248 OpenCE commits (network version 25): touch controls and touch menus for
phones, single-player in-game Settings, opt-in FOV/viewmodel settings, voice
chat and votes to kick, lens flare culling, memory leak fixes (render
targets, gamepads, the Android audio stream), profiling builds, the
HALO_ANDROID split into HALO_ARM64_GUEST / HALO_GLES / HALO_ANDROID.
Conflicts and how they were resolved:
- README.md: ours kept whole. Upstream's README changes (portable build,
profiling builds) went into docs/OPENCE_README.md: upstream's new text
with our header note, links rewritten to ../ and our "made from your own
copy" wording.
- port/android/README.md: both merged; upstream's touch, WSL and save
notes taken, with our application id in every adb path; our VR section,
signing.properties and wording kept; the stale "How it works" list
dropped as upstream dropped it.
- Launcher icons (mipmap-*/ic_launcher_foreground.png, art/android-icon.png):
ours (the Ringfall art). Upstream's helmet monochrome layers,
drawable/ic_launcher_background.xml and its ic_launcher.xml were left out;
our ic_launcher.xml, values/ic_launcher_background.xml and
tools/android_icon.py stay. (port/assets/icon and tools/app_icon.py come
in for the desktop builds' window icon only; do not run app_icon.py, it
would write the helmet into the Android resources.)
- port/android/host/host_main.c: both config helpers kept, and upstream's
emulator write tracking (native_bridge_active); upstream's display width
block dropped in favour of ours (640 in VR) and its display density for
the touch controls moved into our flat (non-VR) branch.
- port/linux/game/menu_functions.c: platform_text_field(typing, password)
from upstream; the VR keyboard launch for text fields kept after it.
- port/linux/game/network_distributed.c: upstream's profile_scope wrappers,
with network_vr_tick and bots_tick kept in their places.
- port/linux/src/dsound_sdl.c: both (our debug.audio_log, upstream's
audio.output_device).
- port/linux/src/port_config.c: our temp-and-rename config write kept,
under upstream's HALO_ARM64_GUEST (it is guest file I/O).
- port/linux/src/sdl_platform.c/.h: upstream's (Android menu pointer from
the touchscreen, Steam keyboard, scoreboard pointer); our quit marker for
the Steam Frame launcher, clipboard_seen and VR frame hooks kept. Our
flat-mouse menu pointer (an emulator aid) is replaced by upstream's touch
pointer, which also drives the menus on the emulator.
- port/linux/src/d3d8_gl.c: halo_ui_pointer_update is upstream's, with the
VR controller ray taking over while VR is active (the touchscreen then
is not the pointer); our persistent-buffer writes kept for stream and
index uploads, now writing upstream's exact length and under HALO_GLES
like the code around them (stream_reserve, index_upload, mirror_refresh
too); multiview uniforms stay under HALO_ANDROID, the counter binding
under HALO_GLES. Visibility counters: ours kept (the snapshot ring with
multiview views, host_gl_counters_snapshot) over upstream's per-frame
glCopyBufferSubData into counter_snapshots: ours reads finished frames
without stalling and counts both eyes' samples once; upstream's
desktop query batches come in unchanged.
- port/linux/src/xinput_sdl.c: both (VR controllers and touch controls).
In VR the touch controls neither show nor act (touch_input_gamepad,
touch_input_controls, touch move/look skipped); rumble goes to the
controllers in VR, to the phone otherwise.
- source/interface/first_person_weapons.c: both (VR scope pass check and
display.viewmodel_visible).
- source/interface/ui_widget.c: upstream's reworked menu targets taken
(ui_mouse_fit_button_targets, merged rows, widened values), which do
what our icon_x0 key picking and the 12-unit value arrows did; our VR
label distance (25) kept, and a VR ray counts as a coarse pointer, so it
gets the taller legend areas and the widened values (not the merged
rows: a row's label still presses A). Our join code and VR options
panels kept; their early return now forgets the frame's targets too.
