap": 0, "width": 128, "height": 32, "size": 4096, "crc": 2685300349},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines", "bitmap": 1, "width": 128, "height": 8, "size": 1024, "crc": 2768572645},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines", "bitmap": 2, "width": 128, "height": 32, "size": 4096, "crc": 4194268279},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines", "bitmap": 3, "width": 128, "height": 32, "size": 4096, "crc": 1151077783},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons", "bitmap": 0, "width": 32, "height": 16, "size": 2048, "crc": 3757329756},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons", "bitmap": 1, "width": 64, "height": 16, "size": 4096, "crc": 1699380589},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons", "bitmap": 2, "width": 32, "height": 16, "size": 2048, "crc": 1250297732},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons", "bitmap": 3, "width": 32, "height": 16, "size": 2048, "crc": 1096370127},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons", "bitmap": 4, "width": 32, "height": 16, "size": 2048, "crc": 1461299380},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_counter_numbers", "bitmap": 0, "width": 128, "height": 128, "size": 65536, "crc": 22576901},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_damage_arrows", "bitmap": 0, "width": 256, "height": 256, "size": 262144, "crc": 4014689458},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 0, "width": 256, "height": 64, "size": 65536, "crc": 3748199011},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 1, "width": 128, "height": 32, "size": 16384, "crc": 550837563},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 2, "width": 256, "height": 32, "size": 32768, "crc": 2456043857},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 3, "width": 256, "height": 32, "size": 32768, "crc": 1948057961},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 4, "width": 256, "height": 16, "size": 16384, "crc": 2860676839},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 5, "width": 128, "height": 8, "size": 4096, "crc": 3272812517},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 6, "width": 128, "height": 128, "size": 65536, "crc": 1984211349},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds", "bitmap": 7, "width": 64, "height": 64, "size": 16384, "crc": 1269964274},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_waypoints", "bitmap": 0, "width": 128, "height": 128, "size": 65536, "crc": 1547299393},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds", "bitmap": 0, "width": 128, "height": 32, "size": 16384, "crc": 2336761448},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds", "bitmap": 1, "width": 128, "height": 32, "size": 16384, "crc": 1382921092},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds", "bitmap": 2, "width": 128, "height": 32, "size": 16384, "crc": 2368424546},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds", "bitmap": 3, "width": 128, "height": 128, "size": 65536, "crc": 2101251412},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds", "bitmap": 4, "width": 64, "height": 64, "size": 16384, "crc": 1083921210},
+  {"tag": "ui\\hud\\bitmaps\\hud_health_base", "bitmap": 0, "width": 128, "height": 32, "size": 8192, "crc": 2334111445},
+  {"tag": "ui\\hud\\bitmaps\\hud_multiplayer", "bitmap": 0, "width": 64, "height": 32, "size": 2048, "crc": 279669690},
+  {"tag": "ui\\hud\\bitmaps\\hud_sensor_blip", "bitmap": 0, "width": 32, "height": 32, "size": 1024, "crc": 2905414509},
+  {"tag": "ui\\hud\\bitmaps\\hud_sensor_blip_custom", "bitmap": 0, "width": 32, "height": 32, "size": 512, "crc": 2318551224},
+  {"tag": "ui\\hud\\bitmaps\\hud_sweeper", "bitmap": 0, "width": 64, "height": 64, "size": 4096, "crc": 1530348706},
+  {"tag": "ui\\hud\\bitmaps\\hud_sweeper_mask", "bitmap": 0, "width": 64, "height": 64, "size": 4096, "crc": 3264958306},
+  {"tag": "ui\\hud\\bitmaps\\pistol\\pistol_scope_mask", "bitmap": 0, "width": 256, "height": 256, "size": 262144, "crc": 1764629049},
+  {"tag": "ui\\hud\\bitmaps\\pistol\\pistol_scope_mask split", "bitmap": 0, "width": 256, "height": 256, "size": 262144, "crc": 343664195},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2", "bitmap": 0, "width": 64, "height": 256, "size": 65536, "crc": 2440566533},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2", "bitmap": 1, "width": 64, "height": 256, "size": 65536, "crc": 1451459225},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2", "bitmap": 2, "width": 128, "height": 8, "size": 4096, "crc": 2199832653},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2", "bitmap": 3, "width": 128, "height": 8, "size": 4096, "crc": 1036536086},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2", "bitmap": 4, "width": 8, "height": 128, "size": 4096, "crc": 3263269116},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm", "bitmap": 0, "width": 32, "height": 128, "size": 16384, "crc": 703763697},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm", "bitmap": 1, "width": 32, "height": 128, "size": 16384, "crc": 183991369},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm", "bitmap": 2, "width": 128, "height": 4, "size": 2048, "crc": 2030486740},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm", "bitmap": 3, "width": 128, "height": 4, "size": 2048, "crc": 1345205876},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm", "bitmap": 4, "width": 4, "height": 64, "size": 1024, "crc": 1676080439},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_mask2", "bitmap": 0, "width": 512, "height": 256, "size": 524288, "crc": 2575239539},
+  {"tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_mask_sm", "bitmap": 0, "width": 256, "height": 256, "size": 262144, "crc": 2593381205},
+  {"tag": "weapons\\sniper rifle\\bitmaps\\angle_ticks", "bitmap": 0, "width": 8, "height": 512, "size": 4096, "crc": 2262136367},
+  {"tag": "weapons\\sniper rifle\\bitmaps\\angle_ticks2", "bitmap": 0, "width": 8, "height": 512, "size": 4096, "crc": 2208884634},
+  {"tag": "weapons\\sniper rifle\\bitmaps\\angle_ticks_mask", "bitmap": 0, "width": 8, "height": 256, "size": 2048, "crc": 283547923},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_unit_meters", "bitmap": 0, "width": 512, "height": 512, "size": 262144, "crc": 3491893663, "replacement": "ce_hud_unit_meters"},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_meters", "bitmap": 0, "width": 512, "height": 512, "size": 1048576, "crc": 1316117604, "replacement": "ce_hud_ammo_meters"},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 0, "width": 128, "height": 128, "size": 65536, "crc": 2514937598},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 1, "width": 64, "height": 64, "size": 16384, "crc": 1934334840},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 2, "width": 64, "height": 64, "size": 16384, "crc": 2036152485},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 3, "width": 64, "height": 64, "size": 16384, "crc": 1222075981},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 4, "width": 64, "height": 64, "size": 16384, "crc": 3524091297},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 5, "width": 64, "height": 64, "size": 16384, "crc": 1478490245},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 6, "width": 64, "height": 64, "size": 16384, "crc": 2425719365},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 7, "width": 64, "height": 64, "size": 16384, "crc": 2841977525},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 8, "width": 64, "height": 64, "size": 16384, "crc": 1789610607},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 9, "width": 64, "height": 64, "size": 16384, "crc": 10769595},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 10, "width": 64, "height": 64, "size": 16384, "crc": 112721360},
+  {"tag": "ui\\hud\\bitmaps\\combined\\hud_reticles", "bitmap": 11, "width": 64, "height": 64, "size": 16384, "crc": 1500905970}
+ ],
+ "resource_sha256": "317658e0ebd4aa189bac68e994fe0b515928f44d17b62ba676d8850aa329dd3d"
+}