The on-screen keyboard: upstream's virtual_keyboard_click for taps and
the mouse, ours (hover highlights the key) for the VR ray only.
- source/main/main.c: both (VR phases around upstream's profile scopes).
VR guards for new upstream features:
- view_fov.c: display.fov, display.viewmodel_fov and
display.viewmodel_visible do nothing while VR is active (the headset
gives each eye's frustum; the weapon is in the hand).
- Touch controls: off in VR (xinput_sdl.c), the menus' touch pointer too
(d3d8_gl.c); the overlay stays hidden as the game never reports a scene.
- Lens flare culling (744040c8, b1a71709) uses global_window_parameters'
frustum, which in VR is each eye's (per-eye passes) or the union frustum
of the multiview centre camera: no change needed.
- In-game Settings: VR options still open with Y on the main and pause
menus (checked flat with debug.vr_options).
- The back button change (enableOnBackInvokedCallback=false) keeps the
legacy KEYCODE_BACK path, which targetSdk 35 already had: no change on
Quest or Frame.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The helpers' comment is marked as the port's and says plainly what the short holds; their definitions move to the file's private code, and the plane the item is moved onto is indented inside its new surface check.
25 notes ("left unassigned only by this default arm ... approval pending,
2026-09-27 audit") argued that a variable was never read unset. Where the
arm ends in system_exit they were right and simply go. A release build's
assertions return, though, so where the arm only asserts the variable now
starts with a value (a Custom Edition map's HUD data can reach hud_draw's).
A failed map precache reads as failed.
rasterizer_debug_drawing_begin had two declarations, one with an argument
its definition never takes; it now has one, and the port's macro papering
over the mismatch is gone.
(cherry picked from commit 74f8a048e4c3cc7dbc4b050dd41a8bae912bb367)
Uninitialised locals get values (debug vertex, datastore result, index
buffer, map tool direction, AI entry points, escape alignment, grenade aim
from a vehicle, game options descriptions, unreachable switch arms), the
AI's squad and platoon records move whole, a speech cause point is read,
the geosphere's out-of-memory path frees itself, a console cond clause
without a result is refused, and the crash reporter rejects truncated map
files. Gameplay the original game has, kept so it plays the same, is noted
in a line rather than a page.
(cherry picked from commit 75afc4a1e57af2ba697e8be0e33b2afeee7639f8)
A trail's first draw asks the texture cache for its bitmap without
waiting and is skipped until the read finishes, so a weapon's first shots
could show no trail (the sniper rifle's most of all). A weapon created or
readied now asks the cache, without waiting, for the bitmaps of its
projectiles' contrails. Only the texture cache sees it: nothing in the
game state or on the network changes.
From pfista's halo-og (4e66af91), the source/items/weapons.c part only;
that commit's spawn inventory and teleport prediction changes are not
taken, as they change what a host and its clients exchange.
Co-authored-by: Michael Pfister <pfista@gmail.com>
(cherry picked from commit 7fff24d4843758ddcb6468c9f1febecfbce68aa5)
(cherry picked from commit 965f48f5c5e2063ba025766f1276467708e8112c)
Conflicts:
- d3d8_gl.c, xgpu.h: upstream's own snapshot ring for the visibility
counters left out for ours (host_gl_counters_snapshot, the same idea,
tried on both headsets, which also halves multiview's counts; its copy
already has the memory barrier upstream added); both declarations kept.
- rasterizer_xbox.c: the mirrored skinning's winding and upstream's
many-node matrices, both.
- main.c, network_server_manager.c: both (bots' machines and a lone host
may count down).
- android_build.py: the OpenXR loader and upstream's SDL mouse patch
(another SDL file than ours), both.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
render_weapon_hud set the secondary magazine's overlay flags into slots 0
and 1, over the primary's, where its states and numbers use 4 and 5: a
weapon of one magazine showed its ammunition overlays as the empty second
magazine's (coldsnap's flamethrower read NO FUEL with a full tank).
A weapon of one magazine also read a second it doesn't have:
weapon_build_weapon_interface_state fills only the weapon's own, into
unset stack memory, so the HUD's secondary flash, reload and fired-empty
warnings followed whatever was there. The state is now cleared first, and
a weapon of one magazine keeps its secondary states and overlays at rest.
Conflicts: port_config.c (both sides' debug settings), hud_weapon.c (the
VR crosshair filter before upstream's state index check),
first_person_weapons.c (the VR arms kept; upstream's animation node check
added, and its node count limit applied to the VR arms too).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A shot fired from the muzzle of the weapon in the hand was kept inside the
level by the game's test of the line from the eyes to it, which in VR runs
down through the player's own body: the test hit it and moved the shot up
towards the eyes, from where it flew parallel to the aim, a few centimetres
above the crosshair and the laser (measured: up to 7 cm at 3 m). In VR the
line is tested against the level alone (a hand through a wall still does
not fire through it); measured after: the impacts on their rays, on
average within a millimetre.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A new distributed message (_distributed_message_vr_poses, last in the
list so builds without it drop it) carries a VR player's controller aim,
muzzle offset, held grenade and last hand throw every tick: clients send
their own to the host, the host relays them with its own. Other machines
aim that player's weapon where the controller points, fire from the hand,
hold the grenade while the hand does and throw it as the hand threw it.
Damage stays the shooter's checked report; network version unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Upstream's own fixes replace two of ours: reclaiming ART's idle large
object space for the guest's fixed ranges (host_memory.c), and the audio
callback's gathering (host_sdl.c). Its consolidated headers take the VR
declarations (model_animation_definitions.h, render/render.h). The
updaters look at this repository's releases: the original's builds, made
without VR, must never replace this one (they share the package name).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The held grenade is drawn in front of the left palm (vr.grenade_right,
_forward, _up from the grip) at 0.55 of its size (vr.grenade_scale).
A hand-thrown grenade is no longer brought up to the projectile's final
velocity, which made every throw as far; strength now runs from 0.25 to
full at 5 m/s.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Shots started at an offset from the unit's eye point (its sight
position), the crosshair at the same offset from the drawn camera; the two
need not agree, and the shots ran parallel to the crosshair's line, a few
centimetres higher (plain on the pistol's small crosshair). Both now start
at the same point in the world, the drawn weapon's muzzle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With vr.aim_with = "controller" (the default), on foot:
- the unit's aiming vector comes from the right controller, while its
facing (the body, the view and the movement) keeps following the head;
- shots start at the muzzle of the weapon in the hand, kept inside the
level from the camera as before;
- the first-person weapon and hands are posed from the controller
(vr.weapon_forward/right/down place the model in the hand);
- the HUD's crosshair, which marks where the head looks, is left out, and
a laser runs from the weapon to what it aims at (vr.laser).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Import only independently reviewed production changes. Preserve canonical physics and virtual-keyboard repairs; keep B3 and all unresolved holds out.
Record exactly four approved canary debits (6987 meaningful bytes), six Halo admissions and two revocations. Keep vendor ioinit/storage work separate. Full build, 8252-row sweep, 1318 tests, park/admission/fake audits and 621-object binding pass within approved debit bounds.
Do not publish donor research dumps or private assets. README and unrelated user research remain untouched. See frontier_publication_reconciliation_20260927.md for complete evidence limits and accounting.
Independently gate storage + K, OQ-4 P-a/P-b1, four static-local packets and comment-only disclosures. Preserve all 7641 exact owner rows, 71 valid parks and 1161 passing tests; code/data credit unchanged. G and game_engine admission remain held because current canonical loses populate_statistic_buffer. Existing collision static-local repair is not duplicated. No donor tree, held candidate, scorer or private asset imported.
All packets passed a precedent audit and an independent adversarial review.
No object changes status.
- Storage per cachebeta publics (source static + symbols.json rows):
- bink_playback: four globals;
- weapons: 11 rows + weapon_magazine_finish_reload;
- object_lights: 4 helpers; should_render_lights is the /Od-attested call and
its prototype leaves the public header;
- vehicles: _update_turret_physics;
- weather_particle_systems: one_over_char_max is external (cachebeta public,
HCEX Global); its globals are static;
- rasterizer_xbox_debug: 8 D3DINLINE wrapper rows (already Matching: audit
FAIL(8) -> PASS, pdb 8 -> 0).
- draw_string: the invented external draw_string_globals aggregate (pads, blob,
#define aliases) becomes four HCEX-attested file statics in /Od declaration
order with = { 0 } (a595bbc2 precedent); typed multitexture params.
- render_debug: three rule-6 hand expansions become real point_from_line3d
calls (ruling #1/#2); the opaque vehicle view gives way to struct
vehicle_datum + vehicle_datum_try_and_get; the six debug_* toggles become
tentative definitions (COMMON evidence).
- vehicles: the TU-wide REAL_MATH_EXTERNAL_POINT_FROM_LINE3D define is gone and
the pathfinding hand expansion becomes the genuine call (ruling #1).
- rasterizer_xbox_profile V1R (reviewer-amended): byte-inert /Od parameter
order, the BUG marker comment, detail_objects via the rasterizer_xbox.h API,
and a rejection text that keeps the SDK-table policy question open.
- semantic_data_matches.json: single-section '$'-defect entries with
allow_incomplete_unit for projectiles _projectile_update_section (1,548 B) and
object_lights _lights_section (1,541 B) (leaf_map / editor_flying_camera /
race precedents).
Gate (full ninja, objdiff 3.3.1): objects 384 (unchanged), code unchanged,
data +3,089; stable diff 0 regressions; parks 83/0/0; admission 10/0/2/0; fake
scan 26; pytest 1159 passed; diff --check clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Structural lane batch 6: +1,632 padded / +1,590 meaningful bytes strict
exact (4 functions), zero stable-verdict regressions across the full
board (the header consumer sweep).
- rasterizer_geometry.h/.c: uncompress_int32_to_real_vector3d returns
real_vector3d by value. The debug build shows the struct-return copy
at all 16 call sites, and HCEX lists a single parameter. Callers in
rasterizer.c, rasterizer_lights.c and rasterizer_xbox_lights.c assign
the result directly and drop their scratch buffers. Exact:
_compress_real_vector3d_to_int32 and _clamp. The parked
_rasterizer_sun_glow_draw is re-measured (same size, fuzzy
95.815 -> 95.817).
- game/players.h: declare players_debug_render(void), a public players.c
function that render_debug.c called undeclared (C4013). Disclosure: the
by-value prototype drops one declared name, which alone flips
_rasterizer_frame_statistics_draw's field-load order. This genuine
missing prototype restores that TU's name count. Both edits are
independently evidenced and landed together; the full build shows no
regression.
- weapons.c: _weapon_magazine_finish_reload reads magazine->rounds_loaded
(/Od 0x6a4590).
- rasterizer_xbox_hardware_geometry.c: _rasterizer_triangle_buffer_new
follows the debug build (0x7eaca0), including the index-buffer Unlock
with its HRESULT check. This removes the _ReadWriteBarrier/pragma/goto
steering.
- parked.json: unpark the three newly exact parked functions.
Gate: ninja PASS, parks 109/0/0, admission 0 contradicted/0 revoked,
provider link PASS, casts and fake scan unchanged, pytest 1152 passed /
5 skipped / 26 subtests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Lane D refresh packet 1: items and projectiles, +9,856 padded bytes strict
exact (4 functions), zero stable-verdict regressions.
- items.c: _item_update exact. Removes the invented storage unions and
punning casts; uses real point_from_line3d/dot_product3d helpers and
scoped locals. January items.obj references _point_from_line3d out of
line, so the COMDAT emission meets the owner ruling.
- projectiles.c: _projectile_update, _projectile_collision and
_projectile_collision_test_line exact. Debug-build (/Od) attested shapes:
the detonation-timer case fall-through, the `(moved = TRUE) &&` condition
and the duplicate magnitude_squared3d call. January projectiles.obj
references _point_from_line3d and _collision_test_line out of line; both
COMDATs are byte-identical to January's folded copies.
- parked.json: unpark _item_update (now exact).
Gate: ninja PASS, parks 150 active / 0 stale / 0 invalid, admission 0
contradicted / 0 revoked, fake scan 0 leads, castcheck clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Integrate verified source and data progress; exclude unproven COMMON ownership, held UB/asm forms, and address-named data credit. Stable sweep: 23 exact functions gained, zero lost.
Reviewed reconstructions, each strict exact in its whole-TU gate with
zero inherited losses, guard passing and no new owners:
- _actor_move_initialize: short sense-ray index (as the sibling loop)
and direct indexed stores instead of per-iteration pointer aliases
- _decal_sprite_get_bounds: edge-relative (0.0f - registration) extents,
matching the adjacent (x1 - registration - x0) extent spelling
- _search_and_replace: single-exit result instead of an early return
- _projectile_accelerate: rotation axis/magnitude scoped to the spin
block (reopens its park)
Rejected in review: _render_ui_widgets and _render_ui_widgets_postgame
(exact only with duplicated identical should_render arms).
Stable diff vs 9062b1e96: 23 functions gained, 0 regressions; parks 261.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The owner-authorized final implementation wave worked only the ten Tier B
functions of the research campaign, each a structural defect confirmed by two
independent lenses; census first, five evidence-driven shapes at most, stop at
allocation, scheduling or x87 ties. Three closed, seven did not.
- hud _temporary_hud_draw_reticle: January does a SIGNED `% 16` (`and eax,
0x8000000f; jns; dec; or -16; inc`) where ours did `and eax,0xf`. NUMBEROF
yields size_t, so `next_point_index % NUMBEROF(points)` was an unsigned modulo;
a signed named count NUMBER_OF_TEMPORARY_HUD_RETICLE_POINTS sizes the array and
bounds the loop. It fixes the type, not a cast. The three point stores become
one set_real_point3d call (laws_w2 A4).
- weapons _weapon_can_be_fired: single-exit form (A3). It writes `result = FALSE`
in two arms, which I tested against the identical-fake-branch prohibition: the
merged `if (age >= 1.0f || chain)` spelling is residual, while January emits a
SEPARATE physical FALSE exit for the age test (`jne; pop edi; xor al,al; pop esi;
pop ebp; ret` at 0x35-0x3c) before game_engine_running is ever called. Two
distinct rejection blocks is laws_w3 A26's admission criterion, unlike the
rejected _bink_query_analog_controller_buttons, whose edges share one block.
- rasterizer_transparent_geometry _rasterizer_transparent_geometry_initialize:
single exit `success = success && aux_buffer()`. Semantics are unchanged; the
error block is the last statement before the call, so the short-circuit sits
exactly where the early return did.
All three parks removed. Not closed and reported in the wave ledgers:
_path_state_traverse, _flag_update, _bitmap_2d_sharpen, _light_volume_render,
_actor_stimulus_prop_acknowledged, _stack_memory_pool_allocate,
_particle_system_new_particle_jet.
Full ninja, parks 268 active / 0 stale / 0 invalid, stable diff vs
scratch/opus5-next150-before.json: gained 15 / 9,504 padded, regressions 0;
fake_match_scan 0 leads on all three files, matching HEAD.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Header packet from wave w3 (adversarially verified). bipeds.c called unit_animation_start_action, unit_cause_player_melee_damage, unit_update_animation (units.c owners) and weapon_stop_reload, weapon_prevents_melee_attack (weapons.c owners) through C4013 implicit declarations. Their genuine owner prototypes are added to units.h (with a struct unit_animation_update_data forward declaration) and weapons.h. With them, _biped_update (1120) is strict exact: January's case block order (moving arms before idle), the 0.1f*0.1f throttle literal (3c23d70b), and direct stores to player_melee_ticks / player_melee_attack_tick with a short melee_speedup_ticks. The header and source land in one commit because the header alone moves the parked _biped_update hash (the ninja park check would fail on an intermediate commit).
Consumer blast (76 units compiled H vs P, including units.c, vehicles.c, weapons.c): only bipeds::_biped_update and the non-exact unparked physics::_physics_update_old hash changed. Live tree: full ninja + whole-board stable sweep +1 gained / 0 regressions; park removed; parks 284/0/0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Wave w3 landing, adversarially verified. park reopens: _projectile_aim_ballistic. Full ninja build and per-function stable_verdicts sweep: 0 regressions. 1 park(s) removed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Packet P2 dependent: write the previously unwritten _weapon_place (208/4 fuzzy, sha-only residual from weapon_index/EBX liveness) using the scenario_weapon_datum owner type: clamp magazine 0 rounds to the definition maxima, set at-rest / cannot-be-garbage / does-not-accelerate flags, lift a non-at-rest weapon by 0.05. Zero strict credit. Full ninja build and stable sweep: 0 regressions.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Wave w1 landing, adversarially verified. exact: _animation_update. Full build of the combined batch: 54 strict gains / 29,440 padded, 0 regressions, parks 355/0/0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
actor_firing_blindly (actors.h), player_aim_projectile (aim_assist.h), projectile_kill_tracer (projectiles.h), unit_adjust_projectile_ray (units.h) and the remaining weapon datum flag bits. Removes the verbatim duplicate collision_surface_polygon prototype from collision_bsp.h; without that cleanup the two added declarations regress units::_unit_preprocess_node_orientations (declaration-count sensitivity, bisected). Full build with the weapons body: 0 regressions, parks clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Header prerequisite; zero credit. weapons.h is the genuine owner of both
public weapons.c APIs. weapon_estimate_time_to_target is already defined in
weapons.c; weapon_aim is January's public _weapon_aim. Signatures follow
January's call sites in actor_combat_update (nine-argument weapon_aim pushes
with the linear flag read back; three-argument estimate) and the HCEX DIA
widths recorded in actor_combat_obj_caller_closure_api_boundary_20260905.md.
Consumer audit: 19 direct includers (actors, actor_combat, aim_assist,
game_engine, game_engine_ctf, game_engine_oddball, players, player_control,
first_person_weapons, hud, hud_draw, hud_weapon, interface, weapons, objects,
object_types, bipeds, units, unit_scripting_commands). Full shadow build
passes; strict stable diff against the merged tip: 0 gains / 0 regressions;
parks 465 active / 0 stale.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+3 strict exact functions / 1,168 padded bytes: _projectile_set_action (32),
_projectile_effect_new (96) and _projectile_detonate (1,040), all previously
unwritten and emitted by their genuine January callers with the static names
from 2364150f9. Three previously unwritten bodies land as zero-credit fuzzy
source: _projectile_update (4064/179 vs 4064/179, allocator/frame-order tie),
_projectile_collision (2928/100, x87 home tie) and
_projectile_collision_test_line (496/10 vs 512/10; January's inline
point_from_line3d expansion would emit a forbidden COMDAT, so explicit math is
used).
The TU-private runtime projectile representation is preserved and no public
projectile_datum field or header changed. TU-local enums carry disclosure
comments, and the unreachable collision default uses match_vassert
(byte-identical). Adversarial review accepted all six; the three parks are
unchanged. projectiles: 24 exact / 6 residual / 0 unwritten.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
